diff -Nru a/MAINTAINERS b/MAINTAINERS
--- a/MAINTAINERS	2004-12-11 10:58:10 -08:00
+++ b/MAINTAINERS	2005-01-07 09:23:24 -08:00
@@ -841,7 +841,7 @@
 
 i386 SETUP CODE / CPU ERRATA WORKAROUNDS
 P:	Dave Jones
-M:	davej@suse.de
+M:	davej@redhat.com
 P:	H. Peter Anvin
 M:	hpa@zytor.com
 S:	Maintained
diff -Nru a/Makefile b/Makefile
--- a/Makefile	2005-01-06 06:17:34 -08:00
+++ b/Makefile	2005-01-11 02:50:09 -08:00
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 4
 SUBLEVEL = 29
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc1-bk1
 
 KERNELRELEASE=$(VERSION).$(PATCHLEVEL).$(SUBLEVEL)$(EXTRAVERSION)
 
diff -Nru a/arch/mips/kernel/irixelf.c b/arch/mips/kernel/irixelf.c
--- a/arch/mips/kernel/irixelf.c	2005-01-07 03:14:01 -08:00
+++ b/arch/mips/kernel/irixelf.c	2005-01-10 11:05:59 -08:00
@@ -130,7 +130,10 @@
 	end = PAGE_ALIGN(end);
 	if (end <= start)
 		return;
-	do_brk_locked(start, end - start);
+
+	down_write(&current->mm->mmap_sem);
+	do_brk(start, end - start);
+	up_write(&current->mm->mmap_sem);
 }
 
 
@@ -379,7 +382,9 @@
 
 	/* Map the last of the bss segment */
 	if (last_bss > len) {
-		do_brk_locked(len, (last_bss - len));
+		down_write(&current->mm->mmap_sem);
+		do_brk(len, (last_bss - len));
+		up_write(&current->mm->mmap_sem);
 	}
 	kfree(elf_phdata);
 
@@ -567,7 +572,9 @@
 	unsigned long v;
 	struct prda *pp;
 
-	v =  do_brk_locked (PRDA_ADDRESS, PAGE_SIZE);
+	down_write(&current->mm->mmap_sem);
+	v =  do_brk (PRDA_ADDRESS, PAGE_SIZE);
+	up_write(&current->mm->mmap_sem);
 
 	if (v < 0)
 		return;
@@ -858,8 +865,11 @@
 
 	len = (elf_phdata->p_filesz + elf_phdata->p_vaddr+ 0xfff) & 0xfffff000;
 	bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
-	if (bss > len)
-	  do_brk_locked(len, bss-len);
+	if (bss > len) {
+		down_write(&current->mm->mmap_sem);
+		do_brk(len, bss-len);
+		up_write(&current->mm->mmap_sem);
+	}
 	kfree(elf_phdata);
 	return 0;
 }
diff -Nru a/arch/sparc64/kernel/binfmt_aout32.c b/arch/sparc64/kernel/binfmt_aout32.c
--- a/arch/sparc64/kernel/binfmt_aout32.c	2005-01-07 03:14:01 -08:00
+++ b/arch/sparc64/kernel/binfmt_aout32.c	2005-01-10 11:10:07 -08:00
@@ -49,7 +49,9 @@
 	end = PAGE_ALIGN(end);
 	if (end <= start)
 		return;
-	do_brk_locked(start, end - start);
+	down_write(&current->mm->mmap_sem);
+	do_brk(start, end - start);
+	up_write(&current->mm->mmap_sem);
 }
 
 /*
@@ -246,10 +248,14 @@
 	if (N_MAGIC(ex) == NMAGIC) {
 		loff_t pos = fd_offset;
 		/* Fuck me plenty... */
-		error = do_brk_locked(N_TXTADDR(ex), ex.a_text);
+		down_write(&current->mm->mmap_sem);
+		error = do_brk(N_TXTADDR(ex), ex.a_text);
+		up_write(&current->mm->mmap_sem);
 		bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
 			  ex.a_text, &pos);
-		error = do_brk_locked(N_DATADDR(ex), ex.a_data);
+		down_write(&current->mm->mmap_sem);
+		error = do_brk(N_DATADDR(ex), ex.a_data);
+		up_write(&current->mm->mmap_sem);
 		bprm->file->f_op->read(bprm->file, (char *) N_DATADDR(ex),
 			  ex.a_data, &pos);
 		goto beyond_if;
@@ -257,8 +263,11 @@
 
 	if (N_MAGIC(ex) == OMAGIC) {
 		loff_t pos = fd_offset;
-		do_brk_locked(N_TXTADDR(ex) & PAGE_MASK,
+		down_write(&current->mm->mmap_sem);
+		do_brk(N_TXTADDR(ex) & PAGE_MASK,
 			ex.a_text+ex.a_data + PAGE_SIZE - 1);
+		up_write(&current->mm->mmap_sem);
+		
 		bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
 			  ex.a_text+ex.a_data, &pos);
 	} else {
@@ -272,7 +281,9 @@
 
 		if (!bprm->file->f_op->mmap) {
 			loff_t pos = fd_offset;
-			do_brk_locked(0, ex.a_text+ex.a_data);
+			down_write(&current->mm->mmap_sem);
+			do_brk(0, ex.a_text+ex.a_data);
+			up_write(&current->mm->mmap_sem);
 			bprm->file->f_op->read(bprm->file,(char *)N_TXTADDR(ex),
 				  ex.a_text+ex.a_data, &pos);
 			goto beyond_if;
@@ -388,7 +399,9 @@
 	len = PAGE_ALIGN(ex.a_text + ex.a_data);
 	bss = ex.a_text + ex.a_data + ex.a_bss;
 	if (bss > len) {
-		error = do_brk_locked(start_addr + len, bss - len);
+		down_write(&current->mm->mmap_sem);
+		error = do_brk(start_addr + len, bss - len);
+		up_write(&current->mm->mmap_sem);
 		retval = error;
 		if (error != start_addr + len)
 			goto out;
diff -Nru a/drivers/char/moxa.c b/drivers/char/moxa.c
--- a/drivers/char/moxa.c	2004-12-16 07:14:38 -08:00
+++ b/drivers/char/moxa.c	2005-01-10 10:11:04 -08:00
@@ -905,6 +905,8 @@
 	case TIOCSSERIAL:
 		return (moxa_set_serial_info(ch, (struct serial_struct *) arg));
 	default:
+		if(!capable(CAP_SYS_RAWIO))
+			return -EPERM;
 		retval = MoxaDriverIoctl(cmd, arg, port);
 	}
 	return (retval);
diff -Nru a/drivers/char/random.c b/drivers/char/random.c
--- a/drivers/char/random.c	2004-08-09 16:09:10 -07:00
+++ b/drivers/char/random.c	2005-01-10 10:07:55 -08:00
@@ -1771,7 +1771,7 @@
 static int proc_do_poolsize(ctl_table *table, int write, struct file *filp,
 			    void *buffer, size_t *lenp)
 {
-	int	ret;
+	unsigned int	ret;
 
 	sysctl_poolsize = random_state->poolinfo.POOLBYTES;
 
diff -Nru a/drivers/char/tty_io.c b/drivers/char/tty_io.c
--- a/drivers/char/tty_io.c	2004-12-16 05:57:23 -08:00
+++ b/drivers/char/tty_io.c	2004-12-26 04:15:53 -08:00
@@ -478,7 +478,6 @@
 	int	retval = 0;
 	struct	tty_ldisc o_ldisc;
 	char buf[64];
-	int work;
 	unsigned long flags;
 	struct tty_ldisc *ld;
 
diff -Nru a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
--- a/drivers/char/tty_ioctl.c	2004-12-16 05:57:23 -08:00
+++ b/drivers/char/tty_ioctl.c	2004-12-26 04:16:01 -08:00
@@ -387,7 +387,6 @@
 	struct tty_struct * real_tty;
 	int retval;
 	struct tty_ldisc *ld;
-	unsigned long flags;
 
 	if (tty->driver.type == TTY_DRIVER_TYPE_PTY &&
 	    tty->driver.subtype == PTY_TYPE_MASTER)
diff -Nru a/drivers/net/wan/sdla.c b/drivers/net/wan/sdla.c
--- a/drivers/net/wan/sdla.c	2002-07-03 21:16:30 -07:00
+++ b/drivers/net/wan/sdla.c	2005-01-10 10:56:45 -08:00
@@ -1300,6 +1300,8 @@
 
 		case SDLA_WRITEMEM:
 		case SDLA_READMEM:
+			if(!capable(CAP_SYS_RAWIO))
+				return -EPERM;
 			return(sdla_xfer(dev, (struct sdla_mem *)ifr->ifr_data, cmd == SDLA_READMEM));
 
 		case SDLA_START:
diff -Nru a/fs/binfmt_aout.c b/fs/binfmt_aout.c
--- a/fs/binfmt_aout.c	2005-01-07 03:15:05 -08:00
+++ b/fs/binfmt_aout.c	2005-01-10 11:03:46 -08:00
@@ -46,7 +46,10 @@
 	start = PAGE_ALIGN(start);
 	end = PAGE_ALIGN(end);
 	if (end > start) {
-		unsigned long addr = do_brk_locked(start, end - start);
+		unsigned long addr;
+		down_write(&current->mm->mmap_sem);
+		addr = do_brk(start, end - start);
+		up_write(&current->mm->mmap_sem);
 		if (BAD_ADDR(addr))
 			return addr;
 	}
@@ -317,10 +320,14 @@
 		loff_t pos = fd_offset;
 		/* Fuck me plenty... */
 		/* <AOL></AOL> */
-		error = do_brk_locked(N_TXTADDR(ex), ex.a_text);
+		down_write(&current->mm->mmap_sem);
+		error = do_brk(N_TXTADDR(ex), ex.a_text);
+		up_write(&current->mm->mmap_sem);
 		bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
 			  ex.a_text, &pos);
-		error = do_brk_locked(N_DATADDR(ex), ex.a_data);
+		down_write(&current->mm->mmap_sem);
+		error = do_brk(N_DATADDR(ex), ex.a_data);
+		up_write(&current->mm->mmap_sem);
 		bprm->file->f_op->read(bprm->file, (char *) N_DATADDR(ex),
 			  ex.a_data, &pos);
 		goto beyond_if;
@@ -340,8 +347,9 @@
 		pos = 32;
 		map_size = ex.a_text+ex.a_data;
 #endif
-
-		error = do_brk_locked(text_addr & PAGE_MASK, map_size);
+		down_write(&current->mm->mmap_sem);
+		error = do_brk(text_addr & PAGE_MASK, map_size);
+		up_write(&current->mm->mmap_sem);
 		if (error != (text_addr & PAGE_MASK)) {
 			send_sig(SIGKILL, current, 0);
 			return error;
@@ -375,7 +383,9 @@
 
 		if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) {
 			loff_t pos = fd_offset;
-			do_brk_locked(N_TXTADDR(ex), ex.a_text+ex.a_data);
+			down_write(&current->mm->mmap_sem);
+			do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
+			up_write(&current->mm->mmap_sem);
 			bprm->file->f_op->read(bprm->file,(char *)N_TXTADDR(ex),
 					ex.a_text+ex.a_data, &pos);
 			flush_icache_range((unsigned long) N_TXTADDR(ex),
@@ -475,8 +485,10 @@
 			       file->f_dentry->d_name.name);
 			error_time = jiffies;
 		}
-
-		do_brk_locked(start_addr, ex.a_text + ex.a_data + ex.a_bss);
+		
+		down_write(&current->mm->mmap_sem);
+		do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
+		up_write(&current->mm->mmap_sem);
 		
 		file->f_op->read(file, (char *)start_addr,
 			ex.a_text + ex.a_data, &pos);
@@ -500,7 +512,10 @@
 	len = PAGE_ALIGN(ex.a_text + ex.a_data);
 	bss = ex.a_text + ex.a_data + ex.a_bss;
 	if (bss > len) {
-		error = do_brk_locked(start_addr + len, bss - len);
+		down_write(&current->mm->mmap_sem);
+		error = do_brk(start_addr + len, bss - len);
+		up_write(&current->mm->mmap_sem);
+
 		retval = error;
 		if (error != start_addr + len)
 			goto out;
diff -Nru a/fs/binfmt_elf.c b/fs/binfmt_elf.c
--- a/fs/binfmt_elf.c	2005-01-07 03:16:31 -08:00
+++ b/fs/binfmt_elf.c	2005-01-10 10:57:42 -08:00
@@ -84,7 +84,10 @@
 	start = ELF_PAGEALIGN(start);
 	end = ELF_PAGEALIGN(end);
 	if (end > start) {
-		unsigned long addr = do_brk_locked(start, end - start);
+		unsigned long addr;
+		down_write(&current->mm->mmap_sem);
+		addr = do_brk(start, end - start);
+		up_write(&current->mm->mmap_sem);
 		if (BAD_ADDR(addr))
 			return addr;
 	}
@@ -379,7 +382,9 @@
 
 	/* Map the last of the bss segment */
 	if (last_bss > elf_bss) {
-		error = do_brk_locked(elf_bss, last_bss - elf_bss);
+		down_write(&current->mm->mmap_sem);
+		error = do_brk(elf_bss, last_bss - elf_bss);
+		up_write(&current->mm->mmap_sem);
 		if (BAD_ADDR(error))
 			goto out_close;
 	}
@@ -425,7 +430,10 @@
 		goto out;
 	}
 
-	do_brk_locked(0, text_data);
+	down_write(&current->mm->mmap_sem);
+	do_brk(0, text_data);
+	up_write(&current->mm->mmap_sem);
+
 	if (!interpreter->f_op || !interpreter->f_op->read)
 		goto out;
 	if (interpreter->f_op->read(interpreter, addr, text_data, &offset) < 0)
@@ -433,8 +441,11 @@
 	flush_icache_range((unsigned long)addr,
 	                   (unsigned long)addr + text_data);
 
-	do_brk_locked(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1),
+	down_write(&current->mm->mmap_sem);
+	do_brk(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1),
 		interp_ex->a_bss);
+	up_write(&current->mm->mmap_sem);
+
 	elf_entry = interp_ex->a_entry;
 
 out:
@@ -973,8 +984,11 @@
 
 	len = ELF_PAGESTART(elf_phdata->p_filesz + elf_phdata->p_vaddr + ELF_MIN_ALIGN - 1);
 	bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
-	if (bss > len)
-		do_brk_locked(len, bss - len);
+	if (bss > len) {
+		down_write(&current->mm->mmap_sem);
+		do_brk(len, bss - len);
+		up_write(&current->mm->mmap_sem);
+	}
 	error = 0;
 
 out_free_ph:
diff -Nru a/fs/coda/upcall.c b/fs/coda/upcall.c
--- a/fs/coda/upcall.c	2002-04-02 07:16:47 -08:00
+++ b/fs/coda/upcall.c	2005-01-06 12:36:25 -08:00
@@ -543,6 +543,11 @@
 		goto exit;
         }
 
+        if (data->vi.out_size > VC_MAXDATASIZE) {
+		error = -EINVAL;
+		goto exit;
+	}
+
         inp->coda_ioctl.VFid = *fid;
     
         /* the cmd field was mutated by increasing its size field to
@@ -571,26 +576,30 @@
 		       error, coda_f2s(fid));
 		goto exit; 
 	}
-        
-	/* Copy out the OUT buffer. */
+
+	if (outsize < (long)outp->coda_ioctl.data + outp->coda_ioctl.len) {
+                CDEBUG(D_FILE, "reply size %d < reply len %ld\n", outsize,
+		       (long)outp->coda_ioctl.data + outp->coda_ioctl.len);
+		error = -EINVAL;
+		goto exit;
+	}
+
         if (outp->coda_ioctl.len > data->vi.out_size) {
-                CDEBUG(D_FILE, "return len %d <= request len %d\n",
-                      outp->coda_ioctl.len, 
-                      data->vi.out_size);
+                CDEBUG(D_FILE, "return len %d > request len %d\n",
+		       outp->coda_ioctl.len, data->vi.out_size);
 		error = -EINVAL;
-        } else {
-		error = verify_area(VERIFY_WRITE, data->vi.out, 
-                                    data->vi.out_size);
-		if ( error ) goto exit;
-
-		if (copy_to_user(data->vi.out, 
-				 (char *)outp + (long)outp->coda_ioctl.data, 
-				 data->vi.out_size)) {
-			error = -EINVAL;
-			goto exit;
-		}
+		goto exit;
         }
 
+	/* Copy out the OUT buffer. */
+	error = verify_area(VERIFY_WRITE, data->vi.out, outp->coda_ioctl.len);
+	if ( error ) goto exit;
+
+	if (copy_to_user(data->vi.out, 
+			 (char *)outp + (long)outp->coda_ioctl.data, 
+			 outp->coda_ioctl.len)) {
+	    error = -EINVAL;
+	}
  exit:
 	CODA_FREE(inp, insize);
 	return error;
diff -Nru a/fs/xfs/linux-2.4/xfs_ioctl.c b/fs/xfs/linux-2.4/xfs_ioctl.c
--- a/fs/xfs/linux-2.4/xfs_ioctl.c	2004-11-28 19:47:11 -08:00
+++ b/fs/xfs/linux-2.4/xfs_ioctl.c	2005-01-10 11:01:35 -08:00
@@ -506,6 +506,11 @@
 	if (error)
 		return -error;
 
+	if(am_hreq.opcount > 1024) {
+		VN_RELE(vp);
+		return -XFS_ERROR(ENOMEM);
+	}
+
 	size = am_hreq.opcount * sizeof(attr_multiop_t);
 	ops = (xfs_attr_multiop_t *)kmalloc(size, GFP_KERNEL);
 	if (!ops) {
diff -Nru a/include/linux/coda.h b/include/linux/coda.h
--- a/include/linux/coda.h	2002-02-04 23:39:39 -08:00
+++ b/include/linux/coda.h	2005-01-06 06:12:40 -08:00
@@ -767,8 +767,8 @@
 #define PIOCPARM_MASK 0x0000ffff
 struct ViceIoctl {
         caddr_t in, out;        /* Data to be transferred in, or out */
-        short in_size;          /* Size of input buffer <= 2K */
-        short out_size;         /* Maximum size of output buffer, <= 2K */
+        u_short in_size;        /* Size of input buffer <= 2K */
+        u_short out_size;       /* Maximum size of output buffer, <= 2K */
 };
 
 struct PioctlData {
diff -Nru a/include/linux/mm.h b/include/linux/mm.h
--- a/include/linux/mm.h	2005-01-07 03:14:01 -08:00
+++ b/include/linux/mm.h	2005-01-10 10:41:47 -08:00
@@ -660,6 +660,14 @@
 		spin_unlock(&vma->vm_mm->page_table_lock);
 		return -ENOMEM;
 	}
+
+	if ((vma->vm_flags & VM_LOCKED) &&
+      	    ((vma->vm_mm->locked_vm + grow) << PAGE_SHIFT) > current->rlim[RLIMIT_MEMLOCK].rlim_cur) {
+		spin_unlock(&vma->vm_mm->page_table_lock);
+		return -ENOMEM;
+	}
+
+
 	vma->vm_start = address;
 	vma->vm_pgoff -= grow;
 	vma->vm_mm->total_vm += grow;
diff -Nru a/include/linux/spinlock.h b/include/linux/spinlock.h
--- a/include/linux/spinlock.h	2003-11-28 04:38:30 -08:00
+++ b/include/linux/spinlock.h	2005-01-07 12:51:28 -08:00
@@ -147,7 +147,7 @@
 
 #define rwlock_init(lock)	do { } while(0)
 #define read_lock(lock)		(void)(lock) /* Not "unused variable". */
-#define read_unlock(lock)	do { } while(0)
+#define read_unlock(lock)	(void)(lock) /* Not "unused variable". */
 #define write_lock(lock)	(void)(lock) /* Not "unused variable". */
 #define write_unlock(lock)	do { } while(0)
 
diff -Nru a/kernel/ksyms.c b/kernel/ksyms.c
--- a/kernel/ksyms.c	2005-01-07 03:14:01 -08:00
+++ b/kernel/ksyms.c	2005-01-10 10:57:58 -08:00
@@ -88,7 +88,6 @@
 EXPORT_SYMBOL(do_mmap_pgoff);
 EXPORT_SYMBOL(do_munmap);
 EXPORT_SYMBOL(do_brk);
-EXPORT_SYMBOL(do_brk_locked);
 EXPORT_SYMBOL(exit_mm);
 EXPORT_SYMBOL(exit_files);
 EXPORT_SYMBOL(exit_fs);
diff -Nru a/mm/memory.c b/mm/memory.c
--- a/mm/memory.c	2004-11-25 11:46:05 -08:00
+++ b/mm/memory.c	2005-01-10 10:45:46 -08:00
@@ -532,7 +532,7 @@
 	printk(KERN_ERR "get_user_pages PG_reserved page on"
 			"vma:%p flags:%lx page:%d\n", savevma,
 			savevma->vm_flags, s);
-	BUG();
+	WARN_ON(1);
 	i = -EFAULT; 
 	goto out;
 }
diff -Nru a/mm/mmap.c b/mm/mmap.c
--- a/mm/mmap.c	2005-01-07 03:14:01 -08:00
+++ b/mm/mmap.c	2005-01-10 10:44:09 -08:00
@@ -1061,6 +1061,12 @@
 	}
 
 	/*
+	 * mm->mmap_sem is required to protect against another thread
+	 * changing the mappings while we sleep (on kmalloc for one).
+	 */
+	WARN_ON(down_read_trylock(&mm->mmap_sem));
+
+	/*
 	 * Clear old maps.  this also does some error checking for us
 	 */
  munmap_back:
diff -Nru a/net/rose/rose_route.c b/net/rose/rose_route.c
--- a/net/rose/rose_route.c	2003-10-27 05:35:38 -08:00
+++ b/net/rose/rose_route.c	2005-01-10 10:53:19 -08:00
@@ -655,6 +655,9 @@
 			if (rose_route.mask > 10) /* Mask can't be more than 10 digits */
 				return -EINVAL;
 
+			if(rose_route.ndigis > 8) /* No more than 8 digipeats */
+				return -EINVAL;
+
 			err = rose_add_node(&rose_route, dev);
 			dev_put(dev);
 			return err;
