Import 1.2.13

diff --git a/Makefile b/Makefile
index 5532940c07baa6286ee5fc01265c58f56a83bb00..7986118738de1a853faa855a5d134b932655572a 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 1
 PATCHLEVEL = 2
-SUBLEVEL = 12
+SUBLEVEL = 13
 
 ARCH = i386
 

diff --git a/drivers/net/ppp.c b/drivers/net/ppp.c
index 52ef880decf6c81118f40198eda35eb6e2feb348..dfaf74eaf543752ee137b354025f5a2f380cda0e 100644 (file)
--- a/drivers/net/ppp.c
+++ b/drivers/net/ppp.c
@@ -1262,6 +1262,12 @@ ppp_read(struct tty_struct *tty, struct file *file, unsigned char *buf, unsigned
         } else goto wait;
       }
 
+      i = verify_area (VERIFY_WRITE,buf,nr);
+      if (i != 0) {
+       ppp->us_rbuff_lock = 0;
+       return i;
+      }
+
       /* reset the time of the last read operation */
       ppp->ddinfo.nip_rjiffies = jiffies;
 
@@ -1303,6 +1309,12 @@ ppp_read(struct tty_struct *tty, struct file *file, unsigned char *buf, unsigned
     current->timeout = 0;
     PRINTKN (3,(KERN_DEBUG "ppp_read: sleeping\n"));
     interruptible_sleep_on (&ppp->read_wait);
+
+    /* Ensure that the ppp device is still attached. */
+    ppp = ppp_find(tty);
+    if (!ppp || ppp->magic != PPP_MAGIC || !ppp->inuse)
+      return 0;
+      
     if (current->signal & ~current->blocked)
       return -EINTR;
   } while (1);
@@ -1354,6 +1366,10 @@ ppp_write(struct tty_struct *tty, struct file *file, unsigned char *buf, unsigne
     nr = ppp->mtu;
   }
 
+  i = verify_area (VERIFY_READ,buf,nr);
+  if (i != 0)
+    return i;
+
   if (ppp_debug >= 3)
     ppp_print_buffer ("write frame", buf, nr, USER_DS);
 
@@ -1363,6 +1379,12 @@ ppp_write(struct tty_struct *tty, struct file *file, unsigned char *buf, unsigne
     current->timeout = 0;
     PRINTKN (3,(KERN_DEBUG "ppp_write: sleeping\n"));
     interruptible_sleep_on(&ppp->write_wait);
+
+    /* Ensure that the ppp device is still attached. */
+    ppp = ppp_find(tty);
+    if (!ppp || ppp->magic != PPP_MAGIC || !ppp->inuse)
+      return 0;
+
     if (current->signal & ~current->blocked)
       return -EINTR;
   }

diff --git a/fs/block_dev.c b/fs/block_dev.c
index 9d54d03c7d7d782ef5d033e6582e13261a6f163d..ead4f9c8a3bb64ca990cc7e55a12a250983480f3 100644 (file)
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -197,6 +197,9 @@ int block_read(struct inode * inode, struct file * filp, char * buf, int count)
 
        if (offset > size)
                left = 0;
+       /* size - offset might not fit into left, so check explicitly. */
+       else if (size - offset > INT_MAX)
+               left = INT_MAX;
        else
                left = size - offset;
        if (left > count)

diff --git a/fs/hpfs/hpfs_fs.c b/fs/hpfs/hpfs_fs.c
index 13ad5ae327db36a99305afa083ca59dea5095974..c2b61a0aa6677e1ff9d6b27f000de7fed5d34a22 100644 (file)
--- a/fs/hpfs/hpfs_fs.c
+++ b/fs/hpfs/hpfs_fs.c
@@ -1297,7 +1297,7 @@ static struct hpfs_dirent *map_dirent(struct inode *inode, dnode_secno dno,
        /*
         * name not found.
         */
-
+       brelse4(qbh);
        return 0;
 }
 

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 1a19e8a731eabee3744f2a58396ae7d8c801120a..93c53d32bf07d85eda014005b8029e2094e0f057 100644 (file)
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -248,7 +248,7 @@ static void nfs_lookup_cache_add(struct inode *dir, const char *filename,
        entry->fhandle = *fhandle;
        entry->fattr = *fattr;
        entry->expiration_date = jiffies + (S_ISDIR(fattr->mode)
-               ? NFS_SERVER(dir)->acdirmax : NFS_SERVER(dir)->acregmax);
+               ? NFS_SERVER(dir)->acdirmin : NFS_SERVER(dir)->acregmin);
 }
 
 static void nfs_lookup_cache_remove(struct inode *dir, struct inode *inode,

diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 70e9a74b5ae44d20a08b64facdc8b0a68a9f9703..0e295e60982fb3204ba6b7f1901d431757a52a2f 100644 (file)
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -194,10 +194,9 @@ void proc_read_inode(struct inode * inode)
                return;
        }
        ino &= 0x0000ffff;
-       if (ino == PROC_PID_INO ||
-           (p->dumpable && p->uid == p->euid && p->gid == p->egid)) {
-               inode->i_uid = p->uid;
-               inode->i_gid = p->gid;
+       if (ino == PROC_PID_INO || p->dumpable) {
+               inode->i_uid = p->euid;
+               inode->i_gid = p->egid;
        }
        switch (ino) {
                case PROC_PID_INO: