/[linux-patches]/genpatches-2.6/trunk/2.6.25/1000_linux-2.6.25.1.patch
Gentoo

Contents of /genpatches-2.6/trunk/2.6.25/1000_linux-2.6.25.1.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1303 - (show annotations) (download) (as text)
Fri May 2 17:04:07 2008 UTC (12 years, 2 months ago) by dsd
File MIME type: text/x-diff
File size: 36826 byte(s)
Linux 2.6.25.1
1 diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
2 index 8c71daf..9fee37e 100644
3 --- a/arch/alpha/kernel/osf_sys.c
4 +++ b/arch/alpha/kernel/osf_sys.c
5 @@ -75,6 +75,7 @@ osf_set_program_attributes(unsigned long text_start, unsigned long text_len,
6 lock_kernel();
7 mm = current->mm;
8 mm->end_code = bss_start + bss_len;
9 + mm->start_brk = bss_start + bss_len;
10 mm->brk = bss_start + bss_len;
11 #if 0
12 printk("set_program_attributes(%lx %lx %lx %lx)\n",
13 diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c
14 index 4ca5486..f239b30 100644
15 --- a/arch/x86/kernel/io_apic_32.c
16 +++ b/arch/x86/kernel/io_apic_32.c
17 @@ -2477,6 +2477,7 @@ void destroy_irq(unsigned int irq)
18 dynamic_irq_cleanup(irq);
19
20 spin_lock_irqsave(&vector_lock, flags);
21 + clear_bit(irq_vector[irq], used_vectors);
22 irq_vector[irq] = 0;
23 spin_unlock_irqrestore(&vector_lock, flags);
24 }
25 diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
26 index a871586..579745c 100644
27 --- a/arch/x86/pci/irq.c
28 +++ b/arch/x86/pci/irq.c
29 @@ -200,7 +200,7 @@ static int pirq_ali_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
30 {
31 static const unsigned char irqmap[16] = { 0, 9, 3, 10, 4, 5, 7, 6, 1, 11, 0, 12, 0, 14, 0, 15 };
32
33 - WARN_ON_ONCE(pirq >= 16);
34 + WARN_ON_ONCE(pirq > 16);
35 return irqmap[read_config_nybble(router, 0x48, pirq-1)];
36 }
37
38 @@ -209,7 +209,7 @@ static int pirq_ali_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i
39 static const unsigned char irqmap[16] = { 0, 8, 0, 2, 4, 5, 7, 6, 0, 1, 3, 9, 11, 0, 13, 15 };
40 unsigned int val = irqmap[irq];
41
42 - WARN_ON_ONCE(pirq >= 16);
43 + WARN_ON_ONCE(pirq > 16);
44 if (val) {
45 write_config_nybble(router, 0x48, pirq-1, val);
46 return 1;
47 @@ -260,7 +260,7 @@ static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq
48 {
49 static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
50
51 - WARN_ON_ONCE(pirq >= 5);
52 + WARN_ON_ONCE(pirq > 5);
53 return read_config_nybble(router, 0x55, pirqmap[pirq-1]);
54 }
55
56 @@ -268,7 +268,7 @@ static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq
57 {
58 static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
59
60 - WARN_ON_ONCE(pirq >= 5);
61 + WARN_ON_ONCE(pirq > 5);
62 write_config_nybble(router, 0x55, pirqmap[pirq-1], irq);
63 return 1;
64 }
65 @@ -282,7 +282,7 @@ static int pirq_ite_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
66 {
67 static const unsigned char pirqmap[4] = { 1, 0, 2, 3 };
68
69 - WARN_ON_ONCE(pirq >= 4);
70 + WARN_ON_ONCE(pirq > 4);
71 return read_config_nybble(router,0x43, pirqmap[pirq-1]);
72 }
73
74 @@ -290,7 +290,7 @@ static int pirq_ite_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i
75 {
76 static const unsigned char pirqmap[4] = { 1, 0, 2, 3 };
77
78 - WARN_ON_ONCE(pirq >= 4);
79 + WARN_ON_ONCE(pirq > 4);
80 write_config_nybble(router, 0x43, pirqmap[pirq-1], irq);
81 return 1;
82 }
83 diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
84 index b2112f5..a3b2374 100644
85 --- a/drivers/infiniband/hw/nes/nes.c
86 +++ b/drivers/infiniband/hw/nes/nes.c
87 @@ -751,13 +751,13 @@ static void __devexit nes_remove(struct pci_dev *pcidev)
88
89 list_del(&nesdev->list);
90 nes_destroy_cqp(nesdev);
91 +
92 + free_irq(pcidev->irq, nesdev);
93 tasklet_kill(&nesdev->dpc_tasklet);
94
95 /* Deallocate the Adapter Structure */
96 nes_destroy_adapter(nesdev->nesadapter);
97
98 - free_irq(pcidev->irq, nesdev);
99 -
100 if (nesdev->msi_enabled) {
101 pci_disable_msi(pcidev);
102 }
103 diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
104 index 0bef878..96b1a0e 100644
105 --- a/drivers/infiniband/hw/nes/nes_cm.c
106 +++ b/drivers/infiniband/hw/nes/nes_cm.c
107 @@ -1834,8 +1834,10 @@ int mini_cm_recv_pkt(struct nes_cm_core *cm_core, struct nes_vnic *nesvnic,
108 nfo.rem_addr = ntohl(iph->saddr);
109 nfo.rem_port = ntohs(tcph->source);
110
111 - nes_debug(NES_DBG_CM, "Received packet: dest=0x%08X:0x%04X src=0x%08X:0x%04X\n",
112 - iph->daddr, tcph->dest, iph->saddr, tcph->source);
113 + nes_debug(NES_DBG_CM, "Received packet: dest=" NIPQUAD_FMT
114 + ":0x%04X src=" NIPQUAD_FMT ":0x%04X\n",
115 + NIPQUAD(iph->daddr), tcph->dest,
116 + NIPQUAD(iph->saddr), tcph->source);
117
118 /* note: this call is going to increment cm_node ref count */
119 cm_node = find_node(cm_core,
120 diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
121 index 49e53e4..496655e 100644
122 --- a/drivers/infiniband/hw/nes/nes_hw.c
123 +++ b/drivers/infiniband/hw/nes/nes_hw.c
124 @@ -625,6 +625,15 @@ unsigned int nes_reset_adapter_ne020(struct nes_device *nesdev, u8 *OneG_Mode)
125 nes_debug(NES_DBG_INIT, "Did not see full soft reset done.\n");
126 return 0;
127 }
128 +
129 + i = 0;
130 + while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000)
131 + mdelay(1);
132 + if (i >= 10000) {
133 + printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n",
134 + nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS));
135 + return 0;
136 + }
137 }
138
139 /* port reset */
140 @@ -673,17 +682,6 @@ unsigned int nes_reset_adapter_ne020(struct nes_device *nesdev, u8 *OneG_Mode)
141 }
142 }
143
144 -
145 -
146 - i = 0;
147 - while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000)
148 - mdelay(1);
149 - if (i >= 10000) {
150 - printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n",
151 - nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS));
152 - return 0;
153 - }
154 -
155 return port_count;
156 }
157
158 diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
159 index 5bbce29..c7d305b 100644
160 --- a/drivers/md/dm-exception-store.c
161 +++ b/drivers/md/dm-exception-store.c
162 @@ -131,7 +131,7 @@ struct pstore {
163
164 static unsigned sectors_to_pages(unsigned sectors)
165 {
166 - return sectors / (PAGE_SIZE >> 9);
167 + return DIV_ROUND_UP(sectors, PAGE_SIZE >> 9);
168 }
169
170 static int alloc_area(struct pstore *ps)
171 diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
172 index 8c9a8ad..8bf5596 100644
173 --- a/drivers/media/video/cx88/cx88-cards.c
174 +++ b/drivers/media/video/cx88/cx88-cards.c
175 @@ -1354,6 +1354,10 @@ static const struct cx88_board cx88_boards[] = {
176 }},
177 /* fixme: Add radio support */
178 .mpeg = CX88_MPEG_DVB | CX88_MPEG_BLACKBIRD,
179 + .radio = {
180 + .type = CX88_RADIO,
181 + .gpio0 = 0xe780,
182 + },
183 },
184 [CX88_BOARD_ADSTECH_PTV_390] = {
185 .name = "ADS Tech Instant Video PCI",
186 diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
187 index edef2a5..1e6f36e 100644
188 --- a/drivers/media/video/ivtv/ivtv-ioctl.c
189 +++ b/drivers/media/video/ivtv/ivtv-ioctl.c
190 @@ -741,7 +741,8 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, struct file *filp, unsigned int cmd, void
191
192 memset(vcap, 0, sizeof(*vcap));
193 strcpy(vcap->driver, IVTV_DRIVER_NAME); /* driver name */
194 - strcpy(vcap->card, itv->card_name); /* card type */
195 + strncpy(vcap->card, itv->card_name,
196 + sizeof(vcap->card)-1); /* card type */
197 strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */
198 vcap->version = IVTV_DRIVER_VERSION; /* version */
199 vcap->capabilities = itv->v4l2_cap; /* capabilities */
200 diff --git a/drivers/media/video/tea5761.c b/drivers/media/video/tea5761.c
201 index 5326eec..de7e060 100644
202 --- a/drivers/media/video/tea5761.c
203 +++ b/drivers/media/video/tea5761.c
204 @@ -249,14 +249,19 @@ int tea5761_autodetection(struct i2c_adapter* i2c_adap, u8 i2c_addr)
205
206 if (16 != (rc = tuner_i2c_xfer_recv(&i2c, buffer, 16))) {
207 printk(KERN_WARNING "it is not a TEA5761. Received %i chars.\n", rc);
208 - return EINVAL;
209 + return -EINVAL;
210 }
211
212 - if (!((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061))) {
213 - printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x. It is not a TEA5761\n",buffer[13],buffer[14],buffer[15]);
214 - return EINVAL;
215 + if ((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061)) {
216 + printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x."
217 + " It is not a TEA5761\n",
218 + buffer[13], buffer[14], buffer[15]);
219 + return -EINVAL;
220 }
221 - printk(KERN_WARNING "TEA5761 detected.\n");
222 + printk(KERN_WARNING "tea5761: TEA%02x%02x detected. "
223 + "Manufacturer ID= 0x%02x\n",
224 + buffer[14], buffer[15], buffer[13]);
225 +
226 return 0;
227 }
228
229 diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
230 index 78a09a2..8cdbdd0 100644
231 --- a/drivers/media/video/tuner-core.c
232 +++ b/drivers/media/video/tuner-core.c
233 @@ -1112,8 +1112,8 @@ static int tuner_probe(struct i2c_client *client)
234 if (!no_autodetect) {
235 switch (client->addr) {
236 case 0x10:
237 - if (tea5761_autodetection(t->i2c->adapter, t->i2c->addr)
238 - != EINVAL) {
239 + if (tea5761_autodetection(t->i2c->adapter,
240 + t->i2c->addr) >= 0) {
241 t->type = TUNER_TEA5761;
242 t->mode_mask = T_RADIO;
243 t->mode = T_STANDBY;
244 @@ -1125,7 +1125,7 @@ static int tuner_probe(struct i2c_client *client)
245
246 goto register_client;
247 }
248 - break;
249 + return -ENODEV;
250 case 0x42:
251 case 0x43:
252 case 0x4a:
253 diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
254 index c082cf0..de11039 100644
255 --- a/drivers/net/s2io.c
256 +++ b/drivers/net/s2io.c
257 @@ -84,7 +84,7 @@
258 #include "s2io.h"
259 #include "s2io-regs.h"
260
261 -#define DRV_VERSION "2.0.26.20"
262 +#define DRV_VERSION "2.0.26.22"
263
264 /* S2io Driver name & version. */
265 static char s2io_driver_name[] = "Neterion";
266 @@ -2339,7 +2339,7 @@ static void free_tx_buffers(struct s2io_nic *nic)
267 for (i = 0; i < config->tx_fifo_num; i++) {
268 unsigned long flags;
269 spin_lock_irqsave(&mac_control->fifos[i].tx_lock, flags);
270 - for (j = 0; j < config->tx_cfg[i].fifo_len - 1; j++) {
271 + for (j = 0; j < config->tx_cfg[i].fifo_len; j++) {
272 txdp = (struct TxD *) \
273 mac_control->fifos[i].list_info[j].list_virt_addr;
274 skb = s2io_txdl_getskb(&mac_control->fifos[i], txdp, j);
275 diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
276 index 17585e5..432e837 100644
277 --- a/drivers/net/tehuti.c
278 +++ b/drivers/net/tehuti.c
279 @@ -625,6 +625,12 @@ static void __init bdx_firmware_endianess(void)
280 s_firmLoad[i] = CPU_CHIP_SWAP32(s_firmLoad[i]);
281 }
282
283 +static int bdx_range_check(struct bdx_priv *priv, u32 offset)
284 +{
285 + return (offset > (u32) (BDX_REGS_SIZE / priv->nic->port_num)) ?
286 + -EINVAL : 0;
287 +}
288 +
289 static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
290 {
291 struct bdx_priv *priv = ndev->priv;
292 @@ -643,9 +649,15 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
293 DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]);
294 }
295
296 + if (!capable(CAP_SYS_RAWIO))
297 + return -EPERM;
298 +
299 switch (data[0]) {
300
301 case BDX_OP_READ:
302 + error = bdx_range_check(priv, data[1]);
303 + if (error < 0)
304 + return error;
305 data[2] = READ_REG(priv, data[1]);
306 DBG("read_reg(0x%x)=0x%x (dec %d)\n", data[1], data[2],
307 data[2]);
308 @@ -655,6 +667,9 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
309 break;
310
311 case BDX_OP_WRITE:
312 + error = bdx_range_check(priv, data[1]);
313 + if (error < 0)
314 + return error;
315 WRITE_REG(priv, data[1], data[2]);
316 DBG("write_reg(0x%x, 0x%x)\n", data[1], data[2]);
317 break;
318 diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
319 index 96043c5..bc4c62b 100644
320 --- a/drivers/net/tg3.c
321 +++ b/drivers/net/tg3.c
322 @@ -64,8 +64,8 @@
323
324 #define DRV_MODULE_NAME "tg3"
325 #define PFX DRV_MODULE_NAME ": "
326 -#define DRV_MODULE_VERSION "3.90"
327 -#define DRV_MODULE_RELDATE "April 12, 2008"
328 +#define DRV_MODULE_VERSION "3.91"
329 +#define DRV_MODULE_RELDATE "April 18, 2008"
330
331 #define TG3_DEF_MAC_MODE 0
332 #define TG3_DEF_RX_MODE 0
333 @@ -4135,11 +4135,21 @@ static int tigon3_dma_hwbug_workaround(struct tg3 *tp, struct sk_buff *skb,
334 u32 last_plus_one, u32 *start,
335 u32 base_flags, u32 mss)
336 {
337 - struct sk_buff *new_skb = skb_copy(skb, GFP_ATOMIC);
338 + struct sk_buff *new_skb;
339 dma_addr_t new_addr = 0;
340 u32 entry = *start;
341 int i, ret = 0;
342
343 + if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5701)
344 + new_skb = skb_copy(skb, GFP_ATOMIC);
345 + else {
346 + int more_headroom = 4 - ((unsigned long)skb->data & 3);
347 +
348 + new_skb = skb_copy_expand(skb,
349 + skb_headroom(skb) + more_headroom,
350 + skb_tailroom(skb), GFP_ATOMIC);
351 + }
352 +
353 if (!new_skb) {
354 ret = -1;
355 } else {
356 @@ -4462,7 +4472,9 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
357
358 would_hit_hwbug = 0;
359
360 - if (tg3_4g_overflow_test(mapping, len))
361 + if (tp->tg3_flags3 & TG3_FLG3_5701_DMA_BUG)
362 + would_hit_hwbug = 1;
363 + else if (tg3_4g_overflow_test(mapping, len))
364 would_hit_hwbug = 1;
365
366 tg3_set_txd(tp, entry, mapping, len, base_flags,
367 @@ -11339,6 +11351,38 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
368 }
369 }
370
371 + if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) {
372 + static struct tg3_dev_id {
373 + u32 vendor;
374 + u32 device;
375 + } bridge_chipsets[] = {
376 + { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_0 },
377 + { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_1 },
378 + { },
379 + };
380 + struct tg3_dev_id *pci_id = &bridge_chipsets[0];
381 + struct pci_dev *bridge = NULL;
382 +
383 + while (pci_id->vendor != 0) {
384 + bridge = pci_get_device(pci_id->vendor,
385 + pci_id->device,
386 + bridge);
387 + if (!bridge) {
388 + pci_id++;
389 + continue;
390 + }
391 + if (bridge->subordinate &&
392 + (bridge->subordinate->number <=
393 + tp->pdev->bus->number) &&
394 + (bridge->subordinate->subordinate >=
395 + tp->pdev->bus->number)) {
396 + tp->tg3_flags3 |= TG3_FLG3_5701_DMA_BUG;
397 + pci_dev_put(bridge);
398 + break;
399 + }
400 + }
401 + }
402 +
403 /* The EPB bridge inside 5714, 5715, and 5780 cannot support
404 * DMA addresses > 40-bit. This bridge may have other additional
405 * 57xx devices behind it in some 4-port NIC designs for example.
406 diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
407 index c1075a7..c688c3a 100644
408 --- a/drivers/net/tg3.h
409 +++ b/drivers/net/tg3.h
410 @@ -2476,6 +2476,7 @@ struct tg3 {
411 #define TG3_FLG3_NO_NVRAM_ADDR_TRANS 0x00000001
412 #define TG3_FLG3_ENABLE_APE 0x00000002
413 #define TG3_FLG3_5761_5784_AX_FIXES 0x00000004
414 +#define TG3_FLG3_5701_DMA_BUG 0x00000008
415
416 struct timer_list timer;
417 u16 timer_counter;
418 diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
419 index 48e9124..4ec1915 100644
420 --- a/drivers/net/wireless/b43/dma.c
421 +++ b/drivers/net/wireless/b43/dma.c
422 @@ -822,6 +822,18 @@ static u64 supported_dma_mask(struct b43_wldev *dev)
423 return DMA_30BIT_MASK;
424 }
425
426 +static enum b43_dmatype dma_mask_to_engine_type(u64 dmamask)
427 +{
428 + if (dmamask == DMA_30BIT_MASK)
429 + return B43_DMA_30BIT;
430 + if (dmamask == DMA_32BIT_MASK)
431 + return B43_DMA_32BIT;
432 + if (dmamask == DMA_64BIT_MASK)
433 + return B43_DMA_64BIT;
434 + B43_WARN_ON(1);
435 + return B43_DMA_30BIT;
436 +}
437 +
438 /* Main initialization function. */
439 static
440 struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
441 @@ -982,6 +994,42 @@ void b43_dma_free(struct b43_wldev *dev)
442 dma->tx_ring0 = NULL;
443 }
444
445 +static int b43_dma_set_mask(struct b43_wldev *dev, u64 mask)
446 +{
447 + u64 orig_mask = mask;
448 + bool fallback = 0;
449 + int err;
450 +
451 + /* Try to set the DMA mask. If it fails, try falling back to a
452 + * lower mask, as we can always also support a lower one. */
453 + while (1) {
454 + err = ssb_dma_set_mask(dev->dev, mask);
455 + if (!err)
456 + break;
457 + if (mask == DMA_64BIT_MASK) {
458 + mask = DMA_32BIT_MASK;
459 + fallback = 1;
460 + continue;
461 + }
462 + if (mask == DMA_32BIT_MASK) {
463 + mask = DMA_30BIT_MASK;
464 + fallback = 1;
465 + continue;
466 + }
467 + b43err(dev->wl, "The machine/kernel does not support "
468 + "the required %u-bit DMA mask\n",
469 + (unsigned int)dma_mask_to_engine_type(orig_mask));
470 + return -EOPNOTSUPP;
471 + }
472 + if (fallback) {
473 + b43info(dev->wl, "DMA mask fallback from %u-bit to %u-bit\n",
474 + (unsigned int)dma_mask_to_engine_type(orig_mask),
475 + (unsigned int)dma_mask_to_engine_type(mask));
476 + }
477 +
478 + return 0;
479 +}
480 +
481 int b43_dma_init(struct b43_wldev *dev)
482 {
483 struct b43_dma *dma = &dev->dma;
484 @@ -991,27 +1039,10 @@ int b43_dma_init(struct b43_wldev *dev)
485 enum b43_dmatype type;
486
487 dmamask = supported_dma_mask(dev);
488 - switch (dmamask) {
489 - default:
490 - B43_WARN_ON(1);
491 - case DMA_30BIT_MASK:
492 - type = B43_DMA_30BIT;
493 - break;
494 - case DMA_32BIT_MASK:
495 - type = B43_DMA_32BIT;
496 - break;
497 - case DMA_64BIT_MASK:
498 - type = B43_DMA_64BIT;
499 - break;
500 - }
501 - err = ssb_dma_set_mask(dev->dev, dmamask);
502 - if (err) {
503 - b43err(dev->wl, "The machine/kernel does not support "
504 - "the required DMA mask (0x%08X%08X)\n",
505 - (unsigned int)((dmamask & 0xFFFFFFFF00000000ULL) >> 32),
506 - (unsigned int)(dmamask & 0x00000000FFFFFFFFULL));
507 - return -EOPNOTSUPP;
508 - }
509 + type = dma_mask_to_engine_type(dmamask);
510 + err = b43_dma_set_mask(dev, dmamask);
511 + if (err)
512 + return err;
513
514 err = -ENOMEM;
515 /* setup TX DMA channels. */
516 diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
517 index c73a75b..f23317e 100644
518 --- a/drivers/net/wireless/b43/main.c
519 +++ b/drivers/net/wireless/b43/main.c
520 @@ -78,6 +78,11 @@ static int modparam_nohwcrypt;
521 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
522 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
523
524 +static int modparam_btcoex = 1;
525 +module_param_named(btcoex, modparam_btcoex, int, 0444);
526 +MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
527 +
528 +
529 static const struct ssb_device_id b43_ssb_tbl[] = {
530 SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
531 SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
532 @@ -3339,6 +3344,8 @@ static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
533 struct ssb_sprom *sprom = &dev->dev->bus->sprom;
534 u32 hf;
535
536 + if (!modparam_btcoex)
537 + return;
538 if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
539 return;
540 if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
541 @@ -3350,11 +3357,13 @@ static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
542 else
543 hf |= B43_HF_BTCOEX;
544 b43_hf_write(dev, hf);
545 - //TODO
546 }
547
548 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
549 -{ //TODO
550 +{
551 + if (!modparam_btcoex)
552 + return;
553 + //TODO
554 }
555
556 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
557 @@ -4000,8 +4009,16 @@ static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
558 return err;
559 }
560
561 +#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice) ( \
562 + (pdev->vendor == PCI_VENDOR_ID_##_vendor) && \
563 + (pdev->device == _device) && \
564 + (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) && \
565 + (pdev->subsystem_device == _subdevice) )
566 +
567 static void b43_sprom_fixup(struct ssb_bus *bus)
568 {
569 + struct pci_dev *pdev;
570 +
571 /* boardflags workarounds */
572 if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
573 bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
574 @@ -4009,6 +4026,13 @@ static void b43_sprom_fixup(struct ssb_bus *bus)
575 if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
576 bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
577 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
578 + if (bus->bustype == SSB_BUSTYPE_PCI) {
579 + pdev = bus->host_pci;
580 + if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
581 + IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
582 + IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013))
583 + bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
584 + }
585 }
586
587 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
588 diff --git a/drivers/rtc/rtc-pcf8583.c b/drivers/rtc/rtc-pcf8583.c
589 index 8b39970..3d09d8f 100644
590 --- a/drivers/rtc/rtc-pcf8583.c
591 +++ b/drivers/rtc/rtc-pcf8583.c
592 @@ -15,7 +15,7 @@
593 #include <linux/i2c.h>
594 #include <linux/slab.h>
595 #include <linux/string.h>
596 -#include <linux/mc146818rtc.h>
597 +#include <linux/rtc.h>
598 #include <linux/init.h>
599 #include <linux/errno.h>
600 #include <linux/bcd.h>
601 diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
602 index 3c1b433..0e8e092 100644
603 --- a/drivers/scsi/qla2xxx/qla_os.c
604 +++ b/drivers/scsi/qla2xxx/qla_os.c
605 @@ -2357,7 +2357,7 @@ qla2x00_do_dpc(void *data)
606 } else {
607 fcport->login_retry = 0;
608 }
609 - if (fcport->login_retry == 0)
610 + if (fcport->login_retry == 0 && status != QLA_SUCCESS)
611 fcport->loop_id = FC_NO_LOOP_ID;
612 }
613 if (test_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags))
614 diff --git a/drivers/serial/dz.c b/drivers/serial/dz.c
615 index 116211f..0dddd68 100644
616 --- a/drivers/serial/dz.c
617 +++ b/drivers/serial/dz.c
618 @@ -819,7 +819,7 @@ static void dz_console_putchar(struct uart_port *uport, int ch)
619 dz_out(dport, DZ_TCR, mask);
620 iob();
621 udelay(2);
622 - } while (loops--);
623 + } while (--loops);
624
625 if (loops) /* Cannot send otherwise. */
626 dz_out(dport, DZ_TDR, ch);
627 diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
628 index b434df7..274a448 100644
629 --- a/drivers/ssb/pci.c
630 +++ b/drivers/ssb/pci.c
631 @@ -482,6 +482,11 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
632 goto unsupported;
633 }
634
635 + if (out->boardflags_lo == 0xFFFF)
636 + out->boardflags_lo = 0; /* per specs */
637 + if (out->boardflags_hi == 0xFFFF)
638 + out->boardflags_hi = 0; /* per specs */
639 +
640 return 0;
641 unsupported:
642 ssb_printk(KERN_WARNING PFX "Unsupported SPROM revision %d "
643 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
644 index 68fc521..7f1bc97 100644
645 --- a/drivers/usb/core/hub.c
646 +++ b/drivers/usb/core/hub.c
647 @@ -2664,6 +2664,7 @@ loop:
648 if ((status == -ENOTCONN) || (status == -ENOTSUPP))
649 break;
650 }
651 + dev_err(hub_dev, "unable to enumerate USB device on port %d\n", port1);
652
653 done:
654 hub_port_disable(hub, port1, 1);
655 diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
656 index d0360f6..b0e2275 100644
657 --- a/drivers/usb/host/ohci-pci.c
658 +++ b/drivers/usb/host/ohci-pci.c
659 @@ -312,11 +312,13 @@ static int ohci_pci_suspend (struct usb_hcd *hcd, pm_message_t message)
660
661 static int ohci_pci_resume (struct usb_hcd *hcd)
662 {
663 + struct ohci_hcd *ohci = hcd_to_ohci(hcd);
664 +
665 set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
666
667 /* FIXME: we should try to detect loss of VBUS power here */
668 prepare_for_handover(hcd);
669 -
670 + ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrenable);
671 return 0;
672 }
673
674 diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
675 index ed67881..7b02a4a 100644
676 --- a/drivers/usb/serial/sierra.c
677 +++ b/drivers/usb/serial/sierra.c
678 @@ -164,6 +164,7 @@ static struct usb_device_id id_table [] = {
679 { USB_DEVICE(0x1199, 0x6812) }, /* Sierra Wireless MC8775 & AC 875U */
680 { USB_DEVICE(0x1199, 0x6813) }, /* Sierra Wireless MC8775 (Thinkpad internal) */
681 { USB_DEVICE(0x1199, 0x6815) }, /* Sierra Wireless MC8775 */
682 + { USB_DEVICE(0x03f0, 0x1e1d) }, /* HP hs2300 a.k.a MC8775 */
683 { USB_DEVICE(0x1199, 0x6820) }, /* Sierra Wireless AirCard 875 */
684 { USB_DEVICE(0x1199, 0x6832) }, /* Sierra Wireless MC8780*/
685 { USB_DEVICE(0x1199, 0x6833) }, /* Sierra Wireless MC8781*/
686 diff --git a/fs/aio.c b/fs/aio.c
687 index 2283686..ae94e1d 100644
688 --- a/fs/aio.c
689 +++ b/fs/aio.c
690 @@ -1166,7 +1166,10 @@ retry:
691 break;
692 if (min_nr <= i)
693 break;
694 - ret = 0;
695 + if (unlikely(ctx->dead)) {
696 + ret = -EINVAL;
697 + break;
698 + }
699 if (to.timed_out) /* Only check after read evt */
700 break;
701 /* Try to only show up in io wait if there are ops
702 @@ -1231,6 +1234,13 @@ static void io_destroy(struct kioctx *ioctx)
703
704 aio_cancel_all(ioctx);
705 wait_for_all_aios(ioctx);
706 +
707 + /*
708 + * Wake up any waiters. The setting of ctx->dead must be seen
709 + * by other CPUs at this point. Right now, we rely on the
710 + * locking done by the above calls to ensure this consistency.
711 + */
712 + wake_up(&ioctx->wait);
713 put_ioctx(ioctx); /* once for the lookup */
714 }
715
716 diff --git a/fs/dnotify.c b/fs/dnotify.c
717 index 28d01ed..eaecc4c 100644
718 --- a/fs/dnotify.c
719 +++ b/fs/dnotify.c
720 @@ -20,6 +20,7 @@
721 #include <linux/init.h>
722 #include <linux/spinlock.h>
723 #include <linux/slab.h>
724 +#include <linux/file.h>
725
726 int dir_notify_enable __read_mostly = 1;
727
728 @@ -66,6 +67,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
729 struct dnotify_struct **prev;
730 struct inode *inode;
731 fl_owner_t id = current->files;
732 + struct file *f;
733 int error = 0;
734
735 if ((arg & ~DN_MULTISHOT) == 0) {
736 @@ -92,6 +94,15 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
737 prev = &odn->dn_next;
738 }
739
740 + rcu_read_lock();
741 + f = fcheck(fd);
742 + rcu_read_unlock();
743 + /* we'd lost the race with close(), sod off silently */
744 + /* note that inode->i_lock prevents reordering problems
745 + * between accesses to descriptor table and ->i_dnotify */
746 + if (f != filp)
747 + goto out_free;
748 +
749 error = __f_setown(filp, task_pid(current), PIDTYPE_PID, 0);
750 if (error)
751 goto out_free;
752 diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
753 index a1db918..4c895f3 100644
754 --- a/fs/jffs2/erase.c
755 +++ b/fs/jffs2/erase.c
756 @@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
757 if (jffs2_write_nand_cleanmarker(c, jeb))
758 goto filebad;
759 }
760 -
761 - /* Everything else got zeroed before the erase */
762 - jeb->free_size = c->sector_size;
763 } else {
764
765 struct kvec vecs[1];
766 @@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
767
768 goto filebad;
769 }
770 -
771 - /* Everything else got zeroed before the erase */
772 - jeb->free_size = c->sector_size;
773 - /* FIXME Special case for cleanmarker in empty block */
774 - jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
775 }
776 + /* Everything else got zeroed before the erase */
777 + jeb->free_size = c->sector_size;
778
779 down(&c->erase_free_sem);
780 spin_lock(&c->erase_completion_lock);
781 +
782 c->erasing_size -= c->sector_size;
783 - c->free_size += jeb->free_size;
784 - c->used_size += jeb->used_size;
785 + c->free_size += c->sector_size;
786 +
787 + /* Account for cleanmarker now, if it's in-band */
788 + if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c))
789 + jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
790
791 jffs2_dbg_acct_sanity_check_nolock(c,jeb);
792 jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
793 diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
794 index b9e1740..44c81c7 100644
795 --- a/include/linux/rtnetlink.h
796 +++ b/include/linux/rtnetlink.h
797 @@ -740,13 +740,13 @@ extern void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change);
798 extern void rtnl_lock(void);
799 extern void rtnl_unlock(void);
800 extern int rtnl_trylock(void);
801 +extern int rtnl_is_locked(void);
802
803 extern void rtnetlink_init(void);
804 extern void __rtnl_unlock(void);
805
806 #define ASSERT_RTNL() do { \
807 - if (unlikely(rtnl_trylock())) { \
808 - rtnl_unlock(); \
809 + if (unlikely(!rtnl_is_locked())) { \
810 printk(KERN_ERR "RTNL: assertion failed at %s (%d)\n", \
811 __FILE__, __LINE__); \
812 dump_stack(); \
813 diff --git a/include/net/tcp.h b/include/net/tcp.h
814 index 4fd3eb2..d69d12e 100644
815 --- a/include/net/tcp.h
816 +++ b/include/net/tcp.h
817 @@ -776,11 +776,14 @@ extern void tcp_enter_cwr(struct sock *sk, const int set_ssthresh);
818 extern __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst);
819
820 /* Slow start with delack produces 3 packets of burst, so that
821 - * it is safe "de facto".
822 + * it is safe "de facto". This will be the default - same as
823 + * the default reordering threshold - but if reordering increases,
824 + * we must be able to allow cwnd to burst at least this much in order
825 + * to not pull it back when holes are filled.
826 */
827 static __inline__ __u32 tcp_max_burst(const struct tcp_sock *tp)
828 {
829 - return 3;
830 + return tp->reordering;
831 }
832
833 /* Returns end sequence number of the receiver's advertised window */
834 diff --git a/include/net/xfrm.h b/include/net/xfrm.h
835 index 0d255ae..97577de 100644
836 --- a/include/net/xfrm.h
837 +++ b/include/net/xfrm.h
838 @@ -435,6 +435,9 @@ struct xfrm_tmpl
839 /* May skip this transfomration if no SA is found */
840 __u8 optional;
841
842 +/* Skip aalgos/ealgos/calgos checks. */
843 + __u8 allalgs;
844 +
845 /* Bit mask of algos allowed for acquisition */
846 __u32 aalgos;
847 __u32 ealgos;
848 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
849 index 2727f92..6d8de05 100644
850 --- a/kernel/cgroup.c
851 +++ b/kernel/cgroup.c
852 @@ -1722,7 +1722,12 @@ void cgroup_enable_task_cg_lists(void)
853 use_task_css_set_links = 1;
854 do_each_thread(g, p) {
855 task_lock(p);
856 - if (list_empty(&p->cg_list))
857 + /*
858 + * We should check if the process is exiting, otherwise
859 + * it will race with cgroup_exit() in that the list
860 + * entry won't be deleted though the process has exited.
861 + */
862 + if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list))
863 list_add(&p->cg_list, &p->cgroups->tasks);
864 task_unlock(p);
865 } while_each_thread(g, p);
866 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
867 index 98bee01..c15a359 100644
868 --- a/kernel/hrtimer.c
869 +++ b/kernel/hrtimer.c
870 @@ -590,7 +590,6 @@ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
871 list_add_tail(&timer->cb_entry,
872 &base->cpu_base->cb_pending);
873 timer->state = HRTIMER_STATE_PENDING;
874 - raise_softirq(HRTIMER_SOFTIRQ);
875 return 1;
876 default:
877 BUG();
878 @@ -633,6 +632,11 @@ static int hrtimer_switch_to_hres(void)
879 return 1;
880 }
881
882 +static inline void hrtimer_raise_softirq(void)
883 +{
884 + raise_softirq(HRTIMER_SOFTIRQ);
885 +}
886 +
887 #else
888
889 static inline int hrtimer_hres_active(void) { return 0; }
890 @@ -651,6 +655,7 @@ static inline int hrtimer_reprogram(struct hrtimer *timer,
891 {
892 return 0;
893 }
894 +static inline void hrtimer_raise_softirq(void) { }
895
896 #endif /* CONFIG_HIGH_RES_TIMERS */
897
898 @@ -850,7 +855,7 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
899 {
900 struct hrtimer_clock_base *base, *new_base;
901 unsigned long flags;
902 - int ret;
903 + int ret, raise;
904
905 base = lock_hrtimer_base(timer, &flags);
906
907 @@ -884,8 +889,18 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
908 enqueue_hrtimer(timer, new_base,
909 new_base->cpu_base == &__get_cpu_var(hrtimer_bases));
910
911 + /*
912 + * The timer may be expired and moved to the cb_pending
913 + * list. We can not raise the softirq with base lock held due
914 + * to a possible deadlock with runqueue lock.
915 + */
916 + raise = timer->state == HRTIMER_STATE_PENDING;
917 +
918 unlock_hrtimer_base(timer, &flags);
919
920 + if (raise)
921 + hrtimer_raise_softirq();
922 +
923 return ret;
924 }
925 EXPORT_SYMBOL_GPL(hrtimer_start);
926 @@ -1080,8 +1095,19 @@ static void run_hrtimer_pending(struct hrtimer_cpu_base *cpu_base)
927 * If the timer was rearmed on another CPU, reprogram
928 * the event device.
929 */
930 - if (timer->base->first == &timer->node)
931 - hrtimer_reprogram(timer, timer->base);
932 + struct hrtimer_clock_base *base = timer->base;
933 +
934 + if (base->first == &timer->node &&
935 + hrtimer_reprogram(timer, base)) {
936 + /*
937 + * Timer is expired. Thus move it from tree to
938 + * pending list again.
939 + */
940 + __remove_hrtimer(timer, base,
941 + HRTIMER_STATE_PENDING, 0);
942 + list_add_tail(&timer->cb_entry,
943 + &base->cpu_base->cb_pending);
944 + }
945 }
946 }
947 spin_unlock_irq(&cpu_base->lock);
948 diff --git a/mm/pagewalk.c b/mm/pagewalk.c
949 index 1cf1417..0afd238 100644
950 --- a/mm/pagewalk.c
951 +++ b/mm/pagewalk.c
952 @@ -9,11 +9,15 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
953 int err = 0;
954
955 pte = pte_offset_map(pmd, addr);
956 - do {
957 + for (;;) {
958 err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, private);
959 if (err)
960 break;
961 - } while (pte++, addr += PAGE_SIZE, addr != end);
962 + addr += PAGE_SIZE;
963 + if (addr == end)
964 + break;
965 + pte++;
966 + }
967
968 pte_unmap(pte);
969 return err;
970 diff --git a/net/can/raw.c b/net/can/raw.c
971 index 94cd7f2..c92cb8e 100644
972 --- a/net/can/raw.c
973 +++ b/net/can/raw.c
974 @@ -573,7 +573,8 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
975 int fsize = ro->count * sizeof(struct can_filter);
976 if (len > fsize)
977 len = fsize;
978 - err = copy_to_user(optval, ro->filter, len);
979 + if (copy_to_user(optval, ro->filter, len))
980 + err = -EFAULT;
981 } else
982 len = 0;
983 release_sock(sk);
984 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
985 index 2bd9c5f..0cb2772 100644
986 --- a/net/core/rtnetlink.c
987 +++ b/net/core/rtnetlink.c
988 @@ -82,6 +82,11 @@ int rtnl_trylock(void)
989 return mutex_trylock(&rtnl_mutex);
990 }
991
992 +int rtnl_is_locked(void)
993 +{
994 + return mutex_is_locked(&rtnl_mutex);
995 +}
996 +
997 static struct rtnl_link *rtnl_msg_handlers[NPROTO];
998
999 static inline int rtm_msgindex(int msgtype)
1000 @@ -1389,6 +1394,7 @@ EXPORT_SYMBOL(rtnetlink_put_metrics);
1001 EXPORT_SYMBOL(rtnl_lock);
1002 EXPORT_SYMBOL(rtnl_trylock);
1003 EXPORT_SYMBOL(rtnl_unlock);
1004 +EXPORT_SYMBOL(rtnl_is_locked);
1005 EXPORT_SYMBOL(rtnl_unicast);
1006 EXPORT_SYMBOL(rtnl_notify);
1007 EXPORT_SYMBOL(rtnl_set_sk_err);
1008 diff --git a/net/dccp/probe.c b/net/dccp/probe.c
1009 index 7053bb8..44eddcf 100644
1010 --- a/net/dccp/probe.c
1011 +++ b/net/dccp/probe.c
1012 @@ -145,7 +145,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf,
1013 goto out_free;
1014
1015 cnt = kfifo_get(dccpw.fifo, tbuf, len);
1016 - error = copy_to_user(buf, tbuf, cnt);
1017 + error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0;
1018
1019 out_free:
1020 vfree(tbuf);
1021 diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
1022 index 87dd5bf..a79a547 100644
1023 --- a/net/ipv4/tcp_probe.c
1024 +++ b/net/ipv4/tcp_probe.c
1025 @@ -190,19 +190,18 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
1026
1027 width = tcpprobe_sprint(tbuf, sizeof(tbuf));
1028
1029 - if (width < len)
1030 + if (cnt + width < len)
1031 tcp_probe.tail = (tcp_probe.tail + 1) % bufsize;
1032
1033 spin_unlock_bh(&tcp_probe.lock);
1034
1035 /* if record greater than space available
1036 return partial buffer (so far) */
1037 - if (width >= len)
1038 + if (cnt + width >= len)
1039 break;
1040
1041 - error = copy_to_user(buf + cnt, tbuf, width);
1042 - if (error)
1043 - break;
1044 + if (copy_to_user(buf + cnt, tbuf, width))
1045 + return -EFAULT;
1046 cnt += width;
1047 }
1048
1049 diff --git a/net/key/af_key.c b/net/key/af_key.c
1050 index e9ef9af..5ceab25 100644
1051 --- a/net/key/af_key.c
1052 +++ b/net/key/af_key.c
1053 @@ -1856,7 +1856,7 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
1054 t->encap_family = xp->family;
1055
1056 /* No way to set this via kame pfkey */
1057 - t->aalgos = t->ealgos = t->calgos = ~0;
1058 + t->allalgs = 1;
1059 xp->xfrm_nr++;
1060 return 0;
1061 }
1062 diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
1063 index 063cbc5..f9293c7 100644
1064 --- a/net/rose/af_rose.c
1065 +++ b/net/rose/af_rose.c
1066 @@ -760,8 +760,10 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
1067
1068 rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause,
1069 &diagnostic);
1070 - if (!rose->neighbour)
1071 - return -ENETUNREACH;
1072 + if (!rose->neighbour) {
1073 + err = -ENETUNREACH;
1074 + goto out_release;
1075 + }
1076
1077 rose->lci = rose_new_lci(rose->neighbour);
1078 if (!rose->lci) {
1079 diff --git a/net/tipc/socket.c b/net/tipc/socket.c
1080 index 2290903..ac04733 100644
1081 --- a/net/tipc/socket.c
1082 +++ b/net/tipc/socket.c
1083 @@ -1600,8 +1600,8 @@ static int getsockopt(struct socket *sock,
1084 else if (len < sizeof(value)) {
1085 res = -EINVAL;
1086 }
1087 - else if ((res = copy_to_user(ov, &value, sizeof(value)))) {
1088 - /* couldn't return value */
1089 + else if (copy_to_user(ov, &value, sizeof(value))) {
1090 + res = -EFAULT;
1091 }
1092 else {
1093 res = put_user(sizeof(value), ol);
1094 diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
1095 index 9fc4c31..c44076c 100644
1096 --- a/net/xfrm/xfrm_policy.c
1097 +++ b/net/xfrm/xfrm_policy.c
1098 @@ -1772,7 +1772,7 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x,
1099 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
1100 (x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
1101 x->props.mode == tmpl->mode &&
1102 - ((tmpl->aalgos & (1<<x->props.aalgo)) ||
1103 + (tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) ||
1104 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
1105 !(x->props.mode != XFRM_MODE_TRANSPORT &&
1106 xfrm_state_addr_cmp(tmpl, x, family));
1107 diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
1108 index 019d21d..12f19be 100644
1109 --- a/net/xfrm/xfrm_user.c
1110 +++ b/net/xfrm/xfrm_user.c
1111 @@ -975,6 +975,8 @@ static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
1112 t->aalgos = ut->aalgos;
1113 t->ealgos = ut->ealgos;
1114 t->calgos = ut->calgos;
1115 + /* If all masks are ~0, then we allow all algorithms. */
1116 + t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
1117 t->encap_family = ut->family;
1118 }
1119 }
1120 diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
1121 index d39b59c..f4fa982 100644
1122 --- a/security/selinux/hooks.c
1123 +++ b/security/selinux/hooks.c
1124 @@ -756,9 +756,18 @@ static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
1125 int set_context = (oldsbsec->flags & CONTEXT_MNT);
1126 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1127
1128 - /* we can't error, we can't save the info, this shouldn't get called
1129 - * this early in the boot process. */
1130 - BUG_ON(!ss_initialized);
1131 + /*
1132 + * if the parent was able to be mounted it clearly had no special lsm
1133 + * mount options. thus we can safely put this sb on the list and deal
1134 + * with it later
1135 + */
1136 + if (!ss_initialized) {
1137 + spin_lock(&sb_security_lock);
1138 + if (list_empty(&newsbsec->list))
1139 + list_add(&newsbsec->list, &superblock_security_head);
1140 + spin_unlock(&sb_security_lock);
1141 + return;
1142 + }
1143
1144 /* how can we clone if the old one wasn't set up?? */
1145 BUG_ON(!oldsbsec->initialized);

  ViewVC Help
Powered by ViewVC 1.1.20