Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.24-r3/0105-2.6.24.6-all-fixes.patch

    Contents of /trunk/kernel26-alx/patches-2.6.24-r3/0105-2.6.24.6-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1022 - (show annotations) (download)
    Sun Apr 25 14:59:21 2010 UTC (14 years ago) by niro
    File size: 8770 byte(s) 
    -added alx kernel
    1 diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c
    2 index 232fdeb..9994c52 100644
    3 --- a/arch/x86/kernel/io_apic_32.c
    4 +++ b/arch/x86/kernel/io_apic_32.c
    5 @@ -2478,6 +2478,7 @@ void destroy_irq(unsigned int irq)
    6 dynamic_irq_cleanup(irq);
    7
    8 spin_lock_irqsave(&vector_lock, flags);
    9 + clear_bit(irq_vector[irq], used_vectors);
    10 irq_vector[irq] = 0;
    11 spin_unlock_irqrestore(&vector_lock, flags);
    12 }
    13 diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
    14 index 48c1775..cb42b69 100644
    15 --- a/drivers/isdn/capi/capidrv.c
    16 +++ b/drivers/isdn/capi/capidrv.c
    17 @@ -2332,13 +2332,14 @@ static int __init capidrv_init(void)
    18
    19 static void __exit capidrv_exit(void)
    20 {
    21 - char rev[10];
    22 + char rev[32];
    23 char *p;
    24
    25 if ((p = strchr(revision, ':')) != 0) {
    26 - strcpy(rev, p + 1);
    27 - p = strchr(rev, '$');
    28 - *p = 0;
    29 + strncpy(rev, p + 1, sizeof(rev));
    30 + rev[sizeof(rev)-1] = 0;
    31 + if ((p = strchr(rev, '$')) != 0)
    32 + *p = 0;
    33 } else {
    34 strcpy(rev, " ??? ");
    35 }
    36 diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
    37 index ced83c2..ef1a300 100644
    38 --- a/drivers/isdn/i4l/isdn_net.c
    39 +++ b/drivers/isdn/i4l/isdn_net.c
    40 @@ -2010,6 +2010,7 @@ isdn_net_init(struct net_device *ndev)
    41 ndev->flags = IFF_NOARP|IFF_POINTOPOINT;
    42 ndev->type = ARPHRD_ETHER;
    43 ndev->addr_len = ETH_ALEN;
    44 + ndev->validate_addr = NULL;
    45
    46 /* for clients with MPPP maybe higher values better */
    47 ndev->tx_queue_len = 30;
    48 diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
    49 index a4eb6a8..0ff3e4c 100644
    50 --- a/drivers/media/video/cx88/cx88-cards.c
    51 +++ b/drivers/media/video/cx88/cx88-cards.c
    52 @@ -1349,6 +1349,10 @@ static const struct cx88_board cx88_boards[] = {
    53 }},
    54 /* fixme: Add radio support */
    55 .mpeg = CX88_MPEG_DVB | CX88_MPEG_BLACKBIRD,
    56 + .radio = {
    57 + .type = CX88_RADIO,
    58 + .gpio0 = 0xe780,
    59 + },
    60 },
    61 [CX88_BOARD_ADSTECH_PTV_390] = {
    62 .name = "ADS Tech Instant Video PCI",
    63 diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
    64 index fd6826f..da9a10e 100644
    65 --- a/drivers/media/video/ivtv/ivtv-ioctl.c
    66 +++ b/drivers/media/video/ivtv/ivtv-ioctl.c
    67 @@ -727,7 +727,8 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, struct file *filp, unsigned int cmd, void
    68
    69 memset(vcap, 0, sizeof(*vcap));
    70 strcpy(vcap->driver, IVTV_DRIVER_NAME); /* driver name */
    71 - strcpy(vcap->card, itv->card_name); /* card type */
    72 + strncpy(vcap->card, itv->card_name,
    73 + sizeof(vcap->card)-1); /* card type */
    74 strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */
    75 vcap->version = IVTV_DRIVER_VERSION; /* version */
    76 vcap->capabilities = itv->v4l2_cap; /* capabilities */
    77 diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
    78 index 21230c9..fe5be1b 100644
    79 --- a/drivers/net/tehuti.c
    80 +++ b/drivers/net/tehuti.c
    81 @@ -625,6 +625,12 @@ static void __init bdx_firmware_endianess(void)
    82 s_firmLoad[i] = CPU_CHIP_SWAP32(s_firmLoad[i]);
    83 }
    84
    85 +static int bdx_range_check(struct bdx_priv *priv, u32 offset)
    86 +{
    87 + return (offset > (u32) (BDX_REGS_SIZE / priv->nic->port_num)) ?
    88 + -EINVAL : 0;
    89 +}
    90 +
    91 static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
    92 {
    93 struct bdx_priv *priv = ndev->priv;
    94 @@ -643,9 +649,15 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
    95 DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]);
    96 }
    97
    98 + if (!capable(CAP_NET_ADMIN))
    99 + return -EPERM;
    100 +
    101 switch (data[0]) {
    102
    103 case BDX_OP_READ:
    104 + error = bdx_range_check(priv, data[1]);
    105 + if (error < 0)
    106 + return error;
    107 data[2] = READ_REG(priv, data[1]);
    108 DBG("read_reg(0x%x)=0x%x (dec %d)\n", data[1], data[2],
    109 data[2]);
    110 @@ -655,6 +667,9 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
    111 break;
    112
    113 case BDX_OP_WRITE:
    114 + error = bdx_range_check(priv, data[1]);
    115 + if (error < 0)
    116 + return error;
    117 WRITE_REG(priv, data[1], data[2]);
    118 DBG("write_reg(0x%x, 0x%x)\n", data[1], data[2]);
    119 break;
    120 diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
    121 index 9e732bf..ba7935d 100644
    122 --- a/drivers/usb/gadget/ether.c
    123 +++ b/drivers/usb/gadget/ether.c
    124 @@ -1561,6 +1561,7 @@ done_set_intf:
    125 memcpy(req->buf, buf, n);
    126 req->complete = rndis_response_complete;
    127 rndis_free_response(dev->rndis_config, buf);
    128 + value = n;
    129 }
    130 /* else stalls ... spec says to avoid that */
    131 }
    132 diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
    133 index 497e29a..d7fae72 100644
    134 --- a/drivers/usb/serial/usb-serial.c
    135 +++ b/drivers/usb/serial/usb-serial.c
    136 @@ -844,6 +844,7 @@ int usb_serial_probe(struct usb_interface *interface,
    137 serial->num_interrupt_in = num_interrupt_in;
    138 serial->num_interrupt_out = num_interrupt_out;
    139
    140 +#if 0
    141 /* check that the device meets the driver's requirements */
    142 if ((type->num_interrupt_in != NUM_DONT_CARE &&
    143 type->num_interrupt_in != num_interrupt_in)
    144 @@ -857,6 +858,7 @@ int usb_serial_probe(struct usb_interface *interface,
    145 kfree(serial);
    146 return -EIO;
    147 }
    148 +#endif
    149
    150 /* found all that we need */
    151 dev_info(&interface->dev, "%s converter detected\n",
    152 diff --git a/fs/dnotify.c b/fs/dnotify.c
    153 index 28d01ed..eaecc4c 100644
    154 --- a/fs/dnotify.c
    155 +++ b/fs/dnotify.c
    156 @@ -20,6 +20,7 @@
    157 #include <linux/init.h>
    158 #include <linux/spinlock.h>
    159 #include <linux/slab.h>
    160 +#include <linux/file.h>
    161
    162 int dir_notify_enable __read_mostly = 1;
    163
    164 @@ -66,6 +67,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
    165 struct dnotify_struct **prev;
    166 struct inode *inode;
    167 fl_owner_t id = current->files;
    168 + struct file *f;
    169 int error = 0;
    170
    171 if ((arg & ~DN_MULTISHOT) == 0) {
    172 @@ -92,6 +94,15 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
    173 prev = &odn->dn_next;
    174 }
    175
    176 + rcu_read_lock();
    177 + f = fcheck(fd);
    178 + rcu_read_unlock();
    179 + /* we'd lost the race with close(), sod off silently */
    180 + /* note that inode->i_lock prevents reordering problems
    181 + * between accesses to descriptor table and ->i_dnotify */
    182 + if (f != filp)
    183 + goto out_free;
    184 +
    185 error = __f_setown(filp, task_pid(current), PIDTYPE_PID, 0);
    186 if (error)
    187 goto out_free;
    188 diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
    189 index a1db918..4c895f3 100644
    190 --- a/fs/jffs2/erase.c
    191 +++ b/fs/jffs2/erase.c
    192 @@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
    193 if (jffs2_write_nand_cleanmarker(c, jeb))
    194 goto filebad;
    195 }
    196 -
    197 - /* Everything else got zeroed before the erase */
    198 - jeb->free_size = c->sector_size;
    199 } else {
    200
    201 struct kvec vecs[1];
    202 @@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
    203
    204 goto filebad;
    205 }
    206 -
    207 - /* Everything else got zeroed before the erase */
    208 - jeb->free_size = c->sector_size;
    209 - /* FIXME Special case for cleanmarker in empty block */
    210 - jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
    211 }
    212 + /* Everything else got zeroed before the erase */
    213 + jeb->free_size = c->sector_size;
    214
    215 down(&c->erase_free_sem);
    216 spin_lock(&c->erase_completion_lock);
    217 +
    218 c->erasing_size -= c->sector_size;
    219 - c->free_size += jeb->free_size;
    220 - c->used_size += jeb->used_size;
    221 + c->free_size += c->sector_size;
    222 +
    223 + /* Account for cleanmarker now, if it's in-band */
    224 + if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c))
    225 + jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
    226
    227 jffs2_dbg_acct_sanity_check_nolock(c,jeb);
    228 jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
    229 diff --git a/fs/splice.c b/fs/splice.c
    230 index e313478..109153c 100644
    231 --- a/fs/splice.c
    232 +++ b/fs/splice.c
    233 @@ -314,7 +314,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
    234 break;
    235
    236 error = add_to_page_cache_lru(page, mapping, index,
    237 - GFP_KERNEL);
    238 + mapping_gfp_mask(mapping));
    239 if (unlikely(error)) {
    240 page_cache_release(page);
    241 if (error == -EEXIST)
    242 diff --git a/include/net/tcp.h b/include/net/tcp.h
    243 index cb5b033..fbc4959 100644
    244 --- a/include/net/tcp.h
    245 +++ b/include/net/tcp.h
    246 @@ -775,11 +775,14 @@ extern void tcp_enter_cwr(struct sock *sk, const int set_ssthresh);
    247 extern __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst);
    248
    249 /* Slow start with delack produces 3 packets of burst, so that
    250 - * it is safe "de facto".
    251 + * it is safe "de facto". This will be the default - same as
    252 + * the default reordering threshold - but if reordering increases,
    253 + * we must be able to allow cwnd to burst at least this much in order
    254 + * to not pull it back when holes are filled.
    255 */
    256 static __inline__ __u32 tcp_max_burst(const struct tcp_sock *tp)
    257 {
    258 - return 3;
    259 + return tp->reordering;
    260 }
    261
    262 /* RFC2861 Check whether we are limited by application or congestion window