The problem is that when new policies are inserted, sockets do not see
the update (but all new route lookups do).

This bug is related to the SA insertion stale route issue solved
recently, and this policy visibility problem can be fixed in a similar
way.

The fix is to flush out the bundles of all policies deeper than the
policy being inserted.  Consider beginning state of "outgoing"
direction policy list:

	policy A --> policy B --> policy C --> policy D

First, realize that inserting a policy into a list only potentially
changes IPSEC routes for that direction.  Therefore we need not bother
considering the policies for other directions.  We need only consider
the existing policies in the list we are doing the inserting.

Consider new policy "B'", inserted after B.

	policy A --> policy B --> policy B' --> policy C --> policy D

Two rules:

1) If policy A or policy B matched before the insertion, they
   appear before B' and thus would still match after inserting
   B'

2) Policy C and D, now "shadowed" and after policy B', potentially
   contain stale routes because policy B' might be selected
   instead of them.

Therefore we only need flush routes assosciated with policies
appearing after a newly inserted policy, if any.
Signed-off-by: David S. Miller <davem@davemloft.net>

I hope to actually change this behaviour shortly but this will help
anybody grepping code at present.
Signed-off-by: Ian McDonald <imcdnzl@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

If you add more than one IPv6 address belonging to the same prefix and 
delete the address that was last added, routing table entry for that 
prefix is also deleted.
Tested on 2.6.14.4

To reproduce:
ip addr add 3ffe::1/64 dev eth0
ip addr add 3ffe::2/64 dev eth0
/* wait DAD */
sleep 1
ip addr del 3ffe::2/64 dev eth0
ip -6 route

(route to 3ffe::/64 should be gone)

In ipv6_del_addr(), if ifa == ifp, we set ifa->if_next to NULL, and later 
assign ifap = &ifa->if_next, effectively terminating the for-loop.
This prevents us from checking if there are other addresses using the same 
prefix that are valid, and thus resulting in deletion of the prefix.
This applies only if the first entry in idev->addr_list is the address to 
be deleted.
Signed-off-by: Kristian Slavov <kristian.slavov@nomadiclab.com>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

In vlan_ioctl_handler() the code misses couple checks for
error return values.
Signed-off-by: Mika Kukkonen <mikukkon@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>

I found these while compiling with extra gcc warnings;
considering the indenting surely they are not intentional?
Signed-off-by: Mika Kukkonen <mikukkon@iki.fi>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

When compiled-in, make sure the sound system has initialized
before these drivers do.

Reported by Adrian Bunk <bunk@stusta.de>

(The right fix would be to make the sound core use "subsys_initcall()"
and thus initialize before all normal drivers, but this is the quick
and limited safe fix for 2.6.15).
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch (as618) changes usbcore to prevent derailing the
suspend/resume sequence when a USB driver doesn't include support for
it.  This is a workaround rather than a true fix; the core needs to be
changed so that URB submissions from suspended drivers can be refused
and outstanding URBs cancelled.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

When the usb-storage module forces sdev->scsi_level to SCSI_2, it should
also force starget->scsi_level to the same value.  Otherwise, the SCSI
layer may attempt to issue SCSI-3 commands to the device, such as REPORT
LUNS, which it cannot handle.  This can prevent the device from working
with Linux.

The AMS Venus DS3 DS2316SU2S SATA-to-SATA+USB enclosure, based on the
Oxford Semiconductor OXU921S chip, requires this patch to function
correctly on Linux.  The enclosure reports a SCSI-3 SPC-2 command set
level, but does not correctly handle the REPORT LUNS SCSI command -
probably due to a bug in its firmware.

It seems likely that other USB storage enclosures with similar bugs will
also benefit from this patch.

Tony Lindgren <tony@atomide.com> collaborated in the development of this
patch.
Signed-off-by: Paul Walmsley <paul@booyaka.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Jan's crosscompile page [1] shows, that one regression in 2.6.15-rc is
that the v850 defconfig does no longer compile.

The compile error is:

<--  snip  -->

...
  CC      arch/v850/kernel/setup.o
In file included from /usr/src/ctest/rc/kernel/arch/v850/kernel/setup.c:17:
/usr/src/ctest/rc/kernel/include/linux/irq.h:13:43: asm/smp.h: No such file or directory
make[2]: *** [arch/v850/kernel/setup.o] Error 1

<--  snip  -->

The #include <asm/smp.h> in irq.h was intruduced in 2.6.15-rc.

Since include/linux/irq.h needs code from asm/smp.h only in the
CONFIG_SMP=y case and linux/smp.h #include's asm/smp.h only in the
CONFIG_SMP=y case, I'm suggesting this patch to #include <linux/smp.h>
in irq.h.

I've tested the compilation with both CONFIG_SMP=y and CONFIG_SMP=n
on i386.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

A tentative address is not considered "assigned to an interface"
in the traditional sense (RFC2462 Section 4).
Don't try to select such an address for the source address.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

If the link was not available when the interface was created,
run DAD for pending tentative addresses when the link becomes ready.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

NETDEV_UP might be sent even if the link attached to the interface was
not ready.  DAD does not make sense in such case, so we won't do so.
After interface
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

There's currently a diagnostic printk in relay_switch_subbuf() meant as
a warning if you accidentally try to log an event larger than the
sub-buffer size.

The problem is if this happens while logging from somewhere it's not
safe to be doing printks, such as in the scheduler, you can end up with
a deadlock.  This patch removes the warning from relay_switch_subbuf()
and instead prints some diagnostic info when the channel is closed.

Thanks to Mathieu Desnoyers for pointing out the problem and
suggesting a fix.
Signed-off-by: Tom Zanussi <zanussi@us.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

It was a stupid workaround for the "static inline" vs.
"extern inline" issues of long ago, and it is what causes
schedule() to be inlined like crazy into kernel/sched.c
when -Os is specified.

MIPS and S390 should probably do the same.

Now CC_OPTIMIZE_FOR_SIZE can be safely used on sparc64
once more.
Signed-off-by: David S. Miller <davem@davemloft.net>

When a spinlock debugging check hits, we print the CPU number as an
informational thing - but there is no guarantee that preemption is off
at that point - hence we should use raw_smp_processor_id().  Otherwise
DEBUG_PREEMPT will print a warning.

With this fix the warning goes away and only the spinlock-debugging info
is printed.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Now needs to include the type 1 functions ("direct") too.

Reported by Pavel Roskin <proski@gnu.org>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

We must check for MAY_SATTR before setting acls, which includes checking
for read-only exports: the lower-level setxattr operation that
eventually sets the acl cannot check export-level restrictions.

Bug reported by Martin Walter <mawa@uni-freiburg.de>.
Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
Acked-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

All the work was done to setup the file and maintain the file handles but
the access functions were zeroed out due to the #ifdef.  Removing the
#ifdef allows full access to all the parameters when CONFIG_MODULES=n.

akpm: put it back again, but use CONFIG_SYSFS instead.
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The overflow checking condition in lib/swiotlb.c was wrong.
It would first run a NULL pointer through virt_to_phys before
testing it. Since pci_map_sg overflow is not that uncommon
and causes data corruption (including broken file systems) when not
properly detected I think it's better to fix it in 2.6.15.

This affects x86-64 and IA64.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Whenever ywrap scrolling is selected together with 180 degree screen
rotation, 2.6.15-rc6 and earlier versions are broken.  fb_pan_display()
expects non-negative yoffsets, but ud_update_start() calls it with
yoffsets down to -(yres - font height).  This patch transforms yoffset
to the correct range 0 ...  vyres-1.

Some obviously unneeded parentheses are removed, too.

Verified with cyblafb, should be applied before 2.6.15-final because it
does fix the framebuffer rotation code introduced early in the 2.6.15
release cycle.
Signed-off-by: Knut Petersen <Knut_Petersen@t-online.de>
Acked-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Reported by: janis huang (Bugzilla Bug 5747)

Fix on oops in intelfb.  Not sure what's happening, looks like
dinfo->name pointer is invalidated after initialization.  Remove
intelfb_get_fix, it's not needed and move the majority of the code to
the initialization routine.
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix intelfb trying to free a non-existent resource in its error path.
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The g5 thermal control for liquid cooled machines has a small bug, when
the temperatures gets too high, it boosts all fans to the max, but
incorrectly sets the liquids pump to the min instead of the max speed,
thus causing the overtemp condition not to clear and the machine to shut
down after a while. This fixes it to set the pumps to max speed instead.
This problem might explain some of the reports of random shutdowns that
some g5 users have been reporting in the past.

Many thanks to Marcus Rothe for spending a lot of time trying various
patches & sending log logs before I found out that typo. Note that
overtemp handling is still not perfect and the machine might still
shutdown, that patch should reduce if not eliminate such occcurences in
"normal" conditions with high load. I'll implement a better handling
with proper slowing down of the CPUs later.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Paul Mackerras <paulus@samba.org>

The CPM2 interrupt handler does not return success to the IRQ subsystem, which
causes it to kill the IRQ line after 100,000 interrupts.
Signed-off-by: Edson Seabra <Edson.Seabra@cyclades.com>
Signed-off-by: Marcelo Tosatti <marcelo.tosatti@cyclades.com>
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Since we don't restore the volatile registers in the syscall exit
path, we need to make sure we don't leak any potentially interesting
values from the kernel to userspace.  This was already the case for
all except r11.  This makes it use r11 for an MSR value, so r11 will
have an (uninteresting) MSR value in it on return to userspace.
Signed-off-by: Paul Mackerras <paulus@samba.org>

 When mixing -olock and -onolock mounts on the same client, we have to
 check that fl->fl_u.nfs_fl.owner is set before dereferencing it.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

 gss_create_upcall() should not error just because rpc.gssd closed the
 pipe on its end. Instead, it should requeue the pending requests and then
 retry.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

 Ensure we call unmap_mapping_range() and sync dirty pages to disk before
 doing an NFS direct write.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

 If we get something like the following,
 [  125.300636]  [<c04086e1>] schedule_timeout+0x54/0xa5
 [  125.305931]  [<c040866e>] io_schedule_timeout+0x29/0x33
 [  125.311495]  [<c02880c4>] blk_congestion_wait+0x70/0x85
 [  125.317058]  [<c014136b>] throttle_vm_writeout+0x69/0x7d
 [  125.322720]  [<c014714d>] shrink_zone+0xe0/0xfa
 [  125.327560]  [<c01471d4>] shrink_caches+0x6d/0x6f
 [  125.332581]  [<c01472a6>] try_to_free_pages+0xd0/0x1b5
 [  125.338056]  [<c013fa4b>] __alloc_pages+0x135/0x2e8
 [  125.343258]  [<c03b74ad>] tcp_sendmsg+0xaa0/0xb78
 [  125.348281]  [<c03d4666>] inet_sendmsg+0x48/0x53
 [  125.353212]  [<c0388716>] sock_sendmsg+0xb8/0xd3
 [  125.358147]  [<c0388773>] kernel_sendmsg+0x42/0x4f
 [  125.363259]  [<c038bc00>] sock_no_sendpage+0x5e/0x77
 [  125.368556]  [<c03ee7af>] xs_tcp_send_request+0x2af/0x375
 then the socket is blocked until memory is reclaimed, and no
 progress can ever be made.

 Try to access the emergency pools by using GFP_ATOMIC.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

I had thought that keeping the reported tail level clearly different
from the module name was a good idea, but I've changed my mind.

'raid5' is better and probably less confusing than 'RAID-5'.
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>