Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes

skb could have been freed by then. Also, in libertas_upload_rx_packet(),
skb->protocol is initialized by eth_type_trans().
Signed-off-by: Eugene Teo <eugeneteo@kernel.sg>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

NULL checks should be performed before the dereference.

Spotted by the Coverity checker.
Signed-off-by: Eugene Teo <eteo@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

In libertas_process_rxed_packet() and process_rxed_802_11_packet() the
skb is dereferenced after being passed to netif_rx (called from
libertas_upload_rx_packet). Spotted by Coverity (1658, 1659).

Also, libertas_upload_rx_packet() unconditionally returns 0 so the error
check is dead code - might as well take it out and change the signature.
Signed-off-by: Florin Malita <fmalita@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This reverts commit f892b7d4, which
totally broke the build on x86 with CONFIG_RELOCATABLE (which, as far as
I can tell, is the only case where it should even matter!) due to a
SIGSEGV in modpost.

Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  Add constant for FCS/CRC length (frame check sequence)
  declance: Remove a dangling spin_unlock_irq() thingy
  e1000: Don't enable polling in open() (was: e1000: assertion hit in e1000_clean(), kernel 2.6.21.1)

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  libata: bump versions
  libata: Trim trailing whitespace
  libata: Kiss post_set_mode goodbye
  ata_piix: clean up
  pata_hpt366: Enable bits are unreliable so don't use them
  libata: Add Seagate STT20000A to DMA blacklist.
  ahci: disable 64bit dma on sb600

Signed-off-by: Jeff Garzik <jeff@garzik.org>

Signed-off-by: Jeff Garzik <jeff@garzik.org>

As of the -mm tree we don't have post_set_mode users any more.
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

With cable methods in place we don't need a custom error handler for SATA
so get rid of it
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Various people had problems with both old and new IDE when hpt366 enable
bits started getting honoured. It turns out they are not reliable so
don't rely on them
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

http://bugzilla.kernel.org/show_bug.cgi?id=1044 points out an
additional hard disk that doesn't handle DMA transfers correctly.
This patch is the libata variant of the earlier patch to drivers/ide/
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

SB600 claims it can do 64bit DMA but it can't.  Disable it.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

About a dozen drivers that have some form of crc checksumming or offloading
use this constant, warranting a global define for it.
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

 The spin_unlock_irq() invocation in lance_start_xmit() has no matching
locking request.  The call is already protected by netif_tx_lock, so
remove the statement.
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Herbert Xu wrote:
"netif_poll_enable can only be called if you've previously called
netif_poll_disable.  Otherwise a poll might already be in action
and you may get a crash like this."

Removing the call to netif_poll_enable in e1000_open should fix this issue,
the only other call to netif_poll_enable is in e1000_up() which is only
reached after a device reset or resume.

Bugzilla: http://bugzilla.kernel.org/show_bug.cgi?id=8455
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240339

Tested by Doug Chapman <doug.chapman@hp.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IB/cm: Improve local id allocation
  IPoIB/cm: Fix SRQ WR leak
  IB/ipoib: Fix typos in error messages
  IB/mlx4: Check if SRQ is full when posting receive
  IB/mlx4: Pass send queue sizes from userspace to kernel
  IB/mlx4: Fix check of opcode in mlx4_ib_post_send()
  mlx4_core: Fix array overrun in dump_dev_cap_flags()
  IB/mlx4: Fix RESET to RESET and RESET to ERROR transitions
  IB/mthca: Fix RESET to ERROR transition
  IB/mlx4: Set GRH:HopLimit when sending globally routed MADs
  IB/mthca: Set GRH:HopLimit when building MLX headers
  IB/mlx4: Fix check of max_qp_dest_rdma in modify QP
  IB/mthca: Fix use-after-free on device restart
  IB/ehca: Return proper error code if register_mr fails
  IPoIB: Handle P_Key table reordering
  IB/core: Use start_port() and end_port()
  IB/core: Add helpers for uncached GID and P_Key searches
  IB/ipath: Fix potential deadlock with multicast spinlocks
  IB/core: Free umem when mm is already gone

The IB CM uses an idr for local id allocations, with a running counter
as start_id.  This fails to generate distinct ids if

1. An id is constantly created and destroyed
2. A chunk of ids just beyond the current next_id value is occupied

This in turn leads to an increased chance of connection request being
mis-detected as a duplicate, sometimes for several retries, until
next_id gets past the block of allocated ids. This has been observed
in practice.

As a fix, remember the last id allocated and start immediately above it.
This also fixes a problem with the old code, where next_id might
overflow and become negative.
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Acked-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

SRQ WR leakage has been observed with IPoIB/CM: e.g. flipping ports on
and off will, with time, leak out all WRs and then all connections
will start getting RNR NAKs.  Fix this in the way suggested by spec:
move the QP being destroyed to the error state, wait for "Last WQE
Reached" event and then post WR on a "drain QP" connected to the same
CQ.  Once we observe a completion on the drain QP, it's safe to call
ib_destroy_qp.
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Trivial error message fixups.
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

* git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fix:
  mm/slab: fix section mismatch warning
  mm: fix section mismatch warnings
  init/main: use __init_refok to fix section mismatch
  kbuild: introduce __init_refok/__initdata_refok to supress section mismatch warnings
  all-archs: consolidate .data section definition in asm-generic
  all-archs: consolidate .text section definition in asm-generic
  kbuild: add "Section mismatch" warning whitelist for powerpc
  kbuild: make better section mismatch reports on i386, arm and mips
  kbuild: make modpost section warnings clearer
  kconfig: search harder for curses library in check-lxdialog.sh
  kbuild: include limits.h in sumversion.c for PATH_MAX
  powerpc: Fix the MODALIAS generation in modpost for of devices

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] More verbose show_mem() like other architectures.
  [S390] Make use of kretprobe_assert.
  [S390] Wire up signald, timerfd and eventfd syscalls.
  [S390] Wire up sys_utimensat.
  [S390] cio: Update documentation.

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NET]: Fix race condition about network device name allocation.
  [IPV4]: icmp: fix crash with sysctl_icmp_errors_use_inbound_ifaddr
  [NETFILTER]: nf_conntrack_ipv4: fix incorrect #ifdef config name
  [NETFILTER]: nf_conntrack: fix use-after-free in helper destroy callback invocation
  [IPSEC] pfkey: Load specific algorithm in pfkey_add rather than all
  [TCP] FRTO: Prevent state inconsistency in corner cases
  [TCP] FRTO: Add missing ECN CWR sending to one of the responses
  [NET]: Fix net/core/skbuff.c gcc-3.2.3 compilation error
  [RFKILL]: Fix check for correct rfkill allocation
  [IPV6]: Add ip6_tunnel.h to headers_install

* master.kernel.org:/home/rmk/linux-2.6-arm: (22 commits)
  [ARM] spelling fixes
  [ARM] at91_adc parenthesis balance
  [ARM] 4400/1: S3C24XX: Add high-speed MMC device definition
  [ARM] 4399/2: S3C2443: Fix SMDK2443 nand timings
  [ARM] 4398/1: S3C2443: Fix watchdog IRQ number
  [ARM] 4397/1: S3C2443: remove SDI0/1 IRQ ambiguity
  [ARM] 4396/1: S3C2443: Add missing HCLK clocks
  [ARM] 4395/1: S3C24XX: add include of <linux/sysdev.h> to relevant machines
  [ARM] 4388/1: no need for arm/mm mmap range checks for non-mmu
  [ARM] 4387/1: fix /proc/cpuinfo formatting for pre-ARM7 parts
  [ARM] ARMv6: add CPU_HAS_ASID configuration
  [ARM] integrator: fix pci_v3 compile error with DEBUG_LL
  [ARM] gic: Fix gic cascade irq handling
  [ARM] Silence OMAP kernel configuration warning
  [ARM] Update ARM syscalls
  [ARM] 4384/1: S3C2412/13 SPI registers offset correction
  [ARM] 4383/1: iop: fix usage of '__init' and 'inline' in iop files
  [ARM] 4382/1: iop13xx: fix msi support
  [ARM] Remove Integrator/CP SMP platform support
  [ARM] 4378/1: KS8695: Serial driver fix
  ...

This fixes the LDM driver so that it works with Windows Vista dynamic
disks which are subtly different to Windows 2000/XP ones.

The patch was needed to get a Vista formatted dynamic disk to be
recognized and parsed successfully.

Thanks go to Chris Teachworth for the report and testing.

Cc: Richard Russon <ldm@flatcap.org>
Signed-off-by: Anton Altaparmakov <aia21@cantab.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

cr4 is a 32-bit register, so casting the mask to an unsigned char is wrong,
as it clears more than the PGE bit.
Signed-off-by: Brian Gerst <bgerst@didntduck.org>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The vsyscall time() function basically returns the second portion of
xtime directly.  This however means that there is about a ticks worth of
time each second where time() will return a second value less then what
gettimeofday() does.

Additionally, this window where vtime() is behind vgettimeofday() grows
when dynticks is enabled, so its probably good to get this in before
dynticks lands.

Big thanks to Sripathi for noticing this issue and creating a test case
to work with!

This patch changes the vtime() implemenation to call vgettimeofday(),
much as syscall time() implementation calls gettimeofday().

2.6.21 stable candidate too
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

In
	commit d358788f
	Author: Russell King <rmk@dyn-67.arm.linux.org.uk>
	Date:   Mon Mar 20 20:00:09 2006 +0000

Glen Turner reported that writing LFCR rather than the more
traditional CRLF causes issues with some terminals.

Since this afflicts many serial drivers, extract the common code to a
library function (uart_console_write) and arrange for each driver to
supply a "putchar" function.

but early_printk is left out.
Signed-off-by: Yinghai Lu <yinghai.lu@sun.com>
Cc: Russell King <rmk@arm.linux.org.uk>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix boot failures with the early CPUID checking on VIA C3

Includes fixes from Christian Volkmann
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

- boot/setup.S did not print "PANIC: CPU too old for this kernel"
  ( not visible, also the message did not match )
- I add "# missed before: set ds"
  => somebody should check if I am right with the way to set.
  => seems to be a generic error in setup.S not to set "ds" for error messages.

AK: extracted patch out of other changes
AK: also couldn't find any other case where ds is wrong
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

It reports machine check capability in CPUID, but doesn't actually
implement all the necessary MSRs of the standard Intel machine
check architecture.

This fixes a boot failure on K6s recently introduced.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The ifdef tests were broken.  Assume it acts like gcc 4
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Only try to allocate MSRs once instead of for every CPU.

This assumes the MSRs are the same on all CPUs which is currently
true. P4-HT is a special case for different SMT threads, but the code
always saves/restores all MSRs so it works identical.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

a) platorm_driver_probe(...) instead of platform_driver_register(&driver);
b) set bfin_spi_enable and bfin_spi_disable static
c) Why is the width flag a u32?
d) maybe use dev_dbg() instead of pr_debug()
Signed-off-by: Bryan Wu <bryan.wu@analog.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

properly setting up and respecting the read_status_mask / ignore_status_mask fields of the serial core
Signed-off-by: Mike Frysinger <michael.frysinger@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Aubrey Li <aubrey.li@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>