)]}' { "log": [ { "commit": "b00916b189d13a615ff05c9242201135992fcda3", "tree": "cc5c416e5bc6ba69534ce880cc135364dcb91baa", "parents": [ "0aa7deadffd8b596983a3abe29a218b4c5f43301" ], "author": { "name": "Kees Cook", "email": "kees.cook@canonical.com", "time": "Mon Oct 11 12:23:25 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 11 12:23:25 2010 -0700" }, "message": "net: clear heap allocations for privileged ethtool actions\n\nSeveral other ethtool functions leave heap uncleared (potentially) by\ndrivers. Some interfaces appear safe (eeprom, etc), in that the sizes\nare well controlled. In some situations (e.g. unchecked error conditions),\nthe heap will remain unchanged in areas before copying back to userspace.\nNote that these are less of an issue since these all require CAP_NET_ADMIN.\n\nCc: stable@kernel.org\nSigned-off-by: Kees Cook \u003ckees.cook@canonical.com\u003e\nAcked-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5518b29f225dbdf47ded02cf229ff8225a2cdf82", "tree": "63ff04e7b339623e41ba0d2d27b67bd4ae81bab3", "parents": [ "f1ee89d5b007620353fb7dec1d34db4baa1a5571" ], "author": { "name": "Jiri Slaby", "email": "jslaby@suse.cz", "time": "Sun Oct 10 22:46:34 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 11 11:05:42 2010 -0700" }, "message": "ATM: mpc, fix use after free\n\nStanse found that mpc_push frees skb and then it dereferences it. It\nis a typo, new_skb should be dereferenced there.\n\nSigned-off-by: Jiri Slaby \u003cjslaby@suse.cz\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ae6df5f96a51818d6376da5307d773baeece4014", "tree": "e696e82cc5a4df37f0d2d3fa25045a79646a0cce", "parents": [ "94b105723a3bfca45c75916423cd959ce71ed215" ], "author": { "name": "Kees Cook", "email": "kees.cook@canonical.com", "time": "Thu Oct 07 10:03:48 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 08 10:48:28 2010 -0700" }, "message": "net: clear heap allocation for ETHTOOL_GRXCLSRLALL\n\nCalling ETHTOOL_GRXCLSRLALL with a large rule_cnt will allocate kernel\nheap without clearing it. For the one driver (niu) that implements it,\nit will leave the unused portion of heap unchanged and copy the full\ncontents back to userspace.\n\nSigned-off-by: Kees Cook \u003ckees.cook@canonical.com\u003e\nAcked-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "94b105723a3bfca45c75916423cd959ce71ed215", "tree": "3138e19c9511738436dc75f773acde596f5973a2", "parents": [ "b530fb69cf54cf22768a3eabc0604d70b5c13fde", "4efe7f51be508a13965f163006dcb32b38a914a3" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 08 10:36:51 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 08 10:36:51 2010 -0700" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "4efe7f51be508a13965f163006dcb32b38a914a3", "tree": "017d0a4069c3502be9101701a58e8b5b78c22c5a", "parents": [ "44271488b91c9eecf249e075a1805dd887e222d2" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Thu Oct 07 11:35:40 2010 -0400" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Thu Oct 07 11:35:40 2010 -0400" }, "message": "Revert \"mac80211: use netif_receive_skb in ieee80211_tx_status callpath\"\n\nThis reverts commit 5ed3bc7288487bd4f891f420a07319e0b538b4fe.\n\nIt turns-out that not all drivers are calling ieee80211_tx_status from a\ncompatible context. Revert this for now and try again later...\n\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "fb3dbece264a50ab4373f3af0bbbd9175d3ad4d7", "tree": "7208ecc94dcec12738635c5850980ce6d9f7349c", "parents": [ "12e94471b2be5ef9b55b10004a3a2cd819490036", "eaa71b318c5ed0cd1ac3182a533471dc5edf372d" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 07 00:59:39 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Oct 07 00:59:39 2010 -0700" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6\n" }, { "commit": "12e94471b2be5ef9b55b10004a3a2cd819490036", "tree": "f84ae818687dc7c35bd54f11bfb9717278d28a4e", "parents": [ "79315068f4560f3f7bd6e9790190dcb43059770c", "cb655d0f3d57c23db51b981648e452988c0223f9" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 06 19:11:17 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Oct 06 19:11:17 2010 -0700" }, "message": "Merge branch \u0027master\u0027 of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6\n" }, { "commit": "44271488b91c9eecf249e075a1805dd887e222d2", "tree": "7c0bb66a9ac50d2f583f4020847d6f7c69563b44", "parents": [ "918df629d6a558ab9eb53350493f618812239a4c" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 05 21:40:33 2010 +0200" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Oct 06 15:58:29 2010 -0400" }, "message": "mac80211: delete AddBA response timer\n\nWe never delete the addBA response timer, which\nis typically fine, but if the station it belongs\nto is deleted very quickly after starting the BA\nsession, before the peer had a chance to reply,\nthe timer may fire after the station struct has\nbeen freed already. Therefore, we need to delete\nthe timer in a suitable spot -- best when the\nsession is being stopped (which will happen even\nthen) in which case the delete will be a no-op\nmost of the time.\n\nI\u0027ve reproduced the scenario and tested the fix.\n\nThis fixes the crash reported at\nhttp://mid.gmane.org/4CAB6F96.6090701@candelatech.com\n\nCc: stable@kernel.org\nReported-by: Ben Greear \u003cgreearb@candelatech.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "79315068f4560f3f7bd6e9790190dcb43059770c", "tree": "da41cf961fd143ba9365fcb18a657dba904e617f", "parents": [ "27e6f065df132b5270014d3285889b15185e9da9" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Mon Oct 04 22:42:08 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Oct 05 20:35:53 2010 -0700" }, "message": "caif: fix two caif_connect() bugs\n\ncaif_connect() might dereference a netdevice after dev_put() it.\n\nIt also doesnt check dev_get_by_index() return value and could\ndereference a NULL pointer.\n\nFix it, using RCU to avoid taking a reference.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Sjur Braendeland \u003csjur.brandeland@stericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4e18b3edf71f5d4ad653e3c2ff6560878e965f96", "tree": "63487292026992afbf5226f44bec12a1264686e9", "parents": [ "51e97a12bef19b7e43199fc153cf9bd5f2140362" ], "author": { "name": "Dan Carpenter", "email": "error27@gmail.com", "time": "Mon Oct 04 02:28:36 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Oct 05 00:40:39 2010 -0700" }, "message": "cls_u32: signedness bug\n\nskb_headroom() is unsigned so \"skb_headroom(skb) + toff\" is also\nunsigned and can\u0027t be less than zero. This test was added in 66d50d25:\n\"u32: negative offset fix\" It was supposed to fix a regression.\n\nSigned-off-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "eaa71b318c5ed0cd1ac3182a533471dc5edf372d", "tree": "2e6b3cf97970543070334e90b4b2300b04f460d2", "parents": [ "e454c844644683571617896ab2a4ce0109c1943e" ], "author": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Mon Oct 04 19:28:52 2010 -0300" }, "committer": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Mon Oct 04 19:28:52 2010 -0300" }, "message": "Bluetooth: Disallow to change L2CAP_OPTIONS values when connected\n\nL2CAP doesn\u0027t permit change like MTU, FCS, TxWindow values while the\nconnection is alive, we can only set that before the\nconnection/configuration process. That can lead to bugs in the L2CAP\noperation.\n\nSigned-off-by: Gustavo F. Padovan \u003cpadovan@profusion.mobi\u003e\n" }, { "commit": "4a73a43741489a652588460e72be959e60bcb9ec", "tree": "7479147c1832131a7c8abfcd0ee8ae1a7d07116f", "parents": [ "c470af0a27bc2f84f337a50624926eac8343211e", "173e79fb70a98b5b223f8dc09c22990d777bdd78" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 04 11:11:01 2010 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 04 11:11:01 2010 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:\n vlan: dont drop packets from unknown vlans in promiscuous mode\n Phonet: Correct header retrieval after pskb_may_pull\n um: Proper Fix for f25c80a4: remove duplicate structure field initialization\n ip_gre: Fix dependencies wrt. ipv6.\n net-2.6: SYN retransmits: Add new parameter to retransmits_timed_out()\n iwl3945: queue the right work if the scan needs to be aborted\n mac80211: fix use-after-free\n" }, { "commit": "51e97a12bef19b7e43199fc153cf9bd5f2140362", "tree": "1ac12f07ab40e28d3ec29d04384a17c3e3b33826", "parents": [ "d7e0d19aa0fdd22819d35db551bd54c1bcf9c2aa" ], "author": { "name": "Dan Rosenberg", "email": "drosenberg@vsecurity.com", "time": "Fri Oct 01 11:51:47 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 03 21:58:49 2010 -0700" }, "message": "sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac()\n\nThe sctp_asoc_get_hmac() function iterates through a peer\u0027s hmac_ids\narray and attempts to ensure that only a supported hmac entry is\nreturned. The current code fails to do this properly - if the last id\nin the array is out of range (greater than SCTP_AUTH_HMAC_ID_MAX), the\nid integer remains set after exiting the loop, and the address of an\nout-of-bounds entry will be returned and subsequently used in the parent\nfunction, causing potentially ugly memory corruption. This patch resets\nthe id integer to 0 on encountering an invalid id so that NULL will be\nreturned after finishing the loop if no valid ids are found.\n\nSigned-off-by: Dan Rosenberg \u003cdrosenberg@vsecurity.com\u003e\nAcked-by: Vlad Yasevich \u003cvladislav.yasevich@hp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d7e0d19aa0fdd22819d35db551bd54c1bcf9c2aa", "tree": "3abc10f8a6e3f296fb619077af5f6f16713c62b8", "parents": [ "5b7c84066733c5dfb0e4016d939757b38de189e4" ], "author": { "name": "Dan Rosenberg", "email": "dan.j.rosenberg@gmail.com", "time": "Fri Oct 01 11:16:58 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 03 21:58:48 2010 -0700" }, "message": "sctp: prevent reading out-of-bounds memory\n\nTwo user-controlled allocations in SCTP are subsequently dereferenced as\nsockaddr structs, without checking if the dereferenced struct members fall\nbeyond the end of the allocated chunk. There doesn\u0027t appear to be any\ninformation leakage here based on how these members are used and\nadditional checking, but it\u0027s still worth fixing.\n\n[akpm@linux-foundation.org: remove unfashionable newlines, fix gmail tab-\u003espace conversion]\nSigned-off-by: Dan Rosenberg \u003cdan.j.rosenberg@gmail.com\u003e\nAcked-by: Vlad Yasevich \u003cvladislav.yasevich@hp.com\u003e\nCc: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5b7c84066733c5dfb0e4016d939757b38de189e4", "tree": "fe7edf2d6327abfc1c4abdab5121e73cce52b693", "parents": [ "10ccff62bd3de7a64cf98f4c37ec0414b8affd4f" ], "author": { "name": "David Stevens", "email": "dlstevens@us.ibm.com", "time": "Thu Sep 30 14:29:40 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 03 21:58:47 2010 -0700" }, "message": "ipv4: correct IGMP behavior on v3 query during v2-compatibility mode\n\nA recent patch to allow IGMPv2 responses to IGMPv3 queries\nbypasses length checks for valid query lengths, incorrectly\nresets the v2_seen timer, and does not support IGMPv1.\n\nThe following patch responds with a v2 report as required\nby IGMPv2 while correcting the other problems introduced\nby the patch.\n\nSigned-Off-By: David L Stevens \u003cdlstevens@us.ibm.com\u003e\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c5d3557103f8bef81d7a150ab9cc970099cd58a2", "tree": "2806f87647db3cf9e37598f4bbe8386abd7300ec", "parents": [ "482964e56e1320cb7952faa1932d8ecf59c4bf75" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Sun Oct 03 15:37:42 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 03 21:46:23 2010 -0700" }, "message": "Revert \"ipv4: Make INET_LRO a bool instead of tristate.\"\n\nThis reverts commit e81963b180ac502fda0326edf059b1e29cdef1a2.\n\nLRO is now deprecated in favour of GRO, and only a few drivers use it,\nso it is desirable to build it as a module in distribution kernels.\n\nThe original change to prevent building it as a module was made in an\nattempt to avoid the case where some dependents are set to y and some\nto m, and INET_LRO can be set to m rather than y. However, the\nKconfig system will reliably set INET_LRO\u003dy in this case.\n\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "482964e56e1320cb7952faa1932d8ecf59c4bf75", "tree": "acd265499553bb1d26d2939e891a92f6d9079cb4", "parents": [ "ae878ae280bea286ff2b1e1cb6e609dd8cb4501d" ], "author": { "name": "Nagendra Tomar", "email": "tomer_iisc@yahoo.com", "time": "Sat Oct 02 23:45:06 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 03 20:41:32 2010 -0700" }, "message": "net: Fix the condition passed to sk_wait_event()\n\nThis patch fixes the condition (3rd arg) passed to sk_wait_event() in\nsk_stream_wait_memory(). The incorrect check in sk_stream_wait_memory()\ncauses the following soft lockup in tcp_sendmsg() when the global tcp\nmemory pool has exhausted.\n\n\u003e\u003e\u003e snip \u003c\u003c\u003c\n\nlocalhost kernel: BUG: soft lockup - CPU#3 stuck for 11s! [sshd:6429]\nlocalhost kernel: CPU 3:\nlocalhost kernel: RIP: 0010:[sk_stream_wait_memory+0xcd/0x200] [sk_stream_wait_memory+0xcd/0x200] sk_stream_wait_memory+0xcd/0x200\nlocalhost kernel:\nlocalhost kernel: Call Trace:\nlocalhost kernel: [sk_stream_wait_memory+0x1b1/0x200] sk_stream_wait_memory+0x1b1/0x200\nlocalhost kernel: [\u003cffffffff802557c0\u003e] autoremove_wake_function+0x0/0x40\nlocalhost kernel: [ipv6:tcp_sendmsg+0x6e6/0xe90] tcp_sendmsg+0x6e6/0xce0\nlocalhost kernel: [sock_aio_write+0x126/0x140] sock_aio_write+0x126/0x140\nlocalhost kernel: [xfs:do_sync_write+0xf1/0x130] do_sync_write+0xf1/0x130\nlocalhost kernel: [\u003cffffffff802557c0\u003e] autoremove_wake_function+0x0/0x40\nlocalhost kernel: [hrtimer_start+0xe3/0x170] hrtimer_start+0xe3/0x170\nlocalhost kernel: [vfs_write+0x185/0x190] vfs_write+0x185/0x190\nlocalhost kernel: [sys_write+0x50/0x90] sys_write+0x50/0x90\nlocalhost kernel: [system_call+0x7e/0x83] system_call+0x7e/0x83\n\n\u003e\u003e\u003e snip \u003c\u003c\u003c\n\nWhat is happening is, that the sk_wait_event() condition passed from\nsk_stream_wait_memory() evaluates to true for the case of tcp global memory\nexhaustion. This is because both sk_stream_memory_free() and vm_wait are true\nwhich causes sk_wait_event() to *not* call schedule_timeout().\nHence sk_stream_wait_memory() returns immediately to the caller w/o sleeping.\nThis causes the caller to again try allocation, which again fails and again\ncalls sk_stream_wait_memory(), and so on.\n\n[ Bug introduced by commit c1cbe4b7ad0bc4b1d98ea708a3fecb7362aa4088\n (\"[NET]: Avoid atomic xchg() for non-error case\") -DaveM ]\n\nSigned-off-by: Nagendra Singh Tomar \u003ctomer_iisc@yahoo.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ae878ae280bea286ff2b1e1cb6e609dd8cb4501d", "tree": "06aee50c978db50558ef9b0d80790d75156b1feb", "parents": [ "173e79fb70a98b5b223f8dc09c22990d777bdd78" ], "author": { "name": "Maciej Żenczykowski", "email": "maze@google.com", "time": "Sun Oct 03 14:49:00 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Oct 03 14:49:00 2010 -0700" }, "message": "net: Fix IPv6 PMTU disc. w/ asymmetric routes\n\nSigned-off-by: Maciej Żenczykowski \u003cmaze@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "173e79fb70a98b5b223f8dc09c22990d777bdd78", "tree": "0812b62ac5ae74b605109372437aaaacb6495234", "parents": [ "92629195314d8adefabeb78b13d681ad1c01e778" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Thu Sep 30 02:16:44 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Sep 30 18:04:21 2010 -0700" }, "message": "vlan: dont drop packets from unknown vlans in promiscuous mode\n\nRoger Luethi noticed packets for unknown VLANs getting silently dropped\neven in promiscuous mode.\n\nCheck for promiscuous mode in __vlan_hwaccel_rx() and vlan_gro_common()\nbefore drops.\n\nAs suggested by Patrick, mark such packets to have skb-\u003epkt_type set to\nPACKET_OTHERHOST to make sure they are dropped by IP stack.\n\nReported-by: Roger Luethi \u003crl@hellgate.ch\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "92629195314d8adefabeb78b13d681ad1c01e778", "tree": "cc84705305a643b391965e4136d07509234ff0e5", "parents": [ "a91e7d471e2e384035b9746ea707ccdcd353f5dd", "e7ee762cf074b0fd8eec483d0cef8fdbf0d04b81" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Sep 30 12:02:22 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Sep 30 12:02:22 2010 -0700" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "b0239c80fe89d5832a68a0f3121a9d5ec9fb763e", "tree": "e4d6731033163bb1fc990bf3b0c5bbf7924b21cd", "parents": [ "fad003b6c8e3d944d4453fd569b0702ef1af82b3" ], "author": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Wed Sep 08 14:59:44 2010 -0300" }, "committer": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Thu Sep 30 12:19:35 2010 -0300" }, "message": "Revert \"Bluetooth: Don\u0027t accept ConfigReq if we aren\u0027t in the BT_CONFIG state\"\n\nThis reverts commit 8cb8e6f1684be13b51f8429b15f39c140326b327.\n\nThat commit introduced a regression with the Bluetooth Profile Tuning\nSuite(PTS), Reverting this make sure that L2CAP is in a qualificable\nstate.\n\nSigned-off-by: Gustavo F. Padovan \u003cpadovan@profusion.mobi\u003e\n" }, { "commit": "fad003b6c8e3d944d4453fd569b0702ef1af82b3", "tree": "d9fd2ec91b39283458ac64e31ae7775ae6ee87ec", "parents": [ "ccbb84af28594e19fd4bf27ff2828c80d03b6081" ], "author": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Sat Aug 14 00:48:07 2010 -0300" }, "committer": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Thu Sep 30 12:19:35 2010 -0300" }, "message": "Bluetooth: Fix inconsistent lock state with RFCOMM\n\nWhen receiving a rfcomm connection with the old dund deamon a\ninconsistent lock state happens. That\u0027s because interrupts were already\ndisabled by l2cap_conn_start() when rfcomm_sk_state_change() try to lock\nthe spin_lock.\n\nAs result we may have a inconsistent lock state for l2cap_conn_start()\nafter rfcomm_sk_state_change() calls bh_lock_sock() and disable interrupts\nas well.\n\n[ 2833.151999]\n[ 2833.151999] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 2833.151999] [ INFO: inconsistent lock state ]\n[ 2833.151999] 2.6.36-rc3 #2\n[ 2833.151999] ---------------------------------\n[ 2833.151999] inconsistent {IN-SOFTIRQ-W} -\u003e {SOFTIRQ-ON-W} usage.\n[ 2833.151999] krfcommd/2306 [HC0[0]:SC0[0]:HE1:SE1] takes:\n[ 2833.151999] (slock-AF_BLUETOOTH){+.?...}, at: [\u003cffffffffa00bcb56\u003e] rfcomm_sk_state_change+0x46/0x170 [rfcomm]\n[ 2833.151999] {IN-SOFTIRQ-W} state was registered at:\n[ 2833.151999] [\u003cffffffff81094346\u003e] __lock_acquire+0x5b6/0x1560\n[ 2833.151999] [\u003cffffffff8109534a\u003e] lock_acquire+0x5a/0x70\n[ 2833.151999] [\u003cffffffff81392b6c\u003e] _raw_spin_lock+0x2c/0x40\n[ 2833.151999] [\u003cffffffffa00a5092\u003e] l2cap_conn_start+0x92/0x640 [l2cap]\n[ 2833.151999] [\u003cffffffffa00a6a3f\u003e] l2cap_sig_channel+0x6bf/0x1320 [l2cap]\n[ 2833.151999] [\u003cffffffffa00a9173\u003e] l2cap_recv_frame+0x133/0x770 [l2cap]\n[ 2833.151999] [\u003cffffffffa00a997b\u003e] l2cap_recv_acldata+0x1cb/0x390 [l2cap]\n[ 2833.151999] [\u003cffffffffa000db4b\u003e] hci_rx_task+0x2ab/0x450 [bluetooth]\n[ 2833.151999] [\u003cffffffff8106b22b\u003e] tasklet_action+0xcb/0xe0\n[ 2833.151999] [\u003cffffffff8106b91e\u003e] __do_softirq+0xae/0x150\n[ 2833.151999] [\u003cffffffff8102bc0c\u003e] call_softirq+0x1c/0x30\n[ 2833.151999] [\u003cffffffff8102ddb5\u003e] do_softirq+0x75/0xb0\n[ 2833.151999] [\u003cffffffff8106b56d\u003e] irq_exit+0x8d/0xa0\n[ 2833.151999] [\u003cffffffff8104484b\u003e] smp_apic_timer_interrupt+0x6b/0xa0\n[ 2833.151999] [\u003cffffffff8102b6d3\u003e] apic_timer_interrupt+0x13/0x20\n[ 2833.151999] [\u003cffffffff81029dfa\u003e] cpu_idle+0x5a/0xb0\n[ 2833.151999] [\u003cffffffff81381ded\u003e] rest_init+0xad/0xc0\n[ 2833.151999] [\u003cffffffff817ebc4d\u003e] start_kernel+0x2dd/0x2e8\n[ 2833.151999] [\u003cffffffff817eb2e6\u003e] x86_64_start_reservations+0xf6/0xfa\n[ 2833.151999] [\u003cffffffff817eb3ce\u003e] x86_64_start_kernel+0xe4/0xeb\n[ 2833.151999] irq event stamp: 731\n[ 2833.151999] hardirqs last enabled at (731): [\u003cffffffff8106b762\u003e] local_bh_enable_ip+0x82/0xe0\n[ 2833.151999] hardirqs last disabled at (729): [\u003cffffffff8106b93e\u003e] __do_softirq+0xce/0x150\n[ 2833.151999] softirqs last enabled at (730): [\u003cffffffff8106b96e\u003e] __do_softirq+0xfe/0x150\n[ 2833.151999] softirqs last disabled at (711): [\u003cffffffff8102bc0c\u003e] call_softirq+0x1c/0x30\n[ 2833.151999]\n[ 2833.151999] other info that might help us debug this:\n[ 2833.151999] 2 locks held by krfcommd/2306:\n[ 2833.151999] #0: (rfcomm_mutex){+.+.+.}, at: [\u003cffffffffa00bb744\u003e] rfcomm_run+0x174/0xb20 [rfcomm]\n[ 2833.151999] #1: (\u0026(\u0026d-\u003elock)-\u003erlock){+.+...}, at: [\u003cffffffffa00b9223\u003e] rfcomm_dlc_accept+0x53/0x100 [rfcomm]\n[ 2833.151999]\n[ 2833.151999] stack backtrace:\n[ 2833.151999] Pid: 2306, comm: krfcommd Tainted: G W 2.6.36-rc3 #2\n[ 2833.151999] Call Trace:\n[ 2833.151999] [\u003cffffffff810928e1\u003e] print_usage_bug+0x171/0x180\n[ 2833.151999] [\u003cffffffff810936c3\u003e] mark_lock+0x333/0x400\n[ 2833.151999] [\u003cffffffff810943ca\u003e] __lock_acquire+0x63a/0x1560\n[ 2833.151999] [\u003cffffffff810948b5\u003e] ? __lock_acquire+0xb25/0x1560\n[ 2833.151999] [\u003cffffffff8109534a\u003e] lock_acquire+0x5a/0x70\n[ 2833.151999] [\u003cffffffffa00bcb56\u003e] ? rfcomm_sk_state_change+0x46/0x170 [rfcomm]\n[ 2833.151999] [\u003cffffffff81392b6c\u003e] _raw_spin_lock+0x2c/0x40\n[ 2833.151999] [\u003cffffffffa00bcb56\u003e] ? rfcomm_sk_state_change+0x46/0x170 [rfcomm]\n[ 2833.151999] [\u003cffffffffa00bcb56\u003e] rfcomm_sk_state_change+0x46/0x170 [rfcomm]\n[ 2833.151999] [\u003cffffffffa00b9239\u003e] rfcomm_dlc_accept+0x69/0x100 [rfcomm]\n[ 2833.151999] [\u003cffffffffa00b9a49\u003e] rfcomm_check_accept+0x59/0xd0 [rfcomm]\n[ 2833.151999] [\u003cffffffffa00bacab\u003e] rfcomm_recv_frame+0x9fb/0x1320 [rfcomm]\n[ 2833.151999] [\u003cffffffff813932bb\u003e] ? _raw_spin_unlock_irqrestore+0x3b/0x60\n[ 2833.151999] [\u003cffffffff81093acd\u003e] ? trace_hardirqs_on_caller+0x13d/0x180\n[ 2833.151999] [\u003cffffffff81093b1d\u003e] ? trace_hardirqs_on+0xd/0x10\n[ 2833.151999] [\u003cffffffffa00bb7f1\u003e] rfcomm_run+0x221/0xb20 [rfcomm]\n[ 2833.151999] [\u003cffffffff813905e7\u003e] ? schedule+0x287/0x780\n[ 2833.151999] [\u003cffffffffa00bb5d0\u003e] ? rfcomm_run+0x0/0xb20 [rfcomm]\n[ 2833.151999] [\u003cffffffff81081026\u003e] kthread+0x96/0xa0\n[ 2833.151999] [\u003cffffffff8102bb14\u003e] kernel_thread_helper+0x4/0x10\n[ 2833.151999] [\u003cffffffff813936bc\u003e] ? restore_args+0x0/0x30\n[ 2833.151999] [\u003cffffffff81080f90\u003e] ? kthread+0x0/0xa0\n[ 2833.151999] [\u003cffffffff8102bb10\u003e] ? kernel_thread_helper+0x0/0x10\n\nSigned-off-by: Gustavo F. Padovan \u003cpadovan@profusion.mobi\u003e\n" }, { "commit": "ccbb84af28594e19fd4bf27ff2828c80d03b6081", "tree": "cfb8b361b73c1bd299f17192e964c3184850e08b", "parents": [ "8183b775bc5b79b6b1e250019c9dd930554dfa94" ], "author": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Mon Aug 30 18:44:44 2010 -0300" }, "committer": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Thu Sep 30 12:19:35 2010 -0300" }, "message": "Bluetooth: Simplify L2CAP Streaming mode sending\n\nAs we don\u0027t have any error control on the Streaming mode, i.e., we don\u0027t\nneed to keep a copy of the skb for later resending we don\u0027t need to\ncall skb_clone() on it.\nThen we can go one further here, and dequeue the skb before sending it,\nthat also means we don\u0027t need to look to sk-\u003esk_send_head anymore.\n\nThe patch saves memory and time when sending Streaming mode data, so\nit is good to mainline.\n\nSigned-off-by: Gustavo F. Padovan \u003cpadovan@profusion.mobi\u003e\n" }, { "commit": "8183b775bc5b79b6b1e250019c9dd930554dfa94", "tree": "cdd7ec2b4a8d0507a4ea51e1db393f6275e0cec0", "parents": [ "8c462b6047da80491b8cb6be878e8bf9313ac3e1" ], "author": { "name": "Andrei Emeltchenko", "email": "andrei.emeltchenko@nokia.com", "time": "Wed Sep 01 15:17:25 2010 +0300" }, "committer": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Thu Sep 30 12:19:35 2010 -0300" }, "message": "Bluetooth: fix MTU L2CAP configuration parameter\n\nWhen receiving L2CAP negative configuration response with respect\nto MTU parameter we modify wrong field. MTU here means proposed\nvalue of MTU that the remote device intends to transmit. So for local\nL2CAP socket it is pi-\u003eimtu.\n\nSigned-off-by: Andrei Emeltchenko \u003candrei.emeltchenko@nokia.com\u003e\nAcked-by: Ville Tervo \u003cville.tervo@nokia.com\u003e\nSigned-off-by: Gustavo F. Padovan \u003cpadovan@profusion.mobi\u003e\n" }, { "commit": "8c462b6047da80491b8cb6be878e8bf9313ac3e1", "tree": "c7cac6b995af6126abf5ee18ba6121a4ee78436e", "parents": [ "899611ee7d373e5eeda08e9a8632684e1ebbbf00" ], "author": { "name": "Mat Martineau", "email": "mathewm@codeaurora.org", "time": "Tue Aug 24 15:35:42 2010 -0700" }, "committer": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Thu Sep 30 12:19:35 2010 -0300" }, "message": "Bluetooth: Only enable L2CAP FCS for ERTM or streaming\n\nThis fixes a bug which caused the FCS setting to show L2CAP_FCS_CRC16\nwith L2CAP modes other than ERTM or streaming. At present, this only\naffects the FCS value shown with getsockopt() for basic mode.\n\nSigned-off-by: Mat Martineau \u003cmathewm@codeaurora.org\u003e\nSigned-off-by: Gustavo F. Padovan \u003cpadovan@profusion.mobi\u003e\n" }, { "commit": "a91e7d471e2e384035b9746ea707ccdcd353f5dd", "tree": "bcace390a9075fba545157872116249c40be0b5c", "parents": [ "9337057d4335053dc14934a60d9c3e8fe4e32039" ], "author": { "name": "Kumar Sanghvi", "email": "kumar.sanghvi@stericsson.com", "time": "Mon Sep 27 23:10:42 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 29 19:41:04 2010 -0700" }, "message": "Phonet: Correct header retrieval after pskb_may_pull\n\nRetrieve the header after doing pskb_may_pull since, pskb_may_pull\ncould change the buffer structure.\n\nThis is based on the comment given by Eric Dumazet on Phonet\nPipe controller patch for a similar problem.\n\nSigned-off-by: Kumar Sanghvi \u003ckumar.sanghvi@stericsson.com\u003e\nAcked-by: Linus Walleij \u003clinus.walleij@stericsson.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nAcked-by: Rémi Denis-Courmont \u003cremi.denis-courmont@nokia.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "68c1f3a96c32a4fe15ebadae45c8145a5e5a66d2", "tree": "eaad407fb9f2c6381f3457585d394d587eeeb301", "parents": [ "4d22f7d372f5769c6c0149e427ed6353e2dcfe61" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 28 22:37:56 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 28 22:37:56 2010 -0700" }, "message": "ip_gre: Fix dependencies wrt. ipv6.\n\nThe GRE tunnel driver needs to invoke icmpv6 helpers in the\nipv6 stack when ipv6 support is enabled.\n\nTherefore if IPV6 is enabled, we have to enforce that GRE\u0027s\nenabling (modular or static) matches that of ipv6.\n\nReported-by: Patrick McHardy \u003ckaber@trash.net\u003e\nReported-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4d22f7d372f5769c6c0149e427ed6353e2dcfe61", "tree": "7f4ff499d171f4d9b78975300aedd6c9d527073f", "parents": [ "01db403cf99f739f86903314a489fb420e0e254f" ], "author": { "name": "Damian Lukowski", "email": "damian@tvk.rwth-aachen.de", "time": "Tue Sep 28 13:08:32 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 28 13:08:32 2010 -0700" }, "message": "net-2.6: SYN retransmits: Add new parameter to retransmits_timed_out()\n\nFixes kernel Bugzilla Bug 18952\n\nThis patch adds a syn_set parameter to the retransmits_timed_out()\nroutine and updates its callers. If not set, TCP_RTO_MIN is taken\nas the calculation basis as before. If set, TCP_TIMEOUT_INIT is\nused instead, so that sysctl_syn_retries represents the actual\namount of SYN retransmissions in case no SYNACKs are received when\nestablishing a new connection.\n\nSigned-off-by: Damian Lukowski \u003cdamian@tvk.rwth-aachen.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a2724f28d9f99b7b42e800b528902f0e3321873b", "tree": "b4431876af950c16ea6af3a8f2864a4ae494bc62", "parents": [ "050026feae5bd4fe2db4096b63b15abce7c47faa", "01db403cf99f739f86903314a489fb420e0e254f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 28 12:01:26 2010 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 28 12:01:26 2010 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (47 commits)\n tcp: Fix \u003e4GB writes on 64-bit.\n net/9p: Mount only matching virtio channels\n de2104x: fix ethtool\n tproxy: check for transparent flag in ip_route_newports\n ipv6: add IPv6 to neighbour table overflow warning\n tcp: fix TSO FACK loss marking in tcp_mark_head_lost\n 3c59x: fix regression from patch \"Add ethtool WOL support\"\n ipv6: add a missing unregister_pernet_subsys call\n s390: use free_netdev(netdev) instead of kfree()\n sgiseeq: use free_netdev(netdev) instead of kfree()\n rionet: use free_netdev(netdev) instead of kfree()\n ibm_newemac: use free_netdev(netdev) instead of kfree()\n smsc911x: Add MODULE_ALIAS()\n net: reset skb queue mapping when rx\u0027ing over tunnel\n br2684: fix scheduling while atomic\n de2104x: fix TP link detection\n de2104x: fix power management\n de2104x: disable autonegotiation on broken hardware\n net: fix a lockdep splat\n e1000e: 82579 do not gate auto config of PHY by hardware during nominal use\n ...\n" }, { "commit": "01db403cf99f739f86903314a489fb420e0e254f", "tree": "bf04fbfb3ed88d6cf7abeea1ab5209be36907882", "parents": [ "0b20406cda621c2495d10baab1e87127ceb43337" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 27 20:24:54 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 27 20:24:54 2010 -0700" }, "message": "tcp: Fix \u003e4GB writes on 64-bit.\n\nFixes kernel bugzilla #16603\n\ntcp_sendmsg() truncates iov_len to an \u0027int\u0027 which a 4GB write to write\nzero bytes, for example.\n\nThere is also the problem higher up of how verify_iovec() works. It\nwants to prevent the total length from looking like an error return\nvalue.\n\nHowever it does this using \u0027int\u0027, but syscalls return \u0027long\u0027 (and\nthus signed 64-bit on 64-bit machines). So it could trigger\nfalse-positives on 64-bit as written. So fix it to use \u0027long\u0027.\n\nReported-by: Olaf Bonorden \u003cbono@onlinehome.de\u003e\nReported-by: Daniel Büse \u003cdbuese@gmx.de\u003e\nReported-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0b20406cda621c2495d10baab1e87127ceb43337", "tree": "10befc92130dbe19406b781b16bf312c77c03f89", "parents": [ "387a85628782690b56492dae4bbf544639f5d4a9" ], "author": { "name": "Sven Eckelmann", "email": "sven.eckelmann@gmx.de", "time": "Mon Sep 27 15:54:44 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 27 15:54:44 2010 -0700" }, "message": "net/9p: Mount only matching virtio channels\n\np9_virtio_create will only compare the the channel\u0027s tag characters\nagainst the device name till the end of the channel\u0027s tag but not till\nthe end of the device name. This means that if a user defines channels\nwith the tags foo and foobar then he would mount foo when he requested\nfoonot and may mount foo when he requested foobar.\n\nThus it is necessary to check both string lengths against each other in\ncase of a successful partial string match.\n\nSigned-off-by: Sven Eckelmann \u003csven.eckelmann@gmx.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7e1b33e5ea392dfc984fc63b76ca75acbf249dcd", "tree": "00fbab440aabca3123b999da42901a7261203c11", "parents": [ "b3de7559afbb7a8a35b4be975a6adf6c5e3cdca0" ], "author": { "name": "Ulrich Weber", "email": "uweber@astaro.com", "time": "Mon Sep 27 15:02:18 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 27 15:02:18 2010 -0700" }, "message": "ipv6: add IPv6 to neighbour table overflow warning\n\nIPv4 and IPv6 have separate neighbour tables, so\nthe warning messages should be distinguishable.\n\n[ Add a suitable message prefix on the ipv4 side as well -DaveM ]\n\nSigned-off-by: Ulrich Weber \u003cuweber@astaro.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b3de7559afbb7a8a35b4be975a6adf6c5e3cdca0", "tree": "b387ee28cbb0c577943e87ddc7d87c3d7c65b99c", "parents": [ "3fd6c88ef875a14740801ebfc6b6e4e064a1cdd4" ], "author": { "name": "Yuchung Cheng", "email": "ycheng@google.com", "time": "Fri Sep 24 13:22:06 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 27 14:55:57 2010 -0700" }, "message": "tcp: fix TSO FACK loss marking in tcp_mark_head_lost\n\nWhen TCP uses FACK algorithm to mark lost packets in\ntcp_mark_head_lost(), if the number of packets in the (TSO) skb is\ngreater than the number of packets that should be marked lost, TCP\nincorrectly exits the loop and marks no packets lost in the skb. This\nunderestimates tp-\u003elost_out and affects the recovery/retransmission.\nThis patch fargments the skb and marks the correct amount of packets\nlost.\n\nSigned-off-by: Yuchung Cheng \u003cycheng@google.com\u003e\nAcked-by: Ilpo Järvinen \u003cilpo.jarvinen@helsinki.fi\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1d6400c7c9cfd38976b25d55b357200ad3ff1be9", "tree": "e7da3e64ec02493282e76a55f2f0025e358049b3", "parents": [ "32163f4b2cef28a5aab8b226ffecfc6379a53786" ], "author": { "name": "Davidlohr Bueso", "email": "dave@gnu.org", "time": "Mon Sep 13 15:53:18 2010 +0000" }, "committer": { "name": "Eric Van Hensbergen", "email": "ericvh@gmail.com", "time": "Mon Sep 27 07:52:50 2010 -0500" }, "message": "net/9p: fix memory handling/allocation in rdma_request()\n\nReturn -ENOMEM when erroring on kmalloc and fix memory leaks when returning on error.\n\nSigned-off-by: Davidlohr Bueso \u003cdave@gnu.org\u003e\nReviewed-by: Aneesh Kumar K.V \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nSigned-off-by: Eric Van Hensbergen \u003cericvh@gmail.com\u003e\n" }, { "commit": "2cc6d2bf3d6195fabcf0febc192c01f99519a8f3", "tree": "6fbbaa255617783eda308a00a21065bc99ad0d21", "parents": [ "bc68580d41b131396054a1a04a7df4948555ed97" ], "author": { "name": "Neil Horman", "email": "nhorman@tuxdriver.com", "time": "Fri Sep 24 09:55:52 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Sep 26 19:09:25 2010 -0700" }, "message": "ipv6: add a missing unregister_pernet_subsys call\n\nClean up a missing exit path in the ipv6 module init routines. In\naddrconf_init we call ipv6_addr_label_init which calls register_pernet_subsys\nfor the ipv6_addr_label_ops structure. But if module loading fails, or if the\nipv6 module is removed, there is no corresponding unregister_pernet_subsys call,\nwhich leaves a now-bogus address on the pernet_list, leading to oopses in\nsubsequent registrations. This patch cleans up both the failed load path and\nthe unload path. Tested by myself with good results.\n\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\n\n include/net/addrconf.h | 1 +\n net/ipv6/addrconf.c | 11 ++++++++---\n net/ipv6/addrlabel.c | 5 +++++\n 3 files changed, 14 insertions(+), 3 deletions(-)\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a3d6713fbd2ccb50898a6f88664da96a7857c039", "tree": "e772805828ad8c862c10b1845878baffbb11248e", "parents": [ "ca9a783575d2affed30ef27a3427a7705527ddac" ], "author": { "name": "Karl Hiramoto", "email": "karl@hiramoto.org", "time": "Thu Sep 23 01:50:54 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Sep 26 18:29:18 2010 -0700" }, "message": "br2684: fix scheduling while atomic\n\nYou can\u0027t call atomic_notifier_chain_unregister() while in atomic context.\n\nFix, call un/register_atmdevice_notifier in module __init and __exit.\n\nBug report:\nhttp://comments.gmane.org/gmane.linux.network/172603\n\nReported-by: Mikko Vinni \u003cmmvinni@yahoo.com\u003e\nTested-by: Mikko Vinni \u003cmmvinni@yahoo.com\u003e\nSigned-off-by: Karl Hiramoto \u003ckarl@hiramoto.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f064af1e500a2bf4607706f0f458163bdb2a6ea5", "tree": "ebbbd1c3c00030c70cab6fe587a5c03252a46ebc", "parents": [ "605c82bab5abe0816e5e32716875c245f89f39da" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed Sep 22 12:43:39 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Sep 24 22:26:10 2010 -0700" }, "message": "net: fix a lockdep splat\n\nWe have for each socket :\n\nOne spinlock (sk_slock.slock)\nOne rwlock (sk_callback_lock)\n\nPossible scenarios are :\n\n(A) (this is used in net/sunrpc/xprtsock.c)\nread_lock(\u0026sk-\u003esk_callback_lock) (without blocking BH)\n\u003cBH\u003e\nspin_lock(\u0026sk-\u003esk_slock.slock);\n...\nread_lock(\u0026sk-\u003esk_callback_lock);\n...\n\n(B)\nwrite_lock_bh(\u0026sk-\u003esk_callback_lock)\nstuff\nwrite_unlock_bh(\u0026sk-\u003esk_callback_lock)\n\n(C)\nspin_lock_bh(\u0026sk-\u003esk_slock)\n...\nwrite_lock_bh(\u0026sk-\u003esk_callback_lock)\nstuff\nwrite_unlock_bh(\u0026sk-\u003esk_callback_lock)\nspin_unlock_bh(\u0026sk-\u003esk_slock)\n\nThis (C) case conflicts with (A) :\n\nCPU1 [A] CPU2 [C]\nread_lock(callback_lock)\n\u003cBH\u003e spin_lock_bh(slock)\n\u003cwait to spin_lock(slock)\u003e\n \u003cwait to write_lock_bh(callback_lock)\u003e\n\nWe have one problematic (C) use case in inet_csk_listen_stop() :\n\nlocal_bh_disable();\nbh_lock_sock(child); // spin_lock_bh(\u0026sk-\u003esk_slock)\nWARN_ON(sock_owned_by_user(child));\n...\nsock_orphan(child); // write_lock_bh(\u0026sk-\u003esk_callback_lock)\n\nlockdep is not happy with this, as reported by Tetsuo Handa\n\nIt seems only way to deal with this is to use read_lock_bh(callbacklock)\neverywhere.\n\nThanks to Jarek for pointing a bug in my first attempt and suggesting\nthis solution.\n\nReported-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nTested-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Jarek Poplawski \u003cjarkao2@gmail.com\u003e\nTested-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963", "tree": "45709536e1c4f36c345b16f90849c7833d23337b", "parents": [ "df6d02300f7c2fbd0fbe626d819c8e5237d72c62" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Fri Sep 24 11:20:47 2010 +0200" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Fri Sep 24 15:21:55 2010 -0400" }, "message": "mac80211: fix use-after-free\n\ncommit 8c0c709eea5cbab97fb464cd68b06f24acc58ee1\nAuthor: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nDate: Wed Nov 25 17:46:15 2009 +0100\n\n mac80211: move cmntr flag out of rx flags\n\nmoved the CMTR flag into the skb\u0027s status, and\nin doing so introduced a use-after-free -- when\nthe skb has been handed to cooked monitors the\nstatus setting will touch now invalid memory.\n\nAdditionally, moving it there has effectively\ndiscarded the optimisation -- since the bit is\nonly ever set on freed SKBs, and those were a\ncopy, it could never be checked.\n\nFor the current release, fixing this properly\nis a bit too involved, so let\u0027s just remove the\nproblematic code and leave userspace with one\ncopy of each frame for each virtual interface.\n\nCc: stable@kernel.org [2.6.33+]\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "94e2238969e89f5112297ad2a00103089dde7e8f", "tree": "95a65a101132a512b70918cdecfd74d209a47862", "parents": [ "3f5a2a713aad28480d86b0add00c68484b54febc" ], "author": { "name": "Ulrich Weber", "email": "uweber@astaro.com", "time": "Wed Sep 22 06:45:11 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 22 20:25:48 2010 -0700" }, "message": "xfrm4: strip ECN bits from tos field\n\notherwise ECT(1) bit will get interpreted as RTO_ONLINK\nand routing will fail with XfrmOutBundleGenError.\n\nSigned-off-by: Ulrich Weber \u003cuweber@astaro.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cbdd769ab9de26764bde0520a91536caa1587e13", "tree": "7a15d114613de0e8e374151628102a76562ebbbd", "parents": [ "d6120b8afacec587f5feb37781bc751bc5d68a10" ], "author": { "name": "Jiri Olsa", "email": "jolsa@redhat.com", "time": "Tue Sep 21 21:17:34 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 22 13:13:34 2010 -0700" }, "message": "netfilter: nf_conntrack_defrag: check socket type before touching nodefrag flag\n\nwe need to check proper socket type within ipv4_conntrack_defrag\nfunction before referencing the nodefrag flag.\n\nFor example the tun driver receive path produces skbs with\nAF_UNSPEC socket type, and so current code is causing unwanted\nfragmented packets going out.\n\nSigned-off-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d6120b8afacec587f5feb37781bc751bc5d68a10", "tree": "c4477c43bfb8cb87f65d3119fa59d8335deeb825", "parents": [ "15cdeadaa5d76009e20c7792aed69f5a73808f97" ], "author": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Tue Sep 21 21:17:33 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 22 13:13:33 2010 -0700" }, "message": "netfilter: nf_nat_snmp: fix checksum calculation (v4)\n\nFix checksum calculation in nf_nat_snmp_basic.\n\nBased on patches by Clark Wang \u003cwtweeker@163.com\u003e and\nStephen Hemminger \u003cshemminger@vyatta.com\u003e.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d17622\n\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "15cdeadaa5d76009e20c7792aed69f5a73808f97", "tree": "11eb05f550c046b3099d52df146948dce0c12635", "parents": [ "b46ffb854554ff939701bdd492b81558da5706fc" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Tue Sep 21 21:17:32 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 22 13:13:33 2010 -0700" }, "message": "netfilter: fix a race in nf_ct_ext_create()\n\nAs soon as rcu_read_unlock() is called, there is no guarantee current\nthread can safely derefence t pointer, rcu protected.\n\nFix is to copy t-\u003ealloc_size in a temporary variable.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nReviewed-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b46ffb854554ff939701bdd492b81558da5706fc", "tree": "e81a9a159751267b62f6218a0c1334622bd04dd0", "parents": [ "7874896a26624214bd7c05eeba7c8ab01548b1b5" ], "author": { "name": "Changli Gao", "email": "xiaosuo@gmail.com", "time": "Tue Sep 21 21:17:31 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 22 13:13:32 2010 -0700" }, "message": "netfilter: fix ipt_REJECT TCP RST routing for indev \u003d\u003d outdev\n\nip_route_me_harder can\u0027t create the route cache when the outdev is the same\nwith the indev for the skbs whichout a valid protocol set.\n\n__mkroute_input functions has this check:\n1998 if (skb-\u003eprotocol !\u003d htons(ETH_P_IP)) {\n1999 /* Not IP (i.e. ARP). Do not create route, if it is\n2000 * invalid for proxy arp. DNAT routes are always valid.\n2001 *\n2002 * Proxy arp feature have been extended to allow, ARP\n2003 * replies back to the same interface, to support\n2004 * Private VLAN switch technologies. See arp.c.\n2005 */\n2006 if (out_dev \u003d\u003d in_dev \u0026\u0026\n2007 IN_DEV_PROXY_ARP_PVLAN(in_dev) \u003d\u003d 0) {\n2008 err \u003d -EINVAL;\n2009 goto cleanup;\n2010 }\n2011 }\n\nThis patch gives the new skb a valid protocol to bypass this check. In order\nto make ipt_REJECT work with bridges, you also need to enable ip_forward.\n\nThis patch also fixes a regression. When we used skb_copy_expand(), we\ndidn\u0027t have this issue stated above, as the protocol was properly set.\n\nSigned-off-by: Changli Gao \u003cxiaosuo@gmail.com\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7874896a26624214bd7c05eeba7c8ab01548b1b5", "tree": "15e62e0eb2c2a1ac911ae6a6ccb5806d0aa0c2a9", "parents": [ "d485d500cf6b13a33bc7a6c09091deea7ea603ca" ], "author": { "name": "Simon Horman", "email": "horms@verge.net.au", "time": "Tue Sep 21 21:17:30 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 22 13:13:32 2010 -0700" }, "message": "netfilter: nf_ct_sip: default to NF_ACCEPT in sip_help_tcp()\n\nI initially noticed this because of the compiler warning below, but it\ndoes seem to be a valid concern in the case where ct_sip_get_header()\nreturns 0 in the first iteration of the while loop.\n\nnet/netfilter/nf_conntrack_sip.c: In function \u0027sip_help_tcp\u0027:\nnet/netfilter/nf_conntrack_sip.c:1379: warning: \u0027ret\u0027 may be used uninitialized in this function\n\nSigned-off-by: Simon Horman \u003chorms@verge.net.au\u003e\n[Patrick: changed NF_DROP to NF_ACCEPT]\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d485d500cf6b13a33bc7a6c09091deea7ea603ca", "tree": "67d132d3b75e8ae5c3f39e0701a20843e50b8ab2", "parents": [ "3d13008e7345fa7a79d8f6438150dc15d6ba6e9d" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Tue Sep 21 21:17:29 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 22 13:13:31 2010 -0700" }, "message": "netfilter: tproxy: nf_tproxy_assign_sock() can handle tw sockets\n\ntransparent field of a socket is either inet_twsk(sk)-\u003etw_transparent\nfor timewait sockets, or inet_sk(sk)-\u003etransparent for other sockets\n(TCP/UDP).\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nAcked-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3d13008e7345fa7a79d8f6438150dc15d6ba6e9d", "tree": "a36caa5636e4030419ca8907642e75c0cd565143", "parents": [ "7e96dc7045bff8758804b047c0dfb6868f182500" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Tue Sep 21 08:47:45 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 21 15:05:50 2010 -0700" }, "message": "ip: fix truesize mismatch in ip fragmentation\n\nSpecial care should be taken when slow path is hit in ip_fragment() :\n\nWhen walking through frags, we transfert truesize ownership from skb to\nfrags. Then if we hit a slow_path condition, we must undo this or risk\nuncharging frags-\u003etruesize twice, and in the end, having negative socket\nsk_wmem_alloc counter, or even freeing socket sooner than expected.\n\nMany thanks to Nick Bowler, who provided a very clean bug report and\ntest program.\n\nThanks to Jarek for reviewing my first patch and providing a V2\n\nWhile Nick bisection pointed to commit 2b85a34e911 (net: No more\nexpensive sock_hold()/sock_put() on each tx), underlying bug is older\n(2.6.12-rc5)\n\nA side effect is to extend work done in commit b2722b1c3a893e\n(ip_fragment: also adjust skb-\u003etruesize for packets not owned by a\nsocket) to ipv6 as well.\n\nReported-and-bisected-by: Nick Bowler \u003cnbowler@elliptictech.com\u003e\nTested-by: Nick Bowler \u003cnbowler@elliptictech.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Jarek Poplawski \u003cjarkao2@gmail.com\u003e\nCC: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2d813760d75150db437e40d340ae0e06ddd54a34", "tree": "b52e8df51dec523f833d5145589b86ac1703b96e", "parents": [ "a4d258036ed9b2a1811c3670c6099203a0f284a0", "df6d02300f7c2fbd0fbe626d819c8e5237d72c62" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 21 12:26:07 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 21 12:26:07 2010 -0700" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "a4d258036ed9b2a1811c3670c6099203a0f284a0", "tree": "58412022664aef745a99d254d20cf1a66aabda44", "parents": [ "9828e6e6e3f19efcb476c567b9999891d051f52f" ], "author": { "name": "Tom Marshall", "email": "tdm.code@gmail.com", "time": "Mon Sep 20 15:42:05 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 20 15:42:05 2010 -0700" }, "message": "tcp: Fix race in tcp_poll\n\nIf a RST comes in immediately after checking sk-\u003esk_err, tcp_poll will\nreturn POLLIN but not POLLOUT. Fix this by checking sk-\u003esk_err at the end\nof tcp_poll. Additionally, ensure the correct order of operations on SMP\nmachines with memory barriers.\n\nSigned-off-by: Tom Marshall \u003ctdm.code@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9828e6e6e3f19efcb476c567b9999891d051f52f", "tree": "c453c5981e2a9b3ea14d6c84ac73456da41c8718", "parents": [ "3779298b81cd9a2531cec93e3beefc1acdb01382" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 20 15:40:35 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 20 15:40:35 2010 -0700" }, "message": "rose: Fix signedness issues wrt. digi count.\n\nJust use explicit casts, since we really can\u0027t change the\ntypes of structures exported to userspace which have been\naround for 15 years or so.\n\nReported-by: Dan Rosenberg \u003cdan.j.rosenberg@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8444cf712c5f71845cba9dc30d8f530ff0d5ff83", "tree": "3283983551829eb3f985a92d49ec65ac8e487268", "parents": [ "842c74bffcdb1d305ccd9e61e417cceae86b9963" ], "author": { "name": "Thomas Egerer", "email": "thomas.egerer@secunet.com", "time": "Mon Sep 20 11:11:38 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 20 11:11:38 2010 -0700" }, "message": "xfrm: Allow different selector family in temporary state\n\nThe family parameter xfrm_state_find is used to find a state matching a\ncertain policy. This value is set to the template\u0027s family\n(encap_family) right before xfrm_state_find is called.\nThe family parameter is however also used to construct a temporary state\nin xfrm_state_find itself which is wrong for inter-family scenarios\nbecause it produces a selector for the wrong family. Since this selector\nis included in the xfrm_user_acquire structure, user space programs\nmisinterpret IPv6 addresses as IPv4 and vice versa.\nThis patch splits up the original init_tempsel function into a part that\ninitializes the selector respectively the props and id of the temporary\nstate, to allow for differing ip address families whithin the state.\n\nSigned-off-by: Thomas Egerer \u003cthomas.egerer@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "df6d02300f7c2fbd0fbe626d819c8e5237d72c62", "tree": "7f0eadba6ca9d0cc19b26dc82ec61bc8df4c9fe2", "parents": [ "7acc7c683a747689aaaaad4fce1683fc3f85e552" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Fri Sep 17 00:38:25 2010 +0200" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Sep 20 13:41:40 2010 -0400" }, "message": "wext: fix potential private ioctl memory content leak\n\nWhen a driver doesn\u0027t fill the entire buffer, old\nheap contents may remain, and if it also doesn\u0027t\nupdate the length properly, this old heap content\nwill be copied back to userspace.\n\nIt is very unlikely that this happens in any of\nthe drivers using private ioctls since it would\nshow up as junk being reported by iwpriv, but it\nseems better to be safe here, so use kzalloc.\n\nReported-by: Jeff Mahoney \u003cjeffm@suse.com\u003e\nCc: stable@kernel.org\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "842c74bffcdb1d305ccd9e61e417cceae86b9963", "tree": "e1f53ccfcfae9c3e37de17e1878907c1b7a21051", "parents": [ "04746ff1289f75af26af279eb4b0b3e231677ee4" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Mon Sep 20 10:06:12 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 20 10:06:12 2010 -0700" }, "message": "ip_gre: CONFIG_IPV6_MODULE support\n\nipv6 can be a module, we should test CONFIG_IPV6 and CONFIG_IPV6_MODULE\nto enable ipv6 bits in ip_gre.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7d7dee96e1a7369eae67e5fe5c987785a1c11e40", "tree": "7c87df02117c7c3ac2ab4b7bd594a2183ec22ff6", "parents": [ "f1c9c9797a7c519a70b8e4607f41d97ec59fc8f0", "4e8cec269dd9e823804141f25ce37c23e72d3c12" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 19 11:05:50 2010 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 19 11:05:50 2010 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (21 commits)\n dca: disable dca on IOAT ver.3.0 multiple-IOH platforms\n netpoll: Disable IRQ around RCU dereference in netpoll_rx\n sctp: Do not reset the packet during sctp_packet_config().\n net/llc: storing negative error codes in unsigned short\n MAINTAINERS: move atlx discussions to netdev\n drivers/net/cxgb3/cxgb3_main.c: prevent reading uninitialized stack memory\n drivers/net/eql.c: prevent reading uninitialized stack memory\n drivers/net/usb/hso.c: prevent reading uninitialized memory\n xfrm: dont assume rcu_read_lock in xfrm_output_one()\n r8169: Handle rxfifo errors on 8168 chips\n 3c59x: Remove atomic context inside vortex_{set|get}_wol\n tcp: Prevent overzealous packetization by SWS logic.\n net: RPS needs to depend upon USE_GENERIC_SMP_HELPERS\n phylib: fix PAL state machine restart on resume\n net: use rcu_barrier() in rollback_registered_many\n bonding: correctly process non-linear skbs\n ipv4: enable getsockopt() for IP_NODEFRAG\n ipv4: force_igmp_version ignored when a IGMPv3 query received\n ppp: potential NULL dereference in ppp_mp_explode()\n net/llc: make opt unsigned in llc_ui_setsockopt()\n ...\n" }, { "commit": "4bdab43323b459900578b200a4b8cf9713ac8fab", "tree": "7a732994407ebb88698845ee36dbf98c062af49e", "parents": [ "2507136f74f70a4869bd4f525d48715ae66db43d" ], "author": { "name": "Vlad Yasevich", "email": "vladislav.yasevich@hp.com", "time": "Wed Sep 15 10:00:26 2010 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Sep 17 16:47:56 2010 -0700" }, "message": "sctp: Do not reset the packet during sctp_packet_config().\n\nsctp_packet_config() is called when getting the packet ready\nfor appending of chunks. The function should not touch the\ncurrent state, since it\u0027s possible to ping-pong between two\ntransports when sending, and that can result packet corruption\nfollowed by skb overlfow crash.\n\nReported-by: Thomas Dreibholz \u003cdreibh@iem.uni-due.de\u003e\nSigned-off-by: Vlad Yasevich \u003cvladislav.yasevich@hp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2507136f74f70a4869bd4f525d48715ae66db43d", "tree": "a0dbb80d26c3c97935ddb549f2cab0d7c78aab3d", "parents": [ "e443e383242839b0d72efce744b7ba31573b1f99" ], "author": { "name": "Dan Carpenter", "email": "error27@gmail.com", "time": "Thu Sep 16 08:12:55 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Sep 16 22:38:23 2010 -0700" }, "message": "net/llc: storing negative error codes in unsigned short\n\nIf the alloc_skb() fails then we return 65431 instead of -ENOBUFS\n(-105).\n\nSigned-off-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e71895a1beff2014534c9660d9ae42e043f11555", "tree": "bec0ddc23b1176cac8f3a53b76aa8f2bc5e653a1", "parents": [ "801e147cde02f04b5c2f42764cd43a89fc7400a2" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Thu Sep 16 12:27:50 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Sep 16 21:46:15 2010 -0700" }, "message": "xfrm: dont assume rcu_read_lock in xfrm_output_one()\n\nip_local_out() is called with rcu_read_lock() held from ip_queue_xmit()\nbut not from other call sites.\n\nReported-and-bisected-by: Nick Bowler \u003cnbowler@elliptictech.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6dcbc12290abb452a5e42713faa6461b248e2f55", "tree": "b1f96a3c1eb356eaa31af3cafa33667a6a601bff", "parents": [ "fddd91016d16277a32727ad272cf2edd3d309c90" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 14 21:41:20 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 14 21:42:22 2010 -0700" }, "message": "net: RPS needs to depend upon USE_GENERIC_SMP_HELPERS\n\nYou cannot invoke __smp_call_function_single() unless the\narchitecture sets this symbol.\n\nReported-by: Daniel Hellstrom \u003cdaniel@gaisler.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "de8d4f5d758786a2cbcfa54a6a85ce747e5637e3", "tree": "a09c0a4f8fe995bea2dde0ea4fa5dbdd32cf3fd4", "parents": [ "75e1c70fc31490ef8a373ea2a4bea2524099b478", "827e3457022d0bb0b1bb8a0eb88501876fe7dcf0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 14 17:04:48 2010 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 14 17:04:48 2010 -0700" }, "message": "Merge branch \u0027bugfixes\u0027 of git://git.linux-nfs.org/projects/trondmy/nfs-2.6\n\n* \u0027bugfixes\u0027 of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:\n SUNRPC: Fix the NFSv4 and RPCSEC_GSS Kconfig dependencies\n statfs() gives ESTALE error\n NFS: Fix a typo in nfs_sockaddr_match_ipaddr6\n sunrpc: increase MAX_HASHTABLE_BITS to 14\n gss:spkm3 miss returning error to caller when import security context\n gss:krb5 miss returning error to caller when import security context\n Remove incorrect do_vfs_lock message\n SUNRPC: cleanup state-machine ordering\n SUNRPC: Fix a race in rpc_info_open\n SUNRPC: Fix race corrupting rpc upcall\n Fix null dereference in call_allocate\n" }, { "commit": "ef885afbf8a37689afc1d9d545e2f3e7a8276c17", "tree": "8defdc814be3668f906213b5f32729341eec2aa5", "parents": [ "ab12811c89e88f2e66746790b1fe4469ccb7bdd9" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Mon Sep 13 12:24:54 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 14 14:27:29 2010 -0700" }, "message": "net: use rcu_barrier() in rollback_registered_many\n\nnetdev_wait_allrefs() waits that all references to a device vanishes.\n\nIt currently uses a _very_ pessimistic 250 ms delay between each probe.\nSome users reported that no more than 4 devices can be dismantled per\nsecond, this is a pretty serious problem for some setups.\n\nMost of the time, a refcount is about to be released by an RCU callback,\nthat is still in flight because rollback_registered_many() uses a\nsynchronize_rcu() call instead of rcu_barrier(). Problem is visible if\nnumber of online cpus is one, because synchronize_rcu() is then a no op.\n\ntime to remove 50 ipip tunnels on a UP machine :\n\nbefore patch : real 11.910s\nafter patch : real 1.250s\n\nReported-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nReported-by: Octavian Purdila \u003copurdila@ixiacom.com\u003e\nReported-by: Benjamin LaHaise \u003cbcrl@kvack.org\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a89b47639f3e11dd9a8eb78a5d3382e109c876f2", "tree": "03e4d137f022ae1b2ec90fb4899215c4b2e1b1f3", "parents": [ "7998156344b0d93de61ff8e5d75e96500e43a571" ], "author": { "name": "Michael Kerrisk", "email": "mtk.manpages@gmail.com", "time": "Fri Sep 10 20:26:56 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 13 19:57:23 2010 -0700" }, "message": "ipv4: enable getsockopt() for IP_NODEFRAG\n\nWhile integrating your man-pages patch for IP_NODEFRAG, I noticed\nthat this option is settable by setsockopt(), but not gettable by\ngetsockopt(). I suppose this is not intended. The (untested,\ntrivial) patch below adds getsockopt() support.\n\nSigned-off-by: Michael kerrisk \u003cmtk.manpages@gmail.com\u003e\nAcked-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7998156344b0d93de61ff8e5d75e96500e43a571", "tree": "ac9d61004b6332c745f20cae58ea130868981701", "parents": [ "3429769bc67c7a48b3c01b2452b32171b3450202" ], "author": { "name": "Bob Arendt", "email": "rda@rincon.com", "time": "Mon Sep 13 12:56:03 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 13 12:56:51 2010 -0700" }, "message": "ipv4: force_igmp_version ignored when a IGMPv3 query received\n\nAfter all these years, it turns out that the\n /proc/sys/net/ipv4/conf/*/force_igmp_version\nparameter isn\u0027t fully implemented.\n\n*Symptom*:\nWhen set force_igmp_version to a value of 2, the kernel should only perform\nmulticast IGMPv2 operations (IETF rfc2236). An host-initiated Join message\nwill be sent as a IGMPv2 Join message. But if a IGMPv3 query message is\nreceived, the host responds with a IGMPv3 join message. Per rfc3376 and\nrfc2236, a IGMPv2 host should treat a IGMPv3 query as a IGMPv2 query and\nrespond with an IGMPv2 Join message.\n\n*Consequences*:\nThis is an issue when a IGMPv3 capable switch is the querier and will only\nissue IGMPv3 queries (which double as IGMPv2 querys) and there\u0027s an\nintermediate switch that is only IGMPv2 capable. The intermediate switch\nprocesses the initial v2 Join, but fails to recognize the IGMPv3 Join responses\nto the Query, resulting in a dropped connection when the intermediate v2-only\nswitch times it out.\n\n*Identifying issue in the kernel source*:\nThe issue is in this section of code (in net/ipv4/igmp.c), which is called when\nan IGMP query is received (from mainline 2.6.36-rc3 gitweb):\n ...\nA IGMPv3 query has a length \u003e\u003d 12 and no sources. This routine will exit after\nline 880, setting the general query timer (random timeout between 0 and query\nresponse time). This calls igmp_gq_timer_expire():\n...\n.. which only sends a v3 response. So if a v3 query is received, the kernel\nalways sends a v3 response.\n\nIGMP queries happen once every 60 sec (per vlan), so the traffic is low. A\nIGMPv3 query *is* a strict superset of a IGMPv2 query, so this patch properly\nshort circuit\u0027s the v3 behaviour.\n\nOne issue is that this does not address force_igmp_version\u003d1. Then again, I\u0027ve\nnever seen any IGMPv1 multicast equipment in the wild. However there is a lot\nof v2-only equipment. If it\u0027s necessary to support the IGMPv1 case as well:\n\n837 if (len \u003d\u003d 8 || IGMP_V2_SEEN(in_dev) || IGMP_V1_SEEN(in_dev)) {\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "339db11b219f36cf7da61b390992d95bb6b7ba2e", "tree": "38faf26336bb97d53dddf918d360914f709e2254", "parents": [ "a505b3b30fc69904f858822a2aa95990a4bf7958" ], "author": { "name": "Dan Carpenter", "email": "error27@gmail.com", "time": "Fri Sep 10 01:56:16 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 13 12:44:10 2010 -0700" }, "message": "net/llc: make opt unsigned in llc_ui_setsockopt()\n\nThe members of struct llc_sock are unsigned so if we pass a negative\nvalue for \"opt\" it can cause a sign bug. Also it can cause an integer\noverflow when we multiply \"opt * HZ\".\n\nCC: stable@kernel.org\nSigned-off-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "62b2be591a9b12c550308ef7718a31abfc815b50", "tree": "d07e2cdfa07fdcc0840d3c1e3209591c085fe1c3", "parents": [ "49553c2ef88749dd502687f4eb9c258bb10a4f44" ], "author": { "name": "Latchesar Ionkov", "email": "lionkov@gmail.com", "time": "Tue Aug 24 18:13:59 2010 +0000" }, "committer": { "name": "Eric Van Hensbergen", "email": "ericvh@gmail.com", "time": "Mon Sep 13 08:13:02 2010 -0500" }, "message": "fs/9p, net/9p: memory leak fixes\n\nFour memory leak fixes in the 9P code.\n\nSigned-off-by: Latchesar Ionkov \u003clucho@ionkov.net\u003e\nSigned-off-by: Eric Van Hensbergen \u003cericvh@gmail.com\u003e\n" }, { "commit": "db5fe26541b6b48460104a0d949a27cdc7786957", "tree": "b14418c090e078e1a5eba29d6da710d9cc7de94f", "parents": [ "651b2933b22a0c060e6bb940c4104eb447a61f9a" ], "author": { "name": "Miquel van Smoorenburg", "email": "mikevs@xs4all.net", "time": "Sun Sep 12 19:55:26 2010 -0400" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Sun Sep 12 19:55:26 2010 -0400" }, "message": "sunrpc: increase MAX_HASHTABLE_BITS to 14\n\nThe maximum size of the authcache is now set to 1024 (10 bits),\nbut on our server we need at least 4096 (12 bits). Increase\nMAX_HASHTABLE_BITS to 14. This is a maximum of 16384 entries,\neach containing a pointer (8 bytes on x86_64). This is\nexactly the limit of kmalloc() (128K).\n\nSigned-off-by: Miquel van Smoorenburg \u003cmikevs@xs4all.net\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n" }, { "commit": "651b2933b22a0c060e6bb940c4104eb447a61f9a", "tree": "8ca4e46718ec63fea52b99c2e9dc32a85029c8dd", "parents": [ "ce8477e1176389ed920550f4c925ad4a815b22d5" ], "author": { "name": "Bian Naimeng", "email": "biannm@cn.fujitsu.com", "time": "Sun Sep 12 19:55:26 2010 -0400" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Sun Sep 12 19:55:26 2010 -0400" }, "message": "gss:spkm3 miss returning error to caller when import security context\n\nspkm3 miss returning error to up layer when import security context,\nit may be return ok though it has failed to import security context.\n\nSigned-off-by: Bian Naimeng \u003cbiannm@cn.fujitsu.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n" }, { "commit": "ce8477e1176389ed920550f4c925ad4a815b22d5", "tree": "ae8867cc24b245694ac1d27ab2591c31a530fb34", "parents": [ "b1bde04c6d9a120dec602cc8a70b8a7f21600883" ], "author": { "name": "Bian Naimeng", "email": "biannm@cn.fujitsu.com", "time": "Sun Sep 12 19:55:25 2010 -0400" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Sun Sep 12 19:55:25 2010 -0400" }, "message": "gss:krb5 miss returning error to caller when import security context\n\nkrb5 miss returning error to up layer when import security context,\nit may be return ok though it has failed to import security context.\n\nSigned-off-by: Bian Naimeng \u003cbiannm@cn.fujitsu.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n" }, { "commit": "55576244eba805307a2b2b6a145b8f85f8c7c124", "tree": "b81f059cd196cdc7b8e0c74bba1584e0c7dfcd5e", "parents": [ "006abe887c5e637d059c44310de6c92f36aded3b" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Sun Sep 12 19:55:25 2010 -0400" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Sun Sep 12 19:55:25 2010 -0400" }, "message": "SUNRPC: cleanup state-machine ordering\n\nThis is just a minor cleanup: net/sunrpc/clnt.c clarifies the rpc client\nstate machine by commenting each state and by laying out the functions\nimplementing each state in the order that each state is normally\nexecuted (in the absence of errors).\n\nThe previous patch \"Fix null dereference in call_allocate\" changed the\norder of the states. Move the functions and update the comments to\nreflect the change.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n" }, { "commit": "006abe887c5e637d059c44310de6c92f36aded3b", "tree": "542ab0f1d56b4d9681c8d61fbf77c9a46062e661", "parents": [ "5a67657a2e90c9e4a48518f95d4ba7777aa20fbb" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Sun Sep 12 19:55:25 2010 -0400" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Sun Sep 12 19:55:25 2010 -0400" }, "message": "SUNRPC: Fix a race in rpc_info_open\n\nThere is a race between rpc_info_open and rpc_release_client()\nin that nothing stops a process from opening the file after\nthe clnt-\u003ecl_kref goes to zero.\n\nFix this by using atomic_inc_unless_zero()...\n\nReported-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nCc: stable@kernel.org\n" }, { "commit": "5a67657a2e90c9e4a48518f95d4ba7777aa20fbb", "tree": "bd98ad7f5261afc7ae9ba804937d9ce2fb9e8764", "parents": [ "f2d47d02fd84343a3c5452daca6ed12c75618aff" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Sun Sep 12 19:55:25 2010 -0400" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Sun Sep 12 19:55:25 2010 -0400" }, "message": "SUNRPC: Fix race corrupting rpc upcall\n\nIf rpc_queue_upcall() adds a new upcall to the rpci-\u003epipe list just\nafter rpc_pipe_release calls rpc_purge_list(), but before it calls\ngss_pipe_release (as rpci-\u003eops-\u003erelease_pipe(inode)), then the latter\nwill free a message without deleting it from the rpci-\u003epipe list.\n\nWe will be left with a freed object on the rpc-\u003epipe list. Most\nfrequent symptoms are kernel crashes in rpc.gssd system calls on the\npipe in question.\n\nReported-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nCc: stable@kernel.org\n" }, { "commit": "f2d47d02fd84343a3c5452daca6ed12c75618aff", "tree": "7f7e70c78070021d28e319bc1124cea283ec1e84", "parents": [ "49553c2ef88749dd502687f4eb9c258bb10a4f44" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Sun Sep 12 19:55:25 2010 -0400" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Sun Sep 12 19:55:25 2010 -0400" }, "message": "Fix null dereference in call_allocate\n\nIn call_allocate we need to reach the auth in order to factor au_cslack\ninto the allocation.\n\nAs of a17c2153d2e271b0cbacae9bed83b0eaa41db7e1 \"SUNRPC: Move the bound\ncred to struct rpc_rqst\", call_allocate attempts to do this by\ndereferencing tk_client-\u003ecl_auth, however this is not guaranteed to be\ndefined--cl_auth can be zero in the case of gss context destruction (see\nrpc_free_auth).\n\nReorder the client state machine to bind credentials before allocating,\nso that we can instead reach the auth through the cred.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nCc: stable@kernel.org\n" }, { "commit": "a505b3b30fc69904f858822a2aa95990a4bf7958", "tree": "4ea708f794d8cb91f77d42e32fce5324902cc274", "parents": [ "053d8f6622701f849fda2ca2c9ae596c13599ba9" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Sep 12 11:56:44 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Sep 12 11:56:44 2010 -0700" }, "message": "sch_atm: Fix potential NULL deref.\n\nThe list_head conversion unearther an unnecessary flow\ncheck. Since flow is always NULL here we don\u0027t need to\nsee if a matching flow exists already.\n\nReported-by: Jiri Slaby \u003cjirislaby@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "123031c0eeda6144b4002dc3285375aa9ae9dc11", "tree": "2f7b13ffb639f3737b52ce47bf7bf258ff496f3a", "parents": [ "e199e6136ce6b151e6638ae93dca60748424d900" ], "author": { "name": "Joe Perches", "email": "joe@perches.com", "time": "Wed Sep 08 11:04:21 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Sep 09 15:00:29 2010 -0700" }, "message": "sctp: fix test for end of loop\n\nAdd a list_has_sctp_addr function to simplify loop\n\nBased on a patches by Dan Carpenter and David Miller\n\nSigned-off-by: Joe Perches \u003cjoe@perches.com\u003e\nAcked-by: Vlad Yasevich \u003cvladislav.yasevich@hp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e199e6136ce6b151e6638ae93dca60748424d900", "tree": "0d66e0b5d227c36b005e4f5537f4bbcfc6ed4904", "parents": [ "972c40b5bee429c84ba727f8ac0a08292bc5dc3d", "d56557af19867edb8c0e96f8e26399698a08857f" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 08 23:49:04 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 08 23:49:04 2010 -0700" }, "message": "Merge branch \u0027master\u0027 of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6\n" }, { "commit": "719f835853a92f6090258114a72ffe41f09155cd", "tree": "a077b05397bf07a096be7f07b50375c5ed918ac2", "parents": [ "ae2688d59b5f861dc70a091d003773975d2ae7fb" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed Sep 08 05:08:44 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 08 21:45:01 2010 -0700" }, "message": "udp: add rehash on connect()\n\ncommit 30fff923 introduced in linux-2.6.33 (udp: bind() optimisation)\nadded a secondary hash on UDP, hashed on (local addr, local port).\n\nProblem is that following sequence :\n\nfd \u003d socket(...)\nconnect(fd, \u0026remote, ...)\n\nnot only selects remote end point (address and port), but also sets\nlocal address, while UDP stack stored in secondary hash table the socket\nwhile its local address was INADDR_ANY (or ipv6 equivalent)\n\nSequence is :\n - autobind() : choose a random local port, insert socket in hash tables\n [while local address is INADDR_ANY]\n - connect() : set remote address and port, change local address to IP\n given by a route lookup.\n\nWhen an incoming UDP frame comes, if more than 10 sockets are found in\nprimary hash table, we switch to secondary table, and fail to find\nsocket because its local address changed.\n\nOne solution to this problem is to rehash datagram socket if needed.\n\nWe add a new rehash(struct socket *) method in \"struct proto\", and\nimplement this method for UDP v4 \u0026 v6, using a common helper.\n\nThis rehashing only takes care of secondary hash table, since primary\nhash (based on local port only) is not changed.\n\nReported-by: Krzysztof Piotr Oledzki \u003cole@ans.pl\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nTested-by: Krzysztof Piotr Oledzki \u003cole@ans.pl\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ae2688d59b5f861dc70a091d003773975d2ae7fb", "tree": "ae674d926ba2069bc712cc1bb25b1c87ea7cc241", "parents": [ "f6b085b69d1cbbd62f49f34e71a3d58cb6d34b7e" ], "author": { "name": "Jianzhao Wang", "email": "jianzhao.wang@6wind.com", "time": "Wed Sep 08 14:35:43 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 08 14:35:43 2010 -0700" }, "message": "net: blackhole route should always be recalculated\n\nBlackhole routes are used when xfrm_lookup() returns -EREMOTE (error\ntriggered by IKE for example), hence this kind of route is always\ntemporary and so we should check if a better route exists for next\npackets.\nBug has been introduced by commit d11a4dc18bf41719c9f0d7ed494d295dd2973b92.\n\nSigned-off-by: Jianzhao Wang \u003cjianzhao.wang@6wind.com\u003e\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f6b085b69d1cbbd62f49f34e71a3d58cb6d34b7e", "tree": "13d067c1be55a7d87b66ce5920890fcf1f72bcf1", "parents": [ "ee9c5cfad29c8a13199962614b9b16f1c4137ac9" ], "author": { "name": "Jarek Poplawski", "email": "jarkao2@gmail.com", "time": "Tue Sep 07 07:51:17 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 08 14:14:20 2010 -0700" }, "message": "ipv4: Suppress lockdep-RCU false positive in FIB trie (3)\n\nHi,\nHere is one more of these warnings and a patch below:\n\nSep 5 23:52:33 del kernel: [46044.244833] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nSep 5 23:52:33 del kernel: [46044.269681] [ INFO: suspicious rcu_dereference_check() usage. ]\nSep 5 23:52:33 del kernel: [46044.277000] ---------------------------------------------------\nSep 5 23:52:33 del kernel: [46044.285185] net/ipv4/fib_trie.c:1756 invoked rcu_dereference_check() without protection!\nSep 5 23:52:33 del kernel: [46044.293627]\nSep 5 23:52:33 del kernel: [46044.293632] other info that might help us debug this:\nSep 5 23:52:33 del kernel: [46044.293634]\nSep 5 23:52:33 del kernel: [46044.325333]\nSep 5 23:52:33 del kernel: [46044.325335] rcu_scheduler_active \u003d 1, debug_locks \u003d 0\nSep 5 23:52:33 del kernel: [46044.348013] 1 lock held by pppd/1717:\nSep 5 23:52:33 del kernel: [46044.357548] #0: (rtnl_mutex){+.+.+.}, at: [\u003cc125dc1f\u003e] rtnl_lock+0xf/0x20\nSep 5 23:52:33 del kernel: [46044.367647]\nSep 5 23:52:33 del kernel: [46044.367652] stack backtrace:\nSep 5 23:52:33 del kernel: [46044.387429] Pid: 1717, comm: pppd Not tainted 2.6.35.4.4a #3\nSep 5 23:52:33 del kernel: [46044.398764] Call Trace:\nSep 5 23:52:33 del kernel: [46044.409596] [\u003cc12f9aba\u003e] ? printk+0x18/0x1e\nSep 5 23:52:33 del kernel: [46044.420761] [\u003cc1053969\u003e] lockdep_rcu_dereference+0xa9/0xb0\nSep 5 23:52:33 del kernel: [46044.432229] [\u003cc12b7235\u003e] trie_firstleaf+0x65/0x70\nSep 5 23:52:33 del kernel: [46044.443941] [\u003cc12b74d4\u003e] fib_table_flush+0x14/0x170\nSep 5 23:52:33 del kernel: [46044.455823] [\u003cc1033e92\u003e] ? local_bh_enable_ip+0x62/0xd0\nSep 5 23:52:33 del kernel: [46044.467995] [\u003cc12fc39f\u003e] ? _raw_spin_unlock_bh+0x2f/0x40\nSep 5 23:52:33 del kernel: [46044.480404] [\u003cc12b24d0\u003e] ? fib_sync_down_dev+0x120/0x180\nSep 5 23:52:33 del kernel: [46044.493025] [\u003cc12b069d\u003e] fib_flush+0x2d/0x60\nSep 5 23:52:33 del kernel: [46044.505796] [\u003cc12b06f5\u003e] fib_disable_ip+0x25/0x50\nSep 5 23:52:33 del kernel: [46044.518772] [\u003cc12b10d3\u003e] fib_netdev_event+0x73/0xd0\nSep 5 23:52:33 del kernel: [46044.531918] [\u003cc1048dfd\u003e] notifier_call_chain+0x2d/0x70\nSep 5 23:52:33 del kernel: [46044.545358] [\u003cc1048f0a\u003e] raw_notifier_call_chain+0x1a/0x20\nSep 5 23:52:33 del kernel: [46044.559092] [\u003cc124f687\u003e] call_netdevice_notifiers+0x27/0x60\nSep 5 23:52:33 del kernel: [46044.573037] [\u003cc124faec\u003e] __dev_notify_flags+0x5c/0x80\nSep 5 23:52:33 del kernel: [46044.586489] [\u003cc124fb47\u003e] dev_change_flags+0x37/0x60\nSep 5 23:52:33 del kernel: [46044.599394] [\u003cc12a8a8d\u003e] devinet_ioctl+0x54d/0x630\nSep 5 23:52:33 del kernel: [46044.612277] [\u003cc12aabb7\u003e] inet_ioctl+0x97/0xc0\nSep 5 23:52:34 del kernel: [46044.625208] [\u003cc123f6af\u003e] sock_ioctl+0x6f/0x270\nSep 5 23:52:34 del kernel: [46044.638046] [\u003cc109d2b0\u003e] ? handle_mm_fault+0x420/0x6c0\nSep 5 23:52:34 del kernel: [46044.650968] [\u003cc123f640\u003e] ? sock_ioctl+0x0/0x270\nSep 5 23:52:34 del kernel: [46044.663865] [\u003cc10c3188\u003e] vfs_ioctl+0x28/0xa0\nSep 5 23:52:34 del kernel: [46044.676556] [\u003cc10c38fa\u003e] do_vfs_ioctl+0x6a/0x5c0\nSep 5 23:52:34 del kernel: [46044.688989] [\u003cc1048676\u003e] ? up_read+0x16/0x30\nSep 5 23:52:34 del kernel: [46044.701411] [\u003cc1021376\u003e] ? do_page_fault+0x1d6/0x3a0\nSep 5 23:52:34 del kernel: [46044.714223] [\u003cc10b6588\u003e] ? fget_light+0xf8/0x2f0\nSep 5 23:52:34 del kernel: [46044.726601] [\u003cc1241f98\u003e] ? sys_socketcall+0x208/0x2c0\nSep 5 23:52:34 del kernel: [46044.739140] [\u003cc10c3eb3\u003e] sys_ioctl+0x63/0x70\nSep 5 23:52:34 del kernel: [46044.751967] [\u003cc12fca3d\u003e] syscall_call+0x7/0xb\nSep 5 23:52:34 del kernel: [46044.764734] [\u003cc12f0000\u003e] ? cookie_v6_check+0x3d0/0x630\n\n--------------\u003e\n\nThis patch fixes the warning:\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ INFO: suspicious rcu_dereference_check() usage. ]\n ---------------------------------------------------\n net/ipv4/fib_trie.c:1756 invoked rcu_dereference_check() without protection!\n\n other info that might help us debug this:\n\n rcu_scheduler_active \u003d 1, debug_locks \u003d 0\n 1 lock held by pppd/1717:\n #0: (rtnl_mutex){+.+.+.}, at: [\u003cc125dc1f\u003e] rtnl_lock+0xf/0x20\n\n stack backtrace:\n Pid: 1717, comm: pppd Not tainted 2.6.35.4a #3\n Call Trace:\n [\u003cc12f9aba\u003e] ? printk+0x18/0x1e\n [\u003cc1053969\u003e] lockdep_rcu_dereference+0xa9/0xb0\n [\u003cc12b7235\u003e] trie_firstleaf+0x65/0x70\n [\u003cc12b74d4\u003e] fib_table_flush+0x14/0x170\n ...\n\nAllow trie_firstleaf() to be called either under rcu_read_lock()\nprotection or with RTNL held. The same annotation is added to\nnode_parent_rcu() to prevent a similar warning a bit later.\n\nFollowup of commits 634a4b20 and 4eaa0e3c.\n\nSigned-off-by: Jarek Poplawski \u003cjarkao2@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6523ce1525e88c598c75a1a6b8c4edddfa9defe8", "tree": "c3439e9c509676a0c29cd81fdaa65ad2632b903c", "parents": [ "64289c8e6851bca0e589e064c9a5c9fbd6ae5dd4" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Sun Sep 05 18:02:29 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 08 10:39:57 2010 -0700" }, "message": "ipvs: fix active FTP\n\n- Do not create expectation when forwarding the PORT\n command to avoid blocking the connection. The problem is that\n nf_conntrack_ftp.c:help() tries to create the same expectation later in\n POST_ROUTING and drops the packet with \"dropping packet\" message after\n failure in nf_ct_expect_related.\n\n- Change ip_vs_update_conntrack to alter the conntrack\n for related connections from real server. If we do not alter the reply in\n this direction the next packet from client sent to vport 20 comes as NEW\n connection. We alter it but may be some collision happens for both\n conntracks and the second conntrack gets destroyed immediately. The\n connection stucks too.\n\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Simon Horman \u003chorms@verge.net.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "64289c8e6851bca0e589e064c9a5c9fbd6ae5dd4", "tree": "d1ce5fb1a0f3ef89e4d1259065cfbeeae07a3145", "parents": [ "de2b96f1212722eb0af80bf9a029d03d8fc673a9" ], "author": { "name": "Jarek Poplawski", "email": "jarkao2@gmail.com", "time": "Sat Sep 04 10:34:29 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 08 10:32:15 2010 -0700" }, "message": "gro: Re-fix different skb headrooms\n\nThe patch: \"gro: fix different skb headrooms\" in its part:\n\"2) allocate a minimal skb for head of frag_list\" is buggy. The copied\nskb has p-\u003edata set at the ip header at the moment, and skb_gro_offset\nis the length of ip + tcp headers. So, after the change the length of\nmac header is skipped. Later skb_set_mac_header() sets it into the\nNET_SKB_PAD area (if it\u0027s long enough) and ip header is misaligned at\nNET_SKB_PAD + NET_IP_ALIGN offset. There is no reason to assume the\noriginal skb was wrongly allocated, so let\u0027s copy it as it was.\n\nbugzilla : https://bugzilla.kernel.org/show_bug.cgi?id\u003d16626\nfixes commit: 3d3be4333fdf6faa080947b331a6a19bce1a4f57\n\nReported-by: Plamen Petrov \u003cpvp-lsts@fs.uni-ruse.bg\u003e\nSigned-off-by: Jarek Poplawski \u003cjarkao2@gmail.com\u003e\nCC: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nTested-by: Plamen Petrov \u003cpvp-lsts@fs.uni-ruse.bg\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "608307e6de2631e37f55f106a7cbbc560cb12751", "tree": "6aff93496b1bfe5ad3d12c97a2326106628989f2", "parents": [ "96d4cbb6a91af9d43db110eec1d8c61d41eb46b4", "0b5d404e349c0236b11466c0a4785520c0be6982" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 07 14:06:10 2010 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 07 14:06:10 2010 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (26 commits)\n pkt_sched: Fix lockdep warning on est_tree_lock in gen_estimator\n ipvs: avoid oops for passive FTP\n Revert \"sky2: don\u0027t do GRO on second port\"\n gro: fix different skb headrooms\n bridge: Clear INET control block of SKBs passed into ip_fragment().\n 3c59x: Remove incorrect locking; correct documented lock hierarchy\n sky2: don\u0027t do GRO on second port\n ipv4: minor fix about RPF in help of Kconfig\n xfrm_user: avoid a warning with some compiler\n net/sched/sch_hfsc.c: initialize parent\u0027s cl_cfmin properly in init_vf()\n pxa168_eth: fix a mdiobus leak\n net sched: fix kernel leak in act_police\n vhost: stop worker only if created\n MAINTAINERS: Add ehea driver as Supported\n ath9k_hw: fix parsing of HT40 5 GHz CTLs\n ath9k_hw: Fix EEPROM uncompress block reading on AR9003\n wireless: register wiphy rfkill w/o holding cfg80211_mutex\n netlink: Make NETLINK_USERSOCK work again.\n irda: Correctly clean up self-\u003eias_obj on irda_bind() failure.\n wireless extensions: fix kernel heap content leak\n ...\n" }, { "commit": "6f86b325189e0a53c97bf86cff0c8b02ff624934", "tree": "856badf9fa6205b2216eb4301a0776da70d5b28a", "parents": [ "8df73ff90f00f14d2c7ff7156f7ef153f7e9d3b7" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Sep 06 22:36:19 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 07 13:57:24 2010 -0700" }, "message": "ipv4: Fix reverse path filtering with multipath routing.\n\nActually iterate over the next-hops to make sure we have\na device match. Otherwise RP filtering is always elided\nwhen the route matched has multiple next-hops.\n\nReported-by: Igor M Podlesny \u003cfor.poige@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8df73ff90f00f14d2c7ff7156f7ef153f7e9d3b7", "tree": "9df146da5dd92eeb921fbc21f856d7660ac92b0e", "parents": [ "32737e934a952c1b0c744f2a78d80089d15c7ee3" ], "author": { "name": "Tetsuo Handa", "email": "penguin-kernel@I-love.SAKURA.ne.jp", "time": "Sat Sep 04 01:34:28 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 07 13:57:23 2010 -0700" }, "message": "UNIX: Do not loop forever at unix_autobind().\n\nWe assumed that unix_autobind() never fails if kzalloc() succeeded.\nBut unix_autobind() allows only 1048576 names. If /proc/sys/fs/file-max is\nlarger than 1048576 (e.g. systems with more than 10GB of RAM), a local user can\nconsume all names using fork()/socket()/bind().\n\nIf all names are in use, those who call bind() with addr_len \u003d\u003d sizeof(short)\nor connect()/sendmsg() with setsockopt(SO_PASSCRED) will continue\n\n while (1)\n yield();\n\nloop at unix_autobind() till a name becomes available.\nThis patch adds a loop counter in order to give up after 1048576 attempts.\n\nCalling yield() for once per 256 attempts may not be sufficient when many names\nare already in use, for __unix_find_socket_byname() can take long time under\nsuch circumstance. Therefore, this patch also adds cond_resched() call.\n\nNote that currently a local user can consume 2GB of kernel memory if the user\nis allowed to create and autobind 1048576 UNIX domain sockets. We should\nconsider adding some restriction for autobind operation.\n\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cf9b94f88bdbe8a02015fc30d7c232b2d262d4ad", "tree": "8e279d2e0b9b3e2d165a2669da002cf7324d24b0", "parents": [ "89b12faba4f3441c9457c5278851e8a93ffd008d" ], "author": { "name": "Dan Carpenter", "email": "error27@gmail.com", "time": "Sat Sep 04 03:14:35 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 07 13:57:22 2010 -0700" }, "message": "irda: off by one\n\nThis is an off by one. We would go past the end when we NUL terminate\nthe \"value\" string at end of the function. The \"value\" buffer is\nallocated in irlan_client_parse_response() or\nirlan_provider_parse_command().\n\nCC: stable@kernel.org\nSigned-off-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1ee89bd0fe72e381c8e4ef887d53c19c8adc6c93", "tree": "3a73d6913b51dc91114443c5af2a1d44c59735c6", "parents": [ "70789d7052239992824628db8133de08dc78e593" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Fri Sep 03 05:13:07 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 07 13:57:21 2010 -0700" }, "message": "netfilter: discard overlapping IPv6 fragment\n\nRFC5722 prohibits reassembling IPv6 fragments when some data overlaps.\n\nBug spotted by Zhang Zuotao \u003czuotao.zhang@6wind.com\u003e.\n\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "70789d7052239992824628db8133de08dc78e593", "tree": "c1fb08a04f4f3a266165405d2f5d606ddff30479", "parents": [ "deabc772f39405054a438d711f408d2d94d26d96" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Fri Sep 03 05:13:05 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 07 13:57:21 2010 -0700" }, "message": "ipv6: discard overlapping fragment\n\nRFC5722 prohibits reassembling fragments when some data overlaps.\n\nBug spotted by Zhang Zuotao \u003czuotao.zhang@6wind.com\u003e.\n\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "deabc772f39405054a438d711f408d2d94d26d96", "tree": "5289c7ac29a882f8999239327c13224bf2bf0f20", "parents": [ "cb32f2a0d194212e4e750a8cdedcc610c9ca4876" ], "author": { "name": "Helmut Schaa", "email": "helmut.schaa@googlemail.com", "time": "Fri Sep 03 02:39:56 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Sep 07 13:57:20 2010 -0700" }, "message": "net: fix tx queue selection for bridged devices implementing select_queue\n\nWhen a net device is implementing the select_queue callback and is part of\na bridge, frames coming from the bridge already have a tx queue associated\nto the socket (introduced in commit a4ee3ce3293dc931fab19beb472a8bde1295aebe,\n\"net: Use sk_tx_queue_mapping for connected sockets\"). The call to\nsk_tx_queue_get will then return the tx queue used by the bridge instead\nof calling the select_queue callback.\n\nIn case of mac80211 this broke QoS which is implemented by using the\nselect_queue callback. Furthermore it introduced problems with rt2x00\nbecause frames with the same TID and RA sometimes appeared on different\ntx queues which the hw cannot handle correctly.\n\nFix this by always calling select_queue first if it is available and only\nafterwards use the socket tx queue mapping.\n\nSigned-off-by: Helmut Schaa \u003chelmut.schaa@googlemail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0b5d404e349c0236b11466c0a4785520c0be6982", "tree": "f4e51049b1433982591204dd67d158ee84808ace", "parents": [ "7bcbf81a2296a8f71342445560dcbe16100b567c" ], "author": { "name": "Jarek Poplawski", "email": "jarkao2@gmail.com", "time": "Thu Sep 02 13:22:11 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Sep 02 13:22:11 2010 -0700" }, "message": "pkt_sched: Fix lockdep warning on est_tree_lock in gen_estimator\n\nThis patch fixes a lockdep warning:\n\n[ 516.287584] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 516.288386] [ INFO: possible irq lock inversion dependency detected ]\n[ 516.288386] 2.6.35b #7\n[ 516.288386] ---------------------------------------------------------\n[ 516.288386] swapper/0 just changed the state of lock:\n[ 516.288386] (\u0026qdisc_tx_lock){+.-...}, at: [\u003cc12eacda\u003e] est_timer+0x62/0x1b4\n[ 516.288386] but this lock took another, SOFTIRQ-unsafe lock in the past:\n[ 516.288386] (est_tree_lock){+.+...}\n[ 516.288386] \n[ 516.288386] and interrupts could create inverse lock ordering between them.\n...\n\nSo, est_tree_lock needs BH protection because it\u0027s taken by\nqdisc_tx_lock, which is used both in BH and process contexts.\n(Full warning with this patch at netdev, 02 Sep 2010.)\n\nFixes commit: ae638c47dc040b8def16d05dc6acdd527628f231\n(\"pkt_sched: gen_estimator: add a new lock\")\n\nSigned-off-by: Jarek Poplawski \u003cjarkao2@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7bcbf81a2296a8f71342445560dcbe16100b567c", "tree": "9004ebda47bfc84e80d5114e86fdb4eb33ecf528", "parents": [ "5e4e7573e1ec286120109e73bf54cff465488725" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Wed Sep 01 23:07:10 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Sep 02 10:05:00 2010 -0700" }, "message": "ipvs: avoid oops for passive FTP\n\nFix Passive FTP problem in ip_vs_ftp:\n\n- Do not oops in nf_nat_set_seq_adjust (adjust_tcp_sequence) when\n iptable_nat module is not loaded\n\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Simon Horman \u003chorms@verge.net.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3d3be4333fdf6faa080947b331a6a19bce1a4f57", "tree": "dd27c40e1fa650369eb5865c4c47dc0001bcc6af", "parents": [ "87f94b4e91dc042620c527f3c30c37e5127ef757" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed Sep 01 00:50:51 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 01 19:17:35 2010 -0700" }, "message": "gro: fix different skb headrooms\n\nPackets entering GRO might have different headrooms, even for a given\nflow (because of implementation details in drivers, like copybreak).\nWe cant force drivers to deliver packets with a fixed headroom.\n\n1) fix skb_segment()\n\nskb_segment() makes the false assumption headrooms of fragments are same\nthan the head. When CHECKSUM_PARTIAL is used, this can give csum_start\nerrors, and crash later in skb_copy_and_csum_dev()\n\n2) allocate a minimal skb for head of frag_list\n\nskb_gro_receive() uses netdev_alloc_skb(headroom + skb_gro_offset(p)) to\nallocate a fresh skb. This adds NET_SKB_PAD to a padding already\nprovided by netdevice, depending on various things, like copybreak.\n\nUse alloc_skb() to allocate an exact padding, to reduce cache line\nneeds:\nNET_SKB_PAD + NET_IP_ALIGN\n\nbugzilla : https://bugzilla.kernel.org/show_bug.cgi?id\u003d16626\n\nMany thanks to Plamen Petrov, testing many debugging patches !\nWith help of Jarek Poplawski.\n\nReported-by: Plamen Petrov \u003cpvp-lsts@fs.uni-ruse.bg\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Jarek Poplawski \u003cjarkao2@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "87f94b4e91dc042620c527f3c30c37e5127ef757", "tree": "e9e3229e7e25f41cf83cfa782dd6dd47299bc34c", "parents": [ "24cd804d1dc60a74c53da983094df3516500c276" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 01 18:06:39 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 01 19:17:34 2010 -0700" }, "message": "bridge: Clear INET control block of SKBs passed into ip_fragment().\n\nIn a similar vain to commit 17762060c25590bfddd68cc1131f28ec720f405f\n(\"bridge: Clear IPCB before possible entry into IP stack\")\n\nAny time we call into the IP stack we have to make sure the state\nthere is as expected by the ipv4 code.\n\nWith help from Eric Dumazet and Herbert Xu.\n\nReported-by: Bandan Das \u003cbandan.das@stratus.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "750e9fad8c7f44e0005ffb7195f72dd76978c2cf", "tree": "1ac435c456d45aa70c4f4d5c2420283c077499a1", "parents": [ "928497f0209027ccd649480a38a499fab9c3f6f6" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Tue Aug 31 05:50:43 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 01 14:29:36 2010 -0700" }, "message": "ipv4: minor fix about RPF in help of Kconfig\n\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "928497f0209027ccd649480a38a499fab9c3f6f6", "tree": "c2d86ba0a40d43ea964e8900999c9e3c09076a91", "parents": [ "3b2eb6131e2f6ff646abb0fc69648179b8b70216" ], "author": { "name": "Nicolas Dichtel", "email": "nicolas.dichtel@6wind.com", "time": "Tue Aug 31 05:54:00 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 01 14:29:35 2010 -0700" }, "message": "xfrm_user: avoid a warning with some compiler\n\nAttached is a small patch to remove a warning (\"warning: ISO C90 forbids\nmixed declarations and code\" with gcc 4.3.2).\n\nSigned-off-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3b2eb6131e2f6ff646abb0fc69648179b8b70216", "tree": "c868e5eadcccb39ad4d2731c21caccd3098eff56", "parents": [ "9c01ae58d4fee39e2af5b1379ee5431dd585cf62" ], "author": { "name": "Michal Soltys", "email": "soltys@ziu.info", "time": "Mon Aug 30 11:34:10 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 01 14:29:35 2010 -0700" }, "message": "net/sched/sch_hfsc.c: initialize parent\u0027s cl_cfmin properly in init_vf()\n\nThis patch fixes init_vf() function, so on each new backlog period parent\u0027s\ncl_cfmin is properly updated (including further propgation towards the root),\neven if the activated leaf has no upperlimit curve defined.\n\nSigned-off-by: Michal Soltys \u003csoltys@ziu.info\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0f04cfd098fb81fded74e78ea1a1b86cc6c6c31e", "tree": "cec4306a238658123aaba429a7cdb679c8deb801", "parents": [ "78b620ce9e168d08ecfac2f4bb056c511b0601ec" ], "author": { "name": "Jeff Mahoney", "email": "jeffm@suse.com", "time": "Tue Aug 31 13:21:42 2010 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 01 14:29:34 2010 -0700" }, "message": "net sched: fix kernel leak in act_police\n\nWhile reviewing commit 1c40be12f7d8ca1d387510d39787b12e512a7ce8, I\n audited other users of tc_action_ops-\u003edump for information leaks.\n\n That commit covered almost all of them but act_police still had a leak.\n\n opt.limit and opt.capab aren\u0027t zeroed out before the structure is\n passed out.\n\n This patch uses the C99 initializers to zero everything unused out.\n\nSigned-off-by: Jeff Mahoney \u003cjeffm@suse.com\u003e\nAcked-by: Jeff Mahoney \u003cjeffm@suse.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a3f86ec002774f28b9b3d1d5e5532231e96a0861", "tree": "740ea059803c6e377e930b19bc8e37134e2b5051", "parents": [ "b963ea89f00f13c648af4082e5efb2172d369727", "904879748d7439a6dabdc6be9aad983e216b027d" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 01 12:01:05 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 01 12:01:05 2010 -0700" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "c3d34d5d9654ec9c2510f9341bfb1030b8f029d1", "tree": "1a5db6df49f9b55aa16b0359088dc0536387b3dd", "parents": [ "42da2f948d949efd0111309f5827bf0298bcc9a4" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Aug 30 17:36:40 2010 -0400" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Tue Aug 31 14:48:47 2010 -0400" }, "message": "wireless: register wiphy rfkill w/o holding cfg80211_mutex\n\nOtherwise lockdep complains...\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d17311\n\n[ INFO: possible circular locking dependency detected ]\n2.6.36-rc2-git4 #12\n-------------------------------------------------------\nkworker/0:3/3630 is trying to acquire lock:\n (rtnl_mutex){+.+.+.}, at: [\u003cffffffff813396c7\u003e] rtnl_lock+0x12/0x14\n\nbut task is already holding lock:\n (rfkill_global_mutex){+.+.+.}, at: [\u003cffffffffa014b129\u003e]\nrfkill_switch_all+0x24/0x49 [rfkill]\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #2 (rfkill_global_mutex){+.+.+.}:\n [\u003cffffffff81079ad7\u003e] lock_acquire+0x120/0x15b\n [\u003cffffffff813ae869\u003e] __mutex_lock_common+0x54/0x52e\n [\u003cffffffff813aede9\u003e] mutex_lock_nested+0x34/0x39\n [\u003cffffffffa014b4ab\u003e] rfkill_register+0x2b/0x29c [rfkill]\n [\u003cffffffffa0185ba0\u003e] wiphy_register+0x1ae/0x270 [cfg80211]\n [\u003cffffffffa0206f01\u003e] ieee80211_register_hw+0x1b4/0x3cf [mac80211]\n [\u003cffffffffa0292e98\u003e] iwl_ucode_callback+0x9e9/0xae3 [iwlagn]\n [\u003cffffffff812d3e9d\u003e] request_firmware_work_func+0x54/0x6f\n [\u003cffffffff81065d15\u003e] kthread+0x8c/0x94\n [\u003cffffffff8100ac24\u003e] kernel_thread_helper+0x4/0x10\n\n-\u003e #1 (cfg80211_mutex){+.+.+.}:\n [\u003cffffffff81079ad7\u003e] lock_acquire+0x120/0x15b\n [\u003cffffffff813ae869\u003e] __mutex_lock_common+0x54/0x52e\n [\u003cffffffff813aede9\u003e] mutex_lock_nested+0x34/0x39\n [\u003cffffffffa018605e\u003e] cfg80211_get_dev_from_ifindex+0x1b/0x7c [cfg80211]\n [\u003cffffffffa0189f36\u003e] cfg80211_wext_giwscan+0x58/0x990 [cfg80211]\n [\u003cffffffff8139a3ce\u003e] ioctl_standard_iw_point+0x1a8/0x272\n [\u003cffffffff8139a529\u003e] ioctl_standard_call+0x91/0xa7\n [\u003cffffffff8139a687\u003e] T.723+0xbd/0x12c\n [\u003cffffffff8139a727\u003e] wext_handle_ioctl+0x31/0x6d\n [\u003cffffffff8133014e\u003e] dev_ioctl+0x63d/0x67a\n [\u003cffffffff8131afd9\u003e] sock_ioctl+0x48/0x21d\n [\u003cffffffff81102abd\u003e] do_vfs_ioctl+0x4ba/0x509\n [\u003cffffffff81102b5d\u003e] sys_ioctl+0x51/0x74\n [\u003cffffffff81009e02\u003e] system_call_fastpath+0x16/0x1b\n\n-\u003e #0 (rtnl_mutex){+.+.+.}:\n [\u003cffffffff810796b0\u003e] __lock_acquire+0xa93/0xd9a\n [\u003cffffffff81079ad7\u003e] lock_acquire+0x120/0x15b\n [\u003cffffffff813ae869\u003e] __mutex_lock_common+0x54/0x52e\n [\u003cffffffff813aede9\u003e] mutex_lock_nested+0x34/0x39\n [\u003cffffffff813396c7\u003e] rtnl_lock+0x12/0x14\n [\u003cffffffffa0185cb5\u003e] cfg80211_rfkill_set_block+0x1a/0x7b [cfg80211]\n [\u003cffffffffa014aed0\u003e] rfkill_set_block+0x80/0xd5 [rfkill]\n [\u003cffffffffa014b07e\u003e] __rfkill_switch_all+0x3f/0x6f [rfkill]\n [\u003cffffffffa014b13d\u003e] rfkill_switch_all+0x38/0x49 [rfkill]\n [\u003cffffffffa014b821\u003e] rfkill_op_handler+0x105/0x136 [rfkill]\n [\u003cffffffff81060708\u003e] process_one_work+0x248/0x403\n [\u003cffffffff81062620\u003e] worker_thread+0x139/0x214\n [\u003cffffffff81065d15\u003e] kthread+0x8c/0x94\n [\u003cffffffff8100ac24\u003e] kernel_thread_helper+0x4/0x10\n\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nAcked-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\n" }, { "commit": "b963ea89f00f13c648af4082e5efb2172d369727", "tree": "d5a09f822da3b0827a32c5b2aa2d72f8e537b6fa", "parents": [ "628e300cccaa628d8fb92aa28cb7530a3d5f2257" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Aug 30 19:08:01 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Aug 31 09:51:37 2010 -0700" }, "message": "netlink: Make NETLINK_USERSOCK work again.\n\nOnce we started enforcing the a nl_table[] entry exist for\na protocol, NETLINK_USERSOCK stopped working. Add a dummy\ntable entry so that it works again.\n\nReported-by: Thomas Voegtle \u003ctv@lio96.de\u003e\nTested-by: Thomas Voegtle \u003ctv@lio96.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "628e300cccaa628d8fb92aa28cb7530a3d5f2257", "tree": "40f51d137174835b2e1240c81391bb18755d501f", "parents": [ "7619b1b2e2b96842459f499fd48ec32e3d223d02" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Aug 30 18:35:24 2010 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Aug 30 18:37:56 2010 -0700" }, "message": "irda: Correctly clean up self-\u003eias_obj on irda_bind() failure.\n\nIf irda_open_tsap() fails, the irda_bind() code tries to destroy\nthe -\u003eias_obj object by hand, but does so wrongly.\n\nIn particular, it fails to a) release the hashbin attached to the\nobject and b) reset the self-\u003eias_obj pointer to NULL.\n\nFix both problems by using irias_delete_object() and explicitly\nsetting self-\u003eias_obj to NULL, just as irda_release() does.\n\nReported-by: Tavis Ormandy \u003ctaviso@cmpxchg8b.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "42da2f948d949efd0111309f5827bf0298bcc9a4", "tree": "9bcf654ba27e198935a00e679c91181365ee37fa", "parents": [ "9ef808048564928a83f3a52c65c5725688cf5cbe" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Aug 30 12:24:54 2010 +0200" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Aug 30 16:35:17 2010 -0400" }, "message": "wireless extensions: fix kernel heap content leak\n\nWireless extensions have an unfortunate, undocumented\nrequirement which requires drivers to always fill\niwp-\u003elength when returning a successful status. When\na driver doesn\u0027t do this, it leads to a kernel heap\ncontent leak when userspace offers a larger buffer\nthan would have been necessary.\n\nArguably, this is a driver bug, as it should, if it\nreturns 0, fill iwp-\u003elength, even if it separately\nindicated that the buffer contents was not valid.\n\nHowever, we can also at least avoid the memory content\nleak if the driver doesn\u0027t do this by setting the iwp\nlength to max_tokens, which then reflects how big the\nbuffer is that the driver may fill, regardless of how\nbig the userspace buffer is.\n\nTo illustrate the point, this patch also fixes a\ncorresponding cfg80211 bug (since this requirement\nisn\u0027t documented nor was ever pointed out by anyone\nduring code review, I don\u0027t trust all drivers nor\nall cfg80211 handlers to implement it correctly).\n\nCc: stable@kernel.org [all the way back]\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "071249b1d501b1f31a6b1af3fbcbe03158a84e5c", "tree": "f25daa4a50718b42ee8597a0b6b8c3ca86be7383", "parents": [ "f880c2050f30b23c9b6f80028c09f76e693bf309" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Aug 25 14:47:38 2010 +0200" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Aug 30 16:02:34 2010 -0400" }, "message": "mac80211: delete work timer\n\nThe new workqueue changes helped me find this bug\nthat\u0027s been lingering since the changes to the work\nprocessing in mac80211 -- the work timer is never\ndeleted properly. Do that to avoid having it fire\nafter all data structures have been freed. It can\u0027t\nbe re-armed because all it will do, if running, is\nschedule the work, but that gets flushed later and\nwon\u0027t have anything to do since all work items are\ngone by now (by way of interface removal).\n\nCc: stable@kernel.org [2.6.34+]\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "29cfcddc0e745b515ec360ffe2ee4e7a4015efd8", "tree": "1682b6caaf84d4863e65b2e4e387afa6a972146f", "parents": [ "303fd2c2ce5addef1aacac962a5b099cc0af71ea", "c34186ed008229e7f7e3f1de8e6acf6374995358" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 28 15:42:44 2010 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 28 15:42:44 2010 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:\n net/ipv4: Eliminate kstrdup memory leak\n net/caif/cfrfml.c: use asm/unaligned.h\n ax25: missplaced sock_put(sk)\n qlge: reset the chip before freeing the buffers\n l2tp: test for ethernet header in l2tp_eth_dev_recv()\n tcp: select(writefds) don\u0027t hang up when a peer close connection\n tcp: fix three tcp sysctls tuning\n tcp: Combat per-cpu skew in orphan tests.\n pxa168_eth: silence gcc warnings\n pxa168_eth: update call to phy_mii_ioctl()\n pxa168_eth: fix error handling in prope\n pxa168_eth: remove unneeded null check\n phylib: Fix race between returning phydev and calling adjust_link\n caif-driver: add HAS_DMA dependency\n 3c59x: Fix deadlock between boomerang_interrupt and boomerang_start_tx\n qlcnic: fix poll implementation\n netxen: fix poll implementation\n bridge: netfilter: fix a memory leak\n" } ], "next": "c34186ed008229e7f7e3f1de8e6acf6374995358" }