Annotation of /trunk/kernel26-alx/patches-2.6.20-r6/0121-2.6.20.21-all-fixes.patch
Parent Directory | Revision Log
Revision 1175 -
(hide annotations)
(download)
Thu Oct 14 12:15:46 2010 UTC (13 years, 11 months ago) by niro
File size: 36574 byte(s)
Thu Oct 14 12:15:46 2010 UTC (13 years, 11 months ago) by niro
File size: 36574 byte(s)
-2.6.20-alx-r6 new magellan 0.5.2 kernel
1 | niro | 1175 | diff --git a/arch/i386/kernel/sysenter.c b/arch/i386/kernel/sysenter.c |
2 | index 666f70d..0577312 100644 | ||
3 | --- a/arch/i386/kernel/sysenter.c | ||
4 | +++ b/arch/i386/kernel/sysenter.c | ||
5 | @@ -183,7 +183,9 @@ struct vm_area_struct *get_gate_vma(struct task_struct *tsk) | ||
6 | |||
7 | int in_gate_area(struct task_struct *task, unsigned long addr) | ||
8 | { | ||
9 | - return 0; | ||
10 | + const struct vm_area_struct *vma = get_gate_vma(task); | ||
11 | + | ||
12 | + return vma && addr >= vma->vm_start && addr < vma->vm_end; | ||
13 | } | ||
14 | |||
15 | int in_gate_area_no_task(unsigned long addr) | ||
16 | diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c | ||
17 | index f3d4dd5..21d4caf 100644 | ||
18 | --- a/arch/powerpc/kernel/process.c | ||
19 | +++ b/arch/powerpc/kernel/process.c | ||
20 | @@ -84,7 +84,7 @@ void flush_fp_to_thread(struct task_struct *tsk) | ||
21 | */ | ||
22 | BUG_ON(tsk != current); | ||
23 | #endif | ||
24 | - giveup_fpu(current); | ||
25 | + giveup_fpu(tsk); | ||
26 | } | ||
27 | preempt_enable(); | ||
28 | } | ||
29 | @@ -144,7 +144,7 @@ void flush_altivec_to_thread(struct task_struct *tsk) | ||
30 | #ifdef CONFIG_SMP | ||
31 | BUG_ON(tsk != current); | ||
32 | #endif | ||
33 | - giveup_altivec(current); | ||
34 | + giveup_altivec(tsk); | ||
35 | } | ||
36 | preempt_enable(); | ||
37 | } | ||
38 | @@ -183,7 +183,7 @@ void flush_spe_to_thread(struct task_struct *tsk) | ||
39 | #ifdef CONFIG_SMP | ||
40 | BUG_ON(tsk != current); | ||
41 | #endif | ||
42 | - giveup_spe(current); | ||
43 | + giveup_spe(tsk); | ||
44 | } | ||
45 | preempt_enable(); | ||
46 | } | ||
47 | diff --git a/arch/sparc64/kernel/traps.c b/arch/sparc64/kernel/traps.c | ||
48 | index ad67784..ab72e91 100644 | ||
49 | --- a/arch/sparc64/kernel/traps.c | ||
50 | +++ b/arch/sparc64/kernel/traps.c | ||
51 | @@ -2146,12 +2146,20 @@ static void user_instruction_dump (unsigned int __user *pc) | ||
52 | void show_stack(struct task_struct *tsk, unsigned long *_ksp) | ||
53 | { | ||
54 | unsigned long pc, fp, thread_base, ksp; | ||
55 | - void *tp = task_stack_page(tsk); | ||
56 | + struct thread_info *tp; | ||
57 | struct reg_window *rw; | ||
58 | int count = 0; | ||
59 | |||
60 | ksp = (unsigned long) _ksp; | ||
61 | - | ||
62 | + if (!tsk) | ||
63 | + tsk = current; | ||
64 | + tp = task_thread_info(tsk); | ||
65 | + if (ksp == 0UL) { | ||
66 | + if (tsk == current) | ||
67 | + asm("mov %%fp, %0" : "=r" (ksp)); | ||
68 | + else | ||
69 | + ksp = tp->ksp; | ||
70 | + } | ||
71 | if (tp == current_thread_info()) | ||
72 | flushw_all(); | ||
73 | |||
74 | @@ -2180,11 +2188,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp) | ||
75 | |||
76 | void dump_stack(void) | ||
77 | { | ||
78 | - unsigned long *ksp; | ||
79 | - | ||
80 | - __asm__ __volatile__("mov %%fp, %0" | ||
81 | - : "=r" (ksp)); | ||
82 | - show_stack(current, ksp); | ||
83 | + show_stack(current, NULL); | ||
84 | } | ||
85 | |||
86 | EXPORT_SYMBOL(dump_stack); | ||
87 | diff --git a/arch/sparc64/mm/fault.c b/arch/sparc64/mm/fault.c | ||
88 | index 55ae802..f6377b4 100644 | ||
89 | --- a/arch/sparc64/mm/fault.c | ||
90 | +++ b/arch/sparc64/mm/fault.c | ||
91 | @@ -129,15 +129,12 @@ static void __kprobes unhandled_fault(unsigned long address, | ||
92 | |||
93 | static void bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr) | ||
94 | { | ||
95 | - unsigned long *ksp; | ||
96 | - | ||
97 | printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n", | ||
98 | regs->tpc); | ||
99 | printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]); | ||
100 | print_symbol("RPC: <%s>\n", regs->u_regs[15]); | ||
101 | printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr); | ||
102 | - __asm__("mov %%sp, %0" : "=r" (ksp)); | ||
103 | - show_stack(current, ksp); | ||
104 | + dump_stack(); | ||
105 | unhandled_fault(regs->tpc, current, regs); | ||
106 | } | ||
107 | |||
108 | diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c | ||
109 | index 38c293b..dbb0192 100644 | ||
110 | --- a/block/ll_rw_blk.c | ||
111 | +++ b/block/ll_rw_blk.c | ||
112 | @@ -1072,12 +1072,6 @@ void blk_queue_end_tag(request_queue_t *q, struct request *rq) | ||
113 | */ | ||
114 | return; | ||
115 | |||
116 | - if (unlikely(!__test_and_clear_bit(tag, bqt->tag_map))) { | ||
117 | - printk(KERN_ERR "%s: attempt to clear non-busy tag (%d)\n", | ||
118 | - __FUNCTION__, tag); | ||
119 | - return; | ||
120 | - } | ||
121 | - | ||
122 | list_del_init(&rq->queuelist); | ||
123 | rq->cmd_flags &= ~REQ_QUEUED; | ||
124 | rq->tag = -1; | ||
125 | @@ -1087,6 +1081,13 @@ void blk_queue_end_tag(request_queue_t *q, struct request *rq) | ||
126 | __FUNCTION__, tag); | ||
127 | |||
128 | bqt->tag_index[tag] = NULL; | ||
129 | + | ||
130 | + if (unlikely(!test_and_clear_bit(tag, bqt->tag_map))) { | ||
131 | + printk(KERN_ERR "%s: attempt to clear non-busy tag (%d)\n", | ||
132 | + __FUNCTION__, tag); | ||
133 | + return; | ||
134 | + } | ||
135 | + | ||
136 | bqt->busy--; | ||
137 | } | ||
138 | |||
139 | diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c | ||
140 | index 6e93004..cb95fa8 100644 | ||
141 | --- a/crypto/blkcipher.c | ||
142 | +++ b/crypto/blkcipher.c | ||
143 | @@ -58,11 +58,13 @@ static inline void blkcipher_unmap_dst(struct blkcipher_walk *walk) | ||
144 | scatterwalk_unmap(walk->dst.virt.addr, 1); | ||
145 | } | ||
146 | |||
147 | +/* Get a spot of the specified length that does not straddle a page. | ||
148 | + * The caller needs to ensure that there is enough space for this operation. | ||
149 | + */ | ||
150 | static inline u8 *blkcipher_get_spot(u8 *start, unsigned int len) | ||
151 | { | ||
152 | - if (offset_in_page(start + len) < len) | ||
153 | - return (u8 *)((unsigned long)(start + len) & PAGE_MASK); | ||
154 | - return start; | ||
155 | + u8 *end_page = (u8 *)(((unsigned long)(start + len - 1)) & PAGE_MASK); | ||
156 | + return start > end_page ? start : end_page; | ||
157 | } | ||
158 | |||
159 | static inline unsigned int blkcipher_done_slow(struct crypto_blkcipher *tfm, | ||
160 | @@ -154,7 +156,8 @@ static inline int blkcipher_next_slow(struct blkcipher_desc *desc, | ||
161 | if (walk->buffer) | ||
162 | goto ok; | ||
163 | |||
164 | - n = bsize * 2 + (alignmask & ~(crypto_tfm_ctx_alignment() - 1)); | ||
165 | + n = bsize * 3 - (alignmask + 1) + | ||
166 | + (alignmask & ~(crypto_tfm_ctx_alignment() - 1)); | ||
167 | walk->buffer = kmalloc(n, GFP_ATOMIC); | ||
168 | if (!walk->buffer) | ||
169 | return blkcipher_walk_done(desc, walk, -ENOMEM); | ||
170 | diff --git a/drivers/acpi/events/evgpeblk.c b/drivers/acpi/events/evgpeblk.c | ||
171 | index 95ddeb4..2ae48c2 100644 | ||
172 | --- a/drivers/acpi/events/evgpeblk.c | ||
173 | +++ b/drivers/acpi/events/evgpeblk.c | ||
174 | @@ -586,6 +586,10 @@ acpi_ev_delete_gpe_xrupt(struct acpi_gpe_xrupt_info *gpe_xrupt) | ||
175 | flags = acpi_os_acquire_lock(acpi_gbl_gpe_lock); | ||
176 | if (gpe_xrupt->previous) { | ||
177 | gpe_xrupt->previous->next = gpe_xrupt->next; | ||
178 | + } else { | ||
179 | + /* No previous, update list head */ | ||
180 | + | ||
181 | + acpi_gbl_gpe_xrupt_list_head = gpe_xrupt->next; | ||
182 | } | ||
183 | |||
184 | if (gpe_xrupt->next) { | ||
185 | diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c | ||
186 | index 9a48ca2..3fc3895 100644 | ||
187 | --- a/drivers/ieee1394/ieee1394_core.c | ||
188 | +++ b/drivers/ieee1394/ieee1394_core.c | ||
189 | @@ -1170,7 +1170,7 @@ static void __exit ieee1394_cleanup(void) | ||
190 | unregister_chrdev_region(IEEE1394_CORE_DEV, 256); | ||
191 | } | ||
192 | |||
193 | -fs_initcall(ieee1394_init); /* same as ohci1394 */ | ||
194 | +module_init(ieee1394_init); | ||
195 | module_exit(ieee1394_cleanup); | ||
196 | |||
197 | /* Exported symbols */ | ||
198 | diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c | ||
199 | index 628130a..ec301a8 100644 | ||
200 | --- a/drivers/ieee1394/ohci1394.c | ||
201 | +++ b/drivers/ieee1394/ohci1394.c | ||
202 | @@ -3785,7 +3785,5 @@ static int __init ohci1394_init(void) | ||
203 | return pci_register_driver(&ohci1394_pci_driver); | ||
204 | } | ||
205 | |||
206 | -/* Register before most other device drivers. | ||
207 | - * Useful for remote debugging via physical DMA, e.g. using firescope. */ | ||
208 | -fs_initcall(ohci1394_init); | ||
209 | +module_init(ohci1394_init); | ||
210 | module_exit(ohci1394_cleanup); | ||
211 | diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c | ||
212 | index 1fe1a83..1093ff4 100644 | ||
213 | --- a/drivers/media/video/cx88/cx88-mpeg.c | ||
214 | +++ b/drivers/media/video/cx88/cx88-mpeg.c | ||
215 | @@ -556,7 +556,7 @@ struct cx8802_dev * cx8802_get_device(struct inode *inode) | ||
216 | |||
217 | list_for_each(list,&cx8802_devlist) { | ||
218 | h = list_entry(list, struct cx8802_dev, devlist); | ||
219 | - if (h->mpeg_dev->minor == minor) | ||
220 | + if (h->mpeg_dev && h->mpeg_dev->minor == minor) | ||
221 | return h; | ||
222 | } | ||
223 | |||
224 | diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c | ||
225 | index a996aad..957694a 100644 | ||
226 | --- a/drivers/media/video/pwc/pwc-if.c | ||
227 | +++ b/drivers/media/video/pwc/pwc-if.c | ||
228 | @@ -1196,12 +1196,19 @@ static int pwc_video_open(struct inode *inode, struct file *file) | ||
229 | return 0; | ||
230 | } | ||
231 | |||
232 | + | ||
233 | +static void pwc_cleanup(struct pwc_device *pdev) | ||
234 | +{ | ||
235 | + pwc_remove_sysfs_files(pdev->vdev); | ||
236 | + video_unregister_device(pdev->vdev); | ||
237 | +} | ||
238 | + | ||
239 | /* Note that all cleanup is done in the reverse order as in _open */ | ||
240 | static int pwc_video_close(struct inode *inode, struct file *file) | ||
241 | { | ||
242 | struct video_device *vdev = file->private_data; | ||
243 | struct pwc_device *pdev; | ||
244 | - int i; | ||
245 | + int i, hint; | ||
246 | |||
247 | PWC_DEBUG_OPEN(">> video_close called(vdev = 0x%p).\n", vdev); | ||
248 | |||
249 | @@ -1224,8 +1231,9 @@ static int pwc_video_close(struct inode *inode, struct file *file) | ||
250 | pwc_isoc_cleanup(pdev); | ||
251 | pwc_free_buffers(pdev); | ||
252 | |||
253 | + lock_kernel(); | ||
254 | /* Turn off LEDS and power down camera, but only when not unplugged */ | ||
255 | - if (pdev->error_status != EPIPE) { | ||
256 | + if (!pdev->unplugged) { | ||
257 | /* Turn LEDs off */ | ||
258 | if (pwc_set_leds(pdev, 0, 0) < 0) | ||
259 | PWC_DEBUG_MODULE("Failed to set LED on/off time.\n"); | ||
260 | @@ -1234,9 +1242,19 @@ static int pwc_video_close(struct inode *inode, struct file *file) | ||
261 | if (i < 0) | ||
262 | PWC_ERROR("Failed to power down camera (%d)\n", i); | ||
263 | } | ||
264 | + pdev->vopen--; | ||
265 | + PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", i); | ||
266 | + } else { | ||
267 | + pwc_cleanup(pdev); | ||
268 | + /* Free memory (don't set pdev to 0 just yet) */ | ||
269 | + kfree(pdev); | ||
270 | + /* search device_hint[] table if we occupy a slot, by any chance */ | ||
271 | + for (hint = 0; hint < MAX_DEV_HINTS; hint++) | ||
272 | + if (device_hint[hint].pdev == pdev) | ||
273 | + device_hint[hint].pdev = NULL; | ||
274 | } | ||
275 | - pdev->vopen--; | ||
276 | - PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", pdev->vopen); | ||
277 | + unlock_kernel(); | ||
278 | + | ||
279 | return 0; | ||
280 | } | ||
281 | |||
282 | @@ -1783,21 +1801,21 @@ static void usb_pwc_disconnect(struct usb_interface *intf) | ||
283 | /* Alert waiting processes */ | ||
284 | wake_up_interruptible(&pdev->frameq); | ||
285 | /* Wait until device is closed */ | ||
286 | - while (pdev->vopen) | ||
287 | - schedule(); | ||
288 | - /* Device is now closed, so we can safely unregister it */ | ||
289 | - PWC_DEBUG_PROBE("Unregistering video device in disconnect().\n"); | ||
290 | - pwc_remove_sysfs_files(pdev->vdev); | ||
291 | - video_unregister_device(pdev->vdev); | ||
292 | - | ||
293 | - /* Free memory (don't set pdev to 0 just yet) */ | ||
294 | - kfree(pdev); | ||
295 | + if(pdev->vopen) { | ||
296 | + pdev->unplugged = 1; | ||
297 | + } else { | ||
298 | + /* Device is closed, so we can safely unregister it */ | ||
299 | + PWC_DEBUG_PROBE("Unregistering video device in disconnect().\n"); | ||
300 | + pwc_cleanup(pdev); | ||
301 | + /* Free memory (don't set pdev to 0 just yet) */ | ||
302 | + kfree(pdev); | ||
303 | |||
304 | disconnect_out: | ||
305 | - /* search device_hint[] table if we occupy a slot, by any chance */ | ||
306 | - for (hint = 0; hint < MAX_DEV_HINTS; hint++) | ||
307 | - if (device_hint[hint].pdev == pdev) | ||
308 | - device_hint[hint].pdev = NULL; | ||
309 | + /* search device_hint[] table if we occupy a slot, by any chance */ | ||
310 | + for (hint = 0; hint < MAX_DEV_HINTS; hint++) | ||
311 | + if (device_hint[hint].pdev == pdev) | ||
312 | + device_hint[hint].pdev = NULL; | ||
313 | + } | ||
314 | |||
315 | unlock_kernel(); | ||
316 | } | ||
317 | diff --git a/drivers/media/video/pwc/pwc.h b/drivers/media/video/pwc/pwc.h | ||
318 | index 7e9c423..7dae6c4 100644 | ||
319 | --- a/drivers/media/video/pwc/pwc.h | ||
320 | +++ b/drivers/media/video/pwc/pwc.h | ||
321 | @@ -198,6 +198,7 @@ struct pwc_device | ||
322 | char vsnapshot; /* snapshot mode */ | ||
323 | char vsync; /* used by isoc handler */ | ||
324 | char vmirror; /* for ToUCaM series */ | ||
325 | + char unplugged; | ||
326 | |||
327 | int cmd_len; | ||
328 | unsigned char cmd_buf[13]; | ||
329 | diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c | ||
330 | index c383dc3..f18edd8 100644 | ||
331 | --- a/drivers/net/forcedeth.c | ||
332 | +++ b/drivers/net/forcedeth.c | ||
333 | @@ -554,6 +554,7 @@ union ring_type { | ||
334 | #define PHY_OUI_MARVELL 0x5043 | ||
335 | #define PHY_OUI_CICADA 0x03f1 | ||
336 | #define PHY_OUI_VITESSE 0x01c1 | ||
337 | +#define PHY_OUI_REALTEK 0x0732 | ||
338 | #define PHYID1_OUI_MASK 0x03ff | ||
339 | #define PHYID1_OUI_SHFT 6 | ||
340 | #define PHYID2_OUI_MASK 0xfc00 | ||
341 | diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c | ||
342 | index 1aafa71..2847a0c 100644 | ||
343 | --- a/drivers/net/r8169.c | ||
344 | +++ b/drivers/net/r8169.c | ||
345 | @@ -2646,14 +2646,16 @@ rtl8169_interrupt(int irq, void *dev_instance) | ||
346 | rtl8169_check_link_status(dev, tp, ioaddr); | ||
347 | |||
348 | #ifdef CONFIG_R8169_NAPI | ||
349 | - RTL_W16(IntrMask, rtl8169_intr_mask & ~rtl8169_napi_event); | ||
350 | - tp->intr_mask = ~rtl8169_napi_event; | ||
351 | - | ||
352 | - if (likely(netif_rx_schedule_prep(dev))) | ||
353 | - __netif_rx_schedule(dev); | ||
354 | - else if (netif_msg_intr(tp)) { | ||
355 | - printk(KERN_INFO "%s: interrupt %04x taken in poll\n", | ||
356 | - dev->name, status); | ||
357 | + if (status & rtl8169_napi_event) { | ||
358 | + RTL_W16(IntrMask, rtl8169_intr_mask & ~rtl8169_napi_event); | ||
359 | + tp->intr_mask = ~rtl8169_napi_event; | ||
360 | + | ||
361 | + if (likely(netif_rx_schedule_prep(dev))) | ||
362 | + __netif_rx_schedule(dev); | ||
363 | + else if (netif_msg_intr(tp)) { | ||
364 | + printk(KERN_INFO "%s: interrupt %04x in poll\n", | ||
365 | + dev->name, status); | ||
366 | + } | ||
367 | } | ||
368 | break; | ||
369 | #else | ||
370 | diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c | ||
371 | index b091a0f..9040564 100644 | ||
372 | --- a/drivers/scsi/3w-9xxx.c | ||
373 | +++ b/drivers/scsi/3w-9xxx.c | ||
374 | @@ -4,7 +4,7 @@ | ||
375 | Written By: Adam Radford <linuxraid@amcc.com> | ||
376 | Modifications By: Tom Couch <linuxraid@amcc.com> | ||
377 | |||
378 | - Copyright (C) 2004-2006 Applied Micro Circuits Corporation. | ||
379 | + Copyright (C) 2004-2007 Applied Micro Circuits Corporation. | ||
380 | |||
381 | This program is free software; you can redistribute it and/or modify | ||
382 | it under the terms of the GNU General Public License as published by | ||
383 | @@ -69,6 +69,7 @@ | ||
384 | 2.26.02.008 - Free irq handler in __twa_shutdown(). | ||
385 | Serialize reset code. | ||
386 | Add support for 9650SE controllers. | ||
387 | + 2.26.02.009 - Fix dma mask setting to fallback to 32-bit if 64-bit fails. | ||
388 | */ | ||
389 | |||
390 | #include <linux/module.h> | ||
391 | @@ -92,7 +93,7 @@ | ||
392 | #include "3w-9xxx.h" | ||
393 | |||
394 | /* Globals */ | ||
395 | -#define TW_DRIVER_VERSION "2.26.02.008" | ||
396 | +#define TW_DRIVER_VERSION "2.26.02.009" | ||
397 | static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT]; | ||
398 | static unsigned int twa_device_extension_count; | ||
399 | static int twa_major = -1; | ||
400 | @@ -2063,11 +2064,14 @@ static int __devinit twa_probe(struct pci_dev *pdev, const struct pci_device_id | ||
401 | |||
402 | pci_set_master(pdev); | ||
403 | |||
404 | - retval = pci_set_dma_mask(pdev, sizeof(dma_addr_t) > 4 ? DMA_64BIT_MASK : DMA_32BIT_MASK); | ||
405 | - if (retval) { | ||
406 | - TW_PRINTK(host, TW_DRIVER, 0x23, "Failed to set dma mask"); | ||
407 | - goto out_disable_device; | ||
408 | - } | ||
409 | + if (pci_set_dma_mask(pdev, DMA_64BIT_MASK) | ||
410 | + || pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK)) | ||
411 | + if (pci_set_dma_mask(pdev, DMA_32BIT_MASK) | ||
412 | + || pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK)) { | ||
413 | + TW_PRINTK(host, TW_DRIVER, 0x23, "Failed to set dma mask"); | ||
414 | + retval = -ENODEV; | ||
415 | + goto out_disable_device; | ||
416 | + } | ||
417 | |||
418 | host = scsi_host_alloc(&driver_template, sizeof(TW_Device_Extension)); | ||
419 | if (!host) { | ||
420 | diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c | ||
421 | index d6eb5ce..c5dc61a 100644 | ||
422 | --- a/drivers/usb/core/driver.c | ||
423 | +++ b/drivers/usb/core/driver.c | ||
424 | @@ -66,7 +66,7 @@ static ssize_t store_new_id(struct device_driver *driver, | ||
425 | dynid->id.match_flags = USB_DEVICE_ID_MATCH_DEVICE; | ||
426 | |||
427 | spin_lock(&usb_drv->dynids.lock); | ||
428 | - list_add_tail(&usb_drv->dynids.list, &dynid->node); | ||
429 | + list_add_tail(&dynid->node, &usb_drv->dynids.list); | ||
430 | spin_unlock(&usb_drv->dynids.lock); | ||
431 | |||
432 | if (get_driver(driver)) { | ||
433 | diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c | ||
434 | index 149aa8b..dec1337 100644 | ||
435 | --- a/drivers/usb/core/message.c | ||
436 | +++ b/drivers/usb/core/message.c | ||
437 | @@ -608,12 +608,12 @@ int usb_get_descriptor(struct usb_device *dev, unsigned char type, unsigned char | ||
438 | memset(buf,0,size); // Make sure we parse really received data | ||
439 | |||
440 | for (i = 0; i < 3; ++i) { | ||
441 | - /* retry on length 0 or stall; some devices are flakey */ | ||
442 | + /* retry on length 0 or error; some devices are flakey */ | ||
443 | result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), | ||
444 | USB_REQ_GET_DESCRIPTOR, USB_DIR_IN, | ||
445 | (type << 8) + index, 0, buf, size, | ||
446 | USB_CTRL_GET_TIMEOUT); | ||
447 | - if (result == 0 || result == -EPIPE) | ||
448 | + if (result <= 0 && result != -ETIMEDOUT) | ||
449 | continue; | ||
450 | if (result > 1 && ((u8 *)buf)[1] != type) { | ||
451 | result = -EPROTO; | ||
452 | diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c | ||
453 | index 4df39c4..99f0f72 100644 | ||
454 | --- a/fs/ext3/namei.c | ||
455 | +++ b/fs/ext3/namei.c | ||
456 | @@ -380,13 +380,28 @@ dx_probe(struct dentry *dentry, struct inode *dir, | ||
457 | |||
458 | entries = (struct dx_entry *) (((char *)&root->info) + | ||
459 | root->info.info_length); | ||
460 | - assert(dx_get_limit(entries) == dx_root_limit(dir, | ||
461 | - root->info.info_length)); | ||
462 | + | ||
463 | + if (dx_get_limit(entries) != dx_root_limit(dir, | ||
464 | + root->info.info_length)) { | ||
465 | + ext3_warning(dir->i_sb, __FUNCTION__, | ||
466 | + "dx entry: limit != root limit"); | ||
467 | + brelse(bh); | ||
468 | + *err = ERR_BAD_DX_DIR; | ||
469 | + goto fail; | ||
470 | + } | ||
471 | + | ||
472 | dxtrace (printk("Look up %x", hash)); | ||
473 | while (1) | ||
474 | { | ||
475 | count = dx_get_count(entries); | ||
476 | - assert (count && count <= dx_get_limit(entries)); | ||
477 | + if (!count || count > dx_get_limit(entries)) { | ||
478 | + ext3_warning(dir->i_sb, __FUNCTION__, | ||
479 | + "dx entry: no count or count > limit"); | ||
480 | + brelse(bh); | ||
481 | + *err = ERR_BAD_DX_DIR; | ||
482 | + goto fail2; | ||
483 | + } | ||
484 | + | ||
485 | p = entries + 1; | ||
486 | q = entries + count - 1; | ||
487 | while (p <= q) | ||
488 | @@ -424,8 +439,15 @@ dx_probe(struct dentry *dentry, struct inode *dir, | ||
489 | if (!(bh = ext3_bread (NULL,dir, dx_get_block(at), 0, err))) | ||
490 | goto fail2; | ||
491 | at = entries = ((struct dx_node *) bh->b_data)->entries; | ||
492 | - assert (dx_get_limit(entries) == dx_node_limit (dir)); | ||
493 | + if (dx_get_limit(entries) != dx_node_limit (dir)) { | ||
494 | + ext3_warning(dir->i_sb, __FUNCTION__, | ||
495 | + "dx entry: limit != node limit"); | ||
496 | + brelse(bh); | ||
497 | + *err = ERR_BAD_DX_DIR; | ||
498 | + goto fail2; | ||
499 | + } | ||
500 | frame++; | ||
501 | + frame->bh = NULL; | ||
502 | } | ||
503 | fail2: | ||
504 | while (frame >= frame_in) { | ||
505 | @@ -433,6 +455,10 @@ fail2: | ||
506 | frame--; | ||
507 | } | ||
508 | fail: | ||
509 | + if (*err == ERR_BAD_DX_DIR) | ||
510 | + ext3_warning(dir->i_sb, __FUNCTION__, | ||
511 | + "Corrupt dir inode %ld, running e2fsck is " | ||
512 | + "recommended.", dir->i_ino); | ||
513 | return NULL; | ||
514 | } | ||
515 | |||
516 | diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c | ||
517 | index e5a74a5..5edc327 100644 | ||
518 | --- a/fs/ext4/namei.c | ||
519 | +++ b/fs/ext4/namei.c | ||
520 | @@ -380,13 +380,28 @@ dx_probe(struct dentry *dentry, struct inode *dir, | ||
521 | |||
522 | entries = (struct dx_entry *) (((char *)&root->info) + | ||
523 | root->info.info_length); | ||
524 | - assert(dx_get_limit(entries) == dx_root_limit(dir, | ||
525 | - root->info.info_length)); | ||
526 | + | ||
527 | + if (dx_get_limit(entries) != dx_root_limit(dir, | ||
528 | + root->info.info_length)) { | ||
529 | + ext4_warning(dir->i_sb, __FUNCTION__, | ||
530 | + "dx entry: limit != root limit"); | ||
531 | + brelse(bh); | ||
532 | + *err = ERR_BAD_DX_DIR; | ||
533 | + goto fail; | ||
534 | + } | ||
535 | + | ||
536 | dxtrace (printk("Look up %x", hash)); | ||
537 | while (1) | ||
538 | { | ||
539 | count = dx_get_count(entries); | ||
540 | - assert (count && count <= dx_get_limit(entries)); | ||
541 | + if (!count || count > dx_get_limit(entries)) { | ||
542 | + ext4_warning(dir->i_sb, __FUNCTION__, | ||
543 | + "dx entry: no count or count > limit"); | ||
544 | + brelse(bh); | ||
545 | + *err = ERR_BAD_DX_DIR; | ||
546 | + goto fail2; | ||
547 | + } | ||
548 | + | ||
549 | p = entries + 1; | ||
550 | q = entries + count - 1; | ||
551 | while (p <= q) | ||
552 | @@ -424,8 +439,15 @@ dx_probe(struct dentry *dentry, struct inode *dir, | ||
553 | if (!(bh = ext4_bread (NULL,dir, dx_get_block(at), 0, err))) | ||
554 | goto fail2; | ||
555 | at = entries = ((struct dx_node *) bh->b_data)->entries; | ||
556 | - assert (dx_get_limit(entries) == dx_node_limit (dir)); | ||
557 | + if (dx_get_limit(entries) != dx_node_limit (dir)) { | ||
558 | + ext4_warning(dir->i_sb, __FUNCTION__, | ||
559 | + "dx entry: limit != node limit"); | ||
560 | + brelse(bh); | ||
561 | + *err = ERR_BAD_DX_DIR; | ||
562 | + goto fail2; | ||
563 | + } | ||
564 | frame++; | ||
565 | + frame->bh = NULL; | ||
566 | } | ||
567 | fail2: | ||
568 | while (frame >= frame_in) { | ||
569 | @@ -433,6 +455,10 @@ fail2: | ||
570 | frame--; | ||
571 | } | ||
572 | fail: | ||
573 | + if (*err == ERR_BAD_DX_DIR) | ||
574 | + ext4_warning(dir->i_sb, __FUNCTION__, | ||
575 | + "Corrupt dir inode %ld, running e2fsck is " | ||
576 | + "recommended.", dir->i_ino); | ||
577 | return NULL; | ||
578 | } | ||
579 | |||
580 | diff --git a/fs/locks.c b/fs/locks.c | ||
581 | index 52a8100..bcdfebc 100644 | ||
582 | --- a/fs/locks.c | ||
583 | +++ b/fs/locks.c | ||
584 | @@ -790,7 +790,7 @@ find_conflict: | ||
585 | if (request->fl_flags & FL_ACCESS) | ||
586 | goto out; | ||
587 | locks_copy_lock(new_fl, request); | ||
588 | - locks_insert_lock(&inode->i_flock, new_fl); | ||
589 | + locks_insert_lock(before, new_fl); | ||
590 | new_fl = NULL; | ||
591 | error = 0; | ||
592 | |||
593 | diff --git a/fs/nfs/super.c b/fs/nfs/super.c | ||
594 | index 28108c8..c81fcd8 100644 | ||
595 | --- a/fs/nfs/super.c | ||
596 | +++ b/fs/nfs/super.c | ||
597 | @@ -180,8 +180,8 @@ void __exit unregister_nfs_fs(void) | ||
598 | remove_shrinker(acl_shrinker); | ||
599 | #ifdef CONFIG_NFS_V4 | ||
600 | unregister_filesystem(&nfs4_fs_type); | ||
601 | - nfs_unregister_sysctl(); | ||
602 | #endif | ||
603 | + nfs_unregister_sysctl(); | ||
604 | unregister_filesystem(&nfs_fs_type); | ||
605 | } | ||
606 | |||
607 | diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c | ||
608 | index 511edef..3743086 100644 | ||
609 | --- a/fs/sysfs/dir.c | ||
610 | +++ b/fs/sysfs/dir.c | ||
611 | @@ -29,6 +29,14 @@ static struct dentry_operations sysfs_dentry_ops = { | ||
612 | .d_iput = sysfs_d_iput, | ||
613 | }; | ||
614 | |||
615 | +static unsigned int sysfs_inode_counter; | ||
616 | +ino_t sysfs_get_inum(void) | ||
617 | +{ | ||
618 | + if (unlikely(sysfs_inode_counter < 3)) | ||
619 | + sysfs_inode_counter = 3; | ||
620 | + return sysfs_inode_counter++; | ||
621 | +} | ||
622 | + | ||
623 | /* | ||
624 | * Allocates a new sysfs_dirent and links it to the parent sysfs_dirent | ||
625 | */ | ||
626 | @@ -42,6 +50,7 @@ static struct sysfs_dirent * sysfs_new_dirent(struct sysfs_dirent * parent_sd, | ||
627 | return NULL; | ||
628 | |||
629 | memset(sd, 0, sizeof(*sd)); | ||
630 | + sd->s_ino = sysfs_get_inum(); | ||
631 | atomic_set(&sd->s_count, 1); | ||
632 | atomic_set(&sd->s_event, 1); | ||
633 | INIT_LIST_HEAD(&sd->s_children); | ||
634 | @@ -461,7 +470,7 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir) | ||
635 | |||
636 | switch (i) { | ||
637 | case 0: | ||
638 | - ino = dentry->d_inode->i_ino; | ||
639 | + ino = parent_sd->s_ino; | ||
640 | if (filldir(dirent, ".", 1, i, ino, DT_DIR) < 0) | ||
641 | break; | ||
642 | filp->f_pos++; | ||
643 | @@ -490,10 +499,7 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir) | ||
644 | |||
645 | name = sysfs_get_name(next); | ||
646 | len = strlen(name); | ||
647 | - if (next->s_dentry) | ||
648 | - ino = next->s_dentry->d_inode->i_ino; | ||
649 | - else | ||
650 | - ino = iunique(sysfs_sb, 2); | ||
651 | + ino = next->s_ino; | ||
652 | |||
653 | if (filldir(dirent, name, len, filp->f_pos, ino, | ||
654 | dt_type(next)) < 0) | ||
655 | diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c | ||
656 | index e79e38d..bb2da9d 100644 | ||
657 | --- a/fs/sysfs/inode.c | ||
658 | +++ b/fs/sysfs/inode.c | ||
659 | @@ -129,6 +129,7 @@ struct inode * sysfs_new_inode(mode_t mode, struct sysfs_dirent * sd) | ||
660 | inode->i_mapping->a_ops = &sysfs_aops; | ||
661 | inode->i_mapping->backing_dev_info = &sysfs_backing_dev_info; | ||
662 | inode->i_op = &sysfs_inode_operations; | ||
663 | + inode->i_ino = sd->s_ino; | ||
664 | lockdep_set_class(&inode->i_mutex, &sysfs_inode_imutex_key); | ||
665 | |||
666 | if (sd->s_iattr) { | ||
667 | diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c | ||
668 | index e503f85..4305e46 100644 | ||
669 | --- a/fs/sysfs/mount.c | ||
670 | +++ b/fs/sysfs/mount.c | ||
671 | @@ -29,6 +29,7 @@ static struct sysfs_dirent sysfs_root = { | ||
672 | .s_element = NULL, | ||
673 | .s_type = SYSFS_ROOT, | ||
674 | .s_iattr = NULL, | ||
675 | + .s_ino = 1, | ||
676 | }; | ||
677 | |||
678 | static int sysfs_fill_super(struct super_block *sb, void *data, int silent) | ||
679 | diff --git a/include/asm-avr32/atomic.h b/include/asm-avr32/atomic.h | ||
680 | index c40b603..7df7b75 100644 | ||
681 | --- a/include/asm-avr32/atomic.h | ||
682 | +++ b/include/asm-avr32/atomic.h | ||
683 | @@ -101,7 +101,7 @@ static inline int atomic_sub_unless(atomic_t *v, int a, int u) | ||
684 | " mov %1, 1\n" | ||
685 | "1:" | ||
686 | : "=&r"(tmp), "=&r"(result), "=o"(v->counter) | ||
687 | - : "m"(v->counter), "rKs21"(a), "rKs21"(u) | ||
688 | + : "m"(v->counter), "rKs21"(a), "rKs21"(u), "1"(result) | ||
689 | : "cc", "memory"); | ||
690 | |||
691 | return result; | ||
692 | @@ -137,7 +137,7 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u) | ||
693 | " mov %1, 1\n" | ||
694 | "1:" | ||
695 | : "=&r"(tmp), "=&r"(result), "=o"(v->counter) | ||
696 | - : "m"(v->counter), "r"(a), "ir"(u) | ||
697 | + : "m"(v->counter), "r"(a), "ir"(u), "1"(result) | ||
698 | : "cc", "memory"); | ||
699 | } | ||
700 | |||
701 | diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild | ||
702 | index 6328175..ab399fc 100644 | ||
703 | --- a/include/linux/netfilter/Kbuild | ||
704 | +++ b/include/linux/netfilter/Kbuild | ||
705 | @@ -28,6 +28,7 @@ header-y += xt_policy.h | ||
706 | header-y += xt_realm.h | ||
707 | header-y += xt_sctp.h | ||
708 | header-y += xt_state.h | ||
709 | +header-y += xt_statistic.h | ||
710 | header-y += xt_string.h | ||
711 | header-y += xt_tcpmss.h | ||
712 | header-y += xt_tcpudp.h | ||
713 | diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h | ||
714 | index 2129d1b..8799dc3 100644 | ||
715 | --- a/include/linux/sysfs.h | ||
716 | +++ b/include/linux/sysfs.h | ||
717 | @@ -73,6 +73,7 @@ struct sysfs_dirent { | ||
718 | void * s_element; | ||
719 | int s_type; | ||
720 | umode_t s_mode; | ||
721 | + ino_t s_ino; | ||
722 | struct dentry * s_dentry; | ||
723 | struct iattr * s_iattr; | ||
724 | atomic_t s_event; | ||
725 | diff --git a/include/net/tcp.h b/include/net/tcp.h | ||
726 | index cd8fa0c..da5bac3 100644 | ||
727 | --- a/include/net/tcp.h | ||
728 | +++ b/include/net/tcp.h | ||
729 | @@ -273,7 +273,7 @@ extern int tcp_v4_remember_stamp(struct sock *sk); | ||
730 | |||
731 | extern int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw); | ||
732 | |||
733 | -extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, | ||
734 | +extern int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, | ||
735 | struct msghdr *msg, size_t size); | ||
736 | extern ssize_t tcp_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags); | ||
737 | |||
738 | diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c | ||
739 | index 50f24ee..5f0115f 100644 | ||
740 | --- a/kernel/futex_compat.c | ||
741 | +++ b/kernel/futex_compat.c | ||
742 | @@ -61,10 +61,10 @@ void compat_exit_robust_list(struct task_struct *curr) | ||
743 | if (fetch_robust_entry(&upending, &pending, | ||
744 | &head->list_op_pending, &pip)) | ||
745 | return; | ||
746 | - if (upending) | ||
747 | + if (pending) | ||
748 | handle_futex_death((void __user *)pending + futex_offset, curr, pip); | ||
749 | |||
750 | - while (compat_ptr(uentry) != &head->list) { | ||
751 | + while (entry != (struct robust_list __user *) &head->list) { | ||
752 | /* | ||
753 | * A pending lock might already be on the list, so | ||
754 | * dont process it twice: | ||
755 | diff --git a/kernel/signal.c b/kernel/signal.c | ||
756 | index 5630255..4975f4c 100644 | ||
757 | --- a/kernel/signal.c | ||
758 | +++ b/kernel/signal.c | ||
759 | @@ -1345,20 +1345,19 @@ struct sigqueue *sigqueue_alloc(void) | ||
760 | void sigqueue_free(struct sigqueue *q) | ||
761 | { | ||
762 | unsigned long flags; | ||
763 | + spinlock_t *lock = ¤t->sighand->siglock; | ||
764 | + | ||
765 | BUG_ON(!(q->flags & SIGQUEUE_PREALLOC)); | ||
766 | /* | ||
767 | * If the signal is still pending remove it from the | ||
768 | - * pending queue. | ||
769 | + * pending queue. We must hold ->siglock while testing | ||
770 | + * q->list to serialize with collect_signal(). | ||
771 | */ | ||
772 | - if (unlikely(!list_empty(&q->list))) { | ||
773 | - spinlock_t *lock = ¤t->sighand->siglock; | ||
774 | - read_lock(&tasklist_lock); | ||
775 | - spin_lock_irqsave(lock, flags); | ||
776 | - if (!list_empty(&q->list)) | ||
777 | - list_del_init(&q->list); | ||
778 | - spin_unlock_irqrestore(lock, flags); | ||
779 | - read_unlock(&tasklist_lock); | ||
780 | - } | ||
781 | + spin_lock_irqsave(lock, flags); | ||
782 | + if (!list_empty(&q->list)) | ||
783 | + list_del_init(&q->list); | ||
784 | + spin_unlock_irqrestore(lock, flags); | ||
785 | + | ||
786 | q->flags &= ~SIGQUEUE_PREALLOC; | ||
787 | __sigqueue_free(q); | ||
788 | } | ||
789 | diff --git a/kernel/sys.c b/kernel/sys.c | ||
790 | index 475ddbb..17f8447 100644 | ||
791 | --- a/kernel/sys.c | ||
792 | +++ b/kernel/sys.c | ||
793 | @@ -1358,7 +1358,6 @@ asmlinkage long sys_times(struct tms __user * tbuf) | ||
794 | * Auch. Had to add the 'did_exec' flag to conform completely to POSIX. | ||
795 | * LBT 04.03.94 | ||
796 | */ | ||
797 | - | ||
798 | asmlinkage long sys_setpgid(pid_t pid, pid_t pgid) | ||
799 | { | ||
800 | struct task_struct *p; | ||
801 | @@ -1386,7 +1385,7 @@ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid) | ||
802 | if (!thread_group_leader(p)) | ||
803 | goto out; | ||
804 | |||
805 | - if (p->real_parent == group_leader) { | ||
806 | + if (p->real_parent->tgid == group_leader->tgid) { | ||
807 | err = -EPERM; | ||
808 | if (process_session(p) != process_session(group_leader)) | ||
809 | goto out; | ||
810 | diff --git a/net/802/psnap.c b/net/802/psnap.c | ||
811 | index 270b9d2..44dc3f9 100644 | ||
812 | --- a/net/802/psnap.c | ||
813 | +++ b/net/802/psnap.c | ||
814 | @@ -55,6 +55,9 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev, | ||
815 | .type = __constant_htons(ETH_P_SNAP), | ||
816 | }; | ||
817 | |||
818 | + if (unlikely(!pskb_may_pull(skb, 5))) | ||
819 | + goto drop; | ||
820 | + | ||
821 | rcu_read_lock(); | ||
822 | proto = find_snap_client(skb->h.raw); | ||
823 | if (proto) { | ||
824 | @@ -62,14 +65,18 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev, | ||
825 | skb->h.raw += 5; | ||
826 | skb_pull_rcsum(skb, 5); | ||
827 | rc = proto->rcvfunc(skb, dev, &snap_packet_type, orig_dev); | ||
828 | - } else { | ||
829 | - skb->sk = NULL; | ||
830 | - kfree_skb(skb); | ||
831 | - rc = 1; | ||
832 | } | ||
833 | - | ||
834 | rcu_read_unlock(); | ||
835 | + | ||
836 | + if (unlikely(!proto)) | ||
837 | + goto drop; | ||
838 | + | ||
839 | +out: | ||
840 | return rc; | ||
841 | + | ||
842 | +drop: | ||
843 | + kfree_skb(skb); | ||
844 | + goto out; | ||
845 | } | ||
846 | |||
847 | /* | ||
848 | diff --git a/net/core/datagram.c b/net/core/datagram.c | ||
849 | index 797fdd4..5d55a2e 100644 | ||
850 | --- a/net/core/datagram.c | ||
851 | +++ b/net/core/datagram.c | ||
852 | @@ -444,6 +444,9 @@ int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb, | ||
853 | __wsum csum; | ||
854 | int chunk = skb->len - hlen; | ||
855 | |||
856 | + if (!chunk) | ||
857 | + return 0; | ||
858 | + | ||
859 | /* Skip filled elements. | ||
860 | * Pretty silly, look at memcpy_toiovec, though 8) | ||
861 | */ | ||
862 | diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c | ||
863 | index fd38b05..05324db 100644 | ||
864 | --- a/net/dccp/ccids/ccid2.c | ||
865 | +++ b/net/dccp/ccids/ccid2.c | ||
866 | @@ -298,7 +298,7 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len) | ||
867 | int rc; | ||
868 | |||
869 | ccid2_pr_debug("allocating more space in history\n"); | ||
870 | - rc = ccid2_hc_tx_alloc_seq(hctx, CCID2_SEQBUF_LEN, GFP_KERNEL); | ||
871 | + rc = ccid2_hc_tx_alloc_seq(hctx, CCID2_SEQBUF_LEN, gfp_any()); | ||
872 | BUG_ON(rc); /* XXX what do we do? */ | ||
873 | |||
874 | next = hctx->ccid2hctx_seqh->ccid2s_next; | ||
875 | diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c | ||
876 | index 8640096..d8e6f77 100644 | ||
877 | --- a/net/ipv4/af_inet.c | ||
878 | +++ b/net/ipv4/af_inet.c | ||
879 | @@ -803,7 +803,7 @@ const struct proto_ops inet_stream_ops = { | ||
880 | .shutdown = inet_shutdown, | ||
881 | .setsockopt = sock_common_setsockopt, | ||
882 | .getsockopt = sock_common_getsockopt, | ||
883 | - .sendmsg = inet_sendmsg, | ||
884 | + .sendmsg = tcp_sendmsg, | ||
885 | .recvmsg = sock_common_recvmsg, | ||
886 | .mmap = sock_no_mmap, | ||
887 | .sendpage = tcp_sendpage, | ||
888 | diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c | ||
889 | index 67a5509..41ad421 100644 | ||
890 | --- a/net/ipv4/ah4.c | ||
891 | +++ b/net/ipv4/ah4.c | ||
892 | @@ -46,7 +46,7 @@ static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr) | ||
893 | memcpy(daddr, optptr+optlen-4, 4); | ||
894 | /* Fall through */ | ||
895 | default: | ||
896 | - memset(optptr+2, 0, optlen-2); | ||
897 | + memset(optptr, 0, optlen); | ||
898 | } | ||
899 | l -= optlen; | ||
900 | optptr += optlen; | ||
901 | diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c | ||
902 | index 6842474..a3818f2 100644 | ||
903 | --- a/net/ipv4/tcp.c | ||
904 | +++ b/net/ipv4/tcp.c | ||
905 | @@ -658,9 +658,10 @@ static inline int select_size(struct sock *sk, struct tcp_sock *tp) | ||
906 | return tmp; | ||
907 | } | ||
908 | |||
909 | -int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, | ||
910 | +int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, | ||
911 | size_t size) | ||
912 | { | ||
913 | + struct sock *sk = sock->sk; | ||
914 | struct iovec *iov; | ||
915 | struct tcp_sock *tp = tcp_sk(sk); | ||
916 | struct sk_buff *skb; | ||
917 | diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c | ||
918 | index 12de90a..9c4862f 100644 | ||
919 | --- a/net/ipv4/tcp_ipv4.c | ||
920 | +++ b/net/ipv4/tcp_ipv4.c | ||
921 | @@ -2427,7 +2427,6 @@ struct proto tcp_prot = { | ||
922 | .shutdown = tcp_shutdown, | ||
923 | .setsockopt = tcp_setsockopt, | ||
924 | .getsockopt = tcp_getsockopt, | ||
925 | - .sendmsg = tcp_sendmsg, | ||
926 | .recvmsg = tcp_recvmsg, | ||
927 | .backlog_rcv = tcp_v4_do_rcv, | ||
928 | .hash = tcp_v4_hash, | ||
929 | diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c | ||
930 | index 0e0e426..30c8299 100644 | ||
931 | --- a/net/ipv6/af_inet6.c | ||
932 | +++ b/net/ipv6/af_inet6.c | ||
933 | @@ -473,7 +473,7 @@ const struct proto_ops inet6_stream_ops = { | ||
934 | .shutdown = inet_shutdown, /* ok */ | ||
935 | .setsockopt = sock_common_setsockopt, /* ok */ | ||
936 | .getsockopt = sock_common_getsockopt, /* ok */ | ||
937 | - .sendmsg = inet_sendmsg, /* ok */ | ||
938 | + .sendmsg = tcp_sendmsg, /* ok */ | ||
939 | .recvmsg = sock_common_recvmsg, /* ok */ | ||
940 | .mmap = sock_no_mmap, | ||
941 | .sendpage = tcp_sendpage, | ||
942 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c | ||
943 | index 7b7bd44..2c613fa 100644 | ||
944 | --- a/net/ipv6/ip6_output.c | ||
945 | +++ b/net/ipv6/ip6_output.c | ||
946 | @@ -1357,8 +1357,9 @@ void ip6_flush_pending_frames(struct sock *sk) | ||
947 | struct sk_buff *skb; | ||
948 | |||
949 | while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) { | ||
950 | - IP6_INC_STATS(ip6_dst_idev(skb->dst), | ||
951 | - IPSTATS_MIB_OUTDISCARDS); | ||
952 | + if (skb->dst) | ||
953 | + IP6_INC_STATS(ip6_dst_idev(skb->dst), | ||
954 | + IPSTATS_MIB_OUTDISCARDS); | ||
955 | kfree_skb(skb); | ||
956 | } | ||
957 | |||
958 | diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c | ||
959 | index 9479fbd..ddbe790 100644 | ||
960 | --- a/net/ipv6/raw.c | ||
961 | +++ b/net/ipv6/raw.c | ||
962 | @@ -851,11 +851,10 @@ back_from_confirm: | ||
963 | ip6_flush_pending_frames(sk); | ||
964 | else if (!(msg->msg_flags & MSG_MORE)) | ||
965 | err = rawv6_push_pending_frames(sk, &fl, rp); | ||
966 | + release_sock(sk); | ||
967 | } | ||
968 | done: | ||
969 | dst_release(dst); | ||
970 | - if (!inet->hdrincl) | ||
971 | - release_sock(sk); | ||
972 | out: | ||
973 | fl6_sock_release(flowlabel); | ||
974 | return err<0?err:len; | ||
975 | diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c | ||
976 | index 03f53f5..f6214b7 100644 | ||
977 | --- a/net/ipv6/tcp_ipv6.c | ||
978 | +++ b/net/ipv6/tcp_ipv6.c | ||
979 | @@ -2127,7 +2127,6 @@ struct proto tcpv6_prot = { | ||
980 | .shutdown = tcp_shutdown, | ||
981 | .setsockopt = tcp_setsockopt, | ||
982 | .getsockopt = tcp_getsockopt, | ||
983 | - .sendmsg = tcp_sendmsg, | ||
984 | .recvmsg = tcp_recvmsg, | ||
985 | .backlog_rcv = tcp_v6_do_rcv, | ||
986 | .hash = tcp_v6_hash, | ||
987 | diff --git a/net/socket.c b/net/socket.c | ||
988 | index afb6085..d9bae01 100644 | ||
989 | --- a/net/socket.c | ||
990 | +++ b/net/socket.c | ||
991 | @@ -1147,7 +1147,7 @@ static int __sock_create(int family, int type, int protocol, | ||
992 | module_put(pf->owner); | ||
993 | err = security_socket_post_create(sock, family, type, protocol, kern); | ||
994 | if (err) | ||
995 | - goto out_release; | ||
996 | + goto out_sock_release; | ||
997 | *res = sock; | ||
998 | |||
999 | return 0; | ||
1000 | diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c | ||
1001 | index bc0bd09..02c2ce6 100644 | ||
1002 | --- a/sound/core/memalloc.c | ||
1003 | +++ b/sound/core/memalloc.c | ||
1004 | @@ -27,6 +27,7 @@ | ||
1005 | #include <linux/pci.h> | ||
1006 | #include <linux/slab.h> | ||
1007 | #include <linux/mm.h> | ||
1008 | +#include <linux/seq_file.h> | ||
1009 | #include <asm/uaccess.h> | ||
1010 | #include <linux/dma-mapping.h> | ||
1011 | #include <linux/moduleparam.h> | ||
1012 | @@ -483,10 +484,8 @@ static void free_all_reserved_pages(void) | ||
1013 | #define SND_MEM_PROC_FILE "driver/snd-page-alloc" | ||
1014 | static struct proc_dir_entry *snd_mem_proc; | ||
1015 | |||
1016 | -static int snd_mem_proc_read(char *page, char **start, off_t off, | ||
1017 | - int count, int *eof, void *data) | ||
1018 | +static int snd_mem_proc_read(struct seq_file *seq, void *offset) | ||
1019 | { | ||
1020 | - int len = 0; | ||
1021 | long pages = snd_allocated_pages >> (PAGE_SHIFT-12); | ||
1022 | struct list_head *p; | ||
1023 | struct snd_mem_list *mem; | ||
1024 | @@ -494,44 +493,47 @@ static int snd_mem_proc_read(char *page, char **start, off_t off, | ||
1025 | static char *types[] = { "UNKNOWN", "CONT", "DEV", "DEV-SG", "SBUS" }; | ||
1026 | |||
1027 | mutex_lock(&list_mutex); | ||
1028 | - len += snprintf(page + len, count - len, | ||
1029 | - "pages : %li bytes (%li pages per %likB)\n", | ||
1030 | - pages * PAGE_SIZE, pages, PAGE_SIZE / 1024); | ||
1031 | + seq_printf(seq, "pages : %li bytes (%li pages per %likB)\n", | ||
1032 | + pages * PAGE_SIZE, pages, PAGE_SIZE / 1024); | ||
1033 | devno = 0; | ||
1034 | list_for_each(p, &mem_list_head) { | ||
1035 | mem = list_entry(p, struct snd_mem_list, list); | ||
1036 | devno++; | ||
1037 | - len += snprintf(page + len, count - len, | ||
1038 | - "buffer %d : ID %08x : type %s\n", | ||
1039 | - devno, mem->id, types[mem->buffer.dev.type]); | ||
1040 | - len += snprintf(page + len, count - len, | ||
1041 | - " addr = 0x%lx, size = %d bytes\n", | ||
1042 | - (unsigned long)mem->buffer.addr, (int)mem->buffer.bytes); | ||
1043 | + seq_printf(seq, "buffer %d : ID %08x : type %s\n", | ||
1044 | + devno, mem->id, types[mem->buffer.dev.type]); | ||
1045 | + seq_printf(seq, " addr = 0x%lx, size = %d bytes\n", | ||
1046 | + (unsigned long)mem->buffer.addr, | ||
1047 | + (int)mem->buffer.bytes); | ||
1048 | } | ||
1049 | mutex_unlock(&list_mutex); | ||
1050 | - return len; | ||
1051 | + return 0; | ||
1052 | +} | ||
1053 | + | ||
1054 | +static int snd_mem_proc_open(struct inode *inode, struct file *file) | ||
1055 | +{ | ||
1056 | + return single_open(file, snd_mem_proc_read, NULL); | ||
1057 | } | ||
1058 | |||
1059 | /* FIXME: for pci only - other bus? */ | ||
1060 | #ifdef CONFIG_PCI | ||
1061 | #define gettoken(bufp) strsep(bufp, " \t\n") | ||
1062 | |||
1063 | -static int snd_mem_proc_write(struct file *file, const char __user *buffer, | ||
1064 | - unsigned long count, void *data) | ||
1065 | +static ssize_t snd_mem_proc_write(struct file *file, const char __user * buffer, | ||
1066 | + size_t count, loff_t * ppos) | ||
1067 | { | ||
1068 | char buf[128]; | ||
1069 | char *token, *p; | ||
1070 | |||
1071 | - if (count > ARRAY_SIZE(buf) - 1) | ||
1072 | - count = ARRAY_SIZE(buf) - 1; | ||
1073 | + if (count > sizeof(buf) - 1) | ||
1074 | + return -EINVAL; | ||
1075 | if (copy_from_user(buf, buffer, count)) | ||
1076 | return -EFAULT; | ||
1077 | - buf[ARRAY_SIZE(buf) - 1] = '\0'; | ||
1078 | + buf[count] = '\0'; | ||
1079 | |||
1080 | p = buf; | ||
1081 | token = gettoken(&p); | ||
1082 | if (! token || *token == '#') | ||
1083 | - return (int)count; | ||
1084 | + return count; | ||
1085 | if (strcmp(token, "add") == 0) { | ||
1086 | char *endp; | ||
1087 | int vendor, device, size, buffers; | ||
1088 | @@ -552,7 +554,7 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer, | ||
1089 | (buffers = simple_strtol(token, NULL, 0)) <= 0 || | ||
1090 | buffers > 4) { | ||
1091 | printk(KERN_ERR "snd-page-alloc: invalid proc write format\n"); | ||
1092 | - return (int)count; | ||
1093 | + return count; | ||
1094 | } | ||
1095 | vendor &= 0xffff; | ||
1096 | device &= 0xffff; | ||
1097 | @@ -564,7 +566,7 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer, | ||
1098 | if (pci_set_dma_mask(pci, mask) < 0 || | ||
1099 | pci_set_consistent_dma_mask(pci, mask) < 0) { | ||
1100 | printk(KERN_ERR "snd-page-alloc: cannot set DMA mask %lx for pci %04x:%04x\n", mask, vendor, device); | ||
1101 | - return (int)count; | ||
1102 | + return count; | ||
1103 | } | ||
1104 | } | ||
1105 | for (i = 0; i < buffers; i++) { | ||
1106 | @@ -574,7 +576,7 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer, | ||
1107 | size, &dmab) < 0) { | ||
1108 | printk(KERN_ERR "snd-page-alloc: cannot allocate buffer pages (size = %d)\n", size); | ||
1109 | pci_dev_put(pci); | ||
1110 | - return (int)count; | ||
1111 | + return count; | ||
1112 | } | ||
1113 | snd_dma_reserve_buf(&dmab, snd_dma_pci_buf_id(pci)); | ||
1114 | } | ||
1115 | @@ -600,9 +602,21 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer, | ||
1116 | free_all_reserved_pages(); | ||
1117 | else | ||
1118 | printk(KERN_ERR "snd-page-alloc: invalid proc cmd\n"); | ||
1119 | - return (int)count; | ||
1120 | + return count; | ||
1121 | } | ||
1122 | #endif /* CONFIG_PCI */ | ||
1123 | + | ||
1124 | +static const struct file_operations snd_mem_proc_fops = { | ||
1125 | + .owner = THIS_MODULE, | ||
1126 | + .open = snd_mem_proc_open, | ||
1127 | + .read = seq_read, | ||
1128 | +#ifdef CONFIG_PCI | ||
1129 | + .write = snd_mem_proc_write, | ||
1130 | +#endif | ||
1131 | + .llseek = seq_lseek, | ||
1132 | + .release = single_release, | ||
1133 | +}; | ||
1134 | + | ||
1135 | #endif /* CONFIG_PROC_FS */ | ||
1136 | |||
1137 | /* | ||
1138 | @@ -613,12 +627,8 @@ static int __init snd_mem_init(void) | ||
1139 | { | ||
1140 | #ifdef CONFIG_PROC_FS | ||
1141 | snd_mem_proc = create_proc_entry(SND_MEM_PROC_FILE, 0644, NULL); | ||
1142 | - if (snd_mem_proc) { | ||
1143 | - snd_mem_proc->read_proc = snd_mem_proc_read; | ||
1144 | -#ifdef CONFIG_PCI | ||
1145 | - snd_mem_proc->write_proc = snd_mem_proc_write; | ||
1146 | -#endif | ||
1147 | - } | ||
1148 | + if (snd_mem_proc) | ||
1149 | + snd_mem_proc->proc_fops = &snd_mem_proc_fops; | ||
1150 | #endif | ||
1151 | return 0; | ||
1152 | } |