9 files changed, 92 insertions, 35 deletions

diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
index 25e1965df7c..d4191fe1ced 100644
--- a/arch/um/drivers/chan_kern.c
+++ b/arch/um/drivers/chan_kern.c
@@ -543,11 +543,10 @@ int parse_chan_pair(char *str, struct line *line, int device,
                     const struct chan_opts *opts, char **error_out)
 {
         struct list_head *chans = &line->chan_list;
-        struct chan *new, *chan;
+        struct chan *new;
         char *in, *out;
 
         if (!list_empty(chans)) {
-                chan = list_entry(chans->next, struct chan, list);
                 free_chan(chans, 0);
                 INIT_LIST_HEAD(chans);
         }
diff --git a/arch/um/drivers/cow_user.c b/arch/um/drivers/cow_user.c
index 93f227a25ba..9cbb426c0b9 100644
--- a/arch/um/drivers/cow_user.c
+++ b/arch/um/drivers/cow_user.c
@@ -186,7 +186,11 @@ static int absolutize(char *to, int size, char *from)
                 strcat(to, "/");
                 strcat(to, from);
         }
-        chdir(save_cwd);
+        if (chdir(save_cwd)) {
+                cow_printf("absolutize : Can't cd to '%s' - "
+                           "errno = %d\n", save_cwd, errno);
+                return -1;
+        }
         return 0;
 }
 
diff --git a/arch/um/drivers/harddog_user.c b/arch/um/drivers/harddog_user.c
index b56f8e0196a..84dce3fc590 100644
--- a/arch/um/drivers/harddog_user.c
+++ b/arch/um/drivers/harddog_user.c
@@ -32,7 +32,7 @@ int start_watchdog(int *in_fd_ret, int *out_fd_ret, char *sock)
 {
         struct dog_data data;
         int in_fds[2], out_fds[2], pid, n, err;
-        char pid_buf[sizeof("nnnnn\0")], c;
+        char pid_buf[sizeof("nnnnnnn\0")], c;
         char *pid_args[] = { "/usr/bin/uml_watchdog", "-pid", pid_buf, NULL };
         char *mconsole_args[] = { "/usr/bin/uml_watchdog", "-mconsole", NULL,
                                   NULL };
diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index 35dd0b86401..364c8a15c4c 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -176,10 +176,9 @@ void line_flush_buffer(struct tty_struct *tty)
 {
         struct line *line = tty->driver_data;
         unsigned long flags;
-        int err;
 
         spin_lock_irqsave(&line->lock, flags);
-        err = flush_buffer(line);
+        flush_buffer(line);
         spin_unlock_irqrestore(&line->lock, flags);
 }
 
@@ -400,8 +399,8 @@ int line_setup_irq(int fd, int input, int output, struct line *line, void *data)
  * is done under a spinlock.  Checking whether the device is in use is
  * line->tty->count > 1, also under the spinlock.
  *
- * tty->count serves to decide whether the device should be enabled or
- * disabled on the host.  If it's equal to 1, then we are doing the
+ * line->count serves to decide whether the device should be enabled or
+ * disabled on the host.  If it's equal to 0, then we are doing the
  * first open or last close.  Otherwise, open and close just return.
  */
 
@@ -415,16 +414,16 @@ int line_open(struct line *lines, struct tty_struct *tty)
                 goto out_unlock;
 
         err = 0;
-        if (tty->count > 1)
+        if (line->count++)
                 goto out_unlock;
 
-        spin_unlock(&line->count_lock);
-
+        BUG_ON(tty->driver_data);
         tty->driver_data = line;
         line->tty = tty;
 
+        spin_unlock(&line->count_lock);
         err = enable_chan(line);
-        if (err)
+        if (err) /* line_close() will be called by our caller */
                 return err;
 
         INIT_DELAYED_WORK(&line->task, line_timer_cb);
@@ -437,7 +436,7 @@ int line_open(struct line *lines, struct tty_struct *tty)
         chan_window_size(&line->chan_list, &tty->winsize.ws_row,
                          &tty->winsize.ws_col);
 
-        return err;
+        return 0;
 
 out_unlock:
         spin_unlock(&line->count_lock);
@@ -461,17 +460,16 @@ void line_close(struct tty_struct *tty, struct file * filp)
         flush_buffer(line);
 
         spin_lock(&line->count_lock);
-        if (!line->valid)
-                goto out_unlock;
+        BUG_ON(!line->valid);
 
-        if (tty->count > 1)
+        if (--line->count)
                 goto out_unlock;
 
-        spin_unlock(&line->count_lock);
-
         line->tty = NULL;
         tty->driver_data = NULL;
 
+        spin_unlock(&line->count_lock);
+
         if (line->sigio) {
                 unregister_winch(tty);
                 line->sigio = 0;
@@ -499,7 +497,7 @@ static int setup_one_line(struct line *lines, int n, char *init, int init_prio,
 
         spin_lock(&line->count_lock);
 
-        if (line->tty != NULL) {
+        if (line->count) {
                 *error_out = "Device is already open";
                 goto out;
         }
@@ -723,41 +721,53 @@ struct winch {
         int pid;
         struct tty_struct *tty;
         unsigned long stack;
+        struct work_struct work;
 };
 
-static void free_winch(struct winch *winch, int free_irq_ok)
+static void __free_winch(struct work_struct *work)
 {
-        if (free_irq_ok)
-                free_irq(WINCH_IRQ, winch);
-
-        list_del(&winch->list);
+        struct winch *winch = container_of(work, struct winch, work);
+        free_irq(WINCH_IRQ, winch);
 
         if (winch->pid != -1)
                 os_kill_process(winch->pid, 1);
-        if (winch->fd != -1)
-                os_close_file(winch->fd);
         if (winch->stack != 0)
                 free_stack(winch->stack, 0);
         kfree(winch);
 }
 
+static void free_winch(struct winch *winch)
+{
+        int fd = winch->fd;
+        winch->fd = -1;
+        if (fd != -1)
+                os_close_file(fd);
+        list_del(&winch->list);
+        __free_winch(&winch->work);
+}
+
 static irqreturn_t winch_interrupt(int irq, void *data)
 {
         struct winch *winch = data;
         struct tty_struct *tty;
         struct line *line;
+        int fd = winch->fd;
         int err;
         char c;
 
-        if (winch->fd != -1) {
-                err = generic_read(winch->fd, &c, NULL);
+        if (fd != -1) {
+                err = generic_read(fd, &c, NULL);
                 if (err < 0) {
                         if (err != -EAGAIN) {
+                                winch->fd = -1;
+                                list_del(&winch->list);
+                                os_close_file(fd);
                                 printk(KERN_ERR "winch_interrupt : "
                                        "read failed, errno = %d\n", -err);
                                 printk(KERN_ERR "fd %d is losing SIGWINCH "
                                        "support\n", winch->tty_fd);
-                                free_winch(winch, 0);
+                                INIT_WORK(&winch->work, __free_winch);
+                                schedule_work(&winch->work);
                                 return IRQ_HANDLED;
                         }
                         goto out;
@@ -829,7 +839,7 @@ static void unregister_winch(struct tty_struct *tty)
         list_for_each_safe(ele, next, &winch_handlers) {
                 winch = list_entry(ele, struct winch, list);
                 if (winch->tty == tty) {
-                        free_winch(winch, 1);
+                        free_winch(winch);
                         break;
                 }
         }
@@ -845,7 +855,7 @@ static void winch_cleanup(void)
 
         list_for_each_safe(ele, next, &winch_handlers) {
                 winch = list_entry(ele, struct winch, list);
-                free_winch(winch, 1);
+                free_winch(winch);
         }
 
         spin_unlock(&winch_handler_lock);
diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c
index 47d0c37897d..22745b47c82 100644
--- a/arch/um/drivers/net_kern.c
+++ b/arch/um/drivers/net_kern.c
@@ -262,6 +262,15 @@ static int uml_net_change_mtu(struct net_device *dev, int new_mtu)
         return 0;
 }
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void uml_net_poll_controller(struct net_device *dev)
+{
+        disable_irq(dev->irq);
+        uml_net_interrupt(dev->irq, dev);
+        enable_irq(dev->irq);
+}
+#endif
+
 static void uml_net_get_drvinfo(struct net_device *dev,
                                 struct ethtool_drvinfo *info)
 {
@@ -364,6 +373,9 @@ static const struct net_device_ops uml_netdev_ops = {
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = uml_net_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller = uml_net_poll_controller,
+#endif
 };
 
 /*
diff --git a/arch/um/drivers/net_user.c b/arch/um/drivers/net_user.c
index 9415dd9e63e..520118888f1 100644
--- a/arch/um/drivers/net_user.c
+++ b/arch/um/drivers/net_user.c
@@ -228,7 +228,10 @@ static void change(char *dev, char *what, unsigned char *addr,
                        "buffer\n");
 
         pid = change_tramp(argv, output, output_len);
-        if (pid < 0) return;
+        if (pid < 0) {
+                kfree(output);
+                return;
+        }
 
         if (output != NULL) {
                 printk("%s", output);
diff --git a/arch/um/drivers/slip_user.c b/arch/um/drivers/slip_user.c
index a1c2d2c98a9..cbacfc4e63e 100644
--- a/arch/um/drivers/slip_user.c
+++ b/arch/um/drivers/slip_user.c
@@ -102,7 +102,7 @@ static int slip_tramp(char **argv, int fd)
                        "buffer\n");
                 os_kill_process(pid, 1);
                 err = -ENOMEM;
-                goto out_free;
+                goto out_close;
         }
 
         close(fds[1]);
@@ -112,7 +112,6 @@ static int slip_tramp(char **argv, int fd)
         err = helper_wait(pid);
         close(fds[0]);
 
-out_free:
         kfree(output);
         return err;
 
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 620f5b70957..0491e40d696 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -513,8 +513,37 @@ __uml_exitcall(kill_io_thread);
 static inline int ubd_file_size(struct ubd *ubd_dev, __u64 *size_out)
 {
         char *file;
+        int fd;
+        int err;
+
+        __u32 version;
+        __u32 align;
+        char *backing_file;
+        time_t mtime;
+        unsigned long long size;
+        int sector_size;
+        int bitmap_offset;
+
+        if (ubd_dev->file && ubd_dev->cow.file) {
+                file = ubd_dev->cow.file;
+
+                goto out;
+        }
 
-        file = ubd_dev->cow.file ? ubd_dev->cow.file : ubd_dev->file;
+        fd = os_open_file(ubd_dev->file, global_openflags, 0);
+        if (fd < 0)
+                return fd;
+
+        err = read_cow_header(file_reader, &fd, &version, &backing_file, \
+                &mtime, &size, &sector_size, &align, &bitmap_offset);
+        os_close_file(fd);
+
+        if(err == -EINVAL)
+                file = ubd_dev->file;
+        else
+                file = backing_file;
+
+out:
         return os_file_size(file, size_out);
 }
 
diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
index 8ac7146c237..2e1de572860 100644
--- a/arch/um/drivers/xterm.c
+++ b/arch/um/drivers/xterm.c
@@ -123,6 +123,7 @@ static int xterm_open(int input, int output, int primary, void *d,
                 err = -errno;
                 printk(UM_KERN_ERR "xterm_open : unlink failed, errno = %d\n",
                        errno);
+                close(fd);
                 return err;
         }
         close(fd);