Contents of /trunk/kernel26-alx/patches-2.6.26-r1/0103-2.6.26.4-all-fixes.patch
Parent Directory | Revision Log
Revision 681 -
(show annotations)
(download)
Wed Sep 17 19:42:13 2008 UTC (16 years ago) by niro
File size: 58786 byte(s)
Wed Sep 17 19:42:13 2008 UTC (16 years ago) by niro
File size: 58786 byte(s)
-2.6.26-alx-r1
1 | diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c |
2 | index e289a98..387d3f6 100644 |
3 | --- a/arch/sparc64/mm/init.c |
4 | +++ b/arch/sparc64/mm/init.c |
5 | @@ -842,6 +842,9 @@ static unsigned long nid_range(unsigned long start, unsigned long end, |
6 | start += PAGE_SIZE; |
7 | } |
8 | |
9 | + if (start > end) |
10 | + start = end; |
11 | + |
12 | return start; |
13 | } |
14 | #else |
15 | @@ -1769,8 +1772,7 @@ void __init paging_init(void) |
16 | |
17 | find_ramdisk(phys_base); |
18 | |
19 | - if (cmdline_memory_size) |
20 | - lmb_enforce_memory_limit(phys_base + cmdline_memory_size); |
21 | + lmb_enforce_memory_limit(cmdline_memory_size); |
22 | |
23 | lmb_analyze(); |
24 | lmb_dump_all(); |
25 | @@ -2007,6 +2009,15 @@ void __init mem_init(void) |
26 | void free_initmem(void) |
27 | { |
28 | unsigned long addr, initend; |
29 | + int do_free = 1; |
30 | + |
31 | + /* If the physical memory maps were trimmed by kernel command |
32 | + * line options, don't even try freeing this initmem stuff up. |
33 | + * The kernel image could have been in the trimmed out region |
34 | + * and if so the freeing below will free invalid page structs. |
35 | + */ |
36 | + if (cmdline_memory_size) |
37 | + do_free = 0; |
38 | |
39 | /* |
40 | * The init section is aligned to 8k in vmlinux.lds. Page align for >8k pagesizes. |
41 | @@ -2021,13 +2032,16 @@ void free_initmem(void) |
42 | ((unsigned long) __va(kern_base)) - |
43 | ((unsigned long) KERNBASE)); |
44 | memset((void *)addr, POISON_FREE_INITMEM, PAGE_SIZE); |
45 | - p = virt_to_page(page); |
46 | |
47 | - ClearPageReserved(p); |
48 | - init_page_count(p); |
49 | - __free_page(p); |
50 | - num_physpages++; |
51 | - totalram_pages++; |
52 | + if (do_free) { |
53 | + p = virt_to_page(page); |
54 | + |
55 | + ClearPageReserved(p); |
56 | + init_page_count(p); |
57 | + __free_page(p); |
58 | + num_physpages++; |
59 | + totalram_pages++; |
60 | + } |
61 | } |
62 | } |
63 | |
64 | diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c |
65 | index 3fd7a67..e710a21 100644 |
66 | --- a/arch/x86/kernel/cpu/cyrix.c |
67 | +++ b/arch/x86/kernel/cpu/cyrix.c |
68 | @@ -134,23 +134,6 @@ static void __cpuinit set_cx86_memwb(void) |
69 | setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x14); |
70 | } |
71 | |
72 | -static void __cpuinit set_cx86_inc(void) |
73 | -{ |
74 | - unsigned char ccr3; |
75 | - |
76 | - printk(KERN_INFO "Enable Incrementor on Cyrix/NSC processor.\n"); |
77 | - |
78 | - ccr3 = getCx86(CX86_CCR3); |
79 | - setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */ |
80 | - /* PCR1 -- Performance Control */ |
81 | - /* Incrementor on, whatever that is */ |
82 | - setCx86(CX86_PCR1, getCx86(CX86_PCR1) | 0x02); |
83 | - /* PCR0 -- Performance Control */ |
84 | - /* Incrementor Margin 10 */ |
85 | - setCx86(CX86_PCR0, getCx86(CX86_PCR0) | 0x04); |
86 | - setCx86(CX86_CCR3, ccr3); /* disable MAPEN */ |
87 | -} |
88 | - |
89 | /* |
90 | * Configure later MediaGX and/or Geode processor. |
91 | */ |
92 | @@ -174,7 +157,6 @@ static void __cpuinit geode_configure(void) |
93 | |
94 | set_cx86_memwb(); |
95 | set_cx86_reorder(); |
96 | - set_cx86_inc(); |
97 | |
98 | local_irq_restore(flags); |
99 | } |
100 | diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c |
101 | index 75b14b1..745b974 100644 |
102 | --- a/arch/x86/kernel/cpu/mtrr/generic.c |
103 | +++ b/arch/x86/kernel/cpu/mtrr/generic.c |
104 | @@ -365,6 +365,7 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base, |
105 | unsigned long *size, mtrr_type *type) |
106 | { |
107 | unsigned int mask_lo, mask_hi, base_lo, base_hi; |
108 | + unsigned int tmp, hi; |
109 | |
110 | rdmsr(MTRRphysMask_MSR(reg), mask_lo, mask_hi); |
111 | if ((mask_lo & 0x800) == 0) { |
112 | @@ -378,8 +379,23 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base, |
113 | rdmsr(MTRRphysBase_MSR(reg), base_lo, base_hi); |
114 | |
115 | /* Work out the shifted address mask. */ |
116 | - mask_lo = size_or_mask | mask_hi << (32 - PAGE_SHIFT) |
117 | - | mask_lo >> PAGE_SHIFT; |
118 | + tmp = mask_hi << (32 - PAGE_SHIFT) | mask_lo >> PAGE_SHIFT; |
119 | + mask_lo = size_or_mask | tmp; |
120 | + /* Expand tmp with high bits to all 1s*/ |
121 | + hi = fls(tmp); |
122 | + if (hi > 0) { |
123 | + tmp |= ~((1<<(hi - 1)) - 1); |
124 | + |
125 | + if (tmp != mask_lo) { |
126 | + static int once = 1; |
127 | + |
128 | + if (once) { |
129 | + printk(KERN_INFO "mtrr: your BIOS has set up an incorrect mask, fixing it up.\n"); |
130 | + once = 0; |
131 | + } |
132 | + mask_lo = tmp; |
133 | + } |
134 | + } |
135 | |
136 | /* This works correctly if size is a power of two, i.e. a |
137 | contiguous range. */ |
138 | diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h |
139 | index 934c7b6..d333a74 100644 |
140 | --- a/arch/x86/kvm/paging_tmpl.h |
141 | +++ b/arch/x86/kvm/paging_tmpl.h |
142 | @@ -343,7 +343,7 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr, |
143 | shadow_addr = __pa(shadow_page->spt); |
144 | shadow_pte = shadow_addr | PT_PRESENT_MASK | PT_ACCESSED_MASK |
145 | | PT_WRITABLE_MASK | PT_USER_MASK; |
146 | - *shadow_ent = shadow_pte; |
147 | + set_shadow_pte(shadow_ent, shadow_pte); |
148 | } |
149 | |
150 | mmu_set_spte(vcpu, shadow_ent, access, walker->pte_access & access, |
151 | diff --git a/crypto/authenc.c b/crypto/authenc.c |
152 | index 4b22676..fd9f06c 100644 |
153 | --- a/crypto/authenc.c |
154 | +++ b/crypto/authenc.c |
155 | @@ -174,8 +174,9 @@ static int crypto_authenc_genicv(struct aead_request *req, u8 *iv, |
156 | static void crypto_authenc_encrypt_done(struct crypto_async_request *req, |
157 | int err) |
158 | { |
159 | + struct aead_request *areq = req->data; |
160 | + |
161 | if (!err) { |
162 | - struct aead_request *areq = req->data; |
163 | struct crypto_aead *authenc = crypto_aead_reqtfm(areq); |
164 | struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc); |
165 | struct ablkcipher_request *abreq = aead_request_ctx(areq); |
166 | @@ -185,7 +186,7 @@ static void crypto_authenc_encrypt_done(struct crypto_async_request *req, |
167 | err = crypto_authenc_genicv(areq, iv, 0); |
168 | } |
169 | |
170 | - aead_request_complete(req->data, err); |
171 | + aead_request_complete(areq, err); |
172 | } |
173 | |
174 | static int crypto_authenc_encrypt(struct aead_request *req) |
175 | @@ -216,14 +217,15 @@ static int crypto_authenc_encrypt(struct aead_request *req) |
176 | static void crypto_authenc_givencrypt_done(struct crypto_async_request *req, |
177 | int err) |
178 | { |
179 | + struct aead_request *areq = req->data; |
180 | + |
181 | if (!err) { |
182 | - struct aead_request *areq = req->data; |
183 | struct skcipher_givcrypt_request *greq = aead_request_ctx(areq); |
184 | |
185 | err = crypto_authenc_genicv(areq, greq->giv, 0); |
186 | } |
187 | |
188 | - aead_request_complete(req->data, err); |
189 | + aead_request_complete(areq, err); |
190 | } |
191 | |
192 | static int crypto_authenc_givencrypt(struct aead_givcrypt_request *req) |
193 | diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c |
194 | index ad169ff..80c655f 100644 |
195 | --- a/drivers/ata/sata_mv.c |
196 | +++ b/drivers/ata/sata_mv.c |
197 | @@ -1134,30 +1134,16 @@ static int mv_qc_defer(struct ata_queued_cmd *qc) |
198 | if (ap->nr_active_links == 0) |
199 | return 0; |
200 | |
201 | - if (pp->pp_flags & MV_PP_FLAG_EDMA_EN) { |
202 | - /* |
203 | - * The port is operating in host queuing mode (EDMA). |
204 | - * It can accomodate a new qc if the qc protocol |
205 | - * is compatible with the current host queue mode. |
206 | - */ |
207 | - if (pp->pp_flags & MV_PP_FLAG_NCQ_EN) { |
208 | - /* |
209 | - * The host queue (EDMA) is in NCQ mode. |
210 | - * If the new qc is also an NCQ command, |
211 | - * then allow the new qc. |
212 | - */ |
213 | - if (qc->tf.protocol == ATA_PROT_NCQ) |
214 | - return 0; |
215 | - } else { |
216 | - /* |
217 | - * The host queue (EDMA) is in non-NCQ, DMA mode. |
218 | - * If the new qc is also a non-NCQ, DMA command, |
219 | - * then allow the new qc. |
220 | - */ |
221 | - if (qc->tf.protocol == ATA_PROT_DMA) |
222 | - return 0; |
223 | - } |
224 | - } |
225 | + /* |
226 | + * The port is operating in host queuing mode (EDMA) with NCQ |
227 | + * enabled, allow multiple NCQ commands. EDMA also allows |
228 | + * queueing multiple DMA commands but libata core currently |
229 | + * doesn't allow it. |
230 | + */ |
231 | + if ((pp->pp_flags & MV_PP_FLAG_EDMA_EN) && |
232 | + (pp->pp_flags & MV_PP_FLAG_NCQ_EN) && ata_is_ncq(qc->tf.protocol)) |
233 | + return 0; |
234 | + |
235 | return ATA_DEFER_PORT; |
236 | } |
237 | |
238 | diff --git a/drivers/char/random.c b/drivers/char/random.c |
239 | index 0cf98bd..71320d2 100644 |
240 | --- a/drivers/char/random.c |
241 | +++ b/drivers/char/random.c |
242 | @@ -406,7 +406,7 @@ struct entropy_store { |
243 | /* read-write data: */ |
244 | spinlock_t lock; |
245 | unsigned add_ptr; |
246 | - int entropy_count; |
247 | + int entropy_count; /* Must at no time exceed ->POOLBITS! */ |
248 | int input_rotate; |
249 | }; |
250 | |
251 | @@ -519,6 +519,7 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes) |
252 | static void credit_entropy_bits(struct entropy_store *r, int nbits) |
253 | { |
254 | unsigned long flags; |
255 | + int entropy_count; |
256 | |
257 | if (!nbits) |
258 | return; |
259 | @@ -526,20 +527,20 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits) |
260 | spin_lock_irqsave(&r->lock, flags); |
261 | |
262 | DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name); |
263 | - r->entropy_count += nbits; |
264 | - if (r->entropy_count < 0) { |
265 | + entropy_count = r->entropy_count; |
266 | + entropy_count += nbits; |
267 | + if (entropy_count < 0) { |
268 | DEBUG_ENT("negative entropy/overflow\n"); |
269 | - r->entropy_count = 0; |
270 | - } else if (r->entropy_count > r->poolinfo->POOLBITS) |
271 | - r->entropy_count = r->poolinfo->POOLBITS; |
272 | + entropy_count = 0; |
273 | + } else if (entropy_count > r->poolinfo->POOLBITS) |
274 | + entropy_count = r->poolinfo->POOLBITS; |
275 | + r->entropy_count = entropy_count; |
276 | |
277 | /* should we wake readers? */ |
278 | - if (r == &input_pool && |
279 | - r->entropy_count >= random_read_wakeup_thresh) { |
280 | + if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) { |
281 | wake_up_interruptible(&random_read_wait); |
282 | kill_fasync(&fasync, SIGIO, POLL_IN); |
283 | } |
284 | - |
285 | spin_unlock_irqrestore(&r->lock, flags); |
286 | } |
287 | |
288 | diff --git a/drivers/misc/eeepc-laptop.c b/drivers/misc/eeepc-laptop.c |
289 | index 6d72760..3f3abf9 100644 |
290 | --- a/drivers/misc/eeepc-laptop.c |
291 | +++ b/drivers/misc/eeepc-laptop.c |
292 | @@ -553,9 +553,9 @@ static void eeepc_hwmon_exit(void) |
293 | hwmon = eeepc_hwmon_device; |
294 | if (!hwmon) |
295 | return ; |
296 | - hwmon_device_unregister(hwmon); |
297 | sysfs_remove_group(&hwmon->kobj, |
298 | &hwmon_attribute_group); |
299 | + hwmon_device_unregister(hwmon); |
300 | eeepc_hwmon_device = NULL; |
301 | } |
302 | |
303 | diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c |
304 | index 3c798ae..8fe0a49 100644 |
305 | --- a/drivers/net/atlx/atl1.c |
306 | +++ b/drivers/net/atlx/atl1.c |
307 | @@ -3019,7 +3019,6 @@ static int __devinit atl1_probe(struct pci_dev *pdev, |
308 | netdev->features = NETIF_F_HW_CSUM; |
309 | netdev->features |= NETIF_F_SG; |
310 | netdev->features |= (NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX); |
311 | - netdev->features |= NETIF_F_TSO; |
312 | netdev->features |= NETIF_F_LLTX; |
313 | |
314 | /* |
315 | diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c |
316 | index 20d4fe9..1652f10 100644 |
317 | --- a/drivers/net/forcedeth.c |
318 | +++ b/drivers/net/forcedeth.c |
319 | @@ -5420,7 +5420,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i |
320 | if (id->driver_data & DEV_HAS_CHECKSUM) { |
321 | np->rx_csum = 1; |
322 | np->txrxctl_bits |= NVREG_TXRXCTL_RXCHECK; |
323 | - dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG; |
324 | + dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG; |
325 | dev->features |= NETIF_F_TSO; |
326 | } |
327 | |
328 | @@ -5728,7 +5728,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i |
329 | |
330 | dev_printk(KERN_INFO, &pci_dev->dev, "%s%s%s%s%s%s%s%s%s%sdesc-v%u\n", |
331 | dev->features & NETIF_F_HIGHDMA ? "highdma " : "", |
332 | - dev->features & (NETIF_F_HW_CSUM | NETIF_F_SG) ? |
333 | + dev->features & (NETIF_F_IP_CSUM | NETIF_F_SG) ? |
334 | "csum " : "", |
335 | dev->features & (NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX) ? |
336 | "vlan " : "", |
337 | diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c |
338 | index 42d7c0a..0e4eb15 100644 |
339 | --- a/drivers/net/r8169.c |
340 | +++ b/drivers/net/r8169.c |
341 | @@ -2822,7 +2822,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev, |
342 | pkt_size, PCI_DMA_FROMDEVICE); |
343 | rtl8169_mark_to_asic(desc, tp->rx_buf_sz); |
344 | } else { |
345 | - pci_unmap_single(pdev, addr, pkt_size, |
346 | + pci_unmap_single(pdev, addr, tp->rx_buf_sz, |
347 | PCI_DMA_FROMDEVICE); |
348 | tp->Rx_skbuff[entry] = NULL; |
349 | } |
350 | diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c |
351 | index cc4bde8..1710e49 100644 |
352 | --- a/drivers/net/tg3.c |
353 | +++ b/drivers/net/tg3.c |
354 | @@ -1672,15 +1672,43 @@ static int tg3_set_power_state(struct tg3 *tp, pci_power_t state) |
355 | } |
356 | |
357 | /* tp->lock is held. */ |
358 | +static inline void tg3_generate_fw_event(struct tg3 *tp) |
359 | +{ |
360 | + u32 val; |
361 | + |
362 | + val = tr32(GRC_RX_CPU_EVENT); |
363 | + val |= GRC_RX_CPU_DRIVER_EVENT; |
364 | + tw32_f(GRC_RX_CPU_EVENT, val); |
365 | + |
366 | + tp->last_event_jiffies = jiffies; |
367 | +} |
368 | + |
369 | +#define TG3_FW_EVENT_TIMEOUT_USEC 2500 |
370 | + |
371 | +/* tp->lock is held. */ |
372 | static void tg3_wait_for_event_ack(struct tg3 *tp) |
373 | { |
374 | int i; |
375 | + unsigned int delay_cnt; |
376 | + long time_remain; |
377 | + |
378 | + /* If enough time has passed, no wait is necessary. */ |
379 | + time_remain = (long)(tp->last_event_jiffies + 1 + |
380 | + usecs_to_jiffies(TG3_FW_EVENT_TIMEOUT_USEC)) - |
381 | + (long)jiffies; |
382 | + if (time_remain < 0) |
383 | + return; |
384 | |
385 | - /* Wait for up to 2.5 milliseconds */ |
386 | - for (i = 0; i < 250000; i++) { |
387 | + /* Check if we can shorten the wait time. */ |
388 | + delay_cnt = jiffies_to_usecs(time_remain); |
389 | + if (delay_cnt > TG3_FW_EVENT_TIMEOUT_USEC) |
390 | + delay_cnt = TG3_FW_EVENT_TIMEOUT_USEC; |
391 | + delay_cnt = (delay_cnt >> 3) + 1; |
392 | + |
393 | + for (i = 0; i < delay_cnt; i++) { |
394 | if (!(tr32(GRC_RX_CPU_EVENT) & GRC_RX_CPU_DRIVER_EVENT)) |
395 | break; |
396 | - udelay(10); |
397 | + udelay(8); |
398 | } |
399 | } |
400 | |
401 | @@ -1729,9 +1757,7 @@ static void tg3_ump_link_report(struct tg3 *tp) |
402 | val = 0; |
403 | tg3_write_mem(tp, NIC_SRAM_FW_CMD_DATA_MBOX + 12, val); |
404 | |
405 | - val = tr32(GRC_RX_CPU_EVENT); |
406 | - val |= GRC_RX_CPU_DRIVER_EVENT; |
407 | - tw32_f(GRC_RX_CPU_EVENT, val); |
408 | + tg3_generate_fw_event(tp); |
409 | } |
410 | |
411 | static void tg3_link_report(struct tg3 *tp) |
412 | @@ -5565,6 +5591,7 @@ static int tg3_chip_reset(struct tg3 *tp) |
413 | tg3_read_mem(tp, NIC_SRAM_DATA_CFG, &nic_cfg); |
414 | if (nic_cfg & NIC_SRAM_DATA_CFG_ASF_ENABLE) { |
415 | tp->tg3_flags |= TG3_FLAG_ENABLE_ASF; |
416 | + tp->last_event_jiffies = jiffies; |
417 | if (tp->tg3_flags2 & TG3_FLG2_5750_PLUS) |
418 | tp->tg3_flags2 |= TG3_FLG2_ASF_NEW_HANDSHAKE; |
419 | } |
420 | @@ -5578,15 +5605,12 @@ static void tg3_stop_fw(struct tg3 *tp) |
421 | { |
422 | if ((tp->tg3_flags & TG3_FLAG_ENABLE_ASF) && |
423 | !(tp->tg3_flags3 & TG3_FLG3_ENABLE_APE)) { |
424 | - u32 val; |
425 | - |
426 | /* Wait for RX cpu to ACK the previous event. */ |
427 | tg3_wait_for_event_ack(tp); |
428 | |
429 | tg3_write_mem(tp, NIC_SRAM_FW_CMD_MBOX, FWCMD_NICDRV_PAUSE_FW); |
430 | - val = tr32(GRC_RX_CPU_EVENT); |
431 | - val |= GRC_RX_CPU_DRIVER_EVENT; |
432 | - tw32(GRC_RX_CPU_EVENT, val); |
433 | + |
434 | + tg3_generate_fw_event(tp); |
435 | |
436 | /* Wait for RX cpu to ACK this event. */ |
437 | tg3_wait_for_event_ack(tp); |
438 | @@ -7477,8 +7501,6 @@ static void tg3_timer(unsigned long __opaque) |
439 | */ |
440 | if (!--tp->asf_counter) { |
441 | if (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) { |
442 | - u32 val; |
443 | - |
444 | tg3_wait_for_event_ack(tp); |
445 | |
446 | tg3_write_mem(tp, NIC_SRAM_FW_CMD_MBOX, |
447 | @@ -7486,9 +7508,8 @@ static void tg3_timer(unsigned long __opaque) |
448 | tg3_write_mem(tp, NIC_SRAM_FW_CMD_LEN_MBOX, 4); |
449 | /* 5 seconds timeout */ |
450 | tg3_write_mem(tp, NIC_SRAM_FW_CMD_DATA_MBOX, 5); |
451 | - val = tr32(GRC_RX_CPU_EVENT); |
452 | - val |= GRC_RX_CPU_DRIVER_EVENT; |
453 | - tw32_f(GRC_RX_CPU_EVENT, val); |
454 | + |
455 | + tg3_generate_fw_event(tp); |
456 | } |
457 | tp->asf_counter = tp->asf_multiplier; |
458 | } |
459 | diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h |
460 | index 0404f93..d68b579 100644 |
461 | --- a/drivers/net/tg3.h |
462 | +++ b/drivers/net/tg3.h |
463 | @@ -2404,7 +2404,10 @@ struct tg3 { |
464 | struct tg3_ethtool_stats estats; |
465 | struct tg3_ethtool_stats estats_prev; |
466 | |
467 | + union { |
468 | unsigned long phy_crc_errors; |
469 | + unsigned long last_event_jiffies; |
470 | + }; |
471 | |
472 | u32 rx_offset; |
473 | u32 tg3_flags; |
474 | diff --git a/drivers/pci/search.c b/drivers/pci/search.c |
475 | index 217814f..3b3b5f1 100644 |
476 | --- a/drivers/pci/search.c |
477 | +++ b/drivers/pci/search.c |
478 | @@ -280,6 +280,8 @@ static struct pci_dev *pci_get_dev_by_id(const struct pci_device_id *id, |
479 | match_pci_dev_by_id); |
480 | if (dev) |
481 | pdev = to_pci_dev(dev); |
482 | + if (from) |
483 | + pci_dev_put(from); |
484 | return pdev; |
485 | } |
486 | |
487 | diff --git a/drivers/rtc/rtc-lib.c b/drivers/rtc/rtc-lib.c |
488 | index 9f996ec..dd70bf7 100644 |
489 | --- a/drivers/rtc/rtc-lib.c |
490 | +++ b/drivers/rtc/rtc-lib.c |
491 | @@ -51,10 +51,11 @@ EXPORT_SYMBOL(rtc_year_days); |
492 | */ |
493 | void rtc_time_to_tm(unsigned long time, struct rtc_time *tm) |
494 | { |
495 | - unsigned int days, month, year; |
496 | + unsigned int month, year; |
497 | + int days; |
498 | |
499 | days = time / 86400; |
500 | - time -= days * 86400; |
501 | + time -= (unsigned int) days * 86400; |
502 | |
503 | /* day of the week, 1970-01-01 was a Thursday */ |
504 | tm->tm_wday = (days + 4) % 7; |
505 | diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h |
506 | index fc2509c..a466820 100644 |
507 | --- a/drivers/s390/block/dasd_eckd.h |
508 | +++ b/drivers/s390/block/dasd_eckd.h |
509 | @@ -379,7 +379,7 @@ struct dasd_psf_prssd_data { |
510 | unsigned char flags; |
511 | unsigned char reserved[4]; |
512 | unsigned char suborder; |
513 | - unsigned char varies[9]; |
514 | + unsigned char varies[5]; |
515 | } __attribute__ ((packed)); |
516 | |
517 | /* |
518 | diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c |
519 | index be95e55..4050845 100644 |
520 | --- a/drivers/serial/8250.c |
521 | +++ b/drivers/serial/8250.c |
522 | @@ -1895,15 +1895,23 @@ static int serial8250_startup(struct uart_port *port) |
523 | * kick the UART on a regular basis. |
524 | */ |
525 | if (!(iir1 & UART_IIR_NO_INT) && (iir & UART_IIR_NO_INT)) { |
526 | + up->bugs |= UART_BUG_THRE; |
527 | pr_debug("ttyS%d - using backup timer\n", port->line); |
528 | - up->timer.function = serial8250_backup_timeout; |
529 | - up->timer.data = (unsigned long)up; |
530 | - mod_timer(&up->timer, jiffies + |
531 | - poll_timeout(up->port.timeout) + HZ / 5); |
532 | } |
533 | } |
534 | |
535 | /* |
536 | + * The above check will only give an accurate result the first time |
537 | + * the port is opened so this value needs to be preserved. |
538 | + */ |
539 | + if (up->bugs & UART_BUG_THRE) { |
540 | + up->timer.function = serial8250_backup_timeout; |
541 | + up->timer.data = (unsigned long)up; |
542 | + mod_timer(&up->timer, jiffies + |
543 | + poll_timeout(up->port.timeout) + HZ / 5); |
544 | + } |
545 | + |
546 | + /* |
547 | * If the "interrupt" for this port doesn't correspond with any |
548 | * hardware interrupt, we use a timer-based system. The original |
549 | * driver used to do this with IRQ0. |
550 | diff --git a/drivers/serial/8250.h b/drivers/serial/8250.h |
551 | index 91bd28f..245288d 100644 |
552 | --- a/drivers/serial/8250.h |
553 | +++ b/drivers/serial/8250.h |
554 | @@ -49,6 +49,7 @@ struct serial8250_config { |
555 | #define UART_BUG_QUOT (1 << 0) /* UART has buggy quot LSB */ |
556 | #define UART_BUG_TXEN (1 << 1) /* UART has buggy TX IIR status */ |
557 | #define UART_BUG_NOMSR (1 << 2) /* UART has buggy MSR status bits (Au1x00) */ |
558 | +#define UART_BUG_THRE (1 << 3) /* UART has buggy THRE reassertion */ |
559 | |
560 | #define PROBE_RSA (1 << 0) |
561 | #define PROBE_ANY (~0) |
562 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c |
563 | index c3201af..560337a 100644 |
564 | --- a/drivers/usb/class/cdc-acm.c |
565 | +++ b/drivers/usb/class/cdc-acm.c |
566 | @@ -525,8 +525,8 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp) |
567 | tasklet_schedule(&acm->urb_task); |
568 | |
569 | done: |
570 | -err_out: |
571 | mutex_unlock(&acm->mutex); |
572 | +err_out: |
573 | mutex_unlock(&open_mutex); |
574 | return rv; |
575 | |
576 | diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c |
577 | index 59df132..4835bdc 100644 |
578 | --- a/drivers/video/fb_defio.c |
579 | +++ b/drivers/video/fb_defio.c |
580 | @@ -114,6 +114,17 @@ static struct vm_operations_struct fb_deferred_io_vm_ops = { |
581 | .page_mkwrite = fb_deferred_io_mkwrite, |
582 | }; |
583 | |
584 | +static int fb_deferred_io_set_page_dirty(struct page *page) |
585 | +{ |
586 | + if (!PageDirty(page)) |
587 | + SetPageDirty(page); |
588 | + return 0; |
589 | +} |
590 | + |
591 | +static const struct address_space_operations fb_deferred_io_aops = { |
592 | + .set_page_dirty = fb_deferred_io_set_page_dirty, |
593 | +}; |
594 | + |
595 | static int fb_deferred_io_mmap(struct fb_info *info, struct vm_area_struct *vma) |
596 | { |
597 | vma->vm_ops = &fb_deferred_io_vm_ops; |
598 | @@ -163,6 +174,14 @@ void fb_deferred_io_init(struct fb_info *info) |
599 | } |
600 | EXPORT_SYMBOL_GPL(fb_deferred_io_init); |
601 | |
602 | +void fb_deferred_io_open(struct fb_info *info, |
603 | + struct inode *inode, |
604 | + struct file *file) |
605 | +{ |
606 | + file->f_mapping->a_ops = &fb_deferred_io_aops; |
607 | +} |
608 | +EXPORT_SYMBOL_GPL(fb_deferred_io_open); |
609 | + |
610 | void fb_deferred_io_cleanup(struct fb_info *info) |
611 | { |
612 | void *screen_base = (void __force *) info->screen_base; |
613 | diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c |
614 | index 776f7fc..ce6b5da 100644 |
615 | --- a/drivers/video/fbmem.c |
616 | +++ b/drivers/video/fbmem.c |
617 | @@ -1340,6 +1340,10 @@ fb_open(struct inode *inode, struct file *file) |
618 | if (res) |
619 | module_put(info->fbops->owner); |
620 | } |
621 | +#ifdef CONFIG_FB_DEFERRED_IO |
622 | + if (info->fbdefio) |
623 | + fb_deferred_io_open(info, inode, file); |
624 | +#endif |
625 | return res; |
626 | } |
627 | |
628 | diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c |
629 | index 7191306..a0a7157 100644 |
630 | --- a/fs/binfmt_misc.c |
631 | +++ b/fs/binfmt_misc.c |
632 | @@ -119,8 +119,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs) |
633 | if (bprm->misc_bang) |
634 | goto _ret; |
635 | |
636 | - bprm->misc_bang = 1; |
637 | - |
638 | /* to keep locking time low, we copy the interpreter string */ |
639 | read_lock(&entries_lock); |
640 | fmt = check_file(bprm); |
641 | @@ -198,6 +196,8 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs) |
642 | if (retval < 0) |
643 | goto _error; |
644 | |
645 | + bprm->misc_bang = 1; |
646 | + |
647 | retval = search_binary_handler (bprm, regs); |
648 | if (retval < 0) |
649 | goto _error; |
650 | diff --git a/fs/bio.c b/fs/bio.c |
651 | index 7856257..7db618c 100644 |
652 | --- a/fs/bio.c |
653 | +++ b/fs/bio.c |
654 | @@ -464,20 +464,21 @@ static void bio_free_map_data(struct bio_map_data *bmd) |
655 | kfree(bmd); |
656 | } |
657 | |
658 | -static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count) |
659 | +static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count, |
660 | + gfp_t gfp_mask) |
661 | { |
662 | - struct bio_map_data *bmd = kmalloc(sizeof(*bmd), GFP_KERNEL); |
663 | + struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask); |
664 | |
665 | if (!bmd) |
666 | return NULL; |
667 | |
668 | - bmd->iovecs = kmalloc(sizeof(struct bio_vec) * nr_segs, GFP_KERNEL); |
669 | + bmd->iovecs = kmalloc(sizeof(struct bio_vec) * nr_segs, gfp_mask); |
670 | if (!bmd->iovecs) { |
671 | kfree(bmd); |
672 | return NULL; |
673 | } |
674 | |
675 | - bmd->sgvecs = kmalloc(sizeof(struct sg_iovec) * iov_count, GFP_KERNEL); |
676 | + bmd->sgvecs = kmalloc(sizeof(struct sg_iovec) * iov_count, gfp_mask); |
677 | if (bmd->sgvecs) |
678 | return bmd; |
679 | |
680 | @@ -486,8 +487,8 @@ static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count) |
681 | return NULL; |
682 | } |
683 | |
684 | -static int __bio_copy_iov(struct bio *bio, struct sg_iovec *iov, int iov_count, |
685 | - int uncopy) |
686 | +static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs, |
687 | + struct sg_iovec *iov, int iov_count, int uncopy) |
688 | { |
689 | int ret = 0, i; |
690 | struct bio_vec *bvec; |
691 | @@ -497,7 +498,7 @@ static int __bio_copy_iov(struct bio *bio, struct sg_iovec *iov, int iov_count, |
692 | |
693 | __bio_for_each_segment(bvec, bio, i, 0) { |
694 | char *bv_addr = page_address(bvec->bv_page); |
695 | - unsigned int bv_len = bvec->bv_len; |
696 | + unsigned int bv_len = iovecs[i].bv_len; |
697 | |
698 | while (bv_len && iov_idx < iov_count) { |
699 | unsigned int bytes; |
700 | @@ -549,7 +550,7 @@ int bio_uncopy_user(struct bio *bio) |
701 | struct bio_map_data *bmd = bio->bi_private; |
702 | int ret; |
703 | |
704 | - ret = __bio_copy_iov(bio, bmd->sgvecs, bmd->nr_sgvecs, 1); |
705 | + ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs, bmd->nr_sgvecs, 1); |
706 | |
707 | bio_free_map_data(bmd); |
708 | bio_put(bio); |
709 | @@ -591,7 +592,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, struct sg_iovec *iov, |
710 | len += iov[i].iov_len; |
711 | } |
712 | |
713 | - bmd = bio_alloc_map_data(nr_pages, iov_count); |
714 | + bmd = bio_alloc_map_data(nr_pages, iov_count, GFP_KERNEL); |
715 | if (!bmd) |
716 | return ERR_PTR(-ENOMEM); |
717 | |
718 | @@ -628,7 +629,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, struct sg_iovec *iov, |
719 | * success |
720 | */ |
721 | if (!write_to_vm) { |
722 | - ret = __bio_copy_iov(bio, iov, iov_count, 0); |
723 | + ret = __bio_copy_iov(bio, bio->bi_io_vec, iov, iov_count, 0); |
724 | if (ret) |
725 | goto cleanup; |
726 | } |
727 | @@ -941,19 +942,22 @@ static void bio_copy_kern_endio(struct bio *bio, int err) |
728 | { |
729 | struct bio_vec *bvec; |
730 | const int read = bio_data_dir(bio) == READ; |
731 | - char *p = bio->bi_private; |
732 | + struct bio_map_data *bmd = bio->bi_private; |
733 | int i; |
734 | + char *p = bmd->sgvecs[0].iov_base; |
735 | |
736 | __bio_for_each_segment(bvec, bio, i, 0) { |
737 | char *addr = page_address(bvec->bv_page); |
738 | + int len = bmd->iovecs[i].bv_len; |
739 | |
740 | if (read && !err) |
741 | - memcpy(p, addr, bvec->bv_len); |
742 | + memcpy(p, addr, len); |
743 | |
744 | __free_page(bvec->bv_page); |
745 | - p += bvec->bv_len; |
746 | + p += len; |
747 | } |
748 | |
749 | + bio_free_map_data(bmd); |
750 | bio_put(bio); |
751 | } |
752 | |
753 | @@ -977,11 +981,21 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len, |
754 | const int nr_pages = end - start; |
755 | struct bio *bio; |
756 | struct bio_vec *bvec; |
757 | + struct bio_map_data *bmd; |
758 | int i, ret; |
759 | + struct sg_iovec iov; |
760 | + |
761 | + iov.iov_base = data; |
762 | + iov.iov_len = len; |
763 | + |
764 | + bmd = bio_alloc_map_data(nr_pages, 1, gfp_mask); |
765 | + if (!bmd) |
766 | + return ERR_PTR(-ENOMEM); |
767 | |
768 | + ret = -ENOMEM; |
769 | bio = bio_alloc(gfp_mask, nr_pages); |
770 | if (!bio) |
771 | - return ERR_PTR(-ENOMEM); |
772 | + goto out_bmd; |
773 | |
774 | while (len) { |
775 | struct page *page; |
776 | @@ -1015,14 +1029,18 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len, |
777 | } |
778 | } |
779 | |
780 | - bio->bi_private = data; |
781 | + bio->bi_private = bmd; |
782 | bio->bi_end_io = bio_copy_kern_endio; |
783 | + |
784 | + bio_set_map_data(bmd, bio, &iov, 1); |
785 | return bio; |
786 | cleanup: |
787 | bio_for_each_segment(bvec, bio, i) |
788 | __free_page(bvec->bv_page); |
789 | |
790 | bio_put(bio); |
791 | +out_bmd: |
792 | + bio_free_map_data(bmd); |
793 | |
794 | return ERR_PTR(ret); |
795 | } |
796 | diff --git a/fs/cifs/file.c b/fs/cifs/file.c |
797 | index 0aac824..8da903b 100644 |
798 | --- a/fs/cifs/file.c |
799 | +++ b/fs/cifs/file.c |
800 | @@ -832,6 +832,10 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data, |
801 | return -EBADF; |
802 | open_file = (struct cifsFileInfo *) file->private_data; |
803 | |
804 | + rc = generic_write_checks(file, poffset, &write_size, 0); |
805 | + if (rc) |
806 | + return rc; |
807 | + |
808 | xid = GetXid(); |
809 | |
810 | if (*poffset > file->f_path.dentry->d_inode->i_size) |
811 | diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c |
812 | index 0c3b618..f40423e 100644 |
813 | --- a/fs/cramfs/inode.c |
814 | +++ b/fs/cramfs/inode.c |
815 | @@ -43,58 +43,13 @@ static DEFINE_MUTEX(read_mutex); |
816 | static int cramfs_iget5_test(struct inode *inode, void *opaque) |
817 | { |
818 | struct cramfs_inode *cramfs_inode = opaque; |
819 | - |
820 | - if (inode->i_ino != CRAMINO(cramfs_inode)) |
821 | - return 0; /* does not match */ |
822 | - |
823 | - if (inode->i_ino != 1) |
824 | - return 1; |
825 | - |
826 | - /* all empty directories, char, block, pipe, and sock, share inode #1 */ |
827 | - |
828 | - if ((inode->i_mode != cramfs_inode->mode) || |
829 | - (inode->i_gid != cramfs_inode->gid) || |
830 | - (inode->i_uid != cramfs_inode->uid)) |
831 | - return 0; /* does not match */ |
832 | - |
833 | - if ((S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) && |
834 | - (inode->i_rdev != old_decode_dev(cramfs_inode->size))) |
835 | - return 0; /* does not match */ |
836 | - |
837 | - return 1; /* matches */ |
838 | + return inode->i_ino == CRAMINO(cramfs_inode) && inode->i_ino != 1; |
839 | } |
840 | |
841 | static int cramfs_iget5_set(struct inode *inode, void *opaque) |
842 | { |
843 | - static struct timespec zerotime; |
844 | struct cramfs_inode *cramfs_inode = opaque; |
845 | - inode->i_mode = cramfs_inode->mode; |
846 | - inode->i_uid = cramfs_inode->uid; |
847 | - inode->i_size = cramfs_inode->size; |
848 | - inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1; |
849 | - inode->i_gid = cramfs_inode->gid; |
850 | - /* Struct copy intentional */ |
851 | - inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime; |
852 | inode->i_ino = CRAMINO(cramfs_inode); |
853 | - /* inode->i_nlink is left 1 - arguably wrong for directories, |
854 | - but it's the best we can do without reading the directory |
855 | - contents. 1 yields the right result in GNU find, even |
856 | - without -noleaf option. */ |
857 | - if (S_ISREG(inode->i_mode)) { |
858 | - inode->i_fop = &generic_ro_fops; |
859 | - inode->i_data.a_ops = &cramfs_aops; |
860 | - } else if (S_ISDIR(inode->i_mode)) { |
861 | - inode->i_op = &cramfs_dir_inode_operations; |
862 | - inode->i_fop = &cramfs_directory_operations; |
863 | - } else if (S_ISLNK(inode->i_mode)) { |
864 | - inode->i_op = &page_symlink_inode_operations; |
865 | - inode->i_data.a_ops = &cramfs_aops; |
866 | - } else { |
867 | - inode->i_size = 0; |
868 | - inode->i_blocks = 0; |
869 | - init_special_inode(inode, inode->i_mode, |
870 | - old_decode_dev(cramfs_inode->size)); |
871 | - } |
872 | return 0; |
873 | } |
874 | |
875 | @@ -104,12 +59,48 @@ static struct inode *get_cramfs_inode(struct super_block *sb, |
876 | struct inode *inode = iget5_locked(sb, CRAMINO(cramfs_inode), |
877 | cramfs_iget5_test, cramfs_iget5_set, |
878 | cramfs_inode); |
879 | + static struct timespec zerotime; |
880 | + |
881 | if (inode && (inode->i_state & I_NEW)) { |
882 | + inode->i_mode = cramfs_inode->mode; |
883 | + inode->i_uid = cramfs_inode->uid; |
884 | + inode->i_size = cramfs_inode->size; |
885 | + inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1; |
886 | + inode->i_gid = cramfs_inode->gid; |
887 | + /* Struct copy intentional */ |
888 | + inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime; |
889 | + /* inode->i_nlink is left 1 - arguably wrong for directories, |
890 | + but it's the best we can do without reading the directory |
891 | + contents. 1 yields the right result in GNU find, even |
892 | + without -noleaf option. */ |
893 | + if (S_ISREG(inode->i_mode)) { |
894 | + inode->i_fop = &generic_ro_fops; |
895 | + inode->i_data.a_ops = &cramfs_aops; |
896 | + } else if (S_ISDIR(inode->i_mode)) { |
897 | + inode->i_op = &cramfs_dir_inode_operations; |
898 | + inode->i_fop = &cramfs_directory_operations; |
899 | + } else if (S_ISLNK(inode->i_mode)) { |
900 | + inode->i_op = &page_symlink_inode_operations; |
901 | + inode->i_data.a_ops = &cramfs_aops; |
902 | + } else { |
903 | + inode->i_size = 0; |
904 | + inode->i_blocks = 0; |
905 | + init_special_inode(inode, inode->i_mode, |
906 | + old_decode_dev(cramfs_inode->size)); |
907 | + } |
908 | unlock_new_inode(inode); |
909 | } |
910 | return inode; |
911 | } |
912 | |
913 | +static void cramfs_drop_inode(struct inode *inode) |
914 | +{ |
915 | + if (inode->i_ino == 1) |
916 | + generic_delete_inode(inode); |
917 | + else |
918 | + generic_drop_inode(inode); |
919 | +} |
920 | + |
921 | /* |
922 | * We have our own block cache: don't fill up the buffer cache |
923 | * with the rom-image, because the way the filesystem is set |
924 | @@ -534,6 +525,7 @@ static const struct super_operations cramfs_ops = { |
925 | .put_super = cramfs_put_super, |
926 | .remount_fs = cramfs_remount, |
927 | .statfs = cramfs_statfs, |
928 | + .drop_inode = cramfs_drop_inode, |
929 | }; |
930 | |
931 | static int cramfs_get_sb(struct file_system_type *fs_type, |
932 | diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c |
933 | index b6ed383..54b8b41 100644 |
934 | --- a/fs/nfsd/nfs4acl.c |
935 | +++ b/fs/nfsd/nfs4acl.c |
936 | @@ -443,7 +443,7 @@ init_state(struct posix_acl_state *state, int cnt) |
937 | * enough space for either: |
938 | */ |
939 | alloc = sizeof(struct posix_ace_state_array) |
940 | - + cnt*sizeof(struct posix_ace_state); |
941 | + + cnt*sizeof(struct posix_user_ace_state); |
942 | state->users = kzalloc(alloc, GFP_KERNEL); |
943 | if (!state->users) |
944 | return -ENOMEM; |
945 | diff --git a/include/linux/Kbuild b/include/linux/Kbuild |
946 | index 71d70d1..27af0b8 100644 |
947 | --- a/include/linux/Kbuild |
948 | +++ b/include/linux/Kbuild |
949 | @@ -293,7 +293,6 @@ unifdef-y += parport.h |
950 | unifdef-y += patchkey.h |
951 | unifdef-y += pci.h |
952 | unifdef-y += personality.h |
953 | -unifdef-y += pim.h |
954 | unifdef-y += pktcdvd.h |
955 | unifdef-y += pmu.h |
956 | unifdef-y += poll.h |
957 | diff --git a/include/linux/fb.h b/include/linux/fb.h |
958 | index 72295b0..dd82c76 100644 |
959 | --- a/include/linux/fb.h |
960 | +++ b/include/linux/fb.h |
961 | @@ -973,6 +973,9 @@ static inline void __fb_pad_aligned_buffer(u8 *dst, u32 d_pitch, |
962 | |
963 | /* drivers/video/fb_defio.c */ |
964 | extern void fb_deferred_io_init(struct fb_info *info); |
965 | +extern void fb_deferred_io_open(struct fb_info *info, |
966 | + struct inode *inode, |
967 | + struct file *file); |
968 | extern void fb_deferred_io_cleanup(struct fb_info *info); |
969 | extern int fb_deferred_io_fsync(struct file *file, struct dentry *dentry, |
970 | int datasync); |
971 | diff --git a/include/linux/mroute.h b/include/linux/mroute.h |
972 | index de4decf..35a8277 100644 |
973 | --- a/include/linux/mroute.h |
974 | +++ b/include/linux/mroute.h |
975 | @@ -2,11 +2,7 @@ |
976 | #define __LINUX_MROUTE_H |
977 | |
978 | #include <linux/sockios.h> |
979 | -#include <linux/types.h> |
980 | -#ifdef __KERNEL__ |
981 | #include <linux/in.h> |
982 | -#endif |
983 | -#include <linux/pim.h> |
984 | |
985 | /* |
986 | * Based on the MROUTING 3.5 defines primarily to keep |
987 | @@ -214,6 +210,27 @@ struct mfc_cache |
988 | #define IGMPMSG_WHOLEPKT 3 /* For PIM Register processing */ |
989 | |
990 | #ifdef __KERNEL__ |
991 | + |
992 | +#define PIM_V1_VERSION __constant_htonl(0x10000000) |
993 | +#define PIM_V1_REGISTER 1 |
994 | + |
995 | +#define PIM_VERSION 2 |
996 | +#define PIM_REGISTER 1 |
997 | + |
998 | +#define PIM_NULL_REGISTER __constant_htonl(0x40000000) |
999 | + |
1000 | +/* PIMv2 register message header layout (ietf-draft-idmr-pimvsm-v2-00.ps */ |
1001 | + |
1002 | +struct pimreghdr |
1003 | +{ |
1004 | + __u8 type; |
1005 | + __u8 reserved; |
1006 | + __be16 csum; |
1007 | + __be32 flags; |
1008 | +}; |
1009 | + |
1010 | +extern int pim_rcv_v1(struct sk_buff *); |
1011 | + |
1012 | struct rtmsg; |
1013 | extern int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait); |
1014 | #endif |
1015 | diff --git a/include/linux/pim.h b/include/linux/pim.h |
1016 | deleted file mode 100644 |
1017 | index 236ffd3..0000000 |
1018 | --- a/include/linux/pim.h |
1019 | +++ /dev/null |
1020 | @@ -1,45 +0,0 @@ |
1021 | -#ifndef __LINUX_PIM_H |
1022 | -#define __LINUX_PIM_H |
1023 | - |
1024 | -#include <asm/byteorder.h> |
1025 | - |
1026 | -#ifndef __KERNEL__ |
1027 | -struct pim { |
1028 | -#if defined(__LITTLE_ENDIAN_BITFIELD) |
1029 | - __u8 pim_type:4, /* PIM message type */ |
1030 | - pim_ver:4; /* PIM version */ |
1031 | -#elif defined(__BIG_ENDIAN_BITFIELD) |
1032 | - __u8 pim_ver:4; /* PIM version */ |
1033 | - pim_type:4; /* PIM message type */ |
1034 | -#endif |
1035 | - __u8 pim_rsv; /* Reserved */ |
1036 | - __be16 pim_cksum; /* Checksum */ |
1037 | -}; |
1038 | - |
1039 | -#define PIM_MINLEN 8 |
1040 | -#endif |
1041 | - |
1042 | -/* Message types - V1 */ |
1043 | -#define PIM_V1_VERSION __constant_htonl(0x10000000) |
1044 | -#define PIM_V1_REGISTER 1 |
1045 | - |
1046 | -/* Message types - V2 */ |
1047 | -#define PIM_VERSION 2 |
1048 | -#define PIM_REGISTER 1 |
1049 | - |
1050 | -#if defined(__KERNEL__) |
1051 | -#define PIM_NULL_REGISTER __constant_htonl(0x40000000) |
1052 | - |
1053 | -/* PIMv2 register message header layout (ietf-draft-idmr-pimvsm-v2-00.ps */ |
1054 | -struct pimreghdr |
1055 | -{ |
1056 | - __u8 type; |
1057 | - __u8 reserved; |
1058 | - __be16 csum; |
1059 | - __be32 flags; |
1060 | -}; |
1061 | - |
1062 | -struct sk_buff; |
1063 | -extern int pim_rcv_v1(struct sk_buff *); |
1064 | -#endif |
1065 | -#endif |
1066 | diff --git a/include/net/addrconf.h b/include/net/addrconf.h |
1067 | index bbd3d58..99ca7cd 100644 |
1068 | --- a/include/net/addrconf.h |
1069 | +++ b/include/net/addrconf.h |
1070 | @@ -80,7 +80,8 @@ extern struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, |
1071 | struct net_device *dev, |
1072 | int strict); |
1073 | |
1074 | -extern int ipv6_dev_get_saddr(struct net_device *dev, |
1075 | +extern int ipv6_dev_get_saddr(struct net *net, |
1076 | + struct net_device *dev, |
1077 | const struct in6_addr *daddr, |
1078 | unsigned int srcprefs, |
1079 | struct in6_addr *saddr); |
1080 | diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h |
1081 | index 9313491..03462e5 100644 |
1082 | --- a/include/net/ip6_route.h |
1083 | +++ b/include/net/ip6_route.h |
1084 | @@ -112,6 +112,7 @@ struct rt6_rtnl_dump_arg |
1085 | { |
1086 | struct sk_buff *skb; |
1087 | struct netlink_callback *cb; |
1088 | + struct net *net; |
1089 | }; |
1090 | |
1091 | extern int rt6_dump_route(struct rt6_info *rt, void *p_arg); |
1092 | diff --git a/mm/page_alloc.c b/mm/page_alloc.c |
1093 | index f32fae3..0d520dc 100644 |
1094 | --- a/mm/page_alloc.c |
1095 | +++ b/mm/page_alloc.c |
1096 | @@ -693,6 +693,9 @@ int move_freepages(struct zone *zone, |
1097 | #endif |
1098 | |
1099 | for (page = start_page; page <= end_page;) { |
1100 | + /* Make sure we are not inadvertently changing nodes */ |
1101 | + VM_BUG_ON(page_to_nid(page) != zone_to_nid(zone)); |
1102 | + |
1103 | if (!pfn_valid_within(page_to_pfn(page))) { |
1104 | page++; |
1105 | continue; |
1106 | @@ -2475,6 +2478,10 @@ static void setup_zone_migrate_reserve(struct zone *zone) |
1107 | continue; |
1108 | page = pfn_to_page(pfn); |
1109 | |
1110 | + /* Watch out for overlapping nodes */ |
1111 | + if (page_to_nid(page) != zone_to_nid(zone)) |
1112 | + continue; |
1113 | + |
1114 | /* Blocks with reserved pages will never free, skip them. */ |
1115 | if (PageReserved(page)) |
1116 | continue; |
1117 | diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c |
1118 | index f597987..f288fc4 100644 |
1119 | --- a/net/ax25/sysctl_net_ax25.c |
1120 | +++ b/net/ax25/sysctl_net_ax25.c |
1121 | @@ -36,6 +36,7 @@ static struct ctl_path ax25_path[] = { |
1122 | { .procname = "ax25", .ctl_name = NET_AX25, }, |
1123 | { } |
1124 | }; |
1125 | + |
1126 | static const ctl_table ax25_param_table[] = { |
1127 | { |
1128 | .ctl_name = NET_AX25_IP_DEFAULT_MODE, |
1129 | @@ -167,6 +168,7 @@ static const ctl_table ax25_param_table[] = { |
1130 | .extra1 = &min_proto, |
1131 | .extra2 = &max_proto |
1132 | }, |
1133 | +#ifdef CONFIG_AX25_DAMA_SLAVE |
1134 | { |
1135 | .ctl_name = NET_AX25_DAMA_SLAVE_TIMEOUT, |
1136 | .procname = "dama_slave_timeout", |
1137 | @@ -177,6 +179,8 @@ static const ctl_table ax25_param_table[] = { |
1138 | .extra1 = &min_ds_timeout, |
1139 | .extra2 = &max_ds_timeout |
1140 | }, |
1141 | +#endif |
1142 | + |
1143 | { .ctl_name = 0 } /* that's all, folks! */ |
1144 | }; |
1145 | |
1146 | @@ -210,16 +214,6 @@ void ax25_register_sysctl(void) |
1147 | ax25_table[n].procname = ax25_dev->dev->name; |
1148 | ax25_table[n].mode = 0555; |
1149 | |
1150 | -#ifndef CONFIG_AX25_DAMA_SLAVE |
1151 | - /* |
1152 | - * We do not wish to have a representation of this parameter |
1153 | - * in /proc/sys/ when configured *not* to include the |
1154 | - * AX.25 DAMA slave code, do we? |
1155 | - */ |
1156 | - |
1157 | - child[AX25_VALUES_DS_TIMEOUT].procname = NULL; |
1158 | -#endif |
1159 | - |
1160 | child[AX25_MAX_VALUES].ctl_name = 0; /* just in case... */ |
1161 | |
1162 | for (k = 0; k < AX25_MAX_VALUES; k++) |
1163 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c |
1164 | index 9f3f7ba..b6e7ec0 100644 |
1165 | --- a/net/ipv4/udp.c |
1166 | +++ b/net/ipv4/udp.c |
1167 | @@ -988,7 +988,9 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb) |
1168 | up->encap_rcv != NULL) { |
1169 | int ret; |
1170 | |
1171 | + bh_unlock_sock(sk); |
1172 | ret = (*up->encap_rcv)(sk, skb); |
1173 | + bh_lock_sock(sk); |
1174 | if (ret <= 0) { |
1175 | UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, |
1176 | is_udplite); |
1177 | @@ -1087,7 +1089,7 @@ static int __udp4_lib_mcast_deliver(struct sk_buff *skb, |
1178 | if (skb1) { |
1179 | int ret = 0; |
1180 | |
1181 | - bh_lock_sock_nested(sk); |
1182 | + bh_lock_sock(sk); |
1183 | if (!sock_owned_by_user(sk)) |
1184 | ret = udp_queue_rcv_skb(sk, skb1); |
1185 | else |
1186 | @@ -1187,7 +1189,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[], |
1187 | |
1188 | if (sk != NULL) { |
1189 | int ret = 0; |
1190 | - bh_lock_sock_nested(sk); |
1191 | + bh_lock_sock(sk); |
1192 | if (!sock_owned_by_user(sk)) |
1193 | ret = udp_queue_rcv_skb(sk, skb); |
1194 | else |
1195 | diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c |
1196 | index ff61a5c..1a1d494 100644 |
1197 | --- a/net/ipv6/addrconf.c |
1198 | +++ b/net/ipv6/addrconf.c |
1199 | @@ -1076,13 +1076,12 @@ out: |
1200 | return ret; |
1201 | } |
1202 | |
1203 | -int ipv6_dev_get_saddr(struct net_device *dst_dev, |
1204 | +int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev, |
1205 | const struct in6_addr *daddr, unsigned int prefs, |
1206 | struct in6_addr *saddr) |
1207 | { |
1208 | struct ipv6_saddr_score scores[2], |
1209 | *score = &scores[0], *hiscore = &scores[1]; |
1210 | - struct net *net = dev_net(dst_dev); |
1211 | struct ipv6_saddr_dst dst; |
1212 | struct net_device *dev; |
1213 | int dst_type; |
1214 | diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c |
1215 | index 8d05527..f5de3f9 100644 |
1216 | --- a/net/ipv6/fib6_rules.c |
1217 | +++ b/net/ipv6/fib6_rules.c |
1218 | @@ -93,7 +93,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp, |
1219 | if (flags & RT6_LOOKUP_F_SRCPREF_COA) |
1220 | srcprefs |= IPV6_PREFER_SRC_COA; |
1221 | |
1222 | - if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev, |
1223 | + if (ipv6_dev_get_saddr(net, |
1224 | + ip6_dst_idev(&rt->u.dst)->dev, |
1225 | &flp->fl6_dst, srcprefs, |
1226 | &saddr)) |
1227 | goto again; |
1228 | diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c |
1229 | index 918fde4..fe80171 100644 |
1230 | --- a/net/ipv6/ip6_fib.c |
1231 | +++ b/net/ipv6/ip6_fib.c |
1232 | @@ -380,6 +380,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb) |
1233 | |
1234 | arg.skb = skb; |
1235 | arg.cb = cb; |
1236 | + arg.net = net; |
1237 | w->args = &arg; |
1238 | |
1239 | for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) { |
1240 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c |
1241 | index 4019770..d99f094 100644 |
1242 | --- a/net/ipv6/ip6_output.c |
1243 | +++ b/net/ipv6/ip6_output.c |
1244 | @@ -925,7 +925,7 @@ static int ip6_dst_lookup_tail(struct sock *sk, |
1245 | goto out_err_release; |
1246 | |
1247 | if (ipv6_addr_any(&fl->fl6_src)) { |
1248 | - err = ipv6_dev_get_saddr(ip6_dst_idev(*dst)->dev, |
1249 | + err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev, |
1250 | &fl->fl6_dst, |
1251 | sk ? inet6_sk(sk)->srcprefs : 0, |
1252 | &fl->fl6_src); |
1253 | diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c |
1254 | index 282fdb3..efa84ae 100644 |
1255 | --- a/net/ipv6/ndisc.c |
1256 | +++ b/net/ipv6/ndisc.c |
1257 | @@ -549,7 +549,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh, |
1258 | override = 0; |
1259 | in6_ifa_put(ifp); |
1260 | } else { |
1261 | - if (ipv6_dev_get_saddr(dev, daddr, |
1262 | + if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr, |
1263 | inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs, |
1264 | &tmpaddr)) |
1265 | return; |
1266 | diff --git a/net/ipv6/route.c b/net/ipv6/route.c |
1267 | index 7ff6870..9deee59 100644 |
1268 | --- a/net/ipv6/route.c |
1269 | +++ b/net/ipv6/route.c |
1270 | @@ -2098,7 +2098,8 @@ static inline size_t rt6_nlmsg_size(void) |
1271 | + nla_total_size(sizeof(struct rta_cacheinfo)); |
1272 | } |
1273 | |
1274 | -static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt, |
1275 | +static int rt6_fill_node(struct net *net, |
1276 | + struct sk_buff *skb, struct rt6_info *rt, |
1277 | struct in6_addr *dst, struct in6_addr *src, |
1278 | int iif, int type, u32 pid, u32 seq, |
1279 | int prefix, int nowait, unsigned int flags) |
1280 | @@ -2179,8 +2180,9 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt, |
1281 | #endif |
1282 | NLA_PUT_U32(skb, RTA_IIF, iif); |
1283 | } else if (dst) { |
1284 | + struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst); |
1285 | struct in6_addr saddr_buf; |
1286 | - if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev, |
1287 | + if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL, |
1288 | dst, 0, &saddr_buf) == 0) |
1289 | NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf); |
1290 | } |
1291 | @@ -2225,7 +2227,8 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg) |
1292 | } else |
1293 | prefix = 0; |
1294 | |
1295 | - return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE, |
1296 | + return rt6_fill_node(arg->net, |
1297 | + arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE, |
1298 | NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq, |
1299 | prefix, 0, NLM_F_MULTI); |
1300 | } |
1301 | @@ -2291,7 +2294,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void |
1302 | rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl); |
1303 | skb->dst = &rt->u.dst; |
1304 | |
1305 | - err = rt6_fill_node(skb, rt, &fl.fl6_dst, &fl.fl6_src, iif, |
1306 | + err = rt6_fill_node(net, skb, rt, &fl.fl6_dst, &fl.fl6_src, iif, |
1307 | RTM_NEWROUTE, NETLINK_CB(in_skb).pid, |
1308 | nlh->nlmsg_seq, 0, 0, 0); |
1309 | if (err < 0) { |
1310 | @@ -2318,7 +2321,7 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info) |
1311 | if (skb == NULL) |
1312 | goto errout; |
1313 | |
1314 | - err = rt6_fill_node(skb, rt, NULL, NULL, 0, |
1315 | + err = rt6_fill_node(net, skb, rt, NULL, NULL, 0, |
1316 | event, info->pid, seq, 0, 0, 0); |
1317 | if (err < 0) { |
1318 | /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */ |
1319 | diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c |
1320 | index dd30962..e14aa66 100644 |
1321 | --- a/net/ipv6/udp.c |
1322 | +++ b/net/ipv6/udp.c |
1323 | @@ -376,7 +376,7 @@ static int __udp6_lib_mcast_deliver(struct sk_buff *skb, struct in6_addr *saddr, |
1324 | uh->source, saddr, dif))) { |
1325 | struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC); |
1326 | if (buff) { |
1327 | - bh_lock_sock_nested(sk2); |
1328 | + bh_lock_sock(sk2); |
1329 | if (!sock_owned_by_user(sk2)) |
1330 | udpv6_queue_rcv_skb(sk2, buff); |
1331 | else |
1332 | @@ -384,7 +384,7 @@ static int __udp6_lib_mcast_deliver(struct sk_buff *skb, struct in6_addr *saddr, |
1333 | bh_unlock_sock(sk2); |
1334 | } |
1335 | } |
1336 | - bh_lock_sock_nested(sk); |
1337 | + bh_lock_sock(sk); |
1338 | if (!sock_owned_by_user(sk)) |
1339 | udpv6_queue_rcv_skb(sk, skb); |
1340 | else |
1341 | @@ -502,7 +502,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[], |
1342 | |
1343 | /* deliver */ |
1344 | |
1345 | - bh_lock_sock_nested(sk); |
1346 | + bh_lock_sock(sk); |
1347 | if (!sock_owned_by_user(sk)) |
1348 | udpv6_queue_rcv_skb(sk, skb); |
1349 | else |
1350 | diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c |
1351 | index 8f1e054..08e4cbb 100644 |
1352 | --- a/net/ipv6/xfrm6_policy.c |
1353 | +++ b/net/ipv6/xfrm6_policy.c |
1354 | @@ -52,12 +52,14 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr, |
1355 | static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr) |
1356 | { |
1357 | struct dst_entry *dst; |
1358 | + struct net_device *dev; |
1359 | |
1360 | dst = xfrm6_dst_lookup(0, NULL, daddr); |
1361 | if (IS_ERR(dst)) |
1362 | return -EHOSTUNREACH; |
1363 | |
1364 | - ipv6_dev_get_saddr(ip6_dst_idev(dst)->dev, |
1365 | + dev = ip6_dst_idev(dst)->dev; |
1366 | + ipv6_dev_get_saddr(dev_net(dev), dev, |
1367 | (struct in6_addr *)&daddr->a6, 0, |
1368 | (struct in6_addr *)&saddr->a6); |
1369 | dst_release(dst); |
1370 | diff --git a/net/sched/act_api.c b/net/sched/act_api.c |
1371 | index 74e662c..b5e116c 100644 |
1372 | --- a/net/sched/act_api.c |
1373 | +++ b/net/sched/act_api.c |
1374 | @@ -205,10 +205,9 @@ struct tcf_common *tcf_hash_check(u32 index, struct tc_action *a, int bind, |
1375 | { |
1376 | struct tcf_common *p = NULL; |
1377 | if (index && (p = tcf_hash_lookup(index, hinfo)) != NULL) { |
1378 | - if (bind) { |
1379 | + if (bind) |
1380 | p->tcfc_bindcnt++; |
1381 | - p->tcfc_refcnt++; |
1382 | - } |
1383 | + p->tcfc_refcnt++; |
1384 | a->priv = p; |
1385 | } |
1386 | return p; |
1387 | diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c |
1388 | index 3fb58f4..51c3f68 100644 |
1389 | --- a/net/sched/sch_htb.c |
1390 | +++ b/net/sched/sch_htb.c |
1391 | @@ -595,11 +595,13 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch) |
1392 | kfree_skb(skb); |
1393 | return ret; |
1394 | #endif |
1395 | - } else if (cl->un.leaf.q->enqueue(skb, cl->un.leaf.q) != |
1396 | + } else if ((ret = cl->un.leaf.q->enqueue(skb, cl->un.leaf.q)) != |
1397 | NET_XMIT_SUCCESS) { |
1398 | - sch->qstats.drops++; |
1399 | - cl->qstats.drops++; |
1400 | - return NET_XMIT_DROP; |
1401 | + if (ret == NET_XMIT_DROP) { |
1402 | + sch->qstats.drops++; |
1403 | + cl->qstats.drops++; |
1404 | + } |
1405 | + return ret; |
1406 | } else { |
1407 | cl->bstats.packets += |
1408 | skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1; |
1409 | @@ -639,11 +641,13 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch) |
1410 | kfree_skb(skb); |
1411 | return ret; |
1412 | #endif |
1413 | - } else if (cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q) != |
1414 | + } else if ((ret = cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q)) != |
1415 | NET_XMIT_SUCCESS) { |
1416 | - sch->qstats.drops++; |
1417 | - cl->qstats.drops++; |
1418 | - return NET_XMIT_DROP; |
1419 | + if (ret == NET_XMIT_DROP) { |
1420 | + sch->qstats.drops++; |
1421 | + cl->qstats.drops++; |
1422 | + } |
1423 | + return ret; |
1424 | } else |
1425 | htb_activate(q, cl); |
1426 | |
1427 | diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c |
1428 | index 5532f10..ec0c921 100644 |
1429 | --- a/net/sched/sch_prio.c |
1430 | +++ b/net/sched/sch_prio.c |
1431 | @@ -228,14 +228,20 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt) |
1432 | { |
1433 | struct prio_sched_data *q = qdisc_priv(sch); |
1434 | struct tc_prio_qopt *qopt; |
1435 | - struct nlattr *tb[TCA_PRIO_MAX + 1]; |
1436 | + struct nlattr *tb[TCA_PRIO_MAX + 1] = {0}; |
1437 | int err; |
1438 | int i; |
1439 | |
1440 | - err = nla_parse_nested_compat(tb, TCA_PRIO_MAX, opt, NULL, qopt, |
1441 | - sizeof(*qopt)); |
1442 | - if (err < 0) |
1443 | - return err; |
1444 | + qopt = nla_data(opt); |
1445 | + if (nla_len(opt) < sizeof(*qopt)) |
1446 | + return -1; |
1447 | + |
1448 | + if (nla_len(opt) >= sizeof(*qopt) + sizeof(struct nlattr)) { |
1449 | + err = nla_parse_nested(tb, TCA_PRIO_MAX, |
1450 | + (struct nlattr *) (qopt + 1), NULL); |
1451 | + if (err < 0) |
1452 | + return err; |
1453 | + } |
1454 | |
1455 | q->bands = qopt->bands; |
1456 | /* If we're multiqueue, make sure the number of incoming bands |
1457 | diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c |
1458 | index 0b7d78f..fc6f8f3 100644 |
1459 | --- a/net/sched/sch_tbf.c |
1460 | +++ b/net/sched/sch_tbf.c |
1461 | @@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch) |
1462 | struct tbf_sched_data *q = qdisc_priv(sch); |
1463 | int ret; |
1464 | |
1465 | - if (skb->len > q->max_size) { |
1466 | - sch->qstats.drops++; |
1467 | -#ifdef CONFIG_NET_CLS_ACT |
1468 | - if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch)) |
1469 | -#endif |
1470 | - kfree_skb(skb); |
1471 | - |
1472 | - return NET_XMIT_DROP; |
1473 | - } |
1474 | + if (skb->len > q->max_size) |
1475 | + return qdisc_reshape_fail(skb, sch); |
1476 | |
1477 | if ((ret = q->qdisc->enqueue(skb, q->qdisc)) != 0) { |
1478 | sch->qstats.drops++; |
1479 | diff --git a/net/sctp/auth.c b/net/sctp/auth.c |
1480 | index 675a5c3..52db5f6 100644 |
1481 | --- a/net/sctp/auth.c |
1482 | +++ b/net/sctp/auth.c |
1483 | @@ -80,6 +80,10 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp) |
1484 | { |
1485 | struct sctp_auth_bytes *key; |
1486 | |
1487 | + /* Verify that we are not going to overflow INT_MAX */ |
1488 | + if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes)) |
1489 | + return NULL; |
1490 | + |
1491 | /* Allocate the shared key */ |
1492 | key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp); |
1493 | if (!key) |
1494 | @@ -782,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep, |
1495 | for (i = 0; i < hmacs->shmac_num_idents; i++) { |
1496 | id = hmacs->shmac_idents[i]; |
1497 | |
1498 | + if (id > SCTP_AUTH_HMAC_ID_MAX) |
1499 | + return -EOPNOTSUPP; |
1500 | + |
1501 | if (SCTP_AUTH_HMAC_ID_SHA1 == id) |
1502 | has_sha1 = 1; |
1503 | |
1504 | diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c |
1505 | index e39a0cd..4c8d9f4 100644 |
1506 | --- a/net/sctp/endpointola.c |
1507 | +++ b/net/sctp/endpointola.c |
1508 | @@ -103,6 +103,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, |
1509 | |
1510 | /* Initialize the CHUNKS parameter */ |
1511 | auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS; |
1512 | + auth_chunks->param_hdr.length = htons(sizeof(sctp_paramhdr_t)); |
1513 | |
1514 | /* If the Add-IP functionality is enabled, we must |
1515 | * authenticate, ASCONF and ASCONF-ACK chunks |
1516 | @@ -110,8 +111,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, |
1517 | if (sctp_addip_enable) { |
1518 | auth_chunks->chunks[0] = SCTP_CID_ASCONF; |
1519 | auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK; |
1520 | - auth_chunks->param_hdr.length = |
1521 | - htons(sizeof(sctp_paramhdr_t) + 2); |
1522 | + auth_chunks->param_hdr.length += htons(2); |
1523 | } |
1524 | } |
1525 | |
1526 | diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c |
1527 | index a2f4d4d..38a5d80 100644 |
1528 | --- a/net/sctp/ipv6.c |
1529 | +++ b/net/sctp/ipv6.c |
1530 | @@ -317,7 +317,8 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk, |
1531 | __func__, asoc, dst, NIP6(daddr->v6.sin6_addr)); |
1532 | |
1533 | if (!asoc) { |
1534 | - ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL, |
1535 | + ipv6_dev_get_saddr(sock_net(sctp_opt2sk(sk)), |
1536 | + dst ? ip6_dst_idev(dst)->dev : NULL, |
1537 | &daddr->v6.sin6_addr, |
1538 | inet6_sk(&sk->inet.sk)->srcprefs, |
1539 | &saddr->v6.sin6_addr); |
1540 | diff --git a/net/sctp/socket.c b/net/sctp/socket.c |
1541 | index 0dbcde6..700d27d 100644 |
1542 | --- a/net/sctp/socket.c |
1543 | +++ b/net/sctp/socket.c |
1544 | @@ -2965,6 +2965,9 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk, |
1545 | { |
1546 | struct sctp_authchunk val; |
1547 | |
1548 | + if (!sctp_auth_enable) |
1549 | + return -EACCES; |
1550 | + |
1551 | if (optlen != sizeof(struct sctp_authchunk)) |
1552 | return -EINVAL; |
1553 | if (copy_from_user(&val, optval, optlen)) |
1554 | @@ -2993,8 +2996,12 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, |
1555 | int optlen) |
1556 | { |
1557 | struct sctp_hmacalgo *hmacs; |
1558 | + u32 idents; |
1559 | int err; |
1560 | |
1561 | + if (!sctp_auth_enable) |
1562 | + return -EACCES; |
1563 | + |
1564 | if (optlen < sizeof(struct sctp_hmacalgo)) |
1565 | return -EINVAL; |
1566 | |
1567 | @@ -3007,8 +3014,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, |
1568 | goto out; |
1569 | } |
1570 | |
1571 | - if (hmacs->shmac_num_idents == 0 || |
1572 | - hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) { |
1573 | + idents = hmacs->shmac_num_idents; |
1574 | + if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS || |
1575 | + (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) { |
1576 | err = -EINVAL; |
1577 | goto out; |
1578 | } |
1579 | @@ -3033,6 +3041,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk, |
1580 | struct sctp_association *asoc; |
1581 | int ret; |
1582 | |
1583 | + if (!sctp_auth_enable) |
1584 | + return -EACCES; |
1585 | + |
1586 | if (optlen <= sizeof(struct sctp_authkey)) |
1587 | return -EINVAL; |
1588 | |
1589 | @@ -3045,6 +3056,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk, |
1590 | goto out; |
1591 | } |
1592 | |
1593 | + if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) { |
1594 | + ret = -EINVAL; |
1595 | + goto out; |
1596 | + } |
1597 | + |
1598 | asoc = sctp_id2assoc(sk, authkey->sca_assoc_id); |
1599 | if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) { |
1600 | ret = -EINVAL; |
1601 | @@ -3070,6 +3086,9 @@ static int sctp_setsockopt_active_key(struct sock *sk, |
1602 | struct sctp_authkeyid val; |
1603 | struct sctp_association *asoc; |
1604 | |
1605 | + if (!sctp_auth_enable) |
1606 | + return -EACCES; |
1607 | + |
1608 | if (optlen != sizeof(struct sctp_authkeyid)) |
1609 | return -EINVAL; |
1610 | if (copy_from_user(&val, optval, optlen)) |
1611 | @@ -3095,6 +3114,9 @@ static int sctp_setsockopt_del_key(struct sock *sk, |
1612 | struct sctp_authkeyid val; |
1613 | struct sctp_association *asoc; |
1614 | |
1615 | + if (!sctp_auth_enable) |
1616 | + return -EACCES; |
1617 | + |
1618 | if (optlen != sizeof(struct sctp_authkeyid)) |
1619 | return -EINVAL; |
1620 | if (copy_from_user(&val, optval, optlen)) |
1621 | @@ -5053,19 +5075,29 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len, |
1622 | static int sctp_getsockopt_hmac_ident(struct sock *sk, int len, |
1623 | char __user *optval, int __user *optlen) |
1624 | { |
1625 | + struct sctp_hmacalgo __user *p = (void __user *)optval; |
1626 | struct sctp_hmac_algo_param *hmacs; |
1627 | - __u16 param_len; |
1628 | + __u16 data_len = 0; |
1629 | + u32 num_idents; |
1630 | + |
1631 | + if (!sctp_auth_enable) |
1632 | + return -EACCES; |
1633 | |
1634 | hmacs = sctp_sk(sk)->ep->auth_hmacs_list; |
1635 | - param_len = ntohs(hmacs->param_hdr.length); |
1636 | + data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t); |
1637 | |
1638 | - if (len < param_len) |
1639 | + if (len < sizeof(struct sctp_hmacalgo) + data_len) |
1640 | return -EINVAL; |
1641 | + |
1642 | + len = sizeof(struct sctp_hmacalgo) + data_len; |
1643 | + num_idents = data_len / sizeof(u16); |
1644 | + |
1645 | if (put_user(len, optlen)) |
1646 | return -EFAULT; |
1647 | - if (copy_to_user(optval, hmacs->hmac_ids, len)) |
1648 | + if (put_user(num_idents, &p->shmac_num_idents)) |
1649 | + return -EFAULT; |
1650 | + if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len)) |
1651 | return -EFAULT; |
1652 | - |
1653 | return 0; |
1654 | } |
1655 | |
1656 | @@ -5075,6 +5107,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, |
1657 | struct sctp_authkeyid val; |
1658 | struct sctp_association *asoc; |
1659 | |
1660 | + if (!sctp_auth_enable) |
1661 | + return -EACCES; |
1662 | + |
1663 | if (len < sizeof(struct sctp_authkeyid)) |
1664 | return -EINVAL; |
1665 | if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) |
1666 | @@ -5089,6 +5124,12 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, |
1667 | else |
1668 | val.scact_keynumber = sctp_sk(sk)->ep->active_key_id; |
1669 | |
1670 | + len = sizeof(struct sctp_authkeyid); |
1671 | + if (put_user(len, optlen)) |
1672 | + return -EFAULT; |
1673 | + if (copy_to_user(optval, &val, len)) |
1674 | + return -EFAULT; |
1675 | + |
1676 | return 0; |
1677 | } |
1678 | |
1679 | @@ -5099,13 +5140,16 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, |
1680 | struct sctp_authchunks val; |
1681 | struct sctp_association *asoc; |
1682 | struct sctp_chunks_param *ch; |
1683 | - u32 num_chunks; |
1684 | + u32 num_chunks = 0; |
1685 | char __user *to; |
1686 | |
1687 | - if (len <= sizeof(struct sctp_authchunks)) |
1688 | + if (!sctp_auth_enable) |
1689 | + return -EACCES; |
1690 | + |
1691 | + if (len < sizeof(struct sctp_authchunks)) |
1692 | return -EINVAL; |
1693 | |
1694 | - if (copy_from_user(&val, p, sizeof(struct sctp_authchunks))) |
1695 | + if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) |
1696 | return -EFAULT; |
1697 | |
1698 | to = p->gauth_chunks; |
1699 | @@ -5114,20 +5158,21 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, |
1700 | return -EINVAL; |
1701 | |
1702 | ch = asoc->peer.peer_chunks; |
1703 | + if (!ch) |
1704 | + goto num; |
1705 | |
1706 | /* See if the user provided enough room for all the data */ |
1707 | num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t); |
1708 | if (len < num_chunks) |
1709 | return -EINVAL; |
1710 | |
1711 | - len = num_chunks; |
1712 | - if (put_user(len, optlen)) |
1713 | + if (copy_to_user(to, ch->chunks, num_chunks)) |
1714 | return -EFAULT; |
1715 | +num: |
1716 | + len = sizeof(struct sctp_authchunks) + num_chunks; |
1717 | + if (put_user(len, optlen)) return -EFAULT; |
1718 | if (put_user(num_chunks, &p->gauth_number_of_chunks)) |
1719 | return -EFAULT; |
1720 | - if (copy_to_user(to, ch->chunks, len)) |
1721 | - return -EFAULT; |
1722 | - |
1723 | return 0; |
1724 | } |
1725 | |
1726 | @@ -5138,13 +5183,16 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, |
1727 | struct sctp_authchunks val; |
1728 | struct sctp_association *asoc; |
1729 | struct sctp_chunks_param *ch; |
1730 | - u32 num_chunks; |
1731 | + u32 num_chunks = 0; |
1732 | char __user *to; |
1733 | |
1734 | - if (len <= sizeof(struct sctp_authchunks)) |
1735 | + if (!sctp_auth_enable) |
1736 | + return -EACCES; |
1737 | + |
1738 | + if (len < sizeof(struct sctp_authchunks)) |
1739 | return -EINVAL; |
1740 | |
1741 | - if (copy_from_user(&val, p, sizeof(struct sctp_authchunks))) |
1742 | + if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) |
1743 | return -EFAULT; |
1744 | |
1745 | to = p->gauth_chunks; |
1746 | @@ -5157,17 +5205,21 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, |
1747 | else |
1748 | ch = sctp_sk(sk)->ep->auth_chunk_list; |
1749 | |
1750 | + if (!ch) |
1751 | + goto num; |
1752 | + |
1753 | num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t); |
1754 | - if (len < num_chunks) |
1755 | + if (len < sizeof(struct sctp_authchunks) + num_chunks) |
1756 | return -EINVAL; |
1757 | |
1758 | - len = num_chunks; |
1759 | + if (copy_to_user(to, ch->chunks, num_chunks)) |
1760 | + return -EFAULT; |
1761 | +num: |
1762 | + len = sizeof(struct sctp_authchunks) + num_chunks; |
1763 | if (put_user(len, optlen)) |
1764 | return -EFAULT; |
1765 | if (put_user(num_chunks, &p->gauth_number_of_chunks)) |
1766 | return -EFAULT; |
1767 | - if (copy_to_user(to, ch->chunks, len)) |
1768 | - return -EFAULT; |
1769 | |
1770 | return 0; |
1771 | } |
1772 | diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c |
1773 | index 0f8c439..5231f7a 100644 |
1774 | --- a/net/sunrpc/sysctl.c |
1775 | +++ b/net/sunrpc/sysctl.c |
1776 | @@ -60,24 +60,14 @@ static int proc_do_xprt(ctl_table *table, int write, struct file *file, |
1777 | void __user *buffer, size_t *lenp, loff_t *ppos) |
1778 | { |
1779 | char tmpbuf[256]; |
1780 | - int len; |
1781 | + size_t len; |
1782 | + |
1783 | if ((*ppos && !write) || !*lenp) { |
1784 | *lenp = 0; |
1785 | return 0; |
1786 | } |
1787 | - if (write) |
1788 | - return -EINVAL; |
1789 | - else { |
1790 | - len = svc_print_xprts(tmpbuf, sizeof(tmpbuf)); |
1791 | - if (!access_ok(VERIFY_WRITE, buffer, len)) |
1792 | - return -EFAULT; |
1793 | - |
1794 | - if (__copy_to_user(buffer, tmpbuf, len)) |
1795 | - return -EFAULT; |
1796 | - } |
1797 | - *lenp -= len; |
1798 | - *ppos += len; |
1799 | - return 0; |
1800 | + len = svc_print_xprts(tmpbuf, sizeof(tmpbuf)); |
1801 | + return simple_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len); |
1802 | } |
1803 | |
1804 | static int |
1805 | diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c |
1806 | index 72fddaf..391f456 100644 |
1807 | --- a/net/xfrm/xfrm_state.c |
1808 | +++ b/net/xfrm/xfrm_state.c |
1809 | @@ -780,11 +780,13 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, |
1810 | { |
1811 | unsigned int h; |
1812 | struct hlist_node *entry; |
1813 | - struct xfrm_state *x, *x0; |
1814 | + struct xfrm_state *x, *x0, *to_put; |
1815 | int acquire_in_progress = 0; |
1816 | int error = 0; |
1817 | struct xfrm_state *best = NULL; |
1818 | |
1819 | + to_put = NULL; |
1820 | + |
1821 | spin_lock_bh(&xfrm_state_lock); |
1822 | h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family); |
1823 | hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) { |
1824 | @@ -833,7 +835,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, |
1825 | if (tmpl->id.spi && |
1826 | (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi, |
1827 | tmpl->id.proto, family)) != NULL) { |
1828 | - xfrm_state_put(x0); |
1829 | + to_put = x0; |
1830 | error = -EEXIST; |
1831 | goto out; |
1832 | } |
1833 | @@ -849,7 +851,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, |
1834 | error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid); |
1835 | if (error) { |
1836 | x->km.state = XFRM_STATE_DEAD; |
1837 | - xfrm_state_put(x); |
1838 | + to_put = x; |
1839 | x = NULL; |
1840 | goto out; |
1841 | } |
1842 | @@ -870,7 +872,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, |
1843 | xfrm_hash_grow_check(x->bydst.next != NULL); |
1844 | } else { |
1845 | x->km.state = XFRM_STATE_DEAD; |
1846 | - xfrm_state_put(x); |
1847 | + to_put = x; |
1848 | x = NULL; |
1849 | error = -ESRCH; |
1850 | } |
1851 | @@ -881,6 +883,8 @@ out: |
1852 | else |
1853 | *err = acquire_in_progress ? -EAGAIN : error; |
1854 | spin_unlock_bh(&xfrm_state_lock); |
1855 | + if (to_put) |
1856 | + xfrm_state_put(to_put); |
1857 | return x; |
1858 | } |
1859 | |
1860 | @@ -1067,18 +1071,20 @@ static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq); |
1861 | |
1862 | int xfrm_state_add(struct xfrm_state *x) |
1863 | { |
1864 | - struct xfrm_state *x1; |
1865 | + struct xfrm_state *x1, *to_put; |
1866 | int family; |
1867 | int err; |
1868 | int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); |
1869 | |
1870 | family = x->props.family; |
1871 | |
1872 | + to_put = NULL; |
1873 | + |
1874 | spin_lock_bh(&xfrm_state_lock); |
1875 | |
1876 | x1 = __xfrm_state_locate(x, use_spi, family); |
1877 | if (x1) { |
1878 | - xfrm_state_put(x1); |
1879 | + to_put = x1; |
1880 | x1 = NULL; |
1881 | err = -EEXIST; |
1882 | goto out; |
1883 | @@ -1088,7 +1094,7 @@ int xfrm_state_add(struct xfrm_state *x) |
1884 | x1 = __xfrm_find_acq_byseq(x->km.seq); |
1885 | if (x1 && ((x1->id.proto != x->id.proto) || |
1886 | xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) { |
1887 | - xfrm_state_put(x1); |
1888 | + to_put = x1; |
1889 | x1 = NULL; |
1890 | } |
1891 | } |
1892 | @@ -1110,6 +1116,9 @@ out: |
1893 | xfrm_state_put(x1); |
1894 | } |
1895 | |
1896 | + if (to_put) |
1897 | + xfrm_state_put(to_put); |
1898 | + |
1899 | return err; |
1900 | } |
1901 | EXPORT_SYMBOL(xfrm_state_add); |
1902 | @@ -1269,10 +1278,12 @@ EXPORT_SYMBOL(xfrm_state_migrate); |
1903 | |
1904 | int xfrm_state_update(struct xfrm_state *x) |
1905 | { |
1906 | - struct xfrm_state *x1; |
1907 | + struct xfrm_state *x1, *to_put; |
1908 | int err; |
1909 | int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY); |
1910 | |
1911 | + to_put = NULL; |
1912 | + |
1913 | spin_lock_bh(&xfrm_state_lock); |
1914 | x1 = __xfrm_state_locate(x, use_spi, x->props.family); |
1915 | |
1916 | @@ -1281,7 +1292,7 @@ int xfrm_state_update(struct xfrm_state *x) |
1917 | goto out; |
1918 | |
1919 | if (xfrm_state_kern(x1)) { |
1920 | - xfrm_state_put(x1); |
1921 | + to_put = x1; |
1922 | err = -EEXIST; |
1923 | goto out; |
1924 | } |
1925 | @@ -1295,6 +1306,9 @@ int xfrm_state_update(struct xfrm_state *x) |
1926 | out: |
1927 | spin_unlock_bh(&xfrm_state_lock); |
1928 | |
1929 | + if (to_put) |
1930 | + xfrm_state_put(to_put); |
1931 | + |
1932 | if (err) |
1933 | return err; |
1934 | |
1935 | diff --git a/sound/pci/oxygen/oxygen_mixer.c b/sound/pci/oxygen/oxygen_mixer.c |
1936 | index 6facac5..05eb899 100644 |
1937 | --- a/sound/pci/oxygen/oxygen_mixer.c |
1938 | +++ b/sound/pci/oxygen/oxygen_mixer.c |
1939 | @@ -512,9 +512,12 @@ static int ac97_switch_get(struct snd_kcontrol *ctl, |
1940 | |
1941 | static void mute_ac97_ctl(struct oxygen *chip, unsigned int control) |
1942 | { |
1943 | - unsigned int priv_idx = chip->controls[control]->private_value & 0xff; |
1944 | + unsigned int priv_idx; |
1945 | u16 value; |
1946 | |
1947 | + if (!chip->controls[control]) |
1948 | + return; |
1949 | + priv_idx = chip->controls[control]->private_value & 0xff; |
1950 | value = oxygen_read_ac97(chip, 0, priv_idx); |
1951 | if (!(value & 0x8000)) { |
1952 | oxygen_write_ac97(chip, 0, priv_idx, value | 0x8000); |