Linux 2.6.22.9 - Kernel

This is a discussion on Linux 2.6.22.9 - Kernel ; We (the -stable team) are announcing the release of the 2.6.22.9 kernel. It fixes a number of reported bugs, and any user of the 2.6.22 series is encouraged to upgrade. I'll also be replying to this message with a copy ...

+ Reply to Thread
Results 1 to 2 of 2

Thread: Linux 2.6.22.9

  1. Linux 2.6.22.9

    We (the -stable team) are announcing the release of the 2.6.22.9 kernel.
    It fixes a number of reported bugs, and any user of the 2.6.22 series is
    encouraged to upgrade.

    I'll also be replying to this message with a copy of the patch between
    2.6.22.8 and 2.6.22.9

    The updated 2.6.22.y git tree can be found at:
    git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
    and can be browsed at the normal kernel.org git web browser:
    http://git.kernel.org/?p=linux/kerne....git;a=summary

    thanks,

    greg k-h

    --------

    Documentation/dvb/get_dvb_firmware | 26 ++++-----
    Makefile | 2
    arch/powerpc/kernel/process.c | 6 +-
    arch/sparc64/kernel/pci.c | 13 ++++
    block/ll_rw_blk.c | 13 ++--
    crypto/blkcipher.c | 11 ++--
    drivers/acpi/tables/tbutils.c | 71 ++++++++++++++++++++++++++
    drivers/block/DAC960.c | 18 ++++--
    drivers/block/DAC960.h | 7 --
    drivers/firewire/fw-ohci.c | 10 +--
    drivers/hwmon/lm78.c | 2
    drivers/hwmon/w83781d.c | 2
    drivers/ieee1394/ieee1394_core.c | 2
    drivers/ieee1394/ohci1394.c | 4 -
    drivers/media/dvb/b2c2/flexcop-i2c.c | 7 ++
    drivers/media/video/cx88/cx88-mpeg.c | 2
    drivers/media/video/ivtv/ivtv-ioctl.c | 1
    drivers/media/video/pwc/pwc-if.c | 2
    drivers/mtd/Makefile | 2
    drivers/mtd/mtdpart.c | 4 -
    drivers/mtd/mtdsuper.c | 2
    drivers/net/forcedeth.c | 2
    drivers/net/wireless/bcm43xx/bcm43xx_main.c | 28 +++++++---
    drivers/net/wireless/bcm43xx/bcm43xx_main.h | 2
    drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c | 2
    drivers/scsi/3w-9xxx.c | 18 ++++--
    drivers/usb/core/driver.c | 2
    fs/afs/mntpt.c | 2
    fs/ext3/namei.c | 73 ++++++++++++++++++++++++---
    fs/ext4/namei.c | 73 ++++++++++++++++++++++++---
    fs/jffs2/fs.c | 2
    fs/locks.c | 2
    fs/nfs/super.c | 2
    fs/splice.c | 4 -
    include/linux/Kbuild | 1
    init/Kconfig | 1
    kernel/futex_compat.c | 4 -
    kernel/signal.c | 19 +++----
    kernel/sys.c | 3 -
    net/8021q/vlan_dev.c | 12 ++++
    net/bridge/br_netfilter.c | 12 ++--
    net/core/datagram.c | 3 +
    net/core/pktgen.c | 10 +++
    net/decnet/dn_dev.c | 2
    net/ipv4/ah4.c | 2
    net/ipv4/devinet.c | 2
    net/ipv4/inet_diag.c | 4 +
    net/ipv4/tcp_input.c | 21 +++++--
    net/ipv6/addrconf.c | 2
    net/ipv6/ip6_output.c | 5 +
    net/ipv6/ndisc.c | 2
    net/ipv6/raw.c | 3 -
    net/sunrpc/svcsock.c | 6 +-
    scripts/kconfig/conf.c | 21 ++++---
    54 files changed, 405 insertions(+), 149 deletions(-)

    Summary of changes from v2.6.22.8 to v2.6.22.9
    ==============================================

    Adam Radford (1):
    3w-9xxx: Fix dma mask setting

    Adit Ranadive (1):
    Fix pktgen src_mac handling.

    Alexey Dobriyan (1):
    nfs: fix oops re sysctls and V4 support

    Andreas Arens (1):
    DVB: get_dvb_firmware: update script for new location of tda10046 firmware

    Andreas Gruenbacher (1):
    afs: mntput called before dput

    Andrew Morton (2):
    disable sys_timerfd()
    Fix "Fix DAC960 driver on machines which don't support 64-bit DMA"

    Arnd Bergmann (1):
    futex_compat: fix list traversal bugs

    David Howells (1):
    MTD: Initialise s_flags in get_sb_mtd_aux()

    David Miller (1):
    Fix sparc64 v100 platform booting.

    Denis V. Lunev (1):
    Fix IPV6 DAD handling

    Eric Sandeen (2):
    ext34: ensure do_split leaves enough free space in both blocks
    dir_index: error out instead of BUG on corrupt dx dirs

    Evgeniy Polyakov (1):
    Fix oops in vlan and bridging code

    Greg Kroah-Hartman (1):
    Linux 2.6.22.9

    Hans Verkuil (1):
    V4L: ivtv: fix VIDIOC_S_FBUF: new OSD values were never set

    Herbert Xu (2):
    crypto: blkcipher_get_spot() handling of buffer at end of page
    Fix datagram recvmsg NULL iov handling regression.

    Ilpo Järvinen (2):
    Handle snd_una in tcp_cwnd_down()
    Fix TCP DSACK cwnd handling

    Jason Lunz (1):
    JFFS2: fix write deadlock regression

    Jean Delvare (2):
    hwmon: End of I/O region off-by-one
    Fix debug regression in video/pwc

    Jens Axboe (2):
    splice: fix direct splice error handling
    Fix race with shared tag queue maps

    Jiri Kosina (1):
    Fix ipv6 source address handling.

    Kumar Gala (1):
    POWERPC: Flush registers to proper task context

    Larry Finger (1):
    bcm43xx: Fix cancellation of work queue crashes

    Matthew Wilcox (1):
    Fix DAC960 driver on machines which don't support 64-bit DMA

    Michael Krufky (1):
    DVB: get_dvb_firmware: update script for new location of sp8870 firmware

    Nathael Pajani (1):
    USB: fix linked list insertion bugfix for usb core

    Neil Brown (1):
    Correctly close old nfsd/lockd sockets.

    Nick Bowler (1):
    Fix IPSEC AH4 options handling

    Oleg Nesterov (2):
    setpgid(child) fails if the child was forked by sub-thread
    sigqueue_free: fix the race with collect_signal()

    Patrick McHardy (2):
    Fix decnet device address listing.
    Fix inet_diag OOPS.

    Pavel Emelyanov (1):
    Leases can be hidden by flocks

    Roman Zippel (1):
    kconfig: oldconfig shall not set symbols if it does not need to

    Satyam Sharma (1):
    MTD: Makefile fix for mtdsuper

    Stefan Richter (2):
    firewire: fw-ohci: ignore failure of pci_set_power_state (fix suspend regression)
    ieee1394: ohci1394: fix initialization if built non-modular

    Stephen Hemminger (2):
    Fix device address listing for ipv4.
    Fix tc_ematch kbuild

    Steven Toth (1):
    V4L: cx88: Avoid a NULL pointer dereference during mpeg_open()

    Trent Piepho (1):
    DVB: b2c2-flexcop: fix Airstar HD5000 tuning regression

    Willy Tarreau (1):
    fix realtek phy id in forcedeth

    Wolfgang Walter (1):
    rpc: fix garbage in printk in svc_tcp_accept()

    YOSHIFUJI Hideaki (2):
    Fix IPV6 append OOPS.
    Fix ipv6 double-sock-release with MSG_CONFIRM

    Zhao Yakui (1):
    ACPI: Validate XSDT, use RSDT if XSDT fails

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

  2. Re: Linux 2.6.22.9


    diff --git a/Documentation/dvb/get_dvb_firmware b/Documentation/dvb/get_dvb_firmware
    index 4820366..6cb3080 100644
    --- a/Documentation/dvb/get_dvb_firmware
    +++ b/Documentation/dvb/get_dvb_firmware
    @@ -56,7 +56,7 @@ syntax();

    sub sp8870 {
    my $sourcefile = "tt_Premium_217g.zip";
    - my $url = "http://www.technotrend.de/new/217g/$sourcefile";
    + my $url = "http://www.softwarepatch.pl/9999ccd06a4813cb827dbb0005071c71/$sourcefile";
    my $hash = "53970ec17a538945a6d8cb608a7b3899";
    my $outfile = "dvb-fe-sp8870.fw";
    my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);
    @@ -110,21 +110,21 @@ sub tda10045 {
    }

    sub tda10046 {
    - my $sourcefile = "tt_budget_217g.zip";
    - my $url = "http://www.technotrend.de/new/217g/$sourcefile";
    - my $hash = "6a7e1e2f2644b162ff0502367553c72d";
    - my $outfile = "dvb-fe-tda10046.fw";
    - my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);
    + my $sourcefile = "TT_PCI_2.19h_28_11_2006.zip";
    + my $url = "http://technotrend-online.com/download/software/219/$sourcefile";
    + my $hash = "6a7e1e2f2644b162ff0502367553c72d";
    + my $outfile = "dvb-fe-tda10046.fw";
    + my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);

    - checkstandard();
    + checkstandard();

    - wgetfile($sourcefile, $url);
    - unzip($sourcefile, $tmpdir);
    - extract("$tmpdir/software/OEM/PCI/App/ttlcdacc.dll", 0x3f731, 24478, "$tmpdir/fwtmp");
    - verify("$tmpdir/fwtmp", $hash);
    - copy("$tmpdir/fwtmp", $outfile);
    + wgetfile($sourcefile, $url);
    + unzip($sourcefile, $tmpdir);
    + extract("$tmpdir/TT_PCI_2.19h_28_11_2006/software/OEM/PCI/App/ttlcdacc.dll", 0x65389, 24478, "$tmpdir/fwtmp");
    + verify("$tmpdir/fwtmp", $hash);
    + copy("$tmpdir/fwtmp", $outfile);

    - $outfile;
    + $outfile;
    }

    sub tda10046lifeview {
    diff --git a/Makefile b/Makefile
    index dc7a45d..6f8adbb 100644
    --- a/Makefile
    +++ b/Makefile
    @@ -1,7 +1,7 @@
    VERSION = 2
    PATCHLEVEL = 6
    SUBLEVEL = 22
    -EXTRAVERSION = .8
    +EXTRAVERSION = .9
    NAME = Holy Dancing Manatees, Batman!

    # *DOCUMENTATION*
    diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
    index 6e2f035..87c474d 100644
    --- a/arch/powerpc/kernel/process.c
    +++ b/arch/powerpc/kernel/process.c
    @@ -83,7 +83,7 @@ void flush_fp_to_thread(struct task_struct *tsk)
    */
    BUG_ON(tsk != current);
    #endif
    - giveup_fpu(current);
    + giveup_fpu(tsk);
    }
    preempt_enable();
    }
    @@ -143,7 +143,7 @@ void flush_altivec_to_thread(struct task_struct *tsk)
    #ifdef CONFIG_SMP
    BUG_ON(tsk != current);
    #endif
    - giveup_altivec(current);
    + giveup_altivec(tsk);
    }
    preempt_enable();
    }
    @@ -182,7 +182,7 @@ void flush_spe_to_thread(struct task_struct *tsk)
    #ifdef CONFIG_SMP
    BUG_ON(tsk != current);
    #endif
    - giveup_spe(current);
    + giveup_spe(tsk);
    }
    preempt_enable();
    }
    diff --git a/arch/sparc64/kernel/pci.c b/arch/sparc64/kernel/pci.c
    index 3bc136a..154f10e 100644
    --- a/arch/sparc64/kernel/pci.c
    +++ b/arch/sparc64/kernel/pci.c
    @@ -751,7 +751,7 @@ static void __devinit pci_of_scan_bus(struct pci_pbm_info *pbm,
    {
    struct device_node *child;
    const u32 *reg;
    - int reglen, devfn;
    + int reglen, devfn, prev_devfn;
    struct pci_dev *dev;

    if (ofpci_verbose)
    @@ -759,14 +759,25 @@ static void __devinit pci_of_scan_bus(struct pci_pbm_info *pbm,
    node->full_name, bus->number);

    child = NULL;
    + prev_devfn = -1;
    while ((child = of_get_next_child(node, child)) != NULL) {
    if (ofpci_verbose)
    printk(" * %s\n", child->full_name);
    reg = of_get_property(child, "reg", &reglen);
    if (reg == NULL || reglen < 20)
    continue;
    +
    devfn = (reg[0] >> 8) & 0xff;

    + /* This is a workaround for some device trees
    + * which list PCI devices twice. On the V100
    + * for example, device number 3 is listed twice.
    + * Once as "pm" and once again as "lomp".
    + */
    + if (devfn == prev_devfn)
    + continue;
    + prev_devfn = devfn;
    +
    /* create a new pci_dev for this device */
    dev = of_create_pci_dev(pbm, child, bus, devfn, 0);
    if (!dev)
    diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
    index c99b463..4369ff2 100644
    --- a/block/ll_rw_blk.c
    +++ b/block/ll_rw_blk.c
    @@ -1081,12 +1081,6 @@ void blk_queue_end_tag(request_queue_t *q, struct request *rq)
    */
    return;

    - if (unlikely(!__test_and_clear_bit(tag, bqt->tag_map))) {
    - printk(KERN_ERR "%s: attempt to clear non-busy tag (%d)\n",
    - __FUNCTION__, tag);
    - return;
    - }
    -
    list_del_init(&rq->queuelist);
    rq->cmd_flags &= ~REQ_QUEUED;
    rq->tag = -1;
    @@ -1096,6 +1090,13 @@ void blk_queue_end_tag(request_queue_t *q, struct request *rq)
    __FUNCTION__, tag);

    bqt->tag_index[tag] = NULL;
    +
    + if (unlikely(!test_and_clear_bit(tag, bqt->tag_map))) {
    + printk(KERN_ERR "%s: attempt to clear non-busy tag (%d)\n",
    + __FUNCTION__, tag);
    + return;
    + }
    +
    bqt->busy--;
    }

    diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
    index 8edf40c..cce9236 100644
    --- a/crypto/blkcipher.c
    +++ b/crypto/blkcipher.c
    @@ -59,11 +59,13 @@ static inline void blkcipher_unmap_dst(struct blkcipher_walk *walk)
    scatterwalk_unmap(walk->dst.virt.addr, 1);
    }

    +/* Get a spot of the specified length that does not straddle a page.
    + * The caller needs to ensure that there is enough space for this operation.
    + */
    static inline u8 *blkcipher_get_spot(u8 *start, unsigned int len)
    {
    - if (offset_in_page(start + len) < len)
    - return (u8 *)((unsigned long)(start + len) & PAGE_MASK);
    - return start;
    + u8 *end_page = (u8 *)(((unsigned long)(start + len - 1)) & PAGE_MASK);
    + return start > end_page ? start : end_page;
    }

    static inline unsigned int blkcipher_done_slow(struct crypto_blkcipher *tfm,
    @@ -155,7 +157,8 @@ static inline int blkcipher_next_slow(struct blkcipher_desc *desc,
    if (walk->buffer)
    goto ok;

    - n = bsize * 2 + (alignmask & ~(crypto_tfm_ctx_alignment() - 1));
    + n = bsize * 3 - (alignmask + 1) +
    + (alignmask & ~(crypto_tfm_ctx_alignment() - 1));
    walk->buffer = kmalloc(n, GFP_ATOMIC);
    if (!walk->buffer)
    return blkcipher_walk_done(desc, walk, -ENOMEM);
    diff --git a/drivers/acpi/tables/tbutils.c b/drivers/acpi/tables/tbutils.c
    index 1da64b4..8cc9492 100644
    --- a/drivers/acpi/tables/tbutils.c
    +++ b/drivers/acpi/tables/tbutils.c
    @@ -51,6 +51,65 @@ ACPI_MODULE_NAME("tbutils")
    static acpi_physical_address
    acpi_tb_get_root_table_entry(u8 * table_entry,
    acpi_native_uint table_entry_size);
    +/************************************************** *****************************
    + *
    + * FUNCTION: acpi_tb_check_xsdt
    + *
    + * PARAMETERS: address - Pointer to the XSDT
    + *
    + * RETURN: status
    + * AE_OK - XSDT is okay
    + * AE_NO_MEMORY - can't map XSDT
    + * AE_INVALID_TABLE_LENGTH - invalid table length
    + * AE_NULL_ENTRY - XSDT has NULL entry
    + *
    + * DESCRIPTION: validate XSDT
    +************************************************* *****************************/
    +
    +static acpi_status
    +acpi_tb_check_xsdt(acpi_physical_address address)
    +{
    + struct acpi_table_header *table;
    + u32 length;
    + u64 xsdt_entry_address;
    + u8 *table_entry;
    + u32 table_count;
    + int i;
    +
    + table = acpi_os_map_memory(address, sizeof(struct acpi_table_header));
    + if (!table)
    + return AE_NO_MEMORY;
    +
    + length = table->length;
    + acpi_os_unmap_memory(table, sizeof(struct acpi_table_header));
    + if (length < sizeof(struct acpi_table_header))
    + return AE_INVALID_TABLE_LENGTH;
    +
    + table = acpi_os_map_memory(address, length);
    + if (!table)
    + return AE_NO_MEMORY;
    +
    + /* Calculate the number of tables described in XSDT */
    + table_count =
    + (u32) ((table->length -
    + sizeof(struct acpi_table_header)) / sizeof(u64));
    + table_entry =
    + ACPI_CAST_PTR(u8, table) + sizeof(struct acpi_table_header);
    + for (i = 0; i < table_count; i++) {
    + ACPI_MOVE_64_TO_64(&xsdt_entry_address, table_entry);
    + if (!xsdt_entry_address) {
    + /* XSDT has NULL entry */
    + break;
    + }
    + table_entry += sizeof(u64);
    + }
    + acpi_os_unmap_memory(table, length);
    +
    + if (i < table_count)
    + return AE_NULL_ENTRY;
    + else
    + return AE_OK;
    +}

    /************************************************** *****************************
    *
    @@ -341,6 +400,7 @@ acpi_tb_parse_root_table(acpi_physical_address rsdp_address, u8 flags)
    u32 table_count;
    struct acpi_table_header *table;
    acpi_physical_address address;
    + acpi_physical_address rsdt_address;
    u32 length;
    u8 *table_entry;
    acpi_status status;
    @@ -369,6 +429,8 @@ acpi_tb_parse_root_table(acpi_physical_address rsdp_address, u8 flags)
    */
    address = (acpi_physical_address) rsdp->xsdt_physical_address;
    table_entry_size = sizeof(u64);
    + rsdt_address = (acpi_physical_address)
    + rsdp->rsdt_physical_address;
    } else {
    /* Root table is an RSDT (32-bit physical addresses) */

    @@ -382,6 +444,15 @@ acpi_tb_parse_root_table(acpi_physical_address rsdp_address, u8 flags)
    */
    acpi_os_unmap_memory(rsdp, sizeof(struct acpi_table_rsdp));

    + if (table_entry_size == sizeof(u64)) {
    + if (acpi_tb_check_xsdt(address) == AE_NULL_ENTRY) {
    + /* XSDT has NULL entry, RSDT is used */
    + address = rsdt_address;
    + table_entry_size = sizeof(u32);
    + ACPI_WARNING((AE_INFO, "BIOS XSDT has NULL entry,"
    + "using RSDT"));
    + }
    + }
    /* Map the RSDT/XSDT table header to get the full table length */

    table = acpi_os_map_memory(address, sizeof(struct acpi_table_header));
    diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
    index 92bf868..84d6aa5 100644
    --- a/drivers/block/DAC960.c
    +++ b/drivers/block/DAC960.c
    @@ -17,8 +17,8 @@
    */


    -#define DAC960_DriverVersion "2.5.48"
    -#define DAC960_DriverDate "14 May 2006"
    +#define DAC960_DriverVersion "2.5.49"
    +#define DAC960_DriverDate "21 Aug 2007"


    #include
    @@ -31,6 +31,7 @@
    #include
    #include
    #include
    +#include
    #include
    #include
    #include
    @@ -1165,9 +1166,9 @@ static bool DAC960_V1_EnableMemoryMailboxInterface(DAC960_Cont roller_T
    int i;


    - if (pci_set_dma_mask(Controller->PCIDevice, DAC690_V1_PciDmaMask))
    + if (pci_set_dma_mask(Controller->PCIDevice, DMA_32BIT_MASK))
    return DAC960_Failure(Controller, "DMA mask out of range");
    - Controller->BounceBufferLimit = DAC690_V1_PciDmaMask;
    + Controller->BounceBufferLimit = DMA_32BIT_MASK;

    if ((hw_type == DAC960_PD_Controller) || (hw_type == DAC960_P_Controller)) {
    CommandMailboxesSize = 0;
    @@ -1368,9 +1369,12 @@ static bool DAC960_V2_EnableMemoryMailboxInterface(DAC960_Cont roller_T
    dma_addr_t CommandMailboxDMA;
    DAC960_V2_CommandStatus_T CommandStatus;

    - if (pci_set_dma_mask(Controller->PCIDevice, DAC690_V2_PciDmaMask))
    - return DAC960_Failure(Controller, "DMA mask out of range");
    - Controller->BounceBufferLimit = DAC690_V2_PciDmaMask;
    + if (!pci_set_dma_mask(Controller->PCIDevice, DMA_64BIT_MASK))
    + Controller->BounceBufferLimit = DMA_64BIT_MASK;
    + else if (!pci_set_dma_mask(Controller->PCIDevice, DMA_32BIT_MASK))
    + Controller->BounceBufferLimit = DMA_32BIT_MASK;
    + else
    + return DAC960_Failure(Controller, "DMA mask out of range");

    /* This is a temporary dma mapping, used only in the scope of this function */
    CommandMailbox = pci_alloc_consistent(PCI_Device,
    diff --git a/drivers/block/DAC960.h b/drivers/block/DAC960.h
    index f5e2436..85fa9bb 100644
    --- a/drivers/block/DAC960.h
    +++ b/drivers/block/DAC960.h
    @@ -61,13 +61,6 @@
    #define DAC960_V2_MaxPhysicalDevices 272

    /*
    - Define the pci dma mask supported by DAC960 V1 and V2 Firmware Controlers
    - */
    -
    -#define DAC690_V1_PciDmaMask 0xffffffff
    -#define DAC690_V2_PciDmaMask 0xffffffffffffffffULL
    -
    -/*
    Define a 32/64 bit I/O Address data type.
    */

    diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
    index 05a5ff1..f1cd9d3 100644
    --- a/drivers/firewire/fw-ohci.c
    +++ b/drivers/firewire/fw-ohci.c
    @@ -1934,14 +1934,12 @@ static int pci_suspend(struct pci_dev *pdev, pm_message_t state)
    free_irq(pdev->irq, ohci);
    err = pci_save_state(pdev);
    if (err) {
    - fw_error("pci_save_state failed with %d", err);
    + fw_error("pci_save_state failed with %d\n", err);
    return err;
    }
    err = pci_set_power_state(pdev, pci_choose_state(pdev, state));
    - if (err) {
    - fw_error("pci_set_power_state failed with %d", err);
    - return err;
    - }
    + if (err)
    + fw_error("pci_set_power_state failed with %d\n", err);

    return 0;
    }
    @@ -1955,7 +1953,7 @@ static int pci_resume(struct pci_dev *pdev)
    pci_restore_state(pdev);
    err = pci_enable_device(pdev);
    if (err) {
    - fw_error("pci_enable_device failed with %d", err);
    + fw_error("pci_enable_device failed with %d\n", err);
    return err;
    }

    diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
    index 9fb572f..3507113 100644
    --- a/drivers/hwmon/lm78.c
    +++ b/drivers/hwmon/lm78.c
    @@ -882,7 +882,7 @@ static int __init lm78_isa_device_add(unsigned short address)
    {
    struct resource res = {
    .start = address,
    - .end = address + LM78_EXTENT,
    + .end = address + LM78_EXTENT - 1,
    .name = "lm78",
    .flags = IORESOURCE_IO,
    };
    diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
    index c95909c..dcc941a 100644
    --- a/drivers/hwmon/w83781d.c
    +++ b/drivers/hwmon/w83781d.c
    @@ -1746,7 +1746,7 @@ w83781d_isa_device_add(unsigned short address)
    {
    struct resource res = {
    .start = address,
    - .end = address + W83781D_EXTENT,
    + .end = address + W83781D_EXTENT - 1,
    .name = "w83781d",
    .flags = IORESOURCE_IO,
    };
    diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c
    index 8f71b6a..ac07a05 100644
    --- a/drivers/ieee1394/ieee1394_core.c
    +++ b/drivers/ieee1394/ieee1394_core.c
    @@ -1279,7 +1279,7 @@ static void __exit ieee1394_cleanup(void)
    unregister_chrdev_region(IEEE1394_CORE_DEV, 256);
    }

    -fs_initcall(ieee1394_init); /* same as ohci1394 */
    +module_init(ieee1394_init);
    module_exit(ieee1394_cleanup);

    /* Exported symbols */
    diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
    index 5dadfd2..e65760f 100644
    --- a/drivers/ieee1394/ohci1394.c
    +++ b/drivers/ieee1394/ohci1394.c
    @@ -3773,7 +3773,5 @@ static int __init ohci1394_init(void)
    return pci_register_driver(&ohci1394_pci_driver);
    }

    -/* Register before most other device drivers.
    - * Useful for remote debugging via physical DMA, e.g. using firescope. */
    -fs_initcall(ohci1394_init);
    +module_init(ohci1394_init);
    module_exit(ohci1394_cleanup);
    diff --git a/drivers/media/dvb/b2c2/flexcop-i2c.c b/drivers/media/dvb/b2c2/flexcop-i2c.c
    index 02a0ea6..6bf858a 100644
    --- a/drivers/media/dvb/b2c2/flexcop-i2c.c
    +++ b/drivers/media/dvb/b2c2/flexcop-i2c.c
    @@ -135,6 +135,13 @@ static int flexcop_master_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msgs
    struct flexcop_device *fc = i2c_get_adapdata(i2c_adap);
    int i, ret = 0;

    + /* Some drivers use 1 byte or 0 byte reads as probes, which this
    + * driver doesn't support. These probes will always fail, so this
    + * hack makes them always succeed. If one knew how, it would of
    + * course be better to actually do the read. */
    + if (num == 1 && msgs[0].flags == I2C_M_RD && msgs[0].len <= 1)
    + return 1;
    +
    if (mutex_lock_interruptible(&fc->i2c_mutex))
    return -ERESTARTSYS;

    diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c
    index 543b05e..c36e2b7 100644
    --- a/drivers/media/video/cx88/cx88-mpeg.c
    +++ b/drivers/media/video/cx88/cx88-mpeg.c
    @@ -580,7 +580,7 @@ struct cx8802_dev * cx8802_get_device(struct inode *inode)

    list_for_each(list,&cx8802_devlist) {
    h = list_entry(list, struct cx8802_dev, devlist);
    - if (h->mpeg_dev->minor == minor)
    + if (h->mpeg_dev && h->mpeg_dev->minor == minor)
    return h;
    }

    diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
    index 57af176..dcfbaa9 100644
    --- a/drivers/media/video/ivtv/ivtv-ioctl.c
    +++ b/drivers/media/video/ivtv/ivtv-ioctl.c
    @@ -1183,6 +1183,7 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, struct file *filp, unsigned int cmd, void
    itv->osd_global_alpha_state = (fb->flags & V4L2_FBUF_FLAG_GLOBAL_ALPHA) != 0;
    itv->osd_local_alpha_state = (fb->flags & V4L2_FBUF_FLAG_LOCAL_ALPHA) != 0;
    itv->osd_color_key_state = (fb->flags & V4L2_FBUF_FLAG_CHROMAKEY) != 0;
    + ivtv_set_osd_alpha(itv);
    break;
    }

    diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
    index cd3d001..5227978 100644
    --- a/drivers/media/video/pwc/pwc-if.c
    +++ b/drivers/media/video/pwc/pwc-if.c
    @@ -1243,7 +1243,7 @@ static int pwc_video_close(struct inode *inode, struct file *file)
    PWC_ERROR("Failed to power down camera (%d)\n", i);
    }
    pdev->vopen--;
    - PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", i);
    + PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", pdev->vopen);
    } else {
    pwc_cleanup(pdev);
    /* Free memory (don't set pdev to 0 just yet) */
    diff --git a/drivers/mtd/Makefile b/drivers/mtd/Makefile
    index 451adcc..6d958a4 100644
    --- a/drivers/mtd/Makefile
    +++ b/drivers/mtd/Makefile
    @@ -3,9 +3,9 @@
    #

    # Core functionality.
    +obj-$(CONFIG_MTD) += mtd.o
    mtd-y := mtdcore.o mtdsuper.o
    mtd-$(CONFIG_MTD_PARTITIONS) += mtdpart.o
    -obj-$(CONFIG_MTD) += $(mtd-y)

    obj-$(CONFIG_MTD_CONCAT) += mtdconcat.o
    obj-$(CONFIG_MTD_REDBOOT_PARTS) += redboot.o
    diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
    index 9c62368..6174a97 100644
    --- a/drivers/mtd/mtdpart.c
    +++ b/drivers/mtd/mtdpart.c
    @@ -560,7 +560,3 @@ int parse_mtd_partitions(struct mtd_info *master, const char **types,
    EXPORT_SYMBOL_GPL(parse_mtd_partitions);
    EXPORT_SYMBOL_GPL(register_mtd_parser);
    EXPORT_SYMBOL_GPL(deregister_mtd_parser);
    -
    -MODULE_LICENSE("GPL");
    -MODULE_AUTHOR("Nicolas Pitre ");
    -MODULE_DESCRIPTION("Generic support for partitioning of MTD devices");
    diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
    index aca3319..9b430f2 100644
    --- a/drivers/mtd/mtdsuper.c
    +++ b/drivers/mtd/mtdsuper.c
    @@ -70,6 +70,8 @@ static int get_sb_mtd_aux(struct file_system_type *fs_type, int flags,
    DEBUG(1, "MTDSB: New superblock for device %d (\"%s\")\n",
    mtd->index, mtd->name);

    + sb->s_flags = flags;
    +
    ret = fill_super(sb, data, flags & MS_SILENT ? 1 : 0);
    if (ret < 0) {
    up_write(&sb->s_umount);
    diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
    index 4a7b5f4..765fb75 100644
    --- a/drivers/net/forcedeth.c
    +++ b/drivers/net/forcedeth.c
    @@ -551,7 +551,7 @@ union ring_type {
    #define PHY_OUI_MARVELL 0x5043
    #define PHY_OUI_CICADA 0x03f1
    #define PHY_OUI_VITESSE 0x01c1
    -#define PHY_OUI_REALTEK 0x01c1
    +#define PHY_OUI_REALTEK 0x0732
    #define PHYID1_OUI_MASK 0x03ff
    #define PHYID1_OUI_SHFT 6
    #define PHYID2_OUI_MASK 0xfc00
    diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
    index ef6b253..dadee85 100644
    --- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
    +++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
    @@ -3183,6 +3183,9 @@ static void bcm43xx_periodic_work_handler(struct work_struct *work)
    unsigned long orig_trans_start = 0;

    mutex_lock(&bcm->mutex);
    + /* keep from doing and rearming periodic work if shutting down */
    + if (bcm43xx_status(bcm) == BCM43xx_STAT_UNINIT)
    + goto unlock_mutex;
    if (unlikely(bcm->periodic_state % 60 == 0)) {
    /* Periodic work will take a long time, so we want it to
    * be preemtible.
    @@ -3228,14 +3231,10 @@ static void bcm43xx_periodic_work_handler(struct work_struct *work)
    mmiowb();
    bcm->periodic_state++;
    spin_unlock_irqrestore(&bcm->irq_lock, flags);
    +unlock_mutex:
    mutex_unlock(&bcm->mutex);
    }

    -void bcm43xx_periodic_tasks_delete(struct bcm43xx_private *bcm)
    -{
    - cancel_rearming_delayed_work(&bcm->periodic_work);
    -}
    -
    void bcm43xx_periodic_tasks_setup(struct bcm43xx_private *bcm)
    {
    struct delayed_work *work = &bcm->periodic_work;
    @@ -3285,6 +3284,14 @@ static int bcm43xx_rng_init(struct bcm43xx_private *bcm)
    return err;
    }

    +void bcm43xx_cancel_work(struct bcm43xx_private *bcm)
    +{
    + /* The system must be unlocked when this routine is entered.
    + * If not, the next 2 steps may deadlock */
    + cancel_work_sync(&bcm->restart_work);
    + cancel_rearming_delayed_work(&bcm->periodic_work);
    +}
    +
    static int bcm43xx_shutdown_all_wireless_cores(struct bcm43xx_private *bcm)
    {
    int ret = 0;
    @@ -3321,7 +3328,12 @@ static void bcm43xx_free_board(struct bcm43xx_private *bcm)
    {
    bcm43xx_rng_exit(bcm);
    bcm43xx_sysfs_unregister(bcm);
    - bcm43xx_periodic_tasks_delete(bcm);
    +
    + mutex_lock(&(bcm)->mutex);
    + bcm43xx_set_status(bcm, BCM43xx_STAT_UNINIT);
    + mutex_unlock(&(bcm)->mutex);
    +
    + bcm43xx_cancel_work(bcm);

    mutex_lock(&(bcm)->mutex);
    bcm43xx_shutdown_all_wireless_cores(bcm);
    @@ -4018,7 +4030,7 @@ static int bcm43xx_net_stop(struct net_device *net_dev)
    err = bcm43xx_disable_interrupts_sync(bcm);
    assert(!err);
    bcm43xx_free_board(bcm);
    - flush_scheduled_work();
    + bcm43xx_cancel_work(bcm);

    return 0;
    }
    @@ -4150,9 +4162,9 @@ static void bcm43xx_chip_reset(struct work_struct *work)
    struct bcm43xx_phyinfo *phy;
    int err = -ENODEV;

    + bcm43xx_cancel_work(bcm);
    mutex_lock(&(bcm)->mutex);
    if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED) {
    - bcm43xx_periodic_tasks_delete(bcm);
    phy = bcm43xx_current_phy(bcm);
    err = bcm43xx_select_wireless_core(bcm, phy->type);
    if (!err)
    diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.h b/drivers/net/wireless/bcm43xx/bcm43xx_main.h
    index c8f3c53..14cfbeb 100644
    --- a/drivers/net/wireless/bcm43xx/bcm43xx_main.h
    +++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.h
    @@ -122,7 +122,7 @@ void bcm43xx_wireless_core_reset(struct bcm43xx_private *bcm, int connect_phy);
    void bcm43xx_mac_suspend(struct bcm43xx_private *bcm);
    void bcm43xx_mac_enable(struct bcm43xx_private *bcm);

    -void bcm43xx_periodic_tasks_delete(struct bcm43xx_private *bcm);
    +void bcm43xx_cancel_work(struct bcm43xx_private *bcm);
    void bcm43xx_periodic_tasks_setup(struct bcm43xx_private *bcm);

    void bcm43xx_controller_restart(struct bcm43xx_private *bcm, const char *reason);
    diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
    index c71b998..8ab5f93 100644
    --- a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
    +++ b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
    @@ -327,7 +327,7 @@ static ssize_t bcm43xx_attr_phymode_store(struct device *dev,
    goto out;
    }

    - bcm43xx_periodic_tasks_delete(bcm);
    + bcm43xx_cancel_work(bcm);
    mutex_lock(&(bcm)->mutex);
    err = bcm43xx_select_wireless_core(bcm, phytype);
    if (!err)
    diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
    index eb766c3..0d24c39 100644
    --- a/drivers/scsi/3w-9xxx.c
    +++ b/drivers/scsi/3w-9xxx.c
    @@ -4,7 +4,7 @@
    Written By: Adam Radford
    Modifications By: Tom Couch

    - Copyright (C) 2004-2006 Applied Micro Circuits Corporation.
    + Copyright (C) 2004-2007 Applied Micro Circuits Corporation.

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    @@ -69,6 +69,7 @@
    2.26.02.008 - Free irq handler in __twa_shutdown().
    Serialize reset code.
    Add support for 9650SE controllers.
    + 2.26.02.009 - Fix dma mask setting to fallback to 32-bit if 64-bit fails.
    */

    #include
    @@ -92,7 +93,7 @@
    #include "3w-9xxx.h"

    /* Globals */
    -#define TW_DRIVER_VERSION "2.26.02.008"
    +#define TW_DRIVER_VERSION "2.26.02.009"
    static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
    static unsigned int twa_device_extension_count;
    static int twa_major = -1;
    @@ -2063,11 +2064,14 @@ static int __devinit twa_probe(struct pci_dev *pdev, const struct pci_device_id

    pci_set_master(pdev);

    - retval = pci_set_dma_mask(pdev, sizeof(dma_addr_t) > 4 ? DMA_64BIT_MASK : DMA_32BIT_MASK);
    - if (retval) {
    - TW_PRINTK(host, TW_DRIVER, 0x23, "Failed to set dma mask");
    - goto out_disable_device;
    - }
    + if (pci_set_dma_mask(pdev, DMA_64BIT_MASK)
    + || pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK))
    + if (pci_set_dma_mask(pdev, DMA_32BIT_MASK)
    + || pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK)) {
    + TW_PRINTK(host, TW_DRIVER, 0x23, "Failed to set dma mask");
    + retval = -ENODEV;
    + goto out_disable_device;
    + }

    host = scsi_host_alloc(&driver_template, sizeof(TW_Device_Extension));
    if (!host) {
    diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
    index 2619986..61699f7 100644
    --- a/drivers/usb/core/driver.c
    +++ b/drivers/usb/core/driver.c
    @@ -58,7 +58,7 @@ ssize_t usb_store_new_id(struct usb_dynids *dynids,
    dynid->id.match_flags = USB_DEVICE_ID_MATCH_DEVICE;

    spin_lock(&dynids->lock);
    - list_add_tail(&dynids->list, &dynid->node);
    + list_add_tail(&dynid->node, &dynids->list);
    spin_unlock(&dynids->lock);

    if (get_driver(driver)) {
    diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c
    index a3684dc..6f8c96f 100644
    --- a/fs/afs/mntpt.c
    +++ b/fs/afs/mntpt.c
    @@ -235,8 +235,8 @@ static void *afs_mntpt_follow_link(struct dentry *dentry, struct nameidata *nd)
    err = do_add_mount(newmnt, nd, MNT_SHRINKABLE, &afs_vfsmounts);
    switch (err) {
    case 0:
    - mntput(nd->mnt);
    dput(nd->dentry);
    + mntput(nd->mnt);
    nd->mnt = newmnt;
    nd->dentry = dget(newmnt->mnt_root);
    schedule_delayed_work(&afs_mntpt_expiry_timer,
    diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
    index 9bb046d..e54eb5f 100644
    --- a/fs/ext3/namei.c
    +++ b/fs/ext3/namei.c
    @@ -140,7 +140,8 @@ struct dx_frame
    struct dx_map_entry
    {
    u32 hash;
    - u32 offs;
    + u16 offs;
    + u16 size;
    };

    #ifdef CONFIG_EXT3_INDEX
    @@ -379,13 +380,28 @@ dx_probe(struct dentry *dentry, struct inode *dir,

    entries = (struct dx_entry *) (((char *)&root->info) +
    root->info.info_length);
    - assert(dx_get_limit(entries) == dx_root_limit(dir,
    - root->info.info_length));
    +
    + if (dx_get_limit(entries) != dx_root_limit(dir,
    + root->info.info_length)) {
    + ext3_warning(dir->i_sb, __FUNCTION__,
    + "dx entry: limit != root limit");
    + brelse(bh);
    + *err = ERR_BAD_DX_DIR;
    + goto fail;
    + }
    +
    dxtrace (printk("Look up %x", hash));
    while (1)
    {
    count = dx_get_count(entries);
    - assert (count && count <= dx_get_limit(entries));
    + if (!count || count > dx_get_limit(entries)) {
    + ext3_warning(dir->i_sb, __FUNCTION__,
    + "dx entry: no count or count > limit");
    + brelse(bh);
    + *err = ERR_BAD_DX_DIR;
    + goto fail2;
    + }
    +
    p = entries + 1;
    q = entries + count - 1;
    while (p <= q)
    @@ -423,8 +439,15 @@ dx_probe(struct dentry *dentry, struct inode *dir,
    if (!(bh = ext3_bread (NULL,dir, dx_get_block(at), 0, err)))
    goto fail2;
    at = entries = ((struct dx_node *) bh->b_data)->entries;
    - assert (dx_get_limit(entries) == dx_node_limit (dir));
    + if (dx_get_limit(entries) != dx_node_limit (dir)) {
    + ext3_warning(dir->i_sb, __FUNCTION__,
    + "dx entry: limit != node limit");
    + brelse(bh);
    + *err = ERR_BAD_DX_DIR;
    + goto fail2;
    + }
    frame++;
    + frame->bh = NULL;
    }
    fail2:
    while (frame >= frame_in) {
    @@ -432,6 +455,10 @@ fail2:
    frame--;
    }
    fail:
    + if (*err == ERR_BAD_DX_DIR)
    + ext3_warning(dir->i_sb, __FUNCTION__,
    + "Corrupt dir inode %ld, running e2fsck is "
    + "recommended.", dir->i_ino);
    return NULL;
    }

    @@ -671,6 +698,10 @@ errout:
    * Directory block splitting, compacting
    */

    +/*
    + * Create map of hash values, offsets, and sizes, stored at end of block.
    + * Returns number of entries mapped.
    + */
    static int dx_make_map (struct ext3_dir_entry_2 *de, int size,
    struct dx_hash_info *hinfo, struct dx_map_entry *map_tail)
    {
    @@ -684,7 +715,8 @@ static int dx_make_map (struct ext3_dir_entry_2 *de, int size,
    ext3fs_dirhash(de->name, de->name_len, &h);
    map_tail--;
    map_tail->hash = h.hash;
    - map_tail->offs = (u32) ((char *) de - base);
    + map_tail->offs = (u16) ((char *) de - base);
    + map_tail->size = le16_to_cpu(de->rec_len);
    count++;
    cond_resched();
    }
    @@ -694,6 +726,7 @@ static int dx_make_map (struct ext3_dir_entry_2 *de, int size,
    return count;
    }

    +/* Sort map by hash value */
    static void dx_sort_map (struct dx_map_entry *map, unsigned count)
    {
    struct dx_map_entry *p, *q, *top = map + count - 1;
    @@ -1081,6 +1114,10 @@ static inline void ext3_set_de_type(struct super_block *sb,
    }

    #ifdef CONFIG_EXT3_INDEX
    +/*
    + * Move count entries from end of map between two memory locations.
    + * Returns pointer to last entry moved.
    + */
    static struct ext3_dir_entry_2 *
    dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
    {
    @@ -1099,6 +1136,10 @@ dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
    return (struct ext3_dir_entry_2 *) (to - rec_len);
    }

    +/*
    + * Compact each dir entry in the range to the minimal rec_len.
    + * Returns pointer to last entry in range.
    + */
    static struct ext3_dir_entry_2* dx_pack_dirents(char *base, int size)
    {
    struct ext3_dir_entry_2 *next, *to, *prev, *de = (struct ext3_dir_entry_2 *) base;
    @@ -1121,6 +1162,11 @@ static struct ext3_dir_entry_2* dx_pack_dirents(char *base, int size)
    return prev;
    }

    +/*
    + * Split a full leaf block to make room for a new dir entry.
    + * Allocate a new block, and move entries so that they are approx. equally full.
    + * Returns pointer to de in block into which the new entry will be inserted.
    + */
    static struct ext3_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
    struct buffer_head **bh,struct dx_frame *frame,
    struct dx_hash_info *hinfo, int *error)
    @@ -1132,7 +1178,7 @@ static struct ext3_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
    u32 hash2;
    struct dx_map_entry *map;
    char *data1 = (*bh)->b_data, *data2;
    - unsigned split;
    + unsigned split, move, size, i;
    struct ext3_dir_entry_2 *de = NULL, *de2;
    int err = 0;

    @@ -1160,8 +1206,19 @@ static struct ext3_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
    count = dx_make_map ((struct ext3_dir_entry_2 *) data1,
    blocksize, hinfo, map);
    map -= count;
    - split = count/2; // need to adjust to actual middle
    dx_sort_map (map, count);
    + /* Split the existing block in the middle, size-wise */
    + size = 0;
    + move = 0;
    + for (i = count-1; i >= 0; i--) {
    + /* is more than half of this entry in 2nd half of the block? */
    + if (size + map[i].size/2 > blocksize/2)
    + break;
    + size += map[i].size;
    + move++;
    + }
    + /* map index at which we will split */
    + split = count - move;
    hash2 = map[split].hash;
    continued = hash2 == map[split - 1].hash;
    dxtrace(printk("Split block %i at %x, %i/%i\n",
    diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
    index 2811e57..7bb8d7c 100644
    --- a/fs/ext4/namei.c
    +++ b/fs/ext4/namei.c
    @@ -140,7 +140,8 @@ struct dx_frame
    struct dx_map_entry
    {
    u32 hash;
    - u32 offs;
    + u16 offs;
    + u16 size;
    };

    #ifdef CONFIG_EXT4_INDEX
    @@ -379,13 +380,28 @@ dx_probe(struct dentry *dentry, struct inode *dir,

    entries = (struct dx_entry *) (((char *)&root->info) +
    root->info.info_length);
    - assert(dx_get_limit(entries) == dx_root_limit(dir,
    - root->info.info_length));
    +
    + if (dx_get_limit(entries) != dx_root_limit(dir,
    + root->info.info_length)) {
    + ext4_warning(dir->i_sb, __FUNCTION__,
    + "dx entry: limit != root limit");
    + brelse(bh);
    + *err = ERR_BAD_DX_DIR;
    + goto fail;
    + }
    +
    dxtrace (printk("Look up %x", hash));
    while (1)
    {
    count = dx_get_count(entries);
    - assert (count && count <= dx_get_limit(entries));
    + if (!count || count > dx_get_limit(entries)) {
    + ext4_warning(dir->i_sb, __FUNCTION__,
    + "dx entry: no count or count > limit");
    + brelse(bh);
    + *err = ERR_BAD_DX_DIR;
    + goto fail2;
    + }
    +
    p = entries + 1;
    q = entries + count - 1;
    while (p <= q)
    @@ -423,8 +439,15 @@ dx_probe(struct dentry *dentry, struct inode *dir,
    if (!(bh = ext4_bread (NULL,dir, dx_get_block(at), 0, err)))
    goto fail2;
    at = entries = ((struct dx_node *) bh->b_data)->entries;
    - assert (dx_get_limit(entries) == dx_node_limit (dir));
    + if (dx_get_limit(entries) != dx_node_limit (dir)) {
    + ext4_warning(dir->i_sb, __FUNCTION__,
    + "dx entry: limit != node limit");
    + brelse(bh);
    + *err = ERR_BAD_DX_DIR;
    + goto fail2;
    + }
    frame++;
    + frame->bh = NULL;
    }
    fail2:
    while (frame >= frame_in) {
    @@ -432,6 +455,10 @@ fail2:
    frame--;
    }
    fail:
    + if (*err == ERR_BAD_DX_DIR)
    + ext4_warning(dir->i_sb, __FUNCTION__,
    + "Corrupt dir inode %ld, running e2fsck is "
    + "recommended.", dir->i_ino);
    return NULL;
    }

    @@ -671,6 +698,10 @@ errout:
    * Directory block splitting, compacting
    */

    +/*
    + * Create map of hash values, offsets, and sizes, stored at end of block.
    + * Returns number of entries mapped.
    + */
    static int dx_make_map (struct ext4_dir_entry_2 *de, int size,
    struct dx_hash_info *hinfo, struct dx_map_entry *map_tail)
    {
    @@ -684,7 +715,8 @@ static int dx_make_map (struct ext4_dir_entry_2 *de, int size,
    ext4fs_dirhash(de->name, de->name_len, &h);
    map_tail--;
    map_tail->hash = h.hash;
    - map_tail->offs = (u32) ((char *) de - base);
    + map_tail->offs = (u16) ((char *) de - base);
    + map_tail->size = le16_to_cpu(de->rec_len);
    count++;
    cond_resched();
    }
    @@ -694,6 +726,7 @@ static int dx_make_map (struct ext4_dir_entry_2 *de, int size,
    return count;
    }

    +/* Sort map by hash value */
    static void dx_sort_map (struct dx_map_entry *map, unsigned count)
    {
    struct dx_map_entry *p, *q, *top = map + count - 1;
    @@ -1079,6 +1112,10 @@ static inline void ext4_set_de_type(struct super_block *sb,
    }

    #ifdef CONFIG_EXT4_INDEX
    +/*
    + * Move count entries from end of map between two memory locations.
    + * Returns pointer to last entry moved.
    + */
    static struct ext4_dir_entry_2 *
    dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
    {
    @@ -1097,6 +1134,10 @@ dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
    return (struct ext4_dir_entry_2 *) (to - rec_len);
    }

    +/*
    + * Compact each dir entry in the range to the minimal rec_len.
    + * Returns pointer to last entry in range.
    + */
    static struct ext4_dir_entry_2* dx_pack_dirents(char *base, int size)
    {
    struct ext4_dir_entry_2 *next, *to, *prev, *de = (struct ext4_dir_entry_2 *) base;
    @@ -1119,6 +1160,11 @@ static struct ext4_dir_entry_2* dx_pack_dirents(char *base, int size)
    return prev;
    }

    +/*
    + * Split a full leaf block to make room for a new dir entry.
    + * Allocate a new block, and move entries so that they are approx. equally full.
    + * Returns pointer to de in block into which the new entry will be inserted.
    + */
    static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
    struct buffer_head **bh,struct dx_frame *frame,
    struct dx_hash_info *hinfo, int *error)
    @@ -1130,7 +1176,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
    u32 hash2;
    struct dx_map_entry *map;
    char *data1 = (*bh)->b_data, *data2;
    - unsigned split;
    + unsigned split, move, size, i;
    struct ext4_dir_entry_2 *de = NULL, *de2;
    int err = 0;

    @@ -1158,8 +1204,19 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
    count = dx_make_map ((struct ext4_dir_entry_2 *) data1,
    blocksize, hinfo, map);
    map -= count;
    - split = count/2; // need to adjust to actual middle
    dx_sort_map (map, count);
    + /* Split the existing block in the middle, size-wise */
    + size = 0;
    + move = 0;
    + for (i = count-1; i >= 0; i--) {
    + /* is more than half of this entry in 2nd half of the block? */
    + if (size + map[i].size/2 > blocksize/2)
    + break;
    + size += map[i].size;
    + move++;
    + }
    + /* map index at which we will split */
    + split = count - move;
    hash2 = map[split].hash;
    continued = hash2 == map[split - 1].hash;
    dxtrace(printk("Split block %i at %x, %i/%i\n",
    diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
    index 1d3b7a9..8bc727b 100644
    --- a/fs/jffs2/fs.c
    +++ b/fs/jffs2/fs.c
    @@ -627,7 +627,7 @@ unsigned char *jffs2_gc_fetch_page(struct jffs2_sb_info *c,
    struct inode *inode = OFNI_EDONI_2SFFJ(f);
    struct page *pg;

    - pg = read_cache_page(inode->i_mapping, offset >> PAGE_CACHE_SHIFT,
    + pg = read_cache_page_async(inode->i_mapping, offset >> PAGE_CACHE_SHIFT,
    (void *)jffs2_do_readpage_unlock, inode);
    if (IS_ERR(pg))
    return (void *)pg;
    diff --git a/fs/locks.c b/fs/locks.c
    index 431a8b8..6428605 100644
    --- a/fs/locks.c
    +++ b/fs/locks.c
    @@ -786,7 +786,7 @@ find_conflict:
    if (request->fl_flags & FL_ACCESS)
    goto out;
    locks_copy_lock(new_fl, request);
    - locks_insert_lock(&inode->i_flock, new_fl);
    + locks_insert_lock(before, new_fl);
    new_fl = NULL;
    error = 0;

    diff --git a/fs/nfs/super.c b/fs/nfs/super.c
    index ca20d3c..6a5bd0d 100644
    --- a/fs/nfs/super.c
    +++ b/fs/nfs/super.c
    @@ -181,8 +181,8 @@ void __exit unregister_nfs_fs(void)
    remove_shrinker(acl_shrinker);
    #ifdef CONFIG_NFS_V4
    unregister_filesystem(&nfs4_fs_type);
    - nfs_unregister_sysctl();
    #endif
    + nfs_unregister_sysctl();
    unregister_filesystem(&nfs_fs_type);
    }

    diff --git a/fs/splice.c b/fs/splice.c
    index d3c6668..e263d3b 100644
    --- a/fs/splice.c
    +++ b/fs/splice.c
    @@ -1011,7 +1011,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
    max_read_len = min(len, (size_t)(PIPE_BUFFERS*PAGE_SIZE));

    ret = do_splice_to(in, ppos, pipe, max_read_len, flags);
    - if (unlikely(ret < 0))
    + if (unlikely(ret <= 0))
    goto out_release;

    read_len = ret;
    @@ -1023,7 +1023,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
    */
    ret = do_splice_from(pipe, out, &out_off, read_len,
    flags & ~SPLICE_F_NONBLOCK);
    - if (unlikely(ret < 0))
    + if (unlikely(ret <= 0))
    goto out_release;

    bytes += ret;
    diff --git a/include/linux/Kbuild b/include/linux/Kbuild
    index b9c4d9e..d86711d 100644
    --- a/include/linux/Kbuild
    +++ b/include/linux/Kbuild
    @@ -7,6 +7,7 @@ header-y += raid/
    header-y += spi/
    header-y += sunrpc/
    header-y += tc_act/
    +header-y += tc_ematch/
    header-y += netfilter/
    header-y += netfilter_arp/
    header-y += netfilter_bridge/
    diff --git a/init/Kconfig b/init/Kconfig
    index a9e99f8..5f8dba9 100644
    --- a/init/Kconfig
    +++ b/init/Kconfig
    @@ -505,6 +505,7 @@ config SIGNALFD
    config TIMERFD
    bool "Enable timerfd() system call" if EMBEDDED
    depends on ANON_INODES
    + depends on BROKEN
    default y
    help
    Enable the timerfd() system call that allows to receive timer
    diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
    index f792136..7e52eb0 100644
    --- a/kernel/futex_compat.c
    +++ b/kernel/futex_compat.c
    @@ -61,10 +61,10 @@ void compat_exit_robust_list(struct task_struct *curr)
    if (fetch_robust_entry(&upending, &pending,
    &head->list_op_pending, &pip))
    return;
    - if (upending)
    + if (pending)
    handle_futex_death((void __user *)pending + futex_offset, curr, pip);

    - while (compat_ptr(uentry) != &head->list) {
    + while (entry != (struct robust_list __user *) &head->list) {
    /*
    * A pending lock might already be on the list, so
    * dont process it twice:
    diff --git a/kernel/signal.c b/kernel/signal.c
    index d625195..5c48ab2 100644
    --- a/kernel/signal.c
    +++ b/kernel/signal.c
    @@ -1259,20 +1259,19 @@ struct sigqueue *sigqueue_alloc(void)
    void sigqueue_free(struct sigqueue *q)
    {
    unsigned long flags;
    + spinlock_t *lock = &current->sighand->siglock;
    +
    BUG_ON(!(q->flags & SIGQUEUE_PREALLOC));
    /*
    * If the signal is still pending remove it from the
    - * pending queue.
    + * pending queue. We must hold ->siglock while testing
    + * q->list to serialize with collect_signal().
    */
    - if (unlikely(!list_empty(&q->list))) {
    - spinlock_t *lock = &current->sighand->siglock;
    - read_lock(&tasklist_lock);
    - spin_lock_irqsave(lock, flags);
    - if (!list_empty(&q->list))
    - list_del_init(&q->list);
    - spin_unlock_irqrestore(lock, flags);
    - read_unlock(&tasklist_lock);
    - }
    + spin_lock_irqsave(lock, flags);
    + if (!list_empty(&q->list))
    + list_del_init(&q->list);
    + spin_unlock_irqrestore(lock, flags);
    +
    q->flags &= ~SIGQUEUE_PREALLOC;
    __sigqueue_free(q);
    }
    diff --git a/kernel/sys.c b/kernel/sys.c
    index 872271c..28e8364 100644
    --- a/kernel/sys.c
    +++ b/kernel/sys.c
    @@ -1428,7 +1428,6 @@ asmlinkage long sys_times(struct tms __user * tbuf)
    * Auch. Had to add the 'did_exec' flag to conform completely to POSIX.
    * LBT 04.03.94
    */
    -
    asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
    {
    struct task_struct *p;
    @@ -1456,7 +1455,7 @@ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
    if (!thread_group_leader(p))
    goto out;

    - if (p->real_parent == group_leader) {
    + if (p->real_parent->tgid == group_leader->tgid) {
    err = -EPERM;
    if (task_session(p) != task_session(group_leader))
    goto out;
    diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
    index ec46084..0642694 100644
    --- a/net/8021q/vlan_dev.c
    +++ b/net/8021q/vlan_dev.c
    @@ -116,12 +116,22 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
    struct packet_type* ptype, struct net_device *orig_dev)
    {
    unsigned char *rawp = NULL;
    - struct vlan_hdr *vhdr = (struct vlan_hdr *)(skb->data);
    + struct vlan_hdr *vhdr;
    unsigned short vid;
    struct net_device_stats *stats;
    unsigned short vlan_TCI;
    __be16 proto;

    + if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
    + return -1;
    +
    + if (unlikely(!pskb_may_pull(skb, VLAN_HLEN))) {
    + kfree_skb(skb);
    + return -1;
    + }
    +
    + vhdr = (struct vlan_hdr *)(skb->data);
    +
    /* vlan_TCI = ntohs(get_unaligned(&vhdr->h_vlan_TCI)); */
    vlan_TCI = ntohs(vhdr->h_vlan_TCI);

    diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
    index fa77987..3ee2022 100644
    --- a/net/bridge/br_netfilter.c
    +++ b/net/bridge/br_netfilter.c
    @@ -509,8 +509,14 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
    int (*okfn)(struct sk_buff *))
    {
    struct iphdr *iph;
    - __u32 len;
    struct sk_buff *skb = *pskb;
    + __u32 len = nf_bridge_encap_header_len(skb);
    +
    + if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
    + return NF_STOLEN;
    +
    + if (unlikely(!pskb_may_pull(skb, len)))
    + goto out;

    if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
    IS_PPPOE_IPV6(skb)) {
    @@ -518,8 +524,6 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
    if (!brnf_call_ip6tables)
    return NF_ACCEPT;
    #endif
    - if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
    - goto out;
    nf_bridge_pull_encap_header_rcsum(skb);
    return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
    }
    @@ -532,8 +536,6 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
    !IS_PPPOE_IP(skb))
    return NF_ACCEPT;

    - if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
    - goto out;
    nf_bridge_pull_encap_header_rcsum(skb);

    if (!pskb_may_pull(skb, sizeof(struct iphdr)))
    diff --git a/net/core/datagram.c b/net/core/datagram.c
    index cb056f4..029b93e 100644
    --- a/net/core/datagram.c
    +++ b/net/core/datagram.c
    @@ -450,6 +450,9 @@ int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
    __wsum csum;
    int chunk = skb->len - hlen;

    + if (!chunk)
    + return 0;
    +
    /* Skip filled elements.
    * Pretty silly, look at memcpy_toiovec, though 8)
    */
    diff --git a/net/core/pktgen.c b/net/core/pktgen.c
    index 9cd3a1c..33190c3 100644
    --- a/net/core/pktgen.c
    +++ b/net/core/pktgen.c
    @@ -111,6 +111,9 @@
    *
    * 802.1Q/Q-in-Q support by Francesco Fondelli (FF)
    *
    + * Fixed src_mac command to set source mac of packet to value specified in
    + * command by Adit Ranadive
    + *
    */
    #include
    #include
    @@ -1415,8 +1418,11 @@ static ssize_t pktgen_if_write(struct file *file,
    }
    if (!strcmp(name, "src_mac")) {
    char *v = valstr;
    + unsigned char old_smac[ETH_ALEN];
    unsigned char *m = pkt_dev->src_mac;

    + memcpy(old_smac, pkt_dev->src_mac, ETH_ALEN);
    +
    len = strn_len(&user_buffer[i], sizeof(valstr) - 1);
    if (len < 0) {
    return len;
    @@ -1445,6 +1451,10 @@ static ssize_t pktgen_if_write(struct file *file,
    }
    }

    + /* Set up Src MAC */
    + if (compare_ether_addr(old_smac, pkt_dev->src_mac))
    + memcpy(&(pkt_dev->hh[6]), pkt_dev->src_mac, ETH_ALEN);
    +
    sprintf(pg_result, "OK: srcmac");
    return count;
    }
    diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
    index ab41c18..d46e453 100644
    --- a/net/decnet/dn_dev.c
    +++ b/net/decnet/dn_dev.c
    @@ -815,7 +815,7 @@ static int dn_nl_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
    for (ifa = dn_db->ifa_list, dn_idx = 0; ifa;
    ifa = ifa->ifa_next, dn_idx++) {
    if (dn_idx < skip_naddr)
    - goto cont;
    + continue;

    if (dn_nl_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid,
    cb->nlh->nlmsg_seq, RTM_NEWADDR,
    diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
    index 6da8ff5..c79a24e 100644
    --- a/net/ipv4/ah4.c
    +++ b/net/ipv4/ah4.c
    @@ -46,7 +46,7 @@ static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr)
    memcpy(daddr, optptr+optlen-4, 4);
    /* Fall through */
    default:
    - memset(optptr+2, 0, optlen-2);
    + memset(optptr, 0, optlen);
    }
    l -= optlen;
    optptr += optlen;
    diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
    index abf6352..0dcc245 100644
    --- a/net/ipv4/devinet.c
    +++ b/net/ipv4/devinet.c
    @@ -1194,7 +1194,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
    for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
    ifa = ifa->ifa_next, ip_idx++) {
    if (ip_idx < s_ip_idx)
    - goto cont;
    + continue;
    if (inet_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid,
    cb->nlh->nlmsg_seq,
    RTM_NEWADDR, NLM_F_MULTI) <= 0)
    diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
    index dbeacd8..def007e 100644
    --- a/net/ipv4/inet_diag.c
    +++ b/net/ipv4/inet_diag.c
    @@ -836,12 +836,16 @@ static int inet_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
    return inet_diag_get_exact(skb, nlh);
    }

    +static DEFINE_MUTEX(inet_diag_mutex);
    +
    static void inet_diag_rcv(struct sock *sk, int len)
    {
    unsigned int qlen = 0;

    do {
    + mutex_lock(&inet_diag_mutex);
    netlink_run_queue(sk, &qlen, &inet_diag_rcv_msg);
    + mutex_unlock(&inet_diag_mutex);
    } while (qlen);
    }

    diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    index 13abf4e..5bfda70 100644
    --- a/net/ipv4/tcp_input.c
    +++ b/net/ipv4/tcp_input.c
    @@ -102,11 +102,14 @@ int sysctl_tcp_abc __read_mostly;
    #define FLAG_DATA_LOST 0x80 /* SACK detected data lossage. */
    #define FLAG_SLOWPATH 0x100 /* Do not skip RFC checks for window update.*/
    #define FLAG_ONLY_ORIG_SACKED 0x200 /* SACKs only non-rexmit sent before RTO */
    +#define FLAG_SND_UNA_ADVANCED 0x400 /* Snd_una was changed (!= FLAG_DATA_ACKED) */
    +#define FLAG_DSACKING_ACK 0x800 /* SACK blocks contained DSACK info */

    #define FLAG_ACKED (FLAG_DATA_ACKED|FLAG_SYN_ACKED)
    #define FLAG_NOT_DUP (FLAG_DATA|FLAG_WIN_UPDATE|FLAG_ACKED)
    #define FLAG_CA_ALERT (FLAG_DATA_SACKED|FLAG_ECE)
    #define FLAG_FORWARD_PROGRESS (FLAG_ACKED|FLAG_DATA_SACKED)
    +#define FLAG_ANY_PROGRESS (FLAG_FORWARD_PROGRESS|FLAG_SND_UNA_ADVANCED)

    #define IsReno(tp) ((tp)->rx_opt.sack_ok == 0)
    #define IsFack(tp) ((tp)->rx_opt.sack_ok & 2)
    @@ -964,12 +967,14 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_

    /* Check for D-SACK. */
    if (before(ntohl(sp[0].start_seq), TCP_SKB_CB(ack_skb)->ack_seq)) {
    + flag |= FLAG_DSACKING_ACK;
    found_dup_sack = 1;
    tp->rx_opt.sack_ok |= 4;
    NET_INC_STATS_BH(LINUX_MIB_TCPDSACKRECV);
    } else if (num_sacks > 1 &&
    !after(ntohl(sp[0].end_seq), ntohl(sp[1].end_seq)) &&
    !before(ntohl(sp[0].start_seq), ntohl(sp[1].start_seq))) {
    + flag |= FLAG_DSACKING_ACK;
    found_dup_sack = 1;
    tp->rx_opt.sack_ok |= 4;
    NET_INC_STATS_BH(LINUX_MIB_TCPDSACKOFORECV);
    @@ -1856,7 +1861,7 @@ static void tcp_cwnd_down(struct sock *sk, int flag)
    struct tcp_sock *tp = tcp_sk(sk);
    int decr = tp->snd_cwnd_cnt + 1;

    - if ((flag&FLAG_FORWARD_PROGRESS) ||
    + if ((flag&(FLAG_ANY_PROGRESS|FLAG_DSACKING_ACK)) ||
    (IsReno(tp) && !(flag&FLAG_NOT_DUP))) {
    tp->snd_cwnd_cnt = decr&1;
    decr >>= 1;
    @@ -2112,10 +2117,9 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
    {
    struct inet_connection_sock *icsk = inet_csk(sk);
    struct tcp_sock *tp = tcp_sk(sk);
    - int is_dupack = (tp->snd_una == prior_snd_una &&
    - (!(flag&FLAG_NOT_DUP) ||
    - ((flag&FLAG_DATA_SACKED) &&
    - (tp->fackets_out > tp->reordering))));
    + int is_dupack = !(flag&(FLAG_SND_UNA_ADVANCED|FLAG_NOT_DUP));
    + int do_lost = is_dupack || ((flag&FLAG_DATA_SACKED) &&
    + (tp->fackets_out > tp->reordering));

    /* Some technical things:
    * 1. Reno does not count dupacks (sacked_out) automatically. */
    @@ -2199,7 +2203,7 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
    int acked = prior_packets - tp->packets_out;
    if (IsReno(tp))
    tcp_remove_reno_sacks(sk, acked);
    - is_dupack = tcp_try_undo_partial(sk, acked);
    + do_lost = tcp_try_undo_partial(sk, acked);
    }
    break;
    case TCP_CA_Loss:
    @@ -2264,7 +2268,7 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
    tcp_set_ca_state(sk, TCP_CA_Recovery);
    }

    - if (is_dupack || tcp_head_timedout(sk))
    + if (do_lost || tcp_head_timedout(sk))
    tcp_update_scoreboard(sk);
    tcp_cwnd_down(sk, flag);
    tcp_xmit_retransmit_queue(sk);
    @@ -2774,6 +2778,9 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
    if (before(ack, prior_snd_una))
    goto old_ack;

    + if (after(ack, prior_snd_una))
    + flag |= FLAG_SND_UNA_ADVANCED;
    +
    if (sysctl_tcp_abc) {
    if (icsk->icsk_ca_state < TCP_CA_CWR)
    tp->bytes_acked += ack - prior_snd_una;
    diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
    index 2cc3728..a908e50 100644
    --- a/net/ipv6/addrconf.c
    +++ b/net/ipv6/addrconf.c
    @@ -1021,7 +1021,7 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
    hiscore.rule++;
    }
    if (ipv6_saddr_preferred(score.addr_type) ||
    - (((ifa_result->flags &
    + (((ifa->flags &
    (IFA_F_DEPRECATED|IFA_F_OPTIMISTIC)) == 0))) {
    score.attrs |= IPV6_SADDR_SCORE_PREFERRED;
    if (!(hiscore.attrs & IPV6_SADDR_SCORE_PREFERRED)) {
    diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    index b9f9e93..4233a95 100644
    --- a/net/ipv6/ip6_output.c
    +++ b/net/ipv6/ip6_output.c
    @@ -1423,8 +1423,9 @@ void ip6_flush_pending_frames(struct sock *sk)
    struct sk_buff *skb;

    while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
    - IP6_INC_STATS(ip6_dst_idev(skb->dst),
    - IPSTATS_MIB_OUTDISCARDS);
    + if (skb->dst)
    + IP6_INC_STATS(ip6_dst_idev(skb->dst),
    + IPSTATS_MIB_OUTDISCARDS);
    kfree_skb(skb);
    }

    diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
    index 0358e60..73a894a 100644
    --- a/net/ipv6/ndisc.c
    +++ b/net/ipv6/ndisc.c
    @@ -736,7 +736,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
    * so fail our DAD process
    */
    addrconf_dad_failure(ifp);
    - goto out;
    + return;
    } else {
    /*
    * This is not a dad solicitation.
    diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
    index a58459a..fc5cb83 100644
    --- a/net/ipv6/raw.c
    +++ b/net/ipv6/raw.c
    @@ -858,11 +858,10 @@ back_from_confirm:
    ip6_flush_pending_frames(sk);
    else if (!(msg->msg_flags & MSG_MORE))
    err = rawv6_push_pending_frames(sk, &fl, rp);
    + release_sock(sk);
    }
    done:
    dst_release(dst);
    - if (!inet->hdrincl)
    - release_sock(sk);
    out:
    fl6_sock_release(flowlabel);
    return err<0?err:len;
    diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
    index 5baf48d..80a0091 100644
    --- a/net/sunrpc/svcsock.c
    +++ b/net/sunrpc/svcsock.c
    @@ -1090,7 +1090,8 @@ svc_tcp_accept(struct svc_sock *svsk)
    serv->sv_name);
    printk(KERN_NOTICE
    "%s: last TCP connect from %s\n",
    - serv->sv_name, buf);
    + serv->sv_name, __svc_print_addr(sin,
    + buf, sizeof(buf)));
    }
    /*
    * Always select the oldest socket. It's not fair,
    @@ -1572,7 +1573,8 @@ svc_age_temp_sockets(unsigned long closure)

    if (!test_and_set_bit(SK_OLD, &svsk->sk_flags))
    continue;
    - if (atomic_read(&svsk->sk_inuse) || test_bit(SK_BUSY, &svsk->sk_flags))
    + if (atomic_read(&svsk->sk_inuse) > 1
    + || test_bit(SK_BUSY, &svsk->sk_flags))
    continue;
    atomic_inc(&svsk->sk_inuse);
    list_move(le, &to_be_aged);
    diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
    index 1199baf..45550d2 100644
    --- a/scripts/kconfig/conf.c
    +++ b/scripts/kconfig/conf.c
    @@ -64,7 +64,7 @@ static void check_stdin(void)
    }
    }

    -static void conf_askvalue(struct symbol *sym, const char *def)
    +static int conf_askvalue(struct symbol *sym, const char *def)
    {
    enum symbol_type type = sym_get_type(sym);
    tristate val;
    @@ -79,7 +79,7 @@ static void conf_askvalue(struct symbol *sym, const char *def)
    printf("%s\n", def);
    line[0] = '\n';
    line[1] = 0;
    - return;
    + return 0;
    }

    switch (input_mode) {
    @@ -89,23 +89,23 @@ static void conf_askvalue(struct symbol *sym, const char *def)
    case set_random:
    if (sym_has_value(sym)) {
    printf("%s\n", def);
    - return;
    + return 0;
    }
    break;
    case ask_new:
    case ask_silent:
    if (sym_has_value(sym)) {
    printf("%s\n", def);
    - return;
    + return 0;
    }
    check_stdin();
    case ask_all:
    fflush(stdout);
    fgets(line, 128, stdin);
    - return;
    + return 1;
    case set_default:
    printf("%s\n", def);
    - return;
    + return 1;
    default:
    break;
    }
    @@ -115,7 +115,7 @@ static void conf_askvalue(struct symbol *sym, const char *def)
    case S_HEX:
    case S_STRING:
    printf("%s\n", def);
    - return;
    + return 1;
    default:
    ;
    }
    @@ -166,6 +166,7 @@ static void conf_askvalue(struct symbol *sym, const char *def)
    break;
    }
    printf("%s", line);
    + return 1;
    }

    int conf_string(struct menu *menu)
    @@ -179,7 +180,8 @@ int conf_string(struct menu *menu)
    def = sym_get_string_value(sym);
    if (sym_get_string_value(sym))
    printf("[%s] ", def);
    - conf_askvalue(sym, def);
    + if (!conf_askvalue(sym, def))
    + return 0;
    switch (line[0]) {
    case '\n':
    break;
    @@ -236,7 +238,8 @@ static int conf_sym(struct menu *menu)
    if (sym->help)
    printf("/?");
    printf("] ");
    - conf_askvalue(sym, sym_get_string_value(sym));
    + if (!conf_askvalue(sym, sym_get_string_value(sym)))
    + return 0;
    strip(line);

    switch (line[0]) {
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

+ Reply to Thread