--- /dev/null
+From stable-bounces@linux.kernel.org Tue Aug 22 00:10:21 2006
+Date: Tue, 22 Aug 2006 00:10:07 -0700 (PDT)
+Message-Id: <20060822.001007.77051872.davem@davemloft.net>
+To: stable@kernel.org
+From: David Miller <davem@davemloft.net>
+Subject: Allow per-route window scale limiting
+
+From: Stephen Hemminger <shemminger@osdl.org>
+
+There are black box devices out there, routers and firewalls and
+whatnot, that simply cannot grok the TCP window scaling option
+correctly.
+
+People should and do bark at the site running the device causing
+the problems, but in the mean time folks do want a way to deal
+with the problem. We don't want them to turn off window scaling
+completely as that hurts performance of connections that would run
+just fine with window scaling enabled.
+
+So give a way to do this on a per-route basis by limiting the
+window scaling by the per-connection window clamp. Stephen's
+changelog message explains how to do this using a route metric.
+
+[TCP]: Limit window scaling if window is clamped.
+
+This small change allows for easy per-route workarounds for broken hosts or
+middleboxes that are not compliant with TCP standards for window scaling.
+Rather than having to turn off window scaling globally. This patch allows
+reducing or disabling window scaling if window clamp is present.
+
+Example: Mark Lord reported a problem with 2.6.17 kernel being unable to
+access http://www.everymac.com
+
+# ip route add 216.145.246.23/32 via 10.8.0.1 window 65535
+
+Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp_output.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.17.11.orig/net/ipv4/tcp_output.c
++++ linux-2.6.17.11/net/ipv4/tcp_output.c
+@@ -197,6 +197,7 @@ void tcp_select_initial_window(int __spa
+ * See RFC1323 for an explanation of the limit to 14
+ */
+ space = max_t(u32, sysctl_tcp_rmem[2], sysctl_rmem_max);
++ space = min_t(u32, space, *window_clamp);
+ while (space > 65535 && (*rcv_wscale) < 14) {
+ space >>= 1;
+ (*rcv_wscale)++;
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Aug 22 17:20:06 2006
+Date: Tue, 22 Aug 2006 17:19:28 -0700
+From: Stephen Hemminger <shemminger@osdl.org>
+To: David Miller <davem@davemloft.net>
+Message-ID: <20060822171928.7ed34b86@localhost.localdomain>
+Cc: netdev@vger.kernel.org, stable@kernel.org
+Subject: bridge-netfilter: don't overwrite memory outside of skb
+
+From: Stephen Hemminger <shemminger@osdl.org>
+
+The bridge netfilter code needs to check for space at the
+front of the skb before overwriting; otherwise if skb from
+device doesn't have headroom, then it will cause random
+memory corruption.
+
+Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/netfilter_bridge.h | 16 ++++++++++++----
+ net/bridge/br_forward.c | 10 +++++++---
+ 2 files changed, 19 insertions(+), 7 deletions(-)
+
+--- linux-2.6.17.11.orig/include/linux/netfilter_bridge.h
++++ linux-2.6.17.11/include/linux/netfilter_bridge.h
+@@ -47,18 +47,26 @@ enum nf_br_hook_priorities {
+ #define BRNF_BRIDGED 0x08
+ #define BRNF_NF_BRIDGE_PREROUTING 0x10
+
+-
+ /* Only used in br_forward.c */
+-static inline
+-void nf_bridge_maybe_copy_header(struct sk_buff *skb)
++static inline int nf_bridge_maybe_copy_header(struct sk_buff *skb)
+ {
++ int err;
++
+ if (skb->nf_bridge) {
+ if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
++ err = skb_cow(skb, 18);
++ if (err)
++ return err;
+ memcpy(skb->data - 18, skb->nf_bridge->data, 18);
+ skb_push(skb, 4);
+- } else
++ } else {
++ err = skb_cow(skb, 16);
++ if (err)
++ return err;
+ memcpy(skb->data - 16, skb->nf_bridge->data, 16);
++ }
+ }
++ return 0;
+ }
+
+ /* This is called by the IP fragmenting code and it ensures there is
+--- linux-2.6.17.11.orig/net/bridge/br_forward.c
++++ linux-2.6.17.11/net/bridge/br_forward.c
+@@ -43,11 +43,15 @@ int br_dev_queue_push_xmit(struct sk_buf
+ else {
+ #ifdef CONFIG_BRIDGE_NETFILTER
+ /* ip_refrag calls ip_fragment, doesn't copy the MAC header. */
+- nf_bridge_maybe_copy_header(skb);
++ if (nf_bridge_maybe_copy_header(skb))
++ kfree_skb(skb);
++ else
+ #endif
+- skb_push(skb, ETH_HLEN);
++ {
++ skb_push(skb, ETH_HLEN);
+
+- dev_queue_xmit(skb);
++ dev_queue_xmit(skb);
++ }
+ }
+
+ return 0;
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Aug 25 01:13:51 2006
+From: Fernando Vazquez <fernando@oss.ntt.co.jp>
+To: gregkh@suse.de
+Date: Fri, 25 Aug 2006 17:13:07 +0900
+Message-Id: <1156493587.2977.20.camel@localhost.localdomain>
+Cc: akpm@osdl.org, dev@openvz.org, linux-ia64@vger.kernel.org,
+ linux-kernel@vger.kernel.org, davem@davemloft.net, stable@kernel.org,
+ kamezawa.hiroyu@jp.fujitsu.com, xemul@openvz.org
+Subject: fix compilation error on IA64
+
+From: Fernando Vazquez <fernando@oss.ntt.co.jp>
+
+The commit 8833ebaa3f4325820fe3338ccf6fae04f6669254 introduced a change that broke
+IA64 compilation as shown below:
+
+ gcc -Wp,-MD,arch/ia64/kernel/.entry.o.d -nostdinc -isystem /usr/lib/gcc/ia64-linux-gnu/4.1.2/include -D__KERNEL__ -Iinclude -include include/linux/autoconf.h -DHAVE_WORKING_TEXT_ALIGN -DHAVE_MODEL_SMALL_ATTRIBUTE -DHAVE_SERIALIZE_DIRECTIVE -D__ASSEMBLY__ -mconstant-gp -c -o arch/ia64/kernel/entry.o arch/ia64/kernel/entry.S
+include/asm/mman.h: Assembler messages:
+include/asm/mman.h:13: Error: Unknown opcode `int ia64_map_check_rgn(unsigned long addr,unsigned long len,'
+include/asm/mman.h:14: Error: Unknown opcode `unsigned long flags)'
+make[1]: *** [arch/ia64/kernel/entry.o] Error 1
+make: *** [arch/ia64/kernel] Error 2
+
+The reason is that "asm/mman.h" is being included from entry.S indirectly through
+"asm/pgtable.h" (see code snips below).
+
+* arch/ia64/kernel/entry.S:
+...
+#include <asm/pgtable.h>
+...
+
+* include/asm-ia64/pgtable.h:
+...
+#include <asm/mman.h>
+...
+
+* include/asm-ia64/mman.h
+...
+#ifdef __KERNEL__
+#define arch_mmap_check ia64_map_check_rgn
+int ia64_map_check_rgn(unsigned long addr, unsigned long len,
+ unsigned long flags);
+#endif
+...
+
+Signed-off-by: Fernando Vazquez <fernando@intellilink.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-ia64/mman.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- linux-2.6.17.11.orig/include/asm-ia64/mman.h
++++ linux-2.6.17.11/include/asm-ia64/mman.h
+@@ -9,10 +9,12 @@
+ */
+
+ #ifdef __KERNEL__
++#ifndef __ASSEMBLY__
+ #define arch_mmap_check ia64_map_check_rgn
+ int ia64_map_check_rgn(unsigned long addr, unsigned long len,
+ unsigned long flags);
+ #endif
++#endif
+
+ #include <asm-generic/mman.h>
+
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Aug 22 13:41:36 2006
+Date: Tue, 22 Aug 2006 13:41:18 -0700 (PDT)
+Message-Id: <20060822.134118.94561932.davem@davemloft.net>
+To: stable@kernel.org
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Subject: Fix output framentation of paged-skbs
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[INET]: Use pskb_trim_unique when trimming paged unique skbs
+
+The IPv4/IPv6 datagram output path was using skb_trim to trim paged
+packets because they know that the packet has not been cloned yet
+(since the packet hasn't been given to anything else in the system).
+
+This broke because skb_trim no longer allows paged packets to be
+trimmed. Paged packets must be given to one of the pskb_trim functions
+instead.
+
+This patch adds a new pskb_trim_unique function to cover the IPv4/IPv6
+datagram output path scenario and replaces the corresponding skb_trim
+calls with it.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/skbuff.h | 15 +++++++++++++++
+ net/ipv4/ip_output.c | 4 ++--
+ net/ipv6/ip6_output.c | 2 +-
+ 3 files changed, 18 insertions(+), 3 deletions(-)
+
+--- linux-2.6.17.11.orig/include/linux/skbuff.h
++++ linux-2.6.17.11/include/linux/skbuff.h
+@@ -1009,6 +1009,21 @@ static inline int pskb_trim(struct sk_bu
+ }
+
+ /**
++ * pskb_trim_unique - remove end from a paged unique (not cloned) buffer
++ * @skb: buffer to alter
++ * @len: new length
++ *
++ * This is identical to pskb_trim except that the caller knows that
++ * the skb is not cloned so we should never get an error due to out-
++ * of-memory.
++ */
++static inline void pskb_trim_unique(struct sk_buff *skb, unsigned int len)
++{
++ int err = pskb_trim(skb, len);
++ BUG_ON(err);
++}
++
++/**
+ * skb_orphan - orphan a buffer
+ * @skb: buffer to orphan
+ *
+--- linux-2.6.17.11.orig/net/ipv4/ip_output.c
++++ linux-2.6.17.11/net/ipv4/ip_output.c
+@@ -946,7 +946,7 @@ alloc_new_skb:
+ skb_prev->csum = csum_sub(skb_prev->csum,
+ skb->csum);
+ data += fraggap;
+- skb_trim(skb_prev, maxfraglen);
++ pskb_trim_unique(skb_prev, maxfraglen);
+ }
+
+ copy = datalen - transhdrlen - fraggap;
+@@ -1139,7 +1139,7 @@ ssize_t ip_append_page(struct sock *sk,
+ data, fraggap, 0);
+ skb_prev->csum = csum_sub(skb_prev->csum,
+ skb->csum);
+- skb_trim(skb_prev, maxfraglen);
++ pskb_trim_unique(skb_prev, maxfraglen);
+ }
+
+ /*
+--- linux-2.6.17.11.orig/net/ipv6/ip6_output.c
++++ linux-2.6.17.11/net/ipv6/ip6_output.c
+@@ -1047,7 +1047,7 @@ alloc_new_skb:
+ skb_prev->csum = csum_sub(skb_prev->csum,
+ skb->csum);
+ data += fraggap;
+- skb_trim(skb_prev, maxfraglen);
++ pskb_trim_unique(skb_prev, maxfraglen);
+ }
+ copy = datalen - transhdrlen - fraggap;
+ if (copy < 0) {
fs/ext2/super.c | 41 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 41 insertions(+)
---- linux-2.6.17.7.orig/fs/ext2/super.c
-+++ linux-2.6.17.7/fs/ext2/super.c
+--- linux-2.6.17.11.orig/fs/ext2/super.c
++++ linux-2.6.17.11/fs/ext2/super.c
@@ -252,6 +252,46 @@ static struct super_operations ext2_sops
#endif
};
--- /dev/null
+textsearch-fix-boyer-moore-initialization-bug.patch
+spectrum_cs-fix-firmware-uploading-errors.patch
+fix-output-framentation-of-paged-skbs.patch
+fix-compilation-error-on-ia64.patch
+bridge-netfilter-don-t-overwrite-memory-outside-of-skb.patch
+allow-per-route-window-scale-limiting.patch
+have-ext2-reject-file-handles-with-bad-inode-numbers-early.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Aug 22 17:17:47 2006
+Message-Id: <200608230017.k7N0H5em003657@shell0.pdx.osdl.net>
+From: Richard Purdie <rpurdie@rpsys.net>
+From: akpm@osdl.org
+Date: Tue, 22 Aug 2006 17:17:05 -0700
+Cc: rpurdie@rpsys.net, stable@kernel.org, linux@dominikbrodowski.net
+Subject: spectrum_cs: Fix firmware uploading errors
+
+From: Richard Purdie <rpurdie@rpsys.net>
+
+This fixes firmware upload failures which prevent the driver from working.
+
+Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
+Cc: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/spectrum_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.17.11.orig/drivers/net/wireless/spectrum_cs.c
++++ linux-2.6.17.11/drivers/net/wireless/spectrum_cs.c
+@@ -245,7 +245,7 @@ spectrum_reset(struct pcmcia_device *lin
+ u_int save_cor;
+
+ /* Doing it if hardware is gone is guaranteed crash */
+- if (pcmcia_dev_present(link))
++ if (!pcmcia_dev_present(link))
+ return -ENODEV;
+
+ /* Save original COR value */
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Aug 21 19:10:48 2006
+Message-ID: <44EA66FD.8050502@trash.net>
+Date: Tue, 22 Aug 2006 04:07:57 +0200
+From: Patrick McHardy <kaber@trash.net>
+To: "David S. Miller" <davem@davemloft.net>
+Cc: Netfilter Development Mailinglist <netfilter-devel@lists.netfilter.org>,
+ stable@kernel.org, Adrian Bunk <bunk@stusta.de>
+Subject: TEXTSEARCH: Fix Boyer Moore initialization bug
+
+From: Michael Rash <mbr@cipherdyne.org>
+
+[TEXTSEARCH]: Fix Boyer Moore initialization bug
+
+The pattern is set after trying to compute the prefix table, which tries
+to use it. Initialize it before calling compute_prefix_tbl, make
+compute_prefix_tbl consistently use only the data from struct ts_bm
+and remove the now unnecessary arguments.
+
+Signed-off-by: Michael Rash <mbr@cipherdyne.org>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Acked-by: David Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/ts_bm.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- linux-2.6.17.11.orig/lib/ts_bm.c
++++ linux-2.6.17.11/lib/ts_bm.c
+@@ -112,15 +112,14 @@ static int subpattern(u8 *pattern, int i
+ return ret;
+ }
+
+-static void compute_prefix_tbl(struct ts_bm *bm, const u8 *pattern,
+- unsigned int len)
++static void compute_prefix_tbl(struct ts_bm *bm)
+ {
+ int i, j, g;
+
+ for (i = 0; i < ASIZE; i++)
+- bm->bad_shift[i] = len;
+- for (i = 0; i < len - 1; i++)
+- bm->bad_shift[pattern[i]] = len - 1 - i;
++ bm->bad_shift[i] = bm->patlen;
++ for (i = 0; i < bm->patlen - 1; i++)
++ bm->bad_shift[bm->pattern[i]] = bm->patlen - 1 - i;
+
+ /* Compute the good shift array, used to match reocurrences
+ * of a subpattern */
+@@ -151,8 +150,8 @@ static struct ts_config *bm_init(const v
+ bm = ts_config_priv(conf);
+ bm->patlen = len;
+ bm->pattern = (u8 *) bm->good_shift + prefix_tbl_len;
+- compute_prefix_tbl(bm, pattern, len);
+ memcpy(bm->pattern, pattern, len);
++ compute_prefix_tbl(bm);
+
+ return conf;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
