Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (25 commits)
  [Bluetooth] Use work queue to trigger URB submission
  [Bluetooth] Add locking for bt_proto array manipulation
  [Bluetooth] Check if DLC is still attached to the TTY
  [Bluetooth] Fix reference count when connection lookup fails
  [Bluetooth] Disconnect HID interrupt channel first
  [Bluetooth] Support concurrent connect requests
  [Bluetooth] Make use of virtual devices tree
  [Bluetooth] Handle return values from driver core functions
  [Bluetooth] Fix compat ioctl for BNEP, CMTP and HIDP
  [IPV6] sit: Add missing MODULE_LICENSE
  [IPV6]: Remove bogus WARN_ON in Proxy-NA handling.
  [IPv6] rules: Use RT6_LOOKUP_F_HAS_SADDR and fix source based selectors
  [XFRM]: Fix xfrm_state_num going negative.
  [NET]: reduce sizeof(struct inet_peer), cleanup, change in peer_check_expire()
  NetLabel: the CIPSOv4 passthrough mapping does not pass categories correctly
  NetLabel: better error handling involving mls_export_cat()
  NetLabel: only deref the CIPSOv4 standard map fields when using standard mapping
  [BRIDGE]: flush forwarding table when device carrier off
  [NETFILTER]: ctnetlink: Remove debugging messages
  [NETFILTER]: Update MAINTAINERS entry
  ...

diff --git a/drivers/char/rio/rioctrl.c b/drivers/char/rio/rioctrl.c
index 052e812..7ce7761 100644 (file)
--- a/drivers/char/rio/rioctrl.c
+++ b/drivers/char/rio/rioctrl.c
@@ -662,7 +662,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
                        p->RIOError.Error = COPYIN_FAILED;
                        return -EFAULT;
                }
-               if (portStats.port >= RIO_PORTS) {
+               if (portStats.port < 0 || portStats.port >= RIO_PORTS) {
                        p->RIOError.Error = PORT_NUMBER_OUT_OF_RANGE;
                        return -ENXIO;
                }
@@ -702,7 +702,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
                        p->RIOError.Error = COPYIN_FAILED;
                        return -EFAULT;
                }
-               if (portStats.port >= RIO_PORTS) {
+               if (portStats.port < 0 || portStats.port >= RIO_PORTS) {
                        p->RIOError.Error = PORT_NUMBER_OUT_OF_RANGE;
                        return -ENXIO;
                }

diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
index 1d0470c..30175c7 100644 (file)
--- a/drivers/ide/ide-taskfile.c
+++ b/drivers/ide/ide-taskfile.c
@@ -524,8 +524,8 @@ int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg)
        task_ioreg_t *hobsptr   = args.hobRegister;
        int err                 = 0;
        int tasksize            = sizeof(struct ide_task_request_s);
-       int taskin              = 0;
-       int taskout             = 0;
+       unsigned int taskin     = 0;
+       unsigned int taskout    = 0;
        u8 io_32bit             = drive->io_32bit;
        char __user *buf = (char __user *)arg;
 
@@ -538,8 +538,13 @@ int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg)
                return -EFAULT;
        }
 
-       taskout = (int) req_task->out_size;
-       taskin  = (int) req_task->in_size;
+       taskout = req_task->out_size;
+       taskin  = req_task->in_size;
+       
+       if (taskin > 65536 || taskout > 65536) {
+               err = -EINVAL;
+               goto abort;
+       }
 
        if (taskout) {
                int outtotal = tasksize;

diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index c0edb66..7bac86d 100644 (file)
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -884,7 +884,7 @@ megaraid_init_mbox(adapter_t *adapter)
 
        if (((magic64 == HBA_SIGNATURE_64_BIT) &&
                ((adapter->pdev->subsystem_device !=
-               PCI_SUBSYS_ID_MEGARAID_SATA_150_6) ||
+               PCI_SUBSYS_ID_MEGARAID_SATA_150_6) &&
                (adapter->pdev->subsystem_device !=
                PCI_SUBSYS_ID_MEGARAID_SATA_150_4))) ||
                (adapter->pdev->vendor == PCI_VENDOR_ID_LSI_LOGIC &&

diff --git a/include/asm-frv/highmem.h b/include/asm-frv/highmem.h
index e2247c2..0f390f4 100644 (file)
--- a/include/asm-frv/highmem.h
+++ b/include/asm-frv/highmem.h
@@ -82,11 +82,11 @@ extern struct page *kmap_atomic_to_page(void *ptr);
        dampr = paddr | xAMPRx_L | xAMPRx_M | xAMPRx_S | xAMPRx_SS_16Kb | xAMPRx_V;             \
                                                                                                \
        if (type != __KM_CACHE)                                                                 \
-               asm volatile("movgs %0,dampr"#ampr :: "r"(dampr));                              \
+               asm volatile("movgs %0,dampr"#ampr :: "r"(dampr) : "memory");                   \
        else                                                                                    \
                asm volatile("movgs %0,iampr"#ampr"\n"                                          \
                             "movgs %0,dampr"#ampr"\n"                                          \
-                            :: "r"(dampr)                                                      \
+                            :: "r"(dampr) : "memory"                                           \
                             );                                                                 \
                                                                                                \
        asm("movsg damlr"#ampr",%0" : "=r"(damlr));                                             \
@@ -104,7 +104,7 @@ extern struct page *kmap_atomic_to_page(void *ptr);
        asm volatile("movgs %0,tplr \n"                                                           \
                     "movgs %1,tppr \n"                                                           \
                     "tlbpr %0,gr0,#2,#1"                                                         \
-                    : : "r"(damlr), "r"(dampr));                                                 \
+                    : : "r"(damlr), "r"(dampr) : "memory");                                      \
                                                                                                  \
        /*printk("TLB: SECN sl=%d L=%08lx P=%08lx\n", slot, damlr, dampr);*/                      \
                                                                                                  \
@@ -115,7 +115,7 @@ static inline void *kmap_atomic(struct page *page, enum km_type type)
 {
        unsigned long paddr;
 
-       preempt_disable();
+       inc_preempt_count();
        paddr = page_to_phys(page);
 
        switch (type) {
@@ -138,16 +138,16 @@ static inline void *kmap_atomic(struct page *page, enum km_type type)
        }
 }
 
-#define __kunmap_atomic_primary(type, ampr)                    \
-do {                                                           \
-       asm volatile("movgs gr0,dampr"#ampr"\n");               \
-       if (type == __KM_CACHE)                                 \
-               asm volatile("movgs gr0,iampr"#ampr"\n");       \
+#define __kunmap_atomic_primary(type, ampr)                            \
+do {                                                                   \
+       asm volatile("movgs gr0,dampr"#ampr"\n" ::: "memory");          \
+       if (type == __KM_CACHE)                                         \
+               asm volatile("movgs gr0,iampr"#ampr"\n" ::: "memory");  \
 } while(0)
 
-#define __kunmap_atomic_secondary(slot, vaddr)                 \
-do {                                                           \
-       asm volatile("tlbpr %0,gr0,#4,#1" : : "r"(vaddr));      \
+#define __kunmap_atomic_secondary(slot, vaddr)                         \
+do {                                                                   \
+       asm volatile("tlbpr %0,gr0,#4,#1" : : "r"(vaddr) : "memory");   \
 } while(0)
 
 static inline void kunmap_atomic(void *kvaddr, enum km_type type)
@@ -170,7 +170,8 @@ static inline void kunmap_atomic(void *kvaddr, enum km_type type)
        default:
                BUG();
        }
-       preempt_enable();
+       dec_preempt_count();
+       preempt_check_resched();
 }
 
 #endif /* !__ASSEMBLY__ */