commit f70602f4f6248735a02c61a1323c9151a33a3775 Author: Greg Kroah-Hartman Date: Mon Mar 27 23:06:28 2006 -0800 Linux 2.6.15.7 commit 6d4da66240b9fec065933928043b1365f97ab724 Author: Al Viro Date: Wed Mar 15 21:41:59 2006 +0000 [PATCH] Fix ext2 readdir f_pos re-validation logic This fixes not one, but _two_, silly (but admittedly hard to hit) bugs in the ext2 filesystem "readdir()" function. It also cleans up the code to avoid the unnecessary goto mess. The bugs were related to re-valiating the f_pos value after somebody had either done an "lseek()" on the directory to an invalid offset, or when the offset had become invalid due to a file being unlinked in the directory. The code would not only set the f_version too eagerly, it would also not update f_pos appropriately for when the offset fixup took place. When that happened, we'd occasionally subsequently fail the readdir() even when we shouldn't (no real harm done, but an ugly printk, and obviously you would end up not necessarily seeing all entries). Thanks to Masoud Sharbiani who noticed the problem and had a test-case for it, and also fixed up a thinko in the first version of this patch. Signed-off-by: Al Viro Acked-by: Masoud Sharbiani Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 107d25ba4fcacf8e29bcad240b95fd9ef7314dac Author: David S. Miller Date: Thu Mar 23 22:54:18 2006 -0800 [PATCH] NET: Ensure device name passed to SO_BINDTODEVICE is NULL terminated. The user can pass us arbitrary garbage so we should ensure the string they give us is null terminated before we pass it on to dev_get_by_index() et al. Found by Solar Designer. Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 739d40fed82810da8e923655c7f8140369641fc7 Author: Alexey Kuznetsov Date: Wed Mar 22 14:34:42 2006 -0800 [PATCH] TCP: Do not use inet->id of global tcp_socket when sending RST (CVE-2006-1242) The problem is in ip_push_pending_frames(), which uses: if (!df) { __ip_select_ident(iph, &rt->u.dst, 0); } else { iph->id = htons(inet->id++); } instead of ip_select_ident(). Right now I think the code is a nonsense. Most likely, I copied it from old ip_build_xmit(), where it was really special, we had to decide whether to generate unique ID when generating the first (well, the last) fragment. In ip_push_pending_frames() it does not make sense, it should use plain ip_select_ident() instead. Signed-off-by: Alexey Kuznetsov Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit a4ae7ec623c051cb681af82f9d62a821402c6a60 Author: Michael Krufky Date: Mon Mar 20 22:34:58 2006 -0500 [PATCH] Kconfig: VIDEO_DECODER must select FW_LOADER The cx25840 module requires external firmware in order to function, so it must select FW_LOADER, but saa7115 and saa7129 do not require it. Signed-off-by: Michael Krufky Cc: Mauro Carvalho Chehab Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 1421207ba3fd53f8090f6f337ac7de57015d3a5c Author: Dave Johnson Date: Mon Mar 6 15:42:36 2006 -0800 [PATCH] cramfs mounts provide corrupted content since 2.6.15 Fix handling of cramfs images created by util-linux containing empty regular files. Images created by cramfstools 1.x were ok. Fill out inode contents in cramfs_iget5_set() instead of get_cramfs_inode() to prevent issues if cramfs_iget5_test() is called with I_LOCK|I_NEW still set. Signed-off-by: Dave Johnson Cc: Olaf Hering Cc: Chris Mason Cc: Andreas Gruenbacher Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 8a3a2a3299081913c22f5d0e1ce893b781efe942 Author: Randy Dunlap Date: Wed Mar 8 17:43:17 2006 -0800 [PATCH] compat ifconf: fix limits A recent change to compat. dev_ifconf() in fs/compat_ioctl.c causes ifconf data to be truncated 1 entry too early when copying it to userspace. The correct amount of data (length) is returned, but the final entry is empty (zero, not filled in). The for-loop 'i' check should use <= to allow the final struct ifreq32 to be copied. I also used the ifconf-corruption program in kernel bugzilla #4746 to make sure that this change does not re-introduce the corruption. Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit b7bec2ba8b776bc3d122375832105c792a1eda3b Author: David S. Miller Date: Tue Mar 7 14:59:23 2006 -0800 [PATCH] Netfilter ip_queue: Fix wrong skb->len == nlmsg_len assumption The size of the skb carrying the netlink message is not equivalent to the length of the actual netlink message due to padding. ip_queue matches the length of the payload against the original packet size to determine if packet mangling is desired, due to the above wrong assumption arbitary packets may not be mangled depening on their original size. Signed-off-by: Thomas Graf Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 2c07f6fae4b06515944c167e8aeb86217c797c03 Author: Roland Dreier Date: Mon Mar 6 20:23:33 2006 -0800 [PATCH] IB/srp: Don't send task management commands after target removal Just fail abort and reset requests that come in after we've already decided to remove a target. This fixes a nasty crash if a storage target goes away. Signed-off-by: Roland Dreier Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman