--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jul 13 02:11:51 2006
+Date: Thu, 13 Jul 2006 19:11:01 +1000
+To: stable@kernel.org, "David S. Miller" <davem@davemloft.net>, netdev@vger.kernel.org
+Message-ID: <20060713091101.GA28651@gondor.apana.org.au>
+Content-Disposition: inline
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Cc:
+Subject: [NET]: Add missing UFO initialisations
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+This bug was unknowingly fixed the GSO patches (or rather, its effect was
+unknown at the time).
+
+Thanks to Marco Berizzi's persistence which is documented in the thread
+"ipsec tunnel asymmetrical mtu", we now know that it can have highly
+non-obvious symptoms.
+
+What happens is that uninitialised uso_size fields can cause packets to
+be incorrectly identified as UFO, which means that it does not get
+fragmented even if it's over the MTU.
+
+The fix is simple enough.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/dev.c | 1 +
+ net/core/skbuff.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- linux-2.6.17.6.orig/net/core/dev.c
++++ linux-2.6.17.6/net/core/dev.c
+@@ -1246,6 +1246,7 @@ int __skb_linearize(struct sk_buff *skb,
+ atomic_set(&ninfo->dataref, 1);
+ ninfo->tso_size = skb_shinfo(skb)->tso_size;
+ ninfo->tso_segs = skb_shinfo(skb)->tso_segs;
++ ninfo->ufo_size = skb_shinfo(skb)->ufo_size;
+ ninfo->nr_frags = 0;
+ ninfo->frag_list = NULL;
+
+--- linux-2.6.17.6.orig/net/core/skbuff.c
++++ linux-2.6.17.6/net/core/skbuff.c
+@@ -240,6 +240,7 @@ struct sk_buff *alloc_skb_from_cache(kme
+ skb_shinfo(skb)->nr_frags = 0;
+ skb_shinfo(skb)->tso_size = 0;
+ skb_shinfo(skb)->tso_segs = 0;
++ skb_shinfo(skb)->ufo_size = 0;
+ skb_shinfo(skb)->frag_list = NULL;
+ out:
+ return skb;
+@@ -529,6 +530,7 @@ static void copy_skb_header(struct sk_bu
+ atomic_set(&new->users, 1);
+ skb_shinfo(new)->tso_size = skb_shinfo(old)->tso_size;
+ skb_shinfo(new)->tso_segs = skb_shinfo(old)->tso_segs;
++ skb_shinfo(new)->ufo_size = skb_shinfo(old)->ufo_size;
+ }
+
+ /**
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Jul 8 13:40:52 2006
+Date: Sat, 08 Jul 2006 13:39:35 -0700 (PDT)
+Message-Id: <20060708.133935.94578437.davem@davemloft.net>
+To: stable@kernel.org
+From: David Miller <davem@davemloft.net>
+Cc:
+Subject: [NET]: Fix IPv4/DECnet routing rule dumping
+
+
+From: Patrick McHardy <kaber@trash.net>
+
+
+When more rules are present than fit in a single skb, the remaining
+rules are incorrectly skipped.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/decnet/dn_rules.c | 3 ++-
+ net/ipv4/fib_rules.c | 4 ++--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- linux-2.6.17.6.orig/net/decnet/dn_rules.c
++++ linux-2.6.17.6/net/decnet/dn_rules.c
+@@ -400,9 +400,10 @@ int dn_fib_dump_rules(struct sk_buff *sk
+ rcu_read_lock();
+ hlist_for_each_entry(r, node, &dn_fib_rules, r_hlist) {
+ if (idx < s_idx)
+- continue;
++ goto next;
+ if (dn_fib_fill_rule(skb, r, cb, NLM_F_MULTI) < 0)
+ break;
++next:
+ idx++;
+ }
+ rcu_read_unlock();
+--- linux-2.6.17.6.orig/net/ipv4/fib_rules.c
++++ linux-2.6.17.6/net/ipv4/fib_rules.c
+@@ -458,13 +458,13 @@ int inet_dump_rules(struct sk_buff *skb,
+
+ rcu_read_lock();
+ hlist_for_each_entry(r, node, &fib_rules, hlist) {
+-
+ if (idx < s_idx)
+- continue;
++ goto next;
+ if (inet_fill_rule(skb, r, NETLINK_CB(cb->skb).pid,
+ cb->nlh->nlmsg_seq,
+ RTM_NEWRULE, NLM_F_MULTI) < 0)
+ break;
++next:
+ idx++;
+ }
+ rcu_read_unlock();
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jul 14 15:58:35 2006
+Date: Fri, 14 Jul 2006 18:51:41 -0400
+From: Chuck Ebbert <76306.1226@compuserve.com>
+To: linux-netdev <netdev@vger.kernel.org>
+Message-ID: <200607141855_MC3-1-C4FF-BD1B@compuserve.com>
+Content-Disposition: inline
+Cc: Andrew Morton <akpm@osdl.org>, Toralf Foerster <toralf.foerster@gmx.de>,
+ linux-stable <stable@kernel.org>,
+ linux-kernel <linux-kernel@vger.kernel.org>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: ieee80211: TKIP requires CRC32
+
+ieee80211_crypt_tkip will not work without CRC32.
+
+ LD .tmp_vmlinux1
+net/built-in.o: In function `ieee80211_tkip_encrypt':
+net/ieee80211/ieee80211_crypt_tkip.c:349: undefined reference to `crc32_le'
+
+Reported by Toralf Foerster <toralf.foerster@gmx.de>
+
+Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ieee80211/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.17.6.orig/net/ieee80211/Kconfig
++++ linux-2.6.17.6/net/ieee80211/Kconfig
+@@ -58,6 +58,7 @@ config IEEE80211_CRYPT_TKIP
+ depends on IEEE80211 && NET_RADIO
+ select CRYPTO
+ select CRYPTO_MICHAEL_MIC
++ select CRC32
+ ---help---
+ Include software based cipher suites in support of IEEE 802.11i
+ (aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with TKIP enabled
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Jul 8 08:38:31 2006
+Date: Sat, 8 Jul 2006 17:37:31 +0200
+From: Pavel Machek <pavel@ucw.cz>
+To: stable@kernel.org, kernel list <linux-kernel@vger.kernel.org>
+Message-ID: <20060708153731.GB1723@elf.ucw.cz>
+Content-Disposition: inline
+Cc: Andrew Morton <akpm@osdl.org>, rml@novell.com
+Subject: [stable] [patch-stable 2.6.16] pdflush: handle resume wakeups
+
+
+2.6.16 needs this. It was merged into 2.6.18-rc1 in
+http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d616e09ab33aa4d013a93c9b393efd5cebf78521 .
+
+pdflush is carefully designed to ensure that all wakeups have some
+corresponding work to do - if a woken-up pdflush thread discovers that
+it hasn't been given any work to do then this is considered an error.
+
+That all broke when swsusp came along - because a timer-delivered
+wakeup to a frozen pdflush thread will just get lost. This causes the
+pdflush thread to get lost as well: the writeback timer is supposed to
+be re-armed by pdflush in process context, but pdflush doesn't execute
+the callout which does this.
+
+Fix that up by ignoring the return value from try_to_freeze(): jsut
+proceed, see if we have any work pending and only go back to sleep if
+that is not the case.
+
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Pavel Machek <pavel@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/pdflush.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- linux-2.6.17.6.orig/mm/pdflush.c
++++ linux-2.6.17.6/mm/pdflush.c
+@@ -104,21 +104,20 @@ static int __pdflush(struct pdflush_work
+ list_move(&my_work->list, &pdflush_list);
+ my_work->when_i_went_to_sleep = jiffies;
+ spin_unlock_irq(&pdflush_lock);
+-
+ schedule();
+- if (try_to_freeze()) {
+- spin_lock_irq(&pdflush_lock);
+- continue;
+- }
+-
++ try_to_freeze();
+ spin_lock_irq(&pdflush_lock);
+ if (!list_empty(&my_work->list)) {
+- printk("pdflush: bogus wakeup!\n");
++ /*
++ * Someone woke us up, but without removing our control
++ * structure from the global list. swsusp will do this
++ * in try_to_freeze()->refrigerator(). Handle it.
++ */
+ my_work->fn = NULL;
+ continue;
+ }
+ if (my_work->fn == NULL) {
+- printk("pdflush: NULL work function\n");
++ printk("pdflush: bogus wakeup\n");
+ continue;
+ }
+ spin_unlock_irq(&pdflush_lock);
cdrom-fix-bad-cgc.buflen-assignment.patch
splice-fix-problems-with-sys_tee.patch
USB-serial-ftdi_sio-Prevent-userspace-DoS.patch
+tpm-interrupt-clear-fix.patch
+pdflush-handle-resume-wakeups.patch
+ieee80211-tkip-requires-crc32.patch
+fix-ipv4-decnet-routing-rule-dumping.patch
+add-missing-ufo-initialisations.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 12 16:39:52 2006
+Date: Wed, 12 Jul 2006 14:33:14 -0700
+From: "Randy.Dunlap" <rdunlap@xenotime.net>
+To: stable@kernel.org
+Message-Id: <20060712143314.48952105.rdunlap@xenotime.net>
+Cc:
+Subject: tpm: interrupt clear fix
+
+From: Kylene Jo Hall <kjhall@us.ibm.com>
+
+Under stress testing I found that the interrupt is not always cleared.
+This is a bug and this patch should go into 2.6.18 and 2.6.17.x.
+
+Signed-off-by: Kylene Hall <kjhall@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm_tis.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.17.6.orig/drivers/char/tpm/tpm_tis.c
++++ linux-2.6.17.6/drivers/char/tpm/tpm_tis.c
+@@ -424,6 +424,7 @@ static irqreturn_t tis_int_handler(int i
+ iowrite32(interrupt,
+ chip->vendor.iobase +
+ TPM_INT_STATUS(chip->vendor.locality));
++ mb();
+ return IRQ_HANDLED;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
