Commit: fae1f6d365ea6ca7b736291970a1aaf56f8e3ed7 Author: Adrian Bunk Wed, 09 May 2007 06:26:35 +0200 Linux 2.6.16.51 Commit: 02ffc0b1725e89f30bc512b24e361fd14e2a011e Author: Adrian Bunk Sat, 05 May 2007 00:04:12 +0200 Linux 2.6.16.51-rc1 Commit: 0fbccb97e946be6db683926331b150da63431088 Author: Andrew Hendry Sat, 05 May 2007 00:00:25 +0200 [X.25]: Add missing sock_put in x25_receive_data __x25_find_socket does a sock_hold. This adds a missing sock_put in x25_receive_data. Signed-off-by: Andrew Hendry Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: c0ff8b5abae6dd56585e375a3b34211de037033a Author: Jaroslav Kysela Fri, 04 May 2007 23:59:07 +0200 [NETFILTER]: ipt_CLUSTERIP: fix oops in checkentry function The clusterip_config_find_get() already increases entries reference counter, so there is no reason to do it twice in checkentry() callback. This causes the config to be freed before it is removed from the list, resulting in a crash when adding the next rule. Signed-off-by: Jaroslav Kysela Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk Commit: c50f63ad108d9f0c607ee365b10cccbff4288b45 Author: Adrian Bunk Fri, 04 May 2007 23:48:45 +0200 x86_64: ACPI_CPU_FREQ must select CPU_FREQ_TABLE Fix a compile error reported by Michel Lespinasse. Signed-off-by: Adrian Bunk Commit: 76e01e5bc0f958d7065d589ada7ca44eb44d8d3e Author: Jean Delvare Fri, 04 May 2007 01:35:12 +0200 hwmon/w83627ehf: Don't redefine REGION_OFFSET On ia64, kernel headers define REGION_OFFSET so we can't use that. Reported by Andrew Morton. Signed-off-by: Jean Delvare Signed-off-by: Adrian Bunk Commit: c5807ace66d5085ed94608a7e9a084085ea57ede Author: Jorge Boncompte Fri, 04 May 2007 01:00:32 +0200 [NETFILTER]: ip_nat_proto_gre: do not modify/corrupt GREv0 packets through NAT While porting some changes of the 2.6.21-rc7 pptp/proto_gre conntrack and nat modules to a 2.4.32 kernel I noticed that the gre_key function returns a wrong pointer to the GRE key of a version 0 packet thus corrupting the packet payload. The intended behaviour for GREv0 packets is to act like ip_conntrack_proto_generic/ip_nat_proto_unknown so I have ripped the offending functions (not used anymore) and modified the ip_nat_proto_gre modules to not touch version 0 (non PPTP) packets. Signed-off-by: Jorge Boncompte Signed-off-by: Patrick McHardy Signed-off-by: Adrian Bunk Commit: 4879e0dfe9c9199e55566a6025a729854bb2a00e Author: Hugh Dickins Fri, 04 May 2007 00:54:25 +0200 holepunch: fix mmap_sem i_mutex deadlock sys_madvise has down_write of mmap_sem, then madvise_remove calls vmtruncate_range which takes i_mutex and i_alloc_sem: no, we can easily devise deadlocks from that ordering. madvise_remove drop mmap_sem while calling vmtruncate_range: luckily, since madvise_remove doesn't split or merge vmas, it's easy to handle this case with a NULL prev, without restructuring sys_madvise. (Though sad to retake mmap_sem when it's unlikely to be needed, and certainly down_read is sufficient for MADV_REMOVE, unlike the other madvices.) Signed-off-by: Hugh Dickins Signed-off-by: Adrian Bunk Commit: 7943951f236f91699a634097a70abc35927efeb9 Author: Hugh Dickins Fri, 04 May 2007 00:53:54 +0200 holepunch: fix disconnected pages after second truncate shmem_truncate_range has its own truncate_inode_pages_range, to free any pages racily instantiated while it was in progress: a SHMEM_PAGEIN flag is set when this might have happened. But holepunching gets no chance to clear that flag at the start of vmtruncate_range, so it's always set (unless a truncate came just before), so holepunch almost always does this second truncate_inode_pages_range. shmem holepunch has unlikely swap<->file races hereabouts whatever we do (without a fuller rework than is fit for this release): I was going to skip the second truncate in the punch_hole case, but Miklos points out that would make holepunch correctness more vulnerable to swapoff. So keep the second truncate, but follow it by an unmap_mapping_range to eliminate the disconnected pages (freed from pagecache while still mapped in userspace) that it might have left behind. Signed-off-by: Hugh Dickins Signed-off-by: Adrian Bunk Commit: ffd0472d4ece96766eec98ebb0ad649dc76248b8 Author: Hugh Dickins Fri, 04 May 2007 00:52:56 +0200 holepunch: fix shmem_truncate_range punch locking Miklos Szeredi observes that during truncation of shmem page directories, info->lock is released to improve latency (after lowering i_size and next_index to exclude races); but this is quite wrong for holepunching, which receives no such protection from i_size or next_index, and is left vulnerable to races with shmem_unuse, shmem_getpage and shmem_writepage. Hold info->lock throughout when holepunching? No, any user could prevent rescheduling for far too long. Instead take info->lock just when needed: in shmem_free_swp when removing the swap entries, and whenever removing a directory page from the level above. But so long as we remove before scanning, we can safely skip taking the lock at the lower levels, except at misaligned start and end of the hole. Signed-off-by: Hugh Dickins Signed-off-by: Adrian Bunk Commit: 0e846d67dd67e4b22a4889768f7982363e44ed26 Author: Hugh Dickins Fri, 04 May 2007 00:52:18 +0200 holepunch: fix shmem_truncate_range punching too far Miklos Szeredi observes BUG_ON(!entry) in shmem_writepage() triggered in rare circumstances, because shmem_truncate_range() erroneously removes partially truncated directory pages at the end of the range: later reclaim on pages pointing to these removed directories triggers the BUG. Indeed, and it can also cause data loss beyond the hole. Fix this as in the patch proposed by Miklos, but distinguish between "limit" (how far we need to search: ignore truncation's next_index optimization in the holepunch case - if there are races it's more consistent to act on the whole range specified) and "upper_limit" (how far we can free directory pages: generally we must be careful to keep partially punched pages, but can relax at end of file - i_size being held stable by i_mutex). Signed-off-by: Hugh Dickins Signed-off-by: Adrian Bunk