2.2.22-rc3

o 3ware IDE raid small update (Adam Radford)
o Fix incorrect comments (Solar Designer)
o Sanity check in isdn (Solar Designer)
o Type fixes for usb (Solar Designer)
o Vmalloc corner case fix (Dave Miller)

diff --git a/Makefile b/Makefile
index cf1de6125b2c06a95413ce4aa7c968293ce8b971..8226e28db811455d764995cdac7761908928c2b7 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 2
 SUBLEVEL = 22
-EXTRAVERSION = rc2
+EXTRAVERSION = rc3
 
 ARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ -e s/arm.*/arm/ -e s/sa110/arm/)
 

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index a404fcab33b730a8cb9934a68899d3c6b84804a2..28fbc964da85f209751701c4f11041e5097d4096 100644 (file)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -334,8 +334,9 @@ static int create_missing_block(struct loop_device *lo, int block, int blksize)
        set_fs(old_fs);
 
        if (retval < 0) {
-               printk(KERN_WARNING "loop: cannot create block - FS write failed: code %d\n", 
-                                                                       retval);
+               printk(KERN_WARNING
+                   "loop: cannot create block - FS write failed: code %d\n",
+                   (int)retval);
                return FALSE;
        } else {
                return TRUE;

diff --git a/drivers/isdn/isdn_common.c b/drivers/isdn/isdn_common.c
index f2e51e6a6ac617506c744dd042d14b50be5f7111..de2a4b6bf9be09be9de3a66b47ac843dc9ed6e2f 100644 (file)
--- a/drivers/isdn/isdn_common.c
+++ b/drivers/isdn/isdn_common.c
@@ -1008,6 +1008,10 @@ isdn_read(struct file *file, char *buf, size_t count, loff_t * off)
                        goto out;
                }
                chidx = isdn_minor2chan(minor);
+               if (count > 131072) {
+                       retval = -EINVAL;
+                       goto out;
+               }
                if (!(p = kmalloc(count, GFP_KERNEL))) {
                        retval = -ENOMEM;
                        goto out;

diff --git a/drivers/sbus/char/openprom.c b/drivers/sbus/char/openprom.c
index 2befabe5cd531ed0429a3a263431c1a599f74eba..0b371013f3eb384c8cd8fddf8b07e13811230755 100644 (file)
--- a/drivers/sbus/char/openprom.c
+++ b/drivers/sbus/char/openprom.c
@@ -75,7 +75,7 @@ static int copyin(struct openpromio *info, struct openpromio **opp_p)
 
        get_user_ret(bufsize, &info->oprom_size, -EFAULT);
 
-       if (bufsize <= 0 || bufsize > OPROMMAXPARAM)
+       if (bufsize == 0 || bufsize > OPROMMAXPARAM)
                return -EINVAL;
 
        if (!(*opp_p = kmalloc(sizeof(int) + bufsize + 1, GFP_KERNEL)))

diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index 48d9845026a214f3b3bdddd4bd1eb1d36d150f30..95e546f24d757163936a708d0fbd477d6145f81e 100644 (file)
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -139,6 +139,11 @@
    1.02.00.024 - Fix bug in raw command post with data ioctl method.
                  Fix bug where rollcall sometimes failed with cable errors.
    1.02.00.025 - Print unit # on all command timeouts.
+   1.02.00.026 - Fix possible infinite retry bug with power glitch induced
+                 drive timeouts.
+                 Cleanup some AEN severity levels.
+   1.02.00.027 - Add drive not supported AEN code for SATA controllers.
+                 Remove spurious unknown ioctl error message.
 */
 
 #include <linux/module.h>
@@ -194,7 +199,7 @@ struct proc_dir_entry tw_scsi_proc_entry = {
 };
 
 /* Globals */
-char *tw_driver_version="1.02.00.025";
+char *tw_driver_version="1.02.00.027";
 TW_Device_Extension *tw_device_extension_list[TW_MAX_SLOT];
 int tw_device_extension_count = 0;
 
@@ -205,7 +210,7 @@ int tw_aen_complete(TW_Device_Extension *tw_dev, int request_id)
 {
        TW_Param *param;
        unsigned short aen;
-       int error = 0;
+       int error = 0, table_max = 0;
 
        if (tw_dev->alignment_virtual_address[request_id] == NULL) {
                printk(KERN_WARNING "3w-xxxx: tw_aen_complete(): Bad alignment virtual address.\n");
@@ -219,7 +224,8 @@ int tw_aen_complete(TW_Device_Extension *tw_dev, int request_id)
        if (aen == 0x0ff) {
                printk(KERN_WARNING "3w-xxxx: scsi%d: AEN: INFO: AEN queue overflow.\n", tw_dev->host->host_no);
        } else {
-               if ((aen & 0x0ff) < TW_AEN_STRING_MAX) {
+               table_max = sizeof(tw_aen_string)/sizeof(char *);
+               if ((aen & 0x0ff) < table_max) {
                        if ((tw_aen_string[aen & 0xff][strlen(tw_aen_string[aen & 0xff])-1]) == '#') {
                                printk(KERN_WARNING "3w-xxxx: scsi%d: AEN: %s%d.\n", tw_dev->host->host_no, tw_aen_string[aen & 0xff], aen >> 8);
                        } else {
@@ -281,7 +287,7 @@ int tw_aen_drain_queue(TW_Device_Extension *tw_dev)
        int first_reset = 0;
        int queue = 0;
        int imax, i;
-       int found = 0;
+       int found = 0, table_max = 0;
 
        dprintk(KERN_NOTICE "3w-xxxx: tw_aen_drain_queue()\n");
 
@@ -401,7 +407,8 @@ int tw_aen_drain_queue(TW_Device_Extension *tw_dev)
                                                if (aen == 0x0ff) {
                                                        printk(KERN_WARNING "3w-xxxx: AEN: INFO: AEN queue overflow.\n");
                                                } else {
-                                                       if ((aen & 0x0ff) < TW_AEN_STRING_MAX) {
+                                                       table_max = sizeof(tw_aen_string)/sizeof(char *);
+                                                       if ((aen & 0x0ff) < table_max) {
                                                                if ((tw_aen_string[aen & 0xff][strlen(tw_aen_string[aen & 0xff])-1]) == '#') {
                                                                        printk(KERN_WARNING "3w-xxxx: AEN: %s%d.\n", tw_aen_string[aen & 0xff], aen >> 8);
                                                                } else {
@@ -1527,7 +1534,8 @@ static void tw_interrupt(int irq, void *dev_instance, struct pt_regs *regs)
 
                                        /* If error, command failed */
                                        if (error == 1) {
-                                               tw_dev->srb[request_id]->result = (DID_RESET << 16);
+                                               /* Ask for a host reset */
+                                               tw_dev->srb[request_id]->result = (DID_OK << 16) | (CHECK_CONDITION << 1);
                                        }
                                        
                                        /* Now complete the io */
@@ -1866,7 +1874,7 @@ int tw_ioctl(TW_Device_Extension *tw_dev, int request_id)
                                return 1;
                        }
                default:
-                       printk(KERN_WARNING "3w-xxxx: Unknown ioctl 0x%x.\n", opcode);
+                       dprintk(KERN_WARNING "3w-xxxx: Unknown ioctl 0x%x.\n", opcode);
                        tw_dev->state[request_id] = TW_S_COMPLETED;
                        tw_state_request_finish(tw_dev, request_id);
                        tw_dev->srb[request_id]->result = (DID_OK << 16);

diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h
index 1ec3eca513eb53b3853b809d36c1a7f8e01aea15..8d55cb3315a57ed89ce2c0bb2a1564053dadf450 100644 (file)
--- a/drivers/scsi/3w-xxxx.h
+++ b/drivers/scsi/3w-xxxx.h
@@ -91,14 +91,13 @@ static char *tw_aen_string[] = {
        "INFO: Verify started: Unit #",                // 0x029
        "ERROR: Verify failed: Port #",                // 0x02A
        "INFO: Verify complete: Unit #",               // 0x02B
-       "ERROR: Overwrote bad sector during rebuild: Port #",   //0x02C
-       "ERROR: Encountered bad sector during rebuild: Port #", //0x02D
-       "INFO: Replacement drive is too small: Port #",         //0x02E
-       "WARNING: Verify error: Unit not previously initialized: Unit #" //0x02F
+       "WARNING: Overwrote bad sector during rebuild: Port #",  //0x02C
+       "ERROR: Encountered bad sector during rebuild: Port #",  //0x02D
+       "ERROR: Replacement drive is too small: Port #",         //0x02E
+       "WARNING: Verify error: Unit not previously initialized: Unit #", //0x02F
+       "ERROR: Drive not supported: Port #"           // 0x030
 };
 
-#define TW_AEN_STRING_MAX                      0x030
-
 /*
    Sense key lookup table
    Format: ESDC/flags,SenseKey,AdditionalSenseCode,AdditionalSenseCodeQualifier

diff --git a/drivers/usb/mdc800.c b/drivers/usb/mdc800.c
index aaae2689f19decada86f027e10f51ec286790f3e..4c53147862cf9aaa74bf09f65ff4de383d30eb04 100644 (file)
--- a/drivers/usb/mdc800.c
+++ b/drivers/usb/mdc800.c
@@ -634,7 +634,7 @@ static int mdc800_device_release (struct inode* inode, struct file *file)
  */
 static ssize_t mdc800_device_read (struct file *file, char *buf, size_t len, loff_t *pos)
 {
-       int   left=len, sts=len; /* single transfer size */
+       size_t left=len, sts=len; /* single transfer size */
        char* ptr=buf;
 
        spin_lock (&mdc800->io_lock);
@@ -719,7 +719,7 @@ static ssize_t mdc800_device_read (struct file *file, char *buf, size_t len, lof
  */
 static ssize_t mdc800_device_write (struct file *file, const char *buf, size_t len, loff_t *pos)
 {
-       int i=0;
+       size_t i=0;
 
        spin_lock (&mdc800->io_lock);
        if (mdc800->state != READY)

diff --git a/drivers/usb/printer.c b/drivers/usb/printer.c
index bf2b6ec8b1b611fed78a93da4ce9ed47cefefa24..2d3fc17bfcaebf71a8093171c1e8a1b88f3f469f 100644 (file)
--- a/drivers/usb/printer.c
+++ b/drivers/usb/printer.c
@@ -324,7 +324,8 @@ static int usblp_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 static ssize_t usblp_write(struct file *file, const char *buffer, size_t count, loff_t *ppos)
 {
        struct usblp *usblp = file->private_data;
-       int timeout, err = 0, writecount = 0;
+       int timeout, err = 0;
+       size_t writecount = 0;
 
        while (writecount < count) {
 

diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index f2ab31cb5a0d28e46d9789468d858c4bc5a94430..a62acf9bd51471cdaec48e1792f3389aff8ceda5 100644 (file)
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -432,7 +432,7 @@ nfs_readpage_result(struct rpc_task *task)
                nfs_list_remove_request(req);
 
                if (task->tk_status >= 0) {
-                       char *p = page_address(page);
+                       char *p = (char *)page_address(page);
                        if (count < PAGE_CACHE_SIZE) {
                                memset(p + count, 0, PAGE_CACHE_SIZE - count);
                                count = 0;

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 5a32418906dcaa7d08199628ebf023b247a3e93c..658594e3fdb733696693e755651a3f32b1d0eb13 100644 (file)
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -160,6 +160,10 @@ struct vm_struct * get_vm_area(unsigned long size)
        if (!area)
                return NULL;
        size += PAGE_SIZE;
+       if (!size) {
+               kfree(area);
+               return NULL;
+       }
        addr = VMALLOC_START;
        for (p = &vmlist; (tmp = *p) ; p = &tmp->next) {
                if ((size + addr) < addr) {

diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 488330912e9b89a10bef03b433b97b7c057bf06e..566a1d5eddda3193df279c7f0af67bf6ae7a9d33 100644 (file)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -266,10 +266,10 @@ svc_sendto(struct svc_rqst *rqstp, struct iovec *iov, int nr)
        set_fs(oldfs);
 #endif
 
-       dprintk("svc: socket %p sendto([%p %d... ], %d, %d) = %d\n",
-                       rqstp->rq_sock,
-                       iov[0].iov_base, iov[0].iov_len, nr,
-                       buflen, len);
+       dprintk("svc: socket %p sendto([%p %lu... ], %d, %d) = %d\n",
+               rqstp->rq_sock,
+               iov[0].iov_base, (unsigned long)iov[0].iov_len, nr,
+               buflen, len);
 
        return len;
 }
@@ -326,8 +326,9 @@ svc_recvfrom(struct svc_rqst *rqstp, struct iovec *iov, int nr, int buflen)
        set_fs(oldfs);
 #endif
 
-       dprintk("svc: socket %p recvfrom(%p, %d) = %d\n", rqstp->rq_sock,
-                               iov[0].iov_base, iov[0].iov_len, len);
+       dprintk("svc: socket %p recvfrom(%p, %lu) = %d\n", rqstp->rq_sock,
+               iov[0].iov_base, (unsigned long)iov[0].iov_len,
+               len);
 
        return len;
 }