--- /dev/null
+From 824818b148db42173446707df4cbd61cd7133272 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Thu, 4 Aug 2011 16:17:42 +0200
+Subject: ALSA: snd-usb: Accept UAC2 FORMAT_TYPE descriptors with
+ bLength > 6
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 824818b148db42173446707df4cbd61cd7133272 upstream.
+
+The Focusrite Scarlett 18i6 USB has them that way, which is probably a
+bug. Anyway, the driver should simply ignore this fact.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-by: Nicolai Krakowiak <nicolai.krakowiak@gmail.com>
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/endpoint.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -352,7 +352,7 @@ int snd_usb_parse_audio_endpoints(struct
+ continue;
+ }
+ if (((protocol == UAC_VERSION_1) && (fmt->bLength < 8)) ||
+- ((protocol == UAC_VERSION_2) && (fmt->bLength != 6))) {
++ ((protocol == UAC_VERSION_2) && (fmt->bLength < 6))) {
+ snd_printk(KERN_ERR "%d:%u:%d : invalid UAC_FORMAT_TYPE desc\n",
+ dev->devnum, iface_no, altno);
+ continue;
--- /dev/null
+From 60c961a9e1ed879a4d151df6076bf1203f595f73 Mon Sep 17 00:00:00 2001
+From: Nicolai Krakowiak <nicolai.krakowiak@gmail.com>
+Date: Thu, 4 Aug 2011 15:56:27 +0200
+Subject: ALSA: snd-usb: avoid dividing by zero on invalid input
+
+From: Nicolai Krakowiak <nicolai.krakowiak@gmail.com>
+
+commit 60c961a9e1ed879a4d151df6076bf1203f595f73 upstream.
+
+Signed-off-by: Nicolai Krakowiak <nicolai.krakowiak@gmail.com>
+Acked-by: Daniel Mack <zonque@gmail.com>
+Acked-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/mixer.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1191,6 +1191,11 @@ static int parse_audio_feature_unit(stru
+
+ if (state->mixer->protocol == UAC_VERSION_1) {
+ csize = hdr->bControlSize;
++ if (!csize) {
++ snd_printdd(KERN_ERR "usbaudio: unit %u: "
++ "invalid bControlSize == 0\n", unitid);
++ return -EINVAL;
++ }
+ channels = (hdr->bLength - 7) / csize - 1;
+ bmaControls = hdr->bmaControls;
+ } else {
--- /dev/null
+From f4389489b5cbe60b3441869c68bb4afe760969c4 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Sat, 6 Aug 2011 09:13:08 +0200
+Subject: ALSA: snd-usb-caiaq: Fix keymap for RigKontrol3
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit f4389489b5cbe60b3441869c68bb4afe760969c4 upstream.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-by: Renato <naretobh@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/caiaq/input.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/caiaq/input.c
++++ b/sound/usb/caiaq/input.c
+@@ -30,7 +30,7 @@ static unsigned short keycode_ak1[] = {
+ static unsigned short keycode_rk2[] = { KEY_1, KEY_2, KEY_3, KEY_4,
+ KEY_5, KEY_6, KEY_7 };
+ static unsigned short keycode_rk3[] = { KEY_1, KEY_2, KEY_3, KEY_4,
+- KEY_5, KEY_6, KEY_7, KEY_5, KEY_6 };
++ KEY_5, KEY_6, KEY_7, KEY_8, KEY_9 };
+
+ static unsigned short keycode_kore[] = {
+ KEY_FN_F1, /* "menu" */
--- /dev/null
+From 1faa5d07a93fc5b0a4a5254fc940a79e20b55540 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Thu, 4 Aug 2011 15:56:28 +0200
+Subject: ALSA: snd-usb: operate on given mixer interface only
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit 1faa5d07a93fc5b0a4a5254fc940a79e20b55540 upstream.
+
+When creating the mixers for an USB audio device, the current code looks
+at the host interface stored in mixer->chip->ctrl_if. Change this and
+rather keep a local pointer to the interface that was given when
+snd_usb_create_mixer() was called.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-by: Nicolai Krakowiak <nicolai.krakowiak@gmail.com>
+Reported-by: Lean-Yves LENHOF <jean-yves@lenhof.eu.org>
+Acked-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/mixer.c | 20 ++++++++------------
+ sound/usb/mixer.h | 1 +
+ 2 files changed, 9 insertions(+), 12 deletions(-)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1939,15 +1939,13 @@ static int snd_usb_mixer_controls(struct
+ struct mixer_build state;
+ int err;
+ const struct usbmix_ctl_map *map;
+- struct usb_host_interface *hostif;
+ void *p;
+
+- hostif = mixer->chip->ctrl_intf;
+ memset(&state, 0, sizeof(state));
+ state.chip = mixer->chip;
+ state.mixer = mixer;
+- state.buffer = hostif->extra;
+- state.buflen = hostif->extralen;
++ state.buffer = mixer->hostif->extra;
++ state.buflen = mixer->hostif->extralen;
+
+ /* check the mapping table */
+ for (map = usbmix_ctl_maps; map->id; map++) {
+@@ -1960,7 +1958,8 @@ static int snd_usb_mixer_controls(struct
+ }
+
+ p = NULL;
+- while ((p = snd_usb_find_csint_desc(hostif->extra, hostif->extralen, p, UAC_OUTPUT_TERMINAL)) != NULL) {
++ while ((p = snd_usb_find_csint_desc(mixer->hostif->extra, mixer->hostif->extralen,
++ p, UAC_OUTPUT_TERMINAL)) != NULL) {
+ if (mixer->protocol == UAC_VERSION_1) {
+ struct uac1_output_terminal_descriptor *desc = p;
+
+@@ -2167,17 +2166,15 @@ int snd_usb_mixer_activate(struct usb_mi
+ /* create the handler for the optional status interrupt endpoint */
+ static int snd_usb_mixer_status_create(struct usb_mixer_interface *mixer)
+ {
+- struct usb_host_interface *hostif;
+ struct usb_endpoint_descriptor *ep;
+ void *transfer_buffer;
+ int buffer_length;
+ unsigned int epnum;
+
+- hostif = mixer->chip->ctrl_intf;
+ /* we need one interrupt input endpoint */
+- if (get_iface_desc(hostif)->bNumEndpoints < 1)
++ if (get_iface_desc(mixer->hostif)->bNumEndpoints < 1)
+ return 0;
+- ep = get_endpoint(hostif, 0);
++ ep = get_endpoint(mixer->hostif, 0);
+ if (!usb_endpoint_dir_in(ep) || !usb_endpoint_xfer_int(ep))
+ return 0;
+
+@@ -2207,7 +2204,6 @@ int snd_usb_create_mixer(struct snd_usb_
+ };
+ struct usb_mixer_interface *mixer;
+ struct snd_info_entry *entry;
+- struct usb_host_interface *host_iface;
+ int err;
+
+ strcpy(chip->card->mixername, "USB Mixer");
+@@ -2224,8 +2220,8 @@ int snd_usb_create_mixer(struct snd_usb_
+ return -ENOMEM;
+ }
+
+- host_iface = &usb_ifnum_to_if(chip->dev, ctrlif)->altsetting[0];
+- switch (get_iface_desc(host_iface)->bInterfaceProtocol) {
++ mixer->hostif = &usb_ifnum_to_if(chip->dev, ctrlif)->altsetting[0];
++ switch (get_iface_desc(mixer->hostif)->bInterfaceProtocol) {
+ case UAC_VERSION_1:
+ default:
+ mixer->protocol = UAC_VERSION_1;
+--- a/sound/usb/mixer.h
++++ b/sound/usb/mixer.h
+@@ -3,6 +3,7 @@
+
+ struct usb_mixer_interface {
+ struct snd_usb_audio *chip;
++ struct usb_host_interface *hostif;
+ struct list_head list;
+ unsigned int ignore_ctl_error;
+ struct urb *urb;
--- /dev/null
+From 0584ffa548b6e59aceb027112f23a55f0133400e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 8 Aug 2011 12:24:46 +0200
+Subject: ALSA: timer - Fix Oops at closing slave timer
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0584ffa548b6e59aceb027112f23a55f0133400e upstream.
+
+A slave-timer instance has no timer reference, and this results in
+NULL-dereference at stopping the timer, typically called at closing
+the device.
+
+Reference: https://bugzilla.kernel.org/show_bug.cgi?id=40682
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/timer.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -531,6 +531,8 @@ int snd_timer_stop(struct snd_timer_inst
+ if (err < 0)
+ return err;
+ timer = timeri->timer;
++ if (!timer)
++ return -EINVAL;
+ spin_lock_irqsave(&timer->lock, flags);
+ timeri->cticks = timeri->ticks;
+ timeri->pticks = 0;
--- /dev/null
+From 151798f872d6b386d82cd1707ad703e981fef8f2 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <w.sang@pengutronix.de>
+Date: Tue, 2 Aug 2011 19:42:19 +0200
+Subject: ASoC: sgtl5000: fix cache handling
+
+From: Wolfram Sang <w.sang@pengutronix.de>
+
+commit 151798f872d6b386d82cd1707ad703e981fef8f2 upstream.
+
+Cache handling in this driver is broken. The chip has 16-bit registers, yet the
+register numbers also increase by 2 per register, i.e. there are only
+even-numbered registers. The cache in this driver, though, simply increments
+register numbers, so it does need some mapping as seen in
+sgtl5000_restore_regs(), note the '>> 1':
+
+ snd_soc_write(codec, SGTL5000_CHIP_LINREG_CTRL,
+ cache[SGTL5000_CHIP_LINREG_CTRL >> 1]);
+
+That, of course, won't work with snd_soc_update_bits(). (Thus, we won't even
+notice the missing register 0x1c in the default regs which shifted all follwing
+registers to wrong values.) Noticed on the MX28EVK where enabling the regulators
+simply locked up the chip.
+
+Refactor the routines and use a properly sized default_regs array which matches
+the register layout of the underlying chip, i.e. create a truly flat cache.
+This also saves some code which should make up for the bigger array a little.
+When soc-core will somewhen have another cache type which handles a step size,
+this conversion will also ease the transition.
+
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Tested-by: Dong Aisheng <b29396@freescale.com>
+Tested-by: Shawn Guo <shawn.guo@linaro.org>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/sgtl5000.c | 128 ++++++++++++--------------------------------
+ 1 file changed, 35 insertions(+), 93 deletions(-)
+
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -33,73 +33,31 @@
+ #define SGTL5000_DAP_REG_OFFSET 0x0100
+ #define SGTL5000_MAX_REG_OFFSET 0x013A
+
+-/* default value of sgtl5000 registers except DAP */
+-static const u16 sgtl5000_regs[SGTL5000_MAX_REG_OFFSET >> 1] = {
+- 0xa011, /* 0x0000, CHIP_ID. 11 stand for revison 17 */
+- 0x0000, /* 0x0002, CHIP_DIG_POWER. */
+- 0x0008, /* 0x0004, CHIP_CKL_CTRL */
+- 0x0010, /* 0x0006, CHIP_I2S_CTRL */
+- 0x0000, /* 0x0008, reserved */
+- 0x0008, /* 0x000A, CHIP_SSS_CTRL */
+- 0x0000, /* 0x000C, reserved */
+- 0x020c, /* 0x000E, CHIP_ADCDAC_CTRL */
+- 0x3c3c, /* 0x0010, CHIP_DAC_VOL */
+- 0x0000, /* 0x0012, reserved */
+- 0x015f, /* 0x0014, CHIP_PAD_STRENGTH */
+- 0x0000, /* 0x0016, reserved */
+- 0x0000, /* 0x0018, reserved */
+- 0x0000, /* 0x001A, reserved */
+- 0x0000, /* 0x001E, reserved */
+- 0x0000, /* 0x0020, CHIP_ANA_ADC_CTRL */
+- 0x1818, /* 0x0022, CHIP_ANA_HP_CTRL */
+- 0x0111, /* 0x0024, CHIP_ANN_CTRL */
+- 0x0000, /* 0x0026, CHIP_LINREG_CTRL */
+- 0x0000, /* 0x0028, CHIP_REF_CTRL */
+- 0x0000, /* 0x002A, CHIP_MIC_CTRL */
+- 0x0000, /* 0x002C, CHIP_LINE_OUT_CTRL */
+- 0x0404, /* 0x002E, CHIP_LINE_OUT_VOL */
+- 0x7060, /* 0x0030, CHIP_ANA_POWER */
+- 0x5000, /* 0x0032, CHIP_PLL_CTRL */
+- 0x0000, /* 0x0034, CHIP_CLK_TOP_CTRL */
+- 0x0000, /* 0x0036, CHIP_ANA_STATUS */
+- 0x0000, /* 0x0038, reserved */
+- 0x0000, /* 0x003A, CHIP_ANA_TEST2 */
+- 0x0000, /* 0x003C, CHIP_SHORT_CTRL */
+- 0x0000, /* reserved */
+-};
+-
+-/* default value of dap registers */
+-static const u16 sgtl5000_dap_regs[] = {
+- 0x0000, /* 0x0100, DAP_CONTROL */
+- 0x0000, /* 0x0102, DAP_PEQ */
+- 0x0040, /* 0x0104, DAP_BASS_ENHANCE */
+- 0x051f, /* 0x0106, DAP_BASS_ENHANCE_CTRL */
+- 0x0000, /* 0x0108, DAP_AUDIO_EQ */
+- 0x0040, /* 0x010A, DAP_SGTL_SURROUND */
+- 0x0000, /* 0x010C, DAP_FILTER_COEF_ACCESS */
+- 0x0000, /* 0x010E, DAP_COEF_WR_B0_MSB */
+- 0x0000, /* 0x0110, DAP_COEF_WR_B0_LSB */
+- 0x0000, /* 0x0112, reserved */
+- 0x0000, /* 0x0114, reserved */
+- 0x002f, /* 0x0116, DAP_AUDIO_EQ_BASS_BAND0 */
+- 0x002f, /* 0x0118, DAP_AUDIO_EQ_BAND0 */
+- 0x002f, /* 0x011A, DAP_AUDIO_EQ_BAND2 */
+- 0x002f, /* 0x011C, DAP_AUDIO_EQ_BAND3 */
+- 0x002f, /* 0x011E, DAP_AUDIO_EQ_TREBLE_BAND4 */
+- 0x8000, /* 0x0120, DAP_MAIN_CHAN */
+- 0x0000, /* 0x0122, DAP_MIX_CHAN */
+- 0x0510, /* 0x0124, DAP_AVC_CTRL */
+- 0x1473, /* 0x0126, DAP_AVC_THRESHOLD */
+- 0x0028, /* 0x0128, DAP_AVC_ATTACK */
+- 0x0050, /* 0x012A, DAP_AVC_DECAY */
+- 0x0000, /* 0x012C, DAP_COEF_WR_B1_MSB */
+- 0x0000, /* 0x012E, DAP_COEF_WR_B1_LSB */
+- 0x0000, /* 0x0130, DAP_COEF_WR_B2_MSB */
+- 0x0000, /* 0x0132, DAP_COEF_WR_B2_LSB */
+- 0x0000, /* 0x0134, DAP_COEF_WR_A1_MSB */
+- 0x0000, /* 0x0136, DAP_COEF_WR_A1_LSB */
+- 0x0000, /* 0x0138, DAP_COEF_WR_A2_MSB */
+- 0x0000, /* 0x013A, DAP_COEF_WR_A2_LSB */
++/* default value of sgtl5000 registers */
++static const u16 sgtl5000_regs[SGTL5000_MAX_REG_OFFSET] = {
++ [SGTL5000_CHIP_CLK_CTRL] = 0x0008,
++ [SGTL5000_CHIP_I2S_CTRL] = 0x0010,
++ [SGTL5000_CHIP_SSS_CTRL] = 0x0008,
++ [SGTL5000_CHIP_DAC_VOL] = 0x3c3c,
++ [SGTL5000_CHIP_PAD_STRENGTH] = 0x015f,
++ [SGTL5000_CHIP_ANA_HP_CTRL] = 0x1818,
++ [SGTL5000_CHIP_ANA_CTRL] = 0x0111,
++ [SGTL5000_CHIP_LINE_OUT_VOL] = 0x0404,
++ [SGTL5000_CHIP_ANA_POWER] = 0x7060,
++ [SGTL5000_CHIP_PLL_CTRL] = 0x5000,
++ [SGTL5000_DAP_BASS_ENHANCE] = 0x0040,
++ [SGTL5000_DAP_BASS_ENHANCE_CTRL] = 0x051f,
++ [SGTL5000_DAP_SURROUND] = 0x0040,
++ [SGTL5000_DAP_EQ_BASS_BAND0] = 0x002f,
++ [SGTL5000_DAP_EQ_BASS_BAND1] = 0x002f,
++ [SGTL5000_DAP_EQ_BASS_BAND2] = 0x002f,
++ [SGTL5000_DAP_EQ_BASS_BAND3] = 0x002f,
++ [SGTL5000_DAP_EQ_BASS_BAND4] = 0x002f,
++ [SGTL5000_DAP_MAIN_CHAN] = 0x8000,
++ [SGTL5000_DAP_AVC_CTRL] = 0x0510,
++ [SGTL5000_DAP_AVC_THRESHOLD] = 0x1473,
++ [SGTL5000_DAP_AVC_ATTACK] = 0x0028,
++ [SGTL5000_DAP_AVC_DECAY] = 0x0050,
+ };
+
+ /* regulator supplies for sgtl5000, VDDD is an optional external supply */
+@@ -1022,12 +980,10 @@ static int sgtl5000_suspend(struct snd_s
+ static int sgtl5000_restore_regs(struct snd_soc_codec *codec)
+ {
+ u16 *cache = codec->reg_cache;
+- int i;
+- int regular_regs = SGTL5000_CHIP_SHORT_CTRL >> 1;
++ u16 reg;
+
+ /* restore regular registers */
+- for (i = 0; i < regular_regs; i++) {
+- int reg = i << 1;
++ for (reg = 0; reg <= SGTL5000_CHIP_SHORT_CTRL; reg += 2) {
+
+ /* this regs depends on the others */
+ if (reg == SGTL5000_CHIP_ANA_POWER ||
+@@ -1037,35 +993,31 @@ static int sgtl5000_restore_regs(struct
+ reg == SGTL5000_CHIP_CLK_CTRL)
+ continue;
+
+- snd_soc_write(codec, reg, cache[i]);
++ snd_soc_write(codec, reg, cache[reg]);
+ }
+
+ /* restore dap registers */
+- for (i = SGTL5000_DAP_REG_OFFSET >> 1;
+- i < SGTL5000_MAX_REG_OFFSET >> 1; i++) {
+- int reg = i << 1;
+-
+- snd_soc_write(codec, reg, cache[i]);
+- }
++ for (reg = SGTL5000_DAP_REG_OFFSET; reg < SGTL5000_MAX_REG_OFFSET; reg += 2)
++ snd_soc_write(codec, reg, cache[reg]);
+
+ /*
+ * restore power and other regs according
+ * to set_power() and set_clock()
+ */
+ snd_soc_write(codec, SGTL5000_CHIP_LINREG_CTRL,
+- cache[SGTL5000_CHIP_LINREG_CTRL >> 1]);
++ cache[SGTL5000_CHIP_LINREG_CTRL]);
+
+ snd_soc_write(codec, SGTL5000_CHIP_ANA_POWER,
+- cache[SGTL5000_CHIP_ANA_POWER >> 1]);
++ cache[SGTL5000_CHIP_ANA_POWER]);
+
+ snd_soc_write(codec, SGTL5000_CHIP_CLK_CTRL,
+- cache[SGTL5000_CHIP_CLK_CTRL >> 1]);
++ cache[SGTL5000_CHIP_CLK_CTRL]);
+
+ snd_soc_write(codec, SGTL5000_CHIP_REF_CTRL,
+- cache[SGTL5000_CHIP_REF_CTRL >> 1]);
++ cache[SGTL5000_CHIP_REF_CTRL]);
+
+ snd_soc_write(codec, SGTL5000_CHIP_LINE_OUT_CTRL,
+- cache[SGTL5000_CHIP_LINE_OUT_CTRL >> 1]);
++ cache[SGTL5000_CHIP_LINE_OUT_CTRL]);
+ return 0;
+ }
+
+@@ -1460,16 +1412,6 @@ static __devinit int sgtl5000_i2c_probe(
+ if (!sgtl5000)
+ return -ENOMEM;
+
+- /*
+- * copy DAP default values to default value array.
+- * sgtl5000 register space has a big hole, merge it
+- * at init phase makes life easy.
+- * FIXME: should we drop 'const' of sgtl5000_regs?
+- */
+- memcpy((void *)(&sgtl5000_regs[0] + (SGTL5000_DAP_REG_OFFSET >> 1)),
+- sgtl5000_dap_regs,
+- SGTL5000_MAX_REG_OFFSET - SGTL5000_DAP_REG_OFFSET);
+-
+ i2c_set_clientdata(client, sgtl5000);
+
+ ret = snd_soc_register_codec(&client->dev,
--- /dev/null
+From 536a63b9c920404eb6a5b22fed00a8a61d409523 Mon Sep 17 00:00:00 2001
+From: Andy Gospodarek <andy@greyhouse.net>
+Date: Tue, 26 Jul 2011 11:12:27 +0000
+Subject: bonding: fix string comparison errors
+
+
+From: Andy Gospodarek <andy@greyhouse.net>
+
+[ Upstream commit f4bb2e9c4fa9e5fdddf90589703613fd1a9c519f ]
+
+When a bond contains a device where one name is the subset of another
+(eth1 and eth10, for example), one cannot properly set the primary
+device or the currently active device.
+
+This was reported and based on work by Takuma Umeya. I also verified
+the problem and tested that this fix resolves it.
+
+V2: A few did not like the the current code or my changes, so I
+refactored bonding_store_primary and bonding_store_active_slave to be a
+bit cleaner, dropped the use of strnicmp since we did not really need
+the comparison to be case insensitive, and formatted the input string
+from sysfs so a comparison to IFNAMSIZ could be used.
+
+I also discovered an error in bonding_store_active_slave that would
+modify bond->primary_slave rather than bond->curr_active_slave before
+forcing the bonding driver to choose a new active slave.
+
+V3: Actually sending the proper patch....
+
+Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
+Reported-by: Takuma Umeya <tumeya@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/bonding/bond_sysfs.c | 133 ++++++++++++++++++++-------------------
+ 1 file changed, 71 insertions(+), 62 deletions(-)
+
+--- a/drivers/net/bonding/bond_sysfs.c
++++ b/drivers/net/bonding/bond_sysfs.c
+@@ -992,6 +992,7 @@ static ssize_t bonding_store_primary(str
+ int i;
+ struct slave *slave;
+ struct bonding *bond = to_bond(d);
++ char ifname[IFNAMSIZ];
+
+ if (!rtnl_trylock())
+ return restart_syscall();
+@@ -1002,32 +1003,33 @@ static ssize_t bonding_store_primary(str
+ if (!USES_PRIMARY(bond->params.mode)) {
+ pr_info("%s: Unable to set primary slave; %s is in mode %d\n",
+ bond->dev->name, bond->dev->name, bond->params.mode);
+- } else {
+- bond_for_each_slave(bond, slave, i) {
+- if (strnicmp
+- (slave->dev->name, buf,
+- strlen(slave->dev->name)) == 0) {
+- pr_info("%s: Setting %s as primary slave.\n",
+- bond->dev->name, slave->dev->name);
+- bond->primary_slave = slave;
+- strcpy(bond->params.primary, slave->dev->name);
+- bond_select_active_slave(bond);
+- goto out;
+- }
+- }
++ goto out;
++ }
+
+- /* if we got here, then we didn't match the name of any slave */
++ sscanf(buf, "%16s", ifname); /* IFNAMSIZ */
+
+- if (strlen(buf) == 0 || buf[0] == '\n') {
+- pr_info("%s: Setting primary slave to None.\n",
+- bond->dev->name);
+- bond->primary_slave = NULL;
+- bond_select_active_slave(bond);
+- } else {
+- pr_info("%s: Unable to set %.*s as primary slave as it is not a slave.\n",
+- bond->dev->name, (int)strlen(buf) - 1, buf);
++ /* check to see if we are clearing primary */
++ if (!strlen(ifname) || buf[0] == '\n') {
++ pr_info("%s: Setting primary slave to None.\n",
++ bond->dev->name);
++ bond->primary_slave = NULL;
++ bond_select_active_slave(bond);
++ goto out;
++ }
++
++ bond_for_each_slave(bond, slave, i) {
++ if (strncmp(slave->dev->name, ifname, IFNAMSIZ) == 0) {
++ pr_info("%s: Setting %s as primary slave.\n",
++ bond->dev->name, slave->dev->name);
++ bond->primary_slave = slave;
++ strcpy(bond->params.primary, slave->dev->name);
++ bond_select_active_slave(bond);
++ goto out;
+ }
+ }
++
++ pr_info("%s: Unable to set %.*s as primary slave.\n",
++ bond->dev->name, (int)strlen(buf) - 1, buf);
+ out:
+ write_unlock_bh(&bond->curr_slave_lock);
+ read_unlock(&bond->lock);
+@@ -1162,6 +1164,7 @@ static ssize_t bonding_store_active_slav
+ struct slave *old_active = NULL;
+ struct slave *new_active = NULL;
+ struct bonding *bond = to_bond(d);
++ char ifname[IFNAMSIZ];
+
+ if (!rtnl_trylock())
+ return restart_syscall();
+@@ -1170,56 +1173,62 @@ static ssize_t bonding_store_active_slav
+ read_lock(&bond->lock);
+ write_lock_bh(&bond->curr_slave_lock);
+
+- if (!USES_PRIMARY(bond->params.mode))
++ if (!USES_PRIMARY(bond->params.mode)) {
+ pr_info("%s: Unable to change active slave; %s is in mode %d\n",
+ bond->dev->name, bond->dev->name, bond->params.mode);
+- else {
+- bond_for_each_slave(bond, slave, i) {
+- if (strnicmp
+- (slave->dev->name, buf,
+- strlen(slave->dev->name)) == 0) {
+- old_active = bond->curr_active_slave;
+- new_active = slave;
+- if (new_active == old_active) {
+- /* do nothing */
+- pr_info("%s: %s is already the current active slave.\n",
++ goto out;
++ }
++
++ sscanf(buf, "%16s", ifname); /* IFNAMSIZ */
++
++ /* check to see if we are clearing active */
++ if (!strlen(ifname) || buf[0] == '\n') {
++ pr_info("%s: Clearing current active slave.\n",
++ bond->dev->name);
++ bond->curr_active_slave = NULL;
++ bond_select_active_slave(bond);
++ goto out;
++ }
++
++ bond_for_each_slave(bond, slave, i) {
++ if (strncmp(slave->dev->name, ifname, IFNAMSIZ) == 0) {
++ old_active = bond->curr_active_slave;
++ new_active = slave;
++ if (new_active == old_active) {
++ /* do nothing */
++ pr_info("%s: %s is already the current"
++ " active slave.\n",
++ bond->dev->name,
++ slave->dev->name);
++ goto out;
++ }
++ else {
++ if ((new_active) &&
++ (old_active) &&
++ (new_active->link == BOND_LINK_UP) &&
++ IS_UP(new_active->dev)) {
++ pr_info("%s: Setting %s as active"
++ " slave.\n",
+ bond->dev->name,
+ slave->dev->name);
+- goto out;
++ bond_change_active_slave(bond,
++ new_active);
+ }
+ else {
+- if ((new_active) &&
+- (old_active) &&
+- (new_active->link == BOND_LINK_UP) &&
+- IS_UP(new_active->dev)) {
+- pr_info("%s: Setting %s as active slave.\n",
+- bond->dev->name,
+- slave->dev->name);
+- bond_change_active_slave(bond, new_active);
+- }
+- else {
+- pr_info("%s: Could not set %s as active slave; either %s is down or the link is down.\n",
+- bond->dev->name,
+- slave->dev->name,
+- slave->dev->name);
+- }
+- goto out;
++ pr_info("%s: Could not set %s as"
++ " active slave; either %s is"
++ " down or the link is down.\n",
++ bond->dev->name,
++ slave->dev->name,
++ slave->dev->name);
+ }
++ goto out;
+ }
+ }
+-
+- /* if we got here, then we didn't match the name of any slave */
+-
+- if (strlen(buf) == 0 || buf[0] == '\n') {
+- pr_info("%s: Setting active slave to None.\n",
+- bond->dev->name);
+- bond->primary_slave = NULL;
+- bond_select_active_slave(bond);
+- } else {
+- pr_info("%s: Unable to set %.*s as active slave as it is not a slave.\n",
+- bond->dev->name, (int)strlen(buf) - 1, buf);
+- }
+ }
++
++ pr_info("%s: Unable to set %.*s as active slave.\n",
++ bond->dev->name, (int)strlen(buf) - 1, buf);
+ out:
+ write_unlock_bh(&bond->curr_slave_lock);
+ read_unlock(&bond->lock);
--- /dev/null
+From 88782afb511c8b96184855b252b11a14f2e82702 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Thu, 28 Jul 2011 02:46:03 +0000
+Subject: drivers/net/niu.c: adjust array index
+
+
+From: Julia Lawall <julia@diku.dk>
+
+[ Upstream commit 956837f7c954443f426a82ba6f17b33488cf9a0c ]
+
+Convert array index from the loop bound to the loop index.
+
+A simplified version of the semantic patch that fixes this problem is as
+follows: (http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression e1,e2,ar;
+@@
+
+for(e1 = 0; e1 < e2; e1++) { <...
+ ar[
+- e2
++ e1
+ ]
+ ...> }
+// </smpl>
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/niu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/niu.c
++++ b/drivers/net/niu.c
+@@ -9196,7 +9196,7 @@ static int __devinit niu_ldg_init(struct
+
+ first_chan = 0;
+ for (i = 0; i < port; i++)
+- first_chan += parent->rxchan_per_port[port];
++ first_chan += parent->rxchan_per_port[i];
+ num_chan = parent->rxchan_per_port[port];
+
+ for (i = first_chan; i < (first_chan + num_chan); i++) {
+@@ -9212,7 +9212,7 @@ static int __devinit niu_ldg_init(struct
+
+ first_chan = 0;
+ for (i = 0; i < port; i++)
+- first_chan += parent->txchan_per_port[port];
++ first_chan += parent->txchan_per_port[i];
+ num_chan = parent->txchan_per_port[port];
+ for (i = first_chan; i < (first_chan + num_chan); i++) {
+ err = niu_ldg_assign_ldn(np, parent,
--- /dev/null
+From af999891230336f7ffbe750d6b8262749693a52e Mon Sep 17 00:00:00 2001
+From: Chris Clayton <chris2553@googlemail.com>
+Date: Tue, 26 Jul 2011 12:20:22 +0000
+Subject: Fix cdc-phonet build
+
+
+From: Chris Clayton <chris2553@googlemail.com>
+
+[ Upstream commit a0295a3b6775ab88f5883684e14bbda8d287822d ]
+
+Try to send to correct address this time!
+
+---------- Forwarded Message ----------
+
+Subject: [PATCH] Fix cdc-phonet build
+Date: Saturday 23 Jul 2011
+From: Chris Clayton <chris2553@googlemail.com>
+To: linux-net@vger.kernel.org
+
+cdc-phonet does not presently build on linux-3.0 because there is no entry for it in
+drivers/net/Makefile. This patch adds that entry.
+
+Signed-off-by: Chris Clayton <chris2553@googlemail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -283,6 +283,7 @@ obj-$(CONFIG_USB_HSO) += usb/
+ obj-$(CONFIG_USB_USBNET) += usb/
+ obj-$(CONFIG_USB_ZD1201) += usb/
+ obj-$(CONFIG_USB_IPHETH) += usb/
++obj-$(CONFIG_USB_CDC_PHONET) += usb/
+
+ obj-$(CONFIG_WLAN) += wireless/
+ obj-$(CONFIG_NET_TULIP) += tulip/
--- /dev/null
+From b2be55e21dd28aecd96e8476fc9e9a0e18e33c52 Mon Sep 17 00:00:00 2001
+From: "xeb@mail.ru" <xeb@mail.ru>
+Date: Fri, 22 Jul 2011 20:49:40 +0000
+Subject: gre: fix improper error handling
+
+
+From: "xeb@mail.ru" <xeb@mail.ru>
+
+[ Upstream commit 559fafb94ad9e4cd8774f39241917c57396f9fc5 ]
+
+Fix improper protocol err_handler, current implementation is fully
+unapplicable and may cause kernel crash due to double kfree_skb.
+
+Signed-off-by: Dmitry Kozlov <xeb@mail.ru>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/gre.c | 21 ++++++---------------
+ 1 file changed, 6 insertions(+), 15 deletions(-)
+
+--- a/net/ipv4/gre.c
++++ b/net/ipv4/gre.c
+@@ -15,6 +15,7 @@
+ #include <linux/kmod.h>
+ #include <linux/skbuff.h>
+ #include <linux/in.h>
++#include <linux/ip.h>
+ #include <linux/netdevice.h>
+ #include <linux/version.h>
+ #include <linux/spinlock.h>
+@@ -97,27 +98,17 @@ drop:
+ static void gre_err(struct sk_buff *skb, u32 info)
+ {
+ const struct gre_protocol *proto;
+- u8 ver;
+-
+- if (!pskb_may_pull(skb, 12))
+- goto drop;
++ const struct iphdr *iph = (const struct iphdr *)skb->data;
++ u8 ver = skb->data[(iph->ihl<<2) + 1]&0x7f;
+
+- ver = skb->data[1]&0x7f;
+ if (ver >= GREPROTO_MAX)
+- goto drop;
++ return;
+
+ rcu_read_lock();
+ proto = rcu_dereference(gre_proto[ver]);
+- if (!proto || !proto->err_handler)
+- goto drop_unlock;
+- proto->err_handler(skb, info);
+- rcu_read_unlock();
+- return;
+-
+-drop_unlock:
++ if (proto && proto->err_handler)
++ proto->err_handler(skb, info);
+ rcu_read_unlock();
+-drop:
+- kfree_skb(skb);
+ }
+
+ static const struct net_protocol net_gre_protocol = {
--- /dev/null
+From c867a9d829b436ca130d08c04d7c1e549e263366 Mon Sep 17 00:00:00 2001
+From: "David S. Miller" <davem@davemloft.net>
+Date: Fri, 22 Jul 2011 06:22:10 -0700
+Subject: icmp: Fix regression in nexthop resolution during replies.
+
+
+From: "David S. Miller" <davem@davemloft.net>
+
+[ Upstream commit 415b3334a21aa67806c52d1acf4e72e14f7f402f ]
+
+icmp_route_lookup() uses the wrong flow parameters if the reverse
+session route lookup isn't used.
+
+So do not commit to the re-decoded flow until we actually make a
+final decision to use a real route saved in 'rt2'.
+
+Reported-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/icmp.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -380,6 +380,7 @@ static struct rtable *icmp_route_lookup(
+ struct icmp_bxm *param)
+ {
+ struct rtable *rt, *rt2;
++ struct flowi4 fl4_dec;
+ int err;
+
+ memset(fl4, 0, sizeof(*fl4));
+@@ -408,19 +409,19 @@ static struct rtable *icmp_route_lookup(
+ } else
+ return rt;
+
+- err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(fl4), AF_INET);
++ err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);
+ if (err)
+ goto relookup_failed;
+
+- if (inet_addr_type(net, fl4->saddr) == RTN_LOCAL) {
+- rt2 = __ip_route_output_key(net, fl4);
++ if (inet_addr_type(net, fl4_dec.saddr) == RTN_LOCAL) {
++ rt2 = __ip_route_output_key(net, &fl4_dec);
+ if (IS_ERR(rt2))
+ err = PTR_ERR(rt2);
+ } else {
+ struct flowi4 fl4_2 = {};
+ unsigned long orefdst;
+
+- fl4_2.daddr = fl4->saddr;
++ fl4_2.daddr = fl4_dec.saddr;
+ rt2 = ip_route_output_key(net, &fl4_2);
+ if (IS_ERR(rt2)) {
+ err = PTR_ERR(rt2);
+@@ -428,7 +429,7 @@ static struct rtable *icmp_route_lookup(
+ }
+ /* Ugh! */
+ orefdst = skb_in->_skb_refdst; /* save old refdst */
+- err = ip_route_input(skb_in, fl4->daddr, fl4->saddr,
++ err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
+ RT_TOS(tos), rt2->dst.dev);
+
+ dst_release(&rt2->dst);
+@@ -440,10 +441,11 @@ static struct rtable *icmp_route_lookup(
+ goto relookup_failed;
+
+ rt2 = (struct rtable *) xfrm_lookup(net, &rt2->dst,
+- flowi4_to_flowi(fl4), NULL,
++ flowi4_to_flowi(&fl4_dec), NULL,
+ XFRM_LOOKUP_ICMP);
+ if (!IS_ERR(rt2)) {
+ dst_release(&rt->dst);
++ memcpy(fl4, &fl4_dec, sizeof(*fl4));
+ rt = rt2;
+ } else if (PTR_ERR(rt2) == -EPERM) {
+ if (rt)
--- /dev/null
+From b08c1401e8fbcce60be44a623bcf9d04af3ce2e9 Mon Sep 17 00:00:00 2001
+From: Bill Sommerfeld <wsommerfeld@google.com>
+Date: Tue, 19 Jul 2011 15:22:33 +0000
+Subject: ipv4: Constrain UFO fragment sizes to multiples of 8 bytes
+
+
+From: Bill Sommerfeld <wsommerfeld@google.com>
+
+[ Upstream commit d9be4f7a6f5a8da3133b832eca41c3591420b1ca ]
+
+Because the ip fragment offset field counts 8-byte chunks, ip
+fragments other than the last must contain a multiple of 8 bytes of
+payload. ip_ufo_append_data wasn't respecting this constraint and,
+depending on the MTU and ip option sizes, could create malformed
+non-final fragments.
+
+Google-Bug-Id: 5009328
+Signed-off-by: Bill Sommerfeld <wsommerfeld@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/ip_output.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -734,7 +734,7 @@ static inline int ip_ufo_append_data(str
+ int getfrag(void *from, char *to, int offset, int len,
+ int odd, struct sk_buff *skb),
+ void *from, int length, int hh_len, int fragheaderlen,
+- int transhdrlen, int mtu, unsigned int flags)
++ int transhdrlen, int maxfraglen, unsigned int flags)
+ {
+ struct sk_buff *skb;
+ int err;
+@@ -767,7 +767,7 @@ static inline int ip_ufo_append_data(str
+ skb->csum = 0;
+
+ /* specify the length of each IP datagram fragment */
+- skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
++ skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
+ skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+ __skb_queue_tail(queue, skb);
+ }
+@@ -831,7 +831,7 @@ static int __ip_append_data(struct sock
+ (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
+ err = ip_ufo_append_data(sk, queue, getfrag, from, length,
+ hh_len, fragheaderlen, transhdrlen,
+- mtu, flags);
++ maxfraglen, flags);
+ if (err)
+ goto error;
+ return 0;
--- /dev/null
+From d3ba761a87bad091b5d4d0f6d6c3f5bbcc574c40 Mon Sep 17 00:00:00 2001
+From: Julian Anastasov <ja@ssi.bg>
+Date: Sun, 7 Aug 2011 22:20:20 -0700
+Subject: ipv4: fix the reusing of routing cache entries
+
+
+From: Julian Anastasov <ja@ssi.bg>
+
+[ Upstream commit d547f727df86059104af2234804fdd538e112015 ]
+
+ compare_keys and ip_route_input_common rely on
+rt_oif for distinguishing of input and output routes
+with same keys values. But sometimes the input route has
+also same hash chain (keyed by iif != 0) with the output
+routes (keyed by orig_oif=0). Problem visible if running
+with small number of rhash_entries.
+
+ Fix them to use rt_route_iif instead. By this way
+input route can not be returned to users that request
+output route.
+
+ The patch fixes the ip_rt_bug errors that were
+reported in ip_local_out context, mostly for 255.255.255.255
+destinations.
+
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/route.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -726,6 +726,7 @@ static inline int compare_keys(struct rt
+ ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
+ (rt1->rt_mark ^ rt2->rt_mark) |
+ (rt1->rt_key_tos ^ rt2->rt_key_tos) |
++ (rt1->rt_route_iif ^ rt2->rt_route_iif) |
+ (rt1->rt_oif ^ rt2->rt_oif) |
+ (rt1->rt_iif ^ rt2->rt_iif)) == 0;
+ }
+@@ -2282,8 +2283,8 @@ int ip_route_input_common(struct sk_buff
+ if ((((__force u32)rth->rt_key_dst ^ (__force u32)daddr) |
+ ((__force u32)rth->rt_key_src ^ (__force u32)saddr) |
+ (rth->rt_iif ^ iif) |
+- rth->rt_oif |
+ (rth->rt_key_tos ^ tos)) == 0 &&
++ rt_is_input_route(rth) &&
+ rth->rt_mark == skb->mark &&
+ net_eq(dev_net(rth->dst.dev), net) &&
+ !rt_is_expired(rth)) {
--- /dev/null
+From 4e1b1e9f8de331f87c4ea9dfe97861edf2026207 Mon Sep 17 00:00:00 2001
+From: Zoltan Kiss <schaman@sch.bme.hu>
+Date: Sun, 24 Jul 2011 13:09:30 +0000
+Subject: IPv4: Send gratuitous ARP for secondary IP addresses also
+
+
+From: Zoltan Kiss <schaman@sch.bme.hu>
+
+[ Upstream commit b76d0789c92a816a5539dc14232a700b8d62a53a ]
+
+If a device event generates gratuitous ARP messages, only primary
+address is used for sending. This patch iterates through the whole
+list. Tested with 2 IP addresses configuration on bonding interface.
+
+Signed-off-by: Zoltan Kiss <schaman@sch.bme.hu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/devinet.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -1134,15 +1134,15 @@ static void inetdev_send_gratuitous_arp(
+ struct in_device *in_dev)
+
+ {
+- struct in_ifaddr *ifa = in_dev->ifa_list;
++ struct in_ifaddr *ifa;
+
+- if (!ifa)
+- return;
+-
+- arp_send(ARPOP_REQUEST, ETH_P_ARP,
+- ifa->ifa_local, dev,
+- ifa->ifa_local, NULL,
+- dev->dev_addr, NULL);
++ for (ifa = in_dev->ifa_list; ifa;
++ ifa = ifa->ifa_next) {
++ arp_send(ARPOP_REQUEST, ETH_P_ARP,
++ ifa->ifa_local, dev,
++ ifa->ifa_local, NULL,
++ dev->dev_addr, NULL);
++ }
+ }
+
+ /* Called only under RTNL semaphore */
--- /dev/null
+From 47a3bfdef3c4ba58f04d978c9480b057bedd4624 Mon Sep 17 00:00:00 2001
+From: Julian Anastasov <ja@ssi.bg>
+Date: Sat, 23 Jul 2011 02:00:41 +0000
+Subject: ipv4: use RT_TOS after some rt_tos conversions
+
+
+From: Julian Anastasov <ja@ssi.bg>
+
+[ Upstream commit b0fe4a31849063fcac0bdc93716ca92615e93f57 ]
+
+rt_tos was changed to iph->tos but it must be filtered by RT_TOS
+
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/ipmr.c | 2 +-
+ net/ipv4/route.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1796,7 +1796,7 @@ static struct mr_table *ipmr_rt_fib_look
+ struct flowi4 fl4 = {
+ .daddr = iph->daddr,
+ .saddr = iph->saddr,
+- .flowi4_tos = iph->tos,
++ .flowi4_tos = RT_TOS(iph->tos),
+ .flowi4_oif = rt->rt_oif,
+ .flowi4_iif = rt->rt_iif,
+ .flowi4_mark = rt->rt_mark,
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1705,7 +1705,7 @@ void ip_rt_get_source(u8 *addr, struct s
+ memset(&fl4, 0, sizeof(fl4));
+ fl4.daddr = iph->daddr;
+ fl4.saddr = iph->saddr;
+- fl4.flowi4_tos = iph->tos;
++ fl4.flowi4_tos = RT_TOS(iph->tos);
+ fl4.flowi4_oif = rt->dst.dev->ifindex;
+ fl4.flowi4_iif = skb->dev->ifindex;
+ fl4.flowi4_mark = skb->mark;
--- /dev/null
+From d8d972876c51f7344367414bef3682bcf97e4e87 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Mon, 8 Aug 2011 23:44:00 -0700
+Subject: ipv6: make fragment identifications less predictable
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Backport of upstream commit 87c48fa3b4630905f98268dde838ee43626a060c ]
+
+Fernando Gont reported current IPv6 fragment identification generation
+was not secure, because using a very predictable system-wide generator,
+allowing various attacks.
+
+IPv4 uses inetpeer cache to address this problem and to get good
+performance. We'll use this mechanism when IPv6 inetpeer is stable
+enough in linux-3.1
+
+For the time being, we use jhash on destination address to provide less
+predictable identifications. Also remove a spinlock and use cmpxchg() to
+get better SMP performance.
+
+Reported-by: Fernando Gont <fernando@gont.com.ar>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/net/ipv6.h | 12 +-----------
+ include/net/transp_v6.h | 2 ++
+ net/ipv6/af_inet6.c | 2 ++
+ net/ipv6/ip6_output.c | 40 +++++++++++++++++++++++++++++++++++-----
+ net/ipv6/udp.c | 2 +-
+ 5 files changed, 41 insertions(+), 17 deletions(-)
+
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -463,17 +463,7 @@ static inline int ipv6_addr_diff(const s
+ return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
+ }
+
+-static __inline__ void ipv6_select_ident(struct frag_hdr *fhdr)
+-{
+- static u32 ipv6_fragmentation_id = 1;
+- static DEFINE_SPINLOCK(ip6_id_lock);
+-
+- spin_lock_bh(&ip6_id_lock);
+- fhdr->identification = htonl(ipv6_fragmentation_id);
+- if (++ipv6_fragmentation_id == 0)
+- ipv6_fragmentation_id = 1;
+- spin_unlock_bh(&ip6_id_lock);
+-}
++extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
+
+ /*
+ * Prototypes exported by ipv6
+--- a/include/net/transp_v6.h
++++ b/include/net/transp_v6.h
+@@ -14,6 +14,8 @@ extern struct proto tcpv6_prot;
+
+ struct flowi6;
+
++extern void initialize_hashidentrnd(void);
++
+ /* extension headers */
+ extern int ipv6_exthdrs_init(void);
+ extern void ipv6_exthdrs_exit(void);
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -1078,6 +1078,8 @@ static int __init inet6_init(void)
+ goto out;
+ }
+
++ initialize_hashidentrnd();
++
+ err = proto_register(&tcpv6_prot, 1);
+ if (err)
+ goto out;
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -596,6 +596,35 @@ int ip6_find_1stfragopt(struct sk_buff *
+ return offset;
+ }
+
++static u32 hashidentrnd __read_mostly;
++#define FID_HASH_SZ 16
++static u32 ipv6_fragmentation_id[FID_HASH_SZ];
++
++void __init initialize_hashidentrnd(void)
++{
++ get_random_bytes(&hashidentrnd, sizeof(hashidentrnd));
++}
++
++static u32 __ipv6_select_ident(const struct in6_addr *addr)
++{
++ u32 newid, oldid, hash = jhash2((u32 *)addr, 4, hashidentrnd);
++ u32 *pid = &ipv6_fragmentation_id[hash % FID_HASH_SZ];
++
++ do {
++ oldid = *pid;
++ newid = oldid + 1;
++ if (!(hash + newid))
++ newid++;
++ } while (cmpxchg(pid, oldid, newid) != oldid);
++
++ return hash + newid;
++}
++
++void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
++{
++ fhdr->identification = htonl(__ipv6_select_ident(&rt->rt6i_dst.addr));
++}
++
+ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+ {
+ struct sk_buff *frag;
+@@ -680,7 +709,7 @@ int ip6_fragment(struct sk_buff *skb, in
+ skb_reset_network_header(skb);
+ memcpy(skb_network_header(skb), tmp_hdr, hlen);
+
+- ipv6_select_ident(fh);
++ ipv6_select_ident(fh, rt);
+ fh->nexthdr = nexthdr;
+ fh->reserved = 0;
+ fh->frag_off = htons(IP6_MF);
+@@ -826,7 +855,7 @@ slow_path:
+ fh->nexthdr = nexthdr;
+ fh->reserved = 0;
+ if (!frag_id) {
+- ipv6_select_ident(fh);
++ ipv6_select_ident(fh, rt);
+ frag_id = fh->identification;
+ } else
+ fh->identification = frag_id;
+@@ -1072,7 +1101,8 @@ static inline int ip6_ufo_append_data(st
+ int getfrag(void *from, char *to, int offset, int len,
+ int odd, struct sk_buff *skb),
+ void *from, int length, int hh_len, int fragheaderlen,
+- int transhdrlen, int mtu,unsigned int flags)
++ int transhdrlen, int mtu,unsigned int flags,
++ struct rt6_info *rt)
+
+ {
+ struct sk_buff *skb;
+@@ -1116,7 +1146,7 @@ static inline int ip6_ufo_append_data(st
+ skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
+ sizeof(struct frag_hdr)) & ~7;
+ skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+- ipv6_select_ident(&fhdr);
++ ipv6_select_ident(&fhdr, rt);
+ skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
+ __skb_queue_tail(&sk->sk_write_queue, skb);
+
+@@ -1282,7 +1312,7 @@ int ip6_append_data(struct sock *sk, int
+
+ err = ip6_ufo_append_data(sk, getfrag, from, length,
+ hh_len, fragheaderlen,
+- transhdrlen, mtu, flags);
++ transhdrlen, mtu, flags, rt);
+ if (err)
+ goto error;
+ return 0;
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1359,7 +1359,7 @@ static struct sk_buff *udp6_ufo_fragment
+ fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
+ fptr->nexthdr = nexthdr;
+ fptr->reserved = 0;
+- ipv6_select_ident(fptr);
++ ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
+
+ /* Fragment the skb. ipv6 header and the remaining fields of the
+ * fragment header are updated in ipv6_gso_segment()
--- /dev/null
+From 84ea121d5ffa4706af3c36da25401c87c27d6841 Mon Sep 17 00:00:00 2001
+From: Simon Horman <horms@verge.net.au>
+Date: Thu, 19 May 2011 21:32:57 +0900
+Subject: IPVS: Free resources on module removal
+
+
+From: Simon Horman <horms@verge.net.au>
+
+[ Upstream commit 7676e345824f162191b1fe2058ad948a6cf91c20 ]
+
+This resolves a panic on module removal.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/netfilter/ipvs/ip_vs_ctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -3771,6 +3771,7 @@ err_sock:
+ void ip_vs_control_cleanup(void)
+ {
+ EnterFunction(2);
++ unregister_netdevice_notifier(&ip_vs_dst_notifier);
+ ip_vs_genl_unregister();
+ nf_unregister_sockopt(&ip_vs_sockopts);
+ LeaveFunction(2);
--- /dev/null
+From djpohly@gmail.com Tue Aug 9 09:40:10 2011
+From: "Devin J. Pohly" <djpohly@gmail.com>
+Date: Mon, 8 Aug 2011 20:53:58 -0600
+Subject: iwlagn: 5000 do not support idle mode
+To: gregkh@suse.de
+Cc: stable@kernel.org, "Devin J. Pohly" <djpohly+iwl@gmail.com>, Wey-Yi Guy <wey-yi.w.guy@intel.com>, "John W. Linville" <linville@tuxdriver.com>
+Message-ID: <1312858438-5080-1-git-send-email-djpohly@gmail.com>
+
+
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+
+commit f35291082294ca6737953bbe4e9491ede04ab822 upstream.
+
+5000 series has issue supporting power save idle mode:
+commit 9dc2153315650eae220898668b6aa56a25c130be
+
+iwlwifi: always support idle mode for agn devices
+
+For agn devices, always support idle mode which help power
+consumption in idle unassociated state.
+
+the above changes cause 5000 become not stable when power management is "on"
+
+http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2312
+
+Reported-by: Devin J. Pohly <djpohly+iwl@gmail.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Devin J. Pohly <djpohly+iwl@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-5000.c | 1 +
+ drivers/net/wireless/iwlwifi/iwl-core.h | 2 ++
+ drivers/net/wireless/iwlwifi/iwl-power.c | 3 ++-
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -421,6 +421,7 @@ static struct iwl_base_params iwl5000_ba
+ .chain_noise_scale = 1000,
+ .wd_timeout = IWL_LONG_WD_TIMEOUT,
+ .max_event_log_size = 512,
++ .no_idle_support = true,
+ };
+ static struct iwl_ht_params iwl5000_ht_params = {
+ .ht_greenfield_support = true,
+--- a/drivers/net/wireless/iwlwifi/iwl-core.h
++++ b/drivers/net/wireless/iwlwifi/iwl-core.h
+@@ -195,6 +195,7 @@ struct iwl_mod_params {
+ * @temperature_kelvin: temperature report by uCode in kelvin
+ * @max_event_log_size: size of event log buffer size for ucode event logging
+ * @shadow_reg_enable: HW shadhow register bit
++ * @no_idle_support: do not support idle mode
+ */
+ struct iwl_base_params {
+ int eeprom_size;
+@@ -216,6 +217,7 @@ struct iwl_base_params {
+ bool temperature_kelvin;
+ u32 max_event_log_size;
+ const bool shadow_reg_enable;
++ const bool no_idle_support;
+ };
+ /*
+ * @advanced_bt_coexist: support advanced bt coexist
+--- a/drivers/net/wireless/iwlwifi/iwl-power.c
++++ b/drivers/net/wireless/iwlwifi/iwl-power.c
+@@ -355,7 +355,8 @@ static void iwl_power_build_cmd(struct i
+
+ dtimper = priv->hw->conf.ps_dtim_period ?: 1;
+
+- if (priv->hw->conf.flags & IEEE80211_CONF_IDLE)
++ if (!priv->cfg->base_params->no_idle_support &&
++ priv->hw->conf.flags & IEEE80211_CONF_IDLE)
+ iwl_static_sleep_cmd(priv, cmd, IWL_POWER_INDEX_5, 20);
+ else if (iwl_tt_is_low_power_state(priv)) {
+ /* in thermal throttling low power state */
--- /dev/null
+From 4c113d38b468faf67ae1558600328154f4ed885e Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Tue, 26 Jul 2011 06:05:37 +0000
+Subject: net: add IFF_SKB_TX_SHARED flag to priv_flags
+
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+[ Upstream commit d8873315065f1f527c7c380402cf59b1e1d0ae36 ]
+
+Pktgen attempts to transmit shared skbs to net devices, which can't be used by
+some drivers as they keep state information in skbs. This patch adds a flag
+marking drivers as being able to handle shared skbs in their tx path. Drivers
+are defaulted to being unable to do so, but calling ether_setup enables this
+flag, as 90% of the drivers calling ether_setup touch real hardware and can
+handle shared skbs. A subsequent patch will audit drivers to ensure that the
+flag is set properly
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+Reported-by: Jiri Pirko <jpirko@redhat.com>
+CC: Robert Olsson <robert.olsson@its.uu.se>
+CC: Eric Dumazet <eric.dumazet@gmail.com>
+CC: Alexey Dobriyan <adobriyan@gmail.com>
+CC: David S. Miller <davem@davemloft.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/linux/if.h | 2 ++
+ net/core/pktgen.c | 8 +++++---
+ net/ethernet/eth.c | 1 +
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+--- a/include/linux/if.h
++++ b/include/linux/if.h
+@@ -76,6 +76,8 @@
+ #define IFF_BRIDGE_PORT 0x4000 /* device used as bridge port */
+ #define IFF_OVS_DATAPATH 0x8000 /* device used as Open vSwitch
+ * datapath port */
++#define IFF_TX_SKB_SHARING 0x10000 /* The interface supports sharing
++ * skbs on transmit */
+
+ #define IF_GET_IFACE 0x0001 /* for querying only */
+ #define IF_GET_PROTO 0x0002
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -1070,7 +1070,9 @@ static ssize_t pktgen_if_write(struct fi
+ len = num_arg(&user_buffer[i], 10, &value);
+ if (len < 0)
+ return len;
+-
++ if ((value > 0) &&
++ (!(pkt_dev->odev->priv_flags & IFF_TX_SKB_SHARING)))
++ return -ENOTSUPP;
+ i += len;
+ pkt_dev->clone_skb = value;
+
+@@ -3555,7 +3557,6 @@ static int pktgen_add_device(struct pktg
+ pkt_dev->min_pkt_size = ETH_ZLEN;
+ pkt_dev->max_pkt_size = ETH_ZLEN;
+ pkt_dev->nfrags = 0;
+- pkt_dev->clone_skb = pg_clone_skb_d;
+ pkt_dev->delay = pg_delay_d;
+ pkt_dev->count = pg_count_d;
+ pkt_dev->sofar = 0;
+@@ -3563,7 +3564,6 @@ static int pktgen_add_device(struct pktg
+ pkt_dev->udp_src_max = 9;
+ pkt_dev->udp_dst_min = 9;
+ pkt_dev->udp_dst_max = 9;
+-
+ pkt_dev->vlan_p = 0;
+ pkt_dev->vlan_cfi = 0;
+ pkt_dev->vlan_id = 0xffff;
+@@ -3575,6 +3575,8 @@ static int pktgen_add_device(struct pktg
+ err = pktgen_setup_dev(pkt_dev, ifname);
+ if (err)
+ goto out1;
++ if (pkt_dev->odev->priv_flags & IFF_TX_SKB_SHARING)
++ pkt_dev->clone_skb = pg_clone_skb_d;
+
+ pkt_dev->entry = proc_create_data(ifname, 0600, pg_proc_dir,
+ &pktgen_if_fops, pkt_dev);
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -340,6 +340,7 @@ void ether_setup(struct net_device *dev)
+ dev->addr_len = ETH_ALEN;
+ dev->tx_queue_len = 1000; /* Ethernet wants good queues */
+ dev->flags = IFF_BROADCAST|IFF_MULTICAST;
++ dev->priv_flags = IFF_TX_SKB_SHARING;
+
+ memset(dev->broadcast, 0xFF, ETH_ALEN);
+
--- /dev/null
+From 04e29aa354a1cf4eee37d0ce32ed3d3399188230 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Thu, 28 Jul 2011 02:46:01 +0000
+Subject: net: adjust array index
+
+
+From: Julia Lawall <julia@diku.dk>
+
+[ Upstream commit a1889c0d2039a53ae04abb9f20c62500bd312bf3 ]
+
+Convert array index from the loop bound to the loop index.
+
+A simplified version of the semantic patch that fixes this problem is as
+follows: (http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression e1,e2,ar;
+@@
+
+for(e1 = 0; e1 < e2; e1++) { <...
+ ar[
+- e2
++ e1
+ ]
+ ...> }
+// </smpl>
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/igmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -1718,7 +1718,7 @@ static int ip_mc_add_src(struct in_devic
+
+ pmc->sfcount[sfmode]--;
+ for (j=0; j<i; j++)
+- (void) ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
++ (void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
+ } else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
+ #ifdef CONFIG_IP_MULTICAST
+ struct ip_sf_list *psf;
--- /dev/null
+From 38be383d73917e4ea2d5676104037742e50c1e64 Mon Sep 17 00:00:00 2001
+From: stephen hemminger <shemminger@vyatta.com>
+Date: Fri, 22 Jul 2011 12:53:56 +0000
+Subject: net: allow netif_carrier to be called safely from IRQ
+
+
+From: stephen hemminger <shemminger@vyatta.com>
+
+[ Upstream commit 1821f7cd65ad9ea56580b830ac79bf4c4fef59cb ]
+
+As reported by Ben Greer and Froncois Romieu. The code path in
+the netif_carrier code leads it to try and disable
+a late workqueue to reenable it immediately
+netif_carrier_on
+-> linkwatch_fire_event
+ -> linkwatch_schedule_work
+ -> cancel_delayed_work
+ -> del_timer_sync
+
+If __cancel_delayed_work is used instead then there is no
+problem of waiting for running linkwatch_event.
+
+There is a race between linkwatch_event running re-scheduling
+but it is harmless to schedule an extra scan of the linkwatch queue.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/core/link_watch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/core/link_watch.c
++++ b/net/core/link_watch.c
+@@ -126,7 +126,7 @@ static void linkwatch_schedule_work(int
+ return;
+
+ /* It's already running which is good enough. */
+- if (!cancel_delayed_work(&linkwatch_work))
++ if (!__cancel_delayed_work(&linkwatch_work))
+ return;
+
+ /* Otherwise we reschedule it again for immediate execution. */
--- /dev/null
+From 6d256e78725e139eec48a4ec5286516b4458fd19 Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Tue, 26 Jul 2011 06:05:38 +0000
+Subject: net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared
+
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+[ Upstream commit 550fd08c2cebad61c548def135f67aba284c6162 ]
+
+After the last patch, We are left in a state in which only drivers calling
+ether_setup have IFF_TX_SKB_SHARING set (we assume that drivers touching real
+hardware call ether_setup for their net_devices and don't hold any state in
+their skbs. There are a handful of drivers that violate this assumption of
+course, and need to be fixed up. This patch identifies those drivers, and marks
+them as not being able to support the safe transmission of skbs by clearning the
+IFF_TX_SKB_SHARING flag in priv_flags
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+CC: Karsten Keil <isdn@linux-pingi.de>
+CC: "David S. Miller" <davem@davemloft.net>
+CC: Jay Vosburgh <fubar@us.ibm.com>
+CC: Andy Gospodarek <andy@greyhouse.net>
+CC: Patrick McHardy <kaber@trash.net>
+CC: Krzysztof Halasa <khc@pm.waw.pl>
+CC: "John W. Linville" <linville@tuxdriver.com>
+CC: Greg Kroah-Hartman <gregkh@suse.de>
+CC: Marcel Holtmann <marcel@holtmann.org>
+CC: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/isdn/i4l/isdn_net.c | 3 +++
+ drivers/net/bonding/bond_main.c | 6 ++++--
+ drivers/net/ifb.c | 2 +-
+ drivers/net/macvlan.c | 2 +-
+ drivers/net/tun.c | 1 +
+ drivers/net/veth.c | 2 ++
+ drivers/net/wan/hdlc_fr.c | 5 +++--
+ drivers/net/wireless/airo.c | 1 +
+ drivers/net/wireless/hostap/hostap_main.c | 1 +
+ drivers/staging/ath6kl/os/linux/ar6000_drv.c | 1 +
+ net/8021q/vlan_dev.c | 2 +-
+ net/bluetooth/bnep/netdev.c | 1 +
+ net/l2tp/l2tp_eth.c | 2 +-
+ net/mac80211/iface.c | 1 +
+ 14 files changed, 22 insertions(+), 8 deletions(-)
+
+--- a/drivers/isdn/i4l/isdn_net.c
++++ b/drivers/isdn/i4l/isdn_net.c
+@@ -2531,6 +2531,9 @@ static void _isdn_setup(struct net_devic
+
+ /* Setup the generic properties */
+ dev->flags = IFF_NOARP|IFF_POINTOPOINT;
++
++ /* isdn prepends a header in the tx path, can't share skbs */
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ dev->header_ops = NULL;
+ dev->netdev_ops = &isdn_netdev_ops;
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1625,8 +1625,10 @@ int bond_enslave(struct net_device *bond
+
+ if (slave_dev->type != ARPHRD_ETHER)
+ bond_setup_by_slave(bond_dev, slave_dev);
+- else
++ else {
+ ether_setup(bond_dev);
++ bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING;
++ }
+
+ netdev_bonding_change(bond_dev,
+ NETDEV_POST_TYPE_CHANGE);
+@@ -4398,7 +4400,7 @@ static void bond_setup(struct net_device
+ bond_dev->tx_queue_len = 0;
+ bond_dev->flags |= IFF_MASTER|IFF_MULTICAST;
+ bond_dev->priv_flags |= IFF_BONDING;
+- bond_dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
++ bond_dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
+
+ /* At first, we block adding VLANs. That's the only way to
+ * prevent problems that occur when adding VLANs over an
+--- a/drivers/net/ifb.c
++++ b/drivers/net/ifb.c
+@@ -145,7 +145,7 @@ static void ifb_setup(struct net_device
+
+ dev->flags |= IFF_NOARP;
+ dev->flags &= ~IFF_MULTICAST;
+- dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
++ dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
+ random_ether_addr(dev->dev_addr);
+ }
+
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -547,7 +547,7 @@ void macvlan_common_setup(struct net_dev
+ {
+ ether_setup(dev);
+
+- dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
++ dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
+ dev->netdev_ops = &macvlan_netdev_ops;
+ dev->destructor = free_netdev;
+ dev->header_ops = &macvlan_hard_header_ops,
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -528,6 +528,7 @@ static void tun_net_init(struct net_devi
+ dev->netdev_ops = &tap_netdev_ops;
+ /* Ethernet TAP Device */
+ ether_setup(dev);
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+
+ random_ether_addr(dev->dev_addr);
+
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -262,6 +262,8 @@ static void veth_setup(struct net_device
+ {
+ ether_setup(dev);
+
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
++
+ dev->netdev_ops = &veth_netdev_ops;
+ dev->ethtool_ops = &veth_ethtool_ops;
+ dev->features |= NETIF_F_LLTX;
+--- a/drivers/net/wan/hdlc_fr.c
++++ b/drivers/net/wan/hdlc_fr.c
+@@ -1083,9 +1083,10 @@ static int fr_add_pvc(struct net_device
+
+ used = pvc_is_used(pvc);
+
+- if (type == ARPHRD_ETHER)
++ if (type == ARPHRD_ETHER) {
+ dev = alloc_netdev(0, "pvceth%d", ether_setup);
+- else
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
++ } else
+ dev = alloc_netdev(0, "pvc%d", pvc_setup);
+
+ if (!dev) {
+--- a/drivers/net/wireless/airo.c
++++ b/drivers/net/wireless/airo.c
+@@ -2823,6 +2823,7 @@ static struct net_device *_init_airo_car
+ dev->wireless_data = &ai->wireless_data;
+ dev->irq = irq;
+ dev->base_addr = port;
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+
+ SET_NETDEV_DEV(dev, dmdev);
+
+--- a/drivers/net/wireless/hostap/hostap_main.c
++++ b/drivers/net/wireless/hostap/hostap_main.c
+@@ -855,6 +855,7 @@ void hostap_setup_dev(struct net_device
+
+ iface = netdev_priv(dev);
+ ether_setup(dev);
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+
+ /* kernel callbacks */
+ if (iface) {
+--- a/drivers/staging/ath6kl/os/linux/ar6000_drv.c
++++ b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
+@@ -6198,6 +6198,7 @@ int ar6000_create_ap_interface(struct ar
+
+ ether_setup(dev);
+ init_netdev(dev, ap_ifname);
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+
+ if (register_netdev(dev)) {
+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_create_ap_interface: register_netdev failed\n"));
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -694,7 +694,7 @@ void vlan_setup(struct net_device *dev)
+ ether_setup(dev);
+
+ dev->priv_flags |= IFF_802_1Q_VLAN;
+- dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
++ dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
+ dev->tx_queue_len = 0;
+
+ dev->netdev_ops = &vlan_netdev_ops;
+--- a/net/bluetooth/bnep/netdev.c
++++ b/net/bluetooth/bnep/netdev.c
+@@ -231,6 +231,7 @@ void bnep_net_setup(struct net_device *d
+ dev->addr_len = ETH_ALEN;
+
+ ether_setup(dev);
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ dev->netdev_ops = &bnep_netdev_ops;
+
+ dev->watchdog_timeo = HZ * 2;
+--- a/net/l2tp/l2tp_eth.c
++++ b/net/l2tp/l2tp_eth.c
+@@ -103,7 +103,7 @@ static struct net_device_ops l2tp_eth_ne
+ static void l2tp_eth_dev_setup(struct net_device *dev)
+ {
+ ether_setup(dev);
+-
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ dev->netdev_ops = &l2tp_eth_netdev_ops;
+ dev->destructor = free_netdev;
+ }
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -699,6 +699,7 @@ static const struct net_device_ops ieee8
+ static void ieee80211_if_setup(struct net_device *dev)
+ {
+ ether_setup(dev);
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ dev->netdev_ops = &ieee80211_dataif_ops;
+ dev->destructor = free_netdev;
+ }
--- /dev/null
+From 57dabb02e0e44392886740d7e22cfb2854adf183 Mon Sep 17 00:00:00 2001
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+Date: Thu, 28 Jul 2011 13:18:11 +0000
+Subject: r8169: Add support for D-Link 530T rev C1 (Kernel Bug 38862)
+
+
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+
+[ Upstream commit 93a3aa25933461d76141179fc94aa32d5f9d954a ]
+
+The D-Link DGE-530T rev C1 is a re-badged Realtek 8169 named DLG10028C,
+unlike the previous revisions which were skge based. It is probably
+the same as the discontinued DGE-528T (0x4300) other than the PCI ID.
+
+The PCI ID is 0x1186:0x4302.
+
+Adding it to r8169.c where 0x1186:0x4300 is already found makes the card
+be detected and work.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=38862
+
+Signed-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/r8169.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -236,6 +236,7 @@ static DEFINE_PCI_DEVICE_TABLE(rtl8169_p
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8168), 0, 0, RTL_CFG_1 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8169), 0, 0, RTL_CFG_0 },
+ { PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4300), 0, 0, RTL_CFG_0 },
++ { PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4302), 0, 0, RTL_CFG_0 },
+ { PCI_DEVICE(PCI_VENDOR_ID_AT, 0xc107), 0, 0, RTL_CFG_0 },
+ { PCI_DEVICE(0x16ec, 0x0116), 0, 0, RTL_CFG_0 },
+ { PCI_VENDOR_ID_LINKSYS, 0x1032,
--- /dev/null
+From 97f750bd33b693c4a4a2ab4bdc2de4ee675d8372 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Fri, 29 Jul 2011 19:22:42 +0000
+Subject: sch_sfq: fix sfq_enqueue()
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit e1738bd9cecc5c867b0e2996470c1ff20f66ba79 ]
+
+commit 8efa88540635 (sch_sfq: avoid giving spurious NET_XMIT_CN signals)
+forgot to call qdisc_tree_decrease_qlen() to signal upper levels that a
+packet (from another flow) was dropped, leading to various problems.
+
+With help from Michal Soltys and Michal Pokrywka, who did a bisection.
+
+Bugzilla ref: https://bugzilla.kernel.org/show_bug.cgi?id=39372
+Debian ref: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631945
+
+Reported-by: Lucas Bocchi <lucas.bocchi@gmail.com>
+Reported-and-bisected-by: Michal Pokrywka <wolfmoon@o2.pl>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+CC: Michal Soltys <soltys@ziu.info>
+Acked-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/sched/sch_sfq.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -410,7 +410,12 @@ sfq_enqueue(struct sk_buff *skb, struct
+ /* Return Congestion Notification only if we dropped a packet
+ * from this flow.
+ */
+- return (qlen != slot->qlen) ? NET_XMIT_CN : NET_XMIT_SUCCESS;
++ if (qlen != slot->qlen)
++ return NET_XMIT_CN;
++
++ /* As we dropped a packet, better let upper stack know this */
++ qdisc_tree_decrease_qlen(sch, 1);
++ return NET_XMIT_SUCCESS;
+ }
+
+ static struct sk_buff *
cifs-fix-missing-a-decrement-of-inflight-value.patch
cifs-cope-with-negative-dentries-in-cifs_get_root.patch
cifs-convert-prefixpath-delimiters-in.patch
+asoc-sgtl5000-fix-cache-handling.patch
+alsa-timer-fix-oops-at-closing-slave-timer.patch
+alsa-snd-usb-caiaq-fix-keymap-for-rigkontrol3.patch
+alsa-snd-usb-avoid-dividing-by-zero-on-invalid-input.patch
+alsa-snd-usb-operate-on-given-mixer-interface-only.patch
+alsa-snd-usb-accept-uac2-format_type-descriptors-with.patch
+ipv6-make-fragment-identifications-less-predictable.patch
+icmp-fix-regression-in-nexthop-resolution-during-replies.patch
+ipv4-constrain-ufo-fragment-sizes-to-multiples-of-8-bytes.patch
+ipv4-fix-the-reusing-of-routing-cache-entries.patch
+ipvs-free-resources-on-module-removal.patch
+net-adjust-array-index.patch
+drivers-net-niu.c-adjust-array-index.patch
+sch_sfq-fix-sfq_enqueue.patch
+ipv4-send-gratuitous-arp-for-secondary-ip-addresses-also.patch
+net-add-iff_skb_tx_shared-flag-to-priv_flags.patch
+net-audit-drivers-to-identify-those-needing-iff_tx_skb_sharing-cleared.patch
+bonding-fix-string-comparison-errors.patch
+fix-cdc-phonet-build.patch
+xfrm-fix-key-lengths-for-rfc3686-ctr-aes.patch
+sis190-rx-filter-init-is-needed-for-mac-address-change.patch
+r8169-add-support-for-d-link-530t-rev-c1-kernel-bug-38862.patch
+net-allow-netif_carrier-to-be-called-safely-from-irq.patch
+ipv4-use-rt_tos-after-some-rt_tos-conversions.patch
+gre-fix-improper-error-handling.patch
+iwlagn-5000-do-not-support-idle-mode.patch
--- /dev/null
+From aa5c8edc9934c5f0e225ad1d0b2b4cbc383a3ab8 Mon Sep 17 00:00:00 2001
+From: Klement Fish <klement2@azet.sk>
+Date: Thu, 28 Jul 2011 06:03:22 +0000
+Subject: sis190: Rx filter init is needed for MAC address change.
+
+
+From: Klement Fish <klement2@azet.sk>
+
+[ Upstream commit fe66101f14813b77d84f6450d51772a2af2b81a1 ]
+
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=34552
+
+Signed-off-by: Klement Fish <klement2@azet.sk>
+Acked-by: Francois Romieu <romieu@fr.zoreil.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/sis190.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/sis190.c
++++ b/drivers/net/sis190.c
+@@ -1824,6 +1824,16 @@ static int sis190_ioctl(struct net_devic
+ generic_mii_ioctl(&tp->mii_if, if_mii(ifr), cmd, NULL);
+ }
+
++static int sis190_mac_addr(struct net_device *dev, void *p)
++{
++ int rc;
++
++ rc = eth_mac_addr(dev, p);
++ if (!rc)
++ sis190_init_rxfilter(dev);
++ return rc;
++}
++
+ static const struct net_device_ops sis190_netdev_ops = {
+ .ndo_open = sis190_open,
+ .ndo_stop = sis190_close,
+@@ -1832,7 +1842,7 @@ static const struct net_device_ops sis19
+ .ndo_tx_timeout = sis190_tx_timeout,
+ .ndo_set_multicast_list = sis190_set_rx_mode,
+ .ndo_change_mtu = eth_change_mtu,
+- .ndo_set_mac_address = eth_mac_addr,
++ .ndo_set_mac_address = sis190_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ .ndo_poll_controller = sis190_netpoll,
--- /dev/null
+From 4422af785032a970c79bdbe423a374c9be0ec957 Mon Sep 17 00:00:00 2001
+From: Tushar Gohad <tgohad@mvista.com>
+Date: Thu, 28 Jul 2011 10:36:20 +0000
+Subject: xfrm: Fix key lengths for rfc3686(ctr(aes))
+
+
+From: Tushar Gohad <tgohad@mvista.com>
+
+[ Upstream commit 4203223a1aed862b4445fdcd260d6139603a51d9 ]
+
+Fix the min and max bit lengths for AES-CTR (RFC3686) keys.
+The number of bits in key spec is the key length (128/256)
+plus 32 bits of nonce.
+
+This change takes care of the "Invalid key length" errors
+reported by setkey when specifying 288 bit keys for aes-ctr.
+
+Signed-off-by: Tushar Gohad <tgohad@mvista.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/xfrm/xfrm_algo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/xfrm/xfrm_algo.c
++++ b/net/xfrm/xfrm_algo.c
+@@ -462,8 +462,8 @@ static struct xfrm_algo_desc ealg_list[]
+ .desc = {
+ .sadb_alg_id = SADB_X_EALG_AESCTR,
+ .sadb_alg_ivlen = 8,
+- .sadb_alg_minbits = 128,
+- .sadb_alg_maxbits = 256
++ .sadb_alg_minbits = 160,
++ .sadb_alg_maxbits = 288
+ }
+ },
+ };
projects / thirdparty / kernel / stable-queue.git / commitdiff
