commit 9c0fc4e28b57c5a6da7b58d60f71476c64d457a6
Merge: 86df864... 138c902...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Jul 8 09:29:34 2008 -0700

    Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6
    
    * 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
      [S390] protect _PAGE_SPECIAL bit against mprotect

commit 86df86424939d316b1f6cfac1b6204f0c7dee317
Author: David Gibson <david@gibson.dropbear.id.au>
Date:   Tue Jul 8 15:58:16 2008 +1000

    Correct hash flushing from huge_ptep_set_wrprotect()
    
    As Andy Whitcroft recently pointed out, the current powerpc version of
    huge_ptep_set_wrprotect() has a bug.  It just calls ptep_set_wrprotect()
    which in turn calls pte_update() then hpte_need_flush() with the 'huge'
    argument set to 0.  This will cause hpte_need_flush() to flush the wrong
    hash entries (of any).  Andy's fix for this is already in the powerpc
    tree as commit 016b33c4958681c24056abed8ec95844a0da80a3.
    
    I have confirmed this is a real bug, not masked by some other
    synchronization, with a new testcase for libhugetlbfs.  A process write
    a (MAP_PRIVATE) hugepage mapping, fork(), then alter the mapping and
    have the child incorrectly see the second write.
    
    Therefore, this should be fixed for 2.6.26, and for the stable tree.
    Here is a suitable patch for 2.6.26, which I think will also be suitable
    for the stable tree (neither of the headers in question has been changed
    much recently).
    
    It is cut down slighlty from Andy's original version, in that it does
    not include a 32-bit version of huge_ptep_set_wrprotect().  Currently,
    hugepages are not supported on any 32-bit powerpc platform.  When they
    are, a suitable 32-bit version can be added - the only 32-bit hardware
    which supports hugepages does not use the conventional hashtable MMU and
    so will have different needs anyway.
    
    Signed-off-by: Andy Whitcroft <apw@shadowen.org>
    Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 138c9021ca68d6f8a6fac3418995fee102a3cc22
Author: Nick Piggin <npiggin@suse.de>
Date:   Tue Jul 8 11:31:06 2008 +0200

    [S390] protect _PAGE_SPECIAL bit against mprotect
    
    Stop mprotect's pte_modify from wiping out the s390 pte_special bit, which
    caused oops thereafter when vm_normal_page thought X's abnormal was normal.
    
    Debugged-by: Ryan Hope <rmh3093@gmail.com>
    Debugged-by: Zan Lynx <zlynx@acm.org>
    Acked-by: Hugh Dickins <hugh@veritas.com>
    Signed-off-by: Nick Piggin <npiggin@suse.de>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

commit 7b51ba38d9baca207152d1c97ec793cfb673a6cd
Merge: 4f81c53... 739db07...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Jul 7 16:59:43 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
      Revert "PCI: Correct last two HP entries in the bfsort whitelist"

commit 739db07f82767e7634176d18af2acbe77b11fd42
Author: Jesse Barnes <jbarnes@hobbes.(none)>
Date:   Mon Jul 7 09:55:26 2008 -0700

    Revert "PCI: Correct last two HP entries in the bfsort whitelist"
    
    This reverts commit a1676072558854b95336c8f7db76b0504e909a0a.  It duplicates
    the change from 8d64c781f0c5fbfdf8016bd1634506ff2ad1376a and only one should be
    applied, otherwise some of the Dell quirks are lost.
    
    Thanks to Tony Camuso for catching this.
    
    Acked-by: Tony Camuso <tcamuso@redhat.com>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>

commit 4f81c5350b44bcc501ab6f8a089b16d064b4d2f6
Author: Jeff Dike <jdike@addtoit.com>
Date:   Mon Jul 7 13:36:56 2008 -0400

    [UML] fix gcc ICEs and unresolved externs
    
    There are various constraints on the use of unit-at-a-time:
     - i386 uses no-unit-at-a-time for pre-4.0 (not 4.3)
     - x86_64 uses unit-at-a-time always
    
    Uli reported a crash on x86_64 with gcc 4.1.2 with unit-at-a-time,
    resulting in commit c0a18111e571138747a98af18b3a2124df56a0d1
    
    Ingo reported a gcc internal error with gcc 4.3 with no-unit-at-a-timem,
    resulting in 22eecde2f9034764a3fd095eecfa3adfb8ec9a98
    
    Benny Halevy is seeing extern inlines not resolved with gcc 4.3 with
    no-unit-at-a-time
    
    This patch reintroduces unit-at-a-time for gcc >= 4.0, bringing back the
    possibility of Uli's crash.  If that happens, we'll debug it.
    
    I started seeing both the internal compiler errors and unresolved
    inlines on Fedora 9.  This patch fixes both problems, without so far
    reintroducing the crash reported by Uli.
    
    Signed-off-by: Jeff Dike <jdike@linux.intel.com>
    Cc: Benny Halevy <bhalevy@panasas.com>
    Cc: Adrian Bunk <bunk@kernel.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Ulrich Drepper <drepper@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit b2798bf0ec2cb5a17bfc1430c5ba6d971c436a03
Merge: 3bc5ab9... 7f2d38e...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Jul 7 09:24:28 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      can: add sanity checks
      fs_enet: restore promiscuous and multicast settings in restart()
      ibm_newemac: Fixes entry of short packets
      ibm_newemac: Fixes kernel crashes when speed of cable connected changes
      pasemi_mac: Access iph->tot_len with correct endianness
      ehea: Access iph->tot_len with correct endianness
      ehea: fix race condition
      ehea: add MODULE_DEVICE_TABLE
      ehea: fix might sleep problem
      forcedeth: fix lockdep warning on ethtool -s
      Add missing skb->dev assignment in Frame Relay RX code
      bridge: fix use-after-free in br_cleanup_bridges()
      tcp: fix a size_t < 0 comparison in tcp_read_sock
      tcp: net/ipv4/tcp.c needs linux/scatterlist.h
      libertas: support USB persistence on suspend/resume (resend)
      iwlwifi: drop skb silently for Tx request in monitor mode
      iwlwifi: fix incorrect 5GHz rates reported in monitor mode

commit 3bc5ab9b7f2760d2892fd0a0589e1077e869d4f5
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date:   Mon Jul 7 16:39:50 2008 +1000

    powerpc: Fix unterminated of_device_id array in legacy_serial.c
    
    A recent patch to legacy_serial.c factored out some code by
    using the of_match_node() facility to match a node against
    an array of possible matches. However, the patch didn't properly
    terminate the array causing potential crashes in cases where no
    match is found. In addition, the name of the array was poorly
    chosen for a static symbol making debugging harder.
    
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 0fe1ef24f7bd0020f29ffe287dfdb9ead33ca0b2
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 16:43:12 2008 -0700

    vsprintf: add support for '%pS' and '%pF' pointer formats
    
    They print out a pointer in symbolic format, if possible (ie using
    symbolic KALLSYMS information).  The '%pS' format is for regular direct
    pointers (which can point to data or code and that you find on the stack
    during backtraces etc), while '%pF' is for C function pointer types.
    
    On most architectures, the two mean exactly the same thing, but some
    architectures use an indirect pointer for C function pointers, where the
    function pointer points to a function descriptor (which in turn contains
    the actual pointer to the code).  The '%pF' code automatically does the
    appropriate function descriptor dereference on such architectures.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 4d8a743cdd2690c0bc8d1b8cbd02cffb1ead849f
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 16:24:57 2008 -0700

    vsprintf: add infrastructure support for extended '%p' specifiers
    
    This expands the kernel '%p' handling with an arbitrary alphanumberic
    specifier extension string immediately following the '%p'.  Right now
    it's just being ignored, but the next commit will start adding some
    specific pointer type extensions.
    
    NOTE! The reason the extension is appended to the '%p' is to allow
    minimal gcc type checking: gcc will still see the '%p' and will check
    that the argument passed in is indeed a pointer, and yet will not
    complain about the extended information that gcc doesn't understand
    about (on the other hand, it also won't actually check that the pointer
    type and the extension are compatible).
    
    Alphanumeric characters were chosen because there is no sane existing
    use for a string format with a hex pointer representation immediately
    followed by alphanumerics (which is what such a format string would have
    traditionally resulted in).
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 78a8bf69b32980879975f7e31d30386c50bfe851
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 16:16:15 2008 -0700

    vsprintf: split out '%p' handling logic
    
    The actual code is the same, just split out into a helper function.
    This makes it easier to read, and allows for simple future extension
    of %p handling.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 0f9bfa569d46f2346a53a940b2b9e49a38635732
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 16:06:25 2008 -0700

    vsprintf: split out '%s' handling logic
    
    The actual code is the same, just split out into a helper function.
    This makes it easier to read, and allows for future sharing of the
    string code.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 1b40a895df6c7d5a80e71f65674060b03d84bbef
Merge: 97f8571... 35baff2...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 11:16:23 2008 -0700

    Merge branch 'kvm-updates-2.6.26' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm
    
    * 'kvm-updates-2.6.26' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm:
      KVM: IOAPIC: Fix level-triggered irq injection hang
      x86: KVM guest: Add memory clobber to hypercalls

commit 97f8571e663c808ad2d01a396627235167291556
Author: Philipp Zabel <philipp.zabel@gmail.com>
Date:   Sun Jul 6 01:15:34 2008 +0200

    pxamci: fix byte aligned DMA transfers
    
    The pxa27x DMA controller defaults to 64-bit alignment. This caused
    the SCR reads to fail (and, depending on card type, error out) when
    card->raw_scr was not aligned on a 8-byte boundary.
    
    For performance reasons all scatter-gather addresses passed to
    pxamci_request should be aligned on 8-byte boundaries, but if
    this can't be guaranteed, byte aligned DMA transfers in the
    have to be enabled in the controller to get correct behaviour.
    
    Signed-off-by: Philipp Zabel <philipp.zabel@gmail.com>
    Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 09ca8adbe9f724a7e96f512c0039c4c4a1c5dcc0
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 6 10:27:25 2008 -0700

    Revert "USB: don't explicitly reenable root-hub status interrupts"
    
    This reverts commit e872154921a6b5256a3c412dd69158ac0b135176.
    
    Andrey Borzenkov reports that it resulted in a totally hung machine for
    him when loading the OHCI driver.  Extensive netconsole capture with
    SysRq output shows that modprobe gets stuck in ohci_hub_status_data()
    when probing and enabling the OHCI controller, see for example
    
    	http://lkml.org/lkml/2008/7/5/236
    
    for an analysis.
    
    The problem appears to be an interrupt flood triggered by the commit
    that gets reverted, and Andrey confirmed that the revert makes things
    work for him again.
    
    Reported-and-tested-by: Andrey Borzenkov <arvidjaar@mail.ru>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Acked-by: David Brownell <david-b@pacbell.net>
    Cc: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 35baff256d8fe1eec0b8988fcb5cde80df7bfa1a
Author: Mark McLoughlin <markmc@redhat.com>
Date:   Fri Jul 4 18:23:15 2008 +0100

    KVM: IOAPIC: Fix level-triggered irq injection hang
    
    The "remote_irr" variable is used to indicate an interrupt
    which has been received by the LAPIC, but not acked.
    
    In our EOI handler, we unset remote_irr and re-inject the
    interrupt if the interrupt line is still asserted.
    
    However, we do not set remote_irr here, leading to a
    situation where if kvm_ioapic_set_irq() is called, then we go
    ahead and call ioapic_service(). This means that IRR is
    re-asserted even though the interrupt is currently in service
    (i.e. LAPIC IRR is cleared and ISR/TMR set)
    
    The issue with this is that when the currently executing
    interrupt handler finishes and writes LAPIC EOI, then TMR is
    unset and EOI sent to the IOAPIC. Since IRR is now asserted,
    but TMR is not, then when the second interrupt is handled,
    no EOI is sent and if there is any pending interrupt, it is
    not re-injected.
    
    This fixes a hang only seen while running mke2fs -j on an
    8Gb virtio disk backed by a fully sparse raw file, with
    aliguori "avoid fragmented virtio-blk transfers by copying"
    changes.
    
    Signed-off-by: Mark McLoughlin <markmc@redhat.com>
    Acked-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Avi Kivity <avi@qumranet.com>

commit ca3739327b89bb4053a62ac41b67b106c1967ab0
Author: Anthony Liguori <aliguori@us.ibm.com>
Date:   Thu Jul 3 19:02:36 2008 +0300

    x86: KVM guest: Add memory clobber to hypercalls
    
    Hypercalls can modify arbitrary regions of memory.  Make sure to indicate this
    in the clobber list.  This fixes a hang when using KVM_GUEST kernel built with
    GCC 4.3.0.
    
    This was originally spotted and analyzed by Marcelo.
    
    Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
    Signed-off-by: Avi Kivity <avi@qumranet.com>

commit 7f2d38eb7a42bea1c1df51bbdaa2ca0f0bdda07f
Author: Oliver Hartkopp <oliver.hartkopp@volkswagen.de>
Date:   Sat Jul 5 23:38:43 2008 -0700

    can: add sanity checks
    
    Even though the CAN netlayer only deals with CAN netdevices, the
    netlayer interface to the userspace and to the device layer should
    perform some sanity checks.
    
    This patch adds several sanity checks that mainly prevent userspace apps
    to send broken content into the system that may be misinterpreted by
    some other userspace application.
    
    Signed-off-by: Oliver Hartkopp <oliver.hartkopp@volkswagen.de>
    Signed-off-by: Urs Thuermann <urs.thuermann@volkswagen.de>
    Acked-by: Andre Naujoks <nautsch@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit c5a78ac00c400df29645e59938700301efb371d0
Author: Laurent Pinchart <laurentp@cse-semaphore.com>
Date:   Thu Jun 26 11:48:22 2008 +0200

    fs_enet: restore promiscuous and multicast settings in restart()
    
    The restart() function is called when the link state changes and resets
    multicast and promiscuous settings. This patch restores those settings at the
    end of restart().
    
    Signed-off-by: Laurent Pinchart <laurentp@cse-semaphore.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 6c688f4294dec3f2228fd46be67604508177a1c3
Author: Sathya Narayanan <sathyan@teamf1.com>
Date:   Tue Jul 1 10:58:19 2008 +0200

    ibm_newemac: Fixes entry of short packets
    
    Short packets has to be discarded by the driver. So this patch addresses the
    issue of discarding the short packets of size lesser then ethernet header
    size.
    
    Signed-off-by: Sathya Narayanan <sathyan@teamf1.com>
    Signed-off-by: Stefan Roese <sr@denx.de>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit ab9b30cc3ec868fab8764d710193107fbeedbd0f
Author: Sathya Narayanan <sathyan@teamf1.com>
Date:   Tue Jul 1 10:58:05 2008 +0200

    ibm_newemac: Fixes kernel crashes when speed of cable connected changes
    
    The descriptor pointers were not initialized to NIL values, so it was
    poiniting to some random addresses which was completely invalid. This
    fix takes care of initializing the descriptor to NIL values and clearing
    the valid descriptors on clean ring operation.
    
    Signed-off-by: Sathya Narayanan <sathyan@teamf1.com>
    Signed-off-by: Stefan Roese <sr@denx.de>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 773212337941c5e26a05989532943877d72a2c83
Author: Roland Dreier <rdreier@cisco.com>
Date:   Tue Jul 1 10:22:45 2008 -0700

    pasemi_mac: Access iph->tot_len with correct endianness
    
    iph->tot_len is stored in network byte order, so access it using
    ntohs().  This doesn't have any real world impact on pasemi_mac, since
    the device only exists as part of a big-endian system-on-chip, but
    fixing this gets rid of a sparse warning and avoids having a bad example
    in the tree.
    
    Signed-off-by: Roland Dreier <rolandd@cisco.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 3ff2cd230de31e3b7bf2efd254e0393e5fc1d15d
Author: Roland Dreier <rdreier@cisco.com>
Date:   Tue Jul 1 10:20:33 2008 -0700

    ehea: Access iph->tot_len with correct endianness
    
    iph->tot_len is stored in network byte order, so access it using
    ntohs().  This doesn't have any real world impact on ehea, since ehea
    only exists for big-endian platfroms (at the moment at least) but fixing
    this gets rid of a sparse warning and avoids having a bad example in the
    tree.
    
    Signed-off-by: Roland Dreier <rolandd@cisco.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 2f69ae01c83a94af5dc3c20e8135b974687ed004
Author: Jan-Bernd Themann <ossthema@de.ibm.com>
Date:   Thu Jul 3 15:18:51 2008 +0100

    ehea: fix race condition
    
    When ehea_stop is called the function
    cancel_work_sync(&port->reset_task) is used to ensure
    that the reset task is not running anymore. We need an
    additional flag to ensure that it can not be scheduled
    after this call again for a certain time.
    
    Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit b0afffe89be619f42ae4215554ed66e67de7bb0e
Author: Jan-Bernd Themann <ossthema@de.ibm.com>
Date:   Thu Jul 3 15:18:48 2008 +0100

    ehea: add MODULE_DEVICE_TABLE
    
    Required to allow distros to easily detect when ehea
    module needs to be loaded
    
    Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 5c2cec143ac54c1960e54bc320fa7d13ac8e0f4a
Author: Jan-Bernd Themann <ossthema@de.ibm.com>
Date:   Thu Jul 3 15:18:45 2008 +0100

    ehea: fix might sleep problem
    
    A mutex has to be replaced by spinlocks as it can be called from
    a context which does not allow sleeping.
    The kzalloc flag GFP_KERNEL has to be replaced by GFP_ATOMIC
    for the same reason.
    
    Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 97bff0953dd45a633fa69e1a650d612f5610a60b
Author: Tobias Diedrich <ranma+kernel@tdiedrich.de>
Date:   Thu Jul 3 23:54:56 2008 -0700

    forcedeth: fix lockdep warning on ethtool -s
    
    After enabling CONFIG_LOCKDEP and CONFIG_PROVE_LOCKING I get the
    following warning when ethtool -s is first called on one of the
    forcedeth ports:
    
    =================================
    [ INFO: inconsistent lock state ]
    2.6.26-rc4 #28
    ---------------------------------
    inconsistent {in-hardirq-W} -> {hardirq-on-W} usage.
    ethtool/1985 [HC0[0]:SC0[1]:HE1:SE0] takes:
     (&np->lock){++..}, at: [<ffffffffa000c5fd>] nv_set_settings+0xc8/0x3de [forcedeth]
    {in-hardirq-W} state was registered at:
      [<ffffffffffffffff>] 0xffffffffffffffff
    irq event stamp: 3606
    hardirqs last  enabled at (3605): [<ffffffff8068106f>] _spin_unlock_irqrestore+0x3f/0x68
    hardirqs last disabled at (3604): [<ffffffff80680d38>] _spin_lock_irqsave+0x13/0x46
    softirqs last  enabled at (3534): [<ffffffff80246ba5>] __do_softirq+0xbc/0xc5
    softirqs last disabled at (3606): [<ffffffff80680b33>] _spin_lock_bh+0x11/0x41
    
    other info that might help us debug this:
    2 locks held by ethtool/1985:
     #0:  (rtnl_mutex){--..}, at: [<ffffffff80596072>] rtnl_lock+0x12/0x14
     #1:  (_xmit_ETHER){-+..}, at: [<ffffffffa000c5e8>] nv_set_settings+0xb3/0x3de [forcedeth]
    stack backtrace:
    Pid: 1985, comm: ethtool Not tainted 2.6.26-rc4 #28
    Call Trace:
     [<ffffffff8025f190>] print_usage_bug+0x162/0x173
     [<ffffffff8025fa8b>] mark_lock+0x231/0x41f
     [<ffffffff802607cf>] __lock_acquire+0x4e7/0xcac
     [<ffffffff8025fe64>] ? trace_hardirqs_on+0xf1/0x115
     [<ffffffff80272c3a>] ? disable_irq_nosync+0x6f/0x7b
     [<ffffffff80261375>] lock_acquire+0x55/0x6e
     [<ffffffffa000c5fd>] ? :forcedeth:nv_set_settings+0xc8/0x3de
     [<ffffffff80680b15>] _spin_lock+0x2f/0x3c
     [<ffffffffa000c5fd>] :forcedeth:nv_set_settings+0xc8/0x3de
     [<ffffffff8058f8bb>] dev_ethtool+0x186/0xea3
     [<ffffffff8067f446>] ? mutex_lock_nested+0x243/0x275
     [<ffffffff8025df2b>] ? debug_mutex_free_waiter+0x46/0x4a
     [<ffffffff8067f469>] ? mutex_lock_nested+0x266/0x275
     [<ffffffff8058e1ce>] dev_ioctl+0x4eb/0x600
     [<ffffffff8068106f>] ? _spin_unlock_irqrestore+0x3f/0x68
     [<ffffffff80580f91>] sock_ioctl+0x1f5/0x202
     [<ffffffff802a322e>] vfs_ioctl+0x2a/0x77
     [<ffffffff802a34d6>] do_vfs_ioctl+0x25b/0x270
     [<ffffffff806807b6>] ? trace_hardirqs_on_thunk+0x35/0x3a
     [<ffffffff802a352d>] sys_ioctl+0x42/0x65
     [<ffffffff8021fffb>] system_call_after_swapgs+0x7b/0x80
    
    This is caused by the following snippet in nv_set_settings:
    
    	netif_carrier_off(dev);
    	if (netif_running(dev)) {
    		nv_disable_irq(dev);
    		netif_tx_lock_bh(dev);
    		spin_lock(&np->lock);
    		/* stop engines */
    		nv_stop_rxtx(dev);
    		spin_unlock(&np->lock);
    		netif_tx_unlock_bh(dev);
    	}
    
    Because of nv_disable_irq this is probably not really a problem
    though (I guess) and replacing the spin_lock with spin_lock_irqsave
    could keep interrupts disabled for a longer period of time because
    of delays in nv_stop_rx and nv_stop_tx.
    
    Signed-off-by: Tobias Diedrich <ranma+kernel@tdiedrich.de>
    Cc: Ayaz Abdulla <aabdulla@nvidia.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 54364b752ef0c91fe92684df000cc4593d1e8963
Author: Krzysztof Halasa <khc@pm.waw.pl>
Date:   Sun Jun 29 21:48:11 2008 +0200

    Add missing skb->dev assignment in Frame Relay RX code
    
    Commit 4c13eb6657fe9ef7b4dc8f1a405c902e9e5234e0 ([ETH]: Make
    eth_type_trans set skb->dev like the other *_type_trans) removed
    skb->dev assignment from hdlc_fr.c:fr_rx(). Unfortunately it was also
    needed for cases other than eth_type_trans().
    
    Adding it back.
    
    It's quite serious and may be a security risk as it causes a wrong
    input interface indication (the physical hdlcX instead of logical
    pvcX). Probably -stable class fix.
    
    Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit ab1b20467cd2214ad89a95d007047cd2a6b5bf5d
Author: Patrick McHardy <kaber@trash.net>
Date:   Thu Jul 3 03:53:42 2008 -0700

    bridge: fix use-after-free in br_cleanup_bridges()
    
    Unregistering a bridge device may cause virtual devices stacked on the
    bridge, like vlan or macvlan devices, to be unregistered as well.
    br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
    devices during cleanup. This is not enough however, if one of the
    additionally unregistered devices is next in the list to the bridge
    device, it will get freed as well and the iteration continues on
    the freed element.
    
    Restart iteration after each bridge device removal from the beginning to
    fix this, similar to what rtnl_link_unregister() does.
    
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Acked-by: Stephen Hemminger <shemminger@vyatta.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 374e7b59498ce0785b3727794b351221528a5159
Author: Octavian Purdila <opurdila@ixiacom.com>
Date:   Thu Jul 3 03:31:21 2008 -0700

    tcp: fix a size_t < 0 comparison in tcp_read_sock
    
    <used> should be of type int (not size_t) since recv_actor can return
    negative values and it is also used in a < 0 comparison.
    
    Signed-off-by: Octavian Purdila <opurdila@ixiacom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 81b23b4a7acd9b37a269c62d02479d4f645dd20a
Author: Andrew Morton <akpm@linux-foundation.org>
Date:   Thu Jul 3 03:22:02 2008 -0700

    tcp: net/ipv4/tcp.c needs linux/scatterlist.h
    
    alpha:
    
    net/ipv4/tcp.c: In function 'tcp_calc_md5_hash':
    net/ipv4/tcp.c:2479: error: implicit declaration of function 'sg_init_table'    net/ipv4/tcp.c:2482: error: implicit declaration of function 'sg_set_buf'
    net/ipv4/tcp.c:2507: error: implicit declaration of function 'sg_mark_end'
    
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 2fff58fce14701e27d5e8a50fa73caef9a6907f5
Merge: c461a97... 7b58ccf...
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Jul 2 22:13:20 2008 -0700

    Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/linville/wireless-2.6

commit 7b58ccfe32f40eca8c8ca29aa723a5d0e814f0c9
Author: andrey@cozybit.com <andrey@cozybit.com>
Date:   Tue Jul 1 11:43:53 2008 -0700

    libertas: support USB persistence on suspend/resume (resend)
    
    Handle .reset_resume() so that libertas can survive suspend/resume without
    reloading the firmware.
    
    Signed-off-by: Andrey Yurovsky <andrey@cozybit.com>
    Acked-by: Deepak Saxena <dsaxena@laptop.org>
    Acked-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 6afe6828b19b4567768264831d101026cb5510ff
Author: Zhu Yi <yi.zhu@intel.com>
Date:   Tue Jul 1 09:20:34 2008 +0800

    iwlwifi: drop skb silently for Tx request in monitor mode
    
    This patch fixes the problem to keep mac80211 resubmitting SKBs
    when Tx request cannot be met in monitor mode.
    
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit ec04fd60fd74a9db9c63fe11d519be3642cabfdd
Author: Rick Farrington <rickdic@hotmail.com>
Date:   Tue Jul 1 09:20:33 2008 +0800

    iwlwifi: fix incorrect 5GHz rates reported in monitor mode
    
    This patch fixes the rates reported in monitor mode operation
    (Wireshark) for iwlwifi.
    
    Previously, packets with rates of 6M..24M would be reported
    incorrectly and packets with rates of 36M..54M would not passed
    up the stack.
    
    Signed-off-by: Rick Farrington <rickdic@hotmail.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>