/[linux-patches]/genpatches-2.6/tags/2.6.32-47/1043_linux-2.6.32.44.patch
Gentoo

Contents of /genpatches-2.6/tags/2.6.32-47/1043_linux-2.6.32.44.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 2037 - (show annotations) (download)
Wed Dec 28 14:38:55 2011 UTC (6 years, 6 months ago) by psomas
File size: 48837 byte(s)
2.6.32-47 release
1 diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
2 index 62619f2..a94e49c 100644
3 --- a/arch/alpha/kernel/osf_sys.c
4 +++ b/arch/alpha/kernel/osf_sys.c
5 @@ -431,7 +431,7 @@ SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen)
6 return -EFAULT;
7
8 len = namelen;
9 - if (namelen > 32)
10 + if (len > 32)
11 len = 32;
12
13 down_read(&uts_sem);
14 @@ -618,7 +618,7 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
15 down_read(&uts_sem);
16 res = sysinfo_table[offset];
17 len = strlen(res)+1;
18 - if (len > count)
19 + if ((unsigned long)len > (unsigned long)count)
20 len = count;
21 if (copy_to_user(buf, res, len))
22 err = -EFAULT;
23 @@ -673,7 +673,7 @@ SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,
24 return 1;
25
26 case GSI_GET_HWRPB:
27 - if (nbytes < sizeof(*hwrpb))
28 + if (nbytes > sizeof(*hwrpb))
29 return -EINVAL;
30 if (copy_to_user(buffer, hwrpb, nbytes) != 0)
31 return -EFAULT;
32 @@ -1035,6 +1035,7 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options,
33 {
34 struct rusage r;
35 long ret, err;
36 + unsigned int status = 0;
37 mm_segment_t old_fs;
38
39 if (!ur)
40 @@ -1043,13 +1044,15 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options,
41 old_fs = get_fs();
42
43 set_fs (KERNEL_DS);
44 - ret = sys_wait4(pid, ustatus, options, (struct rusage __user *) &r);
45 + ret = sys_wait4(pid, (unsigned int __user *) &status, options,
46 + (struct rusage __user *) &r);
47 set_fs (old_fs);
48
49 if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
50 return -EFAULT;
51
52 err = 0;
53 + err |= put_user(status, ustatus);
54 err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
55 err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
56 err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
57 diff --git a/arch/arm/mach-davinci/board-dm365-evm.c b/arch/arm/mach-davinci/board-dm365-evm.c
58 index 52dd804..8904495 100644
59 --- a/arch/arm/mach-davinci/board-dm365-evm.c
60 +++ b/arch/arm/mach-davinci/board-dm365-evm.c
61 @@ -413,7 +413,7 @@ fail:
62 */
63 if (have_imager()) {
64 label = "HD imager";
65 - mux |= 1;
66 + mux |= 2;
67
68 /* externally mux MMC1/ENET/AIC33 to imager */
69 mux |= BIT(6) | BIT(5) | BIT(3);
70 @@ -434,7 +434,7 @@ fail:
71 resets &= ~BIT(1);
72
73 if (have_tvp7002()) {
74 - mux |= 2;
75 + mux |= 1;
76 resets &= ~BIT(2);
77 label = "tvp7002 HD";
78 } else {
79 diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
80 index 102916f..b6bfe7e 100644
81 --- a/arch/arm/mach-pxa/cm-x300.c
82 +++ b/arch/arm/mach-pxa/cm-x300.c
83 @@ -143,10 +143,10 @@ static mfp_cfg_t cm_x300_mfp_cfg[] __initdata = {
84 GPIO99_GPIO, /* Ethernet IRQ */
85
86 /* RTC GPIOs */
87 - GPIO95_GPIO, /* RTC CS */
88 - GPIO96_GPIO, /* RTC WR */
89 - GPIO97_GPIO, /* RTC RD */
90 - GPIO98_GPIO, /* RTC IO */
91 + GPIO95_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC CS */
92 + GPIO96_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC WR */
93 + GPIO97_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC RD */
94 + GPIO98_GPIO, /* RTC IO */
95
96 /* Standard I2C */
97 GPIO21_I2C_SCL,
98 diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
99 index 5009198..d374974 100644
100 --- a/arch/powerpc/kernel/crash.c
101 +++ b/arch/powerpc/kernel/crash.c
102 @@ -176,12 +176,8 @@ static void crash_kexec_wait_realmode(int cpu)
103
104 while (paca[i].kexec_state < KEXEC_STATE_REAL_MODE) {
105 barrier();
106 - if (!cpu_possible(i)) {
107 + if (!cpu_possible(i) || !cpu_online(i) || (msecs <= 0))
108 break;
109 - }
110 - if (!cpu_online(i)) {
111 - break;
112 - }
113 msecs--;
114 mdelay(1);
115 }
116 diff --git a/arch/powerpc/platforms/pseries/hvconsole.c b/arch/powerpc/platforms/pseries/hvconsole.c
117 index 3f6a89b..041e87c 100644
118 --- a/arch/powerpc/platforms/pseries/hvconsole.c
119 +++ b/arch/powerpc/platforms/pseries/hvconsole.c
120 @@ -73,7 +73,7 @@ int hvc_put_chars(uint32_t vtermno, const char *buf, int count)
121 if (ret == H_SUCCESS)
122 return count;
123 if (ret == H_BUSY)
124 - return 0;
125 + return -EAGAIN;
126 return -EIO;
127 }
128
129 diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
130 index 69cab24..987ef29 100644
131 --- a/arch/x86/kernel/hpet.c
132 +++ b/arch/x86/kernel/hpet.c
133 @@ -27,6 +27,9 @@
134 #define HPET_DEV_FSB_CAP 0x1000
135 #define HPET_DEV_PERI_CAP 0x2000
136
137 +#define HPET_MIN_CYCLES 128
138 +#define HPET_MIN_PROG_DELTA (HPET_MIN_CYCLES + (HPET_MIN_CYCLES >> 1))
139 +
140 #define EVT_TO_HPET_DEV(evt) container_of(evt, struct hpet_dev, evt)
141
142 /*
143 @@ -298,8 +301,9 @@ static void hpet_legacy_clockevent_register(void)
144 /* Calculate the min / max delta */
145 hpet_clockevent.max_delta_ns = clockevent_delta2ns(0x7FFFFFFF,
146 &hpet_clockevent);
147 - /* 5 usec minimum reprogramming delta. */
148 - hpet_clockevent.min_delta_ns = 5000;
149 + /* Setup minimum reprogramming delta. */
150 + hpet_clockevent.min_delta_ns = clockevent_delta2ns(HPET_MIN_PROG_DELTA,
151 + &hpet_clockevent);
152
153 /*
154 * Start hpet with the boot cpu mask and make it
155 @@ -379,36 +383,37 @@ static int hpet_next_event(unsigned long delta,
156 struct clock_event_device *evt, int timer)
157 {
158 u32 cnt;
159 + s32 res;
160
161 cnt = hpet_readl(HPET_COUNTER);
162 cnt += (u32) delta;
163 hpet_writel(cnt, HPET_Tn_CMP(timer));
164
165 /*
166 - * We need to read back the CMP register on certain HPET
167 - * implementations (ATI chipsets) which seem to delay the
168 - * transfer of the compare register into the internal compare
169 - * logic. With small deltas this might actually be too late as
170 - * the counter could already be higher than the compare value
171 - * at that point and we would wait for the next hpet interrupt
172 - * forever. We found out that reading the CMP register back
173 - * forces the transfer so we can rely on the comparison with
174 - * the counter register below. If the read back from the
175 - * compare register does not match the value we programmed
176 - * then we might have a real hardware problem. We can not do
177 - * much about it here, but at least alert the user/admin with
178 - * a prominent warning.
179 - * An erratum on some chipsets (ICH9,..), results in comparator read
180 - * immediately following a write returning old value. Workaround
181 - * for this is to read this value second time, when first
182 - * read returns old value.
183 + * HPETs are a complete disaster. The compare register is
184 + * based on a equal comparison and neither provides a less
185 + * than or equal functionality (which would require to take
186 + * the wraparound into account) nor a simple count down event
187 + * mode. Further the write to the comparator register is
188 + * delayed internally up to two HPET clock cycles in certain
189 + * chipsets (ATI, ICH9,10). Some newer AMD chipsets have even
190 + * longer delays. We worked around that by reading back the
191 + * compare register, but that required another workaround for
192 + * ICH9,10 chips where the first readout after write can
193 + * return the old stale value. We already had a minimum
194 + * programming delta of 5us enforced, but a NMI or SMI hitting
195 + * between the counter readout and the comparator write can
196 + * move us behind that point easily. Now instead of reading
197 + * the compare register back several times, we make the ETIME
198 + * decision based on the following: Return ETIME if the
199 + * counter value after the write is less than HPET_MIN_CYCLES
200 + * away from the event or if the counter is already ahead of
201 + * the event. The minimum programming delta for the generic
202 + * clockevents code is set to 1.5 * HPET_MIN_CYCLES.
203 */
204 - if (unlikely((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt)) {
205 - WARN_ONCE((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt,
206 - KERN_WARNING "hpet: compare register read back failed.\n");
207 - }
208 + res = (s32)(cnt - (u32)hpet_readl(HPET_COUNTER));
209
210 - return (s32)((u32)hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0;
211 + return res < HPET_MIN_CYCLES ? -ETIME : 0;
212 }
213
214 static void hpet_legacy_set_mode(enum clock_event_mode mode,
215 diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
216 index 200fcde..cf98100 100644
217 --- a/arch/x86/kernel/reboot.c
218 +++ b/arch/x86/kernel/reboot.c
219 @@ -469,6 +469,14 @@ static struct dmi_system_id __initdata pci_reboot_dmi_table[] = {
220 DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"),
221 },
222 },
223 + { /* Handle problems with rebooting on the Latitude E5420. */
224 + .callback = set_pci_reboot,
225 + .ident = "Dell Latitude E5420",
226 + .matches = {
227 + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
228 + DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E5420"),
229 + },
230 + },
231 { }
232 };
233
234 diff --git a/arch/x86/kernel/relocate_kernel_32.S b/arch/x86/kernel/relocate_kernel_32.S
235 index 4123553..36818f8 100644
236 --- a/arch/x86/kernel/relocate_kernel_32.S
237 +++ b/arch/x86/kernel/relocate_kernel_32.S
238 @@ -97,6 +97,8 @@ relocate_kernel:
239 ret
240
241 identity_mapped:
242 + /* set return address to 0 if not preserving context */
243 + pushl $0
244 /* store the start address on the stack */
245 pushl %edx
246
247 diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
248 index 4de8f5b..7a6f3b3 100644
249 --- a/arch/x86/kernel/relocate_kernel_64.S
250 +++ b/arch/x86/kernel/relocate_kernel_64.S
251 @@ -100,6 +100,8 @@ relocate_kernel:
252 ret
253
254 identity_mapped:
255 + /* set return address to 0 if not preserving context */
256 + pushq $0
257 /* store the start address on the stack */
258 pushq %rdx
259
260 diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
261 index 9486882..885ebe7 100644
262 --- a/arch/xtensa/kernel/ptrace.c
263 +++ b/arch/xtensa/kernel/ptrace.c
264 @@ -136,6 +136,9 @@ int ptrace_setxregs(struct task_struct *child, void __user *uregs)
265 elf_xtregs_t *xtregs = uregs;
266 int ret = 0;
267
268 + if (!access_ok(VERIFY_READ, uregs, sizeof(elf_xtregs_t)))
269 + return -EFAULT;
270 +
271 #if XTENSA_HAVE_COPROCESSORS
272 /* Flush all coprocessors before we overwrite them. */
273 coprocessor_flush_all(ti);
274 diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
275 index fa9bed0..e5bdb9b 100644
276 --- a/drivers/ata/libata-eh.c
277 +++ b/drivers/ata/libata-eh.c
278 @@ -2707,10 +2707,11 @@ int ata_eh_reset(struct ata_link *link, int classify,
279 }
280
281 /*
282 - * Some controllers can't be frozen very well and may set
283 - * spuruious error conditions during reset. Clear accumulated
284 - * error information. As reset is the final recovery action,
285 - * nothing is lost by doing this.
286 + * Some controllers can't be frozen very well and may set spurious
287 + * error conditions during reset. Clear accumulated error
288 + * information and re-thaw the port if frozen. As reset is the
289 + * final recovery action and we cross check link onlineness against
290 + * device classification later, no hotplug event is lost by this.
291 */
292 spin_lock_irqsave(link->ap->lock, flags);
293 memset(&link->eh_info, 0, sizeof(link->eh_info));
294 @@ -2719,6 +2720,9 @@ int ata_eh_reset(struct ata_link *link, int classify,
295 ap->pflags &= ~ATA_PFLAG_EH_PENDING;
296 spin_unlock_irqrestore(link->ap->lock, flags);
297
298 + if (ap->pflags & ATA_PFLAG_FROZEN)
299 + ata_eh_thaw_port(ap);
300 +
301 /*
302 * Make sure onlineness and classification result correspond.
303 * Hotplug could have happened during reset and some
304 diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
305 index 5ae1b1c..04d6bf8 100644
306 --- a/drivers/block/cciss.h
307 +++ b/drivers/block/cciss.h
308 @@ -165,7 +165,7 @@ static void SA5_submit_command( ctlr_info_t *h, CommandList_struct *c)
309 printk("Sending %x - down to controller\n", c->busaddr );
310 #endif /* CCISS_DEBUG */
311 writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
312 - readl(h->vaddr + SA5_REQUEST_PORT_OFFSET);
313 + readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
314 h->commands_outstanding++;
315 if ( h->commands_outstanding > h->max_outstanding)
316 h->max_outstanding = h->commands_outstanding;
317 diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c
318 index 9ac4972..5b6001b 100644
319 --- a/drivers/hwmon/max1111.c
320 +++ b/drivers/hwmon/max1111.c
321 @@ -39,6 +39,8 @@ struct max1111_data {
322 struct spi_transfer xfer[2];
323 uint8_t *tx_buf;
324 uint8_t *rx_buf;
325 + struct mutex drvdata_lock;
326 + /* protect msg, xfer and buffers from multiple access */
327 };
328
329 static int max1111_read(struct device *dev, int channel)
330 @@ -47,6 +49,9 @@ static int max1111_read(struct device *dev, int channel)
331 uint8_t v1, v2;
332 int err;
333
334 + /* writing to drvdata struct is not thread safe, wait on mutex */
335 + mutex_lock(&data->drvdata_lock);
336 +
337 data->tx_buf[0] = (channel << MAX1111_CTRL_SEL_SH) |
338 MAX1111_CTRL_PD0 | MAX1111_CTRL_PD1 |
339 MAX1111_CTRL_SGL | MAX1111_CTRL_UNI | MAX1111_CTRL_STR;
340 @@ -54,12 +59,15 @@ static int max1111_read(struct device *dev, int channel)
341 err = spi_sync(data->spi, &data->msg);
342 if (err < 0) {
343 dev_err(dev, "spi_sync failed with %d\n", err);
344 + mutex_unlock(&data->drvdata_lock);
345 return err;
346 }
347
348 v1 = data->rx_buf[0];
349 v2 = data->rx_buf[1];
350
351 + mutex_unlock(&data->drvdata_lock);
352 +
353 if ((v1 & 0xc0) || (v2 & 0x3f))
354 return -EINVAL;
355
356 @@ -175,6 +183,8 @@ static int __devinit max1111_probe(struct spi_device *spi)
357 if (err)
358 goto err_free_data;
359
360 + mutex_init(&data->drvdata_lock);
361 +
362 data->spi = spi;
363 spi_set_drvdata(spi, data);
364
365 @@ -212,6 +222,7 @@ static int __devexit max1111_remove(struct spi_device *spi)
366
367 hwmon_device_unregister(data->hwmon_dev);
368 sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group);
369 + mutex_destroy(&data->drvdata_lock);
370 kfree(data->rx_buf);
371 kfree(data->tx_buf);
372 kfree(data);
373 diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
374 index fcf717c..b03cd39 100644
375 --- a/drivers/md/dm-mpath.c
376 +++ b/drivers/md/dm-mpath.c
377 @@ -778,6 +778,11 @@ static int parse_features(struct arg_set *as, struct multipath *m)
378 if (!argc)
379 return 0;
380
381 + if (argc > as->argc) {
382 + ti->error = "not enough arguments for features";
383 + return -EINVAL;
384 + }
385 +
386 do {
387 param_name = shift(as);
388 argc--;
389 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
390 index d186687..c988ac2 100644
391 --- a/drivers/md/dm.c
392 +++ b/drivers/md/dm.c
393 @@ -36,6 +36,8 @@ static const char *_name = DM_NAME;
394 static unsigned int major = 0;
395 static unsigned int _major = 0;
396
397 +static DEFINE_IDR(_minor_idr);
398 +
399 static DEFINE_SPINLOCK(_minor_lock);
400 /*
401 * For bio-based dm.
402 @@ -315,6 +317,12 @@ static void __exit dm_exit(void)
403
404 while (i--)
405 _exits[i]();
406 +
407 + /*
408 + * Should be empty by this point.
409 + */
410 + idr_remove_all(&_minor_idr);
411 + idr_destroy(&_minor_idr);
412 }
413
414 /*
415 @@ -1663,8 +1671,6 @@ static int dm_any_congested(void *congested_data, int bdi_bits)
416 /*-----------------------------------------------------------------
417 * An IDR is used to keep track of allocated minor numbers.
418 *---------------------------------------------------------------*/
419 -static DEFINE_IDR(_minor_idr);
420 -
421 static void free_minor(int minor)
422 {
423 spin_lock(&_minor_lock);
424 diff --git a/drivers/media/radio/si4713-i2c.c b/drivers/media/radio/si4713-i2c.c
425 index 6a0028e..93653c6 100644
426 --- a/drivers/media/radio/si4713-i2c.c
427 +++ b/drivers/media/radio/si4713-i2c.c
428 @@ -1003,7 +1003,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
429 char ps_name[MAX_RDS_PS_NAME + 1];
430
431 len = control->size - 1;
432 - if (len > MAX_RDS_PS_NAME) {
433 + if (len < 0 || len > MAX_RDS_PS_NAME) {
434 rval = -ERANGE;
435 goto exit;
436 }
437 @@ -1025,7 +1025,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
438 char radio_text[MAX_RDS_RADIO_TEXT + 1];
439
440 len = control->size - 1;
441 - if (len > MAX_RDS_RADIO_TEXT) {
442 + if (len < 0 || len > MAX_RDS_RADIO_TEXT) {
443 rval = -ERANGE;
444 goto exit;
445 }
446 diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
447 index d258ed7..f0e9c75 100644
448 --- a/drivers/media/video/bt8xx/bttv-driver.c
449 +++ b/drivers/media/video/bt8xx/bttv-driver.c
450 @@ -3532,7 +3532,7 @@ static int radio_s_tuner(struct file *file, void *priv,
451 if (0 != t->index)
452 return -EINVAL;
453
454 - bttv_call_all(btv, tuner, g_tuner, t);
455 + bttv_call_all(btv, tuner, s_tuner, t);
456 return 0;
457 }
458
459 diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.c b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
460 index 13639b3..5891e30 100644
461 --- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
462 +++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
463 @@ -2979,6 +2979,8 @@ static void pvr2_subdev_update(struct pvr2_hdw *hdw)
464 if (hdw->input_dirty || hdw->audiomode_dirty || hdw->force_dirty) {
465 struct v4l2_tuner vt;
466 memset(&vt, 0, sizeof(vt));
467 + vt.type = (hdw->input_val == PVR2_CVAL_INPUT_RADIO) ?
468 + V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
469 vt.audmode = hdw->audiomode_val;
470 v4l2_device_call_all(&hdw->v4l2_dev, 0, tuner, s_tuner, &vt);
471 }
472 @@ -5064,6 +5066,8 @@ void pvr2_hdw_status_poll(struct pvr2_hdw *hdw)
473 {
474 struct v4l2_tuner *vtp = &hdw->tuner_signal_info;
475 memset(vtp, 0, sizeof(*vtp));
476 + vtp->type = (hdw->input_val == PVR2_CVAL_INPUT_RADIO) ?
477 + V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
478 hdw->tuner_signal_stale = 0;
479 /* Note: There apparently is no replacement for VIDIOC_CROPCAP
480 using v4l2-subdev - therefore we can't support that AT ALL right
481 diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
482 index 30cc334..265bfb5 100644
483 --- a/drivers/media/video/v4l2-ioctl.c
484 +++ b/drivers/media/video/v4l2-ioctl.c
485 @@ -1600,6 +1600,8 @@ static long __video_do_ioctl(struct file *file,
486 if (!ops->vidioc_g_tuner)
487 break;
488
489 + p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
490 + V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
491 ret = ops->vidioc_g_tuner(file, fh, p);
492 if (!ret)
493 dbgarg(cmd, "index=%d, name=%s, type=%d, "
494 @@ -1618,6 +1620,8 @@ static long __video_do_ioctl(struct file *file,
495
496 if (!ops->vidioc_s_tuner)
497 break;
498 + p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
499 + V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
500 dbgarg(cmd, "index=%d, name=%s, type=%d, "
501 "capability=0x%x, rangelow=%d, "
502 "rangehigh=%d, signal=%d, afc=%d, "
503 @@ -1636,6 +1640,8 @@ static long __video_do_ioctl(struct file *file,
504 if (!ops->vidioc_g_frequency)
505 break;
506
507 + p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
508 + V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
509 ret = ops->vidioc_g_frequency(file, fh, p);
510 if (!ret)
511 dbgarg(cmd, "tuner=%d, type=%d, frequency=%d\n",
512 diff --git a/drivers/net/jme.c b/drivers/net/jme.c
513 index a893f45..0fbca76 100644
514 --- a/drivers/net/jme.c
515 +++ b/drivers/net/jme.c
516 @@ -681,20 +681,28 @@ jme_make_new_rx_buf(struct jme_adapter *jme, int i)
517 struct jme_ring *rxring = &(jme->rxring[0]);
518 struct jme_buffer_info *rxbi = rxring->bufinf + i;
519 struct sk_buff *skb;
520 + dma_addr_t mapping;
521
522 skb = netdev_alloc_skb(jme->dev,
523 jme->dev->mtu + RX_EXTRA_LEN);
524 if (unlikely(!skb))
525 return -ENOMEM;
526
527 + mapping = pci_map_page(jme->pdev, virt_to_page(skb->data),
528 + offset_in_page(skb->data), skb_tailroom(skb),
529 + PCI_DMA_FROMDEVICE);
530 + if (unlikely(pci_dma_mapping_error(jme->pdev, mapping))) {
531 + dev_kfree_skb(skb);
532 + return -ENOMEM;
533 + }
534 +
535 + if (likely(rxbi->mapping))
536 + pci_unmap_page(jme->pdev, rxbi->mapping,
537 + rxbi->len, PCI_DMA_FROMDEVICE);
538 +
539 rxbi->skb = skb;
540 rxbi->len = skb_tailroom(skb);
541 - rxbi->mapping = pci_map_page(jme->pdev,
542 - virt_to_page(skb->data),
543 - offset_in_page(skb->data),
544 - rxbi->len,
545 - PCI_DMA_FROMDEVICE);
546 -
547 + rxbi->mapping = mapping;
548 return 0;
549 }
550
551 diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
552 index 0d3326d..6f8352c 100644
553 --- a/drivers/pci/pci.c
554 +++ b/drivers/pci/pci.c
555 @@ -1507,7 +1507,7 @@ void pci_enable_ari(struct pci_dev *dev)
556 {
557 int pos;
558 u32 cap;
559 - u16 ctrl;
560 + u16 flags, ctrl;
561 struct pci_dev *bridge;
562
563 if (!dev->is_pcie || dev->devfn)
564 @@ -1525,6 +1525,11 @@ void pci_enable_ari(struct pci_dev *dev)
565 if (!pos)
566 return;
567
568 + /* ARI is a PCIe v2 feature */
569 + pci_read_config_word(bridge, pos + PCI_EXP_FLAGS, &flags);
570 + if ((flags & PCI_EXP_FLAGS_VERS) < 2)
571 + return;
572 +
573 pci_read_config_dword(bridge, pos + PCI_EXP_DEVCAP2, &cap);
574 if (!(cap & PCI_EXP_DEVCAP2_ARI))
575 return;
576 diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
577 index 33cf988..4f43306 100644
578 --- a/drivers/scsi/libsas/sas_expander.c
579 +++ b/drivers/scsi/libsas/sas_expander.c
580 @@ -840,6 +840,9 @@ static struct domain_device *sas_ex_discover_expander(
581
582 res = sas_discover_expander(child);
583 if (res) {
584 + spin_lock_irq(&parent->port->dev_list_lock);
585 + list_del(&child->dev_list_node);
586 + spin_unlock_irq(&parent->port->dev_list_lock);
587 kfree(child);
588 return NULL;
589 }
590 diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
591 index 483370f..9ab8c86 100644
592 --- a/drivers/scsi/pmcraid.c
593 +++ b/drivers/scsi/pmcraid.c
594 @@ -3557,6 +3557,9 @@ static long pmcraid_ioctl_passthrough(
595 pmcraid_err("couldn't build passthrough ioadls\n");
596 goto out_free_buffer;
597 }
598 + } else if (request_size < 0) {
599 + rc = -EINVAL;
600 + goto out_free_buffer;
601 }
602
603 /* If data is being written into the device, copy the data from user
604 diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
605 index 802e91c..ae0ae2d 100644
606 --- a/drivers/scsi/scsi_devinfo.c
607 +++ b/drivers/scsi/scsi_devinfo.c
608 @@ -196,6 +196,7 @@ static struct {
609 {"IBM", "ProFibre 4000R", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
610 {"IBM", "2105", NULL, BLIST_RETRY_HWERROR},
611 {"iomega", "jaz 1GB", "J.86", BLIST_NOTQ | BLIST_NOLUN},
612 + {"IOMEGA", "ZIP", NULL, BLIST_NOTQ | BLIST_NOLUN},
613 {"IOMEGA", "Io20S *F", NULL, BLIST_KEY},
614 {"INSITE", "Floptical F*8I", NULL, BLIST_KEY},
615 {"INSITE", "I325VM", NULL, BLIST_KEY},
616 @@ -242,6 +243,7 @@ static struct {
617 {"Tornado-", "F4", "*", BLIST_NOREPORTLUN},
618 {"TOSHIBA", "CDROM", NULL, BLIST_ISROM},
619 {"TOSHIBA", "CD-ROM", NULL, BLIST_ISROM},
620 + {"Traxdata", "CDR4120", NULL, BLIST_NOLUN}, /* locks up */
621 {"USB2.0", "SMARTMEDIA/XD", NULL, BLIST_FORCELUN | BLIST_INQUIRY_36},
622 {"WangDAT", "Model 2600", "01.7", BLIST_SELECT_NO_ATN},
623 {"WangDAT", "Model 3200", "02.2", BLIST_SELECT_NO_ATN},
624 diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
625 index 3b082dd..340124d 100644
626 --- a/drivers/scsi/ses.c
627 +++ b/drivers/scsi/ses.c
628 @@ -157,6 +157,10 @@ static unsigned char *ses_get_page2_descriptor(struct enclosure_device *edev,
629 return NULL;
630 }
631
632 +/* For device slot and array device slot elements, byte 3 bit 6
633 + * is "fault sensed" while byte 3 bit 5 is "fault reqstd". As this
634 + * code stands these bits are shifted 4 positions right so in
635 + * sysfs they will appear as bits 2 and 1 respectively. Strange. */
636 static void ses_get_fault(struct enclosure_device *edev,
637 struct enclosure_component *ecomp)
638 {
639 @@ -178,7 +182,7 @@ static int ses_set_fault(struct enclosure_device *edev,
640 /* zero is disabled */
641 break;
642 case ENCLOSURE_SETTING_ENABLED:
643 - desc[2] = 0x02;
644 + desc[3] = 0x20;
645 break;
646 default:
647 /* SES doesn't do the SGPIO blink settings */
648 diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
649 index aaad76e..80a1071 100644
650 --- a/drivers/staging/comedi/comedi_fops.c
651 +++ b/drivers/staging/comedi/comedi_fops.c
652 @@ -367,8 +367,8 @@ static int do_devinfo_ioctl(struct comedi_device *dev,
653 /* fill devinfo structure */
654 devinfo.version_code = COMEDI_VERSION_CODE;
655 devinfo.n_subdevs = dev->n_subdevices;
656 - memcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
657 - memcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
658 + strlcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
659 + strlcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
660
661 if (read_subdev)
662 devinfo.read_subdevice = read_subdev - dev->subdevices;
663 diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
664 index 5e09664..7adb671 100644
665 --- a/drivers/usb/gadget/dummy_hcd.c
666 +++ b/drivers/usb/gadget/dummy_hcd.c
667 @@ -1886,6 +1886,7 @@ static int dummy_hcd_probe(struct platform_device *pdev)
668 if (!hcd)
669 return -ENOMEM;
670 the_controller = hcd_to_dummy (hcd);
671 + hcd->has_tt = 1;
672
673 retval = usb_add_hcd(hcd, 0, 0);
674 if (retval != 0) {
675 diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
676 index 6ac3976..1bcf6ee 100644
677 --- a/drivers/usb/host/ehci-hub.c
678 +++ b/drivers/usb/host/ehci-hub.c
679 @@ -758,10 +758,11 @@ static int ehci_hub_control (
680 * power switching; they're allowed to just limit the
681 * current. khubd will turn the power back on.
682 */
683 - if (HCS_PPC (ehci->hcs_params)){
684 + if ((temp & PORT_OC) && HCS_PPC(ehci->hcs_params)) {
685 ehci_writel(ehci,
686 temp & ~(PORT_RWC_BITS | PORT_POWER),
687 status_reg);
688 + temp = ehci_readl(ehci, status_reg);
689 }
690 }
691
692 diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
693 index f51345f..0ee5b4b 100644
694 --- a/drivers/usb/host/ehci-q.c
695 +++ b/drivers/usb/host/ehci-q.c
696 @@ -103,7 +103,7 @@ qh_update (struct ehci_hcd *ehci, struct ehci_qh *qh, struct ehci_qtd *qtd)
697 if (!(hw->hw_info1 & cpu_to_hc32(ehci, 1 << 14))) {
698 unsigned is_out, epnum;
699
700 - is_out = !(qtd->hw_token & cpu_to_hc32(ehci, 1 << 8));
701 + is_out = qh->is_out;
702 epnum = (hc32_to_cpup(ehci, &hw->hw_info1) >> 8) & 0x0f;
703 if (unlikely (!usb_gettoggle (qh->dev, epnum, is_out))) {
704 hw->hw_token &= ~cpu_to_hc32(ehci, QTD_TOGGLE);
705 @@ -923,6 +923,7 @@ done:
706 hw = qh->hw;
707 hw->hw_info1 = cpu_to_hc32(ehci, info1);
708 hw->hw_info2 = cpu_to_hc32(ehci, info2);
709 + qh->is_out = !is_input;
710 usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), !is_input, 1);
711 qh_refresh (ehci, qh);
712 return qh;
713 diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
714 index ac321ef..5b3ca74 100644
715 --- a/drivers/usb/host/ehci.h
716 +++ b/drivers/usb/host/ehci.h
717 @@ -366,6 +366,7 @@ struct ehci_qh {
718 #define NO_FRAME ((unsigned short)~0) /* pick new start */
719
720 struct usb_device *dev; /* access to TT */
721 + unsigned is_out:1; /* bulk or intr OUT */
722 unsigned clearing_tt:1; /* Clear-TT-Buf in progress */
723 };
724
725 diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
726 index 464ed97..bcf7a88 100644
727 --- a/drivers/usb/host/pci-quirks.c
728 +++ b/drivers/usb/host/pci-quirks.c
729 @@ -34,6 +34,8 @@
730 #define OHCI_INTRSTATUS 0x0c
731 #define OHCI_INTRENABLE 0x10
732 #define OHCI_INTRDISABLE 0x14
733 +#define OHCI_FMINTERVAL 0x34
734 +#define OHCI_HCR (1 << 0) /* host controller reset */
735 #define OHCI_OCR (1 << 3) /* ownership change request */
736 #define OHCI_CTRL_RWC (1 << 9) /* remote wakeup connected */
737 #define OHCI_CTRL_IR (1 << 8) /* interrupt routing */
738 @@ -204,6 +206,32 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
739
740 /* reset controller, preserving RWC (and possibly IR) */
741 writel(control & OHCI_CTRL_MASK, base + OHCI_CONTROL);
742 + readl(base + OHCI_CONTROL);
743 +
744 + /* Some NVIDIA controllers stop working if kept in RESET for too long */
745 + if (pdev->vendor == PCI_VENDOR_ID_NVIDIA) {
746 + u32 fminterval;
747 + int cnt;
748 +
749 + /* drive reset for at least 50 ms (7.1.7.5) */
750 + msleep(50);
751 +
752 + /* software reset of the controller, preserving HcFmInterval */
753 + fminterval = readl(base + OHCI_FMINTERVAL);
754 + writel(OHCI_HCR, base + OHCI_CMDSTATUS);
755 +
756 + /* reset requires max 10 us delay */
757 + for (cnt = 30; cnt > 0; --cnt) { /* ... allow extra time */
758 + if ((readl(base + OHCI_CMDSTATUS) & OHCI_HCR) == 0)
759 + break;
760 + udelay(1);
761 + }
762 + writel(fminterval, base + OHCI_FMINTERVAL);
763 +
764 + /* Now we're in the SUSPEND state with all devices reset
765 + * and wakeups and interrupts disabled
766 + */
767 + }
768
769 /*
770 * disable interrupts
771 diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
772 index 24212be..b9afd6a 100644
773 --- a/drivers/usb/musb/musb_core.c
774 +++ b/drivers/usb/musb/musb_core.c
775 @@ -1634,6 +1634,7 @@ void musb_dma_completion(struct musb *musb, u8 epnum, u8 transmit)
776 }
777 }
778 }
779 + musb_writeb(musb_base, MUSB_INDEX, musb->context.index);
780 }
781
782 #else
783 diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
784 index b336017..4a18fd2 100644
785 --- a/drivers/usb/serial/pl2303.c
786 +++ b/drivers/usb/serial/pl2303.c
787 @@ -100,6 +100,8 @@ static struct usb_device_id id_table [] = {
788 { USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
789 { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
790 { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
791 + { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
792 + { USB_DEVICE(WINCHIPHEAD_VENDOR_ID, WINCHIPHEAD_USBSER_PRODUCT_ID) },
793 { } /* Terminating entry */
794 };
795
796 diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
797 index 4d043e4..ca0d237 100644
798 --- a/drivers/usb/serial/pl2303.h
799 +++ b/drivers/usb/serial/pl2303.h
800 @@ -5,7 +5,7 @@
801 * it under the terms of the GNU General Public License as published by
802 * the Free Software Foundation; either version 2 of the License, or
803 * (at your option) any later version.
804 - *
805 + *
806 */
807
808 #define BENQ_VENDOR_ID 0x04a5
809 @@ -140,3 +140,11 @@
810 /* Sanwa KB-USB2 multimeter cable (ID: 11ad:0001) */
811 #define SANWA_VENDOR_ID 0x11ad
812 #define SANWA_PRODUCT_ID 0x0001
813 +
814 +/* ADLINK ND-6530 RS232,RS485 and RS422 adapter */
815 +#define ADLINK_VENDOR_ID 0x0b63
816 +#define ADLINK_ND6530_PRODUCT_ID 0x6530
817 +
818 +/* WinChipHead USB->RS 232 adapter */
819 +#define WINCHIPHEAD_VENDOR_ID 0x4348
820 +#define WINCHIPHEAD_USBSER_PRODUCT_ID 0x5523
821 diff --git a/fs/block_dev.c b/fs/block_dev.c
822 index 16cea86..e65efa2 100644
823 --- a/fs/block_dev.c
824 +++ b/fs/block_dev.c
825 @@ -1203,7 +1203,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
826 if (!bdev->bd_part)
827 goto out_clear;
828
829 - ret = 0;
830 if (disk->fops->open) {
831 ret = disk->fops->open(bdev, mode);
832 if (ret == -ERESTARTSYS) {
833 @@ -1219,18 +1218,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
834 mutex_unlock(&bdev->bd_mutex);
835 goto restart;
836 }
837 + if (ret)
838 + goto out_clear;
839 }
840 - /*
841 - * If the device is invalidated, rescan partition
842 - * if open succeeded or failed with -ENOMEDIUM.
843 - * The latter is necessary to prevent ghost
844 - * partitions on a removed medium.
845 - */
846 - if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
847 - rescan_partitions(disk, bdev);
848 - if (ret)
849 - goto out_clear;
850 -
851 if (!bdev->bd_openers) {
852 bd_set_size(bdev,(loff_t)get_capacity(disk)<<9);
853 bdi = blk_get_backing_dev_info(bdev);
854 @@ -1238,6 +1228,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
855 bdi = &default_backing_dev_info;
856 bdev->bd_inode->i_data.backing_dev_info = bdi;
857 }
858 + if (bdev->bd_invalidated)
859 + rescan_partitions(disk, bdev);
860 } else {
861 struct block_device *whole;
862 whole = bdget_disk(disk, 0);
863 @@ -1264,14 +1256,13 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
864 put_disk(disk);
865 disk = NULL;
866 if (bdev->bd_contains == bdev) {
867 - ret = 0;
868 - if (bdev->bd_disk->fops->open)
869 + if (bdev->bd_disk->fops->open) {
870 ret = bdev->bd_disk->fops->open(bdev, mode);
871 - /* the same as first opener case, read comment there */
872 - if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
873 + if (ret)
874 + goto out_unlock_bdev;
875 + }
876 + if (bdev->bd_invalidated)
877 rescan_partitions(bdev->bd_disk, bdev);
878 - if (ret)
879 - goto out_unlock_bdev;
880 }
881 }
882 bdev->bd_openers++;
883 diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
884 index c4dbc63..e29581e 100644
885 --- a/fs/cifs/cifsglob.h
886 +++ b/fs/cifs/cifsglob.h
887 @@ -33,7 +33,7 @@
888 #define MAX_SHARE_SIZE 64 /* used to be 20, this should still be enough */
889 #define MAX_USERNAME_SIZE 32 /* 32 is to allow for 15 char names + null
890 termination then *2 for unicode versions */
891 -#define MAX_PASSWORD_SIZE 16
892 +#define MAX_PASSWORD_SIZE 512 /* max for windows seems to be 256 wide chars */
893
894 #define CIFS_MIN_RCV_POOL 4
895
896 diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
897 index 6234417..b6bb82e 100644
898 --- a/fs/cifs/connect.c
899 +++ b/fs/cifs/connect.c
900 @@ -1588,17 +1588,29 @@ out_err:
901 }
902
903 static struct cifsSesInfo *
904 -cifs_find_smb_ses(struct TCP_Server_Info *server, char *username)
905 +cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
906 {
907 - struct list_head *tmp;
908 struct cifsSesInfo *ses;
909
910 write_lock(&cifs_tcp_ses_lock);
911 - list_for_each(tmp, &server->smb_ses_list) {
912 - ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
913 - if (strncmp(ses->userName, username, MAX_USERNAME_SIZE))
914 - continue;
915 -
916 + list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
917 + switch (server->secType) {
918 + case Kerberos:
919 + if (vol->linux_uid != ses->linux_uid)
920 + continue;
921 + break;
922 + default:
923 + /* anything else takes username/password */
924 + if (strncmp(ses->userName, vol->username,
925 + MAX_USERNAME_SIZE))
926 + continue;
927 + if (strlen(vol->username) != 0 &&
928 + ses->password != NULL &&
929 + strncmp(ses->password,
930 + vol->password ? vol->password : "",
931 + MAX_PASSWORD_SIZE))
932 + continue;
933 + }
934 ++ses->ses_count;
935 write_unlock(&cifs_tcp_ses_lock);
936 return ses;
937 @@ -2362,7 +2374,7 @@ try_mount_again:
938 goto out;
939 }
940
941 - pSesInfo = cifs_find_smb_ses(srvTcp, volume_info->username);
942 + pSesInfo = cifs_find_smb_ses(srvTcp, volume_info);
943 if (pSesInfo) {
944 cFYI(1, ("Existing smb sess found (status=%d)",
945 pSesInfo->status));
946 diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
947 index 387d92d..d7add4c 100644
948 --- a/fs/ext3/xattr.c
949 +++ b/fs/ext3/xattr.c
950 @@ -800,8 +800,16 @@ inserted:
951 /* We need to allocate a new block */
952 ext3_fsblk_t goal = ext3_group_first_block_no(sb,
953 EXT3_I(inode)->i_block_group);
954 - ext3_fsblk_t block = ext3_new_block(handle, inode,
955 - goal, &error);
956 + ext3_fsblk_t block;
957 +
958 + /*
959 + * Protect us agaist concurrent allocations to the
960 + * same inode from ext3_..._writepage(). Reservation
961 + * code does not expect racing allocations.
962 + */
963 + mutex_lock(&EXT3_I(inode)->truncate_mutex);
964 + block = ext3_new_block(handle, inode, goal, &error);
965 + mutex_unlock(&EXT3_I(inode)->truncate_mutex);
966 if (error)
967 goto cleanup;
968 ea_idebug(inode, "creating block %d", block);
969 diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
970 index e81b2bf..7ee8ebc 100644
971 --- a/fs/nfs/nfs4xdr.c
972 +++ b/fs/nfs/nfs4xdr.c
973 @@ -88,7 +88,7 @@ static int nfs4_stat_to_errno(int);
974 #define encode_getfh_maxsz (op_encode_hdr_maxsz)
975 #define decode_getfh_maxsz (op_decode_hdr_maxsz + 1 + \
976 ((3+NFS4_FHSIZE) >> 2))
977 -#define nfs4_fattr_bitmap_maxsz 3
978 +#define nfs4_fattr_bitmap_maxsz 4
979 #define encode_getattr_maxsz (op_encode_hdr_maxsz + nfs4_fattr_bitmap_maxsz)
980 #define nfs4_name_maxsz (1 + ((3 + NFS4_MAXNAMLEN) >> 2))
981 #define nfs4_path_maxsz (1 + ((3 + NFS4_MAXPATHLEN) >> 2))
982 diff --git a/fs/proc/base.c b/fs/proc/base.c
983 index 3d09a10..7b5819c 100644
984 --- a/fs/proc/base.c
985 +++ b/fs/proc/base.c
986 @@ -2454,6 +2454,9 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
987 struct task_io_accounting acct = task->ioac;
988 unsigned long flags;
989
990 + if (!ptrace_may_access(task, PTRACE_MODE_READ))
991 + return -EACCES;
992 +
993 if (whole && lock_task_sighand(task, &flags)) {
994 struct task_struct *t = task;
995
996 @@ -2575,7 +2578,7 @@ static const struct pid_entry tgid_base_stuff[] = {
997 REG("coredump_filter", S_IRUGO|S_IWUSR, proc_coredump_filter_operations),
998 #endif
999 #ifdef CONFIG_TASK_IO_ACCOUNTING
1000 - INF("io", S_IRUGO, proc_tgid_io_accounting),
1001 + INF("io", S_IRUSR, proc_tgid_io_accounting),
1002 #endif
1003 };
1004
1005 @@ -2910,7 +2913,7 @@ static const struct pid_entry tid_base_stuff[] = {
1006 REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),
1007 #endif
1008 #ifdef CONFIG_TASK_IO_ACCOUNTING
1009 - INF("io", S_IRUGO, proc_tid_io_accounting),
1010 + INF("io", S_IRUSR, proc_tid_io_accounting),
1011 #endif
1012 };
1013
1014 diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
1015 index c27a182..9d7e8f7 100644
1016 --- a/include/linux/netdevice.h
1017 +++ b/include/linux/netdevice.h
1018 @@ -1164,9 +1164,12 @@ static inline int skb_gro_header_hard(struct sk_buff *skb, unsigned int hlen)
1019 static inline void *skb_gro_header_slow(struct sk_buff *skb, unsigned int hlen,
1020 unsigned int offset)
1021 {
1022 + if (!pskb_may_pull(skb, hlen))
1023 + return NULL;
1024 +
1025 NAPI_GRO_CB(skb)->frag0 = NULL;
1026 NAPI_GRO_CB(skb)->frag0_len = 0;
1027 - return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;
1028 + return skb->data + offset;
1029 }
1030
1031 static inline void *skb_gro_mac_header(struct sk_buff *skb)
1032 diff --git a/kernel/perf_event.c b/kernel/perf_event.c
1033 index fc5ab8e..37ebc14 100644
1034 --- a/kernel/perf_event.c
1035 +++ b/kernel/perf_event.c
1036 @@ -3694,12 +3694,8 @@ static int __perf_event_overflow(struct perf_event *event, int nmi,
1037 if (events && atomic_dec_and_test(&event->event_limit)) {
1038 ret = 1;
1039 event->pending_kill = POLL_HUP;
1040 - if (nmi) {
1041 - event->pending_disable = 1;
1042 - perf_pending_queue(&event->pending,
1043 - perf_pending_event);
1044 - } else
1045 - perf_event_disable(event);
1046 + event->pending_disable = 1;
1047 + perf_pending_queue(&event->pending, perf_pending_event);
1048 }
1049
1050 perf_event_output(event, nmi, data, regs);
1051 diff --git a/net/atm/br2684.c b/net/atm/br2684.c
1052 index 26a646d..c9230c3 100644
1053 --- a/net/atm/br2684.c
1054 +++ b/net/atm/br2684.c
1055 @@ -554,6 +554,12 @@ static const struct net_device_ops br2684_netdev_ops = {
1056 .ndo_validate_addr = eth_validate_addr,
1057 };
1058
1059 +static const struct net_device_ops br2684_netdev_ops_routed = {
1060 + .ndo_start_xmit = br2684_start_xmit,
1061 + .ndo_set_mac_address = br2684_mac_addr,
1062 + .ndo_change_mtu = eth_change_mtu
1063 +};
1064 +
1065 static void br2684_setup(struct net_device *netdev)
1066 {
1067 struct br2684_dev *brdev = BRPRIV(netdev);
1068 @@ -569,11 +575,10 @@ static void br2684_setup(struct net_device *netdev)
1069 static void br2684_setup_routed(struct net_device *netdev)
1070 {
1071 struct br2684_dev *brdev = BRPRIV(netdev);
1072 - brdev->net_dev = netdev;
1073
1074 + brdev->net_dev = netdev;
1075 netdev->hard_header_len = 0;
1076 -
1077 - netdev->netdev_ops = &br2684_netdev_ops;
1078 + netdev->netdev_ops = &br2684_netdev_ops_routed;
1079 netdev->addr_len = 0;
1080 netdev->mtu = 1500;
1081 netdev->type = ARPHRD_PPP;
1082 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
1083 index 2114e45..8567d47 100644
1084 --- a/net/bridge/br_private.h
1085 +++ b/net/bridge/br_private.h
1086 @@ -75,6 +75,7 @@ struct net_bridge_port
1087 bridge_id designated_bridge;
1088 u32 path_cost;
1089 u32 designated_cost;
1090 + unsigned long designated_age;
1091
1092 struct timer_list forward_delay_timer;
1093 struct timer_list hold_timer;
1094 diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
1095 index fd3f8d6..c7d6bfc 100644
1096 --- a/net/bridge/br_stp.c
1097 +++ b/net/bridge/br_stp.c
1098 @@ -165,8 +165,7 @@ void br_transmit_config(struct net_bridge_port *p)
1099 else {
1100 struct net_bridge_port *root
1101 = br_get_port(br, br->root_port);
1102 - bpdu.message_age = br->max_age
1103 - - (root->message_age_timer.expires - jiffies)
1104 + bpdu.message_age = (jiffies - root->designated_age)
1105 + MESSAGE_AGE_INCR;
1106 }
1107 bpdu.max_age = br->max_age;
1108 @@ -190,6 +189,7 @@ static inline void br_record_config_information(struct net_bridge_port *p,
1109 p->designated_cost = bpdu->root_path_cost;
1110 p->designated_bridge = bpdu->bridge_id;
1111 p->designated_port = bpdu->port_id;
1112 + p->designated_age = jiffies + bpdu->message_age;
1113
1114 mod_timer(&p->message_age_timer, jiffies
1115 + (p->br->max_age - bpdu->message_age));
1116 diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
1117 index cfab9e4..f614584 100644
1118 --- a/net/ipv4/ip_gre.c
1119 +++ b/net/ipv4/ip_gre.c
1120 @@ -1665,14 +1665,15 @@ static int __init ipgre_init(void)
1121
1122 printk(KERN_INFO "GRE over IPv4 tunneling driver\n");
1123
1124 - if (inet_add_protocol(&ipgre_protocol, IPPROTO_GRE) < 0) {
1125 - printk(KERN_INFO "ipgre init: can't add protocol\n");
1126 - return -EAGAIN;
1127 - }
1128 -
1129 err = register_pernet_gen_device(&ipgre_net_id, &ipgre_net_ops);
1130 if (err < 0)
1131 - goto gen_device_failed;
1132 + return err;
1133 +
1134 + err = inet_add_protocol(&ipgre_protocol, IPPROTO_GRE);
1135 + if (err < 0) {
1136 + printk(KERN_INFO "ipgre init: can't add protocol\n");
1137 + goto add_proto_failed;
1138 + }
1139
1140 err = rtnl_link_register(&ipgre_link_ops);
1141 if (err < 0)
1142 @@ -1688,9 +1689,9 @@ out:
1143 tap_ops_failed:
1144 rtnl_link_unregister(&ipgre_link_ops);
1145 rtnl_link_failed:
1146 - unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
1147 -gen_device_failed:
1148 inet_del_protocol(&ipgre_protocol, IPPROTO_GRE);
1149 +add_proto_failed:
1150 + unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
1151 goto out;
1152 }
1153
1154 @@ -1698,9 +1699,9 @@ static void __exit ipgre_fini(void)
1155 {
1156 rtnl_link_unregister(&ipgre_tap_ops);
1157 rtnl_link_unregister(&ipgre_link_ops);
1158 - unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
1159 if (inet_del_protocol(&ipgre_protocol, IPPROTO_GRE) < 0)
1160 printk(KERN_INFO "ipgre close: can't remove protocol\n");
1161 + unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
1162 }
1163
1164 module_init(ipgre_init);
1165 diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
1166 index f37df1a..860b5c5 100644
1167 --- a/net/ipv4/ipip.c
1168 +++ b/net/ipv4/ipip.c
1169 @@ -830,15 +830,14 @@ static int __init ipip_init(void)
1170
1171 printk(banner);
1172
1173 - if (xfrm4_tunnel_register(&ipip_handler, AF_INET)) {
1174 + err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops);
1175 + if (err < 0)
1176 + return err;
1177 + err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
1178 + if (err < 0) {
1179 + unregister_pernet_device(&ipip_net_ops);
1180 printk(KERN_INFO "ipip init: can't register tunnel\n");
1181 - return -EAGAIN;
1182 }
1183 -
1184 - err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops);
1185 - if (err)
1186 - xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
1187 -
1188 return err;
1189 }
1190
1191 diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
1192 index 9a95c82..7fb3e02 100644
1193 --- a/net/ipv6/ip6_tunnel.c
1194 +++ b/net/ipv6/ip6_tunnel.c
1195 @@ -1466,27 +1466,29 @@ static int __init ip6_tunnel_init(void)
1196 {
1197 int err;
1198
1199 - if (xfrm6_tunnel_register(&ip4ip6_handler, AF_INET)) {
1200 + err = register_pernet_device(&ip6_tnl_net_ops);
1201 + if (err < 0)
1202 + goto out_pernet;
1203 +
1204 + err = xfrm6_tunnel_register(&ip4ip6_handler, AF_INET);
1205 + if (err < 0) {
1206 printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n");
1207 - err = -EAGAIN;
1208 - goto out;
1209 + goto out_ip4ip6;
1210 }
1211
1212 - if (xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6)) {
1213 + err = xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6);
1214 + if (err < 0) {
1215 printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n");
1216 - err = -EAGAIN;
1217 - goto unreg_ip4ip6;
1218 + goto out_ip6ip6;
1219 }
1220
1221 - err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops);
1222 - if (err < 0)
1223 - goto err_pernet;
1224 return 0;
1225 -err_pernet:
1226 - xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6);
1227 -unreg_ip4ip6:
1228 +
1229 +out_ip6ip6:
1230 xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
1231 -out:
1232 +out_ip4ip6:
1233 + unregister_pernet_device(&ip6_tnl_net_ops);
1234 +out_pernet:
1235 return err;
1236 }
1237
1238 diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
1239 index de2ffef..b128c07 100644
1240 --- a/net/ipv6/sit.c
1241 +++ b/net/ipv6/sit.c
1242 @@ -1086,15 +1086,14 @@ static int __init sit_init(void)
1243
1244 printk(KERN_INFO "IPv6 over IPv4 tunneling driver\n");
1245
1246 - if (xfrm4_tunnel_register(&sit_handler, AF_INET6) < 0) {
1247 - printk(KERN_INFO "sit init: Can't add protocol\n");
1248 - return -EAGAIN;
1249 - }
1250 -
1251 err = register_pernet_gen_device(&sit_net_id, &sit_net_ops);
1252 if (err < 0)
1253 - xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
1254 -
1255 + return err;
1256 + err = xfrm4_tunnel_register(&sit_handler, AF_INET6);
1257 + if (err < 0) {
1258 + unregister_pernet_device(&sit_net_ops);
1259 + printk(KERN_INFO "sit init: Can't add protocol\n");
1260 + }
1261 return err;
1262 }
1263
1264 diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
1265 index 81a95c0..48bb1e3 100644
1266 --- a/net/ipv6/xfrm6_tunnel.c
1267 +++ b/net/ipv6/xfrm6_tunnel.c
1268 @@ -344,32 +344,38 @@ static struct xfrm6_tunnel xfrm46_tunnel_handler = {
1269
1270 static int __init xfrm6_tunnel_init(void)
1271 {
1272 - if (xfrm_register_type(&xfrm6_tunnel_type, AF_INET6) < 0)
1273 + int rv;
1274 +
1275 + rv = xfrm6_tunnel_spi_init();
1276 + if (rv < 0)
1277 goto err;
1278 - if (xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6))
1279 - goto unreg;
1280 - if (xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET))
1281 - goto dereg6;
1282 - if (xfrm6_tunnel_spi_init() < 0)
1283 - goto dereg46;
1284 + rv = xfrm_register_type(&xfrm6_tunnel_type, AF_INET6);
1285 + if (rv < 0)
1286 + goto out_type;
1287 + rv = xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6);
1288 + if (rv < 0)
1289 + goto out_xfrm6;
1290 + rv = xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET);
1291 + if (rv < 0)
1292 + goto out_xfrm46;
1293 return 0;
1294
1295 -dereg46:
1296 - xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET);
1297 -dereg6:
1298 +out_xfrm46:
1299 xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6);
1300 -unreg:
1301 +out_xfrm6:
1302 xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
1303 +out_type:
1304 + xfrm6_tunnel_spi_fini();
1305 err:
1306 - return -EAGAIN;
1307 + return rv;
1308 }
1309
1310 static void __exit xfrm6_tunnel_fini(void)
1311 {
1312 - xfrm6_tunnel_spi_fini();
1313 xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET);
1314 xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6);
1315 xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
1316 + xfrm6_tunnel_spi_fini();
1317 }
1318
1319 module_init(xfrm6_tunnel_init);
1320 diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
1321 index 5bea319..e67eea7 100644
1322 --- a/net/mac80211/mlme.c
1323 +++ b/net/mac80211/mlme.c
1324 @@ -2308,6 +2308,9 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
1325 {
1326 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1327
1328 + if (!ifmgd->associated)
1329 + return;
1330 +
1331 if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
1332 add_timer(&ifmgd->timer);
1333 if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
1334 diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
1335 index 830faf4..4418bb4 100644
1336 --- a/net/sunrpc/rpcb_clnt.c
1337 +++ b/net/sunrpc/rpcb_clnt.c
1338 @@ -533,7 +533,7 @@ void rpcb_getport_async(struct rpc_task *task)
1339 u32 bind_version;
1340 struct rpc_xprt *xprt;
1341 struct rpc_clnt *rpcb_clnt;
1342 - static struct rpcbind_args *map;
1343 + struct rpcbind_args *map;
1344 struct rpc_task *child;
1345 struct sockaddr_storage addr;
1346 struct sockaddr *sap = (struct sockaddr *)&addr;
1347 diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
1348 index 9191b2f..570da30 100644
1349 --- a/net/sunrpc/sched.c
1350 +++ b/net/sunrpc/sched.c
1351 @@ -613,30 +613,25 @@ static void __rpc_execute(struct rpc_task *task)
1352 BUG_ON(RPC_IS_QUEUED(task));
1353
1354 for (;;) {
1355 + void (*do_action)(struct rpc_task *);
1356
1357 /*
1358 - * Execute any pending callback.
1359 + * Execute any pending callback first.
1360 */
1361 - if (task->tk_callback) {
1362 - void (*save_callback)(struct rpc_task *);
1363 -
1364 - /*
1365 - * We set tk_callback to NULL before calling it,
1366 - * in case it sets the tk_callback field itself:
1367 - */
1368 - save_callback = task->tk_callback;
1369 - task->tk_callback = NULL;
1370 - save_callback(task);
1371 - } else {
1372 + do_action = task->tk_callback;
1373 + task->tk_callback = NULL;
1374 + if (do_action == NULL) {
1375 /*
1376 * Perform the next FSM step.
1377 - * tk_action may be NULL when the task has been killed
1378 - * by someone else.
1379 + * tk_action may be NULL if the task has been killed.
1380 + * In particular, note that rpc_killall_tasks may
1381 + * do this at any time, so beware when dereferencing.
1382 */
1383 - if (task->tk_action == NULL)
1384 + do_action = task->tk_action;
1385 + if (do_action == NULL)
1386 break;
1387 - task->tk_action(task);
1388 }
1389 + do_action(task);
1390
1391 /*
1392 * Lockless check for whether task is sleeping or not.
1393 diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
1394 index df760ad..cc1fb36 100644
1395 --- a/net/sunrpc/svc_xprt.c
1396 +++ b/net/sunrpc/svc_xprt.c
1397 @@ -896,12 +896,13 @@ void svc_delete_xprt(struct svc_xprt *xprt)
1398 if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
1399 list_del_init(&xprt->xpt_list);
1400 /*
1401 - * We used to delete the transport from whichever list
1402 - * it's sk_xprt.xpt_ready node was on, but we don't actually
1403 - * need to. This is because the only time we're called
1404 - * while still attached to a queue, the queue itself
1405 - * is about to be destroyed (in svc_destroy).
1406 + * The only time we're called while xpt_ready is still on a list
1407 + * is while the list itself is about to be destroyed (in
1408 + * svc_destroy). BUT svc_xprt_enqueue could still be attempting
1409 + * to add new entries to the sp_sockets list, so we can't leave
1410 + * a freed xprt on it.
1411 */
1412 + list_del_init(&xprt->xpt_ready);
1413 if (test_bit(XPT_TEMP, &xprt->xpt_flags))
1414 serv->sv_tmpcnt--;
1415
1416 diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
1417 index 08bfed5..038232d 100644
1418 --- a/sound/core/pcm_compat.c
1419 +++ b/sound/core/pcm_compat.c
1420 @@ -341,7 +341,7 @@ static int snd_pcm_ioctl_xfern_compat(struct snd_pcm_substream *substream,
1421 kfree(bufs);
1422 return -EFAULT;
1423 }
1424 - bufs[ch] = compat_ptr(ptr);
1425 + bufs[i] = compat_ptr(ptr);
1426 bufptr++;
1427 }
1428 if (dir == SNDRV_PCM_STREAM_PLAYBACK)
1429 diff --git a/sound/soc/blackfin/bf5xx-i2s-pcm.c b/sound/soc/blackfin/bf5xx-i2s-pcm.c
1430 index 62fbb84..77dae16 100644
1431 --- a/sound/soc/blackfin/bf5xx-i2s-pcm.c
1432 +++ b/sound/soc/blackfin/bf5xx-i2s-pcm.c
1433 @@ -139,11 +139,20 @@ static snd_pcm_uframes_t bf5xx_pcm_pointer(struct snd_pcm_substream *substream)
1434 pr_debug("%s enter\n", __func__);
1435 if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
1436 diff = sport_curr_offset_tx(sport);
1437 - frames = bytes_to_frames(substream->runtime, diff);
1438 } else {
1439 diff = sport_curr_offset_rx(sport);
1440 - frames = bytes_to_frames(substream->runtime, diff);
1441 }
1442 +
1443 + /*
1444 + * TX at least can report one frame beyond the end of the
1445 + * buffer if we hit the wraparound case - clamp to within the
1446 + * buffer as the ALSA APIs require.
1447 + */
1448 + if (diff == snd_pcm_lib_buffer_bytes(substream))
1449 + diff = 0;
1450 +
1451 + frames = bytes_to_frames(substream->runtime, diff);
1452 +
1453 return frames;
1454 }
1455

  ViewVC Help
Powered by ViewVC 1.1.20