)]}' { "log": [ { "commit": "53bf1469924e07385b4493d3cbd78551d4afaaa3", "tree": "26fd323abf51bc1e9a5362b3ebbd0869425bea6d", "parents": [ "743b911d8b2214bfa9ecd1631edbe6f61f8fdced" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Thu Sep 20 10:01:49 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:41 2012 +0900" }, "message": "xfrm_user: ensure user supplied esn replay window is valid\n\n[ Upstream commit ecd7918745234e423dd87fcc0c077da557909720 ]\n\nThe current code fails to ensure that the netlink message actually\ncontains as many bytes as the header indicates. If a user creates a new\nstate or updates an existing one but does not supply the bytes for the\nwhole ESN replay window, the kernel copies random heap bytes into the\nreplay bitmap, the ones happen to follow the XFRMA_REPLAY_ESN_VAL\nnetlink attribute. This leads to following issues:\n\n1. The replay window has random bits set confusing the replay handling\n code later on.\n\n2. A malicious user could use this flaw to leak up to ~3.5kB of heap\n memory when she has access to the XFRM netlink interface (requires\n CAP_NET_ADMIN).\n\nKnown users of the ESN replay window are strongSwan and Steffen\u0027s\niproute2 patch (\u003chttp://patchwork.ozlabs.org/patch/85962/\u003e). The latter\nuses the interface with a bitmap supplied while the former does not.\nstrongSwan is therefore prone to run into issue 1.\n\nTo fix both issues without breaking existing userland allow using the\nXFRMA_REPLAY_ESN_VAL netlink attribute with either an empty bitmap or a\nfully specified one. For the former case we initialize the in-kernel\nbitmap with zero, for the latter we copy the user supplied bitmap. For\nstate updates the full bitmap must be supplied.\n\nTo prevent overflows in the bitmap length calculation the maximum size\nof bmp_len is limited to 128 by this patch -- resulting in a maximum\nreplay window of 4096 packets. This should be sufficient for all real\nlife scenarios (RFC 4303 recommends a default replay window size of 64).\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nCc: Martin Willi \u003cmartin@revosec.ch\u003e\nCc: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "20eb20851385e53d27dff9ed79c4e68e58e3d9da", "tree": "b3a5a5e16f823d5ca39f44124bf18b5f63fa2a2f", "parents": [ "657197486950474bf30290344339fd0914fe99c9" ], "author": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Sep 04 00:03:29 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:40 2012 +0900" }, "message": "xfrm: Workaround incompatibility of ESN and async crypto\n\n[ Upstream commit 3b59df46a449ec9975146d71318c4777ad086744 ]\n\nESN for esp is defined in RFC 4303. This RFC assumes that the\nsequence number counters are always up to date. However,\nthis is not true if an async crypto algorithm is employed.\n\nIf the sequence number counters are not up to date on sequence\nnumber check, we may incorrectly update the upper 32 bit of\nthe sequence number. This leads to a DOS.\n\nWe workaround this by comparing the upper sequence number,\n(used for authentication) with the upper sequence number\ncomputed after the async processing. We drop the packet\nif these numbers are different.\n\nTo do this, we introduce a recheck function that does this\ncheck in the ESN case.\n\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nAcked-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "268b7d491c88845b410b2dfc84af54075db35c4d", "tree": "b3cbc271f68d91146ba0557a01c96c3073f5e162", "parents": [ "c5500c74ff1414578161b796557b382d5cbaf024" ], "author": { "name": "Flavio Leitner", "email": "fbl@redhat.com", "time": "Fri Sep 21 21:04:34 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 08:32:25 2012 -0700" }, "message": "serial: set correct baud_base for EXSYS EX-41092 Dual 16950\n\ncommit 26e8220adb0aec43b7acafa0f1431760eee28522 upstream.\n\nApparently the same card model has two IDs, so this patch\ncomplements the commit 39aced68d664291db3324d0fcf0985ab5626aac2\nadding the missing one.\n\nSigned-off-by: Flavio Leitner \u003cfbl@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "97ed537eaa6ff11c9a1df342364e25d0996bc117", "tree": "e8aae3109bf171e537f3472f5a1e66edd3c0255e", "parents": [ "34b6567e91b3ff6209c16b3868ec95e0e1cddc1f" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Thu Jul 19 13:52:53 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:40 2012 -0700" }, "message": "kthread_worker: reimplement flush_kthread_work() to allow freeing the work item being executed\n\ncommit 46f3d976213452350f9d10b0c2780c2681f7075b upstream.\n\nkthread_worker provides minimalistic workqueue-like interface for\nusers which need a dedicated worker thread (e.g. for realtime\npriority). It has basic queue, flush_work, flush_worker operations\nwhich mostly match the workqueue counterparts; however, due to the way\nflush_work() is implemented, it has a noticeable difference of not\nallowing work items to be freed while being executed.\n\nWhile the current users of kthread_worker are okay with the current\nbehavior, the restriction does impede some valid use cases. Also,\nremoving this difference isn\u0027t difficult and actually makes the code\neasier to understand.\n\nThis patch reimplements flush_kthread_work() such that it uses a\nflush_work item instead of queue/done sequence numbers.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Colin Cross \u003cccross@google.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9a227fcb842a03fce5b8a6da0da40f5601ec6908", "tree": "d186f0f90e021d9fc9a35ab009cdcab3e315c8a2", "parents": [ "80257cbe62ea0919153c43421746269ab68473bf" ], "author": { "name": "John Stultz", "email": "john.stultz@linaro.org", "time": "Tue Sep 11 15:04:19 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:36 2012 -0700" }, "message": "time: Move ktime_t overflow checking into timespec_valid_strict\n\ncommit cee58483cf56e0ba355fdd97ff5e8925329aa936 upstream\n\nAndreas Bombe reported that the added ktime_t overflow checking added to\ntimespec_valid in commit 4e8b14526ca7 (\"time: Improve sanity checking of\ntimekeeping inputs\") was causing problems with X.org because it caused\ntimeouts larger then KTIME_T to be invalid.\n\nPreviously, these large timeouts would be clamped to KTIME_MAX and would\nnever expire, which is valid.\n\nThis patch splits the ktime_t overflow checking into a new\ntimespec_valid_strict function, and converts the timekeeping codes\ninternal checking to use this more strict function.\n\nReported-and-tested-by: Andreas Bombe \u003caeb@debian.org\u003e\nCc: Zhouping Liu \u003czliu@redhat.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8e878154f5658ba93cf9bb2b491a930ec195de3d", "tree": "7c90f9cafce87cdf0b5629933a35144ee3d11d44", "parents": [ "504471eb5044e4a1dd10950d1a3efab39ba2083a" ], "author": { "name": "John Stultz", "email": "john.stultz@linaro.org", "time": "Tue Sep 11 15:04:17 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:36 2012 -0700" }, "message": "time: Improve sanity checking of timekeeping inputs\n\ncommit 4e8b14526ca7fb046a81c94002c1c43b6fdf0e9b upstream.\n\nUnexpected behavior could occur if the time is set to a value large\nenough to overflow a 64bit ktime_t (which is something larger then the\nyear 2262).\n\nAlso unexpected behavior could occur if large negative offsets are\ninjected via adjtimex.\n\nSo this patch improves the sanity check timekeeping inputs by\nimproving the timespec_valid() check, and then makes better use of\ntimespec_valid() to make sure we don\u0027t set the time to an invalid\nnegative value or one that overflows ktime_t.\n\nNote: This does not protect from setting the time close to overflowing\nktime_t and then letting natural accumulation cause the overflow.\n\nReported-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nReported-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Zhouping Liu \u003czliu@redhat.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: http://lkml.kernel.org/r/1344454580-17031-1-git-send-email-john.stultz@linaro.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e194fab8d7ebe95db5609f1cb6794c2afcc3118f", "tree": "2367f196d1cfa94a2078834bee0d4a64734eb884", "parents": [ "6418cc471b5d8a64ce22d2aa827fcb275e61449c" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Fri Jun 22 13:36:05 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:35 2012 -0700" }, "message": "sched: Fix race in task_group()\n\ncommit 8323f26ce3425460769605a6aece7a174edaa7d1 upstream.\n\nStefan reported a crash on a kernel before a3e5d1091c1 (\"sched:\nDon\u0027t call task_group() too many times in set_task_rq()\"), he\nfound the reason to be that the multiple task_group()\ninvocations in set_task_rq() returned different values.\n\nLooking at all that I found a lack of serialization and plain\nwrong comments.\n\nThe below tries to fix it using an extra pointer which is\nupdated under the appropriate scheduler locks. Its not pretty,\nbut I can\u0027t really see another way given how all the cgroup\nstuff works.\n\nReported-and-tested-by: Stefan Bader \u003cstefan.bader@canonical.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/r/1340364965.18025.71.camel@twins\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0fcc0805df9cf7483e927cf6a4dc94938318c06a", "tree": "5218645ca3737cf7ec1d9b3a039b6a1ec8048931", "parents": [ "27d50469825fd267f44e13fb0627b011c0da6abd" ], "author": { "name": "Vinicius Costa Gomes", "email": "vinicius.gomes@openbossa.org", "time": "Thu Aug 23 21:32:43 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:34 2012 -0700" }, "message": "Bluetooth: Change signature of smp_conn_security()\n\ncommit cc110922da7e902b62d18641a370fec01a9fa794 upstream.\n\nTo make it clear that it may be called from contexts that may not have\nany knowledge of L2CAP, we change the connection parameter, to receive\na hci_conn.\n\nThis also makes it clear that it is checking the security of the link.\n\nSigned-off-by: Vinicius Costa Gomes \u003cvinicius.gomes@openbossa.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2607b9407db4cbc16d5a130c8c16702711c3b7be", "tree": "396f6488dd277120460e0c4cd098a1a9e36b47f6", "parents": [ "4368ade3ff2bfff1033f9e5758630b3d4e8f7e71" ], "author": { "name": "Jakob Bornecrantz", "email": "jakob@vmware.com", "time": "Thu Aug 16 08:29:03 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:23 2012 -0700" }, "message": "drm: Check for invalid cursor flags\n\ncommit 7c4eaca4162d0b5ad4fb39f974d7ffd71b9daa09 upstream.\n\nSigned-off-by: Jakob Bornecrantz \u003cjakob@vmware.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e60b883144de35ea312a7570460cfe6a42af61c1", "tree": "55bf5ed0bebeb5d0eaf57982cf6308531950a4f4", "parents": [ "86236252d2449313bdbac790023cbc957bf6e426" ], "author": { "name": "Will Deacon", "email": "will.deacon@arm.com", "time": "Fri Aug 10 15:22:09 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:21 2012 -0700" }, "message": "mutex: Place lock in contended state after fastpath_lock failure\n\ncommit 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 upstream.\n\nARM recently moved to asm-generic/mutex-xchg.h for its mutex\nimplementation after the previous implementation was found to be missing\nsome crucial memory barriers. However, this has revealed some problems\nrunning hackbench on SMP platforms due to the way in which the\nMUTEX_SPIN_ON_OWNER code operates.\n\nThe symptoms are that a bunch of hackbench tasks are left waiting on an\nunlocked mutex and therefore never get woken up to claim it. This boils\ndown to the following sequence of events:\n\n Task A Task B Task C Lock value\n0 1\n1 lock() 0\n2 lock() 0\n3 spin(A) 0\n4 unlock() 1\n5 lock() 0\n6 cmpxchg(1,0) 0\n7 contended() -1\n8 lock() 0\n9 spin(C) 0\n10 unlock() 1\n11 cmpxchg(1,0) 0\n12 unlock() 1\n\nAt this point, the lock is unlocked, but Task B is in an uninterruptible\nsleep with nobody to wake it up.\n\nThis patch fixes the problem by ensuring we put the lock into the\ncontended state if we fail to acquire it on the fastpath, ensuring that\nany blocked waiters are woken up when the mutex is released.\n\nSigned-off-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Chris Mason \u003cchris.mason@fusionio.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nReviewed-by: Nicolas Pitre \u003cnico@linaro.org\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/n/tip-6e9lrw2avczr0617fzl5vqb8@git.kernel.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f15e72437813a8943aaa3f7528e464923c31437f", "tree": "04dc4af22e6a25c098b22bb443d535102affc6b8", "parents": [ "010ec57f5f6706fbafe9b198846c35500de7aa91" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Mon Sep 03 14:56:02 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:19 2012 -0700" }, "message": "NFS: Fix the initialisation of the readdir \u0027cookieverf\u0027 array\n\ncommit c3f52af3e03013db5237e339c817beaae5ec9e3a upstream.\n\nWhen the NFS_COOKIEVERF helper macro was converted into a static\ninline function in commit 99fadcd764 (nfs: convert NFS_*(inode)\nhelpers to static inline), we broke the initialisation of the\nreaddir cookies, since that depended on doing a memset with an\nargument of \u0027sizeof(NFS_COOKIEVERF(inode))\u0027 which therefore\nchanged from sizeof(be32 cookieverf[2]) to sizeof(be32 *).\n\nAt this point, NFS_COOKIEVERF seems to be more of an obfuscation\nthan a helper, so the best thing would be to just get rid of it.\n\nAlso see: https://bugzilla.kernel.org/show_bug.cgi?id\u003d46881\n\nReported-by: Andi Kleen \u003candi@firstfloor.org\u003e\nReported-by: David Binderman \u003cdcb314@hotmail.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c648535596087f7d17458c293d69829ff6e60a6c", "tree": "e53d6a8026ad35a0cadda0e812faa95c8ef054c4", "parents": [ "dca2dd18c62e3b90cb71534e0a715d246ce7196d" ], "author": { "name": "Wen Congyang", "email": "wency@cn.fujitsu.com", "time": "Thu Sep 20 14:04:47 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:08 2012 -0700" }, "message": "tracing: Don\u0027t call page_to_pfn() if page is NULL\n\ncommit 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa upstream.\n\nWhen allocating memory fails, page is NULL. page_to_pfn() will\ncause the kernel panicked if we don\u0027t use sparsemem vmemmap.\n\nLink: http://lkml.kernel.org/r/505AB1FF.8020104@cn.fujitsu.com\n\nAcked-by: Mel Gorman \u003cmel@csn.ul.ie\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Minchan Kim \u003cminchan@kernel.org\u003e\nSigned-off-by: Wen Congyang \u003cwency@cn.fujitsu.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "449efd1d33fcf40a81f902ceed6a21a406f8d105", "tree": "2369eb51e11ae3f8ce450055593a6649e7675980", "parents": [ "967c0e4ab954d228ca87d85c523ae8a65c03cc5e" ], "author": { "name": "Stefano Stabellini", "email": "stefano.stabellini@eu.citrix.com", "time": "Wed Sep 12 12:44:30 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:06 2012 -0700" }, "message": "xen/m2p: do not reuse kmap_op-\u003edev_bus_addr\n\ncommit 2fc136eecd0c647a6b13fcd00d0c41a1a28f35a5 upstream.\n\nIf the caller passes a valid kmap_op to m2p_add_override, we use\nkmap_op-\u003edev_bus_addr to store the original mfn, but dev_bus_addr is\npart of the interface with Xen and if we are batching the hypercalls it\nmight not have been written by the hypervisor yet. That means that later\non Xen will write to it and we\u0027ll think that the original mfn is\nactually what Xen has written to it.\n\nRather than \"stealing\" struct members from kmap_op, keep using\npage-\u003eindex to store the original mfn and add another parameter to\nm2p_remove_override to get the corresponding kmap_op instead.\nIt is now responsibility of the caller to keep track of which kmap_op\ncorresponds to a particular page in the m2p_override (gntdev, the only\nuser of this interface that passes a valid kmap_op, is already doing that).\n\nReported-and-Tested-By: Sander Eikelenboom \u003clinux@eikelenboom.it\u003e\nSigned-off-by: Stefano Stabellini \u003cstefano.stabellini@eu.citrix.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "32e653056d900d3ecc984733dbfcea34c92bf6d0", "tree": "6f7adb3847243b894ed8f6b1589109c53bd03f0f", "parents": [ "fea0071c60870fbebc605ef72d87668d72dbbd81" ], "author": { "name": "Jianguo Wu", "email": "wujianguo@huawei.com", "time": "Mon Sep 17 14:08:56 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:05 2012 -0700" }, "message": "mm/ia64: fix a memory block size bug\n\ncommit 05cf96398e1b6502f9e191291b715c7463c9d5dd upstream.\n\nI found following definition in include/linux/memory.h, in my IA64\nplatform, SECTION_SIZE_BITS is equal to 32, and MIN_MEMORY_BLOCK_SIZE\nwill be 0.\n\n #define MIN_MEMORY_BLOCK_SIZE (1 \u003c\u003c SECTION_SIZE_BITS)\n\nBecause MIN_MEMORY_BLOCK_SIZE is int type and length of 32bits,\nso MIN_MEMORY_BLOCK_SIZE(1 \u003c\u003c 32) will will equal to 0.\nActually when SECTION_SIZE_BITS \u003e\u003d 31, MIN_MEMORY_BLOCK_SIZE will be wrong.\nThis will cause wrong system memory infomation in sysfs.\nI think it should be:\n\n #define MIN_MEMORY_BLOCK_SIZE (1UL \u003c\u003c SECTION_SIZE_BITS)\n\nAnd \"echo offline \u003e memory0/state\" will cause following call trace:\n\n kernel BUG at mm/memory_hotplug.c:885!\n sh[6455]: bugcheck! 0 [1]\n Pid: 6455, CPU 0, comm: sh\n psr : 0000101008526030 ifs : 8000000000000fa4 ip : [\u003ca0000001008c40f0\u003e] Not tainted (3.6.0-rc1)\n ip is at offline_pages+0x210/0xee0\n Call Trace:\n show_stack+0x80/0xa0\n show_regs+0x640/0x920\n die+0x190/0x2c0\n die_if_kernel+0x50/0x80\n ia64_bad_break+0x3d0/0x6e0\n ia64_native_leave_kernel+0x0/0x270\n offline_pages+0x210/0xee0\n alloc_pages_current+0x180/0x2a0\n\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Jiang Liu \u003cjiang.liu@huawei.com\u003e\nCc: \"Luck, Tony\" \u003ctony.luck@intel.com\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cf499a04f9b5c8d2218257046b66b3062401673a", "tree": "9c9930f689aa9df537462aed2e08e423dd181a3a", "parents": [ "f0868b703758f19c2ced945c2c3fce1c151ab369" ], "author": { "name": "Bjørn Mork", "email": "bjorn@mork.no", "time": "Sun Sep 02 15:41:34 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:55 2012 -0700" }, "message": "kobject: fix oops with \"input0: bad kobj_uevent_env content in show_uevent()\"\n\ncommit 60e233a56609fd963c59e99bd75c663d63fa91b6 upstream.\n\nFengguang Wu \u003cfengguang.wu@intel.com\u003e writes:\n\n\u003e After the __devinit* removal series, I can still get kernel panic in\n\u003e show_uevent(). So there are more sources of bug..\n\u003e\n\u003e Debug patch:\n\u003e\n\u003e @@ -343,8 +343,11 @@ static ssize_t show_uevent(struct device\n\u003e goto out;\n\u003e\n\u003e /* copy keys to file */\n\u003e - for (i \u003d 0; i \u003c env-\u003eenvp_idx; i++)\n\u003e + dev_err(dev, \"uevent %d env[%d]: %s/.../%s\\n\", env-\u003ebuflen, env-\u003eenvp_idx, top_kobj-\u003ename, dev-\u003ekobj.name);\n\u003e + for (i \u003d 0; i \u003c env-\u003eenvp_idx; i++) {\n\u003e + printk(KERN_ERR \"uevent %d env[%d]: %s\\n\", (int)count, i, env-\u003eenvp[i]);\n\u003e count +\u003d sprintf(\u0026buf[count], \"%s\\n\", env-\u003eenvp[i]);\n\u003e + }\n\u003e\n\u003e Oops message, the env[] is again not properly initilized:\n\u003e\n\u003e [ 44.068623] input input0: uevent 61 env[805306368]: input0/.../input0\n\u003e [ 44.069552] uevent 0 env[0]: (null)\n\nThis is a completely different CONFIG_HOTPLUG problem, only\ndemonstrating another reason why CONFIG_HOTPLUG should go away. I had a\nhard time trying to disable it anyway ;-)\n\nThe problem this time is lots of code assuming that a call to\nadd_uevent_var() will guarantee that env-\u003ebuflen \u003e 0. This is not true\nif CONFIG_HOTPLUG is unset. So things like this end up overwriting\nenv-\u003eenvp_idx because the array index is -1:\n\n\tif (add_uevent_var(env, \"MODALIAS\u003d\"))\n\t\treturn -ENOMEM;\n len \u003d input_print_modalias(\u0026env-\u003ebuf[env-\u003ebuflen - 1],\n\t\t\t\t sizeof(env-\u003ebuf) - env-\u003ebuflen,\n\t\t\t\t dev, 0);\n\nDon\u0027t know what the best action is, given that there seem to be a *lot*\nof this around the kernel. This patch \"fixes\" the problem for me, but I\ndon\u0027t know if it can be considered an appropriate fix.\n\n[ It is the correct fix for now, for 3.7 forcing CONFIG_HOTPLUG to\nalways be on is the longterm fix, but it\u0027s too late for 3.6 and older\nkernels to resolve this that way - gregkh ]\n\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nTested-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d409354d1b8a1e47b8f29887179949ec951ffe83", "tree": "a60384b71bacbc43d1dc3b1a5136b1e7a8ebc99f", "parents": [ "e66a381518f9ebf98cdc583d20ae706aa5d1dc28" ], "author": { "name": "Ian Chen", "email": "ian.cy.chen@samsung.com", "time": "Wed Aug 29 15:05:36 2012 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:54 2012 -0700" }, "message": "mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.\n\ncommit 3550ccdb9d8d350e526b809bf3dd92b550a74fe1 upstream.\n\nFor several MoviNAND eMMC parts, there are known issues with secure\nerase and secure trim. For these specific MoviNAND devices, we skip\nthese operations.\n\nSpecifically, there is a bug in the eMMC firmware that causes\nunrecoverable corruption when the MMC is erased with MMC_CAP_ERASE\nenabled.\n\nReferences:\n\nhttp://forum.xda-developers.com/showthread.php?t\u003d1644364\nhttps://plus.google.com/111398485184813224730/posts/21pTYfTsCkB#111398485184813224730/posts/21pTYfTsCkB\n\nSigned-off-by: Ian Chen \u003cian.cy.chen@samsung.com\u003e\nReviewed-by: Namjae Jeon \u003clinkinjeon@gmail.com\u003e\nAcked-by: Jaehoon Chung \u003cjh80.chung@samsung.com\u003e\nReviewed-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Chris Ball \u003ccjb@laptop.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d156b47c4242843096e4a13f8ace5a0626bde3e9", "tree": "517ce331697fce4a5aadba64df99919e60235c53", "parents": [ "9b52a3b313497af37dcdba4ba4c0c95809db525c" ], "author": { "name": "Al Viro", "email": "viro@ZenIV.linux.org.uk", "time": "Mon Aug 20 14:59:25 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:54 2012 -0700" }, "message": "perf_event: Switch to internal refcount, fix race with close()\n\ncommit a6fa941d94b411bbd2b6421ffbde6db3c93e65ab upstream.\n\nDon\u0027t mess with file refcounts (or keep a reference to file, for\nthat matter) in perf_event. Use explicit refcount of its own\ninstead. Deal with the race between the final reference to event\ngoing away and new children getting created for it by use of\natomic_long_inc_not_zero() in inherit_event(); just have the\nlatter free what it had allocated and return NULL, that works\nout just fine (children of siblings of something doomed are\ncreated as singletons, same as if the child of leader had been\ncreated and immediately killed).\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/r/20120820135925.GG23464@ZenIV.linux.org.uk\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f92e8b0ddb85dfe7d8d2547516c873ec8dd9838e", "tree": "ab1d76761b98911b413eb705cad3516311e50fd6", "parents": [ "5975bc201acbe121eaf22ee41076a08b92abc26f" ], "author": { "name": "Miklos Szeredi", "email": "mszeredi@suse.cz", "time": "Mon Sep 17 22:31:38 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:51 2012 -0700" }, "message": "vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill()\n\ncommit b161dfa6937ae46d50adce8a7c6b12233e96e7bd upstream.\n\nIBM reported a soft lockup after applying the fix for the rename_lock\ndeadlock. Commit c83ce989cb5f (\"VFS: Fix the nfs sillyrename regression\nin kernel 2.6.38\") was found to be the culprit.\n\nThe nfs sillyrename fix used DCACHE_DISCONNECTED to indicate that the\ndentry was killed. This flag can be set on non-killed dentries too,\nwhich results in infinite retries when trying to traverse the dentry\ntree.\n\nThis patch introduces a separate flag: DCACHE_DENTRY_KILLED, which is\nonly set in d_kill() and makes try_to_ascend() test only this flag.\n\nIBM reported successful test results with this patch.\n\nSigned-off-by: Miklos Szeredi \u003cmszeredi@suse.cz\u003e\nCc: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6cacd608448898cf0b7bb4353e1a92c6dc7d5dd9", "tree": "b028a0fbe2a78e7f1cec0403b5061fb83cea5d03", "parents": [ "b9d798a996cddfc4c1045e9af97ee434ccab4956" ], "author": { "name": "Yuval Mintz", "email": "yuvalmin@broadcom.com", "time": "Sun Aug 26 00:35:45 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:50 2012 -0700" }, "message": "bnx2x: fix 57840_MF pci id\n\n[ Upstream commit 5c879d2094946081af934739850c7260e8b25d3c ]\n\nCommit c3def943c7117d42caaed3478731ea7c3c87190e have added support for\nnew pci ids of the 57840 board, while failing to change the obsolete value\nin \u0027pci_ids.h\u0027.\nThis patch does so, allowing the probe of such devices.\n\nSigned-off-by: Yuval Mintz \u003cyuvalmin@broadcom.com\u003e\nSigned-off-by: Eilon Greenstein \u003ceilong@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7c799a1e1ca2bc766574078b684c14474da9f704", "tree": "3920b2c94d08c9355c0f6f3e94b30f8ffd42529b", "parents": [ "9e296becde8a8da5bcc1a8e22f27bdf9bd8636fe" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Aug 21 06:21:17 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:37 2012 -0700" }, "message": "af_netlink: force credentials passing [CVE-2012-3520]\n\n[ Upstream commit e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea ]\n\nPablo Neira Ayuso discovered that avahi and\npotentially NetworkManager accept spoofed Netlink messages because of a\nkernel bug. The kernel passes all-zero SCM_CREDENTIALS ancillary data\nto the receiver if the sender did not provide such data, instead of not\nincluding any such data at all or including the correct data from the\npeer (as it is the case with AF_UNIX).\n\nThis bug was introduced in commit 16e572626961\n(af_unix: dont send SCM_CREDENTIALS by default)\n\nThis patch forces passing credentials for netlink, as\nbefore the regression.\n\nAnother fix would be to not add SCM_CREDENTIALS in\nnetlink messages if not provided by the sender, but it\nmight break some programs.\n\nWith help from Florian Weimer \u0026 Petr Matousek\n\nThis issue is designated as CVE-2012-3520\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Petr Matousek \u003cpmatouse@redhat.com\u003e\nCc: Florian Weimer \u003cfweimer@redhat.com\u003e\nCc: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9e296becde8a8da5bcc1a8e22f27bdf9bd8636fe", "tree": "be7a8a0b16cb84b2781b7e210e9749b8236092db", "parents": [ "d09b3b2b1183848e287bc0b6397f8d05945becc4" ], "author": { "name": "Eric Leblond", "email": "eric@regit.org", "time": "Thu Aug 16 22:02:58 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:37 2012 -0700" }, "message": "af_packet: don\u0027t emit packet on orig fanout group\n\n[ Upstream commit c0de08d04215031d68fa13af36f347a6cfa252ca ]\n\nIf a packet is emitted on one socket in one group of fanout sockets,\nit is transmitted again. It is thus read again on one of the sockets\nof the fanout group. This result in a loop for software which\ngenerate packets when receiving one.\nThis retransmission is not the intended behavior: a fanout group\nmust behave like a single socket. The packet should not be\ntransmitted on a socket if it originates from a socket belonging\nto the same fanout group.\n\nThis patch fixes the issue by changing the transmission check to\ntake fanout group info account.\n\nReported-by: Aleksandr Kotov \u003ca1k@mail.ru\u003e\nSigned-off-by: Eric Leblond \u003ceric@regit.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4658b24b2dd0e4c6215db2203743fa999765e8a0", "tree": "9a88804f646780a2424a5ac87586151e923b1b64", "parents": [ "0a1f711681e0d7068b69c0697c4ba284fbf1b2bf" ], "author": { "name": "Ben Hutchings", "email": "bhutchings@solarflare.com", "time": "Mon Jul 30 16:11:42 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:34 2012 -0700" }, "message": "tcp: Apply device TSO segment limit earlier\n\n[ Upstream commit 1485348d2424e1131ea42efc033cbd9366462b01 ]\n\nCache the device gso_max_segs in sock::sk_gso_max_segs and use it to\nlimit the size of TSO skbs. This avoids the need to fall back to\nsoftware GSO for local TCP senders.\n\nSigned-off-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2dc3b21fbca98bd3c8d9e53acf5d966add3c7606", "tree": "6fe9f88dec40cfca839962a5a363848b27afb744", "parents": [ "00709f7f01c3a10252f030f0bdacecbb349d7be4" ], "author": { "name": "Ben Hutchings", "email": "bhutchings@solarflare.com", "time": "Mon Jul 30 15:57:00 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:34 2012 -0700" }, "message": "net: Allow driver to limit number of GSO segments per skb\n\n[ Upstream commit 30b678d844af3305cda5953467005cebb5d7b687 ]\n\nA peer (or local user) may cause TCP to use a nominal MSS of as little\nas 88 (actual MSS of 76 with timestamps). Given that we have a\nsufficiently prodigious local sender and the peer ACKs quickly enough,\nit is nevertheless possible to grow the window for such a connection\nto the point that we will try to send just under 64K at once. This\nresults in a single skb that expands to 861 segments.\n\nIn some drivers with TSO support, such an skb will require hundreds of\nDMA descriptors; a substantial fraction of a TX ring or even more than\na full ring. The TX queue selected for the skb may stall and trigger\nthe TX watchdog repeatedly (since the problem skb will be retried\nafter the TX reset). This particularly affects sfc, for which the\nissue is designated as CVE-2012-3412.\n\nTherefore:\n1. Add the field net_device::gso_max_segs holding the device-specific\n limit.\n2. In netif_skb_features(), if the number of segments is too high then\n mask out GSO features to force fall back to software GSO.\n\nSigned-off-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "952227d5c4d522502b7b815b16be6e991bbaeaed", "tree": "89ffbc3abe99e861e2e6e06c3e8dcdb1901cb7df", "parents": [ "1aac2e73a8af6ce1cd6e938967dd17e2c8d38994" ], "author": { "name": "Gustavo Padovan", "email": "gustavo.padovan@collabora.co.uk", "time": "Tue Jul 10 19:10:06 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 26 15:00:43 2012 -0700" }, "message": "USB: add USB_VENDOR_AND_INTERFACE_INFO() macro\n\ncommit d81a5d1956731c453b85c141458d4ff5d6cc5366 upstream.\n\nA lot of Broadcom Bluetooth devices provides vendor specific interface\nclass and we are getting flooded by patches adding new device support.\nThis change will help us enable support for any other Broadcom with vendor\nspecific device that arrives in the future.\n\nOnly the product id changes for those devices, so this macro would be\nperfect for us:\n\n{ USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }\n\nSigned-off-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nAcked-by: Henrik Rydberg \u003crydberg@bitmath.se\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8b9f3861678e35b18cef66728d0fa896bbda65b6", "tree": "99a1336ea8e0dcc55d1c7f2a61f21526cfcf2f88", "parents": [ "75a757189880a31759ed25c23229f085890cddb1" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sun Aug 05 19:04:57 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 26 15:00:42 2012 -0700" }, "message": "ext4: make sure the journal sb is written in ext4_clear_journal_err()\n\ncommit d796c52ef0b71a988364f6109aeb63d79c5b116b upstream.\n\nAfter we transfer set the EXT4_ERROR_FS bit in the file system\nsuperblock, it\u0027s not enough to call jbd2_journal_clear_err() to clear\nthe error indication from journal superblock --- we need to call\njbd2_journal_update_sb_errno() as well. Otherwise, when the root file\nsystem is mounted read-only, the journal is replayed, and the error\nindicator is transferred to the superblock --- but the s_errno field\nin the jbd2 superblock is left set (since although we cleared it in\nmemory, we never flushed it out to disk).\n\nThis can end up confusing e2fsck. We should make e2fsck more robust\nin this case, but the kernel shouldn\u0027t be leaving things in this\nconfused state, either.\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "844bebfd9d09f92cdf4fac108e5f0d38cd389fff", "tree": "1231da2a36976b91202784d038c516a51fb59cec", "parents": [ "3407b51859d0e65ed66ccb0080c495a1f03cda6a" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Aug 06 10:03:59 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 26 15:00:41 2012 -0700" }, "message": "drm/radeon: add some new SI pci ids\n\ncommit 2f292004dd1fb005788dc0a9cdd5559812ed866e upstream.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "95c92481f69cf89aa1db689940368c09fb425281", "tree": "acde98d86b0fbe22041ed1cb771641ed986a08cd", "parents": [ "733e9ad978a1530328ff78aff3186c20000e5b4e" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Mon Apr 30 16:21:37 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:33 2012 -0700" }, "message": "Input: eeti_ts: pass gpio value instead of IRQ\n\ncommit 4eef6cbfcc03b294d9d334368a851b35b496ce53 upstream.\n\nThe EETI touchscreen asserts its IRQ line as soon as it has data in its\ninternal buffers. The line is automatically deasserted once all data has\nbeen read via I2C. Hence, the driver has to monitor the GPIO line and\ncannot simply rely on the interrupt handler reception.\n\nIn the current implementation of the driver, irq_to_gpio() is used to\ndetermine the GPIO number from the i2c_client\u0027s IRQ value.\n\nAs irq_to_gpio() is not available on all platforms, this patch changes\nthis and makes the driver ignore the passed in IRQ. Instead, a GPIO is\nadded to the platform_data struct and gpio_to_irq is used to derive the\nIRQ from that GPIO. If this fails, bail out. The driver is only able to\nwork in environments where the touchscreen GPIO can be mapped to an\nIRQ.\n\nWithout this patch, building raumfeld_defconfig results in:\n\ndrivers/input/touchscreen/eeti_ts.c: In function \u0027eeti_ts_irq_active\u0027:\ndrivers/input/touchscreen/eeti_ts.c:65:2: error: implicit declaration of function \u0027irq_to_gpio\u0027 [-Werror\u003dimplicit-function-declaration]\n\nSigned-off-by: Daniel Mack \u003czonque@gmail.com\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nCc: Sven Neumann \u003cs.neumann@raumfeld.com\u003e\nCc: linux-input@vger.kernel.org\nCc: Haojian Zhuang \u003chaojian.zhuang@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5784dff6267c788b40a2c9931b13a079e9011936", "tree": "f67c7bcaefa1454cf18f383e90a2a8d9d8a3fb52", "parents": [ "0f27ec339c656ab8dc9255ac8a61a1cecd32d599" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Sun Aug 05 14:58:37 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:32 2012 -0700" }, "message": "ARM: pxa: remove irq_to_gpio from ezx-pcap driver\n\ncommit 59ee93a528b94ef4e81a08db252b0326feff171f upstream.\n\nThe irq_to_gpio function was removed from the pxa platform\nin linux-3.2, and this driver has been broken since.\n\nThere is actually no in-tree user of this driver that adds\nthis platform device, but the driver can and does get enabled\non some platforms.\n\nWithout this patch, building ezx_defconfig results in:\n\ndrivers/mfd/ezx-pcap.c: In function \u0027pcap_isr_work\u0027:\ndrivers/mfd/ezx-pcap.c:205:2: error: implicit declaration of function \u0027irq_to_gpio\u0027 [-Werror\u003dimplicit-function-declaration]\n\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nAcked-by: Haojian Zhuang \u003chaojian.zhuang@gmail.com\u003e\nCc: Samuel Ortiz \u003csameo@linux.intel.com\u003e\nCc: Daniel Ribeiro \u003cdrwyrm@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "26665db4f7fa71c56eeb9205e79927cfc21e70c4", "tree": "8b5dc2c10b8b0aa9c1d1711daf991ae3df30db02", "parents": [ "12dae51a7567bb1e583ee0de6af538db256504db" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sat Jul 14 20:27:52 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:29 2012 -0700" }, "message": "random: remove rand_initialize_irq()\n\ncommit c5857ccf293968348e5eb4ebedc68074de3dcda6 upstream.\n\nWith the new interrupt sampling system, we are no longer using the\ntimer_rand_state structure in the irq descriptor, so we can stop\ninitializing it now.\n\n[ Merged in fixes from Sedat to find some last missing references to\n rand_initialize_irq() ]\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "38e16fc638792ddc12da853c4836602a8708e166", "tree": "1fee9674e85a885501c4905cdf017cd5d6e15089", "parents": [ "29aef9dee78ac45c5bd7f91434b05144ec220abd" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Wed Jul 04 16:19:30 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:28 2012 -0700" }, "message": "random: add tracepoints for easier debugging and verification\n\ncommit 00ce1db1a634746040ace24c09a4e3a7949a3145 upstream.\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "29aef9dee78ac45c5bd7f91434b05144ec220abd", "tree": "16b4c0aed90542db6e0cb1d45ff2e483ee3f2eae", "parents": [ "f5caa70697d4da107f8fd33fe74977a8ec192aaf" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Jul 05 10:35:23 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:28 2012 -0700" }, "message": "random: add new get_random_bytes_arch() function\n\ncommit c2557a303ab6712bb6e09447df828c557c710ac9 upstream.\n\nCreate a new function, get_random_bytes_arch() which will use the\narchitecture-specific hardware random number generator if it is\npresent. Change get_random_bytes() to not use the HW RNG, even if it\nis avaiable.\n\nThe reason for this is that the hw random number generator is fast (if\nit is present), but it requires that we trust the hardware\nmanufacturer to have not put in a back door. (For example, an\nincreasing counter encrypted by an AES key known to the NSA.)\n\nIt\u0027s unlikely that Intel (for example) was paid off by the US\nGovernment to do this, but it\u0027s impossible for them to prove otherwise\n --- especially since Bull Mountain is documented to use AES as a\nwhitener. Hence, the output of an evil, trojan-horse version of\nRDRAND is statistically indistinguishable from an RDRAND implemented\nto the specifications claimed by Intel. Short of using a tunnelling\nelectronic microscope to reverse engineer an Ivy Bridge chip and\ndisassembling and analyzing the CPU microcode, there\u0027s no way for us\nto tell for sure.\n\nSince users of get_random_bytes() in the Linux kernel need to be able\nto support hardware systems where the HW RNG is not present, most\ntime-sensitive users of this interface have already created their own\ncryptographic RNG interface which uses get_random_bytes() as a seed.\nSo it\u0027s much better to use the HW RNG to improve the existing random\nnumber generator, by mixing in any entropy returned by the HW RNG into\n/dev/random\u0027s entropy pool, but to always _use_ /dev/random\u0027s entropy\npool.\n\nThis way we get almost of the benefits of the HW RNG without any\npotential liabilities. The only benefits we forgo is the\nspeed/performance enhancements --- and generic kernel code can\u0027t\ndepend on depend on get_random_bytes() having the speed of a HW RNG\nanyway.\n\nFor those places that really want access to the arch-specific HW RNG,\nif it is available, we provide get_random_bytes_arch().\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "1d0eb350ee278cb257178a14c4c9d965d7d2835e", "tree": "16b4cc295085db157d441e2b08821f92d9161363", "parents": [ "e0604ba541f04a542ee9a7f6a468a60688ad8c72" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 04 11:16:01 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:27 2012 -0700" }, "message": "random: create add_device_randomness() interface\n\ncommit a2080a67abe9e314f9e9c2cc3a4a176e8a8f8793 upstream.\n\nAdd a new interface, add_device_randomness() for adding data to the\nrandom pool that is likely to differ between two devices (or possibly\neven per boot). This would be things like MAC addresses or serial\nnumbers, or the read-out of the RTC. This does *not* add any actual\nentropy to the pool, but it initializes the pool to different values\nfor devices that might otherwise be identical and have very little\nentropy available to them (particularly common in the embedded world).\n\n[ Modified by tytso to mix in a timestamp, since there may be some\n variability caused by the time needed to detect/configure the hardware\n in question. ]\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0110bbfbc8ed1b5240a51e8c767c44a856424139", "tree": "f3ac162b4925c7e841413db59dabff88324640ae", "parents": [ "cabf5b0af54cec6a2f9ce674cbc96fc8aa2fc468" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Mon Jul 02 07:52:16 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:10 2012 -0700" }, "message": "random: make \u0027add_interrupt_randomness()\u0027 do something sane\n\ncommit 775f4b297b780601e61787b766f306ed3e1d23eb upstream.\n\nWe\u0027ve been moving away from add_interrupt_randomness() for various\nreasons: it\u0027s too expensive to do on every interrupt, and flooding the\nCPU with interrupts could theoretically cause bogus floods of entropy\nfrom a somewhat externally controllable source.\n\nThis solves both problems by limiting the actual randomness addition\nto just once a second or after 64 interrupts, whicever comes first.\nDuring that time, the interrupt cycle data is buffered up in a per-cpu\npool. Also, we make sure the the nonblocking pool used by urandom is\ninitialized before we start feeding the normal input pool. This\nassures that /dev/urandom is returning unpredictable data as soon as\npossible.\n\n(Based on an original patch by Linus, but significantly modified by\ntytso.)\n\nTested-by: Eric Wustrow \u003cewust@umich.edu\u003e\nReported-by: Eric Wustrow \u003cewust@umich.edu\u003e\nReported-by: Nadia Heninger \u003cnadiah@cs.ucsd.edu\u003e\nReported-by: Zakir Durumeric \u003czakir@umich.edu\u003e\nReported-by: J. Alex Halderman \u003cjhalderm@umich.edu\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "27cd8f51344dcf4799c7a092c1797402b833126a", "tree": "4af5fa7d852c6f73795dd0ea9508b86283fb009e", "parents": [ "b6e9ffcdb09fbf28665e025aa31fda702689786c" ], "author": { "name": "Josh Boyer", "email": "jwboyer@redhat.com", "time": "Wed Jul 25 10:40:34 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:39 2012 -0700" }, "message": "posix_types.h: Cleanup stale __NFDBITS and related definitions\n\ncommit 8ded2bbc1845e19c771eb55209aab166ef011243 upstream.\n\nRecently, glibc made a change to suppress sign-conversion warnings in\nFD_SET (glibc commit ceb9e56b3d1). This uncovered an issue with the\nkernel\u0027s definition of __NFDBITS if applications #include\n\u003clinux/types.h\u003e after including \u003csys/select.h\u003e. A build failure would\nbe seen when passing the -Werror\u003dsign-compare and -D_FORTIFY_SOURCE\u003d2\nflags to gcc.\n\nIt was suggested that the kernel should either match the glibc\ndefinition of __NFDBITS or remove that entirely. The current in-kernel\nuses of __NFDBITS can be replaced with BITS_PER_LONG, and there are no\nuses of the related __FDELT and __FDMASK defines. Given that, we\u0027ll\ncontinue the cleanup that was started with commit 8b3d1cda4f5f\n(\"posix_types: Remove fd_set macros\") and drop the remaining unused\nmacros.\n\nAdditionally, linux/time.h has similar macros defined that expand to\nnothing so we\u0027ll remove those at the same time.\n\nReported-by: Jeff Law \u003claw@redhat.com\u003e\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Josh Boyer \u003cjwboyer@redhat.com\u003e\n[ .. and fix up whitespace as per akpm ]\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d3b42543cf269243ccf2add49008db879ff7f146", "tree": "db596959747095c3c76fa57fd8420a33a2974615", "parents": [ "c7815406caf7efdd805e893caef4a63e61b7645e" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Jul 17 12:39:26 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:37 2012 -0700" }, "message": "workqueue: perform cpu down operations from low priority cpu_notifier()\n\ncommit 6575820221f7a4dd6eadecf7bf83cdd154335eda upstream.\n\nCurrently, all workqueue cpu hotplug operations run off\nCPU_PRI_WORKQUEUE which is higher than normal notifiers. This is to\nensure that workqueue is up and running while bringing up a CPU before\nother notifiers try to use workqueue on the CPU.\n\nPer-cpu workqueues are supposed to remain working and bound to the CPU\nfor normal CPU_DOWN_PREPARE notifiers. This holds mostly true even\nwith workqueue offlining running with higher priority because\nworkqueue CPU_DOWN_PREPARE only creates a bound trustee thread which\nruns the per-cpu workqueue without concurrency management without\nexplicitly detaching the existing workers.\n\nHowever, if the trustee needs to create new workers, it creates\nunbound workers which may wander off to other CPUs while\nCPU_DOWN_PREPARE notifiers are in progress. Furthermore, if the CPU\ndown is cancelled, the per-CPU workqueue may end up with workers which\naren\u0027t bound to the CPU.\n\nWhile reliably reproducible with a convoluted artificial test-case\ninvolving scheduling and flushing CPU burning work items from CPU down\nnotifiers, this isn\u0027t very likely to happen in the wild, and, even\nwhen it happens, the effects are likely to be hidden by the following\nsuccessful CPU down.\n\nFix it by using different priorities for up and down notifiers - high\npriority for up operations and low priority for down operations.\n\nWorkqueue cpu hotplug operations will soon go through further cleanup.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: \"Rafael J. Wysocki\" \u003crjw@sisk.pl\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "20855fe2097ccfde927c6997101ae35340f1d278", "tree": "b185ec5c08472d49f5c96c65c0a4b9d51e41cfc1", "parents": [ "ecbd55f98e07e25d4017077d0a611ce6c766257b" ], "author": { "name": "Mikulas Patocka", "email": "mikulas@artax.karlin.mff.cuni.cz", "time": "Thu Jul 19 06:13:36 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:30 2012 -0700" }, "message": "tun: fix a crash bug and a memory leak\n\ncommit b09e786bd1dd66418b69348cb110f3a64764626a upstream.\n\nThis patch fixes a crash\ntun_chr_close -\u003e netdev_run_todo -\u003e tun_free_netdev -\u003e sk_release_kernel -\u003e\nsock_release -\u003e iput(SOCK_INODE(sock))\nintroduced by commit 1ab5ecb90cb6a3df1476e052f76a6e8f6511cb3d\n\nThe problem is that this socket is embedded in struct tun_struct, it has\nno inode, iput is called on invalid inode, which modifies invalid memory\nand optionally causes a crash.\n\nsock_release also decrements sockets_in_use, this causes a bug that\n\"sockets: used\" field in /proc/*/net/sockstat keeps on decreasing when\ncreating and closing tun devices.\n\nThis patch introduces a flag SOCK_EXTERNALLY_ALLOCATED that instructs\nsock_release to not free the inode and not decrement sockets_in_use,\nfixing both memory corruption and sockets_in_use underflow.\n\nIt should be backported to 3.3 an 3.4 stabke.\n\nSigned-off-by: Mikulas Patocka \u003cmikulas@artax.karlin.mff.cuni.cz\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7b689c5d930f281e417597af9f817ba03dc9d898", "tree": "75bb26f8fc89a58f25377e60cf2af6879fb795b0", "parents": [ "2830f9a08c084bcf40819942f04d0ca500faf4b8" ], "author": { "name": "Tony Luck", "email": "tony.luck@intel.com", "time": "Wed Jul 11 10:20:47 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:29 2012 -0700" }, "message": "x86/mce: Fix siginfo_t-\u003esi_addr value for non-recoverable memory faults\n\ncommit 6751ed65dc6642af64f7b8a440a75563c8aab7ae upstream.\n\nIn commit dad1743e5993f1 (\"x86/mce: Only restart instruction after machine\ncheck recovery if it is safe\") we fixed mce_notify_process() to force a\nsignal to the current process if it was not restartable (RIPV bit not\nset in MCG_STATUS). But doing it here means that the process doesn\u0027t\nget told the virtual address of the fault via siginfo_t-\u003esi_addr. This\nwould prevent application level recovery from the fault.\n\nMake a new MF_MUST_KILL flag bit for memory_failure() et al. to use so\nthat we will provide the right information with the signal.\n\nSigned-off-by: Tony Luck \u003ctony.luck@intel.com\u003e\nAcked-by: Borislav Petkov \u003cborislav.petkov@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "480692b1562b07a4bb8e4d6e49bf7fd2acefbea2", "tree": "3b9fa92da4f35c273294a6ef66b3862fe59bf4f9", "parents": [ "0d0eef55e03a76885b5d665b1f5572e1f4975886" ], "author": { "name": "Roland Dreier", "email": "roland@purestorage.com", "time": "Mon Jul 16 15:34:21 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:26 2012 -0700" }, "message": "target: Add generation of LOGICAL BLOCK ADDRESS OUT OF RANGE\n\ncommit e2397c704429025bc6b331a970f699e52f34283e upstream.\n\nMany SCSI commands are defined to return a CHECK CONDITION / ILLEGAL\nREQUEST with ASC set to LOGICAL BLOCK ADDRESS OUT OF RANGE if the\ninitiator sends a command that accesses a too-big LBA. Add an enum\nvalue and case entries so that target code can return this status.\n\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "016e7d822a72c4cbcbf7e4bc6d590cf50879ec26", "tree": "2655c509eaf1460f1ebfe8704f6d7ac2d55d5a14", "parents": [ "3cdeda1e763ccb2287c6ee76ece14145027653a9" ], "author": { "name": "Samuel Ortiz", "email": "sameo@linux.intel.com", "time": "Thu May 10 19:45:51 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 19 08:59:00 2012 -0700" }, "message": "NFC: Export nfc.h to userland\n\ncommit dbd4fcaf8d664fab4163b1f8682e41ad8bff3444 upstream.\n\nThe netlink commands and attributes, along with the socket structure\ndefinitions need to be exported.\n\nSigned-off-by: Samuel Ortiz \u003csameo@linux.intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "765bdc4d82fadcddfec19222a545e904633c7816", "tree": "1086773f08d9e4727c1cb6f90543258372db5673", "parents": [ "dd3cded0f516201d3b72999e588a6d67e00cb82f" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue Jul 17 02:39:54 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 19 08:59:00 2012 -0700" }, "message": "timekeeping: Provide hrtimer update function\n\nThis is a backport of f6c06abfb3972ad4914cef57d8348fcb2932bc3b\n\nTo finally fix the infamous leap second issue and other race windows\ncaused by functions which change the offsets between the various time\nbases (CLOCK_MONOTONIC, CLOCK_REALTIME and CLOCK_BOOTTIME) we need a\nfunction which atomically gets the current monotonic time and updates\nthe offsets of CLOCK_REALTIME and CLOCK_BOOTTIME with minimalistic\noverhead. The previous patch which provides ktime_t offsets allows us\nto make this function almost as cheap as ktime_get() which is going to\nbe replaced in hrtimer_interrupt().\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nReviewed-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nAcked-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Prarit Bhargava \u003cprarit@redhat.com\u003e\nSigned-off-by: John Stultz \u003cjohnstul@us.ibm.com\u003e\nLink: http://lkml.kernel.org/r/1341960205-56738-7-git-send-email-johnstul@us.ibm.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: John Stultz \u003cjohnstul@us.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5e5006e64cae9603841405af9febb67064869d83", "tree": "f3a41ebc96d577c9a9c726329d9093c7d477046d", "parents": [ "738c88c1b8ebe16c3ecd1694871474b470275d82" ], "author": { "name": "John Stultz", "email": "johnstul@us.ibm.com", "time": "Tue Jul 17 02:39:50 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 19 08:58:59 2012 -0700" }, "message": "hrtimer: Provide clock_was_set_delayed()\n\nThis is a backport of f55a6faa384304c89cfef162768e88374d3312cb\n\nclock_was_set() cannot be called from hard interrupt context because\nit calls on_each_cpu().\n\nFor fixing the widely reported leap seconds issue it is necessary to\ncall it from hard interrupt context, i.e. the timer tick code, which\ndoes the timekeeping updates.\n\nProvide a new function which denotes it in the hrtimer cpu base\nstructure of the cpu on which it is called and raise the hrtimer\nsoftirq. We then execute the clock_was_set() notificiation from\nsoftirq context in run_hrtimer_softirq(). The hrtimer softirq is\nrarely used, so polling the flag there is not a performance issue.\n\n[ tglx: Made it depend on CONFIG_HIGH_RES_TIMERS. We really should get\n rid of all this ifdeffery ASAP ]\n\nSigned-off-by: John Stultz \u003cjohnstul@us.ibm.com\u003e\nReported-by: Jan Engelhardt \u003cjengelh@inai.de\u003e\nReviewed-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nAcked-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Prarit Bhargava \u003cprarit@redhat.com\u003e\nLink: http://lkml.kernel.org/r/1341960205-56738-2-git-send-email-johnstul@us.ibm.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: John Stultz \u003cjohnstul@us.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7490d0a4cfefa16f9d8ce636eb5b2e13d2432db3", "tree": "70ee2418549bd1af674a7bda391140a45a5e11ce", "parents": [ "667fb5508900340d657645e0bfc9bf210a1fc363" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Fri Jun 22 15:52:09 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 19 08:58:56 2012 -0700" }, "message": "sched/nohz: Rewrite and fix load-avg computation -- again\n\ncommit 5167e8d5417bf5c322a703d2927daec727ea40dd upstream.\n\nThanks to Charles Wang for spotting the defects in the current code:\n\n - If we go idle during the sample window -- after sampling, we get a\n negative bias because we can negate our own sample.\n\n - If we wake up during the sample window we get a positive bias\n because we push the sample to a known active period.\n\nSo rewrite the entire nohz load-avg muck once again, now adding\ncopious documentation to the code.\n\nReported-and-tested-by: Doug Smythies \u003cdsmythies@telus.net\u003e\nReported-and-tested-by: Charles Wang \u003cmuming.wq@gmail.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nLink: http://lkml.kernel.org/r/1340373782.18025.74.camel@twins\n[ minor edits ]\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7ad71f960f0f6e06cbded278809674afc515036a", "tree": "df62cd2fb579dc1ded7ec28c669ed03bf506ffe9", "parents": [ "0fa627b15c842095b5147f381fa1943a6a46bb01" ], "author": { "name": "Yinghai Lu", "email": "yinghai@kernel.org", "time": "Wed Jul 11 14:02:56 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:45 2012 -0700" }, "message": "memblock: free allocated memblock_reserved_regions later\n\ncommit 29f6738609e40227dabcc63bfb3b84b3726a75bd upstream.\n\nmemblock_free_reserved_regions() calls memblock_free(), but\nmemblock_free() would double reserved.regions too, so we could free the\nold range for reserved.regions.\n\nAlso tj said there is another bug which could be related to this.\n\n| I don\u0027t think we\u0027re saving any noticeable\n| amount by doing this \"free - give it to page allocator - reserve\n| again\" dancing. We should just allocate regions aligned to page\n| boundaries and free them later when memblock is no longer in use.\n\nin that case, when DEBUG_PAGEALLOC, will get panic:\n\n memblock_free: [0x0000102febc080-0x0000102febf080] memblock_free_reserved_regions+0x37/0x39\n BUG: unable to handle kernel paging request at ffff88102febd948\n IP: [\u003cffffffff836a5774\u003e] __next_free_mem_range+0x9b/0x155\n PGD 4826063 PUD cf67a067 PMD cf7fa067 PTE 800000102febd160\n Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\n CPU 0\n Pid: 0, comm: swapper Not tainted 3.5.0-rc2-next-20120614-sasha #447\n RIP: 0010:[\u003cffffffff836a5774\u003e] [\u003cffffffff836a5774\u003e] __next_free_mem_range+0x9b/0x155\n\nSee the discussion at https://lkml.org/lkml/2012/6/13/469\n\nSo try to allocate with PAGE_SIZE alignment and free it later.\n\nReported-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Yinghai Lu \u003cyinghai@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0e343dbe08acb440f7914d989bcc32c1d1576735", "tree": "224d26c553fc27c2a556cb52ffd8d8b692a64f8f", "parents": [ "a2db97f10ba81ce924323e580a223ce8d17d685c" ], "author": { "name": "Jiang Liu", "email": "jiang.liu@huawei.com", "time": "Wed Jul 11 14:01:52 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:44 2012 -0700" }, "message": "memory hotplug: fix invalid memory access caused by stale kswapd pointer\n\ncommit d8adde17e5f858427504725218c56aef90e90fc7 upstream.\n\nkswapd_stop() is called to destroy the kswapd work thread when all memory\nof a NUMA node has been offlined. But kswapd_stop() only terminates the\nwork thread without resetting NODE_DATA(nid)-\u003ekswapd to NULL. The stale\npointer will prevent kswapd_run() from creating a new work thread when\nadding memory to the memory-less NUMA node again. Eventually the stale\npointer may cause invalid memory access.\n\nAn example stack dump as below. It\u0027s reproduced with 2.6.32, but latest\nkernel has the same issue.\n\n BUG: unable to handle kernel NULL pointer dereference at (null)\n IP: [\u003cffffffff81051a94\u003e] exit_creds+0x12/0x78\n PGD 0\n Oops: 0000 [#1] SMP\n last sysfs file: /sys/devices/system/memory/memory391/state\n CPU 11\n Modules linked in: cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq microcode fuse loop dm_mod tpm_tis rtc_cmos i2c_i801 rtc_core tpm serio_raw pcspkr sg tpm_bios igb i2c_core iTCO_wdt rtc_lib mptctl iTCO_vendor_support button dca bnx2 usbhid hid uhci_hcd ehci_hcd usbcore sd_mod crc_t10dif edd ext3 mbcache jbd fan ide_pci_generic ide_core ata_generic ata_piix libata thermal processor thermal_sys hwmon mptsas mptscsih mptbase scsi_transport_sas scsi_mod\n Pid: 7949, comm: sh Not tainted 2.6.32.12-qiuxishi-5-default #92 Tecal RH2285\n RIP: 0010:exit_creds+0x12/0x78\n RSP: 0018:ffff8806044f1d78 EFLAGS: 00010202\n RAX: 0000000000000000 RBX: ffff880604f22140 RCX: 0000000000019502\n RDX: 0000000000000000 RSI: 0000000000000202 RDI: 0000000000000000\n RBP: ffff880604f22150 R08: 0000000000000000 R09: ffffffff81a4dc10\n R10: 00000000000032a0 R11: ffff880006202500 R12: 0000000000000000\n R13: 0000000000c40000 R14: 0000000000008000 R15: 0000000000000001\n FS: 00007fbc03d066f0(0000) GS:ffff8800282e0000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n CR2: 0000000000000000 CR3: 000000060f029000 CR4: 00000000000006e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n Process sh (pid: 7949, threadinfo ffff8806044f0000, task ffff880603d7c600)\n Stack:\n ffff880604f22140 ffffffff8103aac5 ffff880604f22140 ffffffff8104d21e\n ffff880006202500 0000000000008000 0000000000c38000 ffffffff810bd5b1\n 0000000000000000 ffff880603d7c600 00000000ffffdd29 0000000000000003\n Call Trace:\n __put_task_struct+0x5d/0x97\n kthread_stop+0x50/0x58\n offline_pages+0x324/0x3da\n memory_block_change_state+0x179/0x1db\n store_mem_state+0x9e/0xbb\n sysfs_write_file+0xd0/0x107\n vfs_write+0xad/0x169\n sys_write+0x45/0x6e\n system_call_fastpath+0x16/0x1b\n Code: ff 4d 00 0f 94 c0 84 c0 74 08 48 89 ef e8 1f fd ff ff 5b 5d 31 c0 41 5c c3 53 48 8b 87 20 06 00 00 48 89 fb 48 8b bf 18 06 00 00 \u003c8b\u003e 00 48 c7 83 18 06 00 00 00 00 00 00 f0 ff 0f 0f 94 c0 84 c0\n RIP exit_creds+0x12/0x78\n RSP \u003cffff8806044f1d78\u003e\n CR2: 0000000000000000\n\n[akpm@linux-foundation.org: add pglist_data.kswapd locking comments]\nSigned-off-by: Xishi Qiu \u003cqiuxishi@huawei.com\u003e\nSigned-off-by: Jiang Liu \u003cjiang.liu@huawei.com\u003e\nAcked-by: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nAcked-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nAcked-by: Mel Gorman \u003cmgorman@suse.de\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nReviewed-by: Minchan Kim \u003cminchan@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2c07f25ea7800adb36cd8da9b58c4ecd3fc3d064", "tree": "b312e3b679b544de20569f8e31dd1469e8a72be1", "parents": [ "5318edefb61eddf91d4c4a089644fcee3ccfda62" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Jun 12 15:24:40 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:42 2012 -0700" }, "message": "splice: fix racy pipe-\u003ebuffers uses\n\ncommit 047fe3605235888f3ebcda0c728cb31937eadfe6 upstream.\n\nDave Jones reported a kernel BUG at mm/slub.c:3474! triggered\nby splice_shrink_spd() called from vmsplice_to_pipe()\n\ncommit 35f3d14dbbc5 (pipe: add support for shrinking and growing pipes)\nadded capability to adjust pipe-\u003ebuffers.\n\nProblem is some paths don\u0027t hold pipe mutex and assume pipe-\u003ebuffers\ndoesn\u0027t change for their duration.\n\nFix this by adding nr_pages_max field in struct splice_pipe_desc, and\nuse it in place of pipe-\u003ebuffers where appropriate.\n\nsplice_shrink_spd() loses its struct pipe_inode_info argument.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Jens Axboe \u003caxboe@kernel.dk\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Tom Herbert \u003ctherbert@google.com\u003e\nTested-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n[bwh: Backported to 3.2:\n - Adjust context in vmsplice_to_pipe()\n - Update one more call to splice_shrink_spd(), from skb_splice_bits()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "acf8fbd7c1182204ed723dee365bc5ba9a503dd6", "tree": "6479ee55435b097d79e5e1fe45a1c1e7a3f030d6", "parents": [ "ff99851d5277c6131301a09f687aa3976ced31e7" ], "author": { "name": "Andrea Arcangeli", "email": "aarcange@redhat.com", "time": "Wed Jun 20 12:52:57 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:42 2012 -0700" }, "message": "thp: avoid atomic64_read in pmd_read_atomic for 32bit PAE\n\ncommit e4eed03fd06578571c01d4f1478c874bb432c815 upstream.\n\nIn the x86 32bit PAE CONFIG_TRANSPARENT_HUGEPAGE\u003dy case while holding the\nmmap_sem for reading, cmpxchg8b cannot be used to read pmd contents under\nXen.\n\nSo instead of dealing only with \"consistent\" pmdvals in\npmd_none_or_trans_huge_or_clear_bad() (which would be conceptually\nsimpler) we let pmd_none_or_trans_huge_or_clear_bad() deal with pmdvals\nwhere the low 32bit and high 32bit could be inconsistent (to avoid having\nto use cmpxchg8b).\n\nThe only guarantee we get from pmd_read_atomic is that if the low part of\nthe pmd was found null, the high part will be null too (so the pmd will be\nconsidered unstable). And if the low part of the pmd is found \"stable\"\nlater, then it means the whole pmd was read atomically (because after a\npmd is stable, neither MADV_DONTNEED nor page faults can alter it anymore,\nand we read the high part after the low part).\n\nIn the 32bit PAE x86 case, it is enough to read the low part of the pmdval\natomically to declare the pmd as \"stable\" and that\u0027s true for THP and no\nTHP, furthermore in the THP case we also have a barrier() that will\nprevent any inconsistent pmdvals to be cached by a later re-read of the\n*pmd.\n\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Jonathan Nieder \u003cjrnieder@gmail.com\u003e\nCc: Ulrich Obergfell \u003cuobergfe@redhat.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Larry Woodman \u003clwoodman@redhat.com\u003e\nCc: Petr Matousek \u003cpmatouse@redhat.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Jan Beulich \u003cjbeulich@suse.com\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@gmail.com\u003e\nTested-by: Andrew Jones \u003cdrjones@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ff99851d5277c6131301a09f687aa3976ced31e7", "tree": "1a7d2b5c47af230cb78978aefe87ba6655a8af45", "parents": [ "e5982925c66c542aa41b17ee35fc233ae1521898" ], "author": { "name": "Andrea Arcangeli", "email": "aarcange@redhat.com", "time": "Tue May 29 15:06:49 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:41 2012 -0700" }, "message": "mm: pmd_read_atomic: fix 32bit PAE pmd walk vs pmd_populate SMP race condition\n\ncommit 26c191788f18129af0eb32a358cdaea0c7479626 upstream.\n\nWhen holding the mmap_sem for reading, pmd_offset_map_lock should only\nrun on a pmd_t that has been read atomically from the pmdp pointer,\notherwise we may read only half of it leading to this crash.\n\nPID: 11679 TASK: f06e8000 CPU: 3 COMMAND: \"do_race_2_panic\"\n #0 [f06a9dd8] crash_kexec at c049b5ec\n #1 [f06a9e2c] oops_end at c083d1c2\n #2 [f06a9e40] no_context at c0433ded\n #3 [f06a9e64] bad_area_nosemaphore at c043401a\n #4 [f06a9e6c] __do_page_fault at c0434493\n #5 [f06a9eec] do_page_fault at c083eb45\n #6 [f06a9f04] error_code (via page_fault) at c083c5d5\n EAX: 01fb470c EBX: fff35000 ECX: 00000003 EDX: 00000100 EBP:\n 00000000\n DS: 007b ESI: 9e201000 ES: 007b EDI: 01fb4700 GS: 00e0\n CS: 0060 EIP: c083bc14 ERR: ffffffff EFLAGS: 00010246\n #7 [f06a9f38] _spin_lock at c083bc14\n #8 [f06a9f44] sys_mincore at c0507b7d\n #9 [f06a9fb0] system_call at c083becd\n start len\n EAX: ffffffda EBX: 9e200000 ECX: 00001000 EDX: 6228537f\n DS: 007b ESI: 00000000 ES: 007b EDI: 003d0f00\n SS: 007b ESP: 62285354 EBP: 62285388 GS: 0033\n CS: 0073 EIP: 00291416 ERR: 000000da EFLAGS: 00000286\n\nThis should be a longstanding bug affecting x86 32bit PAE without THP.\nOnly archs with 64bit large pmd_t and 32bit unsigned long should be\naffected.\n\nWith THP enabled the barrier() in pmd_none_or_trans_huge_or_clear_bad()\nwould partly hide the bug when the pmd transition from none to stable,\nby forcing a re-read of the *pmd in pmd_offset_map_lock, but when THP is\nenabled a new set of problem arises by the fact could then transition\nfreely in any of the none, pmd_trans_huge or pmd_trans_stable states.\nSo making the barrier in pmd_none_or_trans_huge_or_clear_bad()\nunconditional isn\u0027t good idea and it would be a flakey solution.\n\nThis should be fully fixed by introducing a pmd_read_atomic that reads\nthe pmd in order with THP disabled, or by reading the pmd atomically\nwith cmpxchg8b with THP enabled.\n\nLuckily this new race condition only triggers in the places that must\nalready be covered by pmd_none_or_trans_huge_or_clear_bad() so the fix\nis localized there but this bug is not related to THP.\n\nNOTE: this can trigger on x86 32bit systems with PAE enabled with more\nthan 4G of ram, otherwise the high part of the pmd will never risk to be\ntruncated because it would be zero at all times, in turn so hiding the\nSMP race.\n\nThis bug was discovered and fully debugged by Ulrich, quote:\n\n----\n[..]\npmd_none_or_trans_huge_or_clear_bad() loads the content of edx and\neax.\n\n 496 static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t\n *pmd)\n 497 {\n 498 /* depend on compiler for an atomic pmd read */\n 499 pmd_t pmdval \u003d *pmd;\n\n // edi \u003d pmd pointer\n0xc0507a74 \u003csys_mincore+548\u003e: mov 0x8(%esp),%edi\n...\n // edx \u003d PTE page table high address\n0xc0507a84 \u003csys_mincore+564\u003e: mov 0x4(%edi),%edx\n...\n // eax \u003d PTE page table low address\n0xc0507a8e \u003csys_mincore+574\u003e: mov (%edi),%eax\n\n[..]\n\nPlease note that the PMD is not read atomically. These are two \"mov\"\ninstructions where the high order bits of the PMD entry are fetched\nfirst. Hence, the above machine code is prone to the following race.\n\n- The PMD entry {high|low} is 0x0000000000000000.\n The \"mov\" at 0xc0507a84 loads 0x00000000 into edx.\n\n- A page fault (on another CPU) sneaks in between the two \"mov\"\n instructions and instantiates the PMD.\n\n- The PMD entry {high|low} is now 0x00000003fda38067.\n The \"mov\" at 0xc0507a8e loads 0xfda38067 into eax.\n----\n\nReported-by: Ulrich Obergfell \u003cuobergfe@redhat.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Larry Woodman \u003clwoodman@redhat.com\u003e\nCc: Petr Matousek \u003cpmatouse@redhat.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "10762419cafd82a9a3a6f68bef54c29f1af75842", "tree": "45e0a1689e4ffa4c94fc09c9c72d454fab1e6639", "parents": [ "0bbc9d1b4b011e83ba65852b1d652561c7f562f1" ], "author": { "name": "Stanislav Kinsbursky", "email": "skinsbursky@parallels.com", "time": "Mon Jun 25 16:40:08 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:39 2012 -0700" }, "message": "SUNRPC: new svc_bind() routine introduced\n\nupstream commit 9793f7c88937e7ac07305ab1af1a519225836823.\n\nThis new routine is responsible for service registration in a specified\nnetwork context.\n\nThe idea is to separate service creation from per-net operations.\n\nNote also: since registering service with svc_bind() can fail, the\nservice will be destroyed and during destruction it will try to\nunregister itself from rpcbind. In this case unregistration has to be\nskipped.\n\nSigned-off-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0bbc9d1b4b011e83ba65852b1d652561c7f562f1", "tree": "0a6e76d8b7e1d473ca92f5358ff2c5fab7f16ba1", "parents": [ "0e924ae7ac646cf8aa95a3bc5671d19f920417c5" ], "author": { "name": "Stanislav Kinsbursky", "email": "skinsbursky@parallels.com", "time": "Mon Jun 25 16:40:07 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:39 2012 -0700" }, "message": "Lockd: pass network namespace to creation and destruction routines\n\nupstream commit e3f70eadb7dddfb5a2bb9afff7abfc6ee17a29d0.\n\nv2: dereference of most probably already released nlm_host removed in\nnlmclnt_done() and reclaimer().\n\nThese routines are called from locks reclaimer() kernel thread. This thread\nworks in \"init_net\" network context and currently relays on persence on lockd\nthread and it\u0027s per-net resources. Thus lockd_up() and lockd_down() can\u0027t relay\non current network context. So let\u0027s pass corrent one into them.\n\nSigned-off-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0659cf9dcd148f6771c056fa95976fda9c5abf9d", "tree": "4f6cc56b2e5a4ca1ada1320a9961e6a86805de58", "parents": [ "b62d32b9166b085a487916eca514b59b5ffdf2b7" ], "author": { "name": "Alan Stern", "email": "stern@rowland.harvard.edu", "time": "Mon Jul 09 11:09:21 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:39 2012 -0700" }, "message": "PCI: EHCI: fix crash during suspend on ASUS computers\n\ncommit dbf0e4c7257f8d684ec1a3c919853464293de66e upstream.\n\nQuite a few ASUS computers experience a nasty problem, related to the\nEHCI controllers, when going into system suspend. It was observed\nthat the problem didn\u0027t occur if the controllers were not put into the\nD3 power state before starting the suspend, and commit\n151b61284776be2d6f02d48c23c3625678960b97 (USB: EHCI: fix crash during\nsuspend on ASUS computers) was created to do this.\n\nIt turned out this approach messed up other computers that didn\u0027t have\nthe problem -- it prevented USB wakeup from working. Consequently\ncommit c2fb8a3fa25513de8fedb38509b1f15a5bbee47b (USB: add\nNO_D3_DURING_SLEEP flag and revert 151b61284776be2) was merged; it\nreverted the earlier commit and added a whitelist of known good board\nnames.\n\nNow we know the actual cause of the problem. Thanks to AceLan Kao for\ntracking it down.\n\nAccording to him, an engineer at ASUS explained that some of their\nBIOSes contain a bug that was added in an attempt to work around a\nproblem in early versions of Windows. When the computer goes into S3\nsuspend, the BIOS tries to verify that the EHCI controllers were first\nquiesced by the OS. Nothing\u0027s wrong with this, but the BIOS does it\nby checking that the PCI COMMAND registers contain 0 without checking\nthe controllers\u0027 power state. If the register isn\u0027t 0, the BIOS\nassumes the controller needs to be quiesced and tries to do so. This\ninvolves making various MMIO accesses to the controller, which don\u0027t\nwork very well if the controller is already in D3. The end result is\na system hang or memory corruption.\n\nSince the value in the PCI COMMAND register doesn\u0027t matter once the\ncontroller has been suspended, and since the value will be restored\nanyway when the controller is resumed, we can work around the BIOS bug\nsimply by setting the register to 0 during system suspend. This patch\n(as1590) does so and also reverts the second commit mentioned above,\nwhich is now unnecessary.\n\nIn theory we could do this for every PCI device. However to avoid\nintroducing new problems, the patch restricts itself to EHCI host\ncontrollers.\n\nFinally the affected systems can suspend with USB wakeup working\nproperly.\n\nReference: https://bugzilla.kernel.org/show_bug.cgi?id\u003d37632\nReference: https://bugzilla.kernel.org/show_bug.cgi?id\u003d42728\nBased-on-patch-by: AceLan Kao \u003cacelan.kao@canonical.com\u003e\nSigned-off-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nTested-by: Dâniel Fraga \u003cfragabr@gmail.com\u003e\nTested-by: Javier Marcet \u003cjmarcet@gmail.com\u003e\nTested-by: Andrey Rahmatullin \u003cwrar@wrar.name\u003e\nTested-by: Oleksij Rempel \u003cbug-track@fisher-privat.net\u003e\nTested-by: Pavel Pisa \u003cpisa@cmp.felk.cvut.cz\u003e\nAcked-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nAcked-by: Rafael J. Wysocki \u003crjw@sisk.pl\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "76c6b958de9e72947ef08b1c9509f094c34abd8f", "tree": "2d6c6f2f668b3a846cb25904e7845e576e1486f2", "parents": [ "5a89aae8085ef69a2ea9034ff8f5624327cd4efc" ], "author": { "name": "Dan Williams", "email": "dan.j.williams@intel.com", "time": "Fri Jun 22 10:52:34 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:37 2012 -0700" }, "message": "SCSI: libsas: fix taskfile corruption in sas_ata_qc_fill_rtf\n\ncommit 6ef1b512f4e6f936d89aa20be3d97a7ec7c290ac upstream.\n\nfill_result_tf() grabs the taskfile flags from the originating qc which\nsas_ata_qc_fill_rtf() promptly overwrites. The presence of an\nata_taskfile in the sata_device makes it tempting to just copy the full\ncontents in sas_ata_qc_fill_rtf(). However, libata really only wants\nthe fis contents and expects the other portions of the taskfile to not\nbe touched by -\u003eqc_fill_rtf. To that end store a fis buffer in the\nsata_device and use ata_tf_from_fis() like every other -\u003eqc_fill_rtf()\nimplementation.\n\nReported-by: Praveen Murali \u003cpmurali@logicube.com\u003e\nTested-by: Praveen Murali \u003cpmurali@logicube.com\u003e\nSigned-off-by: Dan Williams \u003cdan.j.williams@intel.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5a89aae8085ef69a2ea9034ff8f5624327cd4efc", "tree": "763432902ba6edd688976716291b0645f28d29b1", "parents": [ "7c2c0261ce56126b72fbff0d67d9b1ac06f3c971" ], "author": { "name": "Mark Rustad", "email": "mark.d.rustad@intel.com", "time": "Thu Jun 21 12:23:42 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:30 2012 -0700" }, "message": "SCSI: Fix NULL dereferences in scsi_cmd_to_driver\n\ncommit 222a806af830fda34ad1f6bc991cd226916de060 upstream.\n\nAvoid crashing if the private_data pointer happens to be NULL. This has\nbeen seen sometimes when a host reset happens, notably when there are\nmany LUNs:\n\nhost3: Assigned Port ID 0c1601\nscsi host3: libfc: Host reset succeeded on port (0c1601)\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000350\nIP: [\u003cffffffff81352bb8\u003e] scsi_send_eh_cmnd+0x58/0x3a0\n\u003csnip\u003e\nProcess scsi_eh_3 (pid: 4144, threadinfo ffff88030920c000, task ffff880326b160c0)\nStack:\n 000000010372e6ba 0000000000000282 000027100920dca0 ffffffffa0038ee0\n 0000000000000000 0000000000030003 ffff88030920dc80 ffff88030920dc80\n 00000002000e0000 0000000a00004000 ffff8803242f7760 ffff88031326ed80\nCall Trace:\n [\u003cffffffff8105b590\u003e] ? lock_timer_base+0x70/0x70\n [\u003cffffffff81352fbe\u003e] scsi_eh_tur+0x3e/0xc0\n [\u003cffffffff81353a36\u003e] scsi_eh_test_devices+0x76/0x170\n [\u003cffffffff81354125\u003e] scsi_eh_host_reset+0x85/0x160\n [\u003cffffffff81354291\u003e] scsi_eh_ready_devs+0x91/0x110\n [\u003cffffffff813543fd\u003e] scsi_unjam_host+0xed/0x1f0\n [\u003cffffffff813546a8\u003e] scsi_error_handler+0x1a8/0x200\n [\u003cffffffff81354500\u003e] ? scsi_unjam_host+0x1f0/0x1f0\n [\u003cffffffff8106ec3e\u003e] kthread+0x9e/0xb0\n [\u003cffffffff81509264\u003e] kernel_thread_helper+0x4/0x10\n [\u003cffffffff8106eba0\u003e] ? kthread_freezable_should_stop+0x70/0x70\n [\u003cffffffff81509260\u003e] ? gs_change+0x13/0x13\nCode: 25 28 00 00 00 48 89 45 c8 31 c0 48 8b 87 80 00 00 00 48 8d b5 60 ff ff ff 89 d1 48 89 fb 41 89 d6 4c 89 fa 48 8b 80 b8 00 00 00\n \u003c48\u003e 8b 80 50 03 00 00 48 8b 00 48 89 85 38 ff ff ff 48 8b 07 4c\nRIP [\u003cffffffff81352bb8\u003e] scsi_send_eh_cmnd+0x58/0x3a0\n RSP \u003cffff88030920dc50\u003e\nCR2: 0000000000000350\n\n\nSigned-off-by: Mark Rustad \u003cmark.d.rustad@intel.com\u003e\nTested-by: Marcus Dennis \u003cmarcusx.e.dennis@intel.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f632881de16f8c3133cd1b0866937f50fa2e9156", "tree": "682bbb4fe7e2ec7d9f9302a13e816818a05430a1", "parents": [ "f838956ac64e227e682d7d4da9883888b9aab381" ], "author": { "name": "Junxiao Bi", "email": "junxiao.bi@oracle.com", "time": "Wed Jun 27 17:09:54 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:23 2012 -0700" }, "message": "aio: make kiocb-\u003eprivate NUll in init_sync_kiocb()\n\ncommit 2dfd06036ba7ae8e7be2daf5a2fff1dac42390bf upstream.\n\nOcfs2 uses kiocb.*private as a flag of unsigned long size. In\ncommit a11f7e6 ocfs2: serialize unaligned aio, the unaligned\nio flag is involved in it to serialize the unaligned aio. As\n*private is not initialized in init_sync_kiocb() of do_sync_write(),\nthis unaligned io flag may be unexpectly set in an aligned dio.\nAnd this will cause OCFS2_I(inode)-\u003eip_unaligned_aio decreased\nto -1 in ocfs2_dio_end_io(), thus the following unaligned dio\nwill hang forever at ocfs2_aiodio_wait() in ocfs2_file_aio_write().\n\nSigned-off-by: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nAcked-by: Jeff Moyer \u003cjmoyer@redhat.com\u003e\nSigned-off-by: Joel Becker \u003cjlbec@evilplan.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b18504e4a631e31edd939fe569342274927d4b41", "tree": "86d9935b2829f36f4392cdd733cd1ff22c62cdaa", "parents": [ "35733efe3599b30ace9b035eb425be85aaa3ae12" ], "author": { "name": "Alan Stern", "email": "stern@rowland.harvard.edu", "time": "Wed Jun 20 16:04:19 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:10 2012 -0700" }, "message": "SCSI \u0026 usb-storage: add try_rc_10_first flag\n\ncommit 6a0bdffa0073857870a4ed1b4489762146359eb4 upstream.\n\nSeveral bug reports have been received recently for USB mass-storage\ndevices that don\u0027t handle READ CAPACITY(16) commands properly. They\nreport bogus sizes, in some cases becoming unusable as a result.\n\nThe bugs were triggered by commit\n09b6b51b0b6c1b9bb61815baf205e4d74c89ff04 (SCSI \u0026 usb-storage: add\nflags for VPD pages and REPORT LUNS), which caused usb-storage to stop\noverriding the SCSI level reported by devices. By default, the sd\ndriver will try READ CAPACITY(16) first for any device whose level is\nabove SCSI_SPC_2.\n\nIt seems likely that any device large enough to require the use of\nREAD CAPACITY(16) (i.e., 2 TB or more) would be able to handle READ\nCAPACITY(10) commands properly. Indeed, I don\u0027t know of any devices\nthat don\u0027t handle READ CAPACITY(10) properly.\n\nTherefore this patch (as1559) adds a new flag telling the sd driver\nto try READ CAPACITY(10) before READ CAPACITY(16), and sets this flag\nfor every USB mass-storage device. If a device really is larger than\n2 TB, sd will fall back to READ CAPACITY(16) just as it used to.\n\nThis fixes Bugzilla #43391.\n\nSigned-off-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nAcked-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nCC: \"James E.J. Bottomley\" \u003cJBottomley@parallels.com\u003e\nCC: Matthew Dharm \u003cmdharm-usb@one-eyed-alien.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0f9c37b38800c35e83f43949d93bffefff5b43af", "tree": "e2f2ffcfe9ea52d693766114268f9925af581a7a", "parents": [ "735129c4609e98fd149cddda50b823e43bab0677" ], "author": { "name": "Ohad Ben-Cohen", "email": "ohad@wizery.com", "time": "Thu Jun 07 15:39:35 2012 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:03:52 2012 -0700" }, "message": "rpmsg: make sure inflight messages don\u0027t invoke just-removed callbacks\n\ncommit 15fd943af50dbc5f7f4de33835795c72595f7bf4 upstream.\n\nWhen inbound messages arrive, rpmsg core looks up their associated\nendpoint (by destination address) and then invokes their callback.\n\nWe\u0027ve made sure that endpoints will never be de-allocated after they\nwere found by rpmsg core, but we also need to protect against the\n(rare) scenario where the rpmsg driver was just removed, and its\ncallback function isn\u0027t available anymore.\n\nThis is achieved by introducing a callback mutex, which must be taken\nbefore the callback is invoked, and, obviously, before it is removed.\n\nReported-by: Fernando Guzman Lugo \u003cfernando.lugo@ti.com\u003e\nSigned-off-by: Ohad Ben-Cohen \u003cohad@wizery.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "735129c4609e98fd149cddda50b823e43bab0677", "tree": "69ab2f02267bf2f4aeece86c21ad8135d3524b19", "parents": [ "4ce16269215ffaad3d480425bc74bf632956151e" ], "author": { "name": "Ohad Ben-Cohen", "email": "ohad@wizery.com", "time": "Wed Jun 06 10:09:25 2012 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:03:52 2012 -0700" }, "message": "rpmsg: avoid premature deallocation of endpoints\n\ncommit 5a081caa0414b9bbb82c17ffab9d6fe66edbb72f upstream.\n\nWhen an inbound message arrives, the rpmsg core looks up its\nassociated endpoint and invokes the registered callback.\n\nIf a message arrives while its endpoint is being removed (because\nthe rpmsg driver was removed, or a recovery of a remote processor\nhas kicked in) we must ensure atomicity, i.e.:\n\n- Either the ept is removed before it is found\n\nor\n\n- The ept is found but will not be freed until the callback returns\n\nThis is achieved by maintaining a per-ept reference count, which,\nwhen drops to zero, will trigger deallocation of the ept.\n\nWith this in hand, it is now forbidden to directly deallocate\nepts once they have been added to the endpoints idr.\n\nReported-by: Fernando Guzman Lugo \u003cfernando.lugo@ti.com\u003e\nSigned-off-by: Ohad Ben-Cohen \u003cohad@wizery.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d3ae4a87530c1e10c0705995c87fe8a7b4267f4b", "tree": "3881f8a77c7788fd8720b5c680f3feca5aa87a6d", "parents": [ "3cc270f7fcd34b08d37ed51fb4c25b0f513f2e65" ], "author": { "name": "Pravin B Shelar", "email": "pshelar@nicira.com", "time": "Wed Jun 20 12:52:56 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:03:49 2012 -0700" }, "message": "mm: fix slab-\u003epage _count corruption when using slub\n\ncommit abca7c4965845924f65d40e0aa1092bdd895e314 upstream.\n\nOn arches that do not support this_cpu_cmpxchg_double() slab_lock is used\nto do atomic cmpxchg() on double word which contains page-\u003e_count. The\npage count can be changed from get_page() or put_page() without taking\nslab_lock. That corrupts page counter.\n\nFix it by moving page-\u003e_count out of cmpxchg_double data. So that slub\ndoes no change it while updating slub meta-data in struct page.\n\n[akpm@linux-foundation.org: use standard comment layout, tweak comment text]\nReported-by: Amey Bhide \u003cabhide@nicira.com\u003e\nSigned-off-by: Pravin B Shelar \u003cpshelar@nicira.com\u003e\nAcked-by: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Pekka Enberg \u003cpenberg@cs.helsinki.fi\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "993772c70fda9d05299fc3a8ed9d1cba268870f1", "tree": "bbcbfeaec61f0afc33c9a57b69112f06942725b6", "parents": [ "8f530e3bc3af125ac013732b5c54a3af2ad791a2" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Jun 14 06:42:44 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:03:48 2012 -0700" }, "message": "net: remove skb_orphan_try()\n\n[ Upstream commit 62b1a8ab9b3660bb820d8dfe23148ed6cda38574 ]\n\nOrphaning skb in dev_hard_start_xmit() makes bonding behavior\nunfriendly for applications sending big UDP bursts : Once packets\npass the bonding device and come to real device, they might hit a full\nqdisc and be dropped. Without orphaning, the sender is automatically\nthrottled because sk-\u003esk_wmemalloc reaches sk-\u003esk_sndbuf (assuming\nsk_sndbuf is not too big)\n\nWe could try to defer the orphaning adding another test in\ndev_hard_start_xmit(), but all this seems of little gain,\nnow that BQL tends to make packets more likely to be parked\nin Qdisc queues instead of NIC TX ring, in cases where performance\nmatters.\n\nReverts commits :\nfc6055a5ba31 net: Introduce skb_orphan_try()\n87fd308cfc6b net: skb_tx_hash() fix relative to skb_orphan_try()\nand removes SKBTX_DRV_NEEDS_SK_REF flag\n\nReported-and-bisected-by: Jean-Michel Hautbois \u003cjhautbois@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nTested-by: Oliver Hartkopp \u003csocketcan@hartkopp.net\u003e\nAcked-by: Oliver Hartkopp \u003csocketcan@hartkopp.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c51c618955c052c1d34de9b325bb49a375e874a0", "tree": "ebee40a61655a3d283186432a1201c98331255a9", "parents": [ "09838df9d2ff31252a69a8393ea96a9734eba7e8" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Jun 12 06:03:51 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:03:47 2012 -0700" }, "message": "bonding: Fix corrupted queue_mapping\n\n[ Upstream commit 5ee31c6898ea5537fcea160999d60dc63bc0c305 ]\n\nIn the transmit path of the bonding driver, skb-\u003ecb is used to\nstash the skb-\u003equeue_mapping so that the bonding device can set its\nown queue mapping. This value becomes corrupted since the skb-\u003ecb is\nalso used in __dev_xmit_skb.\n\nWhen transmitting through bonding driver, bond_select_queue is\ncalled from dev_queue_xmit. In bond_select_queue the original\nskb-\u003equeue_mapping is copied into skb-\u003ecb (via bond_queue_mapping)\nand skb-\u003equeue_mapping is overwritten with the bond driver queue.\n\nSubsequently in dev_queue_xmit, __dev_xmit_skb is called which writes\nthe packet length into skb-\u003ecb, thereby overwriting the stashed\nqueue mappping. In bond_dev_queue_xmit (called from hard_start_xmit),\nthe queue mapping for the skb is set to the stashed value which is now\nthe skb length and hence is an invalid queue for the slave device.\n\nIf we want to save skb-\u003equeue_mapping into skb-\u003ecb[], best place is to\nadd a field in struct qdisc_skb_cb, to make sure it wont conflict with\nother layers (eg : Qdiscc, Infiniband...)\n\nThis patchs also makes sure (struct qdisc_skb_cb)-\u003edata is aligned on 8\nbytes :\n\nnetem qdisc for example assumes it can store an u64 in it, without\nmisalignment penalty.\n\nNote : we only have 20 bytes left in (struct qdisc_skb_cb)-\u003edata[].\nThe largest user is CHOKe and it fills it.\n\nBased on a previous patch from Tom Herbert.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: Tom Herbert \u003ctherbert@google.com\u003e\nCc: John Fastabend \u003cjohn.r.fastabend@intel.com\u003e\nCc: Roland Dreier \u003croland@kernel.org\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "89a5feb2d59123824c344665c09328bb9fdb4fe9", "tree": "120726522dff4bb022322f2f3ab7df1b2885bb19", "parents": [ "f375a27c17c033dc9503b12b8379055fd59110ba" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Jun 05 03:00:18 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:03:45 2012 -0700" }, "message": "inetpeer: fix a race in inetpeer_gc_worker()\n\n[ Upstream commit 55432d2b543a4b6dfae54f5c432a566877a85d90 ]\n\ncommit 5faa5df1fa2024 (inetpeer: Invalidate the inetpeer tree along with\nthe routing cache) added a race :\n\nBefore freeing an inetpeer, we must respect a RCU grace period, and make\nsure no user will attempt to increase refcnt.\n\ninetpeer_invalidate_tree() waits for a RCU grace period before inserting\ninetpeer tree into gc_list and waking the worker. At that time, no\nconcurrent lookup can find a inetpeer in this tree.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6fc5186c0628a5dfcfdbc9355bad225613fa7618", "tree": "1ce61633f84fe564e2d4761ffd6701f3b68b43c9", "parents": [ "31fab24bd9cdb9733383cbf9732cda1649f2a760" ], "author": { "name": "Paul Moore", "email": "pmoore@redhat.com", "time": "Fri Jun 01 05:54:56 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:03:44 2012 -0700" }, "message": "cipso: handle CIPSO options correctly when NetLabel is disabled\n\n[ Upstream commit 20e2a86485967c385d7c7befc1646e4d1d39362e ]\n\nWhen NetLabel is not enabled, e.g. CONFIG_NETLABEL\u003dn, and the system\nreceives a CIPSO tagged packet it is dropped (cipso_v4_validate()\nreturns non-zero). In most cases this is the correct and desired\nbehavior, however, in the case where we are simply forwarding the\ntraffic, e.g. acting as a network bridge, this becomes a problem.\n\nThis patch fixes the forwarding problem by providing the basic CIPSO\nvalidation code directly in ip_options_compile() without the need for\nthe NetLabel or CIPSO code. The new validation code can not perform\nany of the CIPSO option label/value verification that\ncipso_v4_validate() does, but it can verify the basic CIPSO option\nformat.\n\nThe behavior when NetLabel is enabled is unchanged.\n\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "12ad741b1c60c341bf85a90c828b6fa1df47dba5", "tree": "7e3210cbce2dd91f0ea83776c0c046f16fedd6d4", "parents": [ "9a12826c11fc0b7cebe6ee0b0711f5ccaf8f6323" ], "author": { "name": "Alan Stern", "email": "stern@rowland.harvard.edu", "time": "Wed Jun 13 11:20:19 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 22 11:37:13 2012 -0700" }, "message": "USB: add NO_D3_DURING_SLEEP flag and revert 151b61284776be2\n\ncommit c2fb8a3fa25513de8fedb38509b1f15a5bbee47b upstream.\n\nThis patch (as1558) fixes a problem affecting several ASUS computers:\nThe machine crashes or corrupts memory when going into suspend if the\nehci-hcd driver is bound to any controllers. Users have been forced\nto unbind or unload ehci-hcd before putting their systems to sleep.\n\nAfter extensive testing, it was determined that the machines don\u0027t\nlike going into suspend when any EHCI controllers are in the PCI D3\npower state. Presumably this is a firmware bug, but there\u0027s nothing\nwe can do about it except to avoid putting the controllers in D3\nduring system sleep.\n\nThe patch adds a new flag to indicate whether the problem is present,\nand avoids changing the controller\u0027s power state if the flag is set.\nRuntime suspend is unaffected; this matters only for system suspend.\nHowever as a side effect, the controller will not respond to remote\nwakeup requests while the system is asleep. Hence USB wakeup is not\nfunctional -- but of course, this is already true in the current state\nof affairs.\n\nA similar patch has already been applied as commit\n151b61284776be2d6f02d48c23c3625678960b97 (USB: EHCI: fix crash during\nsuspend on ASUS computers). The patch supersedes that one and reverts\nit. There are two differences:\n\n\tThe old patch added the flag at the USB level; this patch\n\tadds it at the PCI level.\n\n\tThe old patch applied to all chipsets with the same vendor,\n\tsubsystem vendor, and product IDs; this patch makes an\n\texception for a known-good system (based on DMI information).\n\nSigned-off-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nTested-by: Dâniel Fraga \u003cfragabr@gmail.com\u003e\nTested-by: Andrey Rahmatullin \u003cwrar@wrar.name\u003e\nTested-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nReviewed-by: Rafael J. Wysocki \u003crjw@sisk.pl\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "78ac34ad3199ad0cd9c23d6084c8627daa748a2b", "tree": "c79bc7152e766850c282346475ef90c36ff4e041", "parents": [ "696615b7f9872cf81a840cde982775c521f56ea3" ], "author": { "name": "Hugh Dickins", "email": "hughd@google.com", "time": "Fri Jun 15 17:55:50 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 22 11:36:55 2012 -0700" }, "message": "swap: fix shmem swapping when more than 8 areas\n\ncommit 9b15b817f3d62409290fd56fe3cbb076a931bb0a upstream.\n\nMinchan Kim reports that when a system has many swap areas, and tmpfs\nswaps out to the ninth or more, shmem_getpage_gfp()\u0027s attempts to read\nback the page cannot locate it, and the read fails with -ENOMEM.\n\nWhoops. Yes, I blindly followed read_swap_header()\u0027s pte_to_swp_entry(\nswp_entry_to_pte()) technique for determining maximum usable swap\noffset, without stopping to realize that that actually depends upon the\npte swap encoding shifting swap offset to the higher bits and truncating\nit there. Whereas our radix_tree swap encoding leaves offset in the\nlower bits: it\u0027s swap \"type\" (that is, index of swap area) that was\ntruncated.\n\nFix it by reducing the SWP_TYPE_SHIFT() in swapops.h, and removing the\nbroken radix_to_swp_entry(swp_to_radix_entry()) from read_swap_header().\n\nThis does not reduce the usable size of a swap area any further, it\nleaves it as claimed when making the original commit: no change from 3.0\non x86_64, nor on i386 without PAE; but 3.0\u0027s 512GB is reduced to 128GB\nper swapfile on i386 with PAE. It\u0027s not a change I would have risked\nfive years ago, but with x86_64 supported for ten years, I believe it\u0027s\nappropriate now.\n\nHmm, and what if some architecture implements its swap pte with offset\nencoded below type? That would equally break the maximum usable swap\noffset check. Happily, they all follow the same tradition of encoding\noffset above type, but I\u0027ll prepare a check on that for next.\n\nReported-and-Reviewed-and-Tested-by: Minchan Kim \u003cminchan@kernel.org\u003e\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "54a40b2cf40d655dbbdcc017288be75b1ae1b701", "tree": "c5581223aa8ecc919f5d3df9d8904b1e8c7d4144", "parents": [ "9abcb7517f13aa54152bee6370538b8f56893349" ], "author": { "name": "Andy Whitcroft", "email": "apw@canonical.com", "time": "Fri May 04 22:15:10 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 17 11:21:29 2012 -0700" }, "message": "libata: add a host flag to ignore detected ATA devices\n\ncommit db63a4c8115a0bb904496e1cdd3e7488e68b0d06 upstream.\n\nWhere devices are visible via more than one host we sometimes wish to\nindicate that cirtain devices should be ignored on a specific host. Add a\nhost flag indicating that this host wishes to ignore ATA specific devices.\n\nSigned-off-by: Andy Whitcroft \u003capw@canonical.com\u003e\nSigned-off-by: Jeff Garzik \u003cjgarzik@redhat.com\u003e\nCc: Victor Miasnikov \u003cvvm@tut.by\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3410afedcda2f504e8fbe02a7f4c49912ce688c8", "tree": "8a08670ff706045ab51f6a863e04469a2421c8b3", "parents": [ "e6e70e4c7ef345d3af2d2ba98c2d2f175aa64c2a" ], "author": { "name": "Rusty Russell", "email": "rusty@rustcorp.com.au", "time": "Fri Jun 08 14:58:13 2012 +0930" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 17 11:21:23 2012 -0700" }, "message": "module_param: stop double-calling parameters.\n\ncommit ae82fdb1406ad41d68f07027fe31f2d35ba22a90 upstream.\n\nCommit 026cee0086fe1df4cf74691cf273062cc769617d \"params:\n\u003clevel\u003e_initcall-like kernel parameters\" set old-style module\nparameters to level 0. And we call those level 0 calls where we used\nto, early in start_kernel().\n\nWe also loop through the initcall levels and call the levelled\nmodule_params before the corresponding initcall. Unfortunately level\n0 is early_init(), so we call the standard module_param calls twice.\n\n(Turns out most things don\u0027t care, but at least ubi.mtd does).\n\nChange the level to -1 for standard module_param calls.\n\nReported-by: Benoît Thébaudeau \u003cbenoit.thebaudeau@advansee.com\u003e\nSigned-off-by: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fab83a044aa7d4b968f466f4eb3946388528497a", "tree": "a40f9623041c97fdef89682f33d3d64017f7bb8c", "parents": [ "b1840525b3af198ada9f60fc25c980e97e189933" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Jun 05 09:50:31 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 10 00:36:18 2012 +0900" }, "message": "drm/radeon/kms: add new SI PCI ids\n\ncommit 7aaa61b3476462b69f1ac7669fcca8d608ce3cb5 upstream.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b1840525b3af198ada9f60fc25c980e97e189933", "tree": "b759b6c0318df85e56c00695a73d9ca7a2ef6c21", "parents": [ "36fbcdf64a3c15a8a98adb5ea018ce1913215e25" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Jun 05 09:50:30 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 10 00:36:17 2012 +0900" }, "message": "drm/radeon/kms: add new BTC PCI ids\n\ncommit a2bef8ce826dd1e787fd8ad9b6e0566ba59dab43 upstream.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "36fbcdf64a3c15a8a98adb5ea018ce1913215e25", "tree": "a5cee55884403660e5900e5a93d19643d69f01eb", "parents": [ "d16ba207028eac4f38b908507d731ca894a91744" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Jun 05 09:50:29 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 10 00:36:17 2012 +0900" }, "message": "drm/radeon/kms: add new Palm, Sumo PCI ids\n\ncommit 4a6991cc1fad514745b79181df3ace72d561e7aa upstream.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d16ba207028eac4f38b908507d731ca894a91744", "tree": "92c33551db2ad1d6c069feb494755feb1ad150a6", "parents": [ "ce58755a4fe65790a2e80559e0c585ba610b5f62" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Jun 05 09:50:28 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 10 00:36:17 2012 +0900" }, "message": "drm/radeon/kms: add new Trinity PCI ids\n\ncommit d430f7dbf7bd6aaaa40c0660b3204df8cf07b22b upstream.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b642cb6a143da812f188307c2661c0357776a9d0", "tree": "2c88df819dc12d6a92bf72cce91eaad3ba62ec88", "parents": [ "f940c5366eaaea9630ba643a036c2df321f66db3" ], "author": { "name": "Konstantin Khlebnikov", "email": "khlebnikov@openvz.org", "time": "Tue Jun 05 21:36:33 2012 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 10 00:36:17 2012 +0900" }, "message": "radix-tree: fix contiguous iterator\n\ncommit fffaee365fded09f9ebf2db19066065fa54323c3 upstream.\n\nThis patch fixes bug in macro radix_tree_for_each_contig().\n\nIf radix_tree_next_slot() sees NULL in next slot it returns NULL, but following\nradix_tree_next_chunk() switches iterating into next chunk. As result iterating\nbecomes non-contiguous and breaks vfs \"splice\" and all its users.\n\nSigned-off-by: Konstantin Khlebnikov \u003ckhlebnikov@openvz.org\u003e\nReported-and-bisected-by: Hans de Bruin \u003cjmdebruin@xmsnet.nl\u003e\nReported-and-bisected-by: Ondrej Zary \u003clinux@rainbow-software.org\u003e\nReported-bisected-and-tested-by: Toralf Förster \u003ctoralf.foerster@gmx.de\u003e\nLink: https://lkml.org/lkml/2012/6/5/64\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "010589e2bce841733dc989fd56c5c3aba41a759c", "tree": "bd4a2be410ad1c7ff51ffad8d80e4d65c7ab1c8d", "parents": [ "ea1ae37f4a2c41ea684f2e725332147eb6496026" ], "author": { "name": "Felix Fietkau", "email": "nbd@openwrt.org", "time": "Tue May 29 03:35:08 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 10 00:36:15 2012 +0900" }, "message": "skb: avoid unnecessary reallocations in __skb_cow\n\n[ Upstream commit 617c8c11236716dcbda877e764b7bf37c6fd8063 ]\n\nAt the beginning of __skb_cow, headroom gets set to a minimum of\nNET_SKB_PAD. This causes unnecessary reallocations if the buffer was not\ncloned and the headroom is just below NET_SKB_PAD, but still more than the\namount requested by the caller.\nThis was showing up frequently in my tests on VLAN tx, where\nvlan_insert_tag calls skb_cow_head(skb, VLAN_HLEN).\n\nLocally generated packets should have enough headroom, and for forward\npaths, we already have NET_SKB_PAD bytes of headroom, so we don\u0027t need to\nadd any extra space here.\n\nSigned-off-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "be078c8003469b75aa9119254c163b2961321744", "tree": "a0aab8f217d0a956633a0e81fb6008ee8cd3f8e3", "parents": [ "86a2569c810dff80fc7ba16dd77bc2697c28317a" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Sat May 26 01:30:53 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 10 00:36:15 2012 +0900" }, "message": "ipv6: fix incorrect ipsec fragment\n\n[ Upstream commit 0c1833797a5a6ec23ea9261d979aa18078720b74 ]\n\nSince commit ad0081e43a\n\"ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed\"\nthe fragment of packets is incorrect.\nbecause tunnel mode needs IPsec headers and trailer for all fragments,\nwhile on transport mode it is sufficient to add the headers to the\nfirst fragment and the trailer to the last.\n\nso modify mtu and maxfraglen base on ipsec mode and if fragment is first\nor last.\n\nwith my test,it work well(every fragment\u0027s size is the mtu)\nand does not trigger slow fragment path.\n\nChanges from v1:\n\tthough optimization, mtu_prev and maxfraglen_prev can be delete.\n\treplace xfrm mode codes with dst_entry\u0027s new frag DST_XFRM_TUNNEL.\n\tadd fuction ip6_append_data_mtu to make codes clearer.\n\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "08c372db1aa0a65e0b2135e8556be35e1175f9b9", "tree": "9b96ee54557aaeba2d6d34b0b1ec457484dcc44f", "parents": [ "e552a3bfe0c60c65d35cc3ee6a5f20d9702ebc9a" ], "author": { "name": "Ulrich Drepper", "email": "drepper@akkadia.org", "time": "Tue May 29 15:06:30 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 10 00:36:11 2012 +0900" }, "message": "kbuild: install kernel-page-flags.h\n\ncommit 9295b7a07c859a42346221b5839be0ae612333b0 upstream.\n\nPrograms using /proc/kpageflags need to know about the various flags. The\n\u003clinux/kernel-page-flags.h\u003e provides them and the comments in the file\nindicate that it is supposed to be used by user-level code. But the file\nis not installed.\n\nInstall the headers and mark the unstable flags as out-of-bounds. The\npage-type tool is also adjusted to not duplicate the definitions\n\nSigned-off-by: Ulrich Drepper \u003cdrepper@gmail.com\u003e\nAcked-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nAcked-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "11c8c735ebf68c754bdd94cebd307a96fcd95068", "tree": "876678d7678658773f87ab0969b213d23ff4f98a", "parents": [ "e6b2a258ab83555e062cd2bc2a0ade31b8c118d1" ], "author": { "name": "Nicolas Pitre", "email": "nicolas.pitre@linaro.org", "time": "Mon Apr 16 19:16:54 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 01 15:18:26 2012 +0800" }, "message": "mmc: sdio: avoid spurious calls to interrupt handlers\n\ncommit bbbc4c4d8c5face097d695f9bf3a39647ba6b7e7 upstream.\n\nCommit 06e8935feb (\"optimized SDIO IRQ handling for single irq\")\nintroduced some spurious calls to SDIO function interrupt handlers,\nsuch as when the SDIO IRQ thread is started, or the safety check\nperformed upon a system resume. Let\u0027s add a flag to perform the\noptimization only when a real interrupt is signaled by the host\ndriver and we know there is no point confirming it.\n\nReported-by: Sujit Reddy Thumma \u003csthumma@codeaurora.org\u003e\nSigned-off-by: Nicolas Pitre \u003cnico@linaro.org\u003e\nSigned-off-by: Chris Ball \u003ccjb@laptop.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "474d1f4678a679a98eaf53801e7f95c61ae9daa7", "tree": "55949e1184861437b1d4c6a3cb5cd8ab89f29034", "parents": [ "284e7be895509cdaf9f58e2f789c00b5e9da2244" ], "author": { "name": "Stefano Stabellini", "email": "stefano.stabellini@eu.citrix.com", "time": "Mon May 21 16:54:10 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 01 15:18:25 2012 +0800" }, "message": "xen: do not map the same GSI twice in PVHVM guests.\n\ncommit 68c2c39a76b094e9b2773e5846424ea674bf2c46 upstream.\n\nPV on HVM guests map GSIs into event channels. At restore time the\nevent channels are resumed by restore_pirqs.\n\nDevice drivers might try to register the same GSI again through ACPI at\nrestore time, but the GSI has already been mapped and bound by\nrestore_pirqs. This patch detects these situations and avoids\n mapping the same GSI multiple times.\n\nWithout this patch we get:\n(XEN) irq.c:2235: dom4: pirq 23 or emuirq 28 already mapped\nand waste a pirq.\n\nSigned-off-by: Stefano Stabellini \u003cstefano.stabellini@eu.citrix.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "774a93aa647f8939867c8ff956847bc63dd51cb3", "tree": "e7438e4bc3a45e6e45cb2968c70809eeaa62e663", "parents": [ "59784034b157f70d1e8cf56b114527faeadecfaf" ], "author": { "name": "Oliver Neukum", "email": "oliver@neukum.org", "time": "Mon Apr 30 09:13:46 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 01 15:18:17 2012 +0800" }, "message": "usbhid: prevent deadlock during timeout\n\ncommit 8815bb09af21316aeb5f8948b24ac62181670db2 upstream.\n\nOn some HCDs usb_unlink_urb() can directly call the\ncompletion handler. That limits the spinlocks that can\nbe taken in the handler to locks not held while calling\nusb_unlink_urb()\nTo prevent a race with resubmission, this patch exposes\nusbcore\u0027s infrastructure for blocking submission, uses it\nand so drops the lock without causing a race in usbhid.\n\nSigned-off-by: Oliver Neukum \u003coneukum@suse.de\u003e\nAcked-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "14e931a264498fbd4baef07ee0644e347252393b", "tree": "c202cd976f478fed3d7d786521ab3e32abdc0f9e", "parents": [ "a2ae9787568ac50978c03ce67bfb79ad2e100cca", "05c69d298c96703741cac9a5cbbf6c53bd55a6e2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 19 10:12:17 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 19 10:12:17 2012 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.dk/linux-block\n\nPull block layer fixes from Jens Axboe:\n \"A few small, but important fixes. Most of them are marked for stable\n as well\n\n - Fix failure to release a semaphore on error path in mtip32xx.\n - Fix crashable condition in bio_get_nr_vecs().\n - Don\u0027t mark end-of-disk buffers as mapped, limit it to i_size.\n - Fix for build problem with CONFIG_BLOCK\u003dn on arm at least.\n - Fix for a buffer overlow on UUID partition printing.\n - Trivial removal of unused variables in dac960.\"\n\n* \u0027for-linus\u0027 of git://git.kernel.dk/linux-block:\n block: fix buffer overflow when printing partition UUIDs\n Fix blkdev.h build errors when BLOCK\u003dn\n bio allocation failure due to bio_get_nr_vecs()\n block: don\u0027t mark buffers beyond end of disk as mapped\n mtip32xx: release the semaphore on an error path\n dac960: Remove unused variables from DAC960_CreateProcEntries()\n" }, { "commit": "31ae98359d26ff89b745c4f8094093cbf6ccbdc6", "tree": "38a555bdd527413626389815312419f6e3d78425", "parents": [ "0e93b4b304ae052ba1bc73f6d34a68556fe93429", "9b63776fa3ca96c4ecda76f6fa947b7b0add66ac", "c3709e6734daa4d9b37fe31592ebb0eb57bae1bb", "30b4e9eb783d94e9f5d503b15eb31720679ae1c7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 17 09:35:17 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 17 09:35:17 2012 -0700" }, "message": "Merge branches \u0027perf-urgent-for-linus\u0027, \u0027x86-urgent-for-linus\u0027 and \u0027sched-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf, x86 and scheduler updates from Ingo Molnar.\n\n* \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n tracing: Do not enable function event with enable\n perf stat: handle ENXIO error for perf_event_open\n perf: Turn off compiler warnings for flex and bison generated files\n perf stat: Fix case where guest/host monitoring is not supported by kernel\n perf build-id: Fix filename size calculation\n\n* \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86, kvm: KVM paravirt kernels don\u0027t check for CPUID being unavailable\n x86: Fix section annotation of acpi_map_cpu2node()\n x86/microcode: Ensure that module is only loaded on supported Intel CPUs\n\n* \u0027sched-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched: Fix KVM and ia64 boot crash due to sched_groups circular linked list assumption\n" }, { "commit": "8011652957995914272f398071b70140639185ce", "tree": "a4aa83038c3b763cce267cfec9b652795af7f420", "parents": [ "568b44559d7ca269d367e694c74eb4436e7e3ccf", "26a5d3cc0b3d1ff23b5a94edb58226afe7f12a0c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 16 13:14:52 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 16 13:14:52 2012 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking tree from David Miller:\n\n1) ptp_pch driver build broke during this merge window due to missing\n slab.h header, fix from Geery Uytterhoeven.\n\n2) If ipset passes in a bogus hash table size we crash because the size\n is not validated properly. Compounding this, gcc-4.7 can miscompile\n ipset such that even when the user specifies legitimate parameters\n the tool passes in an out-of-range size to the kernel.\n\n Fix from Jozsef Kadlecsik.\n\n3) Users have reported that the netdev watchdog can trigger with pch_gbe\n devices, and it turns out this is happening because of races in the\n TX path of the driver leading to the transmitter hanging. Fix from\n Eric Dumazet, reported and tested by Andy Cress.\n\n4) Novatel USB551L devices match the generic class entries for the cdc\n ethernet USB driver, but they don\u0027t work because they have generic\n descriptors and thus need FLAG_WWAN to function properly.\n\n Add the necessary ID table entry to fix this, from Dan Williams.\n\n5) A recursive locking fix in the USBNET driver added a new problem, in\n that packet list traversal is now racy and we can thus access\n unlinked SKBs and crash.\n\n Avoid this situation by adding some extra state tracking, from Ming\n Lei.\n\n6) The rtlwifi conversion to asynchronous firmware loading is racy, fix\n by reordering the probe procedure. From Larry Finger.\n\n Fixes: https://bugzilla.kernel.org/show_bug.cgi?id\u003d43187\n\n7) Fix regressions with bluetooth keyboards by notifying userland\n properly when the security level changes, from Gustavo Padovan.\n\n8) Bluetooth needs to make sure device connected events are emitted\n before other kinds of events, otherwise userspace will think there is\n no baseband link yet and therefore abort the sockets associated with\n that connection.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:\n netfilter: ipset: fix hash size checking in kernel\n ptp_pch: Add missing #include \u003clinux/slab.h\u003e\n pch_gbe: fix transmit races\n cdc_ether: add Novatel USB551L device IDs for FLAG_WWAN\n usbnet: fix skb traversing races during unlink(v2)\n Bluetooth: mgmt: Fix device_connected sending order\n Bluetooth: notify userspace of security level change\n rtlwifi: fix for race condition when firmware is cached\n" }, { "commit": "26a5d3cc0b3d1ff23b5a94edb58226afe7f12a0c", "tree": "046834414e20d334fc5172275a53c55d9722a714", "parents": [ "769b0daf6e18a05a6d4da94baab7edd12867350c" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@blackhole.kfki.hu", "time": "Mon May 14 01:47:01 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed May 16 15:38:49 2012 -0400" }, "message": "netfilter: ipset: fix hash size checking in kernel\n\nThe hash size must fit both into u32 (jhash) and the max value of\nsize_t. The missing checking could lead to kernel crash, bug reported\nby Seblu.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@blackhole.kfki.hu\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d0cad88d071d59169ac25e5c1e3bee0719a4fccf", "tree": "22f1fc5579b813e1e70b6174354c145cbbb9ac55", "parents": [ "3ab77bf271e6a41512e366dfa5110edb981ed1d3", "60374631487a6dbf6b888729022f0e8d76eec8fb" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed May 16 01:03:54 2012 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed May 16 01:04:07 2012 -0400" }, "message": "Merge branch \u0027for-davem\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless\n\nJohn Linville says:\n\nHere are three more fixes that some of my developers are desperate to\nsee included in 3.4...\n\nJohan Hedberg went to some length justifyng the inclusion of these two\nBluetooth fixes:\n\n\"The device_connected fix should be quite self-explanatory, but it\u0027s\nactually a wider issue than just for keyboards. All profiles that do\nincoming connection authorization (e.g. headsets) will break without it\nwith specific hardware. The reason it wasn\u0027t caught earlier is that it\nonly occurs with specific Bluetooth adapters.\n\nAs for the security level patch, this fixes L2CAP socket based security\nlevel elevation during a connection. The HID profile needs this (for\nkeyboards) and it is the only way to achieve the security level\nelevation when using the management interface to talk to the kernel\n(hence the management enabling patch being the one that exposes this\"\n\nThe rtlwifi fix addresses a regression related to firmware loading,\nas described in kernel.org bug 43187. It basically just moves a hunk\nof code to a more appropriate place.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "60374631487a6dbf6b888729022f0e8d76eec8fb", "tree": "4adda0d1a8616ce586ea26a25717477c9e18667a", "parents": [ "8aa51d64c1f526e43b1e7f89fb8b98c2fd583f4b", "671267bf3aac3dae0555730b07ef29c042e325b2" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Tue May 15 16:38:00 2012 -0400" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Tue May 15 16:38:00 2012 -0400" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem\n" }, { "commit": "5b6e9bcdeb65634b4ad604eb4536404bbfc62cfa", "tree": "9c758413d018351b2e95942314a1fa973d7fd882", "parents": [ "8aa51d64c1f526e43b1e7f89fb8b98c2fd583f4b" ], "author": { "name": "Ming Lei", "email": "tom.leiming@gmail.com", "time": "Thu Apr 26 11:33:46 2012 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue May 15 13:41:42 2012 -0400" }, "message": "usbnet: fix skb traversing races during unlink(v2)\n\nCommit 4231d47e6fe69f061f96c98c30eaf9fb4c14b96d(net/usbnet: avoid\nrecursive locking in usbnet_stop()) fixes the recursive locking\nproblem by releasing the skb queue lock before unlink, but may\ncause skb traversing races:\n\t- after URB is unlinked and the queue lock is released,\n\tthe refered skb and skb-\u003enext may be moved to done queue,\n\teven be released\n\t- in skb_queue_walk_safe, the next skb is still obtained\n\tby next pointer of the last skb\n\t- so maybe trigger oops or other problems\n\nThis patch extends the usage of entry-\u003estate to describe \u0027start_unlink\u0027\nstate, so always holding the queue(rx/tx) lock to change the state if\nthe referd skb is in rx or tx queue because we need to know if the\nrefered urb has been started unlinking in unlink_urbs.\n\nThe other part of this patch is based on Huajun\u0027s patch:\nalways traverse from head of the tx/rx queue to get skb which is\nto be unlinked but not been started unlinking.\n\nSigned-off-by: Huajun Li \u003chuajun.li.lee@gmail.com\u003e\nSigned-off-by: Ming Lei \u003ctom.leiming@gmail.com\u003e\nCc: Oliver Neukum \u003coneukum@suse.de\u003e\nCc: stable@kernel.org\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "05c69d298c96703741cac9a5cbbf6c53bd55a6e2", "tree": "a9918d8c056adcd527b6cdf23ec9dc26e585efe9", "parents": [ "85fd0bc95bc76d129db0d0114c40665745bbba07" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue May 15 08:22:04 2012 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Tue May 15 08:22:04 2012 +0200" }, "message": "block: fix buffer overflow when printing partition UUIDs\n\n6d1d8050b4bc8 \"block, partition: add partition_meta_info to hd_struct\"\nadded part_unpack_uuid() which assumes that the passed in buffer has\nenough space for sprintfing \"%pU\" - 37 characters including \u0027\\0\u0027.\n\nUnfortunately, b5af921ec0233 \"init: add support for root devices\nspecified by partition UUID\" supplied 33 bytes buffer to the function\nleading to the following panic with stackprotector enabled.\n\n Kernel panic - not syncing: stack-protector: Kernel stack corrupted in: ffffffff81b14c7e\n\n [\u003cffffffff815e226b\u003e] panic+0xba/0x1c6\n [\u003cffffffff81b14c7e\u003e] ? printk_all_partitions+0x259/0x26xb\n [\u003cffffffff810566bb\u003e] __stack_chk_fail+0x1b/0x20\n [\u003cffffffff81b15c7e\u003e] printk_all_paritions+0x259/0x26xb\n [\u003cffffffff81aedfe0\u003e] mount_block_root+0x1bc/0x27f\n [\u003cffffffff81aee0fa\u003e] mount_root+0x57/0x5b\n [\u003cffffffff81aee23b\u003e] prepare_namespace+0x13d/0x176\n [\u003cffffffff8107eec0\u003e] ? release_tgcred.isra.4+0x330/0x30\n [\u003cffffffff81aedd60\u003e] kernel_init+0x155/0x15a\n [\u003cffffffff81087b97\u003e] ? schedule_tail+0x27/0xb0\n [\u003cffffffff815f4d24\u003e] kernel_thread_helper+0x5/0x10\n [\u003cffffffff81aedc0b\u003e] ? start_kernel+0x3c5/0x3c5\n [\u003cffffffff815f4d20\u003e] ? gs_change+0x13/0x13\n\nIncrease the buffer size, remove the dangerous part_unpack_uuid() and\nuse snprintf() directly from printk_all_partitions().\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReported-by: Szymon Gruszczynski \u003csz.gruszczynski@googlemail.com\u003e\nCc: Will Drewry \u003cwad@chromium.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "b6255ee3d82798eb1eee9fb1cca713317b5afae8", "tree": "5b34f32a965dc772a99188293387022d21c5532e", "parents": [ "d69c5c2cf21e734210029afd803a96a942084af3", "788ab1bb03d304232711b6ca9718534f588ee9fc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 14 11:23:37 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 14 11:23:37 2012 -0700" }, "message": "Merge branch \u0027v4l_for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fixes from Mauro Carvalho Chehab:\n \"For a some fix patches for v3.4, including a regression fix at DVB core\"\n\nFix up trivial conflicts in Documentation/feature-removal-schedule.txt\n\n* \u0027v4l_for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n [media] gspca - sonixj: Fix a zero divide in isoc interrupt\n [media] media: videobuf2-dma-contig: include header for exported symbols\n [media] media: videobuf2-dma-contig: quiet sparse noise about plain integer as NULL pointer\n [media] media: vb2-memops: Export vb2_get_vma symbol\n [media] s5p-fimc: Correct memory allocation for VIDIOC_CREATE_BUFS\n [media] s5p-fimc: Fix locking in subdev set_crop op\n [media] dvb_frontend: fix a regression with DVB-S zig-zag\n [media] fintek-cir: change || to \u0026\u0026\n [media] V4L: Schedule V4L2_CID_HCENTER, V4L2_CID_VCENTER controls for removal\n [media] rc: Postpone ISR registration\n [media] marvell-cam: fix an ARM build error\n [media] V4L: soc-camera: protect hosts during probing from overzealous user-space\n" }, { "commit": "a7d7723ae7c0178d715c06c5621e8fd8014ba92f", "tree": "8e09cd37ed267e792481c2ad699bcaff9596e5e7", "parents": [ "574e02abaf816b582685805f0c1150ca9f1f18ee" ], "author": { "name": "Gustavo Padovan", "email": "gustavo@padovan.org", "time": "Sun May 13 03:20:07 2012 -0300" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon May 14 13:51:25 2012 -0400" }, "message": "Bluetooth: notify userspace of security level change\n\nIt fixes L2CAP socket based security level elevation during a\nconnection. The HID profile needs this (for keyboards) and it is the only\nway to achieve the security level elevation when using the management\ninterface to talk to the kernel (hence the management enabling patch\nbeing the one that exposes this issue).\n\nIt enables the userspace a security level change when the socket is\nalready connected and create a way to notify the socket the result of the\nrequest. At the moment of the request the socket is made non writable, if\nthe request fails the connections closes, otherwise the socket is made\nwritable again, POLL_OUT is emmited.\n\nSigned-off-by: Gustavo Padovan \u003cgustavo@padovan.org\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "85fd0bc95bc76d129db0d0114c40665745bbba07", "tree": "ccebfaa6e8ae545ac35308a4cc8e2f3d61702e0f", "parents": [ "f908ee9463b09ddd05e1c1a0111132212dc05fac" ], "author": { "name": "Russell King", "email": "rmk+kernel@arm.linux.org.uk", "time": "Mon May 14 08:29:23 2012 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Mon May 14 08:29:23 2012 +0200" }, "message": "Fix blkdev.h build errors when BLOCK\u003dn\n\nI see builds failing with:\n\n CC [M] drivers/mmc/host/dw_mmc.o\nIn file included from drivers/mmc/host/dw_mmc.c:15:\ninclude/linux/blkdev.h:1404: warning: \u0027struct task_struct\u0027 declared inside parameter list\ninclude/linux/blkdev.h:1404: warning: its scope is only this definition or declaration, which is probably not what you want\ninclude/linux/blkdev.h:1408: warning: \u0027struct task_struct\u0027 declared inside parameter list\ninclude/linux/blkdev.h:1413: error: expected \u0027\u003d\u0027, \u0027,\u0027, \u0027;\u0027, \u0027asm\u0027 or \u0027__attribute__\u0027 before \u0027blk_needs_flush_plug\u0027\nmake[4]: *** [drivers/mmc/host/dw_mmc.o] Error 1\n\nThis is because dw_mmc.c includes linux/blkdev.h as the very first file,\nand when CONFIG_BLOCK\u003dn, blkdev.h omits all includes.\n\nAs it requires linux/sched.h even when CONFIG_BLOCK\u003dn, move this out of\nthe #ifdef.\n\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "4a873f53995cd551587ee4aad1e6f189a330ff36", "tree": "a1caacf532d6a32861399720ae2883396f443954", "parents": [ "2eb429671a4b83ea34a1a722a4656bb14ce7c971", "062e55e3960062fc2fb62a7274b4c253003eba73" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 12 12:57:01 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 12 12:57:01 2012 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David S. Miller:\n\n 1) Since we do RCU lookups on ipv4 FIB entries, we have to test if the\n entry is dead before returning it to our caller.\n\n 2) openvswitch locking and packet validation fixes from Ansis Atteka,\n Jesse Gross, and Pravin B Shelar.\n\n 3) Fix PM resume locking in IGB driver, from Benjamin Poirier.\n\n 4) Fix VLAN header handling in vhost-net and macvtap, from Basil Gor.\n\n 5) Revert a bogus network namespace isolation change that was causing\n regressions on S390 networking devices.\n\n 6) If bonding decides to process and handle a LACPDU frame, we\n shouldn\u0027t bump the rx_dropped counter. From Jiri Bohac.\n\n 7) Fix mis-calculation of available TX space in r8169 driver when doing\n TSO, which can lead to crashes and/or hung device. From Julien\n Ducourthial.\n\n 8) SCTP does not validate cached routes properly in all cases, from\n Nicolas Dichtel.\n\n 9) Link status interrupt needs to be handled in ks8851 driver, from\n Stephen Boyd.\n\n10) Use capable(), not cap_raised(), in connector/userns netlink code.\n From Eric W. Biederman via Andrew Morton.\n\n11) Fix pktgen OOPS on module unload, from Eric Dumazet.\n\n12) iwlwifi under-estimates SKB truesizes, also from Eric Dumazet.\n\n13) Cure division by zero in SFC driver, from Ben Hutchings.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits)\n ks8851: Update link status during link change interrupt\n macvtap: restore vlan header on user read\n vhost-net: fix handle_rx buffer size\n bonding: don\u0027t increase rx_dropped after processing LACPDUs\n connector/userns: replace netlink uses of cap_raised() with capable()\n sctp: check cached dst before using it\n pktgen: fix crash at module unload\n Revert \"net: maintain namespace isolation between vlan and real device\"\n ehea: fix losing of NEQ events when one event occurred early\n igb: fix rtnl race in PM resume path\n ipv4: Do not use dead fib_info entries.\n r8169: fix unsigned int wraparound with TSO\n sfc: Fix division by zero when using one RX channel and no SR-IOV\n openvswitch: Validation of IPv6 set port action uses IPv4 header\n net: compare_ether_addr[_64bits]() has no ordering\n cdc_ether: Ignore bogus union descriptor for RNDIS devices\n bnx2x: bug fix when loading after SAN boot\n e1000: Silence sparse warnings by correcting type\n igb, ixgbe: netdev_tx_reset_queue incorrectly called from tx init path\n openvswitch: Release rtnl_lock if ovs_vport_cmd_build_info() failed.\n ...\n" }, { "commit": "080399aaaf3531f5b8761ec0ac30ff98891e8686", "tree": "28ba8f41bb67a58992bc426dac7002983bc64e8f", "parents": [ "a09ba13eefb155a00d8d50008a0c0a2406985ddd" ], "author": { "name": "Jeff Moyer", "email": "jmoyer@redhat.com", "time": "Fri May 11 16:34:10 2012 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri May 11 16:42:14 2012 +0200" }, "message": "block: don\u0027t mark buffers beyond end of disk as mapped\n\nHi,\n\nWe have a bug report open where a squashfs image mounted on ppc64 would\nexhibit errors due to trying to read beyond the end of the disk. It can\neasily be reproduced by doing the following:\n\n[root@ibm-p750e-02-lp3 ~]# ls -l install.img\n-rw-r--r-- 1 root root 142032896 Apr 30 16:46 install.img\n[root@ibm-p750e-02-lp3 ~]# mount -o loop ./install.img /mnt/test\n[root@ibm-p750e-02-lp3 ~]# dd if\u003d/dev/loop0 of\u003d/dev/null\ndd: reading `/dev/loop0\u0027: Input/output error\n277376+0 records in\n277376+0 records out\n142016512 bytes (142 MB) copied, 0.9465 s, 150 MB/s\n\nIn dmesg, you\u0027ll find the following:\n\nsquashfs: version 4.0 (2009/01/31) Phillip Lougher\n[ 43.106012] attempt to access beyond end of device\n[ 43.106029] loop0: rw\u003d0, want\u003d277410, limit\u003d277408\n[ 43.106039] Buffer I/O error on device loop0, logical block 138704\n[ 43.106053] attempt to access beyond end of device\n[ 43.106057] loop0: rw\u003d0, want\u003d277412, limit\u003d277408\n[ 43.106061] Buffer I/O error on device loop0, logical block 138705\n[ 43.106066] attempt to access beyond end of device\n[ 43.106070] loop0: rw\u003d0, want\u003d277414, limit\u003d277408\n[ 43.106073] Buffer I/O error on device loop0, logical block 138706\n[ 43.106078] attempt to access beyond end of device\n[ 43.106081] loop0: rw\u003d0, want\u003d277416, limit\u003d277408\n[ 43.106085] Buffer I/O error on device loop0, logical block 138707\n[ 43.106089] attempt to access beyond end of device\n[ 43.106093] loop0: rw\u003d0, want\u003d277418, limit\u003d277408\n[ 43.106096] Buffer I/O error on device loop0, logical block 138708\n[ 43.106101] attempt to access beyond end of device\n[ 43.106104] loop0: rw\u003d0, want\u003d277420, limit\u003d277408\n[ 43.106108] Buffer I/O error on device loop0, logical block 138709\n[ 43.106112] attempt to access beyond end of device\n[ 43.106116] loop0: rw\u003d0, want\u003d277422, limit\u003d277408\n[ 43.106120] Buffer I/O error on device loop0, logical block 138710\n[ 43.106124] attempt to access beyond end of device\n[ 43.106128] loop0: rw\u003d0, want\u003d277424, limit\u003d277408\n[ 43.106131] Buffer I/O error on device loop0, logical block 138711\n[ 43.106135] attempt to access beyond end of device\n[ 43.106139] loop0: rw\u003d0, want\u003d277426, limit\u003d277408\n[ 43.106143] Buffer I/O error on device loop0, logical block 138712\n[ 43.106147] attempt to access beyond end of device\n[ 43.106151] loop0: rw\u003d0, want\u003d277428, limit\u003d277408\n[ 43.106154] Buffer I/O error on device loop0, logical block 138713\n[ 43.106158] attempt to access beyond end of device\n[ 43.106162] loop0: rw\u003d0, want\u003d277430, limit\u003d277408\n[ 43.106166] attempt to access beyond end of device\n[ 43.106169] loop0: rw\u003d0, want\u003d277432, limit\u003d277408\n...\n[ 43.106307] attempt to access beyond end of device\n[ 43.106311] loop0: rw\u003d0, want\u003d277470, limit\u003d2774\n\nSquashfs manages to read in the end block(s) of the disk during the\nmount operation. Then, when dd reads the block device, it leads to\nblock_read_full_page being called with buffers that are beyond end of\ndisk, but are marked as mapped. Thus, it would end up submitting read\nI/O against them, resulting in the errors mentioned above. I fixed the\nproblem by modifying init_page_buffers to only set the buffer mapped if\nit fell inside of i_size.\n\nCheers,\nJeff\n\nSigned-off-by: Jeff Moyer \u003cjmoyer@redhat.com\u003e\nAcked-by: Nick Piggin \u003cnpiggin@kernel.dk\u003e\n\n--\n\nChanges from v1-\u003ev2: re-used max_block, as suggested by Nick Piggin.\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "e0268868ba064980488fc8c194db3d8e9fb2959c", "tree": "7b8bfb4cceb0a5d184a2fe651aab5aec59a216d3", "parents": [ "c57b54684060c8aced64a5b78ff69ff289af97b9" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Fri May 04 05:24:54 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu May 10 23:15:47 2012 -0400" }, "message": "sctp: check cached dst before using it\n\ndst_check() will take care of SA (and obsolete field), hence\nIPsec rekeying scenario is taken into account.\n\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nAcked-by: Vlad Yaseivch \u003cvyasevich@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "59b9997baba5242997ddc7bd96b1391f5275a5a4", "tree": "eaef6c0eff50403fcf871cdd4b7c4afa605f0541", "parents": [ "380ec964bc19f865af70c0339dff1cb75dc4f8f2" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu May 10 23:03:34 2012 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu May 10 23:03:34 2012 -0400" }, "message": "Revert \"net: maintain namespace isolation between vlan and real device\"\n\nThis reverts commit 8a83a00b0735190384a348156837918271034144.\n\nIt causes regressions for S390 devices, because it does an\nunconditional DST drop on SKBs for vlans and the QETH device\nneeds the neighbour entry hung off the DST for certain things\non transmit.\n\nArnd can\u0027t remember exactly why he even needed this change.\n\nConflicts:\n\n\tdrivers/net/macvlan.c\n\tnet/8021q/vlan_dev.c\n\tnet/core/dev.c\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9b63776fa3ca96c4ecda76f6fa947b7b0add66ac", "tree": "ac90f2faceecab78d7d547c33daef31d4a9e2943", "parents": [ "20d23aaa31da295378abff4272716e3dfc72baf0" ], "author": { "name": "Steven Rostedt", "email": "srostedt@redhat.com", "time": "Thu May 10 15:55:43 2012 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu May 10 15:55:43 2012 -0400" }, "message": "tracing: Do not enable function event with enable\n\nWith the adding of function tracing event to perf, it caused a\nside effect that produces the following warning when enabling all\nevents in ftrace:\n\n # echo 1 \u003e /sys/kernel/debug/tracing/events/enable\n\n[console]\nevent trace: Could not enable event function\n\nThis is because when enabling all events via the debugfs system\nit ignores events that do not have a -\u003ereg() function assigned.\nThis was to skip over the ftrace internal events (as they are\nnot TRACE_EVENTs). But as the ftrace function event now has\na -\u003ereg() function attached to it for use with perf, it is no\nlonger ignored.\n\nWorse yet, this -\u003ereg() function is being called when it should\nnot be. It returns an error and causes the above warning to\nbe printed.\n\nBy adding a new event_call flag (TRACE_EVENT_FL_IGNORE_ENABLE)\nand have all ftrace internel event structures have it set,\nsetting the events/enable will no longe try to incorrectly enable\nthe function event and does not warn.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "1c430a727fa512500a422ffe4712166c550ea06a", "tree": "5027e4edc9c66a9e49e0e73ba866f5bb326fadcd", "parents": [ "6eddcb4c82883451aec3be1240f17793370fa62f" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon May 07 15:39:06 2012 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon May 07 19:21:29 2012 -0400" }, "message": "net: compare_ether_addr[_64bits]() has no ordering\n\nNeither compare_ether_addr() nor compare_ether_addr_64bits()\n(as it can fall back to the former) have comparison semantics\nlike memcmp() where the sign of the return value indicates sort\norder. We had a bug in the wireless code due to a blind memcmp\nreplacement because of this.\n\nA cursory look suggests that the wireless bug was the only one\ndue to this semantic difference.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "18b15fcde715a5512671af9d72a76e7f6d7cb6f0", "tree": "073ca0c45f48abae1809e86efc06e22e7528f0e7", "parents": [ "271fd5d7286eb931142402c170943d14640bb922", "ab27a20e6212cd1d96d813352b47e1fc1cfd01db" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 06 12:19:38 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 06 12:19:38 2012 -0700" }, "message": "Merge branch \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes form Peter Anvin\n\n* \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n intel_mid_powerbtn: mark irq as IRQF_NO_SUSPEND\n arch/x86/platform/geode/net5501.c: change active_low to 0 for LED driver\n x86, relocs: Remove an unused variable\n asm-generic: Use __BITS_PER_LONG in statfs.h\n x86/amd: Re-enable CPU topology extensions in case BIOS has disabled it\n" }, { "commit": "59068e369b6a2a0a15b93624887525d9ec0f36e5", "tree": "7d165bb50d379e37ca7f0b3fed5da9f7719e22e4", "parents": [ "377485f6244af255b04d662cf19cddbbc4ae4310", "1cc0c998fdf2cb665d625fb565a0d6db5c81c639" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 05 10:06:06 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 05 10:06:06 2012 -0700" }, "message": "Merge branch \u0027release\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux\n\nPull an ACPI patch from Len Brown:\n \"It fixes a D3 issue new in 3.4-rc1.\"\n\nBy Lin Ming via Len Brown:\n* \u0027release\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux:\n ACPI: Fix D3hot v D3cold confusion\n" }, { "commit": "1cc0c998fdf2cb665d625fb565a0d6db5c81c639", "tree": "2768315b4d2217ea16082947bf995edfc40d5faf", "parents": [ "ec612fcf43e09f5e05d37baf4d3f138b3fcc2f3d" ], "author": { "name": "Lin Ming", "email": "ming.m.lin@intel.com", "time": "Mon Apr 23 09:03:49 2012 +0800" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat May 05 01:19:52 2012 -0400" }, "message": "ACPI: Fix D3hot v D3cold confusion\n\nBefore this patch, ACPI_STATE_D3 incorrectly referenced D3hot\nin some places, but D3cold in other places.\n\nAfter this patch, ACPI_STATE_D3 always means ACPI_STATE_D3_COLD;\nand all references to D3hot use ACPI_STATE_D3_HOT.\n\nACPI\u0027s _PR3 method is used to enter both D3hot and D3cold states.\nWhat distinguishes D3hot from D3cold is the presence _PR3\n(Power Resources for D3hot) If these resources are all ON,\nthen the state is D3hot. If _PR3 is not present,\nor all _PR0 resources for the devices are OFF,\nthen the state is D3cold.\n\nThis patch applies after Linux-3.4-rc1.\nA future syntax cleanup may remove ACPI_STATE_D3\nto emphasize that it always means ACPI_STATE_D3_COLD.\n\nSigned-off-by: Lin Ming \u003cming.m.lin@intel.com\u003e\nAcked-by: Rafael J. Wysocki \u003crjw@sisk.pl\u003e\nReviewed-by: Aaron Lu \u003caaron.lu@amd.com\u003e\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "4f988f152ee087831ea5c1c77cda4454cacc052c", "tree": "9078ecf501ebeb4412a0f91ff3125f41fb2535ac", "parents": [ "2f624278626677bfaf73fef97f86b37981621f5c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 04 15:13:54 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 04 15:13:54 2012 -0700" }, "message": "seqlock: add \u0027raw_seqcount_begin()\u0027 function\n\nThe normal read_seqcount_begin() function will wait for any current\nwriters to exit their critical region by looping until the sequence\ncount is even.\n\nThat \"wait for sequence count to stabilize\" is the right thing to do if\nthe read-locker will just retry the whole operation on contention: no\npoint in doing a potentially expensive reader sequence if we know at the\nbeginning that we\u0027ll just end up re-doing it all.\n\nHOWEVER. Some users don\u0027t actually retry the operation, but instead\nwill abort and do the operation with proper locking. So the sequence\ncount case may be the optimistic quick case, but in the presense of\nwriters you may want to do full locking in order to guarantee forward\nprogress. The prime example of this would be the RCU name lookup.\n\nAnd in that case, you may well be better off without the \"retry early\",\nand are in a rush to instead get to the failure handling. Thus this\n\"raw\" interface that just returns the sequence number without testing it\n- it just forces the low bit to zero so that read_seqcount_retry() will\nalways fail such a \"active concurrent writer\" scenario.\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "2f624278626677bfaf73fef97f86b37981621f5c", "tree": "011d5b7d5a6a74d476a80b513f3dd4d78762ed03", "parents": [ "f0f376f204b6047bbb405180f796e93cc8444f09" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 04 14:46:02 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 04 14:46:02 2012 -0700" }, "message": "Fix __read_seqcount_begin() to use ACCESS_ONCE for sequence value read\n\nWe really need to use a ACCESS_ONCE() on the sequence value read in\n__read_seqcount_begin(), because otherwise the compiler might end up\nreloading the value in between the test and the return of it. As a\nresult, it might end up returning an odd value (which means that a write\nis in progress).\n\nIf the reader is then fast enough that that odd value is still the\ncurrent one when the read_seqcount_retry() is done, we might end up with\na \"successful\" read sequence, even despite the concurrent write being\nactive.\n\nIn practice this probably never really happens - there just isn\u0027t\nanything else going on around the read of the sequence count, and the\ncommon case is that we end up having a read barrier immediately\nafterwards.\n\nSo the code sequence in which gcc might decide to reaload from memory is\nsmall, and there\u0027s no reason to believe it would ever actually do the\nreload. But if the compiler ever were to decide to do so, it would be\nincredibly annoying to debug. Let\u0027s just make sure.\n\nCc: stable@kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c42f1d4b523950c4af060f8fc0c7016755d8a3bc", "tree": "8322c9c14b0c7055ce924d12c1150d2acb0ea95e", "parents": [ "913a90416918a591e6d5ece036b795c58a08131d", "5a8887d39e1ba5ee2d4ccb94b14d6f2dce5ddfca" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 03 17:10:39 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 03 17:10:39 2012 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n\n 1) Transfer padding was wrong for full-speed USB in ASIX driver, fix\n from Ingo van Lil.\n\n 2) Propagate the negative packet offset fix into the PowerPC BPF JIT.\n From Jan Seiffert.\n\n 3) dl2k driver\u0027s private ioctls were letting unprivileged tasks make\n MII writes and other ugly bits like that. Fix from Jeff Mahoney.\n\n 4) Fix TX VLAN and RX packet drops in ucc_geth, from Joakim Tjernlund.\n\n 5) OOPS and network namespace fixes in IPVS from Hans Schillstrom and\n Julian Anastasov.\n\n 6) Fix races and sleeping in locked context bugs in drop_monitor, from\n Neil Horman.\n\n 7) Fix link status indication in smsc95xx driver, from Paolo Pisati.\n\n 8) Fix bridge netfilter OOPS, from Peter Huang.\n\n 9) L2TP sendmsg can return on error conditions with the socket lock\n held, oops. Fix from Sasha Levin.\n\n10) udp_diag should return meaningful values for socket memory usage,\n from Shan Wei.\n\n11) Eric Dumazet is so awesome he gets his own section:\n\n Socket memory cgroup code (I never should have applied those\n patches, grumble...) made erroneous changes to\n sk_sockets_allocated_read_positive(). It was changed to\n use percpu_counter_sum_positive (which requires BH disabling)\n instead of percpu_counter_read_positive (which does not).\n Revert back to avoid crashes and lockdep warnings.\n\n Adjust the default tcp_adv_win_scale and tcp_rmem[2] values\n to fix throughput regressions. This is necessary as a result\n of our more precise skb-\u003etruesize tracking.\n\n Fix SKB leak in netem packet scheduler.\n\n12) New device IDs for various bluetooth devices, from Manoj Iyer,\n AceLan Kao, and Steven Harms.\n\n13) Fix command completion race in ipw2200, from Stanislav Yakovlev.\n\n14) Fix rtlwifi oops on unload, from Larry Finger.\n\n15) Fix hard_mtu when adjusting hard_header_len in smsc95xx driver.\n From Stephane Fillod.\n\n16) ehea driver registers it\u0027s IRQ before all the necessary state is\n setup, resulting in crashes. Fix from Thadeu Lima de Souza\n Cascardo.\n\n17) Fix PHY connection failures in davinci_emac driver, from Anatolij\n Gustschin.\n\n18) Missing break; in switch statement in bluetooth\u0027s\n hci_cmd_complete_evt(). Fix from Szymon Janc.\n\n19) Fix queue programming in iwlwifi, from Johannes Berg.\n\n20) Interrupt throttling defaults not being actually programmed into the\n hardware, fix from Jeff Kirsher and Ying Cai.\n\n21) TLAN driver SKB encoding in descriptor busted on 64-bit, fix from\n Benjamin Poirier.\n\n22) Fix blind status block RX producer pointer deref in TG3 driver, from\n Matt Carlson.\n\n23) Promisc and multicast are busted on ehea, fixes from Thadeu Lima de\n Souza Cascardo.\n\n24) Fix crashes in 6lowpan, from Alexander Smirnov.\n\n25) tcp_complete_cwr() needs to be careful to not rewind the CWND to\n ssthresh if ssthresh has the \"infinite\" value. Fix from Yuchung\n Cheng.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (81 commits)\n sungem: Fix WakeOnLan\n tcp: change tcp_adv_win_scale and tcp_rmem[2]\n net: l2tp: unlock socket lock before returning from l2tp_ip_sendmsg\n drop_monitor: prevent init path from scheduling on the wrong cpu\n usbnet: fix failure handling in usbnet_probe\n usbnet: fix leak of transfer buffer of dev-\u003einterrupt\n ucc_geth: Add 16 bytes to max TX frame for VLANs\n net: ucc_geth, increase no. of HW RX descriptors\n netem: fix possible skb leak\n sky2: fix receive length error in mixed non-VLAN/VLAN traffic\n sky2: propogate rx hash when packet is copied\n net: fix two typos in skbuff.h\n cxgb3: Don\u0027t call cxgb_vlan_mode until q locks are initialized\n ixgbe: fix calling skb_put on nonlinear skb assertion bug\n ixgbe: Fix a memory leak in IEEE DCB\n igbvf: fix the bug when initializing the igbvf\n smsc75xx: enable mac to detect speed/duplex from phy\n smsc75xx: declare smsc75xx\u0027s MII as GMII capable\n smsc75xx: fix phy interrupt acknowledge\n smsc75xx: fix phy init reset loop\n ...\n" }, { "commit": "076e7779c07c56c7fa593a28c71ea7432d0c7c95", "tree": "70a4227b5d898c1abf37ed5779b0cd6f29b471bc", "parents": [ "116a0fc31c6c9b8fc821be5a96e5bf0b43260131", "66f2c99af3d6f2d0aa1120884cf1c60613ef61c0" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Tue May 01 14:14:05 2012 -0400" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Tue May 01 14:14:05 2012 -0400" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem\n" } ], "next": "d961949660fa1c1b7eb0c3a3c157989c90f14e8e" }