add open 2.6.16.32 fixes

svn path=/dists/sid/linux-2.6/; revision=8049

debian/changelog

@@ -51,6 +51,9 @@ linux-2.6 (2.6.18-9) UNRELEASED; urgency=low
   * Hand-picked from stable release 2.6.16.31:
     - [NETFILTER]: Fix ip6_tables extension header bypass bug (CVE-2006-4572)
     - fix RARP ic_servaddr breakage
+  * Hand-picked from stable release 2.6.16.32:
+    - drivers/telephony/ixj: fix an array overrun
+    - flush D-cache in failure path
   * Hand-picked from stable release 2.6.16.33:
     - Add new PHY to sis900 supported list
     - ipmi_si_intf.c: fix "&& 0xff" typos
@@ -80,7 +83,7 @@ linux-2.6 (2.6.18-9) UNRELEASED; urgency=low
     - softirq: remove BUG_ONs which can incorrectly trigger
     - Fix SUNRPC wakeup/execute race condition
 
- -- maximilian attems <maks@sternwelten.at>  Fri, 29 Dec 2006 00:22:43 +0100
+ -- maximilian attems <maks@sternwelten.at>  Fri, 29 Dec 2006 00:33:09 +0100
 
 linux-2.6 (2.6.18-8) unstable; urgency=low
 

debian/patches/bugfix/2.6.16.32

@@ -0,0 +1,25 @@
+diff --git a/drivers/telephony/ixj.h b/drivers/telephony/ixj.h
+index fbea454..8d69bcd 100644
+--- a/drivers/telephony/ixj.h
++++ b/drivers/telephony/ixj.h
+@@ -1295,7 +1295,7 @@ typedef struct {
+ 	Proc_Info_Type Info_write;
+ 	unsigned short frame_count;
+ 	unsigned int filter_hist[4];
+-	unsigned char filter_en[4];
++	unsigned char filter_en[6];
+ 	unsigned short proc_load;
+ 	unsigned long framesread;
+ 	unsigned long frameswritten;
+diff --git a/mm/memory.c b/mm/memory.c
+index 85e80a5..a4caa2f 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1429,6 +1429,7 @@ static inline void cow_user_page(struct
+ 		if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE))
+ 			memset(kaddr, 0, PAGE_SIZE);
+ 		kunmap_atomic(kaddr, KM_USER0);
++		flush_dcache_page(dst);
+ 		return;
+
+ 	}

debian/patches/series/9

@@ -18,6 +18,7 @@
 + bugfix/mincore-typo.patch
 + bugfix/2.6.16.30
 + bugfix/2.6.16.31
++ bugfix/2.6.16.32
 + bugfix/2.6.16.33
 + bugfix/2.6.16.34
 + bugfix/2.6.16.35