Import 2.3.22

Documentation/SMP.txt

-SMP on x86/Linux is now an official feature and is not experimental.
-Experimental SMP support for other architectures is underway.
-
-Please view linux/Documentation/smp.txt for more information about enabling SMP.
-
-SMP support for Linux with up to 16 processors using the Intel MP
-specification. 
-
-To fix:
-
-o	Clean up processor specific/independent split.
-o	Document it all.	[PARTLY DONE]
-o	Halting other CPUs on reset or panic doesn't always work.
-o	Don't waste page at 4 K--don't need it now (watch the GDT code).
-o	Dump bootup pages once booted somehow.
-o	Clean up warnings/volatiles.
-o	486 startup code.
-o	How to handle mixed FPU/non FPU processors.
-o	Test IO-APIC on various hardware.
-o	Separate IO-APIC from SMP.

arch/i386/boot/setup.S

@@ -145,7 +145,7 @@ start_of_setup:
 #ifdef SAFE_RESET_DISK_CONTROLLER
 # Reset the disk controller.
 	movw	$0x0000, %ax
-	movb	$0x80, $dl
+	movb	$0x80, %dl
 	int	$0x13
 #endif
 
@@ -400,7 +400,7 @@ is_disk1:
 	subw	$DELTA_INITSEG, %ax		# aka INITSEG
 	movw	%ax, %ds
 	xorw	%ax, %ax
-	movw	%ax, 0xa0			# set table length to 0
+	movw	%ax, (0xa0)			# set table length to 0
 	movb	$0xc0, %ah
 	stc
 	int	$0x15				# moves feature table to es:bx
@@ -496,7 +496,7 @@ done_apm_bios:
 	cmpw	$0, %cs:realmode_swtch
 	jz	rmodeswtch_normal
 
-	call	*%cs:realmode_swtch
+	lcall	%cs:realmode_swtch
 
 	jmp	rmodeswtch_end
 

arch/i386/kernel/setup.c

@@ -881,6 +881,15 @@ static void __init cyrix_model(struct cpuinfo_x86 *c)
 		 *	on the MediaGX. So we turn it off for now. 
 		 */
 		
+#ifdef CONFIG_PCI
+		/* It isnt really a PCI quirk directly, but the cure is the
+		   same. The MediaGX has deep magic SMM stuff that handles the
+		   SB emulation. It thows away the fifo on disable_dma() which
+		   is wrong and ruins the audio. */
+		
+		printk(KERN_INFO "Working around Cyrix MediaGX virtual DMA bug.\n");
+		isa_dma_bridge_buggy = 1;
+#endif		
 		/* GXm supports extended cpuid levels 'ala' AMD */
 		if (c->cpuid_level == 2) {
 			get_model_name(c);  /* get CPU marketing name */
@@ -893,15 +902,6 @@ static void __init cyrix_model(struct cpuinfo_x86 *c)
 			c->x86_model = (dir1 & 0x20) ? 1 : 2;
 			c->x86_capability&=~X86_FEATURE_TSC;
 		}
-#ifdef CONFIG_PCI
-		/* It isnt really a PCI quirk directly, but the cure is the
-		   same. The MediaGX has deep magic SMM stuff that handles the
-		   SB emulation. It thows away the fifo on disable_dma() which
-		   is wrong and ruins the audio. */
-		
-		printk(KERN_INFO "Working around Cyrix MediaGX virtual DMA bug.\n");
-		isa_dma_bridge_buggy = 1;
-#endif		
 		break;
 
         case 5: /* 6x86MX/M II */

drivers/char/bttv.c

@@ -2618,14 +2618,13 @@ static void handle_chipset(void)
 	if (triton1)
 		triton1=BT848_INT_ETBF;
 	
-	while ((dev = pci_find_device(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_496, dev))) 
+	
+	if(pci_pci_problems&PCIPCI_FAIL)
 	{
-		/* Beware the SiS 85C496 my friend - rev 49 don't work with a bttv */
-		printk(KERN_WARNING "BT848 and SIS 85C496 chipset don't always work together.\n");
+		printk(KERN_WARNING "bttv: This configuration is known to have PCI to PCI DMA problems\n");
+		printk(KERN_WARNING "bttv: You may not be able to use overlay mode.\n");
 	}
 			
-	/* dev == NULL */
-
 	while ((dev = pci_find_device(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82441, dev))) 
 	{
 		unsigned char b;

drivers/char/buz.c

@@ -3366,29 +3366,25 @@ static int find_zr36057(void)
 	return zoran_num;
 }
 
-#include "chipsets.h"
-
 static void handle_chipset(void)
 {
-	int index;
-	struct pci_dev *dev = NULL;
+	if(pci_pci_problems&PCIPCI_FAIL)
+	{
+		printk(KERN_WARNING "buz: This configuration is known to have PCI to PCI DMA problems\n");
+		printk(KERN_WARNING "buz: You may not be able to use overlay mode.\n");
+	}
 			
-	for (index = 0; index < sizeof(black) / sizeof(black[0]); index++) {
-		if ((dev = pci_find_device(black[index].vendor, black[index].device, dev)) != NULL) {
-			printk(KERN_INFO ": Host bridge: %s, ", black[index].name);
-			switch (black[index].action) {
 
-			case TRITON:
-				printk("enabling Triton support.\n");
+	if(pci_pci_problems&PCIPCI_TRITON)
+	{
+		printk("buz: Enabling Triton support.\n");
 		triton = 1;
-				break;
+	}
 	
-			case NATOMA:
-				printk("enabling Natoma workaround.\n");
+	if(pci_pci_problems&PCIPCI_NATOMA)
+	{
+		printk("buz: Enabling Natoma workaround.\n");
 		natoma = 1;
-				break;
-			}
-		}
 	}
 }
 

drivers/char/chipsets.h

-static const struct {
-	unsigned short vendor;
-	unsigned short device;
-	enum {
-		TRITON,
-		NATOMA
-	} action;
-	const char *name;
-} black[] = {
-
-	{
-		PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82437, TRITON, "82437"
-	},
-	{
-		PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82437VX, TRITON, "82437VX Triton II"
-	},
-	{
-		PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82439, TRITON, "82439HX Triton II"
-	},
-	{
-		PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82439TX, TRITON, "82439TX"
-	},
-	{
-		PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82441, NATOMA, "82441FX Natoma"
-	},
-	{
-		PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443LX_0, NATOMA, "440LX - 82443LX PAC Host"
-	},
-	{
-		PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443LX_1, NATOMA, "440LX - 82443LX PAC AGP"
-	},
-	{
-		PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0, NATOMA, "440BX - 82443BX Host"
-	},
-	{
-		PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_1, NATOMA, "440BX - 82443BX AGP"
-	},
-	{
-		PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2, NATOMA, "440BX - 82443BX Host (no AGP)"
-	},
-};

fs/Config.in

@@ -12,7 +12,7 @@ if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
    tristate 'ADFS filesystem support (read only) (EXPERIMENTAL)' CONFIG_ADFS_FS
 fi
 tristate 'Amiga FFS filesystem support' CONFIG_AFFS_FS
-tristate 'Apple Macintosh filesystem support (experimental)' CONFIG_HFS_FS
+tristate 'Apple Macintosh filesystem support (EXPERIMENTAL)' CONFIG_HFS_FS
 # msdos filesystems
 tristate 'DOS FAT fs support' CONFIG_FAT_FS
 dep_tristate '  MSDOS fs support' CONFIG_MSDOS_FS $CONFIG_FAT_FS
@@ -20,28 +20,28 @@ dep_tristate '  UMSDOS: Unix-like filesystem on top of standard MSDOS filesystem
 dep_tristate '  VFAT (Windows-95) fs support' CONFIG_VFAT_FS $CONFIG_FAT_FS
 
 if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
-  tristate 'EFS filesystem support (read only) (experimental)' CONFIG_EFS_FS
+   tristate 'EFS filesystem support (read only) (EXPERIMENTAL)' CONFIG_EFS_FS
 fi
 
 tristate 'ISO 9660 CDROM filesystem support' CONFIG_ISO9660_FS
 if [ "$CONFIG_ISO9660_FS" != "n" ]; then
-  bool 'Microsoft Joliet CDROM extensions' CONFIG_JOLIET
+   bool '  Microsoft Joliet CDROM extensions' CONFIG_JOLIET
 else
    # needed by nls/Config.in
    define_bool CONFIG_JOLIET n
 fi
 
-tristate 'UDF filesystem support' CONFIG_UDF_FS
+tristate 'UDF filesystem support (read only)' CONFIG_UDF_FS
 if [ "$CONFIG_UDF_FS" != "n" -a "$CONFIG_EXPERIMENTAL" = "y" ]; then
-  bool '   UDF read-write support (EXPERIMENTAL)' CONFIG_UDF_RW
+   bool '  UDF write support (DANGEROUS)' CONFIG_UDF_RW
 fi
 
 tristate 'Minix fs support' CONFIG_MINIX_FS
 tristate 'NTFS filesystem support (read only)' CONFIG_NTFS_FS
 if [ "$CONFIG_NTFS_FS" != "n" -a "$CONFIG_EXPERIMENTAL" = "y" ]; then
-  bool '   NTFS read-write support (DANGEROUS)' CONFIG_NTFS_RW
+   bool '  NTFS write support (DANGEROUS)' CONFIG_NTFS_RW
 fi
-tristate 'OS/2 HPFS filesystem support (read/write) (NEW)' CONFIG_HPFS_FS
+tristate 'OS/2 HPFS filesystem support' CONFIG_HPFS_FS
 bool '/proc filesystem support' CONFIG_PROC_FS
 if [ "$CONFIG_UNIX98_PTYS" = "y" ]; then
    # It compiles as a module for testing only.  It should not be used
@@ -51,9 +51,9 @@ if [ "$CONFIG_UNIX98_PTYS" = "y" ]; then
    bool '/dev/pts filesystem for Unix98 PTYs' CONFIG_DEVPTS_FS
 fi
 if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
-  tristate 'QNX filesystem support (EXPERIMENTAL)' CONFIG_QNX4FS_FS
+   tristate 'QNX filesystem support (read only) (EXPERIMENTAL)' CONFIG_QNX4FS_FS
    if [ "$CONFIG_QNX4FS_FS" != "n" ]; then
-    bool '   QNXFS read-write support (FOR TESTING ONLY)' CONFIG_QNX4FS_RW
+      bool '  QNXFS write support (DANGEROUS)' CONFIG_QNX4FS_RW
    fi    
 fi
 tristate 'ROM filesystem support' CONFIG_ROMFS_FS
@@ -62,9 +62,9 @@ tristate 'System V and Coherent filesystem support' CONFIG_SYSV_FS
 if [ "$CONFIG_SYSV_FS" != "n" -a "$CONFIG_EXPERIMENTAL" ]; then
    bool '  SYSV filesystem write support (DANGEROUS)' CONFIG_SYSV_FS_WRITE
 fi
-tristate 'UFS filesystem support' CONFIG_UFS_FS
-if [ "$CONFIG_UFS_FS" != "n" ]; then
-  bool '   UFS filesystem write support (experimental)' CONFIG_UFS_FS_WRITE
+tristate 'UFS filesystem support (read only)' CONFIG_UFS_FS
+if [ "$CONFIG_UFS_FS" != "n" -a "$CONFIG_EXPERIMENTAL" ]; then
+   bool '  UFS filesystem write support (DANGEROUS)' CONFIG_UFS_FS_WRITE
 fi
 
 
@@ -79,11 +79,12 @@ if [ "$CONFIG_INET" = "y" ]; then
    if [ "$CONFIG_NFS_FS" = "y" -a "$CONFIG_IP_PNP" = "y" ]; then
       bool '  Root file system on NFS' CONFIG_ROOT_NFS
    fi
-  # considering that RedHat-6.0 ships with this on, I guess it's not really experimental
-  tristate 'NFS server support' CONFIG_NFSD
+   if [ "$CONFIG_EXPERIMENTAL" ]; then
+      tristate 'NFS server support (EXPERIMENTAL)' CONFIG_NFSD
       if [ "$CONFIG_NFSD" != "n" ]; then
 	 bool '  Emulate SUN NFS server' CONFIG_NFSD_SUN
       fi
+   fi
    if [ "$CONFIG_NFS_FS" = "y" -o "$CONFIG_NFSD" = "y" ]; then
       define_bool CONFIG_SUNRPC y
       define_bool CONFIG_LOCKD y

fs/proc/array.c

@@ -38,7 +38,6 @@
  *
  * aeb@cwi.nl        :  /proc/partitions
  *
- *
  * Alan Cox	     :  security fixes.
  *			<Alan.Cox@linux.org>
  *
@@ -46,6 +45,11 @@
  *
  * Gerhard Wichert   :  added BIGMEM support
  * Siemens AG           <Gerhard.Wichert@pdb.siemens.de>
+ *
+ * Chuck Lever       :  safe handling of task_struct
+ *                      <cel@monkey.org>
+ *
+ * Andrea Arcangeli  :	SMP race/security fixes.
  */
 
 #include <linux/types.h>
@@ -67,6 +71,7 @@
 #include <linux/slab.h>
 #include <linux/smp.h>
 #include <linux/signal.h>
+#include <linux/smp_lock.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -469,7 +474,7 @@ static int get_array(struct mm_struct *mm, unsigned long start, unsigned long en
 				return result;
 			}
 		} while (addr & ~PAGE_MASK);
-		kunmap(addr, KM_READ);
+		kunmap(addr-1, KM_READ);
 	}
 	return result;
 }
@@ -479,6 +484,8 @@ static struct mm_struct *get_mm(int pid)
 	struct task_struct *p;
 	struct mm_struct *mm = NULL;
 
+	/* need kernel lock to avoid the tsk->mm to go away under us */
+	lock_kernel();
 	read_lock(&tasklist_lock);
 	p = find_task_by_pid(pid);
 	if (p)
@@ -486,10 +493,10 @@ static struct mm_struct *get_mm(int pid)
 	if (mm)
 		atomic_inc(&mm->mm_users);
 	read_unlock(&tasklist_lock);
+	unlock_kernel();
 	return mm;
 }
 
-
 static int get_env(int pid, char * buffer)
 {
 	struct mm_struct *mm = get_mm(pid);
@@ -842,6 +849,9 @@ static inline char * task_mem(struct mm_struct *mm, char *buffer)
 	return buffer;
 }
 
+/*
+ * These next two assume that the task's sigmask_lock is held by the caller.
+ */
 static void collect_sigign_sigcatch(struct task_struct *p, sigset_t *ign,
 				    sigset_t *catch)
 {
@@ -894,77 +904,115 @@ extern inline char *task_cap(struct task_struct *p, char *buffer)
 			    cap_t(p->cap_effective));
 }
 
-
+/*
+ * This is somewhat safer than it was before.  However...
+ *
+ * Embedded pointers in the task structure may reference data that
+ * can be changed or that is no longer valid after the tasklist
+ * lock is released, or that isn't even protected by the tasklist
+ * lock.  Eg. tsk->tty, tsk->sig, and tsk->p_pptr can change after
+ * we make our own copy of the task structure.  This doesn't matter
+ * unless we are trying to use the pointed-to data as an address.
+ * So there are still a few safety issues to be addressed here.
+ */
 static int get_status(int pid, char * buffer)
 {
 	char * orig = buffer;
 	struct task_struct *tsk;
 	struct mm_struct *mm = NULL;
 
+	/*
+	 * We lock the whole kernel here because p->files and p->mm are still
+	 * protected by the global kernel lock.
+	 */
+	lock_kernel();
+
 	read_lock(&tasklist_lock);
 	tsk = find_task_by_pid(pid);
-	if (tsk)
+	if (tsk) {
 		mm = tsk->mm;
 		if (mm)
 			atomic_inc(&mm->mm_users);
-	read_unlock(&tasklist_lock);	/* FIXME!! This should be done after the last use */
-	if (!tsk)
-		return 0;
+
 		buffer = task_name(tsk, buffer);
 		buffer = task_state(tsk, buffer);
-	if (mm)
-		buffer = task_mem(mm, buffer);
+
+		spin_lock_irq(&tsk->sigmask_lock);
 		buffer = task_sig(tsk, buffer);
+		spin_unlock_irq(&tsk->sigmask_lock);
+
 		buffer = task_cap(tsk, buffer);
-	if (mm)
+	}
+	read_unlock(&tasklist_lock);
+
+	unlock_kernel();
+
+	/*
+	 * We can't hold the tasklist_lock and jiggle the mmap_sem --
+	 * that can result in a deadlock.
+	 */
+	if (mm) {
+		buffer = task_mem(mm, buffer);
 		mmput(mm);
+	}
+
+	/*
+	 * (buffer - orig) will be zero on an error exit.
+	 */
 	return buffer - orig;
 }
 
 static int get_stat(int pid, char * buffer)
 {
 	struct task_struct *tsk;
-	struct mm_struct *mm = NULL;
+	struct mm_struct *mm;
 	unsigned long vsize, eip, esp, wchan;
 	long priority, nice;
-	int tty_pgrp;
+	pid_t ppid = 0;
 	sigset_t sigign, sigcatch;
 	char state;
-	int res;
+	int res = 0;
+	unsigned int tty_device;
+	int tty_pgrp;
 
 	read_lock(&tasklist_lock);
 	tsk = find_task_by_pid(pid);
-	if (tsk)
+	if (!tsk)
+		goto out_unlock;
+	/* avoid the task list to go away under us (security) */
+	get_page(MAP_NR(tsk) + mem_map);
+	ppid = tsk->p_pptr->pid;
+	read_unlock(&tasklist_lock);
+
+	/* we need the big kernel lock to avoid tsk->mm and tsk->tty
+	   to change under us */
+	lock_kernel();
 	mm = tsk->mm;
 	if (mm)
 		atomic_inc(&mm->mm_users);
-	read_unlock(&tasklist_lock);	/* FIXME!! This should be done after the last use */
-	if (!tsk)
-		return 0;
+	tty_device = tsk->tty ? kdev_t_to_nr(tsk->tty->device) : 0;
+	tty_pgrp = tsk->tty ? tsk->tty->pgrp : -1;
+	unlock_kernel();
+
+	spin_lock_irq(&tsk->sigmask_lock);
+	collect_sigign_sigcatch(tsk, &sigign, &sigcatch);
+	spin_unlock_irq(&tsk->sigmask_lock);
+
+	eip = KSTK_EIP(tsk);
+	esp = KSTK_ESP(tsk);
+	wchan = get_wchan(tsk);
+
 	state = *get_task_state(tsk);
 	vsize = eip = esp = 0;
-	if (mm) {
+	if (mm)
+	{
 		struct vm_area_struct *vma;
 		down(&mm->mmap_sem);
-		vma = mm->mmap;
-		while (vma) {
+		for (vma = mm->mmap; vma; vma = vma->vm_next)
 			vsize += vma->vm_end - vma->vm_start;
-			vma = vma->vm_next;
-		}
-		eip = KSTK_EIP(tsk);
-		esp = KSTK_ESP(tsk);
 		up(&mm->mmap_sem);
 	}
 
-	wchan = get_wchan(tsk);
-
-	collect_sigign_sigcatch(tsk, &sigign, &sigcatch);
-
-	if (tsk->tty)
-		tty_pgrp = tsk->tty->pgrp;
-	else
-		tty_pgrp = -1;
-
 	/* scale priority and nice values from timeslices to -20..20 */
 	/* to make it look like a "normal" Unix priority/nice value  */
 	priority = tsk->counter;
@@ -978,10 +1026,10 @@ static int get_stat(int pid, char * buffer)
 		pid,
 		tsk->comm,
 		state,
-		tsk->p_pptr->pid,
+		ppid,
 		tsk->pgrp,
 		tsk->session,
-	        tsk->tty ? kdev_t_to_nr(tsk->tty->device) : 0,
+		tty_device,
 		tty_pgrp,
 		tsk->flags,
 		tsk->min_flt,
@@ -1018,9 +1066,16 @@ static int get_stat(int pid, char * buffer)
 		tsk->cnswap,
 		tsk->exit_signal,
 		tsk->processor);
+
 	if (mm)
 		mmput(mm);
+	free_task_struct(tsk);
 	return res;
+
+out_unlock:
+	read_unlock(&tasklist_lock);
+	unlock_kernel();
+	return 0;
 }
 		
 static inline void statm_pte_range(pmd_t * pmd, unsigned long address, unsigned long size,
@@ -1168,11 +1223,11 @@ static ssize_t read_maps (int pid, struct file * file, char * buf,
 			  size_t count, loff_t *ppos)
 {
 	struct task_struct *p;
+	struct mm_struct *mm = NULL;
 	struct vm_area_struct * map, * next;
 	char * destptr = buf, * buffer;
 	loff_t lineno;
 	ssize_t column, i;
-	int volatile_task;
 	long retval;
 
 	/*
@@ -1184,24 +1239,30 @@ static ssize_t read_maps (int pid, struct file * file, char * buf,
 		goto out;
 
 	retval = -EINVAL;
+	lock_kernel();
 	read_lock(&tasklist_lock);
 	p = find_task_by_pid(pid);
-	read_unlock(&tasklist_lock);	/* FIXME!! This should be done after the last use */
+	if (p) {
+		mm = p->mm;
+		if (mm)
+			atomic_inc(&mm->mm_users);
+	}
+	read_unlock(&tasklist_lock);
+	unlock_kernel();
 	if (!p)
 		goto freepage_out;
 
-	if (!p->mm || count == 0)
+	/* nothing to map */
+	if (!mm || count == 0)
 		goto getlen_out;
 
-	/* Check whether the mmaps could change if we sleep */
-	volatile_task = (p != current || atomic_read(&p->mm->mm_users) > 1);
-
 	/* decode f_pos */
 	lineno = *ppos >> MAPS_LINE_SHIFT;
 	column = *ppos & (MAPS_LINE_LENGTH-1);
 
-	/* quickly go to line lineno */
-	for (map = p->mm->mmap, i = 0; map && (i < lineno); map = map->vm_next, i++)
+	down(&mm->mmap_sem);
+	/* quickly go to line "lineno" */
+	for (map = mm->mmap, i = 0; map && (i < lineno); map = map->vm_next, i++)
 		continue;
 
 	for ( ; map ; map = next ) {
@@ -1272,17 +1333,13 @@ static ssize_t read_maps (int pid, struct file * file, char * buf,
 		/* done? */
 		if (count == 0)
 			break;
-
-		/* By writing to user space, we might have slept.
-		 * Stop the loop, to avoid a race condition.
-		 */
-		if (volatile_task)
-			break;
 	}
+	up(&mm->mmap_sem);
 
 	/* encode f_pos */
 	*ppos = (lineno << MAPS_LINE_SHIFT) + column;
 
+	mmput(mm);
 getlen_out:
 	retval = destptr - buf;
 
@@ -1295,17 +1352,19 @@ static ssize_t read_maps (int pid, struct file * file, char * buf,
 #ifdef __SMP__
 static int get_pidcpu(int pid, char * buffer)
 {
-	struct task_struct * tsk = current ;
-	int i, len;
+	struct task_struct * tsk;
+	int i, len = 0;
 
+	/*
+	 * Hold the tasklist_lock to guarantee that the task_struct
+	 * address will remain valid while we examine its contents.
+	 */
 	read_lock(&tasklist_lock);
-	if (pid != tsk->pid)
 	tsk = find_task_by_pid(pid);
-	read_unlock(&tasklist_lock);	/* FIXME!! This should be done after the last use */
-
-	if (tsk == NULL)
-		return 0;
-
+	if (tsk)
+		get_page(MAP_NR(tsk) + mem_map);
+	read_unlock(&tasklist_lock);
+	if (tsk) {
 		len = sprintf(buffer,
 			"cpu  %lu %lu\n",
 			tsk->times.tms_utime,
@@ -1316,7 +1375,8 @@ static int get_pidcpu(int pid, char * buffer)
 				i,
 				tsk->per_cpu_utime[cpu_logical_map(i)],
 				tsk->per_cpu_stime[cpu_logical_map(i)]);
-
+		free_task_struct(tsk);
+	}
 	return len;
 }
 #endif
@@ -1453,12 +1513,6 @@ static int process_unauthorized(int type, int pid)
 	int ok = 0;
 		
 	read_lock(&tasklist_lock);
-	
-	/*
-	 *	Grab the lock, find the task, save the uid and
-	 *	check it has an mm still (ie its not dead)
-	 */
-	
 	p = find_task_by_pid(pid);
 	if (p) {
 		euid=p->euid;
@@ -1466,9 +1520,7 @@ static int process_unauthorized(int type, int pid)
 		if(!cap_issubset(p->cap_permitted, current->cap_permitted))
 			ok=0;			
 	}
-		
 	read_unlock(&tasklist_lock);
-
 	if (!p)
 		return 1;
 

net/Config.in

@@ -5,16 +5,16 @@ mainmenu_option next_comment
 comment 'Networking options'
 tristate 'Packet socket' CONFIG_PACKET
 if [ "$CONFIG_PACKET" != "n" ]; then
-  bool 'Packet socket: mmapped IO' CONFIG_PACKET_MMAP
+   bool '  Packet socket: mmapped IO' CONFIG_PACKET_MMAP
 fi
 bool 'Kernel/User netlink socket' CONFIG_NETLINK
 if [ "$CONFIG_NETLINK" = "y" ]; then
-  bool 'Routing messages' CONFIG_RTNETLINK
-  tristate 'Netlink device emulation' CONFIG_NETLINK_DEV
+   bool '  Routing messages' CONFIG_RTNETLINK
+   tristate '  Netlink device emulation' CONFIG_NETLINK_DEV
 fi
 bool 'Network packet filtering (replaces ipchains)' CONFIG_NETFILTER
 if [ "$CONFIG_NETFILTER" = "y" ]; then
-  bool 'Network packet filtering debugging' CONFIG_NETFILTER_DEBUG
+   bool '  Network packet filtering debugging' CONFIG_NETFILTER_DEBUG
 fi
 bool 'Socket Filtering'  CONFIG_FILTER
 tristate 'Unix domain sockets' CONFIG_UNIX
@@ -22,9 +22,8 @@ bool 'TCP/IP networking' CONFIG_INET
 if [ "$CONFIG_INET" = "y" ]; then
    source net/ipv4/Config.in
    if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
-#   Sorry, but IPv6 as module is still invalid.
-    tristate 'The IPv6 protocol (EXPERIMENTAL)' CONFIG_IPV6
-#   bool 'The IPv6 protocol (EXPERIMENTAL)' CONFIG_IPV6
+#   IPv6 as module will cause a CRASH if you try to unload it
+      tristate '  The IPv6 protocol (EXPERIMENTAL)' CONFIG_IPV6
       if [ "$CONFIG_IPV6" != "n" ]; then
 	 source net/ipv6/Config.in
       fi
@@ -34,17 +33,17 @@ if [ "$CONFIG_INET" = "y" ]; then
    fi
 fi
 if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
-  bool 'Asynchronous Transfer Mode (ATM, EXPERIMENTAL)' CONFIG_ATM y
+   bool 'Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)' CONFIG_ATM
    if [ "$CONFIG_ATM" = "y" ]; then
       if [ "$CONFIG_INET" = "y" ]; then
-      bool '  Classical IP over ATM' CONFIG_ATM_CLIP y
+	 bool '  Classical IP over ATM' CONFIG_ATM_CLIP
 	 if [ "$CONFIG_ATM_CLIP" = "y" ]; then
-	bool '    Do NOT send ICMP if no neighbour' CONFIG_ATM_CLIP_NO_ICMP n
+	    bool '    Do NOT send ICMP if no neighbour' CONFIG_ATM_CLIP_NO_ICMP
 	 fi
       fi
-    tristate '  LAN Emulation (LANE) support' CONFIG_ATM_LANE y
+      tristate '  LAN Emulation (LANE) support' CONFIG_ATM_LANE
       if [ "$CONFIG_INET" = "y" -a "$CONFIG_ATM_LANE" != "n" ]; then
-      tristate '  Multi-Protocol Over ATM (MPOA) support' CONFIG_ATM_MPOA y
+	 tristate '    Multi-Protocol Over ATM (MPOA) support' CONFIG_ATM_MPOA
       fi
    fi
 fi
@@ -65,9 +64,11 @@ if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
    bool 'Bridging (EXPERIMENTAL)' CONFIG_BRIDGE
    bool '802.2 LLC (EXPERIMENTAL)' CONFIG_LLC
 #   if [ "$CONFIG_LLC" = "y" ]; then
-#   bool 'Netbeui (EXPERIMENTAL)' CONFIG_NETBEUI
+#      bool '  Netbeui (EXPERIMENTAL)' CONFIG_NETBEUI
 #   fi
+   if [ "$CONFIG_INET" = "y" ]; then
       tristate 'Acorn Econet/AUN protocols (EXPERIMENTAL)' CONFIG_ECONET
+   fi
    if [ "$CONFIG_ECONET" != "n" ]; then
       bool '  AUN over UDP' CONFIG_ECONET_AUNUDP
       bool '  Native Econet' CONFIG_ECONET_NATIVE
@@ -78,7 +79,7 @@ if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
    if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
       mainmenu_option next_comment
       comment 'QoS and/or fair queueing'
-  bool 'QoS and/or fair queueing' CONFIG_NET_SCHED
+      bool 'QoS and/or fair queueing (EXPERIMENTAL)' CONFIG_NET_SCHED
       if [ "$CONFIG_NET_SCHED" = "y" ]; then
 	 source net/sched/Config.in
       fi

net/ipv4/Config.in

 #
 # IP configuration
 #
-bool 'IP: multicasting' CONFIG_IP_MULTICAST
-bool 'IP: advanced router' CONFIG_IP_ADVANCED_ROUTER
+bool '  IP: multicasting' CONFIG_IP_MULTICAST
+bool '  IP: advanced router' CONFIG_IP_ADVANCED_ROUTER
 if [ "$CONFIG_IP_ADVANCED_ROUTER" = "y" ]; then
    define_bool CONFIG_RTNETLINK y	
    define_bool CONFIG_NETLINK y
-  bool 'IP: policy routing' CONFIG_IP_MULTIPLE_TABLES
-  bool 'IP: equal cost multipath' CONFIG_IP_ROUTE_MULTIPATH
-  bool 'IP: use TOS value as routing key' CONFIG_IP_ROUTE_TOS
-  bool 'IP: verbose route monitoring' CONFIG_IP_ROUTE_VERBOSE
-  bool 'IP: large routing tables' CONFIG_IP_ROUTE_LARGE_TABLES
+   bool '    IP: policy routing' CONFIG_IP_MULTIPLE_TABLES
    if [ "$CONFIG_IP_MULTIPLE_TABLES" = "y" ]; then
-    bool 'IP: fast network address translation' CONFIG_IP_ROUTE_NAT
+      bool '  IP: use FWMARK value as routing key' CONFIG_IP_ROUTE_FWMARK
+   fi
+   bool '    IP: equal cost multipath' CONFIG_IP_ROUTE_MULTIPATH
+   bool '    IP: use TOS value as routing key' CONFIG_IP_ROUTE_TOS
+   bool '    IP: verbose route monitoring' CONFIG_IP_ROUTE_VERBOSE
+   bool '    IP: large routing tables' CONFIG_IP_ROUTE_LARGE_TABLES
+   if [ "$CONFIG_IP_MULTIPLE_TABLES" = "y" ]; then
+      bool '      IP: fast network address translation' CONFIG_IP_ROUTE_NAT
    fi
 fi
-if [ "$CONFIG_IP_MULTIPLE_TABLES" = "y" ]; then
-  bool 'IP: use FWMARK value as routing key' CONFIG_IP_ROUTE_FWMARK
-fi
-bool 'IP: kernel level autoconfiguration' CONFIG_IP_PNP
+bool '  IP: kernel level autoconfiguration' CONFIG_IP_PNP
 if [ "$CONFIG_IP_PNP" = "y" ]; then
    bool '    BOOTP support' CONFIG_IP_PNP_BOOTP
    bool '    RARP support' CONFIG_IP_PNP_RARP
 # not yet ready..
 #   bool '    ARP support' CONFIG_IP_PNP_ARP		
 fi
-bool 'IP: optimize as router not host' CONFIG_IP_ROUTER
-tristate 'IP: tunneling' CONFIG_NET_IPIP
-tristate 'IP: GRE tunnels over IP' CONFIG_NET_IPGRE
+bool '  IP: optimize as router not host' CONFIG_IP_ROUTER
+tristate '  IP: tunneling' CONFIG_NET_IPIP
+tristate '  IP: GRE tunnels over IP' CONFIG_NET_IPGRE
 if [ "$CONFIG_IP_MULTICAST" = "y" ]; then
    if [ "$CONFIG_NET_IPGRE" != "n" ]; then
-    bool 'IP: broadcast GRE over IP' CONFIG_NET_IPGRE_BROADCAST
+      bool '    IP: broadcast GRE over IP' CONFIG_NET_IPGRE_BROADCAST
    fi
-  bool 'IP: multicast routing' CONFIG_IP_MROUTE
+   bool '  IP: multicast routing' CONFIG_IP_MROUTE
    if [ "$CONFIG_IP_MROUTE" = "y" ]; then
-    bool 'IP: PIM-SM version 1 support' CONFIG_IP_PIMSM_V1
-    bool 'IP: PIM-SM version 2 support' CONFIG_IP_PIMSM_V2
+      bool '    IP: PIM-SM version 1 support' CONFIG_IP_PIMSM_V1
+      bool '    IP: PIM-SM version 2 support' CONFIG_IP_PIMSM_V2
    fi
 fi
-bool 'IP: aliasing support' CONFIG_IP_ALIAS
+bool '  IP: aliasing support' CONFIG_IP_ALIAS
 if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
    if [ "$CONFIG_RTNETLINK" = "y" ]; then
-    bool 'IP: ARP daemon support (EXPERIMENTAL)' CONFIG_ARPD
+      bool '  IP: ARP daemon support (EXPERIMENTAL)' CONFIG_ARPD
    fi
 fi
-bool 'IP: TCP syncookie support (not enabled per default)' CONFIG_SYN_COOKIES
+bool '  IP: TCP syncookie support (disabled per default)' CONFIG_SYN_COOKIES
 comment '(it is safe to leave these untouched)'
-#bool 'IP: PC/TCP compatibility mode' CONFIG_INET_PCTCP
-#bool 'IP: Path MTU Discovery (normally enabled)' CONFIG_PATH_MTU_DISCOVERY
-#bool 'IP: Disable NAGLE algorithm (normally enabled)' CONFIG_TCP_NAGLE_OFF
-bool 'IP: Allow large windows (not recommended if <16Mb of memory)' CONFIG_SKB_LARGE
+#bool '  IP: PC/TCP compatibility mode' CONFIG_INET_PCTCP
+#bool '  IP: Path MTU Discovery (normally enabled)' CONFIG_PATH_MTU_DISCOVERY
+#bool '  IP: Disable NAGLE algorithm (normally enabled)' CONFIG_TCP_NAGLE_OFF
+bool '  IP: Allow large windows (not recommended if <16Mb of memory)' CONFIG_SKB_LARGE
 #if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then 
-#bool 'IP: support experimental checksum copy to user for UDP'  CONFIG_UDP_DELAY_CSUM
+#   bool '  IP: support checksum copy to user for UDP (EXPERIMENTAL)'  CONFIG_UDP_DELAY_CSUM
 #fi
-

net/ipv6/Config.in

 #
 # IPv6 configuration
 # 
-bool 'IPv6: enable EUI-64 token format' CONFIG_IPV6_EUI64
+bool '    IPv6: enable EUI-64 token format' CONFIG_IPV6_EUI64
 if [ "$CONFIG_IPV6_EUI64" = "y" ]; then
-  bool 'IPv6: disable provider based addresses' CONFIG_IPV6_NO_PB
+   bool '    IPv6: disable provider based addresses' CONFIG_IPV6_NO_PB
 fi
 if [ "$CONFIG_NETLINK" = "y" ]; then
    if [ "$CONFIG_RTNETLINK" = "n" ]; then
-    bool 'IPv6: routing messages via old netlink' CONFIG_IPV6_NETLINK
+      bool '    IPv6: routing messages via old netlink' CONFIG_IPV6_NETLINK
    fi
 fi
-#bool 'IPv6: flow policy support' CONFIG_RT6_POLICY
-#bool 'IPv6: firewall support' CONFIG_IPV6_FIREWALL
+#bool '    IPv6: flow policy support' CONFIG_RT6_POLICY
+#bool '    IPv6: firewall support' CONFIG_IPV6_FIREWALL

net/sched/Config.in

@@ -17,20 +17,20 @@ tristate 'TEQL queue' CONFIG_NET_SCH_TEQL
 tristate 'TBF queue' CONFIG_NET_SCH_TBF
 bool 'QoS support' CONFIG_NET_QOS
 if [ "$CONFIG_NET_QOS" = "y" ]; then
-    bool 'Rate estimator' CONFIG_NET_ESTIMATOR
+    bool '  Rate estimator' CONFIG_NET_ESTIMATOR
 fi
 bool 'Packet classifier API' CONFIG_NET_CLS
 if [ "$CONFIG_NET_CLS" = "y" ]; then
-  tristate 'Routing table based classifier' CONFIG_NET_CLS_ROUTE4
+   tristate '  Routing table based classifier' CONFIG_NET_CLS_ROUTE4
    if [ "$CONFIG_NET_CLS_ROUTE4" != "n" ]; then
       define_bool CONFIG_NET_CLS_ROUTE y
    fi
-  tristate 'Firewall based classifier' CONFIG_NET_CLS_FW
-  tristate 'U32 classifier' CONFIG_NET_CLS_U32
+   tristate '  Firewall based classifier' CONFIG_NET_CLS_FW
+   tristate '  U32 classifier' CONFIG_NET_CLS_U32
    if [ "$CONFIG_NET_QOS" = "y" ]; then
-    tristate 'Special RSVP classifier' CONFIG_NET_CLS_RSVP
-    tristate 'Special RSVP classifier for IPv6' CONFIG_NET_CLS_RSVP6
-    bool 'Ingres traffic policing' CONFIG_NET_CLS_POLICE
+      tristate '  Special RSVP classifier' CONFIG_NET_CLS_RSVP
+      tristate '  Special RSVP classifier for IPv6' CONFIG_NET_CLS_RSVP6
+      bool '  Ingres traffic policing' CONFIG_NET_CLS_POLICE
    fi
 fi
 

net/sunrpc/sched.c

@@ -872,7 +872,6 @@ static int
 rpciod(void *ptr)
 {
 	wait_queue_head_t *assassin = (wait_queue_head_t*) ptr;
-	unsigned long	oldflags;
 	int		rounds = 0;
 
 	MOD_INC_USE_COUNT;
@@ -907,7 +906,6 @@ rpciod(void *ptr)
 			schedule();
 			rounds = 0;
 		}
-		save_flags(oldflags); cli();
 		dprintk("RPC: rpciod running checking dispatch\n");
 		rpciod_tcp_dispatcher();
 
@@ -917,7 +915,6 @@ rpciod(void *ptr)
 			dprintk("RPC: switch to rpciod\n");
 			rounds = 0;
 		}
-		restore_flags(oldflags);
 	}
 
 	dprintk("RPC: rpciod shutdown commences\n");