linux/include, branch v2.6.16.52

[NETPOLL]: Fix TX queue overflow in trapped mode.

2007-05-22T22:41:22Z

CONFIG_NETPOLL_TRAP causes the TX queue controls to be completely bypassed in the netpoll's "trapped" mode which easily causes overflows in the drivers with short TX queues (most notably, in 8139too with its 4-deep queue). So, make this option more sensible by making it only bypass the TX softirq wakeup. Signed-off-by: Sergei Shtylyov Acked-by: Jeff Garzik Acked-by: Tom Rini Acked-by: Matt Mackall Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk

[NETFILTER]: ip_nat_proto_gre: do not modify/corrupt GREv0 packets through NAT

2007-05-03T23:00:32Z

While porting some changes of the 2.6.21-rc7 pptp/proto_gre conntrack and nat modules to a 2.4.32 kernel I noticed that the gre_key function returns a wrong pointer to the GRE key of a version 0 packet thus corrupting the packet payload. The intended behaviour for GREv0 packets is to act like ip_conntrack_proto_generic/ip_nat_proto_unknown so I have ripped the offending functions (not used anymore) and modified the ip_nat_proto_gre modules to not touch version 0 (non PPTP) packets. Signed-off-by: Jorge Boncompte Signed-off-by: Patrick McHardy Signed-off-by: Adrian Bunk

[IPV6]: Disallow RH0 by default (CVE-2007-2242)

2007-04-30T23:31:47Z

A security issue is emerging. Disallow Routing Header Type 0 by default as we have been doing for IPv4. This version already includes a fix for the original patch. Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: Adrian Bunk

V4L: saa7146: Fix allocation of clipping memory

2007-04-13T20:58:25Z

Olaf Hering pointed out that SAA7146_CLIPPING_MEM would become very large for PAGE_SIZE > 4K. In fact, the number of clipping windows is limited to 16, and calculate_clipping_registers_rect() does not use more than 256 bytes. SAA7146_CLIPPING_MEM adjusted accordingly. (cherry picked from commit 7a7cd1920969dd9da4e0d99aab573b3eba24c799) Thanks-to: Olaf Hering Signed-off-by: Oliver Endriss Signed-off-by: Michael Krufky Signed-off-by: Adrian Bunk

fix MTIME_SEC_MAX on 32-bit

2007-04-08T22:54:30Z

The maximum seconds value we can handle on 32bit is LONG_MAX. Signed-off-by: Adrian Bunk

prevent timespec/timeval to ktime_t overflow

2007-04-08T22:03:30Z

Frank v. Waveren pointed out that on 64bit machines the timespec to ktime_t conversion might overflow. This is also true for timeval to time_t conversions. This breaks a "sleep inf" on 64bit machines. While a timespec/timeval with tx.sec = MAX_LONG is valid by specification the internal representation of ktime_t is based on nanoseconds. The conversion of seconds to nanoseconds overflows for seconds values >= (MAX_LONG / NSEC_PER_SEC). Check the seconds argument to the conversion and limit it to the maximum time which can be represented by ktime_t. Signed-off-by: Thomas Gleixner Signed-off-by: Adrian Bunk

[IFB]: Fix crash on input device removal

2007-04-03T02:03:55Z

The input_device pointer is not refcounted, which means the device may disappear while packets are queued, causing a crash when ifb passes packets with a stale skb->dev pointer to netif_rx(). Fix by storing the interface index instead and do a lookup where neccessary. Signed-off-by: Patrick McHardy Signed-off-by: Adrian Bunk

[ALSA] Fix invalid assignment of PCI revision

2007-03-28T20:32:32Z

Fix the type of PCI revision to char from int and avoid invalid assignment with pointer cast. Signed-off-by: Takashi Iwai Signed-off-by: Adrian Bunk

[NET_SCHED]: Fix endless loops caused by inaccurate qlen counters

2007-03-28T19:31:36Z

There are multiple problems related to qlen adjustment that can lead to an upper qdisc getting out of sync with the real number of packets queued, leading to endless dequeueing attempts by the upper layer code. All qdiscs must maintain an accurate q.qlen counter. There are basically two groups of operations affecting the qlen: operations that propagate down the tree (enqueue, dequeue, requeue, drop, reset) beginning at the root qdisc and operations only affecting a subtree or single qdisc (change, graft, delete class). Since qlen changes during operations from the second group don't propagate to ancestor qdiscs, their qlen values become desynchronized. This patch adds a function to propagate qlen changes up the qdisc tree, optionally calling a callback function to perform qdisc-internal maintenance when the child qdisc is deactivated, and converts all qdiscs to use this where necessary. Signed-off-by: Patrick McHardy Signed-off-by: Adrian Bunk

[SERIAL] Fix oops when removing suspended serial port

2007-03-28T19:28:32Z

A serial card might have been removed when the system is resumed. This results in a suspended port being shut down, which results in the ports shutdown method being called twice in a row. This causes BUGs. Avoid this by tracking the suspended state separately from the initialised state. Signed-off-by: Russell King Signed-off-by: Adrian Bunk