Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-magellan-server/patches-2.6.25-r4/0100-2.6.25.1-all-fixes.patch

    Contents of /trunk/kernel26-magellan-server/patches-2.6.25-r4/0100-2.6.25.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 665 - (show annotations) (download)
    Wed Jul 30 14:06:06 2008 UTC (15 years, 9 months ago) by niro
    File size: 36826 byte(s) 
    -2.6.25-magellan-r4; updated to linux-2.6.25.10
    1 diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
    2 index 8c71daf..9fee37e 100644
    3 --- a/arch/alpha/kernel/osf_sys.c
    4 +++ b/arch/alpha/kernel/osf_sys.c
    5 @@ -75,6 +75,7 @@ osf_set_program_attributes(unsigned long text_start, unsigned long text_len,
    6 lock_kernel();
    7 mm = current->mm;
    8 mm->end_code = bss_start + bss_len;
    9 + mm->start_brk = bss_start + bss_len;
    10 mm->brk = bss_start + bss_len;
    11 #if 0
    12 printk("set_program_attributes(%lx %lx %lx %lx)\n",
    13 diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c
    14 index 4ca5486..f239b30 100644
    15 --- a/arch/x86/kernel/io_apic_32.c
    16 +++ b/arch/x86/kernel/io_apic_32.c
    17 @@ -2477,6 +2477,7 @@ void destroy_irq(unsigned int irq)
    18 dynamic_irq_cleanup(irq);
    19
    20 spin_lock_irqsave(&vector_lock, flags);
    21 + clear_bit(irq_vector[irq], used_vectors);
    22 irq_vector[irq] = 0;
    23 spin_unlock_irqrestore(&vector_lock, flags);
    24 }
    25 diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
    26 index a871586..579745c 100644
    27 --- a/arch/x86/pci/irq.c
    28 +++ b/arch/x86/pci/irq.c
    29 @@ -200,7 +200,7 @@ static int pirq_ali_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
    30 {
    31 static const unsigned char irqmap[16] = { 0, 9, 3, 10, 4, 5, 7, 6, 1, 11, 0, 12, 0, 14, 0, 15 };
    32
    33 - WARN_ON_ONCE(pirq >= 16);
    34 + WARN_ON_ONCE(pirq > 16);
    35 return irqmap[read_config_nybble(router, 0x48, pirq-1)];
    36 }
    37
    38 @@ -209,7 +209,7 @@ static int pirq_ali_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i
    39 static const unsigned char irqmap[16] = { 0, 8, 0, 2, 4, 5, 7, 6, 0, 1, 3, 9, 11, 0, 13, 15 };
    40 unsigned int val = irqmap[irq];
    41
    42 - WARN_ON_ONCE(pirq >= 16);
    43 + WARN_ON_ONCE(pirq > 16);
    44 if (val) {
    45 write_config_nybble(router, 0x48, pirq-1, val);
    46 return 1;
    47 @@ -260,7 +260,7 @@ static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq
    48 {
    49 static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
    50
    51 - WARN_ON_ONCE(pirq >= 5);
    52 + WARN_ON_ONCE(pirq > 5);
    53 return read_config_nybble(router, 0x55, pirqmap[pirq-1]);
    54 }
    55
    56 @@ -268,7 +268,7 @@ static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq
    57 {
    58 static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
    59
    60 - WARN_ON_ONCE(pirq >= 5);
    61 + WARN_ON_ONCE(pirq > 5);
    62 write_config_nybble(router, 0x55, pirqmap[pirq-1], irq);
    63 return 1;
    64 }
    65 @@ -282,7 +282,7 @@ static int pirq_ite_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
    66 {
    67 static const unsigned char pirqmap[4] = { 1, 0, 2, 3 };
    68
    69 - WARN_ON_ONCE(pirq >= 4);
    70 + WARN_ON_ONCE(pirq > 4);
    71 return read_config_nybble(router,0x43, pirqmap[pirq-1]);
    72 }
    73
    74 @@ -290,7 +290,7 @@ static int pirq_ite_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i
    75 {
    76 static const unsigned char pirqmap[4] = { 1, 0, 2, 3 };
    77
    78 - WARN_ON_ONCE(pirq >= 4);
    79 + WARN_ON_ONCE(pirq > 4);
    80 write_config_nybble(router, 0x43, pirqmap[pirq-1], irq);
    81 return 1;
    82 }
    83 diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
    84 index b2112f5..a3b2374 100644
    85 --- a/drivers/infiniband/hw/nes/nes.c
    86 +++ b/drivers/infiniband/hw/nes/nes.c
    87 @@ -751,13 +751,13 @@ static void __devexit nes_remove(struct pci_dev *pcidev)
    88
    89 list_del(&nesdev->list);
    90 nes_destroy_cqp(nesdev);
    91 +
    92 + free_irq(pcidev->irq, nesdev);
    93 tasklet_kill(&nesdev->dpc_tasklet);
    94
    95 /* Deallocate the Adapter Structure */
    96 nes_destroy_adapter(nesdev->nesadapter);
    97
    98 - free_irq(pcidev->irq, nesdev);
    99 -
    100 if (nesdev->msi_enabled) {
    101 pci_disable_msi(pcidev);
    102 }
    103 diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
    104 index 0bef878..96b1a0e 100644
    105 --- a/drivers/infiniband/hw/nes/nes_cm.c
    106 +++ b/drivers/infiniband/hw/nes/nes_cm.c
    107 @@ -1834,8 +1834,10 @@ int mini_cm_recv_pkt(struct nes_cm_core *cm_core, struct nes_vnic *nesvnic,
    108 nfo.rem_addr = ntohl(iph->saddr);
    109 nfo.rem_port = ntohs(tcph->source);
    110
    111 - nes_debug(NES_DBG_CM, "Received packet: dest=0x%08X:0x%04X src=0x%08X:0x%04X\n",
    112 - iph->daddr, tcph->dest, iph->saddr, tcph->source);
    113 + nes_debug(NES_DBG_CM, "Received packet: dest=" NIPQUAD_FMT
    114 + ":0x%04X src=" NIPQUAD_FMT ":0x%04X\n",
    115 + NIPQUAD(iph->daddr), tcph->dest,
    116 + NIPQUAD(iph->saddr), tcph->source);
    117
    118 /* note: this call is going to increment cm_node ref count */
    119 cm_node = find_node(cm_core,
    120 diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
    121 index 49e53e4..496655e 100644
    122 --- a/drivers/infiniband/hw/nes/nes_hw.c
    123 +++ b/drivers/infiniband/hw/nes/nes_hw.c
    124 @@ -625,6 +625,15 @@ unsigned int nes_reset_adapter_ne020(struct nes_device *nesdev, u8 *OneG_Mode)
    125 nes_debug(NES_DBG_INIT, "Did not see full soft reset done.\n");
    126 return 0;
    127 }
    128 +
    129 + i = 0;
    130 + while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000)
    131 + mdelay(1);
    132 + if (i >= 10000) {
    133 + printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n",
    134 + nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS));
    135 + return 0;
    136 + }
    137 }
    138
    139 /* port reset */
    140 @@ -673,17 +682,6 @@ unsigned int nes_reset_adapter_ne020(struct nes_device *nesdev, u8 *OneG_Mode)
    141 }
    142 }
    143
    144 -
    145 -
    146 - i = 0;
    147 - while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000)
    148 - mdelay(1);
    149 - if (i >= 10000) {
    150 - printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n",
    151 - nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS));
    152 - return 0;
    153 - }
    154 -
    155 return port_count;
    156 }
    157
    158 diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
    159 index 5bbce29..c7d305b 100644
    160 --- a/drivers/md/dm-exception-store.c
    161 +++ b/drivers/md/dm-exception-store.c
    162 @@ -131,7 +131,7 @@ struct pstore {
    163
    164 static unsigned sectors_to_pages(unsigned sectors)
    165 {
    166 - return sectors / (PAGE_SIZE >> 9);
    167 + return DIV_ROUND_UP(sectors, PAGE_SIZE >> 9);
    168 }
    169
    170 static int alloc_area(struct pstore *ps)
    171 diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
    172 index 8c9a8ad..8bf5596 100644
    173 --- a/drivers/media/video/cx88/cx88-cards.c
    174 +++ b/drivers/media/video/cx88/cx88-cards.c
    175 @@ -1354,6 +1354,10 @@ static const struct cx88_board cx88_boards[] = {
    176 }},
    177 /* fixme: Add radio support */
    178 .mpeg = CX88_MPEG_DVB | CX88_MPEG_BLACKBIRD,
    179 + .radio = {
    180 + .type = CX88_RADIO,
    181 + .gpio0 = 0xe780,
    182 + },
    183 },
    184 [CX88_BOARD_ADSTECH_PTV_390] = {
    185 .name = "ADS Tech Instant Video PCI",
    186 diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
    187 index edef2a5..1e6f36e 100644
    188 --- a/drivers/media/video/ivtv/ivtv-ioctl.c
    189 +++ b/drivers/media/video/ivtv/ivtv-ioctl.c
    190 @@ -741,7 +741,8 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, struct file *filp, unsigned int cmd, void
    191
    192 memset(vcap, 0, sizeof(*vcap));
    193 strcpy(vcap->driver, IVTV_DRIVER_NAME); /* driver name */
    194 - strcpy(vcap->card, itv->card_name); /* card type */
    195 + strncpy(vcap->card, itv->card_name,
    196 + sizeof(vcap->card)-1); /* card type */
    197 strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */
    198 vcap->version = IVTV_DRIVER_VERSION; /* version */
    199 vcap->capabilities = itv->v4l2_cap; /* capabilities */
    200 diff --git a/drivers/media/video/tea5761.c b/drivers/media/video/tea5761.c
    201 index 5326eec..de7e060 100644
    202 --- a/drivers/media/video/tea5761.c
    203 +++ b/drivers/media/video/tea5761.c
    204 @@ -249,14 +249,19 @@ int tea5761_autodetection(struct i2c_adapter* i2c_adap, u8 i2c_addr)
    205
    206 if (16 != (rc = tuner_i2c_xfer_recv(&i2c, buffer, 16))) {
    207 printk(KERN_WARNING "it is not a TEA5761. Received %i chars.\n", rc);
    208 - return EINVAL;
    209 + return -EINVAL;
    210 }
    211
    212 - if (!((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061))) {
    213 - printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x. It is not a TEA5761\n",buffer[13],buffer[14],buffer[15]);
    214 - return EINVAL;
    215 + if ((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061)) {
    216 + printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x."
    217 + " It is not a TEA5761\n",
    218 + buffer[13], buffer[14], buffer[15]);
    219 + return -EINVAL;
    220 }
    221 - printk(KERN_WARNING "TEA5761 detected.\n");
    222 + printk(KERN_WARNING "tea5761: TEA%02x%02x detected. "
    223 + "Manufacturer ID= 0x%02x\n",
    224 + buffer[14], buffer[15], buffer[13]);
    225 +
    226 return 0;
    227 }
    228
    229 diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
    230 index 78a09a2..8cdbdd0 100644
    231 --- a/drivers/media/video/tuner-core.c
    232 +++ b/drivers/media/video/tuner-core.c
    233 @@ -1112,8 +1112,8 @@ static int tuner_probe(struct i2c_client *client)
    234 if (!no_autodetect) {
    235 switch (client->addr) {
    236 case 0x10:
    237 - if (tea5761_autodetection(t->i2c->adapter, t->i2c->addr)
    238 - != EINVAL) {
    239 + if (tea5761_autodetection(t->i2c->adapter,
    240 + t->i2c->addr) >= 0) {
    241 t->type = TUNER_TEA5761;
    242 t->mode_mask = T_RADIO;
    243 t->mode = T_STANDBY;
    244 @@ -1125,7 +1125,7 @@ static int tuner_probe(struct i2c_client *client)
    245
    246 goto register_client;
    247 }
    248 - break;
    249 + return -ENODEV;
    250 case 0x42:
    251 case 0x43:
    252 case 0x4a:
    253 diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
    254 index c082cf0..de11039 100644
    255 --- a/drivers/net/s2io.c
    256 +++ b/drivers/net/s2io.c
    257 @@ -84,7 +84,7 @@
    258 #include "s2io.h"
    259 #include "s2io-regs.h"
    260
    261 -#define DRV_VERSION "2.0.26.20"
    262 +#define DRV_VERSION "2.0.26.22"
    263
    264 /* S2io Driver name & version. */
    265 static char s2io_driver_name[] = "Neterion";
    266 @@ -2339,7 +2339,7 @@ static void free_tx_buffers(struct s2io_nic *nic)
    267 for (i = 0; i < config->tx_fifo_num; i++) {
    268 unsigned long flags;
    269 spin_lock_irqsave(&mac_control->fifos[i].tx_lock, flags);
    270 - for (j = 0; j < config->tx_cfg[i].fifo_len - 1; j++) {
    271 + for (j = 0; j < config->tx_cfg[i].fifo_len; j++) {
    272 txdp = (struct TxD *) \
    273 mac_control->fifos[i].list_info[j].list_virt_addr;
    274 skb = s2io_txdl_getskb(&mac_control->fifos[i], txdp, j);
    275 diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
    276 index 17585e5..432e837 100644
    277 --- a/drivers/net/tehuti.c
    278 +++ b/drivers/net/tehuti.c
    279 @@ -625,6 +625,12 @@ static void __init bdx_firmware_endianess(void)
    280 s_firmLoad[i] = CPU_CHIP_SWAP32(s_firmLoad[i]);
    281 }
    282
    283 +static int bdx_range_check(struct bdx_priv *priv, u32 offset)
    284 +{
    285 + return (offset > (u32) (BDX_REGS_SIZE / priv->nic->port_num)) ?
    286 + -EINVAL : 0;
    287 +}
    288 +
    289 static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
    290 {
    291 struct bdx_priv *priv = ndev->priv;
    292 @@ -643,9 +649,15 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
    293 DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]);
    294 }
    295
    296 + if (!capable(CAP_SYS_RAWIO))
    297 + return -EPERM;
    298 +
    299 switch (data[0]) {
    300
    301 case BDX_OP_READ:
    302 + error = bdx_range_check(priv, data[1]);
    303 + if (error < 0)
    304 + return error;
    305 data[2] = READ_REG(priv, data[1]);
    306 DBG("read_reg(0x%x)=0x%x (dec %d)\n", data[1], data[2],
    307 data[2]);
    308 @@ -655,6 +667,9 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
    309 break;
    310
    311 case BDX_OP_WRITE:
    312 + error = bdx_range_check(priv, data[1]);
    313 + if (error < 0)
    314 + return error;
    315 WRITE_REG(priv, data[1], data[2]);
    316 DBG("write_reg(0x%x, 0x%x)\n", data[1], data[2]);
    317 break;
    318 diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
    319 index 96043c5..bc4c62b 100644
    320 --- a/drivers/net/tg3.c
    321 +++ b/drivers/net/tg3.c
    322 @@ -64,8 +64,8 @@
    323
    324 #define DRV_MODULE_NAME "tg3"
    325 #define PFX DRV_MODULE_NAME ": "
    326 -#define DRV_MODULE_VERSION "3.90"
    327 -#define DRV_MODULE_RELDATE "April 12, 2008"
    328 +#define DRV_MODULE_VERSION "3.91"
    329 +#define DRV_MODULE_RELDATE "April 18, 2008"
    330
    331 #define TG3_DEF_MAC_MODE 0
    332 #define TG3_DEF_RX_MODE 0
    333 @@ -4135,11 +4135,21 @@ static int tigon3_dma_hwbug_workaround(struct tg3 *tp, struct sk_buff *skb,
    334 u32 last_plus_one, u32 *start,
    335 u32 base_flags, u32 mss)
    336 {
    337 - struct sk_buff *new_skb = skb_copy(skb, GFP_ATOMIC);
    338 + struct sk_buff *new_skb;
    339 dma_addr_t new_addr = 0;
    340 u32 entry = *start;
    341 int i, ret = 0;
    342
    343 + if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5701)
    344 + new_skb = skb_copy(skb, GFP_ATOMIC);
    345 + else {
    346 + int more_headroom = 4 - ((unsigned long)skb->data & 3);
    347 +
    348 + new_skb = skb_copy_expand(skb,
    349 + skb_headroom(skb) + more_headroom,
    350 + skb_tailroom(skb), GFP_ATOMIC);
    351 + }
    352 +
    353 if (!new_skb) {
    354 ret = -1;
    355 } else {
    356 @@ -4462,7 +4472,9 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
    357
    358 would_hit_hwbug = 0;
    359
    360 - if (tg3_4g_overflow_test(mapping, len))
    361 + if (tp->tg3_flags3 & TG3_FLG3_5701_DMA_BUG)
    362 + would_hit_hwbug = 1;
    363 + else if (tg3_4g_overflow_test(mapping, len))
    364 would_hit_hwbug = 1;
    365
    366 tg3_set_txd(tp, entry, mapping, len, base_flags,
    367 @@ -11339,6 +11351,38 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
    368 }
    369 }
    370
    371 + if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) {
    372 + static struct tg3_dev_id {
    373 + u32 vendor;
    374 + u32 device;
    375 + } bridge_chipsets[] = {
    376 + { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_0 },
    377 + { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_1 },
    378 + { },
    379 + };
    380 + struct tg3_dev_id *pci_id = &bridge_chipsets[0];
    381 + struct pci_dev *bridge = NULL;
    382 +
    383 + while (pci_id->vendor != 0) {
    384 + bridge = pci_get_device(pci_id->vendor,
    385 + pci_id->device,
    386 + bridge);
    387 + if (!bridge) {
    388 + pci_id++;
    389 + continue;
    390 + }
    391 + if (bridge->subordinate &&
    392 + (bridge->subordinate->number <=
    393 + tp->pdev->bus->number) &&
    394 + (bridge->subordinate->subordinate >=
    395 + tp->pdev->bus->number)) {
    396 + tp->tg3_flags3 |= TG3_FLG3_5701_DMA_BUG;
    397 + pci_dev_put(bridge);
    398 + break;
    399 + }
    400 + }
    401 + }
    402 +
    403 /* The EPB bridge inside 5714, 5715, and 5780 cannot support
    404 * DMA addresses > 40-bit. This bridge may have other additional
    405 * 57xx devices behind it in some 4-port NIC designs for example.
    406 diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
    407 index c1075a7..c688c3a 100644
    408 --- a/drivers/net/tg3.h
    409 +++ b/drivers/net/tg3.h
    410 @@ -2476,6 +2476,7 @@ struct tg3 {
    411 #define TG3_FLG3_NO_NVRAM_ADDR_TRANS 0x00000001
    412 #define TG3_FLG3_ENABLE_APE 0x00000002
    413 #define TG3_FLG3_5761_5784_AX_FIXES 0x00000004
    414 +#define TG3_FLG3_5701_DMA_BUG 0x00000008
    415
    416 struct timer_list timer;
    417 u16 timer_counter;
    418 diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
    419 index 48e9124..4ec1915 100644
    420 --- a/drivers/net/wireless/b43/dma.c
    421 +++ b/drivers/net/wireless/b43/dma.c
    422 @@ -822,6 +822,18 @@ static u64 supported_dma_mask(struct b43_wldev *dev)
    423 return DMA_30BIT_MASK;
    424 }
    425
    426 +static enum b43_dmatype dma_mask_to_engine_type(u64 dmamask)
    427 +{
    428 + if (dmamask == DMA_30BIT_MASK)
    429 + return B43_DMA_30BIT;
    430 + if (dmamask == DMA_32BIT_MASK)
    431 + return B43_DMA_32BIT;
    432 + if (dmamask == DMA_64BIT_MASK)
    433 + return B43_DMA_64BIT;
    434 + B43_WARN_ON(1);
    435 + return B43_DMA_30BIT;
    436 +}
    437 +
    438 /* Main initialization function. */
    439 static
    440 struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
    441 @@ -982,6 +994,42 @@ void b43_dma_free(struct b43_wldev *dev)
    442 dma->tx_ring0 = NULL;
    443 }
    444
    445 +static int b43_dma_set_mask(struct b43_wldev *dev, u64 mask)
    446 +{
    447 + u64 orig_mask = mask;
    448 + bool fallback = 0;
    449 + int err;
    450 +
    451 + /* Try to set the DMA mask. If it fails, try falling back to a
    452 + * lower mask, as we can always also support a lower one. */
    453 + while (1) {
    454 + err = ssb_dma_set_mask(dev->dev, mask);
    455 + if (!err)
    456 + break;
    457 + if (mask == DMA_64BIT_MASK) {
    458 + mask = DMA_32BIT_MASK;
    459 + fallback = 1;
    460 + continue;
    461 + }
    462 + if (mask == DMA_32BIT_MASK) {
    463 + mask = DMA_30BIT_MASK;
    464 + fallback = 1;
    465 + continue;
    466 + }
    467 + b43err(dev->wl, "The machine/kernel does not support "
    468 + "the required %u-bit DMA mask\n",
    469 + (unsigned int)dma_mask_to_engine_type(orig_mask));
    470 + return -EOPNOTSUPP;
    471 + }
    472 + if (fallback) {
    473 + b43info(dev->wl, "DMA mask fallback from %u-bit to %u-bit\n",
    474 + (unsigned int)dma_mask_to_engine_type(orig_mask),
    475 + (unsigned int)dma_mask_to_engine_type(mask));
    476 + }
    477 +
    478 + return 0;
    479 +}
    480 +
    481 int b43_dma_init(struct b43_wldev *dev)
    482 {
    483 struct b43_dma *dma = &dev->dma;
    484 @@ -991,27 +1039,10 @@ int b43_dma_init(struct b43_wldev *dev)
    485 enum b43_dmatype type;
    486
    487 dmamask = supported_dma_mask(dev);
    488 - switch (dmamask) {
    489 - default:
    490 - B43_WARN_ON(1);
    491 - case DMA_30BIT_MASK:
    492 - type = B43_DMA_30BIT;
    493 - break;
    494 - case DMA_32BIT_MASK:
    495 - type = B43_DMA_32BIT;
    496 - break;
    497 - case DMA_64BIT_MASK:
    498 - type = B43_DMA_64BIT;
    499 - break;
    500 - }
    501 - err = ssb_dma_set_mask(dev->dev, dmamask);
    502 - if (err) {
    503 - b43err(dev->wl, "The machine/kernel does not support "
    504 - "the required DMA mask (0x%08X%08X)\n",
    505 - (unsigned int)((dmamask & 0xFFFFFFFF00000000ULL) >> 32),
    506 - (unsigned int)(dmamask & 0x00000000FFFFFFFFULL));
    507 - return -EOPNOTSUPP;
    508 - }
    509 + type = dma_mask_to_engine_type(dmamask);
    510 + err = b43_dma_set_mask(dev, dmamask);
    511 + if (err)
    512 + return err;
    513
    514 err = -ENOMEM;
    515 /* setup TX DMA channels. */
    516 diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
    517 index c73a75b..f23317e 100644
    518 --- a/drivers/net/wireless/b43/main.c
    519 +++ b/drivers/net/wireless/b43/main.c
    520 @@ -78,6 +78,11 @@ static int modparam_nohwcrypt;
    521 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
    522 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
    523
    524 +static int modparam_btcoex = 1;
    525 +module_param_named(btcoex, modparam_btcoex, int, 0444);
    526 +MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
    527 +
    528 +
    529 static const struct ssb_device_id b43_ssb_tbl[] = {
    530 SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
    531 SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
    532 @@ -3339,6 +3344,8 @@ static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
    533 struct ssb_sprom *sprom = &dev->dev->bus->sprom;
    534 u32 hf;
    535
    536 + if (!modparam_btcoex)
    537 + return;
    538 if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
    539 return;
    540 if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
    541 @@ -3350,11 +3357,13 @@ static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
    542 else
    543 hf |= B43_HF_BTCOEX;
    544 b43_hf_write(dev, hf);
    545 - //TODO
    546 }
    547
    548 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
    549 -{ //TODO
    550 +{
    551 + if (!modparam_btcoex)
    552 + return;
    553 + //TODO
    554 }
    555
    556 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
    557 @@ -4000,8 +4009,16 @@ static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
    558 return err;
    559 }
    560
    561 +#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice) ( \
    562 + (pdev->vendor == PCI_VENDOR_ID_##_vendor) && \
    563 + (pdev->device == _device) && \
    564 + (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) && \
    565 + (pdev->subsystem_device == _subdevice) )
    566 +
    567 static void b43_sprom_fixup(struct ssb_bus *bus)
    568 {
    569 + struct pci_dev *pdev;
    570 +
    571 /* boardflags workarounds */
    572 if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
    573 bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
    574 @@ -4009,6 +4026,13 @@ static void b43_sprom_fixup(struct ssb_bus *bus)
    575 if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
    576 bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
    577 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
    578 + if (bus->bustype == SSB_BUSTYPE_PCI) {
    579 + pdev = bus->host_pci;
    580 + if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
    581 + IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
    582 + IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013))
    583 + bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
    584 + }
    585 }
    586
    587 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
    588 diff --git a/drivers/rtc/rtc-pcf8583.c b/drivers/rtc/rtc-pcf8583.c
    589 index 8b39970..3d09d8f 100644
    590 --- a/drivers/rtc/rtc-pcf8583.c
    591 +++ b/drivers/rtc/rtc-pcf8583.c
    592 @@ -15,7 +15,7 @@
    593 #include <linux/i2c.h>
    594 #include <linux/slab.h>
    595 #include <linux/string.h>
    596 -#include <linux/mc146818rtc.h>
    597 +#include <linux/rtc.h>
    598 #include <linux/init.h>
    599 #include <linux/errno.h>
    600 #include <linux/bcd.h>
    601 diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
    602 index 3c1b433..0e8e092 100644
    603 --- a/drivers/scsi/qla2xxx/qla_os.c
    604 +++ b/drivers/scsi/qla2xxx/qla_os.c
    605 @@ -2357,7 +2357,7 @@ qla2x00_do_dpc(void *data)
    606 } else {
    607 fcport->login_retry = 0;
    608 }
    609 - if (fcport->login_retry == 0)
    610 + if (fcport->login_retry == 0 && status != QLA_SUCCESS)
    611 fcport->loop_id = FC_NO_LOOP_ID;
    612 }
    613 if (test_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags))
    614 diff --git a/drivers/serial/dz.c b/drivers/serial/dz.c
    615 index 116211f..0dddd68 100644
    616 --- a/drivers/serial/dz.c
    617 +++ b/drivers/serial/dz.c
    618 @@ -819,7 +819,7 @@ static void dz_console_putchar(struct uart_port *uport, int ch)
    619 dz_out(dport, DZ_TCR, mask);
    620 iob();
    621 udelay(2);
    622 - } while (loops--);
    623 + } while (--loops);
    624
    625 if (loops) /* Cannot send otherwise. */
    626 dz_out(dport, DZ_TDR, ch);
    627 diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
    628 index b434df7..274a448 100644
    629 --- a/drivers/ssb/pci.c
    630 +++ b/drivers/ssb/pci.c
    631 @@ -482,6 +482,11 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
    632 goto unsupported;
    633 }
    634
    635 + if (out->boardflags_lo == 0xFFFF)
    636 + out->boardflags_lo = 0; /* per specs */
    637 + if (out->boardflags_hi == 0xFFFF)
    638 + out->boardflags_hi = 0; /* per specs */
    639 +
    640 return 0;
    641 unsupported:
    642 ssb_printk(KERN_WARNING PFX "Unsupported SPROM revision %d "
    643 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    644 index 68fc521..7f1bc97 100644
    645 --- a/drivers/usb/core/hub.c
    646 +++ b/drivers/usb/core/hub.c
    647 @@ -2664,6 +2664,7 @@ loop:
    648 if ((status == -ENOTCONN) || (status == -ENOTSUPP))
    649 break;
    650 }
    651 + dev_err(hub_dev, "unable to enumerate USB device on port %d\n", port1);
    652
    653 done:
    654 hub_port_disable(hub, port1, 1);
    655 diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
    656 index d0360f6..b0e2275 100644
    657 --- a/drivers/usb/host/ohci-pci.c
    658 +++ b/drivers/usb/host/ohci-pci.c
    659 @@ -312,11 +312,13 @@ static int ohci_pci_suspend (struct usb_hcd *hcd, pm_message_t message)
    660
    661 static int ohci_pci_resume (struct usb_hcd *hcd)
    662 {
    663 + struct ohci_hcd *ohci = hcd_to_ohci(hcd);
    664 +
    665 set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
    666
    667 /* FIXME: we should try to detect loss of VBUS power here */
    668 prepare_for_handover(hcd);
    669 -
    670 + ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrenable);
    671 return 0;
    672 }
    673
    674 diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
    675 index ed67881..7b02a4a 100644
    676 --- a/drivers/usb/serial/sierra.c
    677 +++ b/drivers/usb/serial/sierra.c
    678 @@ -164,6 +164,7 @@ static struct usb_device_id id_table [] = {
    679 { USB_DEVICE(0x1199, 0x6812) }, /* Sierra Wireless MC8775 & AC 875U */
    680 { USB_DEVICE(0x1199, 0x6813) }, /* Sierra Wireless MC8775 (Thinkpad internal) */
    681 { USB_DEVICE(0x1199, 0x6815) }, /* Sierra Wireless MC8775 */
    682 + { USB_DEVICE(0x03f0, 0x1e1d) }, /* HP hs2300 a.k.a MC8775 */
    683 { USB_DEVICE(0x1199, 0x6820) }, /* Sierra Wireless AirCard 875 */
    684 { USB_DEVICE(0x1199, 0x6832) }, /* Sierra Wireless MC8780*/
    685 { USB_DEVICE(0x1199, 0x6833) }, /* Sierra Wireless MC8781*/
    686 diff --git a/fs/aio.c b/fs/aio.c
    687 index 2283686..ae94e1d 100644
    688 --- a/fs/aio.c
    689 +++ b/fs/aio.c
    690 @@ -1166,7 +1166,10 @@ retry:
    691 break;
    692 if (min_nr <= i)
    693 break;
    694 - ret = 0;
    695 + if (unlikely(ctx->dead)) {
    696 + ret = -EINVAL;
    697 + break;
    698 + }
    699 if (to.timed_out) /* Only check after read evt */
    700 break;
    701 /* Try to only show up in io wait if there are ops
    702 @@ -1231,6 +1234,13 @@ static void io_destroy(struct kioctx *ioctx)
    703
    704 aio_cancel_all(ioctx);
    705 wait_for_all_aios(ioctx);
    706 +
    707 + /*
    708 + * Wake up any waiters. The setting of ctx->dead must be seen
    709 + * by other CPUs at this point. Right now, we rely on the
    710 + * locking done by the above calls to ensure this consistency.
    711 + */
    712 + wake_up(&ioctx->wait);
    713 put_ioctx(ioctx); /* once for the lookup */
    714 }
    715
    716 diff --git a/fs/dnotify.c b/fs/dnotify.c
    717 index 28d01ed..eaecc4c 100644
    718 --- a/fs/dnotify.c
    719 +++ b/fs/dnotify.c
    720 @@ -20,6 +20,7 @@
    721 #include <linux/init.h>
    722 #include <linux/spinlock.h>
    723 #include <linux/slab.h>
    724 +#include <linux/file.h>
    725
    726 int dir_notify_enable __read_mostly = 1;
    727
    728 @@ -66,6 +67,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
    729 struct dnotify_struct **prev;
    730 struct inode *inode;
    731 fl_owner_t id = current->files;
    732 + struct file *f;
    733 int error = 0;
    734
    735 if ((arg & ~DN_MULTISHOT) == 0) {
    736 @@ -92,6 +94,15 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
    737 prev = &odn->dn_next;
    738 }
    739
    740 + rcu_read_lock();
    741 + f = fcheck(fd);
    742 + rcu_read_unlock();
    743 + /* we'd lost the race with close(), sod off silently */
    744 + /* note that inode->i_lock prevents reordering problems
    745 + * between accesses to descriptor table and ->i_dnotify */
    746 + if (f != filp)
    747 + goto out_free;
    748 +
    749 error = __f_setown(filp, task_pid(current), PIDTYPE_PID, 0);
    750 if (error)
    751 goto out_free;
    752 diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
    753 index a1db918..4c895f3 100644
    754 --- a/fs/jffs2/erase.c
    755 +++ b/fs/jffs2/erase.c
    756 @@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
    757 if (jffs2_write_nand_cleanmarker(c, jeb))
    758 goto filebad;
    759 }
    760 -
    761 - /* Everything else got zeroed before the erase */
    762 - jeb->free_size = c->sector_size;
    763 } else {
    764
    765 struct kvec vecs[1];
    766 @@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
    767
    768 goto filebad;
    769 }
    770 -
    771 - /* Everything else got zeroed before the erase */
    772 - jeb->free_size = c->sector_size;
    773 - /* FIXME Special case for cleanmarker in empty block */
    774 - jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
    775 }
    776 + /* Everything else got zeroed before the erase */
    777 + jeb->free_size = c->sector_size;
    778
    779 down(&c->erase_free_sem);
    780 spin_lock(&c->erase_completion_lock);
    781 +
    782 c->erasing_size -= c->sector_size;
    783 - c->free_size += jeb->free_size;
    784 - c->used_size += jeb->used_size;
    785 + c->free_size += c->sector_size;
    786 +
    787 + /* Account for cleanmarker now, if it's in-band */
    788 + if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c))
    789 + jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
    790
    791 jffs2_dbg_acct_sanity_check_nolock(c,jeb);
    792 jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
    793 diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
    794 index b9e1740..44c81c7 100644
    795 --- a/include/linux/rtnetlink.h
    796 +++ b/include/linux/rtnetlink.h
    797 @@ -740,13 +740,13 @@ extern void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change);
    798 extern void rtnl_lock(void);
    799 extern void rtnl_unlock(void);
    800 extern int rtnl_trylock(void);
    801 +extern int rtnl_is_locked(void);
    802
    803 extern void rtnetlink_init(void);
    804 extern void __rtnl_unlock(void);
    805
    806 #define ASSERT_RTNL() do { \
    807 - if (unlikely(rtnl_trylock())) { \
    808 - rtnl_unlock(); \
    809 + if (unlikely(!rtnl_is_locked())) { \
    810 printk(KERN_ERR "RTNL: assertion failed at %s (%d)\n", \
    811 __FILE__, __LINE__); \
    812 dump_stack(); \
    813 diff --git a/include/net/tcp.h b/include/net/tcp.h
    814 index 4fd3eb2..d69d12e 100644
    815 --- a/include/net/tcp.h
    816 +++ b/include/net/tcp.h
    817 @@ -776,11 +776,14 @@ extern void tcp_enter_cwr(struct sock *sk, const int set_ssthresh);
    818 extern __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst);
    819
    820 /* Slow start with delack produces 3 packets of burst, so that
    821 - * it is safe "de facto".
    822 + * it is safe "de facto". This will be the default - same as
    823 + * the default reordering threshold - but if reordering increases,
    824 + * we must be able to allow cwnd to burst at least this much in order
    825 + * to not pull it back when holes are filled.
    826 */
    827 static __inline__ __u32 tcp_max_burst(const struct tcp_sock *tp)
    828 {
    829 - return 3;
    830 + return tp->reordering;
    831 }
    832
    833 /* Returns end sequence number of the receiver's advertised window */
    834 diff --git a/include/net/xfrm.h b/include/net/xfrm.h
    835 index 0d255ae..97577de 100644
    836 --- a/include/net/xfrm.h
    837 +++ b/include/net/xfrm.h
    838 @@ -435,6 +435,9 @@ struct xfrm_tmpl
    839 /* May skip this transfomration if no SA is found */
    840 __u8 optional;
    841
    842 +/* Skip aalgos/ealgos/calgos checks. */
    843 + __u8 allalgs;
    844 +
    845 /* Bit mask of algos allowed for acquisition */
    846 __u32 aalgos;
    847 __u32 ealgos;
    848 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
    849 index 2727f92..6d8de05 100644
    850 --- a/kernel/cgroup.c
    851 +++ b/kernel/cgroup.c
    852 @@ -1722,7 +1722,12 @@ void cgroup_enable_task_cg_lists(void)
    853 use_task_css_set_links = 1;
    854 do_each_thread(g, p) {
    855 task_lock(p);
    856 - if (list_empty(&p->cg_list))
    857 + /*
    858 + * We should check if the process is exiting, otherwise
    859 + * it will race with cgroup_exit() in that the list
    860 + * entry won't be deleted though the process has exited.
    861 + */
    862 + if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list))
    863 list_add(&p->cg_list, &p->cgroups->tasks);
    864 task_unlock(p);
    865 } while_each_thread(g, p);
    866 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
    867 index 98bee01..c15a359 100644
    868 --- a/kernel/hrtimer.c
    869 +++ b/kernel/hrtimer.c
    870 @@ -590,7 +590,6 @@ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
    871 list_add_tail(&timer->cb_entry,
    872 &base->cpu_base->cb_pending);
    873 timer->state = HRTIMER_STATE_PENDING;
    874 - raise_softirq(HRTIMER_SOFTIRQ);
    875 return 1;
    876 default:
    877 BUG();
    878 @@ -633,6 +632,11 @@ static int hrtimer_switch_to_hres(void)
    879 return 1;
    880 }
    881
    882 +static inline void hrtimer_raise_softirq(void)
    883 +{
    884 + raise_softirq(HRTIMER_SOFTIRQ);
    885 +}
    886 +
    887 #else
    888
    889 static inline int hrtimer_hres_active(void) { return 0; }
    890 @@ -651,6 +655,7 @@ static inline int hrtimer_reprogram(struct hrtimer *timer,
    891 {
    892 return 0;
    893 }
    894 +static inline void hrtimer_raise_softirq(void) { }
    895
    896 #endif /* CONFIG_HIGH_RES_TIMERS */
    897
    898 @@ -850,7 +855,7 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
    899 {
    900 struct hrtimer_clock_base *base, *new_base;
    901 unsigned long flags;
    902 - int ret;
    903 + int ret, raise;
    904
    905 base = lock_hrtimer_base(timer, &flags);
    906
    907 @@ -884,8 +889,18 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
    908 enqueue_hrtimer(timer, new_base,
    909 new_base->cpu_base == &__get_cpu_var(hrtimer_bases));
    910
    911 + /*
    912 + * The timer may be expired and moved to the cb_pending
    913 + * list. We can not raise the softirq with base lock held due
    914 + * to a possible deadlock with runqueue lock.
    915 + */
    916 + raise = timer->state == HRTIMER_STATE_PENDING;
    917 +
    918 unlock_hrtimer_base(timer, &flags);
    919
    920 + if (raise)
    921 + hrtimer_raise_softirq();
    922 +
    923 return ret;
    924 }
    925 EXPORT_SYMBOL_GPL(hrtimer_start);
    926 @@ -1080,8 +1095,19 @@ static void run_hrtimer_pending(struct hrtimer_cpu_base *cpu_base)
    927 * If the timer was rearmed on another CPU, reprogram
    928 * the event device.
    929 */
    930 - if (timer->base->first == &timer->node)
    931 - hrtimer_reprogram(timer, timer->base);
    932 + struct hrtimer_clock_base *base = timer->base;
    933 +
    934 + if (base->first == &timer->node &&
    935 + hrtimer_reprogram(timer, base)) {
    936 + /*
    937 + * Timer is expired. Thus move it from tree to
    938 + * pending list again.
    939 + */
    940 + __remove_hrtimer(timer, base,
    941 + HRTIMER_STATE_PENDING, 0);
    942 + list_add_tail(&timer->cb_entry,
    943 + &base->cpu_base->cb_pending);
    944 + }
    945 }
    946 }
    947 spin_unlock_irq(&cpu_base->lock);
    948 diff --git a/mm/pagewalk.c b/mm/pagewalk.c
    949 index 1cf1417..0afd238 100644
    950 --- a/mm/pagewalk.c
    951 +++ b/mm/pagewalk.c
    952 @@ -9,11 +9,15 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
    953 int err = 0;
    954
    955 pte = pte_offset_map(pmd, addr);
    956 - do {
    957 + for (;;) {
    958 err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, private);
    959 if (err)
    960 break;
    961 - } while (pte++, addr += PAGE_SIZE, addr != end);
    962 + addr += PAGE_SIZE;
    963 + if (addr == end)
    964 + break;
    965 + pte++;
    966 + }
    967
    968 pte_unmap(pte);
    969 return err;
    970 diff --git a/net/can/raw.c b/net/can/raw.c
    971 index 94cd7f2..c92cb8e 100644
    972 --- a/net/can/raw.c
    973 +++ b/net/can/raw.c
    974 @@ -573,7 +573,8 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
    975 int fsize = ro->count * sizeof(struct can_filter);
    976 if (len > fsize)
    977 len = fsize;
    978 - err = copy_to_user(optval, ro->filter, len);
    979 + if (copy_to_user(optval, ro->filter, len))
    980 + err = -EFAULT;
    981 } else
    982 len = 0;
    983 release_sock(sk);
    984 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    985 index 2bd9c5f..0cb2772 100644
    986 --- a/net/core/rtnetlink.c
    987 +++ b/net/core/rtnetlink.c
    988 @@ -82,6 +82,11 @@ int rtnl_trylock(void)
    989 return mutex_trylock(&rtnl_mutex);
    990 }
    991
    992 +int rtnl_is_locked(void)
    993 +{
    994 + return mutex_is_locked(&rtnl_mutex);
    995 +}
    996 +
    997 static struct rtnl_link *rtnl_msg_handlers[NPROTO];
    998
    999 static inline int rtm_msgindex(int msgtype)
    1000 @@ -1389,6 +1394,7 @@ EXPORT_SYMBOL(rtnetlink_put_metrics);
    1001 EXPORT_SYMBOL(rtnl_lock);
    1002 EXPORT_SYMBOL(rtnl_trylock);
    1003 EXPORT_SYMBOL(rtnl_unlock);
    1004 +EXPORT_SYMBOL(rtnl_is_locked);
    1005 EXPORT_SYMBOL(rtnl_unicast);
    1006 EXPORT_SYMBOL(rtnl_notify);
    1007 EXPORT_SYMBOL(rtnl_set_sk_err);
    1008 diff --git a/net/dccp/probe.c b/net/dccp/probe.c
    1009 index 7053bb8..44eddcf 100644
    1010 --- a/net/dccp/probe.c
    1011 +++ b/net/dccp/probe.c
    1012 @@ -145,7 +145,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf,
    1013 goto out_free;
    1014
    1015 cnt = kfifo_get(dccpw.fifo, tbuf, len);
    1016 - error = copy_to_user(buf, tbuf, cnt);
    1017 + error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0;
    1018
    1019 out_free:
    1020 vfree(tbuf);
    1021 diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
    1022 index 87dd5bf..a79a547 100644
    1023 --- a/net/ipv4/tcp_probe.c
    1024 +++ b/net/ipv4/tcp_probe.c
    1025 @@ -190,19 +190,18 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
    1026
    1027 width = tcpprobe_sprint(tbuf, sizeof(tbuf));
    1028
    1029 - if (width < len)
    1030 + if (cnt + width < len)
    1031 tcp_probe.tail = (tcp_probe.tail + 1) % bufsize;
    1032
    1033 spin_unlock_bh(&tcp_probe.lock);
    1034
    1035 /* if record greater than space available
    1036 return partial buffer (so far) */
    1037 - if (width >= len)
    1038 + if (cnt + width >= len)
    1039 break;
    1040
    1041 - error = copy_to_user(buf + cnt, tbuf, width);
    1042 - if (error)
    1043 - break;
    1044 + if (copy_to_user(buf + cnt, tbuf, width))
    1045 + return -EFAULT;
    1046 cnt += width;
    1047 }
    1048
    1049 diff --git a/net/key/af_key.c b/net/key/af_key.c
    1050 index e9ef9af..5ceab25 100644
    1051 --- a/net/key/af_key.c
    1052 +++ b/net/key/af_key.c
    1053 @@ -1856,7 +1856,7 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
    1054 t->encap_family = xp->family;
    1055
    1056 /* No way to set this via kame pfkey */
    1057 - t->aalgos = t->ealgos = t->calgos = ~0;
    1058 + t->allalgs = 1;
    1059 xp->xfrm_nr++;
    1060 return 0;
    1061 }
    1062 diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
    1063 index 063cbc5..f9293c7 100644
    1064 --- a/net/rose/af_rose.c
    1065 +++ b/net/rose/af_rose.c
    1066 @@ -760,8 +760,10 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
    1067
    1068 rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause,
    1069 &diagnostic);
    1070 - if (!rose->neighbour)
    1071 - return -ENETUNREACH;
    1072 + if (!rose->neighbour) {
    1073 + err = -ENETUNREACH;
    1074 + goto out_release;
    1075 + }
    1076
    1077 rose->lci = rose_new_lci(rose->neighbour);
    1078 if (!rose->lci) {
    1079 diff --git a/net/tipc/socket.c b/net/tipc/socket.c
    1080 index 2290903..ac04733 100644
    1081 --- a/net/tipc/socket.c
    1082 +++ b/net/tipc/socket.c
    1083 @@ -1600,8 +1600,8 @@ static int getsockopt(struct socket *sock,
    1084 else if (len < sizeof(value)) {
    1085 res = -EINVAL;
    1086 }
    1087 - else if ((res = copy_to_user(ov, &value, sizeof(value)))) {
    1088 - /* couldn't return value */
    1089 + else if (copy_to_user(ov, &value, sizeof(value))) {
    1090 + res = -EFAULT;
    1091 }
    1092 else {
    1093 res = put_user(sizeof(value), ol);
    1094 diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
    1095 index 9fc4c31..c44076c 100644
    1096 --- a/net/xfrm/xfrm_policy.c
    1097 +++ b/net/xfrm/xfrm_policy.c
    1098 @@ -1772,7 +1772,7 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x,
    1099 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
    1100 (x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
    1101 x->props.mode == tmpl->mode &&
    1102 - ((tmpl->aalgos & (1<<x->props.aalgo)) ||
    1103 + (tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) ||
    1104 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
    1105 !(x->props.mode != XFRM_MODE_TRANSPORT &&
    1106 xfrm_state_addr_cmp(tmpl, x, family));
    1107 diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
    1108 index 019d21d..12f19be 100644
    1109 --- a/net/xfrm/xfrm_user.c
    1110 +++ b/net/xfrm/xfrm_user.c
    1111 @@ -975,6 +975,8 @@ static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
    1112 t->aalgos = ut->aalgos;
    1113 t->ealgos = ut->ealgos;
    1114 t->calgos = ut->calgos;
    1115 + /* If all masks are ~0, then we allow all algorithms. */
    1116 + t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
    1117 t->encap_family = ut->family;
    1118 }
    1119 }
    1120 diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
    1121 index d39b59c..f4fa982 100644
    1122 --- a/security/selinux/hooks.c
    1123 +++ b/security/selinux/hooks.c
    1124 @@ -756,9 +756,18 @@ static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
    1125 int set_context = (oldsbsec->flags & CONTEXT_MNT);
    1126 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
    1127
    1128 - /* we can't error, we can't save the info, this shouldn't get called
    1129 - * this early in the boot process. */
    1130 - BUG_ON(!ss_initialized);
    1131 + /*
    1132 + * if the parent was able to be mounted it clearly had no special lsm
    1133 + * mount options. thus we can safely put this sb on the list and deal
    1134 + * with it later
    1135 + */
    1136 + if (!ss_initialized) {
    1137 + spin_lock(&sb_security_lock);
    1138 + if (list_empty(&newsbsec->list))
    1139 + list_add(&newsbsec->list, &superblock_security_head);
    1140 + spin_unlock(&sb_security_lock);
    1141 + return;
    1142 + }
    1143
    1144 /* how can we clone if the old one wasn't set up?? */
    1145 BUG_ON(!oldsbsec->initialized);