From: Greg Kroah-Hartman Date: Fri, 23 Dec 2005 22:25:51 +0000 (-0800) Subject: Start the 2.6.14.5 review cycle X-Git-Tag: v2.6.14.6~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d9e86192bb3290278ab2280927873539672f64b4;p=thirdparty%2Fkernel%2Fstable-queue.git Start the 2.6.14.5 review cycle --- diff --git a/queue/acpi-add-support-for-fadt-p_lvl2_up-flag.patch b/review/acpi-add-support-for-fadt-p_lvl2_up-flag.patch similarity index 100% rename from queue/acpi-add-support-for-fadt-p_lvl2_up-flag.patch rename to review/acpi-add-support-for-fadt-p_lvl2_up-flag.patch diff --git a/queue/acpi-fix-null-deref-in-video-lcd-brightness.patch b/review/acpi-fix-null-deref-in-video-lcd-brightness.patch similarity index 100% rename from queue/acpi-fix-null-deref-in-video-lcd-brightness.patch rename to review/acpi-fix-null-deref-in-video-lcd-brightness.patch diff --git a/queue/acpi-prefer-_cst-over-fadt-for-c-state-capabilities.patch b/review/acpi-prefer-_cst-over-fadt-for-c-state-capabilities.patch similarity index 100% rename from queue/acpi-prefer-_cst-over-fadt-for-c-state-capabilities.patch rename to review/acpi-prefer-_cst-over-fadt-for-c-state-capabilities.patch diff --git a/queue/dpt_i2o-fix-for-deadlock-condition.patch b/review/dpt_i2o-fix-for-deadlock-condition.patch similarity index 100% rename from queue/dpt_i2o-fix-for-deadlock-condition.patch rename to review/dpt_i2o-fix-for-deadlock-condition.patch diff --git a/queue/fix-bridge-nf-ipv6-length-check.patch b/review/fix-bridge-nf-ipv6-length-check.patch similarity index 100% rename from queue/fix-bridge-nf-ipv6-length-check.patch rename to review/fix-bridge-nf-ipv6-length-check.patch diff --git a/queue/fix-cta_proto_num-attribute-size-in-ctnetlink.patch b/review/fix-cta_proto_num-attribute-size-in-ctnetlink.patch similarity index 100% rename from queue/fix-cta_proto_num-attribute-size-in-ctnetlink.patch rename to review/fix-cta_proto_num-attribute-size-in-ctnetlink.patch diff --git a/queue/fix-incorrect-dependency-for-IP6_NF_TARGET_NFQUEUE.patch b/review/fix-incorrect-dependency-for-IP6_NF_TARGET_NFQUEUE.patch similarity index 100% rename from queue/fix-incorrect-dependency-for-IP6_NF_TARGET_NFQUEUE.patch rename to review/fix-incorrect-dependency-for-IP6_NF_TARGET_NFQUEUE.patch diff --git a/queue/fix-nat-init-order.patch b/review/fix-nat-init-order.patch similarity index 100% rename from queue/fix-nat-init-order.patch rename to review/fix-nat-init-order.patch diff --git a/queue/fix-unbalanced-read_unlock_bh-in-ctnetlink.patch b/review/fix-unbalanced-read_unlock_bh-in-ctnetlink.patch similarity index 100% rename from queue/fix-unbalanced-read_unlock_bh-in-ctnetlink.patch rename to review/fix-unbalanced-read_unlock_bh-in-ctnetlink.patch diff --git a/queue/fix-vlan-checksumming.patch b/review/fix-vlan-checksumming.patch similarity index 100% rename from queue/fix-vlan-checksumming.patch rename to review/fix-vlan-checksumming.patch diff --git a/queue/gre-fix-hardware-checksum-modification.patch b/review/gre-fix-hardware-checksum-modification.patch similarity index 100% rename from queue/gre-fix-hardware-checksum-modification.patch rename to review/gre-fix-hardware-checksum-modification.patch diff --git a/queue/input-fix-an-OOPS-in-HID-driver.patch b/review/input-fix-an-OOPS-in-HID-driver.patch similarity index 100% rename from queue/input-fix-an-OOPS-in-HID-driver.patch rename to review/input-fix-an-OOPS-in-HID-driver.patch diff --git a/queue/ipsec-perform-SA-switchover-immediately.patch b/review/ipsec-perform-SA-switchover-immediately.patch similarity index 100% rename from queue/ipsec-perform-SA-switchover-immediately.patch rename to review/ipsec-perform-SA-switchover-immediately.patch diff --git a/queue/ipv6-fix-route-lifetime.patch b/review/ipv6-fix-route-lifetime.patch similarity index 100% rename from queue/ipv6-fix-route-lifetime.patch rename to review/ipv6-fix-route-lifetime.patch diff --git a/queue/kernel-params.c-fix-sysfs-access-with-config_modules-n.patch b/review/kernel-params.c-fix-sysfs-access-with-config_modules-n.patch similarity index 100% rename from queue/kernel-params.c-fix-sysfs-access-with-config_modules-n.patch rename to review/kernel-params.c-fix-sysfs-access-with-config_modules-n.patch diff --git a/review/review.mbox b/review/review.mbox new file mode 100644 index 00000000000..f50261984a0 --- /dev/null +++ b/review/review.mbox @@ -0,0 +1,1501 @@ +From greg@press.kroah.org Fri Dec 23 14:13:17 2005 +Message-Id: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:00 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/19] -stable review for 2.6.14.5 +Status: RO +Content-Length: 736 +Lines: 17 + +This is the start of the stable review cycle for the 2.6.14.5 release. +There are 19 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Monday, December 26 10:00:00 UTC. Anything +received after that time, might be too late. + +thanks, + +the -stable release team + +From greg@press.kroah.org Fri Dec 23 14:13:17 2005 +Message-Id: <20051223221317.788647000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:01 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, dsd@gentoo.org, venkatesh.pallipadi@intel.com +Subject: [patch 01/19] ACPI: Add support for FADT P_LVL2_UP flag +Content-Disposition: inline; filename=acpi-add-support-for-fadt-p_lvl2_up-flag.patch +X-Git-Tag: v2.6.15-rc4 +X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=4c0335526c95d90a1d958e0059f40a5745fc7c5d +Status: RO +Content-Length: 1829 +Lines: 59 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Venkatesh Pallipadi + +[ACPI] Add support for FADT P_LVL2_UP flag +which tells us if C2 is valid for UP-only, or SMP. + +As there is no separate bit for C3, use P_LVL2_UP +bit to cover both C2 and C3. + +http://bugzilla.kernel.org/show_bug.cgi?id=5165 + +(cherry picked from 28b86b368af3944eb383078fc5797caf2dc8ce44 commit) + +Signed-off-by: Venkatesh Pallipadi +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/processor_idle.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +--- linux-2.6.14.4.orig/drivers/acpi/processor_idle.c ++++ linux-2.6.14.4/drivers/acpi/processor_idle.c +@@ -261,6 +261,16 @@ static void acpi_processor_idle(void) + + cx->usage++; + ++#ifdef CONFIG_HOTPLUG_CPU ++ /* ++ * Check for P_LVL2_UP flag before entering C2 and above on ++ * an SMP system. We do it here instead of doing it at _CST/P_LVL ++ * detection phase, to work cleanly with logical CPU hotplug. ++ */ ++ if ((cx->type != ACPI_STATE_C1) && (num_online_cpus() > 1) && ++ !pr->flags.has_cst && acpi_fadt.plvl2_up) ++ cx->type = ACPI_STATE_C1; ++#endif + /* + * Sleep: + * ------ +@@ -527,6 +537,15 @@ static int acpi_processor_get_power_info + pr->power.states[ACPI_STATE_C0].valid = 1; + pr->power.states[ACPI_STATE_C1].valid = 1; + ++#ifndef CONFIG_HOTPLUG_CPU ++ /* ++ * Check for P_LVL2_UP flag before entering C2 and above on ++ * an SMP system. ++ */ ++ if ((num_online_cpus() > 1) && acpi_fadt.plvl2_up) ++ return_VALUE(-ENODEV); ++#endif ++ + /* determine C2 and C3 address from pblk */ + pr->power.states[ACPI_STATE_C2].address = pr->pblk + 4; + pr->power.states[ACPI_STATE_C3].address = pr->pblk + 5; + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:18 2005 +Message-Id: <20051223221317.908322000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:02 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, dsd@gentoo.org, venkatesh.pallipadi@intel.com +Subject: [patch 02/19] ACPI: Prefer _CST over FADT for C-state capabilities +Content-Disposition: inline; filename=acpi-prefer-_cst-over-fadt-for-c-state-capabilities.patch +X-Git-Tag: v2.6.15-rc4 +X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=6d93c64803a5fea84839789aae13290419c62d92 +Status: RO +Content-Length: 1657 +Lines: 52 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Venkatesh Pallipadi + +[ACPI] Prefer _CST over FADT for C-state capabilities + +Note: This ACPI standard compliance may cause regression +on some system, if they have _CST present, but _CST value +is bogus. "nocst" module parameter should workaround +that regression. + +http://bugzilla.kernel.org/show_bug.cgi?id=5165 + +(cherry picked from 883baf7f7e81cca26f4683ae0d25ba48f094cc08 commit) + +Signed-off-by: Venkatesh Pallipadi +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/processor_idle.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- linux-2.6.14.4.orig/drivers/acpi/processor_idle.c ++++ linux-2.6.14.4/drivers/acpi/processor_idle.c +@@ -706,7 +706,7 @@ static int acpi_processor_get_power_info + + /* Validate number of power states discovered */ + if (pr->power.count < 2) +- status = -ENODEV; ++ status = -EFAULT; + + end: + acpi_os_free(buffer.pointer); +@@ -857,11 +857,11 @@ static int acpi_processor_get_power_info + * this function */ + + result = acpi_processor_get_power_info_cst(pr); +- if ((result) || (acpi_processor_power_verify(pr) < 2)) { ++ if (result == -ENODEV) + result = acpi_processor_get_power_info_fadt(pr); +- if ((result) || (acpi_processor_power_verify(pr) < 2)) +- result = acpi_processor_get_power_info_default_c1(pr); +- } ++ ++ if ((result) || (acpi_processor_power_verify(pr) < 2)) ++ result = acpi_processor_get_power_info_default_c1(pr); + + /* + * Set Default Policy + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:18 2005 +Message-Id: <20051223221318.047802000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:03 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, Harald Welte , Netfilter Development Mailinglist , Pablo Neira Ayuso , kaber@trash.net, ole@ans.pl +Subject: [patch 03/19] [NETFILTER]: Fix CTA_PROTO_NUM attribute size in ctnetlink +Content-Disposition: inline; filename=fix-cta_proto_num-attribute-size-in-ctnetlink.patch +Status: RO +Content-Length: 1191 +Lines: 38 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Krzysztof Oledzki + +CTA_PROTO_NUM is a u_int8_t. + +Based on oryginal patch by Patrick McHardy + +Signed-off-by: Krzysztof Piotr Oledzki +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/netfilter/ip_conntrack_netlink.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.14.4.orig/net/ipv4/netfilter/ip_conntrack_netlink.c ++++ linux-2.6.14.4/net/ipv4/netfilter/ip_conntrack_netlink.c +@@ -506,7 +506,7 @@ nfattr_failure: + } + + static const int cta_min_proto[CTA_PROTO_MAX] = { +- [CTA_PROTO_NUM-1] = sizeof(u_int16_t), ++ [CTA_PROTO_NUM-1] = sizeof(u_int8_t), + [CTA_PROTO_SRC_PORT-1] = sizeof(u_int16_t), + [CTA_PROTO_DST_PORT-1] = sizeof(u_int16_t), + [CTA_PROTO_ICMP_TYPE-1] = sizeof(u_int8_t), +@@ -532,7 +532,7 @@ ctnetlink_parse_tuple_proto(struct nfatt + + if (!tb[CTA_PROTO_NUM-1]) + return -EINVAL; +- tuple->dst.protonum = *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]); ++ tuple->dst.protonum = *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]); + + proto = ip_conntrack_proto_find_get(tuple->dst.protonum); + + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:18 2005 +Message-Id: <20051223221318.165289000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:04 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, Harald Welte , Pablo Neira , Netfilter Development Mailinglist , Krzysztof Oledzki , kaber@trash.net, davem@davemloft.net +Subject: [patch 04/19] [NETFILTER]: Fix unbalanced read_unlock_bh in ctnetlink +Content-Disposition: inline; filename=fix-unbalanced-read_unlock_bh-in-ctnetlink.patch +Status: RO +Content-Length: 1252 +Lines: 35 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Patrick McHardy + +NFA_NEST calls NFA_PUT which jumps to nfattr_failure if the skb has no +room left. We call read_unlock_bh at nfattr_failure for the NFA_PUT +inside the locked section, so move NFA_NEST inside the locked section +too. + +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Krzysztof Piotr Oledzki +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/netfilter/ip_conntrack_proto_tcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.14.4.orig/net/ipv4/netfilter/ip_conntrack_proto_tcp.c ++++ linux-2.6.14.4/net/ipv4/netfilter/ip_conntrack_proto_tcp.c +@@ -341,9 +341,10 @@ static int tcp_print_conntrack(struct se + static int tcp_to_nfattr(struct sk_buff *skb, struct nfattr *nfa, + const struct ip_conntrack *ct) + { +- struct nfattr *nest_parms = NFA_NEST(skb, CTA_PROTOINFO_TCP); ++ struct nfattr *nest_parms; + + read_lock_bh(&tcp_lock); ++ nest_parms = NFA_NEST(skb, CTA_PROTOINFO_TCP); + NFA_PUT(skb, CTA_PROTOINFO_TCP_STATE, sizeof(u_int8_t), + &ct->proto.tcp.state); + read_unlock_bh(&tcp_lock); + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:18 2005 +Message-Id: <20051223221318.259760000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:05 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, luming.yu@gmail.com, len.brown@intel.com, + trenn@suse.de, nacc@us.ibm.com +Subject: [patch 05/19] apci: fix NULL deref in video/lcd/brightness +Content-Disposition: inline; filename=acpi-fix-null-deref-in-video-lcd-brightness.patch +Status: RO +Content-Length: 1024 +Lines: 32 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Yu Luming + +Fix Null pointer deref in video/lcd/brightness +http://bugzilla.kernel.org/show_bug.cgi?id=5571 + +Signed-off-by: Yu Luming +Cc: "Brown, Len" +Signed-off-by: Thomas Renninger +Signed-off-by: Nishanth Aravamudan +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Chris Wright +--- + drivers/acpi/video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.14.4.orig/drivers/acpi/video.c ++++ linux-2.6.14.4/drivers/acpi/video.c +@@ -813,7 +813,7 @@ acpi_video_device_write_brightness(struc + + ACPI_FUNCTION_TRACE("acpi_video_device_write_brightness"); + +- if (!dev || count + 1 > sizeof str) ++ if (!dev || !dev->brightness || count + 1 > sizeof str) + return_VALUE(-EINVAL); + + if (copy_from_user(str, buffer, count)) + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:18 2005 +Message-Id: <20051223221318.375712000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:06 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, James.Bottomley@steeleye.com, miquels@cistron.nl, aacraid@adaptec.com, mark_salyzyn@adaptec.com +Subject: [patch 06/19] [PATCH] dpt_i2o fix for deadlock condition +Content-Disposition: inline; filename=dpt_i2o-fix-for-deadlock-condition.patch +Status: RO +Content-Length: 3051 +Lines: 87 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: "Salyzyn, Mark" + +Miquel van Smoorenburg forwarded me this fix to +resolve a deadlock condition that occurs due to the API change in 2.6.13+ +kernels dropping the host locking when entering the error handling. They +all end up calling adpt_i2o_post_wait(), which if you call it unlocked, +might return with host_lock locked anyway and that causes a deadlock. + +Signed-off-by: Mark Salyzyn +Cc: James Bottomley +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/dpt_i2o.c | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +--- linux-2.6.14.4.orig/drivers/scsi/dpt_i2o.c ++++ linux-2.6.14.4/drivers/scsi/dpt_i2o.c +@@ -660,7 +660,12 @@ static int adpt_abort(struct scsi_cmnd * + msg[2] = 0; + msg[3]= 0; + msg[4] = (u32)cmd; +- if( (rcode = adpt_i2o_post_wait(pHba, msg, sizeof(msg), FOREVER)) != 0){ ++ if (pHba->host) ++ spin_lock_irq(pHba->host->host_lock); ++ rcode = adpt_i2o_post_wait(pHba, msg, sizeof(msg), FOREVER); ++ if (pHba->host) ++ spin_unlock_irq(pHba->host->host_lock); ++ if (rcode != 0) { + if(rcode == -EOPNOTSUPP ){ + printk(KERN_INFO"%s: Abort cmd not supported\n",pHba->name); + return FAILED; +@@ -697,10 +702,15 @@ static int adpt_device_reset(struct scsi + msg[2] = 0; + msg[3] = 0; + ++ if (pHba->host) ++ spin_lock_irq(pHba->host->host_lock); + old_state = d->state; + d->state |= DPTI_DEV_RESET; +- if( (rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER)) ){ +- d->state = old_state; ++ rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER); ++ d->state = old_state; ++ if (pHba->host) ++ spin_unlock_irq(pHba->host->host_lock); ++ if (rcode != 0) { + if(rcode == -EOPNOTSUPP ){ + printk(KERN_INFO"%s: Device reset not supported\n",pHba->name); + return FAILED; +@@ -708,7 +718,6 @@ static int adpt_device_reset(struct scsi + printk(KERN_INFO"%s: Device reset failed\n",pHba->name); + return FAILED; + } else { +- d->state = old_state; + printk(KERN_INFO"%s: Device reset successful\n",pHba->name); + return SUCCESS; + } +@@ -721,6 +730,7 @@ static int adpt_bus_reset(struct scsi_cm + { + adpt_hba* pHba; + u32 msg[4]; ++ u32 rcode; + + pHba = (adpt_hba*)cmd->device->host->hostdata[0]; + memset(msg, 0, sizeof(msg)); +@@ -729,7 +739,12 @@ static int adpt_bus_reset(struct scsi_cm + msg[1] = (I2O_HBA_BUS_RESET<<24|HOST_TID<<12|pHba->channel[cmd->device->channel].tid); + msg[2] = 0; + msg[3] = 0; +- if(adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER) ){ ++ if (pHba->host) ++ spin_lock_irq(pHba->host->host_lock); ++ rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER); ++ if (pHba->host) ++ spin_unlock_irq(pHba->host->host_lock); ++ if (rcode != 0) { + printk(KERN_WARNING"%s: Bus reset failed.\n",pHba->name); + return FAILED; + } else { + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:18 2005 +Message-Id: <20051223221318.487641000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:07 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, davem@davemloft.net, + herbert@gondor.apana.org.au +Subject: [patch 07/19] [GRE]: Fix hardware checksum modification +Content-Disposition: inline; filename=gre-fix-hardware-checksum-modification.patch +Status: RO +Content-Length: 1054 +Lines: 30 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Herbert Xu + +The skb_postpull_rcsum introduced a bug to the checksum modification. +Although the length pulled is offset bytes, the origin of the pulling +is the GRE header, not the IP header. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_gre.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.14.4.orig/net/ipv4/ip_gre.c ++++ linux-2.6.14.4/net/ipv4/ip_gre.c +@@ -617,7 +617,7 @@ static int ipgre_rcv(struct sk_buff *skb + + skb->mac.raw = skb->nh.raw; + skb->nh.raw = __pskb_pull(skb, offset); +- skb_postpull_rcsum(skb, skb->mac.raw, offset); ++ skb_postpull_rcsum(skb, skb->h.raw, offset); + memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options)); + skb->pkt_type = PACKET_HOST; + #ifdef CONFIG_NET_IPGRE_BROADCAST + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:18 2005 +Message-Id: <20051223221318.602677000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:08 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, davem@davemloft.net, shemminger@osdl.org +Subject: [patch 08/19] [VLAN]: Fix hardware rx csum errors +Content-Disposition: inline; filename=fix-vlan-checksumming.patch +Status: RO +Content-Length: 1036 +Lines: 31 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stephen Hemminger + +Receiving VLAN packets over a device (without VLAN assist) that is +doing hardware checksumming (CHECKSUM_HW), causes errors because the +VLAN code forgets to adjust the hardware checksum. + +Signed-off-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + net/8021q/vlan_dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- linux-2.6.14.4.orig/net/8021q/vlan_dev.c ++++ linux-2.6.14.4/net/8021q/vlan_dev.c +@@ -165,6 +165,9 @@ int vlan_skb_recv(struct sk_buff *skb, s + + skb_pull(skb, VLAN_HLEN); /* take off the VLAN header (4 bytes currently) */ + ++ /* Need to correct hardware checksum */ ++ skb_postpull_rcsum(skb, vhdr, VLAN_HLEN); ++ + /* Ok, lets check to make sure the device (dev) we + * came in on is what this VLAN is attached to. + */ + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:18 2005 +Message-Id: <20051223221318.772298000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:09 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, davem@davemloft.net, kaber@trash.net +Subject: [patch 09/19] [NETFILTER]: Fix NAT init order +Content-Disposition: inline; filename=fix-nat-init-order.patch +Status: RO +Content-Length: 1321 +Lines: 39 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Patrick McHardy + +As noticed by Phil Oester, the GRE NAT protocol helper is initialized +before the NAT core, which makes registration fail. + +Change the linking order to make NAT be initialized first. + +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/netfilter/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.14.4.orig/net/ipv4/netfilter/Makefile ++++ linux-2.6.14.4/net/ipv4/netfilter/Makefile +@@ -12,6 +12,7 @@ ip_nat_pptp-objs := ip_nat_helper_pptp.o + + # connection tracking + obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o ++obj-$(CONFIG_IP_NF_NAT) += ip_nat.o + + # conntrack netlink interface + obj-$(CONFIG_IP_NF_CONNTRACK_NETLINK) += ip_conntrack_netlink.o +@@ -41,7 +42,7 @@ obj-$(CONFIG_IP_NF_IPTABLES) += ip_table + # the three instances of ip_tables + obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o + obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o +-obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o ip_nat.o ++obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o + obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o + + # matches + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:18 2005 +Message-Id: <20051223221318.835498000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:10 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, davem@davemloft.net, kaber@trash.net +Subject: [patch 10/19] [NETFILTER]: Fix incorrect dependency for IP6_NF_TARGET_NFQUEUE +Content-Disposition: inline; filename=fix-incorrect-dependency-for-IP6_NF_TARGET_NFQUEUE.patch +Status: RO +Content-Length: 835 +Lines: 28 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Patrick McHardy + +IP6_NF_TARGET_NFQUEUE depends on IP6_NF_IPTABLES, not IP_NF_IPTABLES. + +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/netfilter/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.14.4.orig/net/ipv6/netfilter/Kconfig ++++ linux-2.6.14.4/net/ipv6/netfilter/Kconfig +@@ -211,7 +211,7 @@ config IP6_NF_TARGET_REJECT + + config IP6_NF_TARGET_NFQUEUE + tristate "NFQUEUE Target Support" +- depends on IP_NF_IPTABLES ++ depends on IP6_NF_IPTABLES + help + This Target replaced the old obsolete QUEUE target. + + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:19 2005 +Message-Id: <20051223221318.951748000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:11 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, davem@davemloft.net, + kristian.slavov@nomadiclab.com, hadi@cyberus.ca, kaber@trash.net +Subject: [patch 11/19] [RTNETLINK]: Fix RTNLGRP definitions in rtnetlink.h +Content-Disposition: inline; filename=rtnetlink-fix-RTNLGRP-definitions-in-rtnetlink.h.patch +Status: RO +Content-Length: 1648 +Lines: 47 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kristian Slavov + +I reported a problem and gave hints to the solution, but nobody seemed +to react. So I prepared a patch against 2.6.14.4. + +Tested on 2.6.14.4 with "ip monitor addr" and with the program +attached, while adding and removing IPv6 address. Both programs didn't +receive any messages. Tested 2.6.14.4 + this patch, and both programs +received add and remove messages. + +Signed-off-by: Kristian Slavov +Acked-by: Jamal Hadi salim +ACKed-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/rtnetlink.h | 4 ++++ + 1 file changed, 4 insertions(+) + +--- linux-2.6.14.4.orig/include/linux/rtnetlink.h ++++ linux-2.6.14.4/include/linux/rtnetlink.h +@@ -866,6 +866,7 @@ enum rtnetlink_groups { + #define RTNLGRP_IPV4_MROUTE RTNLGRP_IPV4_MROUTE + RTNLGRP_IPV4_ROUTE, + #define RTNLGRP_IPV4_ROUTE RTNLGRP_IPV4_ROUTE ++ RTNLGRP_NOP1, + RTNLGRP_IPV6_IFADDR, + #define RTNLGRP_IPV6_IFADDR RTNLGRP_IPV6_IFADDR + RTNLGRP_IPV6_MROUTE, +@@ -876,8 +877,11 @@ enum rtnetlink_groups { + #define RTNLGRP_IPV6_IFINFO RTNLGRP_IPV6_IFINFO + RTNLGRP_DECnet_IFADDR, + #define RTNLGRP_DECnet_IFADDR RTNLGRP_DECnet_IFADDR ++ RTNLGRP_NOP2, + RTNLGRP_DECnet_ROUTE, + #define RTNLGRP_DECnet_ROUTE RTNLGRP_DECnet_ROUTE ++ RTNLGRP_NOP3, ++ RTNLGRP_NOP4, + RTNLGRP_IPV6_PREFIX, + #define RTNLGRP_IPV6_PREFIX RTNLGRP_IPV6_PREFIX + __RTNLGRP_MAX + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:19 2005 +Message-Id: <20051223221319.067032000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:12 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, davem@davemloft.net, bdschuym@pandora.be +Subject: [patch 12/19] [BRIDGE-NF]: Fix bridge-nf ipv6 length check +Content-Disposition: inline; filename=fix-bridge-nf-ipv6-length-check.patch +Status: RO +Content-Length: 1760 +Lines: 57 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Bart De Schuymer + +A typo caused some bridged IPv6 packets to get dropped randomly, +as reported by Sebastien Chaumontet. The patch below fixes this +(using skb->nh.raw instead of raw) and also makes the jumbo packet +length checking up-to-date with the code in +net/ipv6/exthdrs.c::ipv6_hop_jumbo. + +Signed-off-by: Bart De Schuymer +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_netfilter.c | 17 +++++++---------- + 1 file changed, 7 insertions(+), 10 deletions(-) + +--- linux-2.6.14.4.orig/net/bridge/br_netfilter.c ++++ linux-2.6.14.4/net/bridge/br_netfilter.c +@@ -295,7 +295,7 @@ static int check_hbh_len(struct sk_buff + len -= 2; + + while (len > 0) { +- int optlen = raw[off+1]+2; ++ int optlen = skb->nh.raw[off+1]+2; + + switch (skb->nh.raw[off]) { + case IPV6_TLV_PAD0: +@@ -308,18 +308,15 @@ static int check_hbh_len(struct sk_buff + case IPV6_TLV_JUMBO: + if (skb->nh.raw[off+1] != 4 || (off&3) != 2) + goto bad; +- + pkt_len = ntohl(*(u32*)(skb->nh.raw+off+2)); +- ++ if (pkt_len <= IPV6_MAXPLEN || ++ skb->nh.ipv6h->payload_len) ++ goto bad; + if (pkt_len > skb->len - sizeof(struct ipv6hdr)) + goto bad; +- if (pkt_len + sizeof(struct ipv6hdr) < skb->len) { +- if (__pskb_trim(skb, +- pkt_len + sizeof(struct ipv6hdr))) +- goto bad; +- if (skb->ip_summed == CHECKSUM_HW) +- skb->ip_summed = CHECKSUM_NONE; +- } ++ if (pskb_trim_rcsum(skb, ++ pkt_len+sizeof(struct ipv6hdr))) ++ goto bad; + break; + default: + if (optlen > len) + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:19 2005 +Message-Id: <20051223221319.184615000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:13 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, davem@davemloft.net, yoshfuji@linux-ipv6.org +Subject: [patch 13/19] [IPV6]: Fix route lifetime. +Content-Disposition: inline; filename=ipv6-fix-route-lifetime.patch +Status: RO +Content-Length: 2475 +Lines: 73 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: YOSHIFUJI Hideaki + +The route expiration time is stored in rt6i_expires in jiffies. +The argument of rt6_route_add() for adding a route is not the +expiration time in jiffies nor in clock_t, but the lifetime +(or time left before expiration) in clock_t. + +Because of the confusion, we sometimes saw several strange errors +(FAILs) in TAHI IPv6 Ready Logo Phase-2 Self Test. +The symptoms were analyzed by Mitsuru Chinen . + +Signed-off-by: YOSHIFUJI Hideaki +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrconf.c | 16 ++++++++++++---- + net/ipv6/route.c | 2 +- + 2 files changed, 13 insertions(+), 5 deletions(-) + +--- linux-2.6.14.4.orig/net/ipv6/addrconf.c ++++ linux-2.6.14.4/net/ipv6/addrconf.c +@@ -1456,9 +1456,17 @@ void addrconf_prefix_rcv(struct net_devi + not good. + */ + if (valid_lft >= 0x7FFFFFFF/HZ) +- rt_expires = 0; ++ rt_expires = 0x7FFFFFFF - (0x7FFFFFFF % HZ); + else +- rt_expires = jiffies + valid_lft * HZ; ++ rt_expires = valid_lft * HZ; ++ ++ /* ++ * We convert this (in jiffies) to clock_t later. ++ * Avoid arithmetic overflow there as well. ++ * Overflow can happen only if HZ < USER_HZ. ++ */ ++ if (HZ < USER_HZ && rt_expires > 0x7FFFFFFF / USER_HZ) ++ rt_expires = 0x7FFFFFFF / USER_HZ; + + if (pinfo->onlink) { + struct rt6_info *rt; +@@ -1470,12 +1478,12 @@ void addrconf_prefix_rcv(struct net_devi + ip6_del_rt(rt, NULL, NULL, NULL); + rt = NULL; + } else { +- rt->rt6i_expires = rt_expires; ++ rt->rt6i_expires = jiffies + rt_expires; + } + } + } else if (valid_lft) { + addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len, +- dev, rt_expires, RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT); ++ dev, jiffies_to_clock_t(rt_expires), RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT); + } + if (rt) + dst_release(&rt->u.dst); +--- linux-2.6.14.4.orig/net/ipv6/route.c ++++ linux-2.6.14.4/net/ipv6/route.c +@@ -829,7 +829,7 @@ int ip6_route_add(struct in6_rtmsg *rtms + } + + rt->u.dst.obsolete = -1; +- rt->rt6i_expires = clock_t_to_jiffies(rtmsg->rtmsg_info); ++ rt->rt6i_expires = jiffies + clock_t_to_jiffies(rtmsg->rtmsg_info); + if (nlh && (r = NLMSG_DATA(nlh))) { + rt->rt6i_protocol = r->rtm_protocol; + } else { + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:19 2005 +Message-Id: <20051223221319.300479000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:14 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, davem@davemloft.net +Subject: [patch 14/19] [IPSEC]: Perform SA switchover immediately. +Content-Disposition: inline; filename=ipsec-perform-SA-switchover-immediately.patch +Status: RO +Content-Length: 2456 +Lines: 89 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: "David S. Miller" + +When we insert a new xfrm_state which potentially +subsumes an existing one, make sure all cached +bundles are flushed so that the new SA is used +immediately. + +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + include/net/xfrm.h | 1 + + net/xfrm/xfrm_policy.c | 19 ++++++++++++++----- + net/xfrm/xfrm_state.c | 5 +++++ + 3 files changed, 20 insertions(+), 5 deletions(-) + +--- linux-2.6.14.4.orig/include/net/xfrm.h ++++ linux-2.6.14.4/include/net/xfrm.h +@@ -890,6 +890,7 @@ struct xfrm_state * xfrm_find_acq(u8 mod + extern void xfrm_policy_flush(void); + extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); + extern int xfrm_flush_bundles(void); ++extern void xfrm_flush_all_bundles(void); + extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family); + extern void xfrm_init_pmtu(struct dst_entry *dst); + +--- linux-2.6.14.4.orig/net/xfrm/xfrm_policy.c ++++ linux-2.6.14.4/net/xfrm/xfrm_policy.c +@@ -1014,13 +1014,12 @@ int __xfrm_route_forward(struct sk_buff + } + EXPORT_SYMBOL(__xfrm_route_forward); + +-/* Optimize later using cookies and generation ids. */ +- + static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie) + { +- if (!stale_bundle(dst)) +- return dst; +- ++ /* If it is marked obsolete, which is how we even get here, ++ * then we have purged it from the policy bundle list and we ++ * did that for a good reason. ++ */ + return NULL; + } + +@@ -1104,6 +1103,16 @@ int xfrm_flush_bundles(void) + return 0; + } + ++static int always_true(struct dst_entry *dst) ++{ ++ return 1; ++} ++ ++void xfrm_flush_all_bundles(void) ++{ ++ xfrm_prune_bundles(always_true); ++} ++ + void xfrm_init_pmtu(struct dst_entry *dst) + { + do { +--- linux-2.6.14.4.orig/net/xfrm/xfrm_state.c ++++ linux-2.6.14.4/net/xfrm/xfrm_state.c +@@ -435,6 +435,8 @@ void xfrm_state_insert(struct xfrm_state + spin_lock_bh(&xfrm_state_lock); + __xfrm_state_insert(x); + spin_unlock_bh(&xfrm_state_lock); ++ ++ xfrm_flush_all_bundles(); + } + EXPORT_SYMBOL(xfrm_state_insert); + +@@ -482,6 +484,9 @@ out: + spin_unlock_bh(&xfrm_state_lock); + xfrm_state_put_afinfo(afinfo); + ++ if (!err) ++ xfrm_flush_all_bundles(); ++ + if (x1) { + xfrm_state_delete(x1); + xfrm_state_put(x1); + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:19 2005 +Message-Id: <20051223221319.415343000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:15 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, dtor@mail.ru, vojtech@suse.cz +Subject: [patch 15/19] [PATCH] Input: fix an OOPS in HID driver +Content-Disposition: inline; filename=input-fix-an-OOPS-in-HID-driver.patch +Status: RO +Content-Length: 861 +Lines: 28 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Dmitry Torokhov + +This patch fixes an OOPS in HID driver when connecting simulation +devices generating unknown simulation events. + +Signed-off-by: Dmitry Torokhov +Acked-by: Vojtech Pavlik +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/input/hid-input.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.14.4.orig/drivers/usb/input/hid-input.c ++++ linux-2.6.14.4/drivers/usb/input/hid-input.c +@@ -137,6 +137,7 @@ static void hidinput_configure_usage(str + switch (usage->hid & 0xffff) { + case 0xba: map_abs(ABS_RUDDER); break; + case 0xbb: map_abs(ABS_THROTTLE); break; ++ default: goto ignore; + } + break; + + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:19 2005 +Message-Id: <20051223221319.554227000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:16 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, jason.wessel@windriver.com, bunk@stusta.de +Subject: [patch 16/19] kernel/params.c: fix sysfs access with CONFIG_MODULES=n +Content-Disposition: inline; filename=kernel-params.c-fix-sysfs-access-with-config_modules-n.patch +Status: RO +Content-Length: 1121 +Lines: 36 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jason Wessel + +All the work was done to setup the file and maintain the file handles but +the access functions were zeroed out due to the #ifdef. Removing the +#ifdef allows full access to all the parameters when CONFIG_MODULES=n. + +akpm: put it back again, but use CONFIG_SYSFS instead. + +This patch has already been included in Linus' tree. + + +Signed-off-by: Jason Wessel +Signed-off-by: Andrew Morton +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/params.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.14.4.orig/kernel/params.c ++++ linux-2.6.14.4/kernel/params.c +@@ -618,7 +618,7 @@ static void __init param_sysfs_builtin(v + + + /* module-related sysfs stuff */ +-#ifdef CONFIG_MODULES ++#ifdef CONFIG_SYSFS + + #define to_module_attr(n) container_of(n, struct module_attribute, attr); + #define to_module_kobject(n) container_of(n, struct module_kobject, kobj); + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:19 2005 +Message-Id: <20051223221319.727051000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:17 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, James.Bottomley@SteelEye.com, + stefanr@s5r6.in-berlin.de, linux-scsi@vger.kernel.org +Subject: [patch 17/19] SCSI: fix transfer direction in sd (kernel panic when ejecting iPod) +Content-Disposition: inline; filename=scsi-fix-transfer-direction-in-sd.patch +Status: RO +Content-Length: 3299 +Lines: 96 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stefan Richter + +SCSI: fix transfer direction in sd (kernel panic when ejecting iPod) + +sd_init_command could issue WRITE requests with zero buffer length. +This may lead to kernel panic or oops with some SCSI low-level drivers. +Seen with the command "eject /dev/sdX" when disconnecting an iPod: +http://marc.theaimsgroup.com/?l=linux1394-devel&m=113399994920181 +http://marc.theaimsgroup.com/?l=linux1394-user&m=112152701817435 + +Derived from -rc patches from Jens Axboe and James Bottomley. + +Patch is reassembled for -stable from patches: +[SCSI] fix panic when ejecting ieee1394 ipod +[SCSI] Consolidate REQ_BLOCK_PC handling path (fix ipod panic) + + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_lib.c | 20 ++++++++++++++++++++ + drivers/scsi/sd.c | 16 +--------------- + include/scsi/scsi_cmnd.h | 1 + + 3 files changed, 22 insertions(+), 15 deletions(-) + +--- linux-2.6.14.4.orig/drivers/scsi/scsi_lib.c ++++ linux-2.6.14.4/drivers/scsi/scsi_lib.c +@@ -1129,6 +1129,26 @@ static void scsi_generic_done(struct scs + scsi_io_completion(cmd, cmd->result == 0 ? cmd->bufflen : 0, 0); + } + ++void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd, int retries) ++{ ++ struct request *req = cmd->request; ++ ++ BUG_ON(sizeof(req->cmd) > sizeof(cmd->cmnd)); ++ memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd)); ++ cmd->cmd_len = req->cmd_len; ++ if (!req->data_len) ++ cmd->sc_data_direction = DMA_NONE; ++ else if (rq_data_dir(req) == WRITE) ++ cmd->sc_data_direction = DMA_TO_DEVICE; ++ else ++ cmd->sc_data_direction = DMA_FROM_DEVICE; ++ ++ cmd->transfersize = req->data_len; ++ cmd->allowed = retries; ++ cmd->timeout_per_command = req->timeout; ++} ++EXPORT_SYMBOL_GPL(scsi_setup_blk_pc_cmnd); ++ + static int scsi_prep_fn(struct request_queue *q, struct request *req) + { + struct scsi_device *sdev = q->queuedata; +--- linux-2.6.14.4.orig/drivers/scsi/sd.c ++++ linux-2.6.14.4/drivers/scsi/sd.c +@@ -231,24 +231,10 @@ static int sd_init_command(struct scsi_c + * SG_IO from block layer already setup, just copy cdb basically + */ + if (blk_pc_request(rq)) { +- if (sizeof(rq->cmd) > sizeof(SCpnt->cmnd)) +- return 0; +- +- memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd)); +- SCpnt->cmd_len = rq->cmd_len; +- if (rq_data_dir(rq) == WRITE) +- SCpnt->sc_data_direction = DMA_TO_DEVICE; +- else if (rq->data_len) +- SCpnt->sc_data_direction = DMA_FROM_DEVICE; +- else +- SCpnt->sc_data_direction = DMA_NONE; +- +- this_count = rq->data_len; ++ scsi_setup_blk_pc_cmnd(SCpnt, SD_PASSTHROUGH_RETRIES); + if (rq->timeout) + timeout = rq->timeout; + +- SCpnt->transfersize = rq->data_len; +- SCpnt->allowed = SD_PASSTHROUGH_RETRIES; + goto queue; + } + +--- linux-2.6.14.4.orig/include/scsi/scsi_cmnd.h ++++ linux-2.6.14.4/include/scsi/scsi_cmnd.h +@@ -150,5 +150,6 @@ extern struct scsi_cmnd *scsi_get_comman + extern void scsi_put_command(struct scsi_cmnd *); + extern void scsi_io_completion(struct scsi_cmnd *, unsigned int, unsigned int); + extern void scsi_finish_command(struct scsi_cmnd *cmd); ++extern void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd, int retries); + + #endif /* _SCSI_SCSI_CMND_H */ + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:19 2005 +Message-Id: <20051223221319.796879000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:18 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, linux-scsi@vger.kernel.org, + James.Bottomley@SteelEye.com, stefanr@s5r6.in-berlin.de +Subject: [patch 18/19] SCSI: fix transfer direction in scsi_lib and st +Content-Disposition: inline; filename=scsi-fix-transfer-direction-in-scsi_lib-and-st.patch +Status: RO +Content-Length: 3467 +Lines: 116 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stefan Richter + +SCSI: fix transfer direction in scsi_lib and st + +scsi_prep_fn and st_init_command could issue WRITE requests with zero +buffer length. This may lead to kernel panic or oops with some SCSI +low-level drivers. + +Derived from -rc patches from Jens Axboe and James Bottomley. + +Patch is reassembled for -stable from patches: +[SCSI] fix panic when ejecting ieee1394 ipod +[SCSI] Consolidate REQ_BLOCK_PC handling path (fix ipod panic) + +Depends on patch "SCSI: fix transfer direction in sd (kernel panic when +ejecting iPod)". Also modifies the already correct sr_init_command to +fully match the corresponding -rc patch. + + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_lib.c | 13 +------------ + drivers/scsi/sr.c | 20 +++----------------- + drivers/scsi/st.c | 19 +------------------ + 3 files changed, 5 insertions(+), 47 deletions(-) + +--- linux-2.6.14.4.orig/drivers/scsi/scsi_lib.c ++++ linux-2.6.14.4/drivers/scsi/scsi_lib.c +@@ -1284,18 +1284,7 @@ static int scsi_prep_fn(struct request_q + goto kill; + } + } else { +- memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd)); +- cmd->cmd_len = req->cmd_len; +- if (rq_data_dir(req) == WRITE) +- cmd->sc_data_direction = DMA_TO_DEVICE; +- else if (req->data_len) +- cmd->sc_data_direction = DMA_FROM_DEVICE; +- else +- cmd->sc_data_direction = DMA_NONE; +- +- cmd->transfersize = req->data_len; +- cmd->allowed = 3; +- cmd->timeout_per_command = req->timeout; ++ scsi_setup_blk_pc_cmnd(cmd, 3); + cmd->done = scsi_generic_done; + } + } +--- linux-2.6.14.4.orig/drivers/scsi/sr.c ++++ linux-2.6.14.4/drivers/scsi/sr.c +@@ -320,25 +320,11 @@ static int sr_init_command(struct scsi_c + * these are already setup, just copy cdb basically + */ + if (SCpnt->request->flags & REQ_BLOCK_PC) { +- struct request *rq = SCpnt->request; ++ scsi_setup_blk_pc_cmnd(SCpnt, MAX_RETRIES); + +- if (sizeof(rq->cmd) > sizeof(SCpnt->cmnd)) +- return 0; +- +- memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd)); +- SCpnt->cmd_len = rq->cmd_len; +- if (!rq->data_len) +- SCpnt->sc_data_direction = DMA_NONE; +- else if (rq_data_dir(rq) == WRITE) +- SCpnt->sc_data_direction = DMA_TO_DEVICE; +- else +- SCpnt->sc_data_direction = DMA_FROM_DEVICE; +- +- this_count = rq->data_len; +- if (rq->timeout) +- timeout = rq->timeout; ++ if (SCpnt->timeout_per_command) ++ timeout = SCpnt->timeout_per_command; + +- SCpnt->transfersize = rq->data_len; + goto queue; + } + +--- linux-2.6.14.4.orig/drivers/scsi/st.c ++++ linux-2.6.14.4/drivers/scsi/st.c +@@ -4196,27 +4196,10 @@ static void st_intr(struct scsi_cmnd *SC + */ + static int st_init_command(struct scsi_cmnd *SCpnt) + { +- struct request *rq; +- + if (!(SCpnt->request->flags & REQ_BLOCK_PC)) + return 0; + +- rq = SCpnt->request; +- if (sizeof(rq->cmd) > sizeof(SCpnt->cmnd)) +- return 0; +- +- memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd)); +- SCpnt->cmd_len = rq->cmd_len; +- +- if (rq_data_dir(rq) == WRITE) +- SCpnt->sc_data_direction = DMA_TO_DEVICE; +- else if (rq->data_len) +- SCpnt->sc_data_direction = DMA_FROM_DEVICE; +- else +- SCpnt->sc_data_direction = DMA_NONE; +- +- SCpnt->timeout_per_command = rq->timeout; +- SCpnt->transfersize = rq->data_len; ++ scsi_setup_blk_pc_cmnd(SCpnt, 0); + SCpnt->done = st_intr; + return 1; + } + +-- + +From greg@press.kroah.org Fri Dec 23 14:13:20 2005 +Message-Id: <20051223221319.913124000@press.kroah.org> +References: <20051223221200.342826000@press.kroah.org> +Date: Fri, 23 Dec 2005 14:12:19 -0800 +From: Greg Kroah-Hartman +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, mason@suse.de, agruen@suse.de, + mawa@uni-freiburg.de, Trond.Myklebust@netapp.com +Subject: [patch 19/19] setting ACLs on readonly mounted NFS filesystems (CVE-2005-3623) +Content-Disposition: inline; filename=setting-acls-on-readonly-mounted-nfs-filesystems.patch +Status: RO +Content-Length: 1388 +Lines: 43 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andreas Gruenbacher + +We must check for MAY_SATTR before setting acls, which includes +checking for read-only exports: the lower-level setxattr operation +that eventually sets the acl cannot check export-level restrictions. + +Bug reported by Martin Walter . + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs2acl.c | 2 +- + fs/nfsd/nfs3acl.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.14.4.orig/fs/nfsd/nfs2acl.c ++++ linux-2.6.14.4/fs/nfsd/nfs2acl.c +@@ -107,7 +107,7 @@ static int nfsacld_proc_setacl(struct sv + dprintk("nfsd: SETACL(2acl) %s\n", SVCFH_fmt(&argp->fh)); + + fh = fh_copy(&resp->fh, &argp->fh); +- nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP); ++ nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR); + + if (!nfserr) { + nfserr = nfserrno( nfsd_set_posix_acl( +--- linux-2.6.14.4.orig/fs/nfsd/nfs3acl.c ++++ linux-2.6.14.4/fs/nfsd/nfs3acl.c +@@ -101,7 +101,7 @@ static int nfsd3_proc_setacl(struct svc_ + int nfserr = 0; + + fh = fh_copy(&resp->fh, &argp->fh); +- nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP); ++ nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR); + + if (!nfserr) { + nfserr = nfserrno( nfsd_set_posix_acl( + +-- + diff --git a/queue/rtnetlink-fix-RTNLGRP-definitions-in-rtnetlink.h.patch b/review/rtnetlink-fix-RTNLGRP-definitions-in-rtnetlink.h.patch similarity index 100% rename from queue/rtnetlink-fix-RTNLGRP-definitions-in-rtnetlink.h.patch rename to review/rtnetlink-fix-RTNLGRP-definitions-in-rtnetlink.h.patch diff --git a/queue/scsi-fix-transfer-direction-in-scsi_lib-and-st.patch b/review/scsi-fix-transfer-direction-in-scsi_lib-and-st.patch similarity index 100% rename from queue/scsi-fix-transfer-direction-in-scsi_lib-and-st.patch rename to review/scsi-fix-transfer-direction-in-scsi_lib-and-st.patch diff --git a/queue/scsi-fix-transfer-direction-in-sd.patch b/review/scsi-fix-transfer-direction-in-sd.patch similarity index 100% rename from queue/scsi-fix-transfer-direction-in-sd.patch rename to review/scsi-fix-transfer-direction-in-sd.patch diff --git a/queue/series b/review/series similarity index 100% rename from queue/series rename to review/series diff --git a/queue/setting-acls-on-readonly-mounted-nfs-filesystems.patch b/review/setting-acls-on-readonly-mounted-nfs-filesystems.patch similarity index 100% rename from queue/setting-acls-on-readonly-mounted-nfs-filesystems.patch rename to review/setting-acls-on-readonly-mounted-nfs-filesystems.patch