From 51f1b7d4ad8ccb3dcafb9183a71f477d01f05779 Mon Sep 17 00:00:00 2001
From: Alan Cox <alan@lxorguk.ukuu.org.uk>
Date: Fri, 23 Nov 2007 15:20:25 -0500
Subject: [PATCH] Linux 2.2.14pre12

o	Fix an IP checking bug				(Stephan Uphoff)
o	Ultrasparc corruption bugfix			(Dave Miller)
o	Tidy up the drive spin up timer			(Jens Axboe)
o	Fix AX.25 hanging socket bug			(Tomi Manninen)
o	PPC SMP build bug fix				(Cort Dougan)
o	Fix SCSI CD memory leak on readraw mode		(Martin Vogt)
o	Firewall rule counting fix			(Emanuele Caratti)
o	Fix script symbol collisions on NCR 53c78xx	(Richar Hirst)
o	Unload lp if it finds no ports			(Tim Waugh)
o	Improve old/new tulip docs			(Wichert Akkerman)
o	Syncookie memory leak				(Andi Kleen)
o	dput could be called on freed dentry		(H J Lu)
o	SCSI end_request race fix			(Soohoon Lee)
o	Fix shared irq bug in synclink driver		(Paul Fulghum)
---
 Documentation/Configure.help       |  26 +++++++
 Makefile                           |   2 +-
 arch/ppc/kernel/head.S             |  15 +---
 arch/sparc64/kernel/dtlb_backend.S |   4 +-
 arch/sparc64/kernel/irq.c          |   6 +-
 arch/sparc64/kernel/process.c      |   4 +-
 arch/sparc64/kernel/smp.c          |   3 +-
 arch/sparc64/mm/init.c             |  60 +++++++++++++---
 drivers/char/lp.c                  |   3 +-
 drivers/char/synclink.c            |  11 +--
 drivers/scsi/g_NCR5380.c           |   8 +--
 drivers/scsi/script_asm.pl         |  16 ++---
 drivers/scsi/scsi.h                |   2 +-
 drivers/scsi/sd.c                  |   4 +-
 drivers/scsi/sim710_d.h            | 108 ++++++++++++++---------------
 drivers/scsi/sr_ioctl.c            |   3 +
 fs/dcache.c                        |   3 +-
 include/asm-sparc64/pgtable.h      |  37 ++++++----
 include/asm-sparc64/smp.h          |  10 +--
 net/ax25/af_ax25.c                 |   1 -
 net/ipv4/ip_fw.c                   |   9 ++-
 net/ipv4/ip_input.c                |   8 +++
 net/ipv4/syncookies.c              |   8 ++-
 scripts/Menuconfig                 |   2 +-
 24 files changed, 222 insertions(+), 131 deletions(-)

diff --git a/Documentation/Configure.help b/Documentation/Configure.help
index 3d0434f8b0a4..e34f3fa12ae5 100644
--- a/Documentation/Configure.help
+++ b/Documentation/Configure.help
@@ -6486,6 +6486,32 @@ CONFIG_DEC_ELCP
   More specific information is contained in
   Documentation/networking/tulip.txt.
 
+  This is the new version of this driver. If it does not work for
+  you please try older version which is also available.
+
+  This driver is also available as a module ( = code which can be
+  inserted in and removed from the running kernel whenever you want).
+  The module will be called tulip.o. If you want to compile it as a
+  module, say M here and read Documentation/modules.txt as well as
+  Documentation/networking/net-modules.txt.
+
+Old DECchip Tulip (dc21x4x) PCI support
+CONFIG_DEC_ELCP_OLD
+  This driver is developed for the SMC EtherPower series Ethernet
+  cards and also works with cards based on the DECchip
+  21040/21041/21140 (Tulip series) chips. Some LinkSys PCI cards are
+  of this type. (If your card is NOT SMC EtherPower 10/100 PCI
+  (smc9332dst), you can also try the driver for "Generic DECchip"
+  cards, above. However, most people with a network card of this type
+  will say Y here.) Do read the Ethernet-HOWTO, available via FTP
+  (user: anonymous) in ftp://metalab.unc.edu/pub/Linux/docs/HOWTO.
+  More specific information is contained in
+  Documentation/networking/tulip.txt.
+
+  This an older version of the driver which supports some cards the
+  new version does not (yet) support. Use it if the new driver does
+  not work for you.
+
   This driver is also available as a module ( = code which can be
   inserted in and removed from the running kernel whenever you want).
   The module will be called tulip.o. If you want to compile it as a
diff --git a/Makefile b/Makefile
index 9f73ca5a03f8..5528f2421ffe 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 2
 SUBLEVEL = 14
-EXTRAVERSION = pre11
+EXTRAVERSION = pre12
 
 ARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ -e s/arm.*/arm/ -e s/sa110/arm/)
 
diff --git a/arch/ppc/kernel/head.S b/arch/ppc/kernel/head.S
index 0c17abf08009..898ce1d2768a 100644
--- a/arch/ppc/kernel/head.S
+++ b/arch/ppc/kernel/head.S
@@ -234,7 +234,7 @@ __start:
 	.globl	__secondary_start
 __secondary_start:
 /* Switch MMU off, clear BATs and flush TLB */
-	bl	mmu_off
+ 	bl	mmu_off
 	bl	clear_bats
 	bl	flush_tlbs
 
@@ -1346,6 +1346,7 @@ hash_page_patch_A:
 	li	r2,8			/* PTEs/group */
 	bne	10f			/* no PTE: go look for an empty slot */
 	tlbie	r3			/* invalidate TLB entry */
+
 	/* Search the primary PTEG for a PTE whose 1st word matches r5 */
 	mtctr	r2
 	addi	r3,r4,-8
@@ -2251,17 +2252,7 @@ do_signal_ret:
 	stw	r4,TSS+KSP(r2)	/* save kernel stack pointer */
 	tophys(r3,r1,r3)
 	mtspr	SPRG2,r3	/* phys exception stack pointer */
-10:	
-#ifdef CONFIG_SMP
-	/* see smp_invalidate_tlb_cpu for explanation */
-	mfspr	r3,PVR
-	rlwinm	r3,r3,16,16,31
-	cmpi	0,r3,8
-	bne	1010f
-	bl	smp_invalidate_tlb_cpu
-1010:		
-#endif /* CONFIG_SMP */	
-	lwz	r2,_CTR(r1)
+10:	lwz	r2,_CTR(r1)
 	lwz	r0,_LINK(r1)
 	mtctr	r2
 	mtlr	r0
diff --git a/arch/sparc64/kernel/dtlb_backend.S b/arch/sparc64/kernel/dtlb_backend.S
index 9fe613a51824..c7d6a88460ad 100644
--- a/arch/sparc64/kernel/dtlb_backend.S
+++ b/arch/sparc64/kernel/dtlb_backend.S
@@ -1,4 +1,4 @@
-/* $Id: dtlb_backend.S,v 1.7 1998/12/16 04:33:28 davem Exp $
+/* $Id: dtlb_backend.S,v 1.7.2.1 1999/12/05 10:41:57 davem Exp $
  * dtlb_backend.S: Back end to DTLB miss replacement strategy.
  *                 This is included directly into the trap table.
  *
@@ -10,7 +10,7 @@
 #define VPTE_SHIFT		(PAGE_SHIFT - 3)
 #define PMD_SHIFT		(23 - PAGE_SHIFT + 3)
 #define PGD_SHIFT		(34 - PAGE_SHIFT + 3)
-#define VPTE_BITS		(_PAGE_CP | _PAGE_P | _PAGE_W)
+#define VPTE_BITS		(_PAGE_CP | _PAGE_CV | _PAGE_P | _PAGE_W)
 
 /* Ways we can get here:
  *
diff --git a/arch/sparc64/kernel/irq.c b/arch/sparc64/kernel/irq.c
index 6eccb883a705..5854f646d96e 100644
--- a/arch/sparc64/kernel/irq.c
+++ b/arch/sparc64/kernel/irq.c
@@ -1,4 +1,4 @@
-/* $Id: irq.c,v 1.76 1999/04/02 14:54:30 davem Exp $
+/* $Id: irq.c,v 1.76.2.1 1999/12/05 07:24:37 davem Exp $
  * irq.c: UltraSparc IRQ handling/init/registry.
  *
  * Copyright (C) 1997  David S. Miller  (davem@caip.rutgers.edu)
@@ -825,10 +825,10 @@ static void show(char * str)
 	int cpu = smp_processor_id();
 
 	printk("\n%s, CPU %d:\n", str, cpu);
-	printk("irq:  %d [%ld %ld]\n",
+	printk("irq:  %d [%u %u]\n",
 	       atomic_read(&global_irq_count),
 	       cpu_data[0].irq_count, cpu_data[1].irq_count);
-	printk("bh:   %d [%ld %ld]\n",
+	printk("bh:   %d [%u %u]\n",
 	       (spin_is_locked(&global_bh_count) ? 1 : 0),
 	       cpu_data[0].bh_count, cpu_data[1].bh_count);
 }
diff --git a/arch/sparc64/kernel/process.c b/arch/sparc64/kernel/process.c
index c5d7c3b2173f..6005b969e666 100644
--- a/arch/sparc64/kernel/process.c
+++ b/arch/sparc64/kernel/process.c
@@ -1,4 +1,4 @@
-/*  $Id: process.c,v 1.92.2.2 1999/08/31 18:21:27 davem Exp $
+/*  $Id: process.c,v 1.92.2.3 1999/12/05 07:24:38 davem Exp $
  *  arch/sparc64/kernel/process.c
  *
  *  Copyright (C) 1995, 1996 David S. Miller (davem@caip.rutgers.edu)
@@ -277,7 +277,7 @@ void __show_regs(struct pt_regs * regs)
 	unsigned long flags;
 
 	spin_lock_irqsave(&regdump_lock, flags);
-	printk("CPU[%d]: local_irq_count[%ld] global_irq_count[%d]\n",
+	printk("CPU[%d]: local_irq_count[%u] global_irq_count[%d]\n",
 	       smp_processor_id(), local_irq_count,
 	       atomic_read(&global_irq_count));
 #endif
diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
index 657d99d7990f..ad9625f582e5 100644
--- a/arch/sparc64/kernel/smp.c
+++ b/arch/sparc64/kernel/smp.c
@@ -94,7 +94,8 @@ __initfunc(void smp_store_cpu_info(int id))
 	cpu_data[id].udelay_val			= loops_per_sec;
 
 	cpu_data[id].pgcache_size		= 0;
-	cpu_data[id].pte_cache			= NULL;
+	cpu_data[id].pte_cache[0]		= NULL;
+	cpu_data[id].pte_cache[1]		= NULL;
 	cpu_data[id].pgdcache_size		= 0;
 	cpu_data[id].pgd_cache			= NULL;
 	cpu_data[id].idle_volume		= 1;
diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
index 53022fa580bf..645f9de75572 100644
--- a/arch/sparc64/mm/init.c
+++ b/arch/sparc64/mm/init.c
@@ -1,4 +1,4 @@
-/*  $Id: init.c,v 1.127.2.5 1999/11/19 07:30:48 davem Exp $
+/*  $Id: init.c,v 1.127.2.6 1999/12/05 07:24:42 davem Exp $
  *  arch/sparc64/mm/init.c
  *
  *  Copyright (C) 1996-1999 David S. Miller (davem@caip.rutgers.edu)
@@ -53,8 +53,10 @@ int do_check_pgt_cache(int low, int high)
 			if(pgd_quicklist)
 				free_pgd_slow(get_pgd_fast()), freed++;
 #endif
-			if(pte_quicklist)
-				free_pte_slow(get_pte_fast()), freed++;
+			if(pte_quicklist[0])
+				free_pte_slow(get_pte_fast(0)), freed++;
+			if(pte_quicklist[1])
+				free_pte_slow(get_pte_fast(1)), freed++;
 		} while(pgtable_cache_size > low);
 	}
 #ifndef __SMP__ 
@@ -1104,6 +1106,10 @@ out:
 struct pgtable_cache_struct pgt_quicklists;
 #endif
 
+/* For PMDs we don't care about the color, writes are
+ * only done via Dcache which is write-thru, so non-Dcache
+ * reads will always see correct data.
+ */
 pmd_t *get_pmd_slow(pgd_t *pgd, unsigned long offset)
 {
 	pmd_t *pmd;
@@ -1117,13 +1123,51 @@ pmd_t *get_pmd_slow(pgd_t *pgd, unsigned long offset)
 	return NULL;
 }
 
-pte_t *get_pte_slow(pmd_t *pmd, unsigned long offset)
+/* OK, we have to color these pages because during DTLB
+ * protection faults we set the dirty bit via a non-Dcache
+ * enabled mapping in the VPTE area.  The kernel can end
+ * up missing the dirty bit resulting in processes crashing
+ * _iff_ the VPTE mapping of the ptes have a virtual address
+ * bit 13 which is different from bit 13 of the physical address.
+ *
+ * The sequence is:
+ *	1) DTLB protection fault, write dirty bit into pte via VPTE
+ *	   mappings.
+ *	2) Swapper checks pte, does not see dirty bit, frees page.
+ *	3) Process faults back in the page, the old pre-dirtied copy
+ *	   is provided and here is the corruption.
+ */
+pte_t *get_pte_slow(pmd_t *pmd, unsigned long offset, unsigned long color)
 {
-	pte_t *pte;
+	unsigned long paddr = __get_free_pages(GFP_KERNEL, 1);
+
+	if (paddr) {
+		struct page *page2 = mem_map + MAP_NR(paddr + PAGE_SIZE);
+		unsigned long *to_free;
+		pte_t *pte;
+
+		/* Set count of second page, so we can free it
+		 * seperately later on.
+		 */
+		atomic_set(&page2->count, 1);
+
+		/* Clear out both pages now. */
+		memset((char *)paddr, 0, (PAGE_SIZE << 1));
+
+		/* Determine which page we give to this request. */
+		if (!color) {
+			pte = (pte_t *) paddr;
+			to_free = (unsigned long *) (paddr + PAGE_SIZE);
+		} else {
+			pte = (pte_t *) (paddr + PAGE_SIZE);
+			to_free = (unsigned long *) paddr;
+		}
+
+		/* Now free the other one up, adjust cache size. */
+		*to_free = (unsigned long) pte_quicklist[color ^ 0x1];
+		pte_quicklist[color ^ 0x1] = to_free;
+		pgtable_cache_size++;
 
-	pte = (pte_t *) __get_free_page(GFP_KERNEL);
-	if(pte) {
-		memset(pte, 0, PAGE_SIZE);
 		pmd_set(pmd, pte);
 		return pte + offset;
 	}
diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index b1778401aab8..3ffb1bc4a53a 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -972,7 +972,8 @@ int lp_init(void)
 			return -EIO;
 		}
 	} else {
-		printk(KERN_INFO "lp: driver loaded but no devices found\n");
+		printk(KERN_INFO "lp: no devices found\n");
+		return -ENODEV;
 	}
 
 	return 0;
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index cb3f1e0dea6a..5feeeef8028d 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -1,7 +1,7 @@
 /*
  * linux/drivers/char/synclink.c
  *
- * ==FILEDATE 19990901==
+ * ==FILEDATE 19991207==
  *
  * Device driver for Microgate SyncLink ISA and PCI
  * high speed multiprotocol serial adapters.
@@ -925,7 +925,7 @@ MODULE_PARM(maxframe,"1-" __MODULE_STRING(MAX_TOTAL_DEVICES) "i");
 #endif
 
 static char *driver_name = "SyncLink serial driver";
-static char *driver_version = "1.14";
+static char *driver_version = "1.15";
 
 static struct tty_driver serial_driver, callout_driver;
 static int serial_refcount;
@@ -6981,7 +6981,6 @@ BOOLEAN mgsl_register_test( struct mgsl_struct *info )
 
 	spin_lock_irqsave(&info->irq_spinlock,flags);
 	usc_reset(info);
-	spin_unlock_irqrestore(&info->irq_spinlock,flags);
 
 	/* Verify the reset state of some registers. */
 
@@ -7015,7 +7014,6 @@ BOOLEAN mgsl_register_test( struct mgsl_struct *info )
 		}
 	}
 
-	spin_lock_irqsave(&info->irq_spinlock,flags);
 	usc_reset(info);
 	spin_unlock_irqrestore(&info->irq_spinlock,flags);
 
@@ -7035,7 +7033,6 @@ BOOLEAN mgsl_irq_test( struct mgsl_struct *info )
 
 	spin_lock_irqsave(&info->irq_spinlock,flags);
 	usc_reset(info);
-	spin_unlock_irqrestore(&info->irq_spinlock,flags);
 
 	/*
 	 * Setup 16C32 to interrupt on TxC pin (14MHz clock) transition. 
@@ -7057,6 +7054,8 @@ BOOLEAN mgsl_irq_test( struct mgsl_struct *info )
 	usc_UnlatchIostatusBits(info, MISCSTATUS_TXC_LATCHED);
 	usc_EnableStatusIrqs(info, SICR_TXC_ACTIVE + SICR_TXC_INACTIVE);
 
+	spin_unlock_irqrestore(&info->irq_spinlock,flags);
+
 	EndTime=100;
 	while( EndTime-- && !info->irq_occurred ) {
 		set_current_state(TASK_INTERRUPTIBLE);
@@ -7359,7 +7358,9 @@ BOOLEAN mgsl_dma_test( struct mgsl_struct *info )
 		}
 	}
 
+	spin_lock_irqsave(&info->irq_spinlock,flags);
 	usc_reset( info );
+	spin_unlock_irqrestore(&info->irq_spinlock,flags);
 
 	/* restore current port options */
 	memcpy(&info->params,&tmp_params,sizeof(MGSL_PARAMS));
diff --git a/drivers/scsi/g_NCR5380.c b/drivers/scsi/g_NCR5380.c
index 8df889631241..1bd75063d058 100644
--- a/drivers/scsi/g_NCR5380.c
+++ b/drivers/scsi/g_NCR5380.c
@@ -499,7 +499,7 @@ static inline int NCR5380_pread (struct Scsi_Host *instance, unsigned char *dst,
 	    dst[start+i] = NCR5380_read(C400_HOST_BUFFER);
 #else
 	/* implies CONFIG_SCSI_G_NCR5380_MEM */
-	memcpy(dst+start,NCR53C400_host_buffer+NCR5380_map_name,128);
+	memcpy_fromio(dst+start,NCR53C400_host_buffer+NCR5380_map_name,128);
 #endif
 	start+=128;
 	blocks--;
@@ -520,7 +520,7 @@ static inline int NCR5380_pread (struct Scsi_Host *instance, unsigned char *dst,
 	    dst[start+i] = NCR5380_read(C400_HOST_BUFFER);
 #else
 	/* implies CONFIG_SCSI_G_NCR5380_MEM */
-	memcpy(dst+start,NCR53C400_host_buffer+NCR5380_map_name,128);
+	memcpy_fromio(dst+start,NCR53C400_host_buffer+NCR5380_map_name,128);
 #endif
 	start+=128;
 	blocks--;
@@ -607,7 +607,7 @@ static inline int NCR5380_pwrite (struct Scsi_Host *instance, unsigned char *src
 	    NCR5380_write(C400_HOST_BUFFER, src[start+i]);
 #else
 	/* implies CONFIG_SCSI_G_NCR5380_MEM */
-	memcpy(NCR53C400_host_buffer+NCR5380_map_name,src+start,128);
+	memcpy_toio(NCR53C400_host_buffer+NCR5380_map_name,src+start,128);
 #endif
 	start+=128;
 	blocks--;
@@ -627,7 +627,7 @@ static inline int NCR5380_pwrite (struct Scsi_Host *instance, unsigned char *src
 	    NCR5380_write(C400_HOST_BUFFER, src[start+i]);
 #else
 	/* implies CONFIG_SCSI_G_NCR5380_MEM */
-	memcpy(NCR53C400_host_buffer+NCR5380_map_name,src+start,128);
+	memcpy_toio(NCR53C400_host_buffer+NCR5380_map_name,src+start,128);
 #endif
 	start+=128;
 	blocks--;
diff --git a/drivers/scsi/script_asm.pl b/drivers/scsi/script_asm.pl
index d99fcc950d0c..a25a7271a2d0 100644
--- a/drivers/scsi/script_asm.pl
+++ b/drivers/scsi/script_asm.pl
@@ -896,7 +896,7 @@ foreach $label (@label) {
 open (OUTPUT, ">$output") || die "$0 : can't open $output for writing\n";
 open (OUTPUTU, ">$outputu") || die "$0 : can't open $outputu for writing\n";
 
-print OUTPUT "u32 ".$prefix."SCRIPT[] = {\n";
+print OUTPUT "static u32 ".$prefix."SCRIPT[] = {\n";
 $instructions = 0;
 for ($i = 0; $i < $#code; ) {
     if ($list_in_array) {
@@ -935,7 +935,7 @@ foreach $i (@absolute) {
     }
     printf OUTPUTU "#undef A_$i\n";
 
-    printf OUTPUT "u32 A_".$i."_used\[\] = {\n";
+    printf OUTPUT "static u32 A_".$i."_used\[\] __attribute((unused)) = {\n";
 printf STDERR "$i is used $symbol_references{$i}\n" if ($debug);
     foreach $j (split (/\s+/,$symbol_references{$i})) {
 	$j =~ /(ABS|REL),(.*),(.*)/;
@@ -957,15 +957,15 @@ foreach $i (sort @entry) {
 # NCR assembler outputs label patches in the form of indices into 
 # the code.
 #
-printf OUTPUT "u32 ".$prefix."LABELPATCHES[] = {\n";
+printf OUTPUT "static u32 ".$prefix."LABELPATCHES[] __attribute((unused)) = {\n";
 for $patch (sort {$a <=> $b} @label_patches) {
     printf OUTPUT "\t0x%08x,\n", $patch;
 }
 printf OUTPUT "};\n\n";
 
 $num_external_patches = 0;
-printf OUTPUT "struct {\n\tu32\toffset;\n\tvoid\t\t*address;\n".
-    "} ".$prefix."EXTERNAL_PATCHES[] = {\n";
+printf OUTPUT "static struct {\n\tu32\toffset;\n\tvoid\t\t*address;\n".
+    "} ".$prefix."EXTERNAL_PATCHES[] __attribute((unused)) = {\n";
 while ($ident = pop(@external_patches)) {
     $off = pop(@external_patches);
     printf OUTPUT "\t{0x%08x, &%s},\n", $off, $ident;
@@ -973,11 +973,11 @@ while ($ident = pop(@external_patches)) {
 }
 printf OUTPUT "};\n\n";
 
-printf OUTPUT "u32 ".$prefix."INSTRUCTIONS\t= %d;\n", 
+printf OUTPUT "static u32 ".$prefix."INSTRUCTIONS __attribute((unused))\t= %d;\n", 
     $instructions;
-printf OUTPUT "u32 ".$prefix."PATCHES\t= %d;\n", 
+printf OUTPUT "static u32 ".$prefix."PATCHES __attribute((unused))\t= %d;\n", 
     $#label_patches+1;
-printf OUTPUT "u32 ".$prefix."EXTERNAL_PATCHES_LEN\t= %d;\n",
+printf OUTPUT "static u32 ".$prefix."EXTERNAL_PATCHES_LEN __attribute((unused))\t= %d;\n",
     $num_external_patches;
 close OUTPUT;
 close OUTPUTU;
diff --git a/drivers/scsi/scsi.h b/drivers/scsi/scsi.h
index 167383b2b6dd..21c9e8a5df88 100644
--- a/drivers/scsi/scsi.h
+++ b/drivers/scsi/scsi.h
@@ -655,8 +655,8 @@ static Scsi_Cmnd * end_scsi_request(Scsi_Cmnd * SCpnt, int uptodate, int sectors
 	    req->nr_sectors -= bh->b_size >> 9;
 	    req->sector += bh->b_size >> 9;
 	    bh->b_reqnext = NULL;
-	    bh->b_end_io(bh, uptodate);
 	    sectors -= bh->b_size >> 9;
+	    bh->b_end_io(bh, uptodate);
 	    if ((bh = req->bh) != NULL) {
 		req->current_nr_sectors = bh->b_size >> 9;
 		if (req->nr_sectors < req->current_nr_sectors) {
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 75a57e208ff2..11162c7cd8fa 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1240,10 +1240,10 @@ static int sd_init_onedisk(int i)
 		}
 
 		spin_unlock_irq(&io_request_lock);
-		time1 = jiffies + HZ;
+		time1 = HZ;
 		do {
 		    current->state = TASK_UNINTERRUPTIBLE;
-		    time1 = schedule_timeout(HZ);
+		    time1 = schedule_timeout(time1);
 		} while (time1); /* Wait 1 second for next try */
 		printk( "." );
 		spin_lock_irq(&io_request_lock);
diff --git a/drivers/scsi/sim710_d.h b/drivers/scsi/sim710_d.h
index 22e0464786c2..b6305f806d92 100644
--- a/drivers/scsi/sim710_d.h
+++ b/drivers/scsi/sim710_d.h
@@ -1,4 +1,4 @@
-u32 SCRIPT[] = {
+static u32 SCRIPT[] = {
 /*
 
 
@@ -1776,12 +1776,12 @@ at 0x0000032c : */	0x98080000,0xab930018,
 };
 
 #define A_dsa_cmnd	0x00000010
-u32 A_dsa_cmnd_used[] = {
+static u32 A_dsa_cmnd_used[] __attribute((unused)) = {
 	0x0000001d,
 };
 
 #define A_dsa_datain	0x00000028
-u32 A_dsa_datain_used[] = {
+static u32 A_dsa_datain_used[] __attribute((unused)) = {
 	0x0000003d,
 	0x0000003f,
 	0x00000041,
@@ -1913,7 +1913,7 @@ u32 A_dsa_datain_used[] = {
 };
 
 #define A_dsa_dataout	0x00000428
-u32 A_dsa_dataout_used[] = {
+static u32 A_dsa_dataout_used[] __attribute((unused)) = {
 	0x00000143,
 	0x00000145,
 	0x00000147,
@@ -2045,12 +2045,12 @@ u32 A_dsa_dataout_used[] = {
 };
 
 #define A_dsa_msgin	0x00000020
-u32 A_dsa_msgin_used[] = {
+static u32 A_dsa_msgin_used[] __attribute((unused)) = {
 	0x0000002f,
 };
 
 #define A_dsa_msgout	0x00000008
-u32 A_dsa_msgout_used[] = {
+static u32 A_dsa_msgout_used[] __attribute((unused)) = {
 	0x00000013,
 	0x00000285,
 	0x000002c5,
@@ -2058,50 +2058,50 @@ u32 A_dsa_msgout_used[] = {
 };
 
 #define A_dsa_select	0x00000000
-u32 A_dsa_select_used[] = {
+static u32 A_dsa_select_used[] __attribute((unused)) = {
 	0x00000006,
 };
 
 #define A_dsa_size	0x00000828
-u32 A_dsa_size_used[] = {
+static u32 A_dsa_size_used[] __attribute((unused)) = {
 };
 
 #define A_dsa_status	0x00000018
-u32 A_dsa_status_used[] = {
+static u32 A_dsa_status_used[] __attribute((unused)) = {
 	0x0000002b,
 };
 
 #define A_had_cmdout	0x00000004
-u32 A_had_cmdout_used[] = {
+static u32 A_had_cmdout_used[] __attribute((unused)) = {
 	0x0000001a,
 };
 
 #define A_had_datain	0x00000008
-u32 A_had_datain_used[] = {
+static u32 A_had_datain_used[] __attribute((unused)) = {
 	0x00000038,
 };
 
 #define A_had_dataout	0x00000010
-u32 A_had_dataout_used[] = {
+static u32 A_had_dataout_used[] __attribute((unused)) = {
 	0x0000013e,
 };
 
 #define A_had_extmsg	0x00000080
-u32 A_had_extmsg_used[] = {
+static u32 A_had_extmsg_used[] __attribute((unused)) = {
 	0x0000025a,
 	0x0000029a,
 	0x000002da,
 };
 
 #define A_had_msgin	0x00000040
-u32 A_had_msgin_used[] = {
+static u32 A_had_msgin_used[] __attribute((unused)) = {
 	0x00000248,
 	0x00000288,
 	0x000002c8,
 };
 
 #define A_had_msgout	0x00000002
-u32 A_had_msgout_used[] = {
+static u32 A_had_msgout_used[] __attribute((unused)) = {
 	0x00000010,
 	0x00000282,
 	0x000002c2,
@@ -2109,161 +2109,161 @@ u32 A_had_msgout_used[] = {
 };
 
 #define A_had_select	0x00000001
-u32 A_had_select_used[] = {
+static u32 A_had_select_used[] __attribute((unused)) = {
 	0x0000000c,
 };
 
 #define A_had_status	0x00000020
-u32 A_had_status_used[] = {
+static u32 A_had_status_used[] __attribute((unused)) = {
 };
 
 #define A_int_bad_extmsg1a	0xab930000
-u32 A_int_bad_extmsg1a_used[] = {
+static u32 A_int_bad_extmsg1a_used[] __attribute((unused)) = {
 	0x00000263,
 };
 
 #define A_int_bad_extmsg1b	0xab930001
-u32 A_int_bad_extmsg1b_used[] = {
+static u32 A_int_bad_extmsg1b_used[] __attribute((unused)) = {
 	0x0000026b,
 };
 
 #define A_int_bad_extmsg2a	0xab930002
-u32 A_int_bad_extmsg2a_used[] = {
+static u32 A_int_bad_extmsg2a_used[] __attribute((unused)) = {
 	0x000002a3,
 };
 
 #define A_int_bad_extmsg2b	0xab930003
-u32 A_int_bad_extmsg2b_used[] = {
+static u32 A_int_bad_extmsg2b_used[] __attribute((unused)) = {
 	0x000002ab,
 };
 
 #define A_int_bad_extmsg3a	0xab930004
-u32 A_int_bad_extmsg3a_used[] = {
+static u32 A_int_bad_extmsg3a_used[] __attribute((unused)) = {
 	0x000002e3,
 };
 
 #define A_int_bad_extmsg3b	0xab930005
-u32 A_int_bad_extmsg3b_used[] = {
+static u32 A_int_bad_extmsg3b_used[] __attribute((unused)) = {
 	0x000002eb,
 };
 
 #define A_int_bad_msg1	0xab930006
-u32 A_int_bad_msg1_used[] = {
+static u32 A_int_bad_msg1_used[] __attribute((unused)) = {
 	0x00000255,
 };
 
 #define A_int_bad_msg2	0xab930007
-u32 A_int_bad_msg2_used[] = {
+static u32 A_int_bad_msg2_used[] __attribute((unused)) = {
 	0x00000295,
 };
 
 #define A_int_bad_msg3	0xab930008
-u32 A_int_bad_msg3_used[] = {
+static u32 A_int_bad_msg3_used[] __attribute((unused)) = {
 	0x000002d5,
 };
 
 #define A_int_cmd_bad_phase	0xab930009
-u32 A_int_cmd_bad_phase_used[] = {
+static u32 A_int_cmd_bad_phase_used[] __attribute((unused)) = {
 	0x00000027,
 };
 
 #define A_int_cmd_complete	0xab93000a
-u32 A_int_cmd_complete_used[] = {
+static u32 A_int_cmd_complete_used[] __attribute((unused)) = {
 	0x00000037,
 };
 
 #define A_int_data_bad_phase	0xab93000b
-u32 A_int_data_bad_phase_used[] = {
+static u32 A_int_data_bad_phase_used[] __attribute((unused)) = {
 	0x00000247,
 };
 
 #define A_int_disc1	0xab930019
-u32 A_int_disc1_used[] = {
+static u32 A_int_disc1_used[] __attribute((unused)) = {
 	0x00000277,
 };
 
 #define A_int_disc2	0xab93001a
-u32 A_int_disc2_used[] = {
+static u32 A_int_disc2_used[] __attribute((unused)) = {
 	0x000002b7,
 };
 
 #define A_int_disc3	0xab93001b
-u32 A_int_disc3_used[] = {
+static u32 A_int_disc3_used[] __attribute((unused)) = {
 	0x000002f7,
 };
 
 #define A_int_msg_sdtr1	0xab93000c
-u32 A_int_msg_sdtr1_used[] = {
+static u32 A_int_msg_sdtr1_used[] __attribute((unused)) = {
 	0x00000271,
 };
 
 #define A_int_msg_sdtr2	0xab93000d
-u32 A_int_msg_sdtr2_used[] = {
+static u32 A_int_msg_sdtr2_used[] __attribute((unused)) = {
 	0x000002b1,
 };
 
 #define A_int_msg_sdtr3	0xab93000e
-u32 A_int_msg_sdtr3_used[] = {
+static u32 A_int_msg_sdtr3_used[] __attribute((unused)) = {
 	0x000002f1,
 };
 
 #define A_int_no_msgout1	0xab93000f
-u32 A_int_no_msgout1_used[] = {
+static u32 A_int_no_msgout1_used[] __attribute((unused)) = {
 	0x00000281,
 };
 
 #define A_int_no_msgout2	0xab930010
-u32 A_int_no_msgout2_used[] = {
+static u32 A_int_no_msgout2_used[] __attribute((unused)) = {
 	0x000002c1,
 };
 
 #define A_int_no_msgout3	0xab930011
-u32 A_int_no_msgout3_used[] = {
+static u32 A_int_no_msgout3_used[] __attribute((unused)) = {
 	0x00000301,
 };
 
 #define A_int_not_cmd_complete	0xab930012
-u32 A_int_not_cmd_complete_used[] = {
+static u32 A_int_not_cmd_complete_used[] __attribute((unused)) = {
 	0x00000031,
 };
 
 #define A_int_not_rej	0xab93001c
-u32 A_int_not_rej_used[] = {
+static u32 A_int_not_rej_used[] __attribute((unused)) = {
 	0x0000030d,
 };
 
 #define A_int_resel_not_msgin	0xab930016
-u32 A_int_resel_not_msgin_used[] = {
+static u32 A_int_resel_not_msgin_used[] __attribute((unused)) = {
 	0x00000317,
 };
 
 #define A_int_reselected	0xab930017
-u32 A_int_reselected_used[] = {
+static u32 A_int_reselected_used[] __attribute((unused)) = {
 	0x0000031b,
 };
 
 #define A_int_sel_no_ident	0xab930013
-u32 A_int_sel_no_ident_used[] = {
+static u32 A_int_sel_no_ident_used[] __attribute((unused)) = {
 	0x0000000f,
 };
 
 #define A_int_sel_not_cmd	0xab930014
-u32 A_int_sel_not_cmd_used[] = {
+static u32 A_int_sel_not_cmd_used[] __attribute((unused)) = {
 	0x00000019,
 };
 
 #define A_int_selected	0xab930018
-u32 A_int_selected_used[] = {
+static u32 A_int_selected_used[] __attribute((unused)) = {
 	0x0000032d,
 };
 
 #define A_int_status_not_msgin	0xab930015
-u32 A_int_status_not_msgin_used[] = {
+static u32 A_int_status_not_msgin_used[] __attribute((unused)) = {
 	0x0000002d,
 };
 
 #define A_msgin_buf	0x00000000
-u32 A_msgin_buf_used[] = {
+static u32 A_msgin_buf_used[] __attribute((unused)) = {
 	0x0000024b,
 	0x0000025f,
 	0x00000267,
@@ -2280,7 +2280,7 @@ u32 A_msgin_buf_used[] = {
 };
 
 #define A_reselected_identify	0x00000000
-u32 A_reselected_identify_used[] = {
+static u32 A_reselected_identify_used[] __attribute((unused)) = {
 	0x00000319,
 };
 
@@ -2304,7 +2304,7 @@ u32 A_reselected_identify_used[] = {
 #define Ent_wait_disc2	0x00000ad0
 #define Ent_wait_disc3	0x00000bd0
 #define Ent_wait_disc_complete	0x000000d0
-u32 LABELPATCHES[] = {
+static u32 LABELPATCHES[] __attribute((unused)) = {
 	0x00000007,
 	0x00000009,
 	0x00000015,
@@ -2349,12 +2349,12 @@ u32 LABELPATCHES[] = {
 	0x0000032b,
 };
 
-struct {
+static struct {
 	u32	offset;
 	void		*address;
-} EXTERNAL_PATCHES[] = {
+} EXTERNAL_PATCHES[] __attribute((unused)) = {
 };
 
-u32 INSTRUCTIONS	= 407;
-u32 PATCHES	= 42;
-u32 EXTERNAL_PATCHES_LEN	= 0;
+static u32 INSTRUCTIONS __attribute((unused))	= 407;
+static u32 PATCHES __attribute((unused))	= 42;
+static u32 EXTERNAL_PATCHES_LEN __attribute((unused))	= 0;
diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c
index 093990914809..a0662f9c55d3 100644
--- a/drivers/scsi/sr_ioctl.c
+++ b/drivers/scsi/sr_ioctl.c
@@ -751,7 +751,10 @@ int sr_dev_ioctl(struct cdrom_device_info *cdi,
 	lba = (((msf.cdmsf_min0 * CD_SECS) + msf.cdmsf_sec0)
 			* CD_FRAMES + msf.cdmsf_frame0) - CD_MSF_OFFSET;
         if (lba < 0 || lba >= scsi_CDs[target].capacity)
+        {
+            scsi_free(raw, 2048+512);
             return -EINVAL;
+        }
 
         rc = sr_read_sector(target, lba, blocksize, raw);
 	if (!rc)
diff --git a/fs/dcache.c b/fs/dcache.c
index 2035410d2a1d..e8d2c543f11d 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -221,7 +221,8 @@ static inline int prune_one_dentry(struct dentry * dentry)
 	ret = dentry_iput(dentry);
 	parent = dentry->d_parent;
 	d_free(dentry);
-	dput(parent);
+	if (parent != dentry)
+		dput(parent);
 
 	return ret;
 }
diff --git a/include/asm-sparc64/pgtable.h b/include/asm-sparc64/pgtable.h
index 8602d380dcf5..4ec01823d57a 100644
--- a/include/asm-sparc64/pgtable.h
+++ b/include/asm-sparc64/pgtable.h
@@ -1,4 +1,4 @@
-/* $Id: pgtable.h,v 1.103.2.1 1999/08/07 10:52:55 davem Exp $
+/* $Id: pgtable.h,v 1.103.2.2 1999/12/05 07:24:45 davem Exp $
  * pgtable.h: SpitFire page table operations.
  *
  * Copyright 1996,1997 David S. Miller (davem@caip.rutgers.edu)
@@ -332,7 +332,7 @@ static __inline__ pte_t pte_mkdirty(pte_t _pte)
 #else
 extern struct pgtable_cache_struct {
 	unsigned long *pgd_cache;
-	unsigned long *pte_cache;
+	unsigned long *pte_cache[2];
 	unsigned int pgcache_size;
 	unsigned int pgdcache_size;
 } pgt_quicklists;
@@ -429,9 +429,12 @@ extern pmd_t *get_pmd_slow(pgd_t *pgd, unsigned long address_premasked);
 extern __inline__ pmd_t *get_pmd_fast(void)
 {
 	unsigned long *ret;
+	int color = 0;
 
-	if((ret = (unsigned long *)pte_quicklist) != NULL) {
-		pte_quicklist = (unsigned long *)(*ret);
+	if (pte_quicklist[color] == NULL)
+		color = 1;
+	if((ret = (unsigned long *)pte_quicklist[color]) != NULL) {
+		pte_quicklist[color] = (unsigned long *)(*ret);
 		ret[0] = 0;
 		pgtable_cache_size--;
 	}
@@ -440,8 +443,10 @@ extern __inline__ pmd_t *get_pmd_fast(void)
 
 extern __inline__ void free_pmd_fast(pgd_t *pmd)
 {
-	*(unsigned long *)pmd = (unsigned long) pte_quicklist;
-	pte_quicklist = (unsigned long *) pmd;
+	int color = (int) (((long)pmd >> PAGE_SHIFT) & 0x1);
+
+	*(unsigned long *)pmd = (unsigned long) pte_quicklist[color];
+	pte_quicklist[color] = (unsigned long *) pmd;
 	pgtable_cache_size++;
 }
 
@@ -450,14 +455,15 @@ extern __inline__ void free_pmd_slow(pmd_t *pmd)
 	free_page((unsigned long)pmd);
 }
 
-extern pte_t *get_pte_slow(pmd_t *pmd, unsigned long address_preadjusted);
+extern pte_t *get_pte_slow(pmd_t *pmd, unsigned long address_preadjusted,
+			   unsigned long color);
 
-extern __inline__ pte_t *get_pte_fast(void)
+extern __inline__ pte_t *get_pte_fast(unsigned long color)
 {
 	unsigned long *ret;
 
-	if((ret = (unsigned long *)pte_quicklist) != NULL) {
-		pte_quicklist = (unsigned long *)(*ret);
+	if((ret = (unsigned long *)pte_quicklist[color]) != NULL) {
+		pte_quicklist[color] = (unsigned long *)(*ret);
 		ret[0] = 0;
 		pgtable_cache_size--;
 	}
@@ -466,8 +472,9 @@ extern __inline__ pte_t *get_pte_fast(void)
 
 extern __inline__ void free_pte_fast(pte_t *pte)
 {
-	*(unsigned long *)pte = (unsigned long) pte_quicklist;
-	pte_quicklist = (unsigned long *) pte;
+	unsigned long color = (((unsigned long)pte >> PAGE_SHIFT) & 0x1);
+	*(unsigned long *)pte = (unsigned long) pte_quicklist[color];
+	pte_quicklist[color] = (unsigned long *) pte;
 	pgtable_cache_size++;
 }
 
@@ -487,10 +494,12 @@ extern inline pte_t * pte_alloc(pmd_t *pmd, unsigned long address)
 {
 	address = (address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1);
 	if (pmd_none(*pmd)) {
-		pte_t *page = get_pte_fast();
+		/* Be careful, address can be just about anything... */
+		unsigned long color = (((unsigned long)pmd)>>2UL) & 0x1UL;
+		pte_t *page = get_pte_fast(color);
 
 		if (!page)
-			return get_pte_slow(pmd, address);
+			return get_pte_slow(pmd, address, color);
 		pmd_set(pmd, page);
 		return page + address;
 	}
diff --git a/include/asm-sparc64/smp.h b/include/asm-sparc64/smp.h
index c5e99dab3d94..15c8080e248b 100644
--- a/include/asm-sparc64/smp.h
+++ b/include/asm-sparc64/smp.h
@@ -33,19 +33,19 @@ extern struct prom_cpuinfo linux_cpus[64];
 /* Keep this a multiple of 64-bytes for cache reasons. */
 struct cpuinfo_sparc {
 	/* Dcache line 1 */
-	unsigned long	irq_count;
-	unsigned long	bh_count;
+	unsigned int	irq_count;
+	unsigned int	bh_count;
 	unsigned int	multiplier;
 	unsigned int	counter;
+	unsigned int	idle_volume;
+	unsigned int	__pad;
 	unsigned long	udelay_val;
 
 	/* Dcache line 2 */
 	unsigned int	pgcache_size;
 	unsigned int	pgdcache_size;
-	unsigned long	*pte_cache;
+	unsigned long	*pte_cache[2];
 	unsigned long	*pgd_cache;
-	unsigned int	idle_volume;
-	unsigned int	__pad;
 
 	/* Dcache lines 3 and 4 */
 	unsigned int	irq_worklists[16];
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index e0513541cefa..18dc9c766c8a 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1266,7 +1266,6 @@ static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
 	newsk->sleep = &newsock->wait;
 
 	/* Now attach up the new socket */
-	skb->sk = NULL;
 	skb->destructor = NULL;
 	kfree_skb(skb);
 	sk->ack_backlog--;
diff --git a/net/ipv4/ip_fw.c b/net/ipv4/ip_fw.c
index 56bd78dcb7a1..400f46c0f8c6 100644
--- a/net/ipv4/ip_fw.c
+++ b/net/ipv4/ip_fw.c
@@ -40,11 +40,12 @@
  * 23-Jul-1999: Fixed small fragment security exposure opened on 15-May-1998.
  *              John McDonald <jm@dataprotect.com>
  *              Thomas Lopatic <tl@dataprotect.com>
+ * 21-Oct-1999: Applied count fix by Emanuele Caratti <wiz@iol.it> --RR
  */
 
 /*
  *
- * The origina Linux port was done Alan Cox, with changes/fixes from
+ * The original Linux port was done Alan Cox, with changes/fixes from
  * Pauline Middlelink, Jos Vos, Thomas Quinot, Wouter Gadeyne, Juan
  * Jose Ciarlante, Bernd Eckenfels, Keith Owens and others.
  * 
@@ -229,6 +230,7 @@ struct ip_reent
 {
 	struct ip_chain *prevchain;	/* Pointer to referencing chain */
 	struct ip_fwkernel *prevrule;	/* Pointer to referencing rule */
+	unsigned int count;
 	struct ip_counters counters;
 };
 
@@ -733,8 +735,8 @@ ip_fw_check(struct iphdr *ip,
 	else FWC_HAVE_LOCK(fwc_rlocks);
 
 	f = chain->chain;
+	count = 0;
 	do {
-		count = 0;
 		for (; f; f = f->next) {
 			count++;
 			if (ip_rule_match(f,rif,ip,
@@ -772,10 +774,12 @@ ip_fw_check(struct iphdr *ip,
 				else {
 					f->branch->reent[slot].prevchain 
 						= chain;
+					f->branch->reent[slot].count = count;
 					f->branch->reent[slot].prevrule 
 						= f->next;
 					chain = f->branch;
 					f = chain->chain;
+					count = 0;
 				}
 			}
 			else if (f->simplebranch == FW_SKIP) 
@@ -794,6 +798,7 @@ ip_fw_check(struct iphdr *ip,
 			if (chain->reent[slot].prevchain) {
 				struct ip_chain *tmp = chain;
 				f = chain->reent[slot].prevrule;
+				count = chain->reent[slot].count;
 				chain = chain->reent[slot].prevchain;
 				tmp->reent[slot].prevchain = NULL;
 			}
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index b1725fa308ef..545f093c14a4 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -97,6 +97,7 @@
  *		Alan Cox	:	Multicast routing hooks
  *		Jos Vos		:	Do accounting *before* call_in_firewall
  *	Willy Konynenberg	:	Transparent proxying support
+ *             Stephan Uphoff   :       Check IP header length field
  *
  *  
  *
@@ -421,6 +422,10 @@ int ip_rcv(struct sk_buff *skb, struct device *dev, struct packet_type *pt)
 
 	if (skb->len < sizeof(struct iphdr))
 		goto inhdr_error; 
+
+	if (skb->len < (iph->ihl << 2))
+		goto inhdr_error;
+
 	if (iph->ihl < 5 || iph->version != 4 || ip_fast_csum((u8 *)iph, iph->ihl) != 0)
 		goto inhdr_error; 
 
@@ -429,6 +434,9 @@ int ip_rcv(struct sk_buff *skb, struct device *dev, struct packet_type *pt)
 	if (skb->len < len)
 		goto inhdr_error; 
 
+	if (len <  (iph->ihl << 2))
+		goto inhdr_error; 
+
 	/*
 	 *	Our transport medium may have padded the buffer out. Now we know it
 	 *	is IP we can trim to the true length of the frame.
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index fb4e8f8007e0..62884aae815b 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -9,7 +9,7 @@
  *      as published by the Free Software Foundation; either version
  *      2 of the License, or (at your option) any later version.
  * 
- *  $Id: syncookies.c,v 1.7.2.1 1999/08/08 08:43:13 davem Exp $
+ *  $Id: syncookies.c,v 1.7.2.3 1999/12/07 03:11:07 davem Exp $
  *
  *  Missing: IPv6 support. 
  */
@@ -184,8 +184,10 @@ cookie_v4_check(struct sock *sk, struct sk_buff *skb, struct ip_options *opt)
 			    req->af.v4_req.loc_addr,
 			    sk->ip_tos | RTO_CONN,
 			    0)) { 
-	    tcp_openreq_free(req);
-	    return NULL; 
+		if (req->af.v4_req.opt)
+			kfree(req->af.v4_req.opt);
+		tcp_openreq_free(req);
+		return NULL; 
 	}
 
 	/* Try to redo what tcp_v4_send_synack did. */
diff --git a/scripts/Menuconfig b/scripts/Menuconfig
index a25722756076..f464f3dfd344 100644
--- a/scripts/Menuconfig
+++ b/scripts/Menuconfig
@@ -54,7 +54,7 @@
 # Change a lot of places to call set_x_info uniformly.
 # Take out message about preparing version (old sound driver cruft).
 #
-# 13 Dec 1998, Riley H Williams (rhw@bigfoot.com)
+# 13 Dec 1998, Riley H Williams <rhw@memalpha.cx>
 # When an error occurs, actually display the error message as well as
 # our comments thereon.
 #
-- 
2.39.5