linux-stable.git/include, branch linux-2.6.12.y

[PATCH] Check input buffer size in zisofs

2005-08-15T00:20:09+00:00

Add fakey 'deflateBound()' function to the in-kernel zlib routines

It's not the real deflateBound() in newer zlib libraries, partly because
the upcoming usage of it won't have the "stream" available, so we can't
have the same interfaces anyway.

This uses the new deflateBound() thing to sanity-check the input to the
zlib decompressor before we even bother to start reading in the blocks.

Problem noted by Tim Yamin 

Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: H. Peter Anvin

[PATCH] x86_64: Fixing smpboot timing problem

2005-08-15T00:20:08+00:00

This patch fixes the SMP boot timing problem that hit various people and was
introduced in 2.6.12. Please apply to stable.

>From Eric Biederman

sync_tsc was using smp_call_function to ask the boot processor
to report it's tsc value.  smp_call_function performs an IPI_send_allbutself
which is a broadcast ipi.  There is a window during processor startup during
which the target cpu has started and before it has initialized it's interrupt
vectors so it can properly process an interrupt.  Receveing an interrupt
during that window will triple fault the cpu and do other nasty things.

Why cli does not protect us from that is beyond me.

The simple fix is to match ia64 and provide a smp_call_function_single.
Which avoids the broadcast and is more efficient.

This certainly fixes the problem of getting stuck on boot which was
very easy to trigger on my SMP Hyperthreaded Xeon, and I think
it fixes it for the right reasons.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Andi Kleen 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix signedness issues in net/core/filter.c

2005-08-05T07:04:17+00:00

This is the code to load packet data into a register:

                        k = fentry->k;
                        if (k < 0) {
...
                        } else {
                                u32 _tmp, *p;
                                p = skb_header_pointer(skb, k, 4, &_tmp);
                                if (p != NULL) {
                                        A = ntohl(*p);
                                        continue;
                                }
                        }

skb_header_pointer checks if the requested data is within the
linear area:

        int hlen = skb_headlen(skb);

        if (offset + len <= hlen)
                return skb->data + offset;

When offset is within [INT_MAX-len+1..INT_MAX] the addition will
result in a negative number which is <= hlen.

I couldn't trigger a crash on my AMD64 with 2GB of memory, but a
coworker tried on his x86 machine and it crashed immediately.

This patch fixes the check in skb_header_pointer to handle large
positive offsets similar to skb_copy_bits. Invalid data can still
be accessed using negative offsets (also similar to skb_copy_bits),
anyone using negative offsets needs to verify them himself.

Thanks to Thomas V�gtle  for verifying the
problem by crashing his machine and providing me with an Oops.

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] fix Shaper driver lossage in 2.6.12

2005-07-15T21:15:25+00:00

[SHAPER]: Switch to spinlocks.

Dave, you were right and the sleeping locks in shaper were
broken. Markus Kanet noticed this and also tested the patch below that
switches locking to spinlocks.

Signed-off-by: Christoph Hellwig 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Add "memory" clobbers to the x86 inline asm of strncmp and friends

2005-06-29T23:00:38+00:00

Add "memory" clobbers to the x86 inline asm of strncmp and friends

They don't actually clobber memory, but gcc doesn't even know they
_read_ memory, so can apparently re-order memory accesses around them.

Which obviously does the wrong thing if the memory access happens to
change the memory that the compare function is accessing..

Verified to fix a strange boot problem by Jens Axboe.

Signed-off-by: Chris Wright

[PATCH] ARM: 2714/1: Fix the IB2 definitions for the Versatile platform

2005-06-16T17:01:12+00:00

Patch from Catalin Marinas

The initial IB2 addresses did not depend on the IB2 base. This
patch defines them as (VERSATILE_IB2_BASE + offset).

Signed-off-by: Catalin Marinas
Signed-off-by: Russell King

[PATCH] ARM: 2713/1: Fix the GPIO base for Integrator/CP

2005-06-16T17:01:11+00:00

Patch from Catalin Marinas

The GPIO base for Integrator/CP is different from the
Integrator/AP. This patch sets the correct value for
INTEGRATOR_GPIO_BASE.

Signed-off-by: Catalin Marinas
Signed-off-by: Russell King

[IPV4]: Sysctl configurable icmp error source address.

2005-06-13T22:19:03+00:00

This patch alows you to change the source address of icmp error
messages. It applies cleanly to 2.6.11.11 and retains the default
behaviour.

In the old (default) behaviour icmp error messages are sent with the ip
of the exiting interface.

The new behaviour (when the sysctl variable is toggled on), it will send
the message with the ip of the interface that received the packet that
caused the icmp error. This is the behaviour network administrators will
expect from a router. It makes debugging complicated network layouts
much easier. Also, all 'vendor routers' I know of have the later
behaviour.

Signed-off-by: David S. Miller

[SCTP] Add support for ip_nonlocal_bind sysctl & IP_FREEBIND socket option

2005-06-13T22:12:33+00:00

Signed-off-by: Neil Horman 
Signed-off-by: Sridhar Samudrala 
Signed-off-by: David S. Miller

[NET]: linux/if_tr.h needs asm/byteorder.h

2005-06-13T20:57:10+00:00

 uses __be16, but does not directly include
.  Add this in, so that dhcp/net-tools token ring code
can compile again.

Signed-off-by: Tom Rini 
Signed-off-by: David S. Miller