--- /dev/null
+From stable-bounces@linux.kernel.org Wed Dec 19 15:50:31 2007
+From: David Miller <davem@davemloft.net>
+Date: Wed, 19 Dec 2007 15:50:06 -0800 (PST)
+Subject: [stable] [PATCH]: Fix sparc64 cpu cross call hangs.
+To: stable@kernel.org
+Cc: bunk@kernel.org
+Message-ID: <20071219.155006.86794054.davem@davemloft.net>
+
+
+
+Adrian, this patch needs a little bit of backporting for
+2.6.16, which I will send to you in the next email.
+
+Please add to -stable, this fits both 2.6.22 and 2.6.23
+and I think since it hangs people's systems it is
+appropriate for both :-)
+
+Thanks!
+
+[SPARC64]: Fix endless loop in cheetah_xcall_deliver().
+
+[ Upsteam commit: 0de56d1ab83323d604d95ca193dcbd28388dbabb ]
+
+We need to mask out the proper bits when testing the dispatch status
+register else we can see unrelated NACK bits from previous cross call
+sends.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ arch/sparc64/kernel/smp.c | 19 +++++++++++++------
+ 1 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
+index 894b506..c399449 100644
+--- a/arch/sparc64/kernel/smp.c
++++ b/arch/sparc64/kernel/smp.c
+@@ -476,7 +476,7 @@ static inline void spitfire_xcall_deliver(u64 data0, u64 data1, u64 data2, cpuma
+ */
+ static void cheetah_xcall_deliver(u64 data0, u64 data1, u64 data2, cpumask_t mask)
+ {
+- u64 pstate, ver;
++ u64 pstate, ver, busy_mask;
+ int nack_busy_id, is_jbus, need_more;
+
+ if (cpus_empty(mask))
+@@ -508,14 +508,20 @@ retry:
+ "i" (ASI_INTR_W));
+
+ nack_busy_id = 0;
++ busy_mask = 0;
+ {
+ int i;
+
+ for_each_cpu_mask(i, mask) {
+ u64 target = (i << 14) | 0x70;
+
+- if (!is_jbus)
++ if (is_jbus) {
++ busy_mask |= (0x1UL << (i * 2));
++ } else {
+ target |= (nack_busy_id << 24);
++ busy_mask |= (0x1UL <<
++ (nack_busy_id * 2));
++ }
+ __asm__ __volatile__(
+ "stxa %%g0, [%0] %1\n\t"
+ "membar #Sync\n\t"
+@@ -531,15 +537,16 @@ retry:
+
+ /* Now, poll for completion. */
+ {
+- u64 dispatch_stat;
++ u64 dispatch_stat, nack_mask;
+ long stuck;
+
+ stuck = 100000 * nack_busy_id;
++ nack_mask = busy_mask << 1;
+ do {
+ __asm__ __volatile__("ldxa [%%g0] %1, %0"
+ : "=r" (dispatch_stat)
+ : "i" (ASI_INTR_DISPATCH_STAT));
+- if (dispatch_stat == 0UL) {
++ if (!(dispatch_stat & (busy_mask | nack_mask))) {
+ __asm__ __volatile__("wrpr %0, 0x0, %%pstate"
+ : : "r" (pstate));
+ if (unlikely(need_more)) {
+@@ -556,12 +563,12 @@ retry:
+ }
+ if (!--stuck)
+ break;
+- } while (dispatch_stat & 0x5555555555555555UL);
++ } while (dispatch_stat & busy_mask);
+
+ __asm__ __volatile__("wrpr %0, 0x0, %%pstate"
+ : : "r" (pstate));
+
+- if ((dispatch_stat & ~(0x5555555555555555UL)) == 0) {
++ if (dispatch_stat & busy_mask) {
+ /* Busy bits will not clear, continue instead
+ * of freezing up on this cpu.
+ */
+--
+1.5.3.7
+
+_______________________________________________
+stable mailing list
+stable@linux.kernel.org
+http://linux.kernel.org/mailman/listinfo/stable
+
+++ /dev/null
-From stable-bounces@linux.kernel.org Sun Jan 6 05:19:14 2008
-From: Jean Delvare <khali@linux-fr.org>
-Date: Sun, 6 Jan 2008 14:18:44 +0100
-Subject: hwmon: (w83627ehf) Be more careful when changing VID input level
-To: stable@kernel.org
-Cc: "Mark M. Hoffman" <mhoffman@lightlink.com>
-Message-ID: <20080106141844.59571bf7@hyperion.delvare>
-
-Already in Linus' tree:
-http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=58e6e78119da2bdade9f6f588155f0320072b76b
-
-Fix for:
-http://bugzilla.kernel.org/show_bug.cgi?id=9634
-
-The VID input level change has been reported to cause trouble. Be more
-careful in this respect:
-* Only change the level on the W83627EHF/EHG. The W83627DHG is more
- complex in this respect.
-* Don't change the level if the VID pins are in output mode.
-* Only set the level to TTL if VRM 9.x is used.
-
-Signed-off-by: Jean Delvare <khali@linux-fr.org>
-Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/hwmon/w83627ehf.c | 36 ++++++++++++++++++++++--------------
- 1 file changed, 22 insertions(+), 14 deletions(-)
-
---- a/drivers/hwmon/w83627ehf.c
-+++ b/drivers/hwmon/w83627ehf.c
-@@ -1276,23 +1276,31 @@ static int __devinit w83627ehf_probe(str
-
- data->vrm = vid_which_vrm();
- superio_enter(sio_data->sioreg);
-- /* Set VID input sensibility if needed. In theory the BIOS should
-- have set it, but in practice it's not always the case. */
-- en_vrm10 = superio_inb(sio_data->sioreg, SIO_REG_EN_VRM10);
-- if ((en_vrm10 & 0x08) && data->vrm != 100) {
-- dev_warn(dev, "Setting VID input voltage to TTL\n");
-- superio_outb(sio_data->sioreg, SIO_REG_EN_VRM10,
-- en_vrm10 & ~0x08);
-- } else if (!(en_vrm10 & 0x08) && data->vrm == 100) {
-- dev_warn(dev, "Setting VID input voltage to VRM10\n");
-- superio_outb(sio_data->sioreg, SIO_REG_EN_VRM10,
-- en_vrm10 | 0x08);
-- }
- /* Read VID value */
- superio_select(sio_data->sioreg, W83627EHF_LD_HWM);
-- if (superio_inb(sio_data->sioreg, SIO_REG_VID_CTRL) & 0x80)
-+ if (superio_inb(sio_data->sioreg, SIO_REG_VID_CTRL) & 0x80) {
-+ /* Set VID input sensibility if needed. In theory the BIOS
-+ should have set it, but in practice it's not always the
-+ case. We only do it for the W83627EHF/EHG because the
-+ W83627DHG is more complex in this respect. */
-+ if (sio_data->kind == w83627ehf) {
-+ en_vrm10 = superio_inb(sio_data->sioreg,
-+ SIO_REG_EN_VRM10);
-+ if ((en_vrm10 & 0x08) && data->vrm == 90) {
-+ dev_warn(dev, "Setting VID input voltage to "
-+ "TTL\n");
-+ superio_outb(sio_data->sioreg, SIO_REG_EN_VRM10,
-+ en_vrm10 & ~0x08);
-+ } else if (!(en_vrm10 & 0x08) && data->vrm == 100) {
-+ dev_warn(dev, "Setting VID input voltage to "
-+ "VRM10\n");
-+ superio_outb(sio_data->sioreg, SIO_REG_EN_VRM10,
-+ en_vrm10 | 0x08);
-+ }
-+ }
-+
- data->vid = superio_inb(sio_data->sioreg, SIO_REG_VID_DATA) & 0x3f;
-- else {
-+ } else {
- dev_info(dev, "VID pins in output mode, CPU VID not "
- "available\n");
- data->vid = 0x3f;
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Dec 19 16:36:18 2007
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Wed, 19 Dec 2007 16:35:54 -0800 (PST)
+Subject: IPSEC: Fix potential dst leak in xfrm_lookup
+To: stable@kernel.org
+Cc: bunk@kernel.org
+Message-ID: <20071219.163554.93686534.davem@davemloft.net>
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[IPSEC]: Fix potential dst leak in xfrm_lookup
+
+[ Upstream commit: 75b8c133267053c9986a7c8db5131f0e7349e806 ]
+
+If we get an error during the actual policy lookup we don't free the
+original dst while the caller expects us to always free the original
+dst in case of error.
+
+This patch fixes that.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/xfrm/xfrm_policy.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1479,8 +1479,9 @@ restart:
+
+ if (sk && sk->sk_policy[1]) {
+ policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
++ err = PTR_ERR(policy);
+ if (IS_ERR(policy))
+- return PTR_ERR(policy);
++ goto dropdst;
+ }
+
+ if (!policy) {
+@@ -1491,8 +1492,9 @@ restart:
+
+ policy = flow_cache_lookup(fl, dst_orig->ops->family,
+ dir, xfrm_policy_lookup);
++ err = PTR_ERR(policy);
+ if (IS_ERR(policy))
+- return PTR_ERR(policy);
++ goto dropdst;
+ }
+
+ if (!policy)
+@@ -1661,8 +1663,9 @@ restart:
+ return 0;
+
+ error:
+- dst_release(dst_orig);
+ xfrm_pols_put(pols, npols);
++dropdst:
++ dst_release(dst_orig);
+ *dst_p = NULL;
+ return err;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jan 11 01:10:17 2008
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Fri, 11 Jan 2008 01:09:46 -0800 (PST)
+Subject: IPV4 raw: Strengthen check on validity of iph->ihl
+To: stable@kernel.org
+Cc: bunk@kernel.org
+Message-ID: <20080111.010946.227858962.davem@davemloft.net>
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[IPV4] raw: Strengthen check on validity of iph->ihl
+
+[ Upstream commit: f844c74fe07321953e2dd227fe35280075f18f60 ]
+
+We currently check that iph->ihl is bounded by the real length and that
+the real length is greater than the minimum IP header length. However,
+we did not check the caes where iph->ihl is less than the minimum IP
+header length.
+
+This breaks because some ip_fast_csum implementations assume that which
+is quite reasonable.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/raw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -270,6 +270,7 @@ static int raw_send_hdrinc(struct sock *
+ int hh_len;
+ struct iphdr *iph;
+ struct sk_buff *skb;
++ unsigned int iphlen;
+ int err;
+
+ if (length > rt->u.dst.dev->mtu) {
+@@ -303,7 +304,8 @@ static int raw_send_hdrinc(struct sock *
+ goto error_fault;
+
+ /* We don't modify invalid header */
+- if (length >= sizeof(*iph) && iph->ihl * 4U <= length) {
++ iphlen = iph->ihl * 4;
++ if (iphlen >= sizeof(*iph) && iphlen <= length) {
+ if (!iph->saddr)
+ iph->saddr = rt->rt_src;
+ iph->check = 0;
-hwmon-be-more-careful-when-changing-vid-input-level.patch
+fix-sparc64-cpu-cross-call-hangs.patch
dm-table-detect-io-beyond-device.patch
dm-crypt-fix-write-endio.patch
dm-crypt-use-bio_add_page.patch
acpi-video_device_list-corruption.patch
acpi-thinkpad-acpi-fix-lenovo-keymap-for-brightness.patch
+sparc64-fix-memory-controller-register-access-when-non-smp.patch
+sparc64-fix-two-kernel-linear-mapping-setup-bugs.patch
+ipsec-fix-potential-dst-leak-in-xfrm_lookup.patch
+vlan-lost-rtnl_unlock-in-vlan_ioctl.patch
+tty-fix-logic-change-introduced-by-wait_event_interruptible_timeout.patch
+ipv4-raw-strengthen-check-on-validity-of-iph-ihl.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Dec 19 16:27:31 2007
+From: David Miller <davem@davemloft.net>
+Date: Wed, 19 Dec 2007 16:27:11 -0800 (PST)
+Subject: SPARC64: Fix memory controller register access when non-SMP.
+To: stable@kernel.org
+Cc: bunk@stable.org
+Message-ID: <20071219.162711.06329560.davem@davemloft.net>
+
+
+From: David Miller <davem@davemloft.net>
+
+[SPARC64]: Fix memory controller register access when non-SMP.
+
+[ Upstream commit: b332b8bc9c67165eabdfc7d10b4a2e4cc9f937d0 ]
+
+get_cpu() always returns zero on non-SMP builds, but we
+really want the physical cpu number in this code in order
+to do the right thing.
+
+Based upon a non-SMP kernel boot failure report from Bernd Zeimetz.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/chmc.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/arch/sparc64/kernel/chmc.c
++++ b/arch/sparc64/kernel/chmc.c
+@@ -1,7 +1,6 @@
+-/* $Id: chmc.c,v 1.4 2002/01/08 16:00:14 davem Exp $
+- * memctrlr.c: Driver for UltraSPARC-III memory controller.
++/* memctrlr.c: Driver for UltraSPARC-III memory controller.
+ *
+- * Copyright (C) 2001 David S. Miller (davem@redhat.com)
++ * Copyright (C) 2001, 2007 David S. Miller (davem@davemloft.net)
+ */
+
+ #include <linux/module.h>
+@@ -16,6 +15,7 @@
+ #include <linux/init.h>
+ #include <asm/spitfire.h>
+ #include <asm/chmctrl.h>
++#include <asm/cpudata.h>
+ #include <asm/oplib.h>
+ #include <asm/prom.h>
+ #include <asm/io.h>
+@@ -242,8 +242,11 @@ int chmc_getunumber(int syndrome_code,
+ */
+ static u64 read_mcreg(struct mctrl_info *mp, unsigned long offset)
+ {
+- unsigned long ret;
+- int this_cpu = get_cpu();
++ unsigned long ret, this_cpu;
++
++ preempt_disable();
++
++ this_cpu = real_hard_smp_processor_id();
+
+ if (mp->portid == this_cpu) {
+ __asm__ __volatile__("ldxa [%1] %2, %0"
+@@ -255,7 +258,8 @@ static u64 read_mcreg(struct mctrl_info
+ : "r" (mp->regs + offset),
+ "i" (ASI_PHYS_BYPASS_EC_E));
+ }
+- put_cpu();
++
++ preempt_enable();
+
+ return ret;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Dec 19 16:29:22 2007
+From: David Miller <davem@davemloft.net>
+Date: Wed, 19 Dec 2007 16:28:57 -0800 (PST)
+Subject: SPARC64: Fix two kernel linear mapping setup bugs.
+To: stable@kernel.org
+Cc: bunk@kernel.org
+Message-ID: <20071219.162857.239562660.davem@davemloft.net>
+
+From: David Miller <davem@davemloft.net>
+
+[SPARC64]: Fix two kernel linear mapping setup bugs.
+
+[ Upstream commit: 8f361453d8e9a67c85b2cf9b93c642c2d8fe0462 ]
+
+This was caught and identified by Greg Onufer.
+
+Since we setup the 256M/4M bitmap table after taking over the trap
+table, it's possible for some 4M mapping to get loaded in the TLB
+beforhand which later will be 256M mappings.
+
+This can cause illegal TLB multiple-match conditions. Fix this by
+setting up the bitmap before we take over the trap table.
+
+Next, __flush_tlb_all() was not doing anything on hypervisor
+platforms. Fix by adding sun4v_mmu_demap_all() and calling it.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/entry.S | 12 ++++++++++++
+ arch/sparc64/mm/init.c | 29 ++++++++++++++++++++---------
+ include/asm-sparc64/hypervisor.h | 4 ++++
+ 3 files changed, 36 insertions(+), 9 deletions(-)
+
+--- a/arch/sparc64/kernel/entry.S
++++ b/arch/sparc64/kernel/entry.S
+@@ -2593,3 +2593,15 @@ sun4v_mmustat_info:
+ retl
+ nop
+ .size sun4v_mmustat_info, .-sun4v_mmustat_info
++
++ .globl sun4v_mmu_demap_all
++ .type sun4v_mmu_demap_all,#function
++sun4v_mmu_demap_all:
++ clr %o0
++ clr %o1
++ mov HV_MMU_ALL, %o2
++ mov HV_FAST_MMU_DEMAP_ALL, %o5
++ ta HV_FAST_TRAP
++ retl
++ nop
++ .size sun4v_mmu_demap_all, .-sun4v_mmu_demap_all
+--- a/arch/sparc64/mm/init.c
++++ b/arch/sparc64/mm/init.c
+@@ -1135,14 +1135,9 @@ static void __init mark_kpte_bitmap(unsi
+ }
+ }
+
+-static void __init kernel_physical_mapping_init(void)
++static void __init init_kpte_bitmap(void)
+ {
+ unsigned long i;
+-#ifdef CONFIG_DEBUG_PAGEALLOC
+- unsigned long mem_alloced = 0UL;
+-#endif
+-
+- read_obp_memory("reg", &pall[0], &pall_ents);
+
+ for (i = 0; i < pall_ents; i++) {
+ unsigned long phys_start, phys_end;
+@@ -1151,14 +1146,24 @@ static void __init kernel_physical_mappi
+ phys_end = phys_start + pall[i].reg_size;
+
+ mark_kpte_bitmap(phys_start, phys_end);
++ }
++}
+
++static void __init kernel_physical_mapping_init(void)
++{
+ #ifdef CONFIG_DEBUG_PAGEALLOC
++ unsigned long i, mem_alloced = 0UL;
++
++ for (i = 0; i < pall_ents; i++) {
++ unsigned long phys_start, phys_end;
++
++ phys_start = pall[i].phys_addr;
++ phys_end = phys_start + pall[i].reg_size;
++
+ mem_alloced += kernel_map_range(phys_start, phys_end,
+ PAGE_KERNEL);
+-#endif
+ }
+
+-#ifdef CONFIG_DEBUG_PAGEALLOC
+ printk("Allocated %ld bytes for kernel page tables.\n",
+ mem_alloced);
+
+@@ -1400,6 +1405,10 @@ void __init paging_init(void)
+
+ inherit_prom_mappings();
+
++ read_obp_memory("reg", &pall[0], &pall_ents);
++
++ init_kpte_bitmap();
++
+ /* Ok, we can use our TLB miss and window trap handlers safely. */
+ setup_tba();
+
+@@ -1854,7 +1863,9 @@ void __flush_tlb_all(void)
+ "wrpr %0, %1, %%pstate"
+ : "=r" (pstate)
+ : "i" (PSTATE_IE));
+- if (tlb_type == spitfire) {
++ if (tlb_type == hypervisor) {
++ sun4v_mmu_demap_all();
++ } else if (tlb_type == spitfire) {
+ for (i = 0; i < 64; i++) {
+ /* Spitfire Errata #32 workaround */
+ /* NOTE: Always runs on spitfire, so no
+--- a/include/asm-sparc64/hypervisor.h
++++ b/include/asm-sparc64/hypervisor.h
+@@ -709,6 +709,10 @@ extern unsigned long sun4v_mmu_tsb_ctx0(
+ */
+ #define HV_FAST_MMU_DEMAP_ALL 0x24
+
++#ifndef __ASSEMBLY__
++extern void sun4v_mmu_demap_all(void);
++#endif
++
+ /* mmu_map_perm_addr()
+ * TRAP: HV_FAST_TRAP
+ * FUNCTION: HV_FAST_MMU_MAP_PERM_ADDR
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Dec 23 12:35:55 2007
+From: "Cory T. Tusar" <ctusar@videon-central.com>
+Date: Sun, 23 Dec 2007 12:34:51 -0800
+Subject: tty: fix logic change introduced by wait_event_interruptible_timeout()
+To: torvalds@linux-foundation.org
+Cc: ctusar@videon-central.com, akpm@linux-foundation.org, jirislaby@gmail.com, alan@lxorguk.ukuu.org.uk, stable@kernel.org
+Message-ID: <200712232035.lBNKZEgn007791@imap1.linux-foundation.org>
+
+
+From: "Cory T. Tusar" <ctusar@videon-central.com>
+
+patch db99247ac68fc352100090ad7704fb5efb9327b6 in mainline.
+
+Commit 5a52bd4a2dcb570333ce6fe2e16cd311650dbdc8 introduced a subtle logic
+change in tty_wait_until_sent(). The original version would only error out
+of the 'do { ... } while (timeout)' loop if signal_pending() evaluated to
+true; a timeout or break due to an empty buffer would fall out of the loop
+and into the tty->driver->wait_until_sent handling. The current
+implementation will error out on either a pending signal or an empty
+buffer, falling through to the tty->driver->wait_until_sent handling only
+on a timeout.
+
+The ->wait_until_sent() will not be reached if the buffer empties before
+timeout jiffies have elapsed. This behavior differs from that prior to commit
+5a52bd4a2dcb570333ce6fe2e16cd311650dbdc8.
+
+I turned this up while using a little serial download utility to bootstrap an
+ARM-based eval board. The util worked fine on 2.6.22.x, but consistently
+failed on 2.6.23.x. Once I'd determined that, I narrowed things down with git
+bisect, and found the above difference in logic in tty_wait_until_sent() by
+inspection.
+
+This change reverts the logic flow in tty_wait_until_sent() to match that
+prior to the aforementioned commit.
+
+Signed-off-by: Cory T. Tusar <ctusar@videon-central.com>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Acked-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tty_ioctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/tty_ioctl.c
++++ b/drivers/char/tty_ioctl.c
+@@ -62,7 +62,7 @@ void tty_wait_until_sent(struct tty_stru
+ if (!timeout)
+ timeout = MAX_SCHEDULE_TIMEOUT;
+ if (wait_event_interruptible_timeout(tty->write_wait,
+- !tty->driver->chars_in_buffer(tty), timeout))
++ !tty->driver->chars_in_buffer(tty), timeout) < 0)
+ return;
+ if (tty->driver->wait_until_sent)
+ tty->driver->wait_until_sent(tty, timeout);
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Dec 19 16:31:34 2007
+From: Pavel Emelyanov <xemul@openvz.org>
+Date: Wed, 19 Dec 2007 16:30:48 -0800 (PST)
+Subject: VLAN: Lost rtnl_unlock() in vlan_ioctl()
+To: stable@kernel.org
+Cc: bunk@stable.org
+Message-ID: <20071219.163048.180596355.davem@davemloft.net>
+
+From: Pavel Emelyanov <xemul@openvz.org>
+
+[VLAN]: Lost rtnl_unlock() in vlan_ioctl()
+
+[ Upstream commit: e35de02615f97b785dc6f73cba421cea06bcbd10 ]
+
+The SET_VLAN_NAME_TYPE_CMD command w/o CAP_NET_ADMIN capability
+doesn't release the rtnl lock.
+
+Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/8021q/vlan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -768,7 +768,7 @@ static int vlan_ioctl_handler(void __use
+ case SET_VLAN_NAME_TYPE_CMD:
+ err = -EPERM;
+ if (!capable(CAP_NET_ADMIN))
+- return -EPERM;
++ break;
+ if ((args.u.name_type >= 0) &&
+ (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
+ vlan_name_type = args.u.name_type;
projects / thirdparty / kernel / stable-queue.git / commitdiff
