kernel26-magellan-server/patches-2.6.25-r5/0108-2.6.25.9-all-fixes.patch

diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index d3437c4..e3b2185 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -141,7 +141,7 @@ static void dump_one_vdso_page(struct page *pg, struct page *upg)
 	printk("kpg: %p (c:%d,f:%08lx)", __va(page_to_pfn(pg) << PAGE_SHIFT),
 	       page_count(pg),
 	       pg->flags);
-	if (upg/* && pg != upg*/) {
+	if (upg && !IS_ERR(upg) /* && pg != upg*/) {
 		printk(" upg: %p (c:%d,f:%08lx)", __va(page_to_pfn(upg)
 						       << PAGE_SHIFT),
 		       page_count(upg),
diff --git a/arch/x86/kernel/setup_32.c b/arch/x86/kernel/setup_32.c
index 2b3e5d4..9ac056b 100644
--- a/arch/x86/kernel/setup_32.c
+++ b/arch/x86/kernel/setup_32.c
@@ -483,10 +483,16 @@ static void __init reserve_crashkernel(void)
 					(unsigned long)(crash_size >> 20),
 					(unsigned long)(crash_base >> 20),
 					(unsigned long)(total_mem >> 20));
+
+			if (reserve_bootmem(crash_base, crash_size,
+					BOOTMEM_EXCLUSIVE) < 0) {
+				printk(KERN_INFO "crashkernel reservation "
+					"failed - memory is in use\n");
+				return;
+			}
+
 			crashk_res.start = crash_base;
 			crashk_res.end   = crash_base + crash_size - 1;
-			reserve_bootmem(crash_base, crash_size,
-					BOOTMEM_DEFAULT);
 		} else
 			printk(KERN_INFO "crashkernel reservation failed - "
 					"you have to specify a base address\n");
diff --git a/drivers/hwmon/adt7473.c b/drivers/hwmon/adt7473.c
index 9587869..8396e0f 100644
--- a/drivers/hwmon/adt7473.c
+++ b/drivers/hwmon/adt7473.c
@@ -309,6 +309,9 @@ no_sensor_update:
 						ADT7473_REG_PWM_BHVR(i));
 	}
 
+	i = i2c_smbus_read_byte_data(client, ADT7473_REG_CFG4);
+	data->max_duty_at_overheat = !!(i & ADT7473_CFG4_MAX_DUTY_AT_OVT);
+
 	data->limits_last_updated = local_jiffies;
 	data->limits_valid = 1;
 
diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index 182fe6a..30bdd50 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -192,7 +192,7 @@ static int RANGE_TO_REG( int range )
 {
 	int i;
 
-	if ( range < lm85_range_map[0] ) { 
+	if (range <= lm85_range_map[0]) {
 		return 0 ;
 	} else if ( range > lm85_range_map[15] ) {
 		return 15 ;
diff --git a/drivers/net/atl1/atl1_hw.c b/drivers/net/atl1/atl1_hw.c
index 9d3bd22..a965f68 100644
--- a/drivers/net/atl1/atl1_hw.c
+++ b/drivers/net/atl1/atl1_hw.c
@@ -250,7 +250,6 @@ static int atl1_get_permanent_address(struct atl1_hw *hw)
 			memcpy(hw->perm_mac_addr, eth_addr, ETH_ALEN);
 			return 0;
 		}
-		return 1;
 	}
 
 	/* see if SPI FLAGS exist ? */
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 6483d10..2b756ef 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -140,49 +140,52 @@ static struct pci_device_id hpwdt_devices[] = {
 };
 MODULE_DEVICE_TABLE(pci, hpwdt_devices);
 
+extern asmlinkage void asminline_call(struct cmn_registers *pi86Regs, unsigned long *pRomEntry);
+
 #ifndef CONFIG_X86_64
 /* --32 Bit Bios------------------------------------------------------------ */
 
 #define HPWDT_ARCH	32
 
-static void asminline_call(struct cmn_registers *pi86Regs,
-			   unsigned long *pRomEntry)
-{
-	asm("pushl       %ebp               \n\t"
-	    "movl        %esp, %ebp         \n\t"
-	    "pusha                          \n\t"
-	    "pushf                          \n\t"
-	    "push        %es                \n\t"
-	    "push        %ds                \n\t"
-	    "pop         %es                \n\t"
-	    "movl        8(%ebp),%eax       \n\t"
-	    "movl        4(%eax),%ebx       \n\t"
-	    "movl        8(%eax),%ecx       \n\t"
-	    "movl        12(%eax),%edx      \n\t"
-	    "movl        16(%eax),%esi      \n\t"
-	    "movl        20(%eax),%edi      \n\t"
-	    "movl        (%eax),%eax        \n\t"
-	    "push        %cs                \n\t"
-	    "call        *12(%ebp)          \n\t"
-	    "pushf                          \n\t"
-	    "pushl       %eax               \n\t"
-	    "movl        8(%ebp),%eax       \n\t"
-	    "movl        %ebx,4(%eax)       \n\t"
-	    "movl        %ecx,8(%eax)       \n\t"
-	    "movl        %edx,12(%eax)      \n\t"
-	    "movl        %esi,16(%eax)      \n\t"
-	    "movl        %edi,20(%eax)      \n\t"
-	    "movw        %ds,24(%eax)       \n\t"
-	    "movw        %es,26(%eax)       \n\t"
-	    "popl        %ebx               \n\t"
-	    "movl        %ebx,(%eax)        \n\t"
-	    "popl        %ebx               \n\t"
-	    "movl        %ebx,28(%eax)      \n\t"
-	    "pop         %es                \n\t"
-	    "popf                           \n\t"
-	    "popa                           \n\t"
-	    "leave                          \n\t" "ret");
-}
+asm(".text                          \n\t"
+    ".align 4                       \n"
+    "asminline_call:                \n\t"
+    "pushl       %ebp               \n\t"
+    "movl        %esp, %ebp         \n\t"
+    "pusha                          \n\t"
+    "pushf                          \n\t"
+    "push        %es                \n\t"
+    "push        %ds                \n\t"
+    "pop         %es                \n\t"
+    "movl        8(%ebp),%eax       \n\t"
+    "movl        4(%eax),%ebx       \n\t"
+    "movl        8(%eax),%ecx       \n\t"
+    "movl        12(%eax),%edx      \n\t"
+    "movl        16(%eax),%esi      \n\t"
+    "movl        20(%eax),%edi      \n\t"
+    "movl        (%eax),%eax        \n\t"
+    "push        %cs                \n\t"
+    "call        *12(%ebp)          \n\t"
+    "pushf                          \n\t"
+    "pushl       %eax               \n\t"
+    "movl        8(%ebp),%eax       \n\t"
+    "movl        %ebx,4(%eax)       \n\t"
+    "movl        %ecx,8(%eax)       \n\t"
+    "movl        %edx,12(%eax)      \n\t"
+    "movl        %esi,16(%eax)      \n\t"
+    "movl        %edi,20(%eax)      \n\t"
+    "movw        %ds,24(%eax)       \n\t"
+    "movw        %es,26(%eax)       \n\t"
+    "popl        %ebx               \n\t"
+    "movl        %ebx,(%eax)        \n\t"
+    "popl        %ebx               \n\t"
+    "movl        %ebx,28(%eax)      \n\t"
+    "pop         %es                \n\t"
+    "popf                           \n\t"
+    "popa                           \n\t"
+    "leave                          \n\t"
+    "ret                            \n\t"
+    ".previous");
 
 /*
  *	cru_detect
@@ -333,43 +336,44 @@ static int __devinit detect_cru_service(void)
 
 #define HPWDT_ARCH	64
 
-static void asminline_call(struct cmn_registers *pi86Regs,
-			   unsigned long *pRomEntry)
-{
-	asm("pushq      %rbp            \n\t"
-	    "movq       %rsp, %rbp      \n\t"
-	    "pushq      %rax            \n\t"
-	    "pushq      %rbx            \n\t"
-	    "pushq      %rdx            \n\t"
-	    "pushq      %r12            \n\t"
-	    "pushq      %r9             \n\t"
-	    "movq       %rsi, %r12      \n\t"
-	    "movq       %rdi, %r9       \n\t"
-	    "movl       4(%r9),%ebx     \n\t"
-	    "movl       8(%r9),%ecx     \n\t"
-	    "movl       12(%r9),%edx    \n\t"
-	    "movl       16(%r9),%esi    \n\t"
-	    "movl       20(%r9),%edi    \n\t"
-	    "movl       (%r9),%eax      \n\t"
-	    "call       *%r12           \n\t"
-	    "pushfq                     \n\t"
-	    "popq        %r12           \n\t"
-	    "popfq                      \n\t"
-	    "movl       %eax, (%r9)     \n\t"
-	    "movl       %ebx, 4(%r9)    \n\t"
-	    "movl       %ecx, 8(%r9)    \n\t"
-	    "movl       %edx, 12(%r9)   \n\t"
-	    "movl       %esi, 16(%r9)   \n\t"
-	    "movl       %edi, 20(%r9)   \n\t"
-	    "movq       %r12, %rax      \n\t"
-	    "movl       %eax, 28(%r9)   \n\t"
-	    "popq       %r9             \n\t"
-	    "popq       %r12            \n\t"
-	    "popq       %rdx            \n\t"
-	    "popq       %rbx            \n\t"
-	    "popq       %rax            \n\t"
-	    "leave                      \n\t" "ret");
-}
+asm(".text                      \n\t"
+    ".align 4                   \n"
+    "asminline_call:            \n\t"
+    "pushq      %rbp            \n\t"
+    "movq       %rsp, %rbp      \n\t"
+    "pushq      %rax            \n\t"
+    "pushq      %rbx            \n\t"
+    "pushq      %rdx            \n\t"
+    "pushq      %r12            \n\t"
+    "pushq      %r9             \n\t"
+    "movq       %rsi, %r12      \n\t"
+    "movq       %rdi, %r9       \n\t"
+    "movl       4(%r9),%ebx     \n\t"
+    "movl       8(%r9),%ecx     \n\t"
+    "movl       12(%r9),%edx    \n\t"
+    "movl       16(%r9),%esi    \n\t"
+    "movl       20(%r9),%edi    \n\t"
+    "movl       (%r9),%eax      \n\t"
+    "call       *%r12           \n\t"
+    "pushfq                     \n\t"
+    "popq        %r12           \n\t"
+    "popfq                      \n\t"
+    "movl       %eax, (%r9)     \n\t"
+    "movl       %ebx, 4(%r9)    \n\t"
+    "movl       %ecx, 8(%r9)    \n\t"
+    "movl       %edx, 12(%r9)   \n\t"
+    "movl       %esi, 16(%r9)   \n\t"
+    "movl       %edi, 20(%r9)   \n\t"
+    "movq       %r12, %rax      \n\t"
+    "movl       %eax, 28(%r9)   \n\t"
+    "popq       %r9             \n\t"
+    "popq       %r12            \n\t"
+    "popq       %rdx            \n\t"
+    "popq       %rbx            \n\t"
+    "popq       %rax            \n\t"
+    "leave                      \n\t"
+    "ret                        \n\t"
+    ".previous");
 
 /*
  *	dmi_find_cru
diff --git a/include/asm-x86/page_32.h b/include/asm-x86/page_32.h
index 5f7257f..8f8085b 100644
--- a/include/asm-x86/page_32.h
+++ b/include/asm-x86/page_32.h
@@ -14,7 +14,8 @@
 #define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
 
 #ifdef CONFIG_X86_PAE
-#define __PHYSICAL_MASK_SHIFT	36
+/* 44=32+12, the limit we can fit into an unsigned long pfn */
+#define __PHYSICAL_MASK_SHIFT	44
 #define __VIRTUAL_MASK_SHIFT	32
 #define PAGETABLE_LEVELS	3
 
diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index 4e4e340..db3d837 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -94,7 +94,7 @@ extern unsigned long init_bootmem_node(pg_data_t *pgdat,
 				       unsigned long freepfn,
 				       unsigned long startpfn,
 				       unsigned long endpfn);
-extern void reserve_bootmem_node(pg_data_t *pgdat,
+extern int reserve_bootmem_node(pg_data_t *pgdat,
 				 unsigned long physaddr,
 				 unsigned long size,
 				 int flags);
diff --git a/mm/bootmem.c b/mm/bootmem.c
index 2ccea70..8bb58da 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -398,10 +398,10 @@ unsigned long __init init_bootmem_node(pg_data_t *pgdat, unsigned long freepfn,
 	return init_bootmem_core(pgdat, freepfn, startpfn, endpfn);
 }
 
-void __init reserve_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
+int __init reserve_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
 				 unsigned long size, int flags)
 {
-	reserve_bootmem_core(pgdat->bdata, physaddr, size, flags);
+	return reserve_bootmem_core(pgdat->bdata, physaddr, size, flags);
 }
 
 void __init free_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
diff --git a/mm/memory.c b/mm/memory.c
index 0d14d1e..df84668 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -943,17 +943,15 @@ struct page *follow_page(struct vm_area_struct *vma, unsigned long address,
 	}
 
 	ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
-	if (!ptep)
-		goto out;
 
 	pte = *ptep;
 	if (!pte_present(pte))
-		goto unlock;
+		goto no_page;
 	if ((flags & FOLL_WRITE) && !pte_write(pte))
 		goto unlock;
 	page = vm_normal_page(vma, address, pte);
 	if (unlikely(!page))
-		goto unlock;
+		goto bad_page;
 
 	if (flags & FOLL_GET)
 		get_page(page);
@@ -968,6 +966,15 @@ unlock:
 out:
 	return page;
 
+bad_page:
+	pte_unmap_unlock(ptep, ptl);
+	return ERR_PTR(-EFAULT);
+
+no_page:
+	pte_unmap_unlock(ptep, ptl);
+	if (!pte_none(pte))
+		return page;
+	/* Fall through to ZERO_PAGE handling */
 no_page_table:
 	/*
 	 * When core dumping an enormous anonymous area that nobody
@@ -982,6 +989,26 @@ no_page_table:
 	return page;
 }
 
+/* Can we do the FOLL_ANON optimization? */
+static inline int use_zero_page(struct vm_area_struct *vma)
+{
+	/*
+	 * We don't want to optimize FOLL_ANON for make_pages_present()
+	 * when it tries to page in a VM_LOCKED region. As to VM_SHARED,
+	 * we want to get the page from the page tables to make sure
+	 * that we serialize and update with any other user of that
+	 * mapping.
+	 */
+	if (vma->vm_flags & (VM_LOCKED | VM_SHARED))
+		return 0;
+	/*
+	 * And if we have a fault or a nopfn routine, it's not an
+	 * anonymous region.
+	 */
+	return !vma->vm_ops ||
+		(!vma->vm_ops->fault && !vma->vm_ops->nopfn);
+}
+
 int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
 		unsigned long start, int len, int write, int force,
 		struct page **pages, struct vm_area_struct **vmas)
@@ -1056,9 +1083,7 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
 		foll_flags = FOLL_TOUCH;
 		if (pages)
 			foll_flags |= FOLL_GET;
-		if (!write && !(vma->vm_flags & VM_LOCKED) &&
-		    (!vma->vm_ops || (!vma->vm_ops->nopage &&
-					!vma->vm_ops->fault)))
+		if (!write && use_zero_page(vma))
 			foll_flags |= FOLL_ANON;
 
 		do {
@@ -1104,6 +1129,8 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
 
 				cond_resched();
 			}
+			if (IS_ERR(page))
+				return i ? i : PTR_ERR(page);
 			if (pages) {
 				pages[i] = page;
 
diff --git a/mm/migrate.c b/mm/migrate.c
index 4e0eccc..6acc815 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -858,6 +858,11 @@ static int do_move_pages(struct mm_struct *mm, struct page_to_node *pm,
 			goto set_status;
 
 		page = follow_page(vma, pp->addr, FOLL_GET);
+
+		err = PTR_ERR(page);
+		if (IS_ERR(page))
+			goto set_status;
+
 		err = -ENOENT;
 		if (!page)
 			goto set_status;
@@ -921,6 +926,11 @@ static int do_pages_stat(struct mm_struct *mm, struct page_to_node *pm)
 			goto set_status;
 
 		page = follow_page(vma, pm->addr, 0);
+
+		err = PTR_ERR(page);
+		if (IS_ERR(page))
+			goto set_status;
+
 		err = -ENOENT;
 		/* Use PageReserved to check for zero page */
 		if (!page || PageReserved(page))
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 998e63a..2d42260 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4421,7 +4421,9 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len,
 	if (copy_from_user(&getaddrs, optval, len))
 		return -EFAULT;
 
-	if (getaddrs.addr_num <= 0) return -EINVAL;
+	if (getaddrs.addr_num <= 0 ||
+	    getaddrs.addr_num >= (INT_MAX / sizeof(union sctp_addr)))
+		return -EINVAL;
 	/*
 	 *  For UDP-style sockets, id specifies the association to query.
 	 *  If the id field is set to the value '0' then the locally bound
1	niro	677	diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
2			index d3437c4..e3b2185 100644
3			--- a/arch/powerpc/kernel/vdso.c
4			+++ b/arch/powerpc/kernel/vdso.c
5			@@ -141,7 +141,7 @@ static void dump_one_vdso_page(struct page pg, struct page upg)
6			printk("kpg: %p (c:%d,f:%08lx)", __va(page_to_pfn(pg) << PAGE_SHIFT),
7			page_count(pg),
8			pg->flags);
9			- if (upg/* && pg != upg*/) {
10			+ if (upg && !IS_ERR(upg) /* && pg != upg*/) {
11			printk(" upg: %p (c:%d,f:%08lx)", __va(page_to_pfn(upg)
12			<< PAGE_SHIFT),
13			page_count(upg),
14			diff --git a/arch/x86/kernel/setup_32.c b/arch/x86/kernel/setup_32.c
15			index 2b3e5d4..9ac056b 100644
16			--- a/arch/x86/kernel/setup_32.c
17			+++ b/arch/x86/kernel/setup_32.c
18			@@ -483,10 +483,16 @@ static void __init reserve_crashkernel(void)
19			(unsigned long)(crash_size >> 20),
20			(unsigned long)(crash_base >> 20),
21			(unsigned long)(total_mem >> 20));
22			+
23			+ if (reserve_bootmem(crash_base, crash_size,
24			+ BOOTMEM_EXCLUSIVE) < 0) {
25			+ printk(KERN_INFO "crashkernel reservation "
26			+ "failed - memory is in use\n");
27			+ return;
28			+ }
29			+
30			crashk_res.start = crash_base;
31			crashk_res.end = crash_base + crash_size - 1;
32			- reserve_bootmem(crash_base, crash_size,
33			- BOOTMEM_DEFAULT);
34			} else
35			printk(KERN_INFO "crashkernel reservation failed - "
36			"you have to specify a base address\n");
37			diff --git a/drivers/hwmon/adt7473.c b/drivers/hwmon/adt7473.c
38			index 9587869..8396e0f 100644
39			--- a/drivers/hwmon/adt7473.c
40			+++ b/drivers/hwmon/adt7473.c
41			@@ -309,6 +309,9 @@ no_sensor_update:
42			ADT7473_REG_PWM_BHVR(i));
43			}
44
45			+ i = i2c_smbus_read_byte_data(client, ADT7473_REG_CFG4);
46			+ data->max_duty_at_overheat = !!(i & ADT7473_CFG4_MAX_DUTY_AT_OVT);
47			+
48			data->limits_last_updated = local_jiffies;
49			data->limits_valid = 1;
50
51			diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
52			index 182fe6a..30bdd50 100644
53			--- a/drivers/hwmon/lm85.c
54			+++ b/drivers/hwmon/lm85.c
55			@@ -192,7 +192,7 @@ static int RANGE_TO_REG( int range )
56			{
57			int i;
58
59			- if ( range < lm85_range_map[0] ) {
60			+ if (range <= lm85_range_map[0]) {
61			return 0 ;
62			} else if ( range > lm85_range_map[15] ) {
63			return 15 ;
64			diff --git a/drivers/net/atl1/atl1_hw.c b/drivers/net/atl1/atl1_hw.c
65			index 9d3bd22..a965f68 100644
66			--- a/drivers/net/atl1/atl1_hw.c
67			+++ b/drivers/net/atl1/atl1_hw.c
68			@@ -250,7 +250,6 @@ static int atl1_get_permanent_address(struct atl1_hw *hw)
69			memcpy(hw->perm_mac_addr, eth_addr, ETH_ALEN);
70			return 0;
71			}
72			- return 1;
73			}
74
75			/* see if SPI FLAGS exist ? */
76			diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
77			index 6483d10..2b756ef 100644
78			--- a/drivers/watchdog/hpwdt.c
79			+++ b/drivers/watchdog/hpwdt.c
80			@@ -140,49 +140,52 @@ static struct pci_device_id hpwdt_devices[] = {
81			};
82			MODULE_DEVICE_TABLE(pci, hpwdt_devices);
83
84			+extern asmlinkage void asminline_call(struct cmn_registers pi86Regs, unsigned long pRomEntry);
85			+
86			#ifndef CONFIG_X86_64
87			/* --32 Bit Bios------------------------------------------------------------ */
88
89			#define HPWDT_ARCH 32
90
91			-static void asminline_call(struct cmn_registers *pi86Regs,
92			- unsigned long *pRomEntry)
93			-{
94			- asm("pushl %ebp \n\t"
95			- "movl %esp, %ebp \n\t"
96			- "pusha \n\t"
97			- "pushf \n\t"
98			- "push %es \n\t"
99			- "push %ds \n\t"
100			- "pop %es \n\t"
101			- "movl 8(%ebp),%eax \n\t"
102			- "movl 4(%eax),%ebx \n\t"
103			- "movl 8(%eax),%ecx \n\t"
104			- "movl 12(%eax),%edx \n\t"
105			- "movl 16(%eax),%esi \n\t"
106			- "movl 20(%eax),%edi \n\t"
107			- "movl (%eax),%eax \n\t"
108			- "push %cs \n\t"
109			- "call *12(%ebp) \n\t"
110			- "pushf \n\t"
111			- "pushl %eax \n\t"
112			- "movl 8(%ebp),%eax \n\t"
113			- "movl %ebx,4(%eax) \n\t"
114			- "movl %ecx,8(%eax) \n\t"
115			- "movl %edx,12(%eax) \n\t"
116			- "movl %esi,16(%eax) \n\t"
117			- "movl %edi,20(%eax) \n\t"
118			- "movw %ds,24(%eax) \n\t"
119			- "movw %es,26(%eax) \n\t"
120			- "popl %ebx \n\t"
121			- "movl %ebx,(%eax) \n\t"
122			- "popl %ebx \n\t"
123			- "movl %ebx,28(%eax) \n\t"
124			- "pop %es \n\t"
125			- "popf \n\t"
126			- "popa \n\t"
127			- "leave \n\t" "ret");
128			-}
129			+asm(".text \n\t"
130			+ ".align 4 \n"
131			+ "asminline_call: \n\t"
132			+ "pushl %ebp \n\t"
133			+ "movl %esp, %ebp \n\t"
134			+ "pusha \n\t"
135			+ "pushf \n\t"
136			+ "push %es \n\t"
137			+ "push %ds \n\t"
138			+ "pop %es \n\t"
139			+ "movl 8(%ebp),%eax \n\t"
140			+ "movl 4(%eax),%ebx \n\t"
141			+ "movl 8(%eax),%ecx \n\t"
142			+ "movl 12(%eax),%edx \n\t"
143			+ "movl 16(%eax),%esi \n\t"
144			+ "movl 20(%eax),%edi \n\t"
145			+ "movl (%eax),%eax \n\t"
146			+ "push %cs \n\t"
147			+ "call *12(%ebp) \n\t"
148			+ "pushf \n\t"
149			+ "pushl %eax \n\t"
150			+ "movl 8(%ebp),%eax \n\t"
151			+ "movl %ebx,4(%eax) \n\t"
152			+ "movl %ecx,8(%eax) \n\t"
153			+ "movl %edx,12(%eax) \n\t"
154			+ "movl %esi,16(%eax) \n\t"
155			+ "movl %edi,20(%eax) \n\t"
156			+ "movw %ds,24(%eax) \n\t"
157			+ "movw %es,26(%eax) \n\t"
158			+ "popl %ebx \n\t"
159			+ "movl %ebx,(%eax) \n\t"
160			+ "popl %ebx \n\t"
161			+ "movl %ebx,28(%eax) \n\t"
162			+ "pop %es \n\t"
163			+ "popf \n\t"
164			+ "popa \n\t"
165			+ "leave \n\t"
166			+ "ret \n\t"
167			+ ".previous");
168
169			/*
170			* cru_detect
171			@@ -333,43 +336,44 @@ static int __devinit detect_cru_service(void)
172
173			#define HPWDT_ARCH 64
174
175			-static void asminline_call(struct cmn_registers *pi86Regs,
176			- unsigned long *pRomEntry)
177			-{
178			- asm("pushq %rbp \n\t"
179			- "movq %rsp, %rbp \n\t"
180			- "pushq %rax \n\t"
181			- "pushq %rbx \n\t"
182			- "pushq %rdx \n\t"
183			- "pushq %r12 \n\t"
184			- "pushq %r9 \n\t"
185			- "movq %rsi, %r12 \n\t"
186			- "movq %rdi, %r9 \n\t"
187			- "movl 4(%r9),%ebx \n\t"
188			- "movl 8(%r9),%ecx \n\t"
189			- "movl 12(%r9),%edx \n\t"
190			- "movl 16(%r9),%esi \n\t"
191			- "movl 20(%r9),%edi \n\t"
192			- "movl (%r9),%eax \n\t"
193			- "call *%r12 \n\t"
194			- "pushfq \n\t"
195			- "popq %r12 \n\t"
196			- "popfq \n\t"
197			- "movl %eax, (%r9) \n\t"
198			- "movl %ebx, 4(%r9) \n\t"
199			- "movl %ecx, 8(%r9) \n\t"
200			- "movl %edx, 12(%r9) \n\t"
201			- "movl %esi, 16(%r9) \n\t"
202			- "movl %edi, 20(%r9) \n\t"
203			- "movq %r12, %rax \n\t"
204			- "movl %eax, 28(%r9) \n\t"
205			- "popq %r9 \n\t"
206			- "popq %r12 \n\t"
207			- "popq %rdx \n\t"
208			- "popq %rbx \n\t"
209			- "popq %rax \n\t"
210			- "leave \n\t" "ret");
211			-}
212			+asm(".text \n\t"
213			+ ".align 4 \n"
214			+ "asminline_call: \n\t"
215			+ "pushq %rbp \n\t"
216			+ "movq %rsp, %rbp \n\t"
217			+ "pushq %rax \n\t"
218			+ "pushq %rbx \n\t"
219			+ "pushq %rdx \n\t"
220			+ "pushq %r12 \n\t"
221			+ "pushq %r9 \n\t"
222			+ "movq %rsi, %r12 \n\t"
223			+ "movq %rdi, %r9 \n\t"
224			+ "movl 4(%r9),%ebx \n\t"
225			+ "movl 8(%r9),%ecx \n\t"
226			+ "movl 12(%r9),%edx \n\t"
227			+ "movl 16(%r9),%esi \n\t"
228			+ "movl 20(%r9),%edi \n\t"
229			+ "movl (%r9),%eax \n\t"
230			+ "call *%r12 \n\t"
231			+ "pushfq \n\t"
232			+ "popq %r12 \n\t"
233			+ "popfq \n\t"
234			+ "movl %eax, (%r9) \n\t"
235			+ "movl %ebx, 4(%r9) \n\t"
236			+ "movl %ecx, 8(%r9) \n\t"
237			+ "movl %edx, 12(%r9) \n\t"
238			+ "movl %esi, 16(%r9) \n\t"
239			+ "movl %edi, 20(%r9) \n\t"
240			+ "movq %r12, %rax \n\t"
241			+ "movl %eax, 28(%r9) \n\t"
242			+ "popq %r9 \n\t"
243			+ "popq %r12 \n\t"
244			+ "popq %rdx \n\t"
245			+ "popq %rbx \n\t"
246			+ "popq %rax \n\t"
247			+ "leave \n\t"
248			+ "ret \n\t"
249			+ ".previous");
250
251			/*
252			* dmi_find_cru
253			diff --git a/include/asm-x86/page_32.h b/include/asm-x86/page_32.h
254			index 5f7257f..8f8085b 100644
255			--- a/include/asm-x86/page_32.h
256			+++ b/include/asm-x86/page_32.h
257			@@ -14,7 +14,8 @@
258			#define __PAGE_OFFSET _AC(CONFIG_PAGE_OFFSET, UL)
259
260			#ifdef CONFIG_X86_PAE
261			-#define __PHYSICAL_MASK_SHIFT 36
262			+/* 44=32+12, the limit we can fit into an unsigned long pfn */
263			+#define __PHYSICAL_MASK_SHIFT 44
264			#define __VIRTUAL_MASK_SHIFT 32
265			#define PAGETABLE_LEVELS 3
266
267			diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
268			index 4e4e340..db3d837 100644
269			--- a/include/linux/bootmem.h
270			+++ b/include/linux/bootmem.h
271			@@ -94,7 +94,7 @@ extern unsigned long init_bootmem_node(pg_data_t *pgdat,
272			unsigned long freepfn,
273			unsigned long startpfn,
274			unsigned long endpfn);
275			-extern void reserve_bootmem_node(pg_data_t *pgdat,
276			+extern int reserve_bootmem_node(pg_data_t *pgdat,
277			unsigned long physaddr,
278			unsigned long size,
279			int flags);
280			diff --git a/mm/bootmem.c b/mm/bootmem.c
281			index 2ccea70..8bb58da 100644
282			--- a/mm/bootmem.c
283			+++ b/mm/bootmem.c
284			@@ -398,10 +398,10 @@ unsigned long __init init_bootmem_node(pg_data_t *pgdat, unsigned long freepfn,
285			return init_bootmem_core(pgdat, freepfn, startpfn, endpfn);
286			}
287
288			-void __init reserve_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
289			+int __init reserve_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
290			unsigned long size, int flags)
291			{
292			- reserve_bootmem_core(pgdat->bdata, physaddr, size, flags);
293			+ return reserve_bootmem_core(pgdat->bdata, physaddr, size, flags);
294			}
295
296			void __init free_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
297			diff --git a/mm/memory.c b/mm/memory.c
298			index 0d14d1e..df84668 100644
299			--- a/mm/memory.c
300			+++ b/mm/memory.c
301			@@ -943,17 +943,15 @@ struct page follow_page(struct vm_area_struct vma, unsigned long address,
302			}
303
304			ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
305			- if (!ptep)
306			- goto out;
307
308			pte = *ptep;
309			if (!pte_present(pte))
310			- goto unlock;
311			+ goto no_page;
312			if ((flags & FOLL_WRITE) && !pte_write(pte))
313			goto unlock;
314			page = vm_normal_page(vma, address, pte);
315			if (unlikely(!page))
316			- goto unlock;
317			+ goto bad_page;
318
319			if (flags & FOLL_GET)
320			get_page(page);
321			@@ -968,6 +966,15 @@ unlock:
322			out:
323			return page;
324
325			+bad_page:
326			+ pte_unmap_unlock(ptep, ptl);
327			+ return ERR_PTR(-EFAULT);
328			+
329			+no_page:
330			+ pte_unmap_unlock(ptep, ptl);
331			+ if (!pte_none(pte))
332			+ return page;
333			+ /* Fall through to ZERO_PAGE handling */
334			no_page_table:
335			/*
336			* When core dumping an enormous anonymous area that nobody
337			@@ -982,6 +989,26 @@ no_page_table:
338			return page;
339			}
340
341			+/* Can we do the FOLL_ANON optimization? */
342			+static inline int use_zero_page(struct vm_area_struct *vma)
343			+{
344			+ /*
345			+ * We don't want to optimize FOLL_ANON for make_pages_present()
346			+ * when it tries to page in a VM_LOCKED region. As to VM_SHARED,
347			+ * we want to get the page from the page tables to make sure
348			+ * that we serialize and update with any other user of that
349			+ * mapping.
350			+ */
351			+ if (vma->vm_flags & (VM_LOCKED \| VM_SHARED))
352			+ return 0;
353			+ /*
354			+ * And if we have a fault or a nopfn routine, it's not an
355			+ * anonymous region.
356			+ */
357			+ return !vma->vm_ops \|\|
358			+ (!vma->vm_ops->fault && !vma->vm_ops->nopfn);
359			+}
360			+
361			int get_user_pages(struct task_struct tsk, struct mm_struct mm,
362			unsigned long start, int len, int write, int force,
363			struct page pages, struct vm_area_struct vmas)
364			@@ -1056,9 +1083,7 @@ int get_user_pages(struct task_struct tsk, struct mm_struct mm,
365			foll_flags = FOLL_TOUCH;
366			if (pages)
367			foll_flags \|= FOLL_GET;
368			- if (!write && !(vma->vm_flags & VM_LOCKED) &&
369			- (!vma->vm_ops \|\| (!vma->vm_ops->nopage &&
370			- !vma->vm_ops->fault)))
371			+ if (!write && use_zero_page(vma))
372			foll_flags \|= FOLL_ANON;
373
374			do {
375			@@ -1104,6 +1129,8 @@ int get_user_pages(struct task_struct tsk, struct mm_struct mm,
376
377			cond_resched();
378			}
379			+ if (IS_ERR(page))
380			+ return i ? i : PTR_ERR(page);
381			if (pages) {
382			pages[i] = page;
383
384			diff --git a/mm/migrate.c b/mm/migrate.c
385			index 4e0eccc..6acc815 100644
386			--- a/mm/migrate.c
387			+++ b/mm/migrate.c
388			@@ -858,6 +858,11 @@ static int do_move_pages(struct mm_struct mm, struct page_to_node pm,
389			goto set_status;
390
391			page = follow_page(vma, pp->addr, FOLL_GET);
392			+
393			+ err = PTR_ERR(page);
394			+ if (IS_ERR(page))
395			+ goto set_status;
396			+
397			err = -ENOENT;
398			if (!page)
399			goto set_status;
400			@@ -921,6 +926,11 @@ static int do_pages_stat(struct mm_struct mm, struct page_to_node pm)
401			goto set_status;
402
403			page = follow_page(vma, pm->addr, 0);
404			+
405			+ err = PTR_ERR(page);
406			+ if (IS_ERR(page))
407			+ goto set_status;
408			+
409			err = -ENOENT;
410			/* Use PageReserved to check for zero page */
411			if (!page \|\| PageReserved(page))
412			diff --git a/net/sctp/socket.c b/net/sctp/socket.c
413			index 998e63a..2d42260 100644
414			--- a/net/sctp/socket.c
415			+++ b/net/sctp/socket.c
416			@@ -4421,7 +4421,9 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len,
417			if (copy_from_user(&getaddrs, optval, len))
418			return -EFAULT;
419
420			- if (getaddrs.addr_num <= 0) return -EINVAL;
421			+ if (getaddrs.addr_num <= 0 \|\|
422			+ getaddrs.addr_num >= (INT_MAX / sizeof(union sctp_addr)))
423			+ return -EINVAL;
424			/*
425			* For UDP-style sockets, id specifies the association to query.
426			* If the id field is set to the value '0' then the locally bound