Fix unchecked __get_user that could be tricked into generating a
memory read on an arbitrary address.  The result of the read is not
returned directly but you may be able to divine some information about
it, or use the read to cause a crash on some architectures by reading
hardware state.  CAN-2004-2492.

Fix from Al Viro, ack from Dave Miller.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The problem is that we're now calling tcp_fragment() in a context
where the packets might be marked as SACKED_ACKED or SACKED_RETRANS.
This was not possible before as you never retransmitted packets that
are so marked.

Because of this, we need to adjust sacked_out and retrans_out in
tcp_fragment().  This is exactly what the following patch does.

We also need to preserve the SACKED_ACKED/SACKED_RETRANS marking
if they exist.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The following commit breaks cisco mode with my WAN drivers:
author	David S. Miller <davem@davemloft.net>
	Tue, 28 Jun 2005 22:25:31 +0000 (15:25 -0700)
commit	689be439

"[NET]: Remove gratuitous use of skb->tail in network drivers."

The following patch fixes it - please apply (cisco_hard_header does
skb_push(4 bytes)).
Signed-off-by: David S. Miller <davem@davemloft.net>

Those exports are needed by the PPTP helper following in the next
couple of changes.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Both __ip_conntrack_expect_find and ip_conntrack_expect_find_get take
a reference to the expectation, the difference is that callers of
__ip_conntrack_expect_find must hold ip_conntrack_lock.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Some IPv6 matches have very similar loops to find IPv6 extension header
and we can unify them. This patch introduces ipv6_find_hdr() to do it.
I just checked that it can find the target headers in the packet which has
dst,hbh,rt,frag,ah,esp headers.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

This new "version 3" PPTP conntrack/nat helper is finally ready for
mainline inclusion.  Special thanks to lots of last-minute bugfixing
by Patric McHardy.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

* This patch is from Paul McKenney's RCU reviewing. 
Signed-off-by: Robert Olsson <robert.olsson@its.uu.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

* Prints the route tnode and set the stats level deepth as before.
Signed-off-by: Robert Olsson <robert.olsson@its.uu.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

Basically, this extends original dp264 fixup to all dp264 variations.
Here is one minor change: mask out bits 4-7 of a value assigned by SRM,
because
- newer consoles report ISA IRQs with offset 0xe0;
- even if console IRQ value is bogus, we'll have a value < 16
  so it should be harmless as it won't clash with native IRQs.

Particularly this fixes USB interrupt problem on xp1000 and es40.
Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Acked-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Anton Altaparmakov <aia21@cantab.net>

Signed-off-by: Anton Altaparmakov <aia21@cantab.net>

      changes by Richard Russon.)
Signed-off-by: Anton Altaparmakov <aia21@cantab.net>

Fix:

arch/arm/mach-sa1100/generic.c:224: warning: 'struct mcp_plat_data' declared inside parameter list

caused by mussing structure and function declaration.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Newer binutils complains:
/tmp/cc07pbI9.s:146: Warning: ignoring changed section type for .sched.text

Fix this warning by adding %progbits to the .section.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Deepak Saxena

Building a kernel for IXDP425 currently includes the machine descriptors
for IXDP465 and PRPMC1100 even if those machines are not configured.
This means we can build a kernel that boots on those machines even
though the machine_is_xxx() macro will always return 0 and other bits
such as PCI won't be compiled in. This can lead to many wasted hours
wondering what you have done to your kernel to make it randomly crash
thus requireing large quantities of beer to be consumed. While I am
all for consumption of large quantities of beer, there are better
reasons to do so then stupid kernel bugs.
Signed-off-by: Deepak Saxena <dsaxena@plexity.net>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

The recently added futex.h contains an unused variable, which gcc
naturally warns about.  Remove this unused variable.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

As suggested by Roman Zippel.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

I think we should cache the per-socket route(dst_entry) only when the
IPv6 UDP socket is connect(2)'ed.
(which is same as IPv4 UDP send behavior)
Signed-off-by: Mitsuru KANDA <mk@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

From: Florin Malita <fmalita@gmail.com>

bond_init() is not releasing rtnl_sem after register_netdevice() and before
calling unregister_netdevice() (from bond_free_all()) in the exception
path.  As the device registration is not completed (dev->reg_state ==
NETREG_REGISTERING), the call to unregister_netdevice() triggers
BUG_ON(dev->reg_state != NETREG_REGISTERED).
Signed-off-by: Florin Malita <fmalita@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Allocation for the optnames is similar to the DCCP options, with a
range for rx and tx half connection CCIDs.
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Moving the TFRC sender and receiver variables to separate structs, so
that we can copy these structs to userspace thru getsockopt,
dccp_diag, etc.
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Isolating it, that will be used when we introduce a CCID2 (TCP-Like)
implementation.
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

They seem to have been due to AMD errata 63/122; the fix is to disable
TLB flush filtering in SMP configurations.

Confirmed to fix the problem by Andrew Walrond <andrew@walrond.org>

[ Let's see if we'll have a better fix eventually, this is the Q&D
  "let's get this fixed and out there" version ]
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The old driver was not fully adapted to new USB ABI and does not
work.
Signed-off-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed using
pci_bus_{read,write}_config_dword().  A recent audit of drivers/ turned up
several cases of byte- and word-sized accesses.  The harmful ones were fixed
by Linus directly.  This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.
Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com>
Cc: Andrew Vasquez <andrew.vasquez@qlogic.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed using
pci_bus_{read,write}_config_dword().  A recent audit of drivers/ turned up
several cases of byte- and word-sized accesses.  The harmful ones were fixed
by Linus directly.  This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.
Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com>
Cc: <kristen.c.accardi@intel.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed
using pci_bus_{read,write}_config_dword(). A recent audit of drivers/
turned up several cases of byte- and word-sized accesses. The harmful
ones were fixed by Linus directly. This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.
Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com>
Cc: <kristen.c.accardi@intel.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed using
pci_bus_{read,write}_config_dword().  A recent audit of drivers/ turned up
several cases of byte- and word-sized accesses.  The harmful ones were fixed
by Linus directly.  This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.
Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

When doing ioctl HDIO_DRIVE_TASKFILE, the ide_task_t's request pointer is
never set, but flagged_taskfile and do_rw_taskfile pass it as a parameter
to the prehandler.  The kernel will oops taskfile pio-out commands because
of this (taskfile pio-in doesn't use a prehandler).  This fix sets the
request pointer at the time the request is created to stop this oops.
Signed-off-by: Timothy Thelin <timothy.thelin@wdc.com>
Cc: "Bartlomiej Zolnierkiewicz" <bzolnier@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Here's the patch from

http://bugzilla.kernel.org/show_bug.cgi?id=4853

It is a feeble attempt at fixing the request handling in pf, it is totally
foobar right now.
Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch fixes miss-sync issue on write() system call.  This updates
inode attrs flags, mtime and ctime on every comit_write call, due to
locking.
Signed-off-by: Hiroyuki Machida <machida@sm.sony.co.jp>
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

With the new fdtable locking rules, you have to protect fdtable with either
->file_lock or rcu_read_lock/unlock().  There are some places where we
aren't doing either.  This patch fixes those places.
Signed-off-by: Dipankar Sarma <dipankar@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch adds a new chapter on memory allocation to
Documentation/CodingStyle.
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>