An application may call connect() to disconnect a socket using an
address with family AF_UNSPEC. The L2TP IP sockets were not handling
this case when the socket is not bound and an attempt to connect()
using AF_UNSPEC in such cases would result in an oops. This patch
addresses the problem by protecting the sk_prot->disconnect() call
against trying to unhash the socket before it is bound.

The L2TP IPv4 and IPv6 sockets have the same problem. Both are fixed
by this patch.

The patch also adds more checks that the sockaddr supplied to bind()
and connect() calls is valid.

 RIP: 0010:[<ffffffff82e133b0>]  [<ffffffff82e133b0>] inet_unhash+0x50/0xd0
 RSP: 0018:ffff88001989be28  EFLAGS: 00010293
 Stack:
  ffff8800407a8000 0000000000000000 ffff88001989be78 ffffffff82e3a249
  ffffffff82e3a050 ffff88001989bec8 ffff88001989be88 ffff8800407a8000
  0000000000000010 ffff88001989bec8 ffff88001989bea8 ffffffff82e42639
 Call Trace:
 [<ffffffff82e3a249>] udp_disconnect+0x1f9/0x290
 [<ffffffff82e42639>] inet_dgram_connect+0x29/0x80
 [<ffffffff82d012fc>] sys_connect+0x9c/0x100
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Since commit ad0081e4
"ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed"
the fragment of packets is incorrect.
because tunnel mode needs IPsec headers and trailer for all fragments,
while on transport mode it is sufficient to add the headers to the
first fragment and the trailer to the last.

so modify mtu and maxfraglen base on ipsec mode and if fragment is first
or last.

with my test,it work well(every fragment's size is the mtu)
and does not trigger slow fragment path.

Changes from v1:
	though optimization, mtu_prev and maxfraglen_prev can be delete.
	replace xfrm mode codes with dst_entry's new frag DST_XFRM_TUNNEL.
	add fuction ip6_append_data_mtu to make codes clearer.
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Corrects the function that determines the esp payload size. The calculations
done in esp{4,6}_get_mtu() lead to overlength frames in transport mode for
certain mtu values and suboptimal frames for others.

According to what is done, mainly in esp{,6}_output() and tcp_mtu_to_mss(),
net_header_len must be taken into account before doing the alignment
calculation.
Signed-off-by: Benjamin Poirier <bpoirier@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

No one uses this on current kernels anymore.

Let it be known it's going to be removed eventually.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

When calculating the number of slots required for a packet header, the code
was reserving too many slots if the header crossed a page boundary. Since
netbk_gop_skb copies the header to the start of the page, the count of
slots required for the header should be based solely on the header size.

This problem is easy to reproduce if a VIF is bridged to a USB 3G modem
device as the skb->data value always starts near the end of the first page.
Signed-off-by: Simon Graham <simon.graham@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

DMA support has finally made its way to the top of the TODO list, having
realised that a Geode using MMIO can't keep up with two ADSL2+ lines
each running at 21Mb/s.

This patch fixes a couple of bugs in the DMA support in the driver, so
once the corresponding FPGA update is complete and tested everything
should work properly.

We weren't storing the currently-transmitting skb, so we were never
unmapping it and never freeing/popping it when the TX was done.
And the addition of pci_set_master() is fairly self-explanatory.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>

After about two decades, I am giving up on cyberus.
Nabwaga Manyanga.
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Some additional Gobi3K IDs found in the BSD/GPL licensed
out-of-tree GobiNet driver from Sierra Wireless.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull main drm updates from Dave Airlie:
 "This is the main merge window request for the drm.

  It's big, but jam packed will lots of features and of course 0
  regressions.  (okay maybe there'll be one).

  Highlights:

   - new KMS drivers for server GPU chipsets: ast, mgag200 and cirrus
     (qemu only).  These drivers use the generic modesetting drivers.

   - initial prime/dma-buf support for i915, nouveau, radeon, udl and
     exynos

   - switcheroo audio support: so GPUs with HDMI can turn off the sound
     driver without crashing stuff.

   - There are some patches drifting outside drivers/gpu into x86 and
     EFI for better handling of multiple video adapters in Apple Macs,
     they've got correct acks except one trivial fixup.

   - Core:
	edid parser has better DMT and reduced blanking support,
	crtc properties,
	plane properties,

   - Drivers:
	exynos: add 2D core accel support, prime support, hdmi features
	intel: more Haswell support, initial Valleyview support, more
	    hdmi infoframe fixes, update MAINTAINERS for Daniel, lots of
	    cleanups and fixes
	radeon: more HDMI audio support, improved GPU lockup recovery
	    support, remove nested mutexes, less memory copying on PCIE, fix
	    bus master enable race (kexec), improved fence handling
	gma500: cleanups, 1080p support, acpi fixes
	nouveau: better nva3 memory reclocking, kepler accel (needs
	    external firmware rip), async buffer moves on nv84+ hw.

  I've some more dma-buf patches that rely on the dma-buf merge for vmap
  stuff, and I've a few fixes building up, but I'd decided I'd better
  get rid of the main pull sooner rather than later, so the audio guys
  are also unblocked."

Fix up trivial conflict due to some duplicated changes in
drivers/gpu/drm/i915/intel_ringbuffer.c

* 'drm-core-next' of git://people.freedesktop.org/~airlied/linux: (605 commits)
  drm/nouveau/nvd9: Fix GPIO initialisation sequence.
  drm/nouveau: Unregister switcheroo client on exit
  drm/nouveau: Check dsm on switcheroo unregister
  drm/nouveau: fix a minor annoyance in an output string
  drm/nouveau: turn a BUG into a WARN
  drm/nv50: decode PGRAPH DATA_ERROR = 0x24
  drm/nouveau/disp: fix dithering not being enabled on some eDP macbooks
  drm/nvd9/copy: initialise copy engine, seems to work like nvc0
  drm/nvc0/ttm: use copy engines for async buffer moves
  drm/nva3/ttm: use copy engine for async buffer moves
  drm/nv98/ttm: add in a (disabled) crypto engine buffer copy method
  drm/nv84/ttm: use crypto engine for async buffer copies
  drm/nouveau/ttm: untangle code to support accelerated buffer moves
  drm/nouveau/fbcon: use fence for sync, rather than notifier
  drm/nv98/crypt: non-stub implementation of the engine hooks
  drm/nouveau/fifo: turn all fifo modules into engine modules
  drm/nv50/graph: remove ability to do interrupt-driven context switching
  drm/nv50: remove manual context unload on context destruction
  drm/nv50: remove execution engine context saves on suspend
  drm/nv50/fifo: use hardware channel kickoff functionality
  ...

Pull more networking updates from David Miller:
 "Ok, everything from here on out will be bug fixes."

1) One final sync of wireless and bluetooth stuff from John Linville.
   These changes have all been in his tree for more than a week, and
   therefore have had the necessary -next exposure.  John was just away
   on a trip and didn't have a change to send the pull request until a
   day or two ago.

2) Put back some defines in user exposed header file areas that were
   removed during the tokenring purge.  From Stephen Hemminger and Paul
   Gortmaker.

3) A bug fix for UDP hash table allocation got lost in the pile due to
   one of those "you got it..  no I've got it.." situations.  :-)

   From Tim Bird.

4) SKB coalescing in TCP needs to have stricter checks, otherwise we'll
   try to coalesce overlapping frags and crash.  Fix from Eric Dumazet.

5) RCU routing table lookups can race with free_fib_info(), causing
   crashes when we deref the device pointers in the route.  Fix by
   releasing the net device in the RCU callback.  From Yanmin Zhang.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (293 commits)
  tcp: take care of overlaps in tcp_try_coalesce()
  ipv4: fix the rcu race between free_fib_info and ip_route_output_slow
  mm: add a low limit to alloc_large_system_hash
  ipx: restore token ring define to include/linux/ipx.h
  if: restore token ring ARP type to header
  xen: do not disable netfront in dom0
  phy/micrel: Fix ID of KSZ9021
  mISDN: Add X-Tensions USB ISDN TA XC-525
  gianfar:don't add FCB length to hard_header_len
  Bluetooth: Report proper error number in disconnection
  Bluetooth: Create flags for bt_sk()
  Bluetooth: report the right security level in getsockopt
  Bluetooth: Lock the L2CAP channel when sending
  Bluetooth: Restore locking semantics when looking up L2CAP channels
  Bluetooth: Fix a redundant and problematic incoming MTU check
  Bluetooth: Add support for Foxconn/Hon Hai AR5BBU22 0489:E03C
  Bluetooth: Fix EIR data generation for mgmt_device_found
  Bluetooth: Fix Inquiry with RSSI event mask
  Bluetooth: improve readability of l2cap_seq_list code
  Bluetooth: Fix skb length calculation
  ...

Pull user-space probe instrumentation from Ingo Molnar:
 "The uprobes code originates from SystemTap and has been used for years
  in Fedora and RHEL kernels.  This version is much rewritten, reviews
  from PeterZ, Oleg and myself shaped the end result.

  This tree includes uprobes support in 'perf probe' - but SystemTap
  (and other tools) can take advantage of user probe points as well.

  Sample usage of uprobes via perf, for example to profile malloc()
  calls without modifying user-space binaries.

  First boot a new kernel with CONFIG_UPROBE_EVENT=y enabled.

  If you don't know which function you want to probe you can pick one
  from 'perf top' or can get a list all functions that can be probed
  within libc (binaries can be specified as well):

	$ perf probe -F -x /lib/libc.so.6

  To probe libc's malloc():

	$ perf probe -x /lib64/libc.so.6 malloc
	Added new event:
	probe_libc:malloc    (on 0x7eac0)

  You can now use it in all perf tools, such as:

	perf record -e probe_libc:malloc -aR sleep 1

  Make use of it to create a call graph (as the flat profile is going to
  look very boring):

	$ perf record -e probe_libc:malloc -gR make
	[ perf record: Woken up 173 times to write data ]
	[ perf record: Captured and wrote 44.190 MB perf.data (~1930712

	$ perf report | less

	  32.03%            git  libc-2.15.so   [.] malloc
	                    |
	                    --- malloc

	  29.49%            cc1  libc-2.15.so   [.] malloc
	                    |
	                    --- malloc
	                       |
	                       |--0.95%-- 0x208eb1000000000
	                       |
	                       |--0.63%-- htab_traverse_noresize

	  11.04%             as  libc-2.15.so   [.] malloc
	                     |
	                     --- malloc
	                        |

	   7.15%             ld  libc-2.15.so   [.] malloc
	                     |
	                     --- malloc
	                        |

	   5.07%             sh  libc-2.15.so   [.] malloc
	                     |
	                     --- malloc
	                        |
	   4.99%  python-config  libc-2.15.so   [.] malloc
	          |
	          --- malloc
	             |
	   4.54%           make  libc-2.15.so   [.] malloc
	                   |
	                   --- malloc
	                      |
	                      |--7.34%-- glob
	                      |          |
	                      |          |--93.18%-- 0x41588f
	                      |          |
	                      |           --6.82%-- glob
	                      |                     0x41588f

	   ...

  Or:

	$ perf report -g flat | less

	# Overhead        Command  Shared Object      Symbol
	# ........  .............  .............  ..........
	#
	  32.03%            git  libc-2.15.so   [.] malloc
	          27.19%
	              malloc

	  29.49%            cc1  libc-2.15.so   [.] malloc
	          24.77%
	              malloc

	  11.04%             as  libc-2.15.so   [.] malloc
	          11.02%
	              malloc

	   7.15%             ld  libc-2.15.so   [.] malloc
	           6.57%
	              malloc

	 ...

  The core uprobes design is fairly straightforward: uprobes probe
  points register themselves at (inode:offset) addresses of
  libraries/binaries, after which all existing (or new) vmas that map
  that address will have a software breakpoint injected at that address.
  vmas are COW-ed to preserve original content.  The probe points are
  kept in an rbtree.

  If user-space executes the probed inode:offset instruction address
  then an event is generated which can be recovered from the regular
  perf event channels and mmap-ed ring-buffer.

  Multiple probes at the same address are supported, they create a
  dynamic callback list of event consumers.

  The basic model is further complicated by the XOL speedup: the
  original instruction that is probed is copied (in an architecture
  specific fashion) and executed out of line when the probe triggers.
  The XOL area is a single vma per process, with a fixed number of
  entries (which limits probe execution parallelism).

  The API: uprobes are installed/removed via
  /sys/kernel/debug/tracing/uprobe_events, the API is integrated to
  align with the kprobes interface as much as possible, but is separate
  to it.

  Injecting a probe point is privileged operation, which can be relaxed
  by setting perf_paranoid to -1.

  You can use multiple probes as well and mix them with kprobes and
  regular PMU events or tracepoints, when instrumenting a task."

Fix up trivial conflicts in mm/memory.c due to previous cleanup of
unmap_single_vma().

* 'perf-uprobes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits)
  perf probe: Detect probe target when m/x options are absent
  perf probe: Provide perf interface for uprobes
  tracing: Fix kconfig warning due to a typo
  tracing: Provide trace events interface for uprobes
  tracing: Extract out common code for kprobes/uprobes trace events
  tracing: Modify is_delete, is_return from int to bool
  uprobes/core: Decrement uprobe count before the pages are unmapped
  uprobes/core: Make background page replacement logic account for rss_stat counters
  uprobes/core: Optimize probe hits with the help of a counter
  uprobes/core: Allocate XOL slots for uprobes use
  uprobes/core: Handle breakpoint and singlestep exceptions
  uprobes/core: Rename bkpt to swbp
  uprobes/core: Make order of function parameters consistent across functions
  uprobes/core: Make macro names consistent
  uprobes: Update copyright notices
  uprobes/core: Move insn to arch specific structure
  uprobes/core: Remove uprobe_opcode_sz
  uprobes/core: Make instruction tables volatile
  uprobes: Move to kernel/events/
  uprobes/core: Clean up, refactor and improve the code
  ...

Pull input layer updates from Dmitry Torokhov:
 - a bunch of new drivers (DA9052/53 touchscreenn controller, Synaptics
   Navpoint, LM8333 keypads, Wacom I2C touhscreen);
 - updates to existing touchpad drivers (ALPS, Sntelic);
 - Wacom driver now supports Intuos5;
 - device-tree bindings in numerous drivers;
 - other cleanups and fixes.

Fix annoying conflict in drivers/input/tablet/wacom_wac.c that I think
implies that the input layer device naming is broken, but let's see.  I
brough it up with Dmitry.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (57 commits)
  Input: matrix-keymap - fix building keymaps
  Input: spear-keyboard - document DT bindings
  Input: spear-keyboard - add device tree bindings
  Input: matrix-keymap - wire up device tree support
  Input: matrix-keymap - uninline and prepare for device tree support
  Input: adp5588 - add support for gpio names
  Input: omap-keypad - dynamically handle register offsets
  Input: synaptics - fix compile warning
  MAINTAINERS: adjust input-related patterns
  Input: ALPS - switch to using input_mt_report_finger_count
  Input: ALPS - add semi-MT support for v4 protocol
  Input: Add Synaptics NavPoint (PXA27x SSP/SPI) driver
  Input: atmel_mxt_ts - dump each message on just 1 line
  Input: atmel_mxt_ts - do not read extra (checksum) byte
  Input: atmel_mxt_ts - verify object size in mxt_write_object
  Input: atmel_mxt_ts - only allow root to update firmware
  Input: atmel_mxt_ts - use CONFIG_PM_SLEEP
  Input: sentelic - report device's production serial number
  Input: tl6040-vibra - Device Tree support
  Input: evdev - properly handle read/write with count 0
  ...

Pull media updates from Mauro Carvalho Chehab:
 - some V4L2 API updates needed by embedded devices
 - DVB API extensions for ATSC-MH delivery system, used in US for mobile
   TV
 - new tuners for fc0011/0012/0013 and tua9001
 - a new dvb driver for af9033/9035
 - a new ATSC-MH frontend (lg2160)
 - new remote controller keymaps
 - Removal of a few legacy webcam driver that got replaced by gspca on
   several kernel versions ago
 - a new driver for Exynos 4/5 webcams(s5pp fimc-lite)
 - a new webcam sensor driver (smiapp)
 - a new video input driver for embedded (sta2x1xx)
 - several improvements, fixes, cleanups, etc inside the drivers.

Manually fix up conflicts due to err() -> dev_err() conversion in
drivers/staging/media/easycap/easycap_main.c

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (484 commits)
  [media] saa7134-cards: Remove a PCI entry added by mistake
  [media] radio-sf16fmi: add support for SF16-FMD
  [media] rc-loopback: remove duplicate line
  [media] patch for Asus My Cinema PS3-100 (1043:48cd)
  [media] au0828: Move the Kconfig knob under V4L_USB_DRIVERS
  [media] em28xx: simple comment fix
  [media] [resend] radio-sf16fmr2: add PnP support for SF16-FMD2
  [media] smiapp: Use v4l2_ctrl_new_int_menu() instead of v4l2_ctrl_new_custom()
  [media] smiapp: Add support for 8-bit uncompressed formats
  [media] smiapp: Allow generic quirk registers
  [media] smiapp: Use non-binning limits if the binning limit is zero
  [media] smiapp: Initialise rval in smiapp_read_nvm()
  [media] smiapp: Round minimum pre_pll up rather than down in ip_clk_freq check
  [media] smiapp: Use 8-bit reads only before identifying the sensor
  [media] smiapp: Quirk for sensors that only do 8-bit reads
  [media] smiapp: Pass struct sensor to register writing commands instead of i2c_client
  [media] smiapp: Allow using external clock from the clock framework
  [media] zl10353: change .read_snr() to report SNR as a 0.1 dB
  [media] media: add support to gspca/pac7302.c for 093a:2627 (Genius FaceCam 300)
  [media] m88rs2000 - only flip bit 2 on reg 0x70 on 16th try
  ...

Merge branch 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-core-next

Ben was distracted:

"Apologies for being really late with this, feel free to bash me in the
future so I remember on time!

Overview:
- improvements to reclocking (especially memory) on nva3+
- kepler accel support (if you have blob ucode)
- better inter-channel synchronisation on nv84+
- async ttm buffer moves on nv84+ (earlier cards don't have a non-PGRAPH
engine that's useful)"

* 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6: (60 commits)
  drm/nouveau/nvd9: Fix GPIO initialisation sequence.
  drm/nouveau: Unregister switcheroo client on exit
  drm/nouveau: Check dsm on switcheroo unregister
  drm/nouveau: fix a minor annoyance in an output string
  drm/nouveau: turn a BUG into a WARN
  drm/nv50: decode PGRAPH DATA_ERROR = 0x24
  drm/nouveau/disp: fix dithering not being enabled on some eDP macbooks
  drm/nvd9/copy: initialise copy engine, seems to work like nvc0
  drm/nvc0/ttm: use copy engines for async buffer moves
  drm/nva3/ttm: use copy engine for async buffer moves
  drm/nv98/ttm: add in a (disabled) crypto engine buffer copy method
  drm/nv84/ttm: use crypto engine for async buffer copies
  drm/nouveau/ttm: untangle code to support accelerated buffer moves
  drm/nouveau/fbcon: use fence for sync, rather than notifier
  drm/nv98/crypt: non-stub implementation of the engine hooks
  drm/nouveau/fifo: turn all fifo modules into engine modules
  drm/nv50/graph: remove ability to do interrupt-driven context switching
  drm/nv50: remove manual context unload on context destruction
  drm/nv50: remove execution engine context saves on suspend
  drm/nv50/fifo: use hardware channel kickoff functionality
  ...

Keymaps used by drivers based on matrix-keymap facilities are arrays of
unsigned shorts, not chars. Treating them otherwise produces corrupted
keymaps.
Reported-by: Sourav Poddar <sourav.poddar@ti.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Currently nouveau only registers as a vga_switcheroo client, but never
unregisters. This patch adds the necessary unregister calls.
Signed-off-by: Andreas Heider <andreas@meetr.de>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Currently vga_switcheroo_unregister_handler is called unconditionally when
nouveau is unloaded, even when nouveau never registered a handler. This
interferes with other switcheroo handlers, as vga_switcheroo doesn't check who
called unregister_handler, but simply unregisters the current handler. This
patch adds a check so unregister is only called if a handler was registered by
nouveau before.
Signed-off-by: Andreas Heider <andreas@meetr.de>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Bugs me every time I put in the TNT2..
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

This is very annoying sometimes..
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Disabled for the moment until some performance issues are sorted out, code
committed as a reference point.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

fuc is from pscnv driver.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Been tested on each major revision that's relevant here, but I'm sure there
are still bugs waiting to be ironed out.

This is a *very* invasive change.

There's a couple of pieces left that I don't like much (eg. other engines
using fifo_priv for the channel count), but that's an artefact of there
being a master channel list still.  This is changing, slowly.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

We never turn this on, no point maintaining the code for it..
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

PFIFO context destruction triggers this automagically now.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Now triggered automagically by the GPU on PFIFO takedown.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

PFIFO channel kickoff will hang sometimes otherwise.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

All the places this stuff is actually needed tends to be chipset-specific
anyway, so we're able to just inline the register bashing instead.

The parts of the common code that still directly touch PFIFO temporarily
have conditionals, these will be removed in subsequent commits that will
refactor the fifo modules into engine modules like graph/mpeg etc.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>