--- /dev/null
+From stable-bounces@linux.kernel.org Tue Dec 13 01:58:24 2005
+Date: Tue, 13 Dec 2005 10:56:08 +0100 (CET)
+From: Krzysztof Oledzki <olenf@ans.pl>
+To: Patrick McHardy <kaber@trash.net>
+Message-ID: <Pine.LNX.4.64.0512131041090.928@bizon.gios.gov.pl>
+Cc: Harald Welte <laforge@netfilter.org>,
+ Netfilter Development Mailinglist <netfilter-devel@lists.netfilter.org>,
+ Pablo Neira Ayuso <pablo@eurodev.net>, stable@kernel.org
+Subject: [NETFILTER]: Fix CTA_PROTO_NUM attribute size in ctnetlink
+
+CTA_PROTO_NUM is a u_int8_t.
+
+Based on oryginal patch by Patrick McHardy <kaber@trash.net>
+
+Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
++++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
+@@ -503,7 +503,7 @@ ctnetlink_parse_tuple_ip(struct nfattr *
+ }
+
+ static const int cta_min_proto[CTA_PROTO_MAX] = {
+- [CTA_PROTO_NUM-1] = sizeof(u_int16_t),
++ [CTA_PROTO_NUM-1] = sizeof(u_int8_t),
+ [CTA_PROTO_SRC_PORT-1] = sizeof(u_int16_t),
+ [CTA_PROTO_DST_PORT-1] = sizeof(u_int16_t),
+ [CTA_PROTO_ICMP_TYPE-1] = sizeof(u_int8_t),
+@@ -528,7 +528,7 @@ ctnetlink_parse_tuple_proto(struct nfatt
+
+ if (!tb[CTA_PROTO_NUM-1])
+ return -EINVAL;
+- tuple->dst.protonum = *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]);
++ tuple->dst.protonum = *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]);
+
+ proto = ip_conntrack_proto_find_get(tuple->dst.protonum);
+
+_______________________________________________
+stable mailing list
+stable@linux.kernel.org
+http://linux.kernel.org/mailman/listinfo/stable
+
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Dec 13 03:28:35 2005
+Message-ID: <439EAFCF.1040409@trash.net>
+Date: Tue, 13 Dec 2005 12:26:07 +0100
+From: Patrick McHardy <kaber@trash.net>
+To: stable@kernel.org
+Cc: Harald Welte <laforge@netfilter.org>, Pablo Neira <pablo@eurodev.net>,
+ Netfilter Development Mailinglist <netfilter-devel@lists.netfilter.org>,
+ Krzysztof Oledzki <olenf@ans.pl>
+Subject: [NETFILTER]: Fix unbalanced read_unlock_bh in ctnetlink
+
+NFA_NEST calls NFA_PUT which jumps to nfattr_failure if the skb has no
+room left. We call read_unlock_bh at nfattr_failure for the NFA_PUT
+inside the locked section, so move NFA_NEST inside the locked section
+too.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+
+--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
++++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+@@ -341,9 +341,10 @@ static int tcp_print_conntrack(struct se
+ static int tcp_to_nfattr(struct sk_buff *skb, struct nfattr *nfa,
+ const struct ip_conntrack *ct)
+ {
+- struct nfattr *nest_parms = NFA_NEST(skb, CTA_PROTOINFO_TCP);
++ struct nfattr *nest_parms;
+
+ read_lock_bh(&tcp_lock);
++ nest_parms = NFA_NEST(skb, CTA_PROTOINFO_TCP);
+ NFA_PUT(skb, CTA_PROTOINFO_TCP_STATE, sizeof(u_int8_t),
+ &ct->proto.tcp.state);
+ read_unlock_bh(&tcp_lock);
+
+_______________________________________________
+stable mailing list
+stable@linux.kernel.org
+http://linux.kernel.org/mailman/listinfo/stable
+
--- /dev/null
+acpi-add-support-for-fadt-p_lvl2_up-flag.patch
+acpi-prefer-_cst-over-fadt-for-c-state-capabilities.patch
+fix-cta_proto_num-attribute-size-in-ctnetlink.patch
+fix-unbalanced-read_unlock_bh-in-ctnetlink.patch
Cc: r3pek@gentoo.org
Subject: DVB: BUDGET CI card depends on STV0297 demodulator
+From: Carlos Silva <r3pek@gentoo.org>
+
+BUDGET_CI card depends on STV0297 demodulator.
This patch solves a DVB driver compile error introduced in 2.6.14
+Signed-off-by: Johannes Stezenbach <js@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@brturbo.com.br>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---