11 files changed, 63 insertions, 23 deletions
diff --git a/include/asm-i386/termbits.h b/include/asm-i386/termbits.h
index 12baf1d6343f..2e6237693814 100644
--- a/include/asm-i386/termbits.h
+++ b/include/asm-i386/termbits.h
@@ -144,7 +144,7 @@ struct ktermios {
 #define  B3000000 0010015
 #define  B3500000 0010016
 #define  B4000000 0010017
-#define CIBAUD    002003600000  /* input baud rate (not used) */
+#define CIBAUD    002003600000
 #define CMSPAR    010000000000          /* mark or space (stick) parity */
 #define CRTSCTS   020000000000          /* flow control */
diff --git a/include/asm-sh/hp6xx.h b/include/asm-sh/hp6xx.h
index f35134c159dd..53ca5643d9c7 100644
--- a/include/asm-sh/hp6xx.h
+++ b/include/asm-sh/hp6xx.h
@@ -10,9 +10,9 @@
 *
 */
-#define HP680_BTN_IRQ           IRQ0_IRQ
+#define HP680_BTN_IRQ           32            /* IRQ0_IRQ */
-#define HP680_TS_IRQ            IRQ3_IRQ
+#define HP680_TS_IRQ            35            /* IRQ3_IRQ */
-#define HP680_HD64461_IRQ       IRQ4_IRQ
+#define HP680_HD64461_IRQ       36            /* IRQ4_IRQ */
 #define DAC_LCD_BRIGHTNESS      0
 #define DAC_SPEAKER_VOLUME      1
diff --git a/include/asm-sh/system.h b/include/asm-sh/system.h
index b1e42e7f998b..4a6a19f4f8a4 100644
--- a/include/asm-sh/system.h
+++ b/include/asm-sh/system.h
@@ -7,6 +7,7 @@
 */
 #include <linux/irqflags.h>
+#include <linux/compiler.h>
 #include <asm/types.h>
 /*
diff --git a/include/asm-um/common.lds.S b/include/asm-um/common.lds.S
index f0454516dd31..b16222b42821 100644
--- a/include/asm-um/common.lds.S
+++ b/include/asm-um/common.lds.S
@@ -15,6 +15,7 @@
  PROVIDE (_unprotected_end = .);
  . = ALIGN(4096);
+  .note : { *(note.*) }
  __start___ex_table = .;
  __ex_table : { *(__ex_table) }
  __stop___ex_table = .;
diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
index 84cfa8bbdc36..d2a96cbf4f0e 100644
--- a/include/linux/eventpoll.h
+++ b/include/linux/eventpoll.h
@@ -31,12 +31,19 @@
 /* 
 * On x86-64 make the 64bit structure have the same alignment as the
 * 32bit structure. This makes 32bit emulation easier.
+ *
+ * UML/x86_64 needs the same packing as x86_64 - UML + UML_X86 +
+ * 64_BIT adds up to UML/x86_64.
 */
 #ifdef __x86_64__
 #define EPOLL_PACKED __attribute__((packed))
 #else
+#if defined(CONFIG_UML) && defined(CONFIG_UML_X86) && defined(CONFIG_64BIT)
+#define EPOLL_PACKED __attribute__((packed))
+#else
 #define EPOLL_PACKED
 #endif
+#endif
 struct epoll_event {
        __u32 events;
diff --git a/include/linux/ipc.h b/include/linux/ipc.h
index 636094c29b16..6da6772c19ff 100644
--- a/include/linux/ipc.h
+++ b/include/linux/ipc.h
@@ -92,19 +92,16 @@ extern struct ipc_namespace init_ipc_ns;
 #ifdef CONFIG_SYSVIPC
 #define INIT_IPC_NS(ns)         .ns             = &init_ipc_ns,
+extern int copy_ipcs(unsigned long flags, struct task_struct *tsk);
 #else
 #define INIT_IPC_NS(ns)
+static inline int copy_ipcs(unsigned long flags, struct task_struct *tsk)
+{ return 0; }
 #endif
 #ifdef CONFIG_IPC_NS
 extern void free_ipc_ns(struct kref *kref);
-extern int copy_ipcs(unsigned long flags, struct task_struct *tsk);
 extern int unshare_ipcs(unsigned long flags, struct ipc_namespace **ns);
-#else
-static inline int copy_ipcs(unsigned long flags, struct task_struct *tsk)
-{
-        return 0;
-}
 #endif
 static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns)
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 2e19478e9e84..8bcbc54e1b48 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -99,4 +99,8 @@ extern ssize_t splice_from_pipe(struct pipe_inode_info *, struct file *,
                                loff_t *, size_t, unsigned int,
                                splice_actor *);
+extern ssize_t __splice_from_pipe(struct pipe_inode_info *, struct file *,
+                                  loff_t *, size_t, unsigned int,
+                                  splice_actor *);
 #endif
diff --git a/include/linux/utsname.h b/include/linux/utsname.h
index a4555fe3754c..e10267d402c5 100644
--- a/include/linux/utsname.h
+++ b/include/linux/utsname.h
@@ -70,6 +70,8 @@ static inline int unshare_utsname(unsigned long unshare_flags,
 static inline int copy_utsname(int flags, struct task_struct *tsk)
 {
+        if (flags & CLONE_NEWUTS)
+                return -EINVAL;
        return 0;
 }
 static inline void put_uts_ns(struct uts_namespace *ns)
diff --git a/include/linux/wireless.h b/include/linux/wireless.h
index 447c52beb691..48759b2f57d7 100644
--- a/include/linux/wireless.h
+++ b/include/linux/wireless.h
@@ -1,10 +1,10 @@
 /*
 * This file define a set of standard wireless extensions
 *
- * Version :    21      14.3.06
+ * Version :    22      16.3.07
 *
 * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
- * Copyright (c) 1997-2006 Jean Tourrilhes, All Rights Reserved.
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
 */
 #ifndef _LINUX_WIRELESS_H
@@ -85,7 +85,7 @@
 * (there is some stuff that will be added in the future...)
 * I just plan to increment with each new version.
 */
-#define WIRELESS_EXT    21
+#define WIRELESS_EXT    22
 /*
 * Changes :
@@ -221,6 +221,10 @@
 *      - Add IW_RETRY_SHORT/IW_RETRY_LONG retry modifiers
 *      - Power/Retry relative values no longer * 100000
 *      - Add explicit flag to tell stats are in 802.11k RCPI : IW_QUAL_RCPI
+ *
+ * V21 to V22
+ * ----------
+ *      - Prevent leaking of kernel space in stream on 64 bits.
 */
 /**************************** CONSTANTS ****************************/
@@ -1085,4 +1089,15 @@ struct iw_event
 #define IW_EV_POINT_LEN (IW_EV_LCP_LEN + sizeof(struct iw_point) - \
                         IW_EV_POINT_OFF)
+/* Size of the Event prefix when packed in stream */
+#define IW_EV_LCP_PK_LEN        (4)
+/* Size of the various events when packed in stream */
+#define IW_EV_CHAR_PK_LEN       (IW_EV_LCP_PK_LEN + IFNAMSIZ)
+#define IW_EV_UINT_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(__u32))
+#define IW_EV_FREQ_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(struct iw_freq))
+#define IW_EV_PARAM_PK_LEN      (IW_EV_LCP_PK_LEN + sizeof(struct iw_param))
+#define IW_EV_ADDR_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(struct sockaddr))
+#define IW_EV_QUAL_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(struct iw_quality))
+#define IW_EV_POINT_PK_LEN      (IW_EV_LCP_LEN + 4)
 #endif  /* _LINUX_WIRELESS_H */
diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
index 83fe2e3d1e25..50e33b0e9349 100644
--- a/include/media/saa7146_vv.h
+++ b/include/media/saa7146_vv.h
@@ -239,7 +239,8 @@ void saa7146_res_free(struct saa7146_fh *fh, unsigned int bits);
 #define SAA7146_HPS_SYNC_PORT_B         0x01
 /* some memory sizes */
-#define SAA7146_CLIPPING_MEM    (14*PAGE_SIZE)
+/* max. 16 clipping rectangles */
+#define SAA7146_CLIPPING_MEM    (16 * 4 * sizeof(u32))
 /* some defines for the various clipping-modes */
 #define SAA7146_CLIPPING_RECT           0x4
diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
index 10559e937d27..8a830188354d 100644
--- a/include/net/iw_handler.h
+++ b/include/net/iw_handler.h
@@ -1,10 +1,10 @@
 /*
 * This file define the new driver API for Wireless Extensions
 *
- * Version :    7       18.3.05
+ * Version :    8       16.3.07
 *
 * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
- * Copyright (c) 2001-2006 Jean Tourrilhes, All Rights Reserved.
+ * Copyright (c) 2001-2007 Jean Tourrilhes, All Rights Reserved.
 */
 #ifndef _IW_HANDLER_H
@@ -207,7 +207,7 @@
 * will be needed...
 * I just plan to increment with each new version.
 */
-#define IW_HANDLER_VERSION      7
+#define IW_HANDLER_VERSION      8
 /*
 * Changes :
@@ -239,6 +239,10 @@
 *      - Remove (struct iw_point *)->pointer from events and streams
 *      - Remove spy_offset from struct iw_handler_def
 *      - Add "check" version of event macros for ieee802.11 stack
+ *
+ * V7 to V8
+ * ----------
+ *      - Prevent leaking of kernel space in stream on 64 bits.
 */
 /**************************** CONSTANTS ****************************/
@@ -500,7 +504,11 @@ iwe_stream_add_event(char *	stream,		/* Stream of events */
        /* Check if it's possible */
        if(likely((stream + event_len) < ends)) {
                iwe->len = event_len;
-                memcpy(stream, (char *) iwe, event_len);
+                /* Beware of alignement issues on 64 bits */
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
+                memcpy(stream + IW_EV_LCP_LEN,
+                       ((char *) iwe) + IW_EV_LCP_LEN,
+                       event_len - IW_EV_LCP_LEN);
                stream += event_len;
        }
        return stream;
@@ -521,10 +529,10 @@ iwe_stream_add_point(char *	stream,		/* Stream of events */
        /* Check if it's possible */
        if(likely((stream + event_len) < ends)) {
                iwe->len = event_len;
-                memcpy(stream, (char *) iwe, IW_EV_LCP_LEN);
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
                memcpy(stream + IW_EV_LCP_LEN,
                       ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
                memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length);
                stream += event_len;
        }
@@ -574,7 +582,11 @@ iwe_stream_check_add_event(char *	stream,		/* Stream of events */
        /* Check if it's possible, set error if not */
        if(likely((stream + event_len) < ends)) {
                iwe->len = event_len;
-                memcpy(stream, (char *) iwe, event_len);
+                /* Beware of alignement issues on 64 bits */
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
+                memcpy(stream + IW_EV_LCP_LEN,
+                       ((char *) iwe) + IW_EV_LCP_LEN,
+                       event_len - IW_EV_LCP_LEN);
                stream += event_len;
        } else
                *perr = -E2BIG;
@@ -598,10 +610,10 @@ iwe_stream_check_add_point(char *	stream,		/* Stream of events */
        /* Check if it's possible */
        if(likely((stream + event_len) < ends)) {
                iwe->len = event_len;
-                memcpy(stream, (char *) iwe, IW_EV_LCP_LEN);
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
                memcpy(stream + IW_EV_LCP_LEN,
                       ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
                memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length);
                stream += event_len;
        } else