[kernel] r8043 - in dists/sid/linux-2.6/debian: . patches/bugfix
patches/series
maximilian attems
maks-guest at alioth.debian.org
Thu Dec 28 21:49:54 UTC 2006
Author: maks-guest
Date: Thu Dec 28 22:49:53 2006
New Revision: 8043
Added:
dists/sid/linux-2.6/debian/patches/bugfix/2.6.16.35
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/9
Log:
add open 2.6.16.35 fixes
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog (original)
+++ dists/sid/linux-2.6/debian/changelog Thu Dec 28 22:49:53 2006
@@ -49,8 +49,19 @@
* Hand-picked from stable release 2.6.16.34:
- [IPX]: Annotate and fix IPX checksum
- [IGMP]: Fix IGMPV3_EXP() normalization bit shift value.
+ * Hand-picked from stable release 2.6.16.35:
+ - sgiioc4: Disable module unload
+ - Fix a masking bug in the 6pack driver.
+ - drivers/usb/input/ati_remote.c: fix cut'n'paste error
+ - [EBTABLES]: Prevent wraparounds in checks for entry components' sizes.
+ - [EBTABLES]: Deal with the worst-case behaviour in loop checks.
+ - [EBTABLES]: Verify that ebt_entries have zero ->distinguisher.
+ - [EBTABLES]: Fix wraparounds in ebt_entries verification.
+ - [PKT_SCHED] act_gact: division by zero
+ - [NET_SCHED]: policer: restore compatibility with old iproute binaries
+ - proper flags type of spin_lock_irqsave()
- -- maximilian attems <maks at sternwelten.at> Thu, 28 Dec 2006 22:38:00 +0100
+ -- maximilian attems <maks at sternwelten.at> Thu, 28 Dec 2006 22:43:53 +0100
linux-2.6 (2.6.18-8) unstable; urgency=low
Added: dists/sid/linux-2.6/debian/patches/bugfix/2.6.16.35
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/bugfix/2.6.16.35 Thu Dec 28 22:49:53 2006
@@ -0,0 +1,568 @@
+diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
+index ee7eec9..ca47dbb 100644
+--- a/arch/ia64/kernel/mca.c
++++ b/arch/ia64/kernel/mca.c
+@@ -220,7 +220,7 @@ ia64_log_get(int sal_info_type, u8 **buffer, int irq_safe)
+ {
+ sal_log_record_header_t *log_buffer;
+ u64 total_len = 0;
+- int s;
++ unsigned long s;
+
+ IA64_LOG_LOCK(sal_info_type);
+
+diff --git a/arch/ia64/sn/pci/pcibr/pcibr_ate.c b/arch/ia64/sn/pci/pcibr/pcibr_ate.c
+index 1f0253b..5eb1e1e 100644
+--- a/arch/ia64/sn/pci/pcibr/pcibr_ate.c
++++ b/arch/ia64/sn/pci/pcibr/pcibr_ate.c
+@@ -160,7 +160,7 @@ void pcibr_ate_free(struct pcibus_info *pcibus_info, int index)
+
+ volatile u64 ate;
+ int count;
+- u64 flags;
++ unsigned long flags;
+
+ if (pcibr_invalidate_ate) {
+ /* For debugging purposes, clear the valid bit in the ATE */
+diff --git a/arch/ia64/sn/pci/pcibr/pcibr_dma.c b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
+index 9f86bb6..6749a3d 100644
+--- a/arch/ia64/sn/pci/pcibr/pcibr_dma.c
++++ b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
+@@ -212,7 +212,7 @@ void sn_dma_flush(u64 addr)
+ int is_tio;
+ int wid_num;
+ int i, j;
+- u64 flags;
++ unsigned long flags;
+ u64 itte;
+ struct hubdev_info *hubinfo;
+ struct sn_flush_device_kernel *p;
+diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c
+index 2dc06b8..01768a6 100644
+--- a/arch/parisc/kernel/firmware.c
++++ b/arch/parisc/kernel/firmware.c
+@@ -1013,7 +1013,7 @@ void pdc_iodc_putc(unsigned char c)
+ static int __attribute__((aligned(8))) iodc_retbuf[32];
+ static char __attribute__((aligned(64))) iodc_dbuf[4096];
+ unsigned int n;
+- unsigned int flags;
++ unsigned long flags;
+
+ switch (c) {
+ case '\n':
+@@ -1052,7 +1052,8 @@ void pdc_iodc_putc(unsigned char c)
+ */
+ void pdc_iodc_outc(unsigned char c)
+ {
+- unsigned int n, flags;
++ unsigned int n;
++ unsigned long flags;
+
+ /* fill buffer with one caracter and print it */
+ static int __attribute__((aligned(8))) iodc_retbuf[32];
+@@ -1077,7 +1078,7 @@ void pdc_iodc_outc(unsigned char c)
+ */
+ int pdc_iodc_getc(void)
+ {
+- unsigned int flags;
++ unsigned long flags;
+ static int __attribute__((aligned(8))) iodc_retbuf[32];
+ static char __attribute__((aligned(64))) iodc_dbuf[4096];
+ int ch;
+diff --git a/arch/v850/kernel/memcons.c b/arch/v850/kernel/memcons.c
+index 491614c..815f8a4 100644
+--- a/arch/v850/kernel/memcons.c
++++ b/arch/v850/kernel/memcons.c
+@@ -30,7 +30,7 @@ static DEFINE_SPINLOCK(memcons_lock);
+
+ static size_t write (const char *buf, size_t len)
+ {
+- int flags;
++ unsigned long flags;
+ char *point;
+
+ spin_lock_irqsave (memcons_lock, flags);
+diff --git a/arch/v850/kernel/rte_cb_leds.c b/arch/v850/kernel/rte_cb_leds.c
+index b662ad8..214fdec 100644
+--- a/arch/v850/kernel/rte_cb_leds.c
++++ b/arch/v850/kernel/rte_cb_leds.c
+@@ -43,7 +43,7 @@ do { \
+ len = LED_NUM_DIGITS - pos; \
+ \
+ if (len > 0) { \
+- int _flags; \
++ unsigned long _flags; \
+ const char *_end = buf + len; \
+ img_decl = &leds_image[pos]; \
+ \
+diff --git a/arch/v850/kernel/rte_mb_a_pci.c b/arch/v850/kernel/rte_mb_a_pci.c
+index ffbb6d0..88e5c93 100644
+--- a/arch/v850/kernel/rte_mb_a_pci.c
++++ b/arch/v850/kernel/rte_mb_a_pci.c
+@@ -366,7 +366,7 @@ static DEFINE_SPINLOCK(mb_sram_lock);
+ static void *alloc_mb_sram (size_t size)
+ {
+ struct mb_sram_free_area *prev, *fa;
+- int flags;
++ unsigned long flags;
+ void *mem = 0;
+
+ spin_lock_irqsave (mb_sram_lock, flags);
+@@ -407,7 +407,7 @@ static void *alloc_mb_sram (size_t size)
+ static void free_mb_sram (void *mem, size_t size)
+ {
+ struct mb_sram_free_area *prev, *fa, *new_fa;
+- int flags;
++ unsigned long flags;
+ void *end = mem + size;
+
+ spin_lock_irqsave (mb_sram_lock, flags);
+@@ -518,7 +518,7 @@ static DEFINE_SPINLOCK(dma_mappings_lock);
+
+ static struct dma_mapping *new_dma_mapping (size_t size)
+ {
+- int flags;
++ unsigned long flags;
+ struct dma_mapping *mapping;
+ void *mb_sram_block = alloc_mb_sram (size);
+
+@@ -576,7 +576,7 @@ static struct dma_mapping *new_dma_mapping (size_t size)
+
+ static struct dma_mapping *find_dma_mapping (void *mb_sram_addr)
+ {
+- int flags;
++ unsigned long flags;
+ struct dma_mapping *mapping;
+
+ spin_lock_irqsave (dma_mappings_lock, flags);
+@@ -593,7 +593,7 @@ static struct dma_mapping *find_dma_mapping (void *mb_sram_addr)
+
+ static struct dma_mapping *deactivate_dma_mapping (void *mb_sram_addr)
+ {
+- int flags;
++ unsigned long flags;
+ struct dma_mapping *mapping, *prev;
+
+ spin_lock_irqsave (dma_mappings_lock, flags);
+@@ -623,7 +623,7 @@ static struct dma_mapping *deactivate_dma_mapping (void *mb_sram_addr)
+ static inline void
+ free_dma_mapping (struct dma_mapping *mapping)
+ {
+- int flags;
++ unsigned long flags;
+
+ free_mb_sram (mapping->mb_sram_addr, mapping->size);
+
+diff --git a/drivers/char/ds1286.c b/drivers/char/ds1286.c
+index d755cac..38401da 100644
+--- a/drivers/char/ds1286.c
++++ b/drivers/char/ds1286.c
+@@ -104,7 +104,7 @@ static int ds1286_ioctl(struct inode *inode, struct file *file,
+ switch (cmd) {
+ case RTC_AIE_OFF: /* Mask alarm int. enab. bit */
+ {
+- unsigned int flags;
++ unsigned long flags;
+ unsigned char val;
+
+ if (!capable(CAP_SYS_TIME))
+@@ -120,7 +120,7 @@ static int ds1286_ioctl(struct inode *inode, struct file *file,
+ }
+ case RTC_AIE_ON: /* Allow alarm interrupts. */
+ {
+- unsigned int flags;
++ unsigned long flags;
+ unsigned char val;
+
+ if (!capable(CAP_SYS_TIME))
+@@ -136,7 +136,7 @@ static int ds1286_ioctl(struct inode *inode, struct file *file,
+ }
+ case RTC_WIE_OFF: /* Mask watchdog int. enab. bit */
+ {
+- unsigned int flags;
++ unsigned long flags;
+ unsigned char val;
+
+ if (!capable(CAP_SYS_TIME))
+@@ -152,7 +152,7 @@ static int ds1286_ioctl(struct inode *inode, struct file *file,
+ }
+ case RTC_WIE_ON: /* Allow watchdog interrupts. */
+ {
+- unsigned int flags;
++ unsigned long flags;
+ unsigned char val;
+
+ if (!capable(CAP_SYS_TIME))
+@@ -434,7 +434,7 @@ static inline unsigned char ds1286_is_updating(void)
+ static void ds1286_get_time(struct rtc_time *rtc_tm)
+ {
+ unsigned char save_control;
+- unsigned int flags;
++ unsigned long flags;
+ unsigned long uip_watchdog = jiffies;
+
+ /*
+@@ -494,7 +494,8 @@ static int ds1286_set_time(struct rtc_time *rtc_tm)
+ {
+ unsigned char mon, day, hrs, min, sec, leap_yr;
+ unsigned char save_control;
+- unsigned int yrs, flags;
++ unsigned int yrs;
++ unsigned long flags;
+
+
+ yrs = rtc_tm->tm_year + 1900;
+@@ -552,7 +553,7 @@ static int ds1286_set_time(struct rtc_time *rtc_tm)
+ static void ds1286_get_alm_time(struct rtc_time *alm_tm)
+ {
+ unsigned char cmd;
+- unsigned int flags;
++ unsigned long flags;
+
+ /*
+ * Only the values that we read from the RTC are set. That
+diff --git a/drivers/i2c/busses/i2c-ite.c b/drivers/i2c/busses/i2c-ite.c
+index 5f5d294..df3e57e 100644
+--- a/drivers/i2c/busses/i2c-ite.c
++++ b/drivers/i2c/busses/i2c-ite.c
+@@ -109,7 +109,7 @@ static int iic_ite_getclock(void *data)
+ static void iic_ite_waitforpin(void) {
+ DEFINE_WAIT(wait);
+ int timeout = 2;
+- long flags;
++ unsigned long flags;
+
+ /* If interrupts are enabled (which they are), then put the process to
+ * sleep. This process will be awakened by two events -- either the
+diff --git a/drivers/ide/pci/sgiioc4.c b/drivers/ide/pci/sgiioc4.c
+index 43b96e2..bde8809 100644
+--- a/drivers/ide/pci/sgiioc4.c
++++ b/drivers/ide/pci/sgiioc4.c
+@@ -734,14 +734,7 @@ ioc4_ide_init(void)
+ return ioc4_register_submodule(&ioc4_ide_submodule);
+ }
+
+-static void __devexit
+-ioc4_ide_exit(void)
+-{
+- ioc4_unregister_submodule(&ioc4_ide_submodule);
+-}
+-
+ module_init(ioc4_ide_init);
+-module_exit(ioc4_ide_exit);
+
+ MODULE_AUTHOR("Aniket Malatpure/Jeremy Higdon");
+ MODULE_DESCRIPTION("IDE PCI driver module for SGI IOC4 Base-IO Card");
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 102c1f0..d1f6895 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -915,7 +915,7 @@ static void decode_prio_command(struct sixpack *sp, unsigned char cmd)
+ printk(KERN_DEBUG "6pack: protocol violation\n");
+ else
+ sp->status = 0;
+- cmd &= !SIXP_RX_DCD_MASK;
++ cmd &= ~SIXP_RX_DCD_MASK;
+ }
+ sp->status = cmd & SIXP_PRIO_DATA_MASK;
+ } else { /* output watchdog char if idle */
+diff --git a/drivers/usb/input/ati_remote.c b/drivers/usb/input/ati_remote.c
+index f7bdc50..cea6d4b 100644
+--- a/drivers/usb/input/ati_remote.c
++++ b/drivers/usb/input/ati_remote.c
+@@ -626,7 +626,7 @@ static void ati_remote_free_buffers(struct ati_remote *ati_remote)
+
+ if (ati_remote->outbuf)
+ usb_buffer_free(ati_remote->udev, DATA_BUFSIZE,
+- ati_remote->inbuf, ati_remote->outbuf_dma);
++ ati_remote->outbuf, ati_remote->outbuf_dma);
+ }
+
+ static void ati_remote_input_init(struct ati_remote *ati_remote)
+diff --git a/include/asm-parisc/semaphore.h b/include/asm-parisc/semaphore.h
+index c9ee41c..d45827a 100644
+--- a/include/asm-parisc/semaphore.h
++++ b/include/asm-parisc/semaphore.h
+@@ -115,7 +115,8 @@ extern __inline__ int down_interruptible(struct semaphore * sem)
+ */
+ extern __inline__ int down_trylock(struct semaphore * sem)
+ {
+- int flags, count;
++ unsigned long flags;
++ int count;
+
+ spin_lock_irqsave(&sem->sentry, flags);
+ count = sem->count - 1;
+@@ -131,7 +132,8 @@ extern __inline__ int down_trylock(struct semaphore * sem)
+ */
+ extern __inline__ void up(struct semaphore * sem)
+ {
+- int flags;
++ unsigned long flags;
++
+ spin_lock_irqsave(&sem->sentry, flags);
+ if (sem->count < 0) {
+ __up(sem);
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index cbd4020..8171fea 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -359,10 +359,11 @@ ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
+ const char *name, unsigned int hookmask, unsigned int *cnt)
+ {
+ struct ebt_match *match;
++ size_t left = ((char *)e + e->watchers_offset) - (char *)m;
+ int ret;
+
+- if (((char *)m) + m->match_size + sizeof(struct ebt_entry_match) >
+- ((char *)e) + e->watchers_offset)
++ if (left < sizeof(struct ebt_entry_match) ||
++ left - sizeof(struct ebt_entry_match) < m->match_size)
+ return -EINVAL;
+ match = find_match_lock(m->u.name, &ret, &ebt_mutex);
+ if (!match)
+@@ -388,10 +389,11 @@ ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
+ const char *name, unsigned int hookmask, unsigned int *cnt)
+ {
+ struct ebt_watcher *watcher;
++ size_t left = ((char *)e + e->target_offset) - (char *)w;
+ int ret;
+
+- if (((char *)w) + w->watcher_size + sizeof(struct ebt_entry_watcher) >
+- ((char *)e) + e->target_offset)
++ if (left < sizeof(struct ebt_entry_watcher) ||
++ left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
+ return -EINVAL;
+ watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
+ if (!watcher)
+@@ -422,19 +424,23 @@ ebt_check_entry_size_and_hooks(struct ebt_entry *e,
+ struct ebt_entries **hook_entries, unsigned int *n, unsigned int *cnt,
+ unsigned int *totalcnt, unsigned int *udc_cnt, unsigned int valid_hooks)
+ {
++ unsigned int offset = (char *)e - newinfo->entries;
++ size_t left = (limit - base) - offset;
+ int i;
+
++ if (left < sizeof(unsigned int))
++ goto Esmall;
++
+ for (i = 0; i < NF_BR_NUMHOOKS; i++) {
+ if ((valid_hooks & (1 << i)) == 0)
+ continue;
+- if ( (char *)hook_entries[i] - base ==
+- (char *)e - newinfo->entries)
++ if ((char *)hook_entries[i] == base + offset)
+ break;
+ }
+ /* beginning of a new chain
+ if i == NF_BR_NUMHOOKS it must be a user defined chain */
+ if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
+- if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) != 0) {
++ if (e->bitmask != 0) {
+ /* we make userspace set this right,
+ so there is no misunderstanding */
+ BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
+@@ -449,11 +455,8 @@ ebt_check_entry_size_and_hooks(struct ebt_entry *e,
+ return -EINVAL;
+ }
+ /* before we look at the struct, be sure it is not too big */
+- if ((char *)hook_entries[i] + sizeof(struct ebt_entries)
+- > limit) {
+- BUGPRINT("entries_size too small\n");
+- return -EINVAL;
+- }
++ if (left < sizeof(struct ebt_entries))
++ goto Esmall;
+ if (((struct ebt_entries *)e)->policy != EBT_DROP &&
+ ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
+ /* only RETURN from udc */
+@@ -476,6 +479,8 @@ ebt_check_entry_size_and_hooks(struct ebt_entry *e,
+ return 0;
+ }
+ /* a plain old entry, heh */
++ if (left < sizeof(struct ebt_entry))
++ goto Esmall;
+ if (sizeof(struct ebt_entry) > e->watchers_offset ||
+ e->watchers_offset > e->target_offset ||
+ e->target_offset >= e->next_offset) {
+@@ -487,10 +492,16 @@ ebt_check_entry_size_and_hooks(struct ebt_entry *e,
+ BUGPRINT("target size too small\n");
+ return -EINVAL;
+ }
++ if (left < e->next_offset)
++ goto Esmall;
+
+ (*cnt)++;
+ (*totalcnt)++;
+ return 0;
++
++Esmall:
++ BUGPRINT("entries_size too small\n");
++ return -EINVAL;
+ }
+
+ struct ebt_cl_stack
+@@ -512,7 +523,7 @@ ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
+ int i;
+
+ /* we're only interested in chain starts */
+- if (e->bitmask & EBT_ENTRY_OR_ENTRIES)
++ if (e->bitmask)
+ return 0;
+ for (i = 0; i < NF_BR_NUMHOOKS; i++) {
+ if ((valid_hooks & (1 << i)) == 0)
+@@ -562,7 +573,7 @@ ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
+ {
+ struct ebt_entry_target *t;
+
+- if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
++ if (e->bitmask == 0)
+ return 0;
+ /* we're done */
+ if (cnt && (*cnt)-- == 0)
+@@ -585,10 +596,11 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
+ struct ebt_entry_target *t;
+ struct ebt_target *target;
+ unsigned int i, j, hook = 0, hookmask = 0;
++ size_t gap = e->next_offset - e->target_offset;
+ int ret;
+
+ /* don't mess with the struct ebt_entries */
+- if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
++ if (e->bitmask == 0)
+ return 0;
+
+ if (e->bitmask & ~EBT_F_MASK) {
+@@ -646,8 +658,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
+
+ t->u.target = target;
+ if (t->u.target == &ebt_standard_target) {
+- if (e->target_offset + sizeof(struct ebt_standard_target) >
+- e->next_offset) {
++ if (gap < sizeof(struct ebt_standard_target)) {
+ BUGPRINT("Standard target size too big\n");
+ ret = -EFAULT;
+ goto cleanup_watchers;
+@@ -658,8 +669,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
+ ret = -EFAULT;
+ goto cleanup_watchers;
+ }
+- } else if ((e->target_offset + t->target_size +
+- sizeof(struct ebt_entry_target) > e->next_offset) ||
++ } else if (t->target_size > gap - sizeof(struct ebt_entry_target) ||
+ (t->u.target->check &&
+ t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
+ module_put(t->u.target->me);
+@@ -729,7 +739,9 @@ static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s
+ BUGPRINT("loop\n");
+ return -1;
+ }
+- /* this can't be 0, so the above test is correct */
++ if (cl_s[i].hookmask & (1 << hooknr))
++ goto letscontinue;
++ /* this can't be 0, so the loop test is correct */
+ cl_s[i].cs.n = pos + 1;
+ pos = 0;
+ cl_s[i].cs.e = ((void *)e + e->next_offset);
+@@ -1311,7 +1323,7 @@ static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase)
+ char *hlp;
+ struct ebt_entry_target *t;
+
+- if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
++ if (e->bitmask == 0)
+ return 0;
+
+ hlp = ubase - base + (char *)e + e->target_offset;
+diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
+index a1e68f7..d5571ee 100644
+--- a/net/sched/act_gact.c
++++ b/net/sched/act_gact.c
+@@ -55,14 +55,14 @@ static DEFINE_RWLOCK(gact_lock);
+ #ifdef CONFIG_GACT_PROB
+ static int gact_net_rand(struct tcf_gact *p)
+ {
+- if (net_random()%p->pval)
++ if (!p->pval || net_random()%p->pval)
+ return p->action;
+ return p->paction;
+ }
+
+ static int gact_determ(struct tcf_gact *p)
+ {
+- if (p->bstats.packets%p->pval)
++ if (!p->pval || p->bstats.packets%p->pval)
+ return p->action;
+ return p->paction;
+ }
+diff --git a/net/sched/act_police.c b/net/sched/act_police.c
+index fa877f8..f304b1b 100644
+--- a/net/sched/act_police.c
++++ b/net/sched/act_police.c
+@@ -45,6 +45,18 @@ static struct tcf_police *tcf_police_ht[MY_TAB_SIZE];
+ /* Policer hash table lock */
+ static DEFINE_RWLOCK(police_lock);
+
++/* old policer structure from before tc actions */
++struct tc_police_compat
++{
++ u32 index;
++ int action;
++ u32 limit;
++ u32 burst;
++ u32 mtu;
++ struct tc_ratespec rate;
++ struct tc_ratespec peakrate;
++};
++
+ /* Each policer is serialized by its individual spinlock */
+
+ static __inline__ unsigned tcf_police_hash(u32 index)
+@@ -170,12 +182,15 @@ static int tcf_act_police_locate(struct rtattr *rta, struct rtattr *est,
+ struct tc_police *parm;
+ struct tcf_police *p;
+ struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL;
++ int size;
+
+ if (rta == NULL || rtattr_parse_nested(tb, TCA_POLICE_MAX, rta) < 0)
+ return -EINVAL;
+
+- if (tb[TCA_POLICE_TBF-1] == NULL ||
+- RTA_PAYLOAD(tb[TCA_POLICE_TBF-1]) != sizeof(*parm))
++ if (tb[TCA_POLICE_TBF-1] == NULL)
++ return -EINVAL;
++ size = RTA_PAYLOAD(tb[TCA_POLICE_TBF-1]);
++ if (size != sizeof(*parm) && size != sizeof(struct tc_police_compat))
+ return -EINVAL;
+ parm = RTA_DATA(tb[TCA_POLICE_TBF-1]);
+
+@@ -415,12 +430,15 @@ struct tcf_police * tcf_police_locate(struct rtattr *rta, struct rtattr *est)
+ struct tcf_police *p;
+ struct rtattr *tb[TCA_POLICE_MAX];
+ struct tc_police *parm;
++ int size;
+
+ if (rtattr_parse_nested(tb, TCA_POLICE_MAX, rta) < 0)
+ return NULL;
+
+- if (tb[TCA_POLICE_TBF-1] == NULL ||
+- RTA_PAYLOAD(tb[TCA_POLICE_TBF-1]) != sizeof(*parm))
++ if (tb[TCA_POLICE_TBF-1] == NULL)
++ return NULL;
++ size = RTA_PAYLOAD(tb[TCA_POLICE_TBF-1]);
++ if (size != sizeof(*parm) && size != sizeof(struct tc_police_compat))
+ return NULL;
+
+ parm = RTA_DATA(tb[TCA_POLICE_TBF-1]);
+diff --git a/sound/oss/swarm_cs4297a.c b/sound/oss/swarm_cs4297a.c
+index df4d377..a1de9dc 100644
+--- a/sound/oss/swarm_cs4297a.c
++++ b/sound/oss/swarm_cs4297a.c
+@@ -724,7 +724,7 @@ static int serdma_reg_access(struct cs4297a_state *s, u64 data)
+ serdma_t *d = &s->dma_dac;
+ u64 *data_p;
+ unsigned swptr;
+- int flags;
++ unsigned long flags;
+ serdma_descr_t *descr;
+
+ if (s->reg_request) {
Modified: dists/sid/linux-2.6/debian/patches/series/9
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/9 (original)
+++ dists/sid/linux-2.6/debian/patches/series/9 Thu Dec 28 22:49:53 2006
@@ -17,3 +17,4 @@
+ bugfix/mincore-error-value-cases.patch
+ bugfix/mincore-typo.patch
+ bugfix/2.6.16.34
++ bugfix/2.6.16.35
More information about the Kernel-svn-changes
mailing list