Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.26-r1/0103-2.6.26.4-all-fixes.patch

    Contents of /trunk/kernel26-alx/patches-2.6.26-r1/0103-2.6.26.4-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 681 - (show annotations) (download)
    Wed Sep 17 19:42:13 2008 UTC (15 years, 7 months ago) by niro
    File size: 58786 byte(s) 
    -2.6.26-alx-r1
    1 diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
    2 index e289a98..387d3f6 100644
    3 --- a/arch/sparc64/mm/init.c
    4 +++ b/arch/sparc64/mm/init.c
    5 @@ -842,6 +842,9 @@ static unsigned long nid_range(unsigned long start, unsigned long end,
    6 start += PAGE_SIZE;
    7 }
    8
    9 + if (start > end)
    10 + start = end;
    11 +
    12 return start;
    13 }
    14 #else
    15 @@ -1769,8 +1772,7 @@ void __init paging_init(void)
    16
    17 find_ramdisk(phys_base);
    18
    19 - if (cmdline_memory_size)
    20 - lmb_enforce_memory_limit(phys_base + cmdline_memory_size);
    21 + lmb_enforce_memory_limit(cmdline_memory_size);
    22
    23 lmb_analyze();
    24 lmb_dump_all();
    25 @@ -2007,6 +2009,15 @@ void __init mem_init(void)
    26 void free_initmem(void)
    27 {
    28 unsigned long addr, initend;
    29 + int do_free = 1;
    30 +
    31 + /* If the physical memory maps were trimmed by kernel command
    32 + * line options, don't even try freeing this initmem stuff up.
    33 + * The kernel image could have been in the trimmed out region
    34 + * and if so the freeing below will free invalid page structs.
    35 + */
    36 + if (cmdline_memory_size)
    37 + do_free = 0;
    38
    39 /*
    40 * The init section is aligned to 8k in vmlinux.lds. Page align for >8k pagesizes.
    41 @@ -2021,13 +2032,16 @@ void free_initmem(void)
    42 ((unsigned long) __va(kern_base)) -
    43 ((unsigned long) KERNBASE));
    44 memset((void *)addr, POISON_FREE_INITMEM, PAGE_SIZE);
    45 - p = virt_to_page(page);
    46
    47 - ClearPageReserved(p);
    48 - init_page_count(p);
    49 - __free_page(p);
    50 - num_physpages++;
    51 - totalram_pages++;
    52 + if (do_free) {
    53 + p = virt_to_page(page);
    54 +
    55 + ClearPageReserved(p);
    56 + init_page_count(p);
    57 + __free_page(p);
    58 + num_physpages++;
    59 + totalram_pages++;
    60 + }
    61 }
    62 }
    63
    64 diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
    65 index 3fd7a67..e710a21 100644
    66 --- a/arch/x86/kernel/cpu/cyrix.c
    67 +++ b/arch/x86/kernel/cpu/cyrix.c
    68 @@ -134,23 +134,6 @@ static void __cpuinit set_cx86_memwb(void)
    69 setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x14);
    70 }
    71
    72 -static void __cpuinit set_cx86_inc(void)
    73 -{
    74 - unsigned char ccr3;
    75 -
    76 - printk(KERN_INFO "Enable Incrementor on Cyrix/NSC processor.\n");
    77 -
    78 - ccr3 = getCx86(CX86_CCR3);
    79 - setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */
    80 - /* PCR1 -- Performance Control */
    81 - /* Incrementor on, whatever that is */
    82 - setCx86(CX86_PCR1, getCx86(CX86_PCR1) | 0x02);
    83 - /* PCR0 -- Performance Control */
    84 - /* Incrementor Margin 10 */
    85 - setCx86(CX86_PCR0, getCx86(CX86_PCR0) | 0x04);
    86 - setCx86(CX86_CCR3, ccr3); /* disable MAPEN */
    87 -}
    88 -
    89 /*
    90 * Configure later MediaGX and/or Geode processor.
    91 */
    92 @@ -174,7 +157,6 @@ static void __cpuinit geode_configure(void)
    93
    94 set_cx86_memwb();
    95 set_cx86_reorder();
    96 - set_cx86_inc();
    97
    98 local_irq_restore(flags);
    99 }
    100 diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
    101 index 75b14b1..745b974 100644
    102 --- a/arch/x86/kernel/cpu/mtrr/generic.c
    103 +++ b/arch/x86/kernel/cpu/mtrr/generic.c
    104 @@ -365,6 +365,7 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
    105 unsigned long *size, mtrr_type *type)
    106 {
    107 unsigned int mask_lo, mask_hi, base_lo, base_hi;
    108 + unsigned int tmp, hi;
    109
    110 rdmsr(MTRRphysMask_MSR(reg), mask_lo, mask_hi);
    111 if ((mask_lo & 0x800) == 0) {
    112 @@ -378,8 +379,23 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
    113 rdmsr(MTRRphysBase_MSR(reg), base_lo, base_hi);
    114
    115 /* Work out the shifted address mask. */
    116 - mask_lo = size_or_mask | mask_hi << (32 - PAGE_SHIFT)
    117 - | mask_lo >> PAGE_SHIFT;
    118 + tmp = mask_hi << (32 - PAGE_SHIFT) | mask_lo >> PAGE_SHIFT;
    119 + mask_lo = size_or_mask | tmp;
    120 + /* Expand tmp with high bits to all 1s*/
    121 + hi = fls(tmp);
    122 + if (hi > 0) {
    123 + tmp |= ~((1<<(hi - 1)) - 1);
    124 +
    125 + if (tmp != mask_lo) {
    126 + static int once = 1;
    127 +
    128 + if (once) {
    129 + printk(KERN_INFO "mtrr: your BIOS has set up an incorrect mask, fixing it up.\n");
    130 + once = 0;
    131 + }
    132 + mask_lo = tmp;
    133 + }
    134 + }
    135
    136 /* This works correctly if size is a power of two, i.e. a
    137 contiguous range. */
    138 diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
    139 index 934c7b6..d333a74 100644
    140 --- a/arch/x86/kvm/paging_tmpl.h
    141 +++ b/arch/x86/kvm/paging_tmpl.h
    142 @@ -343,7 +343,7 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
    143 shadow_addr = __pa(shadow_page->spt);
    144 shadow_pte = shadow_addr | PT_PRESENT_MASK | PT_ACCESSED_MASK
    145 | PT_WRITABLE_MASK | PT_USER_MASK;
    146 - *shadow_ent = shadow_pte;
    147 + set_shadow_pte(shadow_ent, shadow_pte);
    148 }
    149
    150 mmu_set_spte(vcpu, shadow_ent, access, walker->pte_access & access,
    151 diff --git a/crypto/authenc.c b/crypto/authenc.c
    152 index 4b22676..fd9f06c 100644
    153 --- a/crypto/authenc.c
    154 +++ b/crypto/authenc.c
    155 @@ -174,8 +174,9 @@ static int crypto_authenc_genicv(struct aead_request *req, u8 *iv,
    156 static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
    157 int err)
    158 {
    159 + struct aead_request *areq = req->data;
    160 +
    161 if (!err) {
    162 - struct aead_request *areq = req->data;
    163 struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
    164 struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
    165 struct ablkcipher_request *abreq = aead_request_ctx(areq);
    166 @@ -185,7 +186,7 @@ static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
    167 err = crypto_authenc_genicv(areq, iv, 0);
    168 }
    169
    170 - aead_request_complete(req->data, err);
    171 + aead_request_complete(areq, err);
    172 }
    173
    174 static int crypto_authenc_encrypt(struct aead_request *req)
    175 @@ -216,14 +217,15 @@ static int crypto_authenc_encrypt(struct aead_request *req)
    176 static void crypto_authenc_givencrypt_done(struct crypto_async_request *req,
    177 int err)
    178 {
    179 + struct aead_request *areq = req->data;
    180 +
    181 if (!err) {
    182 - struct aead_request *areq = req->data;
    183 struct skcipher_givcrypt_request *greq = aead_request_ctx(areq);
    184
    185 err = crypto_authenc_genicv(areq, greq->giv, 0);
    186 }
    187
    188 - aead_request_complete(req->data, err);
    189 + aead_request_complete(areq, err);
    190 }
    191
    192 static int crypto_authenc_givencrypt(struct aead_givcrypt_request *req)
    193 diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
    194 index ad169ff..80c655f 100644
    195 --- a/drivers/ata/sata_mv.c
    196 +++ b/drivers/ata/sata_mv.c
    197 @@ -1134,30 +1134,16 @@ static int mv_qc_defer(struct ata_queued_cmd *qc)
    198 if (ap->nr_active_links == 0)
    199 return 0;
    200
    201 - if (pp->pp_flags & MV_PP_FLAG_EDMA_EN) {
    202 - /*
    203 - * The port is operating in host queuing mode (EDMA).
    204 - * It can accomodate a new qc if the qc protocol
    205 - * is compatible with the current host queue mode.
    206 - */
    207 - if (pp->pp_flags & MV_PP_FLAG_NCQ_EN) {
    208 - /*
    209 - * The host queue (EDMA) is in NCQ mode.
    210 - * If the new qc is also an NCQ command,
    211 - * then allow the new qc.
    212 - */
    213 - if (qc->tf.protocol == ATA_PROT_NCQ)
    214 - return 0;
    215 - } else {
    216 - /*
    217 - * The host queue (EDMA) is in non-NCQ, DMA mode.
    218 - * If the new qc is also a non-NCQ, DMA command,
    219 - * then allow the new qc.
    220 - */
    221 - if (qc->tf.protocol == ATA_PROT_DMA)
    222 - return 0;
    223 - }
    224 - }
    225 + /*
    226 + * The port is operating in host queuing mode (EDMA) with NCQ
    227 + * enabled, allow multiple NCQ commands. EDMA also allows
    228 + * queueing multiple DMA commands but libata core currently
    229 + * doesn't allow it.
    230 + */
    231 + if ((pp->pp_flags & MV_PP_FLAG_EDMA_EN) &&
    232 + (pp->pp_flags & MV_PP_FLAG_NCQ_EN) && ata_is_ncq(qc->tf.protocol))
    233 + return 0;
    234 +
    235 return ATA_DEFER_PORT;
    236 }
    237
    238 diff --git a/drivers/char/random.c b/drivers/char/random.c
    239 index 0cf98bd..71320d2 100644
    240 --- a/drivers/char/random.c
    241 +++ b/drivers/char/random.c
    242 @@ -406,7 +406,7 @@ struct entropy_store {
    243 /* read-write data: */
    244 spinlock_t lock;
    245 unsigned add_ptr;
    246 - int entropy_count;
    247 + int entropy_count; /* Must at no time exceed ->POOLBITS! */
    248 int input_rotate;
    249 };
    250
    251 @@ -519,6 +519,7 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
    252 static void credit_entropy_bits(struct entropy_store *r, int nbits)
    253 {
    254 unsigned long flags;
    255 + int entropy_count;
    256
    257 if (!nbits)
    258 return;
    259 @@ -526,20 +527,20 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits)
    260 spin_lock_irqsave(&r->lock, flags);
    261
    262 DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name);
    263 - r->entropy_count += nbits;
    264 - if (r->entropy_count < 0) {
    265 + entropy_count = r->entropy_count;
    266 + entropy_count += nbits;
    267 + if (entropy_count < 0) {
    268 DEBUG_ENT("negative entropy/overflow\n");
    269 - r->entropy_count = 0;
    270 - } else if (r->entropy_count > r->poolinfo->POOLBITS)
    271 - r->entropy_count = r->poolinfo->POOLBITS;
    272 + entropy_count = 0;
    273 + } else if (entropy_count > r->poolinfo->POOLBITS)
    274 + entropy_count = r->poolinfo->POOLBITS;
    275 + r->entropy_count = entropy_count;
    276
    277 /* should we wake readers? */
    278 - if (r == &input_pool &&
    279 - r->entropy_count >= random_read_wakeup_thresh) {
    280 + if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
    281 wake_up_interruptible(&random_read_wait);
    282 kill_fasync(&fasync, SIGIO, POLL_IN);
    283 }
    284 -
    285 spin_unlock_irqrestore(&r->lock, flags);
    286 }
    287
    288 diff --git a/drivers/misc/eeepc-laptop.c b/drivers/misc/eeepc-laptop.c
    289 index 6d72760..3f3abf9 100644
    290 --- a/drivers/misc/eeepc-laptop.c
    291 +++ b/drivers/misc/eeepc-laptop.c
    292 @@ -553,9 +553,9 @@ static void eeepc_hwmon_exit(void)
    293 hwmon = eeepc_hwmon_device;
    294 if (!hwmon)
    295 return ;
    296 - hwmon_device_unregister(hwmon);
    297 sysfs_remove_group(&hwmon->kobj,
    298 &hwmon_attribute_group);
    299 + hwmon_device_unregister(hwmon);
    300 eeepc_hwmon_device = NULL;
    301 }
    302
    303 diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
    304 index 3c798ae..8fe0a49 100644
    305 --- a/drivers/net/atlx/atl1.c
    306 +++ b/drivers/net/atlx/atl1.c
    307 @@ -3019,7 +3019,6 @@ static int __devinit atl1_probe(struct pci_dev *pdev,
    308 netdev->features = NETIF_F_HW_CSUM;
    309 netdev->features |= NETIF_F_SG;
    310 netdev->features |= (NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX);
    311 - netdev->features |= NETIF_F_TSO;
    312 netdev->features |= NETIF_F_LLTX;
    313
    314 /*
    315 diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
    316 index 20d4fe9..1652f10 100644
    317 --- a/drivers/net/forcedeth.c
    318 +++ b/drivers/net/forcedeth.c
    319 @@ -5420,7 +5420,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
    320 if (id->driver_data & DEV_HAS_CHECKSUM) {
    321 np->rx_csum = 1;
    322 np->txrxctl_bits |= NVREG_TXRXCTL_RXCHECK;
    323 - dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
    324 + dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
    325 dev->features |= NETIF_F_TSO;
    326 }
    327
    328 @@ -5728,7 +5728,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
    329
    330 dev_printk(KERN_INFO, &pci_dev->dev, "%s%s%s%s%s%s%s%s%s%sdesc-v%u\n",
    331 dev->features & NETIF_F_HIGHDMA ? "highdma " : "",
    332 - dev->features & (NETIF_F_HW_CSUM | NETIF_F_SG) ?
    333 + dev->features & (NETIF_F_IP_CSUM | NETIF_F_SG) ?
    334 "csum " : "",
    335 dev->features & (NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX) ?
    336 "vlan " : "",
    337 diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
    338 index 42d7c0a..0e4eb15 100644
    339 --- a/drivers/net/r8169.c
    340 +++ b/drivers/net/r8169.c
    341 @@ -2822,7 +2822,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
    342 pkt_size, PCI_DMA_FROMDEVICE);
    343 rtl8169_mark_to_asic(desc, tp->rx_buf_sz);
    344 } else {
    345 - pci_unmap_single(pdev, addr, pkt_size,
    346 + pci_unmap_single(pdev, addr, tp->rx_buf_sz,
    347 PCI_DMA_FROMDEVICE);
    348 tp->Rx_skbuff[entry] = NULL;
    349 }
    350 diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
    351 index cc4bde8..1710e49 100644
    352 --- a/drivers/net/tg3.c
    353 +++ b/drivers/net/tg3.c
    354 @@ -1672,15 +1672,43 @@ static int tg3_set_power_state(struct tg3 *tp, pci_power_t state)
    355 }
    356
    357 /* tp->lock is held. */
    358 +static inline void tg3_generate_fw_event(struct tg3 *tp)
    359 +{
    360 + u32 val;
    361 +
    362 + val = tr32(GRC_RX_CPU_EVENT);
    363 + val |= GRC_RX_CPU_DRIVER_EVENT;
    364 + tw32_f(GRC_RX_CPU_EVENT, val);
    365 +
    366 + tp->last_event_jiffies = jiffies;
    367 +}
    368 +
    369 +#define TG3_FW_EVENT_TIMEOUT_USEC 2500
    370 +
    371 +/* tp->lock is held. */
    372 static void tg3_wait_for_event_ack(struct tg3 *tp)
    373 {
    374 int i;
    375 + unsigned int delay_cnt;
    376 + long time_remain;
    377 +
    378 + /* If enough time has passed, no wait is necessary. */
    379 + time_remain = (long)(tp->last_event_jiffies + 1 +
    380 + usecs_to_jiffies(TG3_FW_EVENT_TIMEOUT_USEC)) -
    381 + (long)jiffies;
    382 + if (time_remain < 0)
    383 + return;
    384
    385 - /* Wait for up to 2.5 milliseconds */
    386 - for (i = 0; i < 250000; i++) {
    387 + /* Check if we can shorten the wait time. */
    388 + delay_cnt = jiffies_to_usecs(time_remain);
    389 + if (delay_cnt > TG3_FW_EVENT_TIMEOUT_USEC)
    390 + delay_cnt = TG3_FW_EVENT_TIMEOUT_USEC;
    391 + delay_cnt = (delay_cnt >> 3) + 1;
    392 +
    393 + for (i = 0; i < delay_cnt; i++) {
    394 if (!(tr32(GRC_RX_CPU_EVENT) & GRC_RX_CPU_DRIVER_EVENT))
    395 break;
    396 - udelay(10);
    397 + udelay(8);
    398 }
    399 }
    400
    401 @@ -1729,9 +1757,7 @@ static void tg3_ump_link_report(struct tg3 *tp)
    402 val = 0;
    403 tg3_write_mem(tp, NIC_SRAM_FW_CMD_DATA_MBOX + 12, val);
    404
    405 - val = tr32(GRC_RX_CPU_EVENT);
    406 - val |= GRC_RX_CPU_DRIVER_EVENT;
    407 - tw32_f(GRC_RX_CPU_EVENT, val);
    408 + tg3_generate_fw_event(tp);
    409 }
    410
    411 static void tg3_link_report(struct tg3 *tp)
    412 @@ -5565,6 +5591,7 @@ static int tg3_chip_reset(struct tg3 *tp)
    413 tg3_read_mem(tp, NIC_SRAM_DATA_CFG, &nic_cfg);
    414 if (nic_cfg & NIC_SRAM_DATA_CFG_ASF_ENABLE) {
    415 tp->tg3_flags |= TG3_FLAG_ENABLE_ASF;
    416 + tp->last_event_jiffies = jiffies;
    417 if (tp->tg3_flags2 & TG3_FLG2_5750_PLUS)
    418 tp->tg3_flags2 |= TG3_FLG2_ASF_NEW_HANDSHAKE;
    419 }
    420 @@ -5578,15 +5605,12 @@ static void tg3_stop_fw(struct tg3 *tp)
    421 {
    422 if ((tp->tg3_flags & TG3_FLAG_ENABLE_ASF) &&
    423 !(tp->tg3_flags3 & TG3_FLG3_ENABLE_APE)) {
    424 - u32 val;
    425 -
    426 /* Wait for RX cpu to ACK the previous event. */
    427 tg3_wait_for_event_ack(tp);
    428
    429 tg3_write_mem(tp, NIC_SRAM_FW_CMD_MBOX, FWCMD_NICDRV_PAUSE_FW);
    430 - val = tr32(GRC_RX_CPU_EVENT);
    431 - val |= GRC_RX_CPU_DRIVER_EVENT;
    432 - tw32(GRC_RX_CPU_EVENT, val);
    433 +
    434 + tg3_generate_fw_event(tp);
    435
    436 /* Wait for RX cpu to ACK this event. */
    437 tg3_wait_for_event_ack(tp);
    438 @@ -7477,8 +7501,6 @@ static void tg3_timer(unsigned long __opaque)
    439 */
    440 if (!--tp->asf_counter) {
    441 if (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) {
    442 - u32 val;
    443 -
    444 tg3_wait_for_event_ack(tp);
    445
    446 tg3_write_mem(tp, NIC_SRAM_FW_CMD_MBOX,
    447 @@ -7486,9 +7508,8 @@ static void tg3_timer(unsigned long __opaque)
    448 tg3_write_mem(tp, NIC_SRAM_FW_CMD_LEN_MBOX, 4);
    449 /* 5 seconds timeout */
    450 tg3_write_mem(tp, NIC_SRAM_FW_CMD_DATA_MBOX, 5);
    451 - val = tr32(GRC_RX_CPU_EVENT);
    452 - val |= GRC_RX_CPU_DRIVER_EVENT;
    453 - tw32_f(GRC_RX_CPU_EVENT, val);
    454 +
    455 + tg3_generate_fw_event(tp);
    456 }
    457 tp->asf_counter = tp->asf_multiplier;
    458 }
    459 diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
    460 index 0404f93..d68b579 100644
    461 --- a/drivers/net/tg3.h
    462 +++ b/drivers/net/tg3.h
    463 @@ -2404,7 +2404,10 @@ struct tg3 {
    464 struct tg3_ethtool_stats estats;
    465 struct tg3_ethtool_stats estats_prev;
    466
    467 + union {
    468 unsigned long phy_crc_errors;
    469 + unsigned long last_event_jiffies;
    470 + };
    471
    472 u32 rx_offset;
    473 u32 tg3_flags;
    474 diff --git a/drivers/pci/search.c b/drivers/pci/search.c
    475 index 217814f..3b3b5f1 100644
    476 --- a/drivers/pci/search.c
    477 +++ b/drivers/pci/search.c
    478 @@ -280,6 +280,8 @@ static struct pci_dev *pci_get_dev_by_id(const struct pci_device_id *id,
    479 match_pci_dev_by_id);
    480 if (dev)
    481 pdev = to_pci_dev(dev);
    482 + if (from)
    483 + pci_dev_put(from);
    484 return pdev;
    485 }
    486
    487 diff --git a/drivers/rtc/rtc-lib.c b/drivers/rtc/rtc-lib.c
    488 index 9f996ec..dd70bf7 100644
    489 --- a/drivers/rtc/rtc-lib.c
    490 +++ b/drivers/rtc/rtc-lib.c
    491 @@ -51,10 +51,11 @@ EXPORT_SYMBOL(rtc_year_days);
    492 */
    493 void rtc_time_to_tm(unsigned long time, struct rtc_time *tm)
    494 {
    495 - unsigned int days, month, year;
    496 + unsigned int month, year;
    497 + int days;
    498
    499 days = time / 86400;
    500 - time -= days * 86400;
    501 + time -= (unsigned int) days * 86400;
    502
    503 /* day of the week, 1970-01-01 was a Thursday */
    504 tm->tm_wday = (days + 4) % 7;
    505 diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
    506 index fc2509c..a466820 100644
    507 --- a/drivers/s390/block/dasd_eckd.h
    508 +++ b/drivers/s390/block/dasd_eckd.h
    509 @@ -379,7 +379,7 @@ struct dasd_psf_prssd_data {
    510 unsigned char flags;
    511 unsigned char reserved[4];
    512 unsigned char suborder;
    513 - unsigned char varies[9];
    514 + unsigned char varies[5];
    515 } __attribute__ ((packed));
    516
    517 /*
    518 diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
    519 index be95e55..4050845 100644
    520 --- a/drivers/serial/8250.c
    521 +++ b/drivers/serial/8250.c
    522 @@ -1895,15 +1895,23 @@ static int serial8250_startup(struct uart_port *port)
    523 * kick the UART on a regular basis.
    524 */
    525 if (!(iir1 & UART_IIR_NO_INT) && (iir & UART_IIR_NO_INT)) {
    526 + up->bugs |= UART_BUG_THRE;
    527 pr_debug("ttyS%d - using backup timer\n", port->line);
    528 - up->timer.function = serial8250_backup_timeout;
    529 - up->timer.data = (unsigned long)up;
    530 - mod_timer(&up->timer, jiffies +
    531 - poll_timeout(up->port.timeout) + HZ / 5);
    532 }
    533 }
    534
    535 /*
    536 + * The above check will only give an accurate result the first time
    537 + * the port is opened so this value needs to be preserved.
    538 + */
    539 + if (up->bugs & UART_BUG_THRE) {
    540 + up->timer.function = serial8250_backup_timeout;
    541 + up->timer.data = (unsigned long)up;
    542 + mod_timer(&up->timer, jiffies +
    543 + poll_timeout(up->port.timeout) + HZ / 5);
    544 + }
    545 +
    546 + /*
    547 * If the "interrupt" for this port doesn't correspond with any
    548 * hardware interrupt, we use a timer-based system. The original
    549 * driver used to do this with IRQ0.
    550 diff --git a/drivers/serial/8250.h b/drivers/serial/8250.h
    551 index 91bd28f..245288d 100644
    552 --- a/drivers/serial/8250.h
    553 +++ b/drivers/serial/8250.h
    554 @@ -49,6 +49,7 @@ struct serial8250_config {
    555 #define UART_BUG_QUOT (1 << 0) /* UART has buggy quot LSB */
    556 #define UART_BUG_TXEN (1 << 1) /* UART has buggy TX IIR status */
    557 #define UART_BUG_NOMSR (1 << 2) /* UART has buggy MSR status bits (Au1x00) */
    558 +#define UART_BUG_THRE (1 << 3) /* UART has buggy THRE reassertion */
    559
    560 #define PROBE_RSA (1 << 0)
    561 #define PROBE_ANY (~0)
    562 diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    563 index c3201af..560337a 100644
    564 --- a/drivers/usb/class/cdc-acm.c
    565 +++ b/drivers/usb/class/cdc-acm.c
    566 @@ -525,8 +525,8 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
    567 tasklet_schedule(&acm->urb_task);
    568
    569 done:
    570 -err_out:
    571 mutex_unlock(&acm->mutex);
    572 +err_out:
    573 mutex_unlock(&open_mutex);
    574 return rv;
    575
    576 diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c
    577 index 59df132..4835bdc 100644
    578 --- a/drivers/video/fb_defio.c
    579 +++ b/drivers/video/fb_defio.c
    580 @@ -114,6 +114,17 @@ static struct vm_operations_struct fb_deferred_io_vm_ops = {
    581 .page_mkwrite = fb_deferred_io_mkwrite,
    582 };
    583
    584 +static int fb_deferred_io_set_page_dirty(struct page *page)
    585 +{
    586 + if (!PageDirty(page))
    587 + SetPageDirty(page);
    588 + return 0;
    589 +}
    590 +
    591 +static const struct address_space_operations fb_deferred_io_aops = {
    592 + .set_page_dirty = fb_deferred_io_set_page_dirty,
    593 +};
    594 +
    595 static int fb_deferred_io_mmap(struct fb_info *info, struct vm_area_struct *vma)
    596 {
    597 vma->vm_ops = &fb_deferred_io_vm_ops;
    598 @@ -163,6 +174,14 @@ void fb_deferred_io_init(struct fb_info *info)
    599 }
    600 EXPORT_SYMBOL_GPL(fb_deferred_io_init);
    601
    602 +void fb_deferred_io_open(struct fb_info *info,
    603 + struct inode *inode,
    604 + struct file *file)
    605 +{
    606 + file->f_mapping->a_ops = &fb_deferred_io_aops;
    607 +}
    608 +EXPORT_SYMBOL_GPL(fb_deferred_io_open);
    609 +
    610 void fb_deferred_io_cleanup(struct fb_info *info)
    611 {
    612 void *screen_base = (void __force *) info->screen_base;
    613 diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
    614 index 776f7fc..ce6b5da 100644
    615 --- a/drivers/video/fbmem.c
    616 +++ b/drivers/video/fbmem.c
    617 @@ -1340,6 +1340,10 @@ fb_open(struct inode *inode, struct file *file)
    618 if (res)
    619 module_put(info->fbops->owner);
    620 }
    621 +#ifdef CONFIG_FB_DEFERRED_IO
    622 + if (info->fbdefio)
    623 + fb_deferred_io_open(info, inode, file);
    624 +#endif
    625 return res;
    626 }
    627
    628 diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
    629 index 7191306..a0a7157 100644
    630 --- a/fs/binfmt_misc.c
    631 +++ b/fs/binfmt_misc.c
    632 @@ -119,8 +119,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
    633 if (bprm->misc_bang)
    634 goto _ret;
    635
    636 - bprm->misc_bang = 1;
    637 -
    638 /* to keep locking time low, we copy the interpreter string */
    639 read_lock(&entries_lock);
    640 fmt = check_file(bprm);
    641 @@ -198,6 +196,8 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
    642 if (retval < 0)
    643 goto _error;
    644
    645 + bprm->misc_bang = 1;
    646 +
    647 retval = search_binary_handler (bprm, regs);
    648 if (retval < 0)
    649 goto _error;
    650 diff --git a/fs/bio.c b/fs/bio.c
    651 index 7856257..7db618c 100644
    652 --- a/fs/bio.c
    653 +++ b/fs/bio.c
    654 @@ -464,20 +464,21 @@ static void bio_free_map_data(struct bio_map_data *bmd)
    655 kfree(bmd);
    656 }
    657
    658 -static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count)
    659 +static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count,
    660 + gfp_t gfp_mask)
    661 {
    662 - struct bio_map_data *bmd = kmalloc(sizeof(*bmd), GFP_KERNEL);
    663 + struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask);
    664
    665 if (!bmd)
    666 return NULL;
    667
    668 - bmd->iovecs = kmalloc(sizeof(struct bio_vec) * nr_segs, GFP_KERNEL);
    669 + bmd->iovecs = kmalloc(sizeof(struct bio_vec) * nr_segs, gfp_mask);
    670 if (!bmd->iovecs) {
    671 kfree(bmd);
    672 return NULL;
    673 }
    674
    675 - bmd->sgvecs = kmalloc(sizeof(struct sg_iovec) * iov_count, GFP_KERNEL);
    676 + bmd->sgvecs = kmalloc(sizeof(struct sg_iovec) * iov_count, gfp_mask);
    677 if (bmd->sgvecs)
    678 return bmd;
    679
    680 @@ -486,8 +487,8 @@ static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count)
    681 return NULL;
    682 }
    683
    684 -static int __bio_copy_iov(struct bio *bio, struct sg_iovec *iov, int iov_count,
    685 - int uncopy)
    686 +static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs,
    687 + struct sg_iovec *iov, int iov_count, int uncopy)
    688 {
    689 int ret = 0, i;
    690 struct bio_vec *bvec;
    691 @@ -497,7 +498,7 @@ static int __bio_copy_iov(struct bio *bio, struct sg_iovec *iov, int iov_count,
    692
    693 __bio_for_each_segment(bvec, bio, i, 0) {
    694 char *bv_addr = page_address(bvec->bv_page);
    695 - unsigned int bv_len = bvec->bv_len;
    696 + unsigned int bv_len = iovecs[i].bv_len;
    697
    698 while (bv_len && iov_idx < iov_count) {
    699 unsigned int bytes;
    700 @@ -549,7 +550,7 @@ int bio_uncopy_user(struct bio *bio)
    701 struct bio_map_data *bmd = bio->bi_private;
    702 int ret;
    703
    704 - ret = __bio_copy_iov(bio, bmd->sgvecs, bmd->nr_sgvecs, 1);
    705 + ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs, bmd->nr_sgvecs, 1);
    706
    707 bio_free_map_data(bmd);
    708 bio_put(bio);
    709 @@ -591,7 +592,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, struct sg_iovec *iov,
    710 len += iov[i].iov_len;
    711 }
    712
    713 - bmd = bio_alloc_map_data(nr_pages, iov_count);
    714 + bmd = bio_alloc_map_data(nr_pages, iov_count, GFP_KERNEL);
    715 if (!bmd)
    716 return ERR_PTR(-ENOMEM);
    717
    718 @@ -628,7 +629,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, struct sg_iovec *iov,
    719 * success
    720 */
    721 if (!write_to_vm) {
    722 - ret = __bio_copy_iov(bio, iov, iov_count, 0);
    723 + ret = __bio_copy_iov(bio, bio->bi_io_vec, iov, iov_count, 0);
    724 if (ret)
    725 goto cleanup;
    726 }
    727 @@ -941,19 +942,22 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
    728 {
    729 struct bio_vec *bvec;
    730 const int read = bio_data_dir(bio) == READ;
    731 - char *p = bio->bi_private;
    732 + struct bio_map_data *bmd = bio->bi_private;
    733 int i;
    734 + char *p = bmd->sgvecs[0].iov_base;
    735
    736 __bio_for_each_segment(bvec, bio, i, 0) {
    737 char *addr = page_address(bvec->bv_page);
    738 + int len = bmd->iovecs[i].bv_len;
    739
    740 if (read && !err)
    741 - memcpy(p, addr, bvec->bv_len);
    742 + memcpy(p, addr, len);
    743
    744 __free_page(bvec->bv_page);
    745 - p += bvec->bv_len;
    746 + p += len;
    747 }
    748
    749 + bio_free_map_data(bmd);
    750 bio_put(bio);
    751 }
    752
    753 @@ -977,11 +981,21 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len,
    754 const int nr_pages = end - start;
    755 struct bio *bio;
    756 struct bio_vec *bvec;
    757 + struct bio_map_data *bmd;
    758 int i, ret;
    759 + struct sg_iovec iov;
    760 +
    761 + iov.iov_base = data;
    762 + iov.iov_len = len;
    763 +
    764 + bmd = bio_alloc_map_data(nr_pages, 1, gfp_mask);
    765 + if (!bmd)
    766 + return ERR_PTR(-ENOMEM);
    767
    768 + ret = -ENOMEM;
    769 bio = bio_alloc(gfp_mask, nr_pages);
    770 if (!bio)
    771 - return ERR_PTR(-ENOMEM);
    772 + goto out_bmd;
    773
    774 while (len) {
    775 struct page *page;
    776 @@ -1015,14 +1029,18 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len,
    777 }
    778 }
    779
    780 - bio->bi_private = data;
    781 + bio->bi_private = bmd;
    782 bio->bi_end_io = bio_copy_kern_endio;
    783 +
    784 + bio_set_map_data(bmd, bio, &iov, 1);
    785 return bio;
    786 cleanup:
    787 bio_for_each_segment(bvec, bio, i)
    788 __free_page(bvec->bv_page);
    789
    790 bio_put(bio);
    791 +out_bmd:
    792 + bio_free_map_data(bmd);
    793
    794 return ERR_PTR(ret);
    795 }
    796 diff --git a/fs/cifs/file.c b/fs/cifs/file.c
    797 index 0aac824..8da903b 100644
    798 --- a/fs/cifs/file.c
    799 +++ b/fs/cifs/file.c
    800 @@ -832,6 +832,10 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
    801 return -EBADF;
    802 open_file = (struct cifsFileInfo *) file->private_data;
    803
    804 + rc = generic_write_checks(file, poffset, &write_size, 0);
    805 + if (rc)
    806 + return rc;
    807 +
    808 xid = GetXid();
    809
    810 if (*poffset > file->f_path.dentry->d_inode->i_size)
    811 diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
    812 index 0c3b618..f40423e 100644
    813 --- a/fs/cramfs/inode.c
    814 +++ b/fs/cramfs/inode.c
    815 @@ -43,58 +43,13 @@ static DEFINE_MUTEX(read_mutex);
    816 static int cramfs_iget5_test(struct inode *inode, void *opaque)
    817 {
    818 struct cramfs_inode *cramfs_inode = opaque;
    819 -
    820 - if (inode->i_ino != CRAMINO(cramfs_inode))
    821 - return 0; /* does not match */
    822 -
    823 - if (inode->i_ino != 1)
    824 - return 1;
    825 -
    826 - /* all empty directories, char, block, pipe, and sock, share inode #1 */
    827 -
    828 - if ((inode->i_mode != cramfs_inode->mode) ||
    829 - (inode->i_gid != cramfs_inode->gid) ||
    830 - (inode->i_uid != cramfs_inode->uid))
    831 - return 0; /* does not match */
    832 -
    833 - if ((S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) &&
    834 - (inode->i_rdev != old_decode_dev(cramfs_inode->size)))
    835 - return 0; /* does not match */
    836 -
    837 - return 1; /* matches */
    838 + return inode->i_ino == CRAMINO(cramfs_inode) && inode->i_ino != 1;
    839 }
    840
    841 static int cramfs_iget5_set(struct inode *inode, void *opaque)
    842 {
    843 - static struct timespec zerotime;
    844 struct cramfs_inode *cramfs_inode = opaque;
    845 - inode->i_mode = cramfs_inode->mode;
    846 - inode->i_uid = cramfs_inode->uid;
    847 - inode->i_size = cramfs_inode->size;
    848 - inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1;
    849 - inode->i_gid = cramfs_inode->gid;
    850 - /* Struct copy intentional */
    851 - inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime;
    852 inode->i_ino = CRAMINO(cramfs_inode);
    853 - /* inode->i_nlink is left 1 - arguably wrong for directories,
    854 - but it's the best we can do without reading the directory
    855 - contents. 1 yields the right result in GNU find, even
    856 - without -noleaf option. */
    857 - if (S_ISREG(inode->i_mode)) {
    858 - inode->i_fop = &generic_ro_fops;
    859 - inode->i_data.a_ops = &cramfs_aops;
    860 - } else if (S_ISDIR(inode->i_mode)) {
    861 - inode->i_op = &cramfs_dir_inode_operations;
    862 - inode->i_fop = &cramfs_directory_operations;
    863 - } else if (S_ISLNK(inode->i_mode)) {
    864 - inode->i_op = &page_symlink_inode_operations;
    865 - inode->i_data.a_ops = &cramfs_aops;
    866 - } else {
    867 - inode->i_size = 0;
    868 - inode->i_blocks = 0;
    869 - init_special_inode(inode, inode->i_mode,
    870 - old_decode_dev(cramfs_inode->size));
    871 - }
    872 return 0;
    873 }
    874
    875 @@ -104,12 +59,48 @@ static struct inode *get_cramfs_inode(struct super_block *sb,
    876 struct inode *inode = iget5_locked(sb, CRAMINO(cramfs_inode),
    877 cramfs_iget5_test, cramfs_iget5_set,
    878 cramfs_inode);
    879 + static struct timespec zerotime;
    880 +
    881 if (inode && (inode->i_state & I_NEW)) {
    882 + inode->i_mode = cramfs_inode->mode;
    883 + inode->i_uid = cramfs_inode->uid;
    884 + inode->i_size = cramfs_inode->size;
    885 + inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1;
    886 + inode->i_gid = cramfs_inode->gid;
    887 + /* Struct copy intentional */
    888 + inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime;
    889 + /* inode->i_nlink is left 1 - arguably wrong for directories,
    890 + but it's the best we can do without reading the directory
    891 + contents. 1 yields the right result in GNU find, even
    892 + without -noleaf option. */
    893 + if (S_ISREG(inode->i_mode)) {
    894 + inode->i_fop = &generic_ro_fops;
    895 + inode->i_data.a_ops = &cramfs_aops;
    896 + } else if (S_ISDIR(inode->i_mode)) {
    897 + inode->i_op = &cramfs_dir_inode_operations;
    898 + inode->i_fop = &cramfs_directory_operations;
    899 + } else if (S_ISLNK(inode->i_mode)) {
    900 + inode->i_op = &page_symlink_inode_operations;
    901 + inode->i_data.a_ops = &cramfs_aops;
    902 + } else {
    903 + inode->i_size = 0;
    904 + inode->i_blocks = 0;
    905 + init_special_inode(inode, inode->i_mode,
    906 + old_decode_dev(cramfs_inode->size));
    907 + }
    908 unlock_new_inode(inode);
    909 }
    910 return inode;
    911 }
    912
    913 +static void cramfs_drop_inode(struct inode *inode)
    914 +{
    915 + if (inode->i_ino == 1)
    916 + generic_delete_inode(inode);
    917 + else
    918 + generic_drop_inode(inode);
    919 +}
    920 +
    921 /*
    922 * We have our own block cache: don't fill up the buffer cache
    923 * with the rom-image, because the way the filesystem is set
    924 @@ -534,6 +525,7 @@ static const struct super_operations cramfs_ops = {
    925 .put_super = cramfs_put_super,
    926 .remount_fs = cramfs_remount,
    927 .statfs = cramfs_statfs,
    928 + .drop_inode = cramfs_drop_inode,
    929 };
    930
    931 static int cramfs_get_sb(struct file_system_type *fs_type,
    932 diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
    933 index b6ed383..54b8b41 100644
    934 --- a/fs/nfsd/nfs4acl.c
    935 +++ b/fs/nfsd/nfs4acl.c
    936 @@ -443,7 +443,7 @@ init_state(struct posix_acl_state *state, int cnt)
    937 * enough space for either:
    938 */
    939 alloc = sizeof(struct posix_ace_state_array)
    940 - + cnt*sizeof(struct posix_ace_state);
    941 + + cnt*sizeof(struct posix_user_ace_state);
    942 state->users = kzalloc(alloc, GFP_KERNEL);
    943 if (!state->users)
    944 return -ENOMEM;
    945 diff --git a/include/linux/Kbuild b/include/linux/Kbuild
    946 index 71d70d1..27af0b8 100644
    947 --- a/include/linux/Kbuild
    948 +++ b/include/linux/Kbuild
    949 @@ -293,7 +293,6 @@ unifdef-y += parport.h
    950 unifdef-y += patchkey.h
    951 unifdef-y += pci.h
    952 unifdef-y += personality.h
    953 -unifdef-y += pim.h
    954 unifdef-y += pktcdvd.h
    955 unifdef-y += pmu.h
    956 unifdef-y += poll.h
    957 diff --git a/include/linux/fb.h b/include/linux/fb.h
    958 index 72295b0..dd82c76 100644
    959 --- a/include/linux/fb.h
    960 +++ b/include/linux/fb.h
    961 @@ -973,6 +973,9 @@ static inline void __fb_pad_aligned_buffer(u8 *dst, u32 d_pitch,
    962
    963 /* drivers/video/fb_defio.c */
    964 extern void fb_deferred_io_init(struct fb_info *info);
    965 +extern void fb_deferred_io_open(struct fb_info *info,
    966 + struct inode *inode,
    967 + struct file *file);
    968 extern void fb_deferred_io_cleanup(struct fb_info *info);
    969 extern int fb_deferred_io_fsync(struct file *file, struct dentry *dentry,
    970 int datasync);
    971 diff --git a/include/linux/mroute.h b/include/linux/mroute.h
    972 index de4decf..35a8277 100644
    973 --- a/include/linux/mroute.h
    974 +++ b/include/linux/mroute.h
    975 @@ -2,11 +2,7 @@
    976 #define __LINUX_MROUTE_H
    977
    978 #include <linux/sockios.h>
    979 -#include <linux/types.h>
    980 -#ifdef __KERNEL__
    981 #include <linux/in.h>
    982 -#endif
    983 -#include <linux/pim.h>
    984
    985 /*
    986 * Based on the MROUTING 3.5 defines primarily to keep
    987 @@ -214,6 +210,27 @@ struct mfc_cache
    988 #define IGMPMSG_WHOLEPKT 3 /* For PIM Register processing */
    989
    990 #ifdef __KERNEL__
    991 +
    992 +#define PIM_V1_VERSION __constant_htonl(0x10000000)
    993 +#define PIM_V1_REGISTER 1
    994 +
    995 +#define PIM_VERSION 2
    996 +#define PIM_REGISTER 1
    997 +
    998 +#define PIM_NULL_REGISTER __constant_htonl(0x40000000)
    999 +
    1000 +/* PIMv2 register message header layout (ietf-draft-idmr-pimvsm-v2-00.ps */
    1001 +
    1002 +struct pimreghdr
    1003 +{
    1004 + __u8 type;
    1005 + __u8 reserved;
    1006 + __be16 csum;
    1007 + __be32 flags;
    1008 +};
    1009 +
    1010 +extern int pim_rcv_v1(struct sk_buff *);
    1011 +
    1012 struct rtmsg;
    1013 extern int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait);
    1014 #endif
    1015 diff --git a/include/linux/pim.h b/include/linux/pim.h
    1016 deleted file mode 100644
    1017 index 236ffd3..0000000
    1018 --- a/include/linux/pim.h
    1019 +++ /dev/null
    1020 @@ -1,45 +0,0 @@
    1021 -#ifndef __LINUX_PIM_H
    1022 -#define __LINUX_PIM_H
    1023 -
    1024 -#include <asm/byteorder.h>
    1025 -
    1026 -#ifndef __KERNEL__
    1027 -struct pim {
    1028 -#if defined(__LITTLE_ENDIAN_BITFIELD)
    1029 - __u8 pim_type:4, /* PIM message type */
    1030 - pim_ver:4; /* PIM version */
    1031 -#elif defined(__BIG_ENDIAN_BITFIELD)
    1032 - __u8 pim_ver:4; /* PIM version */
    1033 - pim_type:4; /* PIM message type */
    1034 -#endif
    1035 - __u8 pim_rsv; /* Reserved */
    1036 - __be16 pim_cksum; /* Checksum */
    1037 -};
    1038 -
    1039 -#define PIM_MINLEN 8
    1040 -#endif
    1041 -
    1042 -/* Message types - V1 */
    1043 -#define PIM_V1_VERSION __constant_htonl(0x10000000)
    1044 -#define PIM_V1_REGISTER 1
    1045 -
    1046 -/* Message types - V2 */
    1047 -#define PIM_VERSION 2
    1048 -#define PIM_REGISTER 1
    1049 -
    1050 -#if defined(__KERNEL__)
    1051 -#define PIM_NULL_REGISTER __constant_htonl(0x40000000)
    1052 -
    1053 -/* PIMv2 register message header layout (ietf-draft-idmr-pimvsm-v2-00.ps */
    1054 -struct pimreghdr
    1055 -{
    1056 - __u8 type;
    1057 - __u8 reserved;
    1058 - __be16 csum;
    1059 - __be32 flags;
    1060 -};
    1061 -
    1062 -struct sk_buff;
    1063 -extern int pim_rcv_v1(struct sk_buff *);
    1064 -#endif
    1065 -#endif
    1066 diff --git a/include/net/addrconf.h b/include/net/addrconf.h
    1067 index bbd3d58..99ca7cd 100644
    1068 --- a/include/net/addrconf.h
    1069 +++ b/include/net/addrconf.h
    1070 @@ -80,7 +80,8 @@ extern struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net,
    1071 struct net_device *dev,
    1072 int strict);
    1073
    1074 -extern int ipv6_dev_get_saddr(struct net_device *dev,
    1075 +extern int ipv6_dev_get_saddr(struct net *net,
    1076 + struct net_device *dev,
    1077 const struct in6_addr *daddr,
    1078 unsigned int srcprefs,
    1079 struct in6_addr *saddr);
    1080 diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
    1081 index 9313491..03462e5 100644
    1082 --- a/include/net/ip6_route.h
    1083 +++ b/include/net/ip6_route.h
    1084 @@ -112,6 +112,7 @@ struct rt6_rtnl_dump_arg
    1085 {
    1086 struct sk_buff *skb;
    1087 struct netlink_callback *cb;
    1088 + struct net *net;
    1089 };
    1090
    1091 extern int rt6_dump_route(struct rt6_info *rt, void *p_arg);
    1092 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
    1093 index f32fae3..0d520dc 100644
    1094 --- a/mm/page_alloc.c
    1095 +++ b/mm/page_alloc.c
    1096 @@ -693,6 +693,9 @@ int move_freepages(struct zone *zone,
    1097 #endif
    1098
    1099 for (page = start_page; page <= end_page;) {
    1100 + /* Make sure we are not inadvertently changing nodes */
    1101 + VM_BUG_ON(page_to_nid(page) != zone_to_nid(zone));
    1102 +
    1103 if (!pfn_valid_within(page_to_pfn(page))) {
    1104 page++;
    1105 continue;
    1106 @@ -2475,6 +2478,10 @@ static void setup_zone_migrate_reserve(struct zone *zone)
    1107 continue;
    1108 page = pfn_to_page(pfn);
    1109
    1110 + /* Watch out for overlapping nodes */
    1111 + if (page_to_nid(page) != zone_to_nid(zone))
    1112 + continue;
    1113 +
    1114 /* Blocks with reserved pages will never free, skip them. */
    1115 if (PageReserved(page))
    1116 continue;
    1117 diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
    1118 index f597987..f288fc4 100644
    1119 --- a/net/ax25/sysctl_net_ax25.c
    1120 +++ b/net/ax25/sysctl_net_ax25.c
    1121 @@ -36,6 +36,7 @@ static struct ctl_path ax25_path[] = {
    1122 { .procname = "ax25", .ctl_name = NET_AX25, },
    1123 { }
    1124 };
    1125 +
    1126 static const ctl_table ax25_param_table[] = {
    1127 {
    1128 .ctl_name = NET_AX25_IP_DEFAULT_MODE,
    1129 @@ -167,6 +168,7 @@ static const ctl_table ax25_param_table[] = {
    1130 .extra1 = &min_proto,
    1131 .extra2 = &max_proto
    1132 },
    1133 +#ifdef CONFIG_AX25_DAMA_SLAVE
    1134 {
    1135 .ctl_name = NET_AX25_DAMA_SLAVE_TIMEOUT,
    1136 .procname = "dama_slave_timeout",
    1137 @@ -177,6 +179,8 @@ static const ctl_table ax25_param_table[] = {
    1138 .extra1 = &min_ds_timeout,
    1139 .extra2 = &max_ds_timeout
    1140 },
    1141 +#endif
    1142 +
    1143 { .ctl_name = 0 } /* that's all, folks! */
    1144 };
    1145
    1146 @@ -210,16 +214,6 @@ void ax25_register_sysctl(void)
    1147 ax25_table[n].procname = ax25_dev->dev->name;
    1148 ax25_table[n].mode = 0555;
    1149
    1150 -#ifndef CONFIG_AX25_DAMA_SLAVE
    1151 - /*
    1152 - * We do not wish to have a representation of this parameter
    1153 - * in /proc/sys/ when configured *not* to include the
    1154 - * AX.25 DAMA slave code, do we?
    1155 - */
    1156 -
    1157 - child[AX25_VALUES_DS_TIMEOUT].procname = NULL;
    1158 -#endif
    1159 -
    1160 child[AX25_MAX_VALUES].ctl_name = 0; /* just in case... */
    1161
    1162 for (k = 0; k < AX25_MAX_VALUES; k++)
    1163 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    1164 index 9f3f7ba..b6e7ec0 100644
    1165 --- a/net/ipv4/udp.c
    1166 +++ b/net/ipv4/udp.c
    1167 @@ -988,7 +988,9 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
    1168 up->encap_rcv != NULL) {
    1169 int ret;
    1170
    1171 + bh_unlock_sock(sk);
    1172 ret = (*up->encap_rcv)(sk, skb);
    1173 + bh_lock_sock(sk);
    1174 if (ret <= 0) {
    1175 UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS,
    1176 is_udplite);
    1177 @@ -1087,7 +1089,7 @@ static int __udp4_lib_mcast_deliver(struct sk_buff *skb,
    1178 if (skb1) {
    1179 int ret = 0;
    1180
    1181 - bh_lock_sock_nested(sk);
    1182 + bh_lock_sock(sk);
    1183 if (!sock_owned_by_user(sk))
    1184 ret = udp_queue_rcv_skb(sk, skb1);
    1185 else
    1186 @@ -1187,7 +1189,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
    1187
    1188 if (sk != NULL) {
    1189 int ret = 0;
    1190 - bh_lock_sock_nested(sk);
    1191 + bh_lock_sock(sk);
    1192 if (!sock_owned_by_user(sk))
    1193 ret = udp_queue_rcv_skb(sk, skb);
    1194 else
    1195 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
    1196 index ff61a5c..1a1d494 100644
    1197 --- a/net/ipv6/addrconf.c
    1198 +++ b/net/ipv6/addrconf.c
    1199 @@ -1076,13 +1076,12 @@ out:
    1200 return ret;
    1201 }
    1202
    1203 -int ipv6_dev_get_saddr(struct net_device *dst_dev,
    1204 +int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
    1205 const struct in6_addr *daddr, unsigned int prefs,
    1206 struct in6_addr *saddr)
    1207 {
    1208 struct ipv6_saddr_score scores[2],
    1209 *score = &scores[0], *hiscore = &scores[1];
    1210 - struct net *net = dev_net(dst_dev);
    1211 struct ipv6_saddr_dst dst;
    1212 struct net_device *dev;
    1213 int dst_type;
    1214 diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
    1215 index 8d05527..f5de3f9 100644
    1216 --- a/net/ipv6/fib6_rules.c
    1217 +++ b/net/ipv6/fib6_rules.c
    1218 @@ -93,7 +93,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
    1219 if (flags & RT6_LOOKUP_F_SRCPREF_COA)
    1220 srcprefs |= IPV6_PREFER_SRC_COA;
    1221
    1222 - if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
    1223 + if (ipv6_dev_get_saddr(net,
    1224 + ip6_dst_idev(&rt->u.dst)->dev,
    1225 &flp->fl6_dst, srcprefs,
    1226 &saddr))
    1227 goto again;
    1228 diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
    1229 index 918fde4..fe80171 100644
    1230 --- a/net/ipv6/ip6_fib.c
    1231 +++ b/net/ipv6/ip6_fib.c
    1232 @@ -380,6 +380,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
    1233
    1234 arg.skb = skb;
    1235 arg.cb = cb;
    1236 + arg.net = net;
    1237 w->args = &arg;
    1238
    1239 for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
    1240 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    1241 index 4019770..d99f094 100644
    1242 --- a/net/ipv6/ip6_output.c
    1243 +++ b/net/ipv6/ip6_output.c
    1244 @@ -925,7 +925,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
    1245 goto out_err_release;
    1246
    1247 if (ipv6_addr_any(&fl->fl6_src)) {
    1248 - err = ipv6_dev_get_saddr(ip6_dst_idev(*dst)->dev,
    1249 + err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
    1250 &fl->fl6_dst,
    1251 sk ? inet6_sk(sk)->srcprefs : 0,
    1252 &fl->fl6_src);
    1253 diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
    1254 index 282fdb3..efa84ae 100644
    1255 --- a/net/ipv6/ndisc.c
    1256 +++ b/net/ipv6/ndisc.c
    1257 @@ -549,7 +549,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
    1258 override = 0;
    1259 in6_ifa_put(ifp);
    1260 } else {
    1261 - if (ipv6_dev_get_saddr(dev, daddr,
    1262 + if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
    1263 inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
    1264 &tmpaddr))
    1265 return;
    1266 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    1267 index 7ff6870..9deee59 100644
    1268 --- a/net/ipv6/route.c
    1269 +++ b/net/ipv6/route.c
    1270 @@ -2098,7 +2098,8 @@ static inline size_t rt6_nlmsg_size(void)
    1271 + nla_total_size(sizeof(struct rta_cacheinfo));
    1272 }
    1273
    1274 -static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
    1275 +static int rt6_fill_node(struct net *net,
    1276 + struct sk_buff *skb, struct rt6_info *rt,
    1277 struct in6_addr *dst, struct in6_addr *src,
    1278 int iif, int type, u32 pid, u32 seq,
    1279 int prefix, int nowait, unsigned int flags)
    1280 @@ -2179,8 +2180,9 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
    1281 #endif
    1282 NLA_PUT_U32(skb, RTA_IIF, iif);
    1283 } else if (dst) {
    1284 + struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst);
    1285 struct in6_addr saddr_buf;
    1286 - if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
    1287 + if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
    1288 dst, 0, &saddr_buf) == 0)
    1289 NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
    1290 }
    1291 @@ -2225,7 +2227,8 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg)
    1292 } else
    1293 prefix = 0;
    1294
    1295 - return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
    1296 + return rt6_fill_node(arg->net,
    1297 + arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
    1298 NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,
    1299 prefix, 0, NLM_F_MULTI);
    1300 }
    1301 @@ -2291,7 +2294,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
    1302 rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl);
    1303 skb->dst = &rt->u.dst;
    1304
    1305 - err = rt6_fill_node(skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
    1306 + err = rt6_fill_node(net, skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
    1307 RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
    1308 nlh->nlmsg_seq, 0, 0, 0);
    1309 if (err < 0) {
    1310 @@ -2318,7 +2321,7 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
    1311 if (skb == NULL)
    1312 goto errout;
    1313
    1314 - err = rt6_fill_node(skb, rt, NULL, NULL, 0,
    1315 + err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
    1316 event, info->pid, seq, 0, 0, 0);
    1317 if (err < 0) {
    1318 /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
    1319 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
    1320 index dd30962..e14aa66 100644
    1321 --- a/net/ipv6/udp.c
    1322 +++ b/net/ipv6/udp.c
    1323 @@ -376,7 +376,7 @@ static int __udp6_lib_mcast_deliver(struct sk_buff *skb, struct in6_addr *saddr,
    1324 uh->source, saddr, dif))) {
    1325 struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
    1326 if (buff) {
    1327 - bh_lock_sock_nested(sk2);
    1328 + bh_lock_sock(sk2);
    1329 if (!sock_owned_by_user(sk2))
    1330 udpv6_queue_rcv_skb(sk2, buff);
    1331 else
    1332 @@ -384,7 +384,7 @@ static int __udp6_lib_mcast_deliver(struct sk_buff *skb, struct in6_addr *saddr,
    1333 bh_unlock_sock(sk2);
    1334 }
    1335 }
    1336 - bh_lock_sock_nested(sk);
    1337 + bh_lock_sock(sk);
    1338 if (!sock_owned_by_user(sk))
    1339 udpv6_queue_rcv_skb(sk, skb);
    1340 else
    1341 @@ -502,7 +502,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
    1342
    1343 /* deliver */
    1344
    1345 - bh_lock_sock_nested(sk);
    1346 + bh_lock_sock(sk);
    1347 if (!sock_owned_by_user(sk))
    1348 udpv6_queue_rcv_skb(sk, skb);
    1349 else
    1350 diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
    1351 index 8f1e054..08e4cbb 100644
    1352 --- a/net/ipv6/xfrm6_policy.c
    1353 +++ b/net/ipv6/xfrm6_policy.c
    1354 @@ -52,12 +52,14 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr,
    1355 static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
    1356 {
    1357 struct dst_entry *dst;
    1358 + struct net_device *dev;
    1359
    1360 dst = xfrm6_dst_lookup(0, NULL, daddr);
    1361 if (IS_ERR(dst))
    1362 return -EHOSTUNREACH;
    1363
    1364 - ipv6_dev_get_saddr(ip6_dst_idev(dst)->dev,
    1365 + dev = ip6_dst_idev(dst)->dev;
    1366 + ipv6_dev_get_saddr(dev_net(dev), dev,
    1367 (struct in6_addr *)&daddr->a6, 0,
    1368 (struct in6_addr *)&saddr->a6);
    1369 dst_release(dst);
    1370 diff --git a/net/sched/act_api.c b/net/sched/act_api.c
    1371 index 74e662c..b5e116c 100644
    1372 --- a/net/sched/act_api.c
    1373 +++ b/net/sched/act_api.c
    1374 @@ -205,10 +205,9 @@ struct tcf_common *tcf_hash_check(u32 index, struct tc_action *a, int bind,
    1375 {
    1376 struct tcf_common *p = NULL;
    1377 if (index && (p = tcf_hash_lookup(index, hinfo)) != NULL) {
    1378 - if (bind) {
    1379 + if (bind)
    1380 p->tcfc_bindcnt++;
    1381 - p->tcfc_refcnt++;
    1382 - }
    1383 + p->tcfc_refcnt++;
    1384 a->priv = p;
    1385 }
    1386 return p;
    1387 diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
    1388 index 3fb58f4..51c3f68 100644
    1389 --- a/net/sched/sch_htb.c
    1390 +++ b/net/sched/sch_htb.c
    1391 @@ -595,11 +595,13 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
    1392 kfree_skb(skb);
    1393 return ret;
    1394 #endif
    1395 - } else if (cl->un.leaf.q->enqueue(skb, cl->un.leaf.q) !=
    1396 + } else if ((ret = cl->un.leaf.q->enqueue(skb, cl->un.leaf.q)) !=
    1397 NET_XMIT_SUCCESS) {
    1398 - sch->qstats.drops++;
    1399 - cl->qstats.drops++;
    1400 - return NET_XMIT_DROP;
    1401 + if (ret == NET_XMIT_DROP) {
    1402 + sch->qstats.drops++;
    1403 + cl->qstats.drops++;
    1404 + }
    1405 + return ret;
    1406 } else {
    1407 cl->bstats.packets +=
    1408 skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
    1409 @@ -639,11 +641,13 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
    1410 kfree_skb(skb);
    1411 return ret;
    1412 #endif
    1413 - } else if (cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q) !=
    1414 + } else if ((ret = cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q)) !=
    1415 NET_XMIT_SUCCESS) {
    1416 - sch->qstats.drops++;
    1417 - cl->qstats.drops++;
    1418 - return NET_XMIT_DROP;
    1419 + if (ret == NET_XMIT_DROP) {
    1420 + sch->qstats.drops++;
    1421 + cl->qstats.drops++;
    1422 + }
    1423 + return ret;
    1424 } else
    1425 htb_activate(q, cl);
    1426
    1427 diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
    1428 index 5532f10..ec0c921 100644
    1429 --- a/net/sched/sch_prio.c
    1430 +++ b/net/sched/sch_prio.c
    1431 @@ -228,14 +228,20 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt)
    1432 {
    1433 struct prio_sched_data *q = qdisc_priv(sch);
    1434 struct tc_prio_qopt *qopt;
    1435 - struct nlattr *tb[TCA_PRIO_MAX + 1];
    1436 + struct nlattr *tb[TCA_PRIO_MAX + 1] = {0};
    1437 int err;
    1438 int i;
    1439
    1440 - err = nla_parse_nested_compat(tb, TCA_PRIO_MAX, opt, NULL, qopt,
    1441 - sizeof(*qopt));
    1442 - if (err < 0)
    1443 - return err;
    1444 + qopt = nla_data(opt);
    1445 + if (nla_len(opt) < sizeof(*qopt))
    1446 + return -1;
    1447 +
    1448 + if (nla_len(opt) >= sizeof(*qopt) + sizeof(struct nlattr)) {
    1449 + err = nla_parse_nested(tb, TCA_PRIO_MAX,
    1450 + (struct nlattr *) (qopt + 1), NULL);
    1451 + if (err < 0)
    1452 + return err;
    1453 + }
    1454
    1455 q->bands = qopt->bands;
    1456 /* If we're multiqueue, make sure the number of incoming bands
    1457 diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
    1458 index 0b7d78f..fc6f8f3 100644
    1459 --- a/net/sched/sch_tbf.c
    1460 +++ b/net/sched/sch_tbf.c
    1461 @@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
    1462 struct tbf_sched_data *q = qdisc_priv(sch);
    1463 int ret;
    1464
    1465 - if (skb->len > q->max_size) {
    1466 - sch->qstats.drops++;
    1467 -#ifdef CONFIG_NET_CLS_ACT
    1468 - if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch))
    1469 -#endif
    1470 - kfree_skb(skb);
    1471 -
    1472 - return NET_XMIT_DROP;
    1473 - }
    1474 + if (skb->len > q->max_size)
    1475 + return qdisc_reshape_fail(skb, sch);
    1476
    1477 if ((ret = q->qdisc->enqueue(skb, q->qdisc)) != 0) {
    1478 sch->qstats.drops++;
    1479 diff --git a/net/sctp/auth.c b/net/sctp/auth.c
    1480 index 675a5c3..52db5f6 100644
    1481 --- a/net/sctp/auth.c
    1482 +++ b/net/sctp/auth.c
    1483 @@ -80,6 +80,10 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
    1484 {
    1485 struct sctp_auth_bytes *key;
    1486
    1487 + /* Verify that we are not going to overflow INT_MAX */
    1488 + if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
    1489 + return NULL;
    1490 +
    1491 /* Allocate the shared key */
    1492 key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp);
    1493 if (!key)
    1494 @@ -782,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
    1495 for (i = 0; i < hmacs->shmac_num_idents; i++) {
    1496 id = hmacs->shmac_idents[i];
    1497
    1498 + if (id > SCTP_AUTH_HMAC_ID_MAX)
    1499 + return -EOPNOTSUPP;
    1500 +
    1501 if (SCTP_AUTH_HMAC_ID_SHA1 == id)
    1502 has_sha1 = 1;
    1503
    1504 diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
    1505 index e39a0cd..4c8d9f4 100644
    1506 --- a/net/sctp/endpointola.c
    1507 +++ b/net/sctp/endpointola.c
    1508 @@ -103,6 +103,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
    1509
    1510 /* Initialize the CHUNKS parameter */
    1511 auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS;
    1512 + auth_chunks->param_hdr.length = htons(sizeof(sctp_paramhdr_t));
    1513
    1514 /* If the Add-IP functionality is enabled, we must
    1515 * authenticate, ASCONF and ASCONF-ACK chunks
    1516 @@ -110,8 +111,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
    1517 if (sctp_addip_enable) {
    1518 auth_chunks->chunks[0] = SCTP_CID_ASCONF;
    1519 auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK;
    1520 - auth_chunks->param_hdr.length =
    1521 - htons(sizeof(sctp_paramhdr_t) + 2);
    1522 + auth_chunks->param_hdr.length += htons(2);
    1523 }
    1524 }
    1525
    1526 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
    1527 index a2f4d4d..38a5d80 100644
    1528 --- a/net/sctp/ipv6.c
    1529 +++ b/net/sctp/ipv6.c
    1530 @@ -317,7 +317,8 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk,
    1531 __func__, asoc, dst, NIP6(daddr->v6.sin6_addr));
    1532
    1533 if (!asoc) {
    1534 - ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL,
    1535 + ipv6_dev_get_saddr(sock_net(sctp_opt2sk(sk)),
    1536 + dst ? ip6_dst_idev(dst)->dev : NULL,
    1537 &daddr->v6.sin6_addr,
    1538 inet6_sk(&sk->inet.sk)->srcprefs,
    1539 &saddr->v6.sin6_addr);
    1540 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
    1541 index 0dbcde6..700d27d 100644
    1542 --- a/net/sctp/socket.c
    1543 +++ b/net/sctp/socket.c
    1544 @@ -2965,6 +2965,9 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
    1545 {
    1546 struct sctp_authchunk val;
    1547
    1548 + if (!sctp_auth_enable)
    1549 + return -EACCES;
    1550 +
    1551 if (optlen != sizeof(struct sctp_authchunk))
    1552 return -EINVAL;
    1553 if (copy_from_user(&val, optval, optlen))
    1554 @@ -2993,8 +2996,12 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
    1555 int optlen)
    1556 {
    1557 struct sctp_hmacalgo *hmacs;
    1558 + u32 idents;
    1559 int err;
    1560
    1561 + if (!sctp_auth_enable)
    1562 + return -EACCES;
    1563 +
    1564 if (optlen < sizeof(struct sctp_hmacalgo))
    1565 return -EINVAL;
    1566
    1567 @@ -3007,8 +3014,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
    1568 goto out;
    1569 }
    1570
    1571 - if (hmacs->shmac_num_idents == 0 ||
    1572 - hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) {
    1573 + idents = hmacs->shmac_num_idents;
    1574 + if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
    1575 + (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
    1576 err = -EINVAL;
    1577 goto out;
    1578 }
    1579 @@ -3033,6 +3041,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
    1580 struct sctp_association *asoc;
    1581 int ret;
    1582
    1583 + if (!sctp_auth_enable)
    1584 + return -EACCES;
    1585 +
    1586 if (optlen <= sizeof(struct sctp_authkey))
    1587 return -EINVAL;
    1588
    1589 @@ -3045,6 +3056,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
    1590 goto out;
    1591 }
    1592
    1593 + if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
    1594 + ret = -EINVAL;
    1595 + goto out;
    1596 + }
    1597 +
    1598 asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
    1599 if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
    1600 ret = -EINVAL;
    1601 @@ -3070,6 +3086,9 @@ static int sctp_setsockopt_active_key(struct sock *sk,
    1602 struct sctp_authkeyid val;
    1603 struct sctp_association *asoc;
    1604
    1605 + if (!sctp_auth_enable)
    1606 + return -EACCES;
    1607 +
    1608 if (optlen != sizeof(struct sctp_authkeyid))
    1609 return -EINVAL;
    1610 if (copy_from_user(&val, optval, optlen))
    1611 @@ -3095,6 +3114,9 @@ static int sctp_setsockopt_del_key(struct sock *sk,
    1612 struct sctp_authkeyid val;
    1613 struct sctp_association *asoc;
    1614
    1615 + if (!sctp_auth_enable)
    1616 + return -EACCES;
    1617 +
    1618 if (optlen != sizeof(struct sctp_authkeyid))
    1619 return -EINVAL;
    1620 if (copy_from_user(&val, optval, optlen))
    1621 @@ -5053,19 +5075,29 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
    1622 static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
    1623 char __user *optval, int __user *optlen)
    1624 {
    1625 + struct sctp_hmacalgo __user *p = (void __user *)optval;
    1626 struct sctp_hmac_algo_param *hmacs;
    1627 - __u16 param_len;
    1628 + __u16 data_len = 0;
    1629 + u32 num_idents;
    1630 +
    1631 + if (!sctp_auth_enable)
    1632 + return -EACCES;
    1633
    1634 hmacs = sctp_sk(sk)->ep->auth_hmacs_list;
    1635 - param_len = ntohs(hmacs->param_hdr.length);
    1636 + data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
    1637
    1638 - if (len < param_len)
    1639 + if (len < sizeof(struct sctp_hmacalgo) + data_len)
    1640 return -EINVAL;
    1641 +
    1642 + len = sizeof(struct sctp_hmacalgo) + data_len;
    1643 + num_idents = data_len / sizeof(u16);
    1644 +
    1645 if (put_user(len, optlen))
    1646 return -EFAULT;
    1647 - if (copy_to_user(optval, hmacs->hmac_ids, len))
    1648 + if (put_user(num_idents, &p->shmac_num_idents))
    1649 + return -EFAULT;
    1650 + if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
    1651 return -EFAULT;
    1652 -
    1653 return 0;
    1654 }
    1655
    1656 @@ -5075,6 +5107,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
    1657 struct sctp_authkeyid val;
    1658 struct sctp_association *asoc;
    1659
    1660 + if (!sctp_auth_enable)
    1661 + return -EACCES;
    1662 +
    1663 if (len < sizeof(struct sctp_authkeyid))
    1664 return -EINVAL;
    1665 if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
    1666 @@ -5089,6 +5124,12 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
    1667 else
    1668 val.scact_keynumber = sctp_sk(sk)->ep->active_key_id;
    1669
    1670 + len = sizeof(struct sctp_authkeyid);
    1671 + if (put_user(len, optlen))
    1672 + return -EFAULT;
    1673 + if (copy_to_user(optval, &val, len))
    1674 + return -EFAULT;
    1675 +
    1676 return 0;
    1677 }
    1678
    1679 @@ -5099,13 +5140,16 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
    1680 struct sctp_authchunks val;
    1681 struct sctp_association *asoc;
    1682 struct sctp_chunks_param *ch;
    1683 - u32 num_chunks;
    1684 + u32 num_chunks = 0;
    1685 char __user *to;
    1686
    1687 - if (len <= sizeof(struct sctp_authchunks))
    1688 + if (!sctp_auth_enable)
    1689 + return -EACCES;
    1690 +
    1691 + if (len < sizeof(struct sctp_authchunks))
    1692 return -EINVAL;
    1693
    1694 - if (copy_from_user(&val, p, sizeof(struct sctp_authchunks)))
    1695 + if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
    1696 return -EFAULT;
    1697
    1698 to = p->gauth_chunks;
    1699 @@ -5114,20 +5158,21 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
    1700 return -EINVAL;
    1701
    1702 ch = asoc->peer.peer_chunks;
    1703 + if (!ch)
    1704 + goto num;
    1705
    1706 /* See if the user provided enough room for all the data */
    1707 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
    1708 if (len < num_chunks)
    1709 return -EINVAL;
    1710
    1711 - len = num_chunks;
    1712 - if (put_user(len, optlen))
    1713 + if (copy_to_user(to, ch->chunks, num_chunks))
    1714 return -EFAULT;
    1715 +num:
    1716 + len = sizeof(struct sctp_authchunks) + num_chunks;
    1717 + if (put_user(len, optlen)) return -EFAULT;
    1718 if (put_user(num_chunks, &p->gauth_number_of_chunks))
    1719 return -EFAULT;
    1720 - if (copy_to_user(to, ch->chunks, len))
    1721 - return -EFAULT;
    1722 -
    1723 return 0;
    1724 }
    1725
    1726 @@ -5138,13 +5183,16 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
    1727 struct sctp_authchunks val;
    1728 struct sctp_association *asoc;
    1729 struct sctp_chunks_param *ch;
    1730 - u32 num_chunks;
    1731 + u32 num_chunks = 0;
    1732 char __user *to;
    1733
    1734 - if (len <= sizeof(struct sctp_authchunks))
    1735 + if (!sctp_auth_enable)
    1736 + return -EACCES;
    1737 +
    1738 + if (len < sizeof(struct sctp_authchunks))
    1739 return -EINVAL;
    1740
    1741 - if (copy_from_user(&val, p, sizeof(struct sctp_authchunks)))
    1742 + if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
    1743 return -EFAULT;
    1744
    1745 to = p->gauth_chunks;
    1746 @@ -5157,17 +5205,21 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
    1747 else
    1748 ch = sctp_sk(sk)->ep->auth_chunk_list;
    1749
    1750 + if (!ch)
    1751 + goto num;
    1752 +
    1753 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
    1754 - if (len < num_chunks)
    1755 + if (len < sizeof(struct sctp_authchunks) + num_chunks)
    1756 return -EINVAL;
    1757
    1758 - len = num_chunks;
    1759 + if (copy_to_user(to, ch->chunks, num_chunks))
    1760 + return -EFAULT;
    1761 +num:
    1762 + len = sizeof(struct sctp_authchunks) + num_chunks;
    1763 if (put_user(len, optlen))
    1764 return -EFAULT;
    1765 if (put_user(num_chunks, &p->gauth_number_of_chunks))
    1766 return -EFAULT;
    1767 - if (copy_to_user(to, ch->chunks, len))
    1768 - return -EFAULT;
    1769
    1770 return 0;
    1771 }
    1772 diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
    1773 index 0f8c439..5231f7a 100644
    1774 --- a/net/sunrpc/sysctl.c
    1775 +++ b/net/sunrpc/sysctl.c
    1776 @@ -60,24 +60,14 @@ static int proc_do_xprt(ctl_table *table, int write, struct file *file,
    1777 void __user *buffer, size_t *lenp, loff_t *ppos)
    1778 {
    1779 char tmpbuf[256];
    1780 - int len;
    1781 + size_t len;
    1782 +
    1783 if ((*ppos && !write) || !*lenp) {
    1784 *lenp = 0;
    1785 return 0;
    1786 }
    1787 - if (write)
    1788 - return -EINVAL;
    1789 - else {
    1790 - len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
    1791 - if (!access_ok(VERIFY_WRITE, buffer, len))
    1792 - return -EFAULT;
    1793 -
    1794 - if (__copy_to_user(buffer, tmpbuf, len))
    1795 - return -EFAULT;
    1796 - }
    1797 - *lenp -= len;
    1798 - *ppos += len;
    1799 - return 0;
    1800 + len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
    1801 + return simple_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
    1802 }
    1803
    1804 static int
    1805 diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
    1806 index 72fddaf..391f456 100644
    1807 --- a/net/xfrm/xfrm_state.c
    1808 +++ b/net/xfrm/xfrm_state.c
    1809 @@ -780,11 +780,13 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
    1810 {
    1811 unsigned int h;
    1812 struct hlist_node *entry;
    1813 - struct xfrm_state *x, *x0;
    1814 + struct xfrm_state *x, *x0, *to_put;
    1815 int acquire_in_progress = 0;
    1816 int error = 0;
    1817 struct xfrm_state *best = NULL;
    1818
    1819 + to_put = NULL;
    1820 +
    1821 spin_lock_bh(&xfrm_state_lock);
    1822 h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
    1823 hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
    1824 @@ -833,7 +835,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
    1825 if (tmpl->id.spi &&
    1826 (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
    1827 tmpl->id.proto, family)) != NULL) {
    1828 - xfrm_state_put(x0);
    1829 + to_put = x0;
    1830 error = -EEXIST;
    1831 goto out;
    1832 }
    1833 @@ -849,7 +851,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
    1834 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
    1835 if (error) {
    1836 x->km.state = XFRM_STATE_DEAD;
    1837 - xfrm_state_put(x);
    1838 + to_put = x;
    1839 x = NULL;
    1840 goto out;
    1841 }
    1842 @@ -870,7 +872,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
    1843 xfrm_hash_grow_check(x->bydst.next != NULL);
    1844 } else {
    1845 x->km.state = XFRM_STATE_DEAD;
    1846 - xfrm_state_put(x);
    1847 + to_put = x;
    1848 x = NULL;
    1849 error = -ESRCH;
    1850 }
    1851 @@ -881,6 +883,8 @@ out:
    1852 else
    1853 *err = acquire_in_progress ? -EAGAIN : error;
    1854 spin_unlock_bh(&xfrm_state_lock);
    1855 + if (to_put)
    1856 + xfrm_state_put(to_put);
    1857 return x;
    1858 }
    1859
    1860 @@ -1067,18 +1071,20 @@ static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
    1861
    1862 int xfrm_state_add(struct xfrm_state *x)
    1863 {
    1864 - struct xfrm_state *x1;
    1865 + struct xfrm_state *x1, *to_put;
    1866 int family;
    1867 int err;
    1868 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
    1869
    1870 family = x->props.family;
    1871
    1872 + to_put = NULL;
    1873 +
    1874 spin_lock_bh(&xfrm_state_lock);
    1875
    1876 x1 = __xfrm_state_locate(x, use_spi, family);
    1877 if (x1) {
    1878 - xfrm_state_put(x1);
    1879 + to_put = x1;
    1880 x1 = NULL;
    1881 err = -EEXIST;
    1882 goto out;
    1883 @@ -1088,7 +1094,7 @@ int xfrm_state_add(struct xfrm_state *x)
    1884 x1 = __xfrm_find_acq_byseq(x->km.seq);
    1885 if (x1 && ((x1->id.proto != x->id.proto) ||
    1886 xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
    1887 - xfrm_state_put(x1);
    1888 + to_put = x1;
    1889 x1 = NULL;
    1890 }
    1891 }
    1892 @@ -1110,6 +1116,9 @@ out:
    1893 xfrm_state_put(x1);
    1894 }
    1895
    1896 + if (to_put)
    1897 + xfrm_state_put(to_put);
    1898 +
    1899 return err;
    1900 }
    1901 EXPORT_SYMBOL(xfrm_state_add);
    1902 @@ -1269,10 +1278,12 @@ EXPORT_SYMBOL(xfrm_state_migrate);
    1903
    1904 int xfrm_state_update(struct xfrm_state *x)
    1905 {
    1906 - struct xfrm_state *x1;
    1907 + struct xfrm_state *x1, *to_put;
    1908 int err;
    1909 int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
    1910
    1911 + to_put = NULL;
    1912 +
    1913 spin_lock_bh(&xfrm_state_lock);
    1914 x1 = __xfrm_state_locate(x, use_spi, x->props.family);
    1915
    1916 @@ -1281,7 +1292,7 @@ int xfrm_state_update(struct xfrm_state *x)
    1917 goto out;
    1918
    1919 if (xfrm_state_kern(x1)) {
    1920 - xfrm_state_put(x1);
    1921 + to_put = x1;
    1922 err = -EEXIST;
    1923 goto out;
    1924 }
    1925 @@ -1295,6 +1306,9 @@ int xfrm_state_update(struct xfrm_state *x)
    1926 out:
    1927 spin_unlock_bh(&xfrm_state_lock);
    1928
    1929 + if (to_put)
    1930 + xfrm_state_put(to_put);
    1931 +
    1932 if (err)
    1933 return err;
    1934
    1935 diff --git a/sound/pci/oxygen/oxygen_mixer.c b/sound/pci/oxygen/oxygen_mixer.c
    1936 index 6facac5..05eb899 100644
    1937 --- a/sound/pci/oxygen/oxygen_mixer.c
    1938 +++ b/sound/pci/oxygen/oxygen_mixer.c
    1939 @@ -512,9 +512,12 @@ static int ac97_switch_get(struct snd_kcontrol *ctl,
    1940
    1941 static void mute_ac97_ctl(struct oxygen *chip, unsigned int control)
    1942 {
    1943 - unsigned int priv_idx = chip->controls[control]->private_value & 0xff;
    1944 + unsigned int priv_idx;
    1945 u16 value;
    1946
    1947 + if (!chip->controls[control])
    1948 + return;
    1949 + priv_idx = chip->controls[control]->private_value & 0xff;
    1950 value = oxygen_read_ac97(chip, 0, priv_idx);
    1951 if (!(value & 0x8000)) {
    1952 oxygen_write_ac97(chip, 0, priv_idx, value | 0x8000);