Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.27-r3/0141-2.6.27.42-all-fixes.patch

    Contents of /trunk/kernel26-alx/patches-2.6.27-r3/0141-2.6.27.42-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1176 - (show annotations) (download)
    Thu Oct 14 15:11:06 2010 UTC (13 years, 6 months ago) by niro
    File size: 21754 byte(s) 
    -2.6.27-alx-r3: new magellan 0.5.2 kernel
    1 diff --git a/arch/ia64/lib/ip_fast_csum.S b/arch/ia64/lib/ip_fast_csum.S
    2 index 1f86aeb..620d9dc 100644
    3 --- a/arch/ia64/lib/ip_fast_csum.S
    4 +++ b/arch/ia64/lib/ip_fast_csum.S
    5 @@ -96,20 +96,22 @@ END(ip_fast_csum)
    6 GLOBAL_ENTRY(csum_ipv6_magic)
    7 ld4 r20=[in0],4
    8 ld4 r21=[in1],4
    9 - dep r15=in3,in2,32,16
    10 + zxt4 in2=in2
    11 ;;
    12 ld4 r22=[in0],4
    13 ld4 r23=[in1],4
    14 - mux1 r15=r15,@rev
    15 + dep r15=in3,in2,32,16
    16 ;;
    17 ld4 r24=[in0],4
    18 ld4 r25=[in1],4
    19 - shr.u r15=r15,16
    20 + mux1 r15=r15,@rev
    21 add r16=r20,r21
    22 add r17=r22,r23
    23 + zxt4 in4=in4
    24 ;;
    25 ld4 r26=[in0],4
    26 ld4 r27=[in1],4
    27 + shr.u r15=r15,16
    28 add r18=r24,r25
    29 add r8=r16,r17
    30 ;;
    31 diff --git a/arch/x86/kernel/cpu/perfctr-watchdog.c b/arch/x86/kernel/cpu/perfctr-watchdog.c
    32 index 05cc22d..39040af 100644
    33 --- a/arch/x86/kernel/cpu/perfctr-watchdog.c
    34 +++ b/arch/x86/kernel/cpu/perfctr-watchdog.c
    35 @@ -646,7 +646,7 @@ static void probe_nmi_watchdog(void)
    36 switch (boot_cpu_data.x86_vendor) {
    37 case X86_VENDOR_AMD:
    38 if (boot_cpu_data.x86 != 6 && boot_cpu_data.x86 != 15 &&
    39 - boot_cpu_data.x86 != 16)
    40 + boot_cpu_data.x86 != 16 && boot_cpu_data.x86 != 17)
    41 return;
    42 wd_ops = &k7_wd_ops;
    43 break;
    44 diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
    45 index dcdac6c..34bc987 100644
    46 --- a/arch/x86/kernel/pci-calgary_64.c
    47 +++ b/arch/x86/kernel/pci-calgary_64.c
    48 @@ -377,13 +377,15 @@ static inline struct iommu_table *find_iommu_table(struct device *dev)
    49
    50 pdev = to_pci_dev(dev);
    51
    52 + /* search up the device tree for an iommu */
    53 pbus = pdev->bus;
    54 -
    55 - /* is the device behind a bridge? Look for the root bus */
    56 - while (pbus->parent)
    57 + do {
    58 + tbl = pci_iommu(pbus);
    59 + if (tbl && tbl->it_busno == pbus->number)
    60 + break;
    61 + tbl = NULL;
    62 pbus = pbus->parent;
    63 -
    64 - tbl = pci_iommu(pbus);
    65 + } while (pbus);
    66
    67 BUG_ON(tbl && (tbl->it_busno != pbus->number));
    68
    69 diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
    70 index 87d4d69..4b85cba 100644
    71 --- a/arch/x86/kernel/pci-dma.c
    72 +++ b/arch/x86/kernel/pci-dma.c
    73 @@ -175,7 +175,7 @@ static __init int iommu_setup(char *p)
    74 if (!strncmp(p, "allowdac", 8))
    75 forbid_dac = 0;
    76 if (!strncmp(p, "nodac", 5))
    77 - forbid_dac = -1;
    78 + forbid_dac = 1;
    79 if (!strncmp(p, "usedac", 6)) {
    80 forbid_dac = -1;
    81 return 1;
    82 diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
    83 index eed133e..625ead6 100644
    84 --- a/arch/x86/kernel/pci-gart_64.c
    85 +++ b/arch/x86/kernel/pci-gart_64.c
    86 @@ -865,7 +865,7 @@ void __init gart_parse_options(char *p)
    87 #endif
    88 if (isdigit(*p) && get_option(&p, &arg))
    89 iommu_size = arg;
    90 - if (!strncmp(p, "fullflush", 8))
    91 + if (!strncmp(p, "fullflush", 9))
    92 iommu_fullflush = 1;
    93 if (!strncmp(p, "nofullflush", 11))
    94 iommu_fullflush = 0;
    95 diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
    96 index 1177f10..f2e02b7 100644
    97 --- a/arch/x86/kernel/reboot.c
    98 +++ b/arch/x86/kernel/reboot.c
    99 @@ -219,6 +219,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
    100 DMI_MATCH(DMI_PRODUCT_NAME, "Dell XPS710"),
    101 },
    102 },
    103 + { /* Handle problems with rebooting on ASUS P4S800 */
    104 + .callback = set_bios_reboot,
    105 + .ident = "ASUS P4S800",
    106 + .matches = {
    107 + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
    108 + DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
    109 + },
    110 + },
    111 { }
    112 };
    113
    114 diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
    115 index 233a5fd..2496c2b 100644
    116 --- a/drivers/ata/pata_hpt37x.c
    117 +++ b/drivers/ata/pata_hpt37x.c
    118 @@ -24,7 +24,7 @@
    119 #include <linux/libata.h>
    120
    121 #define DRV_NAME "pata_hpt37x"
    122 -#define DRV_VERSION "0.6.12"
    123 +#define DRV_VERSION "0.6.14"
    124
    125 struct hpt_clock {
    126 u8 xfer_speed;
    127 @@ -404,9 +404,8 @@ static void hpt370_set_piomode(struct ata_port *ap, struct ata_device *adev)
    128
    129 pci_read_config_dword(pdev, addr1, &reg);
    130 mode = hpt37x_find_mode(ap, adev->pio_mode);
    131 - mode &= ~0x8000000; /* No FIFO in PIO */
    132 - mode &= ~0x30070000; /* Leave config bits alone */
    133 - reg &= 0x30070000; /* Strip timing bits */
    134 + mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
    135 + reg &= ~0xCFC3FFFF; /* Strip timing bits */
    136 pci_write_config_dword(pdev, addr1, reg | mode);
    137 }
    138
    139 @@ -423,8 +422,7 @@ static void hpt370_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    140 {
    141 struct pci_dev *pdev = to_pci_dev(ap->host->dev);
    142 u32 addr1, addr2;
    143 - u32 reg;
    144 - u32 mode;
    145 + u32 reg, mode, mask;
    146 u8 fast;
    147
    148 addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
    149 @@ -436,11 +434,12 @@ static void hpt370_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    150 fast |= 0x01;
    151 pci_write_config_byte(pdev, addr2, fast);
    152
    153 + mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
    154 +
    155 pci_read_config_dword(pdev, addr1, &reg);
    156 mode = hpt37x_find_mode(ap, adev->dma_mode);
    157 - mode |= 0x8000000; /* FIFO in MWDMA or UDMA */
    158 - mode &= ~0xC0000000; /* Leave config bits alone */
    159 - reg &= 0xC0000000; /* Strip timing bits */
    160 + mode &= mask;
    161 + reg &= ~mask;
    162 pci_write_config_dword(pdev, addr1, reg | mode);
    163 }
    164
    165 @@ -508,9 +507,8 @@ static void hpt372_set_piomode(struct ata_port *ap, struct ata_device *adev)
    166 mode = hpt37x_find_mode(ap, adev->pio_mode);
    167
    168 printk("Find mode for %d reports %X\n", adev->pio_mode, mode);
    169 - mode &= ~0x80000000; /* No FIFO in PIO */
    170 - mode &= ~0x30070000; /* Leave config bits alone */
    171 - reg &= 0x30070000; /* Strip timing bits */
    172 + mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
    173 + reg &= ~0xCFC3FFFF; /* Strip timing bits */
    174 pci_write_config_dword(pdev, addr1, reg | mode);
    175 }
    176
    177 @@ -527,8 +525,7 @@ static void hpt372_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    178 {
    179 struct pci_dev *pdev = to_pci_dev(ap->host->dev);
    180 u32 addr1, addr2;
    181 - u32 reg;
    182 - u32 mode;
    183 + u32 reg, mode, mask;
    184 u8 fast;
    185
    186 addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
    187 @@ -539,12 +536,13 @@ static void hpt372_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    188 fast &= ~0x07;
    189 pci_write_config_byte(pdev, addr2, fast);
    190
    191 + mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
    192 +
    193 pci_read_config_dword(pdev, addr1, &reg);
    194 mode = hpt37x_find_mode(ap, adev->dma_mode);
    195 printk("Find mode for DMA %d reports %X\n", adev->dma_mode, mode);
    196 - mode &= ~0xC0000000; /* Leave config bits alone */
    197 - mode |= 0x80000000; /* FIFO in MWDMA or UDMA */
    198 - reg &= 0xC0000000; /* Strip timing bits */
    199 + mode &= mask;
    200 + reg &= ~mask;
    201 pci_write_config_dword(pdev, addr1, reg | mode);
    202 }
    203
    204 diff --git a/drivers/ata/pata_hpt3x2n.c b/drivers/ata/pata_hpt3x2n.c
    205 index d5c9fd7..5f9b60f 100644
    206 --- a/drivers/ata/pata_hpt3x2n.c
    207 +++ b/drivers/ata/pata_hpt3x2n.c
    208 @@ -25,7 +25,7 @@
    209 #include <linux/libata.h>
    210
    211 #define DRV_NAME "pata_hpt3x2n"
    212 -#define DRV_VERSION "0.3.4"
    213 +#define DRV_VERSION "0.3.7"
    214
    215 enum {
    216 HPT_PCI_FAST = (1 << 31),
    217 @@ -185,9 +185,8 @@ static void hpt3x2n_set_piomode(struct ata_port *ap, struct ata_device *adev)
    218
    219 pci_read_config_dword(pdev, addr1, &reg);
    220 mode = hpt3x2n_find_mode(ap, adev->pio_mode);
    221 - mode &= ~0x8000000; /* No FIFO in PIO */
    222 - mode &= ~0x30070000; /* Leave config bits alone */
    223 - reg &= 0x30070000; /* Strip timing bits */
    224 + mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
    225 + reg &= ~0xCFC3FFFF; /* Strip timing bits */
    226 pci_write_config_dword(pdev, addr1, reg | mode);
    227 }
    228
    229 @@ -204,8 +203,7 @@ static void hpt3x2n_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    230 {
    231 struct pci_dev *pdev = to_pci_dev(ap->host->dev);
    232 u32 addr1, addr2;
    233 - u32 reg;
    234 - u32 mode;
    235 + u32 reg, mode, mask;
    236 u8 fast;
    237
    238 addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
    239 @@ -216,11 +214,12 @@ static void hpt3x2n_set_dmamode(struct ata_port *ap, struct ata_device *adev)
    240 fast &= ~0x07;
    241 pci_write_config_byte(pdev, addr2, fast);
    242
    243 + mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
    244 +
    245 pci_read_config_dword(pdev, addr1, &reg);
    246 mode = hpt3x2n_find_mode(ap, adev->dma_mode);
    247 - mode |= 0x8000000; /* FIFO in MWDMA or UDMA */
    248 - mode &= ~0xC0000000; /* Leave config bits alone */
    249 - reg &= 0xC0000000; /* Strip timing bits */
    250 + mode &= mask;
    251 + reg &= ~mask;
    252 pci_write_config_dword(pdev, addr1, reg | mode);
    253 }
    254
    255 diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
    256 index cd589ca..6869310 100644
    257 --- a/drivers/firewire/fw-ohci.c
    258 +++ b/drivers/firewire/fw-ohci.c
    259 @@ -2146,6 +2146,13 @@ ohci_queue_iso_receive_dualbuffer(struct fw_iso_context *base,
    260 page = payload >> PAGE_SHIFT;
    261 offset = payload & ~PAGE_MASK;
    262 rest = p->payload_length;
    263 + /*
    264 + * The controllers I've tested have not worked correctly when
    265 + * second_req_count is zero. Rather than do something we know won't
    266 + * work, return an error
    267 + */
    268 + if (rest == 0)
    269 + return -EINVAL;
    270
    271 /* FIXME: make packet-per-buffer/dual-buffer a context option */
    272 while (rest > 0) {
    273 @@ -2199,7 +2206,7 @@ ohci_queue_iso_receive_packet_per_buffer(struct fw_iso_context *base,
    274 unsigned long payload)
    275 {
    276 struct iso_context *ctx = container_of(base, struct iso_context, base);
    277 - struct descriptor *d = NULL, *pd = NULL;
    278 + struct descriptor *d, *pd;
    279 struct fw_iso_packet *p = packet;
    280 dma_addr_t d_bus, page_bus;
    281 u32 z, header_z, rest;
    282 @@ -2237,8 +2244,9 @@ ohci_queue_iso_receive_packet_per_buffer(struct fw_iso_context *base,
    283 d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d)));
    284
    285 rest = payload_per_buffer;
    286 + pd = d;
    287 for (j = 1; j < z; j++) {
    288 - pd = d + j;
    289 + pd++;
    290 pd->control = cpu_to_le16(DESCRIPTOR_STATUS |
    291 DESCRIPTOR_INPUT_MORE);
    292
    293 diff --git a/drivers/media/common/tuners/mxl5007t.c b/drivers/media/common/tuners/mxl5007t.c
    294 index cb25e43..4b975e6 100644
    295 --- a/drivers/media/common/tuners/mxl5007t.c
    296 +++ b/drivers/media/common/tuners/mxl5007t.c
    297 @@ -207,7 +207,7 @@ static void copy_reg_bits(struct reg_pair_t *reg_pair1,
    298 i = j = 0;
    299
    300 while (reg_pair1[i].reg || reg_pair1[i].val) {
    301 - while (reg_pair2[j].reg || reg_pair2[j].reg) {
    302 + while (reg_pair2[j].reg || reg_pair2[j].val) {
    303 if (reg_pair1[i].reg != reg_pair2[j].reg) {
    304 j++;
    305 continue;
    306 diff --git a/drivers/ssb/sprom.c b/drivers/ssb/sprom.c
    307 index 3668edb..17471a7 100644
    308 --- a/drivers/ssb/sprom.c
    309 +++ b/drivers/ssb/sprom.c
    310 @@ -13,6 +13,8 @@
    311
    312 #include "ssb_private.h"
    313
    314 +#include <linux/ctype.h>
    315 +
    316
    317 static int sprom2hex(const u16 *sprom, char *buf, size_t buf_len,
    318 size_t sprom_size_words)
    319 @@ -30,17 +32,27 @@ static int sprom2hex(const u16 *sprom, char *buf, size_t buf_len,
    320 static int hex2sprom(u16 *sprom, const char *dump, size_t len,
    321 size_t sprom_size_words)
    322 {
    323 - char tmp[5] = { 0 };
    324 - int cnt = 0;
    325 + char c, tmp[5] = { 0 };
    326 + int err, cnt = 0;
    327 unsigned long parsed;
    328
    329 - if (len < sprom_size_words * 2)
    330 + /* Strip whitespace at the end. */
    331 + while (len) {
    332 + c = dump[len - 1];
    333 + if (!isspace(c) && c != '\0')
    334 + break;
    335 + len--;
    336 + }
    337 + /* Length must match exactly. */
    338 + if (len != sprom_size_words * 4)
    339 return -EINVAL;
    340
    341 while (cnt < sprom_size_words) {
    342 memcpy(tmp, dump, 4);
    343 dump += 4;
    344 - parsed = simple_strtoul(tmp, NULL, 16);
    345 + err = strict_strtoul(tmp, 16, &parsed);
    346 + if (err)
    347 + return err;
    348 sprom[cnt++] = swab16((u16)parsed);
    349 }
    350
    351 diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
    352 index e8a3938..1911589 100644
    353 --- a/drivers/usb/serial/mos7840.c
    354 +++ b/drivers/usb/serial/mos7840.c
    355 @@ -2453,9 +2453,14 @@ static int mos7840_startup(struct usb_serial *serial)
    356 mos7840_set_port_private(serial->port[i], mos7840_port);
    357 spin_lock_init(&mos7840_port->pool_lock);
    358
    359 - mos7840_port->port_num = ((serial->port[i]->number -
    360 - (serial->port[i]->serial->minor)) +
    361 - 1);
    362 + /* minor is not initialised until later by
    363 + * usb-serial.c:get_free_serial() and cannot therefore be used
    364 + * to index device instances */
    365 + mos7840_port->port_num = i + 1;
    366 + dbg ("serial->port[i]->number = %d", serial->port[i]->number);
    367 + dbg ("serial->port[i]->serial->minor = %d", serial->port[i]->serial->minor);
    368 + dbg ("mos7840_port->port_num = %d", mos7840_port->port_num);
    369 + dbg ("serial->minor = %d", serial->minor);
    370
    371 if (mos7840_port->port_num == 1) {
    372 mos7840_port->SpRegOffset = 0x0;
    373 @@ -2666,10 +2671,12 @@ static void mos7840_disconnect(struct usb_serial *serial)
    374
    375 for (i = 0; i < serial->num_ports; ++i) {
    376 mos7840_port = mos7840_get_port_private(serial->port[i]);
    377 - spin_lock_irqsave(&mos7840_port->pool_lock, flags);
    378 - mos7840_port->zombie = 1;
    379 - spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
    380 - usb_kill_urb(mos7840_port->control_urb);
    381 + if (mos7840_port) {
    382 + spin_lock_irqsave(&mos7840_port->pool_lock, flags);
    383 + mos7840_port->zombie = 1;
    384 + spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
    385 + usb_kill_urb(mos7840_port->control_urb);
    386 + }
    387 }
    388
    389 dbg("%s\n", "Thank u ::");
    390 diff --git a/drivers/video/backlight/lcd.c b/drivers/video/backlight/lcd.c
    391 index b15b2b8..b7c1a2c 100644
    392 --- a/drivers/video/backlight/lcd.c
    393 +++ b/drivers/video/backlight/lcd.c
    394 @@ -41,7 +41,7 @@ static int fb_notifier_callback(struct notifier_block *self,
    395
    396 static int lcd_register_fb(struct lcd_device *ld)
    397 {
    398 - memset(&ld->fb_notif, 0, sizeof(&ld->fb_notif));
    399 + memset(&ld->fb_notif, 0, sizeof(ld->fb_notif));
    400 ld->fb_notif.notifier_call = fb_notifier_callback;
    401 return fb_register_client(&ld->fb_notif);
    402 }
    403 diff --git a/drivers/video/matrox/g450_pll.c b/drivers/video/matrox/g450_pll.c
    404 index d42346e..3dcb6d2 100644
    405 --- a/drivers/video/matrox/g450_pll.c
    406 +++ b/drivers/video/matrox/g450_pll.c
    407 @@ -341,7 +341,8 @@ static int __g450_setclk(WPMINFO unsigned int fout, unsigned int pll,
    408 M1064_XDVICLKCTRL_C1DVICLKEN |
    409 M1064_XDVICLKCTRL_DVILOOPCTL |
    410 M1064_XDVICLKCTRL_P1LOOPBWDTCTL;
    411 - matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp);
    412 + /* Setting this breaks PC systems so don't do it */
    413 + /* matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp); */
    414 matroxfb_DAC_out(PMINFO M1064_XPWRCTRL,
    415 xpwrctrl);
    416
    417 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
    418 index 08e28c9..1332dce 100644
    419 --- a/fs/debugfs/inode.c
    420 +++ b/fs/debugfs/inode.c
    421 @@ -32,7 +32,9 @@
    422 static struct vfsmount *debugfs_mount;
    423 static int debugfs_mount_count;
    424
    425 -static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev)
    426 +static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev,
    427 + void *data, const struct file_operations *fops)
    428 +
    429 {
    430 struct inode *inode = new_inode(sb);
    431
    432 @@ -47,14 +49,18 @@ static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t d
    433 init_special_inode(inode, mode, dev);
    434 break;
    435 case S_IFREG:
    436 - inode->i_fop = &debugfs_file_operations;
    437 + inode->i_fop = fops ? fops : &debugfs_file_operations;
    438 + inode->i_private = data;
    439 break;
    440 case S_IFLNK:
    441 inode->i_op = &debugfs_link_operations;
    442 + inode->i_fop = fops;
    443 + inode->i_private = data;
    444 break;
    445 case S_IFDIR:
    446 inode->i_op = &simple_dir_inode_operations;
    447 - inode->i_fop = &simple_dir_operations;
    448 + inode->i_fop = fops ? fops : &simple_dir_operations;
    449 + inode->i_private = data;
    450
    451 /* directory inodes start off with i_nlink == 2
    452 * (for "." entry) */
    453 @@ -67,7 +73,8 @@ static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t d
    454
    455 /* SMP-safe */
    456 static int debugfs_mknod(struct inode *dir, struct dentry *dentry,
    457 - int mode, dev_t dev)
    458 + int mode, dev_t dev, void *data,
    459 + const struct file_operations *fops)
    460 {
    461 struct inode *inode;
    462 int error = -EPERM;
    463 @@ -75,7 +82,7 @@ static int debugfs_mknod(struct inode *dir, struct dentry *dentry,
    464 if (dentry->d_inode)
    465 return -EEXIST;
    466
    467 - inode = debugfs_get_inode(dir->i_sb, mode, dev);
    468 + inode = debugfs_get_inode(dir->i_sb, mode, dev, data, fops);
    469 if (inode) {
    470 d_instantiate(dentry, inode);
    471 dget(dentry);
    472 @@ -84,12 +91,13 @@ static int debugfs_mknod(struct inode *dir, struct dentry *dentry,
    473 return error;
    474 }
    475
    476 -static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
    477 +static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode,
    478 + void *data, const struct file_operations *fops)
    479 {
    480 int res;
    481
    482 mode = (mode & (S_IRWXUGO | S_ISVTX)) | S_IFDIR;
    483 - res = debugfs_mknod(dir, dentry, mode, 0);
    484 + res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
    485 if (!res) {
    486 inc_nlink(dir);
    487 fsnotify_mkdir(dir, dentry);
    488 @@ -97,18 +105,20 @@ static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
    489 return res;
    490 }
    491
    492 -static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode)
    493 +static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode,
    494 + void *data, const struct file_operations *fops)
    495 {
    496 mode = (mode & S_IALLUGO) | S_IFLNK;
    497 - return debugfs_mknod(dir, dentry, mode, 0);
    498 + return debugfs_mknod(dir, dentry, mode, 0, data, fops);
    499 }
    500
    501 -static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode)
    502 +static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode,
    503 + void *data, const struct file_operations *fops)
    504 {
    505 int res;
    506
    507 mode = (mode & S_IALLUGO) | S_IFREG;
    508 - res = debugfs_mknod(dir, dentry, mode, 0);
    509 + res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
    510 if (!res)
    511 fsnotify_create(dir, dentry);
    512 return res;
    513 @@ -142,7 +152,9 @@ static struct file_system_type debug_fs_type = {
    514
    515 static int debugfs_create_by_name(const char *name, mode_t mode,
    516 struct dentry *parent,
    517 - struct dentry **dentry)
    518 + struct dentry **dentry,
    519 + void *data,
    520 + const struct file_operations *fops)
    521 {
    522 int error = 0;
    523
    524 @@ -167,13 +179,16 @@ static int debugfs_create_by_name(const char *name, mode_t mode,
    525 if (!IS_ERR(*dentry)) {
    526 switch (mode & S_IFMT) {
    527 case S_IFDIR:
    528 - error = debugfs_mkdir(parent->d_inode, *dentry, mode);
    529 + error = debugfs_mkdir(parent->d_inode, *dentry, mode,
    530 + data, fops);
    531 break;
    532 case S_IFLNK:
    533 - error = debugfs_link(parent->d_inode, *dentry, mode);
    534 + error = debugfs_link(parent->d_inode, *dentry, mode,
    535 + data, fops);
    536 break;
    537 default:
    538 - error = debugfs_create(parent->d_inode, *dentry, mode);
    539 + error = debugfs_create(parent->d_inode, *dentry, mode,
    540 + data, fops);
    541 break;
    542 }
    543 dput(*dentry);
    544 @@ -224,19 +239,13 @@ struct dentry *debugfs_create_file(const char *name, mode_t mode,
    545 if (error)
    546 goto exit;
    547
    548 - error = debugfs_create_by_name(name, mode, parent, &dentry);
    549 + error = debugfs_create_by_name(name, mode, parent, &dentry,
    550 + data, fops);
    551 if (error) {
    552 dentry = NULL;
    553 simple_release_fs(&debugfs_mount, &debugfs_mount_count);
    554 goto exit;
    555 }
    556 -
    557 - if (dentry->d_inode) {
    558 - if (data)
    559 - dentry->d_inode->i_private = data;
    560 - if (fops)
    561 - dentry->d_inode->i_fop = fops;
    562 - }
    563 exit:
    564 return dentry;
    565 }
    566 diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c
    567 index 6d98f11..424b033 100644
    568 --- a/fs/hfs/catalog.c
    569 +++ b/fs/hfs/catalog.c
    570 @@ -289,6 +289,10 @@ int hfs_cat_move(u32 cnid, struct inode *src_dir, struct qstr *src_name,
    571 err = hfs_brec_find(&src_fd);
    572 if (err)
    573 goto out;
    574 + if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
    575 + err = -EIO;
    576 + goto out;
    577 + }
    578
    579 hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
    580 src_fd.entrylength);
    581 diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
    582 index 7c69b98..2b3b861 100644
    583 --- a/fs/hfs/dir.c
    584 +++ b/fs/hfs/dir.c
    585 @@ -79,6 +79,11 @@ static int hfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
    586 filp->f_pos++;
    587 /* fall through */
    588 case 1:
    589 + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
    590 + err = -EIO;
    591 + goto out;
    592 + }
    593 +
    594 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
    595 if (entry.type != HFS_CDR_THD) {
    596 printk(KERN_ERR "hfs: bad catalog folder thread\n");
    597 @@ -109,6 +114,12 @@ static int hfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
    598 err = -EIO;
    599 goto out;
    600 }
    601 +
    602 + if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
    603 + err = -EIO;
    604 + goto out;
    605 + }
    606 +
    607 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
    608 type = entry.type;
    609 len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName);
    610 diff --git a/fs/hfs/super.c b/fs/hfs/super.c
    611 index 4abb104..cd0d15d 100644
    612 --- a/fs/hfs/super.c
    613 +++ b/fs/hfs/super.c
    614 @@ -386,8 +386,13 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
    615 /* try to get the root inode */
    616 hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
    617 res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd);
    618 - if (!res)
    619 + if (!res) {
    620 + if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
    621 + res = -EIO;
    622 + goto bail;
    623 + }
    624 hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
    625 + }
    626 if (res) {
    627 hfs_find_exit(&fd);
    628 goto bail_no_root;
    629 diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c
    630 index 090c556..3b6f2fa 100644
    631 --- a/fs/jffs2/gc.c
    632 +++ b/fs/jffs2/gc.c
    633 @@ -700,7 +700,8 @@ static int jffs2_garbage_collect_metadata(struct jffs2_sb_info *c, struct jffs2_
    634 struct jffs2_raw_inode ri;
    635 struct jffs2_node_frag *last_frag;
    636 union jffs2_device_node dev;
    637 - char *mdata = NULL, mdatalen = 0;
    638 + char *mdata = NULL;
    639 + int mdatalen = 0;
    640 uint32_t alloclen, ilen;
    641 int ret;
    642
    643 diff --git a/include/linux/sched.h b/include/linux/sched.h
    644 index 09c5851..ebe801e 100644
    645 --- a/include/linux/sched.h
    646 +++ b/include/linux/sched.h
    647 @@ -1803,11 +1803,18 @@ static inline int is_si_special(const struct siginfo *info)
    648 return info <= SEND_SIG_FORCED;
    649 }
    650
    651 -/* True if we are on the alternate signal stack. */
    652 -
    653 +/*
    654 + * True if we are on the alternate signal stack.
    655 + */
    656 static inline int on_sig_stack(unsigned long sp)
    657 {
    658 - return (sp - current->sas_ss_sp < current->sas_ss_size);
    659 +#ifdef CONFIG_STACK_GROWSUP
    660 + return sp >= current->sas_ss_sp &&
    661 + sp - current->sas_ss_sp < current->sas_ss_size;
    662 +#else
    663 + return sp > current->sas_ss_sp &&
    664 + sp - current->sas_ss_sp <= current->sas_ss_size;
    665 +#endif
    666 }
    667
    668 static inline int sas_ss_flags(unsigned long sp)