Contents of /trunk/kernel26-magellan-server/patches-2.6.24-r7/0105-2.6.24.6-all-fixes.patch
Parent Directory
|
Revision Log
Revision 589 -
(show annotations)
(download)
Fri May 9 12:49:26 2008 UTC (16 years ago) by niro
File size: 8770 byte(s)
Fri May 9 12:49:26 2008 UTC (16 years ago) by niro
File size: 8770 byte(s)
-2.6.24-magellan-r7; updated to linux-2.6.24.7
1 | diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c |
2 | index 232fdeb..9994c52 100644 |
3 | --- a/arch/x86/kernel/io_apic_32.c |
4 | +++ b/arch/x86/kernel/io_apic_32.c |
5 | @@ -2478,6 +2478,7 @@ void destroy_irq(unsigned int irq) |
6 | dynamic_irq_cleanup(irq); |
7 | |
8 | spin_lock_irqsave(&vector_lock, flags); |
9 | + clear_bit(irq_vector[irq], used_vectors); |
10 | irq_vector[irq] = 0; |
11 | spin_unlock_irqrestore(&vector_lock, flags); |
12 | } |
13 | diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c |
14 | index 48c1775..cb42b69 100644 |
15 | --- a/drivers/isdn/capi/capidrv.c |
16 | +++ b/drivers/isdn/capi/capidrv.c |
17 | @@ -2332,13 +2332,14 @@ static int __init capidrv_init(void) |
18 | |
19 | static void __exit capidrv_exit(void) |
20 | { |
21 | - char rev[10]; |
22 | + char rev[32]; |
23 | char *p; |
24 | |
25 | if ((p = strchr(revision, ':')) != 0) { |
26 | - strcpy(rev, p + 1); |
27 | - p = strchr(rev, '$'); |
28 | - *p = 0; |
29 | + strncpy(rev, p + 1, sizeof(rev)); |
30 | + rev[sizeof(rev)-1] = 0; |
31 | + if ((p = strchr(rev, '$')) != 0) |
32 | + *p = 0; |
33 | } else { |
34 | strcpy(rev, " ??? "); |
35 | } |
36 | diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c |
37 | index ced83c2..ef1a300 100644 |
38 | --- a/drivers/isdn/i4l/isdn_net.c |
39 | +++ b/drivers/isdn/i4l/isdn_net.c |
40 | @@ -2010,6 +2010,7 @@ isdn_net_init(struct net_device *ndev) |
41 | ndev->flags = IFF_NOARP|IFF_POINTOPOINT; |
42 | ndev->type = ARPHRD_ETHER; |
43 | ndev->addr_len = ETH_ALEN; |
44 | + ndev->validate_addr = NULL; |
45 | |
46 | /* for clients with MPPP maybe higher values better */ |
47 | ndev->tx_queue_len = 30; |
48 | diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c |
49 | index a4eb6a8..0ff3e4c 100644 |
50 | --- a/drivers/media/video/cx88/cx88-cards.c |
51 | +++ b/drivers/media/video/cx88/cx88-cards.c |
52 | @@ -1349,6 +1349,10 @@ static const struct cx88_board cx88_boards[] = { |
53 | }}, |
54 | /* fixme: Add radio support */ |
55 | .mpeg = CX88_MPEG_DVB | CX88_MPEG_BLACKBIRD, |
56 | + .radio = { |
57 | + .type = CX88_RADIO, |
58 | + .gpio0 = 0xe780, |
59 | + }, |
60 | }, |
61 | [CX88_BOARD_ADSTECH_PTV_390] = { |
62 | .name = "ADS Tech Instant Video PCI", |
63 | diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c |
64 | index fd6826f..da9a10e 100644 |
65 | --- a/drivers/media/video/ivtv/ivtv-ioctl.c |
66 | +++ b/drivers/media/video/ivtv/ivtv-ioctl.c |
67 | @@ -727,7 +727,8 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, struct file *filp, unsigned int cmd, void |
68 | |
69 | memset(vcap, 0, sizeof(*vcap)); |
70 | strcpy(vcap->driver, IVTV_DRIVER_NAME); /* driver name */ |
71 | - strcpy(vcap->card, itv->card_name); /* card type */ |
72 | + strncpy(vcap->card, itv->card_name, |
73 | + sizeof(vcap->card)-1); /* card type */ |
74 | strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */ |
75 | vcap->version = IVTV_DRIVER_VERSION; /* version */ |
76 | vcap->capabilities = itv->v4l2_cap; /* capabilities */ |
77 | diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c |
78 | index 21230c9..fe5be1b 100644 |
79 | --- a/drivers/net/tehuti.c |
80 | +++ b/drivers/net/tehuti.c |
81 | @@ -625,6 +625,12 @@ static void __init bdx_firmware_endianess(void) |
82 | s_firmLoad[i] = CPU_CHIP_SWAP32(s_firmLoad[i]); |
83 | } |
84 | |
85 | +static int bdx_range_check(struct bdx_priv *priv, u32 offset) |
86 | +{ |
87 | + return (offset > (u32) (BDX_REGS_SIZE / priv->nic->port_num)) ? |
88 | + -EINVAL : 0; |
89 | +} |
90 | + |
91 | static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd) |
92 | { |
93 | struct bdx_priv *priv = ndev->priv; |
94 | @@ -643,9 +649,15 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd) |
95 | DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]); |
96 | } |
97 | |
98 | + if (!capable(CAP_NET_ADMIN)) |
99 | + return -EPERM; |
100 | + |
101 | switch (data[0]) { |
102 | |
103 | case BDX_OP_READ: |
104 | + error = bdx_range_check(priv, data[1]); |
105 | + if (error < 0) |
106 | + return error; |
107 | data[2] = READ_REG(priv, data[1]); |
108 | DBG("read_reg(0x%x)=0x%x (dec %d)\n", data[1], data[2], |
109 | data[2]); |
110 | @@ -655,6 +667,9 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd) |
111 | break; |
112 | |
113 | case BDX_OP_WRITE: |
114 | + error = bdx_range_check(priv, data[1]); |
115 | + if (error < 0) |
116 | + return error; |
117 | WRITE_REG(priv, data[1], data[2]); |
118 | DBG("write_reg(0x%x, 0x%x)\n", data[1], data[2]); |
119 | break; |
120 | diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c |
121 | index 9e732bf..ba7935d 100644 |
122 | --- a/drivers/usb/gadget/ether.c |
123 | +++ b/drivers/usb/gadget/ether.c |
124 | @@ -1561,6 +1561,7 @@ done_set_intf: |
125 | memcpy(req->buf, buf, n); |
126 | req->complete = rndis_response_complete; |
127 | rndis_free_response(dev->rndis_config, buf); |
128 | + value = n; |
129 | } |
130 | /* else stalls ... spec says to avoid that */ |
131 | } |
132 | diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c |
133 | index 497e29a..d7fae72 100644 |
134 | --- a/drivers/usb/serial/usb-serial.c |
135 | +++ b/drivers/usb/serial/usb-serial.c |
136 | @@ -844,6 +844,7 @@ int usb_serial_probe(struct usb_interface *interface, |
137 | serial->num_interrupt_in = num_interrupt_in; |
138 | serial->num_interrupt_out = num_interrupt_out; |
139 | |
140 | +#if 0 |
141 | /* check that the device meets the driver's requirements */ |
142 | if ((type->num_interrupt_in != NUM_DONT_CARE && |
143 | type->num_interrupt_in != num_interrupt_in) |
144 | @@ -857,6 +858,7 @@ int usb_serial_probe(struct usb_interface *interface, |
145 | kfree(serial); |
146 | return -EIO; |
147 | } |
148 | +#endif |
149 | |
150 | /* found all that we need */ |
151 | dev_info(&interface->dev, "%s converter detected\n", |
152 | diff --git a/fs/dnotify.c b/fs/dnotify.c |
153 | index 28d01ed..eaecc4c 100644 |
154 | --- a/fs/dnotify.c |
155 | +++ b/fs/dnotify.c |
156 | @@ -20,6 +20,7 @@ |
157 | #include <linux/init.h> |
158 | #include <linux/spinlock.h> |
159 | #include <linux/slab.h> |
160 | +#include <linux/file.h> |
161 | |
162 | int dir_notify_enable __read_mostly = 1; |
163 | |
164 | @@ -66,6 +67,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) |
165 | struct dnotify_struct **prev; |
166 | struct inode *inode; |
167 | fl_owner_t id = current->files; |
168 | + struct file *f; |
169 | int error = 0; |
170 | |
171 | if ((arg & ~DN_MULTISHOT) == 0) { |
172 | @@ -92,6 +94,15 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) |
173 | prev = &odn->dn_next; |
174 | } |
175 | |
176 | + rcu_read_lock(); |
177 | + f = fcheck(fd); |
178 | + rcu_read_unlock(); |
179 | + /* we'd lost the race with close(), sod off silently */ |
180 | + /* note that inode->i_lock prevents reordering problems |
181 | + * between accesses to descriptor table and ->i_dnotify */ |
182 | + if (f != filp) |
183 | + goto out_free; |
184 | + |
185 | error = __f_setown(filp, task_pid(current), PIDTYPE_PID, 0); |
186 | if (error) |
187 | goto out_free; |
188 | diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c |
189 | index a1db918..4c895f3 100644 |
190 | --- a/fs/jffs2/erase.c |
191 | +++ b/fs/jffs2/erase.c |
192 | @@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb |
193 | if (jffs2_write_nand_cleanmarker(c, jeb)) |
194 | goto filebad; |
195 | } |
196 | - |
197 | - /* Everything else got zeroed before the erase */ |
198 | - jeb->free_size = c->sector_size; |
199 | } else { |
200 | |
201 | struct kvec vecs[1]; |
202 | @@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb |
203 | |
204 | goto filebad; |
205 | } |
206 | - |
207 | - /* Everything else got zeroed before the erase */ |
208 | - jeb->free_size = c->sector_size; |
209 | - /* FIXME Special case for cleanmarker in empty block */ |
210 | - jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL); |
211 | } |
212 | + /* Everything else got zeroed before the erase */ |
213 | + jeb->free_size = c->sector_size; |
214 | |
215 | down(&c->erase_free_sem); |
216 | spin_lock(&c->erase_completion_lock); |
217 | + |
218 | c->erasing_size -= c->sector_size; |
219 | - c->free_size += jeb->free_size; |
220 | - c->used_size += jeb->used_size; |
221 | + c->free_size += c->sector_size; |
222 | + |
223 | + /* Account for cleanmarker now, if it's in-band */ |
224 | + if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c)) |
225 | + jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL); |
226 | |
227 | jffs2_dbg_acct_sanity_check_nolock(c,jeb); |
228 | jffs2_dbg_acct_paranoia_check_nolock(c, jeb); |
229 | diff --git a/fs/splice.c b/fs/splice.c |
230 | index e313478..109153c 100644 |
231 | --- a/fs/splice.c |
232 | +++ b/fs/splice.c |
233 | @@ -314,7 +314,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos, |
234 | break; |
235 | |
236 | error = add_to_page_cache_lru(page, mapping, index, |
237 | - GFP_KERNEL); |
238 | + mapping_gfp_mask(mapping)); |
239 | if (unlikely(error)) { |
240 | page_cache_release(page); |
241 | if (error == -EEXIST) |
242 | diff --git a/include/net/tcp.h b/include/net/tcp.h |
243 | index cb5b033..fbc4959 100644 |
244 | --- a/include/net/tcp.h |
245 | +++ b/include/net/tcp.h |
246 | @@ -775,11 +775,14 @@ extern void tcp_enter_cwr(struct sock *sk, const int set_ssthresh); |
247 | extern __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst); |
248 | |
249 | /* Slow start with delack produces 3 packets of burst, so that |
250 | - * it is safe "de facto". |
251 | + * it is safe "de facto". This will be the default - same as |
252 | + * the default reordering threshold - but if reordering increases, |
253 | + * we must be able to allow cwnd to burst at least this much in order |
254 | + * to not pull it back when holes are filled. |
255 | */ |
256 | static __inline__ __u32 tcp_max_burst(const struct tcp_sock *tp) |
257 | { |
258 | - return 3; |
259 | + return tp->reordering; |
260 | } |
261 | |
262 | /* RFC2861 Check whether we are limited by application or congestion window |