commit 9eed28679282238210ad5e80bb91df30fec6d7db Merge: 2099c99... 0e64e94... Author: Linus Torvalds Date: Tue Oct 24 22:01:33 2006 -0700 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 * master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [DCCP]: Update documentation references. [ATM] horizon: read_bia() needs to be __devinit [NETFILTER]: Fix ip6_tables extension header bypass bug [NETFILTER]: Fix ip6_tables protocol bypass bug [XFRM]: Fix xfrm_state accounting [IPV4] ipconfig: fix RARP ic_servaddr breakage commit 2099c99e3b24f86b131566aa9854249189ae9ea2 Author: Al Viro Date: Tue Oct 24 11:17:06 2006 +0100 [PATCH] missing includes of io.h Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 016002312d50004908a79df37174b336e3682e18 Author: Al Viro Date: Tue Oct 24 11:17:37 2006 +0100 [PATCH] missing include of dma-mapping.h Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit aa6c2e62bbe7a20ccc85906f75bc63465d899227 Author: Al Viro Date: Tue Oct 24 11:16:29 2006 +0100 [PATCH] IOC4 should depend on PCI Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 3a51237dc11efe283b40ea0248f4e26ab935dbd1 Author: Al Viro Date: Tue Oct 24 11:15:29 2006 +0100 [PATCH] uml: mconsole fixes * when we have stop/sysrq/go, we get pt_regs of whatever executes mc_work_proc(). Would be better to see what we had at the time of interrupt that got us stop. * stop/stop/stop..... will give stack overflow. Shouldn't allow stop from mconsole_stop(). * stop/stop/go leaves us inside mconsole_stop() with os_set_fd_block(req->originating_fd, 0); reactivate_fd(req->originating_fd, MCONSOLE_IRQ); just done by nested mconsole_stop(). Ditto. * once we'd seen stop, there's a period when INTR commands are executed out of order (as they should; we might have the things stuck badly enough to never reach mconsole_stop(), but still not badly enough to block mconsole_interrupt(); in that situation we _want_ things like "cad" to be executed immediately). Once we enter monsole_stop(), all INTR commands will be executed in order, mixed with PROC ones. We'd better let user see that such change of behaviour has happened. (Suggested by lennert). * stack footprint of monsole_interrupt() is an atrocity; AFAICS we can safely make struct mc_request req; static in function there. Signed-off-by: Al Viro Acked-by: Jeff Dike Signed-off-by: Linus Torvalds commit 6c50444723f2e6487b3377450f90d813a88e6c31 Author: Keith Packard Date: Tue Oct 24 13:34:11 2006 -0700 [PATCH] Merge headphone and speaker volume controls for Panasonic R4 laptop Signed-off-by: Keith Packard Signed-off-by: Linus Torvalds commit 0e64e94e477f8ed04e9295b11a5898d443c28a47 Author: Gerrit Renker Date: Tue Oct 24 16:17:51 2006 -0700 [DCCP]: Update documentation references. Updates the references to spec documents throughout the code, taking into account that * the DCCP, CCID 2, and CCID 3 drafts all became RFCs in March this year * RFC 1063 was obsoleted by RFC 1191 * draft-ietf-tcpimpl-pmtud-0x.txt was published as an Informational RFC, RFC 2923 on 2000-09-22. All references verified. Signed-off-by: Gerrit Renker Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: David S. Miller commit 977a415f2b70b5693aaa23b1a16ad57ea20a1dce Author: David S. Miller Date: Tue Oct 24 16:16:39 2006 -0700 [ATM] horizon: read_bia() needs to be __devinit Thanks to Randy Dunlap. Signed-off-by: David S. Miller commit 6d381634d213580d40d431e7664dfb45f641b884 Author: Patrick McHardy Date: Tue Oct 24 16:15:10 2006 -0700 [NETFILTER]: Fix ip6_tables extension header bypass bug As reported by Mark Dowd , ip6_tables is susceptible to a fragmentation attack causing false negatives on extension header matches. When extension headers occur in the non-first fragment after the fragment header (possibly with an incorrect nexthdr value in the fragment header) a rule looking for this extension header will never match. Drop fragments that are at offset 0 and don't contain the final protocol header regardless of the ruleset, since this should not happen normally. Since all extension headers are before the protocol header this makes sure an extension header is either not present or in the first fragment, where we can properly parse it. With help from Yasuyuki KOZAKAI . Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 51d8b1a65291a6956b79374b6adbbadc2263bcf6 Author: Patrick McHardy Date: Tue Oct 24 16:14:04 2006 -0700 [NETFILTER]: Fix ip6_tables protocol bypass bug As reported by Mark Dowd , ip6_tables is susceptible to a fragmentation attack causing false negatives on protocol matches. When the protocol header doesn't follow the fragment header immediately, the fragment header contains the protocol number of the next extension header. When the extension header and the protocol header are sent in a second fragment a rule like "ip6tables .. -p udp -j DROP" will never match. Drop fragments that are at offset 0 and don't contain the final protocol header regardless of the ruleset, since this should not happen normally. With help from Yasuyuki KOZAKAI . Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 2fab22f2d3290ff7c602fe62f22e825c48e97a06 Author: Patrick McHardy Date: Tue Oct 24 15:34:00 2006 -0700 [XFRM]: Fix xfrm_state accounting xfrm_state_num needs to be increased for XFRM_STATE_ACQ states created by xfrm_state_find() to prevent the counter from going negative when the state is destroyed. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 82571026b9771c4035b0c62abbbe588fe73373ea Author: Al Viro Date: Tue Oct 24 15:18:36 2006 -0700 [IPV4] ipconfig: fix RARP ic_servaddr breakage memcpy 4 bytes to address of auto unsigned long variable followed by comparison with u32 is a bloody bad idea. Signed-off-by: Al Viro Signed-off-by: David S. Miller