Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (25 commits)
[Bluetooth] Use work queue to trigger URB submission
[Bluetooth] Add locking for bt_proto array manipulation
[Bluetooth] Check if DLC is still attached to the TTY
[Bluetooth] Fix reference count when connection lookup fails
[Bluetooth] Disconnect HID interrupt channel first
[Bluetooth] Support concurrent connect requests
[Bluetooth] Make use of virtual devices tree
[Bluetooth] Handle return values from driver core functions
[Bluetooth] Fix compat ioctl for BNEP, CMTP and HIDP
[IPV6] sit: Add missing MODULE_LICENSE
[IPV6]: Remove bogus WARN_ON in Proxy-NA handling.
[IPv6] rules: Use RT6_LOOKUP_F_HAS_SADDR and fix source based selectors
[XFRM]: Fix xfrm_state_num going negative.
[NET]: reduce sizeof(struct inet_peer), cleanup, change in peer_check_expire()
NetLabel: the CIPSOv4 passthrough mapping does not pass categories correctly
NetLabel: better error handling involving mls_export_cat()
NetLabel: only deref the CIPSOv4 standard map fields when using standard mapping
[BRIDGE]: flush forwarding table when device carrier off
[NETFILTER]: ctnetlink: Remove debugging messages
[NETFILTER]: Update MAINTAINERS entry
...
diff --git a/drivers/char/rio/rioctrl.c b/drivers/char/rio/rioctrl.c
index 052e812..7ce7761 100644
--- a/drivers/char/rio/rioctrl.c
+++ b/drivers/char/rio/rioctrl.c
@@ -662,7 +662,7 @@
p->RIOError.Error = COPYIN_FAILED;
return -EFAULT;
}
- if (portStats.port >= RIO_PORTS) {
+ if (portStats.port < 0 || portStats.port >= RIO_PORTS) {
p->RIOError.Error = PORT_NUMBER_OUT_OF_RANGE;
return -ENXIO;
}
@@ -702,7 +702,7 @@
p->RIOError.Error = COPYIN_FAILED;
return -EFAULT;
}
- if (portStats.port >= RIO_PORTS) {
+ if (portStats.port < 0 || portStats.port >= RIO_PORTS) {
p->RIOError.Error = PORT_NUMBER_OUT_OF_RANGE;
return -ENXIO;
}
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
index 1d0470c..30175c7 100644
--- a/drivers/ide/ide-taskfile.c
+++ b/drivers/ide/ide-taskfile.c
@@ -524,8 +524,8 @@
task_ioreg_t *hobsptr = args.hobRegister;
int err = 0;
int tasksize = sizeof(struct ide_task_request_s);
- int taskin = 0;
- int taskout = 0;
+ unsigned int taskin = 0;
+ unsigned int taskout = 0;
u8 io_32bit = drive->io_32bit;
char __user *buf = (char __user *)arg;
@@ -538,8 +538,13 @@
return -EFAULT;
}
- taskout = (int) req_task->out_size;
- taskin = (int) req_task->in_size;
+ taskout = req_task->out_size;
+ taskin = req_task->in_size;
+
+ if (taskin > 65536 || taskout > 65536) {
+ err = -EINVAL;
+ goto abort;
+ }
if (taskout) {
int outtotal = tasksize;
diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index c0edb66..7bac86d 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -884,7 +884,7 @@
if (((magic64 == HBA_SIGNATURE_64_BIT) &&
((adapter->pdev->subsystem_device !=
- PCI_SUBSYS_ID_MEGARAID_SATA_150_6) ||
+ PCI_SUBSYS_ID_MEGARAID_SATA_150_6) &&
(adapter->pdev->subsystem_device !=
PCI_SUBSYS_ID_MEGARAID_SATA_150_4))) ||
(adapter->pdev->vendor == PCI_VENDOR_ID_LSI_LOGIC &&
diff --git a/include/asm-frv/highmem.h b/include/asm-frv/highmem.h
index e2247c2..0f390f4 100644
--- a/include/asm-frv/highmem.h
+++ b/include/asm-frv/highmem.h
@@ -82,11 +82,11 @@
dampr = paddr | xAMPRx_L | xAMPRx_M | xAMPRx_S | xAMPRx_SS_16Kb | xAMPRx_V; \
\
if (type != __KM_CACHE) \
- asm volatile("movgs %0,dampr"#ampr :: "r"(dampr)); \
+ asm volatile("movgs %0,dampr"#ampr :: "r"(dampr) : "memory"); \
else \
asm volatile("movgs %0,iampr"#ampr"\n" \
"movgs %0,dampr"#ampr"\n" \
- :: "r"(dampr) \
+ :: "r"(dampr) : "memory" \
); \
\
asm("movsg damlr"#ampr",%0" : "=r"(damlr)); \
@@ -104,7 +104,7 @@
asm volatile("movgs %0,tplr \n" \
"movgs %1,tppr \n" \
"tlbpr %0,gr0,#2,#1" \
- : : "r"(damlr), "r"(dampr)); \
+ : : "r"(damlr), "r"(dampr) : "memory"); \
\
/*printk("TLB: SECN sl=%d L=%08lx P=%08lx\n", slot, damlr, dampr);*/ \
\
@@ -115,7 +115,7 @@
{
unsigned long paddr;
- preempt_disable();
+ inc_preempt_count();
paddr = page_to_phys(page);
switch (type) {
@@ -138,16 +138,16 @@
}
}
-#define __kunmap_atomic_primary(type, ampr) \
-do { \
- asm volatile("movgs gr0,dampr"#ampr"\n"); \
- if (type == __KM_CACHE) \
- asm volatile("movgs gr0,iampr"#ampr"\n"); \
+#define __kunmap_atomic_primary(type, ampr) \
+do { \
+ asm volatile("movgs gr0,dampr"#ampr"\n" ::: "memory"); \
+ if (type == __KM_CACHE) \
+ asm volatile("movgs gr0,iampr"#ampr"\n" ::: "memory"); \
} while(0)
-#define __kunmap_atomic_secondary(slot, vaddr) \
-do { \
- asm volatile("tlbpr %0,gr0,#4,#1" : : "r"(vaddr)); \
+#define __kunmap_atomic_secondary(slot, vaddr) \
+do { \
+ asm volatile("tlbpr %0,gr0,#4,#1" : : "r"(vaddr) : "memory"); \
} while(0)
static inline void kunmap_atomic(void *kvaddr, enum km_type type)
@@ -170,7 +170,8 @@
default:
BUG();
}
- preempt_enable();
+ dec_preempt_count();
+ preempt_check_resched();
}
#endif /* !__ASSEMBLY__ */