rpms/kernel/devel git-linus.diff,1.7,1.8 kernel.spec,1.900,1.901
Dave Jones
davej at fedoraproject.org
Tue Aug 26 01:38:04 UTC 2008
Author: davej
Update of /cvs/pkgs/rpms/kernel/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv8548
Modified Files:
git-linus.diff kernel.spec
Log Message:
Merge Linux-2.6 up to commit b8e6c91c74e9f0279b7c51048779b3d62da60b88
git-linus.diff:
Index: git-linus.diff
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/git-linus.diff,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- git-linus.diff 5 Aug 2008 15:39:14 -0000 1.7
+++ git-linus.diff 26 Aug 2008 01:38:04 -0000 1.8
@@ -0,0 +1,551 @@
+diff --git a/drivers/net/bnx2x.h b/drivers/net/bnx2x.h
+index b468f90..a14dba1 100644
+--- a/drivers/net/bnx2x.h
++++ b/drivers/net/bnx2x.h
+@@ -271,7 +271,7 @@ struct bnx2x_fastpath {
+ (fp->tx_pkt_prod != fp->tx_pkt_cons))
+
+ #define BNX2X_HAS_RX_WORK(fp) \
+- (fp->rx_comp_cons != le16_to_cpu(*fp->rx_cons_sb))
++ (fp->rx_comp_cons != rx_cons_sb)
+
+ #define BNX2X_HAS_WORK(fp) (BNX2X_HAS_RX_WORK(fp) || BNX2X_HAS_TX_WORK(fp))
+
+diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
+index 971576b..82deea0 100644
+--- a/drivers/net/bnx2x_main.c
++++ b/drivers/net/bnx2x_main.c
+@@ -59,8 +59,8 @@
+ #include "bnx2x.h"
+ #include "bnx2x_init.h"
+
+-#define DRV_MODULE_VERSION "1.45.17"
+-#define DRV_MODULE_RELDATE "2008/08/13"
++#define DRV_MODULE_VERSION "1.45.20"
++#define DRV_MODULE_RELDATE "2008/08/25"
+ #define BNX2X_BC_VER 0x040200
+
+ /* Time in jiffies before concluding the transmitter is hung */
+@@ -1717,8 +1717,8 @@ static int bnx2x_acquire_hw_lock(struct bnx2x *bp, u32 resource)
+ return -EEXIST;
+ }
+
+- /* Try for 1 second every 5ms */
+- for (cnt = 0; cnt < 200; cnt++) {
++ /* Try for 5 second every 5ms */
++ for (cnt = 0; cnt < 1000; cnt++) {
+ /* Try to acquire the lock */
+ REG_WR(bp, hw_lock_control_reg + 4, resource_bit);
+ lock_status = REG_RD(bp, hw_lock_control_reg);
+@@ -2550,6 +2550,7 @@ static inline void bnx2x_attn_int_deasserted0(struct bnx2x *bp, u32 attn)
+ BNX2X_ERR("SPIO5 hw attention\n");
+
+ switch (bp->common.board & SHARED_HW_CFG_BOARD_TYPE_MASK) {
++ case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1021G:
+ case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1022G:
+ /* Fan failure attention */
+
+@@ -4605,6 +4606,17 @@ static void bnx2x_init_internal_common(struct bnx2x *bp)
+ {
+ int i;
+
++ if (bp->flags & TPA_ENABLE_FLAG) {
++ struct tstorm_eth_tpa_exist tpa = {0};
++
++ tpa.tpa_exist = 1;
++
++ REG_WR(bp, BAR_TSTRORM_INTMEM + TSTORM_TPA_EXIST_OFFSET,
++ ((u32 *)&tpa)[0]);
++ REG_WR(bp, BAR_TSTRORM_INTMEM + TSTORM_TPA_EXIST_OFFSET + 4,
++ ((u32 *)&tpa)[1]);
++ }
++
+ /* Zero this manually as its initialization is
+ currently missing in the initTool */
+ for (i = 0; i < (USTORM_AGG_DATA_SIZE >> 2); i++)
+@@ -5337,6 +5349,7 @@ static int bnx2x_init_common(struct bnx2x *bp)
+ }
+
+ switch (bp->common.board & SHARED_HW_CFG_BOARD_TYPE_MASK) {
++ case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1021G:
+ case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1022G:
+ /* Fan failure is indicated by SPIO 5 */
+ bnx2x_set_spio(bp, MISC_REGISTERS_SPIO_5,
+@@ -5363,17 +5376,6 @@ static int bnx2x_init_common(struct bnx2x *bp)
+
+ enable_blocks_attention(bp);
+
+- if (bp->flags & TPA_ENABLE_FLAG) {
+- struct tstorm_eth_tpa_exist tmp = {0};
+-
+- tmp.tpa_exist = 1;
+-
+- REG_WR(bp, BAR_TSTRORM_INTMEM + TSTORM_TPA_EXIST_OFFSET,
+- ((u32 *)&tmp)[0]);
+- REG_WR(bp, BAR_TSTRORM_INTMEM + TSTORM_TPA_EXIST_OFFSET + 4,
+- ((u32 *)&tmp)[1]);
+- }
+-
+ if (!BP_NOMCP(bp)) {
+ bnx2x_acquire_phy_lock(bp);
+ bnx2x_common_init_phy(bp, bp->common.shmem_base);
+@@ -5531,6 +5533,7 @@ static int bnx2x_init_port(struct bnx2x *bp)
+ /* Port DMAE comes here */
+
+ switch (bp->common.board & SHARED_HW_CFG_BOARD_TYPE_MASK) {
++ case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1021G:
+ case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1022G:
+ /* add SPIO 5 to group 0 */
+ val = REG_RD(bp, MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
+@@ -6055,6 +6058,44 @@ static int bnx2x_req_irq(struct bnx2x *bp)
+ return rc;
+ }
+
++static void bnx2x_napi_enable(struct bnx2x *bp)
++{
++ int i;
++
++ for_each_queue(bp, i)
++ napi_enable(&bnx2x_fp(bp, i, napi));
++}
++
++static void bnx2x_napi_disable(struct bnx2x *bp)
++{
++ int i;
++
++ for_each_queue(bp, i)
++ napi_disable(&bnx2x_fp(bp, i, napi));
++}
++
++static void bnx2x_netif_start(struct bnx2x *bp)
++{
++ if (atomic_dec_and_test(&bp->intr_sem)) {
++ if (netif_running(bp->dev)) {
++ if (bp->state == BNX2X_STATE_OPEN)
++ netif_wake_queue(bp->dev);
++ bnx2x_napi_enable(bp);
++ bnx2x_int_enable(bp);
++ }
++ }
++}
++
++static void bnx2x_netif_stop(struct bnx2x *bp)
++{
++ bnx2x_int_disable_sync(bp);
++ if (netif_running(bp->dev)) {
++ bnx2x_napi_disable(bp);
++ netif_tx_disable(bp->dev);
++ bp->dev->trans_start = jiffies; /* prevent tx timeout */
++ }
++}
++
+ /*
+ * Init service functions
+ */
+@@ -6338,7 +6379,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
+ rc = bnx2x_init_hw(bp, load_code);
+ if (rc) {
+ BNX2X_ERR("HW init failed, aborting\n");
+- goto load_error;
++ goto load_int_disable;
+ }
+
+ /* Setup NIC internals and enable interrupts */
+@@ -6350,7 +6391,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
+ if (!load_code) {
+ BNX2X_ERR("MCP response failure, aborting\n");
+ rc = -EBUSY;
+- goto load_int_disable;
++ goto load_rings_free;
+ }
+ }
+
+@@ -6360,8 +6401,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
+
+ /* Enable Rx interrupt handling before sending the ramrod
+ as it's completed on Rx FP queue */
+- for_each_queue(bp, i)
+- napi_enable(&bnx2x_fp(bp, i, napi));
++ bnx2x_napi_enable(bp);
+
+ /* Enable interrupt handling */
+ atomic_set(&bp->intr_sem, 0);
+@@ -6369,7 +6409,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
+ rc = bnx2x_setup_leading(bp);
+ if (rc) {
+ BNX2X_ERR("Setup leading failed!\n");
+- goto load_stop_netif;
++ goto load_netif_stop;
+ }
+
+ if (CHIP_IS_E1H(bp))
+@@ -6382,7 +6422,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
+ for_each_nondefault_queue(bp, i) {
+ rc = bnx2x_setup_multi(bp, i);
+ if (rc)
+- goto load_stop_netif;
++ goto load_netif_stop;
+ }
+
+ if (CHIP_IS_E1(bp))
+@@ -6427,20 +6467,17 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
+
+ return 0;
+
+-load_stop_netif:
++load_netif_stop:
++ bnx2x_napi_disable(bp);
++load_rings_free:
++ /* Free SKBs, SGEs, TPA pool and driver internals */
++ bnx2x_free_skbs(bp);
+ for_each_queue(bp, i)
+- napi_disable(&bnx2x_fp(bp, i, napi));
+-
++ bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE);
+ load_int_disable:
+ bnx2x_int_disable_sync(bp);
+-
+ /* Release IRQs */
+ bnx2x_free_irq(bp);
+-
+- /* Free SKBs, SGEs, TPA pool and driver internals */
+- bnx2x_free_skbs(bp);
+- for_each_queue(bp, i)
+- bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE);
+ load_error:
+ bnx2x_free_mem(bp);
+
+@@ -6455,7 +6492,7 @@ static int bnx2x_stop_multi(struct bnx2x *bp, int index)
+
+ /* halt the connection */
+ bp->fp[index].state = BNX2X_FP_STATE_HALTING;
+- bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_HALT, index, 0, 0, 0);
++ bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_HALT, index, 0, index, 0);
+
+ /* Wait for completion */
+ rc = bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_HALTED, index,
+@@ -6613,11 +6650,9 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
+ bp->rx_mode = BNX2X_RX_MODE_NONE;
+ bnx2x_set_storm_rx_mode(bp);
+
+- if (netif_running(bp->dev)) {
+- netif_tx_disable(bp->dev);
+- bp->dev->trans_start = jiffies; /* prevent tx timeout */
+- }
+-
++ bnx2x_netif_stop(bp);
++ if (!netif_running(bp->dev))
++ bnx2x_napi_disable(bp);
+ del_timer_sync(&bp->timer);
+ SHMEM_WR(bp, func_mb[BP_FUNC(bp)].drv_pulse_mb,
+ (DRV_PULSE_ALWAYS_ALIVE | bp->fw_drv_pulse_wr_seq));
+@@ -6631,9 +6666,7 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
+ smp_rmb();
+ while (BNX2X_HAS_TX_WORK(fp)) {
+
+- if (!netif_running(bp->dev))
+- bnx2x_tx_int(fp, 1000);
+-
++ bnx2x_tx_int(fp, 1000);
+ if (!cnt) {
+ BNX2X_ERR("timeout waiting for queue[%d]\n",
+ i);
+@@ -6649,46 +6682,12 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
+ smp_rmb();
+ }
+ }
+-
+ /* Give HW time to discard old tx messages */
+ msleep(1);
+
+- for_each_queue(bp, i)
+- napi_disable(&bnx2x_fp(bp, i, napi));
+- /* Disable interrupts after Tx and Rx are disabled on stack level */
+- bnx2x_int_disable_sync(bp);
+-
+ /* Release IRQs */
+ bnx2x_free_irq(bp);
+
+- if (unload_mode == UNLOAD_NORMAL)
+- reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
+-
+- else if (bp->flags & NO_WOL_FLAG) {
+- reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP;
+- if (CHIP_IS_E1H(bp))
+- REG_WR(bp, MISC_REG_E1HMF_MODE, 0);
+-
+- } else if (bp->wol) {
+- u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
+- u8 *mac_addr = bp->dev->dev_addr;
+- u32 val;
+- /* The mac address is written to entries 1-4 to
+- preserve entry 0 which is used by the PMF */
+- u8 entry = (BP_E1HVN(bp) + 1)*8;
+-
+- val = (mac_addr[0] << 8) | mac_addr[1];
+- EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry, val);
+-
+- val = (mac_addr[2] << 24) | (mac_addr[3] << 16) |
+- (mac_addr[4] << 8) | mac_addr[5];
+- EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry + 4, val);
+-
+- reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_EN;
+-
+- } else
+- reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
+-
+ if (CHIP_IS_E1(bp)) {
+ struct mac_configuration_cmd *config =
+ bnx2x_sp(bp, mcast_config);
+@@ -6711,14 +6710,41 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
+ U64_LO(bnx2x_sp_mapping(bp, mcast_config)), 0);
+
+ } else { /* E1H */
++ REG_WR(bp, NIG_REG_LLH0_FUNC_EN + port*8, 0);
++
+ bnx2x_set_mac_addr_e1h(bp, 0);
+
+ for (i = 0; i < MC_HASH_SIZE; i++)
+ REG_WR(bp, MC_HASH_OFFSET(bp, i), 0);
+ }
+
+- if (CHIP_IS_E1H(bp))
+- REG_WR(bp, NIG_REG_LLH0_FUNC_EN + port*8, 0);
++ if (unload_mode == UNLOAD_NORMAL)
++ reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
++
++ else if (bp->flags & NO_WOL_FLAG) {
++ reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP;
++ if (CHIP_IS_E1H(bp))
++ REG_WR(bp, MISC_REG_E1HMF_MODE, 0);
++
++ } else if (bp->wol) {
++ u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
++ u8 *mac_addr = bp->dev->dev_addr;
++ u32 val;
++ /* The mac address is written to entries 1-4 to
++ preserve entry 0 which is used by the PMF */
++ u8 entry = (BP_E1HVN(bp) + 1)*8;
++
++ val = (mac_addr[0] << 8) | mac_addr[1];
++ EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry, val);
++
++ val = (mac_addr[2] << 24) | (mac_addr[3] << 16) |
++ (mac_addr[4] << 8) | mac_addr[5];
++ EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry + 4, val);
++
++ reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_EN;
++
++ } else
++ reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
+
+ /* Close multi and leading connections
+ Completions for ramrods are collected in a synchronous way */
+@@ -6821,6 +6847,10 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
+ */
+ bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+ val = REG_RD(bp, DORQ_REG_NORM_CID_OFST);
++ if (val == 0x7)
++ REG_WR(bp, DORQ_REG_NORM_CID_OFST, 0);
++ bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
++
+ if (val == 0x7) {
+ u32 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
+ /* save our func */
+@@ -6898,7 +6928,6 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
+ (SHMEM_RD(bp, func_mb[bp->func].drv_mb_header) &
+ DRV_MSG_SEQ_NUMBER_MASK);
+ }
+- bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+ }
+ }
+
+@@ -8617,34 +8646,6 @@ test_mem_exit:
+ return rc;
+ }
+
+-static void bnx2x_netif_start(struct bnx2x *bp)
+-{
+- int i;
+-
+- if (atomic_dec_and_test(&bp->intr_sem)) {
+- if (netif_running(bp->dev)) {
+- bnx2x_int_enable(bp);
+- for_each_queue(bp, i)
+- napi_enable(&bnx2x_fp(bp, i, napi));
+- if (bp->state == BNX2X_STATE_OPEN)
+- netif_wake_queue(bp->dev);
+- }
+- }
+-}
+-
+-static void bnx2x_netif_stop(struct bnx2x *bp)
+-{
+- int i;
+-
+- if (netif_running(bp->dev)) {
+- netif_tx_disable(bp->dev);
+- bp->dev->trans_start = jiffies; /* prevent tx timeout */
+- for_each_queue(bp, i)
+- napi_disable(&bnx2x_fp(bp, i, napi));
+- }
+- bnx2x_int_disable_sync(bp);
+-}
+-
+ static void bnx2x_wait_for_link(struct bnx2x *bp, u8 link_up)
+ {
+ int cnt = 1000;
+@@ -9250,6 +9251,7 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
+ napi);
+ struct bnx2x *bp = fp->bp;
+ int work_done = 0;
++ u16 rx_cons_sb;
+
+ #ifdef BNX2X_STOP_ON_ERROR
+ if (unlikely(bp->panic))
+@@ -9265,10 +9267,16 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
+ if (BNX2X_HAS_TX_WORK(fp))
+ bnx2x_tx_int(fp, budget);
+
++ rx_cons_sb = le16_to_cpu(*fp->rx_cons_sb);
++ if ((rx_cons_sb & MAX_RCQ_DESC_CNT) == MAX_RCQ_DESC_CNT)
++ rx_cons_sb++;
+ if (BNX2X_HAS_RX_WORK(fp))
+ work_done = bnx2x_rx_int(fp, budget);
+
+ rmb(); /* BNX2X_HAS_WORK() reads the status block */
++ rx_cons_sb = le16_to_cpu(*fp->rx_cons_sb);
++ if ((rx_cons_sb & MAX_RCQ_DESC_CNT) == MAX_RCQ_DESC_CNT)
++ rx_cons_sb++;
+
+ /* must not complete if we consumed full budget */
+ if ((work_done < budget) && !BNX2X_HAS_WORK(fp)) {
+@@ -9484,8 +9492,7 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ fp_index = (smp_processor_id() % bp->num_queues);
+ fp = &bp->fp[fp_index];
+
+- if (unlikely(bnx2x_tx_avail(bp->fp) <
+- (skb_shinfo(skb)->nr_frags + 3))) {
++ if (unlikely(bnx2x_tx_avail(fp) < (skb_shinfo(skb)->nr_frags + 3))) {
+ bp->eth_stats.driver_xoff++,
+ netif_stop_queue(dev);
+ BNX2X_ERR("BUG! Tx ring full when queue awake!\n");
+@@ -9548,7 +9555,6 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ tx_bd->vlan = cpu_to_le16(pkt_prod);
+
+ if (xmit_type) {
+-
+ /* turn on parsing and get a BD */
+ bd_prod = TX_BD(NEXT_TX_IDX(bd_prod));
+ pbd = (void *)&fp->tx_desc_ring[bd_prod];
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index cca921e..e91bafe 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -3116,14 +3116,23 @@ static ctl_table ipv4_route_table[] = {
+ { .ctl_name = 0 }
+ };
+
+-static __net_initdata struct ctl_path ipv4_route_path[] = {
++static struct ctl_table empty[1];
++
++static struct ctl_table ipv4_skeleton[] =
++{
++ { .procname = "route", .ctl_name = NET_IPV4_ROUTE,
++ .child = ipv4_route_table},
++ { .procname = "neigh", .ctl_name = NET_IPV4_NEIGH,
++ .child = empty},
++ { }
++};
++
++static __net_initdata struct ctl_path ipv4_path[] = {
+ { .procname = "net", .ctl_name = CTL_NET, },
+ { .procname = "ipv4", .ctl_name = NET_IPV4, },
+- { .procname = "route", .ctl_name = NET_IPV4_ROUTE, },
+ { },
+ };
+
+-
+ static struct ctl_table ipv4_route_flush_table[] = {
+ {
+ .ctl_name = NET_IPV4_ROUTE_FLUSH,
+@@ -3136,6 +3145,13 @@ static struct ctl_table ipv4_route_flush_table[] = {
+ { .ctl_name = 0 },
+ };
+
++static __net_initdata struct ctl_path ipv4_route_path[] = {
++ { .procname = "net", .ctl_name = CTL_NET, },
++ { .procname = "ipv4", .ctl_name = NET_IPV4, },
++ { .procname = "route", .ctl_name = NET_IPV4_ROUTE, },
++ { },
++};
++
+ static __net_init int sysctl_route_net_init(struct net *net)
+ {
+ struct ctl_table *tbl;
+@@ -3287,7 +3303,7 @@ int __init ip_rt_init(void)
+ */
+ void __init ip_static_sysctl_init(void)
+ {
+- register_sysctl_paths(ipv4_route_path, ipv4_route_table);
++ register_sysctl_paths(ipv4_path, ipv4_skeleton);
+ }
+ #endif
+
+diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
+index e6dfaea..587f8f6 100644
+--- a/net/ipv6/sysctl_net_ipv6.c
++++ b/net/ipv6/sysctl_net_ipv6.c
+@@ -156,7 +156,7 @@ static struct ctl_table_header *ip6_base;
+ int ipv6_static_sysctl_register(void)
+ {
+ static struct ctl_table empty[1];
+- ip6_base = register_net_sysctl_rotable(net_ipv6_ctl_path, empty);
++ ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty);
+ if (ip6_base == NULL)
+ return -ENOMEM;
+ return 0;
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index 675a5c3..1fcb4cf 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -80,6 +80,10 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
+ {
+ struct sctp_auth_bytes *key;
+
++ /* Verify that we are not going to overflow INT_MAX */
++ if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
++ return NULL;
++
+ /* Allocate the shared key */
+ key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp);
+ if (!key)
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index bb5c9ef..afa952e 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -3144,6 +3144,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
+ goto out;
+ }
+
++ if (authkey->sca_keylength > optlen) {
++ ret = -EINVAL;
++ goto out;
++ }
++
+ asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
+ if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
+ ret = -EINVAL;
+diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c
+index 03a274b..6abe8a3 100644
+--- a/sound/pci/ca0106/ca0106_main.c
++++ b/sound/pci/ca0106/ca0106_main.c
+@@ -254,7 +254,7 @@ static struct snd_ca0106_details ca0106_chip_details[] = {
+ .name = "MSI K8N Diamond MB",
+ .gpio_type = 2,
+ .i2c_adc = 1,
+- .spi_dac = 2 }
++ .spi_dac = 2 },
+ /* Shuttle XPC SD31P which has an onboard Creative Labs
+ * Sound Blaster Live! 24-bit EAX
+ * high-definition 7.1 audio processor".
Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/kernel.spec,v
retrieving revision 1.900
retrieving revision 1.901
diff -u -r1.900 -r1.901
--- kernel.spec 26 Aug 2008 00:57:45 -0000 1.900
+++ kernel.spec 26 Aug 2008 01:38:04 -0000 1.901
@@ -970,7 +970,7 @@
done
%endif
-#ApplyPatch git-linus.diff
+ApplyPatch git-linus.diff
# This patch adds a "make nonint_oldconfig" which is non-interactive and
# also gives a list of missing options at the end. Useful for automated
@@ -1740,6 +1740,9 @@
%changelog
* Mon Aug 25 2008 Dave Jones <davej at redhat.com>
+- Merge Linux-2.6 up to commit b8e6c91c74e9f0279b7c51048779b3d62da60b88
+
+* Mon Aug 25 2008 Dave Jones <davej at redhat.com>
- 2.6.27-rc4-git4 (Drop NR_CPUS on x86-64 to 512)
* Sun Aug 24 2008 Dave Jones <davej at redhat.com>
More information about the fedora-extras-commits
mailing list