.32 patches

5 files changed, 215 insertions, 0 deletions

diff --git a/queue-2.6.32/fix-duplicate-removal-on-error-path-in.patch b/queue-2.6.32/fix-duplicate-removal-on-error-path-in.patch
new file mode 100644
index 0000000..6691376
--- /dev/null
+++ b/queue-2.6.32/fix-duplicate-removal-on-error-path-in.patch
@@ -0,0 +1,86 @@
+From ee37e09d81a4acf328f68189af12f116401f8c0f Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 12 Feb 2010 12:13:55 -0500
+Subject: [SCSI] fix duplicate removal on error path in
+ scsi_sysfs_add_sdev
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit ee37e09d81a4acf328f68189af12f116401f8c0f upstream.
+
+This patch (as1335) fixes a bug in scsi_sysfs_add_sdev().  Its callers
+always remove the device if anything goes wrong, so it should never
+remove the device.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_sysfs.c |   18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -838,7 +838,8 @@ int scsi_sysfs_add_sdev(struct scsi_devi
+ 	struct request_queue *rq = sdev->request_queue;
+ 	struct scsi_target *starget = sdev->sdev_target;
+ 
+-	if ((error = scsi_device_set_state(sdev, SDEV_RUNNING)) != 0)
++	error = scsi_device_set_state(sdev, SDEV_RUNNING);
++	if (error)
+ 		return error;
+ 
+ 	error = scsi_target_add(starget);
+@@ -849,13 +850,13 @@ int scsi_sysfs_add_sdev(struct scsi_devi
+ 	error = device_add(&sdev->sdev_gendev);
+ 	if (error) {
+ 		printk(KERN_INFO "error 1\n");
+-		goto out_remove;
++		return error;
+ 	}
+ 	error = device_add(&sdev->sdev_dev);
+ 	if (error) {
+ 		printk(KERN_INFO "error 2\n");
+ 		device_del(&sdev->sdev_gendev);
+-		goto out_remove;
++		return error;
+ 	}
+ 	transport_add_device(&sdev->sdev_gendev);
+ 	sdev->is_visible = 1;
+@@ -866,14 +867,14 @@ int scsi_sysfs_add_sdev(struct scsi_devi
+ 	else
+ 		error = device_create_file(&sdev->sdev_gendev, &dev_attr_queue_depth);
+ 	if (error)
+-		goto out_remove;
++		return error;
+ 
+ 	if (sdev->host->hostt->change_queue_type)
+ 		error = device_create_file(&sdev->sdev_gendev, &sdev_attr_queue_type_rw);
+ 	else
+ 		error = device_create_file(&sdev->sdev_gendev, &dev_attr_queue_type);
+ 	if (error)
+-		goto out_remove;
++		return error;
+ 
+ 	error = bsg_register_queue(rq, &sdev->sdev_gendev, NULL, NULL);
+ 
+@@ -889,16 +890,11 @@ int scsi_sysfs_add_sdev(struct scsi_devi
+ 			error = device_create_file(&sdev->sdev_gendev,
+ 					sdev->host->hostt->sdev_attrs[i]);
+ 			if (error)
+-				goto out_remove;
++				return error;
+ 		}
+ 	}
+ 
+-	return 0;
+-
+- out_remove:
+-	__scsi_remove_device(sdev);
+ 	return error;
+-
+ }
+ 
+ void __scsi_remove_device(struct scsi_device *sdev)
diff --git a/queue-2.6.32/fix-memory-leak-in-scsi_report_lun_scan.patch b/queue-2.6.32/fix-memory-leak-in-scsi_report_lun_scan.patch
new file mode 100644
index 0000000..25a9055
--- /dev/null
+++ b/queue-2.6.32/fix-memory-leak-in-scsi_report_lun_scan.patch
@@ -0,0 +1,35 @@
+From 75f8ee8e01a6c96652f27da40d4bdac9e2e485f0 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 12 Feb 2010 12:13:31 -0500
+Subject: [SCSI] fix memory leak in scsi_report_lun_scan
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 75f8ee8e01a6c96652f27da40d4bdac9e2e485f0 upstream.
+
+This patch (as1333) fixes a bug in scsi_report_lun_scan().  If a
+newly-allocated device can't be used, it should be deleted.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_scan.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -1336,8 +1336,10 @@ static int scsi_report_lun_scan(struct s
+ 		sdev = scsi_alloc_sdev(starget, 0, NULL);
+ 		if (!sdev)
+ 			return 0;
+-		if (scsi_device_get(sdev))
++		if (scsi_device_get(sdev)) {
++			__scsi_remove_device(sdev);
+ 			return 0;
++		}
+ 	}
+ 
+ 	sprintf(devname, "host %d channel %d id %d",
diff --git a/queue-2.6.32/fix-refcounting-bug-in-scsi_get_host_dev.patch b/queue-2.6.32/fix-refcounting-bug-in-scsi_get_host_dev.patch
new file mode 100644
index 0000000..7415a64
--- /dev/null
+++ b/queue-2.6.32/fix-refcounting-bug-in-scsi_get_host_dev.patch
@@ -0,0 +1,36 @@
+From d5469119f0098881ab7f991990ef4f81ef13a194 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 12 Feb 2010 12:13:39 -0500
+Subject: [SCSI] fix refcounting bug in scsi_get_host_dev
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit d5469119f0098881ab7f991990ef4f81ef13a194 upstream.
+
+This patch (as1334) fixes a bug in scsi_get_host_dev().  It
+incorrectly calls get_device() on the new device's target.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_scan.c |    5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -1906,10 +1906,9 @@ struct scsi_device *scsi_get_host_dev(st
+ 		goto out;
+ 
+ 	sdev = scsi_alloc_sdev(starget, 0, NULL);
+-	if (sdev) {
+-		sdev->sdev_gendev.parent = get_device(&starget->dev);
++	if (sdev)
+ 		sdev->borken = 0;
+-	} else
++	else
+ 		scsi_target_reap(starget);
+ 	put_device(&starget->dev);
+  out:
diff --git a/queue-2.6.32/netfilter-nf_conntrack_reasm-properly-handle-packets.patch b/queue-2.6.32/netfilter-nf_conntrack_reasm-properly-handle-packets.patch
new file mode 100644
index 0000000..7ea9a4b
--- /dev/null
+++ b/queue-2.6.32/netfilter-nf_conntrack_reasm-properly-handle-packets.patch
@@ -0,0 +1,54 @@
+From 9e2dcf72023d1447f09c47d77c99b0c49659e5ce Mon Sep 17 00:00:00 2001
+From: Patrick McHardy <kaber@trash.net>
+Date: Fri, 19 Feb 2010 18:18:37 +0100
+Subject: netfilter: nf_conntrack_reasm: properly handle packets
+ fragmented into a single fragment
+
+From: Patrick McHardy <kaber@trash.net>
+
+commit 9e2dcf72023d1447f09c47d77c99b0c49659e5ce upstream.
+
+When an ICMPV6_PKT_TOOBIG message is received with a MTU below 1280,
+all further packets include a fragment header.
+
+Unlike regular defragmentation, conntrack also needs to "reassemble"
+those fragments in order to obtain a packet without the fragment
+header for connection tracking. Currently nf_conntrack_reasm checks
+whether a fragment has either IP6_MF set or an offset != 0, which
+makes it ignore those fragments.
+
+Remove the invalid check and make reassembly handle fragment queues
+containing only a single fragment.
+
+Reported-and-tested-by: Ulrich Weber <uweber@astaro.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/netfilter/nf_conntrack_reasm.c |    8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -474,7 +474,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_que
+ 
+ 	/* all original skbs are linked into the NFCT_FRAG6_CB(head).orig */
+ 	fp = skb_shinfo(head)->frag_list;
+-	if (NFCT_FRAG6_CB(fp)->orig == NULL)
++	if (fp && NFCT_FRAG6_CB(fp)->orig == NULL)
+ 		/* at above code, head skb is divided into two skbs. */
+ 		fp = fp->next;
+ 
+@@ -600,12 +600,6 @@ struct sk_buff *nf_ct_frag6_gather(struc
+ 	hdr = ipv6_hdr(clone);
+ 	fhdr = (struct frag_hdr *)skb_transport_header(clone);
+ 
+-	if (!(fhdr->frag_off & htons(0xFFF9))) {
+-		pr_debug("Invalid fragment offset\n");
+-		/* It is not a fragmented frame */
+-		goto ret_orig;
+-	}
+-
+ 	if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh)
+ 		nf_ct_frag6_evictor();
+ 
diff --git a/queue-2.6.32/series b/queue-2.6.32/series
index a72725a..092a16f 100644
--- a/queue-2.6.32/series
+++ b/queue-2.6.32/series
@@ -48,3 +48,7 @@ brd-handle-on-demand-devices-correctly.patch
 sunrpc-deal-with-the-lack-of-a-syn_sent-sk-sk_state_change.patch
 pci-add-quirk-for-setting-valid-class-for-ti816x-endpoint.patch
 xen-mmu-fix-a-race-window-causing-leave_mm-bug.patch
+netfilter-nf_conntrack_reasm-properly-handle-packets.patch
+fix-memory-leak-in-scsi_report_lun_scan.patch
+fix-refcounting-bug-in-scsi_get_host_dev.patch
+fix-duplicate-removal-on-error-path-in.patch