]> git.neil.brown.name Git - history.git/commitdiff
Linux 2.2.23-rc1 2.2.23-rc1
authorAlan Cox <alan@lxorguk.ukuu.org.uk>
Fri, 23 Nov 2007 20:24:28 +0000 (15:24 -0500)
committerAlan Cox <alan@lxorguk.ukuu.org.uk>
Fri, 23 Nov 2007 20:24:28 +0000 (15:24 -0500)
o       Gameport support for ALi 5451                   (Pascal Schmidt)
        | Just missing PCI idents
o       IP options IPOPT_END padding fix                (Jeff DeFouw)
o       Make APM check more paranoid                    (Solar Designer)
o       Sanity check ixj requests as in 2.4             (Solar Designer)
o       Fix printk warning in fat                       (Solar Designer)
o       Fix other print warnings in 2.2.22              (Solar Designer)
o       Backport NT iret denial of service bugfix    (Marc-Christian Petersen)
o       ISDN multichannel ppp locking fix               (Herbert Xu)
o       Fix sx driver compiled into kernel case         (Martin Pool)
o       Backport ipfw sleep in spinlock in firewall     (James Morris)
o       Update dmi_scan code to match 2.4/2.5           (Jean Delvare)
o       Make agp debugging printk clearer               (Neale Banks)

13 files changed:
Documentation/Configure.help
Makefile
arch/i386/kernel/apm.c
arch/i386/kernel/dmi_scan.c
drivers/char/agp/agpgart_fe.c
drivers/char/joystick/Config.in
drivers/char/joystick/joy-pci.c
drivers/isdn/isdn_ppp.c
drivers/telephony/ixj.c
fs/fat/misc.c
include/linux/kernel.h
init/main.c
net/ipv4/ip_options.c

index c9233437116242663ddf56a18ea941bcb33e8602..3f506a0c25d68e5c41dadfe5ecba93e2ab9081e5 100644 (file)
@@ -11678,12 +11678,13 @@ CONFIG_JOY_LIGHTNING
   joystick or gamepad connected to it. For more information on how to
   use the driver please read Documentation/joystick.txt
 
-Trident 4DWave and Aureal Vortex gameport
+Trident 4DWave/Aureal Vortex/ALi 5451 gameport
 CONFIG_JOY_PCI
   Say Y here if you have a Trident 4DWave DX/NX or Aureal Vortex 1/2
-  card and want to use its gameport in its enhanced digital mode
-  with and ordinary analog joystick. For more information on how to
-  use the driver please read Documentation/joystick.txt
+  card or an ALi 5451 chip on your motherboard and want to use its
+  gameport in its enhanced digital mode with an ordinary analog
+  joystick. For more information on how to use the driver please read
+  Documentation/joystick.txt
 
 Magellan and Space Mouse
 CONFIG_JOY_MAGELLAN
index 008a61d089d74b0b3093e50a03c67dc211ddc786..a9b794b32918281b4c7bbdc56097e1830818f933 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 2
-SUBLEVEL = 22
-EXTRAVERSION = 
+SUBLEVEL = 23
+EXTRAVERSION = -rc1
 
 ARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ -e s/arm.*/arm/ -e s/sa110/arm/)
 
index 0959b9e6f7b07bd165bdecccdb0035f15c54bb37..c1e91544f3492182a491d4acd27ab757ecb0b55a 100644 (file)
@@ -1072,7 +1072,7 @@ static ssize_t do_read(struct file *fp, char *buf, size_t count, loff_t *ppos)
        as = fp->private_data;
        if (check_apm_user(as, "read"))
                return -EIO;
-       if ((int)count < sizeof(apm_event_t))
+       if (count < sizeof(apm_event_t) || count > INT_MAX)
                return -EINVAL;
        if (queue_empty(as)) {
                if (fp->f_flags & O_NONBLOCK)
index e9f725b03b8887b5f00ca6e377f8390f6c7eef86..1ed9fb7cd57d9dd7198f20b26fe99c9d1c818220 100644 (file)
@@ -15,9 +15,11 @@ struct dmi_header
 static char * __init dmi_string(struct dmi_header *dm, u8 s)
 {
        u8 *bp=(u8 *)dm;
+       if(!s)
+               return "";
        bp+=dm->length;
        s--;
-       while(s>0)
+       while(s>0 && *bp)
        {
                bp+=strlen(bp);
                bp++;
@@ -31,24 +33,26 @@ static int __init dmi_table(u32 base, int len, int num, void (*decode)(struct dm
        u8 *buf;
        struct dmi_header *dm;
        u8 *data;
-       int i=1;
-       int last = 0;           
+       int i=0;
                
        buf = ioremap(base, len);
        if(buf==NULL)
                return -1;
 
        data = buf;
-       while(i<num && (data-buf) < len)
+       while(i<num && data-buf+sizeof(struct dmi_header)<=len)
        {
                dm=(struct dmi_header *)data;
-               if(dm->type < last)
-                       break;
-               last = dm->type;
-               decode(dm);             
+               /*
+                *  We want to know the total length (formated area and strings)
+                *  before decoding to make sure we won't run off the table in
+                *  dmi_decode or dmi_string
+                */
                data+=dm->length;
-               while(*data || data[1])
+               while(data-buf<len-1 && (data[0] || data[1]))
                        data++;
+               if(data-buf<len-1)
+                       decode(dm);
                data+=2;
                i++;
        }
@@ -57,33 +61,48 @@ static int __init dmi_table(u32 base, int len, int num, void (*decode)(struct dm
 }
 
 
+inline int __init dmi_checksum(u8 *buf)
+{
+       u8 sum=0;
+       int a;
+       
+       for(a=0; a<15; a++)
+               sum+=buf[a];
+       return (sum==0);
+}
+
 int __init dmi_iterate(void (*decode)(struct dmi_header *))
 {
-       unsigned char buf[20];
-       long fp=0xE0000L;
-       fp -= 16;
+       u8 buf[15];
+       u32 fp=0xF0000;
        
        while( fp < 0xFFFFF)
        {
-               fp+=16;
-               memcpy_fromio(buf, fp, 20);
-               if(memcmp(buf, "_DMI_", 5)==0)
+               memcpy_fromio(buf, fp, 15);
+               if(memcmp(buf, "_DMI_", 5)==0 && dmi_checksum(buf))
                {
                        u16 num=buf[13]<<8|buf[12];
                        u16 len=buf[7]<<8|buf[6];
                        u32 base=buf[11]<<24|buf[10]<<16|buf[9]<<8|buf[8];
 #ifdef DUMP_DMI
-                       printk(KERN_INFO "DMI %d.%d present.\n",
-                               buf[14]>>4, buf[14]&0x0F);
+                       /*
+                        * DMI version 0.0 means that the real version is taken from
+                        * the SMBIOS version, which we don't know at this point.
+                        */
+                       if(buf[14]!=0)
+                               printk(KERN_INFO "DMI %u.%u present.\n",
+                                       buf[14]>>4, buf[14]&0x0F);
+                       else
+                               printk(KERN_INFO "DMI present.\n");
                        printk(KERN_INFO "%d structures occupying %d bytes.\n",
-                               buf[13]<<8|buf[12],
-                               buf[7]<<8|buf[6]);
+                               num, len);
                        printk(KERN_INFO "DMI table at 0x%08X.\n",
-                               buf[11]<<24|buf[10]<<16|buf[9]<<8|buf[8]);
+                               base);
 #endif                         
                        if(dmi_table(base,len, num, decode)==0)
                                return 0;
                }
+               fp+=16;
        }
        return -1;
 }
@@ -98,21 +117,17 @@ int __init dmi_iterate(void (*decode)(struct dmi_header *))
 static void __init dmi_decode(struct dmi_header *dm)
 {
        u8 *data = (u8 *)dm;
-       char *p;
        
        switch(dm->type)
        {
                case  0:                
 #ifdef DUMP_DMI
-                       p=dmi_string(dm,data[4]);
-                       if(*p && *p!=' ')
-                       {
-                               printk("BIOS Vendor: %s\n", p);
-                               printk("BIOS Version: %s\n", 
-                                       dmi_string(dm, data[5]));
-                               printk("BIOS Release: %s\n",
-                                       dmi_string(dm, data[8]));
-                       }
+                       printk("BIOS Vendor: %s\n",
+                               dmi_string(dm, data[4]));
+                       printk("BIOS Version: %s\n", 
+                               dmi_string(dm, data[5]));
+                       printk("BIOS Release: %s\n",
+                               dmi_string(dm, data[8]));
 #endif                         
                        /*
                         *  Check for clue free BIOS implementations who use
@@ -142,35 +157,22 @@ static void __init dmi_decode(struct dmi_header *dm)
                        break;
 #ifdef DUMP_DMI
                case 1:
-                       p=dmi_string(dm,data[4]);
-
-                       if(*p && *p!=' ')
-                       {
-                               printk("System Vendor: %s.\n",p);
-                               printk("Product Name: %s.\n",
-                                       dmi_string(dm, data[5]));
-                               printk("Version %s.\n",
-                                       dmi_string(dm, data[6]));
-                               printk("Serial Number %s.\n",
-                                       dmi_string(dm, data[7]));
-                       }
+                       printk("System Vendor: %s\n",
+                               dmi_string(dm, data[4]));
+                       printk("Product Name: %s\n",
+                               dmi_string(dm, data[5]));
+                       printk("Version: %s\n",
+                               dmi_string(dm, data[6]));
+                       printk("Serial Number: %s\n",
+                               dmi_string(dm, data[7]));
                        break;
                case 2:
-                       p=dmi_string(dm,data[4]);
-
-                       if(*p && *p!=' ')
-                       {
-                               printk("Board Vendor: %s.\n",p);
-                               printk("Board Name: %s.\n",
+                       printk("Board Vendor: %s\n",
+                               dmi_string(dm, data[4]));
+                       printk("Board Name: %s\n",
                                dmi_string(dm, data[5]));
-                               printk("Board Version: %s.\n",
-                                       dmi_string(dm, data[6]));
-                       }
-                       break;
-               case 3:
-                       p=dmi_string(dm,data[8]);
-                       if(*p && *p!=' ')
-                               printk("Asset Tag: %s.\n", p);
+                       printk("Board Version: %s\n",
+                               dmi_string(dm, data[6]));
                        break;
 #endif                 
        }
index b7181051ddc563ab732027bbeb28ec786ab8f237..138dd159b3b9d7b2de207c2e655eb8039f1e6648 100644 (file)
@@ -300,7 +300,7 @@ static agp_memory *agp_allocate_memory_wrap(size_t pg_count, u32 type)
        agp_memory *memory;
 
        memory = agp_allocate_memory(pg_count, type);
-       printk(KERN_DEBUG "memory : %p\n", memory);
+       printk(KERN_DEBUG "agp_allocate_memory: %p\n", memory);
        if (memory == NULL) {
                return NULL;
        }
index 3e371744e4128381576582ee54d0cecf08751411..259134bb7a4424487e52f63c907458bfb19f766f 100644 (file)
@@ -16,7 +16,7 @@ if [ "$CONFIG_JOYSTICK" != "n" ]; then
    dep_tristate '  ThrustMaster DirectConnect' CONFIG_JOY_THRUSTMASTER $CONFIG_JOYSTICK
    dep_tristate '  Creative Labs Blaster' CONFIG_JOY_CREATIVE $CONFIG_JOYSTICK
    dep_tristate '  PDPI Lightning 4 card' CONFIG_JOY_LIGHTNING $CONFIG_JOYSTICK
-   dep_tristate '  Trident 4DWave and Aureal Vortex gameport' CONFIG_JOY_PCI $CONFIG_JOYSTICK
+   dep_tristate '  Trident 4DWave/Aureal Vortex/ALi 5451 gameport' CONFIG_JOY_PCI $CONFIG_JOYSTICK
    dep_tristate '  Magellan and Space Mouse' CONFIG_JOY_MAGELLAN $CONFIG_JOYSTICK
    dep_tristate '  SpaceTec SpaceOrb 360 and SpaceBall Avenger' CONFIG_JOY_SPACEORB $CONFIG_JOYSTICK
    dep_tristate '  SpaceTec SpaceBall 4000 FLX' CONFIG_JOY_SPACEBALL $CONFIG_JOYSTICK
index 3e0301a3b23a9b62f1b8690f1ae9246d9b2cf300..662cfb4764cac2b5dae07a859f57f8952fd731aa 100644 (file)
@@ -129,6 +129,8 @@ static struct js_pci_data js_pci_data[] =
        js_pci_vortex_init, js_pci_vortex_cleanup, "Aureal Vortex1" },
  { PCI_VENDOR_ID_AUREAL,  0x0002, 0x40000, 0x2a00c, 0x2880c, 0x28808, 0x28810, 4, 0x1fff,
        js_pci_vortex_init, js_pci_vortex_cleanup, "Aureal Vortex2" },
+ { PCI_VENDOR_ID_AL,      0x5451, 0x10000, 0x00044, 0x00030, 0x00031, 0x00034, 2, 0xffff,
+       js_pci_4dwave_init, js_pci_4dwave_cleanup, "ALi 5451" },
  { 0, 0, 0, 0, 0, 0, 0, 0, 0, NULL, NULL }};
 
 /*
index a12c328b62d76f5f967f5a32a4c7626dff199a0a..3cb319f52c05ac96a31a12a8397ca1d3f617a974 100644 (file)
@@ -1148,7 +1148,7 @@ isdn_ppp_xmit(struct sk_buff *skb, struct device *netdev)
        if (slot < 0 || slot > ISDN_MAX_CHANNELS) {
                printk(KERN_ERR "isdn_ppp_xmit: lp->ppp_slot %d\n", lp->ppp_slot);
                kfree_skb(skb);
-               return 0;
+               goto unlock;
        }
        ipt = ippp_table[slot];
        lp->huptimer = 0;
index 9781b068f769ca4da790e13d4eb9757a73f0d3e4..ece752ace15f355cb09018c123ca1e1f497e1cd7 100644 (file)
@@ -4472,7 +4472,9 @@ static int ixj_build_cadence(int board, IXJ_CADENCE * cp)
        lcp = kmalloc(sizeof(IXJ_CADENCE), GFP_KERNEL);
        if (lcp == NULL)
                return -ENOMEM;
-       if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)))
+       if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) ||
+           lcp->elements_used < 0 ||
+           lcp->elements_used > INT_MAX / sizeof(IXJ_CADENCE_ELEMENT))
        {
                kfree(lcp);
                return -EFAULT;
index 9d2c25d6da53a6a97fbc7ec141990b1906a4c033..5f22d5ca54deebebff139af00f9df306e09ccc22 100644 (file)
@@ -366,7 +366,8 @@ int fat__get_entry(struct inode *dir, loff_t *pos,struct buffer_head **bh,
                        return -1; /* beyond EOF */
                *pos += sizeof(struct msdos_dir_entry);
                if (!(*bh = fat_bread(sb, sector))) {
-                       printk("Directory sread (sector 0x%x) failed\n",sector);
+                       printk("Directory sread (sector 0x%lx) failed\n",
+                               (unsigned long)sector);
                        continue;
                }
                break;
index 0f14098055a7f1d4afeddc4096d6e80779dd89ed..2b9329e3f1e1f179cb4f3db2c44a572a2bb4223b 100644 (file)
@@ -49,8 +49,12 @@ NORET_TYPE void do_exit(long error_code)
 extern unsigned long simple_strtoul(const char *,char **,unsigned int);
 extern long simple_strtol(const char *,char **,unsigned int);
 extern char *get_options(char *str, int *ints);
-extern int sprintf(char * buf, const char * fmt, ...);
-extern int vsprintf(char *buf, const char *, va_list);
+extern int sprintf(char *buf, const char *fmt, ...)
+       __attribute__ ((format (printf, 2, 3)));
+extern int vsprintf(char *buf, const char *, va_list)
+       __attribute__ ((format (printf, 2, 0)));
+extern int _vsnprintf(char *buf, int n, const char *, va_list)
+       __attribute__ ((format (printf, 3, 0)));
 
 extern int session_of_pgrp(int pgrp);
 
index 23b0ffa4fa1129ff1aad7fa210668b6270614c3f..72a12cec5775c508f4bc1825b19a3b3d3869da57 100644 (file)
@@ -995,7 +995,7 @@ static struct kernel_param cooked_params[] __initdata = {
        { "soundmodem=", sm_setup },
 #endif
 #ifdef CONFIG_COMPUTONE
-       { "ip2=", ip2_setup };
+       { "ip2=", ip2_setup },
 #endif
 #ifdef CONFIG_WDT
        { "wdt=", wdt_setup },
index a3d1f0aa0139cf574266278a8b72f1563ffca66e..a7369ec88530b04a0d3b976300006531dd5a6a24 100644 (file)
@@ -266,7 +266,7 @@ int ip_options_compile(struct ip_options * opt, struct sk_buff * skb)
        for (l = opt->optlen; l > 0; ) {
                switch (*optptr) {
                      case IPOPT_END:
-                       for (optptr++, l--; l>0; l--) {
+                       for (optptr++, l--; l>0; optptr++, l--) {
                                if (*optptr != IPOPT_END) {
                                        *optptr = IPOPT_END;
                                        opt->is_changed = 1;