)]}' { "log": [ { "commit": "81ecd154d0b07bd5dab6e4f09336cb068b70bcb9", "tree": "b93363dce01b629923b1ab0c38aa4174edbd2c45", "parents": [ "8b4bb350e120fe0b32a0b1b8d227e65af03e3993" ], "author": { "name": "shawnlu", "email": "shawn.lu@ericsson.com", "time": "Fri Jan 20 12:22:04 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Feb 03 09:19:04 2012 -0800" }, "message": "tcp: md5: using remote adress for md5 lookup in rst packet\n\n[ Upstream commit 8a622e71f58ec9f092fc99eacae0e6cf14f6e742 ]\n\nmd5 key is added in socket through remote address.\nremote address should be used in finding md5 key when\nsending out reset packet.\n\nSigned-off-by: shawnlu \u003cshawn.lu@ericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8b4bb350e120fe0b32a0b1b8d227e65af03e3993", "tree": "da0f48a820eaa413f7b30d93468f8d386d1a2d16", "parents": [ "f217c4711d71aa6811b6e71d219b9efafa5d55a6" ], "author": { "name": "Neal Cardwell", "email": "ncardwell@google.com", "time": "Sat Jan 28 17:29:46 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Feb 03 09:19:04 2012 -0800" }, "message": "tcp: fix tcp_trim_head() to adjust segment count with skb MSS\n\n[ Upstream commit 5b35e1e6e9ca651e6b291c96d1106043c9af314a ]\n\nThis commit fixes tcp_trim_head() to recalculate the number of\nsegments in the skb with the skb\u0027s existing MSS, so trimming the head\ncauses the skb segment count to be monotonically non-increasing - it\nshould stay the same or go down, but not increase.\n\nPreviously tcp_trim_head() used the current MSS of the connection. But\nif there was a decrease in MSS between original transmission and ACK\n(e.g. due to PMTUD), this could cause tcp_trim_head() to\ncounter-intuitively increase the segment count when trimming bytes off\nthe head of an skb. This violated assumptions in tcp_tso_acked() that\ntcp_trim_head() only decreases the packet count, so that packets_acked\nin tcp_tso_acked() could underflow, leading tcp_clean_rtx_queue() to\npass u32 pkts_acked values as large as 0xffffffff to\nca_ops-\u003epkts_acked().\n\nAs an aside, if tcp_trim_head() had really wanted the skb to reflect\nthe current MSS, it should have called tcp_set_skb_tso_segs()\nunconditionally, since a decrease in MSS would mean that a\nsingle-packet skb should now be sliced into multiple segments.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nAcked-by: Nandita Dukkipati \u003cnanditad@google.com\u003e\nAcked-by: Ilpo Järvinen \u003cilpo.jarvinen@helsinki.fi\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f217c4711d71aa6811b6e71d219b9efafa5d55a6", "tree": "dff8657b88953fc3b5b930e799bb85290910157e", "parents": [ "d020b1d3d3379d183d0649cdc2f6de9131268419" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Jan 24 17:03:44 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Feb 03 09:19:04 2012 -0800" }, "message": "rds: Make rds_sock_lock BH rather than IRQ safe.\n\n[ Upstream commit efc3dbc37412c027e363736b4f4c74ee5e8ecffc ]\n\nrds_sock_info() triggers locking warnings because we try to perform a\nlocal_bh_enable() (via sock_i_ino()) while hardware interrupts are\ndisabled (via taking rds_sock_lock).\n\nThere is no reason for rds_sock_lock to be a hardware IRQ disabling\nlock, none of these access paths run in hardware interrupt context.\n\nTherefore making it a BH disabling lock is safe and sufficient to\nfix this bug.\n\nReported-by: Kumar Sanghvi \u003ckumaras@chelsio.com\u003e\nReported-by: Josh Boyer \u003cjwboyer@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1334533665277ccc5568c5104cd2358788a02e02", "tree": "13264643bfbf18d9f1e32d07cd43d4573a7bd454", "parents": [ "03024e3d2d6705443980f956abb56d4453319e95" ], "author": { "name": "James Chapman", "email": "jchapman@katalix.com", "time": "Wed Jan 25 02:39:05 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Feb 03 09:19:04 2012 -0800" }, "message": "l2tp: l2tp_ip - fix possible oops on packet receive\n\n[ Upstream commit 68315801dbf3ab2001679fd2074c9dc5dcf87dfa ]\n\nWhen a packet is received on an L2TP IP socket (L2TPv3 IP link\nencapsulation), the l2tpip socket\u0027s backlog_rcv function calls\nxfrm4_policy_check(). This is not necessary, since it was called\nbefore the skb was added to the backlog. With CONFIG_NET_NS enabled,\nxfrm4_policy_check() will oops if skb-\u003edev is null, so this trivial\npatch removes the call.\n\nThis bug has always been present, but only when CONFIG_NET_NS is\nenabled does it cause problems. Most users are probably using UDP\nencapsulation for L2TP, hence the problem has only recently\nsurfaced.\n\nEIP: 0060:[\u003cc12bb62b\u003e] EFLAGS: 00210246 CPU: 0\nEIP is at l2tp_ip_recvmsg+0xd4/0x2a7\nEAX: 00000001 EBX: d77b5180 ECX: 00000000 EDX: 00200246\nESI: 00000000 EDI: d63cbd30 EBP: d63cbd18 ESP: d63cbcf4\n DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068\nCall Trace:\n [\u003cc1218568\u003e] sock_common_recvmsg+0x31/0x46\n [\u003cc1215c92\u003e] __sock_recvmsg_nosec+0x45/0x4d\n [\u003cc12163a1\u003e] __sock_recvmsg+0x31/0x3b\n [\u003cc1216828\u003e] sock_recvmsg+0x96/0xab\n [\u003cc10b2693\u003e] ? might_fault+0x47/0x81\n [\u003cc10b2693\u003e] ? might_fault+0x47/0x81\n [\u003cc1167fd0\u003e] ? _copy_from_user+0x31/0x115\n [\u003cc121e8c8\u003e] ? copy_from_user+0x8/0xa\n [\u003cc121ebd6\u003e] ? verify_iovec+0x3e/0x78\n [\u003cc1216604\u003e] __sys_recvmsg+0x10a/0x1aa\n [\u003cc1216792\u003e] ? sock_recvmsg+0x0/0xab\n [\u003cc105a99b\u003e] ? __lock_acquire+0xbdf/0xbee\n [\u003cc12d5a99\u003e] ? do_page_fault+0x193/0x375\n [\u003cc10d1200\u003e] ? fcheck_files+0x9b/0xca\n [\u003cc10d1259\u003e] ? fget_light+0x2a/0x9c\n [\u003cc1216bbb\u003e] sys_recvmsg+0x2b/0x43\n [\u003cc1218145\u003e] sys_socketcall+0x16d/0x1a5\n [\u003cc11679f0\u003e] ? trace_hardirqs_on_thunk+0xc/0x10\n [\u003cc100305f\u003e] sysenter_do_call+0x12/0x38\nCode: c6 05 8c ea a8 c1 01 e8 0c d4 d9 ff 85 f6 74 07 3e ff 86 80 00 00 00 b9 17 b6 2b c1 ba 01 00 00 00 b8 78 ed 48 c1 e8 23 f6 d9 ff \u003cff\u003e 76 0c 68 28 e3 30 c1 68 2d 44 41 c1 e8 89 57 01 00 83 c4 0c\n\nSigned-off-by: James Chapman \u003cjchapman@katalix.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "62252cba2867cec7cc484ebb2d3ec705c41d9684", "tree": "6ef434ccb5c7ddf7fe593d82716ca72f73099427", "parents": [ "cc1be3611bae365c2399f5208732ddd0969cf46d" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Thu Jan 26 14:04:53 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Feb 03 09:19:03 2012 -0800" }, "message": "net caif: Register properly as a pernet subsystem.\n\n[ Upstream commit 8a8ee9aff6c3077dd9c2c7a77478e8ed362b96c6 ]\n\ncaif is a subsystem and as such it needs to register with\nregister_pernet_subsys instead of register_pernet_device.\n\nAmong other problems using register_pernet_device was resulting in\nnet_generic being called before the caif_net structure was allocated.\nWhich has been causing net_generic to fail with either BUG_ON\u0027s or by\nreturn NULL pointers.\n\nA more ugly problem that could be caused is packets in flight why the\nsubsystem is shutting down.\n\nTo remove confusion also remove the cruft cause by inappropriately\ntrying to fix this bug.\n\nWith the aid of the previous patch I have tested this patch and\nconfirmed that using register_pernet_subsys makes the failure go away as\nit should.\n\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nAcked-by: Sjur Brændeland \u003csjur.brandeland@stericsson.com\u003e\nTested-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "561331eae0a03d0c4cf60f3cf485aa3e8aa5ab48", "tree": "39c7f32c2c47bc3b463f9685eda5df9137a930b0", "parents": [ "4df9c291640da8992e146076f57a8e563c449e31" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Thu Jan 26 00:41:38 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Feb 03 09:19:03 2012 -0800" }, "message": "netns: fix net_alloc_generic()\n\n[ Upstream commit 073862ba5d249c20bd5c49fc6d904ff0e1f6a672 ]\n\nWhen a new net namespace is created, we should attach to it a \"struct\nnet_generic\" with enough slots (even empty), or we can hit the following\nBUG_ON() :\n\n[ 200.752016] kernel BUG at include/net/netns/generic.h:40!\n...\n[ 200.752016] [\u003cffffffff825c3cea\u003e] ? get_cfcnfg+0x3a/0x180\n[ 200.752016] [\u003cffffffff821cf0b0\u003e] ? lockdep_rtnl_is_held+0x10/0x20\n[ 200.752016] [\u003cffffffff825c41be\u003e] caif_device_notify+0x2e/0x530\n[ 200.752016] [\u003cffffffff810d61b7\u003e] notifier_call_chain+0x67/0x110\n[ 200.752016] [\u003cffffffff810d67c1\u003e] raw_notifier_call_chain+0x11/0x20\n[ 200.752016] [\u003cffffffff821bae82\u003e] call_netdevice_notifiers+0x32/0x60\n[ 200.752016] [\u003cffffffff821c2b26\u003e] register_netdevice+0x196/0x300\n[ 200.752016] [\u003cffffffff821c2ca9\u003e] register_netdev+0x19/0x30\n[ 200.752016] [\u003cffffffff81c1c67a\u003e] loopback_net_init+0x4a/0xa0\n[ 200.752016] [\u003cffffffff821b5e62\u003e] ops_init+0x42/0x180\n[ 200.752016] [\u003cffffffff821b600b\u003e] setup_net+0x6b/0x100\n[ 200.752016] [\u003cffffffff821b6466\u003e] copy_net_ns+0x86/0x110\n[ 200.752016] [\u003cffffffff810d5789\u003e] create_new_namespaces+0xd9/0x190\n\nnet_alloc_generic() should take into account the maximum index into the\nptr array, as a subsystem might use net_generic() anytime.\n\nThis also reduces number of reallocations in net_assign_generic()\n\nReported-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nTested-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: Sjur Brændeland \u003csjur.brandeland@stericsson.com\u003e\nCc: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nCc: Pavel Emelyanov \u003cxemul@openvz.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ffee9a18f29a0645c2d117083e025f557c738018", "tree": "3ce5e07a74f8e314df5eed0df8dc5acfc3aa54e7", "parents": [ "da8ae089a79cdc37589cab581a2ca9cf48f98904" ], "author": { "name": "Nick Bowler", "email": "nbowler@elliptictech.com", "time": "Thu Nov 10 09:01:27 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Feb 03 09:18:54 2012 -0800" }, "message": "ah: Don\u0027t return NET_XMIT_DROP on input.\n\ncommit 4b90a603a1b21d63cf743cc833680cb195a729f6 upstream.\n\nWhen the ahash driver returns -EBUSY, AH4/6 input functions return\nNET_XMIT_DROP, presumably copied from the output code path. But\nreturning transmit codes on input doesn\u0027t make a lot of sense.\nSince NET_XMIT_DROP is a positive int, this gets interpreted as\nthe next header type (i.e., success). As that can only end badly,\nremove the check.\n\nSigned-off-by: Nick Bowler \u003cnbowler@elliptictech.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c0ab420c6822529fa5aba05668e1e983b065460f", "tree": "8e8e2be923a3587c3847a98332998f89abdd0da8", "parents": [ "d253520a7b2c2223fb4f704f06d10f2c547bdeef" ], "author": { "name": "Nick Bowler", "email": "nbowler@elliptictech.com", "time": "Tue Nov 08 12:12:45 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Wed Jan 25 17:24:51 2012 -0800" }, "message": "ah: Read nexthdr value before overwriting it in ahash input callback.\n\ncommit b7ea81a58adc123a4e980cb0eff9eb5c144b5dc7 upstream.\n\nThe AH4/6 ahash input callbacks read out the nexthdr field from the AH\nheader *after* they overwrite that header. This is obviously not going\nto end well. Fix it up.\n\nSigned-off-by: Nick Bowler \u003cnbowler@elliptictech.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "d253520a7b2c2223fb4f704f06d10f2c547bdeef", "tree": "5bfcb9bec089ba770b70011da319dcea23b9ac37", "parents": [ "8039a47e67451b8efd6100c4a7f27829fc2d8edd" ], "author": { "name": "Nick Bowler", "email": "nbowler@elliptictech.com", "time": "Tue Nov 08 12:12:44 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Wed Jan 25 17:24:51 2012 -0800" }, "message": "ah: Correctly pass error codes in ahash output callback.\n\ncommit 069294e813ed5f27f82613b027609bcda5f1b914 upstream.\n\nThe AH4/6 ahash output callbacks pass nexthdr to xfrm_output_resume\ninstead of the error code. This appears to be a copy+paste error from\nthe input case, where nexthdr is expected. This causes the driver to\ncontinuously add AH headers to the datagram until either an allocation\nfails and the packet is dropped or the ahash driver hits a synchronous\nfallback and the resulting monstrosity is transmitted.\n\nCorrect this issue by simply passing the error code unadulterated.\n\nSigned-off-by: Nick Bowler \u003cnbowler@elliptictech.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "a141a5eb3ab45131cb168e7a561d662722b43ec3", "tree": "f72da23ff947391cc5181842a34b39db81f1dc63", "parents": [ "7df22768c0af8769d805f6db21144d71d91fe13d" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Tue Nov 29 17:00:26 2011 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Wed Jan 25 17:24:48 2012 -0800" }, "message": "svcrpc: avoid memory-corruption on pool shutdown\n\ncommit b4f36f88b3ee7cf26bf0be84e6c7fc15f84dcb71 upstream.\n\nSocket callbacks use svc_xprt_enqueue() to add an xprt to a\npool-\u003esp_sockets list. In normal operation a server thread will later\ncome along and take the xprt off that list. On shutdown, after all the\nthreads have exited, we instead manually walk the sv_tempsocks and\nsv_permsocks lists to find all the xprt\u0027s and delete them.\n\nSo the sp_sockets lists don\u0027t really matter any more. As a result,\nwe\u0027ve mostly just ignored them and hoped they would go away.\n\nWhich has gotten us into trouble; witness for example ebc63e531cc6\n\"svcrpc: fix list-corrupting race on nfsd shutdown\", the result of Ben\nGreear noticing that a still-running svc_xprt_enqueue() could re-add an\nxprt to an sp_sockets list just before it was deleted. The fix was to\nremove it from the list at the end of svc_delete_xprt(). But that only\nmade corruption less likely--I can see nothing that prevents a\nsvc_xprt_enqueue() from adding another xprt to the list at the same\nmoment that we\u0027re removing this xprt from the list. In fact, despite\nthe earlier xpo_detach(), I don\u0027t even see what guarantees that\nsvc_xprt_enqueue() couldn\u0027t still be running on this xprt.\n\nSo, instead, note that svc_xprt_enqueue() essentially does:\n\tlock sp_lock\n\t\tif XPT_BUSY unset\n\t\t\tadd to sp_sockets\n\tunlock sp_lock\n\nSo, if we do:\n\n\tset XPT_BUSY on every xprt.\n\tEmpty every sp_sockets list, under the sp_socks locks.\n\nThen we\u0027re left knowing that the sp_sockets lists are all empty and will\nstay that way, since any svc_xprt_enqueue() will check XPT_BUSY under\nthe sp_lock and see it set.\n\nAnd *then* we can continue deleting the xprt\u0027s.\n\n(Thanks to Jeff Layton for being correctly suspicious of this code....)\n\nCc: Ben Greear \u003cgreearb@candelatech.com\u003e\nCc: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "7df22768c0af8769d805f6db21144d71d91fe13d", "tree": "59adfcb91048e2510aed8fd406380c813fe7ad0c", "parents": [ "b09577ca6680033a4315e2f5cb3a95ebbb8dea79" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Tue Nov 29 11:35:35 2011 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Wed Jan 25 17:24:48 2012 -0800" }, "message": "svcrpc: destroy server sockets all at once\n\ncommit 2fefb8a09e7ed251ae8996e0c69066e74c5aa560 upstream.\n\nThere\u0027s no reason I can see that we need to call sv_shutdown between\nclosing the two lists of sockets.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "b09577ca6680033a4315e2f5cb3a95ebbb8dea79", "tree": "687c2010f9cfb888dd0e3cc196bd4be76453b565", "parents": [ "adc0186cfa38e2736048a638681db511e65e51fd" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Thu Dec 22 18:22:49 2011 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Wed Jan 25 17:24:47 2012 -0800" }, "message": "svcrpc: fix double-free on shutdown of nfsd after changing pool mode\n\ncommit 61c8504c428edcebf23b97775a129c5b393a302b upstream.\n\nThe pool_to and to_pool fields of the global svc_pool_map are freed on\nshutdown, but are initialized in nfsd startup only in the\nSVC_POOL_PERCPU and SVC_POOL_PERNODE cases.\n\nThey *are* initialized to zero on kernel startup. So as long as you use\nonly SVC_POOL_GLOBAL (the default), this will never be a problem.\n\nYou\u0027re also OK if you only ever use SVC_POOL_PERCPU or SVC_POOL_PERNODE.\n\nHowever, the following sequence events leads to a double-free:\n\n\t1. set SVC_POOL_PERCPU or SVC_POOL_PERNODE\n\t2. start nfsd: both fields are initialized.\n\t3. shutdown nfsd: both fields are freed.\n\t4. set SVC_POOL_GLOBAL\n\t5. start nfsd: the fields are left untouched.\n\t6. shutdown nfsd: now we try to free them again.\n\nStep 4 is actually unnecessary, since (for some bizarre reason), nfsd\nautomatically resets the pool mode to SVC_POOL_GLOBAL on shutdown.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "b9e11747e1227d7ad67c5b80be4b206e4059687e", "tree": "b75224b77cf1dd440d8763cdd2ea228624a4a072", "parents": [ "93d150e945fdaceb9e8fe18c7b9014569123195d" ], "author": { "name": "Stanislaw Gruszka", "email": "sgruszka@redhat.com", "time": "Wed Jan 11 09:26:54 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Wed Jan 25 17:24:43 2012 -0800" }, "message": "mac80211: fix rx-\u003ekey NULL pointer dereference in promiscuous mode\n\ncommit 1140afa862842ac3e56678693050760edc4ecde9 upstream.\n\nSince:\n\ncommit 816c04fe7ef01dd9649f5ccfe796474db8708be5\nAuthor: Christian Lamparter \u003cchunkeey@googlemail.com\u003e\nDate: Sat Apr 30 15:24:30 2011 +0200\n\n mac80211: consolidate MIC failure report handling\n\nis possible to that we dereference rx-\u003ekey \u003d\u003d NULL when driver set\nRX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in\npromiscuous mode. This happen with rt73usb and rt61pci at least.\n\nBefore the commit we always check rx-\u003ekey against NULL, so I assume\nfix should be done in mac80211 (also mic_fail path has similar check).\n\nReferences:\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d769766\nhttp://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html\n\nReported-by: Stuart D Gathman \u003cstuart@gathman.org\u003e\nReported-by: Kai Wohlfahrt \u003ckai.scorpio@gmail.com\u003e\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "49ffa26eca87d3518ed88d3e6feebf1b80837a15", "tree": "a7c4569f759bde3a770e4ac52671edd21afc0851", "parents": [ "06752b6cc142845a2c21196fa86a0cba7d72d325" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Mon Jan 09 14:06:46 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Thu Jan 12 11:35:41 2012 -0800" }, "message": "igmp: Avoid zero delay when receiving odd mixture of IGMP queries\n\ncommit a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27 upstream.\n\nCommit 5b7c84066733c5dfb0e4016d939757b38de189e4 (\u0027ipv4: correct IGMP\nbehavior on v3 query during v2-compatibility mode\u0027) added yet another\ncase for query parsing, which can result in max_delay \u003d 0. Substitute\na value of 1, as in the usual v3 case.\n\nReported-by: Simon McVittie \u003csmcv@debian.org\u003e\nReferences: http://bugs.debian.org/654876\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n\n" }, { "commit": "732e81a7579eb0adb26aeadb209e919ee984d01e", "tree": "35acd5de3c1585e60c4f4d8c2f15f8f3b0877151", "parents": [ "ad5dd5dc45d80c397dfe314934e91d0ead793928" ], "author": { "name": "Stephen Rothwell", "email": "sfr@canb.auug.org.au", "time": "Thu Dec 22 17:03:29 2011 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Jan 06 14:14:10 2012 -0800" }, "message": "ipv4: using prefetch requires including prefetch.h\n\n[ Upstream commit b9eda06f80b0db61a73bd87c6b0eb67d8aca55ad ]\n\nSigned-off-by: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "ad5dd5dc45d80c397dfe314934e91d0ead793928", "tree": "b13d757e51bbe03cb4a461298566b56a0f5c56ee", "parents": [ "6c3efb1526c3fcdab3e5bbc9c77710b306493507" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed Dec 21 15:47:16 2011 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Jan 06 14:14:10 2012 -0800" }, "message": "ipv4: reintroduce route cache garbage collector\n\n[ Upstream commit 9f28a2fc0bd77511f649c0a788c7bf9a5fd04edb ]\n\nCommit 2c8cec5c10b (ipv4: Cache learned PMTU information in inetpeer)\nremoved IP route cache garbage collector a bit too soon, as this gc was\nresponsible for expired routes cleanup, releasing their neighbour\nreference.\n\nAs pointed out by Robert Gladewitz, recent kernels can fill and exhaust\ntheir neighbour cache.\n\nReintroduce the garbage collection, since we\u0027ll have to wait our\nneighbour lookups become refcount-less to not depend on this stuff.\n\nReported-by: Robert Gladewitz \u003cgladewitz@gmx.de\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "6c3efb1526c3fcdab3e5bbc9c77710b306493507", "tree": "aed98fa349f35e6800a4a803f291ce62b196c18a", "parents": [ "0e5fe3ed8d751c7be333fa193882e91dcc289158" ], "author": { "name": "Weiping Pan", "email": "panweiping3@gmail.com", "time": "Thu Dec 01 15:47:06 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Jan 06 14:14:09 2012 -0800" }, "message": "ipv4: flush route cache after change accept_local\n\n[ Upstream commit d01ff0a049f749e0bf10a35bb23edd012718c8c2 ]\n\nAfter reset ipv4_devconf-\u003edata[IPV4_DEVCONF_ACCEPT_LOCAL] to 0,\nwe should flush route cache, or it will continue receive packets with local\nsource address, which should be dropped.\n\nSigned-off-by: Weiping Pan \u003cpanweiping3@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "0e5fe3ed8d751c7be333fa193882e91dcc289158", "tree": "87f94fa78ed44938e8b595ce036d38f2f4fee237", "parents": [ "f6e4c89e089ae671a677242edb9e8b08c369c415" ], "author": { "name": "Thomas Graf", "email": "tgraf@redhat.com", "time": "Mon Dec 19 04:11:40 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Jan 06 14:14:09 2012 -0800" }, "message": "sctp: Do not account for sizeof(struct sk_buff) in estimated rwnd\n\n[ Upstream commit a76c0adf60f6ca5ff3481992e4ea0383776b24d2 ]\n\nWhen checking whether a DATA chunk fits into the estimated rwnd a\nfull sizeof(struct sk_buff) is added to the needed chunk size. This\nquickly exhausts the available rwnd space and leads to packets being\nsent which are much below the PMTU limit. This can lead to much worse\nperformance.\n\nThe reason for this behaviour was to avoid putting too much memory\npressure on the receiver. The concept is not completely irational\nbecause a Linux receiver does in fact clone an skb for each DATA chunk\ndelivered. However, Linux also reserves half the available socket\nbuffer space for data structures therefore usage of it is already\naccounted for.\n\nWhen proposing to change this the last time it was noted that this\nbehaviour was introduced to solve a performance issue caused by rwnd\noverusage in combination with small DATA chunks.\n\nTrying to reproduce this I found that with the sk_buff overhead removed,\nthe performance would improve significantly unless socket buffer limits\nare increased.\n\nThe following numbers have been gathered using a patched iperf\nsupporting SCTP over a live 1 Gbit ethernet network. The -l option\nwas used to limit DATA chunk sizes. The numbers listed are based on\nthe average of 3 test runs each. Default values have been used for\nsk_(r|w)mem.\n\nChunk\nSize Unpatched No Overhead\n-------------------------------------\n 4 15.2 Kbit [!] 12.2 Mbit [!]\n 8 35.8 Kbit [!] 26.0 Mbit [!]\n 16 95.5 Kbit [!] 54.4 Mbit [!]\n 32 106.7 Mbit 102.3 Mbit\n 64 189.2 Mbit 188.3 Mbit\n 128 331.2 Mbit 334.8 Mbit\n 256 537.7 Mbit 536.0 Mbit\n 512 766.9 Mbit 766.6 Mbit\n1024 810.1 Mbit 808.6 Mbit\n\nSigned-off-by: Thomas Graf \u003ctgraf@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "f6e4c89e089ae671a677242edb9e8b08c369c415", "tree": "8fc6a469a63235c7a4bf389833962eae9f8302ec", "parents": [ "01d6bbab3834409c220083f25810be9f1a553054" ], "author": { "name": "Xi Wang", "email": "xi.wang@gmail.com", "time": "Fri Dec 16 12:44:15 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Jan 06 14:14:08 2012 -0800" }, "message": "sctp: fix incorrect overflow check on autoclose\n\n[ Upstream commit 2692ba61a82203404abd7dd2a027bda962861f74 ]\n\nCommit 8ffd3208 voids the previous patches f6778aab and 810c0719 for\nlimiting the autoclose value. If userspace passes in -1 on 32-bit\nplatform, the overflow check didn\u0027t work and autoclose would be set\nto 0xffffffff.\n\nThis patch defines a max_autoclose (in seconds) for limiting the value\nand exposes it through sysctl, with the following intentions.\n\n1) Avoid overflowing autoclose * HZ.\n\n2) Keep the default autoclose bound consistent across 32- and 64-bit\n platforms (INT_MAX / HZ in this patch).\n\n3) Keep the autoclose value consistent between setsockopt() and\n getsockopt() calls.\n\nSuggested-by: Vlad Yasevich \u003cvladislav.yasevich@hp.com\u003e\nSigned-off-by: Xi Wang \u003cxi.wang@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "01d6bbab3834409c220083f25810be9f1a553054", "tree": "fa5ef27bb1f28919a67538bc5bb59dc55ff21f29", "parents": [ "9ec14c04ec6be93ff397adf250bc91ee77742bfb" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Sun Dec 11 23:42:53 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Jan 06 14:14:08 2012 -0800" }, "message": "sch_gred: should not use GFP_KERNEL while holding a spinlock\n\n[ Upstream commit 3f1e6d3fd37bd4f25e5b19f1c7ca21850426c33f ]\n\ngred_change_vq() is called under sch_tree_lock(sch).\n\nThis means a spinlock is held, and we are not allowed to sleep in this\ncontext.\n\nWe might pre-allocate memory using GFP_KERNEL before taking spinlock,\nbut this is not suitable for stable material.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "9ec14c04ec6be93ff397adf250bc91ee77742bfb", "tree": "bdd7afb53389c768c7ae469794e167a778789bee", "parents": [ "477a897533f9ab9a6ebb6eedfa9ca3760caa94b2" ], "author": { "name": "Gerlando Falauto", "email": "gerlando.falauto@keymile.com", "time": "Mon Dec 19 22:58:04 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Jan 06 14:14:08 2012 -0800" }, "message": "net: have ipconfig not wait if no dev is available\n\n[ Upstream commit cd7816d14953c8af910af5bb92f488b0b277e29d ]\n\nprevious commit 3fb72f1e6e6165c5f495e8dc11c5bbd14c73385c\nmakes IP-Config wait for carrier on at least one network device.\n\nBefore waiting (predefined value 120s), check that at least one device\nwas successfully brought up. Otherwise (e.g. buggy bootloader\nwhich does not set the MAC address) there is no point in waiting\nfor carrier.\n\nCc: Micha Nelissen \u003cmicha@neli.hopto.org\u003e\nCc: Holger Brunck \u003cholger.brunck@keymile.com\u003e\nSigned-off-by: Gerlando Falauto \u003cgerlando.falauto@keymile.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "477a897533f9ab9a6ebb6eedfa9ca3760caa94b2", "tree": "c7b870384e18ec15602a765f5037c8cd4186ee35", "parents": [ "7eac8f9de24674cc55ee9797d05447bbfbdf1a96" ], "author": { "name": "Thomas Graf", "email": "tgraf@redhat.com", "time": "Thu Dec 22 02:05:07 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Jan 06 14:14:08 2012 -0800" }, "message": "mqprio: Avoid panic if no options are provided\n\n[ Upstream commit 7838f2ce36b6ab5c13ef20b1857e3bbd567f1759 ]\n\nUserspace may not provide TCA_OPTIONS, in fact tc currently does\nso not do so if no arguments are specified on the command line.\nReturn EINVAL instead of panicing.\n\nSigned-off-by: Thomas Graf \u003ctgraf@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "7eac8f9de24674cc55ee9797d05447bbfbdf1a96", "tree": "7c39b437e9413b5f09847c01e47729ad1508f01f", "parents": [ "e2f377870311c6e2ecf77e1ed6bbcb175ce0dde9" ], "author": { "name": "Alex Juncu", "email": "ajuncu@ixiacom.com", "time": "Thu Dec 15 23:01:25 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Jan 06 14:14:06 2012 -0800" }, "message": "llc: llc_cmsg_rcv was getting called after sk_eat_skb.\n\n[ Upstream commit 9cef310fcdee12b49b8b4c96fd8f611c8873d284 ]\n\nReceived non stream protocol packets were calling llc_cmsg_rcv that used a\nskb after that skb was released by sk_eat_skb. This caused received STP\npackets to generate kernel panics.\n\nSigned-off-by: Alexandru Juncu \u003cajuncu@ixiacom.com\u003e\nSigned-off-by: Kunjan Naik \u003cknaik@ixiacom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "afa2450ce311b3182c737c3fda59bb557da93409", "tree": "408d7e9eb3a6e0ddf17bdd7da3d55682b8940a27", "parents": [ "d27020f6c090faf3688324af9a8b496435285039" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Dec 07 09:02:21 2011 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Jan 06 14:13:48 2012 -0800" }, "message": "mac80211: fix another race in aggregation start\n\ncommit 15062e6a8524f5977f2cbdf6e3eb2f144262f74e upstream.\n\nEmmanuel noticed that when mac80211 stops the queues\nfor aggregation that can leave a packet pending. This\npacket will be given to the driver after the AMPDU\ncallback, but as a non-aggregated packet which messes\nup the sequence number etc.\n\nI also noticed by looking at the code that if packets\nare being processed while we clear the WANT_START bit,\nthey might see it cleared already and queue up on\ntid_tx-\u003epending. If the driver then rejects the new\naggregation session we leak the packet.\n\nFix both of these issues by changing this code to not\nstop the queues at all. Instead, let packets queue up\non the tid_tx-\u003epending queue instead of letting them\nget to the driver, and add code to recover properly\nin case the driver rejects the session.\n\n(The patch looks large because it has to move two\nfunctions to before their new use.)\n\nReported-by: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "919130981e72465867038ac1dec823dbd7a87eb5", "tree": "d245d6ce72582c5bdecb9d16f5c9c0ab897bd697", "parents": [ "9ce53d23da31815c0d0ae0380f898da4b5aa7af6" ], "author": { "name": "Ted Feng", "email": "artisdom@gmail.com", "time": "Thu Dec 08 00:46:21 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Jan 06 14:13:45 2012 -0800" }, "message": "ipip, sit: copy parms.name after register_netdevice\n\ncommit 72b36015ba43a3cca5303f5534d2c3e1899eae29 upstream.\n\nSame fix as 731abb9cb2 for ipip and sit tunnel.\nCommit 1c5cae815d removed an explicit call to dev_alloc_name in\nipip_tunnel_locate and ipip6_tunnel_locate, because register_netdevice\nwill now create a valid name, however the tunnel keeps a copy of the\nname in the private parms structure. Fix this by copying the name back\nafter register_netdevice has successfully returned.\n\nThis shows up if you do a simple tunnel add, followed by a tunnel show:\n\n$ sudo ip tunnel add mode ipip remote 10.2.20.211\n$ ip tunnel\ntunl0: ip/ip remote any local any ttl inherit nopmtudisc\ntunl%d: ip/ip remote 10.2.20.211 local any ttl inherit\n$ sudo ip tunnel add mode sit remote 10.2.20.212\n$ ip tunnel\nsit0: ipv6/ip remote any local any ttl 64 nopmtudisc 6rd-prefix 2002::/16\nsit%d: ioctl 89f8 failed: No such device\nsit%d: ipv6/ip remote 10.2.20.212 local any ttl inherit\n\nSigned-off-by: Ted Feng \u003cartisdom@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "5009514a0967db0060656c70de812b8643417da7", "tree": "e915321fceaba600bc99a78f7abf8ae6a15c0023", "parents": [ "0ea3edaf9ae2cede6f76b08a09981b3e71439e2e" ], "author": { "name": "Nikolay Martynov", "email": "mar.kolya@gmail.com", "time": "Sat Dec 10 17:31:23 2011 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Wed Dec 21 12:57:38 2011 -0800" }, "message": "mac80211: fix race condition caused by late addBA response\n\nUpstream commit d305a6557b2c4dca0110f05ffe745b1ef94adb80.\n\nIf addBA responses comes in just after addba_resp_timer has\nexpired mac80211 will still accept it and try to open the\naggregation session. This causes drivers to be confused and\nin some cases even crash.\n\nThis patch fixes the race condition and makes sure that if\naddba_resp_timer has expired addBA response is not longer\naccepted and we do not try to open half-closed session.\n\nSigned-off-by: Nikolay Martynov \u003cmar.kolya@gmail.com\u003e\n[some adjustments]\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "7e06614ab127e8c9de4af2e8f9d66953d3e68297", "tree": "69d48f58cba994e2adba94c2b427b99e7591d0f0", "parents": [ "3ed26be17352133a2dadbc4212a5d23b403b0980" ], "author": { "name": "Luis R. Rodriguez", "email": "mcgrof@qca.qualcomm.com", "time": "Mon Nov 28 16:47:16 2011 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Dec 09 08:52:45 2011 -0800" }, "message": "cfg80211: amend regulatory NULL dereference fix\n\ncommit 0bac71af6e66dc798bf07d0c0dd14ee5503362f9 upstream.\n\nJohannes\u0027 patch for \"cfg80211: fix regulatory NULL dereference\"\nbroke user regulaotry hints and it did not address the fact that\nlast_request was left populated even if the previous regulatory\nhint was stale due to the wiphy disappearing.\n\nFix user reguluatory hints by only bailing out if for those\nregulatory hints where a request_wiphy is expected. The stale last_request\nconsiderations are addressed through the previous fixes on last_request\nwhere we reset the last_request to a static world regdom request upon\nreset_regdomains(). In this case though we further enhance the effect\nby simply restoring reguluatory settings completely.\n\nCc: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Luis R. Rodriguez \u003cmcgrof@qca.qualcomm.com\u003e\nReviewed-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "3ed26be17352133a2dadbc4212a5d23b403b0980", "tree": "ff2cc4e01c57483a47c62c56d1d21a06b228a83d", "parents": [ "a89c8adbd9813435ccc29699e3dd474c1b823058" ], "author": { "name": "Luis R. Rodriguez", "email": "mcgrof@qca.qualcomm.com", "time": "Mon Nov 28 16:47:15 2011 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Dec 09 08:52:45 2011 -0800" }, "message": "cfg80211: fix race on init and driver registration\n\ncommit a042994dd377d86bff9446ee76151ceb6267c9ba upstream.\n\nThere is a theoretical race that if hit will trigger\na crash. The race is between when we issue the first\nregulatory hint, regulatory_hint_core(), gets processed\nby the workqueue and between when the first device\ngets registered to the wireless core. This is not easy\nto reproduce but it was easy to do so through the\nregulatory simulator I have been working on. This\nis a port of the fix I implemented there [1].\n\n[1] https://github.com/mcgrof/regsim/commit/a246ccf81f059cb662eee288aa13100f631e4cc8\n\nCc: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Luis R. Rodriguez \u003cmcgrof@qca.qualcomm.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "20f8d725863ca926a199cab1bc5cf31f8bf53cb0", "tree": "e940585a6fb65cbd8bf170ed603413f4351dfadd", "parents": [ "64a1b241dd84ed6b12b62bbb67b380609bdd50b2" ], "author": { "name": "Emmanuel Grumbach", "email": "emmanuel.grumbach@intel.com", "time": "Sun Nov 27 15:29:44 2011 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Dec 09 08:52:33 2011 -0800" }, "message": "mac80211: fix race between the AGG SM and the Tx data path\n\ncommit 2a1e0fd175dcfd72096ba9291d31e3b1b5342e60 upstream.\n\nWhen a packet is supposed to sent be as an a-MPDU, mac80211 sets\nIEEE80211_TX_CTL_AMPDU to let the driver know. On the other\nhand, mac80211 configures the driver for aggregration with the\nampdu_action callback.\nThere is race between these two mechanisms since the following\nscenario can occur when the BA agreement is torn down:\n\nTx softIRQ\t \t\t\tdrv configuration\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\t\t\t\t\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\ncheck OPERATIONAL bit\nSet the TX_CTL_AMPDU bit in the packet\n\n\t\t\t\t\tclear OPERATIONAL bit\n\t\t\t\t\tstop Tx AGG\nPass Tx packet to the driver.\n\nIn that case the driver would get a packet with TX_CTL_AMPDU set\nalthough it has already been notified that the BA session has been\ntorn down.\n\nTo fix this, we need to synchronize all the Qdisc activity after we\ncleared the OPERATIONAL bit. After that step, all the following\npackets will be buffered until the driver reports it is ready to get\nnew packets for this RA / TID. This buffering allows not to run into\nanother race that would send packets with TX_CTL_AMPDU unset while\nthe driver hasn\u0027t been requested to tear down the BA session yet.\n\nThis race occurs in practice and iwlwifi complains with a WARN_ON\nwhen it happens.\n\nSigned-off-by: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\nReviewed-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "64a1b241dd84ed6b12b62bbb67b380609bdd50b2", "tree": "0d06d32d315910d8972fa159248d03068efcc605", "parents": [ "6cb4e0db2f318c0730f31622fc5812a19e7ff379" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Nov 24 20:06:14 2011 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Dec 09 08:52:33 2011 -0800" }, "message": "mac80211: don\u0027t stop a single aggregation session twice\n\ncommit 24f50a9d165745fd0701c6e089d35f58a229ea69 upstream.\n\nNikolay noticed (by code review) that mac80211 can\nattempt to stop an aggregation session while it is\nalready being stopped. So to fix it, check whether\nstop is already being done and bail out if so.\n\nAlso move setting the STOPPING state into the lock\nso things are properly atomic.\n\nReported-by: Nikolay Martynov \u003cmar.kolya@gmail.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "6cb4e0db2f318c0730f31622fc5812a19e7ff379", "tree": "69000748f6ec6720d82fa1dfb66f142128a35ef0", "parents": [ "e30922bd0c3d24c27f457a64997ed4a47161621e" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Nov 21 10:44:00 2011 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Dec 09 08:52:32 2011 -0800" }, "message": "cfg80211: fix regulatory NULL dereference\n\ncommit de3584bd62d87b4c250129fbc46ca52c80330add upstream.\n\nBy the time userspace returns with a response to\nthe regulatory domain request, the wiphy causing\nthe request might have gone away. If this is so,\nreject the update but mark the request as having\nbeen processed anyway.\n\nCc: Luis R. Rodriguez \u003clrodriguez@qca.qualcomm.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "e30922bd0c3d24c27f457a64997ed4a47161621e", "tree": "984963799d06d4a9bf0516feaea890068305ca94", "parents": [ "2e72634a130dcac5d9e88e9187d7eab6c0ea8713" ], "author": { "name": "Eliad Peller", "email": "eliad@wizery.com", "time": "Thu Nov 24 18:13:56 2011 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Dec 09 08:52:31 2011 -0800" }, "message": "nl80211: fix MAC address validation\n\ncommit e007b857e88097c96c45620bf3b04a4e309053d1 upstream.\n\nMAC addresses have a fixed length. The current\npolicy allows passing \u003c ETH_ALEN bytes, which\nmight result in reading beyond the buffer.\n\nSigned-off-by: Eliad Peller \u003celiad@wizery.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "421f55945fb8515c6f322d20e9b0a2d390235e05", "tree": "7d474b15f2c48fdb9cd8d9887907210294c6cc4a", "parents": [ "6dbe15f453482a897c3db411cfdcffef27e71c6c" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Tue Nov 22 14:44:28 2011 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Dec 09 08:52:27 2011 -0800" }, "message": "SUNRPC: Ensure we return EAGAIN in xs_nospace if congestion is cleared\n\ncommit 24ca9a847791fd53d9b217330b15f3c285827a18 upstream.\n\nBy returning \u00270\u0027 instead of \u0027EAGAIN\u0027 when the tests in xs_nospace() fail\nto find evidence of socket congestion, we are making the RPC engine believe\nthat the message was incorrectly sent and so it disconnects the socket\ninstead of just retrying.\n\nThe bug appears to have been introduced by commit\n5e3771ce2d6a69e10fcc870cdf226d121d868491 (SUNRPC: Ensure that xs_nospace\nreturn values are propagated).\n\nReported-by: Andrew Cooper \u003candrew.cooper3@citrix.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nTested-by: Andrew Cooper \u003candrew.cooper3@citrix.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "d11d8cff78f91d5b956975b5c9e4c271e15f864e", "tree": "af9df715059e60c04793d36c85ce4d21c683192f", "parents": [ "5c02e3ae0a16cfc2fb86549cca9898ead2b0d666" ], "author": { "name": "Josh Boyer", "email": "jwboyer@redhat.com", "time": "Thu Nov 10 15:10:23 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Sat Nov 26 09:09:55 2011 -0800" }, "message": "ip6_tunnel: copy parms.name after register_netdevice\n\ncommit 731abb9cb27aef6013ce60808a04e04a545f3f4e upstream.\n\nCommit 1c5cae815d removed an explicit call to dev_alloc_name in ip6_tnl_create\nbecause register_netdevice will now create a valid name. This works for the\nnet_device itself.\n\nHowever the tunnel keeps a copy of the name in the parms structure for the\nip6_tnl associated with the tunnel. parms.name is set by copying the net_device\nname in ip6_tnl_dev_init_gen. That function is called from ip6_tnl_dev_init in\nip6_tnl_create, but it is done before register_netdevice is called so the name\nis set to a bogus value in the parms.name structure.\n\nThis shows up if you do a simple tunnel add, followed by a tunnel show:\n\n[root@localhost ~]# ip -6 tunnel add remote fec0::100 local fec0::200\n[root@localhost ~]# ip -6 tunnel show\nip6tnl0: ipv6/ipv6 remote :: local :: encaplimit 0 hoplimit 0 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)\nip6tnl%d: ipv6/ipv6 remote fec0::100 local fec0::200 encaplimit 4 hoplimit 64 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)\n[root@localhost ~]#\n\nFix this by moving the strcpy out of ip6_tnl_dev_init_gen, and calling it after\nregister_netdevice has successfully returned.\n\nSigned-off-by: Josh Boyer \u003cjwboyer@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "5c02e3ae0a16cfc2fb86549cca9898ead2b0d666", "tree": "228e029160f172af4a0dbc7edad494de5631688f", "parents": [ "c1ce1705eb0778927a0b81a6eb29e8ff193aa3de" ], "author": { "name": "Luis R. Rodriguez", "email": "mcgrof@qca.qualcomm.com", "time": "Tue Nov 08 14:28:06 2011 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Sat Nov 26 09:09:55 2011 -0800" }, "message": "cfg80211: fix bug on regulatory core exit on access to last_request\n\ncommit 58ebacc66bd11be2327edcefc79de94bd6f5bb4a upstream.\n\nCommit 4d9d88d1 by Scott James Remnant \u003ckeybuk@google.com\u003e added\nthe .uevent() callback for the regulatory device used during\nthe platform device registration. The change was done to account\nfor queuing up udev change requests through udevadm triggers.\nThe change also meant that upon regulatory core exit we will now\nsend a uevent() but the uevent() callback, reg_device_uevent(),\nalso accessed last_request. Right before commiting device suicide\nwe free\u0027d last_request but never set it to NULL so\nplatform_device_unregister() would lead to bogus kernel paging\nrequest. Fix this and also simply supress uevents right before\nwe commit suicide as they are pointless.\n\nThis fix is required for kernels \u003e\u003d v2.6.39\n\n$ git describe --contains 4d9d88d1\nv2.6.39-rc1~468^2~25^2^2~21\n\nThe impact of not having this present is that a bogus paging\naccess may occur (only read) upon cfg80211 unload time. You\nmay also get this BUG complaint below. Although Johannes\ncould not reproduce the issue this fix is theoretically correct.\n\nmac80211_hwsim: unregister radios\nmac80211_hwsim: closing netlink\nBUG: unable to handle kernel paging request at ffff88001a06b5ab\nIP: [\u003cffffffffa030df9a\u003e] reg_device_uevent+0x1a/0x50 [cfg80211]\nPGD 1836063 PUD 183a063 PMD 1ffcb067 PTE 1a06b160\nOops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\nCPU 0\nModules linked in: cfg80211(-) [last unloaded: mac80211]\n\nPid: 2279, comm: rmmod Tainted: G W 3.1.0-wl+ #663 Bochs Bochs\nRIP: 0010:[\u003cffffffffa030df9a\u003e] [\u003cffffffffa030df9a\u003e] reg_device_uevent+0x1a/0x50 [cfg80211]\nRSP: 0000:ffff88001c5f9d58 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88001d2eda88 RCX: ffff88001c7468fc\nRDX: ffff88001a06b5a0 RSI: ffff88001c7467b0 RDI: ffff88001c7467b0\nRBP: ffff88001c5f9d58 R08: 000000000000ffff R09: 000000000000ffff\nR10: 0000000000000000 R11: 0000000000000001 R12: ffff88001c7467b0\nR13: ffff88001d2eda78 R14: ffffffff8164a840 R15: 0000000000000001\nFS: 00007f8a91d8a6e0(0000) GS:ffff88001fc00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\nCR2: ffff88001a06b5ab CR3: 000000001c62e000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nProcess rmmod (pid: 2279, threadinfo ffff88001c5f8000, task ffff88000023c780)\nStack:\n ffff88001c5f9d98 ffffffff812ff7e5 ffffffff8176ab3d ffff88001c7468c2\n 000000000000ffff ffff88001d2eda88 ffff88001c7467b0 ffff880000114820\n ffff88001c5f9e38 ffffffff81241dc7 ffff88001c5f9db8 ffffffff81040189\nCall Trace:\n [\u003cffffffff812ff7e5\u003e] dev_uevent+0xc5/0x170\n [\u003cffffffff81241dc7\u003e] kobject_uevent_env+0x1f7/0x490\n [\u003cffffffff81040189\u003e] ? sub_preempt_count+0x29/0x60\n [\u003cffffffff814cab1a\u003e] ? _raw_spin_unlock_irqrestore+0x4a/0x90\n [\u003cffffffff81305307\u003e] ? devres_release_all+0x27/0x60\n [\u003cffffffff8124206b\u003e] kobject_uevent+0xb/0x10\n [\u003cffffffff812fee27\u003e] device_del+0x157/0x1b0\n [\u003cffffffff8130377d\u003e] platform_device_del+0x1d/0x90\n [\u003cffffffff81303b76\u003e] platform_device_unregister+0x16/0x30\n [\u003cffffffffa030fffd\u003e] regulatory_exit+0x5d/0x180 [cfg80211]\n [\u003cffffffffa032bec3\u003e] cfg80211_exit+0x2b/0x45 [cfg80211]\n [\u003cffffffff8109a84c\u003e] sys_delete_module+0x16c/0x220\n [\u003cffffffff8108a23e\u003e] ? trace_hardirqs_on_caller+0x7e/0x120\n [\u003cffffffff814cba02\u003e] system_call_fastpath+0x16/0x1b\nCode: \u003call your base are belong to me\u003e\nRIP [\u003cffffffffa030df9a\u003e] reg_device_uevent+0x1a/0x50 [cfg80211]\n RSP \u003cffff88001c5f9d58\u003e\nCR2: ffff88001a06b5ab\n---[ end trace 147c5099a411e8c0 ]---\n\nReported-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nCc: Scott James Remnant \u003ckeybuk@google.com\u003e\nSigned-off-by: Luis R. Rodriguez \u003cmcgrof@qca.qualcomm.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "c1ce1705eb0778927a0b81a6eb29e8ff193aa3de", "tree": "ce823c6988c2cda5d7db1abe6e1cf882dcf72c21", "parents": [ "ae1e9df381d5197015356e22de9d7acaf646a9ab" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Nov 03 09:27:01 2011 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Sat Nov 26 09:09:55 2011 -0800" }, "message": "nl80211: fix HT capability attribute validation\n\ncommit 6c7394197af90f6a332180e33f5d025d3037d883 upstream.\n\nSince the NL80211_ATTR_HT_CAPABILITY attribute is\nused as a struct, it needs a minimum, not maximum\nlength. Enforce that properly. Not doing so could\npotentially lead to reading after the buffer.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "ae1e9df381d5197015356e22de9d7acaf646a9ab", "tree": "869e8776944a5635b359e16bbd66d1844fa9c0a9", "parents": [ "492d7eff2def54c6e5521ee82764ca22025e7030" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Nov 08 13:04:41 2011 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Sat Nov 26 09:09:54 2011 -0800" }, "message": "mac80211: fix bug in ieee80211_build_probe_req\n\ncommit 5b2bbf75a24d6b06afff6de0eb4819413fd81971 upstream.\n\nieee80211_probereq_get() can return NULL in\nwhich case we should clean up \u0026 return NULL\nin ieee80211_build_probe_req() as well.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "492d7eff2def54c6e5521ee82764ca22025e7030", "tree": "2d1ae2f73e8f59b36462caa33086c48d02fe7b04", "parents": [ "11885cd854b27c1dcf35ab44d4899e8d20e08290" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Nov 08 12:28:33 2011 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Sat Nov 26 09:09:54 2011 -0800" }, "message": "mac80211: fix NULL dereference in radiotap code\n\ncommit f8d1ccf15568268c76f913b45ecdd33134387f1a upstream.\n\nWhen receiving failed PLCP frames is enabled, there\nwon\u0027t be a rate pointer when we add the radiotap\nheader and thus the kernel will crash. Fix this by\nnot assuming the rate pointer is always valid. It\u0027s\nstill always valid for frames that have good PLCP\nthough, and that is checked \u0026 enforced.\n\nThis was broken by my\ncommit fc88518916793af8ad6a02e05ff254d95c36d875\nAuthor: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nDate: Fri Jul 30 13:23:12 2010 +0200\n\n mac80211: don\u0027t check rates on PLCP error frames\n\nwhere I removed the check in this case but didn\u0027t\ntake into account that the rate info would be used.\n\nReported-by: Xiaokang Qin \u003cxiaokang.qin@intel.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "3fa57c1bf5fb311544199b7837a08b9f5bf5e6e4", "tree": "9285297f1b3fee391dca9773416e900d0b49b7a8", "parents": [ "867ca3109d0289d0a62bb3c7fc3d365e9d478fae" ], "author": { "name": "dpward", "email": "david.ward@ll.mit.edu", "time": "Mon Sep 05 16:47:24 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:37:17 2011 -0800" }, "message": "net: Handle different key sizes between address families in flow cache\n\ncommit aa1c366e4febc7f5c2b84958a2dd7cd70e28f9d0 upstream.\n\nWith the conversion of struct flowi to a union of AF-specific structs, some\noperations on the flow cache need to account for the exact size of the key.\n\nSigned-off-by: David Ward \u003cdavid.ward@ll.mit.edu\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Kim Phillips \u003ckim.phillips@freescale.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "041f9e20b7f794fd7b4932e05d0c938a9ebbf658", "tree": "a36f1cebed3712b1731fd459466d32f27098ad9f", "parents": [ "42c6d01ce89d43598fc804cf7c141d3252fe93b5" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Fri Oct 28 11:59:47 2011 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:37:13 2011 -0800" }, "message": "mac80211: disable powersave for broken APs\n\ncommit 05cb91085760ca378f28fc274fbf77fc4fd9886c upstream.\n\nOnly AID values 1-2007 are valid, but some APs have been\nfound to send random bogus values, in the reported case an\nAP that was sending the AID field value 0xffff, an AID of\n0x3fff (16383).\n\nThere isn\u0027t much we can do but disable powersave since\nthere\u0027s no way it can work properly in this case.\n\nReported-by: Bill C Riemers \u003cbriemers@redhat.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "42c6d01ce89d43598fc804cf7c141d3252fe93b5", "tree": "f9ef34fe7b4368a814949d62ffbcab57bd72d4fc", "parents": [ "632abf8b3f714da01daec2d43ffd9cd7b47f53a9" ], "author": { "name": "Eliad Peller", "email": "eliad@wizery.com", "time": "Thu Oct 20 19:05:50 2011 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:37:12 2011 -0800" }, "message": "mac80211: config hw when going back on-channel\n\ncommit 6911bf0453e0d6ea8eb694a4ce67a68d071c538e upstream.\n\nWhen going back on-channel, we should reconfigure\nthe hw iff the hardware is not already configured\nto the operational channel.\n\nSigned-off-by: Eliad Peller \u003celiad@wizery.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "632abf8b3f714da01daec2d43ffd9cd7b47f53a9", "tree": "01ba73ef955158ccc6a38d02364f44b90e512fea", "parents": [ "1cc8631784f67c62a8309897f7d4cb885a05ed6f" ], "author": { "name": "Eliad Peller", "email": "eliad@wizery.com", "time": "Thu Oct 20 19:05:49 2011 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:37:12 2011 -0800" }, "message": "mac80211: fix remain_off_channel regression\n\ncommit eaa7af2ae582c9a8c51b374c48d5970b748a5ce2 upstream.\n\nThe offchannel code is currently broken - we should\nremain_off_channel if the work was started, and\nthe work\u0027s channel and channel_type are the same\nas local-\u003etmp_channel and local-\u003etmp_channel_type.\n\nHowever, if wk-\u003echan_type and local-\u003etmp_channel_type\ncoexist (e.g. have the same channel type), we won\u0027t\nremain_off_channel.\n\nThis behavior was introduced by commit da2fd1f\n(\"mac80211: Allow work items to use existing\nchannel type.\")\n\nTested-by: Ben Greear \u003cgreearb@candelatech.com\u003e\nSigned-off-by: Eliad Peller \u003celiad@wizery.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "6fa9e3e3e01b8741eead6e00bb968ef3b4fddc3f", "tree": "64cbc64a7b8de5b4958e08cc7891e20997c6ea76", "parents": [ "22bef71b2e411ee05b9b9199394c3a209924926f" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Tue Oct 25 10:25:49 2011 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:37:07 2011 -0800" }, "message": "NFS/sunrpc: don\u0027t use a credential with extra groups.\n\ncommit dc6f55e9f8dac4b6479be67c5c9128ad37bb491f upstream.\n\nThe sunrpc layer keeps a cache of recently used credentials and\n\u0027unx_match\u0027 is used to find the credential which matches the current\nprocess.\n\nHowever unx_match allows a match when the cached credential has extra\ngroups at the end of uc_gids list which are not in the process group list.\n\nSo if a process with a list of (say) 4 group accesses a file and gains\naccess because of the last group in the list, then another process\nwith the same uid and gid, and a gid list being the first tree of the\ngids of the original process tries to access the file, it will be\ngranted access even though it shouldn\u0027t as the wrong rpc credential\nwill be used.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "5796ee30587cb5f887a7fe6182c2bbcc3d31f0ad", "tree": "bdc1b7ccbd37b1b5905e4f228de602752c4c9539", "parents": [ "ce0f562ecf544f386b6ae95f490cd06f7da2deb4" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue Oct 25 02:30:50 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:36:50 2011 -0800" }, "message": "net: Unlock sock before calling sk_free()\n\n[ Upstream commit b0691c8ee7c28a72748ff32e91b165ec12ae4de6 ]\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "ce0f562ecf544f386b6ae95f490cd06f7da2deb4", "tree": "97e36d61c095c13e8b7d5ef0072dd5c86a5cb6cb", "parents": [ "621112ec06bbe3a6dbb6af5f4db3451d01b309f9" ], "author": { "name": "stephen hemminger", "email": "shemminger@vyatta.com", "time": "Mon Oct 03 18:14:45 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:36:49 2011 -0800" }, "message": "bridge: leave carrier on for empty bridge\n\n[ Upstream commit b64b73d7d0c480f75684519c6134e79d50c1b341 ]\n\nThis resolves a regression seen by some users of bridging.\nSome users use the bridge like a dummy device.\nThey expect to be able to put an IPv6 address on the device\nwith no ports attached. Although there are better ways of doing\nthis, there is no reason to not allow it.\n\nNote: the bridge still will reflect the state of ports in the\nbridge if there are any added.\n\nSigned-off-by: Stephen Hemminger \u003cshemminger@vyatta.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "8adc3d3df0562b8dc4008f458081dcc2d8b98863", "tree": "8b8ef461982adac4936537c94b704148577859ff", "parents": [ "6d3607b179804e8ff4e2a1304ee238a4f6dc035c" ], "author": { "name": "Oliver Hartkopp", "email": "socketcan@hartkopp.net", "time": "Thu Sep 29 15:33:47 2011 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:36:45 2011 -0800" }, "message": "can bcm: fix incomplete tx_setup fix\n\ncommit 12d0d0d3a7349daa95dbfd5d7df8146255bc7c67 upstream.\n\nThe commit aabdcb0b553b9c9547b1a506b34d55a764745870 (\"can bcm: fix tx_setup\noff-by-one errors\") fixed only a part of the original problem reported by\nAndre Naujoks. It turned out that the original code needed to be re-ordered\nto reduce complexity and to finally fix the reported frame counting issues.\n\nSigned-off-by: Oliver Hartkopp \u003csocketcan@hartkopp.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "62d8d0b9b6c459789876335156c56110042f2158", "tree": "145bb8d2e72331f2bf35c2c43975dd72d78de009", "parents": [ "2146d4667b5fbdb0e186ca8bc6d9cbe7ac42dfdc" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Fri Sep 30 10:38:28 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:36:29 2011 -0800" }, "message": "make PACKET_STATISTICS getsockopt report consistently between ring and non-ring\n\n[ Upstream commit 7091fbd82cd5686444ffe9935ed6a8190101fe9d ]\n\nThis is a minor change.\n\nUp until kernel 2.6.32, getsockopt(fd, SOL_PACKET, PACKET_STATISTICS,\n...) would return total and dropped packets since its last invocation. The\nintroduction of socket queue overflow reporting [1] changed drop\nrate calculation in the normal packet socket path, but not when using a\npacket ring. As a result, the getsockopt now returns different statistics\ndepending on the reception method used. With a ring, it still returns the\ncount since the last call, as counts are incremented in tpacket_rcv and\nreset in getsockopt. Without a ring, it returns 0 if no drops occurred\nsince the last getsockopt and the total drops over the lifespan of\nthe socket otherwise. The culprit is this line in packet_rcv, executed\non a drop:\n\ndrop_n_acct:\n po-\u003estats.tp_drops \u003d atomic_inc_return(\u0026sk-\u003esk_drops);\n\nAs it shows, the new drop number it taken from the socket drop counter,\nwhich is not reset at getsockopt. I put together a small example\nthat demonstrates the issue [2]. It runs for 10 seconds and overflows\nthe queue/ring on every odd second. The reported drop rates are:\nring: 16, 0, 16, 0, 16, ...\nnon-ring: 0, 15, 0, 30, 0, 46, 0, 60, 0 , 74.\n\nNote how the even ring counts monotonically increase. Because the\ngetsockopt adds tp_drops to tp_packets, total counts are similarly\nreported cumulatively. Long story short, reinstating the original code, as\nthe below patch does, fixes the issue at the cost of additional per-packet\ncycles. Another solution that does not introduce per-packet overhead\nis be to keep the current data path, record the value of sk_drops at\ngetsockopt() at call N in a new field in struct packetsock and subtract\nthat when reporting at call N+1. I\u0027ll be happy to code that, instead,\nit\u0027s just more messy.\n\n[1] http://patchwork.ozlabs.org/patch/35665/\n[2] http://kernel.googlecode.com/files/test-packetsock-getstatistics.c\n\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "2146d4667b5fbdb0e186ca8bc6d9cbe7ac42dfdc", "tree": "561d219cf140a17e6d0c4275acef2d55e9744fe8", "parents": [ "ec668dbad7f732767d5484e1c7b317c767777f27" ], "author": { "name": "Yan, Zheng", "email": "zheng.z.yan@intel.com", "time": "Sun Sep 25 02:21:30 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:36:28 2011 -0800" }, "message": "ipv6: nullify ipv6_ac_list and ipv6_fl_list when creating new socket\n\n[ Upstream commit 676a1184e8afd4fed7948232df1ff91517400859 ]\n\nipv6_ac_list and ipv6_fl_list from listening socket are inadvertently\nshared with new socket created for connection.\n\nSigned-off-by: Zheng Yan \u003czheng.z.yan@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "b00654416d4baccf2269ec888e55d6df069cd36f", "tree": "7f5b6b699f3dfd5458d4f913c10f3149209d9a40", "parents": [ "37c88f5fe7f287a945949e6f4570700c210ebe0f" ], "author": { "name": "Yan, Zheng", "email": "zheng.z.yan@intel.com", "time": "Sun Oct 02 04:21:50 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:36:28 2011 -0800" }, "message": "tcp: properly update lost_cnt_hint during shifting\n\n[ Upstream commit 1e5289e121372a3494402b1b131b41bfe1cf9b7f ]\n\nlost_skb_hint is used by tcp_mark_head_lost() to mark the first unhandled skb.\nlost_cnt_hint is the number of packets or sacked packets before the lost_skb_hint;\nWhen shifting a skb that is before the lost_skb_hint, if tcp_is_fack() is ture,\nthe skb has already been counted in the lost_cnt_hint; if tcp_is_fack() is false,\ntcp_sacktag_one() will increase the lost_cnt_hint. So tcp_shifted_skb() does not\nneed to adjust the lost_cnt_hint by itself. When shifting a skb that is equal to\nlost_skb_hint, the shifted packets will not be counted by tcp_mark_head_lost().\nSo tcp_shifted_skb() should adjust the lost_cnt_hint even tcp_is_fack(tp) is true.\n\nSigned-off-by: Zheng Yan \u003czheng.z.yan@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "37c88f5fe7f287a945949e6f4570700c210ebe0f", "tree": "70ee5416e53203a4186d46fd493fb0ee02a8c74c", "parents": [ "18743353b3154f0ff7c29f3c5ae3a8466a70d73a" ], "author": { "name": "Yan, Zheng", "email": "zheng.z.yan@intel.com", "time": "Thu Sep 29 17:10:10 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:36:27 2011 -0800" }, "message": "tcp: properly handle md5sig_pool references\n\n[ Upstream commit 260fcbeb1ae9e768a44c9925338fbacb0d7e5ba9 ]\n\ntcp_v4_clear_md5_list() assumes that multiple tcp md5sig peers\nonly hold one reference to md5sig_pool. but tcp_v4_md5_do_add()\nincreases use count of md5sig_pool for each peer. This patch\nmakes tcp_v4_md5_do_add() only increases use count for the first\ntcp md5sig peer.\n\nSigned-off-by: Zheng Yan \u003czheng.z.yan@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "c11deb8d898318a2fea9a291b16a7a2b2507cc94", "tree": "427e5f0ccb863dcb54fcc8cbc813e549091e72cc", "parents": [ "cbbd42eb61241fcd721f3b02bcb612894e2f02e6" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Fri Oct 07 05:35:46 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:36:26 2011 -0800" }, "message": "l2tp: fix a potential skb leak in l2tp_xmit_skb()\n\n[ Upstream commit 835acf5da239b91edb9f7ebe36516999e156e6ee ]\n\nl2tp_xmit_skb() can leak one skb if skb_cow_head() returns an error.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "cbbd42eb61241fcd721f3b02bcb612894e2f02e6", "tree": "23d466c07929d95701228e34ce17c1415a411f6c", "parents": [ "92dc979cf8a5b2439ac2764cd56675407136d329" ], "author": { "name": "Yan, Zheng", "email": "zheng.z.yan@intel.com", "time": "Sat Oct 22 21:58:20 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:36:25 2011 -0800" }, "message": "ipv4: fix ipsec forward performance regression\n\n[ Upstream commit b73233960a59ee66e09d642f13d0592b13651e94 ]\n\nThere is bug in commit 5e2b61f(ipv4: Remove flowi from struct rtable).\nIt makes xfrm4_fill_dst() modify wrong data structure.\n\nSigned-off-by: Zheng Yan \u003czheng.z.yan@intel.com\u003e\nReported-by: Kim Phillips \u003ckim.phillips@freescale.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "92dc979cf8a5b2439ac2764cd56675407136d329", "tree": "bc1171d65440a30eddc8aeef5ffff0bedea3f986", "parents": [ "99dfac8ab234555a54f7fa6e4b7bb08bb355158b" ], "author": { "name": "Oliver Hartkopp", "email": "socketcan@hartkopp.net", "time": "Fri Sep 23 08:23:47 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:36:25 2011 -0800" }, "message": "can bcm: fix tx_setup off-by-one errors\n\n[ Upstream commit aabdcb0b553b9c9547b1a506b34d55a764745870 ]\n\nThis patch fixes two off-by-one errors that canceled each other out.\nChecking for the same condition two times in bcm_tx_timeout_tsklet() reduced\nthe count of frames to be sent by one. This did not show up the first time\ntx_setup is invoked as an additional frame is sent due to TX_ANNONCE.\nInvoking a second tx_setup on the same item led to a reduced (by 1) number of\nsent frames.\n\nReported-by: Andre Naujoks \u003cnautsch@gmail.com\u003e\nSigned-off-by: Oliver Hartkopp \u003csocketcan@hartkopp.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "99dfac8ab234555a54f7fa6e4b7bb08bb355158b", "tree": "13e533ddb167623485a1eed2cf505f7ae8b30cca", "parents": [ "e8c492bd9cbc8dd1002bf4bc316f21f0a002b10f" ], "author": { "name": "stephen hemminger", "email": "shemminger@vyatta.com", "time": "Thu Oct 06 11:19:41 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:36:24 2011 -0800" }, "message": "bridge: fix hang on removal of bridge via netlink\n\n[ Upstream commit 1ce5cce895309862d2c35d922816adebe094fe4a ]\n\nNeed to cleanup bridge device timers and ports when being bridge\ndevice is being removed via netlink.\n\nThis fixes the problem of observed when doing:\n ip link add br0 type bridge\n ip link set dev eth1 master br0\n ip link set br0 up\n ip link del br0\n\nwhich would cause br0 to hang in unregister_netdev because\nof leftover reference count.\n\nReported-by: Sridhar Samudrala \u003csri@us.ibm.com\u003e\nSigned-off-by: Stephen Hemminger \u003cshemminger@vyatta.com\u003e\nAcked-by: Sridhar Samudrala \u003csri@us.ibm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "babba877daf7a7ee0cb03dfb5e63f23e2d32dddf", "tree": "024acb25011c38ad4b28e5f6c09e726ab350f62a", "parents": [ "4641f8a010eb97303fbc9bd8a094139b52ffd629" ], "author": { "name": "Richard Cochran", "email": "richardcochran@gmail.com", "time": "Fri Oct 21 00:49:15 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:35:52 2011 -0800" }, "message": "net: hold sock reference while processing tx timestamps\n\ncommit da92b194cc36b5dc1fbd85206aeeffd80bee0c39 upstream.\n\nThe pair of functions,\n\n * skb_clone_tx_timestamp()\n * skb_complete_tx_timestamp()\n\nwere designed to allow timestamping in PHY devices. The first\nfunction, called during the MAC driver\u0027s hard_xmit method, identifies\nPTP protocol packets, clones them, and gives them to the PHY device\ndriver. The PHY driver may hold onto the packet and deliver it at a\nlater time using the second function, which adds the packet to the\nsocket\u0027s error queue.\n\nAs pointed out by Johannes, nothing prevents the socket from\ndisappearing while the cloned packet is sitting in the PHY driver\nawaiting a timestamp. This patch fixes the issue by taking a reference\non the socket for each such packet. In addition, the comments\nregarding the usage of these function are expanded to highlight the\nrule that PHY drivers must use skb_complete_tx_timestamp() to release\nthe packet, in order to release the socket reference, too.\n\nThese functions first appeared in v2.6.36.\n\nReported-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nSigned-off-by: Richard Cochran \u003crichard.cochran@omicron.at\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nReviewed-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "4641f8a010eb97303fbc9bd8a094139b52ffd629", "tree": "faf12450d0c295795f7f70464c9ae018f2c50f9e", "parents": [ "806aeb924e925e6f1584ff956c9b9695e4ec18f9" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 04 18:27:10 2011 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:35:51 2011 -0800" }, "message": "mac80211: fix offchannel TX cookie matching\n\ncommit 28a1bcdb57d50f3038a255741ecc83e391e5282e upstream.\n\nWhen I introduced in-kernel off-channel TX I\nintroduced a bug -- the work can\u0027t be canceled\nagain because the code clear the skb pointer.\nFix this by keeping track separately of whether\nTX status has already been reported.\n\nReported-by: Jouni Malinen \u003cj@w1.fi\u003e\nTested-by: Jouni Malinen \u003cj@w1.fi\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "32779fa06584fdcab2228a36c3a846fa0a6f5cdb", "tree": "9ff99339f24d0a67edee4faeba3df2b0637eeaaf", "parents": [ "e277beeb68b1f1e9326d57913a41549744002449" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Fri Oct 21 06:24:20 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:35:50 2011 -0800" }, "message": "rtnetlink: Add missing manual netlink notification in dev_change_net_namespaces\n\ncommit d2237d35748e7f448a9c2d9dc6a85ef637466e24 upstream.\n\nRenato Westphal noticed that since commit a2835763e130c343ace5320c20d33c281e7097b7\n\"rtnetlink: handle rtnl_link netlink notifications manually\" was merged\nwe no longer send a netlink message when a networking device is moved\nfrom one network namespace to another.\n\nFix this by adding the missing manual notification in dev_change_net_namespaces.\n\nSince all network devices that are processed by dev_change_net_namspaces are\nin the initialized state the complicated tests that guard the manual\nrtmsg_ifinfo calls in rollback_registered and register_netdevice are\nunnecessary and we can just perform a plain notification.\n\nTested-by: Renato Westphal \u003crenatowestphal@gmail.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "5c2433cdc72a03446184e2f898be3b05095b5ed0", "tree": "b4532445ad6d2b5ceaf9eb44409580b97effecb4", "parents": [ "7b59e3e29e1a28ad40892dd2115175e2702f1153" ], "author": { "name": "David Woodhouse", "email": "dwmw2@infradead.org", "time": "Mon Oct 24 21:25:21 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Fri Nov 11 09:35:47 2011 -0800" }, "message": "caif: Fix BUG() with network namespaces\n\ncommit 08613e4626c06ca408fc55071f6aedee36986a87 upstream.\n\nThe caif code will register its own pernet_operations, and then register\na netdevice_notifier. Each time the netdevice_notifier is triggered,\nit\u0027ll do some stuff... including a lookup of its own pernet stuff with\nnet_generic().\n\nIf the net_generic() call ever returns NULL, the caif code will BUG().\nThat doesn\u0027t seem *so* unreasonable, I suppose — it does seem like it\nshould never happen.\n\nHowever, it *does* happen. When we clone a network namespace,\nsetup_net() runs through all the pernet_operations one at a time. It\ngets to loopback before it gets to caif. And loopback_net_init()\nregisters a netdevice... while caif hasn\u0027t been initialised. So the caif\nnetdevice notifier triggers, and immediately goes BUG().\n\nWe could imagine a complex and overengineered solution to this generic\nclass of problems, but this patch takes the simple approach. It just\nmakes caif_device_notify() *not* go looking for its pernet data\nstructures if the device it\u0027s being notified about isn\u0027t a caif device\nin the first place.\n\nSigned-off-by: David Woodhouse \u003cDavid.Woodhouse@intel.com\u003e\nAcked-by: Sjur Brændeland \u003csjur.brandeland@stericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "4ea7f3aa5d3fbec2e09edb8c03bc764f9514d3d2", "tree": "f20dd64cce42007879a319b5db23962c88acb7bb", "parents": [ "6b2f66dc9cabb7eb348587fdac6b3a64545e2d5f" ], "author": { "name": "Matthew Daley", "email": "mattjd@gmail.com", "time": "Fri Oct 14 18:45:05 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Tue Oct 25 07:10:17 2011 +0200" }, "message": "x25: Prevent skb overreads when checking call user data\n\ncommit 7f81e25befdfb3272345a2e775f520e1d515fa20 upstream.\n\nx25_find_listener does not check that the amount of call user data given\nin the skb is big enough in per-socket comparisons, hence buffer\noverreads may occur. Fix this by adding a check.\n\nSigned-off-by: Matthew Daley \u003cmattjd@gmail.com\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: Andrew Hendry \u003candrew.hendry@gmail.com\u003e\nAcked-by: Andrew Hendry \u003candrew.hendry@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "a1b7ab0836a56fa4c9578f88ba1042398d7d9316", "tree": "5b5435397e994519b529c143c6960a35eb015308", "parents": [ "00b8e8ceece20db990b1fbb11f1d6051a276436b" ], "author": { "name": "Jason Wang", "email": "jasowang@redhat.com", "time": "Sun Oct 09 10:56:44 2011 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Sun Oct 16 14:14:54 2011 -0700" }, "message": "ipv6: fix NULL dereference in udp6_ufo_fragment()\n\nThis patch fixes the issue caused by ef81bb40bf15f350fe865f31fa42f1082772a576\nwhich is a backport of upstream 87c48fa3b4630905f98268dde838ee43626a060c. The\nproblem does not exist in upstream.\n\nWe do not check whether route is attached before trying to assign ip\nidentification through route dest which lead NULL pointer dereference. This\nhappens when host bridge transmit a packet from guest.\n\nThis patch changes ipv6_select_ident() to accept in6_addr as its paramter and\nfix the issue by using the destination address in ipv6 header when no route is\nattached.\n\nSigned-off-by: Jason Wang \u003cjasowang@redhat.com\u003e\nAcked-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "508ed7445438cb6dffa105a128333c8461bfd5e4", "tree": "dc7d869f0739e377cabc6d004d60d452f30ef86c", "parents": [ "660702319c69a876dd20fac4499a588cbd66a79a" ], "author": { "name": "Jouni Malinen", "email": "jouni@qca.qualcomm.com", "time": "Wed Sep 21 16:13:07 2011 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:41:10 2011 -0700" }, "message": "cfg80211: Fix validation of AKM suites\n\ncommit 1b9ca0272ffae212e726380f66777b30a56ed7a5 upstream.\n\nIncorrect variable was used in validating the akm_suites array from\nNL80211_ATTR_AKM_SUITES. In addition, there was no explicit\nvalidation of the array length (we only have room for\nNL80211_MAX_NR_AKM_SUITES).\n\nThis can result in a buffer write overflow for stack variables with\narbitrary data from user space. The nl80211 commands using the affected\nfunctionality require GENL_ADMIN_PERM, so this is only exposed to admin\nusers.\n\nSigned-off-by: Jouni Malinen \u003cjouni@qca.qualcomm.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "8341e503c2628f056a9fdfe244f15c96b31c04c9", "tree": "24937a0d3ad5f7775edacdfe5e154b2a4d703527", "parents": [ "caebafff01eee11443bbee4e036497d234f29d76" ], "author": { "name": "Oliver Neukum", "email": "oliver@neukum.org", "time": "Tue Aug 30 15:52:18 2011 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:41:01 2011 -0700" }, "message": "Bluetooth: Fix timeout on scanning for the second time\n\ncommit 2d20a26a92f72e3bb658fe8ce99c3663756e9e7a upstream.\n\nThe checks for HCI_INQUIRY and HCI_MGMT were in the wrong order,\nso that second scans always failed.\n\nSigned-off-by: Oliver Neukum \u003coneukum@suse.de\u003e\nSigned-off-by: Gustavo F. Padovan \u003cpadovan@profusion.mobi\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "af674335761a7ab9b015ec7e051ae232d5c0efab", "tree": "54e6a8956a8fd62d31dffed1a79912187c75fb16", "parents": [ "42270cd40ba8e0134cffd1c036a1aa3d844369a8" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Tue Aug 23 19:57:05 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:56 2011 -0700" }, "message": "bridge: fix a possible use after free\n\n[ Upstream commit 22df13319d1fec30b8f9bcaadc295829647109bb ]\n\nbr_multicast_ipv6_rcv() can call pskb_trim_rcsum() and therefore skb\nhead can be reallocated.\n\nCache icmp6_type field instead of dereferencing twice the struct\nicmp6hdr pointer.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "42270cd40ba8e0134cffd1c036a1aa3d844369a8", "tree": "5f47eb081956ddc7288c71023686b3bc731790b3", "parents": [ "23b576bfe4a6056afb6bca3cd1cb96581f4cb19d" ], "author": { "name": "Yan, Zheng", "email": "zheng.z.yan@intel.com", "time": "Tue Aug 23 22:54:33 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:56 2011 -0700" }, "message": "bridge: Pseudo-header required for the checksum of ICMPv6\n\n[ Upstream commit 4b275d7efa1c4412f0d572fcd7f78ed0919370b3 ]\n\nChecksum of ICMPv6 is not properly computed because the pseudo header is not used.\nThus, the MLD packet gets dropped by the bridge.\n\nSigned-off-by: Zheng Yan \u003czheng.z.yan@intel.com\u003e\nReported-by: Ang Way Chuang \u003cwcang@sfc.wide.ad.jp\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "23b576bfe4a6056afb6bca3cd1cb96581f4cb19d", "tree": "a59620d86b35fa1cddf5490a0a23a50f862bd324", "parents": [ "b082a5631a746b494553f7c72b387cb625a1674a" ], "author": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Sep 20 23:38:58 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:55 2011 -0700" }, "message": "xfrm: Perform a replay check after return from async codepaths\n\n[ Upstream commit bcf66bf54aabffc150acd1c99e0f4bc51935eada ]\n\nWhen asyncronous crypto algorithms are used, there might be many\npackets that passed the xfrm replay check, but the replay advance\nfunction is not called yet for these packets. So the replay check\nfunction would accept a replay of all of these packets. Also the\nsystem might crash if there are more packets in async processing\nthan the size of the anti replay window, because the replay advance\nfunction would try to update the replay window beyond the bounds.\n\nThis pach adds a second replay check after resuming from the async\nprocessing to fix these issues.\n\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nAcked-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "b082a5631a746b494553f7c72b387cb625a1674a", "tree": "51e1dd946e9d985c089a64429fa754793b6182f8", "parents": [ "bc4c1bd0d97dfd9a705bcb3ade46b051c3f4647d" ], "author": { "name": "Jiri Pirko", "email": "jpirko@redhat.com", "time": "Thu Aug 18 21:29:27 2011 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:55 2011 -0700" }, "message": "vlan: reset headers on accel emulation path\n\n[ Upstream commit c5114cd59d2664f258b0d021d79b1532d94bdc2b ]\n\nIt\u0027s after all necessary to do reset headers here. The reason is we\ncannot depend that it gets reseted in __netif_receive_skb once skb is\nreinjected. For incoming vlanids without vlan_dev, vlan_do_receive()\nreturns false with skb !\u003d NULL and __netif_reveive_skb continues, skb is\nnot reinjected.\n\nThis might be good material for 3.0-stable as well\n\nReported-by: Mike Auty \u003cmike.auty@gmail.com\u003e\nSigned-off-by: Jiri Pirko \u003cjpirko@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "bc4c1bd0d97dfd9a705bcb3ade46b051c3f4647d", "tree": "9902cabed36b1c3d245144e062800c1322f9935e", "parents": [ "616ea55abc53ced58c4097b33b26abea01a743d4" ], "author": { "name": "Mike Waychison", "email": "mikew@google.com", "time": "Wed Aug 10 21:59:57 2011 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:54 2011 -0700" }, "message": "tcp: initialize variable ecn_ok in syncookies path\n\n[ Upstream commit f0e3d0689da401f7d1981c2777a714ba295ea5ff ]\n\nUsing a gcc 4.4.3, warnings are emitted for a possibly uninitialized use\nof ecn_ok.\n\nThis can happen if cookie_check_timestamp() returns due to not having\nseen a timestamp. Defaulting to ecn off seems like a reasonable thing\nto do in this case, so initialized ecn_ok to false.\n\nSigned-off-by: Mike Waychison \u003cmikew@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "616ea55abc53ced58c4097b33b26abea01a743d4", "tree": "745fddbb114a33925b15f5ca53f4e7bd5df31fec", "parents": [ "265d5c2eb22550566cf4193df46596dac439374c" ], "author": { "name": "Zheng Yan", "email": "zheng.z.yan@intel.com", "time": "Sun Sep 18 22:37:34 2011 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:54 2011 -0700" }, "message": "tcp: fix validation of D-SACK\n\n[ Upstream commit f779b2d60ab95c17f1e025778ed0df3ec2f05d75 ]\n\nD-SACK is allowed to reside below snd_una. But the corresponding check\nin tcp_is_sackblock_valid() is the exact opposite. It looks like a typo.\n\nSigned-off-by: Zheng Yan \u003czheng.z.yan@intel.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "265d5c2eb22550566cf4193df46596dac439374c", "tree": "26ea2ddaf5eb4967e072f3c5559d7a9732044edf", "parents": [ "5c97f6d48701d464dfd6e8782399383686603b65" ], "author": { "name": "Tim Chen", "email": "tim.c.chen@linux.intel.com", "time": "Tue Aug 09 06:48:32 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:54 2011 -0700" }, "message": "scm: Capture the full credentials of the scm sender\n\n[ Upstream commit e33f7a9f37d486f4c6cce5de18a6eea11d68f64f ]\n\nThis patch corrects an erroneous update of credential\u0027s gid with uid\nintroduced in commit 257b5358b32f17 since 2.6.36.\n\nSigned-off-by: Tim Chen \u003ctim.c.chen@linux.intel.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nReviewed-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "621ad27ca68f318db0d416e5c1401d35c95c6d91", "tree": "47e1b58900fe6cf69ba890a0a5fe7749d783b3a9", "parents": [ "018660661b23526bbc9ebcd2dc260453ed1f49d5" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Aug 09 02:04:43 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:53 2011 -0700" }, "message": "net_sched: prio: use qdisc_dequeue_peeked\n\n[ Upstream commit 3557619f0f6f7496ed453d4825e24958ab1884e0 ]\n\ncommit 07bd8df5df4369487812bf85a237322ff3569b77\n(sch_sfq: fix peek() implementation) changed sfq to use generic\npeek helper.\n\nThis makes HFSC complain about a non-work-conserving child qdisc, if\nprio with sfq child is used within hfsc:\n\nhfsc peeks into prio qdisc, which will then peek into sfq.\nreturned skb is stashed in sch-\u003egso_skb.\n\nNext, hfsc tries to dequeue from prio, but prio will call sfq dequeue\ndirectly, which may return NULL instead of previously peeked-at skb.\n\nHave prio call qdisc_dequeue_peeked, so sfq-\u003edequeue() is\nnot called in this case.\n\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "018660661b23526bbc9ebcd2dc260453ed1f49d5", "tree": "bbc6209d5fb089ba3ed10a6f3f45c7e2f07743bb", "parents": [ "2ce655e2c1e821c6681bb0001c8a0add874647ec" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Sun Aug 07 09:11:00 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:53 2011 -0700" }, "message": "netfilter: TCP and raw fix for ip_route_me_harder\n\n[ Upstream commit 797fd3913abf2f7036003ab8d3d019cbea41affd ]\n\nTCP in some cases uses different global (raw) socket\nto send RST and ACK. The transparent flag is not set there.\nCurrently, it is a problem for rerouting after the previous\nchange.\n\n\tFix it by simplifying the checks in ip_route_me_harder\nand use FLOWI_FLAG_ANYSRC even for sockets. It looks safe\nbecause the initial routing allowed this source address to\nbe used and now we just have to make sure the packet is rerouted.\n\n\tAs a side effect this also allows rerouting for normal\nraw sockets that use spoofed source addresses which was not possible\neven before we eliminated the ip_route_input call.\n\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "2ce655e2c1e821c6681bb0001c8a0add874647ec", "tree": "2ab68ce15fec2c419a312be6e69381caedc9531a", "parents": [ "ea918c963323df0ad0d5052702b76c3230bf414d" ], "author": { "name": "Yan, Zheng", "email": "zheng.z.yan@intel.com", "time": "Tue Aug 23 22:54:37 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:53 2011 -0700" }, "message": "mcast: Fix source address selection for multicast listener report\n\n[ Upstream commit e05c4ad3ed874ee4f5e2c969e55d318ec654332c ]\n\nShould check use count of include mode filter instead of total number\nof include mode filters.\n\nSigned-off-by: Zheng Yan \u003czheng.z.yan@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "ea918c963323df0ad0d5052702b76c3230bf414d", "tree": "32e7fe8168e2c62c55afc9e5b0af12c36e2f75d9", "parents": [ "025fd917321b1af0417d5cff2f17907fa77ee0a2" ], "author": { "name": "Daniel Baluta", "email": "dbaluta@ixiacom.com", "time": "Fri Aug 19 03:19:07 2011 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:52 2011 -0700" }, "message": "ipv6: Fix ipv6_getsockopt for IPV6_2292PKTOPTIONS\n\n[ Upstream commit 98e77438aed3cd3343cbb86825127b1d9d2bea33 ]\n\nIPV6_2292PKTOPTIONS is broken for 32-bit applications running\nin COMPAT mode on 64-bit kernels.\n\nThe same problem was fixed for IPv4 with the patch:\nipv4: Fix ip_getsockopt for IP_PKTOPTIONS,\ncommit dd23198e58cd35259dd09e8892bbdb90f1d57748\n\nSigned-off-by: Sorin Dumitru \u003csdumitru@ixiacom.com\u003e\nSigned-off-by: Daniel Baluta \u003cdbaluta@ixiacom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "025fd917321b1af0417d5cff2f17907fa77ee0a2", "tree": "a2dba9c4d439e84e885aea11ab6b2e4819caea19", "parents": [ "cbab190c501c8034b82e0dd9da7fdb4b75e08daa" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Tue Aug 09 04:01:16 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:51 2011 -0700" }, "message": "ipv4: some rt_iif -\u003e rt_route_iif conversions\n\n[ Upstream commit 97a804102021431fa6fa33c21c85df762b0f5cb9 ]\n\nAs rt_iif represents input device even for packets\ncoming from loopback with output route, it is not an unique\nkey specific to input routes. Now rt_route_iif has such role,\nit was fl.iif in 2.6.38, so better to change the checks at\nsome places to save CPU cycles and to restore 2.6.38 semantics.\n\ncompare_keys:\n\t- input routes: only rt_route_iif matters, rt_iif is same\n\t- output routes: only rt_oif matters, rt_iif is not\n\t\tused for matching in __ip_route_output_key\n\t- now we are back to 2.6.38 state\n\nip_route_input_common:\n\t- matching rt_route_iif implies input route\n\t- compared to 2.6.38 we eliminated one rth-\u003efl.oif check\n\tbecause it was not needed even for 2.6.38\n\ncompare_hash_inputs:\n\tOnly the change here is not an optimization, it has\n\teffect only for output routes. I assume I\u0027m restoring\n\tthe original intention to ignore oif, it was using fl.iif\n\t- now we are back to 2.6.38 state\n\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "cbab190c501c8034b82e0dd9da7fdb4b75e08daa", "tree": "906c1a75f88c366d3e85ab20caf6b4bb2acc238c", "parents": [ "5ee858c9ab53a4f6b12a095a4982793d4f417f56" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Sun Sep 11 15:36:05 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:51 2011 -0700" }, "message": "fib:fix BUG_ON in fib_nl_newrule when add new fib rule\n\n[ Upstream commit 561dac2d410ffac0b57a23b85ae0a623c1a076ca ]\n\nadd new fib rule can cause BUG_ON happen\nthe reproduce shell is\nip rule add pref 38\nip rule add pref 38\nip rule add to 192.168.3.0/24 goto 38\nip rule del pref 38\nip rule add to 192.168.3.0/24 goto 38\nip rule add pref 38\n\nthen the BUG_ON will happen\ndel BUG_ON and use (ctarget \u003d\u003d NULL) identify whether this rule is unresolved\n\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "5ee858c9ab53a4f6b12a095a4982793d4f417f56", "tree": "27b8a68433d4029e20ceae2316c953435086c12f", "parents": [ "8e24aecbcdd00d94474a6e2e61bed59866c0d539" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Mon Aug 22 06:05:59 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:50 2011 -0700" }, "message": "bridge: fix a possible net_device leak\n\n[ Upstream commit 11f3a6bdc2528d1ce2af50202dbf7138fdee1b34 ]\n\nJan Beulich reported a possible net_device leak in bridge code after\ncommit bb900b27a2f4 (bridge: allow creating bridge devices with netlink)\n\nReported-by: Jan Beulich \u003cJBeulich@novell.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nAcked-by: Stephen Hemminger \u003cshemminger@vyatta.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "8e24aecbcdd00d94474a6e2e61bed59866c0d539", "tree": "5da9d96b661e09ae6dea09698224842256f6287f", "parents": [ "3b576ff8b0e8a70be60a0ee8aa7d637ba27db2c8" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Mon Aug 22 19:32:42 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:50 2011 -0700" }, "message": "arp: fix rcu lockdep splat in arp_process()\n\n[ Upstream commit 20e6074eb8e096b3a595c093d1cb222f378cd671 ]\n\nDave Jones reported a lockdep splat triggered by an arp_process() call\nfrom parp_redo().\n\nCommit faa9dcf793be (arp: RCU changes) is the origin of the bug, since\nit assumed arp_process() was called under rcu_read_lock(), which is not\ntrue in this particular path.\n\nInstead of adding rcu_read_lock() in parp_redo(), I chose to add it in\nneigh_proxy_process() to take care of IPv6 side too.\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ INFO: suspicious rcu_dereference_check() usage. ]\n ---------------------------------------------------\n include/linux/inetdevice.h:209 invoked rcu_dereference_check() without\nprotection!\n\n other info that might help us debug this:\n\n rcu_scheduler_active \u003d 1, debug_locks \u003d 0\n 4 locks held by setfiles/2123:\n #0: (\u0026sb-\u003es_type-\u003ei_mutex_key#13){+.+.+.}, at: [\u003cffffffff8114cbc4\u003e]\nwalk_component+0x1ef/0x3e8\n #1: (\u0026isec-\u003elock){+.+.+.}, at: [\u003cffffffff81204bca\u003e]\ninode_doinit_with_dentry+0x3f/0x41f\n #2: (\u0026tbl-\u003eproxy_timer){+.-...}, at: [\u003cffffffff8106a803\u003e]\nrun_timer_softirq+0x157/0x372\n #3: (class){+.-...}, at: [\u003cffffffff8141f256\u003e] neigh_proxy_process\n+0x36/0x103\n\n stack backtrace:\n Pid: 2123, comm: setfiles Tainted: G W\n3.1.0-0.rc2.git7.2.fc16.x86_64 #1\n Call Trace:\n \u003cIRQ\u003e [\u003cffffffff8108ca23\u003e] lockdep_rcu_dereference+0xa7/0xaf\n [\u003cffffffff8146a0b7\u003e] __in_dev_get_rcu+0x55/0x5d\n [\u003cffffffff8146a751\u003e] arp_process+0x25/0x4d7\n [\u003cffffffff8146ac11\u003e] parp_redo+0xe/0x10\n [\u003cffffffff8141f2ba\u003e] neigh_proxy_process+0x9a/0x103\n [\u003cffffffff8106a8c4\u003e] run_timer_softirq+0x218/0x372\n [\u003cffffffff8106a803\u003e] ? run_timer_softirq+0x157/0x372\n [\u003cffffffff8141f220\u003e] ? neigh_stat_seq_open+0x41/0x41\n [\u003cffffffff8108f2f0\u003e] ? mark_held_locks+0x6d/0x95\n [\u003cffffffff81062bb6\u003e] __do_softirq+0x112/0x25a\n [\u003cffffffff8150d27c\u003e] call_softirq+0x1c/0x30\n [\u003cffffffff81010bf5\u003e] do_softirq+0x4b/0xa2\n [\u003cffffffff81062f65\u003e] irq_exit+0x5d/0xcf\n [\u003cffffffff8150dc11\u003e] smp_apic_timer_interrupt+0x7c/0x8a\n [\u003cffffffff8150baf3\u003e] apic_timer_interrupt+0x73/0x80\n \u003cEOI\u003e [\u003cffffffff8108f439\u003e] ? trace_hardirqs_on_caller+0x121/0x158\n [\u003cffffffff814fc285\u003e] ? __slab_free+0x30/0x24c\n [\u003cffffffff814fc283\u003e] ? __slab_free+0x2e/0x24c\n [\u003cffffffff81204e74\u003e] ? inode_doinit_with_dentry+0x2e9/0x41f\n [\u003cffffffff81204e74\u003e] ? inode_doinit_with_dentry+0x2e9/0x41f\n [\u003cffffffff81204e74\u003e] ? inode_doinit_with_dentry+0x2e9/0x41f\n [\u003cffffffff81130cb0\u003e] kfree+0x108/0x131\n [\u003cffffffff81204e74\u003e] inode_doinit_with_dentry+0x2e9/0x41f\n [\u003cffffffff81204fc6\u003e] selinux_d_instantiate+0x1c/0x1e\n [\u003cffffffff81200f4f\u003e] security_d_instantiate+0x21/0x23\n [\u003cffffffff81154625\u003e] d_instantiate+0x5c/0x61\n [\u003cffffffff811563ca\u003e] d_splice_alias+0xbc/0xd2\n [\u003cffffffff811b17ff\u003e] ext4_lookup+0xba/0xeb\n [\u003cffffffff8114bf1e\u003e] d_alloc_and_lookup+0x45/0x6b\n [\u003cffffffff8114cbea\u003e] walk_component+0x215/0x3e8\n [\u003cffffffff8114cdf8\u003e] lookup_last+0x3b/0x3d\n [\u003cffffffff8114daf3\u003e] path_lookupat+0x82/0x2af\n [\u003cffffffff8110fc53\u003e] ? might_fault+0xa5/0xac\n [\u003cffffffff8110fc0a\u003e] ? might_fault+0x5c/0xac\n [\u003cffffffff8114c564\u003e] ? getname_flags+0x31/0x1ca\n [\u003cffffffff8114dd48\u003e] do_path_lookup+0x28/0x97\n [\u003cffffffff8114df2c\u003e] user_path_at+0x59/0x96\n [\u003cffffffff811467ad\u003e] ? cp_new_stat+0xf7/0x10d\n [\u003cffffffff811469a6\u003e] vfs_fstatat+0x44/0x6e\n [\u003cffffffff811469ee\u003e] vfs_lstat+0x1e/0x20\n [\u003cffffffff81146b3d\u003e] sys_newlstat+0x1a/0x33\n [\u003cffffffff8108f439\u003e] ? trace_hardirqs_on_caller+0x121/0x158\n [\u003cffffffff812535fe\u003e] ? trace_hardirqs_on_thunk+0x3a/0x3f\n [\u003cffffffff8150af82\u003e] system_call_fastpath+0x16/0x1b\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "cb49a34465aff5bb9c5209e2b8e775cead9712c7", "tree": "7eaa401d3f94d364b1eeae7904d87efe2b83544c", "parents": [ "310fef97e2c781acbc6603f010c5e14e0e90913b" ], "author": { "name": "Rajkumar Manoharan", "email": "rmanohar@qca.qualcomm.com", "time": "Wed Sep 14 14:28:17 2011 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:40 2011 -0700" }, "message": "wireless: Reset beacon_found while updating regulatory\n\ncommit aa3d7eef398dd4f29045e9889b817d5161afe03e upstream.\n\nDuring the association, the regulatory is updated by country IE\nthat reaps the previously found beacons. The impact is that\nafter a STA disconnects *or* when for any reason a regulatory\ndomain change happens the beacon hint flag is not cleared\ntherefore preventing future beacon hints to be learned.\nThis is important as a regulatory domain change or a restore\nof regulatory settings would set back the passive scan and no-ibss\nflags on the channel. This is the right place to do this given that\nit covers any regulatory domain change.\n\nReviewed-by: Luis R. Rodriguez \u003cmcgrof@gmail.com\u003e\nSigned-off-by: Rajkumar Manoharan \u003crmanohar@qca.qualcomm.com\u003e\nAcked-by: Luis R. Rodriguez \u003cmcgrof@qca.qualcomm.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "e74aa3593a0026ea78b3997c3b7748f536e17f66", "tree": "d709f7031fb2eae91eefa79552cb6dbf87f0dad6", "parents": [ "377a4a241c44d46335b45e00c8a66d39b072fd2f" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Sep 06 12:47:39 2011 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:28 2011 -0700" }, "message": "mac80211: fix missing sta_lock in __sta_info_destroy\n\ncommit 4bae7d976976fa52d345805ba686934cd548343e upstream.\n\nSince my commit 34e895075e21be3e21e71d6317440d1ee7969ad0\n(\"mac80211: allow station add/remove to sleep\") there is\na race in mac80211 when it clears the TIM bit because a\nsleeping station disconnected, the spinlock isn\u0027t held\naround the relevant code any more. Use the right API to\nacquire the spinlock correctly.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "8926487ad88b00a9b6677f866df787dea7b3471b", "tree": "c49509d0071647326233985394474a8365083b3d", "parents": [ "a111278ea956e42e2d1ac4b4f04a2c71d322235b" ], "author": { "name": "Aneesh Kumar K.V", "email": "aneesh.kumar@linux.vnet.ibm.com", "time": "Wed Aug 17 16:56:04 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:22 2011 -0700" }, "message": "net/9p: Fix kernel crash with msize 512K\n\ncommit b49d8b5d7007a673796f3f99688b46931293873e upstream.\n\nWith msize equal to 512K (PAGE_SIZE * VIRTQUEUE_NUM), we hit multiple\ncrashes. This patch fix those.\n\nSigned-off-by: Aneesh Kumar K.V \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nSigned-off-by: Eric Van Hensbergen \u003cericvh@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "8aeae69113b438efadd5b9dda754e60685d8d6c1", "tree": "8afe37bbb03bdd072de4e77f5e4ac03981208173", "parents": [ "926fa0b4b9cd6537f4750642165647aa20cfeae4" ], "author": { "name": "Venkateswararao Jujjuri (JV)", "email": "jvrao@linux.vnet.ibm.com", "time": "Wed Jun 29 18:06:33 2011 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:18 2011 -0700" }, "message": "net/9p: Fix the msize calculation.\n\ncommit c9ffb05ca5b5098d6ea468c909dd384d90da7d54 upstream.\n\nmsize represents the maximum PDU size that includes P9_IOHDRSZ.\n\nSigned-off-by: Venkateswararao Jujjuri \"\u003cjvrao@linux.vnet.ibm.com\u003e\nSigned-off-by: Aneesh Kumar K.V \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nSigned-off-by: Eric Van Hensbergen \u003cericvh@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "a0be78ef93e0656339bf14feddc0e8afb2a86894", "tree": "9898107a0f01304bed77cb179efaed4dc0678edf", "parents": [ "0beac585155d05699b1f186556d23c240a9e245d" ], "author": { "name": "Aneesh Kumar K.V", "email": "aneesh.kumar@linux.vnet.ibm.com", "time": "Mon Jul 11 16:40:58 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:17 2011 -0700" }, "message": "fs/9p: Fid is not valid after a failed clunk.\n\ncommit 5034990e28efb2d232ee82443a9edd62defd17ba upstream.\n\nfree the fid even in case of failed clunk.\n\nSigned-off-by: Aneesh Kumar K.V \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nSigned-off-by: Eric Van Hensbergen \u003cericvh@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "0beac585155d05699b1f186556d23c240a9e245d", "tree": "59da624d8606dc00423483d9a85b787741f6872a", "parents": [ "8b1aebc0bef2e492a1857a1ea9dfc3ab7408b184" ], "author": { "name": "jvrao", "email": "jvrao@linux.vnet.ibm.com", "time": "Thu Jun 30 23:18:41 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:17 2011 -0700" }, "message": "VirtIO can transfer VIRTQUEUE_NUM of pages.\n\ncommit 7f781679dd596c8abde8336b4d0d166d6a4aad04 upstream.\n\nSigned-off-by: Venkateswararao Jujjuri \"\u003cjvrao@linux.vnet.ibm.com\u003e\nReviewed-by: Aneesh Kumar K.V \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nSigned-off-by: Eric Van Hensbergen \u003cericvh@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "8b1aebc0bef2e492a1857a1ea9dfc3ab7408b184", "tree": "2ef04cce79c055fd7ced519cb7ba70f7c105f1be", "parents": [ "7b551b70695eb39e8bfcc29ae9883e66254cb12d" ], "author": { "name": "jvrao", "email": "jvrao@linux.vnet.ibm.com", "time": "Thu Jun 30 23:18:39 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:16 2011 -0700" }, "message": "Fix the size of receive buffer packing onto VirtIO ring.\n\ncommit 114e6f3a5ede73d5b56e145f04680c61c3dd67c4 upstream.\n\nSigned-off-by: Venkateswararao Jujjuri \"\u003cjvrao@linux.vnet.ibm.com\u003e\nReviewed-by: Aneesh Kumar K.V \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nSigned-off-by: Eric Van Hensbergen \u003cericvh@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "7b551b70695eb39e8bfcc29ae9883e66254cb12d", "tree": "066d0d074908159c05d6dfd3b96a1269bb6e931d", "parents": [ "f2685ef0fbc5fff0a8f1cdc204bf37ab0c9a04a7" ], "author": { "name": "Eric Van Hensbergen", "email": "ericvh@gmail.com", "time": "Wed Jul 13 19:12:18 2011 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:40:16 2011 -0700" }, "message": "net/9p: fix client code to fail more gracefully on protocol error\n\ncommit b85f7d92d7bd7e3298159e8b1eed8cb8cbbb0348 upstream.\n\nThere was a BUG_ON to protect against a bad id which could be dealt with\nmore gracefully.\n\nReported-by: Natalie Orlin \u003cnorlin@us.ibm.com\u003e\nSigned-off-by: Eric Van Hensbergen \u003cericvh@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "bdfd59ed66725e66155f011023771bdc15b69c7f", "tree": "31b0cf7e95dfb6873b8518eea10649a19e87fc91", "parents": [ "e4dd9ac202da43712e1725087a7f5c656b79fb51" ], "author": { "name": "Daniel Schwierzeck", "email": "daniel.schwierzeck@googlemail.com", "time": "Fri Aug 19 12:04:20 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:39:57 2011 -0700" }, "message": "atm: br2684: Fix oops due to skb-\u003edev being NULL\n\ncommit fbe5e29ec1886967255e76946aaf537b8cc9b81e upstream.\n\nThis oops have been already fixed with commit\n\n 27141666b69f535a4d63d7bc6d9e84ee5032f82a\n\n atm: [br2684] Fix oops due to skb-\u003edev being NULL\n\n It happens that if a packet arrives in a VC between the call to open it on\n the hardware and the call to change the backend to br2684, br2684_regvcc\n processes the packet and oopses dereferencing skb-\u003edev because it is\n NULL before the call to br2684_push().\n\nbut have been introduced again with commit\n\n b6211ae7f2e56837c6a4849316396d1535606e90\n\n atm: Use SKB queue and list helpers instead of doing it by-hand.\n\nSigned-off-by: Daniel Schwierzeck \u003cdaniel.schwierzeck@googlemail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "5772ee1f183ddfb9386bc7792149d731dbba8725", "tree": "fd97036cb1bd9a3baa03d6b8df2c2b94f171f238", "parents": [ "f1d44226b60a7b28f949105e675ba84a09bcc9a7" ], "author": { "name": "Mathieu Desnoyers", "email": "mathieu.desnoyers@efficios.com", "time": "Wed Aug 24 19:45:03 2011 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Oct 03 11:39:54 2011 -0700" }, "message": "sendmmsg/sendmsg: fix unsafe user pointer access\n\ncommit bc909d9ddbf7778371e36a651d6e4194b1cc7d4c upstream.\n\nDereferencing a user pointer directly from kernel-space without going\nthrough the copy_from_user family of functions is a bad idea. Two of\nsuch usages can be found in the sendmsg code path called from sendmmsg,\nadded by\n\ncommit c71d8ebe7a4496fb7231151cb70a6baa0cb56f9a upstream.\ncommit 5b47b8038f183b44d2d8ff1c7d11a5c1be706b34 in the 3.0-stable tree.\n\nUsages are performed through memcmp() and memcpy() directly. Fix those\nby using the already copied msg_sys structure instead of the __user *msg\nstructure. Note that msg_sys can be set to NULL by verify_compat_iovec()\nor verify_iovec(), which requires additional NULL pointer checks.\n\nSigned-off-by: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nSigned-off-by: David Goulet \u003cdgoulet@ev0ke.net\u003e\nCC: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nCC: Anton Blanchard \u003canton@samba.org\u003e\nCC: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "55041e081ef433774279ecb6fc3fd30f741f5f37", "tree": "6e77743bce1c4cd9b6455cf79157a25c1911025b", "parents": [ "d7a8a78d13730620f9527cff14b444266c05e0cb" ], "author": { "name": "Chas Williams", "email": "chas@cmf.nrl.navy.mil", "time": "Mon Aug 01 17:56:14 2011 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Wed Aug 17 10:55:52 2011 -0700" }, "message": "atm: br2864: sent packets truncated in VC routed mode\n\ncommit a08af810cdc29d2ca930e8a869d3d01744c392d8 upstream.\n\nReported-by: Pascal Hambourg \u003cpascal@plouf.fr.eu.org\u003e\nSigned-off-by: Chas Williams \u003cchas@cmf.nrl.navy.mil\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n" }, { "commit": "06e67267adf0e3b9a25a78250a1c7caefd36f843", "tree": "e3a3f7129a0bd38662e5ff6b3e42732a468443fd", "parents": [ "cb737cb02933192dcbb141480e3dc8153b89be48" ], "author": { "name": "xeb@mail.ru", "email": "xeb@mail.ru", "time": "Fri Jul 22 20:49:40 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:39 2011 -0700" }, "message": "gre: fix improper error handling\n\n[ Upstream commit 559fafb94ad9e4cd8774f39241917c57396f9fc5 ]\n\nFix improper protocol err_handler, current implementation is fully\nunapplicable and may cause kernel crash due to double kfree_skb.\n\nSigned-off-by: Dmitry Kozlov \u003cxeb@mail.ru\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "cb737cb02933192dcbb141480e3dc8153b89be48", "tree": "2f39e114f7e7a9ca692ac4dc542cef3b43000993", "parents": [ "c8656c500dd6e88d427547abe2859213a916a3ea" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Sat Jul 23 02:00:41 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:39 2011 -0700" }, "message": "ipv4: use RT_TOS after some rt_tos conversions\n\n[ Upstream commit b0fe4a31849063fcac0bdc93716ca92615e93f57 ]\n\nrt_tos was changed to iph-\u003etos but it must be filtered by RT_TOS\n\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "c8656c500dd6e88d427547abe2859213a916a3ea", "tree": "f4422706c2691287c1d85543d4cd5328af3c040b", "parents": [ "7106159f8bd33bd5e5b0ea2c87e499117fc22c69" ], "author": { "name": "stephen hemminger", "email": "shemminger@vyatta.com", "time": "Fri Jul 22 12:53:56 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:39 2011 -0700" }, "message": "net: allow netif_carrier to be called safely from IRQ\n\n[ Upstream commit 1821f7cd65ad9ea56580b830ac79bf4c4fef59cb ]\n\nAs reported by Ben Greer and Froncois Romieu. The code path in\nthe netif_carrier code leads it to try and disable\na late workqueue to reenable it immediately\nnetif_carrier_on\n-\u003e linkwatch_fire_event\n -\u003e linkwatch_schedule_work\n -\u003e cancel_delayed_work\n -\u003e del_timer_sync\n\nIf __cancel_delayed_work is used instead then there is no\nproblem of waiting for running linkwatch_event.\n\nThere is a race between linkwatch_event running re-scheduling\nbut it is harmless to schedule an extra scan of the linkwatch queue.\n\nSigned-off-by: Stephen Hemminger \u003cshemminger@vyatta.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "3b9dfc69a292c4397815756bb404f2cda44ae7de", "tree": "36eff860b800c75175532b8d87ff506a650f08ff", "parents": [ "d98630f19f4880bfdb170231ef9f0ba781ecc850" ], "author": { "name": "Tushar Gohad", "email": "tgohad@mvista.com", "time": "Thu Jul 28 10:36:20 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:39 2011 -0700" }, "message": "xfrm: Fix key lengths for rfc3686(ctr(aes))\n\n[ Upstream commit 4203223a1aed862b4445fdcd260d6139603a51d9 ]\n\nFix the min and max bit lengths for AES-CTR (RFC3686) keys.\nThe number of bits in key spec is the key length (128/256)\nplus 32 bits of nonce.\n\nThis change takes care of the \"Invalid key length\" errors\nreported by setkey when specifying 288 bit keys for aes-ctr.\n\nSigned-off-by: Tushar Gohad \u003ctgohad@mvista.com\u003e\nAcked-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "9cf81e790a0d8709cbadbaff73ee40aa944e2ea1", "tree": "461eef924ffafe4de495a6fb0379d1c0efd88e85", "parents": [ "60f17a7798369bec34f171ca126f8247c773763b" ], "author": { "name": "Neil Horman", "email": "nhorman@tuxdriver.com", "time": "Tue Jul 26 06:05:38 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:38 2011 -0700" }, "message": "net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared\n\n[ Upstream commit 550fd08c2cebad61c548def135f67aba284c6162 ]\n\nAfter the last patch, We are left in a state in which only drivers calling\nether_setup have IFF_TX_SKB_SHARING set (we assume that drivers touching real\nhardware call ether_setup for their net_devices and don\u0027t hold any state in\ntheir skbs. There are a handful of drivers that violate this assumption of\ncourse, and need to be fixed up. This patch identifies those drivers, and marks\nthem as not being able to support the safe transmission of skbs by clearning the\nIFF_TX_SKB_SHARING flag in priv_flags\n\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nCC: Karsten Keil \u003cisdn@linux-pingi.de\u003e\nCC: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCC: Jay Vosburgh \u003cfubar@us.ibm.com\u003e\nCC: Andy Gospodarek \u003candy@greyhouse.net\u003e\nCC: Patrick McHardy \u003ckaber@trash.net\u003e\nCC: Krzysztof Halasa \u003ckhc@pm.waw.pl\u003e\nCC: \"John W. Linville\" \u003clinville@tuxdriver.com\u003e\nCC: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\nCC: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nCC: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "60f17a7798369bec34f171ca126f8247c773763b", "tree": "84f10726110facc5c624bccedc02cab0fa6da970", "parents": [ "711ae7c7a810eb8bc92cac46041c996eb66dbd54" ], "author": { "name": "Neil Horman", "email": "nhorman@tuxdriver.com", "time": "Tue Jul 26 06:05:37 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:38 2011 -0700" }, "message": "net: add IFF_SKB_TX_SHARED flag to priv_flags\n\n[ Upstream commit d8873315065f1f527c7c380402cf59b1e1d0ae36 ]\n\nPktgen attempts to transmit shared skbs to net devices, which can\u0027t be used by\nsome drivers as they keep state information in skbs. This patch adds a flag\nmarking drivers as being able to handle shared skbs in their tx path. Drivers\nare defaulted to being unable to do so, but calling ether_setup enables this\nflag, as 90% of the drivers calling ether_setup touch real hardware and can\nhandle shared skbs. A subsequent patch will audit drivers to ensure that the\nflag is set properly\n\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nReported-by: Jiri Pirko \u003cjpirko@redhat.com\u003e\nCC: Robert Olsson \u003crobert.olsson@its.uu.se\u003e\nCC: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Alexey Dobriyan \u003cadobriyan@gmail.com\u003e\nCC: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "711ae7c7a810eb8bc92cac46041c996eb66dbd54", "tree": "981893e0b5c74291954deddd75ca505da52dafe2", "parents": [ "956c35400bfa51940de15ff7c31b7bba298f1dfe" ], "author": { "name": "Zoltan Kiss", "email": "schaman@sch.bme.hu", "time": "Sun Jul 24 13:09:30 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:38 2011 -0700" }, "message": "IPv4: Send gratuitous ARP for secondary IP addresses also\n\n[ Upstream commit b76d0789c92a816a5539dc14232a700b8d62a53a ]\n\nIf a device event generates gratuitous ARP messages, only primary\naddress is used for sending. This patch iterates through the whole\nlist. Tested with 2 IP addresses configuration on bonding interface.\n\nSigned-off-by: Zoltan Kiss \u003cschaman@sch.bme.hu\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "956c35400bfa51940de15ff7c31b7bba298f1dfe", "tree": "4777d846111b08e11b40ad8f3f53fcfabfefd618", "parents": [ "b1d3755791db359c3827c59248d9aa5f5f430931" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Fri Jul 29 19:22:42 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:38 2011 -0700" }, "message": "sch_sfq: fix sfq_enqueue()\n\n[ Upstream commit e1738bd9cecc5c867b0e2996470c1ff20f66ba79 ]\n\ncommit 8efa88540635 (sch_sfq: avoid giving spurious NET_XMIT_CN signals)\nforgot to call qdisc_tree_decrease_qlen() to signal upper levels that a\npacket (from another flow) was dropped, leading to various problems.\n\nWith help from Michal Soltys and Michal Pokrywka, who did a bisection.\n\nBugzilla ref: https://bugzilla.kernel.org/show_bug.cgi?id\u003d39372\nDebian ref: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug\u003d631945\n\nReported-by: Lucas Bocchi \u003clucas.bocchi@gmail.com\u003e\nReported-and-bisected-by: Michal Pokrywka \u003cwolfmoon@o2.pl\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Michal Soltys \u003csoltys@ziu.info\u003e\nAcked-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "d9399f30d1bf0bc5fdcbea1cbdda25a2e549f895", "tree": "b191aef02584e48bb1605831682b42e792261196", "parents": [ "88fd1eabecdffea04af6b0bc2aa56a5dfccb6a6e" ], "author": { "name": "Julia Lawall", "email": "julia@diku.dk", "time": "Thu Jul 28 02:46:01 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:37 2011 -0700" }, "message": "net: adjust array index\n\n[ Upstream commit a1889c0d2039a53ae04abb9f20c62500bd312bf3 ]\n\nConvert array index from the loop bound to the loop index.\n\nA simplified version of the semantic patch that fixes this problem is as\nfollows: (http://coccinelle.lip6.fr/)\n\n// \u003csmpl\u003e\n@@\nexpression e1,e2,ar;\n@@\n\nfor(e1 \u003d 0; e1 \u003c e2; e1++) { \u003c...\n ar[\n- e2\n+ e1\n ]\n ...\u003e }\n// \u003c/smpl\u003e\n\nSigned-off-by: Julia Lawall \u003cjulia@diku.dk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "88fd1eabecdffea04af6b0bc2aa56a5dfccb6a6e", "tree": "8c934eed9ddfd004a72cf6e21c3353d35b3a3b50", "parents": [ "44a41f45fb2609b37ff81dcbce186dc3f7f95fcb" ], "author": { "name": "Simon Horman", "email": "horms@verge.net.au", "time": "Thu May 19 21:32:57 2011 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:37 2011 -0700" }, "message": "IPVS: Free resources on module removal\n\n[ Upstream commit 7676e345824f162191b1fe2058ad948a6cf91c20 ]\n\nThis resolves a panic on module removal.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Hans Schillstrom \u003chans.schillstrom@ericsson.com\u003e\nSigned-off-by: Simon Horman \u003chorms@verge.net.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "44a41f45fb2609b37ff81dcbce186dc3f7f95fcb", "tree": "df18073b39e9446d381d5cfd27c9ce4cfe2af84b", "parents": [ "4339267bcded2540782c8f7587bc59434b89420c" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Sun Aug 07 22:20:20 2011 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:37 2011 -0700" }, "message": "ipv4: fix the reusing of routing cache entries\n\n[ Upstream commit d547f727df86059104af2234804fdd538e112015 ]\n\n\tcompare_keys and ip_route_input_common rely on\nrt_oif for distinguishing of input and output routes\nwith same keys values. But sometimes the input route has\nalso same hash chain (keyed by iif !\u003d 0) with the output\nroutes (keyed by orig_oif\u003d0). Problem visible if running\nwith small number of rhash_entries.\n\n\tFix them to use rt_route_iif instead. By this way\ninput route can not be returned to users that request\noutput route.\n\n\tThe patch fixes the ip_rt_bug errors that were\nreported in ip_local_out context, mostly for 255.255.255.255\ndestinations.\n\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" }, { "commit": "4339267bcded2540782c8f7587bc59434b89420c", "tree": "aefdf4216b3dcb842766a91746560f34adbd9fe2", "parents": [ "0671b3017cad5944fb2b63b5285802eeabb2cdd5" ], "author": { "name": "Bill Sommerfeld", "email": "wsommerfeld@google.com", "time": "Tue Jul 19 15:22:33 2011 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@suse.de", "time": "Mon Aug 15 18:31:37 2011 -0700" }, "message": "ipv4: Constrain UFO fragment sizes to multiples of 8 bytes\n\n[ Upstream commit d9be4f7a6f5a8da3133b832eca41c3591420b1ca ]\n\nBecause the ip fragment offset field counts 8-byte chunks, ip\nfragments other than the last must contain a multiple of 8 bytes of\npayload. ip_ufo_append_data wasn\u0027t respecting this constraint and,\ndepending on the MTU and ip option sizes, could create malformed\nnon-final fragments.\n\nGoogle-Bug-Id: 5009328\nSigned-off-by: Bill Sommerfeld \u003cwsommerfeld@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n" } ], "next": "0671b3017cad5944fb2b63b5285802eeabb2cdd5" }