)]}' { "log": [ { "commit": "d707b52912bfa83176b75efd40da193c18eef1e0", "tree": "e6fc5658b3c3da82e770230b1fdca21075405b05", "parents": [ "d1a94e022b36342cbdb156a9693bca95aab11ca4" ], "author": { "name": "Li RongQing", "email": "roy.qing.li@gmail.com", "time": "Wed Oct 24 14:01:18 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:15 2012 -0800" }, "message": "ipv6: Set default hoplimit as zero.\n\n[ Upstream commit 14edd87dc67311556f1254a8f29cf4dd6cb5b7d1 ]\n\nCommit a02e4b7dae4551(Demark default hoplimit as zero) only changes the\nhoplimit checking condition and default value in ip6_dst_hoplimit, not\nzeros all hoplimit default value.\n\nKeep the zeroing ip6_template_metrics[RTAX_HOPLIMIT - 1] to force it as\nconst, cause as a37e6e344910(net: force dst_default_metrics to const\nsection)\n\nSigned-off-by: Li RongQing \u003croy.qing.li@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d1a94e022b36342cbdb156a9693bca95aab11ca4", "tree": "f2d876615d5f8974ee3694796c720635ac561e40", "parents": [ "0f04b9af7ce98a3db1c4401cced1fef321a9dd57" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Oct 18 09:14:12 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:15 2012 -0800" }, "message": "tcp: fix FIONREAD/SIOCINQ\n\n[ Upstream commit a3374c42aa5f7237e87ff3b0622018636b0c847e ]\n\ntcp_ioctl() tries to take into account if tcp socket received a FIN\nto report correct number bytes in receive queue.\n\nBut its flaky because if the application ate the last skb,\nwe return 1 instead of 0.\n\nCorrect way to detect that FIN was received is to test SOCK_DONE.\n\nReported-by: Elliot Hughes \u003cenh@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Neal Cardwell \u003cncardwell@google.com\u003e\nCc: Tom Herbert \u003ctherbert@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0f04b9af7ce98a3db1c4401cced1fef321a9dd57", "tree": "b924c82f11995692628a0eb3596cd7b7b8774f28", "parents": [ "c2f5b7507ac5d808f29287d77ee6148358d7fbfe" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Oct 18 03:21:55 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:14 2012 -0800" }, "message": "netlink: use kfree_rcu() in netlink_release()\n\n[ Upstream commit 6d772ac5578f711d1ce7b03535d1c95bffb21dff ]\n\nOn some suspend/resume operations involving wimax device, we have\nnoticed some intermittent memory corruptions in netlink code.\n\nStéphane Marchesin tracked this corruption in netlink_update_listeners()\nand suggested a patch.\n\nIt appears netlink_release() should use kfree_rcu() instead of kfree()\nfor the listeners structure as it may be used by other cpus using RCU\nprotection.\n\nnetlink_release() must set to NULL the listeners pointer when\nit is about to be freed.\n\nAlso have to protect netlink_update_listeners() and\nnetlink_has_listeners() if listeners is NULL.\n\nAdd a nl_deref_protected() lockdep helper to properly document which\nlocks protects us.\n\nReported-by: Jonathan Kliegman \u003ckliegs@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Stéphane Marchesin \u003cmarcheu@google.com\u003e\nCc: Sam Leffler \u003csleffler@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c2f5b7507ac5d808f29287d77ee6148358d7fbfe", "tree": "1dd9461fad77f448c61ad0aa6fd6328f18201e29", "parents": [ "9de4f2694044af68a826a568f0c97b1b83b5b173" ], "author": { "name": "Zijie Pan", "email": "zijie.pan@6wind.com", "time": "Mon Oct 15 03:56:39 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:13 2012 -0800" }, "message": "sctp: fix call to SCTP_CMD_PROCESS_SACK in sctp_cmd_interpreter()\n\n[ Upstream commit f6e80abeab928b7c47cc1fbf53df13b4398a2bec ]\n\nBug introduced by commit edfee0339e681a784ebacec7e8c2dc97dc6d2839\n(sctp: check src addr when processing SACK to update transport state)\n\nSigned-off-by: Zijie Pan \u003czijie.pan@6wind.com\u003e\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nAcked-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1feb89af489539f927fc9ff0de99c945eec181c2", "tree": "35e98c43990a36c69d84efb1020d4fe44ddb993d", "parents": [ "d39904cae2cb6e0dcbee3f80692b6052515e43ea" ], "author": { "name": "Antonio Quartulli", "email": "ordex@autistici.org", "time": "Fri Oct 26 18:54:25 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:11 2012 -0800" }, "message": "mac80211: fix SSID copy on IBSS JOIN\n\ncommit badecb001a310408d3473b1fc2ed5aefd0bc92a9 upstream.\n\nThe \u0027ssid\u0027 field of the cfg80211_ibss_params is a u8 pointer and\nits length is likely to be less than IEEE80211_MAX_SSID_LEN most\nof the time.\n\nThis patch fixes the ssid copy in ieee80211_ibss_join() by using\nthe SSID length to prevent it from reading beyond the string.\n\nSigned-off-by: Antonio Quartulli \u003cordex@autistici.org\u003e\n[rewrapped commit message, small rewording]\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d39904cae2cb6e0dcbee3f80692b6052515e43ea", "tree": "d9d9e329dfa9e729dce5d3b9dcf3692770049c74", "parents": [ "4435990b6d456a8c5cac203c025d1f10e0b48a93" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Fri Oct 26 00:41:23 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:11 2012 -0800" }, "message": "mac80211: make sure data is accessible in EAPOL check\n\ncommit 6dbda2d00d466225f9db1dc695ff852443f28832 upstream.\n\nThe code to allow EAPOL frames even when the station\nisn\u0027t yet marked associated needs to check that the\nincoming frame is long enough and due to paged RX it\nalso can\u0027t assume skb-\u003edata contains the right data,\nit must use skb_copy_bits(). Fix this to avoid using\ndata that doesn\u0027t really exist.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4435990b6d456a8c5cac203c025d1f10e0b48a93", "tree": "69364585dbc2eca1b9d073544416e515417c16f4", "parents": [ "537d86c490a03bcb56dfa24c0327c18e61b1ced5" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Fri Oct 26 00:36:40 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:11 2012 -0800" }, "message": "mac80211: verify that skb data is present\n\ncommit 9b395bc3be1cebf0144a127c7e67d56dbdac0930 upstream.\n\nA number of places in the mesh code don\u0027t check that\nthe frame data is present and in the skb header when\ntrying to access. Add those checks and the necessary\npskb_may_pull() calls. This prevents accessing data\nthat doesn\u0027t actually exist.\n\nTo do this, export ieee80211_get_mesh_hdrlen() to be\nable to use it in mac80211.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "537d86c490a03bcb56dfa24c0327c18e61b1ced5", "tree": "5d6aa73453746c3439923c64e90dc4b7c2ef60aa", "parents": [ "4b51c17efde8501badb4bf7355172eb262407ad8" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Fri Oct 26 00:33:36 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:08 2012 -0800" }, "message": "mac80211: check management frame header length\n\ncommit 4a4f1a5808c8bb0b72a4f6e5904c53fb8c9cd966 upstream.\n\nDue to pskb_may_pull() checking the skb length, all\nnon-management frames are checked on input whether\ntheir 802.11 header is fully present. Also add that\ncheck for management frames and remove a check that\nis now duplicate. This prevents accessing skb data\nbeyond the frame end.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7be001e0fa58fa84e81fcc8a7951a3f3fe7c642c", "tree": "547d250a0b903cd569ba380837dfa56c5e3e3a0e", "parents": [ "739b9fa801cab6bd63d51de7d7a97b7bd8bbbdc8" ], "author": { "name": "Javier Cardona", "email": "javier@cozybit.com", "time": "Thu Oct 25 11:10:18 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:15:56 2012 -0800" }, "message": "mac80211: don\u0027t inspect Sequence Control field on control frames\n\ncommit f7fbf70ee9db6da6033ae50d100e017ac1f26555 upstream.\n\nPer IEEE Std. 802.11-2012, Sec 8.2.4.4.1, the sequence Control field is\nnot present in control frames. We noticed this problem when processing\nBlock Ack Requests.\n\nSigned-off-by: Javier Cardona \u003cjavier@cozybit.com\u003e\nSigned-off-by: Javier Lopez \u003cjlopex@cozybit.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "739b9fa801cab6bd63d51de7d7a97b7bd8bbbdc8", "tree": "3c027cf091a81bb289151421cdbd2bd4ced39a2f", "parents": [ "fec9a0c8f048db2807646fea92bdd87dc8adbade" ], "author": { "name": "Javier Cardona", "email": "javier@cozybit.com", "time": "Wed Oct 24 12:43:30 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:15:56 2012 -0800" }, "message": "mac80211: Only process mesh config header on frames that RA_MATCH\n\ncommit 555cb715be8ef98b8ec362b23dfc254d432a35b1 upstream.\n\nDoing otherwise is wrong, and may wreak havoc on the mpp tables,\nspecially if the frame is encrypted.\n\nReported-by: Chaoxing Lin \u003cChaoxing.Lin@ultra-3eti.com\u003e\nSigned-off-by: Javier Cardona \u003cjavier@cozybit.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fec9a0c8f048db2807646fea92bdd87dc8adbade", "tree": "792fa10ed97e5b92b2ece3c6d1d9f7c12601f4bf", "parents": [ "2404ce30fd4e4c46d3c3869093a5987c0d56fee6" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Oct 24 14:19:53 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:15:56 2012 -0800" }, "message": "mac80211: use blacklist for duplicate IE check\n\ncommit 9690fb169b433a66485c808e4fc352b8a0f8d866 upstream.\n\nInstead of the current whitelist which accepts duplicates\nonly for the quiet and vendor IEs, use a blacklist of all\nIEs (that we currently parse) that can\u0027t be duplicated.\n\nThis avoids detecting a beacon as corrupt in the future\nwhen new IEs are added that can be duplicated.\n\nSigned-off-by: Paul Stewart \u003cpstew@chromium.org\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2404ce30fd4e4c46d3c3869093a5987c0d56fee6", "tree": "4725767f550e260a7f7045332282365587fb9211", "parents": [ "91721d4a83437f183d29ae6397a3934fcfa28436" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Oct 25 21:51:59 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:15:56 2012 -0800" }, "message": "wireless: drop invalid mesh address extension frames\n\ncommit 7dd111e8ee10cc6816669eabcad3334447673236 upstream.\n\nThe mesh header can have address extension by a 4th\nor a 5th and 6th address, but never both. Drop such\nframes in 802.11 -\u003e 802.3 conversion along with any\nframes that have the wrong extension.\n\nReviewed-by: Javier Cardona \u003cjavier@cozybit.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "91721d4a83437f183d29ae6397a3934fcfa28436", "tree": "ce23ce382def353c162f041c8856bf2899f3c439", "parents": [ "bfc5de3bc907e97b9aabce6d6517a55d5ed6d791" ], "author": { "name": "Felix Fietkau", "email": "nbd@openwrt.org", "time": "Wed Oct 17 13:56:19 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:15:56 2012 -0800" }, "message": "cfg80211: fix antenna gain handling\n\ncommit c4a9fafc77a5318f5ed26c509bbcddf03e18c201 upstream.\n\nNo driver initializes chan-\u003emax_antenna_gain to something sensible, and\nthe only place where it is being used right now is inside ath9k. This\nleads to ath9k potentially using less tx power than it can use, which can\ndecrease performance/range in some rare cases.\n\nRather than going through every single driver, this patch initializes\nchan-\u003eorig_mag in wiphy_register(), ignoring whatever value the driver\nleft in there. If a driver for some reason wishes to limit it independent\nfrom regulatory rulesets, it can do so internally.\n\nSigned-off-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0fb0773f2da4ffa566e0c813dc295c44208debb5", "tree": "eeaf0c1ef2e7e08419ccde084883ae19c2e76989", "parents": [ "5a01241c81ac4bf6a7a486051699f791634e7b22" ], "author": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Thu Oct 11 16:26:06 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 31 10:03:02 2012 -0700" }, "message": "Bluetooth: SMP: Fix setting unknown auth_req bits\n\ncommit 065a13e2cc665f6547dc7e8a9d6b6565badf940a upstream.\n\nWhen sending a pairing request or response we should not just blindly\ncopy the value that the remote device sent. Instead we should at least\nmake sure to mask out any unknown bits. This is particularly critical\nfrom the upcoming LE Secure Connections feature perspective as\nincorrectly indicating support for it (by copying the remote value)\nwould cause a failure to pair with devices that support it.\n\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5a01241c81ac4bf6a7a486051699f791634e7b22", "tree": "54c7be81f6291608f8d34221acb37e6d29839261", "parents": [ "adb91f6de096f878fb1cb9e0ff5839b2d432e67e" ], "author": { "name": "Stanislaw Gruszka", "email": "sgruszka@redhat.com", "time": "Tue Oct 02 21:34:23 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 31 10:03:01 2012 -0700" }, "message": "mac80211: check if key has TKIP type before updating IV\n\ncommit 4045f72bcf3c293c7c5932ef001742d8bb5ded76 upstream.\n\nThis patch fix corruption which can manifest itself by following crash\nwhen switching on rfkill switch with rt2x00 driver:\nhttps://bugzilla.redhat.com/attachment.cgi?id\u003d615362\n\nPointer key-\u003eu.ccmp.tfm of group key get corrupted in:\n\nieee80211_rx_h_michael_mic_verify():\n\n /* update IV in key information to be able to detect replays */\n rx-\u003ekey-\u003eu.tkip.rx[rx-\u003esecurity_idx].iv32 \u003d rx-\u003etkip_iv32;\n rx-\u003ekey-\u003eu.tkip.rx[rx-\u003esecurity_idx].iv16 \u003d rx-\u003etkip_iv16;\n\nbecause rt2x00 always set RX_FLAG_MMIC_STRIPPED, even if key is not TKIP.\n\nWe already check type of the key in different path in\nieee80211_rx_h_michael_mic_verify() function, so adding additional\ncheck here is reasonable.\n\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6c6dff65535906e5a7a27010447fad0cb316a1fb", "tree": "383516af7652bf48e222a636301df98acd90acbf", "parents": [ "dedf1c2d17cd81796fc25190fd194e8dd0269817" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Tue Oct 23 17:50:07 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 31 10:02:57 2012 -0700" }, "message": "SUNRPC: Prevent races in xs_abort_connection()\n\ncommit 4bc1e68ed6a8b59be8a79eb719be515a55c7bc68 upstream.\n\nThe call to xprt_disconnect_done() that is triggered by a successful\nconnection reset will trigger another automatic wakeup of all tasks\non the xprt-\u003epending rpc_wait_queue. In particular it will cause an\nearly wake up of the task that called xprt_connect().\n\nAll we really want to do here is clear all the socket-specific state\nflags, so we split that functionality out of xs_sock_mark_closed()\ninto a helper that can be called by xs_abort_connection()\n\nReported-by: Chris Perl \u003cchris.perl@gmail.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nTested-by: Chris Perl \u003cchris.perl@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dedf1c2d17cd81796fc25190fd194e8dd0269817", "tree": "92b61790db24f33e70d35e46a9e255a2c1f94998", "parents": [ "ea2887242aafd45727ca22564105fd244f4c6584" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Tue Oct 23 11:40:02 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 31 10:02:57 2012 -0700" }, "message": "Revert \"SUNRPC: Ensure we close the socket on EPIPE errors too...\"\n\ncommit b9d2bb2ee537424a7f855e1f93eed44eb9ee0854 upstream.\n\nThis reverts commit 55420c24a0d4d1fce70ca713f84aa00b6b74a70e.\nNow that we clear the connected flag when entering TCP_CLOSE_WAIT,\nthe deadlock described in this commit is no longer possible.\nInstead, the resulting call to xs_tcp_shutdown() can interfere\nwith pending reconnection attempts.\n\nReported-by: Chris Perl \u003cchris.perl@gmail.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nTested-by: Chris Perl \u003cchris.perl@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ea2887242aafd45727ca22564105fd244f4c6584", "tree": "29ca711e18cae345f0fa421f4396f7b31cbaa3a6", "parents": [ "9f659caf90048296ca120143964222c3f8b6dae7" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Tue Oct 23 11:35:47 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 31 10:02:57 2012 -0700" }, "message": "SUNRPC: Clear the connect flag when socket state is TCP_CLOSE_WAIT\n\ncommit d0bea455dd48da1ecbd04fedf00eb89437455fdc upstream.\n\nThis is needed to ensure that we call xprt_connect() upon the next\ncall to call_connect().\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nTested-by: Chris Perl \u003cchris.perl@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9f659caf90048296ca120143964222c3f8b6dae7", "tree": "ddbbf877086b78f49f3e60e5b6c1e705c4fb2fdd", "parents": [ "71a36b53c81c3ecd1359af68ca4373e7d941a4c5" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Mon Oct 22 17:14:36 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 31 10:02:56 2012 -0700" }, "message": "SUNRPC: Get rid of the xs_error_report socket callback\n\ncommit f878b657ce8e7d3673afe48110ec208a29e38c4a upstream.\n\nChris Perl reports that we\u0027re seeing races between the wakeup call in\nxs_error_report and the connect attempts. Basically, Chris has shown\nthat in certain circumstances, the call to xs_error_report causes the\nrpc_task that is responsible for reconnecting to wake up early, thus\ntriggering a disconnect and retry.\n\nSince the sk-\u003esk_error_report() calls in the socket layer are always\nfollowed by a tcp_done() in the cases where we care about waking up\nthe rpc_tasks, just let the state_change callbacks take responsibility\nfor those wake ups.\n\nReported-by: Chris Perl \u003cchris.perl@gmail.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nTested-by: Chris Perl \u003cchris.perl@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dd2c50efa9941fe7393b5f490eeef68f18916211", "tree": "44296428b9215d6b77b51bd7e3441edcb5873358", "parents": [ "259c5a7fd824ebca122f04fc4202b88896f31d26" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Oct 16 07:37:27 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:16 2012 -0700" }, "message": "ipv6: addrconf: fix /proc/net/if_inet6\n\n[ Upstream commit 9f0d3c2781baa1102108e16efbe640dd74564a7c ]\n\nCommit 1d5783030a1 (ipv6/addrconf: speedup /proc/net/if_inet6 filling)\nadded bugs hiding some devices from if_inet6 and breaking applications.\n\n\"ip -6 addr\" could still display all IPv6 addresses, while \"ifconfig -a\"\ncouldnt.\n\nOne way to reproduce the bug is by starting in a shell :\n\nunshare -n /bin/bash\nifconfig lo up\n\nAnd in original net namespace, lo device disappeared from if_inet6\n\nReported-by: Jan Hinnerk Stosch \u003cjanhinnerk.stosch@gmail.com\u003e\nTested-by: Jan Hinnerk Stosch \u003cjanhinnerk.stosch@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Mihai Maruseac \u003cmihai.maruseac@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "259c5a7fd824ebca122f04fc4202b88896f31d26", "tree": "1bf6bb73cba3d865aa5964370c1ef47b50299d24", "parents": [ "04c592343f478826bf1e5d0d178bb295d848c428" ], "author": { "name": "Alexey Kuznetsov", "email": "kuznet@ms2.inr.ac.ru", "time": "Fri Oct 12 04:34:17 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:16 2012 -0700" }, "message": "tcp: resets are misrouted\n\n[ Upstream commit 4c67525849e0b7f4bd4fab2487ec9e43ea52ef29 ]\n\nAfter commit e2446eaa (\"tcp_v4_send_reset: binding oif to iif in no\nsock case\").. tcp resets are always lost, when routing is asymmetric.\nYes, backing out that patch will result in misrouting of resets for\ndead connections which used interface binding when were alive, but we\nactually cannot do anything here. What\u0027s died that\u0027s died and correct\nhandling normal unbound connections is obviously a priority.\n\nComment to comment:\n\u003e This has few benefits:\n\u003e 1. tcp_v6_send_reset already did that.\n\nIt was done to route resets for IPv6 link local addresses. It was a\nmistake to do so for global addresses. The patch fixes this as well.\n\nActually, the problem appears to be even more serious than guaranteed\nloss of resets. As reported by Sergey Soloviev \u003csol@eqv.ru\u003e, those\nmisrouted resets create a lot of arp traffic and huge amount of\nunresolved arp entires putting down to knees NAT firewalls which use\nasymmetric routing.\n\nSigned-off-by: Alexey Kuznetsov \u003ckuznet@ms2.inr.ac.ru\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "04c592343f478826bf1e5d0d178bb295d848c428", "tree": "e4c1c553b9e0801cbe6e7773f6af18b1a88d7166", "parents": [ "2d2f242f248f19c4618bde9091d20416e2c9a1f6" ], "author": { "name": "jeff.liu", "email": "jeff.liu@oracle.com", "time": "Mon Oct 08 18:57:27 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:15 2012 -0700" }, "message": "RDS: fix rds-ping spinlock recursion\n\n[ Upstream commit 5175a5e76bbdf20a614fb47ce7a38f0f39e70226 ]\n\nThis is the revised patch for fixing rds-ping spinlock recursion\naccording to Venkat\u0027s suggestions.\n\nRDS ping/pong over TCP feature has been broken for years(2.6.39 to\n3.6.0) since we have to set TCP cork and call kernel_sendmsg() between\nping/pong which both need to lock \"struct sock *sk\". However, this\nlock has already been hold before rds_tcp_data_ready() callback is\ntriggerred. As a result, we always facing spinlock resursion which\nwould resulting in system panic.\n\nGiven that RDS ping is only used to test the connectivity and not for\nserious performance measurements, we can queue the pong transmit to\nrds_wq as a delayed response.\n\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nCC: Venkat Venkatsubra \u003cvenkat.x.venkatsubra@oracle.com\u003e\nCC: David S. Miller \u003cdavem@davemloft.net\u003e\nCC: James Morris \u003cjames.l.morris@oracle.com\u003e\nSigned-off-by: Jie Liu \u003cjeff.liu@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2d2f242f248f19c4618bde9091d20416e2c9a1f6", "tree": "5b15e35dde9a352bde196de7619b7268271df260", "parents": [ "14a547a85a7fa2b6473eaa73b83e2055b476a5dc" ], "author": { "name": "Florian Zumbiehl", "email": "florz@florz.de", "time": "Sun Oct 07 15:51:58 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:15 2012 -0700" }, "message": "vlan: don\u0027t deliver frames for unknown vlans to protocols\n\n[ Upstream commit 48cc32d38a52d0b68f91a171a8d00531edc6a46e ]\n\n6a32e4f9dd9219261f8856f817e6655114cfec2f made the vlan code skip marking\nvlan-tagged frames for not locally configured vlans as PACKET_OTHERHOST if\nthere was an rx_handler, as the rx_handler could cause the frame to be received\non a different (virtual) vlan-capable interface where that vlan might be\nconfigured.\n\nAs rx_handlers do not necessarily return RX_HANDLER_ANOTHER, this could cause\nframes for unknown vlans to be delivered to the protocol stack as if they had\nbeen received untagged.\n\nFor example, if an ipv6 router advertisement that\u0027s tagged for a locally not\nconfigured vlan is received on an interface with macvlan interfaces attached,\nmacvlan\u0027s rx_handler returns RX_HANDLER_PASS after delivering the frame to the\nmacvlan interfaces, which caused it to be passed to the protocol stack, leading\nto ipv6 addresses for the announced prefix being configured even though those\nare completely unusable on the underlying interface.\n\nThe fix moves marking as PACKET_OTHERHOST after the rx_handler so the\nrx_handler, if there is one, sees the frame unchanged, but afterwards,\nbefore the frame is delivered to the protocol stack, it gets marked whether\nthere is an rx_handler or not.\n\nSigned-off-by: Florian Zumbiehl \u003cflorz@florz.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "742bd2b3cef97a6eea8168b8e356ca2f16b7f3eb", "tree": "8fc0e2b786e880bb7866adc77d25642f2a7394f3", "parents": [ "6114941a295ff186d29ab7462cce6a41a089c354" ], "author": { "name": "ramesh.nagappa@gmail.com", "email": "ramesh.nagappa@gmail.com", "time": "Fri Oct 05 19:10:15 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:15 2012 -0700" }, "message": "net: Fix skb_under_panic oops in neigh_resolve_output\n\n[ Upstream commit e1f165032c8bade3a6bdf546f8faf61fda4dd01c ]\n\nThe retry loop in neigh_resolve_output() and neigh_connected_output()\ncall dev_hard_header() with out reseting the skb to network_header.\nThis causes the retry to fail with skb_under_panic. The fix is to\nreset the network_header within the retry loop.\n\nSigned-off-by: Ramesh Nagappa \u003cramesh.nagappa@ericsson.com\u003e\nReviewed-by: Shawn Lu \u003cshawn.lu@ericsson.com\u003e\nReviewed-by: Robert Coulson \u003crobert.coulson@ericsson.com\u003e\nReviewed-by: Billie Alsup \u003cbillie.alsup@ericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "70f7f1c70af637a23ca09ba1d2d7c966d1bd5990", "tree": "b00dea2ae29b7459a2ff702134cc0824ecd0265d", "parents": [ "f0dc514c8a0fd7ee7b1f6a3ccdae3b38e6ee1578" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Thu Oct 04 20:15:48 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:15 2012 -0700" }, "message": "netlink: add reference of module in netlink_dump_start\n\n[ Upstream commit 6dc878a8ca39e93f70c42f3dd7260bde10c1e0f1 ]\n\nI get a panic when I use ss -a and rmmod inet_diag at the\nsame time.\n\nIt\u0027s because netlink_dump uses inet_diag_dump which belongs to module\ninet_diag.\n\nI search the codes and find many modules have the same problem. We\nneed to add a reference to the module which the cb-\u003edump belongs to.\n\nThanks for all help from Stephen,Jan,Eric,Steffen and Pablo.\n\nChange From v3:\nchange netlink_dump_start to inline,suggestion from Pablo and\nEric.\n\nChange From v2:\ndelete netlink_dump_done,and call module_put in netlink_dump\nand netlink_sock_destruct.\n\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9b62355a6daff8696ec7f7b1283b6a39650b9f14", "tree": "3e61e0e953d36b3f6b8705384bec209dcc228425", "parents": [ "baecc6ef799c7ab9a5fc0ba29ee560a5c264f306" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Mon Oct 22 12:56:58 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:13 2012 -0700" }, "message": "SUNRPC: Fix a UDP transport regression\n\ncommit f39c1bfb5a03e2d255451bff05be0d7255298fa4 and\ncommit 84e28a307e376f271505af65a7b7e212dd6f61f4 upstream.\n\nCommit 43cedbf0e8dfb9c5610eb7985d5f21263e313802 (SUNRPC: Ensure that\nwe grab the XPRT_LOCK before calling xprt_alloc_slot) is causing\nhangs in the case of NFS over UDP mounts.\n\nSince neither the UDP or the RDMA transport mechanism use dynamic slot\nallocation, we can skip grabbing the socket lock for those transports.\nAdd a new rpc_xprt_op to allow switching between the TCP and UDP/RDMA\ncase.\n\nNote that the NFSv4.1 back channel assigns the slot directly\nthrough rpc_run_bc_task, so we can ignore that case.\n\nReported-by: Dick Streefland \u003cdick.streefland@altium.nl\u003e\nSigned-off-by: Bryan Schumaker \u003cbjschuma@netapp.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "baecc6ef799c7ab9a5fc0ba29ee560a5c264f306", "tree": "ea9f341b7b0f2907d574dde7a8a588b2b7e1633e", "parents": [ "1b91a891bc337ecec08dea5436be0bbb03fec12b" ], "author": { "name": "Sasha Levin", "email": "levinsasha928@gmail.com", "time": "Tue Jul 17 00:01:26 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:13 2012 -0700" }, "message": "SUNRPC: Prevent kernel stack corruption on long values of flush\n\ncommit 212ba90696ab4884e2025b0b13726d67aadc2cd4 upstream.\n\nThe buffer size in read_flush() is too small for the longest possible values\nfor it. This can lead to a kernel stack corruption:\n\n[ 43.047329] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff833e64b4\n[ 43.047329]\n[ 43.049030] Pid: 6015, comm: trinity-child18 Tainted: G W 3.5.0-rc7-next-20120716-sasha #221\n[ 43.050038] Call Trace:\n[ 43.050435] [\u003cffffffff836c60c2\u003e] panic+0xcd/0x1f4\n[ 43.050931] [\u003cffffffff833e64b4\u003e] ? read_flush.isra.7+0xe4/0x100\n[ 43.051602] [\u003cffffffff810e94e6\u003e] __stack_chk_fail+0x16/0x20\n[ 43.052206] [\u003cffffffff833e64b4\u003e] read_flush.isra.7+0xe4/0x100\n[ 43.052951] [\u003cffffffff833e6500\u003e] ? read_flush_pipefs+0x30/0x30\n[ 43.053594] [\u003cffffffff833e652c\u003e] read_flush_procfs+0x2c/0x30\n[ 43.053596] [\u003cffffffff812b9a8c\u003e] proc_reg_read+0x9c/0xd0\n[ 43.053596] [\u003cffffffff812b99f0\u003e] ? proc_reg_write+0xd0/0xd0\n[ 43.053596] [\u003cffffffff81250d5b\u003e] do_loop_readv_writev+0x4b/0x90\n[ 43.053596] [\u003cffffffff81250fd6\u003e] do_readv_writev+0xf6/0x1d0\n[ 43.053596] [\u003cffffffff812510ee\u003e] vfs_readv+0x3e/0x60\n[ 43.053596] [\u003cffffffff812511b8\u003e] sys_readv+0x48/0xb0\n[ 43.053596] [\u003cffffffff8378167d\u003e] system_call_fastpath+0x1a/0x1f\n\nSigned-off-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7ae3bb7d050f8c7e3ef46c830968f3bb5ca2e232", "tree": "02f3770d015be5a50890e3d3354d855c238d284d", "parents": [ "aee054fb840f6fca8067a42f44df0e2a22e0378c" ], "author": { "name": "Jan Engelhardt", "email": "jengelh@inai.de", "time": "Fri Sep 21 22:26:52 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:28:00 2012 -0700" }, "message": "netfilter: xt_limit: have r-\u003ecost !\u003d 0 case work\n\ncommit 82e6bfe2fbc4d48852114c4f979137cd5bf1d1a8 upstream.\n\nCommit v2.6.19-rc1~1272^2~41 tells us that r-\u003ecost !\u003d 0 can happen when\na running state is saved to userspace and then reinstated from there.\n\nMake sure that private xt_limit area is initialized with correct values.\nOtherwise, random matchings due to use of uninitialized memory.\n\nSigned-off-by: Jan Engelhardt \u003cjengelh@inai.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "aee054fb840f6fca8067a42f44df0e2a22e0378c", "tree": "eba739490e10e462b18a408caa621b4e3d8e63ca", "parents": [ "29f0d1b362fcdcd7bb3071782184f4035d5784bd" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Mon May 07 10:51:43 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:28:00 2012 -0700" }, "message": "netfilter: limit, hashlimit: avoid duplicated inline\n\ncommit 7a909ac70f6b0823d9f23a43f19598d4b57ac901 upstream.\n\ncredit_cap can be set to credit, which avoids inlining user2credits\ntwice. Also, remove inline keyword and let compiler decide.\n\nold:\n 684 192 0 876 36c net/netfilter/xt_limit.o\n 4927 344 32 5303 14b7 net/netfilter/xt_hashlimit.o\nnow:\n 668 192 0 860 35c net/netfilter/xt_limit.o\n 4793 344 32 5169 1431 net/netfilter/xt_hashlimit.o\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "29f0d1b362fcdcd7bb3071782184f4035d5784bd", "tree": "5c3dc526737873c2d53ca876b24455e78a3ec56d", "parents": [ "7ea0513ee0bc8c8e85ade576caaf13a58b2cb55d" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Thu Aug 16 02:25:24 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:28:00 2012 -0700" }, "message": "netfilter: nf_ct_expect: fix possible access to uninitialized timer\n\ncommit 2614f86490122bf51eb7c12ec73927f1900f4e7d upstream.\n\nIn __nf_ct_expect_check, the function refresh_timer returns 1\nif a matching expectation is found and its timer is successfully\nrefreshed. This results in nf_ct_expect_related returning 0.\nNote that at this point:\n\n- the passed expectation is not inserted in the expectation table\n and its timer was not initialized, since we have refreshed one\n matching/existing expectation.\n\n- nf_ct_expect_alloc uses kmem_cache_alloc, so the expectation\n timer is in some undefined state just after the allocation,\n until it is appropriately initialized.\n\nThis can be a problem for the SIP helper during the expectation\naddition:\n\n ...\n if (nf_ct_expect_related(rtp_exp) \u003d\u003d 0) {\n if (nf_ct_expect_related(rtcp_exp) !\u003d 0)\n nf_ct_unexpect_related(rtp_exp);\n ...\n\nNote that nf_ct_expect_related(rtp_exp) may return 0 for the timer refresh\ncase that is detailed above. Then, if nf_ct_unexpect_related(rtcp_exp)\nreturns !\u003d 0, nf_ct_unexpect_related(rtp_exp) is called, which does:\n\n spin_lock_bh(\u0026nf_conntrack_lock);\n if (del_timer(\u0026exp-\u003etimeout)) {\n nf_ct_unlink_expect(exp);\n nf_ct_expect_put(exp);\n }\n spin_unlock_bh(\u0026nf_conntrack_lock);\n\nNote that del_timer always returns false if the timer has been\ninitialized. However, the timer was not initialized since setup_timer\nwas not called, therefore, the expectation timer remains in some\nundefined state. If I\u0027m not missing anything, this may lead to the\nremoval an unexistent expectation.\n\nTo fix this, the optimization that allows refreshing an expectation\nis removed. Now nf_conntrack_expect_related looks more consistent\nto me since it always add the expectation in case that it returns\nsuccess.\n\nThanks to Patrick McHardy for participating in the discussion of\nthis patch.\n\nI think this may be the source of the problem described by:\nhttp://marc.info/?l\u003dnetfilter-devel\u0026m\u003d134073514719421\u0026w\u003d2\n\nReported-by: Rafal Fitt \u003crafalf@aplusc.com.pl\u003e\nAcked-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7ea0513ee0bc8c8e85ade576caaf13a58b2cb55d", "tree": "6873907a8edb14ccb9144669c2473675fd0ad9a4", "parents": [ "6ebe631c590aa6c5e61ccec9ab1808f99705f9d5" ], "author": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Thu Aug 09 10:08:47 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:28:00 2012 -0700" }, "message": "netfilter: nf_nat_sip: fix via header translation with multiple parameters\n\ncommit f22eb25cf5b1157b29ef88c793b71972efc47143 upstream.\n\nVia-headers are parsed beginning at the first character after the Via-address.\nWhen the address is translated first and its length decreases, the offset to\nstart parsing at is incorrect and header parameters might be missed.\n\nUpdate the offset after translating the Via-address to fix this.\n\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6ebe631c590aa6c5e61ccec9ab1808f99705f9d5", "tree": "171a20f7d1e35f571e29fdf83f667396802d819b", "parents": [ "0b0ea6a363eb3f5802adcb07c8c23e052a10d6bb" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Aug 29 15:24:09 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:28:00 2012 -0700" }, "message": "netfilter: nf_nat_sip: fix incorrect handling of EBUSY for RTCP expectation\n\ncommit 3f509c689a07a4aa989b426893d8491a7ffcc410 upstream.\n\nWe\u0027re hitting bug while trying to reinsert an already existing\nexpectation:\n\nkernel BUG at kernel/timer.c:895!\ninvalid opcode: 0000 [#1] SMP\n[...]\nCall Trace:\n \u003cIRQ\u003e\n [\u003cffffffffa0069563\u003e] nf_ct_expect_related_report+0x4a0/0x57a [nf_conntrack]\n [\u003cffffffff812d423a\u003e] ? in4_pton+0x72/0x131\n [\u003cffffffffa00ca69e\u003e] ip_nat_sdp_media+0xeb/0x185 [nf_nat_sip]\n [\u003cffffffffa00b5b9b\u003e] set_expected_rtp_rtcp+0x32d/0x39b [nf_conntrack_sip]\n [\u003cffffffffa00b5f15\u003e] process_sdp+0x30c/0x3ec [nf_conntrack_sip]\n [\u003cffffffff8103f1eb\u003e] ? irq_exit+0x9a/0x9c\n [\u003cffffffffa00ca738\u003e] ? ip_nat_sdp_media+0x185/0x185 [nf_nat_sip]\n\nWe have to remove the RTP expectation if the RTCP expectation hits EBUSY\nsince we keep trying with other ports until we succeed.\n\nReported-by: Rafal Fitt \u003crafalf@aplusc.com.pl\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "285ff6c4a762f556275182bcef767b61174c0424", "tree": "4960f988e187c49a6273d42328f1ba20e0be8c12", "parents": [ "0fc58b2ff3f70a6bcfac562c68ec62939c37268a" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@blackhole.kfki.hu", "time": "Fri Jun 29 09:42:28 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:28:00 2012 -0700" }, "message": "netfilter: ipset: timeout fixing bug broke SET target special timeout value\n\ncommit a73f89a61f92b364f0b4a3be412b5b70553afc23 upstream.\n\nThe patch \"127f559 netfilter: ipset: fix timeout value overflow bug\"\nbroke the SET target when no timeout was specified.\n\nReported-by: Jean-Philippe Menil \u003cjean-philippe.menil@univ-nantes.fr\u003e\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@blackhole.kfki.hu\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0fc58b2ff3f70a6bcfac562c68ec62939c37268a", "tree": "b18b3e78186d41acd9c5b1ba73c3e5a3aff807d3", "parents": [ "7fcbcdc96302e9d3e3b36df4fbc86a4c82761092" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@blackhole.kfki.hu", "time": "Mon May 07 02:35:44 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:28:00 2012 -0700" }, "message": "netfilter: ipset: fix timeout value overflow bug\n\ncommit 127f559127f5175e4bec3dab725a34845d956591 upstream.\n\nLarge timeout parameters could result wrong timeout values due to\nan overflow at msec to jiffies conversion (reported by Andreas Herz)\n\n[ This patch was mangled by Pablo Neira Ayuso since David Laight and\n Eric Dumazet noticed that we were using hardcoded 1000 instead of\n MSEC_PER_SEC to calculate the timeout ]\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@blackhole.kfki.hu\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7fcbcdc96302e9d3e3b36df4fbc86a4c82761092", "tree": "770030ce43176a21b837307e7f8a4474d95d7296", "parents": [ "486aaeb0b972820ed704bdf416270ec4b0950da3" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Aug 29 16:25:49 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:28:00 2012 -0700" }, "message": "netfilter: nf_conntrack: fix racy timer handling with reliable events\n\ncommit 5b423f6a40a0327f9d40bc8b97ce9be266f74368 upstream.\n\nExisting code assumes that del_timer returns true for alive conntrack\nentries. However, this is not true if reliable events are enabled.\nIn that case, del_timer may return true for entries that were\njust inserted in the dying list. Note that packets / ctnetlink may\nhold references to conntrack entries that were just inserted to such\nlist.\n\nThis patch fixes the issue by adding an independent timer for\nevent delivery. This increases the size of the ecache extension.\nStill we can revisit this later and use variable size extensions\nto allocate this area on demand.\n\nTested-by: Oliver Smith \u003colipro@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "486aaeb0b972820ed704bdf416270ec4b0950da3", "tree": "a7bd741818d81ec8b85c273c009225f40170945a", "parents": [ "c8479435f2191c22871a4b27e7eb2d501f4661e8" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Sat Jul 07 20:30:11 2012 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:27:59 2012 -0700" }, "message": "ipvs: fix oops in ip_vs_dst_event on rmmod\n\ncommit 283283c4da91adc44b03519f434ee1e7e91d6fdb upstream.\n\n\tAfter commit 39f618b4fd95ae243d940ec64c961009c74e3333 (3.4)\n\"ipvs: reset ipvs pointer in netns\" we can oops in\nip_vs_dst_event on rmmod ip_vs because ip_vs_control_cleanup\nis called after the ipvs_core_ops subsys is unregistered and\nnet-\u003eipvs is NULL. Fix it by exiting early from ip_vs_dst_event\nif ipvs is NULL. It is safe because all services and dests\nfor the net are already freed.\n\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Simon Horman \u003chorms@verge.net.au\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c8479435f2191c22871a4b27e7eb2d501f4661e8", "tree": "aca208ae881fd4de8e75d818942e3ecc9164eb59", "parents": [ "c4c493a4adcee75e1e44af044d0b7fc1b5192b61" ], "author": { "name": "Amerigo Wang", "email": "amwang@redhat.com", "time": "Tue Oct 09 17:48:16 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:27:59 2012 -0700" }, "message": "pktgen: fix crash when generating IPv6 packets\n\ncommit 5aa8b572007c4bca1e6d3dd4c4820f1ae49d6bb2 upstream.\n\nFor IPv6, sizeof(struct ipv6hdr) \u003d 40, thus the following\nexpression will result negative:\n\n datalen \u003d pkt_dev-\u003ecur_pkt_size - 14 -\n sizeof(struct ipv6hdr) - sizeof(struct udphdr) -\n pkt_dev-\u003epkt_overhead;\n\nAnd, the check \"if (datalen \u003c sizeof(struct pktgen_hdr))\" will be\npassed as \"datalen\" is promoted to unsigned, therefore will cause\na crash later.\n\nThis is a quick fix by checking if \"datalen\" is negative. The following\npatch will increase the default value of \u0027min_pkt_size\u0027 for IPv6.\n\nThis bug should exist for a long time, so Cc -stable too.\n\nSigned-off-by: Cong Wang \u003camwang@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b77a7a0e9f3ed51b523857f26c42e350faf43add", "tree": "7333f7635b06fd46713006a4b5842697fe87d375", "parents": [ "0bd1ed9ead1a2b7fc1534bff04729c3712a6fb25" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Wed Sep 12 16:49:15 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:27:58 2012 -0700" }, "message": "SUNRPC: Ensure that the TCP socket is closed when in CLOSE_WAIT\n\ncommit a519fc7a70d1a918574bb826cc6905b87b482eb9 upstream.\n\nInstead of doing a shutdown() call, we need to do an actual close().\nDitto if/when the server is sending us junk RPC headers.\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nTested-by: Simon Kirby \u003csim@hostway.ca\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2583c9724757046ed749ec7d1fef2e371b02f203", "tree": "d3e3a0f293267014583f506ff8431bf0480afe15", "parents": [ "782d596c84bf4239b24906132ba6367ca7dca865" ], "author": { "name": "Ed Cashin", "email": "ecashin@coraid.com", "time": "Wed Sep 19 15:49:00 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:45 2012 +0900" }, "message": "net: do not disable sg for packets requiring no checksum\n\n[ Upstream commit c0d680e577ff171e7b37dbdb1b1bf5451e851f04 ]\n\nA change in a series of VLAN-related changes appears to have\ninadvertently disabled the use of the scatter gather feature of\nnetwork cards for transmission of non-IP ethernet protocols like ATA\nover Ethernet (AoE). Below is a reference to the commit that\nintroduces a \"harmonize_features\" function that turns off scatter\ngather when the NIC does not support hardware checksumming for the\nethernet protocol of an sk buff.\n\n commit f01a5236bd4b140198fbcc550f085e8361fd73fa\n Author: Jesse Gross \u003cjesse@nicira.com\u003e\n Date: Sun Jan 9 06:23:31 2011 +0000\n\n net offloading: Generalize netif_get_vlan_features().\n\nThe can_checksum_protocol function is not equipped to consider a\nprotocol that does not require checksumming. Calling it for a\nprotocol that requires no checksum is inappropriate.\n\nThe patch below has harmonize_features call can_checksum_protocol when\nthe protocol needs a checksum, so that the network layer is not forced\nto perform unnecessary skb linearization on the transmission of AoE\npackets. Unnecessary linearization results in decreased performance\nand increased memory pressure, as reported here:\n\n http://www.spinics.net/lists/linux-mm/msg15184.html\n\nThe problem has probably not been widely experienced yet, because\nonly recently has the kernel.org-distributed aoe driver acquired the\nability to use payloads of over a page in size, with the patchset\nrecently included in the mm tree:\n\n https://lkml.org/lkml/2012/8/28/140\n\nThe coraid.com-distributed aoe driver already could use payloads of\ngreater than a page in size, but its users generally do not use the\nnewest kernels.\n\nSigned-off-by: Ed Cashin \u003cecashin@coraid.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "782d596c84bf4239b24906132ba6367ca7dca865", "tree": "587642f6042dae960cd15cbf79ecf0bd6badaa74", "parents": [ "bc0b2168aed1ecf0d71975af12d4f0ffecb92bfc" ], "author": { "name": "Alan Cox", "email": "alan@linux.intel.com", "time": "Tue Sep 04 04:13:18 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:45 2012 +0900" }, "message": "netrom: copy_datagram_iovec can fail\n\n[ Upstream commit 6cf5c951175abcec4da470c50565cc0afe6cd11d ]\n\nCheck for an error from this and if so bail properly.\n\nSigned-off-by: Alan Cox \u003calan@linux.intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bc0b2168aed1ecf0d71975af12d4f0ffecb92bfc", "tree": "d2ee7751cd2a384bde844f75ac38b10c3e8a815d", "parents": [ "28ad5c792deb17e1274cef32c59049d2062ed1b3" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 04 15:54:55 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:45 2012 +0900" }, "message": "l2tp: fix a typo in l2tp_eth_dev_recv()\n\n[ Upstream commit c0cc88a7627c333de50b07b7c60b1d49d9d2e6cc ]\n\nWhile investigating l2tp bug, I hit a bug in eth_type_trans(),\nbecause not enough bytes were pulled in skb head.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "28ad5c792deb17e1274cef32c59049d2062ed1b3", "tree": "a1c8460712050ec8ea60cc01f436edede37e4df6", "parents": [ "7a20f9c5fa76e602bf9dda7f610c8de04e7afa04" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 25 22:01:28 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:45 2012 +0900" }, "message": "ipv6: mip6: fix mip6_mh_filter()\n\n[ Upstream commit 96af69ea2a83d292238bdba20e4508ee967cf8cb ]\n\nmip6_mh_filter() should not modify its input, or else its caller\nwould need to recompute ipv6_hdr() if skb-\u003ehead is reallocated.\n\nUse skb_header_pointer() instead of pskb_may_pull()\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7a20f9c5fa76e602bf9dda7f610c8de04e7afa04", "tree": "967afe1eab6dc306c17e826392a2ddafe94bd2a0", "parents": [ "514ddfedb89c19c57de82aedec8da2bd8ff3802c" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 25 07:03:40 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:45 2012 +0900" }, "message": "ipv6: raw: fix icmpv6_filter()\n\n[ Upstream commit 1b05c4b50edbddbdde715c4a7350629819f6655e ]\n\nicmpv6_filter() should not modify its input, or else its caller\nwould need to recompute ipv6_hdr() if skb-\u003ehead is reallocated.\n\nUse skb_header_pointer() instead of pskb_may_pull() and\nchange the prototype to make clear both sk and skb are const.\n\nAlso, if icmpv6 header cannot be found, do not deliver the packet,\nas we do in IPv4.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "514ddfedb89c19c57de82aedec8da2bd8ff3802c", "tree": "4a7c2c137effec29e674f73153a82f394612aa21", "parents": [ "09c6cf7f980f1e8dbf58dc9ae0ebf4f6eb93cc0d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sat Sep 22 00:08:29 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:44 2012 +0900" }, "message": "ipv4: raw: fix icmp_filter()\n\n[ Upstream commit ab43ed8b7490cb387782423ecf74aeee7237e591 ]\n\nicmp_filter() should not modify its input, or else its caller\nwould need to recompute ip_hdr() if skb-\u003ehead is reallocated.\n\nUse skb_header_pointer() instead of pskb_may_pull() and\nchange the prototype to make clear both sk and skb are const.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "09c6cf7f980f1e8dbf58dc9ae0ebf4f6eb93cc0d", "tree": "f50557960f49a3f54e4e1df40a0364ce637d08df", "parents": [ "6b8fc5c4eba92b5cd3c9ca0d926e99831604f81e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Sep 24 07:00:11 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:44 2012 +0900" }, "message": "net: guard tcp_set_keepalive() to tcp sockets\n\n[ Upstream commit 3e10986d1d698140747fcfc2761ec9cb64c1d582 ]\n\nIts possible to use RAW sockets to get a crash in\ntcp_set_keepalive() / sk_reset_timer()\n\nFix is to make sure socket is a SOCK_STREAM one.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6b8fc5c4eba92b5cd3c9ca0d926e99831604f81e", "tree": "ff3dafa60edf6c064aefc1003fa41863aa624f3b", "parents": [ "e043257dde697ded17ed99f280cdb7643fdc007a" ], "author": { "name": "Chema Gonzalez", "email": "chema@google.com", "time": "Fri Sep 07 13:40:50 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:44 2012 +0900" }, "message": "net: small bug on rxhash calculation\n\n[ Upstream commit 6862234238e84648c305526af2edd98badcad1e0 ]\n\nIn the current rxhash calculation function, while the\nsorting of the ports/addrs is coherent (you get the\nsame rxhash for packets sharing the same 4-tuple, in\nboth directions), ports and addrs are sorted\nindependently. This implies packets from a connection\nbetween the same addresses but crossed ports hash to\nthe same rxhash.\n\nFor example, traffic between A\u003dS:l and B\u003dL:s is hashed\n(in both directions) from {L, S, {s, l}}. The same\nrxhash is obtained for packets between C\u003dS:s and D\u003dL:l.\n\nThis patch ensures that you either swap both addrs and ports,\nor you swap none. Traffic between A and B, and traffic\nbetween C and D, get their rxhash from different sources\n({L, S, {l, s}} for A\u003c-\u003eB, and {L, S, {s, l}} for C\u003c-\u003eD)\n\nThe patch is co-written with Eric Dumazet \u003cedumazet@google.com\u003e\n\nSigned-off-by: Chema Gonzalez \u003cchema@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8d16c6268b7c3af2ce4f58de903588489e037fcf", "tree": "a4d19ab5bf251a234e882db1fb39e79c1fbe6e57", "parents": [ "2033554a2fe3c5e54764f2f1dba0baff3261f8b5" ], "author": { "name": "Thomas Graf", "email": "tgraf@suug.ch", "time": "Mon Sep 03 04:27:42 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:44 2012 +0900" }, "message": "sctp: Don\u0027t charge for data in sndbuf again when transmitting packet\n\n[ Upstream commit 4c3a5bdae293f75cdf729c6c00124e8489af2276 ]\n\nSCTP charges wmem_alloc via sctp_set_owner_w() in sctp_sendmsg() and via\nskb_set_owner_w() in sctp_packet_transmit(). If a sender runs out of\nsndbuf it will sleep in sctp_wait_for_sndbuf() and expects to be waken up\nby __sctp_write_space().\n\nBuffer space charged via sctp_set_owner_w() is released in sctp_wfree()\nwhich calls __sctp_write_space() directly.\n\nBuffer space charged via skb_set_owner_w() is released via sock_wfree()\nwhich calls sk-\u003esk_write_space() _if_ SOCK_USE_WRITE_QUEUE is not set.\nsctp_endpoint_init() sets SOCK_USE_WRITE_QUEUE on all sockets.\n\nTherefore if sctp_packet_transmit() manages to queue up more than sndbuf\nbytes, sctp_wait_for_sndbuf() will never be woken up again unless it is\ninterrupted by a signal.\n\nThis could be fixed by clearing the SOCK_USE_WRITE_QUEUE flag but ...\n\nCharging for the data twice does not make sense in the first place, it\nleads to overcharging sndbuf by a factor 2. Therefore this patch only\ncharges a single byte in wmem_alloc when transmitting an SCTP packet to\nensure that the socket stays alive until the packet has been released.\n\nThis means that control chunks are no longer accounted for in wmem_alloc\nwhich I believe is not a problem as skb-\u003etruesize will typically lead\nto overcharging anyway and thus compensates for any control overhead.\n\nSigned-off-by: Thomas Graf \u003ctgraf@suug.ch\u003e\nCC: Vlad Yasevich \u003cvyasevic@redhat.com\u003e\nCC: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nCC: David Miller \u003cdavem@davemloft.net\u003e\nAcked-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2033554a2fe3c5e54764f2f1dba0baff3261f8b5", "tree": "ac3133307617931783ead5088f05e6de216a89c4", "parents": [ "410eafac650a906e990351a01ec70451064df83d" ], "author": { "name": "Michal Kubeček", "email": "mkubecek@suse.cz", "time": "Fri Sep 14 04:59:52 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:43 2012 +0900" }, "message": "tcp: flush DMA queue before sk_wait_data if rcv_wnd is zero\n\n[ Upstream commit 15c041759bfcd9ab0a4e43f1c16e2644977d0467 ]\n\nIf recv() syscall is called for a TCP socket so that\n - IOAT DMA is used\n - MSG_WAITALL flag is used\n - requested length is bigger than sk_rcvbuf\n - enough data has already arrived to bring rcv_wnd to zero\nthen when tcp_recvmsg() gets to calling sk_wait_data(), receive\nwindow can be still zero while sk_async_wait_queue exhausts\nenough space to keep it zero. As this queue isn\u0027t cleaned until\nthe tcp_service_net_dma() call, sk_wait_data() cannot receive\nany data and blocks forever.\n\nIf zero receive window and non-empty sk_async_wait_queue is\ndetected before calling sk_wait_data(), process the queue first.\n\nSigned-off-by: Michal Kubecek \u003cmkubecek@suse.cz\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "410eafac650a906e990351a01ec70451064df83d", "tree": "9fc349433e6179e90b8234bd32c2ccca274b18ca", "parents": [ "d5e36b089edcc8179d4640e1a8e5bca6fb74409e" ], "author": { "name": "Wei Yongjun", "email": "yongjun_wei@trendmicro.com.cn", "time": "Thu Sep 20 18:29:56 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:43 2012 +0900" }, "message": "ipv6: fix return value check in fib6_add()\n\n[ Upstream commit f950c0ecc78f745e490d615280e031de4dbb1306 ]\n\nIn case of error, the function fib6_add_1() returns ERR_PTR()\nor NULL pointer. The ERR_PTR() case check is missing in fib6_add().\n\ndpatch engine is used to generated this patch.\n(https://github.com/weiyj/dpatch)\n\nSigned-off-by: Wei Yongjun \u003cyongjun_wei@trendmicro.com.cn\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d5e36b089edcc8179d4640e1a8e5bca6fb74409e", "tree": "8e9cd19cc439a68a260f74f646f1a059f40dada1", "parents": [ "17de307472bf21479e6d7c35211204b6ea186a7c" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Wed Sep 26 00:04:55 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:43 2012 +0900" }, "message": "ipv6: del unreachable route when an addr is deleted on lo\n\n[ Upstream commit 64c6d08e6490fb18cea09bb03686c149946bd818 ]\n\nWhen an address is added on loopback (ip -6 a a 2002::1/128 dev lo), two routes\nare added:\n - one in the local table:\n local 2002::1 via :: dev lo proto none metric 0\n - one the in main table (for the prefix):\n unreachable 2002::1 dev lo proto kernel metric 256 error -101\n\nWhen the address is deleted, the route inserted in the main table remains\nbecause we use rt6_lookup(), which returns NULL when dst-\u003eerror is set, which\nis the case here! Thus, it is better to use ip6_route_lookup() to avoid this\nkind of filter.\n\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "17de307472bf21479e6d7c35211204b6ea186a7c", "tree": "e90915dc70367e2252e35f2af7a9aeea992ceb30", "parents": [ "2ab08687cf48805c5abd0f9a785e09181eda9492" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Wed Sep 19 19:25:34 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:43 2012 +0900" }, "message": "ipv6: release reference of ip6_null_entry\u0027s dst entry in __ip6_del_rt\n\n[ Upstream commit 6825a26c2dc21eb4f8df9c06d3786ddec97cf53b ]\n\nas we hold dst_entry before we call __ip6_del_rt,\nso we should alse call dst_release not only return\n-ENOENT when the rt6_info is ip6_null_entry.\n\nand we already hold the dst entry, so I think it\u0027s\nsafe to call dst_release out of the write-read lock.\n\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2ab08687cf48805c5abd0f9a785e09181eda9492", "tree": "0cb7d9dfdd3f2e6c27541151c414fe70896d054b", "parents": [ "97d5d3295198279362552d9b810c088d3410da23" ], "author": { "name": "Antonio Quartulli", "email": "ordex@autistici.org", "time": "Tue Oct 02 06:14:17 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:43 2012 +0900" }, "message": "8021q: fix mac_len recomputation in vlan_untag()\n\n[ Upstream commit 5316cf9a5197eb80b2800e1acadde287924ca975 ]\n\nskb_reset_mac_len() relies on the value of the skb-\u003enetwork_header pointer,\ntherefore we must wait for such pointer to be recalculated before computing\nthe new mac_len value.\n\nSigned-off-by: Antonio Quartulli \u003cordex@autistici.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5ee708f19bd6a1da1d7bab5916382bbbfba4edbb", "tree": "323985eff3ef122f5199587bac04a2ca44a5f7dd", "parents": [ "52ee75479f2aea816d8bb6a9d6caf5c1ebb36724" ], "author": { "name": "Paolo Valente", "email": "paolo.valente@unimore.it", "time": "Sat Sep 15 00:41:35 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:42 2012 +0900" }, "message": "pkt_sched: fix virtual-start-time update in QFQ\n\n[ Upstream commit 71261956973ba9e0637848a5adb4a5819b4bae83 ]\n\nIf the old timestamps of a class, say cl, are stale when the class\nbecomes active, then QFQ may assign to cl a much higher start time\nthan the maximum value allowed. This may happen when QFQ assigns to\nthe start time of cl the finish time of a group whose classes are\ncharacterized by a higher value of the ratio\nmax_class_pkt/weight_of_the_class with respect to that of\ncl. Inserting a class with a too high start time into the bucket list\ncorrupts the data structure and may eventually lead to crashes.\nThis patch limits the maximum start time assigned to a class.\n\nSigned-off-by: Paolo Valente \u003cpaolo.valente@unimore.it\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "52ee75479f2aea816d8bb6a9d6caf5c1ebb36724", "tree": "e3f3d348712777a3c47c0376ba2d970e71341dbb", "parents": [ "6720119023f635bd8c285530a7092716c23bdfcc" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 11 13:11:12 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:42 2012 +0900" }, "message": "net-sched: sch_cbq: avoid infinite loop\n\n[ Upstream commit bdfc87f7d1e253e0a61e2fc6a75ea9d76f7fc03a ]\n\nIts possible to setup a bad cbq configuration leading to\nan infinite loop in cbq_classify()\n\nDEV_OUT\u003deth0\nICMP\u003d\"match ip protocol 1 0xff\"\nU32\u003d\"protocol ip u32\"\nDST\u003d\"match ip dst\"\ntc qdisc add dev $DEV_OUT root handle 1: cbq avpkt 1000 \\\n\tbandwidth 100mbit\ntc class add dev $DEV_OUT parent 1: classid 1:1 cbq \\\n\trate 512kbit allot 1500 prio 5 bounded isolated\ntc filter add dev $DEV_OUT parent 1: prio 3 $U32 \\\n\t$ICMP $DST 192.168.3.234 flowid 1:\n\nReported-by: Denys Fedoryschenko \u003cdenys@visp.net.lb\u003e\nTested-by: Denys Fedoryschenko \u003cdenys@visp.net.lb\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "53bf1469924e07385b4493d3cbd78551d4afaaa3", "tree": "26fd323abf51bc1e9a5362b3ebbd0869425bea6d", "parents": [ "743b911d8b2214bfa9ecd1631edbe6f61f8fdced" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Thu Sep 20 10:01:49 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:41 2012 +0900" }, "message": "xfrm_user: ensure user supplied esn replay window is valid\n\n[ Upstream commit ecd7918745234e423dd87fcc0c077da557909720 ]\n\nThe current code fails to ensure that the netlink message actually\ncontains as many bytes as the header indicates. If a user creates a new\nstate or updates an existing one but does not supply the bytes for the\nwhole ESN replay window, the kernel copies random heap bytes into the\nreplay bitmap, the ones happen to follow the XFRMA_REPLAY_ESN_VAL\nnetlink attribute. This leads to following issues:\n\n1. The replay window has random bits set confusing the replay handling\n code later on.\n\n2. A malicious user could use this flaw to leak up to ~3.5kB of heap\n memory when she has access to the XFRM netlink interface (requires\n CAP_NET_ADMIN).\n\nKnown users of the ESN replay window are strongSwan and Steffen\u0027s\niproute2 patch (\u003chttp://patchwork.ozlabs.org/patch/85962/\u003e). The latter\nuses the interface with a bitmap supplied while the former does not.\nstrongSwan is therefore prone to run into issue 1.\n\nTo fix both issues without breaking existing userland allow using the\nXFRMA_REPLAY_ESN_VAL netlink attribute with either an empty bitmap or a\nfully specified one. For the former case we initialize the in-kernel\nbitmap with zero, for the latter we copy the user supplied bitmap. For\nstate updates the full bitmap must be supplied.\n\nTo prevent overflows in the bitmap length calculation the maximum size\nof bmp_len is limited to 128 by this patch -- resulting in a maximum\nreplay window of 4096 packets. This should be sufficient for all real\nlife scenarios (RFC 4303 recommends a default replay window size of 64).\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nCc: Martin Willi \u003cmartin@revosec.ch\u003e\nCc: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "743b911d8b2214bfa9ecd1631edbe6f61f8fdced", "tree": "7266729acce0b72e62a1339c67343a152f34e60a", "parents": [ "0c5e37586ef83845acbae1738e693bc97c12d4c3" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Sep 19 11:33:43 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:41 2012 +0900" }, "message": "xfrm_user: don\u0027t copy esn replay window twice for new states\n\n[ Upstream commit e3ac104d41a97b42316915020ba228c505447d21 ]\n\nThe ESN replay window was already fully initialized in\nxfrm_alloc_replay_state_esn(). No need to copy it again.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0c5e37586ef83845acbae1738e693bc97c12d4c3", "tree": "09336b4613715c597972b251a5dd8b8b8fed7a36", "parents": [ "97f96eab8eb32f3178439f73acca4e286c091435" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Sep 19 11:33:41 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:41 2012 +0900" }, "message": "xfrm_user: fix info leak in copy_to_user_tmpl()\n\n[ Upstream commit 1f86840f897717f86d523a13e99a447e6a5d2fa5 ]\n\nThe memory used for the template copy is a local stack variable. As\nstruct xfrm_user_tmpl contains multiple holes added by the compiler for\nalignment, not initializing the memory will lead to leaking stack bytes\nto userland. Add an explicit memset(0) to avoid the info leak.\n\nInitial version of the patch by Brad Spengler.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Brad Spengler \u003cspender@grsecurity.net\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "97f96eab8eb32f3178439f73acca4e286c091435", "tree": "d7f2526d4bd16dadffc4ae2237ddf148d1e767a3", "parents": [ "d5f1f7c230df5f2a198fb231547f1b298594c709" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Sep 19 11:33:40 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:41 2012 +0900" }, "message": "xfrm_user: fix info leak in copy_to_user_policy()\n\n[ Upstream commit 7b789836f434c87168eab067cfbed1ec4783dffd ]\n\nThe memory reserved to dump the xfrm policy includes multiple padding\nbytes added by the compiler for alignment (padding bytes in struct\nxfrm_selector and struct xfrm_userpolicy_info). Add an explicit\nmemset(0) before filling the buffer to avoid the heap info leak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d5f1f7c230df5f2a198fb231547f1b298594c709", "tree": "1295ee4909bacd777b6d9652703efb97ac58ed01", "parents": [ "37d61a27a59671d88279dcc4d331f950d4901d4d" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Sep 19 11:33:39 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:41 2012 +0900" }, "message": "xfrm_user: fix info leak in copy_to_user_state()\n\n[ Upstream commit f778a636713a435d3a922c60b1622a91136560c1 ]\n\nThe memory reserved to dump the xfrm state includes the padding bytes of\nstruct xfrm_usersa_info added by the compiler for alignment (7 for\namd64, 3 for i386). Add an explicit memset(0) before filling the buffer\nto avoid the info leak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "37d61a27a59671d88279dcc4d331f950d4901d4d", "tree": "cd9a28ee5484e21e322634d00391658ec8e05259", "parents": [ "a91af73f445cacfb0db4df3eb2e3d0ddeff43893" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Sep 19 11:33:38 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:40 2012 +0900" }, "message": "xfrm_user: fix info leak in copy_to_user_auth()\n\n[ Upstream commit 4c87308bdea31a7b4828a51f6156e6f721a1fcc9 ]\n\ncopy_to_user_auth() fails to initialize the remainder of alg_name and\ntherefore discloses up to 54 bytes of heap memory via netlink to\nuserland.\n\nUse strncpy() instead of strcpy() to fill the trailing bytes of alg_name\nwith null bytes.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a91af73f445cacfb0db4df3eb2e3d0ddeff43893", "tree": "a4fb8945340d3ee94f5f427d1a4e61250ede0d0f", "parents": [ "f38b334adca51bbf18ad549a9736c0f86bb4a375" ], "author": { "name": "Li RongQing", "email": "roy.qing.li@gmail.com", "time": "Mon Sep 17 22:40:10 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:40 2012 +0900" }, "message": "xfrm: fix a read lock imbalance in make_blackhole\n\n[ Upstream commit 433a19548061bb5457b6ab77ed7ea58ca6e43ddb ]\n\nif xfrm_policy_get_afinfo returns 0, it has already released the read\nlock, xfrm_policy_put_afinfo should not be called again.\n\nSigned-off-by: Li RongQing \u003croy.qing.li@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f38b334adca51bbf18ad549a9736c0f86bb4a375", "tree": "827539bccdea31dbaad05dc0db4a738227278a0e", "parents": [ "555144b63d57c0df7a2677868f83957a34135207" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Fri Sep 14 09:58:32 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:40 2012 +0900" }, "message": "xfrm_user: return error pointer instead of NULL #2\n\n[ Upstream commit c25463722509fef0ed630b271576a8c9a70236f3 ]\n\nWhen dump_one_policy() returns an error, e.g. because of a too small\nbuffer to dump the whole xfrm policy, xfrm_policy_netlink() returns\nNULL instead of an error pointer. But its caller expects an error\npointer and therefore continues to operate on a NULL skbuff.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "555144b63d57c0df7a2677868f83957a34135207", "tree": "f25e99ec2bf0436cc9d6a190ad1498e58bd8f378", "parents": [ "20eb20851385e53d27dff9ed79c4e68e58e3d9da" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Thu Sep 13 11:41:26 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:40 2012 +0900" }, "message": "xfrm_user: return error pointer instead of NULL\n\n[ Upstream commit 864745d291b5ba80ea0bd0edcbe67273de368836 ]\n\nWhen dump_one_state() returns an error, e.g. because of a too small\nbuffer to dump the whole xfrm state, xfrm_state_netlink() returns NULL\ninstead of an error pointer. But its callers expect an error pointer\nand therefore continue to operate on a NULL skbuff.\n\nThis could lead to a privilege escalation (execution of user code in\nkernel context) if the attacker has CAP_NET_ADMIN and is able to map\naddress 0.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "20eb20851385e53d27dff9ed79c4e68e58e3d9da", "tree": "b3a5a5e16f823d5ca39f44124bf18b5f63fa2a2f", "parents": [ "657197486950474bf30290344339fd0914fe99c9" ], "author": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Sep 04 00:03:29 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:40 2012 +0900" }, "message": "xfrm: Workaround incompatibility of ESN and async crypto\n\n[ Upstream commit 3b59df46a449ec9975146d71318c4777ad086744 ]\n\nESN for esp is defined in RFC 4303. This RFC assumes that the\nsequence number counters are always up to date. However,\nthis is not true if an async crypto algorithm is employed.\n\nIf the sequence number counters are not up to date on sequence\nnumber check, we may incorrectly update the upper 32 bit of\nthe sequence number. This leads to a DOS.\n\nWe workaround this by comparing the upper sequence number,\n(used for authentication) with the upper sequence number\ncomputed after the async processing. We drop the packet\nif these numbers are different.\n\nTo do this, we introduce a recheck function that does this\ncheck in the ESN case.\n\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nAcked-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b2c1fcae0409fec6d96351fe2793a502870f4370", "tree": "8b95900f8a41da6de47141368d34bae45b733e63", "parents": [ "11266a8e031a3782241760850f002c79ee2887e1" ], "author": { "name": "Weiping Pan", "email": "wpan@redhat.com", "time": "Mon Jul 23 10:37:48 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:35 2012 -0700" }, "message": "rds: set correct msg_namelen\n\ncommit 06b6a1cf6e776426766298d055bb3991957d90a7 upstream.\n\nJay Fenlason (fenlason@redhat.com) found a bug,\nthat recvfrom() on an RDS socket can return the contents of random kernel\nmemory to userspace if it was called with a address length larger than\nsizeof(struct sockaddr_in).\nrds_recvmsg() also fails to set the addr_len paramater properly before\nreturning, but that\u0027s just a bug.\nThere are also a number of cases wher recvfrom() can return an entirely bogus\naddress. Anything in rds_recvmsg() that returns a non-negative value but does\nnot go through the \"sin \u003d (struct sockaddr_in *)msg-\u003emsg_name;\" code path\nat the end of the while(1) loop will return up to 128 bytes of kernel memory\nto userspace.\n\nAnd I write two test programs to reproduce this bug, you will see that in\nrds_server, fromAddr will be overwritten and the following sock_fd will be\ndestroyed.\nYes, it is the programmer\u0027s fault to set msg_namelen incorrectly, but it is\nbetter to make the kernel copy the real length of address to user space in\nsuch case.\n\nHow to run the test programs ?\nI test them on 32bit x86 system, 3.5.0-rc7.\n\n1 compile\ngcc -o rds_client rds_client.c\ngcc -o rds_server rds_server.c\n\n2 run ./rds_server on one console\n\n3 run ./rds_client on another console\n\n4 you will see something like:\nserver is waiting to receive data...\nold socket fd\u003d3\nserver received data from client:data from client\nmsg.msg_namelen\u003d32\nnew socket fd\u003d-1067277685\nsendmsg()\n: Bad file descriptor\n\n/***************** rds_client.c ********************/\n\nint main(void)\n{\n\tint sock_fd;\n\tstruct sockaddr_in serverAddr;\n\tstruct sockaddr_in toAddr;\n\tchar recvBuffer[128] \u003d \"data from client\";\n\tstruct msghdr msg;\n\tstruct iovec iov;\n\n\tsock_fd \u003d socket(AF_RDS, SOCK_SEQPACKET, 0);\n\tif (sock_fd \u003c 0) {\n\t\tperror(\"create socket error\\n\");\n\t\texit(1);\n\t}\n\n\tmemset(\u0026serverAddr, 0, sizeof(serverAddr));\n\tserverAddr.sin_family \u003d AF_INET;\n\tserverAddr.sin_addr.s_addr \u003d inet_addr(\"127.0.0.1\");\n\tserverAddr.sin_port \u003d htons(4001);\n\n\tif (bind(sock_fd, (struct sockaddr*)\u0026serverAddr, sizeof(serverAddr)) \u003c 0) {\n\t\tperror(\"bind() error\\n\");\n\t\tclose(sock_fd);\n\t\texit(1);\n\t}\n\n\tmemset(\u0026toAddr, 0, sizeof(toAddr));\n\ttoAddr.sin_family \u003d AF_INET;\n\ttoAddr.sin_addr.s_addr \u003d inet_addr(\"127.0.0.1\");\n\ttoAddr.sin_port \u003d htons(4000);\n\tmsg.msg_name \u003d \u0026toAddr;\n\tmsg.msg_namelen \u003d sizeof(toAddr);\n\tmsg.msg_iov \u003d \u0026iov;\n\tmsg.msg_iovlen \u003d 1;\n\tmsg.msg_iov-\u003eiov_base \u003d recvBuffer;\n\tmsg.msg_iov-\u003eiov_len \u003d strlen(recvBuffer) + 1;\n\tmsg.msg_control \u003d 0;\n\tmsg.msg_controllen \u003d 0;\n\tmsg.msg_flags \u003d 0;\n\n\tif (sendmsg(sock_fd, \u0026msg, 0) \u003d\u003d -1) {\n\t\tperror(\"sendto() error\\n\");\n\t\tclose(sock_fd);\n\t\texit(1);\n\t}\n\n\tprintf(\"client send data:%s\\n\", recvBuffer);\n\n\tmemset(recvBuffer, \u0027\\0\u0027, 128);\n\n\tmsg.msg_name \u003d \u0026toAddr;\n\tmsg.msg_namelen \u003d sizeof(toAddr);\n\tmsg.msg_iov \u003d \u0026iov;\n\tmsg.msg_iovlen \u003d 1;\n\tmsg.msg_iov-\u003eiov_base \u003d recvBuffer;\n\tmsg.msg_iov-\u003eiov_len \u003d 128;\n\tmsg.msg_control \u003d 0;\n\tmsg.msg_controllen \u003d 0;\n\tmsg.msg_flags \u003d 0;\n\tif (recvmsg(sock_fd, \u0026msg, 0) \u003d\u003d -1) {\n\t\tperror(\"recvmsg() error\\n\");\n\t\tclose(sock_fd);\n\t\texit(1);\n\t}\n\n\tprintf(\"receive data from server:%s\\n\", recvBuffer);\n\n\tclose(sock_fd);\n\n\treturn 0;\n}\n\n/***************** rds_server.c ********************/\n\nint main(void)\n{\n\tstruct sockaddr_in fromAddr;\n\tint sock_fd;\n\tstruct sockaddr_in serverAddr;\n\tunsigned int addrLen;\n\tchar recvBuffer[128];\n\tstruct msghdr msg;\n\tstruct iovec iov;\n\n\tsock_fd \u003d socket(AF_RDS, SOCK_SEQPACKET, 0);\n\tif(sock_fd \u003c 0) {\n\t\tperror(\"create socket error\\n\");\n\t\texit(0);\n\t}\n\n\tmemset(\u0026serverAddr, 0, sizeof(serverAddr));\n\tserverAddr.sin_family \u003d AF_INET;\n\tserverAddr.sin_addr.s_addr \u003d inet_addr(\"127.0.0.1\");\n\tserverAddr.sin_port \u003d htons(4000);\n\tif (bind(sock_fd, (struct sockaddr*)\u0026serverAddr, sizeof(serverAddr)) \u003c 0) {\n\t\tperror(\"bind error\\n\");\n\t\tclose(sock_fd);\n\t\texit(1);\n\t}\n\n\tprintf(\"server is waiting to receive data...\\n\");\n\tmsg.msg_name \u003d \u0026fromAddr;\n\n\t/*\n\t * I add 16 to sizeof(fromAddr), ie 32,\n\t * and pay attention to the definition of fromAddr,\n\t * recvmsg() will overwrite sock_fd,\n\t * since kernel will copy 32 bytes to userspace.\n\t *\n\t * If you just use sizeof(fromAddr), it works fine.\n\t * */\n\tmsg.msg_namelen \u003d sizeof(fromAddr) + 16;\n\t/* msg.msg_namelen \u003d sizeof(fromAddr); */\n\tmsg.msg_iov \u003d \u0026iov;\n\tmsg.msg_iovlen \u003d 1;\n\tmsg.msg_iov-\u003eiov_base \u003d recvBuffer;\n\tmsg.msg_iov-\u003eiov_len \u003d 128;\n\tmsg.msg_control \u003d 0;\n\tmsg.msg_controllen \u003d 0;\n\tmsg.msg_flags \u003d 0;\n\n\twhile (1) {\n\t\tprintf(\"old socket fd\u003d%d\\n\", sock_fd);\n\t\tif (recvmsg(sock_fd, \u0026msg, 0) \u003d\u003d -1) {\n\t\t\tperror(\"recvmsg() error\\n\");\n\t\t\tclose(sock_fd);\n\t\t\texit(1);\n\t\t}\n\t\tprintf(\"server received data from client:%s\\n\", recvBuffer);\n\t\tprintf(\"msg.msg_namelen\u003d%d\\n\", msg.msg_namelen);\n\t\tprintf(\"new socket fd\u003d%d\\n\", sock_fd);\n\t\tstrcat(recvBuffer, \"--data from server\");\n\t\tif (sendmsg(sock_fd, \u0026msg, 0) \u003d\u003d -1) {\n\t\t\tperror(\"sendmsg()\\n\");\n\t\t\tclose(sock_fd);\n\t\t\texit(1);\n\t\t}\n\t}\n\n\tclose(sock_fd);\n\treturn 0;\n}\n\nSigned-off-by: Weiping Pan \u003cwpan@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e6da94be68b025bdbbee3764428769a85367aa79", "tree": "6be1d9b7148e3e2d1a027d3b38232a61bab84239", "parents": [ "c031edca540afb66764db24eed10eb149ac6c852" ], "author": { "name": "Rustad, Mark D", "email": "mark.d.rustad@intel.com", "time": "Wed Jul 18 09:06:07 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:35 2012 -0700" }, "message": "net: Statically initialize init_net.dev_base_head\n\ncommit 734b65417b24d6eea3e3d7457e1f11493890ee1d upstream.\n\nThis change eliminates an initialization-order hazard most\nrecently seen when netprio_cgroup is built into the kernel.\n\nWith thanks to Eric Dumazet for catching a bug.\n\nSigned-off-by: Mark Rustad \u003cmark.d.rustad@intel.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c031edca540afb66764db24eed10eb149ac6c852", "tree": "867a052756c1bb8942b407f7098a3da4ea95261d", "parents": [ "0fcc0805df9cf7483e927cf6a4dc94938318c06a" ], "author": { "name": "Vinicius Costa Gomes", "email": "vinicius.gomes@openbossa.org", "time": "Thu Aug 23 21:32:44 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:34 2012 -0700" }, "message": "Bluetooth: Fix sending a HCI Authorization Request over LE links\n\ncommit d8343f125710fb596f7a88cd756679f14f4e77b9 upstream.\n\nIn the case that the link is already in the connected state and a\nPairing request arrives from the mgmt interface, hci_conn_security()\nwould be called but it was not considering LE links.\n\nReported-by: João Paulo Rechi Vita \u003cjprvita@openbossa.org\u003e\nSigned-off-by: Vinicius Costa Gomes \u003cvinicius.gomes@openbossa.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0fcc0805df9cf7483e927cf6a4dc94938318c06a", "tree": "5218645ca3737cf7ec1d9b3a039b6a1ec8048931", "parents": [ "27d50469825fd267f44e13fb0627b011c0da6abd" ], "author": { "name": "Vinicius Costa Gomes", "email": "vinicius.gomes@openbossa.org", "time": "Thu Aug 23 21:32:43 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:34 2012 -0700" }, "message": "Bluetooth: Change signature of smp_conn_security()\n\ncommit cc110922da7e902b62d18641a370fec01a9fa794 upstream.\n\nTo make it clear that it may be called from contexts that may not have\nany knowledge of L2CAP, we change the connection parameter, to receive\na hci_conn.\n\nThis also makes it clear that it is checking the security of the link.\n\nSigned-off-by: Vinicius Costa Gomes \u003cvinicius.gomes@openbossa.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "27d50469825fd267f44e13fb0627b011c0da6abd", "tree": "3bc48f09647dfa7cb31375136cde64ddd6abfea1", "parents": [ "403c9ebee757d7ec82e3e06e456ae2445f0b9f40" ], "author": { "name": "Andre Guedes", "email": "andre.guedes@openbossa.org", "time": "Wed Aug 01 20:34:15 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:34 2012 -0700" }, "message": "Bluetooth: Fix use-after-free bug in SMP\n\ncommit 61a0cfb008f57ecf7eb28ee762952fb42dc15d15 upstream.\n\nIf SMP fails, we should always cancel security_timer delayed work.\nOtherwise, security_timer function may run after l2cap_conn object\nhas been freed.\n\nThis patch fixes the following warning reported by ODEBUG:\n\nWARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()\nHardware name: Bochs\nODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x27\nModules linked in: btusb bluetooth\nPid: 440, comm: kworker/u:2 Not tainted 3.5.0-rc1+ #4\nCall Trace:\n [\u003cffffffff81174600\u003e] ? free_obj_work+0x4a/0x7f\n [\u003cffffffff81023eb8\u003e] warn_slowpath_common+0x7e/0x97\n [\u003cffffffff81023f65\u003e] warn_slowpath_fmt+0x41/0x43\n [\u003cffffffff811746b1\u003e] debug_print_object+0x7c/0x8d\n [\u003cffffffff810394f0\u003e] ? __queue_work+0x241/0x241\n [\u003cffffffff81174fdd\u003e] debug_check_no_obj_freed+0x92/0x159\n [\u003cffffffff810ac08e\u003e] slab_free_hook+0x6f/0x77\n [\u003cffffffffa0019145\u003e] ? l2cap_conn_del+0x148/0x157 [bluetooth]\n [\u003cffffffff810ae408\u003e] kfree+0x59/0xac\n [\u003cffffffffa0019145\u003e] l2cap_conn_del+0x148/0x157 [bluetooth]\n [\u003cffffffffa001b9a2\u003e] l2cap_recv_frame+0xa77/0xfa4 [bluetooth]\n [\u003cffffffff810592f9\u003e] ? trace_hardirqs_on_caller+0x112/0x1ad\n [\u003cffffffffa001c86c\u003e] l2cap_recv_acldata+0xe2/0x264 [bluetooth]\n [\u003cffffffffa0002b2f\u003e] hci_rx_work+0x235/0x33c [bluetooth]\n [\u003cffffffff81038dc3\u003e] ? process_one_work+0x126/0x2fe\n [\u003cffffffff81038e22\u003e] process_one_work+0x185/0x2fe\n [\u003cffffffff81038dc3\u003e] ? process_one_work+0x126/0x2fe\n [\u003cffffffff81059f2e\u003e] ? lock_acquired+0x1b5/0x1cf\n [\u003cffffffffa00028fa\u003e] ? le_scan_work+0x11d/0x11d [bluetooth]\n [\u003cffffffff81036fb6\u003e] ? spin_lock_irq+0x9/0xb\n [\u003cffffffff81039209\u003e] worker_thread+0xcf/0x175\n [\u003cffffffff8103913a\u003e] ? rescuer_thread+0x175/0x175\n [\u003cffffffff8103cfe0\u003e] kthread+0x95/0x9d\n [\u003cffffffff812c5054\u003e] kernel_threadi_helper+0x4/0x10\n [\u003cffffffff812c36b0\u003e] ? retint_restore_args+0x13/0x13\n [\u003cffffffff8103cf4b\u003e] ? flush_kthread_worker+0xdb/0xdb\n [\u003cffffffff812c5050\u003e] ? gs_change+0x13/0x13\n\nThis bug can be reproduced using hctool lecc or l2test tools and\nbluetoothd not running.\n\nSigned-off-by: Andre Guedes \u003candre.guedes@openbossa.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7334e402a35e0379933e8b0442f0baeed1104217", "tree": "29901c172d78fcc76023461ad2204419d4b23169", "parents": [ "12e58ca43097b5330e028f4087e7e4789c08abf7" ], "author": { "name": "Luis R. Rodriguez", "email": "mcgrof@do-not-panic.com", "time": "Fri Sep 14 15:36:57 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:09 2012 -0700" }, "message": "cfg80211: fix possible circular lock on reg_regdb_search()\n\ncommit a85d0d7f3460b1a123b78e7f7e39bf72c37dfb78 upstream.\n\nWhen call_crda() is called we kick off a witch hunt search\nfor the same regulatory domain on our internal regulatory\ndatabase and that work gets kicked off on a workqueue, this\nis done while the cfg80211_mutex is held. If that workqueue\nkicks off it will first lock reg_regdb_search_mutex and\nlater cfg80211_mutex but to ensure two CPUs will not contend\nagainst cfg80211_mutex the right thing to do is to have the\nreg_regdb_search() wait until the cfg80211_mutex is let go.\n\nThe lockdep report is pasted below.\n\ncfg80211: Calling CRDA to update world regulatory domain\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ INFO: possible circular locking dependency detected ]\n3.3.8 #3 Tainted: G O\n-------------------------------------------------------\nkworker/0:1/235 is trying to acquire lock:\n (cfg80211_mutex){+.+...}, at: [\u003c816468a4\u003e] set_regdom+0x78c/0x808 [cfg80211]\n\nbut task is already holding lock:\n (reg_regdb_search_mutex){+.+...}, at: [\u003c81646828\u003e] set_regdom+0x710/0x808 [cfg80211]\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #2 (reg_regdb_search_mutex){+.+...}:\n [\u003c800a8384\u003e] lock_acquire+0x60/0x88\n [\u003c802950a8\u003e] mutex_lock_nested+0x54/0x31c\n [\u003c81645778\u003e] is_world_regdom+0x9f8/0xc74 [cfg80211]\n\n-\u003e #1 (reg_mutex#2){+.+...}:\n [\u003c800a8384\u003e] lock_acquire+0x60/0x88\n [\u003c802950a8\u003e] mutex_lock_nested+0x54/0x31c\n [\u003c8164539c\u003e] is_world_regdom+0x61c/0xc74 [cfg80211]\n\n-\u003e #0 (cfg80211_mutex){+.+...}:\n [\u003c800a77b8\u003e] __lock_acquire+0x10d4/0x17bc\n [\u003c800a8384\u003e] lock_acquire+0x60/0x88\n [\u003c802950a8\u003e] mutex_lock_nested+0x54/0x31c\n [\u003c816468a4\u003e] set_regdom+0x78c/0x808 [cfg80211]\n\nother info that might help us debug this:\n\nChain exists of:\n cfg80211_mutex --\u003e reg_mutex#2 --\u003e reg_regdb_search_mutex\n\n Possible unsafe locking scenario:\n\n CPU0 CPU1\n ---- ----\n lock(reg_regdb_search_mutex);\n lock(reg_mutex#2);\n lock(reg_regdb_search_mutex);\n lock(cfg80211_mutex);\n\n *** DEADLOCK ***\n\n3 locks held by kworker/0:1/235:\n #0: (events){.+.+..}, at: [\u003c80089a00\u003e] process_one_work+0x230/0x460\n #1: (reg_regdb_work){+.+...}, at: [\u003c80089a00\u003e] process_one_work+0x230/0x460\n #2: (reg_regdb_search_mutex){+.+...}, at: [\u003c81646828\u003e] set_regdom+0x710/0x808 [cfg80211]\n\nstack backtrace:\nCall Trace:\n[\u003c80290fd4\u003e] dump_stack+0x8/0x34\n[\u003c80291bc4\u003e] print_circular_bug+0x2ac/0x2d8\n[\u003c800a77b8\u003e] __lock_acquire+0x10d4/0x17bc\n[\u003c800a8384\u003e] lock_acquire+0x60/0x88\n[\u003c802950a8\u003e] mutex_lock_nested+0x54/0x31c\n[\u003c816468a4\u003e] set_regdom+0x78c/0x808 [cfg80211]\n\nReported-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nTested-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nSigned-off-by: Luis R. Rodriguez \u003cmcgrof@do-not-panic.com\u003e\nReviewed-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a6be20b8cd1e5e847c4191b8f249b939aaabf987", "tree": "544ffd0fef49963cd28e75f9e8dc8f7308d768b5", "parents": [ "ec4d417c66a406bb464598220faf9f561d5b6d25" ], "author": { "name": "Andrzej Kaczmarek", "email": "andrzej.kaczmarek@tieto.com", "time": "Wed Aug 29 10:02:09 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:08 2012 -0700" }, "message": "Bluetooth: mgmt: Fix enabling LE while powered off\n\ncommit 562fcc246ebe31ade6e1be08585673b9b2785498 upstream.\n\nWhen new BT USB adapter is plugged in it\u0027s configured while still being powered\noff (HCI_AUTO_OFF flag is set), thus Set LE will only set dev_flags but won\u0027t\nwrite changes to controller. As a result it\u0027s not possible to start device\ndiscovery session on LE controller as it uses interleaved discovery which\nrequires LE Supported Host flag in extended features.\n\nThis patch ensures HCI Write LE Host Supported is sent when Set Powered is\ncalled to power on controller and clear HCI_AUTO_OFF flag.\n\nSigned-off-by: Andrzej Kaczmarek \u003candrzej.kaczmarek@tieto.com\u003e\nAcked-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ec4d417c66a406bb464598220faf9f561d5b6d25", "tree": "080f11280018b491b3c998c26a99ffe6ff158481", "parents": [ "dcc8dbc21ff2052c0df6dee3e1a36c3ef4f1133c" ], "author": { "name": "Vinicius Costa Gomes", "email": "vinicius.gomes@openbossa.org", "time": "Fri Sep 14 16:34:46 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:08 2012 -0700" }, "message": "Bluetooth: Fix not removing power_off delayed work\n\ncommit 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a upstream.\n\nFor example, when a usb reset is received (I could reproduce it\nrunning something very similar to this[1] in a loop) it could be\nthat the device is unregistered while the power_off delayed work\nis still scheduled to run.\n\nBacktrace:\n\nWARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()\nHardware name: To Be Filled By O.E.M.\nODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x26\nModules linked in: nouveau mxm_wmi btusb wmi bluetooth ttm coretemp drm_kms_helper\nPid: 2114, comm: usb-reset Not tainted 3.5.0bt-next #2\nCall Trace:\n [\u003cffffffff8124cc00\u003e] ? free_obj_work+0x57/0x91\n [\u003cffffffff81058f88\u003e] warn_slowpath_common+0x7e/0x97\n [\u003cffffffff81059035\u003e] warn_slowpath_fmt+0x41/0x43\n [\u003cffffffff8124ccb6\u003e] debug_print_object+0x7c/0x8d\n [\u003cffffffff8106e3ec\u003e] ? __queue_work+0x259/0x259\n [\u003cffffffff8124d63e\u003e] ? debug_check_no_obj_freed+0x6f/0x1b5\n [\u003cffffffff8124d667\u003e] debug_check_no_obj_freed+0x98/0x1b5\n [\u003cffffffffa00aa031\u003e] ? bt_host_release+0x10/0x1e [bluetooth]\n [\u003cffffffff810fc035\u003e] kfree+0x90/0xe6\n [\u003cffffffffa00aa031\u003e] bt_host_release+0x10/0x1e [bluetooth]\n [\u003cffffffff812ec2f9\u003e] device_release+0x4a/0x7e\n [\u003cffffffff8123ef57\u003e] kobject_release+0x11d/0x154\n [\u003cffffffff8123ed98\u003e] kobject_put+0x4a/0x4f\n [\u003cffffffff812ec0d9\u003e] put_device+0x12/0x14\n [\u003cffffffffa009472b\u003e] hci_free_dev+0x22/0x26 [bluetooth]\n [\u003cffffffffa0280dd0\u003e] btusb_disconnect+0x96/0x9f [btusb]\n [\u003cffffffff813581b4\u003e] usb_unbind_interface+0x57/0x106\n [\u003cffffffff812ef988\u003e] __device_release_driver+0x83/0xd6\n [\u003cffffffff812ef9fb\u003e] device_release_driver+0x20/0x2d\n [\u003cffffffff813582a7\u003e] usb_driver_release_interface+0x44/0x7b\n [\u003cffffffff81358795\u003e] usb_forced_unbind_intf+0x45/0x4e\n [\u003cffffffff8134f959\u003e] usb_reset_device+0xa6/0x12e\n [\u003cffffffff8135df86\u003e] usbdev_do_ioctl+0x319/0xe20\n [\u003cffffffff81203244\u003e] ? avc_has_perm_flags+0xc9/0x12e\n [\u003cffffffff812031a0\u003e] ? avc_has_perm_flags+0x25/0x12e\n [\u003cffffffff81050101\u003e] ? do_page_fault+0x31e/0x3a1\n [\u003cffffffff8135eaa6\u003e] usbdev_ioctl+0x9/0xd\n [\u003cffffffff811126b1\u003e] vfs_ioctl+0x21/0x34\n [\u003cffffffff81112f7b\u003e] do_vfs_ioctl+0x408/0x44b\n [\u003cffffffff81208d45\u003e] ? file_has_perm+0x76/0x81\n [\u003cffffffff8111300f\u003e] sys_ioctl+0x51/0x76\n [\u003cffffffff8158db22\u003e] system_call_fastpath+0x16/0x1b\n\n[1] http://cpansearch.perl.org/src/DPAVLIN/Biblio-RFID-0.03/examples/usbreset.c\n\nSigned-off-by: Vinicius Costa Gomes \u003cvinicius.gomes@openbossa.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dcc8dbc21ff2052c0df6dee3e1a36c3ef4f1133c", "tree": "6fc28055b407f59a94f9086b85269c9ea98c6b15", "parents": [ "f51909c0af2ebc533eaf48c7daff503b3e54d983" ], "author": { "name": "Andrzej Kaczmarek", "email": "andrzej.kaczmarek@tieto.com", "time": "Wed Aug 29 10:02:08 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:08 2012 -0700" }, "message": "Bluetooth: mgmt: Fix enabling SSP while powered off\n\ncommit 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 upstream.\n\nWhen new BT USB adapter is plugged in it\u0027s configured while still being powered\noff (HCI_AUTO_OFF flag is set), thus Set SSP will only set dev_flags but won\u0027t\nwrite changes to controller. As a result remote devices won\u0027t use Secure Simple\nPairing with our device due to SSP Host Support flag disabled in extended\nfeatures and may also reject SSP attempt from our side (with possible fallback\nto legacy pairing).\n\nThis patch ensures HCI Write Simple Pairing Mode is sent when Set Powered is\ncalled to power on controller and clear HCI_AUTO_OFF flag.\n\nSigned-off-by: Andrzej Kaczmarek \u003candrzej.kaczmarek@tieto.com\u003e\nAcked-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ba41a6df9e32ee5752165496017cadf700c14ca9", "tree": "4907a445243d0ccd97e903e169b4f04c72e52509", "parents": [ "0bf2a827d745808dde90001134ecc6a4af39b361" ], "author": { "name": "Eliad Peller", "email": "eliad@wizery.com", "time": "Tue Sep 04 17:44:45 2012 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:07 2012 -0700" }, "message": "mac80211: clear bssid on auth/assoc failure\n\ncommit 3d2abdfdf14f4d6decc2023708211e19b096f4ca upstream.\n\nifmgd-\u003ebssid wasn\u0027t cleared properly in some\nauth/assoc failure cases, causing mac80211 and\nthe low-level driver to go out of sync.\n\nClear ifmgd-\u003ebssid on failure, and notify the driver.\n\nSigned-off-by: Eliad Peller \u003celiad@wizery.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2ff0cd9f615bae1de9d812de92eff6426aad26c9", "tree": "c2bb19352286bb93c6d0e32163351a1d58f0589d", "parents": [ "6cacd608448898cf0b7bb4353e1a92c6dc7d5dd9" ], "author": { "name": "Jesse Gross", "email": "jesse@nicira.com", "time": "Fri May 25 11:29:30 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:50 2012 -0700" }, "message": "openvswitch: Reset upper layer protocol info on internal devices.\n\n[ Upstream commit 7fe99e2d434eafeac0c57b279a77e5de39212636 ]\n\nIt\u0027s possible that packets that are sent on internal devices (from\nthe OVS perspective) have already traversed the local IP stack.\nAfter they go through the internal device, they will again travel\nthrough the IP stack which may get confused by the presence of\nexisting information in the skb. The problem can be observed\nwhen switching between namespaces. This clears out that information\nto avoid problems but deliberately leaves other metadata alone.\nThis is to provide maximum flexibility in chaining together OVS\nand other Linux components.\n\nSigned-off-by: Jesse Gross \u003cjesse@nicira.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b9d798a996cddfc4c1045e9af97ee434ccab4956", "tree": "e38de752bdba626b8fe7f5b8f6506438b0bfe2d0", "parents": [ "fae286b0e547ed0379d93ace7664ea6f55cce0e0" ], "author": { "name": "Francesco Ruggeri", "email": "fruggeri@aristanetworks.com", "time": "Fri Aug 24 07:38:35 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:50 2012 -0700" }, "message": "net: ipv4: ipmr_expire_timer causes crash when removing net namespace\n\n[ Upstream commit acbb219d5f53821b2d0080d047800410c0420ea1 ]\n\nWhen tearing down a net namespace, ipv4 mr_table structures are freed\nwithout first deactivating their timers. This can result in a crash in\nrun_timer_softirq.\nThis patch mimics the corresponding behaviour in ipv6.\nLocking and synchronization seem to be adequate.\nWe are about to kfree mrt, so existing code should already make sure that\nno other references to mrt are pending or can be created by incoming traffic.\nThe functions invoked here do not cause new references to mrt or other\nrace conditions to be created.\nInvoking del_timer_sync guarantees that ipmr_expire_timer is inactive.\nBoth ipmr_expire_process (whose completion we may have to wait in\ndel_timer_sync) and mroute_clean_tables internally use mfc_unres_lock\nor other synchronizations when needed, and they both only modify mrt.\n\nTested in Linux 3.4.8.\n\nSigned-off-by: Francesco Ruggeri \u003cfruggeri@aristanetworks.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fae286b0e547ed0379d93ace7664ea6f55cce0e0", "tree": "fa7f0814dc371a996fdc785add3b5dc072a9c3e1", "parents": [ "c5ca1d03c29df5dc550f71bd1669af8bc30e32f8" ], "author": { "name": "xeb@mail.ru", "email": "xeb@mail.ru", "time": "Fri Aug 24 01:07:38 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:42 2012 -0700" }, "message": "l2tp: avoid to use synchronize_rcu in tunnel free function\n\n[ Upstream commit 99469c32f79a32d8481f87be0d3c66dad286f4ec ]\n\nAvoid to use synchronize_rcu in l2tp_tunnel_free because context may be\natomic.\n\nSigned-off-by: Dmitry Kozlov \u003cxeb@mail.ru\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fbc350126994de9682e0400b969ab84437768894", "tree": "f9cc4d4fc4e9f96f1bfa2e746901511feb0403b7", "parents": [ "912af4d4433a29aa51bcbc33c4275541d8ccc4b1" ], "author": { "name": "Yuchung Cheng", "email": "ycheng@google.com", "time": "Thu Aug 23 07:05:17 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:38 2012 -0700" }, "message": "tcp: fix cwnd reduction for non-sack recovery\n\n[ Upstream commit 7c4a56fec379ac0d7754e0d4da6a7361f1a4fe64 ]\n\nThe cwnd reduction in fast recovery is based on the number of packets\nnewly delivered per ACK. For non-sack connections every DUPACK\nsignifies a packet has been delivered, but the sender mistakenly\nskips counting them for cwnd reduction.\n\nThe fix is to compute newly_acked_sacked after DUPACKs are accounted\nin sacked_out for non-sack connections.\n\nSigned-off-by: Yuchung Cheng \u003cycheng@google.com\u003e\nAcked-by: Nandita Dukkipati \u003cnanditad@google.com\u003e\nAcked-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "912af4d4433a29aa51bcbc33c4275541d8ccc4b1", "tree": "0b66cd3dc6ac1ca8f4950c9991b166d55649fa9d", "parents": [ "7c799a1e1ca2bc766574078b684c14474da9f704" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Thu Aug 23 02:09:11 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:38 2012 -0700" }, "message": "netlink: fix possible spoofing from non-root processes\n\n[ Upstream commit 20e1db19db5d6b9e4e83021595eab0dc8f107bef ]\n\nNon-root user-space processes can send Netlink messages to other\nprocesses that are well-known for being subscribed to Netlink\nasynchronous notifications. This allows ilegitimate non-root\nprocess to send forged messages to Netlink subscribers.\n\nThe userspace process usually verifies the legitimate origin in\ntwo ways:\n\na) Socket credentials. If UID !\u003d 0, then the message comes from\n some ilegitimate process and the message needs to be dropped.\n\nb) Netlink portID. In general, portID \u003d\u003d 0 means that the origin\n of the messages comes from the kernel. Thus, discarding any\n message not coming from the kernel.\n\nHowever, ctnetlink sets the portID in event messages that has\nbeen triggered by some user-space process, eg. conntrack utility.\nSo other processes subscribed to ctnetlink events, eg. conntrackd,\nknow that the event was triggered by some user-space action.\n\nNeither of the two ways to discard ilegitimate messages coming\nfrom non-root processes can help for ctnetlink.\n\nThis patch adds capability validation in case that dst_pid is set\nin netlink_sendmsg(). This approach is aggressive since existing\napplications using any Netlink bus to deliver messages between\ntwo user-space processes will break. Note that the exception is\nNETLINK_USERSOCK, since it is reserved for netlink-to-netlink\nuserspace communication.\n\nStill, if anyone wants that his Netlink bus allows netlink-to-netlink\nuserspace, then they can set NL_NONROOT_SEND. However, by default,\nI don\u0027t think it makes sense to allow to use NETLINK_ROUTE to\ncommunicate two processes that are sending no matter what information\nthat is not related to link/neighbouring/routing. They should be using\nNETLINK_USERSOCK instead for that.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7c799a1e1ca2bc766574078b684c14474da9f704", "tree": "3920b2c94d08c9355c0f6f3e94b30f8ffd42529b", "parents": [ "9e296becde8a8da5bcc1a8e22f27bdf9bd8636fe" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Aug 21 06:21:17 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:37 2012 -0700" }, "message": "af_netlink: force credentials passing [CVE-2012-3520]\n\n[ Upstream commit e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea ]\n\nPablo Neira Ayuso discovered that avahi and\npotentially NetworkManager accept spoofed Netlink messages because of a\nkernel bug. The kernel passes all-zero SCM_CREDENTIALS ancillary data\nto the receiver if the sender did not provide such data, instead of not\nincluding any such data at all or including the correct data from the\npeer (as it is the case with AF_UNIX).\n\nThis bug was introduced in commit 16e572626961\n(af_unix: dont send SCM_CREDENTIALS by default)\n\nThis patch forces passing credentials for netlink, as\nbefore the regression.\n\nAnother fix would be to not add SCM_CREDENTIALS in\nnetlink messages if not provided by the sender, but it\nmight break some programs.\n\nWith help from Florian Weimer \u0026 Petr Matousek\n\nThis issue is designated as CVE-2012-3520\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Petr Matousek \u003cpmatouse@redhat.com\u003e\nCc: Florian Weimer \u003cfweimer@redhat.com\u003e\nCc: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9e296becde8a8da5bcc1a8e22f27bdf9bd8636fe", "tree": "be7a8a0b16cb84b2781b7e210e9749b8236092db", "parents": [ "d09b3b2b1183848e287bc0b6397f8d05945becc4" ], "author": { "name": "Eric Leblond", "email": "eric@regit.org", "time": "Thu Aug 16 22:02:58 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:37 2012 -0700" }, "message": "af_packet: don\u0027t emit packet on orig fanout group\n\n[ Upstream commit c0de08d04215031d68fa13af36f347a6cfa252ca ]\n\nIf a packet is emitted on one socket in one group of fanout sockets,\nit is transmitted again. It is thus read again on one of the sockets\nof the fanout group. This result in a loop for software which\ngenerate packets when receiving one.\nThis retransmission is not the intended behavior: a fanout group\nmust behave like a single socket. The packet should not be\ntransmitted on a socket if it originates from a socket belonging\nto the same fanout group.\n\nThis patch fixes the issue by changing the transmission check to\ntake fanout group info account.\n\nReported-by: Aleksandr Kotov \u003ca1k@mail.ru\u003e\nSigned-off-by: Eric Leblond \u003ceric@regit.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d09b3b2b1183848e287bc0b6397f8d05945becc4", "tree": "1f3bd8db097160f7672c7cd987a48e4eb4e6d9d6", "parents": [ "62b4d90b525c6c11e467a2eadb12fcf64a6f0829" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:57 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:37 2012 -0700" }, "message": "net: fix info leak in compat dev_ifconf()\n\n[ Upstream commit 43da5f2e0d0c69ded3d51907d9552310a6b545e8 ]\n\nThe implementation of dev_ifconf() for the compat ioctl interface uses\nan intermediate ifc structure allocated in userland for the duration of\nthe syscall. Though, it fails to initialize the padding bytes inserted\nfor alignment and that for leaks four bytes of kernel stack. Add an\nexplicit memset(0) before filling the structure to avoid the info leak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "62b4d90b525c6c11e467a2eadb12fcf64a6f0829", "tree": "1a7f38e53fbca60b6651a295a8063b714947157d", "parents": [ "59039dc90bb7879bd4c8c959109d27131f0ce40f" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:56 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:37 2012 -0700" }, "message": "ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)\n\n[ Upstream commit 2d8a041b7bfe1097af21441cb77d6af95f4f4680 ]\n\nIf at least one of CONFIG_IP_VS_PROTO_TCP or CONFIG_IP_VS_PROTO_UDP is\nnot set, __ip_vs_get_timeouts() does not fully initialize the structure\nthat gets copied to userland and that for leaks up to 12 bytes of kernel\nstack. Add an explicit memset(0) before passing the structure to\n__ip_vs_get_timeouts() to avoid the info leak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Wensong Zhang \u003cwensong@linux-vs.org\u003e\nCc: Simon Horman \u003chorms@verge.net.au\u003e\nCc: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "59039dc90bb7879bd4c8c959109d27131f0ce40f", "tree": "63a3e774f903b4f560702083debf6749c33fd9ef", "parents": [ "00ed5b8f397447a944a3305274b74049bfcd633f" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:55 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:37 2012 -0700" }, "message": "dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO)\n\n[ Upstream commit 7b07f8eb75aa3097cdfd4f6eac3da49db787381d ]\n\nThe CCID3 code fails to initialize the trailing padding bytes of struct\ntfrc_tx_info added for alignment on 64 bit architectures. It that for\npotentially leaks four bytes kernel stack via the getsockopt() syscall.\nAdd an explicit memset(0) before filling the structure to avoid the\ninfo leak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Gerrit Renker \u003cgerrit@erg.abdn.ac.uk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "00ed5b8f397447a944a3305274b74049bfcd633f", "tree": "93b0b7fa842936ef99be4f604ee8d0e9d8346d1e", "parents": [ "dbcba7a54a0327f0ef6d6a3ec53b67d0969109b6" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:53 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:37 2012 -0700" }, "message": "llc: fix info leak via getsockname()\n\n[ Upstream commit 3592aaeb80290bda0f2cf0b5456c97bfc638b192 ]\n\nThe LLC code wrongly returns 0, i.e. \"success\", when the socket is\nzapped. Together with the uninitialized uaddrlen pointer argument from\nsys_getsockname this leads to an arbitrary memory leak of up to 128\nbytes kernel stack via the getsockname() syscall.\n\nReturn an error instead when the socket is zapped to prevent the info\nleak. Also remove the unnecessary memset(0). We don\u0027t directly write to\nthe memory pointed by uaddr but memcpy() a local structure at the end of\nthe function that is properly initialized.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@ghostprotocols.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "dbcba7a54a0327f0ef6d6a3ec53b67d0969109b6", "tree": "802a5ba716e47fa4c7364c0681f48a0a3c7e124b", "parents": [ "8717cd3d63233ee5591bf8e8d6e5960a1f6252b1" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:51 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:36 2012 -0700" }, "message": "Bluetooth: L2CAP - Fix info leak via getsockname()\n\n[ Upstream commit 792039c73cf176c8e39a6e8beef2c94ff46522ed ]\n\nThe L2CAP code fails to initialize the l2_bdaddr_type member of struct\nsockaddr_l2 and the padding byte added for alignment. It that for leaks\ntwo bytes kernel stack via the getsockname() syscall. Add an explicit\nmemset(0) before filling the structure to avoid the info leak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nCc: Gustavo Padovan \u003cgustavo@padovan.org\u003e\nCc: Johan Hedberg \u003cjohan.hedberg@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8717cd3d63233ee5591bf8e8d6e5960a1f6252b1", "tree": "ffc4c49e501cf875899afc531332fe6b87c4cfff", "parents": [ "279d3f5b2d402034dee1a81b7f5e3f678aa46d21" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:50 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:36 2012 -0700" }, "message": "Bluetooth: RFCOMM - Fix info leak via getsockname()\n\n[ Upstream commit 9344a972961d1a6d2c04d9008b13617bcb6ec2ef ]\n\nThe RFCOMM code fails to initialize the trailing padding byte of struct\nsockaddr_rc added for alignment. It that for leaks one byte kernel stack\nvia the getsockname() syscall. Add an explicit memset(0) before filling\nthe structure to avoid the info leak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nCc: Gustavo Padovan \u003cgustavo@padovan.org\u003e\nCc: Johan Hedberg \u003cjohan.hedberg@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "279d3f5b2d402034dee1a81b7f5e3f678aa46d21", "tree": "7e44b53ad4a9dc5cebdc5efde5ab80c926d877db", "parents": [ "745dcdb0fd330f0cc984bd8a7764a81f04e44780" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:49 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:36 2012 -0700" }, "message": "Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST)\n\n[ Upstream commit f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a ]\n\nThe RFCOMM code fails to initialize the two padding bytes of struct\nrfcomm_dev_list_req inserted for alignment before copying it to\nuserland. Additionally there are two padding bytes in each instance of\nstruct rfcomm_dev_info. The ioctl() that for disclosures two bytes plus\ndev_num times two bytes uninitialized kernel heap memory.\n\nAllocate the memory using kzalloc() to fix this issue.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nCc: Gustavo Padovan \u003cgustavo@padovan.org\u003e\nCc: Johan Hedberg \u003cjohan.hedberg@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "745dcdb0fd330f0cc984bd8a7764a81f04e44780", "tree": "f0acac1ff978f33ebb9fa23bb470d18e375a30df", "parents": [ "639edee79eb2035b6fe3976f50a1c5364acc7352" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:48 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:36 2012 -0700" }, "message": "Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY)\n\n[ Upstream commit 9ad2de43f1aee7e7274a4e0d41465489299e344b ]\n\nThe RFCOMM code fails to initialize the key_size member of struct\nbt_security before copying it to userland -- that for leaking one\nbyte kernel stack. Initialize key_size with 0 to avoid the info\nleak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nCc: Gustavo Padovan \u003cgustavo@padovan.org\u003e\nCc: Johan Hedberg \u003cjohan.hedberg@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "639edee79eb2035b6fe3976f50a1c5364acc7352", "tree": "b891e242addb0d42f802f1d6042b8da270f7d663", "parents": [ "87c42a1dfd5939d0a24795cd99b3d63daa4e1eff" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:47 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:36 2012 -0700" }, "message": "Bluetooth: HCI - Fix info leak via getsockname()\n\n[ Upstream commit 3f68ba07b1da811bf383b4b701b129bfcb2e4988 ]\n\nThe HCI code fails to initialize the hci_channel member of struct\nsockaddr_hci and that for leaks two bytes kernel stack via the\ngetsockname() syscall. Initialize hci_channel with 0 to avoid the\ninfo leak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nCc: Gustavo Padovan \u003cgustavo@padovan.org\u003e\nCc: Johan Hedberg \u003cjohan.hedberg@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "87c42a1dfd5939d0a24795cd99b3d63daa4e1eff", "tree": "abff8acbebc4d3f6037a53ea40dee1e9c75e1fff", "parents": [ "458ed5622e976848aacdea07d4bfcb84a350c460" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:46 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:36 2012 -0700" }, "message": "Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER)\n\n[ Upstream commit e15ca9a0ef9a86f0477530b0f44a725d67f889ee ]\n\nThe HCI code fails to initialize the two padding bytes of struct\nhci_ufilter before copying it to userland -- that for leaking two\nbytes kernel stack. Add an explicit memset(0) before filling the\nstructure to avoid the info leak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nCc: Gustavo Padovan \u003cgustavo@padovan.org\u003e\nCc: Johan Hedberg \u003cjohan.hedberg@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "458ed5622e976848aacdea07d4bfcb84a350c460", "tree": "863b701597e40dc811ba93d9a33c814ad7fd2496", "parents": [ "5b26dbdd5f22871c21fc2ea4afedfe4ecad62d72" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:45 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:36 2012 -0700" }, "message": "atm: fix info leak via getsockname()\n\n[ Upstream commit 3c0c5cfdcd4d69ffc4b9c0907cec99039f30a50a ]\n\nThe ATM code fails to initialize the two padding bytes of struct\nsockaddr_atmpvc inserted for alignment. Add an explicit memset(0)\nbefore filling the structure to avoid the info leak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5b26dbdd5f22871c21fc2ea4afedfe4ecad62d72", "tree": "879879858bb2508f4285b0d1eae2b25e4c51a7a1", "parents": [ "84a2d3c44cce71152f3555af83bafea6ec5ef23c" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:44 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:35 2012 -0700" }, "message": "atm: fix info leak in getsockopt(SO_ATMPVC)\n\n[ Upstream commit e862f1a9b7df4e8196ebec45ac62295138aa3fc2 ]\n\nThe ATM code fails to initialize the two padding bytes of struct\nsockaddr_atmpvc inserted for alignment. Add an explicit memset(0)\nbefore filling the structure to avoid the info leak.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "84a2d3c44cce71152f3555af83bafea6ec5ef23c", "tree": "fb069dbaa2fe6244cf4a4eaa9cbcdfdc57d22771", "parents": [ "c8cca9d90b953a0a2b5d0edab789f5c52ae983f5" ], "author": { "name": "Ben Hutchings", "email": "bhutchings@solarflare.com", "time": "Tue Aug 14 08:54:51 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:35 2012 -0700" }, "message": "ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock\n\n[ Upstream commit 4acd4945cd1e1f92b20d14e349c6c6a52acbd42d ]\n\nCong Wang reports that lockdep detected suspicious RCU usage while\nenabling IPV6 forwarding:\n\n [ 1123.310275] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ 1123.442202] [ INFO: suspicious RCU usage. ]\n [ 1123.558207] 3.6.0-rc1+ #109 Not tainted\n [ 1123.665204] -------------------------------\n [ 1123.768254] include/linux/rcupdate.h:430 Illegal context switch in RCU read-side critical section!\n [ 1123.992320]\n [ 1123.992320] other info that might help us debug this:\n [ 1123.992320]\n [ 1124.307382]\n [ 1124.307382] rcu_scheduler_active \u003d 1, debug_locks \u003d 0\n [ 1124.522220] 2 locks held by sysctl/5710:\n [ 1124.648364] #0: (rtnl_mutex){+.+.+.}, at: [\u003cffffffff81768498\u003e] rtnl_trylock+0x15/0x17\n [ 1124.882211] #1: (rcu_read_lock){.+.+.+}, at: [\u003cffffffff81871df8\u003e] rcu_lock_acquire+0x0/0x29\n [ 1125.085209]\n [ 1125.085209] stack backtrace:\n [ 1125.332213] Pid: 5710, comm: sysctl Not tainted 3.6.0-rc1+ #109\n [ 1125.441291] Call Trace:\n [ 1125.545281] [\u003cffffffff8109d915\u003e] lockdep_rcu_suspicious+0x109/0x112\n [ 1125.667212] [\u003cffffffff8107c240\u003e] rcu_preempt_sleep_check+0x45/0x47\n [ 1125.781838] [\u003cffffffff8107c260\u003e] __might_sleep+0x1e/0x19b\n[...]\n [ 1127.445223] [\u003cffffffff81757ac5\u003e] call_netdevice_notifiers+0x4a/0x4f\n[...]\n [ 1127.772188] [\u003cffffffff8175e125\u003e] dev_disable_lro+0x32/0x6b\n [ 1127.885174] [\u003cffffffff81872d26\u003e] dev_forward_change+0x30/0xcb\n [ 1128.013214] [\u003cffffffff818738c4\u003e] addrconf_forward_change+0x85/0xc5\n[...]\n\naddrconf_forward_change() uses RCU iteration over the netdev list,\nwhich is unnecessary since it already holds the RTNL lock. We also\ncannot reasonably require netdevice notifier functions not to sleep.\n\nReported-by: Cong Wang \u003camwang@redhat.com\u003e\nSigned-off-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c8cca9d90b953a0a2b5d0edab789f5c52ae983f5", "tree": "cb7361eb1dbf30145276156e99f4e82941f456bd", "parents": [ "caf2630c41a183b72e5d6211e5efd1457ac0c463" ], "author": { "name": "danborkmann@iogearbox.net", "email": "danborkmann@iogearbox.net", "time": "Fri Aug 10 22:48:54 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:35 2012 -0700" }, "message": "af_packet: remove BUG statement in tpacket_destruct_skb\n\n[ Upstream commit 7f5c3e3a80e6654cf48dfba7cf94f88c6b505467 ]\n\nHere\u0027s a quote of the comment about the BUG macro from asm-generic/bug.h:\n\n Don\u0027t use BUG() or BUG_ON() unless there\u0027s really no way out; one\n example might be detecting data structure corruption in the middle\n of an operation that can\u0027t be backed out of. If the (sub)system\n can somehow continue operating, perhaps with reduced functionality,\n it\u0027s probably not BUG-worthy.\n\n If you\u0027re tempted to BUG(), think again: is completely giving up\n really the *only* solution? There are usually better options, where\n users don\u0027t need to reboot ASAP and can mostly shut down cleanly.\n\nIn our case, the status flag of a ring buffer slot is managed from both sides,\nthe kernel space and the user space. This means that even though the kernel\nside might work as expected, the user space screws up and changes this flag\nright between the send(2) is triggered when the flag is changed to\nTP_STATUS_SENDING and a given skb is destructed after some time. Then, this\nwill hit the BUG macro. As David suggested, the best solution is to simply\nremove this statement since it cannot be used for kernel side internal\nconsistency checks. I\u0027ve tested it and the system still behaves /stable/ in\nthis case, so in accordance with the above comment, we should rather remove it.\n\nSigned-off-by: Daniel Borkmann \u003cdaniel.borkmann@tik.ee.ethz.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "caf2630c41a183b72e5d6211e5efd1457ac0c463", "tree": "5bcd1cdd058be10d65ea4fb7a809c5b00ef41aaf", "parents": [ "a348ed02b367a8a8307444724db5c8e96c90ac78" ], "author": { "name": "Alexey Khoroshilov", "email": "khoroshilov@ispras.ru", "time": "Wed Aug 08 00:33:25 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:35 2012 -0700" }, "message": "net/core: Fix potential memory leak in dev_set_alias()\n\n[ Upstream commit 7364e445f62825758fa61195d237a5b8ecdd06ec ]\n\nDo not leak memory by updating pointer with potentially NULL realloc return value.\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\nSigned-off-by: Alexey Khoroshilov \u003ckhoroshilov@ispras.ru\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7e0c71a9a5a23f9433eac1d0aabbc9d54da3428b", "tree": "78f3871cb2b2f4cd89a6ed8bda6bfc325e3f7814", "parents": [ "4658b24b2dd0e4c6215db2203743fa999765e8a0" ], "author": { "name": "Hiroaki SHIMODA", "email": "shimoda.hiroaki@gmail.com", "time": "Fri Aug 03 19:57:52 2012 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:34 2012 -0700" }, "message": "net_sched: gact: Fix potential panic in tcf_gact().\n\n[ Upstream commit 696ecdc10622d86541f2e35cc16e15b6b3b1b67e ]\n\ngact_rand array is accessed by gact-\u003etcfg_ptype whose value\nis assumed to less than MAX_RAND, but any range checks are\nnot performed.\n\nSo add a check in tcf_gact_init(). And in tcf_gact(), we can\nreduce a branch.\n\nSigned-off-by: Hiroaki SHIMODA \u003cshimoda.hiroaki@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4658b24b2dd0e4c6215db2203743fa999765e8a0", "tree": "9a88804f646780a2424a5ac87586151e923b1b64", "parents": [ "0a1f711681e0d7068b69c0697c4ba284fbf1b2bf" ], "author": { "name": "Ben Hutchings", "email": "bhutchings@solarflare.com", "time": "Mon Jul 30 16:11:42 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:34 2012 -0700" }, "message": "tcp: Apply device TSO segment limit earlier\n\n[ Upstream commit 1485348d2424e1131ea42efc033cbd9366462b01 ]\n\nCache the device gso_max_segs in sock::sk_gso_max_segs and use it to\nlimit the size of TSO skbs. This avoids the need to fall back to\nsoftware GSO for local TCP senders.\n\nSigned-off-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2dc3b21fbca98bd3c8d9e53acf5d966add3c7606", "tree": "6fe9f88dec40cfca839962a5a363848b27afb744", "parents": [ "00709f7f01c3a10252f030f0bdacecbb349d7be4" ], "author": { "name": "Ben Hutchings", "email": "bhutchings@solarflare.com", "time": "Mon Jul 30 15:57:00 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:34 2012 -0700" }, "message": "net: Allow driver to limit number of GSO segments per skb\n\n[ Upstream commit 30b678d844af3305cda5953467005cebb5d7b687 ]\n\nA peer (or local user) may cause TCP to use a nominal MSS of as little\nas 88 (actual MSS of 76 with timestamps). Given that we have a\nsufficiently prodigious local sender and the peer ACKs quickly enough,\nit is nevertheless possible to grow the window for such a connection\nto the point that we will try to send just under 64K at once. This\nresults in a single skb that expands to 861 segments.\n\nIn some drivers with TSO support, such an skb will require hundreds of\nDMA descriptors; a substantial fraction of a TX ring or even more than\na full ring. The TX queue selected for the skb may stall and trigger\nthe TX watchdog repeatedly (since the problem skb will be retried\nafter the TX reset). This particularly affects sfc, for which the\nissue is designated as CVE-2012-3412.\n\nTherefore:\n1. Add the field net_device::gso_max_segs holding the device-specific\n limit.\n2. In netif_skb_features(), if the number of segments is too high then\n mask out GSO features to force fall back to software GSO.\n\nSigned-off-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "af843972724e172827266e91ba326c069c8c088c", "tree": "532784df2f1c8e938f015e9f52c6fe7ae23981e4", "parents": [ "72961d91696071841fa013f11f686eaa7e2d0996" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Wed Aug 15 11:31:54 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Sep 14 10:00:34 2012 -0700" }, "message": "dccp: check ccid before dereferencing\n\ncommit 276bdb82dedb290511467a5a4fdbe9f0b52dce6f upstream.\n\nccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with\na NULL ccid pointer leading to a NULL pointer dereference. This could\nlead to a privilege escalation if the attacker is able to map page 0 and\nprepare it with a fake ccid_ops pointer.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Gerrit Renker \u003cgerrit@erg.abdn.ac.uk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "43da476d7f734a1b55680668246d0237dde4ea57" }