This patch contains SELinux changes which add support for extended Netlink
socket classes and the associated permissions nlmsg_read and nlmsg_write.
Signed-off-by: James Morris <jmorris@redhat.com>
Signed-off-by: David S. Miller <davem@redhat.com>

Modifies the LSM netlink_send() hook so that it takes a struct sock
parameter.  SELinux will use this parameter to lookup the class of socket,
which was assigned during socket security initialization.
Signed-off-by: James Morris <jmorris@redhat.com>
Signed-off-by: David S. Miller <davem@redhat.com>

This patch moves the security_netlink_send() LSM hook after the user copy,
so that LSM modules can safely examine skb payload content.  For SELinux,
we need to look at the Netlink message type.
Signed-off-by: James Morris <jmorris@redhat.com>
Signed-off-by: David S. Miller <davem@redhat.com>

This patch regenerates the SELinux module headers to reflect new class
and access vectors definitions.  The size of the diff is misleading;
much of it is simply a change in the ordering of the automatically
generated definitions. The corresponding generation script has been
changed to ensure a stable order in the future.

Author: Stephen Smalley <sds@epoch.ncsc.mil>
Signed-off-by: Stephen Smalley <sds@epoch.ncsc.mil>
Signed-off-by: James Morris <jmorris@redhat.com>
Signed-off-by: David S. Miller <davem@redhat.com>

Author: Anton Blanchard <anton@samba.org>
Signed-off-by: David S. Miller <davem@redhat.com>

We always need to check UDPv6 checksum because it is mandatory.

Author: Yoshifuji Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@redhat.com>

The patch below fixes a race between sock_orphan() and
selinux_socket_sock_rcv_skb() which can lead to a null pointer deref oops
under heavy load.  The sk_callback_lock is used in the patch to 
synchronize access to the incoming socket's inode security state.

This patch has been under test in the Fedora kernel for over a month 
without incident.

Author: Stephen Smalley <sds@epoch.ncsc.mil>
Signed-off-by: James Morris <jmorris@redhat.com>
Signed-off-by: David S. Miller <davem@redhat.com>

into nuts.davemloft.net:/disk1/BK/net-2.6

Signed-off-by: Arnaldo Carvalho de Melo <acme@conectiva.com.br>

into nuts.davemloft.net:/disk1/BK/net-2.6

I ran the following (crappy) script:
 ...
In /proc/sys/ and found a host of undocumented sysctls. This patch documents
a number of them, and at least mentions the rest as 'TODO'. Please verify my
code-inspired documentation before applying!
Signed-off-by: Bert Hubert <ahu@ds9a.nl>
Signed-off-by: David S. Miller <davem@redhat.com>

From: "Siddha, Suresh B" <suresh.b.siddha@intel.com>
From: "Kamble, Nitin A" <nitin.a.kamble@intel.com>

Fix use of uninitialized memory in x86-64 ioremap

This caused BUGs at bootup for some people.

Add proper __user annotation to selinux_shm_shmat.

From: Mika Kukkonen <mika@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Add proper __user annotation to dummy_shm_shmat.
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Add proper __user annotation for shm_shmat hook in security.h.

From: Mika Kukkonen <mika@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Some filesystems can get overflows when their link-count exceeds
65534.  This patch increases the kernels internal resolution for this
and also has a check for the old-system call paths to return and error
(-EOVERFLOW) as required (as suggested by Al Viro).
Signed-off-by: Chris Wedgwood <cw@f00f.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch results in too much idle time under certain
loads, and while that is being looked into we're better
off just reverting the change.

Cset exclude: nickpiggin@yahoo.com.au[torvalds]|ChangeSet|20040605175839|02419

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into kernel.bkbits.net:/home/davem/sparc-2.6

This patch fixes orphaned expectations, which can occur when helpers create
expectations for unconfirmed conntracks and the packet is dropped before
the conntrack is confirmed.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@redhat.com>

Tracked down by Raivis Bucis <raivis@mt.lv>

This patch fixes an oops while listing /proc/net/ip_conntrack.

When a helper sets up expectations based on the first packet (tftp),
NAT can still change the packet and cause conntrack to look for a new helper
based on the new tuple. When no helper is found, expectant->helper will be
NULL, which leads to an oops in print_expect().
 
Only assign a new helper in ip_conntrack_alter_reply() if there are no
expectations.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@redhat.com>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@redhat.com>

[IPV6] IPSEC: fix double kfree_skb() in error path. (reported by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>)
Signed-off-by: Yoshifuji Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@redhat.com>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This fixes build errors in EBSA110, and updates the default
configuration.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

From: Benjamin Herrenschmidt <benh@kernel.crashing.org>

Patch fixes out_be64 implementation on ppc64 along with a glich in out_be32
(inconsistent) use of barrier.
Signed-off-by: Roland Dreier <roland@topspin.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>

Nick changed shrink_cache() to void, but one call was missed.

From: Mika Kukkonen <mika@osdl.org>
Signed-off-by: Randy Dunlap <rddunlap@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Nick Piggin <nickpiggin@yahoo.com.au>

nfs_writepage() refuses to write back mapped pages at all on the page
reclaim path, causing systems to get locked up when there's a lot of dirty
mmapped data around.  The patch changes NFS so that it will start I/O
against these pages.

The code as it stands is designed to defer writeout to pdflush which can do
larger, more efficient I/Os.  But there shouldn't be much traffic by this
path, and going slow is better than not going at all.

Patch originally from Trond.
Signed-off-by: Trond Myklebust <trond.myklebust@fys.uio.no>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

VIA chipsets are broken and don't work with IOMMU enabled. For some mysterious
reason (the IOMMU logic is actually in the CPU) they manage to corrupt all
data going through the aperture to PCI devices.

There was a workaround previously that enabled the slower softmmu when VIA is 
detected on the normal IOMMU path (when there is more than 3GB of memory). But
CONFIG_IOMMU_DEBUG took a short cut that was not handled, which ended up with 
VIA systems not booting when this option is enabled.

This patch enables the workaround with CONFIG_IOMMU_DEBUG/iommu=force too

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into delerium.codemonkey.org.uk:/mnt/data/src/bk/cpufreq

into evo.osdl.org:/home/torvalds/v2.6/linux

Signed-off-by: Ben Collins <bcollins@debian.org>

Signed-off-by: Ben Collins <bcollins@debian.org>

Signed-off-by: Ben Collins <bcollins@debian.org>

Submitted-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Ben Collins <bcollins@debian.org>