Annotation of /trunk/kernel26-magellan/patches-2.6.25-r5/0111-2.6.25.12-all-fixes.patch
Parent Directory | Revision Log
Revision 677 -
(hide annotations)
(download)
Wed Sep 10 21:27:27 2008 UTC (16 years ago) by niro
File size: 45066 byte(s)
Wed Sep 10 21:27:27 2008 UTC (16 years ago) by niro
File size: 45066 byte(s)
2.6.25-magellan-r5: - updated to linux-2.6.25.17
1 | niro | 677 | diff --git a/arch/powerpc/kernel/of_platform.c b/arch/powerpc/kernel/of_platform.c |
2 | index fb698d4..3ae33d4 100644 | ||
3 | --- a/arch/powerpc/kernel/of_platform.c | ||
4 | +++ b/arch/powerpc/kernel/of_platform.c | ||
5 | @@ -76,6 +76,8 @@ struct of_device* of_platform_device_create(struct device_node *np, | ||
6 | return NULL; | ||
7 | |||
8 | dev->dma_mask = 0xffffffffUL; | ||
9 | + dev->dev.coherent_dma_mask = DMA_32BIT_MASK; | ||
10 | + | ||
11 | dev->dev.bus = &of_platform_bus_type; | ||
12 | |||
13 | /* We do not fill the DMA ops for platform devices by default. | ||
14 | diff --git a/block/as-iosched.c b/block/as-iosched.c | ||
15 | index 8c39467..743f33a 100644 | ||
16 | --- a/block/as-iosched.c | ||
17 | +++ b/block/as-iosched.c | ||
18 | @@ -831,6 +831,8 @@ static void as_completed_request(struct request_queue *q, struct request *rq) | ||
19 | } | ||
20 | |||
21 | if (ad->changed_batch && ad->nr_dispatched == 1) { | ||
22 | + ad->current_batch_expires = jiffies + | ||
23 | + ad->batch_expire[ad->batch_data_dir]; | ||
24 | kblockd_schedule_work(&ad->antic_work); | ||
25 | ad->changed_batch = 0; | ||
26 | |||
27 | diff --git a/crypto/chainiv.c b/crypto/chainiv.c | ||
28 | index 6da3f57..9affade 100644 | ||
29 | --- a/crypto/chainiv.c | ||
30 | +++ b/crypto/chainiv.c | ||
31 | @@ -117,6 +117,7 @@ static int chainiv_init(struct crypto_tfm *tfm) | ||
32 | static int async_chainiv_schedule_work(struct async_chainiv_ctx *ctx) | ||
33 | { | ||
34 | int queued; | ||
35 | + int err = ctx->err; | ||
36 | |||
37 | if (!ctx->queue.qlen) { | ||
38 | smp_mb__before_clear_bit(); | ||
39 | @@ -131,7 +132,7 @@ static int async_chainiv_schedule_work(struct async_chainiv_ctx *ctx) | ||
40 | BUG_ON(!queued); | ||
41 | |||
42 | out: | ||
43 | - return ctx->err; | ||
44 | + return err; | ||
45 | } | ||
46 | |||
47 | static int async_chainiv_postpone_request(struct skcipher_givcrypt_request *req) | ||
48 | @@ -227,6 +228,7 @@ static void async_chainiv_do_postponed(struct work_struct *work) | ||
49 | postponed); | ||
50 | struct skcipher_givcrypt_request *req; | ||
51 | struct ablkcipher_request *subreq; | ||
52 | + int err; | ||
53 | |||
54 | /* Only handle one request at a time to avoid hogging keventd. */ | ||
55 | spin_lock_bh(&ctx->lock); | ||
56 | @@ -241,7 +243,11 @@ static void async_chainiv_do_postponed(struct work_struct *work) | ||
57 | subreq = skcipher_givcrypt_reqctx(req); | ||
58 | subreq->base.flags |= CRYPTO_TFM_REQ_MAY_SLEEP; | ||
59 | |||
60 | - async_chainiv_givencrypt_tail(req); | ||
61 | + err = async_chainiv_givencrypt_tail(req); | ||
62 | + | ||
63 | + local_bh_disable(); | ||
64 | + skcipher_givcrypt_complete(req, err); | ||
65 | + local_bh_enable(); | ||
66 | } | ||
67 | |||
68 | static int async_chainiv_init(struct crypto_tfm *tfm) | ||
69 | diff --git a/drivers/base/node.c b/drivers/base/node.c | ||
70 | index e59861f..8bbd21d 100644 | ||
71 | --- a/drivers/base/node.c | ||
72 | +++ b/drivers/base/node.c | ||
73 | @@ -70,8 +70,8 @@ static ssize_t node_read_meminfo(struct sys_device * dev, char * buf) | ||
74 | nid, K(i.totalram), | ||
75 | nid, K(i.freeram), | ||
76 | nid, K(i.totalram - i.freeram), | ||
77 | - nid, node_page_state(nid, NR_ACTIVE), | ||
78 | - nid, node_page_state(nid, NR_INACTIVE), | ||
79 | + nid, K(node_page_state(nid, NR_ACTIVE)), | ||
80 | + nid, K(node_page_state(nid, NR_INACTIVE)), | ||
81 | #ifdef CONFIG_HIGHMEM | ||
82 | nid, K(i.totalhigh), | ||
83 | nid, K(i.freehigh), | ||
84 | diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c | ||
85 | index 41636b8..b75a0d9 100644 | ||
86 | --- a/drivers/block/cciss.c | ||
87 | +++ b/drivers/block/cciss.c | ||
88 | @@ -106,35 +106,34 @@ MODULE_DEVICE_TABLE(pci, cciss_pci_device_id); | ||
89 | /* board_id = Subsystem Device ID & Vendor ID | ||
90 | * product = Marketing Name for the board | ||
91 | * access = Address of the struct of function pointers | ||
92 | - * nr_cmds = Number of commands supported by controller | ||
93 | */ | ||
94 | static struct board_type products[] = { | ||
95 | - {0x40700E11, "Smart Array 5300", &SA5_access, 512}, | ||
96 | - {0x40800E11, "Smart Array 5i", &SA5B_access, 512}, | ||
97 | - {0x40820E11, "Smart Array 532", &SA5B_access, 512}, | ||
98 | - {0x40830E11, "Smart Array 5312", &SA5B_access, 512}, | ||
99 | - {0x409A0E11, "Smart Array 641", &SA5_access, 512}, | ||
100 | - {0x409B0E11, "Smart Array 642", &SA5_access, 512}, | ||
101 | - {0x409C0E11, "Smart Array 6400", &SA5_access, 512}, | ||
102 | - {0x409D0E11, "Smart Array 6400 EM", &SA5_access, 512}, | ||
103 | - {0x40910E11, "Smart Array 6i", &SA5_access, 512}, | ||
104 | - {0x3225103C, "Smart Array P600", &SA5_access, 512}, | ||
105 | - {0x3223103C, "Smart Array P800", &SA5_access, 512}, | ||
106 | - {0x3234103C, "Smart Array P400", &SA5_access, 512}, | ||
107 | - {0x3235103C, "Smart Array P400i", &SA5_access, 512}, | ||
108 | - {0x3211103C, "Smart Array E200i", &SA5_access, 120}, | ||
109 | - {0x3212103C, "Smart Array E200", &SA5_access, 120}, | ||
110 | - {0x3213103C, "Smart Array E200i", &SA5_access, 120}, | ||
111 | - {0x3214103C, "Smart Array E200i", &SA5_access, 120}, | ||
112 | - {0x3215103C, "Smart Array E200i", &SA5_access, 120}, | ||
113 | - {0x3237103C, "Smart Array E500", &SA5_access, 512}, | ||
114 | - {0x323D103C, "Smart Array P700m", &SA5_access, 512}, | ||
115 | - {0x3241103C, "Smart Array P212", &SA5_access, 384}, | ||
116 | - {0x3243103C, "Smart Array P410", &SA5_access, 384}, | ||
117 | - {0x3245103C, "Smart Array P410i", &SA5_access, 384}, | ||
118 | - {0x3247103C, "Smart Array P411", &SA5_access, 384}, | ||
119 | - {0x3249103C, "Smart Array P812", &SA5_access, 384}, | ||
120 | - {0xFFFF103C, "Unknown Smart Array", &SA5_access, 120}, | ||
121 | + {0x40700E11, "Smart Array 5300", &SA5_access}, | ||
122 | + {0x40800E11, "Smart Array 5i", &SA5B_access}, | ||
123 | + {0x40820E11, "Smart Array 532", &SA5B_access}, | ||
124 | + {0x40830E11, "Smart Array 5312", &SA5B_access}, | ||
125 | + {0x409A0E11, "Smart Array 641", &SA5_access}, | ||
126 | + {0x409B0E11, "Smart Array 642", &SA5_access}, | ||
127 | + {0x409C0E11, "Smart Array 6400", &SA5_access}, | ||
128 | + {0x409D0E11, "Smart Array 6400 EM", &SA5_access}, | ||
129 | + {0x40910E11, "Smart Array 6i", &SA5_access}, | ||
130 | + {0x3225103C, "Smart Array P600", &SA5_access}, | ||
131 | + {0x3223103C, "Smart Array P800", &SA5_access}, | ||
132 | + {0x3234103C, "Smart Array P400", &SA5_access}, | ||
133 | + {0x3235103C, "Smart Array P400i", &SA5_access}, | ||
134 | + {0x3211103C, "Smart Array E200i", &SA5_access}, | ||
135 | + {0x3212103C, "Smart Array E200", &SA5_access}, | ||
136 | + {0x3213103C, "Smart Array E200i", &SA5_access}, | ||
137 | + {0x3214103C, "Smart Array E200i", &SA5_access}, | ||
138 | + {0x3215103C, "Smart Array E200i", &SA5_access}, | ||
139 | + {0x3237103C, "Smart Array E500", &SA5_access}, | ||
140 | + {0x323D103C, "Smart Array P700m", &SA5_access}, | ||
141 | + {0x3241103C, "Smart Array P212", &SA5_access}, | ||
142 | + {0x3243103C, "Smart Array P410", &SA5_access}, | ||
143 | + {0x3245103C, "Smart Array P410i", &SA5_access}, | ||
144 | + {0x3247103C, "Smart Array P411", &SA5_access}, | ||
145 | + {0x3249103C, "Smart Array P812", &SA5_access}, | ||
146 | + {0xFFFF103C, "Unknown Smart Array", &SA5_access}, | ||
147 | }; | ||
148 | |||
149 | /* How long to wait (in milliseconds) for board to go into simple mode */ | ||
150 | @@ -3082,11 +3081,20 @@ static int __devinit cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev) | ||
151 | print_cfg_table(c->cfgtable); | ||
152 | #endif /* CCISS_DEBUG */ | ||
153 | |||
154 | + /* Some controllers support Zero Memory Raid (ZMR). | ||
155 | + * When configured in ZMR mode the number of supported | ||
156 | + * commands drops to 64. So instead of just setting an | ||
157 | + * arbitrary value we make the driver a little smarter. | ||
158 | + * We read the config table to tell us how many commands | ||
159 | + * are supported on the controller then subtract 4 to | ||
160 | + * leave a little room for ioctl calls. | ||
161 | + */ | ||
162 | + c->max_commands = readl(&(c->cfgtable->CmdsOutMax)); | ||
163 | for (i = 0; i < ARRAY_SIZE(products); i++) { | ||
164 | if (board_id == products[i].board_id) { | ||
165 | c->product_name = products[i].product_name; | ||
166 | c->access = *(products[i].access); | ||
167 | - c->nr_cmds = products[i].nr_cmds; | ||
168 | + c->nr_cmds = c->max_commands - 4; | ||
169 | break; | ||
170 | } | ||
171 | } | ||
172 | @@ -3106,7 +3114,7 @@ static int __devinit cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev) | ||
173 | if (subsystem_vendor_id == PCI_VENDOR_ID_HP) { | ||
174 | c->product_name = products[i-1].product_name; | ||
175 | c->access = *(products[i-1].access); | ||
176 | - c->nr_cmds = products[i-1].nr_cmds; | ||
177 | + c->nr_cmds = c->max_commands - 4; | ||
178 | printk(KERN_WARNING "cciss: This is an unknown " | ||
179 | "Smart Array controller.\n" | ||
180 | "cciss: Please update to the latest driver " | ||
181 | diff --git a/drivers/char/pcmcia/ipwireless/hardware.c b/drivers/char/pcmcia/ipwireless/hardware.c | ||
182 | index d353866..48c2040 100644 | ||
183 | --- a/drivers/char/pcmcia/ipwireless/hardware.c | ||
184 | +++ b/drivers/char/pcmcia/ipwireless/hardware.c | ||
185 | @@ -616,8 +616,10 @@ static struct ipw_rx_packet *pool_allocate(struct ipw_hardware *hw, | ||
186 | packet = kmalloc(sizeof(struct ipw_rx_packet) + | ||
187 | old_packet->length + minimum_free_space, | ||
188 | GFP_ATOMIC); | ||
189 | - if (!packet) | ||
190 | + if (!packet) { | ||
191 | + kfree(old_packet); | ||
192 | return NULL; | ||
193 | + } | ||
194 | memcpy(packet, old_packet, | ||
195 | sizeof(struct ipw_rx_packet) | ||
196 | + old_packet->length); | ||
197 | diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c | ||
198 | index 5c3142b..81ecec0 100644 | ||
199 | --- a/drivers/char/rtc.c | ||
200 | +++ b/drivers/char/rtc.c | ||
201 | @@ -677,12 +677,13 @@ static int rtc_do_ioctl(unsigned int cmd, unsigned long arg, int kernel) | ||
202 | if (arg != (1<<tmp)) | ||
203 | return -EINVAL; | ||
204 | |||
205 | + rtc_freq = arg; | ||
206 | + | ||
207 | spin_lock_irqsave(&rtc_lock, flags); | ||
208 | if (hpet_set_periodic_freq(arg)) { | ||
209 | spin_unlock_irqrestore(&rtc_lock, flags); | ||
210 | return 0; | ||
211 | } | ||
212 | - rtc_freq = arg; | ||
213 | |||
214 | val = CMOS_READ(RTC_FREQ_SELECT) & 0xf0; | ||
215 | val |= (16 - tmp); | ||
216 | diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c | ||
217 | index 81503d9..6765649 100644 | ||
218 | --- a/drivers/char/tpm/tpm_tis.c | ||
219 | +++ b/drivers/char/tpm/tpm_tis.c | ||
220 | @@ -623,6 +623,7 @@ static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = { | ||
221 | {"IFX0102", 0}, /* Infineon */ | ||
222 | {"BCM0101", 0}, /* Broadcom */ | ||
223 | {"NSC1200", 0}, /* National */ | ||
224 | + {"ICO0102", 0}, /* Intel */ | ||
225 | /* Add new here */ | ||
226 | {"", 0}, /* User Specified */ | ||
227 | {"", 0} /* Terminator */ | ||
228 | diff --git a/drivers/hwmon/hdaps.c b/drivers/hwmon/hdaps.c | ||
229 | index bab5fd2..50f2269 100644 | ||
230 | --- a/drivers/hwmon/hdaps.c | ||
231 | +++ b/drivers/hwmon/hdaps.c | ||
232 | @@ -515,16 +515,24 @@ static struct dmi_system_id __initdata hdaps_whitelist[] = { | ||
233 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R50"), | ||
234 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R51"), | ||
235 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R52"), | ||
236 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad R61i"), | ||
237 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad R61"), | ||
238 | HDAPS_DMI_MATCH_INVERT("IBM", "ThinkPad T41p"), | ||
239 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T41"), | ||
240 | HDAPS_DMI_MATCH_INVERT("IBM", "ThinkPad T42p"), | ||
241 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T42"), | ||
242 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T43"), | ||
243 | HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T60"), | ||
244 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T61p"), | ||
245 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T61"), | ||
246 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad X40"), | ||
247 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad X41"), | ||
248 | HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad X60"), | ||
249 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad X61s"), | ||
250 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad X61"), | ||
251 | HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad Z60m"), | ||
252 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad Z61m"), | ||
253 | + HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad Z61p"), | ||
254 | { .ident = NULL } | ||
255 | }; | ||
256 | |||
257 | diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c | ||
258 | index d4ad699..37fcb38 100644 | ||
259 | --- a/drivers/isdn/i4l/isdn_common.c | ||
260 | +++ b/drivers/isdn/i4l/isdn_common.c | ||
261 | @@ -1977,8 +1977,10 @@ isdn_writebuf_stub(int drvidx, int chan, const u_char __user * buf, int len) | ||
262 | if (!skb) | ||
263 | return -ENOMEM; | ||
264 | skb_reserve(skb, hl); | ||
265 | - if (copy_from_user(skb_put(skb, len), buf, len)) | ||
266 | + if (copy_from_user(skb_put(skb, len), buf, len)) { | ||
267 | + dev_kfree_skb(skb); | ||
268 | return -EFAULT; | ||
269 | + } | ||
270 | ret = dev->drv[drvidx]->interface->writebuf_skb(drvidx, chan, 1, skb); | ||
271 | if (ret <= 0) | ||
272 | dev_kfree_skb(skb); | ||
273 | diff --git a/drivers/md/md.c b/drivers/md/md.c | ||
274 | index ba34990..94e5711 100644 | ||
275 | --- a/drivers/md/md.c | ||
276 | +++ b/drivers/md/md.c | ||
277 | @@ -3804,8 +3804,10 @@ static void autorun_devices(int part) | ||
278 | |||
279 | md_probe(dev, NULL, NULL); | ||
280 | mddev = mddev_find(dev); | ||
281 | - if (!mddev) { | ||
282 | - printk(KERN_ERR | ||
283 | + if (!mddev || !mddev->gendisk) { | ||
284 | + if (mddev) | ||
285 | + mddev_put(mddev); | ||
286 | + printk(KERN_ERR | ||
287 | "md: cannot allocate memory for md drive.\n"); | ||
288 | break; | ||
289 | } | ||
290 | diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c | ||
291 | index 32389d2..ad98858 100644 | ||
292 | --- a/drivers/md/raid10.c | ||
293 | +++ b/drivers/md/raid10.c | ||
294 | @@ -2102,6 +2102,8 @@ static int run(mddev_t *mddev) | ||
295 | !test_bit(In_sync, &disk->rdev->flags)) { | ||
296 | disk->head_position = 0; | ||
297 | mddev->degraded++; | ||
298 | + if (disk->rdev) | ||
299 | + conf->fullsync = 1; | ||
300 | } | ||
301 | } | ||
302 | |||
303 | diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c | ||
304 | index 705fe47..ffcaab6 100644 | ||
305 | --- a/drivers/md/raid5.c | ||
306 | +++ b/drivers/md/raid5.c | ||
307 | @@ -1999,12 +1999,7 @@ static int __handle_issuing_new_read_requests5(struct stripe_head *sh, | ||
308 | */ | ||
309 | s->uptodate++; | ||
310 | return 0; /* uptodate + compute == disks */ | ||
311 | - } else if ((s->uptodate < disks - 1) && | ||
312 | - test_bit(R5_Insync, &dev->flags)) { | ||
313 | - /* Note: we hold off compute operations while checks are | ||
314 | - * in flight, but we still prefer 'compute' over 'read' | ||
315 | - * hence we only read if (uptodate < * disks-1) | ||
316 | - */ | ||
317 | + } else if (test_bit(R5_Insync, &dev->flags)) { | ||
318 | set_bit(R5_LOCKED, &dev->flags); | ||
319 | set_bit(R5_Wantread, &dev->flags); | ||
320 | if (!test_and_set_bit(STRIPE_OP_IO, &sh->ops.pending)) | ||
321 | @@ -2861,6 +2856,8 @@ static void handle_stripe5(struct stripe_head *sh) | ||
322 | |||
323 | for (i = conf->raid_disks; i--; ) { | ||
324 | set_bit(R5_Wantwrite, &sh->dev[i].flags); | ||
325 | + set_bit(R5_LOCKED, &dev->flags); | ||
326 | + s.locked++; | ||
327 | if (!test_and_set_bit(STRIPE_OP_IO, &sh->ops.pending)) | ||
328 | sh->ops.count++; | ||
329 | } | ||
330 | @@ -2874,6 +2871,7 @@ static void handle_stripe5(struct stripe_head *sh) | ||
331 | conf->raid_disks); | ||
332 | s.locked += handle_write_operations5(sh, 1, 1); | ||
333 | } else if (s.expanded && | ||
334 | + s.locked == 0 && | ||
335 | !test_bit(STRIPE_OP_POSTXOR, &sh->ops.pending)) { | ||
336 | clear_bit(STRIPE_EXPAND_READY, &sh->state); | ||
337 | atomic_dec(&conf->reshape_stripes); | ||
338 | @@ -4163,7 +4161,9 @@ static int run(mddev_t *mddev) | ||
339 | " disk %d\n", bdevname(rdev->bdev,b), | ||
340 | raid_disk); | ||
341 | working_disks++; | ||
342 | - } | ||
343 | + } else | ||
344 | + /* Cannot rely on bitmap to complete recovery */ | ||
345 | + conf->fullsync = 1; | ||
346 | } | ||
347 | |||
348 | /* | ||
349 | diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c | ||
350 | index 9fd8399..80c19d8 100644 | ||
351 | --- a/drivers/media/dvb/dvb-usb/dib0700_devices.c | ||
352 | +++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c | ||
353 | @@ -1062,6 +1062,7 @@ struct usb_device_id dib0700_usb_id_table[] = { | ||
354 | /* 30 */{ USB_DEVICE(USB_VID_PINNACLE, USB_PID_PINNACLE_PCTV73E) }, | ||
355 | { USB_DEVICE(USB_VID_YUAN, USB_PID_YUAN_EC372S) }, | ||
356 | { USB_DEVICE(USB_VID_TERRATEC, USB_PID_TERRATEC_CINERGY_HT_EXPRESS) }, | ||
357 | + { USB_DEVICE(USB_VID_TERRATEC, USB_PID_TERRATEC_CINERGY_T_XXS) }, | ||
358 | { 0 } /* Terminating entry */ | ||
359 | }; | ||
360 | MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table); | ||
361 | @@ -1251,7 +1252,7 @@ struct dvb_usb_device_properties dib0700_devices[] = { | ||
362 | }, | ||
363 | }, | ||
364 | |||
365 | - .num_device_descs = 8, | ||
366 | + .num_device_descs = 9, | ||
367 | .devices = { | ||
368 | { "DiBcom STK7070P reference design", | ||
369 | { &dib0700_usb_id_table[15], NULL }, | ||
370 | @@ -1285,6 +1286,10 @@ struct dvb_usb_device_properties dib0700_devices[] = { | ||
371 | { &dib0700_usb_id_table[30], NULL }, | ||
372 | { NULL }, | ||
373 | }, | ||
374 | + { "Terratec Cinergy T USB XXS", | ||
375 | + { &dib0700_usb_id_table[33], NULL }, | ||
376 | + { NULL }, | ||
377 | + }, | ||
378 | }, | ||
379 | |||
380 | .rc_interval = DEFAULT_RC_INTERVAL, | ||
381 | diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h | ||
382 | index 49a44f2..847c008 100644 | ||
383 | --- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h | ||
384 | +++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h | ||
385 | @@ -137,6 +137,7 @@ | ||
386 | #define USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY 0x005a | ||
387 | #define USB_PID_TERRATEC_CINERGY_HT_USB_XE 0x0058 | ||
388 | #define USB_PID_TERRATEC_CINERGY_HT_EXPRESS 0x0060 | ||
389 | +#define USB_PID_TERRATEC_CINERGY_T_XXS 0x0078 | ||
390 | #define USB_PID_PINNACLE_EXPRESSCARD_320CX 0x022e | ||
391 | #define USB_PID_PINNACLE_PCTV2000E 0x022c | ||
392 | #define USB_PID_PINNACLE_PCTV_DVB_T_FLASH 0x0228 | ||
393 | @@ -191,6 +192,6 @@ | ||
394 | #define USB_PID_GIGABYTE_U7000 0x7001 | ||
395 | #define USB_PID_ASUS_U3000 0x171f | ||
396 | #define USB_PID_ASUS_U3100 0x173f | ||
397 | -#define USB_PID_YUAN_EC372S 0x1edc | ||
398 | +#define USB_PID_YUAN_EC372S 0x1edc | ||
399 | |||
400 | #endif | ||
401 | diff --git a/drivers/media/video/ov7670.c b/drivers/media/video/ov7670.c | ||
402 | index 2bc6bdc..d7bfd30 100644 | ||
403 | --- a/drivers/media/video/ov7670.c | ||
404 | +++ b/drivers/media/video/ov7670.c | ||
405 | @@ -406,8 +406,10 @@ static int ov7670_read(struct i2c_client *c, unsigned char reg, | ||
406 | int ret; | ||
407 | |||
408 | ret = i2c_smbus_read_byte_data(c, reg); | ||
409 | - if (ret >= 0) | ||
410 | + if (ret >= 0) { | ||
411 | *value = (unsigned char) ret; | ||
412 | + ret = 0; | ||
413 | + } | ||
414 | return ret; | ||
415 | } | ||
416 | |||
417 | diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c | ||
418 | index 25bcfcf..1effca4 100644 | ||
419 | --- a/drivers/message/fusion/mptspi.c | ||
420 | +++ b/drivers/message/fusion/mptspi.c | ||
421 | @@ -1266,13 +1266,18 @@ mptspi_dv_renegotiate(struct _MPT_SCSI_HOST *hd) | ||
422 | static int | ||
423 | mptspi_ioc_reset(MPT_ADAPTER *ioc, int reset_phase) | ||
424 | { | ||
425 | - struct _MPT_SCSI_HOST *hd = shost_priv(ioc->sh); | ||
426 | int rc; | ||
427 | |||
428 | rc = mptscsih_ioc_reset(ioc, reset_phase); | ||
429 | |||
430 | - if (reset_phase == MPT_IOC_POST_RESET) | ||
431 | + /* only try to do a renegotiation if we're properly set up | ||
432 | + * if we get an ioc fault on bringup, ioc->sh will be NULL */ | ||
433 | + if (reset_phase == MPT_IOC_POST_RESET && | ||
434 | + ioc->sh) { | ||
435 | + struct _MPT_SCSI_HOST *hd = shost_priv(ioc->sh); | ||
436 | + | ||
437 | mptspi_dv_renegotiate(hd); | ||
438 | + } | ||
439 | |||
440 | return rc; | ||
441 | } | ||
442 | diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c | ||
443 | index 65210fc..5c35e63 100644 | ||
444 | --- a/drivers/mmc/host/pxamci.c | ||
445 | +++ b/drivers/mmc/host/pxamci.c | ||
446 | @@ -114,6 +114,7 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data) | ||
447 | unsigned int nob = data->blocks; | ||
448 | unsigned long long clks; | ||
449 | unsigned int timeout; | ||
450 | + bool dalgn = 0; | ||
451 | u32 dcmd; | ||
452 | int i; | ||
453 | |||
454 | @@ -152,6 +153,9 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data) | ||
455 | host->sg_cpu[i].dcmd = dcmd | length; | ||
456 | if (length & 31 && !(data->flags & MMC_DATA_READ)) | ||
457 | host->sg_cpu[i].dcmd |= DCMD_ENDIRQEN; | ||
458 | + /* Not aligned to 8-byte boundary? */ | ||
459 | + if (sg_dma_address(&data->sg[i]) & 0x7) | ||
460 | + dalgn = 1; | ||
461 | if (data->flags & MMC_DATA_READ) { | ||
462 | host->sg_cpu[i].dsadr = host->res->start + MMC_RXFIFO; | ||
463 | host->sg_cpu[i].dtadr = sg_dma_address(&data->sg[i]); | ||
464 | @@ -165,6 +169,15 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data) | ||
465 | host->sg_cpu[host->dma_len - 1].ddadr = DDADR_STOP; | ||
466 | wmb(); | ||
467 | |||
468 | + /* | ||
469 | + * The PXA27x DMA controller encounters overhead when working with | ||
470 | + * unaligned (to 8-byte boundaries) data, so switch on byte alignment | ||
471 | + * mode only if we have unaligned data. | ||
472 | + */ | ||
473 | + if (dalgn) | ||
474 | + DALGN |= (1 << host->dma); | ||
475 | + else | ||
476 | + DALGN &= ~(1 << host->dma); | ||
477 | DDADR(host->dma) = host->sg_dma; | ||
478 | DCSR(host->dma) = DCSR_RUN; | ||
479 | } | ||
480 | diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c | ||
481 | index 4b673aa..e44e2bd 100644 | ||
482 | --- a/drivers/mmc/host/sdhci.c | ||
483 | +++ b/drivers/mmc/host/sdhci.c | ||
484 | @@ -109,7 +109,8 @@ static const struct pci_device_id pci_ids[] __devinitdata = { | ||
485 | .subvendor = PCI_ANY_ID, | ||
486 | .subdevice = PCI_ANY_ID, | ||
487 | .driver_data = SDHCI_QUIRK_SINGLE_POWER_WRITE | | ||
488 | - SDHCI_QUIRK_RESET_CMD_DATA_ON_IOS, | ||
489 | + SDHCI_QUIRK_RESET_CMD_DATA_ON_IOS | | ||
490 | + SDHCI_QUIRK_BROKEN_DMA, | ||
491 | }, | ||
492 | |||
493 | { | ||
494 | @@ -118,7 +119,8 @@ static const struct pci_device_id pci_ids[] __devinitdata = { | ||
495 | .subvendor = PCI_ANY_ID, | ||
496 | .subdevice = PCI_ANY_ID, | ||
497 | .driver_data = SDHCI_QUIRK_SINGLE_POWER_WRITE | | ||
498 | - SDHCI_QUIRK_RESET_CMD_DATA_ON_IOS, | ||
499 | + SDHCI_QUIRK_RESET_CMD_DATA_ON_IOS | | ||
500 | + SDHCI_QUIRK_BROKEN_DMA, | ||
501 | }, | ||
502 | |||
503 | { | ||
504 | diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c | ||
505 | index 6f8e7d4..09451ad 100644 | ||
506 | --- a/drivers/net/3c59x.c | ||
507 | +++ b/drivers/net/3c59x.c | ||
508 | @@ -1769,9 +1769,10 @@ vortex_timer(unsigned long data) | ||
509 | case XCVR_MII: case XCVR_NWAY: | ||
510 | { | ||
511 | ok = 1; | ||
512 | - spin_lock_bh(&vp->lock); | ||
513 | + /* Interrupts are already disabled */ | ||
514 | + spin_lock(&vp->lock); | ||
515 | vortex_check_media(dev, 0); | ||
516 | - spin_unlock_bh(&vp->lock); | ||
517 | + spin_unlock(&vp->lock); | ||
518 | } | ||
519 | break; | ||
520 | default: /* Other media types handled by Tx timeouts. */ | ||
521 | diff --git a/drivers/net/wireless/b43/leds.c b/drivers/net/wireless/b43/leds.c | ||
522 | index 0aac1ff..23d4c09 100644 | ||
523 | --- a/drivers/net/wireless/b43/leds.c | ||
524 | +++ b/drivers/net/wireless/b43/leds.c | ||
525 | @@ -72,6 +72,9 @@ static void b43_led_brightness_set(struct led_classdev *led_dev, | ||
526 | struct b43_wldev *dev = led->dev; | ||
527 | bool radio_enabled; | ||
528 | |||
529 | + if (unlikely(b43_status(dev) < B43_STAT_INITIALIZED)) | ||
530 | + return; | ||
531 | + | ||
532 | /* Checking the radio-enabled status here is slightly racy, | ||
533 | * but we want to avoid the locking overhead and we don't care | ||
534 | * whether the LED has the wrong state for a second. */ | ||
535 | diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c | ||
536 | index b4a2042..b2cc246 100644 | ||
537 | --- a/drivers/net/wireless/b43/main.c | ||
538 | +++ b/drivers/net/wireless/b43/main.c | ||
539 | @@ -2607,7 +2607,7 @@ static int b43_op_tx(struct ieee80211_hw *hw, | ||
540 | int err; | ||
541 | |||
542 | if (unlikely(!dev)) | ||
543 | - return NETDEV_TX_BUSY; | ||
544 | + goto drop_packet; | ||
545 | |||
546 | /* Transmissions on seperate queues can run concurrently. */ | ||
547 | read_lock_irqsave(&wl->tx_lock, flags); | ||
548 | @@ -2619,7 +2619,12 @@ static int b43_op_tx(struct ieee80211_hw *hw, | ||
549 | read_unlock_irqrestore(&wl->tx_lock, flags); | ||
550 | |||
551 | if (unlikely(err)) | ||
552 | - return NETDEV_TX_BUSY; | ||
553 | + goto drop_packet; | ||
554 | + return NETDEV_TX_OK; | ||
555 | + | ||
556 | +drop_packet: | ||
557 | + /* We can not transmit this packet. Drop it. */ | ||
558 | + dev_kfree_skb_any(skb); | ||
559 | return NETDEV_TX_OK; | ||
560 | } | ||
561 | |||
562 | diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c | ||
563 | index c990f87..93ddc1c 100644 | ||
564 | --- a/drivers/net/wireless/b43legacy/dma.c | ||
565 | +++ b/drivers/net/wireless/b43legacy/dma.c | ||
566 | @@ -876,6 +876,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, | ||
567 | if (!ring) | ||
568 | goto out; | ||
569 | ring->type = type; | ||
570 | + ring->dev = dev; | ||
571 | |||
572 | nr_slots = B43legacy_RXRING_SLOTS; | ||
573 | if (for_tx) | ||
574 | @@ -922,7 +923,6 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, | ||
575 | DMA_TO_DEVICE); | ||
576 | } | ||
577 | |||
578 | - ring->dev = dev; | ||
579 | ring->nr_slots = nr_slots; | ||
580 | ring->mmio_base = b43legacy_dmacontroller_base(type, controller_index); | ||
581 | ring->index = controller_index; | ||
582 | diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c | ||
583 | index 0f7a6e7..531aeb2 100644 | ||
584 | --- a/drivers/net/wireless/b43legacy/main.c | ||
585 | +++ b/drivers/net/wireless/b43legacy/main.c | ||
586 | @@ -2350,8 +2350,10 @@ static int b43legacy_op_tx(struct ieee80211_hw *hw, | ||
587 | } else | ||
588 | err = b43legacy_dma_tx(dev, skb, ctl); | ||
589 | out: | ||
590 | - if (unlikely(err)) | ||
591 | - return NETDEV_TX_BUSY; | ||
592 | + if (unlikely(err)) { | ||
593 | + /* Drop the packet. */ | ||
594 | + dev_kfree_skb_any(skb); | ||
595 | + } | ||
596 | return NETDEV_TX_OK; | ||
597 | } | ||
598 | |||
599 | diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c | ||
600 | index 7942b15..17efe4f 100644 | ||
601 | --- a/drivers/net/wireless/zd1211rw/zd_usb.c | ||
602 | +++ b/drivers/net/wireless/zd1211rw/zd_usb.c | ||
603 | @@ -64,6 +64,7 @@ static struct usb_device_id usb_ids[] = { | ||
604 | { USB_DEVICE(0x079b, 0x0062), .driver_info = DEVICE_ZD1211B }, | ||
605 | { USB_DEVICE(0x1582, 0x6003), .driver_info = DEVICE_ZD1211B }, | ||
606 | { USB_DEVICE(0x050d, 0x705c), .driver_info = DEVICE_ZD1211B }, | ||
607 | + { USB_DEVICE(0x083a, 0xe506), .driver_info = DEVICE_ZD1211B }, | ||
608 | { USB_DEVICE(0x083a, 0x4505), .driver_info = DEVICE_ZD1211B }, | ||
609 | { USB_DEVICE(0x0471, 0x1236), .driver_info = DEVICE_ZD1211B }, | ||
610 | { USB_DEVICE(0x13b1, 0x0024), .driver_info = DEVICE_ZD1211B }, | ||
611 | diff --git a/drivers/rapidio/rio-driver.c b/drivers/rapidio/rio-driver.c | ||
612 | index 3ce9f3d..956d3e7 100644 | ||
613 | --- a/drivers/rapidio/rio-driver.c | ||
614 | +++ b/drivers/rapidio/rio-driver.c | ||
615 | @@ -101,8 +101,8 @@ static int rio_device_probe(struct device *dev) | ||
616 | if (error >= 0) { | ||
617 | rdev->driver = rdrv; | ||
618 | error = 0; | ||
619 | + } else | ||
620 | rio_dev_put(rdev); | ||
621 | - } | ||
622 | } | ||
623 | return error; | ||
624 | } | ||
625 | diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c | ||
626 | index bfdee59..3d8d5d4 100644 | ||
627 | --- a/drivers/scsi/esp_scsi.c | ||
628 | +++ b/drivers/scsi/esp_scsi.c | ||
629 | @@ -2352,6 +2352,24 @@ void scsi_esp_unregister(struct esp *esp) | ||
630 | } | ||
631 | EXPORT_SYMBOL(scsi_esp_unregister); | ||
632 | |||
633 | +static int esp_target_alloc(struct scsi_target *starget) | ||
634 | +{ | ||
635 | + struct esp *esp = shost_priv(dev_to_shost(&starget->dev)); | ||
636 | + struct esp_target_data *tp = &esp->target[starget->id]; | ||
637 | + | ||
638 | + tp->starget = starget; | ||
639 | + | ||
640 | + return 0; | ||
641 | +} | ||
642 | + | ||
643 | +static void esp_target_destroy(struct scsi_target *starget) | ||
644 | +{ | ||
645 | + struct esp *esp = shost_priv(dev_to_shost(&starget->dev)); | ||
646 | + struct esp_target_data *tp = &esp->target[starget->id]; | ||
647 | + | ||
648 | + tp->starget = NULL; | ||
649 | +} | ||
650 | + | ||
651 | static int esp_slave_alloc(struct scsi_device *dev) | ||
652 | { | ||
653 | struct esp *esp = shost_priv(dev->host); | ||
654 | @@ -2363,8 +2381,6 @@ static int esp_slave_alloc(struct scsi_device *dev) | ||
655 | return -ENOMEM; | ||
656 | dev->hostdata = lp; | ||
657 | |||
658 | - tp->starget = dev->sdev_target; | ||
659 | - | ||
660 | spi_min_period(tp->starget) = esp->min_period; | ||
661 | spi_max_offset(tp->starget) = 15; | ||
662 | |||
663 | @@ -2595,6 +2611,8 @@ struct scsi_host_template scsi_esp_template = { | ||
664 | .name = "esp", | ||
665 | .info = esp_info, | ||
666 | .queuecommand = esp_queuecommand, | ||
667 | + .target_alloc = esp_target_alloc, | ||
668 | + .target_destroy = esp_target_destroy, | ||
669 | .slave_alloc = esp_slave_alloc, | ||
670 | .slave_configure = esp_slave_configure, | ||
671 | .slave_destroy = esp_slave_destroy, | ||
672 | diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c | ||
673 | index a6d9669..f1f2f65 100644 | ||
674 | --- a/drivers/scsi/ses.c | ||
675 | +++ b/drivers/scsi/ses.c | ||
676 | @@ -61,7 +61,7 @@ static int ses_probe(struct device *dev) | ||
677 | return err; | ||
678 | } | ||
679 | |||
680 | -#define SES_TIMEOUT 30 | ||
681 | +#define SES_TIMEOUT (30 * HZ) | ||
682 | #define SES_RETRIES 3 | ||
683 | |||
684 | static int ses_recv_diag(struct scsi_device *sdev, int page_code, | ||
685 | diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c | ||
686 | index d60705e..fe989c5 100644 | ||
687 | --- a/drivers/serial/8250.c | ||
688 | +++ b/drivers/serial/8250.c | ||
689 | @@ -2564,6 +2564,9 @@ static struct console serial8250_console = { | ||
690 | |||
691 | static int __init serial8250_console_init(void) | ||
692 | { | ||
693 | + if (nr_uarts > UART_NR) | ||
694 | + nr_uarts = UART_NR; | ||
695 | + | ||
696 | serial8250_isa_init_ports(); | ||
697 | register_console(&serial8250_console); | ||
698 | return 0; | ||
699 | diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c | ||
700 | index db9920e..3419a89 100644 | ||
701 | --- a/drivers/serial/serial_core.c | ||
702 | +++ b/drivers/serial/serial_core.c | ||
703 | @@ -1950,7 +1950,9 @@ struct uart_match { | ||
704 | static int serial_match_port(struct device *dev, void *data) | ||
705 | { | ||
706 | struct uart_match *match = data; | ||
707 | - dev_t devt = MKDEV(match->driver->major, match->driver->minor) + match->port->line; | ||
708 | + struct tty_driver *tty_drv = match->driver->tty_driver; | ||
709 | + dev_t devt = MKDEV(tty_drv->major, tty_drv->minor_start) + | ||
710 | + match->port->line; | ||
711 | |||
712 | return dev->devt == devt; /* Actually, only one tty per port */ | ||
713 | } | ||
714 | diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c | ||
715 | index e52ed16..27533b3 100644 | ||
716 | --- a/drivers/usb/core/hcd.c | ||
717 | +++ b/drivers/usb/core/hcd.c | ||
718 | @@ -1685,19 +1685,30 @@ EXPORT_SYMBOL_GPL(usb_bus_start_enum); | ||
719 | irqreturn_t usb_hcd_irq (int irq, void *__hcd) | ||
720 | { | ||
721 | struct usb_hcd *hcd = __hcd; | ||
722 | - int start = hcd->state; | ||
723 | + unsigned long flags; | ||
724 | + irqreturn_t rc; | ||
725 | |||
726 | - if (unlikely(start == HC_STATE_HALT || | ||
727 | - !test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))) | ||
728 | - return IRQ_NONE; | ||
729 | - if (hcd->driver->irq (hcd) == IRQ_NONE) | ||
730 | - return IRQ_NONE; | ||
731 | + /* IRQF_DISABLED doesn't work correctly with shared IRQs | ||
732 | + * when the first handler doesn't use it. So let's just | ||
733 | + * assume it's never used. | ||
734 | + */ | ||
735 | + local_irq_save(flags); | ||
736 | |||
737 | - set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags); | ||
738 | + if (unlikely(hcd->state == HC_STATE_HALT || | ||
739 | + !test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))) { | ||
740 | + rc = IRQ_NONE; | ||
741 | + } else if (hcd->driver->irq(hcd) == IRQ_NONE) { | ||
742 | + rc = IRQ_NONE; | ||
743 | + } else { | ||
744 | + set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags); | ||
745 | |||
746 | - if (unlikely(hcd->state == HC_STATE_HALT)) | ||
747 | - usb_hc_died (hcd); | ||
748 | - return IRQ_HANDLED; | ||
749 | + if (unlikely(hcd->state == HC_STATE_HALT)) | ||
750 | + usb_hc_died(hcd); | ||
751 | + rc = IRQ_HANDLED; | ||
752 | + } | ||
753 | + | ||
754 | + local_irq_restore(flags); | ||
755 | + return rc; | ||
756 | } | ||
757 | |||
758 | /*-------------------------------------------------------------------------*/ | ||
759 | @@ -1861,6 +1872,13 @@ int usb_add_hcd(struct usb_hcd *hcd, | ||
760 | |||
761 | /* enable irqs just before we start the controller */ | ||
762 | if (hcd->driver->irq) { | ||
763 | + | ||
764 | + /* IRQF_DISABLED doesn't work as advertised when used together | ||
765 | + * with IRQF_SHARED. As usb_hcd_irq() will always disable | ||
766 | + * interrupts we can remove it here. | ||
767 | + */ | ||
768 | + irqflags &= ~IRQF_DISABLED; | ||
769 | + | ||
770 | snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d", | ||
771 | hcd->driver->description, hcd->self.busnum); | ||
772 | if ((retval = request_irq(irqnum, &usb_hcd_irq, irqflags, | ||
773 | diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h | ||
774 | index bf92d20..888e81e 100644 | ||
775 | --- a/drivers/usb/host/ehci.h | ||
776 | +++ b/drivers/usb/host/ehci.h | ||
777 | @@ -176,6 +176,15 @@ timer_action_done (struct ehci_hcd *ehci, enum ehci_timer_action action) | ||
778 | static inline void | ||
779 | timer_action (struct ehci_hcd *ehci, enum ehci_timer_action action) | ||
780 | { | ||
781 | + /* Don't override timeouts which shrink or (later) disable | ||
782 | + * the async ring; just the I/O watchdog. Note that if a | ||
783 | + * SHRINK were pending, OFF would never be requested. | ||
784 | + */ | ||
785 | + if (timer_pending(&ehci->watchdog) | ||
786 | + && ((BIT(TIMER_ASYNC_SHRINK) | BIT(TIMER_ASYNC_OFF)) | ||
787 | + & ehci->actions)) | ||
788 | + return; | ||
789 | + | ||
790 | if (!test_and_set_bit (action, &ehci->actions)) { | ||
791 | unsigned long t; | ||
792 | |||
793 | @@ -191,15 +200,7 @@ timer_action (struct ehci_hcd *ehci, enum ehci_timer_action action) | ||
794 | t = EHCI_SHRINK_JIFFIES; | ||
795 | break; | ||
796 | } | ||
797 | - t += jiffies; | ||
798 | - // all timings except IAA watchdog can be overridden. | ||
799 | - // async queue SHRINK often precedes IAA. while it's ready | ||
800 | - // to go OFF neither can matter, and afterwards the IO | ||
801 | - // watchdog stops unless there's still periodic traffic. | ||
802 | - if (time_before_eq(t, ehci->watchdog.expires) | ||
803 | - && timer_pending (&ehci->watchdog)) | ||
804 | - return; | ||
805 | - mod_timer (&ehci->watchdog, t); | ||
806 | + mod_timer(&ehci->watchdog, t + jiffies); | ||
807 | } | ||
808 | } | ||
809 | |||
810 | diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c | ||
811 | index 33f1c1c..a8160d6 100644 | ||
812 | --- a/drivers/usb/host/ohci-hcd.c | ||
813 | +++ b/drivers/usb/host/ohci-hcd.c | ||
814 | @@ -1054,7 +1054,7 @@ MODULE_LICENSE ("GPL"); | ||
815 | |||
816 | #ifdef CONFIG_MFD_SM501 | ||
817 | #include "ohci-sm501.c" | ||
818 | -#define PLATFORM_DRIVER ohci_hcd_sm501_driver | ||
819 | +#define SM501_OHCI_DRIVER ohci_hcd_sm501_driver | ||
820 | #endif | ||
821 | |||
822 | #if !defined(PCI_DRIVER) && \ | ||
823 | @@ -1062,6 +1062,7 @@ MODULE_LICENSE ("GPL"); | ||
824 | !defined(OF_PLATFORM_DRIVER) && \ | ||
825 | !defined(SA1111_DRIVER) && \ | ||
826 | !defined(PS3_SYSTEM_BUS_DRIVER) && \ | ||
827 | + !defined(SM501_OHCI_DRIVER) && \ | ||
828 | !defined(SSB_OHCI_DRIVER) | ||
829 | #error "missing bus glue for ohci-hcd" | ||
830 | #endif | ||
831 | @@ -1121,9 +1122,18 @@ static int __init ohci_hcd_mod_init(void) | ||
832 | goto error_ssb; | ||
833 | #endif | ||
834 | |||
835 | +#ifdef SM501_OHCI_DRIVER | ||
836 | + retval = platform_driver_register(&SM501_OHCI_DRIVER); | ||
837 | + if (retval < 0) | ||
838 | + goto error_sm501; | ||
839 | +#endif | ||
840 | + | ||
841 | return retval; | ||
842 | |||
843 | /* Error path */ | ||
844 | +#ifdef SM501_OHCI_DRIVER | ||
845 | + error_sm501: | ||
846 | +#endif | ||
847 | #ifdef SSB_OHCI_DRIVER | ||
848 | error_ssb: | ||
849 | #endif | ||
850 | @@ -1159,6 +1169,9 @@ module_init(ohci_hcd_mod_init); | ||
851 | |||
852 | static void __exit ohci_hcd_mod_exit(void) | ||
853 | { | ||
854 | +#ifdef SM501_OHCI_DRIVER | ||
855 | + platform_driver_unregister(&SM501_OHCI_DRIVER); | ||
856 | +#endif | ||
857 | #ifdef SSB_OHCI_DRIVER | ||
858 | ssb_driver_unregister(&SSB_OHCI_DRIVER); | ||
859 | #endif | ||
860 | diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c | ||
861 | index 9c9f3b5..9b54740 100644 | ||
862 | --- a/drivers/usb/host/ohci-q.c | ||
863 | +++ b/drivers/usb/host/ohci-q.c | ||
864 | @@ -952,6 +952,7 @@ rescan_this: | ||
865 | struct urb *urb; | ||
866 | urb_priv_t *urb_priv; | ||
867 | __hc32 savebits; | ||
868 | + u32 tdINFO; | ||
869 | |||
870 | td = list_entry (entry, struct td, td_list); | ||
871 | urb = td->urb; | ||
872 | @@ -966,6 +967,17 @@ rescan_this: | ||
873 | savebits = *prev & ~cpu_to_hc32 (ohci, TD_MASK); | ||
874 | *prev = td->hwNextTD | savebits; | ||
875 | |||
876 | + /* If this was unlinked, the TD may not have been | ||
877 | + * retired ... so manually save the data toggle. | ||
878 | + * The controller ignores the value we save for | ||
879 | + * control and ISO endpoints. | ||
880 | + */ | ||
881 | + tdINFO = hc32_to_cpup(ohci, &td->hwINFO); | ||
882 | + if ((tdINFO & TD_T) == TD_T_DATA0) | ||
883 | + ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_C); | ||
884 | + else if ((tdINFO & TD_T) == TD_T_DATA1) | ||
885 | + ed->hwHeadP |= cpu_to_hc32(ohci, ED_C); | ||
886 | + | ||
887 | /* HC may have partly processed this TD */ | ||
888 | td_done (ohci, urb, td); | ||
889 | urb_priv->td_cnt++; | ||
890 | diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c | ||
891 | index cb7fa0e..33182f4 100644 | ||
892 | --- a/drivers/usb/misc/sisusbvga/sisusb.c | ||
893 | +++ b/drivers/usb/misc/sisusbvga/sisusb.c | ||
894 | @@ -3264,8 +3264,6 @@ static void sisusb_disconnect(struct usb_interface *intf) | ||
895 | |||
896 | /* decrement our usage count */ | ||
897 | kref_put(&sisusb->kref, sisusb_delete); | ||
898 | - | ||
899 | - dev_info(&sisusb->sisusb_dev->dev, "Disconnected\n"); | ||
900 | } | ||
901 | |||
902 | static struct usb_device_id sisusb_table [] = { | ||
903 | diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c | ||
904 | index 24843fd..59df132 100644 | ||
905 | --- a/drivers/video/fb_defio.c | ||
906 | +++ b/drivers/video/fb_defio.c | ||
907 | @@ -74,6 +74,7 @@ static int fb_deferred_io_mkwrite(struct vm_area_struct *vma, | ||
908 | { | ||
909 | struct fb_info *info = vma->vm_private_data; | ||
910 | struct fb_deferred_io *fbdefio = info->fbdefio; | ||
911 | + struct page *cur; | ||
912 | |||
913 | /* this is a callback we get when userspace first tries to | ||
914 | write to the page. we schedule a workqueue. that workqueue | ||
915 | @@ -83,7 +84,24 @@ static int fb_deferred_io_mkwrite(struct vm_area_struct *vma, | ||
916 | |||
917 | /* protect against the workqueue changing the page list */ | ||
918 | mutex_lock(&fbdefio->lock); | ||
919 | - list_add(&page->lru, &fbdefio->pagelist); | ||
920 | + | ||
921 | + /* we loop through the pagelist before adding in order | ||
922 | + to keep the pagelist sorted */ | ||
923 | + list_for_each_entry(cur, &fbdefio->pagelist, lru) { | ||
924 | + /* this check is to catch the case where a new | ||
925 | + process could start writing to the same page | ||
926 | + through a new pte. this new access can cause the | ||
927 | + mkwrite even when the original ps's pte is marked | ||
928 | + writable */ | ||
929 | + if (unlikely(cur == page)) | ||
930 | + goto page_already_added; | ||
931 | + else if (cur->index > page->index) | ||
932 | + break; | ||
933 | + } | ||
934 | + | ||
935 | + list_add_tail(&page->lru, &cur->lru); | ||
936 | + | ||
937 | +page_already_added: | ||
938 | mutex_unlock(&fbdefio->lock); | ||
939 | |||
940 | /* come back after delay to process the deferred IO */ | ||
941 | diff --git a/fs/buffer.c b/fs/buffer.c | ||
942 | index 39ff144..c55d485 100644 | ||
943 | --- a/fs/buffer.c | ||
944 | +++ b/fs/buffer.c | ||
945 | @@ -818,7 +818,7 @@ static int fsync_buffers_list(spinlock_t *lock, struct list_head *list) | ||
946 | * contents - it is a noop if I/O is still in | ||
947 | * flight on potentially older contents. | ||
948 | */ | ||
949 | - ll_rw_block(SWRITE, 1, &bh); | ||
950 | + ll_rw_block(SWRITE_SYNC, 1, &bh); | ||
951 | brelse(bh); | ||
952 | spin_lock(lock); | ||
953 | } | ||
954 | @@ -2952,16 +2952,19 @@ void ll_rw_block(int rw, int nr, struct buffer_head *bhs[]) | ||
955 | for (i = 0; i < nr; i++) { | ||
956 | struct buffer_head *bh = bhs[i]; | ||
957 | |||
958 | - if (rw == SWRITE) | ||
959 | + if (rw == SWRITE || rw == SWRITE_SYNC) | ||
960 | lock_buffer(bh); | ||
961 | else if (test_set_buffer_locked(bh)) | ||
962 | continue; | ||
963 | |||
964 | - if (rw == WRITE || rw == SWRITE) { | ||
965 | + if (rw == WRITE || rw == SWRITE || rw == SWRITE_SYNC) { | ||
966 | if (test_clear_buffer_dirty(bh)) { | ||
967 | bh->b_end_io = end_buffer_write_sync; | ||
968 | get_bh(bh); | ||
969 | - submit_bh(WRITE, bh); | ||
970 | + if (rw == SWRITE_SYNC) | ||
971 | + submit_bh(WRITE_SYNC, bh); | ||
972 | + else | ||
973 | + submit_bh(WRITE, bh); | ||
974 | continue; | ||
975 | } | ||
976 | } else { | ||
977 | @@ -2990,7 +2993,7 @@ int sync_dirty_buffer(struct buffer_head *bh) | ||
978 | if (test_clear_buffer_dirty(bh)) { | ||
979 | get_bh(bh); | ||
980 | bh->b_end_io = end_buffer_write_sync; | ||
981 | - ret = submit_bh(WRITE, bh); | ||
982 | + ret = submit_bh(WRITE_SYNC, bh); | ||
983 | wait_on_buffer(bh); | ||
984 | if (buffer_eopnotsupp(bh)) { | ||
985 | clear_buffer_eopnotsupp(bh); | ||
986 | diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c | ||
987 | index 1cb5b0a..f454f71 100644 | ||
988 | --- a/fs/cifs/cifsacl.c | ||
989 | +++ b/fs/cifs/cifsacl.c | ||
990 | @@ -34,11 +34,11 @@ | ||
991 | static struct cifs_wksid wksidarr[NUM_WK_SIDS] = { | ||
992 | {{1, 0, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }, "null user"}, | ||
993 | {{1, 1, {0, 0, 0, 0, 0, 1}, {0, 0, 0, 0, 0} }, "nobody"}, | ||
994 | - {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"}, | ||
995 | - {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(18), 0, 0, 0, 0} }, "sys"}, | ||
996 | - {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(544), 0, 0, 0} }, "root"}, | ||
997 | - {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(545), 0, 0, 0} }, "users"}, | ||
998 | - {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(546), 0, 0, 0} }, "guest"} } | ||
999 | + {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"}, | ||
1000 | + {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(18), 0, 0, 0, 0} }, "sys"}, | ||
1001 | + {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(544), 0, 0, 0} }, "root"}, | ||
1002 | + {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(545), 0, 0, 0} }, "users"}, | ||
1003 | + {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(546), 0, 0, 0} }, "guest"} } | ||
1004 | ; | ||
1005 | |||
1006 | |||
1007 | diff --git a/fs/exec.c b/fs/exec.c | ||
1008 | index 54a0a55..3080915 100644 | ||
1009 | --- a/fs/exec.c | ||
1010 | +++ b/fs/exec.c | ||
1011 | @@ -605,7 +605,7 @@ int setup_arg_pages(struct linux_binprm *bprm, | ||
1012 | bprm->exec -= stack_shift; | ||
1013 | |||
1014 | down_write(&mm->mmap_sem); | ||
1015 | - vm_flags = vma->vm_flags; | ||
1016 | + vm_flags = VM_STACK_FLAGS; | ||
1017 | |||
1018 | /* | ||
1019 | * Adjust stack execute permissions; explicitly enable for | ||
1020 | diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c | ||
1021 | index 5791793..1922696 100644 | ||
1022 | --- a/fs/reiserfs/inode.c | ||
1023 | +++ b/fs/reiserfs/inode.c | ||
1024 | @@ -45,6 +45,8 @@ void reiserfs_delete_inode(struct inode *inode) | ||
1025 | goto out; | ||
1026 | reiserfs_update_inode_transaction(inode); | ||
1027 | |||
1028 | + reiserfs_discard_prealloc(&th, inode); | ||
1029 | + | ||
1030 | err = reiserfs_delete_object(&th, inode); | ||
1031 | |||
1032 | /* Do quota update inside a transaction for journaled quotas. We must do that | ||
1033 | diff --git a/include/linux/fs.h b/include/linux/fs.h | ||
1034 | index b84b848..212ad96 100644 | ||
1035 | --- a/include/linux/fs.h | ||
1036 | +++ b/include/linux/fs.h | ||
1037 | @@ -83,6 +83,7 @@ extern int dir_notify_enable; | ||
1038 | #define READ_SYNC (READ | (1 << BIO_RW_SYNC)) | ||
1039 | #define READ_META (READ | (1 << BIO_RW_META)) | ||
1040 | #define WRITE_SYNC (WRITE | (1 << BIO_RW_SYNC)) | ||
1041 | +#define SWRITE_SYNC (SWRITE | (1 << BIO_RW_SYNC)) | ||
1042 | #define WRITE_BARRIER ((1 << BIO_RW) | (1 << BIO_RW_BARRIER)) | ||
1043 | |||
1044 | #define SEL_IN 1 | ||
1045 | diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c | ||
1046 | index c15a359..3d31d65 100644 | ||
1047 | --- a/kernel/hrtimer.c | ||
1048 | +++ b/kernel/hrtimer.c | ||
1049 | @@ -896,10 +896,18 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode) | ||
1050 | */ | ||
1051 | raise = timer->state == HRTIMER_STATE_PENDING; | ||
1052 | |||
1053 | + /* | ||
1054 | + * We use preempt_disable to prevent this task from migrating after | ||
1055 | + * setting up the softirq and raising it. Otherwise, if me migrate | ||
1056 | + * we will raise the softirq on the wrong CPU. | ||
1057 | + */ | ||
1058 | + preempt_disable(); | ||
1059 | + | ||
1060 | unlock_hrtimer_base(timer, &flags); | ||
1061 | |||
1062 | if (raise) | ||
1063 | hrtimer_raise_softirq(); | ||
1064 | + preempt_enable(); | ||
1065 | |||
1066 | return ret; | ||
1067 | } | ||
1068 | diff --git a/lib/ts_bm.c b/lib/ts_bm.c | ||
1069 | index d90822c..4a7fce7 100644 | ||
1070 | --- a/lib/ts_bm.c | ||
1071 | +++ b/lib/ts_bm.c | ||
1072 | @@ -63,7 +63,7 @@ static unsigned int bm_find(struct ts_config *conf, struct ts_state *state) | ||
1073 | struct ts_bm *bm = ts_config_priv(conf); | ||
1074 | unsigned int i, text_len, consumed = state->offset; | ||
1075 | const u8 *text; | ||
1076 | - int shift = bm->patlen, bs; | ||
1077 | + int shift = bm->patlen - 1, bs; | ||
1078 | |||
1079 | for (;;) { | ||
1080 | text_len = conf->get_next_block(consumed, &text, conf, state); | ||
1081 | diff --git a/mm/slub.c b/mm/slub.c | ||
1082 | index acc975f..8927f29 100644 | ||
1083 | --- a/mm/slub.c | ||
1084 | +++ b/mm/slub.c | ||
1085 | @@ -1575,9 +1575,11 @@ static __always_inline void *slab_alloc(struct kmem_cache *s, | ||
1086 | void **object; | ||
1087 | struct kmem_cache_cpu *c; | ||
1088 | unsigned long flags; | ||
1089 | + unsigned int objsize; | ||
1090 | |||
1091 | local_irq_save(flags); | ||
1092 | c = get_cpu_slab(s, smp_processor_id()); | ||
1093 | + objsize = c->objsize; | ||
1094 | if (unlikely(!c->freelist || !node_match(c, node))) | ||
1095 | |||
1096 | object = __slab_alloc(s, gfpflags, node, addr, c); | ||
1097 | @@ -1590,7 +1592,7 @@ static __always_inline void *slab_alloc(struct kmem_cache *s, | ||
1098 | local_irq_restore(flags); | ||
1099 | |||
1100 | if (unlikely((gfpflags & __GFP_ZERO) && object)) | ||
1101 | - memset(object, 0, c->objsize); | ||
1102 | + memset(object, 0, objsize); | ||
1103 | |||
1104 | return object; | ||
1105 | } | ||
1106 | diff --git a/net/can/af_can.c b/net/can/af_can.c | ||
1107 | index 6b956f5..57594b9 100644 | ||
1108 | --- a/net/can/af_can.c | ||
1109 | +++ b/net/can/af_can.c | ||
1110 | @@ -205,12 +205,19 @@ static int can_create(struct net *net, struct socket *sock, int protocol) | ||
1111 | * -ENOBUFS on full driver queue (see net_xmit_errno()) | ||
1112 | * -ENOMEM when local loopback failed at calling skb_clone() | ||
1113 | * -EPERM when trying to send on a non-CAN interface | ||
1114 | + * -EINVAL when the skb->data does not contain a valid CAN frame | ||
1115 | */ | ||
1116 | int can_send(struct sk_buff *skb, int loop) | ||
1117 | { | ||
1118 | struct sk_buff *newskb = NULL; | ||
1119 | + struct can_frame *cf = (struct can_frame *)skb->data; | ||
1120 | int err; | ||
1121 | |||
1122 | + if (skb->len != sizeof(struct can_frame) || cf->can_dlc > 8) { | ||
1123 | + kfree_skb(skb); | ||
1124 | + return -EINVAL; | ||
1125 | + } | ||
1126 | + | ||
1127 | if (skb->dev->type != ARPHRD_CAN) { | ||
1128 | kfree_skb(skb); | ||
1129 | return -EPERM; | ||
1130 | @@ -605,6 +612,7 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, | ||
1131 | struct packet_type *pt, struct net_device *orig_dev) | ||
1132 | { | ||
1133 | struct dev_rcv_lists *d; | ||
1134 | + struct can_frame *cf = (struct can_frame *)skb->data; | ||
1135 | int matches; | ||
1136 | |||
1137 | if (dev->type != ARPHRD_CAN || dev->nd_net != &init_net) { | ||
1138 | @@ -612,6 +620,8 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, | ||
1139 | return 0; | ||
1140 | } | ||
1141 | |||
1142 | + BUG_ON(skb->len != sizeof(struct can_frame) || cf->can_dlc > 8); | ||
1143 | + | ||
1144 | /* update statistics */ | ||
1145 | can_stats.rx_frames++; | ||
1146 | can_stats.rx_frames_delta++; | ||
1147 | diff --git a/net/can/bcm.c b/net/can/bcm.c | ||
1148 | index bd4282d..2709292 100644 | ||
1149 | --- a/net/can/bcm.c | ||
1150 | +++ b/net/can/bcm.c | ||
1151 | @@ -326,7 +326,7 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head, | ||
1152 | |||
1153 | if (head->nframes) { | ||
1154 | /* can_frames starting here */ | ||
1155 | - firstframe = (struct can_frame *) skb_tail_pointer(skb); | ||
1156 | + firstframe = (struct can_frame *)skb_tail_pointer(skb); | ||
1157 | |||
1158 | memcpy(skb_put(skb, datalen), frames, datalen); | ||
1159 | |||
1160 | @@ -818,6 +818,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, | ||
1161 | for (i = 0; i < msg_head->nframes; i++) { | ||
1162 | err = memcpy_fromiovec((u8 *)&op->frames[i], | ||
1163 | msg->msg_iov, CFSIZ); | ||
1164 | + | ||
1165 | + if (op->frames[i].can_dlc > 8) | ||
1166 | + err = -EINVAL; | ||
1167 | + | ||
1168 | if (err < 0) | ||
1169 | return err; | ||
1170 | |||
1171 | @@ -850,6 +854,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, | ||
1172 | for (i = 0; i < msg_head->nframes; i++) { | ||
1173 | err = memcpy_fromiovec((u8 *)&op->frames[i], | ||
1174 | msg->msg_iov, CFSIZ); | ||
1175 | + | ||
1176 | + if (op->frames[i].can_dlc > 8) | ||
1177 | + err = -EINVAL; | ||
1178 | + | ||
1179 | if (err < 0) { | ||
1180 | if (op->frames != &op->sframe) | ||
1181 | kfree(op->frames); | ||
1182 | @@ -1161,9 +1169,12 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk) | ||
1183 | |||
1184 | skb->dev = dev; | ||
1185 | skb->sk = sk; | ||
1186 | - can_send(skb, 1); /* send with loopback */ | ||
1187 | + err = can_send(skb, 1); /* send with loopback */ | ||
1188 | dev_put(dev); | ||
1189 | |||
1190 | + if (err) | ||
1191 | + return err; | ||
1192 | + | ||
1193 | return CFSIZ + MHSIZ; | ||
1194 | } | ||
1195 | |||
1196 | @@ -1182,6 +1193,10 @@ static int bcm_sendmsg(struct kiocb *iocb, struct socket *sock, | ||
1197 | if (!bo->bound) | ||
1198 | return -ENOTCONN; | ||
1199 | |||
1200 | + /* check for valid message length from userspace */ | ||
1201 | + if (size < MHSIZ || (size - MHSIZ) % CFSIZ) | ||
1202 | + return -EINVAL; | ||
1203 | + | ||
1204 | /* check for alternative ifindex for this bcm_op */ | ||
1205 | |||
1206 | if (!ifindex && msg->msg_name) { | ||
1207 | @@ -1256,8 +1271,8 @@ static int bcm_sendmsg(struct kiocb *iocb, struct socket *sock, | ||
1208 | break; | ||
1209 | |||
1210 | case TX_SEND: | ||
1211 | - /* we need at least one can_frame */ | ||
1212 | - if (msg_head.nframes < 1) | ||
1213 | + /* we need exactly one can_frame behind the msg head */ | ||
1214 | + if ((msg_head.nframes != 1) || (size != CFSIZ + MHSIZ)) | ||
1215 | ret = -EINVAL; | ||
1216 | else | ||
1217 | ret = bcm_tx_send(msg, ifindex, sk); | ||
1218 | diff --git a/net/can/raw.c b/net/can/raw.c | ||
1219 | index da26bbb..ba33944 100644 | ||
1220 | --- a/net/can/raw.c | ||
1221 | +++ b/net/can/raw.c | ||
1222 | @@ -632,6 +632,9 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock, | ||
1223 | } else | ||
1224 | ifindex = ro->ifindex; | ||
1225 | |||
1226 | + if (size != sizeof(struct can_frame)) | ||
1227 | + return -EINVAL; | ||
1228 | + | ||
1229 | dev = dev_get_by_index(&init_net, ifindex); | ||
1230 | if (!dev) | ||
1231 | return -ENXIO; | ||
1232 | diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c | ||
1233 | index 67b509e..9bdaed8 100644 | ||
1234 | --- a/net/mac80211/tx.c | ||
1235 | +++ b/net/mac80211/tx.c | ||
1236 | @@ -1090,7 +1090,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb, | ||
1237 | ieee80211_tx_handler *handler; | ||
1238 | struct ieee80211_txrx_data tx; | ||
1239 | ieee80211_txrx_result res = TXRX_DROP, res_prepare; | ||
1240 | - int ret, i; | ||
1241 | + int ret, i, retries = 0; | ||
1242 | |||
1243 | WARN_ON(__ieee80211_queue_pending(local, control->queue)); | ||
1244 | |||
1245 | @@ -1181,6 +1181,13 @@ retry: | ||
1246 | if (!__ieee80211_queue_stopped(local, control->queue)) { | ||
1247 | clear_bit(IEEE80211_LINK_STATE_PENDING, | ||
1248 | &local->state[control->queue]); | ||
1249 | + retries++; | ||
1250 | + /* | ||
1251 | + * Driver bug, it's rejecting packets but | ||
1252 | + * not stopping queues. | ||
1253 | + */ | ||
1254 | + if (WARN_ON_ONCE(retries > 5)) | ||
1255 | + goto drop; | ||
1256 | goto retry; | ||
1257 | } | ||
1258 | memcpy(&store->control, control, | ||
1259 | diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c | ||
1260 | index 6256795..fc43e22 100644 | ||
1261 | --- a/net/netfilter/nf_conntrack_proto_tcp.c | ||
1262 | +++ b/net/netfilter/nf_conntrack_proto_tcp.c | ||
1263 | @@ -332,12 +332,13 @@ static unsigned int get_conntrack_index(const struct tcphdr *tcph) | ||
1264 | |||
1265 | I. Upper bound for valid data: seq <= sender.td_maxend | ||
1266 | II. Lower bound for valid data: seq + len >= sender.td_end - receiver.td_maxwin | ||
1267 | - III. Upper bound for valid ack: sack <= receiver.td_end | ||
1268 | - IV. Lower bound for valid ack: ack >= receiver.td_end - MAXACKWINDOW | ||
1269 | + III. Upper bound for valid (s)ack: sack <= receiver.td_end | ||
1270 | + IV. Lower bound for valid (s)ack: sack >= receiver.td_end - MAXACKWINDOW | ||
1271 | |||
1272 | - where sack is the highest right edge of sack block found in the packet. | ||
1273 | + where sack is the highest right edge of sack block found in the packet | ||
1274 | + or ack in the case of packet without SACK option. | ||
1275 | |||
1276 | - The upper bound limit for a valid ack is not ignored - | ||
1277 | + The upper bound limit for a valid (s)ack is not ignored - | ||
1278 | we doesn't have to deal with fragments. | ||
1279 | */ | ||
1280 | |||
1281 | @@ -607,12 +608,12 @@ static int tcp_in_window(const struct nf_conn *ct, | ||
1282 | before(seq, sender->td_maxend + 1), | ||
1283 | after(end, sender->td_end - receiver->td_maxwin - 1), | ||
1284 | before(sack, receiver->td_end + 1), | ||
1285 | - after(ack, receiver->td_end - MAXACKWINDOW(sender))); | ||
1286 | + after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)); | ||
1287 | |||
1288 | if (before(seq, sender->td_maxend + 1) && | ||
1289 | after(end, sender->td_end - receiver->td_maxwin - 1) && | ||
1290 | before(sack, receiver->td_end + 1) && | ||
1291 | - after(ack, receiver->td_end - MAXACKWINDOW(sender))) { | ||
1292 | + after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) { | ||
1293 | /* | ||
1294 | * Take into account window scaling (RFC 1323). | ||
1295 | */ |