.33 patches
diff --git a/queue-2.6.33/gro-fix-different-skb-headrooms.patch b/queue-2.6.33/gro-fix-different-skb-headrooms.patch
new file mode 100644
index 0000000..f7b0edf
--- /dev/null
+++ b/queue-2.6.33/gro-fix-different-skb-headrooms.patch
@@ -0,0 +1,69 @@
+From 3d3be4333fdf6faa080947b331a6a19bce1a4f57 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Wed, 1 Sep 2010 00:50:51 +0000
+Subject: gro: fix different skb headrooms
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit 3d3be4333fdf6faa080947b331a6a19bce1a4f57 upstream.
+
+Packets entering GRO might have different headrooms, even for a given
+flow (because of implementation details in drivers, like copybreak).
+We cant force drivers to deliver packets with a fixed headroom.
+
+1) fix skb_segment()
+
+skb_segment() makes the false assumption headrooms of fragments are same
+than the head. When CHECKSUM_PARTIAL is used, this can give csum_start
+errors, and crash later in skb_copy_and_csum_dev()
+
+2) allocate a minimal skb for head of frag_list
+
+skb_gro_receive() uses netdev_alloc_skb(headroom + skb_gro_offset(p)) to
+allocate a fresh skb. This adds NET_SKB_PAD to a padding already
+provided by netdevice, depending on various things, like copybreak.
+
+Use alloc_skb() to allocate an exact padding, to reduce cache line
+needs:
+NET_SKB_PAD + NET_IP_ALIGN
+
+bugzilla : https://bugzilla.kernel.org/show_bug.cgi?id=16626
+
+Many thanks to Plamen Petrov, testing many debugging patches !
+With help of Jarek Poplawski.
+
+Reported-by: Plamen Petrov <pvp-lsts@fs.uni-ruse.bg>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+CC: Jarek Poplawski <jarkao2@gmail.com>
+Cc: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/skbuff.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2578,6 +2578,10 @@ struct sk_buff *skb_segment(struct sk_bu
+ __copy_skb_header(nskb, skb);
+ nskb->mac_len = skb->mac_len;
+
++ /* nskb and skb might have different headroom */
++ if (nskb->ip_summed == CHECKSUM_PARTIAL)
++ nskb->csum_start += skb_headroom(nskb) - headroom;
++
+ skb_reset_mac_header(nskb);
+ skb_set_network_header(nskb, skb->mac_len);
+ nskb->transport_header = (nskb->network_header +
+@@ -2707,8 +2711,8 @@ int skb_gro_receive(struct sk_buff **hea
+ } else if (skb_gro_len(p) != pinfo->gso_size)
+ return -E2BIG;
+
+- headroom = skb_headroom(p);
+- nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
++ headroom = NET_SKB_PAD + NET_IP_ALIGN;
++ nskb = alloc_skb(headroom + skb_gro_offset(p), GFP_ATOMIC);
+ if (unlikely(!nskb))
+ return -ENOMEM;
+
diff --git a/queue-2.6.33/gro-re-fix-different-skb-headrooms.patch b/queue-2.6.33/gro-re-fix-different-skb-headrooms.patch
new file mode 100644
index 0000000..322dc0d
--- /dev/null
+++ b/queue-2.6.33/gro-re-fix-different-skb-headrooms.patch
@@ -0,0 +1,45 @@
+From 64289c8e6851bca0e589e064c9a5c9fbd6ae5dd4 Mon Sep 17 00:00:00 2001
+From: Jarek Poplawski <jarkao2@gmail.com>
+Date: Sat, 4 Sep 2010 10:34:29 +0000
+Subject: gro: Re-fix different skb headrooms
+
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+commit 64289c8e6851bca0e589e064c9a5c9fbd6ae5dd4 upstream.
+
+The patch: "gro: fix different skb headrooms" in its part:
+"2) allocate a minimal skb for head of frag_list" is buggy. The copied
+skb has p->data set at the ip header at the moment, and skb_gro_offset
+is the length of ip + tcp headers. So, after the change the length of
+mac header is skipped. Later skb_set_mac_header() sets it into the
+NET_SKB_PAD area (if it's long enough) and ip header is misaligned at
+NET_SKB_PAD + NET_IP_ALIGN offset. There is no reason to assume the
+original skb was wrongly allocated, so let's copy it as it was.
+
+bugzilla : https://bugzilla.kernel.org/show_bug.cgi?id=16626
+fixes commit: 3d3be4333fdf6faa080947b331a6a19bce1a4f57
+
+Reported-by: Plamen Petrov <pvp-lsts@fs.uni-ruse.bg>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+CC: Eric Dumazet <eric.dumazet@gmail.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Tested-by: Plamen Petrov <pvp-lsts@fs.uni-ruse.bg>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/skbuff.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2711,7 +2711,7 @@ int skb_gro_receive(struct sk_buff **hea
+ } else if (skb_gro_len(p) != pinfo->gso_size)
+ return -E2BIG;
+
+- headroom = NET_SKB_PAD + NET_IP_ALIGN;
++ headroom = skb_headroom(p);
+ nskb = alloc_skb(headroom + skb_gro_offset(p), GFP_ATOMIC);
+ if (unlikely(!nskb))
+ return -ENOMEM;
diff --git a/queue-2.6.33/net-fix-a-memmove-bug-in-dev_gro_receive.patch b/queue-2.6.33/net-fix-a-memmove-bug-in-dev_gro_receive.patch
new file mode 100644
index 0000000..0cc8415
--- /dev/null
+++ b/queue-2.6.33/net-fix-a-memmove-bug-in-dev_gro_receive.patch
@@ -0,0 +1,42 @@
+From e5093aec2e6b60c3df2420057ffab9ed4a6d2792 Mon Sep 17 00:00:00 2001
+From: Jarek Poplawski <jarkao2@gmail.com>
+Date: Wed, 11 Aug 2010 02:02:10 +0000
+Subject: net: Fix a memmove bug in dev_gro_receive()
+
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+commit e5093aec2e6b60c3df2420057ffab9ed4a6d2792 upstream.
+
+>Xin Xiaohui wrote:
+> I looked into the code dev_gro_receive(), found the code here:
+> if the frags[0] is pulled to 0, then the page will be released,
+> and memmove() frags left.
+> Is that right? I'm not sure if memmove do right or not, but
+> frags[0].size is never set after memove at least. what I think
+> a simple way is not to do anything if we found frags[0].size == 0.
+> The patch is as followed.
+...
+
+This version of the patch fixes the bug directly in memmove.
+
+Reported-by: "Xin, Xiaohui" <xiaohui.xin@intel.com>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2664,7 +2664,7 @@ pull:
+ put_page(skb_shinfo(skb)->frags[0].page);
+ memmove(skb_shinfo(skb)->frags,
+ skb_shinfo(skb)->frags + 1,
+- --skb_shinfo(skb)->nr_frags);
++ --skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
+ }
+ }
+
diff --git a/queue-2.6.33/series b/queue-2.6.33/series
index 77c19b3..cbeefac 100644
--- a/queue-2.6.33/series
+++ b/queue-2.6.33/series
@@ -83,3 +83,6 @@
uvcvideo-set-alternate-setting-0-on-resume-if-the-bus-has-been-reset.patch
tuner_xc2028-allow-selection-of-the-frequency-adjustment-code-for-xc3028.patch
plat-mxc-iomux-v3.h-implicitly-enable-pull-up-down-when-that-s-desired.patch
+net-fix-a-memmove-bug-in-dev_gro_receive.patch
+gro-fix-different-skb-headrooms.patch
+gro-re-fix-different-skb-headrooms.patch
