Annotation of /trunk/kernel26-alx/patches-2.6.27-r3/0145-2.6.27.46-all-fixes.patch
Parent Directory | Revision Log
Revision 1176 -
(hide annotations)
(download)
Thu Oct 14 15:11:06 2010 UTC (13 years, 11 months ago) by niro
File size: 44616 byte(s)
Thu Oct 14 15:11:06 2010 UTC (13 years, 11 months ago) by niro
File size: 44616 byte(s)
-2.6.27-alx-r3: new magellan 0.5.2 kernel
1 | niro | 1176 | diff --git a/Documentation/filesystems/tmpfs.txt b/Documentation/filesystems/tmpfs.txt |
2 | index 222437e..a94fede 100644 | ||
3 | --- a/Documentation/filesystems/tmpfs.txt | ||
4 | +++ b/Documentation/filesystems/tmpfs.txt | ||
5 | @@ -82,11 +82,13 @@ tmpfs has a mount option to set the NUMA memory allocation policy for | ||
6 | all files in that instance (if CONFIG_NUMA is enabled) - which can be | ||
7 | adjusted on the fly via 'mount -o remount ...' | ||
8 | |||
9 | -mpol=default prefers to allocate memory from the local node | ||
10 | +mpol=default use the process allocation policy | ||
11 | + (see set_mempolicy(2)) | ||
12 | mpol=prefer:Node prefers to allocate memory from the given Node | ||
13 | mpol=bind:NodeList allocates memory only from nodes in NodeList | ||
14 | mpol=interleave prefers to allocate from each node in turn | ||
15 | mpol=interleave:NodeList allocates from each node of NodeList in turn | ||
16 | +mpol=local prefers to allocate memory from the local node | ||
17 | |||
18 | NodeList format is a comma-separated list of decimal numbers and ranges, | ||
19 | a range being two hyphen-separated decimal numbers, the smallest and | ||
20 | @@ -134,3 +136,5 @@ Author: | ||
21 | Christoph Rohland <cr@sap.com>, 1.12.01 | ||
22 | Updated: | ||
23 | Hugh Dickins <hugh@veritas.com>, 4 June 2007 | ||
24 | +Updated: | ||
25 | + KOSAKI Motohiro, 16 Mar 2010 | ||
26 | diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c | ||
27 | index a0e1dbe..5efd5b2 100644 | ||
28 | --- a/arch/x86/ia32/ia32_aout.c | ||
29 | +++ b/arch/x86/ia32/ia32_aout.c | ||
30 | @@ -324,7 +324,6 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs) | ||
31 | current->mm->free_area_cache = TASK_UNMAPPED_BASE; | ||
32 | current->mm->cached_hole_size = 0; | ||
33 | |||
34 | - current->mm->mmap = NULL; | ||
35 | compute_creds(bprm); | ||
36 | current->flags &= ~PF_FORKNOEXEC; | ||
37 | |||
38 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c | ||
39 | index 4cee61a..7981dbe 100644 | ||
40 | --- a/arch/x86/kvm/vmx.c | ||
41 | +++ b/arch/x86/kvm/vmx.c | ||
42 | @@ -2464,6 +2464,9 @@ static int handle_dr(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) | ||
43 | unsigned long val; | ||
44 | int dr, reg; | ||
45 | |||
46 | + if (!kvm_require_cpl(vcpu, 0)) | ||
47 | + return 1; | ||
48 | + | ||
49 | /* | ||
50 | * FIXME: this code assumes the host is debugging the guest. | ||
51 | * need to deal with guest debugging itself too. | ||
52 | diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c | ||
53 | index bf872f2..80ffc99 100644 | ||
54 | --- a/arch/x86/kvm/x86.c | ||
55 | +++ b/arch/x86/kvm/x86.c | ||
56 | @@ -198,6 +198,19 @@ static void __queue_exception(struct kvm_vcpu *vcpu) | ||
57 | } | ||
58 | |||
59 | /* | ||
60 | + * Checks if cpl <= required_cpl; if true, return true. Otherwise queue | ||
61 | + * a #GP and return false. | ||
62 | + */ | ||
63 | +bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl) | ||
64 | +{ | ||
65 | + if (kvm_x86_ops->get_cpl(vcpu) <= required_cpl) | ||
66 | + return true; | ||
67 | + kvm_queue_exception_e(vcpu, GP_VECTOR, 0); | ||
68 | + return false; | ||
69 | +} | ||
70 | +EXPORT_SYMBOL_GPL(kvm_require_cpl); | ||
71 | + | ||
72 | +/* | ||
73 | * Load the pae pdptrs. Return true is they are all valid. | ||
74 | */ | ||
75 | int load_pdptrs(struct kvm_vcpu *vcpu, unsigned long cr3) | ||
76 | @@ -3645,7 +3658,13 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu, | ||
77 | |||
78 | vcpu->arch.cr2 = sregs->cr2; | ||
79 | mmu_reset_needed |= vcpu->arch.cr3 != sregs->cr3; | ||
80 | - vcpu->arch.cr3 = sregs->cr3; | ||
81 | + | ||
82 | + down_read(&vcpu->kvm->slots_lock); | ||
83 | + if (gfn_to_memslot(vcpu->kvm, sregs->cr3 >> PAGE_SHIFT)) | ||
84 | + vcpu->arch.cr3 = sregs->cr3; | ||
85 | + else | ||
86 | + set_bit(KVM_REQ_TRIPLE_FAULT, &vcpu->requests); | ||
87 | + up_read(&vcpu->kvm->slots_lock); | ||
88 | |||
89 | kvm_set_cr8(vcpu, sregs->cr8); | ||
90 | |||
91 | diff --git a/arch/x86/kvm/x86_emulate.c b/arch/x86/kvm/x86_emulate.c | ||
92 | index f2f9046..1dc1cfd 100644 | ||
93 | --- a/arch/x86/kvm/x86_emulate.c | ||
94 | +++ b/arch/x86/kvm/x86_emulate.c | ||
95 | @@ -581,6 +581,9 @@ static int do_insn_fetch(struct x86_emulate_ctxt *ctxt, | ||
96 | { | ||
97 | int rc = 0; | ||
98 | |||
99 | + /* x86 instructions are limited to 15 bytes. */ | ||
100 | + if (eip + size - ctxt->decode.eip_orig > 15) | ||
101 | + return X86EMUL_UNHANDLEABLE; | ||
102 | eip += ctxt->cs_base; | ||
103 | while (size--) { | ||
104 | rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++); | ||
105 | @@ -839,7 +842,7 @@ x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops) | ||
106 | /* Shadow copy of register state. Committed on successful emulation. */ | ||
107 | |||
108 | memset(c, 0, sizeof(struct decode_cache)); | ||
109 | - c->eip = ctxt->vcpu->arch.rip; | ||
110 | + c->eip = c->eip_orig = ctxt->vcpu->arch.rip; | ||
111 | ctxt->cs_base = seg_base(ctxt, VCPU_SREG_CS); | ||
112 | memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs); | ||
113 | |||
114 | diff --git a/drivers/char/mem.c b/drivers/char/mem.c | ||
115 | index 672b08e..3191fc8 100644 | ||
116 | --- a/drivers/char/mem.c | ||
117 | +++ b/drivers/char/mem.c | ||
118 | @@ -724,6 +724,9 @@ static ssize_t read_zero(struct file * file, char __user * buf, | ||
119 | written += chunk - unwritten; | ||
120 | if (unwritten) | ||
121 | break; | ||
122 | + /* Consider changing this to just 'signal_pending()' with lots of testing */ | ||
123 | + if (fatal_signal_pending(current)) | ||
124 | + return written ? written : -EINTR; | ||
125 | buf += chunk; | ||
126 | count -= chunk; | ||
127 | cond_resched(); | ||
128 | diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c | ||
129 | index c4b82c7..e6788f4 100644 | ||
130 | --- a/drivers/char/tty_io.c | ||
131 | +++ b/drivers/char/tty_io.c | ||
132 | @@ -2437,8 +2437,10 @@ static int tty_fasync(int fd, struct file *filp, int on) | ||
133 | pid = task_pid(current); | ||
134 | type = PIDTYPE_PID; | ||
135 | } | ||
136 | - retval = __f_setown(filp, pid, type, 0); | ||
137 | + get_pid(pid); | ||
138 | spin_unlock_irqrestore(&tty->ctrl_lock, flags); | ||
139 | + retval = __f_setown(filp, pid, type, 0); | ||
140 | + put_pid(pid); | ||
141 | if (retval) | ||
142 | goto out; | ||
143 | } else { | ||
144 | diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c | ||
145 | index c31afbd..11bb1fd 100644 | ||
146 | --- a/drivers/gpu/drm/r128/r128_cce.c | ||
147 | +++ b/drivers/gpu/drm/r128/r128_cce.c | ||
148 | @@ -353,6 +353,11 @@ static int r128_do_init_cce(struct drm_device * dev, drm_r128_init_t * init) | ||
149 | |||
150 | DRM_DEBUG("\n"); | ||
151 | |||
152 | + if (dev->dev_private) { | ||
153 | + DRM_DEBUG("called when already initialized\n"); | ||
154 | + return -EINVAL; | ||
155 | + } | ||
156 | + | ||
157 | dev_priv = drm_alloc(sizeof(drm_r128_private_t), DRM_MEM_DRIVER); | ||
158 | if (dev_priv == NULL) | ||
159 | return -ENOMEM; | ||
160 | @@ -651,6 +656,8 @@ int r128_cce_start(struct drm_device *dev, void *data, struct drm_file *file_pri | ||
161 | |||
162 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
163 | |||
164 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
165 | + | ||
166 | if (dev_priv->cce_running || dev_priv->cce_mode == R128_PM4_NONPM4) { | ||
167 | DRM_DEBUG("while CCE running\n"); | ||
168 | return 0; | ||
169 | @@ -673,6 +680,8 @@ int r128_cce_stop(struct drm_device *dev, void *data, struct drm_file *file_priv | ||
170 | |||
171 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
172 | |||
173 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
174 | + | ||
175 | /* Flush any pending CCE commands. This ensures any outstanding | ||
176 | * commands are exectuted by the engine before we turn it off. | ||
177 | */ | ||
178 | @@ -710,10 +719,7 @@ int r128_cce_reset(struct drm_device *dev, void *data, struct drm_file *file_pri | ||
179 | |||
180 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
181 | |||
182 | - if (!dev_priv) { | ||
183 | - DRM_DEBUG("called before init done\n"); | ||
184 | - return -EINVAL; | ||
185 | - } | ||
186 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
187 | |||
188 | r128_do_cce_reset(dev_priv); | ||
189 | |||
190 | @@ -730,6 +736,8 @@ int r128_cce_idle(struct drm_device *dev, void *data, struct drm_file *file_priv | ||
191 | |||
192 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
193 | |||
194 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
195 | + | ||
196 | if (dev_priv->cce_running) { | ||
197 | r128_do_cce_flush(dev_priv); | ||
198 | } | ||
199 | @@ -743,6 +751,8 @@ int r128_engine_reset(struct drm_device *dev, void *data, struct drm_file *file_ | ||
200 | |||
201 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
202 | |||
203 | + DEV_INIT_TEST_WITH_RETURN(dev->dev_private); | ||
204 | + | ||
205 | return r128_do_engine_reset(dev); | ||
206 | } | ||
207 | |||
208 | diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h | ||
209 | index 011105e..bc030f6 100644 | ||
210 | --- a/drivers/gpu/drm/r128/r128_drv.h | ||
211 | +++ b/drivers/gpu/drm/r128/r128_drv.h | ||
212 | @@ -418,6 +418,14 @@ static __inline__ void r128_update_ring_snapshot(drm_r128_private_t * dev_priv) | ||
213 | * Misc helper macros | ||
214 | */ | ||
215 | |||
216 | +#define DEV_INIT_TEST_WITH_RETURN(_dev_priv) \ | ||
217 | +do { \ | ||
218 | + if (!_dev_priv) { \ | ||
219 | + DRM_ERROR("called with no initialization\n"); \ | ||
220 | + return -EINVAL; \ | ||
221 | + } \ | ||
222 | +} while (0) | ||
223 | + | ||
224 | #define RING_SPACE_TEST_WITH_RETURN( dev_priv ) \ | ||
225 | do { \ | ||
226 | drm_r128_ring_buffer_t *ring = &dev_priv->ring; int i; \ | ||
227 | diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c | ||
228 | index 51a9afc..7cd107f 100644 | ||
229 | --- a/drivers/gpu/drm/r128/r128_state.c | ||
230 | +++ b/drivers/gpu/drm/r128/r128_state.c | ||
231 | @@ -1244,14 +1244,18 @@ static void r128_cce_dispatch_stipple(struct drm_device * dev, u32 * stipple) | ||
232 | static int r128_cce_clear(struct drm_device *dev, void *data, struct drm_file *file_priv) | ||
233 | { | ||
234 | drm_r128_private_t *dev_priv = dev->dev_private; | ||
235 | - drm_r128_sarea_t *sarea_priv = dev_priv->sarea_priv; | ||
236 | + drm_r128_sarea_t *sarea_priv; | ||
237 | drm_r128_clear_t *clear = data; | ||
238 | DRM_DEBUG("\n"); | ||
239 | |||
240 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
241 | |||
242 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
243 | + | ||
244 | RING_SPACE_TEST_WITH_RETURN(dev_priv); | ||
245 | |||
246 | + sarea_priv = dev_priv->sarea_priv; | ||
247 | + | ||
248 | if (sarea_priv->nbox > R128_NR_SAREA_CLIPRECTS) | ||
249 | sarea_priv->nbox = R128_NR_SAREA_CLIPRECTS; | ||
250 | |||
251 | @@ -1312,6 +1316,8 @@ static int r128_cce_flip(struct drm_device *dev, void *data, struct drm_file *fi | ||
252 | |||
253 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
254 | |||
255 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
256 | + | ||
257 | RING_SPACE_TEST_WITH_RETURN(dev_priv); | ||
258 | |||
259 | if (!dev_priv->page_flipping) | ||
260 | @@ -1331,6 +1337,8 @@ static int r128_cce_swap(struct drm_device *dev, void *data, struct drm_file *fi | ||
261 | |||
262 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
263 | |||
264 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
265 | + | ||
266 | RING_SPACE_TEST_WITH_RETURN(dev_priv); | ||
267 | |||
268 | if (sarea_priv->nbox > R128_NR_SAREA_CLIPRECTS) | ||
269 | @@ -1354,10 +1362,7 @@ static int r128_cce_vertex(struct drm_device *dev, void *data, struct drm_file * | ||
270 | |||
271 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
272 | |||
273 | - if (!dev_priv) { | ||
274 | - DRM_ERROR("called with no initialization\n"); | ||
275 | - return -EINVAL; | ||
276 | - } | ||
277 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
278 | |||
279 | DRM_DEBUG("pid=%d index=%d count=%d discard=%d\n", | ||
280 | DRM_CURRENTPID, vertex->idx, vertex->count, vertex->discard); | ||
281 | @@ -1410,10 +1415,7 @@ static int r128_cce_indices(struct drm_device *dev, void *data, struct drm_file | ||
282 | |||
283 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
284 | |||
285 | - if (!dev_priv) { | ||
286 | - DRM_ERROR("called with no initialization\n"); | ||
287 | - return -EINVAL; | ||
288 | - } | ||
289 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
290 | |||
291 | DRM_DEBUG("pid=%d buf=%d s=%d e=%d d=%d\n", DRM_CURRENTPID, | ||
292 | elts->idx, elts->start, elts->end, elts->discard); | ||
293 | @@ -1476,6 +1478,8 @@ static int r128_cce_blit(struct drm_device *dev, void *data, struct drm_file *fi | ||
294 | |||
295 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
296 | |||
297 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
298 | + | ||
299 | DRM_DEBUG("pid=%d index=%d\n", DRM_CURRENTPID, blit->idx); | ||
300 | |||
301 | if (blit->idx < 0 || blit->idx >= dma->buf_count) { | ||
302 | @@ -1501,6 +1505,8 @@ static int r128_cce_depth(struct drm_device *dev, void *data, struct drm_file *f | ||
303 | |||
304 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
305 | |||
306 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
307 | + | ||
308 | RING_SPACE_TEST_WITH_RETURN(dev_priv); | ||
309 | |||
310 | ret = -EINVAL; | ||
311 | @@ -1531,6 +1537,8 @@ static int r128_cce_stipple(struct drm_device *dev, void *data, struct drm_file | ||
312 | |||
313 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
314 | |||
315 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
316 | + | ||
317 | if (DRM_COPY_FROM_USER(&mask, stipple->mask, 32 * sizeof(u32))) | ||
318 | return -EFAULT; | ||
319 | |||
320 | @@ -1555,10 +1563,7 @@ static int r128_cce_indirect(struct drm_device *dev, void *data, struct drm_file | ||
321 | |||
322 | LOCK_TEST_WITH_RETURN(dev, file_priv); | ||
323 | |||
324 | - if (!dev_priv) { | ||
325 | - DRM_ERROR("called with no initialization\n"); | ||
326 | - return -EINVAL; | ||
327 | - } | ||
328 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
329 | |||
330 | DRM_DEBUG("idx=%d s=%d e=%d d=%d\n", | ||
331 | indirect->idx, indirect->start, indirect->end, | ||
332 | @@ -1620,10 +1625,7 @@ static int r128_getparam(struct drm_device *dev, void *data, struct drm_file *fi | ||
333 | drm_r128_getparam_t *param = data; | ||
334 | int value; | ||
335 | |||
336 | - if (!dev_priv) { | ||
337 | - DRM_ERROR("called with no initialization\n"); | ||
338 | - return -EINVAL; | ||
339 | - } | ||
340 | + DEV_INIT_TEST_WITH_RETURN(dev_priv); | ||
341 | |||
342 | DRM_DEBUG("pid=%d\n", DRM_CURRENTPID); | ||
343 | |||
344 | diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c | ||
345 | index 93c1722..2b8f439 100644 | ||
346 | --- a/drivers/hwmon/coretemp.c | ||
347 | +++ b/drivers/hwmon/coretemp.c | ||
348 | @@ -191,7 +191,7 @@ static int __devinit adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device * | ||
349 | if (err) { | ||
350 | dev_warn(dev, | ||
351 | "Unable to access MSR 0xEE, for Tjmax, left" | ||
352 | - " at default"); | ||
353 | + " at default\n"); | ||
354 | } else if (eax & 0x40000000) { | ||
355 | tjmax = 85000; | ||
356 | } | ||
357 | diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c | ||
358 | index affee01..488e867 100644 | ||
359 | --- a/drivers/hwmon/lm78.c | ||
360 | +++ b/drivers/hwmon/lm78.c | ||
361 | @@ -655,7 +655,7 @@ static int __devinit lm78_isa_probe(struct platform_device *pdev) | ||
362 | |||
363 | /* Reserve the ISA region */ | ||
364 | res = platform_get_resource(pdev, IORESOURCE_IO, 0); | ||
365 | - if (!request_region(res->start, LM78_EXTENT, "lm78")) { | ||
366 | + if (!request_region(res->start + LM78_ADDR_REG_OFFSET, 2, "lm78")) { | ||
367 | err = -EBUSY; | ||
368 | goto exit; | ||
369 | } | ||
370 | @@ -699,7 +699,7 @@ static int __devinit lm78_isa_probe(struct platform_device *pdev) | ||
371 | device_remove_file(&pdev->dev, &dev_attr_name); | ||
372 | kfree(data); | ||
373 | exit_release_region: | ||
374 | - release_region(res->start, LM78_EXTENT); | ||
375 | + release_region(res->start + LM78_ADDR_REG_OFFSET, 2); | ||
376 | exit: | ||
377 | return err; | ||
378 | } | ||
379 | @@ -711,7 +711,7 @@ static int __devexit lm78_isa_remove(struct platform_device *pdev) | ||
380 | hwmon_device_unregister(data->hwmon_dev); | ||
381 | sysfs_remove_group(&pdev->dev.kobj, &lm78_group); | ||
382 | device_remove_file(&pdev->dev, &dev_attr_name); | ||
383 | - release_region(data->client.addr, LM78_EXTENT); | ||
384 | + release_region(data->client.addr + LM78_ADDR_REG_OFFSET, 2); | ||
385 | kfree(data); | ||
386 | |||
387 | return 0; | ||
388 | @@ -836,9 +836,17 @@ static struct lm78_data *lm78_update_device(struct device *dev) | ||
389 | static int __init lm78_isa_found(unsigned short address) | ||
390 | { | ||
391 | int val, save, found = 0; | ||
392 | - | ||
393 | - if (!request_region(address, LM78_EXTENT, "lm78")) | ||
394 | - return 0; | ||
395 | + int port; | ||
396 | + | ||
397 | + /* Some boards declare base+0 to base+7 as a PNP device, some base+4 | ||
398 | + * to base+7 and some base+5 to base+6. So we better request each port | ||
399 | + * individually for the probing phase. */ | ||
400 | + for (port = address; port < address + LM78_EXTENT; port++) { | ||
401 | + if (!request_region(port, 1, "lm78")) { | ||
402 | + pr_debug("lm78: Failed to request port 0x%x\n", port); | ||
403 | + goto release; | ||
404 | + } | ||
405 | + } | ||
406 | |||
407 | #define REALLY_SLOW_IO | ||
408 | /* We need the timeouts for at least some LM78-like | ||
409 | @@ -901,7 +909,8 @@ static int __init lm78_isa_found(unsigned short address) | ||
410 | val & 0x80 ? "LM79" : "LM78", (int)address); | ||
411 | |||
412 | release: | ||
413 | - release_region(address, LM78_EXTENT); | ||
414 | + for (port--; port >= address; port--) | ||
415 | + release_region(port, 1); | ||
416 | return found; | ||
417 | } | ||
418 | |||
419 | diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c | ||
420 | index a10d0d2..3d3fb00 100644 | ||
421 | --- a/drivers/i2c/i2c-core.c | ||
422 | +++ b/drivers/i2c/i2c-core.c | ||
423 | @@ -644,6 +644,9 @@ int i2c_del_adapter(struct i2c_adapter *adap) | ||
424 | } | ||
425 | } | ||
426 | |||
427 | + /* device name is gone after device_unregister */ | ||
428 | + dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name); | ||
429 | + | ||
430 | /* clean up the sysfs representation */ | ||
431 | init_completion(&adap->dev_released); | ||
432 | device_unregister(&adap->dev); | ||
433 | @@ -654,8 +657,6 @@ int i2c_del_adapter(struct i2c_adapter *adap) | ||
434 | /* free bus id */ | ||
435 | idr_remove(&i2c_adapter_idr, adap->nr); | ||
436 | |||
437 | - dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name); | ||
438 | - | ||
439 | /* Clear the device structure in case this adapter is ever going to be | ||
440 | added again */ | ||
441 | memset(&adap->dev, 0, sizeof(adap->dev)); | ||
442 | diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c | ||
443 | index d2b1a1a..72894f4 100644 | ||
444 | --- a/drivers/media/video/em28xx/em28xx-dvb.c | ||
445 | +++ b/drivers/media/video/em28xx/em28xx-dvb.c | ||
446 | @@ -501,6 +501,7 @@ static int dvb_fini(struct em28xx *dev) | ||
447 | |||
448 | if (dev->dvb) { | ||
449 | unregister_dvb(dev->dvb); | ||
450 | + kfree(dev->dvb); | ||
451 | dev->dvb = NULL; | ||
452 | } | ||
453 | |||
454 | diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c | ||
455 | index 03c759b..82dfbe5 100644 | ||
456 | --- a/drivers/mtd/ubi/cdev.c | ||
457 | +++ b/drivers/mtd/ubi/cdev.c | ||
458 | @@ -793,7 +793,6 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file, | ||
459 | break; | ||
460 | } | ||
461 | |||
462 | - req.name[req.name_len] = '\0'; | ||
463 | err = verify_mkvol_req(ubi, &req); | ||
464 | if (err) | ||
465 | break; | ||
466 | diff --git a/drivers/net/b44.c b/drivers/net/b44.c | ||
467 | index f1521c6..012614e 100644 | ||
468 | --- a/drivers/net/b44.c | ||
469 | +++ b/drivers/net/b44.c | ||
470 | @@ -1502,8 +1502,7 @@ static int b44_magic_pattern(u8 *macaddr, u8 *ppattern, u8 *pmask, int offset) | ||
471 | for (k = 0; k< ethaddr_bytes; k++) { | ||
472 | ppattern[offset + magicsync + | ||
473 | (j * ETH_ALEN) + k] = macaddr[k]; | ||
474 | - len++; | ||
475 | - set_bit(len, (unsigned long *) pmask); | ||
476 | + set_bit(len++, (unsigned long *) pmask); | ||
477 | } | ||
478 | } | ||
479 | return len - 1; | ||
480 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c | ||
481 | index 5a07b50..598d2e9 100644 | ||
482 | --- a/drivers/net/bonding/bond_main.c | ||
483 | +++ b/drivers/net/bonding/bond_main.c | ||
484 | @@ -2228,6 +2228,9 @@ static int bond_miimon_inspect(struct bonding *bond) | ||
485 | { | ||
486 | struct slave *slave; | ||
487 | int i, link_state, commit = 0; | ||
488 | + bool ignore_updelay; | ||
489 | + | ||
490 | + ignore_updelay = !bond->curr_active_slave ? true : false; | ||
491 | |||
492 | bond_for_each_slave(bond, slave, i) { | ||
493 | slave->new_link = BOND_LINK_NOCHANGE; | ||
494 | @@ -2292,6 +2295,7 @@ static int bond_miimon_inspect(struct bonding *bond) | ||
495 | ": %s: link status up for " | ||
496 | "interface %s, enabling it in %d ms.\n", | ||
497 | bond->dev->name, slave->dev->name, | ||
498 | + ignore_updelay ? 0 : | ||
499 | bond->params.updelay * | ||
500 | bond->params.miimon); | ||
501 | } | ||
502 | @@ -2310,9 +2314,13 @@ static int bond_miimon_inspect(struct bonding *bond) | ||
503 | continue; | ||
504 | } | ||
505 | |||
506 | + if (ignore_updelay) | ||
507 | + slave->delay = 0; | ||
508 | + | ||
509 | if (slave->delay <= 0) { | ||
510 | slave->new_link = BOND_LINK_UP; | ||
511 | commit++; | ||
512 | + ignore_updelay = false; | ||
513 | continue; | ||
514 | } | ||
515 | |||
516 | diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c | ||
517 | index f718215..68bba7f 100644 | ||
518 | --- a/drivers/net/r8169.c | ||
519 | +++ b/drivers/net/r8169.c | ||
520 | @@ -1842,9 +1842,9 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev) | ||
521 | static void rtl8169_set_rxbufsize(struct rtl8169_private *tp, | ||
522 | struct net_device *dev) | ||
523 | { | ||
524 | - unsigned int mtu = dev->mtu; | ||
525 | + unsigned int max_frame = dev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN; | ||
526 | |||
527 | - tp->rx_buf_sz = (mtu > RX_BUF_SIZE) ? mtu + ETH_HLEN + 8 : RX_BUF_SIZE; | ||
528 | + tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE; | ||
529 | } | ||
530 | |||
531 | static int rtl8169_open(struct net_device *dev) | ||
532 | diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c | ||
533 | index 42963a9..aa9ff46 100644 | ||
534 | --- a/drivers/net/sky2.c | ||
535 | +++ b/drivers/net/sky2.c | ||
536 | @@ -1438,7 +1438,6 @@ static int sky2_up(struct net_device *dev) | ||
537 | if (ramsize > 0) { | ||
538 | u32 rxspace; | ||
539 | |||
540 | - hw->flags |= SKY2_HW_RAM_BUFFER; | ||
541 | pr_debug(PFX "%s: ram buffer %dK\n", dev->name, ramsize); | ||
542 | if (ramsize < 16) | ||
543 | rxspace = ramsize / 2; | ||
544 | @@ -2846,6 +2845,9 @@ static int __devinit sky2_init(struct sky2_hw *hw) | ||
545 | ++hw->ports; | ||
546 | } | ||
547 | |||
548 | + if (sky2_read8(hw, B2_E_0)) | ||
549 | + hw->flags |= SKY2_HW_RAM_BUFFER; | ||
550 | + | ||
551 | return 0; | ||
552 | } | ||
553 | |||
554 | diff --git a/drivers/parisc/eisa_eeprom.c b/drivers/parisc/eisa_eeprom.c | ||
555 | index 5ac2079..7eee236 100644 | ||
556 | --- a/drivers/parisc/eisa_eeprom.c | ||
557 | +++ b/drivers/parisc/eisa_eeprom.c | ||
558 | @@ -55,7 +55,7 @@ static ssize_t eisa_eeprom_read(struct file * file, | ||
559 | ssize_t ret; | ||
560 | int i; | ||
561 | |||
562 | - if (*ppos >= HPEE_MAX_LENGTH) | ||
563 | + if (*ppos < 0 || *ppos >= HPEE_MAX_LENGTH) | ||
564 | return 0; | ||
565 | |||
566 | count = *ppos + count < HPEE_MAX_LENGTH ? count : HPEE_MAX_LENGTH - *ppos; | ||
567 | diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c | ||
568 | index 3499a9d..f84f068 100644 | ||
569 | --- a/drivers/serial/8250.c | ||
570 | +++ b/drivers/serial/8250.c | ||
571 | @@ -70,6 +70,9 @@ static unsigned int nr_uarts = CONFIG_SERIAL_8250_RUNTIME_UARTS; | ||
572 | |||
573 | #define PASS_LIMIT 256 | ||
574 | |||
575 | +#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE) | ||
576 | + | ||
577 | + | ||
578 | /* | ||
579 | * We default to IRQ0 for the "no irq" hack. Some | ||
580 | * machine types want others as well - they're free | ||
581 | @@ -1656,7 +1659,7 @@ static unsigned int serial8250_tx_empty(struct uart_port *port) | ||
582 | up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS; | ||
583 | spin_unlock_irqrestore(&up->port.lock, flags); | ||
584 | |||
585 | - return lsr & UART_LSR_TEMT ? TIOCSER_TEMT : 0; | ||
586 | + return (lsr & BOTH_EMPTY) == BOTH_EMPTY ? TIOCSER_TEMT : 0; | ||
587 | } | ||
588 | |||
589 | static unsigned int serial8250_get_mctrl(struct uart_port *port) | ||
590 | @@ -1714,8 +1717,6 @@ static void serial8250_break_ctl(struct uart_port *port, int break_state) | ||
591 | spin_unlock_irqrestore(&up->port.lock, flags); | ||
592 | } | ||
593 | |||
594 | -#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE) | ||
595 | - | ||
596 | /* | ||
597 | * Wait for transmitter & holding register to empty | ||
598 | */ | ||
599 | diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c | ||
600 | index 33b2935..8657266 100644 | ||
601 | --- a/drivers/usb/core/devio.c | ||
602 | +++ b/drivers/usb/core/devio.c | ||
603 | @@ -1123,6 +1123,13 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb, | ||
604 | free_async(as); | ||
605 | return -ENOMEM; | ||
606 | } | ||
607 | + /* Isochronous input data may end up being discontiguous | ||
608 | + * if some of the packets are short. Clear the buffer so | ||
609 | + * that the gaps don't leak kernel data to userspace. | ||
610 | + */ | ||
611 | + if (is_in && uurb->type == USBDEVFS_URB_TYPE_ISO) | ||
612 | + memset(as->urb->transfer_buffer, 0, | ||
613 | + uurb->buffer_length); | ||
614 | } | ||
615 | as->urb->dev = ps->dev; | ||
616 | as->urb->pipe = (uurb->type << 30) | | ||
617 | @@ -1224,10 +1231,14 @@ static int processcompl(struct async *as, void __user * __user *arg) | ||
618 | void __user *addr = as->userurb; | ||
619 | unsigned int i; | ||
620 | |||
621 | - if (as->userbuffer) | ||
622 | - if (copy_to_user(as->userbuffer, urb->transfer_buffer, | ||
623 | - urb->transfer_buffer_length)) | ||
624 | + if (as->userbuffer && urb->actual_length) { | ||
625 | + if (urb->number_of_packets > 0) /* Isochronous */ | ||
626 | + i = urb->transfer_buffer_length; | ||
627 | + else /* Non-Isoc */ | ||
628 | + i = urb->actual_length; | ||
629 | + if (copy_to_user(as->userbuffer, urb->transfer_buffer, i)) | ||
630 | goto err_out; | ||
631 | + } | ||
632 | if (put_user(as->status, &userurb->status)) | ||
633 | goto err_out; | ||
634 | if (put_user(urb->actual_length, &userurb->actual_length)) | ||
635 | @@ -1246,14 +1257,11 @@ static int processcompl(struct async *as, void __user * __user *arg) | ||
636 | } | ||
637 | } | ||
638 | |||
639 | - free_async(as); | ||
640 | - | ||
641 | if (put_user(addr, (void __user * __user *)arg)) | ||
642 | return -EFAULT; | ||
643 | return 0; | ||
644 | |||
645 | err_out: | ||
646 | - free_async(as); | ||
647 | return -EFAULT; | ||
648 | } | ||
649 | |||
650 | @@ -1283,8 +1291,11 @@ static struct async *reap_as(struct dev_state *ps) | ||
651 | static int proc_reapurb(struct dev_state *ps, void __user *arg) | ||
652 | { | ||
653 | struct async *as = reap_as(ps); | ||
654 | - if (as) | ||
655 | - return processcompl(as, (void __user * __user *)arg); | ||
656 | + if (as) { | ||
657 | + int retval = processcompl(as, (void __user * __user *)arg); | ||
658 | + free_async(as); | ||
659 | + return retval; | ||
660 | + } | ||
661 | if (signal_pending(current)) | ||
662 | return -EINTR; | ||
663 | return -EIO; | ||
664 | @@ -1292,11 +1303,16 @@ static int proc_reapurb(struct dev_state *ps, void __user *arg) | ||
665 | |||
666 | static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg) | ||
667 | { | ||
668 | + int retval; | ||
669 | struct async *as; | ||
670 | |||
671 | - if (!(as = async_getcompleted(ps))) | ||
672 | - return -EAGAIN; | ||
673 | - return processcompl(as, (void __user * __user *)arg); | ||
674 | + as = async_getcompleted(ps); | ||
675 | + retval = -EAGAIN; | ||
676 | + if (as) { | ||
677 | + retval = processcompl(as, (void __user * __user *)arg); | ||
678 | + free_async(as); | ||
679 | + } | ||
680 | + return retval; | ||
681 | } | ||
682 | |||
683 | #ifdef CONFIG_COMPAT | ||
684 | @@ -1347,9 +1363,9 @@ static int processcompl_compat(struct async *as, void __user * __user *arg) | ||
685 | void __user *addr = as->userurb; | ||
686 | unsigned int i; | ||
687 | |||
688 | - if (as->userbuffer) | ||
689 | + if (as->userbuffer && urb->actual_length) | ||
690 | if (copy_to_user(as->userbuffer, urb->transfer_buffer, | ||
691 | - urb->transfer_buffer_length)) | ||
692 | + urb->actual_length)) | ||
693 | return -EFAULT; | ||
694 | if (put_user(as->status, &userurb->status)) | ||
695 | return -EFAULT; | ||
696 | @@ -1369,7 +1385,6 @@ static int processcompl_compat(struct async *as, void __user * __user *arg) | ||
697 | } | ||
698 | } | ||
699 | |||
700 | - free_async(as); | ||
701 | if (put_user(ptr_to_compat(addr), (u32 __user *)arg)) | ||
702 | return -EFAULT; | ||
703 | return 0; | ||
704 | @@ -1378,8 +1393,11 @@ static int processcompl_compat(struct async *as, void __user * __user *arg) | ||
705 | static int proc_reapurb_compat(struct dev_state *ps, void __user *arg) | ||
706 | { | ||
707 | struct async *as = reap_as(ps); | ||
708 | - if (as) | ||
709 | - return processcompl_compat(as, (void __user * __user *)arg); | ||
710 | + if (as) { | ||
711 | + int retval = processcompl_compat(as, (void __user * __user *)arg); | ||
712 | + free_async(as); | ||
713 | + return retval; | ||
714 | + } | ||
715 | if (signal_pending(current)) | ||
716 | return -EINTR; | ||
717 | return -EIO; | ||
718 | @@ -1387,11 +1405,16 @@ static int proc_reapurb_compat(struct dev_state *ps, void __user *arg) | ||
719 | |||
720 | static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg) | ||
721 | { | ||
722 | + int retval; | ||
723 | struct async *as; | ||
724 | |||
725 | - if (!(as = async_getcompleted(ps))) | ||
726 | - return -EAGAIN; | ||
727 | - return processcompl_compat(as, (void __user * __user *)arg); | ||
728 | + retval = -EAGAIN; | ||
729 | + as = async_getcompleted(ps); | ||
730 | + if (as) { | ||
731 | + retval = processcompl_compat(as, (void __user * __user *)arg); | ||
732 | + free_async(as); | ||
733 | + } | ||
734 | + return retval; | ||
735 | } | ||
736 | |||
737 | #endif | ||
738 | diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c | ||
739 | index ef9b038..f1a29e2 100644 | ||
740 | --- a/drivers/usb/host/ehci-hub.c | ||
741 | +++ b/drivers/usb/host/ehci-hub.c | ||
742 | @@ -254,10 +254,8 @@ static int ehci_bus_resume (struct usb_hcd *hcd) | ||
743 | temp = ehci_readl(ehci, &ehci->regs->port_status [i]); | ||
744 | temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS); | ||
745 | if (test_bit(i, &ehci->bus_suspended) && | ||
746 | - (temp & PORT_SUSPEND)) { | ||
747 | - ehci->reset_done [i] = jiffies + msecs_to_jiffies (20); | ||
748 | + (temp & PORT_SUSPEND)) | ||
749 | temp |= PORT_RESUME; | ||
750 | - } | ||
751 | ehci_writel(ehci, temp, &ehci->regs->port_status [i]); | ||
752 | } | ||
753 | i = HCS_N_PORTS (ehci->hcs_params); | ||
754 | @@ -752,6 +750,9 @@ static int ehci_hub_control ( | ||
755 | ehci_readl(ehci, status_reg)); | ||
756 | } | ||
757 | |||
758 | + if (!(temp & (PORT_RESUME|PORT_RESET))) | ||
759 | + ehci->reset_done[wIndex] = 0; | ||
760 | + | ||
761 | /* transfer dedicated ports to the companion hc */ | ||
762 | if ((temp & PORT_CONNECT) && | ||
763 | test_bit(wIndex, &ehci->companion_ports)) { | ||
764 | diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c | ||
765 | index 097dd55..da88a80 100644 | ||
766 | --- a/drivers/usb/host/ehci-q.c | ||
767 | +++ b/drivers/usb/host/ehci-q.c | ||
768 | @@ -346,12 +346,11 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh) | ||
769 | */ | ||
770 | if ((token & QTD_STS_XACT) && | ||
771 | QTD_CERR(token) == 0 && | ||
772 | - --qh->xacterrs > 0 && | ||
773 | + ++qh->xacterrs < QH_XACTERR_MAX && | ||
774 | !urb->unlinked) { | ||
775 | ehci_dbg(ehci, | ||
776 | - "detected XactErr len %d/%d retry %d\n", | ||
777 | - qtd->length - QTD_LENGTH(token), qtd->length, | ||
778 | - QH_XACTERR_MAX - qh->xacterrs); | ||
779 | + "detected XactErr len %zu/%zu retry %d\n", | ||
780 | + qtd->length - QTD_LENGTH(token), qtd->length, qh->xacterrs); | ||
781 | |||
782 | /* reset the token in the qtd and the | ||
783 | * qh overlay (which still contains | ||
784 | @@ -451,7 +450,7 @@ halt: | ||
785 | last = qtd; | ||
786 | |||
787 | /* reinit the xacterr counter for the next qtd */ | ||
788 | - qh->xacterrs = QH_XACTERR_MAX; | ||
789 | + qh->xacterrs = 0; | ||
790 | } | ||
791 | |||
792 | /* last urb's completion might still need calling */ | ||
793 | @@ -898,7 +897,7 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh) | ||
794 | head->qh_next.qh = qh; | ||
795 | head->hw_next = dma; | ||
796 | |||
797 | - qh->xacterrs = QH_XACTERR_MAX; | ||
798 | + qh->xacterrs = 0; | ||
799 | qh->qh_state = QH_STATE_LINKED; | ||
800 | /* qtd completions reported later by interrupt */ | ||
801 | } | ||
802 | diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c | ||
803 | index 18e8741..e813ca8 100644 | ||
804 | --- a/drivers/usb/host/ehci-sched.c | ||
805 | +++ b/drivers/usb/host/ehci-sched.c | ||
806 | @@ -542,6 +542,7 @@ static int qh_link_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh) | ||
807 | } | ||
808 | } | ||
809 | qh->qh_state = QH_STATE_LINKED; | ||
810 | + qh->xacterrs = 0; | ||
811 | qh_get (qh); | ||
812 | |||
813 | /* update per-qh bandwidth for usbfs */ | ||
814 | diff --git a/fs/exec.c b/fs/exec.c | ||
815 | index 5ec0f56..50da182 100644 | ||
816 | --- a/fs/exec.c | ||
817 | +++ b/fs/exec.c | ||
818 | @@ -1826,8 +1826,9 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs) | ||
819 | /* | ||
820 | * Dont allow local users get cute and trick others to coredump | ||
821 | * into their pre-created files: | ||
822 | + * Note, this is not relevant for pipes | ||
823 | */ | ||
824 | - if (inode->i_uid != current->fsuid) | ||
825 | + if (!ispipe && (inode->i_uid != current->fsuid)) | ||
826 | goto close_fail; | ||
827 | if (!file->f_op) | ||
828 | goto close_fail; | ||
829 | diff --git a/fs/ext4/super.c b/fs/ext4/super.c | ||
830 | index db2642a..baacaf8 100644 | ||
831 | --- a/fs/ext4/super.c | ||
832 | +++ b/fs/ext4/super.c | ||
833 | @@ -254,7 +254,8 @@ static const char *ext4_decode_error(struct super_block *sb, int errno, | ||
834 | errstr = "Out of memory"; | ||
835 | break; | ||
836 | case -EROFS: | ||
837 | - if (!sb || EXT4_SB(sb)->s_journal->j_flags & JBD2_ABORT) | ||
838 | + if (!sb || (EXT4_SB(sb)->s_journal && | ||
839 | + EXT4_SB(sb)->s_journal->j_flags & JBD2_ABORT)) | ||
840 | errstr = "Journal has aborted"; | ||
841 | else | ||
842 | errstr = "Readonly filesystem"; | ||
843 | diff --git a/fs/fcntl.c b/fs/fcntl.c | ||
844 | index 4eed4d6..ac79b7e 100644 | ||
845 | --- a/fs/fcntl.c | ||
846 | +++ b/fs/fcntl.c | ||
847 | @@ -200,9 +200,7 @@ static int setfl(int fd, struct file * filp, unsigned long arg) | ||
848 | static void f_modown(struct file *filp, struct pid *pid, enum pid_type type, | ||
849 | uid_t uid, uid_t euid, int force) | ||
850 | { | ||
851 | - unsigned long flags; | ||
852 | - | ||
853 | - write_lock_irqsave(&filp->f_owner.lock, flags); | ||
854 | + write_lock_irq(&filp->f_owner.lock); | ||
855 | if (force || !filp->f_owner.pid) { | ||
856 | put_pid(filp->f_owner.pid); | ||
857 | filp->f_owner.pid = get_pid(pid); | ||
858 | @@ -210,7 +208,7 @@ static void f_modown(struct file *filp, struct pid *pid, enum pid_type type, | ||
859 | filp->f_owner.uid = uid; | ||
860 | filp->f_owner.euid = euid; | ||
861 | } | ||
862 | - write_unlock_irqrestore(&filp->f_owner.lock, flags); | ||
863 | + write_unlock_irq(&filp->f_owner.lock); | ||
864 | } | ||
865 | |||
866 | int __f_setown(struct file *filp, struct pid *pid, enum pid_type type, | ||
867 | diff --git a/fs/namei.c b/fs/namei.c | ||
868 | index e6c73de..832cd4b 100644 | ||
869 | --- a/fs/namei.c | ||
870 | +++ b/fs/namei.c | ||
871 | @@ -841,6 +841,17 @@ fail: | ||
872 | } | ||
873 | |||
874 | /* | ||
875 | + * This is a temporary kludge to deal with "automount" symlinks; proper | ||
876 | + * solution is to trigger them on follow_mount(), so that do_lookup() | ||
877 | + * would DTRT. To be killed before 2.6.34-final. | ||
878 | + */ | ||
879 | +static inline int follow_on_final(struct inode *inode, unsigned lookup_flags) | ||
880 | +{ | ||
881 | + return inode && unlikely(inode->i_op->follow_link) && | ||
882 | + ((lookup_flags & LOOKUP_FOLLOW) || S_ISDIR(inode->i_mode)); | ||
883 | +} | ||
884 | + | ||
885 | +/* | ||
886 | * Name resolution. | ||
887 | * This is the basic name resolution function, turning a pathname into | ||
888 | * the final dentry. We expect 'base' to be positive and a directory. | ||
889 | @@ -984,8 +995,7 @@ last_component: | ||
890 | if (err) | ||
891 | break; | ||
892 | inode = next.dentry->d_inode; | ||
893 | - if ((lookup_flags & LOOKUP_FOLLOW) | ||
894 | - && inode && inode->i_op && inode->i_op->follow_link) { | ||
895 | + if (follow_on_final(inode, lookup_flags)) { | ||
896 | err = do_follow_link(&next, nd); | ||
897 | if (err) | ||
898 | goto return_err; | ||
899 | diff --git a/include/asm-x86/checksum_32.h b/include/asm-x86/checksum_32.h | ||
900 | index 52bbb0d..0fbf77e 100644 | ||
901 | --- a/include/asm-x86/checksum_32.h | ||
902 | +++ b/include/asm-x86/checksum_32.h | ||
903 | @@ -161,7 +161,8 @@ static inline __sum16 csum_ipv6_magic(const struct in6_addr *saddr, | ||
904 | "adcl $0, %0 ;\n" | ||
905 | : "=&r" (sum) | ||
906 | : "r" (saddr), "r" (daddr), | ||
907 | - "r" (htonl(len)), "r" (htonl(proto)), "0" (sum)); | ||
908 | + "r" (htonl(len)), "r" (htonl(proto)), "0" (sum) | ||
909 | + : "memory"); | ||
910 | |||
911 | return csum_fold(sum); | ||
912 | } | ||
913 | diff --git a/include/asm-x86/kvm_host.h b/include/asm-x86/kvm_host.h | ||
914 | index cf7c887..69d4de9 100644 | ||
915 | --- a/include/asm-x86/kvm_host.h | ||
916 | +++ b/include/asm-x86/kvm_host.h | ||
917 | @@ -537,6 +537,7 @@ void kvm_queue_exception(struct kvm_vcpu *vcpu, unsigned nr); | ||
918 | void kvm_queue_exception_e(struct kvm_vcpu *vcpu, unsigned nr, u32 error_code); | ||
919 | void kvm_inject_page_fault(struct kvm_vcpu *vcpu, unsigned long cr2, | ||
920 | u32 error_code); | ||
921 | +bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl); | ||
922 | |||
923 | void kvm_inject_nmi(struct kvm_vcpu *vcpu); | ||
924 | |||
925 | diff --git a/include/asm-x86/kvm_x86_emulate.h b/include/asm-x86/kvm_x86_emulate.h | ||
926 | index 4e8c1e4..fcbb680 100644 | ||
927 | --- a/include/asm-x86/kvm_x86_emulate.h | ||
928 | +++ b/include/asm-x86/kvm_x86_emulate.h | ||
929 | @@ -128,7 +128,7 @@ struct decode_cache { | ||
930 | u8 seg_override; | ||
931 | unsigned int d; | ||
932 | unsigned long regs[NR_VCPU_REGS]; | ||
933 | - unsigned long eip; | ||
934 | + unsigned long eip, eip_orig; | ||
935 | /* modrm */ | ||
936 | u8 modrm; | ||
937 | u8 modrm_mod; | ||
938 | diff --git a/include/linux/sched.h b/include/linux/sched.h | ||
939 | index ebe801e..6d32974 100644 | ||
940 | --- a/include/linux/sched.h | ||
941 | +++ b/include/linux/sched.h | ||
942 | @@ -901,7 +901,7 @@ struct sched_class { | ||
943 | void (*yield_task) (struct rq *rq); | ||
944 | int (*select_task_rq)(struct task_struct *p, int sync); | ||
945 | |||
946 | - void (*check_preempt_curr) (struct rq *rq, struct task_struct *p); | ||
947 | + void (*check_preempt_curr) (struct rq *rq, struct task_struct *p, int sync); | ||
948 | |||
949 | struct task_struct * (*pick_next_task) (struct rq *rq); | ||
950 | void (*put_prev_task) (struct rq *rq, struct task_struct *p); | ||
951 | @@ -2232,6 +2232,28 @@ static inline void mm_init_owner(struct mm_struct *mm, struct task_struct *p) | ||
952 | |||
953 | #define TASK_STATE_TO_CHAR_STR "RSDTtZX" | ||
954 | |||
955 | +static inline unsigned long task_rlimit(const struct task_struct *tsk, | ||
956 | + unsigned int limit) | ||
957 | +{ | ||
958 | + return ACCESS_ONCE(tsk->signal->rlim[limit].rlim_cur); | ||
959 | +} | ||
960 | + | ||
961 | +static inline unsigned long task_rlimit_max(const struct task_struct *tsk, | ||
962 | + unsigned int limit) | ||
963 | +{ | ||
964 | + return ACCESS_ONCE(tsk->signal->rlim[limit].rlim_max); | ||
965 | +} | ||
966 | + | ||
967 | +static inline unsigned long rlimit(unsigned int limit) | ||
968 | +{ | ||
969 | + return task_rlimit(current, limit); | ||
970 | +} | ||
971 | + | ||
972 | +static inline unsigned long rlimit_max(unsigned int limit) | ||
973 | +{ | ||
974 | + return task_rlimit_max(current, limit); | ||
975 | +} | ||
976 | + | ||
977 | #endif /* __KERNEL__ */ | ||
978 | |||
979 | #endif | ||
980 | diff --git a/include/linux/topology.h b/include/linux/topology.h | ||
981 | index 2158fc0..2565f4a 100644 | ||
982 | --- a/include/linux/topology.h | ||
983 | +++ b/include/linux/topology.h | ||
984 | @@ -99,7 +99,7 @@ void arch_update_cpu_topology(void); | ||
985 | | SD_BALANCE_FORK \ | ||
986 | | SD_BALANCE_EXEC \ | ||
987 | | SD_WAKE_AFFINE \ | ||
988 | - | SD_WAKE_IDLE \ | ||
989 | + | SD_WAKE_BALANCE \ | ||
990 | | SD_SHARE_CPUPOWER, \ | ||
991 | .last_balance = jiffies, \ | ||
992 | .balance_interval = 1, \ | ||
993 | @@ -120,10 +120,10 @@ void arch_update_cpu_topology(void); | ||
994 | .wake_idx = 1, \ | ||
995 | .forkexec_idx = 1, \ | ||
996 | .flags = SD_LOAD_BALANCE \ | ||
997 | - | SD_BALANCE_NEWIDLE \ | ||
998 | | SD_BALANCE_FORK \ | ||
999 | | SD_BALANCE_EXEC \ | ||
1000 | | SD_WAKE_AFFINE \ | ||
1001 | + | SD_WAKE_BALANCE \ | ||
1002 | | SD_SHARE_PKG_RESOURCES\ | ||
1003 | | BALANCE_FOR_MC_POWER, \ | ||
1004 | .last_balance = jiffies, \ | ||
1005 | diff --git a/kernel/futex.c b/kernel/futex.c | ||
1006 | index ec84da5..02d07e4 100644 | ||
1007 | --- a/kernel/futex.c | ||
1008 | +++ b/kernel/futex.c | ||
1009 | @@ -533,8 +533,25 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, | ||
1010 | return -EINVAL; | ||
1011 | |||
1012 | WARN_ON(!atomic_read(&pi_state->refcount)); | ||
1013 | - WARN_ON(pid && pi_state->owner && | ||
1014 | - pi_state->owner->pid != pid); | ||
1015 | + | ||
1016 | + /* | ||
1017 | + * When pi_state->owner is NULL then the owner died | ||
1018 | + * and another waiter is on the fly. pi_state->owner | ||
1019 | + * is fixed up by the task which acquires | ||
1020 | + * pi_state->rt_mutex. | ||
1021 | + * | ||
1022 | + * We do not check for pid == 0 which can happen when | ||
1023 | + * the owner died and robust_list_exit() cleared the | ||
1024 | + * TID. | ||
1025 | + */ | ||
1026 | + if (pid && pi_state->owner) { | ||
1027 | + /* | ||
1028 | + * Bail out if user space manipulated the | ||
1029 | + * futex value. | ||
1030 | + */ | ||
1031 | + if (pid != task_pid_vnr(pi_state->owner)) | ||
1032 | + return -EINVAL; | ||
1033 | + } | ||
1034 | |||
1035 | atomic_inc(&pi_state->refcount); | ||
1036 | *ps = pi_state; | ||
1037 | @@ -630,6 +647,13 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this) | ||
1038 | if (!pi_state) | ||
1039 | return -EINVAL; | ||
1040 | |||
1041 | + /* | ||
1042 | + * If current does not own the pi_state then the futex is | ||
1043 | + * inconsistent and user space fiddled with the futex value. | ||
1044 | + */ | ||
1045 | + if (pi_state->owner != current) | ||
1046 | + return -EINVAL; | ||
1047 | + | ||
1048 | spin_lock(&pi_state->pi_mutex.wait_lock); | ||
1049 | new_owner = rt_mutex_next_owner(&pi_state->pi_mutex); | ||
1050 | |||
1051 | diff --git a/kernel/printk.c b/kernel/printk.c | ||
1052 | index 204660d..b9df41b 100644 | ||
1053 | --- a/kernel/printk.c | ||
1054 | +++ b/kernel/printk.c | ||
1055 | @@ -995,7 +995,7 @@ int printk_needs_cpu(int cpu) | ||
1056 | void wake_up_klogd(void) | ||
1057 | { | ||
1058 | if (waitqueue_active(&log_wait)) | ||
1059 | - __get_cpu_var(printk_pending) = 1; | ||
1060 | + __raw_get_cpu_var(printk_pending) = 1; | ||
1061 | } | ||
1062 | |||
1063 | /** | ||
1064 | diff --git a/kernel/sched.c b/kernel/sched.c | ||
1065 | index 98c0cdc..f01ff16 100644 | ||
1066 | --- a/kernel/sched.c | ||
1067 | +++ b/kernel/sched.c | ||
1068 | @@ -604,9 +604,9 @@ struct rq { | ||
1069 | |||
1070 | static DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); | ||
1071 | |||
1072 | -static inline void check_preempt_curr(struct rq *rq, struct task_struct *p) | ||
1073 | +static inline void check_preempt_curr(struct rq *rq, struct task_struct *p, int sync) | ||
1074 | { | ||
1075 | - rq->curr->sched_class->check_preempt_curr(rq, p); | ||
1076 | + rq->curr->sched_class->check_preempt_curr(rq, p, sync); | ||
1077 | } | ||
1078 | |||
1079 | static inline int cpu_of(struct rq *rq) | ||
1080 | @@ -2285,7 +2285,7 @@ out_running: | ||
1081 | trace_mark(kernel_sched_wakeup, | ||
1082 | "pid %d state %ld ## rq %p task %p rq->curr %p", | ||
1083 | p->pid, p->state, rq, p, rq->curr); | ||
1084 | - check_preempt_curr(rq, p); | ||
1085 | + check_preempt_curr(rq, p, sync); | ||
1086 | |||
1087 | p->state = TASK_RUNNING; | ||
1088 | #ifdef CONFIG_SMP | ||
1089 | @@ -2420,7 +2420,7 @@ void wake_up_new_task(struct task_struct *p, unsigned long clone_flags) | ||
1090 | trace_mark(kernel_sched_wakeup_new, | ||
1091 | "pid %d state %ld ## rq %p task %p rq->curr %p", | ||
1092 | p->pid, p->state, rq, p, rq->curr); | ||
1093 | - check_preempt_curr(rq, p); | ||
1094 | + check_preempt_curr(rq, p, 0); | ||
1095 | #ifdef CONFIG_SMP | ||
1096 | if (p->sched_class->task_wake_up) | ||
1097 | p->sched_class->task_wake_up(rq, p); | ||
1098 | @@ -2880,7 +2880,7 @@ static void pull_task(struct rq *src_rq, struct task_struct *p, | ||
1099 | * Note that idle threads have a prio of MAX_PRIO, for this test | ||
1100 | * to be always true for them. | ||
1101 | */ | ||
1102 | - check_preempt_curr(this_rq, p); | ||
1103 | + check_preempt_curr(this_rq, p, 0); | ||
1104 | } | ||
1105 | |||
1106 | /* | ||
1107 | @@ -5957,7 +5957,7 @@ static int __migrate_task(struct task_struct *p, int src_cpu, int dest_cpu) | ||
1108 | set_task_cpu(p, dest_cpu); | ||
1109 | if (on_rq) { | ||
1110 | activate_task(rq_dest, p, 0); | ||
1111 | - check_preempt_curr(rq_dest, p); | ||
1112 | + check_preempt_curr(rq_dest, p, 0); | ||
1113 | } | ||
1114 | done: | ||
1115 | ret = 1; | ||
1116 | diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c | ||
1117 | index fb8994c..ab8e6f3 100644 | ||
1118 | --- a/kernel/sched_fair.c | ||
1119 | +++ b/kernel/sched_fair.c | ||
1120 | @@ -1331,7 +1331,7 @@ static inline int depth_se(struct sched_entity *se) | ||
1121 | /* | ||
1122 | * Preempt the current task with a newly woken task if needed: | ||
1123 | */ | ||
1124 | -static void check_preempt_wakeup(struct rq *rq, struct task_struct *p) | ||
1125 | +static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int sync) | ||
1126 | { | ||
1127 | struct task_struct *curr = rq->curr; | ||
1128 | struct cfs_rq *cfs_rq = task_cfs_rq(curr); | ||
1129 | @@ -1360,6 +1360,13 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p) | ||
1130 | if (!sched_feat(WAKEUP_PREEMPT)) | ||
1131 | return; | ||
1132 | |||
1133 | + if (sched_feat(WAKEUP_OVERLAP) && sync && | ||
1134 | + se->avg_overlap < sysctl_sched_migration_cost && | ||
1135 | + pse->avg_overlap < sysctl_sched_migration_cost) { | ||
1136 | + resched_task(curr); | ||
1137 | + return; | ||
1138 | + } | ||
1139 | + | ||
1140 | /* | ||
1141 | * preemption test can be made between sibling entities who are in the | ||
1142 | * same cfs_rq i.e who have a common parent. Walk up the hierarchy of | ||
1143 | @@ -1642,7 +1649,7 @@ static void prio_changed_fair(struct rq *rq, struct task_struct *p, | ||
1144 | if (p->prio > oldprio) | ||
1145 | resched_task(rq->curr); | ||
1146 | } else | ||
1147 | - check_preempt_curr(rq, p); | ||
1148 | + check_preempt_curr(rq, p, 0); | ||
1149 | } | ||
1150 | |||
1151 | /* | ||
1152 | @@ -1659,7 +1666,7 @@ static void switched_to_fair(struct rq *rq, struct task_struct *p, | ||
1153 | if (running) | ||
1154 | resched_task(rq->curr); | ||
1155 | else | ||
1156 | - check_preempt_curr(rq, p); | ||
1157 | + check_preempt_curr(rq, p, 0); | ||
1158 | } | ||
1159 | |||
1160 | /* Account for a task changing its policy or group. | ||
1161 | diff --git a/kernel/sched_features.h b/kernel/sched_features.h | ||
1162 | index c4c88ae..4e51893 100644 | ||
1163 | --- a/kernel/sched_features.h | ||
1164 | +++ b/kernel/sched_features.h | ||
1165 | @@ -11,3 +11,4 @@ SCHED_FEAT(ASYM_GRAN, 1) | ||
1166 | SCHED_FEAT(LB_BIAS, 1) | ||
1167 | SCHED_FEAT(LB_WAKEUP_UPDATE, 1) | ||
1168 | SCHED_FEAT(ASYM_EFF_LOAD, 1) | ||
1169 | +SCHED_FEAT(WAKEUP_OVERLAP, 1) | ||
1170 | diff --git a/kernel/sched_idletask.c b/kernel/sched_idletask.c | ||
1171 | index 3a4f92d..dec4cca 100644 | ||
1172 | --- a/kernel/sched_idletask.c | ||
1173 | +++ b/kernel/sched_idletask.c | ||
1174 | @@ -14,7 +14,7 @@ static int select_task_rq_idle(struct task_struct *p, int sync) | ||
1175 | /* | ||
1176 | * Idle tasks are unconditionally rescheduled: | ||
1177 | */ | ||
1178 | -static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p) | ||
1179 | +static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int sync) | ||
1180 | { | ||
1181 | resched_task(rq->idle); | ||
1182 | } | ||
1183 | @@ -76,7 +76,7 @@ static void switched_to_idle(struct rq *rq, struct task_struct *p, | ||
1184 | if (running) | ||
1185 | resched_task(rq->curr); | ||
1186 | else | ||
1187 | - check_preempt_curr(rq, p); | ||
1188 | + check_preempt_curr(rq, p, 0); | ||
1189 | } | ||
1190 | |||
1191 | static void prio_changed_idle(struct rq *rq, struct task_struct *p, | ||
1192 | @@ -93,7 +93,7 @@ static void prio_changed_idle(struct rq *rq, struct task_struct *p, | ||
1193 | if (p->prio > oldprio) | ||
1194 | resched_task(rq->curr); | ||
1195 | } else | ||
1196 | - check_preempt_curr(rq, p); | ||
1197 | + check_preempt_curr(rq, p, 0); | ||
1198 | } | ||
1199 | |||
1200 | /* | ||
1201 | diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c | ||
1202 | index 37f0721..68c4745 100644 | ||
1203 | --- a/kernel/sched_rt.c | ||
1204 | +++ b/kernel/sched_rt.c | ||
1205 | @@ -784,7 +784,7 @@ static void check_preempt_equal_prio(struct rq *rq, struct task_struct *p) | ||
1206 | /* | ||
1207 | * Preempt the current task with a newly woken task if needed: | ||
1208 | */ | ||
1209 | -static void check_preempt_curr_rt(struct rq *rq, struct task_struct *p) | ||
1210 | +static void check_preempt_curr_rt(struct rq *rq, struct task_struct *p, int sync) | ||
1211 | { | ||
1212 | if (p->prio < rq->curr->prio) { | ||
1213 | resched_task(rq->curr); | ||
1214 | diff --git a/mm/mempolicy.c b/mm/mempolicy.c | ||
1215 | index 7acf81c..b759b7d 100644 | ||
1216 | --- a/mm/mempolicy.c | ||
1217 | +++ b/mm/mempolicy.c | ||
1218 | @@ -2029,8 +2029,8 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context) | ||
1219 | char *rest = nodelist; | ||
1220 | while (isdigit(*rest)) | ||
1221 | rest++; | ||
1222 | - if (!*rest) | ||
1223 | - err = 0; | ||
1224 | + if (*rest) | ||
1225 | + goto out; | ||
1226 | } | ||
1227 | break; | ||
1228 | case MPOL_INTERLEAVE: | ||
1229 | @@ -2039,7 +2039,6 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context) | ||
1230 | */ | ||
1231 | if (!nodelist) | ||
1232 | nodes = node_states[N_HIGH_MEMORY]; | ||
1233 | - err = 0; | ||
1234 | break; | ||
1235 | case MPOL_LOCAL: | ||
1236 | /* | ||
1237 | @@ -2049,11 +2048,19 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context) | ||
1238 | goto out; | ||
1239 | mode = MPOL_PREFERRED; | ||
1240 | break; | ||
1241 | - | ||
1242 | - /* | ||
1243 | - * case MPOL_BIND: mpol_new() enforces non-empty nodemask. | ||
1244 | - * case MPOL_DEFAULT: mpol_new() enforces empty nodemask, ignores flags. | ||
1245 | - */ | ||
1246 | + case MPOL_DEFAULT: | ||
1247 | + /* | ||
1248 | + * Insist on a empty nodelist | ||
1249 | + */ | ||
1250 | + if (!nodelist) | ||
1251 | + err = 0; | ||
1252 | + goto out; | ||
1253 | + case MPOL_BIND: | ||
1254 | + /* | ||
1255 | + * Insist on a nodelist | ||
1256 | + */ | ||
1257 | + if (!nodelist) | ||
1258 | + goto out; | ||
1259 | } | ||
1260 | |||
1261 | mode_flags = 0; | ||
1262 | @@ -2067,14 +2074,17 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context) | ||
1263 | else if (!strcmp(flags, "relative")) | ||
1264 | mode_flags |= MPOL_F_RELATIVE_NODES; | ||
1265 | else | ||
1266 | - err = 1; | ||
1267 | + goto out; | ||
1268 | } | ||
1269 | |||
1270 | new = mpol_new(mode, mode_flags, &nodes); | ||
1271 | if (IS_ERR(new)) | ||
1272 | - err = 1; | ||
1273 | - else if (no_context) | ||
1274 | - new->w.user_nodemask = nodes; /* save for contextualization */ | ||
1275 | + goto out; | ||
1276 | + err = 0; | ||
1277 | + if (no_context) { | ||
1278 | + /* save for contextualization */ | ||
1279 | + new->w.user_nodemask = nodes; | ||
1280 | + } | ||
1281 | |||
1282 | out: | ||
1283 | /* Restore string for error message */ | ||
1284 | diff --git a/mm/migrate.c b/mm/migrate.c | ||
1285 | index d493c02..96178f4 100644 | ||
1286 | --- a/mm/migrate.c | ||
1287 | +++ b/mm/migrate.c | ||
1288 | @@ -1062,6 +1062,9 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, | ||
1289 | goto out; | ||
1290 | |||
1291 | err = -ENODEV; | ||
1292 | + if (node < 0 || node >= MAX_NUMNODES) | ||
1293 | + goto out; | ||
1294 | + | ||
1295 | if (!node_state(node, N_HIGH_MEMORY)) | ||
1296 | goto out; | ||
1297 | |||
1298 | diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c | ||
1299 | index cd9d526..2268a7e 100644 | ||
1300 | --- a/net/ax25/af_ax25.c | ||
1301 | +++ b/net/ax25/af_ax25.c | ||
1302 | @@ -894,7 +894,6 @@ struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev) | ||
1303 | |||
1304 | sock_init_data(NULL, sk); | ||
1305 | |||
1306 | - sk->sk_destruct = ax25_free_sock; | ||
1307 | sk->sk_type = osk->sk_type; | ||
1308 | sk->sk_priority = osk->sk_priority; | ||
1309 | sk->sk_protocol = osk->sk_protocol; | ||
1310 | @@ -932,6 +931,7 @@ struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev) | ||
1311 | } | ||
1312 | |||
1313 | sk->sk_protinfo = ax25; | ||
1314 | + sk->sk_destruct = ax25_free_sock; | ||
1315 | ax25->sk = sk; | ||
1316 | |||
1317 | return sk; | ||
1318 | diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c | ||
1319 | index f976fc5..6d108fb 100644 | ||
1320 | --- a/net/ipv4/tcp_minisocks.c | ||
1321 | +++ b/net/ipv4/tcp_minisocks.c | ||
1322 | @@ -362,7 +362,7 @@ void tcp_twsk_destructor(struct sock *sk) | ||
1323 | #ifdef CONFIG_TCP_MD5SIG | ||
1324 | struct tcp_timewait_sock *twsk = tcp_twsk(sk); | ||
1325 | if (twsk->tw_md5_keylen) | ||
1326 | - tcp_put_md5sig_pool(); | ||
1327 | + tcp_free_md5sig_pool(); | ||
1328 | #endif | ||
1329 | } | ||
1330 | |||
1331 | diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c | ||
1332 | index b7a50e9..0a913c9 100644 | ||
1333 | --- a/net/ipv6/sit.c | ||
1334 | +++ b/net/ipv6/sit.c | ||
1335 | @@ -260,7 +260,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t, | ||
1336 | |||
1337 | c = 0; | ||
1338 | for (prl = t->prl; prl; prl = prl->next) { | ||
1339 | - if (c > cmax) | ||
1340 | + if (c >= cmax) | ||
1341 | break; | ||
1342 | if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr) | ||
1343 | continue; | ||
1344 | diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c | ||
1345 | index 1122c95..2b801a0 100644 | ||
1346 | --- a/net/sched/sch_api.c | ||
1347 | +++ b/net/sched/sch_api.c | ||
1348 | @@ -1453,6 +1453,8 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q, | ||
1349 | nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags); | ||
1350 | tcm = NLMSG_DATA(nlh); | ||
1351 | tcm->tcm_family = AF_UNSPEC; | ||
1352 | + tcm->tcm__pad1 = 0; | ||
1353 | + tcm->tcm__pad2 = 0; | ||
1354 | tcm->tcm_ifindex = qdisc_dev(q)->ifindex; | ||
1355 | tcm->tcm_parent = q->handle; | ||
1356 | tcm->tcm_handle = q->handle; | ||
1357 | diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c | ||
1358 | index facdaa9..3c33817 100644 | ||
1359 | --- a/net/unix/af_unix.c | ||
1360 | +++ b/net/unix/af_unix.c | ||
1361 | @@ -1491,6 +1491,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock, | ||
1362 | struct sk_buff *skb; | ||
1363 | int sent=0; | ||
1364 | struct scm_cookie tmp_scm; | ||
1365 | + bool fds_sent = false; | ||
1366 | |||
1367 | if (NULL == siocb->scm) | ||
1368 | siocb->scm = &tmp_scm; | ||
1369 | @@ -1552,12 +1553,14 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock, | ||
1370 | size = min_t(int, size, skb_tailroom(skb)); | ||
1371 | |||
1372 | memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred)); | ||
1373 | - if (siocb->scm->fp) { | ||
1374 | + /* Only send the fds in the first buffer */ | ||
1375 | + if (siocb->scm->fp && !fds_sent) { | ||
1376 | err = unix_attach_fds(siocb->scm, skb); | ||
1377 | if (err) { | ||
1378 | kfree_skb(skb); | ||
1379 | goto out_err; | ||
1380 | } | ||
1381 | + fds_sent = true; | ||
1382 | } | ||
1383 | |||
1384 | if ((err = memcpy_fromiovec(skb_put(skb,size), msg->msg_iov, size)) != 0) { |