The documentation for how the length of attributes
is checked is wrong ("Exact length" isn't true, the
policy checks are for "minimum length") and a bit
misleading. Make it more complete and explain what
really happens.

Cc: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

L2TP for example uses NLA_MSECS like this:
policy:
        [L2TP_ATTR_RECV_TIMEOUT]        = { .type = NLA_MSECS, },
code:
        if (info->attrs[L2TP_ATTR_RECV_TIMEOUT])
                cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]);

As nla_get_msecs() is essentially nla_get_u64() plus the
conversion to a HZ-based value, this will not properly
reject attributes from userspace that aren't long enough
and might overrun the message.

Add NLA_MSECS to the attribute minlen array to check the
size properly.

Cc: Thomas Graf <tgraf@suug.ch>
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

i825xx and xscale are "sub" Kconfigs to NET_VENDOR_INTEL, so
NET_VENDOR_INTEL should contain ALL the dependencies of the
"sub" Kconfigs.

Same with 8390 is a "sub" Kconfig to NET_VENDOR_NATSEMI, so
NET_VENDOR_NATSEMI needs to contains ALL the dependencies.

Freescale Kconfig only had fs_enet as a sub Kconfig, and already
contained the needed dependencies, just cleaned up the dependencies.
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

When implementing VRRP v2 using macvlan several problems were
discovered.  VRRP is weird in that all routers participating
in a redundant group use the same virtual MAC address.
Macvlan is a natural driver to use for this but it doesn't
work.  The problem is that packets with a macvlan device's
source address are not received.

The problem is actually a regression that date back almost 2 years now.
The original problems started with:

commit 618e1b74
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Thu Nov 26 06:07:10 2009 +0000

    macvlan: implement bridge, VEPA and private mode

This patches restores the original 2.6.32 behavior. Allowing multicast
packets received with the VRRP source address to be received.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch updates the tg3 version to 3.121.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

During shutdown, it is impossible to reliably disable the timer and
reset_task threads.  Each thread can schedule the other, which leads to
shutdown code that chases its tail.

To fix the problem, this patch removes the ability of tg3_reset_task to
schedule a new timer thread.  To support this change, tg3_timer no
longer terminates itself, but rather goes into a polling mode.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

It is possible for multiple threads in the tg3 driver to each attempt to
schedule a run of tg3_reset_task().  The multiple tg3_reset_task
executions could all wind up on the same queue (and execute serially) or
wind up on the queues of another processor (which could execute in
parallel).  Either scenario is not what was truly desired.

This patch adds a new flag, TG3_FLAG_RESET_TASK_PENDING, and uses it to
determine whether or not to schedule another run of tg3_reset_task().
With the new flag comes two new functions to facilitate scheduling and
descheduling of tg3_reset_task().
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch adds code to attempt to obtain the PCI function number from
the device rather than accept the number handed by the kernel.  In
pass-through scenarios, the function number handed by the kernel may not
reflect the true function of the device.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch fixes a bug where the irq error cleanup path did not free all
the resources it allocated.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: Ben Li <benli@broadcom.com>
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

On the error recovery resource unwind path, it is possible for the
driver to attempt to unmap a fragment that hadn't been mapped.  This
patch fixes the problem by correcting the "last" parameter supplied.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The new 4k tx bd segmentation code had a bug in the error cleanup path.
If the driver did not map all the physical fragments, the abort path
would wind up advancing the producer index beyond the point where the
setup code stopped.  This would ultimately turn into a tx recovery error
where the driver would expect the skb pointer to be set when it isn't.
This patch fixes the problem, and then makes the code a little easier to
understand.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

APE mutex register blocks are shared by all ports of multiport devices.
For some mutexing purposes, each function is assigned their own
register.  For other cases, each function is assigned its own request
and grant bits of a single register.  For the latter cases, the tg3
driver is incorrectly allowing each function to use the same set of
grant / request bits.  This patch fixes the code so that each function
uses the appropriate bitset.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

* 'for-linus' of git://github.com/cmetcalf-tilera/linux-tile:
  arch/tile: factor out <arch/opcode.h> header
  arch/tile: add the <arch> headers to the set of installed kernel headers
  arch/tile: avoid exporting a symbol no longer used by gcc
  arch/tile: avoid ISO namespace pollution with <asm/sigcontext.h>

* 'nfs-for-3.2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (25 commits)
  nfs: set vs_hidden on nfs4_callback_version4 (try #2)
  pnfs-obj: Support for RAID5 read-4-write interface.
  pnfs-obj: move to ore 03: Remove old raid engine
  pnfs-obj: move to ore 02: move to ORE
  pnfs-obj: move to ore 01: ore_layout & ore_components
  pnfs-obj: Rename objlayout_io_state => objlayout_io_res
  pnfs-obj: Get rid of objlayout_{alloc,free}_io_state
  pnfs-obj: Return PNFS_NOT_ATTEMPTED in case of read/write_pagelist
  pnfs-obj: Remove redundant EOF from objlayout_io_state
  nfs: Remove unused variable from write.c
  nfs: Fix unused variable warning from file.c
  NFS: Remove no-op less-than-zero checks on unsigned variables.
  NFS: Clean up nfs4_xdr_dec_secinfo()
  NFS: Fix documenting comment for nfs_create_request()
  NFS4: fix cb_recallany decode error
  nfs4: serialize layoutcommit
  SUNRPC: remove rpcbind clients destruction on module cleanup
  SUNRPC: remove rpcbind clients creation during service registering
  NFSd: call svc rpcbind cleanup explicitly
  SUNRPC: cleanup service destruction
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IB/qib: Fix panic in RC error flushing logic
  IB/iser: DMA unmap TX bufs used for iSCSI/iSER headers
  IB/iser: Use separate buffers for the login request/response
  IB/mthca: Fix buddy->num_free allocation size

Remove 'as' for as is no longer supported, and we can not use
'elevator=as' any more.
Signed-off-by: Wang Sheng-Hui <shhuiw@gmail.com>
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix a typo (duplicated word) in Documentation/leds/leds-class.txt
Signed-off-by: Bryan Wu <bryan.wu@canonical.com>
Acked-by: Richard Purdie <rchard.purdie@linuxfoundation.org>
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Removed the email for support and fixes for orphaned ip2 driver.
Signed-off-by: Marcos Paulo de Souza <marcos.mage@gmail.com>
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Removed the reference of Roman Zippel, last maintainer, of orphaned
HFS filesystem.
Signed-off-by: Marcos Paulo de Souza <marcos.mage@gmail.com>
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

After commit 38829dc9 ("Documentation/CodingStyle: flesh out if-else
examples") highlight that if _only_one_ branch of a conditional
statement is a single statement, then braces are to be used on both
branches.
Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fixes the path to find the source files of the inotify subsystem.
Signed-off-by: Marcos Paulo de Souza <marcos.mage@gmail.com>
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This adds minor grammatical fixes to the description of the keys in the
thinkpad-acpi documentation.
Signed-off-by: Kumar Appaiah <a.kumar@alumni.iitm.ac.in>
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

- ns cgroup has been removed.
- it's true moving a task to another cgroup can fail.
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Paul Menage <paul@paulmenage.org>
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

The warning really shouldn't happen, but until we
find the reason why it does don't spew it all the
time, just once is enough to know we've hit it.
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

The following panic can occur when flushing a QP:

    RIP: 0010:[<ffffffffa0168e8b>]  [<ffffffffa0168e8b>] qib_send_complete+0x3b/0x190 [ib_qib]
    RSP: 0018:ffff8803cdc6fc90  EFLAGS: 00010046
    RAX: 0000000000000000 RBX: ffff8803d84ba000 RCX: 0000000000000000
    RDX: 0000000000000005 RSI: ffffc90015a53430 RDI: ffff8803d84ba000
    RBP: ffff8803cdc6fce0 R08: ffff8803cdc6fc90 R09: 0000000000000001
    R10: 00000000ffffffff R11: 0000000000000000 R12: ffff8803d84ba0c0
    R13: ffff8803d84ba5cc R14: 0000000000000800 R15: 0000000000000246
    FS:  0000000000000000(0000) GS:ffff880036600000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
    CR2: 0000000000000034 CR3: 00000003e44f9000 CR4: 00000000000406f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process qib/0 (pid: 1350, threadinfo ffff8803cdc6e000, task ffff88042728a100)
    Stack:
     53544c5553455201 0000000100000005 0000000000000000 ffff8803d84ba000
     0000000000000000 0000000000000000 0000000000000000 0000000000000000
     0000000000000000 0000000000000001 ffff8803cdc6fd30 ffffffffa0165d7a
    Call Trace:
     [<ffffffffa0165d7a>] qib_make_rc_req+0x36a/0xe80 [ib_qib]
     [<ffffffffa0165a10>] ?  qib_make_rc_req+0x0/0xe80 [ib_qib]
     [<ffffffffa01698b3>] qib_do_send+0xf3/0xb60 [ib_qib]
     [<ffffffff814db757>] ? thread_return+0x4e/0x777
     [<ffffffffa01697c0>] ? qib_do_send+0x0/0xb60 [ib_qib]
     [<ffffffff81088bf0>] worker_thread+0x170/0x2a0
     [<ffffffff8108e530>] ?  autoremove_wake_function+0x0/0x40
     [<ffffffff81088a80>] ? worker_thread+0x0/0x2a0
     [<ffffffff8108e1c6>] kthread+0x96/0xa0
     [<ffffffff8100c1ca>] child_rip+0xa/0x20
     [<ffffffff8108e130>] ? kthread+0x0/0xa0
     [<ffffffff8100c1c0>] ? child_rip+0x0/0x20
    RIP  [<ffffffffa0168e8b>] qib_send_complete+0x3b/0x190 [ib_qib]

The RC error state flush logic in qib_make_rc_req() could return all
of the acked wqes and potentially have emptied the queue.  It would
then unconditionally try return a flush completion via
qib_send_complete() for an invalid wqe, or worse a valid one that is
not queued. The panic results when the completion code tries to
maintain an MR reference count for a NULL MR.

This fix modifies logic to only send one completion per
qib_make_rc_req() call and changing the completion status from
IB_WC_SUCCESS to IB_WC_WR_FLUSH_ERR as the completions progress.

The outer loop will call as many times as necessary to flush the queue.
Reviewed-by: Ram Vepa <ram.vepa@qlogic.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@qlogic.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>

* 'process_vm' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux:
  [IA64] Wire up cross memory attach syscalls

The current driver never does DMA unmapping on these buffers.  Fix that
by adding DMA unmapping to the task cleanup callback, and DMA mapping to
the task init function (drop the headers_initialized micro-optimization).
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>

The driver counted on the transactional nature of iSCSI login/text
flows and used the same buffer for both the request and the response.
We also went further and did DMA mapping only once, with
DMA_FROM_DEVICE, which violates the DMA mapping API.  Fix that by
using different buffers, one for requests and one for responses, and
use the correct DMA mapping direction for each.
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (144 commits)
  [media] saa7134.h: Suppress compiler warnings when CONFIG_VIDEO_SAA7134_RC is not set
  [media] it913x [VER 1.07] Support for single ITE 9135 devices
  [media] Support for Terratec G1
  [media] cx25821: off by one in cx25821_vidioc_s_input()
  [media] media: tea5764: reconcile Kconfig symbol and macro
  [media] omap_vout: Add poll() support
  [media] omap3isp: preview: Add crop support on the sink pad
  [media] omap3isp: preview: Rename min/max input/output sizes defines
  [media] omap3isp: preview: Remove horizontal averager support
  [media] omap3isp: Report the ISP revision through the media controller API
  [media] omap3isp: ccdc: remove redundant operation
  [media] omap3isp: Fix memory leaks in initialization error paths
  [media] omap3isp: Add missing mutex_destroy() calls
  [media] omap3isp: Move *_init_entities() functions to the init/cleanup section
  [media] omap3isp: Move media_entity_cleanup() from unregister() to cleanup()
  [media] MFC: Change MFC firmware binary name
  [media] vb2: add vb2_get_unmapped_area in vb2 core
  [media] v4l: Add v4l2 subdev driver for S5K6AAFX sensor
  [media] v4l: Add AUTO option for the V4L2_CID_POWER_LINE_FREQUENCY control
  [media] media: ov6650: stylistic improvements
  ...

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  hwmon: (w83627ehf) Add support for the W83627UHG
  hwmon: (w83627ehf) Clean up probe function
  hwmon: (w83627ehf) Properly report PECI and AMD-SI sensor types
  hwmon: Use i2c_smbus_{read,write}_word_swapped
  hwmon: (smsc47b397) Fix checkpatch errors
  hwmon: (lm90) Make code more readable
  hwmon: (lm90) Fix warnings
  hwmon: (ibmaem) Avoid repeated memory allocations
  hwmon: (ibmaem) Make instance initializations independent
  hwmon: (ibmaem) Fix error paths
  hwmon: (lm73) Make detection less problematic
  hwmon: Avoid building drivers for powerpc that read/write ISA addresses

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits)
  ALSA: hda/realtek - Skip invalid digital out pins
  ALSA: hda/sigmatel - Automatically retrieve digital I/O widgets
  ALSA: hda - Remove unused variables
  ALSA: hda/realtek - Don't create alt-stream for capture when unnecessary
  ALSA: hda - Add support for 92HD65 / 92HD66 family of codecs
  ALSA: hda - Disable power-widget control for IDT 92HD83/93 as default
  ALSA: hda - Check NO_PRESENCE pincfg default bit
  ASoC: Ensure we always delay for WM8962 FLL when starting from SYSCLK
  ASoC: Ensure the WM8962 oscillator and PLLs start up disabled
  ASoC: Ensure WM8962 PLL registers are reset
  ALSA: intel8x0 - Fix inclusion of kvm_para.h
  ALSA: hda_hwdep: Fix possible buffer overflow
  ASoC: Fix return value of wm5100_gpio_direction_out()
  ASoC: WM8904: Set `invert' bit for Capture Switch
  ASoC: Leave input audio data bit length settings untouched in wm8711_set_dai_fmt
  ASoC: wm8711: Fix wrong mask for setting input audio data bit length select
  ALSA: intel8x0: Improve performance in virtual environment
  ALSA: hdspm - Enable all firmware ranges for PCI MADI/AES cards
  ALSA: hdsp - Correct HDSP_VERSION_BIT constant, thus partly fixing RPM detection
  ALSA: hdspm - Fix MADI channel format in the status ioctl
  ...

* 'devicetree/merge' of git://git.secretlab.ca/git/linux-2.6:
  dt: add empty of_machine_is_compatible
  ahci: add DT binding for Calxeda AHCI controller
  dt/platform: minor cleanup
  dt: add empty of_alias_get_id() for non-dt builds

This service should not be registered with or unregistered from rpcbind.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

This is essentially a stripped down version of the W83627DHG. Noticeable
difference is that it is still powered with +5V, as older models, even
though the ADC resolution is 8 mV as newer models have.

Thanks to Ulf Bruman (Saab Group) for doing all the testing.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>

The probe function has grown pretty large, I think it's time for some
cleanups, starting with these two simple ones:
* Move temp3/in6 check for the W83667HG later in the function, where
  it is done for all other chip types.
* Move temperature register setting to a separate function, to avoid
  code duplication.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>

When temperature sources are PECI or AMD-SI agents, it makes no sense
to report their type as diode or thermistor. Instead we must report
their digital nature.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: stable@kernel.org
Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>

Make use of the new i2c_smbus_{read,write}_word_swapped functions.
This makes the driver code more compact and readable. It also ensures
proper error handling.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
Cc: Dirk Eibach <eibach@gdsys.de>
Cc: "Mark M. Hoffman" <mhoffman@lightlink.com>
Cc: Guillaume Ligneul <guillaume.ligneul@gmail.com>