Contents of /trunk/kernel26-alx/patches-2.6.20-r6/0121-2.6.20.21-all-fixes.patch
Parent Directory | Revision Log
Revision 1175 -
(show annotations)
(download)
Thu Oct 14 12:15:46 2010 UTC (13 years, 11 months ago) by niro
File size: 36574 byte(s)
Thu Oct 14 12:15:46 2010 UTC (13 years, 11 months ago) by niro
File size: 36574 byte(s)
-2.6.20-alx-r6 new magellan 0.5.2 kernel
1 | diff --git a/arch/i386/kernel/sysenter.c b/arch/i386/kernel/sysenter.c |
2 | index 666f70d..0577312 100644 |
3 | --- a/arch/i386/kernel/sysenter.c |
4 | +++ b/arch/i386/kernel/sysenter.c |
5 | @@ -183,7 +183,9 @@ struct vm_area_struct *get_gate_vma(struct task_struct *tsk) |
6 | |
7 | int in_gate_area(struct task_struct *task, unsigned long addr) |
8 | { |
9 | - return 0; |
10 | + const struct vm_area_struct *vma = get_gate_vma(task); |
11 | + |
12 | + return vma && addr >= vma->vm_start && addr < vma->vm_end; |
13 | } |
14 | |
15 | int in_gate_area_no_task(unsigned long addr) |
16 | diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c |
17 | index f3d4dd5..21d4caf 100644 |
18 | --- a/arch/powerpc/kernel/process.c |
19 | +++ b/arch/powerpc/kernel/process.c |
20 | @@ -84,7 +84,7 @@ void flush_fp_to_thread(struct task_struct *tsk) |
21 | */ |
22 | BUG_ON(tsk != current); |
23 | #endif |
24 | - giveup_fpu(current); |
25 | + giveup_fpu(tsk); |
26 | } |
27 | preempt_enable(); |
28 | } |
29 | @@ -144,7 +144,7 @@ void flush_altivec_to_thread(struct task_struct *tsk) |
30 | #ifdef CONFIG_SMP |
31 | BUG_ON(tsk != current); |
32 | #endif |
33 | - giveup_altivec(current); |
34 | + giveup_altivec(tsk); |
35 | } |
36 | preempt_enable(); |
37 | } |
38 | @@ -183,7 +183,7 @@ void flush_spe_to_thread(struct task_struct *tsk) |
39 | #ifdef CONFIG_SMP |
40 | BUG_ON(tsk != current); |
41 | #endif |
42 | - giveup_spe(current); |
43 | + giveup_spe(tsk); |
44 | } |
45 | preempt_enable(); |
46 | } |
47 | diff --git a/arch/sparc64/kernel/traps.c b/arch/sparc64/kernel/traps.c |
48 | index ad67784..ab72e91 100644 |
49 | --- a/arch/sparc64/kernel/traps.c |
50 | +++ b/arch/sparc64/kernel/traps.c |
51 | @@ -2146,12 +2146,20 @@ static void user_instruction_dump (unsigned int __user *pc) |
52 | void show_stack(struct task_struct *tsk, unsigned long *_ksp) |
53 | { |
54 | unsigned long pc, fp, thread_base, ksp; |
55 | - void *tp = task_stack_page(tsk); |
56 | + struct thread_info *tp; |
57 | struct reg_window *rw; |
58 | int count = 0; |
59 | |
60 | ksp = (unsigned long) _ksp; |
61 | - |
62 | + if (!tsk) |
63 | + tsk = current; |
64 | + tp = task_thread_info(tsk); |
65 | + if (ksp == 0UL) { |
66 | + if (tsk == current) |
67 | + asm("mov %%fp, %0" : "=r" (ksp)); |
68 | + else |
69 | + ksp = tp->ksp; |
70 | + } |
71 | if (tp == current_thread_info()) |
72 | flushw_all(); |
73 | |
74 | @@ -2180,11 +2188,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp) |
75 | |
76 | void dump_stack(void) |
77 | { |
78 | - unsigned long *ksp; |
79 | - |
80 | - __asm__ __volatile__("mov %%fp, %0" |
81 | - : "=r" (ksp)); |
82 | - show_stack(current, ksp); |
83 | + show_stack(current, NULL); |
84 | } |
85 | |
86 | EXPORT_SYMBOL(dump_stack); |
87 | diff --git a/arch/sparc64/mm/fault.c b/arch/sparc64/mm/fault.c |
88 | index 55ae802..f6377b4 100644 |
89 | --- a/arch/sparc64/mm/fault.c |
90 | +++ b/arch/sparc64/mm/fault.c |
91 | @@ -129,15 +129,12 @@ static void __kprobes unhandled_fault(unsigned long address, |
92 | |
93 | static void bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr) |
94 | { |
95 | - unsigned long *ksp; |
96 | - |
97 | printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n", |
98 | regs->tpc); |
99 | printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]); |
100 | print_symbol("RPC: <%s>\n", regs->u_regs[15]); |
101 | printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr); |
102 | - __asm__("mov %%sp, %0" : "=r" (ksp)); |
103 | - show_stack(current, ksp); |
104 | + dump_stack(); |
105 | unhandled_fault(regs->tpc, current, regs); |
106 | } |
107 | |
108 | diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c |
109 | index 38c293b..dbb0192 100644 |
110 | --- a/block/ll_rw_blk.c |
111 | +++ b/block/ll_rw_blk.c |
112 | @@ -1072,12 +1072,6 @@ void blk_queue_end_tag(request_queue_t *q, struct request *rq) |
113 | */ |
114 | return; |
115 | |
116 | - if (unlikely(!__test_and_clear_bit(tag, bqt->tag_map))) { |
117 | - printk(KERN_ERR "%s: attempt to clear non-busy tag (%d)\n", |
118 | - __FUNCTION__, tag); |
119 | - return; |
120 | - } |
121 | - |
122 | list_del_init(&rq->queuelist); |
123 | rq->cmd_flags &= ~REQ_QUEUED; |
124 | rq->tag = -1; |
125 | @@ -1087,6 +1081,13 @@ void blk_queue_end_tag(request_queue_t *q, struct request *rq) |
126 | __FUNCTION__, tag); |
127 | |
128 | bqt->tag_index[tag] = NULL; |
129 | + |
130 | + if (unlikely(!test_and_clear_bit(tag, bqt->tag_map))) { |
131 | + printk(KERN_ERR "%s: attempt to clear non-busy tag (%d)\n", |
132 | + __FUNCTION__, tag); |
133 | + return; |
134 | + } |
135 | + |
136 | bqt->busy--; |
137 | } |
138 | |
139 | diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c |
140 | index 6e93004..cb95fa8 100644 |
141 | --- a/crypto/blkcipher.c |
142 | +++ b/crypto/blkcipher.c |
143 | @@ -58,11 +58,13 @@ static inline void blkcipher_unmap_dst(struct blkcipher_walk *walk) |
144 | scatterwalk_unmap(walk->dst.virt.addr, 1); |
145 | } |
146 | |
147 | +/* Get a spot of the specified length that does not straddle a page. |
148 | + * The caller needs to ensure that there is enough space for this operation. |
149 | + */ |
150 | static inline u8 *blkcipher_get_spot(u8 *start, unsigned int len) |
151 | { |
152 | - if (offset_in_page(start + len) < len) |
153 | - return (u8 *)((unsigned long)(start + len) & PAGE_MASK); |
154 | - return start; |
155 | + u8 *end_page = (u8 *)(((unsigned long)(start + len - 1)) & PAGE_MASK); |
156 | + return start > end_page ? start : end_page; |
157 | } |
158 | |
159 | static inline unsigned int blkcipher_done_slow(struct crypto_blkcipher *tfm, |
160 | @@ -154,7 +156,8 @@ static inline int blkcipher_next_slow(struct blkcipher_desc *desc, |
161 | if (walk->buffer) |
162 | goto ok; |
163 | |
164 | - n = bsize * 2 + (alignmask & ~(crypto_tfm_ctx_alignment() - 1)); |
165 | + n = bsize * 3 - (alignmask + 1) + |
166 | + (alignmask & ~(crypto_tfm_ctx_alignment() - 1)); |
167 | walk->buffer = kmalloc(n, GFP_ATOMIC); |
168 | if (!walk->buffer) |
169 | return blkcipher_walk_done(desc, walk, -ENOMEM); |
170 | diff --git a/drivers/acpi/events/evgpeblk.c b/drivers/acpi/events/evgpeblk.c |
171 | index 95ddeb4..2ae48c2 100644 |
172 | --- a/drivers/acpi/events/evgpeblk.c |
173 | +++ b/drivers/acpi/events/evgpeblk.c |
174 | @@ -586,6 +586,10 @@ acpi_ev_delete_gpe_xrupt(struct acpi_gpe_xrupt_info *gpe_xrupt) |
175 | flags = acpi_os_acquire_lock(acpi_gbl_gpe_lock); |
176 | if (gpe_xrupt->previous) { |
177 | gpe_xrupt->previous->next = gpe_xrupt->next; |
178 | + } else { |
179 | + /* No previous, update list head */ |
180 | + |
181 | + acpi_gbl_gpe_xrupt_list_head = gpe_xrupt->next; |
182 | } |
183 | |
184 | if (gpe_xrupt->next) { |
185 | diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c |
186 | index 9a48ca2..3fc3895 100644 |
187 | --- a/drivers/ieee1394/ieee1394_core.c |
188 | +++ b/drivers/ieee1394/ieee1394_core.c |
189 | @@ -1170,7 +1170,7 @@ static void __exit ieee1394_cleanup(void) |
190 | unregister_chrdev_region(IEEE1394_CORE_DEV, 256); |
191 | } |
192 | |
193 | -fs_initcall(ieee1394_init); /* same as ohci1394 */ |
194 | +module_init(ieee1394_init); |
195 | module_exit(ieee1394_cleanup); |
196 | |
197 | /* Exported symbols */ |
198 | diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c |
199 | index 628130a..ec301a8 100644 |
200 | --- a/drivers/ieee1394/ohci1394.c |
201 | +++ b/drivers/ieee1394/ohci1394.c |
202 | @@ -3785,7 +3785,5 @@ static int __init ohci1394_init(void) |
203 | return pci_register_driver(&ohci1394_pci_driver); |
204 | } |
205 | |
206 | -/* Register before most other device drivers. |
207 | - * Useful for remote debugging via physical DMA, e.g. using firescope. */ |
208 | -fs_initcall(ohci1394_init); |
209 | +module_init(ohci1394_init); |
210 | module_exit(ohci1394_cleanup); |
211 | diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c |
212 | index 1fe1a83..1093ff4 100644 |
213 | --- a/drivers/media/video/cx88/cx88-mpeg.c |
214 | +++ b/drivers/media/video/cx88/cx88-mpeg.c |
215 | @@ -556,7 +556,7 @@ struct cx8802_dev * cx8802_get_device(struct inode *inode) |
216 | |
217 | list_for_each(list,&cx8802_devlist) { |
218 | h = list_entry(list, struct cx8802_dev, devlist); |
219 | - if (h->mpeg_dev->minor == minor) |
220 | + if (h->mpeg_dev && h->mpeg_dev->minor == minor) |
221 | return h; |
222 | } |
223 | |
224 | diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c |
225 | index a996aad..957694a 100644 |
226 | --- a/drivers/media/video/pwc/pwc-if.c |
227 | +++ b/drivers/media/video/pwc/pwc-if.c |
228 | @@ -1196,12 +1196,19 @@ static int pwc_video_open(struct inode *inode, struct file *file) |
229 | return 0; |
230 | } |
231 | |
232 | + |
233 | +static void pwc_cleanup(struct pwc_device *pdev) |
234 | +{ |
235 | + pwc_remove_sysfs_files(pdev->vdev); |
236 | + video_unregister_device(pdev->vdev); |
237 | +} |
238 | + |
239 | /* Note that all cleanup is done in the reverse order as in _open */ |
240 | static int pwc_video_close(struct inode *inode, struct file *file) |
241 | { |
242 | struct video_device *vdev = file->private_data; |
243 | struct pwc_device *pdev; |
244 | - int i; |
245 | + int i, hint; |
246 | |
247 | PWC_DEBUG_OPEN(">> video_close called(vdev = 0x%p).\n", vdev); |
248 | |
249 | @@ -1224,8 +1231,9 @@ static int pwc_video_close(struct inode *inode, struct file *file) |
250 | pwc_isoc_cleanup(pdev); |
251 | pwc_free_buffers(pdev); |
252 | |
253 | + lock_kernel(); |
254 | /* Turn off LEDS and power down camera, but only when not unplugged */ |
255 | - if (pdev->error_status != EPIPE) { |
256 | + if (!pdev->unplugged) { |
257 | /* Turn LEDs off */ |
258 | if (pwc_set_leds(pdev, 0, 0) < 0) |
259 | PWC_DEBUG_MODULE("Failed to set LED on/off time.\n"); |
260 | @@ -1234,9 +1242,19 @@ static int pwc_video_close(struct inode *inode, struct file *file) |
261 | if (i < 0) |
262 | PWC_ERROR("Failed to power down camera (%d)\n", i); |
263 | } |
264 | + pdev->vopen--; |
265 | + PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", i); |
266 | + } else { |
267 | + pwc_cleanup(pdev); |
268 | + /* Free memory (don't set pdev to 0 just yet) */ |
269 | + kfree(pdev); |
270 | + /* search device_hint[] table if we occupy a slot, by any chance */ |
271 | + for (hint = 0; hint < MAX_DEV_HINTS; hint++) |
272 | + if (device_hint[hint].pdev == pdev) |
273 | + device_hint[hint].pdev = NULL; |
274 | } |
275 | - pdev->vopen--; |
276 | - PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", pdev->vopen); |
277 | + unlock_kernel(); |
278 | + |
279 | return 0; |
280 | } |
281 | |
282 | @@ -1783,21 +1801,21 @@ static void usb_pwc_disconnect(struct usb_interface *intf) |
283 | /* Alert waiting processes */ |
284 | wake_up_interruptible(&pdev->frameq); |
285 | /* Wait until device is closed */ |
286 | - while (pdev->vopen) |
287 | - schedule(); |
288 | - /* Device is now closed, so we can safely unregister it */ |
289 | - PWC_DEBUG_PROBE("Unregistering video device in disconnect().\n"); |
290 | - pwc_remove_sysfs_files(pdev->vdev); |
291 | - video_unregister_device(pdev->vdev); |
292 | - |
293 | - /* Free memory (don't set pdev to 0 just yet) */ |
294 | - kfree(pdev); |
295 | + if(pdev->vopen) { |
296 | + pdev->unplugged = 1; |
297 | + } else { |
298 | + /* Device is closed, so we can safely unregister it */ |
299 | + PWC_DEBUG_PROBE("Unregistering video device in disconnect().\n"); |
300 | + pwc_cleanup(pdev); |
301 | + /* Free memory (don't set pdev to 0 just yet) */ |
302 | + kfree(pdev); |
303 | |
304 | disconnect_out: |
305 | - /* search device_hint[] table if we occupy a slot, by any chance */ |
306 | - for (hint = 0; hint < MAX_DEV_HINTS; hint++) |
307 | - if (device_hint[hint].pdev == pdev) |
308 | - device_hint[hint].pdev = NULL; |
309 | + /* search device_hint[] table if we occupy a slot, by any chance */ |
310 | + for (hint = 0; hint < MAX_DEV_HINTS; hint++) |
311 | + if (device_hint[hint].pdev == pdev) |
312 | + device_hint[hint].pdev = NULL; |
313 | + } |
314 | |
315 | unlock_kernel(); |
316 | } |
317 | diff --git a/drivers/media/video/pwc/pwc.h b/drivers/media/video/pwc/pwc.h |
318 | index 7e9c423..7dae6c4 100644 |
319 | --- a/drivers/media/video/pwc/pwc.h |
320 | +++ b/drivers/media/video/pwc/pwc.h |
321 | @@ -198,6 +198,7 @@ struct pwc_device |
322 | char vsnapshot; /* snapshot mode */ |
323 | char vsync; /* used by isoc handler */ |
324 | char vmirror; /* for ToUCaM series */ |
325 | + char unplugged; |
326 | |
327 | int cmd_len; |
328 | unsigned char cmd_buf[13]; |
329 | diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c |
330 | index c383dc3..f18edd8 100644 |
331 | --- a/drivers/net/forcedeth.c |
332 | +++ b/drivers/net/forcedeth.c |
333 | @@ -554,6 +554,7 @@ union ring_type { |
334 | #define PHY_OUI_MARVELL 0x5043 |
335 | #define PHY_OUI_CICADA 0x03f1 |
336 | #define PHY_OUI_VITESSE 0x01c1 |
337 | +#define PHY_OUI_REALTEK 0x0732 |
338 | #define PHYID1_OUI_MASK 0x03ff |
339 | #define PHYID1_OUI_SHFT 6 |
340 | #define PHYID2_OUI_MASK 0xfc00 |
341 | diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c |
342 | index 1aafa71..2847a0c 100644 |
343 | --- a/drivers/net/r8169.c |
344 | +++ b/drivers/net/r8169.c |
345 | @@ -2646,14 +2646,16 @@ rtl8169_interrupt(int irq, void *dev_instance) |
346 | rtl8169_check_link_status(dev, tp, ioaddr); |
347 | |
348 | #ifdef CONFIG_R8169_NAPI |
349 | - RTL_W16(IntrMask, rtl8169_intr_mask & ~rtl8169_napi_event); |
350 | - tp->intr_mask = ~rtl8169_napi_event; |
351 | - |
352 | - if (likely(netif_rx_schedule_prep(dev))) |
353 | - __netif_rx_schedule(dev); |
354 | - else if (netif_msg_intr(tp)) { |
355 | - printk(KERN_INFO "%s: interrupt %04x taken in poll\n", |
356 | - dev->name, status); |
357 | + if (status & rtl8169_napi_event) { |
358 | + RTL_W16(IntrMask, rtl8169_intr_mask & ~rtl8169_napi_event); |
359 | + tp->intr_mask = ~rtl8169_napi_event; |
360 | + |
361 | + if (likely(netif_rx_schedule_prep(dev))) |
362 | + __netif_rx_schedule(dev); |
363 | + else if (netif_msg_intr(tp)) { |
364 | + printk(KERN_INFO "%s: interrupt %04x in poll\n", |
365 | + dev->name, status); |
366 | + } |
367 | } |
368 | break; |
369 | #else |
370 | diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c |
371 | index b091a0f..9040564 100644 |
372 | --- a/drivers/scsi/3w-9xxx.c |
373 | +++ b/drivers/scsi/3w-9xxx.c |
374 | @@ -4,7 +4,7 @@ |
375 | Written By: Adam Radford <linuxraid@amcc.com> |
376 | Modifications By: Tom Couch <linuxraid@amcc.com> |
377 | |
378 | - Copyright (C) 2004-2006 Applied Micro Circuits Corporation. |
379 | + Copyright (C) 2004-2007 Applied Micro Circuits Corporation. |
380 | |
381 | This program is free software; you can redistribute it and/or modify |
382 | it under the terms of the GNU General Public License as published by |
383 | @@ -69,6 +69,7 @@ |
384 | 2.26.02.008 - Free irq handler in __twa_shutdown(). |
385 | Serialize reset code. |
386 | Add support for 9650SE controllers. |
387 | + 2.26.02.009 - Fix dma mask setting to fallback to 32-bit if 64-bit fails. |
388 | */ |
389 | |
390 | #include <linux/module.h> |
391 | @@ -92,7 +93,7 @@ |
392 | #include "3w-9xxx.h" |
393 | |
394 | /* Globals */ |
395 | -#define TW_DRIVER_VERSION "2.26.02.008" |
396 | +#define TW_DRIVER_VERSION "2.26.02.009" |
397 | static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT]; |
398 | static unsigned int twa_device_extension_count; |
399 | static int twa_major = -1; |
400 | @@ -2063,11 +2064,14 @@ static int __devinit twa_probe(struct pci_dev *pdev, const struct pci_device_id |
401 | |
402 | pci_set_master(pdev); |
403 | |
404 | - retval = pci_set_dma_mask(pdev, sizeof(dma_addr_t) > 4 ? DMA_64BIT_MASK : DMA_32BIT_MASK); |
405 | - if (retval) { |
406 | - TW_PRINTK(host, TW_DRIVER, 0x23, "Failed to set dma mask"); |
407 | - goto out_disable_device; |
408 | - } |
409 | + if (pci_set_dma_mask(pdev, DMA_64BIT_MASK) |
410 | + || pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK)) |
411 | + if (pci_set_dma_mask(pdev, DMA_32BIT_MASK) |
412 | + || pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK)) { |
413 | + TW_PRINTK(host, TW_DRIVER, 0x23, "Failed to set dma mask"); |
414 | + retval = -ENODEV; |
415 | + goto out_disable_device; |
416 | + } |
417 | |
418 | host = scsi_host_alloc(&driver_template, sizeof(TW_Device_Extension)); |
419 | if (!host) { |
420 | diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c |
421 | index d6eb5ce..c5dc61a 100644 |
422 | --- a/drivers/usb/core/driver.c |
423 | +++ b/drivers/usb/core/driver.c |
424 | @@ -66,7 +66,7 @@ static ssize_t store_new_id(struct device_driver *driver, |
425 | dynid->id.match_flags = USB_DEVICE_ID_MATCH_DEVICE; |
426 | |
427 | spin_lock(&usb_drv->dynids.lock); |
428 | - list_add_tail(&usb_drv->dynids.list, &dynid->node); |
429 | + list_add_tail(&dynid->node, &usb_drv->dynids.list); |
430 | spin_unlock(&usb_drv->dynids.lock); |
431 | |
432 | if (get_driver(driver)) { |
433 | diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c |
434 | index 149aa8b..dec1337 100644 |
435 | --- a/drivers/usb/core/message.c |
436 | +++ b/drivers/usb/core/message.c |
437 | @@ -608,12 +608,12 @@ int usb_get_descriptor(struct usb_device *dev, unsigned char type, unsigned char |
438 | memset(buf,0,size); // Make sure we parse really received data |
439 | |
440 | for (i = 0; i < 3; ++i) { |
441 | - /* retry on length 0 or stall; some devices are flakey */ |
442 | + /* retry on length 0 or error; some devices are flakey */ |
443 | result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), |
444 | USB_REQ_GET_DESCRIPTOR, USB_DIR_IN, |
445 | (type << 8) + index, 0, buf, size, |
446 | USB_CTRL_GET_TIMEOUT); |
447 | - if (result == 0 || result == -EPIPE) |
448 | + if (result <= 0 && result != -ETIMEDOUT) |
449 | continue; |
450 | if (result > 1 && ((u8 *)buf)[1] != type) { |
451 | result = -EPROTO; |
452 | diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c |
453 | index 4df39c4..99f0f72 100644 |
454 | --- a/fs/ext3/namei.c |
455 | +++ b/fs/ext3/namei.c |
456 | @@ -380,13 +380,28 @@ dx_probe(struct dentry *dentry, struct inode *dir, |
457 | |
458 | entries = (struct dx_entry *) (((char *)&root->info) + |
459 | root->info.info_length); |
460 | - assert(dx_get_limit(entries) == dx_root_limit(dir, |
461 | - root->info.info_length)); |
462 | + |
463 | + if (dx_get_limit(entries) != dx_root_limit(dir, |
464 | + root->info.info_length)) { |
465 | + ext3_warning(dir->i_sb, __FUNCTION__, |
466 | + "dx entry: limit != root limit"); |
467 | + brelse(bh); |
468 | + *err = ERR_BAD_DX_DIR; |
469 | + goto fail; |
470 | + } |
471 | + |
472 | dxtrace (printk("Look up %x", hash)); |
473 | while (1) |
474 | { |
475 | count = dx_get_count(entries); |
476 | - assert (count && count <= dx_get_limit(entries)); |
477 | + if (!count || count > dx_get_limit(entries)) { |
478 | + ext3_warning(dir->i_sb, __FUNCTION__, |
479 | + "dx entry: no count or count > limit"); |
480 | + brelse(bh); |
481 | + *err = ERR_BAD_DX_DIR; |
482 | + goto fail2; |
483 | + } |
484 | + |
485 | p = entries + 1; |
486 | q = entries + count - 1; |
487 | while (p <= q) |
488 | @@ -424,8 +439,15 @@ dx_probe(struct dentry *dentry, struct inode *dir, |
489 | if (!(bh = ext3_bread (NULL,dir, dx_get_block(at), 0, err))) |
490 | goto fail2; |
491 | at = entries = ((struct dx_node *) bh->b_data)->entries; |
492 | - assert (dx_get_limit(entries) == dx_node_limit (dir)); |
493 | + if (dx_get_limit(entries) != dx_node_limit (dir)) { |
494 | + ext3_warning(dir->i_sb, __FUNCTION__, |
495 | + "dx entry: limit != node limit"); |
496 | + brelse(bh); |
497 | + *err = ERR_BAD_DX_DIR; |
498 | + goto fail2; |
499 | + } |
500 | frame++; |
501 | + frame->bh = NULL; |
502 | } |
503 | fail2: |
504 | while (frame >= frame_in) { |
505 | @@ -433,6 +455,10 @@ fail2: |
506 | frame--; |
507 | } |
508 | fail: |
509 | + if (*err == ERR_BAD_DX_DIR) |
510 | + ext3_warning(dir->i_sb, __FUNCTION__, |
511 | + "Corrupt dir inode %ld, running e2fsck is " |
512 | + "recommended.", dir->i_ino); |
513 | return NULL; |
514 | } |
515 | |
516 | diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c |
517 | index e5a74a5..5edc327 100644 |
518 | --- a/fs/ext4/namei.c |
519 | +++ b/fs/ext4/namei.c |
520 | @@ -380,13 +380,28 @@ dx_probe(struct dentry *dentry, struct inode *dir, |
521 | |
522 | entries = (struct dx_entry *) (((char *)&root->info) + |
523 | root->info.info_length); |
524 | - assert(dx_get_limit(entries) == dx_root_limit(dir, |
525 | - root->info.info_length)); |
526 | + |
527 | + if (dx_get_limit(entries) != dx_root_limit(dir, |
528 | + root->info.info_length)) { |
529 | + ext4_warning(dir->i_sb, __FUNCTION__, |
530 | + "dx entry: limit != root limit"); |
531 | + brelse(bh); |
532 | + *err = ERR_BAD_DX_DIR; |
533 | + goto fail; |
534 | + } |
535 | + |
536 | dxtrace (printk("Look up %x", hash)); |
537 | while (1) |
538 | { |
539 | count = dx_get_count(entries); |
540 | - assert (count && count <= dx_get_limit(entries)); |
541 | + if (!count || count > dx_get_limit(entries)) { |
542 | + ext4_warning(dir->i_sb, __FUNCTION__, |
543 | + "dx entry: no count or count > limit"); |
544 | + brelse(bh); |
545 | + *err = ERR_BAD_DX_DIR; |
546 | + goto fail2; |
547 | + } |
548 | + |
549 | p = entries + 1; |
550 | q = entries + count - 1; |
551 | while (p <= q) |
552 | @@ -424,8 +439,15 @@ dx_probe(struct dentry *dentry, struct inode *dir, |
553 | if (!(bh = ext4_bread (NULL,dir, dx_get_block(at), 0, err))) |
554 | goto fail2; |
555 | at = entries = ((struct dx_node *) bh->b_data)->entries; |
556 | - assert (dx_get_limit(entries) == dx_node_limit (dir)); |
557 | + if (dx_get_limit(entries) != dx_node_limit (dir)) { |
558 | + ext4_warning(dir->i_sb, __FUNCTION__, |
559 | + "dx entry: limit != node limit"); |
560 | + brelse(bh); |
561 | + *err = ERR_BAD_DX_DIR; |
562 | + goto fail2; |
563 | + } |
564 | frame++; |
565 | + frame->bh = NULL; |
566 | } |
567 | fail2: |
568 | while (frame >= frame_in) { |
569 | @@ -433,6 +455,10 @@ fail2: |
570 | frame--; |
571 | } |
572 | fail: |
573 | + if (*err == ERR_BAD_DX_DIR) |
574 | + ext4_warning(dir->i_sb, __FUNCTION__, |
575 | + "Corrupt dir inode %ld, running e2fsck is " |
576 | + "recommended.", dir->i_ino); |
577 | return NULL; |
578 | } |
579 | |
580 | diff --git a/fs/locks.c b/fs/locks.c |
581 | index 52a8100..bcdfebc 100644 |
582 | --- a/fs/locks.c |
583 | +++ b/fs/locks.c |
584 | @@ -790,7 +790,7 @@ find_conflict: |
585 | if (request->fl_flags & FL_ACCESS) |
586 | goto out; |
587 | locks_copy_lock(new_fl, request); |
588 | - locks_insert_lock(&inode->i_flock, new_fl); |
589 | + locks_insert_lock(before, new_fl); |
590 | new_fl = NULL; |
591 | error = 0; |
592 | |
593 | diff --git a/fs/nfs/super.c b/fs/nfs/super.c |
594 | index 28108c8..c81fcd8 100644 |
595 | --- a/fs/nfs/super.c |
596 | +++ b/fs/nfs/super.c |
597 | @@ -180,8 +180,8 @@ void __exit unregister_nfs_fs(void) |
598 | remove_shrinker(acl_shrinker); |
599 | #ifdef CONFIG_NFS_V4 |
600 | unregister_filesystem(&nfs4_fs_type); |
601 | - nfs_unregister_sysctl(); |
602 | #endif |
603 | + nfs_unregister_sysctl(); |
604 | unregister_filesystem(&nfs_fs_type); |
605 | } |
606 | |
607 | diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c |
608 | index 511edef..3743086 100644 |
609 | --- a/fs/sysfs/dir.c |
610 | +++ b/fs/sysfs/dir.c |
611 | @@ -29,6 +29,14 @@ static struct dentry_operations sysfs_dentry_ops = { |
612 | .d_iput = sysfs_d_iput, |
613 | }; |
614 | |
615 | +static unsigned int sysfs_inode_counter; |
616 | +ino_t sysfs_get_inum(void) |
617 | +{ |
618 | + if (unlikely(sysfs_inode_counter < 3)) |
619 | + sysfs_inode_counter = 3; |
620 | + return sysfs_inode_counter++; |
621 | +} |
622 | + |
623 | /* |
624 | * Allocates a new sysfs_dirent and links it to the parent sysfs_dirent |
625 | */ |
626 | @@ -42,6 +50,7 @@ static struct sysfs_dirent * sysfs_new_dirent(struct sysfs_dirent * parent_sd, |
627 | return NULL; |
628 | |
629 | memset(sd, 0, sizeof(*sd)); |
630 | + sd->s_ino = sysfs_get_inum(); |
631 | atomic_set(&sd->s_count, 1); |
632 | atomic_set(&sd->s_event, 1); |
633 | INIT_LIST_HEAD(&sd->s_children); |
634 | @@ -461,7 +470,7 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir) |
635 | |
636 | switch (i) { |
637 | case 0: |
638 | - ino = dentry->d_inode->i_ino; |
639 | + ino = parent_sd->s_ino; |
640 | if (filldir(dirent, ".", 1, i, ino, DT_DIR) < 0) |
641 | break; |
642 | filp->f_pos++; |
643 | @@ -490,10 +499,7 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir) |
644 | |
645 | name = sysfs_get_name(next); |
646 | len = strlen(name); |
647 | - if (next->s_dentry) |
648 | - ino = next->s_dentry->d_inode->i_ino; |
649 | - else |
650 | - ino = iunique(sysfs_sb, 2); |
651 | + ino = next->s_ino; |
652 | |
653 | if (filldir(dirent, name, len, filp->f_pos, ino, |
654 | dt_type(next)) < 0) |
655 | diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c |
656 | index e79e38d..bb2da9d 100644 |
657 | --- a/fs/sysfs/inode.c |
658 | +++ b/fs/sysfs/inode.c |
659 | @@ -129,6 +129,7 @@ struct inode * sysfs_new_inode(mode_t mode, struct sysfs_dirent * sd) |
660 | inode->i_mapping->a_ops = &sysfs_aops; |
661 | inode->i_mapping->backing_dev_info = &sysfs_backing_dev_info; |
662 | inode->i_op = &sysfs_inode_operations; |
663 | + inode->i_ino = sd->s_ino; |
664 | lockdep_set_class(&inode->i_mutex, &sysfs_inode_imutex_key); |
665 | |
666 | if (sd->s_iattr) { |
667 | diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c |
668 | index e503f85..4305e46 100644 |
669 | --- a/fs/sysfs/mount.c |
670 | +++ b/fs/sysfs/mount.c |
671 | @@ -29,6 +29,7 @@ static struct sysfs_dirent sysfs_root = { |
672 | .s_element = NULL, |
673 | .s_type = SYSFS_ROOT, |
674 | .s_iattr = NULL, |
675 | + .s_ino = 1, |
676 | }; |
677 | |
678 | static int sysfs_fill_super(struct super_block *sb, void *data, int silent) |
679 | diff --git a/include/asm-avr32/atomic.h b/include/asm-avr32/atomic.h |
680 | index c40b603..7df7b75 100644 |
681 | --- a/include/asm-avr32/atomic.h |
682 | +++ b/include/asm-avr32/atomic.h |
683 | @@ -101,7 +101,7 @@ static inline int atomic_sub_unless(atomic_t *v, int a, int u) |
684 | " mov %1, 1\n" |
685 | "1:" |
686 | : "=&r"(tmp), "=&r"(result), "=o"(v->counter) |
687 | - : "m"(v->counter), "rKs21"(a), "rKs21"(u) |
688 | + : "m"(v->counter), "rKs21"(a), "rKs21"(u), "1"(result) |
689 | : "cc", "memory"); |
690 | |
691 | return result; |
692 | @@ -137,7 +137,7 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u) |
693 | " mov %1, 1\n" |
694 | "1:" |
695 | : "=&r"(tmp), "=&r"(result), "=o"(v->counter) |
696 | - : "m"(v->counter), "r"(a), "ir"(u) |
697 | + : "m"(v->counter), "r"(a), "ir"(u), "1"(result) |
698 | : "cc", "memory"); |
699 | } |
700 | |
701 | diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild |
702 | index 6328175..ab399fc 100644 |
703 | --- a/include/linux/netfilter/Kbuild |
704 | +++ b/include/linux/netfilter/Kbuild |
705 | @@ -28,6 +28,7 @@ header-y += xt_policy.h |
706 | header-y += xt_realm.h |
707 | header-y += xt_sctp.h |
708 | header-y += xt_state.h |
709 | +header-y += xt_statistic.h |
710 | header-y += xt_string.h |
711 | header-y += xt_tcpmss.h |
712 | header-y += xt_tcpudp.h |
713 | diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h |
714 | index 2129d1b..8799dc3 100644 |
715 | --- a/include/linux/sysfs.h |
716 | +++ b/include/linux/sysfs.h |
717 | @@ -73,6 +73,7 @@ struct sysfs_dirent { |
718 | void * s_element; |
719 | int s_type; |
720 | umode_t s_mode; |
721 | + ino_t s_ino; |
722 | struct dentry * s_dentry; |
723 | struct iattr * s_iattr; |
724 | atomic_t s_event; |
725 | diff --git a/include/net/tcp.h b/include/net/tcp.h |
726 | index cd8fa0c..da5bac3 100644 |
727 | --- a/include/net/tcp.h |
728 | +++ b/include/net/tcp.h |
729 | @@ -273,7 +273,7 @@ extern int tcp_v4_remember_stamp(struct sock *sk); |
730 | |
731 | extern int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw); |
732 | |
733 | -extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, |
734 | +extern int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, |
735 | struct msghdr *msg, size_t size); |
736 | extern ssize_t tcp_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags); |
737 | |
738 | diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c |
739 | index 50f24ee..5f0115f 100644 |
740 | --- a/kernel/futex_compat.c |
741 | +++ b/kernel/futex_compat.c |
742 | @@ -61,10 +61,10 @@ void compat_exit_robust_list(struct task_struct *curr) |
743 | if (fetch_robust_entry(&upending, &pending, |
744 | &head->list_op_pending, &pip)) |
745 | return; |
746 | - if (upending) |
747 | + if (pending) |
748 | handle_futex_death((void __user *)pending + futex_offset, curr, pip); |
749 | |
750 | - while (compat_ptr(uentry) != &head->list) { |
751 | + while (entry != (struct robust_list __user *) &head->list) { |
752 | /* |
753 | * A pending lock might already be on the list, so |
754 | * dont process it twice: |
755 | diff --git a/kernel/signal.c b/kernel/signal.c |
756 | index 5630255..4975f4c 100644 |
757 | --- a/kernel/signal.c |
758 | +++ b/kernel/signal.c |
759 | @@ -1345,20 +1345,19 @@ struct sigqueue *sigqueue_alloc(void) |
760 | void sigqueue_free(struct sigqueue *q) |
761 | { |
762 | unsigned long flags; |
763 | + spinlock_t *lock = ¤t->sighand->siglock; |
764 | + |
765 | BUG_ON(!(q->flags & SIGQUEUE_PREALLOC)); |
766 | /* |
767 | * If the signal is still pending remove it from the |
768 | - * pending queue. |
769 | + * pending queue. We must hold ->siglock while testing |
770 | + * q->list to serialize with collect_signal(). |
771 | */ |
772 | - if (unlikely(!list_empty(&q->list))) { |
773 | - spinlock_t *lock = ¤t->sighand->siglock; |
774 | - read_lock(&tasklist_lock); |
775 | - spin_lock_irqsave(lock, flags); |
776 | - if (!list_empty(&q->list)) |
777 | - list_del_init(&q->list); |
778 | - spin_unlock_irqrestore(lock, flags); |
779 | - read_unlock(&tasklist_lock); |
780 | - } |
781 | + spin_lock_irqsave(lock, flags); |
782 | + if (!list_empty(&q->list)) |
783 | + list_del_init(&q->list); |
784 | + spin_unlock_irqrestore(lock, flags); |
785 | + |
786 | q->flags &= ~SIGQUEUE_PREALLOC; |
787 | __sigqueue_free(q); |
788 | } |
789 | diff --git a/kernel/sys.c b/kernel/sys.c |
790 | index 475ddbb..17f8447 100644 |
791 | --- a/kernel/sys.c |
792 | +++ b/kernel/sys.c |
793 | @@ -1358,7 +1358,6 @@ asmlinkage long sys_times(struct tms __user * tbuf) |
794 | * Auch. Had to add the 'did_exec' flag to conform completely to POSIX. |
795 | * LBT 04.03.94 |
796 | */ |
797 | - |
798 | asmlinkage long sys_setpgid(pid_t pid, pid_t pgid) |
799 | { |
800 | struct task_struct *p; |
801 | @@ -1386,7 +1385,7 @@ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid) |
802 | if (!thread_group_leader(p)) |
803 | goto out; |
804 | |
805 | - if (p->real_parent == group_leader) { |
806 | + if (p->real_parent->tgid == group_leader->tgid) { |
807 | err = -EPERM; |
808 | if (process_session(p) != process_session(group_leader)) |
809 | goto out; |
810 | diff --git a/net/802/psnap.c b/net/802/psnap.c |
811 | index 270b9d2..44dc3f9 100644 |
812 | --- a/net/802/psnap.c |
813 | +++ b/net/802/psnap.c |
814 | @@ -55,6 +55,9 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev, |
815 | .type = __constant_htons(ETH_P_SNAP), |
816 | }; |
817 | |
818 | + if (unlikely(!pskb_may_pull(skb, 5))) |
819 | + goto drop; |
820 | + |
821 | rcu_read_lock(); |
822 | proto = find_snap_client(skb->h.raw); |
823 | if (proto) { |
824 | @@ -62,14 +65,18 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev, |
825 | skb->h.raw += 5; |
826 | skb_pull_rcsum(skb, 5); |
827 | rc = proto->rcvfunc(skb, dev, &snap_packet_type, orig_dev); |
828 | - } else { |
829 | - skb->sk = NULL; |
830 | - kfree_skb(skb); |
831 | - rc = 1; |
832 | } |
833 | - |
834 | rcu_read_unlock(); |
835 | + |
836 | + if (unlikely(!proto)) |
837 | + goto drop; |
838 | + |
839 | +out: |
840 | return rc; |
841 | + |
842 | +drop: |
843 | + kfree_skb(skb); |
844 | + goto out; |
845 | } |
846 | |
847 | /* |
848 | diff --git a/net/core/datagram.c b/net/core/datagram.c |
849 | index 797fdd4..5d55a2e 100644 |
850 | --- a/net/core/datagram.c |
851 | +++ b/net/core/datagram.c |
852 | @@ -444,6 +444,9 @@ int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb, |
853 | __wsum csum; |
854 | int chunk = skb->len - hlen; |
855 | |
856 | + if (!chunk) |
857 | + return 0; |
858 | + |
859 | /* Skip filled elements. |
860 | * Pretty silly, look at memcpy_toiovec, though 8) |
861 | */ |
862 | diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c |
863 | index fd38b05..05324db 100644 |
864 | --- a/net/dccp/ccids/ccid2.c |
865 | +++ b/net/dccp/ccids/ccid2.c |
866 | @@ -298,7 +298,7 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len) |
867 | int rc; |
868 | |
869 | ccid2_pr_debug("allocating more space in history\n"); |
870 | - rc = ccid2_hc_tx_alloc_seq(hctx, CCID2_SEQBUF_LEN, GFP_KERNEL); |
871 | + rc = ccid2_hc_tx_alloc_seq(hctx, CCID2_SEQBUF_LEN, gfp_any()); |
872 | BUG_ON(rc); /* XXX what do we do? */ |
873 | |
874 | next = hctx->ccid2hctx_seqh->ccid2s_next; |
875 | diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c |
876 | index 8640096..d8e6f77 100644 |
877 | --- a/net/ipv4/af_inet.c |
878 | +++ b/net/ipv4/af_inet.c |
879 | @@ -803,7 +803,7 @@ const struct proto_ops inet_stream_ops = { |
880 | .shutdown = inet_shutdown, |
881 | .setsockopt = sock_common_setsockopt, |
882 | .getsockopt = sock_common_getsockopt, |
883 | - .sendmsg = inet_sendmsg, |
884 | + .sendmsg = tcp_sendmsg, |
885 | .recvmsg = sock_common_recvmsg, |
886 | .mmap = sock_no_mmap, |
887 | .sendpage = tcp_sendpage, |
888 | diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c |
889 | index 67a5509..41ad421 100644 |
890 | --- a/net/ipv4/ah4.c |
891 | +++ b/net/ipv4/ah4.c |
892 | @@ -46,7 +46,7 @@ static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr) |
893 | memcpy(daddr, optptr+optlen-4, 4); |
894 | /* Fall through */ |
895 | default: |
896 | - memset(optptr+2, 0, optlen-2); |
897 | + memset(optptr, 0, optlen); |
898 | } |
899 | l -= optlen; |
900 | optptr += optlen; |
901 | diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c |
902 | index 6842474..a3818f2 100644 |
903 | --- a/net/ipv4/tcp.c |
904 | +++ b/net/ipv4/tcp.c |
905 | @@ -658,9 +658,10 @@ static inline int select_size(struct sock *sk, struct tcp_sock *tp) |
906 | return tmp; |
907 | } |
908 | |
909 | -int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, |
910 | +int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, |
911 | size_t size) |
912 | { |
913 | + struct sock *sk = sock->sk; |
914 | struct iovec *iov; |
915 | struct tcp_sock *tp = tcp_sk(sk); |
916 | struct sk_buff *skb; |
917 | diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c |
918 | index 12de90a..9c4862f 100644 |
919 | --- a/net/ipv4/tcp_ipv4.c |
920 | +++ b/net/ipv4/tcp_ipv4.c |
921 | @@ -2427,7 +2427,6 @@ struct proto tcp_prot = { |
922 | .shutdown = tcp_shutdown, |
923 | .setsockopt = tcp_setsockopt, |
924 | .getsockopt = tcp_getsockopt, |
925 | - .sendmsg = tcp_sendmsg, |
926 | .recvmsg = tcp_recvmsg, |
927 | .backlog_rcv = tcp_v4_do_rcv, |
928 | .hash = tcp_v4_hash, |
929 | diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c |
930 | index 0e0e426..30c8299 100644 |
931 | --- a/net/ipv6/af_inet6.c |
932 | +++ b/net/ipv6/af_inet6.c |
933 | @@ -473,7 +473,7 @@ const struct proto_ops inet6_stream_ops = { |
934 | .shutdown = inet_shutdown, /* ok */ |
935 | .setsockopt = sock_common_setsockopt, /* ok */ |
936 | .getsockopt = sock_common_getsockopt, /* ok */ |
937 | - .sendmsg = inet_sendmsg, /* ok */ |
938 | + .sendmsg = tcp_sendmsg, /* ok */ |
939 | .recvmsg = sock_common_recvmsg, /* ok */ |
940 | .mmap = sock_no_mmap, |
941 | .sendpage = tcp_sendpage, |
942 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c |
943 | index 7b7bd44..2c613fa 100644 |
944 | --- a/net/ipv6/ip6_output.c |
945 | +++ b/net/ipv6/ip6_output.c |
946 | @@ -1357,8 +1357,9 @@ void ip6_flush_pending_frames(struct sock *sk) |
947 | struct sk_buff *skb; |
948 | |
949 | while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) { |
950 | - IP6_INC_STATS(ip6_dst_idev(skb->dst), |
951 | - IPSTATS_MIB_OUTDISCARDS); |
952 | + if (skb->dst) |
953 | + IP6_INC_STATS(ip6_dst_idev(skb->dst), |
954 | + IPSTATS_MIB_OUTDISCARDS); |
955 | kfree_skb(skb); |
956 | } |
957 | |
958 | diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c |
959 | index 9479fbd..ddbe790 100644 |
960 | --- a/net/ipv6/raw.c |
961 | +++ b/net/ipv6/raw.c |
962 | @@ -851,11 +851,10 @@ back_from_confirm: |
963 | ip6_flush_pending_frames(sk); |
964 | else if (!(msg->msg_flags & MSG_MORE)) |
965 | err = rawv6_push_pending_frames(sk, &fl, rp); |
966 | + release_sock(sk); |
967 | } |
968 | done: |
969 | dst_release(dst); |
970 | - if (!inet->hdrincl) |
971 | - release_sock(sk); |
972 | out: |
973 | fl6_sock_release(flowlabel); |
974 | return err<0?err:len; |
975 | diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c |
976 | index 03f53f5..f6214b7 100644 |
977 | --- a/net/ipv6/tcp_ipv6.c |
978 | +++ b/net/ipv6/tcp_ipv6.c |
979 | @@ -2127,7 +2127,6 @@ struct proto tcpv6_prot = { |
980 | .shutdown = tcp_shutdown, |
981 | .setsockopt = tcp_setsockopt, |
982 | .getsockopt = tcp_getsockopt, |
983 | - .sendmsg = tcp_sendmsg, |
984 | .recvmsg = tcp_recvmsg, |
985 | .backlog_rcv = tcp_v6_do_rcv, |
986 | .hash = tcp_v6_hash, |
987 | diff --git a/net/socket.c b/net/socket.c |
988 | index afb6085..d9bae01 100644 |
989 | --- a/net/socket.c |
990 | +++ b/net/socket.c |
991 | @@ -1147,7 +1147,7 @@ static int __sock_create(int family, int type, int protocol, |
992 | module_put(pf->owner); |
993 | err = security_socket_post_create(sock, family, type, protocol, kern); |
994 | if (err) |
995 | - goto out_release; |
996 | + goto out_sock_release; |
997 | *res = sock; |
998 | |
999 | return 0; |
1000 | diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c |
1001 | index bc0bd09..02c2ce6 100644 |
1002 | --- a/sound/core/memalloc.c |
1003 | +++ b/sound/core/memalloc.c |
1004 | @@ -27,6 +27,7 @@ |
1005 | #include <linux/pci.h> |
1006 | #include <linux/slab.h> |
1007 | #include <linux/mm.h> |
1008 | +#include <linux/seq_file.h> |
1009 | #include <asm/uaccess.h> |
1010 | #include <linux/dma-mapping.h> |
1011 | #include <linux/moduleparam.h> |
1012 | @@ -483,10 +484,8 @@ static void free_all_reserved_pages(void) |
1013 | #define SND_MEM_PROC_FILE "driver/snd-page-alloc" |
1014 | static struct proc_dir_entry *snd_mem_proc; |
1015 | |
1016 | -static int snd_mem_proc_read(char *page, char **start, off_t off, |
1017 | - int count, int *eof, void *data) |
1018 | +static int snd_mem_proc_read(struct seq_file *seq, void *offset) |
1019 | { |
1020 | - int len = 0; |
1021 | long pages = snd_allocated_pages >> (PAGE_SHIFT-12); |
1022 | struct list_head *p; |
1023 | struct snd_mem_list *mem; |
1024 | @@ -494,44 +493,47 @@ static int snd_mem_proc_read(char *page, char **start, off_t off, |
1025 | static char *types[] = { "UNKNOWN", "CONT", "DEV", "DEV-SG", "SBUS" }; |
1026 | |
1027 | mutex_lock(&list_mutex); |
1028 | - len += snprintf(page + len, count - len, |
1029 | - "pages : %li bytes (%li pages per %likB)\n", |
1030 | - pages * PAGE_SIZE, pages, PAGE_SIZE / 1024); |
1031 | + seq_printf(seq, "pages : %li bytes (%li pages per %likB)\n", |
1032 | + pages * PAGE_SIZE, pages, PAGE_SIZE / 1024); |
1033 | devno = 0; |
1034 | list_for_each(p, &mem_list_head) { |
1035 | mem = list_entry(p, struct snd_mem_list, list); |
1036 | devno++; |
1037 | - len += snprintf(page + len, count - len, |
1038 | - "buffer %d : ID %08x : type %s\n", |
1039 | - devno, mem->id, types[mem->buffer.dev.type]); |
1040 | - len += snprintf(page + len, count - len, |
1041 | - " addr = 0x%lx, size = %d bytes\n", |
1042 | - (unsigned long)mem->buffer.addr, (int)mem->buffer.bytes); |
1043 | + seq_printf(seq, "buffer %d : ID %08x : type %s\n", |
1044 | + devno, mem->id, types[mem->buffer.dev.type]); |
1045 | + seq_printf(seq, " addr = 0x%lx, size = %d bytes\n", |
1046 | + (unsigned long)mem->buffer.addr, |
1047 | + (int)mem->buffer.bytes); |
1048 | } |
1049 | mutex_unlock(&list_mutex); |
1050 | - return len; |
1051 | + return 0; |
1052 | +} |
1053 | + |
1054 | +static int snd_mem_proc_open(struct inode *inode, struct file *file) |
1055 | +{ |
1056 | + return single_open(file, snd_mem_proc_read, NULL); |
1057 | } |
1058 | |
1059 | /* FIXME: for pci only - other bus? */ |
1060 | #ifdef CONFIG_PCI |
1061 | #define gettoken(bufp) strsep(bufp, " \t\n") |
1062 | |
1063 | -static int snd_mem_proc_write(struct file *file, const char __user *buffer, |
1064 | - unsigned long count, void *data) |
1065 | +static ssize_t snd_mem_proc_write(struct file *file, const char __user * buffer, |
1066 | + size_t count, loff_t * ppos) |
1067 | { |
1068 | char buf[128]; |
1069 | char *token, *p; |
1070 | |
1071 | - if (count > ARRAY_SIZE(buf) - 1) |
1072 | - count = ARRAY_SIZE(buf) - 1; |
1073 | + if (count > sizeof(buf) - 1) |
1074 | + return -EINVAL; |
1075 | if (copy_from_user(buf, buffer, count)) |
1076 | return -EFAULT; |
1077 | - buf[ARRAY_SIZE(buf) - 1] = '\0'; |
1078 | + buf[count] = '\0'; |
1079 | |
1080 | p = buf; |
1081 | token = gettoken(&p); |
1082 | if (! token || *token == '#') |
1083 | - return (int)count; |
1084 | + return count; |
1085 | if (strcmp(token, "add") == 0) { |
1086 | char *endp; |
1087 | int vendor, device, size, buffers; |
1088 | @@ -552,7 +554,7 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer, |
1089 | (buffers = simple_strtol(token, NULL, 0)) <= 0 || |
1090 | buffers > 4) { |
1091 | printk(KERN_ERR "snd-page-alloc: invalid proc write format\n"); |
1092 | - return (int)count; |
1093 | + return count; |
1094 | } |
1095 | vendor &= 0xffff; |
1096 | device &= 0xffff; |
1097 | @@ -564,7 +566,7 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer, |
1098 | if (pci_set_dma_mask(pci, mask) < 0 || |
1099 | pci_set_consistent_dma_mask(pci, mask) < 0) { |
1100 | printk(KERN_ERR "snd-page-alloc: cannot set DMA mask %lx for pci %04x:%04x\n", mask, vendor, device); |
1101 | - return (int)count; |
1102 | + return count; |
1103 | } |
1104 | } |
1105 | for (i = 0; i < buffers; i++) { |
1106 | @@ -574,7 +576,7 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer, |
1107 | size, &dmab) < 0) { |
1108 | printk(KERN_ERR "snd-page-alloc: cannot allocate buffer pages (size = %d)\n", size); |
1109 | pci_dev_put(pci); |
1110 | - return (int)count; |
1111 | + return count; |
1112 | } |
1113 | snd_dma_reserve_buf(&dmab, snd_dma_pci_buf_id(pci)); |
1114 | } |
1115 | @@ -600,9 +602,21 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer, |
1116 | free_all_reserved_pages(); |
1117 | else |
1118 | printk(KERN_ERR "snd-page-alloc: invalid proc cmd\n"); |
1119 | - return (int)count; |
1120 | + return count; |
1121 | } |
1122 | #endif /* CONFIG_PCI */ |
1123 | + |
1124 | +static const struct file_operations snd_mem_proc_fops = { |
1125 | + .owner = THIS_MODULE, |
1126 | + .open = snd_mem_proc_open, |
1127 | + .read = seq_read, |
1128 | +#ifdef CONFIG_PCI |
1129 | + .write = snd_mem_proc_write, |
1130 | +#endif |
1131 | + .llseek = seq_lseek, |
1132 | + .release = single_release, |
1133 | +}; |
1134 | + |
1135 | #endif /* CONFIG_PROC_FS */ |
1136 | |
1137 | /* |
1138 | @@ -613,12 +627,8 @@ static int __init snd_mem_init(void) |
1139 | { |
1140 | #ifdef CONFIG_PROC_FS |
1141 | snd_mem_proc = create_proc_entry(SND_MEM_PROC_FILE, 0644, NULL); |
1142 | - if (snd_mem_proc) { |
1143 | - snd_mem_proc->read_proc = snd_mem_proc_read; |
1144 | -#ifdef CONFIG_PCI |
1145 | - snd_mem_proc->write_proc = snd_mem_proc_write; |
1146 | -#endif |
1147 | - } |
1148 | + if (snd_mem_proc) |
1149 | + snd_mem_proc->proc_fops = &snd_mem_proc_fops; |
1150 | #endif |
1151 | return 0; |
1152 | } |