Annotation of /trunk/kernel26-alx/patches-2.6.26-r1/0103-2.6.26.4-all-fixes.patch
Parent Directory | Revision Log
Revision 681 -
(hide annotations)
(download)
Wed Sep 17 19:42:13 2008 UTC (16 years ago) by niro
File size: 58786 byte(s)
Wed Sep 17 19:42:13 2008 UTC (16 years ago) by niro
File size: 58786 byte(s)
-2.6.26-alx-r1
1 | niro | 681 | diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c |
2 | index e289a98..387d3f6 100644 | ||
3 | --- a/arch/sparc64/mm/init.c | ||
4 | +++ b/arch/sparc64/mm/init.c | ||
5 | @@ -842,6 +842,9 @@ static unsigned long nid_range(unsigned long start, unsigned long end, | ||
6 | start += PAGE_SIZE; | ||
7 | } | ||
8 | |||
9 | + if (start > end) | ||
10 | + start = end; | ||
11 | + | ||
12 | return start; | ||
13 | } | ||
14 | #else | ||
15 | @@ -1769,8 +1772,7 @@ void __init paging_init(void) | ||
16 | |||
17 | find_ramdisk(phys_base); | ||
18 | |||
19 | - if (cmdline_memory_size) | ||
20 | - lmb_enforce_memory_limit(phys_base + cmdline_memory_size); | ||
21 | + lmb_enforce_memory_limit(cmdline_memory_size); | ||
22 | |||
23 | lmb_analyze(); | ||
24 | lmb_dump_all(); | ||
25 | @@ -2007,6 +2009,15 @@ void __init mem_init(void) | ||
26 | void free_initmem(void) | ||
27 | { | ||
28 | unsigned long addr, initend; | ||
29 | + int do_free = 1; | ||
30 | + | ||
31 | + /* If the physical memory maps were trimmed by kernel command | ||
32 | + * line options, don't even try freeing this initmem stuff up. | ||
33 | + * The kernel image could have been in the trimmed out region | ||
34 | + * and if so the freeing below will free invalid page structs. | ||
35 | + */ | ||
36 | + if (cmdline_memory_size) | ||
37 | + do_free = 0; | ||
38 | |||
39 | /* | ||
40 | * The init section is aligned to 8k in vmlinux.lds. Page align for >8k pagesizes. | ||
41 | @@ -2021,13 +2032,16 @@ void free_initmem(void) | ||
42 | ((unsigned long) __va(kern_base)) - | ||
43 | ((unsigned long) KERNBASE)); | ||
44 | memset((void *)addr, POISON_FREE_INITMEM, PAGE_SIZE); | ||
45 | - p = virt_to_page(page); | ||
46 | |||
47 | - ClearPageReserved(p); | ||
48 | - init_page_count(p); | ||
49 | - __free_page(p); | ||
50 | - num_physpages++; | ||
51 | - totalram_pages++; | ||
52 | + if (do_free) { | ||
53 | + p = virt_to_page(page); | ||
54 | + | ||
55 | + ClearPageReserved(p); | ||
56 | + init_page_count(p); | ||
57 | + __free_page(p); | ||
58 | + num_physpages++; | ||
59 | + totalram_pages++; | ||
60 | + } | ||
61 | } | ||
62 | } | ||
63 | |||
64 | diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c | ||
65 | index 3fd7a67..e710a21 100644 | ||
66 | --- a/arch/x86/kernel/cpu/cyrix.c | ||
67 | +++ b/arch/x86/kernel/cpu/cyrix.c | ||
68 | @@ -134,23 +134,6 @@ static void __cpuinit set_cx86_memwb(void) | ||
69 | setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x14); | ||
70 | } | ||
71 | |||
72 | -static void __cpuinit set_cx86_inc(void) | ||
73 | -{ | ||
74 | - unsigned char ccr3; | ||
75 | - | ||
76 | - printk(KERN_INFO "Enable Incrementor on Cyrix/NSC processor.\n"); | ||
77 | - | ||
78 | - ccr3 = getCx86(CX86_CCR3); | ||
79 | - setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */ | ||
80 | - /* PCR1 -- Performance Control */ | ||
81 | - /* Incrementor on, whatever that is */ | ||
82 | - setCx86(CX86_PCR1, getCx86(CX86_PCR1) | 0x02); | ||
83 | - /* PCR0 -- Performance Control */ | ||
84 | - /* Incrementor Margin 10 */ | ||
85 | - setCx86(CX86_PCR0, getCx86(CX86_PCR0) | 0x04); | ||
86 | - setCx86(CX86_CCR3, ccr3); /* disable MAPEN */ | ||
87 | -} | ||
88 | - | ||
89 | /* | ||
90 | * Configure later MediaGX and/or Geode processor. | ||
91 | */ | ||
92 | @@ -174,7 +157,6 @@ static void __cpuinit geode_configure(void) | ||
93 | |||
94 | set_cx86_memwb(); | ||
95 | set_cx86_reorder(); | ||
96 | - set_cx86_inc(); | ||
97 | |||
98 | local_irq_restore(flags); | ||
99 | } | ||
100 | diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c | ||
101 | index 75b14b1..745b974 100644 | ||
102 | --- a/arch/x86/kernel/cpu/mtrr/generic.c | ||
103 | +++ b/arch/x86/kernel/cpu/mtrr/generic.c | ||
104 | @@ -365,6 +365,7 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base, | ||
105 | unsigned long *size, mtrr_type *type) | ||
106 | { | ||
107 | unsigned int mask_lo, mask_hi, base_lo, base_hi; | ||
108 | + unsigned int tmp, hi; | ||
109 | |||
110 | rdmsr(MTRRphysMask_MSR(reg), mask_lo, mask_hi); | ||
111 | if ((mask_lo & 0x800) == 0) { | ||
112 | @@ -378,8 +379,23 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base, | ||
113 | rdmsr(MTRRphysBase_MSR(reg), base_lo, base_hi); | ||
114 | |||
115 | /* Work out the shifted address mask. */ | ||
116 | - mask_lo = size_or_mask | mask_hi << (32 - PAGE_SHIFT) | ||
117 | - | mask_lo >> PAGE_SHIFT; | ||
118 | + tmp = mask_hi << (32 - PAGE_SHIFT) | mask_lo >> PAGE_SHIFT; | ||
119 | + mask_lo = size_or_mask | tmp; | ||
120 | + /* Expand tmp with high bits to all 1s*/ | ||
121 | + hi = fls(tmp); | ||
122 | + if (hi > 0) { | ||
123 | + tmp |= ~((1<<(hi - 1)) - 1); | ||
124 | + | ||
125 | + if (tmp != mask_lo) { | ||
126 | + static int once = 1; | ||
127 | + | ||
128 | + if (once) { | ||
129 | + printk(KERN_INFO "mtrr: your BIOS has set up an incorrect mask, fixing it up.\n"); | ||
130 | + once = 0; | ||
131 | + } | ||
132 | + mask_lo = tmp; | ||
133 | + } | ||
134 | + } | ||
135 | |||
136 | /* This works correctly if size is a power of two, i.e. a | ||
137 | contiguous range. */ | ||
138 | diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h | ||
139 | index 934c7b6..d333a74 100644 | ||
140 | --- a/arch/x86/kvm/paging_tmpl.h | ||
141 | +++ b/arch/x86/kvm/paging_tmpl.h | ||
142 | @@ -343,7 +343,7 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr, | ||
143 | shadow_addr = __pa(shadow_page->spt); | ||
144 | shadow_pte = shadow_addr | PT_PRESENT_MASK | PT_ACCESSED_MASK | ||
145 | | PT_WRITABLE_MASK | PT_USER_MASK; | ||
146 | - *shadow_ent = shadow_pte; | ||
147 | + set_shadow_pte(shadow_ent, shadow_pte); | ||
148 | } | ||
149 | |||
150 | mmu_set_spte(vcpu, shadow_ent, access, walker->pte_access & access, | ||
151 | diff --git a/crypto/authenc.c b/crypto/authenc.c | ||
152 | index 4b22676..fd9f06c 100644 | ||
153 | --- a/crypto/authenc.c | ||
154 | +++ b/crypto/authenc.c | ||
155 | @@ -174,8 +174,9 @@ static int crypto_authenc_genicv(struct aead_request *req, u8 *iv, | ||
156 | static void crypto_authenc_encrypt_done(struct crypto_async_request *req, | ||
157 | int err) | ||
158 | { | ||
159 | + struct aead_request *areq = req->data; | ||
160 | + | ||
161 | if (!err) { | ||
162 | - struct aead_request *areq = req->data; | ||
163 | struct crypto_aead *authenc = crypto_aead_reqtfm(areq); | ||
164 | struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc); | ||
165 | struct ablkcipher_request *abreq = aead_request_ctx(areq); | ||
166 | @@ -185,7 +186,7 @@ static void crypto_authenc_encrypt_done(struct crypto_async_request *req, | ||
167 | err = crypto_authenc_genicv(areq, iv, 0); | ||
168 | } | ||
169 | |||
170 | - aead_request_complete(req->data, err); | ||
171 | + aead_request_complete(areq, err); | ||
172 | } | ||
173 | |||
174 | static int crypto_authenc_encrypt(struct aead_request *req) | ||
175 | @@ -216,14 +217,15 @@ static int crypto_authenc_encrypt(struct aead_request *req) | ||
176 | static void crypto_authenc_givencrypt_done(struct crypto_async_request *req, | ||
177 | int err) | ||
178 | { | ||
179 | + struct aead_request *areq = req->data; | ||
180 | + | ||
181 | if (!err) { | ||
182 | - struct aead_request *areq = req->data; | ||
183 | struct skcipher_givcrypt_request *greq = aead_request_ctx(areq); | ||
184 | |||
185 | err = crypto_authenc_genicv(areq, greq->giv, 0); | ||
186 | } | ||
187 | |||
188 | - aead_request_complete(req->data, err); | ||
189 | + aead_request_complete(areq, err); | ||
190 | } | ||
191 | |||
192 | static int crypto_authenc_givencrypt(struct aead_givcrypt_request *req) | ||
193 | diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c | ||
194 | index ad169ff..80c655f 100644 | ||
195 | --- a/drivers/ata/sata_mv.c | ||
196 | +++ b/drivers/ata/sata_mv.c | ||
197 | @@ -1134,30 +1134,16 @@ static int mv_qc_defer(struct ata_queued_cmd *qc) | ||
198 | if (ap->nr_active_links == 0) | ||
199 | return 0; | ||
200 | |||
201 | - if (pp->pp_flags & MV_PP_FLAG_EDMA_EN) { | ||
202 | - /* | ||
203 | - * The port is operating in host queuing mode (EDMA). | ||
204 | - * It can accomodate a new qc if the qc protocol | ||
205 | - * is compatible with the current host queue mode. | ||
206 | - */ | ||
207 | - if (pp->pp_flags & MV_PP_FLAG_NCQ_EN) { | ||
208 | - /* | ||
209 | - * The host queue (EDMA) is in NCQ mode. | ||
210 | - * If the new qc is also an NCQ command, | ||
211 | - * then allow the new qc. | ||
212 | - */ | ||
213 | - if (qc->tf.protocol == ATA_PROT_NCQ) | ||
214 | - return 0; | ||
215 | - } else { | ||
216 | - /* | ||
217 | - * The host queue (EDMA) is in non-NCQ, DMA mode. | ||
218 | - * If the new qc is also a non-NCQ, DMA command, | ||
219 | - * then allow the new qc. | ||
220 | - */ | ||
221 | - if (qc->tf.protocol == ATA_PROT_DMA) | ||
222 | - return 0; | ||
223 | - } | ||
224 | - } | ||
225 | + /* | ||
226 | + * The port is operating in host queuing mode (EDMA) with NCQ | ||
227 | + * enabled, allow multiple NCQ commands. EDMA also allows | ||
228 | + * queueing multiple DMA commands but libata core currently | ||
229 | + * doesn't allow it. | ||
230 | + */ | ||
231 | + if ((pp->pp_flags & MV_PP_FLAG_EDMA_EN) && | ||
232 | + (pp->pp_flags & MV_PP_FLAG_NCQ_EN) && ata_is_ncq(qc->tf.protocol)) | ||
233 | + return 0; | ||
234 | + | ||
235 | return ATA_DEFER_PORT; | ||
236 | } | ||
237 | |||
238 | diff --git a/drivers/char/random.c b/drivers/char/random.c | ||
239 | index 0cf98bd..71320d2 100644 | ||
240 | --- a/drivers/char/random.c | ||
241 | +++ b/drivers/char/random.c | ||
242 | @@ -406,7 +406,7 @@ struct entropy_store { | ||
243 | /* read-write data: */ | ||
244 | spinlock_t lock; | ||
245 | unsigned add_ptr; | ||
246 | - int entropy_count; | ||
247 | + int entropy_count; /* Must at no time exceed ->POOLBITS! */ | ||
248 | int input_rotate; | ||
249 | }; | ||
250 | |||
251 | @@ -519,6 +519,7 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes) | ||
252 | static void credit_entropy_bits(struct entropy_store *r, int nbits) | ||
253 | { | ||
254 | unsigned long flags; | ||
255 | + int entropy_count; | ||
256 | |||
257 | if (!nbits) | ||
258 | return; | ||
259 | @@ -526,20 +527,20 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits) | ||
260 | spin_lock_irqsave(&r->lock, flags); | ||
261 | |||
262 | DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name); | ||
263 | - r->entropy_count += nbits; | ||
264 | - if (r->entropy_count < 0) { | ||
265 | + entropy_count = r->entropy_count; | ||
266 | + entropy_count += nbits; | ||
267 | + if (entropy_count < 0) { | ||
268 | DEBUG_ENT("negative entropy/overflow\n"); | ||
269 | - r->entropy_count = 0; | ||
270 | - } else if (r->entropy_count > r->poolinfo->POOLBITS) | ||
271 | - r->entropy_count = r->poolinfo->POOLBITS; | ||
272 | + entropy_count = 0; | ||
273 | + } else if (entropy_count > r->poolinfo->POOLBITS) | ||
274 | + entropy_count = r->poolinfo->POOLBITS; | ||
275 | + r->entropy_count = entropy_count; | ||
276 | |||
277 | /* should we wake readers? */ | ||
278 | - if (r == &input_pool && | ||
279 | - r->entropy_count >= random_read_wakeup_thresh) { | ||
280 | + if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) { | ||
281 | wake_up_interruptible(&random_read_wait); | ||
282 | kill_fasync(&fasync, SIGIO, POLL_IN); | ||
283 | } | ||
284 | - | ||
285 | spin_unlock_irqrestore(&r->lock, flags); | ||
286 | } | ||
287 | |||
288 | diff --git a/drivers/misc/eeepc-laptop.c b/drivers/misc/eeepc-laptop.c | ||
289 | index 6d72760..3f3abf9 100644 | ||
290 | --- a/drivers/misc/eeepc-laptop.c | ||
291 | +++ b/drivers/misc/eeepc-laptop.c | ||
292 | @@ -553,9 +553,9 @@ static void eeepc_hwmon_exit(void) | ||
293 | hwmon = eeepc_hwmon_device; | ||
294 | if (!hwmon) | ||
295 | return ; | ||
296 | - hwmon_device_unregister(hwmon); | ||
297 | sysfs_remove_group(&hwmon->kobj, | ||
298 | &hwmon_attribute_group); | ||
299 | + hwmon_device_unregister(hwmon); | ||
300 | eeepc_hwmon_device = NULL; | ||
301 | } | ||
302 | |||
303 | diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c | ||
304 | index 3c798ae..8fe0a49 100644 | ||
305 | --- a/drivers/net/atlx/atl1.c | ||
306 | +++ b/drivers/net/atlx/atl1.c | ||
307 | @@ -3019,7 +3019,6 @@ static int __devinit atl1_probe(struct pci_dev *pdev, | ||
308 | netdev->features = NETIF_F_HW_CSUM; | ||
309 | netdev->features |= NETIF_F_SG; | ||
310 | netdev->features |= (NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX); | ||
311 | - netdev->features |= NETIF_F_TSO; | ||
312 | netdev->features |= NETIF_F_LLTX; | ||
313 | |||
314 | /* | ||
315 | diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c | ||
316 | index 20d4fe9..1652f10 100644 | ||
317 | --- a/drivers/net/forcedeth.c | ||
318 | +++ b/drivers/net/forcedeth.c | ||
319 | @@ -5420,7 +5420,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i | ||
320 | if (id->driver_data & DEV_HAS_CHECKSUM) { | ||
321 | np->rx_csum = 1; | ||
322 | np->txrxctl_bits |= NVREG_TXRXCTL_RXCHECK; | ||
323 | - dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG; | ||
324 | + dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG; | ||
325 | dev->features |= NETIF_F_TSO; | ||
326 | } | ||
327 | |||
328 | @@ -5728,7 +5728,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i | ||
329 | |||
330 | dev_printk(KERN_INFO, &pci_dev->dev, "%s%s%s%s%s%s%s%s%s%sdesc-v%u\n", | ||
331 | dev->features & NETIF_F_HIGHDMA ? "highdma " : "", | ||
332 | - dev->features & (NETIF_F_HW_CSUM | NETIF_F_SG) ? | ||
333 | + dev->features & (NETIF_F_IP_CSUM | NETIF_F_SG) ? | ||
334 | "csum " : "", | ||
335 | dev->features & (NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX) ? | ||
336 | "vlan " : "", | ||
337 | diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c | ||
338 | index 42d7c0a..0e4eb15 100644 | ||
339 | --- a/drivers/net/r8169.c | ||
340 | +++ b/drivers/net/r8169.c | ||
341 | @@ -2822,7 +2822,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev, | ||
342 | pkt_size, PCI_DMA_FROMDEVICE); | ||
343 | rtl8169_mark_to_asic(desc, tp->rx_buf_sz); | ||
344 | } else { | ||
345 | - pci_unmap_single(pdev, addr, pkt_size, | ||
346 | + pci_unmap_single(pdev, addr, tp->rx_buf_sz, | ||
347 | PCI_DMA_FROMDEVICE); | ||
348 | tp->Rx_skbuff[entry] = NULL; | ||
349 | } | ||
350 | diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c | ||
351 | index cc4bde8..1710e49 100644 | ||
352 | --- a/drivers/net/tg3.c | ||
353 | +++ b/drivers/net/tg3.c | ||
354 | @@ -1672,15 +1672,43 @@ static int tg3_set_power_state(struct tg3 *tp, pci_power_t state) | ||
355 | } | ||
356 | |||
357 | /* tp->lock is held. */ | ||
358 | +static inline void tg3_generate_fw_event(struct tg3 *tp) | ||
359 | +{ | ||
360 | + u32 val; | ||
361 | + | ||
362 | + val = tr32(GRC_RX_CPU_EVENT); | ||
363 | + val |= GRC_RX_CPU_DRIVER_EVENT; | ||
364 | + tw32_f(GRC_RX_CPU_EVENT, val); | ||
365 | + | ||
366 | + tp->last_event_jiffies = jiffies; | ||
367 | +} | ||
368 | + | ||
369 | +#define TG3_FW_EVENT_TIMEOUT_USEC 2500 | ||
370 | + | ||
371 | +/* tp->lock is held. */ | ||
372 | static void tg3_wait_for_event_ack(struct tg3 *tp) | ||
373 | { | ||
374 | int i; | ||
375 | + unsigned int delay_cnt; | ||
376 | + long time_remain; | ||
377 | + | ||
378 | + /* If enough time has passed, no wait is necessary. */ | ||
379 | + time_remain = (long)(tp->last_event_jiffies + 1 + | ||
380 | + usecs_to_jiffies(TG3_FW_EVENT_TIMEOUT_USEC)) - | ||
381 | + (long)jiffies; | ||
382 | + if (time_remain < 0) | ||
383 | + return; | ||
384 | |||
385 | - /* Wait for up to 2.5 milliseconds */ | ||
386 | - for (i = 0; i < 250000; i++) { | ||
387 | + /* Check if we can shorten the wait time. */ | ||
388 | + delay_cnt = jiffies_to_usecs(time_remain); | ||
389 | + if (delay_cnt > TG3_FW_EVENT_TIMEOUT_USEC) | ||
390 | + delay_cnt = TG3_FW_EVENT_TIMEOUT_USEC; | ||
391 | + delay_cnt = (delay_cnt >> 3) + 1; | ||
392 | + | ||
393 | + for (i = 0; i < delay_cnt; i++) { | ||
394 | if (!(tr32(GRC_RX_CPU_EVENT) & GRC_RX_CPU_DRIVER_EVENT)) | ||
395 | break; | ||
396 | - udelay(10); | ||
397 | + udelay(8); | ||
398 | } | ||
399 | } | ||
400 | |||
401 | @@ -1729,9 +1757,7 @@ static void tg3_ump_link_report(struct tg3 *tp) | ||
402 | val = 0; | ||
403 | tg3_write_mem(tp, NIC_SRAM_FW_CMD_DATA_MBOX + 12, val); | ||
404 | |||
405 | - val = tr32(GRC_RX_CPU_EVENT); | ||
406 | - val |= GRC_RX_CPU_DRIVER_EVENT; | ||
407 | - tw32_f(GRC_RX_CPU_EVENT, val); | ||
408 | + tg3_generate_fw_event(tp); | ||
409 | } | ||
410 | |||
411 | static void tg3_link_report(struct tg3 *tp) | ||
412 | @@ -5565,6 +5591,7 @@ static int tg3_chip_reset(struct tg3 *tp) | ||
413 | tg3_read_mem(tp, NIC_SRAM_DATA_CFG, &nic_cfg); | ||
414 | if (nic_cfg & NIC_SRAM_DATA_CFG_ASF_ENABLE) { | ||
415 | tp->tg3_flags |= TG3_FLAG_ENABLE_ASF; | ||
416 | + tp->last_event_jiffies = jiffies; | ||
417 | if (tp->tg3_flags2 & TG3_FLG2_5750_PLUS) | ||
418 | tp->tg3_flags2 |= TG3_FLG2_ASF_NEW_HANDSHAKE; | ||
419 | } | ||
420 | @@ -5578,15 +5605,12 @@ static void tg3_stop_fw(struct tg3 *tp) | ||
421 | { | ||
422 | if ((tp->tg3_flags & TG3_FLAG_ENABLE_ASF) && | ||
423 | !(tp->tg3_flags3 & TG3_FLG3_ENABLE_APE)) { | ||
424 | - u32 val; | ||
425 | - | ||
426 | /* Wait for RX cpu to ACK the previous event. */ | ||
427 | tg3_wait_for_event_ack(tp); | ||
428 | |||
429 | tg3_write_mem(tp, NIC_SRAM_FW_CMD_MBOX, FWCMD_NICDRV_PAUSE_FW); | ||
430 | - val = tr32(GRC_RX_CPU_EVENT); | ||
431 | - val |= GRC_RX_CPU_DRIVER_EVENT; | ||
432 | - tw32(GRC_RX_CPU_EVENT, val); | ||
433 | + | ||
434 | + tg3_generate_fw_event(tp); | ||
435 | |||
436 | /* Wait for RX cpu to ACK this event. */ | ||
437 | tg3_wait_for_event_ack(tp); | ||
438 | @@ -7477,8 +7501,6 @@ static void tg3_timer(unsigned long __opaque) | ||
439 | */ | ||
440 | if (!--tp->asf_counter) { | ||
441 | if (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) { | ||
442 | - u32 val; | ||
443 | - | ||
444 | tg3_wait_for_event_ack(tp); | ||
445 | |||
446 | tg3_write_mem(tp, NIC_SRAM_FW_CMD_MBOX, | ||
447 | @@ -7486,9 +7508,8 @@ static void tg3_timer(unsigned long __opaque) | ||
448 | tg3_write_mem(tp, NIC_SRAM_FW_CMD_LEN_MBOX, 4); | ||
449 | /* 5 seconds timeout */ | ||
450 | tg3_write_mem(tp, NIC_SRAM_FW_CMD_DATA_MBOX, 5); | ||
451 | - val = tr32(GRC_RX_CPU_EVENT); | ||
452 | - val |= GRC_RX_CPU_DRIVER_EVENT; | ||
453 | - tw32_f(GRC_RX_CPU_EVENT, val); | ||
454 | + | ||
455 | + tg3_generate_fw_event(tp); | ||
456 | } | ||
457 | tp->asf_counter = tp->asf_multiplier; | ||
458 | } | ||
459 | diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h | ||
460 | index 0404f93..d68b579 100644 | ||
461 | --- a/drivers/net/tg3.h | ||
462 | +++ b/drivers/net/tg3.h | ||
463 | @@ -2404,7 +2404,10 @@ struct tg3 { | ||
464 | struct tg3_ethtool_stats estats; | ||
465 | struct tg3_ethtool_stats estats_prev; | ||
466 | |||
467 | + union { | ||
468 | unsigned long phy_crc_errors; | ||
469 | + unsigned long last_event_jiffies; | ||
470 | + }; | ||
471 | |||
472 | u32 rx_offset; | ||
473 | u32 tg3_flags; | ||
474 | diff --git a/drivers/pci/search.c b/drivers/pci/search.c | ||
475 | index 217814f..3b3b5f1 100644 | ||
476 | --- a/drivers/pci/search.c | ||
477 | +++ b/drivers/pci/search.c | ||
478 | @@ -280,6 +280,8 @@ static struct pci_dev *pci_get_dev_by_id(const struct pci_device_id *id, | ||
479 | match_pci_dev_by_id); | ||
480 | if (dev) | ||
481 | pdev = to_pci_dev(dev); | ||
482 | + if (from) | ||
483 | + pci_dev_put(from); | ||
484 | return pdev; | ||
485 | } | ||
486 | |||
487 | diff --git a/drivers/rtc/rtc-lib.c b/drivers/rtc/rtc-lib.c | ||
488 | index 9f996ec..dd70bf7 100644 | ||
489 | --- a/drivers/rtc/rtc-lib.c | ||
490 | +++ b/drivers/rtc/rtc-lib.c | ||
491 | @@ -51,10 +51,11 @@ EXPORT_SYMBOL(rtc_year_days); | ||
492 | */ | ||
493 | void rtc_time_to_tm(unsigned long time, struct rtc_time *tm) | ||
494 | { | ||
495 | - unsigned int days, month, year; | ||
496 | + unsigned int month, year; | ||
497 | + int days; | ||
498 | |||
499 | days = time / 86400; | ||
500 | - time -= days * 86400; | ||
501 | + time -= (unsigned int) days * 86400; | ||
502 | |||
503 | /* day of the week, 1970-01-01 was a Thursday */ | ||
504 | tm->tm_wday = (days + 4) % 7; | ||
505 | diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h | ||
506 | index fc2509c..a466820 100644 | ||
507 | --- a/drivers/s390/block/dasd_eckd.h | ||
508 | +++ b/drivers/s390/block/dasd_eckd.h | ||
509 | @@ -379,7 +379,7 @@ struct dasd_psf_prssd_data { | ||
510 | unsigned char flags; | ||
511 | unsigned char reserved[4]; | ||
512 | unsigned char suborder; | ||
513 | - unsigned char varies[9]; | ||
514 | + unsigned char varies[5]; | ||
515 | } __attribute__ ((packed)); | ||
516 | |||
517 | /* | ||
518 | diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c | ||
519 | index be95e55..4050845 100644 | ||
520 | --- a/drivers/serial/8250.c | ||
521 | +++ b/drivers/serial/8250.c | ||
522 | @@ -1895,15 +1895,23 @@ static int serial8250_startup(struct uart_port *port) | ||
523 | * kick the UART on a regular basis. | ||
524 | */ | ||
525 | if (!(iir1 & UART_IIR_NO_INT) && (iir & UART_IIR_NO_INT)) { | ||
526 | + up->bugs |= UART_BUG_THRE; | ||
527 | pr_debug("ttyS%d - using backup timer\n", port->line); | ||
528 | - up->timer.function = serial8250_backup_timeout; | ||
529 | - up->timer.data = (unsigned long)up; | ||
530 | - mod_timer(&up->timer, jiffies + | ||
531 | - poll_timeout(up->port.timeout) + HZ / 5); | ||
532 | } | ||
533 | } | ||
534 | |||
535 | /* | ||
536 | + * The above check will only give an accurate result the first time | ||
537 | + * the port is opened so this value needs to be preserved. | ||
538 | + */ | ||
539 | + if (up->bugs & UART_BUG_THRE) { | ||
540 | + up->timer.function = serial8250_backup_timeout; | ||
541 | + up->timer.data = (unsigned long)up; | ||
542 | + mod_timer(&up->timer, jiffies + | ||
543 | + poll_timeout(up->port.timeout) + HZ / 5); | ||
544 | + } | ||
545 | + | ||
546 | + /* | ||
547 | * If the "interrupt" for this port doesn't correspond with any | ||
548 | * hardware interrupt, we use a timer-based system. The original | ||
549 | * driver used to do this with IRQ0. | ||
550 | diff --git a/drivers/serial/8250.h b/drivers/serial/8250.h | ||
551 | index 91bd28f..245288d 100644 | ||
552 | --- a/drivers/serial/8250.h | ||
553 | +++ b/drivers/serial/8250.h | ||
554 | @@ -49,6 +49,7 @@ struct serial8250_config { | ||
555 | #define UART_BUG_QUOT (1 << 0) /* UART has buggy quot LSB */ | ||
556 | #define UART_BUG_TXEN (1 << 1) /* UART has buggy TX IIR status */ | ||
557 | #define UART_BUG_NOMSR (1 << 2) /* UART has buggy MSR status bits (Au1x00) */ | ||
558 | +#define UART_BUG_THRE (1 << 3) /* UART has buggy THRE reassertion */ | ||
559 | |||
560 | #define PROBE_RSA (1 << 0) | ||
561 | #define PROBE_ANY (~0) | ||
562 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c | ||
563 | index c3201af..560337a 100644 | ||
564 | --- a/drivers/usb/class/cdc-acm.c | ||
565 | +++ b/drivers/usb/class/cdc-acm.c | ||
566 | @@ -525,8 +525,8 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp) | ||
567 | tasklet_schedule(&acm->urb_task); | ||
568 | |||
569 | done: | ||
570 | -err_out: | ||
571 | mutex_unlock(&acm->mutex); | ||
572 | +err_out: | ||
573 | mutex_unlock(&open_mutex); | ||
574 | return rv; | ||
575 | |||
576 | diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c | ||
577 | index 59df132..4835bdc 100644 | ||
578 | --- a/drivers/video/fb_defio.c | ||
579 | +++ b/drivers/video/fb_defio.c | ||
580 | @@ -114,6 +114,17 @@ static struct vm_operations_struct fb_deferred_io_vm_ops = { | ||
581 | .page_mkwrite = fb_deferred_io_mkwrite, | ||
582 | }; | ||
583 | |||
584 | +static int fb_deferred_io_set_page_dirty(struct page *page) | ||
585 | +{ | ||
586 | + if (!PageDirty(page)) | ||
587 | + SetPageDirty(page); | ||
588 | + return 0; | ||
589 | +} | ||
590 | + | ||
591 | +static const struct address_space_operations fb_deferred_io_aops = { | ||
592 | + .set_page_dirty = fb_deferred_io_set_page_dirty, | ||
593 | +}; | ||
594 | + | ||
595 | static int fb_deferred_io_mmap(struct fb_info *info, struct vm_area_struct *vma) | ||
596 | { | ||
597 | vma->vm_ops = &fb_deferred_io_vm_ops; | ||
598 | @@ -163,6 +174,14 @@ void fb_deferred_io_init(struct fb_info *info) | ||
599 | } | ||
600 | EXPORT_SYMBOL_GPL(fb_deferred_io_init); | ||
601 | |||
602 | +void fb_deferred_io_open(struct fb_info *info, | ||
603 | + struct inode *inode, | ||
604 | + struct file *file) | ||
605 | +{ | ||
606 | + file->f_mapping->a_ops = &fb_deferred_io_aops; | ||
607 | +} | ||
608 | +EXPORT_SYMBOL_GPL(fb_deferred_io_open); | ||
609 | + | ||
610 | void fb_deferred_io_cleanup(struct fb_info *info) | ||
611 | { | ||
612 | void *screen_base = (void __force *) info->screen_base; | ||
613 | diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c | ||
614 | index 776f7fc..ce6b5da 100644 | ||
615 | --- a/drivers/video/fbmem.c | ||
616 | +++ b/drivers/video/fbmem.c | ||
617 | @@ -1340,6 +1340,10 @@ fb_open(struct inode *inode, struct file *file) | ||
618 | if (res) | ||
619 | module_put(info->fbops->owner); | ||
620 | } | ||
621 | +#ifdef CONFIG_FB_DEFERRED_IO | ||
622 | + if (info->fbdefio) | ||
623 | + fb_deferred_io_open(info, inode, file); | ||
624 | +#endif | ||
625 | return res; | ||
626 | } | ||
627 | |||
628 | diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c | ||
629 | index 7191306..a0a7157 100644 | ||
630 | --- a/fs/binfmt_misc.c | ||
631 | +++ b/fs/binfmt_misc.c | ||
632 | @@ -119,8 +119,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs) | ||
633 | if (bprm->misc_bang) | ||
634 | goto _ret; | ||
635 | |||
636 | - bprm->misc_bang = 1; | ||
637 | - | ||
638 | /* to keep locking time low, we copy the interpreter string */ | ||
639 | read_lock(&entries_lock); | ||
640 | fmt = check_file(bprm); | ||
641 | @@ -198,6 +196,8 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs) | ||
642 | if (retval < 0) | ||
643 | goto _error; | ||
644 | |||
645 | + bprm->misc_bang = 1; | ||
646 | + | ||
647 | retval = search_binary_handler (bprm, regs); | ||
648 | if (retval < 0) | ||
649 | goto _error; | ||
650 | diff --git a/fs/bio.c b/fs/bio.c | ||
651 | index 7856257..7db618c 100644 | ||
652 | --- a/fs/bio.c | ||
653 | +++ b/fs/bio.c | ||
654 | @@ -464,20 +464,21 @@ static void bio_free_map_data(struct bio_map_data *bmd) | ||
655 | kfree(bmd); | ||
656 | } | ||
657 | |||
658 | -static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count) | ||
659 | +static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count, | ||
660 | + gfp_t gfp_mask) | ||
661 | { | ||
662 | - struct bio_map_data *bmd = kmalloc(sizeof(*bmd), GFP_KERNEL); | ||
663 | + struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask); | ||
664 | |||
665 | if (!bmd) | ||
666 | return NULL; | ||
667 | |||
668 | - bmd->iovecs = kmalloc(sizeof(struct bio_vec) * nr_segs, GFP_KERNEL); | ||
669 | + bmd->iovecs = kmalloc(sizeof(struct bio_vec) * nr_segs, gfp_mask); | ||
670 | if (!bmd->iovecs) { | ||
671 | kfree(bmd); | ||
672 | return NULL; | ||
673 | } | ||
674 | |||
675 | - bmd->sgvecs = kmalloc(sizeof(struct sg_iovec) * iov_count, GFP_KERNEL); | ||
676 | + bmd->sgvecs = kmalloc(sizeof(struct sg_iovec) * iov_count, gfp_mask); | ||
677 | if (bmd->sgvecs) | ||
678 | return bmd; | ||
679 | |||
680 | @@ -486,8 +487,8 @@ static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count) | ||
681 | return NULL; | ||
682 | } | ||
683 | |||
684 | -static int __bio_copy_iov(struct bio *bio, struct sg_iovec *iov, int iov_count, | ||
685 | - int uncopy) | ||
686 | +static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs, | ||
687 | + struct sg_iovec *iov, int iov_count, int uncopy) | ||
688 | { | ||
689 | int ret = 0, i; | ||
690 | struct bio_vec *bvec; | ||
691 | @@ -497,7 +498,7 @@ static int __bio_copy_iov(struct bio *bio, struct sg_iovec *iov, int iov_count, | ||
692 | |||
693 | __bio_for_each_segment(bvec, bio, i, 0) { | ||
694 | char *bv_addr = page_address(bvec->bv_page); | ||
695 | - unsigned int bv_len = bvec->bv_len; | ||
696 | + unsigned int bv_len = iovecs[i].bv_len; | ||
697 | |||
698 | while (bv_len && iov_idx < iov_count) { | ||
699 | unsigned int bytes; | ||
700 | @@ -549,7 +550,7 @@ int bio_uncopy_user(struct bio *bio) | ||
701 | struct bio_map_data *bmd = bio->bi_private; | ||
702 | int ret; | ||
703 | |||
704 | - ret = __bio_copy_iov(bio, bmd->sgvecs, bmd->nr_sgvecs, 1); | ||
705 | + ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs, bmd->nr_sgvecs, 1); | ||
706 | |||
707 | bio_free_map_data(bmd); | ||
708 | bio_put(bio); | ||
709 | @@ -591,7 +592,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, struct sg_iovec *iov, | ||
710 | len += iov[i].iov_len; | ||
711 | } | ||
712 | |||
713 | - bmd = bio_alloc_map_data(nr_pages, iov_count); | ||
714 | + bmd = bio_alloc_map_data(nr_pages, iov_count, GFP_KERNEL); | ||
715 | if (!bmd) | ||
716 | return ERR_PTR(-ENOMEM); | ||
717 | |||
718 | @@ -628,7 +629,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, struct sg_iovec *iov, | ||
719 | * success | ||
720 | */ | ||
721 | if (!write_to_vm) { | ||
722 | - ret = __bio_copy_iov(bio, iov, iov_count, 0); | ||
723 | + ret = __bio_copy_iov(bio, bio->bi_io_vec, iov, iov_count, 0); | ||
724 | if (ret) | ||
725 | goto cleanup; | ||
726 | } | ||
727 | @@ -941,19 +942,22 @@ static void bio_copy_kern_endio(struct bio *bio, int err) | ||
728 | { | ||
729 | struct bio_vec *bvec; | ||
730 | const int read = bio_data_dir(bio) == READ; | ||
731 | - char *p = bio->bi_private; | ||
732 | + struct bio_map_data *bmd = bio->bi_private; | ||
733 | int i; | ||
734 | + char *p = bmd->sgvecs[0].iov_base; | ||
735 | |||
736 | __bio_for_each_segment(bvec, bio, i, 0) { | ||
737 | char *addr = page_address(bvec->bv_page); | ||
738 | + int len = bmd->iovecs[i].bv_len; | ||
739 | |||
740 | if (read && !err) | ||
741 | - memcpy(p, addr, bvec->bv_len); | ||
742 | + memcpy(p, addr, len); | ||
743 | |||
744 | __free_page(bvec->bv_page); | ||
745 | - p += bvec->bv_len; | ||
746 | + p += len; | ||
747 | } | ||
748 | |||
749 | + bio_free_map_data(bmd); | ||
750 | bio_put(bio); | ||
751 | } | ||
752 | |||
753 | @@ -977,11 +981,21 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len, | ||
754 | const int nr_pages = end - start; | ||
755 | struct bio *bio; | ||
756 | struct bio_vec *bvec; | ||
757 | + struct bio_map_data *bmd; | ||
758 | int i, ret; | ||
759 | + struct sg_iovec iov; | ||
760 | + | ||
761 | + iov.iov_base = data; | ||
762 | + iov.iov_len = len; | ||
763 | + | ||
764 | + bmd = bio_alloc_map_data(nr_pages, 1, gfp_mask); | ||
765 | + if (!bmd) | ||
766 | + return ERR_PTR(-ENOMEM); | ||
767 | |||
768 | + ret = -ENOMEM; | ||
769 | bio = bio_alloc(gfp_mask, nr_pages); | ||
770 | if (!bio) | ||
771 | - return ERR_PTR(-ENOMEM); | ||
772 | + goto out_bmd; | ||
773 | |||
774 | while (len) { | ||
775 | struct page *page; | ||
776 | @@ -1015,14 +1029,18 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len, | ||
777 | } | ||
778 | } | ||
779 | |||
780 | - bio->bi_private = data; | ||
781 | + bio->bi_private = bmd; | ||
782 | bio->bi_end_io = bio_copy_kern_endio; | ||
783 | + | ||
784 | + bio_set_map_data(bmd, bio, &iov, 1); | ||
785 | return bio; | ||
786 | cleanup: | ||
787 | bio_for_each_segment(bvec, bio, i) | ||
788 | __free_page(bvec->bv_page); | ||
789 | |||
790 | bio_put(bio); | ||
791 | +out_bmd: | ||
792 | + bio_free_map_data(bmd); | ||
793 | |||
794 | return ERR_PTR(ret); | ||
795 | } | ||
796 | diff --git a/fs/cifs/file.c b/fs/cifs/file.c | ||
797 | index 0aac824..8da903b 100644 | ||
798 | --- a/fs/cifs/file.c | ||
799 | +++ b/fs/cifs/file.c | ||
800 | @@ -832,6 +832,10 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data, | ||
801 | return -EBADF; | ||
802 | open_file = (struct cifsFileInfo *) file->private_data; | ||
803 | |||
804 | + rc = generic_write_checks(file, poffset, &write_size, 0); | ||
805 | + if (rc) | ||
806 | + return rc; | ||
807 | + | ||
808 | xid = GetXid(); | ||
809 | |||
810 | if (*poffset > file->f_path.dentry->d_inode->i_size) | ||
811 | diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c | ||
812 | index 0c3b618..f40423e 100644 | ||
813 | --- a/fs/cramfs/inode.c | ||
814 | +++ b/fs/cramfs/inode.c | ||
815 | @@ -43,58 +43,13 @@ static DEFINE_MUTEX(read_mutex); | ||
816 | static int cramfs_iget5_test(struct inode *inode, void *opaque) | ||
817 | { | ||
818 | struct cramfs_inode *cramfs_inode = opaque; | ||
819 | - | ||
820 | - if (inode->i_ino != CRAMINO(cramfs_inode)) | ||
821 | - return 0; /* does not match */ | ||
822 | - | ||
823 | - if (inode->i_ino != 1) | ||
824 | - return 1; | ||
825 | - | ||
826 | - /* all empty directories, char, block, pipe, and sock, share inode #1 */ | ||
827 | - | ||
828 | - if ((inode->i_mode != cramfs_inode->mode) || | ||
829 | - (inode->i_gid != cramfs_inode->gid) || | ||
830 | - (inode->i_uid != cramfs_inode->uid)) | ||
831 | - return 0; /* does not match */ | ||
832 | - | ||
833 | - if ((S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) && | ||
834 | - (inode->i_rdev != old_decode_dev(cramfs_inode->size))) | ||
835 | - return 0; /* does not match */ | ||
836 | - | ||
837 | - return 1; /* matches */ | ||
838 | + return inode->i_ino == CRAMINO(cramfs_inode) && inode->i_ino != 1; | ||
839 | } | ||
840 | |||
841 | static int cramfs_iget5_set(struct inode *inode, void *opaque) | ||
842 | { | ||
843 | - static struct timespec zerotime; | ||
844 | struct cramfs_inode *cramfs_inode = opaque; | ||
845 | - inode->i_mode = cramfs_inode->mode; | ||
846 | - inode->i_uid = cramfs_inode->uid; | ||
847 | - inode->i_size = cramfs_inode->size; | ||
848 | - inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1; | ||
849 | - inode->i_gid = cramfs_inode->gid; | ||
850 | - /* Struct copy intentional */ | ||
851 | - inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime; | ||
852 | inode->i_ino = CRAMINO(cramfs_inode); | ||
853 | - /* inode->i_nlink is left 1 - arguably wrong for directories, | ||
854 | - but it's the best we can do without reading the directory | ||
855 | - contents. 1 yields the right result in GNU find, even | ||
856 | - without -noleaf option. */ | ||
857 | - if (S_ISREG(inode->i_mode)) { | ||
858 | - inode->i_fop = &generic_ro_fops; | ||
859 | - inode->i_data.a_ops = &cramfs_aops; | ||
860 | - } else if (S_ISDIR(inode->i_mode)) { | ||
861 | - inode->i_op = &cramfs_dir_inode_operations; | ||
862 | - inode->i_fop = &cramfs_directory_operations; | ||
863 | - } else if (S_ISLNK(inode->i_mode)) { | ||
864 | - inode->i_op = &page_symlink_inode_operations; | ||
865 | - inode->i_data.a_ops = &cramfs_aops; | ||
866 | - } else { | ||
867 | - inode->i_size = 0; | ||
868 | - inode->i_blocks = 0; | ||
869 | - init_special_inode(inode, inode->i_mode, | ||
870 | - old_decode_dev(cramfs_inode->size)); | ||
871 | - } | ||
872 | return 0; | ||
873 | } | ||
874 | |||
875 | @@ -104,12 +59,48 @@ static struct inode *get_cramfs_inode(struct super_block *sb, | ||
876 | struct inode *inode = iget5_locked(sb, CRAMINO(cramfs_inode), | ||
877 | cramfs_iget5_test, cramfs_iget5_set, | ||
878 | cramfs_inode); | ||
879 | + static struct timespec zerotime; | ||
880 | + | ||
881 | if (inode && (inode->i_state & I_NEW)) { | ||
882 | + inode->i_mode = cramfs_inode->mode; | ||
883 | + inode->i_uid = cramfs_inode->uid; | ||
884 | + inode->i_size = cramfs_inode->size; | ||
885 | + inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1; | ||
886 | + inode->i_gid = cramfs_inode->gid; | ||
887 | + /* Struct copy intentional */ | ||
888 | + inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime; | ||
889 | + /* inode->i_nlink is left 1 - arguably wrong for directories, | ||
890 | + but it's the best we can do without reading the directory | ||
891 | + contents. 1 yields the right result in GNU find, even | ||
892 | + without -noleaf option. */ | ||
893 | + if (S_ISREG(inode->i_mode)) { | ||
894 | + inode->i_fop = &generic_ro_fops; | ||
895 | + inode->i_data.a_ops = &cramfs_aops; | ||
896 | + } else if (S_ISDIR(inode->i_mode)) { | ||
897 | + inode->i_op = &cramfs_dir_inode_operations; | ||
898 | + inode->i_fop = &cramfs_directory_operations; | ||
899 | + } else if (S_ISLNK(inode->i_mode)) { | ||
900 | + inode->i_op = &page_symlink_inode_operations; | ||
901 | + inode->i_data.a_ops = &cramfs_aops; | ||
902 | + } else { | ||
903 | + inode->i_size = 0; | ||
904 | + inode->i_blocks = 0; | ||
905 | + init_special_inode(inode, inode->i_mode, | ||
906 | + old_decode_dev(cramfs_inode->size)); | ||
907 | + } | ||
908 | unlock_new_inode(inode); | ||
909 | } | ||
910 | return inode; | ||
911 | } | ||
912 | |||
913 | +static void cramfs_drop_inode(struct inode *inode) | ||
914 | +{ | ||
915 | + if (inode->i_ino == 1) | ||
916 | + generic_delete_inode(inode); | ||
917 | + else | ||
918 | + generic_drop_inode(inode); | ||
919 | +} | ||
920 | + | ||
921 | /* | ||
922 | * We have our own block cache: don't fill up the buffer cache | ||
923 | * with the rom-image, because the way the filesystem is set | ||
924 | @@ -534,6 +525,7 @@ static const struct super_operations cramfs_ops = { | ||
925 | .put_super = cramfs_put_super, | ||
926 | .remount_fs = cramfs_remount, | ||
927 | .statfs = cramfs_statfs, | ||
928 | + .drop_inode = cramfs_drop_inode, | ||
929 | }; | ||
930 | |||
931 | static int cramfs_get_sb(struct file_system_type *fs_type, | ||
932 | diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c | ||
933 | index b6ed383..54b8b41 100644 | ||
934 | --- a/fs/nfsd/nfs4acl.c | ||
935 | +++ b/fs/nfsd/nfs4acl.c | ||
936 | @@ -443,7 +443,7 @@ init_state(struct posix_acl_state *state, int cnt) | ||
937 | * enough space for either: | ||
938 | */ | ||
939 | alloc = sizeof(struct posix_ace_state_array) | ||
940 | - + cnt*sizeof(struct posix_ace_state); | ||
941 | + + cnt*sizeof(struct posix_user_ace_state); | ||
942 | state->users = kzalloc(alloc, GFP_KERNEL); | ||
943 | if (!state->users) | ||
944 | return -ENOMEM; | ||
945 | diff --git a/include/linux/Kbuild b/include/linux/Kbuild | ||
946 | index 71d70d1..27af0b8 100644 | ||
947 | --- a/include/linux/Kbuild | ||
948 | +++ b/include/linux/Kbuild | ||
949 | @@ -293,7 +293,6 @@ unifdef-y += parport.h | ||
950 | unifdef-y += patchkey.h | ||
951 | unifdef-y += pci.h | ||
952 | unifdef-y += personality.h | ||
953 | -unifdef-y += pim.h | ||
954 | unifdef-y += pktcdvd.h | ||
955 | unifdef-y += pmu.h | ||
956 | unifdef-y += poll.h | ||
957 | diff --git a/include/linux/fb.h b/include/linux/fb.h | ||
958 | index 72295b0..dd82c76 100644 | ||
959 | --- a/include/linux/fb.h | ||
960 | +++ b/include/linux/fb.h | ||
961 | @@ -973,6 +973,9 @@ static inline void __fb_pad_aligned_buffer(u8 *dst, u32 d_pitch, | ||
962 | |||
963 | /* drivers/video/fb_defio.c */ | ||
964 | extern void fb_deferred_io_init(struct fb_info *info); | ||
965 | +extern void fb_deferred_io_open(struct fb_info *info, | ||
966 | + struct inode *inode, | ||
967 | + struct file *file); | ||
968 | extern void fb_deferred_io_cleanup(struct fb_info *info); | ||
969 | extern int fb_deferred_io_fsync(struct file *file, struct dentry *dentry, | ||
970 | int datasync); | ||
971 | diff --git a/include/linux/mroute.h b/include/linux/mroute.h | ||
972 | index de4decf..35a8277 100644 | ||
973 | --- a/include/linux/mroute.h | ||
974 | +++ b/include/linux/mroute.h | ||
975 | @@ -2,11 +2,7 @@ | ||
976 | #define __LINUX_MROUTE_H | ||
977 | |||
978 | #include <linux/sockios.h> | ||
979 | -#include <linux/types.h> | ||
980 | -#ifdef __KERNEL__ | ||
981 | #include <linux/in.h> | ||
982 | -#endif | ||
983 | -#include <linux/pim.h> | ||
984 | |||
985 | /* | ||
986 | * Based on the MROUTING 3.5 defines primarily to keep | ||
987 | @@ -214,6 +210,27 @@ struct mfc_cache | ||
988 | #define IGMPMSG_WHOLEPKT 3 /* For PIM Register processing */ | ||
989 | |||
990 | #ifdef __KERNEL__ | ||
991 | + | ||
992 | +#define PIM_V1_VERSION __constant_htonl(0x10000000) | ||
993 | +#define PIM_V1_REGISTER 1 | ||
994 | + | ||
995 | +#define PIM_VERSION 2 | ||
996 | +#define PIM_REGISTER 1 | ||
997 | + | ||
998 | +#define PIM_NULL_REGISTER __constant_htonl(0x40000000) | ||
999 | + | ||
1000 | +/* PIMv2 register message header layout (ietf-draft-idmr-pimvsm-v2-00.ps */ | ||
1001 | + | ||
1002 | +struct pimreghdr | ||
1003 | +{ | ||
1004 | + __u8 type; | ||
1005 | + __u8 reserved; | ||
1006 | + __be16 csum; | ||
1007 | + __be32 flags; | ||
1008 | +}; | ||
1009 | + | ||
1010 | +extern int pim_rcv_v1(struct sk_buff *); | ||
1011 | + | ||
1012 | struct rtmsg; | ||
1013 | extern int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait); | ||
1014 | #endif | ||
1015 | diff --git a/include/linux/pim.h b/include/linux/pim.h | ||
1016 | deleted file mode 100644 | ||
1017 | index 236ffd3..0000000 | ||
1018 | --- a/include/linux/pim.h | ||
1019 | +++ /dev/null | ||
1020 | @@ -1,45 +0,0 @@ | ||
1021 | -#ifndef __LINUX_PIM_H | ||
1022 | -#define __LINUX_PIM_H | ||
1023 | - | ||
1024 | -#include <asm/byteorder.h> | ||
1025 | - | ||
1026 | -#ifndef __KERNEL__ | ||
1027 | -struct pim { | ||
1028 | -#if defined(__LITTLE_ENDIAN_BITFIELD) | ||
1029 | - __u8 pim_type:4, /* PIM message type */ | ||
1030 | - pim_ver:4; /* PIM version */ | ||
1031 | -#elif defined(__BIG_ENDIAN_BITFIELD) | ||
1032 | - __u8 pim_ver:4; /* PIM version */ | ||
1033 | - pim_type:4; /* PIM message type */ | ||
1034 | -#endif | ||
1035 | - __u8 pim_rsv; /* Reserved */ | ||
1036 | - __be16 pim_cksum; /* Checksum */ | ||
1037 | -}; | ||
1038 | - | ||
1039 | -#define PIM_MINLEN 8 | ||
1040 | -#endif | ||
1041 | - | ||
1042 | -/* Message types - V1 */ | ||
1043 | -#define PIM_V1_VERSION __constant_htonl(0x10000000) | ||
1044 | -#define PIM_V1_REGISTER 1 | ||
1045 | - | ||
1046 | -/* Message types - V2 */ | ||
1047 | -#define PIM_VERSION 2 | ||
1048 | -#define PIM_REGISTER 1 | ||
1049 | - | ||
1050 | -#if defined(__KERNEL__) | ||
1051 | -#define PIM_NULL_REGISTER __constant_htonl(0x40000000) | ||
1052 | - | ||
1053 | -/* PIMv2 register message header layout (ietf-draft-idmr-pimvsm-v2-00.ps */ | ||
1054 | -struct pimreghdr | ||
1055 | -{ | ||
1056 | - __u8 type; | ||
1057 | - __u8 reserved; | ||
1058 | - __be16 csum; | ||
1059 | - __be32 flags; | ||
1060 | -}; | ||
1061 | - | ||
1062 | -struct sk_buff; | ||
1063 | -extern int pim_rcv_v1(struct sk_buff *); | ||
1064 | -#endif | ||
1065 | -#endif | ||
1066 | diff --git a/include/net/addrconf.h b/include/net/addrconf.h | ||
1067 | index bbd3d58..99ca7cd 100644 | ||
1068 | --- a/include/net/addrconf.h | ||
1069 | +++ b/include/net/addrconf.h | ||
1070 | @@ -80,7 +80,8 @@ extern struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, | ||
1071 | struct net_device *dev, | ||
1072 | int strict); | ||
1073 | |||
1074 | -extern int ipv6_dev_get_saddr(struct net_device *dev, | ||
1075 | +extern int ipv6_dev_get_saddr(struct net *net, | ||
1076 | + struct net_device *dev, | ||
1077 | const struct in6_addr *daddr, | ||
1078 | unsigned int srcprefs, | ||
1079 | struct in6_addr *saddr); | ||
1080 | diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h | ||
1081 | index 9313491..03462e5 100644 | ||
1082 | --- a/include/net/ip6_route.h | ||
1083 | +++ b/include/net/ip6_route.h | ||
1084 | @@ -112,6 +112,7 @@ struct rt6_rtnl_dump_arg | ||
1085 | { | ||
1086 | struct sk_buff *skb; | ||
1087 | struct netlink_callback *cb; | ||
1088 | + struct net *net; | ||
1089 | }; | ||
1090 | |||
1091 | extern int rt6_dump_route(struct rt6_info *rt, void *p_arg); | ||
1092 | diff --git a/mm/page_alloc.c b/mm/page_alloc.c | ||
1093 | index f32fae3..0d520dc 100644 | ||
1094 | --- a/mm/page_alloc.c | ||
1095 | +++ b/mm/page_alloc.c | ||
1096 | @@ -693,6 +693,9 @@ int move_freepages(struct zone *zone, | ||
1097 | #endif | ||
1098 | |||
1099 | for (page = start_page; page <= end_page;) { | ||
1100 | + /* Make sure we are not inadvertently changing nodes */ | ||
1101 | + VM_BUG_ON(page_to_nid(page) != zone_to_nid(zone)); | ||
1102 | + | ||
1103 | if (!pfn_valid_within(page_to_pfn(page))) { | ||
1104 | page++; | ||
1105 | continue; | ||
1106 | @@ -2475,6 +2478,10 @@ static void setup_zone_migrate_reserve(struct zone *zone) | ||
1107 | continue; | ||
1108 | page = pfn_to_page(pfn); | ||
1109 | |||
1110 | + /* Watch out for overlapping nodes */ | ||
1111 | + if (page_to_nid(page) != zone_to_nid(zone)) | ||
1112 | + continue; | ||
1113 | + | ||
1114 | /* Blocks with reserved pages will never free, skip them. */ | ||
1115 | if (PageReserved(page)) | ||
1116 | continue; | ||
1117 | diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c | ||
1118 | index f597987..f288fc4 100644 | ||
1119 | --- a/net/ax25/sysctl_net_ax25.c | ||
1120 | +++ b/net/ax25/sysctl_net_ax25.c | ||
1121 | @@ -36,6 +36,7 @@ static struct ctl_path ax25_path[] = { | ||
1122 | { .procname = "ax25", .ctl_name = NET_AX25, }, | ||
1123 | { } | ||
1124 | }; | ||
1125 | + | ||
1126 | static const ctl_table ax25_param_table[] = { | ||
1127 | { | ||
1128 | .ctl_name = NET_AX25_IP_DEFAULT_MODE, | ||
1129 | @@ -167,6 +168,7 @@ static const ctl_table ax25_param_table[] = { | ||
1130 | .extra1 = &min_proto, | ||
1131 | .extra2 = &max_proto | ||
1132 | }, | ||
1133 | +#ifdef CONFIG_AX25_DAMA_SLAVE | ||
1134 | { | ||
1135 | .ctl_name = NET_AX25_DAMA_SLAVE_TIMEOUT, | ||
1136 | .procname = "dama_slave_timeout", | ||
1137 | @@ -177,6 +179,8 @@ static const ctl_table ax25_param_table[] = { | ||
1138 | .extra1 = &min_ds_timeout, | ||
1139 | .extra2 = &max_ds_timeout | ||
1140 | }, | ||
1141 | +#endif | ||
1142 | + | ||
1143 | { .ctl_name = 0 } /* that's all, folks! */ | ||
1144 | }; | ||
1145 | |||
1146 | @@ -210,16 +214,6 @@ void ax25_register_sysctl(void) | ||
1147 | ax25_table[n].procname = ax25_dev->dev->name; | ||
1148 | ax25_table[n].mode = 0555; | ||
1149 | |||
1150 | -#ifndef CONFIG_AX25_DAMA_SLAVE | ||
1151 | - /* | ||
1152 | - * We do not wish to have a representation of this parameter | ||
1153 | - * in /proc/sys/ when configured *not* to include the | ||
1154 | - * AX.25 DAMA slave code, do we? | ||
1155 | - */ | ||
1156 | - | ||
1157 | - child[AX25_VALUES_DS_TIMEOUT].procname = NULL; | ||
1158 | -#endif | ||
1159 | - | ||
1160 | child[AX25_MAX_VALUES].ctl_name = 0; /* just in case... */ | ||
1161 | |||
1162 | for (k = 0; k < AX25_MAX_VALUES; k++) | ||
1163 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c | ||
1164 | index 9f3f7ba..b6e7ec0 100644 | ||
1165 | --- a/net/ipv4/udp.c | ||
1166 | +++ b/net/ipv4/udp.c | ||
1167 | @@ -988,7 +988,9 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb) | ||
1168 | up->encap_rcv != NULL) { | ||
1169 | int ret; | ||
1170 | |||
1171 | + bh_unlock_sock(sk); | ||
1172 | ret = (*up->encap_rcv)(sk, skb); | ||
1173 | + bh_lock_sock(sk); | ||
1174 | if (ret <= 0) { | ||
1175 | UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, | ||
1176 | is_udplite); | ||
1177 | @@ -1087,7 +1089,7 @@ static int __udp4_lib_mcast_deliver(struct sk_buff *skb, | ||
1178 | if (skb1) { | ||
1179 | int ret = 0; | ||
1180 | |||
1181 | - bh_lock_sock_nested(sk); | ||
1182 | + bh_lock_sock(sk); | ||
1183 | if (!sock_owned_by_user(sk)) | ||
1184 | ret = udp_queue_rcv_skb(sk, skb1); | ||
1185 | else | ||
1186 | @@ -1187,7 +1189,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[], | ||
1187 | |||
1188 | if (sk != NULL) { | ||
1189 | int ret = 0; | ||
1190 | - bh_lock_sock_nested(sk); | ||
1191 | + bh_lock_sock(sk); | ||
1192 | if (!sock_owned_by_user(sk)) | ||
1193 | ret = udp_queue_rcv_skb(sk, skb); | ||
1194 | else | ||
1195 | diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c | ||
1196 | index ff61a5c..1a1d494 100644 | ||
1197 | --- a/net/ipv6/addrconf.c | ||
1198 | +++ b/net/ipv6/addrconf.c | ||
1199 | @@ -1076,13 +1076,12 @@ out: | ||
1200 | return ret; | ||
1201 | } | ||
1202 | |||
1203 | -int ipv6_dev_get_saddr(struct net_device *dst_dev, | ||
1204 | +int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev, | ||
1205 | const struct in6_addr *daddr, unsigned int prefs, | ||
1206 | struct in6_addr *saddr) | ||
1207 | { | ||
1208 | struct ipv6_saddr_score scores[2], | ||
1209 | *score = &scores[0], *hiscore = &scores[1]; | ||
1210 | - struct net *net = dev_net(dst_dev); | ||
1211 | struct ipv6_saddr_dst dst; | ||
1212 | struct net_device *dev; | ||
1213 | int dst_type; | ||
1214 | diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c | ||
1215 | index 8d05527..f5de3f9 100644 | ||
1216 | --- a/net/ipv6/fib6_rules.c | ||
1217 | +++ b/net/ipv6/fib6_rules.c | ||
1218 | @@ -93,7 +93,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp, | ||
1219 | if (flags & RT6_LOOKUP_F_SRCPREF_COA) | ||
1220 | srcprefs |= IPV6_PREFER_SRC_COA; | ||
1221 | |||
1222 | - if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev, | ||
1223 | + if (ipv6_dev_get_saddr(net, | ||
1224 | + ip6_dst_idev(&rt->u.dst)->dev, | ||
1225 | &flp->fl6_dst, srcprefs, | ||
1226 | &saddr)) | ||
1227 | goto again; | ||
1228 | diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c | ||
1229 | index 918fde4..fe80171 100644 | ||
1230 | --- a/net/ipv6/ip6_fib.c | ||
1231 | +++ b/net/ipv6/ip6_fib.c | ||
1232 | @@ -380,6 +380,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb) | ||
1233 | |||
1234 | arg.skb = skb; | ||
1235 | arg.cb = cb; | ||
1236 | + arg.net = net; | ||
1237 | w->args = &arg; | ||
1238 | |||
1239 | for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) { | ||
1240 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c | ||
1241 | index 4019770..d99f094 100644 | ||
1242 | --- a/net/ipv6/ip6_output.c | ||
1243 | +++ b/net/ipv6/ip6_output.c | ||
1244 | @@ -925,7 +925,7 @@ static int ip6_dst_lookup_tail(struct sock *sk, | ||
1245 | goto out_err_release; | ||
1246 | |||
1247 | if (ipv6_addr_any(&fl->fl6_src)) { | ||
1248 | - err = ipv6_dev_get_saddr(ip6_dst_idev(*dst)->dev, | ||
1249 | + err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev, | ||
1250 | &fl->fl6_dst, | ||
1251 | sk ? inet6_sk(sk)->srcprefs : 0, | ||
1252 | &fl->fl6_src); | ||
1253 | diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c | ||
1254 | index 282fdb3..efa84ae 100644 | ||
1255 | --- a/net/ipv6/ndisc.c | ||
1256 | +++ b/net/ipv6/ndisc.c | ||
1257 | @@ -549,7 +549,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh, | ||
1258 | override = 0; | ||
1259 | in6_ifa_put(ifp); | ||
1260 | } else { | ||
1261 | - if (ipv6_dev_get_saddr(dev, daddr, | ||
1262 | + if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr, | ||
1263 | inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs, | ||
1264 | &tmpaddr)) | ||
1265 | return; | ||
1266 | diff --git a/net/ipv6/route.c b/net/ipv6/route.c | ||
1267 | index 7ff6870..9deee59 100644 | ||
1268 | --- a/net/ipv6/route.c | ||
1269 | +++ b/net/ipv6/route.c | ||
1270 | @@ -2098,7 +2098,8 @@ static inline size_t rt6_nlmsg_size(void) | ||
1271 | + nla_total_size(sizeof(struct rta_cacheinfo)); | ||
1272 | } | ||
1273 | |||
1274 | -static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt, | ||
1275 | +static int rt6_fill_node(struct net *net, | ||
1276 | + struct sk_buff *skb, struct rt6_info *rt, | ||
1277 | struct in6_addr *dst, struct in6_addr *src, | ||
1278 | int iif, int type, u32 pid, u32 seq, | ||
1279 | int prefix, int nowait, unsigned int flags) | ||
1280 | @@ -2179,8 +2180,9 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt, | ||
1281 | #endif | ||
1282 | NLA_PUT_U32(skb, RTA_IIF, iif); | ||
1283 | } else if (dst) { | ||
1284 | + struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst); | ||
1285 | struct in6_addr saddr_buf; | ||
1286 | - if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev, | ||
1287 | + if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL, | ||
1288 | dst, 0, &saddr_buf) == 0) | ||
1289 | NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf); | ||
1290 | } | ||
1291 | @@ -2225,7 +2227,8 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg) | ||
1292 | } else | ||
1293 | prefix = 0; | ||
1294 | |||
1295 | - return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE, | ||
1296 | + return rt6_fill_node(arg->net, | ||
1297 | + arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE, | ||
1298 | NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq, | ||
1299 | prefix, 0, NLM_F_MULTI); | ||
1300 | } | ||
1301 | @@ -2291,7 +2294,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void | ||
1302 | rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl); | ||
1303 | skb->dst = &rt->u.dst; | ||
1304 | |||
1305 | - err = rt6_fill_node(skb, rt, &fl.fl6_dst, &fl.fl6_src, iif, | ||
1306 | + err = rt6_fill_node(net, skb, rt, &fl.fl6_dst, &fl.fl6_src, iif, | ||
1307 | RTM_NEWROUTE, NETLINK_CB(in_skb).pid, | ||
1308 | nlh->nlmsg_seq, 0, 0, 0); | ||
1309 | if (err < 0) { | ||
1310 | @@ -2318,7 +2321,7 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info) | ||
1311 | if (skb == NULL) | ||
1312 | goto errout; | ||
1313 | |||
1314 | - err = rt6_fill_node(skb, rt, NULL, NULL, 0, | ||
1315 | + err = rt6_fill_node(net, skb, rt, NULL, NULL, 0, | ||
1316 | event, info->pid, seq, 0, 0, 0); | ||
1317 | if (err < 0) { | ||
1318 | /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */ | ||
1319 | diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c | ||
1320 | index dd30962..e14aa66 100644 | ||
1321 | --- a/net/ipv6/udp.c | ||
1322 | +++ b/net/ipv6/udp.c | ||
1323 | @@ -376,7 +376,7 @@ static int __udp6_lib_mcast_deliver(struct sk_buff *skb, struct in6_addr *saddr, | ||
1324 | uh->source, saddr, dif))) { | ||
1325 | struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC); | ||
1326 | if (buff) { | ||
1327 | - bh_lock_sock_nested(sk2); | ||
1328 | + bh_lock_sock(sk2); | ||
1329 | if (!sock_owned_by_user(sk2)) | ||
1330 | udpv6_queue_rcv_skb(sk2, buff); | ||
1331 | else | ||
1332 | @@ -384,7 +384,7 @@ static int __udp6_lib_mcast_deliver(struct sk_buff *skb, struct in6_addr *saddr, | ||
1333 | bh_unlock_sock(sk2); | ||
1334 | } | ||
1335 | } | ||
1336 | - bh_lock_sock_nested(sk); | ||
1337 | + bh_lock_sock(sk); | ||
1338 | if (!sock_owned_by_user(sk)) | ||
1339 | udpv6_queue_rcv_skb(sk, skb); | ||
1340 | else | ||
1341 | @@ -502,7 +502,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[], | ||
1342 | |||
1343 | /* deliver */ | ||
1344 | |||
1345 | - bh_lock_sock_nested(sk); | ||
1346 | + bh_lock_sock(sk); | ||
1347 | if (!sock_owned_by_user(sk)) | ||
1348 | udpv6_queue_rcv_skb(sk, skb); | ||
1349 | else | ||
1350 | diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c | ||
1351 | index 8f1e054..08e4cbb 100644 | ||
1352 | --- a/net/ipv6/xfrm6_policy.c | ||
1353 | +++ b/net/ipv6/xfrm6_policy.c | ||
1354 | @@ -52,12 +52,14 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr, | ||
1355 | static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr) | ||
1356 | { | ||
1357 | struct dst_entry *dst; | ||
1358 | + struct net_device *dev; | ||
1359 | |||
1360 | dst = xfrm6_dst_lookup(0, NULL, daddr); | ||
1361 | if (IS_ERR(dst)) | ||
1362 | return -EHOSTUNREACH; | ||
1363 | |||
1364 | - ipv6_dev_get_saddr(ip6_dst_idev(dst)->dev, | ||
1365 | + dev = ip6_dst_idev(dst)->dev; | ||
1366 | + ipv6_dev_get_saddr(dev_net(dev), dev, | ||
1367 | (struct in6_addr *)&daddr->a6, 0, | ||
1368 | (struct in6_addr *)&saddr->a6); | ||
1369 | dst_release(dst); | ||
1370 | diff --git a/net/sched/act_api.c b/net/sched/act_api.c | ||
1371 | index 74e662c..b5e116c 100644 | ||
1372 | --- a/net/sched/act_api.c | ||
1373 | +++ b/net/sched/act_api.c | ||
1374 | @@ -205,10 +205,9 @@ struct tcf_common *tcf_hash_check(u32 index, struct tc_action *a, int bind, | ||
1375 | { | ||
1376 | struct tcf_common *p = NULL; | ||
1377 | if (index && (p = tcf_hash_lookup(index, hinfo)) != NULL) { | ||
1378 | - if (bind) { | ||
1379 | + if (bind) | ||
1380 | p->tcfc_bindcnt++; | ||
1381 | - p->tcfc_refcnt++; | ||
1382 | - } | ||
1383 | + p->tcfc_refcnt++; | ||
1384 | a->priv = p; | ||
1385 | } | ||
1386 | return p; | ||
1387 | diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c | ||
1388 | index 3fb58f4..51c3f68 100644 | ||
1389 | --- a/net/sched/sch_htb.c | ||
1390 | +++ b/net/sched/sch_htb.c | ||
1391 | @@ -595,11 +595,13 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch) | ||
1392 | kfree_skb(skb); | ||
1393 | return ret; | ||
1394 | #endif | ||
1395 | - } else if (cl->un.leaf.q->enqueue(skb, cl->un.leaf.q) != | ||
1396 | + } else if ((ret = cl->un.leaf.q->enqueue(skb, cl->un.leaf.q)) != | ||
1397 | NET_XMIT_SUCCESS) { | ||
1398 | - sch->qstats.drops++; | ||
1399 | - cl->qstats.drops++; | ||
1400 | - return NET_XMIT_DROP; | ||
1401 | + if (ret == NET_XMIT_DROP) { | ||
1402 | + sch->qstats.drops++; | ||
1403 | + cl->qstats.drops++; | ||
1404 | + } | ||
1405 | + return ret; | ||
1406 | } else { | ||
1407 | cl->bstats.packets += | ||
1408 | skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1; | ||
1409 | @@ -639,11 +641,13 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch) | ||
1410 | kfree_skb(skb); | ||
1411 | return ret; | ||
1412 | #endif | ||
1413 | - } else if (cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q) != | ||
1414 | + } else if ((ret = cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q)) != | ||
1415 | NET_XMIT_SUCCESS) { | ||
1416 | - sch->qstats.drops++; | ||
1417 | - cl->qstats.drops++; | ||
1418 | - return NET_XMIT_DROP; | ||
1419 | + if (ret == NET_XMIT_DROP) { | ||
1420 | + sch->qstats.drops++; | ||
1421 | + cl->qstats.drops++; | ||
1422 | + } | ||
1423 | + return ret; | ||
1424 | } else | ||
1425 | htb_activate(q, cl); | ||
1426 | |||
1427 | diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c | ||
1428 | index 5532f10..ec0c921 100644 | ||
1429 | --- a/net/sched/sch_prio.c | ||
1430 | +++ b/net/sched/sch_prio.c | ||
1431 | @@ -228,14 +228,20 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt) | ||
1432 | { | ||
1433 | struct prio_sched_data *q = qdisc_priv(sch); | ||
1434 | struct tc_prio_qopt *qopt; | ||
1435 | - struct nlattr *tb[TCA_PRIO_MAX + 1]; | ||
1436 | + struct nlattr *tb[TCA_PRIO_MAX + 1] = {0}; | ||
1437 | int err; | ||
1438 | int i; | ||
1439 | |||
1440 | - err = nla_parse_nested_compat(tb, TCA_PRIO_MAX, opt, NULL, qopt, | ||
1441 | - sizeof(*qopt)); | ||
1442 | - if (err < 0) | ||
1443 | - return err; | ||
1444 | + qopt = nla_data(opt); | ||
1445 | + if (nla_len(opt) < sizeof(*qopt)) | ||
1446 | + return -1; | ||
1447 | + | ||
1448 | + if (nla_len(opt) >= sizeof(*qopt) + sizeof(struct nlattr)) { | ||
1449 | + err = nla_parse_nested(tb, TCA_PRIO_MAX, | ||
1450 | + (struct nlattr *) (qopt + 1), NULL); | ||
1451 | + if (err < 0) | ||
1452 | + return err; | ||
1453 | + } | ||
1454 | |||
1455 | q->bands = qopt->bands; | ||
1456 | /* If we're multiqueue, make sure the number of incoming bands | ||
1457 | diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c | ||
1458 | index 0b7d78f..fc6f8f3 100644 | ||
1459 | --- a/net/sched/sch_tbf.c | ||
1460 | +++ b/net/sched/sch_tbf.c | ||
1461 | @@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch) | ||
1462 | struct tbf_sched_data *q = qdisc_priv(sch); | ||
1463 | int ret; | ||
1464 | |||
1465 | - if (skb->len > q->max_size) { | ||
1466 | - sch->qstats.drops++; | ||
1467 | -#ifdef CONFIG_NET_CLS_ACT | ||
1468 | - if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch)) | ||
1469 | -#endif | ||
1470 | - kfree_skb(skb); | ||
1471 | - | ||
1472 | - return NET_XMIT_DROP; | ||
1473 | - } | ||
1474 | + if (skb->len > q->max_size) | ||
1475 | + return qdisc_reshape_fail(skb, sch); | ||
1476 | |||
1477 | if ((ret = q->qdisc->enqueue(skb, q->qdisc)) != 0) { | ||
1478 | sch->qstats.drops++; | ||
1479 | diff --git a/net/sctp/auth.c b/net/sctp/auth.c | ||
1480 | index 675a5c3..52db5f6 100644 | ||
1481 | --- a/net/sctp/auth.c | ||
1482 | +++ b/net/sctp/auth.c | ||
1483 | @@ -80,6 +80,10 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp) | ||
1484 | { | ||
1485 | struct sctp_auth_bytes *key; | ||
1486 | |||
1487 | + /* Verify that we are not going to overflow INT_MAX */ | ||
1488 | + if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes)) | ||
1489 | + return NULL; | ||
1490 | + | ||
1491 | /* Allocate the shared key */ | ||
1492 | key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp); | ||
1493 | if (!key) | ||
1494 | @@ -782,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep, | ||
1495 | for (i = 0; i < hmacs->shmac_num_idents; i++) { | ||
1496 | id = hmacs->shmac_idents[i]; | ||
1497 | |||
1498 | + if (id > SCTP_AUTH_HMAC_ID_MAX) | ||
1499 | + return -EOPNOTSUPP; | ||
1500 | + | ||
1501 | if (SCTP_AUTH_HMAC_ID_SHA1 == id) | ||
1502 | has_sha1 = 1; | ||
1503 | |||
1504 | diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c | ||
1505 | index e39a0cd..4c8d9f4 100644 | ||
1506 | --- a/net/sctp/endpointola.c | ||
1507 | +++ b/net/sctp/endpointola.c | ||
1508 | @@ -103,6 +103,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, | ||
1509 | |||
1510 | /* Initialize the CHUNKS parameter */ | ||
1511 | auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS; | ||
1512 | + auth_chunks->param_hdr.length = htons(sizeof(sctp_paramhdr_t)); | ||
1513 | |||
1514 | /* If the Add-IP functionality is enabled, we must | ||
1515 | * authenticate, ASCONF and ASCONF-ACK chunks | ||
1516 | @@ -110,8 +111,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, | ||
1517 | if (sctp_addip_enable) { | ||
1518 | auth_chunks->chunks[0] = SCTP_CID_ASCONF; | ||
1519 | auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK; | ||
1520 | - auth_chunks->param_hdr.length = | ||
1521 | - htons(sizeof(sctp_paramhdr_t) + 2); | ||
1522 | + auth_chunks->param_hdr.length += htons(2); | ||
1523 | } | ||
1524 | } | ||
1525 | |||
1526 | diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c | ||
1527 | index a2f4d4d..38a5d80 100644 | ||
1528 | --- a/net/sctp/ipv6.c | ||
1529 | +++ b/net/sctp/ipv6.c | ||
1530 | @@ -317,7 +317,8 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk, | ||
1531 | __func__, asoc, dst, NIP6(daddr->v6.sin6_addr)); | ||
1532 | |||
1533 | if (!asoc) { | ||
1534 | - ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL, | ||
1535 | + ipv6_dev_get_saddr(sock_net(sctp_opt2sk(sk)), | ||
1536 | + dst ? ip6_dst_idev(dst)->dev : NULL, | ||
1537 | &daddr->v6.sin6_addr, | ||
1538 | inet6_sk(&sk->inet.sk)->srcprefs, | ||
1539 | &saddr->v6.sin6_addr); | ||
1540 | diff --git a/net/sctp/socket.c b/net/sctp/socket.c | ||
1541 | index 0dbcde6..700d27d 100644 | ||
1542 | --- a/net/sctp/socket.c | ||
1543 | +++ b/net/sctp/socket.c | ||
1544 | @@ -2965,6 +2965,9 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk, | ||
1545 | { | ||
1546 | struct sctp_authchunk val; | ||
1547 | |||
1548 | + if (!sctp_auth_enable) | ||
1549 | + return -EACCES; | ||
1550 | + | ||
1551 | if (optlen != sizeof(struct sctp_authchunk)) | ||
1552 | return -EINVAL; | ||
1553 | if (copy_from_user(&val, optval, optlen)) | ||
1554 | @@ -2993,8 +2996,12 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, | ||
1555 | int optlen) | ||
1556 | { | ||
1557 | struct sctp_hmacalgo *hmacs; | ||
1558 | + u32 idents; | ||
1559 | int err; | ||
1560 | |||
1561 | + if (!sctp_auth_enable) | ||
1562 | + return -EACCES; | ||
1563 | + | ||
1564 | if (optlen < sizeof(struct sctp_hmacalgo)) | ||
1565 | return -EINVAL; | ||
1566 | |||
1567 | @@ -3007,8 +3014,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, | ||
1568 | goto out; | ||
1569 | } | ||
1570 | |||
1571 | - if (hmacs->shmac_num_idents == 0 || | ||
1572 | - hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) { | ||
1573 | + idents = hmacs->shmac_num_idents; | ||
1574 | + if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS || | ||
1575 | + (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) { | ||
1576 | err = -EINVAL; | ||
1577 | goto out; | ||
1578 | } | ||
1579 | @@ -3033,6 +3041,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk, | ||
1580 | struct sctp_association *asoc; | ||
1581 | int ret; | ||
1582 | |||
1583 | + if (!sctp_auth_enable) | ||
1584 | + return -EACCES; | ||
1585 | + | ||
1586 | if (optlen <= sizeof(struct sctp_authkey)) | ||
1587 | return -EINVAL; | ||
1588 | |||
1589 | @@ -3045,6 +3056,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk, | ||
1590 | goto out; | ||
1591 | } | ||
1592 | |||
1593 | + if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) { | ||
1594 | + ret = -EINVAL; | ||
1595 | + goto out; | ||
1596 | + } | ||
1597 | + | ||
1598 | asoc = sctp_id2assoc(sk, authkey->sca_assoc_id); | ||
1599 | if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) { | ||
1600 | ret = -EINVAL; | ||
1601 | @@ -3070,6 +3086,9 @@ static int sctp_setsockopt_active_key(struct sock *sk, | ||
1602 | struct sctp_authkeyid val; | ||
1603 | struct sctp_association *asoc; | ||
1604 | |||
1605 | + if (!sctp_auth_enable) | ||
1606 | + return -EACCES; | ||
1607 | + | ||
1608 | if (optlen != sizeof(struct sctp_authkeyid)) | ||
1609 | return -EINVAL; | ||
1610 | if (copy_from_user(&val, optval, optlen)) | ||
1611 | @@ -3095,6 +3114,9 @@ static int sctp_setsockopt_del_key(struct sock *sk, | ||
1612 | struct sctp_authkeyid val; | ||
1613 | struct sctp_association *asoc; | ||
1614 | |||
1615 | + if (!sctp_auth_enable) | ||
1616 | + return -EACCES; | ||
1617 | + | ||
1618 | if (optlen != sizeof(struct sctp_authkeyid)) | ||
1619 | return -EINVAL; | ||
1620 | if (copy_from_user(&val, optval, optlen)) | ||
1621 | @@ -5053,19 +5075,29 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len, | ||
1622 | static int sctp_getsockopt_hmac_ident(struct sock *sk, int len, | ||
1623 | char __user *optval, int __user *optlen) | ||
1624 | { | ||
1625 | + struct sctp_hmacalgo __user *p = (void __user *)optval; | ||
1626 | struct sctp_hmac_algo_param *hmacs; | ||
1627 | - __u16 param_len; | ||
1628 | + __u16 data_len = 0; | ||
1629 | + u32 num_idents; | ||
1630 | + | ||
1631 | + if (!sctp_auth_enable) | ||
1632 | + return -EACCES; | ||
1633 | |||
1634 | hmacs = sctp_sk(sk)->ep->auth_hmacs_list; | ||
1635 | - param_len = ntohs(hmacs->param_hdr.length); | ||
1636 | + data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t); | ||
1637 | |||
1638 | - if (len < param_len) | ||
1639 | + if (len < sizeof(struct sctp_hmacalgo) + data_len) | ||
1640 | return -EINVAL; | ||
1641 | + | ||
1642 | + len = sizeof(struct sctp_hmacalgo) + data_len; | ||
1643 | + num_idents = data_len / sizeof(u16); | ||
1644 | + | ||
1645 | if (put_user(len, optlen)) | ||
1646 | return -EFAULT; | ||
1647 | - if (copy_to_user(optval, hmacs->hmac_ids, len)) | ||
1648 | + if (put_user(num_idents, &p->shmac_num_idents)) | ||
1649 | + return -EFAULT; | ||
1650 | + if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len)) | ||
1651 | return -EFAULT; | ||
1652 | - | ||
1653 | return 0; | ||
1654 | } | ||
1655 | |||
1656 | @@ -5075,6 +5107,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, | ||
1657 | struct sctp_authkeyid val; | ||
1658 | struct sctp_association *asoc; | ||
1659 | |||
1660 | + if (!sctp_auth_enable) | ||
1661 | + return -EACCES; | ||
1662 | + | ||
1663 | if (len < sizeof(struct sctp_authkeyid)) | ||
1664 | return -EINVAL; | ||
1665 | if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) | ||
1666 | @@ -5089,6 +5124,12 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, | ||
1667 | else | ||
1668 | val.scact_keynumber = sctp_sk(sk)->ep->active_key_id; | ||
1669 | |||
1670 | + len = sizeof(struct sctp_authkeyid); | ||
1671 | + if (put_user(len, optlen)) | ||
1672 | + return -EFAULT; | ||
1673 | + if (copy_to_user(optval, &val, len)) | ||
1674 | + return -EFAULT; | ||
1675 | + | ||
1676 | return 0; | ||
1677 | } | ||
1678 | |||
1679 | @@ -5099,13 +5140,16 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, | ||
1680 | struct sctp_authchunks val; | ||
1681 | struct sctp_association *asoc; | ||
1682 | struct sctp_chunks_param *ch; | ||
1683 | - u32 num_chunks; | ||
1684 | + u32 num_chunks = 0; | ||
1685 | char __user *to; | ||
1686 | |||
1687 | - if (len <= sizeof(struct sctp_authchunks)) | ||
1688 | + if (!sctp_auth_enable) | ||
1689 | + return -EACCES; | ||
1690 | + | ||
1691 | + if (len < sizeof(struct sctp_authchunks)) | ||
1692 | return -EINVAL; | ||
1693 | |||
1694 | - if (copy_from_user(&val, p, sizeof(struct sctp_authchunks))) | ||
1695 | + if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) | ||
1696 | return -EFAULT; | ||
1697 | |||
1698 | to = p->gauth_chunks; | ||
1699 | @@ -5114,20 +5158,21 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, | ||
1700 | return -EINVAL; | ||
1701 | |||
1702 | ch = asoc->peer.peer_chunks; | ||
1703 | + if (!ch) | ||
1704 | + goto num; | ||
1705 | |||
1706 | /* See if the user provided enough room for all the data */ | ||
1707 | num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t); | ||
1708 | if (len < num_chunks) | ||
1709 | return -EINVAL; | ||
1710 | |||
1711 | - len = num_chunks; | ||
1712 | - if (put_user(len, optlen)) | ||
1713 | + if (copy_to_user(to, ch->chunks, num_chunks)) | ||
1714 | return -EFAULT; | ||
1715 | +num: | ||
1716 | + len = sizeof(struct sctp_authchunks) + num_chunks; | ||
1717 | + if (put_user(len, optlen)) return -EFAULT; | ||
1718 | if (put_user(num_chunks, &p->gauth_number_of_chunks)) | ||
1719 | return -EFAULT; | ||
1720 | - if (copy_to_user(to, ch->chunks, len)) | ||
1721 | - return -EFAULT; | ||
1722 | - | ||
1723 | return 0; | ||
1724 | } | ||
1725 | |||
1726 | @@ -5138,13 +5183,16 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, | ||
1727 | struct sctp_authchunks val; | ||
1728 | struct sctp_association *asoc; | ||
1729 | struct sctp_chunks_param *ch; | ||
1730 | - u32 num_chunks; | ||
1731 | + u32 num_chunks = 0; | ||
1732 | char __user *to; | ||
1733 | |||
1734 | - if (len <= sizeof(struct sctp_authchunks)) | ||
1735 | + if (!sctp_auth_enable) | ||
1736 | + return -EACCES; | ||
1737 | + | ||
1738 | + if (len < sizeof(struct sctp_authchunks)) | ||
1739 | return -EINVAL; | ||
1740 | |||
1741 | - if (copy_from_user(&val, p, sizeof(struct sctp_authchunks))) | ||
1742 | + if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) | ||
1743 | return -EFAULT; | ||
1744 | |||
1745 | to = p->gauth_chunks; | ||
1746 | @@ -5157,17 +5205,21 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, | ||
1747 | else | ||
1748 | ch = sctp_sk(sk)->ep->auth_chunk_list; | ||
1749 | |||
1750 | + if (!ch) | ||
1751 | + goto num; | ||
1752 | + | ||
1753 | num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t); | ||
1754 | - if (len < num_chunks) | ||
1755 | + if (len < sizeof(struct sctp_authchunks) + num_chunks) | ||
1756 | return -EINVAL; | ||
1757 | |||
1758 | - len = num_chunks; | ||
1759 | + if (copy_to_user(to, ch->chunks, num_chunks)) | ||
1760 | + return -EFAULT; | ||
1761 | +num: | ||
1762 | + len = sizeof(struct sctp_authchunks) + num_chunks; | ||
1763 | if (put_user(len, optlen)) | ||
1764 | return -EFAULT; | ||
1765 | if (put_user(num_chunks, &p->gauth_number_of_chunks)) | ||
1766 | return -EFAULT; | ||
1767 | - if (copy_to_user(to, ch->chunks, len)) | ||
1768 | - return -EFAULT; | ||
1769 | |||
1770 | return 0; | ||
1771 | } | ||
1772 | diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c | ||
1773 | index 0f8c439..5231f7a 100644 | ||
1774 | --- a/net/sunrpc/sysctl.c | ||
1775 | +++ b/net/sunrpc/sysctl.c | ||
1776 | @@ -60,24 +60,14 @@ static int proc_do_xprt(ctl_table *table, int write, struct file *file, | ||
1777 | void __user *buffer, size_t *lenp, loff_t *ppos) | ||
1778 | { | ||
1779 | char tmpbuf[256]; | ||
1780 | - int len; | ||
1781 | + size_t len; | ||
1782 | + | ||
1783 | if ((*ppos && !write) || !*lenp) { | ||
1784 | *lenp = 0; | ||
1785 | return 0; | ||
1786 | } | ||
1787 | - if (write) | ||
1788 | - return -EINVAL; | ||
1789 | - else { | ||
1790 | - len = svc_print_xprts(tmpbuf, sizeof(tmpbuf)); | ||
1791 | - if (!access_ok(VERIFY_WRITE, buffer, len)) | ||
1792 | - return -EFAULT; | ||
1793 | - | ||
1794 | - if (__copy_to_user(buffer, tmpbuf, len)) | ||
1795 | - return -EFAULT; | ||
1796 | - } | ||
1797 | - *lenp -= len; | ||
1798 | - *ppos += len; | ||
1799 | - return 0; | ||
1800 | + len = svc_print_xprts(tmpbuf, sizeof(tmpbuf)); | ||
1801 | + return simple_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len); | ||
1802 | } | ||
1803 | |||
1804 | static int | ||
1805 | diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c | ||
1806 | index 72fddaf..391f456 100644 | ||
1807 | --- a/net/xfrm/xfrm_state.c | ||
1808 | +++ b/net/xfrm/xfrm_state.c | ||
1809 | @@ -780,11 +780,13 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, | ||
1810 | { | ||
1811 | unsigned int h; | ||
1812 | struct hlist_node *entry; | ||
1813 | - struct xfrm_state *x, *x0; | ||
1814 | + struct xfrm_state *x, *x0, *to_put; | ||
1815 | int acquire_in_progress = 0; | ||
1816 | int error = 0; | ||
1817 | struct xfrm_state *best = NULL; | ||
1818 | |||
1819 | + to_put = NULL; | ||
1820 | + | ||
1821 | spin_lock_bh(&xfrm_state_lock); | ||
1822 | h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family); | ||
1823 | hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) { | ||
1824 | @@ -833,7 +835,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, | ||
1825 | if (tmpl->id.spi && | ||
1826 | (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi, | ||
1827 | tmpl->id.proto, family)) != NULL) { | ||
1828 | - xfrm_state_put(x0); | ||
1829 | + to_put = x0; | ||
1830 | error = -EEXIST; | ||
1831 | goto out; | ||
1832 | } | ||
1833 | @@ -849,7 +851,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, | ||
1834 | error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid); | ||
1835 | if (error) { | ||
1836 | x->km.state = XFRM_STATE_DEAD; | ||
1837 | - xfrm_state_put(x); | ||
1838 | + to_put = x; | ||
1839 | x = NULL; | ||
1840 | goto out; | ||
1841 | } | ||
1842 | @@ -870,7 +872,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, | ||
1843 | xfrm_hash_grow_check(x->bydst.next != NULL); | ||
1844 | } else { | ||
1845 | x->km.state = XFRM_STATE_DEAD; | ||
1846 | - xfrm_state_put(x); | ||
1847 | + to_put = x; | ||
1848 | x = NULL; | ||
1849 | error = -ESRCH; | ||
1850 | } | ||
1851 | @@ -881,6 +883,8 @@ out: | ||
1852 | else | ||
1853 | *err = acquire_in_progress ? -EAGAIN : error; | ||
1854 | spin_unlock_bh(&xfrm_state_lock); | ||
1855 | + if (to_put) | ||
1856 | + xfrm_state_put(to_put); | ||
1857 | return x; | ||
1858 | } | ||
1859 | |||
1860 | @@ -1067,18 +1071,20 @@ static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq); | ||
1861 | |||
1862 | int xfrm_state_add(struct xfrm_state *x) | ||
1863 | { | ||
1864 | - struct xfrm_state *x1; | ||
1865 | + struct xfrm_state *x1, *to_put; | ||
1866 | int family; | ||
1867 | int err; | ||
1868 | int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); | ||
1869 | |||
1870 | family = x->props.family; | ||
1871 | |||
1872 | + to_put = NULL; | ||
1873 | + | ||
1874 | spin_lock_bh(&xfrm_state_lock); | ||
1875 | |||
1876 | x1 = __xfrm_state_locate(x, use_spi, family); | ||
1877 | if (x1) { | ||
1878 | - xfrm_state_put(x1); | ||
1879 | + to_put = x1; | ||
1880 | x1 = NULL; | ||
1881 | err = -EEXIST; | ||
1882 | goto out; | ||
1883 | @@ -1088,7 +1094,7 @@ int xfrm_state_add(struct xfrm_state *x) | ||
1884 | x1 = __xfrm_find_acq_byseq(x->km.seq); | ||
1885 | if (x1 && ((x1->id.proto != x->id.proto) || | ||
1886 | xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) { | ||
1887 | - xfrm_state_put(x1); | ||
1888 | + to_put = x1; | ||
1889 | x1 = NULL; | ||
1890 | } | ||
1891 | } | ||
1892 | @@ -1110,6 +1116,9 @@ out: | ||
1893 | xfrm_state_put(x1); | ||
1894 | } | ||
1895 | |||
1896 | + if (to_put) | ||
1897 | + xfrm_state_put(to_put); | ||
1898 | + | ||
1899 | return err; | ||
1900 | } | ||
1901 | EXPORT_SYMBOL(xfrm_state_add); | ||
1902 | @@ -1269,10 +1278,12 @@ EXPORT_SYMBOL(xfrm_state_migrate); | ||
1903 | |||
1904 | int xfrm_state_update(struct xfrm_state *x) | ||
1905 | { | ||
1906 | - struct xfrm_state *x1; | ||
1907 | + struct xfrm_state *x1, *to_put; | ||
1908 | int err; | ||
1909 | int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); | ||
1910 | |||
1911 | + to_put = NULL; | ||
1912 | + | ||
1913 | spin_lock_bh(&xfrm_state_lock); | ||
1914 | x1 = __xfrm_state_locate(x, use_spi, x->props.family); | ||
1915 | |||
1916 | @@ -1281,7 +1292,7 @@ int xfrm_state_update(struct xfrm_state *x) | ||
1917 | goto out; | ||
1918 | |||
1919 | if (xfrm_state_kern(x1)) { | ||
1920 | - xfrm_state_put(x1); | ||
1921 | + to_put = x1; | ||
1922 | err = -EEXIST; | ||
1923 | goto out; | ||
1924 | } | ||
1925 | @@ -1295,6 +1306,9 @@ int xfrm_state_update(struct xfrm_state *x) | ||
1926 | out: | ||
1927 | spin_unlock_bh(&xfrm_state_lock); | ||
1928 | |||
1929 | + if (to_put) | ||
1930 | + xfrm_state_put(to_put); | ||
1931 | + | ||
1932 | if (err) | ||
1933 | return err; | ||
1934 | |||
1935 | diff --git a/sound/pci/oxygen/oxygen_mixer.c b/sound/pci/oxygen/oxygen_mixer.c | ||
1936 | index 6facac5..05eb899 100644 | ||
1937 | --- a/sound/pci/oxygen/oxygen_mixer.c | ||
1938 | +++ b/sound/pci/oxygen/oxygen_mixer.c | ||
1939 | @@ -512,9 +512,12 @@ static int ac97_switch_get(struct snd_kcontrol *ctl, | ||
1940 | |||
1941 | static void mute_ac97_ctl(struct oxygen *chip, unsigned int control) | ||
1942 | { | ||
1943 | - unsigned int priv_idx = chip->controls[control]->private_value & 0xff; | ||
1944 | + unsigned int priv_idx; | ||
1945 | u16 value; | ||
1946 | |||
1947 | + if (!chip->controls[control]) | ||
1948 | + return; | ||
1949 | + priv_idx = chip->controls[control]->private_value & 0xff; | ||
1950 | value = oxygen_read_ac97(chip, 0, priv_idx); | ||
1951 | if (!(value & 0x8000)) { | ||
1952 | oxygen_write_ac97(chip, 0, priv_idx, value | 0x8000); |