+++ /dev/null
-Hot Fix 32.3 for Linux Kernel 2.4.30 - 2006/03/18
-From Willy Tarreau - EXOSEC < wtarreau at exosec.net >
-
-http://linux.exosec.net/kernel/2.4-hf/
-
-- CVE-2004-1058
-- CVE-2004-2607
-- CVE-2005-0204
-- CVE-2005-1263
-- CVE-2005-2457
-- CVE-2005-2490
-- CVE-2005-2708
-- CVE-2005-2709
-- CVE-2005-2973
-- CVE-2005-3180
-- CVE-2005-3257
-- CVE-2005-3783
-- CVE-2005-3806
-- CVE-2005-3857
-
-
-diff -urN linux-2.4.30/arch/alpha/kernel/Makefile linux-2.4.30-hf32.3/arch/alpha/kernel/Makefile
---- linux-2.4.30/arch/alpha/kernel/Makefile 2003-11-28 19:26:19.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/alpha/kernel/Makefile 2006-03-18 00:34:06.000000000 +0100
-@@ -76,7 +76,7 @@
- obj-y += sys_alcor.o
- endif
- ifneq ($(CONFIG_ALPHA_CABRIOLET)$(CONFIG_ALPHA_EB164)$(CONFIG_ALPHA_EB66P)$(CONFIG_ALPHA_LX164)$(CONFIG_ALPHA_PC164),)
--obj-y += sys_cabriolet.o
-+obj-y += sys_cabriolet.o ns87312.o
- endif
-
- obj-$(CONFIG_ALPHA_DP264) += sys_dp264.o
-diff -urN linux-2.4.30/arch/alpha/kernel/pci_iommu.c linux-2.4.30-hf32.3/arch/alpha/kernel/pci_iommu.c
---- linux-2.4.30/arch/alpha/kernel/pci_iommu.c 2003-06-13 16:51:29.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/alpha/kernel/pci_iommu.c 2006-03-18 00:34:06.000000000 +0100
-@@ -503,7 +503,7 @@
- /* Given a scatterlist leader, choose an allocation method and fill
- in the blanks. */
-
--static inline int
-+static int
- sg_fill(struct scatterlist *leader, struct scatterlist *end,
- struct scatterlist *out, struct pci_iommu_arena *arena,
- dma_addr_t max_dma, int dac_allowed)
-diff -urN linux-2.4.30/arch/i386/config.in linux-2.4.30-hf32.3/arch/i386/config.in
---- linux-2.4.30/arch/i386/config.in 2004-11-17 12:54:21.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/i386/config.in 2006-03-18 00:34:06.000000000 +0100
-@@ -65,6 +65,7 @@
- define_bool CONFIG_X86_POPAD_OK y
- define_bool CONFIG_RWSEM_GENERIC_SPINLOCK n
- define_bool CONFIG_RWSEM_XCHGADD_ALGORITHM y
-+ define_bool CONFIG_X86_TSC n
- fi
- if [ "$CONFIG_M486" = "y" ]; then
- define_int CONFIG_X86_L1_CACHE_SHIFT 4
-@@ -72,6 +73,7 @@
- define_bool CONFIG_X86_ALIGNMENT_16 y
- define_bool CONFIG_X86_PPRO_FENCE y
- define_bool CONFIG_X86_F00F_WORKS_OK n
-+ define_bool CONFIG_X86_TSC n
- fi
- if [ "$CONFIG_M586" = "y" ]; then
- define_int CONFIG_X86_L1_CACHE_SHIFT 5
-diff -urN linux-2.4.30/arch/i386/kernel/apm.c linux-2.4.30-hf32.3/arch/i386/kernel/apm.c
---- linux-2.4.30/arch/i386/kernel/apm.c 2003-08-25 13:44:39.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/i386/kernel/apm.c 2006-03-18 00:34:06.000000000 +0100
-@@ -327,7 +327,7 @@
- * Save a segment register away
- */
- #define savesegment(seg, where) \
-- __asm__ __volatile__("movl %%" #seg ",%0" : "=m" (where))
-+ __asm__ __volatile__("mov %%" #seg ",%0" : "=m" (where))
-
- /*
- * Maximum number of events stored
-@@ -553,7 +553,7 @@
-
- #ifdef APM_ZERO_SEGS
- # define APM_DECL_SEGS \
-- unsigned int saved_fs; unsigned int saved_gs;
-+ unsigned short saved_fs; unsigned short saved_gs;
- # define APM_DO_SAVE_SEGS \
- savesegment(fs, saved_fs); savesegment(gs, saved_gs)
- # define APM_DO_ZERO_SEGS \
-diff -urN linux-2.4.30/arch/i386/kernel/io_apic.c linux-2.4.30-hf32.3/arch/i386/kernel/io_apic.c
---- linux-2.4.30/arch/i386/kernel/io_apic.c 2004-11-17 12:54:21.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/i386/kernel/io_apic.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1194,7 +1194,7 @@
- * might have cached one ExtINT interrupt. Finally, at
- * least one tick may be lost due to delays.
- */
-- if (jiffies - t1 > 4)
-+ if (jiffies - t1 > 4 && jiffies - t1 < 16)
- return 1;
-
- return 0;
-diff -urN linux-2.4.30/arch/i386/kernel/mtrr.c linux-2.4.30-hf32.3/arch/i386/kernel/mtrr.c
---- linux-2.4.30/arch/i386/kernel/mtrr.c 2004-08-08 01:26:04.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/i386/kernel/mtrr.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1674,6 +1674,7 @@
- char *ptr;
- char line[LINE_SIZE];
-
-+ if (!len) return -EINVAL;
- if ( !suser () ) return -EPERM;
- /* Can't seek (pwrite) on this device */
- if (ppos != &file->f_pos) return -ESPIPE;
-diff -urN linux-2.4.30/arch/i386/kernel/process.c linux-2.4.30-hf32.3/arch/i386/kernel/process.c
---- linux-2.4.30/arch/i386/kernel/process.c 2004-11-17 12:54:21.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/i386/kernel/process.c 2006-03-18 00:34:06.000000000 +0100
-@@ -544,7 +544,7 @@
- * Save a segment.
- */
- #define savesegment(seg,value) \
-- asm volatile("movl %%" #seg ",%0":"=m" (*(int *)&(value)))
-+ asm volatile("mov %%" #seg ",%0":"=m" (value))
-
- int copy_thread(int nr, unsigned long clone_flags, unsigned long esp,
- unsigned long unused,
-@@ -661,8 +661,8 @@
- * Save away %fs and %gs. No need to save %es and %ds, as
- * those are always kernel segments while inside the kernel.
- */
-- asm volatile("movl %%fs,%0":"=m" (*(int *)&prev->fs));
-- asm volatile("movl %%gs,%0":"=m" (*(int *)&prev->gs));
-+ asm volatile("mov %%fs,%0":"=m" (prev->fs));
-+ asm volatile("mov %%gs,%0":"=m" (prev->gs));
-
- /*
- * Restore %fs and %gs.
-diff -urN linux-2.4.30/arch/i386/kernel/traps.c linux-2.4.30-hf32.3/arch/i386/kernel/traps.c
---- linux-2.4.30/arch/i386/kernel/traps.c 2002-11-29 00:53:09.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/i386/kernel/traps.c 2006-03-18 00:34:06.000000000 +0100
-@@ -631,15 +631,14 @@
- */
- cwd = get_fpu_cwd(task);
- swd = get_fpu_swd(task);
-- switch (((~cwd) & swd & 0x3f) | (swd & 0x240)) {
-+ switch (swd & ~cwd & 0x3f) {
- case 0x000:
- default:
- break;
- case 0x001: /* Invalid Op */
-- case 0x041: /* Stack Fault */
-- case 0x241: /* Stack Fault | Direction */
-+ /* swd & 0x240 == 0x040: Stack Fault */
-+ /* swd & 0x240 == 0x240: Stack Fault | Direction */
- info.si_code = FPE_FLTINV;
-- /* Should we clear the SF or let user space do it ???? */
- break;
- case 0x002: /* Denormalize */
- case 0x010: /* Underflow */
-diff -urN linux-2.4.30/arch/ia64/ia32/sys_ia32.c linux-2.4.30-hf32.3/arch/ia64/ia32/sys_ia32.c
---- linux-2.4.30/arch/ia64/ia32/sys_ia32.c 2005-04-14 09:43:32.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/ia64/ia32/sys_ia32.c 2006-03-18 00:34:06.000000000 +0100
-@@ -94,7 +94,7 @@
- static DECLARE_MUTEX(ia32_mmap_sem);
-
- static int
--nargs (unsigned int arg, char **ap)
-+nargs (unsigned int arg, char **ap, int max)
- {
- unsigned int addr;
- int n, err;
-@@ -107,6 +107,8 @@
- err = get_user(addr, (unsigned int *)A(arg));
- if (err)
- return err;
-+ if (n > max)
-+ return -E2BIG;
- if (ap)
- *ap++ = (char *) A(addr);
- arg += sizeof(unsigned int);
-@@ -128,10 +130,11 @@
- int na, ne, len;
- long r;
-
-- na = nargs(argv, NULL);
-+ /* Allocates upto 2x MAX_ARG_PAGES */
-+ na = nargs(argv, NULL, (MAX_ARG_PAGES*PAGE_SIZE) / sizeof(char *) - 1);
- if (na < 0)
- return na;
-- ne = nargs(envp, NULL);
-+ ne = nargs(envp, NULL, (MAX_ARG_PAGES*PAGE_SIZE) / sizeof(char *) - 1 );
- if (ne < 0)
- return ne;
- len = (na + ne + 2) * sizeof(*av);
-@@ -143,10 +146,10 @@
- av[na] = NULL;
- ae[ne] = NULL;
-
-- r = nargs(argv, av);
-+ r = nargs(argv, av, na);
- if (r < 0)
- goto out;
-- r = nargs(envp, ae);
-+ r = nargs(envp, ae, ne);
- if (r < 0)
- goto out;
-
-@@ -1439,6 +1442,7 @@
-
- tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
- CMSG_ALIGN(sizeof(struct cmsghdr)));
-+ tmp = CMSG_ALIGN(tmp);
- kcmlen += tmp;
- ucmsg = CMSG32_NXTHDR(kmsg, ucmsg, ucmlen);
- }
-@@ -1475,7 +1479,7 @@
- goto out_free_efault;
-
- /* Advance. */
-- kcmsg = (struct cmsghdr *)((char *)kcmsg + CMSG_ALIGN(tmp));
-+ kcmsg = (struct cmsghdr *)((char *)kcmsg + tmp);
- ucmsg = CMSG32_NXTHDR(kmsg, ucmsg, ucmlen);
- }
-
-diff -urN linux-2.4.30/arch/ia64/mm/fault.c linux-2.4.30-hf32.3/arch/ia64/mm/fault.c
---- linux-2.4.30/arch/ia64/mm/fault.c 2003-08-25 13:44:39.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/ia64/mm/fault.c 2006-03-18 00:34:06.000000000 +0100
-@@ -206,9 +206,6 @@
- return;
- }
-
-- if (done_with_exception(regs))
-- return;
--
- /*
- * Since we have no vma's for region 5, we might get here even if the address is
- * valid, due to the VHPT walker inserting a non present translation that becomes
-@@ -219,6 +216,9 @@
- if (REGION_NUMBER(address) == 5 && mapped_kernel_page_is_present(address))
- return;
-
-+ if (done_with_exception(regs))
-+ return;
-+
- /*
- * Oops. The kernel tried to access some bad page. We'll have to terminate things
- * with extreme prejudice.
-diff -urN linux-2.4.30/arch/parisc/kernel/ioctl32.c linux-2.4.30-hf32.3/arch/parisc/kernel/ioctl32.c
---- linux-2.4.30/arch/parisc/kernel/ioctl32.c 2005-01-27 18:57:31.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/parisc/kernel/ioctl32.c 2006-03-18 00:34:06.000000000 +0100
-@@ -35,6 +35,7 @@
- #include <linux/cdrom.h>
- #include <linux/loop.h>
- #include <linux/auto_fs.h>
-+#include <linux/auto_fs4.h>
- #include <linux/devfs_fs.h>
- #include <linux/tty.h>
- #include <linux/vt_kern.h>
-diff -urN linux-2.4.30/arch/parisc/kernel/sys_parisc32.c linux-2.4.30-hf32.3/arch/parisc/kernel/sys_parisc32.c
---- linux-2.4.30/arch/parisc/kernel/sys_parisc32.c 2005-04-14 09:43:33.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/parisc/kernel/sys_parisc32.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1934,12 +1934,13 @@
- struct cmsghdr *kcmsg, *kcmsg_base;
- __kernel_size_t32 ucmlen;
- __kernel_size_t kcmlen, tmp;
-+ int err = -EFAULT;
-
- kcmlen = 0;
- kcmsg_base = kcmsg = (struct cmsghdr *)stackbuf;
- ucmsg = CMSG32_FIRSTHDR(kmsg);
- while(ucmsg != NULL) {
-- if(get_user(ucmlen, &ucmsg->cmsg_len))
-+ if (get_user(ucmlen, &ucmsg->cmsg_len))
- return -EFAULT;
-
- /* Catch bogons. */
-@@ -1948,6 +1949,7 @@
-
- tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
- CMSG_ALIGN(sizeof(struct cmsghdr)));
-+ tmp = CMSG_ALIGN(tmp);
- kcmlen += tmp;
- ucmsg = CMSG32_NXTHDR(kmsg, ucmsg, ucmlen);
- }
-@@ -1968,21 +1970,23 @@
- memset(kcmsg, 0, kcmlen);
- ucmsg = CMSG32_FIRSTHDR(kmsg);
- while(ucmsg != NULL) {
-- __get_user(ucmlen, &ucmsg->cmsg_len);
-+ if (__get_user(ucmlen, &ucmsg->cmsg_len))
-+ goto Efault;
- tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
- CMSG_ALIGN(sizeof(struct cmsghdr)));
-+ if ((char *)kcmsg_base + kcmlen - (char *)kcmsg < CMSG_ALIGN(tmp))
-+ goto Einval;
- kcmsg->cmsg_len = tmp;
-- __get_user(kcmsg->cmsg_level, &ucmsg->cmsg_level);
-- __get_user(kcmsg->cmsg_type, &ucmsg->cmsg_type);
--
-- /* Copy over the data. */
-- if(copy_from_user(CMSG_DATA(kcmsg),
-- CMSG32_DATA(ucmsg),
-- (ucmlen - CMSG32_ALIGN(sizeof(*ucmsg)))))
-- goto out_free_efault;
-+ tmp = CMSG_ALIGN(tmp);
-+ if (__get_user(kcmsg->cmsg_level, &ucmsg->cmsg_level) ||
-+ __get_user(kcmsg->cmsg_type, &ucmsg->cmsg_type) ||
-+ copy_from_user(CMSG_DATA(kcmsg),
-+ CMSG32_DATA(ucmsg),
-+ (ucmlen - CMSG32_ALIGN(sizeof(*ucmsg)))))
-+ goto Efault;
-
- /* Advance. */
-- kcmsg = (struct cmsghdr *)((char *)kcmsg + CMSG_ALIGN(tmp));
-+ kcmsg = (struct cmsghdr *)((char *)kcmsg + tmp);
- ucmsg = CMSG32_NXTHDR(kmsg, ucmsg, ucmlen);
- }
-
-@@ -1991,10 +1995,12 @@
- kmsg->msg_controllen = kcmlen;
- return 0;
-
--out_free_efault:
-- if(kcmsg_base != (struct cmsghdr *)stackbuf)
-+Einval:
-+ err = -EINVAL;
-+Efault:
-+ if (kcmsg_base != (struct cmsghdr *)stackbuf)
- kfree(kcmsg_base);
-- return -EFAULT;
-+ return err;
- }
-
- static void put_cmsg32(struct msghdr *kmsg, int level, int type,
-diff -urN linux-2.4.30/arch/ppc/boot/lib/zlib.c linux-2.4.30-hf32.3/arch/ppc/boot/lib/zlib.c
---- linux-2.4.30/arch/ppc/boot/lib/zlib.c 2003-08-25 13:44:40.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/ppc/boot/lib/zlib.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1322,6 +1322,7 @@
- if ((j = *p++) != 0)
- v[x[j]++] = i;
- } while (++i < n);
-+ n = x[g]; /* set n to length of v */
-
-
- /* Generate the Huffman codes and for each, make the table entries */
-diff -urN linux-2.4.30/arch/ppc64/boot/zlib.c linux-2.4.30-hf32.3/arch/ppc64/boot/zlib.c
---- linux-2.4.30/arch/ppc64/boot/zlib.c 2003-08-25 13:44:40.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/ppc64/boot/zlib.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1338,6 +1338,7 @@
- if ((j = *p++) != 0)
- v[x[j]++] = i;
- } while (++i < n);
-+ n = x[g]; /* set n to length of v */
-
-
- /* Generate the Huffman codes and for each, make the table entries */
-diff -urN linux-2.4.30/arch/ppc64/kernel/ioctl32.c linux-2.4.30-hf32.3/arch/ppc64/kernel/ioctl32.c
---- linux-2.4.30/arch/ppc64/kernel/ioctl32.c 2005-01-27 18:57:31.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/ppc64/kernel/ioctl32.c 2006-03-18 00:34:06.000000000 +0100
-@@ -49,6 +49,7 @@
- #include <linux/cdrom.h>
- #include <linux/loop.h>
- #include <linux/auto_fs.h>
-+#include <linux/autofs_4.h>
- #include <linux/devfs_fs.h>
- #include <linux/tty.h>
- #include <linux/vt_kern.h>
-@@ -876,13 +877,15 @@
- r = (void *) &r4;
- }
-
-- if (ret)
-- return -EFAULT;
-+ if (ret) {
-+ ret = -EFAULT;
-+ goto out;
-+ }
-
- set_fs (KERNEL_DS);
- ret = sys_ioctl (fd, cmd, (long) r);
- set_fs (old_fs);
--
-+out:
- if (mysock)
- sockfd_put(mysock);
-
-diff -urN linux-2.4.30/arch/ppc64/kernel/signal.c linux-2.4.30-hf32.3/arch/ppc64/kernel/signal.c
---- linux-2.4.30/arch/ppc64/kernel/signal.c 2005-01-27 18:57:31.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/ppc64/kernel/signal.c 2006-03-18 00:34:06.000000000 +0100
-@@ -332,7 +332,7 @@
- }
-
-
--asmlinkage int
-+asmlinkage long
- sys_rt_sigreturn(unsigned long r3, unsigned long r4, unsigned long r5,
- unsigned long r6, unsigned long r7, unsigned long r8,
- struct pt_regs *regs)
-diff -urN linux-2.4.30/arch/ppc64/kernel/sys_ppc32.c linux-2.4.30-hf32.3/arch/ppc64/kernel/sys_ppc32.c
---- linux-2.4.30/arch/ppc64/kernel/sys_ppc32.c 2005-04-14 09:43:33.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/ppc64/kernel/sys_ppc32.c 2006-03-18 00:34:06.000000000 +0100
-@@ -3442,12 +3442,13 @@
- struct cmsghdr *kcmsg, *kcmsg_base;
- __kernel_size_t32 ucmlen;
- __kernel_size_t kcmlen, tmp;
-+ int err = -EFAULT;
-
- kcmlen = 0;
- kcmsg_base = kcmsg = (struct cmsghdr *)stackbuf;
- ucmsg = CMSG32_FIRSTHDR(kmsg);
- while(ucmsg != NULL) {
-- if(get_user(ucmlen, &ucmsg->cmsg_len))
-+ if (get_user(ucmlen, &ucmsg->cmsg_len))
- return -EFAULT;
-
- /* Catch bogons. */
-@@ -3456,6 +3457,7 @@
-
- tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
- CMSG_ALIGN(sizeof(struct cmsghdr)));
-+ tmp = CMSG_ALIGN(tmp);
- kcmlen += tmp;
- ucmsg = CMSG32_NXTHDR(kmsg, ucmsg, ucmlen);
- }
-@@ -3476,21 +3478,23 @@
- memset(kcmsg, 0, kcmlen);
- ucmsg = CMSG32_FIRSTHDR(kmsg);
- while (ucmsg != NULL) {
-- __get_user(ucmlen, &ucmsg->cmsg_len);
-+ if (__get_user(ucmlen, &ucmsg->cmsg_len))
-+ goto Efault;
- tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
- CMSG_ALIGN(sizeof(struct cmsghdr)));
-+ if ((char *)kcmsg_base + kcmlen - (char *)kcmsg < CMSG_ALIGN(tmp))
-+ goto Einval;
- kcmsg->cmsg_len = tmp;
-- __get_user(kcmsg->cmsg_level, &ucmsg->cmsg_level);
-- __get_user(kcmsg->cmsg_type, &ucmsg->cmsg_type);
--
-- /* Copy over the data. */
-- if(copy_from_user(CMSG_DATA(kcmsg),
-- CMSG32_DATA(ucmsg),
-- (ucmlen - CMSG32_ALIGN(sizeof(*ucmsg)))))
-- goto out_free_efault;
-+ tmp = CMSG_ALIGN(tmp);
-+ if (__get_user(kcmsg->cmsg_level, &ucmsg->cmsg_level) ||
-+ __get_user(kcmsg->cmsg_type, &ucmsg->cmsg_type) ||
-+ copy_from_user(CMSG_DATA(kcmsg),
-+ CMSG32_DATA(ucmsg),
-+ (ucmlen - CMSG32_ALIGN(sizeof(*ucmsg)))))
-+ goto Efault;
-
- /* Advance. */
-- kcmsg = (struct cmsghdr *)((char *)kcmsg + CMSG_ALIGN(tmp));
-+ kcmsg = (struct cmsghdr *)((char *)kcmsg + tmp);
- ucmsg = CMSG32_NXTHDR(kmsg, ucmsg, ucmlen);
- }
-
-@@ -3499,10 +3503,12 @@
- kmsg->msg_controllen = kcmlen;
- return 0;
-
--out_free_efault:
-- if(kcmsg_base != (struct cmsghdr *)stackbuf)
-+Einval:
-+ err = -EINVAL;
-+Efault:
-+ if (kcmsg_base != (struct cmsghdr *)stackbuf)
- kfree(kcmsg_base);
-- return -EFAULT;
-+ return err;
- }
-
- asmlinkage long sys32_sendmsg(int fd, struct msghdr32* user_msg, unsigned int user_flags)
-diff -urN linux-2.4.30/arch/s390x/kernel/linux32.c linux-2.4.30-hf32.3/arch/s390x/kernel/linux32.c
---- linux-2.4.30/arch/s390x/kernel/linux32.c 2005-04-14 09:43:33.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/s390x/kernel/linux32.c 2006-03-18 00:34:06.000000000 +0100
-@@ -2425,12 +2425,13 @@
- struct cmsghdr *kcmsg, *kcmsg_base;
- __kernel_size_t32 ucmlen;
- __kernel_size_t kcmlen, tmp;
-+ int err = -EFAULT;
-
- kcmlen = 0;
- kcmsg_base = kcmsg = (struct cmsghdr *)stackbuf;
- ucmsg = CMSG32_FIRSTHDR(kmsg);
- while(ucmsg != NULL) {
-- if(get_user(ucmlen, &ucmsg->cmsg_len))
-+ if (get_user(ucmlen, &ucmsg->cmsg_len))
- return -EFAULT;
-
- /* Catch bogons. */
-@@ -2439,6 +2440,7 @@
-
- tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
- CMSG_ALIGN(sizeof(struct cmsghdr)));
-+ tmp = CMSG_ALIGN(tmp);
- kcmlen += tmp;
- ucmsg = CMSG32_NXTHDR(kmsg, ucmsg, ucmlen);
- }
-@@ -2459,21 +2461,23 @@
- memset(kcmsg, 0, kcmlen);
- ucmsg = CMSG32_FIRSTHDR(kmsg);
- while(ucmsg != NULL) {
-- __get_user(ucmlen, &ucmsg->cmsg_len);
-+ if (__get_user(ucmlen, &ucmsg->cmsg_len))
-+ goto Efault;
- tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
- CMSG_ALIGN(sizeof(struct cmsghdr)));
-+ if ((char *)kcmsg_base + kcmlen - (char *)kcmsg < CMSG_ALIGN(tmp))
-+ goto Einval;
- kcmsg->cmsg_len = tmp;
-- __get_user(kcmsg->cmsg_level, &ucmsg->cmsg_level);
-- __get_user(kcmsg->cmsg_type, &ucmsg->cmsg_type);
--
-- /* Copy over the data. */
-- if(copy_from_user(CMSG_DATA(kcmsg),
-- CMSG32_DATA(ucmsg),
-- (ucmlen - CMSG32_ALIGN(sizeof(*ucmsg)))))
-- goto out_free_efault;
-+ tmp = CMSG_ALIGN(tmp);
-+ if (__get_user(kcmsg->cmsg_level, &ucmsg->cmsg_level) ||
-+ __get_user(kcmsg->cmsg_type, &ucmsg->cmsg_type) ||
-+ copy_from_user(CMSG_DATA(kcmsg),
-+ CMSG32_DATA(ucmsg),
-+ (ucmlen - CMSG32_ALIGN(sizeof(*ucmsg)))))
-+ goto Efault;
-
- /* Advance. */
-- kcmsg = (struct cmsghdr *)((char *)kcmsg + CMSG_ALIGN(tmp));
-+ kcmsg = (struct cmsghdr *)((char *)kcmsg + tmp);
- ucmsg = CMSG32_NXTHDR(kmsg, ucmsg, ucmlen);
- }
-
-@@ -2482,10 +2486,12 @@
- kmsg->msg_controllen = kcmlen;
- return 0;
-
--out_free_efault:
-- if(kcmsg_base != (struct cmsghdr *)stackbuf)
-+Einval:
-+ err = -EINVAL;
-+Efault:
-+ if (kcmsg_base != (struct cmsghdr *)stackbuf)
- kfree(kcmsg_base);
-- return -EFAULT;
-+ return err;
- }
-
- static void put_cmsg32(struct msghdr *kmsg, int level, int type,
-diff -urN linux-2.4.30/arch/sparc/math-emu/math.c linux-2.4.30-hf32.3/arch/sparc/math-emu/math.c
---- linux-2.4.30/arch/sparc/math-emu/math.c 1999-12-03 00:28:54.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/sparc/math-emu/math.c 2006-03-18 00:34:06.000000000 +0100
-@@ -323,10 +323,6 @@
- case FMOVS:
- case FABSS:
- case FNEGS: TYPE(2,1,0,1,0,0,0); break;
-- default:
--#ifdef DEBUG_MATHEMU
-- printk("unknown FPop1: %03lx\n",(insn>>5)&0x1ff);
--#endif
- }
- } else if ((insn & 0xc1f80000) == 0x81a80000) /* FPOP2 */ {
- switch ((insn >> 5) & 0x1ff) {
-@@ -336,10 +332,6 @@
- case FCMPED: TYPE(3,0,0,2,1,2,1); break;
- case FCMPQ: TYPE(3,0,0,3,1,3,1); break;
- case FCMPEQ: TYPE(3,0,0,3,1,3,1); break;
-- default:
--#ifdef DEBUG_MATHEMU
-- printk("unknown FPop2: %03lx\n",(insn>>5)&0x1ff);
--#endif
- }
- }
-
-diff -urN linux-2.4.30/arch/sparc64/kernel/ioctl32.c linux-2.4.30-hf32.3/arch/sparc64/kernel/ioctl32.c
---- linux-2.4.30/arch/sparc64/kernel/ioctl32.c 2005-04-14 09:43:33.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/sparc64/kernel/ioctl32.c 2006-03-18 00:34:06.000000000 +0100
-@@ -809,13 +809,15 @@
- r = (void *) &r4;
- }
-
-- if (ret)
-- return -EFAULT;
-+ if (ret) {
-+ ret = -EFAULT;
-+ goto out;
-+ }
-
- set_fs (KERNEL_DS);
- ret = sys_ioctl (fd, cmd, (long) r);
- set_fs (old_fs);
--
-+out:
- if (mysock)
- sockfd_put(mysock);
-
-diff -urN linux-2.4.30/arch/sparc64/kernel/sys_sparc32.c linux-2.4.30-hf32.3/arch/sparc64/kernel/sys_sparc32.c
---- linux-2.4.30/arch/sparc64/kernel/sys_sparc32.c 2005-04-14 09:43:33.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/sparc64/kernel/sys_sparc32.c 2006-03-18 00:34:06.000000000 +0100
-@@ -50,6 +50,7 @@
- #include <linux/in.h>
- #include <linux/icmpv6.h>
- #include <linux/sysctl.h>
-+#include <linux/vmalloc.h>
- #include <linux/dnotify.h>
- #include <linux/netfilter_ipv4/ip_tables.h>
-
-@@ -2496,12 +2497,13 @@
- struct cmsghdr *kcmsg, *kcmsg_base;
- __kernel_size_t32 ucmlen;
- __kernel_size_t kcmlen, tmp;
-+ int err = -EFAULT;
-
- kcmlen = 0;
- kcmsg_base = kcmsg = (struct cmsghdr *)stackbuf;
- ucmsg = CMSG32_FIRSTHDR(kmsg);
- while(ucmsg != NULL) {
-- if(get_user(ucmlen, &ucmsg->cmsg_len))
-+ if (get_user(ucmlen, &ucmsg->cmsg_len))
- return -EFAULT;
-
- /* Catch bogons. */
-@@ -2510,6 +2512,7 @@
-
- tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
- CMSG_ALIGN(sizeof(struct cmsghdr)));
-+ tmp = CMSG_ALIGN(tmp);
- kcmlen += tmp;
- ucmsg = CMSG32_NXTHDR(kmsg, ucmsg, ucmlen);
- }
-@@ -2530,21 +2533,23 @@
- memset(kcmsg, 0, kcmlen);
- ucmsg = CMSG32_FIRSTHDR(kmsg);
- while(ucmsg != NULL) {
-- __get_user(ucmlen, &ucmsg->cmsg_len);
-+ if (__get_user(ucmlen, &ucmsg->cmsg_len))
-+ goto Efault;
- tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
- CMSG_ALIGN(sizeof(struct cmsghdr)));
-+ if ((char *)kcmsg_base + kcmlen - (char *)kcmsg < CMSG_ALIGN(tmp))
-+ goto Einval;
- kcmsg->cmsg_len = tmp;
-- __get_user(kcmsg->cmsg_level, &ucmsg->cmsg_level);
-- __get_user(kcmsg->cmsg_type, &ucmsg->cmsg_type);
--
-- /* Copy over the data. */
-- if(copy_from_user(CMSG_DATA(kcmsg),
-- CMSG32_DATA(ucmsg),
-- (ucmlen - CMSG32_ALIGN(sizeof(*ucmsg)))))
-- goto out_free_efault;
-+ tmp = CMSG_ALIGN(tmp);
-+ if (__get_user(kcmsg->cmsg_level, &ucmsg->cmsg_level) ||
-+ __get_user(kcmsg->cmsg_type, &ucmsg->cmsg_type) ||
-+ copy_from_user(CMSG_DATA(kcmsg),
-+ CMSG32_DATA(ucmsg),
-+ (ucmlen - CMSG32_ALIGN(sizeof(*ucmsg)))))
-+ goto Efault;
-
- /* Advance. */
-- kcmsg = (struct cmsghdr *)((char *)kcmsg + CMSG_ALIGN(tmp));
-+ kcmsg = (struct cmsghdr *)((char *)kcmsg + tmp);
- ucmsg = CMSG32_NXTHDR(kmsg, ucmsg, ucmlen);
- }
-
-@@ -2553,10 +2558,12 @@
- kmsg->msg_controllen = kcmlen;
- return 0;
-
--out_free_efault:
-- if(kcmsg_base != (struct cmsghdr *)stackbuf)
-+Einval:
-+ err = -EINVAL;
-+Efault:
-+ if (kcmsg_base != (struct cmsghdr *)stackbuf)
- kfree(kcmsg_base);
-- return -EFAULT;
-+ return err;
- }
-
- static void put_cmsg32(struct msghdr *kmsg, int level, int type,
-@@ -2919,12 +2926,12 @@
- if (optlen != kreplsize)
- return -ENOPROTOOPT;
-
-- krepl = (struct ipt_replace *)kmalloc(kreplsize, GFP_KERNEL);
-+ krepl = (struct ipt_replace *)vmalloc(kreplsize);
- if (krepl == NULL)
- return -ENOMEM;
-
- if (copy_from_user(krepl, optval, kreplsize)) {
-- kfree(krepl);
-+ vfree(krepl);
- return -EFAULT;
- }
-
-@@ -2932,10 +2939,9 @@
- ((struct ipt_replace32 *)krepl)->counters);
-
- kcountersize = krepl->num_counters * sizeof(struct ipt_counters);
-- krepl->counters = (struct ipt_counters *)kmalloc(
-- kcountersize, GFP_KERNEL);
-+ krepl->counters = (struct ipt_counters *)vmalloc(kcountersize);
- if (krepl->counters == NULL) {
-- kfree(krepl);
-+ vfree(krepl);
- return -ENOMEM;
- }
-
-@@ -2949,8 +2955,8 @@
- copy_to_user(counters32, krepl->counters, kcountersize))
- ret = -EFAULT;
-
-- kfree(krepl->counters);
-- kfree(krepl);
-+ vfree(krepl->counters);
-+ vfree(krepl);
-
- return ret;
- }
-@@ -4205,7 +4211,7 @@
-
- old_fs = get_fs();
- set_fs(KERNEL_DS);
-- ret = sys_utimes(kfilename, &ktvs[0]);
-+ ret = sys_utimes(kfilename, (tvs ? &ktvs[0] : NULL));
- set_fs(old_fs);
-
- putname(kfilename);
-diff -urN linux-2.4.30/arch/sparc64/solaris/socket.c linux-2.4.30-hf32.3/arch/sparc64/solaris/socket.c
---- linux-2.4.30/arch/sparc64/solaris/socket.c 2001-02-19 04:49:54.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/sparc64/solaris/socket.c 2006-03-18 00:34:06.000000000 +0100
-@@ -410,8 +410,10 @@
- unsigned long *kcmsg;
- __kernel_size_t32 cmlen;
-
-- if(kern_msg.msg_controllen > sizeof(ctl) &&
-- kern_msg.msg_controllen <= 256) {
-+ if (kern_msg.msg_controllen <= sizeof(__kernel_size_t32))
-+ return -EINVAL;
-+
-+ if(kern_msg.msg_controllen > sizeof(ctl)) {
- err = -ENOBUFS;
- ctl_buf = kmalloc(kern_msg.msg_controllen, GFP_KERNEL);
- if(!ctl_buf)
-diff -urN linux-2.4.30/arch/x86_64/ia32/ia32_ioctl.c linux-2.4.30-hf32.3/arch/x86_64/ia32/ia32_ioctl.c
---- linux-2.4.30/arch/x86_64/ia32/ia32_ioctl.c 2005-01-27 18:57:31.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/x86_64/ia32/ia32_ioctl.c 2006-03-18 00:34:06.000000000 +0100
-@@ -816,6 +816,11 @@
-
- extern struct socket *sockfd_lookup(int fd, int *err);
-
-+extern __inline__ void sockfd_put(struct socket *sock)
-+{
-+ fput(sock->file);
-+}
-+
- static int routing_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
- {
- int ret;
-@@ -857,12 +862,17 @@
- r = (void *) &r4;
- }
-
-- if (ret)
-- return -EFAULT;
-+ if (ret) {
-+ ret = -EFAULT;
-+ goto out;
-+ }
-
- set_fs (KERNEL_DS);
- ret = sys_ioctl (fd, cmd, (long) r);
- set_fs (old_fs);
-+out:
-+ if (mysock)
-+ sockfd_put(mysock);
-
- return ret;
- }
-@@ -2766,17 +2776,24 @@
- static int tiocgdev(unsigned fd, unsigned cmd, unsigned int *ptr)
- {
-
-- struct file *file = fget(fd);
-+ struct file *file;
- struct tty_struct *real_tty;
-+ int ret;
-
-+ file = fget(fd);
- if (!file)
- return -EBADF;
-+ ret = -EINVAL;
- if (file->f_op->ioctl != tty_ioctl)
-- return -EINVAL;
-+ goto out;
- real_tty = (struct tty_struct *)file->private_data;
- if (!real_tty)
-- return -EINVAL;
-- return put_user(kdev_t_to_nr(real_tty->device), ptr);
-+ goto out;
-+ ret = put_user(kdev_t_to_nr(real_tty->device), ptr);
-+out:
-+ fput(file);
-+
-+ return ret;
- }
-
-
-diff -urN linux-2.4.30/arch/x86_64/ia32/socket32.c linux-2.4.30-hf32.3/arch/x86_64/ia32/socket32.c
---- linux-2.4.30/arch/x86_64/ia32/socket32.c 2005-04-14 09:43:33.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/x86_64/ia32/socket32.c 2006-03-18 00:34:06.000000000 +0100
-@@ -127,12 +127,13 @@
- struct cmsghdr *kcmsg, *kcmsg_base;
- __kernel_size_t32 ucmlen;
- __kernel_size_t kcmlen, tmp;
-+ int err = -EFAULT;
-
- kcmlen = 0;
- kcmsg_base = kcmsg = (struct cmsghdr *)stackbuf;
- ucmsg = CMSG32_FIRSTHDR(kmsg);
- while(ucmsg != NULL) {
-- if(get_user(ucmlen, &ucmsg->cmsg_len))
-+ if (get_user(ucmlen, &ucmsg->cmsg_len))
- return -EFAULT;
-
- /* Catch bogons. */
-@@ -164,18 +165,19 @@
- memset(kcmsg, 0, kcmlen);
- ucmsg = CMSG32_FIRSTHDR(kmsg);
- while(ucmsg != NULL) {
-- __get_user(ucmlen, &ucmsg->cmsg_len);
-+ if (__get_user(ucmlen, &ucmsg->cmsg_len))
-+ goto Efault;
- tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
- CMSG_ALIGN(sizeof(struct cmsghdr)));
-+ if ((char *)kcmsg_base + kcmlen - (char *)kcmsg < CMSG_ALIGN(tmp))
-+ goto Einval;
- kcmsg->cmsg_len = tmp;
-- __get_user(kcmsg->cmsg_level, &ucmsg->cmsg_level);
-- __get_user(kcmsg->cmsg_type, &ucmsg->cmsg_type);
--
-- /* Copy over the data. */
-- if(copy_from_user(CMSG_DATA(kcmsg),
-- CMSG32_DATA(ucmsg),
-- (ucmlen - CMSG32_ALIGN(sizeof(*ucmsg)))))
-- goto out_free_efault;
-+ if (__get_user(kcmsg->cmsg_level, &ucmsg->cmsg_level) ||
-+ __get_user(kcmsg->cmsg_type, &ucmsg->cmsg_type) ||
-+ copy_from_user(CMSG_DATA(kcmsg),
-+ CMSG32_DATA(ucmsg),
-+ (ucmlen - CMSG32_ALIGN(sizeof(*ucmsg)))))
-+ goto Efault;
-
- /* Advance. */
- kcmsg = (struct cmsghdr *)((char *)kcmsg + CMSG_ALIGN(tmp));
-@@ -187,10 +189,12 @@
- kmsg->msg_controllen = kcmlen;
- return 0;
-
--out_free_efault:
-- if(kcmsg_base != (struct cmsghdr *)stackbuf)
-+Einval:
-+ err = -EINVAL;
-+Efault:
-+ if (kcmsg_base != (struct cmsghdr *)stackbuf)
- kfree(kcmsg_base);
-- return -EFAULT;
-+ return err;
- }
-
- static void put_cmsg32(struct msghdr *kmsg, int level, int type,
-diff -urN linux-2.4.30/arch/x86_64/ia32/sys_ia32.c linux-2.4.30-hf32.3/arch/x86_64/ia32/sys_ia32.c
---- linux-2.4.30/arch/x86_64/ia32/sys_ia32.c 2005-01-27 18:57:31.000000000 +0100
-+++ linux-2.4.30-hf32.3/arch/x86_64/ia32/sys_ia32.c 2006-03-18 00:34:06.000000000 +0100
-@@ -2200,7 +2200,7 @@
- return ret;
- }
-
--static int nargs(u32 src, char **dst)
-+static int nargs(u32 src, char **dst, int max)
- {
- int cnt;
- u32 val;
-@@ -2210,13 +2210,13 @@
- int ret = get_user(val, (__u32 *)(u64)src);
- if (ret)
- return ret;
-+ if (cnt > max)
-+ return -E2BIG;
- if (dst)
- dst[cnt] = (char *)(u64)val;
- cnt++;
- src += 4;
-- if (cnt >= (MAX_ARG_PAGES * PAGE_SIZE) / sizeof(char *))
-- return -E2BIG;
-- } while(val);
-+ } while(val);
- if (dst)
- dst[cnt-1] = 0;
- return cnt;
-@@ -2230,13 +2230,14 @@
- int ret;
- unsigned sz = 0;
-
-+ /* Can actually allocate 2*MAX_ARG_PAGES */
- if (argv) {
-- na = nargs(argv, NULL);
-+ na = nargs(argv, NULL, (MAX_ARG_PAGES * PAGE_SIZE)/sizeof(char*) - 1);
- if (na < 0)
- return -EFAULT;
- }
- if (envp) {
-- ne = nargs(envp, NULL);
-+ ne = nargs(envp, NULL, (MAX_ARG_PAGES * PAGE_SIZE)/sizeof(char*) - 1);
- if (ne < 0)
- return -EFAULT;
- }
-@@ -2252,13 +2253,13 @@
- }
-
- if (argv) {
-- ret = nargs(argv, buf);
-+ ret = nargs(argv, buf, na);
- if (ret < 0)
- goto free;
- }
-
- if (envp) {
-- ret = nargs(envp, buf + na);
-+ ret = nargs(envp, buf + na, ne);
- if (ret < 0)
- goto free;
- }
-diff -urN linux-2.4.30/arch/x86_64/kernel/process.c linux-2.4.30-hf32.3/arch/x86_64/kernel/process.c
---- linux-2.4.30/arch/x86_64/kernel/process.c 2004-04-14 15:05:28.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/x86_64/kernel/process.c 2006-03-18 00:34:06.000000000 +0100
-@@ -527,10 +527,10 @@
- p->thread.fs = me->thread.fs;
- p->thread.gs = me->thread.gs;
-
-- asm("movl %%gs,%0" : "=m" (p->thread.gsindex));
-- asm("movl %%fs,%0" : "=m" (p->thread.fsindex));
-- asm("movl %%es,%0" : "=m" (p->thread.es));
-- asm("movl %%ds,%0" : "=m" (p->thread.ds));
-+ asm("mov %%gs,%0" : "=m" (p->thread.gsindex));
-+ asm("mov %%fs,%0" : "=m" (p->thread.fsindex));
-+ asm("mov %%es,%0" : "=m" (p->thread.es));
-+ asm("mov %%ds,%0" : "=m" (p->thread.ds));
-
- unlazy_fpu(current);
- p->thread.i387 = current->thread.i387;
-@@ -575,11 +575,11 @@
- /*
- * Switch DS and ES.
- */
-- asm volatile("movl %%es,%0" : "=m" (prev->es));
-+ asm volatile("mov %%es,%0" : "=m" (prev->es));
- if (unlikely(next->es | prev->es))
- loadsegment(es, next->es);
-
-- asm volatile ("movl %%ds,%0" : "=m" (prev->ds));
-+ asm volatile ("mov %%ds,%0" : "=m" (prev->ds));
- if (unlikely(next->ds | prev->ds))
- loadsegment(ds, next->ds);
-
-@@ -588,7 +588,7 @@
- */
- {
- unsigned fsindex;
-- asm volatile("movl %%fs,%0" : "=g" (fsindex));
-+ asm volatile("movl %%fs,%0" : "=r" (fsindex));
- /* segment register != 0 always requires a reload.
- also reload when it has changed.
- when prev process used 64bit base always reload
-@@ -609,7 +609,7 @@
- }
- {
- unsigned gsindex;
-- asm volatile("movl %%gs,%0" : "=g" (gsindex));
-+ asm volatile("movl %%gs,%0" : "=r" (gsindex));
- if (unlikely((gsindex | next->gsindex) || prev->gs)) {
- load_gs_index(next->gsindex);
- if (gsindex)
-diff -urN linux-2.4.30/arch/x86_64/kernel/ptrace.c linux-2.4.30-hf32.3/arch/x86_64/kernel/ptrace.c
---- linux-2.4.30/arch/x86_64/kernel/ptrace.c 2003-06-13 16:51:32.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/x86_64/kernel/ptrace.c 2006-03-18 00:34:06.000000000 +0100
-@@ -114,13 +114,13 @@
- child->thread.es = value & 0xffff;
- return 0;
- case offsetof(struct user_regs_struct,fs_base):
-- if (!((value >> 48) == 0 || (value >> 48) == 0xffff))
-- return -EIO;
-+ if (value >= TASK_SIZE)
-+ return -EIO;
- child->thread.fs = value;
- return 0;
- case offsetof(struct user_regs_struct,gs_base):
-- if (!((value >> 48) == 0 || (value >> 48) == 0xffff))
-- return -EIO;
-+ if (value >= TASK_SIZE)
-+ return -EIO;
- child->thread.gs = value;
- return 0;
- case offsetof(struct user_regs_struct, eflags):
-@@ -139,6 +139,11 @@
- return -EIO;
- value &= 0xffff;
- break;
-+ case offsetof(struct user_regs_struct, rip):
-+ /* Check if the new RIP address is canonical */
-+ if (value >= TASK_SIZE)
-+ return -EIO;
-+ break;
- }
- put_stack_long(child, regno - sizeof(struct pt_regs), value);
- return 0;
-diff -urN linux-2.4.30/arch/x86_64/kernel/traps.c linux-2.4.30-hf32.3/arch/x86_64/kernel/traps.c
---- linux-2.4.30/arch/x86_64/kernel/traps.c 2004-04-14 15:05:28.000000000 +0200
-+++ linux-2.4.30-hf32.3/arch/x86_64/kernel/traps.c 2006-03-18 00:34:06.000000000 +0100
-@@ -857,7 +857,7 @@
- set_intr_gate(9,&coprocessor_segment_overrun);
- set_intr_gate(10,&invalid_TSS);
- set_intr_gate(11,&segment_not_present);
-- set_intr_gate_ist(12,&stack_segment,STACKFAULT_STACK);
-+ set_intr_gate(12,&stack_segment);
- set_intr_gate(13,&general_protection);
- set_intr_gate(14,&page_fault);
- set_intr_gate(15,&spurious_interrupt_bug);
-diff -urN linux-2.4.30/drivers/block/loop.c linux-2.4.30-hf32.3/drivers/block/loop.c
---- linux-2.4.30/drivers/block/loop.c 2003-08-25 13:44:41.000000000 +0200
-+++ linux-2.4.30-hf32.3/drivers/block/loop.c 2006-03-18 00:34:06.000000000 +0100
-@@ -974,7 +974,7 @@
-
- int loop_register_transfer(struct loop_func_table *funcs)
- {
-- if ((unsigned)funcs->number > MAX_LO_CRYPT || xfer_funcs[funcs->number])
-+ if ((unsigned)funcs->number >= MAX_LO_CRYPT || xfer_funcs[funcs->number])
- return -EINVAL;
- xfer_funcs[funcs->number] = funcs;
- return 0;
-diff -urN linux-2.4.30/drivers/bluetooth/bfusb.c linux-2.4.30-hf32.3/drivers/bluetooth/bfusb.c
---- linux-2.4.30/drivers/bluetooth/bfusb.c 2004-08-08 01:26:04.000000000 +0200
-+++ linux-2.4.30-hf32.3/drivers/bluetooth/bfusb.c 2006-03-18 00:34:06.000000000 +0100
-@@ -470,12 +470,11 @@
- return 0;
-
- write_lock_irqsave(&bfusb->lock, flags);
-+ write_unlock_irqrestore(&bfusb->lock, flags);
-
- bfusb_unlink_urbs(bfusb);
- bfusb_flush(hdev);
-
-- write_unlock_irqrestore(&bfusb->lock, flags);
--
- MOD_DEC_USE_COUNT;
-
- return 0;
-diff -urN linux-2.4.30/drivers/bluetooth/hci_usb.c linux-2.4.30-hf32.3/drivers/bluetooth/hci_usb.c
---- linux-2.4.30/drivers/bluetooth/hci_usb.c 2004-08-08 01:26:04.000000000 +0200
-+++ linux-2.4.30-hf32.3/drivers/bluetooth/hci_usb.c 2006-03-18 00:34:06.000000000 +0100
-@@ -398,13 +398,13 @@
-
- BT_DBG("%s", hdev->name);
-
-+ /* Synchronize with completion handlers */
- write_lock_irqsave(&husb->completion_lock, flags);
--
-+ write_unlock_irqrestore(&husb->completion_lock, flags);
-+
- hci_usb_unlink_urbs(husb);
- hci_usb_flush(hdev);
-
-- write_unlock_irqrestore(&husb->completion_lock, flags);
--
- MOD_DEC_USE_COUNT;
- return 0;
- }
-diff -urN linux-2.4.30/drivers/char/cyclades.c linux-2.4.30-hf32.3/drivers/char/cyclades.c
---- linux-2.4.30/drivers/char/cyclades.c 2005-01-27 18:57:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/char/cyclades.c 2006-03-18 00:34:06.000000000 +0100
-@@ -2960,10 +2960,15 @@
- cy_write(struct tty_struct * tty, int from_user,
- const unsigned char *buf, int count)
- {
-- struct cyclades_port *info = (struct cyclades_port *)tty->driver_data;
-+ struct cyclades_port *info;
- unsigned long flags;
- int c, ret = 0;
-
-+ if (!tty)
-+ return 0;
-+
-+ info = (struct cyclades_port *)tty->driver_data;
-+
- #ifdef CY_DEBUG_IO
- printk("cyc:cy_write ttyC%d\n", info->line); /* */
- #endif
-@@ -2972,7 +2977,7 @@
- return 0;
- }
-
-- if (!tty || !info->xmit_buf || !tmp_buf){
-+ if (!info->xmit_buf || !tmp_buf){
- return 0;
- }
-
-@@ -3047,9 +3052,14 @@
- static void
- cy_put_char(struct tty_struct *tty, unsigned char ch)
- {
-- struct cyclades_port *info = (struct cyclades_port *)tty->driver_data;
-+ struct cyclades_port *info;
- unsigned long flags;
-
-+ if (!tty)
-+ return;
-+
-+ info = (struct cyclades_port *)tty->driver_data;
-+
- #ifdef CY_DEBUG_IO
- printk("cyc:cy_put_char ttyC%d\n", info->line);
- #endif
-@@ -3057,7 +3067,7 @@
- if (serial_paranoia_check(info, tty->device, "cy_put_char"))
- return;
-
-- if (!tty || !info->xmit_buf)
-+ if (!info->xmit_buf)
- return;
-
- CY_LOCK(info, flags);
-diff -urN linux-2.4.30/drivers/char/drm/drm_stub.h linux-2.4.30-hf32.3/drivers/char/drm/drm_stub.h
---- linux-2.4.30/drivers/char/drm/drm_stub.h 2006-02-26 22:56:01.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/char/drm/drm_stub.h 2006-03-18 00:34:06.000000000 +0100
-@@ -52,6 +52,7 @@
- int err = -ENODEV;
- struct file_operations *old_fops;
-
-+ if (minor < 0 || minor >=DRM_STUB_MAXCARDS) return -ENODEV;
- if (!DRM(stub_list) || !DRM(stub_list)[minor].fops) return -ENODEV;
- old_fops = filp->f_op;
- filp->f_op = fops_get(DRM(stub_list)[minor].fops);
-diff -urN linux-2.4.30/drivers/char/esp.c linux-2.4.30-hf32.3/drivers/char/esp.c
---- linux-2.4.30/drivers/char/esp.c 2005-01-27 18:57:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/char/esp.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1251,13 +1251,18 @@
-
- static void rs_put_char(struct tty_struct *tty, unsigned char ch)
- {
-- struct esp_struct *info = (struct esp_struct *)tty->driver_data;
-+ struct esp_struct *info;
- unsigned long flags;
-
-+ if (!tty)
-+ return;
-+
-+ info = (struct esp_struct *)tty->driver_data;
-+
- if (serial_paranoia_check(info, tty->device, "rs_put_char"))
- return;
-
-- if (!tty || !info->xmit_buf)
-+ if (!info->xmit_buf)
- return;
-
- save_flags(flags); cli();
-@@ -1296,13 +1301,19 @@
- const unsigned char *buf, int count)
- {
- int c, t, ret = 0;
-- struct esp_struct *info = (struct esp_struct *)tty->driver_data;
-+ struct esp_struct *info;
- unsigned long flags;
-
-+
-+ if (!tty)
-+ return 0;
-+
-+ info = (struct esp_struct *)tty->driver_data;
-+
- if (serial_paranoia_check(info, tty->device, "rs_write"))
- return 0;
-
-- if (!tty || !info->xmit_buf || !tmp_buf)
-+ if (!info->xmit_buf || !tmp_buf)
- return 0;
-
- if (from_user)
-diff -urN linux-2.4.30/drivers/char/isicom.c linux-2.4.30-hf32.3/drivers/char/isicom.c
---- linux-2.4.30/drivers/char/isicom.c 2005-01-27 18:57:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/char/isicom.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1223,9 +1223,15 @@
- static int isicom_write(struct tty_struct * tty, int from_user,
- const unsigned char * buf, int count)
- {
-- struct isi_port * port = (struct isi_port *) tty->driver_data;
-+ struct isi_port * port;
- unsigned long flags;
- int cnt, total = 0;
-+
-+ if (!tty)
-+ return 0;
-+
-+ port = (struct isi_port *) tty->driver_data;
-+
- #ifdef ISICOM_DEBUG
- printk(KERN_DEBUG "ISICOM: isicom_write for port%d: %d bytes.\n",
- port->channel+1, count);
-@@ -1233,7 +1239,7 @@
- if (isicom_paranoia_check(port, tty->device, "isicom_write"))
- return 0;
-
-- if (!tty || !port->xmit_buf || !tmp_buf)
-+ if (!port->xmit_buf || !tmp_buf)
- return 0;
- if (from_user)
- down(&tmp_buf_sem); /* acquire xclusive access to tmp_buf */
-@@ -1281,13 +1287,18 @@
- /* put_char et all */
- static void isicom_put_char(struct tty_struct * tty, unsigned char ch)
- {
-- struct isi_port * port = (struct isi_port *) tty->driver_data;
-+ struct isi_port * port;
- unsigned long flags;
-+
-+ if (!tty)
-+ return;
-+
-+ port = (struct isi_port *) tty->driver_data;
-
- if (isicom_paranoia_check(port, tty->device, "isicom_put_char"))
- return;
-
-- if (!tty || !port->xmit_buf)
-+ if (!port->xmit_buf)
- return;
- #ifdef ISICOM_DEBUG
- printk(KERN_DEBUG "ISICOM: put_char, port %d, char %c.\n", port->channel+1, ch);
-diff -urN linux-2.4.30/drivers/char/moxa.c linux-2.4.30-hf32.3/drivers/char/moxa.c
---- linux-2.4.30/drivers/char/moxa.c 2005-01-27 18:57:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/char/moxa.c 2006-03-18 00:34:06.000000000 +0100
-@@ -294,6 +294,7 @@
- static int moxa_get_serial_info(struct moxa_str *, struct serial_struct *);
- static int moxa_set_serial_info(struct moxa_str *, struct serial_struct *);
- static void MoxaSetFifo(int port, int enable);
-+static unsigned long moxaIntPend[MAX_BOARDS];
-
- #ifdef MODULE
- int init_module(void)
-@@ -995,7 +996,8 @@
- return;
- }
- for (card = 0; card < MAX_BOARDS; card++) {
-- if ((ports = MoxaPortsOfCard(card)) <= 0)
-+ if ((ports = MoxaPortsOfCard(card)) <= 0
-+ || moxaIntPend[card] == 0)
- continue;
- ch = &moxaChannels[card * MAX_PORTS_PER_BOARD];
- for (i = 0; i < ports; i++, ch++) {
-@@ -1578,7 +1580,6 @@
-
- static unsigned char moxaBuff[10240];
- static unsigned long moxaIntNdx[MAX_BOARDS];
--static unsigned long moxaIntPend[MAX_BOARDS];
- static unsigned long moxaIntTable[MAX_BOARDS];
- static char moxaChkPort[MAX_PORTS];
- static char moxaLineCtrl[MAX_PORTS];
-diff -urN linux-2.4.30/drivers/char/mxser.c linux-2.4.30-hf32.3/drivers/char/mxser.c
---- linux-2.4.30/drivers/char/mxser.c 2005-01-27 18:57:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/char/mxser.c 2006-03-18 00:34:06.000000000 +0100
-@@ -911,10 +911,15 @@
- const unsigned char *buf, int count)
- {
- int c, total = 0;
-- struct mxser_struct *info = (struct mxser_struct *) tty->driver_data;
-+ struct mxser_struct *info;
- unsigned long flags;
-
-- if (!tty || !info->xmit_buf || !mxvar_tmp_buf)
-+ if (!tty)
-+ return (0);
-+
-+ info = (struct mxser_struct *) tty->driver_data;
-+
-+ if (!info->xmit_buf || !mxvar_tmp_buf)
- return (0);
-
- save_flags(flags);
-@@ -979,10 +984,15 @@
-
- static void mxser_put_char(struct tty_struct *tty, unsigned char ch)
- {
-- struct mxser_struct *info = (struct mxser_struct *) tty->driver_data;
-+ struct mxser_struct *info;
- unsigned long flags;
-
-- if (!tty || !info->xmit_buf)
-+ if (!tty)
-+ return;
-+
-+ info = (struct mxser_struct *) tty->driver_data;
-+
-+ if (!info->xmit_buf)
- return;
-
- save_flags(flags);
-diff -urN linux-2.4.30/drivers/char/random.c linux-2.4.30-hf32.3/drivers/char/random.c
---- linux-2.4.30/drivers/char/random.c 2005-01-27 18:57:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/char/random.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1771,7 +1771,7 @@
- static int proc_do_poolsize(ctl_table *table, int write, struct file *filp,
- void *buffer, size_t *lenp)
- {
-- unsigned int ret;
-+ int ret;
-
- sysctl_poolsize = random_state->poolinfo.POOLBYTES;
-
-@@ -1787,7 +1787,7 @@
- void *oldval, size_t *oldlenp,
- void *newval, size_t newlen, void **context)
- {
-- int len;
-+ unsigned int len;
-
- sysctl_poolsize = random_state->poolinfo.POOLBYTES;
-
-diff -urN linux-2.4.30/drivers/char/riscom8.c linux-2.4.30-hf32.3/drivers/char/riscom8.c
---- linux-2.4.30/drivers/char/riscom8.c 2005-01-27 18:57:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/char/riscom8.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1220,17 +1220,22 @@
- static int rc_write(struct tty_struct * tty, int from_user,
- const unsigned char *buf, int count)
- {
-- struct riscom_port *port = (struct riscom_port *)tty->driver_data;
-+ struct riscom_port *port;
- struct riscom_board *bp;
- int c, total = 0;
- unsigned long flags;
-+
-+ if (!tty)
-+ return 0;
-+
-+ port = (struct riscom_port *)tty->driver_data;
-
- if (rc_paranoia_check(port, tty->device, "rc_write"))
- return 0;
-
- bp = port_Board(port);
-
-- if (!tty || !port->xmit_buf || !tmp_buf)
-+ if (!port->xmit_buf || !tmp_buf)
- return 0;
-
- save_flags(flags);
-@@ -1298,13 +1303,18 @@
-
- static void rc_put_char(struct tty_struct * tty, unsigned char ch)
- {
-- struct riscom_port *port = (struct riscom_port *)tty->driver_data;
-+ struct riscom_port *port;
- unsigned long flags;
-
-+ if (!tty)
-+ return;
-+
-+ port = (struct riscom_port *)tty->driver_data;
-+
- if (rc_paranoia_check(port, tty->device, "rc_put_char"))
- return;
-
-- if (!tty || !port->xmit_buf)
-+ if (!port->xmit_buf)
- return;
-
- save_flags(flags); cli();
-diff -urN linux-2.4.30/drivers/char/serial.c linux-2.4.30-hf32.3/drivers/char/serial.c
---- linux-2.4.30/drivers/char/serial.c 2005-01-27 18:57:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/char/serial.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1827,13 +1827,18 @@
-
- static void rs_put_char(struct tty_struct *tty, unsigned char ch)
- {
-- struct async_struct *info = (struct async_struct *)tty->driver_data;
-+ struct async_struct *info;
- unsigned long flags;
-
-+ if (!tty)
-+ return;
-+
-+ info = (struct async_struct *)tty->driver_data;
-+
- if (serial_paranoia_check(info, tty->device, "rs_put_char"))
- return;
-
-- if (!tty || !info->xmit.buf)
-+ if (!info->xmit.buf)
- return;
-
- save_flags(flags); cli();
-@@ -1873,13 +1878,18 @@
- const unsigned char *buf, int count)
- {
- int c, ret = 0;
-- struct async_struct *info = (struct async_struct *)tty->driver_data;
-+ struct async_struct *info;
- unsigned long flags;
-
-+ if (!tty)
-+ return 0;
-+
-+ info = (struct async_struct *)tty->driver_data;
-+
- if (serial_paranoia_check(info, tty->device, "rs_write"))
- return 0;
-
-- if (!tty || !info->xmit.buf || !tmp_buf)
-+ if (!info->xmit.buf || !tmp_buf)
- return 0;
-
- save_flags(flags);
-diff -urN linux-2.4.30/drivers/char/specialix.c linux-2.4.30-hf32.3/drivers/char/specialix.c
---- linux-2.4.30/drivers/char/specialix.c 2005-01-27 18:57:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/char/specialix.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1600,17 +1600,22 @@
- static int sx_write(struct tty_struct * tty, int from_user,
- const unsigned char *buf, int count)
- {
-- struct specialix_port *port = (struct specialix_port *)tty->driver_data;
-+ struct specialix_port *port;
- struct specialix_board *bp;
- int c, total = 0;
- unsigned long flags;
-+
-+ if (!tty)
-+ return 0;
-+
-+ port = (struct specialix_port *)tty->driver_data;
-
- if (sx_paranoia_check(port, tty->device, "sx_write"))
- return 0;
-
- bp = port_Board(port);
-
-- if (!tty || !port->xmit_buf || !tmp_buf)
-+ if (!port->xmit_buf || !tmp_buf)
- return 0;
-
- save_flags(flags);
-@@ -1676,13 +1681,18 @@
-
- static void sx_put_char(struct tty_struct * tty, unsigned char ch)
- {
-- struct specialix_port *port = (struct specialix_port *)tty->driver_data;
-+ struct specialix_port *port;
- unsigned long flags;
-
-+ if (!tty)
-+ return;
-+
-+ port = (struct specialix_port *)tty->driver_data;
-+
- if (sx_paranoia_check(port, tty->device, "sx_put_char"))
- return;
-
-- if (!tty || !port->xmit_buf)
-+ if (!port->xmit_buf)
- return;
-
- save_flags(flags); cli();
-diff -urN linux-2.4.30/drivers/char/vt.c linux-2.4.30-hf32.3/drivers/char/vt.c
---- linux-2.4.30/drivers/char/vt.c 2005-01-27 18:57:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/char/vt.c 2006-03-18 00:34:06.000000000 +0100
-@@ -166,6 +166,9 @@
- if (i >= NR_KEYS || s >= MAX_NR_KEYMAPS)
- return -EINVAL;
-
-+ if (!capable(CAP_SYS_TTY_CONFIG))
-+ perm = 0;
-+
- switch (cmd) {
- case KDGKBENT:
- key_map = key_maps[s];
-@@ -276,6 +279,9 @@
- char *first_free, *fj, *fnw;
- int i, j, k;
-
-+ if (!capable(CAP_SYS_TTY_CONFIG))
-+ perm = 0;
-+
- /* we mostly copy too much here (512bytes), but who cares ;) */
- if (copy_from_user(&tmp, user_kdgkb, sizeof(struct kbsentry)))
- return -EFAULT;
-diff -urN linux-2.4.30/drivers/ide/ide-io.c linux-2.4.30-hf32.3/drivers/ide/ide-io.c
---- linux-2.4.30/drivers/ide/ide-io.c 2003-11-28 19:26:20.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/ide/ide-io.c 2006-03-18 00:34:06.000000000 +0100
-@@ -899,11 +899,13 @@
- rq = HWGROUP(drive)->rq;
- HWGROUP(drive)->rq = NULL;
-
-- rq->errors = 0;
-- rq->sector = rq->bh->b_rsector;
-- rq->current_nr_sectors = rq->bh->b_size >> 9;
-- rq->hard_cur_sectors = rq->current_nr_sectors;
-- rq->buffer = rq->bh->b_data;
-+ if (rq) {
-+ rq->errors = 0;
-+ rq->sector = rq->bh->b_rsector;
-+ rq->current_nr_sectors = rq->bh->b_size >> 9;
-+ rq->hard_cur_sectors = rq->current_nr_sectors;
-+ rq->buffer = rq->bh->b_data;
-+ }
-
- return ret;
- }
-diff -urN linux-2.4.30/drivers/net/bonding/bond_alb.c linux-2.4.30-hf32.3/drivers/net/bonding/bond_alb.c
---- linux-2.4.30/drivers/net/bonding/bond_alb.c 2004-04-14 15:05:30.000000000 +0200
-+++ linux-2.4.30-hf32.3/drivers/net/bonding/bond_alb.c 2006-03-18 00:34:06.000000000 +0100
-@@ -37,6 +37,9 @@
- *
- * 2004/01/14 - Shmulik Hen <shmulik.hen at intel dot com>
- * - Add capability to tag self generated packets in ALB/TLB modes.
-+ *
-+ * 2005/12/02 - Michael O'Donnell <Michael.ODonnell at stratus dot com>
-+ * - Stratus88746: tlb_clear_slave() must tlb_init_slave() while locked.
- */
-
- //#define BONDING_DEBUG 1
-@@ -187,9 +190,9 @@
- index = next_index;
- }
-
-- _unlock_tx_hashtbl(bond);
-+ tlb_init_slave(slave); /* Stratus88746: do this before unlocking */
-
-- tlb_init_slave(slave);
-+ _unlock_tx_hashtbl(bond);
- }
-
- /* Must be called before starting the monitor timer */
-diff -urN linux-2.4.30/drivers/net/bonding/bond_main.c linux-2.4.30-hf32.3/drivers/net/bonding/bond_main.c
---- linux-2.4.30/drivers/net/bonding/bond_main.c 2004-11-17 12:54:21.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/net/bonding/bond_main.c 2006-03-18 00:34:06.000000000 +0100
-@@ -469,6 +469,13 @@
- * * Add support for VLAN hardware acceleration capable slaves.
- * * Add capability to tag self generated packets in ALB/TLB modes.
- * Set version to 2.6.0.
-+ * 2004/10/29 - Mitch Williams <mitch.a.williams at intel dot com>
-+ * - Fixed bug when unloading module while using 802.3ad. If
-+ * spinlock debugging is turned on, this causes a stack dump.
-+ * Solution is to move call to dev_remove_pack outside of the
-+ * spinlock.
-+ * Set version to 2.6.1.
-+ *
- */
-
- //#define BONDING_DEBUG 1
-@@ -3565,15 +3572,15 @@
- {
- struct bonding *bond = bond_dev->priv;
-
-- write_lock_bh(&bond->lock);
--
-- bond_mc_list_destroy(bond);
--
- if (bond->params.mode == BOND_MODE_8023AD) {
- /* Unregister the receive of LACPDUs */
- bond_unregister_lacpdu(bond);
- }
-
-+ write_lock_bh(&bond->lock);
-+
-+ bond_mc_list_destroy(bond);
-+
- /* signal timers not to re-arm */
- bond->kill_timers = 1;
-
-diff -urN linux-2.4.30/drivers/net/e1000/e1000_hw.c linux-2.4.30-hf32.3/drivers/net/e1000/e1000_hw.c
---- linux-2.4.30/drivers/net/e1000/e1000_hw.c 2005-04-14 09:43:33.000000000 +0200
-+++ linux-2.4.30-hf32.3/drivers/net/e1000/e1000_hw.c 2006-03-18 00:34:06.000000000 +0100
-@@ -5049,7 +5049,7 @@
- if(ret_val)
- return ret_val;
-
-- msec_delay(20);
-+ msec_delay_irq(20);
-
- ret_val = e1000_write_phy_reg(hw, 0x0000,
- IGP01E1000_IEEE_FORCE_GIGA);
-@@ -5073,7 +5073,7 @@
- if(ret_val)
- return ret_val;
-
-- msec_delay(20);
-+ msec_delay_irq(20);
-
- /* Now enable the transmitter */
- ret_val = e1000_write_phy_reg(hw, 0x2F5B, phy_saved_data);
-@@ -5098,7 +5098,7 @@
- if(ret_val)
- return ret_val;
-
-- msec_delay(20);
-+ msec_delay_irq(20);
-
- ret_val = e1000_write_phy_reg(hw, 0x0000,
- IGP01E1000_IEEE_FORCE_GIGA);
-@@ -5114,7 +5114,7 @@
- if(ret_val)
- return ret_val;
-
-- msec_delay(20);
-+ msec_delay_irq(20);
-
- /* Now enable the transmitter */
- ret_val = e1000_write_phy_reg(hw, 0x2F5B, phy_saved_data);
-diff -urN linux-2.4.30/drivers/net/wan/sdla.c linux-2.4.30-hf32.3/drivers/net/wan/sdla.c
---- linux-2.4.30/drivers/net/wan/sdla.c 2005-01-27 18:57:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/net/wan/sdla.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1201,6 +1201,7 @@
- temp = kmalloc(mem.len, GFP_KERNEL);
- if (!temp)
- return(-ENOMEM);
-+ memset(temp, 0, mem.len);
- sdla_read(dev, mem.addr, temp, mem.len);
- if(copy_to_user(mem.data, temp, mem.len))
- {
-diff -urN linux-2.4.30/drivers/net/wireless/airo.c linux-2.4.30-hf32.3/drivers/net/wireless/airo.c
---- linux-2.4.30/drivers/net/wireless/airo.c 2004-08-08 01:26:05.000000000 +0200
-+++ linux-2.4.30-hf32.3/drivers/net/wireless/airo.c 2006-03-18 00:34:06.000000000 +0100
-@@ -43,6 +43,8 @@
- #include <linux/pci.h>
- #include <asm/uaccess.h>
-
-+#include "airo.h"
-+
- #ifdef CONFIG_PCI
- static struct pci_device_id card_ids[] = {
- { 0x14b9, 1, PCI_ANY_ID, PCI_ANY_ID, },
-diff -urN linux-2.4.30/drivers/net/wireless/airo.h linux-2.4.30-hf32.3/drivers/net/wireless/airo.h
---- linux-2.4.30/drivers/net/wireless/airo.h 1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/net/wireless/airo.h 2006-03-18 00:34:06.000000000 +0100
-@@ -0,0 +1,8 @@
-+#ifndef _AIRO_H_
-+#define _AIRO_H_
-+
-+struct net_device *init_airo_card(unsigned short irq, int port, int is_pcmcia);
-+void stop_airo_card(struct net_device *dev, int freeres);
-+int reset_airo_card(struct net_device *dev);
-+
-+#endif /* _AIRO_H_ */
-diff -urN linux-2.4.30/drivers/net/wireless/airo_cs.c linux-2.4.30-hf32.3/drivers/net/wireless/airo_cs.c
---- linux-2.4.30/drivers/net/wireless/airo_cs.c 2002-11-29 00:53:14.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/net/wireless/airo_cs.c 2006-03-18 00:34:06.000000000 +0100
-@@ -45,6 +45,8 @@
- #include <pcmcia/cisreg.h>
- #include <pcmcia/ds.h>
-
-+#include "airo.h"
-+
- /*
- All the PCMCIA modules use PCMCIA_DEBUG to control debugging. If
- you do not define PCMCIA_DEBUG at all, all the debug code will be
-@@ -91,10 +93,6 @@
- event handler.
- */
-
--struct net_device *init_airo_card( int, int, int );
--void stop_airo_card( struct net_device *, int );
--int reset_airo_card( struct net_device * );
--
- static void airo_config(dev_link_t *link);
- static void airo_release(u_long arg);
- static int airo_event(event_t event, int priority,
-diff -urN linux-2.4.30/drivers/net/wireless/hermes.c linux-2.4.30-hf32.3/drivers/net/wireless/hermes.c
---- linux-2.4.30/drivers/net/wireless/hermes.c 2003-08-25 13:44:42.000000000 +0200
-+++ linux-2.4.30-hf32.3/drivers/net/wireless/hermes.c 2006-03-18 00:34:06.000000000 +0100
-@@ -448,6 +448,43 @@
- return err;
- }
-
-+/* Write a block of data to the chip's buffer with padding if
-+ * neccessary, via the BAP. Synchronization/serialization is the
-+ * caller's problem. len must be even.
-+ *
-+ * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware
-+ */
-+int hermes_bap_pwrite_pad(hermes_t *hw, int bap, const void *buf, unsigned data_len, unsigned len,
-+ u16 id, u16 offset)
-+{
-+ int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
-+ int err = 0;
-+
-+ if (len < 0 || len % 2 || data_len > len)
-+ return -EINVAL;
-+
-+ err = hermes_bap_seek(hw, bap, id, offset);
-+ if (err)
-+ goto out;
-+
-+ /* Transfer all the complete words of data */
-+ hermes_write_words(hw, dreg, buf, data_len/2);
-+ /* If there is an odd byte left over pad and transfer it */
-+ if (data_len & 1) {
-+ u8 end[2];
-+ end[1] = 0;
-+ end[0] = ((unsigned char *)buf)[data_len - 1];
-+ hermes_write_words(hw, dreg, end, 1);
-+ data_len ++;
-+ }
-+ /* Now send zeros for the padding */
-+ if (data_len < len)
-+ hermes_clear_words(hw, dreg, (len - data_len) / 2);
-+ /* Complete */
-+ out:
-+ return err;
-+}
-+
- /* Read a Length-Type-Value record from the card.
- *
- * If length is NULL, we ignore the length read from the card, and
-@@ -534,6 +571,7 @@
-
- EXPORT_SYMBOL(hermes_bap_pread);
- EXPORT_SYMBOL(hermes_bap_pwrite);
-+EXPORT_SYMBOL(hermes_bap_pwrite_pad);
- EXPORT_SYMBOL(hermes_read_ltv);
- EXPORT_SYMBOL(hermes_write_ltv);
-
-diff -urN linux-2.4.30/drivers/net/wireless/hermes.h linux-2.4.30-hf32.3/drivers/net/wireless/hermes.h
---- linux-2.4.30/drivers/net/wireless/hermes.h 2006-01-29 08:47:28.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/net/wireless/hermes.h 2006-03-18 00:34:06.000000000 +0100
-@@ -319,6 +319,8 @@
- u16 id, u16 offset);
- int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, unsigned len,
- u16 id, u16 offset);
-+int hermes_bap_pwrite_pad(hermes_t *hw, int bap, const void *buf,
-+ unsigned data_len, unsigned len, u16 id, u16 offset);
- int hermes_read_ltv(hermes_t *hw, int bap, u16 rid, unsigned buflen,
- u16 *length, void *buf);
- int hermes_write_ltv(hermes_t *hw, int bap, u16 rid,
-diff -urN linux-2.4.30/drivers/net/wireless/orinoco.c linux-2.4.30-hf32.3/drivers/net/wireless/orinoco.c
---- linux-2.4.30/drivers/net/wireless/orinoco.c 2003-08-25 13:44:42.000000000 +0200
-+++ linux-2.4.30-hf32.3/drivers/net/wireless/orinoco.c 2006-03-18 00:34:06.000000000 +0100
-@@ -2312,6 +2312,8 @@
- }
- }
-
-+#define ALIGN(x,a) (((x)+(a)-1)&~((a)-1))
-+
- static int
- orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
- {
-@@ -2407,14 +2409,22 @@
- stats->tx_errors++;
- goto fail;
- }
-+ /* Actual xfer length - allow for padding */
-+ len = ALIGN(data_len, 2);
-+ if (len < ETH_ZLEN - ETH_HLEN)
-+ len = ETH_ZLEN - ETH_HLEN;
- } else { /* IEEE 802.3 frame */
- data_len = len + ETH_HLEN;
- data_off = HERMES_802_3_OFFSET;
- p = skb->data;
-+ /* Actual xfer length - round up for odd length packets */
-+ len = ALIGN(data_len, 2);
-+ if (len < ETH_ZLEN)
-+ len = ETH_ZLEN;
- }
-
-- /* Round up for odd length packets */
-- err = hermes_bap_pwrite(hw, USER_BAP, p, RUP_EVEN(data_len), txfid, data_off);
-+ err = hermes_bap_pwrite_pad(hw, USER_BAP, p, data_len, len,
-+ txfid, data_off);
- if (err) {
- printk(KERN_ERR "%s: Error %d writing packet to BAP\n",
- dev->name, err);
-diff -urN linux-2.4.30/drivers/scsi/sd.c linux-2.4.30-hf32.3/drivers/scsi/sd.c
---- linux-2.4.30/drivers/scsi/sd.c 2005-04-14 09:43:34.000000000 +0200
-+++ linux-2.4.30-hf32.3/drivers/scsi/sd.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1472,6 +1472,7 @@
- kfree(sd_sizes);
- kfree(sd_blocksizes);
- kfree(sd_hardsizes);
-+ kfree(sd_max_sectors);
- for (i = 0; i < N_USED_SD_MAJORS; i++) {
- kfree(sd_gendisks[i].de_arr);
- kfree(sd_gendisks[i].flags);
-@@ -1482,6 +1483,7 @@
- del_gendisk(&sd_gendisks[i]);
- blksize_size[SD_MAJOR(i)] = NULL;
- hardsect_size[SD_MAJOR(i)] = NULL;
-+ max_sectors[SD_MAJOR(i)] = NULL;
- read_ahead[SD_MAJOR(i)] = 0;
- }
- sd_template.dev_max = 0;
-diff -urN linux-2.4.30/drivers/usb/serial/io_edgeport.c linux-2.4.30-hf32.3/drivers/usb/serial/io_edgeport.c
---- linux-2.4.30/drivers/usb/serial/io_edgeport.c 2005-01-27 18:57:33.000000000 +0100
-+++ linux-2.4.30-hf32.3/drivers/usb/serial/io_edgeport.c 2006-03-18 00:34:06.000000000 +0100
-@@ -2803,9 +2803,13 @@
- static void unicode_to_ascii (char *string, short *unicode, int unicode_size)
- {
- int i;
-- for (i = 0; i < unicode_size; ++i) {
-+
-+ if (unicode_size <= 0)
-+ return;
-+
-+ for (i = 0; i < unicode_size; ++i)
- string[i] = (char)(le16_to_cpu(unicode[i]));
-- }
-+
- string[unicode_size] = 0x00;
- }
-
-diff -urN linux-2.4.30/fs/binfmt_elf.c linux-2.4.30-hf32.3/fs/binfmt_elf.c
---- linux-2.4.30/fs/binfmt_elf.c 2005-04-14 09:43:34.000000000 +0200
-+++ linux-2.4.30-hf32.3/fs/binfmt_elf.c 2006-03-18 00:34:06.000000000 +0100
-@@ -222,7 +222,7 @@
- }
-
- __put_user((elf_addr_t)argc,--sp);
-- current->mm->arg_start = (unsigned long) p;
-+ current->mm->arg_end = current->mm->arg_start = (unsigned long) p;
- while (argc-->0) {
- __put_user((elf_caddr_t)(unsigned long)p,argv++);
- len = strnlen_user(p, PAGE_SIZE*MAX_ARG_PAGES);
-@@ -643,6 +643,11 @@
- SET_PERSONALITY(elf_ex, ibcs2_interpreter);
- }
-
-+ if (BAD_ADDR(elf_ex.e_entry)) {
-+ retval = -ENOEXEC;
-+ goto out_free_dentry;
-+ }
-+
- /* OK, we are done with that, now set up the arg stuff,
- and then start this sucker up */
-
-@@ -820,7 +825,7 @@
- printk(KERN_ERR "Unable to load interpreter %.128s\n",
- elf_interpreter);
- force_sig(SIGSEGV, current);
-- retval = -ENOEXEC; /* Nobody gets to see this, but.. */
-+ retval = IS_ERR((void *)elf_entry) ? PTR_ERR((void *)elf_entry) : -ENOEXEC;
- goto out_free_dentry;
- }
- reloc_func_desc = interp_load_addr;
-@@ -1159,7 +1164,7 @@
- /* first copy the parameters from user space */
- memset(&psinfo, 0, sizeof(psinfo));
- {
-- int i, len;
-+ unsigned int i, len;
-
- len = current->mm->arg_end - current->mm->arg_start;
- if (len >= ELF_PRARGSZ)
-diff -urN linux-2.4.30/fs/buffer.c linux-2.4.30-hf32.3/fs/buffer.c
---- linux-2.4.30/fs/buffer.c 2004-11-17 12:54:21.000000000 +0100
-+++ linux-2.4.30-hf32.3/fs/buffer.c 2006-03-18 00:34:06.000000000 +0100
-@@ -584,7 +584,7 @@
- (*bhp)->b_prev_free->b_next_free = bh;
- (*bhp)->b_prev_free = bh;
- nr_buffers_type[blist]++;
-- size_buffers_type[blist] += bh->b_size;
-+ size_buffers_type[blist] += bh->b_size >> 9;
- }
-
- static void __remove_from_lru_list(struct buffer_head * bh)
-@@ -604,7 +604,7 @@
- bh->b_next_free = NULL;
- bh->b_prev_free = NULL;
- nr_buffers_type[blist]--;
-- size_buffers_type[blist] -= bh->b_size;
-+ size_buffers_type[blist] -= bh->b_size >> 9;
- }
- }
-
-@@ -1033,7 +1033,7 @@
- {
- unsigned long dirty, tot, hard_dirty_limit, soft_dirty_limit;
-
-- dirty = size_buffers_type[BUF_DIRTY] >> PAGE_SHIFT;
-+ dirty = size_buffers_type[BUF_DIRTY] >> (PAGE_SHIFT - 9);
- tot = nr_free_buffer_pages();
-
- dirty *= 100;
-@@ -1054,7 +1054,7 @@
- {
- unsigned long dirty, tot, dirty_limit;
-
-- dirty = size_buffers_type[BUF_DIRTY] >> PAGE_SHIFT;
-+ dirty = size_buffers_type[BUF_DIRTY] >> (PAGE_SHIFT - 9);
- tot = nr_free_buffer_pages();
-
- dirty *= 100;
-@@ -2839,7 +2839,7 @@
- }
- printk("%9s: %d buffers, %lu kbyte, %d used (last=%d), "
- "%d locked, %d dirty, %d delay\n",
-- buf_types[nlist], found, size_buffers_type[nlist]>>10,
-+ buf_types[nlist], found, size_buffers_type[nlist]>>(10-9),
- used, lastused, locked, dirty, delalloc);
- }
- spin_unlock(&lru_list_lock);
-diff -urN linux-2.4.30/fs/dcache.c linux-2.4.30-hf32.3/fs/dcache.c
---- linux-2.4.30/fs/dcache.c 2004-11-17 12:54:21.000000000 +0100
-+++ linux-2.4.30-hf32.3/fs/dcache.c 2006-03-18 00:34:06.000000000 +0100
-@@ -221,7 +221,7 @@
- static inline struct dentry * __dget_locked(struct dentry *dentry)
- {
- atomic_inc(&dentry->d_count);
-- if (atomic_read(&dentry->d_count) == 1) {
-+ if (!list_empty(&dentry->d_lru)) {
- dentry_stat.nr_unused--;
- list_del_init(&dentry->d_lru);
- }
-diff -urN linux-2.4.30/fs/inode.c linux-2.4.30-hf32.3/fs/inode.c
---- linux-2.4.30/fs/inode.c 2004-04-14 15:05:40.000000000 +0200
-+++ linux-2.4.30-hf32.3/fs/inode.c 2006-03-18 00:34:06.000000000 +0100
-@@ -297,7 +297,7 @@
- {
- struct list_head *to;
-
-- if (inode->i_state & I_FREEING)
-+ if (inode->i_state & (I_FREEING|I_CLEAR))
- return;
- if (list_empty(&inode->i_hash))
- return;
-@@ -634,7 +634,9 @@
- cdput(inode->i_cdev);
- inode->i_cdev = NULL;
- }
-+ spin_lock(&inode_lock);
- inode->i_state = I_CLEAR;
-+ spin_unlock(&inode_lock);
- }
-
- /*
-@@ -852,8 +854,8 @@
- */
- if (goal <= 0)
- return;
-- if (inodes_stat.nr_unused * sizeof(struct inode) * 10 <
-- freeable_lowmem() * PAGE_SIZE)
-+ if (inodes_stat.nr_unused <
-+ (freeable_lowmem() * PAGE_SIZE) / (sizeof(struct inode) * 10))
- return;
-
- wakeup_bdflush();
-diff -urN linux-2.4.30/fs/isofs/compress.c linux-2.4.30-hf32.3/fs/isofs/compress.c
---- linux-2.4.30/fs/isofs/compress.c 2002-11-29 00:53:15.000000000 +0100
-+++ linux-2.4.30-hf32.3/fs/isofs/compress.c 2006-03-18 00:34:06.000000000 +0100
-@@ -147,8 +147,14 @@
- cend = le32_to_cpu(*(u32 *)(bh->b_data + (blockendptr & bufmask)));
- brelse(bh);
-
-+ if (cstart > cend)
-+ goto eio;
-+
- csize = cend-cstart;
-
-+ if (csize > deflateBound(1UL << zisofs_block_shift))
-+ goto eio;
-+
- /* Now page[] contains an array of pages, any of which can be NULL,
- and the locks on which we hold. We should now read the data and
- release the pages. If the pages are NULL the decompressed data
-diff -urN linux-2.4.30/fs/isofs/inode.c linux-2.4.30-hf32.3/fs/isofs/inode.c
---- linux-2.4.30/fs/isofs/inode.c 2005-04-14 09:43:34.000000000 +0200
-+++ linux-2.4.30-hf32.3/fs/isofs/inode.c 2006-03-18 00:34:06.000000000 +0100
-@@ -335,16 +335,16 @@
- else if (!strcmp(value,"acorn")) popt->map = 'a';
- else return 0;
- }
-- if (!strcmp(this_char,"session") && value) {
-+ else if (!strcmp(this_char,"session") && value) {
- char * vpnt = value;
- unsigned int ivalue = simple_strtoul(vpnt, &vpnt, 0);
-- if(ivalue < 0 || ivalue >99) return 0;
-+ if (ivalue > 99) return 0;
- popt->session=ivalue+1;
- }
-- if (!strcmp(this_char,"sbsector") && value) {
-+ else if (!strcmp(this_char,"sbsector") && value) {
- char * vpnt = value;
- unsigned int ivalue = simple_strtoul(vpnt, &vpnt, 0);
-- if(ivalue < 0 || ivalue >660*512) return 0;
-+ if (ivalue > 660*512) return 0;
- popt->sbsector=ivalue;
- }
- else if (!strcmp(this_char,"check") && value) {
-diff -urN linux-2.4.30/fs/jfs/super.c linux-2.4.30-hf32.3/fs/jfs/super.c
---- linux-2.4.30/fs/jfs/super.c 2005-04-14 09:43:34.000000000 +0200
-+++ linux-2.4.30-hf32.3/fs/jfs/super.c 2006-03-18 00:34:06.000000000 +0100
-@@ -407,7 +407,7 @@
- jfs_err("jfs_umount failed with return code %d", rc);
- }
- out_kfree:
-- if (sbi->nls_tab)
-+ if (sbi->nls_tab && sbi->nls_tab != (void *) -1)
- unload_nls(sbi->nls_tab);
- kfree(sbi);
- return NULL;
-diff -urN linux-2.4.30/fs/locks.c linux-2.4.30-hf32.3/fs/locks.c
---- linux-2.4.30/fs/locks.c 2004-04-14 15:05:40.000000000 +0200
-+++ linux-2.4.30-hf32.3/fs/locks.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1087,7 +1087,6 @@
- before = &fl->fl_next;
- continue;
- }
-- printk(KERN_INFO "lease broken - owner pid = %d\n", fl->fl_pid);
- lease_modify(before, fl->fl_type & ~F_INPROGRESS);
- if (fl == *before) /* lease_modify may have freed fl */
- before = &fl->fl_next;
-diff -urN linux-2.4.30/fs/nfs/nfs2xdr.c linux-2.4.30-hf32.3/fs/nfs/nfs2xdr.c
---- linux-2.4.30/fs/nfs/nfs2xdr.c 2002-11-29 00:53:15.000000000 +0100
-+++ linux-2.4.30-hf32.3/fs/nfs/nfs2xdr.c 2006-03-18 00:34:06.000000000 +0100
-@@ -571,8 +571,11 @@
- strlen = (u32*)kmap(rcvbuf->pages[0]);
- /* Convert length of symlink */
- len = ntohl(*strlen);
-- if (len > rcvbuf->page_len)
-- len = rcvbuf->page_len;
-+ if (len >= rcvbuf->page_len - sizeof(u32) || len > NFS2_MAXPATHLEN) {
-+ dprintk("NFS: server returned giant symlink!\n");
-+ kunmap(rcvbuf->pages[0]);
-+ return -ENAMETOOLONG;
-+ }
- *strlen = len;
- /* NULL terminate the string we got */
- string = (char *)(strlen + 1);
-diff -urN linux-2.4.30/fs/nfs/nfs3xdr.c linux-2.4.30-hf32.3/fs/nfs/nfs3xdr.c
---- linux-2.4.30/fs/nfs/nfs3xdr.c 2003-11-28 19:26:21.000000000 +0100
-+++ linux-2.4.30-hf32.3/fs/nfs/nfs3xdr.c 2006-03-18 00:34:06.000000000 +0100
-@@ -759,8 +759,11 @@
- strlen = (u32*)kmap(rcvbuf->pages[0]);
- /* Convert length of symlink */
- len = ntohl(*strlen);
-- if (len > rcvbuf->page_len)
-- len = rcvbuf->page_len;
-+ if (len >= rcvbuf->page_len - sizeof(u32)) {
-+ dprintk("NFS: server returned giant symlink!\n");
-+ kunmap(rcvbuf->pages[0]);
-+ return -ENAMETOOLONG;
-+ }
- *strlen = len;
- /* NULL terminate the string we got */
- string = (char *)(strlen + 1);
-diff -urN linux-2.4.30/fs/proc/base.c linux-2.4.30-hf32.3/fs/proc/base.c
---- linux-2.4.30/fs/proc/base.c 2005-01-27 18:57:33.000000000 +0100
-+++ linux-2.4.30-hf32.3/fs/proc/base.c 2006-03-18 00:34:06.000000000 +0100
-@@ -185,8 +185,12 @@
- int res = 0;
- task_lock(task);
- mm = task->mm;
-- if (mm)
-- atomic_inc(&mm->mm_users);
-+ if (mm) {
-+ if (mm->arg_end)
-+ atomic_inc(&mm->mm_users);
-+ else
-+ mm = NULL;
-+ }
- task_unlock(task);
- if (mm && mm->arg_start && mm->arg_start < mm->arg_end) {
- unsigned long len = mm->arg_end - mm->arg_start;
-diff -urN linux-2.4.30/fs/smbfs/proc.c linux-2.4.30-hf32.3/fs/smbfs/proc.c
---- linux-2.4.30/fs/smbfs/proc.c 2004-11-17 12:54:21.000000000 +0100
-+++ linux-2.4.30-hf32.3/fs/smbfs/proc.c 2006-03-18 00:34:06.000000000 +0100
-@@ -2945,7 +2945,7 @@
- LSET(data, 32, SMB_TIME_NO_CHANGE);
- LSET(data, 40, SMB_UID_NO_CHANGE);
- LSET(data, 48, SMB_GID_NO_CHANGE);
-- LSET(data, 56, smb_filetype_from_mode(attr->ia_mode));
-+ DSET(data, 56, smb_filetype_from_mode(attr->ia_mode));
- LSET(data, 60, major);
- LSET(data, 68, minor);
- LSET(data, 76, 0);
-diff -urN linux-2.4.30/fs/xfs/linux-2.4/xfs_buf.c linux-2.4.30-hf32.3/fs/xfs/linux-2.4/xfs_buf.c
---- linux-2.4.30/fs/xfs/linux-2.4/xfs_buf.c 2005-01-27 18:57:33.000000000 +0100
-+++ linux-2.4.30-hf32.3/fs/xfs/linux-2.4/xfs_buf.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1073,7 +1073,7 @@
- return(locked ? 0 : -EBUSY);
- }
-
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(XFS_BLI_TRACE)
- /*
- * pagebuf_lock_value
- *
-diff -urN linux-2.4.30/include/asm-i386/system.h linux-2.4.30-hf32.3/include/asm-i386/system.h
---- linux-2.4.30/include/asm-i386/system.h 2005-03-26 10:13:13.000000000 +0100
-+++ linux-2.4.30-hf32.3/include/asm-i386/system.h 2006-03-18 00:34:06.000000000 +0100
-@@ -84,7 +84,7 @@
- #define loadsegment(seg,value) \
- asm volatile("\n" \
- "1:\t" \
-- "movl %0,%%" #seg "\n" \
-+ "mov %0,%%" #seg "\n" \
- "2:\n" \
- ".section .fixup,\"ax\"\n" \
- "3:\t" \
-@@ -96,7 +96,7 @@
- ".align 4\n\t" \
- ".long 1b,3b\n" \
- ".previous" \
-- : :"m" (*(unsigned int *)&(value)))
-+ : :"m" (value))
-
- /*
- * Clear and set 'TS' bit respectively
-diff -urN linux-2.4.30/include/asm-x86_64/desc.h linux-2.4.30-hf32.3/include/asm-x86_64/desc.h
---- linux-2.4.30/include/asm-x86_64/desc.h 2004-08-08 01:26:06.000000000 +0200
-+++ linux-2.4.30-hf32.3/include/asm-x86_64/desc.h 2006-03-18 00:34:06.000000000 +0100
-@@ -128,7 +128,7 @@
-
- static inline void set_tss_desc(unsigned n, void *addr)
- {
-- set_tssldt_descriptor((void *)&gdt_table + __CPU_DESC_INDEX(n,tss), (unsigned long)addr, DESC_TSS, sizeof(struct tss_struct));
-+ set_tssldt_descriptor((void *)&gdt_table + __CPU_DESC_INDEX(n,tss), (unsigned long)addr, DESC_TSS, IO_BITMAP_OFFSET + IO_BITMAP_BYTES + 7);
- }
-
- static inline void set_ldt_desc(unsigned n, void *addr, int size)
-diff -urN linux-2.4.30/include/asm-x86_64/processor.h linux-2.4.30-hf32.3/include/asm-x86_64/processor.h
---- linux-2.4.30/include/asm-x86_64/processor.h 2004-04-14 15:05:40.000000000 +0200
-+++ linux-2.4.30-hf32.3/include/asm-x86_64/processor.h 2006-03-18 00:34:06.000000000 +0100
-@@ -260,6 +260,7 @@
- * Size of io_bitmap in longwords: 32 is ports 0-0x3ff.
- */
- #define IO_BITMAP_SIZE 32
-+#define IO_BITMAP_BYTES (IO_BITMAP_SIZE * sizeof(u32))
- #define IO_BITMAP_OFFSET offsetof(struct tss_struct,io_bitmap)
- #define INVALID_IO_BITMAP_OFFSET 0x8000
-
-@@ -325,10 +326,9 @@
- #define INIT_MMAP \
- { &init_mm, 0, 0, NULL, PAGE_SHARED, VM_READ | VM_WRITE | VM_EXEC, 1, NULL, NULL }
-
--#define STACKFAULT_STACK 1
--#define DOUBLEFAULT_STACK 2
--#define NMI_STACK 3
--#define N_EXCEPTION_STACKS 3 /* hw limit: 7 */
-+#define DOUBLEFAULT_STACK 1
-+#define NMI_STACK 2
-+#define N_EXCEPTION_STACKS 2 /* hw limit: 7 */
- #define EXCEPTION_STKSZ PAGE_SIZE
- #define EXCEPTION_STK_ORDER 0
-
-diff -urN linux-2.4.30/include/linux/delay.h linux-2.4.30-hf32.3/include/linux/delay.h
---- linux-2.4.30/include/linux/delay.h 2005-11-18 12:45:36.000000000 +0100
-+++ linux-2.4.30-hf32.3/include/linux/delay.h 2006-03-18 00:34:06.000000000 +0100
-@@ -14,6 +14,24 @@
- #include <asm/delay.h>
-
- /*
-+ * We define MAX_MSEC_OFFSET as the maximal value that can be accepted by
-+ * msecs_to_jiffies() without risking a multiply overflow. This function
-+ * returns MAX_JIFFY_OFFSET for arguments above those values.
-+ */
-+
-+#if HZ <= 1000 && !(1000 % HZ)
-+# define MAX_MSEC_OFFSET \
-+ (ULONG_MAX - (1000 / HZ) + 1)
-+#elif HZ > 1000 && !(HZ % 1000)
-+# define MAX_MSEC_OFFSET \
-+ (ULONG_MAX / (HZ / 1000))
-+#else
-+# define MAX_MSEC_OFFSET \
-+ ((ULONG_MAX - 999) / HZ)
-+#endif
-+
-+
-+/*
- * Convert jiffies to milliseconds and back.
- *
- * Avoid unnecessary multiplications/divisions in the
-@@ -43,14 +61,14 @@
-
- static inline unsigned long msecs_to_jiffies(const unsigned int m)
- {
-- if (m > jiffies_to_msecs(MAX_JIFFY_OFFSET))
-+ if (MAX_MSEC_OFFSET < UINT_MAX && m > (unsigned int)MAX_MSEC_OFFSET)
- return MAX_JIFFY_OFFSET;
- #if HZ <= 1000 && !(1000 % HZ)
-- return (m + (1000 / HZ) - 1) / (1000 / HZ);
-+ return ((unsigned long)m + (1000 / HZ) - 1) / (1000 / HZ);
- #elif HZ > 1000 && !(HZ % 1000)
-- return m * (HZ / 1000);
-+ return (unsigned long)m * (HZ / 1000);
- #else
-- return (m * HZ + 999) / 1000;
-+ return ((unsigned long)m * HZ + 999) / 1000;
- #endif
- }
-
-diff -urN linux-2.4.30/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.4.30-hf32.3/include/linux/netfilter_ipv4/ip_conntrack.h
---- linux-2.4.30/include/linux/netfilter_ipv4/ip_conntrack.h 2005-07-27 13:13:58.000000000 +0200
-+++ linux-2.4.30-hf32.3/include/linux/netfilter_ipv4/ip_conntrack.h 2006-03-18 00:34:06.000000000 +0100
-@@ -229,7 +229,7 @@
- ip_conntrack_get(struct sk_buff *skb, enum ip_conntrack_info *ctinfo);
-
- /* decrement reference count on a conntrack */
--extern inline void ip_conntrack_put(struct ip_conntrack *ct);
-+extern void ip_conntrack_put(struct ip_conntrack *ct);
-
- /* find unconfirmed expectation based on tuple */
- struct ip_conntrack_expect *
-diff -urN linux-2.4.30/include/linux/netfilter_ipv4/ip_nat_rule.h linux-2.4.30-hf32.3/include/linux/netfilter_ipv4/ip_nat_rule.h
---- linux-2.4.30/include/linux/netfilter_ipv4/ip_nat_rule.h 2006-01-29 08:38:54.000000000 +0100
-+++ linux-2.4.30-hf32.3/include/linux/netfilter_ipv4/ip_nat_rule.h 2006-03-18 00:34:06.000000000 +0100
-@@ -19,5 +19,10 @@
- alloc_null_binding(struct ip_conntrack *conntrack,
- struct ip_nat_info *info,
- unsigned int hooknum);
-+
-+extern unsigned int
-+alloc_null_binding_confirmed(struct ip_conntrack *conntrack,
-+ struct ip_nat_info *info,
-+ unsigned int hooknum);
- #endif
- #endif /* _IP_NAT_RULE_H */
-diff -urN linux-2.4.30/include/linux/proc_fs.h linux-2.4.30-hf32.3/include/linux/proc_fs.h
---- linux-2.4.30/include/linux/proc_fs.h 2005-12-04 19:00:23.000000000 +0100
-+++ linux-2.4.30-hf32.3/include/linux/proc_fs.h 2006-03-18 00:34:06.000000000 +0100
-@@ -70,6 +70,7 @@
- atomic_t count; /* use count */
- int deleted; /* delete flag */
- kdev_t rdev;
-+ void *set;
- };
-
- #define PROC_INODE_PROPER(inode) ((inode)->i_ino & ~0xffff)
-diff -urN linux-2.4.30/include/linux/sysctl.h linux-2.4.30-hf32.3/include/linux/sysctl.h
---- linux-2.4.30/include/linux/sysctl.h 2005-11-02 10:29:31.000000000 +0100
-+++ linux-2.4.30-hf32.3/include/linux/sysctl.h 2006-03-18 00:34:06.000000000 +0100
-@@ -29,6 +29,7 @@
- #include <linux/list.h>
-
- struct file;
-+struct completion;
-
- #define CTL_MAXNAME 10
-
-@@ -829,6 +830,8 @@
- {
- ctl_table *ctl_table;
- struct list_head ctl_entry;
-+ int used;
-+ struct completion *unregistering;
- };
-
- struct ctl_table_header * register_sysctl_table(ctl_table * table,
-diff -urN linux-2.4.30/include/linux/zlib.h linux-2.4.30-hf32.3/include/linux/zlib.h
---- linux-2.4.30/include/linux/zlib.h 2005-11-18 12:46:17.000000000 +0100
-+++ linux-2.4.30-hf32.3/include/linux/zlib.h 2006-03-18 00:34:06.000000000 +0100
-@@ -516,6 +516,11 @@
- stream state was inconsistent (such as zalloc or state being NULL).
- */
-
-+static inline unsigned long deflateBound(unsigned long s)
-+{
-+ return s + ((s + 7) >> 3) + ((s + 63) >> 6) + 11;
-+}
-+
- ZEXTERN int ZEXPORT zlib_deflateParams OF((z_streamp strm,
- int level,
- int strategy));
-diff -urN linux-2.4.30/include/net/ax25.h linux-2.4.30-hf32.3/include/net/ax25.h
---- linux-2.4.30/include/net/ax25.h 2005-11-18 12:45:59.000000000 +0100
-+++ linux-2.4.30-hf32.3/include/net/ax25.h 2006-03-18 00:34:06.000000000 +0100
-@@ -142,7 +142,7 @@
- ax25_address calls[AX25_MAX_DIGIS];
- unsigned char repeated[AX25_MAX_DIGIS];
- unsigned char ndigi;
-- char lastrepeat;
-+ signed char lastrepeat;
- } ax25_digi;
-
- typedef struct ax25_route {
-diff -urN linux-2.4.30/include/net/ip6_fib.h linux-2.4.30-hf32.3/include/net/ip6_fib.h
---- linux-2.4.30/include/net/ip6_fib.h 2005-09-01 16:18:27.000000000 +0200
-+++ linux-2.4.30-hf32.3/include/net/ip6_fib.h 2006-03-18 00:34:06.000000000 +0100
-@@ -171,13 +171,16 @@
-
- extern int fib6_add(struct fib6_node *root,
- struct rt6_info *rt,
-- struct nlmsghdr *nlh);
-+ struct nlmsghdr *nlh,
-+ struct netlink_skb_parms *req);
-
- extern int fib6_del(struct rt6_info *rt,
-- struct nlmsghdr *nlh);
-+ struct nlmsghdr *nlh,
-+ struct netlink_skb_parms *req);
-
- extern void inet6_rt_notify(int event, struct rt6_info *rt,
-- struct nlmsghdr *nlh);
-+ struct nlmsghdr *nlh,
-+ struct netlink_skb_parms *req);
-
- extern void fib6_run_gc(unsigned long dummy);
-
-diff -urN linux-2.4.30/include/net/ip6_route.h linux-2.4.30-hf32.3/include/net/ip6_route.h
---- linux-2.4.30/include/net/ip6_route.h 2005-09-01 16:18:27.000000000 +0200
-+++ linux-2.4.30-hf32.3/include/net/ip6_route.h 2006-03-18 00:34:06.000000000 +0100
-@@ -39,9 +39,11 @@
- extern int ipv6_route_ioctl(unsigned int cmd, void *arg);
-
- extern int ip6_route_add(struct in6_rtmsg *rtmsg,
-- struct nlmsghdr *);
-+ struct nlmsghdr *,
-+ struct netlink_skb_parms *req);
- extern int ip6_del_rt(struct rt6_info *,
-- struct nlmsghdr *);
-+ struct nlmsghdr *,
-+ struct netlink_skb_parms *req);
-
- extern int ip6_rt_addr_add(struct in6_addr *addr,
- struct net_device *dev);
-diff -urN linux-2.4.30/include/net/ip_vs.h linux-2.4.30-hf32.3/include/net/ip_vs.h
---- linux-2.4.30/include/net/ip_vs.h 2005-09-01 16:18:30.000000000 +0200
-+++ linux-2.4.30-hf32.3/include/net/ip_vs.h 2006-03-18 00:34:06.000000000 +0100
-@@ -82,6 +82,7 @@
- #define IP_VS_CONN_F_IN_SEQ 0x0400 /* must do input seq adjust */
- #define IP_VS_CONN_F_SEQ_MASK 0x0600 /* in/out sequence mask */
- #define IP_VS_CONN_F_NO_CPORT 0x0800 /* no client port set yet */
-+#define IP_VS_CONN_F_TEMPLATE 0x1000 /* template, not connection */
-
- /* Move it to better place one day, for now keep it unique */
- #define NFC_IPVS_PROPERTY 0x10000
-@@ -592,6 +593,8 @@
-
- extern struct ip_vs_conn *ip_vs_conn_in_get
- (int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port);
-+extern struct ip_vs_conn *ip_vs_ct_in_get
-+(int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port);
- extern struct ip_vs_conn *ip_vs_conn_out_get
- (int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port);
-
-diff -urN linux-2.4.30/kernel/kmod.c linux-2.4.30-hf32.3/kernel/kmod.c
---- linux-2.4.30/kernel/kmod.c 2003-11-28 19:26:21.000000000 +0100
-+++ linux-2.4.30-hf32.3/kernel/kmod.c 2006-03-18 00:34:06.000000000 +0100
-@@ -125,6 +125,8 @@
- curtask->euid = curtask->uid = curtask->suid = curtask->fsuid = 0;
- curtask->egid = curtask->gid = curtask->sgid = curtask->fsgid = 0;
-
-+ memcpy(&curtask->rlim, &init_task.rlim, sizeof(struct rlimit)*RLIM_NLIMITS);
-+
- curtask->ngroups = 0;
-
- cap_set_full(curtask->cap_effective);
-diff -urN linux-2.4.30/kernel/ptrace.c linux-2.4.30-hf32.3/kernel/ptrace.c
---- linux-2.4.30/kernel/ptrace.c 2003-08-25 13:44:44.000000000 +0200
-+++ linux-2.4.30-hf32.3/kernel/ptrace.c 2006-03-18 00:34:06.000000000 +0100
-@@ -58,7 +58,7 @@
- task_lock(task);
- if (task->pid <= 1)
- goto bad;
-- if (task == current)
-+ if (task->tgid == current->tgid)
- goto bad;
- if (!task->mm)
- goto bad;
-diff -urN linux-2.4.30/kernel/sysctl.c linux-2.4.30-hf32.3/kernel/sysctl.c
---- linux-2.4.30/kernel/sysctl.c 2005-01-27 18:57:34.000000000 +0100
-+++ linux-2.4.30-hf32.3/kernel/sysctl.c 2006-03-18 00:34:06.000000000 +0100
-@@ -147,7 +147,7 @@
-
- extern struct proc_dir_entry *proc_sys_root;
-
--static void register_proc_table(ctl_table *, struct proc_dir_entry *);
-+static void register_proc_table(ctl_table *, struct proc_dir_entry *, void *);
- static void unregister_proc_table(ctl_table *, struct proc_dir_entry *);
- #endif
-
-@@ -360,10 +360,51 @@
-
- extern void init_irq_proc (void);
-
-+static spinlock_t sysctl_lock = SPIN_LOCK_UNLOCKED;
-+
-+/* called under sysctl_lock */
-+static int use_table(struct ctl_table_header *p)
-+{
-+ if (unlikely(p->unregistering != NULL))
-+ return 0;
-+ p->used++;
-+ return 1;
-+}
-+
-+/* called under sysctl_lock */
-+static void unuse_table(struct ctl_table_header *p)
-+{
-+ if (!--p->used)
-+ if (unlikely(p->unregistering != NULL))
-+ complete(p->unregistering);
-+}
-+
-+/* called under sysctl_lock, will reacquire if has to wait */
-+static void start_unregistering(struct ctl_table_header *p)
-+{
-+ /*
-+ * if p->used is 0, nobody will ever touch that entry again;
-+ * we'll eliminate all paths to it before dropping sysctl_lock
-+ */
-+ if (unlikely(p->used)) {
-+ struct completion wait;
-+ init_completion(&wait);
-+ p->unregistering = &wait;
-+ spin_unlock(&sysctl_lock);
-+ wait_for_completion(&wait);
-+ spin_lock(&sysctl_lock);
-+ }
-+ /*
-+ * do not remove from the list until nobody holds it; walking the
-+ * list in do_sysctl() relies on that.
-+ */
-+ list_del_init(&p->ctl_entry);
-+}
-+
- void __init sysctl_init(void)
- {
- #ifdef CONFIG_PROC_FS
-- register_proc_table(root_table, proc_sys_root);
-+ register_proc_table(root_table, proc_sys_root, &root_table_header);
- init_irq_proc();
- #endif
- }
-@@ -372,6 +413,7 @@
- void *newval, size_t newlen)
- {
- struct list_head *tmp;
-+ int error = -ENOTDIR;
-
- if (nlen <= 0 || nlen >= CTL_MAXNAME)
- return -ENOTDIR;
-@@ -383,21 +425,31 @@
- if ((ssize_t)old_len < 0)
- return -EINVAL;
- }
-+ spin_lock(&sysctl_lock);
- tmp = &root_table_header.ctl_entry;
- do {
- struct ctl_table_header *head =
- list_entry(tmp, struct ctl_table_header, ctl_entry);
- void *context = NULL;
-- int error = parse_table(name, nlen, oldval, oldlenp,
-+
-+ if (!use_table(head))
-+ continue;
-+
-+ spin_unlock(&sysctl_lock);
-+
-+ error = parse_table(name, nlen, oldval, oldlenp,
- newval, newlen, head->ctl_table,
- &context);
- if (context)
- kfree(context);
-+
-+ spin_lock(&sysctl_lock);
-+ unuse_table(head);
- if (error != -ENOTDIR)
-- return error;
-- tmp = tmp->next;
-- } while (tmp != &root_table_header.ctl_entry);
-- return -ENOTDIR;
-+ break;
-+ } while ((tmp = tmp->next) != &root_table_header.ctl_entry);
-+ spin_unlock(&sysctl_lock);
-+ return error;
- }
-
- extern asmlinkage long sys_sysctl(struct __sysctl_args *args)
-@@ -604,12 +656,16 @@
- return NULL;
- tmp->ctl_table = table;
- INIT_LIST_HEAD(&tmp->ctl_entry);
-+ tmp->used = 0;
-+ tmp->unregistering = NULL;
-+ spin_lock(&sysctl_lock);
- if (insert_at_head)
- list_add(&tmp->ctl_entry, &root_table_header.ctl_entry);
- else
- list_add_tail(&tmp->ctl_entry, &root_table_header.ctl_entry);
-+ spin_unlock(&sysctl_lock);
- #ifdef CONFIG_PROC_FS
-- register_proc_table(table, proc_sys_root);
-+ register_proc_table(table, proc_sys_root, tmp);
- #endif
- return tmp;
- }
-@@ -623,10 +679,12 @@
- */
- void unregister_sysctl_table(struct ctl_table_header * header)
- {
-- list_del(&header->ctl_entry);
-+ spin_lock(&sysctl_lock);
-+ start_unregistering(header);
- #ifdef CONFIG_PROC_FS
- unregister_proc_table(header->ctl_table, proc_sys_root);
- #endif
-+ spin_unlock(&sysctl_lock);
- kfree(header);
- }
-
-@@ -637,7 +695,7 @@
- #ifdef CONFIG_PROC_FS
-
- /* Scan the sysctl entries in table and add them all into /proc */
--static void register_proc_table(ctl_table * table, struct proc_dir_entry *root)
-+static void register_proc_table(ctl_table * table, struct proc_dir_entry *root, void *set)
- {
- struct proc_dir_entry *de;
- int len;
-@@ -673,6 +731,7 @@
- de = create_proc_entry(table->procname, mode, root);
- if (!de)
- continue;
-+ de->set = set;
- de->data = (void *) table;
- if (table->proc_handler) {
- de->proc_fops = &proc_sys_file_operations;
-@@ -681,7 +740,7 @@
- }
- table->de = de;
- if (de->mode & S_IFDIR)
-- register_proc_table(table->child, de);
-+ register_proc_table(table->child, de, set);
- }
- }
-
-@@ -706,6 +765,13 @@
- continue;
- }
-
-+ /*
-+ * In any case, mark the entry as goner; we'll keep it
-+ * around if it's busy, but we'll know to do nothing with
-+ * its fields. We are under sysctl_lock here.
-+ */
-+ de->data = NULL;
-+
- /* Don't unregister proc entries that are still being used.. */
- if (atomic_read(&de->count))
- continue;
-@@ -719,31 +785,44 @@
- size_t count, loff_t *ppos)
- {
- int op;
-- struct proc_dir_entry *de;
-+ struct proc_dir_entry *de =
-+ (struct proc_dir_entry*) file->f_dentry->d_inode->u.generic_ip;
- struct ctl_table *table;
- size_t res;
-- ssize_t error;
--
-- de = (struct proc_dir_entry*) file->f_dentry->d_inode->u.generic_ip;
-- if (!de || !de->data)
-- return -ENOTDIR;
-- table = (struct ctl_table *) de->data;
-- if (!table || !table->proc_handler)
-- return -ENOTDIR;
-- op = (write ? 002 : 004);
-- if (ctl_perm(table, op))
-- return -EPERM;
--
-- res = count;
-+ ssize_t error = -ENOTDIR;
-
-- /*
-- * FIXME: we need to pass on ppos to the handler.
-- */
-+ spin_lock(&sysctl_lock);
-+ if (de && de->data && use_table(de->set)) {
-+ /*
-+ * at that point we know that sysctl was not unregistered
-+ * and won't be until we finish
-+ */
-+ spin_unlock(&sysctl_lock);
-+ table = (struct ctl_table *) de->data;
-+ if (!table || !table->proc_handler)
-+ goto out;
-+ error = -EPERM;
-+ op = (write ? 002 : 004);
-+ if (ctl_perm(table, op))
-+ goto out;
-+
-+ /* careful: calling conventions are nasty here */
-+ res = count;
-
-- error = (*table->proc_handler) (table, write, file, buf, &res);
-- if (error)
-- return error;
-- return res;
-+ /*
-+ * FIXME: we need to pass on ppos to the handler.
-+ */
-+
-+ error = (*table->proc_handler)(table, write, file,
-+ buf, &res);
-+ if (!error)
-+ error = res;
-+ out:
-+ spin_lock(&sysctl_lock);
-+ unuse_table(de->set);
-+ }
-+ spin_unlock(&sysctl_lock);
-+ return error;
- }
-
- static ssize_t proc_readsys(struct file * file, char * buf,
-diff -urN linux-2.4.30/lib/inflate.c linux-2.4.30-hf32.3/lib/inflate.c
---- linux-2.4.30/lib/inflate.c 2002-11-29 00:53:15.000000000 +0100
-+++ linux-2.4.30-hf32.3/lib/inflate.c 2006-03-18 00:34:06.000000000 +0100
-@@ -320,7 +320,7 @@
- {
- *t = (struct huft *)NULL;
- *m = 0;
-- return 0;
-+ return 2;
- }
-
- DEBG("huft2 ");
-@@ -368,6 +368,7 @@
- if ((j = *p++) != 0)
- v[x[j]++] = i;
- } while (++i < n);
-+ n = x[g]; /* set n to length of v */
-
- DEBG("h6 ");
-
-@@ -404,12 +405,13 @@
- DEBG1("2 ");
- f -= a + 1; /* deduct codes from patterns left */
- xp = c + k;
-- while (++j < z) /* try smaller tables up to z bits */
-- {
-- if ((f <<= 1) <= *++xp)
-- break; /* enough codes to use up j bits */
-- f -= *xp; /* else deduct codes from patterns */
-- }
-+ if (j < z)
-+ while (++j < z) /* try smaller tables up to z bits */
-+ {
-+ if ((f <<= 1) <= *++xp)
-+ break; /* enough codes to use up j bits */
-+ f -= *xp; /* else deduct codes from patterns */
-+ }
- }
- DEBG1("3 ");
- z = 1 << j; /* table entries for j-bit table */
-diff -urN linux-2.4.30/lib/rbtree.c linux-2.4.30-hf32.3/lib/rbtree.c
---- linux-2.4.30/lib/rbtree.c 2004-11-17 12:54:22.000000000 +0100
-+++ linux-2.4.30-hf32.3/lib/rbtree.c 2006-03-18 00:34:06.000000000 +0100
-@@ -332,6 +332,7 @@
- node = node->rb_right;
- while (node->rb_left)
- node = node->rb_left;
-+ return node;
- }
-
- /* No right-hand children. Everything down and left is
-@@ -355,6 +356,7 @@
- node = node->rb_left;
- while (node->rb_right)
- node = node->rb_right;
-+ return node;
- }
-
- /* No left-hand children. Go up till we find an ancestor which
-diff -urN linux-2.4.30/lib/rwsem-spinlock.c linux-2.4.30-hf32.3/lib/rwsem-spinlock.c
---- linux-2.4.30/lib/rwsem-spinlock.c 2005-01-27 18:57:34.000000000 +0100
-+++ linux-2.4.30-hf32.3/lib/rwsem-spinlock.c 2006-03-18 00:34:06.000000000 +0100
-@@ -127,12 +127,12 @@
-
- rwsemtrace(sem,"Entering __down_read");
-
-- spin_lock(&sem->wait_lock);
-+ spin_lock_irq(&sem->wait_lock);
-
- if (sem->activity>=0 && list_empty(&sem->wait_list)) {
- /* granted */
- sem->activity++;
-- spin_unlock(&sem->wait_lock);
-+ spin_unlock_irq(&sem->wait_lock);
- goto out;
- }
-
-@@ -147,7 +147,7 @@
- list_add_tail(&waiter.list,&sem->wait_list);
-
- /* we don't need to touch the semaphore struct anymore */
-- spin_unlock(&sem->wait_lock);
-+ spin_unlock_irq(&sem->wait_lock);
-
- /* wait to be given the lock */
- for (;;) {
-@@ -169,9 +169,10 @@
- int fastcall __down_read_trylock(struct rw_semaphore *sem)
- {
- int ret = 0;
-+ unsigned long flags;
- rwsemtrace(sem,"Entering __down_read_trylock");
-
-- spin_lock(&sem->wait_lock);
-+ spin_lock_irqsave(&sem->wait_lock, flags);
-
- if (sem->activity>=0 && list_empty(&sem->wait_list)) {
- /* granted */
-@@ -179,7 +180,7 @@
- ret = 1;
- }
-
-- spin_unlock(&sem->wait_lock);
-+ spin_unlock_irqrestore(&sem->wait_lock, flags);
-
- rwsemtrace(sem,"Leaving __down_read_trylock");
- return ret;
-@@ -196,12 +197,12 @@
-
- rwsemtrace(sem,"Entering __down_write");
-
-- spin_lock(&sem->wait_lock);
-+ spin_lock_irq(&sem->wait_lock);
-
- if (sem->activity==0 && list_empty(&sem->wait_list)) {
- /* granted */
- sem->activity = -1;
-- spin_unlock(&sem->wait_lock);
-+ spin_unlock_irq(&sem->wait_lock);
- goto out;
- }
-
-@@ -216,7 +217,7 @@
- list_add_tail(&waiter.list,&sem->wait_list);
-
- /* we don't need to touch the semaphore struct anymore */
-- spin_unlock(&sem->wait_lock);
-+ spin_unlock_irq(&sem->wait_lock);
-
- /* wait to be given the lock */
- for (;;) {
-@@ -238,9 +239,10 @@
- int fastcall __down_write_trylock(struct rw_semaphore *sem)
- {
- int ret = 0;
-+ unsigned long flags;
- rwsemtrace(sem,"Entering __down_write_trylock");
-
-- spin_lock(&sem->wait_lock);
-+ spin_lock_irqsave(&sem->wait_lock, flags);
-
- if (sem->activity==0 && list_empty(&sem->wait_list)) {
- /* granted */
-@@ -248,7 +250,7 @@
- ret = 1;
- }
-
-- spin_unlock(&sem->wait_lock);
-+ spin_unlock_irqrestore(&sem->wait_lock, flags);
-
- rwsemtrace(sem,"Leaving __down_write_trylock");
- return ret;
-@@ -259,14 +261,15 @@
- */
- void fastcall __up_read(struct rw_semaphore *sem)
- {
-+ unsigned long flags;
- rwsemtrace(sem,"Entering __up_read");
-
-- spin_lock(&sem->wait_lock);
-+ spin_lock_irqsave(&sem->wait_lock, flags);
-
- if (--sem->activity==0 && !list_empty(&sem->wait_list))
- sem = __rwsem_wake_one_writer(sem);
-
-- spin_unlock(&sem->wait_lock);
-+ spin_unlock_irqrestore(&sem->wait_lock, flags);
-
- rwsemtrace(sem,"Leaving __up_read");
- }
-@@ -276,15 +279,16 @@
- */
- void fastcall __up_write(struct rw_semaphore *sem)
- {
-+ unsigned long flags;
- rwsemtrace(sem,"Entering __up_write");
-
-- spin_lock(&sem->wait_lock);
-+ spin_lock_irqsave(&sem->wait_lock, flags);
-
- sem->activity = 0;
- if (!list_empty(&sem->wait_list))
- sem = __rwsem_do_wake(sem);
-
-- spin_unlock(&sem->wait_lock);
-+ spin_unlock_irqrestore(&sem->wait_lock, flags);
-
- rwsemtrace(sem,"Leaving __up_write");
- }
-diff -urN linux-2.4.30/lib/rwsem.c linux-2.4.30-hf32.3/lib/rwsem.c
---- linux-2.4.30/lib/rwsem.c 2004-11-17 12:54:22.000000000 +0100
-+++ linux-2.4.30-hf32.3/lib/rwsem.c 2006-03-18 00:34:06.000000000 +0100
-@@ -127,7 +127,7 @@
- set_task_state(tsk,TASK_UNINTERRUPTIBLE);
-
- /* set up my own style of waitqueue */
-- spin_lock(&sem->wait_lock);
-+ spin_lock_irq(&sem->wait_lock);
- waiter->task = tsk;
- get_task_struct(tsk);
-
-@@ -142,7 +142,7 @@
- if (!(count & RWSEM_ACTIVE_MASK))
- sem = __rwsem_do_wake(sem);
-
-- spin_unlock(&sem->wait_lock);
-+ spin_unlock_irq(&sem->wait_lock);
-
- /* wait to be given the lock */
- for (;;) {
-@@ -195,15 +195,16 @@
- */
- struct rw_semaphore fastcall *rwsem_wake(struct rw_semaphore *sem)
- {
-+ unsigned long flags;
- rwsemtrace(sem,"Entering rwsem_wake");
-
-- spin_lock(&sem->wait_lock);
-+ spin_lock_irqsave(&sem->wait_lock, flags);
-
- /* do nothing if list empty */
- if (!list_empty(&sem->wait_list))
- sem = __rwsem_do_wake(sem);
-
-- spin_unlock(&sem->wait_lock);
-+ spin_unlock_irqrestore(&sem->wait_lock, flags);
-
- rwsemtrace(sem,"Leaving rwsem_wake");
-
-diff -urN linux-2.4.30/mm/filemap.c linux-2.4.30-hf32.3/mm/filemap.c
---- linux-2.4.30/mm/filemap.c 2005-04-14 09:43:35.000000000 +0200
-+++ linux-2.4.30-hf32.3/mm/filemap.c 2006-03-18 00:34:06.000000000 +0100
-@@ -2605,6 +2605,8 @@
- end = vma->vm_end;
- end = ((end - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
-
-+ error = -EIO;
-+
- /* round to cluster boundaries if this isn't a "random" area. */
- if (!VM_RandomReadHint(vma)) {
- start = CLUSTER_OFFSET(start);
-diff -urN linux-2.4.30/mm/vmscan.c linux-2.4.30-hf32.3/mm/vmscan.c
---- linux-2.4.30/mm/vmscan.c 2005-01-27 18:57:34.000000000 +0100
-+++ linux-2.4.30-hf32.3/mm/vmscan.c 2006-03-18 00:34:06.000000000 +0100
-@@ -556,6 +556,7 @@
- continue;
-
- }
-+ smp_rmb();
- if (PageDirty(page)) {
- spin_unlock(&pagecache_lock);
- UnlockPage(page);
-diff -urN linux-2.4.30/net/core/rtnetlink.c linux-2.4.30-hf32.3/net/core/rtnetlink.c
---- linux-2.4.30/net/core/rtnetlink.c 2003-08-25 13:44:44.000000000 +0200
-+++ linux-2.4.30-hf32.3/net/core/rtnetlink.c 2006-03-18 00:34:06.000000000 +0100
-@@ -303,7 +303,7 @@
- return 0;
-
- family = ((struct rtgenmsg*)NLMSG_DATA(nlh))->rtgen_family;
-- if (family > NPROTO) {
-+ if (family >= NPROTO) {
- *errp = -EAFNOSUPPORT;
- return -1;
- }
-diff -urN linux-2.4.30/net/ipv4/af_inet.c linux-2.4.30-hf32.3/net/ipv4/af_inet.c
---- linux-2.4.30/net/ipv4/af_inet.c 2005-01-27 18:57:34.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv4/af_inet.c 2006-03-18 00:34:06.000000000 +0100
-@@ -724,6 +724,7 @@
- sin->sin_port = sk->sport;
- sin->sin_addr.s_addr = addr;
- }
-+ memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
- *uaddr_len = sizeof(*sin);
- return(0);
- }
-diff -urN linux-2.4.30/net/ipv4/igmp.c linux-2.4.30-hf32.3/net/ipv4/igmp.c
---- linux-2.4.30/net/ipv4/igmp.c 2005-01-27 18:57:34.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv4/igmp.c 2006-03-18 00:34:06.000000000 +0100
-@@ -876,6 +876,10 @@
- /* Is it our report looped back? */
- if (((struct rtable*)skb->dst)->key.iif == 0)
- break;
-+ /* don't rely on MC router hearing unicast reports */
-+ if (skb->pkt_type == PACKET_MULTICAST ||
-+ skb->pkt_type == PACKET_BROADCAST)
-+ igmp_heard_report(in_dev, ih->group);
- igmp_heard_report(in_dev, ih->group);
- break;
- case IGMP_PIM:
-@@ -1582,7 +1586,7 @@
- }
- pmc->sources = 0;
- pmc->sfmode = MCAST_EXCLUDE;
-- pmc->sfcount[MCAST_EXCLUDE] = 0;
-+ pmc->sfcount[MCAST_INCLUDE] = 0;
- pmc->sfcount[MCAST_EXCLUDE] = 1;
- }
-
-@@ -1876,8 +1880,11 @@
- sock_kfree_s(sk, newpsl, IP_SFLSIZE(newpsl->sl_max));
- goto done;
- }
-- } else
-- newpsl = 0;
-+ } else {
-+ newpsl = NULL;
-+ (void) ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
-+ msf->imsf_fmode, 0, NULL, 0);
-+ }
- psl = pmc->sflist;
- if (psl) {
- (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
-diff -urN linux-2.4.30/net/ipv4/inetpeer.c linux-2.4.30-hf32.3/net/ipv4/inetpeer.c
---- linux-2.4.30/net/ipv4/inetpeer.c 2001-10-01 18:19:56.000000000 +0200
-+++ linux-2.4.30-hf32.3/net/ipv4/inetpeer.c 2006-03-18 00:34:06.000000000 +0100
-@@ -445,9 +445,12 @@
- /* Trigger the timer after inet_peer_gc_mintime .. inet_peer_gc_maxtime
- * interval depending on the total number of entries (more entries,
- * less interval). */
-- peer_periodic_timer.expires = jiffies
-- + inet_peer_gc_maxtime
-- - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
-- peer_total / inet_peer_threshold * HZ;
-+ if (peer_total >= inet_peer_threshold)
-+ peer_periodic_timer.expires = jiffies + inet_peer_gc_mintime;
-+ else
-+ peer_periodic_timer.expires = jiffies
-+ + inet_peer_gc_maxtime
-+ - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
-+ peer_total / inet_peer_threshold * HZ;
- add_timer(&peer_periodic_timer);
- }
-diff -urN linux-2.4.30/net/ipv4/ipvs/ip_vs_conn.c linux-2.4.30-hf32.3/net/ipv4/ipvs/ip_vs_conn.c
---- linux-2.4.30/net/ipv4/ipvs/ip_vs_conn.c 2005-01-27 18:57:34.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv4/ipvs/ip_vs_conn.c 2006-03-18 00:34:06.000000000 +0100
-@@ -210,6 +210,7 @@
- cp = list_entry(e, struct ip_vs_conn, c_list);
- if (s_addr==cp->caddr && s_port==cp->cport &&
- d_port==cp->vport && d_addr==cp->vaddr &&
-+ ((!s_port) ^ (!(cp->flags & IP_VS_CONN_F_NO_CPORT))) &&
- protocol==cp->protocol) {
- /* HIT */
- atomic_inc(&cp->refcnt);
-@@ -241,6 +242,40 @@
- return cp;
- }
-
-+/* Get reference to connection template */
-+struct ip_vs_conn *ip_vs_ct_in_get
-+(int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port)
-+{
-+ unsigned hash;
-+ struct ip_vs_conn *cp;
-+
-+ hash = ip_vs_conn_hashkey(protocol, s_addr, s_port);
-+
-+ ct_read_lock(hash);
-+
-+ list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
-+ if (s_addr==cp->caddr && s_port==cp->cport &&
-+ d_port==cp->vport && d_addr==cp->vaddr &&
-+ cp->flags & IP_VS_CONN_F_TEMPLATE &&
-+ protocol==cp->protocol) {
-+ /* HIT */
-+ atomic_inc(&cp->refcnt);
-+ goto out;
-+ }
-+ }
-+ cp = NULL;
-+
-+ out:
-+ ct_read_unlock(hash);
-+
-+ IP_VS_DBG(7, "template lookup/in %s %u.%u.%u.%u:%d->%u.%u.%u.%u:%d %s\n",
-+ ip_vs_proto_name(protocol),
-+ NIPQUAD(s_addr), ntohs(s_port),
-+ NIPQUAD(d_addr), ntohs(d_port),
-+ cp?"hit":"not hit");
-+
-+ return cp;
-+}
-
- /*
- * Gets ip_vs_conn associated with supplied parameters in the ip_vs_conn_tab.
-@@ -1087,7 +1122,7 @@
-
- IP_VS_DBG(9, "Unbind-dest %s c:%u.%u.%u.%u:%d "
- "v:%u.%u.%u.%u:%d d:%u.%u.%u.%u:%d fwd:%c "
-- "s:%s flg:%X cnt:%d destcnt:%d",
-+ "s:%s flg:%X cnt:%d destcnt:%d\n",
- ip_vs_proto_name(cp->protocol),
- NIPQUAD(cp->caddr), ntohs(cp->cport),
- NIPQUAD(cp->vaddr), ntohs(cp->vport),
-@@ -1098,10 +1133,9 @@
-
- /*
- * Decrease the inactconns or activeconns counter
-- * if it is not a connection template ((cp->cport!=0)
-- * || (cp->flags & IP_VS_CONN_F_NO_CPORT)).
-+ * if it is not a connection template
- */
-- if (cp->cport || (cp->flags & IP_VS_CONN_F_NO_CPORT)) {
-+ if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) {
- if (cp->flags & IP_VS_CONN_F_INACTIVE) {
- atomic_dec(&dest->inactconns);
- } else {
-@@ -1145,7 +1179,7 @@
- /*
- * Invalidate the connection template
- */
-- if (ct->cport) {
-+ if (ct->vport != 65535) {
- if (ip_vs_conn_unhash(ct)) {
- ct->dport = 65535;
- ct->vport = 65535;
-@@ -1430,7 +1464,7 @@
- l = &ip_vs_conn_tab[hash];
- for (e=l->next; e!=l; e=e->next) {
- cp = list_entry(e, struct ip_vs_conn, c_list);
-- if (!cp->cport && !(cp->flags & IP_VS_CONN_F_NO_CPORT))
-+ if (cp->flags & IP_VS_CONN_F_TEMPLATE)
- /* connection template */
- continue;
- switch(cp->state) {
-diff -urN linux-2.4.30/net/ipv4/ipvs/ip_vs_core.c linux-2.4.30-hf32.3/net/ipv4/ipvs/ip_vs_core.c
---- linux-2.4.30/net/ipv4/ipvs/ip_vs_core.c 2005-04-14 09:43:35.000000000 +0200
-+++ linux-2.4.30-hf32.3/net/ipv4/ipvs/ip_vs_core.c 2006-03-18 00:34:06.000000000 +0100
-@@ -188,10 +188,10 @@
- if (portp[1] == svc->port) {
- /* Check if a template already exists */
- if (svc->port != FTPPORT)
-- ct = ip_vs_conn_in_get(iph->protocol, snet, 0,
-+ ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
- iph->daddr, portp[1]);
- else
-- ct = ip_vs_conn_in_get(iph->protocol, snet, 0,
-+ ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
- iph->daddr, 0);
-
- if (!ct || !ip_vs_check_template(ct)) {
-@@ -216,14 +216,14 @@
- snet, 0,
- iph->daddr, portp[1],
- dest->addr, dest->port,
-- 0,
-+ IP_VS_CONN_F_TEMPLATE,
- dest);
- else
- ct = ip_vs_conn_new(iph->protocol,
- snet, 0,
- iph->daddr, 0,
- dest->addr, 0,
-- 0,
-+ IP_VS_CONN_F_TEMPLATE,
- dest);
- if (ct == NULL)
- return NULL;
-@@ -242,10 +242,10 @@
- * port zero template: <protocol,caddr,0,vaddr,0,daddr,0>
- */
- if (svc->fwmark)
-- ct = ip_vs_conn_in_get(IPPROTO_IP, snet, 0,
-+ ct = ip_vs_ct_in_get(IPPROTO_IP, snet, 0,
- htonl(svc->fwmark), 0);
- else
-- ct = ip_vs_conn_in_get(iph->protocol, snet, 0,
-+ ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
- iph->daddr, 0);
-
- if (!ct || !ip_vs_check_template(ct)) {
-@@ -270,14 +270,14 @@
- snet, 0,
- htonl(svc->fwmark), 0,
- dest->addr, 0,
-- 0,
-+ IP_VS_CONN_F_TEMPLATE,
- dest);
- else
- ct = ip_vs_conn_new(iph->protocol,
- snet, 0,
- iph->daddr, 0,
- dest->addr, 0,
-- 0,
-+ IP_VS_CONN_F_TEMPLATE,
- dest);
- if (ct == NULL)
- return NULL;
-@@ -1111,11 +1111,10 @@
- if (sysctl_ip_vs_expire_nodest_conn) {
- /* try to expire the connection immediately */
- ip_vs_conn_expire_now(cp);
-- } else {
-- /* don't restart its timer, and silently
-- drop the packet. */
-- __ip_vs_conn_put(cp);
- }
-+ /* don't restart its timer, and silently
-+ drop the packet. */
-+ __ip_vs_conn_put(cp);
- return NF_DROP;
- }
-
-diff -urN linux-2.4.30/net/ipv4/ipvs/ip_vs_ctl.c linux-2.4.30-hf32.3/net/ipv4/ipvs/ip_vs_ctl.c
---- linux-2.4.30/net/ipv4/ipvs/ip_vs_ctl.c 2005-01-27 18:57:34.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv4/ipvs/ip_vs_ctl.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1842,7 +1842,8 @@
- entry.addr = svc->addr;
- entry.port = svc->port;
- entry.fwmark = svc->fwmark;
-- strcpy(entry.sched_name, svc->scheduler->name);
-+ strncpy(entry.sched_name, svc->scheduler->name, sizeof(entry.sched_name));
-+ entry.sched_name[sizeof(entry.sched_name) - 1] = 0;
- entry.flags = svc->flags;
- entry.timeout = svc->timeout / HZ;
- entry.netmask = svc->netmask;
-@@ -1866,7 +1867,8 @@
- entry.addr = svc->addr;
- entry.port = svc->port;
- entry.fwmark = svc->fwmark;
-- strcpy(entry.sched_name, svc->scheduler->name);
-+ strncpy(entry.sched_name, svc->scheduler->name, sizeof(entry.sched_name));
-+ entry.sched_name[sizeof(entry.sched_name) - 1] = 0;
- entry.flags = svc->flags;
- entry.timeout = svc->timeout / HZ;
- entry.netmask = svc->netmask;
-@@ -2020,7 +2022,8 @@
- svc = __ip_vs_service_get(get.protocol,
- get.addr, get.port);
- if (svc) {
-- strcpy(get.sched_name, svc->scheduler->name);
-+ strncpy(get.sched_name, svc->scheduler->name, sizeof(get.sched_name));
-+ get.sched_name[sizeof(get.sched_name) - 1] = 0;
- get.flags = svc->flags;
- get.timeout = svc->timeout / HZ;
- get.netmask = svc->netmask;
-@@ -2083,10 +2086,14 @@
- goto out;
- }
- u.state = ip_vs_sync_state;
-- if (ip_vs_sync_state & IP_VS_STATE_MASTER)
-- strcpy(u.mcast_master_ifn, ip_vs_mcast_master_ifn);
-- if (ip_vs_sync_state & IP_VS_STATE_BACKUP)
-- strcpy(u.mcast_backup_ifn, ip_vs_mcast_backup_ifn);
-+ if (ip_vs_sync_state & IP_VS_STATE_MASTER) {
-+ strncpy(u.mcast_master_ifn, ip_vs_mcast_master_ifn, sizeof(u.mcast_master_ifn));
-+ u.mcast_master_ifn[sizeof(u.mcast_master_ifn) - 1] = 0;
-+ }
-+ if (ip_vs_sync_state & IP_VS_STATE_BACKUP) {
-+ strncpy(u.mcast_backup_ifn, ip_vs_mcast_backup_ifn, sizeof(u.mcast_backup_ifn));
-+ u.mcast_backup_ifn[sizeof(u.mcast_backup_ifn) - 1] = 0;
-+ }
- if (copy_to_user(user, &u, sizeof(u)) != 0)
- ret = -EFAULT;
- }
-diff -urN linux-2.4.30/net/ipv4/ipvs/ip_vs_sched.c linux-2.4.30-hf32.3/net/ipv4/ipvs/ip_vs_sched.c
---- linux-2.4.30/net/ipv4/ipvs/ip_vs_sched.c 2004-04-14 15:05:41.000000000 +0200
-+++ linux-2.4.30-hf32.3/net/ipv4/ipvs/ip_vs_sched.c 2006-03-18 00:34:06.000000000 +0100
-@@ -156,7 +156,7 @@
- */
- if (sched == NULL) {
- char module_name[IP_VS_SCHEDNAME_MAXLEN+8];
-- sprintf(module_name,"ip_vs_%s", sched_name);
-+ snprintf(module_name, sizeof(module_name), "ip_vs_%s", sched_name);
- request_module(module_name);
- sched = ip_vs_sched_getbyname(sched_name);
- }
-diff -urN linux-2.4.30/net/ipv4/ipvs/ip_vs_sync.c linux-2.4.30-hf32.3/net/ipv4/ipvs/ip_vs_sync.c
---- linux-2.4.30/net/ipv4/ipvs/ip_vs_sync.c 2005-01-27 18:57:34.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv4/ipvs/ip_vs_sync.c 2006-03-18 00:34:06.000000000 +0100
-@@ -295,16 +295,24 @@
-
- p = (char *)buffer + sizeof(struct ip_vs_sync_mesg);
- for (i=0; i<m->nr_conns; i++) {
-+ unsigned flags;
-+
- s = (struct ip_vs_sync_conn *)p;
-- cp = ip_vs_conn_in_get(s->protocol,
-- s->caddr, s->cport,
-- s->vaddr, s->vport);
-+ flags = ntohs(s->flags);
-+ if (!(flags & IP_VS_CONN_F_TEMPLATE))
-+ cp = ip_vs_conn_in_get(s->protocol,
-+ s->caddr, s->cport,
-+ s->vaddr, s->vport);
-+ else
-+ cp = ip_vs_ct_in_get(s->protocol,
-+ s->caddr, s->cport,
-+ s->vaddr, s->vport);
- if (!cp) {
- cp = ip_vs_conn_new(s->protocol,
- s->caddr, s->cport,
- s->vaddr, s->vport,
- s->daddr, s->dport,
-- ntohs(s->flags), NULL);
-+ flags, NULL);
- if (!cp) {
- IP_VS_ERR("ip_vs_conn_new failed\n");
- return;
-@@ -313,11 +321,11 @@
- } else if (!cp->dest) {
- /* it is an entry created by the synchronization */
- cp->state = ntohs(s->state);
-- cp->flags = ntohs(s->flags) | IP_VS_CONN_F_HASHED;
-+ cp->flags = flags | IP_VS_CONN_F_HASHED;
- } /* Note that we don't touch its state and flags
- if it is a normal entry. */
-
-- if (ntohs(s->flags) & IP_VS_CONN_F_SEQ_MASK) {
-+ if (flags & IP_VS_CONN_F_SEQ_MASK) {
- opt = (struct ip_vs_sync_conn_options *)&s[1];
- memcpy(&cp->in_seq, opt, sizeof(*opt));
- p += FULL_CONN_SIZE;
-@@ -808,10 +816,12 @@
-
- ip_vs_sync_state |= state;
- if (state == IP_VS_STATE_MASTER) {
-- strcpy(ip_vs_mcast_master_ifn, mcast_ifn);
-+ strncpy(ip_vs_mcast_master_ifn, mcast_ifn, sizeof(ip_vs_mcast_master_ifn));
-+ ip_vs_mcast_master_ifn[sizeof(ip_vs_mcast_master_ifn) - 1] = 0;
- ip_vs_master_syncid = syncid;
- } else {
-- strcpy(ip_vs_mcast_backup_ifn, mcast_ifn);
-+ strncpy(ip_vs_mcast_backup_ifn, mcast_ifn, sizeof(ip_vs_mcast_backup_ifn));
-+ ip_vs_mcast_backup_ifn[sizeof(ip_vs_mcast_backup_ifn) - 1] = 0;
- ip_vs_backup_syncid = syncid;
- }
-
-diff -urN linux-2.4.30/net/ipv4/netfilter/ip_conntrack_core.c linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_conntrack_core.c
---- linux-2.4.30/net/ipv4/netfilter/ip_conntrack_core.c 2005-04-14 09:43:35.000000000 +0200
-+++ linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_conntrack_core.c 2006-03-18 00:34:06.000000000 +0100
-@@ -1349,6 +1349,7 @@
- .tuple.dst.u.tcp.port;
- sin.sin_addr.s_addr = h->ctrack->tuplehash[IP_CT_DIR_ORIGINAL]
- .tuple.dst.ip;
-+ memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
-
- DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
- NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));
-diff -urN linux-2.4.30/net/ipv4/netfilter/ip_nat_proto_tcp.c linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_nat_proto_tcp.c
---- linux-2.4.30/net/ipv4/netfilter/ip_nat_proto_tcp.c 2002-11-29 00:53:15.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_nat_proto_tcp.c 2006-03-18 00:34:06.000000000 +0100
-@@ -31,7 +31,8 @@
- enum ip_nat_manip_type maniptype,
- const struct ip_conntrack *conntrack)
- {
-- static u_int16_t port = 0, *portptr;
-+ static u_int16_t port = 0;
-+ u_int16_t *portptr;
- unsigned int range_size, min, i;
-
- if (maniptype == IP_NAT_MANIP_SRC)
-diff -urN linux-2.4.30/net/ipv4/netfilter/ip_nat_proto_udp.c linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_nat_proto_udp.c
---- linux-2.4.30/net/ipv4/netfilter/ip_nat_proto_udp.c 2000-08-04 22:07:24.000000000 +0200
-+++ linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_nat_proto_udp.c 2006-03-18 00:34:06.000000000 +0100
-@@ -32,7 +32,8 @@
- enum ip_nat_manip_type maniptype,
- const struct ip_conntrack *conntrack)
- {
-- static u_int16_t port = 0, *portptr;
-+ static u_int16_t port = 0;
-+ u_int16_t *portptr;
- unsigned int range_size, min, i;
-
- if (maniptype == IP_NAT_MANIP_SRC)
-diff -urN linux-2.4.30/net/ipv4/netfilter/ip_nat_rule.c linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_nat_rule.c
---- linux-2.4.30/net/ipv4/netfilter/ip_nat_rule.c 2005-01-27 18:57:34.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_nat_rule.c 2006-03-18 00:34:06.000000000 +0100
-@@ -241,6 +241,27 @@
- return ip_nat_setup_info(conntrack, &mr, hooknum);
- }
-
-+unsigned int
-+alloc_null_binding_confirmed(struct ip_conntrack *conntrack,
-+ struct ip_nat_info *info,
-+ unsigned int hooknum)
-+{
-+ u_int32_t ip
-+ = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
-+ ? conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip
-+ : conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip);
-+ u_int16_t all
-+ = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
-+ ? conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.all
-+ : conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.src.u.all);
-+ struct ip_nat_multi_range mr
-+ = { 1, { { IP_NAT_RANGE_MAP_IPS, ip, ip, { all }, { all } } } };
-+
-+ DEBUGP("Allocating NULL binding for confirmed %p (%u.%u.%u.%u)\n",
-+ conntrack, NIPQUAD(ip));
-+ return ip_nat_setup_info(conntrack, &mr, hooknum);
-+}
-+
- int ip_nat_rule_find(struct sk_buff **pskb,
- unsigned int hooknum,
- const struct net_device *in,
-diff -urN linux-2.4.30/net/ipv4/netfilter/ip_nat_standalone.c linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_nat_standalone.c
---- linux-2.4.30/net/ipv4/netfilter/ip_nat_standalone.c 2005-04-14 09:43:35.000000000 +0200
-+++ linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_nat_standalone.c 2006-03-18 00:34:06.000000000 +0100
-@@ -123,8 +123,12 @@
- ret = call_expect(master_ct(ct), pskb,
- hooknum, ct, info);
- } else {
-- /* LOCAL_IN hook doesn't have a chain! */
-- if (hooknum == NF_IP_LOCAL_IN)
-+ if (unlikely(is_confirmed(ct)))
-+ /* NAT module was loaded late */
-+ ret = alloc_null_binding_confirmed(ct, info,
-+ hooknum);
-+ else if (hooknum == NF_IP_LOCAL_IN)
-+ /* LOCAL_IN hook doesn't have a chain */
- ret = alloc_null_binding(ct, info,
- hooknum);
- else
-diff -urN linux-2.4.30/net/ipv4/netfilter/ip_queue.c linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_queue.c
---- linux-2.4.30/net/ipv4/netfilter/ip_queue.c 2004-02-18 14:36:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv4/netfilter/ip_queue.c 2006-03-18 00:34:06.000000000 +0100
-@@ -517,7 +517,7 @@
- write_unlock_bh(&queue_lock);
-
- status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-- skblen - NLMSG_LENGTH(0));
-+ nlmsglen - NLMSG_LENGTH(0));
- if (status < 0)
- RCV_SKB_FAIL(status);
-
-diff -urN linux-2.4.30/net/ipv4/netfilter/ipt_unclean.c linux-2.4.30-hf32.3/net/ipv4/netfilter/ipt_unclean.c
---- linux-2.4.30/net/ipv4/netfilter/ipt_unclean.c 2004-08-08 01:26:06.000000000 +0200
-+++ linux-2.4.30-hf32.3/net/ipv4/netfilter/ipt_unclean.c 2006-03-18 00:34:06.000000000 +0100
-@@ -264,6 +264,7 @@
- {
- [TH_SYN] = 1,
- [TH_SYN|TH_ACK] = 1,
-+ [TH_SYN|TH_ACK|TH_PUSH] = 1,
- [TH_RST] = 1,
- [TH_RST|TH_ACK] = 1,
- [TH_RST|TH_ACK|TH_PUSH] = 1,
-diff -urN linux-2.4.30/net/ipv4/tcp_input.c linux-2.4.30-hf32.3/net/ipv4/tcp_input.c
---- linux-2.4.30/net/ipv4/tcp_input.c 2005-04-14 09:43:35.000000000 +0200
-+++ linux-2.4.30-hf32.3/net/ipv4/tcp_input.c 2006-03-18 00:34:06.000000000 +0100
-@@ -374,8 +374,6 @@
- app_win -= tp->ack.rcv_mss;
- app_win = max(app_win, 2U*tp->advmss);
-
-- if (!ofo_win)
-- tp->window_clamp = min(tp->window_clamp, app_win);
- tp->rcv_ssthresh = min(tp->window_clamp, 2U*tp->advmss);
- }
- }
-@@ -2488,6 +2486,7 @@
- /* Note, it is the only place, where
- * fast path is recovered for sending TCP.
- */
-+ tp->pred_flags = 0;
- tcp_fast_path_check(sk, tp);
-
- if (nwin > tp->max_window) {
-@@ -4243,16 +4242,7 @@
- goto no_ack;
- }
-
-- if (eaten) {
-- if (tcp_in_quickack_mode(tp)) {
-- tcp_send_ack(sk);
-- } else {
-- tcp_send_delayed_ack(sk);
-- }
-- } else {
-- __tcp_ack_snd_check(sk, 0);
-- }
--
-+ __tcp_ack_snd_check(sk, 0);
- no_ack:
- if (eaten)
- __kfree_skb(skb);
-diff -urN linux-2.4.30/net/ipv6/addrconf.c linux-2.4.30-hf32.3/net/ipv6/addrconf.c
---- linux-2.4.30/net/ipv6/addrconf.c 2004-11-17 12:54:22.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv6/addrconf.c 2006-03-18 00:34:06.000000000 +0100
-@@ -883,7 +883,7 @@
- if (dev->type == ARPHRD_SIT && (dev->flags&IFF_POINTOPOINT))
- rtmsg.rtmsg_flags |= RTF_NONEXTHOP;
-
-- ip6_route_add(&rtmsg, NULL);
-+ ip6_route_add(&rtmsg, NULL, NULL);
- }
-
- /* Create "default" multicast route to the interface */
-@@ -900,7 +900,7 @@
- rtmsg.rtmsg_ifindex = dev->ifindex;
- rtmsg.rtmsg_flags = RTF_UP;
- rtmsg.rtmsg_type = RTMSG_NEWROUTE;
-- ip6_route_add(&rtmsg, NULL);
-+ ip6_route_add(&rtmsg, NULL, NULL);
- }
-
- static void sit_route_add(struct net_device *dev)
-@@ -917,7 +917,7 @@
- rtmsg.rtmsg_flags = RTF_UP|RTF_NONEXTHOP;
- rtmsg.rtmsg_ifindex = dev->ifindex;
-
-- ip6_route_add(&rtmsg, NULL);
-+ ip6_route_add(&rtmsg, NULL, NULL);
- }
-
- static void addrconf_add_lroute(struct net_device *dev)
-@@ -1009,7 +1009,7 @@
- if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
- if (rt->rt6i_flags&RTF_EXPIRES) {
- if (pinfo->onlink == 0 || valid_lft == 0) {
-- ip6_del_rt(rt, NULL);
-+ ip6_del_rt(rt, NULL, NULL);
- rt = NULL;
- } else {
- rt->rt6i_expires = rt_expires;
-@@ -1592,7 +1592,7 @@
-
- rtmsg.rtmsg_ifindex = ifp->idev->dev->ifindex;
-
-- ip6_route_add(&rtmsg, NULL);
-+ ip6_route_add(&rtmsg, NULL, NULL);
- }
-
- out:
-diff -urN linux-2.4.30/net/ipv6/ip6_fib.c linux-2.4.30-hf32.3/net/ipv6/ip6_fib.c
---- linux-2.4.30/net/ipv6/ip6_fib.c 2004-11-17 12:54:22.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv6/ip6_fib.c 2006-03-18 00:34:06.000000000 +0100
-@@ -424,7 +424,7 @@
- */
-
- static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
-- struct nlmsghdr *nlh)
-+ struct nlmsghdr *nlh, struct netlink_skb_parms *req)
- {
- struct rt6_info *iter = NULL;
- struct rt6_info **ins;
-@@ -482,7 +482,7 @@
- *ins = rt;
- rt->rt6i_node = fn;
- atomic_inc(&rt->rt6i_ref);
-- inet6_rt_notify(RTM_NEWROUTE, rt, nlh);
-+ inet6_rt_notify(RTM_NEWROUTE, rt, nlh, req);
- rt6_stats.fib_rt_entries++;
-
- if ((fn->fn_flags & RTN_RTINFO) == 0) {
-@@ -506,7 +506,8 @@
- * with source addr info in sub-trees
- */
-
--int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nlmsghdr *nlh)
-+int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nlmsghdr *nlh,
-+ struct netlink_skb_parms *req)
- {
- struct fib6_node *fn;
- int err = -ENOMEM;
-@@ -579,7 +580,7 @@
- }
- #endif
-
-- err = fib6_add_rt2node(fn, rt, nlh);
-+ err = fib6_add_rt2node(fn, rt, nlh, req);
-
- if (err == 0) {
- fib6_start_gc(rt);
-@@ -888,7 +889,7 @@
- }
-
- static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
-- struct nlmsghdr *nlh)
-+ struct nlmsghdr *nlh, struct netlink_skb_parms *req)
- {
- struct fib6_walker_t *w;
- struct rt6_info *rt = *rtp;
-@@ -943,11 +944,11 @@
- if (atomic_read(&rt->rt6i_ref) != 1) BUG();
- }
-
-- inet6_rt_notify(RTM_DELROUTE, rt, nlh);
-+ inet6_rt_notify(RTM_DELROUTE, rt, nlh, req);
- rt6_release(rt);
- }
-
--int fib6_del(struct rt6_info *rt, struct nlmsghdr *nlh)
-+int fib6_del(struct rt6_info *rt, struct nlmsghdr *nlh, struct netlink_skb_parms *req)
- {
- struct fib6_node *fn = rt->rt6i_node;
- struct rt6_info **rtp;
-@@ -972,7 +973,7 @@
-
- for (rtp = &fn->leaf; *rtp; rtp = &(*rtp)->u.next) {
- if (*rtp == rt) {
-- fib6_del_route(fn, rtp, nlh);
-+ fib6_del_route(fn, rtp, nlh, req);
- return 0;
- }
- }
-@@ -1101,7 +1102,7 @@
- res = c->func(rt, c->arg);
- if (res < 0) {
- w->leaf = rt;
-- res = fib6_del(rt, NULL);
-+ res = fib6_del(rt, NULL, NULL);
- if (res) {
- #if RT6_DEBUG >= 2
- printk(KERN_DEBUG "fib6_clean_node: del failed: rt=%p@%p err=%d\n", rt, rt->rt6i_node, res);
-diff -urN linux-2.4.30/net/ipv6/ip6_flowlabel.c linux-2.4.30-hf32.3/net/ipv6/ip6_flowlabel.c
---- linux-2.4.30/net/ipv6/ip6_flowlabel.c 2000-08-07 07:20:09.000000000 +0200
-+++ linux-2.4.30-hf32.3/net/ipv6/ip6_flowlabel.c 2006-03-18 00:34:06.000000000 +0100
-@@ -475,7 +475,7 @@
- goto done;
- }
- fl1 = sfl->fl;
-- atomic_inc(&fl->users);
-+ atomic_inc(&fl1->users);
- break;
- }
- }
-diff -urN linux-2.4.30/net/ipv6/mcast.c linux-2.4.30-hf32.3/net/ipv6/mcast.c
---- linux-2.4.30/net/ipv6/mcast.c 2005-01-27 18:57:34.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv6/mcast.c 2006-03-18 00:34:06.000000000 +0100
-@@ -505,8 +505,11 @@
- sock_kfree_s(sk, newpsl, IP6_SFLSIZE(newpsl->sl_max));
- goto done;
- }
-- } else
-- newpsl = 0;
-+ } else {
-+ newpsl = NULL;
-+ (void) ip6_mc_add_src(idev, group, gsf->gf_fmode, 0, NULL, 0);
-+ }
-+
- psl = pmc->sflist;
- if (psl) {
- (void) ip6_mc_del_src(idev, group, pmc->sfmode,
-@@ -1142,6 +1145,11 @@
- if (skb->pkt_type == PACKET_LOOPBACK)
- return 0;
-
-+ /* send our report if the MC router may not have heard this report */
-+ if (skb->pkt_type != PACKET_MULTICAST &&
-+ skb->pkt_type != PACKET_BROADCAST)
-+ return 0;
-+
- if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
- return -EINVAL;
-
-@@ -1867,7 +1875,7 @@
- }
- pmc->mca_sources = 0;
- pmc->mca_sfmode = MCAST_EXCLUDE;
-- pmc->mca_sfcount[MCAST_EXCLUDE] = 0;
-+ pmc->mca_sfcount[MCAST_INCLUDE] = 0;
- pmc->mca_sfcount[MCAST_EXCLUDE] = 1;
- }
-
-diff -urN linux-2.4.30/net/ipv6/ndisc.c linux-2.4.30-hf32.3/net/ipv6/ndisc.c
---- linux-2.4.30/net/ipv6/ndisc.c 2004-11-17 12:54:22.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv6/ndisc.c 2006-03-18 00:34:06.000000000 +0100
-@@ -876,7 +876,7 @@
- /* It is safe only because
- we aer in BH */
- dst_release(&rt->u.dst);
-- ip6_del_rt(rt, NULL);
-+ ip6_del_rt(rt, NULL, NULL);
- }
- }
- } else {
-@@ -962,7 +962,7 @@
- rt = rt6_get_dflt_router(&skb->nh.ipv6h->saddr, skb->dev);
-
- if (rt && lifetime == 0) {
-- ip6_del_rt(rt, NULL);
-+ ip6_del_rt(rt, NULL, NULL);
- rt = NULL;
- }
-
-diff -urN linux-2.4.30/net/ipv6/netfilter/ip6_queue.c linux-2.4.30-hf32.3/net/ipv6/netfilter/ip6_queue.c
---- linux-2.4.30/net/ipv6/netfilter/ip6_queue.c 2004-02-18 14:36:32.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv6/netfilter/ip6_queue.c 2006-03-18 00:34:06.000000000 +0100
-@@ -521,7 +521,7 @@
- write_unlock_bh(&queue_lock);
-
- status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-- skblen - NLMSG_LENGTH(0));
-+ nlmsglen - NLMSG_LENGTH(0));
- if (status < 0)
- RCV_SKB_FAIL(status);
-
-diff -urN linux-2.4.30/net/ipv6/route.c linux-2.4.30-hf32.3/net/ipv6/route.c
---- linux-2.4.30/net/ipv6/route.c 2004-11-17 12:54:22.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv6/route.c 2006-03-18 00:34:06.000000000 +0100
-@@ -325,12 +325,12 @@
- be destroyed.
- */
-
--static int rt6_ins(struct rt6_info *rt, struct nlmsghdr *nlh)
-+static int rt6_ins(struct rt6_info *rt, struct nlmsghdr *nlh, struct netlink_skb_parms *req)
- {
- int err;
-
- write_lock_bh(&rt6_lock);
-- err = fib6_add(&ip6_routing_table, rt, nlh);
-+ err = fib6_add(&ip6_routing_table, rt, nlh, req);
- write_unlock_bh(&rt6_lock);
-
- return err;
-@@ -341,7 +341,7 @@
- */
-
- static struct rt6_info *rt6_cow(struct rt6_info *ort, struct in6_addr *daddr,
-- struct in6_addr *saddr)
-+ struct in6_addr *saddr, struct netlink_skb_parms *req)
- {
- int err;
- struct rt6_info *rt;
-@@ -373,7 +373,7 @@
-
- dst_hold(&rt->u.dst);
-
-- err = rt6_ins(rt, NULL);
-+ err = rt6_ins(rt, NULL, req);
- if (err == 0)
- return rt;
-
-@@ -479,7 +479,8 @@
- read_unlock_bh(&rt6_lock);
-
- rt = rt6_cow(rt, &skb->nh.ipv6h->daddr,
-- &skb->nh.ipv6h->saddr);
-+ &skb->nh.ipv6h->saddr,
-+ &NETLINK_CB(skb));
-
- if (rt->u.dst.error != -EEXIST || --attempts <= 0)
- goto out2;
-@@ -558,7 +559,7 @@
- read_unlock_bh(&rt6_lock);
-
- rt = rt6_cow(rt, fl->nl_u.ip6_u.daddr,
-- fl->nl_u.ip6_u.saddr);
-+ fl->nl_u.ip6_u.saddr, NULL);
-
- if (rt->u.dst.error != -EEXIST || --attempts <= 0)
- goto out2;
-@@ -619,7 +620,7 @@
-
- if (rt) {
- if (rt->rt6i_flags & RTF_CACHE)
-- ip6_del_rt(rt, NULL);
-+ ip6_del_rt(rt, NULL, NULL);
- else
- dst_release(dst);
- }
-@@ -712,7 +713,7 @@
- *
- */
-
--int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh)
-+int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, struct netlink_skb_parms *req)
- {
- int err;
- struct rtmsg *r;
-@@ -865,7 +866,7 @@
- if (rt->u.dst.advmss > 65535-20)
- rt->u.dst.advmss = 65535;
- rt->u.dst.dev = dev;
-- return rt6_ins(rt, nlh);
-+ return rt6_ins(rt, nlh, req);
-
- out:
- if (dev)
-@@ -874,7 +875,7 @@
- return err;
- }
-
--int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh)
-+int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, struct netlink_skb_parms *req)
- {
- int err;
-
-@@ -886,13 +887,13 @@
-
- dst_release(&rt->u.dst);
-
-- err = fib6_del(rt, nlh);
-+ err = fib6_del(rt, nlh, req);
- write_unlock_bh(&rt6_lock);
-
- return err;
- }
-
--int ip6_route_del(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh)
-+int ip6_route_del(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, struct netlink_skb_parms *req)
- {
- struct fib6_node *fn;
- struct rt6_info *rt;
-@@ -919,7 +920,7 @@
- dst_hold(&rt->u.dst);
- read_unlock_bh(&rt6_lock);
-
-- return ip6_del_rt(rt, nlh);
-+ return ip6_del_rt(rt, nlh, req);
- }
- }
- read_unlock_bh(&rt6_lock);
-@@ -1021,11 +1022,11 @@
- rt->u.dst.advmss = 65535;
- nrt->rt6i_hoplimit = ipv6_get_hoplimit(neigh->dev);
-
-- if (rt6_ins(nrt, NULL))
-+ if (rt6_ins(nrt, NULL, NULL))
- goto out;
-
- if (rt->rt6i_flags&RTF_CACHE) {
-- ip6_del_rt(rt, NULL);
-+ ip6_del_rt(rt, NULL, NULL);
- return;
- }
-
-@@ -1087,7 +1088,7 @@
- 2. It is gatewayed route or NONEXTHOP route. Action: clone it.
- */
- if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP)) {
-- nrt = rt6_cow(rt, daddr, saddr);
-+ nrt = rt6_cow(rt, daddr, saddr, NULL);
- if (!nrt->u.dst.error) {
- nrt->u.dst.pmtu = pmtu;
- /* According to RFC 1981, detecting PMTU increase shouldn't be
-@@ -1111,7 +1112,7 @@
- dst_set_expires(&nrt->u.dst, ip6_rt_mtu_expires);
- nrt->rt6i_flags |= RTF_DYNAMIC|RTF_CACHE|RTF_EXPIRES;
- nrt->u.dst.pmtu = pmtu;
-- rt6_ins(nrt, NULL);
-+ rt6_ins(nrt, NULL, NULL);
- }
-
- out:
-@@ -1184,7 +1185,7 @@
-
- rtmsg.rtmsg_ifindex = dev->ifindex;
-
-- ip6_route_add(&rtmsg, NULL);
-+ ip6_route_add(&rtmsg, NULL, NULL);
- return rt6_get_dflt_router(gwaddr, dev);
- }
-
-@@ -1210,7 +1211,7 @@
-
- read_unlock_bh(&rt6_lock);
-
-- ip6_del_rt(rt, NULL);
-+ ip6_del_rt(rt, NULL, NULL);
-
- goto restart;
- }
-@@ -1236,10 +1237,10 @@
- rtnl_lock();
- switch (cmd) {
- case SIOCADDRT:
-- err = ip6_route_add(&rtmsg, NULL);
-+ err = ip6_route_add(&rtmsg, NULL, NULL);
- break;
- case SIOCDELRT:
-- err = ip6_route_del(&rtmsg, NULL);
-+ err = ip6_route_del(&rtmsg, NULL, NULL);
- break;
- default:
- err = -EINVAL;
-@@ -1296,7 +1297,7 @@
-
- ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
- rt->rt6i_dst.plen = 128;
-- rt6_ins(rt, NULL);
-+ rt6_ins(rt, NULL, NULL);
-
- return 0;
- }
-@@ -1313,7 +1314,7 @@
- rt = rt6_lookup(addr, NULL, loopback_dev.ifindex, 1);
- if (rt) {
- if (rt->rt6i_dst.plen == 128)
-- err = ip6_del_rt(rt, NULL);
-+ err = ip6_del_rt(rt, NULL, NULL);
- else
- dst_release(&rt->u.dst);
- }
-@@ -1429,7 +1430,7 @@
-
- nrt->rt6i_flags |= RTF_CACHE;
- dst_hold(&nrt->u.dst);
-- err = rt6_ins(nrt, NULL);
-+ err = rt6_ins(nrt, NULL, NULL);
- if (err)
- nrt->u.dst.error = err;
- return nrt;
-@@ -1556,7 +1557,7 @@
-
- if (inet6_rtm_to_rtmsg(r, arg, &rtmsg))
- return -EINVAL;
-- return ip6_route_del(&rtmsg, nlh);
-+ return ip6_route_del(&rtmsg, nlh, &NETLINK_CB(skb));
- }
-
- int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
-@@ -1566,7 +1567,7 @@
-
- if (inet6_rtm_to_rtmsg(r, arg, &rtmsg))
- return -EINVAL;
-- return ip6_route_add(&rtmsg, nlh);
-+ return ip6_route_add(&rtmsg, nlh, &NETLINK_CB(skb));
- }
-
- struct rt6_rtnl_dump_arg
-@@ -1576,11 +1577,8 @@
- };
-
- static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
-- struct in6_addr *dst,
-- struct in6_addr *src,
-- int iif,
-- int type, u32 pid, u32 seq,
-- struct nlmsghdr *in_nlh, int prefix)
-+ struct in6_addr *dst, struct in6_addr *src,
-+ int iif, int type, u32 pid, u32 seq, int prefix)
- {
- struct rtmsg *rtm;
- struct nlmsghdr *nlh;
-@@ -1593,9 +1591,6 @@
- return 1;
- }
- }
-- if (!pid && in_nlh) {
-- pid = in_nlh->nlmsg_pid;
-- }
-
- nlh = NLMSG_PUT(skb, pid, seq, type, sizeof(*rtm));
- rtm = NLMSG_DATA(nlh);
-@@ -1683,7 +1678,7 @@
-
- return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
- NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,
-- NULL, prefix);
-+ prefix);
- }
-
- static int fib6_dump_node(struct fib6_walker_t *w)
-@@ -1834,7 +1829,7 @@
- fl.nl_u.ip6_u.saddr,
- iif,
- RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
-- nlh->nlmsg_seq, nlh, 0);
-+ nlh->nlmsg_seq, 0);
- if (err < 0) {
- err = -EMSGSIZE;
- goto out_free;
-@@ -1850,17 +1845,25 @@
- goto out;
- }
-
--void inet6_rt_notify(int event, struct rt6_info *rt, struct nlmsghdr *nlh)
-+void inet6_rt_notify(int event, struct rt6_info *rt, struct nlmsghdr *nlh,
-+ struct netlink_skb_parms *req)
- {
- struct sk_buff *skb;
- int size = NLMSG_SPACE(sizeof(struct rtmsg)+256);
-+ u32 pid = current->pid;
-+ u32 seq = 0;
-+
-+ if (req)
-+ pid = req->pid;
-+ if (nlh)
-+ seq = nlh->nlmsg_seq;
-
- skb = alloc_skb(size, gfp_any());
- if (!skb) {
- netlink_set_err(rtnl, 0, RTMGRP_IPV6_ROUTE, ENOBUFS);
- return;
- }
-- if (rt6_fill_node(skb, rt, NULL, NULL, 0, event, 0, 0, nlh, 0) < 0) {
-+ if (rt6_fill_node(skb, rt, NULL, NULL, 0, event, pid, seq, 0) < 0) {
- kfree_skb(skb);
- netlink_set_err(rtnl, 0, RTMGRP_IPV6_ROUTE, EINVAL);
- return;
-diff -urN linux-2.4.30/net/ipv6/udp.c linux-2.4.30-hf32.3/net/ipv6/udp.c
---- linux-2.4.30/net/ipv6/udp.c 2004-11-17 12:54:22.000000000 +0100
-+++ linux-2.4.30-hf32.3/net/ipv6/udp.c 2006-03-18 00:34:06.000000000 +0100
-@@ -89,7 +89,7 @@
- next:;
- }
- result = best;
-- for(;; result += UDP_HTABLE_SIZE) {
-+ for(i = 0; i < (1 << 16) / UDP_HTABLE_SIZE; i++, result += UDP_HTABLE_SIZE) {
- if (result > sysctl_local_port_range[1])
- result = sysctl_local_port_range[0]
- + ((result - sysctl_local_port_range[0]) &
-@@ -97,6 +97,8 @@
- if (!udp_lport_inuse(result))
- break;
- }
-+ if (i >= (1 << 16) / UDP_HTABLE_SIZE)
-+ goto fail;
- gotit:
- udp_port_rover = snum = result;
- } else {
-diff -urN linux-2.4.30/net/netlink/af_netlink.c linux-2.4.30-hf32.3/net/netlink/af_netlink.c
---- linux-2.4.30/net/netlink/af_netlink.c 2005-04-14 09:43:35.000000000 +0200
-+++ linux-2.4.30-hf32.3/net/netlink/af_netlink.c 2006-03-18 00:34:06.000000000 +0100
-@@ -330,9 +330,9 @@
- u32 pid = nlk_sk(sk)->pid;
-
- netlink_table_grab();
-- hash->entries--;
- for (skp = nl_pid_hashfn(hash, pid); *skp; skp = &((*skp)->next)) {
- if (*skp == sk) {
-+ hash->entries--;
- *skp = sk->next;
- __sock_put(sk);
- break;
-@@ -450,7 +450,12 @@
- err = netlink_insert(sk, pid);
- if (err == -EADDRINUSE)
- goto retry;
-- return 0;
-+
-+ /* If 2 threads race to autobind, that is fine. */
-+ if (err == -EBUSY)
-+ err = 0;
-+
-+ return err;
- }
-
- static inline int netlink_capable(struct socket *sock, unsigned int flag)
projects / openwrt / svn-archive / openwrt.git / blobdiff