+++ /dev/null
-diff --git a/Makefile b/Makefile
-index 1f60819..259a378 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,7 +1,7 @@
- VERSION = 2
- PATCHLEVEL = 6
- SUBLEVEL = 27
--EXTRAVERSION = .54
-+EXTRAVERSION = .55-rc1
- NAME = Trembling Tortoise
-
- # *DOCUMENTATION*
-diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
-index cc8fb47..835994e 100644
---- a/arch/powerpc/kernel/head_64.S
-+++ b/arch/powerpc/kernel/head_64.S
-@@ -1479,15 +1479,21 @@ __secondary_start:
- /* Load TOC */
- ld r2,PACATOC(r13)
-
-- /* Do early setup for that CPU (stab, slb, hash table pointer) */
-- bl .early_setup_secondary
--
- /* Initialize the kernel stack. Just a repeat for iSeries. */
- LOAD_REG_ADDR(r3, current_set)
- sldi r28,r24,3 /* get current_set[cpu#] */
-- ldx r1,r3,r28
-- addi r1,r1,THREAD_SIZE-STACK_FRAME_OVERHEAD
-- std r1,PACAKSAVE(r13)
-+ ldx r14,r3,r28
-+ addi r14,r14,THREAD_SIZE-STACK_FRAME_OVERHEAD
-+ std r14,PACAKSAVE(r13)
-+
-+ /* Do early setup for that CPU (stab, slb, hash table pointer) */
-+ bl .early_setup_secondary
-+
-+ /*
-+ * setup the new stack pointer, but *don't* use this until
-+ * translation is on.
-+ */
-+ mr r1, r14
-
- /* Clear backchain so we get nice backtraces */
- li r7,0
-diff --git a/block/bsg.c b/block/bsg.c
-index 9cfbea8..dcdbcd3 100644
---- a/block/bsg.c
-+++ b/block/bsg.c
-@@ -421,7 +421,7 @@ static int blk_complete_sgv4_hdr_rq(struct request *rq, struct sg_io_v4 *hdr,
- /*
- * fill in all the output members
- */
-- hdr->device_status = status_byte(rq->errors);
-+ hdr->device_status = rq->errors & 0xff;
- hdr->transport_status = host_byte(rq->errors);
- hdr->driver_status = driver_byte(rq->errors);
- hdr->info = 0;
-diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
-index bcda174..369612e 100644
---- a/drivers/dma/mv_xor.c
-+++ b/drivers/dma/mv_xor.c
-@@ -162,7 +162,7 @@ static int mv_is_err_intr(u32 intr_cause)
-
- static void mv_xor_device_clear_eoc_cause(struct mv_xor_chan *chan)
- {
-- u32 val = (1 << (1 + (chan->idx * 16)));
-+ u32 val = ~(1 << (chan->idx * 16));
- dev_dbg(chan->device->common.dev, "%s, val 0x%08x\n", __func__, val);
- __raw_writel(val, XOR_INTR_CAUSE(chan));
- }
-diff --git a/drivers/media/video/compat_ioctl32.c b/drivers/media/video/compat_ioctl32.c
-index e6ca401..ec850b5 100644
---- a/drivers/media/video/compat_ioctl32.c
-+++ b/drivers/media/video/compat_ioctl32.c
-@@ -499,17 +499,24 @@ struct video_code32
- {
- char loadwhat[16]; /* name or tag of file being passed */
- compat_int_t datasize;
-- unsigned char *data;
-+ compat_uptr_t data;
- };
-
--static inline int microcode32(struct video_code *kp, struct video_code32 __user *up)
-+static struct video_code __user *get_microcode32(struct video_code32 *kp)
- {
-- if(!access_ok(VERIFY_READ, up, sizeof(struct video_code32)) ||
-- copy_from_user(kp->loadwhat, up->loadwhat, sizeof (up->loadwhat)) ||
-- get_user(kp->datasize, &up->datasize) ||
-- copy_from_user(kp->data, up->data, up->datasize))
-- return -EFAULT;
-- return 0;
-+ struct video_code __user *up;
-+
-+ up = compat_alloc_user_space(sizeof(*up));
-+
-+ /*
-+ * NOTE! We don't actually care if these fail. If the
-+ * user address is invalid, the native ioctl will do
-+ * the error handling for us
-+ */
-+ (void) copy_to_user(up->loadwhat, kp->loadwhat, sizeof(up->loadwhat));
-+ (void) put_user(kp->datasize, &up->datasize);
-+ (void) put_user(compat_ptr(kp->data), &up->data);
-+ return up;
- }
-
- #define VIDIOCGTUNER32 _IOWR('v',4, struct video_tuner32)
-@@ -618,7 +625,7 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
- struct video_tuner vt;
- struct video_buffer vb;
- struct video_window vw;
-- struct video_code vc;
-+ struct video_code32 vc;
- struct video_audio va;
- #endif
- struct v4l2_format v2f;
-@@ -745,8 +752,11 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
- break;
- #ifdef CONFIG_VIDEO_V4L1_COMPAT
- case VIDIOCSMICROCODE:
-- err = microcode32(&karg.vc, up);
-- compatible_arg = 0;
-+ /* Copy the 32-bit "video_code32" to kernel space */
-+ if (copy_from_user(&karg.vc, up, sizeof(karg.vc)))
-+ return -EFAULT;
-+ /* Convert the 32-bit version to a 64-bit version in user space */
-+ up = get_microcode32(&karg.vc);
- break;
- #endif
- };
-diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
-index b46e599..13a3885 100644
---- a/drivers/net/atlx/atl1.c
-+++ b/drivers/net/atlx/atl1.c
-@@ -2881,10 +2881,11 @@ static int atl1_resume(struct pci_dev *pdev)
- pci_enable_wake(pdev, PCI_D3cold, 0);
-
- atl1_reset_hw(&adapter->hw);
-- adapter->cmb.cmb->int_stats = 0;
-
-- if (netif_running(netdev))
-+ if (netif_running(netdev)) {
-+ adapter->cmb.cmb->int_stats = 0;
- atl1_up(adapter);
-+ }
- netif_device_attach(netdev);
-
- return 0;
-diff --git a/drivers/net/b44.c b/drivers/net/b44.c
-index 012614e..74b68de 100644
---- a/drivers/net/b44.c
-+++ b/drivers/net/b44.c
-@@ -2164,8 +2164,6 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
- dev->irq = sdev->irq;
- SET_ETHTOOL_OPS(dev, &b44_ethtool_ops);
-
-- netif_carrier_off(dev);
--
- err = ssb_bus_powerup(sdev->bus, 0);
- if (err) {
- dev_err(sdev->dev,
-@@ -2205,6 +2203,8 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
- goto err_out_powerdown;
- }
-
-+ netif_carrier_off(dev);
-+
- ssb_set_drvdata(sdev, dev);
-
- /* Chip reset provides power to the b44 MAC & PCI cores, which
-diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
-index c71982d..2a473cc 100644
---- a/drivers/net/r6040.c
-+++ b/drivers/net/r6040.c
-@@ -135,7 +135,7 @@
- #define RX_DESC_SIZE (RX_DCNT * sizeof(struct r6040_descriptor))
- #define TX_DESC_SIZE (TX_DCNT * sizeof(struct r6040_descriptor))
- #define MBCR_DEFAULT 0x012A /* MAC Bus Control Register */
--#define MCAST_MAX 4 /* Max number multicast addresses to filter */
-+#define MCAST_MAX 3 /* Max number multicast addresses to filter */
-
- /* Descriptor status */
- #define DSC_OWNER_MAC 0x8000 /* MAC is the owner of this descriptor */
-@@ -969,9 +969,6 @@ static void r6040_multicast_list(struct net_device *dev)
- crc >>= 26;
- hash_table[crc >> 4] |= 1 << (15 - (crc & 0xf));
- }
-- /* Write the index of the hash table */
-- for (i = 0; i < 4; i++)
-- iowrite16(hash_table[i] << 14, ioaddr + MCR1);
- /* Fill the MAC hash tables with their values */
- iowrite16(hash_table[0], ioaddr + MAR0);
- iowrite16(hash_table[1], ioaddr + MAR1);
-@@ -979,6 +976,7 @@ static void r6040_multicast_list(struct net_device *dev)
- iowrite16(hash_table[3], ioaddr + MAR3);
- }
- /* Multicast Address 1~4 case */
-+ dmi = dev->mc_list;
- for (i = 0, dmi; (i < dev->mc_count) && (i < MCAST_MAX); i++) {
- adrp = (u16 *)dmi->dmi_addr;
- iowrite16(adrp[0], ioaddr + MID_1L + 8*i);
-@@ -987,9 +985,9 @@ static void r6040_multicast_list(struct net_device *dev)
- dmi = dmi->next;
- }
- for (i = dev->mc_count; i < MCAST_MAX; i++) {
-- iowrite16(0xffff, ioaddr + MID_0L + 8*i);
-- iowrite16(0xffff, ioaddr + MID_0M + 8*i);
-- iowrite16(0xffff, ioaddr + MID_0H + 8*i);
-+ iowrite16(0xffff, ioaddr + MID_1L + 8*i);
-+ iowrite16(0xffff, ioaddr + MID_1M + 8*i);
-+ iowrite16(0xffff, ioaddr + MID_1H + 8*i);
- }
- }
-
-diff --git a/fs/aio.c b/fs/aio.c
-index c1174b5..0f65453 100644
---- a/fs/aio.c
-+++ b/fs/aio.c
-@@ -1677,6 +1677,9 @@ SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
- if (unlikely(nr < 0))
- return -EINVAL;
-
-+ if (unlikely(nr > LONG_MAX/sizeof(*iocbpp)))
-+ nr = LONG_MAX/sizeof(*iocbpp);
-+
- if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(*iocbpp)))))
- return -EFAULT;
-
-diff --git a/fs/exec.c b/fs/exec.c
-index 50da182..fc30de0 100644
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -393,6 +393,9 @@ static int count(char __user * __user * argv, int max)
- argv++;
- if(++i > max)
- return -E2BIG;
-+
-+ if (fatal_signal_pending(current))
-+ return -ERESTARTNOHAND;
- cond_resched();
- }
- }
-@@ -436,6 +439,12 @@ static int copy_strings(int argc, char __user * __user * argv,
- while (len > 0) {
- int offset, bytes_to_copy;
-
-+ if (fatal_signal_pending(current)) {
-+ ret = -ERESTARTNOHAND;
-+ goto out;
-+ }
-+ cond_resched();
-+
- offset = pos % PAGE_SIZE;
- if (offset == 0)
- offset = PAGE_SIZE;
-@@ -608,6 +617,11 @@ int setup_arg_pages(struct linux_binprm *bprm,
- #else
- stack_top = arch_align_stack(stack_top);
- stack_top = PAGE_ALIGN(stack_top);
-+
-+ if (unlikely(stack_top < mmap_min_addr) ||
-+ unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
-+ return -ENOMEM;
-+
- stack_shift = vma->vm_end - stack_top;
-
- bprm->p -= stack_shift;
-diff --git a/include/linux/mm.h b/include/linux/mm.h
-index eeb7e56..c20007c 100644
---- a/include/linux/mm.h
-+++ b/include/linux/mm.h
-@@ -87,7 +87,11 @@ extern unsigned int kobjsize(const void *objp);
- #define VM_MAYSHARE 0x00000080
-
- #define VM_GROWSDOWN 0x00000100 /* general info on the segment */
-+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
- #define VM_GROWSUP 0x00000200
-+#else
-+#define VM_GROWSUP 0x00000000
-+#endif
- #define VM_PFNMAP 0x00000400 /* Page-ranges managed without "struct page", just pure PFN */
- #define VM_DENYWRITE 0x00000800 /* ETXTBSY on write attempts.. */
-
-@@ -1181,8 +1185,10 @@ unsigned long max_sane_readahead(unsigned long nr);
-
- /* Do stack extension */
- extern int expand_stack(struct vm_area_struct *vma, unsigned long address);
--#ifdef CONFIG_IA64
-+#if VM_GROWSUP
- extern int expand_upwards(struct vm_area_struct *vma, unsigned long address);
-+#else
-+ #define expand_upwards(vma, address) do { } while (0)
- #endif
- extern int expand_stack_downwards(struct vm_area_struct *vma,
- unsigned long address);
-diff --git a/mm/memory.c b/mm/memory.c
-index f0282eb..57309b1 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -2396,11 +2396,9 @@ out_nomap:
- }
-
- /*
-- * This is like a special single-page "expand_downwards()",
-- * except we must first make sure that 'address-PAGE_SIZE'
-+ * This is like a special single-page "expand_{down|up}wards()",
-+ * except we must first make sure that 'address{-|+}PAGE_SIZE'
- * doesn't hit another vma.
-- *
-- * The "find_vma()" will do the right thing even if we wrap
- */
- static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
- {
-@@ -2412,6 +2410,15 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
-
- expand_stack(vma, address);
- }
-+ if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
-+ struct vm_area_struct *next = vma->vm_next;
-+
-+ /* As VM_GROWSDOWN but s/below/above/ */
-+ if (next && next->vm_start == address + PAGE_SIZE)
-+ return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
-+
-+ expand_upwards(vma, address + PAGE_SIZE);
-+ }
- return 0;
- }
-
-diff --git a/mm/mmap.c b/mm/mmap.c
-index 08a32cf..17d640d 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -1589,9 +1589,6 @@ static int acct_stack_growth(struct vm_area_struct * vma, unsigned long size, un
- * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
- * vma is the last one with address > vma->vm_end. Have to extend vma.
- */
--#ifndef CONFIG_IA64
--static inline
--#endif
- int expand_upwards(struct vm_area_struct *vma, unsigned long address)
- {
- int error;
-diff --git a/net/wireless/wext.c b/net/wireless/wext.c
-index d98ffb7..6890b7e 100644
---- a/net/wireless/wext.c
-+++ b/net/wireless/wext.c
-@@ -947,7 +947,7 @@ static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
- } else if (!iwp->pointer)
- return -EFAULT;
-
-- extra = kmalloc(extra_size, GFP_KERNEL);
-+ extra = kzalloc(extra_size, GFP_KERNEL);
- if (!extra)
- return -ENOMEM;
-
-diff --git a/sound/core/control.c b/sound/core/control.c
-index 236bbb1..a708b0b 100644
---- a/sound/core/control.c
-+++ b/sound/core/control.c
-@@ -31,6 +31,7 @@
-
- /* max number of user-defined controls */
- #define MAX_USER_CONTROLS 32
-+#define MAX_CONTROL_COUNT 1028
-
- struct snd_kctl_ioctl {
- struct list_head list; /* list of all ioctls */
-@@ -190,6 +191,8 @@ static struct snd_kcontrol *snd_ctl_new(struct snd_kcontrol *control,
-
- snd_assert(control != NULL, return NULL);
- snd_assert(control->count > 0, return NULL);
-+ if (control->count > MAX_CONTROL_COUNT)
-+ return NULL;
- kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL);
- if (kctl == NULL) {
- snd_printk(KERN_ERR "Cannot allocate control instance\n");
-diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
-index 4d6fbb3..cee643e 100644
---- a/sound/pci/rme9652/hdsp.c
-+++ b/sound/pci/rme9652/hdsp.c
-@@ -4569,6 +4569,7 @@ static int snd_hdsp_hwdep_ioctl(struct snd_hwdep *hw, struct file *file, unsigne
- snd_printk(KERN_ERR "Hammerfall-DSP: Firmware needs to be uploaded to the card.\n");
- return -EINVAL;
- }
-+ memset(&info, 0, sizeof(info));
- spin_lock_irqsave(&hdsp->lock, flags);
- info.pref_sync_ref = (unsigned char)hdsp_pref_sync_ref(hdsp);
- info.wordclock_sync_check = (unsigned char)hdsp_wc_sync_check(hdsp);
-diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
-index ab423bc..bd36bdd 100644
---- a/sound/pci/rme9652/hdspm.c
-+++ b/sound/pci/rme9652/hdspm.c
-@@ -4133,6 +4133,7 @@ static int snd_hdspm_hwdep_ioctl(struct snd_hwdep * hw, struct file *file,
-
- case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO:
-
-+ memset(&info, 0, sizeof(info));
- spin_lock_irq(&hdspm->lock);
- info.pref_sync_ref = hdspm_pref_sync_ref(hdspm);
- info.wordclock_sync_check = hdspm_wc_sync_check(hdspm);
git://git.onelab.eu / linux-2.6.git / commitdiff