Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.20-r6/0103-2.6.20.3-all-fixes.patch

    Contents of /trunk/kernel26-alx/patches-2.6.20-r6/0103-2.6.20.3-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1175 - (show annotations) (download)
    Thu Oct 14 12:15:46 2010 UTC (13 years, 6 months ago) by niro
    File size: 28252 byte(s) 
    -2.6.20-alx-r6 new magellan 0.5.2 kernel
    1 diff --git a/arch/sparc/kernel/of_device.c b/arch/sparc/kernel/of_device.c
    2 index dab6169..798b140 100644
    3 --- a/arch/sparc/kernel/of_device.c
    4 +++ b/arch/sparc/kernel/of_device.c
    5 @@ -495,7 +495,7 @@ static void __init build_device_resources(struct of_device *op,
    6 u32 *reg = (preg + (index * ((na + ns) * 4)));
    7 struct device_node *dp = op->node;
    8 struct device_node *pp = p_op->node;
    9 - struct of_bus *pbus;
    10 + struct of_bus *pbus, *dbus;
    11 u64 size, result = OF_BAD_ADDR;
    12 unsigned long flags;
    13 int dna, dns;
    14 @@ -516,6 +516,7 @@ static void __init build_device_resources(struct of_device *op,
    15
    16 dna = na;
    17 dns = ns;
    18 + dbus = bus;
    19
    20 while (1) {
    21 dp = pp;
    22 @@ -528,13 +529,13 @@ static void __init build_device_resources(struct of_device *op,
    23 pbus = of_match_bus(pp);
    24 pbus->count_cells(dp, &pna, &pns);
    25
    26 - if (build_one_resource(dp, bus, pbus, addr,
    27 + if (build_one_resource(dp, dbus, pbus, addr,
    28 dna, dns, pna))
    29 break;
    30
    31 dna = pna;
    32 dns = pns;
    33 - bus = pbus;
    34 + dbus = pbus;
    35 }
    36
    37 build_res:
    38 diff --git a/arch/sparc64/kernel/of_device.c b/arch/sparc64/kernel/of_device.c
    39 index ad74e5e..1f45985 100644
    40 --- a/arch/sparc64/kernel/of_device.c
    41 +++ b/arch/sparc64/kernel/of_device.c
    42 @@ -581,7 +581,7 @@ static void __init build_device_resources(struct of_device *op,
    43 u32 *reg = (preg + (index * ((na + ns) * 4)));
    44 struct device_node *dp = op->node;
    45 struct device_node *pp = p_op->node;
    46 - struct of_bus *pbus;
    47 + struct of_bus *pbus, *dbus;
    48 u64 size, result = OF_BAD_ADDR;
    49 unsigned long flags;
    50 int dna, dns;
    51 @@ -599,6 +599,7 @@ static void __init build_device_resources(struct of_device *op,
    52
    53 dna = na;
    54 dns = ns;
    55 + dbus = bus;
    56
    57 while (1) {
    58 dp = pp;
    59 @@ -611,13 +612,13 @@ static void __init build_device_resources(struct of_device *op,
    60 pbus = of_match_bus(pp);
    61 pbus->count_cells(dp, &pna, &pns);
    62
    63 - if (build_one_resource(dp, bus, pbus, addr,
    64 + if (build_one_resource(dp, dbus, pbus, addr,
    65 dna, dns, pna))
    66 break;
    67
    68 dna = pna;
    69 dns = pns;
    70 - bus = pbus;
    71 + dbus = pbus;
    72 }
    73
    74 build_res:
    75 diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
    76 index a44db75..a905f78 100644
    77 --- a/drivers/connector/connector.c
    78 +++ b/drivers/connector/connector.c
    79 @@ -128,7 +128,7 @@ EXPORT_SYMBOL_GPL(cn_netlink_send);
    80 */
    81 static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), void *data)
    82 {
    83 - struct cn_callback_entry *__cbq;
    84 + struct cn_callback_entry *__cbq, *__new_cbq;
    85 struct cn_dev *dev = &cdev;
    86 int err = -ENODEV;
    87
    88 @@ -148,27 +148,27 @@ static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), v
    89 } else {
    90 struct cn_callback_data *d;
    91
    92 - __cbq = kzalloc(sizeof(*__cbq), GFP_ATOMIC);
    93 - if (__cbq) {
    94 - d = &__cbq->data;
    95 + err = -ENOMEM;
    96 + __new_cbq = kzalloc(sizeof(struct cn_callback_entry), GFP_ATOMIC);
    97 + if (__new_cbq) {
    98 + d = &__new_cbq->data;
    99 d->callback_priv = msg;
    100 d->callback = __cbq->data.callback;
    101 d->ddata = data;
    102 d->destruct_data = destruct_data;
    103 - d->free = __cbq;
    104 + d->free = __new_cbq;
    105
    106 - INIT_WORK(&__cbq->work,
    107 + INIT_WORK(&__new_cbq->work,
    108 &cn_queue_wrapper);
    109 -
    110 +
    111 if (queue_work(dev->cbdev->cn_queue,
    112 - &__cbq->work))
    113 + &__new_cbq->work))
    114 err = 0;
    115 else {
    116 - kfree(__cbq);
    117 + kfree(__new_cbq);
    118 err = -EINVAL;
    119 }
    120 - } else
    121 - err = -ENOMEM;
    122 + }
    123 }
    124 break;
    125 }
    126 diff --git a/drivers/net/wireless/bcm43xx/bcm43xx.h b/drivers/net/wireless/bcm43xx/bcm43xx.h
    127 index 02ad9b1..38ea6b9 100644
    128 --- a/drivers/net/wireless/bcm43xx/bcm43xx.h
    129 +++ b/drivers/net/wireless/bcm43xx/bcm43xx.h
    130 @@ -766,6 +766,7 @@ struct bcm43xx_private {
    131 * This is currently always BCM43xx_BUSTYPE_PCI
    132 */
    133 u8 bustype;
    134 + u64 dma_mask;
    135
    136 u16 board_vendor;
    137 u16 board_type;
    138 diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
    139 index 978ed09..6e0dc76 100644
    140 --- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
    141 +++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
    142 @@ -145,16 +145,14 @@ dma_addr_t map_descbuffer(struct bcm43xx_dmaring *ring,
    143 int tx)
    144 {
    145 dma_addr_t dmaaddr;
    146 + int direction = PCI_DMA_FROMDEVICE;
    147
    148 - if (tx) {
    149 - dmaaddr = dma_map_single(&ring->bcm->pci_dev->dev,
    150 - buf, len,
    151 - DMA_TO_DEVICE);
    152 - } else {
    153 - dmaaddr = dma_map_single(&ring->bcm->pci_dev->dev,
    154 + if (tx)
    155 + direction = PCI_DMA_TODEVICE;
    156 +
    157 + dmaaddr = pci_map_single(ring->bcm->pci_dev,
    158 buf, len,
    159 - DMA_FROM_DEVICE);
    160 - }
    161 + direction);
    162
    163 return dmaaddr;
    164 }
    165 @@ -166,13 +164,13 @@ void unmap_descbuffer(struct bcm43xx_dmaring *ring,
    166 int tx)
    167 {
    168 if (tx) {
    169 - dma_unmap_single(&ring->bcm->pci_dev->dev,
    170 + pci_unmap_single(ring->bcm->pci_dev,
    171 addr, len,
    172 - DMA_TO_DEVICE);
    173 + PCI_DMA_TODEVICE);
    174 } else {
    175 - dma_unmap_single(&ring->bcm->pci_dev->dev,
    176 + pci_unmap_single(ring->bcm->pci_dev,
    177 addr, len,
    178 - DMA_FROM_DEVICE);
    179 + PCI_DMA_FROMDEVICE);
    180 }
    181 }
    182
    183 @@ -183,8 +181,8 @@ void sync_descbuffer_for_cpu(struct bcm43xx_dmaring *ring,
    184 {
    185 assert(!ring->tx);
    186
    187 - dma_sync_single_for_cpu(&ring->bcm->pci_dev->dev,
    188 - addr, len, DMA_FROM_DEVICE);
    189 + pci_dma_sync_single_for_cpu(ring->bcm->pci_dev,
    190 + addr, len, PCI_DMA_FROMDEVICE);
    191 }
    192
    193 static inline
    194 @@ -194,8 +192,8 @@ void sync_descbuffer_for_device(struct bcm43xx_dmaring *ring,
    195 {
    196 assert(!ring->tx);
    197
    198 - dma_sync_single_for_device(&ring->bcm->pci_dev->dev,
    199 - addr, len, DMA_FROM_DEVICE);
    200 + pci_dma_sync_single_for_cpu(ring->bcm->pci_dev,
    201 + addr, len, PCI_DMA_TODEVICE);
    202 }
    203
    204 /* Unmap and free a descriptor buffer. */
    205 @@ -214,17 +212,53 @@ void free_descriptor_buffer(struct bcm43xx_dmaring *ring,
    206
    207 static int alloc_ringmemory(struct bcm43xx_dmaring *ring)
    208 {
    209 - struct device *dev = &(ring->bcm->pci_dev->dev);
    210 -
    211 - ring->descbase = dma_alloc_coherent(dev, BCM43xx_DMA_RINGMEMSIZE,
    212 - &(ring->dmabase), GFP_KERNEL);
    213 + ring->descbase = pci_alloc_consistent(ring->bcm->pci_dev, BCM43xx_DMA_RINGMEMSIZE,
    214 + &(ring->dmabase));
    215 if (!ring->descbase) {
    216 - printk(KERN_ERR PFX "DMA ringmemory allocation failed\n");
    217 - return -ENOMEM;
    218 + /* Allocation may have failed due to pci_alloc_consistent
    219 + insisting on use of GFP_DMA, which is more restrictive
    220 + than necessary... */
    221 + struct dma_desc *rx_ring;
    222 + dma_addr_t rx_ring_dma;
    223 +
    224 + rx_ring = kzalloc(BCM43xx_DMA_RINGMEMSIZE, GFP_KERNEL);
    225 + if (!rx_ring)
    226 + goto out_err;
    227 +
    228 + rx_ring_dma = pci_map_single(ring->bcm->pci_dev, rx_ring,
    229 + BCM43xx_DMA_RINGMEMSIZE,
    230 + PCI_DMA_BIDIRECTIONAL);
    231 +
    232 + if (pci_dma_mapping_error(rx_ring_dma) ||
    233 + rx_ring_dma + BCM43xx_DMA_RINGMEMSIZE > ring->bcm->dma_mask) {
    234 + /* Sigh... */
    235 + if (!pci_dma_mapping_error(rx_ring_dma))
    236 + pci_unmap_single(ring->bcm->pci_dev,
    237 + rx_ring_dma, BCM43xx_DMA_RINGMEMSIZE,
    238 + PCI_DMA_BIDIRECTIONAL);
    239 + rx_ring_dma = pci_map_single(ring->bcm->pci_dev,
    240 + rx_ring, BCM43xx_DMA_RINGMEMSIZE,
    241 + PCI_DMA_BIDIRECTIONAL);
    242 + if (pci_dma_mapping_error(rx_ring_dma) ||
    243 + rx_ring_dma + BCM43xx_DMA_RINGMEMSIZE > ring->bcm->dma_mask) {
    244 + assert(0);
    245 + if (!pci_dma_mapping_error(rx_ring_dma))
    246 + pci_unmap_single(ring->bcm->pci_dev,
    247 + rx_ring_dma, BCM43xx_DMA_RINGMEMSIZE,
    248 + PCI_DMA_BIDIRECTIONAL);
    249 + goto out_err;
    250 + }
    251 + }
    252 +
    253 + ring->descbase = rx_ring;
    254 + ring->dmabase = rx_ring_dma;
    255 }
    256 memset(ring->descbase, 0, BCM43xx_DMA_RINGMEMSIZE);
    257
    258 return 0;
    259 +out_err:
    260 + printk(KERN_ERR PFX "DMA ringmemory allocation failed\n");
    261 + return -ENOMEM;
    262 }
    263
    264 static void free_ringmemory(struct bcm43xx_dmaring *ring)
    265 @@ -407,6 +441,29 @@ static int setup_rx_descbuffer(struct bcm43xx_dmaring *ring,
    266 if (unlikely(!skb))
    267 return -ENOMEM;
    268 dmaaddr = map_descbuffer(ring, skb->data, ring->rx_buffersize, 0);
    269 + /* This hardware bug work-around adapted from the b44 driver.
    270 + The chip may be unable to do PCI DMA to/from anything above 1GB */
    271 + if (pci_dma_mapping_error(dmaaddr) ||
    272 + dmaaddr + ring->rx_buffersize > ring->bcm->dma_mask) {
    273 + /* This one has 30-bit addressing... */
    274 + if (!pci_dma_mapping_error(dmaaddr))
    275 + pci_unmap_single(ring->bcm->pci_dev,
    276 + dmaaddr, ring->rx_buffersize,
    277 + PCI_DMA_FROMDEVICE);
    278 + dev_kfree_skb_any(skb);
    279 + skb = __dev_alloc_skb(ring->rx_buffersize,GFP_DMA);
    280 + if (skb == NULL)
    281 + return -ENOMEM;
    282 + dmaaddr = pci_map_single(ring->bcm->pci_dev,
    283 + skb->data, ring->rx_buffersize,
    284 + PCI_DMA_FROMDEVICE);
    285 + if (pci_dma_mapping_error(dmaaddr) ||
    286 + dmaaddr + ring->rx_buffersize > ring->bcm->dma_mask) {
    287 + assert(0);
    288 + dev_kfree_skb_any(skb);
    289 + return -ENOMEM;
    290 + }
    291 + }
    292 meta->skb = skb;
    293 meta->dmaaddr = dmaaddr;
    294 skb->dev = ring->bcm->net_dev;
    295 @@ -636,8 +693,10 @@ struct bcm43xx_dmaring * bcm43xx_setup_dmaring(struct bcm43xx_private *bcm,
    296 err = dmacontroller_setup(ring);
    297 if (err)
    298 goto err_free_ringmemory;
    299 + return ring;
    300
    301 out:
    302 + printk(KERN_ERR PFX "Error in bcm43xx_setup_dmaring\n");
    303 return ring;
    304
    305 err_free_ringmemory:
    306 @@ -705,30 +764,16 @@ int bcm43xx_dma_init(struct bcm43xx_private *bcm)
    307 struct bcm43xx_dmaring *ring;
    308 int err = -ENOMEM;
    309 int dma64 = 0;
    310 - u64 mask = bcm43xx_get_supported_dma_mask(bcm);
    311 - int nobits;
    312
    313 - if (mask == DMA_64BIT_MASK) {
    314 + bcm->dma_mask = bcm43xx_get_supported_dma_mask(bcm);
    315 + if (bcm->dma_mask == DMA_64BIT_MASK)
    316 dma64 = 1;
    317 - nobits = 64;
    318 - } else if (mask == DMA_32BIT_MASK)
    319 - nobits = 32;
    320 - else
    321 - nobits = 30;
    322 - err = pci_set_dma_mask(bcm->pci_dev, mask);
    323 - err |= pci_set_consistent_dma_mask(bcm->pci_dev, mask);
    324 - if (err) {
    325 -#ifdef CONFIG_BCM43XX_PIO
    326 - printk(KERN_WARNING PFX "DMA not supported on this device."
    327 - " Falling back to PIO.\n");
    328 - bcm->__using_pio = 1;
    329 - return -ENOSYS;
    330 -#else
    331 - printk(KERN_ERR PFX "FATAL: DMA not supported and PIO not configured. "
    332 - "Please recompile the driver with PIO support.\n");
    333 - return -ENODEV;
    334 -#endif /* CONFIG_BCM43XX_PIO */
    335 - }
    336 + err = pci_set_dma_mask(bcm->pci_dev, bcm->dma_mask);
    337 + if (err)
    338 + goto no_dma;
    339 + err = pci_set_consistent_dma_mask(bcm->pci_dev, bcm->dma_mask);
    340 + if (err)
    341 + goto no_dma;
    342
    343 /* setup TX DMA channels. */
    344 ring = bcm43xx_setup_dmaring(bcm, 0, 1, dma64);
    345 @@ -774,7 +819,9 @@ int bcm43xx_dma_init(struct bcm43xx_private *bcm)
    346 dma->rx_ring3 = ring;
    347 }
    348
    349 - dprintk(KERN_INFO PFX "%d-bit DMA initialized\n", nobits);
    350 + dprintk(KERN_INFO PFX "%d-bit DMA initialized\n",
    351 + (bcm->dma_mask == DMA_64BIT_MASK) ? 64 :
    352 + (bcm->dma_mask == DMA_32BIT_MASK) ? 32 : 30);
    353 err = 0;
    354 out:
    355 return err;
    356 @@ -800,7 +847,17 @@ err_destroy_tx1:
    357 err_destroy_tx0:
    358 bcm43xx_destroy_dmaring(dma->tx_ring0);
    359 dma->tx_ring0 = NULL;
    360 - goto out;
    361 +no_dma:
    362 +#ifdef CONFIG_BCM43XX_PIO
    363 + printk(KERN_WARNING PFX "DMA not supported on this device."
    364 + " Falling back to PIO.\n");
    365 + bcm->__using_pio = 1;
    366 + return -ENOSYS;
    367 +#else
    368 + printk(KERN_ERR PFX "FATAL: DMA not supported and PIO not configured. "
    369 + "Please recompile the driver with PIO support.\n");
    370 + return -ENODEV;
    371 +#endif /* CONFIG_BCM43XX_PIO */
    372 }
    373
    374 /* Generate a cookie for the TX header. */
    375 @@ -905,6 +962,7 @@ static void dma_tx_fragment(struct bcm43xx_dmaring *ring,
    376 struct bcm43xx_dmadesc_generic *desc;
    377 struct bcm43xx_dmadesc_meta *meta;
    378 dma_addr_t dmaaddr;
    379 + struct sk_buff *bounce_skb;
    380
    381 assert(skb_shinfo(skb)->nr_frags == 0);
    382
    383 @@ -924,9 +982,28 @@ static void dma_tx_fragment(struct bcm43xx_dmaring *ring,
    384 skb->len - sizeof(struct bcm43xx_txhdr),
    385 (cur_frag == 0),
    386 generate_cookie(ring, slot));
    387 + dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
    388 + if (dma_mapping_error(dmaaddr) || dmaaddr + skb->len > ring->bcm->dma_mask) {
    389 + /* chip cannot handle DMA to/from > 1GB, use bounce buffer (copied from b44 driver) */
    390 + if (!dma_mapping_error(dmaaddr))
    391 + unmap_descbuffer(ring, dmaaddr, skb->len, 1);
    392 + bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC|GFP_DMA);
    393 + if (!bounce_skb)
    394 + return;
    395 + dmaaddr = map_descbuffer(ring, bounce_skb->data, bounce_skb->len, 1);
    396 + if (dma_mapping_error(dmaaddr) || dmaaddr + skb->len > ring->bcm->dma_mask) {
    397 + if (!dma_mapping_error(dmaaddr))
    398 + unmap_descbuffer(ring, dmaaddr, skb->len, 1);
    399 + dev_kfree_skb_any(bounce_skb);
    400 + assert(0);
    401 + return;
    402 + }
    403 + memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
    404 + dev_kfree_skb_any(skb);
    405 + skb = bounce_skb;
    406 + }
    407
    408 meta->skb = skb;
    409 - dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
    410 meta->dmaaddr = dmaaddr;
    411
    412 fill_descriptor(ring, desc, dmaaddr,
    413 diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
    414 index 30ee3d7..614c2c9 100644
    415 --- a/drivers/scsi/scsi_debug.c
    416 +++ b/drivers/scsi/scsi_debug.c
    417 @@ -954,7 +954,9 @@ static int resp_inquiry(struct scsi_cmnd * scp, int target,
    418 int alloc_len, n, ret;
    419
    420 alloc_len = (cmd[3] << 8) + cmd[4];
    421 - arr = kzalloc(SDEBUG_MAX_INQ_ARR_SZ, GFP_KERNEL);
    422 + arr = kzalloc(SDEBUG_MAX_INQ_ARR_SZ, GFP_ATOMIC);
    423 + if (! arr)
    424 + return DID_REQUEUE << 16;
    425 if (devip->wlun)
    426 pq_pdt = 0x1e; /* present, wlun */
    427 else if (scsi_debug_no_lun_0 && (0 == devip->lun))
    428 @@ -1217,7 +1219,9 @@ static int resp_report_tgtpgs(struct scsi_cmnd * scp,
    429 alen = ((cmd[6] << 24) + (cmd[7] << 16) + (cmd[8] << 8)
    430 + cmd[9]);
    431
    432 - arr = kzalloc(SDEBUG_MAX_TGTPGS_ARR_SZ, GFP_KERNEL);
    433 + arr = kzalloc(SDEBUG_MAX_TGTPGS_ARR_SZ, GFP_ATOMIC);
    434 + if (! arr)
    435 + return DID_REQUEUE << 16;
    436 /*
    437 * EVPD page 0x88 states we have two ports, one
    438 * real and a fake port with no device connected.
    439 @@ -1996,6 +2000,8 @@ static int scsi_debug_slave_configure(struct scsi_device * sdp)
    440 if (sdp->host->max_cmd_len != SCSI_DEBUG_MAX_CMD_LEN)
    441 sdp->host->max_cmd_len = SCSI_DEBUG_MAX_CMD_LEN;
    442 devip = devInfoReg(sdp);
    443 + if (NULL == devip)
    444 + return 1; /* no resources, will be marked offline */
    445 sdp->hostdata = devip;
    446 if (sdp->host->cmd_per_lun)
    447 scsi_adjust_queue_depth(sdp, SDEBUG_TAGGED_QUEUING,
    448 @@ -2044,7 +2050,7 @@ static struct sdebug_dev_info * devInfoReg(struct scsi_device * sdev)
    449 }
    450 }
    451 if (NULL == open_devip) { /* try and make a new one */
    452 - open_devip = kzalloc(sizeof(*open_devip),GFP_KERNEL);
    453 + open_devip = kzalloc(sizeof(*open_devip),GFP_ATOMIC);
    454 if (NULL == open_devip) {
    455 printk(KERN_ERR "%s: out of memory at line %d\n",
    456 __FUNCTION__, __LINE__);
    457 diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
    458 index 9d2fdfd..e6966f1 100644
    459 --- a/drivers/usb/serial/keyspan.c
    460 +++ b/drivers/usb/serial/keyspan.c
    461 @@ -1275,11 +1275,31 @@ static int keyspan_fake_startup (struct usb_serial *serial)
    462 }
    463
    464 /* Helper functions used by keyspan_setup_urbs */
    465 +static struct usb_endpoint_descriptor const *find_ep(struct usb_serial const *serial,
    466 + int endpoint)
    467 +{
    468 + struct usb_host_interface *iface_desc;
    469 + struct usb_endpoint_descriptor *ep;
    470 + int i;
    471 +
    472 + iface_desc = serial->interface->cur_altsetting;
    473 + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
    474 + ep = &iface_desc->endpoint[i].desc;
    475 + if (ep->bEndpointAddress == endpoint)
    476 + return ep;
    477 + }
    478 + dev_warn(&serial->interface->dev, "found no endpoint descriptor for "
    479 + "endpoint %x\n", endpoint);
    480 + return NULL;
    481 +}
    482 +
    483 static struct urb *keyspan_setup_urb (struct usb_serial *serial, int endpoint,
    484 int dir, void *ctx, char *buf, int len,
    485 void (*callback)(struct urb *))
    486 {
    487 struct urb *urb;
    488 + struct usb_endpoint_descriptor const *ep_desc;
    489 + char const *ep_type_name;
    490
    491 if (endpoint == -1)
    492 return NULL; /* endpoint not needed */
    493 @@ -1291,11 +1311,32 @@ static struct urb *keyspan_setup_urb (struct usb_serial *serial, int endpoint,
    494 return NULL;
    495 }
    496
    497 - /* Fill URB using supplied data. */
    498 - usb_fill_bulk_urb(urb, serial->dev,
    499 - usb_sndbulkpipe(serial->dev, endpoint) | dir,
    500 - buf, len, callback, ctx);
    501 + ep_desc = find_ep(serial, endpoint);
    502 + if (!ep_desc) {
    503 + /* leak the urb, something's wrong and the callers don't care */
    504 + return urb;
    505 + }
    506 + if (usb_endpoint_xfer_int(ep_desc)) {
    507 + ep_type_name = "INT";
    508 + usb_fill_int_urb(urb, serial->dev,
    509 + usb_sndintpipe(serial->dev, endpoint) | dir,
    510 + buf, len, callback, ctx,
    511 + ep_desc->bInterval);
    512 + } else if (usb_endpoint_xfer_bulk(ep_desc)) {
    513 + ep_type_name = "BULK";
    514 + usb_fill_bulk_urb(urb, serial->dev,
    515 + usb_sndbulkpipe(serial->dev, endpoint) | dir,
    516 + buf, len, callback, ctx);
    517 + } else {
    518 + dev_warn(&serial->interface->dev,
    519 + "unsupported endpoint type %x\n",
    520 + ep_desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
    521 + usb_free_urb(urb);
    522 + return NULL;
    523 + }
    524
    525 + dbg("%s - using urb %p for %s endpoint %x",
    526 + __func__, urb, ep_type_name, endpoint);
    527 return urb;
    528 }
    529
    530 diff --git a/include/linux/netfilter_ipv4/ip_conntrack_core.h b/include/linux/netfilter_ipv4/ip_conntrack_core.h
    531 index 907d4f5..e3a6df0 100644
    532 --- a/include/linux/netfilter_ipv4/ip_conntrack_core.h
    533 +++ b/include/linux/netfilter_ipv4/ip_conntrack_core.h
    534 @@ -45,7 +45,7 @@ static inline int ip_conntrack_confirm(struct sk_buff **pskb)
    535 int ret = NF_ACCEPT;
    536
    537 if (ct) {
    538 - if (!is_confirmed(ct))
    539 + if (!is_confirmed(ct) && !is_dying(ct))
    540 ret = __ip_conntrack_confirm(pskb);
    541 ip_ct_deliver_cached_events(ct);
    542 }
    543 diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
    544 index f7be1ac..09a2532 100644
    545 --- a/include/net/inet_timewait_sock.h
    546 +++ b/include/net/inet_timewait_sock.h
    547 @@ -66,7 +66,7 @@ struct inet_hashinfo;
    548 struct inet_timewait_death_row {
    549 /* Short-time timewait calendar */
    550 int twcal_hand;
    551 - int twcal_jiffie;
    552 + unsigned long twcal_jiffie;
    553 struct timer_list twcal_timer;
    554 struct hlist_head twcal_row[INET_TWDR_RECYCLE_SLOTS];
    555
    556 diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
    557 index 7fdc72c..85634e1 100644
    558 --- a/include/net/netfilter/nf_conntrack_core.h
    559 +++ b/include/net/netfilter/nf_conntrack_core.h
    560 @@ -64,7 +64,7 @@ static inline int nf_conntrack_confirm(struct sk_buff **pskb)
    561 int ret = NF_ACCEPT;
    562
    563 if (ct) {
    564 - if (!nf_ct_is_confirmed(ct))
    565 + if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
    566 ret = __nf_conntrack_confirm(pskb);
    567 nf_ct_deliver_cached_events(ct);
    568 }
    569 diff --git a/net/core/sock.c b/net/core/sock.c
    570 index 0ed5b4f..b69192b 100644
    571 --- a/net/core/sock.c
    572 +++ b/net/core/sock.c
    573 @@ -1597,7 +1597,7 @@ int compat_sock_common_getsockopt(struct socket *sock, int level, int optname,
    574 {
    575 struct sock *sk = sock->sk;
    576
    577 - if (sk->sk_prot->compat_setsockopt != NULL)
    578 + if (sk->sk_prot->compat_getsockopt != NULL)
    579 return sk->sk_prot->compat_getsockopt(sk, level, optname,
    580 optval, optlen);
    581 return sk->sk_prot->getsockopt(sk, level, optname, optval, optlen);
    582 diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
    583 index 8556a4f..f8b3009 100644
    584 --- a/net/ipv4/netfilter/ip_conntrack_core.c
    585 +++ b/net/ipv4/netfilter/ip_conntrack_core.c
    586 @@ -1242,7 +1242,7 @@ get_next_corpse(int (*iter)(struct ip_conntrack *i, void *data),
    587 list_for_each_entry(h, &unconfirmed, list) {
    588 ct = tuplehash_to_ctrack(h);
    589 if (iter(ct, data))
    590 - goto found;
    591 + set_bit(IPS_DYING_BIT, &ct->status);
    592 }
    593 write_unlock_bh(&ip_conntrack_lock);
    594 return NULL;
    595 diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
    596 index 06e4e8a..4cd76ed 100644
    597 --- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
    598 +++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
    599 @@ -821,8 +821,10 @@ void ip_conntrack_tcp_update(struct sk_buff *skb,
    600 static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
    601 {
    602 [TH_SYN] = 1,
    603 - [TH_SYN|TH_ACK] = 1,
    604 [TH_SYN|TH_PUSH] = 1,
    605 + [TH_SYN|TH_URG] = 1,
    606 + [TH_SYN|TH_PUSH|TH_URG] = 1,
    607 + [TH_SYN|TH_ACK] = 1,
    608 [TH_SYN|TH_ACK|TH_PUSH] = 1,
    609 [TH_RST] = 1,
    610 [TH_RST|TH_ACK] = 1,
    611 diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
    612 index 86a9227..8de7188 100644
    613 --- a/net/ipv4/netfilter/nf_nat_core.c
    614 +++ b/net/ipv4/netfilter/nf_nat_core.c
    615 @@ -540,8 +540,7 @@ void nf_nat_protocol_unregister(struct nf_nat_protocol *proto)
    616 }
    617 EXPORT_SYMBOL(nf_nat_protocol_unregister);
    618
    619 -#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
    620 - defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
    621 +#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
    622 int
    623 nf_nat_port_range_to_nfattr(struct sk_buff *skb,
    624 const struct nf_nat_range *range)
    625 diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
    626 index d3de579..e5a34c1 100644
    627 --- a/net/ipv4/netfilter/nf_nat_proto_gre.c
    628 +++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
    629 @@ -152,8 +152,7 @@ static struct nf_nat_protocol gre __read_mostly = {
    630 .manip_pkt = gre_manip_pkt,
    631 .in_range = gre_in_range,
    632 .unique_tuple = gre_unique_tuple,
    633 -#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
    634 - defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
    635 +#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
    636 .range_to_nfattr = nf_nat_port_range_to_nfattr,
    637 .nfattr_to_range = nf_nat_port_nfattr_to_range,
    638 #endif
    639 diff --git a/net/ipv4/netfilter/nf_nat_proto_icmp.c b/net/ipv4/netfilter/nf_nat_proto_icmp.c
    640 index dcfd772..b93c78a 100644
    641 --- a/net/ipv4/netfilter/nf_nat_proto_icmp.c
    642 +++ b/net/ipv4/netfilter/nf_nat_proto_icmp.c
    643 @@ -78,8 +78,7 @@ struct nf_nat_protocol nf_nat_protocol_icmp = {
    644 .manip_pkt = icmp_manip_pkt,
    645 .in_range = icmp_in_range,
    646 .unique_tuple = icmp_unique_tuple,
    647 -#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
    648 - defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
    649 +#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
    650 .range_to_nfattr = nf_nat_port_range_to_nfattr,
    651 .nfattr_to_range = nf_nat_port_nfattr_to_range,
    652 #endif
    653 diff --git a/net/ipv4/netfilter/nf_nat_proto_tcp.c b/net/ipv4/netfilter/nf_nat_proto_tcp.c
    654 index 7e26a7e..f6b99d6 100644
    655 --- a/net/ipv4/netfilter/nf_nat_proto_tcp.c
    656 +++ b/net/ipv4/netfilter/nf_nat_proto_tcp.c
    657 @@ -140,8 +140,7 @@ struct nf_nat_protocol nf_nat_protocol_tcp = {
    658 .manip_pkt = tcp_manip_pkt,
    659 .in_range = tcp_in_range,
    660 .unique_tuple = tcp_unique_tuple,
    661 -#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
    662 - defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
    663 +#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
    664 .range_to_nfattr = nf_nat_port_range_to_nfattr,
    665 .nfattr_to_range = nf_nat_port_nfattr_to_range,
    666 #endif
    667 diff --git a/net/ipv4/netfilter/nf_nat_proto_udp.c b/net/ipv4/netfilter/nf_nat_proto_udp.c
    668 index ab0ce4c..c00ab6e 100644
    669 --- a/net/ipv4/netfilter/nf_nat_proto_udp.c
    670 +++ b/net/ipv4/netfilter/nf_nat_proto_udp.c
    671 @@ -130,8 +130,7 @@ struct nf_nat_protocol nf_nat_protocol_udp = {
    672 .manip_pkt = udp_manip_pkt,
    673 .in_range = udp_in_range,
    674 .unique_tuple = udp_unique_tuple,
    675 -#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
    676 - defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
    677 +#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
    678 .range_to_nfattr = nf_nat_port_range_to_nfattr,
    679 .nfattr_to_range = nf_nat_port_nfattr_to_range,
    680 #endif
    681 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    682 index cfff930..f8068b0 100644
    683 --- a/net/ipv4/udp.c
    684 +++ b/net/ipv4/udp.c
    685 @@ -1214,6 +1214,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
    686
    687 if (ulen < sizeof(*uh) || pskb_trim_rcsum(skb, ulen))
    688 goto short_packet;
    689 + uh = skb->h.uh;
    690
    691 udp4_csum_init(skb, uh);
    692
    693 diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
    694 index f6294e5..ca50b58 100644
    695 --- a/net/ipv6/netfilter.c
    696 +++ b/net/ipv6/netfilter.c
    697 @@ -15,6 +15,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
    698 struct dst_entry *dst;
    699 struct flowi fl = {
    700 .oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
    701 + .mark = skb->mark,
    702 .nl_u =
    703 { .ip6_u =
    704 { .daddr = iph->daddr,
    705 diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
    706 index a20615f..6155b80 100644
    707 --- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
    708 +++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
    709 @@ -257,6 +257,7 @@ static unsigned int ipv6_conntrack_in(unsigned int hooknum,
    710 }
    711 nf_conntrack_get(reasm->nfct);
    712 (*pskb)->nfct = reasm->nfct;
    713 + (*pskb)->nfctinfo = reasm->nfctinfo;
    714 return NF_ACCEPT;
    715 }
    716
    717 diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
    718 index 9b02ec4..cb29ba7 100644
    719 --- a/net/netfilter/nf_conntrack_core.c
    720 +++ b/net/netfilter/nf_conntrack_core.c
    721 @@ -1052,7 +1052,7 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
    722 list_for_each_entry(h, &unconfirmed, list) {
    723 ct = nf_ct_tuplehash_to_ctrack(h);
    724 if (iter(ct, data))
    725 - goto found;
    726 + set_bit(IPS_DYING_BIT, &ct->status);
    727 }
    728 write_unlock_bh(&nf_conntrack_lock);
    729 return NULL;
    730 diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
    731 index ac193ce..5434472 100644
    732 --- a/net/netfilter/nf_conntrack_proto_gre.c
    733 +++ b/net/netfilter/nf_conntrack_proto_gre.c
    734 @@ -281,8 +281,7 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 = {
    735 .new = gre_new,
    736 .destroy = gre_destroy,
    737 .me = THIS_MODULE,
    738 -#if defined(CONFIG_NF_CONNTRACK_NETLINK) || \
    739 - defined(CONFIG_NF_CONNTRACK_NETLINK_MODULE)
    740 +#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
    741 .tuple_to_nfattr = nf_ct_port_tuple_to_nfattr,
    742 .nfattr_to_tuple = nf_ct_port_nfattr_to_tuple,
    743 #endif
    744 diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
    745 index 626b001..693d189 100644
    746 --- a/net/netfilter/nf_conntrack_proto_tcp.c
    747 +++ b/net/netfilter/nf_conntrack_proto_tcp.c
    748 @@ -778,8 +778,10 @@ EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
    749 static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
    750 {
    751 [TH_SYN] = 1,
    752 - [TH_SYN|TH_ACK] = 1,
    753 [TH_SYN|TH_PUSH] = 1,
    754 + [TH_SYN|TH_URG] = 1,
    755 + [TH_SYN|TH_PUSH|TH_URG] = 1,
    756 + [TH_SYN|TH_ACK] = 1,
    757 [TH_SYN|TH_ACK|TH_PUSH] = 1,
    758 [TH_RST] = 1,
    759 [TH_RST|TH_ACK] = 1,
    760 diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
    761 index 24c1d29..690b173 100644
    762 --- a/net/netfilter/nfnetlink_log.c
    763 +++ b/net/netfilter/nfnetlink_log.c
    764 @@ -397,8 +397,8 @@ static void nfulnl_timer(unsigned long data)
    765 if (timer_pending(&inst->timer)) /* is it always true or false here? */
    766 del_timer(&inst->timer);
    767 __nfulnl_send(inst);
    768 - instance_put(inst);
    769 spin_unlock_bh(&inst->lock);
    770 + instance_put(inst);
    771 }
    772
    773 /* This is an inline function, we don't really care about a long
    774 @@ -491,7 +491,7 @@ __build_packet_message(struct nfulnl_instance *inst,
    775 * for physical device (when called from ipv4) */
    776 NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
    777 sizeof(tmp_uint), &tmp_uint);
    778 - if (skb->nf_bridge) {
    779 + if (skb->nf_bridge && skb->nf_bridge->physoutdev) {
    780 tmp_uint =
    781 htonl(skb->nf_bridge->physoutdev->ifindex);
    782 NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
    783 @@ -564,6 +564,7 @@ __build_packet_message(struct nfulnl_instance *inst,
    784 }
    785
    786 nlh->nlmsg_len = inst->skb->tail - old_tail;
    787 + inst->lastnlh = nlh;
    788 return 0;
    789
    790 nlmsg_failure:
    791 @@ -619,7 +620,7 @@ nfulnl_log_packet(unsigned int pf,
    792
    793 plen = 0;
    794 if (prefix)
    795 - plen = strlen(prefix);
    796 + plen = strlen(prefix) + 1;
    797
    798 /* all macros expand to constant values at compile time */
    799 /* FIXME: do we want to make the size calculation conditional based on
    800 @@ -720,15 +721,16 @@ nfulnl_log_packet(unsigned int pf,
    801 inst->timer.expires = jiffies + (inst->flushtimeout*HZ/100);
    802 add_timer(&inst->timer);
    803 }
    804 - spin_unlock_bh(&inst->lock);
    805
    806 +unlock_and_release:
    807 + spin_unlock_bh(&inst->lock);
    808 + instance_put(inst);
    809 return;
    810
    811 alloc_failure:
    812 - spin_unlock_bh(&inst->lock);
    813 - instance_put(inst);
    814 UDEBUG("error allocating skb\n");
    815 /* FIXME: statistics */
    816 + goto unlock_and_release;
    817 }
    818
    819 static int
    820 @@ -865,6 +867,9 @@ nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
    821 ret = -EINVAL;
    822 break;
    823 }
    824 +
    825 + if (!inst)
    826 + goto out;
    827 } else {
    828 if (!inst) {
    829 UDEBUG("no config command, and no instance for "
    830 @@ -918,6 +923,7 @@ nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
    831
    832 out_put:
    833 instance_put(inst);
    834 +out:
    835 return ret;
    836 }
    837