This fixes a use-after-free bug in the usb-serial core.  It is simple to
trigger this (open a usb-serial port, then yank the device out before
closing the port.)  Thanks to Stefan Seyfried <seife@suse.de> for
reporting this, and to the slab debugging code which enabled it to be
tracked down.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* 'upstream-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  [PATCH] chelsio: fix kmalloc failure in t1_espi_create
  Merge branch 'master'
  s2io: set_multicast_list bug

We want to use the "struct slab" size, not the size of the pointer to
same.  As it is, we'd not print out the last <n> entry pointers in the
slab (where <n> is ~10, depending on whether it's a 32-bit or 64-bit
kernel).

Gaah, that slab code was written by somebody who likes unreadable crud.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

memset() is called before check.
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

* master.kernel.org:/pub/scm/linux/kernel/git/sfrench/cifs-2.6-stable:
  [CIFS] Always match oplock break (cache notification) to the right tcp

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: Mark __ex_table section correctly.

We must use the "a" (allocate) attribute every time we
emit an entry into the __ex_table section.

For consistency, use "a" instead of #alloc which is some
Solaris compat cruft GNU as provides on Sparc.
Signed-off-by: David S. Miller <davem@davemloft.net>

In rare circumstances 0 is returned by dccp_li_hist_calc_i_mean which
leads to a divide by zero in ccid3_hc_rx_packet_recv. Explicitly check
for zero return now. Update copyright notice at same time.

Found by Arnaldo.
Signed-off-by: Ian McDonald <imcdnzl@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
Signed-off-by: David S. Miller <davem@davemloft.net>

The earlier round of kobject/sysfs changes to bridge caused
it not to generate a uevent on removal. Don't think any application
cares (not sure about Xen) but since it generates add uevent
it should generate remove as well.
Signed-off-by: Stephen Hemminger <shemmigner@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Initialize the STP timers for a port when it is created,
rather than when it is enabled. This will prevent future race conditions
where timer gets started before port is enabled.
Signed-off-by: Stephen Hemminger <shemmigner@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Bridge would crash because of uninitailized timer if STP is used and
device was inserted into a bridge before bridge was up. This got
introduced when the delayed port checking was added.  Fix is to not
enable STP on port unless bridge is up.

Bugzilla: http://bugzilla.kernel.org/show_bug.cgi?id=6140
Dup:      http://bugzilla.kernel.org/show_bug.cgi?id=6156Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

session when multiply mounted.

Fixes slow response when cifs client is mounted to shares on multiple
servers and oplock break occurs (usually due to attempt to multiply open a
file).  When treeids on mutiple mounted shares match and we find the wrong
match first, we searched for the wrong cached files to send oplock break
response for which usually meant that no matching file was found and thus
the server would have to timeout the notification.  Oplock break timeout is
about 20 seconds on some servers so this could cause significantly slower
performance on file open calls in a few cases (in particular when multiple
shares are mounted from multiple servers, tree ids match, and we have a
cached file which is later opened multiple times).  This was the most
important of the bugs that was found and fixed at Connectathon
(interoperability testing event) this week.

Acked-by:  Shaggy (shaggy@austin.ibm.com)
Signed-off-by: Steve French (sfrench@us.ibm.com)

* 'upstream-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/misc-2.6:
  [PATCH] Add missing ifdef for VIA RNG code

* master.kernel.org:/home/rmk/linux-2.6-mmc:
  [MMC] au1xmmc: Fix a compilation warning ('status' is not used)
  [MMC] au1xmmc: Fix linking error because mmc_rsp_type doesn't exist
  [MMC] au1xmmc: Fix compilation error by using platform_driver

Fix a trivial compilation warning:

  CC      drivers/mmc/au1xmmc.o
drivers/mmc/au1xmmc.c: In function ‘au1xmmc_dma_callback’:
drivers/mmc/au1xmmc.c:743: warning: unused variable ‘status’
Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
Acked-by: Martin Michlmayr <tbm@cyrius.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

drivers/mmc/au1xmmc.c doesn't compile because commit
e9225176 introduced a typo and passes
the wrong argument to the mmc_resp_type macro.

Error because of the typo:

  CC      drivers/mmc/au1xmmc.o
drivers/mmc/au1xmmc.c: In function ‘au1xmmc_send_command’:
drivers/mmc/au1xmmc.c:197: warning: implicit declaration of function ‘mmc_rsp_type’
...
  LD      .tmp_vmlinux1
drivers/built-in.o: In function `au1xmmc_request':au1xmmc.c:(.text+0x89504): undefined reference to `mmc_rsp_type'
:au1xmmc.c:(.text+0x8968c): undefined reference to `mmc_rsp_type'
make: *** [.tmp_vmlinux1] Error 1

Error because of the wrong argument:

  CC      drivers/mmc/au1xmmc.o
drivers/mmc/au1xmmc.c: In function ‘au1xmmc_send_command’:
drivers/mmc/au1xmmc.c:197: error: invalid type argument of ‘->’
Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
Acked-by: Jordan Crouse <jordan.crouse@amd.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

drivers/mmc/au1xmmc.c currently doesn't compile; it needs to be
converted to use platform_driver.  I cannot test this change because
of lack of hardware but I followed the drivers this one is based on,
and the code is certainly not worse than before.

drivers/mmc/au1xmmc.c: At top level:
drivers/mmc/au1xmmc.c:1002: error: ‘platform_bus_type’ undeclared here (not in a function)
make[2]: *** [drivers/mmc/au1xmmc.o] Error 1
Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
Acked-by: Jordan Crouse <jordan.crouse@amd.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

yaboot is scrogged and calls us with an invalid stack alignment,
it seems.

Thanks to David Woodhouse to pointing me to the problem.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The mac_addr variable doesn't get reset between
(re)additions of multicast addresses. One byte
of all multicast addresses (except the first)
can be incorrect.
Signed-off-by: Arthur Kepner <akepner@sgi.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Almost all the code for the VIA RNG is guarded with __i386__ #ifdefs,
the only exception being the enumeration of RNG types which is used to
index into the rng_vector ops array.  This patch adds an ifdef around
that for consistency and since the guard makes a difference when adding
new RNG types on non-i386 hardware.
Signed-Off-By: Mark Brown <broonie@sirena.org.uk>
Signed-Off-By: Jeff Garzik <jeff@garzik.org>

The bitmaps associated with generation numbers for directory entries
are declared as an array of ints. On some platforms, this causes alignment
exceptions.

The following patch uses the standard bitmap declaration macros to
declare the bitmaps, fixing the problem.

Originally from Takashi Iwai.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch fixes bugs in reiserfs where unsigned integers were checked
whether they are less then 0.
Signed-off-by: Vladimir V. Saveliev <vs@namesys.com>
Cc: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Hans Reiser <reiser@namesys.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

numa_maps should not scan over huge vmas in order not to cause problems for
non IA64 platforms that may have pte entries pointing to huge pages in a
variety of ways in their page tables.  Add a simple check to ignore vmas
containing huge pages.
Signed-off-by: Christoph Lameter <clameter@engr.sgi.com>
Cc: Hugh Dickins <hugh@veritas.com>
Cc: Andi Kleen <ak@muc.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

On some platforms readq performs additional work to make sure I/O is done
in a coherent way.  This is not needed for time retrieval as done by the
time interpolator.  So we can use readq_relaxed instead which will improve
performance.

It affects sparc64 and ia64 only.  Apparently it makes a significant
difference on ia64.
Signed-off-by: Christoph Lameter <clameter@sgi.com>
Cc: john stultz <johnstul@us.ibm.com>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

acpi_video_flags variable is unsigned long, so it should be set as such.
This actually matters on x86-64.
Signed-off-by: Stefan Seyfried <seife@suse.de>
Signed-off-by: Pavel Machek <pavel@suse.cz>
Cc: "Brown, Len" <len.brown@intel.com>
Cc: Andi Kleen <ak@muc.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

v9fs has been plagued by an over-complicated approach trying to map Linux
dentry semantics to Plan 9 fid semantics.  Our previous approach called for
aggressive flushing of the dcache resulting in several problems (including
wierd cwd behavior when running /bin/pwd).

This patch dramatically simplifies our handling of this fid management.  Fids
will not be clunked as promptly, but the new approach is more functionally
correct.  We now clunk un-open fids only when their dentry ref_count reaches 0
(and d_delete is called).

Another simplification is we no longer seek to match fids to the process-id or
uid of the action initiator.  The uid-matching will need to be revisited when
we fix the security model.
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Lucho's atomic create+open fix had a bug in the super block initialization
causing all mounts to fail.  He was freeing an fcall too early.  This patch
fixes that oversight.
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

In order to assure atomic create+open v9fs stores the open fid produced by
v9fs_vfs_create in the dentry, from where v9fs_file_open retrieves it and
associates it with the open file.

This patch modifies v9fs to use nameidata.intent.open values to do the atomic
create+open.
Signed-off-by: Latchesar Ionkov <lucho@ionkov.net>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Sync up the recent redboot fix with MTD CVS.  It uses the correct swab()
functions.

Cc: John Bowler <jbowler@acm.org>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Martin Michlmayr <tbm@cyrius.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

I seem to have lost this read_unlock().

While we're there, let's turn that interruptible sleep unto uninterruptible,
so we don't get a busywait if signal_pending().  (Again.  We seem to have a
habit of doing this).
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch should fixe a problem with eeh_add_device_late() not being
defined in the ppc64 build process, causing the build to break.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Switch from list_head to hlist_head. Make the size of the hash dependent
upon the allocated area, rather than a constant.
Signed-off-by: Mark Fasheh <mark.fasheh@oracle.com>

to prevent confusion when a virtual ip is created on the same interface
Signed-off-by: Sunil Mushran <sunil.mushran@oracle.com>
Signed-off-by: Mark Fasheh <mark.fasheh@oracle.com>

The extent map code has long noticed when the on-disk extent information
is corrupt.  However, so far it has only returned an error.  We should
take the filesystem read-only, as it is corrupt.
Signed-off-by: Joel Becker <joel.becker@oracle.com>
Signed-off-by: Mark Fasheh <mark.fasheh@oracle.com>