Commit: e76e407ef9ac8b94f011b42375b9105923b41dd9 Author: Adrian Bunk Thu, 03 May 2007 23:49:52 +0200 Linux 2.6.16.50 Commit: b15ca5bcd58b4dae7c40945ae0cecbd60e4d33cf Author: Adrian Bunk Tue, 01 May 2007 05:44:08 +0200 Linux 2.6.16.50-rc1 Commit: 5225791117b564cd8b5683cf82d9eea45b0f0d59 Author: Adrian Bunk Tue, 01 May 2007 01:31:47 +0200 [IPV6]: Disallow RH0 by default (CVE-2007-2242) A security issue is emerging. Disallow Routing Header Type 0 by default as we have been doing for IPv4. This version already includes a fix for the original patch. Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: Adrian Bunk Commit: ca80e5b5767e8a2bf0714f9797b872258e500ee6 Author: Adrian Bunk Tue, 01 May 2007 01:11:29 +0200 [NETLINK]: Infinite recursion in netlink (CVE-2007-1861) Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel, which resulted in infinite recursion and stack overflow. The bug is present in all kernel versions since the feature appeared. The patch also makes some minimal cleanup: 1. Return something consistent (-ENOENT) when fib table is missing 2. Do not crash when queue is empty (does not happen, but yet) 3. Put result of lookup Sergey Vlasov: Oops fix Signed-off-by: Alexey Kuznetsov Signed-off-by: Sergey Vlasov Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: 0ea2b4b19d3bc0d4075a4f176a9da5797be73304 Author: Jiri Slaby Thu, 26 Apr 2007 01:35:22 +0200 Char: icom, mark __init as __devinit Two functions are called from __devinit context, but they are marked as __init. Fix this. Signed-off-by: Jiri Slaby Signed-off-by: Adrian Bunk Commit: 70272a6c174b13f764322d1ac8c43f10372f4b0c Author: Zach Brown Thu, 26 Apr 2007 00:47:15 +0200 aio: remove bare user-triggerable error printk The user can generate console output if they cause do_mmap() to fail during sys_io_setup(). This was seen in a regression test that does exactly that by spinning calling mmap() until it gets -ENOMEM before calling io_setup(). We don't need this printk at all, just remove it. Signed-off-by: Zach Brown Signed-off-by: Adrian Bunk Commit: 89cd6ca5a57e67604e05076203e1da12723dae12 Author: Al Viro Thu, 26 Apr 2007 00:43:52 +0200 mca_nmi_hook() can be called at any point ... and having it __init is a bad idea. Signed-off-by: Al Viro Signed-off-by: Adrian Bunk Commit: d19b7b09a83e1ef419a6bbe960a39b66c1d07e80 Author: Guennadi Liakhovetski Wed, 25 Apr 2007 21:57:52 +0200 IrDA: irttp_dup spin_lock initialisation Without this initialization one gets kernel BUG at kernel/rtmutex_common.h:80! Signed-off-by: G. Liakhovetski Signed-off-by: Samuel Ortiz Acked-by: David Miller Signed-off-by: Adrian Bunk Commit: 15485523f2deacb7663af61538fbd786ebc1f7db Author: Jeet Chaudhuri Wed, 25 Apr 2007 21:53:20 +0200 IrDA: Incorrect TTP header reservation We must reserve SAR + MAX_HEADER bytes for IrLMP to fit in. This fixes an oops reported (and fixed) by Jeet Chaudhuri, when max_sdu_size is greater than 0. Signed-off-by: Samuel Ortiz Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: fe1a5ddff7186192f9c6316798a85b3095696ea6 Author: Shaohua Li Tue, 24 Apr 2007 01:25:26 +0200 x86 microcode: don't check the size IA32 manual says if micorcode update's size is 0, then the size is default size (2048 bytes). But this doesn't suggest all microcode update's size should be above 2048 bytes to me. We actually had a microcode update whose size is 1024 bytes. The patch just removed the check. Backported by Daniel Drake. Signed-off-by: Daniel Drake Signed-off-by: Adrian Bunk