Merge davem@nuts.ninka.net:/home/davem/src/BK/net-2.5

into kernel.bkbits.net:/home/davem/net-2.5

arch/i386/kernel/process.c

@@ -324,7 +324,7 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long esp,
 		int idx;
 
 		err = -EFAULT;
-		if (copy_from_user(&info, (void *)childregs->esi, sizeof(info)))
+		if (copy_from_user(&info, (void __user *)childregs->esi, sizeof(info)))
 			goto out;
 		err = -EINVAL;
 		if (LDT_empty(&info))
@@ -567,11 +567,14 @@ asmlinkage int sys_execve(struct pt_regs regs)
 	int error;
 	char * filename;
 
-	filename = getname((char *) regs.ebx);
+	filename = getname((char __user *) regs.ebx);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
 		goto out;
-	error = do_execve(filename, (char **) regs.ecx, (char **) regs.edx, &regs);
+	error = do_execve(filename,
+			(char __user * __user *) regs.ecx,
+			(char __user * __user *) regs.edx,
+			&regs);
 	if (error == 0) {
 		current->ptrace &= ~PT_DTRACE;
 		/* Make sure we don't return using sysenter.. */
@@ -633,7 +636,7 @@ static int get_free_idx(void)
 /*
  * Set a given TLS descriptor:
  */
-asmlinkage int sys_set_thread_area(struct user_desc *u_info)
+asmlinkage int sys_set_thread_area(struct user_desc __user *u_info)
 {
 	struct thread_struct *t = &current->thread;
 	struct user_desc info;
@@ -700,7 +703,7 @@ asmlinkage int sys_set_thread_area(struct user_desc *u_info)
 #define GET_PRESENT(desc)	(((desc)->b >> 15) & 1)
 #define GET_USEABLE(desc)	(((desc)->b >> 20) & 1)
 
-asmlinkage int sys_get_thread_area(struct user_desc *u_info)
+asmlinkage int sys_get_thread_area(struct user_desc __user *u_info)
 {
 	struct user_desc info;
 	struct desc_struct *desc;

drivers/s390/net/Kconfig

@@ -9,7 +9,7 @@ config LCS
   	   or zSeries. This device driver supports Token Ring (IEEE 802.5),
   	   FDDI (IEEE 802.7) and Ethernet. 
 	   This option is also available as a module which will be
-	   called lcs.o . If you do not know what it is, it's safe to say "Y".
+	   called lcs.ko. If you do not know what it is, it's safe to say "Y".
 
 config CTC
 	tristate "CTC device support"
@@ -20,7 +20,7 @@ config CTC
 	  coupling using ESCON. It also supports virtual CTCs when running
 	  under VM. It will use the channel device configuration if this is
 	  available.  This option is also available as a module which will be
-	  called ctc.o.  If you do not know what it is, it's safe to say "Y".
+	  called ctc.ko.  If you do not know what it is, it's safe to say "Y".
 
 config IUCV
 	tristate "IUCV device support (VM only)"
@@ -28,7 +28,7 @@ config IUCV
 	help
 	  Select this option if you want to use inter-user communication
 	  vehicle networking under VM or VIF.  This option is also available
-	  as a module which will be called iucv.o. If unsure, say "Y".
+	  as a module which will be called iucv.ko. If unsure, say "Y".
 
 config CCWGROUP
  	tristate

drivers/s390/net/ctcmain.c

 /*
- * $Id: ctcmain.c,v 1.36 2003/02/18 09:15:14 mschwide Exp $
+ * $Id: ctcmain.c,v 1.40 2003/04/08 16:00:17 mschwide Exp $
  *
  * CTC / ESCON network driver
  *
@@ -36,13 +36,12 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * RELEASE-TAG: CTC/ESCON network driver $Revision: 1.36 $
+ * RELEASE-TAG: CTC/ESCON network driver $Revision: 1.40 $
  *
  */
 
 #undef DEBUG
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -273,7 +272,7 @@ static void
 print_banner(void)
 {
 	static int printed = 0;
-	char vbuf[] = "$Revision: 1.36 $";
+	char vbuf[] = "$Revision: 1.40 $";
 	char *version = vbuf;
 
 	if (printed)
@@ -1962,22 +1961,17 @@ ctc_irq_handler(struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
 	}
 	
 	priv = cdev->dev.driver_data;
-	ch = (struct channel *) intparm;
-	if ((ch != priv->channel[READ]) && (ch != priv->channel[WRITE]))
-		ch = NULL;
-	
-	if (!ch) {
-		/* Try to extract channel from driver data. */
-		if (priv->channel[READ]->cdev == cdev)
-			ch = priv->channel[READ];
-		else if (priv->channel[WRITE]->cdev == cdev)
-			ch = priv->channel[READ];
-		else {
-			printk(KERN_ERR
-			       "ctc: Can't determine channel for interrupt, "
-			       "device %s\n", cdev->dev.bus_id);
-			return;
-		}
+
+	/* Try to extract channel from driver data. */
+	if (priv->channel[READ]->cdev == cdev)
+		ch = priv->channel[READ];
+	else if (priv->channel[WRITE]->cdev == cdev)
+		ch = priv->channel[READ];
+	else {
+		printk(KERN_ERR
+		       "ctc: Can't determine channel for interrupt, "
+		       "device %s\n", cdev->dev.bus_id);
+		return;
 	}
 	
 	dev = (struct net_device *) (ch->netdev);
@@ -2392,7 +2386,6 @@ transmit_skb(struct channel *ch, struct sk_buff *skb)
 static int
 ctc_open(struct net_device * dev)
 {
-	MOD_INC_USE_COUNT;
 	fsm_event(((struct ctc_priv *) dev->priv)->fsm, DEV_EVENT_START, dev);
 	return 0;
 }
@@ -2409,7 +2402,6 @@ static int
 ctc_close(struct net_device * dev)
 {
 	fsm_event(((struct ctc_priv *) dev->priv)->fsm, DEV_EVENT_STOP, dev);
-	MOD_DEC_USE_COUNT;
 	return 0;
 }
 
@@ -2761,6 +2753,7 @@ ctc_init_netdevice(struct net_device * dev, int alloc_device,
 	dev->addr_len = 0;
 	dev->type = ARPHRD_SLIP;
 	dev->tx_queue_len = 100;
+	dev->owner = THIS_MODULE;
 	dev->flags = IFF_POINTOPOINT | IFF_NOARP;
 	return dev;
 }

drivers/s390/net/ctctty.c

 /*
- * $Id: ctctty.c,v 1.9 2002/12/02 15:25:13 aberg Exp $
+ * $Id: ctctty.c,v 1.10 2003/03/21 18:47:31 aberg Exp $
  *
  * CTC / ESCON network driver, tty interface.
  *
@@ -22,7 +22,6 @@
  *
  */
 
-#define __NO_VERSION__
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/tty.h>

drivers/s390/net/fsm.c

 /**
- * $Id: fsm.c,v 1.3 2002/10/08 16:53:45 mschwide Exp $
+ * $Id: fsm.c,v 1.4 2003/03/28 08:54:40 mschwide Exp $
  *
  * A generic FSM based on fsm used in isdn4linux
  *
  */
 
 #include "fsm.h"
-#include <linux/version.h>
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/timer.h>

drivers/s390/net/iucv.c

 /* 
- * $Id: iucv.c,v 1.9 2002/11/06 13:37:25 cohuck Exp $
+ * $Id: iucv.c,v 1.10 2003/03/28 08:54:40 mschwide Exp $
  *
  * IUCV network driver
  *
@@ -29,14 +29,13 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * RELEASE-TAG: IUCV lowlevel driver $Revision: 1.9 $
+ * RELEASE-TAG: IUCV lowlevel driver $Revision: 1.10 $
  *
  */
 
 #include <linux/module.h>
 #include <linux/config.h>
 
-#include <linux/version.h>
 #include <linux/spinlock.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
@@ -333,7 +332,7 @@ do { \
 static void
 iucv_banner(void)
 {
-	char vbuf[] = "$Revision: 1.9 $";
+	char vbuf[] = "$Revision: 1.10 $";
 	char *version = vbuf;
 
 	if ((version = strchr(version, ':'))) {

drivers/s390/net/lcs.c

@@ -11,7 +11,7 @@
  *			  Frank Pavlic (pavlic@de.ibm.com) and
  *		 	  Martin Schwidefsky <schwidefsky@de.ibm.com>
  *
- *    $Revision: 1.44 $	 $Date: 2003/02/18 19:49:02 $
+ *    $Revision: 1.51 $	 $Date: 2003/03/28 08:54:40 $
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -28,7 +28,6 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/if.h>
 #include <linux/netdevice.h>
@@ -59,7 +58,7 @@
 /**
  * initialization string for output
  */
-#define VERSION_LCS_C  "$Revision: 1.44 $"
+#define VERSION_LCS_C  "$Revision: 1.51 $"
 
 static char version[] __initdata = "LCS driver ("VERSION_LCS_C "/" VERSION_LCS_H ")";
 
@@ -335,7 +334,9 @@ lcs_setup_card(struct lcs_card *card)
 		  (void *)lcs_start_kernel_thread,card);
 	card->thread_mask = 0;
 	spin_lock_init(&card->lock);
+#ifdef CONFIG_IP_MULTICAST
 	INIT_LIST_HEAD(&card->ipm_list);
+#endif
 	INIT_LIST_HEAD(&card->lancmd_waiters);
 	return 0;
 }
@@ -358,6 +359,7 @@ lcs_cleanup_card(struct lcs_card *card)
 		kfree(ipm_list);
 	}
 #endif
+	kfree(card->dev);
 	/* Cleanup channels. */
 	lcs_cleanup_channel(&card->write);
 	lcs_cleanup_channel(&card->read);
@@ -556,13 +558,12 @@ lcs_ready_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
 static int
 __lcs_processed_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
 {
-	int index, prevprev, prev, next;
+	int index, prev, next;
 
 	if (buffer->state != BUF_STATE_READY)
 		BUG();
 	buffer->state = BUF_STATE_PROCESSED;
 	index = buffer - channel->iob;
-	prevprev = (index - 1) & (LCS_NUM_BUFFS - 1);
 	prev = (index - 1) & (LCS_NUM_BUFFS - 1);
 	next = (index + 1) & (LCS_NUM_BUFFS - 1);
 	/* Set the suspend bit and clear the PCI bit of this buffer. */
@@ -1082,7 +1083,7 @@ lcs_tasklet(unsigned long data)
 	unsigned long flags;
 	struct lcs_channel *channel;
 	struct lcs_buffer *iob;
-	int buf_idx, io_idx;
+	int buf_idx;
 	int rc;
 
 	channel = (struct lcs_channel *) data;
@@ -1092,9 +1093,7 @@ lcs_tasklet(unsigned long data)
 	/* Check for processed buffers. */
 	iob = channel->iob;
 	buf_idx = channel->buf_idx;
-	io_idx = channel->io_idx;
-	while (buf_idx != io_idx &&
-	       iob[buf_idx].state == BUF_STATE_PROCESSED) {
+	while (iob[buf_idx].state == BUF_STATE_PROCESSED) {
 		/* Do the callback thing. */
 		if (iob[buf_idx].callback != NULL)
 			iob[buf_idx].callback(channel, iob + buf_idx);
@@ -1434,6 +1433,7 @@ static int
 lcs_lgw_stoplan_thread(void *data)
 {
 	struct lcs_card *card;
+	int rc;
 
 	card = (struct lcs_card *) data;
 	daemonize("lgwstop");
@@ -1446,7 +1446,11 @@ lcs_lgw_stoplan_thread(void *data)
 	else
 		PRINT_ERR("Stoplan %s initiated by LGW failed!\n",
 			  card->dev->name);
-	return 0;
+	/*Try to reset the card, stop it on failure */
+        rc = lcs_resetcard(card);
+        if (rc != 0)
+                rc = lcs_stopcard(card);
+        return rc;
 }
 
 /**
@@ -1462,8 +1466,10 @@ lcs_start_kernel_thread(struct lcs_card *card)
 		kernel_thread(lcs_lgw_startlan_thread, (void *) card, SIGCHLD);
 	if (test_and_clear_bit(2, &card->thread_mask))
 		kernel_thread(lcs_lgw_stoplan_thread, (void *) card, SIGCHLD);
+#ifdef CONFIG_IP_MULTICAST
 	if (test_and_clear_bit(3, &card->thread_mask))
 		kernel_thread(lcs_fix_multicast_list, (void *) card, SIGCHLD);
+#endif
 }
 
 /**
@@ -1599,12 +1605,9 @@ lcs_stop_device(struct net_device *dev)
 	LCS_DBF_TEXT(2, trace, "stopdev");
 	card   = (struct lcs_card *) dev->priv;
 	netif_stop_queue(dev);
-	// FIXME: really free the net_device here ?!?
-	kfree(card->dev);
 	rc = lcs_stopcard(card);
 	if (rc)
 		PRINT_ERR("Try it again!\n ");
-	MOD_DEC_USE_COUNT;
 	return rc;
 }
 
@@ -1626,7 +1629,6 @@ lcs_open_device(struct net_device *dev)
 		PRINT_ERR("LCS:Error in opening device!\n");
 
 	} else {
-		MOD_INC_USE_COUNT;
 		netif_wake_queue(dev);
 		card->state = DEV_STATE_UP;
 	}
@@ -1784,6 +1786,7 @@ lcs_new_device(struct ccwgroup_device *ccwgdev)
 		dev->set_multicast_list = lcs_set_multicast_list;
 #endif
 	dev->get_stats = lcs_getstats;
+	dev->owner = THIS_MODULE;
 	netif_stop_queue(dev);
 	lcs_stopcard(card);
 	return 0;

drivers/s390/net/netiucv.c

 /*
- * $Id: netiucv.c,v 1.16 2003/02/18 09:15:14 mschwide Exp $
+ * $Id: netiucv.c,v 1.19 2003/04/08 16:00:17 mschwide Exp $
  *
  * IUCV network driver
  *
@@ -30,7 +30,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * RELEASE-TAG: IUCV network driver $Revision: 1.16 $
+ * RELEASE-TAG: IUCV network driver $Revision: 1.19 $
  *
  */
 
@@ -1140,7 +1140,6 @@ netiucv_transmit_skb(struct iucv_connection *conn, struct sk_buff *skb) {
  */
 static int
 netiucv_open(struct net_device *dev) {
-	MOD_INC_USE_COUNT;
 	SET_DEVICE_START(dev, 1);
 	fsm_event(((struct netiucv_priv *)dev->priv)->fsm, DEV_EVENT_START, dev);
 	return 0;
@@ -1158,7 +1157,6 @@ static int
 netiucv_close(struct net_device *dev) {
 	SET_DEVICE_START(dev, 0);
 	fsm_event(((struct netiucv_priv *)dev->priv)->fsm, DEV_EVENT_STOP, dev);
-	MOD_DEC_USE_COUNT;
 	return 0;
 }
 
@@ -1517,12 +1515,14 @@ netiucv_new_connection(struct net_device *dev, char *username)
 		conn->max_buffsize = NETIUCV_BUFSIZE_DEFAULT;
 		conn->netdev = dev;
 
-		conn->rx_buff = alloc_skb(NETIUCV_BUFSIZE_DEFAULT, GFP_DMA);
+		conn->rx_buff = alloc_skb(NETIUCV_BUFSIZE_DEFAULT,
+					  GFP_KERNEL | GFP_DMA);
 		if (!conn->rx_buff) {
 			kfree(conn);
 			return NULL;
 		}
-		conn->tx_buff = alloc_skb(NETIUCV_BUFSIZE_DEFAULT, GFP_DMA);
+		conn->tx_buff = alloc_skb(NETIUCV_BUFSIZE_DEFAULT,
+					  GFP_KERNEL | GFP_DMA);
 		if (!conn->tx_buff) {
 			kfree_skb(conn->rx_buff);
 			kfree(conn);
@@ -1630,6 +1630,7 @@ netiucv_init_netdevice(int ifno, char *username)
 	dev->addr_len            = 0;
 	dev->type                = ARPHRD_SLIP;
 	dev->tx_queue_len        = NETIUCV_QUEUELEN_DEFAULT;
+	dev->owner               = THIS_MODULE;
 	dev->flags	         = IFF_POINTOPOINT | IFF_NOARP;
 	return dev;
 }
@@ -1716,7 +1717,7 @@ static struct device_driver netiucv_driver = {
 static void
 netiucv_banner(void)
 {
-	char vbuf[] = "$Revision: 1.16 $";
+	char vbuf[] = "$Revision: 1.19 $";
 	char *version = vbuf;
 
 	if ((version = strchr(version, ':'))) {

fs/coda/psdev.c

@@ -371,7 +371,7 @@ static int init_coda_psdev(void)
 		     CODA_PSDEV_MAJOR);
               return -EIO;
 	}
-	devfs_mk_dir (NULL, "coda", NULL);
+	devfs_mk_dir ("coda");
 	for (i = 0; i < MAX_CODADEVS; i++) {
 		char name[16];
 		sprintf(name, "coda/%d", i);

fs/exec.c

@@ -491,7 +491,8 @@ int kernel_read(struct file *file, unsigned long offset,
 
 	old_fs = get_fs();
 	set_fs(get_ds());
-	result = vfs_read(file, addr, count, &pos);
+	/* The cast to a user pointer is valid due to the set_fs() */
+	result = vfs_read(file, (void __user *)addr, count, &pos);
 	set_fs(old_fs);
 	return result;
 }

fs/namei.c

@@ -847,6 +847,7 @@ int path_lookup(const char *name, unsigned int flags, struct nameidata *nd)
 			read_unlock(&current->fs->lock);
 			if (__emul_lookup_dentry(name,nd))
 				return 0;
+			read_lock(&current->fs->lock);
 		}
 		nd->mnt = mntget(current->fs->rootmnt);
 		nd->dentry = dget(current->fs->root);

fs/namespace.c

@@ -367,7 +367,7 @@ static int do_umount(struct vfsmount *mnt, int flags)
  * unixes. Our API is identical to OSF/1 to avoid making a mess of AMD
  */
 
-asmlinkage long sys_umount(char * name, int flags)
+asmlinkage long sys_umount(char __user * name, int flags)
 {
 	struct nameidata nd;
 	int retval;
@@ -396,7 +396,7 @@ asmlinkage long sys_umount(char * name, int flags)
  *	The 2.0 compatible umount. No flags. 
  */
  
-asmlinkage long sys_oldumount(char * name)
+asmlinkage long sys_oldumount(char __user * name)
 {
 	return sys_umount(name,0);
 }
@@ -664,7 +664,7 @@ static int do_add_mount(struct nameidata *nd, char *type, int flags,
 	return err;
 }
 
-static int copy_mount_options (const void *data, unsigned long *where)
+static int copy_mount_options (const void __user *data, unsigned long *where)
 {
 	int i;
 	unsigned long page;
@@ -842,8 +842,9 @@ int copy_namespace(int flags, struct task_struct *tsk)
 	return -ENOMEM;
 }
 
-asmlinkage long sys_mount(char * dev_name, char * dir_name, char * type,
-			  unsigned long flags, void * data)
+asmlinkage long sys_mount(char __user * dev_name, char __user * dir_name,
+			  char __user * type, unsigned long flags,
+			  void __user * data)
 {
 	int retval;
 	unsigned long data_page;
@@ -963,7 +964,7 @@ static void chroot_fs_refs(struct nameidata *old_nd, struct nameidata *new_nd)
  *    first.
  */
 
-asmlinkage long sys_pivot_root(const char *new_root, const char *put_old)
+asmlinkage long sys_pivot_root(const char __user *new_root, const char __user *put_old)
 {
 	struct vfsmount *tmp;
 	struct nameidata new_nd, old_nd, parent_nd, root_parent, user_nd;

fs/nfsctl.c

@@ -87,10 +87,10 @@ static struct {
 };
 
 long
-asmlinkage sys_nfsservctl(int cmd, struct nfsctl_arg *arg, void *res)
+asmlinkage sys_nfsservctl(int cmd, struct nfsctl_arg __user *arg, void __user *res)
 {
 	struct file *file;
-	void *p = &arg->u;
+	void __user *p = &arg->u;
 	int version;
 	int err;
 

fs/read_write.c

@@ -335,7 +335,7 @@ static ssize_t do_readv_writev(int type, struct file *file,
 			       const struct iovec __user * uvector,
 			       unsigned long nr_segs, loff_t *pos)
 {
-	typedef ssize_t (*io_fn_t)(struct file *, char *, size_t, loff_t *);
+	typedef ssize_t (*io_fn_t)(struct file *, char __user *, size_t, loff_t *);
 	typedef ssize_t (*iov_fn_t)(struct file *, const struct iovec *, unsigned long, loff_t *);
 
 	size_t tot_len;
@@ -423,7 +423,7 @@ static ssize_t do_readv_writev(int type, struct file *file,
 	ret = 0;
 	vector = iov;
 	while (nr_segs > 0) {
-		void * base;
+		void __user * base;
 		size_t len;
 		ssize_t nr;
 

include/linux/binfmts.h

@@ -56,7 +56,7 @@ extern void remove_arg_zero(struct linux_binprm *);
 extern int search_binary_handler(struct linux_binprm *,struct pt_regs *);
 extern int flush_old_exec(struct linux_binprm * bprm);
 extern int setup_arg_pages(struct linux_binprm * bprm);
-extern int copy_strings(int argc,char ** argv,struct linux_binprm *bprm); 
+extern int copy_strings(int argc,char __user * __user * argv,struct linux_binprm *bprm); 
 extern int copy_strings_kernel(int argc,char ** argv,struct linux_binprm *bprm);
 extern void compute_creds(struct linux_binprm *binprm);
 extern int do_coredump(long signr, int exit_code, struct pt_regs * regs);

include/linux/fs.h

@@ -752,11 +752,11 @@ struct inode_operations {
 
 struct seq_file;
 
-extern ssize_t vfs_read(struct file *, char *, size_t, loff_t *);
-extern ssize_t vfs_write(struct file *, const char *, size_t, loff_t *);
-extern ssize_t vfs_readv(struct file *, const struct iovec *,
+extern ssize_t vfs_read(struct file *, char __user *, size_t, loff_t *);
+extern ssize_t vfs_write(struct file *, const char __user *, size_t, loff_t *);
+extern ssize_t vfs_readv(struct file *, const struct iovec __user *,
 		unsigned long, loff_t *);
-extern ssize_t vfs_writev(struct file *, const struct iovec *,
+extern ssize_t vfs_writev(struct file *, const struct iovec __user *,
 		unsigned long, loff_t *);
 
 /*
@@ -1202,16 +1202,16 @@ extern int generic_file_mmap(struct file *, struct vm_area_struct *);
 extern int generic_file_readonly_mmap(struct file *, struct vm_area_struct *);
 extern int file_read_actor(read_descriptor_t * desc, struct page *page, unsigned long offset, unsigned long size);
 extern int file_send_actor(read_descriptor_t * desc, struct page *page, unsigned long offset, unsigned long size);
-extern ssize_t generic_file_read(struct file *, char *, size_t, loff_t *);
+extern ssize_t generic_file_read(struct file *, char __user *, size_t, loff_t *);
 int generic_write_checks(struct inode *inode, struct file *file,
 			loff_t *pos, size_t *count, int isblk);
-extern ssize_t generic_file_write(struct file *, const char *, size_t, loff_t *);
+extern ssize_t generic_file_write(struct file *, const char __user *, size_t, loff_t *);
 extern ssize_t generic_file_aio_read(struct kiocb *, char *, size_t, loff_t);
 extern ssize_t generic_file_aio_write(struct kiocb *, const char *, size_t, loff_t);
 extern ssize_t generic_file_aio_write_nolock(struct kiocb *, const struct iovec *,
 				unsigned long, loff_t *);
-extern ssize_t do_sync_read(struct file *filp, char *buf, size_t len, loff_t *ppos);
-extern ssize_t do_sync_write(struct file *filp, const char *buf, size_t len, loff_t *ppos);
+extern ssize_t do_sync_read(struct file *filp, char __user *buf, size_t len, loff_t *ppos);
+extern ssize_t do_sync_write(struct file *filp, const char __user *buf, size_t len, loff_t *ppos);
 ssize_t generic_file_write_nolock(struct file *file, const struct iovec *iov,
 				unsigned long nr_segs, loff_t *ppos);
 extern ssize_t generic_file_sendfile(struct file *, loff_t *, size_t, read_actor_t, void *);
@@ -1247,9 +1247,9 @@ static inline void do_generic_file_read(struct file * filp, loff_t *ppos,
 
 extern struct file_operations generic_ro_fops;
 
-extern int vfs_readlink(struct dentry *, char *, int, const char *);
+extern int vfs_readlink(struct dentry *, char __user *, int, const char *);
 extern int vfs_follow_link(struct nameidata *, const char *);
-extern int page_readlink(struct dentry *, char *, int);
+extern int page_readlink(struct dentry *, char __user *, int);
 extern int page_follow_link(struct dentry *, struct nameidata *);
 extern int page_symlink(struct inode *inode, const char *symname, int len);
 extern struct inode_operations page_symlink_inode_operations;

include/linux/nfsd/syscall.h

@@ -116,7 +116,7 @@ union nfsctl_res {
 /*
  * Kernel syscall implementation.
  */
-extern asmlinkage long	sys_nfsservctl(int, struct nfsctl_arg *, void *);
+extern asmlinkage long	sys_nfsservctl(int, struct nfsctl_arg __user *, void __user *);
 extern int		exp_addclient(struct nfsctl_client *ncp);
 extern int		exp_delclient(struct nfsctl_client *ncp);
 extern int		exp_export(struct nfsctl_export *nxp);

include/linux/sched.h

@@ -629,7 +629,7 @@ extern void daemonize(const char *, ...);
 extern int allow_signal(int);
 extern task_t *child_reaper;
 
-extern int do_execve(char *, char **, char **, struct pt_regs *);
+extern int do_execve(char *, char __user * __user *, char __user * __user *, struct pt_regs *);
 extern struct task_struct *do_fork(unsigned long, unsigned long, struct pt_regs *, unsigned long, int *, int *);
 
 #ifdef CONFIG_SMP

include/linux/uio.h

 #ifndef __LINUX_UIO_H
 #define __LINUX_UIO_H
 
+#include <linux/compiler.h>
 #include <linux/types.h>
 
 /*
@@ -18,7 +19,7 @@
 
 struct iovec
 {
-	void *iov_base;		/* BSD uses caddr_t (1003.1g requires void *) */
+	void __user *iov_base;	/* BSD uses caddr_t (1003.1g requires void *) */
 	__kernel_size_t iov_len; /* Must be size_t (1003.1g) */
 };
 

kernel/module.c

@@ -165,7 +165,7 @@ static unsigned long __find_symbol(const char *name,
 		if (gplok) {
 			for (i = 0; i < mod->num_gpl_syms; i++) {
 				if (strcmp(mod->gpl_syms[i].name, name) == 0) {
-					*crc = symversion(mod->crcs, i);
+					*crc = symversion(mod->gpl_crcs, i);
 					return mod->gpl_syms[i].value;
 				}
 			}

kernel/posix-timers.c

@@ -87,6 +87,8 @@ static spinlock_t idr_lock = SPIN_LOCK_UNLOCKED;
 		      SIGEV_SIGNAL & \
 		      SIGEV_THREAD &  \
 		      SIGEV_THREAD_ID)
+
+#define REQUEUE_PENDING 1
 /*
  * The timer ID is turned into a timer address by idr_find().
  * Verifying a valid ID consists of:
@@ -245,7 +247,7 @@ static void schedule_next_timer(struct k_itimer *timr)
 
 	timr->it_overrun_last = timr->it_overrun;
 	timr->it_overrun = -1;
-	timr->it_requeue_pending = 0;
+	++timr->it_requeue_pending;
 	add_timer(&timr->it_timer);
 }
 
@@ -286,16 +288,16 @@ void do_schedule_next_timer(struct siginfo *info)
  * without an info block.  In this case, we will not get a call back to
  * do_schedule_next_timer() so we do it here.  This should be rare...
 
- * An interesting problem can occure if, while a signal, and thus a call
+ * An interesting problem can occur if, while a signal, and thus a call
  * back is pending, the timer is rearmed, i.e. stopped and restarted.
  * We then need to sort out the call back and do the right thing.  What
  * we do is to put a counter in the info block and match it with the
  * timers copy on the call back.  If they don't match, we just ignore
- * the call back.  Note that we do allow the timer to be deleted while
- * a signal is pending.  The standard says we can allow that signal to
- * be delivered, and we do.
+ * the call back.  The counter is local to the timer and we use odd to
+ * indicate a call back is pending.  Note that we do allow the timer to 
+ * be deleted while a signal is pending.  The standard says we can
+ * allow that signal to be delivered, and we do. 
  */
-static int pendcount = 1;
 
 static void timer_notify_task(struct k_itimer *timr)
 {
@@ -310,17 +312,12 @@ static void timer_notify_task(struct k_itimer *timr)
 	info.si_code = SI_TIMER;
 	info.si_tid = timr->it_id;
 	info.si_value = timr->it_sigev_value;
-	if (timr->it_incr){
-		/*
-		 * Don't allow a call back counter of zero...
-		 * and avoid the test by using 2.
-		 */
-		pendcount += 2;
-		timr->it_requeue_pending = info.si_sys_private = pendcount;
-	}
-	if( timr->it_sigev_notify & SIGEV_THREAD_ID & MIPS_SIGEV){
+	if (timr->it_incr)
+		info.si_sys_private = ++timr->it_requeue_pending;
+
+	if (timr->it_sigev_notify & SIGEV_THREAD_ID & MIPS_SIGEV)
 		ret = send_sig_info(info.si_signo, &info, timr->it_process);
-	}else
+	else
 		ret = send_group_sig_info(info.si_signo, &info, 
 					  timr->it_process);
 	switch (ret) {
@@ -617,7 +614,7 @@ do_timer_gettime(struct k_itimer *timr, struct itimerspec *cur_setting)
 			posix_time_before(&timr->it_timer, &now))
 		timr->it_timer.expires = expires = 0;
 	if (expires) {
-		if (timr->it_requeue_pending ||
+		if (timr->it_requeue_pending & REQUEUE_PENDING ||
 		    (timr->it_sigev_notify & SIGEV_NONE))
 			while (posix_time_before(&timr->it_timer, &now))
 				posix_bump_timer(timr);
@@ -779,7 +776,8 @@ do_timer_settime(struct k_itimer *timr, int flags,
 #else
 	del_timer(&timr->it_timer);
 #endif
-	timr->it_requeue_pending = 0;
+	timr->it_requeue_pending = (timr->it_requeue_pending + 2) & 
+		~REQUEUE_PENDING;
 	timr->it_overrun_last = 0;
 	timr->it_overrun = -1;
 	/*