linux-stable.git/include/linux, branch linux-2.6.12.y

[PATCH] Check input buffer size in zisofs

2005-08-15T00:20:09+00:00

Add fakey 'deflateBound()' function to the in-kernel zlib routines

It's not the real deflateBound() in newer zlib libraries, partly because
the upcoming usage of it won't have the "stream" available, so we can't
have the same interfaces anyway.

This uses the new deflateBound() thing to sanity-check the input to the
zlib decompressor before we even bother to start reading in the blocks.

Problem noted by Tim Yamin 

Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: H. Peter Anvin

[PATCH] Fix signedness issues in net/core/filter.c

2005-08-05T07:04:17+00:00

This is the code to load packet data into a register:

                        k = fentry->k;
                        if (k < 0) {
...
                        } else {
                                u32 _tmp, *p;
                                p = skb_header_pointer(skb, k, 4, &_tmp);
                                if (p != NULL) {
                                        A = ntohl(*p);
                                        continue;
                                }
                        }

skb_header_pointer checks if the requested data is within the
linear area:

        int hlen = skb_headlen(skb);

        if (offset + len <= hlen)
                return skb->data + offset;

When offset is within [INT_MAX-len+1..INT_MAX] the addition will
result in a negative number which is <= hlen.

I couldn't trigger a crash on my AMD64 with 2GB of memory, but a
coworker tried on his x86 machine and it crashed immediately.

This patch fixes the check in skb_header_pointer to handle large
positive offsets similar to skb_copy_bits. Invalid data can still
be accessed using negative offsets (also similar to skb_copy_bits),
anyone using negative offsets needs to verify them himself.

Thanks to Thomas V�gtle  for verifying the
problem by crashing his machine and providing me with an Oops.

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] fix Shaper driver lossage in 2.6.12

2005-07-15T21:15:25+00:00

[SHAPER]: Switch to spinlocks.

Dave, you were right and the sleeping locks in shaper were
broken. Markus Kanet noticed this and also tested the patch below that
switches locking to spinlocks.

Signed-off-by: Christoph Hellwig 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[IPV4]: Sysctl configurable icmp error source address.

2005-06-13T22:19:03+00:00

This patch alows you to change the source address of icmp error
messages. It applies cleanly to 2.6.11.11 and retains the default
behaviour.

In the old (default) behaviour icmp error messages are sent with the ip
of the exiting interface.

The new behaviour (when the sysctl variable is toggled on), it will send
the message with the ip of the interface that received the packet that
caused the icmp error. This is the behaviour network administrators will
expect from a router. It makes debugging complicated network layouts
much easier. Also, all 'vendor routers' I know of have the later
behaviour.

Signed-off-by: David S. Miller

[NET]: linux/if_tr.h needs asm/byteorder.h

2005-06-13T20:57:10+00:00

 uses __be16, but does not directly include
.  Add this in, so that dhcp/net-tools token ring code
can compile again.

Signed-off-by: Tom Rini 
Signed-off-by: David S. Miller

[PATCH] Remove obsolete HAVE_ARCH_GET_SIGNAL_TO_DELIVER?

2005-06-13T03:43:21+00:00

Now m68k no longer sets HAVE_ARCH_GET_SIGNAL_TO_DELIVER, can it be removed
completely? Or may ARM26 still need it? Note that its usage was removed from
kernel/signal.c about 2 months ago.

Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Linus Torvalds

Merge rsync://rsync.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

2005-06-08T23:36:31+00:00

[PKT_SCHED]: Allow socket attributes to be matched on via meta ematch

2005-06-08T22:10:48+00:00

Adds meta collectors for all socket attributes that make sense
to be filtered upon. Some of them are only useful for debugging
but having them doesn't hurt.

Signed-off-by: Thomas Graf 
Signed-off-by: David S. Miller

[TG3]: Fix 5700/5701 DMA corruption on Apple G4.

2005-06-08T21:13:14+00:00

Fix 5700/5701 DMA write corruption on Apple G4 by detecting the Apple
UniNorth PCI 1.5 chipset and adjusting the DMA write boundary to 16. DMA
test fails to detect the problem with this chipset.

Thanks to Manuel Perez Ayala for reporting the problem and helping to
debug it.

Signed-off-by: Michael Chan 
Signed-off-by: David S. Miller

[PATCH] i945G patch for agpgart

2005-06-07T19:35:42+00:00

Attached is a small patch for i945G support against 2.6.11.11.

From: Alan Hourihane 
Signed-off-by: Dave Jones