kernel/linux.git, branch v2.6.16.41-rc1

Linux 2.6.16.41-rc1

2007-02-15T12:56:49+00:00

uml: fix signal frame alignment

2007-02-14T19:37:44+00:00

Use the same signal frame alignment calculations as the underlying architecture. x86_64 appeared to do this, but the "- 8" was really subtracting 8 * sizeof(struct rt_sigframe) rather than 8 bytes. UML/i386 might have been OK, but I changed the calculation to match i386 just to be sure. Signed-off-by: Jeff Dike Signed-off-by: Adrian Bunk

[ALSA] echo3g_dsp.c shouldn't include #include

2007-02-14T19:32:10+00:00

Despite being under linux/, linux/irq.h shouldn't be #include'd by arch independent code. Signed-off-by: Adrian Bunk

Revert "[Bluetooth] Fix compat ioctl for BNEP, CMTP and HIDP"

2007-02-14T13:00:41+00:00

This reverts commit ac4d63dab8bb425f1ae037abf349090c12f16883. Does not work in 2.6.16.

[TCP]: struct tcp_sack_block annotations

2007-02-14T12:58:42+00:00

Some of the instances of tcp_sack_block are host-endian, some - net-endian. Define struct tcp_sack_block_wire identical to struct tcp_sack_block with u32 replaced with __be32; annotate uses of tcp_sack_block replacing net-endian ones with tcp_sack_block_wire. Change is obviously safe since for cc(1) __be32 is typedefed to u32. Signed-off-by: Al Viro Signed-off-by: Adrian Bunk

[IPX]: Fix NULL pointer dereference on ipx unload

2007-02-14T08:40:31+00:00

Fixes a null pointer dereference when unloading the ipx module. On initialization of the ipx module, registering certain packet types can fail. When this happens, unloading the module later dereferences NULL pointers. This patch fixes that. Please apply. Signed-off-by: Jiri Bohac Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk

[NETFILTER]: Clear GSO bits for TCP reset packet

2007-02-14T08:39:09+00:00

The TCP reset packet is copied from the original. This includes all the GSO bits which do not apply to the new packet. So we should clear those bits. Spotted by Patrick McHardy. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk

[TCP]: Don't apply FIN exception to full TSO segments.

2007-02-14T08:34:43+00:00

Signed-off-by: John Heffner Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk

[ATM]: Fix for crash in adummy_init()

2007-02-14T08:33:14+00:00

This was reported by Ingo Molnar here, http://lkml.org/lkml/2006/12/18/119 The problem is that adummy_init() depends on atm_init() , but adummy_init() is called first. So I put atm_init() into subsys_initcall which seems appropriate, and it will still get module_init() if it becomes a module. Interesting to note that you could crash your system here if you just load the modules in the wrong order. Signed-off-by: Daniel Walker Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk

TCP: skb is unexpectedly freed.

2007-02-14T08:31:02+00:00

I encountered a kernel panic with my test program, which is a very simple IPv6 client-server program. The server side sets IPV6_RECVPKTINFO on a listening socket, and the client side just sends a message to the server. Then the kernel panic occurs on the server. (If you need the test program, please let me know. I can provide it.) This problem happens because a skb is forcibly freed in tcp_rcv_state_process(). When a socket in listening state(TCP_LISTEN) receives a syn packet, then tcp_v6_conn_request() will be called from tcp_rcv_state_process(). If the tcp_v6_conn_request() successfully returns, the skb would be discarded by __kfree_skb(). However, in case of a listening socket which was already set IPV6_RECVPKTINFO, an address of the skb will be stored in treq->pktopts and a ref count of the skb will be incremented in tcp_v6_conn_request(). But, even if the skb is still in use, the skb will be freed. Then someone still using the freed skb will cause the kernel panic. I suggest to use kfree_skb() instead of __kfree_skb(). Signed-off-by: Masayuki Nakagawa Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk