commit 9a50e1ccd38517c04f16e96fdf4117a69c293af1
Author: Chris Wright <chrisw@sous-sol.org>
Date:   Sat Jan 14 22:16:02 2006 -0800

    Linux 2.6.15.1

commit 76596a3df11e704ca3c317b1ae8ae3cb4568d7f8
Author: Adrian Bunk <bunk@stusta.de>
Date:   Thu Jan 12 23:55:10 2006 +0100

    [PATCH] arch/sparc64/Kconfig: fix HUGETLB_PAGE_SIZE_64K dependencies
    
    This patch fixes a typo in the dependencies of HUGETLB_PAGE_SIZE_64K.
    
    This bug was reported by Jean-Luc Leger <reiga@dspnet.fr.eu.org>.
    
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit 609269d535a35b92cf9bb92e7126c822a598245a
Author: Andrey Borzenkov <arvidjaar@mail.ru>
Date:   Mon Jan 9 20:51:28 2006 -0800

    [PATCH] fix /sys/class/net/<if>/wireless without dev->get_wireless_stats
    
    dev->get_wireless_stats is deprecated but removing it also removes wireless
    subdirectory in sysfs. This patch puts it back.
    
    akpm: I don't know what's happening here.  This might be appropriate as a
    2.6.15.x compatibility backport.  Waiting to hear from Jeff.
    
    Signed-off-by: Andrey Borzenkov <arvidjaar@mail.ru>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Jeff Garzik <jgarzik@pobox.com>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit f72e024e3a4705336b04109756bc619e7ae62fdb
Author: Alan Cox <alan@redhat.com>
Date:   Mon Jan 9 09:35:28 2006 -0500

    [PATCH] moxa serial: add proper capability check
    
    This requires the proper capabilities for the moxa bios update ioctl's.
    
    Signed-off-by: Alan Cox <alan@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@osdl.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit 7abeff5a23abb2d0edc54cc1cc3acaf886ea98ca
Author: Martin Murray <murrayma@citi.umich.edu>
Date:   Tue Jan 10 21:02:29 2006 -0800

    [PATCH] Fix DoS in netlink_rcv_skb() (CVE-2006-0035)
    
    Sanity check nlmsg_len during netlink_rcv_skb.  An nlmsg_len == 0 can
    cause infinite loop in kernel, effectively DoSing machine.  Noted by
    Martin Murray.
    
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 15ee2e069481ce6de3523e4effeddd44c61cc65a
Author: David S. Miller <davem@davemloft.net>
Date:   Tue Jan 10 13:31:59 2006 -0800

    [PATCH] Fix sys_fstat64() entry in 64-bit syscall table.
    
    Noticed by Jakub Jelinek.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit b37d1b4106088c4f6b1e9c1d75a0f31f00640417
Author: Richard Mortimer <richm@oldelvet.org.uk>
Date:   Tue Jan 10 13:30:54 2006 -0800

    [PATCH] Fix ptrace/strace
    
    Don't clobber register %l0 while checking TI_SYS_NOERROR value in
    syscall return path.  This bug was introduced by:
    
    db7d9a4eb700be766cc9f29241483dbb1e748832
    
    Problem narrowed down by Luis F. Ortiz and Richard Mortimer.
    
    I tried using %l2 as suggested by Luis and that works for me.
    
    Looking at the code I wonder if it makes sense to simplify the code
    a little bit. The following works for me but I'm not sure how to
    exercise the "NOERROR" codepath.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit 711f4b02bc48b9f208c96352995c19f107381a80
Author: Bart De Schuymer <bdschuym@pandora.be>
Date:   Tue Jan 10 13:13:45 2006 -0800

    [PATCH] Don't match tcp/udp source/destination port for IP fragments
    
    Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit 1cc7060e107b1dbb4a537cb20af949ffadb01222
Author: Patrick McHardy <kaber@trash.net>
Date:   Tue Jan 10 02:00:07 2006 +0100

    [PATCH] Fix another crash in ip_nat_pptp (CVE-2006-0037)
    
    The PPTP NAT helper calculates the offset at which the packet needs
    to be mangled as difference between two pointers to the header. With
    non-linear skbs however the pointers may point to two seperate buffers
    on the stack and the calculation results in a wrong offset beeing
    used.
    
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit a81954faaf6fdbf1fd8a1ef03f2d75e01f56a974
Author: Patrick McHardy <kaber@trash.net>
Date:   Tue Jan 10 02:00:07 2006 +0100

    [PATCH] Fix crash in ip_nat_pptp (CVE-2006-0036)
    
    When an inbound PPTP_IN_CALL_REQUEST packet is received the
    PPTP NAT helper uses a NULL pointer in pointer arithmentic to
    calculate the offset in the packet which needs to be mangled
    and corrupts random memory or crashes.
    
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit e7594b2f2389fab1558fed58507ad3ce7d4eae56
Author: Kirill Korotaev <dev@openvz.org>
Date:   Mon Jan 9 17:42:42 2006 +0300

    [PATCH] netlink oops fix due to incorrect error code
    
    Fixed oops after failed netlink socket creation.
    Wrong parathenses in if() statement caused err to be 1,
    instead of negative value.
    Trivial fix, not trivial to find though.
    
    Signed-Off-By: Dmitry Mishin <dim@sw.ru>
    Signed-Off-By: Kirill Korotaev <dev@openvz.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit 4e5ae24c6485ea49e61bdafb3e4d4d598bf5b1dc
Author: Nathan Lynch <ntl@pobox.com>
Date:   Sun Jan 8 01:05:12 2006 -0800

    [PATCH] fix workqueue oops during cpu offline
    
    Use first_cpu(cpu_possible_map) for the single-thread workqueue case.  We
    used to hardcode 0, but that broke on systems where !cpu_possible(0) when
    workqueue_struct->cpu_workqueue_struct was changed from a static array to
    alloc_percpu.
    
    Commit id bce61dd49d6ba7799be2de17c772e4c701558f14 ("Fix hardcoded cpu=0 in
    workqueue for per_cpu_ptr() calls") fixed that for Ben's funky sparc64
    system, but it regressed my Power5.  Offlining cpu 0 oopses upon the next
    call to queue_work for a single-thread workqueue, because now we try to
    manipulate per_cpu_ptr(wq->cpu_wq, 1), which is uninitialized.
    
    So we need to establish an unchanging "slot" for single-thread workqueues
    which will have a valid percpu allocation.  Since alloc_percpu keys off of
    cpu_possible_map, which must not change after initialization, make this
    slot == first_cpu(cpu_possible_map).
    
    Signed-off-by: Nathan Lynch <ntl@pobox.com>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit 2d7fc97cea8a45158bc6428a3f99782e41e6b5c3
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Sat Jan 14 22:15:28 2006 -0800

    [PATCH] vgacon: fix doublescan mode
    
    When doublescan mode is in use, scanlines must be doubled.
    
    Thanks to Jason Dravet <dravet@hotmail.com> for reporting and testing.
    
    Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit a2a1d0e361eda14153c26854230d92f77d77da44
Author: Peter Korsgaard <jacmet@sunsite.dk>
Date:   Fri Jan 6 00:11:39 2006 -0800

    [PATCH] ppc32: Re-add embed_config.c to ml300/ep405
    
    Commit 3e9e7c1d0b7a36fb8affb973a054c5098e27baa8 (ppc32: cleanup AMCC PPC40x
    eval boards to support U-Boot) broke the kernel for ML300 / EP405.
    
    It still compiles as there's a weak definition of the function in
    misc-embedded.c, but the kernel crashes as the bd_t fixup isn't performed.
    
    Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit 0c900c3b8c8bddac45e084ffbfd42bd77a12bf57
Author: Luis F. Ortiz <lfo@Polyad.Org>
Date:   Thu Jan 5 13:19:46 2006 -0800

    [PATCH] Fix onboard video on SPARC Blade 100 for 2.6.{13,14,15}
    
    	I have recently been switching from using 2.4.32 on my trusty
    old Sparc Blade 100 to using 2.6.15 .  Some of the problems I ran into
    were distorted video when the console was active (missing first
    character, skipped dots) and when running X windows (colored snow,
    stripes, missing pixels).  A quick examination of the 2.6 versus 2.4
    source for the ATY driver revealed alot of changes.
    
             A closer look at the code/data for the 64GR/XL chip revealed
    two minor "typos" that the rewriter(s) of the code made.  The first is
    a incorrect clock value (230 .vs. 235) and the second is a missing
    flag (M64F_SDRAM_MAGIC_PLL).  Making both these changes seems to have
    fixed my problem.  I tend to think the 235 value is the correct one,
    as there is a 29.4 Mhz clock crystal close to the video chip and 235.2
    (29.4*8) is too close to 235 to make it a coincidence.
    
    	The flag for M64F_SDRAM_MAGIC_PLL was dropped during the
    changes made by adaplas in file revision 1.72 on the old bitkeeper
    repository.
    
    	The change relating to the clock rate has been there forever,
    at least in the 2.6 tree.  I'm not sure where to look for the old 2.5
    tree or if anyone cares when it happened.
    
    On SPARC Blades 100's, which use the ATY MACH64GR video chipset, the
    clock crystal frequency is 235.2 Mhz, not 230 Mhz.  The chipset also
    requires the use of M64F_SDRAM_MAGIC_PLL in order to setup the PLL
    properly for the DRAM.
    
    Signed-off-by: Luis F. Ortiz <lfo@Polyad.Org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

commit 187754cae94a299edaeefeba80ac6d87b22bc940
Author: Stephen Hemminger <shemminger@osdl.org>
Date:   Wed Jan 4 15:52:28 2006 -0800

    [PATCH] skge: handle out of memory on ring changes
    
    Please consider this for 2.6.15.1; it fixes several cases where
    the skge driver can get in a bad state and later crash; if an
    admin operation that causes a restart fails from out of memory.
    Such as changing the MTU or increasing the ring size.
    
    The fixes involve checking the return value and doing necessary
    unwinds. Or in some cases avoiding doing a full restart.
    
    The same code is the netdev-2.6 tree for 2.6.16 but as separate pieces
    
    Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 67e0d5c77ea0e0747b1c7bf7455ad274ae9af992
Author: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Date:   Tue Jan 3 17:59:19 2006 -0800

    [PATCH] UFS: inode->i_sem is not released in error path
    
    Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
    Cc: <stable@kernel.org>
    akpm: obviously correct, OK for -stable immediately.
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit b43a04de4c0807dbaf5934e7f72c004f4853c4e8
Author: Stephen Hemminger <shemminger@osdl.org>
Date:   Tue Jan 3 15:28:05 2006 -0800

    [PATCH] BRIDGE: Fix faulty check in br_stp_recalculate_bridge_id()
    
    There is a regression in 2.6.15.
    One of the conversions from memcmp to compare_ether_addr is incorrect.
    We need to do relative comparison to determine min MAC address to
    use in bridge id. This will cause the wrong bridge id to be chosen
    which violates 802.1d Spanning Tree Protocol, and may create forwarding
    loops.
    
    Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>