Contents of /trunk/kernel26-alx/patches-2.6.27-r3/0142-2.6.27.43-all-fixes.patch
Parent Directory | Revision Log
Revision 1176 -
(show annotations)
(download)
Thu Oct 14 15:11:06 2010 UTC (13 years, 11 months ago) by niro
File size: 12743 byte(s)
Thu Oct 14 15:11:06 2010 UTC (13 years, 11 months ago) by niro
File size: 12743 byte(s)
-2.6.27-alx-r3: new magellan 0.5.2 kernel
1 | diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c |
2 | index 12fe589..a0db19c 100644 |
3 | --- a/arch/x86/kernel/ptrace.c |
4 | +++ b/arch/x86/kernel/ptrace.c |
5 | @@ -416,14 +416,14 @@ static int genregs_get(struct task_struct *target, |
6 | { |
7 | if (kbuf) { |
8 | unsigned long *k = kbuf; |
9 | - while (count > 0) { |
10 | + while (count >= sizeof(*k)) { |
11 | *k++ = getreg(target, pos); |
12 | count -= sizeof(*k); |
13 | pos += sizeof(*k); |
14 | } |
15 | } else { |
16 | unsigned long __user *u = ubuf; |
17 | - while (count > 0) { |
18 | + while (count >= sizeof(*u)) { |
19 | if (__put_user(getreg(target, pos), u++)) |
20 | return -EFAULT; |
21 | count -= sizeof(*u); |
22 | @@ -442,14 +442,14 @@ static int genregs_set(struct task_struct *target, |
23 | int ret = 0; |
24 | if (kbuf) { |
25 | const unsigned long *k = kbuf; |
26 | - while (count > 0 && !ret) { |
27 | + while (count >= sizeof(*k) && !ret) { |
28 | ret = putreg(target, pos, *k++); |
29 | count -= sizeof(*k); |
30 | pos += sizeof(*k); |
31 | } |
32 | } else { |
33 | const unsigned long __user *u = ubuf; |
34 | - while (count > 0 && !ret) { |
35 | + while (count >= sizeof(*u) && !ret) { |
36 | unsigned long word; |
37 | ret = __get_user(word, u++); |
38 | if (ret) |
39 | @@ -1159,14 +1159,14 @@ static int genregs32_get(struct task_struct *target, |
40 | { |
41 | if (kbuf) { |
42 | compat_ulong_t *k = kbuf; |
43 | - while (count > 0) { |
44 | + while (count >= sizeof(*k)) { |
45 | getreg32(target, pos, k++); |
46 | count -= sizeof(*k); |
47 | pos += sizeof(*k); |
48 | } |
49 | } else { |
50 | compat_ulong_t __user *u = ubuf; |
51 | - while (count > 0) { |
52 | + while (count >= sizeof(*u)) { |
53 | compat_ulong_t word; |
54 | getreg32(target, pos, &word); |
55 | if (__put_user(word, u++)) |
56 | @@ -1187,14 +1187,14 @@ static int genregs32_set(struct task_struct *target, |
57 | int ret = 0; |
58 | if (kbuf) { |
59 | const compat_ulong_t *k = kbuf; |
60 | - while (count > 0 && !ret) { |
61 | + while (count >= sizeof(*k) && !ret) { |
62 | ret = putreg32(target, pos, *k++); |
63 | count -= sizeof(*k); |
64 | pos += sizeof(*k); |
65 | } |
66 | } else { |
67 | const compat_ulong_t __user *u = ubuf; |
68 | - while (count > 0 && !ret) { |
69 | + while (count >= sizeof(*u) && !ret) { |
70 | compat_ulong_t word; |
71 | ret = __get_user(word, u++); |
72 | if (ret) |
73 | diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c |
74 | index 95c65e3..839d0f9 100644 |
75 | --- a/arch/x86/kvm/mmu.c |
76 | +++ b/arch/x86/kvm/mmu.c |
77 | @@ -1995,6 +1995,14 @@ EXPORT_SYMBOL_GPL(kvm_disable_tdp); |
78 | |
79 | static void free_mmu_pages(struct kvm_vcpu *vcpu) |
80 | { |
81 | + struct kvm_mmu_page *sp; |
82 | + |
83 | + while (!list_empty(&vcpu->kvm->arch.active_mmu_pages)) { |
84 | + sp = container_of(vcpu->kvm->arch.active_mmu_pages.next, |
85 | + struct kvm_mmu_page, link); |
86 | + kvm_mmu_zap_page(vcpu->kvm, sp); |
87 | + cond_resched(); |
88 | + } |
89 | free_page((unsigned long)vcpu->arch.mmu.pae_root); |
90 | } |
91 | |
92 | diff --git a/drivers/ata/pata_cmd64x.c b/drivers/ata/pata_cmd64x.c |
93 | index ddd09b7..9eb5f85 100644 |
94 | --- a/drivers/ata/pata_cmd64x.c |
95 | +++ b/drivers/ata/pata_cmd64x.c |
96 | @@ -219,7 +219,7 @@ static void cmd64x_set_dmamode(struct ata_port *ap, struct ata_device *adev) |
97 | regU |= udma_data[adev->dma_mode - XFER_UDMA_0] << shift; |
98 | /* Merge the control bits */ |
99 | regU |= 1 << adev->devno; /* UDMA on */ |
100 | - if (adev->dma_mode > 2) /* 15nS timing */ |
101 | + if (adev->dma_mode > XFER_UDMA_2) /* 15nS timing */ |
102 | regU |= 4 << adev->devno; |
103 | } else { |
104 | regU &= ~ (1 << adev->devno); /* UDMA off */ |
105 | diff --git a/drivers/i2c/chips/tsl2550.c b/drivers/i2c/chips/tsl2550.c |
106 | index b96f302..ec0a7ca 100644 |
107 | --- a/drivers/i2c/chips/tsl2550.c |
108 | +++ b/drivers/i2c/chips/tsl2550.c |
109 | @@ -277,6 +277,7 @@ static DEVICE_ATTR(operating_mode, S_IWUSR | S_IRUGO, |
110 | |
111 | static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf) |
112 | { |
113 | + struct tsl2550_data *data = i2c_get_clientdata(client); |
114 | u8 ch0, ch1; |
115 | int ret; |
116 | |
117 | @@ -296,6 +297,8 @@ static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf) |
118 | ret = tsl2550_calculate_lux(ch0, ch1); |
119 | if (ret < 0) |
120 | return ret; |
121 | + if (data->operating_mode == 1) |
122 | + ret *= 5; |
123 | |
124 | return sprintf(buf, "%d\n", ret); |
125 | } |
126 | diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c |
127 | index 8b3ed77..d9fca29 100644 |
128 | --- a/drivers/net/wireless/libertas/wext.c |
129 | +++ b/drivers/net/wireless/libertas/wext.c |
130 | @@ -1899,10 +1899,8 @@ static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info, |
131 | if (priv->connect_status == LBS_CONNECTED) { |
132 | memcpy(extra, priv->curbssparams.ssid, |
133 | priv->curbssparams.ssid_len); |
134 | - extra[priv->curbssparams.ssid_len] = '\0'; |
135 | } else { |
136 | memset(extra, 0, 32); |
137 | - extra[priv->curbssparams.ssid_len] = '\0'; |
138 | } |
139 | /* |
140 | * If none, we may want to get the one that was set |
141 | diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c |
142 | index 85fcb43..b4ae447 100644 |
143 | --- a/drivers/s390/block/dasd_diag.c |
144 | +++ b/drivers/s390/block/dasd_diag.c |
145 | @@ -143,6 +143,15 @@ dasd_diag_erp(struct dasd_device *device) |
146 | |
147 | mdsk_term_io(device); |
148 | rc = mdsk_init_io(device, device->block->bp_block, 0, NULL); |
149 | + if (rc == 4) { |
150 | + if (!(device->features & DASD_FEATURE_READONLY)) { |
151 | + dev_warn(&device->cdev->dev, |
152 | + "The access mode of a DIAG device changed" |
153 | + " to read-only"); |
154 | + device->features |= DASD_FEATURE_READONLY; |
155 | + } |
156 | + rc = 0; |
157 | + } |
158 | if (rc) |
159 | DEV_MESSAGE(KERN_WARNING, device, "DIAG ERP unsuccessful, " |
160 | "rc=%d", rc); |
161 | @@ -432,16 +441,20 @@ dasd_diag_check_device(struct dasd_device *device) |
162 | for (sb = 512; sb < bsize; sb = sb << 1) |
163 | block->s2b_shift++; |
164 | rc = mdsk_init_io(device, block->bp_block, 0, NULL); |
165 | - if (rc) { |
166 | + if (rc && (rc != 4)) { |
167 | DEV_MESSAGE(KERN_WARNING, device, "DIAG initialization " |
168 | "failed (rc=%d)", rc); |
169 | rc = -EIO; |
170 | } else { |
171 | + if (rc == 4) |
172 | + device->features |= DASD_FEATURE_READONLY; |
173 | DEV_MESSAGE(KERN_INFO, device, |
174 | - "(%ld B/blk): %ldkB", |
175 | + "(%ld B/blk): %ldkB%s", |
176 | (unsigned long) block->bp_block, |
177 | (unsigned long) (block->blocks << |
178 | - block->s2b_shift) >> 1); |
179 | + block->s2b_shift) >> 1, |
180 | + (rc == 4) ? ", read-only device" : ""); |
181 | + rc = 0; |
182 | } |
183 | out_label: |
184 | free_page((long) label); |
185 | diff --git a/fs/namei.c b/fs/namei.c |
186 | index 2259d21..e6c73de 100644 |
187 | --- a/fs/namei.c |
188 | +++ b/fs/namei.c |
189 | @@ -220,6 +220,7 @@ int generic_permission(struct inode *inode, int mask, |
190 | /* |
191 | * Searching includes executable on directories, else just read. |
192 | */ |
193 | + mask &= MAY_READ | MAY_WRITE | MAY_EXEC; |
194 | if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))) |
195 | if (capable(CAP_DAC_READ_SEARCH)) |
196 | return 0; |
197 | diff --git a/include/net/ipv6.h b/include/net/ipv6.h |
198 | index 113028f..2444076 100644 |
199 | --- a/include/net/ipv6.h |
200 | +++ b/include/net/ipv6.h |
201 | @@ -342,8 +342,15 @@ static inline int ipv6_prefix_equal(const struct in6_addr *a1, |
202 | |
203 | struct inet_frag_queue; |
204 | |
205 | +enum ip6_defrag_users { |
206 | + IP6_DEFRAG_LOCAL_DELIVER, |
207 | + IP6_DEFRAG_CONNTRACK_IN, |
208 | + IP6_DEFRAG_CONNTRACK_OUT, |
209 | +}; |
210 | + |
211 | struct ip6_create_arg { |
212 | __be32 id; |
213 | + u32 user; |
214 | struct in6_addr *src; |
215 | struct in6_addr *dst; |
216 | }; |
217 | diff --git a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h |
218 | index abc55ad..1ee717e 100644 |
219 | --- a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h |
220 | +++ b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h |
221 | @@ -9,7 +9,7 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6; |
222 | |
223 | extern int nf_ct_frag6_init(void); |
224 | extern void nf_ct_frag6_cleanup(void); |
225 | -extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb); |
226 | +extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user); |
227 | extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb, |
228 | struct net_device *in, |
229 | struct net_device *out, |
230 | diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |
231 | index 85050c0..3abaec7 100644 |
232 | --- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |
233 | +++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |
234 | @@ -183,6 +183,16 @@ out: |
235 | return nf_conntrack_confirm(skb); |
236 | } |
237 | |
238 | +static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum, |
239 | + struct sk_buff *skb) |
240 | +{ |
241 | + if (hooknum == NF_INET_PRE_ROUTING) |
242 | + return IP6_DEFRAG_CONNTRACK_IN; |
243 | + else |
244 | + return IP6_DEFRAG_CONNTRACK_OUT; |
245 | + |
246 | +} |
247 | + |
248 | static unsigned int ipv6_defrag(unsigned int hooknum, |
249 | struct sk_buff *skb, |
250 | const struct net_device *in, |
251 | @@ -195,8 +205,7 @@ static unsigned int ipv6_defrag(unsigned int hooknum, |
252 | if (skb->nfct) |
253 | return NF_ACCEPT; |
254 | |
255 | - reasm = nf_ct_frag6_gather(skb); |
256 | - |
257 | + reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb)); |
258 | /* queued */ |
259 | if (reasm == NULL) |
260 | return NF_STOLEN; |
261 | diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c |
262 | index 52d06dd..6011bad 100644 |
263 | --- a/net/ipv6/netfilter/nf_conntrack_reasm.c |
264 | +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c |
265 | @@ -198,13 +198,14 @@ out: |
266 | /* Creation primitives. */ |
267 | |
268 | static __inline__ struct nf_ct_frag6_queue * |
269 | -fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst) |
270 | +fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst) |
271 | { |
272 | struct inet_frag_queue *q; |
273 | struct ip6_create_arg arg; |
274 | unsigned int hash; |
275 | |
276 | arg.id = id; |
277 | + arg.user = user; |
278 | arg.src = src; |
279 | arg.dst = dst; |
280 | |
281 | @@ -589,7 +590,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff) |
282 | return 0; |
283 | } |
284 | |
285 | -struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb) |
286 | +struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user) |
287 | { |
288 | struct sk_buff *clone; |
289 | struct net_device *dev = skb->dev; |
290 | @@ -635,7 +636,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb) |
291 | if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh) |
292 | nf_ct_frag6_evictor(); |
293 | |
294 | - fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr); |
295 | + fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr); |
296 | if (fq == NULL) { |
297 | pr_debug("Can't find and can't create new queue\n"); |
298 | goto ret_orig; |
299 | diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c |
300 | index 89184b5..d2fff41 100644 |
301 | --- a/net/ipv6/reassembly.c |
302 | +++ b/net/ipv6/reassembly.c |
303 | @@ -72,6 +72,7 @@ struct frag_queue |
304 | struct inet_frag_queue q; |
305 | |
306 | __be32 id; /* fragment id */ |
307 | + u32 user; |
308 | struct in6_addr saddr; |
309 | struct in6_addr daddr; |
310 | |
311 | @@ -140,7 +141,7 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a) |
312 | struct ip6_create_arg *arg = a; |
313 | |
314 | fq = container_of(q, struct frag_queue, q); |
315 | - return (fq->id == arg->id && |
316 | + return (fq->id == arg->id && fq->user == arg->user && |
317 | ipv6_addr_equal(&fq->saddr, arg->src) && |
318 | ipv6_addr_equal(&fq->daddr, arg->dst)); |
319 | } |
320 | @@ -162,6 +163,7 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a) |
321 | struct ip6_create_arg *arg = a; |
322 | |
323 | fq->id = arg->id; |
324 | + fq->user = arg->user; |
325 | ipv6_addr_copy(&fq->saddr, arg->src); |
326 | ipv6_addr_copy(&fq->daddr, arg->dst); |
327 | } |
328 | @@ -243,6 +245,7 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst, |
329 | unsigned int hash; |
330 | |
331 | arg.id = id; |
332 | + arg.user = IP6_DEFRAG_LOCAL_DELIVER; |
333 | arg.src = src; |
334 | arg.dst = dst; |
335 | |
336 | diff --git a/sound/mips/sgio2audio.c b/sound/mips/sgio2audio.c |
337 | index 4c63504..c1b777d 100644 |
338 | --- a/sound/mips/sgio2audio.c |
339 | +++ b/sound/mips/sgio2audio.c |
340 | @@ -609,7 +609,7 @@ static int snd_sgio2audio_pcm_hw_params(struct snd_pcm_substream *substream, |
341 | /* alloc virtual 'dma' area */ |
342 | if (runtime->dma_area) |
343 | vfree(runtime->dma_area); |
344 | - runtime->dma_area = vmalloc(size); |
345 | + runtime->dma_area = vmalloc_user(size); |
346 | if (runtime->dma_area == NULL) |
347 | return -ENOMEM; |
348 | runtime->dma_bytes = size; |
349 | diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c |
350 | index 01066c9..51fd452 100644 |
351 | --- a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c |
352 | +++ b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c |
353 | @@ -51,7 +51,7 @@ static int snd_pcm_alloc_vmalloc_buffer(struct snd_pcm_substream *subs, size_t s |
354 | return 0; /* already enough large */ |
355 | vfree(runtime->dma_area); |
356 | } |
357 | - runtime->dma_area = vmalloc_32(size); |
358 | + runtime->dma_area = vmalloc_32_user(size); |
359 | if (! runtime->dma_area) |
360 | return -ENOMEM; |
361 | runtime->dma_bytes = size; |
362 | diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c |
363 | index 915a131..04e5d2e 100644 |
364 | --- a/sound/usb/usbaudio.c |
365 | +++ b/sound/usb/usbaudio.c |
366 | @@ -740,7 +740,7 @@ static int snd_pcm_alloc_vmalloc_buffer(struct snd_pcm_substream *subs, size_t s |
367 | return 0; /* already large enough */ |
368 | vfree(runtime->dma_area); |
369 | } |
370 | - runtime->dma_area = vmalloc(size); |
371 | + runtime->dma_area = vmalloc_user(size); |
372 | if (!runtime->dma_area) |
373 | return -ENOMEM; |
374 | runtime->dma_bytes = size; |
375 | diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c |
376 | index db062b5..cecfc13 100644 |
377 | --- a/virt/kvm/kvm_main.c |
378 | +++ b/virt/kvm/kvm_main.c |
379 | @@ -406,8 +406,6 @@ static void kvm_destroy_vm(struct kvm *kvm) |
380 | #endif |
381 | #if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER) |
382 | mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm); |
383 | -#else |
384 | - kvm_arch_flush_shadow(kvm); |
385 | #endif |
386 | kvm_arch_destroy_vm(kvm); |
387 | mmdrop(mm); |