)]}' { "log": [ { "commit": "dbf3239455b155c3e72deacda93ef3a041e190c9", "tree": "c7a8cfce370fa0de4cdeaab1b75925061fe9ccf1", "parents": [ "f61eb9ceb26cee3fdbb8c7a4920f171f7661fb4f" ], "author": { "name": "Ying Xue", "email": "ying.xue@windriver.com", "time": "Tue Jul 17 15:03:43 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 13 11:51:19 2014 -0800" }, "message": "sched/rt: Avoid updating RT entry timeout twice within one tick period\n\ncommit 57d2aa00dcec67afa52478730f2b524521af14fb upstream.\n\nThe issue below was found in 2.6.34-rt rather than mainline rt\nkernel, but the issue still exists upstream as well.\n\nSo please let me describe how it was noticed on 2.6.34-rt:\n\nOn this version, each softirq has its own thread, it means there\nis at least one RT FIFO task per cpu. The priority of these\ntasks is set to 49 by default. If user launches an RT FIFO task\nwith priority lower than 49 of softirq RT tasks, it\u0027s possible\nthere are two RT FIFO tasks enqueued one cpu runqueue at one\nmoment. By current strategy of balancing RT tasks, when it comes\nto RT tasks, we really need to put them off to a CPU that they\ncan run on as soon as possible. Even if it means a bit of cache\nline flushing, we want RT tasks to be run with the least latency.\n\nWhen the user RT FIFO task which just launched before is\nrunning, the sched timer tick of the current cpu happens. In this\ntick period, the timeout value of the user RT task will be\nupdated once. Subsequently, we try to wake up one softirq RT\ntask on its local cpu. As the priority of current user RT task\nis lower than the softirq RT task, the current task will be\npreempted by the higher priority softirq RT task. Before\npreemption, we check to see if current can readily move to a\ndifferent cpu. If so, we will reschedule to allow the RT push logic\nto try to move current somewhere else. Whenever the woken\nsoftirq RT task runs, it first tries to migrate the user FIFO RT\ntask over to a cpu that is running a task of lesser priority. If\nmigration is done, it will send a reschedule request to the found\ncpu by IPI interrupt. Once the target cpu responds the IPI\ninterrupt, it will pick the migrated user RT task to preempt its\ncurrent task. When the user RT task is running on the new cpu,\nthe sched timer tick of the cpu fires. So it will tick the user\nRT task again. This also means the RT task timeout value will be\nupdated again. As the migration may be done in one tick period,\nit means the user RT task timeout value will be updated twice\nwithin one tick.\n\nIf we set a limit on the amount of cpu time for the user RT task\nby setrlimit(RLIMIT_RTTIME), the SIGXCPU signal should be posted\nupon reaching the soft limit.\n\nBut exactly when the SIGXCPU signal should be sent depends on the\nRT task timeout value. In fact the timeout mechanism of sending\nthe SIGXCPU signal assumes the RT task timeout is increased once\nevery tick.\n\nHowever, currently the timeout value may be added twice per\ntick. So it results in the SIGXCPU signal being sent earlier\nthan expected.\n\nTo solve this issue, we prevent the timeout value from increasing\ntwice within one tick time by remembering the jiffies value of\nlast updating the timeout. As long as the RT task\u0027s jiffies is\ndifferent with the global jiffies value, we allow its timeout to\nbe updated.\n\nSigned-off-by: Ying Xue \u003cying.xue@windriver.com\u003e\nSigned-off-by: Fan Du \u003cfan.du@windriver.com\u003e\nReviewed-by: Yong Zhang \u003cyong.zhang0@gmail.com\u003e\nAcked-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/1342508623-2887-1-git-send-email-ying.xue@windriver.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n[ lizf: backported to 3.4: adjust context ]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0cc70c5ec55e404dd4c970a3566dc60508088932", "tree": "45496133db35e147867f02d0a77e889a387cc82c", "parents": [ "0b909374b96f4ac56fcb18f3a94ff5c359ab46fa" ], "author": { "name": "Boaz Harrosh", "email": "bharrosh@panasas.com", "time": "Thu Nov 21 17:58:08 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 13 11:51:11 2014 -0800" }, "message": "ore: Fix wrong math in allocation of per device BIO\n\ncommit aad560b7f63b495f48a7232fd086c5913a676e6f upstream.\n\nAt IO preparation we calculate the max pages at each device and\nallocate a BIO per device of that size. The calculation was wrong\non some unaligned corner cases offset/length combination and would\nmake prepare return with -ENOMEM. This would be bad for pnfs-objects\nthat would in that case IO through MDS. And fatal for exofs were it\nwould fail writes with EIO.\n\nFix it by doing the proper math, that will work in all cases. (I\nran a test with all possible offset/length combinations this time\nround).\n\nAlso when reading we do not need to allocate for the parity units\nsince we jump over them.\n\nAlso lower the max_io_length to take into account the parity pages\nso not to allocate BIOs bigger than PAGE_SIZE\n\nSigned-off-by: Boaz Harrosh \u003cbharrosh@panasas.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cd1188e7a59ca6c03cab5fe490bf18888a3ca5dc", "tree": "0190e9cc1c4755e196580ebe407525e9b87f715e", "parents": [ "559316545580bbc61cf839e164c8a4c871c6ba42" ], "author": { "name": "AKASHI Takahiro", "email": "takahiro.akashi@linaro.org", "time": "Mon Jan 13 13:33:09 2014 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 13 11:51:08 2014 -0800" }, "message": "audit: correct a type mismatch in audit_syscall_exit()\n\ncommit 06bdadd7634551cfe8ce071fe44d0311b3033d9e upstream.\n\naudit_syscall_exit() saves a result of regs_return_value() in intermediate\n\"int\" variable and passes it to __audit_syscall_exit(), which expects its\nsecond argument as a \"long\" value. This will result in truncating the\nvalue returned by a system call and making a wrong audit record.\n\nI don\u0027t know why gcc compiler doesn\u0027t complain about this, but anyway it\ncauses a problem at runtime on arm64 (and probably most 64-bit archs).\n\nSigned-off-by: AKASHI Takahiro \u003ctakahiro.akashi@linaro.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "50d8f1b5c57bb29f02ab5834be334b4f7922b856", "tree": "3a9ead44eb4186570bf51ba5f20d3d6030ae271f", "parents": [ "18c8053c6b59f11bcd941850c1d13b3b502e1e74" ], "author": { "name": "Andrea Arcangeli", "email": "aarcange@redhat.com", "time": "Thu Nov 21 14:32:02 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 06 11:05:46 2014 -0800" }, "message": "mm: hugetlbfs: fix hugetlbfs optimization\n\ncommit 27c73ae759774e63313c1fbfeb17ba076cea64c5 upstream.\n\nCommit 7cb2ef56e6a8 (\"mm: fix aio performance regression for database\ncaused by THP\") can cause dereference of a dangling pointer if\nsplit_huge_page runs during PageHuge() if there are updates to the\ntail_page-\u003eprivate field.\n\nAlso it is repeating compound_head twice for hugetlbfs and it is running\ncompound_head+compound_trans_head for THP when a single one is needed in\nboth cases.\n\nThe new code within the PageSlab() check doesn\u0027t need to verify that the\nTHP page size is never bigger than the smallest hugetlbfs page size, to\navoid memory corruption.\n\nA longstanding theoretical race condition was found while fixing the\nabove (see the change right after the skip_unlock label, that is\nrelevant for the compound_lock path too).\n\nBy re-establishing the _mapcount tail refcounting for all compound\npages, this also fixes the below problem:\n\n echo 0 \u003e/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages\n\n BUG: Bad page state in process bash pfn:59a01\n page:ffffea000139b038 count:0 mapcount:10 mapping: (null) index:0x0\n page flags: 0x1c00000000008000(tail)\n Modules linked in:\n CPU: 6 PID: 2018 Comm: bash Not tainted 3.12.0+ #25\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n Call Trace:\n dump_stack+0x55/0x76\n bad_page+0xd5/0x130\n free_pages_prepare+0x213/0x280\n __free_pages+0x36/0x80\n update_and_free_page+0xc1/0xd0\n free_pool_huge_page+0xc2/0xe0\n set_max_huge_pages.part.58+0x14c/0x220\n nr_hugepages_store_common.isra.60+0xd0/0xf0\n nr_hugepages_store+0x13/0x20\n kobj_attr_store+0xf/0x20\n sysfs_write_file+0x189/0x1e0\n vfs_write+0xc5/0x1f0\n SyS_write+0x55/0xb0\n system_call_fastpath+0x16/0x1b\n\nSigned-off-by: Khalid Aziz \u003ckhalid.aziz@oracle.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nTested-by: Khalid Aziz \u003ckhalid.aziz@oracle.com\u003e\nCc: Pravin Shelar \u003cpshelar@nicira.com\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nCc: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Johannes Weiner \u003cjweiner@redhat.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Minchan Kim \u003cminchan@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Guillaume Morin \u003cguillaume@morinfr.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "86dc6b93ee413a3997b699476fc4dd78d8f35df7", "tree": "71504a3c49b46b466dccbd9486ca57cf4096000b", "parents": [ "e25027c9bf3fb2dcdd893f13a5651401332941cb" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Dec 31 16:23:35 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jan 15 15:27:11 2014 -0800" }, "message": "vlan: Fix header ops passthru when doing TX VLAN offload.\n\n[ Upstream commit 2205369a314e12fcec4781cc73ac9c08fc2b47de ]\n\nWhen the vlan code detects that the real device can do TX VLAN offloads\nin hardware, it tries to arrange for the real device\u0027s header_ops to\nbe invoked directly.\n\nBut it does so illegally, by simply hooking the real device\u0027s\nheader_ops up to the VLAN device.\n\nThis doesn\u0027t work because we will end up invoking a set of header_ops\nroutines which expect a device type which matches the real device, but\nwill see a VLAN device instead.\n\nFix this by providing a pass-thru set of header_ops which will arrange\nto pass the proper real device instead.\n\nTo facilitate this add a dev_rebuild_header(). There are\nimplementations which provide a -\u003ecache and -\u003ecreate but not a\n-\u003erebuild (f.e. PLIP). So we need a helper function just like\ndev_hard_header() to avoid crashes.\n\nUse this helper in the one existing place where the\nheader_ops-\u003erebuild was being invoked, the neighbour code.\n\nWith lots of help from Florian Westphal.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e387172fe3c3f5d256f183c0f88c9f0dc5434a88", "tree": "2869b0c303eb867b899857588ab9bf9a9f8c9f78", "parents": [ "fcbb1132558f68da2ce37a883be165129aa1eb31" ], "author": { "name": "Sasha Levin", "email": "sasha.levin@oracle.com", "time": "Sat Dec 07 17:26:27 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jan 15 15:27:11 2014 -0800" }, "message": "net: unix: allow set_peek_off to fail\n\n[ Upstream commit 12663bfc97c8b3fdb292428105dd92d563164050 ]\n\nunix_dgram_recvmsg() will hold the readlock of the socket until recv\nis complete.\n\nIn the same time, we may try to setsockopt(SO_PEEK_OFF) which will hang until\nunix_dgram_recvmsg() will complete (which can take a while) without allowing\nus to break out of it, triggering a hung task spew.\n\nInstead, allow set_peek_off to fail, this way userspace will not hang.\n\nSigned-off-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nAcked-by: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "be541ecb66d285c4135c3820113af22ff57d4a0c", "tree": "ddef6ed02dc046771156e87aa03e841c8ed63729", "parents": [ "93fb68c0c53ce4660686cf276320e64fe68578a1" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Dec 23 09:31:58 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jan 08 09:42:11 2014 -0800" }, "message": "drm/radeon: 0x9649 is SUMO2 not SUMO\n\ncommit d00adcc8ae9e22eca9d8af5f66c59ad9a74c90ec upstream.\n\nFixes rendering corruption due to incorrect\ngfx configuration.\n\nbug:\nhttps://bugs.freedesktop.org/show_bug.cgi?id\u003d63599\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "50a715f272de5c786e76607a3cd21489388c5a03", "tree": "93e45e611c9bde29ef1b6caf7ff7b706782cbb6f", "parents": [ "a6079a371fbd4e9cb4489b8a484b559427b97fe1" ], "author": { "name": "Stefano Panella", "email": "stefano.panella@citrix.com", "time": "Tue Dec 10 14:20:28 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Dec 20 07:34:19 2013 -0800" }, "message": "ALSA: memalloc.h - fix wrong truncation of dma_addr_t\n\ncommit 932e9dec380c67ec15ac3eb073bb55797d8b4801 upstream.\n\nWhen running a 32bit kernel the hda_intel driver is still reporting\na 64bit dma_mask if the HW supports it.\n\nFrom sound/pci/hda/hda_intel.c:\n\n /* allow 64bit DMA address if supported by H/W */\n if ((gcap \u0026 ICH6_GCAP_64OK) \u0026\u0026 !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))\n pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64));\n else {\n pci_set_dma_mask(pci, DMA_BIT_MASK(32));\n pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(32));\n }\n\nwhich means when there is a call to dma_alloc_coherent from\nsnd_malloc_dev_pages a machine address bigger than 32bit can be returned.\nThis can be true in particular if running the 32bit kernel as a pv dom0\nunder the Xen Hypervisor or PAE on bare metal.\n\nThe problem is that when calling setup_bdle to program the BLE the\ndma_addr_t returned from the dma_alloc_coherent is wrongly truncated\nfrom snd_sgbuf_get_addr if running a 32bit kernel:\n\nstatic inline dma_addr_t snd_sgbuf_get_addr(struct snd_dma_buffer *dmab,\n size_t offset)\n{\n struct snd_sg_buf *sgbuf \u003d dmab-\u003eprivate_data;\n dma_addr_t addr \u003d sgbuf-\u003etable[offset \u003e\u003e PAGE_SHIFT].addr;\n addr \u0026\u003d PAGE_MASK;\n return addr + offset % PAGE_SIZE;\n}\n\nwhere PAGE_MASK in a 32bit kernel is zeroing the upper 32bit af addr.\n\nWithout this patch the HW will fetch the 32bit truncated address,\nwhich is not the one obtained from dma_alloc_coherent and will result\nto a non working audio but can corrupt host memory at a random location.\n\nThe current patch apply to v3.13-rc3-74-g6c843f5\n\nSigned-off-by: Stefano Panella \u003cstefano.panella@citrix.com\u003e\nReviewed-by: Frediano Ziglio \u003cfrediano.ziglio@citrix.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4062191e84141d4549a38a25de09f886e2e344d8", "tree": "ab7cd954e5545aa4585e454c253077248b4cdb77", "parents": [ "3fc9589a42dab00a4c2dd9922dde4d15497bc3f0" ], "author": { "name": "Tom Lendacky", "email": "thomas.lendacky@amd.com", "time": "Thu Dec 05 13:09:53 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 11 22:34:12 2013 -0800" }, "message": "crypto: scatterwalk - Use sg_chain_ptr on chain entries\n\ncommit 389a5390583a18e45bc4abd4439291abec5e7a63 upstream.\n\nNow that scatterwalk_sg_chain sets the chain pointer bit the sg_page\ncall in scatterwalk_sg_next hits a BUG_ON when CONFIG_DEBUG_SG is\nenabled. Use sg_chain_ptr instead of sg_page on a chain entry.\n\nSigned-off-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "941f77dc3c2b264051fba4726461fec919822041", "tree": "1b0a0f5e794dc8d0bec5f600124bba18c3593976", "parents": [ "50b673d2fefba609f4a84e889277c5e12ce6a93d" ], "author": { "name": "Tom Lendacky", "email": "thomas.lendacky@amd.com", "time": "Tue Nov 12 11:46:10 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 11 22:34:10 2013 -0800" }, "message": "crypto: scatterwalk - Set the chain pointer indication bit\n\ncommit 41da8b5adba77e22584f8b45f9641504fa885308 upstream.\n\nThe scatterwalk_crypto_chain function invokes the scatterwalk_sg_chain\nfunction to chain two scatterlists, but the chain pointer indication\nbit is not set. When the resulting scatterlist is used, for example,\nby sg_nents to count the number of scatterlist entries, a segfault occurs\nbecause sg_nents does not follow the chain pointer to the chained scatterlist.\n\nUpdate scatterwalk_sg_chain to set the chain pointer indication bit as is\ndone by the sg_chain function.\n\nSigned-off-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d8b8a43e0f3c99bb29f258ef508969793f8e43bd", "tree": "275f0d0bfedf91eed51f22c7be6bed227cbf5b77", "parents": [ "9e23d8bd64e49062faf4aa4abcedd3943cf1d09d" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Mar 01 22:45:44 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Dec 08 07:29:43 2013 -0800" }, "message": "dm: fix truncated status strings\n\ncommit fd7c092e711ebab55b2688d3859d95dfd0301f73 upstream.\n\nAvoid returning a truncated table or status string instead of setting\nthe DM_BUFFER_FULL_FLAG when the last target of a table fills the\nbuffer.\n\nWhen processing a table or status request, the function retrieve_status\ncalls ti-\u003etype-\u003estatus. If ti-\u003etype-\u003estatus returns non-zero,\nretrieve_status assumes that the buffer overflowed and sets\nDM_BUFFER_FULL_FLAG.\n\nHowever, targets don\u0027t return non-zero values from their status method\non overflow. Most targets returns always zero.\n\nIf a buffer overflow happens in a target that is not the last in the\ntable, it gets noticed during the next iteration of the loop in\nretrieve_status; but if a buffer overflow happens in the last target, it\ngoes unnoticed and erroneously truncated data is returned.\n\nIn the current code, the targets behave in the following way:\n* dm-crypt returns -ENOMEM if there is not enough space to store the\n key, but it returns 0 on all other overflows.\n* dm-thin returns errors from the status method if a disk error happened.\n This is incorrect because retrieve_status doesn\u0027t check the error\n code, it assumes that all non-zero values mean buffer overflow.\n* all the other targets always return 0.\n\nThis patch changes the ti-\u003etype-\u003estatus function to return void (because\nmost targets don\u0027t use the return code). Overflow is detected in\nretrieve_status: if the status method fills up the remaining space\ncompletely, it is assumed that buffer overflow happened.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ad25b5df02bacf27efb56fe12bb8da8dd9273546", "tree": "46b4c357415225acf77d155d659a729c307fdee0", "parents": [ "ea9d7dc958579b07bf5cc419c4db932689a1224d" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Sat Nov 23 00:46:12 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Dec 08 07:29:42 2013 -0800" }, "message": "inet: fix addr_len/msg-\u003emsg_namelen assignment in recv_error and rxpmtu functions\n\n[ Upstream commit 85fbaa75037d0b6b786ff18658ddf0b4014ce2a4 ]\n\nCommit bceaa90240b6019ed73b49965eac7d167610be69 (\"inet: prevent leakage\nof uninitialized memory to user in recv syscalls\") conditionally updated\naddr_len if the msg_name is written to. The recv_error and rxpmtu\nfunctions relied on the recvmsg functions to set up addr_len before.\n\nAs this does not happen any more we have to pass addr_len to those\nfunctions as well and set it to the size of the corresponding sockaddr\nlength.\n\nThis broke traceroute and such.\n\nFixes: bceaa90240b6 (\"inet: prevent leakage of uninitialized memory to user in recv syscalls\")\nReported-by: Brad Spengler \u003cspender@grsecurity.net\u003e\nReported-by: Tom Labanowski\nCc: mpb \u003cmpb.mail@gmail.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "18719a4c7a90af3de4bb071511dd4a6dcf61a2e0", "tree": "8a2a831db542446ee13ec1d9ec8d484ecbb72843", "parents": [ "11afb94fbe0337a06ee7fce36841969b4e538622" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Thu Nov 21 03:14:22 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Dec 08 07:29:41 2013 -0800" }, "message": "net: rework recvmsg handler msg_name and msg_namelen logic\n\n[ Upstream commit f3d3342602f8bcbf37d7c46641cb9bca7618eb1c ]\n\nThis patch now always passes msg-\u003emsg_namelen as 0. recvmsg handlers must\nset msg_namelen to the proper size \u003c\u003d sizeof(struct sockaddr_storage)\nto return msg_name to the user.\n\nThis prevents numerous uninitialized memory leaks we had in the\nrecvmsg handlers and makes it harder for new code to accidentally leak\nuninitialized memory.\n\nOptimize for the case recvfrom is called with NULL as address. We don\u0027t\nneed to copy the address at all, so set it to NULL before invoking the\nrecvmsg handler. We can do so, because all the recvmsg handlers must\ncope with the case a plain read() is called on them. read() also sets\nmsg_name to NULL.\n\nAlso document these changes in include/linux/net.h as suggested by David\nMiller.\n\nChanges since RFC:\n\nSet msg-\u003emsg_name \u003d NULL if user specified a NULL in msg_name but had a\nnon-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn\u0027t\naffect sendto as it would bail out earlier while trying to copy-in the\naddress. It also more naturally reflects the logic by the callers of\nverify_iovec.\n\nWith this change in place I could remove \"\nif (!uaddr || msg_sys-\u003emsg_namelen \u003d\u003d 0)\n\tmsg-\u003emsg_name \u003d NULL\n\".\n\nThis change does not alter the user visible error logic as we ignore\nmsg_namelen as long as msg_name is NULL.\n\nAlso remove two unnecessary curly brackets in ___sys_recvmsg and change\ncomments to netdev style.\n\nCc: David Miller \u003cdavem@davemloft.net\u003e\nSuggested-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4dd7a52b53ab79e8990bb295a2907d47345d2fa2", "tree": "68e671edcbc17a2b0a5df560bd05c1f28b81c1e2", "parents": [ "4bb2cc8ea8b76426dcb60b95d27d599cb426bcf9" ], "author": { "name": "Daniel Borkmann", "email": "dborkman@redhat.com", "time": "Mon Nov 11 12:20:32 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Dec 08 07:29:41 2013 -0800" }, "message": "random32: fix off-by-one in seeding requirement\n\n[ Upstream commit 51c37a70aaa3f95773af560e6db3073520513912 ]\n\nFor properly initialising the Tausworthe generator [1], we have\na strict seeding requirement, that is, s1 \u003e 1, s2 \u003e 7, s3 \u003e 15.\n\nCommit 697f8d0348 (\"random32: seeding improvement\") introduced\na __seed() function that imposes boundary checks proposed by the\nerrata paper [2] to properly ensure above conditions.\n\nHowever, we\u0027re off by one, as the function is implemented as:\n\"return (x \u003c m) ? x + m : x;\", and called with __seed(X, 1),\n__seed(X, 7), __seed(X, 15). Thus, an unwanted seed of 1, 7, 15\nwould be possible, whereas the lower boundary should actually\nbe of at least 2, 8, 16, just as GSL does. Fix this, as otherwise\nan initialization with an unwanted seed could have the effect\nthat Tausworthe\u0027s PRNG properties cannot not be ensured.\n\nNote that this PRNG is *not* used for cryptography in the kernel.\n\n [1] http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme.ps\n [2] http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme2.ps\n\nJoint work with Hannes Frederic Sowa.\n\nFixes: 697f8d0348a6 (\"random32: seeding improvement\")\nCc: Stephen Hemminger \u003cstephen@networkplumber.org\u003e\nCc: Florian Weimer \u003cfweimer@redhat.com\u003e\nCc: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4d815b62becdae153d9541b49ba323cd58459a97", "tree": "8c24b8043089de504e8c6d6af9c0f6271d112920", "parents": [ "1d78aecdc9eb045e8c6b90050911324d3d0fc51f" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Tue Nov 26 09:22:54 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:34 2013 -0800" }, "message": "tracing: Allow events to have NULL strings\n\ncommit 4e58e54754dc1fec21c3a9e824bc108b05fdf46e upstream.\n\nIf an TRACE_EVENT() uses __assign_str() or __get_str on a NULL pointer\nthen the following oops will happen:\n\nBUG: unable to handle kernel NULL pointer dereference at (null)\nIP: [\u003cc127a17b\u003e] strlen+0x10/0x1a\n*pde \u003d 00000000 ^M\nOops: 0000 [#1] PREEMPT SMP\nModules linked in:\nCPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.13.0-rc1-test+ #2\nHardware name: /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006^M\ntask: f5cde9f0 ti: f5e5e000 task.ti: f5e5e000\nEIP: 0060:[\u003cc127a17b\u003e] EFLAGS: 00210046 CPU: 1\nEIP is at strlen+0x10/0x1a\nEAX: 00000000 EBX: c2472da8 ECX: ffffffff EDX: c2472da8\nESI: c1c5e5fc EDI: 00000000 EBP: f5e5fe84 ESP: f5e5fe80\n DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068\nCR0: 8005003b CR2: 00000000 CR3: 01f32000 CR4: 000007d0\nStack:\n f5f18b90 f5e5feb8 c10687a8 0759004f 00000005 00000005 00000005 00200046\n 00000002 00000000 c1082a93 f56c7e28 c2472da8 c1082a93 f5e5fee4 c106bc61^M\n 00000000 c1082a93 00000000 00000000 00000001 00200046 00200082 00000000\nCall Trace:\n [\u003cc10687a8\u003e] ftrace_raw_event_lock+0x39/0xc0\n [\u003cc1082a93\u003e] ? ktime_get+0x29/0x69\n [\u003cc1082a93\u003e] ? ktime_get+0x29/0x69\n [\u003cc106bc61\u003e] lock_release+0x57/0x1a5\n [\u003cc1082a93\u003e] ? ktime_get+0x29/0x69\n [\u003cc10824dd\u003e] read_seqcount_begin.constprop.7+0x4d/0x75\n [\u003cc1082a93\u003e] ? ktime_get+0x29/0x69^M\n [\u003cc1082a93\u003e] ktime_get+0x29/0x69\n [\u003cc108a46a\u003e] __tick_nohz_idle_enter+0x1e/0x426\n [\u003cc10690e8\u003e] ? lock_release_holdtime.part.19+0x48/0x4d\n [\u003cc10bc184\u003e] ? time_hardirqs_off+0xe/0x28\n [\u003cc1068c82\u003e] ? trace_hardirqs_off_caller+0x3f/0xaf\n [\u003cc108a8cb\u003e] tick_nohz_idle_enter+0x59/0x62\n [\u003cc1079242\u003e] cpu_startup_entry+0x64/0x192\n [\u003cc102299c\u003e] start_secondary+0x277/0x27c\nCode: 90 89 c6 89 d0 88 c4 ac 38 e0 74 09 84 c0 75 f7 be 01 00 00 00 89 f0 48 5e 5d c3 55 89 e5 57 66 66 66 66 90 83 c9 ff 89 c7 31 c0 \u003cf2\u003e ae f7 d1 8d 41 ff 5f 5d c3 55 89 e5 57 66 66 66 66 90 31 ff\nEIP: [\u003cc127a17b\u003e] strlen+0x10/0x1a SS:ESP 0068:f5e5fe80\nCR2: 0000000000000000\n---[ end trace 01bc47bf519ec1b2 ]---\n\nNew tracepoints have been added that have allowed for NULL pointers\nbeing assigned to strings. To fix this, change the TRACE_EVENT() code\nto check for NULL and if it is, it will assign \"(null)\" to it instead\n(similar to what glibc printf does).\n\nReported-by: Shuah Khan \u003cshuah.kh@samsung.com\u003e\nReported-by: Jovi Zhangwei \u003cjovi.zhangwei@gmail.com\u003e\nLink: http://lkml.kernel.org/r/CAGdX0WFeEuy+DtpsJzyzn0343qEEjLX97+o1VREFkUEhndC+5Q@mail.gmail.com\nLink: http://lkml.kernel.org/r/528D6972.9010702@samsung.com\nFixes: 9cbf117662e2 (\"tracing/events: provide string with undefined size support\")\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "09f665049d7ecde55c5fbe4bb419b992288c4608", "tree": "a2dcc09fe7f79b93406573082baa79fa8d797744", "parents": [ "b22831e6611bec1fdf84e71d80f7917199212ee8" ], "author": { "name": "Wang Haitao", "email": "wang.haitao1@zte.com.cn", "time": "Thu Aug 22 19:32:38 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:29 2013 -0800" }, "message": "mtd: map: fixed bug in 64-bit systems\n\ncommit a4d62babf988fe5dfde24437fa135ef147bc7aa0 upstream.\n\nHardware:\n\tCPU: XLP832,the 64-bit OS\n\tNOR Flash:S29GL128S 128M\nSoftware:\n\tKernel:2.6.32.41\n\tFilesystem:JFFS2\nWhen writing files, errors appear:\n\tWrite len 182 but return retlen 180\n\tWrite of 182 bytes at 0x072c815c failed. returned -5, retlen 180\n\tWrite len 186 but return retlen 184\n\tWrite of 186 bytes at 0x072caff4 failed. returned -5, retlen 184\nThese errors exist only in 64-bit systems,not in 32-bit systems. After analysis, we\nfound that the left shift operation is wrong in map_word_load_partial. For instance:\n\tunsigned char buf[3] \u003d{0x9e,0x3a,0xea};\n\tmap_bankwidth(map) is 4;\n\tfor (i\u003d0; i \u003c 3; i++) {\n\t\tint bitpos;\n\t\tbitpos \u003d (map_bankwidth(map)-1-i)*8;\n\t\torig.x[0] \u0026\u003d ~(0xff \u003c\u003c bitpos);\n\t\torig.x[0] |\u003d buf[i] \u003c\u003c bitpos;\n\t}\n\nThe value of orig.x[0] is expected to be 0x9e3aeaff, but in this situation(64-bit\nSystem) we\u0027ll get the wrong value of 0xffffffff9e3aeaff due to the 64-bit sign\nextension:\nbuf[i] is defined as \"unsigned char\" and the left-shift operation will convert it\nto the type of \"signed int\", so when left-shift buf[i] by 24 bits, the final result\nwill get the wrong value: 0xffffffff9e3aeaff.\n\nIf the left-shift bits are less than 24, then sign extension will not occur. Whereas\nthe bankwidth of the nor flash we used is 4, therefore this BUG emerges.\n\nSigned-off-by: Pang Xunlei \u003cpang.xunlei@zte.com.cn\u003e\nSigned-off-by: Zhang Yi \u003czhang.yi20@zte.com.cn\u003e\nSigned-off-by: Lu Zhongjun \u003clu.zhongjun@zte.com.cn\u003e\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c0d30628ff1b424f041d83fee37daea5f84eb0a2", "tree": "d7bc2b3b5824eeddeb687c3547c21984e1d6c422", "parents": [ "7288f91dd5b55d82e1dee9f0d24e9f4730d57392" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Tue Nov 12 15:11:17 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:34 2013 -0800" }, "message": "exec/ptrace: fix get_dumpable() incorrect tests\n\ncommit d049f74f2dbe71354d43d393ac3a188947811348 upstream.\n\nThe get_dumpable() return value is not boolean. Most users of the\nfunction actually want to be testing for non-SUID_DUMP_USER(1) rather than\nSUID_DUMP_DISABLE(0). The SUID_DUMP_ROOT(2) is also considered a\nprotected state. Almost all places did this correctly, excepting the two\nplaces fixed in this patch.\n\nWrong logic:\n if (dumpable \u003d\u003d SUID_DUMP_DISABLE) { /* be protective */ }\n or\n if (dumpable \u003d\u003d 0) { /* be protective */ }\n or\n if (!dumpable) { /* be protective */ }\n\nCorrect logic:\n if (dumpable !\u003d SUID_DUMP_USER) { /* be protective */ }\n or\n if (dumpable !\u003d 1) { /* be protective */ }\n\nWithout this patch, if the system had set the sysctl fs/suid_dumpable\u003d2, a\nuser was able to ptrace attach to processes that had dropped privileges to\nthat user. (This may have been partially mitigated if Yama was enabled.)\n\nThe macros have been moved into the file that declares get/set_dumpable(),\nwhich means things like the ia64 code can see them too.\n\nCVE-2013-2929\n\nReported-by: Vasily Kulikov \u003csegoon@openwall.com\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: \"Luck, Tony\" \u003ctony.luck@intel.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f22ff9d05def87a049c5c8c7b86539bd4f8e3172", "tree": "ed805b8838b5cf2d7686345c8859eeb1f8d48901", "parents": [ "df4011e050b4e80165a317424e6b3367dfa7697c" ], "author": { "name": "Fan Du", "email": "fan.du@windriver.com", "time": "Tue Apr 30 15:27:27 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "include/linux/fs.h: disable preempt when acquire i_size_seqcount write lock\n\ncommit 74e3d1e17b2e11d175970b85acd44f5927000ba2 upstream.\n\nTwo rt tasks bind to one CPU core.\n\nThe higher priority rt task A preempts a lower priority rt task B which\nhas already taken the write seq lock, and then the higher priority rt\ntask A try to acquire read seq lock, it\u0027s doomed to lockup.\n\nrt task A with lower priority: call write\ni_size_write rt task B with higher priority: call sync, and preempt task A\n write_seqcount_begin(\u0026inode-\u003ei_size_seqcount); i_size_read\n inode-\u003ei_size \u003d i_size; read_seqcount_begin \u003c-- lockup here...\n\nSo disable preempt when acquiring every i_size_seqcount *write* lock will\ncure the problem.\n\nSigned-off-by: Fan Du \u003cfan.du@windriver.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Zhao Hongjiang \u003czhaohongjiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "df4011e050b4e80165a317424e6b3367dfa7697c", "tree": "2aef78ae8ee675b60ec7798beda0b49e73545f51", "parents": [ "1a9a8c2c61437bc8ab745c96af936196f4684495" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Tue Apr 30 15:28:20 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Nov 29 10:50:33 2013 -0800" }, "message": "exec: do not abuse -\u003ecred_guard_mutex in threadgroup_lock()\n\ncommit e56fb2874015370e3b7f8d85051f6dce26051df9 upstream.\n\nthreadgroup_lock() takes signal-\u003ecred_guard_mutex to ensure that\nthread_group_leader() is stable. This doesn\u0027t look nice, the scope of\nthis lock in do_execve() is huge.\n\nAnd as Dave pointed out this can lead to deadlock, we have the\nfollowing dependencies:\n\n\tdo_execve:\t\tcred_guard_mutex -\u003e i_mutex\n\tcgroup_mount:\t\ti_mutex -\u003e cgroup_mutex\n\tattach_task_by_pid:\tcgroup_mutex -\u003e cred_guard_mutex\n\nChange de_thread() to take threadgroup_change_begin() around the\nswitch-the-leader code and change threadgroup_lock() to avoid\n-\u003ecred_guard_mutex.\n\nNote that de_thread() can\u0027t sleep with -\u003egroup_rwsem held, this can\nobviously deadlock with the exiting leader if the writer is active, so it\ndoes threadgroup_change_end() before schedule().\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[ zhj: adjust context ]\nSigned-off-by: Zhao Hongjiang \u003czhaohongjiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "478e9a72b5e0cc9ecd8b787db90dec01d283123c", "tree": "f64155ef7f2967e06a105074cb668da0294d62ae", "parents": [ "2b5f6d110ee835cba1742c999cabd30a54c10b76" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Tue Oct 22 00:07:47 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 04 04:23:41 2013 -0800" }, "message": "inet: fix possible memory corruption with UDP_CORK and UFO\n\n[ This is a simplified -stable version of a set of upstream commits. ]\n\nThis is a replacement patch only for stable which does fix the problems\nhandled by the following two commits in -net:\n\n\"ip_output: do skb ufo init for peeked non ufo skb as well\" (e93b7d748be887cd7639b113ba7d7ef792a7efb9)\n\"ip6_output: do skb ufo init for peeked non ufo skb as well\" (c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b)\n\nThree frames are written on a corked udp socket for which the output\nnetdevice has UFO enabled. If the first and third frame are smaller than\nthe mtu and the second one is bigger, we enqueue the second frame with\nskb_append_datato_frags without initializing the gso fields. This leads\nto the third frame appended regulary and thus constructing an invalid skb.\n\nThis fixes the problem by always using skb_append_datato_frags as soon\nas the first frag got enqueued to the skb without marking the packet\nas SKB_GSO_UDP.\n\nThe problem with only two frames for ipv6 was fixed by \"ipv6: udp\npackets following an UFO enqueued packet need also be handled by UFO\"\n(2811ebac2521ceac84f2bdae402455baa6a7fb47).\n\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2b5f6d110ee835cba1742c999cabd30a54c10b76", "tree": "4e10f90603b71437153e18c38cd356b569fdb98c", "parents": [ "4dde1cb060276e93a2ed22e4a167fc260a9d8c23" ], "author": { "name": "Seif Mazareeb", "email": "seif@marvell.com", "time": "Thu Oct 17 20:33:21 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 04 04:23:41 2013 -0800" }, "message": "net: fix cipso packet validation when !NETLABEL\n\n[ Upstream commit f2e5ddcc0d12f9c4c7b254358ad245c9dddce13b ]\n\nWhen CONFIG_NETLABEL is disabled, the cipso_v4_validate() function could loop\nforever in the main loop if opt[opt_iter +1] \u003d\u003d 0, this will causing a kernel\ncrash in an SMP system, since the CPU executing this function will\nstall /not respond to IPIs.\n\nThis problem can be reproduced by running the IP Stack Integrity Checker\n(http://isic.sourceforge.net) using the following command on a Linux machine\nconnected to DUT:\n\n\"icmpsic -s rand -d \u003cDUT IP address\u003e -r 123456\"\nwait (1-2 min)\n\nSigned-off-by: Seif Mazareeb \u003cseif@marvell.com\u003e\nAcked-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3e5d72cd013a30bbd3a835243b635f0b85c4dd0a", "tree": "79b48fb112d98c9631a7e2a1ff1b5428fb1cf1db", "parents": [ "225be57bbaf2c104f339b1a21efc25ff6b6bd9cb" ], "author": { "name": "Vlad Yasevich", "email": "vyasevich@gmail.com", "time": "Tue Oct 15 22:01:29 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 04 04:23:41 2013 -0800" }, "message": "net: dst: provide accessor function to dst-\u003exfrm\n\n[ Upstream commit e87b3998d795123b4139bc3f25490dd236f68212 ]\n\ndst-\u003exfrm is conditionally defined. Provide accessor funtion that\nis always available.\n\nSigned-off-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "11db1e4cee071defc371d0fc7f1740024fbe5b06", "tree": "3f31e7f8abf5be8eee3c2bd2de3306d1b41c233a", "parents": [ "3cebd7931a6f3007c3eb53942934772cc3b6ee08" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Oct 15 11:54:30 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 04 04:23:40 2013 -0800" }, "message": "tcp: must unclone packets before mangling them\n\n[ Upstream commit c52e2421f7368fd36cbe330d2cf41b10452e39a9 ]\n\nTCP stack should make sure it owns skbs before mangling them.\n\nWe had various crashes using bnx2x, and it turned out gso_size\nwas cleared right before bnx2x driver was populating TC descriptor\nof the _previous_ packet send. TCP stack can sometime retransmit\npackets that are still in Qdisc.\n\nOf course we could make bnx2x driver more robust (using\nACCESS_ONCE(shinfo-\u003egso_size) for example), but the bug is TCP stack.\n\nWe have identified two points where skb_unclone() was needed.\n\nThis patch adds a WARN_ON_ONCE() to warn us if we missed another\nfix of this kind.\n\nKudos to Neal for finding the root cause of this bug. Its visible\nusing small MSS.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nCc: Yuchung Cheng \u003cycheng@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c2f271001295e9d4b1cca3a01502795e4f0d1639", "tree": "d977bfe72c4f54eaa65ac1a315bc6f4ce820eaea", "parents": [ "dad61bad4267b922a9386d9772f80fbac496c05e" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Tue Sep 10 10:52:35 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 22 09:02:25 2013 +0100" }, "message": "random: run random_int_secret_init() run after all late_initcalls\n\ncommit 47d06e532e95b71c0db3839ebdef3fe8812fca2c upstream.\n\nThe some platforms (e.g., ARM) initializes their clocks as\nlate_initcalls for some unknown reason. So make sure\nrandom_int_secret_init() is run after all of the late_initcalls are\nrun.\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "022a41db8aa1bc0b4ff4c013f889292324a1c465", "tree": "11f00ef8d0aa584b956a194de5ee4c3be5fc5120", "parents": [ "9712612a91e92824349ce9fece31dba6d2fbde70" ], "author": { "name": "David Rientjes", "email": "rientjes@google.com", "time": "Mon Apr 29 15:06:11 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:49 2013 -0700" }, "message": "mm, show_mem: suppress page counts in non-blockable contexts\n\ncommit 4b59e6c4730978679b414a8da61514a2518da512 upstream.\n\nOn large systems with a lot of memory, walking all RAM to determine page\ntypes may take a half second or even more.\n\nIn non-blockable contexts, the page allocator will emit a page allocation\nfailure warning unless __GFP_NOWARN is specified. In such contexts, irqs\nare typically disabled and such a lengthy delay may even result in NMI\nwatchdog timeouts.\n\nTo fix this, suppress the page walk in such contexts when printing the\npage allocation failure warning.\n\nSigned-off-by: David Rientjes \u003crientjes@google.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Dave Hansen \u003cdave@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Xishi Qiu \u003cqiuxishi@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f72299da3e1a010a3d77fbed0b9ee6abd0a19911", "tree": "7ea60bcfbe30a8b48fe9e3a5d2af5c08d2f115a9", "parents": [ "832ae42a43dd7ea2a39d7cc0687363d0039da850" ], "author": { "name": "Ansis Atteka", "email": "aatteka@nicira.com", "time": "Wed Sep 18 15:29:53 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:48 2013 -0700" }, "message": "ip: generate unique IP identificator if local fragmentation is allowed\n\n[ Upstream commit 703133de331a7a7df47f31fb9de51dc6f68a9de8 ]\n\nIf local fragmentation is allowed, then ip_select_ident() and\nip_select_ident_more() need to generate unique IDs to ensure\ncorrect defragmentation on the peer.\n\nFor example, if IPsec (tunnel mode) has to encrypt large skbs\nthat have local_df bit set, then all IP fragments that belonged\nto different ESP datagrams would have used the same identificator.\nIf one of these IP fragments would get lost or reordered, then\npeer could possibly stitch together wrong IP fragments that did\nnot belong to the same datagram. This would lead to a packet loss\nor data corruption.\n\nSigned-off-by: Ansis Atteka \u003caatteka@nicira.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2cd21fa1b54efaf6b5912ef2833fa474fdcf92b7", "tree": "17a056e20c3937a5af97acd45ac7792a420d78ab", "parents": [ "2927937899b958de968119856ba659d8a4eff037" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Tue Oct 02 15:38:52 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:52 2013 -0700" }, "message": "perf: Clarify perf_cpu_context::active_pmu usage by renaming it to ::unique_pmu\n\ncommit 3f1f33206c16c7b3839d71372bc2ac3f305aa802 upstream.\n\nStephane thought the perf_cpu_context::active_pmu name confusing and\nsuggested using \u0027unique_pmu\u0027 instead.\n\nThis pointer is a pointer to a \u0027random\u0027 pmu sharing the cpuctx\ninstance, therefore limiting a for_each_pmu loop to those where\ncpuctx-\u003eunique_pmu matches the pmu we get a loop over unique cpuctx\ninstances.\n\nSuggested-by: Stephane Eranian \u003ceranian@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/n/tip-kxyjqpfj2fn9gt7kwu5ag9ks@git.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0049b62c9efc4ef23492976512d4722b3e63de45", "tree": "a098aec5808beb0937fdf3964e23742dd30066b2", "parents": [ "62875332eafea9ee150a6037c0a1a20669e02aa1" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Sep 11 21:56:50 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "HID: provide a helper for validating hid reports\n\ncommit 331415ff16a12147d57d5c953f3a961b7ede348b upstream.\n\nMany drivers need to validate the characteristics of their HID report\nduring initialization to avoid misusing the reports. This adds a common\nhelper to perform validation of the report exisitng, the field existing,\nand the expected number of values within the field.\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReviewed-by: Benjamin Tissoires \u003cbenjamin.tissoires@redhat.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "28f9d084175a2e0df088f5d1d9159819762e8534", "tree": "c48da7a3766d04e91832b8cf9ec820f019a019d9", "parents": [ "3fb6304439680cd10ae221f5ddfc531147f6a6cd" ], "author": { "name": "Andrzej Hajda", "email": "a.hajda@samsung.com", "time": "Fri Jun 28 05:44:22 2013 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:49 2013 -0700" }, "message": "media: v4l2: added missing mutex.h include to v4l2-ctrls.h\n\ncommit a19dec6ea94c036af68c31930c1c92681f55af41 upstream.\n\nThis patch fixes following error:\ninclude/media/v4l2-ctrls.h:193:15: error: field ‘_lock’ has incomplete type\ninclude/media/v4l2-ctrls.h: In function ‘v4l2_ctrl_lock’:\ninclude/media/v4l2-ctrls.h:570:2: error: implicit declaration of\n\tfunction ‘mutex_lock’ [-Werror\u003dimplicit-function-declaration]\ninclude/media/v4l2-ctrls.h: In function ‘v4l2_ctrl_unlock’:\ninclude/media/v4l2-ctrls.h:579:2: error: implicit declaration of\n\tfunction ‘mutex_unlock’ [-Werror\u003dimplicit-function-declaration]\n\nSigned-off-by: Andrzej Hajda \u003ca.hajda@samsung.com\u003e\nSigned-off-by: Kyungmin Park \u003ckyungmin.park@samsung.com\u003e\nSigned-off-by: Hans Verkuil \u003chans.verkuil@cisco.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cm.chehab@samsung.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "676bb9a417ceec66576daeb24aed2184a82ef544", "tree": "0fe1e2fc2906db54dd98ffd118a4dd94be056a2e", "parents": [ "355c557b3e0164eaf75aded30e92da5a3a818c5f" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Aug 28 22:29:55 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:34 2013 -0700" }, "message": "HID: validate HID report id size\n\ncommit 43622021d2e2b82ea03d883926605bdd0525e1d1 upstream.\n\nThe \"Report ID\" field of a HID report is used to build indexes of\nreports. The kernel\u0027s index of these is limited to 256 entries, so any\nmalicious device that sets a Report ID greater than 255 will trigger\nmemory corruption on the host:\n\n[ 1347.156239] BUG: unable to handle kernel paging request at ffff88094958a878\n[ 1347.156261] IP: [\u003cffffffff813e4da0\u003e] hid_register_report+0x2a/0x8b\n\nCVE-2013-2888\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a7179b89a68c7cb6f8623cedcce02b98d9e072a1", "tree": "7518b03360ce858e94f7bf57dbe855ca54847d65", "parents": [ "38a0864499c5a2b092e3ef065d9333acf2600e82" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Jun 28 10:34:48 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:32 2013 -0700" }, "message": "rculist: list_first_or_null_rcu() should use list_entry_rcu()\n\ncommit c34ac00caefbe49d40058ae7200bd58725cebb45 upstream.\n\nlist_first_or_null() should test whether the list is empty and return\npointer to the first entry if not in a RCU safe manner. It\u0027s broken\nin several ways.\n\n* It compares __kernel @__ptr with __rcu @__next triggering the\n following sparse warning.\n\n net/core/dev.c:4331:17: error: incompatible types in comparison expression (different address spaces)\n\n* It doesn\u0027t perform rcu_dereference*() and computes the entry address\n using container_of() directly from the __rcu pointer which is\n inconsitent with other rculist interface. As a result, all three\n in-kernel users - net/core/dev.c, macvlan, cgroup - are buggy. They\n dereference the pointer w/o going through read barrier.\n\n* While -\u003enext dereference passes through list_next_rcu(), the\n compiler is still free to fetch -\u003enext more than once and thus\n nullify the \"__ptr !\u003d __next\" condition check.\n\nFix it by making list_first_or_null_rcu() dereference -\u003enext directly\nusing ACCESS_ONCE() and then use list_entry_rcu() on it like other\nrculist accessors.\n\nv2: Paul pointed out that the compiler may fetch the pointer more than\n once nullifying the condition check. ACCESS_ONCE() added on\n -\u003enext dereference.\n\nv3: Restored () around macro param which was accidentally removed.\n Spotted by Paul.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nCc: Dipankar Sarma \u003cdipankar@in.ibm.com\u003e\nCc: \"Paul E. McKenney\" \u003cpaulmck@linux.vnet.ibm.com\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nCc: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nReviewed-by: Josh Triplett \u003cjosh@joshtriplett.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8708ea2b682963ce30dfd638771e7e4022094a90", "tree": "7b9614ba8229bf836c376efb599ee9d7dc5af233", "parents": [ "98fadc18d23f40203ff154d0220692834e0de8f1" ], "author": { "name": "Jiri Bohac", "email": "jbohac@suse.cz", "time": "Fri Aug 30 11:18:45 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:10 2013 -0700" }, "message": "ICMPv6: treat dest unreachable codes 5 and 6 as EACCES, not EPROTO\n\n[ Upstream commit 61e76b178dbe7145e8d6afa84bb4ccea71918994 ]\n\nRFC 4443 has defined two additional codes for ICMPv6 type 1 (destination\nunreachable) messages:\n 5 - Source address failed ingress/egress policy\n\t6 - Reject route to destination\n\nNow they are treated as protocol error and icmpv6_err_convert() converts them\nto EPROTO.\n\nRFC 4443 says:\n\t\"Codes 5 and 6 are more informative subsets of code 1.\"\n\nTreat codes 5 and 6 as code 1 (EACCES)\n\nBtw, connect() returning -EPROTO confuses firefox, so that fallback to\nother/IPv4 addresses does not work:\nhttps://bugzilla.mozilla.org/show_bug.cgi?id\u003d910773\n\nSigned-off-by: Jiri Bohac \u003cjbohac@suse.cz\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "055c396300ee15d990777841278ba94d2bc7868a", "tree": "7160fdb3700a540dd58fa7c01d1930df13749a02", "parents": [ "f4cb837d1bdb6e1592523ce76c3f45188d120b4e" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Fri Aug 16 13:30:07 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:10 2013 -0700" }, "message": "ipv6: drop packets with multiple fragmentation headers\n\n[ Upstream commit f46078cfcd77fa5165bf849f5e568a7ac5fa569c ]\n\nIt is not allowed for an ipv6 packet to contain multiple fragmentation\nheaders. So discard packets which were already reassembled by\nfragmentation logic and send back a parameter problem icmp.\n\nThe updates for RFC 6980 will come in later, I have to do a bit more\nresearch here.\n\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "09c756513ab486569683c6496e3285892a4e5ea0", "tree": "12d8f2da129db2ed1c2994c73a11f0557c58ae08", "parents": [ "41f2be6744087bbcf8444499ac2bb36af1ae8316" ], "author": { "name": "Martin Peschke", "email": "mpeschke@linux.vnet.ibm.com", "time": "Thu Aug 22 17:45:36 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 29 09:50:13 2013 -0700" }, "message": "SCSI: zfcp: fix lock imbalance by reworking request queue locking\n\ncommit d79ff142624e1be080ad8d09101f7004d79c36e1 upstream.\n\nThis patch adds wait_event_interruptible_lock_irq_timeout(), which is a\nstraight-forward descendant of wait_event_interruptible_timeout() and\nwait_event_interruptible_lock_irq().\n\nThe zfcp driver used to call wait_event_interruptible_timeout()\nin combination with some intricate and error-prone locking. Using\nwait_event_interruptible_lock_irq_timeout() as a replacement\nnicely cleans up that locking.\n\nThis rework removes a situation that resulted in a locking imbalance\nin zfcp_qdio_sbal_get():\n\nBUG: workqueue leaked lock or atomic: events/1/0xffffff00/10\n last function: zfcp_fc_wka_port_offline+0x0/0xa0 [zfcp]\n\nIt was introduced by commit c2af7545aaff3495d9bf9a7608c52f0af86fb194\n\"[SCSI] zfcp: Do not wait for SBALs on stopped queue\", which had a new\ncode path related to ZFCP_STATUS_ADAPTER_QDIOUP that took an early exit\nwithout a required lock being held. The problem occured when a\nspecial, non-SCSI I/O request was being submitted in process context,\nwhen the adapter\u0027s queues had been torn down. In this case the bug\nsurfaced when the Fibre Channel port connection for a well-known address\nwas closed during a concurrent adapter shut-down procedure, which is a\nrare constellation.\n\nThis patch also fixes these warnings from the sparse tool (make C\u003d1):\n\ndrivers/s390/scsi/zfcp_qdio.c:224:12: warning: context imbalance in\n \u0027zfcp_qdio_sbal_check\u0027 - wrong count at exit\ndrivers/s390/scsi/zfcp_qdio.c:244:5: warning: context imbalance in\n \u0027zfcp_qdio_sbal_get\u0027 - unexpected unlock\n\nLast but not least, we get rid of that crappy lock-unlock-lock\nsequence at the beginning of the critical section.\n\nIt is okay to call zfcp_erp_adapter_reopen() with req_q_lock held.\n\nReported-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nReported-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\nSigned-off-by: Martin Peschke \u003cmpeschke@linux.vnet.ibm.com\u003e\nSigned-off-by: Steffen Maier \u003cmaier@linux.vnet.ibm.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a42efb79d54d9a13c8f68df122c832bca08b74ae", "tree": "b49010c84b42ccc5407766471bc94c95efe63d83", "parents": [ "4d5b24dd453b4ff44f69756106b029e8961dcb55" ], "author": { "name": "Zhang Yi", "email": "wetpzy@gmail.com", "time": "Tue Jun 25 21:19:31 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Aug 20 08:26:28 2013 -0700" }, "message": "futex: Take hugepages into account when generating futex_key\n\ncommit 13d60f4b6ab5b702dc8d2ee20999f98a93728aec upstream.\n\nThe futex_keys of process shared futexes are generated from the page\noffset, the mapping host and the mapping index of the futex user space\naddress. This should result in an unique identifier for each futex.\n\nThough this is not true when futexes are located in different subpages\nof an hugepage. The reason is, that the mapping index for all those\nfutexes evaluates to the index of the base page of the hugetlbfs\nmapping. So a futex at offset 0 of the hugepage mapping and another\none at offset PAGE_SIZE of the same hugepage mapping have identical\nfutex_keys. This happens because the futex code blindly uses\npage-\u003eindex.\n\nSteps to reproduce the bug:\n\n1. Map a file from hugetlbfs. Initialize pthread_mutex1 at offset 0\n and pthread_mutex2 at offset PAGE_SIZE of the hugetlbfs\n mapping.\n\n The mutexes must be initialized as PTHREAD_PROCESS_SHARED because\n PTHREAD_PROCESS_PRIVATE mutexes are not affected by this issue as\n their keys solely depend on the user space address.\n\n2. Lock mutex1 and mutex2\n\n3. Create thread1 and in the thread function lock mutex1, which\n results in thread1 blocking on the locked mutex1.\n\n4. Create thread2 and in the thread function lock mutex2, which\n results in thread2 blocking on the locked mutex2.\n\n5. Unlock mutex2. Despite the fact that mutex2 got unlocked, thread2\n still blocks on mutex2 because the futex_key points to mutex1.\n\nTo solve this issue we need to take the normal page index of the page\nwhich contains the futex into account, if the futex is in an hugetlbfs\nmapping. In other words, we calculate the normal page mapping index of\nthe subpage in the hugetlbfs mapping.\n\nMappings which are not based on hugetlbfs are not affected and still\nuse page-\u003eindex.\n\nThanks to Mel Gorman who provided a patch for adding proper evaluation\nfunctions to the hugetlbfs code to avoid exposing hugetlbfs specific\ndetails to the futex code.\n\n[ tglx: Massaged changelog ]\n\nSigned-off-by: Zhang Yi \u003czhang.yi20@zte.com.cn\u003e\nReviewed-by: Jiang Biao \u003cjiang.biao2@zte.com.cn\u003e\nTested-by: Ma Chenggong \u003cma.chenggong@zte.com.cn\u003e\nReviewed-by: \u0027Mel Gorman\u0027 \u003cmgorman@suse.de\u003e\nAcked-by: \u0027Darren Hart\u0027 \u003cdvhart@linux.intel.com\u003e\nCc: \u0027Peter Zijlstra\u0027 \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/000101ce71a6%24a83c5880%24f8b50980%24@com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Mike Galbraith \u003cmgalbraith@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "99593eb7ca1dd9bfaa431d96e009eda23f001ace", "tree": "b1412f07fda67143bc2454bbb6f81e124cae3617", "parents": [ "65280b8ed1cca78ff7fe63ecfdb0fff87fe184a3" ], "author": { "name": "Andrew Vagin", "email": "avagin@openvz.org", "time": "Fri Aug 02 21:16:43 2013 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 14 22:57:08 2013 -0700" }, "message": "tracing: Fix fields of struct trace_iterator that are zeroed by mistake\n\ncommit ed5467da0e369e65b247b99eb6403cb79172bcda upstream.\n\ntracing_read_pipe zeros all fields bellow \"seq\". The declaration contains\na comment about that, but it doesn\u0027t help.\n\nThe first field is \"snapshot\", it\u0027s true when current open file is\nsnapshot. Looks obvious, that it should not be zeroed.\n\nThe second field is \"started\". It was converted from cpumask_t to\ncpumask_var_t (v2.6.28-4983-g4462344), in other words it was\nconverted from cpumask to pointer on cpumask.\n\nCurrently the reference on \"started\" memory is lost after the first read\nfrom tracing_read_pipe and a proper object will never be freed.\n\nThe \"started\" is never dereferenced for trace_pipe, because trace_pipe\ncan\u0027t have the TRACE_FILE_ANNOTATE options.\n\nLink: http://lkml.kernel.org/r/1375463803-3085183-1-git-send-email-avagin@openvz.org\n\nSigned-off-by: Andrew Vagin \u003cavagin@openvz.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2010fa31f8f5c5fa8385459dff03cb844cf79dd1", "tree": "f43541e0f5a5169293e2094c5a722f289a96a33d", "parents": [ "c733e1a2c459c09fe2510bfa49e2571b532be97c" ], "author": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Tue Jul 09 13:19:18 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 04 16:26:03 2013 +0800" }, "message": "virtio: support unlocked queue poll\n\ncommit cc229884d3f77ec3b1240e467e0236c3e0647c0c upstream.\n\nThis adds a way to check ring empty state after enable_cb outside any\nlocks. Will be used by virtio_net.\n\nNote: there\u0027s room for more optimization: caller is likely to have a\nmemory barrier already, which means we might be able to get rid of a\nbarrier here. Deferring this optimization until we do some\nbenchmarking.\n\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n[wg: Backported to 3.2]\nSigned-off-by: Wolfram Gloger \u003cwmglo@dent.med.uni-muenchen.de\u003e\n[bwh: Backported to 3.4: adjust context]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a90a3adeda28c4b701b11770817cf86d92db3228", "tree": "4443439c0d4ea52b0cb411b4069286afeea3f170", "parents": [ "8924588cf02036c239cfec4302f8b44ca6e2c6bb" ], "author": { "name": "Clemens Ladisch", "email": "clemens@ladisch.de", "time": "Mon Jul 22 21:32:09 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 04 16:26:02 2013 +0800" }, "message": "firewire: fix libdc1394/FlyCap2 iso event regression\n\ncommit 0699a73af3811b66b1ab5650575acee5eea841ab upstream.\n\nCommit 18d627113b83 (firewire: prevent dropping of completed iso packet\nheader data) was intended to be an obvious bug fix, but libdc1394 and\nFlyCap2 depend on the old behaviour by ignoring all returned information\nand thus not noticing that not all packets have been received yet. The\nresult was that the video frame buffers would be saved before they\ncontained the correct data.\n\nReintroduce the old behaviour for old clients.\n\nTested-by: Stepan Salenikovich \u003cstepan.salenikovich@gmail.com\u003e\nTested-by: Josep Bosch \u003cjep250@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 3.4+\nSigned-off-by: Clemens Ladisch \u003cclemens@ladisch.de\u003e\nSigned-off-by: Stefan Richter \u003cstefanr@s5r6.in-berlin.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "eeddd9177a67b743868e09742d58f574b2b9a497", "tree": "6f78ff2f6a6cc08cf59d4ceeece5e9601f4e135e", "parents": [ "589acc586e0f12e0c46bc98e79ff2a008e8c6c11" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Mon Jul 01 20:21:30 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:26:02 2013 -0700" }, "message": "ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data\n\n[ Upstream commit 8822b64a0fa64a5dd1dfcf837c5b0be83f8c05d1 ]\n\nWe accidentally call down to ip6_push_pending_frames when uncorking\npending AF_INET data on a ipv6 socket. This results in the following\nsplat (from Dave Jones):\n\nskbuff: skb_under_panic: text:ffffffff816765f6 len:48 put:40 head:ffff88013deb6df0 data:ffff88013deb6dec tail:0x2c end:0xc0 dev:\u003cNULL\u003e\n------------[ cut here ]------------\nkernel BUG at net/core/skbuff.c:126!\ninvalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\nModules linked in: dccp_ipv4 dccp 8021q garp bridge stp dlci mpoa snd_seq_dummy sctp fuse hidp tun bnep nfnetlink scsi_transport_iscsi rfcomm can_raw can_bcm af_802154 appletalk caif_socket can caif ipt_ULOG x25 rose af_key pppoe pppox ipx phonet irda llc2 ppp_generic slhc p8023 psnap p8022 llc crc_ccitt atm bluetooth\n+netrom ax25 nfc rfkill rds af_rxrpc coretemp hwmon kvm_intel kvm crc32c_intel snd_hda_codec_realtek ghash_clmulni_intel microcode pcspkr snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hwdep usb_debug snd_seq snd_seq_device snd_pcm e1000e snd_page_alloc snd_timer ptp snd pps_core soundcore xfs libcrc32c\nCPU: 2 PID: 8095 Comm: trinity-child2 Not tainted 3.10.0-rc7+ #37\ntask: ffff8801f52c2520 ti: ffff8801e6430000 task.ti: ffff8801e6430000\nRIP: 0010:[\u003cffffffff816e759c\u003e] [\u003cffffffff816e759c\u003e] skb_panic+0x63/0x65\nRSP: 0018:ffff8801e6431de8 EFLAGS: 00010282\nRAX: 0000000000000086 RBX: ffff8802353d3cc0 RCX: 0000000000000006\nRDX: 0000000000003b90 RSI: ffff8801f52c2ca0 RDI: ffff8801f52c2520\nRBP: ffff8801e6431e08 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000001 R12: ffff88022ea0c800\nR13: ffff88022ea0cdf8 R14: ffff8802353ecb40 R15: ffffffff81cc7800\nFS: 00007f5720a10740(0000) GS:ffff880244c00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000005862000 CR3: 000000022843c000 CR4: 00000000001407e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600\nStack:\n ffff88013deb6dec 000000000000002c 00000000000000c0 ffffffff81a3f6e4\n ffff8801e6431e18 ffffffff8159a9aa ffff8801e6431e90 ffffffff816765f6\n ffffffff810b756b 0000000700000002 ffff8801e6431e40 0000fea9292aa8c0\nCall Trace:\n [\u003cffffffff8159a9aa\u003e] skb_push+0x3a/0x40\n [\u003cffffffff816765f6\u003e] ip6_push_pending_frames+0x1f6/0x4d0\n [\u003cffffffff810b756b\u003e] ? mark_held_locks+0xbb/0x140\n [\u003cffffffff81694919\u003e] udp_v6_push_pending_frames+0x2b9/0x3d0\n [\u003cffffffff81694660\u003e] ? udplite_getfrag+0x20/0x20\n [\u003cffffffff8162092a\u003e] udp_lib_setsockopt+0x1aa/0x1f0\n [\u003cffffffff811cc5e7\u003e] ? fget_light+0x387/0x4f0\n [\u003cffffffff816958a4\u003e] udpv6_setsockopt+0x34/0x40\n [\u003cffffffff815949f4\u003e] sock_common_setsockopt+0x14/0x20\n [\u003cffffffff81593c31\u003e] SyS_setsockopt+0x71/0xd0\n [\u003cffffffff816f5d54\u003e] tracesys+0xdd/0xe2\nCode: 00 00 48 89 44 24 10 8b 87 d8 00 00 00 48 89 44 24 08 48 8b 87 e8 00 00 00 48 c7 c7 c0 04 aa 81 48 89 04 24 31 c0 e8 e1 7e ff ff \u003c0f\u003e 0b 55 48 89 e5 0f 0b 55 48 89 e5 0f 0b 55 48 89 e5 0f 0b 55\nRIP [\u003cffffffff816e759c\u003e] skb_panic+0x63/0x65\n RSP \u003cffff8801e6431de8\u003e\n\nThis patch adds a check if the pending data is of address family AF_INET\nand directly calls udp_push_ending_frames from udp_v6_push_pending_frames\nif that is the case.\n\nThis bug was found by Dave Jones with trinity.\n\n(Also move the initialization of fl6 below the AF_INET check, even if\nnot strictly necessary.)\n\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nCc: Dave Jones \u003cdavej@redhat.com\u003e\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3ef208a71f18b128e318294af3f7ee8081fe0ac1", "tree": "7c6094a3e8003f9532b6e935121bb36a3dc98a2f", "parents": [ "d11ff32e52d86dfc6d3f100653ad88b83b6ead0e" ], "author": { "name": "Amerigo Wang", "email": "amwang@redhat.com", "time": "Sat Jun 29 21:30:49 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:26:02 2013 -0700" }, "message": "ipv6,mcast: always hold idev-\u003elock before mca_lock\n\n[ Upstream commit 8965779d2c0e6ab246c82a405236b1fb2adae6b2, with\n some bits from commit b7b1bfce0bb68bd8f6e62a28295922785cc63781\n (\"ipv6: split duplicate address detection and router solicitation timer\")\n to get the __ipv6_get_lladdr() used by this patch. ]\n\ndingtianhong reported the following deadlock detected by lockdep:\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ INFO: possible circular locking dependency detected ]\n 3.4.24.05-0.1-default #1 Not tainted\n -------------------------------------------------------\n ksoftirqd/0/3 is trying to acquire lock:\n (\u0026ndev-\u003elock){+.+...}, at: [\u003cffffffff8147f804\u003e] ipv6_get_lladdr+0x74/0x120\n\n but task is already holding lock:\n (\u0026mc-\u003emca_lock){+.+...}, at: [\u003cffffffff8149d130\u003e] mld_send_report+0x40/0x150\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -\u003e #1 (\u0026mc-\u003emca_lock){+.+...}:\n [\u003cffffffff810a8027\u003e] validate_chain+0x637/0x730\n [\u003cffffffff810a8417\u003e] __lock_acquire+0x2f7/0x500\n [\u003cffffffff810a8734\u003e] lock_acquire+0x114/0x150\n [\u003cffffffff814f691a\u003e] rt_spin_lock+0x4a/0x60\n [\u003cffffffff8149e4bb\u003e] igmp6_group_added+0x3b/0x120\n [\u003cffffffff8149e5d8\u003e] ipv6_mc_up+0x38/0x60\n [\u003cffffffff81480a4d\u003e] ipv6_find_idev+0x3d/0x80\n [\u003cffffffff81483175\u003e] addrconf_notify+0x3d5/0x4b0\n [\u003cffffffff814fae3f\u003e] notifier_call_chain+0x3f/0x80\n [\u003cffffffff81073471\u003e] raw_notifier_call_chain+0x11/0x20\n [\u003cffffffff813d8722\u003e] call_netdevice_notifiers+0x32/0x60\n [\u003cffffffff813d92d4\u003e] __dev_notify_flags+0x34/0x80\n [\u003cffffffff813d9360\u003e] dev_change_flags+0x40/0x70\n [\u003cffffffff813ea627\u003e] do_setlink+0x237/0x8a0\n [\u003cffffffff813ebb6c\u003e] rtnl_newlink+0x3ec/0x600\n [\u003cffffffff813eb4d0\u003e] rtnetlink_rcv_msg+0x160/0x310\n [\u003cffffffff814040b9\u003e] netlink_rcv_skb+0x89/0xb0\n [\u003cffffffff813eb357\u003e] rtnetlink_rcv+0x27/0x40\n [\u003cffffffff81403e20\u003e] netlink_unicast+0x140/0x180\n [\u003cffffffff81404a9e\u003e] netlink_sendmsg+0x33e/0x380\n [\u003cffffffff813c4252\u003e] sock_sendmsg+0x112/0x130\n [\u003cffffffff813c537e\u003e] __sys_sendmsg+0x44e/0x460\n [\u003cffffffff813c5544\u003e] sys_sendmsg+0x44/0x70\n [\u003cffffffff814feab9\u003e] system_call_fastpath+0x16/0x1b\n\n -\u003e #0 (\u0026ndev-\u003elock){+.+...}:\n [\u003cffffffff810a798e\u003e] check_prev_add+0x3de/0x440\n [\u003cffffffff810a8027\u003e] validate_chain+0x637/0x730\n [\u003cffffffff810a8417\u003e] __lock_acquire+0x2f7/0x500\n [\u003cffffffff810a8734\u003e] lock_acquire+0x114/0x150\n [\u003cffffffff814f6c82\u003e] rt_read_lock+0x42/0x60\n [\u003cffffffff8147f804\u003e] ipv6_get_lladdr+0x74/0x120\n [\u003cffffffff8149b036\u003e] mld_newpack+0xb6/0x160\n [\u003cffffffff8149b18b\u003e] add_grhead+0xab/0xc0\n [\u003cffffffff8149d03b\u003e] add_grec+0x3ab/0x460\n [\u003cffffffff8149d14a\u003e] mld_send_report+0x5a/0x150\n [\u003cffffffff8149f99e\u003e] igmp6_timer_handler+0x4e/0xb0\n [\u003cffffffff8105705a\u003e] call_timer_fn+0xca/0x1d0\n [\u003cffffffff81057b9f\u003e] run_timer_softirq+0x1df/0x2e0\n [\u003cffffffff8104e8c7\u003e] handle_pending_softirqs+0xf7/0x1f0\n [\u003cffffffff8104ea3b\u003e] __do_softirq_common+0x7b/0xf0\n [\u003cffffffff8104f07f\u003e] __thread_do_softirq+0x1af/0x210\n [\u003cffffffff8104f1c1\u003e] run_ksoftirqd+0xe1/0x1f0\n [\u003cffffffff8106c7de\u003e] kthread+0xae/0xc0\n [\u003cffffffff814fff74\u003e] kernel_thread_helper+0x4/0x10\n\nactually we can just hold idev-\u003elock before taking pmc-\u003emca_lock,\nand avoid taking idev-\u003elock again when iterating idev-\u003eaddr_list,\nsince the upper callers of mld_newpack() already take\nread_lock_bh(\u0026idev-\u003elock).\n\nReported-by: dingtianhong \u003cdingtianhong@huawei.com\u003e\nCc: dingtianhong \u003cdingtianhong@huawei.com\u003e\nCc: Hideaki YOSHIFUJI \u003cyoshfuji@linux-ipv6.org\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nTested-by: Ding Tianhong \u003cdingtianhong@huawei.com\u003e\nTested-by: Chen Weilong \u003cchenweilong@huawei.com\u003e\nSigned-off-by: Cong Wang \u003camwang@redhat.com\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d11ff32e52d86dfc6d3f100653ad88b83b6ead0e", "tree": "77823b56eb1a60cedf52ec4dfa68a465c3d78b27", "parents": [ "d710304c889be7c6320fec4accaee1413efc90ed" ], "author": { "name": "Changli Gao", "email": "xiaosuo@gmail.com", "time": "Sat Jun 29 00:15:51 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:25:59 2013 -0700" }, "message": "net: Swap ver and type in pppoe_hdr\n\n[ Upstream commit b1a5a34bd0b8767ea689e68f8ea513e9710b671e ]\n\nVer and type in pppoe_hdr should be swapped as defined by RFC2516\nsection-4.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "535fad87e86d33ea41d4b8580fadf62f5865ae6b", "tree": "144c7d400374a57142d4e176c6f0ac34ba926028", "parents": [ "5d2a2c717306c11672aef8ca6a1535ff78f57fa8" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Tue May 28 10:55:48 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 03 10:59:06 2013 -0700" }, "message": "perf: Fix perf mmap bugs\n\ncommit 26cb63ad11e04047a64309362674bcbbd6a6f246 upstream.\n\nVince reported a problem found by his perf specific trinity\nfuzzer.\n\nAl noticed 2 problems with perf\u0027s mmap():\n\n - it has issues against fork() since we use vma-\u003evm_mm for accounting.\n - it has an rb refcount leak on double mmap().\n\nWe fix the issues against fork() by using VM_DONTCOPY; I don\u0027t\nthink there\u0027s code out there that uses this; we didn\u0027t hear\nabout weird accounting problems/crashes. If we do need this to\nwork, the previously proposed VM_PINNED could make this work.\n\nAside from the rb reference leak spotted by Al, Vince\u0027s example\nprog was indeed doing a double mmap() through the use of\nperf_event_set_output().\n\nThis exposes another problem, since we now have 2 events with\none buffer, the accounting gets screwy because we account per\nevent. Fix this by making the buffer responsible for its own\naccounting.\n\n[Backporting for 3.4-stable.\nVM_RESERVED flag was replaced with pair \u0027VM_DONTEXPAND | VM_DONTDUMP\u0027 in\n314e51b9 since 3.7.0-rc1, and 314e51b9 comes from a big patchset, we didn\u0027t\nbackport the patchset, so I restored \u0027VM_DNOTEXPAND | VM_DONTDUMP\u0027 as before:\n- vma-\u003evm_flags |\u003d VM_DONTCOPY | VM_DONTEXPAND | VM_DONTDUMP;\n+ vma-\u003evm_flags |\u003d VM_DONTCOPY | VM_RESERVED;\n -- zliu]\n\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@ghostprotocols.net\u003e\nLink: http://lkml.kernel.org/r/20130528085548.GA12193@twins.programming.kicks-ass.net\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Zhouping Liu \u003czliu@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "689ec1227270c5b3f009b82fb32d902717a0a03e", "tree": "e0c01085c8d7c1d8f5168b5f2af7931076fb76cd", "parents": [ "c0cc94f2f65a682827cca2a79a4d045a20f8897f" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed May 29 09:06:27 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 27 11:27:32 2013 -0700" }, "message": "net: force a reload of first item in hlist_nulls_for_each_entry_rcu\n\n[ Upstream commit c87a124a5d5e8cf8e21c4363c3372bcaf53ea190 ]\n\nRoman Gushchin discovered that udp4_lib_lookup2() was not reloading\nfirst item in the rcu protected list, in case the loop was restarted.\n\nThis produced soft lockups as in https://lkml.org/lkml/2013/4/16/37\n\nrcu_dereference(X)/ACCESS_ONCE(X) seem to not work as intended if X is\nptr-\u003efield :\n\nIn some cases, gcc caches the value or ptr-\u003efield in a register.\n\nUse a barrier() to disallow such caching, as documented in\nDocumentation/atomic_ops.txt line 114\n\nThanks a lot to Roman for providing analysis and numerous patches.\n\nDiagnosed-by: Roman Gushchin \u003cklamm@yandex-team.ru\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: Boris Zhmurov \u003czhmurov@yandex-team.ru\u003e\nSigned-off-by: Roman Gushchin \u003cklamm@yandex-team.ru\u003e\nAcked-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c0cc94f2f65a682827cca2a79a4d045a20f8897f", "tree": "5f5ec066b0c72524ccd349861b17666dd49a06e1", "parents": [ "3c353df4ca0f8f6912e103ca6d8d593ff4563b68" ], "author": { "name": "Andy Lutomirski", "email": "luto@amacapital.net", "time": "Wed May 22 14:07:44 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 27 11:27:32 2013 -0700" }, "message": "net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg\n\n[ Upstream commits 1be374a0518a288147c6a7398792583200a67261 and\n a7526eb5d06b0084ef12d7b168d008fcf516caab ]\n\nMSG_CMSG_COMPAT is (AFAIK) not intended to be part of the API --\nit\u0027s a hack that steals a bit to indicate to other networking code\nthat a compat entry was used. So don\u0027t allow it from a non-compat\nsyscall.\n\nThis prevents an oops when running this code:\n\nint main()\n{\n\tint s;\n\tstruct sockaddr_in addr;\n\tstruct msghdr *hdr;\n\n\tchar *highpage \u003d mmap((void*)(TASK_SIZE_MAX - 4096), 4096,\n\t PROT_READ | PROT_WRITE,\n\t MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);\n\tif (highpage \u003d\u003d MAP_FAILED)\n\t\terr(1, \"mmap\");\n\n\ts \u003d socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);\n\tif (s \u003d\u003d -1)\n\t\terr(1, \"socket\");\n\n addr.sin_family \u003d AF_INET;\n addr.sin_port \u003d htons(1);\n addr.sin_addr.s_addr \u003d htonl(INADDR_LOOPBACK);\n\tif (connect(s, (struct sockaddr*)\u0026addr, sizeof(addr)) !\u003d 0)\n\t\terr(1, \"connect\");\n\n\tvoid *evil \u003d highpage + 4096 - COMPAT_MSGHDR_SIZE;\n\tprintf(\"Evil address is %p\\n\", evil);\n\n\tif (syscall(__NR_sendmmsg, s, evil, 1, MSG_CMSG_COMPAT) \u003c 0)\n\t\terr(1, \"sendmmsg\");\n\n\treturn 0;\n}\n\nSigned-off-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7f259658b1f320b35040a14d7ace371b5cc15fbb", "tree": "22b82fc7ded6e3e7ba868dbf2dbab13c2881ffcc", "parents": [ "aa80dd9dbe86743ae6e52c836f6ab1472c469927" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Mon Mar 25 10:26:30 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:47 2013 -0700" }, "message": "libceph: wrap auth methods in a mutex\n\ncommit e9966076cdd952e19f2dd4854cd719be0d7cbebc upstream.\n\nThe auth code is called from a variety of contexts, include the mon_client\n(protected by the monc\u0027s mutex) and the messenger callbacks (currently\nprotected by nothing). Avoid chaos by protecting all auth state with a\nmutex. Nothing is blocking, so this should be simple and lightweight.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "aa80dd9dbe86743ae6e52c836f6ab1472c469927", "tree": "1b5a77428bc53dd4cf0988c6328bbea34adaee1f", "parents": [ "29c65a277a64645af853e8c9a9b3dda0ddc421e0" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Mon Mar 25 10:26:14 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:47 2013 -0700" }, "message": "libceph: wrap auth ops in wrapper functions\n\ncommit 27859f9773e4a0b2042435b13400ee2c891a61f4 upstream.\n\nUse wrapper functions that check whether the auth op exists so that callers\ndo not need a bunch of conditional checks. Simplifies the external\ninterface.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "29c65a277a64645af853e8c9a9b3dda0ddc421e0", "tree": "c2dac081d3aed9b11ece51c4edc5664d963fb536", "parents": [ "aacd9c3626bac2960bbecd35cc6f032f8529d90b" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Mon Mar 25 10:26:01 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:46 2013 -0700" }, "message": "libceph: add update_authorizer auth method\n\ncommit 0bed9b5c523d577378b6f83eab5835fe30c27208 upstream.\n\nCurrently the messenger calls out to a get_authorizer con op, which will\ncreate a new authorizer if it doesn\u0027t yet have one. In the meantime, when\nwe rotate our service keys, the authorizer doesn\u0027t get updated. Eventually\nit will be rejected by the server on a new connection attempt and get\ninvalidated, and we will then rebuild a new authorizer, but this is not\nideal.\n\nInstead, if we do have an authorizer, call a new update_authorizer op that\nwill verify that the current authorizer is using the latest secret. If it\nis not, we will build a new one that does. This avoids the transient\nfailure.\n\nThis fixes one of the sorry sequence of events for bug\n\n\thttp://tracker.ceph.com/issues/4282\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f517dfe6d161bf37a9355c86ea5cb605b06d5963", "tree": "610e29e1cbcd1f50888bcf131390d900f51f82b9", "parents": [ "0938e135aa8513f9bc379a408d3c6c1fd24eb46a" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Wed Jun 12 14:05:04 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:46 2013 -0700" }, "message": "mm: migration: add migrate_entry_wait_huge()\n\ncommit 30dad30922ccc733cfdbfe232090cf674dc374dc upstream.\n\nWhen we have a page fault for the address which is backed by a hugepage\nunder migration, the kernel can\u0027t wait correctly and do busy looping on\nhugepage fault until the migration finishes. As a result, users who try\nto kick hugepage migration (via soft offlining, for example) occasionally\nexperience long delay or soft lockup.\n\nThis is because pte_offset_map_lock() can\u0027t get a correct migration entry\nor a correct page table lock for hugepage. This patch introduces\nmigration_entry_wait_huge() to solve this.\n\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nReviewed-by: Rik van Riel \u003criel@redhat.com\u003e\nReviewed-by: Wanpeng Li \u003cliwanp@linux.vnet.ibm.com\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b3cba474228862814480d40554f77e98483f41ed", "tree": "ac70cc8e20df21d9f64b27bd5f2318964b204cd1", "parents": [ "91c930674642f4b849d64398db261ad13c3ab354" ], "author": { "name": "Srivatsa S. Bhat", "email": "srivatsa.bhat@linux.vnet.ibm.com", "time": "Wed Jun 12 14:04:36 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:44 2013 -0700" }, "message": "CPU hotplug: provide a generic helper to disable/enable CPU hotplug\n\ncommit 16e53dbf10a2d7e228709a7286310e629ede5e45 upstream.\n\nThere are instances in the kernel where we would like to disable CPU\nhotplug (from sysfs) during some important operation. Today the freezer\ncode depends on this and the code to do it was kinda tailor-made for\nthat.\n\nRestructure the code and make it generic enough to be useful for other\nusecases too.\n\nSigned-off-by: Srivatsa S. Bhat \u003csrivatsa.bhat@linux.vnet.ibm.com\u003e\nSigned-off-by: Robin Holt \u003cholt@sgi.com\u003e\nCc: H. Peter Anvin \u003chpa@zytor.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Russ Anderson \u003crja@sgi.com\u003e\nCc: Robin Holt \u003cholt@sgi.com\u003e\nCc: Russell King \u003clinux@arm.linux.org.uk\u003e\nCc: Guan Xuetao \u003cgxt@mprc.pku.edu.cn\u003e\nCc: Shawn Guo \u003cshawn.guo@linaro.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2147439889d33148785d20cdff01491f5617965f", "tree": "1f2504a3535c3e534b040cc66f002bb43e41c7e3", "parents": [ "b507d034be0418dd2dee4fe3d40f389b1818b37a" ], "author": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Wed May 29 09:51:29 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:44 2013 -0700" }, "message": "Bluetooth: Fix mgmt handling of power on failures\n\ncommit 96570ffcca0b872dc8626e97569d2697f374d868 upstream.\n\nIf hci_dev_open fails we need to ensure that the corresponding\nmgmt_set_powered command gets an appropriate response. This patch fixes\nthe missing response by adding a new mgmt_set_powered_failed function\nthat\u0027s used to indicate a power on failure to mgmt. Since a situation\nwith the device being rfkilled may require special handling in user\nspace the patch uses a new dedicated mgmt status code for this.\n\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bc4d36c41f16a66c320fd0282110ddc82aa1eb09", "tree": "4d15ef32790902916c0b92b33b299dfeb2834b5d", "parents": [ "3a22cc7f184b77731816e55662cd12f0c3d24d56" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jun 07 17:02:08 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 13 09:45:03 2013 -0700" }, "message": "ftrace: Move ftrace_filter_lseek out of CONFIG_DYNAMIC_FTRACE section\n\ncommit 7f49ef69db6bbf756c0abca7e9b65b32e999eec8 upstream.\n\nAs ftrace_filter_lseek is now used with ftrace_pid_fops, it needs to\nbe moved out of the #ifdef CONFIG_DYNAMIC_FTRACE section as the\nftrace_pid_fops is defined when DYNAMIC_FTRACE is not.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\n[ lizf: adjust context ]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3a22cc7f184b77731816e55662cd12f0c3d24d56", "tree": "ce3612a4ea2ec1ed53d5c98a24b88aa80067129c", "parents": [ "ce840e2f7825bfd240782dc209c2f2b8db514287" ], "author": { "name": "Namhyung Kim", "email": "namhyung.kim@lge.com", "time": "Fri Jun 07 17:01:16 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 13 09:45:03 2013 -0700" }, "message": "tracing: Fix possible NULL pointer dereferences\n\ncommit 6a76f8c0ab19f215af2a3442870eeb5f0e81998d upstream.\n\nCurrently set_ftrace_pid and set_graph_function files use seq_lseek\nfor their fops. However seq_open() is called only for FMODE_READ in\nthe fops-\u003eopen() so that if an user tries to seek one of those file\nwhen she open it for writing, it sees NULL seq_file and then panic.\n\nIt can be easily reproduced with following command:\n\n $ cd /sys/kernel/debug/tracing\n $ echo 1234 | sudo tee -a set_ftrace_pid\n\nIn this example, GNU coreutils\u0027 tee opens the file with fopen(, \"a\")\nand then the fopen() internally calls lseek().\n\nLink:\nhttp://lkml.kernel.org/r/1365663302-2170-1-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n[ lizf: adjust context ]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "954dc41937054d91766387ea2af400c185a1e96a", "tree": "451921b8a4b9e8ae9d18ef4845d256e440f362df", "parents": [ "b6a526aa935210e5a292cd7919fdecf14e240fac" ], "author": { "name": "Imre Deak", "email": "imre.deak@intel.com", "time": "Fri May 24 15:55:09 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:14 2013 -0700" }, "message": "wait: fix false timeouts when using wait_event_timeout()\n\ncommit 4c663cfc523a88d97a8309b04a089c27dc57fd7e upstream.\n\nMany callers of the wait_event_timeout() and\nwait_event_interruptible_timeout() expect that the return value will be\npositive if the specified condition becomes true before the timeout\nelapses. However, at the moment this isn\u0027t guaranteed. If the wake-up\nhandler is delayed enough, the time remaining until timeout will be\ncalculated as 0 - and passed back as a return value - even if the\ncondition became true before the timeout has passed.\n\nFix this by returning at least 1 if the condition becomes true. This\nsemantic is in line with what wait_for_condition_timeout() does; see\ncommit bb10ed09 (\"sched: fix wait_for_completion_timeout() spurious\nfailure under heavy load\").\n\nDaniel said \"We have 3 instances of this bug in drm/i915. One case even\nwhere we switch between the interruptible and not interruptible\nwait_event_timeout variants, foolishly presuming they have the same\nsemantics. I very much like this.\"\n\nOne such bug is reported at\n https://bugs.freedesktop.org/show_bug.cgi?id\u003d64133\n\nSigned-off-by: Imre Deak \u003cimre.deak@intel.com\u003e\nAcked-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nCc: \"Paul E. McKenney\" \u003cpaulmck@linux.vnet.ibm.com\u003e\nCc: Dave Jones \u003cdavej@redhat.com\u003e\nCc: Lukas Czerner \u003clczerner@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dab2d3dc45ae7343216635d981d43637e1cb7d45", "tree": "a79004a3fcee0ada81f9dd12ed77caf5807edc58", "parents": [ "dd77cf8cc7aca5902e759c26049730c151bc885f" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Tue May 07 16:18:13 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:48 2013 -0700" }, "message": "hugetlbfs: fix mmap failure in unaligned size request\n\ncommit af73e4d9506d3b797509f3c030e7dcd554f7d9c4 upstream.\n\nThe current kernel returns -EINVAL unless a given mmap length is\n\"almost\" hugepage aligned. This is because in sys_mmap_pgoff() the\ngiven length is passed to vm_mmap_pgoff() as it is without being aligned\nwith hugepage boundary.\n\nThis is a regression introduced in commit 40716e29243d (\"hugetlbfs: fix\nalignment of huge page requests\"), where alignment code is pushed into\nhugetlb_file_setup() and the variable len in caller side is not changed.\n\nTo fix this, this patch partially reverts that commit, and adds\nalignment code in caller side. And it also introduces hstate_sizelog()\nin order to get proper hstate to specified hugepage size.\n\nAddresses https://bugzilla.kernel.org/show_bug.cgi?id\u003d56881\n\n[akpm@linux-foundation.org: fix warning when CONFIG_HUGETLB_PAGE\u003dn]\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nSigned-off-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nReported-by: \u003ciceman_dvd@yahoo.com\u003e\nCc: Steven Truelove \u003csteven.truelove@utoronto.ca\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7d9577d0b2d7958c821236064d995a995e1c4256", "tree": "a69a1229b1f5c8fc15e9ae683ad665ec16e17eb8", "parents": [ "f2f17ef7c7a9ac2a9ed1160c768c67d2cf86b8d5" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu May 09 10:28:16 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:47 2013 -0700" }, "message": "ipv6: do not clear pinet6 field\n\n[ Upstream commit f77d602124d865c38705df7fa25c03de9c284ad2 ]\n\nWe have seen multiple NULL dereferences in __inet6_lookup_established()\n\nAfter analysis, I found that inet6_sk() could be NULL while the\ncheck for sk_family \u003d\u003d AF_INET6 was true.\n\nBug was added in linux-2.6.29 when RCU lookups were introduced in UDP\nand TCP stacks.\n\nOnce an IPv6 socket, using SLAB_DESTROY_BY_RCU is inserted in a hash\ntable, we no longer can clear pinet6 field.\n\nThis patch extends logic used in commit fcbdf09d9652c891\n(\"net: fix nulls list corruptions in sk_prot_alloc\")\n\nTCP/UDP/UDPLite IPv6 protocols provide their own .clear_sk() method\nto make sure we do not clear pinet6 field.\n\nAt socket clone phase, we do not really care, as cloning the parent (non\nNULL) pinet6 is not adding a fatal race.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f2f17ef7c7a9ac2a9ed1160c768c67d2cf86b8d5", "tree": "d30412dc090b30800365582acba0f0f11924b2b4", "parents": [ "e52507b9069411a0a770d49daa246f8cb2fbcde4" ], "author": { "name": "Jiri Pirko", "email": "jiri@resnulli.us", "time": "Thu May 09 04:23:40 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:47 2013 -0700" }, "message": "macvlan: fix passthru mode race between dev removal and rx path\n\n[ Upstream commit 233c7df0821c4190e2d3f4be0f2ca0ab40a5ed8c, note\n that I had to add list_first_or_null_rcu to rculist.h in order\n to accomodate this fix. ]\n\nCurrently, if macvlan in passthru mode is created and data are rxed and\nyou remove this device, following panic happens:\n\nNULL pointer dereference at 0000000000000198\nIP: [\u003cffffffffa0196058\u003e] macvlan_handle_frame+0x153/0x1f7 [macvlan]\n\nI\u0027m using following script to trigger this:\n\u003cscript\u003e\nwhile [ 1 ]\ndo\n\tip link add link e1 name macvtap0 type macvtap mode passthru\n\tip link set e1 up\n\tip link set macvtap0 up\n\tIFINDEX\u003d`ip link |grep macvtap0 | cut -f 1 -d \u0027:\u0027`\n\tcat /dev/tap$IFINDEX \u003e/dev/null \u0026\n\tip link del dev macvtap0\ndone\n\u003c/script\u003e\n\nI run this script while \"ping -f\" is running on another machine to send\npackets to e1 rx.\n\nReason of the panic is that list_first_entry() is blindly called in\nmacvlan_handle_frame() even if the list was empty. vlan is set to\nincorrect pointer which leads to the crash.\n\nI\u0027m fixing this by protecting port-\u003evlans list by rcu and by preventing\nfrom getting incorrect pointer in case the list is empty.\n\nIntroduced by: commit eb06acdc85585f2 \"macvlan: Introduce \u0027passthru\u0027 mode to takeover the underlying device\"\n\nSigned-off-by: Jiri Pirko \u003cjiri@resnulli.us\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e52507b9069411a0a770d49daa246f8cb2fbcde4", "tree": "8bfea237f8984d26400320ba32456d50ddce9db8", "parents": [ "9faef35be7ff4fbaeb6ed86ca5a3fdcf46d630be" ], "author": { "name": "Josh Boyer", "email": "jwboyer@redhat.com", "time": "Wed May 08 09:45:47 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:47 2013 -0700" }, "message": "if_cablemodem.h: Add parenthesis around ioctl macros\n\n[ Upstream commit 4f924b2aa4d3cb30f07e57d6b608838edcbc0d88 ]\n\nProtect the SIOCGCM* ioctl macros with parenthesis.\n\nReported-by: Paul Wouters \u003cpwouters@redhat.com\u003e\nSigned-off-by: Josh Boyer \u003cjwboyer@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8e1546d7e14ef043ff74070cea0aff55ba2f600c", "tree": "c595d2a41d374eb4d57366553cd3f628583d6697", "parents": [ "1203d9c66e6b892bd8043eea51c5cd510d097266" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Apr 24 18:34:55 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:43 2013 -0700" }, "message": "tcp: force a dst refcount when prequeue packet\n\n[ Upstream commit 093162553c33e9479283e107b4431378271c735d ]\n\nBefore escaping RCU protected section and adding packet into\nprequeue, make sure the dst is refcounted.\n\nReported-by: Mike Galbraith \u003cbitbucket@online.de\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ad86524f948c1914dbd5bc460a5c6fd131ec054a", "tree": "e123d937b7d8e6871bc161a6233f850c236e8d49", "parents": [ "7c8b65e18db43c918ec3491e2712432d2a33f8a5" ], "author": { "name": "Anton Blanchard", "email": "anton@samba.org", "time": "Wed Jan 09 10:46:17 2013 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:39 2013 -0700" }, "message": "audit: Syscall rules are not applied to existing processes on non-x86\n\ncommit cdee3904b4ce7c03d1013ed6dd704b43ae7fc2e9 upstream.\n\nCommit b05d8447e782 (audit: inline audit_syscall_entry to reduce\nburden on archs) changed audit_syscall_entry to check for a dummy\ncontext before calling __audit_syscall_entry. Unfortunately the dummy\ncontext state is maintained in __audit_syscall_entry so once set it\nnever gets cleared, even if the audit rules change.\n\nAs a result, if there are no auditing rules when a process starts\nthen it will never be subject to any rules added later. x86 doesn\u0027t\nsee this because it has an assembly fast path that calls directly into\n__audit_syscall_entry.\n\nI noticed this issue when working on audit performance optimisations.\nI wrote a set of simple test cases available at:\n\nhttp://ozlabs.org/~anton/junkcode/audit_tests.tar.gz\n\n02_new_rule.py fails without the patch and passes with it. The\ntest case clears all rules, starts a process, adds a rule then\nverifies the process produces a syscall audit record.\n\nSigned-off-by: Anton Blanchard \u003canton@samba.org\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0c98574b6a4bdcf84b6b61804cb1f68fb1d390a4", "tree": "8fe74f4a2812813efde1912a879a1227424ff456", "parents": [ "3fe09e770fb1e5007af981a1eef4c3667e3e55f0" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Apr 25 14:06:05 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 11 13:48:14 2013 -0700" }, "message": "drm/radeon: add new richland pci ids\n\ncommit 62d1f92e06aef9665d71ca7e986b3047ecf0b3c7 upstream.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6e98eded75064b5121ce759d1b0fb8568c598b1f", "tree": "155524133c571ea0819ed71d6e4ae3564155072a", "parents": [ "10939f3f94637c3f243ef9f876b545b9839faf2a" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Apr 25 13:55:15 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 11 13:48:12 2013 -0700" }, "message": "drm/radeon: add some new SI PCI ids\n\ncommit 18932a28419596bc9403770f5d8a108c5433fe59 upstream.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "213116e53f9fde7896be9958e73d4e59bfea980b", "tree": "83050e644c69f12e6a3eaf5271a3ac7d87b33c1f", "parents": [ "e99e7562943ded071fbd77066b1e4aee1e3815c2" ], "author": { "name": "Dmitry Monakhov", "email": "dmonakhov@openvz.org", "time": "Wed Apr 03 22:06:52 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:57 2013 -0700" }, "message": "jbd2: fix race between jbd2_journal_remove_checkpoint and -\u003ej_commit_callback\n\ncommit 794446c6946513c684d448205fbd76fa35f38b72 upstream.\n\nThe following race is possible:\n\n[kjournald2] other_task\njbd2_journal_commit_transaction()\n j_state \u003d T_FINISHED;\n spin_unlock(\u0026journal-\u003ej_list_lock);\n -\u003ejbd2_journal_remove_checkpoint()\n\t\t\t\t\t -\u003ejbd2_journal_free_transaction();\n\t\t\t\t\t -\u003ekmem_cache_free(transaction)\n -\u003ej_commit_callback(journal, transaction);\n -\u003e USE_AFTER_FREE\n\nWARNING: at lib/list_debug.c:62 __list_del_entry+0x1c0/0x250()\nHardware name:\nlist_del corruption. prev-\u003enext should be ffff88019a4ec198, but was 6b6b6b6b6b6b6b6b\nModules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf coretemp kvm_intel kvm crc32c_intel ghash_clmulni_intel microcode sg xhci_hcd button sd_mod crc_t10dif aesni_intel ablk_helper cryptd lrw aes_x86_64 xts gf128mul ahci libahci pata_acpi ata_generic dm_mirror dm_region_hash dm_log dm_mod\nPid: 16400, comm: jbd2/dm-1-8 Tainted: G W 3.8.0-rc3+ #107\nCall Trace:\n [\u003cffffffff8106fb0d\u003e] warn_slowpath_common+0xad/0xf0\n [\u003cffffffff8106fc06\u003e] warn_slowpath_fmt+0x46/0x50\n [\u003cffffffff813637e9\u003e] ? ext4_journal_commit_callback+0x99/0xc0\n [\u003cffffffff8148cae0\u003e] __list_del_entry+0x1c0/0x250\n [\u003cffffffff813637bf\u003e] ext4_journal_commit_callback+0x6f/0xc0\n [\u003cffffffff813ca336\u003e] jbd2_journal_commit_transaction+0x23a6/0x2570\n [\u003cffffffff8108aa42\u003e] ? try_to_del_timer_sync+0x82/0xa0\n [\u003cffffffff8108b491\u003e] ? del_timer_sync+0x91/0x1e0\n [\u003cffffffff813d3ecf\u003e] kjournald2+0x19f/0x6a0\n [\u003cffffffff810ad630\u003e] ? wake_up_bit+0x40/0x40\n [\u003cffffffff813d3d30\u003e] ? bit_spin_lock+0x80/0x80\n [\u003cffffffff810ac6be\u003e] kthread+0x10e/0x120\n [\u003cffffffff810ac5b0\u003e] ? __init_kthread_worker+0x70/0x70\n [\u003cffffffff818ff6ac\u003e] ret_from_fork+0x7c/0xb0\n [\u003cffffffff810ac5b0\u003e] ? __init_kthread_worker+0x70/0x70\n\nIn order to demonstrace this issue one should mount ext4 with mount -o\ndiscard option on SSD disk. This makes callback longer and race\nwindow becomes wider.\n\nIn order to fix this we should mark transaction as finished only after\ncallbacks have completed\n\nSigned-off-by: Dmitry Monakhov \u003cdmonakhov@openvz.org\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b7d885f21da64b75066f42246da6968e3769b951", "tree": "65d90fc56637f12d65a981e65cb94011191e695b", "parents": [ "131e3afd38ede147ad56179d352a9d7b8b3d966f" ], "author": { "name": "Robin Holt", "email": "holt@sgi.com", "time": "Tue Apr 30 19:15:54 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:56 2013 -0700" }, "message": "ipc: sysv shared memory limited to 8TiB\n\ncommit d69f3bad4675ac519d41ca2b11e1c00ca115cecd upstream.\n\nTrying to run an application which was trying to put data into half of\nmemory using shmget(), we found that having a shmall value below 8EiB-8TiB\nwould prevent us from using anything more than 8TiB. By setting\nkernel.shmall greater than 8EiB-8TiB would make the job work.\n\nIn the newseg() function, ns-\u003eshm_tot which, at 8TiB is INT_MAX.\n\nipc/shm.c:\n 458 static int newseg(struct ipc_namespace *ns, struct ipc_params *params)\n 459 {\n...\n 465 int numpages \u003d (size + PAGE_SIZE -1) \u003e\u003e PAGE_SHIFT;\n...\n 474 if (ns-\u003eshm_tot + numpages \u003e ns-\u003eshm_ctlall)\n 475 return -ENOSPC;\n\n[akpm@linux-foundation.org: make ipc/shm.c:newseg()\u0027s numpages size_t, not int]\nSigned-off-by: Robin Holt \u003cholt@sgi.com\u003e\nReported-by: Alex Thorlton \u003cathorlton@sgi.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "273a82bee94d42ba58b264bc427cd75df65b81fc", "tree": "29c58f1e1b209f4e6ab09fb0ea8188e52501d6db", "parents": [ "ede49f3642cce1fe60ac81cb1953e7a8fd91e8ce" ], "author": { "name": "Hugh Dickins", "email": "hughd@google.com", "time": "Mon Apr 29 15:07:44 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:55 2013 -0700" }, "message": "mm: allow arch code to control the user page table ceiling\n\ncommit 6ee8630e02be6dd89926ca0fbc21af68b23dc087 upstream.\n\nOn architectures where a pgd entry may be shared between user and kernel\n(e.g. ARM+LPAE), freeing page tables needs a ceiling other than 0.\nThis patch introduces a generic USER_PGTABLES_CEILING that arch code can\noverride. It is the responsibility of the arch code setting the ceiling\nto ensure the complete freeing of the page tables (usually in\npgd_free()).\n\n[catalin.marinas@arm.com: commit log; shift_arg_pages(), asm-generic/pgtables.h changes]\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Russell King \u003clinux@arm.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ca4bf7c6970aee586c4b6b642e011e3847ac5f93", "tree": "5a09c1404e30b8647502300f19516bc6720df17a", "parents": [ "4087320fd8d0164c4b53fe5f9c26c0d3eaba7d2d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 19 15:32:32 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:16 2013 -0700" }, "message": "net: fix incorrect credentials passing\n\n[ Upstream commit 83f1b4ba917db5dc5a061a44b3403ddb6e783494 ]\n\nCommit 257b5358b32f (\"scm: Capture the full credentials of the scm\nsender\") changed the credentials passing code to pass in the effective\nuid/gid instead of the real uid/gid.\n\nObviously this doesn\u0027t matter most of the time (since normally they are\nthe same), but it results in differences for suid binaries when the wrong\nuid/gid ends up being used.\n\nThis just undoes that (presumably unintentional) part of the commit.\n\nReported-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nCc: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nCc: Serge E. Hallyn \u003cserge@hallyn.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nAcked-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1ab6b2a5a0970c887166b732fd3ad347979f2cec", "tree": "816c2b7f42d8a6779bb48adba53ec461560937e8", "parents": [ "ba12001651d677a8742aa465d3996885d2568f98" ], "author": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Fri Apr 05 20:42:05 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:07 2013 -0700" }, "message": "netfilter: don\u0027t reset nf_trace in nf_reset()\n\n[ Upstream commit 124dff01afbdbff251f0385beca84ba1b9adda68 ]\n\nCommit 130549fe (\"netfilter: reset nf_trace in nf_reset\") added code\nto reset nf_trace in nf_reset(). This is wrong and unnecessary.\n\nnf_reset() is used in the following cases:\n\n- when passing packets up the the socket layer, at which point we want to\n release all netfilter references that might keep modules pinned while\n the packet is queued. nf_trace doesn\u0027t matter anymore at this point.\n\n- when encapsulating or decapsulating IPsec packets. We want to continue\n tracing these packets after IPsec processing.\n\n- when passing packets through virtual network devices. Only devices on\n that encapsulate in IPv4/v6 matter since otherwise nf_trace is not\n used anymore. Its not entirely clear whether those packets should\n be traced after that, however we\u0027ve always done that.\n\n- when passing packets through virtual network devices that make the\n packet cross network namespace boundaries. This is the only cases\n where we clearly want to reset nf_trace and is also what the\n original patch intended to fix.\n\nAdd a new function nf_reset_trace() and use it in dev_forward_skb() to\nfix this properly.\n\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "617f13b4194b6aad612733a932bc89d883d9325e", "tree": "ab3ae7170a72801d5b9cca9092abc09d05b02747", "parents": [ "ef95e3d5d7325b87ca22c4aa72710ac152315559" ], "author": { "name": "Vlad Yasevich", "email": "vyasevic@redhat.com", "time": "Tue Apr 02 17:10:07 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:06 2013 -0700" }, "message": "net: count hw_addr syncs so that unsync works properly.\n\n[ Upstream commit 4543fbefe6e06a9e40d9f2b28d688393a299f079 ]\n\nA few drivers use dev_uc_sync/unsync to synchronize the\naddress lists from master down to slave/lower devices. In\nsome cases (bond/team) a single address list is synched down\nto multiple devices. At the time of unsync, we have a leak\nin these lower devices, because \"synced\" is treated as a\nboolean and the address will not be unsynced for anything after\nthe first device/call.\n\nTreat \"synced\" as a count (same as refcount) and allow all\nunsync calls to work.\n\nSigned-off-by: Vlad Yasevich \u003cvyasevic@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c420060e7b21368c21972e8a29e4ff56abb9d219", "tree": "069e6e4afb23f00817a7daf0bec549435359ab27", "parents": [ "726cc91ed26521f3e678346e5745203a70edd456" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 16 13:45:37 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:56 2013 -0700" }, "message": "vm: add vm_iomap_memory() helper function\n\ncommit b4cbb197c7e7a68dbad0d491242e3ca67420c13e upstream.\n\nVarious drivers end up replicating the code to mmap() their memory\nbuffers into user space, and our core memory remapping function may be\nvery flexible but it is unnecessarily complicated for the common cases\nto use.\n\nOur internal VM uses pfn\u0027s (\"page frame numbers\") which simplifies\nthings for the VM, and allows us to pass physical addresses around in a\ndenser and more efficient format than passing a \"phys_addr_t\" around,\nand having to shift it up and down by the page size. But it just means\nthat drivers end up doing that shifting instead at the interface level.\n\nIt also means that drivers end up mucking around with internal VM things\nlike the vma details (vm_pgoff, vm_start/end) way more than they really\nneed to.\n\nSo this just exports a function to map a certain physical memory range\ninto user space (using a phys_addr_t based interface that is much more\nnatural for a driver) and hides all the complexity from the driver.\nSome drivers will still end up tweaking the vm_page_prot details for\nthings like prefetching or cacheability etc, but that\u0027s actually\nrelevant to the driver, rather than caring about what the page offset of\nthe mapping is into the particular IO memory region.\n\nAcked-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n\n" }, { "commit": "d6b8c333ca71eba35911fc4460ca37568ccfa9c0", "tree": "da26dfb9cb9e1e4b672dd22bea47f4486bf6d75b", "parents": [ "f4ec6e0f475dd23157042a150c8f3dcfa528a8ca" ], "author": { "name": "Rafał Miłecki", "email": "zajec5@gmail.com", "time": "Tue Apr 02 15:57:26 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "ssb: implement spurious tone avoidance\n\ncommit 46fc4c909339f5a84d1679045297d9d2fb596987 upstream.\n\nAnd make use of it in b43. This fixes a regression introduced with\n49d55cef5b1925a5c1efb6aaddaa40fc7c693335\nb43: N-PHY: implement spurious tone avoidance\nThis commit made BCM4322 use only MCS 0 on channel 13, which of course\nresulted in performance drop (down to 0.7Mb/s).\n\nReported-by: Stefan Brüns \u003cstefan.bruens@rwth-aachen.de\u003e\nSigned-off-by: Rafał Miłecki \u003czajec5@gmail.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2a6b0247eee46f424e032fb7431cc4700ad19ea5", "tree": "99660b47a9ccc8e1123f4363ca0a95875a7f7ea6", "parents": [ "f56d137aa68f8edadac247aa48b335f2776954ff" ], "author": { "name": "Andrew Honig", "email": "ahonig@google.com", "time": "Fri Mar 29 09:35:21 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "KVM: Allow cross page reads and writes from cached translations.\n\ncommit 8f964525a121f2ff2df948dac908dcc65be21b5b upstream.\n\nThis patch adds support for kvm_gfn_to_hva_cache_init functions for\nreads and writes that will cross a page. If the range falls within\nthe same memslot, then this will be a fast operation. If the range\nis split between two memslots, then the slower kvm_read_guest and\nkvm_write_guest are used.\n\nTested: Test against kvm_clock unit tests.\n\nSigned-off-by: Andrew Honig \u003cahonig@google.com\u003e\nSigned-off-by: Gleb Natapov \u003cgleb@redhat.com\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e3a55052f4773105dbd23f72dec4aeac82dea871", "tree": "287ba056309faab0f819fa03b74f6770430d5b49", "parents": [ "7077c66b3ab3a1d336648cf88f54df43709ebac3" ], "author": { "name": "Thomas Hellstrom", "email": "thellstrom@vmware.com", "time": "Tue Nov 06 11:31:49 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "kref: Implement kref_get_unless_zero v3\n\ncommit 4b20db3de8dab005b07c74161cb041db8c5ff3a7 upstream.\n\nThis function is intended to simplify locking around refcounting for\nobjects that can be looked up from a lookup structure, and which are\nremoved from that lookup structure in the object destructor.\nOperations on such objects require at least a read lock around\nlookup + kref_get, and a write lock around kref_put + remove from lookup\nstructure. Furthermore, RCU implementations become extremely tricky.\nWith a lookup followed by a kref_get_unless_zero *with return value check*\nlocking in the kref_put path can be deferred to the actual removal from\nthe lookup structure and RCU lookups become trivial.\n\nv2: Formatting fixes.\nv3: Invert the return value.\n\nSigned-off-by: Thomas Hellstrom \u003cthellstrom@vmware.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a227904b82c591bf9531b9deac1e60fbe96abfed", "tree": "b8842e19626ce583e64546b9ae20fabee91a53e8", "parents": [ "261c874090bde0efb5040608d8123d5f0fadcac8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 09 10:48:33 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 12 09:38:46 2013 -0700" }, "message": "spinlocks and preemption points need to be at least compiler barriers\n\ncommit 386afc91144b36b42117b0092893f15bc8798a80 upstream.\n\nIn UP and non-preempt respectively, the spinlocks and preemption\ndisable/enable points are stubbed out entirely, because there is no\nregular code that can ever hit the kind of concurrency they are meant to\nprotect against.\n\nHowever, while there is no regular code that can cause scheduling, we\n_do_ end up having some exceptional (literally!) code that can do so,\nand that we need to make sure does not ever get moved into the critical\nregion by the compiler.\n\nIn particular, get_user() and put_user() is generally implemented as\ninline asm statements (even if the inline asm may then make a call\ninstruction to call out-of-line), and can obviously cause a page fault\nand IO as a result. If that inline asm has been scheduled into the\nmiddle of a preemption-safe (or spinlock-protected) code region, we\nobviously lose.\n\nNow, admittedly this is *very* unlikely to actually ever happen, and\nwe\u0027ve not seen examples of actual bugs related to this. But partly\nexactly because it\u0027s so hard to trigger and the resulting bug is so\nsubtle, we should be extra careful to get this right.\n\nSo make sure that even when preemption is disabled, and we don\u0027t have to\ngenerate any actual *code* to explicitly tell the system that we are in\na preemption-disabled region, we need to at least tell the compiler not\nto move things around the critical region.\n\nThis patch grew out of the same discussion that caused commits\n79e5f05edcbf (\"ARC: Add implicit compiler barrier to raw_local_irq*\nfunctions\") and 3e2e0d2c222b (\"tile: comment assumption about\n__insn_mtspr for \u003casm/irqflags.h\u003e\") to come about.\n\nNote for stable: use discretion when/if applying this. As mentioned,\nthis bug may never have actually bitten anybody, and gcc may never have\ndone the required code motion for it to possibly ever trigger in\npractice.\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Steven Rostedt \u003csrostedt@redhat.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "284aeebb312c2b2464673bf68b9a32e415b5145a", "tree": "71fbc5fdade725cba28c6fe25da459cdd7a5d4b8", "parents": [ "57b41f6193014b2a4a67c270dd77d801fd337d98" ], "author": { "name": "Shan Hai", "email": "shan.hai@windriver.com", "time": "Mon Mar 18 10:30:44 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 12 09:38:44 2013 -0700" }, "message": "libata: Set max sector to 65535 for Slimtype DVD A DS8A8SH drive\n\ncommit a32450e127fc6e5ca6d958ceb3cfea4d30a00846 upstream.\n\nThe Slimtype DVD A DS8A8SH drive locks up when max sector is smaller than\n65535, and the blow backtrace is observed on locking up:\n\nINFO: task flush-8:32:1130 blocked for more than 120 seconds.\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\nflush-8:32 D ffffffff8180cf60 0 1130 2 0x00000000\n ffff880273aef618 0000000000000046 0000000000000005 ffff880273aee000\n ffff880273aee000 ffff880273aeffd8 ffff880273aee010 ffff880273aee000\n ffff880273aeffd8 ffff880273aee000 ffff88026e842ea0 ffff880274a10000\nCall Trace:\n [\u003cffffffff8168fc2d\u003e] schedule+0x5d/0x70\n [\u003cffffffff8168fccc\u003e] io_schedule+0x8c/0xd0\n [\u003cffffffff81324461\u003e] get_request+0x731/0x7d0\n [\u003cffffffff8133dc60\u003e] ? cfq_allow_merge+0x50/0x90\n [\u003cffffffff81083aa0\u003e] ? wake_up_bit+0x40/0x40\n [\u003cffffffff81320443\u003e] ? bio_attempt_back_merge+0x33/0x110\n [\u003cffffffff813248ea\u003e] blk_queue_bio+0x23a/0x3f0\n [\u003cffffffff81322176\u003e] generic_make_request+0xc6/0x120\n [\u003cffffffff81322308\u003e] submit_bio+0x138/0x160\n [\u003cffffffff811d7596\u003e] ? bio_alloc_bioset+0x96/0x120\n [\u003cffffffff811d1f61\u003e] submit_bh+0x1f1/0x220\n [\u003cffffffff811d48b8\u003e] __block_write_full_page+0x228/0x340\n [\u003cffffffff811d3650\u003e] ? attach_nobh_buffers+0xc0/0xc0\n [\u003cffffffff811d8960\u003e] ? I_BDEV+0x10/0x10\n [\u003cffffffff811d8960\u003e] ? I_BDEV+0x10/0x10\n [\u003cffffffff811d4ab6\u003e] block_write_full_page_endio+0xe6/0x100\n [\u003cffffffff811d4ae5\u003e] block_write_full_page+0x15/0x20\n [\u003cffffffff811d9268\u003e] blkdev_writepage+0x18/0x20\n [\u003cffffffff81142527\u003e] __writepage+0x17/0x40\n [\u003cffffffff811438ba\u003e] write_cache_pages+0x34a/0x4a0\n [\u003cffffffff81142510\u003e] ? set_page_dirty+0x70/0x70\n [\u003cffffffff81143a61\u003e] generic_writepages+0x51/0x80\n [\u003cffffffff81143ab0\u003e] do_writepages+0x20/0x50\n [\u003cffffffff811c9ed6\u003e] __writeback_single_inode+0xa6/0x2b0\n [\u003cffffffff811ca861\u003e] writeback_sb_inodes+0x311/0x4d0\n [\u003cffffffff811caaa6\u003e] __writeback_inodes_wb+0x86/0xd0\n [\u003cffffffff811cad43\u003e] wb_writeback+0x1a3/0x330\n [\u003cffffffff816916cf\u003e] ? _raw_spin_lock_irqsave+0x3f/0x50\n [\u003cffffffff811b8362\u003e] ? get_nr_inodes+0x52/0x70\n [\u003cffffffff811cb0ac\u003e] wb_do_writeback+0x1dc/0x260\n [\u003cffffffff8168dd34\u003e] ? schedule_timeout+0x204/0x240\n [\u003cffffffff811cb232\u003e] bdi_writeback_thread+0x102/0x2b0\n [\u003cffffffff811cb130\u003e] ? wb_do_writeback+0x260/0x260\n [\u003cffffffff81083550\u003e] kthread+0xc0/0xd0\n [\u003cffffffff81083490\u003e] ? kthread_worker_fn+0x1b0/0x1b0\n [\u003cffffffff8169a3ec\u003e] ret_from_fork+0x7c/0xb0\n [\u003cffffffff81083490\u003e] ? kthread_worker_fn+0x1b0/0x1b0\n\n The above trace was triggered by\n \"dd if\u003d/dev/zero of\u003d/dev/sr0 bs\u003d2048 count\u003d32768\"\n\n It was previously working by accident, since another bug introduced\n by 4dce8ba94c7 (libata: Use \u0027bool\u0027 return value for ata_id_XXX) caused\n all drives to use maxsect\u003d65535.\n\nSigned-off-by: Shan Hai \u003cshan.hai@windriver.com\u003e\nSigned-off-by: Jeff Garzik \u003cjgarzik@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "57b41f6193014b2a4a67c270dd77d801fd337d98", "tree": "e7ba3d038511ab08027428518796f3edeaf8dc92", "parents": [ "91777f102bc6c5d72bf637281b74ba96c1447850" ], "author": { "name": "Shan Hai", "email": "shan.hai@windriver.com", "time": "Mon Mar 18 10:30:43 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 12 09:38:44 2013 -0700" }, "message": "libata: Use integer return value for atapi_command_packet_set\n\ncommit d8668fcb0b257d9fdcfbe5c172a99b8d85e1cd82 upstream.\n\nThe function returns type of ATAPI drives so it should return integer value.\nThe commit 4dce8ba94c7 (libata: Use \u0027bool\u0027 return value for ata_id_XXX) since\nv2.6.39 changed the type of return value from int to bool, the change would\ncause all of the ATAPI class drives to be treated as TYPE_TAPE and the\nmax_sectors of the drives to be set to 65535 because of the commit\nf8d8e5799b7(libata: increase 128 KB / cmd limit for ATAPI tape drives), for the\nfunction would return true for all ATAPI class drives and the TYPE_TAPE is\ndefined as 0x01.\n\nSigned-off-by: Shan Hai \u003cshan.hai@windriver.com\u003e\nSigned-off-by: Jeff Garzik \u003cjgarzik@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a9304844277ca08288b54df5ee9201c5ce3e4cbf", "tree": "1bca8c782dbd681644066a6f512beacc8f41801c", "parents": [ "71ec40e8f0a5eefca7b318f133f90dc4f2302c4f" ], "author": { "name": "Andrey Vagin", "email": "avagin@openvz.org", "time": "Thu Mar 21 20:33:46 2013 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:40 2013 -0700" }, "message": "net: fix *_DIAG_MAX constants\n\n[ Upstream commit ae5fc98728c8bbbd6d7cab0b9781671fc4419c1b ]\n\nFollow the common pattern and define *_DIAG_MAX like:\n\n [...]\n __XXX_DIAG_MAX,\n};\n\nBecause everyone is used to do:\n\n struct nlattr *attrs[XXX_DIAG_MAX+1];\n\n nla_parse([...], XXX_DIAG_MAX, [...]\n\nReported-by: Thomas Graf \u003ctgraf@suug.ch\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: \"Paul E. McKenney\" \u003cpaulmck@linux.vnet.ibm.com\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrey Vagin \u003cavagin@openvz.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b9f3bf1d0fe1e9ef11d1d607906138e9f84f7616", "tree": "34b9e1f7679eb5f563c0e506ff811d736878774c", "parents": [ "a83417946df6c57fbb4d4383c992c5ffd59b56c2" ], "author": { "name": "Masatake YAMATO", "email": "yamato@redhat.com", "time": "Mon Apr 01 14:50:40 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:38 2013 -0700" }, "message": "thermal: shorten too long mcast group name\n\n[ Upstream commits 73214f5d9f33b79918b1f7babddd5c8af28dd23d\n and f1e79e208076ffe7bad97158275f1c572c04f5c7, the latter\n adds an assertion to genetlink to prevent this from happening\n again in the future. ]\n\nThe original name is too long.\n\nSigned-off-by: Masatake YAMATO \u003cyamato@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "119016c59b6a83cf168f0f1202f2251122f0d5b3", "tree": "8a9ccdc968b15db1a845276aaa9be4492c8b2986", "parents": [ "2c0260b234031e0dd0266baafbc4d8e1eb580bb6" ], "author": { "name": "David Vrabel", "email": "david.vrabel@citrix.com", "time": "Thu Mar 07 17:32:01 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:18 2013 -0700" }, "message": "xen/blkback: correctly respond to unknown, non-native requests\n\ncommit 0e367ae46503cfe7791460c8ba8434a5d60b2bd5 upstream.\n\nIf the frontend is using a non-native protocol (e.g., a 64-bit\nfrontend with a 32-bit backend) and it sent an unrecognized request,\nthe request was not translated and the response would have the\nincorrect ID. This may cause the frontend driver to behave\nincorrectly or crash.\n\nSince the ID field in the request is always in the same place,\nregardless of the request type we can get the correct ID and make a\nvalid response (which will report BLKIF_RSP_EOPNOTSUPP).\n\nThis bug affected 64-bit SLES 11 guests when using a 32-bit backend.\nThis guest does a BLKIF_OP_RESERVED_1 (BLKIF_OP_PACKET in the SLES\nsource) and would crash in blkif_int() as the ID in the response would\nbe invalid.\n\nSigned-off-by: David Vrabel \u003cdavid.vrabel@citrix.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "556ba7075b9b95a0439cd7b52a1284b88b8fa755", "tree": "83030591531a58bc4419a77e30123aedaaf5a33f", "parents": [ "f3b5af9a6e2a873110bb8546b42ae7c51f2213b3" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Sun Nov 25 22:24:19 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:14 2013 -0700" }, "message": "signal: Define __ARCH_HAS_SA_RESTORER so we know whether to clear sa_restorer\n\nVaguely based on upstream commit 574c4866e33d \u0027consolidate kernel-side\nstruct sigaction declarations\u0027.\n\nflush_signal_handlers() needs to know whether sigaction::sa_restorer\nis defined, not whether SA_RESTORER is defined. Define the\n__ARCH_HAS_SA_RESTORER macro to indicate this.\n\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "023eae6de094c527f85c5fc3e9a8a364af56b1af", "tree": "899b193a9ba356d2ac6b404a93b1c2545407d709", "parents": [ "2f7dea37d1b0b3a26fb3c2bd97bbf836dfd04def" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Mon Dec 17 16:03:20 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:28 2013 -0700" }, "message": "exec: use -ELOOP for max recursion depth\n\ncommit d740269867021faf4ce38a449353d2b986c34a67 upstream.\n\nTo avoid an explosion of request_module calls on a chain of abusive\nscripts, fail maximum recursion with -ELOOP instead of -ENOEXEC. As soon\nas maximum recursion depth is hit, the error will fail all the way back\nup the chain, aborting immediately.\n\nThis also has the side-effect of stopping the user\u0027s shell from attempting\nto reexecute the top-level file as a shell script. As seen in the\ndash source:\n\n if (cmd !\u003d path_bshell \u0026\u0026 errno \u003d\u003d ENOEXEC) {\n *argv-- \u003d cmd;\n *argv \u003d cmd \u003d path_bshell;\n goto repeat;\n }\n\nThe above logic was designed for running scripts automatically that lacked\nthe \"#!\" header, not to re-try failed recursion. On a legitimate -ENOEXEC,\nthings continue to behave as the shell expects.\n\nAdditionally, when tracking recursion, the binfmt handlers should not be\ninvolved. The recursion being tracked is the depth of calls through\nsearch_binary_handler(), so that function should be exclusively responsible\nfor tracking the depth.\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: halfdog \u003cme@halfdog.net\u003e\nCc: P J P \u003cppandit@redhat.com\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2cf470d198f3bf272910dff8f039ee77fc61db0c", "tree": "a066dce503e92cda81afdea687cd2e29e0a19a87", "parents": [ "6e8d94de159e7520e6ff1ecaf8419844b93631e7" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Mar 08 13:36:54 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:13 2013 -0700" }, "message": "drm/radeon: add Richland pci ids\n\ncommit b75bbaa038ffc426e88ea3df6c4ae11834fc3e4f upstream.\n\nReviewed-by: Jerome Glisse \u003cjglisse@redhat.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1280938465132080915aef414a1f40f62831bab9", "tree": "a2055fce3874fea9ddec94d17658e7d3ec18dc66", "parents": [ "05bec9da3978124bde3b40bfa0404760f45aa399" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Fri Mar 15 11:32:30 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:11:54 2013 -0700" }, "message": "inet: limit length of fragment queue hash table bucket lists\n\n[ Upstream commit 5a3da1fe9561828d0ca7eca664b16ec2b9bf0055 ]\n\nThis patch introduces a constant limit of the fragment queue hash\ntable bucket list lengths. Currently the limit 128 is choosen somewhat\narbitrary and just ensures that we can fill up the fragment cache with\nempty packets up to the default ip_frag_high_thresh limits. It should\njust protect from list iteration eating considerable amounts of cpu.\n\nIf we reach the maximum length in one hash bucket a warning is printed.\nThis is implemented on the caller side of inet_frag_find to distinguish\nbetween the different users of inet_fragment.c.\n\nI dropped the out of memory warning in the ipv4 fragment lookup path,\nbecause we already get a warning by the slab allocator.\n\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: Jesper Dangaard Brouer \u003cjbrouer@redhat.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b6da578e2a610a64e89f2a983f7675eb301c5d35", "tree": "e9a01ac902578dcb3c0cca6b9126e294d02942a7", "parents": [ "6a2d122cdd939e33279baf351c7cbf12c50eaeb5" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Mar 14 05:40:32 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:11:53 2013 -0700" }, "message": "tcp: fix skb_availroom()\n\n[ Upstream commit 16fad69cfe4adbbfa813de516757b87bcae36d93 ]\n\nChrome OS team reported a crash on a Pixel ChromeBook in TCP stack :\n\nhttps://code.google.com/p/chromium/issues/detail?id\u003d182056\n\ncommit a21d45726acac (tcp: avoid order-1 allocations on wifi and tx\npath) did a poor choice adding an \u0027avail_size\u0027 field to skb, while\nwhat we really needed was a \u0027reserved_tailroom\u0027 one.\n\nIt would have avoided commit 22b4a4f22da (tcp: fix retransmit of\npartially acked frames) and this commit.\n\nCrash occurs because skb_split() is not aware of the \u0027avail_size\u0027\nmanagement (and should not be aware)\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: Mukesh Agrawal \u003cquiche@chromium.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6a2d122cdd939e33279baf351c7cbf12c50eaeb5", "tree": "d33d3ae99144bd170bd0453016fa85b2eae75ad6", "parents": [ "ca42fad953eab535f12b04cea9622b253faebb0b" ], "author": { "name": "Denis V. Lunev", "email": "den@openvz.org", "time": "Wed Mar 13 00:24:15 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:11:53 2013 -0700" }, "message": "ipv4: fix definition of FIB_TABLE_HASHSZ\n\n[ Upstream commit 5b9e12dbf92b441b37136ea71dac59f05f2673a9 ]\n\na long time ago by the commit\n\n commit 93456b6d7753def8760b423ac6b986eb9d5a4a95\n Author: Denis V. Lunev \u003cden@openvz.org\u003e\n Date: Thu Jan 10 03:23:38 2008 -0800\n\n [IPV4]: Unify access to the routing tables.\n\nthe defenition of FIB_HASH_TABLE size has obtained wrong dependency:\nit should depend upon CONFIG_IP_MULTIPLE_TABLES (as was in the original\ncode) but it was depended from CONFIG_IP_ROUTE_MULTIPATH\n\nThis patch returns the situation to the original state.\n\nThe problem was spotted by Tingwei Liu.\n\nSigned-off-by: Denis V. Lunev \u003cden@openvz.org\u003e\nCC: Tingwei Liu \u003ctingw.liu@gmail.com\u003e\nCC: Alexey Kuznetsov \u003ckuznet@ms2.inr.ac.ru\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "cb505e2eb68fe9e22afa220bf172f6aa090b7dca", "tree": "d1b25dcc977afffedbca41ee63b331c6f49f1f00", "parents": [ "a40a945f829a2b95d5460491d81061166817e3cb" ], "author": { "name": "Johan Hovold", "email": "jhovold@gmail.com", "time": "Tue Feb 05 14:35:11 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 20 13:05:00 2013 -0700" }, "message": "atmel_lcdfb: fix 16-bpp modes on older SOCs\n\ncommit a79eac7165ed62114e6ca197195aa5060a54f137 upstream.\n\nFix regression introduced by commit 787f9fd23283 (\"atmel_lcdfb: support\n16bit BGR:565 mode, remove unsupported 15bit modes\") which broke 16-bpp\nmodes for older SOCs which use IBGR:555 (msb is intensity) rather\nthan BGR:565.\n\nUse SOC-type to determine the pixel layout.\n\nTested on at91sam9263 and at91sam9g45.\n\nAcked-by: Peter Korsgaard \u003cjacmet@sunsite.dk\u003e\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Nicolas Ferre \u003cnicolas.ferre@atmel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6bf083ffc825244992274a23017655caee8e4c58", "tree": "e74f39428f6ed033b83b5e1e227d9883669fee7c", "parents": [ "d7805638b85ce978f7c0cf1ac49204d4288084f6" ], "author": { "name": "David Rientjes", "email": "rientjes@google.com", "time": "Sun Mar 17 15:49:10 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 20 13:05:00 2013 -0700" }, "message": "perf,x86: fix link failure for non-Intel configs\n\ncommit 6c4d3bc99b3341067775efd4d9d13cc8e655fd7c upstream.\n\nCommit 1d9d8639c063 (\"perf,x86: fix kernel crash with PEBS/BTS after\nsuspend/resume\") introduces a link failure since\nperf_restore_debug_store() is only defined for CONFIG_CPU_SUP_INTEL:\n\n\tarch/x86/power/built-in.o: In function `restore_processor_state\u0027:\n\t(.text+0x45c): undefined reference to `perf_restore_debug_store\u0027\n\nFix it by defining the dummy function appropriately.\n\nSigned-off-by: David Rientjes \u003crientjes@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9a9b01c04ef4b844f64bbf36987f918e64e304a2", "tree": "12cd294a8b45e518c2083f399ef67b22348039df", "parents": [ "75750fc43320a6b2ef9852b3437fa25104add6f6" ], "author": { "name": "Stephane Eranian", "email": "eranian@google.com", "time": "Fri Mar 15 14:26:07 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 20 13:04:59 2013 -0700" }, "message": "perf,x86: fix kernel crash with PEBS/BTS after suspend/resume\n\ncommit 1d9d8639c063caf6efc2447f5f26aa637f844ff6 upstream.\n\nThis patch fixes a kernel crash when using precise sampling (PEBS)\nafter a suspend/resume. Turns out the CPU notifier code is not invoked\non CPU0 (BP). Therefore, the DS_AREA (used by PEBS) is not restored properly\nby the kernel and keeps it power-on/resume value of 0 causing any PEBS\nmeasurement to crash when running on CPU0.\n\nThe workaround is to add a hook in the actual resume code to restore\nthe DS Area MSR value. It is invoked for all CPUS. So for all but CPU0,\nthe DS_AREA will be restored twice but this is harmless.\n\nReported-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Stephane Eranian \u003ceranian@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "68412b1718c488e58783d1c576d0aeb34012092d", "tree": "369e927a49f4b7a3e652783d83d8660fc7eca529", "parents": [ "06f924f163e4426ce6a8d4cf61b45f2fc8eaeecc" ], "author": { "name": "Seiji Aguchi", "email": "seiji.aguchi@hds.com", "time": "Fri Jan 11 18:09:41 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Mar 04 06:06:43 2013 +0800" }, "message": "pstore: Avoid deadlock in panic and emergency-restart path\n\ncommit 9f244e9cfd70c7c0f82d3c92ce772ab2a92d9f64 upstream.\n\n[Issue]\n\nWhen pstore is in panic and emergency-restart paths, it may be blocked\nin those paths because it simply takes spin_lock.\n\nThis is an example scenario which pstore may hang up in a panic path:\n\n - cpuA grabs psinfo-\u003ebuf_lock\n - cpuB panics and calls smp_send_stop\n - smp_send_stop sends IRQ to cpuA\n - after 1 second, cpuB gives up on cpuA and sends an NMI instead\n - cpuA is now in an NMI handler while still holding buf_lock\n - cpuB is deadlocked\n\nThis case may happen if a firmware has a bug and\ncpuA is stuck talking with it more than one second.\n\nAlso, this is a similar scenario in an emergency-restart path:\n\n - cpuA grabs psinfo-\u003ebuf_lock and stucks in a firmware\n - cpuB kicks emergency-restart via either sysrq-b or hangcheck timer.\n And then, cpuB is deadlocked by taking psinfo-\u003ebuf_lock again.\n\n[Solution]\n\nThis patch avoids the deadlocking issues in both panic and emergency_restart\npaths by introducing a function, is_non_blocking_path(), to check if a cpu\ncan be blocked in current path.\n\nWith this patch, pstore is not blocked even if another cpu has\ntaken a spin_lock, in those paths by changing from spin_lock_irqsave\nto spin_trylock_irqsave.\n\nIn addition, according to a comment of emergency_restart() in kernel/sys.c,\nspin_lock shouldn\u0027t be taken in an emergency_restart path to avoid\ndeadlock. This patch fits the comment below.\n\n\u003csnip\u003e\n/**\n * emergency_restart - reboot the system\n *\n * Without shutting down any hardware or taking any locks\n * reboot the system. This is called when we know we are in\n * trouble so this is our best effort to reboot. This is\n * safe to call in interrupt context.\n */\nvoid emergency_restart(void)\n\u003csnip\u003e\n\nSigned-off-by: Seiji Aguchi \u003cseiji.aguchi@hds.com\u003e\nAcked-by: Don Zickus \u003cdzickus@redhat.com\u003e\nSigned-off-by: Tony Luck \u003ctony.luck@intel.com\u003e\nCc: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "57ef0d83d393b0f1f378a6b18a7394c62caadafa", "tree": "ff6a2a11496d63cad0d9a0a5a2f9ead1e894c1fb", "parents": [ "146207bbadeb4578334d6e26b9b690df8aeb1a3d" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Mon Feb 04 19:39:52 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Mar 04 06:06:43 2013 +0800" }, "message": "unbreak automounter support on 64-bit kernel with 32-bit userspace (v2)\n\ncommit 4f4ffc3a5398ef9bdbb32db04756d7d34e356fcf upstream.\n\nautomount-support is broken on the parisc architecture, because the existing\n#if list does not include a check for defined(__hppa__). The HPPA (parisc)\narchitecture is similiar to other 64bit Linux targets where we have to define\nautofs_wqt_t (which is passed back and forth to user space) as int type which\nhas a size of 32bit across 32 and 64bit kernels.\n\nDuring the discussion on the mailing list, H. Peter Anvin suggested to invert\nthe #if list since only specific platforms (specifically those who do not have\na 32bit userspace, like IA64 and Alpha) should have autofs_wqt_t as unsigned\nlong type.\n\nThis suggestion is probably the best way to go, since Arm64 (and maybe others?)\nseems to have a non-working automounter. So in the long run even for other new\nupcoming architectures this inverted check seem to be the best solution, since\nit will not require them to change this #if again (unless they are 64bit only).\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\nAcked-by: H. Peter Anvin \u003chpa@zytor.com\u003e\nAcked-by: Ian Kent \u003craven@themaw.net\u003e\nAcked-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCC: James Bottomley \u003cJames.Bottomley@HansenPartnership.com\u003e\nCC: Rolf Eike Beer \u003ceike-kernel@sf-tec.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "db6154ead40e0a568982ec4885cfa3fa89e67324", "tree": "3603b25bad619e22def94ba2205afdbe8e4415bf", "parents": [ "dd54ec4067a23236736afecbda120030d7ce8fe9" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Jan 24 23:24:56 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Mar 04 06:06:37 2013 +0800" }, "message": "quota: autoload the quota_v2 module for QFMT_VFS_V1 quota format\n\ncommit c3ad83d9efdfe6a86efd44945a781f00c879b7b4 upstream.\n\nOtherwise, ext4 file systems with the quota featured enable will get a\nvery confusing \"No such process\" error message if the quota code is\nbuilt as a module and the quota_v2 module has not been loaded.\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nAcked-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b9bf60ac3e3779d4ffa03daceebf59df7b46c224", "tree": "92b29a20a04ca4aab9b8cf52fd4b3b99371add87", "parents": [ "8c2223fc19032e7b8761e46c15e1ed167a252285" ], "author": { "name": "Cong Wang", "email": "amwang@redhat.com", "time": "Thu Feb 21 23:32:27 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:06 2013 -0800" }, "message": "vlan: adjust vlan_set_encap_proto() for its callers\n\n[ Upstream commit da8c87241c26aac81a64c7e4d21d438a33018f4e ]\n\nThere are two places to call vlan_set_encap_proto():\nvlan_untag() and __pop_vlan_tci().\n\nvlan_untag() assumes skb-\u003edata points after mac addr, otherwise\nthe following code\n\n vhdr \u003d (struct vlan_hdr *) skb-\u003edata;\n vlan_tci \u003d ntohs(vhdr-\u003eh_vlan_TCI);\n __vlan_hwaccel_put_tag(skb, vlan_tci);\n\n skb_pull_rcsum(skb, VLAN_HLEN);\n\nwon\u0027t be correct. But __pop_vlan_tci() assumes points _before_\nmac addr.\n\nIn vlan_set_encap_proto(), it looks for some magic L2 value\nafter mac addr:\n\n rawp \u003d skb-\u003edata;\n if (*(unsigned short *) rawp \u003d\u003d 0xFFFF)\n\t...\n\nTherefore __pop_vlan_tci() is obviously wrong.\n\nA quick fix is avoiding using skb-\u003edata in vlan_set_encap_proto(),\nuse \u0027vhdr+1\u0027 is always correct in both cases.\n\nSigned-off-by: Cong Wang \u003camwang@redhat.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Jesse Gross \u003cjesse@nicira.com\u003e\nAcked-by: Jesse Gross \u003cjesse@nicira.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e5a096aa0aeb1fc8ad8b3d6bd70d322a0d65edc4", "tree": "d5055028b4ac0b56b49b6d65237038c5c7f46778", "parents": [ "785e5dce256ea5bdf4871af13f9908b74264b515" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Feb 21 12:18:52 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:06 2013 -0800" }, "message": "ipv6: use a stronger hash for tcp\n\n[ Upstream commit 08dcdbf6a7b9d14c2302c5bd0c5390ddf122f664 ]\n\nIt looks like its possible to open thousands of TCP IPv6\nsessions on a server, all landing in a single slot of TCP hash\ntable. Incoming packets have to lookup sockets in a very\nlong list.\n\nWe should hash all bits from foreign IPv6 addresses, using\na salt and hash mix, not a simple XOR.\n\ninet6_ehashfn() can also separately use the ports, instead\nof xoring them.\n\nReported-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Yuchung Cheng \u003cycheng@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1e6b5fb5ce92028f6c87864712ed7290446a4c11", "tree": "0426fe2c4e1f79732c2957659a0adc6e4476cdcb", "parents": [ "29b3bb0be43fea0a49e5235894e1dcbc0ac299dc" ], "author": { "name": "Ying Xue", "email": "ying.xue@windriver.com", "time": "Fri Feb 15 22:28:25 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:06 2013 -0800" }, "message": "net: fix a compile error when SOCK_REFCNT_DEBUG is enabled\n\n[ Upstream commit dec34fb0f5b7873de45132a84a3af29e61084a6b ]\n\nWhen SOCK_REFCNT_DEBUG is enabled, below build error is met:\n\nkernel/sysctl_binary.o: In function `sk_refcnt_debug_release\u0027:\ninclude/net/sock.h:1025: multiple definition of `sk_refcnt_debug_release\u0027\nkernel/sysctl.o:include/net/sock.h:1025: first defined here\nkernel/audit.o: In function `sk_refcnt_debug_release\u0027:\ninclude/net/sock.h:1025: multiple definition of `sk_refcnt_debug_release\u0027\nkernel/sysctl.o:include/net/sock.h:1025: first defined here\nmake[1]: *** [kernel/built-in.o] Error 1\nmake: *** [kernel] Error 2\n\nSo we decide to make sk_refcnt_debug_release static to eliminate\nthe error.\n\nSigned-off-by: Ying Xue \u003cying.xue@windriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f515e1d59602f8eafaad39b6842bd823ad34654e", "tree": "48d183d9d59e79c35719953ef85b489641f4e598", "parents": [ "c30b55c385288be48f7accd16a6929ad4d983311" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri Jan 25 10:28:18 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:05 2013 -0800" }, "message": "fb: Yet another band-aid for fixing lockdep mess\n\ncommit e93a9a868792ad71cdd09d75e5a02d8067473c4e upstream.\n\nI\u0027ve still got lockdep warnings even after Alan\u0027s patch, and it seems that\nyet more band aids are required to paper over similar paths for\nunbind_con_driver() and unregister_con_driver(). After this hack, lockdep\nwarnings are finally gone.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nCc: Alan Cox \u003calan@linux.intel.com\u003e\nCc: Florian Tobias Schandinat \u003cFlorianSchandinat@gmx.de\u003e\nCc: Jiri Kosina \u003cjkosina@suse.cz\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c30b55c385288be48f7accd16a6929ad4d983311", "tree": "1588731963ecab2c47c3999d7691a095ab591d0e", "parents": [ "62a3dcc78d04dcd84276eaa7a40dec1066054532" ], "author": { "name": "Alan Cox", "email": "alan@linux.intel.com", "time": "Fri Jan 25 10:28:15 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:05 2013 -0800" }, "message": "fb: rework locking to fix lock ordering on takeover\n\ncommit 50e244cc793d511b86adea24972f3a7264cae114 upstream.\n\nAdjust the console layer to allow a take over call where the caller\nalready holds the locks. Make the fb layer lock in order.\n\nThis is partly a band aid, the fb layer is terminally confused about the\nlocking rules it uses for its notifiers it seems.\n\n[akpm@linux-foundation.org: remove stray non-ascii char, tidy comment]\n[akpm@linux-foundation.org: export do_take_over_console()]\n[airlied: cleanup another non-ascii char]\nSigned-off-by: Alan Cox \u003calan@linux.intel.com\u003e\nCc: Florian Tobias Schandinat \u003cFlorianSchandinat@gmx.de\u003e\nCc: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nCc: Jiri Kosina \u003cjkosina@suse.cz\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nReviewed-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "df28f4890263a0540b395402b43b57f047ccf7d5", "tree": "4b8430b47afc77c27f42b094ddebd03b93982974", "parents": [ "ae4c05e0232e869cf2418ac6c0c862bb5287d672" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 24 14:14:19 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:03 2013 -0800" }, "message": "vgacon/vt: clear buffer attributes when we load a 512 character font (v2)\n\ncommit 2a2483072393b27f4336ab068a1f48ca19ff1c1e upstream.\n\nWhen we switch from 256-\u003e512 byte font rendering mode, it means the\ncurrent contents of the screen is being reinterpreted. The bit that holds\nthe high bit of the 9-bit font, may have been previously set, and thus\nthe new font misrenders.\n\nThe problem case we see is grub2 writes spaces with the bit set, so it\nends up with data like 0x820, which gets reinterpreted into 0x120 char\nwhich the font translates into G with a circumflex. This flashes up on\nscreen at boot and is quite ugly.\n\nA current side effect of this patch though is that any rendering on the\nscreen changes color to a slightly darker color, but at least the screen\nno longer corrupts.\n\nv2: as suggested by hpa, always clear the attribute space, whether we\nare are going to or from 512 chars.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e32afc122e3a808944a9f7af5612bf2a3cbea89a", "tree": "8718795508df5c4fa7fa206900fc918b50cdd294", "parents": [ "e3fc3cb2a03623b48250dd3a12378a42d276f20e" ], "author": { "name": "Pawel Moll", "email": "mail@pawelmoll.com", "time": "Thu Feb 21 01:55:50 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:02 2013 -0800" }, "message": "ALSA: usb: Fix Processing Unit Descriptor parsers\n\ncommit b531f81b0d70ffbe8d70500512483227cc532608 upstream.\n\nCommit 99fc86450c439039d2ef88d06b222fd51a779176 \"ALSA: usb-mixer:\nparse descriptors with structs\" introduced a set of useful parsers\nfor descriptors. Unfortunately the parses for the Processing Unit\nDescriptor came with a very subtle bug...\n\nFunctions uac_processing_unit_iProcessing() and\nuac_processing_unit_specific() were indexing the baSourceID array\nforgetting the fields before the iProcessing and process-specific\ndescriptors.\n\nThe problem was observed with Sound Blaster Extigy mixer,\nwhere nNrModes in Up/Down-mix Processing Unit Descriptor\nwas accessed at offset 10 of the descriptor (value 0)\ninstead of offset 15 (value 7). In result the resulting\ncontrol had interesting limit values:\n\nSimple mixer control \u0027Channel Routing Mode Select\u0027,0\n Capabilities: volume volume-joined penum\n Playback channels: Mono\n Capture channels: Mono\n Limits: 0 - -1\n Mono: -1 [100%]\n\nFixed by starting from the bmControls, which was calculated\ncorrectly, instead of baSourceID.\n\nNow the mentioned control is fine:\n\nSimple mixer control \u0027Channel Routing Mode Select\u0027,0\n Capabilities: volume volume-joined penum\n Playback channels: Mono\n Capture channels: Mono\n Limits: 0 - 6\n Mono: 0 [0%]\n\nSigned-off-by: Pawel Moll \u003cmail@pawelmoll.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4209ee0d3f7992af3903b5f9a3359f6d2f597c4b", "tree": "5009887555ccf68907acf7ff9b14c9acfed6ee00", "parents": [ "362efcc9b0ba020f9124c70c56381ed64491aeca" ], "author": { "name": "Sagi Grimberg", "email": "sagig@mellanox.co.il", "time": "Mon Oct 08 16:29:24 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:00 2013 -0800" }, "message": "mm: mmu_notifier: have mmu_notifiers use a global SRCU so they may safely schedule\n\ncommit 21a92735f660eaecf69a6f2e777f18463760ec32 upstream.\n\nWith an RCU based mmu_notifier implementation, any callout to\nmmu_notifier_invalidate_range_{start,end}() or\nmmu_notifier_invalidate_page() would not be allowed to call schedule()\nas that could potentially allow a modification to the mmu_notifier\nstructure while it is currently being used.\n\nSince srcu allocs 4 machine words per instance per cpu, we may end up\nwith memory exhaustion if we use srcu per mm. So all mms share a global\nsrcu. Note that during large mmu_notifier activity exit \u0026 unregister\npaths might hang for longer periods, but it is tolerable for current\nmmu_notifier clients.\n\nSigned-off-by: Sagi Grimberg \u003csagig@mellanox.co.il\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Haggai Eran \u003chaggaie@mellanox.com\u003e\nCc: \"Paul E. McKenney\" \u003cpaulmck@us.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ce0030c00f95cf9110d9cdcd41e901e1fb814417", "tree": "40b124b99205bd469ed156b682d7f0f4e5726e5a", "parents": [ "9ad3bfb9e26197c378d6c239180ed7bcf7c29fd8" ], "author": { "name": "Alexandre SIMON", "email": "Alexandre.Simon@univ-lorraine.fr", "time": "Fri Feb 01 15:31:54 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 21 10:04:57 2013 -0800" }, "message": "printk: fix buffer overflow when calling log_prefix function from call_console_drivers\n\nThis patch corrects a buffer overflow in kernels from 3.0 to 3.4 when calling\nlog_prefix() function from call_console_drivers().\n\nThis bug existed in previous releases but has been revealed with commit\n162a7e7500f9664636e649ba59defe541b7c2c60 (2.6.39 \u003d\u003e 3.0) that made changes\nabout how to allocate memory for early printk buffer (use of memblock_alloc).\nIt disappears with commit 7ff9554bb578ba02166071d2d487b7fc7d860d62 (3.4 \u003d\u003e 3.5)\nthat does a refactoring of printk buffer management.\n\nIn log_prefix(), the access to \"p[0]\", \"p[1]\", \"p[2]\" or\n\"simple_strtoul(\u0026p[1], \u0026endp, 10)\" may cause a buffer overflow as this\nfunction is called from call_console_drivers by passing \"\u0026LOG_BUF(cur_index)\"\nwhere the index must be masked to do not exceed the buffer\u0027s boundary.\n\nThe trick is to prepare in call_console_drivers() a buffer with the necessary\ndata (PRI field of syslog message) to be safely evaluated in log_prefix().\n\nThis patch can be applied to stable kernel branches 3.0.y, 3.2.y and 3.4.y.\n\nWithout this patch, one can freeze a server running this loop from shell :\n $ export DUMMY\u003d`cat /dev/urandom | tr -dc \u002712345AZERTYUIOPQSDFGHJKLMWXCVBNazertyuiopqsdfghjklmwxcvbn\u0027 | head -c255`\n $ while true do ; echo $DUMMY \u003e /dev/kmsg ; done\n\nThe \"server freeze\" depends on where memblock_alloc does allocate printk buffer :\nif the buffer overflow is inside another kernel allocation the problem may not\nbe revealed, else the server may hangs up.\n\nSigned-off-by: Alexandre SIMON \u003cAlexandre.Simon@univ-lorraine.fr\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "739230186fa9d6999f88c53f0cb6d07ed4234fb0", "tree": "38a80e1d83573df8e365b95d66ddd961c3abed4c", "parents": [ "a256a4c2001293548f0851b66ea8f39b704bac72" ], "author": { "name": "Matt Fleming", "email": "matt.fleming@intel.com", "time": "Wed Nov 14 09:42:35 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 14 10:48:53 2013 -0800" }, "message": "efi: Make \u0027efi_enabled\u0027 a function to query EFI facilities\n\ncommit 83e68189745ad931c2afd45d8ee3303929233e7f upstream.\n\nOriginally \u0027efi_enabled\u0027 indicated whether a kernel was booted from\nEFI firmware. Over time its semantics have changed, and it now\nindicates whether or not we are booted on an EFI machine with\nbit-native firmware, e.g. 64-bit kernel with 64-bit firmware.\n\nThe immediate motivation for this patch is the bug report at,\n\n https://bugs.launchpad.net/ubuntu-cdimage/+bug/1040557\n\nwhich details how running a platform driver on an EFI machine that is\ndesigned to run under BIOS can cause the machine to become\nbricked. Also, the following report,\n\n https://bugzilla.kernel.org/show_bug.cgi?id\u003d47121\n\ndetails how running said driver can also cause Machine Check\nExceptions. Drivers need a new means of detecting whether they\u0027re\nrunning on an EFI machine, as sadly the expression,\n\n if (!efi_enabled)\n\nhasn\u0027t been a sufficient condition for quite some time.\n\nUsers actually want to query \u0027efi_enabled\u0027 for different reasons -\nwhat they really want access to is the list of available EFI\nfacilities.\n\nFor instance, the x86 reboot code needs to know whether it can invoke\nthe ResetSystem() function provided by the EFI runtime services, while\nthe ACPI OSL code wants to know whether the EFI config tables were\nmapped successfully. There are also checks in some of the platform\ndriver code to simply see if they\u0027re running on an EFI machine (which\nwould make it a bad idea to do BIOS-y things).\n\nThis patch is a prereq for the samsung-laptop fix patch.\n\nSigned-off-by: Matt Fleming \u003cmatt.fleming@intel.com\u003e\nCc: David Airlie \u003cairlied@linux.ie\u003e\nCc: Corentin Chary \u003ccorentincj@iksaif.net\u003e\nCc: Matthew Garrett \u003cmjg59@srcf.ucam.org\u003e\nCc: Dave Jiang \u003cdave.jiang@intel.com\u003e\nCc: Olof Johansson \u003colof@lixom.net\u003e\nCc: Peter Jones \u003cpjones@redhat.com\u003e\nCc: Colin Ian King \u003ccolin.king@canonical.com\u003e\nCc: Steve Langasek \u003csteve.langasek@canonical.com\u003e\nCc: Tony Luck \u003ctony.luck@intel.com\u003e\nCc: Konrad Rzeszutek Wilk \u003ckonrad@kernel.org\u003e\nCc: Rafael J. Wysocki \u003crjw@sisk.pl\u003e\nSigned-off-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7ad8ac9444d54af92c61c2fa7d02cbf96c990bc5", "tree": "3b9dea5b19ce92dba02b46f35ad35d6b7b896514", "parents": [ "5b70af1c0b0088151a1e7a8917527e190ddd76d7" ], "author": { "name": "Lan Tianyu", "email": "tianyu.lan@intel.com", "time": "Thu Jan 24 10:31:28 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 11 08:47:20 2013 -0800" }, "message": "usb: Using correct way to clear usb3.0 device\u0027s remote wakeup feature.\n\ncommit 54a3ac0c9e5b7213daa358ce74d154352657353a upstream.\n\nUsb3.0 device defines function remote wakeup which is only for interface\nrecipient rather than device recipient. This is different with usb2.0 device\u0027s\nremote wakeup feature which is defined for device recipient. According usb3.0\nspec 9.4.5, the function remote wakeup can be modified by the SetFeature()\nrequests using the FUNCTION_SUSPEND feature selector. This patch is to use\ncorrect way to disable usb3.0 device\u0027s function remote wakeup after suspend\nerror and resuming.\n\nThis should be backported to kernels as old as 3.4, that contain the\ncommit 623bef9e03a60adc623b09673297ca7a1cdfb367 \"USB/xhci: Enable remote\nwakeup for USB3 devices.\"\n\nSigned-off-by: Lan Tianyu \u003ctianyu.lan@intel.com\u003e\nSigned-off-by: Sarah Sharp \u003csarah.a.sharp@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "b08d81801e151fbcefa81a551eadf2beff554752" }