From: <pageexec@freemail.hu>

$subject was fixed in 2.4 already, 2.6 needs it as well.

The impact of the bugs is a kernel stack overflow and privilege escalation
from CAP_NET_ADMIN via the IP_VS_SO_SET_STARTDAEMON/IP_VS_SO_GET_DAEMON
ioctls.  People running with 'root=all caps' (i.e., most users) are not
really affected (there's nothing to escalate), but SELinux and similar
users should take it seriously if they grant CAP_NET_ADMIN to other users.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch fixes two bugs in the dm9000 network driver:

- Don't read one byte too much in 8bit mode.
- release correct resource

Signed-off-by: Jochen Karrer <j.karrer@lightmaze.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>

Patch indents dmfe.txt to look like other docs.  It adds a tip about CNET
cards using Davicom chipsets.  Also it removes parts where it refers to how
to build driver out-of-kernel which seems to be cruft from times where the
driver was out of the kernel.

Signed-off-by: Ismail Donmez <ismail@kde.org.tr>
Signed-off-by: Domen Puncer <domen@coderock.org>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>

Signed-off-by: Andrew Morton <akpm@osdl.org>

Fix int vs. pm_message_t confusion in airo. Should change no code.

Signed-off-by: Pavel Machek <pavel@suse.cz>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>

This is a fix for the interrupt handler in the defxx driver to use
irqreturn_t.  Beside the obvious fix of returning a proper status at all,
it actually checks board registers as appropriate for determining if an
interrupt has been recorded in the bus-specific interface logic.

The patch also includes an obvious one-line fix for SET_NETDEV_DEV needed
for the EISA variation, for which I've decided there is no point in sending
separately.

Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>

drivers/net/tulip/dmfe.c: In function `dmfe_parse_srom':
drivers/net/tulip/dmfe.c:1805: warning: passing arg 1 of `__le16_to_cpup' from incompatible pointer type
drivers/net/tulip/dmfe.c:1817: warning: passing arg 1 of `__le32_to_cpup' from incompatible pointer type
drivers/net/tulip/dmfe.c:1817: warning: passing arg 1 of `__le32_to_cpup' from incompatible pointer type

This is basically a guess:

Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>

The 8129/8130 support is a sub-option that is not visible if the user
hasn't enabled the 8139 support.

Let's make it a bit easier for users to find the driver for their nic.

Signed-off-by: Adrian Bunk <bunk@stusta.de>

1) netlink_release() should only decrement the hash entry
   count if the socket was actually hashed.

   This was causing hash->entries to underflow, which
   resulting in all kinds of troubles.

   On 64-bit systems, this would cause the following
   conditional to erroneously trigger:

	err = -ENOMEM;
	if (BITS_PER_LONG > 32 && unlikely(hash->entries >= UINT_MAX))
		goto err;

2) netlink_autobind() needs to propagate the error return from
   netlink_insert().  Otherwise, callers will not see the error
   as they should and thus try to operate on a socket with a zero pid,
   which is very bad.

   However, it should not propagate -EBUSY.  If two threads race
   to autobind the socket, that is fine.  This is consistent with the
   autobind behavior in other protocols.

   So bug #1 above, combined with this one, resulted in hangs
   on netlink_sendmsg() calls to the rtnetlink socket.  We'd try
   to do the user sendmsg() with the socket's pid set to zero,
   later we do a socket lookup using that pid (via the value we
   stashed away in NETLINK_CB(skb).pid), but that won't give us the
   user socket, it will give us the rtnetlink socket.  So when we
   try to wake up the receive queue, we dive back into rtnetlink_rcv()
   which tries to recursively take the rtnetlink semaphore.

Thanks to Jakub Jelink for providing backtraces.  Also, thanks to
Herbert Xu for supplying debugging patches to help track this down,
and also finding a mistake in an earlier version of this fix.

Signed-off-by: David S. Miller <davem@davemloft.net>

Use msleep_interruptible() instead of schedule_timeout() to guarantee
the task delays as expected.

This patch removes some obviously dead code found by the Coverity
checker.

Signed-off-by: Adrian Bunk <bunk@stusta.de>

This patch fixes the LITTLE_ENDIAN #define and a function prototype.

Signed-off-by: Adrian Bunk <bunk@stusta.de>

This patch contains the follwing cleanups:
- make needlessly global code static
- remove obsolete Emacs settings

Signed-off-by: Adrian Bunk <bunk@stusta.de>

We're using __be16 in userland visible types, so we
have to include asm/byteorder.h so that works.

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Robert Olsson <robert.olsson@its.uu.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

During some performance diagnostics I stumbled on this slightly wasteful
code in pcnet_cs.c which I made the patch included at the bottom for (two
minor comment fixes included).

Improvement:
instead of *always* calculating
lea    0x2c0(%edx),%ebx
and then additionally doing the
mov    %edx,0xc0(%ebx)
addition *if we need it*,

we now do the *whole* calculation of
mov    %edx,0x380(%ebx)
*only* if we need it.
This even manages to save us a whole 16-byte alignment buffer loss
in this compilation case.

Result: slightly improves IRQ handler performance in both shared and
non-shared IRQ case, which should make my rusty P3/700 a slight bit happier.

Thank you for your support,

Andreas Mohr

old asm result (using gcc 3.3.5):

000015a0 <ei_irq_wrapper>:
    15a0:       55                      push   %ebp
    15a1:       89 e5                   mov    %esp,%ebp
    15a3:       53                      push   %ebx
    15a4:       8d 9a c0 02 00 00       lea    0x2c0(%edx),%ebx
    15aa:       e8 fc ff ff ff          call   15ab <ei_irq_wrapper+0xb>
    15af:       83 f8 01                cmp    $0x1,%eax
    15b2:       74 03                   je     15b7 <ei_irq_wrapper+0x17>
    15b4:       5b                      pop    %ebx
    15b5:       5d                      pop    %ebp
    15b6:       c3                      ret
    15b7:       31 d2                   xor    %edx,%edx
    15b9:       89 93 c0 00 00 00       mov    %edx,0xc0(%ebx)
    15bf:       eb f3                   jmp    15b4 <ei_irq_wrapper+0x14>
    15c1:       eb 0d                   jmp    15d0 <ei_watchdog>
    15c3:       90                      nop
    15c4:       90                      nop
    15c5:       90                      nop
    15c6:       90                      nop
    15c7:       90                      nop
    15c8:       90                      nop
    15c9:       90                      nop
    15ca:       90                      nop
    15cb:       90                      nop
    15cc:       90                      nop
    15cd:       90                      nop
    15ce:       90                      nop
    15cf:       90                      nop

000015d0 <ei_watchdog>:

new asm result:

000015a0 <ei_irq_wrapper>:
    15a0:       55                      push   %ebp
    15a1:       89 e5                   mov    %esp,%ebp
    15a3:       53                      push   %ebx
    15a4:       89 d3                   mov    %edx,%ebx
    15a6:       e8 fc ff ff ff          call   15a7 <ei_irq_wrapper+0x7>
    15ab:       83 f8 01                cmp    $0x1,%eax
    15ae:       74 03                   je     15b3 <ei_irq_wrapper+0x13>
    15b0:       5b                      pop    %ebx
    15b1:       5d                      pop    %ebp
    15b2:       c3                      ret
    15b3:       31 d2                   xor    %edx,%edx
    15b5:       89 93 80 03 00 00       mov    %edx,0x380(%ebx)
    15bb:       eb f3                   jmp    15b0 <ei_irq_wrapper+0x10>
    15bd:       8d 76 00                lea    0x0(%esi),%esi

000015c0 <ei_watchdog>:

Signed-off-by: Andrew Morton <akpm@osdl.org>

Use the DMA_{64,32}BIT_MASK constants from dma-mapping.h when calling
pci_set_dma_mask() or pci_set_consistent_dma_mask()

This patch includes dma-mapping.h explicitly because it caused errors
on some architectures otherwise.

See http://marc.theaimsgroup.com/?t=108001993000001&r=1&w=2

 for details

Signed-off-by: Tobias Klauser <tklauser@nuerscht.ch>
Signed-off-by: Domen Puncer <domen@coderock.org>

It doesn't seem to make much sense to let an "If unsure, say N." option 
default to y.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

Since it is tristate when we offer it as a choice, we should
definte it also as tristate when forcing it as the default.
Otherwise kconfig warns.

Signed-off-by: David S. Miller <davem@davemloft.net>

Make sure the code compiles with and without ARLAN_ENTRY_EXIT_DEBUGGING.
Only provide parameter descriptions when parameters are defined.
Remove "arlan_"-prefix to shape up built-in parameter names:

arlan.arlan_debug -> arlan.debug
arlan.arlan_EEPROM_bad -> arlan.EEPROM_bad
arlan.arlan_entry_and_exit_debug -> arlan.entry_and_exit_debug
arlan.arlan_entry_debug -> arlan.entry_debug
arlan.arlan_exit_debug -> arlan.exit_debug

Signed-off-by: Magnus Damm <damm@opensource.se>

Use the DMA_32BIT_MASK constant from dma-mapping.h when calling
pci_set_dma_mask() or pci_set_consistent_dma_mask() instead of custom
macros.
This patch includes dma-mapping.h explicitly because it caused errors
on some architectures otherwise.
See http://marc.theaimsgroup.com/?t=108001993000001&r=1&w=2

 for details

Signed-off-by: Tobias Klauser <tklauser@nuerscht.ch>

The spin loop in 8139cp is limited to 100 iterations when pulling hardware
stats. There is no allowance for processor speed so on a fast machine, the
stats may not be available that fast. Also, if the board doesn't return
soon enough make sure turn the address back off to prevent later updates
when memory has gone away.

This patch updates the name identifier to list both of the Marvell PHYs
that are supported.

Signed-off-by: Kumar Gala <kumar.gala@freescale.com>

Add support for alternate slave selection algorithms to bonding
balance-xor and 802.3ad modes.  Default mode (what we have now: xor of
MAC addresses) is "layer2", new choice is "layer3+4", using IP and port
information for hashing to select peer.

Originally submitted by Jason Gabler for balance-xor mode;
modified by Jay Vosburgh to additionally support 802.3ad mode.  Jason's
original comment is as follows:

The attached patch to the Linux Etherchannel Bonding driver modifies the
driver's "balance-xor" mode as follows:

      - alternate hashing policy support for mode 2
        * Added kernel parameter "xmit_policy" to allow the specification
          of different hashing policies for mode 2.  The original mode 2
          policy is the default, now found in xmit_hash_policy_layer2().
        * Added xmit_hash_policy_layer34()

This patch was inspired by hashing policies implemented by Cisco,
Foundry and IBM, which are explained in
Foundry documentation found at:
http://www.foundrynet.com/services/documentation/sribcg/Trunking.html#112750



Signed-off-by: Jason Gabler <jygabler@lbl.gov>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>

Add support for generating gratuitous ARPs in bonding
active-backup mode when failovers occur.  Includes support for VLAN
tagging the ARPs as needed.

Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>

Patch from Lennert Buytenhek

Compiling one kernel that supports both ixdp2400 and ixdp2800 gives
an error, as a copy of the ixdp2400 irq init routing accidentally
ended up in ixdp2800.c somehow.

Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: Deepak Saxena
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Lennert Buytenhek

Add a mapping for the ixp2400 and ixp2800 msf unit.  The msf is the
ixp2000's 'media and switch fabric' unit, which handles the networking
part of the chip.

Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: Deepak Saxena
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Lennert Buytenhek

Add a comment to asm/arch-ixp2000/ixp2000-regs.h describing the
ixp2000 virtual memory map layout.

Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: Deepak Saxena
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Lennert Buytenhek

As the ixdp cpld mappings now live at 0xfe000000, we can push
VMALLOC_END upwards to 0xfb000000, where the first iotable mapping
begins.

Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: Deepak Saxena
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Lennert Buytenhek

All ixdp platforms currently have a cpld mapped in at 0xfafff000.
Since this address is not 1M-aligned, a regular page mapping will be
used instead of a section mapping, which opens up the possibility of
triggering ixp2400 erratum #66 as we only do the XCB=101 workaround
thing for section mappings.
There is still a lot of space higher up in the virtual memory map
for 1M mappings, so move the cpld mapping to 0xfe000000 and make it
1M big so that a section mapping will be used for it.

Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: Deepak Saxena
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

VST needs to know which timer handler is for the timer interrupt.
Mark all timer interrupts with the SA_TIMER flag.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

The pending registers for IRQ1-IRQ7 were pointing to the interrupt pending
register instead of the external one.

Signed-off-by: Tony Li <Tony.Li@freescale.com>
Signed-off-by: Kumar Gala <kumar.gala@freescale.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>