## Automatically generated incremental diff
## From:   linux-2.2.22-rc1
## To:     linux-2.2.22-rc2
## Robot:  $Id: make-incremental-diff,v 1.11 2002/02/20 02:59:33 hpa Exp $

diff -urN linux-2.2.22-rc1/Documentation/usb/ov511.txt linux-2.2.22-rc2/Documentation/usb/ov511.txt
--- linux-2.2.22-rc1/Documentation/usb/ov511.txt	Sun Mar 25 08:32:00 2001
+++ linux-2.2.22-rc2/Documentation/usb/ov511.txt	Fri Aug 30 16:24:38 2002
@@ -178,16 +178,6 @@
         programs that expect RGB data (e.g. gqcam) to work with this driver. If
         your colors look VERY wrong, you may want to change this.
 
-  NAME: buf_timeout
-  TYPE: integer
-  DEFAULT: 5 (seconds)
-  DESC: Number of seconds before unused frame buffers are deallocated.
-        Previously, memory was allocated upon open() and deallocated upon
-        close(). Deallocation now occurs only if the driver is closed and this
-        timeout is reached. If you are capturing frames less frequently than
-        the default timeout, increase this. This will not make any difference
-        with programs that capture multiple frames during an open/close cycle.
-
   NAME: cams
   TYPE: integer (1-4 for OV511, 1-31 for OV511+)
   DEFAULT: 1
@@ -242,7 +232,7 @@
 
 HOW TO CONTACT ME:
 
-You can email me at mwm@i.am . Please prefix the subject line
+You can email me at mark@alpha.dyndns.org . Please prefix the subject line
 with "OV511: " so that I am certain to notice your message.
 
 CREDITS:
diff -urN linux-2.2.22-rc1/MAINTAINERS linux-2.2.22-rc2/MAINTAINERS
--- linux-2.2.22-rc1/MAINTAINERS	Mon May 20 16:32:34 2002
+++ linux-2.2.22-rc2/MAINTAINERS	Fri Aug 30 16:24:38 2002
@@ -1176,6 +1176,11 @@
 W:	http://cvs.conectiva.com.br/drivers/ZFL-watchdog/
 S:	Maintained
 
+LINUX 2.2 FIXES
+P:	Alan Cox
+M:	alan@lxorguk.ukuu.org.uk
+S:	Maintained
+
 THE REST
 P:	Linus Torvalds
 S:	Buried alive in reporters
diff -urN linux-2.2.22-rc1/Makefile linux-2.2.22-rc2/Makefile
--- linux-2.2.22-rc1/Makefile	Fri Aug 30 16:24:37 2002
+++ linux-2.2.22-rc2/Makefile	Fri Aug 30 16:24:38 2002
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 2
 SUBLEVEL = 22
-EXTRAVERSION = rc1
+EXTRAVERSION = rc2
 
 ARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ -e s/arm.*/arm/ -e s/sa110/arm/)
 
diff -urN linux-2.2.22-rc1/arch/sparc/config.in linux-2.2.22-rc2/arch/sparc/config.in
--- linux-2.2.22-rc1/arch/sparc/config.in	Sun Mar 25 08:37:30 2001
+++ linux-2.2.22-rc2/arch/sparc/config.in	Fri Aug 30 16:24:38 2002
@@ -93,6 +93,9 @@
   tristate '   RAID-1 (mirroring) mode' CONFIG_MD_MIRRORING
   tristate '   RAID-4/RAID-5 mode' CONFIG_MD_RAID5
 fi
+if [ "$CONFIG_MD_LINEAR" = "y" -o "$CONFIG_MD_STRIPED" = "y" ]; then
+  bool '      Boot support (linear, striped)' CONFIG_MD_BOOT
+fi
 
 tristate 'RAM disk support' CONFIG_BLK_DEV_RAM
 if [ "$CONFIG_BLK_DEV_RAM" = "y" -o "$CONFIG_BLK_DEV_RAM" = "m" ]; then
diff -urN linux-2.2.22-rc1/drivers/cdrom/cdu31a.c linux-2.2.22-rc2/drivers/cdrom/cdu31a.c
--- linux-2.2.22-rc1/drivers/cdrom/cdu31a.c	Sun Mar 25 08:31:36 2001
+++ linux-2.2.22-rc2/drivers/cdrom/cdu31a.c	Fri Aug 30 16:24:38 2002
@@ -3027,6 +3027,8 @@
          	return 0;
          }
 
+         if (ra.nframes > INT_MAX / CD_FRAMESIZE_RAW)
+		return -EINVAL;
          i=verify_area(VERIFY_WRITE, ra.buf, CD_FRAMESIZE_RAW * ra.nframes);
          if(i<0)
          	return i;
diff -urN linux-2.2.22-rc1/drivers/char/bttv.c linux-2.2.22-rc2/drivers/char/bttv.c
--- linux-2.2.22-rc1/drivers/char/bttv.c	Fri Aug 30 16:24:37 2002
+++ linux-2.2.22-rc2/drivers/char/bttv.c	Fri Aug 30 16:24:38 2002
@@ -1610,6 +1610,8 @@
 	struct bttv *btv= (struct bttv *)v;
 	int q,todo;
 	/* BROKEN: RETURNS VBI WHEN IT SHOULD RETURN GRABBED VIDEO FRAME */
+	if (count > INT_MAX)
+		return -EINVAL;
 	todo=count;
 	while (todo && todo>(q=VBIBUF_SIZE-btv->vbip)) 
 	{
@@ -1639,7 +1641,7 @@
 			}
 		}
 	}
-	if (todo) 
+	if (todo > 0 && todo <= VBIBUF_SIZE-btv->vbip)
 	{
 		if(copy_to_user((void *) buf, (void *) btv->vbibuf+btv->vbip, todo))
 			return -EFAULT;
@@ -2457,6 +2459,8 @@
 	struct bttv *btv=(struct bttv *)(v-2);
 	int q,todo;
 
+	if (count > INT_MAX)
+		return -EINVAL;
 	todo=count;
 	while (todo && todo>(q=VBIBUF_SIZE-btv->vbip)) 
 	{
@@ -2486,7 +2490,7 @@
 			}
 		}
 	}
-	if (todo) 
+	if (todo > 0 && todo <= VBIBUF_SIZE-btv->vbip)
 	{
 		if(copy_to_user((void *) buf, (void *) btv->vbibuf+btv->vbip, todo))
 			return -EFAULT;
diff -urN linux-2.2.22-rc1/drivers/char/console.c linux-2.2.22-rc2/drivers/char/console.c
--- linux-2.2.22-rc1/drivers/char/console.c	Sun Mar 25 08:37:31 2001
+++ linux-2.2.22-rc2/drivers/char/console.c	Fri Aug 30 16:24:38 2002
@@ -2101,6 +2101,8 @@
 		return -EINVAL;
 	if (current->tty != tty && !suser())
 		return -EPERM;
+	/* Further code uses __put_user() relying on this get_user() having
+	 * done the address range checking. */
 	if (get_user(type, (char *)arg))
 		return -EFAULT;
 	switch (type)
diff -urN linux-2.2.22-rc1/drivers/char/consolemap.c linux-2.2.22-rc2/drivers/char/consolemap.c
--- linux-2.2.22-rc1/drivers/char/consolemap.c	Sun Mar 25 08:31:25 2001
+++ linux-2.2.22-rc2/drivers/char/consolemap.c	Fri Aug 30 16:24:38 2002
@@ -611,16 +611,18 @@
 			if ((p2 = *(p1++)))
 				for (k = 0; k < 64; k++) {
 					if (*p2 < MAX_GLYPH && ect++ < ct) {
-						__put_user((u_short)((i<<11)+(j<<6)+k),
-							   &list->unicode);
-						__put_user((u_short) *p2, 
-							   &list->fontpos);
+						put_user_ret((u_short)((i<<11)+(j<<6)+k),
+							&list->unicode,
+							-EFAULT);
+						put_user_ret((u_short) *p2,
+							&list->fontpos,
+							-EFAULT);
 						list++;
 					}
 					p2++;
 				}
 	}
-	__put_user(ect, uct);
+	put_user_ret(ect, uct, -EFAULT);
 	return ((ect <= ct) ? 0 : -ENOMEM);
 }
 
diff -urN linux-2.2.22-rc1/drivers/char/lp.c linux-2.2.22-rc2/drivers/char/lp.c
--- linux-2.2.22-rc1/drivers/char/lp.c	Fri Nov  2 08:39:06 2001
+++ linux-2.2.22-rc2/drivers/char/lp.c	Fri Aug 30 16:24:38 2002
@@ -649,7 +649,7 @@
 		}
 		if ((i & 1) != 0) {
 			Byte |= (z<<4);
-			if (__put_user (Byte, temp))
+			if (put_user (Byte, temp))
 			{
 				count = -EFAULT;
 				break;
diff -urN linux-2.2.22-rc1/drivers/char/vt.c linux-2.2.22-rc2/drivers/char/vt.c
--- linux-2.2.22-rc1/drivers/char/vt.c	Sun Mar 25 08:31:24 2001
+++ linux-2.2.22-rc2/drivers/char/vt.c	Fri Aug 30 16:24:38 2002
@@ -394,8 +394,9 @@
 	if (copy_from_user(&tmp, user_ud, sizeof tmp))
 		return -EFAULT;
 	if (tmp.entries) {
-		i = verify_area(VERIFY_WRITE, tmp.entries, 
-						tmp.entry_ct*sizeof(struct unipair));
+		/* tmp.entry_ct is an unsigned short */
+		i = verify_area(VERIFY_WRITE, tmp.entries,
+				(size_t)tmp.entry_ct * sizeof(struct unipair));
 		if (i) return i;
 	}
 	switch (cmd) {
diff -urN linux-2.2.22-rc1/drivers/isdn/isdn_common.c linux-2.2.22-rc2/drivers/isdn/isdn_common.c
--- linux-2.2.22-rc1/drivers/isdn/isdn_common.c	Mon May 20 16:32:34 2002
+++ linux-2.2.22-rc2/drivers/isdn/isdn_common.c	Fri Aug 30 16:24:38 2002
@@ -64,7 +64,7 @@
 #endif /* CONFIG_ISDN_DIVERSION */
 
 
-static int isdn_writebuf_stub(int, int, const u_char *, int, int);
+static ssize_t isdn_writebuf_stub(int, int, const u_char *, size_t, int);
 static void set_global_features(void);
 static int isdn_wildmat(char *s, char *p);
 
@@ -1099,9 +1099,11 @@
 			goto out;
 		}
 		chidx = isdn_minor2chan(minor);
-		while (isdn_writebuf_stub(drvidx, chidx, buf, count, 1) != count)
+		do {
+			retval = isdn_writebuf_stub(drvidx, chidx, buf, count, 1);
+			if (retval == count || retval < 0) break;
 			interruptible_sleep_on(&dev->drv[drvidx]->snd_waitq[chidx]);
-		retval = count;
+		} while (1);
 		goto out;
 	}
 	if (minor <= ISDN_MINOR_CTRLMAX) {
@@ -1874,22 +1876,29 @@
 /*
  *  writebuf replacement for SKB_ABLE drivers
  */
-static int
-isdn_writebuf_stub(int drvidx, int chan, const u_char * buf, int len,
+static ssize_t
+isdn_writebuf_stub(int drvidx, int chan, const u_char * buf, size_t len,
 		   int user)
 {
-	int ret;
-	int hl = dev->drv[drvidx]->interface->hl_hdrlen;
-	struct sk_buff *skb = alloc_skb(hl + len, GFP_ATOMIC);
+	int ret = 0;
+	unsigned int hl;
+	struct sk_buff *skb;
+
+	hl = dev->drv[drvidx]->interface->hl_hdrlen;
+	if (len > INT_MAX / 2 || hl > INT_MAX / 2)
+		return -EINVAL;
+	skb = alloc_skb(hl + len, GFP_ATOMIC);
 
 	if (!skb)
-		return 0;
+		return -ENOMEM;
 	skb_reserve(skb, hl);
 	if (user)
-		copy_from_user(skb_put(skb, len), buf, len);
+		ret = copy_from_user(skb_put(skb, len), buf, len) ? -EFAULT : 0;
 	else
 		memcpy(skb_put(skb, len), buf, len);
-	ret = dev->drv[drvidx]->interface->writebuf_skb(drvidx, chan, 1, skb);
+	if (!ret)
+		ret = dev->drv[drvidx]->interface->writebuf_skb(drvidx,
+		    chan, 1, skb);
 	if (ret <= 0)
 		dev_kfree_skb(skb);
 	if (ret > 0)
diff -urN linux-2.2.22-rc1/drivers/isdn/isdn_ppp.c linux-2.2.22-rc2/drivers/isdn/isdn_ppp.c
--- linux-2.2.22-rc1/drivers/isdn/isdn_ppp.c	Mon May 20 16:32:34 2002
+++ linux-2.2.22-rc2/drivers/isdn/isdn_ppp.c	Fri Aug 30 16:24:38 2002
@@ -678,8 +678,8 @@
  *           reports, that there is data
  */
 
-int
-isdn_ppp_read(int min, struct file *file, char *buf, int count)
+ssize_t
+isdn_ppp_read(int min, struct file *file, char *buf, size_t count)
 {
 	struct ippp_struct *is;
 	struct ippp_buf_queue *b;
@@ -721,8 +721,8 @@
  * ipppd wanna write a packet to the card .. non-blocking
  */
 
-int
-isdn_ppp_write(int min, struct file *file, const char *buf, int count)
+ssize_t
+isdn_ppp_write(int min, struct file *file, const char *buf, size_t count)
 {
 	isdn_net_local *lp;
 	struct ippp_struct *is;
@@ -757,7 +757,7 @@
 		if ((dev->drv[lp->isdn_device]->flags & DRV_FLAG_RUNNING) &&
 			lp->dialstate == 0 &&
 		    (lp->flags & ISDN_NET_CONNECTED)) {
-			unsigned short hl;
+			unsigned int hl;
 			struct sk_buff *skb;
 			/*
 			 * we need to reserve enought space in front of
@@ -765,11 +765,11 @@
 			 * 16 bytes, now we are looking what the driver want
 			 */
 			hl = dev->drv[lp->isdn_device]->interface->hl_hdrlen;
+			if (hl > INT_MAX / 2 || count > INT_MAX / 2)
+				return -EINVAL;
 			skb = alloc_skb(hl+count, GFP_ATOMIC);
-			if (!skb) {
-				printk(KERN_WARNING "isdn_ppp_write: out of memory!\n");
-				return count;
-			}
+			if (!skb)
+				return -ENOMEM;
 			skb_reserve(skb, hl);
 			if (copy_from_user(skb_put(skb, count), buf, count))
 			{
@@ -1170,7 +1170,7 @@
 #ifdef CONFIG_ISDN_PPP_VJ
 	if (proto == PPP_IP && ipts->pppcfg & SC_COMP_TCP) {	/* ipts here? probably yes, but check this again */
 		struct sk_buff *new_skb;
-	        unsigned short hl;
+	        unsigned int hl;
 		/*
 		 * we need to reserve enought space in front of
 		 * sk_buff. old call to dev_alloc_skb only reserved
diff -urN linux-2.2.22-rc1/drivers/isdn/isdn_ppp.h linux-2.2.22-rc2/drivers/isdn/isdn_ppp.h
--- linux-2.2.22-rc1/drivers/isdn/isdn_ppp.h	Mon May 20 16:32:34 2002
+++ linux-2.2.22-rc2/drivers/isdn/isdn_ppp.h	Fri Aug 30 16:24:38 2002
@@ -12,8 +12,8 @@
 #include <linux/ppp_defs.h>     /* for PPP_PROTOCOL */
 #include <linux/isdn_ppp.h>	/* for isdn_ppp info */
 
-extern int isdn_ppp_read(int, struct file *, char *, int);
-extern int isdn_ppp_write(int, struct file *, const char *, int);
+extern ssize_t isdn_ppp_read(int, struct file *, char *, size_t);
+extern ssize_t isdn_ppp_write(int, struct file *, const char *, size_t);
 extern int isdn_ppp_open(int, struct file *);
 extern int isdn_ppp_init(void);
 extern void isdn_ppp_cleanup(void);
diff -urN linux-2.2.22-rc1/drivers/isdn/pcbit/capi.c linux-2.2.22-rc2/drivers/isdn/pcbit/capi.c
--- linux-2.2.22-rc1/drivers/isdn/pcbit/capi.c	Mon May 20 16:32:35 2002
+++ linux-2.2.22-rc2/drivers/isdn/pcbit/capi.c	Fri Aug 30 16:24:38 2002
@@ -425,7 +425,7 @@
 #ifdef DEBUG
 		printk(KERN_DEBUG "CPN: Octect 3 %02x\n", skb->data[1]);
 #endif
-		if ((skb->data[1] & 0x80) == 0)
+		if (len >= 2 && (skb->data[1] & 0x80) == 0)
 			count = 2;
 		
 		if (!(info->data.setup.CallingPN = kmalloc(len - count + 1, GFP_ATOMIC)))
@@ -453,7 +453,7 @@
 	if (len > 0) {
 		int count = 1;
 		
-		if ((skb->data[1] & 0x80) == 0)
+		if (len >= 2 && (skb->data[1] & 0x80) == 0)
 			count = 2;
         
 		if (!(info->data.setup.CalledPN = kmalloc(len - count + 1, GFP_ATOMIC)))
diff -urN linux-2.2.22-rc1/drivers/net/hamradio/baycom_par.c linux-2.2.22-rc2/drivers/net/hamradio/baycom_par.c
--- linux-2.2.22-rc1/drivers/net/hamradio/baycom_par.c	Sun Mar 25 08:31:17 2001
+++ linux-2.2.22-rc2/drivers/net/hamradio/baycom_par.c	Fri Aug 30 16:24:38 2002
@@ -83,53 +83,8 @@
 
 /* --------------------------------------------------------------------- */
 
-/*
- * currently this module is supposed to support both module styles, i.e.
- * the old one present up to about 2.1.9, and the new one functioning
- * starting with 2.1.21. The reason is I have a kit allowing to compile
- * this module also under 2.0.x which was requested by several people.
- * This will go in 2.2
- */
-#include <linux/version.h>
-
-#if LINUX_VERSION_CODE >= 0x20100
 #include <asm/uaccess.h>
-#else
-#include <asm/segment.h>
-#include <linux/mm.h>
-
-#undef put_user
-#undef get_user
-
-#define put_user(x,ptr) ({ __put_user((unsigned long)(x),(ptr),sizeof(*(ptr))); 0; })
-#define get_user(x,ptr) ({ x = ((__typeof__(*(ptr)))__get_user((ptr),sizeof(*(ptr)))); 0; })
-
-extern __inline__ int copy_from_user(void *to, const void *from, unsigned long n)
-{
-        int i = verify_area(VERIFY_READ, from, n);
-        if (i)
-                return i;
-        memcpy_fromfs(to, from, n);
-        return 0;
-}
-
-extern __inline__ int copy_to_user(void *to, const void *from, unsigned long n)
-{
-        int i = verify_area(VERIFY_WRITE, to, n);
-        if (i)
-                return i;
-        memcpy_tofs(to, from, n);
-        return 0;
-}
-#endif
-
-#if LINUX_VERSION_CODE >= 0x20123
 #include <linux/init.h>
-#else
-#define __init
-#define __initdata
-#define __initfunc(x) x
-#endif
 
 /* --------------------------------------------------------------------- */
 
@@ -581,8 +536,6 @@
 static const char *mode[NR_PORTS] = { "picpar", };
 static int iobase[NR_PORTS] = { 0x378, };
 
-#if LINUX_VERSION_CODE >= 0x20115
-
 MODULE_PARM(mode, "1-" __MODULE_STRING(NR_PORTS) "s");
 MODULE_PARM_DESC(mode, "baycom operating mode; eg. par96 or picpar");
 MODULE_PARM(iobase, "1-" __MODULE_STRING(NR_PORTS) "i");
@@ -591,8 +544,6 @@
 MODULE_AUTHOR("Thomas M. Sailer, sailer@ife.ee.ethz.ch, hb9jnx@hb9w.che.eu");
 MODULE_DESCRIPTION("Baycom par96 and picpar amateur radio modem driver");
 
-#endif
-
 __initfunc(int init_module(void))
 {
 	int i;
diff -urN linux-2.2.22-rc1/drivers/net/hamradio/soundmodem/sm_sbc.c linux-2.2.22-rc2/drivers/net/hamradio/soundmodem/sm_sbc.c
--- linux-2.2.22-rc1/drivers/net/hamradio/soundmodem/sm_sbc.c	Sun Mar 25 08:31:18 2001
+++ linux-2.2.22-rc2/drivers/net/hamradio/soundmodem/sm_sbc.c	Fri Aug 30 16:24:38 2002
@@ -38,45 +38,7 @@
 
 /* --------------------------------------------------------------------- */
 
-/*
- * currently this module is supposed to support both module styles, i.e.
- * the old one present up to about 2.1.9, and the new one functioning
- * starting with 2.1.21. The reason is I have a kit allowing to compile
- * this module also under 2.0.x which was requested by several people.
- * This will go in 2.2
- */
-#include <linux/version.h>
-
-#if LINUX_VERSION_CODE >= 0x20100
 #include <asm/uaccess.h>
-#else
-#include <asm/segment.h>
-#include <linux/mm.h>
-
-#undef put_user
-#undef get_user
-
-#define put_user(x,ptr) ({ __put_user((unsigned long)(x),(ptr),sizeof(*(ptr))); 0; })
-#define get_user(x,ptr) ({ x = ((__typeof__(*(ptr)))__get_user((ptr),sizeof(*(ptr)))); 0; })
-
-extern inline int copy_from_user(void *to, const void *from, unsigned long n)
-{
-        int i = verify_area(VERIFY_READ, from, n);
-        if (i)
-                return i;
-        memcpy_fromfs(to, from, n);
-        return 0;
-}
-
-extern inline int copy_to_user(void *to, const void *from, unsigned long n)
-{
-        int i = verify_area(VERIFY_WRITE, to, n);
-        if (i)
-                return i;
-        memcpy_tofs(to, from, n);
-        return 0;
-}
-#endif
 
 /* --------------------------------------------------------------------- */
 
diff -urN linux-2.2.22-rc1/drivers/net/hamradio/soundmodem/sm_wss.c linux-2.2.22-rc2/drivers/net/hamradio/soundmodem/sm_wss.c
--- linux-2.2.22-rc1/drivers/net/hamradio/soundmodem/sm_wss.c	Fri Nov  2 08:39:07 2001
+++ linux-2.2.22-rc2/drivers/net/hamradio/soundmodem/sm_wss.c	Fri Aug 30 16:24:38 2002
@@ -52,12 +52,6 @@
 #include <asm/segment.h>
 #include <linux/mm.h>
 
-#undef put_user
-#undef get_user
-
-#define put_user(x,ptr) ({ __put_user((unsigned long)(x),(ptr),sizeof(*(ptr))); 0; })
-#define get_user(x,ptr) ({ x = ((__typeof__(*(ptr)))__get_user((ptr),sizeof(*(ptr)))); 0; })
-
 extern inline int copy_from_user(void *to, const void *from, unsigned long n)
 {
         int i = verify_area(VERIFY_READ, from, n);
diff -urN linux-2.2.22-rc1/drivers/net/hamradio/yam.c linux-2.2.22-rc2/drivers/net/hamradio/yam.c
--- linux-2.2.22-rc1/drivers/net/hamradio/yam.c	Sun Mar 25 08:31:18 2001
+++ linux-2.2.22-rc2/drivers/net/hamradio/yam.c	Fri Aug 30 16:24:38 2002
@@ -76,63 +76,8 @@
 
 /* --------------------------------------------------------------------- */
 
-/*
- * currently this module is supposed to support both module styles, i.e.
- * the old one present up to about 2.1.9, and the new one functioning
- * starting with 2.1.21. The reason is I have a kit allowing to compile
- * this module also under 2.0.x which was requested by several people.
- * This will go in 2.2
- */
-#include <linux/version.h>
-
-#if LINUX_VERSION_CODE >= 0x20100
 #include <asm/uaccess.h>
-#else
-#include <asm/segment.h>
-#include <linux/mm.h>
-
-#undef put_user
-#undef get_user
-
-#define put_user(x,ptr) ({ __put_user((unsigned long)(x),(ptr),sizeof(*(ptr))); 0; })
-#define get_user(x,ptr) ({ x = ((__typeof__(*(ptr)))__get_user((ptr),sizeof(*(ptr)))); 0; })
-
-extern inline int copy_from_user(void *to, const void *from, unsigned long n)
-{
-	int i = verify_area(VERIFY_READ, from, n);
-	if (i)
-		return i;
-	memcpy_fromfs(to, from, n);
-	return 0;
-}
-
-extern inline int copy_to_user(void *to, const void *from, unsigned long n)
-{
-	int i = verify_area(VERIFY_WRITE, to, n);
-	if (i)
-		return i;
-	memcpy_tofs(to, from, n);
-	return 0;
-}
-#endif
-
-#if LINUX_VERSION_CODE < 0x20115
-extern __inline__ void dev_init_buffers(struct device *dev)
-{
-	int i;
-	for (i = 0; i < DEV_NUMBUFFS; i++) {
-		skb_queue_head_init(&dev->buffs[i]);
-	}
-}
-#endif
-
-#if LINUX_VERSION_CODE >= 0x20123
 #include <linux/init.h>
-#else
-#define __init
-#define __initdata
-#define __initfunc(x) x
-#endif
 
 /* --------------------------------------------------------------------- */
 
@@ -178,11 +123,7 @@
 
 	/* Stats section */
 
-#if LINUX_VERSION_CODE < 0x20119
-	struct enet_statistics stats;
-#else
 	struct net_device_stats stats;
-#endif
 	int nb_rxint;
 	int nb_mdint;
 
@@ -919,13 +860,8 @@
 
 /* --------------------------------------------------------------------- */
 
-#if LINUX_VERSION_CODE >= 0x20119
 static struct net_device_stats *
  yam_get_stats(struct device *dev)
-#else
-static struct enet_statistics *
- yam_get_stats(struct device *dev)
-#endif
 {
 	struct yam_port *yp;
 
@@ -1266,13 +1202,9 @@
  * command line settable parameters
  */
 
-#if LINUX_VERSION_CODE >= 0x20115
-
 MODULE_AUTHOR("Frederic Rible F1OAT frible@teaser.fr");
 MODULE_DESCRIPTION("Yam amateur radio modem driver");
 
-#endif
-
 __initfunc(int init_module(void))
 {
 	int ret = yam_init(NULL);
diff -urN linux-2.2.22-rc1/drivers/sbus/char/openprom.c linux-2.2.22-rc2/drivers/sbus/char/openprom.c
--- linux-2.2.22-rc1/drivers/sbus/char/openprom.c	Fri Aug 30 16:24:37 2002
+++ linux-2.2.22-rc2/drivers/sbus/char/openprom.c	Fri Aug 30 16:24:38 2002
@@ -68,7 +68,7 @@
  */
 static int copyin(struct openpromio *info, struct openpromio **opp_p)
 {
-	int bufsize;
+	unsigned int bufsize;
 
 	if (!info || !opp_p)
 		return -EFAULT;
diff -urN linux-2.2.22-rc1/drivers/sbus/char/sunkbd.c linux-2.2.22-rc2/drivers/sbus/char/sunkbd.c
--- linux-2.2.22-rc1/drivers/sbus/char/sunkbd.c	Sun Mar 25 08:31:38 2001
+++ linux-2.2.22-rc2/drivers/sbus/char/sunkbd.c	Fri Aug 30 16:24:38 2002
@@ -1309,9 +1309,9 @@
 			copy_to_user_ret((Firm_event *)p, &kbd_queue [kbd_tail], 
 					 sizeof(Firm_event)-sizeof(struct timeval), -EFAULT);
 			p += sizeof(Firm_event)-sizeof(struct timeval);
-			__put_user_ret(kbd_queue[kbd_tail].time.tv_sec, (u32 *)p, -EFAULT);
+			put_user_ret(kbd_queue[kbd_tail].time.tv_sec, (u32 *)p, -EFAULT);
 			p += sizeof(u32);
-			__put_user_ret(kbd_queue[kbd_tail].time.tv_usec, (u32 *)p, -EFAULT);
+			put_user_ret(kbd_queue[kbd_tail].time.tv_usec, (u32 *)p, -EFAULT);
 			p += sizeof(u32);
 		} else
 #endif
diff -urN linux-2.2.22-rc1/drivers/sbus/char/sunmouse.c linux-2.2.22-rc2/drivers/sbus/char/sunmouse.c
--- linux-2.2.22-rc1/drivers/sbus/char/sunmouse.c	Sun Mar 25 08:31:39 2001
+++ linux-2.2.22-rc2/drivers/sbus/char/sunmouse.c	Fri Aug 30 16:24:38 2002
@@ -444,9 +444,9 @@
 						 sizeof(Firm_event)-sizeof(struct timeval),
 						 -EFAULT);
 				p += sizeof(Firm_event)-sizeof(struct timeval);
-				__put_user_ret(q->time.tv_sec, (u32 *)p, -EFAULT);
+				put_user_ret(q->time.tv_sec, (u32 *)p, -EFAULT);
 				p += sizeof(u32);
-				__put_user_ret(q->time.tv_usec, (u32 *)p, -EFAULT);
+				put_user_ret(q->time.tv_usec, (u32 *)p, -EFAULT);
 				p += sizeof(u32);
 			} else
 #endif	
diff -urN linux-2.2.22-rc1/drivers/scsi/ips.h linux-2.2.22-rc2/drivers/scsi/ips.h
--- linux-2.2.22-rc1/drivers/scsi/ips.h	Sun Mar 25 08:31:34 2001
+++ linux-2.2.22-rc2/drivers/scsi/ips.h	Fri Aug 30 16:24:38 2002
@@ -105,10 +105,6 @@
       #define PUT_USER                 put_user
    #endif
 
-   #ifndef __PUT_USER
-      #define __PUT_USER               __put_user
-   #endif
-
    #ifndef PUT_USER_RET
       #define PUT_USER_RET             put_user_ret
    #endif
diff -urN linux-2.2.22-rc1/drivers/usb/ov511.c linux-2.2.22-rc2/drivers/usb/ov511.c
--- linux-2.2.22-rc1/drivers/usb/ov511.c	Mon May 20 16:32:35 2002
+++ linux-2.2.22-rc2/drivers/usb/ov511.c	Fri Aug 30 16:24:38 2002
@@ -54,8 +54,8 @@
 /*
  * Version Information
  */
-#define DRIVER_VERSION "v1.28"
-#define DRIVER_AUTHOR "Mark McClelland <mwm@i.am> & Bret Wallach & Orion Sky Lawlor <olawlor@acm.org> & Kevin Moore & Charl P. Botha <cpbotha@ieee.org> & Claudio Matsuoka <claudio@conectiva.com>"
+#define DRIVER_VERSION "v1.28a for Linux 2.2"
+#define DRIVER_AUTHOR "Mark McClelland <mark@alpha.dyndns.org> & Bret Wallach & Orion Sky Lawlor <olawlor@acm.org> & Kevin Moore & Charl P. Botha <cpbotha@ieee.org> & Claudio Matsuoka <claudio@conectiva.com>"
 #define DRIVER_DESC "OV511 USB Camera Driver"
 
 #define OV511_I2C_RETRIES 3
@@ -99,9 +99,6 @@
  * programs that expect RGB data (e.g. gqcam) to work with this driver. */
 static int force_rgb = 0;
 
-/* Number of seconds before inactive buffers are deallocated */
-static int buf_timeout = 5;
-
 /* Number of cameras to stream from simultaneously */
 static int cams = 1;
 
@@ -138,8 +135,6 @@
 MODULE_PARM_DESC(aperture, "Read the OV7610/7620 specs");
 MODULE_PARM(force_rgb, "i");
 MODULE_PARM_DESC(force_rgb, "Read RGB instead of BGR");
-MODULE_PARM(buf_timeout, "i");
-MODULE_PARM_DESC(buf_timeout, "Number of seconds before buffer deallocation");
 MODULE_PARM(cams, "i");
 MODULE_PARM_DESC(cams, "Number of simultaneous cameras");
 MODULE_PARM(retry_sync, "i");
@@ -2037,11 +2032,6 @@
 	PDEBUG(4, "entered");
 	down(&ov511->buf_lock);
 
-	if (ov511->buf_state == BUF_PEND_DEALLOC) {
-		ov511->buf_state = BUF_ALLOCATED;
-		del_timer(&ov511->buf_timer);
-	}
-
 	if (ov511->buf_state == BUF_ALLOCATED)
 		goto out;
 
@@ -2106,42 +2096,11 @@
 	PDEBUG(4, "leaving");
 }
 
-static void ov511_buf_callback(unsigned long data)
-{
-	struct usb_ov511 *ov511 = (struct usb_ov511 *)data;
-	PDEBUG(4, "entered");
-	down(&ov511->buf_lock);
-
-	if (ov511->buf_state == BUF_PEND_DEALLOC)
-		ov511_do_dealloc(ov511);
-
-	up(&ov511->buf_lock);
-	PDEBUG(4, "leaving");
-}
-
-static void ov511_dealloc(struct usb_ov511 *ov511, int now)
+static void ov511_dealloc(struct usb_ov511 *ov511)
 {
-	struct timer_list *bt = &(ov511->buf_timer);
 	PDEBUG(4, "entered");
 	down(&ov511->buf_lock);
-
-	PDEBUG(4, "deallocating buffer memory %s", now ? "now" : "later");
-
-	if (ov511->buf_state == BUF_PEND_DEALLOC) {
-		ov511->buf_state = BUF_ALLOCATED;
-		del_timer(bt);
-	}
-
-	if (now)
-		ov511_do_dealloc(ov511);
-	else {
-		ov511->buf_state = BUF_PEND_DEALLOC;
-		init_timer(bt);
-		bt->function = ov511_buf_callback;
-		bt->data = (unsigned long)ov511;
-		bt->expires = jiffies + buf_timeout * HZ;
-		add_timer(bt);
-	}
+	ov511_do_dealloc(ov511);
 	up(&ov511->buf_lock);
 	PDEBUG(4, "leaving");
 }
@@ -2173,7 +2132,7 @@
 
 	err = ov511_init_isoc(ov511);
 	if (err) {
-		ov511_dealloc(ov511, 0);
+		ov511_dealloc(ov511);
 		goto out;
 	}
 
@@ -2200,12 +2159,12 @@
 	ov511_stop_isoc(ov511);
 
 	if (ov511->dev)
-		ov511_dealloc(ov511, 0);
+		ov511_dealloc(ov511);
 
 	up(&ov511->lock);
 
 	if (!ov511->dev) {
-		ov511_dealloc(ov511, 1);
+		ov511_dealloc(ov511);
 		video_unregister_device(&ov511->vdev);
 		kfree(ov511);
 		ov511 = NULL;
@@ -3410,7 +3369,7 @@
 
 	/* Free the memory */
 	if (ov511 && !ov511->user) {
-		ov511_dealloc(ov511, 1);
+		ov511_dealloc(ov511);
 		kfree(ov511);
 		ov511 = NULL;
 	}
diff -urN linux-2.2.22-rc1/drivers/usb/ov511.h linux-2.2.22-rc2/drivers/usb/ov511.h
--- linux-2.2.22-rc1/drivers/usb/ov511.h	Sun Mar 25 08:31:42 2001
+++ linux-2.2.22-rc2/drivers/usb/ov511.h	Fri Aug 30 16:24:38 2002
@@ -219,7 +219,6 @@
 enum {
 	BUF_NOT_ALLOCATED,
 	BUF_ALLOCATED,
-	BUF_PEND_DEALLOC,	/* ov511->buf_timer is set */
 };
 
 struct usb_device;
@@ -341,7 +340,6 @@
 	/* Framebuffer/sbuf management */
 	int buf_state;
 	struct semaphore buf_lock;
-	struct timer_list buf_timer;
 };
 
 struct cam_list {
diff -urN linux-2.2.22-rc1/drivers/video/cgfourteenfb.c linux-2.2.22-rc2/drivers/video/cgfourteenfb.c
--- linux-2.2.22-rc1/drivers/video/cgfourteenfb.c	Fri Nov  2 08:39:08 2001
+++ linux-2.2.22-rc2/drivers/video/cgfourteenfb.c	Fri Aug 30 16:24:38 2002
@@ -283,11 +283,11 @@
 	case MDI_GET_CFGINFO:
 		mdii = (struct mdi_cfginfo *)arg;
 		put_user_ret(FBTYPE_MDICOLOR, &mdii->mdi_type, -EFAULT);
-		__put_user_ret(fb->type.fb_height, &mdii->mdi_height, -EFAULT);
-		__put_user_ret(fb->type.fb_width, &mdii->mdi_width, -EFAULT);
-		__put_user_ret(fb->s.cg14.mode, &mdii->mdi_mode, -EFAULT);
-		__put_user_ret(72, &mdii->mdi_pixfreq, -EFAULT); /* FIXME */
-		__put_user_ret(fb->s.cg14.ramsize, &mdii->mdi_size, -EFAULT);
+		put_user_ret(fb->type.fb_height, &mdii->mdi_height, -EFAULT);
+		put_user_ret(fb->type.fb_width, &mdii->mdi_width, -EFAULT);
+		put_user_ret(fb->s.cg14.mode, &mdii->mdi_mode, -EFAULT);
+		put_user_ret(72, &mdii->mdi_pixfreq, -EFAULT); /* FIXME */
+		put_user_ret(fb->s.cg14.ramsize, &mdii->mdi_size, -EFAULT);
 		break;
 	case MDI_SET_PIXELMODE:
 		get_user_ret(mode, (int *)arg, -EFAULT);
diff -urN linux-2.2.22-rc1/fs/dcache.c linux-2.2.22-rc2/fs/dcache.c
--- linux-2.2.22-rc1/fs/dcache.c	Fri Aug 30 16:24:37 2002
+++ linux-2.2.22-rc2/fs/dcache.c	Fri Aug 30 16:24:38 2002
@@ -764,12 +764,15 @@
 /*
  * "buflen" should be PAGE_SIZE or more.
  */
-char * d_path(struct dentry *dentry, char *buffer, int buflen)
+static char * d_path_error(struct dentry *dentry,
+			   char *buffer, int buflen, int *error)
 {
 	char * end = buffer+buflen;
 	char * retval;
 	struct dentry * root = current->fs->root;
 
+	*error = 0;
+
 	*--end = '\0';
 	buflen--;
 	if (dentry->d_parent != dentry && list_empty(&dentry->d_hash)) {
@@ -794,8 +797,10 @@
 			break;
 		namelen = dentry->d_name.len;
 		buflen -= namelen + 1;
-		if (buflen < 0)
+		if (buflen < 0) {
+			*error = -ENAMETOOLONG;
 			break;
+		}
 		end -= namelen;
 		memcpy(end, dentry->d_name.name, namelen);
 		*--end = '/';
@@ -805,6 +810,13 @@
 	return retval;
 }
 
+char * d_path(struct dentry *dentry, char *buffer, int buflen)
+{
+	int error;
+
+	return d_path_error(dentry, buffer, buflen, &error);
+}
+
 /*
  * NOTE! The user-level library version returns a
  * character pointer. The kernel system call just
@@ -835,14 +847,17 @@
 		error = -ENOMEM;
 		if (page) {
 			unsigned long len;
-			char * cwd = d_path(pwd, page, PAGE_SIZE);
+			char * cwd;
 
-			error = -ERANGE;
-			len = PAGE_SIZE + page - cwd;
-			if (len <= size) {
-				error = len;
-				if (copy_to_user(buf, cwd, len))
-					error = -EFAULT;
+			cwd = d_path_error(pwd, page, PAGE_SIZE, &error);
+			if (!error) {
+				error = -ERANGE;
+				len = PAGE_SIZE + page - cwd;
+				if (len <= size) {
+					error = len;
+					if (copy_to_user(buf, cwd, len))
+						error = -EFAULT;
+				}
 			}
 			free_page((unsigned long) page);
 		}
diff -urN linux-2.2.22-rc1/fs/fat/misc.c linux-2.2.22-rc2/fs/fat/misc.c
--- linux-2.2.22-rc1/fs/fat/misc.c	Mon May 20 16:32:35 2002
+++ linux-2.2.22-rc2/fs/fat/misc.c	Fri Aug 30 16:24:38 2002
@@ -554,7 +554,8 @@
 int fat_parent_ino(struct inode *dir,int locked)
 {
 	static int zero = 0;
-	int error,curr,prev,nr;
+	int error,curr,prev;
+	loff_t nr;
 
 	PRINTK(("fat_parent_ino: Debug 0\n"));
 	if (!S_ISDIR(dir->i_mode)) panic("Non-directory fed to m_p_i");
@@ -585,7 +586,7 @@
 			if (!locked) fat_unlock_creation();
 			return error;
 		}
-		PRINTK(("fat_parent_ino: Debug 6 nr=%d\n", nr));
+		PRINTK(("fat_parent_ino: Debug 6 nr=%ld\n", (long)nr));
 	}
 	if (!locked) fat_unlock_creation();
 	return nr;
diff -urN linux-2.2.22-rc1/fs/isofs/inode.c linux-2.2.22-rc2/fs/isofs/inode.c
--- linux-2.2.22-rc1/fs/isofs/inode.c	Sun Mar 25 08:37:38 2001
+++ linux-2.2.22-rc2/fs/isofs/inode.c	Fri Aug 30 16:24:38 2002
@@ -430,10 +430,11 @@
       /* If a minor device was explicitly opened, set session to the
        * minor number. For instance, if /dev/hdc1 is mounted, session
        * 1 on the CD-ROM is selected. CD_PART_MAX gives access to
-       * a max of 64 sessions on IDE. SCSI drives must still use
-       * the session option to mount.
+       * a max of 64 sessions on IDE. For SCSI drives or loop devices
+       * you must still use the session option to mount.
        */
-      if ((MINOR(dev) % CD_PART_MAX) && (MAJOR(dev) != SCSI_CDROM_MAJOR))
+      if ((MINOR(dev) % CD_PART_MAX) && (MAJOR(dev) != SCSI_CDROM_MAJOR)
+					&& (MAJOR(dev) != LOOP_MAJOR))
 		session = MINOR(dev) % CD_PART_MAX;
       if (session > 0 && session <= CD_PART_MAX) {
 		struct cdrom_tocentry entry;
diff -urN linux-2.2.22-rc1/fs/proc/openpromfs.c linux-2.2.22-rc2/fs/proc/openpromfs.c
--- linux-2.2.22-rc1/fs/proc/openpromfs.c	Sun Mar 25 08:30:58 2001
+++ linux-2.2.22-rc2/fs/proc/openpromfs.c	Fri Aug 30 16:24:38 2002
@@ -67,7 +67,7 @@
 {
 	struct inode *inode = file->f_dentry->d_inode;
 	char buffer[10];
-	
+
 	if (count < 0 || !inode->u.generic_ip)
 		return -EINVAL;
 	sprintf (buffer, "%8.8x\n", (u32)(long)(inode->u.generic_ip));
@@ -75,7 +75,7 @@
 		return 0;
 	if (count > 9 - file->f_pos)
 		count = 9 - file->f_pos;
-	copy_to_user(buf, buffer + file->f_pos, count);
+	copy_to_user_ret(buf, buffer + file->f_pos, count, -EFAULT);
 	file->f_pos += count;
 	return count;
 }
@@ -90,8 +90,8 @@
 	u32 *q;
 	openprom_property *op;
 	char buffer[64];
-	
-	if (filp->f_pos >= 0xffffff)
+
+	if (filp->f_pos >= 0xffffff || count >= 0xffffff)
 		return -EINVAL;
 	if (!filp->private_data) {
 		node = nodes[(u16)((long)inode->u.generic_ip)].node;
@@ -182,7 +182,7 @@
 	if (count > i - k) count = i - k;
 	if (op->flag & OPP_STRING) {
 		if (!k) {
-			__put_user('\'', buf);
+			put_user_ret('\'', buf, -EFAULT);
 			k++;
 			count--;
 		}
@@ -193,16 +193,16 @@
 			j = count;
 
 		if (j >= 0) {
-			copy_to_user(buf + k - filp->f_pos,
-				     op->value + k - 1, j);
+			copy_to_user_ret(buf + k - filp->f_pos,
+					 op->value + k - 1, j, -EFAULT);
 			count -= j;
 			k += j;
 		}
 
 		if (count)
-			__put_user('\'', &buf [k++ - filp->f_pos]);
+			put_user_ret('\'', &buf [k++ - filp->f_pos], -EFAULT);
 		if (count > 1)
-			__put_user('\n', &buf [k++ - filp->f_pos]);
+			put_user_ret('\n', &buf [k++ - filp->f_pos], -EFAULT);
 
 	} else if (op->flag & OPP_STRINGLIST) {
 		char *tmp;
@@ -223,7 +223,7 @@
 		}
 		strcpy(s, "'\n");
 
-		copy_to_user(buf, tmp + k, count);
+		copy_to_user_ret(buf, tmp + k, count, -EFAULT);
 
 		kfree(tmp);
 		k += count;
@@ -241,53 +241,63 @@
 
 		if (first == last) {
 			sprintf (buffer, "%08x.", *first);
-			copy_to_user (buf, buffer + first_off, last_cnt - first_off);
+			copy_to_user_ret (buf, buffer + first_off,
+				last_cnt - first_off, -EFAULT);
 			buf += last_cnt - first_off;
 		} else {		
 			for (q = first; q <= last; q++) {
 				sprintf (buffer, "%08x.", *q);
 				if (q == first) {
-					copy_to_user (buf, buffer + first_off,
-						      9 - first_off);
+					copy_to_user_ret (buf,
+						buffer + first_off,
+						9 - first_off, -EFAULT);
 					buf += 9 - first_off;
 				} else if (q == last) {
-					copy_to_user (buf, buffer, last_cnt);
+					copy_to_user_ret (buf, buffer,
+						last_cnt, -EFAULT);
 					buf += last_cnt;
 				} else {
-					copy_to_user (buf, buffer, 9);
+					copy_to_user_ret (buf, buffer,
+						9, -EFAULT);
 					buf += 9;
 				}
 			}
 		}
 
 		if (last == (u32 *)(op->value + op->len - 4) && last_cnt == 9)
-			__put_user('\n', (buf - 1));
+			put_user_ret('\n', (buf - 1), -EFAULT);
 
 		k += count;
 
 	} else if (op->flag & OPP_HEXSTRING) {
-		char buffer[2];
+		char buffer[3];
 
 		if ((k < i - 1) && (k & 1)) {
-			sprintf (buffer, "%02x", *(op->value + (k >> 1)));
-			__put_user(buffer[1], &buf[k++ - filp->f_pos]);
+			sprintf (buffer, "%02x",
+				(unsigned char)*(op->value + (k >> 1)) & 0xff);
+			put_user_ret(buffer[1], &buf[k++ - filp->f_pos],
+				-EFAULT);
 			count--;
 		}
 
 		for (; (count > 1) && (k < i - 1); k += 2) {
-			sprintf (buffer, "%02x", *(op->value + (k >> 1)));
-			copy_to_user (buf + k - filp->f_pos, buffer, 2);
+			sprintf (buffer, "%02x",
+				(unsigned char)*(op->value + (k >> 1)) & 0xff);
+			copy_to_user_ret (buf + k - filp->f_pos, buffer, 2,
+				-EFAULT);
 			count -= 2;
 		}
 
 		if (count && (k < i - 1)) {
-			sprintf (buffer, "%02x", *(op->value + (k >> 1)));
-			__put_user(buffer[0], &buf[k++ - filp->f_pos]);
+			sprintf (buffer, "%02x",
+				(unsigned char)*(op->value + (k >> 1)) & 0xff);
+			put_user_ret(buffer[0], &buf[k++ - filp->f_pos],
+				-EFAULT);
 			count--;
 		}
 
 		if (count)
-			__put_user('\n', &buf [k++ - filp->f_pos]);
+			put_user_ret('\n', &buf [k++ - filp->f_pos], -EFAULT);
 	}
 	count = k - filp->f_pos;
 	filp->f_pos = k;
@@ -302,8 +312,8 @@
 	u32 *q;
 	void *b;
 	openprom_property *op;
-	
-	if (filp->f_pos >= 0xffffff)
+
+	if (filp->f_pos >= 0xffffff || count >= 0xffffff)
 		return -EINVAL;
 	if (!filp->private_data) {
 		i = property_read (filp, NULL, 0, 0);
@@ -324,7 +334,7 @@
 			if (j == 9) j = 0;
 			if (!j) {
 				char ctmp;
-				__get_user(ctmp, &buf[i]);
+				get_user_ret(ctmp, &buf[i], -EFAULT);
 				if (ctmp != '.') {
 					if (ctmp != '\n') {
 						if (op->flag & OPP_BINARY)
@@ -339,7 +349,7 @@
 				}
 			} else {
 				char ctmp;
-				__get_user(ctmp, &buf[i]);
+				get_user_ret(ctmp, &buf[i], -EFAULT);
 				if (ctmp < '0' || 
 				    (ctmp > '9' && ctmp < 'A') ||
 				    (ctmp > 'F' && ctmp < 'a') ||
@@ -377,8 +387,9 @@
 		last_cnt = (k + count) % 9;
 		if (first + 1 == last) {
 			memset (tmp, '0', 8);
-			copy_from_user (tmp + first_off, buf,
-					(count + first_off > 8) ? 8 - first_off : count);
+			copy_from_user_ret (tmp + first_off, buf,
+				(count + first_off > 8) ? 8 - first_off : count,
+				-EFAULT);
 			mask = 0xffffffff;
 			mask2 = 0xffffffff;
 			for (j = 0; j < first_off; j++)
@@ -397,8 +408,9 @@
 				if (q == first) {
 					if (first_off < 8) {
 						memset (tmp, '0', 8);
-						copy_from_user (tmp + first_off, buf,
-								8 - first_off);
+						copy_from_user_ret (
+							tmp + first_off, buf,
+							8 - first_off, -EFAULT);
 						mask = 0xffffffff;
 						for (j = 0; j < first_off; j++)
 							mask >>= 1;
@@ -409,7 +421,8 @@
 				} else if ((q == last - 1) && last_cnt
 					   && (last_cnt < 8)) {
 					memset (tmp, '0', 8);
-					copy_from_user (tmp, buf, last_cnt);
+					copy_from_user_ret (tmp, buf, last_cnt,
+						-EFAULT);
 					mask = 0xffffffff;
 					for (j = 0; j < 8 - last_cnt; j++)
 						mask <<= 1;
@@ -419,7 +432,8 @@
 				} else {
 					char tchars[17]; /* XXX yuck... */
 
-					copy_from_user(tchars, buf, 16);
+					copy_from_user_ret(tchars, buf, 16,
+						-EFAULT);
 					*q = simple_strtoul (tchars, 0, 16);
 					buf += 9;
 				}
@@ -442,7 +456,7 @@
 			 */
 			if (k > 0)
 				return -EINVAL;
-			__get_user(ctmp, buf);
+			get_user_ret(ctmp, buf, -EFAULT);
 			if (ctmp == '\'') {
 				op->flag |= OPP_QUOTED;
 				buf++;
@@ -474,7 +488,7 @@
 			kfree (b);
 		}
 		p = op->value + filp->f_pos - ((op->flag & OPP_QUOTED) ? 1 : 0);
-		copy_from_user (p, buf, count);
+		copy_from_user_ret (p, buf, count, -EFAULT);
 		op->flag |= OPP_DIRTY;
 		for (i = 0; i < count; i++, p++)
 			if (*p == '\n') {
diff -urN linux-2.2.22-rc1/net/core/skbuff.c linux-2.2.22-rc2/net/core/skbuff.c
--- linux-2.2.22-rc1/net/core/skbuff.c	Sun Mar 25 08:31:12 2001
+++ linux-2.2.22-rc2/net/core/skbuff.c	Fri Aug 30 16:24:38 2002
@@ -136,6 +136,8 @@
 		goto nohead;
 
 	/* Get the DATA. Size must match skb_add_mtu(). */
+	if (size > 131072 - 32)
+		goto nodata;
 	size = ((size + 15) & ~15); 
 	data = kmalloc(size + sizeof(atomic_t), gfp_mask);
 	if (data == NULL)
diff -urN linux-2.2.22-rc1/net/ipv4/ip_masq.c linux-2.2.22-rc2/net/ipv4/ip_masq.c
--- linux-2.2.22-rc1/net/ipv4/ip_masq.c	Sun Mar 25 08:37:41 2001
+++ linux-2.2.22-rc2/net/ipv4/ip_masq.c	Fri Aug 30 16:24:38 2002
@@ -2450,7 +2450,7 @@
 	struct ip_masq_ctl masq_ctl;
 	int ret = -EINVAL;
 
-	if(optlen>sizeof(masq_ctl))
+	if(optlen < 0 || optlen > sizeof(masq_ctl))
 		return -EINVAL;
 
 	if(copy_from_user(&masq_ctl,optval,optlen))
diff -urN linux-2.2.22-rc1/net/ipv4/route.c linux-2.2.22-rc2/net/ipv4/route.c
--- linux-2.2.22-rc1/net/ipv4/route.c	Fri Nov  2 08:39:16 2001
+++ linux-2.2.22-rc2/net/ipv4/route.c	Fri Aug 30 16:24:38 2002
@@ -1998,15 +1998,23 @@
 static int ip_rt_acct_read(char *buffer, char **start, off_t offset,
 			   int length, int *eof, void *data)
 {
-	*start=buffer;
+	*start = buffer;
 
-	if (offset + length > sizeof(ip_rt_acct)) {
+	if (offset < 0 || length < 0)
+		return 0;
+
+	if (offset >= sizeof(ip_rt_acct) || length >= sizeof(ip_rt_acct)) {
+		*eof = 1;
+		return 0;
+	}
+
+	if (offset + length >= sizeof(ip_rt_acct)) {
 		length = sizeof(ip_rt_acct) - offset;
 		*eof = 1;
 	}
 	if (length > 0) {
 		start_bh_atomic();
-		memcpy(buffer, ((u8*)&ip_rt_acct)+offset, length);
+		memcpy(buffer, ((u8*)&ip_rt_acct) + offset, length);
 		end_bh_atomic();
 		return length;
 	}
diff -urN linux-2.2.22-rc1/net/ipv4/tcp.c linux-2.2.22-rc2/net/ipv4/tcp.c
--- linux-2.2.22-rc1/net/ipv4/tcp.c	Fri Nov  2 08:39:16 2001
+++ linux-2.2.22-rc2/net/ipv4/tcp.c	Fri Aug 30 16:24:38 2002
@@ -940,6 +940,7 @@
 				if (!err) 
 					tcp_push_pending_frames(sk, tp);
 				wait_for_tcp_memory(sk, err);
+				err = 0;
 
 				/* If SACK's were formed or PMTU events happened,
 				 * we must find out about it.
diff -urN linux-2.2.22-rc1/net/ipv4/tcp_input.c linux-2.2.22-rc2/net/ipv4/tcp_input.c
--- linux-2.2.22-rc1/net/ipv4/tcp_input.c	Fri Nov  2 08:39:16 2001
+++ linux-2.2.22-rc2/net/ipv4/tcp_input.c	Fri Aug 30 16:24:38 2002
@@ -296,7 +296,7 @@
 	}
 	sk->shutdown = SHUTDOWN_MASK;
 	if (!sk->dead) 
-		sk->state_change(sk);
+		sk->error_report(sk);
 }
 
 /* This tags the retransmission queue when SACKs arrive. */
diff -urN linux-2.2.22-rc1/net/socket.c linux-2.2.22-rc2/net/socket.c
--- linux-2.2.22-rc1/net/socket.c	Sun Mar 25 08:37:41 2001
+++ linux-2.2.22-rc2/net/socket.c	Fri Aug 30 16:24:38 2002
@@ -1073,11 +1073,19 @@
 asmlinkage int sys_getsockopt(int fd, int level, int optname, char *optval, int *optlen)
 {
 	int err;
+	int len;
 	struct socket *sock;
 
 	lock_kernel();
 	if ((sock = sockfd_lookup(fd, &err))!=NULL)
 	{
+		/* XXX: insufficient for SMP, but should be redundant anyway */
+		if (get_user(len, optlen))
+			err = -EFAULT;
+		else
+		if (len < 0)
+			err = -EINVAL;
+		else
 		if (level == SOL_SOCKET)
 			err=sock_getsockopt(sock,level,optname,optval,optlen);
 		else
diff -urN linux-2.2.22-rc1/net/unix/af_unix.c linux-2.2.22-rc2/net/unix/af_unix.c
--- linux-2.2.22-rc1/net/unix/af_unix.c	Mon May 20 16:32:35 2002
+++ linux-2.2.22-rc2/net/unix/af_unix.c	Fri Aug 30 16:24:38 2002
@@ -540,6 +540,8 @@
 			return NULL;
 		}
 		u=unix_find_socket_byinode(dentry->d_inode);
+		if (u && u->type == type)
+			UPDATE_ATIME(dentry->d_inode);
 		dput(dentry);
 		if (u && u->type != type)
 		{
@@ -549,7 +551,16 @@
 		}
 	}
 	else
+	{
 		u=unix_find_socket_byname(sunname, len, type, hash);
+		if (u)
+		{
+			struct dentry *dentry;
+			dentry = u->protinfo.af_unix.dentry;
+			if (dentry)
+				UPDATE_ATIME(dentry->d_inode);
+		}
+	}
 
 	if (u==NULL)
 	{
