Commit: f908b08a54fff892beb42ceddafaeac3cda119a0 Author: Adrian Bunk Wed, 15 Nov 2006 11:38:39 +0100 Linux 2.6.16.32 Commit: ae92a0d0312b7ef58f6dec63de265fb29fbd9cda Author: Adrian Bunk Sat, 11 Nov 2006 12:16:36 +0100 Linux 2.6.16.32-rc1 Commit: ef147950bee58ecfa672433badf679608fb90668 Author: Christoph Lameter Sat, 11 Nov 2006 12:13:53 +0100 Fix longstanding load balancing bug in the scheduler The scheduler will stop load balancing if the most busy processor contains processes pinned via processor affinity. The scheduler currently only does one search for busiest cpu. If it cannot pull any tasks away from the busiest cpu because they were pinned then the scheduler goes into a corner and sulks leaving the idle processors idle. F.e. If you have processor 0 busy running four tasks pinned via taskset, there are none on processor 1 and one just started two processes on processor 2 then the scheduler will not move one of the two processes away from processor 2. This patch fixes that issue by forcing the scheduler to come out of its corner and retrying the load balancing by considering other processors for load balancing. This patch was originally developed by John Hawkes and discussed at http://marc.theaimsgroup.com/?l=linux-kernel&m=113901368523205&w=2. I have removed extraneous material and gone back to equipping struct rq with the cpu the queue is associated with since this makes the patch much easier and it is likely that others in the future will have the same difficulty of figuring out which processor owns which runqueue. The overhead added through these patches is a single word on the stack if the kernel is configured to support 32 cpus or less (32 bit). For 32 bit environments the maximum number of cpus that can be configued is 255 which would result in the use of 32 bytes additional on the stack. On IA64 up to 1k cpus can be configured which will result in the use of 128 additional bytes on the stack. The maximum additional cache footprint is one cacheline. Typically memory use will be much less than a cacheline and the additional cpumask will be placed on the stack in a cacheline that already contains other local variable. Signed-off-by: Christoph Lameter Signed-off-by: Adrian Bunk Commit: f9a198cc962f1347564493d406789b79cab4294b Author: Tejun Heo Sat, 11 Nov 2006 11:34:49 +0100 sata_sil24: add a new PCI ID for SiI 3124 Add a new PCI ID for SiI 3124. Reported by Silicon Image. Signed-off-by: Tejun Heo Signed-off-by: Adrian Bunk Commit: 05c19c4369b40357c726a224fe51a3f5ff21f9bd Author: Kirill Korotaev Sat, 11 Nov 2006 01:08:49 +0100 ia64/sparc: fix local DoS with corrupted ELFs (CVE-2006-4538) This patch prevents cross-region mappings on IA64 and SPARC which could lead to system crash. Adrian Bunk: Adapted to 2.6.16. Signed-Off-By: Kirill Korotaev Signed-off-by: Adrian Bunk Commit: 567e0e320d52690b9a442beb146ab59af88824a7 Author: Paul Mackerras Sat, 11 Nov 2006 00:28:30 +0100 nvidia fbdev: fix powerpc xmon scribbles xmon writes garbage on the screen because the nvidia console driver has changed the line pitch from what the firmware set it to. Fix it by making the nvidia driver inform the btext engine (which xmon uses if the screen is its output device) about changes to display resolution. Signed-off-by: Paul Mackerras Signed-off-by: Adrian Bunk Commit: 582b1199147d6035339869c458135224e6070b60 Author: Paul Mackerras Sat, 11 Nov 2006 00:17:57 +0100 [POWERPC] Fix return value from memcpy As pointed out by Herbert Xu , our memcpy implementation didn't return the destination pointer as its return value, and there is code in the kernel that expects that. This fixes it. Signed-off-by: Paul Mackerras Signed-off-by: Adrian Bunk Commit: e1dc7abb2490bfe0b72f5f9ee6cf28001197ab5b Author: Herbert Xu Sat, 11 Nov 2006 00:15:10 +0100 [NET]: Update frag_list in pskb_trim When pskb_trim has to defer to ___pksb_trim to trim the frag_list part of the packet, the frag_list is not updated to reflect the trimming. This will usually work fine until you hit something that uses the packet length or tail from the frag_list. Examples include esp_output and ip_fragment. Another problem caused by this is that you can end up with a linear packet with a frag_list attached. It is possible to get away with this if we audit everything to make sure that they always consult skb->len before going down onto frag_list. In fact we can do the samething for the paged part as well to avoid copying the data area of the skb. For now though, let's do the conservative fix and update frag_list. Many thanks to Marco Berizzi for helping me to track down this bug. This 4-year old bug took 3 months to track down. Marco was very patient indeed :) Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: c04f8dca8e1e3b055355bf5fa94d773b17f6f683 Author: Jean Delvare Sat, 11 Nov 2006 00:13:32 +0100 scx200_acb: Fix the block transactions The scx200_acb i2c bus driver pretends to support SMBus block transactions, but in fact it implements the more simple I2C block transactions. Additionally, it lacks sanity checks on the length of the block transactions, which could lead to a buffer overrun. This fixes an oops reported by Alexander Atanasov: http://marc.theaimsgroup.com/?l=linux-kernel&m=114970382125094 Thanks to Ben Gardner for fixing my bugs :) Signed-off-by: Jean Delvare Signed-off-by: Adrian Bunk Commit: b88acf65abec97a9b44c42d921c930c4d62d7b5e Author: Thomas Andrews Sat, 11 Nov 2006 00:09:25 +0100 Fix the scx200_acb state machine: * Nack was sent one byte too late on reads >= 2 bytes. * Stop bit was set one byte too late on reads. Signed-off-by: Jean Delvare Signed-off-by: Adrian Bunk Commit: b235e2832575ccde51f00eda1cade521a0f193fd Author: Pavel Roskin Thu, 09 Nov 2006 12:00:26 +0100 drivers/video/nvidia/nvidia.c: Add ID for Quadro NVS280 Quadro NVS280 is a dual-head PCIe card with PCI ID 10de:00fd and subsystem I 10de:0215. Signed-off-by: Pavel Roskin Signed-off-by: Antonino Daplas Signed-off-by: Adrian Bunk Commit: d2b85a5a4048902d43f43a43c2f9291b46127950 Author: Jeff Mahoney Thu, 09 Nov 2006 11:31:23 +0100 [DISKLABEL] SUN: Fix signed int usage for sector count The current sun disklabel code uses a signed int for the sector count. When partitions larger than 1 TB are used, the cast to a sector_t causes the partition sizes to be invalid: # cat /proc/paritions | grep sdan 66 112 2146435072 sdan 66 115 9223372036853660736 sdan3 66 120 9223372036853660736 sdan8 This patch switches the sector count to an unsigned int to fix this. Eric Sandeen also submitted the same patch. Signed-off-by: Jeff Mahoney Signed-off-by: Andrew Morton Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: 4504530e9f7310af00f79807029659c32fda90a1 Author: Larry Woodman Thu, 09 Nov 2006 11:05:38 +0100 [NET]: __alloc_pages() failures reported due to fragmentation We have seen a couple of __alloc_pages() failures due to fragmentation, there is plenty of free memory but no large order pages available. I think the problem is in sock_alloc_send_pskb(), the gfp_mask includes __GFP_REPEAT but its never used/passed to the page allocator. Shouldnt the gfp_mask be passed to alloc_skb() ? Signed-off-by: Larry Woodman Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: 5f61e927c7c47e696f7fe18ae3e7ea32a42e1d24 Author: Herbert Xu Thu, 09 Nov 2006 11:03:56 +0100 [NET]: Set truesize in pskb_copy Since pskb_copy tacks on the non-linear bits from the original skb, it needs to count them in the truesize field of the new skb. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: 289b5dceffbf83344a6e8dc319f8e2822edeab5f Author: John Heffner Thu, 09 Nov 2006 11:01:54 +0100 [TCP]: Don't use highmem in tcp hash size calculation. This patch removes consideration of high memory when determining TCP hash table sizes. Taking into account high memory results in tcp_mem values that are too large. Signed-off-by: John Heffner Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: c3fe9b53262fb22a7aaacf448e911f267c5482a9 Author: Adrian Bunk Thu, 09 Nov 2006 09:54:54 +0100 [AGPGART] remove unused variable This patch removes an unused variable. Signed-off-by: Adrian Bunk Signed-off-by: Dave Jones Commit: 8a3decfebb02774c7db8df2a439e106ce983549c Author: Dave Jones Thu, 09 Nov 2006 09:53:22 +0100 [AGPGART] Suspend/Resume support for nVidia nForce AGP. Based on a patch from the Ubuntu kernel. Signed-off-by: Ben Collins Signed-off-by: Dave Jones Signed-off-by: Adrian Bunk Commit: 9e914f50ac8359a5e8ba920976ef72121cbb6044 Author: Adrian Bunk Thu, 09 Nov 2006 09:52:07 +0100 drivers/telephony/ixj: fix an array overrun The Coverity checker noted that in drivers/telephony/ixj.c:ixj_build_filter_cadence(), filter_en[4] or filter_en[5] could be written to. Signed-off-by: Adrian Bunk Commit: 0ed0aa77231943572e7fba6914bb27f8e104e62d Author: Antonino Daplas Wed, 08 Nov 2006 09:08:58 +0100 nvidiafb: Add support for Geforce 6100 and related chipsets Add support for Geforce 6100 and related chipsets (PCI device id 0x024x) Signed-off-by: Antonino Daplas Signed-off-by: Adrian Bunk Commit: f919643362f45c65457e01ddd9aed0682497b2f8 Author: Adrian Bunk Wed, 08 Nov 2006 08:19:14 +0100 drivers/md/md.c: update START_ARRAY printk START_ARRAY will not be removed in 2.6.16, therefore replace the date reference with a kernel version reference. Signed-off-by: Adrian Bunk Commit: aac3c5dc8d5cc67c0523fc47faace5ee1b7093e2 Author: Adrian Bunk Wed, 08 Nov 2006 08:14:17 +0100 remove Documentation/feature-removal-schedule.txt The information in Documentation/feature-removal-schedule.txt doesn't apply to the 2.6.16 branch (and most dates were already in the past. Signed-off-by: Adrian Bunk Commit: a38c4343dc64fa5da5989d72c3dec9b5ed521f3b Author: Kirill Korotaev Wed, 08 Nov 2006 08:12:01 +0100 [IPV4]: Limit rt cache size properly. During OpenVZ stress testing we found that UDP traffic with random src can generate too much excessive rt hash growing leading finally to OOM and kernel panics. It was found that for 4GB i686 system (having 1048576 total pages and 225280 normal zone pages) kernel allocates the following route hash: syslog: IP route cache hash table entries: 262144 (order: 8, 1048576 bytes) => ip_rt_max_size = 4194304 entries, i.e. max rt size is 4194304 * 256b = 1Gb of RAM > normal_zone Attached the patch which removes HASH_HIGHMEM flag from alloc_large_system_hash() call. Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: 5db60db61aaa613f8c6dffa4213797c0dd83a8fd Author: Marcel Holtmann Wed, 08 Nov 2006 08:10:30 +0100 Don't allow chmod() on the /proc// files This just turns off chmod() on the /proc// files, since there is no good reason to allow it, and had we disallowed it originally, the nasty /proc race exploit wouldn't have been possible. The other patches already fixed the problem chmod() could cause, so this is really just some final mop-up.. This particular version is based off a patch by Eugene and Marcel which had much better naming than my original equivalent one. Signed-off-by: Eugene Teo Signed-off-by: Marcel Holtmann Signed-off-by: Adrian Bunk Commit: 5f4b6b038a617c333fd4c3b6d66ca31c51dddd5f Author: Geert Uytterhoeven Wed, 08 Nov 2006 07:48:45 +0100 fbdev: correct buffer size limit in fbmem_read_proc() Address http://bugzilla.kernel.org/show_bug.cgi?id=7189 It should check `clen', not `len'. Signed-off-by: Geert Uytterhoeven Signed-off-by: Adrian Bunk Commit: 41dc00ec4d90588a7362075cfd0f0afae5d29ff4 Author: Herbert Xu Wed, 08 Nov 2006 07:47:29 +0100 [NET]: Add missing UFO initialisations This bug was unknowingly fixed the GSO patches (or rather, its effect was unknown at the time). Thanks to Marco Berizzi's persistence which is documented in the thread "ipsec tunnel asymmetrical mtu", we now know that it can have highly non-obvious symptoms. What happens is that uninitialised uso_size fields can cause packets to be incorrectly identified as UFO, which means that it does not get fragmented even if it's over the MTU. The fix is simple enough. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: 8bd3ff1d04183848b589c53e94e4467a83746c8f Author: Dmitriy Monakhov Tue, 07 Nov 2006 15:40:54 +0100 from mm/memory.c: 1434 static inline void cow_user_page(struct page *dst, struct page *src, unsigned long va) 1435 { 1436 /* 1437 * If the source page was a PFN mapping, we don't have 1438 * a "struct page" for it. We do a best-effort copy by 1439 * just copying from the original user address. If that 1440 * fails, we just zero-fill it. Live with it. 1441 */ 1442 if (unlikely(!src)) { 1443 void *kaddr = kmap_atomic(dst, KM_USER0); 1444 void __user *uaddr = (void __user *)(va & PAGE_MASK); 1445 1446 /* 1447 * This really shouldn't fail, because the page is there 1448 * in the page tables. But it might just be unreadable, 1449 * in which case we just give up and fill the result with 1450 * zeroes. 1451 */ 1452 if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) 1453 memset(kaddr, 0, PAGE_SIZE); 1454 kunmap_atomic(kaddr, KM_USER0); #### D-cache have to be flushed here. #### It seems it is just forgotten. 1455 return; 1456 1457 } 1458 copy_user_highpage(dst, src, va); #### Ok here. flush_dcache_page() called from this func if arch need it 1459 } Signed-off-by: Dmitriy Monakhov Acked-by: David Miller Signed-off-by: Adrian Bunk Commit: de4fdc932162e6d9a1b350bd3536dc9ad2f1f5e3 Author: Stephen Hemminger Tue, 07 Nov 2006 15:36:32 +0100 [MAINTAINERS]: Add proper entry for TC classifier Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: aa459cd3ef50097e5f6f3b659a0b28f740fd5c1c Author: Thomas Graf Tue, 07 Nov 2006 15:34:27 +0100 [PKT_SCHED]: act_api: Fix module leak while flushing actions Module reference needs to be given back if message header construction fails. Signed-off-by: Thomas Graf Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: ed382a2a0f26e182f17743891b4a9eb44a659310 Author: Thomas Graf Tue, 07 Nov 2006 15:32:51 +0100 PKT_SCHED: Return ENOENT if action module is unavailable Return ENOENT if action module is unavailable Signed-off-by: Thomas Graf Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: f6dde50d9deb831fdc89f06cc453c5cb87669972 Author: Thomas Graf Tue, 07 Nov 2006 15:31:14 +0100 PKT_SCHED: Fix illegal memory dereferences when dumping actions The TCA_ACT_KIND attribute is used without checking its availability when dumping actions therefore leading to a value of 0x4 being dereferenced. The use of strcmp() in tc_lookup_action_n() isn't safe when fed with string from an attribute without enforcing proper NUL termination. Both bugs can be triggered with malformed netlink message and don't require any privileges. Signed-off-by: Thomas Graf Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: 118d32a5f209230c66a3b7d3874d1d5846ceb630 Author: Thomas Graf Tue, 07 Nov 2006 15:30:21 +0100 PKT_SCHED: Fix error handling while dumping actions "return -err" and blindly inheriting the error code in the netlink failure exception handler causes errors codes to be returned as positive value therefore making them being ignored by the caller. May lead to sending out incomplete netlink messages. Signed-off-by: Thomas Graf Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: f0524af06cf2243c6bebd7a18fe9876da33b0a08 Author: Neil Brown Tue, 07 Nov 2006 15:25:48 +0100 [PATCH] md: Make sure bi_max_vecs is set properly in bio_split Else a subsequent bio_clone might make a mess. Signed-off-by: Neil Brown Acked-by: Jens Axboe Signed-off-by: Adrian Bunk Commit: 6f5bccdd4fcebf5edc3cd3ff3e68417a0dbe9f2b Author: Randy Dunlap Tue, 07 Nov 2006 15:15:04 +0100 [CPUFREQ] Fix powernow-k8 SMP kernel on UP hardware bug. Fix powernow-k8 doesn't load bug. Reference: https://launchpad.net/distros/ubuntu/+source/linux-source-2.6.15/+bug/35145 Signed-off-by: Ben Collins Signed-off-by: Dave Jones Commit: 22d66b36bdebde6a104798f1a4ea86b1101e71b4 Author: Dave Jones Tue, 07 Nov 2006 15:14:04 +0100 [CPUFREQ] Make powernow-k7 work on SMP kernels. Even though powernow-k7 doesn't work in SMP environments, it can work on an SMP configured kernel if there's only one CPU present, however recalibrate_cpu_khz was returning -EINVAL on such kernels, so we failed to init the cpufreq driver. Signed-off-by: Dave Jones Signed-off-by: Adrian Bunk