The return value of dup2 when oldfd == newfd and the fd isn't valid is
not getting properly sign extended.  We end up with 4294967287 instead
of -EBADF.

I've reproduced this on SLE11 (2.6.27.21), openSUSE Factory
(2.6.29-rc5), and Ubuntu 9.04 (2.6.28).

This patch uses a signed int for the error value so it is properly
extended.

Commit 6c5d0512 introduced this
regression.
Reported-by: Jiri Dluhos <jdluhos@novell.com>
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

PAGE_MASK is 0xFFFFF000 on i386 -- even with PAE.

So it's not sufficient to ensure that you use phys_addr_t or uint64_t
everywhere you handle physical addresses -- you also have to avoid using
the construct 'addr & PAGE_MASK', because that will strip the high 32
bits of the address.

This patch avoids that problem by using PHYSICAL_PAGE_MASK instead of
PAGE_MASK where appropriate. It leaves '& PAGE_MASK' in a few instances
that don't matter -- where it's being used on the virtual bus addresses
we're dishing out, which are 32-bit anyway.

Since PHYSICAL_PAGE_MASK is not present on other architectures, we have
to define it (to PAGE_MASK) if it's not already defined.

Maybe it would be better just to fix PAGE_MASK for i386/PAE?
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6:
  Staging: comedi: David doesn't want to get comedi patches
  Staging: rtl8187se: Fix compilation warnings and procfs directory leak
  Staging: rt2870: new device id
  Staging: w35und: unregister device from the ieee80211 stack upon ->disconnect()

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  usb-serial: ftdi_sio: fix reference counting of ftdi_private
  USB: unusual_devs: extend nokia 6288 bcd range
  USB: Gadget: fix UTF conversion in the usbstring library
  USB: Fix makefile so that CONFIG_WDM and CONFIG_TMC work.
  USB: ftdi_sio: add vendor/product id for the Marvell SheevaPlug
  USB: cxacru: Fix negative dB output

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6:
  Revert driver core: move platform_data into platform_device
  Revert driver core: fix passing platform_data
  Remove old PRINTK_DEBUG config item
  Doc/sysfs-rules: Swap the order of the words so the sentence makes more sense
  Driver core: platform: fix kernel-doc warnings

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: (22 commits)
  Fix the race between capifs remount and node creation
  Fix races around the access to ->s_options
  switch ufs directories to ufs_sync_file()
  Switch open_exec() and sys_uselib() to do_open_filp()
  Make open_exec() and sys_uselib() use may_open(), instead of duplicating its parts
  Reduce path_lookup() abuses
  Make checkpatch.pl shut up on fs/inode.c
  NULL noise in fs/super.c:kill_bdev_super()
  romfs: cleanup romfs_fs.h
  ROMFS: romfs_dev_read() error ignored
  fs: dcache fix LRU ordering
  ocfs2: Use nd_set_link().
  Fix deadlock in ipathfs ->get_sb()
  Fix a leak in failure exit in 9p ->get_sb()
  Convert obvious places to deactivate_locked_super()
  New helper: deactivate_locked_super()
  reiserfs: remove privroot hiding in lookup
  reiserfs: dont associate security.* with xattr files
  reiserfs: fixup xattr_root caching
  Always lookup priv_root on reiserfs mount and keep it
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes:
  GFS2: Fix glock ref counting bug

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: hda - Fix line-in on Mac Mini Core2 Duo
  ALSA: Release v1.0.20
  sound: via82xx: fix DXS volume range
  sound: serial-u16550: fix buffer overflow
  ASoC: Fix errors in WM8990

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6:
  V4L/DVB (11680): cafe_ccic: use = instead of == for setting a value at a var
  V4L/DVB (11679): cafe_ccic: fix sensor detection
  V4L/DVB (11675): ivtv/radio: fix V4L2_TUNER_MODE/V4L2_TUNER_SUB confusion
  V4L/DVB (11674): ivtv: fix incorrect bit tests
  V4L/DVB (11669): uvc: fix compile warning
  V4L/DVB (11668): ivtv: fix compiler warning.
  V4L/DVB (11664): cx23885: Frontend wasn't locking on HVR-1500
  V4L/DVB (11662): v4l2-ioctl: Clear buffer type specific trailing fields/padding
  V4L/DVB (11661): v4l2-ioctl: Check buffer types using g_fmt instead of try_fmt
  V4L/DVB (11660): zoran: fix bug when enumerating format -1
  V4L/DVB (11575): uvcvideo: fix uvc resume failed

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (26 commits)
  bonding: fix panic if initialization fails
  IXP4xx: complete Ethernet netdev setup before calling register_netdev().
  IXP4xx: use "ENODEV" instead of "ENOSYS" in module initialization.
  ipvs: Fix IPv4 FWMARK virtual services
  ipv4: Make INET_LRO a bool instead of tristate.
  net: remove stale reference to fastroute from Kconfig help text
  net: update skb_recycle_check() for hardware timestamping changes
  bnx2: Fix panic in bnx2_poll_work().
  net-sched: fix bfifo default limit
  igb: resolve panic on shutdown when SR-IOV is enabled
  wimax: oops: wimax_dev_add() is the only one that can initialize the state
  wimax: fix oops if netlink fails to add attribute
  Bluetooth: Move dev_set_name() to a context that can sleep
  netfilter: ctnetlink: fix wrong message type in user updates
  netfilter: xt_cluster: fix use of cluster match with 32 nodes
  netfilter: ip6t_ipv6header: fix match on packets ending with NEXTHDR_NONE
  netfilter: add missing linux/types.h include to xt_LED.h
  mac80211: pid, fix memory corruption
  mac80211: minstrel, fix memory corruption
  cfg80211: fix comment on regulatory hint processing
  ...

* fix/asoc:
  ASoC: Fix errors in WM8990

* fix/hda:
  ALSA: hda - Fix line-in on Mac Mini Core2 Duo

* topic/misc:
  ALSA: Release v1.0.20

* fix/misc:
  sound: via82xx: fix DXS volume range
  sound: serial-u16550: fix buffer overflow

/home/v4l/master/v4l/cafe_ccic.c: In function 'cafe_cam_init':
/home/v4l/master/v4l/cafe_ccic.c:778: warning: statement with no effect

Cc: Hans Verkuil <hverkuil@xs4all.nl>
Cc: saeed bishara <saeed.bishara@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

Due to an uninitialized chip.ident field the chip identification failed.

Thanks-to: Saeed Bishara <saeed.bishara@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

V4L2_TUNER_MODE_ was used in a few places where V4L2_TUNER_SUB_ should have
been used.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

Found the coccinelle tool.

Thanks-to: Julia Lawall <julia@diku.dk>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

The 2.6.30 kernel generates this warning:

uvc_driver.c:1729: warning: 'ret' may be used uninitialized in this function

I guess some new warning flag must have been turned on since this warning
didn't appear with older kernels (gcc version 4.3.1). It's also a bogus
warning, but since this code didn't comply to the coding standard anyway
I've modified it to 1) remove the warning and 2) conform to the coding
standard.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

The boards control struct wasn't updated when (presumably) all of the
other drivers migrated from using scode_table to specifying the demod.
Signed-off-by: Steven Toth <stoth@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

Some ioctls have structs that are a different size depending on what type
of buffer is being used.  If the buffer type leaves a field unused or has
padding space at the end, this space should be zeroed out.

The problems with S_FMT and REQBUFS were original identified and patched by
Marton Nemeth <nm127@freemail.hu>.
Signed-off-by: Trent Piepho <xyzzy@speakeasy.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

For a number of different ioctls, the v4l2-ioctl code checks that the
passed buffer type is supported by the driver.  It did this by checking
that the driver defined a method for the try_fmt handler for that buffer
type.  However, try_fmt is optional and a driver might not provide it even
though it does support that type.  So use g_fmt instead, since that isn't
optional.

This should fix a problem with VBI capture with saa7146.
Signed-off-by: Trent Piepho <xyzzy@speakeasy.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

If someone requests a format at fmt->index == (unsigned)-1 and the first
format in the array doesn't have the requested type then num will still be
-1 when it's compared to fmt->index and there will appear to be a match.

Restructure the loop so this can't happen.  It's simpler this way too.  The
unnecessary check for (unsigned)fmt->index < 0 found by Roel Kluin
<roel.kluin@gmail.com> is removed this way too.
Signed-off-by: Trent Piepho <xyzzy@speakeasy.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

Now urb buffers is not freed before suspend, so uvc_alloc_urb_buffers should
return packet counts allocated originally during uvc resume, instead of zero.

This version uses round down to return packet counts on Linus' suggestions,
or else may lead to buffer destructed if packet size is changed before
calling uvc_alloc_urb_buffers() in this kind of case.
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Acked-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

If module initialisation failed (e.g. because the bonding sysfs entry
cannot be created), kernel panics:
 IP: [<ffffffff8024910a>] destroy_workqueue+0x2d/0x146
Call Trace:
 [<ffffffff808268c4>] bond_destructor+0x28/0x78
 [<ffffffff80b64471>] netdev_run_todo+0x231/0x25a
 [<ffffffff80b6dbcd>] rtnl_unlock+0x9/0xb
 [<ffffffff81567907>] bonding_init+0x83e/0x84a

Remove the calls to bond_work_cancel_all() and destroy_workqueue();
both are also called/scheduled via bond_free_all().

bond_destroy_sysfs is unecessary because the sysfs entry has
not been created in the error case.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jiri Pirko <jpirko@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

we don't want to deal with half-updated config
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Put generic_show_options read access to s_options under rcu_read_lock,
split save_mount_options() into "we are setting it the first time"
(uses in foo_fill_super()) and "we are relacing and freeing the old one",
synchronize_rcu() before kfree() in the latter.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

... and make path_lookup_open() static
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

... use kern_path() where possible

[folded a fix from rdd]
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Code Quality According To Mingo(tm) has been vastly improved,
no code has been damaged^Wchanged^Wdamaged.

[commit message rewritten -- AV]
Signed-off-by: Manish Katiyar <mkatiyar@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Subrata Modak <subrata@linux.vnet.ibm.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

There's no kernel-only content in it anymore, so move it to header-y
and remove the superflous #ifdef __KERNEL__.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

romfs_dev_read() may return -EIO, but ret is unsigned, so the errorpath
isn't taken.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Fix ordering of LRU when moving referenced dentries to the head of the list
(they should go to the head of the list in the same order as they were found
from the tail, rather than reverse order).
Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

ocfs2 was hand-calling vfs_follow_link(), but there's no point to that.
Let's use page_follow_link_light() and nd_set_link().
Signed-off-by: Joel Becker <joel.becker@oracle.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

forgot to unlock superblock before calling deactivate_super()...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>