Merge http://lia64.bkbits.net/to-linus-2.5

into ppc970.osdl.org:/home/torvalds/v2.6/linux

arch/ppc64/kernel/idle.c

@@ -172,16 +172,16 @@ int dedicated_idle(void)
 		oldval = test_and_clear_thread_flag(TIF_NEED_RESCHED);
 		if (!oldval) {
 			set_thread_flag(TIF_POLLING_NRFLAG);
-			start_snooze = __get_tb();
+			start_snooze = __get_tb() +
+				naca->smt_snooze_delay*tb_ticks_per_usec;
 			while (!need_resched()) {
 				/* need_resched could be 1 or 0 at this 
 				 * point.  If it is 0, set it to 0, so
 				 * an IPI/Prod is sent.  If it is 1, keep
 				 * it that way & schedule work.
 				 */
-				if (__get_tb() < 
-				    (start_snooze + 
-				     naca->smt_snooze_delay*tb_ticks_per_usec)) {  
+				if (naca->smt_snooze_delay == 0 ||
+				    __get_tb() < start_snooze) {
 					HMT_low(); /* Low thread priority */
 					continue;
 				}

arch/ppc64/kernel/sys_ppc32.c

@@ -405,14 +405,13 @@ asmlinkage long sys32_mount(char *dev_name, char *dir_name, char *type, unsigned
 	if (err)
 		goto out;
 
-	if (!type_page) {
-		err = -EINVAL;
-		goto out;
+	if (type_page) {
+		is_smb = !strcmp((char *)type_page, SMBFS_NAME);
+		is_ncp = !strcmp((char *)type_page, NCPFS_NAME);
+	} else {
+		is_smb = is_ncp = 0;
 	}
 
-	is_smb = !strcmp((char *)type_page, SMBFS_NAME);
-	is_ncp = !strcmp((char *)type_page, NCPFS_NAME);
-
 	err = copy_mount_stuff_to_kernel((const void *)AA(data), &data_page);
 	if (err)
 		goto type_out;
@@ -534,7 +533,7 @@ filldir(void * __buf, const char * name, int namlen, off_t offset, ino_t ino,
 {
 	struct linux_dirent32 * dirent;
 	struct getdents_callback32 * buf = (struct getdents_callback32 *) __buf;
-	int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
+	int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 2);
 
 	buf->error = -EINVAL;	/* only used if we fail.. */
 	if (reclen > buf->count)
@@ -548,6 +547,7 @@ filldir(void * __buf, const char * name, int namlen, off_t offset, ino_t ino,
 	put_user(reclen, &dirent->d_reclen);
 	copy_to_user(dirent->d_name, name, namlen);
 	put_user(0, dirent->d_name + namlen);
+	put_user(d_type, (char *) dirent + reclen - 1);
 	((char *) dirent) += reclen;
 	buf->current_dir = dirent;
 	buf->count -= reclen;

drivers/block/Kconfig

@@ -6,7 +6,7 @@ menu "Block devices"
 
 config BLK_DEV_FD
 	tristate "Normal floppy disk support"
-	depends on (!X86_PC9800 && !ARCH_S390 && !M68K) || Q40 || (SUN3X && BROKEN)
+	depends on (!X86_PC9800 && !ARCH_S390 && !M68K && !IA64) || Q40 || (SUN3X && BROKEN)
 	---help---
 	  If you want to use the floppy disk drive(s) of your PC under Linux,
 	  say Y. Information about this driver, especially important for IBM

drivers/cdrom/cdrom.c

@@ -725,7 +725,7 @@ static int cdrom_media_erasable(struct cdrom_device_info *cdi)
 	disc_information di;
 
 	if (cdrom_get_disc_info(cdi, &di))
-		return 0;
+		return -1;
 
 	return di.erasable;
 }
@@ -735,7 +735,16 @@ static int cdrom_media_erasable(struct cdrom_device_info *cdi)
  */
 static int cdrom_dvdram_open_write(struct cdrom_device_info *cdi)
 {
-	return !cdrom_media_erasable(cdi);
+	int ret = cdrom_media_erasable(cdi);
+
+	/*
+	 * allow writable open if media info read worked and media is
+	 * erasable, _or_ if it fails since not all drives support it
+	 */
+	if (!ret)
+		return 1;
+
+	return 0;
 }
 
 static int cdrom_mrw_open_write(struct cdrom_device_info *cdi)

drivers/char/vt.c

@@ -2487,11 +2487,13 @@ static void con_close(struct tty_struct *tty, struct file *filp)
 	if (tty && tty->count == 1) {
 		struct vt_struct *vt;
 
-		vcs_remove_devfs(tty);
 		vt = tty->driver_data;
 		if (vt)
 			vc_cons[vt->vc_num].d->vc_tty = NULL;
 		tty->driver_data = 0;
+		release_console_sem();
+		vcs_remove_devfs(tty);
+		return;
 	}
 	release_console_sem();
 }

drivers/ide/ide-cd.c

@@ -3510,6 +3510,7 @@ static int ide_cdrom_attach (ide_drive_t *drive)
 
 	cdrom_read_toc(drive, &sense);
 	g->fops = &idecd_ops;
+	g->flags |= GENHD_FL_REMOVABLE;
 	add_disk(g);
 	return 0;
 failed:

drivers/net/b44.c

@@ -1892,6 +1892,8 @@ static int b44_resume(struct pci_dev *pdev)
 	if (!netif_running(dev))
 		return 0;
 
+	pci_restore_state(pdev, bp->pci_cfg_state);
+
 	spin_lock_irq(&bp->lock);
 
 	b44_init_rings(bp);

drivers/scsi/Kconfig

@@ -443,7 +443,7 @@ config SCSI_SATA_PROMISE
 
 config SCSI_SATA_SIL
 	tristate "Silicon Image SATA support"
-	depends on SCSI_SATA && PCI && BROKEN
+	depends on SCSI_SATA && PCI && EXPERIMENTAL
 	help
 	  This option enables support for Silicon Image Serial ATA.
 

drivers/scsi/sata_via.c

@@ -205,7 +205,7 @@ static int svia_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
 	INIT_LIST_HEAD(&probe_ent->node);
 	probe_ent->pdev = pdev;
 	probe_ent->sht = &svia_sht;
-	probe_ent->host_flags = ATA_FLAG_SATA | ATA_FLAG_SATA_RESET |
+	probe_ent->host_flags = ATA_FLAG_SATA | ATA_FLAG_SRST |
 				ATA_FLAG_NO_LEGACY;
 	probe_ent->port_ops = &svia_sata_ops;
 	probe_ent->n_ports = 2;

drivers/scsi/sr.c

@@ -575,6 +575,7 @@ static int sr_probe(struct device *dev)
 		goto fail_put;
 
 	dev_set_drvdata(dev, cd);
+	disk->flags |= GENHD_FL_REMOVABLE;
 	add_disk(disk);
 
 	printk(KERN_DEBUG

fs/ext2/ialloc.c

@@ -294,7 +294,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent)
 	ndirs = percpu_counter_read_positive(&sbi->s_dirs_counter);
 
 	if ((parent == sb->s_root->d_inode) ||
-	    (parent->i_flags & EXT2_TOPDIR_FL)) {
+	    (EXT2_I(parent)->i_flags & EXT2_TOPDIR_FL)) {
 		struct ext2_group_desc *best_desc = NULL;
 		struct buffer_head *best_bh = NULL;
 		int best_ndir = inodes_per_group;

fs/ext3/ialloc.c

@@ -275,7 +275,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent)
 	ndirs = percpu_counter_read_positive(&sbi->s_dirs_counter);
 
 	if ((parent == sb->s_root->d_inode) ||
-	    (parent->i_flags & EXT3_TOPDIR_FL)) {
+	    (EXT3_I(parent)->i_flags & EXT3_TOPDIR_FL)) {
 		int best_ndir = inodes_per_group;
 		int best_group = -1;
 

fs/jfs/jfs_dmap.c

@@ -1526,6 +1526,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
 			if (n == 4) {
 				jfs_error(bmp->db_ipbmap->i_sb,
 					  "dbAllocAG: failed descending stree");
+				release_metapage(mp);
 				return -EIO;
 			}
 		}
@@ -3310,7 +3311,7 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno,	s64 nblocks)
 	int i, i0 = TRUE, j, j0 = TRUE, k, n;
 	s64 newsize;
 	s64 p;
-	struct metapage *mp, *l2mp, *l1mp, *l0mp;
+	struct metapage *mp, *l2mp, *l1mp = NULL, *l0mp = NULL;
 	struct dmapctl *l2dcp, *l1dcp, *l0dcp;
 	struct dmap *dp;
 	s8 *l0leaf, *l1leaf, *l2leaf;
@@ -3513,6 +3514,7 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno,	s64 nblocks)
 			 */
 			*l1leaf = dbInitDmapCtl(l0dcp, 0, ++i);
 			write_metapage(l0mp);
+			l0mp = NULL;
 
 			if (nblocks)
 				l1leaf++;	/* continue for next L0 */
@@ -3536,6 +3538,7 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno,	s64 nblocks)
 		 */
 		*l2leaf = dbInitDmapCtl(l1dcp, 1, ++j);
 		write_metapage(l1mp);
+		l1mp = NULL;
 
 		if (nblocks)
 			l2leaf++;	/* continue for next L1 */
@@ -3554,17 +3557,20 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno,	s64 nblocks)
 
 	jfs_error(ipbmap->i_sb,
 		  "dbExtendFS: function has not returned as expected");
+errout:
+	if (l0mp)
+		release_metapage(l0mp);
+	if (l1mp)
+		release_metapage(l1mp);
+	release_metapage(l2mp);
 	return -EIO;
 
 	/*
 	 *      finalize bmap control page
 	 */
-      finalize:
+finalize:
 
 	return 0;
-
-      errout:
-	return -EIO;
 }
 
 

fs/jfs/jfs_dtree.c

@@ -1423,8 +1423,10 @@ static int dtSplitPage(tid_t tid, struct inode *ip, struct dtsplit * split,
 	 */
 	if (nextbn != 0) {
 		DT_GETPAGE(ip, nextbn, mp, PSIZE, p, rc);
-		if (rc)
+		if (rc) {
+			discard_metapage(rmp);
 			return rc;
+		}
 
 		BT_MARK_DIRTY(mp, ip);
 		/*
@@ -2235,8 +2237,10 @@ static int dtDeleteUp(tid_t tid, struct inode *ip,
 	pxdlock->index = 1;
 
 	/* update sibling pointers */
-	if ((rc = dtRelink(tid, ip, fp)))
+	if ((rc = dtRelink(tid, ip, fp))) {
+		BT_PUTPAGE(fmp);
 		return rc;
+	}
 
 	xlen = lengthPXD(&fp->header.self);
 	ip->i_blocks -= LBLK2PBLK(ip->i_sb, xlen);
@@ -2307,8 +2311,10 @@ static int dtDeleteUp(tid_t tid, struct inode *ip,
 				pxdlock->index = 1;
 
 				/* update sibling pointers */
-				if ((rc = dtRelink(tid, ip, p)))
+				if ((rc = dtRelink(tid, ip, p))) {
+					DT_PUTPAGE(mp);
 					return rc;
+				}
 
 				xlen = lengthPXD(&p->header.self);
 				ip->i_blocks -= LBLK2PBLK(ip->i_sb, xlen);
@@ -2621,8 +2627,10 @@ static int dtSearchNode(struct inode *ip, s64 lmxaddr, pxd_t * kpxd,
 		/*
 		 * descend down to leftmost child page
 		 */
-		if (p->header.flag & BT_LEAF)
+		if (p->header.flag & BT_LEAF) {
+			DT_PUTPAGE(mp);
 			return -ESTALE;
+		}
 
 		/* get the leftmost entry */
 		stbl = DT_GETSTBL(p);

fs/jfs/jfs_imap.c

@@ -1546,6 +1546,7 @@ int diAlloc(struct inode *pip, boolean_t dir, struct inode *ip)
 						 0);
 				if (rem >= INOSPEREXT) {
 					IREAD_UNLOCK(ipimap);
+					release_metapage(mp);
 					AG_UNLOCK(imap, agno);
 					jfs_error(ip->i_sb,
 						  "diAlloc: can't find free bit "
@@ -1840,6 +1841,7 @@ static int diAllocIno(struct inomap * imap, int agno, struct inode *ip)
 	 */
 	if (!iagp->nfreeinos) {
 		IREAD_UNLOCK(imap->im_ipimap);
+		release_metapage(mp);
 		jfs_error(ip->i_sb,
 			  "diAllocIno: nfreeinos = 0, but iag on freelist");
 		return -EIO;
@@ -1851,6 +1853,7 @@ static int diAllocIno(struct inomap * imap, int agno, struct inode *ip)
 	for (sword = 0;; sword++) {
 		if (sword >= SMAPSZ) {
 			IREAD_UNLOCK(imap->im_ipimap);
+			release_metapage(mp);
 			jfs_error(ip->i_sb,
 				  "diAllocIno: free inode not found in summary map");
 			return -EIO;
@@ -1866,6 +1869,7 @@ static int diAllocIno(struct inomap * imap, int agno, struct inode *ip)
 	rem = diFindFree(le32_to_cpu(iagp->inosmap[sword]), 0);
 	if (rem >= EXTSPERSUM) {
 		IREAD_UNLOCK(imap->im_ipimap);
+		release_metapage(mp);
 		jfs_error(ip->i_sb, "diAllocIno: no free extent found");
 		return -EIO;
 	}
@@ -1876,6 +1880,7 @@ static int diAllocIno(struct inomap * imap, int agno, struct inode *ip)
 	rem = diFindFree(le32_to_cpu(iagp->wmap[extno]), 0);
 	if (rem >= INOSPEREXT) {
 		IREAD_UNLOCK(imap->im_ipimap);
+		release_metapage(mp);
 		jfs_error(ip->i_sb, "diAllocIno: free inode not found");
 		return -EIO;
 	}
@@ -2839,12 +2844,14 @@ diUpdatePMap(struct inode *ipimap,
 		 * and should be free in persistent map;
 		 */
 		if (!(le32_to_cpu(iagp->wmap[extno]) & mask)) {
+			release_metapage(mp);
 			jfs_error(ipimap->i_sb,
 				  "diUpdatePMap: the inode is not allocated in "
 				  "the working map");
 			return -EIO;
 		}
 		if ((le32_to_cpu(iagp->pmap[extno]) & mask) != 0) {
+			release_metapage(mp);
 			jfs_error(ipimap->i_sb,
 				  "diUpdatePMap: the inode is not free in the "
 				  "persistent map");

fs/jfs/jfs_logmgr.c

@@ -979,7 +979,6 @@ static int lmLogSync(struct jfs_log * log, int nosyncwait)
 		 * We need to make sure all of the "written" metapages
 		 * actually make it to disk
 		 */
-		down(&jfs_log_sem);
 		list_for_each_entry(sbi, &log->sb_list, log_list) {
 			filemap_fdatawrite(sbi->ipbmap->i_mapping);
 			filemap_fdatawrite(sbi->ipimap->i_mapping);
@@ -990,7 +989,6 @@ static int lmLogSync(struct jfs_log * log, int nosyncwait)
 			filemap_fdatawait(sbi->ipimap->i_mapping);
 			filemap_fdatawait(sbi->sb->s_bdev->bd_inode->i_mapping);
 		}
-		up(&jfs_log_sem);
 
 		lrd.logtid = 0;
 		lrd.backchain = 0;
@@ -1151,8 +1149,10 @@ int lmLogOpen(struct super_block *sb)
 		goto shutdown;
 
 journal_found:
+	LOG_LOCK(log);
 	list_add(&sbi->log_list, &log->sb_list);
 	sbi->log = log;
+	LOG_UNLOCK(log);
 
 	up(&jfs_log_sem);
 	return 0;
@@ -1237,8 +1237,10 @@ static int open_dummy_log(struct super_block *sb)
 		}
 	}
 
+	LOG_LOCK(dummy_log);
 	list_add(&JFS_SBI(sb)->log_list, &dummy_log->sb_list);
 	JFS_SBI(sb)->log = dummy_log;
+	LOG_UNLOCK(dummy_log);
 	up(&jfs_log_sem);
 
 	return 0;
@@ -1469,7 +1471,9 @@ int lmLogClose(struct super_block *sb)
 	jfs_info("lmLogClose: log:0x%p", log);
 
 	down(&jfs_log_sem);
+	LOG_LOCK(log);
 	list_del(&sbi->log_list);
+	LOG_UNLOCK(log);
 	sbi->log = NULL;
 
 	/*

fs/jfs/jfs_txnmgr.c

@@ -1356,9 +1356,6 @@ static int txLog(struct jfs_log * log, struct tblock * tblk, struct commit * cd)
 		lrd->log.redopage.fileset = cpu_to_le32(JFS_IP(ip)->fileset);
 		lrd->log.redopage.inode = cpu_to_le32(ip->i_ino);
 
-		if (tlck->mp)
-			hold_metapage(tlck->mp, 0);
-
 		/* write log record of page from the tlock */
 		switch (tlck->type & tlckTYPE) {
 		case tlckXTREE:
@@ -1384,8 +1381,6 @@ static int txLog(struct jfs_log * log, struct tblock * tblk, struct commit * cd)
 		default:
 			jfs_err("UFO tlock:0x%p", tlck);
 		}
-		if (tlck->mp)
-			release_metapage(tlck->mp);
 	}
 
 	return rc;
@@ -1535,6 +1530,7 @@ static int dataLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
 		 * the last entry, so don't bother logging this
 		 */
 		mp->lid = 0;
+		hold_metapage(mp, 0);
 		atomic_dec(&mp->nohomeok);
 		discard_metapage(mp);
 		tlck->mp = 0;

fs/super.c

@@ -636,7 +636,7 @@ struct super_block *get_sb_bdev(struct file_system_type *fs_type,
 		char b[BDEVNAME_SIZE];
 
 		s->s_flags = flags;
-		strncpy(s->s_id, bdevname(bdev, b), sizeof(s->s_id));
+		strlcpy(s->s_id, bdevname(bdev, b), sizeof(s->s_id));
 		s->s_old_blocksize = block_size(bdev);
 		sb_set_blocksize(s, s->s_old_blocksize);
 		error = fill_super(s, data, flags & MS_VERBOSE ? 1 : 0);

include/asm-x86_64/pci.h

@@ -49,7 +49,7 @@ struct pci_dev;
 extern int iommu_setup(char *opt);
 
 extern dma_addr_t bad_dma_address;
-#define pci_dma_error(x) ((x) == bad_dma_address)
+#define pci_dma_mapping_error(x) ((x) == bad_dma_address)
 
 /* Allocate and map kernel buffer using consistent mode DMA for a device.
  * hwdev should be valid struct pci_dev pointer for PCI devices,

net/ipv4/Kconfig

@@ -287,25 +287,6 @@ config ARPD
 	  and you should also say Y to "Kernel/User network link driver",
 	  below. If unsure, say N.
 
-config INET_ECN
-	bool "IP: TCP Explicit Congestion Notification support"
-	depends on INET
-	---help---
-	  Explicit Congestion Notification (ECN) allows routers to notify
-	  clients about network congestion, resulting in fewer dropped packets
-	  and increased network performance.  This option adds ECN support to
-	  the Linux kernel, as well as a sysctl (/proc/sys/net/ipv4/tcp_ecn)
-	  which allows ECN support to be disabled at runtime.
-
-	  Note that, on the Internet, there are many broken firewalls which
-	  refuse connections from ECN-enabled machines, and it may be a while
-	  before these firewalls are fixed.  Until then, to access a site
-	  behind such a firewall (some of which are major sites, at the time
-	  of this writing) you will have to disable this option, either by
-	  saying N now or by using the sysctl.
-
-	  If in doubt, say N.
-
 config SYN_COOKIES
 	bool "IP: TCP syncookie support (disabled per default)"
 	depends on INET

net/ipv4/ipvs/ip_vs_conn.c

@@ -125,25 +125,27 @@ static unsigned int ip_vs_conn_hashkey(unsigned proto, __u32 addr, __u16 port)
 static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
 {
 	unsigned hash;
-
-	if (cp->flags & IP_VS_CONN_F_HASHED) {
-		IP_VS_ERR("ip_vs_conn_hash(): request for already hashed, "
-			  "called from %p\n", __builtin_return_address(0));
-		return 0;
-	}
+	int ret;
 
 	/* Hash by protocol, client address and port */
 	hash = ip_vs_conn_hashkey(cp->protocol, cp->caddr, cp->cport);
 
 	ct_write_lock(hash);
 
-	list_add(&cp->c_list, &ip_vs_conn_tab[hash]);
-	cp->flags |= IP_VS_CONN_F_HASHED;
-	atomic_inc(&cp->refcnt);
+	if (!(cp->flags & IP_VS_CONN_F_HASHED)) {
+		list_add(&cp->c_list, &ip_vs_conn_tab[hash]);
+		cp->flags |= IP_VS_CONN_F_HASHED;
+		atomic_inc(&cp->refcnt);
+		ret = 1;
+	} else {
+		IP_VS_ERR("ip_vs_conn_hash(): request for already hashed, "
+			  "called from %p\n", __builtin_return_address(0));
+		ret = 0;
+	}
 
 	ct_write_unlock(hash);
 
-	return 1;
+	return ret;
 }
 
 
@@ -154,24 +156,24 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
 static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
 {
 	unsigned hash;
-
-	if (!(cp->flags & IP_VS_CONN_F_HASHED)) {
-		IP_VS_ERR("ip_vs_conn_unhash(): request for unhash flagged, "
-			  "called from %p\n", __builtin_return_address(0));
-		return 0;
-	}
+	int ret;
 
 	/* unhash it and decrease its reference counter */
 	hash = ip_vs_conn_hashkey(cp->protocol, cp->caddr, cp->cport);
+
 	ct_write_lock(hash);
 
-	list_del(&cp->c_list);
-	cp->flags &= ~IP_VS_CONN_F_HASHED;
-	atomic_dec(&cp->refcnt);
+	if (cp->flags & IP_VS_CONN_F_HASHED) {
+		list_del(&cp->c_list);
+		cp->flags &= ~IP_VS_CONN_F_HASHED;
+		atomic_dec(&cp->refcnt);
+		ret = 1;
+	} else
+		ret = 0;
 
 	ct_write_unlock(hash);
 
-	return 1;
+	return ret;
 }
 
 
@@ -285,12 +287,18 @@ void ip_vs_conn_put(struct ip_vs_conn *cp)
  */
 void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __u16 cport)
 {
-	atomic_dec(&ip_vs_conn_no_cport_cnt);
-	ip_vs_conn_unhash(cp);
-	cp->flags &= ~IP_VS_CONN_F_NO_CPORT;
-	cp->cport = cport;
-	/* hash on new dport */
-	ip_vs_conn_hash(cp);
+	if (ip_vs_conn_unhash(cp)) {
+		spin_lock(&cp->lock);
+		if (cp->flags & IP_VS_CONN_F_NO_CPORT) {
+			atomic_dec(&ip_vs_conn_no_cport_cnt);
+			cp->flags &= ~IP_VS_CONN_F_NO_CPORT;
+			cp->cport = cport;
+		}
+		spin_unlock(&cp->lock);
+
+		/* hash on new dport */
+		ip_vs_conn_hash(cp);
+	}
 }
 
 
@@ -457,11 +465,14 @@ int ip_vs_check_template(struct ip_vs_conn *ct)
 		/*
 		 * Invalidate the connection template
 		 */
-		ip_vs_conn_unhash(ct);
-		ct->dport = 65535;
-		ct->vport = 65535;
-		ct->cport = 0;
-		ip_vs_conn_hash(ct);
+		if (ct->cport) {
+			if (ip_vs_conn_unhash(ct)) {
+				ct->dport = 65535;
+				ct->vport = 65535;
+				ct->cport = 0;
+				ip_vs_conn_hash(ct);
+			}
+		}
 
 		/*
 		 * Simply decrease the refcnt of the template,
@@ -493,7 +504,8 @@ static void ip_vs_conn_expire(unsigned long data)
 	/*
 	 *	unhash it if it is hashed in the conn table
 	 */
-	ip_vs_conn_unhash(cp);
+	if (!ip_vs_conn_unhash(cp))
+		goto expire_later;
 
 	/*
 	 *	refcnt==1 implies I'm the only one referrer

net/ipv4/ipvs/ip_vs_ctl.c

@@ -898,9 +898,16 @@ ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
 
 	__ip_vs_update_dest(svc, dest, udest);
 
+	write_lock_bh(&__ip_vs_svc_lock);
+
+	/* Wait until all other svc users go away */
+	while (atomic_read(&svc->usecnt) > 1) {};
+
 	/* call the update_service, because server weight may be changed */
 	svc->scheduler->update_service(svc);
 
+	write_unlock_bh(&__ip_vs_svc_lock);
+
 	LeaveFunction(2);
 
 	return 0;

net/ipv4/netfilter/Kconfig

@@ -363,7 +363,7 @@ config IP_NF_NAT_LOCAL
 
 	  Please note that you will need a recent version (>= 1.2.6a)
 	  of the iptables userspace program in order to use this feature.
-	  See http://www.iptables.org/ for download instructions.
+	  See <http://www.iptables.org/> for download instructions.
 
 	  If unsure, say 'N'.
 
@@ -497,7 +497,7 @@ config IP_NF_TARGET_ULOG
 	  which can only be viewed through syslog.
 
 	  The apropriate userspace logging daemon (ulogd) may be obtained from
-	  http://www.gnumonks.org/projects/ulogd
+	  <http://www.gnumonks.org/projects/ulogd/>
 
 	  To compile it as a module, choose M here.  If unsure, say N.
 

net/ipv4/netfilter/ip_fw_compat_masq.c

@@ -221,7 +221,7 @@ static const char *masq_proto_name(u_int16_t protonum)
 	case IPPROTO_TCP: return "TCP";
 	case IPPROTO_UDP: return "UDP";
 	case IPPROTO_ICMP: return "ICMP";
-	default: return "MORE-CAFFIENE-FOR-RUSTY";
+	default: return "MORE-CAFFEINE-FOR-RUSTY";
 	}
 }
 

net/ipv4/netfilter/ipchains_core.c

@@ -101,6 +101,7 @@
 #include <linux/stat.h>
 
 MODULE_LICENSE("Dual BSD/GPL");
+MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
 MODULE_DESCRIPTION("ipchains backwards compatibility layer");
 
 /* Understanding locking in this code: (thanks to Alan Cox for using

net/ipv4/tcp_diag.c

@@ -167,10 +167,8 @@ static int tcpdiag_fill(struct sk_buff *skb, struct sock *sk,
 			info->tcpi_snd_wscale = 0;
 			info->tcpi_rcv_wscale = 0;
 		}
-#ifdef CONFIG_INET_ECN
 		if (tp->ecn_flags&TCP_ECN_OK)
 			info->tcpi_options |= TCPI_OPT_ECN;
-#endif
 
 		info->tcpi_rto = (1000000*tp->rto)/HZ;
 		info->tcpi_ato = (1000000*tp->ack.ato)/HZ;

net/ipv4/tcp_input.c

@@ -77,11 +77,7 @@ int sysctl_tcp_window_scaling = 1;
 int sysctl_tcp_sack = 1;
 int sysctl_tcp_fack = 1;
 int sysctl_tcp_reordering = TCP_FASTRETRANS_THRESH;
-#ifdef CONFIG_INET_ECN
-int sysctl_tcp_ecn = 1;
-#else
 int sysctl_tcp_ecn;
-#endif
 int sysctl_tcp_dsack = 1;
 int sysctl_tcp_app_win = 31;
 int sysctl_tcp_adv_win_scale = 2;

net/ipv6/ip6_output.c

@@ -821,6 +821,9 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offse
 						       sk->sk_allocation);
 				if (unlikely(np->cork.opt == NULL))
 					return -ENOBUFS;
+			} else if (np->cork.opt->tot_len < opt->tot_len) {
+				printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
+				return -EINVAL;
 			}
 			memcpy(np->cork.opt, opt, opt->tot_len);
 			inet->cork.flags |= IPCORK_OPT;

net/key/af_key.c

@@ -1879,6 +1879,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
 		err = -EINVAL;
 		goto out;
 	}
+	xp->selector.family = xp->family;
 	xp->selector.prefixlen_s = sa->sadb_address_prefixlen;
 	xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
 	xp->selector.sport = ((struct sockaddr_in *)(sa+1))->sin_port;

net/sched/sch_tbf.c

@@ -62,7 +62,7 @@
 
 	Algorithm.
 	----------
-	
+
 	Let N(t_i) be B/R initially and N(t) grow continuously with time as:
 
 	N(t+delta) = min{B/R, N(t) + delta}
@@ -146,15 +146,15 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 		if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch))
 #endif
 			kfree_skb(skb);
-	
+
 		return NET_XMIT_DROP;
 	}
-	
+
 	if ((ret = q->qdisc->enqueue(skb, q->qdisc)) != 0) {
 		sch->stats.drops++;
 		return ret;
-	}	
-	
+	}
+
 	sch->q.qlen++;
 	sch->stats.bytes += skb->len;
 	sch->stats.packets++;
@@ -165,10 +165,10 @@ static int tbf_requeue(struct sk_buff *skb, struct Qdisc* sch)
 {
 	struct tbf_sched_data *q = (struct tbf_sched_data *)sch->data;
 	int ret;
-	
+
 	if ((ret = q->qdisc->ops->requeue(skb, q->qdisc)) == 0)
-		sch->q.qlen++; 
-	
+		sch->q.qlen++;
+
 	return ret;
 }
 
@@ -176,7 +176,7 @@ static unsigned int tbf_drop(struct Qdisc* sch)
 {
 	struct tbf_sched_data *q = (struct tbf_sched_data *)sch->data;
 	unsigned int len;
-	
+
 	if ((len = q->qdisc->ops->drop(q->qdisc)) != 0) {
 		sch->q.qlen--;
 		sch->stats.drops++;
@@ -196,7 +196,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc* sch)
 {
 	struct tbf_sched_data *q = (struct tbf_sched_data *)sch->data;
 	struct sk_buff *skb;
-	
+
 	skb = q->qdisc->dequeue(q->qdisc);
 
 	if (skb) {
@@ -204,7 +204,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc* sch)
 		long toks;
 		long ptoks = 0;
 		unsigned int len = skb->len;
-		
+
 		PSCHED_GET_TIME(now);
 
 		toks = PSCHED_TDIFF_SAFE(now, q->t_c, q->buffer, 0);
@@ -248,13 +248,13 @@ static struct sk_buff *tbf_dequeue(struct Qdisc* sch)
 		   This is the main idea of all FQ algorithms
 		   (cf. CSZ, HPFQ, HFSC)
 		 */
-		
+
 		if (q->qdisc->ops->requeue(skb, q->qdisc) != NET_XMIT_SUCCESS) {
-			/* When requeue fails skb is dropped */ 
+			/* When requeue fails skb is dropped */
 			sch->q.qlen--;
 			sch->stats.drops++;
-		}	
-		
+		}
+
 		sch->flags |= TCQ_F_THROTTLED;
 		sch->stats.overlimits++;
 	}
@@ -279,24 +279,24 @@ static struct Qdisc *tbf_create_dflt_qdisc(struct net_device *dev, u32 limit)
 	struct Qdisc *q = qdisc_create_dflt(dev, &bfifo_qdisc_ops);
         struct rtattr *rta;
 	int ret;
-	
+
 	if (q) {
 		rta = kmalloc(RTA_LENGTH(sizeof(struct tc_fifo_qopt)), GFP_KERNEL);
 		if (rta) {
 			rta->rta_type = RTM_NEWQDISC;
 			rta->rta_len = RTA_LENGTH(sizeof(struct tc_fifo_qopt)); 
 			((struct tc_fifo_qopt *)RTA_DATA(rta))->limit = limit;
-			
+
 			ret = q->ops->change(q, rta);
 			kfree(rta);
-			
+
 			if (ret == 0)
 				return q;
 		}
 		qdisc_destroy(q);
 	}
 
-	return NULL;	
+	return NULL;
 }
 
 static int tbf_change(struct Qdisc* sch, struct rtattr *opt)
@@ -340,7 +340,7 @@ static int tbf_change(struct Qdisc* sch, struct rtattr *opt)
 	}
 	if (max_size < 0)
 		goto done;
-	
+
 	if (q->qdisc == &noop_qdisc) {
 		if ((child = tbf_create_dflt_qdisc(sch->dev, qopt->limit)) == NULL)
 			goto done;
@@ -369,17 +369,17 @@ static int tbf_change(struct Qdisc* sch, struct rtattr *opt)
 static int tbf_init(struct Qdisc* sch, struct rtattr *opt)
 {
 	struct tbf_sched_data *q = (struct tbf_sched_data *)sch->data;
-	
+
 	if (opt == NULL)
 		return -EINVAL;
-	
+
 	PSCHED_GET_TIME(q->t_c);
 	init_timer(&q->wd_timer);
 	q->wd_timer.function = tbf_watchdog;
 	q->wd_timer.data = (unsigned long)sch;
 
 	q->qdisc = &noop_qdisc;
-	
+
 	return tbf_change(sch, opt);
 }
 
@@ -393,7 +393,7 @@ static void tbf_destroy(struct Qdisc *sch)
 		qdisc_put_rtab(q->P_tab);
 	if (q->R_tab)
 		qdisc_put_rtab(q->R_tab);
-	
+
 	qdisc_destroy(q->qdisc);
 	q->qdisc = &noop_qdisc;
 }
@@ -404,10 +404,10 @@ static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
 	unsigned char	 *b = skb->tail;
 	struct rtattr *rta;
 	struct tc_tbf_qopt opt;
-	
+
 	rta = (struct rtattr*)b;
 	RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
-	
+
 	opt.limit = q->limit;
 	opt.rate = q->R_tab->rate;
 	if (q->P_tab)
@@ -427,15 +427,14 @@ static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
 }
 
 static int tbf_dump_class(struct Qdisc *sch, unsigned long cl,
-	       		  struct sk_buff *skb, struct tcmsg *tcm)
+			  struct sk_buff *skb, struct tcmsg *tcm)
 {
 	struct tbf_sched_data *q = (struct tbf_sched_data*)sch->data;
 
-	if (cl != 1) 	/* only one class */ 
+	if (cl != 1) 	/* only one class */
 		return -ENOENT;
-    
-	tcm->tcm_parent = TC_H_ROOT;
-	tcm->tcm_handle = 1;
+
+	tcm->tcm_handle |= TC_H_MIN(1);
 	tcm->tcm_info = q->qdisc->handle;
 
 	return 0;
@@ -449,12 +448,12 @@ static int tbf_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
 	if (new == NULL)
 		new = &noop_qdisc;
 
-	sch_tree_lock(sch);	
+	sch_tree_lock(sch);
 	*old = xchg(&q->qdisc, new);
 	qdisc_reset(*old);
 	sch->q.qlen = 0;
 	sch_tree_unlock(sch);
-	
+
 	return 0;
 }
 
@@ -474,7 +473,7 @@ static void tbf_put(struct Qdisc *sch, unsigned long arg)
 }
 
 static int tbf_change_class(struct Qdisc *sch, u32 classid, u32 parentid, 
-			struct rtattr **tca, unsigned long *arg)
+			    struct rtattr **tca, unsigned long *arg)
 {
 	return -ENOSYS;
 }
@@ -486,11 +485,9 @@ static int tbf_delete(struct Qdisc *sch, unsigned long arg)
 
 static void tbf_walk(struct Qdisc *sch, struct qdisc_walker *walker)
 {
-	struct tbf_sched_data *q = (struct tbf_sched_data *)sch->data;
-
 	if (!walker->stop) {
-		if (walker->count >= walker->skip) 
-			if (walker->fn(sch, (unsigned long)q, walker) < 0) { 
+		if (walker->count >= walker->skip)
+			if (walker->fn(sch, 1, walker) < 0) {
 				walker->stop = 1;
 				return;
 			}
@@ -500,7 +497,7 @@ static void tbf_walk(struct Qdisc *sch, struct qdisc_walker *walker)
 
 static struct Qdisc_class_ops tbf_class_ops =
 {
-	.graft		= 	tbf_graft,
+	.graft		=	tbf_graft,
 	.leaf		=	tbf_leaf,
 	.get		=	tbf_get,
 	.put		=	tbf_put,
@@ -532,7 +529,7 @@ static int __init tbf_module_init(void)
 	return register_qdisc(&tbf_qdisc_ops);
 }
 
-static void __exit tbf_module_exit(void) 
+static void __exit tbf_module_exit(void)
 {
 	unregister_qdisc(&tbf_qdisc_ops);
 }

net/sctp/Kconfig

@@ -5,14 +5,9 @@
 menu "SCTP Configuration (EXPERIMENTAL)"
 	depends on INET && EXPERIMENTAL
 
-config IPV6_SCTP__
-	tristate
-	default y if IPV6=n
-	default IPV6 if IPV6
-
 config IP_SCTP
 	tristate "The SCTP Protocol (EXPERIMENTAL)"
-	depends on IPV6_SCTP__
+	depends on IPV6 || IPV6=n
 	---help---
 	  Stream Control Transmission Protocol
 
@@ -61,6 +56,7 @@ config SCTP_DBG_OBJCNT
 choice
 	prompt "SCTP: Cookie HMAC Algorithm"
 	depends on IP_SCTP
+	default SCTP_HMAC_MD5
 	help
 	  HMAC algorithm to be used during association initialization.  It
 	  is strongly recommended to use HMAC-SHA1 or HMAC-MD5.  See 

net/sctp/sm_make_chunk.c

@@ -516,7 +516,7 @@ struct sctp_chunk *sctp_make_datafrag_empty(struct sctp_association *asoc,
 	 */
 	dp.tsn = 0;
 	dp.stream = htons(sinfo->sinfo_stream);
-	dp.ppid   = htonl(sinfo->sinfo_ppid);
+	dp.ppid   = sinfo->sinfo_ppid;
 
 	/* Set the flags for an unordered send.  */
 	if (sinfo->sinfo_flags & MSG_UNORDERED) {

net/sctp/ulpevent.c

@@ -663,7 +663,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
 	 * for and this information is passed opaquely by the SCTP stack from
 	 * one end to the other.
 	 */
-	info->sinfo_ppid = ntohl(chunk->subh.data_hdr->ppid);
+	info->sinfo_ppid = chunk->subh.data_hdr->ppid;
 
 	/* Sockets API Extensions for SCTP
 	 * Section 5.2.2 SCTP Header Information Structure (SCTP_SNDRCV)

net/xfrm/xfrm_user.c

@@ -674,6 +674,7 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
 		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
 
 		memcpy(&up->id, &kp->id, sizeof(up->id));
+		up->family = xp->family;
 		memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
 		up->reqid = kp->reqid;
 		up->mode = kp->mode;