)]}' { "log": [ { "commit": "58634ac42e736eea0e8b93cec610174879d36d58", "tree": "4179bdb042aa497dd2fb3c7d0cddc88e244e5237", "parents": [ "fda73056f62d84376a3d29926708b4a08155da31", "a995dd1c29426a074364170359a026f68e8426db" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Tue Jan 14 21:51:43 2014 -0800" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Tue Jan 14 21:51:43 2014 -0800" }, "message": "Merge remote-tracking branch \u0027codeaurora/kk_2.7_rb1.21\u0027 into cm-11.0\n\nConflicts:\n\tdrivers/media/video/msm/msm_vfe32.h\n\tdrivers/media/video/msm/vfe/msm_vfe32.c\n\tnet/wireless/reg.c\n\nChange-Id: I073c609cfa1c461249bf728b28249bcaa1eaa211\n" }, { "commit": "de0f9a5a9d7932086e623560d66655cc8507cfec", "tree": "d9e4678d68da38d7670b79c8b5e8782445c5ad7e", "parents": [ "e1a3c5a3706d580390c02c69cb14dcd679d31d91", "84dfcb758ba7cce52ef475ac96861a558e1a20ca" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Dec 21 14:22:41 2013 -0800" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Dec 21 14:22:41 2013 -0800" }, "message": "Merge tag \u0027v3.4.75\u0027 into cm-11.0\n\nThis is the 3.4.75 stable release\n\nConflicts:\n\tdrivers/md/dm-crypt.c\n\tdrivers/mmc/card/block.c\n\tdrivers/net/ethernet/smsc/smc91x.h\n\nChange-Id: I39f38ef5530c5fef07583beb9d76b983e71b9ff3\n" }, { "commit": "4637517da82112b507f821e29a006662ac414894", "tree": "270969509f9d5a0ff9a445ff61925ffccd48c390", "parents": [ "b5043328b852715b21ab0e41a1edddfc7345f051" ], "author": { "name": "Will Deacon", "email": "will.deacon@arm.com", "time": "Mon Oct 21 12:14:53 2013 +0000" }, "committer": { "name": "Vijaya Kumar T M", "email": "vtmuni@codeaurora.org", "time": "Wed Dec 18 12:37:23 2013 +0530" }, "message": "netfilter: x_tables: fix ordering of jumpstack allocation and table update\n\nDuring kernel stability testing on an SMP ARMv7 system, Yalin Wang\nreported the following panic from the netfilter code:\n\n 1fe0: 0000001c 5e2d3b10 4007e779 4009e110 60000010 00000032 ff565656 ff545454\n [\u003cc06c48dc\u003e] (ipt_do_table+0x448/0x584) from [\u003cc0655ef0\u003e] (nf_iterate+0x48/0x7c)\n [\u003cc0655ef0\u003e] (nf_iterate+0x48/0x7c) from [\u003cc0655f7c\u003e] (nf_hook_slow+0x58/0x104)\n [\u003cc0655f7c\u003e] (nf_hook_slow+0x58/0x104) from [\u003cc0683bbc\u003e] (ip_local_deliver+0x88/0xa8)\n [\u003cc0683bbc\u003e] (ip_local_deliver+0x88/0xa8) from [\u003cc0683718\u003e] (ip_rcv_finish+0x418/0x43c)\n [\u003cc0683718\u003e] (ip_rcv_finish+0x418/0x43c) from [\u003cc062b1c4\u003e] (__netif_receive_skb+0x4cc/0x598)\n [\u003cc062b1c4\u003e] (__netif_receive_skb+0x4cc/0x598) from [\u003cc062b314\u003e] (process_backlog+0x84/0x158)\n [\u003cc062b314\u003e] (process_backlog+0x84/0x158) from [\u003cc062de84\u003e] (net_rx_action+0x70/0x1dc)\n [\u003cc062de84\u003e] (net_rx_action+0x70/0x1dc) from [\u003cc0088230\u003e] (__do_softirq+0x11c/0x27c)\n [\u003cc0088230\u003e] (__do_softirq+0x11c/0x27c) from [\u003cc008857c\u003e] (do_softirq+0x44/0x50)\n [\u003cc008857c\u003e] (do_softirq+0x44/0x50) from [\u003cc0088614\u003e] (local_bh_enable_ip+0x8c/0xd0)\n [\u003cc0088614\u003e] (local_bh_enable_ip+0x8c/0xd0) from [\u003cc06b0330\u003e] (inet_stream_connect+0x164/0x298)\n [\u003cc06b0330\u003e] (inet_stream_connect+0x164/0x298) from [\u003cc061d68c\u003e] (sys_connect+0x88/0xc8)\n [\u003cc061d68c\u003e] (sys_connect+0x88/0xc8) from [\u003cc000e340\u003e] (ret_fast_syscall+0x0/0x30)\n Code: 2a000021 e59d2028 e59de01c e59f011c (e7824103)\n ---[ end trace da227214a82491bd ]---\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThis comes about because CPU1 is executing xt_replace_table in response\nto a setsockopt syscall, resulting in:\n\n\tret \u003d xt_jumpstack_alloc(newinfo);\n\t\t--\u003e newinfo-\u003ejumpstack \u003d kzalloc(size, GFP_KERNEL);\n\n\t[...]\n\n\ttable-\u003eprivate \u003d newinfo;\n\tnewinfo-\u003einitial_entries \u003d private-\u003einitial_entries;\n\nMeanwhile, CPU0 is handling the network receive path and ends up in\nipt_do_table, resulting in:\n\n\tprivate \u003d table-\u003eprivate;\n\n\t[...]\n\n\tjumpstack \u003d (struct ipt_entry **)private-\u003ejumpstack[cpu];\n\nOn weakly ordered memory architectures, the writes to table-\u003eprivate\nand newinfo-\u003ejumpstack from CPU1 can be observed out of order by CPU0.\nFurthermore, on architectures which don\u0027t respect ordering of address\ndependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.\n\nThis patch adds an smp_wmb() before the assignment to table-\u003eprivate\n(which is essentially publishing newinfo) to ensure that all writes to\nnewinfo will be observed before plugging it into the table structure.\nA dependent-read barrier is also added on the consumer sides, to ensure\nthe same ordering requirements are also respected there.\n\nCRs-Fixed: 591149\n\nChange-Id: Ica3ec69cd6e2f77945a1a7303f92887feecf42e9\nCc: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nReported-by: Wang, Yalin \u003cYalin.Wang@sonymobile.com\u003e\nTested-by: Wang, Yalin \u003cYalin.Wang@sonymobile.com\u003e\nSigned-off-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nGit-commit: b416c144f46af1a30ddfa4e4319a8f077381ad63\nGit-repo: https://www.codeaurora.org/cgit/quic/la/kernel/msm/common/\nSigned-off-by: Vijaya Kumar T M \u003cvtmuni@codeaurora.org\u003e\n" }, { "commit": "2a38ada0f1ab9f894eea4428731ebc811b51c3f3", "tree": "759c765808a23a3a35e4ba10d8306c847c0205b7", "parents": [ "19218e895cefdd389c96af12c93c89e7276bbaad", "44d19f5a04ae4e433548ba2f25e4d2ccfcac765e" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sun Dec 08 12:50:38 2013 -0800" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sun Dec 08 12:50:38 2013 -0800" }, "message": "Merge tag \u0027v3.4.72\u0027 into tmp\n\nThis is the 3.4.72 stable release\n\nConflicts:\n\tarch/arm/Kconfig\n\tarch/arm/include/asm/mutex.h\n\tarch/arm/kernel/perf_event.c\n\tarch/arm/kernel/traps.c\n\tarch/arm/mm/dma-mapping.c\n\tdrivers/base/power/main.c\n\tdrivers/bluetooth/ath3k.c\n\tdrivers/bluetooth/btusb.c\n\tdrivers/gpu/drm/radeon/radeon_mode.h\n\tdrivers/mmc/card/block.c\n\tdrivers/mmc/host/sdhci.c\n\tdrivers/usb/core/message.c\n\tdrivers/usb/host/xhci-plat.c\n\tdrivers/usb/host/xhci.h\n\tdrivers/virtio/virtio_ring.c\n\tfs/ubifs/dir.c\n\tinclude/linux/freezer.h\n\tinclude/linux/virtio.h\n\tinclude/media/v4l2-ctrls.h\n\tinclude/net/bluetooth/hci_core.h\n\tinclude/net/bluetooth/mgmt.h\n\tkernel/cgroup.c\n\tkernel/futex.c\n\tkernel/signal.c\n\tnet/bluetooth/hci_conn.c\n\tnet/bluetooth/hci_core.c\n\tnet/bluetooth/hci_event.c\n\tnet/bluetooth/l2cap_core.c\n\tnet/bluetooth/mgmt.c\n\tnet/bluetooth/rfcomm/sock.c\n\tnet/bluetooth/smp.c\n\nChange-Id: I4fb0d5de74ca76f933d95d98e1a9c2c859402f34\n" }, { "commit": "8799b15a11fa940cba1e0085775eee5b6e6825d5", "tree": "14f55b2fce73b8afecabf5c54ce03977a512d2b9", "parents": [ "5fdc381c7cac378e757f76affb00f3b4e874d921" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Fri Nov 29 06:39:44 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Dec 08 07:29:42 2013 -0800" }, "message": "ipv6: fix possible seqlock deadlock in ip6_finish_output2\n\n[ Upstream commit 7f88c6b23afbd31545c676dea77ba9593a1a14bf ]\n\nIPv6 stats are 64 bits and thus are protected with a seqlock. By not\ndisabling bottom-half we could deadlock here if we don\u0027t disable bh and\na softirq reentrantly updates the same mib.\n\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "597b9d2145baea7ca03aa27ca5ede3e65f9859a2", "tree": "8dd0e9292bafab4f0a4a7907564db107d424b0d6", "parents": [ "eb7eb184acef1e803629b0cdcf1afc90bff62e1a" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Sat Nov 23 07:22:33 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Dec 08 07:29:42 2013 -0800" }, "message": "ipv6: fix leaking uninitialized port number of offender sockaddr\n\n[ Upstream commit 1fa4c710b6fe7b0aac9907240291b6fe6aafc3b8 ]\n\nOffenders don\u0027t have port numbers, so set it to 0.\n\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ad25b5df02bacf27efb56fe12bb8da8dd9273546", "tree": "46b4c357415225acf77d155d659a729c307fdee0", "parents": [ "ea9d7dc958579b07bf5cc419c4db932689a1224d" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Sat Nov 23 00:46:12 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Dec 08 07:29:42 2013 -0800" }, "message": "inet: fix addr_len/msg-\u003emsg_namelen assignment in recv_error and rxpmtu functions\n\n[ Upstream commit 85fbaa75037d0b6b786ff18658ddf0b4014ce2a4 ]\n\nCommit bceaa90240b6019ed73b49965eac7d167610be69 (\"inet: prevent leakage\nof uninitialized memory to user in recv syscalls\") conditionally updated\naddr_len if the msg_name is written to. The recv_error and rxpmtu\nfunctions relied on the recvmsg functions to set up addr_len before.\n\nAs this does not happen any more we have to pass addr_len to those\nfunctions as well and set it to the size of the corresponding sockaddr\nlength.\n\nThis broke traceroute and such.\n\nFixes: bceaa90240b6 (\"inet: prevent leakage of uninitialized memory to user in recv syscalls\")\nReported-by: Brad Spengler \u003cspender@grsecurity.net\u003e\nReported-by: Tom Labanowski\nCc: mpb \u003cmpb.mail@gmail.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "11afb94fbe0337a06ee7fce36841969b4e538622", "tree": "73becca8145da338a56cadf79fff88ce988e679c", "parents": [ "fadb5aaa2bcfbfc9c0707a04e980e0c85810b942" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Mon Nov 18 04:20:45 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Dec 08 07:29:41 2013 -0800" }, "message": "inet: prevent leakage of uninitialized memory to user in recv syscalls\n\n[ Upstream commit bceaa90240b6019ed73b49965eac7d167610be69 ]\n\nOnly update *addr_len when we actually fill in sockaddr, otherwise we\ncan return uninitialized memory from the stack to the caller in the\nrecvfrom, recvmmsg and recvmsg syscalls. Drop the the (addr_len \u003d\u003d NULL)\nchecks because we only get called with a valid addr_len pointer either\nfrom sock_common_recvmsg or inet_recvmsg.\n\nIf a blocking read waits on a socket which is concurrently shut down we\nnow return zero and set msg_msgnamelen to 0.\n\nReported-by: mpb \u003cmpb.mail@gmail.com\u003e\nSuggested-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4bb2cc8ea8b76426dcb60b95d27d599cb426bcf9", "tree": "04badee4c3e8119201806e03e66047b73aed41e0", "parents": [ "c137ba1634fce3c456a3e9983f70868708c13711" ], "author": { "name": "Duan Jiong", "email": "duanj.fnst@cn.fujitsu.com", "time": "Fri Nov 08 09:56:53 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Dec 08 07:29:41 2013 -0800" }, "message": "ipv6: use rt6_get_dflt_router to get default router in rt6_route_rcv\n\n[ Upstream commit f104a567e673f382b09542a8dc3500aa689957b4 ]\n\nAs the rfc 4191 said, the Router Preference and Lifetime values in a\n::/0 Route Information Option should override the preference and lifetime\nvalues in the Router Advertisement header. But when the kernel deals with\na ::/0 Route Information Option, the rt6_get_route_info() always return\nNULL, that means that overriding will not happen, because those default\nrouters were added without flag RTF_ROUTEINFO in rt6_add_dflt_router().\n\nIn order to deal with that condition, we should call rt6_get_dflt_router\nwhen the prefix length is 0.\n\nSigned-off-by: Duan Jiong \u003cduanj.fnst@cn.fujitsu.com\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "478e9a72b5e0cc9ecd8b787db90dec01d283123c", "tree": "f64155ef7f2967e06a105074cb668da0294d62ae", "parents": [ "2b5f6d110ee835cba1742c999cabd30a54c10b76" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Tue Oct 22 00:07:47 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 04 04:23:41 2013 -0800" }, "message": "inet: fix possible memory corruption with UDP_CORK and UFO\n\n[ This is a simplified -stable version of a set of upstream commits. ]\n\nThis is a replacement patch only for stable which does fix the problems\nhandled by the following two commits in -net:\n\n\"ip_output: do skb ufo init for peeked non ufo skb as well\" (e93b7d748be887cd7639b113ba7d7ef792a7efb9)\n\"ip6_output: do skb ufo init for peeked non ufo skb as well\" (c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b)\n\nThree frames are written on a corked udp socket for which the output\nnetdevice has UFO enabled. If the first and third frame are smaller than\nthe mtu and the second one is bigger, we enqueue the second frame with\nskb_append_datato_frags without initializing the gso fields. This leads\nto the third frame appended regulary and thus constructing an invalid skb.\n\nThis fixes the problem by always using skb_append_datato_frags as soon\nas the first frag got enqueued to the skb without marking the packet\nas SKB_GSO_UDP.\n\nThe problem with only two frames for ipv6 was fixed by \"ipv6: udp\npackets following an UFO enqueued packet need also be handled by UFO\"\n(2811ebac2521ceac84f2bdae402455baa6a7fb47).\n\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "25c065e6ed51e0fa5b1010c1682b3cad8fd34763", "tree": "4bcd8878d487c914a9c39cc07f9b2953cbf16409", "parents": [ "bbcb20aaca3bbbfcb8c53c3587620d59320f805f" ], "author": { "name": "Marcelo Ricardo Leitner", "email": "mleitner@redhat.com", "time": "Tue Oct 08 16:41:13 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 04 04:23:40 2013 -0800" }, "message": "ipv6: restrict neighbor entry creation to output flow\n\nThis patch is based on 3.2.y branch, the one used by reporter. Please let me\nknow if it should be different. Thanks.\n\nThe patch which introduced the regression was applied on stables:\n3.0.64 3.4.31 3.7.8 3.2.39\n\nThe patch which introduced the regression was for stable trees only.\n\n---8\u003c---\n\nCommit 0d6a77079c475033cb622c07c5a880b392ef664e \"ipv6: do not create\nneighbor entries for local delivery\" introduced a regression on\nwhich routes to local delivery would not work anymore. Like this:\n\n $ ip -6 route add local 2001::/64 dev lo\n $ ping6 -c1 2001::9\n PING 2001::9(2001::9) 56 data bytes\n ping: sendmsg: Invalid argument\n\nAs this is a local delivery, that commit would not allow the creation of a\nneighbor entry and thus the packet cannot be sent.\n\nBut as TPROXY scenario actually needs to avoid the neighbor entry creation only\nfor input flow, this patch now limits previous patch to input flow, keeping\noutput as before that patch.\n\nReported-by: Debabrata Banerjee \u003cdbavatar@gmail.com\u003e\nSigned-off-by: Marcelo Ricardo Leitner \u003cmleitner@redhat.com\u003e\nSigned-off-by: Jiri Pirko \u003cjiri@resnulli.us\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nCC: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "791673fbfa0c130e13b81a6c9e7036e5361986e4", "tree": "2517cca4e29f63fbb454f26b1c8e31fa72de8f96", "parents": [ "d1e668e717a602aa9a3c831711472c3e5d19ce7e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Oct 01 21:04:11 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 04 04:23:40 2013 -0800" }, "message": "net: do not call sock_put() on TIMEWAIT sockets\n\n[ Upstream commit 80ad1d61e72d626e30ebe8529a0455e660ca4693 ]\n\ncommit 3ab5aee7fe84 (\"net: Convert TCP \u0026 DCCP hash tables to use RCU /\nhlist_nulls\") incorrectly used sock_put() on TIMEWAIT sockets.\n\nWe should instead use inet_twsk_put()\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6b179d3a1422de6417691ff8de2e483563a13223", "tree": "ae33cab1395a686875ce20bce03a415b09c856de", "parents": [ "e723dd8bbde1ae36128fdeae766cd5447d747bf0" ], "author": { "name": "Salam Noureddine", "email": "noureddine@aristanetworks.com", "time": "Sun Sep 29 13:41:34 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:48 2013 -0700" }, "message": "ipv6 mcast: use in6_dev_put in timer handlers instead of __in6_dev_put\n\n[ Upstream commit 9260d3e1013701aa814d10c8fc6a9f92bd17d643 ]\n\nIt is possible for the timer handlers to run after the call to\nipv6_mc_down so use in6_dev_put instead of __in6_dev_put in the\nhandler function in order to do proper cleanup when the refcnt\nreaches 0. Otherwise, the refcnt can reach zero without the\ninet6_dev being destroyed and we end up leaking a reference to\nthe net_device and see messages like the following,\n\nunregister_netdevice: waiting for eth0 to become free. Usage count \u003d 1\n\nTested on linux-3.4.43.\n\nSigned-off-by: Salam Noureddine \u003cnoureddine@aristanetworks.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d720ee298ff7ef1495e6f39cd751dd4bab1be85d", "tree": "47f3b26fe64f75e6e713369cc8fee234840634ef", "parents": [ "f72299da3e1a010a3d77fbed0b9ee6abd0a19911" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Sat Sep 21 06:27:00 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:48 2013 -0700" }, "message": "ipv6: udp packets following an UFO enqueued packet need also be handled by UFO\n\n[ Upstream commit 2811ebac2521ceac84f2bdae402455baa6a7fb47 ]\n\nIn the following scenario the socket is corked:\nIf the first UDP packet is larger then the mtu we try to append it to the\nwrite queue via ip6_ufo_append_data. A following packet, which is smaller\nthan the mtu would be appended to the already queued up gso-skb via\nplain ip6_append_data. This causes random memory corruptions.\n\nIn ip6_ufo_append_data we also have to be careful to not queue up the\nsame skb multiple times. So setup the gso frame only when no first skb\nis available.\n\nThis also fixes a shortcoming where we add the current packet\u0027s length to\ncork-\u003elength but return early because of a packet \u003e mtu with dontfrag set\n(instead of sutracting it again).\n\nFound with trinity.\n\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d22586ffdda8938a66e198acff0f2ea64d7ce62e", "tree": "fac37e655174ece23505aefee79e2cf3a6aab85f", "parents": [ "8708ea2b682963ce30dfd638771e7e4022094a90" ], "author": { "name": "Daniel Borkmann", "email": "dborkman@redhat.com", "time": "Tue Sep 03 19:29:12 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:10 2013 -0700" }, "message": "net: ipv6: tcp: fix potential use after free in tcp_v6_do_rcv\n\n[ Upstream commit 3a1c756590633c0e86df606e5c618c190926a0df ]\n\nIn tcp_v6_do_rcv() code, when processing pkt options, we soley work\non our skb clone opt_skb that we\u0027ve created earlier before entering\ntcp_rcv_established() on our way. However, only in condition ...\n\n if (np-\u003erxopt.bits.rxtclass)\n np-\u003ercv_tclass \u003d ipv6_get_dsfield(ipv6_hdr(skb));\n\n... we work on skb itself. As we extract every other information out\nof opt_skb in ipv6_pktoptions path, this seems wrong, since skb can\nalready be released by tcp_rcv_established() earlier on. When we try\nto access it in ipv6_hdr(), we will dereference freed skb.\n\n[ Bug added by commit 4c507d2897bd9b (\"net: implement IP_RECVTOS for\n IP_PKTOPTIONS\") ]\n\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Jiri Benc \u003cjbenc@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8708ea2b682963ce30dfd638771e7e4022094a90", "tree": "7b9614ba8229bf836c376efb599ee9d7dc5af233", "parents": [ "98fadc18d23f40203ff154d0220692834e0de8f1" ], "author": { "name": "Jiri Bohac", "email": "jbohac@suse.cz", "time": "Fri Aug 30 11:18:45 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:10 2013 -0700" }, "message": "ICMPv6: treat dest unreachable codes 5 and 6 as EACCES, not EPROTO\n\n[ Upstream commit 61e76b178dbe7145e8d6afa84bb4ccea71918994 ]\n\nRFC 4443 has defined two additional codes for ICMPv6 type 1 (destination\nunreachable) messages:\n 5 - Source address failed ingress/egress policy\n\t6 - Reject route to destination\n\nNow they are treated as protocol error and icmpv6_err_convert() converts them\nto EPROTO.\n\nRFC 4443 says:\n\t\"Codes 5 and 6 are more informative subsets of code 1.\"\n\nTreat codes 5 and 6 as code 1 (EACCES)\n\nBtw, connect() returning -EPROTO confuses firefox, so that fallback to\nother/IPv4 addresses does not work:\nhttps://bugzilla.mozilla.org/show_bug.cgi?id\u003d910773\n\nSigned-off-by: Jiri Bohac \u003cjbohac@suse.cz\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "cce0727ab07058c745d1a104d84c4d0e3a100ef9", "tree": "d4c39d739016d6f40ac21e3789c0431c917f3ec3", "parents": [ "055c396300ee15d990777841278ba94d2bc7868a" ], "author": { "name": "Thomas Graf", "email": "tgraf@suug.ch", "time": "Tue Sep 03 13:37:01 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:10 2013 -0700" }, "message": "ipv6: Don\u0027t depend on per socket memory for neighbour discovery messages\n\n[ Upstream commit 25a6e6b84fba601eff7c28d30da8ad7cfbef0d43 ]\n\nAllocating skbs when sending out neighbour discovery messages\ncurrently uses sock_alloc_send_skb() based on a per net namespace\nsocket and thus share a socket wmem buffer space.\n\nIf a netdevice is temporarily unable to transmit due to carrier\nloss or for other reasons, the queued up ndisc messages will cosnume\nall of the wmem space and will thus prevent from any more skbs to\nbe allocated even for netdevices that are able to transmit packets.\n\nThe number of neighbour discovery messages sent is very limited,\nuse of alloc_skb() bypasses the socket wmem buffer size enforcement\nwhile the manual call to skb_set_owner_w() maintains the socket\nreference needed for the IPv6 output path.\n\nThis patch has orginally been posted by Eric Dumazet in a modified\nform.\n\nSigned-off-by: Thomas Graf \u003ctgraf@suug.ch\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nCc: Stephen Warren \u003cswarren@wwwdotorg.org\u003e\nCc: Fabio Estevam \u003cfestevam@gmail.com\u003e\nTested-by: Fabio Estevam \u003cfabio.estevam@freescale.com\u003e\nTested-by: Stephen Warren \u003cswarren@nvidia.com\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "055c396300ee15d990777841278ba94d2bc7868a", "tree": "7160fdb3700a540dd58fa7c01d1930df13749a02", "parents": [ "f4cb837d1bdb6e1592523ce76c3f45188d120b4e" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Fri Aug 16 13:30:07 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:10 2013 -0700" }, "message": "ipv6: drop packets with multiple fragmentation headers\n\n[ Upstream commit f46078cfcd77fa5165bf849f5e568a7ac5fa569c ]\n\nIt is not allowed for an ipv6 packet to contain multiple fragmentation\nheaders. So discard packets which were already reassembled by\nfragmentation logic and send back a parameter problem icmp.\n\nThe updates for RFC 6980 will come in later, I have to do a bit more\nresearch here.\n\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f4cb837d1bdb6e1592523ce76c3f45188d120b4e", "tree": "50bf25da38185a7d4f95cde5edca20dbdc9bb192", "parents": [ "62d5a1d2a8a7c247c1f2dcd87b1e8c533b03017b" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Fri Aug 16 13:02:27 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:09 2013 -0700" }, "message": "ipv6: remove max_addresses check from ipv6_create_tempaddr\n\n[ Upstream commit 4b08a8f1bd8cb4541c93ec170027b4d0782dab52 ]\n\nBecause of the max_addresses check attackers were able to disable privacy\nextensions on an interface by creating enough autoconfigured addresses:\n\n\u003chttp://seclists.org/oss-sec/2012/q4/292\u003e\n\nBut the check is not actually needed: max_addresses protects the\nkernel to install too many ipv6 addresses on an interface and guards\naddrconf_prefix_rcv to install further addresses as soon as this limit\nis reached. We only generate temporary addresses in direct response of\na new address showing up. As soon as we filled up the maximum number of\naddresses of an interface, we stop installing more addresses and thus\nalso stop generating more temp addresses.\n\nEven if the attacker tries to generate a lot of temporary addresses\nby announcing a prefix and removing it again (lifetime \u003d\u003d 0) we won\u0027t\ninstall more temp addresses, because the temporary addresses do count\nto the maximum number of addresses, thus we would stop installing new\nautoconfigured addresses when the limit is reached.\n\nThis patch fixes CVE-2013-0343 (but other layer-2 attacks are still\npossible).\n\nThanks to Ding Tianhong to bring this topic up again.\n\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nCc: Ding Tianhong \u003cdingtianhong@huawei.com\u003e\nCc: George Kargiotakis \u003ckargig@void.gr\u003e\nCc: P J P \u003cppandit@redhat.com\u003e\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nAcked-by: Ding Tianhong \u003cdingtianhong@huawei.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7f1322071c591867b963eac2c42643b0dce29bca", "tree": "f8a1d39853670249ab586c1c4a412a8fa4d29135", "parents": [ "6b7f7bf782f38216c7584a21e4189ff637056e56" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Wed Aug 07 02:34:31 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:09 2013 -0700" }, "message": "ipv6: don\u0027t stop backtracking in fib6_lookup_1 if subtree does not match\n\n[ Upstream commit 3e3be275851bc6fc90bfdcd732cd95563acd982b ]\n\nIn case a subtree did not match we currently stop backtracking and return\nNULL (root table from fib_lookup). This could yield in invalid routing\ntable lookups when using subtrees.\n\nInstead continue to backtrack until a valid subtree or node is found\nand return this match.\n\nAlso remove unneeded NULL check.\n\nReported-by: Teco Boot \u003cteco@inf-net.nl\u003e\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nCc: David Lamparter \u003cequinox@diac24.net\u003e\nCc: \u003cboutier@pps.univ-paris-diderot.fr\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8d50892d6f963cd24104d7f821fb08b903519a6b", "tree": "67e5913e996235a992178c328471f1504c71bdb1", "parents": [ "d9a6f7174337a6d02b77e37fba6ab80bcf1ea528" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Mon Jul 22 23:45:53 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 11 15:38:44 2013 -0700" }, "message": "ipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanup\n\n[ Upstream commit 905a6f96a1b18e490a75f810d733ced93c39b0e5 ]\n\nOtherwise we end up dereferencing the already freed net-\u003eipv6.mrt pointer\nwhich leads to a panic (from Srivatsa S. Bhat):\n\nBUG: unable to handle kernel paging request at ffff882018552020\nIP: [\u003cffffffffa0366b02\u003e] ip6mr_sk_done+0x32/0xb0 [ipv6]\nPGD 290a067 PUD 207ffe0067 PMD 207ff1d067 PTE 8000002018552060\nOops: 0000 [#1] SMP DEBUG_PAGEALLOC\nModules linked in: ebtable_nat ebtables nfs fscache nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables nfsd lockd nfs_acl exportfs auth_rpcgss autofs4 sunrpc 8021q garp bridge stp llc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter\n+ip6_tables ipv6 vfat fat vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support cdc_ether usbnet mii microcode i2c_i801 i2c_core lpc_ich mfd_core shpchp ioatdma dca mlx4_core be2net wmi acpi_cpufreq mperf ext4 jbd2 mbcache dm_mirror dm_region_hash dm_log dm_mod\nCPU: 0 PID: 7 Comm: kworker/u33:0 Not tainted 3.11.0-rc1-ea45e-a #4\nHardware name: IBM -[8737R2A]-/00Y2738, BIOS -[B2E120RUS-1.20]- 11/30/2012\nWorkqueue: netns cleanup_net\ntask: ffff8810393641c0 ti: ffff881039366000 task.ti: ffff881039366000\nRIP: 0010:[\u003cffffffffa0366b02\u003e] [\u003cffffffffa0366b02\u003e] ip6mr_sk_done+0x32/0xb0 [ipv6]\nRSP: 0018:ffff881039367bd8 EFLAGS: 00010286\nRAX: ffff881039367fd8 RBX: ffff882018552000 RCX: dead000000200200\nRDX: 0000000000000000 RSI: ffff881039367b68 RDI: ffff881039367b68\nRBP: ffff881039367bf8 R08: ffff881039367b68 R09: 2222222222222222\nR10: 2222222222222222 R11: 2222222222222222 R12: ffff882015a7a040\nR13: ffff882014eb89c0 R14: ffff8820289e2800 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff88103fc00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffff882018552020 CR3: 0000000001c0b000 CR4: 00000000000407f0\nStack:\n ffff881039367c18 ffff882014eb89c0 ffff882015e28c00 0000000000000000\n ffff881039367c18 ffffffffa034d9d1 ffff8820289e2800 ffff882014eb89c0\n ffff881039367c58 ffffffff815bdecb ffffffff815bddf2 ffff882014eb89c0\nCall Trace:\n [\u003cffffffffa034d9d1\u003e] rawv6_close+0x21/0x40 [ipv6]\n [\u003cffffffff815bdecb\u003e] inet_release+0xfb/0x220\n [\u003cffffffff815bddf2\u003e] ? inet_release+0x22/0x220\n [\u003cffffffffa032686f\u003e] inet6_release+0x3f/0x50 [ipv6]\n [\u003cffffffff8151c1d9\u003e] sock_release+0x29/0xa0\n [\u003cffffffff81525520\u003e] sk_release_kernel+0x30/0x70\n [\u003cffffffffa034f14b\u003e] icmpv6_sk_exit+0x3b/0x80 [ipv6]\n [\u003cffffffff8152fff9\u003e] ops_exit_list+0x39/0x60\n [\u003cffffffff815306fb\u003e] cleanup_net+0xfb/0x1a0\n [\u003cffffffff81075e3a\u003e] process_one_work+0x1da/0x610\n [\u003cffffffff81075dc9\u003e] ? process_one_work+0x169/0x610\n [\u003cffffffff81076390\u003e] worker_thread+0x120/0x3a0\n [\u003cffffffff81076270\u003e] ? process_one_work+0x610/0x610\n [\u003cffffffff8107da2e\u003e] kthread+0xee/0x100\n [\u003cffffffff8107d940\u003e] ? __init_kthread_worker+0x70/0x70\n [\u003cffffffff8162a99c\u003e] ret_from_fork+0x7c/0xb0\n [\u003cffffffff8107d940\u003e] ? __init_kthread_worker+0x70/0x70\nCode: 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 66 66 66 66 90 4c 8b 67 30 49 89 fd e8 db 3c 1e e1 49 8b 9c 24 90 08 00 00 48 85 db 74 06 \u003c4c\u003e 39 6b 20 74 20 bb f3 ff ff ff e8 8e 3c 1e e1 89 d8 4c 8b 65\nRIP [\u003cffffffffa0366b02\u003e] ip6mr_sk_done+0x32/0xb0 [ipv6]\n RSP \u003cffff881039367bd8\u003e\nCR2: ffff882018552020\n\nReported-by: Srivatsa S. Bhat \u003csrivatsa.bhat@linux.vnet.ibm.com\u003e\nTested-by: Srivatsa S. Bhat \u003csrivatsa.bhat@linux.vnet.ibm.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9e17026719400715de98857ed473406e21bd0de9", "tree": "3b31ab4f161bb89bba8182d4c2be042fa2944d18", "parents": [ "7d3f3dc17115e360f599c97c1882f9362e8330a5" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Wed Jul 10 23:00:57 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:26:05 2013 -0700" }, "message": "ipv6: in case of link failure remove route directly instead of letting it expire\n\n[ Upstream commit 1eb4f758286884e7566627164bca4c4a16952a83 ]\n\nWe could end up expiring a route which is part of an ecmp route set. Doing\nso would invalidate the rt-\u003ert6i_nsiblings calculations and could provoke\nthe following panic:\n\n[ 80.144667] ------------[ cut here ]------------\n[ 80.145172] kernel BUG at net/ipv6/ip6_fib.c:733!\n[ 80.145172] invalid opcode: 0000 [#1] SMP\n[ 80.145172] Modules linked in: 8021q nf_conntrack_netbios_ns nf_conntrack_broadcast ipt_MASQUERADE ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat nf_nat_ipv4 nf_nat iptable_mangle nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables ip6table_filter ip6_tables\n+snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_page_alloc snd_timer virtio_balloon snd soundcore i2c_piix4 i2c_core virtio_net virtio_blk\n[ 80.145172] CPU: 1 PID: 786 Comm: ping6 Not tainted 3.10.0+ #118\n[ 80.145172] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 80.145172] task: ffff880117fa0000 ti: ffff880118770000 task.ti: ffff880118770000\n[ 80.145172] RIP: 0010:[\u003cffffffff815f3b5d\u003e] [\u003cffffffff815f3b5d\u003e] fib6_add+0x75d/0x830\n[ 80.145172] RSP: 0018:ffff880118771798 EFLAGS: 00010202\n[ 80.145172] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88011350e480\n[ 80.145172] RDX: ffff88011350e238 RSI: 0000000000000004 RDI: ffff88011350f738\n[ 80.145172] RBP: ffff880118771848 R08: ffff880117903280 R09: 0000000000000001\n[ 80.145172] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88011350f680\n[ 80.145172] R13: ffff880117903280 R14: ffff880118771890 R15: ffff88011350ef90\n[ 80.145172] FS: 00007f02b5127740(0000) GS:ffff88011fd00000(0000) knlGS:0000000000000000\n[ 80.145172] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n[ 80.145172] CR2: 00007f981322a000 CR3: 00000001181b1000 CR4: 00000000000006e0\n[ 80.145172] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 80.145172] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n[ 80.145172] Stack:\n[ 80.145172] 0000000000000001 ffff880100000000 ffff880100000000 ffff880117903280\n[ 80.145172] 0000000000000000 ffff880119a4cf00 0000000000000400 00000000000007fa\n[ 80.145172] 0000000000000000 0000000000000000 0000000000000000 ffff88011350f680\n[ 80.145172] Call Trace:\n[ 80.145172] [\u003cffffffff815eeceb\u003e] ? rt6_bind_peer+0x4b/0x90\n[ 80.145172] [\u003cffffffff815ed985\u003e] __ip6_ins_rt+0x45/0x70\n[ 80.145172] [\u003cffffffff815eee35\u003e] ip6_ins_rt+0x35/0x40\n[ 80.145172] [\u003cffffffff815ef1e4\u003e] ip6_pol_route.isra.44+0x3a4/0x4b0\n[ 80.145172] [\u003cffffffff815ef34a\u003e] ip6_pol_route_output+0x2a/0x30\n[ 80.145172] [\u003cffffffff81616077\u003e] fib6_rule_action+0xd7/0x210\n[ 80.145172] [\u003cffffffff815ef320\u003e] ? ip6_pol_route_input+0x30/0x30\n[ 80.145172] [\u003cffffffff81553026\u003e] fib_rules_lookup+0xc6/0x140\n[ 80.145172] [\u003cffffffff81616374\u003e] fib6_rule_lookup+0x44/0x80\n[ 80.145172] [\u003cffffffff815ef320\u003e] ? ip6_pol_route_input+0x30/0x30\n[ 80.145172] [\u003cffffffff815edea3\u003e] ip6_route_output+0x73/0xb0\n[ 80.145172] [\u003cffffffff815dfdf3\u003e] ip6_dst_lookup_tail+0x2c3/0x2e0\n[ 80.145172] [\u003cffffffff813007b1\u003e] ? list_del+0x11/0x40\n[ 80.145172] [\u003cffffffff81082a4c\u003e] ? remove_wait_queue+0x3c/0x50\n[ 80.145172] [\u003cffffffff815dfe4d\u003e] ip6_dst_lookup_flow+0x3d/0xa0\n[ 80.145172] [\u003cffffffff815fda77\u003e] rawv6_sendmsg+0x267/0xc20\n[ 80.145172] [\u003cffffffff815a8a83\u003e] inet_sendmsg+0x63/0xb0\n[ 80.145172] [\u003cffffffff8128eb93\u003e] ? selinux_socket_sendmsg+0x23/0x30\n[ 80.145172] [\u003cffffffff815218d6\u003e] sock_sendmsg+0xa6/0xd0\n[ 80.145172] [\u003cffffffff81524a68\u003e] SYSC_sendto+0x128/0x180\n[ 80.145172] [\u003cffffffff8109825c\u003e] ? update_curr+0xec/0x170\n[ 80.145172] [\u003cffffffff81041d09\u003e] ? kvm_clock_get_cycles+0x9/0x10\n[ 80.145172] [\u003cffffffff810afd1e\u003e] ? __getnstimeofday+0x3e/0xd0\n[ 80.145172] [\u003cffffffff8152509e\u003e] SyS_sendto+0xe/0x10\n[ 80.145172] [\u003cffffffff8164efd9\u003e] system_call_fastpath+0x16/0x1b\n[ 80.145172] Code: fe ff ff 41 f6 45 2a 06 0f 85 ca fe ff ff 49 8b 7e 08 4c 89 ee e8 94 ef ff ff e9 b9 fe ff ff 48 8b 82 28 05 00 00 e9 01 ff ff ff \u003c0f\u003e 0b 49 8b 54 24 30 0d 00 00 40 00 89 83 14 01 00 00 48 89 53\n[ 80.145172] RIP [\u003cffffffff815f3b5d\u003e] fib6_add+0x75d/0x830\n[ 80.145172] RSP \u003cffff880118771798\u003e\n[ 80.387413] ---[ end trace 02f20b7a8b81ed95 ]---\n[ 80.390154] Kernel panic - not syncing: Fatal exception in interrupt\n\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nCc: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6641027f832be5576d260fb0aeed2968aa67f185", "tree": "f28c1b7de2cbb599f2fc799e3b8bb5406c66bf4a", "parents": [ "eeddd9177a67b743868e09742d58f574b2b9a497" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Tue Jul 02 08:04:05 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:26:03 2013 -0700" }, "message": "ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size\n\n[ Upstream commit 75a493e60ac4bbe2e977e7129d6d8cbb0dd236be ]\n\nIf the socket had an IPV6_MTU value set, ip6_append_data_mtu lost track\nof this when appending the second frame on a corked socket. This results\nin the following splat:\n\n[37598.993962] ------------[ cut here ]------------\n[37598.994008] kernel BUG at net/core/skbuff.c:2064!\n[37598.994008] invalid opcode: 0000 [#1] SMP\n[37598.994008] Modules linked in: tcp_lp uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_core videodev media vfat fat usb_storage fuse ebtable_nat xt_CHECKSUM bridge stp llc ipt_MASQUERADE nf_conntrack_netbios_ns nf_conntrack_broadcast ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat\n+nf_nat_ipv4 nf_nat iptable_mangle nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables ip6table_filter ip6_tables be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i cxgb4 cxgb3i cxgb3 mdio libcxgbi ib_iser rdma_cm ib_addr iw_cm ib_cm ib_sa ib_mad ib_core iscsi_tcp libiscsi_tcp libiscsi\n+scsi_transport_iscsi rfcomm bnep iTCO_wdt iTCO_vendor_support snd_hda_codec_conexant arc4 iwldvm mac80211 snd_hda_intel acpi_cpufreq mperf coretemp snd_hda_codec microcode cdc_wdm cdc_acm\n[37598.994008] snd_hwdep cdc_ether snd_seq snd_seq_device usbnet mii joydev btusb snd_pcm bluetooth i2c_i801 e1000e lpc_ich mfd_core ptp iwlwifi pps_core snd_page_alloc mei cfg80211 snd_timer thinkpad_acpi snd tpm_tis soundcore rfkill tpm tpm_bios vhost_net tun macvtap macvlan kvm_intel kvm uinput binfmt_misc\n+dm_crypt i915 i2c_algo_bit drm_kms_helper drm i2c_core wmi video\n[37598.994008] CPU 0\n[37598.994008] Pid: 27320, comm: t2 Not tainted 3.9.6-200.fc18.x86_64 #1 LENOVO 27744PG/27744PG\n[37598.994008] RIP: 0010:[\u003cffffffff815443a5\u003e] [\u003cffffffff815443a5\u003e] skb_copy_and_csum_bits+0x325/0x330\n[37598.994008] RSP: 0018:ffff88003670da18 EFLAGS: 00010202\n[37598.994008] RAX: ffff88018105c018 RBX: 0000000000000004 RCX: 00000000000006c0\n[37598.994008] RDX: ffff88018105a6c0 RSI: ffff88018105a000 RDI: ffff8801e1b0aa00\n[37598.994008] RBP: ffff88003670da78 R08: 0000000000000000 R09: ffff88018105c040\n[37598.994008] R10: ffff8801e1b0aa00 R11: 0000000000000000 R12: 000000000000fff8\n[37598.994008] R13: 00000000000004fc R14: 00000000ffff0504 R15: 0000000000000000\n[37598.994008] FS: 00007f28eea59740(0000) GS:ffff88023bc00000(0000) knlGS:0000000000000000\n[37598.994008] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n[37598.994008] CR2: 0000003d935789e0 CR3: 00000000365cb000 CR4: 00000000000407f0\n[37598.994008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[37598.994008] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n[37598.994008] Process t2 (pid: 27320, threadinfo ffff88003670c000, task ffff88022c162ee0)\n[37598.994008] Stack:\n[37598.994008] ffff88022e098a00 ffff88020f973fc0 0000000000000008 00000000000004c8\n[37598.994008] ffff88020f973fc0 00000000000004c4 ffff88003670da78 ffff8801e1b0a200\n[37598.994008] 0000000000000018 00000000000004c8 ffff88020f973fc0 00000000000004c4\n[37598.994008] Call Trace:\n[37598.994008] [\u003cffffffff815fc21f\u003e] ip6_append_data+0xccf/0xfe0\n[37598.994008] [\u003cffffffff8158d9f0\u003e] ? ip_copy_metadata+0x1a0/0x1a0\n[37598.994008] [\u003cffffffff81661f66\u003e] ? _raw_spin_lock_bh+0x16/0x40\n[37598.994008] [\u003cffffffff8161548d\u003e] udpv6_sendmsg+0x1ed/0xc10\n[37598.994008] [\u003cffffffff812a2845\u003e] ? sock_has_perm+0x75/0x90\n[37598.994008] [\u003cffffffff815c3693\u003e] inet_sendmsg+0x63/0xb0\n[37598.994008] [\u003cffffffff812a2973\u003e] ? selinux_socket_sendmsg+0x23/0x30\n[37598.994008] [\u003cffffffff8153a450\u003e] sock_sendmsg+0xb0/0xe0\n[37598.994008] [\u003cffffffff810135d1\u003e] ? __switch_to+0x181/0x4a0\n[37598.994008] [\u003cffffffff8153d97d\u003e] sys_sendto+0x12d/0x180\n[37598.994008] [\u003cffffffff810dfb64\u003e] ? __audit_syscall_entry+0x94/0xf0\n[37598.994008] [\u003cffffffff81020ed1\u003e] ? syscall_trace_enter+0x231/0x240\n[37598.994008] [\u003cffffffff8166a7e7\u003e] tracesys+0xdd/0xe2\n[37598.994008] Code: fe 07 00 00 48 c7 c7 04 28 a6 81 89 45 a0 4c 89 4d b8 44 89 5d a8 e8 1b ac b1 ff 44 8b 5d a8 4c 8b 4d b8 8b 45 a0 e9 cf fe ff ff \u003c0f\u003e 0b 66 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 48\n[37598.994008] RIP [\u003cffffffff815443a5\u003e] skb_copy_and_csum_bits+0x325/0x330\n[37598.994008] RSP \u003cffff88003670da18\u003e\n[37599.007323] ---[ end trace d69f6a17f8ac8eee ]---\n\nWhile there, also check if path mtu discovery is activated for this\nsocket. The logic was adapted from ip6_append_data when first writing\non the corked socket.\n\nThis bug was introduced with commit\n0c1833797a5a6ec23ea9261d979aa18078720b74 (\"ipv6: fix incorrect ipsec\nfragment\").\n\nv2:\na) Replace IPV6_PMTU_DISC_DO with IPV6_PMTUDISC_PROBE.\nb) Don\u0027t pass ipv6_pinfo to ip6_append_data_mtu (suggestion by Gao\n feng, thanks!).\nc) Change mtu to unsigned int, else we get a warning about\n non-matching types because of the min()-macro type-check.\n\nAcked-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "eeddd9177a67b743868e09742d58f574b2b9a497", "tree": "6f78ff2f6a6cc08cf59d4ceeece5e9601f4e135e", "parents": [ "589acc586e0f12e0c46bc98e79ff2a008e8c6c11" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Mon Jul 01 20:21:30 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:26:02 2013 -0700" }, "message": "ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data\n\n[ Upstream commit 8822b64a0fa64a5dd1dfcf837c5b0be83f8c05d1 ]\n\nWe accidentally call down to ip6_push_pending_frames when uncorking\npending AF_INET data on a ipv6 socket. This results in the following\nsplat (from Dave Jones):\n\nskbuff: skb_under_panic: text:ffffffff816765f6 len:48 put:40 head:ffff88013deb6df0 data:ffff88013deb6dec tail:0x2c end:0xc0 dev:\u003cNULL\u003e\n------------[ cut here ]------------\nkernel BUG at net/core/skbuff.c:126!\ninvalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\nModules linked in: dccp_ipv4 dccp 8021q garp bridge stp dlci mpoa snd_seq_dummy sctp fuse hidp tun bnep nfnetlink scsi_transport_iscsi rfcomm can_raw can_bcm af_802154 appletalk caif_socket can caif ipt_ULOG x25 rose af_key pppoe pppox ipx phonet irda llc2 ppp_generic slhc p8023 psnap p8022 llc crc_ccitt atm bluetooth\n+netrom ax25 nfc rfkill rds af_rxrpc coretemp hwmon kvm_intel kvm crc32c_intel snd_hda_codec_realtek ghash_clmulni_intel microcode pcspkr snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hwdep usb_debug snd_seq snd_seq_device snd_pcm e1000e snd_page_alloc snd_timer ptp snd pps_core soundcore xfs libcrc32c\nCPU: 2 PID: 8095 Comm: trinity-child2 Not tainted 3.10.0-rc7+ #37\ntask: ffff8801f52c2520 ti: ffff8801e6430000 task.ti: ffff8801e6430000\nRIP: 0010:[\u003cffffffff816e759c\u003e] [\u003cffffffff816e759c\u003e] skb_panic+0x63/0x65\nRSP: 0018:ffff8801e6431de8 EFLAGS: 00010282\nRAX: 0000000000000086 RBX: ffff8802353d3cc0 RCX: 0000000000000006\nRDX: 0000000000003b90 RSI: ffff8801f52c2ca0 RDI: ffff8801f52c2520\nRBP: ffff8801e6431e08 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000001 R12: ffff88022ea0c800\nR13: ffff88022ea0cdf8 R14: ffff8802353ecb40 R15: ffffffff81cc7800\nFS: 00007f5720a10740(0000) GS:ffff880244c00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000005862000 CR3: 000000022843c000 CR4: 00000000001407e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600\nStack:\n ffff88013deb6dec 000000000000002c 00000000000000c0 ffffffff81a3f6e4\n ffff8801e6431e18 ffffffff8159a9aa ffff8801e6431e90 ffffffff816765f6\n ffffffff810b756b 0000000700000002 ffff8801e6431e40 0000fea9292aa8c0\nCall Trace:\n [\u003cffffffff8159a9aa\u003e] skb_push+0x3a/0x40\n [\u003cffffffff816765f6\u003e] ip6_push_pending_frames+0x1f6/0x4d0\n [\u003cffffffff810b756b\u003e] ? mark_held_locks+0xbb/0x140\n [\u003cffffffff81694919\u003e] udp_v6_push_pending_frames+0x2b9/0x3d0\n [\u003cffffffff81694660\u003e] ? udplite_getfrag+0x20/0x20\n [\u003cffffffff8162092a\u003e] udp_lib_setsockopt+0x1aa/0x1f0\n [\u003cffffffff811cc5e7\u003e] ? fget_light+0x387/0x4f0\n [\u003cffffffff816958a4\u003e] udpv6_setsockopt+0x34/0x40\n [\u003cffffffff815949f4\u003e] sock_common_setsockopt+0x14/0x20\n [\u003cffffffff81593c31\u003e] SyS_setsockopt+0x71/0xd0\n [\u003cffffffff816f5d54\u003e] tracesys+0xdd/0xe2\nCode: 00 00 48 89 44 24 10 8b 87 d8 00 00 00 48 89 44 24 08 48 8b 87 e8 00 00 00 48 c7 c7 c0 04 aa 81 48 89 04 24 31 c0 e8 e1 7e ff ff \u003c0f\u003e 0b 55 48 89 e5 0f 0b 55 48 89 e5 0f 0b 55 48 89 e5 0f 0b 55\nRIP [\u003cffffffff816e759c\u003e] skb_panic+0x63/0x65\n RSP \u003cffff8801e6431de8\u003e\n\nThis patch adds a check if the pending data is of address family AF_INET\nand directly calls udp_push_ending_frames from udp_v6_push_pending_frames\nif that is the case.\n\nThis bug was found by Dave Jones with trinity.\n\n(Also move the initialization of fl6 below the AF_INET check, even if\nnot strictly necessary.)\n\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nCc: Dave Jones \u003cdavej@redhat.com\u003e\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3ef208a71f18b128e318294af3f7ee8081fe0ac1", "tree": "7c6094a3e8003f9532b6e935121bb36a3dc98a2f", "parents": [ "d11ff32e52d86dfc6d3f100653ad88b83b6ead0e" ], "author": { "name": "Amerigo Wang", "email": "amwang@redhat.com", "time": "Sat Jun 29 21:30:49 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:26:02 2013 -0700" }, "message": "ipv6,mcast: always hold idev-\u003elock before mca_lock\n\n[ Upstream commit 8965779d2c0e6ab246c82a405236b1fb2adae6b2, with\n some bits from commit b7b1bfce0bb68bd8f6e62a28295922785cc63781\n (\"ipv6: split duplicate address detection and router solicitation timer\")\n to get the __ipv6_get_lladdr() used by this patch. ]\n\ndingtianhong reported the following deadlock detected by lockdep:\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ INFO: possible circular locking dependency detected ]\n 3.4.24.05-0.1-default #1 Not tainted\n -------------------------------------------------------\n ksoftirqd/0/3 is trying to acquire lock:\n (\u0026ndev-\u003elock){+.+...}, at: [\u003cffffffff8147f804\u003e] ipv6_get_lladdr+0x74/0x120\n\n but task is already holding lock:\n (\u0026mc-\u003emca_lock){+.+...}, at: [\u003cffffffff8149d130\u003e] mld_send_report+0x40/0x150\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -\u003e #1 (\u0026mc-\u003emca_lock){+.+...}:\n [\u003cffffffff810a8027\u003e] validate_chain+0x637/0x730\n [\u003cffffffff810a8417\u003e] __lock_acquire+0x2f7/0x500\n [\u003cffffffff810a8734\u003e] lock_acquire+0x114/0x150\n [\u003cffffffff814f691a\u003e] rt_spin_lock+0x4a/0x60\n [\u003cffffffff8149e4bb\u003e] igmp6_group_added+0x3b/0x120\n [\u003cffffffff8149e5d8\u003e] ipv6_mc_up+0x38/0x60\n [\u003cffffffff81480a4d\u003e] ipv6_find_idev+0x3d/0x80\n [\u003cffffffff81483175\u003e] addrconf_notify+0x3d5/0x4b0\n [\u003cffffffff814fae3f\u003e] notifier_call_chain+0x3f/0x80\n [\u003cffffffff81073471\u003e] raw_notifier_call_chain+0x11/0x20\n [\u003cffffffff813d8722\u003e] call_netdevice_notifiers+0x32/0x60\n [\u003cffffffff813d92d4\u003e] __dev_notify_flags+0x34/0x80\n [\u003cffffffff813d9360\u003e] dev_change_flags+0x40/0x70\n [\u003cffffffff813ea627\u003e] do_setlink+0x237/0x8a0\n [\u003cffffffff813ebb6c\u003e] rtnl_newlink+0x3ec/0x600\n [\u003cffffffff813eb4d0\u003e] rtnetlink_rcv_msg+0x160/0x310\n [\u003cffffffff814040b9\u003e] netlink_rcv_skb+0x89/0xb0\n [\u003cffffffff813eb357\u003e] rtnetlink_rcv+0x27/0x40\n [\u003cffffffff81403e20\u003e] netlink_unicast+0x140/0x180\n [\u003cffffffff81404a9e\u003e] netlink_sendmsg+0x33e/0x380\n [\u003cffffffff813c4252\u003e] sock_sendmsg+0x112/0x130\n [\u003cffffffff813c537e\u003e] __sys_sendmsg+0x44e/0x460\n [\u003cffffffff813c5544\u003e] sys_sendmsg+0x44/0x70\n [\u003cffffffff814feab9\u003e] system_call_fastpath+0x16/0x1b\n\n -\u003e #0 (\u0026ndev-\u003elock){+.+...}:\n [\u003cffffffff810a798e\u003e] check_prev_add+0x3de/0x440\n [\u003cffffffff810a8027\u003e] validate_chain+0x637/0x730\n [\u003cffffffff810a8417\u003e] __lock_acquire+0x2f7/0x500\n [\u003cffffffff810a8734\u003e] lock_acquire+0x114/0x150\n [\u003cffffffff814f6c82\u003e] rt_read_lock+0x42/0x60\n [\u003cffffffff8147f804\u003e] ipv6_get_lladdr+0x74/0x120\n [\u003cffffffff8149b036\u003e] mld_newpack+0xb6/0x160\n [\u003cffffffff8149b18b\u003e] add_grhead+0xab/0xc0\n [\u003cffffffff8149d03b\u003e] add_grec+0x3ab/0x460\n [\u003cffffffff8149d14a\u003e] mld_send_report+0x5a/0x150\n [\u003cffffffff8149f99e\u003e] igmp6_timer_handler+0x4e/0xb0\n [\u003cffffffff8105705a\u003e] call_timer_fn+0xca/0x1d0\n [\u003cffffffff81057b9f\u003e] run_timer_softirq+0x1df/0x2e0\n [\u003cffffffff8104e8c7\u003e] handle_pending_softirqs+0xf7/0x1f0\n [\u003cffffffff8104ea3b\u003e] __do_softirq_common+0x7b/0xf0\n [\u003cffffffff8104f07f\u003e] __thread_do_softirq+0x1af/0x210\n [\u003cffffffff8104f1c1\u003e] run_ksoftirqd+0xe1/0x1f0\n [\u003cffffffff8106c7de\u003e] kthread+0xae/0xc0\n [\u003cffffffff814fff74\u003e] kernel_thread_helper+0x4/0x10\n\nactually we can just hold idev-\u003elock before taking pmc-\u003emca_lock,\nand avoid taking idev-\u003elock again when iterating idev-\u003eaddr_list,\nsince the upper callers of mld_newpack() already take\nread_lock_bh(\u0026idev-\u003elock).\n\nReported-by: dingtianhong \u003cdingtianhong@huawei.com\u003e\nCc: dingtianhong \u003cdingtianhong@huawei.com\u003e\nCc: Hideaki YOSHIFUJI \u003cyoshfuji@linux-ipv6.org\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nTested-by: Ding Tianhong \u003cdingtianhong@huawei.com\u003e\nTested-by: Chen Weilong \u003cchenweilong@huawei.com\u003e\nSigned-off-by: Cong Wang \u003camwang@redhat.com\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b57037f726d4e8acfb63f333282a1e49a9f09ca3", "tree": "5ad08fd59290dbe119147758f23a365f4e1fe7b5", "parents": [ "2b01eeeaa363dc4cd5e6d9efd962ac55cc3d5d48" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Jun 26 04:15:07 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:25:56 2013 -0700" }, "message": "ipv6: ip6_sk_dst_check() must not assume ipv6 dst\n\n[ Upstream commit a963a37d384d71ad43b3e9e79d68d42fbe0901f3 ]\n\nIt\u0027s possible to use AF_INET6 sockets and to connect to an IPv4\ndestination. After this, socket dst cache is a pointer to a rtable,\nnot rt6_info.\n\nip6_sk_dst_check() should check the socket dst cache is IPv6, or else\nvarious corruptions/crashes can happen.\n\nDave Jones can reproduce immediate crash with\ntrinity -q -l off -n -c sendmsg -c connect\n\nWith help from Hannes Frederic Sowa\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nReported-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "dabed30c3f3af3afd343ad33e3fa0b741ffdebb3", "tree": "0113bf4e85da58c76105f130e33c17223c947166", "parents": [ "251d33ece34f261875830e0dfd52e53a10ac13dc" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Sun Jun 16 11:14:30 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:25:56 2013 -0700" }, "message": "ipv6: don\u0027t call addrconf_dst_alloc again when enable lo\n\n[ Upstream commit a881ae1f625c599b460cc8f8a7fcb1c438f699ad ]\n\nIf we disable all of the net interfaces, and enable\nun-lo interface before lo interface, we already allocated\nthe addrconf dst in ipv6_add_addr. So we shouldn\u0027t allocate\nit again when we enable lo interface.\n\nOtherwise the message below will be triggered.\nunregister_netdevice: waiting for sit1 to become free. Usage count \u003d 1\n\nThis problem is introduced by commit 25fb6ca4ed9cad72f14f61629b68dc03c0d9713f\n\"net IPv6 : Fix broken IPv6 routing table after loopback down-up\"\n\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f50301548260580f6d7c074a8d0aa2f15862b9d6", "tree": "cfd6c71d969d1fb671995986a47c4096fc47a364", "parents": [ "1c9ce1e6c11777c95b974883be2f0313873d6f14", "a0b5b9b636fffbf6cc3af3460c13cb1b0fc1835e" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sun Jul 28 02:55:29 2013 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sun Jul 28 02:55:29 2013 -0700" }, "message": "Merge remote-tracking branch \u0027codeaurora/jb_2.6\u0027 into cm-10.2\n\nConflicts:\n\tdrivers/gpu/msm/adreno.c\n\tdrivers/gpu/msm/adreno.h\n\tdrivers/gpu/msm/adreno_a3xx.c\n\tdrivers/gpu/msm/kgsl.c\n\tdrivers/input/touchscreen/synaptics_fw_update.c\n\tdrivers/input/touchscreen/synaptics_i2c_rmi4.c\n\tdrivers/media/video/msm/gemini/msm_gemini_hw.c\n\tdrivers/media/video/msm/gemini/msm_gemini_hw.h\n\tdrivers/media/video/msm/gemini/msm_gemini_sync.c\n\tdrivers/media/video/msm/jpeg_10/msm_jpeg_hw.c\n\tdrivers/media/video/msm/jpeg_10/msm_jpeg_hw.h\n\tdrivers/media/video/msm/jpeg_10/msm_jpeg_sync.c\n\tdrivers/media/video/msm/mercury/msm_mercury_hw.c\n\tdrivers/media/video/msm/mercury/msm_mercury_hw.h\n\tdrivers/media/video/msm/mercury/msm_mercury_sync.c\n\tdrivers/media/video/msm/msm.c\n\tdrivers/media/video/msm/msm.h\n\tdrivers/media/video/msm/msm_mctl.c\n\tdrivers/media/video/msm/msm_mctl_buf.c\n\tdrivers/media/video/msm/msm_vfe32.h\n\tdrivers/media/video/msm/msm_vpe.c\n\tdrivers/media/video/msm/sensors/msm_sensor.c\n\tdrivers/media/video/msm/sensors/ov8825_v4l2.c\n\tdrivers/media/video/msm/sensors/ov9724_v4l2.c\n\tdrivers/media/video/msm/server/msm_cam_server.c\n\tdrivers/media/video/msm/vfe/msm_vfe32.c\n\tdrivers/media/video/msm/vfe/msm_vfe_stats_buf.c\n\tdrivers/tty/serial/msm_serial_hs.c\n\tdrivers/video/msm/hdmi_msm.c\n\tdrivers/video/msm/vidc/common/enc/venc.c\n\tinclude/linux/msm_vidc_enc.h\n\tinclude/linux/nl80211.h\n\tinclude/media/msm/vcd_property.h\n\tinclude/media/msm_camera.h\n\nChange-Id: I153f2e550f038e419bf43fd05892193853ae078e\n" }, { "commit": "2f4997c908d217048a3136224c6bb83afbcb8a1e", "tree": "cbf394a8701829d7d12af4f8029aad1d7da55e5f", "parents": [ "689ec1227270c5b3f009b82fb32d902717a0a03e" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Sun Jun 02 22:16:21 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 27 11:27:32 2013 -0700" }, "message": "ipv6: assign rt6_info to inet6_ifaddr in init_loopback\n\n[ Upstream commit 534c877928a16ae5f9776436a497109639bf67dc ]\n\nCommit 25fb6ca4ed9cad72f14f61629b68dc03c0d9713f\n\"net IPv6 : Fix broken IPv6 routing table after loopback down-up\"\nforgot to assign rt6_info to the inet6_ifaddr.\nWhen disable the net device, the rt6_info which allocated\nin init_loopback will not be destroied in __ipv6_ifa_notify.\n\nThis will trigger the waring message below\n[23527.916091] unregister_netdevice: waiting for tap0 to become free. Usage count \u003d 1\n\nReported-by: Arkadiusz Miskiewicz \u003ca.miskiewicz@gmail.com\u003e\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "32d704a1a1d8c0fc6552c269a911a03621065cd9", "tree": "68fde5a96f1703df5985acf047a989de21b8e324", "parents": [ "c76631940b5c893dbca8b504b1cbb5b970267dc8" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri May 17 04:53:13 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 27 11:27:31 2013 -0700" }, "message": "ipv6: fix possible crashes in ip6_cork_release()\n\n[ Upstream commit 284041ef21fdf2e0d216ab6b787bc9072b4eb58a ]\n\ncommit 0178b695fd6b4 (\"ipv6: Copy cork options in ip6_append_data\")\nadded some code duplication and bad error recovery, leading to potential\ncrash in ip6_cork_release() as kfree() could be called with garbage.\n\nuse kzalloc() to make sure this wont happen.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nCc: Hideaki YOSHIFUJI \u003cyoshfuji@linux-ipv6.org\u003e\nCc: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8b2414d4e80786254c84d7ae7826750b38e4b150", "tree": "88c0c904c6497464d2ffdb227a05d952c54a95c9", "parents": [ "47264b29620c1bd0aea291ac1bb93e3e956b41a6" ], "author": { "name": "Harout Hedeshian", "email": "harouth@codeaurora.org", "time": "Fri Dec 21 12:38:38 2012 -0800" }, "committer": { "name": "Harout Hedeshian", "email": "harouth@codeaurora.org", "time": "Mon Jun 24 10:08:26 2013 -0600" }, "message": "net/ipv6/addrconf: IPv6 tethering enhancement\n\nAdded new procfs flag to toggle the automatic addition of prefix\nroutes on a per device basis. The new flag is accept_ra_prefix_route.\nDefaults to 1 as to not break existing behavior.\n\nChange-Id: If25493890c7531c27f5b2c4855afebbbbf5d072a\nCRs-Fixed: 504095\nSigned-off-by: Harout Hedeshian \u003charouth@codeaurora.org\u003e\n" }, { "commit": "dde448d95d8698ee4c8373bb48fe08a22f41052f", "tree": "7fe87fa93bfa5b81e6f87b147e32512d2e8198e3", "parents": [ "ac4f6190fae02a3dc30133f90488b996f726bf7a", "f95b978981a7d154ba40d14c18e8ed5c694e6124" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Thu Jun 20 11:32:42 2013 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Thu Jun 20 11:32:42 2013 -0700" }, "message": "Merge tag \u0027v3.4.10\u0027 into cm-10.1\n\nThis is the 3.4.10 stable release\n\nConflicts:\n\tarch/arm/mm/tlb-v7.S\n\tarch/arm/vfp/entry.S\n\tdrivers/base/power/main.c\n\tdrivers/mmc/host/sdhci.c\n\tdrivers/net/tun.c\n\tdrivers/usb/core/hub.c\n\tdrivers/usb/host/xhci.h\n\tinclude/linux/sched.h\n\tkernel/power/suspend.c\n\nChange-Id: Ia2477ec93ceb64b13dd1a2d8aa646cb233387d14\n" }, { "commit": "a98124aac0b5adc5de8ae54f11322781cb4d85c3", "tree": "2c1d384e0d52e1c1a783d74bde6b93960d06f525", "parents": [ "7d9577d0b2d7958c821236064d995a995e1c4256" ], "author": { "name": "Cong Wang", "email": "amwang@redhat.com", "time": "Thu May 09 22:40:00 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:47 2013 -0700" }, "message": "xfrm6: release dev before returning error\n\n[ Upstream commit 84c4a9dfbf430861e7588d95ae3ff61535dca351 ]\n\nWe forget to call dev_put() on error path in xfrm6_fill_dst(),\nits caller doesn\u0027t handle this.\n\nSigned-off-by: Cong Wang \u003camwang@redhat.com\u003e\nCc: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7d9577d0b2d7958c821236064d995a995e1c4256", "tree": "a69a1229b1f5c8fc15e9ae683ad665ec16e17eb8", "parents": [ "f2f17ef7c7a9ac2a9ed1160c768c67d2cf86b8d5" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu May 09 10:28:16 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:47 2013 -0700" }, "message": "ipv6: do not clear pinet6 field\n\n[ Upstream commit f77d602124d865c38705df7fa25c03de9c284ad2 ]\n\nWe have seen multiple NULL dereferences in __inet6_lookup_established()\n\nAfter analysis, I found that inet6_sk() could be NULL while the\ncheck for sk_family \u003d\u003d AF_INET6 was true.\n\nBug was added in linux-2.6.29 when RCU lookups were introduced in UDP\nand TCP stacks.\n\nOnce an IPv6 socket, using SLAB_DESTROY_BY_RCU is inserted in a hash\ntable, we no longer can clear pinet6 field.\n\nThis patch extends logic used in commit fcbdf09d9652c891\n(\"net: fix nulls list corruptions in sk_prot_alloc\")\n\nTCP/UDP/UDPLite IPv6 protocols provide their own .clear_sk() method\nto make sure we do not clear pinet6 field.\n\nAt socket clone phase, we do not really care, as cloning the parent (non\nNULL) pinet6 is not adding a fatal race.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1d0dd1db15bc5dedc25bcdebf3dd382436f11f8a", "tree": "f796d4236a52fcf8993652594578d5a5f6b8dc4e", "parents": [ "ca4bf7c6970aee586c4b6b642e011e3847ac5f93" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Apr 16 12:55:41 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:20 2013 -0700" }, "message": "net: drop dst before queueing fragments\n\n[ Upstream commit 97599dc792b45b1669c3cdb9a4b365aad0232f65 ]\n\nCommit 4a94445c9a5c (net: Use ip_route_input_noref() in input path)\nadded a bug in IP defragmentation handling, as non refcounted\ndst could escape an RCU protected section.\n\nCommit 64f3b9e203bd068 (net: ip_expire() must revalidate route) fixed\nthe case of timeouts, but not the general problem.\n\nTom Parkin noticed crashes in UDP stack and provided a patch,\nbut further analysis permitted us to pinpoint the root cause.\n\nBefore queueing a packet into a frag list, we must drop its dst,\nas this dst has limited lifetime (RCU protected)\n\nWhen/if a packet is finally reassembled, we use the dst of the very\nlast skb, still protected by RCU and valid, as the dst of the\nreassembled packet.\n\nUse same logic in IPv6, as there is no need to hold dst references.\n\nReported-by: Tom Parkin \u003ctparkin@katalix.com\u003e\nTested-by: Tom Parkin \u003ctparkin@katalix.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ef95e3d5d7325b87ca22c4aa72710ac152315559", "tree": "4dbcc03fae31b3c7bd1ecd1b16162514671934b4", "parents": [ "815b1018620edb2f86fc7a7740b9a0e726446929" ], "author": { "name": "Balakumaran Kannan", "email": "kumaran.4353@gmail.com", "time": "Tue Apr 02 16:15:05 2013 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:06 2013 -0700" }, "message": "net IPv6 : Fix broken IPv6 routing table after loopback down-up\n\n[ Upstream commit 25fb6ca4ed9cad72f14f61629b68dc03c0d9713f ]\n\nIPv6 Routing table becomes broken once we do ifdown, ifup of the loopback(lo)\ninterface. After down-up, routes of other interface\u0027s IPv6 addresses through\n\u0027lo\u0027 are lost.\n\nIPv6 addresses assigned to all interfaces are routed through \u0027lo\u0027 for internal\ncommunication. Once \u0027lo\u0027 is down, those routing entries are removed from routing\ntable. But those removed entries are not being re-created properly when \u0027lo\u0027 is\nbrought up. So IPv6 addresses of other interfaces becomes unreachable from the\nsame machine. Also this breaks communication with other machines because of\nNDISC packet processing failure.\n\nThis patch fixes this issue by reading all interface\u0027s IPv6 addresses and adding\nthem to IPv6 routing table while bringing up \u0027lo\u0027.\n\n\u003d\u003dTesting\u003d\u003d\nBefore applying the patch:\n$ route -A inet6\nKernel IPv6 routing table\nDestination Next Hop Flag Met Ref Use If\n2000::20/128 :: U 256 0 0 eth0\nfe80::/64 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n::1/128 :: Un 0 1 0 lo\n2000::20/128 :: Un 0 1 0 lo\nfe80::xxxx:xxxx:xxxx:xxxx/128 :: Un 0 1 0 lo\nff00::/8 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n$ sudo ifdown lo\n$ sudo ifup lo\n$ route -A inet6\nKernel IPv6 routing table\nDestination Next Hop Flag Met Ref Use If\n2000::20/128 :: U 256 0 0 eth0\nfe80::/64 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n::1/128 :: Un 0 1 0 lo\nff00::/8 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n$\n\nAfter applying the patch:\n$ route -A inet6\nKernel IPv6 routing\ntable\nDestination Next Hop Flag Met Ref Use If\n2000::20/128 :: U 256 0 0 eth0\nfe80::/64 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n::1/128 :: Un 0 1 0 lo\n2000::20/128 :: Un 0 1 0 lo\nfe80::xxxx:xxxx:xxxx:xxxx/128 :: Un 0 1 0 lo\nff00::/8 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n$ sudo ifdown lo\n$ sudo ifup lo\n$ route -A inet6\nKernel IPv6 routing table\nDestination Next Hop Flag Met Ref Use If\n2000::20/128 :: U 256 0 0 eth0\nfe80::/64 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n::1/128 :: Un 0 1 0 lo\n2000::20/128 :: Un 0 1 0 lo\nfe80::xxxx:xxxx:xxxx:xxxx/128 :: Un 0 1 0 lo\nff00::/8 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n$\n\nSigned-off-by: Balakumaran Kannan \u003cBalakumaran.Kannan@ap.sony.com\u003e\nSigned-off-by: Maruthi Thotad \u003cMaruthi.Thotad@ap.sony.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "567a4ac4b7d48e186a28168e40388503d5b7eb01", "tree": "baa45bfd1c88169339885d48e00f461a5d7e889c", "parents": [ "6a519979f9787fc326fd58dce983dda1cdf215dc" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Tue Mar 26 08:13:34 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:41 2013 -0700" }, "message": "ipv6: don\u0027t accept node local multicast traffic from the wire\n\n[ Upstream commit 1c4a154e5253687c51123956dfcee9e9dfa8542d ]\n\nErik Hugne\u0027s errata proposal (Errata ID: 3480) to RFC4291 has been\nverified: http://www.rfc-editor.org/errata_search.php?eid\u003d3480\n\nWe have to check for pkt_type and loopback flag because either the\npackets are allowed to travel over the loopback interface (in which case\npkt_type is PACKET_HOST and IFF_LOOPBACK flag is set) or they travel\nover a non-loopback interface back to us (in which case PACKET_TYPE is\nPACKET_LOOPBACK and IFF_LOOPBACK flag is not set).\n\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nCc: Erik Hugne \u003cerik.hugne@ericsson.com\u003e\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6a519979f9787fc326fd58dce983dda1cdf215dc", "tree": "f1171348f431d53b7c44d210382e7a916fe3160f", "parents": [ "df19106f4574ba16d8575bbc206573f53cf1f4a9" ], "author": { "name": "Hong Zhiguo", "email": "honkiko@gmail.com", "time": "Tue Mar 26 01:52:45 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:41 2013 -0700" }, "message": "ipv6: fix bad free of addrconf_init_net\n\n[ Upstream commit a79ca223e029aa4f09abb337accf1812c900a800 ]\n\nSigned-off-by: Hong Zhiguo \u003chonkiko@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "df19106f4574ba16d8575bbc206573f53cf1f4a9", "tree": "2db506e318413dbda1d31a3c161631bbe2c0a93a", "parents": [ "ccb926f51c4e5e4b79e5023c0c0735482ce18757" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Sun Feb 10 05:35:22 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:41 2013 -0700" }, "message": "ipv6: don\u0027t accept multicast traffic with scope 0\n\n[ Upstream commit 20314092c1b41894d8c181bf9aa6f022be2416aa ]\n\nv2:\na) moved before multicast source address check\nb) changed comment to netdev style\n\nAcked-by: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nCc: Erik Hugne \u003cerik.hugne@ericsson.com\u003e\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nAcked-by: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1280938465132080915aef414a1f40f62831bab9", "tree": "a2055fce3874fea9ddec94d17658e7d3ec18dc66", "parents": [ "05bec9da3978124bde3b40bfa0404760f45aa399" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Fri Mar 15 11:32:30 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:11:54 2013 -0700" }, "message": "inet: limit length of fragment queue hash table bucket lists\n\n[ Upstream commit 5a3da1fe9561828d0ca7eca664b16ec2b9bf0055 ]\n\nThis patch introduces a constant limit of the fragment queue hash\ntable bucket list lengths. Currently the limit 128 is choosen somewhat\narbitrary and just ensures that we can fill up the fragment cache with\nempty packets up to the default ip_frag_high_thresh limits. It should\njust protect from list iteration eating considerable amounts of cpu.\n\nIf we reach the maximum length in one hash bucket a warning is printed.\nThis is implemented on the caller side of inet_frag_find to distinguish\nbetween the different users of inet_fragment.c.\n\nI dropped the out of memory warning in the ipv4 fragment lookup path,\nbecause we already get a warning by the slab allocator.\n\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: Jesper Dangaard Brouer \u003cjbrouer@redhat.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "47d7ed18c33cc4e9cba603c7ca776c40037ae842", "tree": "9e4ffec7197c072c6d371e28f9b5138de627fd01", "parents": [ "c7a226b6464bfdc67433adcfe9e17b816157af98" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Fri Mar 08 02:07:23 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 20 13:05:02 2013 -0700" }, "message": "ipv6: stop multicast forwarding to process interface scoped addresses\n\n[ Upstream commit ddf64354af4a702ee0b85d0a285ba74c7278a460 ]\n\nv2:\na) used struct ipv6_addr_props\n\nv3:\na) reverted changes for ipv6_addr_props\n\nv4:\na) do not use __ipv6_addr_needs_scope_id\n\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nAcked-by: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6202fe4eec7b98b7391865c8aebe513bc1f14009", "tree": "d22e072024d814324cde88bc96d03e2274bf33b1", "parents": [ "2b2066c41aba3032831ff5402bbd3b68ff5b9d47" ], "author": { "name": "Lorenzo Colitti", "email": "lorenzo@google.com", "time": "Sun Mar 03 20:46:46 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 20 13:05:01 2013 -0700" }, "message": "net: ipv6: Don\u0027t purge default router if accept_ra\u003d2\n\n[ Upstream commit 3e8b0ac3e41e3c882222a5522d5df7212438ab51 ]\n\nSetting net.ipv6.conf.\u003cinterface\u003e.accept_ra\u003d2 causes the kernel\nto accept RAs even when forwarding is enabled. However, enabling\nforwarding purges all default routes on the system, breaking\nconnectivity until the next RA is received. Fix this by not\npurging default routes on interfaces that have accept_ra\u003d2.\n\nSigned-off-by: Lorenzo Colitti \u003clorenzo@google.com\u003e\nAcked-by: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "909978d73590b07c3a050a569cc3bd44b1f9355c", "tree": "f62315f8be65677c9421c5e68d9f6000098a0a3e", "parents": [ "6c1128b87d5814de27f8ddc445783a81914b194f" ], "author": { "name": "Marcelo Ricardo Leitner", "email": "mleitner@redhat.com", "time": "Tue Jan 29 22:26:08 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 14 10:49:05 2013 -0800" }, "message": "ipv6: do not create neighbor entries for local delivery\n\n[ Upstream commit bd30e947207e2ea0ff2c08f5b4a03025ddce48d3 ]\n\nThey will be created at output, if ever needed. This avoids creating\nempty neighbor entries when TPROXYing/Forwarding packets for addresses\nthat are not even directly reachable.\n\nNote that IPv4 already handles it this way. No neighbor entries are\ncreated for local input.\n\nTested by myself and customer.\n\nSigned-off-by: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Marcelo Ricardo Leitner \u003cmleitner@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "07da6b22a219ba7907ad41118f0e77f4b8fae9a9", "tree": "6369b3eefe623706dba649d01051a2343c47e40c", "parents": [ "6320f430b95a00ef958d7e98655823bfb3c1b918" ], "author": { "name": "Romain KUNTZ", "email": "r.kuntz@ipflavors.com", "time": "Wed Jan 16 12:47:40 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 14 10:48:54 2013 -0800" }, "message": "ipv6: fix header length calculation in ip6_append_data()\n\n[ Upstream commit 7efdba5bd9a2f3e2059beeb45c9fa55eefe1bced ]\n\nCommit 299b0767 (ipv6: Fix IPsec slowpath fragmentation problem)\nhas introduced a error in the header length calculation that\nprovokes corrupted packets when non-fragmentable extensions\nheaders (Destination Option or Routing Header Type 2) are used.\n\nrt-\u003ert6i_nfheader_len is the length of the non-fragmentable\nextension header, and it should be substracted to\nrt-\u003edst.header_len, and not to exthdrlen, as it was done before\ncommit 299b0767.\n\nThis patch reverts to the original and correct behavior. It has\nbeen successfully tested with and without IPsec on packets\nthat include non-fragmentable extensions headers.\n\nSigned-off-by: Romain Kuntz \u003cr.kuntz@ipflavors.com\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3b69055b43c57783a8bf99a8e40f773580e451a1", "tree": "acf7a6f31138e0642b1233c56dcd43c9112d777c", "parents": [ "0ad715758022062a34bccede6200803e26480c97" ], "author": { "name": "Romain Kuntz", "email": "r.kuntz@ipflavors.com", "time": "Wed Jan 09 15:02:26 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 14 10:48:54 2013 -0800" }, "message": "ipv6: fix the noflags test in addrconf_get_prefix_route\n\n[ Upstream commit 85da53bf1c336bb07ac038fb951403ab0478d2c5 ]\n\nThe tests on the flags in addrconf_get_prefix_route() does no make\nmuch sense: the \u0027noflags\u0027 parameter contains the set of flags that\nmust not match with the route flags, so the test must be done\nagainst \u0027noflags\u0027, and not against \u0027flags\u0027.\n\nSigned-off-by: Romain Kuntz \u003cr.kuntz@ipflavors.com\u003e\nAcked-by: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d46699a94ddf2dd4d83e986a759b64981b37fc5b", "tree": "c2de686ba7429ce5ac341c97ccdf673374c3f1be", "parents": [ "6eec2413cb320bdd0139ba0db3888d27f746ea2b" ], "author": { "name": "Christoph Paasch", "email": "christoph.paasch@uclouvain.be", "time": "Fri Dec 14 04:07:58 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:07:14 2013 -0800" }, "message": "inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock\n\n[ Upstream commit e337e24d6624e74a558aa69071e112a65f7b5758 ]\n\nIf in either of the above functions inet_csk_route_child_sock() or\n__inet_inherit_port() fails, the newsk will not be freed:\n\nunreferenced object 0xffff88022e8a92c0 (size 1592):\n comm \"softirq\", pid 0, jiffies 4294946244 (age 726.160s)\n hex dump (first 32 bytes):\n 0a 01 01 01 0a 01 01 02 00 00 00 00 a7 cc 16 00 ................\n 02 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [\u003cffffffff8153d190\u003e] kmemleak_alloc+0x21/0x3e\n [\u003cffffffff810ab3e7\u003e] kmem_cache_alloc+0xb5/0xc5\n [\u003cffffffff8149b65b\u003e] sk_prot_alloc.isra.53+0x2b/0xcd\n [\u003cffffffff8149b784\u003e] sk_clone_lock+0x16/0x21e\n [\u003cffffffff814d711a\u003e] inet_csk_clone_lock+0x10/0x7b\n [\u003cffffffff814ebbc3\u003e] tcp_create_openreq_child+0x21/0x481\n [\u003cffffffff814e8fa5\u003e] tcp_v4_syn_recv_sock+0x3a/0x23b\n [\u003cffffffff814ec5ba\u003e] tcp_check_req+0x29f/0x416\n [\u003cffffffff814e8e10\u003e] tcp_v4_do_rcv+0x161/0x2bc\n [\u003cffffffff814eb917\u003e] tcp_v4_rcv+0x6c9/0x701\n [\u003cffffffff814cea9f\u003e] ip_local_deliver_finish+0x70/0xc4\n [\u003cffffffff814cec20\u003e] ip_local_deliver+0x4e/0x7f\n [\u003cffffffff814ce9f8\u003e] ip_rcv_finish+0x1fc/0x233\n [\u003cffffffff814cee68\u003e] ip_rcv+0x217/0x267\n [\u003cffffffff814a7bbe\u003e] __netif_receive_skb+0x49e/0x553\n [\u003cffffffff814a7cc3\u003e] netif_receive_skb+0x50/0x82\n\nThis happens, because sk_clone_lock initializes sk_refcnt to 2, and thus\na single sock_put() is not enough to free the memory. Additionally, things\nlike xfrm, memcg, cookie_values,... may have been initialized.\nWe have to free them properly.\n\nThis is fixed by forcing a call to tcp_done(), ending up in\ninet_csk_destroy_sock, doing the final sock_put(). tcp_done() is necessary,\nbecause it ends up doing all the cleanup on xfrm, memcg, cookie_values,\nxfrm,...\n\nBefore calling tcp_done, we have to set the socket to SOCK_DEAD, to\nforce it entering inet_csk_destroy_sock. To avoid the warning in\ninet_csk_destroy_sock, inet_num has to be set to 0.\nAs inet_csk_destroy_sock does a dec on orphan_count, we first have to\nincrease it.\n\nCalling tcp_done() allows us to remove the calls to\ntcp_clear_xmit_timer() and tcp_cleanup_congestion_control().\n\nA similar approach is taken for dccp by calling dccp_done().\n\nThis is in the kernel since 093d282321 (tproxy: fix hash locking issue\nwhen using port redirection in __inet_inherit_port()), thus since\nversion \u003e\u003d 2.6.37.\n\nSigned-off-by: Christoph Paasch \u003cchristoph.paasch@uclouvain.be\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "798f49e632f38abcb51dea6014b078798c1cc6ee", "tree": "cb22e091d573ec0d4667e1be49837e9af61eb33d", "parents": [ "0fa89335e494872552e8e1d4e594c18559922e5c" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Sat Nov 10 19:52:34 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:37:46 2012 -0800" }, "message": "ipv6: setsockopt(IPIPPROTO_IPV6, IPV6_MINHOPCOUNT) forgot to set return value\n\n[ Upstream commit d4596bad2a713fcd0def492b1960e6d899d5baa8 ]\n\nCc: Stephen Hemminger \u003cshemminger@vyatta.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f0d6767af2ece14b24064258dffbc816c4258ae5", "tree": "2850cd98108a6b163b0b9dfc6dcd08e1c1d0d980", "parents": [ "0f2835b0b762391fb8e1d1da3bdb8f1d90a5d53e" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Tue Nov 06 16:18:41 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:21 2012 -0800" }, "message": "ipv6: send unsolicited neighbour advertisements to all-nodes\n\n[ Upstream commit 60713a0ca7fd6651b951cc1b4dbd528d1fc0281b ]\n\nAs documented in RFC4861 (Neighbor Discovery for IP version 6) 7.2.6.,\nunsolicited neighbour advertisements should be sent to the all-nodes\nmulticast address.\n\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d707b52912bfa83176b75efd40da193c18eef1e0", "tree": "e6fc5658b3c3da82e770230b1fdca21075405b05", "parents": [ "d1a94e022b36342cbdb156a9693bca95aab11ca4" ], "author": { "name": "Li RongQing", "email": "roy.qing.li@gmail.com", "time": "Wed Oct 24 14:01:18 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:15 2012 -0800" }, "message": "ipv6: Set default hoplimit as zero.\n\n[ Upstream commit 14edd87dc67311556f1254a8f29cf4dd6cb5b7d1 ]\n\nCommit a02e4b7dae4551(Demark default hoplimit as zero) only changes the\nhoplimit checking condition and default value in ip6_dst_hoplimit, not\nzeros all hoplimit default value.\n\nKeep the zeroing ip6_template_metrics[RTAX_HOPLIMIT - 1] to force it as\nconst, cause as a37e6e344910(net: force dst_default_metrics to const\nsection)\n\nSigned-off-by: Li RongQing \u003croy.qing.li@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "dd2c50efa9941fe7393b5f490eeef68f18916211", "tree": "44296428b9215d6b77b51bd7e3441edcb5873358", "parents": [ "259c5a7fd824ebca122f04fc4202b88896f31d26" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Oct 16 07:37:27 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:16 2012 -0700" }, "message": "ipv6: addrconf: fix /proc/net/if_inet6\n\n[ Upstream commit 9f0d3c2781baa1102108e16efbe640dd74564a7c ]\n\nCommit 1d5783030a1 (ipv6/addrconf: speedup /proc/net/if_inet6 filling)\nadded bugs hiding some devices from if_inet6 and breaking applications.\n\n\"ip -6 addr\" could still display all IPv6 addresses, while \"ifconfig -a\"\ncouldnt.\n\nOne way to reproduce the bug is by starting in a shell :\n\nunshare -n /bin/bash\nifconfig lo up\n\nAnd in original net namespace, lo device disappeared from if_inet6\n\nReported-by: Jan Hinnerk Stosch \u003cjanhinnerk.stosch@gmail.com\u003e\nTested-by: Jan Hinnerk Stosch \u003cjanhinnerk.stosch@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Mihai Maruseac \u003cmihai.maruseac@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "259c5a7fd824ebca122f04fc4202b88896f31d26", "tree": "1bf6bb73cba3d865aa5964370c1ef47b50299d24", "parents": [ "04c592343f478826bf1e5d0d178bb295d848c428" ], "author": { "name": "Alexey Kuznetsov", "email": "kuznet@ms2.inr.ac.ru", "time": "Fri Oct 12 04:34:17 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:16 2012 -0700" }, "message": "tcp: resets are misrouted\n\n[ Upstream commit 4c67525849e0b7f4bd4fab2487ec9e43ea52ef29 ]\n\nAfter commit e2446eaa (\"tcp_v4_send_reset: binding oif to iif in no\nsock case\").. tcp resets are always lost, when routing is asymmetric.\nYes, backing out that patch will result in misrouting of resets for\ndead connections which used interface binding when were alive, but we\nactually cannot do anything here. What\u0027s died that\u0027s died and correct\nhandling normal unbound connections is obviously a priority.\n\nComment to comment:\n\u003e This has few benefits:\n\u003e 1. tcp_v6_send_reset already did that.\n\nIt was done to route resets for IPv6 link local addresses. It was a\nmistake to do so for global addresses. The patch fixes this as well.\n\nActually, the problem appears to be even more serious than guaranteed\nloss of resets. As reported by Sergey Soloviev \u003csol@eqv.ru\u003e, those\nmisrouted resets create a lot of arp traffic and huge amount of\nunresolved arp entires putting down to knees NAT firewalls which use\nasymmetric routing.\n\nSigned-off-by: Alexey Kuznetsov \u003ckuznet@ms2.inr.ac.ru\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "28ad5c792deb17e1274cef32c59049d2062ed1b3", "tree": "a1c8460712050ec8ea60cc01f436edede37e4df6", "parents": [ "7a20f9c5fa76e602bf9dda7f610c8de04e7afa04" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 25 22:01:28 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:45 2012 +0900" }, "message": "ipv6: mip6: fix mip6_mh_filter()\n\n[ Upstream commit 96af69ea2a83d292238bdba20e4508ee967cf8cb ]\n\nmip6_mh_filter() should not modify its input, or else its caller\nwould need to recompute ipv6_hdr() if skb-\u003ehead is reallocated.\n\nUse skb_header_pointer() instead of pskb_may_pull()\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7a20f9c5fa76e602bf9dda7f610c8de04e7afa04", "tree": "967afe1eab6dc306c17e826392a2ddafe94bd2a0", "parents": [ "514ddfedb89c19c57de82aedec8da2bd8ff3802c" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 25 07:03:40 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:45 2012 +0900" }, "message": "ipv6: raw: fix icmpv6_filter()\n\n[ Upstream commit 1b05c4b50edbddbdde715c4a7350629819f6655e ]\n\nicmpv6_filter() should not modify its input, or else its caller\nwould need to recompute ipv6_hdr() if skb-\u003ehead is reallocated.\n\nUse skb_header_pointer() instead of pskb_may_pull() and\nchange the prototype to make clear both sk and skb are const.\n\nAlso, if icmpv6 header cannot be found, do not deliver the packet,\nas we do in IPv4.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "410eafac650a906e990351a01ec70451064df83d", "tree": "9fc349433e6179e90b8234bd32c2ccca274b18ca", "parents": [ "d5e36b089edcc8179d4640e1a8e5bca6fb74409e" ], "author": { "name": "Wei Yongjun", "email": "yongjun_wei@trendmicro.com.cn", "time": "Thu Sep 20 18:29:56 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:43 2012 +0900" }, "message": "ipv6: fix return value check in fib6_add()\n\n[ Upstream commit f950c0ecc78f745e490d615280e031de4dbb1306 ]\n\nIn case of error, the function fib6_add_1() returns ERR_PTR()\nor NULL pointer. The ERR_PTR() case check is missing in fib6_add().\n\ndpatch engine is used to generated this patch.\n(https://github.com/weiyj/dpatch)\n\nSigned-off-by: Wei Yongjun \u003cyongjun_wei@trendmicro.com.cn\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d5e36b089edcc8179d4640e1a8e5bca6fb74409e", "tree": "8e9cd19cc439a68a260f74f646f1a059f40dada1", "parents": [ "17de307472bf21479e6d7c35211204b6ea186a7c" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Wed Sep 26 00:04:55 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:43 2012 +0900" }, "message": "ipv6: del unreachable route when an addr is deleted on lo\n\n[ Upstream commit 64c6d08e6490fb18cea09bb03686c149946bd818 ]\n\nWhen an address is added on loopback (ip -6 a a 2002::1/128 dev lo), two routes\nare added:\n - one in the local table:\n local 2002::1 via :: dev lo proto none metric 0\n - one the in main table (for the prefix):\n unreachable 2002::1 dev lo proto kernel metric 256 error -101\n\nWhen the address is deleted, the route inserted in the main table remains\nbecause we use rt6_lookup(), which returns NULL when dst-\u003eerror is set, which\nis the case here! Thus, it is better to use ip6_route_lookup() to avoid this\nkind of filter.\n\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "17de307472bf21479e6d7c35211204b6ea186a7c", "tree": "e90915dc70367e2252e35f2af7a9aeea992ceb30", "parents": [ "2ab08687cf48805c5abd0f9a785e09181eda9492" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Wed Sep 19 19:25:34 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:43 2012 +0900" }, "message": "ipv6: release reference of ip6_null_entry\u0027s dst entry in __ip6_del_rt\n\n[ Upstream commit 6825a26c2dc21eb4f8df9c06d3786ddec97cf53b ]\n\nas we hold dst_entry before we call __ip6_del_rt,\nso we should alse call dst_release not only return\n-ENOENT when the rt6_info is ip6_null_entry.\n\nand we already hold the dst entry, so I think it\u0027s\nsafe to call dst_release out of the write-read lock.\n\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "84a2d3c44cce71152f3555af83bafea6ec5ef23c", "tree": "fb069dbaa2fe6244cf4a4eaa9cbcdfdc57d22771", "parents": [ "c8cca9d90b953a0a2b5d0edab789f5c52ae983f5" ], "author": { "name": "Ben Hutchings", "email": "bhutchings@solarflare.com", "time": "Tue Aug 14 08:54:51 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:35 2012 -0700" }, "message": "ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock\n\n[ Upstream commit 4acd4945cd1e1f92b20d14e349c6c6a52acbd42d ]\n\nCong Wang reports that lockdep detected suspicious RCU usage while\nenabling IPV6 forwarding:\n\n [ 1123.310275] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ 1123.442202] [ INFO: suspicious RCU usage. ]\n [ 1123.558207] 3.6.0-rc1+ #109 Not tainted\n [ 1123.665204] -------------------------------\n [ 1123.768254] include/linux/rcupdate.h:430 Illegal context switch in RCU read-side critical section!\n [ 1123.992320]\n [ 1123.992320] other info that might help us debug this:\n [ 1123.992320]\n [ 1124.307382]\n [ 1124.307382] rcu_scheduler_active \u003d 1, debug_locks \u003d 0\n [ 1124.522220] 2 locks held by sysctl/5710:\n [ 1124.648364] #0: (rtnl_mutex){+.+.+.}, at: [\u003cffffffff81768498\u003e] rtnl_trylock+0x15/0x17\n [ 1124.882211] #1: (rcu_read_lock){.+.+.+}, at: [\u003cffffffff81871df8\u003e] rcu_lock_acquire+0x0/0x29\n [ 1125.085209]\n [ 1125.085209] stack backtrace:\n [ 1125.332213] Pid: 5710, comm: sysctl Not tainted 3.6.0-rc1+ #109\n [ 1125.441291] Call Trace:\n [ 1125.545281] [\u003cffffffff8109d915\u003e] lockdep_rcu_suspicious+0x109/0x112\n [ 1125.667212] [\u003cffffffff8107c240\u003e] rcu_preempt_sleep_check+0x45/0x47\n [ 1125.781838] [\u003cffffffff8107c260\u003e] __might_sleep+0x1e/0x19b\n[...]\n [ 1127.445223] [\u003cffffffff81757ac5\u003e] call_netdevice_notifiers+0x4a/0x4f\n[...]\n [ 1127.772188] [\u003cffffffff8175e125\u003e] dev_disable_lro+0x32/0x6b\n [ 1127.885174] [\u003cffffffff81872d26\u003e] dev_forward_change+0x30/0xcb\n [ 1128.013214] [\u003cffffffff818738c4\u003e] addrconf_forward_change+0x85/0xc5\n[...]\n\naddrconf_forward_change() uses RCU iteration over the netdev list,\nwhich is unnecessary since it already holds the RTNL lock. We also\ncannot reasonably require netdevice notifier functions not to sleep.\n\nReported-by: Cong Wang \u003camwang@redhat.com\u003e\nSigned-off-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f9909f77764c6e7d9f6067ac58bf3f68a02ed266", "tree": "325ca736f5bcb12807ab37719f86f41b6d064c9a", "parents": [ "8ec2c824f3773dcc31316535acd8c725c22a7341" ], "author": { "name": "Thomas Graf", "email": "tgraf@suug.ch", "time": "Mon Jun 18 12:08:33 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:03:46 2012 -0700" }, "message": "ipv6: Move ipv6 proc file registration to end of init order\n\n[ Upstream commit d189634ecab947c10f6f832258b103d0bbfe73cc ]\n\n/proc/net/ipv6_route reflects the contents of fib_table_hash. The proc\nhandler is installed in ip6_route_net_init() whereas fib_table_hash is\nallocated in fib6_net_init() _after_ the proc handler has been installed.\n\nThis opens up a short time frame to access fib_table_hash with its pants\ndown.\n\nMove the registration of the proc files to a later point in the init\norder to avoid the race.\n\nTested :-)\n\nSigned-off-by: Thomas Graf \u003ctgraf@suug.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8ec2c824f3773dcc31316535acd8c725c22a7341", "tree": "61b8e00091cb98631a4bdbff88a3e12a8faf0327", "parents": [ "217fc833225f3a2ba55eabd3916bfbef38185cd1" ], "author": { "name": "Thomas Graf", "email": "tgraf@suug.ch", "time": "Thu Jun 07 06:51:04 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:03:46 2012 -0700" }, "message": "ipv6: fib: Restore NTF_ROUTER exception in fib6_age()\n\n[ Upstream commit 8bd74516b1bd9308c17f67583134d93f777203ca ]\n\nCommit 5339ab8b1dd82 (ipv6: fib: Convert fib6_age() to\ndst_neigh_lookup().) seems to have mistakenly inverted the\nexception for cached NTF_ROUTER routes.\n\nSigned-off-by: Thomas Graf \u003ctgraf@suug.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "978041f2a946a4616f7cdb60f6d453ffa83298c1", "tree": "e5ced0504c3986e77add058bf1923cfe7b7449b2", "parents": [ "010589e2bce841733dc989fd56c5c3aba41a759c" ], "author": { "name": "Benjamin Poirier", "email": "bpoirier@suse.de", "time": "Thu May 24 11:32:38 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 10 00:36:15 2012 +0900" }, "message": "xfrm: take net hdr len into account for esp payload size calculation\n\n[ Upstream commit 91657eafb64b4cb53ec3a2fbc4afc3497f735788 ]\n\nCorrects the function that determines the esp payload size. The calculations\ndone in esp{4,6}_get_mtu() lead to overlength frames in transport mode for\ncertain mtu values and suboptimal frames for others.\n\nAccording to what is done, mainly in esp{,6}_output() and tcp_mtu_to_mss(),\nnet_header_len must be taken into account before doing the alignment\ncalculation.\n\nSigned-off-by: Benjamin Poirier \u003cbpoirier@suse.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "be078c8003469b75aa9119254c163b2961321744", "tree": "a0aab8f217d0a956633a0e81fb6008ee8cd3f8e3", "parents": [ "86a2569c810dff80fc7ba16dd77bc2697c28317a" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Sat May 26 01:30:53 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 10 00:36:15 2012 +0900" }, "message": "ipv6: fix incorrect ipsec fragment\n\n[ Upstream commit 0c1833797a5a6ec23ea9261d979aa18078720b74 ]\n\nSince commit ad0081e43a\n\"ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed\"\nthe fragment of packets is incorrect.\nbecause tunnel mode needs IPsec headers and trailer for all fragments,\nwhile on transport mode it is sufficient to add the headers to the\nfirst fragment and the trailer to the last.\n\nso modify mtu and maxfraglen base on ipsec mode and if fragment is first\nor last.\n\nwith my test,it work well(every fragment\u0027s size is the mtu)\nand does not trigger slow fragment path.\n\nChanges from v1:\n\tthough optimization, mtu_prev and maxfraglen_prev can be delete.\n\treplace xfrm mode codes with dst_entry\u0027s new frag DST_XFRM_TUNNEL.\n\tadd fuction ip6_append_data_mtu to make codes clearer.\n\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f132c6cf77251e011e1dad0ec88c0b1fda16d5aa", "tree": "f04b469a3547a19b7bdbe110adc571eb71c93328", "parents": [ "23016defd7db701a01dc49f972ad6b1bae9651c2", "3f6240f3e4e2608caf1a70d614ada658cbcbe7be" ], "author": { "name": "Steve Muckle", "email": "smuckle@codeaurora.org", "time": "Wed Jun 06 18:30:57 2012 -0700" }, "committer": { "name": "Steve Muckle", "email": "smuckle@codeaurora.org", "time": "Wed Jun 06 18:45:28 2012 -0700" }, "message": "Merge commit \u0027AU_LINUX_ANDROID_ICS.04.00.04.00.126\u0027 into msm-3.4\n\nAU_LINUX_ANDROID_ICS.04.00.04.00.126 from msm-3.0.\nFirst parent is from google/android-3.4.\n\n* commit \u0027AU_LINUX_ANDROID_ICS.04.00.04.00.126\u0027: (8712 commits)\n PRNG: Device tree entry for qrng device.\n vidc:1080p: Set video core timeout value for Thumbnail mode\n msm: sps: improve the debugging support in SPS driver\n board-8064 msm: Overlap secure and non secure video firmware heaps.\n msm: clock: Add handoff ops for 7x30 and copper XO clocks\n msm_fb: display: Wait for external vsync before DTV IOMMU unmap\n msm: Fix ciruclar dependency in debug UART settings\n msm: gdsc: Add GDSC regulator driver for msm-copper\n defconfig: Enable Mobicore Driver.\n mobicore: Add mobicore driver.\n mobicore: rename variable to lower case.\n mobicore: rename folder.\n mobicore: add makefiles\n mobicore: initial import of kernel driver\n ASoC: msm: Add SLIMBUS_2_RX CPU DAI\n board-8064-gpio: Update FUNC for EPM SPI CS\n msm_fb: display: Remove chicken bit config during video playback\n mmc: msm_sdcc: enable the sanitize capability\n msm-fb: display: lm2 writeback support on mpq platfroms\n msm_fb: display: Disable LVDS phy \u0026 pll during panel off\n ...\n\nSigned-off-by: Steve Muckle \u003csmuckle@codeaurora.org\u003e\n" }, { "commit": "6329bf0a03811f4644a4c8d50bf241f6db6f19b5", "tree": "3b92221c0536e4cfc414a3ff36483de00a739e96", "parents": [ "2c653ad630abce4b447292fbfb20d48c2136a13d" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Thu Feb 23 10:55:02 2012 +0000" }, "committer": { "name": "Jin Hong", "email": "jinh@codeaurora.org", "time": "Sat May 12 21:53:36 2012 -0700" }, "message": "ipsec: be careful of non existing mac headers\n\nNiccolo Belli reported ipsec crashes in case we handle a frame without\nmac header (atm in his case)\n\nBefore copying mac header, better make sure it is present.\n\nBugzilla reference: https://bugzilla.kernel.org/show_bug.cgi?id\u003d42809\n\nReported-by: Niccolò Belli \u003cdarkbasic@linuxsystems.it\u003e\nTested-by: Niccolò Belli \u003cdarkbasic@linuxsystems.it\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n\nCRs-Fixed: 344300\nChange-Id: Ic2d8f3f6b90233d6e87741373c33ef510b35aaa5\nSigned-off-by: Jin Hong \u003cjinh@codeaurora.org\u003e\n" }, { "commit": "aadf030d84352a91cdadf50f947da739c5611450", "tree": "5f22ec57ee257776b4c157f0c91f3612f05ed6c5", "parents": [ "aad2732ba0dddcf3446a4e3c4843496759c1c305", "69964ea4c7b68c9399f7977aa5b9aa6539a6a98a" ], "author": { "name": "Colin Cross", "email": "ccross@android.com", "time": "Tue May 01 15:47:09 2012 -0700" }, "committer": { "name": "Colin Cross", "email": "ccross@android.com", "time": "Tue May 01 15:47:09 2012 -0700" }, "message": "Merge commit \u0027v3.4-rc5\u0027 into android-3.4\n" }, { "commit": "d135c522f1234f62e81be29cebdf59e9955139ad", "tree": "7e151f3995d6a30499c2bec2c07b2bf68754788e", "parents": [ "163faf31778e536ac6125bc8b14f4667adc910e9" ], "author": { "name": "Neal Cardwell", "email": "ncardwell@google.com", "time": "Sun Apr 22 09:45:47 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Apr 22 17:09:35 2012 -0400" }, "message": "tcp: fix TCP_MAXSEG for established IPv6 passive sockets\n\nCommit f5fff5d forgot to fix TCP_MAXSEG behavior IPv6 sockets, so IPv6\nTCP server sockets that used TCP_MAXSEG would find that the advmss of\nchild sockets would be incorrect. This commit mirrors the advmss logic\nfrom tcp_v4_syn_recv_sock in tcp_v6_syn_recv_sock. Eventually this\nlogic should probably be shared between IPv4 and IPv6, but this at\nleast fixes this issue.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ab2965eefef95a2eecfd54c12b0eb243162862e9", "tree": "c947fdc158e144c2d060486b65d10ee67d254039", "parents": [ "a0ec4361e4539e30cf1c5de7ddfd2dadcd8e1595", "e816b57a337ea3b755de72bec38c10c864f23015" ], "author": { "name": "Colin Cross", "email": "ccross@android.com", "time": "Thu Apr 19 14:42:22 2012 -0700" }, "committer": { "name": "Colin Cross", "email": "ccross@android.com", "time": "Thu Apr 19 14:42:22 2012 -0700" }, "message": "Merge commit \u0027v3.4-rc3\u0027 into android-3.4\n\nConflicts:\n\tdrivers/staging/android/lowmemorykiller.c\n\nChange-Id: Ia3ffcfc702e28c4fce0e91b363f4afd5f1c40306\n" }, { "commit": "1716a96101c49186bb0b8491922fd3e69030235f", "tree": "43794d2f033f439d25c63b1796e138d65fd746a8", "parents": [ "d62f8dbb5b7771910f7c4657345df8ac93acb832" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Fri Apr 06 00:13:10 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Apr 13 12:58:29 2012 -0400" }, "message": "ipv6: fix problem with expired dst cache\n\nIf the ipv6 dst cache which copy from the dst generated by ICMPV6 RA packet.\nthis dst cache will not check expire because it has no RTF_EXPIRES flag.\nSo this dst cache will always be used until the dst gc run.\n\nChange the struct dst_entry,add a union contains new pointer from and expires.\nWhen rt6_info.rt6i_flags has no RTF_EXPIRES flag,the dst.expires has no use.\nwe can use this field to point to where the dst cache copy from.\nThe dst.from is only used in IPV6.\n\nrt6_check_expired check if rt6_info.dst.from is expired.\n\nip6_rt_copy only set dst.from when the ort has flag RTF_ADDRCONF\nand RTF_DEFAULT.then hold the ort.\n\nip6_dst_destroy release the ort.\n\nAdd some functions to operate the RTF_EXPIRES flag and expires(from) together.\nand change the code to use these new adding functions.\n\nChanges from v5:\nmodify ip6_route_add and ndisc_router_discovery to use new adding functions.\n\nOnly set dst.from when the ort has flag RTF_ADDRCONF\nand RTF_DEFAULT.then hold the ort.\n\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "174808af90a06ee59ffedd60c00c252f1f887f25", "tree": "5e026fdc0d2b4d66c0a79267e5755e10d6d04bd8", "parents": [ "778c2dee6f134bf0472ed45eedaee53b4f336afb", "5d949944229b0a08e218723be231731cd86b94f3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 12 14:04:33 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 12 14:04:33 2012 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n\n 1) Fix bluetooth userland regression reported by Keith Packard, from\n Gustavo Padovan.\n\n 2) Revert ath9k PS idle change, from Sujith Manoharan.\n\n 3) Correct default TCP memory limits (again), from Eric Dumazet.\n\n 4) Fix tcp_rcv_rtt_update() accidental use of unscaled RTT, from Neal\n Cardwell.\n\n 5) We made a facility for layers like wireless to say how much tailroom\n they need in the SKB for link layer stuff such as wireless\n encryption etc., but TCP works hard to fill every SKB out to the end\n defeating this specification.\n\n This leads to every TCP packet getting reallocated by the wireless\n code in order to have the right amount of tailroom available.\n\n Fix TCP to only fill SKBs out to the real amount of data area it\n asked for during the allocation, this way it won\u0027t eat into the\n slack added for the device\u0027s tailroom needs.\n\n Reported by Marc Merlin and fixed by Eric Dumazet.\n\n 6) Leaks, endian bugs, and new device IDs in bluetooth from Santosh\n Nayak, João Paulo Rechi Vita, Cho, Yu-Chen, Andrei Emeltchenko,\n AceLan Kao, and Andrei Emeltchenko.\n\n 7) OOPS on tty_close fix in bluetooth\u0027s hci_ldisc from Johan Hovold.\n\n 8) netfilter erroneously scales TCP window twice, fix from Changli Gao.\n\n 9) Memleak fix in wext-core from Julia Lawall.\n\n10) Consistently handle invalid TCP packets in ipv4 vs. ipv6 conntrack,\n from Jozsef Kadlecsik.\n\n11) Validate IP header length properly in netfilter conntrack\u0027s\n ipv4_get_l4proto().\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (39 commits)\n NFC: Fix the LLCP Tx fragmentation loop\n rtlwifi: Add missing DMA buffer unmapping for PCI drivers\n rtlwifi: Preallocate USB read buffers and eliminate kalloc in read routine\n tcp: avoid order-1 allocations on wifi and tx path\n net: allow pskb_expand_head() to get maximum tailroom\n bridge: Do not send queries on multicast group leaves\n MAINTAINERS: Mark NATSEMI driver as orphan\u0027d.\n tcp: fix tcp_rcv_rtt_update() use of an unscaled RTT sample\n tcp: restore correct limit\n Revert \"ath9k: fix going to full-sleep on PS idle\"\n rt2x00: Fix rfkill_polling register function.\n bcma: fix build error on MIPS; implicit pcibios_enable_device\n netfilter: nf_conntrack: fix incorrect logic in nf_conntrack_init_net\n netfilter: nf_ct_ipv4: packets with wrong ihl are invalid\n netfilter: nf_ct_ipv4: handle invalid IPv4 and IPv6 packets consistently\n net/wireless/wext-core.c: add missing kfree\n rtlwifi: Fix oops on rate-control failure\n mac80211: Convert WARN_ON to WARN_ON_ONCE\n rtlwifi: rtl8192de: Fix firmware initialization\n nl80211: ensure interface is up in various APIs\n ...\n" }, { "commit": "94fb175c0414902ad9dbd956addf3a5feafbc85b", "tree": "5d3c37abe78f072e92072f2079a98303c92cf16e", "parents": [ "a9e1e53bcfb29b3b503a5e75ce498d9a64f32c1e", "a2bd1140a264b561e38d99e656cd843c2d840e86" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 10 15:30:16 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 10 15:30:16 2012 -0700" }, "message": "Merge tag \u0027dmaengine-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/dmaengine\n\nPull dmaengine fixes from Dan Williams:\n\n1/ regression fix for Xen as it now trips over a broken assumption\n about the dma address size on 32-bit builds\n\n2/ new quirk for netdma to ignore dma channels that cannot meet\n netdma alignment requirements\n\n3/ fixes for two long standing issues in ioatdma (ring size overflow)\n and iop-adma (potential stack corruption)\n\n* tag \u0027dmaengine-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/dmaengine:\n netdma: adding alignment check for NETDMA ops\n ioatdma: DMA copy alignment needed to address IOAT DMA silicon errata\n ioat: ring size variables need to be 32bit to avoid overflow\n iop-adma: Corrected array overflow in RAID6 Xscale(R) test.\n ioat: fix size of \u0027completion\u0027 for Xen\n" }, { "commit": "02435b1c3f4b70ffe18edb31a66afedabd0ba12b", "tree": "7f8625fedd89085a4b59f8b05c271481e5bccaab", "parents": [ "18913bc477d66183f729862798996381d5c98290" ], "author": { "name": "JP Abgrall", "email": "jpa@google.com", "time": "Thu Sep 29 15:36:49 2011 -0700" }, "committer": { "name": "Colin Cross", "email": "ccross@android.com", "time": "Mon Apr 09 13:57:57 2012 -0700" }, "message": "netfilter: ipv6: fix crash caused by ipv6_find_hdr()\n\nWhen calling:\n ipv6_find_hdr(skb, \u0026thoff, -1, NULL)\non a fragmented packet, thoff would be left with a random\nvalue causing callers to read random memory offsets with:\n skb_header_pointer(skb, thoff, ...)\n\nNow we force ipv6_find_hdr() to return a failure in this case.\nCalling:\n ipv6_find_hdr(skb, \u0026thoff, -1, \u0026fragoff)\nwill set fragoff as expected, and not return a failure.\n\nChange-Id: Ib474e8a4267dd2b300feca325811330329684a88\nSigned-off-by: JP Abgrall \u003cjpa@google.com\u003e\n" }, { "commit": "bc7b88a0df0d28a19ba75fce0811dfd6ea500295", "tree": "1fa08d5ec6d31f035eccb6c920f9c862b80dd11b", "parents": [ "8024cefc83bba720768a898f1c05248050648a71" ], "author": { "name": "JP Abgrall", "email": "jpa@google.com", "time": "Thu Jun 16 14:37:03 2011 -0700" }, "committer": { "name": "Colin Cross", "email": "ccross@android.com", "time": "Mon Apr 09 13:57:56 2012 -0700" }, "message": "netfilter: have ip*t REJECT set the sock err when an icmp is to be sent\n\nAllow the REJECT --reject-with icmp*blabla to also set the matching error\nlocally on the socket affected by the reject.\nThis allows the process to see an error almost as if it received it\nvia ICMP.\nIt avoids the local process who\u0027s ingress packet is rejected to have to\nwait for a pseudo-eternity until some timeout kicks in.\n\nIdeally, this should be enabled with a new iptables flag similar to\n --reject-with-sock-err\nFor now it is enabled with CONFIG_IP*_NF_TARGET_REJECT_SKERR option.\n\nChange-Id: I649a4fd5940029ec0b3233e5abb205da6984891e\nSigned-off-by: JP Abgrall \u003cjpa@google.com\u003e\n" }, { "commit": "c543f112f11bd08d5efdf8815ff419bd20a7a392", "tree": "141ab0657cbec45454b435988db0e7d8b4d5d29b", "parents": [ "0432013eb1fbddf51f43d3dfb7553db011c81707" ], "author": { "name": "Chia-chi Yeh", "email": "chiachi@android.com", "time": "Tue Jun 30 11:23:04 2009 +0800" }, "committer": { "name": "Colin Cross", "email": "ccross@android.com", "time": "Mon Apr 09 13:57:47 2012 -0700" }, "message": "net: Replace AID_NET_RAW checks with capable(CAP_NET_RAW).\n\nSigned-off-by: Chia-chi Yeh \u003cchiachi@android.com\u003e\n" }, { "commit": "2365d054980471b7fcb6d862169ddcec1eb52f4d", "tree": "532fd00c912501470daba9a90ab5d0248843929c", "parents": [ "2038692b9acf7ae3054a35e879039ff062316bf0" ], "author": { "name": "Robert Love", "email": "rlove@google.com", "time": "Mon May 12 17:08:29 2008 -0400" }, "committer": { "name": "Colin Cross", "email": "ccross@android.com", "time": "Mon Apr 09 13:53:15 2012 -0700" }, "message": "net: socket ioctl to reset connections matching local address\n\nIntroduce a new socket ioctl, SIOCKILLADDR, that nukes all sockets\nbound to the same local address. This is useful in situations with\ndynamic IPs, to kill stuck connections.\n\nSigned-off-by: Brian Swetland \u003cswetland@google.com\u003e\n\nnet: fix tcp_v4_nuke_addr\n\nSigned-off-by: Dima Zavin \u003cdima@android.com\u003e\n\nnet: ipv4: Fix a spinlock recursion bug in tcp_v4_nuke.\n\nWe can\u0027t hold the lock while calling to tcp_done(), so we drop\nit before calling. We then have to start at the top of the chain again.\n\nSigned-off-by: Dima Zavin \u003cdima@android.com\u003e\n\nnet: ipv4: Fix race in tcp_v4_nuke_addr().\n\nTo fix a recursive deadlock in 2.6.29, we stopped holding the hash table lock\nacross tcp_done() calls. This fixed the deadlock, but introduced a race where\nthe socket could die or change state.\n\nFix: Before unlocking the hash table, we grab a reference to the socket. We\ncan then unlock the hash table without risk of the socket going away. We then\nlock the socket, which is safe because it is pinned. We can then call\ntcp_done() without recursive deadlock and without race. Upon return, we unlock\nthe socket and then unpin it, killing it.\n\nChange-Id: Idcdae072b48238b01bdbc8823b60310f1976e045\nSigned-off-by: Robert Love \u003crlove@google.com\u003e\nAcked-by: Dima Zavin \u003cdima@android.com\u003e\n\nipv4: disable bottom halves around call to tcp_done().\n\nSigned-off-by: Robert Love \u003crlove@google.com\u003e\nSigned-off-by: Colin Cross \u003cccross@android.com\u003e\n\nipv4: Move sk_error_report inside bh_lock_sock in tcp_v4_nuke_addr\n\nWhen sk_error_report is called, it wakes up the user-space thread, which then\ncalls tcp_close. When the tcp_close is interrupted by the tcp_v4_nuke_addr\nioctl thread running tcp_done, it leaks 392 bytes and triggers a WARN_ON.\n\nThis patch moves the call to sk_error_report inside the bh_lock_sock, which\nmatches the locking used in tcp_v4_err.\n\nSigned-off-by: Colin Cross \u003cccross@android.com\u003e\n" }, { "commit": "2038692b9acf7ae3054a35e879039ff062316bf0", "tree": "c0ac7f6245ec55f48eade0c9d0529466a573b1e2", "parents": [ "d92aa582e4cf5c378defc14b892ae056c9db65b6" ], "author": { "name": "Robert Love", "email": "rlove@google.com", "time": "Wed Oct 15 15:35:44 2008 -0400" }, "committer": { "name": "Colin Cross", "email": "ccross@android.com", "time": "Mon Apr 09 13:53:14 2012 -0700" }, "message": "Paranoid network.\n\nWith CONFIG_ANDROID_PARANOID_NETWORK, require specific uids/gids to instantiate\nnetwork sockets.\n\nSigned-off-by: Robert Love \u003crlove@google.com\u003e\n\nparanoid networking: Use in_egroup_p() to check group membership\n\nThe previous group_search() caused trouble for partners with module builds.\nin_egroup_p() is also cleaner.\n\nSigned-off-by: Nick Pelly \u003cnpelly@google.com\u003e\n\nFix 2.6.29 build.\n\nSigned-off-by: Arve Hjønnevåg \u003carve@android.com\u003e\n\nnet: Fix compilation of the IPv6 module\n\nFix compilation of the IPv6 module -- current-\u003eeuid does not exist anymore,\ncurrent_euid() is what needs to be used.\n\nSigned-off-by: Steinar H. Gunderson \u003csesse@google.com\u003e\n" }, { "commit": "95ad2f873d5d404dc9ebc2377de0b762346346c0", "tree": "61a2b1897a62e245729667844204bbef01be2573", "parents": [ "6ee0b693bdb8ec56689e0d1cc533b16466fda048" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Apr 06 18:12:54 2012 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Mon Apr 09 16:29:34 2012 +0200" }, "message": "netfilter: ip6_tables: ip6t_ext_hdr is now static inline\n\nWe may hit this in xt_LOG:\n\nnet/built-in.o:xt_LOG.c:function dump_ipv6_packet:\n\terror: undefined reference to \u0027ip6t_ext_hdr\u0027\n\nhappens with these config options:\n\nCONFIG_NETFILTER_XT_TARGET_LOG\u003dy\nCONFIG_IP6_NF_IPTABLES\u003dm\n\nip6t_ext_hdr is fairly small and it is called in the packet path.\nMake it static inline.\n\nReported-by: Simon Kirby \u003csim@netnation.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "a2bd1140a264b561e38d99e656cd843c2d840e86", "tree": "9c9f19dde5c0213a52de0e77c16059062cc6c8a1", "parents": [ "f26df1a1a9452573af7b6cea9a4723593e838568" ], "author": { "name": "Dave Jiang", "email": "dave.jiang@intel.com", "time": "Wed Apr 04 16:10:46 2012 -0700" }, "committer": { "name": "Dan Williams", "email": "dan.j.williams@intel.com", "time": "Thu Apr 05 15:27:12 2012 -0700" }, "message": "netdma: adding alignment check for NETDMA ops\n\nThis is the fallout from adding memcpy alignment workaround for certain\nIOATDMA hardware. NetDMA will only use DMA engine that can handle byte align\nops.\n\nAcked-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Dave Jiang \u003cdave.jiang@intel.com\u003e\nSigned-off-by: Dan Williams \u003cdan.j.williams@intel.com\u003e\n" }, { "commit": "78d50217baf36093ab320f95bae0d6452daec85c", "tree": "ca39d544f4e2918ade64f0a601ebd6b41cc808f0", "parents": [ "117980c4c994b6fe58e873fe803c9bcdcb4337a3" ], "author": { "name": "RongQing.Li", "email": "roy.qing.li@gmail.com", "time": "Wed Apr 04 16:47:04 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Apr 05 00:00:42 2012 -0400" }, "message": "ipv6: fix array index in ip6_mc_add_src()\n\nConvert array index from the loop bound to the loop index.\n\nAnd remove the void type conversion to ip6_mc_del1_src() return\ncode, seem it is unnecessary, since ip6_mc_del1_src() does not\nuse __must_check similar attribute, no compiler will report the\nwarning when it is removed.\n\nv2: enrich the commit header\n\nSigned-off-by: RongQing.Li \u003croy.qing.li@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ed359a3b7b6ade0071f378c0cf4392d252f7d334", "tree": "8f81e03fcb44a7d36f53bc5a53d8eced7154bee2", "parents": [ "95694129b43165911dc4e8a972f0d39ad98d86be", "2240eb4ae3dc4acff20d1a8947c441c451513e37" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 02 17:53:39 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 02 17:53:39 2012 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n\n 1) Provide device string properly for USB i2400m wimax devices, also\n don\u0027t OOPS when providing firmware string. From Phil Sutter.\n\n 2) Add support for sh_eth SH7734 chips, from Nobuhiro Iwamatsu.\n\n 3) Add another device ID to USB zaurus driver, from Guan Xin.\n\n 4) Loop index start in pool vector iterator is wrong causing MAC to not\n get configured in bnx2x driver, fix from Dmitry Kravkov.\n\n 5) EQL driver assumes HZ\u003d100, fix from Eric Dumazet.\n\n 6) Now that skb_add_rx_frag() can specify the truesize increment\n separately, do so in f_phonet and cdc_phonet, also from Eric\n Dumazet.\n\n 7) virtio_net accidently uses net_ratelimit() not only on the kernel\n warning but also the statistic bump, fix from Rick Jones.\n\n 8) ip_route_input_mc() uses fixed init_net namespace, oops, use\n dev_net(dev) instead. Fix from Benjamin LaHaise.\n\n 9) dev_forward_skb() needs to clear the incoming interface index of the\n SKB so that it looks like a new incoming packet, also from Benjamin\n LaHaise.\n\n10) iwlwifi mistakenly initializes a channel entry as 2GHZ instead of\n 5GHZ, fix from Stanislav Yakovlev.\n\n11) Missing kmalloc() return value checks in orinoco, from Santosh\n Nayak.\n\n12) ath9k doesn\u0027t check for HT capabilities in the right way, it is\n checking ht_supported instead of the ATH9K_HW_CAP_HT flag. Fix from\n Sujith Manoharan.\n\n13) Fix x86 BPF JIT emission of 16-bit immediate field of AND\n instructions, from Feiran Zhuang.\n\n14) Avoid infinite loop in GARP code when registering sysfs entries.\n From David Ward.\n\n15) rose protocol uses memcpy instead of memcmp in a device address\n comparison, oops. Fix from Daniel Borkmann.\n\n16) Fix build of lpc_eth due to dev_hw_addr_rancom() interface being\n renamed to eth_hw_addr_random(). From Roland Stigge.\n\n17) Make ipv6 RTM_GETROUTE interpret RTA_IIF attribute the same way\n that ipv4 does. Fix from Shmulik Ladkani.\n\n18) via-rhine has an inverted bit test, causing suspend/resume\n regressions. Fix from Andreas Mohr.\n\n19) RIONET assumes 4K page size, fix from Akinobu Mita.\n\n20) Initialization of imask register in sky2 is buggy, because bits are\n \"or\u0027d\" into an uninitialized local variable. Fix from Lino\n Sanfilippo.\n\n21) Fix FCOE checksum offload handling, from Yi Zou.\n\n22) Fix VLAN processing regression in e1000, from Jiri Pirko.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits)\n sky2: dont overwrite settings for PHY Quick link\n tg3: Fix 5717 serdes powerdown problem\n net: usb: cdc_eem: fix mtu\n net: sh_eth: fix endian check for architecture independent\n usb/rtl8150 : Remove duplicated definitions\n rionet: fix page allocation order of rionet_active\n via-rhine: fix wait-bit inversion.\n ipv6: Fix RTM_GETROUTE\u0027s interpretation of RTA_IIF to be consistent with ipv4\n net: lpc_eth: Fix rename of dev_hw_addr_random\n net/netfilter/nfnetlink_acct.c: use linux/atomic.h\n rose_dev: fix memcpy-bug in rose_set_mac_address\n Fix non TBI PHY access; a bad merge undid bug fix in a previous commit.\n net/garp: avoid infinite loop if attribute already exists\n x86 bpf_jit: fix a bug in emitting the 16-bit immediate operand of AND\n bonding: emit event when bonding changes MAC\n mac80211: fix oper channel timestamp updation\n ath9k: Use HW HT capabilites properly\n MAINTAINERS: adding maintainer for ipw2x00\n net: orinoco: add error handling for failed kmalloc().\n net/wireless: ipw2x00: fix a typo in wiphy struct initilization\n ...\n" }, { "commit": "72331bc0cd072c3f4b670cd1256e47681fc53b80", "tree": "46665ad2830342d94b4d784c5aa397e3a6f0045b", "parents": [ "cdaf0b835df04177397b90214f8b457fd23b67e0" ], "author": { "name": "Shmulik Ladkani", "email": "shmulik.ladkani@gmail.com", "time": "Sun Apr 01 04:03:45 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Apr 01 17:29:40 2012 -0400" }, "message": "ipv6: Fix RTM_GETROUTE\u0027s interpretation of RTA_IIF to be consistent with ipv4\n\nIn IPv4, if an RTA_IIF attribute is specified within an RTM_GETROUTE\nmessage, then a route is searched as if a packet was received on the\nspecified \u0027iif\u0027 interface.\n\nHowever in IPv6, RTA_IIF is not interpreted in the same way:\n\u0027inet6_rtm_getroute()\u0027 always calls \u0027ip6_route_output()\u0027, regardless the\nRTA_IIF attribute.\n\nAs a result, in IPv6 there\u0027s no way to use RTM_GETROUTE in order to look\nfor a route as if a packet was received on a specific interface.\n\nFix \u0027inet6_rtm_getroute()\u0027 so that RTA_IIF is interpreted as \"lookup a\nroute as if a packet was received on the specified interface\", similar\nto IPv4\u0027s \u0027inet_rtm_getroute()\u0027 interpretation.\n\nReported-by: Ami Koren \u003camikoren@yahoo.com\u003e\nSigned-off-by: Shmulik Ladkani \u003cshmulik.ladkani@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a76e99abc558aed633ba28ff61c5328116292bf3", "tree": "60f7677f0baafa00825accc1214839246b3e78dd", "parents": [ "a54734678ff9cb97938b9f7648547174f3b118e4", "1d05f993784973189395051cc711fdd6dd5eb389" ], "author": { "name": "Rohit Vaswani", "email": "rvaswani@codeaurora.org", "time": "Fri Mar 30 00:09:34 2012 -0700" }, "committer": { "name": "Rohit Vaswani", "email": "rvaswani@codeaurora.org", "time": "Fri Mar 30 00:09:34 2012 -0700" }, "message": "Merge branch \u0027Linux 3.0.21\u0027 into msm-3.0\n\nMerge Upstream\u0027s stable 3.0.21 branch into msm-3.0\nThis consists 814 commits and some merge conflicts.\n\nThe merge conflicts are because of some local changes to\nmsm-3.0 as well as some conflicts between google\u0027s tree and\nthe upstream tree.\n\nConflicts:\n\tarch/arm/kernel/head.S\n\tdrivers/bluetooth/ath3k.c\n\tdrivers/bluetooth/btusb.c\n\tdrivers/mmc/core/core.c\n\tdrivers/tty/serial/serial_core.c\n\tdrivers/usb/host/ehci-hub.c\n\tdrivers/usb/serial/qcserial.c\n\tfs/namespace.c\n\tfs/proc/base.c\n\nChange-Id: I62e2edbe213f84915e27f8cd6e4f6ce23db22a21\nSigned-off-by: Rohit Vaswani \u003crvaswani@codeaurora.org\u003e\n" }, { "commit": "0195c00244dc2e9f522475868fa278c473ba7339", "tree": "f97ca98ae64ede2c33ad3de05ed7bbfa4f4495ed", "parents": [ "f21ce8f8447c8be8847dadcfdbcc76b0d7365fa5", "141124c02059eee9dbc5c86ea797b1ca888e77f7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 28 15:58:21 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 28 15:58:21 2012 -0700" }, "message": "Merge tag \u0027split-asm_system_h-for-linus-20120328\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-asm_system\n\nPull \"Disintegrate and delete asm/system.h\" from David Howells:\n \"Here are a bunch of patches to disintegrate asm/system.h into a set of\n separate bits to relieve the problem of circular inclusion\n dependencies.\n\n I\u0027ve built all the working defconfigs from all the arches that I can\n and made sure that they don\u0027t break.\n\n The reason for these patches is that I recently encountered a circular\n dependency problem that came about when I produced some patches to\n optimise get_order() by rewriting it to use ilog2().\n\n This uses bitops - and on the SH arch asm/bitops.h drags in\n asm-generic/get_order.h by a circuituous route involving asm/system.h.\n\n The main difficulty seems to be asm/system.h. It holds a number of\n low level bits with no/few dependencies that are commonly used (eg.\n memory barriers) and a number of bits with more dependencies that\n aren\u0027t used in many places (eg. switch_to()).\n\n These patches break asm/system.h up into the following core pieces:\n\n (1) asm/barrier.h\n\n Move memory barriers here. This already done for MIPS and Alpha.\n\n (2) asm/switch_to.h\n\n Move switch_to() and related stuff here.\n\n (3) asm/exec.h\n\n Move arch_align_stack() here. Other process execution related bits\n could perhaps go here from asm/processor.h.\n\n (4) asm/cmpxchg.h\n\n Move xchg() and cmpxchg() here as they\u0027re full word atomic ops and\n frequently used by atomic_xchg() and atomic_cmpxchg().\n\n (5) asm/bug.h\n\n Move die() and related bits.\n\n (6) asm/auxvec.h\n\n Move AT_VECTOR_SIZE_ARCH here.\n\n Other arch headers are created as needed on a per-arch basis.\"\n\nFixed up some conflicts from other header file cleanups and moving code\naround that has happened in the meantime, so David\u0027s testing is somewhat\nweakened by that. We\u0027ll find out anything that got broken and fix it..\n\n* tag \u0027split-asm_system_h-for-linus-20120328\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-asm_system: (38 commits)\n Delete all instances of asm/system.h\n Remove all #inclusions of asm/system.h\n Add #includes needed to permit the removal of asm/system.h\n Move all declarations of free_initmem() to linux/mm.h\n Disintegrate asm/system.h for OpenRISC\n Split arch_align_stack() out from asm-generic/system.h\n Split the switch_to() wrapper out of asm-generic/system.h\n Move the asm-generic/system.h xchg() implementation to asm-generic/cmpxchg.h\n Create asm-generic/barrier.h\n Make asm-generic/cmpxchg.h #include asm-generic/cmpxchg-local.h\n Disintegrate asm/system.h for Xtensa\n Disintegrate asm/system.h for Unicore32 [based on ver #3, changed by gxt]\n Disintegrate asm/system.h for Tile\n Disintegrate asm/system.h for Sparc\n Disintegrate asm/system.h for SH\n Disintegrate asm/system.h for Score\n Disintegrate asm/system.h for S390\n Disintegrate asm/system.h for PowerPC\n Disintegrate asm/system.h for PA-RISC\n Disintegrate asm/system.h for MN10300\n ...\n" }, { "commit": "9ffc93f203c18a70623f21950f1dd473c9ec48cd", "tree": "1eb3536ae183b0bfbf7f5152a6fe4f430ae881c2", "parents": [ "96f951edb1f1bdbbc99b0cd458f9808bb83d58ae" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Mar 28 18:30:03 2012 +0100" }, "committer": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Mar 28 18:30:03 2012 +0100" }, "message": "Remove all #inclusions of asm/system.h\n\nRemove all #inclusions of asm/system.h preparatory to splitting and killing\nit. Performed with the following command:\n\nperl -p -i -e \u0027s!^#\\s*include\\s*\u003casm/system[.]h\u003e.*\\n!!\u0027 `grep -Irl \u0027^#\\s*include\\s*\u003casm/system[.]h\u003e\u0027 *`\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\n" }, { "commit": "94f826b8076e2cb92242061e92f21b5baa3eccc2", "tree": "bb9893bf45ef93842a315b5ed8287ae1f11ae41b", "parents": [ "50269e19ad990e79eeda101fc6df80cffd5d4831" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Tue Mar 27 09:53:52 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 27 18:48:35 2012 -0400" }, "message": "net: fix a potential rcu_read_lock() imbalance in rt6_fill_node()\n\nCommit f2c31e32b378 (net: fix NULL dereferences in check_peer_redir() )\nadded a regression in rt6_fill_node(), leading to rcu_read_lock()\nimbalance.\n\nThats because NLA_PUT() can make a jump to nla_put_failure label.\n\nFix this by using nla_put()\n\nMany thanks to Ben Greear for his help\n\nReported-by: Ben Greear \u003cgreearb@candelatech.com\u003e\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nTested-by: Ben Greear \u003cgreearb@candelatech.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "523f610e1be2a4afca605962e137064378883c5f", "tree": "82923297355fccb70a03c5d2108bc5a6030212a2", "parents": [ "5d5440a835710d09f0ef18da5000541ec98b537a" ], "author": { "name": "Rusty Russell", "email": "rusty@rustcorp.com.au", "time": "Thu Mar 22 12:27:06 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Mar 22 22:36:17 2012 -0400" }, "message": "netfilter: remove forward module param confusion.\n\nIt used to be an int, and it got changed to a bool parameter at least\n7 years ago. It happens that NF_ACCEPT and NF_DROP are 0 and 1, so\nthis works, but it\u0027s unclear, and the check that it\u0027s in range is not\nrequired.\n\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1f85851e17b64cabd089a8a8839dddebc627948c", "tree": "a7a23af86a8241f09cff1602786bd7e26a120d17", "parents": [ "5c473ed26dba609622c9a625f896f8f59d86066c" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Mon Mar 19 22:36:10 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 20 05:39:34 2012 -0400" }, "message": "ipv6: fix incorrent ipv6 ipsec packet fragment\n\nSince commit 299b0767(ipv6: Fix IPsec slowpath fragmentation problem)\nIn func ip6_append_data,after call skb_put(skb, fraglen + dst_exthdrlen)\nthe skb-\u003elen contains dst_exthdrlen,and we don\u0027t reduce dst_exthdrlen at last\nThis will make fraggap\u003e0 in next \"while cycle\",and cause the size of skb incorrent\n\nFix this by reserve headroom for dst_exthdrlen.\n\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4da0bd736552e6377b407b3c3d3ae518ebbdd269", "tree": "f0da9f843b8033565c3ca4103fccb17a60688326", "parents": [ "81a430ac1b88b0702c57d2513e247317e810e04d", "c16fa4f2ad19908a47c63d8fa436a1178438c7e7" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Mar 18 23:29:41 2012 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Mar 18 23:29:41 2012 -0400" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n" }, { "commit": "c577923756b7fe9071f28a76b66b83b306d1d001", "tree": "3cdb24e829bf58f5a319c9e9dca491ce295276e1", "parents": [ "b8fbaef586176f6abe0eb7887ddae66e99898b79" ], "author": { "name": "RongQing.Li", "email": "roy.qing.li@gmail.com", "time": "Thu Mar 15 22:54:14 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Mar 16 21:56:42 2012 -0700" }, "message": "ipv6: Don\u0027t dev_hold(dev) in ip6_mc_find_dev_rcu.\n\nip6_mc_find_dev_rcu() is called with rcu_read_lock(), so don\u0027t\nneed to dev_hold().\nWith dev_hold(), not corresponding dev_put(), will lead to leak.\n\n[ bug introduced in 96b52e61be1 (ipv6: mcast: RCU conversions) ]\n\nSigned-off-by: RongQing.Li \u003croy.qing.li@gmail.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "122bdf67f15a22bcabf6c2cab3a545d17ccf68dc", "tree": "194cd16507ab67c34280c0c490268514bbe7f86a", "parents": [ "762ad8a5330325b789cfb6dc896f81cf273ff4e9" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed Mar 14 21:13:11 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Mar 16 01:53:42 2012 -0700" }, "message": "ipv6: fix icmp6_dst_alloc()\n\ncommit 87a115783 ( ipv6: Move xfrm_lookup() call down into\nicmp6_dst_alloc().) forgot to convert one error path, leading\nto crashes in mld_sendpack()\n\nMany thanks to Dave Jones for providing a very complete bug report.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8b2aaedee4eaa94e816144ed54b9707b96be29f8", "tree": "0fd46f2b7fdfd5aacda2c35470048dfe2fb00dab", "parents": [ "7fbc415d7bd0ff0224eea53c678fa9f13f646b4f" ], "author": { "name": "Li Wei", "email": "lw@cn.fujitsu.com", "time": "Wed Mar 07 14:58:07 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Mar 11 15:57:11 2012 -0700" }, "message": "ipv6: Fix Smatch warning.\n\nWith commit d6ddef9e641d(IPv6: Fix not join all-router mcast group\nwhen forwarding set.) I check \u0027dev\u0027 after it\u0027s dereference that\nleads to a Smatch complaint:\n\nnet/ipv6/addrconf.c:438 ipv6_add_dev()\n\t warn: variable dereferenced before check \u0027dev\u0027 (see line 432)\n\nnet/ipv6/addrconf.c\n 431\t\t/* protected by rtnl_lock */\n 432\t\trcu_assign_pointer(dev-\u003eip6_ptr, ndev);\n ^^^^^^^^^^^^\nOld dereference.\n\n 433\n 434\t\t/* Join all-node multicast group */\n 435\t\tipv6_dev_mc_inc(dev, \u0026in6addr_linklocal_allnodes);\n 436\n 437\t\t/* Join all-router multicast group if forwarding is set\n*/\n 438\t\tif (ndev-\u003ecnf.forwarding \u0026\u0026 dev \u0026\u0026 (dev-\u003eflags \u0026\nIFF_MULTICAST))\n ^^^\n\nRemove the check to avoid the complaint as \u0027dev\u0027 can\u0027t be NULL.\n\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Li Wei \u003clw@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b2d3298e0916fa059712691c85a0e97becc4ab9f", "tree": "c7d5ea46a9dbf9cebdb122df4aaf0beda6e7621e", "parents": [ "1a0bdadb4e36abac63b0a9787f372aac30c11a9e", "a7f4255f906f60f72e00aad2fb000939449ff32e" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Mar 09 14:34:20 2012 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Mar 09 14:34:20 2012 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n" }, { "commit": "50978462300f74dc48aea4a38471cb69bdf741a5", "tree": "0d63f721f996d4c4a4e37cd08df949e25d4c980e", "parents": [ "2c8503f55fbdfbeff4164f133df804cf4d316290" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Feb 28 19:13:48 2012 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Mar 07 17:41:22 2012 +0100" }, "message": "netfilter: add cttimeout infrastructure for fine timeout tuning\n\nThis patch adds the infrastructure to add fine timeout tuning\nover nfnetlink. Now you can use the NFNL_SUBSYS_CTNETLINK_TIMEOUT\nsubsystem to create/delete/dump timeout objects that contain some\nspecific timeout policy for one flow.\n\nThe follow up patches will allow you attach timeout policy object\nto conntrack via the CT target and the conntrack extension\ninfrastructure.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "2c8503f55fbdfbeff4164f133df804cf4d316290", "tree": "fe491bc79fd59aa4b8b99ea63d13e62b6a2ef1cb", "parents": [ "b888341c7f33035694f70428d7001d73f0b2a3b1" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Feb 28 18:23:31 2012 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Mar 07 17:41:19 2012 +0100" }, "message": "netfilter: nf_conntrack: pass timeout array to l4-\u003enew and l4-\u003epacket\n\nThis patch defines a new interface for l4 protocol trackers:\n\nunsigned int *(*get_timeouts)(struct net *net);\n\nthat is used to return the array of unsigned int that contains\nthe timeouts that will be applied for this flow. This is passed\nto the l4proto-\u003enew(...) and l4proto-\u003epacket(...) functions to\nspecify the timeout policy.\n\nThis interface allows per-net global timeout configuration\n(although only DCCP supports this by now) and it will allow\ncustom custom timeout configuration by means of follow-up\npatches.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "6939c33a757bd006c5e0b8b5fd429fc587a4d0f4", "tree": "c635fa7ceeb8a1a80540b45cf9e059ccb98ecdb1", "parents": [ "544d5c7d9f4d1ec4f170bc5bcc522012cb7704bc" ], "author": { "name": "Richard Weinberger", "email": "richard@nod.at", "time": "Fri Feb 10 23:10:52 2012 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Mar 07 17:40:49 2012 +0100" }, "message": "netfilter: merge ipt_LOG and ip6_LOG into xt_LOG\n\nipt_LOG and ip6_LOG have a lot of common code, merge them\nto reduce duplicate code.\n\nSigned-off-by: Richard Weinberger \u003crichard@nod.at\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "d6ddef9e641d1229d4ec841dc75ae703171c3e92", "tree": "eb895255cd3d561b189757cc26a5add23702c491", "parents": [ "34efc283a56adaef5756ac93065f46608674ea7d" ], "author": { "name": "Li Wei", "email": "lw@cn.fujitsu.com", "time": "Mon Mar 05 14:45:17 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 06 16:58:47 2012 -0500" }, "message": "IPv6: Fix not join all-router mcast group when forwarding set.\n\nWhen forwarding was set and a new net device is register,\nwe need add this device to the all-router mcast group.\n\nSigned-off-by: Li Wei \u003clw@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ff4783ce78c08d2990126ce1874250ae8e72bbd2", "tree": "5c95885a4ab768101dd72942b57c238d452a7565", "parents": [ "622121719934f60378279eb440d3cec2fc3176d2", "203738e548cefc3fc3c2f73a9063176c9f3583d5" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Feb 26 21:55:51 2012 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Feb 26 21:55:51 2012 -0500" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nConflicts:\n\tdrivers/net/ethernet/sfc/rx.c\n\nOverlapping changes in drivers/net/ethernet/sfc/rx.c, one to change\nthe rx_buf-\u003eis_page boolean into a set of u16 flags, and another to\nadjust how -\u003eip_summed is initialized.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "03606895cd98c0a628b17324fd7b5ff15db7e3cd", "tree": "26aab95243f23a5d0cff45ee0d6afd1608afe5df", "parents": [ "4a2258ddddefeef3291c0fc66437c73d84261a1e" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Thu Feb 23 10:55:02 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 23 16:50:45 2012 -0500" }, "message": "ipsec: be careful of non existing mac headers\n\nNiccolo Belli reported ipsec crashes in case we handle a frame without\nmac header (atm in his case)\n\nBefore copying mac header, better make sure it is present.\n\nBugzilla reference: https://bugzilla.kernel.org/show_bug.cgi?id\u003d42809\n\nReported-by: Niccolò Belli \u003cdarkbasic@linuxsystems.it\u003e\nTested-by: Niccolò Belli \u003cdarkbasic@linuxsystems.it\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5095d64db1b978bdb31d30fed9e47dbf04f729be", "tree": "a912b34b0f78b40f46fde374fae530211ef22c4c", "parents": [ "ba9adbe67e288823ac1deb7f11576ab5653f833e" ], "author": { "name": "RongQing.Li", "email": "roy.qing.li@gmail.com", "time": "Tue Feb 21 22:10:49 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 22 15:30:14 2012 -0500" }, "message": "ipv6: ip6_route_output() never returns NULL.\n\nip6_route_output() never returns NULL, so it is wrong to\ncheck if the return value is NULL.\n\nSigned-off-by: RongQing.Li \u003croy.qing.li@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3f518bf745cbd6007d8069100fb9cb09e960c872", "tree": "debbe9e9340d46080f1b82e4149a2427545c4aef", "parents": [ "4934b0329f7150dcb5f90506860e2db32274c755" ], "author": { "name": "Pavel Emelyanov", "email": "xemul@parallels.com", "time": "Tue Feb 21 07:30:58 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 21 14:58:57 2012 -0500" }, "message": "datagram: Add offset argument to __skb_recv_datagram\n\nThis one is only considered for MSG_PEEK flag and the value pointed by\nit specifies where to start peeking bytes from. If the offset happens to\npoint into the middle of the returned skb, the offset within this skb is\nput back to this very argument.\n\nSigned-off-by: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8a533666d1591cf4ea596c6bd710e2fe682cb56a", "tree": "0c525703fd834499c659490b3cb38835fde14f51", "parents": [ "323a479328cbc2fb5cf647790f7414ca570a577b" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Thu Feb 09 16:13:19 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 13 11:06:13 2012 -0800" }, "message": "net: fix NULL dereferences in check_peer_redir()\n\n[ Upstream commit d3aaeb38c40e5a6c08dd31a1b64da65c4352be36, along\n with dependent backports of commits:\n 69cce1d1404968f78b177a0314f5822d5afdbbfb\n 9de79c127cccecb11ae6a21ab1499e87aa222880\n 218fa90f072e4aeff9003d57e390857f4f35513e\n 580da35a31f91a594f3090b7a2c39b85cb051a12\n f7e57044eeb1841847c24aa06766c8290c202583\n e049f28883126c689cf95859480d9ee4ab23b7fa ]\n\nGergely Kalman reported crashes in check_peer_redir().\n\nIt appears commit f39925dbde778 (ipv4: Cache learned redirect\ninformation in inetpeer.) added a race, leading to possible NULL ptr\ndereference.\n\nSince we can now change dst neighbour, we should make sure a reader can\nsafely use a neighbour.\n\nAdd RCU protection to dst neighbour, and make sure check_peer_redir()\ncan be called safely by different cpus in parallel.\n\nAs neighbours are already freed after one RCU grace period, this patch\nshould not add typical RCU penalty (cache cold effects)\n\nMany thanks to Gergely for providing a pretty report pointing to the\nbug.\n\nReported-by: Gergely Kalman \u003csynapse@hippy.csoma.elte.hu\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4c507d2897bd9be810b3403ade73b04cf6fdfd4a", "tree": "dfd808407a0f800195e994bb2cfc401fae23295e", "parents": [ "7a3198a89722ad9521d22b05938d357eac7460fa" ], "author": { "name": "Jiri Benc", "email": "jbenc@redhat.com", "time": "Thu Feb 09 09:35:49 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 13 00:46:41 2012 -0500" }, "message": "net: implement IP_RECVTOS for IP_PKTOPTIONS\n\nCurrently, it is not easily possible to get TOS/DSCP value of packets from\nan incoming TCP stream. The mechanism is there, IP_PKTOPTIONS getsockopt\nwith IP_RECVTOS set, the same way as incoming TTL can be queried. This is\nnot actually implemented for TOS, though.\n\nThis patch adds this functionality, both for IPv4 (IP_PKTOPTIONS) and IPv6\n(IPV6_2292PKTOPTIONS). For IPv4, like in the IP_RECVTTL case, the value of\nthe TOS field is stored from the other party\u0027s ACK.\n\nThis is needed for proxies which require DSCP transparency. One such example\nis at http://zph.bratcheda.org/.\n\nSigned-off-by: Jiri Benc \u003cjbenc@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" } ], "next": "7a3198a89722ad9521d22b05938d357eac7460fa" }