Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.27-r3/0141-2.6.27.42-all-fixes.patch

    Annotation of /trunk/kernel26-alx/patches-2.6.27-r3/0141-2.6.27.42-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1176 - (hide annotations) (download)
    Thu Oct 14 15:11:06 2010 UTC (13 years, 8 months ago) by niro
    File size: 21754 byte(s) 
    -2.6.27-alx-r3: new magellan 0.5.2 kernel
    1 niro 1176 diff --git a/arch/ia64/lib/ip_fast_csum.S b/arch/ia64/lib/ip_fast_csum.S
    2     index 1f86aeb..620d9dc 100644
    3     --- a/arch/ia64/lib/ip_fast_csum.S
    4     +++ b/arch/ia64/lib/ip_fast_csum.S
    5     @@ -96,20 +96,22 @@ END(ip_fast_csum)
    6     GLOBAL_ENTRY(csum_ipv6_magic)
    7     ld4 r20=[in0],4
    8     ld4 r21=[in1],4
    9     - dep r15=in3,in2,32,16
    10     + zxt4 in2=in2
    11     ;;
    12     ld4 r22=[in0],4
    13     ld4 r23=[in1],4
    14     - mux1 r15=r15,@rev
    15     + dep r15=in3,in2,32,16
    16     ;;
    17     ld4 r24=[in0],4
    18     ld4 r25=[in1],4
    19     - shr.u r15=r15,16
    20     + mux1 r15=r15,@rev
    21     add r16=r20,r21
    22     add r17=r22,r23
    23     + zxt4 in4=in4
    24     ;;
    25     ld4 r26=[in0],4
    26     ld4 r27=[in1],4
    27     + shr.u r15=r15,16
    28     add r18=r24,r25
    29     add r8=r16,r17
    30     ;;
    31     diff --git a/arch/x86/kernel/cpu/perfctr-watchdog.c b/arch/x86/kernel/cpu/perfctr-watchdog.c
    32     index 05cc22d..39040af 100644
    33     --- a/arch/x86/kernel/cpu/perfctr-watchdog.c
    34     +++ b/arch/x86/kernel/cpu/perfctr-watchdog.c
    35     @@ -646,7 +646,7 @@ static void probe_nmi_watchdog(void)
    36     switch (boot_cpu_data.x86_vendor) {
    37     case X86_VENDOR_AMD:
    38     if (boot_cpu_data.x86 != 6 && boot_cpu_data.x86 != 15 &&
    39     - boot_cpu_data.x86 != 16)
    40     + boot_cpu_data.x86 != 16 && boot_cpu_data.x86 != 17)
    41     return;
    42     wd_ops = &k7_wd_ops;
    43     break;
    44     diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
    45     index dcdac6c..34bc987 100644
    46     --- a/arch/x86/kernel/pci-calgary_64.c
    47     +++ b/arch/x86/kernel/pci-calgary_64.c
    48     @@ -377,13 +377,15 @@ static inline struct iommu_table *find_iommu_table(struct device *dev)
    49    
    50     pdev = to_pci_dev(dev);
    51    
    52     + /* search up the device tree for an iommu */
    53     pbus = pdev->bus;
    54     -
    55     - /* is the device behind a bridge? Look for the root bus */
    56     - while (pbus->parent)
    57     + do {
    58     + tbl = pci_iommu(pbus);
    59     + if (tbl && tbl->it_busno == pbus->number)
    60     + break;
    61     + tbl = NULL;
    62     pbus = pbus->parent;
    63     -
    64     - tbl = pci_iommu(pbus);
    65     + } while (pbus);
    66    
    67     BUG_ON(tbl && (tbl->it_busno != pbus->number));
    68    
    69     diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
    70     index 87d4d69..4b85cba 100644
    71     --- a/arch/x86/kernel/pci-dma.c
    72     +++ b/arch/x86/kernel/pci-dma.c
    73     @@ -175,7 +175,7 @@ static __init int iommu_setup(char *p)
    74     if (!strncmp(p, "allowdac", 8))
    75     forbid_dac = 0;
    76     if (!strncmp(p, "nodac", 5))
    77     - forbid_dac = -1;
    78     + forbid_dac = 1;
    79     if (!strncmp(p, "usedac", 6)) {
    80     forbid_dac = -1;
    81     return 1;
    82     diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
    83     index eed133e..625ead6 100644
    84     --- a/arch/x86/kernel/pci-gart_64.c
    85     +++ b/arch/x86/kernel/pci-gart_64.c
    86     @@ -865,7 +865,7 @@ void __init gart_parse_options(char *p)
    87     #endif
    88     if (isdigit(*p) && get_option(&p, &arg))
    89     iommu_size = arg;
    90     - if (!strncmp(p, "fullflush", 8))
    91     + if (!strncmp(p, "fullflush", 9))
    92     iommu_fullflush = 1;
    93     if (!strncmp(p, "nofullflush", 11))
    94     iommu_fullflush = 0;
    95     diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
    96     index 1177f10..f2e02b7 100644
    97     --- a/arch/x86/kernel/reboot.c
    98     +++ b/arch/x86/kernel/reboot.c
    99     @@ -219,6 +219,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
    100     DMI_MATCH(DMI_PRODUCT_NAME, "Dell XPS710"),
    101     },
    102     },
    103     + { /* Handle problems with rebooting on ASUS P4S800 */
    104     + .callback = set_bios_reboot,
    105     + .ident = "ASUS P4S800",
    106     + .matches = {
    107     + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
    108     + DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
    109     + },
    110     + },
    111     { }
    112     };
    113    
    114     diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
    115     index 233a5fd..2496c2b 100644
    116     --- a/drivers/ata/pata_hpt37x.c
    117     +++ b/drivers/ata/pata_hpt37x.c
    118     @@ -24,7 +24,7 @@
    119     #include <linux/libata.h>
    120    
    121     #define DRV_NAME "pata_hpt37x"
    122     -#define DRV_VERSION "0.6.12"
    123     +#define DRV_VERSION "0.6.14"
    124    
    125     struct hpt_clock {
    126     u8 xfer_speed;
    127     @@ -404,9 +404,8 @@ static void hpt370_set_piomode(struct ata_port *ap, struct ata_device *adev)
    128    
    129     pci_read_config_dword(pdev, addr1, &reg);
    130     mode = hpt37x_find_mode(ap, adev->pio_mode);
    131     - mode &= ~0x8000000; /* No FIFO in PIO */
    132     - mode &= ~0x30070000; /* Leave config bits alone */
    133     - reg &= 0x30070000; /* Strip timing bits */
    134     + mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
    135     + reg &= ~0xCFC3FFFF; /* Strip timing bits */
    136     pci_write_config_dword(pdev, addr1, reg | mode);
    137     }
    138    
    139     @@ -423,8 +422,7 @@ static void hpt370_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    140     {
    141     struct pci_dev *pdev = to_pci_dev(ap->host->dev);
    142     u32 addr1, addr2;
    143     - u32 reg;
    144     - u32 mode;
    145     + u32 reg, mode, mask;
    146     u8 fast;
    147    
    148     addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
    149     @@ -436,11 +434,12 @@ static void hpt370_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    150     fast |= 0x01;
    151     pci_write_config_byte(pdev, addr2, fast);
    152    
    153     + mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
    154     +
    155     pci_read_config_dword(pdev, addr1, &reg);
    156     mode = hpt37x_find_mode(ap, adev->dma_mode);
    157     - mode |= 0x8000000; /* FIFO in MWDMA or UDMA */
    158     - mode &= ~0xC0000000; /* Leave config bits alone */
    159     - reg &= 0xC0000000; /* Strip timing bits */
    160     + mode &= mask;
    161     + reg &= ~mask;
    162     pci_write_config_dword(pdev, addr1, reg | mode);
    163     }
    164    
    165     @@ -508,9 +507,8 @@ static void hpt372_set_piomode(struct ata_port *ap, struct ata_device *adev)
    166     mode = hpt37x_find_mode(ap, adev->pio_mode);
    167    
    168     printk("Find mode for %d reports %X\n", adev->pio_mode, mode);
    169     - mode &= ~0x80000000; /* No FIFO in PIO */
    170     - mode &= ~0x30070000; /* Leave config bits alone */
    171     - reg &= 0x30070000; /* Strip timing bits */
    172     + mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
    173     + reg &= ~0xCFC3FFFF; /* Strip timing bits */
    174     pci_write_config_dword(pdev, addr1, reg | mode);
    175     }
    176    
    177     @@ -527,8 +525,7 @@ static void hpt372_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    178     {
    179     struct pci_dev *pdev = to_pci_dev(ap->host->dev);
    180     u32 addr1, addr2;
    181     - u32 reg;
    182     - u32 mode;
    183     + u32 reg, mode, mask;
    184     u8 fast;
    185    
    186     addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
    187     @@ -539,12 +536,13 @@ static void hpt372_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    188     fast &= ~0x07;
    189     pci_write_config_byte(pdev, addr2, fast);
    190    
    191     + mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
    192     +
    193     pci_read_config_dword(pdev, addr1, &reg);
    194     mode = hpt37x_find_mode(ap, adev->dma_mode);
    195     printk("Find mode for DMA %d reports %X\n", adev->dma_mode, mode);
    196     - mode &= ~0xC0000000; /* Leave config bits alone */
    197     - mode |= 0x80000000; /* FIFO in MWDMA or UDMA */
    198     - reg &= 0xC0000000; /* Strip timing bits */
    199     + mode &= mask;
    200     + reg &= ~mask;
    201     pci_write_config_dword(pdev, addr1, reg | mode);
    202     }
    203    
    204     diff --git a/drivers/ata/pata_hpt3x2n.c b/drivers/ata/pata_hpt3x2n.c
    205     index d5c9fd7..5f9b60f 100644
    206     --- a/drivers/ata/pata_hpt3x2n.c
    207     +++ b/drivers/ata/pata_hpt3x2n.c
    208     @@ -25,7 +25,7 @@
    209     #include <linux/libata.h>
    210    
    211     #define DRV_NAME "pata_hpt3x2n"
    212     -#define DRV_VERSION "0.3.4"
    213     +#define DRV_VERSION "0.3.7"
    214    
    215     enum {
    216     HPT_PCI_FAST = (1 << 31),
    217     @@ -185,9 +185,8 @@ static void hpt3x2n_set_piomode(struct ata_port *ap, struct ata_device *adev)
    218    
    219     pci_read_config_dword(pdev, addr1, &reg);
    220     mode = hpt3x2n_find_mode(ap, adev->pio_mode);
    221     - mode &= ~0x8000000; /* No FIFO in PIO */
    222     - mode &= ~0x30070000; /* Leave config bits alone */
    223     - reg &= 0x30070000; /* Strip timing bits */
    224     + mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
    225     + reg &= ~0xCFC3FFFF; /* Strip timing bits */
    226     pci_write_config_dword(pdev, addr1, reg | mode);
    227     }
    228    
    229     @@ -204,8 +203,7 @@ static void hpt3x2n_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    230     {
    231     struct pci_dev *pdev = to_pci_dev(ap->host->dev);
    232     u32 addr1, addr2;
    233     - u32 reg;
    234     - u32 mode;
    235     + u32 reg, mode, mask;
    236     u8 fast;
    237    
    238     addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
    239     @@ -216,11 +214,12 @@ static void hpt3x2n_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    240     fast &= ~0x07;
    241     pci_write_config_byte(pdev, addr2, fast);
    242    
    243     + mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
    244     +
    245     pci_read_config_dword(pdev, addr1, &reg);
    246     mode = hpt3x2n_find_mode(ap, adev->dma_mode);
    247     - mode |= 0x8000000; /* FIFO in MWDMA or UDMA */
    248     - mode &= ~0xC0000000; /* Leave config bits alone */
    249     - reg &= 0xC0000000; /* Strip timing bits */
    250     + mode &= mask;
    251     + reg &= ~mask;
    252     pci_write_config_dword(pdev, addr1, reg | mode);
    253     }
    254    
    255     diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
    256     index cd589ca..6869310 100644
    257     --- a/drivers/firewire/fw-ohci.c
    258     +++ b/drivers/firewire/fw-ohci.c
    259     @@ -2146,6 +2146,13 @@ ohci_queue_iso_receive_dualbuffer(struct fw_iso_context *base,
    260     page = payload >> PAGE_SHIFT;
    261     offset = payload & ~PAGE_MASK;
    262     rest = p->payload_length;
    263     + /*
    264     + * The controllers I've tested have not worked correctly when
    265     + * second_req_count is zero. Rather than do something we know won't
    266     + * work, return an error
    267     + */
    268     + if (rest == 0)
    269     + return -EINVAL;
    270    
    271     /* FIXME: make packet-per-buffer/dual-buffer a context option */
    272     while (rest > 0) {
    273     @@ -2199,7 +2206,7 @@ ohci_queue_iso_receive_packet_per_buffer(struct fw_iso_context *base,
    274     unsigned long payload)
    275     {
    276     struct iso_context *ctx = container_of(base, struct iso_context, base);
    277     - struct descriptor *d = NULL, *pd = NULL;
    278     + struct descriptor *d, *pd;
    279     struct fw_iso_packet *p = packet;
    280     dma_addr_t d_bus, page_bus;
    281     u32 z, header_z, rest;
    282     @@ -2237,8 +2244,9 @@ ohci_queue_iso_receive_packet_per_buffer(struct fw_iso_context *base,
    283     d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d)));
    284    
    285     rest = payload_per_buffer;
    286     + pd = d;
    287     for (j = 1; j < z; j++) {
    288     - pd = d + j;
    289     + pd++;
    290     pd->control = cpu_to_le16(DESCRIPTOR_STATUS |
    291     DESCRIPTOR_INPUT_MORE);
    292    
    293     diff --git a/drivers/media/common/tuners/mxl5007t.c b/drivers/media/common/tuners/mxl5007t.c
    294     index cb25e43..4b975e6 100644
    295     --- a/drivers/media/common/tuners/mxl5007t.c
    296     +++ b/drivers/media/common/tuners/mxl5007t.c
    297     @@ -207,7 +207,7 @@ static void copy_reg_bits(struct reg_pair_t *reg_pair1,
    298     i = j = 0;
    299    
    300     while (reg_pair1[i].reg || reg_pair1[i].val) {
    301     - while (reg_pair2[j].reg || reg_pair2[j].reg) {
    302     + while (reg_pair2[j].reg || reg_pair2[j].val) {
    303     if (reg_pair1[i].reg != reg_pair2[j].reg) {
    304     j++;
    305     continue;
    306     diff --git a/drivers/ssb/sprom.c b/drivers/ssb/sprom.c
    307     index 3668edb..17471a7 100644
    308     --- a/drivers/ssb/sprom.c
    309     +++ b/drivers/ssb/sprom.c
    310     @@ -13,6 +13,8 @@
    311    
    312     #include "ssb_private.h"
    313    
    314     +#include <linux/ctype.h>
    315     +
    316    
    317     static int sprom2hex(const u16 *sprom, char *buf, size_t buf_len,
    318     size_t sprom_size_words)
    319     @@ -30,17 +32,27 @@ static int sprom2hex(const u16 *sprom, char *buf, size_t buf_len,
    320     static int hex2sprom(u16 *sprom, const char *dump, size_t len,
    321     size_t sprom_size_words)
    322     {
    323     - char tmp[5] = { 0 };
    324     - int cnt = 0;
    325     + char c, tmp[5] = { 0 };
    326     + int err, cnt = 0;
    327     unsigned long parsed;
    328    
    329     - if (len < sprom_size_words * 2)
    330     + /* Strip whitespace at the end. */
    331     + while (len) {
    332     + c = dump[len - 1];
    333     + if (!isspace(c) && c != '\0')
    334     + break;
    335     + len--;
    336     + }
    337     + /* Length must match exactly. */
    338     + if (len != sprom_size_words * 4)
    339     return -EINVAL;
    340    
    341     while (cnt < sprom_size_words) {
    342     memcpy(tmp, dump, 4);
    343     dump += 4;
    344     - parsed = simple_strtoul(tmp, NULL, 16);
    345     + err = strict_strtoul(tmp, 16, &parsed);
    346     + if (err)
    347     + return err;
    348     sprom[cnt++] = swab16((u16)parsed);
    349     }
    350    
    351     diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
    352     index e8a3938..1911589 100644
    353     --- a/drivers/usb/serial/mos7840.c
    354     +++ b/drivers/usb/serial/mos7840.c
    355     @@ -2453,9 +2453,14 @@ static int mos7840_startup(struct usb_serial *serial)
    356     mos7840_set_port_private(serial->port[i], mos7840_port);
    357     spin_lock_init(&mos7840_port->pool_lock);
    358    
    359     - mos7840_port->port_num = ((serial->port[i]->number -
    360     - (serial->port[i]->serial->minor)) +
    361     - 1);
    362     + /* minor is not initialised until later by
    363     + * usb-serial.c:get_free_serial() and cannot therefore be used
    364     + * to index device instances */
    365     + mos7840_port->port_num = i + 1;
    366     + dbg ("serial->port[i]->number = %d", serial->port[i]->number);
    367     + dbg ("serial->port[i]->serial->minor = %d", serial->port[i]->serial->minor);
    368     + dbg ("mos7840_port->port_num = %d", mos7840_port->port_num);
    369     + dbg ("serial->minor = %d", serial->minor);
    370    
    371     if (mos7840_port->port_num == 1) {
    372     mos7840_port->SpRegOffset = 0x0;
    373     @@ -2666,10 +2671,12 @@ static void mos7840_disconnect(struct usb_serial *serial)
    374    
    375     for (i = 0; i < serial->num_ports; ++i) {
    376     mos7840_port = mos7840_get_port_private(serial->port[i]);
    377     - spin_lock_irqsave(&mos7840_port->pool_lock, flags);
    378     - mos7840_port->zombie = 1;
    379     - spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
    380     - usb_kill_urb(mos7840_port->control_urb);
    381     + if (mos7840_port) {
    382     + spin_lock_irqsave(&mos7840_port->pool_lock, flags);
    383     + mos7840_port->zombie = 1;
    384     + spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
    385     + usb_kill_urb(mos7840_port->control_urb);
    386     + }
    387     }
    388    
    389     dbg("%s\n", "Thank u ::");
    390     diff --git a/drivers/video/backlight/lcd.c b/drivers/video/backlight/lcd.c
    391     index b15b2b8..b7c1a2c 100644
    392     --- a/drivers/video/backlight/lcd.c
    393     +++ b/drivers/video/backlight/lcd.c
    394     @@ -41,7 +41,7 @@ static int fb_notifier_callback(struct notifier_block *self,
    395    
    396     static int lcd_register_fb(struct lcd_device *ld)
    397     {
    398     - memset(&ld->fb_notif, 0, sizeof(&ld->fb_notif));
    399     + memset(&ld->fb_notif, 0, sizeof(ld->fb_notif));
    400     ld->fb_notif.notifier_call = fb_notifier_callback;
    401     return fb_register_client(&ld->fb_notif);
    402     }
    403     diff --git a/drivers/video/matrox/g450_pll.c b/drivers/video/matrox/g450_pll.c
    404     index d42346e..3dcb6d2 100644
    405     --- a/drivers/video/matrox/g450_pll.c
    406     +++ b/drivers/video/matrox/g450_pll.c
    407     @@ -341,7 +341,8 @@ static int __g450_setclk(WPMINFO unsigned int fout, unsigned int pll,
    408     M1064_XDVICLKCTRL_C1DVICLKEN |
    409     M1064_XDVICLKCTRL_DVILOOPCTL |
    410     M1064_XDVICLKCTRL_P1LOOPBWDTCTL;
    411     - matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp);
    412     + /* Setting this breaks PC systems so don't do it */
    413     + /* matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp); */
    414     matroxfb_DAC_out(PMINFO M1064_XPWRCTRL,
    415     xpwrctrl);
    416    
    417     diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
    418     index 08e28c9..1332dce 100644
    419     --- a/fs/debugfs/inode.c
    420     +++ b/fs/debugfs/inode.c
    421     @@ -32,7 +32,9 @@
    422     static struct vfsmount *debugfs_mount;
    423     static int debugfs_mount_count;
    424    
    425     -static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev)
    426     +static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev,
    427     + void *data, const struct file_operations *fops)
    428     +
    429     {
    430     struct inode *inode = new_inode(sb);
    431    
    432     @@ -47,14 +49,18 @@ static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t d
    433     init_special_inode(inode, mode, dev);
    434     break;
    435     case S_IFREG:
    436     - inode->i_fop = &debugfs_file_operations;
    437     + inode->i_fop = fops ? fops : &debugfs_file_operations;
    438     + inode->i_private = data;
    439     break;
    440     case S_IFLNK:
    441     inode->i_op = &debugfs_link_operations;
    442     + inode->i_fop = fops;
    443     + inode->i_private = data;
    444     break;
    445     case S_IFDIR:
    446     inode->i_op = &simple_dir_inode_operations;
    447     - inode->i_fop = &simple_dir_operations;
    448     + inode->i_fop = fops ? fops : &simple_dir_operations;
    449     + inode->i_private = data;
    450    
    451     /* directory inodes start off with i_nlink == 2
    452     * (for "." entry) */
    453     @@ -67,7 +73,8 @@ static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t d
    454    
    455     /* SMP-safe */
    456     static int debugfs_mknod(struct inode *dir, struct dentry *dentry,
    457     - int mode, dev_t dev)
    458     + int mode, dev_t dev, void *data,
    459     + const struct file_operations *fops)
    460     {
    461     struct inode *inode;
    462     int error = -EPERM;
    463     @@ -75,7 +82,7 @@ static int debugfs_mknod(struct inode *dir, struct dentry *dentry,
    464     if (dentry->d_inode)
    465     return -EEXIST;
    466    
    467     - inode = debugfs_get_inode(dir->i_sb, mode, dev);
    468     + inode = debugfs_get_inode(dir->i_sb, mode, dev, data, fops);
    469     if (inode) {
    470     d_instantiate(dentry, inode);
    471     dget(dentry);
    472     @@ -84,12 +91,13 @@ static int debugfs_mknod(struct inode *dir, struct dentry *dentry,
    473     return error;
    474     }
    475    
    476     -static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
    477     +static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode,
    478     + void *data, const struct file_operations *fops)
    479     {
    480     int res;
    481    
    482     mode = (mode & (S_IRWXUGO | S_ISVTX)) | S_IFDIR;
    483     - res = debugfs_mknod(dir, dentry, mode, 0);
    484     + res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
    485     if (!res) {
    486     inc_nlink(dir);
    487     fsnotify_mkdir(dir, dentry);
    488     @@ -97,18 +105,20 @@ static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
    489     return res;
    490     }
    491    
    492     -static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode)
    493     +static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode,
    494     + void *data, const struct file_operations *fops)
    495     {
    496     mode = (mode & S_IALLUGO) | S_IFLNK;
    497     - return debugfs_mknod(dir, dentry, mode, 0);
    498     + return debugfs_mknod(dir, dentry, mode, 0, data, fops);
    499     }
    500    
    501     -static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode)
    502     +static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode,
    503     + void *data, const struct file_operations *fops)
    504     {
    505     int res;
    506    
    507     mode = (mode & S_IALLUGO) | S_IFREG;
    508     - res = debugfs_mknod(dir, dentry, mode, 0);
    509     + res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
    510     if (!res)
    511     fsnotify_create(dir, dentry);
    512     return res;
    513     @@ -142,7 +152,9 @@ static struct file_system_type debug_fs_type = {
    514    
    515     static int debugfs_create_by_name(const char *name, mode_t mode,
    516     struct dentry *parent,
    517     - struct dentry **dentry)
    518     + struct dentry **dentry,
    519     + void *data,
    520     + const struct file_operations *fops)
    521     {
    522     int error = 0;
    523    
    524     @@ -167,13 +179,16 @@ static int debugfs_create_by_name(const char *name, mode_t mode,
    525     if (!IS_ERR(*dentry)) {
    526     switch (mode & S_IFMT) {
    527     case S_IFDIR:
    528     - error = debugfs_mkdir(parent->d_inode, *dentry, mode);
    529     + error = debugfs_mkdir(parent->d_inode, *dentry, mode,
    530     + data, fops);
    531     break;
    532     case S_IFLNK:
    533     - error = debugfs_link(parent->d_inode, *dentry, mode);
    534     + error = debugfs_link(parent->d_inode, *dentry, mode,
    535     + data, fops);
    536     break;
    537     default:
    538     - error = debugfs_create(parent->d_inode, *dentry, mode);
    539     + error = debugfs_create(parent->d_inode, *dentry, mode,
    540     + data, fops);
    541     break;
    542     }
    543     dput(*dentry);
    544     @@ -224,19 +239,13 @@ struct dentry *debugfs_create_file(const char *name, mode_t mode,
    545     if (error)
    546     goto exit;
    547    
    548     - error = debugfs_create_by_name(name, mode, parent, &dentry);
    549     + error = debugfs_create_by_name(name, mode, parent, &dentry,
    550     + data, fops);
    551     if (error) {
    552     dentry = NULL;
    553     simple_release_fs(&debugfs_mount, &debugfs_mount_count);
    554     goto exit;
    555     }
    556     -
    557     - if (dentry->d_inode) {
    558     - if (data)
    559     - dentry->d_inode->i_private = data;
    560     - if (fops)
    561     - dentry->d_inode->i_fop = fops;
    562     - }
    563     exit:
    564     return dentry;
    565     }
    566     diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c
    567     index 6d98f11..424b033 100644
    568     --- a/fs/hfs/catalog.c
    569     +++ b/fs/hfs/catalog.c
    570     @@ -289,6 +289,10 @@ int hfs_cat_move(u32 cnid, struct inode *src_dir, struct qstr *src_name,
    571     err = hfs_brec_find(&src_fd);
    572     if (err)
    573     goto out;
    574     + if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
    575     + err = -EIO;
    576     + goto out;
    577     + }
    578    
    579     hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
    580     src_fd.entrylength);
    581     diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
    582     index 7c69b98..2b3b861 100644
    583     --- a/fs/hfs/dir.c
    584     +++ b/fs/hfs/dir.c
    585     @@ -79,6 +79,11 @@ static int hfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
    586     filp->f_pos++;
    587     /* fall through */
    588     case 1:
    589     + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
    590     + err = -EIO;
    591     + goto out;
    592     + }
    593     +
    594     hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
    595     if (entry.type != HFS_CDR_THD) {
    596     printk(KERN_ERR "hfs: bad catalog folder thread\n");
    597     @@ -109,6 +114,12 @@ static int hfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
    598     err = -EIO;
    599     goto out;
    600     }
    601     +
    602     + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
    603     + err = -EIO;
    604     + goto out;
    605     + }
    606     +
    607     hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
    608     type = entry.type;
    609     len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName);
    610     diff --git a/fs/hfs/super.c b/fs/hfs/super.c
    611     index 4abb104..cd0d15d 100644
    612     --- a/fs/hfs/super.c
    613     +++ b/fs/hfs/super.c
    614     @@ -386,8 +386,13 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
    615     /* try to get the root inode */
    616     hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
    617     res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd);
    618     - if (!res)
    619     + if (!res) {
    620     + if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
    621     + res = -EIO;
    622     + goto bail;
    623     + }
    624     hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
    625     + }
    626     if (res) {
    627     hfs_find_exit(&fd);
    628     goto bail_no_root;
    629     diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c
    630     index 090c556..3b6f2fa 100644
    631     --- a/fs/jffs2/gc.c
    632     +++ b/fs/jffs2/gc.c
    633     @@ -700,7 +700,8 @@ static int jffs2_garbage_collect_metadata(struct jffs2_sb_info *c, struct jffs2_
    634     struct jffs2_raw_inode ri;
    635     struct jffs2_node_frag *last_frag;
    636     union jffs2_device_node dev;
    637     - char *mdata = NULL, mdatalen = 0;
    638     + char *mdata = NULL;
    639     + int mdatalen = 0;
    640     uint32_t alloclen, ilen;
    641     int ret;
    642    
    643     diff --git a/include/linux/sched.h b/include/linux/sched.h
    644     index 09c5851..ebe801e 100644
    645     --- a/include/linux/sched.h
    646     +++ b/include/linux/sched.h
    647     @@ -1803,11 +1803,18 @@ static inline int is_si_special(const struct siginfo *info)
    648     return info <= SEND_SIG_FORCED;
    649     }
    650    
    651     -/* True if we are on the alternate signal stack. */
    652     -
    653     +/*
    654     + * True if we are on the alternate signal stack.
    655     + */
    656     static inline int on_sig_stack(unsigned long sp)
    657     {
    658     - return (sp - current->sas_ss_sp < current->sas_ss_size);
    659     +#ifdef CONFIG_STACK_GROWSUP
    660     + return sp >= current->sas_ss_sp &&
    661     + sp - current->sas_ss_sp < current->sas_ss_size;
    662     +#else
    663     + return sp > current->sas_ss_sp &&
    664     + sp - current->sas_ss_sp <= current->sas_ss_size;
    665     +#endif
    666     }
    667    
    668     static inline int sas_ss_flags(unsigned long sp)