If somebody sends an invalid beacon/probe response, that can trash the
whole BSS descriptor. The descriptor is, luckily, large enough so that
it cannot scribble past the end of it; it's well above 400 bytes long.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Cc: stable@kernel.org [2.6.24-2.6.27, bug present in some form since driver was added (2.6.22)]
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Johannes Berg detected this two sparse warnings:

drivers/net/wireless/libertas/cmd.c:609:16: warning: cast to restricted __le16
drivers/net/wireless/libertas/cmd.c:611:16: warning: cast to restricted __le16

... but cmd.minlevel is "s8", so we can access it directly and hope
for the sign-extension-code in the compiler to convert that to the
"s16" type.
Signed-off-by: Holger Schurig <hs4233@mail.mn-solutions.de>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This patch fixes suspend to RAM after by moving
notify_mac out of iwlwifi mutex

http://bugzilla.kernel.org/show_bug.cgi?id=11845Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Tested-by: Carlos R. Mafra <crmafra2@gmail.com>
Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

when testing the new pktgen module with multiple queues and ixgbe with:
	pgset "flag QUEUE_MAP_CPU"

I found that I was getting errors in dmesg like:
pktgen: WARNING: QUEUE_MAP_CPU disabled because CPU count (8) exceeds number
<4>pktgen: WARNING: of tx queues (8) on eth15

you'll note, 8 really doesn't exceed 8.

This patch seemed to fix the logic errors and also the attempts at
limiting line length in printk (which didn't work anyway)
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Robert Olsson <robert.olsson@its.uu.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

Fix mac80211.h kernel-doc: it had some extra parameters that were
no longer valid and incorrect format for a return value in 2 places.

Warning(lin2628-rc2//include/net/mac80211.h:1487): Excess function parameter or struct member 'control' description in 'ieee80211_beacon_get'
Warning(lin2628-rc2//include/net/mac80211.h:1596): Excess function parameter or struct member 'control' description in 'ieee80211_get_buffered_bc'
Warning(lin2628-rc2//include/net/mac80211.h:1632): Excess function parameter or struct member 'rc4key' description in 'ieee80211_get_tkip_key'
Warning(lin2628-rc2//include/net/mac80211.h:1735): Excess function parameter or struct member 'return' description in 'ieee80211_start_tx_ba_session'
Warning(lin2628-rc2//include/net/mac80211.h:1775): Excess function parameter or struct member 'return' description in 'ieee80211_stop_tx_ba_session'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

On Saturday 25 October 2008 10:24:10 Johannes Berg wrote:
> just FYI in case you haven't seen them. the p54 one looks like a genuine
> problem.
>
> drivers/net/wireless/p54/p54common.c: In function ‘p54_parse_eeprom’:
> drivers/net/wireless/p54/p54common.c:325: warning: ‘synth’ may be used uninitialized in this function

There you go. Yes, it is a genuine problem, if the device's eeprom is screwed really up.
Signed-off-by: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

After a s2ram / resume cycle, resetting the key cache does not work
unless it is deferred until after the hardware has been reinitialised by
a call to ath5k_hw_reset(). This fixes a regression introduced by
"ath5k: fix suspend-related oops on rmmod".
Signed-off-by: Elias Oltmanns <eo@nebensachen.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Signed-off-by: John W. Linville <linville@tuxdriver.com>

Initialise correctly last fields, so tasks can be actually executed.
On some architectures the initial jiffies value is not zero, so later
all rfkill incorrectly decides that rfkill_*.last is in future.
Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This patch fixes a double-free error in p54pci
( http://bugzilla.kernel.org/show_bug.cgi?id=11782 )

Trying to free already-free IRQ 10
Pid: 108, comm: pccardd Not tainted 2.6.27-05577-g0cfd8103-dirty #1
Call Trace:
 [<c01265dc>] free_irq+0xad/0xb9
 [<c01050dd>] dma_generic_alloc_coherent+0x0/0xd7
 [<c01ba8e6>] p54p_stop+0x4a/0x1fa
 [<c01050dd>] dma_generic_alloc_coherent+0x0/0xd7
 [<c02348c5>] p54p_probe+0x23e/0x302

Tested-by: Sean Young
Signed-off-by: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Implement set_mac_address for runtime mac address change.
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

This patch corrects a message bug in the via-velocity driver which
bothered me for some time.

The messages printed during device init look like the following:

[    8.486422] eth%d: set value of parameter Wake On Lan options to 0
                  ^^!
[    8.487340] eth0: VIA Networking Velocity Family Gigabit Ethernet Adapter

Note the unresolved format string.

dev->name is unavailable before register_netdev, so use
dev_driver_string(&pdev->dev), which is also consistent with other
drivers.

"char *devname" parameters had to be converted to "const char *devname" to
be consistent with dev_driver_string return value.
Signed-off-by: Sven Hartge <sven@svenhartge.de>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

Fix !CONFIG_INET warnings.

Spotted, and original patch authored by: Manish Katiyar <mkatiyar@gmail.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

Removed duplicated #include <linux/cpumask.h> in
drivers/net/mlx4/en_main.c.
Signed-off-by: Huang Weiyi <weiyi.huang@gmail.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

The recent build fix for ibm_newemac has a typo in the config
option #ifdef used for disabling flow control.  This corrects
it to the proper Kconfig option name.
Reported-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Josh Boyer <jwboyer@linux.vnet.ibm.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

All kernel memory which is used for kernel/hardware data transfer must
be registered with firmware using "memory regions". 16GB hugepages
may not be part of a memory region due to firmware restrictions.
This patch modifies the walk_memory_resource callback fn to filter
hugepages and add only standard memory to the busmap which is later
on used for MR registration.
Signed-off-by: Thomas Klein <tklein@de.ibm.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

We need to check the address that pci_alloc_consistent() returns since
it might fail.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

To make the qeth driver more robust in case of malformatted inbound
packets due to hardware problems, an additional check for
OSN-card-type is added for OSN-type packets.
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

Removing this check improves usability because you do not have to
set the device online to initially set ipv6 routing option.
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

For the non preallocated qeth header code path we should not
change the header length.
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

IP-threads have been removed from the qeth driver. Only the
recover-thread is left over. This makes checkings for
non-recover threads superfluous.
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

David Miller noticed that commit
33ad798c '(tcp: options clean up')
did not move the req->cookie_ts check.
This essentially disabled commit 4dfc2817
'[Syncookies]: Add support for TCP options via timestamps.'.

This restores the original logic.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

free sk_buff with kfree_skb, instead of kree
Signed-off-by: Sergio Luis <sergio@larces.uece.br>
Signed-off-by: David S. Miller <davem@davemloft.net>

free sk_buff with kfree_skb, instead of kree
Signed-off-by: Sergio Luis <sergio@larces.uece.br>
Signed-off-by: David S. Miller <davem@davemloft.net>

This fixes a potential error packet loop.
Signed-off-by: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This fixes an OOPS in hard_header if a Phonet address is assigned to a
non-Phonet network interface.
Signed-off-by: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

* 'for-linus' of git://neil.brown.name/md:
  md: allow extended partitions on md devices.
  md: use sysfs_notify_dirent to notify changes to md/dev-xxx/state
  md: use sysfs_notify_dirent to notify changes to md/array_state

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: psmouse - add support for Elantech touchpads
  Input: i8042 - add Blue FB5601 to noloop exception table

* 'for-linus' of git://git.o-hand.com/linux-mfd:
  mfd: Make WM8400 depend on I2C until SPI is submitted
  mfd: add missing Kconfig entry for da903x

* 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/dvrabel/uwb:
  uwb: build UWB before USB/WUSB

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: Add support for Sony Vaio VGX-TP1E
  HID: fix lock imbalance in hiddev
  HID: fix lock imbalance in hidraw
  HID: fix hidbus/appletouch device binding regression
  HID: add hid_type to general hid struct
  HID: quirk for OLED devices present in ASUS G50/G70/G71
  HID: Remove "default m" for Thrustmaster and Zeroplus
  HID: fix hidraw_exit section mismatch
  HID: add support for another Gyration remote control
  Revert "HID: Invert HWHEEL mappings for some Logitech mice"

Fix docbook fatal errors (file location changed):

docproc: lin2628-rc1/include/asm-x86/io_32.h: No such file or directory
make[1]: *** [Documentation/DocBook/deviceiobook.xml] Error 1

docproc: lin2628-rc1/include/asm-x86/atomic_32.h: No such file or directory
make[1]: *** [Documentation/DocBook/kernel-api.xml] Error 1

docproc: lin2628-rc1/include/asm-x86/mca_dma.h: No such file or directory
make[1]: *** [Documentation/DocBook/mcabook.xml] Error 1
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Allow macros that are annotated with kernel-doc to contain whitespace
between the '#' and "define".  It's valid and being used, so allow it.
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6:
  leds-hp-disk: fix build warning
  ACPI: Oops in ACPI with git latest
  ACPI suspend: build fix for ACPI_SLEEP=n && XEN_SAVE_RESTORE=y.
  toshiba_acpi: always call input_sync() after input_report_switch()
  ACPI: Always report a sync event after a lid state change
  ACPI: cpufreq, processor: fix compile error in drivers/acpi/processor_perflib.c
  i7300_idle: Fix compile warning CONFIG_I7300_IDLE_IOAT_CHANNEL not defined
  i7300_idle: Cleanup based review comments
  i7300_idle: Disable ioat channel only on platforms where ile driver can load

.. fix all the worst problems in -rc1

If CONFIG_AMIGA_BUILTIN_SERIAL=m, I get the following warnings:

| drivers/char/amiserial.c: At top level:
| drivers/char/amiserial.c:2138: warning: data definition has no type or storage class
| drivers/char/amiserial.c:2138: warning: type defaults to 'int' in declaration of 'console_initcall'
| drivers/char/amiserial.c:2138: warning: parameter names (without types) in function declaration
| drivers/char/amiserial.c:2134: warning: 'amiserial_console_init' defined but not used

because console_initcall() is not defined (nor really sensible) in the
modular case.

So disable serial console support if the driver is modular.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

In commit f337b9c5 ("epoll: drop
unnecessary test") Thomas found that there is an unnecessary (always
true) test in ep_send_events().  The callback never inserts into
->rdllink while the send loop is performed, and also does the
~EP_PRIVATE_BITS test.  Given we're holding the mutex during this time,
the conditions tested inside the loop are always true.

HOWEVER.

The test "!ep_is_linked(&epi->rdllink)" wasn't there because we insert
into ->rdllink, but because the send-events loop might terminate before
the whole list is scanned (-EFAULT).

In such cases, when the loop terminates early, and when a (leftover)
file received an event while we're performing the lockless loop, we need
such test to avoid to double insert the epoll items.  The list_splice()
done a few steps below, will correctly re-insert the ones that were left
on "txlist".

This should fix the kenrel.org bugzilla entry 11831.
Signed-off-by: Davide Libenzi <davidel@xmailserver.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Some userland apps seem to pass in a "0" for the seconds, and several
seconds worth of usecs to select().  The old kernels accepted this just
fine, so the new kernels must too.

However, due to the upscaling of the microseconds to nanoseconds we had
some cases where we got math overflow, and depending on the GCC version
(due to inlining decisions) that actually resulted in an -EINVAL return.

This patch fixes this by adding the excess microseconds to the seconds
field.

Also with thanks to Marcin Slusarz for spotting some implementation bugs
in the diagnostics patches.
Reported-by: Carlos R. Mafra <crmafra2@gmail.com>
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>