From: Alan Cox Date: Fri, 23 Nov 2007 20:24:28 +0000 (-0500) Subject: Linux 2.2.23-rc1 X-Git-Tag: 2.2.23-rc1 X-Git-Url: http://git.neil.brown.name/?a=commitdiff_plain;h=3289ca724f399755c2ceee7ceac06e81eb93f262;p=history.git Linux 2.2.23-rc1 o Gameport support for ALi 5451 (Pascal Schmidt) | Just missing PCI idents o IP options IPOPT_END padding fix (Jeff DeFouw) o Make APM check more paranoid (Solar Designer) o Sanity check ixj requests as in 2.4 (Solar Designer) o Fix printk warning in fat (Solar Designer) o Fix other print warnings in 2.2.22 (Solar Designer) o Backport NT iret denial of service bugfix (Marc-Christian Petersen) o ISDN multichannel ppp locking fix (Herbert Xu) o Fix sx driver compiled into kernel case (Martin Pool) o Backport ipfw sleep in spinlock in firewall (James Morris) o Update dmi_scan code to match 2.4/2.5 (Jean Delvare) o Make agp debugging printk clearer (Neale Banks) --- diff --git a/Documentation/Configure.help b/Documentation/Configure.help index c92334371162..3f506a0c25d6 100644 --- a/Documentation/Configure.help +++ b/Documentation/Configure.help @@ -11678,12 +11678,13 @@ CONFIG_JOY_LIGHTNING joystick or gamepad connected to it. For more information on how to use the driver please read Documentation/joystick.txt -Trident 4DWave and Aureal Vortex gameport +Trident 4DWave/Aureal Vortex/ALi 5451 gameport CONFIG_JOY_PCI Say Y here if you have a Trident 4DWave DX/NX or Aureal Vortex 1/2 - card and want to use its gameport in its enhanced digital mode - with and ordinary analog joystick. For more information on how to - use the driver please read Documentation/joystick.txt + card or an ALi 5451 chip on your motherboard and want to use its + gameport in its enhanced digital mode with an ordinary analog + joystick. For more information on how to use the driver please read + Documentation/joystick.txt Magellan and Space Mouse CONFIG_JOY_MAGELLAN diff --git a/Makefile b/Makefile index 008a61d089d7..a9b794b32918 100644 --- a/Makefile +++ b/Makefile @@ -1,7 +1,7 @@ VERSION = 2 PATCHLEVEL = 2 -SUBLEVEL = 22 -EXTRAVERSION = +SUBLEVEL = 23 +EXTRAVERSION = -rc1 ARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ -e s/arm.*/arm/ -e s/sa110/arm/) diff --git a/arch/i386/kernel/apm.c b/arch/i386/kernel/apm.c index 0959b9e6f7b0..c1e91544f349 100644 --- a/arch/i386/kernel/apm.c +++ b/arch/i386/kernel/apm.c @@ -1072,7 +1072,7 @@ static ssize_t do_read(struct file *fp, char *buf, size_t count, loff_t *ppos) as = fp->private_data; if (check_apm_user(as, "read")) return -EIO; - if ((int)count < sizeof(apm_event_t)) + if (count < sizeof(apm_event_t) || count > INT_MAX) return -EINVAL; if (queue_empty(as)) { if (fp->f_flags & O_NONBLOCK) diff --git a/arch/i386/kernel/dmi_scan.c b/arch/i386/kernel/dmi_scan.c index e9f725b03b88..1ed9fb7cd57d 100644 --- a/arch/i386/kernel/dmi_scan.c +++ b/arch/i386/kernel/dmi_scan.c @@ -15,9 +15,11 @@ struct dmi_header static char * __init dmi_string(struct dmi_header *dm, u8 s) { u8 *bp=(u8 *)dm; + if(!s) + return ""; bp+=dm->length; s--; - while(s>0) + while(s>0 && *bp) { bp+=strlen(bp); bp++; @@ -31,24 +33,26 @@ static int __init dmi_table(u32 base, int len, int num, void (*decode)(struct dm u8 *buf; struct dmi_header *dm; u8 *data; - int i=1; - int last = 0; + int i=0; buf = ioremap(base, len); if(buf==NULL) return -1; data = buf; - while(itype < last) - break; - last = dm->type; - decode(dm); + /* + * We want to know the total length (formated area and strings) + * before decoding to make sure we won't run off the table in + * dmi_decode or dmi_string + */ data+=dm->length; - while(*data || data[1]) + while(data-buf>4, buf[14]&0x0F); + /* + * DMI version 0.0 means that the real version is taken from + * the SMBIOS version, which we don't know at this point. + */ + if(buf[14]!=0) + printk(KERN_INFO "DMI %u.%u present.\n", + buf[14]>>4, buf[14]&0x0F); + else + printk(KERN_INFO "DMI present.\n"); printk(KERN_INFO "%d structures occupying %d bytes.\n", - buf[13]<<8|buf[12], - buf[7]<<8|buf[6]); + num, len); printk(KERN_INFO "DMI table at 0x%08X.\n", - buf[11]<<24|buf[10]<<16|buf[9]<<8|buf[8]); + base); #endif if(dmi_table(base,len, num, decode)==0) return 0; } + fp+=16; } return -1; } @@ -98,21 +117,17 @@ int __init dmi_iterate(void (*decode)(struct dmi_header *)) static void __init dmi_decode(struct dmi_header *dm) { u8 *data = (u8 *)dm; - char *p; switch(dm->type) { case 0: #ifdef DUMP_DMI - p=dmi_string(dm,data[4]); - if(*p && *p!=' ') - { - printk("BIOS Vendor: %s\n", p); - printk("BIOS Version: %s\n", - dmi_string(dm, data[5])); - printk("BIOS Release: %s\n", - dmi_string(dm, data[8])); - } + printk("BIOS Vendor: %s\n", + dmi_string(dm, data[4])); + printk("BIOS Version: %s\n", + dmi_string(dm, data[5])); + printk("BIOS Release: %s\n", + dmi_string(dm, data[8])); #endif /* * Check for clue free BIOS implementations who use @@ -142,35 +157,22 @@ static void __init dmi_decode(struct dmi_header *dm) break; #ifdef DUMP_DMI case 1: - p=dmi_string(dm,data[4]); - - if(*p && *p!=' ') - { - printk("System Vendor: %s.\n",p); - printk("Product Name: %s.\n", - dmi_string(dm, data[5])); - printk("Version %s.\n", - dmi_string(dm, data[6])); - printk("Serial Number %s.\n", - dmi_string(dm, data[7])); - } + printk("System Vendor: %s\n", + dmi_string(dm, data[4])); + printk("Product Name: %s\n", + dmi_string(dm, data[5])); + printk("Version: %s\n", + dmi_string(dm, data[6])); + printk("Serial Number: %s\n", + dmi_string(dm, data[7])); break; case 2: - p=dmi_string(dm,data[4]); - - if(*p && *p!=' ') - { - printk("Board Vendor: %s.\n",p); - printk("Board Name: %s.\n", + printk("Board Vendor: %s\n", + dmi_string(dm, data[4])); + printk("Board Name: %s\n", dmi_string(dm, data[5])); - printk("Board Version: %s.\n", - dmi_string(dm, data[6])); - } - break; - case 3: - p=dmi_string(dm,data[8]); - if(*p && *p!=' ') - printk("Asset Tag: %s.\n", p); + printk("Board Version: %s\n", + dmi_string(dm, data[6])); break; #endif } diff --git a/drivers/char/agp/agpgart_fe.c b/drivers/char/agp/agpgart_fe.c index b7181051ddc5..138dd159b3b9 100644 --- a/drivers/char/agp/agpgart_fe.c +++ b/drivers/char/agp/agpgart_fe.c @@ -300,7 +300,7 @@ static agp_memory *agp_allocate_memory_wrap(size_t pg_count, u32 type) agp_memory *memory; memory = agp_allocate_memory(pg_count, type); - printk(KERN_DEBUG "memory : %p\n", memory); + printk(KERN_DEBUG "agp_allocate_memory: %p\n", memory); if (memory == NULL) { return NULL; } diff --git a/drivers/char/joystick/Config.in b/drivers/char/joystick/Config.in index 3e371744e412..259134bb7a44 100644 --- a/drivers/char/joystick/Config.in +++ b/drivers/char/joystick/Config.in @@ -16,7 +16,7 @@ if [ "$CONFIG_JOYSTICK" != "n" ]; then dep_tristate ' ThrustMaster DirectConnect' CONFIG_JOY_THRUSTMASTER $CONFIG_JOYSTICK dep_tristate ' Creative Labs Blaster' CONFIG_JOY_CREATIVE $CONFIG_JOYSTICK dep_tristate ' PDPI Lightning 4 card' CONFIG_JOY_LIGHTNING $CONFIG_JOYSTICK - dep_tristate ' Trident 4DWave and Aureal Vortex gameport' CONFIG_JOY_PCI $CONFIG_JOYSTICK + dep_tristate ' Trident 4DWave/Aureal Vortex/ALi 5451 gameport' CONFIG_JOY_PCI $CONFIG_JOYSTICK dep_tristate ' Magellan and Space Mouse' CONFIG_JOY_MAGELLAN $CONFIG_JOYSTICK dep_tristate ' SpaceTec SpaceOrb 360 and SpaceBall Avenger' CONFIG_JOY_SPACEORB $CONFIG_JOYSTICK dep_tristate ' SpaceTec SpaceBall 4000 FLX' CONFIG_JOY_SPACEBALL $CONFIG_JOYSTICK diff --git a/drivers/char/joystick/joy-pci.c b/drivers/char/joystick/joy-pci.c index 3e0301a3b23a..662cfb4764ca 100644 --- a/drivers/char/joystick/joy-pci.c +++ b/drivers/char/joystick/joy-pci.c @@ -129,6 +129,8 @@ static struct js_pci_data js_pci_data[] = js_pci_vortex_init, js_pci_vortex_cleanup, "Aureal Vortex1" }, { PCI_VENDOR_ID_AUREAL, 0x0002, 0x40000, 0x2a00c, 0x2880c, 0x28808, 0x28810, 4, 0x1fff, js_pci_vortex_init, js_pci_vortex_cleanup, "Aureal Vortex2" }, + { PCI_VENDOR_ID_AL, 0x5451, 0x10000, 0x00044, 0x00030, 0x00031, 0x00034, 2, 0xffff, + js_pci_4dwave_init, js_pci_4dwave_cleanup, "ALi 5451" }, { 0, 0, 0, 0, 0, 0, 0, 0, 0, NULL, NULL }}; /* diff --git a/drivers/isdn/isdn_ppp.c b/drivers/isdn/isdn_ppp.c index a12c328b62d7..3cb319f52c05 100644 --- a/drivers/isdn/isdn_ppp.c +++ b/drivers/isdn/isdn_ppp.c @@ -1148,7 +1148,7 @@ isdn_ppp_xmit(struct sk_buff *skb, struct device *netdev) if (slot < 0 || slot > ISDN_MAX_CHANNELS) { printk(KERN_ERR "isdn_ppp_xmit: lp->ppp_slot %d\n", lp->ppp_slot); kfree_skb(skb); - return 0; + goto unlock; } ipt = ippp_table[slot]; lp->huptimer = 0; diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c index 9781b068f769..ece752ace15f 100644 --- a/drivers/telephony/ixj.c +++ b/drivers/telephony/ixj.c @@ -4472,7 +4472,9 @@ static int ixj_build_cadence(int board, IXJ_CADENCE * cp) lcp = kmalloc(sizeof(IXJ_CADENCE), GFP_KERNEL); if (lcp == NULL) return -ENOMEM; - if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE))) + if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) || + lcp->elements_used < 0 || + lcp->elements_used > INT_MAX / sizeof(IXJ_CADENCE_ELEMENT)) { kfree(lcp); return -EFAULT; diff --git a/fs/fat/misc.c b/fs/fat/misc.c index 9d2c25d6da53..5f22d5ca54de 100644 --- a/fs/fat/misc.c +++ b/fs/fat/misc.c @@ -366,7 +366,8 @@ int fat__get_entry(struct inode *dir, loff_t *pos,struct buffer_head **bh, return -1; /* beyond EOF */ *pos += sizeof(struct msdos_dir_entry); if (!(*bh = fat_bread(sb, sector))) { - printk("Directory sread (sector 0x%x) failed\n",sector); + printk("Directory sread (sector 0x%lx) failed\n", + (unsigned long)sector); continue; } break; diff --git a/include/linux/kernel.h b/include/linux/kernel.h index 0f14098055a7..2b9329e3f1e1 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -49,8 +49,12 @@ NORET_TYPE void do_exit(long error_code) extern unsigned long simple_strtoul(const char *,char **,unsigned int); extern long simple_strtol(const char *,char **,unsigned int); extern char *get_options(char *str, int *ints); -extern int sprintf(char * buf, const char * fmt, ...); -extern int vsprintf(char *buf, const char *, va_list); +extern int sprintf(char *buf, const char *fmt, ...) + __attribute__ ((format (printf, 2, 3))); +extern int vsprintf(char *buf, const char *, va_list) + __attribute__ ((format (printf, 2, 0))); +extern int _vsnprintf(char *buf, int n, const char *, va_list) + __attribute__ ((format (printf, 3, 0))); extern int session_of_pgrp(int pgrp); diff --git a/init/main.c b/init/main.c index 23b0ffa4fa11..72a12cec5775 100644 --- a/init/main.c +++ b/init/main.c @@ -995,7 +995,7 @@ static struct kernel_param cooked_params[] __initdata = { { "soundmodem=", sm_setup }, #endif #ifdef CONFIG_COMPUTONE - { "ip2=", ip2_setup }; + { "ip2=", ip2_setup }, #endif #ifdef CONFIG_WDT { "wdt=", wdt_setup }, diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c index a3d1f0aa0139..a7369ec88530 100644 --- a/net/ipv4/ip_options.c +++ b/net/ipv4/ip_options.c @@ -266,7 +266,7 @@ int ip_options_compile(struct ip_options * opt, struct sk_buff * skb) for (l = opt->optlen; l > 0; ) { switch (*optptr) { case IPOPT_END: - for (optptr++, l--; l>0; l--) { + for (optptr++, l--; l>0; optptr++, l--) { if (*optptr != IPOPT_END) { *optptr = IPOPT_END; opt->is_changed = 1;