]>
Commit | Line | Data |
---|---|---|
82094b55 AF |
1 | From: Greg Kroah-Hartman <gregkh@suse.de> |
2 | Subject: Linux 2.6.27.36 | |
3 | ||
4 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | |
5 | ||
6 | diff --git a/Makefile b/Makefile | |
7 | index 5768979..e7046ea 100644 | |
8 | --- a/Makefile | |
9 | +++ b/Makefile | |
10 | @@ -1,7 +1,7 @@ | |
11 | VERSION = 2 | |
12 | PATCHLEVEL = 6 | |
13 | SUBLEVEL = 27 | |
14 | -EXTRAVERSION = .35 | |
15 | +EXTRAVERSION = .36 | |
16 | NAME = Trembling Tortoise | |
17 | ||
18 | # *DOCUMENTATION* | |
19 | diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c | |
20 | index fcec2df..3990eae 100644 | |
21 | --- a/drivers/isdn/gigaset/bas-gigaset.c | |
22 | +++ b/drivers/isdn/gigaset/bas-gigaset.c | |
23 | @@ -2140,8 +2140,16 @@ static int gigaset_initcshw(struct cardstate *cs) | |
24 | struct bas_cardstate *ucs; | |
25 | ||
26 | cs->hw.bas = ucs = kmalloc(sizeof *ucs, GFP_KERNEL); | |
27 | - if (!ucs) | |
28 | + if (!ucs) { | |
29 | + pr_err("out of memory\n"); | |
30 | + return 0; | |
31 | + } | |
32 | + ucs->int_in_buf = kmalloc(IP_MSGSIZE, GFP_KERNEL); | |
33 | + if (!ucs->int_in_buf) { | |
34 | + kfree(ucs); | |
35 | + pr_err("out of memory\n"); | |
36 | return 0; | |
37 | + } | |
38 | ||
39 | ucs->urb_cmd_in = NULL; | |
40 | ucs->urb_cmd_out = NULL; | |
41 | @@ -2236,12 +2244,6 @@ static int gigaset_probe(struct usb_interface *interface, | |
42 | } | |
43 | hostif = interface->cur_altsetting; | |
44 | } | |
45 | - ucs->int_in_buf = kmalloc(IP_MSGSIZE, GFP_KERNEL); | |
46 | - if (!ucs->int_in_buf) { | |
47 | - kfree(ucs); | |
48 | - pr_err("out of memory\n"); | |
49 | - return 0; | |
50 | - } | |
51 | ||
52 | /* Reject application specific interfaces | |
53 | */ | |
54 | diff --git a/drivers/net/enc28j60.c b/drivers/net/enc28j60.c | |
55 | index aa0bf6e..49fc60d 100644 | |
56 | --- a/drivers/net/enc28j60.c | |
57 | +++ b/drivers/net/enc28j60.c | |
58 | @@ -919,7 +919,7 @@ static void enc28j60_hw_rx(struct net_device *ndev) | |
59 | if (netif_msg_rx_status(priv)) | |
60 | enc28j60_dump_rsv(priv, __FUNCTION__, next_packet, len, rxstat); | |
61 | ||
62 | - if (!RSV_GETBIT(rxstat, RSV_RXOK)) { | |
63 | + if (!RSV_GETBIT(rxstat, RSV_RXOK) || len > MAX_FRAMELEN) { | |
64 | if (netif_msg_rx_err(priv)) | |
65 | dev_err(&ndev->dev, "Rx Error (%04x)\n", rxstat); | |
66 | ndev->stats.rx_errors++; | |
67 | @@ -927,6 +927,8 @@ static void enc28j60_hw_rx(struct net_device *ndev) | |
68 | ndev->stats.rx_crc_errors++; | |
69 | if (RSV_GETBIT(rxstat, RSV_LENCHECKERR)) | |
70 | ndev->stats.rx_frame_errors++; | |
71 | + if (len > MAX_FRAMELEN) | |
72 | + ndev->stats.rx_over_errors++; | |
73 | } else { | |
74 | skb = dev_alloc_skb(len + NET_IP_ALIGN); | |
75 | if (!skb) { | |
76 | diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c | |
77 | index 7d6cf02..b429a0f 100644 | |
78 | --- a/drivers/net/pcmcia/pcnet_cs.c | |
79 | +++ b/drivers/net/pcmcia/pcnet_cs.c | |
80 | @@ -591,7 +591,7 @@ static int pcnet_config(struct pcmcia_device *link) | |
81 | } | |
82 | ||
83 | if ((link->conf.ConfigBase == 0x03c0) | |
84 | - && (link->manf_id == 0x149) && (link->card_id = 0xc1ab)) { | |
85 | + && (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) { | |
86 | printk(KERN_INFO "pcnet_cs: this is an AX88190 card!\n"); | |
87 | printk(KERN_INFO "pcnet_cs: use axnet_cs instead.\n"); | |
88 | goto failed; | |
89 | diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c | |
90 | index bfff6b5..b97a1c9 100644 | |
91 | --- a/drivers/net/wireless/p54/p54usb.c | |
92 | +++ b/drivers/net/wireless/p54/p54usb.c | |
93 | @@ -63,6 +63,7 @@ static struct usb_device_id p54u_table[] __devinitdata = { | |
94 | {USB_DEVICE(0x0bf8, 0x1009)}, /* FUJITSU E-5400 USB D1700*/ | |
95 | {USB_DEVICE(0x0cde, 0x0006)}, /* Medion MD40900 */ | |
96 | {USB_DEVICE(0x0cde, 0x0008)}, /* Sagem XG703A */ | |
97 | + {USB_DEVICE(0x0cde, 0x0015)}, /* Zcomax XG-705A */ | |
98 | {USB_DEVICE(0x0d8e, 0x3762)}, /* DLink DWL-G120 Cohiba */ | |
99 | {USB_DEVICE(0x09aa, 0x1000)}, /* Spinnaker Proto board */ | |
100 | {USB_DEVICE(0x124a, 0x4025)}, /* IOGear GWU513 (GW3887IK chip) */ | |
101 | diff --git a/fs/inode.c b/fs/inode.c | |
102 | index 7b2acc1..79777d9 100644 | |
103 | --- a/fs/inode.c | |
104 | +++ b/fs/inode.c | |
105 | @@ -590,13 +590,15 @@ void unlock_new_inode(struct inode *inode) | |
106 | } | |
107 | #endif | |
108 | /* | |
109 | - * This is special! We do not need the spinlock | |
110 | - * when clearing I_LOCK, because we're guaranteed | |
111 | - * that nobody else tries to do anything about the | |
112 | - * state of the inode when it is locked, as we | |
113 | - * just created it (so there can be no old holders | |
114 | - * that haven't tested I_LOCK). | |
115 | + * This is special! We do not need the spinlock when clearing I_LOCK, | |
116 | + * because we're guaranteed that nobody else tries to do anything about | |
117 | + * the state of the inode when it is locked, as we just created it (so | |
118 | + * there can be no old holders that haven't tested I_LOCK). | |
119 | + * However we must emit the memory barrier so that other CPUs reliably | |
120 | + * see the clearing of I_LOCK after the other inode initialisation has | |
121 | + * completed. | |
122 | */ | |
123 | + smp_mb(); | |
124 | WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW)); | |
125 | inode->i_state &= ~(I_LOCK|I_NEW); | |
126 | wake_up_inode(inode); | |
127 | diff --git a/mm/hugetlb.c b/mm/hugetlb.c | |
128 | index 2885674..3a08c5a 100644 | |
129 | --- a/mm/hugetlb.c | |
130 | +++ b/mm/hugetlb.c | |
131 | @@ -983,6 +983,7 @@ __attribute__((weak)) int alloc_bootmem_huge_page(struct hstate *h) | |
132 | NODE_DATA(h->hugetlb_next_nid), | |
133 | huge_page_size(h), huge_page_size(h), 0); | |
134 | ||
135 | + hstate_next_node(h); | |
136 | if (addr) { | |
137 | /* | |
138 | * Use the beginning of the huge page to store the | |
139 | @@ -993,7 +994,6 @@ __attribute__((weak)) int alloc_bootmem_huge_page(struct hstate *h) | |
140 | if (m) | |
141 | goto found; | |
142 | } | |
143 | - hstate_next_node(h); | |
144 | nr_nodes--; | |
145 | } | |
146 | return 0; | |
147 | diff --git a/mm/memory.c b/mm/memory.c | |
148 | index 3856c36..1300b70 100644 | |
149 | --- a/mm/memory.c | |
150 | +++ b/mm/memory.c | |
151 | @@ -2422,7 +2422,8 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, | |
152 | goto oom_free_page; | |
153 | ||
154 | entry = mk_pte(page, vma->vm_page_prot); | |
155 | - entry = maybe_mkwrite(pte_mkdirty(entry), vma); | |
156 | + if (vma->vm_flags & VM_WRITE) | |
157 | + entry = pte_mkwrite(pte_mkdirty(entry)); | |
158 | ||
159 | page_table = pte_offset_map_lock(mm, pmd, address, &ptl); | |
160 | if (!pte_none(*page_table)) | |
161 | diff --git a/mm/mmap.c b/mm/mmap.c | |
162 | index d330758..8b5aa8e 100644 | |
163 | --- a/mm/mmap.c | |
164 | +++ b/mm/mmap.c | |
165 | @@ -575,9 +575,9 @@ again: remove_next = 1 + (end > next->vm_end); | |
166 | ||
167 | /* | |
168 | * When changing only vma->vm_end, we don't really need | |
169 | - * anon_vma lock: but is that case worth optimizing out? | |
170 | + * anon_vma lock. | |
171 | */ | |
172 | - if (vma->anon_vma) | |
173 | + if (vma->anon_vma && (insert || importer || start != vma->vm_start)) | |
174 | anon_vma = vma->anon_vma; | |
175 | if (anon_vma) { | |
176 | spin_lock(&anon_vma->lock); | |
177 | diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c | |
178 | index 28c7157..cd9d526 100644 | |
179 | --- a/net/ax25/af_ax25.c | |
180 | +++ b/net/ax25/af_ax25.c | |
181 | @@ -539,7 +539,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, | |
182 | if (level != SOL_AX25) | |
183 | return -ENOPROTOOPT; | |
184 | ||
185 | - if (optlen < sizeof(int)) | |
186 | + if (optlen < (int)sizeof(int)) | |
187 | return -EINVAL; | |
188 | ||
189 | if (get_user(opt, (int __user *)optval)) | |
190 | diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c | |
191 | index 9abd450..f908d68 100644 | |
192 | --- a/net/bridge/br_netfilter.c | |
193 | +++ b/net/bridge/br_netfilter.c | |
194 | @@ -358,7 +358,7 @@ static int br_nf_pre_routing_finish(struct sk_buff *skb) | |
195 | }, | |
196 | .proto = 0, | |
197 | }; | |
198 | - struct in_device *in_dev = in_dev_get(dev); | |
199 | + struct in_device *in_dev = __in_dev_get_rcu(dev); | |
200 | ||
201 | /* If err equals -EHOSTUNREACH the error is due to a | |
202 | * martian destination or due to the fact that | |
203 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c | |
204 | index 4b50878..ade1ebd 100644 | |
205 | --- a/net/packet/af_packet.c | |
206 | +++ b/net/packet/af_packet.c | |
207 | @@ -1500,7 +1500,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv | |
208 | static int packet_getsockopt(struct socket *sock, int level, int optname, | |
209 | char __user *optval, int __user *optlen) | |
210 | { | |
211 | - int len; | |
212 | + unsigned int len; | |
213 | int val; | |
214 | struct sock *sk = sock->sk; | |
215 | struct packet_sock *po = pkt_sk(sk); | |
216 | @@ -1513,7 +1513,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, | |
217 | if (get_user(len, optlen)) | |
218 | return -EFAULT; | |
219 | ||
220 | - if (len < 0) | |
221 | + if ((int)len < 0) | |
222 | return -EINVAL; | |
223 | ||
224 | switch(optname) { |