diff options
| -rw-r--r-- | 2.6.32/0000_README | 4 | ||||
| -rw-r--r-- | 2.6.32/1043_linux-2.6.32.44.patch | 1455 |
2 files changed, 1459 insertions, 0 deletions
diff --git a/2.6.32/0000_README b/2.6.32/0000_README index 97013da..5e4d4d1 100644 --- a/2.6.32/0000_README +++ b/2.6.32/0000_README @@ -3,6 +3,10 @@ README Individual Patch Descriptions: ----------------------------------------------------------------------------- +Patch: 1043_linux-2.6.32.44.patch +From: http://www.kernel.org +Desc: Linux 2.6.39.44 + Patch: 4420_grsecurity-2.2.2-2.6.32.44-201108111959.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/2.6.32/1043_linux-2.6.32.44.patch b/2.6.32/1043_linux-2.6.32.44.patch new file mode 100644 index 0000000..c71b835 --- /dev/null +++ b/2.6.32/1043_linux-2.6.32.44.patch @@ -0,0 +1,1455 @@ +diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c +index 62619f2..a94e49c 100644 +--- a/arch/alpha/kernel/osf_sys.c ++++ b/arch/alpha/kernel/osf_sys.c +@@ -431,7 +431,7 @@ SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen) + return -EFAULT; + + len = namelen; +- if (namelen > 32) ++ if (len > 32) + len = 32; + + down_read(&uts_sem); +@@ -618,7 +618,7 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count) + down_read(&uts_sem); + res = sysinfo_table[offset]; + len = strlen(res)+1; +- if (len > count) ++ if ((unsigned long)len > (unsigned long)count) + len = count; + if (copy_to_user(buf, res, len)) + err = -EFAULT; +@@ -673,7 +673,7 @@ SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer, + return 1; + + case GSI_GET_HWRPB: +- if (nbytes < sizeof(*hwrpb)) ++ if (nbytes > sizeof(*hwrpb)) + return -EINVAL; + if (copy_to_user(buffer, hwrpb, nbytes) != 0) + return -EFAULT; +@@ -1035,6 +1035,7 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options, + { + struct rusage r; + long ret, err; ++ unsigned int status = 0; + mm_segment_t old_fs; + + if (!ur) +@@ -1043,13 +1044,15 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options, + old_fs = get_fs(); + + set_fs (KERNEL_DS); +- ret = sys_wait4(pid, ustatus, options, (struct rusage __user *) &r); ++ ret = sys_wait4(pid, (unsigned int __user *) &status, options, ++ (struct rusage __user *) &r); + set_fs (old_fs); + + if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur))) + return -EFAULT; + + err = 0; ++ err |= put_user(status, ustatus); + err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec); + err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec); + err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec); +diff --git a/arch/arm/mach-davinci/board-dm365-evm.c b/arch/arm/mach-davinci/board-dm365-evm.c +index 52dd804..8904495 100644 +--- a/arch/arm/mach-davinci/board-dm365-evm.c ++++ b/arch/arm/mach-davinci/board-dm365-evm.c +@@ -413,7 +413,7 @@ fail: + */ + if (have_imager()) { + label = "HD imager"; +- mux |= 1; ++ mux |= 2; + + /* externally mux MMC1/ENET/AIC33 to imager */ + mux |= BIT(6) | BIT(5) | BIT(3); +@@ -434,7 +434,7 @@ fail: + resets &= ~BIT(1); + + if (have_tvp7002()) { +- mux |= 2; ++ mux |= 1; + resets &= ~BIT(2); + label = "tvp7002 HD"; + } else { +diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c +index 102916f..b6bfe7e 100644 +--- a/arch/arm/mach-pxa/cm-x300.c ++++ b/arch/arm/mach-pxa/cm-x300.c +@@ -143,10 +143,10 @@ static mfp_cfg_t cm_x300_mfp_cfg[] __initdata = { + GPIO99_GPIO, /* Ethernet IRQ */ + + /* RTC GPIOs */ +- GPIO95_GPIO, /* RTC CS */ +- GPIO96_GPIO, /* RTC WR */ +- GPIO97_GPIO, /* RTC RD */ +- GPIO98_GPIO, /* RTC IO */ ++ GPIO95_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC CS */ ++ GPIO96_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC WR */ ++ GPIO97_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC RD */ ++ GPIO98_GPIO, /* RTC IO */ + + /* Standard I2C */ + GPIO21_I2C_SCL, +diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c +index 5009198..d374974 100644 +--- a/arch/powerpc/kernel/crash.c ++++ b/arch/powerpc/kernel/crash.c +@@ -176,12 +176,8 @@ static void crash_kexec_wait_realmode(int cpu) + + while (paca[i].kexec_state < KEXEC_STATE_REAL_MODE) { + barrier(); +- if (!cpu_possible(i)) { ++ if (!cpu_possible(i) || !cpu_online(i) || (msecs <= 0)) + break; +- } +- if (!cpu_online(i)) { +- break; +- } + msecs--; + mdelay(1); + } +diff --git a/arch/powerpc/platforms/pseries/hvconsole.c b/arch/powerpc/platforms/pseries/hvconsole.c +index 3f6a89b..041e87c 100644 +--- a/arch/powerpc/platforms/pseries/hvconsole.c ++++ b/arch/powerpc/platforms/pseries/hvconsole.c +@@ -73,7 +73,7 @@ int hvc_put_chars(uint32_t vtermno, const char *buf, int count) + if (ret == H_SUCCESS) + return count; + if (ret == H_BUSY) +- return 0; ++ return -EAGAIN; + return -EIO; + } + +diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c +index 69cab24..987ef29 100644 +--- a/arch/x86/kernel/hpet.c ++++ b/arch/x86/kernel/hpet.c +@@ -27,6 +27,9 @@ + #define HPET_DEV_FSB_CAP 0x1000 + #define HPET_DEV_PERI_CAP 0x2000 + ++#define HPET_MIN_CYCLES 128 ++#define HPET_MIN_PROG_DELTA (HPET_MIN_CYCLES + (HPET_MIN_CYCLES >> 1)) ++ + #define EVT_TO_HPET_DEV(evt) container_of(evt, struct hpet_dev, evt) + + /* +@@ -298,8 +301,9 @@ static void hpet_legacy_clockevent_register(void) + /* Calculate the min / max delta */ + hpet_clockevent.max_delta_ns = clockevent_delta2ns(0x7FFFFFFF, + &hpet_clockevent); +- /* 5 usec minimum reprogramming delta. */ +- hpet_clockevent.min_delta_ns = 5000; ++ /* Setup minimum reprogramming delta. */ ++ hpet_clockevent.min_delta_ns = clockevent_delta2ns(HPET_MIN_PROG_DELTA, ++ &hpet_clockevent); + + /* + * Start hpet with the boot cpu mask and make it +@@ -379,36 +383,37 @@ static int hpet_next_event(unsigned long delta, + struct clock_event_device *evt, int timer) + { + u32 cnt; ++ s32 res; + + cnt = hpet_readl(HPET_COUNTER); + cnt += (u32) delta; + hpet_writel(cnt, HPET_Tn_CMP(timer)); + + /* +- * We need to read back the CMP register on certain HPET +- * implementations (ATI chipsets) which seem to delay the +- * transfer of the compare register into the internal compare +- * logic. With small deltas this might actually be too late as +- * the counter could already be higher than the compare value +- * at that point and we would wait for the next hpet interrupt +- * forever. We found out that reading the CMP register back +- * forces the transfer so we can rely on the comparison with +- * the counter register below. If the read back from the +- * compare register does not match the value we programmed +- * then we might have a real hardware problem. We can not do +- * much about it here, but at least alert the user/admin with +- * a prominent warning. +- * An erratum on some chipsets (ICH9,..), results in comparator read +- * immediately following a write returning old value. Workaround +- * for this is to read this value second time, when first +- * read returns old value. ++ * HPETs are a complete disaster. The compare register is ++ * based on a equal comparison and neither provides a less ++ * than or equal functionality (which would require to take ++ * the wraparound into account) nor a simple count down event ++ * mode. Further the write to the comparator register is ++ * delayed internally up to two HPET clock cycles in certain ++ * chipsets (ATI, ICH9,10). Some newer AMD chipsets have even ++ * longer delays. We worked around that by reading back the ++ * compare register, but that required another workaround for ++ * ICH9,10 chips where the first readout after write can ++ * return the old stale value. We already had a minimum ++ * programming delta of 5us enforced, but a NMI or SMI hitting ++ * between the counter readout and the comparator write can ++ * move us behind that point easily. Now instead of reading ++ * the compare register back several times, we make the ETIME ++ * decision based on the following: Return ETIME if the ++ * counter value after the write is less than HPET_MIN_CYCLES ++ * away from the event or if the counter is already ahead of ++ * the event. The minimum programming delta for the generic ++ * clockevents code is set to 1.5 * HPET_MIN_CYCLES. + */ +- if (unlikely((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt)) { +- WARN_ONCE((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt, +- KERN_WARNING "hpet: compare register read back failed.\n"); +- } ++ res = (s32)(cnt - (u32)hpet_readl(HPET_COUNTER)); + +- return (s32)((u32)hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0; ++ return res < HPET_MIN_CYCLES ? -ETIME : 0; + } + + static void hpet_legacy_set_mode(enum clock_event_mode mode, +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index 200fcde..cf98100 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -469,6 +469,14 @@ static struct dmi_system_id __initdata pci_reboot_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"), + }, + }, ++ { /* Handle problems with rebooting on the Latitude E5420. */ ++ .callback = set_pci_reboot, ++ .ident = "Dell Latitude E5420", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E5420"), ++ }, ++ }, + { } + }; + +diff --git a/arch/x86/kernel/relocate_kernel_32.S b/arch/x86/kernel/relocate_kernel_32.S +index 4123553..36818f8 100644 +--- a/arch/x86/kernel/relocate_kernel_32.S ++++ b/arch/x86/kernel/relocate_kernel_32.S +@@ -97,6 +97,8 @@ relocate_kernel: + ret + + identity_mapped: ++ /* set return address to 0 if not preserving context */ ++ pushl $0 + /* store the start address on the stack */ + pushl %edx + +diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S +index 4de8f5b..7a6f3b3 100644 +--- a/arch/x86/kernel/relocate_kernel_64.S ++++ b/arch/x86/kernel/relocate_kernel_64.S +@@ -100,6 +100,8 @@ relocate_kernel: + ret + + identity_mapped: ++ /* set return address to 0 if not preserving context */ ++ pushq $0 + /* store the start address on the stack */ + pushq %rdx + +diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c +index 9486882..885ebe7 100644 +--- a/arch/xtensa/kernel/ptrace.c ++++ b/arch/xtensa/kernel/ptrace.c +@@ -136,6 +136,9 @@ int ptrace_setxregs(struct task_struct *child, void __user *uregs) + elf_xtregs_t *xtregs = uregs; + int ret = 0; + ++ if (!access_ok(VERIFY_READ, uregs, sizeof(elf_xtregs_t))) ++ return -EFAULT; ++ + #if XTENSA_HAVE_COPROCESSORS + /* Flush all coprocessors before we overwrite them. */ + coprocessor_flush_all(ti); +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index fa9bed0..e5bdb9b 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -2707,10 +2707,11 @@ int ata_eh_reset(struct ata_link *link, int classify, + } + + /* +- * Some controllers can't be frozen very well and may set +- * spuruious error conditions during reset. Clear accumulated +- * error information. As reset is the final recovery action, +- * nothing is lost by doing this. ++ * Some controllers can't be frozen very well and may set spurious ++ * error conditions during reset. Clear accumulated error ++ * information and re-thaw the port if frozen. As reset is the ++ * final recovery action and we cross check link onlineness against ++ * device classification later, no hotplug event is lost by this. + */ + spin_lock_irqsave(link->ap->lock, flags); + memset(&link->eh_info, 0, sizeof(link->eh_info)); +@@ -2719,6 +2720,9 @@ int ata_eh_reset(struct ata_link *link, int classify, + ap->pflags &= ~ATA_PFLAG_EH_PENDING; + spin_unlock_irqrestore(link->ap->lock, flags); + ++ if (ap->pflags & ATA_PFLAG_FROZEN) ++ ata_eh_thaw_port(ap); ++ + /* + * Make sure onlineness and classification result correspond. + * Hotplug could have happened during reset and some +diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h +index 5ae1b1c..04d6bf8 100644 +--- a/drivers/block/cciss.h ++++ b/drivers/block/cciss.h +@@ -165,7 +165,7 @@ static void SA5_submit_command( ctlr_info_t *h, CommandList_struct *c) + printk("Sending %x - down to controller\n", c->busaddr ); + #endif /* CCISS_DEBUG */ + writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET); +- readl(h->vaddr + SA5_REQUEST_PORT_OFFSET); ++ readl(h->vaddr + SA5_SCRATCHPAD_OFFSET); + h->commands_outstanding++; + if ( h->commands_outstanding > h->max_outstanding) + h->max_outstanding = h->commands_outstanding; +diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c +index 9ac4972..5b6001b 100644 +--- a/drivers/hwmon/max1111.c ++++ b/drivers/hwmon/max1111.c +@@ -39,6 +39,8 @@ struct max1111_data { + struct spi_transfer xfer[2]; + uint8_t *tx_buf; + uint8_t *rx_buf; ++ struct mutex drvdata_lock; ++ /* protect msg, xfer and buffers from multiple access */ + }; + + static int max1111_read(struct device *dev, int channel) +@@ -47,6 +49,9 @@ static int max1111_read(struct device *dev, int channel) + uint8_t v1, v2; + int err; + ++ /* writing to drvdata struct is not thread safe, wait on mutex */ ++ mutex_lock(&data->drvdata_lock); ++ + data->tx_buf[0] = (channel << MAX1111_CTRL_SEL_SH) | + MAX1111_CTRL_PD0 | MAX1111_CTRL_PD1 | + MAX1111_CTRL_SGL | MAX1111_CTRL_UNI | MAX1111_CTRL_STR; +@@ -54,12 +59,15 @@ static int max1111_read(struct device *dev, int channel) + err = spi_sync(data->spi, &data->msg); + if (err < 0) { + dev_err(dev, "spi_sync failed with %d\n", err); ++ mutex_unlock(&data->drvdata_lock); + return err; + } + + v1 = data->rx_buf[0]; + v2 = data->rx_buf[1]; + ++ mutex_unlock(&data->drvdata_lock); ++ + if ((v1 & 0xc0) || (v2 & 0x3f)) + return -EINVAL; + +@@ -175,6 +183,8 @@ static int __devinit max1111_probe(struct spi_device *spi) + if (err) + goto err_free_data; + ++ mutex_init(&data->drvdata_lock); ++ + data->spi = spi; + spi_set_drvdata(spi, data); + +@@ -212,6 +222,7 @@ static int __devexit max1111_remove(struct spi_device *spi) + + hwmon_device_unregister(data->hwmon_dev); + sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group); ++ mutex_destroy(&data->drvdata_lock); + kfree(data->rx_buf); + kfree(data->tx_buf); + kfree(data); +diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c +index fcf717c..b03cd39 100644 +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -778,6 +778,11 @@ static int parse_features(struct arg_set *as, struct multipath *m) + if (!argc) + return 0; + ++ if (argc > as->argc) { ++ ti->error = "not enough arguments for features"; ++ return -EINVAL; ++ } ++ + do { + param_name = shift(as); + argc--; +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index d186687..c988ac2 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -36,6 +36,8 @@ static const char *_name = DM_NAME; + static unsigned int major = 0; + static unsigned int _major = 0; + ++static DEFINE_IDR(_minor_idr); ++ + static DEFINE_SPINLOCK(_minor_lock); + /* + * For bio-based dm. +@@ -315,6 +317,12 @@ static void __exit dm_exit(void) + + while (i--) + _exits[i](); ++ ++ /* ++ * Should be empty by this point. ++ */ ++ idr_remove_all(&_minor_idr); ++ idr_destroy(&_minor_idr); + } + + /* +@@ -1663,8 +1671,6 @@ static int dm_any_congested(void *congested_data, int bdi_bits) + /*----------------------------------------------------------------- + * An IDR is used to keep track of allocated minor numbers. + *---------------------------------------------------------------*/ +-static DEFINE_IDR(_minor_idr); +- + static void free_minor(int minor) + { + spin_lock(&_minor_lock); +diff --git a/drivers/media/radio/si4713-i2c.c b/drivers/media/radio/si4713-i2c.c +index 6a0028e..93653c6 100644 +--- a/drivers/media/radio/si4713-i2c.c ++++ b/drivers/media/radio/si4713-i2c.c +@@ -1003,7 +1003,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev, + char ps_name[MAX_RDS_PS_NAME + 1]; + + len = control->size - 1; +- if (len > MAX_RDS_PS_NAME) { ++ if (len < 0 || len > MAX_RDS_PS_NAME) { + rval = -ERANGE; + goto exit; + } +@@ -1025,7 +1025,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev, + char radio_text[MAX_RDS_RADIO_TEXT + 1]; + + len = control->size - 1; +- if (len > MAX_RDS_RADIO_TEXT) { ++ if (len < 0 || len > MAX_RDS_RADIO_TEXT) { + rval = -ERANGE; + goto exit; + } +diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c +index d258ed7..f0e9c75 100644 +--- a/drivers/media/video/bt8xx/bttv-driver.c ++++ b/drivers/media/video/bt8xx/bttv-driver.c +@@ -3532,7 +3532,7 @@ static int radio_s_tuner(struct file *file, void *priv, + if (0 != t->index) + return -EINVAL; + +- bttv_call_all(btv, tuner, g_tuner, t); ++ bttv_call_all(btv, tuner, s_tuner, t); + return 0; + } + +diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.c b/drivers/media/video/pvrusb2/pvrusb2-hdw.c +index 13639b3..5891e30 100644 +--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c +@@ -2979,6 +2979,8 @@ static void pvr2_subdev_update(struct pvr2_hdw *hdw) + if (hdw->input_dirty || hdw->audiomode_dirty || hdw->force_dirty) { + struct v4l2_tuner vt; + memset(&vt, 0, sizeof(vt)); ++ vt.type = (hdw->input_val == PVR2_CVAL_INPUT_RADIO) ? ++ V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV; + vt.audmode = hdw->audiomode_val; + v4l2_device_call_all(&hdw->v4l2_dev, 0, tuner, s_tuner, &vt); + } +@@ -5064,6 +5066,8 @@ void pvr2_hdw_status_poll(struct pvr2_hdw *hdw) + { + struct v4l2_tuner *vtp = &hdw->tuner_signal_info; + memset(vtp, 0, sizeof(*vtp)); ++ vtp->type = (hdw->input_val == PVR2_CVAL_INPUT_RADIO) ? ++ V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV; + hdw->tuner_signal_stale = 0; + /* Note: There apparently is no replacement for VIDIOC_CROPCAP + using v4l2-subdev - therefore we can't support that AT ALL right +diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c +index 30cc334..265bfb5 100644 +--- a/drivers/media/video/v4l2-ioctl.c ++++ b/drivers/media/video/v4l2-ioctl.c +@@ -1600,6 +1600,8 @@ static long __video_do_ioctl(struct file *file, + if (!ops->vidioc_g_tuner) + break; + ++ p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ? ++ V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV; + ret = ops->vidioc_g_tuner(file, fh, p); + if (!ret) + dbgarg(cmd, "index=%d, name=%s, type=%d, " +@@ -1618,6 +1620,8 @@ static long __video_do_ioctl(struct file *file, + + if (!ops->vidioc_s_tuner) + break; ++ p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ? ++ V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV; + dbgarg(cmd, "index=%d, name=%s, type=%d, " + "capability=0x%x, rangelow=%d, " + "rangehigh=%d, signal=%d, afc=%d, " +@@ -1636,6 +1640,8 @@ static long __video_do_ioctl(struct file *file, + if (!ops->vidioc_g_frequency) + break; + ++ p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ? ++ V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV; + ret = ops->vidioc_g_frequency(file, fh, p); + if (!ret) + dbgarg(cmd, "tuner=%d, type=%d, frequency=%d\n", +diff --git a/drivers/net/jme.c b/drivers/net/jme.c +index a893f45..0fbca76 100644 +--- a/drivers/net/jme.c ++++ b/drivers/net/jme.c +@@ -681,20 +681,28 @@ jme_make_new_rx_buf(struct jme_adapter *jme, int i) + struct jme_ring *rxring = &(jme->rxring[0]); + struct jme_buffer_info *rxbi = rxring->bufinf + i; + struct sk_buff *skb; ++ dma_addr_t mapping; + + skb = netdev_alloc_skb(jme->dev, + jme->dev->mtu + RX_EXTRA_LEN); + if (unlikely(!skb)) + return -ENOMEM; + ++ mapping = pci_map_page(jme->pdev, virt_to_page(skb->data), ++ offset_in_page(skb->data), skb_tailroom(skb), ++ PCI_DMA_FROMDEVICE); ++ if (unlikely(pci_dma_mapping_error(jme->pdev, mapping))) { ++ dev_kfree_skb(skb); ++ return -ENOMEM; ++ } ++ ++ if (likely(rxbi->mapping)) ++ pci_unmap_page(jme->pdev, rxbi->mapping, ++ rxbi->len, PCI_DMA_FROMDEVICE); ++ + rxbi->skb = skb; + rxbi->len = skb_tailroom(skb); +- rxbi->mapping = pci_map_page(jme->pdev, +- virt_to_page(skb->data), +- offset_in_page(skb->data), +- rxbi->len, +- PCI_DMA_FROMDEVICE); +- ++ rxbi->mapping = mapping; + return 0; + } + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 0d3326d..6f8352c 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1507,7 +1507,7 @@ void pci_enable_ari(struct pci_dev *dev) + { + int pos; + u32 cap; +- u16 ctrl; ++ u16 flags, ctrl; + struct pci_dev *bridge; + + if (!dev->is_pcie || dev->devfn) +@@ -1525,6 +1525,11 @@ void pci_enable_ari(struct pci_dev *dev) + if (!pos) + return; + ++ /* ARI is a PCIe v2 feature */ ++ pci_read_config_word(bridge, pos + PCI_EXP_FLAGS, &flags); ++ if ((flags & PCI_EXP_FLAGS_VERS) < 2) ++ return; ++ + pci_read_config_dword(bridge, pos + PCI_EXP_DEVCAP2, &cap); + if (!(cap & PCI_EXP_DEVCAP2_ARI)) + return; +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 33cf988..4f43306 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -840,6 +840,9 @@ static struct domain_device *sas_ex_discover_expander( + + res = sas_discover_expander(child); + if (res) { ++ spin_lock_irq(&parent->port->dev_list_lock); ++ list_del(&child->dev_list_node); ++ spin_unlock_irq(&parent->port->dev_list_lock); + kfree(child); + return NULL; + } +diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c +index 483370f..9ab8c86 100644 +--- a/drivers/scsi/pmcraid.c ++++ b/drivers/scsi/pmcraid.c +@@ -3557,6 +3557,9 @@ static long pmcraid_ioctl_passthrough( + pmcraid_err("couldn't build passthrough ioadls\n"); + goto out_free_buffer; + } ++ } else if (request_size < 0) { ++ rc = -EINVAL; ++ goto out_free_buffer; + } + + /* If data is being written into the device, copy the data from user +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index 802e91c..ae0ae2d 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -196,6 +196,7 @@ static struct { + {"IBM", "ProFibre 4000R", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"IBM", "2105", NULL, BLIST_RETRY_HWERROR}, + {"iomega", "jaz 1GB", "J.86", BLIST_NOTQ | BLIST_NOLUN}, ++ {"IOMEGA", "ZIP", NULL, BLIST_NOTQ | BLIST_NOLUN}, + {"IOMEGA", "Io20S *F", NULL, BLIST_KEY}, + {"INSITE", "Floptical F*8I", NULL, BLIST_KEY}, + {"INSITE", "I325VM", NULL, BLIST_KEY}, +@@ -242,6 +243,7 @@ static struct { + {"Tornado-", "F4", "*", BLIST_NOREPORTLUN}, + {"TOSHIBA", "CDROM", NULL, BLIST_ISROM}, + {"TOSHIBA", "CD-ROM", NULL, BLIST_ISROM}, ++ {"Traxdata", "CDR4120", NULL, BLIST_NOLUN}, /* locks up */ + {"USB2.0", "SMARTMEDIA/XD", NULL, BLIST_FORCELUN | BLIST_INQUIRY_36}, + {"WangDAT", "Model 2600", "01.7", BLIST_SELECT_NO_ATN}, + {"WangDAT", "Model 3200", "02.2", BLIST_SELECT_NO_ATN}, +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index 3b082dd..340124d 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -157,6 +157,10 @@ static unsigned char *ses_get_page2_descriptor(struct enclosure_device *edev, + return NULL; + } + ++/* For device slot and array device slot elements, byte 3 bit 6 ++ * is "fault sensed" while byte 3 bit 5 is "fault reqstd". As this ++ * code stands these bits are shifted 4 positions right so in ++ * sysfs they will appear as bits 2 and 1 respectively. Strange. */ + static void ses_get_fault(struct enclosure_device *edev, + struct enclosure_component *ecomp) + { +@@ -178,7 +182,7 @@ static int ses_set_fault(struct enclosure_device *edev, + /* zero is disabled */ + break; + case ENCLOSURE_SETTING_ENABLED: +- desc[2] = 0x02; ++ desc[3] = 0x20; + break; + default: + /* SES doesn't do the SGPIO blink settings */ +diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c +index aaad76e..80a1071 100644 +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -367,8 +367,8 @@ static int do_devinfo_ioctl(struct comedi_device *dev, + /* fill devinfo structure */ + devinfo.version_code = COMEDI_VERSION_CODE; + devinfo.n_subdevs = dev->n_subdevices; +- memcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN); +- memcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN); ++ strlcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN); ++ strlcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN); + + if (read_subdev) + devinfo.read_subdevice = read_subdev - dev->subdevices; +diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c +index 5e09664..7adb671 100644 +--- a/drivers/usb/gadget/dummy_hcd.c ++++ b/drivers/usb/gadget/dummy_hcd.c +@@ -1886,6 +1886,7 @@ static int dummy_hcd_probe(struct platform_device *pdev) + if (!hcd) + return -ENOMEM; + the_controller = hcd_to_dummy (hcd); ++ hcd->has_tt = 1; + + retval = usb_add_hcd(hcd, 0, 0); + if (retval != 0) { +diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c +index 6ac3976..1bcf6ee 100644 +--- a/drivers/usb/host/ehci-hub.c ++++ b/drivers/usb/host/ehci-hub.c +@@ -758,10 +758,11 @@ static int ehci_hub_control ( + * power switching; they're allowed to just limit the + * current. khubd will turn the power back on. + */ +- if (HCS_PPC (ehci->hcs_params)){ ++ if ((temp & PORT_OC) && HCS_PPC(ehci->hcs_params)) { + ehci_writel(ehci, + temp & ~(PORT_RWC_BITS | PORT_POWER), + status_reg); ++ temp = ehci_readl(ehci, status_reg); + } + } + +diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c +index f51345f..0ee5b4b 100644 +--- a/drivers/usb/host/ehci-q.c ++++ b/drivers/usb/host/ehci-q.c +@@ -103,7 +103,7 @@ qh_update (struct ehci_hcd *ehci, struct ehci_qh *qh, struct ehci_qtd *qtd) + if (!(hw->hw_info1 & cpu_to_hc32(ehci, 1 << 14))) { + unsigned is_out, epnum; + +- is_out = !(qtd->hw_token & cpu_to_hc32(ehci, 1 << 8)); ++ is_out = qh->is_out; + epnum = (hc32_to_cpup(ehci, &hw->hw_info1) >> 8) & 0x0f; + if (unlikely (!usb_gettoggle (qh->dev, epnum, is_out))) { + hw->hw_token &= ~cpu_to_hc32(ehci, QTD_TOGGLE); +@@ -923,6 +923,7 @@ done: + hw = qh->hw; + hw->hw_info1 = cpu_to_hc32(ehci, info1); + hw->hw_info2 = cpu_to_hc32(ehci, info2); ++ qh->is_out = !is_input; + usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), !is_input, 1); + qh_refresh (ehci, qh); + return qh; +diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h +index ac321ef..5b3ca74 100644 +--- a/drivers/usb/host/ehci.h ++++ b/drivers/usb/host/ehci.h +@@ -366,6 +366,7 @@ struct ehci_qh { + #define NO_FRAME ((unsigned short)~0) /* pick new start */ + + struct usb_device *dev; /* access to TT */ ++ unsigned is_out:1; /* bulk or intr OUT */ + unsigned clearing_tt:1; /* Clear-TT-Buf in progress */ + }; + +diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c +index 464ed97..bcf7a88 100644 +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -34,6 +34,8 @@ + #define OHCI_INTRSTATUS 0x0c + #define OHCI_INTRENABLE 0x10 + #define OHCI_INTRDISABLE 0x14 ++#define OHCI_FMINTERVAL 0x34 ++#define OHCI_HCR (1 << 0) /* host controller reset */ + #define OHCI_OCR (1 << 3) /* ownership change request */ + #define OHCI_CTRL_RWC (1 << 9) /* remote wakeup connected */ + #define OHCI_CTRL_IR (1 << 8) /* interrupt routing */ +@@ -204,6 +206,32 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev) + + /* reset controller, preserving RWC (and possibly IR) */ + writel(control & OHCI_CTRL_MASK, base + OHCI_CONTROL); ++ readl(base + OHCI_CONTROL); ++ ++ /* Some NVIDIA controllers stop working if kept in RESET for too long */ ++ if (pdev->vendor == PCI_VENDOR_ID_NVIDIA) { ++ u32 fminterval; ++ int cnt; ++ ++ /* drive reset for at least 50 ms (7.1.7.5) */ ++ msleep(50); ++ ++ /* software reset of the controller, preserving HcFmInterval */ ++ fminterval = readl(base + OHCI_FMINTERVAL); ++ writel(OHCI_HCR, base + OHCI_CMDSTATUS); ++ ++ /* reset requires max 10 us delay */ ++ for (cnt = 30; cnt > 0; --cnt) { /* ... allow extra time */ ++ if ((readl(base + OHCI_CMDSTATUS) & OHCI_HCR) == 0) ++ break; ++ udelay(1); ++ } ++ writel(fminterval, base + OHCI_FMINTERVAL); ++ ++ /* Now we're in the SUSPEND state with all devices reset ++ * and wakeups and interrupts disabled ++ */ ++ } + + /* + * disable interrupts +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index 24212be..b9afd6a 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1634,6 +1634,7 @@ void musb_dma_completion(struct musb *musb, u8 epnum, u8 transmit) + } + } + } ++ musb_writeb(musb_base, MUSB_INDEX, musb->context.index); + } + + #else +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index b336017..4a18fd2 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -100,6 +100,8 @@ static struct usb_device_id id_table [] = { + { USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) }, + { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) }, + { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) }, ++ { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) }, ++ { USB_DEVICE(WINCHIPHEAD_VENDOR_ID, WINCHIPHEAD_USBSER_PRODUCT_ID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 4d043e4..ca0d237 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -5,7 +5,7 @@ + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. +- * ++ * + */ + + #define BENQ_VENDOR_ID 0x04a5 +@@ -140,3 +140,11 @@ + /* Sanwa KB-USB2 multimeter cable (ID: 11ad:0001) */ + #define SANWA_VENDOR_ID 0x11ad + #define SANWA_PRODUCT_ID 0x0001 ++ ++/* ADLINK ND-6530 RS232,RS485 and RS422 adapter */ ++#define ADLINK_VENDOR_ID 0x0b63 ++#define ADLINK_ND6530_PRODUCT_ID 0x6530 ++ ++/* WinChipHead USB->RS 232 adapter */ ++#define WINCHIPHEAD_VENDOR_ID 0x4348 ++#define WINCHIPHEAD_USBSER_PRODUCT_ID 0x5523 +diff --git a/fs/block_dev.c b/fs/block_dev.c +index 16cea86..e65efa2 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -1203,7 +1203,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + if (!bdev->bd_part) + goto out_clear; + +- ret = 0; + if (disk->fops->open) { + ret = disk->fops->open(bdev, mode); + if (ret == -ERESTARTSYS) { +@@ -1219,18 +1218,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + mutex_unlock(&bdev->bd_mutex); + goto restart; + } ++ if (ret) ++ goto out_clear; + } +- /* +- * If the device is invalidated, rescan partition +- * if open succeeded or failed with -ENOMEDIUM. +- * The latter is necessary to prevent ghost +- * partitions on a removed medium. +- */ +- if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM)) +- rescan_partitions(disk, bdev); +- if (ret) +- goto out_clear; +- + if (!bdev->bd_openers) { + bd_set_size(bdev,(loff_t)get_capacity(disk)<<9); + bdi = blk_get_backing_dev_info(bdev); +@@ -1238,6 +1228,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + bdi = &default_backing_dev_info; + bdev->bd_inode->i_data.backing_dev_info = bdi; + } ++ if (bdev->bd_invalidated) ++ rescan_partitions(disk, bdev); + } else { + struct block_device *whole; + whole = bdget_disk(disk, 0); +@@ -1264,14 +1256,13 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + put_disk(disk); + disk = NULL; + if (bdev->bd_contains == bdev) { +- ret = 0; +- if (bdev->bd_disk->fops->open) ++ if (bdev->bd_disk->fops->open) { + ret = bdev->bd_disk->fops->open(bdev, mode); +- /* the same as first opener case, read comment there */ +- if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM)) ++ if (ret) ++ goto out_unlock_bdev; ++ } ++ if (bdev->bd_invalidated) + rescan_partitions(bdev->bd_disk, bdev); +- if (ret) +- goto out_unlock_bdev; + } + } + bdev->bd_openers++; +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index c4dbc63..e29581e 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -33,7 +33,7 @@ + #define MAX_SHARE_SIZE 64 /* used to be 20, this should still be enough */ + #define MAX_USERNAME_SIZE 32 /* 32 is to allow for 15 char names + null + termination then *2 for unicode versions */ +-#define MAX_PASSWORD_SIZE 16 ++#define MAX_PASSWORD_SIZE 512 /* max for windows seems to be 256 wide chars */ + + #define CIFS_MIN_RCV_POOL 4 + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 6234417..b6bb82e 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -1588,17 +1588,29 @@ out_err: + } + + static struct cifsSesInfo * +-cifs_find_smb_ses(struct TCP_Server_Info *server, char *username) ++cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol) + { +- struct list_head *tmp; + struct cifsSesInfo *ses; + + write_lock(&cifs_tcp_ses_lock); +- list_for_each(tmp, &server->smb_ses_list) { +- ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list); +- if (strncmp(ses->userName, username, MAX_USERNAME_SIZE)) +- continue; +- ++ list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { ++ switch (server->secType) { ++ case Kerberos: ++ if (vol->linux_uid != ses->linux_uid) ++ continue; ++ break; ++ default: ++ /* anything else takes username/password */ ++ if (strncmp(ses->userName, vol->username, ++ MAX_USERNAME_SIZE)) ++ continue; ++ if (strlen(vol->username) != 0 && ++ ses->password != NULL && ++ strncmp(ses->password, ++ vol->password ? vol->password : "", ++ MAX_PASSWORD_SIZE)) ++ continue; ++ } + ++ses->ses_count; + write_unlock(&cifs_tcp_ses_lock); + return ses; +@@ -2362,7 +2374,7 @@ try_mount_again: + goto out; + } + +- pSesInfo = cifs_find_smb_ses(srvTcp, volume_info->username); ++ pSesInfo = cifs_find_smb_ses(srvTcp, volume_info); + if (pSesInfo) { + cFYI(1, ("Existing smb sess found (status=%d)", + pSesInfo->status)); +diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c +index 387d92d..d7add4c 100644 +--- a/fs/ext3/xattr.c ++++ b/fs/ext3/xattr.c +@@ -800,8 +800,16 @@ inserted: + /* We need to allocate a new block */ + ext3_fsblk_t goal = ext3_group_first_block_no(sb, + EXT3_I(inode)->i_block_group); +- ext3_fsblk_t block = ext3_new_block(handle, inode, +- goal, &error); ++ ext3_fsblk_t block; ++ ++ /* ++ * Protect us agaist concurrent allocations to the ++ * same inode from ext3_..._writepage(). Reservation ++ * code does not expect racing allocations. ++ */ ++ mutex_lock(&EXT3_I(inode)->truncate_mutex); ++ block = ext3_new_block(handle, inode, goal, &error); ++ mutex_unlock(&EXT3_I(inode)->truncate_mutex); + if (error) + goto cleanup; + ea_idebug(inode, "creating block %d", block); +diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c +index e81b2bf..7ee8ebc 100644 +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -88,7 +88,7 @@ static int nfs4_stat_to_errno(int); + #define encode_getfh_maxsz (op_encode_hdr_maxsz) + #define decode_getfh_maxsz (op_decode_hdr_maxsz + 1 + \ + ((3+NFS4_FHSIZE) >> 2)) +-#define nfs4_fattr_bitmap_maxsz 3 ++#define nfs4_fattr_bitmap_maxsz 4 + #define encode_getattr_maxsz (op_encode_hdr_maxsz + nfs4_fattr_bitmap_maxsz) + #define nfs4_name_maxsz (1 + ((3 + NFS4_MAXNAMLEN) >> 2)) + #define nfs4_path_maxsz (1 + ((3 + NFS4_MAXPATHLEN) >> 2)) +diff --git a/fs/proc/base.c b/fs/proc/base.c +index 3d09a10..7b5819c 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -2454,6 +2454,9 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole) + struct task_io_accounting acct = task->ioac; + unsigned long flags; + ++ if (!ptrace_may_access(task, PTRACE_MODE_READ)) ++ return -EACCES; ++ + if (whole && lock_task_sighand(task, &flags)) { + struct task_struct *t = task; + +@@ -2575,7 +2578,7 @@ static const struct pid_entry tgid_base_stuff[] = { + REG("coredump_filter", S_IRUGO|S_IWUSR, proc_coredump_filter_operations), + #endif + #ifdef CONFIG_TASK_IO_ACCOUNTING +- INF("io", S_IRUGO, proc_tgid_io_accounting), ++ INF("io", S_IRUSR, proc_tgid_io_accounting), + #endif + }; + +@@ -2910,7 +2913,7 @@ static const struct pid_entry tid_base_stuff[] = { + REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations), + #endif + #ifdef CONFIG_TASK_IO_ACCOUNTING +- INF("io", S_IRUGO, proc_tid_io_accounting), ++ INF("io", S_IRUSR, proc_tid_io_accounting), + #endif + }; + +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index c27a182..9d7e8f7 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -1164,9 +1164,12 @@ static inline int skb_gro_header_hard(struct sk_buff *skb, unsigned int hlen) + static inline void *skb_gro_header_slow(struct sk_buff *skb, unsigned int hlen, + unsigned int offset) + { ++ if (!pskb_may_pull(skb, hlen)) ++ return NULL; ++ + NAPI_GRO_CB(skb)->frag0 = NULL; + NAPI_GRO_CB(skb)->frag0_len = 0; +- return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL; ++ return skb->data + offset; + } + + static inline void *skb_gro_mac_header(struct sk_buff *skb) +diff --git a/kernel/perf_event.c b/kernel/perf_event.c +index fc5ab8e..37ebc14 100644 +--- a/kernel/perf_event.c ++++ b/kernel/perf_event.c +@@ -3694,12 +3694,8 @@ static int __perf_event_overflow(struct perf_event *event, int nmi, + if (events && atomic_dec_and_test(&event->event_limit)) { + ret = 1; + event->pending_kill = POLL_HUP; +- if (nmi) { +- event->pending_disable = 1; +- perf_pending_queue(&event->pending, +- perf_pending_event); +- } else +- perf_event_disable(event); ++ event->pending_disable = 1; ++ perf_pending_queue(&event->pending, perf_pending_event); + } + + perf_event_output(event, nmi, data, regs); +diff --git a/net/atm/br2684.c b/net/atm/br2684.c +index 26a646d..c9230c3 100644 +--- a/net/atm/br2684.c ++++ b/net/atm/br2684.c +@@ -554,6 +554,12 @@ static const struct net_device_ops br2684_netdev_ops = { + .ndo_validate_addr = eth_validate_addr, + }; + ++static const struct net_device_ops br2684_netdev_ops_routed = { ++ .ndo_start_xmit = br2684_start_xmit, ++ .ndo_set_mac_address = br2684_mac_addr, ++ .ndo_change_mtu = eth_change_mtu ++}; ++ + static void br2684_setup(struct net_device *netdev) + { + struct br2684_dev *brdev = BRPRIV(netdev); +@@ -569,11 +575,10 @@ static void br2684_setup(struct net_device *netdev) + static void br2684_setup_routed(struct net_device *netdev) + { + struct br2684_dev *brdev = BRPRIV(netdev); +- brdev->net_dev = netdev; + ++ brdev->net_dev = netdev; + netdev->hard_header_len = 0; +- +- netdev->netdev_ops = &br2684_netdev_ops; ++ netdev->netdev_ops = &br2684_netdev_ops_routed; + netdev->addr_len = 0; + netdev->mtu = 1500; + netdev->type = ARPHRD_PPP; +diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h +index 2114e45..8567d47 100644 +--- a/net/bridge/br_private.h ++++ b/net/bridge/br_private.h +@@ -75,6 +75,7 @@ struct net_bridge_port + bridge_id designated_bridge; + u32 path_cost; + u32 designated_cost; ++ unsigned long designated_age; + + struct timer_list forward_delay_timer; + struct timer_list hold_timer; +diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c +index fd3f8d6..c7d6bfc 100644 +--- a/net/bridge/br_stp.c ++++ b/net/bridge/br_stp.c +@@ -165,8 +165,7 @@ void br_transmit_config(struct net_bridge_port *p) + else { + struct net_bridge_port *root + = br_get_port(br, br->root_port); +- bpdu.message_age = br->max_age +- - (root->message_age_timer.expires - jiffies) ++ bpdu.message_age = (jiffies - root->designated_age) + + MESSAGE_AGE_INCR; + } + bpdu.max_age = br->max_age; +@@ -190,6 +189,7 @@ static inline void br_record_config_information(struct net_bridge_port *p, + p->designated_cost = bpdu->root_path_cost; + p->designated_bridge = bpdu->bridge_id; + p->designated_port = bpdu->port_id; ++ p->designated_age = jiffies + bpdu->message_age; + + mod_timer(&p->message_age_timer, jiffies + + (p->br->max_age - bpdu->message_age)); +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index cfab9e4..f614584 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -1665,14 +1665,15 @@ static int __init ipgre_init(void) + + printk(KERN_INFO "GRE over IPv4 tunneling driver\n"); + +- if (inet_add_protocol(&ipgre_protocol, IPPROTO_GRE) < 0) { +- printk(KERN_INFO "ipgre init: can't add protocol\n"); +- return -EAGAIN; +- } +- + err = register_pernet_gen_device(&ipgre_net_id, &ipgre_net_ops); + if (err < 0) +- goto gen_device_failed; ++ return err; ++ ++ err = inet_add_protocol(&ipgre_protocol, IPPROTO_GRE); ++ if (err < 0) { ++ printk(KERN_INFO "ipgre init: can't add protocol\n"); ++ goto add_proto_failed; ++ } + + err = rtnl_link_register(&ipgre_link_ops); + if (err < 0) +@@ -1688,9 +1689,9 @@ out: + tap_ops_failed: + rtnl_link_unregister(&ipgre_link_ops); + rtnl_link_failed: +- unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops); +-gen_device_failed: + inet_del_protocol(&ipgre_protocol, IPPROTO_GRE); ++add_proto_failed: ++ unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops); + goto out; + } + +@@ -1698,9 +1699,9 @@ static void __exit ipgre_fini(void) + { + rtnl_link_unregister(&ipgre_tap_ops); + rtnl_link_unregister(&ipgre_link_ops); +- unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops); + if (inet_del_protocol(&ipgre_protocol, IPPROTO_GRE) < 0) + printk(KERN_INFO "ipgre close: can't remove protocol\n"); ++ unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops); + } + + module_init(ipgre_init); +diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c +index f37df1a..860b5c5 100644 +--- a/net/ipv4/ipip.c ++++ b/net/ipv4/ipip.c +@@ -830,15 +830,14 @@ static int __init ipip_init(void) + + printk(banner); + +- if (xfrm4_tunnel_register(&ipip_handler, AF_INET)) { ++ err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops); ++ if (err < 0) ++ return err; ++ err = xfrm4_tunnel_register(&ipip_handler, AF_INET); ++ if (err < 0) { ++ unregister_pernet_device(&ipip_net_ops); + printk(KERN_INFO "ipip init: can't register tunnel\n"); +- return -EAGAIN; + } +- +- err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops); +- if (err) +- xfrm4_tunnel_deregister(&ipip_handler, AF_INET); +- + return err; + } + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 9a95c82..7fb3e02 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1466,27 +1466,29 @@ static int __init ip6_tunnel_init(void) + { + int err; + +- if (xfrm6_tunnel_register(&ip4ip6_handler, AF_INET)) { ++ err = register_pernet_device(&ip6_tnl_net_ops); ++ if (err < 0) ++ goto out_pernet; ++ ++ err = xfrm6_tunnel_register(&ip4ip6_handler, AF_INET); ++ if (err < 0) { + printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n"); +- err = -EAGAIN; +- goto out; ++ goto out_ip4ip6; + } + +- if (xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6)) { ++ err = xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6); ++ if (err < 0) { + printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n"); +- err = -EAGAIN; +- goto unreg_ip4ip6; ++ goto out_ip6ip6; + } + +- err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops); +- if (err < 0) +- goto err_pernet; + return 0; +-err_pernet: +- xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6); +-unreg_ip4ip6: ++ ++out_ip6ip6: + xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET); +-out: ++out_ip4ip6: ++ unregister_pernet_device(&ip6_tnl_net_ops); ++out_pernet: + return err; + } + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index de2ffef..b128c07 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1086,15 +1086,14 @@ static int __init sit_init(void) + + printk(KERN_INFO "IPv6 over IPv4 tunneling driver\n"); + +- if (xfrm4_tunnel_register(&sit_handler, AF_INET6) < 0) { +- printk(KERN_INFO "sit init: Can't add protocol\n"); +- return -EAGAIN; +- } +- + err = register_pernet_gen_device(&sit_net_id, &sit_net_ops); + if (err < 0) +- xfrm4_tunnel_deregister(&sit_handler, AF_INET6); +- ++ return err; ++ err = xfrm4_tunnel_register(&sit_handler, AF_INET6); ++ if (err < 0) { ++ unregister_pernet_device(&sit_net_ops); ++ printk(KERN_INFO "sit init: Can't add protocol\n"); ++ } + return err; + } + +diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c +index 81a95c0..48bb1e3 100644 +--- a/net/ipv6/xfrm6_tunnel.c ++++ b/net/ipv6/xfrm6_tunnel.c +@@ -344,32 +344,38 @@ static struct xfrm6_tunnel xfrm46_tunnel_handler = { + + static int __init xfrm6_tunnel_init(void) + { +- if (xfrm_register_type(&xfrm6_tunnel_type, AF_INET6) < 0) ++ int rv; ++ ++ rv = xfrm6_tunnel_spi_init(); ++ if (rv < 0) + goto err; +- if (xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6)) +- goto unreg; +- if (xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET)) +- goto dereg6; +- if (xfrm6_tunnel_spi_init() < 0) +- goto dereg46; ++ rv = xfrm_register_type(&xfrm6_tunnel_type, AF_INET6); ++ if (rv < 0) ++ goto out_type; ++ rv = xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6); ++ if (rv < 0) ++ goto out_xfrm6; ++ rv = xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET); ++ if (rv < 0) ++ goto out_xfrm46; + return 0; + +-dereg46: +- xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET); +-dereg6: ++out_xfrm46: + xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6); +-unreg: ++out_xfrm6: + xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6); ++out_type: ++ xfrm6_tunnel_spi_fini(); + err: +- return -EAGAIN; ++ return rv; + } + + static void __exit xfrm6_tunnel_fini(void) + { +- xfrm6_tunnel_spi_fini(); + xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET); + xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6); + xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6); ++ xfrm6_tunnel_spi_fini(); + } + + module_init(xfrm6_tunnel_init); +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 5bea319..e67eea7 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -2308,6 +2308,9 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata) + { + struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; + ++ if (!ifmgd->associated) ++ return; ++ + if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running)) + add_timer(&ifmgd->timer); + if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running)) +diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c +index 830faf4..4418bb4 100644 +--- a/net/sunrpc/rpcb_clnt.c ++++ b/net/sunrpc/rpcb_clnt.c +@@ -533,7 +533,7 @@ void rpcb_getport_async(struct rpc_task *task) + u32 bind_version; + struct rpc_xprt *xprt; + struct rpc_clnt *rpcb_clnt; +- static struct rpcbind_args *map; ++ struct rpcbind_args *map; + struct rpc_task *child; + struct sockaddr_storage addr; + struct sockaddr *sap = (struct sockaddr *)&addr; +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index 9191b2f..570da30 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -613,30 +613,25 @@ static void __rpc_execute(struct rpc_task *task) + BUG_ON(RPC_IS_QUEUED(task)); + + for (;;) { ++ void (*do_action)(struct rpc_task *); + + /* +- * Execute any pending callback. ++ * Execute any pending callback first. + */ +- if (task->tk_callback) { +- void (*save_callback)(struct rpc_task *); +- +- /* +- * We set tk_callback to NULL before calling it, +- * in case it sets the tk_callback field itself: +- */ +- save_callback = task->tk_callback; +- task->tk_callback = NULL; +- save_callback(task); +- } else { ++ do_action = task->tk_callback; ++ task->tk_callback = NULL; ++ if (do_action == NULL) { + /* + * Perform the next FSM step. +- * tk_action may be NULL when the task has been killed +- * by someone else. ++ * tk_action may be NULL if the task has been killed. ++ * In particular, note that rpc_killall_tasks may ++ * do this at any time, so beware when dereferencing. + */ +- if (task->tk_action == NULL) ++ do_action = task->tk_action; ++ if (do_action == NULL) + break; +- task->tk_action(task); + } ++ do_action(task); + + /* + * Lockless check for whether task is sleeping or not. +diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c +index df760ad..cc1fb36 100644 +--- a/net/sunrpc/svc_xprt.c ++++ b/net/sunrpc/svc_xprt.c +@@ -896,12 +896,13 @@ void svc_delete_xprt(struct svc_xprt *xprt) + if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags)) + list_del_init(&xprt->xpt_list); + /* +- * We used to delete the transport from whichever list +- * it's sk_xprt.xpt_ready node was on, but we don't actually +- * need to. This is because the only time we're called +- * while still attached to a queue, the queue itself +- * is about to be destroyed (in svc_destroy). ++ * The only time we're called while xpt_ready is still on a list ++ * is while the list itself is about to be destroyed (in ++ * svc_destroy). BUT svc_xprt_enqueue could still be attempting ++ * to add new entries to the sp_sockets list, so we can't leave ++ * a freed xprt on it. + */ ++ list_del_init(&xprt->xpt_ready); + if (test_bit(XPT_TEMP, &xprt->xpt_flags)) + serv->sv_tmpcnt--; + +diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c +index 08bfed5..038232d 100644 +--- a/sound/core/pcm_compat.c ++++ b/sound/core/pcm_compat.c +@@ -341,7 +341,7 @@ static int snd_pcm_ioctl_xfern_compat(struct snd_pcm_substream *substream, + kfree(bufs); + return -EFAULT; + } +- bufs[ch] = compat_ptr(ptr); ++ bufs[i] = compat_ptr(ptr); + bufptr++; + } + if (dir == SNDRV_PCM_STREAM_PLAYBACK) +diff --git a/sound/soc/blackfin/bf5xx-i2s-pcm.c b/sound/soc/blackfin/bf5xx-i2s-pcm.c +index 62fbb84..77dae16 100644 +--- a/sound/soc/blackfin/bf5xx-i2s-pcm.c ++++ b/sound/soc/blackfin/bf5xx-i2s-pcm.c +@@ -139,11 +139,20 @@ static snd_pcm_uframes_t bf5xx_pcm_pointer(struct snd_pcm_substream *substream) + pr_debug("%s enter\n", __func__); + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { + diff = sport_curr_offset_tx(sport); +- frames = bytes_to_frames(substream->runtime, diff); + } else { + diff = sport_curr_offset_rx(sport); +- frames = bytes_to_frames(substream->runtime, diff); + } ++ ++ /* ++ * TX at least can report one frame beyond the end of the ++ * buffer if we hit the wraparound case - clamp to within the ++ * buffer as the ALSA APIs require. ++ */ ++ if (diff == snd_pcm_lib_buffer_bytes(substream)) ++ diff = 0; ++ ++ frames = bytes_to_frames(substream->runtime, diff); ++ + return frames; + } + |