CONFIG_DEBUG_SLAB found the following bug:
netem_enqueue() in sch_netem.c gets a pointer inside a slab object:
struct netem_skb_cb *cb = (struct netem_skb_cb *)skb->cb;
But then, the slab object may be freed:
skb = skb_unshare(skb, GFP_ATOMIC)
cb is still pointing inside the freed skb, so here is a patch to
initialize cb later, and make it clear that initializing it sooner
is a bad idea.

[From Stephen Hemminger: leave cb unitialized in order to let gcc
complain in case of use before initialization]
Signed-off-by: Guillaume Chazarain <guichaz@yahoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>

WAN: Converted synclink drivers to use netif_carrier_*() instead
of hdlc_set_carrier().
Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>

WAN: Cosmetic changes to N2 and C101 drivers
Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>

WAN: Fixed a problem with PPP/raw HDLC/X.25 protocols not doing
netif_dormant_off() at startup.
Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>

Now that we always zero the IPCB->opts in ip_rcv, it is no longer
necessary to do so before calling netif_rx for tunneled packets.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

* master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: (38 commits)
  [SCSI] More buffer->request_buffer changes
  [SCSI] mptfusion: bump version to 3.04.01
  [SCSI] mptfusion: misc fix's
  [SCSI] mptfusion: firmware download boot fix's
  [SCSI] mptfusion: task abort fix's
  [SCSI] mptfusion: sas nexus loss support
  [SCSI] mptfusion: sas loginfo update
  [SCSI] mptfusion: mptctl panic when loading
  [SCSI] mptfusion: sas enclosures with smart drive
  [SCSI] NCR_D700: misc fixes (section and argument ordering)
  [SCSI] scsi_debug: must_check fixes
  [SCSI] scsi_transport_sas: kill the use of channel 
  [SCSI] scsi_transport_sas: add expander backlink
  [SCSI] hide EH backup data outside the scsi_cmnd
  [SCSI] ibmvscsi: handle inactive SCSI target during probe
  [SCSI] ibmvscsi: allocate lpevents for ibmvscsi on iseries
  [SCSI] aic7[9x]xx: Remove last vestiges of reverse_scan
  [SCSI] aha152x: stop poking at saved scsi_cmnd members
  [SCSI] st.c: Improve sense output
  [SCSI] lpfc 8.1.7: Change version number to 8.1.7
  ...

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] sysfs_create_xxx return values.
  [S390] .align 4096 statements in head.S
  [S390] get_clock inline assembly.
  [S390] channel measurement interval display.
  [S390] xpram module parameter parsing - take 2.
  [S390] Fix gcc warning about unused return values.

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  [PATCH] spidernet: rework tx queue handling
  [PATCH] spidernet: bug fix for init code
  [PATCH] sky2: NAPI poll fix
  [NET] ethtool: fix oops by testing correct struct member
  e1000: bump version to 7.1.9-k4
  e1000: fix panic on large frame receive when mtu=default
  e1000: remove CRC bytes from measured packet length
  e1000: Redo netpoll fix to address community concerns

Take return values of sysfs_create_group & friends into account.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

SLES9 binutils don't like .align 4096 statements in head.S. Work around this
by using .org statements.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

With this patch TX queue descriptors are not chained per default any more.
The pointer to next descriptor is set only when next descriptor is prepaired
for transfer. Also the mechanism of checking wether Spider is ready has been
changed: it checks not for CARDOWNED flag in status of previous descriptor
but for a TXDMAENABLED flag in Spider's register.
Signed-off-by: Maxim Shchetynin <maxim@de.ibm.com>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Jens Osterkamp <Jens.Osterkamp@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

We want to intitialize addr instead of data register first.
Signed-off-by: Jens Osterkamp <Jens.Osterkamp@de.ibm.com>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

When sky2 driver gets lots of received packets at once, it can get stuck.
The NAPI poll routine gets called back to keep going, but since no IRQ bits
are set it doesn't make progress.

Increase version, since this is serious enough problem that I want to be
able to tell new from old problems.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Merge branch 'upstream-fixes-jgarzik' of git://lost.foo-projects.org/~ahkok/git/netdev-2.6 into upstream-fixes

Noticed by Willy Tarreau.
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Add missing volatile to the get_clock / get_cycles inline assemblies
to avoid that consecutive calls get optimized away.
Signed-off-by: Andreas Krebbel <krebbel1@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Display avg_sample_interval in nanoseconds, like it is documented.
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Don't use memparse since the default size modifier is 'k'.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Signed-off-by: Jeff Garzik <jeff@garzik.org>

* delete unused PIIX_FLAG_COMBINED*
* port_enable should be u16 rather than u32
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Take into account the fact that ICH8 changed the register layout of
the MAP and PCS register bits.
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Prior to this patch, the driver would do this for each port:
	read 8-bit PCS
	write 8-bit PCS
	read 8-bit PCS
	write 8-bit PCS

In the field, flaky behavior has been observed related to this register.
In particular, these overzealous register writes can cause misdetection
problems.

Update to do the following once (not once per port) at boot:
	read 16-bit PCS
	if needs changing,
		write 16-bit PCS

And thereafter, we only perform a 'read 16-bit PCS' per port.

This should eliminate all PCS writes in many cases, and be more friendly
in the cases where we do need to enable ports.
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Add host_set private structure piix_host_priv.  Currently the only
field is ->map which used to be stored directly at
host_set->private_data.  This change allows more host_set private
fields to be added.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Finishing up for the kernel summit. Ottawa, here I come.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6:
  JFS: commit_mutex cleanups

Some -mm-only material leaked into a patch destined for mainline, and I didn't
notice.

This was the replacement of system_utsname with utsname() that's required by
the uts namespace patch.  This patch reverts those changes (which are correct
in -mm) so that mainline UML builds again.
Signed-off-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This just turns off chmod() on the /proc/<pid>/ files, since there is no
good reason to allow it, and had we disallowed it originally, the nasty
/proc race exploit wouldn't have been possible.

The other patches already fixed the problem chmod() could cause, so this
is really just some final mop-up..

This particular version is based off a patch by Eugene and Marcel which
had much better naming than my original equivalent one.
Signed-off-by: Eugene Teo <eteo@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Not that we really need this any more, but at the same time there's no
reason not to do this.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

net/sched/sch_htb.c: In function 'htb_change_class':
net/sched/sch_htb.c:1605: error: expected ';' before 'do_gettimeofday'
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* master.kernel.org:/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  [CRYPTO] padlock: Fix alignment after aes_ctx rearrange

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64] Fix PSYCHO PCI controler init.
  [SPARC64] psycho: Fix pbm->name handling in pbm_register_toplevel_resources()
  [SERIAL] sunsab: Fix significant typo in sab_probe()
  [SERIAL] sunsu: Report keyboard and mouse ports in kernel log.
  [SPARC64]: Make sure IRQs are disabled properly during early boot.

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [VLAN]: __vlan_hwaccel_rx can use the faster ether_compare_addr
  [PKT_SCHED] HTB: initialize upper bound properly
  [IPV4]: Clear skb cb on IP input
  [NET]: Update frag_list in pskb_trim

set_wmb should not be used in the kernel because it just confuses the
code more and has no benefit.  Since it is not currently used in the
kernel this patch removes it so that new code does not include it.

All archs define set_wmb(var, value) to do { var = value; wmb(); }
while(0) except ia64 and sparc which use a mb() instead.  But this is
still moot since it is not used anyway.

Hasn't been tested on any archs but x86 and x86_64 (and only compiled
tested)
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch removes the reference to set_wmb from memory-barriers.txt
since it shouldn't be used.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

In send_cpu_listeners(), which is called on the exit path, a down_write()
was protecting operations like skb_clone() and genlmsg_unicast() that do
GFP_KERNEL allocations.  If the oom-killer decides to kill tasks to satisfy
the allocations,the exit of those tasks could block on the same semphore.

The down_write() was only needed to allow removal of invalid listeners from
the listener list.  The patch converts the down_write to a down_read and
defers the removal to a separate critical region.  This ensures that even
if the oom-killer is called, no other task's exit is blocked as it can
still acquire another down_read.

Thanks to Andrew Morton & Herbert Xu for pointing out the oom related
pitfalls, and to Chandra Seetharaman for suggesting this fix instead of
using something more complex like RCU.
Signed-off-by: Chandra Seetharaman <sekharan@us.ibm.com>
Signed-off-by: Shailabh Nagar <nagar@watson.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

On systems with a large number of cpus, with even a modest rate of tasks
exiting per cpu, the volume of taskstats data sent on thread exit can
overflow a userspace listener's buffers.

One approach to avoiding overflow is to allow listeners to get data for a
limited and specific set of cpus.  By scaling the number of listeners
and/or the cpus they monitor, userspace can handle the statistical data
overload more gracefully.

In this patch, each listener registers to listen to a specific set of cpus
by specifying a cpumask.  The interest is recorded per-cpu.  When a task
exits on a cpu, its taskstats data is unicast to each listener interested
in that cpu.

Thanks to Andrew Morton for pointing out the various scalability and
general concerns of previous attempts and for suggesting this design.

[akpm@osdl.org: build fix]
Signed-off-by: Shailabh Nagar <nagar@watson.ibm.com>
Signed-off-by: Balbir Singh <balbir@in.ibm.com>
Signed-off-by: Chandra Seetharaman <sekharan@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Don't send taskstats (per-pid or per-tgid) on thread exit when no one is
listening for such data.

Currently the taskstats interface allocates a structure, fills it in and
calls netlink to send out per-pid and per-tgid stats regardless of whether
a userspace listener for the data exists (netlink layer would check for
that and avoid the multicast).

As a result of this patch, the check for the no-listener case is performed
early, avoiding the redundant allocation and filling up of the taskstats
structures.
Signed-off-by: Balbir Singh <balbir@in.ibm.com>
Signed-off-by: Shailabh Nagar <nagar@watson.ibm.com>
Cc: Jay Lan <jlan@engr.sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Change documentation and example program to reflect the flow control issues
being addressed by the cpumask changes.
Signed-off-by: Shailabh Nagar <nagar@watson.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Send per-tgid data only once during exit of a thread group instead of once
with each member thread exit.

Currently, when a thread exits, besides its per-tid data, the per-tgid data
of its thread group is also sent out, if its thread group is non-empty.
The per-tgid data sent consists of the sum of per-tid stats for all
*remaining* threads of the thread group.

This patch modifies this sending in two ways:

- the per-tgid data is sent only when the last thread of a thread group
  exits.  This cuts down heavily on the overhead of sending/receiving
  per-tgid data, especially when other exploiters of the taskstats
  interface aren't interested in per-tgid stats

- the semantics of the per-tgid data sent are changed.  Instead of being
  the sum of per-tid data for remaining threads, the value now sent is the
  true total accumalated statistics for all threads that are/were part of
  the thread group.

The patch also addresses a minor issue where failure of one accounting
subsystem to fill in the taskstats structure was causing the send of
taskstats to not be sent at all.

The patch has been tested for stability and run cerberus for over 4 hours
on an SMP.

[akpm@osdl.org: bugfixes]
Signed-off-by: Shailabh Nagar <nagar@watson.ibm.com>
Signed-off-by: Balbir Singh <balbir@in.ibm.com>
Cc: Jay Lan <jlan@engr.sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>