src/patches/suse-2.6.27.39/patches.kernel.org/patch-2.6.27.35-36

   1 From: Greg Kroah-Hartman <gregkh@suse.de>
   2 Subject: Linux 2.6.27.36
   3
   4 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
   5
   6 diff --git a/Makefile b/Makefile
   7 index 5768979..e7046ea 100644
   8 --- a/Makefile
   9 +++ b/Makefile
  10 @@ -1,7 +1,7 @@
  11  VERSION = 2
  12  PATCHLEVEL = 6
  13  SUBLEVEL = 27
  14 -EXTRAVERSION = .35
  15 +EXTRAVERSION = .36
  16  NAME = Trembling Tortoise
  17
  18  # *DOCUMENTATION*
  19 diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
  20 index fcec2df..3990eae 100644
  21 --- a/drivers/isdn/gigaset/bas-gigaset.c
  22 +++ b/drivers/isdn/gigaset/bas-gigaset.c
  23 @@ -2140,8 +2140,16 @@ static int gigaset_initcshw(struct cardstate *cs)
  24         struct bas_cardstate *ucs;
  25
  26         cs->hw.bas = ucs = kmalloc(sizeof *ucs, GFP_KERNEL);
  27 -       if (!ucs)
  28 +       if (!ucs) {
  29 +               pr_err("out of memory\n");
  30 +               return 0;
  31 +       }
  32 +       ucs->int_in_buf = kmalloc(IP_MSGSIZE, GFP_KERNEL);
  33 +       if (!ucs->int_in_buf) {
  34 +               kfree(ucs);
  35 +               pr_err("out of memory\n");
  36                 return 0;
  37 +       }
  38
  39         ucs->urb_cmd_in = NULL;
  40         ucs->urb_cmd_out = NULL;
  41 @@ -2236,12 +2244,6 @@ static int gigaset_probe(struct usb_interface *interface,
  42                 }
  43                 hostif = interface->cur_altsetting;
  44         }
  45 -       ucs->int_in_buf = kmalloc(IP_MSGSIZE, GFP_KERNEL);
  46 -       if (!ucs->int_in_buf) {
  47 -               kfree(ucs);
  48 -               pr_err("out of memory\n");
  49 -               return 0;
  50 -       }
  51
  52         /* Reject application specific interfaces
  53          */
  54 diff --git a/drivers/net/enc28j60.c b/drivers/net/enc28j60.c
  55 index aa0bf6e..49fc60d 100644
  56 --- a/drivers/net/enc28j60.c
  57 +++ b/drivers/net/enc28j60.c
  58 @@ -919,7 +919,7 @@ static void enc28j60_hw_rx(struct net_device *ndev)
  59         if (netif_msg_rx_status(priv))
  60                 enc28j60_dump_rsv(priv, __FUNCTION__, next_packet, len, rxstat);
  61
  62 -       if (!RSV_GETBIT(rxstat, RSV_RXOK)) {
  63 +       if (!RSV_GETBIT(rxstat, RSV_RXOK) || len > MAX_FRAMELEN) {
  64                 if (netif_msg_rx_err(priv))
  65                         dev_err(&ndev->dev, "Rx Error (%04x)\n", rxstat);
  66                 ndev->stats.rx_errors++;
  67 @@ -927,6 +927,8 @@ static void enc28j60_hw_rx(struct net_device *ndev)
  68                         ndev->stats.rx_crc_errors++;
  69                 if (RSV_GETBIT(rxstat, RSV_LENCHECKERR))
  70                         ndev->stats.rx_frame_errors++;
  71 +               if (len > MAX_FRAMELEN)
  72 +                       ndev->stats.rx_over_errors++;
  73         } else {
  74                 skb = dev_alloc_skb(len + NET_IP_ALIGN);
  75                 if (!skb) {
  76 diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
  77 index 7d6cf02..b429a0f 100644
  78 --- a/drivers/net/pcmcia/pcnet_cs.c
  79 +++ b/drivers/net/pcmcia/pcnet_cs.c
  80 @@ -591,7 +591,7 @@ static int pcnet_config(struct pcmcia_device *link)
  81      }
  82
  83      if ((link->conf.ConfigBase == 0x03c0)
  84 -       && (link->manf_id == 0x149) && (link->card_id = 0xc1ab)) {
  85 +       && (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) {
  86         printk(KERN_INFO "pcnet_cs: this is an AX88190 card!\n");
  87         printk(KERN_INFO "pcnet_cs: use axnet_cs instead.\n");
  88         goto failed;
  89 diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
  90 index bfff6b5..b97a1c9 100644
  91 --- a/drivers/net/wireless/p54/p54usb.c
  92 +++ b/drivers/net/wireless/p54/p54usb.c
  93 @@ -63,6 +63,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
  94         {USB_DEVICE(0x0bf8, 0x1009)},   /* FUJITSU E-5400 USB D1700*/
  95         {USB_DEVICE(0x0cde, 0x0006)},   /* Medion MD40900 */
  96         {USB_DEVICE(0x0cde, 0x0008)},   /* Sagem XG703A */
  97 +       {USB_DEVICE(0x0cde, 0x0015)},   /* Zcomax XG-705A */
  98         {USB_DEVICE(0x0d8e, 0x3762)},   /* DLink DWL-G120 Cohiba */
  99         {USB_DEVICE(0x09aa, 0x1000)},   /* Spinnaker Proto board */
 100         {USB_DEVICE(0x124a, 0x4025)},   /* IOGear GWU513 (GW3887IK chip) */
 101 diff --git a/fs/inode.c b/fs/inode.c
 102 index 7b2acc1..79777d9 100644
 103 --- a/fs/inode.c
 104 +++ b/fs/inode.c
 105 @@ -590,13 +590,15 @@ void unlock_new_inode(struct inode *inode)
 106         }
 107  #endif
 108         /*
 109 -        * This is special!  We do not need the spinlock
 110 -        * when clearing I_LOCK, because we're guaranteed
 111 -        * that nobody else tries to do anything about the
 112 -        * state of the inode when it is locked, as we
 113 -        * just created it (so there can be no old holders
 114 -        * that haven't tested I_LOCK).
 115 +        * This is special!  We do not need the spinlock when clearing I_LOCK,
 116 +        * because we're guaranteed that nobody else tries to do anything about
 117 +        * the state of the inode when it is locked, as we just created it (so
 118 +        * there can be no old holders that haven't tested I_LOCK).
 119 +        * However we must emit the memory barrier so that other CPUs reliably
 120 +        * see the clearing of I_LOCK after the other inode initialisation has
 121 +        * completed.
 122          */
 123 +       smp_mb();
 124         WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW));
 125         inode->i_state &= ~(I_LOCK|I_NEW);
 126         wake_up_inode(inode);
 127 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
 128 index 2885674..3a08c5a 100644
 129 --- a/mm/hugetlb.c
 130 +++ b/mm/hugetlb.c
 131 @@ -983,6 +983,7 @@ __attribute__((weak)) int alloc_bootmem_huge_page(struct hstate *h)
 132                                 NODE_DATA(h->hugetlb_next_nid),
 133                                 huge_page_size(h), huge_page_size(h), 0);
 134
 135 +               hstate_next_node(h);
 136                 if (addr) {
 137                         /*
 138                          * Use the beginning of the huge page to store the
 139 @@ -993,7 +994,6 @@ __attribute__((weak)) int alloc_bootmem_huge_page(struct hstate *h)
 140                         if (m)
 141                                 goto found;
 142                 }
 143 -               hstate_next_node(h);
 144                 nr_nodes--;
 145         }
 146         return 0;
 147 diff --git a/mm/memory.c b/mm/memory.c
 148 index 3856c36..1300b70 100644
 149 --- a/mm/memory.c
 150 +++ b/mm/memory.c
 151 @@ -2422,7 +2422,8 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
 152                 goto oom_free_page;
 153
 154         entry = mk_pte(page, vma->vm_page_prot);
 155 -       entry = maybe_mkwrite(pte_mkdirty(entry), vma);
 156 +       if (vma->vm_flags & VM_WRITE)
 157 +               entry = pte_mkwrite(pte_mkdirty(entry));
 158
 159         page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
 160         if (!pte_none(*page_table))
 161 diff --git a/mm/mmap.c b/mm/mmap.c
 162 index d330758..8b5aa8e 100644
 163 --- a/mm/mmap.c
 164 +++ b/mm/mmap.c
 165 @@ -575,9 +575,9 @@ again:                      remove_next = 1 + (end > next->vm_end);
 166
 167         /*
 168          * When changing only vma->vm_end, we don't really need
 169 -        * anon_vma lock: but is that case worth optimizing out?
 170 +        * anon_vma lock.
 171          */
 172 -       if (vma->anon_vma)
 173 +       if (vma->anon_vma && (insert || importer || start != vma->vm_start))
 174                 anon_vma = vma->anon_vma;
 175         if (anon_vma) {
 176                 spin_lock(&anon_vma->lock);
 177 diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
 178 index 28c7157..cd9d526 100644
 179 --- a/net/ax25/af_ax25.c
 180 +++ b/net/ax25/af_ax25.c
 181 @@ -539,7 +539,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 182         if (level != SOL_AX25)
 183                 return -ENOPROTOOPT;
 184
 185 -       if (optlen < sizeof(int))
 186 +       if (optlen < (int)sizeof(int))
 187                 return -EINVAL;
 188
 189         if (get_user(opt, (int __user *)optval))
 190 diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
 191 index 9abd450..f908d68 100644
 192 --- a/net/bridge/br_netfilter.c
 193 +++ b/net/bridge/br_netfilter.c
 194 @@ -358,7 +358,7 @@ static int br_nf_pre_routing_finish(struct sk_buff *skb)
 195                                 },
 196                                 .proto = 0,
 197                         };
 198 -                       struct in_device *in_dev = in_dev_get(dev);
 199 +                       struct in_device *in_dev = __in_dev_get_rcu(dev);
 200
 201                         /* If err equals -EHOSTUNREACH the error is due to a
 202                          * martian destination or due to the fact that
 203 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
 204 index 4b50878..ade1ebd 100644
 205 --- a/net/packet/af_packet.c
 206 +++ b/net/packet/af_packet.c
 207 @@ -1500,7 +1500,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 208  static int packet_getsockopt(struct socket *sock, int level, int optname,
 209                              char __user *optval, int __user *optlen)
 210  {
 211 -       int len;
 212 +       unsigned int len;
 213         int val;
 214         struct sock *sk = sock->sk;
 215         struct packet_sock *po = pkt_sk(sk);
 216 @@ -1513,7 +1513,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 217         if (get_user(len, optlen))
 218                 return -EFAULT;
 219
 220 -       if (len < 0)
 221 +       if ((int)len < 0)
 222                 return -EINVAL;
 223
 224         switch(optname) {