diff options
35 files changed, 153 insertions, 89 deletions
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig index 3a75a0b2beb..a04f507e7f2 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -1072,6 +1072,8 @@ source "drivers/rtc/Kconfig" source "drivers/dma/Kconfig" +source "drivers/dca/Kconfig" + endmenu source "fs/Kconfig" diff --git a/arch/arm/mach-omap1/board-fsample.c b/arch/arm/mach-omap1/board-fsample.c index f65baa95986..d5f6ea14fc7 100644 --- a/arch/arm/mach-omap1/board-fsample.c +++ b/arch/arm/mach-omap1/board-fsample.c @@ -40,31 +40,29 @@ static int fsample_keymap[] = { KEY(0,1,KEY_RIGHT), KEY(0,2,KEY_LEFT), KEY(0,3,KEY_DOWN), - KEY(0,4,KEY_CENTER), - KEY(0,5,KEY_0_5), - KEY(1,0,KEY_SOFT2), + KEY(0,4,KEY_ENTER), + KEY(1,0,KEY_F10), KEY(1,1,KEY_SEND), KEY(1,2,KEY_END), KEY(1,3,KEY_VOLUMEDOWN), KEY(1,4,KEY_VOLUMEUP), KEY(1,5,KEY_RECORD), - KEY(2,0,KEY_SOFT1), + KEY(2,0,KEY_F9), KEY(2,1,KEY_3), KEY(2,2,KEY_6), KEY(2,3,KEY_9), - KEY(2,4,KEY_SHARP), - KEY(2,5,KEY_2_5), + KEY(2,4,KEY_KPDOT), KEY(3,0,KEY_BACK), KEY(3,1,KEY_2), KEY(3,2,KEY_5), KEY(3,3,KEY_8), KEY(3,4,KEY_0), - KEY(3,5,KEY_HEADSETHOOK), + KEY(3,5,KEY_KPSLASH), KEY(4,0,KEY_HOME), KEY(4,1,KEY_1), KEY(4,2,KEY_4), KEY(4,3,KEY_7), - KEY(4,4,KEY_STAR), + KEY(4,4,KEY_KPASTERISK), KEY(4,5,KEY_POWER), 0 }; diff --git a/arch/arm/mach-omap1/board-nokia770.c b/arch/arm/mach-omap1/board-nokia770.c index 22db19a5364..182a98a9df4 100644 --- a/arch/arm/mach-omap1/board-nokia770.c +++ b/arch/arm/mach-omap1/board-nokia770.c @@ -36,8 +36,6 @@ #include <asm/arch/omapfb.h> #include <asm/arch/lcd_mipid.h> -#include "../plat-omap/dsp/dsp_common.h" - #define ADS7846_PENDOWN_GPIO 15 static void __init omap_nokia770_init_irq(void) @@ -318,6 +316,8 @@ static __init int omap_dsp_init(void) out: return ret; } +#else +#define omap_dsp_init() do {} while (0) #endif /* CONFIG_OMAP_DSP */ static void __init omap_nokia770_init(void) diff --git a/arch/arm/mach-omap1/board-perseus2.c b/arch/arm/mach-omap1/board-perseus2.c index 1d5c8d50972..e44437e10ee 100644 --- a/arch/arm/mach-omap1/board-perseus2.c +++ b/arch/arm/mach-omap1/board-perseus2.c @@ -39,31 +39,29 @@ static int p2_keymap[] = { KEY(0,1,KEY_RIGHT), KEY(0,2,KEY_LEFT), KEY(0,3,KEY_DOWN), - KEY(0,4,KEY_CENTER), - KEY(0,5,KEY_0_5), - KEY(1,0,KEY_SOFT2), + KEY(0,4,KEY_ENTER), + KEY(1,0,KEY_F10), KEY(1,1,KEY_SEND), KEY(1,2,KEY_END), KEY(1,3,KEY_VOLUMEDOWN), KEY(1,4,KEY_VOLUMEUP), KEY(1,5,KEY_RECORD), - KEY(2,0,KEY_SOFT1), + KEY(2,0,KEY_F9), KEY(2,1,KEY_3), KEY(2,2,KEY_6), KEY(2,3,KEY_9), - KEY(2,4,KEY_SHARP), - KEY(2,5,KEY_2_5), + KEY(2,4,KEY_KPDOT), KEY(3,0,KEY_BACK), KEY(3,1,KEY_2), KEY(3,2,KEY_5), KEY(3,3,KEY_8), KEY(3,4,KEY_0), - KEY(3,5,KEY_HEADSETHOOK), + KEY(3,5,KEY_KPSLASH), KEY(4,0,KEY_HOME), KEY(4,1,KEY_1), KEY(4,2,KEY_4), KEY(4,3,KEY_7), - KEY(4,4,KEY_STAR), + KEY(4,4,KEY_KPASTERISK), KEY(4,5,KEY_POWER), 0 }; diff --git a/arch/arm/mach-pxa/sleep.S b/arch/arm/mach-pxa/sleep.S index aff71fec618..d0447723b73 100644 --- a/arch/arm/mach-pxa/sleep.S +++ b/arch/arm/mach-pxa/sleep.S @@ -43,11 +43,11 @@ pxa_cpu_save_cp: pxa_cpu_save_sp: @ preserve phys address of stack mov r0, sp - mov r2, lr + str lr, [sp, #-4]! bl sleep_phys_sp ldr r1, =sleep_save_sp str r0, [r1] - mov pc, r2 + ldr pc, [sp], #4 /* * pxa27x_cpu_suspend() @@ -270,5 +270,3 @@ resume_after_mmu: mar acc0, r2, r3 #endif ldmfd sp!, {r4 - r12, pc} @ return to caller - - diff --git a/arch/cris/arch-v10/kernel/io_interface_mux.c b/arch/cris/arch-v10/kernel/io_interface_mux.c index 3a9114e89ed..f3b327d4ed9 100644 --- a/arch/cris/arch-v10/kernel/io_interface_mux.c +++ b/arch/cris/arch-v10/kernel/io_interface_mux.c @@ -392,6 +392,7 @@ int cris_request_io_interface(enum cris_io_interface ioif, const char *device_id if (((interfaces[ioif].gpio_g_in & gpio_in_pins) != interfaces[ioif].gpio_g_in) || ((interfaces[ioif].gpio_g_out & gpio_out_pins) != interfaces[ioif].gpio_g_out) || ((interfaces[ioif].gpio_b & gpio_pb_pins) != interfaces[ioif].gpio_b)) { + local_irq_restore(flags); printk(KERN_CRIT "cris_request_io_interface: Could not get required pins for interface %u\n", ioif); return -EBUSY; diff --git a/arch/mips/mips-boards/malta/malta_setup.c b/arch/mips/mips-boards/malta/malta_setup.c index 9a2636e5624..bc43a5c2224 100644 --- a/arch/mips/mips-boards/malta/malta_setup.c +++ b/arch/mips/mips-boards/malta/malta_setup.c @@ -149,7 +149,7 @@ void __init plat_mem_setup(void) /* Check PCI clock */ { unsigned int __iomem *jmpr_p = (unsigned int *) ioremap(MALTA_JMPRS_REG, sizeof(unsigned int)); - int jmpr = (readw(jmpr_p) >> 2) & 0x07; + int jmpr = (__raw_readl(jmpr_p) >> 2) & 0x07; static const int pciclocks[] __initdata = { 33, 20, 25, 30, 12, 16, 37, 10 }; diff --git a/arch/mips/tx4938/toshiba_rbtx4938/setup.c b/arch/mips/tx4938/toshiba_rbtx4938/setup.c index 4a8152375ef..632e5d20135 100644 --- a/arch/mips/tx4938/toshiba_rbtx4938/setup.c +++ b/arch/mips/tx4938/toshiba_rbtx4938/setup.c @@ -598,8 +598,8 @@ static int __init rbtx4938_ethaddr_init(void) printk(KERN_WARNING "seeprom: bad checksum.\n"); } for (i = 0; i < 2; i++) { - unsigned int slot = TX4938_PCIC_IDSEL_AD_TO_SLOT(31 - i); - unsigned int id = (1 << 8) | PCI_DEVFN(slot, 0); /* bus 1 */ + unsigned int id = + TXX9_IRQ_BASE + (i ? TX4938_IR_ETH1 : TX4938_IR_ETH0); struct platform_device *pdev; if (!(tx4938_ccfgptr->pcfg & (i ? TX4938_PCFG_ETH1_SEL : TX4938_PCFG_ETH0_SEL))) diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c index 0bd657f5dd2..84672dc57f7 100644 --- a/drivers/atm/idt77105.c +++ b/drivers/atm/idt77105.c @@ -357,7 +357,7 @@ static const struct atmphy_ops idt77105_ops = { }; -int __devinit idt77105_init(struct atm_dev *dev) +int idt77105_init(struct atm_dev *dev) { dev->phy = &idt77105_ops; return 0; diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c index f04f39c0083..b1d063cc4fb 100644 --- a/drivers/atm/suni.c +++ b/drivers/atm/suni.c @@ -289,7 +289,7 @@ static const struct atmphy_ops suni_ops = { }; -int __devinit suni_init(struct atm_dev *dev) +int suni_init(struct atm_dev *dev) { unsigned char mri; diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c index 0c9a6f7104d..76c0fa690cc 100644 --- a/drivers/net/e1000/e1000_main.c +++ b/drivers/net/e1000/e1000_main.c @@ -632,6 +632,7 @@ e1000_down(struct e1000_adapter *adapter) #ifdef CONFIG_E1000_NAPI napi_disable(&adapter->napi); + atomic_set(&adapter->irq_sem, 0); #endif e1000_irq_disable(adapter); diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c index 2ab3bfbb8a6..9cc5a6b01bc 100644 --- a/drivers/net/e1000e/netdev.c +++ b/drivers/net/e1000e/netdev.c @@ -2183,6 +2183,7 @@ void e1000e_down(struct e1000_adapter *adapter) msleep(10); napi_disable(&adapter->napi); + atomic_set(&adapter->irq_sem, 0); e1000_irq_disable(adapter); del_timer_sync(&adapter->watchdog_timer); diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c index d2fb88d5cda..4f63839051b 100644 --- a/drivers/net/ixgb/ixgb_main.c +++ b/drivers/net/ixgb/ixgb_main.c @@ -296,6 +296,11 @@ ixgb_down(struct ixgb_adapter *adapter, boolean_t kill_watchdog) { struct net_device *netdev = adapter->netdev; +#ifdef CONFIG_IXGB_NAPI + napi_disable(&adapter->napi); + atomic_set(&adapter->irq_sem, 0); +#endif + ixgb_irq_disable(adapter); free_irq(adapter->pdev->irq, netdev); @@ -304,9 +309,7 @@ ixgb_down(struct ixgb_adapter *adapter, boolean_t kill_watchdog) if(kill_watchdog) del_timer_sync(&adapter->watchdog_timer); -#ifdef CONFIG_IXGB_NAPI - napi_disable(&adapter->napi); -#endif + adapter->link_speed = 0; adapter->link_duplex = 0; netif_carrier_off(netdev); diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c index de3f45e4c5a..a4265bc1ceb 100644 --- a/drivers/net/ixgbe/ixgbe_main.c +++ b/drivers/net/ixgbe/ixgbe_main.c @@ -1409,9 +1409,11 @@ void ixgbe_down(struct ixgbe_adapter *adapter) IXGBE_WRITE_FLUSH(&adapter->hw); msleep(10); + napi_disable(&adapter->napi); + atomic_set(&adapter->irq_sem, 0); + ixgbe_irq_disable(adapter); - napi_disable(&adapter->napi); del_timer_sync(&adapter->watchdog_timer); netif_carrier_off(netdev); diff --git a/drivers/net/tc35815.c b/drivers/net/tc35815.c index d887c05588d..370d329d15d 100644 --- a/drivers/net/tc35815.c +++ b/drivers/net/tc35815.c @@ -611,7 +611,7 @@ static int __devinit tc35815_mac_match(struct device *dev, void *data) { struct platform_device *plat_dev = to_platform_device(dev); struct pci_dev *pci_dev = data; - unsigned int id = (pci_dev->bus->number << 8) | pci_dev->devfn; + unsigned int id = pci_dev->irq; return !strcmp(plat_dev->name, "tc35815-mac") && plat_dev->id == id; } diff --git a/drivers/net/veth.c b/drivers/net/veth.c index 43af9e9b265..3f67a29593b 100644 --- a/drivers/net/veth.c +++ b/drivers/net/veth.c @@ -459,19 +459,7 @@ static __init int veth_init(void) static __exit void veth_exit(void) { - struct veth_priv *priv, *next; - - rtnl_lock(); - /* - * cannot trust __rtnl_link_unregister() to unregister all - * devices, as each ->dellink call will remove two devices - * from the list at once. - */ - list_for_each_entry_safe(priv, next, &veth_list, list) - veth_dellink(priv->dev); - - __rtnl_link_unregister(&veth_link_ops); - rtnl_unlock(); + rtnl_link_unregister(&veth_link_ops); } module_init(veth_init); diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c index feba9679ace..7c069a02c1d 100644 --- a/drivers/usb/serial/keyspan.c +++ b/drivers/usb/serial/keyspan.c @@ -447,7 +447,7 @@ static void usa26_indat_callback(struct urb *urb) port = (struct usb_serial_port *) urb->context; tty = port->tty; - if (urb->actual_length) { + if (tty && urb->actual_length) { /* 0x80 bit is error flag */ if ((data[0] & 0x80) == 0) { /* no errors on individual bytes, only possible overrun err*/ diff --git a/drivers/video/s3c2410fb.c b/drivers/video/s3c2410fb.c index ad35033f1a4..b3c31d9dc59 100644 --- a/drivers/video/s3c2410fb.c +++ b/drivers/video/s3c2410fb.c @@ -488,7 +488,7 @@ static int s3c2410fb_set_par(struct fb_info *info) break; } - info->fix.line_length = (var->width * var->bits_per_pixel) / 8; + info->fix.line_length = (var->xres_virtual * var->bits_per_pixel) / 8; /* activate this new configuration */ diff --git a/include/asm-mips/smtc_ipi.h b/include/asm-mips/smtc_ipi.h index e09131a6127..8ce51757434 100644 --- a/include/asm-mips/smtc_ipi.h +++ b/include/asm-mips/smtc_ipi.h @@ -49,7 +49,7 @@ struct smtc_ipi_q { static inline void smtc_ipi_nq(struct smtc_ipi_q *q, struct smtc_ipi *p) { - long flags; + unsigned long flags; spin_lock_irqsave(&q->lock, flags); if (q->head == NULL) @@ -98,7 +98,7 @@ static inline struct smtc_ipi *smtc_ipi_dq(struct smtc_ipi_q *q) static inline void smtc_ipi_req(struct smtc_ipi_q *q, struct smtc_ipi *p) { - long flags; + unsigned long flags; spin_lock_irqsave(&q->lock, flags); if (q->head == NULL) { @@ -114,7 +114,7 @@ static inline void smtc_ipi_req(struct smtc_ipi_q *q, struct smtc_ipi *p) static inline int smtc_ipi_qdepth(struct smtc_ipi_q *q) { - long flags; + unsigned long flags; int retval; spin_lock_irqsave(&q->lock, flags); diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c index e65dd0b47cd..f994bb8065e 100644 --- a/kernel/hrtimer.c +++ b/kernel/hrtimer.c @@ -1378,7 +1378,7 @@ sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp) /* * Functions related to boot-time initialization: */ -static void __devinit init_hrtimers_cpu(int cpu) +static void __cpuinit init_hrtimers_cpu(int cpu) { struct hrtimer_cpu_base *cpu_base = &per_cpu(hrtimer_bases, cpu); int i; diff --git a/kernel/timer.c b/kernel/timer.c index 26671f4db07..2a00c22203f 100644 --- a/kernel/timer.c +++ b/kernel/timer.c @@ -1289,7 +1289,7 @@ static void migrate_timer_list(tvec_base_t *new_base, struct list_head *head) } } -static void __devinit migrate_timers(int cpu) +static void __cpuinit migrate_timers(int cpu) { tvec_base_t *old_base; tvec_base_t *new_base; diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c index 5d8b939eded..9f78a69d6b8 100644 --- a/net/bridge/br_netfilter.c +++ b/net/bridge/br_netfilter.c @@ -142,6 +142,23 @@ static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb) return skb->nf_bridge; } +static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb) +{ + struct nf_bridge_info *nf_bridge = skb->nf_bridge; + + if (atomic_read(&nf_bridge->use) > 1) { + struct nf_bridge_info *tmp = nf_bridge_alloc(skb); + + if (tmp) { + memcpy(tmp, nf_bridge, sizeof(struct nf_bridge_info)); + atomic_set(&tmp->use, 1); + nf_bridge_put(nf_bridge); + } + nf_bridge = tmp; + } + return nf_bridge; +} + static inline void nf_bridge_push_encap_header(struct sk_buff *skb) { unsigned int len = nf_bridge_encap_header_len(skb); @@ -637,6 +654,11 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb, if (!skb->nf_bridge) return NF_ACCEPT; + /* Need exclusive nf_bridge_info since we might have multiple + * different physoutdevs. */ + if (!nf_bridge_unshare(skb)) + return NF_DROP; + parent = bridge_parent(out); if (!parent) return NF_DROP; @@ -718,6 +740,11 @@ static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff *skb, if (!skb->nf_bridge) return NF_ACCEPT; + /* Need exclusive nf_bridge_info since we might have multiple + * different physoutdevs. */ + if (!nf_bridge_unshare(skb)) + return NF_DROP; + nf_bridge = skb->nf_bridge; if (!(nf_bridge->mask & BRNF_BRIDGED_DNAT)) return NF_ACCEPT; diff --git a/net/core/neighbour.c b/net/core/neighbour.c index cc8a2f190ac..29b8ee4e35d 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -1316,6 +1316,8 @@ void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms) *p = parms->next; parms->dead = 1; write_unlock_bh(&tbl->lock); + if (parms->dev) + dev_put(parms->dev); call_rcu(&parms->rcu_head, neigh_rcu_free_parms); return; } @@ -1326,8 +1328,6 @@ void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms) void neigh_parms_destroy(struct neigh_parms *parms) { - if (parms->dev) - dev_put(parms->dev); kfree(parms); } diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index e1ba26fb4bf..fed95a323b2 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -308,9 +308,12 @@ void __rtnl_link_unregister(struct rtnl_link_ops *ops) struct net *net; for_each_net(net) { +restart: for_each_netdev_safe(net, dev, n) { - if (dev->rtnl_link_ops == ops) + if (dev->rtnl_link_ops == ops) { ops->dellink(dev); + goto restart; + } } } list_del(&ops->list); diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c index 527a6e0af5b..0dfee27cfbc 100644 --- a/net/ipv4/fib_hash.c +++ b/net/ipv4/fib_hash.c @@ -444,6 +444,9 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg) struct fib_info *fi_drop; u8 state; + if (fi->fib_treeref > 1) + goto out; + write_lock_bh(&fib_hash_lock); fi_drop = fa->fa_info; fa->fa_info = fi; @@ -718,19 +721,18 @@ fn_hash_dump_zone(struct sk_buff *skb, struct netlink_callback *cb, { int h, s_h; + if (fz->fz_hash == NULL) + return skb->len; s_h = cb->args[3]; - for (h=0; h < fz->fz_divisor; h++) { - if (h < s_h) continue; - if (h > s_h) - memset(&cb->args[4], 0, - sizeof(cb->args) - 4*sizeof(cb->args[0])); - if (fz->fz_hash == NULL || - hlist_empty(&fz->fz_hash[h])) + for (h = s_h; h < fz->fz_divisor; h++) { + if (hlist_empty(&fz->fz_hash[h])) continue; - if (fn_hash_dump_bucket(skb, cb, tb, fz, &fz->fz_hash[h])<0) { + if (fn_hash_dump_bucket(skb, cb, tb, fz, &fz->fz_hash[h]) < 0) { cb->args[3] = h; return -1; } + memset(&cb->args[4], 0, + sizeof(cb->args) - 4*sizeof(cb->args[0])); } cb->args[3] = h; return skb->len; @@ -746,14 +748,13 @@ static int fn_hash_dump(struct fib_table *tb, struct sk_buff *skb, struct netlin read_lock(&fib_hash_lock); for (fz = table->fn_zone_list, m=0; fz; fz = fz->fz_next, m++) { if (m < s_m) continue; - if (m > s_m) - memset(&cb->args[3], 0, - sizeof(cb->args) - 3*sizeof(cb->args[0])); if (fn_hash_dump_zone(skb, cb, tb, fz) < 0) { cb->args[2] = m; read_unlock(&fib_hash_lock); return -1; } + memset(&cb->args[3], 0, + sizeof(cb->args) - 3*sizeof(cb->args[0])); } read_unlock(&fib_hash_lock); cb->args[2] = m; diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c index 8d8c2915e06..1010b469d7d 100644 --- a/net/ipv4/fib_trie.c +++ b/net/ipv4/fib_trie.c @@ -1214,6 +1214,9 @@ static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg) struct fib_info *fi_drop; u8 state; + if (fi->fib_treeref > 1) + goto out; + err = -ENOBUFS; new_fa = kmem_cache_alloc(fn_alias_kmem, GFP_KERNEL); if (new_fa == NULL) diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 233de063429..82baea02648 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -540,7 +540,6 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) icmp_param.data.icmph.checksum = 0; icmp_param.skb = skb_in; icmp_param.offset = skb_network_offset(skb_in); - icmp_out_count(icmp_param.data.icmph.type); inet_sk(icmp_socket->sk)->tos = tos; ipc.addr = iph->saddr; ipc.opt = &icmp_param.replyopts; diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c index 9bb031fa1c2..f1240688dc5 100644 --- a/net/ipv6/icmp.c +++ b/net/ipv6/icmp.c @@ -458,8 +458,6 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info, } err = icmpv6_push_pending_frames(sk, &fl, &tmp_hdr, len + sizeof(struct icmp6hdr)); - ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTMSGS); - out_put: if (likely(idev != NULL)) in6_dev_put(idev); diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c index adc73adadfa..0765d8bd380 100644 --- a/net/ipv6/inet6_hashtables.c +++ b/net/ipv6/inet6_hashtables.c @@ -193,7 +193,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row, sk2->sk_family == PF_INET6 && ipv6_addr_equal(&tw6->tw_v6_daddr, saddr) && ipv6_addr_equal(&tw6->tw_v6_rcv_saddr, daddr) && - sk2->sk_bound_dev_if == sk->sk_bound_dev_if) { + (!sk2->sk_bound_dev_if || sk2->sk_bound_dev_if == dif)) { if (twsk_unique(sk, sk2, twp)) goto unique; else diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c index 8631ed7fe8a..44937616057 100644 --- a/net/ipv6/proc.c +++ b/net/ipv6/proc.c @@ -88,7 +88,7 @@ static char *icmp6type2name[256] = { [ICMPV6_PKT_TOOBIG] = "PktTooBigs", [ICMPV6_TIME_EXCEED] = "TimeExcds", [ICMPV6_PARAMPROB] = "ParmProblems", - [ICMPV6_ECHO_REQUEST] = "EchoRequest", + [ICMPV6_ECHO_REQUEST] = "Echos", [ICMPV6_ECHO_REPLY] = "EchoReplies", [ICMPV6_MGM_QUERY] = "GroupMembQueries", [ICMPV6_MGM_REPORT] = "GroupMembResponses", @@ -98,7 +98,7 @@ static char *icmp6type2name[256] = { [NDISC_ROUTER_SOLICITATION] = "RouterSolicits", [NDISC_NEIGHBOUR_ADVERTISEMENT] = "NeighborAdvertisements", [NDISC_NEIGHBOUR_SOLICITATION] = "NeighborSolicits", - [NDISC_REDIRECT] = "NeighborRedirects", + [NDISC_REDIRECT] = "Redirects", }; diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 6ecb5e6fae2..20083e0d399 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -329,7 +329,7 @@ static inline int rt6_check_dev(struct rt6_info *rt, int oif) static inline int rt6_check_neigh(struct rt6_info *rt) { struct neighbour *neigh = rt->rt6i_nexthop; - int m = 0; + int m; if (rt->rt6i_flags & RTF_NONEXTHOP || !(rt->rt6i_flags & RTF_GATEWAY)) m = 1; @@ -337,10 +337,15 @@ static inline int rt6_check_neigh(struct rt6_info *rt) read_lock_bh(&neigh->lock); if (neigh->nud_state & NUD_VALID) m = 2; - else if (!(neigh->nud_state & NUD_FAILED)) +#ifdef CONFIG_IPV6_ROUTER_PREF + else if (neigh->nud_state & NUD_FAILED) + m = 0; +#endif + else m = 1; read_unlock_bh(&neigh->lock); - } + } else + m = 0; return m; } diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c index d5e4dd75200..07dfa7fdd2a 100644 --- a/net/irda/af_irda.c +++ b/net/irda/af_irda.c @@ -802,12 +802,18 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) } #endif /* CONFIG_IRDA_ULTRA */ + self->ias_obj = irias_new_object(addr->sir_name, jiffies); + if (self->ias_obj == NULL) + return -ENOMEM; + err = irda_open_tsap(self, addr->sir_lsap_sel, addr->sir_name); - if (err < 0) + if (err < 0) { + kfree(self->ias_obj->name); + kfree(self->ias_obj); return err; + } /* Register with LM-IAS */ - self->ias_obj = irias_new_object(addr->sir_name, jiffies); irias_add_integer_attrib(self->ias_obj, "IrDA:TinyTP:LsapSel", self->stsap_sel, IAS_KERNEL_ATTR); irias_insert_object(self->ias_obj); @@ -1825,7 +1831,7 @@ static int irda_setsockopt(struct socket *sock, int level, int optname, struct irda_ias_set *ias_opt; struct ias_object *ias_obj; struct ias_attrib * ias_attr; /* Attribute in IAS object */ - int opt; + int opt, free_ias = 0; IRDA_DEBUG(2, "%s(%p)\n", __FUNCTION__, self); @@ -1881,11 +1887,20 @@ static int irda_setsockopt(struct socket *sock, int level, int optname, /* Create a new object */ ias_obj = irias_new_object(ias_opt->irda_class_name, jiffies); + if (ias_obj == NULL) { + kfree(ias_opt); + return -ENOMEM; + } + free_ias = 1; } /* Do we have the attribute already ? */ if(irias_find_attrib(ias_obj, ias_opt->irda_attrib_name)) { kfree(ias_opt); + if (free_ias) { + kfree(ias_obj->name); + kfree(ias_obj); + } return -EINVAL; } @@ -1904,6 +1919,11 @@ static int irda_setsockopt(struct socket *sock, int level, int optname, if(ias_opt->attribute.irda_attrib_octet_seq.len > IAS_MAX_OCTET_STRING) { kfree(ias_opt); + if (free_ias) { + kfree(ias_obj->name); + kfree(ias_obj); + } + return -EINVAL; } /* Add an octet sequence attribute */ @@ -1932,6 +1952,10 @@ static int irda_setsockopt(struct socket *sock, int level, int optname, break; default : kfree(ias_opt); + if (free_ias) { + kfree(ias_obj->name); + kfree(ias_obj); + } return -EINVAL; } irias_insert_object(ias_obj); diff --git a/net/key/af_key.c b/net/key/af_key.c index 26d5e63c4cc..76dcd882f87 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -3593,27 +3593,29 @@ static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, /* old ipsecrequest */ int mode = pfkey_mode_from_xfrm(mp->mode); if (mode < 0) - return -EINVAL; + goto err; if (set_ipsecrequest(skb, mp->proto, mode, (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), mp->reqid, mp->old_family, - &mp->old_saddr, &mp->old_daddr) < 0) { - return -EINVAL; - } + &mp->old_saddr, &mp->old_daddr) < 0) + goto err; /* new ipsecrequest */ if (set_ipsecrequest(skb, mp->proto, mode, (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), mp->reqid, mp->new_family, - &mp->new_saddr, &mp->new_daddr) < 0) { - return -EINVAL; - } + &mp->new_saddr, &mp->new_daddr) < 0) + goto err; } /* broadcast migrate message to sockets */ pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL); return 0; + +err: + kfree_skb(skb); + return -EINVAL; } #else static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type, diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c index 4469a7be006..d06d338812e 100644 --- a/net/rfkill/rfkill.c +++ b/net/rfkill/rfkill.c @@ -392,11 +392,14 @@ int rfkill_register(struct rfkill *rfkill) rfkill_led_trigger_register(rfkill); error = rfkill_add_switch(rfkill); - if (error) + if (error) { + rfkill_led_trigger_unregister(rfkill); return error; + } error = device_add(dev); if (error) { + rfkill_led_trigger_unregister(rfkill); rfkill_remove_switch(rfkill); return error; } diff --git a/security/commoncap.c b/security/commoncap.c index 5bc1895f3f9..ea61bc73f6d 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -59,6 +59,12 @@ int cap_netlink_recv(struct sk_buff *skb, int cap) EXPORT_SYMBOL(cap_netlink_recv); +/* + * NOTE WELL: cap_capable() cannot be used like the kernel's capable() + * function. That is, it has the reverse semantics: cap_capable() + * returns 0 when a task has a capability, but the kernel's capable() + * returns 1 for this case. + */ int cap_capable (struct task_struct *tsk, int cap) { /* Derived from include/linux/sched.h:capable. */ @@ -107,10 +113,11 @@ static inline int cap_block_setpcap(struct task_struct *target) static inline int cap_inh_is_capped(void) { /* - * return 1 if changes to the inheritable set are limited - * to the old permitted set. + * Return 1 if changes to the inheritable set are limited + * to the old permitted set. That is, if the current task + * does *not* possess the CAP_SETPCAP capability. */ - return !cap_capable(current, CAP_SETPCAP); + return (cap_capable(current, CAP_SETPCAP) != 0); } #else /* ie., ndef CONFIG_SECURITY_FILE_CAPABILITIES */ |