From: Greg Kroah-Hartman Date: Mon, 21 Aug 2006 18:49:20 +0000 (-0700) Subject: start next 2.6.17 review cycle X-Git-Tag: v2.6.17.10~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f9ed720d1c1ba2af7b1374308e16bc97bdb2404d;p=thirdparty%2Fkernel%2Fstable-queue.git start next 2.6.17 review cycle --- diff --git a/queue-2.6.17/1394-fix-for-recently-added-firewire-patch-that-breaks-things-on-ppc.patch b/review-2.6.17/1394-fix-for-recently-added-firewire-patch-that-breaks-things-on-ppc.patch similarity index 100% rename from queue-2.6.17/1394-fix-for-recently-added-firewire-patch-that-breaks-things-on-ppc.patch rename to review-2.6.17/1394-fix-for-recently-added-firewire-patch-that-breaks-things-on-ppc.patch diff --git a/queue-2.6.17/disable-debugging-version-of-write_lock.patch b/review-2.6.17/disable-debugging-version-of-write_lock.patch similarity index 100% rename from queue-2.6.17/disable-debugging-version-of-write_lock.patch rename to review-2.6.17/disable-debugging-version-of-write_lock.patch diff --git a/queue-2.6.17/dm-bug-oops-fix.patch b/review-2.6.17/dm-bug-oops-fix.patch similarity index 100% rename from queue-2.6.17/dm-bug-oops-fix.patch rename to review-2.6.17/dm-bug-oops-fix.patch diff --git a/queue-2.6.17/fix-befs-slab-corruption.patch b/review-2.6.17/fix-befs-slab-corruption.patch similarity index 100% rename from queue-2.6.17/fix-befs-slab-corruption.patch rename to review-2.6.17/fix-befs-slab-corruption.patch diff --git a/queue-2.6.17/fix-ifla_address-handling.patch b/review-2.6.17/fix-ifla_address-handling.patch similarity index 100% rename from queue-2.6.17/fix-ifla_address-handling.patch rename to review-2.6.17/fix-ifla_address-handling.patch diff --git a/queue-2.6.17/fix-ipv4-routing-locking-bug.patch b/review-2.6.17/fix-ipv4-routing-locking-bug.patch similarity index 100% rename from queue-2.6.17/fix-ipv4-routing-locking-bug.patch rename to review-2.6.17/fix-ipv4-routing-locking-bug.patch diff --git a/queue-2.6.17/fix-timer-race-in-dst-gc-code.patch b/review-2.6.17/fix-timer-race-in-dst-gc-code.patch similarity index 100% rename from queue-2.6.17/fix-timer-race-in-dst-gc-code.patch rename to review-2.6.17/fix-timer-race-in-dst-gc-code.patch diff --git a/queue-2.6.17/have-ext3-reject-file-handles-with-bad-inode-numbers-early.patch b/review-2.6.17/have-ext3-reject-file-handles-with-bad-inode-numbers-early.patch similarity index 100% rename from queue-2.6.17/have-ext3-reject-file-handles-with-bad-inode-numbers-early.patch rename to review-2.6.17/have-ext3-reject-file-handles-with-bad-inode-numbers-early.patch diff --git a/queue-2.6.17/ia64-local-dos-with-corrupted-elfs.patch b/review-2.6.17/ia64-local-dos-with-corrupted-elfs.patch similarity index 100% rename from queue-2.6.17/ia64-local-dos-with-corrupted-elfs.patch rename to review-2.6.17/ia64-local-dos-with-corrupted-elfs.patch diff --git a/queue-2.6.17/ip_tables-fix-table-locking-in-ipt_do_table.patch b/review-2.6.17/ip_tables-fix-table-locking-in-ipt_do_table.patch similarity index 100% rename from queue-2.6.17/ip_tables-fix-table-locking-in-ipt_do_table.patch rename to review-2.6.17/ip_tables-fix-table-locking-in-ipt_do_table.patch diff --git a/queue-2.6.17/ipx-header-length-validation-needed.patch b/review-2.6.17/ipx-header-length-validation-needed.patch similarity index 100% rename from queue-2.6.17/ipx-header-length-validation-needed.patch rename to review-2.6.17/ipx-header-length-validation-needed.patch diff --git a/queue-2.6.17/kill-hash_highmem-from-route-cache-hash-sizing.patch b/review-2.6.17/kill-hash_highmem-from-route-cache-hash-sizing.patch similarity index 100% rename from queue-2.6.17/kill-hash_highmem-from-route-cache-hash-sizing.patch rename to review-2.6.17/kill-hash_highmem-from-route-cache-hash-sizing.patch diff --git a/review-2.6.17/mbox b/review-2.6.17/mbox new file mode 100644 index 00000000000..9e8c842f6dc --- /dev/null +++ b/review-2.6.17/mbox @@ -0,0 +1,1879 @@ +From greg@quad.kroah.org Mon Aug 21 11:39:51 2006 +Message-Id: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:18 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/20] 2.6.17-stable review +Status: RO +Content-Length: 738 +Lines: 18 + +This is the start of the stable review cycle for the next 2.6.17.y +release. There are 20 patches in this series, all will be posted as +a response to this one. If anyone has any issues with these being +applied, please let us know. If anyone is a maintainer of the proper +subsystem, and wants to add a Signed-off-by: line to the patch, please +respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Wed, Auguest 23, 18:00:00 UTC. Anything +received after that time might be too late. + +thanks, + +the -stable release team + +From greg@quad.kroah.org Mon Aug 21 11:39:51 2006 +Message-Id: <20060821183951.683191589@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Christoph Hellwig , + Eric Sandeen +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Eric Sandeen , + Greg Kroah-Hartman +Subject: [patch 01/20] Have ext3 reject file handles with bad inode numbers early +Content-Disposition: inline; filename=have-ext3-reject-file-handles-with-bad-inode-numbers-early.patch +Content-Length: 1752 +Lines: 67 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +blatantly ripped off from Neil Brown's ext2 patch. + + +Signed-off-by: Eric Sandeen +Acked-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext3/super.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +--- linux-2.6.17.8.orig/fs/ext3/super.c ++++ linux-2.6.17.8/fs/ext3/super.c +@@ -620,8 +620,48 @@ static struct super_operations ext3_sops + #endif + }; + ++static struct dentry *ext3_get_dentry(struct super_block *sb, void *vobjp) ++{ ++ __u32 *objp = vobjp; ++ unsigned long ino = objp[0]; ++ __u32 generation = objp[1]; ++ struct inode *inode; ++ struct dentry *result; ++ ++ if (ino != EXT3_ROOT_INO && ino < EXT3_FIRST_INO(sb)) ++ return ERR_PTR(-ESTALE); ++ if (ino > le32_to_cpu(EXT3_SB(sb)->s_es->s_inodes_count)) ++ return ERR_PTR(-ESTALE); ++ ++ /* iget isn't really right if the inode is currently unallocated!! ++ * ext3_read_inode currently does appropriate checks, but ++ * it might be "neater" to call ext3_get_inode first and check ++ * if the inode is valid..... ++ */ ++ inode = iget(sb, ino); ++ if (inode == NULL) ++ return ERR_PTR(-ENOMEM); ++ if (is_bad_inode(inode) ++ || (generation && inode->i_generation != generation) ++ ) { ++ /* we didn't find the right inode.. */ ++ iput(inode); ++ return ERR_PTR(-ESTALE); ++ } ++ /* now to find a dentry. ++ * If possible, get a well-connected one ++ */ ++ result = d_alloc_anon(inode); ++ if (!result) { ++ iput(inode); ++ return ERR_PTR(-ENOMEM); ++ } ++ return result; ++} ++ + static struct export_operations ext3_export_ops = { + .get_parent = ext3_get_parent, ++ .get_dentry = ext3_get_dentry, + }; + + enum { + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:51 2006 +Message-Id: <20060821183951.826004574@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Stephen Hemminger , + Greg Kroah-Hartman +Subject: [patch 02/20] sky2: phy power problem on 88e805x +Content-Disposition: inline; filename=sky2-phy-power-problem-on-88e805x.patch +Content-Length: 1118 +Lines: 39 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stephen Hemminger + +On the 88E805X chipsets (used in laptops), the PHY was not getting powered +out of shutdown properly. The variable reg1 was getting reused incorrectly. +This is probably the cause of the bug. + http://bugzilla.kernel.org/show_bug.cgi?id=6471 + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.17.8.orig/drivers/net/sky2.c ++++ linux-2.6.17.8/drivers/net/sky2.c +@@ -233,6 +233,8 @@ static void sky2_set_power_state(struct + if (hw->ports > 1) + reg1 |= PCI_Y2_PHY2_COMA; + } ++ sky2_pci_write32(hw, PCI_DEV_REG1, reg1); ++ udelay(100); + + if (hw->chip_id == CHIP_ID_YUKON_EC_U) { + sky2_write16(hw, B0_CTST, Y2_HW_WOL_ON); +@@ -243,8 +245,6 @@ static void sky2_set_power_state(struct + sky2_pci_write32(hw, PCI_DEV_REG5, 0); + } + +- sky2_pci_write32(hw, PCI_DEV_REG1, reg1); +- + break; + + case PCI_D3hot: + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:52 2006 +Message-Id: <20060821183951.965881860@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" , + Greg Kroah-Hartman +Subject: [patch 03/20] Kill HASH_HIGHMEM from route cache hash sizing +Content-Disposition: inline; filename=kill-hash_highmem-from-route-cache-hash-sizing.patch +Content-Length: 1204 +Lines: 40 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kirill Korotaev + +[IPV4]: Limit rt cache size properly. + +During OpenVZ stress testing we found that UDP traffic with random src +can generate too much excessive rt hash growing leading finally to OOM +and kernel panics. + +It was found that for 4GB i686 system (having 1048576 total pages and +225280 normal zone pages) kernel allocates the following route hash: +syslog: IP route cache hash table entries: 262144 (order: 8, 1048576 +bytes) => ip_rt_max_size = 4194304 entries, i.e. max rt size is +4194304 * 256b = 1Gb of RAM > normal_zone + +Attached the patch which removes HASH_HIGHMEM flag from +alloc_large_system_hash() call. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/route.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.17.8.orig/net/ipv4/route.c ++++ linux-2.6.17.8/net/ipv4/route.c +@@ -3144,7 +3144,7 @@ int __init ip_rt_init(void) + rhash_entries, + (num_physpages >= 128 * 1024) ? + 15 : 17, +- HASH_HIGHMEM, ++ 0, + &rt_hash_log, + &rt_hash_mask, + 0); + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:52 2006 +Message-Id: <20060821183952.107883692@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Dmitry Mishin , + Kirill Korotaev , + Alexey Kuznetsov , + "David S. Miller" , + Greg Kroah-Hartman +Subject: [patch 04/20] Fix timer race in dst GC code +Content-Disposition: inline; filename=fix-timer-race-in-dst-gc-code.patch +Content-Length: 2076 +Lines: 64 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Dmitry Mishin + +[NET]: add_timer -> mod_timer() in dst_run_gc() + +Patch from Dmitry Mishin : + +Replace add_timer() by mod_timer() in dst_run_gc +in order to avoid BUG message. + + CPU1 CPU2 +dst_run_gc() entered dst_run_gc() entered +spin_lock(&dst_lock) ..... +del_timer(&dst_gc_timer) fail to get lock + .... mod_timer() <--- puts + timer back + to the list +add_timer(&dst_gc_timer) <--- BUG because timer is in list already. + +Found during OpenVZ internal testing. + +At first we thought that it is OpenVZ specific as we +added dst_run_gc(0) call in dst_dev_event(), +but as Alexey pointed to me it is possible to trigger +this condition in mainstream kernel. + +F.e. timer has fired on CPU2, but the handler was preeempted +by an irq before dst_lock is tried. +Meanwhile, someone on CPU1 adds an entry to gc list and +starts the timer. +If CPU2 was preempted long enough, this timer can expire +simultaneously with resuming timer handler on CPU1, arriving +exactly to the situation described. + +Signed-off-by: Dmitry Mishin +Signed-off-by: Kirill Korotaev +Signed-off-by: Alexey Kuznetsov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/dst.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- linux-2.6.17.8.orig/net/core/dst.c ++++ linux-2.6.17.8/net/core/dst.c +@@ -95,12 +95,11 @@ static void dst_run_gc(unsigned long dum + dst_gc_timer_inc = DST_GC_INC; + dst_gc_timer_expires = DST_GC_MIN; + } +- dst_gc_timer.expires = jiffies + dst_gc_timer_expires; + #if RT_CACHE_DEBUG >= 2 + printk("dst_total: %d/%d %ld\n", + atomic_read(&dst_total), delayed, dst_gc_timer_expires); + #endif +- add_timer(&dst_gc_timer); ++ mod_timer(&dst_gc_timer, jiffies + dst_gc_timer_expires); + + out: + spin_unlock(&dst_lock); + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:52 2006 +Message-Id: <20060821183952.249022317@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" , + Greg Kroah-Hartman +Subject: [patch 05/20] Fix IFLA_ADDRESS handling +Content-Disposition: inline; filename=fix-ifla_address-handling.patch +Content-Length: 1484 +Lines: 54 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Miller + +[RTNETLINK]: Fix IFLA_ADDRESS handling. + +The ->set_mac_address handlers expect a pointer to a +sockaddr which contains the MAC address, whereas +IFLA_ADDRESS provides just the MAC address itself. + +So whip up a sockaddr to wrap around the netlink +attribute for the ->set_mac_address call. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/rtnetlink.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- linux-2.6.17.8.orig/net/core/rtnetlink.c ++++ linux-2.6.17.8/net/core/rtnetlink.c +@@ -395,6 +395,9 @@ static int do_setlink(struct sk_buff *sk + } + + if (ida[IFLA_ADDRESS - 1]) { ++ struct sockaddr *sa; ++ int len; ++ + if (!dev->set_mac_address) { + err = -EOPNOTSUPP; + goto out; +@@ -406,7 +409,17 @@ static int do_setlink(struct sk_buff *sk + if (ida[IFLA_ADDRESS - 1]->rta_len != RTA_LENGTH(dev->addr_len)) + goto out; + +- err = dev->set_mac_address(dev, RTA_DATA(ida[IFLA_ADDRESS - 1])); ++ len = sizeof(sa_family_t) + dev->addr_len; ++ sa = kmalloc(len, GFP_KERNEL); ++ if (!sa) { ++ err = -ENOMEM; ++ goto out; ++ } ++ sa->sa_family = dev->type; ++ memcpy(sa->sa_data, RTA_DATA(ida[IFLA_ADDRESS - 1]), ++ dev->addr_len); ++ err = dev->set_mac_address(dev, sa); ++ kfree(sa); + if (err) + goto out; + send_addr_notify = 1; + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:52 2006 +Message-Id: <20060821183952.389848998@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@osdl.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Diego Calleja , + Jens Kilian , + Greg Kroah-Hartman +Subject: [patch 06/20] Fix BeFS slab corruption +Content-Disposition: inline; filename=fix-befs-slab-corruption.patch +Content-Length: 2207 +Lines: 62 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Diego Calleja + +In bugzilla #6941, Jens Kilian reported: + +"The function befs_utf2nls (in fs/befs/linuxvfs.c) writes a 0 byte past the +end of a block of memory allocated via kmalloc(), leading to memory +corruption. This happens only for filenames which are pure ASCII and a +multiple of 4 bytes in length. [...] + +Without DEBUG_SLAB, this leads to further corruption and hard lockups; I +believe this is the bug which has made kernels later than 2.6.8 unusable +for me. (This must be due to changes in memory management, the bug has +been in the BeFS driver since the time it was introduced (AFAICT).) + +Steps to reproduce: +Create a directory (in BeOS, naturally :-) with files named, e.g., +"1", "22", "333", "4444", ... Mount it in Linux and do an "ls" or "find"" + +This patch implements the suggested fix. Credits to Jens Kilian for +debugging the problem and finding the right fix. + +Signed-off-by: Diego Calleja +Cc: Jens Kilian +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/befs/linuxvfs.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- linux-2.6.17.8.orig/fs/befs/linuxvfs.c ++++ linux-2.6.17.8/fs/befs/linuxvfs.c +@@ -512,7 +512,11 @@ befs_utf2nls(struct super_block *sb, con + wchar_t uni; + int unilen, utflen; + char *result; +- int maxlen = in_len; /* The utf8->nls conversion can't make more chars */ ++ /* The utf8->nls conversion won't make the final nls string bigger ++ * than the utf one, but if the string is pure ascii they'll have the ++ * same width and an extra char is needed to save the additional \0 ++ */ ++ int maxlen = in_len + 1; + + befs_debug(sb, "---> utf2nls()"); + +@@ -588,7 +592,10 @@ befs_nls2utf(struct super_block *sb, con + wchar_t uni; + int unilen, utflen; + char *result; +- int maxlen = 3 * in_len; ++ /* There're nls characters that will translate to 3-chars-wide UTF-8 ++ * characters, a additional byte is needed to save the final \0 ++ * in special cases */ ++ int maxlen = (3 * in_len) + 1; + + befs_debug(sb, "---> nls2utf()\n"); + + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:52 2006 +Message-Id: <20060821183952.533635218@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@osdl.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Ingo Molnar , + Greg Kroah-Hartman +Subject: [patch 07/20] disable debugging version of write_lock() +Content-Disposition: inline; filename=disable-debugging-version-of-write_lock.patch +Content-Length: 1917 +Lines: 72 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andrew Morton + +We've confirmed that the debug version of write_lock() can get stuck for long +enough to cause NMI watchdog timeouts and hence a crash. + +We don't know why, yet. Disable it for now. + +Also disable the similar read_lock() code. Just in case. + +Thanks to Dave Olson for reporting and testing. + +Acked-by: Ingo Molnar +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + lib/spinlock_debug.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- linux-2.6.17.8.orig/lib/spinlock_debug.c ++++ linux-2.6.17.8/lib/spinlock_debug.c +@@ -137,6 +137,7 @@ static void rwlock_bug(rwlock_t *lock, c + + #define RWLOCK_BUG_ON(cond, lock, msg) if (unlikely(cond)) rwlock_bug(lock, msg) + ++#if 0 /* __write_lock_debug() can lock up - maybe this can too? */ + static void __read_lock_debug(rwlock_t *lock) + { + int print_once = 1; +@@ -159,12 +160,12 @@ static void __read_lock_debug(rwlock_t * + } + } + } ++#endif + + void _raw_read_lock(rwlock_t *lock) + { + RWLOCK_BUG_ON(lock->magic != RWLOCK_MAGIC, lock, "bad magic"); +- if (unlikely(!__raw_read_trylock(&lock->raw_lock))) +- __read_lock_debug(lock); ++ __raw_read_lock(&lock->raw_lock); + } + + int _raw_read_trylock(rwlock_t *lock) +@@ -210,6 +211,7 @@ static inline void debug_write_unlock(rw + lock->owner_cpu = -1; + } + ++#if 0 /* This can cause lockups */ + static void __write_lock_debug(rwlock_t *lock) + { + int print_once = 1; +@@ -232,12 +234,12 @@ static void __write_lock_debug(rwlock_t + } + } + } ++#endif + + void _raw_write_lock(rwlock_t *lock) + { + debug_write_lock_before(lock); +- if (unlikely(!__raw_write_trylock(&lock->raw_lock))) +- __write_lock_debug(lock); ++ __raw_write_lock(&lock->raw_lock); + debug_write_lock_after(lock); + } + + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:52 2006 +Message-Id: <20060821183952.680112104@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + David Miller +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + netdev@vger.kernel.org, + acme@ghostprotocols.net, + Stephen Hemminger +Subject: [patch 08/20] ipx: header length validation needed +Content-Disposition: inline; filename=ipx-header-length-validation-needed.patch +Content-Length: 882 +Lines: 29 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stephen Hemminger + +This patch will linearize and check there is enough data. +It handles the pprop case as well as avoiding a whole audit of +the routing code. + +Signed-off-by: Stephen Hemminger + +--- + net/ipx/af_ipx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.17.8.orig/net/ipx/af_ipx.c ++++ linux-2.6.17.8/net/ipx/af_ipx.c +@@ -1647,7 +1647,8 @@ static int ipx_rcv(struct sk_buff *skb, + ipx_pktsize = ntohs(ipx->ipx_pktsize); + + /* Too small or invalid header? */ +- if (ipx_pktsize < sizeof(struct ipxhdr) || ipx_pktsize > skb->len) ++ if (ipx_pktsize < sizeof(struct ipxhdr) ++ || !pskb_may_pull(skb, ipx_pktsize)) + goto drop; + + if (ipx->ipx_checksum != IPX_NO_CHECKSUM && + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:52 2006 +Message-Id: <20060821183952.818275931@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Kylene Hall , + Greg Kroah-Hartman +Subject: [patch 09/20] tpm: interrupt clear fix +Content-Disposition: inline; filename=tpm-interrupt-clear-fix.patch +Content-Length: 802 +Lines: 27 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kylene Jo Hall + +Under stress testing I found that the interrupt is not always cleared. +This is a bug and this patch should go into 2.6.18 and 2.6.17.x. + +Signed-off-by: Kylene Hall +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_tis.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.17.8.orig/drivers/char/tpm/tpm_tis.c ++++ linux-2.6.17.8/drivers/char/tpm/tpm_tis.c +@@ -424,6 +424,7 @@ static irqreturn_t tis_int_handler(int i + iowrite32(interrupt, + chip->vendor.iobase + + TPM_INT_STATUS(chip->vendor.locality)); ++ ioread32(chip->vendor.iobase + TPM_INT_STATUS(chip->vendor.locality)); + return IRQ_HANDLED; + } + + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:53 2006 +Message-Id: <20060821183952.958397241@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Adrian Bunk , + Mark Huang , + Patrick McHardy , + Greg Kroah-Hartman +Subject: [patch 10/20] : ulog: fix panic on SMP kernels +Content-Disposition: inline; filename=ulog-fix-panic-on-smp-kernels.patch +Content-Length: 2114 +Lines: 67 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mark Huang + +[NETFILTER]: ulog: fix panic on SMP kernels + +Fix kernel panic on various SMP machines. The culprit is a null +ub->skb in ulog_send(). If ulog_timer() has already been scheduled on +one CPU and is spinning on the lock, and ipt_ulog_packet() flushes the +queue on another CPU by calling ulog_send() right before it exits, +there will be no skbuff when ulog_timer() acquires the lock and calls +ulog_send(). Cancelling the timer in ulog_send() doesn't help because +it has already been scheduled and is running on the first CPU. + +Similar problem exists in ebt_ulog.c and nfnetlink_log.c. + +Signed-off-by: Mark Huang +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/bridge/netfilter/ebt_ulog.c | 3 +++ + net/ipv4/netfilter/ipt_ULOG.c | 5 +++++ + net/netfilter/nfnetlink_log.c | 3 +++ + 3 files changed, 11 insertions(+) + +--- linux-2.6.17.9.orig/net/bridge/netfilter/ebt_ulog.c ++++ linux-2.6.17.9/net/bridge/netfilter/ebt_ulog.c +@@ -75,6 +75,9 @@ static void ulog_send(unsigned int nlgro + if (timer_pending(&ub->timer)) + del_timer(&ub->timer); + ++ if (!ub->skb) ++ return; ++ + /* last nlmsg needs NLMSG_DONE */ + if (ub->qlen > 1) + ub->lastnlh->nlmsg_type = NLMSG_DONE; +--- linux-2.6.17.9.orig/net/ipv4/netfilter/ipt_ULOG.c ++++ linux-2.6.17.9/net/ipv4/netfilter/ipt_ULOG.c +@@ -116,6 +116,11 @@ static void ulog_send(unsigned int nlgro + del_timer(&ub->timer); + } + ++ if (!ub->skb) { ++ DEBUGP("ipt_ULOG: ulog_send: nothing to send\n"); ++ return; ++ } ++ + /* last nlmsg needs NLMSG_DONE */ + if (ub->qlen > 1) + ub->lastnlh->nlmsg_type = NLMSG_DONE; +--- linux-2.6.17.9.orig/net/netfilter/nfnetlink_log.c ++++ linux-2.6.17.9/net/netfilter/nfnetlink_log.c +@@ -366,6 +366,9 @@ __nfulnl_send(struct nfulnl_instance *in + if (timer_pending(&inst->timer)) + del_timer(&inst->timer); + ++ if (!inst->skb) ++ return 0; ++ + if (inst->qlen > 1) + inst->lastnlh->nlmsg_type = NLMSG_DONE; + + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:53 2006 +Message-Id: <20060821183953.101027612@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + dev@openvz.org, + haveblue@us.ibm.com, + dev@sw.ru, + oleg@tv-sign.ru, + Greg Kroah-Hartman +Subject: [patch 11/20] sys_getppid oopses on debug kernel +Content-Disposition: inline; filename=sys_getppid-oopses-on-debug-kernel.patch +Content-Length: 2427 +Lines: 81 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kirill Korotaev + +sys_getppid() optimization can access a freed memory. On kernels with +DEBUG_SLAB turned ON, this results in Oops. As Dave Hansen noted, this +optimization is also unsafe for memory hotplug. + +So this patch always takes the lock to be safe. + +[oleg@tv-sign.ru: simplifications] + +Signed-off-by: Kirill Korotaev +Cc: Dave Hansen +Signed-off-by: Oleg Nesterov +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/timer.c | 41 +++++++---------------------------------- + 1 file changed, 7 insertions(+), 34 deletions(-) + +--- linux-2.6.17.9.orig/kernel/timer.c ++++ linux-2.6.17.9/kernel/timer.c +@@ -975,46 +975,19 @@ asmlinkage long sys_getpid(void) + } + + /* +- * Accessing ->group_leader->real_parent is not SMP-safe, it could +- * change from under us. However, rather than getting any lock +- * we can use an optimistic algorithm: get the parent +- * pid, and go back and check that the parent is still +- * the same. If it has changed (which is extremely unlikely +- * indeed), we just try again.. +- * +- * NOTE! This depends on the fact that even if we _do_ +- * get an old value of "parent", we can happily dereference +- * the pointer (it was and remains a dereferencable kernel pointer +- * no matter what): we just can't necessarily trust the result +- * until we know that the parent pointer is valid. +- * +- * NOTE2: ->group_leader never changes from under us. ++ * Accessing ->real_parent is not SMP-safe, it could ++ * change from under us. However, we can use a stale ++ * value of ->real_parent under rcu_read_lock(), see ++ * release_task()->call_rcu(delayed_put_task_struct). + */ + asmlinkage long sys_getppid(void) + { + int pid; +- struct task_struct *me = current; +- struct task_struct *parent; + +- parent = me->group_leader->real_parent; +- for (;;) { +- pid = parent->tgid; +-#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT) +-{ +- struct task_struct *old = parent; ++ rcu_read_lock(); ++ pid = rcu_dereference(current->real_parent)->tgid; ++ rcu_read_unlock(); + +- /* +- * Make sure we read the pid before re-reading the +- * parent pointer: +- */ +- smp_rmb(); +- parent = me->group_leader->real_parent; +- if (old != parent) +- continue; +-} +-#endif +- break; +- } + return pid; + } + + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:53 2006 +Message-Id: <20060821183953.239986945@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + bunk@stusta.de, + maks@sternwelten.at +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Olaf Hering , + Greg Kroah-Hartman +Subject: [patch 12/20] SERIAL: icom: select FW_LOADER +Content-Disposition: inline; filename=serial-icom-select-fw_loader.patch +Content-Length: 827 +Lines: 29 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Olaf Hering + +The icom driver uses request_firmware() +and thus needs to select FW_LOADER. + +Signed-off-by: maximilian attems +Signed-off-by: Olaf Hering +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/serial/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.17.9.orig/drivers/serial/Kconfig ++++ linux-2.6.17.9/drivers/serial/Kconfig +@@ -803,6 +803,7 @@ config SERIAL_MPC52xx + tristate "Freescale MPC52xx family PSC serial support" + depends on PPC_MPC52xx + select SERIAL_CORE ++ select FW_LOADER + help + This drivers support the MPC52xx PSC serial ports. If you would + like to use them, you must answer Y or M to this option. Not that + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:53 2006 +Message-Id: <20060821183953.381397963@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH , + Andrew Morton +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Daniel Ritz +Subject: [patch 13/20] PCI: fix ICH6 quirks +Content-Disposition: inline; filename=pci-fix-ich6-quirks.patch +Content-Length: 1720 +Lines: 40 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Daniel Ritz + +[PATCH] PCI: fix ICH6 quirks + +- add the ICH6(R) LPC to the ICH6 ACPI quirks. currently only the ICH6-M is + handled. [ PCI_DEVICE_ID_INTEL_ICH6_1 is the ICH6-M LPC, ICH6_0 is the ICH6(R) ] +- remove the wrong quirk calling asus_hides_smbus_lpc() for ICH6. the register + modified in asus_hides_smbus_lpc() has a different meaning in ICH6. + +Signed-off-by: Daniel Ritz +Cc: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.17.9.orig/drivers/pci/quirks.c ++++ linux-2.6.17.9/drivers/pci/quirks.c +@@ -427,6 +427,7 @@ static void __devinit quirk_ich6_lpc_acp + pci_read_config_dword(dev, 0x48, ®ion); + quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES+1, "ICH6 GPIO"); + } ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_0, quirk_ich6_lpc_acpi ); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_1, quirk_ich6_lpc_acpi ); + + /* +@@ -1043,7 +1044,6 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801CA_12, asus_hides_smbus_lpc ); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801DB_12, asus_hides_smbus_lpc ); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801EB_0, asus_hides_smbus_lpc ); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_1, asus_hides_smbus_lpc ); + + static void __init asus_hides_smbus_lpc_ich6(struct pci_dev *dev) + { + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:53 2006 +Message-Id: <20060821183953.525133544@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Adrian Bunk , + Patrick McHardy , + Greg Kroah-Hartman +Subject: [patch 14/20] : ip_tables: fix table locking in ipt_do_table +Content-Disposition: inline; filename=ip_tables-fix-table-locking-in-ipt_do_table.patch +Content-Length: 1989 +Lines: 58 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Patrick McHardy + +[NETFILTER]: ip_tables: fix table locking in ipt_do_table + +table->private might change because of ruleset changes, don't use it without +holding the lock. + +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/netfilter/arp_tables.c | 3 ++- + net/ipv4/netfilter/ip_tables.c | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- linux-2.6.17.9.orig/net/ipv4/netfilter/arp_tables.c ++++ linux-2.6.17.9/net/ipv4/netfilter/arp_tables.c +@@ -237,7 +237,7 @@ unsigned int arpt_do_table(struct sk_buf + struct arpt_entry *e, *back; + const char *indev, *outdev; + void *table_base; +- struct xt_table_info *private = table->private; ++ struct xt_table_info *private; + + /* ARP header, plus 2 device addresses, plus 2 IP addresses. */ + if (!pskb_may_pull((*pskb), (sizeof(struct arphdr) + +@@ -249,6 +249,7 @@ unsigned int arpt_do_table(struct sk_buf + outdev = out ? out->name : nulldevname; + + read_lock_bh(&table->lock); ++ private = table->private; + table_base = (void *)private->entries[smp_processor_id()]; + e = get_entry(table_base, private->hook_entry[hook]); + back = get_entry(table_base, private->underflow[hook]); +--- linux-2.6.17.9.orig/net/ipv4/netfilter/ip_tables.c ++++ linux-2.6.17.9/net/ipv4/netfilter/ip_tables.c +@@ -231,7 +231,7 @@ ipt_do_table(struct sk_buff **pskb, + const char *indev, *outdev; + void *table_base; + struct ipt_entry *e, *back; +- struct xt_table_info *private = table->private; ++ struct xt_table_info *private; + + /* Initialization */ + ip = (*pskb)->nh.iph; +@@ -248,6 +248,7 @@ ipt_do_table(struct sk_buff **pskb, + + read_lock_bh(&table->lock); + IP_NF_ASSERT(table->valid_hooks & (1 << hook)); ++ private = table->private; + table_base = (void *)private->entries[smp_processor_id()]; + e = get_entry(table_base, private->hook_entry[hook]); + + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:53 2006 +Message-Id: <20060821183953.663500743@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Pavel Emelianov , + Kirill Korotaev , + Greg Kroah-Hartman +Subject: [patch 15/20] IA64: local DoS with corrupted ELFs +Content-Disposition: inline; filename=ia64-local-dos-with-corrupted-elfs.patch +Status: RO +Content-Length: 7804 +Lines: 283 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kirill Korotaev + +This patch prevents cross-region mappings +on IA64 and SPARC which could lead to system crash. + +davem@ confirmed: "This looks fine to me." :) + +Signed-Off-By: Pavel Emelianov +Signed-Off-By: Kirill Korotaev +Signed-off-by: Greg Kroah-Hartman + + +--- + arch/ia64/kernel/sys_ia64.c | 28 ++++++++++++++++------------ + arch/sparc/kernel/sys_sparc.c | 27 +++++++++++++++------------ + arch/sparc64/kernel/sys_sparc.c | 36 ++++++++++++++++++++---------------- + include/asm-generic/mman.h | 6 ++++++ + include/asm-ia64/mman.h | 6 ++++++ + include/asm-sparc/mman.h | 6 ++++++ + include/asm-sparc64/mman.h | 6 ++++++ + mm/mmap.c | 13 +++++++++++-- + 8 files changed, 86 insertions(+), 42 deletions(-) + +--- linux-2.6.17.9.orig/arch/ia64/kernel/sys_ia64.c ++++ linux-2.6.17.9/arch/ia64/kernel/sys_ia64.c +@@ -164,10 +164,25 @@ sys_pipe (void) + return retval; + } + ++int ia64_map_check_rgn(unsigned long addr, unsigned long len, ++ unsigned long flags) ++{ ++ unsigned long roff; ++ ++ /* ++ * Don't permit mappings into unmapped space, the virtual page table ++ * of a region, or across a region boundary. Note: RGN_MAP_LIMIT is ++ * equal to 2^n-PAGE_SIZE (for some integer n <= 61) and len > 0. ++ */ ++ roff = REGION_OFFSET(addr); ++ if ((len > RGN_MAP_LIMIT) || (roff > (RGN_MAP_LIMIT - len))) ++ return -EINVAL; ++ return 0; ++} ++ + static inline unsigned long + do_mmap2 (unsigned long addr, unsigned long len, int prot, int flags, int fd, unsigned long pgoff) + { +- unsigned long roff; + struct file *file = NULL; + + flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE); +@@ -189,17 +204,6 @@ do_mmap2 (unsigned long addr, unsigned l + goto out; + } + +- /* +- * Don't permit mappings into unmapped space, the virtual page table of a region, +- * or across a region boundary. Note: RGN_MAP_LIMIT is equal to 2^n-PAGE_SIZE +- * (for some integer n <= 61) and len > 0. +- */ +- roff = REGION_OFFSET(addr); +- if ((len > RGN_MAP_LIMIT) || (roff > (RGN_MAP_LIMIT - len))) { +- addr = -EINVAL; +- goto out; +- } +- + down_write(¤t->mm->mmap_sem); + addr = do_mmap_pgoff(file, addr, len, prot, flags, pgoff); + up_write(¤t->mm->mmap_sem); +--- linux-2.6.17.9.orig/arch/sparc/kernel/sys_sparc.c ++++ linux-2.6.17.9/arch/sparc/kernel/sys_sparc.c +@@ -219,6 +219,21 @@ out: + return err; + } + ++int sparc_mmap_check(unsigned long addr, unsigned long len, unsigned long flags) ++{ ++ if (ARCH_SUN4C_SUN4 && ++ (len > 0x20000000 || ++ ((flags & MAP_FIXED) && ++ addr < 0xe0000000 && addr + len > 0x20000000))) ++ return -EINVAL; ++ ++ /* See asm-sparc/uaccess.h */ ++ if (len > TASK_SIZE - PAGE_SIZE || addr + len > TASK_SIZE - PAGE_SIZE) ++ return -EINVAL; ++ ++ return 0; ++} ++ + /* Linux version of mmap */ + static unsigned long do_mmap2(unsigned long addr, unsigned long len, + unsigned long prot, unsigned long flags, unsigned long fd, +@@ -233,25 +248,13 @@ static unsigned long do_mmap2(unsigned l + goto out; + } + +- retval = -EINVAL; + len = PAGE_ALIGN(len); +- if (ARCH_SUN4C_SUN4 && +- (len > 0x20000000 || +- ((flags & MAP_FIXED) && +- addr < 0xe0000000 && addr + len > 0x20000000))) +- goto out_putf; +- +- /* See asm-sparc/uaccess.h */ +- if (len > TASK_SIZE - PAGE_SIZE || addr + len > TASK_SIZE - PAGE_SIZE) +- goto out_putf; +- + flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE); + + down_write(¤t->mm->mmap_sem); + retval = do_mmap_pgoff(file, addr, len, prot, flags, pgoff); + up_write(¤t->mm->mmap_sem); + +-out_putf: + if (file) + fput(file); + out: +--- linux-2.6.17.9.orig/arch/sparc64/kernel/sys_sparc.c ++++ linux-2.6.17.9/arch/sparc64/kernel/sys_sparc.c +@@ -549,6 +549,26 @@ asmlinkage long sparc64_personality(unsi + return ret; + } + ++int sparc64_mmap_check(unsigned long addr, unsigned long len, ++ unsigned long flags) ++{ ++ if (test_thread_flag(TIF_32BIT)) { ++ if (len >= STACK_TOP32) ++ return -EINVAL; ++ ++ if ((flags & MAP_FIXED) && addr > STACK_TOP32 - len) ++ return -EINVAL; ++ } else { ++ if (len >= VA_EXCLUDE_START) ++ return -EINVAL; ++ ++ if ((flags & MAP_FIXED) && invalid_64bit_range(addr, len)) ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + /* Linux version of mmap */ + asmlinkage unsigned long sys_mmap(unsigned long addr, unsigned long len, + unsigned long prot, unsigned long flags, unsigned long fd, +@@ -564,27 +584,11 @@ asmlinkage unsigned long sys_mmap(unsign + } + flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE); + len = PAGE_ALIGN(len); +- retval = -EINVAL; +- +- if (test_thread_flag(TIF_32BIT)) { +- if (len >= STACK_TOP32) +- goto out_putf; +- +- if ((flags & MAP_FIXED) && addr > STACK_TOP32 - len) +- goto out_putf; +- } else { +- if (len >= VA_EXCLUDE_START) +- goto out_putf; +- +- if ((flags & MAP_FIXED) && invalid_64bit_range(addr, len)) +- goto out_putf; +- } + + down_write(¤t->mm->mmap_sem); + retval = do_mmap(file, addr, len, prot, flags, off); + up_write(¤t->mm->mmap_sem); + +-out_putf: + if (file) + fput(file); + out: +--- linux-2.6.17.9.orig/include/asm-generic/mman.h ++++ linux-2.6.17.9/include/asm-generic/mman.h +@@ -39,4 +39,10 @@ + #define MAP_ANON MAP_ANONYMOUS + #define MAP_FILE 0 + ++#ifdef __KERNEL__ ++#ifndef arch_mmap_check ++#define arch_mmap_check(addr, len, flags) (0) ++#endif ++#endif ++ + #endif +--- linux-2.6.17.9.orig/include/asm-ia64/mman.h ++++ linux-2.6.17.9/include/asm-ia64/mman.h +@@ -8,6 +8,12 @@ + * David Mosberger-Tang , Hewlett-Packard Co + */ + ++#ifdef __KERNEL__ ++#define arch_mmap_check ia64_map_check_rgn ++int ia64_map_check_rgn(unsigned long addr, unsigned long len, ++ unsigned long flags); ++#endif ++ + #include + + #define MAP_GROWSDOWN 0x00100 /* stack-like segment */ +--- linux-2.6.17.9.orig/include/asm-sparc/mman.h ++++ linux-2.6.17.9/include/asm-sparc/mman.h +@@ -2,6 +2,12 @@ + #ifndef __SPARC_MMAN_H__ + #define __SPARC_MMAN_H__ + ++#ifdef __KERNEL__ ++#define arch_mmap_check sparc_mmap_check ++int sparc_mmap_check(unsigned long addr, unsigned long len, ++ unsigned long flags); ++#endif ++ + #include + + /* SunOS'ified... */ +--- linux-2.6.17.9.orig/include/asm-sparc64/mman.h ++++ linux-2.6.17.9/include/asm-sparc64/mman.h +@@ -2,6 +2,12 @@ + #ifndef __SPARC64_MMAN_H__ + #define __SPARC64_MMAN_H__ + ++#ifdef __KERNEL__ ++#define arch_mmap_check sparc64_mmap_check ++int sparc64_mmap_check(unsigned long addr, unsigned long len, ++ unsigned long flags); ++#endif ++ + #include + + /* SunOS'ified... */ +--- linux-2.6.17.9.orig/mm/mmap.c ++++ linux-2.6.17.9/mm/mmap.c +@@ -913,6 +913,10 @@ unsigned long do_mmap_pgoff(struct file + if (!len) + return -EINVAL; + ++ error = arch_mmap_check(addr, len, flags); ++ if (error) ++ return error; ++ + /* Careful about overflows.. */ + len = PAGE_ALIGN(len); + if (!len || len > TASK_SIZE) +@@ -1852,6 +1856,7 @@ unsigned long do_brk(unsigned long addr, + unsigned long flags; + struct rb_node ** rb_link, * rb_parent; + pgoff_t pgoff = addr >> PAGE_SHIFT; ++ int error; + + len = PAGE_ALIGN(len); + if (!len) +@@ -1860,6 +1865,12 @@ unsigned long do_brk(unsigned long addr, + if ((addr + len) > TASK_SIZE || (addr + len) < addr) + return -EINVAL; + ++ flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags; ++ ++ error = arch_mmap_check(addr, len, flags); ++ if (error) ++ return error; ++ + /* + * mlock MCL_FUTURE? + */ +@@ -1900,8 +1911,6 @@ unsigned long do_brk(unsigned long addr, + if (security_vm_enough_memory(len >> PAGE_SHIFT)) + return -ENOMEM; + +- flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags; +- + /* Can we just expand an old private anonymous mapping? */ + if (vma_merge(mm, prev, addr, addr + len, flags, + NULL, NULL, pgoff, NULL)) + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:53 2006 +Message-Id: <20060821183953.809086225@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Alexey Kuznetsov , + "David S. Miller" , + Greg Kroah-Hartman +Subject: [patch 16/20] Fix ipv4 routing locking bug +Content-Disposition: inline; filename=fix-ipv4-routing-locking-bug.patch +Content-Length: 2499 +Lines: 82 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alexey Kuznetsov + +[IPV4]: severe locking bug in fib_semantics.c + +Found in 2.4 by Yixin Pan . + +> When I read fib_semantics.c of Linux-2.4.32, write_lock(&fib_info_lock) = +> is used in fib_release_info() instead of write_lock_bh(&fib_info_lock). = +> Is the following case possible: a BH interrupts fib_release_info() while = +> holding the write lock, and calls ip_check_fib_default() which calls = +> read_lock(&fib_info_lock), and spin forever. + +Signed-off-by: Alexey Kuznetsov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/fib_semantics.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- linux-2.6.17.9.orig/net/ipv4/fib_semantics.c ++++ linux-2.6.17.9/net/ipv4/fib_semantics.c +@@ -160,7 +160,7 @@ void free_fib_info(struct fib_info *fi) + + void fib_release_info(struct fib_info *fi) + { +- write_lock(&fib_info_lock); ++ write_lock_bh(&fib_info_lock); + if (fi && --fi->fib_treeref == 0) { + hlist_del(&fi->fib_hash); + if (fi->fib_prefsrc) +@@ -173,7 +173,7 @@ void fib_release_info(struct fib_info *f + fi->fib_dead = 1; + fib_info_put(fi); + } +- write_unlock(&fib_info_lock); ++ write_unlock_bh(&fib_info_lock); + } + + static __inline__ int nh_comp(const struct fib_info *fi, const struct fib_info *ofi) +@@ -599,7 +599,7 @@ static void fib_hash_move(struct hlist_h + unsigned int old_size = fib_hash_size; + unsigned int i, bytes; + +- write_lock(&fib_info_lock); ++ write_lock_bh(&fib_info_lock); + old_info_hash = fib_info_hash; + old_laddrhash = fib_info_laddrhash; + fib_hash_size = new_size; +@@ -640,7 +640,7 @@ static void fib_hash_move(struct hlist_h + } + fib_info_laddrhash = new_laddrhash; + +- write_unlock(&fib_info_lock); ++ write_unlock_bh(&fib_info_lock); + + bytes = old_size * sizeof(struct hlist_head *); + fib_hash_free(old_info_hash, bytes); +@@ -822,7 +822,7 @@ link_it: + + fi->fib_treeref++; + atomic_inc(&fi->fib_clntref); +- write_lock(&fib_info_lock); ++ write_lock_bh(&fib_info_lock); + hlist_add_head(&fi->fib_hash, + &fib_info_hash[fib_info_hashfn(fi)]); + if (fi->fib_prefsrc) { +@@ -841,7 +841,7 @@ link_it: + head = &fib_info_devhash[hash]; + hlist_add_head(&nh->nh_hash, head); + } endfor_nexthops(fi) +- write_unlock(&fib_info_lock); ++ write_unlock_bh(&fib_info_lock); + return fi; + + err_inval: + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:54 2006 +Message-Id: <20060821183953.950097468@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + agk@redhat.com, + mirq-linux@rere.qmqm.pl, + Greg Kroah-Hartman +Subject: [patch 17/20] dm: BUG/OOPS fix +Content-Disposition: inline; filename=dm-bug-oops-fix.patch +Content-Length: 2568 +Lines: 69 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michal Miroslaw + +Fix BUG I tripped on while testing failover and multipathing. + +BUG shows up on error path in multipath_ctr() when parse_priority_group() +fails after returning at least once without error. The fix is to +initialize m->ti early - just after alloc()ing it. + +BUG: unable to handle kernel NULL pointer dereference at virtual address 00000000 + printing eip: +c027c3d2 +*pde = 00000000 +Oops: 0000 [#3] +Modules linked in: qla2xxx ext3 jbd mbcache sg ide_cd cdrom floppy +CPU: 0 +EIP: 0060:[] Not tainted VLI +EFLAGS: 00010202 (2.6.17.3 #1) +EIP is at dm_put_device+0xf/0x3b +eax: 00000001 ebx: ee4fcac0 ecx: 00000000 edx: ee4fcac0 +esi: ee4fc4e0 edi: ee4fc4e0 ebp: 00000000 esp: c5db3e78 +ds: 007b es: 007b ss: 0068 +Process multipathd (pid: 15912, threadinfo=c5db2000 task=ef485a90) +Stack: ec4eda40 c02816bd ee4fc4c0 00000000 f7e89498 f883e0bc c02816f6 f7e89480 + f7e8948c c0281801 ffffffea f7e89480 f883e080 c0281ffe 00000001 00000000 + 00000004 dfe9cab8 f7a693c0 f883e080 f883e0c0 ca4b99c0 c027c6ee 01400000 +Call Trace: + free_pgpaths+0x31/0x45 free_priority_group+0x25/0x2e + free_multipath+0x35/0x67 multipath_ctr+0x123/0x12d + dm_table_add_target+0x11e/0x18b populate_table+0x8a/0xaf + table_load+0x52/0xf9 ctl_ioctl+0xca/0xfc + table_load+0x0/0xf9 do_ioctl+0x3e/0x43 + vfs_ioctl+0x16c/0x178 sys_ioctl+0x48/0x60 + syscall_call+0x7/0xb +Code: 97 f0 00 00 00 89 c1 83 c9 01 80 e2 01 0f 44 c1 88 43 14 8b 04 24 59 5b 5e 5f 5d c3 53 89 c1 89 d3 ff 4a 08 0f 94 c0 84 c0 74 2a <8b> 01 8b 10 89 d8 e8 f6 fb ff ff 8b 03 8b 53 04 89 50 04 89 02 +EIP: [] dm_put_device+0xf/0x3b SS:ESP 0068:c5db3e78 + +Signed-off-by: Michal Miroslaw +Acked-by: Alasdair G Kergon +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-mpath.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.17.9.orig/drivers/md/dm-mpath.c ++++ linux-2.6.17.9/drivers/md/dm-mpath.c +@@ -711,6 +711,8 @@ static int multipath_ctr(struct dm_targe + return -EINVAL; + } + ++ m->ti = ti; ++ + r = parse_features(&as, m, ti); + if (r) + goto bad; +@@ -752,7 +754,6 @@ static int multipath_ctr(struct dm_targe + } + + ti->private = m; +- m->ti = ti; + + return 0; + + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:54 2006 +Message-Id: <20060821183954.092592169@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + mm-commits@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + rjw@sisk.pl, + hugh@veritas.com, + pavel@suse.cz, + Greg Kroah-Hartman +Subject: [patch 18/20] swsusp: Fix swap_type_of +Content-Disposition: inline; filename=swsusp-fix-swap_type_of.patch +Content-Length: 1061 +Lines: 36 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: "Rafael J. Wysocki" + +There is a bug in mm/swapfile.c#swap_type_of() that makes swsusp only be +able to use the first active swap partition as the resume device. Fix it. + +Signed-off-by: Rafael J. Wysocki +Cc: Hugh Dickins +Acked-by: Pavel Machek +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + mm/swapfile.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.17.9.orig/mm/swapfile.c ++++ linux-2.6.17.9/mm/swapfile.c +@@ -440,11 +440,12 @@ int swap_type_of(dev_t device) + + if (!(swap_info[i].flags & SWP_WRITEOK)) + continue; ++ + if (!device) { + spin_unlock(&swap_lock); + return i; + } +- inode = swap_info->swap_file->f_dentry->d_inode; ++ inode = swap_info[i].swap_file->f_dentry->d_inode; + if (S_ISBLK(inode->i_mode) && + device == MKDEV(imajor(inode), iminor(inode))) { + spin_unlock(&swap_lock); + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:54 2006 +Message-Id: <20060821183954.233744517@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + linux-raid@vger.kernel.org, + Neil Brown , + Greg Kroah-Hartman +Subject: [patch 19/20] MD: Fix a potential NULL dereference in md/raid1 +Content-Disposition: inline; filename=md-fix-a-potential-null-dereference-in-md-raid1.patch +Content-Length: 1297 +Lines: 43 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: NeilBrown + +At the point where this 'atomic_add' is, rdev could be NULL, as seen by +the fact that we test for this in the very next statement. + +Further is it is really the wrong place of the add. We could add to the +count of corrected errors once the are sure it was corrected, not before +trying to correct it. + +Signed-off-by: Neil Brown +Signed-off-by: Greg Kroah-Hartman + + +diff .prev/drivers/md/raid1.c ./drivers/md/raid1.c +--- + drivers/md/raid1.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- linux-2.6.17.9.orig/drivers/md/raid1.c ++++ linux-2.6.17.9/drivers/md/raid1.c +@@ -1486,7 +1486,6 @@ static void raid1d(mddev_t *mddev) + d = conf->raid_disks; + d--; + rdev = conf->mirrors[d].rdev; +- atomic_add(s, &rdev->corrected_errors); + if (rdev && + test_bit(In_sync, &rdev->flags)) { + if (sync_page_io(rdev->bdev, +@@ -1509,6 +1508,9 @@ static void raid1d(mddev_t *mddev) + s<<9, conf->tmppage, READ) == 0) + /* Well, this device is dead */ + md_error(mddev, rdev); ++ else ++ atomic_add(s, &rdev->corrected_errors); ++ + } + } + } else { + +-- + +From greg@quad.kroah.org Mon Aug 21 11:39:54 2006 +Message-Id: <20060821183954.380028812@quad.kroah.org> +References: <20060821183818.155091391@quad.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 21 Aug 2006 11:38:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + mm-commits@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + scjody@modernduck.com, + bcollins@ubuntu.com, + benh@kernel.crashing.org, + obiwan@mailmij.org, + stefanr@s5r6.in-berlin.de, + Greg Kroah-Hartman +Subject: [patch 20/20] 1394: fix for recently added firewire patch that breaks things on ppc +Content-Disposition: inline; filename=1394-fix-for-recently-added-firewire-patch-that-breaks-things-on-ppc.patch +Content-Length: 1371 +Lines: 46 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Danny Tholen + +Recently a patch was added for preliminary suspend/resume handling on +!PPC_PMAC. However, this broke both suspend and firewire on powerpc +because it saves the pci state after the device has already been disabled. + +This moves the save state to before the pmac specific code. + +Signed-off-by: Danny Tholen +Cc: Stefan Richter +Cc: Benjamin Herrenschmidt +Cc: Ben Collins +Cc: Jody McIntyre +Acked-by: Benjamin Herrenschmidt +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ieee1394/ohci1394.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.17.9.orig/drivers/ieee1394/ohci1394.c ++++ linux-2.6.17.9/drivers/ieee1394/ohci1394.c +@@ -3548,6 +3548,8 @@ static int ohci1394_pci_resume (struct p + + static int ohci1394_pci_suspend (struct pci_dev *pdev, pm_message_t state) + { ++ pci_save_state(pdev); ++ + #ifdef CONFIG_PPC_PMAC + if (machine_is(powermac)) { + struct device_node *of_node; +@@ -3559,8 +3561,6 @@ static int ohci1394_pci_suspend (struct + } + #endif + +- pci_save_state(pdev); +- + return 0; + } + + +-- + diff --git a/queue-2.6.17/md-fix-a-potential-null-dereference-in-md-raid1.patch b/review-2.6.17/md-fix-a-potential-null-dereference-in-md-raid1.patch similarity index 100% rename from queue-2.6.17/md-fix-a-potential-null-dereference-in-md-raid1.patch rename to review-2.6.17/md-fix-a-potential-null-dereference-in-md-raid1.patch diff --git a/queue-2.6.17/pci-fix-ich6-quirks.patch b/review-2.6.17/pci-fix-ich6-quirks.patch similarity index 100% rename from queue-2.6.17/pci-fix-ich6-quirks.patch rename to review-2.6.17/pci-fix-ich6-quirks.patch diff --git a/queue-2.6.17/serial-icom-select-fw_loader.patch b/review-2.6.17/serial-icom-select-fw_loader.patch similarity index 100% rename from queue-2.6.17/serial-icom-select-fw_loader.patch rename to review-2.6.17/serial-icom-select-fw_loader.patch diff --git a/queue-2.6.17/series b/review-2.6.17/series similarity index 100% rename from queue-2.6.17/series rename to review-2.6.17/series diff --git a/queue-2.6.17/sky2-phy-power-problem-on-88e805x.patch b/review-2.6.17/sky2-phy-power-problem-on-88e805x.patch similarity index 100% rename from queue-2.6.17/sky2-phy-power-problem-on-88e805x.patch rename to review-2.6.17/sky2-phy-power-problem-on-88e805x.patch diff --git a/queue-2.6.17/swsusp-fix-swap_type_of.patch b/review-2.6.17/swsusp-fix-swap_type_of.patch similarity index 100% rename from queue-2.6.17/swsusp-fix-swap_type_of.patch rename to review-2.6.17/swsusp-fix-swap_type_of.patch diff --git a/queue-2.6.17/sys_getppid-oopses-on-debug-kernel.patch b/review-2.6.17/sys_getppid-oopses-on-debug-kernel.patch similarity index 100% rename from queue-2.6.17/sys_getppid-oopses-on-debug-kernel.patch rename to review-2.6.17/sys_getppid-oopses-on-debug-kernel.patch diff --git a/queue-2.6.17/tpm-interrupt-clear-fix.patch b/review-2.6.17/tpm-interrupt-clear-fix.patch similarity index 100% rename from queue-2.6.17/tpm-interrupt-clear-fix.patch rename to review-2.6.17/tpm-interrupt-clear-fix.patch diff --git a/queue-2.6.17/ulog-fix-panic-on-smp-kernels.patch b/review-2.6.17/ulog-fix-panic-on-smp-kernels.patch similarity index 100% rename from queue-2.6.17/ulog-fix-panic-on-smp-kernels.patch rename to review-2.6.17/ulog-fix-panic-on-smp-kernels.patch