)]}' { "log": [ { "commit": "9fc3bbb4a752f108cf096d96640f3b548bbbce6c", "tree": "ce1f8d7a53c2a93a42e64b4148587cff0132ba6d", "parents": [ "e6f26129ebbb0071016e2526036f42036ccf30e1" ], "author": { "name": "Joel Sing", "email": "jsing@google.com", "time": "Mon Jan 03 20:24:20 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Jan 04 11:35:12 2011 -0800" }, "message": "ipv4/route.c: respect prefsrc for local routes\n\nThe preferred source address is currently ignored for local routes,\nwhich results in all local connections having a src address that is the\nsame as the local dst address. Fix this by respecting the preferred source\naddress when it is provided for local routes.\n\nThis bug can be demonstrated as follows:\n\n # ifconfig dummy0 192.168.0.1\n # ip route show table local | grep local.*dummy0\n local 192.168.0.1 dev dummy0 proto kernel scope host src 192.168.0.1\n # ip route change table local local 192.168.0.1 dev dummy0 \\\n proto kernel scope host src 127.0.0.1\n # ip route show table local | grep local.*dummy0\n local 192.168.0.1 dev dummy0 proto kernel scope host src 127.0.0.1\n\nWe now establish a local connection and verify the source IP\naddress selection:\n\n # nc -l 192.168.0.1 3128 \u0026\n # nc 192.168.0.1 3128 \u0026\n # netstat -ant | grep 192.168.0.1:3128.*EST\n tcp 0 0 192.168.0.1:3128 192.168.0.1:33228 ESTABLISHED\n tcp 0 0 192.168.0.1:33228 192.168.0.1:3128 ESTABLISHED\n\nSigned-off-by: Joel Sing \u003cjsing@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e6f26129ebbb0071016e2526036f42036ccf30e1", "tree": "ba75f3014c9251ceee17c69bd6602603337c6b2e", "parents": [ "9d89081d698132b5f964aea88112f76492563ee9" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Mon Jan 03 04:16:28 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 03 12:09:33 2011 -0800" }, "message": "bridge: stp: ensure mac header is set\n\ncommit bf9ae5386bca8836c16e69ab8fdbe46767d7452a\n(llc: use dev_hard_header) removed the\nskb_reset_mac_header call from llc_mac_hdr_init.\n\nThis seems fine itself, but br_send_bpdu() invokes ebtables LOCAL_OUT.\n\nWe oops in ebt_basic_match() because it assumes eth_hdr(skb) returns\na meaningful result.\n\nCc: acme@ghostprotocols.net\nReferences: https://bugzilla.kernel.org/show_bug.cgi?id\u003d24532\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9d89081d698132b5f964aea88112f76492563ee9", "tree": "55c1c41e407ea0c8bbbf6444a8cdb16a9da181d0", "parents": [ "2f32c867219734b06abc980d4812f67b6d6fe517" ], "author": { "name": "Tomas Winkler", "email": "tomas.winkler@intel.com", "time": "Mon Jan 03 11:26:08 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 03 11:26:34 2011 -0800" }, "message": "bridge: fix br_multicast_ipv6_rcv for paged skbs\n\nuse pskb_may_pull to access ipv6 header correctly for paged skbs\nIt was omitted in the bridge code leading to crash in blind\n__skb_pull\n\nsince the skb is cloned undonditionally we also simplify the\nthe exit path\n\nthis fixes bug https://bugzilla.kernel.org/show_bug.cgi?id\u003d25202\n\nDec 15 14:36:40 User-PC hostapd: wlan0: STA 00:15:00:60:5d:34 IEEE 802.11: authenticated\nDec 15 14:36:40 User-PC hostapd: wlan0: STA 00:15:00:60:5d:34 IEEE 802.11: associated (aid 2)\nDec 15 14:36:40 User-PC hostapd: wlan0: STA 00:15:00:60:5d:34 RADIUS: starting accounting session 4D0608A3-00000005\nDec 15 14:36:41 User-PC kernel: [175576.120287] ------------[ cut here ]------------\nDec 15 14:36:41 User-PC kernel: [175576.120452] kernel BUG at include/linux/skbuff.h:1178!\nDec 15 14:36:41 User-PC kernel: [175576.120609] invalid opcode: 0000 [#1] SMP\nDec 15 14:36:41 User-PC kernel: [175576.120749] last sysfs file: /sys/devices/pci0000:00/0000:00:1f.2/host0/target0:0:0/0:0:0:0/block/sda/uevent\nDec 15 14:36:41 User-PC kernel: [175576.121035] Modules linked in: approvals binfmt_misc bridge stp llc parport_pc ppdev arc4 iwlagn snd_hda_codec_realtek iwlcore i915 snd_hda_intel mac80211 joydev snd_hda_codec snd_hwdep snd_pcm snd_seq_midi drm_kms_helper snd_rawmidi drm snd_seq_midi_event snd_seq snd_timer snd_seq_device cfg80211 eeepc_wmi usbhid psmouse intel_agp i2c_algo_bit intel_gtt uvcvideo agpgart videodev sparse_keymap snd shpchp v4l1_compat lp hid video serio_raw soundcore output snd_page_alloc ahci libahci atl1c\nDec 15 14:36:41 User-PC kernel: [175576.122712]\nDec 15 14:36:41 User-PC kernel: [175576.122769] Pid: 0, comm: kworker/0:0 Tainted: G W 2.6.37-rc5-wl+ #3 1015PE/1016P\nDec 15 14:36:41 User-PC kernel: [175576.123012] EIP: 0060:[\u003cf83edd65\u003e] EFLAGS: 00010283 CPU: 1\nDec 15 14:36:41 User-PC kernel: [175576.123193] EIP is at br_multicast_rcv+0xc95/0xe1c [bridge]\nDec 15 14:36:41 User-PC kernel: [175576.123362] EAX: 0000001c EBX: f5626318 ECX: 00000000 EDX: 00000000\nDec 15 14:36:41 User-PC kernel: [175576.123550] ESI: ec512262 EDI: f5626180 EBP: f60b5ca0 ESP: f60b5bd8\nDec 15 14:36:41 User-PC kernel: [175576.123737] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068\nDec 15 14:36:41 User-PC kernel: [175576.123902] Process kworker/0:0 (pid: 0, ti\u003df60b4000 task\u003df60a8000 task.ti\u003df60b0000)\nDec 15 14:36:41 User-PC kernel: [175576.124137] Stack:\nDec 15 14:36:41 User-PC kernel: [175576.124181] ec556500 f6d06800 f60b5be8 c01087d8 ec512262 00000030 00000024 f5626180\nDec 15 14:36:41 User-PC kernel: [175576.124181] f572c200 ef463440 f5626300 3affffff f6d06dd0 e60766a4 000000c4 f6d06860\nDec 15 14:36:41 User-PC kernel: [175576.124181] ffffffff ec55652c 00000001 f6d06844 f60b5c64 c0138264 c016e451 c013e47d\nDec 15 14:36:41 User-PC kernel: [175576.124181] Call Trace:\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc01087d8\u003e] ? sched_clock+0x8/0x10\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc0138264\u003e] ? enqueue_entity+0x174/0x440\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc016e451\u003e] ? sched_clock_cpu+0x131/0x190\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc013e47d\u003e] ? select_task_rq_fair+0x2ad/0x730\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc0524fc1\u003e] ? nf_iterate+0x71/0x90\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf83e4914\u003e] ? br_handle_frame_finish+0x184/0x220 [bridge]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf83e4790\u003e] ? br_handle_frame_finish+0x0/0x220 [bridge]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf83e46e9\u003e] ? br_handle_frame+0x189/0x230 [bridge]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf83e4790\u003e] ? br_handle_frame_finish+0x0/0x220 [bridge]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf83e4560\u003e] ? br_handle_frame+0x0/0x230 [bridge]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc04ff026\u003e] ? __netif_receive_skb+0x1b6/0x5b0\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc04f7a30\u003e] ? skb_copy_bits+0x110/0x210\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc0503a7f\u003e] ? netif_receive_skb+0x6f/0x80\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf82cb74c\u003e] ? ieee80211_deliver_skb+0x8c/0x1a0 [mac80211]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf82cc836\u003e] ? ieee80211_rx_handlers+0xeb6/0x1aa0 [mac80211]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc04ff1f0\u003e] ? __netif_receive_skb+0x380/0x5b0\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc016e242\u003e] ? sched_clock_local+0xb2/0x190\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc012b688\u003e] ? default_spin_lock_flags+0x8/0x10\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc05d83df\u003e] ? _raw_spin_lock_irqsave+0x2f/0x50\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf82cd621\u003e] ? ieee80211_prepare_and_rx_handle+0x201/0xa90 [mac80211]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf82ce154\u003e] ? ieee80211_rx+0x2a4/0x830 [mac80211]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf815a8d6\u003e] ? iwl_update_stats+0xa6/0x2a0 [iwlcore]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf8499212\u003e] ? iwlagn_rx_reply_rx+0x292/0x3b0 [iwlagn]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc05d83df\u003e] ? _raw_spin_lock_irqsave+0x2f/0x50\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf8483697\u003e] ? iwl_rx_handle+0xe7/0x350 [iwlagn]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cf8486ab7\u003e] ? iwl_irq_tasklet+0xf7/0x5c0 [iwlagn]\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc01aece1\u003e] ? __rcu_process_callbacks+0x201/0x2d0\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc0150d05\u003e] ? tasklet_action+0xc5/0x100\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc0150a07\u003e] ? __do_softirq+0x97/0x1d0\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc05d910c\u003e] ? nmi_stack_correct+0x2f/0x34\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc0150970\u003e] ? __do_softirq+0x0/0x1d0\nDec 15 14:36:41 User-PC kernel: [175576.124181] \u003cIRQ\u003e\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc01508f5\u003e] ? irq_exit+0x65/0x70\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc05df062\u003e] ? do_IRQ+0x52/0xc0\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc01036b0\u003e] ? common_interrupt+0x30/0x38\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc03a1fc2\u003e] ? intel_idle+0xc2/0x160\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc04daebb\u003e] ? cpuidle_idle_call+0x6b/0x100\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc0101dea\u003e] ? cpu_idle+0x8a/0xf0\nDec 15 14:36:41 User-PC kernel: [175576.124181] [\u003cc05d2702\u003e] ? start_secondary+0x1e8/0x1ee\n\nCc: David Miller \u003cdavem@davemloft.net\u003e\nCc: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nCc: Stephen Hemminger \u003cshemminger@vyatta.com\u003e\nSigned-off-by: Tomas Winkler \u003ctomas.winkler@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9f260e0efa4766e56d0ac14f1aeea6ee5eb8fe83", "tree": "a30573e33db58c6b084e02a50fd6f2bfd1cb90d7", "parents": [ "4a5fc4e179d79c79ad87bfc12a2d7e9b2371e40c" ], "author": { "name": "Dan Rosenberg", "email": "drosenberg@vsecurity.com", "time": "Sun Dec 26 06:54:53 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Dec 31 11:13:27 2010 -0800" }, "message": "CAN: Use inode instead of kernel address for /proc file\n\nSince the socket address is just being used as a unique identifier, its\ninode number is an alternative that does not leak potentially sensitive\ninformation.\n\nCC-ing stable because MITRE has assigned CVE-2010-4565 to the issue.\n\nSigned-off-by: Dan Rosenberg \u003cdrosenberg@vsecurity.com\u003e\nAcked-by: Oliver Hartkopp \u003csocketcan@hartkopp.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d7c1255a3a21e98bdc64df8ccf005a174d7e6289", "tree": "ded861029cdacd09b6c2e2de2896a671f71b02cf", "parents": [ "d3c7e1ab043abd7706db4fbccf327df9e62f7990", "fc75fc8339e7727167443469027540b283daac71" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 26 12:06:56 2010 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 26 12:06:56 2010 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits)\n ipv4: dont create routes on down devices\n epic100: hamachi: yellowfin: Fix skb allocation size\n sundance: Fix oopses with corrupted skb_shared_info\n Revert \"ipv4: Allow configuring subnets as local addresses\"\n USB: mcs7830: return negative if auto negotiate fails\n irda: prevent integer underflow in IRLMP_ENUMDEVICES\n tcp: fix listening_get_next()\n atl1c: Do not use legacy PCI power management\n mac80211: fix mesh forwarding\n MAINTAINERS: email address change\n net: Fix range checks in tcf_valid_offset().\n net_sched: sch_sfq: fix allot handling\n hostap: remove netif_stop_queue from init\n mac80211/rt2x00: add ieee80211_tx_status_ni()\n typhoon: memory corruption in typhoon_get_drvinfo()\n net: Add USB PID for new MOSCHIP USB ethernet controller MCS7832 variant\n net_sched: always clone skbs\n ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed.\n netlink: fix gcc -Wconversion compilation warning\n asix: add USB ID for Logitec LAN-GTJ U2A\n ...\n" }, { "commit": "fc75fc8339e7727167443469027540b283daac71", "tree": "f4e4a6b9554b157976d73db9f1ae2e93ddf6e24e", "parents": [ "7a36df8a857edee8cd8967cbe99a85574d22f482" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed Dec 22 04:39:39 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Dec 25 20:05:31 2010 -0800" }, "message": "ipv4: dont create routes on down devices\n\nIn ip_route_output_slow(), instead of allowing a route to be created on\na not UPed device, report -ENETUNREACH immediately.\n\n# ip tunnel add mode ipip remote 10.16.0.164 local\n10.16.0.72 dev eth0\n# (Note : tunl1 is down)\n# ping -I tunl1 10.1.2.3\nPING 10.1.2.3 (10.1.2.3) from 192.168.18.5 tunl1: 56(84) bytes of data.\n(nothing)\n# ./a.out tunl1\n# ip tunnel del tunl1\nMessage from syslogd@shelby at Dec 22 10:12:08 ...\n kernel: unregister_netdevice: waiting for tunl1 to become free.\nUsage count \u003d 3\n\nAfter patch:\n# ping -I tunl1 10.1.2.3\nconnect: Network is unreachable\n\nReported-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nReviewed-by: Octavian Purdila \u003copurdila@ixiacom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e058464990c2ef1f3ecd6b83a154913c3c06f02a", "tree": "1c949b22d8ed6ac0c1419f2bf2c372d8833b41d4", "parents": [ "0e214ad81545a35c5e62a4c2d6cf7275fd7a545f" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 23 12:03:57 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 23 12:03:57 2010 -0800" }, "message": "Revert \"ipv4: Allow configuring subnets as local addresses\"\n\nThis reverts commit 4465b469008bc03b98a1b8df4e9ae501b6c69d4b.\n\nConflicts:\n\n\tnet/ipv4/fib_frontend.c\n\nAs reported by Ben Greear, this causes regressions:\n\n\u003e Change 4465b469008bc03b98a1b8df4e9ae501b6c69d4b caused rules\n\u003e to stop matching the input device properly because the\n\u003e FLOWI_FLAG_MATCH_ANY_IIF is always defined in ip_dev_find().\n\u003e\n\u003e This breaks rules such as:\n\u003e\n\u003e ip rule add pref 512 lookup local\n\u003e ip rule del pref 0 lookup local\n\u003e ip link set eth2 up\n\u003e ip -4 addr add 172.16.0.102/24 broadcast 172.16.0.255 dev eth2\n\u003e ip rule add to 172.16.0.102 iif eth2 lookup local pref 10\n\u003e ip rule add iif eth2 lookup 10001 pref 20\n\u003e ip route add 172.16.0.0/24 dev eth2 table 10001\n\u003e ip route add unreachable 0/0 table 10001\n\u003e\n\u003e If you had a second interface \u0027eth0\u0027 that was on a different\n\u003e subnet, pinging a system on that interface would fail:\n\u003e\n\u003e [root@ct503-60 ~]# ping 192.168.100.1\n\u003e connect: Invalid argument\n\nReported-by: Ben Greear \u003cgreearb@candelatech.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fdac1e0697356ac212259f2147aa60c72e334861", "tree": "ce479592fda66f81e1058c02b813dbc168958197", "parents": [ "1bde5ac49398a064c753bb490535cfad89e99a5f" ], "author": { "name": "Dan Rosenberg", "email": "drosenberg@vsecurity.com", "time": "Wed Dec 22 13:58:27 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 23 10:09:43 2010 -0800" }, "message": "irda: prevent integer underflow in IRLMP_ENUMDEVICES\n\nIf the user-provided len is less than the expected offset, the\nIRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large\nsize value. While this isn\u0027t be a security issue on x86 because it will\nget caught by the access_ok() check, it may leak large amounts of kernel\nheap on other architectures. In any event, this patch fixes it.\n\nSigned-off-by: Dan Rosenberg \u003cdrosenberg@vsecurity.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1bde5ac49398a064c753bb490535cfad89e99a5f", "tree": "9a26c9da2be8e1a6eedc089dd7719e14ac9b184b", "parents": [ "b7e03ec9a6b9d0c0cb1e435026d46dfcd78e48ac" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Thu Dec 23 09:32:46 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 23 09:32:46 2010 -0800" }, "message": "tcp: fix listening_get_next()\n\nAlexey Vlasov found /proc/net/tcp could sometime loop and display\nmillions of sockets in LISTEN state.\n\nIn 2.6.29, when we converted TCP hash tables to RCU, we left two\nsk_next() calls in listening_get_next().\n\nWe must instead use sk_nulls_next() to properly detect an end of chain.\n\nReported-by: Alexey Vlasov \u003crenton@renton.name\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b7e03ec9a6b9d0c0cb1e435026d46dfcd78e48ac", "tree": "eb00fdc7f8ea3132e0eee3eb1a5925df73f5d859", "parents": [ "762e30239cce9ff0d82227ade663feed2f6283d8", "b51aff057c9d0ef6c529dc25fd9f775faf7b6c63" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 22 17:34:40 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 22 17:34:40 2010 -0800" }, "message": "Merge branch \u0027master\u0027 of ssh://master.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "b51aff057c9d0ef6c529dc25fd9f775faf7b6c63", "tree": "57f268b9553fa77f5a5337fb5be4355c63b44d1b", "parents": [ "b2b7ab22fa2e619c20917e825c0da7212ca2efc9" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Dec 22 10:15:07 2010 +0100" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Dec 22 13:36:35 2010 -0500" }, "message": "mac80211: fix mesh forwarding\n\nUnder memory pressure, the mac80211 mesh code\nmay helpfully print a message that it failed\nto clone a mesh frame and then will proceed\nto crash trying to use it anyway. Fix that.\n\nCc: stable@kernel.org [2.6.27+]\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nAcked-by: Javier Cardona \u003cjavier@cozybit.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "9d5004fcf6e4e8caa9efbc25c9f85059b165329c", "tree": "7f1b53d5487ffabb7be6e1f5b5b964448651b5bc", "parents": [ "453434cf3fdcd3954bb52460e37d4945a0913d3e", "361cf40519a491f68b28ad90225e4611c4bf8e12" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 20 21:32:20 2010 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 20 21:32:20 2010 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:\n ceph: handle partial result from get_user_pages\n ceph: mark user pages dirty on direct-io reads\n ceph: fix null pointer dereference in ceph_init_dentry for nfs reexport\n ceph: fix direct-io on non-page-aligned buffers\n ceph: fix msgr_init error path\n" }, { "commit": "aa3e219997e4b949be4199660936099ded0b401f", "tree": "e463d695dbf0e92f7fd2c6b3132bbb9c38493829", "parents": [ "914e5cea14b2e4651cdb0707e0936b43246deda0" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Mon Dec 20 13:18:16 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Dec 20 13:18:16 2010 -0800" }, "message": "net_sched: sch_sfq: fix allot handling\n\nWhen deploying SFQ/IFB here at work, I found the allot management was\npretty wrong in sfq, even changing allot from short to int...\n\nWe should init allot for each new flow, not using a previous value found\nin slot.\n\nBefore patch, I saw bursts of several packets per flow, apparently\ndenying the default \"quantum 1514\" limit I had on my SFQ class.\n\nclass sfq 11:1 parent 11: \n (dropped 0, overlimits 0 requeues 0) \n backlog 0b 7p requeues 0 \n allot 11546 \n\nclass sfq 11:46 parent 11: \n (dropped 0, overlimits 0 requeues 0) \n backlog 0b 1p requeues 0 \n allot -23873 \n\nclass sfq 11:78 parent 11: \n (dropped 0, overlimits 0 requeues 0) \n backlog 0b 5p requeues 0 \n allot 11393 \n\nAfter patch, better fairness among each flow, allot limit being\nrespected, allot is positive :\n\nclass sfq 11:e parent 11: \n (dropped 0, overlimits 0 requeues 86) \n backlog 0b 3p requeues 86 \n allot 596 \n\nclass sfq 11:94 parent 11: \n (dropped 0, overlimits 0 requeues 0) \n backlog 0b 3p requeues 0 \n allot 1468 \n\nclass sfq 11:a4 parent 11: \n (dropped 0, overlimits 0 requeues 0) \n backlog 0b 4p requeues 0 \n allot 650 \n\nclass sfq 11:bb parent 11: \n (dropped 0, overlimits 0 requeues 0) \n backlog 0b 3p requeues 0 \n allot 596 \n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ad0081e43af6de3fecf308b0d098f9611835766b", "tree": "76f25d2666ed36e4668bd0897a4de23bd601c7b8", "parents": [ "4b8fe66300acb2fba8b16d62606e0d30204022fc" ], "author": { "name": "David Stevens", "email": "dlstevens@us.ibm.com", "time": "Fri Dec 17 11:42:42 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Dec 19 20:22:23 2010 -0800" }, "message": "ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed.\n\nThis patch modifies IPsec6 to fragment IPv6 packets that are\nlocally generated as needed.\n\nThis version of the patch only fragments in tunnel mode, so that fragment\nheaders will not be obscured by ESP in transport mode.\n\nSigned-off-by: David L Stevens \u003cdlstevens@us.ibm.com\u003e\nAcked-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "361cf40519a491f68b28ad90225e4611c4bf8e12", "tree": "ac0a77f2d6b36d4140bbaf3b8c14a37e8ae1ef11", "parents": [ "b6aa5901c7a2bd90d0b6b9866300d2648b2568f3" ], "author": { "name": "Henry C Chang", "email": "henry_c_chang@tcloudcomputing.com", "time": "Fri Dec 17 09:55:59 2010 -0800" }, "committer": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Fri Dec 17 09:55:59 2010 -0800" }, "message": "ceph: handle partial result from get_user_pages\n\nThe get_user_pages() helper can return fewer than the requested pages.\nError out in that case, and clean up the partial result.\n\nSigned-off-by: Henry C Chang \u003chenry_c_chang@tcloudcomputing.com\u003e\nSigned-off-by: Sage Weil \u003csage@newdream.net\u003e\n" }, { "commit": "b6aa5901c7a2bd90d0b6b9866300d2648b2568f3", "tree": "1161ed9dbacb7ace73c5d48fc9acd1db0d7815d5", "parents": [ "92cf765237e2787eb168096305c448caf25ac7f8" ], "author": { "name": "Henry C Chang", "email": "henry_c_chang@tcloudcomputing.com", "time": "Wed Dec 15 20:45:41 2010 -0800" }, "committer": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Fri Dec 17 09:54:40 2010 -0800" }, "message": "ceph: mark user pages dirty on direct-io reads\n\nFor read operation, we have to set the argument _write_ of get_user_pages\nto 1 since we will write data to pages. Also, we need to SetPageDirty before\nreleasing these pages.\n\nSigned-off-by: Henry C Chang \u003chenry_c_chang@tcloudcomputing.com\u003e\nSigned-off-by: Sage Weil \u003csage@newdream.net\u003e\n" }, { "commit": "29ba5fed1bbd09c2cba890798c8f9eaab251401d", "tree": "b3e553db3b756b3714dcce42cd92f2e6bb266ddc", "parents": [ "7d743b7e952261f4d9ee091100b6403f3ce8a2af" ], "author": { "name": "stephen hemminger", "email": "shemminger@vyatta.com", "time": "Thu Dec 16 11:28:12 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 16 18:26:26 2010 -0800" }, "message": "ipv6: don\u0027t flush routes when setting loopback down\n\nWhen loopback device is being brought down, then keep the route table\nentries because they are special. The entries in the local table for\nlinklocal routes and ::1 address should not be purged.\n\nThis is a sub optimal solution to the problem and should be replaced\nby a better fix in future.\n\nSigned-off-by: Stephen Hemminger \u003cshemminger@vyatta.com\u003e\nAcked-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7d743b7e952261f4d9ee091100b6403f3ce8a2af", "tree": "9829009c63ccebbf65b4cca63c1eb4e14b8e5fd1", "parents": [ "0b7967503dc97864f283a3a06fbe23e041876138" ], "author": { "name": "Wei Yongjun", "email": "yjwei@cn.fujitsu.com", "time": "Tue Dec 14 16:10:41 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 16 14:48:44 2010 -0800" }, "message": "sctp: fix the return value of getting the sctp partial delivery point\n\nGet the sctp partial delivery point using SCTP_PARTIAL_DELIVERY_POINT\nsocket option should return 0 if success, not -ENOTSUPP.\n\nSigned-off-by: Wei Yongjun \u003cyjwei@cn.fujitsu.com\u003e\nAcked-by: Vlad Yasevich \u003cvladislav.yasevich@hp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "76d661586c8131453ba75a2e027c1f21511a893a", "tree": "3a3812b18ff0d959edf6be20236dde4eb8f8b524", "parents": [ "fcbdf09d9652c8919dcf47072e3ae7dcb4eb98ac" ], "author": { "name": "David Stevens", "email": "dlstevens@us.ibm.com", "time": "Tue Dec 14 08:42:16 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 16 14:41:23 2010 -0800" }, "message": "bridge: fix IPv6 queries for bridge multicast snooping\n\nThis patch fixes a missing ntohs() for bridge IPv6 multicast snooping.\n\nSigned-off-by: David L Stevens \u003cdlstevens@us.ibm.com\u003e\nAcked-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fcbdf09d9652c8919dcf47072e3ae7dcb4eb98ac", "tree": "51e3cc1fbd813a880ea09dc31a12683b73d87e05", "parents": [ "2984961c388381c1830f95e1c2dc2137301b1009" ], "author": { "name": "Octavian Purdila", "email": "opurdila@ixiacom.com", "time": "Thu Dec 16 14:26:56 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 16 14:26:56 2010 -0800" }, "message": "net: fix nulls list corruptions in sk_prot_alloc\n\nSpecial care is taken inside sk_port_alloc to avoid overwriting\nskc_node/skc_nulls_node. We should also avoid overwriting\nskc_bind_node/skc_portaddr_node.\n\nThe patch fixes the following crash:\n\n BUG: unable to handle kernel paging request at fffffffffffffff0\n IP: [\u003cffffffff812ec6dd\u003e] udp4_lib_lookup2+0xad/0x370\n [\u003cffffffff812ecc22\u003e] __udp4_lib_lookup+0x282/0x360\n [\u003cffffffff812ed63e\u003e] __udp4_lib_rcv+0x31e/0x700\n [\u003cffffffff812bba45\u003e] ? ip_local_deliver_finish+0x65/0x190\n [\u003cffffffff812bbbf8\u003e] ? ip_local_deliver+0x88/0xa0\n [\u003cffffffff812eda35\u003e] udp_rcv+0x15/0x20\n [\u003cffffffff812bba45\u003e] ip_local_deliver_finish+0x65/0x190\n [\u003cffffffff812bbbf8\u003e] ip_local_deliver+0x88/0xa0\n [\u003cffffffff812bb2cd\u003e] ip_rcv_finish+0x32d/0x6f0\n [\u003cffffffff8128c14c\u003e] ? netif_receive_skb+0x99c/0x11c0\n [\u003cffffffff812bb94b\u003e] ip_rcv+0x2bb/0x350\n [\u003cffffffff8128c14c\u003e] netif_receive_skb+0x99c/0x11c0\n\nSigned-off-by: Leonard Crestez \u003clcrestez@ixiacom.com\u003e\nSigned-off-by: Octavian Purdila \u003copurdila@ixiacom.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d3052b557a1c94c21f50465702fa886753ce6b43", "tree": "5a48598ed08bef56cc71355f84eff04f13622780", "parents": [ "af3e5bd5f650163c2e12297f572910a1af1b8236" ], "author": { "name": "Andrey Vagin", "email": "avagin@openvz.org", "time": "Sat Dec 11 15:20:11 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 16 12:28:13 2010 -0800" }, "message": "ipv6: delete expired route in ip6_pmtu_deliver\n\nThe first big packets sent to a \"low-MTU\" client correctly\ntriggers the creation of a temporary route containing the reduced MTU.\n\nBut after the temporary route has expired, new ICMP6 \"packet too big\"\nwill be sent, rt6_pmtu_discovery will find the previous EXPIRED route\ncheck that its mtu isn\u0027t bigger then in icmp packet and do nothing\nbefore the temporary route will not deleted by gc.\n\nI make the simple experiment:\nwhile :; do\n time ( dd if\u003d/dev/zero bs\u003d10K count\u003d1 | ssh hostname dd of\u003d/dev/null ) || break;\ndone\n\nThe \"time\" reports real 0m0.197s if a temporary route isn\u0027t expired, but\nit reports real 0m52.837s (!!!!) immediately after a temporare route has\nexpired.\n\nSigned-off-by: Andrey Vagin \u003cavagin@openvz.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "82cc4f5cb8be6dede34c32a814ab1470409e1840", "tree": "1ab46942502a2841479c8a614d5bca8a7901227a", "parents": [ "2a27a03d3a891e87ca33d27a858b4db734a4cbab", "56e6417b49132d4f56e9f2241d31942b90b46315" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 15 09:43:13 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 15 09:43:13 2010 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "b4fe2a03422e6bd20bd8df5e428109a85c9ea961", "tree": "b6505c0599251421fef39c9fa0655f255aac9ed6", "parents": [ "85cb7f1264c4d9e60ccdce52740238222e77ccd0", "2a27a03d3a891e87ca33d27a858b4db734a4cbab" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 14 17:33:40 2010 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 14 17:33:40 2010 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (75 commits)\n pppoe.c: Fix kernel panic caused by __pppoe_xmit\n WAN: Fix a TX IRQ causing BUG() in PC300 and PCI200SYN drivers.\n bnx2x: Advance a version number to 1.60.01-0\n bnx2x: Fixed a compilation warning\n bnx2x: LSO code was broken on BE platforms\n qlge: Fix deadlock when cancelling worker.\n net: fix skb_defer_rx_timestamp()\n cxgb4vf: Ingress Queue Entry Size needs to be 64 bytes\n phy: add the IC+ IP1001 driver\n atm: correct sysfs \u0027device\u0027 link creation and parent relationships\n MAINTAINERS: remove me from tulip\n SCTP: Fix SCTP_SET_PEER_PRIMARY_ADDR to accpet v4mapped address\n enic: Bug Fix: Pass napi reference to the isr that services receive queue\n ipv6: fix nl group when advertising a new link\n connector: add module alias\n net: Document the kernel_recvmsg() function\n r8169: Fix runtime power management\n hso: IP checksuming doesn\u0027t work on GE0301 option cards\n xfrm: Fix xfrm_state_migrate leak\n net: Convert netpoll blocking api in bonding driver to be a counter\n ...\n" }, { "commit": "d96c9043d1588f04c7f467167f653c07d83232d5", "tree": "d4b68d2ee371db0287902cae2a27f37749e8e1c9", "parents": [ "1cd275f609ba46c8cae3ee77e499c54a0d13a983" ], "author": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Mon Dec 13 20:30:28 2010 -0800" }, "committer": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Mon Dec 13 20:30:28 2010 -0800" }, "message": "ceph: fix msgr_init error path\n\ncreate_workqueue() returns NULL on failure.\n\nSigned-off-by: Sage Weil \u003csage@newdream.net\u003e\n" }, { "commit": "8808f64171deec62346888e156e3adb636e2a31a", "tree": "7f34fd8c560b0fdb4426fe4dfcf16029a8ccb3c6", "parents": [ "16cad7fba037b34ca32cc0adac65bc089d969fb8" ], "author": { "name": "Herton Ronaldo Krzesinski", "email": "herton@mandriva.com.br", "time": "Mon Dec 13 11:43:51 2010 -0200" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Dec 13 14:55:08 2010 -0500" }, "message": "mac80211: avoid calling ieee80211_work_work unconditionally\n\nOn suspend, there might be usb wireless drivers which wrongly trigger\nthe warning in ieee80211_work_work. If an usb driver doesn\u0027t have a\nsuspend hook, the usb stack will disconnect the device. On disconnect,\na mac80211 driver calls ieee80211_unregister_hw, which calls dev_close,\nwhich calls ieee80211_stop, and in the end calls ieee80211_work_purge-\u003e\nieee80211_work_work.\n\nThe problem is that this call to ieee80211_work_purge comes after\nmac80211 is suspended, triggering the warning even when we don\u0027t have\nwork queued in work_list (the expected case when already suspended),\nbecause it always calls ieee80211_work_work.\n\nSo, just call ieee80211_work_work in ieee80211_work_purge if we really\nhave to abort work. This addresses the warning reported at\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d24402\n\nSigned-off-by: Herton Ronaldo Krzesinski \u003cherton@mandriva.com.br\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "c926d006c1514cfb3572893f41f2324e96823661", "tree": "b76f1ac5f172f7a5ee47da767cdc31bd4e164e32", "parents": [ "4a55d5852adbe66722fb1636c82c7864cd5be441" ], "author": { "name": "Tim Harvey", "email": "harvey.tim@gmail.com", "time": "Thu Dec 09 10:43:13 2010 -0800" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Dec 13 14:53:46 2010 -0500" }, "message": "mac80211: Fix NULL-pointer deference on ibss merge when not ready\n\ndev_open will eventually call ieee80211_ibss_join which sets up the\nskb used for beacons/probe-responses however it is possible to\nreceive beacons that attempt to merge before this occurs causing\na null pointer dereference. Check ssid_len as that is the last\nthing set in ieee80211_ibss_join.\n\nThis occurs quite easily in the presence of adhoc nodes with hidden SSID\u0027s\n\nrevised previous patch to check further up based on irc feedback\n\nSigned-off-by: Tim Harvey \u003charvey.tim@gmail.com\u003e\nReviewed-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "10c38c3306c04ec26b1536d30b8b11ccab32faa5", "tree": "3aada0b8d12cb8d67c88fa39c4ad71ac7b2cef27", "parents": [ "6942fec92d3d1b6918425730de31b4c6d0d5c196", "d9319560b86839506c2011346b1f2e61438a3c73" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Dec 13 14:41:23 2010 -0500" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Dec 13 14:41:23 2010 -0500" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6\n" }, { "commit": "a19faf0250e09b16cac169354126404bc8aa342b", "tree": "1d77cd6906181069ef3b5d1508c99c9a02f3e340", "parents": [ "c710245caa41060e983cc9cb5ffcc020e02ca45f" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Sun Dec 05 18:50:32 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Dec 10 16:20:56 2010 -0800" }, "message": "net: fix skb_defer_rx_timestamp()\n\nAfter commit c1f19b51d1d8 (net: support time stamping in phy devices.),\nkernel might crash if CONFIG_NETWORK_PHY_TIMESTAMPING\u003dy and\nskb_defer_rx_timestamp() handles a packet without an ethernet header.\n\nFixes kernel bugzilla #24102\n\nReference: https://bugzilla.kernel.org/show_bug.cgi?id\u003d24102\nReported-and-tested-by: Andrew Watts \u003cakwatts@ymail.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d9ca676bcb26e1fdff9265a3e70f697cd381c889", "tree": "72ab0bf8cb22291eb4e1a57329bb8e1df2b7649f", "parents": [ "fb890ae7d615f4b4f5689144b6832230ab2046aa" ], "author": { "name": "Dan Williams", "email": "dcbw@redhat.com", "time": "Wed Dec 08 19:40:47 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Dec 10 15:45:05 2010 -0800" }, "message": "atm: correct sysfs \u0027device\u0027 link creation and parent relationships\n\nThe ATM subsystem was incorrectly creating the \u0027device\u0027 link for ATM\nnodes in sysfs. This led to incorrect device/parent relationships\nexposed by sysfs and udev. Instead of rolling the \u0027device\u0027 link by hand\nin the generic ATM code, pass each ATM driver\u0027s bus device down to the\nsysfs code and let sysfs do this stuff correctly.\n\nSigned-off-by: Dan Williams \u003cdcbw@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "40a010395cd66053f07bffeb3da5e44683bac30e", "tree": "f734e8da3145553bd47416d27c33e62435a39e52", "parents": [ "79aeec5822cea63cf732bbc0c9f3337542352616" ], "author": { "name": "Wei Yongjun", "email": "yjwei@cn.fujitsu.com", "time": "Tue Dec 07 17:11:09 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Dec 10 15:29:49 2010 -0800" }, "message": "SCTP: Fix SCTP_SET_PEER_PRIMARY_ADDR to accpet v4mapped address\n\nSCTP_SET_PEER_PRIMARY_ADDR does not accpet v4mapped address, using\nv4mapped address in SCTP_SET_PEER_PRIMARY_ADDR socket option will\nget -EADDRNOTAVAIL error if v4map is enabled. This patch try to\nfix it by mapping v4mapped address to v4 address if allowed.\n\nSigned-off-by: Wei Yongjun \u003cyjwei@cn.fujitsu.com\u003e\nAcked-by: Vlad Yasevich \u003cvladislav.yasevich@hp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e91db5cd6f2203ef2a93ce8770f2728e9107c4f7", "tree": "210668b645b5d63cecf6c876c011b2cf3f9a5122", "parents": [ "5f75a1042feca37c0a436ba42a4b1f7f75c35778", "0a54917c3fc295cb61f3fb52373c173fd3b69f48" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Dec 10 12:51:02 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Dec 10 12:51:02 2010 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "5f75a1042feca37c0a436ba42a4b1f7f75c35778", "tree": "6738a8642df1f0f7c18a90368da2d80d33f092a5", "parents": [ "3700c3c2934467d53d443682f020cc5c1f75f1f2" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Tue Dec 07 23:38:31 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Dec 10 12:49:36 2010 -0800" }, "message": "ipv6: fix nl group when advertising a new link\n\nNew idev are advertised with NL group RTNLGRP_IPV6_IFADDR, but\nshould use RTNLGRP_IPV6_IFINFO.\nBug was introduced by commit 8d7a76c9.\n\nSigned-off-by: Wang Xuefu \u003cxuefu.wang@6wind.com\u003e\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nAcked-by: Thomas Graf \u003ctgraf@infradead.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c1249c0aae4c93a753c70496ab2e9a51430a6f02", "tree": "4e2905d99365e3d7cc1a09cd8681b1e7dd31b867", "parents": [ "e4fbce740f078bbc925ba5c86648d9c883968479" ], "author": { "name": "Martin Lucina", "email": "mato@kotelna.sk", "time": "Fri Dec 10 00:04:05 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Dec 10 11:13:18 2010 -0800" }, "message": "net: Document the kernel_recvmsg() function\n\nSigned-off-by: Martin Lucina \u003cmato@kotelna.sk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "78347c8c6b2ddf20535bc1b18d749a3bbdea2a60", "tree": "2aa2048f11a93c4319b023e938eee387d19c96f4", "parents": [ "fb4fa76a1fa59340154c42d998d700e1f8bf21e0" ], "author": { "name": "Thomas Egerer", "email": "thomas.egerer@secunet.com", "time": "Mon Dec 06 23:28:56 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 09 20:35:27 2010 -0800" }, "message": "xfrm: Fix xfrm_state_migrate leak\n\nxfrm_state_migrate calls kfree instead of xfrm_state_put to free\na failed state. According to git commit 553f9118 this can cause\nmemory leaks.\n\nSigned-off-by: Thomas Egerer \u003cthomas.egerer@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nAcked-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4e085e76cbe558b79b54cbab772f61185879bc64", "tree": "d70aa6d1045a2759bfc67b4eafbb0199f5877b1c", "parents": [ "f19872575ff7819a3723154657a497d9bca66b33" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 18:42:23 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 20:51:15 2010 -0800" }, "message": "econet: Fix crash in aun_incoming().\n\nUnconditional use of skb-\u003edev won\u0027t work here,\ntry to fetch the econet device via skb_dst()-\u003edev\ninstead.\n\nSuggested by Eric Dumazet.\n\nReported-by: Nelson Elhage \u003cnelhage@ksplice.com\u003e\nTested-by: Nelson Elhage \u003cnelhage@ksplice.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f19872575ff7819a3723154657a497d9bca66b33", "tree": "3c84b591c773611a6c4c00589f69a6639e83b8e0", "parents": [ "ad9f4f50fe9288bbe65b7dfd76d8820afac6a24c" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Tue Dec 07 12:20:47 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 12:34:09 2010 -0800" }, "message": "tcp: protect sysctl_tcp_cookie_size reads\n\nMake sure sysctl_tcp_cookie_size is read once in\ntcp_cookie_size_check(), or we might return an illegal value to caller\nif sysctl_tcp_cookie_size is changed by another cpu.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nCc: William Allen Simpson \u003cwilliam.allen.simpson@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ad9f4f50fe9288bbe65b7dfd76d8820afac6a24c", "tree": "f3f3100da8d042607bbbab31c1f8a060ba2b5f15", "parents": [ "c7757fdb41dfcf6add9f8a4576eb85aa5e77a4eb" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Tue Dec 07 12:03:55 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 12:34:08 2010 -0800" }, "message": "tcp: avoid a possible divide by zero\n\nsysctl_tcp_tso_win_divisor might be set to zero while one cpu runs in\ntcp_tso_should_defer(). Make sure we dont allow a divide by zero by\nreading sysctl_tcp_tso_win_divisor exactly once.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7e2447075690860e2cea96b119fc9cadbaa7e83c", "tree": "1bede27944240867d96e0440fbadb254b04368cd", "parents": [ "f933ebed7888a9a7d73ebeeb6bcbb3f710c423b4" ], "author": { "name": "Helmut Schaa", "email": "helmut.schaa@googlemail.com", "time": "Thu Dec 02 18:44:09 2010 +0100" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Dec 08 15:23:48 2010 -0500" }, "message": "mac80211: Fix BUG in pskb_expand_head when transmitting shared skbs\n\nmac80211 doesn\u0027t handle shared skbs correctly at the moment. As a result\na possible resize can trigger a BUG in pskb_expand_head.\n\n[ 676.030000] Kernel bug detected[#1]:\n[ 676.030000] Cpu 0\n[ 676.030000] $ 0 : 00000000 00000000 819662ff 00000002\n[ 676.030000] $ 4 : 81966200 00000020 00000000 00000020\n[ 676.030000] $ 8 : 819662e0 800043c0 00000002 00020000\n[ 676.030000] $12 : 3b9aca00 00000000 00000000 00470000\n[ 676.030000] $16 : 80ea2000 00000000 00000000 00000000\n[ 676.030000] $20 : 818aa200 80ea2018 80ea2000 00000008\n[ 676.030000] $24 : 00000002 800ace5c\n[ 676.030000] $28 : 8199a000 8199bd20 81938f88 80f180d4\n[ 676.030000] Hi : 0000026e\n[ 676.030000] Lo : 0000757e\n[ 676.030000] epc : 801245e4 pskb_expand_head+0x44/0x1d8\n[ 676.030000] Not tainted\n[ 676.030000] ra : 80f180d4 ieee80211_skb_resize+0xb0/0x114 [mac80211]\n[ 676.030000] Status: 1000a403 KERNEL EXL IE\n[ 676.030000] Cause : 10800024\n[ 676.030000] PrId : 0001964c (MIPS 24Kc)\n[ 676.030000] Modules linked in: mac80211_hwsim rt2800lib rt2x00soc rt2x00pci rt2x00lib mac80211 crc_itu_t crc_ccitt cfg80211 compat arc4 aes_generic deflate ecb cbc [last unloaded: rt2800pci]\n[ 676.030000] Process kpktgend_0 (pid: 97, threadinfo\u003d8199a000, task\u003d81879f48, tls\u003d00000000)\n[ 676.030000] Stack : ffffffff 00000000 00000000 00000014 00000004 80ea2000 00000000 00000000\n[ 676.030000] 818aa200 80f180d4 ffffffff 0000000a 81879f78 81879f48 81879f48 00000018\n[ 676.030000] 81966246 80ea2000 818432e0 80f1a420 80203050 81814d98 00000001 81879f48\n[ 676.030000] 81879f48 00000018 81966246 818432e0 0000001a 8199bdd4 0000001c 80f1b72c\n[ 676.030000] 80203020 8001292c 80ef4aa2 7f10b55d 801ab5b8 81879f48 00000188 80005c90\n[ 676.030000] ...\n[ 676.030000] Call Trace:\n[ 676.030000] [\u003c801245e4\u003e] pskb_expand_head+0x44/0x1d8\n[ 676.030000] [\u003c80f180d4\u003e] ieee80211_skb_resize+0xb0/0x114 [mac80211]\n[ 676.030000] [\u003c80f1a420\u003e] ieee80211_xmit+0x150/0x22c [mac80211]\n[ 676.030000] [\u003c80f1b72c\u003e] ieee80211_subif_start_xmit+0x6f4/0x73c [mac80211]\n[ 676.030000] [\u003c8014361c\u003e] pktgen_thread_worker+0xfac/0x16f8\n[ 676.030000] [\u003c8002ebe8\u003e] kthread+0x7c/0x88\n[ 676.030000] [\u003c80008e0c\u003e] kernel_thread_helper+0x10/0x18\n[ 676.030000]\n[ 676.030000]\n[ 676.030000] Code: 24020001 10620005 2502001f \u003c0200000d\u003e 0804917a 00000000 2502001f 00441023 00531021\n\nFix this by making a local copy of shared skbs prior to mangeling them.\nTo avoid copying the skb unnecessarily move the skb_copy call below the\nchecks that don\u0027t need write access to the skb.\n\nAlso, move the assignment of nh_pos and h_pos below the skb_copy to point\nto the correct skb.\n\nIt would be possible to avoid another resize of the copied skb by using\nskb_copy_expand instead of skb_copy but that would make the patch more\ncomplex. Also, shared skbs are a corner case right now, so the resize\nshouldn\u0027t matter much.\n\nCc: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nSigned-off-by: Helmut Schaa \u003chelmut.schaa@googlemail.com\u003e\nCc: stable@kernel.org\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "67631510a318d5a930055fe927607f483716e100", "tree": "fd98bd3ab939a22188c72d4371c263af2d756192", "parents": [ "171995e5d82dcc92bea37a7d2a2ecc21068a0f19" ], "author": { "name": "Tom Herbert", "email": "therbert@google.com", "time": "Wed Dec 08 12:16:33 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 12:16:33 2010 -0800" }, "message": "tcp: Replace time wait bucket msg by counter\n\nRather than printing the message to the log, use a mib counter to keep\ntrack of the count of occurences of time wait bucket overflow. Reduces\nspam in logs.\n\nSigned-off-by: Tom Herbert \u003ctherbert@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "171995e5d82dcc92bea37a7d2a2ecc21068a0f19", "tree": "d0c6d6650a244f4860edff9f9d20ae9ea98dd85f", "parents": [ "408cc293c29ada769ae772420a39961320da1854" ], "author": { "name": "Apollon Oikonomopoulos", "email": "apollon@noc.grnet.gr", "time": "Tue Dec 07 09:43:30 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 12:13:44 2010 -0800" }, "message": "x25: decrement netdev reference counts on unload\n\nx25 does not decrement the network device reference counts on module unload.\nThus unregistering any pre-existing interface after unloading the x25 module\nhangs and results in\n\n unregister_netdevice: waiting for tap0 to become free. Usage count \u003d 1\n\nThis patch decrements the reference counts of all interfaces in x25_link_free,\nthe way it is already done in x25_link_device_down for NETDEV_DOWN events.\n\nSigned-off-by: Apollon Oikonomopoulos \u003capollon@noc.grnet.gr\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e8d34a884e4ff118920bb57664def8a73b1b784f", "tree": "50c6e3f7e576fd6941cc8071ff86c14d26295b8d", "parents": [ "0c62fc6dd02c8d793c75ae76a9b6881fc36388ad" ], "author": { "name": "Michal Marek", "email": "mmarek@suse.cz", "time": "Mon Dec 06 02:39:12 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 12:13:43 2010 -0800" }, "message": "l2tp: Fix modalias of l2tp_ip\n\nUsing the SOCK_DGRAM enum results in\n\"net-pf-2-proto-SOCK_DGRAM-type-115\", so use the numeric value like it\nis done in net/dccp.\n\nSigned-off-by: Michal Marek \u003cmmarek@suse.cz\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0c62fc6dd02c8d793c75ae76a9b6881fc36388ad", "tree": "49dbe734dc75fe318ca83e2eae823fbeae10dc48", "parents": [ "083384755252cde25af187acf1807a0f5edb901f" ], "author": { "name": "Nelson Elhage", "email": "nelhage@ksplice.com", "time": "Wed Dec 08 10:13:55 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 12:13:42 2010 -0800" }, "message": "econet: Do the correct cleanup after an unprivileged SIOCSIFADDR.\n\nWe need to drop the mutex and do a dev_put, so set an error code and break like\nthe other paths, instead of returning directly.\n\nSigned-off-by: Nelson Elhage \u003cnelhage@ksplice.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "35d9b0c906ad92d32a0b8db5daa6fabfcc2f068d", "tree": "d9cdc72902f327ff377dd8bedfaeb0a8eead24a5", "parents": [ "75c1c82566f23dd539fb7ccbf57a1caa7ba82628" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Sun Dec 05 02:03:26 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 09:58:44 2010 -0800" }, "message": "llc: fix a device refcount imbalance\n\nLe dimanche 05 décembre 2010 à 12:23 +0100, Eric Dumazet a écrit :\n\u003e Le dimanche 05 décembre 2010 à 09:19 +0100, Eric Dumazet a écrit :\n\u003e\n\u003e \u003e Hmm..\n\u003e \u003e\n\u003e \u003e If somebody can explain why RTNL is held in arp_ioctl() (and therefore\n\u003e \u003e in arp_req_delete()), we might first remove RTNL use in arp_ioctl() so\n\u003e \u003e that your patch can be applied.\n\u003e \u003e\n\u003e \u003e Right now it is not good, because RTNL wont be necessarly held when you\n\u003e \u003e are going to call arp_invalidate() ?\n\u003e\n\u003e While doing this analysis, I found a refcount bug in llc, I\u0027ll send a\n\u003e patch for net-2.6\n\nOh well, of course I must first fix the bug in net-2.6, and wait David\npull the fix in net-next-2.6 before sending this rcu conversion.\n\nNote: this patch should be sent to stable teams (2.6.34 and up)\n\n[PATCH net-2.6] llc: fix a device refcount imbalance\n\ncommit abf9d537fea225 (llc: add support for SO_BINDTODEVICE) added one\nrefcount imbalance in llc_ui_bind(), because dev_getbyhwaddr() doesnt\ntake a reference on device, while dev_get_by_index() does.\n\nFix this using RCU locking. And since an RCU conversion will be done for\n2.6.38 for dev_getbyhwaddr(), put the rcu_read_lock/unlock exactly at\ntheir final place.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: stable@kernel.org\nCc: Octavian Purdila \u003copurdila@ixiacom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b1afde60f2b9ee8444fba4e012dc99a3b28d224d", "tree": "b1c37e988a51f9823471a5d6ac83023ed4f06197", "parents": [ "ce9aeb583a1071304d0e4ab8db600bfc8a6a1b44" ], "author": { "name": "Nandita Dukkipati", "email": "nanditad@google.com", "time": "Fri Dec 03 13:33:44 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 09:38:37 2010 -0800" }, "message": "tcp: Bug fix in initialization of receive window.\n\nThe bug has to do with boundary checks on the initial receive window.\nIf the initial receive window falls between init_cwnd and the\nreceive window specified by the user, the initial window is incorrectly\nbrought down to init_cwnd. The correct behavior is to allow it to\nremain unchanged.\n\nSigned-off-by: Nandita Dukkipati \u003cnanditad@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4f58605e6b7ae30a0d048af6a868582768e6754c", "tree": "2b72e81761c7874b48825267958e58823e05b592", "parents": [ "b8eb3a1046f68a5b8f284830d971c62688cd606b", "d89197c7f34934fbb0f96d938a0d6cfe0b8bcb1c" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 08:13:01 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 08 08:13:01 2010 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "ed2849d3ecfa339435818eeff28f6c3424300cec", "tree": "2fbef743779156c2c96afecd8311ff8488a90121", "parents": [ "cf7d7e5a1980d1116ee152d25dac382b112b9c17" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Tue Nov 16 16:55:19 2010 +1100" }, "committer": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Tue Dec 07 20:39:55 2010 -0500" }, "message": "sunrpc: prevent use-after-free on clearing XPT_BUSY\n\nWhen an xprt is created, it has a refcount of 1, and XPT_BUSY is set.\nThe refcount is *not* owned by the thread that created the xprt\n(as is clear from the fact that creators never put the reference).\nRather, it is owned by the absence of XPT_DEAD. Once XPT_DEAD is set,\n(And XPT_BUSY is clear) that initial reference is dropped and the xprt\ncan be freed.\n\nSo when a creator clears XPT_BUSY it is dropping its only reference and\nso must not touch the xprt again.\n\nHowever svc_recv, after calling -\u003expo_accept (and so getting an XPT_BUSY\nreference on a new xprt), calls svc_xprt_recieved. This clears\nXPT_BUSY and then svc_xprt_enqueue - this last without owning a reference.\nThis is dangerous and has been seen to leave svc_xprt_enqueue working\nwith an xprt containing garbage.\n\nSo we need to hold an extra counted reference over that call to\nsvc_xprt_received.\n\nFor safety, any time we clear XPT_BUSY and then use the xprt again, we\nfirst get a reference, and the put it again afterwards.\n\nNote that svc_close_all does not need this extra protection as there are\nno threads running, and the final free can only be called asynchronously\nfrom such a thread.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nCc: stable@kernel.org\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\n" }, { "commit": "183f732c3f3f307d5673e17b69de6894e1dd2918", "tree": "3c5641374b15ee4a31b28cbdc071356058065436", "parents": [ "d89197c7f34934fbb0f96d938a0d6cfe0b8bcb1c" ], "author": { "name": "Johan Hedberg", "email": "johan.hedberg@nokia.com", "time": "Mon Dec 06 15:56:17 2010 +0200" }, "committer": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Mon Dec 06 15:47:44 2010 -0200" }, "message": "Bluetooth: Fix initial RFCOMM DLC security level\n\nDue to commit 63ce0900 connections initiated through TTYs created with\n\"rfcomm bind ...\" would have security level BT_SECURITY_SDP instead of\nBT_SECURITY_LOW. This would cause instant connection failure between any\ntwo SSP capable devices due to the L2CAP connect request to RFCOMM being\nsent before authentication has been performed. This patch fixes the\nregression by always initializing the DLC security level to\nBT_SECURITY_LOW.\n\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@nokia.com\u003e\nAcked-by: Luiz Augusto von Dentz \u003cluiz.dentz-von@nokia.com\u003e\nSigned-off-by: Gustavo F. Padovan \u003cpadovan@profusion.mobi\u003e\n" }, { "commit": "46bcf14f44d8f31ecfdc8b6708ec15a3b33316d9", "tree": "4d2a200387242e1ed2d95ccd367c77750379e8cc", "parents": [ "e7dfc8dbdf9a7fa1ef04c63100a71f4102b82ed3" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Mon Dec 06 09:29:43 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Dec 06 09:29:43 2010 -0800" }, "message": "filter: fix sk_filter rcu handling\n\nPavel Emelyanov tried to fix a race between sk_filter_(de|at)tach and\nsk_clone() in commit 47e958eac280c263397\n\nProblem is we can have several clones sharing a common sk_filter, and\nthese clones might want to sk_filter_attach() their own filters at the\nsame time, and can overwrite old_filter-\u003ercu, corrupting RCU queues.\n\nWe can not use filter-\u003ercu without being sure no other thread could do\nthe same thing.\n\nSwitch code to a more conventional ref-counting technique : Do the\natomic decrement immediately and queue one rcu call back when last\nreference is released.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0bae35e14b68f5e7075bc96e5ea608b42bdf8f59", "tree": "c7aaf04160c9278d2d4f9466980dfca501258442", "parents": [ "e172662d113ceb22db727a979bb35b9c02f703b5" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Dec 02 14:31:14 2010 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 02 14:51:15 2010 -0800" }, "message": "leds: fix up dependencies\n\nIt\u0027s not useful to build LED triggers when there\u0027s no LEDs that can be\ntriggered by them. Therefore, fix up the dependencies so that this\ncannot happen, and fix a few users that select triggers to depend on\nLEDS_CLASS as well (there is also one user that also selects LEDS_CLASS,\nwhich is OK).\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nReported-by: Randy Dunlap \u003crandy.dunlap@oracle.com\u003e\nAcked-by: Randy Dunlap \u003crandy.dunlap@oracle.com\u003e\nTested-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Arnd Hannemann \u003carnd@arndnet.de\u003e\nCc: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Richard Purdie \u003crpurdie@linux.intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "1937721f5637b53c794124cf4fd9edad0eb315ef", "tree": "011689400fe1b751ad59a54f30158c713f9a64dd", "parents": [ "916448e77f6bcaaa7f13c3de0c3851783ae2bfd0", "be93112accb42c5586a459683d71975cc70673ca" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Thu Dec 02 14:00:51 2010 -0500" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Thu Dec 02 14:00:51 2010 -0500" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6\n" }, { "commit": "6dcdd1b3694a4fa2b85167a9c860c7613a7553c7", "tree": "4a0d21dbaf8d502c2b91777457065a9131b1eb9b", "parents": [ "d13a2cb63d06fe2e3067c7d40f9a5946abd614c8" ], "author": { "name": "David McCullough", "email": "david_mccullough@mcafee.com", "time": "Mon Nov 29 19:32:34 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 01 13:19:34 2010 -0800" }, "message": "net/ipv6/sit.c: return unhandled skb to tunnel4_rcv\n\nI found a problem using an IPv6 over IPv4 tunnel. When CONFIG_IPV6_SIT\nwas enabled, the packets would be rejected as net/ipv6/sit.c was catching\nall IPPROTO_IPV6 packets and returning an ICMP port unreachable error.\n\nI think this patch fixes the problem cleanly. I believe the code in\nnet/ipv4/tunnel4.c:tunnel4_rcv takes care of it properly if none of the\nhandlers claim the skb.\n\nSigned-off-by: David McCullough \u003cdavid_mccullough@mcafee.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "381601e5bbae78d7c18d946fe874a63957edea13", "tree": "2aa2fa29329265ea781001a8e4365977d6caa322", "parents": [ "25888e30319f8896fc656fc68643e6a078263060" ], "author": { "name": "Anders Franzen", "email": "Anders.Franzen@ericsson.com", "time": "Wed Nov 24 05:47:18 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Dec 01 10:55:47 2010 -0800" }, "message": "Make the ip6_tunnel reflect the true mtu.\n\nThe ip6_tunnel always assumes it consumes 40 bytes (ip6 hdr) of the mtu of the\nunderlaying device. So for a normal ethernet bearer, the mtu of the ip6_tunnel is\n1460.\nHowever, when creating a tunnel the encap limit option is enabled by default, and it\nconsumes 8 bytes more, so the true mtu shall be 1452.\n\nI dont really know if this breaks some statement in some RFC, so this is a request for\ncomments.\n\nSigned-off-by: Anders Franzen \u003canders.franzen@ericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8e26d5ad2f9c038609d42eebc676cd1107709eef", "tree": "64faf31c3f8dcc4000b06c21a6df147f2f522d18", "parents": [ "2c31333a8fde7e26936a9f5371d02ff12c490993" ], "author": { "name": "Senthil Balasubramanian", "email": "senthilkumar@atheros.com", "time": "Tue Nov 30 20:15:38 2010 +0530" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Tue Nov 30 13:45:02 2010 -0500" }, "message": "mac80211: Fix STA disconnect due to MIC failure\n\nTh commit titled \"mac80211: clean up rx handling wrt. found_sta\"\nremoved found_sta variable which caused a MIC failure event\nto be reported twice for a single failure to supplicant resulted\nin STA disconnect.\n\nThis should fix WPA specific countermeasures WiFi test case (5.2.17)\nissues with mac80211 based drivers which report MIC failure events in\nrx status.\n\nCc: Stable \u003cstable@kernel.org\u003e (2.6.37)\nSigned-off-by: Senthil Balasubramanian \u003csenthilkumar@atheros.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "2c31333a8fde7e26936a9f5371d02ff12c490993", "tree": "75bb0fc716caa240e7afc0245da0b5089bd3e420", "parents": [ "cf63495d0dbe435b475a44672f5dee150da6471b" ], "author": { "name": "Christian Lamparter", "email": "chunkeey@googlemail.com", "time": "Mon Nov 29 20:53:23 2010 +0100" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Tue Nov 30 13:23:06 2010 -0500" }, "message": "mac80211: ignore non-bcast mcast deauth/disassoc franes\n\nThis patch fixes an curious issue due to insufficient\nrx frame filtering.\n\nSaqeb Akhter reported frequent disconnects while streaming\nvideos over samba: \u003chttp://marc.info/?m\u003d128600031109136\u003e\n\u003e [ 1166.512087] wlan1: deauthenticated from 30:46:9a:10:49:f7 (Reason: 7)\n\u003e [ 1526.059997] wlan1: deauthenticated from 30:46:9a:10:49:f7 (Reason: 7)\n\u003e [ 2125.324356] wlan1: deauthenticated from 30:46:9a:10:49:f7 (Reason: 7)\n\u003e [...]\n\nThe reason is that the device generates frames with slightly\nbogus SA/TA addresses.\n\ne.g.:\n [ 2314.402316] Ignore 9f:1f:31:f8:64:ff\n [ 2314.402321] Ignore 9f:1f:31:f8:64:ff\n [ 2352.453804] Ignore 0d:1f:31:f8:64:ff\n [ 2352.453808] Ignore 0d:1f:31:f8:64:ff\n \t\t\t\t\t ^^ the group-address flag is set!\n (the correct SA/TA would be: 00:1f:31:f8:64:ff)\n\nSince the AP does not know from where the frames come, it\ngenerates a DEAUTH response for the (invalid) mcast address.\nThis mcast deauth frame then passes through all filters and\ntricks the stack into thinking that the AP brutally kicked\nus!\n\nThis patch fixes the problem by simply ignoring\nnon-broadcast, group-addressed deauth/disassoc frames.\n\nCc: Jouni Malinen \u003cj@w1.fi\u003e\nCc: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nReported-by: Saqeb Akhter \u003csaqeb.akhter@gmail.com\u003e\nSigned-off-by: Christian Lamparter \u003cchunkeey@googlemail.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "a01af8e4a4ee1135598f157051959982418c38f8", "tree": "76c78a7cbd02204afbe7404880dfbf312ebd51a5", "parents": [ "a9735c81a43054a7e8cb8771c8e04c01fcacde10", "25888e30319f8896fc656fc68643e6a078263060" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Nov 29 14:36:33 2010 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Nov 29 14:36:33 2010 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits)\n af_unix: limit recursion level\n pch_gbe driver: The wrong of initializer entry\n pch_gbe dreiver: chang author\n ucc_geth: fix ucc halt problem in half duplex mode\n inet: Fix __inet_inherit_port() to correctly increment bsockets and num_owners\n ehea: Add some info messages and fix an issue\n hso: fix disable_net\n NET: wan/x25_asy, move lapb_unregister to x25_asy_close_tty\n cxgb4vf: fix setting unicast/multicast addresses ...\n net, ppp: Report correct error code if unit allocation failed\n DECnet: don\u0027t leak uninitialized stack byte\n au1000_eth: fix invalid address accessing the MAC enable register\n dccp: fix error in updating the GAR\n tcp: restrict net.ipv4.tcp_adv_win_scale (#20312)\n netns: Don\u0027t leak others\u0027 openreq-s in proc\n Net: ceph: Makefile: Remove unnessary code\n vhost/net: fix rcu check usage\n econet: fix CVE-2010-3848\n econet: fix CVE-2010-3850\n econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849\n ...\n" }, { "commit": "7dff3125534c1d035a910052335a3a39fbb31aa7", "tree": "533142aacfc3d49067449173fb006225f41bc459", "parents": [ "46047784b8cdcfc916f6c1cccee0c18dd1223dfd" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@atheros.com", "time": "Fri Nov 26 20:41:55 2010 +0200" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Nov 29 14:41:28 2010 -0500" }, "message": "mac80211: Fix frame injection using non-AP vif\n\nIn order for frame injection to work properly for some use cases\n(e.g., finding the station entry and keys for encryption), mac80211\nneeds to find the correct sdata entry. This works when the main vif\nis in AP mode, but commit a2c1e3dad516618cb0fbfb1a62c36d0b0744573a\nbroke this particular use case for station main vif. While this type of\ninjection is quite unusual operation, it has some uses and we should fix\nit. Do this by changing the monitor vif sdata selection to allow station\nvif to be selected instead of limiting it to just AP vifs. We still need\nto skip some iftypes to avoid selecting unsuitable vif for injection.\n\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@atheros.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "25888e30319f8896fc656fc68643e6a078263060", "tree": "ae484d38b1250da885d3939dd9a97e667fbc871d", "parents": [ "50a4205333c5e545551f1f82b3004ca635407c5c" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Thu Nov 25 04:11:39 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Nov 29 09:45:15 2010 -0800" }, "message": "af_unix: limit recursion level\n\nIts easy to eat all kernel memory and trigger NMI watchdog, using an\nexploit program that queues unix sockets on top of others.\n\nlkml ref : http://lkml.org/lkml/2010/11/25/8\n\nThis mechanism is used in applications, one choice we have is to have a\nrecursion limit.\n\nOther limits might be needed as well (if we queue other types of files),\nsince the passfd mechanism is currently limited by socket receive queue\nsizes only.\n\nAdd a recursion_level to unix socket, allowing up to 4 levels.\n\nEach time we send an unix socket through sendfd mechanism, we copy its\nrecursion level (plus one) to receiver. This recursion level is cleared\nwhen socket receive queue is emptied.\n\nReported-by: Марк Коренберг \u003csocketpair@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b4ff3c90e6066bacc8a92111752fe9e4f4c45cca", "tree": "b64a78c4a7950e6b43c3e882dfc6dbe3a88aa2ea", "parents": [ "5c7e57f7cddb83d81d83fefa5822dfe80891130e" ], "author": { "name": "Nagendra Tomar", "email": "tomer_iisc@yahoo.com", "time": "Fri Nov 26 14:26:27 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Nov 28 18:18:44 2010 -0800" }, "message": "inet: Fix __inet_inherit_port() to correctly increment bsockets and num_owners\n\ninet sockets corresponding to passive connections are added to the bind hash\nusing ___inet_inherit_port(). These sockets are later removed from the bind\nhash using __inet_put_port(). These two functions are not exactly symmetrical.\n__inet_put_port() decrements hashinfo-\u003ebsockets and tb-\u003enum_owners, whereas\n___inet_inherit_port() does not increment them. This results in both of these\ngoing to -ve values.\n\nThis patch fixes this by calling inet_bind_hash() from ___inet_inherit_port(),\nwhich does the right thing.\n\n\u0027bsockets\u0027 and \u0027num_owners\u0027 were introduced by commit a9d8f9110d7e953c\n(inet: Allowing more than 64k connections and heavily optimize bind(0))\n\nSigned-off-by: Nagendra Singh Tomar \u003ctomer_iisc@yahoo.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nAcked-by: Evgeniy Polyakov \u003czbr@ioremap.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3c6f27bf33052ea6ba9d82369fb460726fb779c0", "tree": "0159223767a5edaaad3133df1bc4f061da0723a0", "parents": [ "462ca99c2ff6caae94dde5c05b56b54f6c01602a" ], "author": { "name": "Dan Rosenberg", "email": "drosenberg@vsecurity.com", "time": "Tue Nov 23 11:02:13 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Nov 28 11:32:30 2010 -0800" }, "message": "DECnet: don\u0027t leak uninitialized stack byte\n\nA single uninitialized padding byte is leaked to userspace.\n\nSigned-off-by: Dan Rosenberg \u003cdrosenberg@vsecurity.com\u003e\nCC: stable \u003cstable@kernel.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0ac78870220b6e0ac74dd9292bcfa7b18718babd", "tree": "19b0359b9a805857acf9ab713afd4e485e4da692", "parents": [ "a301e1703edc088592f8c5c16f9bdd34a0792776" ], "author": { "name": "Gerrit Renker", "email": "gerrit@erg.abdn.ac.uk", "time": "Tue Nov 23 02:36:56 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Nov 28 11:29:27 2010 -0800" }, "message": "dccp: fix error in updating the GAR\n\nThis fixes a bug in updating the Greatest Acknowledgment number Received (GAR):\nthe current implementation does not track the greatest received value -\nlower values in the range AWL..AWH (RFC 4340, 7.5.1) erase higher ones.\n\nSigned-off-by: Gerrit Renker \u003cgerrit@erg.abdn.ac.uk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0147fc058d11bd4009b126d09974d2c8f48fef15", "tree": "f73f0e82f7774938dd7190c6a810e0ccb2466f2b", "parents": [ "8475ef9fd16cadbfc692f78e608d1941a340beb2" ], "author": { "name": "Alexey Dobriyan", "email": "adobriyan@gmail.com", "time": "Mon Nov 22 12:54:21 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Nov 28 10:39:45 2010 -0800" }, "message": "tcp: restrict net.ipv4.tcp_adv_win_scale (#20312)\n\ntcp_win_from_space() does the following:\n\n if (sysctl_tcp_adv_win_scale \u003c\u003d 0)\n return space \u003e\u003e (-sysctl_tcp_adv_win_scale);\n else\n return space - (space \u003e\u003e sysctl_tcp_adv_win_scale);\n\n\"space\" is int.\n\nAs per C99 6.5.7 (3) shifting int for 32 or more bits is\nundefined behaviour.\n\nIndeed, if sysctl_tcp_adv_win_scale is exactly 32,\nspace \u003e\u003e 32 equals space and function returns 0.\n\nWhich means we busyloop in tcp_fixup_rcvbuf().\n\nRestrict net.ipv4.tcp_adv_win_scale to [-31, 31].\n\nFix https://bugzilla.kernel.org/show_bug.cgi?id\u003d20312\n\nSteps to reproduce:\n\n echo 32 \u003e/proc/sys/net/ipv4/tcp_adv_win_scale\n wget www.kernel.org\n [softlockup]\n\nSigned-off-by: Alexey Dobriyan \u003cadobriyan@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8475ef9fd16cadbfc692f78e608d1941a340beb2", "tree": "6e582cc6eed642094c87fd1075bc0d7eade41602", "parents": [ "4cb6a614ba0e58cae8abdadbf73bcb4d37a3f599" ], "author": { "name": "Pavel Emelyanov", "email": "xemul@parallels.com", "time": "Mon Nov 22 03:26:12 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Nov 27 22:57:48 2010 -0800" }, "message": "netns: Don\u0027t leak others\u0027 openreq-s in proc\n\nThe /proc/net/tcp leaks openreq sockets from other namespaces.\n\nSigned-off-by: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4cb6a614ba0e58cae8abdadbf73bcb4d37a3f599", "tree": "09198ec9e4bbb9c751246d38db87da970a7740aa", "parents": [ "a27e13d370415add3487949c60810e36069a23a6" ], "author": { "name": "Tracey Dent", "email": "tdent48227@gmail.com", "time": "Sun Nov 21 15:23:50 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Nov 27 17:39:29 2010 -0800" }, "message": "Net: ceph: Makefile: Remove unnessary code\n\nRemove the if and else conditional because the code is in mainline and there\nis no need in it being there.\n\nSigned-off-by: Tracey Dent \u003ctdent48227@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "19650e8580987c0ffabc2fe2cbc16b944789df8b", "tree": "cf0cfb390a128e3b2d47daa46f59de0a62a8ff04", "parents": [ "1eb4c6362cb7d6a2f904c555c10dc45caeeefc31", "0b26a0bf6ff398185546432420bb772bcfdf8d94" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 27 07:30:30 2010 +0900" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 27 07:30:30 2010 +0900" }, "message": "Merge branch \u0027bugfixes\u0027 of git://git.linux-nfs.org/projects/trondmy/nfs-2.6\n\n* \u0027bugfixes\u0027 of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:\n NFS: Ensure we return the dirent-\u003ed_type when it is known\n NFS: Correct the array bound calculation in nfs_readdir_add_to_array\n NFS: Don\u0027t ignore errors from nfs_do_filldir()\n NFS: Fix the error handling in \"uncached_readdir()\"\n NFS: Fix a page leak in uncached_readdir()\n NFS: Fix a page leak in nfs_do_filldir()\n NFS: Assume eof if the server returns no readdir records\n NFS: Buffer overflow in -\u003edecode_dirent() should not be fatal\n Pure nfs client performance using odirect.\n SUNRPC: Fix an infinite loop in call_refresh/call_refreshresult\n" }, { "commit": "a27e13d370415add3487949c60810e36069a23a6", "tree": "072e0ba8e2d629c55be4ef6fa5ae318e2a351e2f", "parents": [ "16c41745c7b92a243d0874f534c1655196c64b74" ], "author": { "name": "Phil Blundell", "email": "philb@gnu.org", "time": "Wed Nov 24 11:51:47 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 24 11:51:47 2010 -0800" }, "message": "econet: fix CVE-2010-3848\n\nDon\u0027t declare variable sized array of iovecs on the stack since this\ncould cause stack overflow if msg-\u003emsgiovlen is large. Instead, coalesce\nthe user-supplied data into a new buffer and use a single iovec for it.\n\nSigned-off-by: Phil Blundell \u003cphilb@gnu.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "16c41745c7b92a243d0874f534c1655196c64b74", "tree": "f30468ec3c9beb4d375ca1b0350c934e07d3b54f", "parents": [ "fa0e846494792e722d817b9d3d625a4ef4896c96" ], "author": { "name": "Phil Blundell", "email": "philb@gnu.org", "time": "Wed Nov 24 11:49:53 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 24 11:49:53 2010 -0800" }, "message": "econet: fix CVE-2010-3850\n\nAdd missing check for capable(CAP_NET_ADMIN) in SIOCSIFADDR operation.\n\nSigned-off-by: Phil Blundell \u003cphilb@gnu.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fa0e846494792e722d817b9d3d625a4ef4896c96", "tree": "0e842037f9f48fe0974fe854f7f2d13b69f23c7f", "parents": [ "c39508d6f118308355468314ff414644115a07f3" ], "author": { "name": "Phil Blundell", "email": "philb@gnu.org", "time": "Wed Nov 24 11:49:19 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 24 11:49:19 2010 -0800" }, "message": "econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849\n\nLater parts of econet_sendmsg() rely on saddr !\u003d NULL, so return early\nwith EINVAL if NULL was passed otherwise an oops may occur.\n\nSigned-off-by: Phil Blundell \u003cphilb@gnu.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c39508d6f118308355468314ff414644115a07f3", "tree": "c69cfd271855fa4b81398f9ddcb3dc286489d71a", "parents": [ "4448008eb12f4b6bb9993584de8ec1d20b708d6f" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 24 11:47:22 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 24 11:47:22 2010 -0800" }, "message": "tcp: Make TCP_MAXSEG minimum more correct.\n\nUse TCP_MIN_MSS instead of constant 64.\n\nReported-by: Min Zhang \u003cmzhang@mvista.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9915672d41273f5b77f1b3c29b391ffb7732b84b", "tree": "191dbf657535e49265be7664755890630e69e329", "parents": [ "cf41a51db89850033efc11c18a5257de810b5417" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed Nov 24 09:15:27 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 24 09:15:27 2010 -0800" }, "message": "af_unix: limit unix_tot_inflight\n\nVegard Nossum found a unix socket OOM was possible, posting an exploit\nprogram.\n\nMy analysis is we can eat all LOWMEM memory before unix_gc() being\ncalled from unix_release_sock(). Moreover, the thread blocked in\nunix_gc() can consume huge amount of time to perform cleanup because of\nhuge working set.\n\nOne way to handle this is to have a sensible limit on unix_tot_inflight,\ntested from wait_for_unix_gc() and to force a call to unix_gc() if this\nlimit is hit.\n\nThis solves the OOM and also reduce overall latencies, and should not\nslowdown normal workloads.\n\nReported-by: Vegard Nossum \u003cvegard.nossum@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3cbaa0f7a78d3b970b566629ee298c310780b919", "tree": "5b392ab5d59cfd87d7a6869ab6681a63d14e7d04", "parents": [ "e94571653876922bbc247c8ef13c0b7839c3e503", "cf41a51db89850033efc11c18a5257de810b5417" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 24 08:22:34 2010 +0900" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 24 08:22:34 2010 +0900" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:\n of/phylib: Use device tree properties to initialize Marvell PHYs.\n phylib: Add support for Marvell 88E1149R devices.\n phylib: Use common page register definition for Marvell PHYs.\n qlge: Fix incorrect usage of module parameters and netdev msg level\n ipv6: fix missing in6_ifa_put in addrconf\n SuperH IrDA: correct Baud rate error correction\n atl1c: Fix hardware type check for enabling OTP CLK\n net: allow GFP_HIGHMEM in __vmalloc()\n bonding: change list contact to netdev@vger.kernel.org\n e1000: fix screaming IRQ\n" }, { "commit": "c89ad7372232b69fd37edf90d6f5d2a8d6381214", "tree": "fa62412e8663f2e1e7288d649f3d96d84c4d68bb", "parents": [ "7379efeacb707f49729080791a7a562d8996aec4" ], "author": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Mon Nov 01 19:08:50 2010 +0000" }, "committer": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Mon Nov 22 18:23:18 2010 -0200" }, "message": "Bluetooth: Fix not returning proper error in SCO\n\nReturn 0 in that situation could lead to errors in the caller.\n\nSigned-off-by: Gustavo F. Padovan \u003cpadovan@profusion.mobi\u003e\n" }, { "commit": "5fc43978a79e8021c189660ab63249fd29c5fb32", "tree": "cac3a18f6bc6c5b91e5c2592c2d7b0ad459db50e", "parents": [ "3561d43fd289f590fdae672e5eb831b8d5cf0bf6" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Sat Nov 20 11:13:31 2010 -0500" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Mon Nov 22 13:22:39 2010 -0500" }, "message": "SUNRPC: Fix an infinite loop in call_refresh/call_refreshresult\n\nIf the rpcauth_refreshcred() call returns an error other than\nEACCES, ENOMEM or ETIMEDOUT, we currently end up looping forever\nbetween call_refresh and call_refreshresult.\n\nThe correct thing to do here is to exit on all errors except\nEAGAIN and ETIMEDOUT, for which case we retry 3 times, then\nreturn EACCES.\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n" }, { "commit": "88b2a9a3d98a19496d64aadda7158c0ad51cbe7d", "tree": "6e2fef13c006956efb6f592356d1c06874baf34c", "parents": [ "ddab1a3b30452bf6d2a2780dbb5fd962a85bec48" ], "author": { "name": "John Fastabend", "email": "john.r.fastabend@intel.com", "time": "Mon Nov 15 20:29:21 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Nov 22 07:37:36 2010 -0800" }, "message": "ipv6: fix missing in6_ifa_put in addrconf\n\nFix ref count bug introduced by\n\ncommit 2de795707294972f6c34bae9de713e502c431296\nAuthor: Lorenzo Colitti \u003clorenzo@google.com\u003e\nDate: Wed Oct 27 18:16:49 2010 +0000\n\nipv6: addrconf: don\u0027t remove address state on ifdown if the address\nis being kept\n\nFix logic so that addrconf_ifdown() decrements the inet6_ifaddr\nrefcnt correctly with in6_ifa_put().\n\nReported-by: Stephen Hemminger \u003cshemminger@vyatta.com\u003e\nSigned-off-by: John Fastabend \u003cjohn.r.fastabend@intel.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7a1c8e5ab120a5f352e78bbc1fa5bb64e6f23639", "tree": "9c9b81e173c59d4be5590be5101c405457acab83", "parents": [ "a6c36ee677607b02d8ecc88e8a12785418b88107" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Sat Nov 20 07:46:35 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Nov 21 10:04:04 2010 -0800" }, "message": "net: allow GFP_HIGHMEM in __vmalloc()\n\nWe forgot to use __GFP_HIGHMEM in several __vmalloc() calls.\n\nIn ceph, add the missing flag.\n\nIn fib_trie.c, xfrm_hash.c and request_sock.c, using vzalloc() is\ncleaner and allows using HIGHMEM pages as well.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "76db8ac45fc738f7d7664fe9b56d15c594a45228", "tree": "eca23feab074d505b375e27714473f4ad337bd85", "parents": [ "caf8394524fdc039b090cd3af99157e9e76f4f06", "3105c19c450ac7c18ab28c19d364b588767261b3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 19 15:32:22 2010 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 19 15:32:22 2010 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:\n ceph: fix readdir EOVERFLOW on 32-bit archs\n ceph: fix frag offset for non-leftmost frags\n ceph: fix dangling pointer\n ceph: explicitly specify page alignment in network messages\n ceph: make page alignment explicit in osd interface\n ceph: fix comment, remove extraneous args\n ceph: fix update of ctime from MDS\n ceph: fix version check on racing inode updates\n ceph: fix uid/gid on resent mds requests\n ceph: fix rdcache_gen usage and invalidate\n ceph: re-request max_size if cap auth changes\n ceph: only let auth caps update max_size\n ceph: fix open for write on clustered mds\n ceph: fix bad pointer dereference in ceph_fill_trace\n ceph: fix small seq message skipping\n Revert \"ceph: update issue_seq on cap grant\"\n" }, { "commit": "caf8394524fdc039b090cd3af99157e9e76f4f06", "tree": "c58af82b15459a55a66bfae3a9d83a23c2d2c62c", "parents": [ "6656b3fc8aba2eb7ca00c06c7fe4917938b0b652", "0302b8622ce696af1cda22fcf207d3793350e896" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 19 15:25:59 2010 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 19 15:25:59 2010 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (31 commits)\n net: fix kernel-doc for sk_filter_rcu_release\n be2net: Fix to avoid firmware update when interface is not open.\n netfilter: fix IP_VS dependencies\n net: irda: irttp: sync error paths of data- and udata-requests\n ipv6: Expose reachable and retrans timer values as msecs\n ipv6: Expose IFLA_PROTINFO timer values in msecs instead of jiffies\n 3c59x: fix build failure on !CONFIG_PCI\n ipg.c: remove id [SUNDANCE, 0x1021]\n net: caif: spi: fix potential NULL dereference\n ath9k_htc: Avoid setting QoS control for non-QoS frames\n net: zero kobject in rx_queue_release\n net: Fix duplicate volatile warning.\n MAINTAINERS: Add stmmac maintainer\n bonding: fix a race in IGMP handling\n cfg80211: fix can_beacon_sec_chan, reenable HT40\n gianfar: fix signedness issue\n net: bnx2x: fix error value sign\n 8139cp: fix checksum broken\n r8169: fix checksum broken\n rds: Integer overflow in RDS cmsg handling\n ...\n" }, { "commit": "0302b8622ce696af1cda22fcf207d3793350e896", "tree": "70d8b124dcd37db847c5a6e997fca466458d024e", "parents": [ "d9efd2af461abb7b54c49c1b7e654d496dd1d379" ], "author": { "name": "Randy Dunlap", "email": "randy.dunlap@oracle.com", "time": "Thu Nov 18 13:02:37 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 19 09:27:15 2010 -0800" }, "message": "net: fix kernel-doc for sk_filter_rcu_release\n\nFix kernel-doc warning for sk_filter_rcu_release():\n\nWarning(net/core/filter.c:586): missing initial short description on line:\n * \tsk_filter_rcu_release: Release a socket filter by rcu_head\n\nSigned-off-by: Randy Dunlap \u003crandy.dunlap@oracle.com\u003e\nCc:\t\"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc:\tnetdev@vger.kernel.org\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "dba4490d22a496f9b7c21919cf3effbed5851213", "tree": "c66928ae2f6f7c9677266c2d84d3c92c0fc80b46", "parents": [ "925e277f5221defdc53cbef1ac3ed1803fa32357" ], "author": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Thu Nov 18 08:20:57 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Nov 18 13:14:33 2010 -0800" }, "message": "netfilter: fix IP_VS dependencies\n\nWhen NF_CONNTRACK is enabled, IP_VS uses conntrack symbols.\nTherefore IP_VS can\u0027t be linked statically when conntrack\nis built modular.\n\nReported-by: Justin P. Mattock \u003cjustinmattock@gmail.com\u003e\nTested-by: Justin P. Mattock \u003cjustinmattock@gmail.com\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "925e277f5221defdc53cbef1ac3ed1803fa32357", "tree": "5d11dc5bf2e6ca2ef848a3722c9270e59e4def67", "parents": [ "18a31e1e282f9ed563b131526a88162ccbe04ee3" ], "author": { "name": "Wolfram Sang", "email": "w.sang@pengutronix.de", "time": "Tue Nov 16 09:40:02 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Nov 18 12:24:25 2010 -0800" }, "message": "net: irda: irttp: sync error paths of data- and udata-requests\n\nirttp_data_request() returns meaningful errorcodes, while irttp_udata_request()\njust returns -1 in similar situations. Sync the two and the loglevels of the\naccompanying output.\n\nSigned-off-by: Wolfram Sang \u003cw.sang@pengutronix.de\u003e\nCc: Samuel Ortiz \u003csameo@linux.intel.com\u003e\nCc: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "18a31e1e282f9ed563b131526a88162ccbe04ee3", "tree": "1ab16b75f4302854d5b2840143624577189f9997", "parents": [ "07bfa524d4c67acbb6b6fbdd1dea923d07853c04" ], "author": { "name": "Thomas Graf", "email": "tgraf@infradead.org", "time": "Wed Nov 17 04:12:02 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Nov 18 12:08:36 2010 -0800" }, "message": "ipv6: Expose reachable and retrans timer values as msecs\n\nExpose reachable and retrans timer values in msecs instead of jiffies.\nBoth timer values are already exposed as msecs in the neighbour table\nnetlink interface.\n\nThe creation timestamp format with increased precision is kept but\ncleaned up.\n\nSigned-off-by: Thomas Graf \u003ctgraf@infradead.org\u003e\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "07bfa524d4c67acbb6b6fbdd1dea923d07853c04", "tree": "6e3819f13d3f4efa9c099cf227b1d42b1bc78620", "parents": [ "93908d192686d8285dd6441ff855df92a40103d2", "3bf30b56c4f0a1c4fae34050b7db4527c92891e8" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Nov 18 11:56:09 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Nov 18 11:56:09 2010 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "93908d192686d8285dd6441ff855df92a40103d2", "tree": "f5d22a57782538cb2fe3a794294eef72bc8ede08", "parents": [ "d530db0db90378b5674cb78d9c0cfcc83f851a5e" ], "author": { "name": "Thomas Graf", "email": "tgraf@infradead.org", "time": "Wed Nov 17 01:44:24 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Nov 18 11:05:01 2010 -0800" }, "message": "ipv6: Expose IFLA_PROTINFO timer values in msecs instead of jiffies\n\nIFLA_PROTINFO exposes timer related per device settings in jiffies.\nChange it to expose these values in msecs like the sysctl interface\ndoes.\n\nI did not find any users of IFLA_PROTINFO which rely on any of these\nvalues and even if there are, they are likely already broken because\nthere is no way for them to reliably convert such a value to another\ntime format.\n\nSigned-off-by: Thomas Graf \u003ctgraf@infradead.org\u003e\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7d8e76bf9ac3604897f0ce12e8bf09b68c2a2c89", "tree": "c22856a3f630d3fb3067aa1a89f8f884f97dcc40", "parents": [ "ef22b7b65f0eda9015becc7bff225a399914a242" ], "author": { "name": "John Fastabend", "email": "john.r.fastabend@intel.com", "time": "Tue Nov 16 19:42:53 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Nov 18 09:41:40 2010 -0800" }, "message": "net: zero kobject in rx_queue_release\n\nnetif_set_real_num_rx_queues() can decrement and increment\nthe number of rx queues. For example ixgbe does this as\nfeatures and offloads are toggled. Presumably this could\nalso happen across down/up on most devices if the available\nresources changed (cpu offlined).\n\nThe kobject needs to be zero\u0027d in this case so that the\nstate is not preserved across kobject_put()/kobject_init_and_add().\n\nThis resolves the following error report.\n\nixgbe 0000:03:00.0: eth2: NIC Link is Up 10 Gbps, Flow Control: RX/TX\nkobject (ffff880324b83210): tried to init an initialized object, something is seriously wrong.\nPid: 1972, comm: lldpad Not tainted 2.6.37-rc18021qaz+ #169\nCall Trace:\n [\u003cffffffff8121c940\u003e] kobject_init+0x3a/0x83\n [\u003cffffffff8121cf77\u003e] kobject_init_and_add+0x23/0x57\n [\u003cffffffff8107b800\u003e] ? mark_lock+0x21/0x267\n [\u003cffffffff813c6d11\u003e] net_rx_queue_update_kobjects+0x63/0xc6\n [\u003cffffffff813b5e0e\u003e] netif_set_real_num_rx_queues+0x5f/0x78\n [\u003cffffffffa0261d49\u003e] ixgbe_set_num_queues+0x1c6/0x1ca [ixgbe]\n [\u003cffffffffa0262509\u003e] ixgbe_init_interrupt_scheme+0x1e/0x79c [ixgbe]\n [\u003cffffffffa0274596\u003e] ixgbe_dcbnl_set_state+0x167/0x189 [ixgbe]\n\nSigned-off-by: John Fastabend \u003cjohn.r.fastabend@intel.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "09a02fdb919876c01e8f05960750a418b3f7fa48", "tree": "56be1e83394ba38590ab16a0d2905fe49e05414d", "parents": [ "9236d838c920e90708570d9bbd7bb82d30a38130" ], "author": { "name": "Mark Mentovai", "email": "mark@moxienet.com", "time": "Wed Nov 17 16:34:37 2010 -0500" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Thu Nov 18 11:35:05 2010 -0500" }, "message": "cfg80211: fix can_beacon_sec_chan, reenable HT40\n\nThis follows wireless-testing 9236d838c920e90708570d9bbd7bb82d30a38130\n(\"cfg80211: fix extension channel checks to initiate communication\") and\nfixes accidental case fall-through. Without this fix, HT40 is entirely\nblocked.\n\nSigned-off-by: Mark Mentovai \u003cmark@moxienet.com\u003e\nCc: stable@kernel.org\nAcked-by: Luis R. Rodriguez \u003clrodriguez@atheros.com\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "218854af84038d828a32f061858b1902ed2beec6", "tree": "d5c688bc9856b3763e354619ff46ebe20edad891", "parents": [ "7d98ffd8c2d1da6cec5d84eba42c4aa836a93f85" ], "author": { "name": "Dan Rosenberg", "email": "drosenberg@vsecurity.com", "time": "Wed Nov 17 06:37:16 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 17 12:20:52 2010 -0800" }, "message": "rds: Integer overflow in RDS cmsg handling\n\nIn rds_cmsg_rdma_args(), the user-provided args-\u003enr_local value is\nrestricted to less than UINT_MAX. This seems to need a tighter upper\nbound, since the calculation of total iov_size can overflow, resulting\nin a small sock_kmalloc() allocation. This would probably just result\nin walking off the heap and crashing when calling rds_rdma_pages() with\na high count value. If it somehow doesn\u0027t crash here, then memory\ncorruption could occur soon after.\n\nSigned-off-by: Dan Rosenberg \u003cdrosenberg@vsecurity.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "451a3c24b0135bce54542009b5fde43846c7cf67", "tree": "f0fbbcc155aef2a1ffcb8aa593fe7a966d0e6900", "parents": [ "55f6561c6941713ab5ae9180525b026dd40b7d14" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Wed Nov 17 16:26:55 2010 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 17 08:59:32 2010 -0800" }, "message": "BKL: remove extraneous #include \u003csmp_lock.h\u003e\n\nThe big kernel lock has been removed from all these files at some point,\nleaving only the #include.\n\nRemove this too as a cleanup.\n\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9236d838c920e90708570d9bbd7bb82d30a38130", "tree": "ee2d9ae6b4f82efe3b28e33abebec96b7e136141", "parents": [ "b5261cf4f3860bd772346a3e692683b6144dd44c" ], "author": { "name": "Luis R. Rodriguez", "email": "lrodriguez@atheros.com", "time": "Fri Nov 12 16:31:23 2010 -0800" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Tue Nov 16 15:59:39 2010 -0500" }, "message": "cfg80211: fix extension channel checks to initiate communication\n\nWhen operating in a mode that initiates communication and using\nHT40 we should fail if we cannot use both primary and secondary\nchannels to initiate communication. Our current ht40 allowmap\nonly covers STA mode of operation, for beaconing modes we need\na check on the fly as the mode of operation is dynamic and\nthere other flags other than disable which we should read\nto check if we can initiate communication.\n\nDo not allow for initiating communication if our secondary HT40\nchannel has is either disabled, has a passive scan flag, a\nno-ibss flag or is a radar channel. Userspace now has similar\nchecks but this is also needed in-kernel.\n\nReported-by: Jouni Malinen \u003cjouni.malinen@atheros.com\u003e\nCc: stable@kernel.org\nSigned-off-by: Luis R. Rodriguez \u003clrodriguez@atheros.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "7d98ffd8c2d1da6cec5d84eba42c4aa836a93f85", "tree": "398437e234367d8184bbaed1b3af8dc8ed7d5d3a", "parents": [ "4c62ab9c538bc09c38093fa079e6902ea4d42b98" ], "author": { "name": "Ulrich Weber", "email": "uweber@astaro.com", "time": "Fri Nov 05 01:39:12 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 16 11:43:39 2010 -0800" }, "message": "xfrm: update flowi saddr in icmp_send if unset\n\notherwise xfrm_lookup will fail to find correct policy\n\nSigned-off-by: Ulrich Weber \u003cuweber@astaro.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4c62ab9c538bc09c38093fa079e6902ea4d42b98", "tree": "d67bb872f84197369d82985702b6517a7a3f289a", "parents": [ "3b42a96dc7870c53d20b419185737d3b8f7a7b74" ], "author": { "name": "Wolfram Sang", "email": "w.sang@pengutronix.de", "time": "Tue Nov 16 09:50:47 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 16 09:50:47 2010 -0800" }, "message": "irda: irttp: allow zero byte packets\n\nSending zero byte packets is not neccessarily an error (AF_INET accepts it,\ntoo), so just apply a shortcut. This was discovered because of a non-working\nsoftware with WINE. See\n\n http://bugs.winehq.org/show_bug.cgi?id\u003d19397#c86\n http://thread.gmane.org/gmane.linux.irda.general/1643\n\nfor very detailed debugging information and a testcase. Kudos to Wolfgang for\nthose!\n\nReported-by: Wolfgang Schwotzer \u003cwolfgang.schwotzer@gmx.net\u003e\nSigned-off-by: Wolfram Sang \u003cw.sang@pengutronix.de\u003e\nTested-by: Mike Evans \u003cmike.evans@cardolan.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "94f58df8e545657f0b2d16eca1ac7a4ec39ed6be", "tree": "cf914f47862fdabb86257f18b671754c38c2ca8f", "parents": [ "5685b971362651ee3d99ff3cc512c3bbd049d34d" ], "author": { "name": "Jesper Juhl", "email": "jj@chaosbits.net", "time": "Sun Nov 07 22:11:34 2010 +0100" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Tue Nov 16 11:58:51 2010 -0500" }, "message": "SUNRPC: Simplify rpc_alloc_iostats by removing pointless local variable\n\nHi,\n\nWe can simplify net/sunrpc/stats.c::rpc_alloc_iostats() a bit by getting\nrid of the unneeded local variable \u0027new\u0027.\n\nPlease CC me on replies.\n\nSigned-off-by: Jesper Juhl \u003cjj@chaosbits.net\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n" }, { "commit": "9457b24a0955bbdd2e89220a75de69fe09501bba", "tree": "cb484848e14cc2705c4513ad3ec1f0420a4d55db", "parents": [ "80ef913f5e6a84551545016cea709f5e96d0cda6", "0597d1b99fcfc2c0eada09a698f85ed413d4ba84" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 12 17:17:55 2010 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 12 17:17:55 2010 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (66 commits)\n can-bcm: fix minor heap overflow\n gianfar: Do not call device_set_wakeup_enable() under a spinlock\n ipv6: Warn users if maximum number of routes is reached.\n docs: Add neigh/gc_thresh3 and route/max_size documentation.\n axnet_cs: fix resume problem for some Ax88790 chip\n ipv6: addrconf: don\u0027t remove address state on ifdown if the address is being kept\n tcp: Don\u0027t change unlocked socket state in tcp_v4_err().\n x25: Prevent crashing when parsing bad X.25 facilities\n cxgb4vf: add call to Firmware to reset VF State.\n cxgb4vf: Fail open if link_start() fails.\n cxgb4vf: flesh out PCI Device ID Table ...\n cxgb4vf: fix some errors in Gather List to skb conversion\n cxgb4vf: fix bug in Generic Receive Offload\n cxgb4vf: don\u0027t implement trivial (and incorrect) ndo_select_queue()\n ixgbe: Look inside vlan when determining offload protocol.\n bnx2x: Look inside vlan when determining checksum proto.\n vlan: Add function to retrieve EtherType from vlan packets.\n virtio-net: init link state correctly\n ucc_geth: Fix deadlock\n ucc_geth: Do not bring the whole IF down when TX failure.\n ...\n" }, { "commit": "0597d1b99fcfc2c0eada09a698f85ed413d4ba84", "tree": "c66d570cfa83daadde69179557183dafeeab7ed8", "parents": [ "6c4f199411f254bf3713b04ed8653f0955883309" ], "author": { "name": "Oliver Hartkopp", "email": "socketcan@hartkopp.net", "time": "Wed Nov 10 12:10:30 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 12 14:07:14 2010 -0800" }, "message": "can-bcm: fix minor heap overflow\n\nOn 64-bit platforms the ASCII representation of a pointer may be up to 17\nbytes long. This patch increases the length of the buffer accordingly.\n\nhttp://marc.info/?l\u003dlinux-netdev\u0026m\u003d128872251418192\u0026w\u003d2\n\nReported-by: Dan Rosenberg \u003cdrosenberg@vsecurity.com\u003e\nSigned-off-by: Oliver Hartkopp \u003csocketcan@hartkopp.net\u003e\nCC: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "403856532734317d25ec86ab1e75b8133db7acc6", "tree": "a294c1cba6ba395cd50c24c4e0f696645d6e13e2", "parents": [ "cbaf087a9f5e4721e83e8681ef328158f2298c6f" ], "author": { "name": "Ben Greear", "email": "greearb@candelatech.com", "time": "Mon Nov 08 12:33:48 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 12 14:03:24 2010 -0800" }, "message": "ipv6: Warn users if maximum number of routes is reached.\n\nThis gives users at least some clue as to what the problem\nmight be and how to go about fixing it.\n\nSigned-off-by: Ben Greear \u003cgreearb@candelatech.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2de795707294972f6c34bae9de713e502c431296", "tree": "bd5ee45aee40d0c4a6a0c7d3c25202fd0f95f3f6", "parents": [ "8f49c2703b33519aaaccc63f571b465b9d2b3a2d" ], "author": { "name": "Lorenzo Colitti", "email": "lorenzo@google.com", "time": "Wed Oct 27 18:16:49 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 12 13:44:24 2010 -0800" }, "message": "ipv6: addrconf: don\u0027t remove address state on ifdown if the address is being kept\n\nCurrently, addrconf_ifdown does not delete statically configured IPv6\naddresses when the interface is brought down. The intent is that when\nthe interface comes back up the address will be usable again. However,\nthis doesn\u0027t actually work, because the system stops listening on the\ncorresponding solicited-node multicast address, so the address cannot\nrespond to neighbor solicitations and thus receive traffic. Also, the\ncode notifies the rest of the system that the address is being deleted\n(e.g, RTM_DELADDR), even though it is not. Fix it so that none of this\nstate is updated if the address is being kept on the interface.\n\nTested: Added a statically configured IPv6 address to an interface,\nstarted ping, brought link down, brought link up again. When link came\nup ping kept on going and \"ip -6 maddr\" showed that the host was still\nsubscribed to there\n\nSigned-off-by: Lorenzo Colitti \u003clorenzo@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8f49c2703b33519aaaccc63f571b465b9d2b3a2d", "tree": "3b2db10ae8642c87c7258522e06ee56910d5b420", "parents": [ "5ef41308f94dcbb3b7afc56cdef1c2ba53fa5d2f" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 12 13:35:00 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 12 13:35:00 2010 -0800" }, "message": "tcp: Don\u0027t change unlocked socket state in tcp_v4_err().\n\nAlexey Kuznetsov noticed a regression introduced by\ncommit f1ecd5d9e7366609d640ff4040304ea197fbc618\n(\"Revert Backoff [v3]: Revert RTO on ICMP destination unreachable\")\n\nThe RTO and timer modification code added to tcp_v4_err()\ndoesn\u0027t check sock_owned_by_user(), which if true means we\ndon\u0027t have exclusive access to the socket and therefore cannot\nmodify it\u0027s critical state.\n\nJust skip this new code block if sock_owned_by_user() is true\nand eliminate the now superfluous sock_owned_by_user() code\nblock contained within.\n\nReported-by: Alexey Kuznetsov \u003ckuznet@ms2.inr.ac.ru\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nCC: Damian Lukowski \u003cdamian@tvk.rwth-aachen.de\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\n" }, { "commit": "5ef41308f94dcbb3b7afc56cdef1c2ba53fa5d2f", "tree": "c21d9c1c7f2792b0889432988d42e9b90f953358", "parents": [ "e68e6133e2daef6fc40e91621a1e26938e428e9e" ], "author": { "name": "Dan Rosenberg", "email": "drosenberg@vsecurity.com", "time": "Fri Nov 12 12:44:42 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 12 12:44:42 2010 -0800" }, "message": "x25: Prevent crashing when parsing bad X.25 facilities\n\nNow with improved comma support.\n\nOn parsing malformed X.25 facilities, decrementing the remaining length\nmay cause it to underflow. Since the length is an unsigned integer,\nthis will result in the loop continuing until the kernel crashes.\n\nThis patch adds checks to ensure decrementing the remaining length does\nnot cause it to wrap around.\n\nSigned-off-by: Dan Rosenberg \u003cdrosenberg@vsecurity.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1f18b7176e2e41fada24584ce3c80e9abfaca52b", "tree": "4f5cc10413729e16e8965c81afba3ca953ff3642", "parents": [ "7c13a0d9a1ac6875f6380763b947f4a5a016605f" ], "author": { "name": "Mariusz Kozlowski", "email": "mk@lab.zgora.pl", "time": "Mon Nov 08 11:58:45 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 12 11:06:46 2010 -0800" }, "message": "net: Fix header size check for GSO case in recvmsg (af_packet)\n\nParameter \u0027len\u0027 is size_t type so it will never get negative.\n\nSigned-off-by: Mariusz Kozlowski \u003cmk@lab.zgora.pl\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7c13a0d9a1ac6875f6380763b947f4a5a016605f", "tree": "fbf7b41bc8cc250e6f9add13541e7d1c408a33b8", "parents": [ "369cf77a6a3e41b1110506ddf43d45804103bfde", "22e091e5253da1e9ad7c0a82c2c84446fc403efe" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 12 11:04:26 2010 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 12 11:04:26 2010 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6\n" }, { "commit": "369cf77a6a3e41b1110506ddf43d45804103bfde", "tree": "6bd88b669c8c68ac4d9008e00566ca15e43a6ff4", "parents": [ "8877870f8a8127b653f8c9a55c6b4de9f96f639b" ], "author": { "name": "Thomas Graf", "email": "tgraf@infradead.org", "time": "Thu Nov 11 15:47:59 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 12 10:53:09 2010 -0800" }, "message": "rtnetlink: Fix message size calculation for link messages\n\nnlmsg_total_size() calculates the length of a netlink message\nincluding header and alignment. nla_total_size() calculates the\nspace an individual attribute consumes which was meant to be used\nin this context.\n\nAlso, ensure to account for the attribute header for the\nIFLA_INFO_XSTATS attribute as implementations of get_xstats_size()\nseem to assume that we do so.\n\nThe addition of two message headers minus the missing attribute\nheader resulted in a calculated message size that was larger than\nrequired. Therefore we never risked running out of skb tailroom.\n\nSigned-off-by: Thomas Graf \u003ctgraf@infradead.org\u003e\nAcked-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "22e091e5253da1e9ad7c0a82c2c84446fc403efe", "tree": "b3f892779ab637002bfb9e32c74905b13f81ec75", "parents": [ "ac5aa2e3332ec04889074afdbd1479424d0227a5" ], "author": { "name": "Shan Wei", "email": "shanwei@cn.fujitsu.com", "time": "Fri Nov 12 08:51:55 2010 +0100" }, "committer": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Fri Nov 12 08:51:55 2010 +0100" }, "message": "netfilter: ipv6: fix overlap check for fragments\n\nThe type of FRAG6_CB(prev)-\u003eoffset is int, skb-\u003elen is *unsigned* int,\nand offset is int.\n\nWithout this patch, type conversion occurred to this expression, when\n(FRAG6_CB(prev)-\u003eoffset + prev-\u003elen) is less than offset.\n\nSigned-off-by: Shan Wei \u003cshanwei@cn.fujitsu.com\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\n" } ], "next": "8877870f8a8127b653f8c9a55c6b4de9f96f639b" }