Commit: eed22cdc141e11eacd8cd544bdc41432ceb506d1 Author: Adrian Bunk Sun, 15 Apr 2007 22:16:49 +0200 Linux 2.6.16.48 Commit: 6c59eb971bb3cb7df3fddccc5f4fd9157c058523 Author: Adrian Bunk Fri, 13 Apr 2007 21:51:12 +0200 Linux 2.6.16.48-rc1 Commit: 51e4ab6cf5eb8c000ef61fa862a6b610a5d2189d Author: Patrick McHardy Fri, 13 Apr 2007 21:34:16 +0200 [NET_SCHED]: cls_tcindex: fix compatibility breakage Userspace uses an integer for TCA_TCINDEX_SHIFT, the kernel was changed to expect and use a u16 value in 2.6.11, which broke compatibility on big endian machines. Change back to use int. Reported by Ole Reinartz Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: ef846bc01da49cf63d289e97139bef5181e75229 Author: Herbert Xu Fri, 13 Apr 2007 21:32:53 +0200 [IPSEC]: Reject packets within replay window but outside the bit mask Up until this point we've accepted replay window settings greater than 32 but our bit mask can only accomodate 32 packets. Thus any packet with a sequence number within the window but outside the bit mask would be accepted. This patch causes those packets to be rejected instead. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: 19a0662baeb7f783d345ebdfe3048b834582b294 Author: John Heffner Fri, 13 Apr 2007 21:31:34 +0200 [TCP]: Do receiver-side SWS avoidance for rcvbuf < MSS. Signed-off-by: John Heffner Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: 889cde54cd2a82f6e4d7ed18440e0f6138b06d60 Author: YOSHIFUJI Hideaki Fri, 13 Apr 2007 21:30:03 +0200 [IPv6]: Fix incorrect length check in rawv6_sendmsg() In article <20070329.142644.70222545.davem@davemloft.net> (at Thu, 29 Mar 2007 14:26:44 -0700 (PDT)), David Miller says: > From: Sridhar Samudrala > Date: Thu, 29 Mar 2007 14:17:28 -0700 > > > The check for length in rawv6_sendmsg() is incorrect. > > As len is an unsigned int, (len < 0) will never be TRUE. > > I think checking for IPV6_MAXPLEN(65535) is better. > > > > Is it possible to send ipv6 jumbo packets using raw > > sockets? If so, we can remove this check. > > I don't see why such a limitation against jumbo would exist, > does anyone else? > > Thanks for catching this Sridhar. A good compiler should simply > fail to compile "if (x < 0)" when 'x' is an unsigned type, don't > you think :-) Dave, we use "int" for returning value, so we should fix this anyway, IMHO; we should not allow len > INT_MAX. Signed-off-by: YOSHIFUJI Hideaki Acked-by: Sridhar Samudrala Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: 6d94f3b14205120019674b5a6a5502c9dadc4964 Author: Patrick McHardy Fri, 13 Apr 2007 21:28:27 +0200 [NET_SCHED]: cls_basic: fix memory leak in basic_destroy tp->root is not freed on destruction. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: 2530ba1f3a6ea7923979907715fe00a7e4b2c818 Author: Andreas Oberritter Fri, 13 Apr 2007 21:21:28 +0200 V4L/DVB: Pluto2: fix incorrect TSCR register setting The ADEF bits in the TSCR register have different meanings in read and write mode. For this reason ADEF has to be reset on every read-modify-write operation. This patch introduces a special write function for this register, which takes care of it. Thanks to Holger Magnussen for pointing my nose at this problem. Signed-off-by: Andreas Oberritter Signed-off-by: Adrian Bunk Commit: 2d51ccdd501e620b3c323f4df3f07a6e5d03ea6d Author: Oliver Endriss Fri, 13 Apr 2007 21:23:49 +0200 V4L: saa7146: Fix allocation of clipping memory Olaf Hering pointed out that SAA7146_CLIPPING_MEM would become very large for PAGE_SIZE > 4K. In fact, the number of clipping windows is limited to 16, and calculate_clipping_registers_rect() does not use more than 256 bytes. SAA7146_CLIPPING_MEM adjusted accordingly. (cherry picked from commit 7a7cd1920969dd9da4e0d99aab573b3eba24c799) Thanks-to: Olaf Hering Signed-off-by: Oliver Endriss Signed-off-by: Michael Krufky Signed-off-by: Adrian Bunk Commit: 9c38858ad17d961762deb032d7e9737589cae3a2 Author: Trent Piepho Fri, 13 Apr 2007 21:23:11 +0200 V4L: radio: Fix error in Kbuild file All the radio drivers need video_dev, but they were depending on VIDEO_DEV!=n. That meant that one could try to compile the driver into the kernel when VIDEO_DEV=m, which will not work. If video_dev is a module, then the radio drivers must be modules too. (cherry picked from commit b10fece583fdfdb3d2f29b0da3896ec58b8fe122) Signed-off-by: Trent Piepho Signed-off-by: Michael Krufky Signed-off-by: Adrian Bunk Commit: 1a40c3a4c890b95b66a8831aa967cd12cef61062 Author: Michael Krufky Fri, 13 Apr 2007 21:18:10 +0200 V4L: tveeprom: autodetect LG TAPC G701D as tuner type 37 Autodetect LG TAPC G701D as tuner type 37, fixing mis-detected tuners in some Hauppauge tv tuner cards. Thanks to Adonis Papas, for pointing this out. (cherry picked from commit 1323fbda1343f50f198bc8bd6d1d59c8b7fc45bf) Signed-off-by: Michael Krufky Signed-off-by: Adrian Bunk Commit: d9b258c4bcf11ec912d95c8e61d7453b07f28c63 Author: Stephen Hemminger Fri, 13 Apr 2007 20:34:00 +0200 sky2: turn on clocks when doing resume Some of these chips are disabled until clock is enabled. This fixes: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=404107 Signed-off-by: Stephen Hemminger Signed-off-by: Adrian Bunk Commit: e3bfdc5b2a5a2f4429e2bcd9123a39a361c18662 Author: Stephen Hemminger Fri, 13 Apr 2007 20:32:35 +0200 sky2: turn carrier off when down Driver needs to turn off carrier when down. Signed-off-by: Stephen Hemminger Signed-off-by: Adrian Bunk Commit: 35688b92b2b447cee8f9923fd462c6cd216b695e Author: Stephen Hemminger Fri, 13 Apr 2007 20:31:50 +0200 skge: turn carrier off when down Driver needs to turn off carrier when down, otherwise it can confuse bonding and bridging and looks like carrier is on immediately when it is brought back up. Signed-off-by: Stephen Hemminger Signed-off-by: Adrian Bunk Commit: 0243ef462fbe940dafde1f47d3ea29dbf5146b21 Author: Thomas Gleixner Fri, 13 Apr 2007 20:45:17 +0200 i386: fix file_read_actor() and pipe_read() for original i386 systems The __copy_to_user_inatomic() calls in file_read_actor() and pipe_read() are broken on original i386 machines, where WP-works-ok == false, as __copy_to_user_inatomic() on such systems calls functions which might sleep and/or contain cond_resched() calls inside of a kmap_atomic() region. The original check for WP-works-ok was in access_ok(), but got moved during the 2.5 series to fix a race vs. swap. Return the number of bytes to copy in the case where we are in an atomic region, so the non atomic code pathes in file_read_actor() and pipe_read() are taken. This could be optimized to avoid the kmap_atomicby moving the check for WP-works-ok into fault_in_pages_writeable(), but this is more intrusive and can be done later. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Signed-off-by: Adrian Bunk Commit: 1ee709383b60148263f139af790c8b5a22c2e586 Author: Francois Romieu Fri, 13 Apr 2007 22:57:48 +0200 r8169: issue request_irq after the private data are completely initialized The irq handler schedules a NAPI poll request unconditionally as soon as the status register is not clean. It has been there - and wrong - for ages but a recent timing change made it apparently easier to trigger. Adrian Bunk: backported to 2.6.16 Signed-off-by: Francois Romieu Signed-off-by: Adrian Bunk Commit: 34215e7b2e7021740a562595218411e91d921d9f Author: Francois Romieu Fri, 13 Apr 2007 20:19:50 +0200 r8169: fix suspend/resume for down interface The PM hooks are no-op if the r8169 interface is down (i.e. !IFF_UP). However, as the chipset is enabled, the device will not work after a suspend/resume cycle. The patch always issue the required PCI suspend sequence and removes the module unload/reload workaround. Signed-off-by: Arnaud Patard Signed-off-by: Francois Romieu Signed-off-by: Adrian Bunk Commit: 151ed87ad21b3ac49eed51edf1f19fb5dbee3972 Author: Francois Romieu Fri, 13 Apr 2007 20:18:38 +0200 r8169: fix a race between PCI probe and dev_open Initialize the timer with the rest of the private-struct. Signed-off-by: Francois Romieu Signed-off-by: Adrian Bunk Commit: 2f9ccf56f3b4e9738a68da18d9fca3d6ba612736 Author: David Brownell Fri, 13 Apr 2007 20:16:21 +0200 USB: usbnet driver bugfix The attached fixes an oops in the usbnet driver. The same patch is in 2.6.21-rc1, but that one has many whitespace changes. This is much smaller. Signed-off-by: David Brownell Signed-off-by: Adrian Bunk