r2610 - in trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches: . series
Sven Luther
luther@costa.debian.org
Sat, 05 Mar 2005 10:34:02 +0100
Author: luther
Date: 2005-03-05 10:34:01 +0100 (Sat, 05 Mar 2005)
New Revision: 2610
Removed:
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/amd64-ia32-vsyscall-fix.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/amd64-parse-noexec-fix.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/atyfb-sparc.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/cmsg-compat-signedness-fix-fix.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/fix-mxser-compile.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/ia64-bte_error-missing-include.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/ipv4-fragment-queues.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/nls-table-overflow.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/scsi-ioctl.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/setsid-race-2.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/setsid-race.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/skb-reset-ip_summed.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/smbfs-overflow-fixes.dpatch
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/sparc64-nis-killer.dpatch
Modified:
trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/series/2.6.11-1
Log:
Removed a bunch of upstream applied patches, which where not directly marked as backported.
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/amd64-ia32-vsyscall-fix.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/amd64-ia32-vsyscall-fix.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/amd64-ia32-vsyscall-fix.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,57 +0,0 @@
-#! /bin/sh -e
-## <PATCHNAME>.dpatch by <PATCH_AUTHOR@EMAI>
-##
-## All lines beginning with `## DP:' are a description of the patch.
-## DP: Description: fix crash on get_user_pages of ia32 vsyscall page
-## DP: Patch author: Roland McGrath <roland@redhat.com>
-## DP: Upstream status: backport from 2.6.11-rc2
-
-. $(dirname $0)/DPATCH
-
-@DPATCH@
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2005/01/16 10:09:59-08:00 roland@redhat.com
-# [PATCH] x86_64: fix crash on get_user_pages of ia32 vsyscall page before it's faulted in
-#
-# God invented symbolic names to help you. Repeating magic constants by hand
-# is begging to lose, especially when you get them wrong. Don't be a loser.
-#
-# [ Editor's hint: 0xfffe000 vs 0xffffe000 ]
-#
-# Signed-off-by: Roland McGrath <roland@redhat.com>
-# Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-#
-# arch/x86_64/mm/fault.c
-# 2005/01/15 16:00:00-08:00 roland@redhat.com +1 -1
-# x86_64: fix crash on get_user_pages of ia32 vsyscall page before it's faulted in
-#
-# arch/x86_64/mm/init.c
-# 2005/01/15 16:00:00-08:00 roland@redhat.com +1 -1
-# x86_64: fix crash on get_user_pages of ia32 vsyscall page before it's faulted in
-#
-diff -Nru a/arch/x86_64/mm/fault.c b/arch/x86_64/mm/fault.c
---- a/arch/x86_64/mm/fault.c 2005-01-29 17:34:25 -08:00
-+++ b/arch/x86_64/mm/fault.c 2005-01-29 17:34:25 -08:00
-@@ -462,7 +462,7 @@
- #ifdef CONFIG_IA32_EMULATION
- /* 32bit vsyscall. map on demand. */
- if (test_thread_flag(TIF_IA32) &&
-- address >= 0xffffe000 && address < 0xffffe000 + PAGE_SIZE) {
-+ address >= VSYSCALL32_BASE && address < VSYSCALL32_END) {
- if (map_syscall32(mm, address) < 0)
- goto out_of_memory2;
- return;
-diff -Nru a/arch/x86_64/mm/init.c b/arch/x86_64/mm/init.c
---- a/arch/x86_64/mm/init.c 2005-01-29 17:34:25 -08:00
-+++ b/arch/x86_64/mm/init.c 2005-01-29 17:34:25 -08:00
-@@ -605,7 +605,7 @@
- if (test_tsk_thread_flag(tsk, TIF_IA32)) {
- /* lookup code assumes the pages are present. set them up
- now */
-- if (__map_syscall32(tsk->mm, 0xfffe000) < 0)
-+ if (__map_syscall32(tsk->mm, VSYSCALL32_BASE) < 0)
- return NULL;
- return &gate32_vma;
- }
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/amd64-parse-noexec-fix.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/amd64-parse-noexec-fix.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/amd64-parse-noexec-fix.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,46 +0,0 @@
-#! /bin/sh -e
-## amd64-parse-noexec-fix.dpatch by <fschueler@gmx.net>
-##
-## All lines beginning with `## DP:' are a description of the patch.
-## DP: Description: Fix parsing of noexec boot option
-## DP: Patch author: fabbione@fabbione.net
-## DP: Upstream status: backport from BK current
-
-. $(dirname $0)/DPATCH
-
-@DPATCH@
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2005/02/05 15:10:06-08:00 fabbione@fabbione.net
-# [PATCH] x86_64: parse noexec=[on|off]
-#
-# The patch fixes the noexec= boot option on x86_64 to actually work when
-# other options come after it.
-#
-# Credits (if any ;)) should go to Matt Zimmerman and Colin Watson for
-# spotting the problem and providing/testing the fix.
-#
-# Signed-off-by: Andrew Morton <akpm@osdl.org>
-# Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-#
-# arch/x86_64/kernel/setup64.c
-# 2005/02/05 12:54:22-08:00 fabbione@fabbione.net +2 -2
-# x86_64: parse noexec=[on|off]
-#
-diff -Nru a/arch/x86_64/kernel/setup64.c b/arch/x86_64/kernel/setup64.c
---- a/arch/x86_64/kernel/setup64.c 2005-02-06 05:52:25 -08:00
-+++ b/arch/x86_64/kernel/setup64.c 2005-02-06 05:52:25 -08:00
-@@ -52,10 +52,10 @@
- */
- void __init nonx_setup(const char *str)
- {
-- if (!strcmp(str, "on")) {
-+ if (!strncmp(str, "on", 2)) {
- __supported_pte_mask |= _PAGE_NX;
- do_not_nx = 0;
-- } else if (!strcmp(str, "off")) {
-+ } else if (!strncmp(str, "off", 3)) {
- do_not_nx = 1;
- __supported_pte_mask &= ~_PAGE_NX;
- }
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/atyfb-sparc.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/atyfb-sparc.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/atyfb-sparc.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,133 +0,0 @@
-# origin: linux-sparc (davem)
-# cset: n/a
-# inclusion: pushed for 2.6.11
-# description: fix atyfb on sparc post-2.6.10
-# revision date: 2005-02-15
-
-Path: main.gmane.org!not-for-mail
-From: "David S. Miller" <davem@davemloft.net>
-Newsgroups: gmane.linux.ports.sparc,gmane.linux.debian.ports.sparc,gmane.linux.fbdev.devel
-Subject: Re: [atyfb] No display on Sparc Ultra 10 with kernel 2.6.10-rc2 or
- later
-Date: Tue, 15 Feb 2005 08:49:58 -0800
-Lines: 73
-Approved: news@gmane.org
-Message-ID: <20050215084958.1f68b39b.davem@davemloft.net>
-References: <200502140251.00645.aragorn@tiscali.nl>
- <200502150741.01702.adaplas@hotpop.com>
- <200502150722.24770.aragorn@tiscali.nl>
- <200502152010.22880.adaplas@hotpop.com>
-NNTP-Posting-Host: main.gmane.org
-Mime-Version: 1.0
-Content-Type: text/plain; charset=US-ASCII
-Content-Transfer-Encoding: 7bit
-X-Trace: sea.gmane.org 1108486298 17138 80.91.229.2 (15 Feb 2005 16:51:38 GMT)
-X-Complaints-To: usenet@sea.gmane.org
-NNTP-Posting-Date: Tue, 15 Feb 2005 16:51:38 +0000 (UTC)
-Cc: adaplas@hotpop.com, aragorn@tiscali.nl,
- debian-sparc@lists.debian.org, sparclinux@vger.kernel.org,
- linux-fbdev-devel@lists.sourceforge.net
-Original-X-From: sparclinux-owner@vger.kernel.org Tue Feb 15 17:51:38 2005
-Original-Received: from vger.kernel.org ([12.107.209.244])
- by ciao.gmane.org with esmtp (Exim 4.43)
- id 1D15vC-0002p1-PX
- for lnx-sparclinux@gmane.org; Tue, 15 Feb 2005 17:51:35 +0100
-Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
- id S261793AbVBOQxh (ORCPT <rfc822;lnx-sparclinux@m.gmane.org>);
- Tue, 15 Feb 2005 11:53:37 -0500
-Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org id S261794AbVBOQxh
- (ORCPT <rfc822;sparclinux-outgoing>);
- Tue, 15 Feb 2005 11:53:37 -0500
-Original-Received: from adsl-63-197-226-105.dsl.snfc21.pacbell.net ([63.197.226.105]:44461
- "EHLO cheetah.davemloft.net") by vger.kernel.org with ESMTP
- id S261793AbVBOQwh (ORCPT <rfc822;sparclinux@vger.kernel.org>);
- Tue, 15 Feb 2005 11:52:37 -0500
-Original-Received: from localhost
- ([127.0.0.1] helo=cheetah.davemloft.net ident=davem)
- by cheetah.davemloft.net with smtp (Exim 3.36 #1 (Debian))
- id 1D15te-00061r-00; Tue, 15 Feb 2005 08:49:58 -0800
-Original-To: adaplas@pol.net
-In-Reply-To: <200502152010.22880.adaplas@hotpop.com>
-X-Mailer: Sylpheed version 1.0.1 (GTK+ 1.2.10; sparc-unknown-linux-gnu)
-X-Face: "_;p5u5aPsO,_Vsx"^v-pEq09'CU4&Dc1$fQExov$62l60cgCc%FnIwD=.UF^a>?5'9Kn[;433QFVV9M..2eN.@4ZWPGbdi<=?[:T>y?SD(R*-3It"Vj:)"dP
-Original-Sender: sparclinux-owner@vger.kernel.org
-Precedence: bulk
-X-Mailing-List: sparclinux@vger.kernel.org
-X-MailScanner-From: sparclinux-owner@vger.kernel.org
-X-MailScanner-To: lnx-sparclinux@gmane.org
-Xref: main.gmane.org gmane.linux.ports.sparc:4623 gmane.linux.debian.ports.sparc:8113 gmane.linux.fbdev.devel:6014
-X-Report-Spam: http://spam.gmane.org/gmane.linux.ports.sparc:4623
-
-On Tue, 15 Feb 2005 20:10:21 +0800
-"Antonino A. Daplas" <adaplas@hotpop.com> wrote:
-
-> Okay. It seems that in the working kernel, the default mode, 1152x900, was
-> taken from the prom (since there is no 1152x900 in the mode database) if you
-> did not specify any boot mode option.
->
-> In the non-working version, without the boot mode option, the default_var
-> was used (which is only 640x480) or taken from the mode database if you
-> specified a boot mode.
-
-I think the bug is in the changes made to the fb_find_mode() calls
-in the !CONFIG_PPC case. That looked suspicious to me the first time
-I scanned the atyfb driver diffs in 2.6.11
-
-First of all, a file global declared as "static char *mode" is asking for
-all sorts of trouble. It's very easy to use such a simple name as
-a function local variable, thus making the global one invisible.
-
-I reviewed the driver and there are no cases of local variables named
-"mode" right now, but this is still asking for trouble in the future.
-It should be thus renamed.
-
-Now let's get back to the fb_find_mode() call in aty_init(). The old
-code for the non-CONFIG_PPC case did this:
-
-#ifdef __sparc__
- if (mode_option) {
- if (!fb_find_mode(...))
- var = default_var;
- } else
- var = default_var;
-#else
- if (!fb_find_mode(...))
- var = default_var;
-#endif
-
-The new code calls fb_find_mode() always, this is wrong for Sparc's
-desired behavior:
-
- if (!fb_find_mode(...))
- var = default_var;
-
-On sparc, when "mode" is NULL, we should always use default_var as
-setup by PROM probed values.
-
-Here is the fix:
-
-===== drivers/video/aty/atyfb_base.c 1.82 vs edited =====
---- 1.82/drivers/video/aty/atyfb_base.c 2005-01-04 18:48:32 -08:00
-+++ edited/drivers/video/aty/atyfb_base.c 2005-02-15 08:19:00 -08:00
-@@ -2511,7 +2511,15 @@
- }
- } else
- #endif /* !CONFIG_PPC */
-- if (!fb_find_mode(&var, info, mode, NULL, 0, &defmode, 8))
-+ if (
-+#if defined(CONFIG_SPARC32) || defined(CONFIG_SPARC64)
-+ /* On Sparc, unless the user gave a specific mode
-+ * specification, use the PROM probed values in
-+ * default_var.
-+ */
-+ !mode ||
-+#endif
-+ !fb_find_mode(&var, info, mode, NULL, 0, &defmode, 8))
- var = default_var;
-
- if (noaccel)
--
-To unsubscribe from this list: send the line "unsubscribe sparclinux" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at http://vger.kernel.org/majordomo-info.html
-
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/cmsg-compat-signedness-fix-fix.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/cmsg-compat-signedness-fix-fix.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/cmsg-compat-signedness-fix-fix.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,33 +0,0 @@
-#! /bin/sh -e
-##
-## All lines beginning with `## DP:' are a description of the patch.
-## DP: Description: Fix cmsg_len checks in 32bit compat mode
-## DP: Patch author: Olaf Kirch <okir@suse.de>
-## DP: Upstream status: submitted and accepted, but not in mainline yet
-
-. $(dirname $0)/DPATCH
-
-@DPATCH@
-From: Olaf Kirch <okir@suse.de>
-Subject: Fix cmsg_len checks in 32bit compat mode
-References: 49517 - LTC13227
-
-The recent fixes for cmsg_len handling seem to break 32bit compatibility
-at least on x86_64. The new CMSG_COMPAT_OK macro requires that cmsg_len
-is greater or equal the size of struct cmsghdr, which is the 64bit
-version of the struct. The code should really check against the size
-of struct compat_cmsghdr.
-
-Signed-off-by: Olaf Kirch <okir@suse.de>
-
---- linux-2.6.10/net/compat.c.orig 2005-01-04 13:51:49.000000000 +0100
-+++ linux-2.6.10/net/compat.c 2005-01-04 16:53:38.000000000 +0100
-@@ -125,7 +125,7 @@
- (struct compat_cmsghdr __user *)NULL)
-
- #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
-- ((ucmlen) >= sizeof(struct cmsghdr) && \
-+ ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
- (ucmlen) <= (unsigned long) \
- ((mhdr)->msg_controllen - \
- ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/fix-mxser-compile.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/fix-mxser-compile.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/fix-mxser-compile.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,335 +0,0 @@
-diff -urN RC10-delta13/drivers/char/mxser.c RC10-delta14/drivers/char/mxser.c
---- RC10-delta13/drivers/char/mxser.c Fri Dec 24 20:11:42 2004
-+++ RC10-delta14/drivers/char/mxser.c Mon Dec 27 06:04:22 2004
-@@ -401,7 +401,7 @@
- static void mxser_flush_chars(struct tty_struct *);
- static void mxser_put_char(struct tty_struct *, unsigned char);
- static int mxser_ioctl(struct tty_struct *, struct file *, uint, ulong);
--static int mxser_ioctl_special(unsigned int, unsigned long);
-+static int mxser_ioctl_special(unsigned int, void __user *);
- static void mxser_throttle(struct tty_struct *);
- static void mxser_unthrottle(struct tty_struct *);
- static void mxser_set_termios(struct tty_struct *, struct termios *);
-@@ -417,9 +417,9 @@
- static int mxser_startup(struct mxser_struct *);
- static void mxser_shutdown(struct mxser_struct *);
- static int mxser_change_speed(struct mxser_struct *, struct termios *old_termios);
--static int mxser_get_serial_info(struct mxser_struct *, struct serial_struct *);
--static int mxser_set_serial_info(struct mxser_struct *, struct serial_struct *);
--static int mxser_get_lsr_info(struct mxser_struct *, unsigned int *);
-+static int mxser_get_serial_info(struct mxser_struct *, struct serial_struct __user *);
-+static int mxser_set_serial_info(struct mxser_struct *, struct serial_struct __user *);
-+static int mxser_get_lsr_info(struct mxser_struct *, unsigned int __user *);
- static void mxser_send_break(struct mxser_struct *, int);
- static int mxser_tiocmget(struct tty_struct *, struct file *);
- static int mxser_tiocmset(struct tty_struct *, struct file *, unsigned int, unsigned int);
-@@ -834,6 +834,7 @@
- }
-
- /* start finding PCI board here */
-+#ifdef CONFIG_PCI
- n = (sizeof(mxser_pcibrds) / sizeof(mxser_pcibrds[0])) - 1;
- index = 0;
- b = 0;
-@@ -875,6 +876,7 @@
- m++;
- }
- }
-+#endif
-
- ret1 = 0;
- if (!(ret1 = tty_register_driver(mxvar_sdriver))) {
-@@ -968,7 +970,7 @@
- *tty->termios = info->normal_termios;
- else
- *tty->termios = info->callout_termios;
-- mxser_change_speed(info, 0);
-+ mxser_change_speed(info, NULL);
- }
-
- info->session = current->signal->session;
-@@ -1084,7 +1086,7 @@
-
- tty->closing = 0;
- info->event = 0;
-- info->tty = 0;
-+ info->tty = NULL;
- if (info->blocked_open) {
- if (info->close_delay) {
- set_current_state(TASK_INTERRUPTIBLE);
-@@ -1223,12 +1225,13 @@
- struct mxser_struct *info = (struct mxser_struct *) tty->driver_data;
- int retval;
- struct async_icount cprev, cnow; /* kernel counter temps */
-- struct serial_icounter_struct *p_cuser; /* user space */
-+ struct serial_icounter_struct __user *p_cuser;
- unsigned long templ;
- unsigned long flags;
-+ void __user *argp = (void __user *)arg;
-
- if (tty->index == MXSER_PORTS)
-- return (mxser_ioctl_special(cmd, arg));
-+ return (mxser_ioctl_special(cmd, argp));
-
- // following add by Victor Yu. 01-05-2004
- if (cmd == MOXA_SET_OP_MODE || cmd == MOXA_GET_OP_MODE) {
-@@ -1239,7 +1242,7 @@
-
- p = info->port % 4;
- if (cmd == MOXA_SET_OP_MODE) {
-- if (get_user(opmode, (int *) arg))
-+ if (get_user(opmode, (int __user *) argp))
- return -EFAULT;
- if (opmode != RS232_MODE && opmode != RS485_2WIRE_MODE && opmode != RS422_MODE && opmode != RS485_4WIRE_MODE)
- return -EFAULT;
-@@ -1253,7 +1256,7 @@
- shiftbit = p * 2;
- opmode = inb(info->opmode_ioaddr) >> shiftbit;
- opmode &= OP_MODE_MASK;
-- if (copy_to_user((int *) arg, &opmode, sizeof(int)))
-+ if (copy_to_user(argp, &opmode, sizeof(int)))
- return -EFAULT;
- }
- return 0;
-@@ -1281,19 +1284,19 @@
- mxser_send_break(info, arg ? arg * (HZ / 10) : HZ / 4);
- return (0);
- case TIOCGSOFTCAR:
-- return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long *) arg);
-+ return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *) argp);
- case TIOCSSOFTCAR:
-- if (get_user(templ, (unsigned long *) arg))
-+ if (get_user(templ, (unsigned long __user *) argp))
- return -EFAULT;
- arg = templ;
- tty->termios->c_cflag = ((tty->termios->c_cflag & ~CLOCAL) | (arg ? CLOCAL : 0));
- return (0);
- case TIOCGSERIAL:
-- return (mxser_get_serial_info(info, (struct serial_struct *) arg));
-+ return mxser_get_serial_info(info, argp);
- case TIOCSSERIAL:
-- return (mxser_set_serial_info(info, (struct serial_struct *) arg));
-+ return mxser_set_serial_info(info, argp);
- case TIOCSERGETLSR: /* Get line status register */
-- return (mxser_get_lsr_info(info, (unsigned int *) arg));
-+ return mxser_get_lsr_info(info, argp);
- /*
- * Wait for any of the 4 modem inputs (DCD,RI,DSR,CTS) to change
- * - mask passed in arg for lines of interest
-@@ -1340,7 +1343,7 @@
- spin_lock_irqsave(&info->slock, flags);
- cnow = info->icount;
- spin_unlock_irqrestore(&info->slock, flags);
-- p_cuser = (struct serial_icounter_struct *) arg;
-+ p_cuser = argp;
- /* modified by casper 1/11/2000 */
- if (put_user(cnow.frame, &p_cuser->frame))
- return -EFAULT;
-@@ -1364,7 +1367,7 @@
- /* */
- return 0;
- case MOXA_HighSpeedOn:
-- return put_user(info->baud_base != 115200 ? 1 : 0, (int *) arg);
-+ return put_user(info->baud_base != 115200 ? 1 : 0, (int __user *) argp);
-
- case MOXA_SDS_RSTICOUNTER:{
- info->mon_data.rxcnt = 0;
-@@ -1374,13 +1377,13 @@
- // (above) added by James.
- case MOXA_ASPP_SETBAUD:{
- long baud;
-- if (get_user(baud, (long *) arg))
-+ if (get_user(baud, (long __user *) argp))
- return -EFAULT;
- mxser_set_baud(info, baud);
- return 0;
- }
- case MOXA_ASPP_GETBAUD:
-- if (copy_to_user((long *) arg, &info->realbaud, sizeof(long)))
-+ if (copy_to_user(argp, &info->realbaud, sizeof(long)))
- return -EFAULT;
-
- return 0;
-@@ -1394,7 +1397,7 @@
-
- len += (lsr ? 0 : 1);
-
-- if (copy_to_user((int *) arg, &len, sizeof(int)))
-+ if (copy_to_user(argp, &len, sizeof(int)))
- return -EFAULT;
-
- return 0;
-@@ -1423,7 +1426,7 @@
- info->mon_data.hold_reason &= ~NPPI_NOTIFY_CTSHOLD;
-
-
-- if (copy_to_user((struct mxser_mon *) arg, &(info->mon_data), sizeof(struct mxser_mon)))
-+ if (copy_to_user(argp, &info->mon_data, sizeof(struct mxser_mon)))
- return -EFAULT;
-
- return 0;
-@@ -1431,7 +1434,7 @@
- }
-
- case MOXA_ASPP_LSTATUS:{
-- if (copy_to_user((struct mxser_mon *) arg, &(info->err_shadow), sizeof(unsigned char)))
-+ if (copy_to_user(argp, &info->err_shadow, sizeof(unsigned char)))
- return -EFAULT;
-
- info->err_shadow = 0;
-@@ -1440,10 +1443,10 @@
- }
- case MOXA_SET_BAUD_METHOD:{
- int method;
-- if (get_user(method, (int *) arg))
-+ if (get_user(method, (int __user *) argp))
- return -EFAULT;
- mxser_set_baud_method[info->port] = method;
-- if (copy_to_user((int *) arg, &method, sizeof(int)))
-+ if (copy_to_user(argp, &method, sizeof(int)))
- return -EFAULT;
-
- return 0;
-@@ -1454,22 +1457,26 @@
- return 0;
- }
-
--static int mxser_ioctl_special(unsigned int cmd, unsigned long arg)
-+#ifndef CMSPAR
-+#define CMSPAR 010000000000
-+#endif
-+
-+static int mxser_ioctl_special(unsigned int cmd, void __user *argp)
- {
- int i, result, status;
-
- switch (cmd) {
- case MOXA_GET_CONF:
-- if (copy_to_user((struct mxser_hwconf *) arg, mxsercfg, sizeof(struct mxser_hwconf) * 4))
-+ if (copy_to_user(argp, mxsercfg, sizeof(struct mxser_hwconf) * 4))
- return -EFAULT;
- return 0;
- case MOXA_GET_MAJOR:
-- if (copy_to_user((int *) arg, &ttymajor, sizeof(int)))
-+ if (copy_to_user(argp, &ttymajor, sizeof(int)))
- return -EFAULT;
- return 0;
-
- case MOXA_GET_CUMAJOR:
-- if (copy_to_user((int *) arg, &calloutmajor, sizeof(int)))
-+ if (copy_to_user(argp, &calloutmajor, sizeof(int)))
- return -EFAULT;
- return 0;
-
-@@ -1479,9 +1486,9 @@
- if (mxvar_table[i].base)
- result |= (1 << i);
- }
-- return put_user(result, (unsigned long *) arg);
-+ return put_user(result, (unsigned long __user *) argp);
- case MOXA_GETDATACOUNT:
-- if (copy_to_user((struct mxser_log *) arg, &mxvar_log, sizeof(mxvar_log)))
-+ if (copy_to_user(argp, &mxvar_log, sizeof(mxvar_log)))
- return -EFAULT;
- return (0);
- case MOXA_GETMSTATUS:
-@@ -1516,7 +1523,7 @@
- else
- GMStatus[i].cts = 0;
- }
-- if (copy_to_user((struct mxser_mstatus *) arg, GMStatus, sizeof(struct mxser_mstatus) * MXSER_PORTS))
-+ if (copy_to_user(argp, GMStatus, sizeof(struct mxser_mstatus) * MXSER_PORTS))
- return -EFAULT;
- return 0;
- case MOXA_ASPP_MON_EXT:{
-@@ -1584,7 +1591,7 @@
- mon_data_ext.iftype[i] = opmode;
-
- }
-- if (copy_to_user((struct mxser_mon_ext *) arg, &mon_data_ext, sizeof(struct mxser_mon_ext)))
-+ if (copy_to_user(argp, &mon_data_ext, sizeof(struct mxser_mon_ext)))
- return -EFAULT;
-
- return 0;
-@@ -1829,7 +1836,7 @@
- info->event = 0;
- info->count = 0;
- info->flags &= ~ASYNC_NORMAL_ACTIVE;
-- info->tty = 0;
-+ info->tty = NULL;
- wake_up_interruptible(&info->open_wait);
- }
-
-@@ -1866,7 +1873,7 @@
- int pass_counter = 0;
- int handled = IRQ_NONE;
-
-- port = 0;
-+ port = NULL;
- //spin_lock(&gm_lock);
-
- for (i = 0; i < MXSER_BOARDS; i++) {
-@@ -2412,7 +2419,7 @@
- * and set the speed of the serial port
- */
- spin_unlock_irqrestore(&info->slock, flags);
-- mxser_change_speed(info, 0);
-+ mxser_change_speed(info, NULL);
-
- info->flags |= ASYNC_INITIALIZED;
- return (0);
-@@ -2442,7 +2449,7 @@
- */
- if (info->xmit_buf) {
- free_page((unsigned long) info->xmit_buf);
-- info->xmit_buf = 0;
-+ info->xmit_buf = NULL;
- }
-
- info->IER = 0;
-@@ -2591,9 +2598,6 @@
- cval |= 0x04;
- if (cflag & PARENB)
- cval |= UART_LCR_PARITY;
--#ifndef CMSPAR
--#define CMSPAR 010000000000
--#endif
- if (!(cflag & PARODD)) {
- cval |= UART_LCR_EPAR;
- }
-@@ -2807,7 +2811,7 @@
- * friends of mxser_ioctl()
- * ------------------------------------------------------------
- */
--static int mxser_get_serial_info(struct mxser_struct *info, struct serial_struct *retinfo)
-+static int mxser_get_serial_info(struct mxser_struct *info, struct serial_struct __user *retinfo)
- {
- struct serial_struct tmp;
-
-@@ -2829,7 +2833,7 @@
- return (0);
- }
-
--static int mxser_set_serial_info(struct mxser_struct *info, struct serial_struct *new_info)
-+static int mxser_set_serial_info(struct mxser_struct *info, struct serial_struct __user *new_info)
- {
- struct serial_struct new_serial;
- unsigned int flags;
-@@ -2869,7 +2873,7 @@
- /* */
- if (info->flags & ASYNC_INITIALIZED) {
- if (flags != (info->flags & ASYNC_SPD_MASK)) {
-- mxser_change_speed(info, 0);
-+ mxser_change_speed(info, NULL);
- }
- } else {
- retval = mxser_startup(info);
-@@ -2887,7 +2891,7 @@
- * transmit holding register is empty. This functionality
- * allows an RS485 driver to be written in user space.
- */
--static int mxser_get_lsr_info(struct mxser_struct *info, unsigned int *value)
-+static int mxser_get_lsr_info(struct mxser_struct *info, unsigned int __user *value)
- {
- unsigned char status;
- unsigned int result;
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/ia64-bte_error-missing-include.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/ia64-bte_error-missing-include.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/ia64-bte_error-missing-include.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,29 +0,0 @@
-#! /bin/sh -e
-## DP: Description: Add include for missing HZ define - fixes UP builds
-## DP: Patch author: dann frazier <dannf@hp.com>
-## DP: Upstream status: Submitted
-
-. $(dirname $0)/DPATCH
-
-@DPATCH@
-A UP build of 2.6.10 fails in bte_error.c because HZ is undefined.
-Approved by Jesse in Message-Id: <200501061330.48941.jbarnes@engr.sgi.com>
-
-Signed-off-by: dann frazier <dannf@hp.com>
-Signed-off-by: Jesse Barnes <jbarnes@engr.sgi.com>
-
---- kernel-source-2.6.10/arch/ia64/sn/kernel/bte_error.c.orig 2005-01-06 13:20:10.954478087 -0700
-+++ kernel-source-2.6.10/arch/ia64/sn/kernel/bte_error.c 2005-01-06 12:54:41.483793698 -0700
-@@ -15,6 +15,7 @@
- #include "xtalk/xwidgetdev.h"
- #include "xtalk/hubdev.h"
- #include <asm/sn/bte.h>
-+#include <asm/param.h>
-
- /*
- * Bte error handling is done in two parts. The first captures
--
-To unsubscribe from this list: send the line "unsubscribe linux-ia64" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at http://vger.kernel.org/majordomo-info.html
-
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/ipv4-fragment-queues.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/ipv4-fragment-queues.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/ipv4-fragment-queues.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,404 +0,0 @@
-# origin: bk
-# key: 41f8843a8ZMCNuP3meYAYnnXd3CO_g (linux-2.5)
-# description: global availability of fragment queues allows information leak
-# inclusion: 2.6.11?
-# revision date: 2005-02-18
-
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2005/01/26 22:03:38-08:00 kaber@trash.net
-# [IPV4]: Keep fragment queues private to each user.
-#
-# Signed-off-by: Patrick McHardy <kaber@trash.net>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-# include/linux/netfilter_ipv4/ip_conntrack.h
-# 2005/01/26 22:03:17-08:00 kaber@trash.net +1 -2
-# [IPV4]: Keep fragment queues private to each user.
-#
-# Signed-off-by: Patrick McHardy <kaber@trash.net>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-# include/net/ip.h
-# 2005/01/26 22:03:17-08:00 kaber@trash.net +14 -3
-# [IPV4]: Keep fragment queues private to each user.
-#
-# Signed-off-by: Patrick McHardy <kaber@trash.net>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-# net/ipv4/ip_fragment.c
-# 2005/01/26 22:03:17-08:00 kaber@trash.net +13 -20
-# [IPV4]: Keep fragment queues private to each user.
-#
-# Signed-off-by: Patrick McHardy <kaber@trash.net>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-# net/ipv4/ip_input.c
-# 2005/01/26 22:03:17-08:00 kaber@trash.net +2 -2
-# [IPV4]: Keep fragment queues private to each user.
-#
-# Signed-off-by: Patrick McHardy <kaber@trash.net>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-# net/ipv4/ipvs/ip_vs_core.c
-# 2005/01/26 22:03:17-08:00 kaber@trash.net +11 -8
-# [IPV4]: Keep fragment queues private to each user.
-#
-# Signed-off-by: Patrick McHardy <kaber@trash.net>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-# net/ipv4/netfilter/ip_conntrack_core.c
-# 2005/01/26 22:03:17-08:00 kaber@trash.net +2 -9
-# [IPV4]: Keep fragment queues private to each user.
-#
-# Signed-off-by: Patrick McHardy <kaber@trash.net>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-# net/ipv4/netfilter/ip_conntrack_standalone.c
-# 2005/01/26 22:03:17-08:00 kaber@trash.net +4 -7
-# [IPV4]: Keep fragment queues private to each user.
-#
-# Signed-off-by: Patrick McHardy <kaber@trash.net>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-# net/ipv4/netfilter/ip_nat_standalone.c
-# 2005/01/26 22:03:17-08:00 kaber@trash.net +1 -1
-# [IPV4]: Keep fragment queues private to each user.
-#
-# Signed-off-by: Patrick McHardy <kaber@trash.net>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-diff -Nru a/include/linux/netfilter_ipv4/ip_conntrack.h b/include/linux/netfilter_ipv4/ip_conntrack.h
---- a/include/linux/netfilter_ipv4/ip_conntrack.h 2005-02-18 18:05:57 -08:00
-+++ b/include/linux/netfilter_ipv4/ip_conntrack.h 2005-02-18 18:05:57 -08:00
-@@ -262,10 +262,9 @@
- /* Fake conntrack entry for untracked connections */
- extern struct ip_conntrack ip_conntrack_untracked;
-
--extern int ip_ct_no_defrag;
- /* Returns new sk_buff, or NULL */
- struct sk_buff *
--ip_ct_gather_frags(struct sk_buff *skb);
-+ip_ct_gather_frags(struct sk_buff *skb, u_int32_t user);
-
- /* Iterate over all conntracks: if iter returns true, it's deleted. */
- extern void
-diff -Nru a/include/net/ip.h b/include/net/ip.h
---- a/include/net/ip.h 2005-02-18 18:05:57 -08:00
-+++ b/include/net/ip.h 2005-02-18 18:05:57 -08:00
-@@ -286,9 +286,20 @@
- /*
- * Functions provided by ip_fragment.o
- */
--
--struct sk_buff *ip_defrag(struct sk_buff *skb);
--extern void ipfrag_flush(void);
-+
-+enum ip_defrag_users
-+{
-+ IP_DEFRAG_LOCAL_DELIVER,
-+ IP_DEFRAG_CALL_RA_CHAIN,
-+ IP_DEFRAG_CONNTRACK_IN,
-+ IP_DEFRAG_CONNTRACK_OUT,
-+ IP_DEFRAG_NAT_OUT,
-+ IP_DEFRAG_VS_IN,
-+ IP_DEFRAG_VS_OUT,
-+ IP_DEFRAG_VS_FWD
-+};
-+
-+struct sk_buff *ip_defrag(struct sk_buff *skb, u32 user);
- extern int ip_frag_nqueues;
- extern atomic_t ip_frag_mem;
-
-diff -Nru a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
---- a/net/ipv4/ip_fragment.c 2005-02-18 18:05:57 -08:00
-+++ b/net/ipv4/ip_fragment.c 2005-02-18 18:05:57 -08:00
-@@ -73,6 +73,7 @@
- struct ipq {
- struct ipq *next; /* linked list pointers */
- struct list_head lru_list; /* lru list member */
-+ u32 user;
- u32 saddr;
- u32 daddr;
- u16 id;
-@@ -243,13 +244,13 @@
- /* Memory limiting on fragments. Evictor trashes the oldest
- * fragment queue until we are back under the threshold.
- */
--static void __ip_evictor(int threshold)
-+static void ip_evictor(void)
- {
- struct ipq *qp;
- struct list_head *tmp;
- int work;
-
-- work = atomic_read(&ip_frag_mem) - threshold;
-+ work = atomic_read(&ip_frag_mem) - sysctl_ipfrag_low_thresh;
- if (work <= 0)
- return;
-
-@@ -274,11 +275,6 @@
- }
- }
-
--static inline void ip_evictor(void)
--{
-- __ip_evictor(sysctl_ipfrag_low_thresh);
--}
--
- /*
- * Oops, a fragment queue timed out. Kill it and send an ICMP reply.
- */
-@@ -325,7 +321,8 @@
- if(qp->id == qp_in->id &&
- qp->saddr == qp_in->saddr &&
- qp->daddr == qp_in->daddr &&
-- qp->protocol == qp_in->protocol) {
-+ qp->protocol == qp_in->protocol &&
-+ qp->user == qp_in->user) {
- atomic_inc(&qp->refcnt);
- write_unlock(&ipfrag_lock);
- qp_in->last_in |= COMPLETE;
-@@ -352,7 +349,7 @@
- }
-
- /* Add an entry to the 'ipq' queue for a newly received IP datagram. */
--static struct ipq *ip_frag_create(unsigned hash, struct iphdr *iph)
-+static struct ipq *ip_frag_create(unsigned hash, struct iphdr *iph, u32 user)
- {
- struct ipq *qp;
-
-@@ -364,6 +361,7 @@
- qp->id = iph->id;
- qp->saddr = iph->saddr;
- qp->daddr = iph->daddr;
-+ qp->user = user;
- qp->len = 0;
- qp->meat = 0;
- qp->fragments = NULL;
-@@ -386,7 +384,7 @@
- /* Find the correct entry in the "incomplete datagrams" queue for
- * this IP datagram, and create new one, if nothing is found.
- */
--static inline struct ipq *ip_find(struct iphdr *iph)
-+static inline struct ipq *ip_find(struct iphdr *iph, u32 user)
- {
- __u16 id = iph->id;
- __u32 saddr = iph->saddr;
-@@ -400,7 +398,8 @@
- if(qp->id == id &&
- qp->saddr == saddr &&
- qp->daddr == daddr &&
-- qp->protocol == protocol) {
-+ qp->protocol == protocol &&
-+ qp->user == user) {
- atomic_inc(&qp->refcnt);
- read_unlock(&ipfrag_lock);
- return qp;
-@@ -408,7 +407,7 @@
- }
- read_unlock(&ipfrag_lock);
-
-- return ip_frag_create(hash, iph);
-+ return ip_frag_create(hash, iph, user);
- }
-
- /* Add new segment to existing queue. */
-@@ -642,7 +641,7 @@
- }
-
- /* Process an incoming IP datagram fragment. */
--struct sk_buff *ip_defrag(struct sk_buff *skb)
-+struct sk_buff *ip_defrag(struct sk_buff *skb, u32 user)
- {
- struct iphdr *iph = skb->nh.iph;
- struct ipq *qp;
-@@ -657,7 +656,7 @@
- dev = skb->dev;
-
- /* Lookup (or create) queue header */
-- if ((qp = ip_find(iph)) != NULL) {
-+ if ((qp = ip_find(iph, user)) != NULL) {
- struct sk_buff *ret = NULL;
-
- spin_lock(&qp->lock);
-@@ -689,10 +688,4 @@
- add_timer(&ipfrag_secret_timer);
- }
-
--void ipfrag_flush(void)
--{
-- __ip_evictor(0);
--}
--
- EXPORT_SYMBOL(ip_defrag);
--EXPORT_SYMBOL(ipfrag_flush);
-diff -Nru a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
---- a/net/ipv4/ip_input.c 2005-02-18 18:05:57 -08:00
-+++ b/net/ipv4/ip_input.c 2005-02-18 18:05:57 -08:00
-@@ -172,7 +172,7 @@
- (!sk->sk_bound_dev_if ||
- sk->sk_bound_dev_if == skb->dev->ifindex)) {
- if (skb->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
-- skb = ip_defrag(skb);
-+ skb = ip_defrag(skb, IP_DEFRAG_CALL_RA_CHAIN);
- if (skb == NULL) {
- read_unlock(&ip_ra_lock);
- return 1;
-@@ -273,7 +273,7 @@
- */
-
- if (skb->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
-- skb = ip_defrag(skb);
-+ skb = ip_defrag(skb, IP_DEFRAG_LOCAL_DELIVER);
- if (!skb)
- return 0;
- }
-diff -Nru a/net/ipv4/ipvs/ip_vs_core.c b/net/ipv4/ipvs/ip_vs_core.c
---- a/net/ipv4/ipvs/ip_vs_core.c 2005-02-18 18:05:57 -08:00
-+++ b/net/ipv4/ipvs/ip_vs_core.c 2005-02-18 18:05:57 -08:00
-@@ -544,9 +544,9 @@
- }
-
- static inline struct sk_buff *
--ip_vs_gather_frags(struct sk_buff *skb)
-+ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)
- {
-- skb = ip_defrag(skb);
-+ skb = ip_defrag(skb, user);
- if (skb)
- ip_send_check(skb->nh.iph);
- return skb;
-@@ -620,7 +620,7 @@
-
- /* reassemble IP fragments */
- if (skb->nh.iph->frag_off & __constant_htons(IP_MF|IP_OFFSET)) {
-- skb = ip_vs_gather_frags(skb);
-+ skb = ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT);
- if (!skb)
- return NF_STOLEN;
- *pskb = skb;
-@@ -759,7 +759,7 @@
- /* reassemble IP fragments */
- if (unlikely(iph->frag_off & __constant_htons(IP_MF|IP_OFFSET) &&
- !pp->dont_defrag)) {
-- skb = ip_vs_gather_frags(skb);
-+ skb = ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT);
- if (!skb)
- return NF_STOLEN;
- iph = skb->nh.iph;
-@@ -839,7 +839,8 @@
- * forward to the right destination host if relevant.
- * Currently handles error types - unreachable, quench, ttl exceeded.
- */
--static int ip_vs_in_icmp(struct sk_buff **pskb, int *related)
-+static int
-+ip_vs_in_icmp(struct sk_buff **pskb, int *related, unsigned int hooknum)
- {
- struct sk_buff *skb = *pskb;
- struct iphdr *iph;
-@@ -853,7 +854,9 @@
-
- /* reassemble IP fragments */
- if (skb->nh.iph->frag_off & __constant_htons(IP_MF|IP_OFFSET)) {
-- skb = ip_vs_gather_frags(skb);
-+ skb = ip_vs_gather_frags(skb,
-+ hooknum == NF_IP_LOCAL_IN ?
-+ IP_DEFRAG_VS_IN : IP_DEFRAG_VS_FWD);
- if (!skb)
- return NF_STOLEN;
- *pskb = skb;
-@@ -962,7 +965,7 @@
-
- iph = skb->nh.iph;
- if (unlikely(iph->protocol == IPPROTO_ICMP)) {
-- int related, verdict = ip_vs_in_icmp(pskb, &related);
-+ int related, verdict = ip_vs_in_icmp(pskb, &related, hooknum);
-
- if (related)
- return verdict;
-@@ -1057,7 +1060,7 @@
- if ((*pskb)->nh.iph->protocol != IPPROTO_ICMP)
- return NF_ACCEPT;
-
-- return ip_vs_in_icmp(pskb, &r);
-+ return ip_vs_in_icmp(pskb, &r, hooknum);
- }
-
-
-diff -Nru a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
---- a/net/ipv4/netfilter/ip_conntrack_core.c 2005-02-18 18:05:57 -08:00
-+++ b/net/ipv4/netfilter/ip_conntrack_core.c 2005-02-18 18:05:57 -08:00
-@@ -936,29 +936,22 @@
- }
- }
-
--int ip_ct_no_defrag;
--
- /* Returns new sk_buff, or NULL */
- struct sk_buff *
--ip_ct_gather_frags(struct sk_buff *skb)
-+ip_ct_gather_frags(struct sk_buff *skb, u_int32_t user)
- {
- struct sock *sk = skb->sk;
- #ifdef CONFIG_NETFILTER_DEBUG
- unsigned int olddebug = skb->nf_debug;
- #endif
-
-- if (unlikely(ip_ct_no_defrag)) {
-- kfree_skb(skb);
-- return NULL;
-- }
--
- if (sk) {
- sock_hold(sk);
- skb_orphan(skb);
- }
-
- local_bh_disable();
-- skb = ip_defrag(skb);
-+ skb = ip_defrag(skb, user);
- local_bh_enable();
-
- if (!skb) {
-diff -Nru a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
---- a/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-02-18 18:05:57 -08:00
-+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-02-18 18:05:57 -08:00
-@@ -391,7 +391,10 @@
-
- /* Gather fragments. */
- if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
-- *pskb = ip_ct_gather_frags(*pskb);
-+ *pskb = ip_ct_gather_frags(*pskb,
-+ hooknum == NF_IP_PRE_ROUTING ?
-+ IP_DEFRAG_CONNTRACK_IN :
-+ IP_DEFRAG_CONNTRACK_OUT);
- if (!*pskb)
- return NF_STOLEN;
- }
-@@ -823,12 +826,6 @@
- cleanup_defraglocalops:
- nf_unregister_hook(&ip_conntrack_defrag_local_out_ops);
- cleanup_defragops:
-- /* Frag queues may hold fragments with skb->dst == NULL */
-- ip_ct_no_defrag = 1;
-- synchronize_net();
-- local_bh_disable();
-- ipfrag_flush();
-- local_bh_enable();
- nf_unregister_hook(&ip_conntrack_defrag_ops);
- cleanup_proc_stat:
- #ifdef CONFIG_PROC_FS
-diff -Nru a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
---- a/net/ipv4/netfilter/ip_nat_standalone.c 2005-02-18 18:05:57 -08:00
-+++ b/net/ipv4/netfilter/ip_nat_standalone.c 2005-02-18 18:05:57 -08:00
-@@ -195,7 +195,7 @@
- I'm starting to have nightmares about fragments. */
-
- if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
-- *pskb = ip_ct_gather_frags(*pskb);
-+ *pskb = ip_ct_gather_frags(*pskb, IP_DEFRAG_NAT_OUT);
-
- if (!*pskb)
- return NF_STOLEN;
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/nls-table-overflow.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/nls-table-overflow.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/nls-table-overflow.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,67 +0,0 @@
-# origin: bk
-# key: 41e2bfbeOiXFga62XrBhzm7Kv9QDmQ (linux-2.6)
-# description: NLS table should be 256 entries, not 128
-# inclusion: 2.6.11?
-# revision date: 2005-02-18
-
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2005/01/10 09:47:42-08:00 hirofumi@mail.parknet.co.jp
-# [PATCH] NLS: Fix overflow of nls_ascii
-#
-# The nls_ascii conversion table is just for 128 entries, but should be
-# 256.
-#
-# Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
-# Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-#
-# fs/nls/nls_ascii.c
-# 2005/01/10 09:31:32-08:00 hirofumi@mail.parknet.co.jp +6 -6
-# NLS: Fix overflow of nls_ascii
-#
-diff -Nru a/fs/nls/nls_ascii.c b/fs/nls/nls_ascii.c
---- a/fs/nls/nls_ascii.c 2005-02-18 18:12:27 -08:00
-+++ b/fs/nls/nls_ascii.c 2005-02-18 18:12:27 -08:00
-@@ -13,7 +13,7 @@
- #include <linux/nls.h>
- #include <linux/errno.h>
-
--static wchar_t charset2uni[128] = {
-+static wchar_t charset2uni[256] = {
- /* 0x00*/
- 0x0000, 0x0001, 0x0002, 0x0003,
- 0x0004, 0x0005, 0x0006, 0x0007,
-@@ -56,7 +56,7 @@
- 0x007c, 0x007d, 0x007e, 0x007f,
- };
-
--static unsigned char page00[128] = {
-+static unsigned char page00[256] = {
- 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, /* 0x00-0x07 */
- 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* 0x08-0x0f */
- 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, /* 0x10-0x17 */
-@@ -75,11 +75,11 @@
- 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, /* 0x78-0x7f */
- };
-
--static unsigned char *page_uni2charset[128] = {
-- page00, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-+static unsigned char *page_uni2charset[256] = {
-+ page00,
- };
-
--static unsigned char charset2lower[128] = {
-+static unsigned char charset2lower[256] = {
- 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, /* 0x00-0x07 */
- 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* 0x08-0x0f */
- 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, /* 0x10-0x17 */
-@@ -98,7 +98,7 @@
- 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, /* 0x78-0x7f */
- };
-
--static unsigned char charset2upper[128] = {
-+static unsigned char charset2upper[256] = {
- 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, /* 0x00-0x07 */
- 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* 0x08-0x0f */
- 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, /* 0x10-0x17 */
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/scsi-ioctl.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/scsi-ioctl.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/scsi-ioctl.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,47 +0,0 @@
-#! /bin/sh -e
-## <PATCHNAME>.dpatch by <PATCH_AUTHOR@EMAI>
-##
-## All lines beginning with `## DP:' are a description of the patch.
-## DP: Description: [PATCH] scsi_ioctl: only warn about really unknown opcodes
-## DP: Patch author: torvalds
-## DP: Upstream status: backport
-
-. $(dirname $0)/DPATCH
-
-@DPATCH@
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2005/01/20 07:42:05-08:00 torvalds@ppc970.osdl.org
-# scsi_ioctl: only warn about unknown opcodes if they are truly unknown.
-#
-# We could screw up and warn for opcodes that weren't write-safe and the
-# user tried to use without having write permissions.
-#
-# Not so bad in itself, but that also destroyed the cmd type information.
-#
-# Noticed by Michal Schmidt
-#
-# drivers/block/scsi_ioctl.c
-# 2005/01/20 07:41:57-08:00 torvalds@ppc970.osdl.org +1 -1
-# scsi_ioctl: only warn about unknown opcodes if they are truly unknown.
-#
-# We could screw up and warn for opcodes that weren't write-safe and the
-# user tried to use without having write permissions.
-#
-# Not so bad in itself, but that also destroyed the cmd type information.
-#
-# Noticed by Michal Schmidt
-#
-diff -Nru a/drivers/block/scsi_ioctl.c b/drivers/block/scsi_ioctl.c
---- a/drivers/block/scsi_ioctl.c 2005-01-21 10:31:55 -08:00
-+++ b/drivers/block/scsi_ioctl.c 2005-01-21 10:31:55 -08:00
-@@ -199,7 +199,7 @@
- return 0;
- }
-
-- if (!(type & CMD_WARNED)) {
-+ if (!type) {
- cmd_type[cmd[0]] = CMD_WARNED;
- printk(KERN_WARNING "scsi: unknown opcode 0x%02x\n", cmd[0]);
- }
Modified: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/series/2.6.11-1
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/series/2.6.11-1 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/series/2.6.11-1 2005-03-05 09:34:01 UTC (rev 2610)
@@ -50,25 +50,11 @@
# + ia64-generic-no-smp-1-to-2.dpatch # FAILED
# + 029-random_poolsize_overflow.dpatch # FAILED
# + 030-moxa_user_copy_checking.dpatch # FAILED
-# + ia64-bte_error-missing-include.dpatch # REVERSED, may be upstream ?
# + ia64-irq-affinity-upfix.dpatch # OK, needs rediff
-# + smbfs-overflow-fixes.dpatch # REVERSED, may be upstream ?
# + drivers-ide-__devinit.dpatch # FAILED
-# + fix-mxser-compile.dpatch # REVERSED, may be upstream ?
# + fix-alpha-ext3-oops.dpatch # OK, needs rediff
-# + cmsg-compat-signedness-fix-fix.dpatch # REVERSED, may be upstream ?
-# + scsi-ioctl.dpatch # REVERSED, may be upstream ?
-# + amd64-ia32-vsyscall-fix.dpatch # REVERSED, may be upstream ?
-# + amd64-parse-noexec-fix.dpatch # REVERSED, may be upstream ?
-# + amd64-int3-fix.dpatch # REVERSED, may be upstream ?
+# + amd64-int3-fix.dpatch # PARTIALLY REVERSED, needs investigating.
# + fbdev-radeon-noaccel.dpatch # OK, needs rediff
-# + atyfb-sparc.dpatch # REVERSED, may be upstream ?
-# + skb-reset-ip_summed.dpatch # REVERSED, may be upstream ?
-# + sparc64-nis-killer.dpatch # REVERSED, may be upstream ?
# + sparc32-hypersparc-srmmu.dpatch # OK, needs rediff
-# + setsid-race.dpatch # REVERSED, may be upstream ?
-# + setsid-race-2.dpatch # REVERSED, may be upstream ?
-# + ipv4-fragment-queues.dpatch # REVERSED, may be upstream ?
# + ipv4-fragment-queues-2.dpatch # FAILED
-# + nls-table-overflow.dpatch # REVERSED, may be upstream ?
# + amd64-noexec32-backport.dpatch # FAILED
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/setsid-race-2.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/setsid-race-2.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/setsid-race-2.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,51 +0,0 @@
-# origin: jgarzik (BitKeeper)
-# cset: 1.1966.27.2 (2.6) key=41deb8dbtBo-XheRdYFJvHQdoWvMaA
-# URL: http://linux.bkbits.net:8080/linux-2.6/gnupatch@41deb8dbtBo-XheRdYFJvHQdoWvMaA
-# inclusion: upstream
-# descrition: [PATCH] x86-64: kernel/sys.c build fix
-# revision date: Wed, 23 Feb 2005 10:51:48 +0900
-#
-# S rset: ChangeSet|1.1966.27.1..1.1966.27.2
-# I rset: kernel/sys.c|1.101..1.102
-#
-# Key:
-# S: Skipped ChangeSet file only
-# O: Original Followed by Updated
-# U: Updated Included with updated range of versions
-# I: Included Included verbatim
-# E: Excluded Excluded on request from user
-# D: Deleted Manually deleted by subsequent user edit
-# R: Revised Manually revised by subsequent user edit
-#
-#
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2005/01/07 08:29:15-08:00 jgarzik@pobox.com
-# [PATCH] x86-64: kernel/sys.c build fix
-#
-# On x86-64, the attached patch is required to fix
-#
-# > kernel/sys.c: In function `sys_setsid':
-# > kernel/sys.c:1078: error: `tty_sem' undeclared (first use in this function)
-# > kernel/sys.c:1078: error: (Each undeclared identifier is reported only once
-# > kernel/sys.c:1078: error: for each function it appears in.)
-#
-# kernel/sys.c needs the tty_sem declaration from linux/tty.h.
-#
-# kernel/sys.c
-# 2005/01/06 23:25:46-08:00 jgarzik@pobox.com +1 -0
-# x86-64: kernel/sys.c build fix
-#
-#
-===== kernel/sys.c 1.101 vs 1.102 =====
---- 1.101/kernel/sys.c 2005-01-05 03:47:32 +09:00
-+++ 1.102/kernel/sys.c 2005-01-07 16:25:46 +09:00
-@@ -23,6 +23,7 @@
- #include <linux/security.h>
- #include <linux/dcookies.h>
- #include <linux/suspend.h>
-+#include <linux/tty.h>
-
- #include <linux/compat.h>
- #include <linux/syscalls.h>
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/setsid-race.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/setsid-race.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/setsid-race.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,204 +0,0 @@
-# origin: bk
-# key: 41ddda70CWJb5nNL71T4MOlG2sMG8A (linux-2.6)
-# description: fix setsid race [CAN-2005-0178]
-# inclusion: 2.6.11?
-# revision date: 2005-02-18
-
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2005/01/06 16:40:16-08:00 alan@lxorguk.ukuu.org.uk
-# [PATCH] First cut at setsid/tty locking
-#
-# Use the existing "tty_sem" to protect against the process tty changes
-# too.
-#
-# drivers/char/tty_io.c
-# 2005/01/04 11:42:29-08:00 alan@lxorguk.ukuu.org.uk +29 -10
-# First cut at setsid/tty locking
-#
-# kernel/exit.c
-# 2005/01/04 10:45:27-08:00 alan@lxorguk.ukuu.org.uk +2 -0
-# First cut at setsid/tty locking
-#
-# kernel/sys.c
-# 2005/01/04 10:47:32-08:00 alan@lxorguk.ukuu.org.uk +2 -0
-# First cut at setsid/tty locking
-#
-diff -Nru a/drivers/char/tty_io.c b/drivers/char/tty_io.c
---- a/drivers/char/tty_io.c 2005-02-18 17:33:57 -08:00
-+++ b/drivers/char/tty_io.c 2005-02-18 17:33:57 -08:00
-@@ -918,9 +918,11 @@
-
- lock_kernel();
-
-+ down(&tty_sem);
- tty = current->signal->tty;
- if (tty) {
- tty_pgrp = tty->pgrp;
-+ up(&tty_sem);
- if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
- tty_vhangup(tty);
- } else {
-@@ -928,6 +930,7 @@
- kill_pg(current->signal->tty_old_pgrp, SIGHUP, on_exit);
- kill_pg(current->signal->tty_old_pgrp, SIGCONT, on_exit);
- }
-+ up(&tty_sem);
- unlock_kernel();
- return;
- }
-@@ -937,15 +940,19 @@
- kill_pg(tty_pgrp, SIGCONT, on_exit);
- }
-
-+ /* Must lock changes to tty_old_pgrp */
-+ down(&tty_sem);
- current->signal->tty_old_pgrp = 0;
- tty->session = 0;
- tty->pgrp = -1;
-
-+ /* Now clear signal->tty under the lock */
- read_lock(&tasklist_lock);
- do_each_task_pid(current->signal->session, PIDTYPE_SID, p) {
- p->signal->tty = NULL;
- } while_each_task_pid(current->signal->session, PIDTYPE_SID, p);
- read_unlock(&tasklist_lock);
-+ up(&tty_sem);
- unlock_kernel();
- }
-
-@@ -1172,12 +1179,6 @@
- struct termios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
- int retval=0;
-
-- /*
-- * Check whether we need to acquire the tty semaphore to avoid
-- * race conditions. For now, play it safe.
-- */
-- down(&tty_sem);
--
- /* check whether we're reopening an existing tty */
- if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
- tty = devpts_get_tty(idx);
-@@ -1366,7 +1367,6 @@
-
- /* All paths come through here to release the semaphore */
- end_init:
-- up(&tty_sem);
- return retval;
-
- /* Release locally allocated memory ... nothing placed in slots */
-@@ -1562,9 +1562,14 @@
- * each iteration we avoid any problems.
- */
- while (1) {
-+ /* Guard against races with tty->count changes elsewhere and
-+ opens on /dev/tty */
-+
-+ down(&tty_sem);
- tty_closing = tty->count <= 1;
- o_tty_closing = o_tty &&
- (o_tty->count <= (pty_master ? 1 : 0));
-+ up(&tty_sem);
- do_sleep = 0;
-
- if (tty_closing) {
-@@ -1600,6 +1605,8 @@
- * both sides, and we've completed the last operation that could
- * block, so it's safe to proceed with closing.
- */
-+
-+ down(&tty_sem);
- if (pty_master) {
- if (--o_tty->count < 0) {
- printk(KERN_WARNING "release_dev: bad pty slave count "
-@@ -1613,7 +1620,8 @@
- tty->count, tty_name(tty, buf));
- tty->count = 0;
- }
--
-+ up(&tty_sem);
-+
- /*
- * We've decremented tty->count, so we need to remove this file
- * descriptor off the tty->tty_files list; this serves two
-@@ -1760,10 +1768,14 @@
- noctty = filp->f_flags & O_NOCTTY;
- index = -1;
- retval = 0;
-+
-+ down(&tty_sem);
-
- if (device == MKDEV(TTYAUX_MAJOR,0)) {
-- if (!current->signal->tty)
-+ if (!current->signal->tty) {
-+ up(&tty_sem);
- return -ENXIO;
-+ }
- driver = current->signal->tty->driver;
- index = current->signal->tty->index;
- filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
-@@ -1788,14 +1800,18 @@
- noctty = 1;
- goto got_driver;
- }
-+ up(&tty_sem);
- return -ENODEV;
- }
-
- driver = get_tty_driver(device, &index);
-- if (!driver)
-+ if (!driver) {
-+ up(&tty_sem);
- return -ENODEV;
-+ }
- got_driver:
- retval = init_dev(driver, index, &tty);
-+ up(&tty_sem);
- if (retval)
- return retval;
-
-@@ -1881,7 +1897,10 @@
- }
- up(&allocated_ptys_lock);
-
-+ down(&tty_sem);
- retval = init_dev(ptm_driver, index, &tty);
-+ up(&tty_sem);
-+
- if (retval)
- goto out;
-
-diff -Nru a/kernel/exit.c b/kernel/exit.c
---- a/kernel/exit.c 2005-02-18 17:33:57 -08:00
-+++ b/kernel/exit.c 2005-02-18 17:33:57 -08:00
-@@ -332,7 +332,9 @@
- exit_mm(current);
-
- set_special_pids(1, 1);
-+ down(&tty_sem);
- current->signal->tty = NULL;
-+ up(&tty_sem);
-
- /* Block and flush all signals */
- sigfillset(&blocked);
-diff -Nru a/kernel/sys.c b/kernel/sys.c
---- a/kernel/sys.c 2005-02-18 17:33:57 -08:00
-+++ b/kernel/sys.c 2005-02-18 17:33:57 -08:00
-@@ -1075,6 +1075,7 @@
- if (!thread_group_leader(current))
- return -EINVAL;
-
-+ down(&tty_sem);
- write_lock_irq(&tasklist_lock);
-
- pid = find_pid(PIDTYPE_PGID, current->pid);
-@@ -1088,6 +1089,7 @@
- err = process_group(current);
- out:
- write_unlock_irq(&tasklist_lock);
-+ up(&tty_sem);
- return err;
- }
-
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/skb-reset-ip_summed.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/skb-reset-ip_summed.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/skb-reset-ip_summed.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,66 +0,0 @@
-# origin: bk
-# key: 41f59581p1swNaow4K1aBglV-q2jfQ (linux-2.5)
-# description: packet forwarding DoS issue
-# inclusion: projected 2.4.29 as backport
-# revision date: 2005-02-16
-
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2005/01/24 16:40:33-08:00 herbert@gondor.apana.org.au
-# [IPV4/IPV6]: In ip_fragment(), reset ip_summed field on SKB sub-frags.
-#
-# If we forward a fragmented packet, we can have ip_summed
-# set to CHECKSUM_HW or similar. This is fine for local
-# protocol processing, but once if we are forwarding this
-# packet we want to reset ip_summed to CHECKSUM_NONE.
-#
-# Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-# net/ipv4/ip_output.c
-# 2005/01/24 16:40:10-08:00 herbert@gondor.apana.org.au +1 -0
-# [IPV4/IPV6]: In ip_fragment(), reset ip_summed field on SKB sub-frags.
-#
-# If we forward a fragmented packet, we can have ip_summed
-# set to CHECKSUM_HW or similar. This is fine for local
-# protocol processing, but once if we are forwarding this
-# packet we want to reset ip_summed to CHECKSUM_NONE.
-#
-# Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-# net/ipv6/ip6_output.c
-# 2005/01/24 16:40:10-08:00 herbert@gondor.apana.org.au +1 -0
-# [IPV4/IPV6]: In ip_fragment(), reset ip_summed field on SKB sub-frags.
-#
-# If we forward a fragmented packet, we can have ip_summed
-# set to CHECKSUM_HW or similar. This is fine for local
-# protocol processing, but once if we are forwarding this
-# packet we want to reset ip_summed to CHECKSUM_NONE.
-#
-# Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-diff -Nru a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
---- a/net/ipv4/ip_output.c 2005-02-16 15:58:30 -08:00
-+++ b/net/ipv4/ip_output.c 2005-02-16 15:58:30 -08:00
-@@ -504,6 +504,7 @@
- /* Prepare header of the next frame,
- * before previous one went down. */
- if (frag) {
-+ frag->ip_summed = CHECKSUM_NONE;
- frag->h.raw = frag->data;
- frag->nh.raw = __skb_push(frag, hlen);
- memcpy(frag->nh.raw, iph, hlen);
-diff -Nru a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
---- a/net/ipv6/ip6_output.c 2005-02-16 15:58:30 -08:00
-+++ b/net/ipv6/ip6_output.c 2005-02-16 15:58:30 -08:00
-@@ -592,6 +592,7 @@
- /* Prepare header of the next frame,
- * before previous one went down. */
- if (frag) {
-+ frag->ip_summed = CHECKSUM_NONE;
- frag->h.raw = frag->data;
- fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
- frag->nh.raw = __skb_push(frag, hlen);
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/smbfs-overflow-fixes.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/smbfs-overflow-fixes.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/smbfs-overflow-fixes.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,133 +0,0 @@
-#! /bin/sh -e
-## <PATCHNAME>.dpatch by <PATCH_AUTHOR@EMAI>
-##
-## All lines beginning with `## DP:' are a description of the patch.
-## DP: Description: SMBfs overflow fixes
-## DP: Patch author: unknown, stolen from -ac tree (probably Stefan Esser, Juan Quintela, and Urban Widmark)
-## DP: Upstream status: unknown
-
-. $(dirname $0)/DPATCH
-
-@DPATCH@
-diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.10/fs/smbfs/proc.c linux-2.6.10/fs/smbfs/proc.c
---- linux.vanilla-2.6.10/fs/smbfs/proc.c 2004-12-25 21:15:41.000000000 +0000
-+++ linux-2.6.10/fs/smbfs/proc.c 2004-12-26 23:03:13.000000000 +0000
-@@ -1427,9 +1427,9 @@
- * So we must first calculate the amount of padding used by the server.
- */
- data_off -= hdrlen;
-- if (data_off > SMB_READX_MAX_PAD) {
-- PARANOIA("offset is larger than max pad!\n");
-- PARANOIA("%d > %d\n", data_off, SMB_READX_MAX_PAD);
-+ if (data_off > SMB_READX_MAX_PAD || data_off < 0) {
-+ PARANOIA("offset is larger than SMB_READX_MAX_PAD or negative!\n");
-+ PARANOIA("%d > %d || %d < 0\n", data_off, SMB_READX_MAX_PAD, data_off);
- req->rq_rlen = req->rq_bufsize + 1;
- return;
- }
-diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.10/fs/smbfs/request.c linux-2.6.10/fs/smbfs/request.c
---- linux.vanilla-2.6.10/fs/smbfs/request.c 2004-12-25 21:15:41.000000000 +0000
-+++ linux-2.6.10/fs/smbfs/request.c 2004-12-26 23:06:24.000000000 +0000
-@@ -588,8 +588,18 @@
- data_count = WVAL(inbuf, smb_drcnt);
-
- /* Modify offset for the split header/buffer we use */
-- data_offset -= hdrlen;
-- parm_offset -= hdrlen;
-+ if (data_count || data_offset) {
-+ if (unlikely(data_offset < hdrlen))
-+ goto out_bad_data;
-+ else
-+ data_offset -= hdrlen;
-+ }
-+ if (parm_count || parm_offset) {
-+ if (unlikely(parm_offset < hdrlen))
-+ goto out_bad_parm;
-+ else
-+ parm_offset -= hdrlen;
-+ }
-
- if (parm_count == parm_tot && data_count == data_tot) {
- /*
-@@ -600,18 +610,22 @@
- * response that fits.
- */
- VERBOSE("single trans2 response "
-- "dcnt=%d, pcnt=%d, doff=%d, poff=%d\n",
-+ "dcnt=%u, pcnt=%u, doff=%u, poff=%u\n",
- data_count, parm_count,
- data_offset, parm_offset);
- req->rq_ldata = data_count;
- req->rq_lparm = parm_count;
- req->rq_data = req->rq_buffer + data_offset;
- req->rq_parm = req->rq_buffer + parm_offset;
-+ if (unlikely(parm_offset + parm_count > req->rq_rlen))
-+ goto out_bad_parm;
-+ if (unlikely(data_offset + data_count > req->rq_rlen))
-+ goto out_bad_data;
- return 0;
- }
-
- VERBOSE("multi trans2 response "
-- "frag=%d, dcnt=%d, pcnt=%d, doff=%d, poff=%d\n",
-+ "frag=%d, dcnt=%u, pcnt=%u, doff=%u, poff=%u\n",
- req->rq_fragment,
- data_count, parm_count,
- data_offset, parm_offset);
-@@ -638,13 +652,15 @@
-
- req->rq_parm = req->rq_trans2buffer;
- req->rq_data = req->rq_trans2buffer + parm_tot;
-- } else if (req->rq_total_data < data_tot ||
-- req->rq_total_parm < parm_tot)
-+ } else if (unlikely(req->rq_total_data < data_tot ||
-+ req->rq_total_parm < parm_tot))
- goto out_data_grew;
-
-- if (parm_disp + parm_count > req->rq_total_parm)
-+ if (unlikely(parm_disp + parm_count > req->rq_total_parm ||
-+ parm_offset + parm_count > req->rq_rlen))
- goto out_bad_parm;
-- if (data_disp + data_count > req->rq_total_data)
-+ if (unlikely(data_disp + data_count > req->rq_total_data ||
-+ data_offset + data_count > req->rq_rlen))
- goto out_bad_data;
-
- inbuf = req->rq_buffer;
-@@ -666,10 +682,9 @@
- return 1;
-
- out_too_long:
-- printk(KERN_ERR "smb_trans2: data/param too long, data=%d, parm=%d\n",
-+ printk(KERN_ERR "smb_trans2: data/param too long, data=%u, parm=%u\n",
- data_tot, parm_tot);
-- req->rq_errno = -EIO;
-- goto out;
-+ goto out_EIO;
- out_no_mem:
- printk(KERN_ERR "smb_trans2: couldn't allocate data area of %d bytes\n",
- req->rq_trans2bufsize);
-@@ -677,16 +692,15 @@
- goto out;
- out_data_grew:
- printk(KERN_ERR "smb_trans2: data/params grew!\n");
-- req->rq_errno = -EIO;
-- goto out;
-+ goto out_EIO;
- out_bad_parm:
-- printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d\n",
-- parm_disp, parm_count, parm_tot);
-- req->rq_errno = -EIO;
-- goto out;
-+ printk(KERN_ERR "smb_trans2: invalid parms, disp=%u, cnt=%u, tot=%u, ofs=%u\n",
-+ parm_disp, parm_count, parm_tot, parm_offset);
-+ goto out_EIO;
- out_bad_data:
-- printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d\n",
-- data_disp, data_count, data_tot);
-+ printk(KERN_ERR "smb_trans2: invalid data, disp=%u, cnt=%u, tot=%u, ofs=%u\n",
-+ data_disp, data_count, data_tot, data_offset);
-+out_EIO:
- req->rq_errno = -EIO;
- out:
- return req->rq_errno;
Deleted: trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/sparc64-nis-killer.dpatch
===================================================================
--- trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/sparc64-nis-killer.dpatch 2005-03-05 09:13:46 UTC (rev 2609)
+++ trunk/kernel/source/kernel-source-2.6.11-2.6.11/debian/patches/sparc64-nis-killer.dpatch 2005-03-05 09:34:01 UTC (rev 2610)
@@ -1,29 +0,0 @@
-# origin: linux-sparc (davem)
-# key: 42083fb5G9VacMhj0X7v5aPmZaQGXw (linux-2.5)
-# inclusion: projected 2.6.11
-# description: this fixes the NIS killer #288180
-
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2005/02/07 20:27:33-08:00 davem@nuts.davemloft.net
-# [SPARC64]: Mask off stack ptr in compat_alloc_user_space() for 32-bit.
-#
-# Signed-off-by: David S. Miller <davem@davemloft.net>
-#
-# include/asm-sparc64/compat.h
-# 2005/02/07 20:26:55-08:00 davem@nuts.davemloft.net +2 -0
-# [SPARC64]: Mask off stack ptr in compat_alloc_user_space() for 32-bit.
-#
-diff -Nru a/include/asm-sparc64/compat.h b/include/asm-sparc64/compat.h
---- a/include/asm-sparc64/compat.h 2005-02-16 17:37:34 -08:00
-+++ b/include/asm-sparc64/compat.h 2005-02-16 17:37:34 -08:00
-@@ -133,6 +133,8 @@
-
- if (!(test_thread_flag(TIF_32BIT)))
- usp += STACK_BIAS;
-+ else
-+ usp &= 0xffffffffUL;
-
- return (void __user *) (usp - len);
- }