r2495 - in trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian: . patches patches/series
Joshua Kwan
joshk@costa.debian.org
Wed, 16 Feb 2005 08:31:32 +0100
Author: joshk
Date: 2005-02-16 08:31:30 +0100 (Wed, 16 Feb 2005)
New Revision: 2495
Added:
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/101-2.4.29-flash_erase-checks-cap_sys_admin-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/102-2.4.29-rw_verify_area-against-file-offset-overflow-2
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/103-2.4.29-rw_verify_area-missing-f_maxcount-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/104-2.4.29-wireless-data-leak-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/201-2.4.29-panic-when-backing-up-lvm-snapshots-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/201-2.4.29-sparc64-xchg-use-membars-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/202-2.4.29-sparc64-locks-use-membars-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/203-2.4.29-ipconfig-use-memmove-not-strcpy-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/204-2.4.29-sparc64-mask-32bits-stack-ptr-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/205-2.4.29-i386-pci-irq-displays-wrong-pin-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/206-2.4.29-lp_write-race-can-corrupt-data-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/301-2.4.29-oops-ata_to_sense_error-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/302-2.4.29-lcd_ioctl-memory-leak-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/303-2.4.29-pkt_sched-netem-leaks-memory-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/304-2.4.29-netlink-fix-nlmsg_goodsize-calculation-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/305-2.4.29-proc-kcore-memory-corruption-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/402-2.4.29-rtnetlink-set-multi-flags-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/403-2.4.29-hiddev-busy-loop-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/404-2.4.29-msf-overflow-multisession-dvd-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/405-2.4.29-sparc64-signed-atomic-values-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/406-2.4.29-kfree_skb-missing-memory-barrier-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/408-2.4.29-sparc64-atomic-and-bitops-fixes-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/501-2.4.29-configure-mangles-hex-values-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/502-2.4.29-sparc-membar-extra-semi-colons-1
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/503-2.4.29-sparc64-membar-extra-semi-colons-1
Modified:
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/changelog
trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/series/2.4.29-1
Log:
add 2.4.29-hf2
Modified: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/changelog
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/changelog 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/changelog 2005-02-16 07:31:30 UTC (rev 2495)
@@ -9,8 +9,10 @@
- 114-binfmt_aout-CAN-2004-1074.diff (backport)
* Patches added
- 097_ipsec.diff (Herbert's backport)
+ - 101-503: add Willy Tarreau's hotfix patchset (2.4.29-hf2), addressing
+ some new security issues and bugs in 2.4.29
- -- Joshua Kwan <joshk@triplehelix.org> Mon, 14 Feb 2005 16:35:49 -0800
+ -- Joshua Kwan <joshk@triplehelix.org> Tue, 15 Feb 2005 23:30:34 -0800
kernel-source-2.4.28 (2.4.28-1) unstable; urgency=low
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/101-2.4.29-flash_erase-checks-cap_sys_admin-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/101-2.4.29-flash_erase-checks-cap_sys_admin-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/101-2.4.29-flash_erase-checks-cap_sys_admin-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,36 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/01/29 14:25:32-02:00 james4765@cwazy.co.uk
+# [PATCH] lcd: Add checks to CAP_SYS_ADMIN to potentially dangerous ioctl's
+#
+# This patch adds CAP_SYS_ADMIN checks to the potentially dangerous ioctls FLASH_Erase and FLASH_Burn
+# in the Cobalt LCD interface driver.
+#
+# Signed-off-by: James Nelson <james4765@gmail.com>
+#
+# drivers/char/lcd.c
+# 2005/01/27 21:54:01-02:00 james4765@cwazy.co.uk +4 -0
+# lcd: Add checks to CAP_SYS_ADMIN to potentially dangerous ioctl's
+#
+diff -Nru a/drivers/char/lcd.c b/drivers/char/lcd.c
+--- a/drivers/char/lcd.c 2005-02-03 05:58:28 -08:00
++++ b/drivers/char/lcd.c 2005-02-03 05:58:28 -08:00
+@@ -386,6 +386,8 @@
+
+ int ctr=0;
+
++ if (!capable(CAP_SYS_ADMIN)) return -EPERM;
++
+ // Chip Erase Sequence
+ WRITE_FLASH( kFlash_Addr1, kFlash_Data1 );
+ WRITE_FLASH( kFlash_Addr2, kFlash_Data2 );
+@@ -421,6 +423,8 @@
+
+
+ struct lcd_display display;
++
++ if (!capable(CAP_SYS_ADMIN)) return -EPERM;
+
+ if(copy_from_user(&display, (struct lcd_display*)arg, sizeof(struct lcd_display)))
+ return -EFAULT;
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/102-2.4.29-rw_verify_area-against-file-offset-overflow-2
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/102-2.4.29-rw_verify_area-against-file-offset-overflow-2 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/102-2.4.29-rw_verify_area-against-file-offset-overflow-2 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,307 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# arch/sparc64/kernel/sys_sparc32.c
+# 2005/02/07 17:41:42-02:00 marcelo@logos.cnet +2 -5
+# backport 2.6 rw_verify_area() to check against file offset overflows
+#
+# arch/s390x/kernel/linux32.c
+# 2005/02/07 17:41:11-02:00 marcelo@logos.cnet +2 -5
+# backport 2.6 rw_verify_area() to check against file offset overflows
+#
+# arch/ppc64/kernel/sys_ppc32.c
+# 2005/02/07 17:40:23-02:00 marcelo@logos.cnet +2 -4
+# backport 2.6 rw_verify_area() to check against file offset overflows
+#
+# arch/parisc/kernel/sys_parisc32.c
+# 2005/02/07 17:39:59-02:00 marcelo@logos.cnet +2 -4
+# backport 2.6 rw_verify_area() to check against file offset overflows
+#
+# arch/mips64/kernel/linux32.c
+# 2005/02/07 17:39:43-02:00 marcelo@logos.cnet +2 -4
+# backport 2.6 rw_verify_area() to check against file offset overflows
+#
+# fs/read_write.c
+# 2005/02/07 17:35:33-02:00 marcelo@logos.cnet +33 -15
+# backport 2.6 rw_verify_area() to check against file offset overflows
+#
+# mm/filemap.c
+# 2005/02/07 17:26:34-02:00 marcelo@logos.cnet +2 -2
+# backport 2.6 rw_verify_area() to check against file offset overflows
+#
+# ChangeSet
+# 2005/02/07 17:20:08-02:00 marcelo@logos.cnet
+# Linus Torvalds: backport 2.6 rw_verify_area() to check against file offset overflows
+#
+# - Make generic rw_verify_area check against file offset overflows.
+# - Add 'f_maxcount' to allow filesystems to set a per-file maximum IO size.
+# - Rename "locks_verify_area()" to "rw_verify_area()" and clean up the arguments.
+#
+# include/linux/fs.h
+# 2005/02/07 16:30:59-02:00 marcelo@logos.cnet +2 -8
+# backport 2.6 rw_verify_area() to check against file offset overflows
+#
+# fs/file_table.c
+# 2005/02/07 15:35:27-02:00 marcelo@logos.cnet +1 -0
+# backport 2.6 rw_verify_area() to check against file offset overflows
+#
+diff -Nru a/arch/mips64/kernel/linux32.c b/arch/mips64/kernel/linux32.c
+--- a/arch/mips64/kernel/linux32.c 2005-02-07 15:03:08 -08:00
++++ b/arch/mips64/kernel/linux32.c 2005-02-07 15:03:08 -08:00
+@@ -1088,11 +1088,9 @@
+ i--;
+ }
+
+- inode = file->f_dentry->d_inode;
+ /* VERIFY_WRITE actually means a read, as we write to user space */
+- retval = locks_verify_area((type == VERIFY_WRITE
+- ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE),
+- inode, file, file->f_pos, tot_len);
++ retval = rw_verify_area((type == VERIFY_WRITE ? READ : WRITE),
++ file, &file->f_pos, tot_len);
+ if (retval) {
+ if (iov != iovstack)
+ kfree(iov);
+diff -Nru a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c
+--- a/arch/parisc/kernel/sys_parisc32.c 2005-02-07 15:03:08 -08:00
++++ b/arch/parisc/kernel/sys_parisc32.c 2005-02-07 15:03:08 -08:00
+@@ -1671,11 +1671,9 @@
+ i--;
+ }
+
+- inode = file->f_dentry->d_inode;
+ /* VERIFY_WRITE actually means a read, as we write to user space */
+- retval = locks_verify_area((type == VERIFY_WRITE
+- ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE),
+- inode, file, file->f_pos, tot_len);
++ retval = rw_verify_area((type == VERIFY_WRITE ? READ : WRITE),
++ file, &file->f_pos, tot_len);
+ if (retval) {
+ if (iov != iovstack)
+ kfree(iov);
+diff -Nru a/arch/ppc64/kernel/sys_ppc32.c b/arch/ppc64/kernel/sys_ppc32.c
+--- a/arch/ppc64/kernel/sys_ppc32.c 2005-02-07 15:03:08 -08:00
++++ b/arch/ppc64/kernel/sys_ppc32.c 2005-02-07 15:03:08 -08:00
+@@ -183,11 +183,9 @@
+ i--;
+ }
+
+- inode = file->f_dentry->d_inode;
+ /* VERIFY_WRITE actually means a read, as we write to user space */
+- retval = locks_verify_area((type == VERIFY_WRITE
+- ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE),
+- inode, file, file->f_pos, tot_len);
++ retval = rw_verify_area((type == VERIFY_WRITE ? READ : WRITE),
++ file, &file->f_pos, tot_len);
+ if (retval) {
+ if (iov != iovstack)
+ kfree(iov);
+diff -Nru a/arch/s390x/kernel/linux32.c b/arch/s390x/kernel/linux32.c
+--- a/arch/s390x/kernel/linux32.c 2005-02-07 15:03:08 -08:00
++++ b/arch/s390x/kernel/linux32.c 2005-02-07 15:03:08 -08:00
+@@ -1108,7 +1108,6 @@
+ unsigned long tot_len;
+ struct iovec iovstack[UIO_FASTIOV];
+ struct iovec *iov=iovstack, *ivp;
+- struct inode *inode;
+ long retval, i;
+ io_fn_t fn;
+ iov_fn_t fnv;
+@@ -1145,11 +1144,9 @@
+ i--;
+ }
+
+- inode = file->f_dentry->d_inode;
+ /* VERIFY_WRITE actually means a read, as we write to user space */
+- retval = locks_verify_area((type == VERIFY_WRITE
+- ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE),
+- inode, file, file->f_pos, tot_len);
++ retval = rw_verify_area((type == VERIFY_WRITE ? READ : WRITE),
++ file, &file->f_pos, tot_len);
+ if (retval)
+ goto out;
+
+diff -Nru a/arch/sparc64/kernel/sys_sparc32.c b/arch/sparc64/kernel/sys_sparc32.c
+--- a/arch/sparc64/kernel/sys_sparc32.c 2005-02-07 15:03:08 -08:00
++++ b/arch/sparc64/kernel/sys_sparc32.c 2005-02-07 15:03:08 -08:00
+@@ -1093,7 +1093,6 @@
+ __kernel_ssize_t32 tot_len;
+ struct iovec iovstack[UIO_FASTIOV];
+ struct iovec *iov=iovstack, *ivp;
+- struct inode *inode;
+ long retval, i;
+ io_fn_t fn;
+ iov_fn_t fnv;
+@@ -1140,11 +1139,9 @@
+ i--;
+ }
+
+- inode = file->f_dentry->d_inode;
+ /* VERIFY_WRITE actually means a read, as we write to user space */
+- retval = locks_verify_area((type == VERIFY_WRITE
+- ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE),
+- inode, file, file->f_pos, tot_len);
++ retval = rw_verify_area((type == VERIFY_WRITE ? READ : WRITE),
++ file, &file->f_pos, tot_len);
+ if (retval)
+ goto out;
+
+diff -Nru a/fs/file_table.c b/fs/file_table.c
+--- a/fs/file_table.c 2005-02-07 15:03:08 -08:00
++++ b/fs/file_table.c 2005-02-07 15:03:08 -08:00
+@@ -46,6 +46,7 @@
+ f->f_version = ++event;
+ f->f_uid = current->fsuid;
+ f->f_gid = current->fsgid;
++ f->f_maxcount = INT_MAX;
+ list_add(&f->f_list, &anon_list);
+ file_list_unlock();
+ return f;
+diff -Nru a/fs/read_write.c b/fs/read_write.c
+--- a/fs/read_write.c 2005-02-07 15:03:08 -08:00
++++ b/fs/read_write.c 2005-02-07 15:03:08 -08:00
+@@ -40,6 +40,28 @@
+ return -EISDIR;
+ }
+
++int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count)
++{
++ struct inode *inode;
++ loff_t pos;
++
++ if (unlikely(count > file->f_maxcount))
++ goto Einval;
++
++ pos = *ppos;
++
++ if (unlikely((pos < 0) || (loff_t) (pos + count) < 0))
++ goto Einval;
++
++ inode = file->f_dentry->d_inode;
++ if (inode->i_flock && MANDATORY_LOCK(inode))
++ return locks_mandatory_area(read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE, inode, file, *ppos, count);
++ return 0;
++
++Einval:
++ return -EINVAL;
++}
++
+ loff_t generic_file_llseek(struct file *file, loff_t offset, int origin)
+ {
+ long long retval;
+@@ -168,8 +190,8 @@
+ file = fget(fd);
+ if (file) {
+ if (file->f_mode & FMODE_READ) {
+- ret = locks_verify_area(FLOCK_VERIFY_READ, file->f_dentry->d_inode,
+- file, file->f_pos, count);
++ ret = rw_verify_area(READ, file, &file->f_pos, count);
++
+ if (!ret) {
+ ssize_t (*read)(struct file *, char *, size_t, loff_t *);
+ ret = -EINVAL;
+@@ -193,9 +215,7 @@
+ file = fget(fd);
+ if (file) {
+ if (file->f_mode & FMODE_WRITE) {
+- struct inode *inode = file->f_dentry->d_inode;
+- ret = locks_verify_area(FLOCK_VERIFY_WRITE, inode, file,
+- file->f_pos, count);
++ ret = rw_verify_area(WRITE, file, &file->f_pos, count);
+ if (!ret) {
+ ssize_t (*write)(struct file *, const char *, size_t, loff_t *);
+ ret = -EINVAL;
+@@ -224,7 +244,6 @@
+ ssize_t ret, i;
+ io_fn_t fn;
+ iov_fn_t fnv;
+- struct inode *inode;
+
+ /*
+ * First get the "struct iovec" from user memory and
+@@ -275,12 +294,11 @@
+ goto out;
+ }
+
+- inode = file->f_dentry->d_inode;
+ /* VERIFY_WRITE actually means a read, as we write to user space */
+- ret = locks_verify_area((type == VERIFY_WRITE
+- ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE),
+- inode, file, file->f_pos, tot_len);
+- if (ret) goto out;
++ ret = rw_verify_area((type == VERIFY_WRITE ? READ : WRITE),
++ file, &file->f_pos, tot_len);
++ if (ret)
++ goto out;
+
+ fnv = (type == VERIFY_WRITE ? file->f_op->readv : file->f_op->writev);
+ if (fnv) {
+@@ -383,8 +401,8 @@
+ goto bad_file;
+ if (!(file->f_mode & FMODE_READ))
+ goto out;
+- ret = locks_verify_area(FLOCK_VERIFY_READ, file->f_dentry->d_inode,
+- file, pos, count);
++ ret = rw_verify_area(READ, file, &pos, count);
++
+ if (ret)
+ goto out;
+ ret = -EINVAL;
+@@ -414,8 +432,8 @@
+ goto bad_file;
+ if (!(file->f_mode & FMODE_WRITE))
+ goto out;
+- ret = locks_verify_area(FLOCK_VERIFY_WRITE, file->f_dentry->d_inode,
+- file, pos, count);
++ ret = rw_verify_area(WRITE, file, &pos, count);
++
+ if (ret)
+ goto out;
+ ret = -EINVAL;
+diff -Nru a/include/linux/fs.h b/include/linux/fs.h
+--- a/include/linux/fs.h 2005-02-07 15:03:08 -08:00
++++ b/include/linux/fs.h 2005-02-07 15:03:08 -08:00
+@@ -576,6 +576,7 @@
+ unsigned int f_uid, f_gid;
+ int f_error;
+
++ size_t f_maxcount;
+ unsigned long f_version;
+
+ /* needed for tty driver, and maybe others */
+@@ -1056,14 +1057,7 @@
+ return 0;
+ }
+
+-static inline int locks_verify_area(int read_write, struct inode *inode,
+- struct file *filp, loff_t offset,
+- size_t count)
+-{
+- if (inode->i_flock && MANDATORY_LOCK(inode))
+- return locks_mandatory_area(read_write, inode, filp, offset, count);
+- return 0;
+-}
++extern int rw_verify_area(int, struct file *, loff_t *, size_t);
+
+ static inline int locks_verify_truncate(struct inode *inode,
+ struct file *filp,
+diff -Nru a/mm/filemap.c b/mm/filemap.c
+--- a/mm/filemap.c 2005-02-07 15:03:08 -08:00
++++ b/mm/filemap.c 2005-02-07 15:03:08 -08:00
+@@ -1870,7 +1870,7 @@
+ goto fput_in;
+ if (!in_inode->i_mapping->a_ops->readpage)
+ goto fput_in;
+- retval = locks_verify_area(FLOCK_VERIFY_READ, in_inode, in_file, in_file->f_pos, count);
++ retval = rw_verify_area(READ, in_file, &in_file->f_pos, count);
+ if (retval)
+ goto fput_in;
+
+@@ -1887,7 +1887,7 @@
+ if (!out_file->f_op || !out_file->f_op->write)
+ goto fput_out;
+ out_inode = out_file->f_dentry->d_inode;
+- retval = locks_verify_area(FLOCK_VERIFY_WRITE, out_inode, out_file, out_file->f_pos, count);
++ retval = rw_verify_area(WRITE, out_file, &out_file->f_pos, count);
+ if (retval)
+ goto fput_out;
+
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/103-2.4.29-rw_verify_area-missing-f_maxcount-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/103-2.4.29-rw_verify_area-missing-f_maxcount-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/103-2.4.29-rw_verify_area-missing-f_maxcount-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,39 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/08 12:35:49-02:00 marcelo@logos.cnet
+# Solar Designer: missing f_maxcount initialization
+# TAG: MailDone
+#
+# fs/nfsd/vfs.c
+# 2005/02/08 12:35:28-02:00 marcelo@logos.cnet +2 -0
+# Solar Designer: missing f_maxcount initialization
+#
+# fs/file_table.c
+# 2005/02/08 12:34:05-02:00 marcelo@logos.cnet +2 -0
+# Solar Designer: missing f_maxcount initialization
+#
+diff -Nru a/fs/file_table.c b/fs/file_table.c
+--- a/fs/file_table.c 2005-02-08 13:03:17 -08:00
++++ b/fs/file_table.c 2005-02-08 13:03:17 -08:00
+@@ -92,6 +92,8 @@
+ filp->f_uid = current->fsuid;
+ filp->f_gid = current->fsgid;
+ filp->f_op = dentry->d_inode->i_fop;
++ filp->f_maxcount = INT_MAX;
++
+ if (filp->f_op->open)
+ return filp->f_op->open(dentry->d_inode, filp);
+ else
+diff -Nru a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+--- a/fs/nfsd/vfs.c 2005-02-08 13:03:17 -08:00
++++ b/fs/nfsd/vfs.c 2005-02-08 13:03:17 -08:00
+@@ -466,6 +466,8 @@
+ atomic_set(&filp->f_count, 1);
+ filp->f_dentry = dentry;
+ filp->f_vfsmnt = fhp->fh_export->ex_mnt;
++ filp->f_maxcount = INT_MAX;
++
+ if (access & MAY_WRITE) {
+ filp->f_flags = O_WRONLY|O_LARGEFILE;
+ filp->f_mode = FMODE_WRITE;
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/104-2.4.29-wireless-data-leak-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/104-2.4.29-wireless-data-leak-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/104-2.4.29-wireless-data-leak-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,90 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/09 12:33:55-02:00 chrisw@osdl.org
+# [PATCH] Fix potential leak of kernel data to user space in wireless private handler helper.
+#
+# Jean Tourrilhes wrote:
+#
+# > There is a potential leak of kernel data to user space in
+# > private handler handling. Few drivers use that feature, there is no
+# > risk of crash or direct attack, so I would not worry about it.
+# > Its not like you can read any arbitrary address, exploiting
+# > such a flaw is in my mind theoritical. Let's not overblow things,
+# > there are some real bugs to take care of.
+#
+# If the fix is simple (as it appears to be), there's no good reason to
+# leave the risk there.
+#
+# prism54 uses this, and is a reasonably popular card.
+#
+# thanks,
+# -chris
+#
+# ===== net/core/wireless.c 1.4 vs edited =====
+#
+# net/core/wireless.c
+# 2005/02/08 23:45:15-02:00 chrisw@osdl.org +28 -2
+# Fix potential leak of kernel data to user space in wireless private handler helper.
+#
+diff -Nru a/net/core/wireless.c b/net/core/wireless.c
+--- a/net/core/wireless.c 2005-02-09 11:03:56 -08:00
++++ b/net/core/wireless.c 2005-02-09 11:03:56 -08:00
+@@ -310,7 +310,7 @@
+
+ /* ---------------------------------------------------------------- */
+ /*
+- * Number of private arguments
++ * Calculate size of private arguments
+ */
+ static inline int get_priv_size(__u16 args)
+ {
+@@ -320,6 +320,24 @@
+ return num * priv_type_size[type];
+ }
+
++/* ---------------------------------------------------------------- */
++/*
++ * Re-calculate the size of private arguments
++ */
++static inline int adjust_priv_size(__u16 args,
++ union iwreq_data * wrqu)
++{
++ int num = wrqu->data.length;
++ int max = args & IW_PRIV_SIZE_MASK;
++ int type = (args & IW_PRIV_TYPE_MASK) >> 12;
++
++ /* Make sure the driver doesn't goof up */
++ if (max < num)
++ num = max;
++
++ return num * priv_type_size[type];
++}
++
+
+ /******************** /proc/net/wireless SUPPORT ********************/
+ /*
+@@ -701,7 +719,7 @@
+ ((extra_size + offset) <= IFNAMSIZ))
+ extra_size = 0;
+ } else {
+- /* Size of set arguments */
++ /* Size of get arguments */
+ extra_size = get_priv_size(descr->get_args);
+
+ /* Does it fits in iwr ? */
+@@ -771,6 +789,14 @@
+
+ /* If we have something to return to the user */
+ if (!ret && IW_IS_GET(cmd)) {
++
++ /* Adjust for the actual length if it's variable,
++ * avoid leaking kernel bits outside. */
++ if (!(descr->get_args & IW_PRIV_SIZE_FIXED)) {
++ extra_size = adjust_priv_size(descr->get_args,
++ &(iwr->u));
++ }
++
+ err = copy_to_user(iwr->u.data.pointer, extra,
+ extra_size);
+ if (err)
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/201-2.4.29-panic-when-backing-up-lvm-snapshots-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/201-2.4.29-panic-when-backing-up-lvm-snapshots-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/201-2.4.29-panic-when-backing-up-lvm-snapshots-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,41 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/01/26 10:10:40-02:00 mauelshagen@redhat.com
+# [PATCH] fix panics while backing up LVM snapshots
+#
+# this patch fixes lvm-snap.c in order to avoid a list update
+# on the snapshot exception hash happening while only holding a
+# read lock as documented in Red Hat bugzilla #135266.
+#
+# drivers/md/lvm-snap.c
+# 2005/01/26 13:01:33-02:00 mauelshagen@redhat.com +0 -7
+# fix panics while backing up LVM snapshots
+#
+diff -Nru a/drivers/md/lvm-snap.c b/drivers/md/lvm-snap.c
+--- a/drivers/md/lvm-snap.c 2005-02-03 05:58:45 -08:00
++++ b/drivers/md/lvm-snap.c 2005-02-03 05:58:45 -08:00
+@@ -119,7 +119,6 @@
+ unsigned long mask = lv->lv_snapshot_hash_mask;
+ int chunk_size = lv->lv_chunk_size;
+ lv_block_exception_t *ret;
+- int i = 0;
+
+ hash_table =
+ &hash_table[hashfn(org_dev, org_start, mask, chunk_size)];
+@@ -132,15 +131,9 @@
+ exception = list_entry(next, lv_block_exception_t, hash);
+ if (exception->rsector_org == org_start &&
+ exception->rdev_org == org_dev) {
+- if (i) {
+- /* fun, isn't it? :) */
+- list_del(next);
+- list_add(next, hash_table);
+- }
+ ret = exception;
+ break;
+ }
+- i++;
+ }
+ return ret;
+ }
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/201-2.4.29-sparc64-xchg-use-membars-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/201-2.4.29-sparc64-xchg-use-membars-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/201-2.4.29-sparc64-xchg-use-membars-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,51 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/06 20:47:34-08:00 davem@nuts.davemloft.net
+# [SPARC64]: Add missing membars for xchg() and cmpxchg().
+#
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+# include/asm-sparc64/system.h
+# 2005/02/06 20:47:20-08:00 davem@nuts.davemloft.net +6 -2
+# [SPARC64]: Add missing membars for xchg() and cmpxchg().
+#
+diff -Nru a/include/asm-sparc64/system.h b/include/asm-sparc64/system.h
+--- a/include/asm-sparc64/system.h 2005-02-09 09:11:19 -08:00
++++ b/include/asm-sparc64/system.h 2005-02-09 09:11:19 -08:00
+@@ -246,6 +246,7 @@
+ extern __inline__ unsigned long xchg32(__volatile__ unsigned int *m, unsigned int val)
+ {
+ __asm__ __volatile__(
++" membar #StoreLoad | #LoadLoad\n"
+ " mov %0, %%g5\n"
+ "1: lduw [%2], %%g7\n"
+ " cas [%2], %%g7, %0\n"
+@@ -262,6 +263,7 @@
+ extern __inline__ unsigned long xchg64(__volatile__ unsigned long *m, unsigned long val)
+ {
+ __asm__ __volatile__(
++" membar #StoreLoad | #LoadLoad\n"
+ " mov %0, %%g5\n"
+ "1: ldx [%2], %%g7\n"
+ " casx [%2], %%g7, %0\n"
+@@ -306,7 +308,8 @@
+ extern __inline__ unsigned long
+ __cmpxchg_u32(volatile int *m, int old, int new)
+ {
+- __asm__ __volatile__("cas [%2], %3, %0\n\t"
++ __asm__ __volatile__("membar #StoreLoad | #LoadLoad\n"
++ "cas [%2], %3, %0\n\t"
+ "membar #StoreLoad | #StoreStore"
+ : "=&r" (new)
+ : "0" (new), "r" (m), "r" (old)
+@@ -318,7 +321,8 @@
+ extern __inline__ unsigned long
+ __cmpxchg_u64(volatile long *m, unsigned long old, unsigned long new)
+ {
+- __asm__ __volatile__("casx [%2], %3, %0\n\t"
++ __asm__ __volatile__("membar #StoreLoad | #LoadLoad\n"
++ "casx [%2], %3, %0\n\t"
+ "membar #StoreLoad | #StoreStore"
+ : "=&r" (new)
+ : "0" (new), "r" (m), "r" (old)
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/202-2.4.29-sparc64-locks-use-membars-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/202-2.4.29-sparc64-locks-use-membars-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/202-2.4.29-sparc64-locks-use-membars-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,57 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/06 20:55:36-08:00 davem@nuts.davemloft.net
+# [SPARC64]: Add missing membars for xchg() and cmpxchg().
+#
+# read_unlock should order all previous memory operations
+# before the atomic counter update to drop the lock.
+# The debugging version of write_unlock had a similar error.
+#
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+# arch/sparc64/lib/rwlock.S
+# 2005/02/06 20:54:57-08:00 davem@nuts.davemloft.net +2 -1
+# [SPARC64]: Correct rwlock membars.
+#
+# arch/sparc64/lib/debuglocks.c
+# 2005/02/06 20:54:57-08:00 davem@nuts.davemloft.net +2 -0
+# [SPARC64]: Correct rwlock membars.
+#
+diff -Nru a/arch/sparc64/lib/debuglocks.c b/arch/sparc64/lib/debuglocks.c
+--- a/arch/sparc64/lib/debuglocks.c 2005-02-09 09:11:29 -08:00
++++ b/arch/sparc64/lib/debuglocks.c 2005-02-09 09:11:29 -08:00
+@@ -162,6 +162,7 @@
+ runlock_again:
+ /* Spin trying to decrement the counter using casx. */
+ __asm__ __volatile__(
++" membar #StoreLoad | #LoadLoad\n"
+ " ldx [%0], %%g5\n"
+ " sub %%g5, 1, %%g7\n"
+ " casx [%0], %%g5, %%g7\n"
+@@ -276,6 +277,7 @@
+ current->thread.smp_lock_count--;
+ wlock_again:
+ __asm__ __volatile__(
++" membar #StoreLoad | #LoadLoad\n"
+ " mov 1, %%g3\n"
+ " sllx %%g3, 63, %%g3\n"
+ " ldx [%0], %%g5\n"
+diff -Nru a/arch/sparc64/lib/rwlock.S b/arch/sparc64/lib/rwlock.S
+--- a/arch/sparc64/lib/rwlock.S 2005-02-09 09:11:29 -08:00
++++ b/arch/sparc64/lib/rwlock.S 2005-02-09 09:11:29 -08:00
+@@ -24,12 +24,13 @@
+ 99: retl
+ nop
+ __read_unlock: /* %o0 = lock_ptr */
++ membar #StoreLoad | #LoadLoad
+ lduw [%o0], %g5
+ sub %g5, 1, %g7
+ cas [%o0], %g5, %g7
+ cmp %g5, %g7
+ be,pt %xcc, 99b
+- membar #StoreLoad | #StoreStore
++ nop
+ ba,a,pt %xcc, __read_unlock
+
+ __read_wait_for_writer:
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/203-2.4.29-ipconfig-use-memmove-not-strcpy-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/203-2.4.29-ipconfig-use-memmove-not-strcpy-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/203-2.4.29-ipconfig-use-memmove-not-strcpy-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,36 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/06 22:21:22-08:00 matthew@wil.cx
+# [IPV4]: ipconfig should use memmove() instead of strcpy()
+#
+# strcpy is undefined if src and dest overlap. That's clearly possible
+# here with a sufficiently deep path on the server. Use memmove instead.
+#
+# Signed-off-by: Matthew Wilcox <matthew@wil.cx>
+#
+# net/ipv4/ipconfig.c
+# 2005/02/06 22:21:02-08:00 matthew@wil.cx +1 -1
+# `### Change the comments to ChangeSet|1.1547 below
+# [IPV4]: ipconfig should use memmove() instead of strcpy()
+#
+# strcpy is undefined if src and dest overlap. That's clearly possible
+# here with a sufficiently deep path on the server. Use memmove instead.
+#
+# Signed-off-by: Matthew Wilcox <matthew@wil.cx>
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+# [IPV4]: ipconfig should use memmove() instead of strcpy()
+#
+diff -Nru a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
+--- a/net/ipv4/ipconfig.c 2005-02-09 09:12:44 -08:00
++++ b/net/ipv4/ipconfig.c 2005-02-09 09:12:44 -08:00
+@@ -1162,7 +1162,7 @@
+ if (*cp == ':')
+ *cp++ = '\0';
+ addr = in_aton(name);
+- strcpy(name, cp);
++ memmove(name, cp, strlen(cp) + 1);
+ } else
+ addr = INADDR_NONE;
+
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/204-2.4.29-sparc64-mask-32bits-stack-ptr-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/204-2.4.29-sparc64-mask-32bits-stack-ptr-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/204-2.4.29-sparc64-mask-32bits-stack-ptr-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,40 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/07 20:24:13-08:00 davem@nuts.davemloft.net
+# [SPARC64]: Mask off stack ptr in alloc_user_space() for 32-bit.
+#
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+# arch/sparc64/kernel/sys_sparc32.c
+# 2005/02/07 20:23:33-08:00 davem@nuts.davemloft.net +2 -0
+# [SPARC64]: Mask off stack ptr in alloc_user_space() for 32-bit.
+#
+# arch/sparc64/kernel/ioctl32.c
+# 2005/02/07 20:23:33-08:00 davem@nuts.davemloft.net +2 -0
+# [SPARC64]: Mask off stack ptr in alloc_user_space() for 32-bit.
+#
+diff -Nru a/arch/sparc64/kernel/ioctl32.c b/arch/sparc64/kernel/ioctl32.c
+--- a/arch/sparc64/kernel/ioctl32.c 2005-02-09 09:11:38 -08:00
++++ b/arch/sparc64/kernel/ioctl32.c 2005-02-09 09:11:38 -08:00
+@@ -562,6 +562,8 @@
+
+ if (!(current->thread.flags & SPARC_FLAG_32BIT))
+ usp += STACK_BIAS;
++ else
++ usp &= 0xffffffffUL;
+
+ return (void *) (usp - len);
+ }
+diff -Nru a/arch/sparc64/kernel/sys_sparc32.c b/arch/sparc64/kernel/sys_sparc32.c
+--- a/arch/sparc64/kernel/sys_sparc32.c 2005-02-09 09:11:38 -08:00
++++ b/arch/sparc64/kernel/sys_sparc32.c 2005-02-09 09:11:38 -08:00
+@@ -770,6 +770,8 @@
+
+ if (!(current->thread.flags & SPARC_FLAG_32BIT))
+ usp += STACK_BIAS;
++ else
++ usp &= 0xffffffffUL;
+
+ return (void *) (usp - len);
+ }
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/205-2.4.29-i386-pci-irq-displays-wrong-pin-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/205-2.4.29-i386-pci-irq-displays-wrong-pin-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/205-2.4.29-i386-pci-irq-displays-wrong-pin-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,113 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/09 12:09:17-02:00 Mark.Haigh@spirentcom.com
+# [PATCH] arch/i386/kernel/pci-irq.c: Wrong message output
+#
+# I'd submitted a patch earlier for this file, fixing a warning. When I
+# looked at it further, I noticed it can output an incorrect warning
+# message under certain circumstances. I've confirmed that this can and
+# does happen in the wild:
+#
+# PCI: Enabling device 0000:00:0a.0 (0000 -> 0001)
+# PCI: No IRQ known for interrupt pin @ of device 0000:00:0a.0. Probably
+# buggy MP table.
+#
+# It should read "No IRQ known for interrupt pin A", but the 'pin'
+# variable has already been decremented (from 1 to 0), so the line:
+#
+# printk(KERN_WARNING "PCI: No IRQ known for interrupt pin %c of device
+# %s.%s\n", 'A' + pin - 1, dev->slot_name, msg);
+#
+# causes "pin @" to be output, because 'A' + 0 - 1 == '@'.
+#
+# This patch also fixes the original warning:
+#
+# pci-irq.c: In function `pcibios_enable_irq':
+# pci-irq.c:1128: warning: 'msg' might be used uninitialized in this function
+#
+# arch/i386/kernel/pci-irq.c
+# 2005/02/08 02:13:38-02:00 Mark.Haigh@spirentcom.com +28 -29
+# arch/i386/kernel/pci-irq.c: Wrong message output
+#
+diff -Nru a/arch/i386/kernel/pci-irq.c b/arch/i386/kernel/pci-irq.c
+--- a/arch/i386/kernel/pci-irq.c 2005-02-09 11:03:51 -08:00
++++ b/arch/i386/kernel/pci-irq.c 2005-02-09 11:03:51 -08:00
+@@ -1127,6 +1127,8 @@
+ if (pin && !pcibios_lookup_irq(dev, 1) && !dev->irq) {
+ char *msg;
+
++ pin--; /* interrupt pins are numbered starting from 1 */
++
+ /* With IDE legacy devices the IRQ lookup failure is not a problem.. */
+ if (dev->class >> 8 == PCI_CLASS_STORAGE_IDE && !(dev->class & 0x5))
+ return;
+@@ -1134,42 +1136,39 @@
+ if (io_apic_assign_pci_irqs) {
+ int irq;
+
+- if (pin) {
+- pin--; /* interrupt pins are numbered starting from 1 */
+- irq = IO_APIC_get_PCI_irq_vector(dev->bus->number, PCI_SLOT(dev->devfn), pin);
+- /*
+- * Busses behind bridges are typically not listed in the MP-table.
+- * In this case we have to look up the IRQ based on the parent bus,
+- * parent slot, and pin number. The SMP code detects such bridged
+- * busses itself so we should get into this branch reliably.
+- */
+- temp_dev = dev;
+- while (irq < 0 && dev->bus->parent) { /* go back to the bridge */
+- struct pci_dev * bridge = dev->bus->self;
++ irq = IO_APIC_get_PCI_irq_vector(dev->bus->number, PCI_SLOT(dev->devfn), pin);
++ /*
++ * Busses behind bridges are typically not listed in the MP-table.
++ * In this case we have to look up the IRQ based on the parent bus,
++ * parent slot, and pin number. The SMP code detects such bridged
++ * busses itself so we should get into this branch reliably.
++ */
++ temp_dev = dev;
++ while (irq < 0 && dev->bus->parent) { /* go back to the bridge */
++ struct pci_dev * bridge = dev->bus->self;
+
+- pin = (pin + PCI_SLOT(dev->devfn)) % 4;
+- irq = IO_APIC_get_PCI_irq_vector(bridge->bus->number,
+- PCI_SLOT(bridge->devfn), pin);
+- if (irq >= 0)
+- printk(KERN_WARNING "PCI: using PPB(B%d,I%d,P%d) to get irq %d\n",
+- bridge->bus->number, PCI_SLOT(bridge->devfn), pin, irq);
+- dev = bridge;
+- }
+- dev = temp_dev;
+- if (irq >= 0) {
+- printk(KERN_INFO "PCI->APIC IRQ transform: (B%d,I%d,P%d) -> %d\n",
+- dev->bus->number, PCI_SLOT(dev->devfn), pin, irq);
+- dev->irq = irq;
+- return;
+- } else
+- msg = " Probably buggy MP table.";
++ pin = (pin + PCI_SLOT(dev->devfn)) % 4;
++ irq = IO_APIC_get_PCI_irq_vector(bridge->bus->number,
++ PCI_SLOT(bridge->devfn), pin);
++ if (irq >= 0)
++ printk(KERN_WARNING "PCI: using PPB(B%d,I%d,P%d) to get irq %d\n",
++ bridge->bus->number, PCI_SLOT(bridge->devfn), pin, irq);
++ dev = bridge;
+ }
++ dev = temp_dev;
++ if (irq >= 0) {
++ printk(KERN_INFO "PCI->APIC IRQ transform: (B%d,I%d,P%d) -> %d\n",
++ dev->bus->number, PCI_SLOT(dev->devfn), pin, irq);
++ dev->irq = irq;
++ return;
++ } else
++ msg = " Probably buggy MP table.";
+ } else if (pci_probe & PCI_BIOS_IRQ_SCAN)
+ msg = "";
+ else
+ msg = " Please try using pci=biosirq.";
+ printk(KERN_WARNING "PCI: No IRQ known for interrupt pin %c of device %s.%s\n",
+- 'A' + pin - 1, dev->slot_name, msg);
++ 'A' + pin, dev->slot_name, msg);
+ }
+ /* VIA bridges use interrupt line for apic/pci steering across
+ the V-Link */
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/206-2.4.29-lp_write-race-can-corrupt-data-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/206-2.4.29-lp_write-race-can-corrupt-data-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/206-2.4.29-lp_write-race-can-corrupt-data-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,49 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/10 10:00:20-02:00 akpm@osdl.org
+# [PATCH] Kenneth Sumrall: In lp_write(), copy_from_user() is called to copy data into a statically allocated kernel buffer before down_interruptible().
+#
+# From: Kenneth Sumrall <ken@mvista.com>
+#
+# In lp_write(), copy_from_user() is called to copy data into a statically
+# allocated kernel buffer before down_interruptible() is called. If a second
+# thread of execution comes in between the copy_from_user() and the
+# down_interruptible() calls, silent data corruption could result.
+#
+# Signed-off-by: Andrew Morton <akpm@osdl.org>
+#
+# drivers/char/lp.c
+# 2005/02/09 02:52:03-02:00 akpm@osdl.org +6 -4
+# Kenneth Sumrall: In lp_write(), copy_from_user() is called to copy data into a statically allocated kernel buffer before down_interruptible().
+#
+diff -Nru a/drivers/char/lp.c b/drivers/char/lp.c
+--- a/drivers/char/lp.c 2005-02-12 00:43:17 -08:00
++++ b/drivers/char/lp.c 2005-02-12 00:43:17 -08:00
+@@ -314,12 +314,14 @@
+ if (copy_size > LP_BUFFER_SIZE)
+ copy_size = LP_BUFFER_SIZE;
+
+- if (copy_from_user (kbuf, buf, copy_size))
+- return -EFAULT;
+-
+ if (down_interruptible (&lp_table[minor].port_mutex))
+ return -EINTR;
+
++ if (copy_from_user (kbuf, buf, copy_size)) {
++ retv = -EFAULT;
++ goto out_unlock;
++ }
++
+ /* Claim Parport or sleep until it becomes available
+ */
+ lp_claim_parport_or_block (&lp_table[minor]);
+@@ -398,7 +400,7 @@
+ lp_table[minor].current_mode = IEEE1284_MODE_COMPAT;
+ lp_release_parport (&lp_table[minor]);
+ }
+-
++out_unlock:
+ up (&lp_table[minor].port_mutex);
+
+ return retv;
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/301-2.4.29-oops-ata_to_sense_error-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/301-2.4.29-oops-ata_to_sense_error-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/301-2.4.29-oops-ata_to_sense_error-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,27 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/01/28 22:30:08-05:00 mkrikis@yahoo.com
+# [PATCH] fix an oops in ata_to_sense_error
+#
+# Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
+#
+# drivers/scsi/libata-scsi.c
+# 2005/01/28 22:29:43-05:00 mkrikis@yahoo.com +2 -1
+# [PATCH] fix an oops in ata_to_sense_error
+#
+# Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
+#
+diff -Nru a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
+--- a/drivers/scsi/libata-scsi.c 2005-02-03 05:58:31 -08:00
++++ b/drivers/scsi/libata-scsi.c 2005-02-03 05:58:31 -08:00
+@@ -283,7 +283,8 @@
+ /* No immediate match */
+ if(err)
+ printk(KERN_DEBUG "ata%u: no sense translation for 0x%02x\n", qc->ap->id, err);
+-
++
++ i = 0;
+ /* Fall back to interpreting status bits */
+ while(stat_table[i][0] != 0xFF)
+ {
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/302-2.4.29-lcd_ioctl-memory-leak-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/302-2.4.29-lcd_ioctl-memory-leak-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/302-2.4.29-lcd_ioctl-memory-leak-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,29 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/01/29 14:26:17-02:00 james4765@cwazy.co.uk
+# [PATCH] lcd: fix memory leak in lcd_ioctl()
+#
+# This patch fixes a memory leak in the FLASH_Burn ioctl for the Cobalt LCD interface driver.
+#
+# Signed-off-by: James Nelson <james4765@gmail.com>
+#
+# drivers/char/lcd.c
+# 2005/01/27 21:49:38-02:00 james4765@cwazy.co.uk +3 -1
+# lcd: fix memory leak in lcd_ioctl()
+#
+diff -Nru a/drivers/char/lcd.c b/drivers/char/lcd.c
+--- a/drivers/char/lcd.c 2005-02-03 05:58:23 -08:00
++++ b/drivers/char/lcd.c 2005-02-03 05:58:23 -08:00
+@@ -438,8 +438,10 @@
+ save_flags(flags);
+ for (i=0; i<FLASH_SIZE; i=i+128) {
+
+- if(copy_from_user(rom, display.RomImage + i, 128))
++ if(copy_from_user(rom, display.RomImage + i, 128)) {
++ kfree(rom);
+ return -EFAULT;
++ }
+ burn_addr = kFlashBase + i;
+ cli();
+ for ( index = 0; index < ( 128 ) ; index++ )
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/303-2.4.29-pkt_sched-netem-leaks-memory-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/303-2.4.29-pkt_sched-netem-leaks-memory-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/303-2.4.29-pkt_sched-netem-leaks-memory-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,26 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/06 21:47:40-08:00 shemminger@osdl.org
+# [PKT_SCHED]: netem: memory leak
+#
+# Good catch.. netem needs to free skb's that are dropped due to loss
+# simulation.
+#
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+# net/sched/sch_netem.c
+# 2005/02/06 21:47:26-08:00 shemminger@osdl.org +1 -0
+# [PKT_SCHED]: netem: memory leak
+#
+diff -Nru a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+--- a/net/sched/sch_netem.c 2005-02-09 09:13:00 -08:00
++++ b/net/sched/sch_netem.c 2005-02-09 09:13:00 -08:00
+@@ -180,6 +180,7 @@
+ if (q->loss && q->loss >= get_crandom(&q->loss_cor)) {
+ pr_debug("netem_enqueue: random loss\n");
+ sch->stats.drops++;
++ kfree_skb(skb);
+ return 0; /* lie about loss so TCP doesn't know */
+ }
+
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/304-2.4.29-netlink-fix-nlmsg_goodsize-calculation-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/304-2.4.29-netlink-fix-nlmsg_goodsize-calculation-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/304-2.4.29-netlink-fix-nlmsg_goodsize-calculation-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,56 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/06 22:01:47-08:00 tgraf@suug.ch
+# [NETLINK]: Use SKB_MAXORDER to calculate NLMSG_GOODSIZE
+#
+# NLMSG_GOODSIZE specifies a good default size for the skb tailroom
+# used in netlink messages when the size is unknown at the time of
+# the allocation.
+#
+# The current value doesn't make much sense anymore because
+# skb_shared_info isn't taken into account which means that
+# depending on the architecture NLMSG_GOOSIZE can exceed PAGE_SIZE
+# resulting in a waste of almost a complete page.
+#
+# Using SKB_MAXORDER solves this potential leak at the cost of
+# slightly smaller but safer sizes for some architectures.
+#
+# Signed-off-by: Thomas Graf <tgraf@suug.ch>
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+# include/linux/netlink.h
+# 2005/02/06 22:01:39-08:00 tgraf@suug.ch +2 -3
+# [NETLINK]: Use SKB_MAXORDER to calculate NLMSG_GOODSIZE
+#
+# NLMSG_GOODSIZE specifies a good default size for the skb tailroom
+# used in netlink messages when the size is unknown at the time of
+# the allocation.
+#
+# The current value doesn't make much sense anymore because
+# skb_shared_info isn't taken into account which means that
+# depending on the architecture NLMSG_GOOSIZE can exceed PAGE_SIZE
+# resulting in a waste of almost a complete page.
+#
+# Using SKB_MAXORDER solves this potential leak at the cost of
+# slightly smaller but safer sizes for some architectures.
+#
+# Signed-off-by: Thomas Graf <tgraf@suug.ch>
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+diff -Nru a/include/linux/netlink.h b/include/linux/netlink.h
+--- a/include/linux/netlink.h 2005-02-09 09:13:15 -08:00
++++ b/include/linux/netlink.h 2005-02-09 09:13:15 -08:00
+@@ -117,10 +117,9 @@
+
+ /*
+ * skb should fit one page. This choice is good for headerless malloc.
+- *
+- * FIXME: What is the best size for SLAB???? --ANK
+ */
+-#define NLMSG_GOODSIZE (PAGE_SIZE - ((sizeof(struct sk_buff)+0xF)&~0xF))
++#define NLMSG_GOODORDER 0
++#define NLMSG_GOODSIZE (SKB_MAX_ORDER(0, NLMSG_GOODORDER))
+
+
+ struct netlink_callback
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/305-2.4.29-proc-kcore-memory-corruption-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/305-2.4.29-proc-kcore-memory-corruption-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/305-2.4.29-proc-kcore-memory-corruption-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,73 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/03 13:17:21-02:00 petrides@redhat.com
+# [PATCH] fix for memory corruption from /proc/kcore access
+#
+# A fairly nasty memory corruption potential exists when
+# /proc/kcore is accessed and there are at least 62 vmalloc'd areas.
+#
+# The problem is that get_kcore_size() does not properly account for
+# the elf_prstatus, elf_prpsinfo, and task_struct structure sizes in
+# the fabricated ELF header, and then elf_kcore_store_hdr() and its
+# associated calls to storenote() will possibly overrun the "elf_buf"
+# buffer allocated by read_kcore(). Because the requested buffer size
+# is rounded up to a page multiple, only certain ranges of counts of
+# vmalloc'd areas will actually lead to a memory corruption. When it
+# does happen, usually the end of the /proc/kcore reader's task_struct
+# ends up being copied into a slab page (or sometimes into a data page)
+# causing a kernel crash (or data corruption) at a later point in time.
+#
+# The 1st hunk of the patch below fixes this problem. The latter 3
+# hunks correct the "p_filesz" value for the note section (which is
+# already initialized to 0 on line 232) as stored in the ELF header,
+# but these hunks are not necessary to fix the corruption possiblity.
+#
+# The fix is already in 2.6.
+#
+# fs/proc/kcore.c
+# 2005/02/02 22:52:50-02:00 petrides@redhat.com +7 -4
+# fix for memory corruption from /proc/kcore access
+#
+diff -Nru a/fs/proc/kcore.c b/fs/proc/kcore.c
+--- a/fs/proc/kcore.c 2005-02-07 13:04:49 -08:00
++++ b/fs/proc/kcore.c 2005-02-07 13:04:49 -08:00
+@@ -136,7 +136,10 @@
+ }
+ *elf_buflen = sizeof(struct elfhdr) +
+ (*num_vma + 2)*sizeof(struct elf_phdr) +
+- 3 * sizeof(struct memelfnote);
++ 3 * (sizeof(struct elf_note) + 4) +
++ sizeof(struct elf_prstatus) +
++ sizeof(struct elf_prpsinfo) +
++ sizeof(struct task_struct);
+ *elf_buflen = PAGE_ALIGN(*elf_buflen);
+ return (size - PAGE_OFFSET + *elf_buflen);
+ }
+@@ -279,7 +282,7 @@
+
+ memset(&prstatus, 0, sizeof(struct elf_prstatus));
+
+- nhdr->p_filesz = notesize(¬es[0]);
++ nhdr->p_filesz += notesize(¬es[0]);
+ bufp = storenote(¬es[0], bufp);
+
+ /* set up the process info */
+@@ -296,7 +299,7 @@
+ strcpy(prpsinfo.pr_fname, "vmlinux");
+ strncpy(prpsinfo.pr_psargs, saved_command_line, ELF_PRARGSZ);
+
+- nhdr->p_filesz = notesize(¬es[1]);
++ nhdr->p_filesz += notesize(¬es[1]);
+ bufp = storenote(¬es[1], bufp);
+
+ /* set up the task structure */
+@@ -305,7 +308,7 @@
+ notes[2].datasz = sizeof(struct task_struct);
+ notes[2].data = current;
+
+- nhdr->p_filesz = notesize(¬es[2]);
++ nhdr->p_filesz += notesize(¬es[2]);
+ bufp = storenote(¬es[2], bufp);
+
+ } /* end elf_kcore_store_hdr() */
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/402-2.4.29-rtnetlink-set-multi-flags-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/402-2.4.29-rtnetlink-set-multi-flags-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/402-2.4.29-rtnetlink-set-multi-flags-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,27 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/01/25 22:06:47-08:00 tgraf@suug.ch
+# [NET]: Set NLM_F_MULTI for neighbour rtnetlink messages to userspace.
+#
+# Signed-off-by: Thomas Graf <tgraf@suug.ch>
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+# net/core/neighbour.c
+# 2005/01/25 22:06:42-08:00 tgraf@suug.ch +1 -0
+# [NET]: Set NLM_F_MULTI for neighbour rtnetlink messages to userspace.
+#
+# Signed-off-by: Thomas Graf <tgraf@suug.ch>
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+diff -Nru a/net/core/neighbour.c b/net/core/neighbour.c
+--- a/net/core/neighbour.c 2005-02-03 06:30:57 -08:00
++++ b/net/core/neighbour.c 2005-02-03 06:30:57 -08:00
+@@ -1469,6 +1469,7 @@
+
+ nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*ndm));
+ ndm = NLMSG_DATA(nlh);
++ nlh->nlmsg_flags = pid ? NLM_F_MULTI : 0;
+ ndm->ndm_family = n->ops->family;
+ ndm->ndm_flags = n->flags;
+ ndm->ndm_type = n->type;
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/403-2.4.29-hiddev-busy-loop-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/403-2.4.29-hiddev-busy-loop-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/403-2.4.29-hiddev-busy-loop-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,28 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/01/27 07:28:42-02:00 zaitcev@redhat.com
+# [PATCH] USB: Prevent hiddev from looping
+#
+# In the loop, schedule() returns with the current state TASK_RUNNING, so at the
+# next revolution it returns immediately, and the task sits there burning CPU.
+#
+# The fix is to add the forgotten state assignment.
+#
+# Patch from David Micon.
+#
+# drivers/usb/hiddev.c
+# 2005/01/26 20:24:52-02:00 zaitcev@redhat.com +1 -0
+# USB: Prevent hiddev from looping
+#
+diff -Nru a/drivers/usb/hiddev.c b/drivers/usb/hiddev.c
+--- a/drivers/usb/hiddev.c 2005-02-03 05:58:42 -08:00
++++ b/drivers/usb/hiddev.c 2005-02-03 05:58:42 -08:00
+@@ -328,6 +328,7 @@
+ }
+
+ schedule();
++ set_current_state(TASK_INTERRUPTIBLE);
+ }
+
+ set_current_state(TASK_RUNNING);
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/404-2.4.29-msf-overflow-multisession-dvd-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/404-2.4.29-msf-overflow-multisession-dvd-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/404-2.4.29-msf-overflow-multisession-dvd-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,66 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/01/28 15:18:14-02:00 kronos@kronoz.cjb.net
+# [PATCH] Fix MSF overflow in ide-cd with multisession DVDs
+#
+# This a backport of my patch that went into 2.6.10.
+#
+# cdrom_read_toc (ide-cd.c) always reads the TOC using MSF format. If the
+# last session of the disk starts beyond block 1152000 (LBA) there's an
+# overflow in the MSF format and kernel complains:
+#
+# Unable to identify CD-ROM format.
+#
+# So read the multi-session TOC in LBA format in order to avoid an
+# overflow in MSF format with multisession DVDs.
+#
+# Signed-off-by: Luca Tettamanti <kronos@kronoz.cjb.net>
+#
+# drivers/ide/ide-cd.c
+# 2005/01/08 18:53:08-02:00 kronos@kronoz.cjb.net +15 -9
+# Fix MSF overflow in ide-cd with multisession DVDs
+#
+diff -Nru a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
+--- a/drivers/ide/ide-cd.c 2005-02-03 05:58:34 -08:00
++++ b/drivers/ide/ide-cd.c 2005-02-03 05:58:34 -08:00
+@@ -2206,24 +2206,30 @@
+ /* Read the multisession information. */
+ if (toc->hdr.first_track != CDROM_LEADOUT) {
+ /* Read the multisession information. */
+- stat = cdrom_read_tocentry(drive, 0, 1, 1, (char *)&ms_tmp,
++ stat = cdrom_read_tocentry(drive, 0, 0, 1, (char *)&ms_tmp,
+ sizeof(ms_tmp), sense);
+ if (stat) return stat;
++
++ toc->last_session_lba = be32_to_cpu(ms_tmp.ent.addr.lba);
+ } else {
+- ms_tmp.ent.addr.msf.minute = 0;
+- ms_tmp.ent.addr.msf.second = 2;
+- ms_tmp.ent.addr.msf.frame = 0;
+ ms_tmp.hdr.first_track = ms_tmp.hdr.last_track = CDROM_LEADOUT;
++ toc->last_session_lba = msf_to_lba(0, 2, 0); /* 0m 2s 0f */
+ }
+
+ #if ! STANDARD_ATAPI
+- if (CDROM_CONFIG_FLAGS(drive)->tocaddr_as_bcd)
++ if (CDROM_CONFIG_FLAGS(drive)->tocaddr_as_bcd) {
++ /* Re-read multisession information using MSF format */
++ stat = cdrom_read_tocentry(drive, 0, 1, 1, (char *)&ms_tmp,
++ sizeof(ms_tmp), sense);
++ if (stat)
++ return stat;
++
+ msf_from_bcd (&ms_tmp.ent.addr.msf);
++ toc->last_session_lba = msf_to_lba(ms_tmp.ent.addr.msf.minute,
++ ms_tmp.ent.addr.msf.second,
++ ms_tmp.ent.addr.msf.frame);
++ }
+ #endif /* not STANDARD_ATAPI */
+-
+- toc->last_session_lba = msf_to_lba (ms_tmp.ent.addr.msf.minute,
+- ms_tmp.ent.addr.msf.second,
+- ms_tmp.ent.addr.msf.frame);
+
+ toc->xa_flag = (ms_tmp.hdr.first_track != ms_tmp.hdr.last_track);
+
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/405-2.4.29-sparc64-signed-atomic-values-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/405-2.4.29-sparc64-signed-atomic-values-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/405-2.4.29-sparc64-signed-atomic-values-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,80 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/01 12:26:07-08:00 davem@nuts.davemloft.net
+# [SPARC64]: __atomic_{add,sub}() must sign-extend return value.
+#
+# Even though we declare these functions as returning
+# a 32-bit signed integer, the sparc64 ABI states that
+# such functions must properly sign-extend the return
+# value to the full 64-bits.
+#
+# Due to this bug, parts of mm/rmap.c were misbehaving
+# when compiled with gcc-3.4 on sparc64. gcc-3.4 was
+# legally using a 64-bit comparison against zero with
+# the return value of __atomic_add().
+#
+# I would like to thank Hugh Daniels and others for helping
+# to track down this peculiar bug.
+#
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+# arch/sparc64/lib/atomic.S
+# 2005/02/01 12:25:42-08:00 davem@nuts.davemloft.net +21 -8
+# [SPARC64]: __atomic_{add,sub}() must sign-extend return value.
+#
+diff -Nru a/arch/sparc64/lib/atomic.S b/arch/sparc64/lib/atomic.S
+--- a/arch/sparc64/lib/atomic.S 2005-02-03 05:48:35 -08:00
++++ b/arch/sparc64/lib/atomic.S 2005-02-03 05:48:35 -08:00
+@@ -7,21 +7,34 @@
+ #include <asm/asi.h>
+
+ .text
+- .align 64
+
+ .globl atomic_impl_begin, atomic_impl_end
++atomic_impl_begin:
++ /* We use these stubs for the uncommon case
++ * of contention on the atomic value. This is
++ * so that we can keep the main fast path 8
++ * instructions long and thus fit into a single
++ * L2 cache line.
++ */
++__atomic_add_membar:
++ ba,pt %xcc, __atomic_add
++ membar #StoreLoad | #StoreStore
++
++__atomic_sub_membar:
++ ba,pt %xcc, __atomic_sub
++ membar #StoreLoad | #StoreStore
+
++ .align 64
+ .globl __atomic_add
+-atomic_impl_begin:
+ __atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
+ lduw [%o1], %g5
+ add %g5, %o0, %g7
+ cas [%o1], %g5, %g7
+ cmp %g5, %g7
+- bne,pn %icc, __atomic_add
+- membar #StoreLoad | #StoreStore
++ bne,pn %icc, __atomic_add_membar
++ add %g7, %o0, %g7
+ retl
+- add %g7, %o0, %o0
++ sra %g7, 0, %o0
+
+ .globl __atomic_sub
+ __atomic_sub: /* %o0 = increment, %o1 = atomic_ptr */
+@@ -29,8 +42,8 @@
+ sub %g5, %o0, %g7
+ cas [%o1], %g5, %g7
+ cmp %g5, %g7
+- bne,pn %icc, __atomic_sub
+- membar #StoreLoad | #StoreStore
++ bne,pn %icc, __atomic_sub_membar
++ sub %g7, %o0, %g7
+ retl
+- sub %g7, %o0, %o0
++ sra %g7, 0, %o0
+ atomic_impl_end:
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/406-2.4.29-kfree_skb-missing-memory-barrier-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/406-2.4.29-kfree_skb-missing-memory-barrier-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/406-2.4.29-kfree_skb-missing-memory-barrier-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,49 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/05 16:56:05-08:00 herbert@gondor.apana.org.au
+# [NET]: Add missing memory barrier to kfree_skb().
+#
+# Also kill kfree_skb_fast(), that is a relic from fast switching
+# which was killed off years ago.
+#
+# The bug is that in the case where we do the atomic_read()
+# optimization, we need to make sure that reads of skb state
+# later in __kfree_skb() processing (particularly the skb->list
+# BUG check) are not reordered to occur before the counter
+# read by the cpu.
+#
+# Thanks to Olaf Kirch and Anton Blanchard for discovering
+# and helping fix this bug.
+#
+# Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+# include/linux/skbuff.h
+# 2005/02/05 16:55:26-08:00 herbert@gondor.apana.org.au +5 -9
+# [NET]: Add missing memory barrier to kfree_skb().
+#
+diff -Nru a/include/linux/skbuff.h b/include/linux/skbuff.h
+--- a/include/linux/skbuff.h 2005-02-09 09:12:11 -08:00
++++ b/include/linux/skbuff.h 2005-02-09 09:12:11 -08:00
+@@ -290,15 +290,11 @@
+
+ static inline void kfree_skb(struct sk_buff *skb)
+ {
+- if (atomic_read(&skb->users) == 1 || atomic_dec_and_test(&skb->users))
+- __kfree_skb(skb);
+-}
+-
+-/* Use this if you didn't touch the skb state [for fast switching] */
+-static inline void kfree_skb_fast(struct sk_buff *skb)
+-{
+- if (atomic_read(&skb->users) == 1 || atomic_dec_and_test(&skb->users))
+- kfree_skbmem(skb);
++ if (likely(atomic_read(&skb->users) == 1))
++ smp_rmb();
++ else if (likely(!atomic_dec_and_test(&skb->users)))
++ return;
++ __kfree_skb(skb);
+ }
+
+ /**
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/408-2.4.29-sparc64-atomic-and-bitops-fixes-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/408-2.4.29-sparc64-atomic-and-bitops-fixes-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/408-2.4.29-sparc64-atomic-and-bitops-fixes-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,859 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/02/05 18:03:10-08:00 davem@nuts.davemloft.net
+# [SPARC64]: atomic and bitop fixes
+#
+# 1) Correct memory barriers. Routines not returning a value need
+# no memory barriers, however routines returning values do need
+# them.
+# 2) Actually implement non-atomic ext2 bitops.
+#
+# Thanks to Anton Blanchard for pointing out the memory barrier
+# requirements.
+#
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+# include/asm-sparc64/bitops.h
+# 2005/02/05 18:02:15-08:00 davem@nuts.davemloft.net +156 -111
+# [SPARC64]: atomic and bitop fixes
+#
+# include/asm-sparc64/atomic.h
+# 2005/02/05 18:02:15-08:00 davem@nuts.davemloft.net +38 -10
+# [SPARC64]: atomic and bitop fixes
+#
+# arch/sparc64/lib/bitops.S
+# 2005/02/05 18:02:15-08:00 davem@nuts.davemloft.net +112 -70
+# [SPARC64]: atomic and bitop fixes
+#
+# arch/sparc64/lib/atomic.S
+# 2005/02/05 18:02:15-08:00 davem@nuts.davemloft.net +59 -22
+# [SPARC64]: atomic and bitop fixes
+#
+# arch/sparc64/kernel/sparc64_ksyms.c
+# 2005/02/05 18:02:15-08:00 davem@nuts.davemloft.net +10 -7
+# [SPARC64]: atomic and bitop fixes
+#
+# arch/sparc64/kernel/smp.c
+# 2005/02/05 18:02:15-08:00 davem@nuts.davemloft.net +1 -1
+# [SPARC64]: atomic and bitop fixes
+#
+diff -Nru a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
+--- a/arch/sparc64/kernel/smp.c 2005-02-09 09:11:10 -08:00
++++ b/arch/sparc64/kernel/smp.c 2005-02-09 09:11:10 -08:00
+@@ -1034,7 +1034,7 @@
+ void smp_capture(void)
+ {
+ if (smp_processors_ready) {
+- int result = __atomic_add(1, &smp_capture_depth);
++ int result = atomic_add_ret(1, &smp_capture_depth);
+
+ membar("#StoreStore | #LoadStore");
+ if (result == 1) {
+diff -Nru a/arch/sparc64/kernel/sparc64_ksyms.c b/arch/sparc64/kernel/sparc64_ksyms.c
+--- a/arch/sparc64/kernel/sparc64_ksyms.c 2005-02-09 09:11:10 -08:00
++++ b/arch/sparc64/kernel/sparc64_ksyms.c 2005-02-09 09:11:10 -08:00
+@@ -173,18 +173,21 @@
+ EXPORT_SYMBOL(__up);
+
+ /* Atomic counter implementation. */
+-EXPORT_SYMBOL(__atomic_add);
+-EXPORT_SYMBOL(__atomic_sub);
++EXPORT_SYMBOL(atomic_add);
++EXPORT_SYMBOL(atomic_add_ret);
++EXPORT_SYMBOL(atomic_sub);
++EXPORT_SYMBOL(atomic_sub_ret);
+ #ifdef CONFIG_SMP
+ EXPORT_SYMBOL(atomic_dec_and_lock);
+ #endif
+
+ /* Atomic bit operations. */
+-EXPORT_SYMBOL(___test_and_set_bit);
+-EXPORT_SYMBOL(___test_and_clear_bit);
+-EXPORT_SYMBOL(___test_and_change_bit);
+-EXPORT_SYMBOL(___test_and_set_le_bit);
+-EXPORT_SYMBOL(___test_and_clear_le_bit);
++EXPORT_SYMBOL(test_and_set_bit);
++EXPORT_SYMBOL(test_and_clear_bit);
++EXPORT_SYMBOL(test_and_change_bit);
++EXPORT_SYMBOL(set_bit);
++EXPORT_SYMBOL(clear_bit);
++EXPORT_SYMBOL(change_bit);
+
+ EXPORT_SYMBOL(ivector_table);
+ EXPORT_SYMBOL(enable_irq);
+diff -Nru a/arch/sparc64/lib/atomic.S b/arch/sparc64/lib/atomic.S
+--- a/arch/sparc64/lib/atomic.S 2005-02-09 09:11:10 -08:00
++++ b/arch/sparc64/lib/atomic.S 2005-02-09 09:11:10 -08:00
+@@ -4,46 +4,83 @@
+ * Copyright (C) 1999 David S. Miller (davem@redhat.com)
+ */
+
++#include <linux/config.h>
+ #include <asm/asi.h>
+
++ /* On SMP we need to use memory barriers to ensure
++ * correct memory operation ordering, nop these out
++ * for uniprocessor.
++ */
++#ifdef CONFIG_SMP
++#define ATOMIC_PRE_BARRIER membar #StoreLoad | #LoadLoad
++#define ATOMIC_POST_BARRIER membar #StoreLoad | #StoreStore
++#else
++#define ATOMIC_PRE_BARRIER nop
++#define ATOMIC_POST_BARRIER nop
++#endif
++
+ .text
+
+ .globl atomic_impl_begin, atomic_impl_end
+ atomic_impl_begin:
+- /* We use these stubs for the uncommon case
+- * of contention on the atomic value. This is
+- * so that we can keep the main fast path 8
+- * instructions long and thus fit into a single
+- * L2 cache line.
++ /* Two versions of the atomic routines, one that
++ * does not return a value and does not perform
++ * memory barriers, and a second which returns
++ * a value and does the barriers.
+ */
+-__atomic_add_membar:
+- ba,pt %xcc, __atomic_add
+- membar #StoreLoad | #StoreStore
+-
+-__atomic_sub_membar:
+- ba,pt %xcc, __atomic_sub
+- membar #StoreLoad | #StoreStore
+-
+- .align 64
+- .globl __atomic_add
+-__atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
+- lduw [%o1], %g5
++ .globl atomic_add
++ .type atomic_add,#function
++atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
++1: lduw [%o1], %g5
++ add %g5, %o0, %g7
++ cas [%o1], %g5, %g7
++ cmp %g5, %g7
++ bne,pn %icc, 1b
++ nop
++ retl
++ nop
++ .size atomic_add, .-atomic_add
++
++ .globl atomic_sub
++ .type atomic_sub,#function
++atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
++1: lduw [%o1], %g5
++ sub %g5, %o0, %g7
++ cas [%o1], %g5, %g7
++ cmp %g5, %g7
++ bne,pn %icc, 1b
++ nop
++ retl
++ nop
++ .size atomic_sub, .-atomic_sub
++
++ .globl atomic_add_ret
++ .type atomic_add_ret,#function
++atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
++ ATOMIC_PRE_BARRIER
++1: lduw [%o1], %g5
+ add %g5, %o0, %g7
+ cas [%o1], %g5, %g7
+ cmp %g5, %g7
+- bne,pn %icc, __atomic_add_membar
++ bne,pn %icc, 1b
+ add %g7, %o0, %g7
++ ATOMIC_POST_BARRIER
+ retl
+ sra %g7, 0, %o0
++ .size atomic_add_ret, .-atomic_add_ret
+
+- .globl __atomic_sub
+-__atomic_sub: /* %o0 = increment, %o1 = atomic_ptr */
+- lduw [%o1], %g5
++ .globl atomic_sub_ret
++ .type atomic_sub_ret,#function
++atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
++ ATOMIC_PRE_BARRIER
++1: lduw [%o1], %g5
+ sub %g5, %o0, %g7
+ cas [%o1], %g5, %g7
+ cmp %g5, %g7
+- bne,pn %icc, __atomic_sub_membar
++ bne,pn %icc, 1b
+ sub %g7, %o0, %g7
++ ATOMIC_POST_BARRIER
+ retl
+ sra %g7, 0, %o0
++ .size atomic_sub_ret, .-atomic_sub_ret
+ atomic_impl_end:
+diff -Nru a/arch/sparc64/lib/bitops.S b/arch/sparc64/lib/bitops.S
+--- a/arch/sparc64/lib/bitops.S 2005-02-09 09:11:10 -08:00
++++ b/arch/sparc64/lib/bitops.S 2005-02-09 09:11:10 -08:00
+@@ -4,107 +4,149 @@
+ * Copyright (C) 2000 David S. Miller (davem@redhat.com)
+ */
+
++#include <linux/config.h>
+ #include <asm/asi.h>
+
++ /* On SMP we need to use memory barriers to ensure
++ * correct memory operation ordering, nop these out
++ * for uniprocessor.
++ */
++#ifdef CONFIG_SMP
++#define BITOP_PRE_BARRIER membar #StoreLoad | #LoadLoad
++#define BITOP_POST_BARRIER membar #StoreLoad | #StoreStore
++#else
++#define BITOP_PRE_BARRIER nop
++#define BITOP_POST_BARRIER nop
++#endif
++
+ .text
+- .align 64
++
+ .globl __bitops_begin
+ __bitops_begin:
+
+- .globl ___test_and_set_bit
+-___test_and_set_bit: /* %o0=nr, %o1=addr */
++
++ .globl test_and_set_bit
++ .type test_and_set_bit,#function
++test_and_set_bit: /* %o0=nr, %o1=addr */
++ BITOP_PRE_BARRIER
+ srlx %o0, 6, %g1
+ mov 1, %g5
+ sllx %g1, 3, %g3
+ and %o0, 63, %g2
+ sllx %g5, %g2, %g5
+ add %o1, %g3, %o1
+- ldx [%o1], %g7
+-1: andcc %g7, %g5, %o0
+- bne,pn %xcc, 2f
+- xor %g7, %g5, %g1
++1: ldx [%o1], %g7
++ or %g7, %g5, %g1
+ casx [%o1], %g7, %g1
+ cmp %g7, %g1
+- bne,a,pn %xcc, 1b
+- ldx [%o1], %g7
+-2: retl
+- membar #StoreLoad | #StoreStore
+-
+- .globl ___test_and_clear_bit
+-___test_and_clear_bit: /* %o0=nr, %o1=addr */
++ bne,pn %xcc, 1b
++ and %g7, %g5, %g2
++ BITOP_POST_BARRIER
++ clr %o0
++ retl
++ movrne %g2, 1, %o0
++ .size test_and_set_bit, .-test_and_set_bit
++
++ .globl test_and_clear_bit
++ .type test_and_clear_bit,#function
++test_and_clear_bit: /* %o0=nr, %o1=addr */
++ BITOP_PRE_BARRIER
+ srlx %o0, 6, %g1
+ mov 1, %g5
+ sllx %g1, 3, %g3
+ and %o0, 63, %g2
+ sllx %g5, %g2, %g5
+ add %o1, %g3, %o1
+- ldx [%o1], %g7
+-1: andcc %g7, %g5, %o0
+- be,pn %xcc, 2f
+- xor %g7, %g5, %g1
++1: ldx [%o1], %g7
++ andn %g7, %g5, %g1
+ casx [%o1], %g7, %g1
+ cmp %g7, %g1
+- bne,a,pn %xcc, 1b
+- ldx [%o1], %g7
+-2: retl
+- membar #StoreLoad | #StoreStore
+-
+- .globl ___test_and_change_bit
+-___test_and_change_bit: /* %o0=nr, %o1=addr */
++ bne,pn %xcc, 1b
++ and %g7, %g5, %g2
++ BITOP_POST_BARRIER
++ clr %o0
++ retl
++ movrne %g2, 1, %o0
++ .size test_and_clear_bit, .-test_and_clear_bit
++
++ .globl test_and_change_bit
++ .type test_and_change_bit,#function
++test_and_change_bit: /* %o0=nr, %o1=addr */
++ BITOP_PRE_BARRIER
++ srlx %o0, 6, %g1
++ mov 1, %g5
++ sllx %g1, 3, %g3
++ and %o0, 63, %g2
++ sllx %g5, %g2, %g5
++ add %o1, %g3, %o1
++1: ldx [%o1], %g7
++ xor %g7, %g5, %g1
++ casx [%o1], %g7, %g1
++ cmp %g7, %g1
++ bne,pn %xcc, 1b
++ and %g7, %g5, %g2
++ BITOP_POST_BARRIER
++ clr %o0
++ retl
++ movrne %g2, 1, %o0
++ .size test_and_change_bit, .-test_and_change_bit
++
++ .globl set_bit
++ .type set_bit,#function
++set_bit: /* %o0=nr, %o1=addr */
++ srlx %o0, 6, %g1
++ mov 1, %g5
++ sllx %g1, 3, %g3
++ and %o0, 63, %g2
++ sllx %g5, %g2, %g5
++ add %o1, %g3, %o1
++1: ldx [%o1], %g7
++ or %g7, %g5, %g1
++ casx [%o1], %g7, %g1
++ cmp %g7, %g1
++ bne,pn %xcc, 1b
++ nop
++ retl
++ nop
++ .size set_bit, .-set_bit
++
++ .globl clear_bit
++ .type clear_bit,#function
++clear_bit: /* %o0=nr, %o1=addr */
++ srlx %o0, 6, %g1
++ mov 1, %g5
++ sllx %g1, 3, %g3
++ and %o0, 63, %g2
++ sllx %g5, %g2, %g5
++ add %o1, %g3, %o1
++1: ldx [%o1], %g7
++ andn %g7, %g5, %g1
++ casx [%o1], %g7, %g1
++ cmp %g7, %g1
++ bne,pn %xcc, 1b
++ nop
++ retl
++ nop
++ .size clear_bit, .-clear_bit
++
++ .globl change_bit
++ .type change_bit,#function
++change_bit: /* %o0=nr, %o1=addr */
+ srlx %o0, 6, %g1
+ mov 1, %g5
+ sllx %g1, 3, %g3
+ and %o0, 63, %g2
+ sllx %g5, %g2, %g5
+ add %o1, %g3, %o1
+- ldx [%o1], %g7
+-1: and %g7, %g5, %o0
++1: ldx [%o1], %g7
+ xor %g7, %g5, %g1
+ casx [%o1], %g7, %g1
+ cmp %g7, %g1
+- bne,a,pn %xcc, 1b
+- ldx [%o1], %g7
+-2: retl
+- membar #StoreLoad | #StoreStore
+- nop
+-
+- .globl ___test_and_set_le_bit
+-___test_and_set_le_bit: /* %o0=nr, %o1=addr */
+- srlx %o0, 5, %g1
+- mov 1, %g5
+- sllx %g1, 2, %g3
+- and %o0, 31, %g2
+- sllx %g5, %g2, %g5
+- add %o1, %g3, %o1
+- lduwa [%o1] ASI_PL, %g7
+-1: andcc %g7, %g5, %o0
+- bne,pn %icc, 2f
+- xor %g7, %g5, %g1
+- casa [%o1] ASI_PL, %g7, %g1
+- cmp %g7, %g1
+- bne,a,pn %icc, 1b
+- lduwa [%o1] ASI_PL, %g7
+-2: retl
+- membar #StoreLoad | #StoreStore
+-
+- .globl ___test_and_clear_le_bit
+-___test_and_clear_le_bit: /* %o0=nr, %o1=addr */
+- srlx %o0, 5, %g1
+- mov 1, %g5
+- sllx %g1, 2, %g3
+- and %o0, 31, %g2
+- sllx %g5, %g2, %g5
+- add %o1, %g3, %o1
+- lduwa [%o1] ASI_PL, %g7
+-1: andcc %g7, %g5, %o0
+- be,pn %icc, 2f
+- xor %g7, %g5, %g1
+- casa [%o1] ASI_PL, %g7, %g1
+- cmp %g7, %g1
+- bne,a,pn %icc, 1b
+- lduwa [%o1] ASI_PL, %g7
+-2: retl
+- membar #StoreLoad | #StoreStore
++ bne,pn %xcc, 1b
++ nop
++ retl
++ nop
++ .size change_bit, .-change_bit
+
+ .globl __bitops_end
+ __bitops_end:
+diff -Nru a/include/asm-sparc64/atomic.h b/include/asm-sparc64/atomic.h
+--- a/include/asm-sparc64/atomic.h 2005-02-09 09:11:10 -08:00
++++ b/include/asm-sparc64/atomic.h 2005-02-09 09:11:10 -08:00
+@@ -8,31 +8,59 @@
+ #ifndef __ARCH_SPARC64_ATOMIC__
+ #define __ARCH_SPARC64_ATOMIC__
+
++#include <linux/config.h>
++
+ typedef struct { volatile int counter; } atomic_t;
+ #define ATOMIC_INIT(i) { (i) }
+
+ #define atomic_read(v) ((v)->counter)
+ #define atomic_set(v, i) (((v)->counter) = i)
+
+-extern int __atomic_add(int, atomic_t *);
+-extern int __atomic_sub(int, atomic_t *);
++extern void atomic_add(int, atomic_t *);
++extern void atomic_sub(int, atomic_t *);
++
++extern int atomic_add_ret(int, atomic_t *);
++extern int atomic_sub_ret(int, atomic_t *);
++
++#define atomic_dec_return(v) atomic_sub_ret(1, v)
++
++#define atomic_inc_return(v) atomic_add_ret(1, v)
++
++#define atomic_sub_return(i, v) atomic_sub_ret(i, v)
++
++#define atomic_add_return(i, v) atomic_add_ret(i, v)
++
++/*
++ * atomic_inc_and_test - increment and test
++ * @v: pointer of type atomic_t
++ *
++ * Atomically increments @v by 1
++ * and returns true if the result is zero, or false for all
++ * other cases.
++ */
++#define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
++
++#define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
+
+-#define atomic_add(i, v) ((void)__atomic_add(i, v))
+-#define atomic_sub(i, v) ((void)__atomic_sub(i, v))
++#define atomic_dec_and_test(v) (atomic_sub_ret(1, v) == 0)
+
+-#define atomic_dec_return(v) __atomic_sub(1, v)
+-#define atomic_inc_return(v) __atomic_add(1, v)
++#define atomic_inc(v) atomic_add(1, v)
+
+-#define atomic_sub_and_test(i, v) (__atomic_sub(i, v) == 0)
+-#define atomic_dec_and_test(v) (__atomic_sub(1, v) == 0)
++#define atomic_dec(v) atomic_sub(1, v)
+
+-#define atomic_inc(v) ((void)__atomic_add(1, v))
+-#define atomic_dec(v) ((void)__atomic_sub(1, v))
++#define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
+
+ /* Atomic operations are already serializing */
++#ifdef CONFIG_SMP
++#define smp_mb__before_atomic_dec() membar("#StoreLoad | #LoadLoad")
++#define smp_mb__after_atomic_dec() membar("#StoreLoad | #StoreStore")
++#define smp_mb__before_atomic_inc() membar("#StoreLoad | #LoadLoad")
++#define smp_mb__after_atomic_inc() membar("#StoreLoad | #StoreStore")
++#else
+ #define smp_mb__before_atomic_dec() barrier()
+ #define smp_mb__after_atomic_dec() barrier()
+ #define smp_mb__before_atomic_inc() barrier()
+ #define smp_mb__after_atomic_inc() barrier()
++#endif
+
+ #endif /* !(__ARCH_SPARC64_ATOMIC__) */
+diff -Nru a/include/asm-sparc64/bitops.h b/include/asm-sparc64/bitops.h
+--- a/include/asm-sparc64/bitops.h 2005-02-09 09:11:10 -08:00
++++ b/include/asm-sparc64/bitops.h 2005-02-09 09:11:10 -08:00
+@@ -1,4 +1,4 @@
+-/* $Id: bitops.h,v 1.38 2001/11/19 18:36:34 davem Exp $
++/* $Id: bitops.h,v 1.39 2002/01/30 01:40:00 davem Exp $
+ * bitops.h: Bit string operations on the V9.
+ *
+ * Copyright 1996, 1997 David S. Miller (davem@caip.rutgers.edu)
+@@ -7,114 +7,126 @@
+ #ifndef _SPARC64_BITOPS_H
+ #define _SPARC64_BITOPS_H
+
++#include <linux/config.h>
++#include <linux/compiler.h>
+ #include <asm/byteorder.h>
+
+-extern long ___test_and_set_bit(unsigned long nr, volatile void *addr);
+-extern long ___test_and_clear_bit(unsigned long nr, volatile void *addr);
+-extern long ___test_and_change_bit(unsigned long nr, volatile void *addr);
+-
+-#define test_and_set_bit(nr,addr) ({___test_and_set_bit(nr,addr)!=0;})
+-#define test_and_clear_bit(nr,addr) ({___test_and_clear_bit(nr,addr)!=0;})
+-#define test_and_change_bit(nr,addr) ({___test_and_change_bit(nr,addr)!=0;})
+-#define set_bit(nr,addr) ((void)___test_and_set_bit(nr,addr))
+-#define clear_bit(nr,addr) ((void)___test_and_clear_bit(nr,addr))
+-#define change_bit(nr,addr) ((void)___test_and_change_bit(nr,addr))
++extern int test_and_set_bit(unsigned long nr, volatile void *addr);
++extern int test_and_clear_bit(unsigned long nr, volatile void *addr);
++extern int test_and_change_bit(unsigned long nr, volatile void *addr);
++extern void set_bit(unsigned long nr, volatile void *addr);
++extern void clear_bit(unsigned long nr, volatile void *addr);
++extern void change_bit(unsigned long nr, volatile void *addr);
+
+ /* "non-atomic" versions... */
+-#define __set_bit(X,Y) \
+-do { unsigned long __nr = (X); \
+- long *__m = ((long *) (Y)) + (__nr >> 6); \
+- *__m |= (1UL << (__nr & 63)); \
+-} while (0)
+-#define __clear_bit(X,Y) \
+-do { unsigned long __nr = (X); \
+- long *__m = ((long *) (Y)) + (__nr >> 6); \
+- *__m &= ~(1UL << (__nr & 63)); \
+-} while (0)
+-#define __change_bit(X,Y) \
+-do { unsigned long __nr = (X); \
+- long *__m = ((long *) (Y)) + (__nr >> 6); \
+- *__m ^= (1UL << (__nr & 63)); \
+-} while (0)
+-#define __test_and_set_bit(X,Y) \
+-({ unsigned long __nr = (X); \
+- long *__m = ((long *) (Y)) + (__nr >> 6); \
+- long __old = *__m; \
+- long __mask = (1UL << (__nr & 63)); \
+- *__m = (__old | __mask); \
+- ((__old & __mask) != 0); \
+-})
+-#define __test_and_clear_bit(X,Y) \
+-({ unsigned long __nr = (X); \
+- long *__m = ((long *) (Y)) + (__nr >> 6); \
+- long __old = *__m; \
+- long __mask = (1UL << (__nr & 63)); \
+- *__m = (__old & ~__mask); \
+- ((__old & __mask) != 0); \
+-})
+-#define __test_and_change_bit(X,Y) \
+-({ unsigned long __nr = (X); \
+- long *__m = ((long *) (Y)) + (__nr >> 6); \
+- long __old = *__m; \
+- long __mask = (1UL << (__nr & 63)); \
+- *__m = (__old ^ __mask); \
+- ((__old & __mask) != 0); \
+-})
+
+-#define smp_mb__before_clear_bit() do { } while(0)
+-#define smp_mb__after_clear_bit() do { } while(0)
++static __inline__ void __set_bit(int nr, volatile void *addr)
++{
++ unsigned long *m;
++
++ m = ((unsigned long *)addr) + (nr >> 6);
++ *m |= (1UL << (nr & 63));
++}
++
++static __inline__ void __clear_bit(int nr, volatile void *addr)
++{
++ unsigned long *m;
++
++ m = ((unsigned long *)addr) + (nr >> 6);
++ *m &= ~(1UL << (nr & 63));
++}
+
+-extern __inline__ int test_bit(int nr, __const__ void *addr)
++static __inline__ void __change_bit(int nr, volatile void *addr)
+ {
+- return (1UL & (((__const__ long *) addr)[nr >> 6] >> (nr & 63))) != 0UL;
++ unsigned long *m;
++
++ m = ((unsigned long *)addr) + (nr >> 6);
++ *m ^= (1UL << (nr & 63));
++}
++
++static __inline__ int __test_and_set_bit(int nr, volatile void *addr)
++{
++ unsigned long *m = ((unsigned long *)addr) + (nr >> 6);
++ unsigned long old = *m;
++ unsigned long mask = (1UL << (nr & 63));
++
++ *m = (old | mask);
++ return ((old & mask) != 0);
++}
++
++static __inline__ int __test_and_clear_bit(int nr, volatile void *addr)
++{
++ unsigned long *m = ((unsigned long *)addr) + (nr >> 6);
++ unsigned long old = *m;
++ unsigned long mask = (1UL << (nr & 63));
++
++ *m = (old & ~mask);
++ return ((old & mask) != 0);
++}
++
++static __inline__ int __test_and_change_bit(int nr, volatile void *addr)
++{
++ unsigned long *m = ((unsigned long *)addr) + (nr >> 6);
++ unsigned long old = *m;
++ unsigned long mask = (1UL << (nr & 63));
++
++ *m = (old ^ mask);
++ return ((old & mask) != 0);
++}
++
++#ifdef CONFIG_SMP
++#define smp_mb__before_clear_bit() membar("#StoreLoad | #LoadLoad")
++#define smp_mb__after_clear_bit() membar("#StoreLoad | #StoreStore")
++#else
++#define smp_mb__before_clear_bit() barrier()
++#define smp_mb__after_clear_bit() barrier()
++#endif
++
++static __inline__ int test_bit(int nr, __const__ volatile void *_addr)
++{
++ __const__ unsigned long *addr;
++
++ addr = (__const__ unsigned long *) _addr;
++
++ return (1UL & ((addr)[nr >> 6] >> (nr & 63))) != 0UL;
+ }
+
+ /* The easy/cheese version for now. */
+-extern __inline__ unsigned long ffz(unsigned long word)
++static __inline__ unsigned long ffz(unsigned long word)
+ {
+ unsigned long result;
+
+-#ifdef ULTRA_HAS_POPULATION_COUNT /* Thanks for nothing Sun... */
+- __asm__ __volatile__(
+-" brz,pn %0, 1f\n"
+-" neg %0, %%g1\n"
+-" xnor %0, %%g1, %%g2\n"
+-" popc %%g2, %0\n"
+-"1: " : "=&r" (result)
+- : "0" (word)
+- : "g1", "g2");
+-#else
+-#if 1 /* def EASY_CHEESE_VERSION */
+ result = 0;
+ while(word & 1) {
+ result++;
+ word >>= 1;
+ }
+-#else
+- unsigned long tmp;
++ return result;
++}
+
+- result = 0;
+- tmp = ~word & -~word;
+- if (!(unsigned)tmp) {
+- tmp >>= 32;
+- result = 32;
+- }
+- if (!(unsigned short)tmp) {
+- tmp >>= 16;
+- result += 16;
+- }
+- if (!(unsigned char)tmp) {
+- tmp >>= 8;
+- result += 8;
++/**
++ * __ffs - find first bit in word.
++ * @word: The word to search
++ *
++ * Undefined if no bit exists, so code should check against 0 first.
++ */
++static __inline__ unsigned long __ffs(unsigned long word)
++{
++ unsigned long result = 0;
++
++ while (!(word & 1UL)) {
++ result++;
++ word >>= 1;
+ }
+- if (tmp & 0xf0) result += 4;
+- if (tmp & 0xcc) result += 2;
+- if (tmp & 0xaa) result ++;
+-#endif
+-#endif
+ return result;
+ }
+
++/*
++ * fls: find last bit set.
++ */
++
++#define fls(x) generic_fls(x)
++
+ #ifdef __KERNEL__
+
+ /*
+@@ -122,8 +134,12 @@
+ * the libc and compiler builtin ffs routines, therefore
+ * differs in spirit from the above ffz (man ffs).
+ */
+-
+-#define ffs(x) generic_ffs(x)
++static __inline__ int ffs(int x)
++{
++ if (!x)
++ return 0;
++ return __ffs((unsigned long)x) + 1;
++}
+
+ /*
+ * hweightN: returns the hamming weight (i.e. the number
+@@ -132,7 +148,15 @@
+
+ #ifdef ULTRA_HAS_POPULATION_COUNT
+
+-extern __inline__ unsigned int hweight32(unsigned int w)
++static __inline__ unsigned int hweight64(unsigned long w)
++{
++ unsigned int res;
++
++ __asm__ ("popc %1,%0" : "=r" (res) : "r" (w));
++ return res;
++}
++
++static __inline__ unsigned int hweight32(unsigned int w)
+ {
+ unsigned int res;
+
+@@ -140,7 +164,7 @@
+ return res;
+ }
+
+-extern __inline__ unsigned int hweight16(unsigned int w)
++static __inline__ unsigned int hweight16(unsigned int w)
+ {
+ unsigned int res;
+
+@@ -148,7 +172,7 @@
+ return res;
+ }
+
+-extern __inline__ unsigned int hweight8(unsigned int w)
++static __inline__ unsigned int hweight8(unsigned int w)
+ {
+ unsigned int res;
+
+@@ -158,6 +182,7 @@
+
+ #else
+
++#define hweight64(x) generic_hweight64(x)
+ #define hweight32(x) generic_hweight32(x)
+ #define hweight16(x) generic_hweight16(x)
+ #define hweight8(x) generic_hweight8(x)
+@@ -170,7 +195,7 @@
+ * on Linus's ALPHA routines, which are pretty portable BTW.
+ */
+
+-extern __inline__ unsigned long find_next_zero_bit(void *addr, unsigned long size, unsigned long offset)
++static __inline__ unsigned long find_next_zero_bit(void *addr, unsigned long size, unsigned long offset)
+ {
+ unsigned long *p = ((unsigned long *) addr) + (offset >> 6);
+ unsigned long result = offset & ~63UL;
+@@ -211,15 +236,12 @@
+ #define find_first_zero_bit(addr, size) \
+ find_next_zero_bit((addr), (size), 0)
+
+-extern long ___test_and_set_le_bit(int nr, volatile void *addr);
+-extern long ___test_and_clear_le_bit(int nr, volatile void *addr);
+-
+-#define test_and_set_le_bit(nr,addr) ({___test_and_set_le_bit(nr,addr)!=0;})
+-#define test_and_clear_le_bit(nr,addr) ({___test_and_clear_le_bit(nr,addr)!=0;})
+-#define set_le_bit(nr,addr) ((void)___test_and_set_le_bit(nr,addr))
+-#define clear_le_bit(nr,addr) ((void)___test_and_clear_le_bit(nr,addr))
++#define test_and_set_le_bit(nr,addr) \
++ test_and_set_bit((nr) ^ 0x38, (addr))
++#define test_and_clear_le_bit(nr,addr) \
++ test_and_clear_bit((nr) ^ 0x38, (addr))
+
+-extern __inline__ int test_le_bit(int nr, __const__ void * addr)
++static __inline__ int test_le_bit(int nr, __const__ void *addr)
+ {
+ int mask;
+ __const__ unsigned char *ADDR = (__const__ unsigned char *) addr;
+@@ -232,7 +254,7 @@
+ #define find_first_zero_le_bit(addr, size) \
+ find_next_zero_le_bit((addr), (size), 0)
+
+-extern __inline__ unsigned long find_next_zero_le_bit(void *addr, unsigned long size, unsigned long offset)
++static __inline__ unsigned long find_next_zero_le_bit(void *addr, unsigned long size, unsigned long offset)
+ {
+ unsigned long *p = ((unsigned long *) addr) + (offset >> 6);
+ unsigned long result = offset & ~63UL;
+@@ -271,18 +293,41 @@
+
+ #ifdef __KERNEL__
+
+-#define ext2_set_bit test_and_set_le_bit
+-#define ext2_clear_bit test_and_clear_le_bit
+-#define ext2_test_bit test_le_bit
+-#define ext2_find_first_zero_bit find_first_zero_le_bit
+-#define ext2_find_next_zero_bit find_next_zero_le_bit
++#define __set_le_bit(nr, addr) \
++ __set_bit((nr) ^ 0x38, (addr))
++#define __clear_le_bit(nr, addr) \
++ __clear_bit((nr) ^ 0x38, (addr))
++#define __test_and_clear_le_bit(nr, addr) \
++ __test_and_clear_bit((nr) ^ 0x38, (addr))
++#define __test_and_set_le_bit(nr, addr) \
++ __test_and_set_bit((nr) ^ 0x38, (addr))
++
++#define ext2_set_bit(nr,addr) \
++ __test_and_set_le_bit((nr),(unsigned long *)(addr))
++#define ext2_set_bit_atomic(lock,nr,addr) \
++ test_and_set_le_bit((nr),(unsigned long *)(addr))
++#define ext2_clear_bit(nr,addr) \
++ __test_and_clear_le_bit((nr),(unsigned long *)(addr))
++#define ext2_clear_bit_atomic(lock,nr,addr) \
++ test_and_clear_le_bit((nr),(unsigned long *)(addr))
++#define ext2_test_bit(nr,addr) \
++ test_le_bit((nr),(unsigned long *)(addr))
++#define ext2_find_first_zero_bit(addr, size) \
++ find_first_zero_le_bit((unsigned long *)(addr), (size))
++#define ext2_find_next_zero_bit(addr, size, off) \
++ find_next_zero_le_bit((unsigned long *)(addr), (size), (off))
+
+ /* Bitmap functions for the minix filesystem. */
+-#define minix_test_and_set_bit(nr,addr) test_and_set_bit(nr,addr)
+-#define minix_set_bit(nr,addr) set_bit(nr,addr)
+-#define minix_test_and_clear_bit(nr,addr) test_and_clear_bit(nr,addr)
+-#define minix_test_bit(nr,addr) test_bit(nr,addr)
+-#define minix_find_first_zero_bit(addr,size) find_first_zero_bit(addr,size)
++#define minix_test_and_set_bit(nr,addr) \
++ test_and_set_bit((nr),(unsigned long *)(addr))
++#define minix_set_bit(nr,addr) \
++ set_bit((nr),(unsigned long *)(addr))
++#define minix_test_and_clear_bit(nr,addr) \
++ test_and_clear_bit((nr),(unsigned long *)(addr))
++#define minix_test_bit(nr,addr) \
++ test_bit((nr),(unsigned long *)(addr))
++#define minix_find_first_zero_bit(addr,size) \
++ find_first_zero_bit((unsigned long *)(addr),(size))
+
+ #endif /* __KERNEL__ */
+
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/501-2.4.29-configure-mangles-hex-values-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/501-2.4.29-configure-mangles-hex-values-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/501-2.4.29-configure-mangles-hex-values-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,51 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2005/01/28 07:46:20-02:00 npollitt@mvista.com
+# [PATCH] Configure mangles hex values
+#
+# When doing a make oldconfig, the hex function strips the leading '0x' from hex
+# values. The '0x' is needed in the final autoconf.h, and its absence causes
+# the following problem.
+#
+# If I start with a hex value in my config file like this:
+# CONFIG_LOWMEM_SIZE=0x40000000
+# When I run make oldconfig, it strips out the '0x' leaving this:
+# CONFIG_LOWMEM_SIZE=40000000
+# Then if I run make xconfig, this is not considered a valid hex value, so it
+# replaces my value with the default:
+# CONFIG_LOWMEM_SIZE=0x20000000
+#
+# The following patch removes the lines that strip the 0x from the hex value.
+# It also checks the result for the leading 0x and inserts it if necessary.
+#
+# scripts/Configure
+# 2005/01/26 21:19:52-02:00 npollitt@mvista.com +7 -4
+# Configure mangles hex values
+#
+diff -Nru a/scripts/Configure b/scripts/Configure
+--- a/scripts/Configure 2005-02-03 05:58:38 -08:00
++++ b/scripts/Configure 2005-02-03 05:58:38 -08:00
+@@ -378,15 +378,18 @@
+ function hex () {
+ old=$(eval echo "\${$2}")
+ def=${old:-$3}
+- def=${def#*[x,X]}
+ while :; do
+ readln "$1 ($2) [$def] " "$def" "$old"
+- ans=${ans#*[x,X]}
+- if expr "$ans" : '[0-9a-fA-F][0-9a-fA-F]*$' > /dev/null; then
++ if expr "$ans" : '0x[0-9a-fA-F][0-9a-fA-F]*$' > /dev/null; then
+ define_hex "$2" "$ans"
+ break
+ else
+- help "$2"
++ if expr "$ans" : '[0-9a-fA-F][0-9a-fA-F]*$' > /dev/null; then
++ define_hex "$2" "0x$ans"
++ break
++ else
++ help "$2"
++ fi
+ fi
+ done
+ }
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/502-2.4.29-sparc-membar-extra-semi-colons-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/502-2.4.29-sparc-membar-extra-semi-colons-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/502-2.4.29-sparc-membar-extra-semi-colons-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,15 @@
+--- ./include/asm-sparc/system.h.bad Sat Sep 18 14:15:43 2004
++++ ./include/asm-sparc/system.h Sat Feb 12 10:55:05 2005
+@@ -295,9 +295,9 @@
+ #define wmb() mb()
+ #define set_mb(__var, __value) do { __var = __value; mb(); } while(0)
+ #define set_wmb(__var, __value) set_mb(__var, __value)
+-#define smp_mb() __asm__ __volatile__("":::"memory");
+-#define smp_rmb() __asm__ __volatile__("":::"memory");
+-#define smp_wmb() __asm__ __volatile__("":::"memory");
++#define smp_mb() __asm__ __volatile__("":::"memory")
++#define smp_rmb() __asm__ __volatile__("":::"memory")
++#define smp_wmb() __asm__ __volatile__("":::"memory")
+
+ #define nop() __asm__ __volatile__ ("nop");
+
Added: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/503-2.4.29-sparc64-membar-extra-semi-colons-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/503-2.4.29-sparc64-membar-extra-semi-colons-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/503-2.4.29-sparc64-membar-extra-semi-colons-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -0,0 +1,36 @@
+--- ./include/asm-sparc64/system.h.bad Sat Feb 12 10:40:21 2005
++++ ./include/asm-sparc64/system.h Sat Feb 12 10:54:17 2005
+@@ -106,9 +106,9 @@
+
+ #define nop() __asm__ __volatile__ ("nop")
+
+-#define membar(type) __asm__ __volatile__ ("membar " type : : : "memory");
++#define membar(type) __asm__ __volatile__ ("membar " type : : : "memory")
+ #define mb() \
+- membar("#LoadLoad | #LoadStore | #StoreStore | #StoreLoad");
++ membar("#LoadLoad | #LoadStore | #StoreStore | #StoreLoad")
+ #define rmb() membar("#LoadLoad")
+ #define wmb() membar("#StoreStore")
+ #define set_mb(__var, __value) \
+@@ -121,9 +121,9 @@
+ #define smp_rmb() rmb()
+ #define smp_wmb() wmb()
+ #else
+-#define smp_mb() __asm__ __volatile__("":::"memory");
+-#define smp_rmb() __asm__ __volatile__("":::"memory");
+-#define smp_wmb() __asm__ __volatile__("":::"memory");
++#define smp_mb() __asm__ __volatile__("":::"memory")
++#define smp_rmb() __asm__ __volatile__("":::"memory")
++#define smp_wmb() __asm__ __volatile__("":::"memory")
+ #endif
+
+ #define flushi(addr) __asm__ __volatile__ ("flush %0" : : "r" (addr) : "memory")
+@@ -132,7 +132,7 @@
+
+ /* Performance counter register access. */
+ #define read_pcr(__p) __asm__ __volatile__("rd %%pcr, %0" : "=r" (__p))
+-#define write_pcr(__p) __asm__ __volatile__("wr %0, 0x0, %%pcr" : : "r" (__p));
++#define write_pcr(__p) __asm__ __volatile__("wr %0, 0x0, %%pcr" : : "r" (__p))
+ #define read_pic(__p) __asm__ __volatile__("rd %%pic, %0" : "=r" (__p))
+
+ /* Blackbird errata workaround. See commentary in
Modified: trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/series/2.4.29-1
===================================================================
--- trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/series/2.4.29-1 2005-02-16 03:36:00 UTC (rev 2494)
+++ trunk/kernel-2.4/source/kernel-source-2.4.29-2.4.29/debian/patches/series/2.4.29-1 2005-02-16 07:31:30 UTC (rev 2495)
@@ -80,7 +80,7 @@
+ 080_modular_ide-proc.diff
+ 082_global_scan_direction.diff
+ 083_ide_pci_scan_delay.diff
-+ 084_ea_acl-2.diff
++ 084_ea_acl-2.diff
+ 086_ver_linux_ld.diff
+ 087_mkdep_xargs.diff
+ 088_dont_use_infobox.diff
@@ -90,3 +90,28 @@
+ 095_sparc32_initrd_memcpy.diff
+ 096_megaraid2_proc_name.diff
+ 097_ipsec.diff
++ 101-2.4.29-flash_erase-checks-cap_sys_admin-1
++ 102-2.4.29-rw_verify_area-against-file-offset-overflow-2
++ 103-2.4.29-rw_verify_area-missing-f_maxcount-1
++ 104-2.4.29-wireless-data-leak-1
++ 201-2.4.29-panic-when-backing-up-lvm-snapshots-1
++ 201-2.4.29-sparc64-xchg-use-membars-1
++ 202-2.4.29-sparc64-locks-use-membars-1
++ 203-2.4.29-ipconfig-use-memmove-not-strcpy-1
++ 204-2.4.29-sparc64-mask-32bits-stack-ptr-1
++ 205-2.4.29-i386-pci-irq-displays-wrong-pin-1
++ 206-2.4.29-lp_write-race-can-corrupt-data-1
++ 301-2.4.29-oops-ata_to_sense_error-1
++ 302-2.4.29-lcd_ioctl-memory-leak-1
++ 303-2.4.29-pkt_sched-netem-leaks-memory-1
++ 304-2.4.29-netlink-fix-nlmsg_goodsize-calculation-1
++ 305-2.4.29-proc-kcore-memory-corruption-1
++ 402-2.4.29-rtnetlink-set-multi-flags-1
++ 403-2.4.29-hiddev-busy-loop-1
++ 404-2.4.29-msf-overflow-multisession-dvd-1
++ 405-2.4.29-sparc64-signed-atomic-values-1
++ 406-2.4.29-kfree_skb-missing-memory-barrier-1
++ 408-2.4.29-sparc64-atomic-and-bitops-fixes-1
++ 501-2.4.29-configure-mangles-hex-values-1
++ 502-2.4.29-sparc-membar-extra-semi-colons-1
++ 503-2.4.29-sparc64-membar-extra-semi-colons-1