tags/2.6.12-14/1004_linux-2.6.12.4.patch

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -1149,7 +1149,7 @@ endif # KBUILD_EXTMOD
 #(which is the most common case IMHO) to avoid unneeded clutter in the big tags file.
 #Adding $(srctree) adds about 20M on i386 to the size of the output file!
 
-ifeq ($(KBUILD_OUTPUT),)
+ifeq ($(src),$(obj))
 __srctree =
 else
 __srctree = $(srctree)/
diff --git a/arch/i386/kernel/cpu/cpufreq/powernow-k8.c b/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
--- a/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
@@ -44,7 +44,7 @@
 
 #define PFX "powernow-k8: "
 #define BFX PFX "BIOS error: "
-#define VERSION "version 1.40.2"
+#define VERSION "version 1.40.4"
 #include "powernow-k8.h"
 
 /* serialize freq changes  */
@@ -978,7 +978,7 @@ static int __init powernowk8_cpu_init(st
 {
        struct powernow_k8_data *data;
        cpumask_t oldmask = CPU_MASK_ALL;
-       int rc;
+       int rc, i;
 
        if (!check_supported_cpu(pol->cpu))
                return -ENODEV;
@@ -1064,7 +1064,9 @@ static int __init powernowk8_cpu_init(st
        printk("cpu_init done, current fid 0x%x, vid 0x%x\n",
               data->currfid, data->currvid);
 
-       powernow_data[pol->cpu] = data;
+       for_each_cpu_mask(i, cpu_core_map[pol->cpu]) {
+               powernow_data[i] = data;
+       }
 
        return 0;
 
diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
--- a/arch/i386/kernel/process.c
+++ b/arch/i386/kernel/process.c
@@ -827,6 +827,8 @@ asmlinkage int sys_get_thread_area(struc
        if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
                return -EINVAL;
 
+       memset(&info, 0, sizeof(info));
+
        desc = current->thread.tls_array + idx - GDT_ENTRY_TLS_MIN;
 
        info.entry_number = idx;
diff --git a/arch/x86_64/ia32/syscall32.c b/arch/x86_64/ia32/syscall32.c
--- a/arch/x86_64/ia32/syscall32.c
+++ b/arch/x86_64/ia32/syscall32.c
@@ -57,6 +57,7 @@ int syscall32_setup_pages(struct linux_b
        int npages = (VSYSCALL32_END - VSYSCALL32_BASE) >> PAGE_SHIFT;
        struct vm_area_struct *vma;
        struct mm_struct *mm = current->mm;
+       int ret;
 
        vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
        if (!vma)
@@ -78,7 +79,11 @@ int syscall32_setup_pages(struct linux_b
        vma->vm_mm = mm;
 
        down_write(&mm->mmap_sem);
-       insert_vm_struct(mm, vma);
+       if ((ret = insert_vm_struct(mm, vma))) {
+               up_write(&mm->mmap_sem);
+               kmem_cache_free(vm_area_cachep, vma);
+               return ret;
+       }
        mm->total_vm += npages;
        up_write(&mm->mmap_sem);
        return 0;
diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
--- a/drivers/char/rocket.c
+++ b/drivers/char/rocket.c
@@ -277,7 +277,7 @@ static void rp_do_receive(struct r_port 
                ToRecv = space;
 
        if (ToRecv <= 0)
-               return;
+               goto done;
 
        /*
         * if status indicates there are errored characters in the
@@ -359,6 +359,7 @@ static void rp_do_receive(struct r_port 
        }
        /*  Push the data up to the tty layer */
        ld->receive_buf(tty, tty->flip.char_buf, tty->flip.flag_buf, count);
+done:
        tty_ldisc_deref(ld);
 }
 
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1914,9 +1914,11 @@ qla2x00_reg_remote_port(scsi_qla_host_t 
                rport_ids.roles |= FC_RPORT_ROLE_FCP_TARGET;
 
        fcport->rport = rport = fc_remote_port_add(ha->host, 0, &rport_ids);
-       if (!rport)
+       if (!rport) {
                qla_printk(KERN_WARNING, ha,
                    "Unable to allocate fc remote port!\n");
+               return;
+       }
 
        if (rport->scsi_target_id != -1 && rport->scsi_target_id < MAX_TARGETS)
                fcport->os_target_id = rport->scsi_target_id;
diff --git a/fs/bio.c b/fs/bio.c
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -261,6 +261,7 @@ inline void __bio_clone(struct bio *bio,
         */
        bio->bi_vcnt = bio_src->bi_vcnt;
        bio->bi_size = bio_src->bi_size;
+       bio->bi_idx = bio_src->bi_idx;
        bio_phys_segments(q, bio);
        bio_hw_segments(q, bio);
 }
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1192,7 +1192,7 @@ static inline void *skb_header_pointer(c
 {
        int hlen = skb_headlen(skb);
 
-       if (offset + len <= hlen)
+       if (hlen - offset >= len)
                return skb->data + offset;
 
        if (skb_copy_bits(skb, offset, buffer, len) < 0)
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -578,6 +578,14 @@ static int vlan_device_event(struct noti
                        if (!vlandev)
                                continue;
 
+                       if (netif_carrier_ok(dev)) {
+                               if (!netif_carrier_ok(vlandev))
+                                       netif_carrier_on(vlandev);
+                       } else {
+                               if (netif_carrier_ok(vlandev))
+                                       netif_carrier_off(vlandev);
+                       }
+
                        if ((vlandev->state & VLAN_LINK_STATE_MASK) != flgs) {
                                vlandev->state = (vlandev->state &~ VLAN_LINK_STATE_MASK) 
                                        | flgs;
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -1124,6 +1124,9 @@ void ip_conntrack_cleanup(void)
                schedule();
                goto i_see_dead_people;
        }
+       /* wait until all references to ip_conntrack_untracked are dropped */
+       while (atomic_read(&ip_conntrack_untracked.ct_general.use) > 1)
+               schedule();
 
        kmem_cache_destroy(ip_conntrack_cachep);
        kmem_cache_destroy(ip_conntrack_expect_cachep);
diff --git a/net/ipv4/netfilter/ip_nat_proto_tcp.c b/net/ipv4/netfilter/ip_nat_proto_tcp.c
--- a/net/ipv4/netfilter/ip_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_tcp.c
@@ -40,7 +40,8 @@ tcp_unique_tuple(struct ip_conntrack_tup
                 enum ip_nat_manip_type maniptype,
                 const struct ip_conntrack *conntrack)
 {
-       static u_int16_t port, *portptr;
+       static u_int16_t port;
+       u_int16_t *portptr;
        unsigned int range_size, min, i;
 
        if (maniptype == IP_NAT_MANIP_SRC)
diff --git a/net/ipv4/netfilter/ip_nat_proto_udp.c b/net/ipv4/netfilter/ip_nat_proto_udp.c
--- a/net/ipv4/netfilter/ip_nat_proto_udp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_udp.c
@@ -41,7 +41,8 @@ udp_unique_tuple(struct ip_conntrack_tup
                 enum ip_nat_manip_type maniptype,
                 const struct ip_conntrack *conntrack)
 {
-       static u_int16_t port, *portptr;
+       static u_int16_t port;
+       u_int16_t *portptr;
        unsigned int range_size, min, i;
 
        if (maniptype == IP_NAT_MANIP_SRC)
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -76,7 +76,9 @@ static DECLARE_MUTEX(ipqnl_sem);
 static void
 ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
 {
+       local_bh_disable();
        nf_reinject(entry->skb, entry->info, verdict);
+       local_bh_enable();
        kfree(entry);
 }
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1180,6 +1180,9 @@ static struct xfrm_policy *xfrm_compile_
        if (nr > XFRM_MAX_DEPTH)
                return NULL;
 
+       if (p->dir > XFRM_POLICY_OUT)
+               return NULL;
+
        xp = xfrm_policy_alloc(GFP_KERNEL);
        if (xp == NULL) {
                *dir = -ENOBUFS;
1	diff --git a/Makefile b/Makefile
2	--- a/Makefile
3	+++ b/Makefile
4	@@ -1149,7 +1149,7 @@ endif # KBUILD_EXTMOD
5	#(which is the most common case IMHO) to avoid unneeded clutter in the big tags file.
6	#Adding $(srctree) adds about 20M on i386 to the size of the output file!
7
8	-ifeq ($(KBUILD_OUTPUT),)
9	+ifeq ($(src),$(obj))
10	__srctree =
11	else
12	__srctree = $(srctree)/
13	diff --git a/arch/i386/kernel/cpu/cpufreq/powernow-k8.c b/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
14	--- a/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
15	+++ b/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
16	@@ -44,7 +44,7 @@
17
18	#define PFX "powernow-k8: "
19	#define BFX PFX "BIOS error: "
20	-#define VERSION "version 1.40.2"
21	+#define VERSION "version 1.40.4"
22	#include "powernow-k8.h"
23
24	/* serialize freq changes */
25	@@ -978,7 +978,7 @@ static int __init powernowk8_cpu_init(st
26	{
27	struct powernow_k8_data *data;
28	cpumask_t oldmask = CPU_MASK_ALL;
29	- int rc;
30	+ int rc, i;
31
32	if (!check_supported_cpu(pol->cpu))
33	return -ENODEV;
34	@@ -1064,7 +1064,9 @@ static int __init powernowk8_cpu_init(st
35	printk("cpu_init done, current fid 0x%x, vid 0x%x\n",
36	data->currfid, data->currvid);
37
38	- powernow_data[pol->cpu] = data;
39	+ for_each_cpu_mask(i, cpu_core_map[pol->cpu]) {
40	+ powernow_data[i] = data;
41	+ }
42
43	return 0;
44
45	diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
46	--- a/arch/i386/kernel/process.c
47	+++ b/arch/i386/kernel/process.c
48	@@ -827,6 +827,8 @@ asmlinkage int sys_get_thread_area(struc
49	if (idx < GDT_ENTRY_TLS_MIN \|\| idx > GDT_ENTRY_TLS_MAX)
50	return -EINVAL;
51
52	+ memset(&info, 0, sizeof(info));
53	+
54	desc = current->thread.tls_array + idx - GDT_ENTRY_TLS_MIN;
55
56	info.entry_number = idx;
57	diff --git a/arch/x86_64/ia32/syscall32.c b/arch/x86_64/ia32/syscall32.c
58	--- a/arch/x86_64/ia32/syscall32.c
59	+++ b/arch/x86_64/ia32/syscall32.c
60	@@ -57,6 +57,7 @@ int syscall32_setup_pages(struct linux_b
61	int npages = (VSYSCALL32_END - VSYSCALL32_BASE) >> PAGE_SHIFT;
62	struct vm_area_struct *vma;
63	struct mm_struct *mm = current->mm;
64	+ int ret;
65
66	vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
67	if (!vma)
68	@@ -78,7 +79,11 @@ int syscall32_setup_pages(struct linux_b
69	vma->vm_mm = mm;
70
71	down_write(&mm->mmap_sem);
72	- insert_vm_struct(mm, vma);
73	+ if ((ret = insert_vm_struct(mm, vma))) {
74	+ up_write(&mm->mmap_sem);
75	+ kmem_cache_free(vm_area_cachep, vma);
76	+ return ret;
77	+ }
78	mm->total_vm += npages;
79	up_write(&mm->mmap_sem);
80	return 0;
81	diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
82	--- a/drivers/char/rocket.c
83	+++ b/drivers/char/rocket.c
84	@@ -277,7 +277,7 @@ static void rp_do_receive(struct r_port
85	ToRecv = space;
86
87	if (ToRecv <= 0)
88	- return;
89	+ goto done;
90
91	/*
92	* if status indicates there are errored characters in the
93	@@ -359,6 +359,7 @@ static void rp_do_receive(struct r_port
94	}
95	/* Push the data up to the tty layer */
96	ld->receive_buf(tty, tty->flip.char_buf, tty->flip.flag_buf, count);
97	+done:
98	tty_ldisc_deref(ld);
99	}
100
101	diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
102	--- a/drivers/scsi/qla2xxx/qla_init.c
103	+++ b/drivers/scsi/qla2xxx/qla_init.c
104	@@ -1914,9 +1914,11 @@ qla2x00_reg_remote_port(scsi_qla_host_t
105	rport_ids.roles \|= FC_RPORT_ROLE_FCP_TARGET;
106
107	fcport->rport = rport = fc_remote_port_add(ha->host, 0, &rport_ids);
108	- if (!rport)
109	+ if (!rport) {
110	qla_printk(KERN_WARNING, ha,
111	"Unable to allocate fc remote port!\n");
112	+ return;
113	+ }
114
115	if (rport->scsi_target_id != -1 && rport->scsi_target_id < MAX_TARGETS)
116	fcport->os_target_id = rport->scsi_target_id;
117	diff --git a/fs/bio.c b/fs/bio.c
118	--- a/fs/bio.c
119	+++ b/fs/bio.c
120	@@ -261,6 +261,7 @@ inline void __bio_clone(struct bio *bio,
121	*/
122	bio->bi_vcnt = bio_src->bi_vcnt;
123	bio->bi_size = bio_src->bi_size;
124	+ bio->bi_idx = bio_src->bi_idx;
125	bio_phys_segments(q, bio);
126	bio_hw_segments(q, bio);
127	}
128	diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
129	--- a/include/linux/skbuff.h
130	+++ b/include/linux/skbuff.h
131	@@ -1192,7 +1192,7 @@ static inline void *skb_header_pointer(c
132	{
133	int hlen = skb_headlen(skb);
134
135	- if (offset + len <= hlen)
136	+ if (hlen - offset >= len)
137	return skb->data + offset;
138
139	if (skb_copy_bits(skb, offset, buffer, len) < 0)
140	diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
141	--- a/net/8021q/vlan.c
142	+++ b/net/8021q/vlan.c
143	@@ -578,6 +578,14 @@ static int vlan_device_event(struct noti
144	if (!vlandev)
145	continue;
146
147	+ if (netif_carrier_ok(dev)) {
148	+ if (!netif_carrier_ok(vlandev))
149	+ netif_carrier_on(vlandev);
150	+ } else {
151	+ if (netif_carrier_ok(vlandev))
152	+ netif_carrier_off(vlandev);
153	+ }
154	+
155	if ((vlandev->state & VLAN_LINK_STATE_MASK) != flgs) {
156	vlandev->state = (vlandev->state &~ VLAN_LINK_STATE_MASK)
157	\| flgs;
158	diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
159	--- a/net/ipv4/netfilter/ip_conntrack_core.c
160	+++ b/net/ipv4/netfilter/ip_conntrack_core.c
161	@@ -1124,6 +1124,9 @@ void ip_conntrack_cleanup(void)
162	schedule();
163	goto i_see_dead_people;
164	}
165	+ /* wait until all references to ip_conntrack_untracked are dropped */
166	+ while (atomic_read(&ip_conntrack_untracked.ct_general.use) > 1)
167	+ schedule();
168
169	kmem_cache_destroy(ip_conntrack_cachep);
170	kmem_cache_destroy(ip_conntrack_expect_cachep);
171	diff --git a/net/ipv4/netfilter/ip_nat_proto_tcp.c b/net/ipv4/netfilter/ip_nat_proto_tcp.c
172	--- a/net/ipv4/netfilter/ip_nat_proto_tcp.c
173	+++ b/net/ipv4/netfilter/ip_nat_proto_tcp.c
174	@@ -40,7 +40,8 @@ tcp_unique_tuple(struct ip_conntrack_tup
175	enum ip_nat_manip_type maniptype,
176	const struct ip_conntrack *conntrack)
177	{
178	- static u_int16_t port, *portptr;
179	+ static u_int16_t port;
180	+ u_int16_t *portptr;
181	unsigned int range_size, min, i;
182
183	if (maniptype == IP_NAT_MANIP_SRC)
184	diff --git a/net/ipv4/netfilter/ip_nat_proto_udp.c b/net/ipv4/netfilter/ip_nat_proto_udp.c
185	--- a/net/ipv4/netfilter/ip_nat_proto_udp.c
186	+++ b/net/ipv4/netfilter/ip_nat_proto_udp.c
187	@@ -41,7 +41,8 @@ udp_unique_tuple(struct ip_conntrack_tup
188	enum ip_nat_manip_type maniptype,
189	const struct ip_conntrack *conntrack)
190	{
191	- static u_int16_t port, *portptr;
192	+ static u_int16_t port;
193	+ u_int16_t *portptr;
194	unsigned int range_size, min, i;
195
196	if (maniptype == IP_NAT_MANIP_SRC)
197	diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
198	--- a/net/ipv6/netfilter/ip6_queue.c
199	+++ b/net/ipv6/netfilter/ip6_queue.c
200	@@ -76,7 +76,9 @@ static DECLARE_MUTEX(ipqnl_sem);
201	static void
202	ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
203	{
204	+ local_bh_disable();
205	nf_reinject(entry->skb, entry->info, verdict);
206	+ local_bh_enable();
207	kfree(entry);
208	}
209
210	diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
211	--- a/net/xfrm/xfrm_user.c
212	+++ b/net/xfrm/xfrm_user.c
213	@@ -1180,6 +1180,9 @@ static struct xfrm_policy *xfrm_compile_
214	if (nr > XFRM_MAX_DEPTH)
215	return NULL;
216
217	+ if (p->dir > XFRM_POLICY_OUT)
218	+ return NULL;
219	+
220	xp = xfrm_policy_alloc(GFP_KERNEL);
221	if (xp == NULL) {
222	*dir = -ENOBUFS;