11 files changed, 54 insertions, 52 deletions

diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 002703b8c0b..729cdbdf803 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -330,6 +330,9 @@ config PCI_DOMAINS
 config PCI_SYSCALL
         def_bool PCI
 
+config IOMMU_HELPER
+        def_bool PCI
+
 config ALPHA_CORE_AGP
         bool
         depends on ALPHA_GENERIC || ALPHA_TITAN || ALPHA_MARVEL
diff --git a/arch/alpha/kernel/pci_iommu.c b/arch/alpha/kernel/pci_iommu.c
index e07a23fc5b7..4e1c08636ed 100644
--- a/arch/alpha/kernel/pci_iommu.c
+++ b/arch/alpha/kernel/pci_iommu.c
@@ -10,6 +10,7 @@
 #include <linux/scatterlist.h>
 #include <linux/log2.h>
 #include <linux/dma-mapping.h>
+#include <linux/iommu-helper.h>
 
 #include <asm/io.h>
 #include <asm/hwrpb.h>
@@ -125,14 +126,6 @@ iommu_arena_new(struct pci_controller *hose, dma_addr_t base,
         return iommu_arena_new_node(0, hose, base, window_size, align);
 }
 
-static inline int is_span_boundary(unsigned int index, unsigned int nr,
-                                   unsigned long shift,
-                                   unsigned long boundary_size)
-{
-        shift = (shift + index) & (boundary_size - 1);
-        return shift + nr > boundary_size;
-}
-
 /* Must be called with the arena lock held */
 static long
 iommu_arena_find_pages(struct device *dev, struct pci_iommu_arena *arena,
@@ -147,7 +140,6 @@ iommu_arena_find_pages(struct device *dev, struct pci_iommu_arena *arena,
         base = arena->dma_base >> PAGE_SHIFT;
         if (dev) {
                 boundary_size = dma_get_seg_boundary(dev) + 1;
-                BUG_ON(!is_power_of_2(boundary_size));
                 boundary_size >>= PAGE_SHIFT;
         } else {
                 boundary_size = 1UL << (32 - PAGE_SHIFT);
@@ -161,7 +153,7 @@ iommu_arena_find_pages(struct device *dev, struct pci_iommu_arena *arena,
 
 again:
         while (i < n && p+i < nent) {
-                if (!i && is_span_boundary(p, n, base, boundary_size)) {
+                if (!i && iommu_is_span_boundary(p, n, base, boundary_size)) {
                         p = ALIGN(p + 1, mask + 1);
                         goto again;
                 }
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 32c79a55511..7652e87d60c 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -217,7 +217,6 @@ static int use_virtual_dma;
  */
 
 static DEFINE_SPINLOCK(floppy_lock);
-static struct completion device_release;
 
 static unsigned short virtual_dma_port = 0x3f0;
 irqreturn_t floppy_interrupt(int irq, void *dev_id);
@@ -4144,7 +4143,6 @@ DEVICE_ATTR(cmos,S_IRUGO,floppy_cmos_show,NULL);
 
 static void floppy_device_release(struct device *dev)
 {
-        complete(&device_release);
 }
 
 static struct platform_device floppy_device[N_DRIVE];
@@ -4539,7 +4537,6 @@ void cleanup_module(void)
 {
         int drive;
 
-        init_completion(&device_release);
         blk_unregister_region(MKDEV(FLOPPY_MAJOR, 0), 256);
         unregister_blkdev(FLOPPY_MAJOR, "fd");
 
@@ -4564,8 +4561,6 @@ void cleanup_module(void)
 
         /* eject disk, if any */
         fd_eject(0);
-
-        wait_for_completion(&device_release);
 }
 
 module_param(floppy, charp, 0);
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 589ac6f65b9..3f9d0a9ac36 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -1709,7 +1709,7 @@ static int __init riscom8_init_module (void)
 
         if (iobase || iobase1 || iobase2 || iobase3) {
                 for(i = 0; i < RC_NBOARD; i++)
-                        rc_board[0].base = 0;
+                        rc_board[i].base = 0;
         }
 
         if (iobase)
diff --git a/drivers/spi/au1550_spi.c b/drivers/spi/au1550_spi.c
index c47a650183a..41a3d00c451 100644
--- a/drivers/spi/au1550_spi.c
+++ b/drivers/spi/au1550_spi.c
@@ -99,7 +99,7 @@ static dbdev_tab_t au1550_spi_mem_dbdev =
 static void au1550_spi_bits_handlers_set(struct au1550_spi *hw, int bpw);
 
 
-/**
+/*
  *  compute BRG and DIV bits to setup spi clock based on main input clock rate
  *  that was specified in platform data structure
  *  according to au1550 datasheet:
@@ -650,7 +650,7 @@ static int au1550_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
         return hw->txrx_bufs(spi, t);
 }
 
-static irqreturn_t au1550_spi_irq(int irq, void *dev, struct pt_regs *regs)
+static irqreturn_t au1550_spi_irq(int irq, void *dev)
 {
         struct au1550_spi *hw = dev;
         return hw->irq_callback(hw);
diff --git a/drivers/spi/spi_bitbang.c b/drivers/spi/spi_bitbang.c
index f7f8580edad..71e881419cd 100644
--- a/drivers/spi/spi_bitbang.c
+++ b/drivers/spi/spi_bitbang.c
@@ -344,12 +344,14 @@ static void bitbang_work(struct work_struct *work)
                                         t->rx_dma = t->tx_dma = 0;
                                 status = bitbang->txrx_bufs(spi, t);
                         }
+                        if (status > 0)
+                                m->actual_length += status;
                         if (status != t->len) {
-                                if (status > 0)
-                                        status = -EMSGSIZE;
+                                /* always report some kind of error */
+                                if (status >= 0)
+                                        status = -EREMOTEIO;
                                 break;
                         }
-                        m->actual_length += status;
                         status = 0;
 
                         /* protocol tweaks before next transfer */
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 6dc0334815f..4206454734e 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -640,17 +640,17 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
 
         ret = -EACCES;
         if (!ptrace_may_attach(task))
-                goto out;
+                goto out_task;
 
         ret = -EINVAL;
         /* file position must be aligned */
         if (*ppos % PM_ENTRY_BYTES)
-                goto out;
+                goto out_task;
 
         ret = 0;
         mm = get_task_mm(task);
         if (!mm)
-                goto out;
+                goto out_task;
 
         ret = -ENOMEM;
         uaddr = (unsigned long)buf & PAGE_MASK;
@@ -658,7 +658,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
         pagecount = (PAGE_ALIGN(uend) - uaddr) / PAGE_SIZE;
         pages = kmalloc(pagecount * sizeof(struct page *), GFP_KERNEL);
         if (!pages)
-                goto out_task;
+                goto out_mm;
 
         down_read(&current->mm->mmap_sem);
         ret = get_user_pages(current, current->mm, uaddr, pagecount,
@@ -668,6 +668,12 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
         if (ret < 0)
                 goto out_free;
 
+        if (ret != pagecount) {
+                pagecount = ret;
+                ret = -EFAULT;
+                goto out_pages;
+        }
+
         pm.out = buf;
         pm.end = buf + count;
 
@@ -699,15 +705,17 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                         ret = pm.out - buf;
         }
 
+out_pages:
         for (; pagecount; pagecount--) {
                 page = pages[pagecount-1];
                 if (!PageReserved(page))
                         SetPageDirty(page);
                 page_cache_release(page);
         }
-        mmput(mm);
 out_free:
         kfree(pages);
+out_mm:
+        mmput(mm);
 out_task:
         put_task_struct(task);
 out:
diff --git a/include/asm-h8300/uaccess.h b/include/asm-h8300/uaccess.h
index a22350ec271..356068cd087 100644
--- a/include/asm-h8300/uaccess.h
+++ b/include/asm-h8300/uaccess.h
@@ -91,22 +91,19 @@ extern int __put_user_bad(void);
 #define get_user(x, ptr)                                        \
 ({                                                              \
     int __gu_err = 0;                                           \
-    uint32_t __gu_val = 0;                              \
+    typeof(*(ptr)) __gu_val = *ptr;                             \
     switch (sizeof(*(ptr))) {                                   \
     case 1:                                                     \
     case 2:                                                     \
     case 4:                                                     \
-        __gu_val = *(ptr);                                      \
-        break;                                                  \
-    case 8:                                                     \
-        memcpy(&__gu_val, ptr, sizeof (*(ptr)));                \
+    case 8:                                                     \
         break;                                                  \
     default:                                                    \
-        __gu_val = 0;                                           \
         __gu_err = __get_user_bad();                            \
+        __gu_val = 0;                                           \
         break;                                                  \
     }                                                           \
-    (x) = (typeof(*(ptr)))__gu_val;                             \
+    (x) = __gu_val;                                             \
     __gu_err;                                                   \
 })
 #define __get_user(x, ptr) get_user(x, ptr)
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index 74c2f9db2aa..263d04ab2d9 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -247,6 +247,10 @@ my ($function, %function_table,%parametertypes,$declaration_purpose);
 my ($type,$declaration_name,$return_type);
 my ($newsection,$newcontents,$prototype,$filelist, $brcount, %source_map);
 
+if (defined($ENV{'KBUILD_VERBOSE'})) {
+        $verbose = "$ENV{'KBUILD_VERBOSE'}";
+}
+
 # Generated docbook code is inserted in a template at a point where
 # docbook v3.1 requires a non-zero sequence of RefEntry's; see:
 # http://www.oasis-open.org/docbook/documentation/reference/html/refentry.html
diff --git a/security/smack/smack.h b/security/smack/smack.h
index a21a0e907ab..62c1e982849 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -26,14 +26,6 @@
 #define SMK_MAXLEN      23
 #define SMK_LABELLEN    (SMK_MAXLEN+1)
 
-/*
- * How many kinds of access are there?
- * Here's your answer.
- */
-#define SMK_ACCESSDASH  '-'
-#define SMK_ACCESSLOW   "rwxa"
-#define SMK_ACCESSKINDS (sizeof(SMK_ACCESSLOW) - 1)
-
 struct superblock_smack {
         char            *smk_root;
         char            *smk_floor;
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 358c92c1a15..afe7c9b0732 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -81,10 +81,23 @@ static struct semaphore smack_write_sem;
 /*
  * Values for parsing cipso rules
  * SMK_DIGITLEN: Length of a digit field in a rule.
- * SMK_CIPSOMEN: Minimum possible cipso rule length.
+ * SMK_CIPSOMIN: Minimum possible cipso rule length.
+ * SMK_CIPSOMAX: Maximum possible cipso rule length.
  */
 #define SMK_DIGITLEN 4
-#define SMK_CIPSOMIN (SMK_MAXLEN + 2 * SMK_DIGITLEN)
+#define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
+#define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
+
+/*
+ * Values for parsing MAC rules
+ * SMK_ACCESS: Maximum possible combination of access permissions
+ * SMK_ACCESSLEN: Maximum length for a rule access field
+ * SMK_LOADLEN: Smack rule length
+ */
+#define SMK_ACCESS    "rwxa"
+#define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
+#define SMK_LOADLEN   (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
+
 
 /*
  * Seq_file read operations for /smack/load
@@ -229,14 +242,10 @@ static void smk_set_access(struct smack_rule *srp)
  * The format is exactly:
  *     char subject[SMK_LABELLEN]
  *     char object[SMK_LABELLEN]
- *     char access[SMK_ACCESSKINDS]
- *
- *     Anything following is commentary and ignored.
+ *     char access[SMK_ACCESSLEN]
  *
- * writes must be SMK_LABELLEN+SMK_LABELLEN+4 bytes.
+ * writes must be SMK_LABELLEN+SMK_LABELLEN+SMK_ACCESSLEN bytes.
  */
-#define MINIMUM_LOAD (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSKINDS)
-
 static ssize_t smk_write_load(struct file *file, const char __user *buf,
                               size_t count, loff_t *ppos)
 {
@@ -253,7 +262,7 @@ static ssize_t smk_write_load(struct file *file, const char __user *buf,
                 return -EPERM;
         if (*ppos != 0)
                 return -EINVAL;
-        if (count < MINIMUM_LOAD)
+        if (count != SMK_LOADLEN)
                 return -EINVAL;
 
         data = kzalloc(count, GFP_KERNEL);
@@ -513,7 +522,7 @@ static ssize_t smk_write_cipso(struct file *file, const char __user *buf,
                 return -EPERM;
         if (*ppos != 0)
                 return -EINVAL;
-        if (count <= SMK_CIPSOMIN)
+        if (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX)
                 return -EINVAL;
 
         data = kzalloc(count + 1, GFP_KERNEL);
@@ -547,7 +556,7 @@ static ssize_t smk_write_cipso(struct file *file, const char __user *buf,
         if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
                 goto out;
 
-        if (count <= (SMK_CIPSOMIN + catlen * SMK_DIGITLEN))
+        if (count != (SMK_CIPSOMIN + catlen * SMK_DIGITLEN))
                 goto out;
 
         memset(mapcatset, 0, sizeof(mapcatset));