diff -u --new-file --recursive linux.vanilla/Documentation/Configure.help linux/Documentation/Configure.help
--- linux.vanilla/Documentation/Configure.help	Mon Sep 16 09:26:11 2002
+++ linux/Documentation/Configure.help	Fri Nov 29 10:05:55 2002
@@ -11678,12 +11678,13 @@
   joystick or gamepad connected to it. For more information on how to
   use the driver please read Documentation/joystick.txt
 
-Trident 4DWave and Aureal Vortex gameport
+Trident 4DWave/Aureal Vortex/ALi 5451 gameport
 CONFIG_JOY_PCI
   Say Y here if you have a Trident 4DWave DX/NX or Aureal Vortex 1/2
-  card and want to use its gameport in its enhanced digital mode
-  with and ordinary analog joystick. For more information on how to
-  use the driver please read Documentation/joystick.txt
+  card or an ALi 5451 chip on your motherboard and want to use its
+  gameport in its enhanced digital mode with an ordinary analog
+  joystick. For more information on how to use the driver please read
+  Documentation/joystick.txt
 
 Magellan and Space Mouse
 CONFIG_JOY_MAGELLAN
diff -u --new-file --recursive linux.vanilla/Makefile linux/Makefile
--- linux.vanilla/Makefile	Mon Sep 16 09:26:11 2002
+++ linux/Makefile	Fri Nov 29 10:06:15 2002
@@ -1,6 +1,6 @@
 VERSION = 2
 PATCHLEVEL = 2
-SUBLEVEL = 22
+SUBLEVEL = 23
 EXTRAVERSION = 
 
 ARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ -e s/arm.*/arm/ -e s/sa110/arm/)
diff -u --new-file --recursive linux.vanilla/arch/i386/kernel/apm.c linux/arch/i386/kernel/apm.c
--- linux.vanilla/arch/i386/kernel/apm.c	Mon Sep 16 09:26:11 2002
+++ linux/arch/i386/kernel/apm.c	Fri Nov 29 10:05:43 2002
@@ -1072,7 +1072,7 @@
 	as = fp->private_data;
 	if (check_apm_user(as, "read"))
 		return -EIO;
-	if ((int)count < sizeof(apm_event_t))
+	if (count < sizeof(apm_event_t) || count > INT_MAX)
 		return -EINVAL;
 	if (queue_empty(as)) {
 		if (fp->f_flags & O_NONBLOCK)
diff -u --new-file --recursive linux.vanilla/arch/i386/kernel/dmi_scan.c linux/arch/i386/kernel/dmi_scan.c
--- linux.vanilla/arch/i386/kernel/dmi_scan.c	Sun Mar 25 08:37:29 2001
+++ linux/arch/i386/kernel/dmi_scan.c	Fri Nov 29 10:05:43 2002
@@ -15,9 +15,11 @@
 static char * __init dmi_string(struct dmi_header *dm, u8 s)
 {
 	u8 *bp=(u8 *)dm;
+	if(!s)
+		return "";
 	bp+=dm->length;
 	s--;
-	while(s>0)
+	while(s>0 && *bp)
 	{
 		bp+=strlen(bp);
 		bp++;
@@ -31,24 +33,26 @@
 	u8 *buf;
 	struct dmi_header *dm;
 	u8 *data;
-	int i=1;
-	int last = 0;		
+	int i=0;
 		
 	buf = ioremap(base, len);
 	if(buf==NULL)
 		return -1;
 
 	data = buf;
-	while(i<num && (data-buf) < len)
+	while(i<num && data-buf+sizeof(struct dmi_header)<=len)
 	{
 		dm=(struct dmi_header *)data;
-		if(dm->type < last)
-			break;
-		last = dm->type;
-		decode(dm);		
+		/*
+		 *  We want to know the total length (formated area and strings)
+		 *  before decoding to make sure we won't run off the table in
+		 *  dmi_decode or dmi_string
+		 */
 		data+=dm->length;
-		while(*data || data[1])
+		while(data-buf<len-1 && (data[0] || data[1]))
 			data++;
+		if(data-buf<len-1)
+			decode(dm);
 		data+=2;
 		i++;
 	}
@@ -57,33 +61,48 @@
 }
 
 
+inline int __init dmi_checksum(u8 *buf)
+{
+	u8 sum=0;
+	int a;
+	
+	for(a=0; a<15; a++)
+		sum+=buf[a];
+	return (sum==0);
+}
+
 int __init dmi_iterate(void (*decode)(struct dmi_header *))
 {
-	unsigned char buf[20];
-	long fp=0xE0000L;
-	fp -= 16;
+	u8 buf[15];
+	u32 fp=0xF0000;
 	
 	while( fp < 0xFFFFF)
 	{
-		fp+=16;
-		memcpy_fromio(buf, fp, 20);
-		if(memcmp(buf, "_DMI_", 5)==0)
+		memcpy_fromio(buf, fp, 15);
+		if(memcmp(buf, "_DMI_", 5)==0 && dmi_checksum(buf))
 		{
 			u16 num=buf[13]<<8|buf[12];
 			u16 len=buf[7]<<8|buf[6];
 			u32 base=buf[11]<<24|buf[10]<<16|buf[9]<<8|buf[8];
 #ifdef DUMP_DMI
-			printk(KERN_INFO "DMI %d.%d present.\n",
-				buf[14]>>4, buf[14]&0x0F);
+			/*
+			 * DMI version 0.0 means that the real version is taken from
+			 * the SMBIOS version, which we don't know at this point.
+			 */
+			if(buf[14]!=0)
+				printk(KERN_INFO "DMI %u.%u present.\n",
+					buf[14]>>4, buf[14]&0x0F);
+			else
+				printk(KERN_INFO "DMI present.\n");
 			printk(KERN_INFO "%d structures occupying %d bytes.\n",
-				buf[13]<<8|buf[12],
-				buf[7]<<8|buf[6]);
+				num, len);
 			printk(KERN_INFO "DMI table at 0x%08X.\n",
-				buf[11]<<24|buf[10]<<16|buf[9]<<8|buf[8]);
+				base);
 #endif				
 			if(dmi_table(base,len, num, decode)==0)
 				return 0;
 		}
+		fp+=16;
 	}
 	return -1;
 }
@@ -98,21 +117,17 @@
 static void __init dmi_decode(struct dmi_header *dm)
 {
 	u8 *data = (u8 *)dm;
-	char *p;
 	
 	switch(dm->type)
 	{
 		case  0:		
 #ifdef DUMP_DMI
-			p=dmi_string(dm,data[4]);
-			if(*p && *p!=' ')
-			{
-				printk("BIOS Vendor: %s\n", p);
-				printk("BIOS Version: %s\n", 
-					dmi_string(dm, data[5]));
-				printk("BIOS Release: %s\n",
-					dmi_string(dm, data[8]));
-			}
+			printk("BIOS Vendor: %s\n",
+				dmi_string(dm, data[4]));
+			printk("BIOS Version: %s\n", 
+				dmi_string(dm, data[5]));
+			printk("BIOS Release: %s\n",
+				dmi_string(dm, data[8]));
 #endif				
 			/*
 			 *  Check for clue free BIOS implementations who use
@@ -142,35 +157,22 @@
 			break;
 #ifdef DUMP_DMI
 		case 1:
-			p=dmi_string(dm,data[4]);
-
-			if(*p && *p!=' ')
-			{
-				printk("System Vendor: %s.\n",p);
-				printk("Product Name: %s.\n",
-					dmi_string(dm, data[5]));
-				printk("Version %s.\n",
-					dmi_string(dm, data[6]));
-				printk("Serial Number %s.\n",
-					dmi_string(dm, data[7]));
-			}
+			printk("System Vendor: %s\n",
+				dmi_string(dm, data[4]));
+			printk("Product Name: %s\n",
+				dmi_string(dm, data[5]));
+			printk("Version: %s\n",
+				dmi_string(dm, data[6]));
+			printk("Serial Number: %s\n",
+				dmi_string(dm, data[7]));
 			break;
 		case 2:
-			p=dmi_string(dm,data[4]);
-
-			if(*p && *p!=' ')
-			{
-				printk("Board Vendor: %s.\n",p);
-				printk("Board Name: %s.\n",
+			printk("Board Vendor: %s\n",
+				dmi_string(dm, data[4]));
+			printk("Board Name: %s\n",
 				dmi_string(dm, data[5]));
-				printk("Board Version: %s.\n",
-					dmi_string(dm, data[6]));
-			}
-			break;
-		case 3:
-			p=dmi_string(dm,data[8]);
-			if(*p && *p!=' ')
-				printk("Asset Tag: %s.\n", p);
+			printk("Board Version: %s\n",
+				dmi_string(dm, data[6]));
 			break;
 #endif			
 	}
diff -u --new-file --recursive linux.vanilla/arch/i386/kernel/entry.S linux/arch/i386/kernel/entry.S
--- linux.vanilla/arch/i386/kernel/entry.S	Mon May 20 16:32:34 2002
+++ linux/arch/i386/kernel/entry.S	Fri Nov 29 10:05:43 2002
@@ -63,7 +63,9 @@
 OLDSS		= 0x38
 
 CF_MASK		= 0x00000001
+TF_MASK		= 0x00000100
 IF_MASK		= 0x00000200
+DF_MASK		= 0x00000400
 NT_MASK		= 0x00004000
 VM_MASK		= 0x00020000
 
@@ -139,6 +141,9 @@
 	movl CS(%esp),%edx	# this is eip..
 	movl EFLAGS(%esp),%ecx	# and this is cs..
 	movl %eax,EFLAGS(%esp)	#
+	andl $~(NT_MASK|TF_MASK|DF_MASK), %eax
+	pushl %eax
+	popfl
 	movl %edx,EIP(%esp)	# Now we move them to their "normal" places
 	movl %ecx,CS(%esp)	#
 	movl %esp,%ebx
@@ -256,6 +261,9 @@
 	pushl $ SYMBOL_NAME(do_divide_error)
 	ALIGN
 error_code:
+	pushfl
+	andl $~(NT_MASK|TF_MASK|DF_MASK), (%esp)
+	popfl
 	pushl %ds
 	pushl %eax
 	xorl %eax,%eax
@@ -266,7 +274,6 @@
 	decl %eax			# eax = -1
 	pushl %ecx
 	pushl %ebx
-	cld
 	movl %es,%cx
 	movl ORIG_EAX(%esp), %esi	# get the error code
 	movl ES(%esp), %edi		# get the function address
diff -u --new-file --recursive linux.vanilla/arch/i386/kernel/traps.c linux/arch/i386/kernel/traps.c
--- linux.vanilla/arch/i386/kernel/traps.c	Mon May 20 16:32:34 2002
+++ linux/arch/i386/kernel/traps.c	Fri Nov 29 10:05:43 2002
@@ -419,7 +419,7 @@
 	return;
 
 clear_TF:
-	regs->eflags &= ~TF_MASK;
+	regs->eflags &= ~(TF_MASK|NT_MASK);
 	return;
 }
 
diff -u --new-file --recursive linux.vanilla/drivers/char/agp/agpgart_fe.c linux/drivers/char/agp/agpgart_fe.c
--- linux.vanilla/drivers/char/agp/agpgart_fe.c	Fri Nov  2 08:39:06 2001
+++ linux/drivers/char/agp/agpgart_fe.c	Fri Nov 29 10:05:43 2002
@@ -300,7 +300,7 @@
 	agp_memory *memory;
 
 	memory = agp_allocate_memory(pg_count, type);
-   	printk(KERN_DEBUG "memory : %p\n", memory);
+   	printk(KERN_DEBUG "agp_allocate_memory: %p\n", memory);
 	if (memory == NULL) {
 		return NULL;
 	}
diff -u --new-file --recursive linux.vanilla/drivers/char/joystick/Config.in linux/drivers/char/joystick/Config.in
--- linux.vanilla/drivers/char/joystick/Config.in	Sun Mar 25 08:31:27 2001
+++ linux/drivers/char/joystick/Config.in	Fri Nov 29 10:05:43 2002
@@ -16,7 +16,7 @@
    dep_tristate '  ThrustMaster DirectConnect' CONFIG_JOY_THRUSTMASTER $CONFIG_JOYSTICK
    dep_tristate '  Creative Labs Blaster' CONFIG_JOY_CREATIVE $CONFIG_JOYSTICK
    dep_tristate '  PDPI Lightning 4 card' CONFIG_JOY_LIGHTNING $CONFIG_JOYSTICK
-   dep_tristate '  Trident 4DWave and Aureal Vortex gameport' CONFIG_JOY_PCI $CONFIG_JOYSTICK
+   dep_tristate '  Trident 4DWave/Aureal Vortex/ALi 5451 gameport' CONFIG_JOY_PCI $CONFIG_JOYSTICK
    dep_tristate '  Magellan and Space Mouse' CONFIG_JOY_MAGELLAN $CONFIG_JOYSTICK
    dep_tristate '  SpaceTec SpaceOrb 360 and SpaceBall Avenger' CONFIG_JOY_SPACEORB $CONFIG_JOYSTICK
    dep_tristate '  SpaceTec SpaceBall 4000 FLX' CONFIG_JOY_SPACEBALL $CONFIG_JOYSTICK
diff -u --new-file --recursive linux.vanilla/drivers/char/joystick/joy-pci.c linux/drivers/char/joystick/joy-pci.c
--- linux.vanilla/drivers/char/joystick/joy-pci.c	Sun Mar 25 08:31:27 2001
+++ linux/drivers/char/joystick/joy-pci.c	Fri Nov 29 10:05:43 2002
@@ -129,6 +129,8 @@
 	js_pci_vortex_init, js_pci_vortex_cleanup, "Aureal Vortex1" },
  { PCI_VENDOR_ID_AUREAL,  0x0002, 0x40000, 0x2a00c, 0x2880c, 0x28808, 0x28810, 4, 0x1fff,
 	js_pci_vortex_init, js_pci_vortex_cleanup, "Aureal Vortex2" },
+ { PCI_VENDOR_ID_AL,      0x5451, 0x10000, 0x00044, 0x00030, 0x00031, 0x00034, 2, 0xffff,
+	js_pci_4dwave_init, js_pci_4dwave_cleanup, "ALi 5451" },
  { 0, 0, 0, 0, 0, 0, 0, 0, 0, NULL, NULL }};
 
 /*
diff -u --new-file --recursive linux.vanilla/drivers/isdn/isdn_ppp.c linux/drivers/isdn/isdn_ppp.c
--- linux.vanilla/drivers/isdn/isdn_ppp.c	Mon Sep 16 09:26:11 2002
+++ linux/drivers/isdn/isdn_ppp.c	Fri Nov 29 10:05:43 2002
@@ -1148,7 +1148,7 @@
 	if (slot < 0 || slot > ISDN_MAX_CHANNELS) {
 		printk(KERN_ERR "isdn_ppp_xmit: lp->ppp_slot %d\n", lp->ppp_slot);
 		kfree_skb(skb);
-		return 0;
+		goto unlock;
 	}
 	ipt = ippp_table[slot];
 	lp->huptimer = 0;
diff -u --new-file --recursive linux.vanilla/drivers/telephony/ixj.c linux/drivers/telephony/ixj.c
--- linux.vanilla/drivers/telephony/ixj.c	Sun Mar 25 08:31:44 2001
+++ linux/drivers/telephony/ixj.c	Fri Nov 29 10:05:43 2002
@@ -4472,7 +4472,9 @@
 	lcp = kmalloc(sizeof(IXJ_CADENCE), GFP_KERNEL);
 	if (lcp == NULL)
 		return -ENOMEM;
-	if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)))
+	if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) ||
+	    lcp->elements_used < 0 ||
+	    lcp->elements_used > INT_MAX / sizeof(IXJ_CADENCE_ELEMENT))
 	{
 		kfree(lcp);
 		return -EFAULT;
diff -u --new-file --recursive linux.vanilla/fs/fat/misc.c linux/fs/fat/misc.c
--- linux.vanilla/fs/fat/misc.c	Mon Sep 16 09:26:32 2002
+++ linux/fs/fat/misc.c	Fri Nov 29 10:05:43 2002
@@ -366,7 +366,8 @@
 			return -1; /* beyond EOF */
 		*pos += sizeof(struct msdos_dir_entry);
 		if (!(*bh = fat_bread(sb, sector))) {
-			printk("Directory sread (sector 0x%x) failed\n",sector);
+			printk("Directory sread (sector 0x%lx) failed\n",
+				(unsigned long)sector);
 			continue;
 		}
 		break;
diff -u --new-file --recursive linux.vanilla/include/linux/kernel.h linux/include/linux/kernel.h
--- linux.vanilla/include/linux/kernel.h	Sun Mar 25 08:31:03 2001
+++ linux/include/linux/kernel.h	Fri Nov 29 10:05:43 2002
@@ -49,8 +49,12 @@
 extern unsigned long simple_strtoul(const char *,char **,unsigned int);
 extern long simple_strtol(const char *,char **,unsigned int);
 extern char *get_options(char *str, int *ints);
-extern int sprintf(char * buf, const char * fmt, ...);
-extern int vsprintf(char *buf, const char *, va_list);
+extern int sprintf(char *buf, const char *fmt, ...)
+	__attribute__ ((format (printf, 2, 3)));
+extern int vsprintf(char *buf, const char *, va_list)
+	__attribute__ ((format (printf, 2, 0)));
+extern int _vsnprintf(char *buf, int n, const char *, va_list)
+	__attribute__ ((format (printf, 3, 0)));
 
 extern int session_of_pgrp(int pgrp);
 
diff -u --new-file --recursive linux.vanilla/init/main.c linux/init/main.c
--- linux.vanilla/init/main.c	Fri Nov  2 08:39:16 2001
+++ linux/init/main.c	Fri Nov 29 10:05:43 2002
@@ -995,7 +995,7 @@
 	{ "soundmodem=", sm_setup },
 #endif
 #ifdef CONFIG_COMPUTONE
-	{ "ip2=", ip2_setup };
+	{ "ip2=", ip2_setup },
 #endif
 #ifdef CONFIG_WDT
 	{ "wdt=", wdt_setup },
diff -u --new-file --recursive linux.vanilla/net/ipv4/ip_options.c linux/net/ipv4/ip_options.c
--- linux.vanilla/net/ipv4/ip_options.c	Sun Mar 25 08:31:12 2001
+++ linux/net/ipv4/ip_options.c	Fri Nov 29 10:05:43 2002
@@ -266,7 +266,7 @@
 	for (l = opt->optlen; l > 0; ) {
 		switch (*optptr) {
 		      case IPOPT_END:
-			for (optptr++, l--; l>0; l--) {
+			for (optptr++, l--; l>0; optptr++, l--) {
 				if (*optptr != IPOPT_END) {
 					*optptr = IPOPT_END;
 					opt->is_changed = 1;