commit 9df2fe986770bc4c76e8fe72c20b71268eec39a7
Merge: de72aa4... 5ac37f8...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat Jul 12 14:34:31 2008 -0700

    Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86: fix ldt limit for 64 bit

commit de72aa4c2b82a6cffe15d86a8d391ded4fb57602
Merge: 536abdb... 8df5fc0...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat Jul 12 14:34:11 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
      [SCSI] bsg: fix oops on remove
      [SCSI] fusion: default MSI to disabled for SPI and FC controllers
      [SCSI] ipr: Fix HDIO_GET_IDENTITY oops for SATA devices
      [SCSI] mptspi: fix oops in mptspi_dv_renegotiate_work()
      [SCSI] erase invalid data returned by device

commit 536abdb0802f3fac1b217530741853843d63c281
Author: Jeff Layton <jlayton@redhat.com>
Date:   Sat Jul 12 13:48:00 2008 -0700

    cifs: fix wksidarr declaration to be big-endian friendly
    
    The current definition of wksidarr works fine on little endian arches
    (since cpu_to_le32 is a no-op there), but on big-endian arches, it fails
    to compile with this error:
    
    error: braced-group within expression allowed only inside a function
    
    The problem is that this static declaration has cpu_to_le32 embedded
    within it, and that expands into a function macro.  We need to use
    __constant_cpu_to_le32() instead.
    
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Cc: Steven French <sfrench@us.ibm.com>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit e911d0cc877ff027d5bd09fc33148ab76f0fdf0e
Author: Jeff Layton <jlayton@redhat.com>
Date:   Sat Jul 12 13:47:59 2008 -0700

    cifs: fix inode leak in cifs_get_inode_info_unix
    
    Try this:
    
        mount a share with unix extensions
        create a file on it
        umount the share
    
    You'll get the following message in the ring buffer:
    
    VFS: Busy inodes after unmount of cifs. Self-destruct in 5 seconds.  Have a
    nice day...
    
    ...the problem is that cifs_get_inode_info_unix is creating and hashing
    a new inode even when it's going to return error anyway. The first
    lookup when creating a file returns an error so we end up leaking this
    inode before we do the actual create. This appears to be a regression
    caused by commit 0e4bbde94fdc33f5b3d793166b21bf768ca3e098.
    
    The following patch seems to fix it for me, and fixes a minor
    formatting nit as well.
    
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Acked-by: Steven French <sfrench@us.ibm.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit d3297a644a0ab784e0c810ceca6bf35a67868ad9
Author: David Howells <dhowells@redhat.com>
Date:   Sat Jul 12 13:47:58 2008 -0700

    frv: fix irqs_disabled() to return an int, not an unsigned long
    
    Fix FRV irqs_disabled() to return an int, not an unsigned long to avoid
    this warning:
    
    kernel/sched.c: In function '__might_sleep':
    kernel/sched.c:8198: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
    
    Signed-off-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit d1a5d1979702cc57b9b80f636426ec7ad1655cad
Author: Robert Richter <robert.richter@amd.com>
Date:   Sat Jul 12 13:47:57 2008 -0700

    OProfile kernel maintainership changes
    
    Cc: Philippe Elie <phil.el@wanadoo.fr>
    Cc: John Levon <levon@movementarian.org>
    Cc: Maynard Johnson <maynardj@us.ibm.com>
    Cc: Richard Purdie <rpurdie@openedhand.com>
    Cc: Daniel Hansel <daniel.hansel@linux.vnet.ibm.com>
    Cc: Jason Yeh <jason.yeh@amd.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Robert Richter <robert.richter@amd.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 8ea9212cbd65db749543ec619e32fdff9a8b3408
Author: Jon Smirl <jonsmirl@gmail.com>
Date:   Sat Jul 12 13:47:56 2008 -0700

    rtc-pcf8563: add chip id
    
    Add the rtc8564 chip entry
    
    Signed-off-by: Jon Smirl <jonsmirl@gmail.com>
    Signed-off-by: Alessandro Zummo <a.zummo@towertech.it>
    Cc: David Brownell <david-b@pacbell.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 876550aa3e5f6448a1abae3704cbebcc50545998
Author: Alessandro Zummo <a.zummo@towertech.it>
Date:   Sat Jul 12 13:47:55 2008 -0700

    rtc-fm3130: fix chip naming
    
    Fix chip naming from fm3031-rtc to fm3031
    
    Signed-off-by: Alessandro Zummo <a.zummo@towertech.it>
    Cc: Sergey Lapin <slapin@ossfans.org>
    Cc: David Brownell <david-b@pacbell.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit bca5c2c550f16d2dc2d21ffb7b4712bd0a7d32a9
Author: Andres Salomon <dilinger@queued.net>
Date:   Sat Jul 12 13:47:54 2008 -0700

    ov7670: clean up ov7670_read semantics
    
    Cortland Setlow pointed out a bug in ov7670.c where the result from
    ov7670_read() was just being checked for !0, rather than <0.  This made me
    realize that ov7670_read's semantics were rather confusing; it both fills
    in 'value' with the result, and returns it.  This is goes against general
    kernel convention; so rather than fixing callers, let's fix the function.
    
    This makes ov7670_read return <0 in the case of an error, and 0 upon
    success. Thus, code like:
    
    res = ov7670_read(...);
    if (!res)
    	goto error;
    
    ..will work properly.
    
    Signed-off-by: Cortland Setlow <csetlow@tower-research.com>
    Signed-off-by: Andres Salomon <dilinger@debian.org>
    Acked-by: Jonathan Corbet <corbet@lwn.net>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 05d81d2222beec7b63ac8c1c8cdb5bb4f82c2bad
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Sat Jul 12 13:47:53 2008 -0700

    serial8250: sanity check nr_uarts on all paths.
    
    I had 8250.nr_uarts=16 in the boot line of a test kernel and I had a weird
    mysterious crash in sysfs.  After taking an in-depth look I realized that
    CONFIG_SERIAL_8250_NR_UARTS was set to 4 and I was walking off the end of
    the serial8250_ports array.
    
    Ouch!!!
    
    Don't let this happen to someone else.
    
    Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
    Acked-by: Alan Cox <alan@redhat.com>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit f31ad92f34913043cf008d6e479e92dfbaf02df1
Author: Jaya Kumar <jayakumar.lkml@gmail.com>
Date:   Sat Jul 12 13:47:51 2008 -0700

    fbdev: bugfix for multiprocess defio
    
    This patch is a bugfix for how defio handles multiple processes manipulating
    the same framebuffer.
    
    Thanks to Bernard Blackham for identifying this bug.
    
    It occurs when two applications mmap the same framebuffer and concurrently
    write to the same page.  Normally, this doesn't occur since only a single
    process mmaps the framebuffer.  The symptom of the bug is that the mapping
    applications will hang.  The cause is that defio incorrectly tries to add the
    same page twice to the pagelist.  The solution I have is to walk the pagelist
    and check for a duplicate before adding.  Since I needed to walk the pagelist,
    I now also keep the pagelist in sorted order.
    
    Signed-off-by: Jaya Kumar <jayakumar.lkml@gmail.com>
    Cc: Bernard Blackham <bernard@largestprime.net>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 4fc89e3911aa5357b55b85b60c4beaeb8a48a290
Author: Darren Jenkins <darrenrjenkins@gmail.com>
Date:   Sat Jul 12 13:47:50 2008 -0700

    drivers/isdn/i4l/isdn_common.c fix small resource leak
    
    Coverity CID: 1356 RESOURCE_LEAK
    
    I found a very old patch for this that was Acked but did not get applied
    https://lists.linux-foundation.org/pipermail/kernel-janitors/2006-September/016362.html
    
    There looks to be a small leak in isdn_writebuf_stub() in isdn_common.c, when
    copy_from_user() returns an un-copied data length (length != 0).  The below
    patch should be a minimally invasive fix.
    
    Signed-off-by: Darren Jenkins <darrenrjenkins@gmailcom>
    Acked-by: Karsten Keil <kkeil@suse.de>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 43f77e91eadbc290eb76a08110a039c809dde6c9
Author: Darren Jenkins <darrenrjenkins@gmail.com>
Date:   Sat Jul 12 13:47:49 2008 -0700

    drivers/char/pcmcia/ipwireless/hardware.c fix resource leak
    
    Coverity CID: 2172 RESOURCE_LEAK
    
    When pool_allocate() tries to enlarge a packet, if it can not allocate enough
    memory, it returns NULL without first freeing the old packet.
    
    This patch just frees the packet first.
    
    Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com>
    Acked-by: Jiri Kosina <jkosina@suse.cz>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 8df5fc042c8e7c08dc438c8198b62407ee1e91a0
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Mon Jul 7 15:50:01 2008 -0500

    [SCSI] bsg: fix oops on remove
    
    If you do a modremove of any sas driver, you run into an oops on
    shutdown when the host is removed (coming from the host bsg device).
    The root cause seems to be that there's a use after free of the
    bsg_class_device:  In bsg_kref_release_function, this is used (to do a
    put_device(bcg->parent) after bcg->release has been called.  In sas (and
    possibly many other things) bcd->release frees the queue which contains
    the bsg_class_device, so we get a put_device on unreferenced memory.
    Fix this by taking a copy of the pointer to the parent before releasing
    bsg.
    
    Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 27898988174bb211fd962ea73b9c6dc09f888705
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Thu Jul 10 22:10:55 2008 -0500

    [SCSI] fusion: default MSI to disabled for SPI and FC controllers
    
    There's a fault on the FC controllers that makes them not respond
    correctly to MSI.  The SPI controllers are fine, but are likely to be
    onboard on older motherboards which don't handle MSI correctly, so
    default both these cases to disabled.  Enable by setting the module
    parameter mpt_msi_enable=1.
    
    For the SAS case, enable MSI by default, but it can be disabled by
    setting the module parameter mpt_msi_enable=0.
    
    Cc: "Prakash, Sathya" <sathya.prakash@lsi.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 5ac37f87ff18843aabab84cf75b2f8504c2d81fe
Author: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Date:   Fri Jul 11 18:04:46 2008 +0200

    x86: fix ldt limit for 64 bit
    
    Fix size of LDT entries. On x86-64, ldt_desc is a double-sized descriptor.
    
    Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>

commit a26929fb489188ff959b1715ee67f0c9f84405b5
Merge: 4d727a7... 3976df9...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Jul 11 17:00:17 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
      [PATCH] IPMI: return correct value from ipmi_write

commit 3976df9b04c113ab19dc0268e49c6cec6baf28f7
Author: Mark Rustad <Rustad@gmail.com>
Date:   Thu Jul 10 14:27:11 2008 -0500

    [PATCH] IPMI: return correct value from ipmi_write
    
    This patch corrects the handling of write operations to the IPMI watchdog
    to work as intended by returning the number of characters actually
    processed. Without this patch, an "echo V >/dev/watchdog" enables the
    watchdog if IPMI is providing the watchdog function.
    
    Signed-off-by: Mark Rustad <MRustad@gmail.com>
    Signed-off-by: Corey Minyard <cminyard@mvista.com>
    Signed-off-by: Wim Van Sebroeck <wim@iguana.be>

commit 0ce3a7e5bd305e96c924fab1e3126480c665f017
Author: Brian King <brking@linux.vnet.ibm.com>
Date:   Fri Jul 11 13:37:50 2008 -0500

    [SCSI] ipr: Fix HDIO_GET_IDENTITY oops for SATA devices
    
    Currently, ipr does not support HDIO_GET_IDENTITY to SATA devices.
    An oops occurs if userspace attempts to send the command. Since hald
    issues the command, ensure we fail the ioctl in ipr. This is a
    temporary solution to the oops. Once the ipr libata EH conversion
    is upstream, ipr will fully support HDIO_GET_IDENTITY.
    
    Tested-by: Milton Miller <miltonm@bga.com>
    Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 4d727a781f6c9ab8b446d6596ed2dcd6ce80bb47
Merge: 49641f1... 3c1e389...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Jul 11 11:37:55 2008 -0700

    Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev
    
    * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
      libata-acpi: don't call sleeping function from invalid context
      Added Targa Visionary 1000 IDE adapter to pata_sis.c
      libata-acpi: filter out DIPM enable

commit 49641f1acfdfd437ed9b0a70b86bf36626c02afe
Author: Dave Chinner <david@fromorbit.com>
Date:   Fri Jul 11 17:43:55 2008 +1000

    Fix reference counting race on log buffers
    
    When we release the iclog, we do an atomic_dec_and_lock to determine if
    we are the last reference and need to trigger update of log headers and
    writeout.  However, in xlog_state_get_iclog_space() we also need to
    check if we have the last reference count there.  If we do, we release
    the log buffer, otherwise we decrement the reference count.
    
    But the compare and decrement in xlog_state_get_iclog_space() is not
    atomic, so both places can see a reference count of 2 and neither will
    release the iclog.  That leads to a filesystem hang.
    
    Close the race by replacing the atomic_read() and atomic_dec() pair with
    atomic_add_unless() to ensure that they are executed atomically.
    
    Signed-off-by: Dave Chinner <david@fromorbit.com>
    Reviewed-by: Tim Shimmin <tes@sgi.com>
    Tested-by: Eric Sandeen <sandeen@sandeen.net>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 3c1e3896344063273715b332b1c0534deb9b286c
Author: Zhang Rui <rui.zhang@intel.com>
Date:   Fri Jul 11 09:42:03 2008 -0400

    libata-acpi: don't call sleeping function from invalid context
    
    The problem is introduced by commit
    664d080c41463570b95717b5ad86e79dc1be0877.
    
    acpi_evaluate_integer is a sleeping function,
    and it should not be called with spin_lock_irqsave.
    https://bugzilla.redhat.com/show_bug.cgi?id=451399
    
    Signed-off-by: Zhang Rui <rui.zhang@intel.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit edb804713ffb660ddad5dda5fb8f2addea7ad8c6
Author: Kai Krakow <kai@kaishome.de>
Date:   Sun Jul 6 14:22:26 2008 +0200

    Added Targa Visionary 1000 IDE adapter to pata_sis.c
    
    This enables short 40-wire detection for my laptop thus
    enabling UDMA/100.
    
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit b344991ace21896a83694c86d132b8494a29f3be
Author: Tejun Heo <tj@kernel.org>
Date:   Sun Jul 6 23:15:03 2008 +0900

    libata-acpi: filter out DIPM enable
    
    Some BIOSen enable DIPM via _GTF which causes command timeouts under
    certain configuration.  This didn't occur on 2.6.25 because 2.6.25
    defaulted to SRST, so _GTF wasn't executed during boot probe, so ahci
    host reset disabled DIPM and as _GTF wasn't executed after SRST, DIPM
    wasn't enabled.  On 2.6.26, hardreset is used during probe and after
    probe _GTF is executed enabling DIPM and thus the failures.
    
    This patch could theoretically disable DIPM on machines which used to
    have it enabled on 2.6.25 but AFAIK ahci is currently the only driver
    which uses SATA ACPI hierarchy (_SDD) and as the host reset would have
    always disabled DIPM, this shouldn't happen.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 61ca9daa2ca3022dc9cb22bd98e69c1b61e412ad
Author: Paul Gortmaker <paul.gortmaker@windriver.com>
Date:   Thu Jul 10 17:30:48 2008 -0700

    rtc: fix reported IRQ rate for when HPET is enabled
    
    The IRQ rate reported back by the RTC is incorrect when HPET is enabled.
    
    Newer hardware that has HPET to emulate the legacy RTC device gets this value
    wrong since after it sets the rate, it returns before setting the variable
    used to report the IRQ rate back to users of the device -- so the set rate and
    the reported rate get out of sync.
    
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: David Brownell <david-b@pacbell.net>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit ac310bb5db057963548e067037d68c9be41d0dd0
Author: Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
Date:   Thu Jul 10 17:30:46 2008 -0700

    Fix name of Russell King in various comments
    
    This patch was created by
    
    	git grep -E -l 'Rus(el|s?e)l King' | xargs -r -t perl -p -i -e 's/Rus(el|s?e)l King/Russell King/g'
    
    Signed-off-by: Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
    Most-Definitely-Acked-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit a7de3902edce099e4102c1272ec0ab569c1791f7
Author: Eugene Surovegin <ebs@ebshome.net>
Date:   Thu Jul 10 17:30:44 2008 -0700

    rapidio: fix device reference counting
    
    Fix RapidIO device reference counting.
    
    Signed-of-by: Eugene Surovegin <ebs@ebshome.net>
    Cc: Matt Porter <mporter@kernel.crashing.org>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit fb0e7e11d017beb5f0b1fa25bc51e49e65c46d67
Author: Marcin Obara <marcin_obara@users.sourceforge.net>
Date:   Thu Jul 10 17:30:42 2008 -0700

    tpm: add Intel TPM TIS device HID
    
    This patch adds Intel TPM TIS device HID:  ICO0102
    
    Signed-off-by: Marcin Obara <marcin_obara@users.sourceforge.net>
    Acked-by: Marcel Selhorst <tpm@selhorst.net>
    Acked-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit e5a5816f7875207cb0a0a7032e39a4686c5e10a4
Merge: bdb2192... e35259a...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Jul 10 17:58:47 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits)
      tun: Persistent devices can get stuck in xoff state
      xfrm: Add a XFRM_STATE_AF_UNSPEC flag to xfrm_usersa_info
      ipv6: missed namespace context in ipv6_rthdr_rcv
      netlabel: netlink_unicast calls kfree_skb on error path by itself
      ipv4: fib_trie: Fix lookup error return
      tcp: correct kcalloc usage
      ip: sysctl documentation cleanup
      Documentation: clarify tcp_{r,w}mem sysctl docs
      netfilter: nf_nat_snmp_basic: fix a range check in NAT for SNMP
      netfilter: nf_conntrack_tcp: fix endless loop
      libertas: fix memory alignment problems on the blackfin
      zd1211rw: stop beacons on remove_interface
      rt2x00: Disable synchronization during initialization
      rc80211_pid: Fix fast_start parameter handling
      sctp: Add documentation for sctp sysctl variable
      ipv6: fix race between ipv6_del_addr and DAD timer
      irda: Fix netlink error path return value
      irda: New device ID for nsc-ircc
      irda: via-ircc proper dma freeing
      sctp: Mark the tsn as received after all allocations finish
      ...

commit e35259a95331ae4a9146cc03ab49aad641cab957
Author: Max Krasnyansky <maxk@qualcomm.com>
Date:   Thu Jul 10 16:59:11 2008 -0700

    tun: Persistent devices can get stuck in xoff state
    
    The scenario goes like this. App stops reading from tun/tap.
    TX queue gets full and driver does netif_stop_queue().
    App closes fd and TX queue gets flushed as part of the cleanup.
    Next time the app opens tun/tap and starts reading from it but
    the xoff state is not cleared. We're stuck.
    Normally xoff state is cleared when netdev is brought up. But
    in the case of persistent devices this happens only during
    initial setup.
    
    The fix is trivial. If device is already up when an app opens
    it we clear xoff state and that gets things moving again.
    
    Signed-off-by: Max Krasnyansky <maxk@qualcomm.com>
    Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit ccf9b3b83d0e56fbf20c00a08b15031ce13204a7
Author: Steffen Klassert <steffen.klassert@secunet.com>
Date:   Thu Jul 10 16:55:37 2008 -0700

    xfrm: Add a XFRM_STATE_AF_UNSPEC flag to xfrm_usersa_info
    
    Add a XFRM_STATE_AF_UNSPEC flag to handle the AF_UNSPEC behavior for
    the selector family. Userspace applications can set this flag to leave
    the selector family of the xfrm_state unspecified.  This can be used
    to to handle inter family tunnels if the selector is not set from
    userspace.
    
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0ce28553cc018be5022f51e67c87997f7271534e
Author: Denis V. Lunev <den@parallels.com>
Date:   Thu Jul 10 16:54:50 2008 -0700

    ipv6: missed namespace context in ipv6_rthdr_rcv
    
    Signed-off-by: Denis V. Lunev <den@parallels.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit fe785bee05f08d37b34b7399d003b74199274ce4
Author: Denis V. Lunev <den@openvz.org>
Date:   Thu Jul 10 16:53:39 2008 -0700

    netlabel: netlink_unicast calls kfree_skb on error path by itself
    
    So, no need to kfree_skb here on the error path. In this case we can
    simply return.
    
    Signed-off-by: Denis V. Lunev <den@openvz.org>
    Acked-by: Paul Moore <paul.moore@hp.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 2e655571c618434c24ac2ca989374fdd84470d6d
Author: Ben Hutchings <bhutchings@solarflare.com>
Date:   Thu Jul 10 16:52:52 2008 -0700

    ipv4: fib_trie: Fix lookup error return
    
    In commit a07f5f508a4d9728c8e57d7f66294bf5b254ff7f "[IPV4] fib_trie: style
    cleanup", the changes to check_leaf() and fn_trie_lookup() were wrong - where
    fn_trie_lookup() would previously return a negative error value from
    check_leaf(), it now returns 0.
    
    Now fn_trie_lookup() doesn't appear to care about plen, so we can revert
    check_leaf() to returning the error value.
    
    Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
    Tested-by: William Boughton <bill@boughton.de>
    Acked-by: Stephen Heminger <shemminger@vyatta.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 3d8ea1fd7001f39b5cc0ad2ff51696292ea3cfbf
Author: Milton Miller <miltonm@bga.com>
Date:   Thu Jul 10 16:51:32 2008 -0700

    tcp: correct kcalloc usage
    
    kcalloc is supposed to be called with the count as its first argument and
    the element size as the second.
    
    Signed-off-by: Milton Miller <miltonm@bga.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 4edc2f3416438a05b83a677ae7b1a78b3ca22bb9
Author: Stephen Hemminger <shemminger@vyatta.com>
Date:   Thu Jul 10 16:50:26 2008 -0700

    ip: sysctl documentation cleanup
    
    Reduced version of the spelling cleanup patch.
    
    Take out the confusing language in tcp_frto, and organize the
    undocumented values.
    
    Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
    Acked-by: Randy Dunlap <rdunlap@xenotime.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 53025f5efd5a1c14fca75c479b11d97d9dd958a5
Author: J. Bruce Fields <bfields@citi.umich.edu>
Date:   Thu Jul 10 16:47:41 2008 -0700

    Documentation: clarify tcp_{r,w}mem sysctl docs
    
    Fix some of the defaults and attempt to clarify some language.
    
    Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit bdb21928512a860a60e6a24a849dc5b63cbaf96a
Author: Dmitry Adamushko <dmitry.adamushko@gmail.com>
Date:   Thu Jul 10 22:21:58 2008 +0200

    slub: Fix use-after-preempt of per-CPU data structure
    
    Vegard Nossum reported a crash in kmem_cache_alloc():
    
    	BUG: unable to handle kernel paging request at da87d000
    	IP: [<c01991c7>] kmem_cache_alloc+0xc7/0xe0
    	*pde = 28180163 *pte = 1a87d160
    	Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC
    	Pid: 3850, comm: grep Not tainted (2.6.26-rc9-00059-gb190333 #5)
    	EIP: 0060:[<c01991c7>] EFLAGS: 00210203 CPU: 0
    	EIP is at kmem_cache_alloc+0xc7/0xe0
    	EAX: 00000000 EBX: da87c100 ECX: 1adad71a EDX: 6b6b6b6b
    	ESI: 00200282 EDI: da87d000 EBP: f60bfe74 ESP: f60bfe54
    	DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
    
    and analyzed it:
    
      "The register %ecx looks innocent but is very important here. The disassembly:
    
           mov    %edx,%ecx
           shr    $0x2,%ecx
           rep stos %eax,%es:(%edi) <-- the fault
    
       So %ecx has been loaded from %edx... which is 0x6b6b6b6b/POISON_FREE.
       (0x6b6b6b6b >> 2 == 0x1adadada.)
    
       %ecx is the counter for the memset, from here:
    
           memset(object, 0, c->objsize);
    
      i.e. %ecx was loaded from c->objsize, so "c" must have been freed.
      Where did "c" come from? Uh-oh...
    
           c = get_cpu_slab(s, smp_processor_id());
    
      This looks like it has very much to do with CPU hotplug/unplug. Is
      there a race between SLUB/hotplug since the CPU slab is used after it
      has been freed?"
    
    Good analysis.
    
    Yeah, it's possible that a caller of kmem_cache_alloc() -> slab_alloc()
    can be migrated on another CPU right after local_irq_restore() and
    before memset().  The inital cpu can become offline in the mean time (or
    a migration is a consequence of the CPU going offline) so its
    'kmem_cache_cpu' structure gets freed ( slab_cpuup_callback).
    
    At some point of time the caller continues on another CPU having an
    obsolete pointer...
    
    Signed-off-by: Dmitry Adamushko <dmitry.adamushko@gmail.com>
    Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
    Acked-by: Ingo Molnar <mingo@elte.hu>
    Cc: stable@kernel.org
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 96a8e13ed44e380fc2bb6c711d74d5ba698c00b2
Author: Hugh Dickins <hugh@veritas.com>
Date:   Thu Jul 10 21:19:20 2008 +0100

    exec: fix stack excutability without PT_GNU_STACK
    
    Kernel Bugzilla #11063 points out that on some architectures (e.g. x86_32)
    exec'ing an ELF without a PT_GNU_STACK program header should default to an
    executable stack; but this got broken by the unlimited argv feature because
    stack vma is now created before the right personality has been established:
    so breaking old binaries using nested function trampolines.
    
    Therefore re-evaluate VM_STACK_FLAGS in setup_arg_pages, where stack
    vm_flags used to be set, before the mprotect_fixup.  Checking through
    our existing VM_flags, none would have changed since insert_vm_struct:
    so this seems safer than finding a way through the personality labyrinth.
    
    Reported-by: pageexec@freemail.hu
    Signed-off-by: Hugh Dickins <hugh@veritas.com>
    Cc: stable@kernel.org
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit f8804d39462dc019ae9d1a6e4d45512e9dfec2bf
Merge: a26449d... e988cf1...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Jul 10 13:11:01 2008 -0700

    Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2
    
    * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2:
      ocfs2: Fix flags in ocfs2_file_lock

commit a26449daa285c858fc68991c1d585b6927702cf5
Merge: 9cc3089... b1e3873...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Jul 10 12:34:55 2008 -0700

    Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      sched: fix cpu hotplug, cleanup
      sched: fix cpu hotplug

commit b1e387348a2a70954312b102d0589c3e2ca3dba1
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Jul 10 11:25:03 2008 -0700

    sched: fix cpu hotplug, cleanup
    
    Clean up __migrate_task(): to just have separate "done" and "fail"
    cases, instead of that "out" case with random error behavior.
    
    Signed-off-by: Ingo Molnar <mingo@elte.hu>

commit 9cc308920103a743ce9fb2c88481d6d7a676514b
Merge: 70ff055... a361ee5...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Jul 10 11:19:53 2008 -0700

    Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86: fix /dev/mem compatibility under PAT

commit 70ff05554f91a1edda1f11684da1dbde09e2feea
Author: Nick Piggin <nickpiggin@yahoo.com.au>
Date:   Thu Jul 10 17:25:35 2008 +1000

    Fix PREEMPT_RCU without HOTPLUG_CPU
    
    PREEMPT_RCU without HOTPLUG_CPU is broken.  The rcu_online_cpu is called
    to initially populate rcu_cpu_online_map with all online CPUs when the
    hotplug event handler is installed, and also to populate the map with
    CPUs as they come online.  The former case is meant to happen with and
    without HOTPLUG_CPU, but without HOTPLUG_CPU, the rcu_offline_cpu
    function is no-oped -- while it still gets called, it does not set the
    rcu CPU map.
    
    With a blank RCU CPU map, grace periods get to tick by completely
    oblivious to active RCU read side critical sections.  This results in
    free-before-grace bugs.
    
    Fix is obvious once the problem is known. (Also, change __devinit to
    __cpuinit so the function gets thrown away on !HOTPLUG_CPU kernels).
    
    Signed-off-by: Nick Piggin <npiggin@suse.de>
    Reported-and-tested-by: Alexey Dobriyan <adobriyan@gmail.com>
    Acked-by: Ingo Molnar <mingo@elte.hu>
    Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    [ Nick is my personal hero of the day - Linus ]
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit eb6d42ea17329745d7d712d3aa3bb84ec1da9c85
Author: Steven Rostedt <rostedt@goodmis.org>
Date:   Thu Jul 10 12:46:01 2008 -0400

    ftrace: Documentation
    
    This is the long awaited ftrace.txt. It explains in quite detail how to
    use ftrace and the various tracers.
    
    Signed-off-by: Steven Rostedt <srostedt@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit b10e9ad0f1d0dc62bd444dd6761a6527bfe98959
Author: Daniel Guilak <guilak@linux.vnet.ibm.com>
Date:   Thu Jul 10 09:39:32 2008 -0700

    arch/x86/kernel/.gitignore: Added vmlinux.lds to .gitignore file because it shouldn't be tracked.
    
    Signed-off-by: Daniel Guilak <daniel@danielguilak.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 544304b200c3869bc1312bcf941c4cf04d65b56c
Author: Daniel Guilak <guilak@linux.vnet.ibm.com>
Date:   Thu Jul 10 09:38:19 2008 -0700

    kernel/kprobes.c: Made kprobe_blacklist static.
    
    Signed-off-by: Daniel Guilak <daniel@danielguilak.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 08405b8bd1795145e0f9cb8cb13949281efe9ec2
Merge: 2283af5... 872ac87...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Jul 10 10:10:02 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
      crypto: chainiv - Invoke completion function

commit 2283af5b0b99565f516eacd756df2b1ddf9f4f85
Merge: 6329d30... 7a1fc53...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Jul 10 09:49:46 2008 -0700

    Merge branch 'for-2.6.26' of git://neil.brown.name/md
    
    * 'for-2.6.26' of git://neil.brown.name/md:
      md: ensure all blocks are uptodate or locked when syncing

commit e988cf1cfed4ed80bf40528e655fe18bed6a38b6
Author: Mark Fasheh <mfasheh@suse.com>
Date:   Thu Jul 10 09:25:39 2008 -0700

    ocfs2: Fix flags in ocfs2_file_lock
    
    The stack-glue merge changed the way we use flags in dlmglue in that we now
    use the fs/dlm equivalents. Unfortunately, a merge error left the new flock
    code only partially updated. This took a while to show up though, because
    the lock level constants are actually identical between o2dlm and fs/dlm.
    The *_CONVERT and *_NOQUEUE flags have different values though, which is
    eventually causing a crash in flags_to_o2dlm().
    
    Signed-off-by: Mark Fasheh <mfasheh@suse.com>

commit 872ac8743cb400192a9fce4ba2d3ffd7bb309685
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Thu Jul 10 17:42:36 2008 +0800

    crypto: chainiv - Invoke completion function
    
    When chainiv postpones requests it never calls their completion functions.
    This causes symptoms such as memory leaks when IPsec is in use.
    
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

commit a361ee5cb8011763ece7b4add393e206439db8b3
Author: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Date:   Thu Jul 10 10:09:59 2008 +0200

    x86: fix /dev/mem compatibility under PAT
    
    Add ioremap_default(), which gives a sane mapping without worrying about
    type conflicts.
    
    Use it in /dev/mem read in place of ioremap(), as with ioremap(),
    any mapping of the region (other than UC_MINUS) will cause a conflict
    and failure of /dev/mem read.
    
    Should address the vbetest failure reported at:
    
      http://bugzilla.kernel.org/show_bug.cgi?id=11057
    
    Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>

commit dc7fab8b3bb388c57c6c4a43ba68c8a32ca25204
Author: Dmitry Adamushko <dmitry.adamushko@gmail.com>
Date:   Thu Jul 10 00:32:40 2008 +0200

    sched: fix cpu hotplug
    
    I think we may have a race between try_to_wake_up() and
    migrate_live_tasks() -> move_task_off_dead_cpu() when the later one
    may end up looping endlessly.
    
    Interrupts are enabled on other CPUs when migration_call(CPU_DEAD, ...) is
    called so we may get a race between try_to_wake_up() and
    migrate_live_tasks() -> move_task_off_dead_cpu(). The former one may push
    a task out of a dead CPU causing the later one to loop endlessly.
    
    Heiko Carstens observed:
    
    | That's exactly what explains a dump I got yesterday. Thanks for fixing! :)
    
    Signed-off-by: Dmitry Adamushko <dmitry.adamushko@gmail.com>
    Cc: miaox@cn.fujitsu.com
    Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
    Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Avi Kivity <avi@qumranet.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>

commit 7a1fc53c5adb910751a9b212af90302eb4ffb527
Author: Dan Williams <dan.j.williams@intel.com>
Date:   Thu Jul 10 04:54:57 2008 -0700

    md: ensure all blocks are uptodate or locked when syncing
    
    Remove the dubious attempt to prefer 'compute' over 'read'.  Not only is it
    wrong given commit c337869d (md: do not compute parity unless it is on a failed
    drive), but it can trigger a BUG_ON in handle_parity_checks5().
    
    Cc: <stable@kernel.org>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Signed-off-by: Neil Brown <neilb@suse.de>

commit 2ddddb98694af847f70463dbdc69aa491d9f477a
Merge: 252815b... 814feef...
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Jul 9 15:10:09 2008 -0700

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

commit 252815b0cfe711001eff0327872209986b36d490
Author: David Howells <dhowells@redhat.com>
Date:   Wed Jul 9 15:06:45 2008 -0700

    netfilter: nf_nat_snmp_basic: fix a range check in NAT for SNMP
    
    Fix a range check in netfilter IP NAT for SNMP to always use a big enough size
    variable that the compiler won't moan about comparing it to ULONG_MAX/8 on a
    64-bit platform.
    
    Signed-off-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6b69fe0c73c0f5a8dacf8f889db3cc9adee53649
Author: Patrick McHardy <kaber@trash.net>
Date:   Wed Jul 9 15:06:12 2008 -0700

    netfilter: nf_conntrack_tcp: fix endless loop
    
    When a conntrack entry is destroyed in process context and destruction
    is interrupted by packet processing and the packet is an attempt to
    reopen a closed connection, TCP conntrack tries to kill the old entry
    itself and returns NF_REPEAT to pass the packet through the hook
    again. This may lead to an endless loop: TCP conntrack repeatedly
    finds the old entry, but can not kill it itself since destruction
    is already in progress, but destruction in process context can not
    complete since TCP conntrack is keeping the CPU busy.
    
    Drop the packet in TCP conntrack if we can't kill the connection
    ourselves to avoid this.
    
    Reported by: hemao77@gmail.com [ Kernel bugzilla #11058 ]
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6329d3021bcfa9038621e6e917d98929421d8ec8
Merge: b72e9eb... 5e19cf6...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed Jul 9 14:16:23 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
      RDMA/cxgb3: Fix regression caused by class_device -> device conversion

commit 814feefa859a736d29d0700d49debf13904b429f
Author: Ihar Hrachyshka <ihar.hrachyshka@promwad.com>
Date:   Wed Jul 9 09:29:58 2008 +0300

    libertas: fix memory alignment problems on the blackfin
    
    Fixing unaligned memory access on the blackfin architecture.
    
    Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@promwad.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 86229f0c7b4e065f51b5572a8a61801e281740a0
Author: Luis Carlos Cobo <luisca@cozybit.com>
Date:   Tue Jul 8 16:19:21 2008 +0200

    zd1211rw: stop beacons on remove_interface
    
    If a mesh or ad-hoc interface is brought up and later it is replaced
    by managed interface, the managed interface will keep transmitting
    the beacons that were configured for the former interface. This patch
    fixes that behaviour.
    
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 1f90916264049a7d9e6106fd60d289c9a775d24f
Author: Ivo van Doorn <ivdoorn@gmail.com>
Date:   Tue Jul 8 13:45:20 2008 +0200

    rt2x00: Disable synchronization during initialization
    
    As soon as init_registers() was called, the rt2400/rt2500
    would start raising beacondone interrupts. Since this is highly
    premature since no beacons were provided yet, we should
    initialize the synchronization register to 0.
    
    This will make all drivers initialize it to 0 regardless
    if they are raising beacondone interrupts or not, since it only
    makes sense to have it completely disabled.
    
    Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit adeed48090fc370afa0db8d007748ee72a40b578
Author: Mattias Nissler <mattias.nissler@gmx.de>
Date:   Mon Jul 7 23:08:19 2008 +0200

    rc80211_pid: Fix fast_start parameter handling
    
    This removes the fast_start parameter from the rc_pid parameters
    information and instead uses the parameter macro when initializing
    the rc_pid state. Since the parameter is only used on initialization,
    there is no point of making exporting it via debugfs. This also fixes
    uninitialized memory references to the fast_start and norm_offset
    parameters detected by the kmemcheck utility.  Thanks to Vegard Nossum
    for reporting the bug.
    
    Signed-off-by: Mattias Nissler <mattias.nissler@gmx.de>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit b72e9ebe7efa5754aa53bbdb0040a2d6eeb34db3
Merge: ba0fc70... 18c6ac3...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Jul 8 21:48:26 2008 -0700

    Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2
    
    * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2:
      [PATCH] ocfs2/dlm: Fixes oops in dlm_new_lockres()

commit ba0fc709e197415aadd46b9ec208dc4abaa21edd
Author: Vitaly Bordug <vitb@kernel.crashing.org>
Date:   Wed Jul 9 13:13:38 2008 +1000

    powerpc: Add missing reference to coherent_dma_mask
    
    There is dma_mask in of_device upon of_platform_device_create()
    but we don't actually set coherent_dma_mask. This may cause weird
    behavior of USB subsystem using of_device USB host drivers.
    
    Signed-off-by: Vitaly Bordug <vitb@kernel.crashing.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit f1d407efbe59ff1a450f0ec7a486a768acaa2949
Merge: 7683c57... dbb018c...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Jul 8 18:10:51 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
      crypto: tcrypt - Fix memory leak in test_cipher

commit 7683c57c489bd17795945f4ae1c1d73e7c7b38e3
Author: Daniel Guilak <guilak@linux.vnet.ibm.com>
Date:   Tue Jul 8 15:02:06 2008 -0700

    kernel/printk.c: Made printk_recursion_bug_msg static.
    
    Signed-off-by: Daniel Guilak <daniel@danielguilak.com>
    Acked-by: Josh Triplett <josh@kernel.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 32e8d4948bb0b5f3f0ac5cdb71d0ac8e305b29a5
Author: Vlad Yasevich <vladislav.yasevich@hp.com>
Date:   Tue Jul 8 16:43:29 2008 -0700

    sctp: Add documentation for sctp sysctl variable
    
    Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
    Acked-by: Randy Dunlap <randy.dunlap@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit b2238566401f01eb796e75750213c7b0fce396b2
Author: Andrey Vagin <avagin@parallels.com>
Date:   Tue Jul 8 15:13:31 2008 -0700

    ipv6: fix race between ipv6_del_addr and DAD timer
    
    Consider the following scenario:
    
    ipv6_del_addr(ifp)
      ipv6_ifa_notify(RTM_DELADDR, ifp)
        ip6_del_rt(ifp->rt)
    
    after returning from the ipv6_ifa_notify and enabling BH-s
    back, but *before* calling the addrconf_del_timer the
    ifp->timer fires and:
    
    addrconf_dad_timer(ifp)
      addrconf_dad_completed(ifp)
        ipv6_ifa_notify(RTM_NEWADDR, ifp)
          ip6_ins_rt(ifp->rt)
    
    then return back to the ipv6_del_addr and:
    
    in6_ifa_put(ifp)
      inet6_ifa_finish_destroy(ifp)
        dst_release(&ifp->rt->u.dst)
    
    After this we have an ifp->rt inserted into fib6 lists, but
    queued for gc, which in turn can result in oopses in the
    fib6_run_gc. Maybe some other nasty things, but we caught
    only the oops in gc so far.
    
    The solution is to disarm the ifp->timer before flushing the
    rt from it.
    
    Signed-off-by: Andrey Vagin <avagin@parallels.com>
    Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 5e19cf663be534c7c15a35a86fa7ddc9f797e4f4
Author: Steve Wise <swise@opengridcomputing.com>
Date:   Tue Jul 8 14:40:05 2008 -0700

    RDMA/cxgb3: Fix regression caused by class_device -> device conversion
    
    The change to iwch_provider.c in commit f4e91eb4 ("IB: convert struct
    class_device to struct device") undid the fix done in commit 7f049f2f
    ("RDMA/cxgb3: Hold rtnl_lock() around ethtool get_drvinfo call").  It
    removed the calls to rtnl_lock() that serialized the iw_cxgb3 ethtool
    ops calls into the cxgb3 driver.  This locking is needed to avoid
    messing up the internal state of the cxgb3 driver.
    
    Signed-off-by: Steve Wise <swise@opengridcomputing.com>
    Signed-off-by: Roland Dreier <rolandd@cisco.com>

commit 48948a3e237ff47823d414704aeb8604a4c61ad0
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Jul 8 18:41:17 2008 +0200

    Fix broken fix for fsl-diu-db
    
    On 2.6.26-rc9, the commit 05946bce839b4fed5442dbfab77060fb75e051f3
    ("fsl_diu_fb: fix build with CONFIG_PM=y, plus fix some warnings")
    breaks its previous fix f969c5672b16b857e5231ad3c78f08d8ef3305aa
    ("fsl-diu-db: compile fix")
    
    This patch reverts the broken part.
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Acked-by: Anton Vorontsov <avorontsov@ru.mvista.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit f57e91682d141ea50d8c6d42cdc251b6256a3755
Merge: e914475... 803a906...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Jul 8 12:40:57 2008 -0700

    Merge branch 'hotfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6
    
    * 'hotfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:
      SUNRPC: Fix an rpcbind breakage for the case of IPv6 lookups
      SUNRPC: Fix a double-free in rpcbind
      NFS: Fix readdir cache invalidation

commit e9144754867b9ef431d54ea2a156f78feb196c34
Merge: eb35c21... 14defd9...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Jul 8 12:40:19 2008 -0700

    Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus
    
    * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
      [MIPS] Fix 32bit kernels on R4k with 128 byte cache line size
      [MIPS] Atlas, decstation: Fix section mismatches triggered by defconfigs

commit eb35c218d83ec0780d9db869310f2e333f628702
Author: Jeff Mahoney <jeffm@suse.com>
Date:   Tue Jul 8 14:37:06 2008 -0400

    reiserfs: discard prealloc in reiserfs_delete_inode
    
    With the removal of struct file from the xattr code,
    reiserfs_file_release() isn't used anymore, so the prealloc isn't
    discarded.  This causes hangs later down the line.
    
    This patch adds it to reiserfs_delete_inode.  In most cases it will be a
    no-op due to it already having been called, but will avoid hangs with
    xattrs.
    
    Signed-off-by: Jeff Mahoney <jeffm@suse.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 803a9067e19714ea7b7da760fe92f0d53bfa6994
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Tue Jul 1 15:20:55 2008 -0400

    SUNRPC: Fix an rpcbind breakage for the case of IPv6 lookups
    
    Now that rpcb_next_version has been split into an IPv4 version and an IPv6
    version, we Oops when rpcb_call_async attempts to look up the IPv6-specific
    RPC procedure in rpcb_next_version.
    
    Fix the Oops simply by having rpcb_getport_async pass the correct RPC
    procedure as an argument.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

commit 0d3a34b48c87a374b37d7a21a60d257d076484f3
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Mon Jul 7 12:18:52 2008 -0400

    SUNRPC: Fix a double-free in rpcbind
    
    It is wrong to be freeing up the rpcbind arguments if the call to
    rpcb_call_async() fails, since they should already have been freed up by
    rpcb_map_release().
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

commit 2aac05a91971fbd1bf6cbed78b8731eb7454b9b7
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Mon Jul 7 13:26:10 2008 -0400

    NFS: Fix readdir cache invalidation
    
    invalidate_inode_pages2_range() takes page offset arguments, not byte
    ranges.
    
    Another thought is that individual pages might perhaps get evicted by VM
    pressure, in which case we might perhaps want to re-read not only the
    evicted page, but all subsequent pages too (in case the server returns
    more/less data per page so that the alignment of the next entry
    changes). We should therefore remove the condition that we only do this on
    page->index==0.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

commit 14defd90f5281da8a1bf43bc789efbafe5991cd8
Author: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Date:   Tue Jul 8 14:46:34 2008 +0200

    [MIPS] Fix 32bit kernels on R4k with 128 byte cache line size
    
    The generated copy_page for R4k CPU with a 128 byte cache line size used
    Create Dirty Exclusive cache line operations even if only part of the
    cache line was filled.  This change avoids generating cache operations,
    if only part of the cache line size is copied in one loop. It also
    increases the maxmimum loop size, because the generated code even fits
    into the available space for r4k CPUs with 128 byte cache line size.
    
    Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

commit b32dfbb9c54393af32761add16e249664193621f
Author: Shane McDonald <mcdonald.shane@gmail.com>
Date:   Sat Jul 5 17:19:42 2008 -0600

    [MIPS] Atlas, decstation: Fix section mismatches triggered by defconfigs
    
    Resolve these mismatches by defining affected functions with the __cpuinit
    attribute, rather than __init.
    
    Signed-off-by: Shane McDonald <mcdonald.shane@gmail.com>
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

commit 90621ed829ac64eb25b4d1214e9a5155e5c67ff2
Merge: 9c0fc4e... be30504...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Jul 8 11:19:11 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
      it8213: fix return value in it8213_init_one()
      palm_bk3710: fix IDECLK period calculation
      ide: add __ide_default_irq() inline helper

commit be305042b7a01a1ab03a8adfa95f57bc63e012e1
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Tue Jul 8 19:27:23 2008 +0200

    it8213: fix return value in it8213_init_one()
    
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit ffab6cf44e9058fe75a33aa86386b22e616a8f6f
Author: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Date:   Tue Jul 8 19:27:22 2008 +0200

    palm_bk3710: fix IDECLK period calculation
    
    The driver uses completely bogus rounding formula for calculating period from
    the IDECLK frequency which gives one-off period values (e.g. 11 ns with 100 MHz
    IDECLK) which in turn can lead to overclocked IDE transfer timings.  Actually,
    rounding is just wrong in this case, so use a mere division for a safe result.
    
    While at it, also:
    
    - give 'ide_palm_clk' variable a more suitable name;
    
    - get rid of the useless 'ideclkp' variable;
    
    - drop the LISP stype 'p' postfix from the 'clkp' variable's name. :-)
    
    Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
    Cc: mcherkashin@ru.mvista.com
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit a861beb1401d65e3f095fee074c13645ab06490e
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Tue Jul 8 19:27:22 2008 +0200

    ide: add __ide_default_irq() inline helper
    
    Add __ide_default_irq() inline helper and use it instead of
    ide_default_irq() in ide-probe.c and ns87415.c (all host drivers
    except IDE PCI ones always setup hwif->irq so it is enough to
    check only for I/O bases 0x1f0 and 0x170).
    
    This fixes post-2.6.25 regression since ide_default_irq()
    define could shadow ide_default_irq() inline.
    
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit 9c0fc4e28b57c5a6da7b58d60f71476c64d457a6
Merge: 86df864... 138c902...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Jul 8 09:29:34 2008 -0700

    Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6
    
    * 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
      [S390] protect _PAGE_SPECIAL bit against mprotect

commit 86df86424939d316b1f6cfac1b6204f0c7dee317
Author: David Gibson <david@gibson.dropbear.id.au>
Date:   Tue Jul 8 15:58:16 2008 +1000

    Correct hash flushing from huge_ptep_set_wrprotect()
    
    As Andy Whitcroft recently pointed out, the current powerpc version of
    huge_ptep_set_wrprotect() has a bug.  It just calls ptep_set_wrprotect()
    which in turn calls pte_update() then hpte_need_flush() with the 'huge'
    argument set to 0.  This will cause hpte_need_flush() to flush the wrong
    hash entries (of any).  Andy's fix for this is already in the powerpc
    tree as commit 016b33c4958681c24056abed8ec95844a0da80a3.
    
    I have confirmed this is a real bug, not masked by some other
    synchronization, with a new testcase for libhugetlbfs.  A process write
    a (MAP_PRIVATE) hugepage mapping, fork(), then alter the mapping and
    have the child incorrectly see the second write.
    
    Therefore, this should be fixed for 2.6.26, and for the stable tree.
    Here is a suitable patch for 2.6.26, which I think will also be suitable
    for the stable tree (neither of the headers in question has been changed
    much recently).
    
    It is cut down slighlty from Andy's original version, in that it does
    not include a 32-bit version of huge_ptep_set_wrprotect().  Currently,
    hugepages are not supported on any 32-bit powerpc platform.  When they
    are, a suitable 32-bit version can be added - the only 32-bit hardware
    which supports hugepages does not use the conventional hashtable MMU and
    so will have different needs anyway.
    
    Signed-off-by: Andy Whitcroft <apw@shadowen.org>
    Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 081a5bcb39b455405d58f79bb3c9398a9d4477ed
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Mon Jul 7 11:24:06 2008 -0500

    [SCSI] mptspi: fix oops in mptspi_dv_renegotiate_work()
    
    The problem here is that if the ioc faults too early in the bring up
    sequence (as it usually does for an irq routing problem), ioc_reset gets
    called before the scsi host is even allocated.  This causes an oops when
    it later schedules a renegotiation.  Fix this by checking ioc->sh before
    trying to renegotiate.
    
    Cc: "Moore, Eric" <Eric.Moore@lsi.com>
    Cc: Stable Tree <stable@kernel.org>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 07035fc1bbf931a06e47583cddd2cea2907ac0db
Author: Julius Volz <juliusv@google.com>
Date:   Tue Jul 8 03:07:43 2008 -0700

    irda: Fix netlink error path return value
    
    Fix an incorrect return value check of genlmsg_put() in irda_nl_get_mode().
    genlmsg_put() does not use ERR_PTR() to encode return values, it just
    returns NULL on error.
    
    Signed-off-by: Julius Volz <juliusv@google.com>
    Signed-off-by: Samuel Ortiz <samuel@sortiz.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 02307080622da0312f2ede0f9c0ac779a1cc4f9a
Author: Ville Syrjala <syrjala@sci.fi>
Date:   Tue Jul 8 03:07:16 2008 -0700

    irda: New device ID for nsc-ircc
    
    HP OmniBook 500's DSDT code changes the HID of the FIR device from
    NSC6001 to HWPC224 when run under an "NT" operating system. Add the
    new ID to the pnp device id table.
    
    Signed-off-by: Ville Syrjala <syrjala@sci.fi>
    Signed-off-by: Samuel Ortiz <samuel@sortiz.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 568b4933a9902aed0f51e2e1bea3da157fb18833
Author: Wang Chen <wangchen@cn.fujitsu.com>
Date:   Tue Jul 8 03:06:46 2008 -0700

    irda: via-ircc proper dma freeing
    
    1. dma should be freed when dma2 request fail.
    2. dma2 should be freed too when device close.
    
    Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
    Signed-off-by: Samuel Ortiz <samuel@sortiz.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 138c9021ca68d6f8a6fac3418995fee102a3cc22
Author: Nick Piggin <npiggin@suse.de>
Date:   Tue Jul 8 11:31:06 2008 +0200

    [S390] protect _PAGE_SPECIAL bit against mprotect
    
    Stop mprotect's pte_modify from wiping out the s390 pte_special bit, which
    caused oops thereafter when vm_normal_page thought X's abnormal was normal.
    
    Debugged-by: Ryan Hope <rmh3093@gmail.com>
    Debugged-by: Zan Lynx <zlynx@acm.org>
    Acked-by: Hugh Dickins <hugh@veritas.com>
    Signed-off-by: Nick Piggin <npiggin@suse.de>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

commit 3888e9efc9bf05e60504d2a420be7a527ff43678
Author: Vlad Yasevich <vladislav.yasevich@hp.com>
Date:   Tue Jul 8 02:28:39 2008 -0700

    sctp: Mark the tsn as received after all allocations finish
    
    If we don't have the buffer space or memory allocations fail,
    the data chunk is dropped, but TSN is still reported as received.
    This introduced a data loss that can't be recovered.  We should
    only mark TSNs are received after memory allocations finish.
    The one exception is the invalid stream identifier, but that's
    due to user error and is reported back to the user.
    
    This was noticed by Michael Tuexen.
    
    Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit dbb018cd8a0fd073eaabf9de5a93f62d98bd7723
Author: Darren Jenkins <darrenrjenkins@gmailcom>
Date:   Tue Jul 8 15:51:44 2008 +0800

    crypto: tcrypt - Fix memory leak in test_cipher
    
    Coverity CID: 2306 & 2307 RESOURCE_LEAK
    
    In the second for loop in test_cipher(), data is allocated space with
    kzalloc() and is only ever freed in an error case.
    Looking at this loop, data is written to this memory but nothing seems
    to read from it.
    So here is a patch removing the allocation, I think this is the right
    fix.
    
    Only compile tested.
    
    Signed-off-by: Darren Jenkins <darrenrjenkins@gmailcom>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

commit 7b51ba38d9baca207152d1c97ec793cfb673a6cd
Merge: 4f81c53... 739db07...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Jul 7 16:59:43 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
      Revert "PCI: Correct last two HP entries in the bfsort whitelist"

commit 6e43829bb69bf1d584a592075f1357590eb49b1a
Author: Vladimir Koutny <vlado@work.ksp.sk>
Date:   Mon Jul 7 14:23:01 2008 +0200

    mac80211: don't report selected IBSS when not found
    
    Don't report a 'selected' IBSS in sta_find_ibss when none was found.
    
    Signed-off-by: Vladimir Koutny <vlado@ksp.sk>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 9e095a687b3561972272063260e14ab1bc21de08
Author: Michael Buesch <mb@bu3sch.de>
Date:   Fri Jul 4 23:44:37 2008 +0200

    ssb-pcicore: Fix IRQ-vector init on embedded devices
    
    On embedded devices we must not route the interrupts through
    the PCI core, if our host-bus is not PCI.
    
    Reported-by: Steve Brown <sbrown@cortland.com>
    Signed-off-by: Michael Buesch <mb@bu3sch.de>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 9dfd55008e3863dcd93219c74bf05b09e5c549e2
Author: Firat Birlik <firat@airties.com>
Date:   Fri Jul 4 04:31:50 2008 +0100

    zd1211rw: add ID for AirTies WUS-201
    
    I would like to inform you of our zd1211 based usb wifi adapter (AirTies
    WUS-201), which works with the zd1211rw driver with the following device
    id definition.
    
    Signed-off-by: Daniel Drake <dsd@gentoo.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit ea0c925370b33baf168bb33782c613468c1aa119
Author: Ivo van Doorn <ivdoorn@gmail.com>
Date:   Thu Jul 3 19:02:44 2008 +0200

    mac80211: Only flush workqueue when last interface was removed
    
    Currently the ieee80211_hw->workqueue is flushed each time
    an interface is being removed. However most scheduled work
    is not interface specific but device specific, for example things like
    periodic work for link tuners.
    
    This patch will move the flush_workqueue() call to directly behind
    the call to ops->stop() to make sure the workqueue is only flushed
    when all interfaces are gone and there really shouldn't be any scheduled
    work in the drivers left.
    
    Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
    Acked-by: Johannes Berg <johannes@sipsolutions.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 8db9369ff92b1cd93566baadd8bd2992f025fdd0
Author: Guy Cohen <guy.cohen@intel.com>
Date:   Thu Jul 3 19:56:13 2008 +0300

    mac80211: move netif_carrier_on to after ieee80211_bss_info_change_notify
    
    Putting netif_carrier_on before configuring the driver/device with the
    new association state may cause a race (tx frames may be sent before
    configuration is done)
    
    Signed-off-by: Guy Cohen <guy.cohen@intel.com>
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 0ff1cca0e272045b9c11a2ff94bd3e6893c9308c
Author: Darren Jenkins <darrenrjenkins@gmail.com>
Date:   Thu Jul 3 09:41:38 2008 +1000

    drivers/net/wireless/iwlwifi/iwl-3945.c Fix type issue on 64bit
    
    Coverity CID: 2265 NEGATIVE_RETURNS
    
    "rate" is of an unsigned type, and the code requires a signed type.
    The following patch makes it so.
    
    Signed-off-by: Darren Jenkins <darrenrjenkins@gmailcom>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit fcee7a01ad7516eeb8dfdd0a17ef04cd2ee30757
Author: John W. Linville <linville@tuxdriver.com>
Date:   Wed Jul 2 11:04:24 2008 -0400

    hostap_cs: correct poor NULL checks in suspend/resume routines
    
    This corrects this kernel.org bug:
    
    	http://bugzilla.kernel.org/show_bug.cgi?id=9701
    
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 739db07f82767e7634176d18af2acbe77b11fd42
Author: Jesse Barnes <jbarnes@hobbes.(none)>
Date:   Mon Jul 7 09:55:26 2008 -0700

    Revert "PCI: Correct last two HP entries in the bfsort whitelist"
    
    This reverts commit a1676072558854b95336c8f7db76b0504e909a0a.  It duplicates
    the change from 8d64c781f0c5fbfdf8016bd1634506ff2ad1376a and only one should be
    applied, otherwise some of the Dell quirks are lost.
    
    Thanks to Tony Camuso for catching this.
    
    Acked-by: Tony Camuso <tcamuso@redhat.com>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>

commit 18c6ac383f3e46cfce08d0bf972705852a4e1268
Author: Sunil Mushran <sunil.mushran@oracle.com>
Date:   Mon Jul 7 10:06:29 2008 -0700

    [PATCH] ocfs2/dlm: Fixes oops in dlm_new_lockres()
    
    Patch fixes a race that can result in an oops while adding a
    lockres to the dlm lockres tracking list.
    
    Bug introduced by mainline commit 29576f8bb54045be944ba809d4fca1ad77c94165.
    
    Signed-off-by: Sunil Mushran <sunil.mushran@oracle.com>
    Signed-off-by: Mark Fasheh <mfasheh@suse.com>

commit 4f81c5350b44bcc501ab6f8a089b16d064b4d2f6
Author: Jeff Dike <jdike@addtoit.com>
Date:   Mon Jul 7 13:36:56 2008 -0400

    [UML] fix gcc ICEs and unresolved externs
    
    There are various constraints on the use of unit-at-a-time:
     - i386 uses no-unit-at-a-time for pre-4.0 (not 4.3)
     - x86_64 uses unit-at-a-time always
    
    Uli reported a crash on x86_64 with gcc 4.1.2 with unit-at-a-time,
    resulting in commit c0a18111e571138747a98af18b3a2124df56a0d1
    
    Ingo reported a gcc internal error with gcc 4.3 with no-unit-at-a-timem,
    resulting in 22eecde2f9034764a3fd095eecfa3adfb8ec9a98
    
    Benny Halevy is seeing extern inlines not resolved with gcc 4.3 with
    no-unit-at-a-time
    
    This patch reintroduces unit-at-a-time for gcc >= 4.0, bringing back the
    possibility of Uli's crash.  If that happens, we'll debug it.
    
    I started seeing both the internal compiler errors and unresolved
    inlines on Fedora 9.  This patch fixes both problems, without so far
    reintroducing the crash reported by Uli.
    
    Signed-off-by: Jeff Dike <jdike@linux.intel.com>
    Cc: Benny Halevy <bhalevy@panasas.com>
    Cc: Adrian Bunk <bunk@kernel.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Ulrich Drepper <drepper@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit b2798bf0ec2cb5a17bfc1430c5ba6d971c436a03
Merge: 3bc5ab9... 7f2d38e...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Jul 7 09:24:28 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      can: add sanity checks
      fs_enet: restore promiscuous and multicast settings in restart()
      ibm_newemac: Fixes entry of short packets
      ibm_newemac: Fixes kernel crashes when speed of cable connected changes
      pasemi_mac: Access iph->tot_len with correct endianness
      ehea: Access iph->tot_len with correct endianness
      ehea: fix race condition
      ehea: add MODULE_DEVICE_TABLE
      ehea: fix might sleep problem
      forcedeth: fix lockdep warning on ethtool -s
      Add missing skb->dev assignment in Frame Relay RX code
      bridge: fix use-after-free in br_cleanup_bridges()
      tcp: fix a size_t < 0 comparison in tcp_read_sock
      tcp: net/ipv4/tcp.c needs linux/scatterlist.h
      libertas: support USB persistence on suspend/resume (resend)
      iwlwifi: drop skb silently for Tx request in monitor mode
      iwlwifi: fix incorrect 5GHz rates reported in monitor mode

commit 3bc5ab9b7f2760d2892fd0a0589e1077e869d4f5
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date:   Mon Jul 7 16:39:50 2008 +1000

    powerpc: Fix unterminated of_device_id array in legacy_serial.c
    
    A recent patch to legacy_serial.c factored out some code by
    using the of_match_node() facility to match a node against
    an array of possible matches. However, the patch didn't properly
    terminate the array causing potential crashes in cases where no
    match is found. In addition, the name of the array was poorly
    chosen for a static symbol making debugging harder.
    
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 0fe1ef24f7bd0020f29ffe287dfdb9ead33ca0b2
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 16:43:12 2008 -0700

    vsprintf: add support for '%pS' and '%pF' pointer formats
    
    They print out a pointer in symbolic format, if possible (ie using
    symbolic KALLSYMS information).  The '%pS' format is for regular direct
    pointers (which can point to data or code and that you find on the stack
    during backtraces etc), while '%pF' is for C function pointer types.
    
    On most architectures, the two mean exactly the same thing, but some
    architectures use an indirect pointer for C function pointers, where the
    function pointer points to a function descriptor (which in turn contains
    the actual pointer to the code).  The '%pF' code automatically does the
    appropriate function descriptor dereference on such architectures.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 4d8a743cdd2690c0bc8d1b8cbd02cffb1ead849f
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 16:24:57 2008 -0700

    vsprintf: add infrastructure support for extended '%p' specifiers
    
    This expands the kernel '%p' handling with an arbitrary alphanumberic
    specifier extension string immediately following the '%p'.  Right now
    it's just being ignored, but the next commit will start adding some
    specific pointer type extensions.
    
    NOTE! The reason the extension is appended to the '%p' is to allow
    minimal gcc type checking: gcc will still see the '%p' and will check
    that the argument passed in is indeed a pointer, and yet will not
    complain about the extended information that gcc doesn't understand
    about (on the other hand, it also won't actually check that the pointer
    type and the extension are compatible).
    
    Alphanumeric characters were chosen because there is no sane existing
    use for a string format with a hex pointer representation immediately
    followed by alphanumerics (which is what such a format string would have
    traditionally resulted in).
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 78a8bf69b32980879975f7e31d30386c50bfe851
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 16:16:15 2008 -0700

    vsprintf: split out '%p' handling logic
    
    The actual code is the same, just split out into a helper function.
    This makes it easier to read, and allows for simple future extension
    of %p handling.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 0f9bfa569d46f2346a53a940b2b9e49a38635732
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 16:06:25 2008 -0700

    vsprintf: split out '%s' handling logic
    
    The actual code is the same, just split out into a helper function.
    This makes it easier to read, and allows for future sharing of the
    string code.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 1b40a895df6c7d5a80e71f65674060b03d84bbef
Merge: 97f8571... 35baff2...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 11:16:23 2008 -0700

    Merge branch 'kvm-updates-2.6.26' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm
    
    * 'kvm-updates-2.6.26' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm:
      KVM: IOAPIC: Fix level-triggered irq injection hang
      x86: KVM guest: Add memory clobber to hypercalls

commit 97f8571e663c808ad2d01a396627235167291556
Author: Philipp Zabel <philipp.zabel@gmail.com>
Date:   Sun Jul 6 01:15:34 2008 +0200

    pxamci: fix byte aligned DMA transfers
    
    The pxa27x DMA controller defaults to 64-bit alignment. This caused
    the SCR reads to fail (and, depending on card type, error out) when
    card->raw_scr was not aligned on a 8-byte boundary.
    
    For performance reasons all scatter-gather addresses passed to
    pxamci_request should be aligned on 8-byte boundaries, but if
    this can't be guaranteed, byte aligned DMA transfers in the
    have to be enabled in the controller to get correct behaviour.
    
    Signed-off-by: Philipp Zabel <philipp.zabel@gmail.com>
    Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 09ca8adbe9f724a7e96f512c0039c4c4a1c5dcc0
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 10:27:25 2008 -0700

    Revert "USB: don't explicitly reenable root-hub status interrupts"
    
    This reverts commit e872154921a6b5256a3c412dd69158ac0b135176.
    
    Andrey Borzenkov reports that it resulted in a totally hung machine for
    him when loading the OHCI driver.  Extensive netconsole capture with
    SysRq output shows that modprobe gets stuck in ohci_hub_status_data()
    when probing and enabling the OHCI controller, see for example
    
    	http://lkml.org/lkml/2008/7/5/236
    
    for an analysis.
    
    The problem appears to be an interrupt flood triggered by the commit
    that gets reverted, and Andrey confirmed that the revert makes things
    work for him again.
    
    Reported-and-tested-by: Andrey Borzenkov <arvidjaar@mail.ru>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Acked-by: David Brownell <david-b@pacbell.net>
    Cc: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit bdb2b8cab4392ce41ddfbd6773a3da3334daf836
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Tue Jun 24 14:03:14 2008 -0400

    [SCSI] erase invalid data returned by device
    
    This patch (as1108) fixes a problem that can occur with certain USB
    mass-storage devices: They return invalid data together with a residue
    indicating that the data should be ignored.  Rather than leave the
    invalid data in a transfer buffer, where it can get misinterpreted,
    the patch clears the invalid portion of the buffer.
    
    This solves a problem (wrong write-protect setting detected) reported
    by Maciej Rutecki and Peter Teoh.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Tested-by: Peter Teoh <htmldeveloper@gmail.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 35baff256d8fe1eec0b8988fcb5cde80df7bfa1a
Author: Mark McLoughlin <markmc@redhat.com>
Date:   Fri Jul 4 18:23:15 2008 +0100

    KVM: IOAPIC: Fix level-triggered irq injection hang
    
    The "remote_irr" variable is used to indicate an interrupt
    which has been received by the LAPIC, but not acked.
    
    In our EOI handler, we unset remote_irr and re-inject the
    interrupt if the interrupt line is still asserted.
    
    However, we do not set remote_irr here, leading to a
    situation where if kvm_ioapic_set_irq() is called, then we go
    ahead and call ioapic_service(). This means that IRR is
    re-asserted even though the interrupt is currently in service
    (i.e. LAPIC IRR is cleared and ISR/TMR set)
    
    The issue with this is that when the currently executing
    interrupt handler finishes and writes LAPIC EOI, then TMR is
    unset and EOI sent to the IOAPIC. Since IRR is now asserted,
    but TMR is not, then when the second interrupt is handled,
    no EOI is sent and if there is any pending interrupt, it is
    not re-injected.
    
    This fixes a hang only seen while running mke2fs -j on an
    8Gb virtio disk backed by a fully sparse raw file, with
    aliguori "avoid fragmented virtio-blk transfers by copying"
    changes.
    
    Signed-off-by: Mark McLoughlin <markmc@redhat.com>
    Acked-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Avi Kivity <avi@qumranet.com>

commit ca3739327b89bb4053a62ac41b67b106c1967ab0
Author: Anthony Liguori <aliguori@us.ibm.com>
Date:   Thu Jul 3 19:02:36 2008 +0300

    x86: KVM guest: Add memory clobber to hypercalls
    
    Hypercalls can modify arbitrary regions of memory.  Make sure to indicate this
    in the clobber list.  This fixes a hang when using KVM_GUEST kernel built with
    GCC 4.3.0.
    
    This was originally spotted and analyzed by Marcelo.
    
    Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
    Signed-off-by: Avi Kivity <avi@qumranet.com>

commit 7f2d38eb7a42bea1c1df51bbdaa2ca0f0bdda07f
Author: Oliver Hartkopp <oliver.hartkopp@volkswagen.de>
Date:   Sat Jul 5 23:38:43 2008 -0700

    can: add sanity checks
    
    Even though the CAN netlayer only deals with CAN netdevices, the
    netlayer interface to the userspace and to the device layer should
    perform some sanity checks.
    
    This patch adds several sanity checks that mainly prevent userspace apps
    to send broken content into the system that may be misinterpreted by
    some other userspace application.
    
    Signed-off-by: Oliver Hartkopp <oliver.hartkopp@volkswagen.de>
    Signed-off-by: Urs Thuermann <urs.thuermann@volkswagen.de>
    Acked-by: Andre Naujoks <nautsch@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit c5a78ac00c400df29645e59938700301efb371d0
Author: Laurent Pinchart <laurentp@cse-semaphore.com>
Date:   Thu Jun 26 11:48:22 2008 +0200

    fs_enet: restore promiscuous and multicast settings in restart()
    
    The restart() function is called when the link state changes and resets
    multicast and promiscuous settings. This patch restores those settings at the
    end of restart().
    
    Signed-off-by: Laurent Pinchart <laurentp@cse-semaphore.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 6c688f4294dec3f2228fd46be67604508177a1c3
Author: Sathya Narayanan <sathyan@teamf1.com>
Date:   Tue Jul 1 10:58:19 2008 +0200

    ibm_newemac: Fixes entry of short packets
    
    Short packets has to be discarded by the driver. So this patch addresses the
    issue of discarding the short packets of size lesser then ethernet header
    size.
    
    Signed-off-by: Sathya Narayanan <sathyan@teamf1.com>
    Signed-off-by: Stefan Roese <sr@denx.de>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit ab9b30cc3ec868fab8764d710193107fbeedbd0f
Author: Sathya Narayanan <sathyan@teamf1.com>
Date:   Tue Jul 1 10:58:05 2008 +0200

    ibm_newemac: Fixes kernel crashes when speed of cable connected changes
    
    The descriptor pointers were not initialized to NIL values, so it was
    poiniting to some random addresses which was completely invalid. This
    fix takes care of initializing the descriptor to NIL values and clearing
    the valid descriptors on clean ring operation.
    
    Signed-off-by: Sathya Narayanan <sathyan@teamf1.com>
    Signed-off-by: Stefan Roese <sr@denx.de>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 773212337941c5e26a05989532943877d72a2c83
Author: Roland Dreier <rdreier@cisco.com>
Date:   Tue Jul 1 10:22:45 2008 -0700

    pasemi_mac: Access iph->tot_len with correct endianness
    
    iph->tot_len is stored in network byte order, so access it using
    ntohs().  This doesn't have any real world impact on pasemi_mac, since
    the device only exists as part of a big-endian system-on-chip, but
    fixing this gets rid of a sparse warning and avoids having a bad example
    in the tree.
    
    Signed-off-by: Roland Dreier <rolandd@cisco.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 3ff2cd230de31e3b7bf2efd254e0393e5fc1d15d
Author: Roland Dreier <rdreier@cisco.com>
Date:   Tue Jul 1 10:20:33 2008 -0700

    ehea: Access iph->tot_len with correct endianness
    
    iph->tot_len is stored in network byte order, so access it using
    ntohs().  This doesn't have any real world impact on ehea, since ehea
    only exists for big-endian platfroms (at the moment at least) but fixing
    this gets rid of a sparse warning and avoids having a bad example in the
    tree.
    
    Signed-off-by: Roland Dreier <rolandd@cisco.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 2f69ae01c83a94af5dc3c20e8135b974687ed004
Author: Jan-Bernd Themann <ossthema@de.ibm.com>
Date:   Thu Jul 3 15:18:51 2008 +0100

    ehea: fix race condition
    
    When ehea_stop is called the function
    cancel_work_sync(&port->reset_task) is used to ensure
    that the reset task is not running anymore. We need an
    additional flag to ensure that it can not be scheduled
    after this call again for a certain time.
    
    Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit b0afffe89be619f42ae4215554ed66e67de7bb0e
Author: Jan-Bernd Themann <ossthema@de.ibm.com>
Date:   Thu Jul 3 15:18:48 2008 +0100

    ehea: add MODULE_DEVICE_TABLE
    
    Required to allow distros to easily detect when ehea
    module needs to be loaded
    
    Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 5c2cec143ac54c1960e54bc320fa7d13ac8e0f4a
Author: Jan-Bernd Themann <ossthema@de.ibm.com>
Date:   Thu Jul 3 15:18:45 2008 +0100

    ehea: fix might sleep problem
    
    A mutex has to be replaced by spinlocks as it can be called from
    a context which does not allow sleeping.
    The kzalloc flag GFP_KERNEL has to be replaced by GFP_ATOMIC
    for the same reason.
    
    Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 97bff0953dd45a633fa69e1a650d612f5610a60b
Author: Tobias Diedrich <ranma+kernel@tdiedrich.de>
Date:   Thu Jul 3 23:54:56 2008 -0700

    forcedeth: fix lockdep warning on ethtool -s
    
    After enabling CONFIG_LOCKDEP and CONFIG_PROVE_LOCKING I get the
    following warning when ethtool -s is first called on one of the
    forcedeth ports:
    
    =================================
    [ INFO: inconsistent lock state ]
    2.6.26-rc4 #28
    ---------------------------------
    inconsistent {in-hardirq-W} -> {hardirq-on-W} usage.
    ethtool/1985 [HC0[0]:SC0[1]:HE1:SE0] takes:
     (&np->lock){++..}, at: [<ffffffffa000c5fd>] nv_set_settings+0xc8/0x3de [forcedeth]
    {in-hardirq-W} state was registered at:
      [<ffffffffffffffff>] 0xffffffffffffffff
    irq event stamp: 3606
    hardirqs last  enabled at (3605): [<ffffffff8068106f>] _spin_unlock_irqrestore+0x3f/0x68
    hardirqs last disabled at (3604): [<ffffffff80680d38>] _spin_lock_irqsave+0x13/0x46
    softirqs last  enabled at (3534): [<ffffffff80246ba5>] __do_softirq+0xbc/0xc5
    softirqs last disabled at (3606): [<ffffffff80680b33>] _spin_lock_bh+0x11/0x41
    
    other info that might help us debug this:
    2 locks held by ethtool/1985:
     #0:  (rtnl_mutex){--..}, at: [<ffffffff80596072>] rtnl_lock+0x12/0x14
     #1:  (_xmit_ETHER){-+..}, at: [<ffffffffa000c5e8>] nv_set_settings+0xb3/0x3de [forcedeth]
    stack backtrace:
    Pid: 1985, comm: ethtool Not tainted 2.6.26-rc4 #28
    Call Trace:
     [<ffffffff8025f190>] print_usage_bug+0x162/0x173
     [<ffffffff8025fa8b>] mark_lock+0x231/0x41f
     [<ffffffff802607cf>] __lock_acquire+0x4e7/0xcac
     [<ffffffff8025fe64>] ? trace_hardirqs_on+0xf1/0x115
     [<ffffffff80272c3a>] ? disable_irq_nosync+0x6f/0x7b
     [<ffffffff80261375>] lock_acquire+0x55/0x6e
     [<ffffffffa000c5fd>] ? :forcedeth:nv_set_settings+0xc8/0x3de
     [<ffffffff80680b15>] _spin_lock+0x2f/0x3c
     [<ffffffffa000c5fd>] :forcedeth:nv_set_settings+0xc8/0x3de
     [<ffffffff8058f8bb>] dev_ethtool+0x186/0xea3
     [<ffffffff8067f446>] ? mutex_lock_nested+0x243/0x275
     [<ffffffff8025df2b>] ? debug_mutex_free_waiter+0x46/0x4a
     [<ffffffff8067f469>] ? mutex_lock_nested+0x266/0x275
     [<ffffffff8058e1ce>] dev_ioctl+0x4eb/0x600
     [<ffffffff8068106f>] ? _spin_unlock_irqrestore+0x3f/0x68
     [<ffffffff80580f91>] sock_ioctl+0x1f5/0x202
     [<ffffffff802a322e>] vfs_ioctl+0x2a/0x77
     [<ffffffff802a34d6>] do_vfs_ioctl+0x25b/0x270
     [<ffffffff806807b6>] ? trace_hardirqs_on_thunk+0x35/0x3a
     [<ffffffff802a352d>] sys_ioctl+0x42/0x65
     [<ffffffff8021fffb>] system_call_after_swapgs+0x7b/0x80
    
    This is caused by the following snippet in nv_set_settings:
    
    	netif_carrier_off(dev);
    	if (netif_running(dev)) {
    		nv_disable_irq(dev);
    		netif_tx_lock_bh(dev);
    		spin_lock(&np->lock);
    		/* stop engines */
    		nv_stop_rxtx(dev);
    		spin_unlock(&np->lock);
    		netif_tx_unlock_bh(dev);
    	}
    
    Because of nv_disable_irq this is probably not really a problem
    though (I guess) and replacing the spin_lock with spin_lock_irqsave
    could keep interrupts disabled for a longer period of time because
    of delays in nv_stop_rx and nv_stop_tx.
    
    Signed-off-by: Tobias Diedrich <ranma+kernel@tdiedrich.de>
    Cc: Ayaz Abdulla <aabdulla@nvidia.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 54364b752ef0c91fe92684df000cc4593d1e8963
Author: Krzysztof Halasa <khc@pm.waw.pl>
Date:   Sun Jun 29 21:48:11 2008 +0200

    Add missing skb->dev assignment in Frame Relay RX code
    
    Commit 4c13eb6657fe9ef7b4dc8f1a405c902e9e5234e0 ([ETH]: Make
    eth_type_trans set skb->dev like the other *_type_trans) removed
    skb->dev assignment from hdlc_fr.c:fr_rx(). Unfortunately it was also
    needed for cases other than eth_type_trans().
    
    Adding it back.
    
    It's quite serious and may be a security risk as it causes a wrong
    input interface indication (the physical hdlcX instead of logical
    pvcX). Probably -stable class fix.
    
    Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit ab1b20467cd2214ad89a95d007047cd2a6b5bf5d
Author: Patrick McHardy <kaber@trash.net>
Date:   Thu Jul 3 03:53:42 2008 -0700

    bridge: fix use-after-free in br_cleanup_bridges()
    
    Unregistering a bridge device may cause virtual devices stacked on the
    bridge, like vlan or macvlan devices, to be unregistered as well.
    br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
    devices during cleanup. This is not enough however, if one of the
    additionally unregistered devices is next in the list to the bridge
    device, it will get freed as well and the iteration continues on
    the freed element.
    
    Restart iteration after each bridge device removal from the beginning to
    fix this, similar to what rtnl_link_unregister() does.
    
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Acked-by: Stephen Hemminger <shemminger@vyatta.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 374e7b59498ce0785b3727794b351221528a5159
Author: Octavian Purdila <opurdila@ixiacom.com>
Date:   Thu Jul 3 03:31:21 2008 -0700

    tcp: fix a size_t < 0 comparison in tcp_read_sock
    
    <used> should be of type int (not size_t) since recv_actor can return
    negative values and it is also used in a < 0 comparison.
    
    Signed-off-by: Octavian Purdila <opurdila@ixiacom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 81b23b4a7acd9b37a269c62d02479d4f645dd20a
Author: Andrew Morton <akpm@linux-foundation.org>
Date:   Thu Jul 3 03:22:02 2008 -0700

    tcp: net/ipv4/tcp.c needs linux/scatterlist.h
    
    alpha:
    
    net/ipv4/tcp.c: In function 'tcp_calc_md5_hash':
    net/ipv4/tcp.c:2479: error: implicit declaration of function 'sg_init_table'    net/ipv4/tcp.c:2482: error: implicit declaration of function 'sg_set_buf'
    net/ipv4/tcp.c:2507: error: implicit declaration of function 'sg_mark_end'
    
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 2fff58fce14701e27d5e8a50fa73caef9a6907f5
Merge: c461a97... 7b58ccf...
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Jul 2 22:13:20 2008 -0700

    Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/linville/wireless-2.6

commit 7b58ccfe32f40eca8c8ca29aa723a5d0e814f0c9
Author: andrey@cozybit.com <andrey@cozybit.com>
Date:   Tue Jul 1 11:43:53 2008 -0700

    libertas: support USB persistence on suspend/resume (resend)
    
    Handle .reset_resume() so that libertas can survive suspend/resume without
    reloading the firmware.
    
    Signed-off-by: Andrey Yurovsky <andrey@cozybit.com>
    Acked-by: Deepak Saxena <dsaxena@laptop.org>
    Acked-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 6afe6828b19b4567768264831d101026cb5510ff
Author: Zhu Yi <yi.zhu@intel.com>
Date:   Tue Jul 1 09:20:34 2008 +0800

    iwlwifi: drop skb silently for Tx request in monitor mode
    
    This patch fixes the problem to keep mac80211 resubmitting SKBs
    when Tx request cannot be met in monitor mode.
    
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit ec04fd60fd74a9db9c63fe11d519be3642cabfdd
Author: Rick Farrington <rickdic@hotmail.com>
Date:   Tue Jul 1 09:20:33 2008 +0800

    iwlwifi: fix incorrect 5GHz rates reported in monitor mode
    
    This patch fixes the rates reported in monitor mode operation
    (Wireshark) for iwlwifi.
    
    Previously, packets with rates of 6M..24M would be reported
    incorrectly and packets with rates of 36M..54M would not passed
    up the stack.
    
    Signed-off-by: Rick Farrington <rickdic@hotmail.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>