[PATCH 0/4] -stable review

[PATCH 0/4] -stable review

[Chris Wright]

This is the start of the stable review cycle for the 2.6.15.6 release.
There are 4 patches in this series, 2 of which are simply compile fixes
for the problems with 2.6.15.5, all will be posted as a response to
this one.  If anyone has any issues with these being applied, please let
us know.  If anyone is a maintainer of the proper subsystem, and wants
to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the
Cc: line.  If you wish to be a reviewer, please email stable@kernel.org
to add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by Sun Mar 5 08:00 UTC.  Anything received
after that time, might be too late.

thanks,
the -stable release team
--

[PATCH 1/4] [REQSK] Dont reset rskq_defer_accept in reqsk_queue_alloc

[Chris Wright]

[-- Attachment #1: don-t-reset-rskq_defer_accept-in-reqsk_queue_alloc.patch --]
[-- Type: text/plain, Size: 1113 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

In 295f7324ff8d9ea58b4d3ec93b1aaa1d80e048a9 I moved defer_accept from
tcp_sock to request_queue and mistakingly reset it at reqsl_queue_alloc, causing
calls to setsockopt(TCP_DEFER_ACCEPT ) to be lost after bind, the fix is to
remove the zeroing of rskq_defer_accept from reqsl_queue_alloc.

Thanks to Alexandra N. Kossovsky <Alexandra.Kossovsky@oktetlabs.ru> for
reporting and testing the suggested fix.

Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 net/core/request_sock.c |    1 -
 1 files changed, 1 deletion(-)

--- linux-2.6.15.5.orig/net/core/request_sock.c
+++ linux-2.6.15.5/net/core/request_sock.c
@@ -52,7 +52,6 @@ int reqsk_queue_alloc(struct request_soc
 	get_random_bytes(&lopt->hash_rnd, sizeof(lopt->hash_rnd));
 	rwlock_init(&queue->syn_wait_lock);
 	queue->rskq_accept_head = queue->rskq_accept_head = NULL;
-	queue->rskq_defer_accept = 0;
 	lopt->nr_table_entries = nr_table_entries;
 
 	write_lock_bh(&queue->syn_wait_lock);

--

[PATCH 2/4] [PATCH] [IA64] die_if_kernel() can return (CVE-2006-0742)

[Chris Wright]

[-- Attachment #1: die_if_kernel-can-return.patch --]
[-- Type: text/plain, Size: 970 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

arch/ia64/kernel/unaligned.c erroneously marked die_if_kernel()
with a "noreturn" attribute ... which is silly (it returns whenever
the argument regs say that the fault happened in user mode, as one
might expect given the "if_kernel" part of its name!).  Thanks to
Alan and Gareth for pointing this out.

Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 arch/ia64/kernel/unaligned.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.15.5.orig/arch/ia64/kernel/unaligned.c
+++ linux-2.6.15.5/arch/ia64/kernel/unaligned.c
@@ -24,7 +24,7 @@
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
 
-extern void die_if_kernel(char *str, struct pt_regs *regs, long err) __attribute__ ((noreturn));
+extern void die_if_kernel(char *str, struct pt_regs *regs, long err);
 
 #undef DEBUG_UNALIGNED_TRAP
 

--

[PATCH 3/4] [PATCH] fs/nfs/direct.c compile fix

[Chris Wright]

[-- Attachment #1: normal-user-can-panic-nfs-client-with-direct-i-o-fix.patch --]
[-- Type: text/plain, Size: 1659 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

Compile fix:

fs/nfs/direct.c: In function 'nfs_get_user_pages':
fs/nfs/direct.c:110: warning: implicit declaration of function 'nfs_free_user_pages'
fs/nfs/direct.c: At top level:
fs/nfs/direct.c:127: warning: conflicting types for 'nfs_free_user_pages'
fs/nfs/direct.c:127: error: static declaration of 'nfs_free_user_pages' follows non-static declaration
fs/nfs/direct.c:110: error: previous implicit declaration of 'nfs_free_user_pages' was here

This should now be the same as fix that's going upstream.

Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
---

 fs/nfs/direct.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletion(-)

--- linux-2.6.15.5.orig/fs/nfs/direct.c
+++ linux-2.6.15.5/fs/nfs/direct.c
@@ -57,6 +57,7 @@
 #define NFSDBG_FACILITY		NFSDBG_VFS
 #define MAX_DIRECTIO_SIZE	(4096UL << PAGE_SHIFT)
 
+static void nfs_free_user_pages(struct page **pages, int npages, int do_dirty);
 static kmem_cache_t *nfs_direct_cachep;
 
 /*
@@ -106,12 +107,16 @@ nfs_get_user_pages(int rw, unsigned long
 		result = get_user_pages(current, current->mm, user_addr,
 					page_count, (rw == READ), 0,
 					*pages, NULL);
+		up_read(&current->mm->mmap_sem);
+		/*
+		 * If we got fewer pages than expected from get_user_pages(),
+		 * the user buffer runs off the end of a mapping; return EFAULT.
+		 */
 		if (result >= 0 && result < page_count) {
 			nfs_free_user_pages(*pages, result, 0);
 			*pages = NULL;
 			result = -EFAULT;
 		}
-		up_read(&current->mm->mmap_sem);
 	}
 	return result;
 }

--

[PATCH 4/4] [PATCH] mempolicy.c compile fix, make sure BITS_PER_BYTE is defined

[Chris Wright]

[-- Attachment #1: compile-fix-make-sure-bits_per_byte-is-defined.patch --]
[-- Type: text/plain, Size: 926 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

Gar..

mm/mempolicy.c: In function 'get_nodes':
mm/mempolicy.c:527: error: 'BITS_PER_BYTE' undeclared (first use in this function)
mm/mempolicy.c:527: error: (Each undeclared identifier is reported only once
mm/mempolicy.c:527: error: for each function it appears in.)

About to retry a build with the below patch which should do the trick.
(How did this *ever* build?)

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 include/linux/types.h |    1 +
 1 files changed, 1 insertion(+)

--- linux-2.6.15.5.orig/include/linux/types.h
+++ linux-2.6.15.5/include/linux/types.h
@@ -8,6 +8,7 @@
 	(((bits)+BITS_PER_LONG-1)/BITS_PER_LONG)
 #define DECLARE_BITMAP(name,bits) \
 	unsigned long name[BITS_TO_LONGS(bits)]
+#define BITS_PER_BYTE 8
 #endif
 
 #include <linux/posix_types.h>

--