[PATCH 00/10] -stable review

[PATCH 00/10] -stable review

[Chris Wright]

This is the start of the stable review cycle for the 2.6.13.3 release.
There are 10 patches in this series, all will be posted as a response to
this one.  If anyone has any issues with these being applied, please let
us know.  If anyone is a maintainer of the proper subsystem, and wants
to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the
Cc: line.  If you wish to be a reviewer, please email stable@kernel.org
to add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by Sun Oct 2, 02:00 UTC.  Anything received
after that time, might be too late.

thanks,

the -stable release team
--

[PATCH 01/10] [PATCH] yenta oops fix

[Chris Wright]

[-- Attachment #1: yenta-oops-fix.patch --]
[-- Type: text/plain, Size: 1580 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

In some cases, especially on modern laptops with a lot of PCI and
cardbus bridges, we're unable to assign correct secondary/subordinate
bus numbers to all cardbus bridges due to BIOS limitations unless
we are using "pci=assign-busses" boot option.
So some cardbus controllers may not have attached subordinate pci_bus
structure, and yenta driver must cope with it - just ignore such cardbus
bridges.

For example, see https://bugzilla.novell.com/show_bug.cgi?id=113778

Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
---
 drivers/pcmcia/yenta_socket.c |   13 ++++++++++++-
 1 files changed, 12 insertions(+), 1 deletion(-)

Index: linux-2.6.13.y/drivers/pcmcia/yenta_socket.c
===================================================================
--- linux-2.6.13.y.orig/drivers/pcmcia/yenta_socket.c
+++ linux-2.6.13.y/drivers/pcmcia/yenta_socket.c
@@ -976,7 +976,18 @@ static int __devinit yenta_probe (struct
 {
 	struct yenta_socket *socket;
 	int ret;
-	
+
+	/*
+	 * If we failed to assign proper bus numbers for this cardbus
+	 * controller during PCI probe, its subordinate pci_bus is NULL.
+	 * Bail out if so.
+	 */
+	if (!dev->subordinate) {
+		printk(KERN_ERR "Yenta: no bus associated with %s! "
+			"(try 'pci=assign-busses')\n", pci_name(dev));
+		return -ENODEV;
+	}
+
 	socket = kmalloc(sizeof(struct yenta_socket), GFP_KERNEL);
 	if (!socket)
 		return -ENOMEM;

--

[PATCH 02/10] [PATCH] Fix fs/exec.c:788 (de_thread()) BUG_ON

[Chris Wright]

[-- Attachment #1: fix-de_thread-BUG_ON.patch --]
[-- Type: text/plain, Size: 2012 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

It turns out that the BUG_ON() in fs/exec.c: de_thread() is unreliable
and can trigger due to the test itself being racy.

de_thread() does
 	while (atomic_read(&sig->count) > count) {
	}
	.....
	.....
	BUG_ON(!thread_group_empty(current));

but release_task does
	write_lock_irq(&tasklist_lock)
	__exit_signal
		(this is where atomic_dec(&sig->count) is run)
	__exit_sighand
	__unhash_process
		takes write lock on tasklist_lock
		remove itself out of PIDTYPE_TGID list
	write_unlock_irq(&tasklist_lock)

so there's a clear (although small) window between the
atomic_dec(&sig->count) and the actual PIDTYPE_TGID unhashing of the
thread.

And actually there is no need for all threads to have exited at this
point, so we simply kill the BUG_ON.

Big thanks to Marc Lehmann who provided the test-case.

Fixes Bug 5170 (http://bugme.osdl.org/show_bug.cgi?id=5170)

Signed-off-by: Alexander Nyberg <alexn@telia.com>
Cc: Roland McGrath <roland@redhat.com>
Cc: Andrew Morton <akpm@osdl.org>
Cc: Ingo Molnar <mingo@elte.hu>
Acked-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
---
 fs/exec.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)

Index: linux-2.6.13.y/fs/exec.c
===================================================================
--- linux-2.6.13.y.orig/fs/exec.c
+++ linux-2.6.13.y/fs/exec.c
@@ -745,8 +745,8 @@ static inline int de_thread(struct task_
         }
 
 	/*
-	 * Now there are really no other threads at all,
-	 * so it's safe to stop telling them to kill themselves.
+	 * There may be one thread left which is just exiting,
+	 * but it's safe to stop telling the group to kill themselves.
 	 */
 	sig->flags = 0;
 
@@ -785,7 +785,6 @@ no_thread_group:
 			kmem_cache_free(sighand_cachep, oldsighand);
 	}
 
-	BUG_ON(!thread_group_empty(current));
 	BUG_ON(!thread_group_leader(current));
 	return 0;
 }

--

[PATCH 03/10] [PATCH] fix IPv6 per-socket multicast filtering in exact-match case

[Chris Wright]

[-- Attachment #1: ipv6-fix-per-socket-multicast-filtering.patch --]
[-- Type: text/plain, Size: 1060 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

per-socket multicast filters were not being applied to all sockets
in the case of an exact-match bound address, due to an over-exuberant
"return" in the look-up code. Fix below. IPv4 does not have this problem.

Thanks to Hoerdt Mickael for reporting the bug.

Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
Signed-off-by: Chris Wright <chrisw@osdl.org>
---
 net/ipv6/udp.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)

Index: linux-2.6.13.y/net/ipv6/udp.c
===================================================================
--- linux-2.6.13.y.orig/net/ipv6/udp.c
+++ linux-2.6.13.y/net/ipv6/udp.c
@@ -404,9 +404,8 @@ static struct sock *udp_v6_mcast_next(st
 				continue;
 
 			if (!ipv6_addr_any(&np->rcv_saddr)) {
-				if (ipv6_addr_equal(&np->rcv_saddr, loc_addr))
-					return s;
-				continue;
+				if (!ipv6_addr_equal(&np->rcv_saddr, loc_addr))
+					continue;
 			}
 			if(!inet6_mc_check(s, loc_addr, rmt_addr))
 				continue;

--

[PATCH 04/10] [PATCH] ipvs: ip_vs_ftp breaks connections using persistence

[Chris Wright]

[-- Attachment #1: ipvs-ip_vs_ftp-breaks-connections.patch --]
[-- Type: text/plain, Size: 9145 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

	ip_vs_ftp when loaded can create NAT connections with unknown
client port for passive FTP. For such expectations we lookup with
cport=0 on incoming packet but it matches the format of the persistence
templates causing packets to other persistent virtual servers to be
forwarded to real server without creating connection. Later the
reply packets are treated as foreign and not SNAT-ed.

	If the IPVS box serves both FTP and other services (eg. HTTP)
for the time we wait for first packet for the FTP data connections with
unknown client port (there can be many), other HTTP connections
that have nothing common to the FTP conn break, i.e. HTTP client
sends SYN to the virtual IP but the SYN+ACK is not NAT-ed properly
in IPVS box and the client box returns RST to real server IP. I.e.
the result can be 10% broken HTTP traffic if 10% of the time
there are passive FTP connections in connecting state. It hurts
only IPVS connections.

	This patch changes the connection lookup for packets from
clients:

* introduce IP_VS_CONN_F_TEMPLATE connection flag to mark the
connection as template
* create new connection lookup function just for templates - ip_vs_ct_in_get
* make sure ip_vs_conn_in_get hits only connections with
IP_VS_CONN_F_NO_CPORT flag set when s_port is 0. By this way
we avoid returning template when looking for cport=0 (ftp)

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Chris Wright <chrisw@osdl.org>
---
 include/net/ip_vs.h        |    3 +++
 net/ipv4/ipvs/ip_vs_conn.c |   41 ++++++++++++++++++++++++++++++++++++++---
 net/ipv4/ipvs/ip_vs_core.c |   16 ++++++++--------
 net/ipv4/ipvs/ip_vs_sync.c |   20 ++++++++++++++------
 4 files changed, 63 insertions(+), 17 deletions(-)

Index: linux-2.6.13.y/include/net/ip_vs.h
===================================================================
--- linux-2.6.13.y.orig/include/net/ip_vs.h
+++ linux-2.6.13.y/include/net/ip_vs.h
@@ -84,6 +84,7 @@
 #define IP_VS_CONN_F_IN_SEQ	0x0400		/* must do input seq adjust */
 #define IP_VS_CONN_F_SEQ_MASK	0x0600		/* in/out sequence mask */
 #define IP_VS_CONN_F_NO_CPORT	0x0800		/* no client port set yet */
+#define IP_VS_CONN_F_TEMPLATE	0x1000		/* template, not connection */
 
 /* Move it to better place one day, for now keep it unique */
 #define NFC_IPVS_PROPERTY	0x10000
@@ -740,6 +741,8 @@ enum {
 
 extern struct ip_vs_conn *ip_vs_conn_in_get
 (int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port);
+extern struct ip_vs_conn *ip_vs_ct_in_get
+(int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port);
 extern struct ip_vs_conn *ip_vs_conn_out_get
 (int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port);
 
Index: linux-2.6.13.y/net/ipv4/ipvs/ip_vs_conn.c
===================================================================
--- linux-2.6.13.y.orig/net/ipv4/ipvs/ip_vs_conn.c
+++ linux-2.6.13.y/net/ipv4/ipvs/ip_vs_conn.c
@@ -196,6 +196,7 @@ static inline struct ip_vs_conn *__ip_vs
 	list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
 		if (s_addr==cp->caddr && s_port==cp->cport &&
 		    d_port==cp->vport && d_addr==cp->vaddr &&
+		    ((!s_port) ^ (!(cp->flags & IP_VS_CONN_F_NO_CPORT))) &&
 		    protocol==cp->protocol) {
 			/* HIT */
 			atomic_inc(&cp->refcnt);
@@ -227,6 +228,40 @@ struct ip_vs_conn *ip_vs_conn_in_get
 	return cp;
 }
 
+/* Get reference to connection template */
+struct ip_vs_conn *ip_vs_ct_in_get
+(int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port)
+{
+	unsigned hash;
+	struct ip_vs_conn *cp;
+
+	hash = ip_vs_conn_hashkey(protocol, s_addr, s_port);
+
+	ct_read_lock(hash);
+
+	list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
+		if (s_addr==cp->caddr && s_port==cp->cport &&
+		    d_port==cp->vport && d_addr==cp->vaddr &&
+		    cp->flags & IP_VS_CONN_F_TEMPLATE &&
+		    protocol==cp->protocol) {
+			/* HIT */
+			atomic_inc(&cp->refcnt);
+			goto out;
+		}
+	}
+	cp = NULL;
+
+  out:
+	ct_read_unlock(hash);
+
+	IP_VS_DBG(7, "template lookup/in %s %u.%u.%u.%u:%d->%u.%u.%u.%u:%d %s\n",
+		  ip_vs_proto_name(protocol),
+		  NIPQUAD(s_addr), ntohs(s_port),
+		  NIPQUAD(d_addr), ntohs(d_port),
+		  cp?"hit":"not hit");
+
+	return cp;
+}
 
 /*
  *  Gets ip_vs_conn associated with supplied parameters in the ip_vs_conn_tab.
@@ -367,7 +402,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
 		  atomic_read(&dest->refcnt));
 
 	/* Update the connection counters */
-	if (cp->cport || (cp->flags & IP_VS_CONN_F_NO_CPORT)) {
+	if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) {
 		/* It is a normal connection, so increase the inactive
 		   connection counter because it is in TCP SYNRECV
 		   state (inactive) or other protocol inacive state */
@@ -406,7 +441,7 @@ static inline void ip_vs_unbind_dest(str
 		  atomic_read(&dest->refcnt));
 
 	/* Update the connection counters */
-	if (cp->cport || (cp->flags & IP_VS_CONN_F_NO_CPORT)) {
+	if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) {
 		/* It is a normal connection, so decrease the inactconns
 		   or activeconns counter */
 		if (cp->flags & IP_VS_CONN_F_INACTIVE) {
@@ -776,7 +811,7 @@ void ip_vs_random_dropentry(void)
 		ct_write_lock_bh(hash);
 
 		list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
-			if (!cp->cport && !(cp->flags & IP_VS_CONN_F_NO_CPORT))
+			if (cp->flags & IP_VS_CONN_F_TEMPLATE)
 				/* connection template */
 				continue;
 
Index: linux-2.6.13.y/net/ipv4/ipvs/ip_vs_core.c
===================================================================
--- linux-2.6.13.y.orig/net/ipv4/ipvs/ip_vs_core.c
+++ linux-2.6.13.y/net/ipv4/ipvs/ip_vs_core.c
@@ -242,10 +242,10 @@ ip_vs_sched_persist(struct ip_vs_service
 	if (ports[1] == svc->port) {
 		/* Check if a template already exists */
 		if (svc->port != FTPPORT)
-			ct = ip_vs_conn_in_get(iph->protocol, snet, 0,
+			ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
 					       iph->daddr, ports[1]);
 		else
-			ct = ip_vs_conn_in_get(iph->protocol, snet, 0,
+			ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
 					       iph->daddr, 0);
 
 		if (!ct || !ip_vs_check_template(ct)) {
@@ -271,14 +271,14 @@ ip_vs_sched_persist(struct ip_vs_service
 						    iph->daddr,
 						    ports[1],
 						    dest->addr, dest->port,
-						    0,
+						    IP_VS_CONN_F_TEMPLATE,
 						    dest);
 			else
 				ct = ip_vs_conn_new(iph->protocol,
 						    snet, 0,
 						    iph->daddr, 0,
 						    dest->addr, 0,
-						    0,
+						    IP_VS_CONN_F_TEMPLATE,
 						    dest);
 			if (ct == NULL)
 				return NULL;
@@ -297,10 +297,10 @@ ip_vs_sched_persist(struct ip_vs_service
 		 * port zero template: <protocol,caddr,0,vaddr,0,daddr,0>
 		 */
 		if (svc->fwmark)
-			ct = ip_vs_conn_in_get(IPPROTO_IP, snet, 0,
+			ct = ip_vs_ct_in_get(IPPROTO_IP, snet, 0,
 					       htonl(svc->fwmark), 0);
 		else
-			ct = ip_vs_conn_in_get(iph->protocol, snet, 0,
+			ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
 					       iph->daddr, 0);
 
 		if (!ct || !ip_vs_check_template(ct)) {
@@ -325,14 +325,14 @@ ip_vs_sched_persist(struct ip_vs_service
 						    snet, 0,
 						    htonl(svc->fwmark), 0,
 						    dest->addr, 0,
-						    0,
+						    IP_VS_CONN_F_TEMPLATE,
 						    dest);
 			else
 				ct = ip_vs_conn_new(iph->protocol,
 						    snet, 0,
 						    iph->daddr, 0,
 						    dest->addr, 0,
-						    0,
+						    IP_VS_CONN_F_TEMPLATE,
 						    dest);
 			if (ct == NULL)
 				return NULL;
Index: linux-2.6.13.y/net/ipv4/ipvs/ip_vs_sync.c
===================================================================
--- linux-2.6.13.y.orig/net/ipv4/ipvs/ip_vs_sync.c
+++ linux-2.6.13.y/net/ipv4/ipvs/ip_vs_sync.c
@@ -297,16 +297,24 @@ static void ip_vs_process_message(const 
 
 	p = (char *)buffer + sizeof(struct ip_vs_sync_mesg);
 	for (i=0; i<m->nr_conns; i++) {
+		unsigned flags;
+
 		s = (struct ip_vs_sync_conn *)p;
-		cp = ip_vs_conn_in_get(s->protocol,
-				       s->caddr, s->cport,
-				       s->vaddr, s->vport);
+		flags = ntohs(s->flags);
+		if (!(flags & IP_VS_CONN_F_TEMPLATE))
+			cp = ip_vs_conn_in_get(s->protocol,
+					       s->caddr, s->cport,
+					       s->vaddr, s->vport);
+		else
+			cp = ip_vs_ct_in_get(s->protocol,
+					       s->caddr, s->cport,
+					       s->vaddr, s->vport);
 		if (!cp) {
 			cp = ip_vs_conn_new(s->protocol,
 					    s->caddr, s->cport,
 					    s->vaddr, s->vport,
 					    s->daddr, s->dport,
-					    ntohs(s->flags), NULL);
+					    flags, NULL);
 			if (!cp) {
 				IP_VS_ERR("ip_vs_conn_new failed\n");
 				return;
@@ -315,11 +323,11 @@ static void ip_vs_process_message(const 
 		} else if (!cp->dest) {
 			/* it is an entry created by the synchronization */
 			cp->state = ntohs(s->state);
-			cp->flags = ntohs(s->flags) | IP_VS_CONN_F_HASHED;
+			cp->flags = flags | IP_VS_CONN_F_HASHED;
 		}	/* Note that we don't touch its state and flags
 			   if it is a normal entry. */
 
-		if (ntohs(s->flags) & IP_VS_CONN_F_SEQ_MASK) {
+		if (flags & IP_VS_CONN_F_SEQ_MASK) {
 			opt = (struct ip_vs_sync_conn_options *)&s[1];
 			memcpy(&cp->in_seq, opt, sizeof(*opt));
 			p += FULL_CONN_SIZE;

--

[PATCH 05/10] [PATCH]: Missing acct/mm calls in compat_do_execve()

[Chris Wright]

[-- Attachment #1: missing-acct-mm-calls-in-compat_do_execve.patch --]
[-- Type: text/plain, Size: 1292 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

As I do periodically, I checked to see how far out of sync
compat_do_execve() has gotten from do_execve().  And as usual there
was some missing stuff in the former.  Perhaps we need some tighter
consolidation of these two routines to make this less likely to happen
in the future.

Anyways, on the success path of compat_do_execve() we forget
to call acct_update_integrals() and update_mem_hiwater(), as
is done in do_execve().

Signed-off-by: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
---
 fs/compat.c |    4 ++++
 1 files changed, 4 insertions(+)

Index: linux-2.6.13.y/fs/compat.c
===================================================================
--- linux-2.6.13.y.orig/fs/compat.c
+++ linux-2.6.13.y/fs/compat.c
@@ -44,6 +44,8 @@
 #include <linux/nfsd/syscall.h>
 #include <linux/personality.h>
 #include <linux/rwsem.h>
+#include <linux/acct.h>
+#include <linux/mm.h>
 
 #include <net/sock.h>		/* siocdevprivate_ioctl */
 
@@ -1567,6 +1569,8 @@ int compat_do_execve(char * filename,
 
 		/* execve success */
 		security_bprm_free(bprm);
+		acct_update_integrals(current);
+		update_mem_hiwater(current);
 		kfree(bprm);
 		return retval;
 	}

--

Re: [PATCH 05/10] [PATCH]: Missing acct/mm calls in compat_do_execve()

[Hugh Dickins]

On Thu, 29 Sep 2005, Chris Wright wrote:

> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> As I do periodically, I checked to see how far out of sync
> compat_do_execve() has gotten from do_execve().  And as usual there
> was some missing stuff in the former.  Perhaps we need some tighter
> consolidation of these two routines to make this less likely to happen
> in the future.
> 
> Anyways, on the success path of compat_do_execve() we forget
> to call acct_update_integrals() and update_mem_hiwater(), as
> is done in do_execve().

The patch is good, but for -stable?  Spelling corrections next?

Hugh

Re: [PATCH 05/10] [PATCH]: Missing acct/mm calls in compat_do_execve()

[Chris Wright]

* Hugh Dickins (hugh@veritas.com) wrote:
> The patch is good, but for -stable?  Spelling corrections next?

Heh, I think you've got a good point.  This one doesn't have any real
nasty side-effects that I can see.  David do you have objections to
dropping this one from -stable?

thanks,
-chris

Re: [PATCH 05/10] [PATCH]: Missing acct/mm calls in compat_do_execve()

[David S. Miller]

From: Chris Wright <chrisw@osdl.org>
Date: Fri, 30 Sep 2005 14:24:06 -0700

> * Hugh Dickins (hugh@veritas.com) wrote:
> > The patch is good, but for -stable?  Spelling corrections next?
> 
> Heh, I think you've got a good point.  This one doesn't have any real
> nasty side-effects that I can see.  David do you have objections to
> dropping this one from -stable?

No objections, you can drop it.

[PATCH 06/10] [PATCH] uml - Fix x86_64 page leak

[Chris Wright]

[-- Attachment #1: uml-fix-x86_64-page-leak.patch --]
[-- Type: text/plain, Size: 3595 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

We were leaking pmd pages when 3_LEVEL_PGTABLES was enabled. This fixes that,
has been well tested and is included in mainline tree. Please include in -stable
as well.

Signed-off-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Signed-off-by: Chris Wright <chrisw@osdl.org>
---
 arch/um/kernel/skas/include/mmu-skas.h |    4 ++++
 arch/um/kernel/skas/mmu.c              |    9 ++++++++-
 include/asm-um/pgalloc.h               |   12 +++++++-----
 include/asm-um/pgtable-3level.h        |    9 +++------
 4 files changed, 22 insertions(+), 12 deletions(-)

Index: linux-2.6.13.y/arch/um/kernel/skas/include/mmu-skas.h
===================================================================
--- linux-2.6.13.y.orig/arch/um/kernel/skas/include/mmu-skas.h
+++ linux-2.6.13.y/arch/um/kernel/skas/include/mmu-skas.h
@@ -6,11 +6,15 @@
 #ifndef __SKAS_MMU_H
 #define __SKAS_MMU_H
 
+#include "linux/config.h"
 #include "mm_id.h"
 
 struct mmu_context_skas {
 	struct mm_id id;
         unsigned long last_page_table;
+#ifdef CONFIG_3_LEVEL_PGTABLES
+        unsigned long last_pmd;
+#endif
 };
 
 extern void switch_mm_skas(struct mm_id * mm_idp);
Index: linux-2.6.13.y/arch/um/kernel/skas/mmu.c
===================================================================
--- linux-2.6.13.y.orig/arch/um/kernel/skas/mmu.c
+++ linux-2.6.13.y/arch/um/kernel/skas/mmu.c
@@ -56,6 +56,9 @@ static int init_stub_pte(struct mm_struc
 	 */
 
         mm->context.skas.last_page_table = pmd_page_kernel(*pmd);
+#ifdef CONFIG_3_LEVEL_PGTABLES
+        mm->context.skas.last_pmd = (unsigned long) __va(pud_val(*pud));
+#endif
 
 	*pte = mk_pte(virt_to_page(kernel), __pgprot(_PAGE_PRESENT));
 	*pte = pte_mkexec(*pte);
@@ -140,6 +143,10 @@ void destroy_context_skas(struct mm_stru
 	else {
 		os_kill_ptraced_process(mmu->id.u.pid, 1);
 		free_page(mmu->id.stack);
-		free_page(mmu->last_page_table);
+		pte_free_kernel((pte_t *) mmu->last_page_table);
+		dec_page_state(nr_page_table_pages);
+#ifdef CONFIG_3_LEVEL_PGTABLES
+		pmd_free((pmd_t *) mmu->last_pmd);
+#endif
 	}
 }
Index: linux-2.6.13.y/include/asm-um/pgalloc.h
===================================================================
--- linux-2.6.13.y.orig/include/asm-um/pgalloc.h
+++ linux-2.6.13.y/include/asm-um/pgalloc.h
@@ -42,11 +42,13 @@ static inline void pte_free(struct page 
 #define __pte_free_tlb(tlb,pte) tlb_remove_page((tlb),(pte))
 
 #ifdef CONFIG_3_LEVEL_PGTABLES
-/*
- * In the 3-level case we free the pmds as part of the pgd.
- */
-#define pmd_free(x)			do { } while (0)
-#define __pmd_free_tlb(tlb,x)		do { } while (0)
+
+extern __inline__ void pmd_free(pmd_t *pmd)
+{
+	free_page((unsigned long)pmd);
+}
+
+#define __pmd_free_tlb(tlb,x)   tlb_remove_page((tlb),virt_to_page(x))
 #endif
 
 #define check_pgt_cache()	do { } while (0)
Index: linux-2.6.13.y/include/asm-um/pgtable-3level.h
===================================================================
--- linux-2.6.13.y.orig/include/asm-um/pgtable-3level.h
+++ linux-2.6.13.y/include/asm-um/pgtable-3level.h
@@ -98,14 +98,11 @@ static inline pmd_t *pmd_alloc_one(struc
         return pmd;
 }
 
-static inline void pmd_free(pmd_t *pmd){
-	free_page((unsigned long) pmd);
+extern inline void pud_clear (pud_t *pud)
+{
+        set_pud(pud, __pud(0));
 }
 
-#define __pmd_free_tlb(tlb,x)   do { } while (0)
-
-static inline void pud_clear (pud_t * pud) { }
-
 #define pud_page(pud) \
 	((struct page *) __va(pud_val(pud) & PAGE_MASK))
 

--

[PATCH 07/10] [PATCH] check connect(2) status for IPv6 UDP socket

[Chris Wright]

[-- Attachment #1: check-connect-status-for-IPv6-UDP-socket.patch --]
[-- Type: text/plain, Size: 1783 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

I think we should cache the per-socket route(dst_entry) only when the
IPv6 UDP socket is connect(2)'ed.
(which is same as IPv4 UDP send behavior)

Signed-off-by: Mitsuru KANDA <mk@linux-ipv6.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
---
 net/ipv6/udp.c |   10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

Index: linux-2.6.13.y/net/ipv6/udp.c
===================================================================
--- linux-2.6.13.y.orig/net/ipv6/udp.c
+++ linux-2.6.13.y/net/ipv6/udp.c
@@ -638,6 +638,7 @@ static int udpv6_sendmsg(struct kiocb *i
 	int hlimit = -1;
 	int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
 	int err;
+	int connected = 0;
 
 	/* destination address check */
 	if (sin6) {
@@ -747,6 +748,7 @@ do_udp_sendmsg:
 		fl->fl_ip_dport = inet->dport;
 		daddr = &np->daddr;
 		fl->fl6_flowlabel = np->flow_label;
+		connected = 1;
 	}
 
 	if (!fl->oif)
@@ -769,6 +771,7 @@ do_udp_sendmsg:
 		}
 		if (!(opt->opt_nflen|opt->opt_flen))
 			opt = NULL;
+		connected = 0;
 	}
 	if (opt == NULL)
 		opt = np->opt;
@@ -787,10 +790,13 @@ do_udp_sendmsg:
 		ipv6_addr_copy(&final, &fl->fl6_dst);
 		ipv6_addr_copy(&fl->fl6_dst, rt0->addr);
 		final_p = &final;
+		connected = 0;
 	}
 
-	if (!fl->oif && ipv6_addr_is_multicast(&fl->fl6_dst))
+	if (!fl->oif && ipv6_addr_is_multicast(&fl->fl6_dst)) {
 		fl->oif = np->mcast_oif;
+		connected = 0;
+	}
 
 	err = ip6_dst_lookup(sk, &dst, fl);
 	if (err)
@@ -841,7 +847,7 @@ do_append_data:
 	else if (!corkreq)
 		err = udp_v6_push_pending_frames(sk, up);
 
-	if (dst)
+	if (dst&&connected)
 		ip6_dst_store(sk, dst,
 			      ipv6_addr_equal(&fl->fl6_dst, &np->daddr) ?
 			      &np->daddr : NULL);

--

Re: [PATCH 07/10] [PATCH] check connect(2) status for IPv6 UDP socket

[Chuck Wolber]

On Thu, 29 Sep 2005, Chris Wright wrote:

> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> I think we should cache the per-socket route(dst_entry) only when the 
> IPv6 UDP socket is connect(2)'ed. (which is same as IPv4 UDP send 
> behavior)
> 
> Signed-off-by: Mitsuru KANDA <mk@linux-ipv6.org>
> Signed-off-by: Chris Wright <chrisw@osdl.org>
> ---

%< Snip %<


Does this really qualify as a necessary bug fix?

..Chuck..


-- 
http://www.quantumlinux.com
 Quantum Linux Laboratories, LLC.
 ACCELERATING Business with Open Technology

 "The measure of the restoration lies in the extent to which we apply
  social values more noble than mere monetary profit." - FDR

Re: [PATCH 07/10] [PATCH] check connect(2) status for IPv6 UDP socket

[David S. Miller]

From: Chuck Wolber <chuckw@quantumlinux.com>
Date: Thu, 29 Sep 2005 23:25:14 -0700 (PDT)

> Does this really qualify as a necessary bug fix?

Yes.  Without this unconnected ipv6 UDP sockets end up using the wrong
route or IPSEC path.

Re: [PATCH 07/10] [PATCH] check connect(2) status for IPv6 UDP socket

[Mitsuru KANDA / 神田 充]

Sorry for log silence, I was on a business trip in last week.

I recreate a patch (of course, which have been tested) ASAP.

At Fri, 30 Sep 2005 00:10:25 -0700 (PDT),
"David S. Miller" <davem@davemloft.net> wrote:
> 
> From: Chuck Wolber <chuckw@quantumlinux.com>
> Date: Thu, 29 Sep 2005 23:25:14 -0700 (PDT)
> 
> > Does this really qualify as a necessary bug fix?
> 
> Yes.  Without this unconnected ipv6 UDP sockets end up using the wrong
> route or IPSEC path.

Re: [PATCH 07/10] [PATCH] check connect(2) status for IPv6 UDP socket

[Chris Wright]

* Mitsuru KANDA / 神田 充 (mk@karaba.org) wrote:
> Sorry for log silence, I was on a business trip in last week.
> 
> I recreate a patch (of course, which have been tested) ASAP.

BTW, we dropped this one, since it had possible leak in it.  I'll let
you and DaveM decide when the updated one is ready for -stable.

thanks,
-chris

Re: [PATCH 07/10] [PATCH] check connect(2) status for IPv6 UDP socket

[David S. Miller]

From: Chris Wright <chrisw@osdl.org>
Date: Wed, 5 Oct 2005 12:00:59 -0700

> * Mitsuru KANDA (mk@karaba.org) wrote:
> > Sorry for log silence, I was on a business trip in last week.
> > 
> > I recreate a patch (of course, which have been tested) ASAP.
> 
> BTW, we dropped this one, since it had possible leak in it.  I'll let
> you and DaveM decide when the updated one is ready for -stable.

Will do, thanks Chris.

[PATCH 08/10] [PATCH] skge: set mac address oops with bonding

[Chris Wright]

[-- Attachment #1: skge-set-mac-address-oops-with-bonding.patch --]
[-- Type: text/plain, Size: 1907 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

Here is the patch (fuzz removed) for 2.6.13.2 that fixes
OOPs when using bonding with skge.

Skge driver was bringing link up/down when changing mac
address.  This doesn't work in the bonding environment, and is
more effort than needed.

Fixes-bug: http://bugzilla.kernel.org/show_bug.cgi?id=5271
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Sigend-off-by: Chris Wright <chrisw@osdl.org>
---
 drivers/net/skge.c |   24 ++++++++++++++++--------
 1 files changed, 16 insertions(+), 8 deletions(-)

Index: linux-2.6.13.y/drivers/net/skge.c
===================================================================
--- linux-2.6.13.y.orig/drivers/net/skge.c
+++ linux-2.6.13.y/drivers/net/skge.c
@@ -2828,21 +2828,29 @@ static void skge_netpoll(struct net_devi
 static int skge_set_mac_address(struct net_device *dev, void *p)
 {
 	struct skge_port *skge = netdev_priv(dev);
-	struct sockaddr *addr = p;
-	int err = 0;
+	struct skge_hw *hw = skge->hw;
+	unsigned port = skge->port;
+	const struct sockaddr *addr = p;
 
 	if (!is_valid_ether_addr(addr->sa_data))
 		return -EADDRNOTAVAIL;
 
-	skge_down(dev);
+	spin_lock_bh(&hw->phy_lock);
 	memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
-	memcpy_toio(skge->hw->regs + B2_MAC_1 + skge->port*8,
+	memcpy_toio(hw->regs + B2_MAC_1 + port*8,
 		    dev->dev_addr, ETH_ALEN);
-	memcpy_toio(skge->hw->regs + B2_MAC_2 + skge->port*8,
+	memcpy_toio(hw->regs + B2_MAC_2 + port*8,
 		    dev->dev_addr, ETH_ALEN);
-	if (dev->flags & IFF_UP)
-		err = skge_up(dev);
-	return err;
+
+	if (hw->chip_id == CHIP_ID_GENESIS)
+		xm_outaddr(hw, port, XM_SA, dev->dev_addr);
+	else {
+		gma_set_addr(hw, port, GM_SRC_ADDR_1L, dev->dev_addr);
+		gma_set_addr(hw, port, GM_SRC_ADDR_2L, dev->dev_addr);
+	}
+	spin_unlock_bh(&hw->phy_lock);
+
+	return 0;
 }
 
 static const struct {

--

[PATCH 09/10] [PATCH] tcp: set default congestion control correctly for incoming connections

[Chris Wright]

[-- Attachment #1: tcp-set-default-congestion-control-correctly.patch --]
[-- Type: text/plain, Size: 1197 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

Patch from Joel Sing to fix the default congestion control algorithm for incoming connections. If a new congestion control handler is added (via module),
it should become the default for new connections. Instead, the incoming
connections use reno. The cause is incorrect 
initialisation causes the tcp_init_congestion_control() function to return 
after the initial if test fails.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Acked-by: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
---
 net/ipv4/tcp_minisocks.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

Index: linux-2.6.13.y/net/ipv4/tcp_minisocks.c
===================================================================
--- linux-2.6.13.y.orig/net/ipv4/tcp_minisocks.c
+++ linux-2.6.13.y/net/ipv4/tcp_minisocks.c
@@ -774,7 +774,7 @@ struct sock *tcp_create_openreq_child(st
 		newtp->frto_counter = 0;
 		newtp->frto_highmark = 0;
 
-		newtp->ca_ops = &tcp_reno;
+		newtp->ca_ops = &tcp_init_congestion_ops;
 
 		tcp_set_ca_state(newtp, TCP_CA_Open);
 		tcp_init_xmit_timers(newsk);

--

[PATCH 10/10] [TCP]: Dont over-clamp window in tcp_clamp_window()

[Chris Wright]

[-- Attachment #1: tcp-dont-over-clamp-window-in-tcp_clamp_window.patch --]
[-- Type: text/plain, Size: 1676 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

Handle better the case where the sender sends full sized
frames initially, then moves to a mode where it trickles
out small amounts of data at a time.

This known problem is even mentioned in the comments
above tcp_grow_window() in tcp_input.c, specifically:

..
 * The scheme does not work when sender sends good segments opening
 * window and then starts to feed us spagetti. But it should work
 * in common situations. Otherwise, we have to rely on queue collapsing.
..

When the sender gives full sized frames, the "struct sk_buff" overhead
from each packet is small.  So we'll advertize a larger window.
If the sender moves to a mode where small segments are sent, this
ratio becomes tilted to the other extreme and we start overrunning
the socket buffer space.

tcp_clamp_window() tries to address this, but it's clamping of
tp->window_clamp is a wee bit too aggressive for this particular case.

Fix confirmed by Ion Badulescu.

Signed-off-by: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
---
 net/ipv4/tcp_input.c |    2 --
 1 files changed, 2 deletions(-)

Index: linux-2.6.13.y/net/ipv4/tcp_input.c
===================================================================
--- linux-2.6.13.y.orig/net/ipv4/tcp_input.c
+++ linux-2.6.13.y/net/ipv4/tcp_input.c
@@ -350,8 +350,6 @@ static void tcp_clamp_window(struct sock
 			app_win -= tp->ack.rcv_mss;
 		app_win = max(app_win, 2U*tp->advmss);
 
-		if (!ofo_win)
-			tp->window_clamp = min(tp->window_clamp, app_win);
 		tp->rcv_ssthresh = min(tp->window_clamp, 2U*tp->advmss);
 	}
 }

--