--- /dev/null
+From greg@press.kroah.org Fri Dec 23 14:13:17 2005
+Message-Id: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:00 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/19] -stable review for 2.6.14.5
+Status: RO
+Content-Length: 736
+Lines: 17
+
+This is the start of the stable review cycle for the 2.6.14.5 release.
+There are 19 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Monday, December 26 10:00:00 UTC. Anything
+received after that time, might be too late.
+
+thanks,
+
+the -stable release team
+
+From greg@press.kroah.org Fri Dec 23 14:13:17 2005
+Message-Id: <20051223221317.788647000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:01 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, dsd@gentoo.org, venkatesh.pallipadi@intel.com
+Subject: [patch 01/19] ACPI: Add support for FADT P_LVL2_UP flag
+Content-Disposition: inline; filename=acpi-add-support-for-fadt-p_lvl2_up-flag.patch
+X-Git-Tag: v2.6.15-rc4
+X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=4c0335526c95d90a1d958e0059f40a5745fc7c5d
+Status: RO
+Content-Length: 1829
+Lines: 59
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+
+[ACPI] Add support for FADT P_LVL2_UP flag
+which tells us if C2 is valid for UP-only, or SMP.
+
+As there is no separate bit for C3, use P_LVL2_UP
+bit to cover both C2 and C3.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=5165
+
+(cherry picked from 28b86b368af3944eb383078fc5797caf2dc8ce44 commit)
+
+Signed-off-by: Venkatesh Pallipadi<venkatesh.pallipadi@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/acpi/processor_idle.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- linux-2.6.14.4.orig/drivers/acpi/processor_idle.c
++++ linux-2.6.14.4/drivers/acpi/processor_idle.c
+@@ -261,6 +261,16 @@ static void acpi_processor_idle(void)
+
+ cx->usage++;
+
++#ifdef CONFIG_HOTPLUG_CPU
++ /*
++ * Check for P_LVL2_UP flag before entering C2 and above on
++ * an SMP system. We do it here instead of doing it at _CST/P_LVL
++ * detection phase, to work cleanly with logical CPU hotplug.
++ */
++ if ((cx->type != ACPI_STATE_C1) && (num_online_cpus() > 1) &&
++ !pr->flags.has_cst && acpi_fadt.plvl2_up)
++ cx->type = ACPI_STATE_C1;
++#endif
+ /*
+ * Sleep:
+ * ------
+@@ -527,6 +537,15 @@ static int acpi_processor_get_power_info
+ pr->power.states[ACPI_STATE_C0].valid = 1;
+ pr->power.states[ACPI_STATE_C1].valid = 1;
+
++#ifndef CONFIG_HOTPLUG_CPU
++ /*
++ * Check for P_LVL2_UP flag before entering C2 and above on
++ * an SMP system.
++ */
++ if ((num_online_cpus() > 1) && acpi_fadt.plvl2_up)
++ return_VALUE(-ENODEV);
++#endif
++
+ /* determine C2 and C3 address from pblk */
+ pr->power.states[ACPI_STATE_C2].address = pr->pblk + 4;
+ pr->power.states[ACPI_STATE_C3].address = pr->pblk + 5;
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:18 2005
+Message-Id: <20051223221317.908322000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:02 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, dsd@gentoo.org, venkatesh.pallipadi@intel.com
+Subject: [patch 02/19] ACPI: Prefer _CST over FADT for C-state capabilities
+Content-Disposition: inline; filename=acpi-prefer-_cst-over-fadt-for-c-state-capabilities.patch
+X-Git-Tag: v2.6.15-rc4
+X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=6d93c64803a5fea84839789aae13290419c62d92
+Status: RO
+Content-Length: 1657
+Lines: 52
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+
+[ACPI] Prefer _CST over FADT for C-state capabilities
+
+Note: This ACPI standard compliance may cause regression
+on some system, if they have _CST present, but _CST value
+is bogus. "nocst" module parameter should workaround
+that regression.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=5165
+
+(cherry picked from 883baf7f7e81cca26f4683ae0d25ba48f094cc08 commit)
+
+Signed-off-by: Venkatesh Pallipadi<venkatesh.pallipadi@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/acpi/processor_idle.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- linux-2.6.14.4.orig/drivers/acpi/processor_idle.c
++++ linux-2.6.14.4/drivers/acpi/processor_idle.c
+@@ -706,7 +706,7 @@ static int acpi_processor_get_power_info
+
+ /* Validate number of power states discovered */
+ if (pr->power.count < 2)
+- status = -ENODEV;
++ status = -EFAULT;
+
+ end:
+ acpi_os_free(buffer.pointer);
+@@ -857,11 +857,11 @@ static int acpi_processor_get_power_info
+ * this function */
+
+ result = acpi_processor_get_power_info_cst(pr);
+- if ((result) || (acpi_processor_power_verify(pr) < 2)) {
++ if (result == -ENODEV)
+ result = acpi_processor_get_power_info_fadt(pr);
+- if ((result) || (acpi_processor_power_verify(pr) < 2))
+- result = acpi_processor_get_power_info_default_c1(pr);
+- }
++
++ if ((result) || (acpi_processor_power_verify(pr) < 2))
++ result = acpi_processor_get_power_info_default_c1(pr);
+
+ /*
+ * Set Default Policy
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:18 2005
+Message-Id: <20051223221318.047802000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:03 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, Harald Welte <laforge@netfilter.org>, Netfilter Development Mailinglist <netfilter-devel@lists.netfilter.org>, Pablo Neira Ayuso <pablo@eurodev.net>, kaber@trash.net, ole@ans.pl
+Subject: [patch 03/19] [NETFILTER]: Fix CTA_PROTO_NUM attribute size in ctnetlink
+Content-Disposition: inline; filename=fix-cta_proto_num-attribute-size-in-ctnetlink.patch
+Status: RO
+Content-Length: 1191
+Lines: 38
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Krzysztof Oledzki <olenf@ans.pl>
+
+CTA_PROTO_NUM is a u_int8_t.
+
+Based on oryginal patch by Patrick McHardy <kaber@trash.net>
+
+Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/netfilter/ip_conntrack_netlink.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.14.4.orig/net/ipv4/netfilter/ip_conntrack_netlink.c
++++ linux-2.6.14.4/net/ipv4/netfilter/ip_conntrack_netlink.c
+@@ -506,7 +506,7 @@ nfattr_failure:
+ }
+
+ static const int cta_min_proto[CTA_PROTO_MAX] = {
+- [CTA_PROTO_NUM-1] = sizeof(u_int16_t),
++ [CTA_PROTO_NUM-1] = sizeof(u_int8_t),
+ [CTA_PROTO_SRC_PORT-1] = sizeof(u_int16_t),
+ [CTA_PROTO_DST_PORT-1] = sizeof(u_int16_t),
+ [CTA_PROTO_ICMP_TYPE-1] = sizeof(u_int8_t),
+@@ -532,7 +532,7 @@ ctnetlink_parse_tuple_proto(struct nfatt
+
+ if (!tb[CTA_PROTO_NUM-1])
+ return -EINVAL;
+- tuple->dst.protonum = *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]);
++ tuple->dst.protonum = *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]);
+
+ proto = ip_conntrack_proto_find_get(tuple->dst.protonum);
+
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:18 2005
+Message-Id: <20051223221318.165289000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:04 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, Harald Welte <laforge@netfilter.org>, Pablo Neira <pablo@eurodev.net>, Netfilter Development Mailinglist <netfilter-devel@lists.netfilter.org>, Krzysztof Oledzki <olenf@ans.pl>, kaber@trash.net, davem@davemloft.net
+Subject: [patch 04/19] [NETFILTER]: Fix unbalanced read_unlock_bh in ctnetlink
+Content-Disposition: inline; filename=fix-unbalanced-read_unlock_bh-in-ctnetlink.patch
+Status: RO
+Content-Length: 1252
+Lines: 35
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Patrick McHardy <kaber@trash.net>
+
+NFA_NEST calls NFA_PUT which jumps to nfattr_failure if the skb has no
+room left. We call read_unlock_bh at nfattr_failure for the NFA_PUT
+inside the locked section, so move NFA_NEST inside the locked section
+too.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/netfilter/ip_conntrack_proto_tcp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- linux-2.6.14.4.orig/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
++++ linux-2.6.14.4/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+@@ -341,9 +341,10 @@ static int tcp_print_conntrack(struct se
+ static int tcp_to_nfattr(struct sk_buff *skb, struct nfattr *nfa,
+ const struct ip_conntrack *ct)
+ {
+- struct nfattr *nest_parms = NFA_NEST(skb, CTA_PROTOINFO_TCP);
++ struct nfattr *nest_parms;
+
+ read_lock_bh(&tcp_lock);
++ nest_parms = NFA_NEST(skb, CTA_PROTOINFO_TCP);
+ NFA_PUT(skb, CTA_PROTOINFO_TCP_STATE, sizeof(u_int8_t),
+ &ct->proto.tcp.state);
+ read_unlock_bh(&tcp_lock);
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:18 2005
+Message-Id: <20051223221318.259760000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:05 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, luming.yu@gmail.com, len.brown@intel.com,
+ trenn@suse.de, nacc@us.ibm.com
+Subject: [patch 05/19] apci: fix NULL deref in video/lcd/brightness
+Content-Disposition: inline; filename=acpi-fix-null-deref-in-video-lcd-brightness.patch
+Status: RO
+Content-Length: 1024
+Lines: 32
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Yu Luming <luming.yu@gmail.com>
+
+Fix Null pointer deref in video/lcd/brightness
+http://bugzilla.kernel.org/show_bug.cgi?id=5571
+
+Signed-off-by: Yu Luming <luming.yu@gmail.com>
+Cc: "Brown, Len" <len.brown@intel.com>
+Signed-off-by: Thomas Renninger <trenn@suse.de>
+Signed-off-by: Nishanth Aravamudan <nacc@us.ibm.com>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Chris Wright <chrisw@redhat.com>
+---
+ drivers/acpi/video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.14.4.orig/drivers/acpi/video.c
++++ linux-2.6.14.4/drivers/acpi/video.c
+@@ -813,7 +813,7 @@ acpi_video_device_write_brightness(struc
+
+ ACPI_FUNCTION_TRACE("acpi_video_device_write_brightness");
+
+- if (!dev || count + 1 > sizeof str)
++ if (!dev || !dev->brightness || count + 1 > sizeof str)
+ return_VALUE(-EINVAL);
+
+ if (copy_from_user(str, buffer, count))
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:18 2005
+Message-Id: <20051223221318.375712000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:06 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, James.Bottomley@steeleye.com, miquels@cistron.nl, aacraid@adaptec.com, mark_salyzyn@adaptec.com
+Subject: [patch 06/19] [PATCH] dpt_i2o fix for deadlock condition
+Content-Disposition: inline; filename=dpt_i2o-fix-for-deadlock-condition.patch
+Status: RO
+Content-Length: 3051
+Lines: 87
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: "Salyzyn, Mark" <mark_salyzyn@adaptec.com>
+
+Miquel van Smoorenburg <miquels@cistron.nl> forwarded me this fix to
+resolve a deadlock condition that occurs due to the API change in 2.6.13+
+kernels dropping the host locking when entering the error handling. They
+all end up calling adpt_i2o_post_wait(), which if you call it unlocked,
+might return with host_lock locked anyway and that causes a deadlock.
+
+Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
+Cc: James Bottomley <James.Bottomley@steeleye.com>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Chris Wright <chrisw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/scsi/dpt_i2o.c | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+--- linux-2.6.14.4.orig/drivers/scsi/dpt_i2o.c
++++ linux-2.6.14.4/drivers/scsi/dpt_i2o.c
+@@ -660,7 +660,12 @@ static int adpt_abort(struct scsi_cmnd *
+ msg[2] = 0;
+ msg[3]= 0;
+ msg[4] = (u32)cmd;
+- if( (rcode = adpt_i2o_post_wait(pHba, msg, sizeof(msg), FOREVER)) != 0){
++ if (pHba->host)
++ spin_lock_irq(pHba->host->host_lock);
++ rcode = adpt_i2o_post_wait(pHba, msg, sizeof(msg), FOREVER);
++ if (pHba->host)
++ spin_unlock_irq(pHba->host->host_lock);
++ if (rcode != 0) {
+ if(rcode == -EOPNOTSUPP ){
+ printk(KERN_INFO"%s: Abort cmd not supported\n",pHba->name);
+ return FAILED;
+@@ -697,10 +702,15 @@ static int adpt_device_reset(struct scsi
+ msg[2] = 0;
+ msg[3] = 0;
+
++ if (pHba->host)
++ spin_lock_irq(pHba->host->host_lock);
+ old_state = d->state;
+ d->state |= DPTI_DEV_RESET;
+- if( (rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER)) ){
+- d->state = old_state;
++ rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER);
++ d->state = old_state;
++ if (pHba->host)
++ spin_unlock_irq(pHba->host->host_lock);
++ if (rcode != 0) {
+ if(rcode == -EOPNOTSUPP ){
+ printk(KERN_INFO"%s: Device reset not supported\n",pHba->name);
+ return FAILED;
+@@ -708,7 +718,6 @@ static int adpt_device_reset(struct scsi
+ printk(KERN_INFO"%s: Device reset failed\n",pHba->name);
+ return FAILED;
+ } else {
+- d->state = old_state;
+ printk(KERN_INFO"%s: Device reset successful\n",pHba->name);
+ return SUCCESS;
+ }
+@@ -721,6 +730,7 @@ static int adpt_bus_reset(struct scsi_cm
+ {
+ adpt_hba* pHba;
+ u32 msg[4];
++ u32 rcode;
+
+ pHba = (adpt_hba*)cmd->device->host->hostdata[0];
+ memset(msg, 0, sizeof(msg));
+@@ -729,7 +739,12 @@ static int adpt_bus_reset(struct scsi_cm
+ msg[1] = (I2O_HBA_BUS_RESET<<24|HOST_TID<<12|pHba->channel[cmd->device->channel].tid);
+ msg[2] = 0;
+ msg[3] = 0;
+- if(adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER) ){
++ if (pHba->host)
++ spin_lock_irq(pHba->host->host_lock);
++ rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER);
++ if (pHba->host)
++ spin_unlock_irq(pHba->host->host_lock);
++ if (rcode != 0) {
+ printk(KERN_WARNING"%s: Bus reset failed.\n",pHba->name);
+ return FAILED;
+ } else {
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:18 2005
+Message-Id: <20051223221318.487641000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:07 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, davem@davemloft.net,
+ herbert@gondor.apana.org.au
+Subject: [patch 07/19] [GRE]: Fix hardware checksum modification
+Content-Disposition: inline; filename=gre-fix-hardware-checksum-modification.patch
+Status: RO
+Content-Length: 1054
+Lines: 30
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+The skb_postpull_rcsum introduced a bug to the checksum modification.
+Although the length pulled is offset bytes, the origin of the pulling
+is the GRE header, not the IP header.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/ip_gre.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.14.4.orig/net/ipv4/ip_gre.c
++++ linux-2.6.14.4/net/ipv4/ip_gre.c
+@@ -617,7 +617,7 @@ static int ipgre_rcv(struct sk_buff *skb
+
+ skb->mac.raw = skb->nh.raw;
+ skb->nh.raw = __pskb_pull(skb, offset);
+- skb_postpull_rcsum(skb, skb->mac.raw, offset);
++ skb_postpull_rcsum(skb, skb->h.raw, offset);
+ memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
+ skb->pkt_type = PACKET_HOST;
+ #ifdef CONFIG_NET_IPGRE_BROADCAST
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:18 2005
+Message-Id: <20051223221318.602677000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:08 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, davem@davemloft.net, shemminger@osdl.org
+Subject: [patch 08/19] [VLAN]: Fix hardware rx csum errors
+Content-Disposition: inline; filename=fix-vlan-checksumming.patch
+Status: RO
+Content-Length: 1036
+Lines: 31
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stephen Hemminger <shemminger@osdl.org>
+
+Receiving VLAN packets over a device (without VLAN assist) that is
+doing hardware checksumming (CHECKSUM_HW), causes errors because the
+VLAN code forgets to adjust the hardware checksum.
+
+Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/8021q/vlan_dev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- linux-2.6.14.4.orig/net/8021q/vlan_dev.c
++++ linux-2.6.14.4/net/8021q/vlan_dev.c
+@@ -165,6 +165,9 @@ int vlan_skb_recv(struct sk_buff *skb, s
+
+ skb_pull(skb, VLAN_HLEN); /* take off the VLAN header (4 bytes currently) */
+
++ /* Need to correct hardware checksum */
++ skb_postpull_rcsum(skb, vhdr, VLAN_HLEN);
++
+ /* Ok, lets check to make sure the device (dev) we
+ * came in on is what this VLAN is attached to.
+ */
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:18 2005
+Message-Id: <20051223221318.772298000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:09 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, davem@davemloft.net, kaber@trash.net
+Subject: [patch 09/19] [NETFILTER]: Fix NAT init order
+Content-Disposition: inline; filename=fix-nat-init-order.patch
+Status: RO
+Content-Length: 1321
+Lines: 39
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Patrick McHardy <kaber@trash.net>
+
+As noticed by Phil Oester, the GRE NAT protocol helper is initialized
+before the NAT core, which makes registration fail.
+
+Change the linking order to make NAT be initialized first.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/netfilter/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- linux-2.6.14.4.orig/net/ipv4/netfilter/Makefile
++++ linux-2.6.14.4/net/ipv4/netfilter/Makefile
+@@ -12,6 +12,7 @@ ip_nat_pptp-objs := ip_nat_helper_pptp.o
+
+ # connection tracking
+ obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o
++obj-$(CONFIG_IP_NF_NAT) += ip_nat.o
+
+ # conntrack netlink interface
+ obj-$(CONFIG_IP_NF_CONNTRACK_NETLINK) += ip_conntrack_netlink.o
+@@ -41,7 +42,7 @@ obj-$(CONFIG_IP_NF_IPTABLES) += ip_table
+ # the three instances of ip_tables
+ obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
+ obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
+-obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o ip_nat.o
++obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
+ obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
+
+ # matches
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:18 2005
+Message-Id: <20051223221318.835498000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:10 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, davem@davemloft.net, kaber@trash.net
+Subject: [patch 10/19] [NETFILTER]: Fix incorrect dependency for IP6_NF_TARGET_NFQUEUE
+Content-Disposition: inline; filename=fix-incorrect-dependency-for-IP6_NF_TARGET_NFQUEUE.patch
+Status: RO
+Content-Length: 835
+Lines: 28
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Patrick McHardy <kaber@trash.net>
+
+IP6_NF_TARGET_NFQUEUE depends on IP6_NF_IPTABLES, not IP_NF_IPTABLES.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv6/netfilter/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.14.4.orig/net/ipv6/netfilter/Kconfig
++++ linux-2.6.14.4/net/ipv6/netfilter/Kconfig
+@@ -211,7 +211,7 @@ config IP6_NF_TARGET_REJECT
+
+ config IP6_NF_TARGET_NFQUEUE
+ tristate "NFQUEUE Target Support"
+- depends on IP_NF_IPTABLES
++ depends on IP6_NF_IPTABLES
+ help
+ This Target replaced the old obsolete QUEUE target.
+
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:19 2005
+Message-Id: <20051223221318.951748000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:11 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, davem@davemloft.net,
+ kristian.slavov@nomadiclab.com, hadi@cyberus.ca, kaber@trash.net
+Subject: [patch 11/19] [RTNETLINK]: Fix RTNLGRP definitions in rtnetlink.h
+Content-Disposition: inline; filename=rtnetlink-fix-RTNLGRP-definitions-in-rtnetlink.h.patch
+Status: RO
+Content-Length: 1648
+Lines: 47
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Kristian Slavov <kristian.slavov@nomadiclab.com>
+
+I reported a problem and gave hints to the solution, but nobody seemed
+to react. So I prepared a patch against 2.6.14.4.
+
+Tested on 2.6.14.4 with "ip monitor addr" and with the program
+attached, while adding and removing IPv6 address. Both programs didn't
+receive any messages. Tested 2.6.14.4 + this patch, and both programs
+received add and remove messages.
+
+Signed-off-by: Kristian Slavov <kristian.slavov@nomadiclab.com>
+Acked-by: Jamal Hadi salim <hadi@cyberus.ca>
+ACKed-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/linux/rtnetlink.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- linux-2.6.14.4.orig/include/linux/rtnetlink.h
++++ linux-2.6.14.4/include/linux/rtnetlink.h
+@@ -866,6 +866,7 @@ enum rtnetlink_groups {
+ #define RTNLGRP_IPV4_MROUTE RTNLGRP_IPV4_MROUTE
+ RTNLGRP_IPV4_ROUTE,
+ #define RTNLGRP_IPV4_ROUTE RTNLGRP_IPV4_ROUTE
++ RTNLGRP_NOP1,
+ RTNLGRP_IPV6_IFADDR,
+ #define RTNLGRP_IPV6_IFADDR RTNLGRP_IPV6_IFADDR
+ RTNLGRP_IPV6_MROUTE,
+@@ -876,8 +877,11 @@ enum rtnetlink_groups {
+ #define RTNLGRP_IPV6_IFINFO RTNLGRP_IPV6_IFINFO
+ RTNLGRP_DECnet_IFADDR,
+ #define RTNLGRP_DECnet_IFADDR RTNLGRP_DECnet_IFADDR
++ RTNLGRP_NOP2,
+ RTNLGRP_DECnet_ROUTE,
+ #define RTNLGRP_DECnet_ROUTE RTNLGRP_DECnet_ROUTE
++ RTNLGRP_NOP3,
++ RTNLGRP_NOP4,
+ RTNLGRP_IPV6_PREFIX,
+ #define RTNLGRP_IPV6_PREFIX RTNLGRP_IPV6_PREFIX
+ __RTNLGRP_MAX
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:19 2005
+Message-Id: <20051223221319.067032000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:12 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, davem@davemloft.net, bdschuym@pandora.be
+Subject: [patch 12/19] [BRIDGE-NF]: Fix bridge-nf ipv6 length check
+Content-Disposition: inline; filename=fix-bridge-nf-ipv6-length-check.patch
+Status: RO
+Content-Length: 1760
+Lines: 57
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Bart De Schuymer <bdschuym@pandora.be>
+
+A typo caused some bridged IPv6 packets to get dropped randomly,
+as reported by Sebastien Chaumontet. The patch below fixes this
+(using skb->nh.raw instead of raw) and also makes the jumbo packet
+length checking up-to-date with the code in
+net/ipv6/exthdrs.c::ipv6_hop_jumbo.
+
+Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/bridge/br_netfilter.c | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+--- linux-2.6.14.4.orig/net/bridge/br_netfilter.c
++++ linux-2.6.14.4/net/bridge/br_netfilter.c
+@@ -295,7 +295,7 @@ static int check_hbh_len(struct sk_buff
+ len -= 2;
+
+ while (len > 0) {
+- int optlen = raw[off+1]+2;
++ int optlen = skb->nh.raw[off+1]+2;
+
+ switch (skb->nh.raw[off]) {
+ case IPV6_TLV_PAD0:
+@@ -308,18 +308,15 @@ static int check_hbh_len(struct sk_buff
+ case IPV6_TLV_JUMBO:
+ if (skb->nh.raw[off+1] != 4 || (off&3) != 2)
+ goto bad;
+-
+ pkt_len = ntohl(*(u32*)(skb->nh.raw+off+2));
+-
++ if (pkt_len <= IPV6_MAXPLEN ||
++ skb->nh.ipv6h->payload_len)
++ goto bad;
+ if (pkt_len > skb->len - sizeof(struct ipv6hdr))
+ goto bad;
+- if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
+- if (__pskb_trim(skb,
+- pkt_len + sizeof(struct ipv6hdr)))
+- goto bad;
+- if (skb->ip_summed == CHECKSUM_HW)
+- skb->ip_summed = CHECKSUM_NONE;
+- }
++ if (pskb_trim_rcsum(skb,
++ pkt_len+sizeof(struct ipv6hdr)))
++ goto bad;
+ break;
+ default:
+ if (optlen > len)
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:19 2005
+Message-Id: <20051223221319.184615000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:13 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, davem@davemloft.net, yoshfuji@linux-ipv6.org
+Subject: [patch 13/19] [IPV6]: Fix route lifetime.
+Content-Disposition: inline; filename=ipv6-fix-route-lifetime.patch
+Status: RO
+Content-Length: 2475
+Lines: 73
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+
+The route expiration time is stored in rt6i_expires in jiffies.
+The argument of rt6_route_add() for adding a route is not the
+expiration time in jiffies nor in clock_t, but the lifetime
+(or time left before expiration) in clock_t.
+
+Because of the confusion, we sometimes saw several strange errors
+(FAILs) in TAHI IPv6 Ready Logo Phase-2 Self Test.
+The symptoms were analyzed by Mitsuru Chinen <CHINEN@jp.ibm.com>.
+
+Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv6/addrconf.c | 16 ++++++++++++----
+ net/ipv6/route.c | 2 +-
+ 2 files changed, 13 insertions(+), 5 deletions(-)
+
+--- linux-2.6.14.4.orig/net/ipv6/addrconf.c
++++ linux-2.6.14.4/net/ipv6/addrconf.c
+@@ -1456,9 +1456,17 @@ void addrconf_prefix_rcv(struct net_devi
+ not good.
+ */
+ if (valid_lft >= 0x7FFFFFFF/HZ)
+- rt_expires = 0;
++ rt_expires = 0x7FFFFFFF - (0x7FFFFFFF % HZ);
+ else
+- rt_expires = jiffies + valid_lft * HZ;
++ rt_expires = valid_lft * HZ;
++
++ /*
++ * We convert this (in jiffies) to clock_t later.
++ * Avoid arithmetic overflow there as well.
++ * Overflow can happen only if HZ < USER_HZ.
++ */
++ if (HZ < USER_HZ && rt_expires > 0x7FFFFFFF / USER_HZ)
++ rt_expires = 0x7FFFFFFF / USER_HZ;
+
+ if (pinfo->onlink) {
+ struct rt6_info *rt;
+@@ -1470,12 +1478,12 @@ void addrconf_prefix_rcv(struct net_devi
+ ip6_del_rt(rt, NULL, NULL, NULL);
+ rt = NULL;
+ } else {
+- rt->rt6i_expires = rt_expires;
++ rt->rt6i_expires = jiffies + rt_expires;
+ }
+ }
+ } else if (valid_lft) {
+ addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
+- dev, rt_expires, RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT);
++ dev, jiffies_to_clock_t(rt_expires), RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT);
+ }
+ if (rt)
+ dst_release(&rt->u.dst);
+--- linux-2.6.14.4.orig/net/ipv6/route.c
++++ linux-2.6.14.4/net/ipv6/route.c
+@@ -829,7 +829,7 @@ int ip6_route_add(struct in6_rtmsg *rtms
+ }
+
+ rt->u.dst.obsolete = -1;
+- rt->rt6i_expires = clock_t_to_jiffies(rtmsg->rtmsg_info);
++ rt->rt6i_expires = jiffies + clock_t_to_jiffies(rtmsg->rtmsg_info);
+ if (nlh && (r = NLMSG_DATA(nlh))) {
+ rt->rt6i_protocol = r->rtm_protocol;
+ } else {
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:19 2005
+Message-Id: <20051223221319.300479000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:14 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, davem@davemloft.net
+Subject: [patch 14/19] [IPSEC]: Perform SA switchover immediately.
+Content-Disposition: inline; filename=ipsec-perform-SA-switchover-immediately.patch
+Status: RO
+Content-Length: 2456
+Lines: 89
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: "David S. Miller" <davem@davemloft.net>
+
+When we insert a new xfrm_state which potentially
+subsumes an existing one, make sure all cached
+bundles are flushed so that the new SA is used
+immediately.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/net/xfrm.h | 1 +
+ net/xfrm/xfrm_policy.c | 19 ++++++++++++++-----
+ net/xfrm/xfrm_state.c | 5 +++++
+ 3 files changed, 20 insertions(+), 5 deletions(-)
+
+--- linux-2.6.14.4.orig/include/net/xfrm.h
++++ linux-2.6.14.4/include/net/xfrm.h
+@@ -890,6 +890,7 @@ struct xfrm_state * xfrm_find_acq(u8 mod
+ extern void xfrm_policy_flush(void);
+ extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
+ extern int xfrm_flush_bundles(void);
++extern void xfrm_flush_all_bundles(void);
+ extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family);
+ extern void xfrm_init_pmtu(struct dst_entry *dst);
+
+--- linux-2.6.14.4.orig/net/xfrm/xfrm_policy.c
++++ linux-2.6.14.4/net/xfrm/xfrm_policy.c
+@@ -1014,13 +1014,12 @@ int __xfrm_route_forward(struct sk_buff
+ }
+ EXPORT_SYMBOL(__xfrm_route_forward);
+
+-/* Optimize later using cookies and generation ids. */
+-
+ static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
+ {
+- if (!stale_bundle(dst))
+- return dst;
+-
++ /* If it is marked obsolete, which is how we even get here,
++ * then we have purged it from the policy bundle list and we
++ * did that for a good reason.
++ */
+ return NULL;
+ }
+
+@@ -1104,6 +1103,16 @@ int xfrm_flush_bundles(void)
+ return 0;
+ }
+
++static int always_true(struct dst_entry *dst)
++{
++ return 1;
++}
++
++void xfrm_flush_all_bundles(void)
++{
++ xfrm_prune_bundles(always_true);
++}
++
+ void xfrm_init_pmtu(struct dst_entry *dst)
+ {
+ do {
+--- linux-2.6.14.4.orig/net/xfrm/xfrm_state.c
++++ linux-2.6.14.4/net/xfrm/xfrm_state.c
+@@ -435,6 +435,8 @@ void xfrm_state_insert(struct xfrm_state
+ spin_lock_bh(&xfrm_state_lock);
+ __xfrm_state_insert(x);
+ spin_unlock_bh(&xfrm_state_lock);
++
++ xfrm_flush_all_bundles();
+ }
+ EXPORT_SYMBOL(xfrm_state_insert);
+
+@@ -482,6 +484,9 @@ out:
+ spin_unlock_bh(&xfrm_state_lock);
+ xfrm_state_put_afinfo(afinfo);
+
++ if (!err)
++ xfrm_flush_all_bundles();
++
+ if (x1) {
+ xfrm_state_delete(x1);
+ xfrm_state_put(x1);
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:19 2005
+Message-Id: <20051223221319.415343000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:15 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, dtor@mail.ru, vojtech@suse.cz
+Subject: [patch 15/19] [PATCH] Input: fix an OOPS in HID driver
+Content-Disposition: inline; filename=input-fix-an-OOPS-in-HID-driver.patch
+Status: RO
+Content-Length: 861
+Lines: 28
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Dmitry Torokhov <dtor_core@ameritech.net>
+
+This patch fixes an OOPS in HID driver when connecting simulation
+devices generating unknown simulation events.
+
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Acked-by: Vojtech Pavlik <vojtech@suse.cz>
+Signed-off-by: Chris Wright <chrisw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/input/hid-input.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.14.4.orig/drivers/usb/input/hid-input.c
++++ linux-2.6.14.4/drivers/usb/input/hid-input.c
+@@ -137,6 +137,7 @@ static void hidinput_configure_usage(str
+ switch (usage->hid & 0xffff) {
+ case 0xba: map_abs(ABS_RUDDER); break;
+ case 0xbb: map_abs(ABS_THROTTLE); break;
++ default: goto ignore;
+ }
+ break;
+
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:19 2005
+Message-Id: <20051223221319.554227000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:16 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, jason.wessel@windriver.com, bunk@stusta.de
+Subject: [patch 16/19] kernel/params.c: fix sysfs access with CONFIG_MODULES=n
+Content-Disposition: inline; filename=kernel-params.c-fix-sysfs-access-with-config_modules-n.patch
+Status: RO
+Content-Length: 1121
+Lines: 36
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jason Wessel <jason.wessel@windriver.com>
+
+All the work was done to setup the file and maintain the file handles but
+the access functions were zeroed out due to the #ifdef. Removing the
+#ifdef allows full access to all the parameters when CONFIG_MODULES=n.
+
+akpm: put it back again, but use CONFIG_SYSFS instead.
+
+This patch has already been included in Linus' tree.
+
+
+Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/params.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.14.4.orig/kernel/params.c
++++ linux-2.6.14.4/kernel/params.c
+@@ -618,7 +618,7 @@ static void __init param_sysfs_builtin(v
+
+
+ /* module-related sysfs stuff */
+-#ifdef CONFIG_MODULES
++#ifdef CONFIG_SYSFS
+
+ #define to_module_attr(n) container_of(n, struct module_attribute, attr);
+ #define to_module_kobject(n) container_of(n, struct module_kobject, kobj);
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:19 2005
+Message-Id: <20051223221319.727051000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:17 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, James.Bottomley@SteelEye.com,
+ stefanr@s5r6.in-berlin.de, linux-scsi@vger.kernel.org
+Subject: [patch 17/19] SCSI: fix transfer direction in sd (kernel panic when ejecting iPod)
+Content-Disposition: inline; filename=scsi-fix-transfer-direction-in-sd.patch
+Status: RO
+Content-Length: 3299
+Lines: 96
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+SCSI: fix transfer direction in sd (kernel panic when ejecting iPod)
+
+sd_init_command could issue WRITE requests with zero buffer length.
+This may lead to kernel panic or oops with some SCSI low-level drivers.
+Seen with the command "eject /dev/sdX" when disconnecting an iPod:
+http://marc.theaimsgroup.com/?l=linux1394-devel&m=113399994920181
+http://marc.theaimsgroup.com/?l=linux1394-user&m=112152701817435
+
+Derived from -rc patches from Jens Axboe and James Bottomley.
+
+Patch is reassembled for -stable from patches:
+[SCSI] fix panic when ejecting ieee1394 ipod
+[SCSI] Consolidate REQ_BLOCK_PC handling path (fix ipod panic)
+
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/scsi/scsi_lib.c | 20 ++++++++++++++++++++
+ drivers/scsi/sd.c | 16 +---------------
+ include/scsi/scsi_cmnd.h | 1 +
+ 3 files changed, 22 insertions(+), 15 deletions(-)
+
+--- linux-2.6.14.4.orig/drivers/scsi/scsi_lib.c
++++ linux-2.6.14.4/drivers/scsi/scsi_lib.c
+@@ -1129,6 +1129,26 @@ static void scsi_generic_done(struct scs
+ scsi_io_completion(cmd, cmd->result == 0 ? cmd->bufflen : 0, 0);
+ }
+
++void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd, int retries)
++{
++ struct request *req = cmd->request;
++
++ BUG_ON(sizeof(req->cmd) > sizeof(cmd->cmnd));
++ memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd));
++ cmd->cmd_len = req->cmd_len;
++ if (!req->data_len)
++ cmd->sc_data_direction = DMA_NONE;
++ else if (rq_data_dir(req) == WRITE)
++ cmd->sc_data_direction = DMA_TO_DEVICE;
++ else
++ cmd->sc_data_direction = DMA_FROM_DEVICE;
++
++ cmd->transfersize = req->data_len;
++ cmd->allowed = retries;
++ cmd->timeout_per_command = req->timeout;
++}
++EXPORT_SYMBOL_GPL(scsi_setup_blk_pc_cmnd);
++
+ static int scsi_prep_fn(struct request_queue *q, struct request *req)
+ {
+ struct scsi_device *sdev = q->queuedata;
+--- linux-2.6.14.4.orig/drivers/scsi/sd.c
++++ linux-2.6.14.4/drivers/scsi/sd.c
+@@ -231,24 +231,10 @@ static int sd_init_command(struct scsi_c
+ * SG_IO from block layer already setup, just copy cdb basically
+ */
+ if (blk_pc_request(rq)) {
+- if (sizeof(rq->cmd) > sizeof(SCpnt->cmnd))
+- return 0;
+-
+- memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd));
+- SCpnt->cmd_len = rq->cmd_len;
+- if (rq_data_dir(rq) == WRITE)
+- SCpnt->sc_data_direction = DMA_TO_DEVICE;
+- else if (rq->data_len)
+- SCpnt->sc_data_direction = DMA_FROM_DEVICE;
+- else
+- SCpnt->sc_data_direction = DMA_NONE;
+-
+- this_count = rq->data_len;
++ scsi_setup_blk_pc_cmnd(SCpnt, SD_PASSTHROUGH_RETRIES);
+ if (rq->timeout)
+ timeout = rq->timeout;
+
+- SCpnt->transfersize = rq->data_len;
+- SCpnt->allowed = SD_PASSTHROUGH_RETRIES;
+ goto queue;
+ }
+
+--- linux-2.6.14.4.orig/include/scsi/scsi_cmnd.h
++++ linux-2.6.14.4/include/scsi/scsi_cmnd.h
+@@ -150,5 +150,6 @@ extern struct scsi_cmnd *scsi_get_comman
+ extern void scsi_put_command(struct scsi_cmnd *);
+ extern void scsi_io_completion(struct scsi_cmnd *, unsigned int, unsigned int);
+ extern void scsi_finish_command(struct scsi_cmnd *cmd);
++extern void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd, int retries);
+
+ #endif /* _SCSI_SCSI_CMND_H */
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:19 2005
+Message-Id: <20051223221319.796879000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:18 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, linux-scsi@vger.kernel.org,
+ James.Bottomley@SteelEye.com, stefanr@s5r6.in-berlin.de
+Subject: [patch 18/19] SCSI: fix transfer direction in scsi_lib and st
+Content-Disposition: inline; filename=scsi-fix-transfer-direction-in-scsi_lib-and-st.patch
+Status: RO
+Content-Length: 3467
+Lines: 116
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+
+SCSI: fix transfer direction in scsi_lib and st
+
+scsi_prep_fn and st_init_command could issue WRITE requests with zero
+buffer length. This may lead to kernel panic or oops with some SCSI
+low-level drivers.
+
+Derived from -rc patches from Jens Axboe and James Bottomley.
+
+Patch is reassembled for -stable from patches:
+[SCSI] fix panic when ejecting ieee1394 ipod
+[SCSI] Consolidate REQ_BLOCK_PC handling path (fix ipod panic)
+
+Depends on patch "SCSI: fix transfer direction in sd (kernel panic when
+ejecting iPod)". Also modifies the already correct sr_init_command to
+fully match the corresponding -rc patch.
+
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/scsi/scsi_lib.c | 13 +------------
+ drivers/scsi/sr.c | 20 +++-----------------
+ drivers/scsi/st.c | 19 +------------------
+ 3 files changed, 5 insertions(+), 47 deletions(-)
+
+--- linux-2.6.14.4.orig/drivers/scsi/scsi_lib.c
++++ linux-2.6.14.4/drivers/scsi/scsi_lib.c
+@@ -1284,18 +1284,7 @@ static int scsi_prep_fn(struct request_q
+ goto kill;
+ }
+ } else {
+- memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd));
+- cmd->cmd_len = req->cmd_len;
+- if (rq_data_dir(req) == WRITE)
+- cmd->sc_data_direction = DMA_TO_DEVICE;
+- else if (req->data_len)
+- cmd->sc_data_direction = DMA_FROM_DEVICE;
+- else
+- cmd->sc_data_direction = DMA_NONE;
+-
+- cmd->transfersize = req->data_len;
+- cmd->allowed = 3;
+- cmd->timeout_per_command = req->timeout;
++ scsi_setup_blk_pc_cmnd(cmd, 3);
+ cmd->done = scsi_generic_done;
+ }
+ }
+--- linux-2.6.14.4.orig/drivers/scsi/sr.c
++++ linux-2.6.14.4/drivers/scsi/sr.c
+@@ -320,25 +320,11 @@ static int sr_init_command(struct scsi_c
+ * these are already setup, just copy cdb basically
+ */
+ if (SCpnt->request->flags & REQ_BLOCK_PC) {
+- struct request *rq = SCpnt->request;
++ scsi_setup_blk_pc_cmnd(SCpnt, MAX_RETRIES);
+
+- if (sizeof(rq->cmd) > sizeof(SCpnt->cmnd))
+- return 0;
+-
+- memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd));
+- SCpnt->cmd_len = rq->cmd_len;
+- if (!rq->data_len)
+- SCpnt->sc_data_direction = DMA_NONE;
+- else if (rq_data_dir(rq) == WRITE)
+- SCpnt->sc_data_direction = DMA_TO_DEVICE;
+- else
+- SCpnt->sc_data_direction = DMA_FROM_DEVICE;
+-
+- this_count = rq->data_len;
+- if (rq->timeout)
+- timeout = rq->timeout;
++ if (SCpnt->timeout_per_command)
++ timeout = SCpnt->timeout_per_command;
+
+- SCpnt->transfersize = rq->data_len;
+ goto queue;
+ }
+
+--- linux-2.6.14.4.orig/drivers/scsi/st.c
++++ linux-2.6.14.4/drivers/scsi/st.c
+@@ -4196,27 +4196,10 @@ static void st_intr(struct scsi_cmnd *SC
+ */
+ static int st_init_command(struct scsi_cmnd *SCpnt)
+ {
+- struct request *rq;
+-
+ if (!(SCpnt->request->flags & REQ_BLOCK_PC))
+ return 0;
+
+- rq = SCpnt->request;
+- if (sizeof(rq->cmd) > sizeof(SCpnt->cmnd))
+- return 0;
+-
+- memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd));
+- SCpnt->cmd_len = rq->cmd_len;
+-
+- if (rq_data_dir(rq) == WRITE)
+- SCpnt->sc_data_direction = DMA_TO_DEVICE;
+- else if (rq->data_len)
+- SCpnt->sc_data_direction = DMA_FROM_DEVICE;
+- else
+- SCpnt->sc_data_direction = DMA_NONE;
+-
+- SCpnt->timeout_per_command = rq->timeout;
+- SCpnt->transfersize = rq->data_len;
++ scsi_setup_blk_pc_cmnd(SCpnt, 0);
+ SCpnt->done = st_intr;
+ return 1;
+ }
+
+--
+
+From greg@press.kroah.org Fri Dec 23 14:13:20 2005
+Message-Id: <20051223221319.913124000@press.kroah.org>
+References: <20051223221200.342826000@press.kroah.org>
+Date: Fri, 23 Dec 2005 14:12:19 -0800
+From: Greg Kroah-Hartman <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ torvalds@osdl.org,
+ akpm@osdl.org,
+ alan@lxorguk.ukuu.org.uk, mason@suse.de, agruen@suse.de,
+ mawa@uni-freiburg.de, Trond.Myklebust@netapp.com
+Subject: [patch 19/19] setting ACLs on readonly mounted NFS filesystems (CVE-2005-3623)
+Content-Disposition: inline; filename=setting-acls-on-readonly-mounted-nfs-filesystems.patch
+Status: RO
+Content-Length: 1388
+Lines: 43
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Andreas Gruenbacher <agruen@suse.de>
+
+We must check for MAY_SATTR before setting acls, which includes
+checking for read-only exports: the lower-level setxattr operation
+that eventually sets the acl cannot check export-level restrictions.
+
+Bug reported by Martin Walter <mawa@uni-freiburg.de>.
+
+Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs2acl.c | 2 +-
+ fs/nfsd/nfs3acl.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.14.4.orig/fs/nfsd/nfs2acl.c
++++ linux-2.6.14.4/fs/nfsd/nfs2acl.c
+@@ -107,7 +107,7 @@ static int nfsacld_proc_setacl(struct sv
+ dprintk("nfsd: SETACL(2acl) %s\n", SVCFH_fmt(&argp->fh));
+
+ fh = fh_copy(&resp->fh, &argp->fh);
+- nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP);
++ nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR);
+
+ if (!nfserr) {
+ nfserr = nfserrno( nfsd_set_posix_acl(
+--- linux-2.6.14.4.orig/fs/nfsd/nfs3acl.c
++++ linux-2.6.14.4/fs/nfsd/nfs3acl.c
+@@ -101,7 +101,7 @@ static int nfsd3_proc_setacl(struct svc_
+ int nfserr = 0;
+
+ fh = fh_copy(&resp->fh, &argp->fh);
+- nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP);
++ nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR);
+
+ if (!nfserr) {
+ nfserr = nfserrno( nfsd_set_posix_acl(
+
+--
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
