kernel/linux.git, branch v2.6.21-rc6

Linux 2.6.21-rc6

2007-04-06T02:36:56+00:00

.. perfect? Ahh, sure. Signed-off-by: Linus Torvalds

[IPSEC]: Reject packets within replay window but outside the bit mask

2007-04-05T07:07:39+00:00

Up until this point we've accepted replay window settings greater than 32 but our bit mask can only accomodate 32 packets. Thus any packet with a sequence number within the window but outside the bit mask would be accepted. This patch causes those packets to be rejected instead. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller

[IPv6]: Exclude truncated packets from InHdrErrors statistics

2007-04-05T06:54:59+00:00

Incoming trancated packets are counted as not only InTruncatedPkts but also InHdrErrors. They should be counted as InTruncatedPkts only. Signed-off-by: Mitsuru Chinen Acked-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller

[APPLETALK]: Fix a remotely triggerable crash

2007-04-05T06:52:46+00:00

When we receive an AppleTalk frame shorter than what its header says, we still attempt to verify its checksum, and trip on the BUG_ON() at the end of function atalk_sum_skb() because of the length mismatch. This has security implications because this can be triggered by simply sending a specially crafted ethernet frame to a target victim, effectively crashing that host. Thus this qualifies, I think, as a remote DoS. Here is the frame I used to trigger the crash, in npg format: { # Ethernet header ----- XX XX XX XX XX XX # Destination MAC 00 00 00 00 00 00 # Source MAC 00 1D # Length # LLC header ----- AA AA 03 08 00 07 80 9B # Appletalk # Appletalk header ----- 00 1B # Packet length (invalid) 00 01 # Fake checksum 00 00 00 00 # Destination and source networks 00 00 00 00 # Destination and source nodes and ports # Payload ----- 0C 0D 0E 0F 10 11 12 13 14 } The destination MAC address must be set to those of the victim. The severity is mitigated by two requirements: * The target host must have the appletalk kernel module loaded. I suspect this isn't so frequent. * AppleTalk frames are non-IP, thus I guess they can only travel on local networks. I am no network expert though, maybe it is possible to somehow encapsulate AppleTalk packets over IP. The bug has been reported back in June 2004: http://bugzilla.kernel.org/show_bug.cgi?id=2979 But it wasn't investigated, and was closed in July 2006 as both reporters had vanished meanwhile. This code was new in kernel 2.6.0-test5: http://git.kernel.org/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=7ab442d7e0a76402c12553ee256f756097cae2d2 And not modified since then, so we can assume that vanilla kernels 2.6.0-test5 and later, and distribution kernels based thereon, are affected. Note that I still do not know for sure what triggered the bug in the real-world cases. The frame could have been corrupted by the kernel if we have a bug hiding somewhere. But more likely, we are receiving the faulty frame from the network. Signed-off-by: Jean Delvare Signed-off-by: David S. Miller

[PATCH] ia64: desc_empty thinko/typo fix

2007-04-05T04:12:48+00:00

Just a one-byter for an ia64 thinko/typo - already fixed for i386 and x86_64. Acked-by: Tony Luck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] Fix build error on zs serial driver

2007-04-05T04:12:47+00:00

drivers/tc/zs.c:73:24: error: asm/dec/tc.h: No such file or directory Signed-off-by: Yoichi Yuasa Acked-by: Maciej W. Rozycki Cc: Ralf Baechle Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] fix jiffies clocksource inittime

2007-04-05T04:12:47+00:00

In debugging a problem w/ the -rt tree, I noticed that on systems that mark the tsc as unstable before it is registered, the TSC would still be selected and used for a short period of time. Digging in it looks to be a result of the mix of the clocksource list changes and my clocksource initialization changes. With the -rt tree, using a bad TSC, even for a short period of time can results in a hang at boot. I was not able to reproduce this hang w/ mainline, but I'm not completely certain that someone won't trip on it. This patch resolves the issue by initializing the jiffies clocksource earlier so a bad TSC won't get selected just because nothing else is yet registered. Signed-off-by: John Stultz Acked-by: Thomas Gleixner Cc: Ingo Molnar Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] cciss: add init of drv->cylinders back to cciss_geometry_inquiry

2007-04-05T04:12:47+00:00

This patch adds initialization of drv->cylinders back into the failing case in cciss_geometry_inquiry. I inadvertently removed it in one my 2TB updates. Signed-off-by: Mike Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] remove protection of LANANA-reserved majors

2007-04-05T04:12:47+00:00

Revert all this. It can cause device-mapper to receive a different major from earlier kernels and it turns out that the Amanda backup program (via GNU tar, apparently) checks major numbers on files when performing incremental backups. Which is a bit broken of Amanda (or tar), but this feature isn't important enough to justify the churn. Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] swsusp: fix memory shrinker

2007-04-05T04:12:47+00:00

Fix a bug in the swsusp's memory shrinker that causes some systems using highmem to refuse to suspend to disk if image_size is set above 1/2 of available RAM. Special thanks to Jiri Slaby for reporting the problem and assistance in debugging it. Signed-off-by: Rafael J. Wysocki Cc: Jiri Slaby Cc: Pavel Machek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds