)]}' { "log": [ { "commit": "eabf5baaaaf41b6a0273043cfb06d53dca67acef", "tree": "d3af759bccd76ecb3b1f1b5ec027193051b55734", "parents": [ "cee6a5372f8804f58acc87f07816f64db36718e2" ], "author": { "name": "Fred Isaman", "email": "iisaman@netapp.com", "time": "Fri Feb 11 15:42:36 2011 +0000" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Fri Mar 11 15:38:40 2011 -0500" }, "message": "RPC: clarify rpc_run_task error handling\n\nrpc_run_task can only fail if it is not passed in a preallocated task.\nHowever, that is not at all clear with the current code. So\nremove several impossible to occur failure checks.\n\nSigned-off-by: Fred Isaman \u003ciisaman@netapp.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n" }, { "commit": "cee6a5372f8804f58acc87f07816f64db36718e2", "tree": "66e07d4404e95fe7abcf60a9c72286328dd6a07f", "parents": [ "f49f9baac8f63de9cbc17a0a84e04060496e8e76" ], "author": { "name": "Fred Isaman", "email": "iisaman@netapp.com", "time": "Fri Feb 11 15:42:35 2011 +0000" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Fri Mar 11 15:38:40 2011 -0500" }, "message": "RPC: remove check for impossible condition in rpc_make_runnable\n\nqueue_work() only returns 0 or 1, never a negative value.\n\nSigned-off-by: Fred Isaman \u003ciisaman@netapp.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n" }, { "commit": "4cea288aaf0e11647880cc487350b1dc45d9febc", "tree": "6ea19d6d0b7b833f39077941a795f83b81448b36", "parents": [ "3fa0b4e201d254b52a251fa348bd53e53000cff6" ], "author": { "name": "Ben Hutchings", "email": "bhutchings@solarflare.com", "time": "Tue Feb 22 21:54:34 2011 +0000" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Thu Mar 10 15:04:58 2011 -0500" }, "message": "sunrpc: Propagate errors from xs_bind() through xs_create_sock()\n\nxs_create_sock() is supposed to return a pointer or an ERR_PTR-encoded\nerror, but it currently returns 0 if xs_bind() fails.\n\nSigned-off-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nCc: stable@kernel.org [v2.6.37]\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n" }, { "commit": "a5e502681007779d4762fb3ef7e80a3ecd1cfe6b", "tree": "bfa3e8658e93fd8c64eff33cca5904c9f32ae055", "parents": [ "d2224e7afbf2a6556f4f8f25bc0e96d99ec4d2bd" ], "author": { "name": "Jesper Juhl", "email": "jj@chaosbits.net", "time": "Sat Jan 22 21:40:20 2011 +0000" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Thu Mar 10 15:04:54 2011 -0500" }, "message": "SUNRPC: Remove resource leak in svc_rdma_send_error()\n\nWe leak the memory allocated to \u0027ctxt\u0027 when we return after\n\u0027ib_dma_mapping_error()\u0027 returns !\u003d0.\n\nSigned-off-by: Jesper Juhl \u003cjj@chaosbits.net\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n" }, { "commit": "bf294b41cefcb22fc3139e0f42c5b3f06728bd5e", "tree": "250251c040a2d2e278b5a2ddd03c8d20a27be129", "parents": [ "214d93b02c4fe93638ad268613c9702a81ed9192" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Mon Feb 21 11:05:41 2011 -0800" }, "committer": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Thu Mar 10 15:04:52 2011 -0500" }, "message": "SUNRPC: Close a race in __rpc_wait_for_completion_task()\n\nAlthough they run as rpciod background tasks, under normal operation\n(i.e. no SIGKILL), functions like nfs_sillyrename(), nfs4_proc_unlck()\nand nfs4_do_close() want to be fully synchronous. This means that when we\nexit, we want all references to the rpc_task to be gone, and we want\nany dentry references etc. held by that task to be released.\n\nFor this reason these functions call __rpc_wait_for_completion_task(),\nfollowed by rpc_put_task() in the expectation that the latter will be\nreleasing the last reference to the rpc_task, and thus ensuring that the\ncallback_ops-\u003erpc_release() has been called synchronously.\n\nThis patch fixes a race which exists due to the fact that\nrpciod calls rpc_complete_task() (in order to wake up the callers of\n__rpc_wait_for_completion_task()) and then subsequently calls\nrpc_put_task() without ensuring that these two steps are done atomically.\n\nIn order to avoid adding new spin locks, the patch uses the existing\nwaitqueue spin lock to order the rpc_task reference count releases between\nthe waiting process and rpciod.\nThe common case where nobody is waiting for completion is optimised for by\nchecking if the RPC_TASK_ASYNC flag is cleared and/or if the rpc_task\nreference count is 1: in those cases we drop trying to grab the spin lock,\nand immediately free up the rpc_task.\n\nThose few processes that need to put the rpc_task from inside an\nasynchronous context and that do not care about ordering are given a new\nhelper: rpc_put_task_async().\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\n" }, { "commit": "fb62c00a6d8942775abc23d1621db1252e2d93d1", "tree": "ef8760123f5a2b692126ecb7a70f2689053885c1", "parents": [ "5c4b4be3b6b937256103a5ae49177e0c3a17cb8f", "455cec0abff563574cca432ced49f734117ca113" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 05 10:43:22 2011 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 05 10:43:22 2011 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:\n ceph: no .snap inside of snapped namespace\n libceph: fix msgr standby handling\n libceph: fix msgr keepalive flag\n libceph: fix msgr backoff\n libceph: retry after authorization failure\n libceph: fix handling of short returns from get_user_pages\n ceph: do not clear I_COMPLETE from d_release\n ceph: do not set I_COMPLETE\n Revert \"ceph: keep reference to parent inode on ceph_dentry\"\n" }, { "commit": "e00de341fdb76c955703b4438100f9933c452b7f", "tree": "ab776a5e46f1cb5acaa6b26484763259040f470c", "parents": [ "e76661d0a59e53e5cc4dccbe4b755d1dc8a968ec" ], "author": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Fri Mar 04 12:25:05 2011 -0800" }, "committer": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Fri Mar 04 12:25:05 2011 -0800" }, "message": "libceph: fix msgr standby handling\n\nThe standby logic used to be pretty dependent on the work requeueing\nbehavior that changed when we switched to WQ_NON_REENTRANT. It was also\nvery fragile.\n\nRestructure things so that:\n - We clear WRITE_PENDING when we set STANDBY. This ensures we will\n requeue work when we wake up later.\n - con_work backs off if STANDBY is set. There is nothing to do if we are\n in standby.\n - clear_standby() helper is called by both con_send() and con_keepalive(),\n the two actions that can wake us up again. Move the connect_seq++\n logic here.\n\nSigned-off-by: Sage Weil \u003csage@newdream.net\u003e\n" }, { "commit": "e76661d0a59e53e5cc4dccbe4b755d1dc8a968ec", "tree": "371ed08c5d00dbcdcf6f18e5cf36d798bcc51180", "parents": [ "60bf8bf8815e6adea4c1d0423578c3b8000e2ec8" ], "author": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Thu Mar 03 10:10:15 2011 -0800" }, "committer": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Fri Mar 04 12:24:31 2011 -0800" }, "message": "libceph: fix msgr keepalive flag\n\nThere was some broken keepalive code using a dead variable. Shift to using\nthe proper bit flag.\n\nSigned-off-by: Sage Weil \u003csage@newdream.net\u003e\n" }, { "commit": "60bf8bf8815e6adea4c1d0423578c3b8000e2ec8", "tree": "ce7140c32a3f177816f4029a88eb99e15bda6943", "parents": [ "692d20f576fb26f62c83f80dbf3ea899998391b7" ], "author": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Fri Mar 04 12:24:28 2011 -0800" }, "committer": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Fri Mar 04 12:24:28 2011 -0800" }, "message": "libceph: fix msgr backoff\n\nWith commit f363e45f we replaced a bunch of hacky workqueue mutual\nexclusion logic with the WQ_NON_REENTRANT flag. One pieces of fallout is\nthat the exponential backoff breaks in certain cases:\n\n * con_work attempts to connect.\n * we get an immediate failure, and the socket state change handler queues\n immediate work.\n * con_work calls con_fault, we decide to back off, but can\u0027t queue delayed\n work.\n\nIn this case, we add a BACKOFF bit to make con_work reschedule delayed work\nnext time it runs (which should be immediately).\n\nSigned-off-by: Sage Weil \u003csage@newdream.net\u003e\n" }, { "commit": "b65a0e0c84cf489bfa00d6aa6c48abc5a237100f", "tree": "3ed9d7b094e003a7b0d98234cb5b490d671bf3a9", "parents": [ "4438a02fc4956f5f61918095708f183f5c63a9d3", "1362fa078dae16776cd439791c6605b224ea6171" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 03 15:48:01 2011 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 03 15:48:01 2011 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:\n DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]\n" }, { "commit": "4438a02fc4956f5f61918095708f183f5c63a9d3", "tree": "cc37b89534e3679d8e4e9c95935d040758a9de74", "parents": [ "fb4b10ab5fadcf5012983e4306aec3131b808b1b", "4cd72c6e72e8a36a975decb53d70086008f386db" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 03 15:43:15 2011 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 03 15:43:15 2011 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits)\n MAINTAINERS: Add Andy Gospodarek as co-maintainer.\n r8169: disable ASPM\n RxRPC: Fix v1 keys\n AF_RXRPC: Handle receiving ACKALL packets\n cnic: Fix lost interrupt on bnx2x\n cnic: Prevent status block race conditions with hardware\n net: dcbnl: check correct ops in dcbnl_ieee_set()\n e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead\n igb: fix sparse warning\n e1000: fix sparse warning\n netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values\n dccp: fix oops on Reset after close\n ipvs: fix dst_lock locking on dest update\n davinci_emac: Add Carrier Link OK check in Davinci RX Handler\n bnx2x: update driver version to 1.62.00-6\n bnx2x: properly calculate lro_mss\n bnx2x: perform statistics \"action\" before state transition.\n bnx2x: properly configure coefficients for MinBW algorithm (NPAR mode).\n bnx2x: Fix ethtool -t link test for MF (non-pmf) devices.\n bnx2x: Fix nvram test for single port devices.\n ...\n" }, { "commit": "1362fa078dae16776cd439791c6605b224ea6171", "tree": "76738a2137f8dd2e0064d8e74ff4c6e72def2e05", "parents": [ "dd9c1549edef02290edced639f67b54a25abbe0e" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Mar 03 11:28:58 2011 +0000" }, "committer": { "name": "James Morris", "email": "jmorris@namei.org", "time": "Fri Mar 04 09:56:19 2011 +1100" }, "message": "DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]\n\nWhen a DNS resolver key is instantiated with an error indication, attempts to\nread that key will result in an oops because user_read() is expecting there to\nbe a payload - and there isn\u0027t one [CVE-2011-1076].\n\nGive the DNS resolver key its own read handler that returns the error cached in\nkey-\u003etype_data.x[0] as an error rather than crashing.\n\nAlso make the kenter() at the beginning of dns_resolver_instantiate() limit the\namount of data it prints, since the data is not necessarily NUL-terminated.\n\nThe buggy code was added in:\n\n\tcommit 4a2d789267e00b5a1175ecd2ddefcc78b83fbf09\n\tAuthor: Wang Lei \u003cwang840925@gmail.com\u003e\n\tDate: Wed Aug 11 09:37:58 2010 +0100\n\tSubject: DNS: If the DNS server returns an error, allow that to be cached [ver #2]\n\nThis can trivially be reproduced by any user with the following program\ncompiled with -lkeyutils:\n\n\t#include \u003cstdlib.h\u003e\n\t#include \u003ckeyutils.h\u003e\n\t#include \u003cerr.h\u003e\n\tstatic char payload[] \u003d \"#dnserror\u003d6\";\n\tint main()\n\t{\n\t\tkey_serial_t key;\n\t\tkey \u003d add_key(\"dns_resolver\", \"a\", payload, sizeof(payload),\n\t\t\t KEY_SPEC_SESSION_KEYRING);\n\t\tif (key \u003d\u003d -1)\n\t\t\terr(1, \"add_key\");\n\t\tif (keyctl_read(key, NULL, 0) \u003d\u003d -1)\n\t\t\terr(1, \"read_key\");\n\t\treturn 0;\n\t}\n\nWhat should happen is that keyctl_read() reports error 6 (ENXIO) to the user:\n\n\tdns-break: read_key: No such device or address\n\nbut instead the kernel oopses.\n\nThis cannot be reproduced with the \u0027keyutils add\u0027 or \u0027keyutils padd\u0027 commands\nas both of those cut the data down below the NUL termination that must be\nincluded in the data. Without this dns_resolver_instantiate() will return\n-EINVAL and the key will not be instantiated such that it can be read.\n\nThe oops looks like:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\nIP: [\u003cffffffff811b99f7\u003e] user_read+0x4f/0x8f\nPGD 3bdf8067 PUD 385b9067 PMD 0\nOops: 0000 [#1] SMP\nlast sysfs file: /sys/devices/pci0000:00/0000:00:19.0/irq\nCPU 0\nModules linked in:\n\nPid: 2150, comm: dns-break Not tainted 2.6.38-rc7-cachefs+ #468 /DG965RY\nRIP: 0010:[\u003cffffffff811b99f7\u003e] [\u003cffffffff811b99f7\u003e] user_read+0x4f/0x8f\nRSP: 0018:ffff88003bf47f08 EFLAGS: 00010246\nRAX: 0000000000000001 RBX: ffff88003b5ea378 RCX: ffffffff81972368\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003b5ea378\nRBP: ffff88003bf47f28 R08: ffff88003be56620 R09: 0000000000000000\nR10: 0000000000000395 R11: 0000000000000002 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: ffffffffffffffa1\nFS: 00007feab5751700(0000) GS:ffff88003e000000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000010 CR3: 000000003de40000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nProcess dns-break (pid: 2150, threadinfo ffff88003bf46000, task ffff88003be56090)\nStack:\n ffff88003b5ea378 ffff88003b5ea3a0 0000000000000000 0000000000000000\n ffff88003bf47f68 ffffffff811b708e ffff88003c442bc8 0000000000000000\n 00000000004005a0 00007fffba368060 0000000000000000 0000000000000000\nCall Trace:\n [\u003cffffffff811b708e\u003e] keyctl_read_key+0xac/0xcf\n [\u003cffffffff811b7c07\u003e] sys_keyctl+0x75/0xb6\n [\u003cffffffff81001f7b\u003e] system_call_fastpath+0x16/0x1b\nCode: 75 1f 48 83 7b 28 00 75 18 c6 05 58 2b fb 00 01 be bb 00 00 00 48 c7 c7 76 1c 75 81 e8 13 c2 e9 ff 4c 8b b3 e0 00 00 00 4d 85 ed \u003c41\u003e 0f b7 5e 10 74 2d 4d 85 e4 74 28 e8 98 79 ee ff 49 39 dd 48\nRIP [\u003cffffffff811b99f7\u003e] user_read+0x4f/0x8f\n RSP \u003cffff88003bf47f08\u003e\nCR2: 0000000000000010\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Jeff Layton \u003cjlayton@redhat.com\u003e\ncc: Wang Lei \u003cwang840925@gmail.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n" }, { "commit": "692d20f576fb26f62c83f80dbf3ea899998391b7", "tree": "91b3d1984b2986ea99c2b208de6dc65f1a74c701", "parents": [ "38815b780285a4957852c5c9dbe94991c0b26c56" ], "author": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Thu Mar 03 12:14:53 2011 -0800" }, "committer": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Thu Mar 03 13:47:40 2011 -0800" }, "message": "libceph: retry after authorization failure\n\nIf we mark the connection CLOSED we will give up trying to reconnect to\nthis server instance. That is appropriate for things like a protocol\nversion mismatch that won\u0027t change until the server is restarted, at which\npoint we\u0027ll get a new addr and reconnect. An authorization failure like\nthis is probably due to the server not properly rotating it\u0027s secret keys,\nhowever, and should be treated as transient so that the normal backoff and\nretry behavior kicks in.\n\nSigned-off-by: Sage Weil \u003csage@newdream.net\u003e\n" }, { "commit": "38815b780285a4957852c5c9dbe94991c0b26c56", "tree": "032d882544ef73d2e99208de7a6e6340df3d31ea", "parents": [ "16a8b70a5a757db513f036bbcc73309f6c507d81" ], "author": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Wed Mar 02 16:55:21 2011 -0800" }, "committer": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Thu Mar 03 13:47:39 2011 -0800" }, "message": "libceph: fix handling of short returns from get_user_pages\n\nget_user_pages() can return fewer pages than we ask for. We were returning\na bogus pointer/error code in that case. Instead, loop until we get all\nthe pages we want or get an error we can return to the caller.\n\nSigned-off-by: Sage Weil \u003csage@newdream.net\u003e\n" }, { "commit": "10003453479ef287a73f8a39593f8f42687ea565", "tree": "c66b9be08673889103a60e3a458a850cc5477546", "parents": [ "0197b087ed6384760656f1e4a620a3e92d8dc0b0" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon Feb 28 03:27:43 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Mar 02 22:18:52 2011 -0800" }, "message": "AF_RXRPC: Handle receiving ACKALL packets\n\nThe OpenAFS server is now sending ACKALL packets, so we need to handle them.\nOtherwise we report a protocol error and abort.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f3d7bc57c71eba3f279785111bb473b1ef68dcb6", "tree": "c6a67621f6fcc5372c6d5c0d355c02a32b43621c", "parents": [ "88d2d28b182dc3f38e68259efaa6dd3bc40ef1e6" ], "author": { "name": "John Fastabend", "email": "john.r.fastabend@intel.com", "time": "Wed Mar 02 10:35:33 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Mar 02 15:04:33 2011 -0800" }, "message": "net: dcbnl: check correct ops in dcbnl_ieee_set()\n\nThe incorrect ops routine was being tested for in\nDCB_ATTR_IEEE_PFC attributes. This patch corrects\nit.\n\nCurrently, every driver implementing ieee_setets also\nimplements ieee_setpfc so this bug is not actualized\nyet.\n\nSigned-off-by: John Fastabend \u003cjohn.r.fastabend@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "88d2d28b182dc3f38e68259efaa6dd3bc40ef1e6", "tree": "285bb300f799a11bdf7db664d0d2517a9bd89ece", "parents": [ "720dc34bbbe9493c7bd48b2243058b4e447a929d", "9ef0298a8e5730d9a46d640014c727f3b4152870" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Mar 02 11:29:31 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Mar 02 11:29:31 2011 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6\n" }, { "commit": "9ef0298a8e5730d9a46d640014c727f3b4152870", "tree": "d5c676b9a9c79bc29cf1af6b8a56a471177993a6", "parents": [ "ff75f40f44ae9b79d520bf32a05d35af74a805c0" ], "author": { "name": "Jan Engelhardt", "email": "jengelh@medozas.de", "time": "Wed Mar 02 12:10:13 2011 +0100" }, "committer": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Wed Mar 02 12:10:13 2011 +0100" }, "message": "netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values\n\nLike many other places, we have to check that the array index is\nwithin allowed limits, or otherwise, a kernel oops and other nastiness\ncan ensue when we access memory beyond the end of the array.\n\n[ 5954.115381] BUG: unable to handle kernel paging request at 0000004000000000\n[ 5954.120014] IP: __find_logger+0x6f/0xa0\n[ 5954.123979] nf_log_bind_pf+0x2b/0x70\n[ 5954.123979] nfulnl_recv_config+0xc0/0x4a0 [nfnetlink_log]\n[ 5954.123979] nfnetlink_rcv_msg+0x12c/0x1b0 [nfnetlink]\n...\n\nThe problem goes back to v2.6.30-rc1~1372~1342~31 where nf_log_bind\nwas decoupled from nf_log_register.\n\nReported-by: Miguel Di Ciurcio Filho \u003cmiguel.filho@gmail.com\u003e,\n via irc.freenode.net/#netfilter\nSigned-off-by: Jan Engelhardt \u003cjengelh@medozas.de\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\n" }, { "commit": "720dc34bbbe9493c7bd48b2243058b4e447a929d", "tree": "1c99c2d5018e2cfc7f4eb6721f57d5ae144abb56", "parents": [ "6ea25a6c2b95cf916e844fe2bacdd1c15b72e4c5" ], "author": { "name": "Gerrit Renker", "email": "gerrit@erg.abdn.ac.uk", "time": "Tue Mar 01 23:02:07 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 01 23:02:07 2011 -0800" }, "message": "dccp: fix oops on Reset after close\n\nThis fixes a bug in the order of dccp_rcv_state_process() that still permitted\nreception even after closing the socket. A Reset after close thus causes a NULL\npointer dereference by not preventing operations on an already torn-down socket.\n\n dccp_v4_do_rcv() \n\t|\n\t| state other than OPEN\n\tv\n dccp_rcv_state_process()\n\t|\n\t| DCCP_PKT_RESET\n\tv\n dccp_rcv_reset()\n\t|\n\tv\n dccp_time_wait()\n\n WARNING: at net/ipv4/inet_timewait_sock.c:141 __inet_twsk_hashdance+0x48/0x128()\n Modules linked in: arc4 ecb carl9170 rt2870sta(C) mac80211 r8712u(C) crc_ccitt ah\n [\u003cc0038850\u003e] (unwind_backtrace+0x0/0xec) from [\u003cc0055364\u003e] (warn_slowpath_common)\n [\u003cc0055364\u003e] (warn_slowpath_common+0x4c/0x64) from [\u003cc0055398\u003e] (warn_slowpath_n)\n [\u003cc0055398\u003e] (warn_slowpath_null+0x1c/0x24) from [\u003cc02b72d0\u003e] (__inet_twsk_hashd)\n [\u003cc02b72d0\u003e] (__inet_twsk_hashdance+0x48/0x128) from [\u003cc031caa0\u003e] (dccp_time_wai)\n [\u003cc031caa0\u003e] (dccp_time_wait+0x40/0xc8) from [\u003cc031c15c\u003e] (dccp_rcv_state_proces)\n [\u003cc031c15c\u003e] (dccp_rcv_state_process+0x120/0x538) from [\u003cc032609c\u003e] (dccp_v4_do_)\n [\u003cc032609c\u003e] (dccp_v4_do_rcv+0x11c/0x14c) from [\u003cc0286594\u003e] (release_sock+0xac/0)\n [\u003cc0286594\u003e] (release_sock+0xac/0x110) from [\u003cc031fd34\u003e] (dccp_close+0x28c/0x380)\n [\u003cc031fd34\u003e] (dccp_close+0x28c/0x380) from [\u003cc02d9a78\u003e] (inet_release+0x64/0x70)\n\nThe fix is by testing the socket state first. Receiving a packet in Closed state\nnow also produces the required \"No connection\" Reset reply of RFC 4340, 8.3.1.\n\nReported-and-tested-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nCc: stable@kernel.org\nSigned-off-by: Gerrit Renker \u003cgerrit@erg.abdn.ac.uk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ff75f40f44ae9b79d520bf32a05d35af74a805c0", "tree": "ec3dc42c3a95c5482569956b9be4503ef0e46259", "parents": [ "0af320fb4627033e49cbc6e8138e7aa75ab8352a" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Tue Feb 22 10:40:25 2011 +0200" }, "committer": { "name": "Simon Horman", "email": "horms@verge.net.au", "time": "Wed Mar 02 07:54:41 2011 +0900" }, "message": "ipvs: fix dst_lock locking on dest update\n\n\tFix dst_lock usage in __ip_vs_update_dest. We need\n_bh locking because destination is updated in user context.\nCan cause lockups on frequent destination updates.\nProblem reported by Simon Kirby. Bug was introduced\nin 2.6.37 from the \"ipvs: changes for local real server\"\nchange.\n\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Hans Schillstrom \u003chans@schillstrom.com\u003e\nSigned-off-by: Simon Horman \u003chorms@verge.net.au\u003e\n" }, { "commit": "b44d211e166b4b0dae8ce379f9d2e3ac164b5b60", "tree": "1af9b2e472f35813e0fb99d183a6610a90bf7195", "parents": [ "dad3d44dcb054e9d0514fbf65ee4a2d88cf1698f" ], "author": { "name": "Andrey Vagin", "email": "avagin@openvz.org", "time": "Mon Feb 21 02:40:47 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 28 12:18:12 2011 -0800" }, "message": "netlink: handle errors from netlink_dump()\n\nnetlink_dump() may failed, but nobody handle its error.\nIt generates output data, when a previous portion has been returned to\nuser space. This mechanism works when all data isn\u0027t go in skb. If we\nenter in netlink_recvmsg() and skb is absent in the recv queue, the\nnetlink_dump() will not been executed. So if netlink_dump() is failed\none time, the new data never appear and the reader will sleep forever.\n\nnetlink_dump() is called from two places:\n\n1. from netlink_sendmsg-\u003e...-\u003enetlink_dump_start().\n In this place we can report error directly and it will be returned\n by sendmsg().\n\n2. from netlink_recvmsg\n There we can\u0027t report error directly, because we have a portion of\n valid output data and call netlink_dump() for prepare the next portion.\n If netlink_dump() is failed, the socket will be mark as error and the\n next recvmsg will be failed.\n\nSigned-off-by: Andrey Vagin \u003cavagin@openvz.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5aca1a9e880e06bb7e5fd553a86a330ae7e218b5", "tree": "172cf3642ba7e64883e5ba8df0a4d22a56eb8083", "parents": [ "c486da34390846b430896a407b47f0cea3a4189c" ], "author": { "name": "Hagen Paul Pfeifer", "email": "hagen@jauu.net", "time": "Fri Feb 25 13:58:54 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 25 13:58:54 2011 -0800" }, "message": "net: handle addr_type of 0 properly\n\naddr_type of 0 means that the type should be adopted from from_dev and\nnot from __hw_addr_del_multiple(). Unfortunately it isn\u0027t so and\naddr_type will always be considered. Fix this by implementing the\nconsidered and documented behavior.\n\nSigned-off-by: Hagen Paul Pfeifer \u003chagen@jauu.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0a93ea2e897bd793cc0aaaddc397eff32ac8d6fe", "tree": "60fd9c282565e803e6d022e7166db34818a33bef", "parents": [ "f129ccc9231c95513a1227ca9da876beeb03e577" ], "author": { "name": "Anton Blanchard", "email": "anton@samba.org", "time": "Fri Feb 25 15:33:17 2011 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 25 11:12:37 2011 -0800" }, "message": "RxRPC: Allocate tokens with kzalloc to avoid oops in rxrpc_destroy\n\nWith slab poisoning enabled, I see the following oops:\n\n Unable to handle kernel paging request for data at address 0x6b6b6b6b6b6b6b73\n ...\n NIP [c0000000006bc61c] .rxrpc_destroy+0x44/0x104\n LR [c0000000006bc618] .rxrpc_destroy+0x40/0x104\n Call Trace:\n [c0000000feb2bc00] [c0000000006bc618] .rxrpc_destroy+0x40/0x104 (unreliable)\n [c0000000feb2bc90] [c000000000349b2c] .key_cleanup+0x1a8/0x20c\n [c0000000feb2bd40] [c0000000000a2920] .process_one_work+0x2f4/0x4d0\n [c0000000feb2be00] [c0000000000a2d50] .worker_thread+0x254/0x468\n [c0000000feb2bec0] [c0000000000a868c] .kthread+0xbc/0xc8\n [c0000000feb2bf90] [c000000000020e00] .kernel_thread+0x54/0x70\n\nWe aren\u0027t initialising token-\u003enext, but the code in destroy_context relies\non the list being NULL terminated. Use kzalloc to zero out all the fields.\n\nSigned-off-by: Anton Blanchard \u003canton@samba.org\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c486da34390846b430896a407b47f0cea3a4189c", "tree": "2df7eb05f91354e0dc0468ed884326b121f76686", "parents": [ "cdf64c803e6cfec72259f7bb2654261584bb80a8" ], "author": { "name": "Lucian Adrian Grijincu", "email": "lucian.grijincu@gmail.com", "time": "Thu Feb 24 19:48:03 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 25 11:01:56 2011 -0800" }, "message": "sysctl: ipv6: use correct net in ipv6_sysctl_rtcache_flush\n\nBefore this patch issuing these commands:\n\n fd \u003d open(\"/proc/sys/net/ipv6/route/flush\")\n unshare(CLONE_NEWNET)\n write(fd, \"stuff\")\n\nwould flush the newly created net, not the original one.\n\nThe equivalent ipv4 code is correct (stores the net inside -\u003eextra1).\nAcked-by: Daniel Lezcano \u003cdaniel.lezcano@free.fr\u003e\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ef3242859fae47e728b50b7ce3d17b201a71779a", "tree": "7857320b5209cafc231b329b9dab67ddb53f8128", "parents": [ "b5f7376eb30538d03dd27f6a59b5b2d28587967c", "518d020a18716024187ee0b834c8f5bfebd59398" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 23 16:02:00 2011 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 23 16:02:00 2011 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (33 commits)\n Added support for usb ethernet (0x0fe6, 0x9700)\n r8169: fix RTL8168DP power off issue.\n r8169: correct settings of rtl8102e.\n r8169: fix incorrect args to oob notify.\n DM9000B: Fix PHY power for network down/up\n DM9000B: Fix reg_save after spin_lock in dm9000_timeout\n net_sched: long word align struct qdisc_skb_cb data\n sfc: lower stack usage in efx_ethtool_self_test\n bridge: Use IPv6 link-local address for multicast listener queries\n bridge: Fix MLD queries\u0027 ethernet source address\n bridge: Allow mcast snooping for transient link local addresses too\n ipv6: Add IPv6 multicast address flag defines\n bridge: Add missing ntohs()s for MLDv2 report parsing\n bridge: Fix IPv6 multicast snooping by correcting offset in MLDv2 report\n bridge: Fix IPv6 multicast snooping by storing correct protocol type\n p54pci: update receive dma buffers before and after processing\n fix cfg80211_wext_siwfreq lock ordering...\n rt2x00: Fix WPA TKIP Michael MIC failures.\n ath5k: Fix fast channel switching\n tcp: undo_retrans counter fixes\n ...\n" }, { "commit": "d3bd1b4c89cceca42211cd5bd30508b903267229", "tree": "ab3459496e3c9d8b1904b440b1a19c72ff23b3f0", "parents": [ "28801f351f76231e8d1e378274d6d56a577b897e", "0bf719dfdecc5552155cbec78e49fa06e531e35c" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 22 11:53:05 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 22 11:53:05 2011 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "fe29ec41aaa51902aebd63658dfb04fe6fea8be5", "tree": "c9325f8cb76331c307b39d1348f8d668dfdfbc58", "parents": [ "36cff5a10c6b003fa2d0464848d5664b2bf723e0" ], "author": { "name": "Linus Lüssing", "email": "linus.luessing@web.de", "time": "Thu Feb 17 08:17:52 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 22 10:07:29 2011 -0800" }, "message": "bridge: Use IPv6 link-local address for multicast listener queries\n\nCurrently the bridge multicast snooping feature periodically issues\nIPv6 general multicast listener queries to sense the absence of a\nlistener.\n\nFor this, it uses :: as its source address - however RFC 2710 requires:\n\"To be valid, the Query message MUST come from a link-local IPv6 Source\nAddress\". Current Linux kernel versions seem to follow this requirement\nand ignore our bogus MLD queries.\n\nWith this commit a link local address from the bridge interface is being\nused to issue the MLD query, resulting in other Linux devices which are\nmulticast listeners in the network to respond with a MLD response (which\nwas not the case before).\n\nSigned-off-by: Linus Lüssing \u003clinus.luessing@web.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "36cff5a10c6b003fa2d0464848d5664b2bf723e0", "tree": "3c7bbed26f620254a680329600b658746c3c83fc", "parents": [ "e4de9f9e8333fbbae951c6e068f501f955123cf0" ], "author": { "name": "Linus Lüssing", "email": "linus.luessing@web.de", "time": "Thu Feb 17 08:17:51 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 22 10:07:28 2011 -0800" }, "message": "bridge: Fix MLD queries\u0027 ethernet source address\n\nMap the IPv6 header\u0027s destination multicast address to an ethernet\nsource address instead of the MLD queries multicast address.\n\nFor instance for a general MLD query (multicast address in the MLD query\nset to ::), this would wrongly be mapped to 33:33:00:00:00:00, although\nan MLD queries destination MAC should always be 33:33:00:00:00:01 which\nmatches the IPv6 header\u0027s multicast destination ff02::1.\n\nSigned-off-by: Linus Lüssing \u003clinus.luessing@web.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e4de9f9e8333fbbae951c6e068f501f955123cf0", "tree": "b3b09d3d6510f57724c599246f2bbe08451f8165", "parents": [ "5ced1339612d1fa095459bd481f1d1f64f76f859" ], "author": { "name": "Linus Lüssing", "email": "linus.luessing@web.de", "time": "Tue Feb 15 13:19:21 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 22 10:07:28 2011 -0800" }, "message": "bridge: Allow mcast snooping for transient link local addresses too\n\nCurrently the multicast bridge snooping support is not active for\nlink local multicast. I assume this has been done to leave\nimportant multicast data untouched, like IPv6 Neighborhood Discovery.\n\nIn larger, bridged, local networks it could however be desirable to\noptimize for instance local multicast audio/video streaming too.\n\nWith the transient flag in IPv6 multicast addresses we have an easy\nway to optimize such multimedia traffic without tempering with the\nhigh priority multicast data from well-known addresses.\n\nThis patch alters the multicast bridge snooping for IPv6, to take\neffect for transient multicast addresses instead of non-link-local\naddresses.\n\nSigned-off-by: Linus Lüssing \u003clinus.luessing@web.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d41db9f3f71548f07b8b6d81a88220d0035b04f6", "tree": "14d56a73bccb0fdc6a00a79809fec94697817f6d", "parents": [ "649e984d00416cb1a254fdbebd6d3f9fa01c32fa" ], "author": { "name": "Linus Lüssing", "email": "linus.luessing@web.de", "time": "Tue Feb 15 13:19:19 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 22 10:07:27 2011 -0800" }, "message": "bridge: Add missing ntohs()s for MLDv2 report parsing\n\nThe nsrcs number is 2 Byte wide, therefore we need to call ntohs()\nbefore using it.\n\nSigned-off-by: Linus Lüssing \u003clinus.luessing@web.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "649e984d00416cb1a254fdbebd6d3f9fa01c32fa", "tree": "f55db589cf188c833680f64622a6baee407e78ca", "parents": [ "9cc6e0c4c457f84bedcfb04e7dd58a36909c4ef7" ], "author": { "name": "Linus Lüssing", "email": "linus.luessing@web.de", "time": "Tue Feb 15 13:19:18 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 22 10:07:26 2011 -0800" }, "message": "bridge: Fix IPv6 multicast snooping by correcting offset in MLDv2 report\n\nWe actually want a pointer to the grec_nsrcr and not the following\nfield. Otherwise we can get very high values for *nsrcs as the first two\nbytes of the IPv6 multicast address are being used instead, leading to\na failing pskb_may_pull() which results in MLDv2 reports not being\nparsed.\n\nSigned-off-by: Linus Lüssing \u003clinus.luessing@web.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9cc6e0c4c457f84bedcfb04e7dd58a36909c4ef7", "tree": "e0a1dc5eba3ce25e8f1cf0b3b78a60314ee80975", "parents": [ "c24f691b56107feeba076616982093ee2d3c8fb5" ], "author": { "name": "Linus Lüssing", "email": "linus.luessing@web.de", "time": "Tue Feb 15 13:19:17 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 22 10:07:26 2011 -0800" }, "message": "bridge: Fix IPv6 multicast snooping by storing correct protocol type\n\nThe protocol type for IPv6 entries in the hash table for multicast\nbridge snooping is falsely set to ETH_P_IP, marking it as an IPv4\naddress, instead of setting it to ETH_P_IPV6, which results in negative\nlook-ups in the hash table later.\n\nSigned-off-by: Linus Lüssing \u003clinus.luessing@web.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8bd89ca22010847e85de37b77d9f19f16b1962ad", "tree": "0bcee2ae6a85443177a6d95ed960301e0f4c9d57", "parents": [ "b08b69a110bd981909c248f89997dcdcdfd5a39c", "97d79b403ef03f729883246208ef5d8a2ebc4d68" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Feb 21 15:01:38 2011 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Feb 21 15:01:38 2011 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:\n ceph: keep reference to parent inode on ceph_dentry\n ceph: queue cap_snaps once per realm\n libceph: fix socket write error handling\n libceph: fix socket read error handling\n" }, { "commit": "4f919a3bc54da01db829c520ce4b1fabfde1c3f7", "tree": "967b25b61b7e0afc261b6c79fe75f3f31644be1b", "parents": [ "a866a2cc1c558089dd4c627eeb300142b1354474" ], "author": { "name": "Daniel J Blueman", "email": "daniel.blueman@gmail.com", "time": "Tue Feb 22 00:11:06 2011 +0800" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Feb 21 15:14:25 2011 -0500" }, "message": "fix cfg80211_wext_siwfreq lock ordering...\n\nI previously managed to reproduce a hang while scanning wireless\nchannels (reproducible with airodump-ng hopping channels); subsequent\nlockdep instrumentation revealed a lock ordering issue.\n\nWithout knowing the design intent, it looks like the locks should be\ntaken in reverse order; please comment.\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ INFO: possible circular locking dependency detected ]\n2.6.38-rc5-341cd #4\n-------------------------------------------------------\nairodump-ng/15445 is trying to acquire lock:\n (\u0026rdev-\u003edevlist_mtx){+.+.+.}, at: [\u003cffffffff816b1266\u003e]\ncfg80211_wext_siwfreq+0xc6/0x100\n\nbut task is already holding lock:\n (\u0026wdev-\u003emtx){+.+.+.}, at: [\u003cffffffff816b125c\u003e] cfg80211_wext_siwfreq+0xbc/0x100\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #1 (\u0026wdev-\u003emtx){+.+.+.}:\n [\u003cffffffff810a79d6\u003e] lock_acquire+0xc6/0x280\n [\u003cffffffff816d6bce\u003e] mutex_lock_nested+0x6e/0x4b0\n [\u003cffffffff81696080\u003e] cfg80211_netdev_notifier_call+0x430/0x5f0\n [\u003cffffffff8109351b\u003e] notifier_call_chain+0x8b/0x100\n [\u003cffffffff810935b1\u003e] raw_notifier_call_chain+0x11/0x20\n [\u003cffffffff81576d92\u003e] call_netdevice_notifiers+0x32/0x60\n [\u003cffffffff815771a4\u003e] __dev_notify_flags+0x34/0x80\n [\u003cffffffff81577230\u003e] dev_change_flags+0x40/0x70\n [\u003cffffffff8158587c\u003e] do_setlink+0x1fc/0x8d0\n [\u003cffffffff81586042\u003e] rtnl_setlink+0xf2/0x140\n [\u003cffffffff81586923\u003e] rtnetlink_rcv_msg+0x163/0x270\n [\u003cffffffff8159d741\u003e] netlink_rcv_skb+0xa1/0xd0\n [\u003cffffffff815867b0\u003e] rtnetlink_rcv+0x20/0x30\n [\u003cffffffff8159d39a\u003e] netlink_unicast+0x2ba/0x300\n [\u003cffffffff8159dd57\u003e] netlink_sendmsg+0x267/0x3e0\n [\u003cffffffff8155e364\u003e] sock_sendmsg+0xe4/0x110\n [\u003cffffffff8155f3a3\u003e] sys_sendmsg+0x253/0x3b0\n [\u003cffffffff81003192\u003e] system_call_fastpath+0x16/0x1b\n\n-\u003e #0 (\u0026rdev-\u003edevlist_mtx){+.+.+.}:\n [\u003cffffffff810a7222\u003e] __lock_acquire+0x1622/0x1d10\n [\u003cffffffff810a79d6\u003e] lock_acquire+0xc6/0x280\n [\u003cffffffff816d6bce\u003e] mutex_lock_nested+0x6e/0x4b0\n [\u003cffffffff816b1266\u003e] cfg80211_wext_siwfreq+0xc6/0x100\n [\u003cffffffff816b2fad\u003e] ioctl_standard_call+0x5d/0xd0\n [\u003cffffffff816b3223\u003e] T.808+0x163/0x170\n [\u003cffffffff816b326a\u003e] wext_handle_ioctl+0x3a/0x90\n [\u003cffffffff815798d2\u003e] dev_ioctl+0x6f2/0x830\n [\u003cffffffff8155cf3d\u003e] sock_ioctl+0xfd/0x290\n [\u003cffffffff8117dffd\u003e] do_vfs_ioctl+0x9d/0x590\n [\u003cffffffff8117e53a\u003e] sys_ioctl+0x4a/0x80\n [\u003cffffffff81003192\u003e] system_call_fastpath+0x16/0x1b\n\nother info that might help us debug this:\n\n2 locks held by airodump-ng/15445:\n #0: (rtnl_mutex){+.+.+.}, at: [\u003cffffffff81586782\u003e] rtnl_lock+0x12/0x20\n #1: (\u0026wdev-\u003emtx){+.+.+.}, at: [\u003cffffffff816b125c\u003e]\ncfg80211_wext_siwfreq+0xbc/0x100\n\nstack backtrace:\nPid: 15445, comm: airodump-ng Not tainted 2.6.38-rc5-341cd #4\nCall Trace:\n [\u003cffffffff810a3f0a\u003e] ? print_circular_bug+0xfa/0x100\n [\u003cffffffff810a7222\u003e] ? __lock_acquire+0x1622/0x1d10\n [\u003cffffffff810a1f99\u003e] ? trace_hardirqs_off_caller+0x29/0xc0\n [\u003cffffffff810a79d6\u003e] ? lock_acquire+0xc6/0x280\n [\u003cffffffff816b1266\u003e] ? cfg80211_wext_siwfreq+0xc6/0x100\n [\u003cffffffff810a31d7\u003e] ? mark_held_locks+0x67/0x90\n [\u003cffffffff816d6bce\u003e] ? mutex_lock_nested+0x6e/0x4b0\n [\u003cffffffff816b1266\u003e] ? cfg80211_wext_siwfreq+0xc6/0x100\n [\u003cffffffff810a31d7\u003e] ? mark_held_locks+0x67/0x90\n [\u003cffffffff816b1266\u003e] ? cfg80211_wext_siwfreq+0xc6/0x100\n [\u003cffffffff816b1266\u003e] ? cfg80211_wext_siwfreq+0xc6/0x100\n [\u003cffffffff816b2fad\u003e] ? ioctl_standard_call+0x5d/0xd0\n [\u003cffffffff8157818b\u003e] ? __dev_get_by_name+0x9b/0xc0\n [\u003cffffffff816b2f50\u003e] ? ioctl_standard_call+0x0/0xd0\n [\u003cffffffff816b3223\u003e] ? T.808+0x163/0x170\n [\u003cffffffff8112ddf2\u003e] ? might_fault+0x72/0xd0\n [\u003cffffffff816b326a\u003e] ? wext_handle_ioctl+0x3a/0x90\n [\u003cffffffff8112de3b\u003e] ? might_fault+0xbb/0xd0\n [\u003cffffffff815798d2\u003e] ? dev_ioctl+0x6f2/0x830\n [\u003cffffffff810a1bae\u003e] ? put_lock_stats+0xe/0x40\n [\u003cffffffff810a1c8c\u003e] ? lock_release_holdtime+0xac/0x150\n [\u003cffffffff8155cf3d\u003e] ? sock_ioctl+0xfd/0x290\n [\u003cffffffff8117dffd\u003e] ? do_vfs_ioctl+0x9d/0x590\n [\u003cffffffff8116c8ff\u003e] ? fget_light+0x1df/0x3c0\n [\u003cffffffff8117e53a\u003e] ? sys_ioctl+0x4a/0x80\n [\u003cffffffff81003192\u003e] ? system_call_fastpath+0x16/0x1b\n\nSigned-off-by: Daniel J Blueman \u003cdaniel.blueman@gmail.com\u003e\nAcked-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "c24f691b56107feeba076616982093ee2d3c8fb5", "tree": "90317e187a511635fdb8682384fc8eb99f1de21f", "parents": [ "5f04d5068a90602b93a7953e9a47c496705c6976" ], "author": { "name": "Yuchung Cheng", "email": "ycheng@google.com", "time": "Mon Feb 07 12:57:04 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 21 11:31:18 2011 -0800" }, "message": "tcp: undo_retrans counter fixes\n\nFix a bug that undo_retrans is incorrectly decremented when undo_marker is\nnot set or undo_retrans is already 0. This happens when sender receives\nmore DSACK ACKs than packets retransmitted during the current\nundo phase. This may also happen when sender receives DSACK after\nthe undo operation is completed or cancelled.\n\nFix another bug that undo_retrans is incorrectly incremented when\nsender retransmits an skb and tcp_skb_pcount(skb) \u003e 1 (TSO). This case\nis rare but not impossible.\n\nSigned-off-by: Yuchung Cheng \u003cycheng@google.com\u003e\nAcked-by: Ilpo Järvinen \u003cilpo.jarvinen@helsinki.fi\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5f04d5068a90602b93a7953e9a47c496705c6976", "tree": "272ea087a13648cb3dd34e0feed08cfc4b1e5e2c", "parents": [ "2205a6ea93fea76f88b43727fea53f3ce3790d6f" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Sun Feb 20 11:49:45 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Feb 20 11:49:45 2011 -0800" }, "message": "net: Fix more stale on-stack list_head objects.\n\nFrom: Eric W. Biederman \u003cebiederm@xmission.com\u003e\n\nIn the beginning with batching unreg_list was a list that was used only\nonce in the lifetime of a network device (I think). Now we have calls\nusing the unreg_list that can happen multiple times in the life of a\nnetwork device like dev_deactivate and dev_close that are also using the\nunreg_list. In addition in unregister_netdevice_queue we also do a\nlist_move because for devices like veth pairs it is possible that\nunregister_netdevice_queue will be called multiple times.\n\nSo I think the change below to fix dev_deactivate which Eric D. missed\nwill fix this problem. Now to go test that.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2205a6ea93fea76f88b43727fea53f3ce3790d6f", "tree": "440ff9d40ce5eeee3c85e22feea20f2a0c4d4065", "parents": [ "226111d1fbe611bc7a5ffaa5275ccb41e73fd011" ], "author": { "name": "Jiri Bohac", "email": "jbohac@suse.cz", "time": "Thu Feb 17 13:12:08 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Feb 19 19:06:55 2011 -0800" }, "message": "sctp: fix reporting of unknown parameters\n\ncommit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809 re-worked the\nhandling of unknown parameters. sctp_init_cause_fixed() can now\nreturn -ENOSPC if there is not enough tailroom in the error\nchunk skb. When this happens, the error header is not appended to\nthe error chunk. In that case, the payload of the unknown parameter\nshould not be appended either.\n\nSigned-off-by: Jiri Bohac \u003cjbohac@suse.cz\u003e\nAcked-by: Vlad Yasevich \u003cvladislav.yasevich@hp.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "91035f0b7d89291af728b6f3e370c3be58fcbe1b", "tree": "e15aeadf32b4e4c2874c72be0100dbe0f222f84a", "parents": [ "ece639caa33c85c8805fa4a0a5955b8de9c95346" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Fri Feb 18 22:35:56 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Feb 19 18:59:04 2011 -0800" }, "message": "tcp: fix inet_twsk_deschedule()\n\nEric W. Biederman reported a lockdep splat in inet_twsk_deschedule()\n\nThis is caused by inet_twsk_purge(), run from process context,\nand commit 575f4cd5a5b6394577 (net: Use rcu lookups in inet_twsk_purge.)\nremoved the BH disabling that was necessary.\n\nAdd the BH disabling but fine grained, right before calling\ninet_twsk_deschedule(), instead of whole function.\n\nWith help from Linus Torvalds and Eric W. Biederman\n\nReported-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Daniel Lezcano \u003cdaniel.lezcano@free.fr\u003e\nCC: Pavel Emelyanov \u003cxemul@openvz.org\u003e\nCC: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nCC: stable \u003cstable@kernel.org\u003e (# 2.6.33+)\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ece639caa33c85c8805fa4a0a5955b8de9c95346", "tree": "5b8d613601c2e01e876a7d241923e90a0e759c3b", "parents": [ "0cc9d5257857608ba85885b75fcada13d359b5d1", "0af320fb4627033e49cbc6e8138e7aa75ab8352a" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Feb 19 16:42:37 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Feb 19 16:42:37 2011 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6\n" }, { "commit": "4c3021da451fe0ea1deaba8fa3805d8d065ec84e", "tree": "7dba26f1fb51be87dfd5d136ddbbd752b60e9a6c", "parents": [ "a5bbef0b2deb7b943f095181309ecc9e1fc91c0f", "ceaaec98ad99859ac90ac6863ad0a6cd075d8e0e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 18 14:15:05 2011 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 18 14:15:05 2011 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (37 commits)\n net: deinit automatic LIST_HEAD\n net: dont leave active on stack LIST_HEAD\n net: provide default_advmss() methods to blackhole dst_ops\n tg3: Restrict phy ioctl access\n drivers/net: Call netif_carrier_off at the end of the probe\n ixgbe: work around for DDP last buffer size\n ixgbe: fix panic due to uninitialised pointer\n e1000e: flush all writebacks before unload\n e1000e: check down flag in tasks\n isdn: hisax: Use l2headersize() instead of dup (and buggy) func.\n arp_notify: unconditionally send gratuitous ARP for NETDEV_NOTIFY_PEERS.\n cxgb4vf: Use defined Mailbox Timeout\n cxgb4vf: Quiesce Virtual Interfaces on shutdown ...\n cxgb4vf: Behave properly when CONFIG_DEBUG_FS isn\u0027t defined ...\n cxgb4vf: Check driver parameters in the right place ...\n pch_gbe: Fix the MAC Address load issue.\n iwlwifi: Delete iwl3945_good_plcp_health.\n net/can/softing: make CAN_SOFTING_CS depend on CAN_SOFTING\n netfilter: nf_iterate: fix incorrect RCU usage\n pch_gbe: Fix the issue that the receiving data is not normal.\n ...\n" }, { "commit": "05e7c99136554789e4cc060a63334ccaa08ad62d", "tree": "5ff7ec6db73e15aababfd34741a7db1e93e9d324", "parents": [ "1b68e676204927f69e987b86a99e19e61cc37dcc" ], "author": { "name": "Stanislaw Gruszka", "email": "sgruszka@redhat.com", "time": "Fri Feb 18 09:05:08 2011 +0100" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Fri Feb 18 16:47:37 2011 -0500" }, "message": "mac80211: fix conn_mon_timer running after disassociate\n\nLow level driver could pass rx frames to us after disassociate, what\ncan lead to run conn_mon_timer by ieee80211_sta_rx_notify(). That\nis obviously wrong, but nothing happens until we unload modules and\nresources are used after free. If kernel debugging is enabled following\nwarning could be observed:\n\nWARNING: at lib/debugobjects.c:259 debug_print_object+0x65/0x70()\nHardware name: HP xw8600 Workstation\nODEBUG: free active (active state 0) object type: timer_list\nModules linked in: iwlagn(-) iwlcore mac80211 cfg80211 aes_x86_64 aes_generic fuse cpufreq_ondemand acpi_cpufreq freq_table mperf xt_physdev ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 ext3 jbd dm_mirror dm_region_hash dm_log dm_mod uinput hp_wmi sparse_keymap sg wmi arc4 microcode serio_raw ecb tg3 shpchp rfkill ext4 mbcache jbd2 sr_mod cdrom sd_mod crc_t10dif firewire_ohci firewire_core crc_itu_t mptsas mptscsih mptbase scsi_transport_sas ahci libahci pata_acpi ata_generic ata_piix floppy nouveau ttm drm_kms_helper drm i2c_algo_bit i2c_core video [last unloaded: cfg80211]\nPid: 13827, comm: rmmod Tainted: G W 2.6.38-rc4-wl+ #22\nCall Trace:\n [\u003cffffffff810649cf\u003e] ? warn_slowpath_common+0x7f/0xc0\n [\u003cffffffff81064ac6\u003e] ? warn_slowpath_fmt+0x46/0x50\n [\u003cffffffff81226fc5\u003e] ? debug_print_object+0x65/0x70\n [\u003cffffffff81227625\u003e] ? debug_check_no_obj_freed+0x125/0x210\n [\u003cffffffff8109ebd7\u003e] ? debug_check_no_locks_freed+0xf7/0x170\n [\u003cffffffff81156092\u003e] ? kfree+0xc2/0x2f0\n [\u003cffffffff813ec5c5\u003e] ? netdev_release+0x45/0x60\n [\u003cffffffff812f1067\u003e] ? device_release+0x27/0xa0\n [\u003cffffffff81216ddd\u003e] ? kobject_release+0x8d/0x1a0\n [\u003cffffffff81216d50\u003e] ? kobject_release+0x0/0x1a0\n [\u003cffffffff812183b7\u003e] ? kref_put+0x37/0x70\n [\u003cffffffff81216c57\u003e] ? kobject_put+0x27/0x60\n [\u003cffffffff813d5d1b\u003e] ? netdev_run_todo+0x1ab/0x270\n [\u003cffffffff813e771e\u003e] ? rtnl_unlock+0xe/0x10\n [\u003cffffffffa0581188\u003e] ? ieee80211_unregister_hw+0x58/0x120 [mac80211]\n [\u003cffffffffa0377ed7\u003e] ? iwl_pci_remove+0xdb/0x22a [iwlagn]\n [\u003cffffffff8123cde2\u003e] ? pci_device_remove+0x52/0x120\n [\u003cffffffff812f5205\u003e] ? __device_release_driver+0x75/0xe0\n [\u003cffffffff812f5348\u003e] ? driver_detach+0xd8/0xe0\n [\u003cffffffff812f4111\u003e] ? bus_remove_driver+0x91/0x100\n [\u003cffffffff812f5b62\u003e] ? driver_unregister+0x62/0xa0\n [\u003cffffffff8123d194\u003e] ? pci_unregister_driver+0x44/0xa0\n [\u003cffffffffa0377df5\u003e] ? iwl_exit+0x15/0x1c [iwlagn]\n [\u003cffffffff810ab492\u003e] ? sys_delete_module+0x1a2/0x270\n [\u003cffffffff81498889\u003e] ? trace_hardirqs_on_thunk+0x3a/0x3f\n [\u003cffffffff8100bf42\u003e] ? system_call_fastpath+0x16/0x1b\n\nAcked-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "ceaaec98ad99859ac90ac6863ad0a6cd075d8e0e", "tree": "12754d2780860162b031e8c67c80866473cb4fe9", "parents": [ "f87e6f47933e3ebeced9bb12615e830a72cedce4" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Thu Feb 17 22:59:19 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 18 11:49:36 2011 -0800" }, "message": "net: deinit automatic LIST_HEAD\n\ncommit 9b5e383c11b08784 (net: Introduce\nunregister_netdevice_many()) left an active LIST_HEAD() in\nrollback_registered(), with possible memory corruption.\n\nEven if device is freed without touching its unreg_list (and therefore\ntouching the previous memory location holding LISTE_HEAD(single), better\nclose the bug for good, since its really subtle.\n\n(Same fix for default_device_exit_batch() for completeness)\n\nReported-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nTested-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nReported-by: Eric W. Biderman \u003cebiderman@xmission.com\u003e\nTested-by: Eric W. Biderman \u003cebiderman@xmission.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Ingo Molnar \u003cmingo@elte.hu\u003e\nCC: Octavian Purdila \u003copurdila@ixiacom.com\u003e\nCC: stable \u003cstable@kernel.org\u003e [.33+]\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f87e6f47933e3ebeced9bb12615e830a72cedce4", "tree": "c664fa9d09f0d946270c5a3cfb821a0bc95f3d8f", "parents": [ "214f45c91bbda8321d9676f1197238e4663edcbb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 17 22:54:38 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 18 11:49:35 2011 -0800" }, "message": "net: dont leave active on stack LIST_HEAD\n\nEric W. Biderman and Michal Hocko reported various memory corruptions\nthat we suspected to be related to a LIST head located on stack, that\nwas manipulated after thread left function frame (and eventually exited,\nso its stack was freed and reused).\n\nEric Dumazet suggested the problem was probably coming from commit\n443457242beb (net: factorize\nsync-rcu call in unregister_netdevice_many)\n\nThis patch fixes __dev_close() and dev_close() to properly deinit their\nrespective LIST_HEAD(single) before exiting.\n\nReferences: https://lkml.org/lkml/2011/2/16/304\nReferences: https://lkml.org/lkml/2011/2/14/223\n\nReported-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nTested-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nReported-by: Eric W. Biderman \u003cebiderman@xmission.com\u003e\nTested-by: Eric W. Biderman \u003cebiderman@xmission.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Ingo Molnar \u003cmingo@elte.hu\u003e\nCC: Octavian Purdila \u003copurdila@ixiacom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "214f45c91bbda8321d9676f1197238e4663edcbb", "tree": "2b78e1d21298c1622755b09826ed2b8e5152d6e3", "parents": [ "ed199facd070f8e551dc16a2ae1baa01d8d28ed4" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Fri Feb 18 11:39:01 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 18 11:39:01 2011 -0800" }, "message": "net: provide default_advmss() methods to blackhole dst_ops\n\nCommit 0dbaee3b37e118a (net: Abstract default ADVMSS behind an\naccessor.) introduced a possible crash in tcp_connect_init(), when\ndst-\u003edefault_advmss() is called from dst_metric_advmss()\n\nReported-by: George Spelvin \u003clinux@horizon.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0af320fb4627033e49cbc6e8138e7aa75ab8352a", "tree": "724a020c8d6f96b37ee9674cd59b94c08f50a176", "parents": [ "d503b30bd648b3cb4e5f50b65d27e389960cc6d9" ], "author": { "name": "Joerg Marx", "email": "joerg.marx@secunet.com", "time": "Thu Feb 17 16:23:40 2011 +0100" }, "committer": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Thu Feb 17 16:23:40 2011 +0100" }, "message": "netfilter: ip6t_LOG: fix a flaw in printing the MAC\n\nThe flaw was in skipping the second byte in MAC header due to increasing\nthe pointer AND indexed access starting at \u00271\u0027.\n\nSigned-off-by: Joerg Marx \u003cjoerg.marx@secunet.com\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\n" }, { "commit": "d503b30bd648b3cb4e5f50b65d27e389960cc6d9", "tree": "ebb3e2ad85f32cd95c767dda75d25873c384e78d", "parents": [ "de9963f0f2dfad128b26ae7bf6005f5948416a6d" ], "author": { "name": "Florian Westphal", "email": "fwestphal@astaro.com", "time": "Thu Feb 17 11:32:38 2011 +0100" }, "committer": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Thu Feb 17 11:32:38 2011 +0100" }, "message": "netfilter: tproxy: do not assign timewait sockets to skb-\u003esk\n\nAssigning a socket in timewait state to skb-\u003esk can trigger\nkernel oops, e.g. in nfnetlink_log, which does:\n\nif (skb-\u003esk) {\n read_lock_bh(\u0026skb-\u003esk-\u003esk_callback_lock);\n if (skb-\u003esk-\u003esk_socket \u0026\u0026 skb-\u003esk-\u003esk_socket-\u003efile) ...\n\nin the timewait case, accessing sk-\u003esk_callback_lock and sk-\u003esk_socket\nis invalid.\n\nEither all of these spots will need to add a test for sk-\u003esk_state !\u003d TCP_TIME_WAIT,\nor xt_TPROXY must not assign a timewait socket to skb-\u003esk.\n\nThis does the latter.\n\nIf a TW socket is found, assign the tproxy nfmark, but skip the skb-\u003esk assignment,\nthus mimicking behaviour of a \u0027-m socket .. -j MARK/ACCEPT\u0027 re-routing rule.\n\nThe \u0027SYN to TW socket\u0027 case is left unchanged -- we try to redirect to the\nlistener socket.\n\nCc: Balazs Scheidler \u003cbazsi@balabit.hu\u003e\nCc: KOVACS Krisztian \u003chidden@balabit.hu\u003e\nSigned-off-by: Florian Westphal \u003cfwestphal@astaro.com\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\n" }, { "commit": "840af824b2bf9194ea596e0ddc7aa05066794ca1", "tree": "e10fe7e455b9a4aaadf56cb3f0c0325208bc0118", "parents": [ "8efdd0cdc54f3bb5db464b3baf88f7441f54da47" ], "author": { "name": "Vladislav P", "email": "vladisslav@inbox.ru", "time": "Mon Feb 14 15:21:50 2011 -0200" }, "committer": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Wed Feb 16 15:54:11 2011 -0300" }, "message": "Bluetooth: Release BTM while sleeping to avoid deadlock\n\nSigned-off-by: Vladislav P \u003cvladisslav@inbox.ru\u003e\nSigned-off-by: Gustavo F. Padovan \u003cpadovan@profusion.mobi\u003e\n" }, { "commit": "d11327ad6695db8117c78d70611e71102ceec2ac", "tree": "02d76a5825c357d0383268d9502c886abc8c9987", "parents": [ "0550769bb7f364fb9aeeb9412229fb7790ee79c4" ], "author": { "name": "Ian Campbell", "email": "Ian.Campbell@citrix.com", "time": "Fri Feb 11 07:44:16 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 14 17:47:15 2011 -0800" }, "message": "arp_notify: unconditionally send gratuitous ARP for NETDEV_NOTIFY_PEERS.\n\nNETDEV_NOTIFY_PEER is an explicit request by the driver to send a link\nnotification while NETDEV_UP/NETDEV_CHANGEADDR generate link\nnotifications as a sort of side effect.\n\nIn the later cases the sysctl option is present because link\nnotification events can have undesired effects e.g. if the link is\nflapping. I don\u0027t think this applies in the case of an explicit\nrequest from a driver.\n\nThis patch makes NETDEV_NOTIFY_PEER unconditional, if preferred we\ncould add a new sysctl for this case which defaults to on.\n\nThis change causes Xen post-migration ARP notifications (which cause\nswitches to relearn their MAC tables etc) to be sent by default.\n\nSigned-off-by: Ian Campbell \u003cian.campbell@citrix.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8bc26a008f61eac5631701cbd65f88c015a63280", "tree": "c85eb9e5a14b406a4dd6625c57029ec266e7dc80", "parents": [ "ddfdb508866b3c07b295f6c85c271981d88afe4c", "a7b545f7fe753ca3dc1b51ca57f90cd59d974e44" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 14 12:51:42 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 14 12:51:42 2011 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "af756e9d8873efc8b0565c06734ef12d9b652061", "tree": "5e1f93a9fd46a9939cb5f7d937f173f9ccf41b48", "parents": [ "ac09664248e300342e92b937c9894a8149ddf189", "de9963f0f2dfad128b26ae7bf6005f5948416a6d" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 14 11:16:12 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 14 11:16:12 2011 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6\n" }, { "commit": "de9963f0f2dfad128b26ae7bf6005f5948416a6d", "tree": "73b45541d33e86600cd10e4be43298864f2b6a1a", "parents": [ "c317428644c0af137d80069ab178cd797da3be45" ], "author": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Mon Feb 14 17:35:07 2011 +0100" }, "committer": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Mon Feb 14 17:35:07 2011 +0100" }, "message": "netfilter: nf_iterate: fix incorrect RCU usage\n\nAs noticed by Eric, nf_iterate doesn\u0027t use RCU correctly by\naccessing the prev pointer of a RCU protected list element when\na verdict of NF_REPEAT is issued.\n\nFix by jumping backwards to the hook invocation directly instead\nof loading the previous list element before continuing the list\niteration.\n\nReported-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\n" }, { "commit": "d3337de52af7fb0ebe605b02b740be4ee7dee9eb", "tree": "1788ad68e863e2aa8c6cbf50ceab25d39827bc5b", "parents": [ "7ec79270d7de0c8ca602c47cb25a9652ec28f37f" ], "author": { "name": "Jesper Juhl", "email": "jj@chaosbits.net", "time": "Thu Feb 10 11:57:16 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Feb 13 11:21:14 2011 -0800" }, "message": "Don\u0027t potentially dereference NULL in net/dcb/dcbnl.c:dcbnl_getapp()\n\nnla_nest_start() may return NULL. If it does then we\u0027ll blow up in\nnla_nest_end() when we dereference the pointer.\n\nSigned-off-by: Jesper Juhl \u003cjj@chaosbits.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7ec79270d7de0c8ca602c47cb25a9652ec28f37f", "tree": "77386b7e90fa4891589ec139790579fb8b791d01", "parents": [ "8a870178c0ad1bae9994c99bd01eb10c9903e616" ], "author": { "name": "John Fastabend", "email": "john.r.fastabend@intel.com", "time": "Mon Jan 31 12:00:59 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Feb 13 11:02:39 2011 -0800" }, "message": "net: dcb: application priority is per net_device\n\nThe app_data priority may not be the same for all net devices.\nIn order for stacks with application notifiers to identify the\nspecific net device dcb_app_type should be passed in the ptr.\n\nThis allows handlers to use dev_get_by_name() to pin priority\nto net devices.\n\nSigned-off-by: John Fastabend \u003cjohn.r.fastabend@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8a870178c0ad1bae9994c99bd01eb10c9903e616", "tree": "e850d082e5aef4f436867a3301d1bf15fda80d06", "parents": [ "24f9cdcbd743fd6adb8fb83688d8d86dcccde662" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Sat Feb 12 01:05:42 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Feb 12 01:05:42 2011 -0800" }, "message": "bridge: Replace mp-\u003emglist hlist with a bool\n\nAs it turns out we never need to walk through the list of multicast\ngroups subscribed by the bridge interface itself (the only time we\u0027d\nwant to do that is when we shut down the bridge, in which case we\nsimply walk through all multicast groups), we don\u0027t really need to\nkeep an hlist for mp-\u003emglist.\n\nThis means that we can replace it with just a single bit to indicate\nwhether the bridge interface is subscribed to a group.\n\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "24f9cdcbd743fd6adb8fb83688d8d86dcccde662", "tree": "95913d38abc0ec80c4bfa0ca8af478e63de137f8", "parents": [ "6b0d6a9b4296fa16a28d10d416db7a770fc03287" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Fri Feb 11 12:42:07 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 11 21:59:37 2011 -0800" }, "message": "bridge: Fix timer typo that may render snooping less effective\n\nIn a couple of spots where we are supposed to modify the port\ngroup timer (p-\u003etimer) we instead modify the bridge interface\ngroup timer (mp-\u003etimer).\n\nThe effect of this is mostly harmless. However, it can cause\nport subscriptions to be longer than they should be, thus making\nsnooping less effective.\n\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6b0d6a9b4296fa16a28d10d416db7a770fc03287", "tree": "27f21e7dbcd447e7fd0f2d0b75e2c9cd9e7deddf", "parents": [ "946bf5ee3c46f73b5cbd52aab594697b1a132d1f" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Fri Feb 11 12:36:55 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 11 21:59:37 2011 -0800" }, "message": "bridge: Fix mglist corruption that leads to memory corruption\n\nThe list mp-\u003emglist is used to indicate whether a multicast group\nis active on the bridge interface itself as opposed to one of the\nconstituent interfaces in the bridge.\n\nUnfortunately the operation that adds the mp-\u003emglist node to the\nlist neglected to check whether it has already been added. This\nleads to list corruption in the form of nodes pointing to itself.\n\nNormally this would be quite obvious as it would cause an infinite\nloop when walking the list. However, as this list is never actually\nwalked (which means that we don\u0027t really need it, I\u0027ll get rid of\nit in a subsequent patch), this instead is hidden until we perform\na delete operation on the affected nodes.\n\nAs the same node may now be pointed to by more than one node, the\ndelete operations can then cause modification of freed memory.\n\nThis was observed in practice to cause corruption in 512-byte slabs,\nmost commonly leading to crashes in jbd2.\n\nThanks to Josef Bacik for pointing me in the right direction.\n\nReported-by: Ian Page Hands \u003cihands@redhat.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "946bf5ee3c46f73b5cbd52aab594697b1a132d1f", "tree": "a28a589a294fe25407001d419c8788348633f65b", "parents": [ "0b150932197b185ad5816932912e648116c7a96a" ], "author": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Fri Feb 11 11:21:57 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 11 11:23:12 2011 -0800" }, "message": "ip_gre: Add IPPROTO_GRE to flowi in ipgre_tunnel_xmit\n\nCommit 5811662b15db018c740c57d037523683fd3e6123 (\"net: use the macros\ndefined for the members of flowi\") accidentally removed the setting of\nIPPROTO_GRE from the struct flowi in ipgre_tunnel_xmit. This patch\nrestores it.\n\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nAcked-by: Changli Gao \u003cxiaosuo@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0b150932197b185ad5816932912e648116c7a96a", "tree": "3b3092f2876be20a48088ee0d1cf29cf6028c843", "parents": [ "520732af9158308e96245b54f1d573861eafb631" ], "author": { "name": "Hiroaki SHIMODA", "email": "shimoda.hiroaki@gmail.com", "time": "Thu Feb 10 23:08:33 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 10 23:08:33 2011 -0800" }, "message": "xfrm: avoid possible oopse in xfrm_alloc_dst\n\nCommit 80c802f3073e84 (xfrm: cache bundles instead of policies for\noutgoing flows) introduced possible oopse when dst_alloc returns NULL.\n\nSigned-off-by: Hiroaki SHIMODA \u003cshimoda.hiroaki@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e128c5e26bd474a2a56b96ec7c8967aff347b763", "tree": "1352a221d62f4c452c3962c283aac48491549363", "parents": [ "70a062286b9dfcbd24d2e11601aecfead5cf709a", "3e9d08ec0a68f6faf718d5a7e050fe5ca0ba004f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 10 12:05:09 2011 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 10 12:05:09 2011 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (34 commits)\n virtio_net: Add schedule check to napi_enable call\n x25: Do not reference freed memory.\n pch_can: fix tseg1/tseg2 setting issue\n isdn: hysdn: Kill (partially buggy) CVS regision log reporting.\n can: softing_cs needs slab.h\n pch_gbe: Fix the issue which a driver locks when rx offload is set by ethtool\n netfilter: nf_conntrack: set conntrack templates again if we return NF_REPEAT\n pch_can: fix module reload issue with MSI\n pch_can: fix rmmod issue\n pch_can: fix 800k comms issue\n net: Fix lockdep regression caused by initializing netdev queues too early.\n net/caif: Fix dangling list pointer in freed object on error.\n USB CDC NCM errata updates for cdc_ncm host driver\n CDC NCM errata updates for cdc.h\n ixgbe: update version string\n ixgbe: cleanup variable initialization\n ixgbe: limit VF access to network traffic\n ixgbe: fix for 82599 erratum on Header Splitting\n ixgbe: fix variable set but not used warnings by gcc 4.6\n e1000: add support for Marvell Alaska M88E1118R PHY\n ...\n" }, { "commit": "96642d42f076101ba98866363d908cab706d156c", "tree": "07043558ca37f51e072cf32c0a3a7db05dd91ce7", "parents": [ "ebc02e9c524e9ff377dd8a3820522d381adf19c8" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 09 21:48:36 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 09 22:36:13 2011 -0800" }, "message": "x25: Do not reference freed memory.\n\nIn x25_link_free(), we destroy \u0027nb\u0027 before dereferencing\n\u0027nb-\u003edev\u0027. Don\u0027t do this, because \u0027nb\u0027 might be freed\nby then.\n\nReported-by: Randy Dunlap \u003crandy.dunlap@oracle.com\u003e\nTested-by: Randy Dunlap \u003crandy.dunlap@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ae0935776c3c7f4c99d0b3909755fe0896277d0e", "tree": "b04bfd38cb2dfab522834d42ca476241d68a567e", "parents": [ "75d1a7522f8b3f4de3eea040fdcdb640deeda64d", "c317428644c0af137d80069ab178cd797da3be45" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 09 12:40:21 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 09 12:40:21 2011 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6\n" }, { "commit": "a7b545f7fe753ca3dc1b51ca57f90cd59d974e44", "tree": "7eab351da83338f3edb161b4cfe8f9b30d48a7a2", "parents": [ "c91d01556f52255a31575be0cb1981c92a2a5028" ], "author": { "name": "Eliad Peller", "email": "eliad@wizery.com", "time": "Tue Feb 08 18:43:19 2011 +0200" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Feb 09 15:35:13 2011 -0500" }, "message": "mac80211: add missing locking in ieee80211_reconfig\n\nWhen suspending an associated system, and then resuming,\nthe station vif is being reconfigured without taking the\nsdata-\u003eu.mgd.mtx lock, which results in the following warning:\n\nWARNING: at net/mac80211/mlme.c:101 ieee80211_ap_probereq_get+0x58/0xb8 [mac80211]()\nModules linked in: wl12xx_sdio wl12xx firmware_class crc7 mac80211 cfg80211 [last unloaded: crc7]\nBacktrace:\n[\u003cc005432c\u003e] (dump_backtrace+0x0/0x118) from [\u003cc0376e28\u003e] (dump_stack+0x20/0x24)\n r7:00000000 r6:bf12d6ec r5:bf154aac r4:00000065\n[\u003cc0376e08\u003e] (dump_stack+0x0/0x24) from [\u003cc0079104\u003e] (warn_slowpath_common+0x5c/0x74)\n[\u003cc00790a8\u003e] (warn_slowpath_common+0x0/0x74) from [\u003cc0079148\u003e] (warn_slowpath_null+0x2c/0x34)\n r9:000024ff r8:cd006460 r7:00000001 r6:00000000 r5:00000000\nr4:cf1394a0\n[\u003cc007911c\u003e] (warn_slowpath_null+0x0/0x34) from [\u003cbf12d6ec\u003e] (ieee80211_ap_probereq_get+0x58/0xb8 [mac80211])\n[\u003cbf12d694\u003e] (ieee80211_ap_probereq_get+0x0/0xb8 [mac80211]) from [\u003cbf19cd04\u003e] (wl1271_cmd_build_ap_probe_req+0x30/0xf8 [wl12xx])\n r4:cd007440\n[\u003cbf19ccd4\u003e] (wl1271_cmd_build_ap_probe_req+0x0/0xf8 [wl12xx]) from [\u003cbf1995f4\u003e] (wl1271_op_bss_info_changed+0x4c4/0x808 [wl12xx])\n r5:cd007440 r4:000003b4\n[\u003cbf199130\u003e] (wl1271_op_bss_info_changed+0x0/0x808 [wl12xx]) from [\u003cbf122168\u003e] (ieee80211_bss_info_change_notify+0x1a4/0x1f8 [mac80211])\n[\u003cbf121fc4\u003e] (ieee80211_bss_info_change_notify+0x0/0x1f8 [mac80211]) from [\u003cbf141e80\u003e] (ieee80211_reconfig+0x4d0/0x668 [mac80211])\n r8:cf0eeea4 r7:cd00671c r6:00000000 r5:cd006460 r4:cf1394a0\n[\u003cbf1419b0\u003e] (ieee80211_reconfig+0x0/0x668 [mac80211]) from [\u003cbf137dd4\u003e] (ieee80211_resume+0x60/0x70 [mac80211])\n[\u003cbf137d74\u003e] (ieee80211_resume+0x0/0x70 [mac80211]) from [\u003cbf0eb930\u003e] (wiphy_resume+0x6c/0x7c [cfg80211])\n r5:cd006248 r4:cd006110\n[\u003cbf0eb8c4\u003e] (wiphy_resume+0x0/0x7c [cfg80211]) from [\u003cc0241024\u003e] (legacy_resume+0x38/0x70)\n r7:00000000 r6:00000000 r5:cd006248 r4:cd0062fc\n[\u003cc0240fec\u003e] (legacy_resume+0x0/0x70) from [\u003cc0241478\u003e] (device_resume+0x168/0x1a0)\n r8:c04ca8d8 r7:cd00627c r6:00000010 r5:cd006248 r4:cd0062fc\n[\u003cc0241310\u003e] (device_resume+0x0/0x1a0) from [\u003cc0241600\u003e] (dpm_resume_end+0xf8/0x3bc)\n r7:00000000 r6:00000005 r5:cd006248 r4:cd0062fc\n[\u003cc0241508\u003e] (dpm_resume_end+0x0/0x3bc) from [\u003cc00b2a24\u003e] (suspend_devices_and_enter+0x1b0/0x204)\n[\u003cc00b2874\u003e] (suspend_devices_and_enter+0x0/0x204) from [\u003cc00b2b68\u003e] (enter_state+0xf0/0x148)\n r7:c037e978 r6:00000003 r5:c043d807 r4:00000000\n[\u003cc00b2a78\u003e] (enter_state+0x0/0x148) from [\u003cc00b20a4\u003e] (state_store+0xa4/0xcc)\n r7:c037e978 r6:00000003 r5:00000003 r4:c043d807\n[\u003cc00b2000\u003e] (state_store+0x0/0xcc) from [\u003cc01fc90c\u003e] (kobj_attr_store+0x20/0x24)\n[\u003cc01fc8ec\u003e] (kobj_attr_store+0x0/0x24) from [\u003cc0157120\u003e] (sysfs_write_file+0x11c/0x150)\n[\u003cc0157004\u003e] (sysfs_write_file+0x0/0x150) from [\u003cc0100f84\u003e] (vfs_write+0xc0/0x14c)\n[\u003cc0100ec4\u003e] (vfs_write+0x0/0x14c) from [\u003cc01010e4\u003e] (sys_write+0x4c/0x78)\n r8:40126000 r7:00000004 r6:cf1a7c80 r5:00000000 r4:00000000\n[\u003cc0101098\u003e] (sys_write+0x0/0x78) from [\u003cc00500c0\u003e] (ret_fast_syscall+0x0/0x30)\n r8:c00502c8 r7:00000004 r6:403525e8 r5:40126000 r4:00000004\n\nSigned-off-by: Eliad Peller \u003celiad@wizery.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "5dc0fa782ad4a2cfad93c016765492083e687cf3", "tree": "a7c41c15779b5cbeafcfdc445f796c46d80ec0c0", "parents": [ "fc7c976dc7a565213393ce700d4a6105f037bf20", "e733fb62082b3b187870dfba28d5f6730b8436c4" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Feb 09 15:30:42 2011 -0500" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Feb 09 15:30:42 2011 -0500" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6\n" }, { "commit": "c317428644c0af137d80069ab178cd797da3be45", "tree": "bb862f2da8a291f6f46b0fb70f329529b1095586", "parents": [ "3db7e93d3308fb882884b9f024235d6fbf542034" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Feb 09 08:08:20 2011 +0100" }, "committer": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Wed Feb 09 08:08:20 2011 +0100" }, "message": "netfilter: nf_conntrack: set conntrack templates again if we return NF_REPEAT\n\nThe TCP tracking code has a special case that allows to return\nNF_REPEAT if we receive a new SYN packet while in TIME_WAIT state.\n\nIn this situation, the TCP tracking code destroys the existing\nconntrack to start a new clean session.\n\n[DESTROY] tcp 6 src\u003d192.168.0.2 dst\u003d192.168.1.2 sport\u003d38925 dport\u003d8000 src\u003d192.168.1.2 dst\u003d192.168.1.100 sport\u003d8000 dport\u003d38925 [ASSURED]\n [NEW] tcp 6 120 SYN_SENT src\u003d192.168.0.2 dst\u003d192.168.1.2 sport\u003d38925 dport\u003d8000 [UNREPLIED] src\u003d192.168.1.2 dst\u003d192.168.1.100 sport\u003d8000 dport\u003d38925\n\nHowever, this is a problem for the iptables\u0027 CT target event filtering\nwhich will not work in this case since the conntrack template will not\nbe there for the new session. To fix this, we reassign the conntrack\ntemplate to the packet if we return NF_REPEAT.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\n" }, { "commit": "8d3bdbd55a7e2a3f2c148a4830aa26dd682b21c4", "tree": "d32637a46d04190f1123c2e7ad1ba460f53b8ff9", "parents": [ "b2df5a8446e135f7648736b8bec8179c88ce360d" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 08 15:02:50 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 08 15:02:50 2011 -0800" }, "message": "net: Fix lockdep regression caused by initializing netdev queues too early.\n\nIn commit aa9421041128abb4d269ee1dc502ff65fb3b7d69 (\"net: init ingress\nqueue\") we moved the allocation and lock initialization of the queues\ninto alloc_netdev_mq() since register_netdevice() is way too late.\n\nThe problem is that dev-\u003etype is not setup until the setup()\ncallback is invoked by alloc_netdev_mq(), and the dev-\u003etype is\nwhat determines the lockdep class to use for the locks in the\nqueues.\n\nFix this by doing the queue allocation after the setup() callback\nruns.\n\nThis is safe because the setup() callback is not allowed to make any\nstate changes that need to be undone on error (memory allocations,\netc.). It may, however, make state changes that are undone by\nfree_netdev() (such as netif_napi_add(), which is done by the\nipoib driver\u0027s setup routine).\n\nThe previous code also leaked a reference to the \u0026init_net namespace\nobject on RX/TX queue allocation failures.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b2df5a8446e135f7648736b8bec8179c88ce360d", "tree": "472726c88dfd5a20c913bf557e4d6b5889e00510", "parents": [ "84e77a8bc73cad2f910cc981f266904c66a17825" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 08 14:31:31 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 08 14:31:31 2011 -0800" }, "message": "net/caif: Fix dangling list pointer in freed object on error.\n\nrtnl_link_ops-\u003esetup(), and the \"setup\" callback passed to alloc_netdev*(),\ncannot make state changes which need to be undone on failure. There is\nno cleanup mechanism available at this point.\n\nSo we have to add the caif private instance to the global list once we\nare sure that register_netdev() has succedded in -\u003enewlink().\n\nOtherwise, if register_netdev() fails, the caller will invoke free_netdev()\nand we will have a reference to freed up memory on the chnl_net_list.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e0985f27ddc3cd49c56fc3a76ec4ae3a594315d0", "tree": "a0261a4fae2b2e288cbc7e14a8f1acd47d4f2df4", "parents": [ "429a01a70f301baf0c8fc780f891a18c296d5e24", "fc7c976dc7a565213393ce700d4a6105f037bf20" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 08 12:03:54 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 08 12:03:54 2011 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "429a01a70f301baf0c8fc780f891a18c296d5e24", "tree": "663ee8a8c0a47d364648d5f905f185e875e48d62", "parents": [ "95c3043008ca8449feb96aba5481fe31c2ea750b", "531c9da8c854c5b075383253a57fdd4e0be82e99" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 07 19:54:14 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 07 19:54:14 2011 -0800" }, "message": "Merge branch \u0027batman-adv/merge\u0027 of git://git.open-mesh.org/ecsv/linux-merge\n" }, { "commit": "531c9da8c854c5b075383253a57fdd4e0be82e99", "tree": "ad3cd10621d05b18b1b403f28733e0bc11b8eb8f", "parents": [ "1181e1daace88018b2ff66592aa10a4791d705ff" ], "author": { "name": "Sven Eckelmann", "email": "sven@narfation.org", "time": "Sun Feb 06 23:26:43 2011 +0000" }, "committer": { "name": "Sven Eckelmann", "email": "sven@narfation.org", "time": "Tue Feb 08 00:54:31 2011 +0100" }, "message": "batman-adv: Linearize fragment packets before merge\n\nWe access the data inside the skbs of two fragments directly using memmove\nduring the merge. The data of the skb could span over multiple skb pages. An\ndirect access without knowledge about the pages would lead to an invalid memory\naccess.\n\nSigned-off-by: Sven Eckelmann \u003csven@narfation.org\u003e\n[lindner_marek@yahoo.de: Move return from function to the end]\nSigned-off-by: Marek Lindner \u003clindner_marek@yahoo.de\u003e\n" }, { "commit": "95c3043008ca8449feb96aba5481fe31c2ea750b", "tree": "1a80c238a56c1dc22a8b962f98ee1af363186e64", "parents": [ "711c914688163dbe757c174788e20695088478e5" ], "author": { "name": "andrew hendry", "email": "andrew.hendry@gmail.com", "time": "Mon Feb 07 00:08:15 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 07 13:41:38 2011 -0800" }, "message": "x25: possible skb leak on bad facilities\n\nOriginally x25_parse_facilities returned\n-1 for an error\n 0 meaning 0 length facilities\n\u003e0 the length of the facilities parsed.\n\n5ef41308f94dc (\"x25: Prevent crashing when parsing bad X.25 facilities\") introduced more\nerror checking in x25_parse_facilities however used 0 to indicate bad parsing\na6331d6f9a429 (\"memory corruption in X.25 facilities parsing\") followed this further for\nDTE facilities, again using 0 for bad parsing.\n\nThe meaning of 0 got confused in the callers.\nIf the facilities are messed up we can\u0027t determine where the data starts.\nSo patch makes all parsing errors return -1 and ensures callers close and don\u0027t use the skb further.\n\nReported-by: Andy Whitcroft \u003capw@canonical.com\u003e\nSigned-off-by: Andrew Hendry \u003candrew.hendry@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fc7c976dc7a565213393ce700d4a6105f037bf20", "tree": "ab7b069f25f0d6ddce88be4a1c898d3101ed1c09", "parents": [ "3dd823e6b86407aed1a025041d8f1df77e43a9c8" ], "author": { "name": "Felix Fietkau", "email": "nbd@openwrt.org", "time": "Mon Feb 07 12:05:00 2011 +0100" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Feb 07 16:02:14 2011 -0500" }, "message": "mac80211: fix the skb cloned check in the tx path\n\nUsing skb_header_cloned to check if it\u0027s safe to write to the skb is not\nenough - mac80211 also touches the tailroom of the skb.\nInitially this check was only used to increase a counter, however this\ncommit changed the code to also skip skb data reallocation if no extra\nhead/tailroom was needed:\n\ncommit 4cd06a344db752f513437138953af191cbe9a691\nmac80211: skip unnecessary pskb_expand_head calls\n\nIt added a regression at least with iwl3945, which is fixed by this patch.\n\nReported-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nSigned-off-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nTested-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "44f2c5c841da1b1e0864d768197ab1497b5c2cc1", "tree": "a9e62ee30dedd31c5aeb9c1a97cb8efec5dc3398", "parents": [ "78d2978874e4e10e97dfd4fd79db45bdc0748550", "1e6d93e45b231b3ae87c01902ede2315aacfe976" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 04 13:20:01 2011 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 04 13:20:01 2011 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (68 commits)\n net: can: janz-ican3: world-writable sysfs termination file\n net: can: at91_can: world-writable sysfs files\n MAINTAINERS: update email ids of the be2net driver maintainers.\n bridge: Don\u0027t put partly initialized fdb into hash\n r8169: prevent RxFIFO induced loops in the irq handler.\n r8169: RxFIFO overflow oddities with 8168 chipsets.\n r8169: use RxFIFO overflow workaround for 8168c chipset.\n include/net/genetlink.h: Allow genlmsg_cancel to accept a NULL argument\n net: Provide compat support for SIOCGETMIFCNT_IN6 and SIOCGETSGCNT_IN6.\n net: Support compat SIOCGETVIFCNT ioctl in ipv4.\n net: Fix bug in compat SIOCGETSGCNT handling.\n niu: Fix races between up/down and get_stats.\n tcp_ecn is an integer not a boolean\n atl1c: Add missing PCI device ID\n s390: Fix possibly wrong size in strncmp (smsgiucv)\n s390: Fix wrong size in memcmp (netiucv)\n qeth: allow OSA CHPARM change in suspend state\n qeth: allow HiperSockets framesize change in suspend\n qeth: add more strict MTU checking\n qeth: show new mac-address if its setting fails\n ...\n" }, { "commit": "1158f762e57c1cdcda631c1c5f339e4853caa82b", "tree": "c4e0fa76daa3c8f37312d4de6a3fd587545e920e", "parents": [ "f60ac8e7ab7cbb413a0131d5665b053f9f386526" ], "author": { "name": "Pavel Emelyanov", "email": "xemul@openvz.org", "time": "Fri Feb 04 13:02:36 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 04 13:02:36 2011 -0800" }, "message": "bridge: Don\u0027t put partly initialized fdb into hash\n\nThe fdb_create() puts a new fdb into hash with only addr set. This is\nnot good, since there are callers, that search the hash w/o the lock\nand access all the other its fields.\n\nApplies to current netdev tree.\n\nSigned-off-by: Pavel Emelyanov \u003cxemul@openvz.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e2d57766e6744f2956975dd2086d82957187b0f6", "tree": "6d7f09ad6eaaac8ad99528cc83894faa6b230b1a", "parents": [ "ca6b8bb097c8e0ab6bce4fa04584074dee17c0d9" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 03 17:59:32 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 03 18:05:29 2011 -0800" }, "message": "net: Provide compat support for SIOCGETMIFCNT_IN6 and SIOCGETSGCNT_IN6.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ca6b8bb097c8e0ab6bce4fa04584074dee17c0d9", "tree": "4d4892f421fbe0edfb03fab640521d01c8540c52", "parents": [ "0033d5ad27a6db33a55ff39951d3ec61a8c13b89" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 03 17:24:28 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 03 17:24:28 2011 -0800" }, "message": "net: Support compat SIOCGETVIFCNT ioctl in ipv4.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0033d5ad27a6db33a55ff39951d3ec61a8c13b89", "tree": "4312ad7fb4821ccd38a4a0aba64b6bb560d53733", "parents": [ "9690c636ac118b6662f28308bee817343d9932d8" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 03 17:21:31 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 03 17:21:31 2011 -0800" }, "message": "net: Fix bug in compat SIOCGETSGCNT handling.\n\nCommit 709b46e8d90badda1898caea50483c12af178e96 (\"net: Add compat\nioctl support for the ipv4 multicast ioctl SIOCGETSGCNT\") added the\ncorrect plumbing to handle SIOCGETSGCNT properly.\n\nHowever, whilst definiting a proper \"struct compat_sioc_sg_req\" it\nisn\u0027t actually used in ipmr_compat_ioctl().\n\nCorrect this oversight.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0bc0be7f20efea664b7c4c1d0b1822bc8f53a8b4", "tree": "ead6485944f5c1db64c9f6b6dd7ef0f9e4842a67", "parents": [ "34a6ef381d402c6547aa9abb8a74b0262ae8255f", "3db7e93d3308fb882884b9f024235d6fbf542034" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 02 15:52:23 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 02 15:52:23 2011 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6\n" }, { "commit": "6d152e23ad1a7a5b40fef1f42e017d66e6115159", "tree": "c634636d5f033f0eefde9de1360624ae8972924e", "parents": [ "9b6cefd6593c2b661e0052d53f2fff6fc5463975" ], "author": { "name": "Andy Gospodarek", "email": "andy@greyhouse.net", "time": "Wed Feb 02 14:53:25 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 02 14:53:25 2011 -0800" }, "message": "gro: reset skb_iif on reuse\n\nLike Herbert\u0027s change from a few days ago:\n\n66c46d741e2e60f0e8b625b80edb0ab820c46d7a gro: Reset dev pointer on reuse\n\nthis may not be necessary at this point, but we should still clean up\nthe skb-\u003eskb_iif. If not we may end up with an invalid valid for\nskb-\u003eskb_iif when the skb is reused and the check is done in\n__netif_receive_skb.\n\nSigned-off-by: Andy Gospodarek \u003candy@greyhouse.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4334ec8518cec3f7a4feeb3dacb46acfb24904d4", "tree": "e00b87af0dc841a5bd2cf2af4fc0de7adeeaaff7", "parents": [ "ff458edc0c5ec42b299547fb7eb9790a4aecc632" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Feb 02 16:58:06 2011 +0100" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Feb 02 16:38:59 2011 -0500" }, "message": "mac80211: fix TX status cookie in HW offload case\n\nWhen the off-channel TX is done with remain-on-channel\noffloaded to hardware, the reported cookie is wrong as\nin that case we shouldn\u0027t use the SKB as the cookie but\nneed to instead use the corresponding r-o-c cookie\n(XOR\u0027ed with 2 to prevent API mismatches).\n\nFix this by keeping track of the hw_roc_skb pointer\njust for the status processing and use the correct\ncookie to report in this case. We can\u0027t use the\nhw_roc_skb pointer itself because it is NULL\u0027ed when\nthe frame is transmitted to prevent it being used\ntwice.\n\nThis fixes a bug where the P2P state machine in the\nsupplicant gets stuck because it never gets a correct\nresult for its transmitted frame.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "e733fb62082b3b187870dfba28d5f6730b8436c4", "tree": "46ae9db79569049dae5dda31e442d8694bfb2040", "parents": [ "509e7861d8a5e26bb07b5a3a13e2b9e442283631" ], "author": { "name": "Bao Liang", "email": "tim.bao@gmail.com", "time": "Sat Jan 29 21:39:37 2011 +0800" }, "committer": { "name": "Gustavo F. Padovan", "email": "padovan@profusion.mobi", "time": "Wed Feb 02 12:47:59 2011 -0200" }, "message": "Bluetooth: Set conn state to BT_DISCONN to avoid multiple responses\n\nThis patch fixes a minor issue that two connection responses will be sent\nfor one L2CAP connection request. If the L2CAP connection request is first\nblocked due to security reason and responded with reason \"security block\",\nthe state of the connection remains BT_CONNECT2. If a pairing procedure\ncompletes successfully before the ACL connection is down, local host will\nsend another connection complete response. See the following packets\ncaptured by hcidump.\n\n2010-12-07 22:21:24.928096 \u003c ACL data: handle 12 flags 0x00 dlen 16\n 0000: 0c 00 01 00 03 19 08 00 41 00 53 00 03 00 00 00 ........A.S.....\n... ...\n\n2010-12-07 22:21:35.791747 \u003e HCI Event: Auth Complete (0x06) plen 3\n status 0x00 handle 12\n... ...\n\n2010-12-07 22:21:35.872372 \u003e ACL data: handle 12 flags 0x02 dlen 16\n L2CAP(s): Connect rsp: dcid 0x0054 scid 0x0040 result 0 status 0\n Connection successful\n\nSigned-off-by: Liang Bao \u003ctim.bao@gmail.com\u003e\nAcked-by: Ville Tervo \u003cville.tervo@nokia.com\u003e\nSigned-off-by: Gustavo F. Padovan \u003cpadovan@profusion.mobi\u003e\n" }, { "commit": "3db7e93d3308fb882884b9f024235d6fbf542034", "tree": "6488a45704107f77645774c85d67511b7a73fed1", "parents": [ "9d0db8b6b1da9e3d4c696ef29449700c58d589db" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Feb 01 16:06:30 2011 +0100" }, "committer": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Tue Feb 01 16:06:30 2011 +0100" }, "message": "netfilter: ecache: always set events bits, filter them later\n\nFor the following rule:\n\niptables -I PREROUTING -t raw -j CT --ctevents assured\n\nThe event delivered looks like the following:\n\n [UPDATE] tcp 6 src\u003d192.168.0.2 dst\u003d192.168.1.2 sport\u003d37041 dport\u003d80 src\u003d192.168.1.2 dst\u003d192.168.1.100 sport\u003d80 dport\u003d37041 [ASSURED]\n\nNote that the TCP protocol state is not included. For that reason\nthe CT event filtering is not very useful for conntrackd.\n\nTo resolve this issue, instead of conditionally setting the CT events\nbits based on the ctmask, we always set them and perform the filtering\nin the late stage, just before the delivery.\n\nThus, the event delivered looks like the following:\n\n [UPDATE] tcp 6 432000 ESTABLISHED src\u003d192.168.0.2 dst\u003d192.168.1.2 sport\u003d37041 dport\u003d80 src\u003d192.168.1.2 dst\u003d192.168.1.100 sport\u003d80 dport\u003d37041 [ASSURED]\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\n" }, { "commit": "9d0db8b6b1da9e3d4c696ef29449700c58d589db", "tree": "f3fcf8325e523810c1ec70437b291b5ac8b74bfa", "parents": [ "08b5194b5d6485d12ebf24cf6ee389fc55691122" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Feb 01 16:03:46 2011 +0100" }, "committer": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Tue Feb 01 16:03:46 2011 +0100" }, "message": "netfilter: arpt_mangle: fix return values of checkentry\n\nIn 135367b \"netfilter: xtables: change xt_target.checkentry return type\",\nthe type returned by checkentry was changed from boolean to int, but the\nreturn values where not adjusted.\n\narptables: Input/output error\n\nThis broke arptables with the mangle target since it returns true\nunder success, which is interpreted by xtables as \u003e0, thus\nreturning EIO.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\n" }, { "commit": "bf36076a67db6d7423d09d861a072337866f0dd9", "tree": "39d1b95a07d47b69f0e807461427e74b8f340af9", "parents": [ "785e8cc39baf31d5c18a2d198ded03a003c9c190" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Mon Jan 31 20:54:17 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 31 20:54:17 2011 -0800" }, "message": "net: Fix ipv6 neighbour unregister_sysctl_table warning\n\nIn my testing of 2.6.37 I was occassionally getting a warning about\nsysctl table entries being unregistered in the wrong order. Digging\nin it turns out this dates back to the last great sysctl reorg done\nwhere Al Viro introduced the requirement that sysctl directories\nneeded to be created before and destroyed after the files in them.\n\nIt turns out that in that great reorg /proc/sys/net/ipv6/neigh was\noverlooked. So this patch fixes that oversight and makes an annoying\nwarning message go away.\n\n\u003e------------[ cut here ]------------\n\u003eWARNING: at kernel/sysctl.c:1992 unregister_sysctl_table+0x134/0x164()\n\u003ePid: 23951, comm: kworker/u:3 Not tainted 2.6.37-350888.2010AroraKernelBeta.fc14.x86_64 #1\n\u003eCall Trace:\n\u003e [\u003cffffffff8103e034\u003e] warn_slowpath_common+0x80/0x98\n\u003e [\u003cffffffff8103e061\u003e] warn_slowpath_null+0x15/0x17\n\u003e [\u003cffffffff810452f8\u003e] unregister_sysctl_table+0x134/0x164\n\u003e [\u003cffffffff810e7834\u003e] ? kfree+0xc4/0xd1\n\u003e [\u003cffffffff813439b2\u003e] neigh_sysctl_unregister+0x22/0x3a\n\u003e [\u003cffffffffa02cd14e\u003e] addrconf_ifdown+0x33f/0x37b [ipv6]\n\u003e [\u003cffffffff81331ec2\u003e] ? skb_dequeue+0x5f/0x6b\n\u003e [\u003cffffffffa02ce4a5\u003e] addrconf_notify+0x69b/0x75c [ipv6]\n\u003e [\u003cffffffffa02eb953\u003e] ? ip6mr_device_event+0x98/0xa9 [ipv6]\n\u003e [\u003cffffffff813d2413\u003e] notifier_call_chain+0x32/0x5e\n\u003e [\u003cffffffff8105bdea\u003e] raw_notifier_call_chain+0xf/0x11\n\u003e [\u003cffffffff8133cdac\u003e] call_netdevice_notifiers+0x45/0x4a\n\u003e [\u003cffffffff8133d2b0\u003e] rollback_registered_many+0x118/0x201\n\u003e [\u003cffffffff8133d3af\u003e] unregister_netdevice_many+0x16/0x6d\n\u003e [\u003cffffffff8133d571\u003e] default_device_exit_batch+0xa4/0xb8\n\u003e [\u003cffffffff81337c42\u003e] ? cleanup_net+0x0/0x194\n\u003e [\u003cffffffff81337a2a\u003e] ops_exit_list+0x4e/0x56\n\u003e [\u003cffffffff81337d36\u003e] cleanup_net+0xf4/0x194\n\u003e [\u003cffffffff81053318\u003e] process_one_work+0x187/0x280\n\u003e [\u003cffffffff8105441b\u003e] worker_thread+0xff/0x19f\n\u003e [\u003cffffffff8105431c\u003e] ? worker_thread+0x0/0x19f\n\u003e [\u003cffffffff8105776d\u003e] kthread+0x7d/0x85\n\u003e [\u003cffffffff81003824\u003e] kernel_thread_helper+0x4/0x10\n\u003e [\u003cffffffff810576f0\u003e] ? kthread+0x0/0x85\n\u003e [\u003cffffffff81003820\u003e] ? kernel_thread_helper+0x0/0x10\n\u003e---[ end trace 8a7e9310b35e9486 ]---\n\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8587523640441a9ff2564ebc6efeb39497ad6709", "tree": "c42ae4809263f9db59ee0721eb03e1b9b18fb0b1", "parents": [ "cc09b5f6466528867b280f6eb4077311aa099588" ], "author": { "name": "Tom Herbert", "email": "therbert@google.com", "time": "Mon Jan 31 16:23:42 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 31 16:23:42 2011 -0800" }, "message": "net: Check rps_flow_table when RPS map length is 1\n\nIn get_rps_cpu, add check that the rps_flow_table for the device is\nNULL when trying to take fast path when RPS map length is one.\nWithout this, RFS is effectively disabled if map length is one which\nis not correct.\n\nSigned-off-by: Tom Herbert \u003ctherbert@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0fd08c5545a806c960a6597fae4a2e656eb7ead9", "tree": "027dfcc65f600afe6a4b19ab72c472fe3f0f24fa", "parents": [ "7921127e297ea203b794c4a1c3ef3eb0ee52acbf", "d1205f87bbb8040c1408bbd9e0a720310b2b0b9b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Feb 01 09:41:02 2011 +1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Feb 01 09:41:02 2011 +1000" }, "message": "Merge branch \u0027bugfixes\u0027 of git://git.linux-nfs.org/projects/trondmy/nfs-2.6\n\n* \u0027bugfixes\u0027 of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:\n NFS: NFSv4 readdir loses entries\n NFS: Micro-optimize nfs4_decode_dirent()\n NFS: Fix an NFS client lockdep issue\n NFS construct consistent co_ownerid for v4.1\n NFS: nfs_wcc_update_inode() should set nfsi-\u003eattr_gencount\n NFS improve pnfs_put_deviceid_cache debug print\n NFS fix cb_sequence error processing\n NFS do not find client in NFSv4 pg_authenticate\n NLM: Fix \"kernel BUG at fs/lockd/host.c:417!\" or \".../host.c:283!\"\n NFS: Prevent memory allocation failure in nfsacl_encode()\n NFS: nfsacl_{encode,decode} should return signed integer\n NFS: Fix \"kernel BUG at fs/nfs/nfs3xdr.c:1338!\"\n NFS: Fix \"kernel BUG at fs/aio.c:554!\"\n NFS4: Avoid potential NULL pointer dereference in decode_and_add_ds().\n NFS: fix handling of malloc failure during nfs_flush_multi()\n" }, { "commit": "ec831ea72ee5d7d473899e27a86bd659482c4d0d", "tree": "9bce912eff9cc0aaeb1f47659e99f1d6c9951f80", "parents": [ "c4c93106741bbf61ecd05a2a835af8e3bf31c1bd" ], "author": { "name": "Roland Dreier", "email": "roland@purestorage.com", "time": "Mon Jan 31 13:16:00 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 31 13:16:00 2011 -0800" }, "message": "net: Add default_mtu() methods to blackhole dst_ops\n\nWhen an IPSEC SA is still being set up, __xfrm_lookup() will return\n-EREMOTE and so ip_route_output_flow() will return a blackhole route.\nThis can happen in a sndmsg call, and after d33e455337ea (\"net: Abstract\ndefault MTU metric calculation behind an accessor.\") this leads to a\ncrash in ip_append_data() because the blackhole dst_ops have no\ndefault_mtu() method and so dst_mtu() calls a NULL pointer.\n\nFix this by adding default_mtu() methods (that simply return 0, matching\nthe old behavior) to the blackhole dst_ops.\n\nThe IPv4 part of this patch fixes a crash that I saw when using an IPSEC\nVPN; the IPv6 part is untested because I don\u0027t have an IPv6 VPN, but it\nlooks to be needed as well.\n\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "81c2bdb68855b29a4339313a6f0d07791b663ce7", "tree": "b8eac6dd767ab805989fb8a935adf3d7ebca995e", "parents": [ "709b46e8d90badda1898caea50483c12af178e96", "1181e1daace88018b2ff66592aa10a4791d705ff" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 30 22:16:34 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 30 22:16:34 2011 -0800" }, "message": "Merge branch \u0027batman-adv/merge-oopsonly\u0027 of git://git.open-mesh.org/ecsv/linux-merge\n" }, { "commit": "1181e1daace88018b2ff66592aa10a4791d705ff", "tree": "7cea108c5063c61b74904070396c98c4b1bf29fa", "parents": [ "dda9fc6b2c59f056e7a2b313b8423b14a4df25a9" ], "author": { "name": "Sven Eckelmann", "email": "sven@narfation.org", "time": "Fri Jan 28 18:34:07 2011 +0100" }, "committer": { "name": "Sven Eckelmann", "email": "sven@narfation.org", "time": "Sun Jan 30 10:32:08 2011 +0100" }, "message": "batman-adv: Make vis info stack traversal threadsafe\n\nThe batman-adv vis server has to a stack which stores all information\nabout packets which should be send later. This stack is protected\nwith a spinlock that is used to prevent concurrent write access to it.\n\nThe send_vis_packets function has to take all elements from the stack\nand send them to other hosts over the primary interface. The send will\nbe initiated without the lock which protects the stack.\n\nThe implementation using list_for_each_entry_safe has the problem that\nit stores the next element as \"safe ptr\" to allow the deletion of the\ncurrent element in the list. The list may be modified during the\nunlock/lock pair in the loop body which may make the safe pointer\nnot pointing to correct next element.\n\nIt is safer to remove and use the first element from the stack until no\nelements are available. This does not need reduntant information which\nwould have to be validated each time the lock was removed.\n\nReported-by: Russell Senior \u003crussell@personaltelco.net\u003e\nSigned-off-by: Sven Eckelmann \u003csven@narfation.org\u003e\n" }, { "commit": "dda9fc6b2c59f056e7a2b313b8423b14a4df25a9", "tree": "0ad7d73e862e92d26b30b857f3ffa958f2637912", "parents": [ "2674c15870f888cb732a564fc504ce17654afc64" ], "author": { "name": "Sven Eckelmann", "email": "sven@narfation.org", "time": "Fri Jan 28 18:34:06 2011 +0100" }, "committer": { "name": "Sven Eckelmann", "email": "sven@narfation.org", "time": "Sun Jan 30 10:32:06 2011 +0100" }, "message": "batman-adv: Remove vis info element in free_info\n\nThe free_info function will be called when no reference to the info\nobject exists anymore. It must be ensured that the allocated memory\ngets freed and not only the elements which are managed by the info\nobject.\n\nSigned-off-by: Sven Eckelmann \u003csven@narfation.org\u003e\n" }, { "commit": "2674c15870f888cb732a564fc504ce17654afc64", "tree": "98ae97713077307ee1f56ec5de362b53f8e3186d", "parents": [ "dd58ddc6928f711d8fb7101182215a0f23cf41f1" ], "author": { "name": "Sven Eckelmann", "email": "sven@narfation.org", "time": "Fri Jan 28 18:34:05 2011 +0100" }, "committer": { "name": "Sven Eckelmann", "email": "sven@narfation.org", "time": "Sun Jan 30 10:32:02 2011 +0100" }, "message": "batman-adv: Remove vis info on hashing errors\n\nA newly created vis info object must be removed when it couldn\u0027t be\nadded to the hash. The old_info which has to be replaced was already\nremoved and isn\u0027t related to the hash anymore.\n\nSigned-off-by: Sven Eckelmann \u003csven@narfation.org\u003e\n" }, { "commit": "709b46e8d90badda1898caea50483c12af178e96", "tree": "799b57704dda3684777fb57a6e413dabac78858c", "parents": [ "13ad17745c2cbd437d9e24b2d97393e0be11c439" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Sat Jan 29 16:15:56 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 30 01:14:38 2011 -0800" }, "message": "net: Add compat ioctl support for the ipv4 multicast ioctl SIOCGETSGCNT\n\nSIOCGETSGCNT is not a unique ioctl value as it it maps tio SIOCPROTOPRIVATE +1,\nwhich unfortunately means the existing infrastructure for compat networking\nioctls is insufficient. A trivial compact ioctl implementation would conflict\nwith:\n\nSIOCAX25ADDUID\nSIOCAIPXPRISLT\nSIOCGETSGCNT_IN6\nSIOCGETSGCNT\nSIOCRSSCAUSE\nSIOCX25SSUBSCRIP\nSIOCX25SDTEFACILITIES\n\nTo make this work I have updated the compat_ioctl decode path to mirror the\nthe normal ioctl decode path. I have added an ipv4 inet_compat_ioctl function\nso that I can have ipv4 specific compat ioctls. I have added a compat_ioctl\nfunction into struct proto so I can break out ioctls by which kind of ip socket\nI am using. I have added a compat_raw_ioctl function because SIOCGETSGCNT only\nworks on raw sockets. I have added a ipmr_compat_ioctl that mirrors the normal\nipmr_ioctl.\n\nThis was necessary because unfortunately the struct layout for the SIOCGETSGCNT\nhas unsigned longs in it so changes between 32bit and 64bit kernels.\n\nThis change was sufficient to run a 32bit ip multicast routing daemon on a\n64bit kernel.\n\nReported-by: Bill Fenner \u003cfenner@aristanetworks.com\u003e\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "13ad17745c2cbd437d9e24b2d97393e0be11c439", "tree": "bb33ca241dc6586f003e36ba822a2e98f8e30786", "parents": [ "52fe7c9cc1637110ba4e0e6fe5d07cc0786d62de" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Sat Jan 29 14:57:22 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 30 01:14:15 2011 -0800" }, "message": "net: Fix ip link add netns oops\n\nEd Swierk \u003ceswierk@bigswitch.com\u003e writes:\n\u003e On 2.6.35.7\n\u003e ip link add link eth0 netns 9999 type macvlan\n\u003e where 9999 is a nonexistent PID triggers an oops and causes all network functions to hang:\n\u003e [10663.821898] BUG: unable to handle kernel NULL pointer dereference at 000000000000006d\n\u003e [10663.821917] IP: [\u003cffffffff8149c2fa\u003e] __dev_alloc_name+0x9a/0x170\n\u003e [10663.821933] PGD 1d3927067 PUD 22f5c5067 PMD 0\n\u003e [10663.821944] Oops: 0000 [#1] SMP\n\u003e [10663.821953] last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq\n\u003e [10663.821959] CPU 3\n\u003e [10663.821963] Modules linked in: macvlan ip6table_filter ip6_tables rfcomm ipt_MASQUERADE binfmt_misc iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack sco ipt_REJECT bnep l2cap xt_tcpudp iptable_filter ip_tables x_tables bridge stp vboxnetadp vboxnetflt vboxdrv kvm_intel kvm parport_pc ppdev snd_hda_codec_intelhdmi snd_hda_codec_conexant arc4 iwlagn iwlcore mac80211 snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi i915 snd_seq_midi_event snd_seq thinkpad_acpi drm_kms_helper btusb tpm_tis nvram uvcvideo snd_timer snd_seq_device bluetooth videodev v4l1_compat v4l2_compat_ioctl32 tpm drm tpm_bios snd cfg80211 psmouse serio_raw intel_ips soundcore snd_page_alloc intel_agp i2c_algo_bit video output netconsole configfs lp parport usbhid hid e1000e sdhci_pci ahci libahci sdhci led_class\n\u003e [10663.822155]\n\u003e [10663.822161] Pid: 6000, comm: ip Not tainted 2.6.35-23-generic #41-Ubuntu 2901CTO/2901CTO\n\u003e [10663.822167] RIP: 0010:[\u003cffffffff8149c2fa\u003e] [\u003cffffffff8149c2fa\u003e] __dev_alloc_name+0x9a/0x170\n\u003e [10663.822177] RSP: 0018:ffff88014aebf7b8 EFLAGS: 00010286\n\u003e [10663.822182] RAX: 00000000fffffff4 RBX: ffff8801ad900800 RCX: 0000000000000000\n\u003e [10663.822187] RDX: ffff880000000000 RSI: 0000000000000000 RDI: ffff88014ad63000\n\u003e [10663.822191] RBP: ffff88014aebf808 R08: 0000000000000041 R09: 0000000000000041\n\u003e [10663.822196] R10: 0000000000000000 R11: dead000000200200 R12: ffff88014aebf818\n\u003e [10663.822201] R13: fffffffffffffffd R14: ffff88014aebf918 R15: ffff88014ad62000\n\u003e [10663.822207] FS: 00007f00c487f700(0000) GS:ffff880001f80000(0000) knlGS:0000000000000000\n\u003e [10663.822212] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n\u003e [10663.822216] CR2: 000000000000006d CR3: 0000000231f19000 CR4: 00000000000026e0\n\u003e [10663.822221] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n\u003e [10663.822226] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n\u003e [10663.822231] Process ip (pid: 6000, threadinfo ffff88014aebe000, task ffff88014afb16e0)\n\u003e [10663.822236] Stack:\n\u003e [10663.822240] ffff88014aebf808 ffffffff814a2bb5 ffff88014aebf7e8 00000000a00ee8d6\n\u003e [10663.822251] \u003c0\u003e 0000000000000000 ffffffffa00ef940 ffff8801ad900800 ffff88014aebf818\n\u003e [10663.822265] \u003c0\u003e ffff88014aebf918 ffff8801ad900800 ffff88014aebf858 ffffffff8149c413\n\u003e [10663.822281] Call Trace:\n\u003e [10663.822290] [\u003cffffffff814a2bb5\u003e] ? dev_addr_init+0x75/0xb0\n\u003e [10663.822298] [\u003cffffffff8149c413\u003e] dev_alloc_name+0x43/0x90\n\u003e [10663.822307] [\u003cffffffff814a85ee\u003e] rtnl_create_link+0xbe/0x1b0\n\u003e [10663.822314] [\u003cffffffff814ab2aa\u003e] rtnl_newlink+0x48a/0x570\n\u003e [10663.822321] [\u003cffffffff814aafcc\u003e] ? rtnl_newlink+0x1ac/0x570\n\u003e [10663.822332] [\u003cffffffff81030064\u003e] ? native_x2apic_icr_read+0x4/0x20\n\u003e [10663.822339] [\u003cffffffff814a8c17\u003e] rtnetlink_rcv_msg+0x177/0x290\n\u003e [10663.822346] [\u003cffffffff814a8aa0\u003e] ? rtnetlink_rcv_msg+0x0/0x290\n\u003e [10663.822354] [\u003cffffffff814c25d9\u003e] netlink_rcv_skb+0xa9/0xd0\n\u003e [10663.822360] [\u003cffffffff814a8a85\u003e] rtnetlink_rcv+0x25/0x40\n\u003e [10663.822367] [\u003cffffffff814c223e\u003e] netlink_unicast+0x2de/0x2f0\n\u003e [10663.822374] [\u003cffffffff814c303e\u003e] netlink_sendmsg+0x1fe/0x2e0\n\u003e [10663.822383] [\u003cffffffff81488533\u003e] sock_sendmsg+0xf3/0x120\n\u003e [10663.822391] [\u003cffffffff815899fe\u003e] ? _raw_spin_lock+0xe/0x20\n\u003e [10663.822400] [\u003cffffffff81168656\u003e] ? __d_lookup+0x136/0x150\n\u003e [10663.822406] [\u003cffffffff815899fe\u003e] ? _raw_spin_lock+0xe/0x20\n\u003e [10663.822414] [\u003cffffffff812b7a0d\u003e] ? _atomic_dec_and_lock+0x4d/0x80\n\u003e [10663.822422] [\u003cffffffff8116ea90\u003e] ? mntput_no_expire+0x30/0x110\n\u003e [10663.822429] [\u003cffffffff81486ff5\u003e] ? move_addr_to_kernel+0x65/0x70\n\u003e [10663.822435] [\u003cffffffff81493308\u003e] ? verify_iovec+0x88/0xe0\n\u003e [10663.822442] [\u003cffffffff81489020\u003e] sys_sendmsg+0x240/0x3a0\n\u003e [10663.822450] [\u003cffffffff8111e2a9\u003e] ? __do_fault+0x479/0x560\n\u003e [10663.822457] [\u003cffffffff815899fe\u003e] ? _raw_spin_lock+0xe/0x20\n\u003e [10663.822465] [\u003cffffffff8116cf4a\u003e] ? alloc_fd+0x10a/0x150\n\u003e [10663.822473] [\u003cffffffff8158d76e\u003e] ? do_page_fault+0x15e/0x350\n\u003e [10663.822482] [\u003cffffffff8100a0f2\u003e] system_call_fastpath+0x16/0x1b\n\u003e [10663.822487] Code: 90 48 8d 78 02 be 25 00 00 00 e8 92 1d e2 ff 48 85 c0 75 cf bf 20 00 00 00 e8 c3 b1 c6 ff 49 89 c7 b8 f4 ff ff ff 4d 85 ff 74 bd \u003c4d\u003e 8b 75 70 49 8d 45 70 48 89 45 b8 49 83 ee 58 eb 28 48 8d 55\n\u003e [10663.822618] RIP [\u003cffffffff8149c2fa\u003e] __dev_alloc_name+0x9a/0x170\n\u003e [10663.822627] RSP \u003cffff88014aebf7b8\u003e\n\u003e [10663.822631] CR2: 000000000000006d\n\u003e [10663.822636] ---[ end trace 3dfd6c3ad5327ca7 ]---\n\nThis bug was introduced in:\ncommit 81adee47dfb608df3ad0b91d230fb3cef75f0060\nAuthor: Eric W. Biederman \u003cebiederm@aristanetworks.com\u003e\nDate: Sun Nov 8 00:53:51 2009 -0800\n\n net: Support specifying the network namespace upon device creation.\n\n There is no good reason to not support userspace specifying the\n network namespace during device creation, and it makes it easier\n to create a network device and pass it to a child network namespace\n with a well known name.\n\n We have to be careful to ensure that the target network namespace\n for the new device exists through the life of the call. To keep\n that logic clear I have factored out the network namespace grabbing\n logic into rtnl_link_get_net.\n\n In addtion we need to continue to pass the source network namespace\n to the rtnl_link_ops.newlink method so that we can find the base\n device source network namespace.\n\n Signed-off-by: Eric W. Biederman \u003cebiederm@aristanetworks.com\u003e\n Acked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\n\nWhere apparently I forgot to add error handling to the path where we create\na new network device in a new network namespace, and pass in an invalid pid.\n\nCc: stable@kernel.org\nReported-by: Ed Swierk \u003ceswierk@bigswitch.com\u003e\nSigned-off-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "66c46d741e2e60f0e8b625b80edb0ab820c46d7a", "tree": "999a13b5384d57e9548798b36c4316b271fdeae6", "parents": [ "8f2771f2b85aea4d0f9a0137ad3b63d1173c0962" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Sat Jan 29 20:44:54 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Jan 29 22:36:24 2011 -0800" }, "message": "gro: Reset dev pointer on reuse\n\nOn older kernels the VLAN code may zero skb-\u003edev before dropping\nit and causing it to be reused by GRO.\n\nUnfortunately we didn\u0027t reset skb-\u003edev in that case which causes\nthe next GRO user to get a bogus skb-\u003edev pointer.\n\nThis particular problem no longer happens with the current upstream\nkernel due to changes in VLAN processing.\n\nHowever, for correctness we should still reset the skb-\u003edev pointer\nin the GRO reuse function in case a future user does the same thing.\n\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8f2771f2b85aea4d0f9a0137ad3b63d1173c0962", "tree": "b632e0a811dee0637017d6f024e5efade412f0d1", "parents": [ "c2aa3665cf8510b1665ee2f5a9525cf7be6dec4f" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 27 14:55:22 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 27 14:55:22 2011 -0800" }, "message": "ipv6: Remove route peer binding assertions.\n\nThey are bogus. The basic idea is that I wanted to make sure\nthat prefixed routes never bind to peers.\n\nThe test I used was whether RTF_CACHE was set.\n\nBut first of all, the RTF_CACHE flag is set at different spots\ndepending upon which ip6_rt_copy() caller you\u0027re talking about.\n\nI\u0027ve validated all of the code paths, and even in the future\nwhere we bind peers more aggressively (for route metric COW\u0027ing)\nwe never bind to prefix\u0027d routes, only fully specified ones.\nThis even applies when addrconf or icmp6 routes are allocated.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c2aa3665cf8510b1665ee2f5a9525cf7be6dec4f", "tree": "0f4443e66b7b93ba60264b1ce51d3f3057eb74b2", "parents": [ "6d3a9a685465986d7653c5abbc0b24681e7c44d7" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Tue Jan 25 23:18:38 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 27 14:41:06 2011 -0800" }, "message": "net: add kmemcheck annotation in __alloc_skb()\n\npskb_expand_head() triggers a kmemcheck warning when copy of\nskb_shared_info is done in pskb_expand_head()\n\nThis is because destructor_arg field is not necessarily initialized at\nthis point. Add kmemcheck_annotate_variable() call in __alloc_skb() to\ninstruct kmemcheck this is a normal situation.\n\nResolves bugzilla.kernel.org 27212\n\nReference: https://bugzilla.kernel.org/show_bug.cgi?id\u003d27212\nReported-by: Christian Casteyde \u003ccasteyde.christian@free.fr\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCC: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6d3a9a685465986d7653c5abbc0b24681e7c44d7", "tree": "97bc128d9c8c7001d8eb97fe8a1ed34f755b967e", "parents": [ "9eb710797a21fa4a9e09ae9c86c4b3ec9d291c2d" ], "author": { "name": "Kurt Van Dijck", "email": "kurt.van.dijck@eia.be", "time": "Wed Jan 26 04:55:24 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 27 14:39:21 2011 -0800" }, "message": "net: fix validate_link_af in rtnetlink core\n\nI\u0027m testing an API that uses IFLA_AF_SPEC attribute.\nIn the rtnetlink core , the set_link_af() member\nof the rtnl_af_ops struct receives the nested attribute\n(as I expected), but the validate_link_af() member\nreceives the parent attribute.\nIMO, this patch fixes this.\n\nSigned-off-by: Kurt Van Dijck \u003ckurt.van.dijck@eia.be\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "389f2a18c6a2a5531ac5a155c3ba25784065b1cb", "tree": "545f2dfc66e580b75ad7c6442e910e0821159bcb", "parents": [ "4bb9ebc78097376b3734c6d3001a96aecac0f7bb" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed Jan 26 00:04:18 2011 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 27 14:15:54 2011 -0800" }, "message": "econet: remove compiler warnings\n\nnet/econet/af_econet.c: In function ‘econet_sendmsg’:\nnet/econet/af_econet.c:494: warning: label ‘error’ defined but not used\nnet/econet/af_econet.c:268: warning: unused variable ‘sk’\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nAcked-by: Phil Blundell \u003cphilb@gnu.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7cc2edb83447775a34ed3bf9d29d8295a434b523", "tree": "cdcbae599c95d6902fcb29989c75810b08f04707", "parents": [ "34c92049ac15dcb731dc455d165b4c3c1df569cf" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 26 13:41:03 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 26 13:41:03 2011 -0800" }, "message": "xfrm6: Don\u0027t forget to propagate peer into ipsec route.\n\nLike ipv4, we have to propagate the ipv6 route peer into\nthe ipsec top-level route during instantiation.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9b6941d8b103fe95d1a90b7996046be9ee0e55e4", "tree": "03c4e26abb8d6212741c3821061f2f40f2b5c8ec", "parents": [ "de221bd5eb5e754806fcc39c40bb12b96515d9c5", "acd9f9cc305ca2e5da2a39f6f6160cd4b476e38b" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 26 11:49:49 2011 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 26 11:49:49 2011 -0800" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6\n" }, { "commit": "dd58ddc6928f711d8fb7101182215a0f23cf41f1", "tree": "7c5707c51d817e27e795bb77c5da9fe0c2fbc345", "parents": [ "aa0adb1a85e159cf57f0e11282bc6c9e3606a5f3" ], "author": { "name": "Linus Lüssing", "email": "linus.luessing@web.de", "time": "Tue Jan 25 21:56:16 2011 +0000" }, "committer": { "name": "Sven Eckelmann", "email": "sven@narfation.org", "time": "Tue Jan 25 23:58:33 2011 +0100" }, "message": "batman-adv: Fix kernel panic when fetching vis data on a vis server\n\nThe hash_iterate removal introduced a bug leading to a kernel panic when\nfetching the vis data on a vis server. That commit forgot to rename one\nvariable name, which this commit fixes now.\n\nReported-by: Russell Senior \u003crussell@personaltelco.net\u003e\nSigned-off-by: Linus Lüssing \u003clinus.luessing@web.de\u003e\nSigned-off-by: Sven Eckelmann \u003csven@narfation.org\u003e\n" } ], "next": "44f5324b5d13ef2187729d949eca442689627f39" }