Merge samba.org:/scratch/anton/linux-2.5

into samba.org:/scratch/anton/tmp3

arch/alpha/kernel/time.c

@@ -371,6 +371,9 @@ time_init(void)
 	xtime.tv_sec = mktime(year, mon, day, hour, min, sec);
 	xtime.tv_nsec = 0;
 
+        wall_to_monotonic.tv_sec -= xtime.tv_sec;
+        wall_to_monotonic.tv_nsec = 0;
+
 	if (HZ > (1<<16)) {
 		extern void __you_loose (void);
 		__you_loose();
@@ -486,6 +489,16 @@ do_settimeofday(struct timespec *tv)
 	time_maxerror = NTP_PHASE_LIMIT;
 	time_esterror = NTP_PHASE_LIMIT;
 
+        wall_to_monotonic.tv_sec += xtime.tv_sec - tv->tv_sec;
+        wall_to_monotonic.tv_nsec += xtime.tv_nsec - tv->tv_nsec;
+        if (wall_to_monotonic.tv_nsec > NSEC_PER_SEC) {
+                wall_to_monotonic.tv_nsec -= NSEC_PER_SEC;
+                wall_to_monotonic.tv_sec++;
+        } else if (wall_to_monotonic.tv_nsec < 0) {
+                wall_to_monotonic.tv_nsec += NSEC_PER_SEC;
+                wall_to_monotonic.tv_sec--;
+        }
+
 	write_sequnlock_irq(&xtime_lock);
 	return 0;
 }

arch/alpha/lib/ev6-memset.S

@@ -38,7 +38,6 @@
 	.ent __memset
 .align 5
 __memset:
-memset:
 	.frame $30,0,$26,0
 	.prologue 0
 
@@ -594,3 +593,5 @@ end_w:
 	ret $31,($26),1		# L0 :
 
 	.end __memsetw
+
+memset = __memset

arch/alpha/lib/memset.S

@@ -17,6 +17,7 @@
 	.set noat
 	.set noreorder
 .text
+	.globl memset
 	.globl __memset
 	.globl __memsetw
 	.globl __constant_c_memset
@@ -120,8 +121,4 @@ __memsetw:
 
 	.end __memsetw
 
-#ifdef __ELF__
- .weak memset; memset = __memset
-#else
- .weakext memset, __memset
-#endif
+memset = __memset

drivers/block/scsi_ioctl.c

@@ -450,7 +450,7 @@ int scsi_cmd_ioctl(struct block_device *bdev, unsigned int cmd, unsigned long ar
 			close = 1;
 		case CDROMEJECT:
 			rq = blk_get_request(q, WRITE, __GFP_WAIT);
-			rq->flags = REQ_BLOCK_PC;
+			rq->flags |= REQ_BLOCK_PC;
 			rq->data = NULL;
 			rq->data_len = 0;
 			rq->timeout = BLK_DEFAULT_TIMEOUT;

drivers/char/watchdog/mixcomwd.c

@@ -95,7 +95,12 @@ static int mixcomwd_open(struct inode *inode, struct file *file)
 	mixcomwd_ping();
 	
 	if (nowayout) {
-		MOD_INC_USE_COUNT;
+		/*
+		 * fops_get() code via open() has already done
+		 * a try_module_get() so it is safe to do the
+		 * __module_get().
+		 */
+		__module_get(THIS_MODULE);
 	} else {
 		if(mixcomwd_timer_alive) {
 			del_timer(&mixcomwd_timer);
@@ -211,30 +216,34 @@ static int __init mixcomwd_checkcard(int port)
 {
 	int id;
 
-	if(check_region(port+MIXCOM_WATCHDOG_OFFSET,1)) {
+	port += MIXCOM_WATCHDOG_OFFSET;
+	if (!request_region(port, 1, "MixCOM watchdog")) {
 		return 0;
 	}
 	
-	id=inb_p(port + MIXCOM_WATCHDOG_OFFSET) & 0x3f;
+	id=inb_p(port) & 0x3f;
 	if(id!=MIXCOM_ID) {
+		release_region(port, 1);
 		return 0;
 	}
-	return 1;
+	return port;
 }
 
 static int __init flashcom_checkcard(int port)
 {
 	int id;
 	
-	if(check_region(port + FLASHCOM_WATCHDOG_OFFSET,1)) {
+	port += FLASHCOM_WATCHDOG_OFFSET;
+	if (!request_region(port, 1, "MixCOM watchdog")) {
 		return 0;
 	}
 	
-	id=inb_p(port + FLASHCOM_WATCHDOG_OFFSET);
+	id=inb_p(port);
  	if(id!=FLASHCOM_ID) {
+		release_region(port, 1);
 		return 0;
 	}
- 	return 1;
+ 	return port;
  }
  
 static int __init mixcomwd_init(void)
@@ -244,17 +253,17 @@ static int __init mixcomwd_init(void)
 	int found=0;
 
 	for (i = 0; !found && mixcomwd_ioports[i] != 0; i++) {
-		if (mixcomwd_checkcard(mixcomwd_ioports[i])) {
+		watchdog_port = mixcomwd_checkcard(mixcomwd_ioports[i]);
+		if (watchdog_port) {
 			found = 1;
-			watchdog_port = mixcomwd_ioports[i] + MIXCOM_WATCHDOG_OFFSET;
 		}
 	}
 	
 	/* The FlashCOM card can be set up at 0x300 -> 0x378, in 0x8 jumps */
 	for (i = 0x300; !found && i < 0x380; i+=0x8) {
-		if (flashcom_checkcard(i)) {
+		watchdog_port = flashcom_checkcard(i);
+		if (watchdog_port) {
 			found = 1;
-			watchdog_port = i + FLASHCOM_WATCHDOG_OFFSET;
 		}
 	}
 	
@@ -263,9 +272,6 @@ static int __init mixcomwd_init(void)
 		return -ENODEV;
 	}
 
-	if (!request_region(watchdog_port,1,"MixCOM watchdog"))
-		return -EIO;
-		
 	ret = misc_register(&mixcomwd_miscdev);
 	if (ret)
 	{

drivers/net/arcnet/arc-rimi.c

@@ -86,6 +86,8 @@ static void arcrimi_copy_from_card(struct net_device *dev, int bufnum, int offse
  */
 static int __init arcrimi_probe(struct net_device *dev)
 {
+	int retval;
+
 	BUGLVL(D_NORMAL) printk(VERSION);
 	BUGLVL(D_NORMAL) printk("E-mail me if you actually test the RIM I driver, please!\n");
 
@@ -97,16 +99,27 @@ static int __init arcrimi_probe(struct net_device *dev)
 		       "must specify the shmem and irq!\n");
 		return -ENODEV;
 	}
-	if (check_mem_region(dev->mem_start, BUFFER_SIZE)) {
+	/*
+	 * Grab the memory region at mem_start for BUFFER_SIZE bytes.
+	 * Later in arcrimi_found() the real size will be determined
+	 * and this reserve will be released and the correct size
+	 * will be taken.
+	 */
+	if (!request_mem_region(dev->mem_start, BUFFER_SIZE, "arcnet (90xx)")) {
 		BUGMSG(D_NORMAL, "Card memory already allocated\n");
 		return -ENODEV;
 	}
 	if (dev->dev_addr[0] == 0) {
+		release_mem_region(dev->mem_start, BUFFER_SIZE);
 		BUGMSG(D_NORMAL, "You need to specify your card's station "
 		       "ID!\n");
 		return -ENODEV;
 	}
-	return arcrimi_found(dev);
+	retval = arcrimi_found(dev);
+	if (retval < 0) {
+		release_mem_region(dev->mem_start, BUFFER_SIZE);
+	}
+	return retval;
 }
 
 
@@ -182,8 +195,19 @@ static int __init arcrimi_found(struct net_device *dev)
 	/* get and check the station ID from offset 1 in shmem */
 	dev->dev_addr[0] = readb(lp->mem_start + 1);
 
-	/* reserve the memory region - guaranteed to work by check_region */
-	request_mem_region(dev->mem_start, dev->mem_end - dev->mem_start + 1, "arcnet (90xx)");
+	/*
+	 * re-reserve the memory region - arcrimi_probe() alloced this reqion
+	 * but didn't know the real size.  Free that region and then re-get
+	 * with the correct size.  There is a VERY slim chance this could
+	 * fail.
+	 */
+	release_mem_region(dev->mem_start, BUFFER_SIZE);
+	if (!request_mem_region(dev->mem_start,
+				dev->mem_end - dev->mem_start + 1,
+				"arcnet (90xx)")) {
+		BUGMSG(D_NORMAL, "Card memory already allocated\n");
+		goto err_free_dev_priv;
+	}
 
 	BUGMSG(D_NORMAL, "ARCnet RIM I: station %02Xh found at IRQ %d, "
 	       "ShMem %lXh (%ld*%d bytes).\n",

drivers/net/pcmcia/nmclan_cs.c

@@ -710,7 +710,7 @@ while ((last_ret=CardServices(last_fn=(fn), args))!=0) goto cs_failed
 static void nmclan_config(dev_link_t *link)
 {
   client_handle_t handle = link->handle;
-  struct net_device *dev = link->priv;;
+  struct net_device *dev = link->priv;
   mace_private *lp = dev->priv;
   tuple_t tuple;
   cisparse_t parse;

drivers/net/ppp_generic.c

@@ -1348,16 +1348,9 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
 	struct channel *pch = chan->ppp;
 	int proto;
 
-	if (pch == 0)
-		goto drop;
-
-	/* need to have PPP header */
-	if (!pskb_may_pull(skb, 2)) {
-		if (pch->ppp) {
-			++pch->ppp->stats.rx_length_errors;
-			ppp_receive_error(pch->ppp);
-		}
-		goto drop;
+	if (pch == 0 || skb->len == 0) {
+		kfree_skb(skb);
+		return;
 	}
 	
 	proto = PPP_PROTO(skb);
@@ -1374,10 +1367,6 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
 		ppp_do_recv(pch->ppp, skb, pch);
 	}
 	read_unlock_bh(&pch->upl);
-	return;
- drop:
-	kfree_skb(skb);
-	return;
 }
 
 /* Put a 0-length skb in the receive queue as an error indication */
@@ -1409,6 +1398,7 @@ ppp_input_error(struct ppp_channel *chan, int code)
 static void
 ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 {
+	if (skb->len >= 2) {
 #ifdef CONFIG_PPP_MULTILINK
 		/* XXX do channel-level decompression here */
 		if (PPP_PROTO(skb) == PPP_MP)
@@ -1416,6 +1406,15 @@ ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 		else
 #endif /* CONFIG_PPP_MULTILINK */
 			ppp_receive_nonmp_frame(ppp, skb);
+		return;
+	}
+
+	if (skb->len > 0)
+		/* note: a 0-length skb is used as an error indication */
+		++ppp->stats.rx_length_errors;
+
+	kfree_skb(skb);
+	ppp_receive_error(ppp);
 }
 
 static void
@@ -1448,7 +1447,7 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
 		if (ppp->vj == 0 || (ppp->flags & SC_REJ_COMP_TCP))
 			goto err;
 
-		if (skb_tailroom(skb) < 124 || skb_is_nonlinear(skb) ) {
+		if (skb_tailroom(skb) < 124) {
 			/* copy to a new sk_buff with more tailroom */
 			ns = dev_alloc_skb(skb->len + 128);
 			if (ns == 0) {
@@ -1460,6 +1459,9 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
 			kfree_skb(skb);
 			skb = ns;
 		}
+		else if (!pskb_may_pull(skb, skb->len))
+			goto err;
+
 		len = slhc_uncompress(ppp->vj, skb->data + 2, skb->len - 2);
 		if (len <= 0) {
 			printk(KERN_DEBUG "PPP: VJ decompression error\n");
@@ -2033,12 +2035,12 @@ ppp_set_compress(struct ppp *ppp, unsigned long arg)
 static void
 ppp_ccp_peek(struct ppp *ppp, struct sk_buff *skb, int inbound)
 {
-	unsigned char *dp = skb->data + 2;
+	unsigned char *dp;
 	int len;
 
-	if (!pskb_may_pull(skb, CCP_HDRLEN + 2)
-	    || skb->len < (len = CCP_LENGTH(dp)) + 2)
-		return;		/* too short */
+	if (!pskb_may_pull(skb, CCP_HDRLEN + 2))
+		return;	/* no header */
+	dp = skb->data + 2;
 
 	switch (CCP_CODE(dp)) {
 	case CCP_CONFREQ:
@@ -2071,10 +2073,8 @@ ppp_ccp_peek(struct ppp *ppp, struct sk_buff *skb, int inbound)
 	case CCP_CONFACK:
 		if ((ppp->flags & (SC_CCP_OPEN | SC_CCP_UP)) != SC_CCP_OPEN)
 			break;
-
-		if (!pskb_may_pull(skb, len))
-			break;
-
+		if (!pskb_may_pull(skb, len = CCP_LENGTH(dp)) + 2)
+			return;		/* too short */
 		dp += CCP_HDRLEN;
 		len -= CCP_HDRLEN;
 		if (len < CCP_OPT_MINLEN || len < CCP_OPT_LENGTH(dp))

drivers/scsi/sr.c

@@ -65,7 +65,7 @@ MODULE_PARM(xa_test, "i");	/* see sr_ioctl.c */
 	(CDC_CLOSE_TRAY|CDC_OPEN_TRAY|CDC_LOCK|CDC_SELECT_SPEED| \
 	 CDC_SELECT_DISC|CDC_MULTI_SESSION|CDC_MCN|CDC_MEDIA_CHANGED| \
 	 CDC_PLAY_AUDIO|CDC_RESET|CDC_IOCTLS|CDC_DRIVE_STATUS| \
-	 CDC_CD_R|CDC_CD_RW|CDC_DVD|CDC_DVD_R|CDC_GENERIC_PACKET)
+	 CDC_CD_R|CDC_CD_RW|CDC_DVD|CDC_DVD_R|CDC_DVD_RAM|CDC_GENERIC_PACKET)
 
 static int sr_probe(struct device *);
 static int sr_remove(struct device *);

fs/ext3/super.c

@@ -864,19 +864,17 @@ static int ext3_setup_super(struct super_block *sb, struct ext3_super_block *es,
 	ext3_update_dynamic_rev(sb);
 	EXT3_SET_INCOMPAT_FEATURE(sb, EXT3_FEATURE_INCOMPAT_RECOVER);
 
-	ext3_commit_super (sb, es, 1);
-	if (test_opt (sb, DEBUG))
-		printk (KERN_INFO
-			"[EXT3 FS %s, %s, bs=%lu, gc=%lu, "
+	ext3_commit_super(sb, es, 1);
+	if (test_opt(sb, DEBUG))
+		printk(KERN_INFO "[EXT3 FS bs=%lu, gc=%lu, "
 				"bpg=%lu, ipg=%lu, mo=%04lx]\n",
-			EXT3FS_VERSION, EXT3FS_DATE, sb->s_blocksize,
+			sb->s_blocksize,
 			sbi->s_groups_count,
 			EXT3_BLOCKS_PER_GROUP(sb),
 			EXT3_INODES_PER_GROUP(sb),
 			sbi->s_mount_opt);
 
-	printk(KERN_INFO "EXT3 FS " EXT3FS_VERSION ", " EXT3FS_DATE " on %s, ",
-				sb->s_id);
+	printk(KERN_INFO "EXT3 FS on %s, ", sb->s_id);
 	if (EXT3_SB(sb)->s_journal->j_inode == NULL) {
 		char b[BDEVNAME_SIZE];
 

fs/proc/proc_misc.c

@@ -412,7 +412,7 @@ static int kstat_read_proc(char *page, char **start, off_t off,
 	}
 	len += sprintf(page + len, "intr %u", sum);
 
-#if !defined(CONFIG_ARCH_S390) && !defined(CONFIG_PPC64)
+#if !defined(CONFIG_ARCH_S390) && !defined(CONFIG_PPC64) && !defined(CONFIG_ALPHA)
 	for (i = 0 ; i < NR_IRQS ; i++)
 		len += sprintf(page + len, " %u", kstat_irqs(i));
 #endif

fs/reiserfs/tail_conversion.c

@@ -143,6 +143,16 @@ void reiserfs_unmap_buffer(struct buffer_head *bh) {
     }
     clear_buffer_dirty(bh) ;
     lock_buffer(bh) ;
+    /* Remove the buffer from whatever list it belongs to. We are mostly
+       interested in removing it from per-sb j_dirty_buffers list, to avoid
+        BUG() on attempt to write not mapped buffer */
+    if ( !list_empty(&bh->b_assoc_buffers) && bh->b_page) {
+	struct inode *inode = bh->b_page->mapping->host;
+	struct reiserfs_journal *j = SB_JOURNAL(inode->i_sb);
+	spin_lock(&j->j_dirty_buffers_lock);
+	list_del_init(&bh->b_assoc_buffers);
+	spin_unlock(&j->j_dirty_buffers_lock);
+    }
     clear_buffer_mapped(bh) ;
     clear_buffer_req(bh) ;
     clear_buffer_new(bh);
@@ -180,6 +190,9 @@ unmap_buffers(struct page *page, loff_t pos) {
         }
 	bh = next ;
       } while (bh != head) ;
+      if ( PAGE_SIZE == bh->b_size ) {
+	ClearPageDirty(page);
+      }
     }
   } 
 }

include/asm-alpha/elf.h

@@ -98,6 +98,9 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
 /* The registers are layed out in pt_regs for PAL and syscall
    convenience.  Re-order them for the linear elf_gregset_t.  */
 
+struct pt_regs;
+struct thread_info;
+struct task_struct;
 extern void dump_elf_thread(elf_greg_t *dest, struct pt_regs *pt,
 			    struct thread_info *ti);
 #define ELF_CORE_COPY_REGS(DEST, REGS) \

include/linux/ext3_fs.h

@@ -38,12 +38,6 @@ struct statfs;
 #undef  EXT3_PREALLOCATE /* @@@ Fix this! */
 #define EXT3_DEFAULT_PREALLOC_BLOCKS	8
 
-/*
- * The second extended file system version
- */
-#define EXT3FS_DATE		"02 Dec 2001"
-#define EXT3FS_VERSION		"2.4-0.9.16"
-
 /*
  * Always enable hashed directories
  */

include/net/dst.h

@@ -22,8 +22,8 @@
  */
 #define RT_CACHE_DEBUG		0
 
-#define DST_GC_MIN	(1*HZ)
-#define DST_GC_INC	(5*HZ)
+#define DST_GC_MIN	(HZ/10)
+#define DST_GC_INC	(HZ/2)
 #define DST_GC_MAX	(120*HZ)
 
 /* Each dst_entry has reference count and sits in some parent list(s).

kernel/printk.c

@@ -186,16 +186,17 @@ int do_syslog(int type, char __user * buf, int len)
 			goto out;
 		i = 0;
 		spin_lock_irq(&logbuf_lock);
-		while ((log_start != log_end) && i < len) {
+		while (!error && (log_start != log_end) && i < len) {
 			c = LOG_BUF(log_start);
 			log_start++;
 			spin_unlock_irq(&logbuf_lock);
-			__put_user(c,buf);
+			error = __put_user(c,buf);
 			buf++;
 			i++;
 			spin_lock_irq(&logbuf_lock);
 		}
 		spin_unlock_irq(&logbuf_lock);
+		if (!error)
 			error = i;
 		break;
 	case 4:		/* Read/clear last kernel messages */
@@ -226,26 +227,30 @@ int do_syslog(int type, char __user * buf, int len)
 		 * we try to copy to user space. Therefore
 		 * the messages are copied in reverse. <manfreds>
 		 */
-		for(i=0;i < count;i++) {
+		for(i = 0; i < count && !error; i++) {
 			j = limit-1-i;
 			if (j+LOG_BUF_LEN < log_end)
 				break;
 			c = LOG_BUF(j);
 			spin_unlock_irq(&logbuf_lock);
-			__put_user(c,&buf[count-1-i]);
+			error = __put_user(c,&buf[count-1-i]);
 			spin_lock_irq(&logbuf_lock);
 		}
 		spin_unlock_irq(&logbuf_lock);
+		if (error)
+			break;
 		error = i;
 		if(i != count) {
 			int offset = count-error;
 			/* buffer overflow during copy, correct user buffer. */
 			for(i=0;i<error;i++) {
-				__get_user(c,&buf[i+offset]);
-				__put_user(c,&buf[i]);
+				if (__get_user(c,&buf[i+offset]) ||
+				    __put_user(c,&buf[i])) {
+					error = -EFAULT;
+					break;
+				}
 			}
 		}
-
 		break;
 	case 5:		/* Clear ring buffer */
 		logged_chars = 0;

mm/readahead.c

@@ -260,6 +260,9 @@ int do_page_cache_readahead(struct address_space *mapping, struct file *filp,
 {
 	int ret = 0;
 
+	if (unlikely(!mapping->a_ops->readpage && !mapping->a_ops->readpages))
+		return -EINVAL;
+
 	while (nr_to_read) {
 		int err;
 

mm/slab.c

@@ -1207,7 +1207,8 @@ static void smp_call_function_all_cpus(void (*func) (void *arg), void *arg)
 }
 
 static void free_block (kmem_cache_t* cachep, void** objpp, int len);
-static void drain_array_locked(kmem_cache_t* cachep, struct array_cache *ac);
+static void drain_array_locked(kmem_cache_t* cachep,
+				struct array_cache *ac, int force);
 
 static void do_drain(void *arg)
 {
@@ -1228,7 +1229,7 @@ static void drain_cpu_caches(kmem_cache_t *cachep)
 	check_irq_on();
 	spin_lock_irq(&cachep->spinlock);
 	if (cachep->lists.shared)
-		drain_array_locked(cachep, cachep->lists.shared);
+		drain_array_locked(cachep, cachep->lists.shared, 1);
 	spin_unlock_irq(&cachep->spinlock);
 }
 
@@ -2267,7 +2268,8 @@ static void drain_array(kmem_cache_t *cachep, struct array_cache *ac)
 	}
 }
 
-static void drain_array_locked(kmem_cache_t *cachep, struct array_cache *ac)
+static void drain_array_locked(kmem_cache_t *cachep,
+				struct array_cache *ac, int force)
 {
 	int tofree;
 
@@ -2275,7 +2277,7 @@ static void drain_array_locked(kmem_cache_t *cachep, struct array_cache *ac)
 	if (ac->touched) {
 		ac->touched = 0;
 	} else if (ac->avail) {
-		tofree = (ac->limit+4)/5;
+		tofree = force ? ac->avail : (ac->limit+4)/5;
 		if (tofree > ac->avail) {
 			tofree = (ac->avail+1)/2;
 		}
@@ -2286,7 +2288,6 @@ static void drain_array_locked(kmem_cache_t *cachep, struct array_cache *ac)
 	}
 }
 
-
 /**
  * cache_reap - Reclaim memory from caches.
  *
@@ -2334,7 +2335,7 @@ static inline void cache_reap (void)
 		searchp->lists.next_reap = jiffies + REAPTIMEOUT_LIST3;
 
 		if (searchp->lists.shared)
-			drain_array_locked(searchp, searchp->lists.shared);
+			drain_array_locked(searchp, searchp->lists.shared, 0);
 
 		if (searchp->lists.free_touched) {
 			searchp->lists.free_touched = 0;

net/core/dev.c

@@ -2346,7 +2346,7 @@ static int dev_ifsioc(struct ifreq *ifr, unsigned int cmd)
 				return -EEXIST;
 			memcpy(dev->name, ifr->ifr_newname, IFNAMSIZ);
 			dev->name[IFNAMSIZ - 1] = 0;
-			snprintf(dev->class_dev.class_id, BUS_ID_SIZE, dev->name);
+			strlcpy(dev->class_dev.class_id, dev->name, BUS_ID_SIZE);
 			notifier_call_chain(&netdev_chain,
 					    NETDEV_CHANGENAME, dev);
 			return 0;

net/ipv6/route.c

@@ -72,7 +72,7 @@
 
 
 static int ip6_rt_max_size = 4096;
-static int ip6_rt_gc_min_interval = 5*HZ;
+static int ip6_rt_gc_min_interval = HZ / 2;
 static int ip6_rt_gc_timeout = 60*HZ;
 int ip6_rt_gc_interval = 30*HZ;
 static int ip6_rt_gc_elasticity = 9;