linux, branch v2.6.22.17

Linux 2.6.22.17

2008-02-06T19:59:40Z

vm audit: add VM_DONTEXPAND to mmap for drivers that need it (CVE-2008-0007)

2008-02-06T19:43:46Z

Drivers that register a ->fault handler, but do not range-check the offset argument, must set VM_DONTEXPAND in the vm_flags in order to prevent an expanding mremap from overflowing the resource. I've audited the tree and attempted to fix these problems (usually by adding VM_DONTEXPAND where it is not obvious). Signed-off-by: Nick Piggin Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

ACPI: apply quirk_ich6_lpc_acpi to more ICH8 and ICH9

2008-02-06T19:43:46Z

patch d1ec7298fcefd7e4d1ca612da402ce9e5d5e2c13 in mainline. It is important that these resources be reserved to avoid conflicts with well known ACPI registers. Signed-off-by: Zhao Yakui Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman

POWERPC: Fix invalid semicolon after if statement

2008-02-06T19:43:46Z

Patch 2b02d13996fe28478e45605de9bd8bdca25718de in mainline [POWERPC] Fix invalid semicolon after if statement A similar fix to netfilter from Eric Dumazet inspired me to look around a bit by using some grep/sed stuff as looking for this kind of bugs seemed easy to automate. This is one of them I found where it looks like this semicolon is not valid. Signed-off-by: Ilpo JÃ¤rvinen Acked-by: Benjamin Herrenschmidt Signed-off-by: Paul Mackerras Signed-off-by: Greg Kroah-Hartman

chelsio: Fix skb->dev setting

2008-02-06T19:43:45Z

patch 7de6af0f23b25df8da9719ecae1916b669d0b03d in mainline. eth_type_trans() now sets skb->dev. Access skb->def after it gets set. Signed-off-by: Divy Le Ray Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

cxgb: fix stats

2008-02-06T19:43:45Z

patch e0348b9ae5374f9a24424ae680bcd80724415f60 in mainline. Fix MAC stats accounting. Fix get_stats. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman

cxgb: fix T2 GSO

2008-02-06T19:43:45Z

patch 7832ee034b6ef78aab020c9ec1348544cd65ccbd in mainline. The patch ensures that a GSO skb has enough headroom to push an encapsulating cpl_tx_pkt_lso header. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman

vfs: coredumping fix (CVE-2007-6206)

2008-02-06T19:43:45Z

vfs: coredumping fix patch c46f739dd39db3b07ab5deb4e3ec81e1c04a91af in mainline fix: http://bugzilla.kernel.org/show_bug.cgi?id=3043 only allow coredumping to the same uid that the coredumping task runs under. Signed-off-by: Ingo Molnar Acked-by: Alan Cox Acked-by: Christoph Hellwig Acked-by: Al Viro Signed-off-by: Linus Torvalds Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman

ACPICA: fix acpi-cpufreq boot crash due to _PSD return-by-reference

2008-02-06T19:43:45Z

patch 152c300d007c70c4a1847dad39ecdaba22e7d457 in mainline. Changed resolution of named references in packages Fixed a problem with the Package operator where all named references were created as object references and left otherwise unresolved. According to the ACPI specification, a Package can only contain Data Objects or references to control methods. The implication is that named references to Data Objects (Integer, Buffer, String, Package, BufferField, Field) should be resolved immediately upon package creation. This is the approach taken with this change. References to all other named objects (Methods, Devices, Scopes, etc.) are all now properly created as reference objects. http://bugzilla.kernel.org/show_bug.cgi?id=5328 http://bugzilla.kernel.org/show_bug.cgi?id=9429 Signed-off-by: Bob Moore Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman

CASSINI: Set skb->truesize properly on receive packets.

2008-02-06T19:43:45Z

[ Upstream commit: d011a231675b240157a3c335dd53e9b849d7d30d ] skb->truesize was not being incremented at all to reflect the page based data added to RX SKBs. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman