mac80211: Fix for NULL pointer dereference in sta_info_get()

This addresses a NULL pointer dereference in sta_info_get().
TID and sta_info are extracted in ADDBA Timer expiry function
through the timer handler's argument.

The problem is extracging the TID (which was stored in
timer_to_tid[] array of type "u8") through "int *" typecast which
may also yield unwanted bytes for the MSB of TID that results
in incorrect sta_info and ieee80211_local pointers.

ieee80211_local pointer is NULL as illustrated below, it crashes in
sta_info_get(). The problem started when extracting ieee80211_local
pointer out of sta_info iteself and eventually crashed in
stat_info_get().

The proper way to fix is to change the data type of TID to u8
instead of u16. However changing all the occurences requires
some prototype changes as well. We should fix this in upcoming
patches.

Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com>
Signed-off-by: Luis Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: fix a typo in ieee80211_handle_filtered_frame comment

fix a typo in ieee80211_handle_filtered_frame comment

Signed-off-by: Yi Zhu <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: add missing range check for power_output modparam

Range check for power_output were missing.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

iwlwifi: fix rate scale TLC column selection bug

This patch fixes a case that a wrong maximal rate is selected when
searching for better configurations.

Signed-off-by: Guy Cohen <guy.cohen@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

iwlwifi: fix exit from stay_in_table state

When exiting from stay in table state (e.g. timer expiration),
all the statistics are reset and the RS flow should not continue
but only after enough statistics are collected again.

Signed-off-by: Guy Cohen <guy.cohen@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: Make connections to TKIP PSK networks work

This patch allows the rndis_wlan driver to connect to TKIP PSK
networks.  It uses the ASSOCIATION_INFORMATION RNDIS call to pull back
the IEs and sends them back to userspace using wireless events. Tested
on a few wireless networks I have access to. Based on the similar
code in ndiswrapper.

Signed-off-by: Scott Ashcroft <scott.ashcroft@talk21.com>
[edit: cleanups]
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211 : Fixes the status message for iwconfig

iwconfig was showing incorrect status messages when disassociated.
Patch fixes this by always checking for association status in
ioctl calls for getting ap address.

Signed-off-by: Abhijeet Kolekar <abhijeet.kolekar@intel.com>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: Use atomic interface iteration in irq context

rt2x00lib_beacondone() is called from interrupt context,
this means we cannot use the mac80211 interface iterator
that uses the rtnl lock (since that uses a mutex which can sleep).
Instead we should use the atomic mac80211 interface iterator.

Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: Reset antenna RSSI after switch

When the antenna configuration has changed we should reset
the antenna RSSI value. Otherwise the value will be influenced
by the previous configuration quality which in turn will affect
the antenna diversity.

Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: Don't count retries as failure

Link quality estimation became quite low for all rt2x00 drivers
because the number of retries it took to send the frame were
counted as failure.
This does not correspond to the legacy driver link quality calculation,
by not counting it we will send somewhat more optimistic values to
mac80211.

Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: Fix memleak in tx() path

When the tx() handler runs while the device has disapeared,
we did return NETDEV_TX_OK but didn't free the skb.

Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: reorder channel and freq reporting in wext scan report

This patch switch order of channel and freq (SIOCGIWFREQ) reports
in scan results in order to overcome wpa_supplicant inability
to handle channel numbers in 5.2Ghz band.
Wext reporting channel number is ambiguous as channels 7-12 (802.11j)
exist on both bands.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: Fix controller restart crash

This fixes a kernel crash on rmmod, in the case where the controller
was restarted before doing the rmmod.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: fix ieee80211_rx_bss_put/get imbalance

This patch fixes iee80211_rx_bss_put/get imbalance
introduced by 'mac80211: enable IBSS merging' patch.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

net/mac80211: always true conditionals

Correct always true conditionals.

Signed-off-by: Nicolas Kaiser <nikai@nikai.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: Upload both beacon templates on initial load

This updates the beacon template code to upload both templates,
if we never uploaded one before.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtl8180: fix wrong parameter in grf5101_rf_set_channel

The grf5101 RF code needs to invoke grf5101_write_phy_antenna every time the
channel is being switch.

This should be done passing the channel number to that function.
Incorrectly we were passing the same value that is written on the
channel RF register.
This may cause problems when operating on ch 14.

This patch fixes it.

Thanks to Alessandro Di Marco who found this issue!

Signed-off-by: Andrea Merello <andreamrl@tiscali.it>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtl8180: fix wrong parameter in max2820_rf_set_channel

The max2820 RF code needs to invoke max2820_write_phy_antenna every time the
channel is being switch.

This should be done passing the channel number to that function.
Incorrectly we were passing the same value that is written on the
channel RF register.
This may cause problems when operating on ch 14.

This patch fixes it.

Thanks to Alessandro Di Marco who found this issue!

Signed-off-by: Andrea Merello <andreamrl@tiscali.it>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtl8180: fix wrong parameter in sa2400_rf_set_channel

The sa2400 RF code needs to invoke sa2400_write_phy_antenna every time the
channel is being switch.

This should be done passing the channel number to that function.
Incorrectly we were passing the same value that is written on the
channel RF register.
This may cause problems when operating on ch 14.

This patch fixes it.

Thanks to Alessandro Di Marco who found this issue!

Signed-off-by: Andrea Merello <andreamrl@tiscali.it>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtl8180: avoid NULL dereference in max2820_rf_set_channel

The static function max2820_rf_set_channel is called with conf == NULL
within its compilation unit.  Originally this defaulted to b/g channel
1, but "cfg80211 API for channels/bitrates, mac80211 and driver
conversion" (commit 8318d78a44d49ac1edf2bdec7299de3617c4232e) mistakenly
dropped this check.  This patch minimally restores the expected
behavior.

Reported-by: Colin Lai <colin_sh@163.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

vlan: Use bitmask of feature flags instead of seperate feature bits

Herbert Xu points out that the use of seperate feature bits for features
to be propagated to VLAN devices is going to get messy real soon.
Replace the VLAN feature bits by a bitmask of feature flags to be
propagated and restore the old GSO_SHIFT/MASK values.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'upstream-davem' of /linux/kernel/git/jgarzik/netdev-2.6

fmvj18x_cs: add NextCom NC5310 rev B support

fmvj18x_cs: The manfid of "NextCom NC5310 rev B" is MANF_ID_FUJITSU.
            but this card is MBH10302 based card.
            use ConfigBase to detect the cardtype for this card.

Signed-off-by: Komuro <komurojun-mbn@nifty.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

xirc2ps_cs: re-initialize the multicast address in do_reset
            keep bit7,8 of XIRCREG42_SWC1 in set_multicast_list.

Signed-off-by: Komuro <komurojun-mbn@nifty.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

3C509: rx_bytes should not be increased when alloc_skb failed

If alloc_skb failed, the recieved packet will be dropped. Do not increase
rx_bytes for dropped packet.

Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

NETFRONT: Use __skb_queue_purge()

Use standard routine for queue purging.

Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

VIRTIO: Use __skb_queue_purge()

Use standard routine for queue purging.

Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

phylib: do EXPORT_SYMBOL on get_phy_id

Commit cac1f3c8 factored out the code for get_phy_id so that it
could be reused in multiple places.  Turns out that some of the
users can be modular, so we need to export this symbol as well.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

netlink: Fix nla_parse_nested_compat() to call nla_parse() directly

The purpose of nla_parse_nested_compat() is to parse attributes which
contain a struct followed by a stream of nested attributes.  So far,
it called nla_parse_nested() to parse the stream of nested attributes
which was wrong, as nla_parse_nested() expects a container attribute
as data which holds the attribute stream.  It needs to call
nla_parse() directly while pointing at the next possible alignment
point after the struct in the beginning of the attribute.

With this patch, I can no longer reproduce the reported leftover
warnings.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

WAN: protect HDLC proto list while insmod/rmmod

WAN: protect protocol list in hdlc.c with RTNL.

Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

drivers/net/fs_enet: remove null pointer dereference

The following code appears in the function fs_init_instance in the file drivers/net/fs_enet/fs_enet-main.c.

if (fep->ops == NULL) {
printk(KERN_ERR DRV_MODULE_NAME
       ": %s No matching ops found (%d).\n",
       ndev->name, fpi->fs_no);
err = -EINVAL;
goto err;
}

This code implies that at the point of err, fep->ops can be NULL, so an
extra test is needed before dereferencing this value.

This problem was found using the following semantic match
(http://www.emn.fr/x-info/coccinelle/)

// <smpl>
@@
expression E, E1;
identifier f;
statement S1,S2,S3;
@@

* if (E == NULL)
{
  ... when != if (E == NULL) S1 else S2
      when != E = E1
* E->f
  ... when any
  return ...;
}
else S3
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

S2io: Version update for napi and MSI-X patches

- Updated version number

Signed-off-by: Sreenivasa Honnur <sreenivasa.honnur@neterion.com>
Signed-off-by: Ramkrishna Vepa <ram.vepa@neterion.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

S2io: Added napi support when MSIX is enabled.

- Added napi support when MSIX is enabled.
- Moved test_msi function from s2io_open to probe function.

Signed-off-by: Sreenivasa Honnur <sreenivasa.honnur@neterion.com>
Signed-off-by: Ramkrishna Vepa <ram.vepa@neterion.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

S2io: Move all the transmit completions to a single msi-x (alarm) vector

- Move all the transmit completions to a single msi-x (alarm) vector.
- Enable the continuous timer interrupt for only one transmit fifo.

Signed-off-by: Santosh Rastapur <santosh.rastapur@neterion.com>
Signed-off-by: Ramkrishna Vepa <ram.vepa@neterion.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

drivers/net/ehea - remove unnecessary memset after kzalloc

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

au1000_eth: remove useless check

The lifespan of the device covers the request_irq .. free_irq interval.

The cast of a void * pointer is not needed either.

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

Blackfin EMAC Driver: Removed duplicated include <linux/ethtool.h>

Signed-off-by: Huang Weiyi <weiyi.huang@gmail.com>
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

cpmac bugfixes and enhancements

* Resolve some locking issues using atomic_inc/atomic_dec
* move status code in cpmac_check_status
* unmark the BROKEN flag in Kconfig
* move code which should have been in platform code in
  arch/mips/ar7/platform.c
* fixed an IRQ storm which lets the kernel hang
* fixed a double call to netif_start_queue which causes a kernel panic
* don't fail to register the PHY, works on many devices now

Signed-off-by: Matteo Croce <matteo@openwrt.org>
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

e1000e: use resource_size_t, not unsigned long, for phys addrs

The use of unsigned long causes the driver to fail on 32-bit systems
which support 64-bit resources.

Signed-off-by: Becky Bruce <becky.bruce@freescale.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

net/usb: add support for Apple USB Ethernet Adapter

Add support for Apple USB Ethernet Adapter.

http://store.apple.com/1-800-MY-APPLE/WebObjects/AppleStore.woa/wa/RSLID?nplm=MB442Z/A

Signed-off-by: Aurelien Nephtali <aurelien@sitadelle.com>
Acked-by: Greg KH <greg@kroah.com>
Cc: David Brownell <david-b@pacbell.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

uli526x: add support for netpoll

This patch adds netpoll support for the uli526x ethernet driver --
simply call the interrupt handler for polling.

To do this without disable_irq()/enable_irq() pair we should fully
protect the handler. Luckily, it's already using irqsave spinlock,
the only unprotected place is interrupts re-enabling write. It was
safe to re-enable interrupts without holding the spinlock, but with
netpoll possibility now it doesn't seem so.

Patch was tested using netconsole and KGDBoE.

Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

ucc_geth: Fix arguments to dma map/unmap functions

We were passing NULL as the device.  When we actually start supporting
more interesting memory configurations, this will break things, so
we proactively are fixing the bug.

Signed-off-by: Andy Fleming <afleming@freescale.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

PHYLIB: Kconfig: Fix the dependency on S390

 PHYLIB was first marked as BROKEN on S390, then the enclosing menu marked
as non-S390, then the two dependencies merged with the conversion to
menuconfig.  Reduce to non-S390.

Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

[SC92031] Using padto turned driver into an IPv6-only interface

IPv4 would work with this driver only with static arp table entries,
the patch  reverts a padto introduced in

 commit 26a17b7bbb36a8552d531bc1ad08472fb5aa3007
 sc92031: start transmit return value bugfix

The padto does not work because the driver code evaluates `len' later on and
there are cases where skb->len is not updated accordingly.

This was observed with ARP frames (skb->len = 42 bytes, !skb_cloned(),
skb_tailroom = 84 bytes). Then in skb_pad(), the first condition is true, where
skb->len is not updated. As a consequence, the driver uses 42 bytes instead of
the 60 bytes, and the ARP frame never makes it onto the wire.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sb1250: use netdev_alloc_skb

 Use netdev_alloc_skb.  This sets skb->dev and allows arch specific
allocation.  Also simplify and cleanup the alignment code.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

[netdrvr] forcedeth: Restore multicast settings on resume

nv_open() resets multicast settings, call nv_set_multicast(dev)
to restore them.  (Maybe this should rather be moved into nv_open())

Signed-off-by: Tobias Diedrich <ranma+kernel@tdiedrich.de>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

WAN: protect Cisco HDLC state changes with a spinlock.

Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

make myri10ge_get_firmware_capabilities() static

This patch makes the needlessly global
myri10ge_get_firmware_capabilities() static.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

s2io: add missing block braces to multistatement if statement

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Cc: Ramkrishna Vepa <ram.vepa@neterion.com>
Cc: Rastapur Santosh <santosh.rastapur@neterion.com>
Cc: Sivakumar Subramani <sivakumar.subramani@neterion.com>
Cc: Sreenivasa Honnur <sreenivasa.honnur@neterion.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

hamradio/scc: add missing block braces to multi-statement if

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

ehea: Fix use after free on reboot

Fixes the following use after free oops:

ehea: Reboot: freeing all eHEA resources
Unable to handle kernel paging request for data at address 0x6b6b6b6b6b6b6c5b
Faulting instruction address: 0xd000000000354488
cpu 0x0: Vector: 300 (Data Access) at [c00000002ec6f310]
    pc: d000000000354488: .ehea_shutdown_single_port+0x50/0x78 [ehea]
    lr: d00000000035447c: .ehea_shutdown_single_port+0x44/0x78 [ehea]
    sp: c00000002ec6f590
   msr: 8000000000009032
   dar: 6b6b6b6b6b6b6c5b
 dsisr: 40000000
  current = 0xc0000000281412e0
  paca    = 0xc0000000006df300
    pid   = 10930, comm = reboot
enter ? for help
[c00000002ec6f590] d00000000035d64c .ehea_remove+0x44/0x124 [ehea] (unreliable)
[c00000002ec6f630] c000000000319f88 .of_platform_device_remove+0x40/0x58
[c00000002ec6f6a0] c000000000291018 .__device_release_driver+0xb0/0xf0
[c00000002ec6f730] c000000000291120 .driver_detach+0xc8/0xfc
[c00000002ec6f7c0] c00000000028fe24 .bus_remove_driver+0xb4/0x114
[c00000002ec6f850] c000000000291768 .driver_unregister+0x54/0x74
[c00000002ec6f8e0] c00000000031a0c8 .of_unregister_driver+0x14/0x28
[c00000002ec6f950] c000000000023ba0 .ibmebus_unregister_driver+0x10/0x24
[c00000002ec6f9c0] d000000000354180 .ehea_reboot_notifier+0x30/0x4c [ehea]
[c00000002ec6fa40] c0000000003c95a8 .notifier_call_chain+0x5c/0xcc
[c00000002ec6fae0] c000000000082cd4 .__blocking_notifier_call_chain+0x70/0xb0
[c00000002ec6fb90] c000000000075cf8 .kernel_restart_prepare+0x24/0x58
[c00000002ec6fc10] c000000000075f0c .kernel_restart+0x20/0x6c
[c00000002ec6fc90] c000000000078674 .sys_reboot+0x1d4/0x290
[c00000002ec6fe30] c0000000000086ac syscall_exit+0x0/0x40

Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

rndis_host: increase delay in command response loop

Some devices running some WinCE firmware (with SC_* Samsung processors
according to the SynCE project, verified on a HTC P3600 device) fail to
register because they apparently need extra time to respond correctly to
requests.  Increase the existing delay to satisfy them.  Based on code
from the SynCE project, on a suggestion of David Brownell.

This patch Works For Me(tm).

Signed-off-by: Pierre Ynard <linkfanel@yahoo.fr>
Acked-by: David Brownell <david-b@pacbell.net>
Cc: Greg KH <greg@kroah.com>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

drivers/net/tokenring/olympic.c: fix warning

When dev_name() is changed to return `const char *':

drivers/net/tokenring/olympic.c: In function 'olympic_probe':
drivers/net/tokenring/olympic.c:234: warning: assignment discards qualifiers from pointer target type

Cc: Jeff Garzik <jeff@garzik.org>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

drivers/net/tokenring/3c359.c: squish a warning

When dev_name() is changed to return `const char *':

drivers/net/tokenring/3c359.c: In function 'xl_probe':
drivers/net/tokenring/3c359.c:318: warning: assignment discards qualifiers from pointer target type

Cc: Jeff Garzik <jeff@garzik.org>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

pcnet32: fix warning

pci_name() will be changed to return `const char *':

drivers/net/pcnet32.c: In function 'pcnet32_probe1':
drivers/net/pcnet32.c:1884: warning: passing argument 2 of 'pcnet32_alloc_ring' discards qualifiers from pointer target type

Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

[netdrvr] dm9000: use delayed work to update mii phy state fix

use cancel_delayed_work_sync()

Cc: Ben Dooks <ben-linux@fluff.org>
Cc: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sky2: restore vlan acceleration on reset

If device has to be reset by sky2_restart, then need to restore
the VLAN acceleration settings.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Remove sub-minor component from driver version

This driver has diverged from the out-of-tree driver to which the version
number originally applied.  It should be identified primarily by kernel
version.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Added checks for heap allocation failure

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Remove redundant casts to and from void *

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Change type of efx_nic::nic_data to struct falcon_nic_data *

Remove redundant casts and variable.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Use __packed macro

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Do not define inline macro

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Use DMA_BIT_MASK() instead of our own DMA mask macros

Also change type of efx_nic_type::max_dma_mask to u64, matching
pci_dma_supported() parameter type.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Correct and expand some comments

These comments have been revised in response to questions raised by Andrew
Morton in <20080501120858.207b6dd6.akpm@linux-foundation.org>.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Use resource_size_t for PCI bus address

This should make the driver work on 32-bit systems with 64-bit PCI support.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Merged efx_page_offset() into efx_rx_buf_offset()

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Replaced various macros with inline functions

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Added and removed braces to comply with kernel style

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Removed unncesssary UL suffixes on 0 literals

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Simplified efx_rx_calc_buffer_size() using get_order()

Merged it into its only caller, efx_init_channels().

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Removed casts to void

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

sfc: Use mod_timer() to set expiry and add_timer() together

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

net: The world is not perfect patch.

  Unless there will be any objection here, I suggest consider the
following patch which simply removes the code for the
-DI_WISH_WORLD_WERE_PERFECT in the three methods which use it.

The compilation errors we get when using -DI_WISH_WORLD_WERE_PERFECT
show that this code was not built and not used for really a long time.

Signed-off-by: Rami Rosen <ramirose@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

tcp: Make prior_ssthresh a u32

If previous window was above representable values of u16,
strange things will happen if undo with the truncated value
is called for. Alternatively, this could be fixed by some
max trickery but that would limit undoing high-speed undos.

Adds 16-bit hole but there isn't anything to fill it with.

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>

xfrm_user: Remove zero length key checks.

The crypto layer will determine whether that is valid
or not.

Suggested by Herbert Xu, based upon a report and patch
by Martin Willi.

Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>

net/ipv4/arp.c: Use common hex_asc helpers

Here the local hexbuf is a duplicate of global const char hex_asc from
lib/hexdump.c, except the hex letters' cases:

const char hexbuf[] = "0123456789ABCDEF";

const char hex_asc[] = "0123456789abcdef";

and here to print HW addresses, the hex cases are not significant.

Thanks to Harvey Harrison to introduce the hex_asc_hi/hex_asc_lo helpers.

Signed-off-by: Denis Cheng <crquan@gmail.com>
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

cassini: Only use chip checksum for ipv4 packets.

According to David Monro, at least with Natsemi Saturn chips the
cassini driver has some trouble with ipv6 checksums.

Until we have more information about what's going on here, only
use the chip checksums for ipv4.

This workaround was suggested and tested by David.

Update version and release date.

Signed-off-by: David S. Miller <davem@davemloft.net>

tcp: TCP connection times out if ICMP frag needed is delayed

We are seeing an issue with TCP in handling an ICMP frag needed
message that is received after net.ipv4.tcp_retries1 retransmits.
The default value of retries1 is 3. So if the path mtu changes
and ICMP frag needed is lost for the first 3 retransmits or if
it gets delayed until 3 retransmits are done, TCP doesn't update
MSS correctly and continues to retransmit the orginal message
until it timesout after tcp_retries2 retransmits.

I am seeing this issue even with the latest 2.6.25.4 kernel.

In tcp_retransmit_timer(), when retransmits counter exceeds
tcp_retries1 value, the dst cache entry of the socket is reset.
At this time, if we receive an ICMP frag needed message, the
dst entry gets updated with the new MTU, but the TCP sockets
dst_cache entry remains NULL.

So the next time when we try to retransmit after the ICMP frag
needed is received, tcp_retransmit_skb() gets called. Here the
cur_mss value is calculated at the start of the routine with
a NULL sk_dst_cache. Instead we should call tcp_current_mss after
the rebuild_header that caches the dst entry with the updated mtu.
Also the rebuild_header should be called before tcp_fragment
so that skb is fragmented if the mss goes down.

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

netfilter: Move linux/types.h inclusions outside of #ifdef __KERNEL__

Greg Steuck <greg@nest.cx> points out that some of the netfilter
headers can't be used in userspace without including linux/types.h
first. The headers include their own linux/types.h include statements,
these are stripped by make headers-install because they are inside
#ifdef __KERNEL__ however. Move them out to fix this.

Reported and Tested by Greg Steuck.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

af_key: Fix selector family initialization.

This propagates the xfrm_user fix made in commit
bcf0dda8d2408fe1c1040cdec5a98e5fcad2ac72 ("[XFRM]: xfrm_user: fix
selector family initialization")

Based upon a bug report from, and tested by, Alan Swanson.

Signed-off-by: Kazunori MIYAZAWA <kazunori@miyazawa.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'master' of /linux/kernel/git/linville/wireless-2.6

libertas: Fix ethtool statistics

Fix various problems:
 - We converted MESH_ACCESS to a direct command but missed this caller.
 - We were trying to access mesh stats even on meshless firmware.
 - We should really zero the buffer if something goes wrong.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: fix NULL pointer dereference in ieee80211_compatible_rates

Fix a possible NULL pointer dereference in ieee80211_compatible_rates
introduced in the patch "mac80211: fix association with some APs". If no bss
is available just use all supported rates in the association request.

Signed-off-by: Helmut Schaa <hschaa@suse.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

pktgen: make sure that pktgen_thread_worker has been executed

The following courruption can happen during pktgen stop:
list_del corruption. prev->next should be ffff81007e8a5e70, but was 6b6b6b6b6b6b6b6b
kernel BUG at lib/list_debug.c:67!
      :pktgen:pktgen_thread_worker+0x374/0x10b0
      ? autoremove_wake_function+0x0/0x40
      ? _spin_unlock_irqrestore+0x42/0x80
      ? :pktgen:pktgen_thread_worker+0x0/0x10b0
      kthread+0x4d/0x80
      child_rip+0xa/0x12
      ? restore_args+0x0/0x30
      ? kthread+0x0/0x80
      ? child_rip+0x0/0x12
RIP  list_del+0x48/0x70

The problem is that pktgen_thread_worker can not be executed if kthread_stop
has been called too early. Insert a completion on the normal initialization
path to make sure that pktgen_thread_worker will gain the control for sure.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Acked-by: Alexey Dobriyan <adobriyan@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

mac80211: don't claim iwspy support

We removed iwspy support a very long time ago because it is useless, but
forgot to stop claiming to support it. Apparently, nobody cares, but
remove it nonetheless.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

orinoco_cs: add ID for SpeedStream wireless adapters

Reported by Gerald Willmann <gerald.willmann@econ.kuleuven.be>

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

hostap_cs: add ID for Conceptronic CON11CPro

Reported by Santiago Garcia Mantinan <hostap@manty.net>

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtl8187: resource leak in error case

This fixes resource leaks in error cases due to urb submission
failures.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[VLAN]: Propagate selected feature bits to VLAN devices

Propagate feature bits from the NETDEV_FEAT_CHANGE notifier. For now
only TSO is propagated for devices that announce their ability to
support TSO in combination with VLAN accel by setting the NETIF_F_VLAN_TSO
flag.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/atm/: remove CVS keywords

This patch removes CVS keywords that weren't updated for a long time.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Acked-by: Chas Williams <chas@cmf.nrl.navy.mil>
Signed-off-by: David S. Miller <davem@davemloft.net>

ath5k: Fix loop variable initializations

In ath5k_tasklet_rx, both status structures 'rxs' and 'rs' are
initialized at the top of the tasklet, but not within the loop.
If the loop is executed multiple times in the tasklet then the
variables may see changes from previous packets.

For TKIP, this results in 'Invalid Michael MIC' errors if two packets
are processed in the tasklet: rxs.flag gets set to RX_DECRYPTED by
mac80211 when it decrypts the first encrypted packet.  The subsequent
packet will have RX_DECRYPTED set upon entry to mac80211, so mac80211
will not try to decrypt it.

We currently initialize all but two fields in the structures, so fix
the other two.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

vlan: Correctly handle device notifications for layered VLAN devices

Commit 30688a9 ([VLAN]: Handle vlan devices net namespace changing)
changed the device notifier to special-case notifications for VLAN
devices, effectively disabling state propagation to underlying VLAN
devices. This is needed for layered VLANs though, so restore the
original behaviour.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

net: Fix call to ->change_rx_flags(dev, IFF_MULTICAST) in dev_change_flags()

Am I just being particularly dim today, or can the call to
dev->change_rx_flags(dev, IFF_MULTICAST) in dev_change_flags() never
happen?

We've just set dev->flags = flags & IFF_MULTICAST, effectively. So the
condition '(dev->flags ^ flags) & IFF_MULTICAST' is _never_ going to be
true.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

net_sched: cls_api: fix return value for non-existant classifiers

cls_api should return ENOENT when the requested classifier doesn't
exist.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

ipsec: Use the correct ip_local_out function

Because the IPsec output function xfrm_output_resume does its
own dst_output call it should always call __ip_local_output
instead of ip_local_output as the latter may invoke dst_output
directly.  Otherwise the return values from nf_hook and dst_output
may clash as they both use the value 1 but for different purposes.

When that clash occurs this can cause a packet to be used after
it has been freed which usually leads to a crash.  Because the
offending value is only returned from dst_output with qdiscs
such as HTB, this bug is normally not visible.

Thanks to Marco Berizzi for his perseverance in tracking this
down.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

ipv6 addrconf: Allow infinite prefix lifetime.

We need to handle infinite prefix lifetime specially.
With help from original reporter "Bonitch, Joseph"
<Joseph.Bonitch@xerox.com>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

ipv6 route: Fix lifetime in netlink.

We could not see appropriate lifetime if the route had been scheduled
to expired at 0 (in jiffies).  We should check rt6i_flags instead of
rt6i_expires to determine whether lifetime is valid or not.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

ipv6 addrconf: Fix route lifetime setting in corner case.

Because of arithmetic overflow avoidance, the actual lifetime setting
(vs the value given by RA) did not increase monotonically around
0x7fffffff/HZ.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'master' of /linux/kernel/git/linville/wireless-2.6