)]}' { "log": [ { "commit": "af1860122000cf090868fb7f7fbba7417e4575bd", "tree": "7b4b78cfbb68a81cb1463aaac0faa1b46e4052ec", "parents": [ "893238186e35bdd59efde4572bcb6d0653c0ec65" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Wed Mar 13 21:25:35 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:54 2013 -0700" }, "message": "tracing: Fix stack tracer with fentry use\n\ncommit d4ecbfc49b4b1d4b597fb5ba9e4fa25d62f105c5 upstream.\n\nWhen gcc 4.6 on x86 is used, the function tracer will use the new\noption -mfentry which does a call to \"fentry\" at every function\ninstead of \"mcount\". The significance of this is that fentry is\ncalled as the first operation of the function instead of the mcount\nusage of being called after the stack.\n\nThis causes the stack tracer to show some bogus results for the size\nof the last function traced, as well as showing \"ftrace_call\" instead\nof the function. This is due to the stack frame not being set up\nby the function that is about to be traced.\n\n # cat stack_trace\n Depth Size Location (48 entries)\n ----- ---- --------\n 0) 4824 216 ftrace_call+0x5/0x2f\n 1) 4608 112 ____cache_alloc+0xb7/0x22d\n 2) 4496 80 kmem_cache_alloc+0x63/0x12f\n\nThe 216 size for ftrace_call includes both the ftrace_call stack\n(which includes the saving of registers it does), as well as the\nstack size of the parent.\n\nTo fix this, if CC_USING_FENTRY is defined, then the stack_tracer\nwill reserve the first item in stack_dump_trace[] array when\ncalling save_stack_trace(), and it will fill it in with the parent ip.\nThen the code will look for the parent pointer on the stack and\ngive the real size of the parent\u0027s stack pointer:\n\n # cat stack_trace\n Depth Size Location (14 entries)\n ----- ---- --------\n 0) 2640 48 update_group_power+0x26/0x187\n 1) 2592 224 update_sd_lb_stats+0x2a5/0x4ac\n 2) 2368 160 find_busiest_group+0x31/0x1f1\n 3) 2208 256 load_balance+0xd9/0x662\n\nI\u0027m Cc\u0027ing stable, although it\u0027s not urgent, as it only shows bogus\nsize for item #0, the rest of the trace is legit. It should still be\ncorrected in previous stable releases.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "893238186e35bdd59efde4572bcb6d0653c0ec65", "tree": "4da26b69bc9c3432a7a77c653f882ccd2ced8424", "parents": [ "a393520aa653a5e1133e14a1984b5e5815e01cf6" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Wed Mar 13 20:43:57 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:54 2013 -0700" }, "message": "tracing: Use stack of calling function for stack tracer\n\ncommit 87889501d0adfae10e3b0f0e6f2d7536eed9ae84 upstream.\n\nUse the stack of stack_trace_call() instead of check_stack() as\nthe test pointer for max stack size. It makes it a bit cleaner\nand a little more accurate.\n\nAdding stable, as a later fix depends on this patch.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a393520aa653a5e1133e14a1984b5e5815e01cf6", "tree": "f9fca8e0c38bfc48a43758f4ed79656c37d3d3ce", "parents": [ "ce5b62fd947369813666074f725aa0c1d819fc29" ], "author": { "name": "Mika Kuoppala", "email": "mika.kuoppala@linux.intel.com", "time": "Mon Apr 22 14:19:26 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:53 2013 -0700" }, "message": "fbcon: when font is freed, clear also vc_font.data\n\ncommit e6637d5427d2af9f3f33b95447bfc5347e5ccd85 upstream.\n\ncommit ae1287865f5361fa138d4d3b1b6277908b54eac9\nAuthor: Dave Airlie \u003cairlied@redhat.com\u003e\nDate: Thu Jan 24 16:12:41 2013 +1000\n\n fbcon: don\u0027t lose the console font across generic-\u003echip driver switch\n\nuses a pointer in vc-\u003evc_font.data to load font into the new driver.\nHowever if the font is actually freed, we need to clear the data\nso that we don\u0027t reload font from dangling pointer.\n\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id\u003d892340\nSigned-off-by: Mika Kuoppala \u003cmika.kuoppala@intel.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ce5b62fd947369813666074f725aa0c1d819fc29", "tree": "a1ea9a71634b7146ea63a645db1a46aa208779d2", "parents": [ "8370884e1b78a1aa1c4c80872cea22c0269b93bd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 07:32:21 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:53 2013 -0700" }, "message": "tty: fix up atime/mtime mess, take three\n\ncommit b0b885657b6c8ef63a46bc9299b2a7715d19acde upstream.\n\nWe first tried to avoid updating atime/mtime entirely (commit\nb0de59b5733d: \"TTY: do not update atime/mtime on read/write\"), and then\nlimited it to only update it occasionally (commit 37b7f3c76595: \"TTY:\nfix atime/mtime regression\"), but it turns out that this was both\ninsufficient and overkill.\n\nIt was insufficient because we let people attach to the shared ptmx node\nto see activity without even reading atime/mtime, and it was overkill\nbecause the \"only once a minute\" means that you can\u0027t really tell an\nidle person from an active one with \u0027w\u0027.\n\nSo this tries to fix the problem properly. It marks the shared ptmx\nnode as un-notifiable, and it lowers the \"only once a minute\" to a few\nseconds instead - still long enough that you can\u0027t time individual\nkeystrokes, but short enough that you can tell whether somebody is\nactive or not.\n\nReported-by: Simon Kirby \u003csim@hostway.ca\u003e\nAcked-by: Jiri Slaby \u003cjslaby@suse.cz\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8370884e1b78a1aa1c4c80872cea22c0269b93bd", "tree": "b4f512030b5f00f4963faea0dc9ed6860d7f003d", "parents": [ "0907fdff86010806099f872de9fff2b86d6b18fe" ], "author": { "name": "Richard Cochran", "email": "richardcochran@gmail.com", "time": "Mon Apr 22 19:42:16 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:53 2013 -0700" }, "message": "gianfar: do not advertise any alarm capability.\n\ncommit cd4baaaa04b4aaa3b0ec4d13a6f3d203b92eadbd upstream.\n\nAn early draft of the PHC patch series included an alarm in the\ngianfar driver. During the review process, the alarm code was dropped,\nbut the capability removal was overlooked. This patch fixes the issue\nby advertising zero alarms.\n\nThis patch should be applied to every 3.x stable kernel.\n\nSigned-off-by: Richard Cochran \u003crichardcochran@gmail.com\u003e\nReported-by: Chris LaRocque \u003cclarocq@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0907fdff86010806099f872de9fff2b86d6b18fe", "tree": "86879a15384eeeca368a1af6bb1608ddf56b8437", "parents": [ "be2300f0961d43c4d92f2a7aa716811383ebbeb2" ], "author": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Mon Apr 29 15:07:45 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:53 2013 -0700" }, "message": "arm: set the page table freeing ceiling to TASK_SIZE\n\ncommit 104ad3b32d7a71941c8ab2dee78eea38e8a23309 upstream.\n\nARM processors with LPAE enabled use 3 levels of page tables, with an\nentry in the top level (pgd) covering 1GB of virtual space. Because of\nthe branch relocation limitations on ARM, the loadable modules are\nmapped 16MB below PAGE_OFFSET, making the corresponding 1GB pgd shared\nbetween kernel modules and user space.\n\nIf free_pgtables() is called with the default ceiling 0,\nfree_pgd_range() (and subsequently called functions) also frees the page\ntable shared between user space and kernel modules (which is normally\nhandled by the ARM-specific pgd_free() function). This patch changes\ndefines the ARM USER_PGTABLES_CEILING to TASK_SIZE when CONFIG_ARM_LPAE\nis enabled.\n\nNote that the pgd_free() function already checks the presence of the\nshared pmd page allocated by pgd_alloc() and frees it, though with\nceiling 0 this wasn\u0027t necessary.\n\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Russell King \u003clinux@arm.linux.org.uk\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "be2300f0961d43c4d92f2a7aa716811383ebbeb2", "tree": "77c38624aa9d883cefb14365eda8175ba5d34048", "parents": [ "0c6ad85215e151e96a0af63f7012d6642c23e3bd" ], "author": { "name": "Federico Vaga", "email": "federico.vaga@gmail.com", "time": "Mon Apr 15 16:01:07 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:53 2013 -0700" }, "message": "serial_core.c: add put_device() after device_find_child()\n\ncommit 5a65dcc04cda41f4122aacc37a5a348454645399 upstream.\n\nThe serial core uses device_find_child() but does not drop the reference to\nthe retrieved child after using it. This patch add the missing put_device().\n\nWhat I have done to test this issue.\n\nI used a machine with an AMBA PL011 serial driver. I tested the patch on\nnext-20120408 because the last branch [next-20120415] does not boot on this\nboard.\n\nFor test purpose, I added some pr_info() messages to print the refcount\nafter device_find_child() (lines: 1937,2009), and after put_device()\n(lines: 1947, 2021).\n\nBoot the machine *without* put_device(). Then:\n\necho reboot \u003e /sys/power/disk\necho disk \u003e /sys/power/state\n[ 87.058575] uart_suspend_port:1937 refcount 4\n[ 87.058582] uart_suspend_port:1947 refcount 4\n[ 87.098083] uart_resume_port:2009refcount 5\n[ 87.098088] uart_resume_port:2021 refcount 5\n\necho disk \u003e /sys/power/state\n[ 103.055574] uart_suspend_port:1937 refcount 6\n[ 103.055580] uart_suspend_port:1947 refcount 6\n[ 103.095322] uart_resume_port:2009 refcount 7\n[ 103.095327] uart_resume_port:2021 refcount 7\n\necho disk \u003e /sys/power/state\n[ 252.459580] uart_suspend_port:1937 refcount 8\n[ 252.459586] uart_suspend_port:1947 refcount 8\n[ 252.499611] uart_resume_port:2009 refcount 9\n[ 252.499616] uart_resume_port:2021 refcount 9\n\nThe refcount continuously increased.\n\nBoot the machine *with* this patch. Then:\n\necho reboot \u003e /sys/power/disk\necho disk \u003e /sys/power/state\n[ 159.333559] uart_suspend_port:1937 refcount 4\n[ 159.333566] uart_suspend_port:1947 refcount 3\n[ 159.372751] uart_resume_port:2009 refcount 4\n[ 159.372755] uart_resume_port:2021 refcount 3\n\necho disk \u003e /sys/power/state\n[ 185.713614] uart_suspend_port:1937 refcount 4\n[ 185.713621] uart_suspend_port:1947 refcount 3\n[ 185.752935] uart_resume_port:2009 refcount 4\n[ 185.752940] uart_resume_port:2021 refcount 3\n\necho disk \u003e /sys/power/state\n[ 207.458584] uart_suspend_port:1937 refcount 4\n[ 207.458591] uart_suspend_port:1947 refcount 3\n[ 207.498598] uart_resume_port:2009 refcount 4\n[ 207.498605] uart_resume_port:2021 refcount 3\n\nThe refcount correctly handled.\n\nSigned-off-by: Federico Vaga \u003cfederico.vaga@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0c6ad85215e151e96a0af63f7012d6642c23e3bd", "tree": "989df004ae26837655f4ffafab761ce3624aed79", "parents": [ "403e8ff46d44eab2c5e83acb4b15cf21a8a05c3e" ], "author": { "name": "Konrad Rzeszutek Wilk", "email": "konrad.wilk@oracle.com", "time": "Tue Apr 16 15:18:00 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:53 2013 -0700" }, "message": "xen/time: Fix kasprintf splat when allocating timer%d IRQ line.\n\ncommit 7918c92ae9638eb8a6ec18e2b4a0de84557cccc8 upstream.\n\nWhen we online the CPU, we get this splat:\n\nsmpboot: Booting Node 0 Processor 1 APIC 0x2\ninstalling Xen timer for CPU 1\nBUG: sleeping function called from invalid context at /home/konrad/ssd/konrad/linux/mm/slab.c:3179\nin_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper/1\nPid: 0, comm: swapper/1 Not tainted 3.9.0-rc6upstream-00001-g3884fad #1\nCall Trace:\n [\u003cffffffff810c1fea\u003e] __might_sleep+0xda/0x100\n [\u003cffffffff81194617\u003e] __kmalloc_track_caller+0x1e7/0x2c0\n [\u003cffffffff81303758\u003e] ? kasprintf+0x38/0x40\n [\u003cffffffff813036eb\u003e] kvasprintf+0x5b/0x90\n [\u003cffffffff81303758\u003e] kasprintf+0x38/0x40\n [\u003cffffffff81044510\u003e] xen_setup_timer+0x30/0xb0\n [\u003cffffffff810445af\u003e] xen_hvm_setup_cpu_clockevents+0x1f/0x30\n [\u003cffffffff81666d0a\u003e] start_secondary+0x19c/0x1a8\n\nThe solution to that is use kasprintf in the CPU hotplug path\nthat \u0027online\u0027s the CPU. That is, do it in in xen_hvm_cpu_notify,\nand remove the call to in xen_hvm_setup_cpu_clockevents.\n\nUnfortunatly the later is not a good idea as the bootup path\ndoes not use xen_hvm_cpu_notify so we would end up never allocating\ntimer%d interrupt lines when booting. As such add the check for\natomic() to continue.\n\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "403e8ff46d44eab2c5e83acb4b15cf21a8a05c3e", "tree": "2cd126d3a0d621f587a86df82a26824def469757", "parents": [ "d7200993dd8d12775487157913b5e6ce866e642f" ], "author": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Thu Apr 25 10:03:15 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:53 2013 -0700" }, "message": "s390/memory hotplug: prevent offline of active memory increments\n\ncommit 94c163663fc1dcfc067a5fb3cc1446b9469975ce upstream.\n\nIn case a machine supports memory hotplug all active memory increments\npresent at IPL time have been initialized with a \"usecount\" of 1.\nThis is wrong if the memory increment size is larger than the memory\nsection size of the memory hotplug code. If that is the case the\nusecount must be initialized with the number of memory sections that\nfit into one memory increment.\nOtherwise it is possible to put a memory increment into standby state\neven if there are still active sections.\nAfterwards addressing exceptions might happen which cause the kernel\nto panic.\nHowever even worse, if a memory increment was put into standby state\nand afterwards into active state again, it\u0027s contents would have been\nzeroed, leading to memory corruption.\n\nThis was only an issue for machines that support standby memory and\nhave at least 256GB memory.\n\nThis is broken since commit fdb1bb15 \"[S390] sclp/memory hotplug: fix\ninitial usecount of increments\".\n\nSigned-off-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\nReviewed-by: Gerald Schaefer \u003cgerald.schaefer@de.ibm.com\u003e\nSigned-off-by: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d7200993dd8d12775487157913b5e6ce866e642f", "tree": "b9fa617d915e86d580e7862f4f0e21b8e20ad731", "parents": [ "cfec6f5f0ee497134df86b9e61314f5ff4c2fce2" ], "author": { "name": "Tormod Volden", "email": "debian.tormod@gmail.com", "time": "Sat Apr 20 14:24:04 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:53 2013 -0700" }, "message": "usb-storage: CY7C68300A chips do not support Cypress ATACB\n\ncommit 671b4b2ba9266cbcfe7210a704e9ea487dcaa988 upstream.\n\nMany cards based on CY7C68300A/B/C use the USB ID 04b4:6830 but only the\nB and C variants (EZ-USB AT2LP) support the ATA Command Block\nfunctionality, according to the data sheets. The A variant (EZ-USB AT2)\nlocks up if ATACB is attempted, until a typical 30 seconds timeout runs\nout and a USB reset is performed.\n\nhttps://bugs.launchpad.net/bugs/428469\n\nIt seems that one way to spot a CY7C68300A (at least where the card\nmanufacturer left Cypress\u0027 EEPROM default vaules, against Cypress\u0027\nrecommendations) is to look at the USB string descriptor indices.\n\nA http://media.digikey.com/pdf/Data%20Sheets/Cypress%20PDFs/CY7C68300A.pdf\nB http://www.farnell.com/datasheets/43456.pdf\nC http://www.cypress.com/?rID\u003d14189\n\nNote that a CY7C68300B/C chip appears as CY7C68300A if it is running\nin Backward Compatibility Mode, and if ATACB would be supported in this\ncase there is anyway no way to tell which chip it really is.\n\nFor 5 years my external USB drive has been locking up for half a minute\nwhen plugged in and ata_id is run by udev, or anytime hdparm or similar\nis run on it.\n\nFinally looking at the /correct/ datasheet I think I found the reason. I\nam aware the quirk in this patch is a bit hacky, but the hardware\nmanufacturers haven\u0027t made it easy for us.\n\nSigned-off-by: Tormod Volden \u003cdebian.tormod@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cfec6f5f0ee497134df86b9e61314f5ff4c2fce2", "tree": "fc271b3db80cb594fa0ad07971a1d116b36fb759", "parents": [ "ebd414a67ba32d17a53dd506b01720e08c88e455" ], "author": { "name": "Hans de Goede", "email": "hdegoede@redhat.com", "time": "Tue Apr 16 11:08:33 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:53 2013 -0700" }, "message": "usbfs: Always allow ctrl requests with USB_RECIP_ENDPOINT on the ctrl ep\n\ncommit 1361bf4b9f9ef45e628a5b89e0fd9bedfdcb7104 upstream.\n\nWhen usbfs receives a ctrl-request from userspace it calls check_ctrlrecip,\nwhich for a request with USB_RECIP_ENDPOINT tries to map this to an interface\nto see if this interface is claimed, except for ctrl-requests with a type of\nUSB_TYPE_VENDOR.\n\nWhen trying to use this device: http://www.akaipro.com/eiepro\nredirected to a Windows vm running on qemu on top of Linux.\n\nThe windows driver makes a ctrl-req with USB_TYPE_CLASS and\nUSB_RECIP_ENDPOINT with index 0, and the mapping of the endpoint (0) to\nthe interface fails since ep 0 is the ctrl endpoint and thus never is\npart of an interface.\n\nThis patch fixes this ctrl-req failing by skipping the checkintf call for\nUSB_RECIP_ENDPOINT ctrl-reqs on the ctrl endpoint.\n\nReported-by: Dave Stikkolorum \u003cd.r.stikkolorum@hhs.nl\u003e\nTested-by: Dave Stikkolorum \u003cd.r.stikkolorum@hhs.nl\u003e\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nAcked-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ebd414a67ba32d17a53dd506b01720e08c88e455", "tree": "9cce779ea5933e5701b172a779f24ca4be590d49", "parents": [ "a185de0ef7d02c512175cf373435f0c7f1c640e1" ], "author": { "name": "Adrian Thomasset", "email": "adrian.thomasset@st.com", "time": "Tue Apr 23 12:46:29 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:53 2013 -0700" }, "message": "USB: ftdi_sio: correct ST Micro Connect Lite PIDs\n\ncommit 9f06d15f8db6946e41f73196a122b84a37938878 upstream.\n\nThe current ST Micro Connect Lite uses the FT4232H hi-speed quad USB\nUART FTDI chip. It is also possible to drive STM reference targets\npopulated with an on-board JTAG debugger based on the FT2232H chip with\nthe same STMicroelectronics tools.\n\nFor this reason, the ST Micro Connect Lite PIDs should be\nST_STMCLT_2232_PID: 0x3746\nST_STMCLT_4232_PID: 0x3747\n\nSigned-off-by: Adrian Thomasset \u003cadrian.thomasset@st.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a185de0ef7d02c512175cf373435f0c7f1c640e1", "tree": "e54fdc0a4d8c1a33f679c2d489e46e10a92f057f", "parents": [ "c868de9e852bcea3e2f52cf0e626316da4ffada7" ], "author": { "name": "Stefani Seibold", "email": "stefani@seibold.net", "time": "Sun Apr 07 12:08:55 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:52 2013 -0700" }, "message": "USB: add ftdi_sio USB ID for GDM Boost V1.x\n\ncommit 58f8b6c4fa5a13cb2ddb400e26e9e65766d71e38 upstream.\n\nThis patch add a missing usb device id for the GDMBoost V1.x device\n\nThe patch is against 3.9-rc5\n\nSigned-off-by: Stefani Seibold \u003cstefani@seibold.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c868de9e852bcea3e2f52cf0e626316da4ffada7", "tree": "6dfd4a449252960f27b405c673c994defb21af74", "parents": [ "b174e3c05c191442e0675e8d9c329f2c42ee363a" ], "author": { "name": "Ben Jencks", "email": "ben@bjencks.net", "time": "Tue Apr 02 00:35:08 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:52 2013 -0700" }, "message": "usb/misc/appledisplay: Add 24\" LED Cinema display\n\ncommit e7d3b6e22c871ba36d052ca99bc8ceca4d546a60 upstream.\n\nAdd the Apple 24\" LED Cinema display to the supported devices.\n\nSigned-off-by: Ben Jencks \u003cben@bjencks.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b174e3c05c191442e0675e8d9c329f2c42ee363a", "tree": "79b1e8b6d8d7db1349ad15954c3a062ba452af5f", "parents": [ "9758cfd231405b21f2244c9f4cc1fff89fcee3e0" ], "author": { "name": "Yogesh Ashok Powar", "email": "yogeshp@marvell.com", "time": "Tue Apr 23 16:49:48 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:52 2013 -0700" }, "message": "mwifiex: Call pci_release_region after calling pci_disable_device\n\ncommit 5b0d9b218b74042ff72bf4bfda6eeb2e4bf98397 upstream.\n\n\"drivers should call pci_release_region() AFTER\ncalling pci_disable_device()\"\n\nPlease refer section 3.2 Request MMIO/IOP resources\nin Documentation/PCI/pci.txt\n\nSigned-off-by: Avinash Patil \u003cpatila@marvell.com\u003e\nSigned-off-by: Amitkumar Karwar \u003cakarwar@marvell.com\u003e\nSigned-off-by: Yogesh Ashok Powar \u003cyogeshp@marvell.com\u003e\nSigned-off-by: Bing Zhao \u003cbzhao@marvell.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9758cfd231405b21f2244c9f4cc1fff89fcee3e0", "tree": "b4d62f6a1a4d98d4b5ebafa6fc4a98c7bedab7cc", "parents": [ "5a7cdf1caa46fabd4661b65e72752506649b15ac" ], "author": { "name": "Yogesh Ashok Powar", "email": "yogeshp@marvell.com", "time": "Tue Apr 23 16:49:47 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:52 2013 -0700" }, "message": "mwifiex: Use pci_release_region() instead of a pci_release_regions()\n\ncommit c380aafb77b7435d010698fe3ca6d3e1cd745fde upstream.\n\nPCI regions are associated with the device using\npci_request_region() call. Hence use pci_release_region()\ninstead of pci_release_regions().\n\nSigned-off-by: Yogesh Ashok Powar \u003cyogeshp@marvell.com\u003e\nSigned-off-by: Amitkumar Karwar \u003cakarwar@marvell.com\u003e\nSigned-off-by: Avinash Patil \u003cpatila@marvell.com\u003e\nSigned-off-by: Bing Zhao \u003cbzhao@marvell.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5a7cdf1caa46fabd4661b65e72752506649b15ac", "tree": "5be2cb0c1e0e789c058fb794caf85cebfd908e15", "parents": [ "59973aa09eaac7eb849badd597453ec0b4230ebf" ], "author": { "name": "Michael Ellerman", "email": "michael@ellerman.id.au", "time": "Tue Apr 23 15:13:14 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:52 2013 -0700" }, "message": "powerpc/spufs: Initialise inode-\u003ei_ino in spufs_new_inode()\n\ncommit 6747e83235caecd30b186d1282e4eba7679f81b7 upstream.\n\nIn commit 85fe402 (fs: do not assign default i_ino in new_inode), the\ninitialisation of i_ino was removed from new_inode() and pushed down\ninto the callers. However spufs_new_inode() was not updated.\n\nThis exhibits as no files appearing in /spu, because all our dirents\nhave a zero inode, which readdir() seems to dislike.\n\nSigned-off-by: Michael Ellerman \u003cmichael@ellerman.id.au\u003e\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "59973aa09eaac7eb849badd597453ec0b4230ebf", "tree": "71b0552aed844943077c6f5bed6409ecb50d5676", "parents": [ "635b15ddf03123c602a6bfb0505c01d0a0fb46a4" ], "author": { "name": "Michael Neuling", "email": "michael.neuling@au1.ibm.com", "time": "Wed Apr 24 00:30:09 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:52 2013 -0700" }, "message": "powerpc: Add isync to copy_and_flush\n\ncommit 29ce3c5073057991217916abc25628e906911757 upstream.\n\nIn __after_prom_start we copy the kernel down to zero in two calls to\ncopy_and_flush. After the first call (copy from 0 to copy_to_here:)\nwe jump to the newly copied code soon after.\n\nUnfortunately there\u0027s no isync between the copy of this code and the\njump to it. Hence it\u0027s possible that stale instructions could still be\nin the icache or pipeline before we branch to it.\n\nWe\u0027ve seen this on real machines and it\u0027s results in no console output\nafter:\n calling quiesce...\n returning from prom_init\n\nThe below adds an isync to ensure that the copy and flushing has\ncompleted before any branching to the new instructions occurs.\n\nSigned-off-by: Michael Neuling \u003cmikey@neuling.org\u003e\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "635b15ddf03123c602a6bfb0505c01d0a0fb46a4", "tree": "55131833bba907e6ff0b8a4cd275398c7810eb52", "parents": [ "9c61996dfded2b01a688be41df3cc97bd3cf9d23" ], "author": { "name": "Maxime Ripard", "email": "maxime.ripard@free-electrons.com", "time": "Sat Mar 23 10:58:57 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:52 2013 -0700" }, "message": "ARM: at91: Fix typo in restart code panic message\n\ncommit e7619459d47a673af3433208a42f583af920e9db upstream.\n\nSigned-off-by: Maxime Ripard \u003cmaxime.ripard@free-electrons.com\u003e\nAcked-by: Jean-Christophe PLAGNIOL-VILLARD \u003cplagnioj@jcrosoft.com\u003e\nSigned-off-by: Nicolas Ferre \u003cnicolas.ferre@atmel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9c61996dfded2b01a688be41df3cc97bd3cf9d23", "tree": "a21078ed480d6bff6185118d079c9a94a6fc168f", "parents": [ "976c850e9deae3e2cc783a2b2f055b4881df7bce" ], "author": { "name": "Bjørn Mork", "email": "bjorn@mork.no", "time": "Tue Apr 09 11:26:02 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:52 2013 -0700" }, "message": "USB: option: add a D-Link DWM-156 variant\n\ncommit a2a2d6c7f93e160b52a4ad0164db1f43f743ae0f upstream.\n\nAdding support for a Mediatek based device labelled as\nD-Link Model: DWM-156, H/W Ver: A7\n\nAlso adding two other device IDs found in the Debian(!)\npackages included on the embedded device driver CD.\n\nThis is a composite MBIM + serial ports + card reader device:\n\nT: Bus\u003d04 Lev\u003d01 Prnt\u003d01 Port\u003d00 Cnt\u003d01 Dev#\u003d 14 Spd\u003d480 MxCh\u003d 0\nD: Ver\u003d 2.00 Cls\u003def(misc ) Sub\u003d02 Prot\u003d01 MxPS\u003d64 #Cfgs\u003d 1\nP: Vendor\u003d2001 ProdID\u003d7d01 Rev\u003d 3.00\nS: Manufacturer\u003dD-Link,Inc\nS: Product\u003dD-Link DWM-156\nC:* #Ifs\u003d 7 Cfg#\u003d 1 Atr\u003da0 MxPwr\u003d500mA\nA: FirstIf#\u003d 0 IfCount\u003d 2 Cls\u003d02(comm.) Sub\u003d0e Prot\u003d00\nI:* If#\u003d 0 Alt\u003d 0 #EPs\u003d 1 Cls\u003d02(comm.) Sub\u003d0e Prot\u003d00 Driver\u003dcdc_mbim\nE: Ad\u003d88(I) Atr\u003d03(Int.) MxPS\u003d 64 Ivl\u003d125us\nI: If#\u003d 1 Alt\u003d 0 #EPs\u003d 0 Cls\u003d0a(data ) Sub\u003d00 Prot\u003d02 Driver\u003dcdc_mbim\nI:* If#\u003d 1 Alt\u003d 1 #EPs\u003d 2 Cls\u003d0a(data ) Sub\u003d00 Prot\u003d02 Driver\u003dcdc_mbim\nE: Ad\u003d81(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nE: Ad\u003d01(O) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nI:* If#\u003d 2 Alt\u003d 0 #EPs\u003d 3 Cls\u003dff(vend.) Sub\u003d02 Prot\u003d01 Driver\u003doption\nE: Ad\u003d87(I) Atr\u003d03(Int.) MxPS\u003d 64 Ivl\u003d500us\nE: Ad\u003d82(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nE: Ad\u003d02(O) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nI:* If#\u003d 3 Alt\u003d 0 #EPs\u003d 2 Cls\u003dff(vend.) Sub\u003d00 Prot\u003d00 Driver\u003doption\nE: Ad\u003d83(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nE: Ad\u003d03(O) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nI:* If#\u003d 4 Alt\u003d 0 #EPs\u003d 2 Cls\u003dff(vend.) Sub\u003d00 Prot\u003d00 Driver\u003doption\nE: Ad\u003d84(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nE: Ad\u003d04(O) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nI:* If#\u003d 5 Alt\u003d 0 #EPs\u003d 2 Cls\u003dff(vend.) Sub\u003d00 Prot\u003d00 Driver\u003doption\nE: Ad\u003d85(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nE: Ad\u003d05(O) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nI:* If#\u003d 6 Alt\u003d 0 #EPs\u003d 2 Cls\u003d08(stor.) Sub\u003d06 Prot\u003d50 Driver\u003dusb-storage\nE: Ad\u003d86(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nE: Ad\u003d06(O) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\n\nSigned-off-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "976c850e9deae3e2cc783a2b2f055b4881df7bce", "tree": "787796a1b7d65e03c50df8e98c80ba795b031af4", "parents": [ "b375a75787daf96b7c6bfae272edb2720a9fedfc" ], "author": { "name": "Filippo Turato", "email": "nnj7585@gmail.com", "time": "Sat Apr 20 15:04:08 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:52 2013 -0700" }, "message": "USB: serial: option: Added support Olivetti Olicard 145\n\ncommit d19bf5cedfd7d53854a3bd699c98b467b139833b upstream.\n\nThis adds PID for Olivetti Olicard 145 in option.c\n\nSigned-off-by: Filippo Turato \u003cnnj7585@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b375a75787daf96b7c6bfae272edb2720a9fedfc", "tree": "575a8fa1a68c663ae4f931884df857839e9d732b", "parents": [ "1d0dd1db15bc5dedc25bcdebf3dd382436f11f8a" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:42 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:42 2013 -0700" }, "message": "Linux 3.4.43\n" }, { "commit": "1d0dd1db15bc5dedc25bcdebf3dd382436f11f8a", "tree": "f796d4236a52fcf8993652594578d5a5f6b8dc4e", "parents": [ "ca4bf7c6970aee586c4b6b642e011e3847ac5f93" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Apr 16 12:55:41 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:20 2013 -0700" }, "message": "net: drop dst before queueing fragments\n\n[ Upstream commit 97599dc792b45b1669c3cdb9a4b365aad0232f65 ]\n\nCommit 4a94445c9a5c (net: Use ip_route_input_noref() in input path)\nadded a bug in IP defragmentation handling, as non refcounted\ndst could escape an RCU protected section.\n\nCommit 64f3b9e203bd068 (net: ip_expire() must revalidate route) fixed\nthe case of timeouts, but not the general problem.\n\nTom Parkin noticed crashes in UDP stack and provided a patch,\nbut further analysis permitted us to pinpoint the root cause.\n\nBefore queueing a packet into a frag list, we must drop its dst,\nas this dst has limited lifetime (RCU protected)\n\nWhen/if a packet is finally reassembled, we use the dst of the very\nlast skb, still protected by RCU and valid, as the dst of the\nreassembled packet.\n\nUse same logic in IPv6, as there is no need to hold dst references.\n\nReported-by: Tom Parkin \u003ctparkin@katalix.com\u003e\nTested-by: Tom Parkin \u003ctparkin@katalix.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ca4bf7c6970aee586c4b6b642e011e3847ac5f93", "tree": "5a09c1404e30b8647502300f19516bc6720df17a", "parents": [ "4087320fd8d0164c4b53fe5f9c26c0d3eaba7d2d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 19 15:32:32 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:16 2013 -0700" }, "message": "net: fix incorrect credentials passing\n\n[ Upstream commit 83f1b4ba917db5dc5a061a44b3403ddb6e783494 ]\n\nCommit 257b5358b32f (\"scm: Capture the full credentials of the scm\nsender\") changed the credentials passing code to pass in the effective\nuid/gid instead of the real uid/gid.\n\nObviously this doesn\u0027t matter most of the time (since normally they are\nthe same), but it results in differences for suid binaries when the wrong\nuid/gid ends up being used.\n\nThis just undoes that (presumably unintentional) part of the commit.\n\nReported-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nCc: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nCc: Serge E. Hallyn \u003cserge@hallyn.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nAcked-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4087320fd8d0164c4b53fe5f9c26c0d3eaba7d2d", "tree": "eec3227d92d224f68f1902f866bef7fa1613c8d2", "parents": [ "7575f50ffc847587909648242efdfd0951eb27b9" ], "author": { "name": "Ben Greear", "email": "greearb@candelatech.com", "time": "Fri Apr 19 10:45:52 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:10 2013 -0700" }, "message": "net: rate-limit warn-bad-offload splats.\n\n[ Upstream commit c846ad9b880ece01bb4d8d07ba917734edf0324f ]\n\nIf one does do something unfortunate and allow a\nbad offload bug into the kernel, this the\nskb_warn_bad_offload can effectively live-lock the\nsystem, filling the logs with the same error over\nand over.\n\nAdd rate limitation to this so that box remains otherwise\nfunctional in this case.\n\nSigned-off-by: Ben Greear \u003cgreearb@candelatech.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7575f50ffc847587909648242efdfd0951eb27b9", "tree": "0d134d4939dc799086897b354e0b29caadb35572", "parents": [ "a009d58e52a816355a2423729c9aeded56fc40d1" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Apr 19 07:19:48 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:08 2013 -0700" }, "message": "tcp: call tcp_replace_ts_recent() from tcp_ack()\n\n[ Upstream commit 12fb3dd9dc3c64ba7d64cec977cca9b5fb7b1d4e ]\n\ncommit bd090dfc634d (tcp: tcp_replace_ts_recent() should not be called\nfrom tcp_validate_incoming()) introduced a TS ecr bug in slow path\nprocessing.\n\n1 A \u003e B P. 1:10001(10000) ack 1 \u003cnop,nop,TS val 1001 ecr 200\u003e\n2 B \u003c A . 1:1(0) ack 1 win 257 \u003csack 9001:10001,TS val 300 ecr 1001\u003e\n3 A \u003e B . 1:1001(1000) ack 1 win 227 \u003cnop,nop,TS val 1002 ecr 200\u003e\n4 A \u003e B . 1001:2001(1000) ack 1 win 227 \u003cnop,nop,TS val 1002 ecr 200\u003e\n\n(ecr 200 should be ecr 300 in packets 3 \u0026 4)\n\nProblem is tcp_ack() can trigger send of new packets (retransmits),\nreflecting the prior TSval, instead of the TSval contained in the\ncurrently processed incoming packet.\n\nFix this by calling tcp_replace_ts_recent() from tcp_ack() after the\nchecks, but before the actions.\n\nReported-by: Yuchung Cheng \u003cycheng@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Neal Cardwell \u003cncardwell@google.com\u003e\nAcked-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a009d58e52a816355a2423729c9aeded56fc40d1", "tree": "251e07e807e46ad37327fe442814596880476a36", "parents": [ "d768ca1b9fae5c2ee68ad39e6b1b5e9fc23ca9bf" ], "author": { "name": "Daniel Borkmann", "email": "dborkman@redhat.com", "time": "Thu Feb 07 00:55:37 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:08 2013 -0700" }, "message": "net: sctp: sctp_auth_key_put: use kzfree instead of kfree\n\n[ Upstream commit 586c31f3bf04c290dc0a0de7fc91d20aa9a5ee53 ]\n\nFor sensitive data like keying material, it is common practice to zero\nout keys before returning the memory back to the allocator. Thus, use\nkzfree instead of kfree.\n\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nAcked-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d768ca1b9fae5c2ee68ad39e6b1b5e9fc23ca9bf", "tree": "bd2262b266abdb91f1ac0ba7c1d171b0e82a6c2d", "parents": [ "ca6ad5d7758a96ef3cea419efe39b3281a5017b5" ], "author": { "name": "Wei Yongjun", "email": "yongjun_wei@trendmicro.com.cn", "time": "Sat Apr 13 15:49:03 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:07 2013 -0700" }, "message": "esp4: fix error return code in esp_output()\n\n[ Upstream commit 06848c10f720cbc20e3b784c0df24930b7304b93 ]\n\nFix to return a negative error code from the error handling\ncase instead of 0, as returned elsewhere in this function.\n\nSigned-off-by: Wei Yongjun \u003cyongjun_wei@trendmicro.com.cn\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ca6ad5d7758a96ef3cea419efe39b3281a5017b5", "tree": "0f4d660acb1fe37a85a5e64c2c4bd3ba703cb1dc", "parents": [ "d0d7ee05a623ba00e4ffc4a07e67c6649cac5cae" ], "author": { "name": "Thomas Graf", "email": "tgraf@suug.ch", "time": "Thu Apr 11 10:57:18 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:07 2013 -0700" }, "message": "tcp: Reallocate headroom if it would overflow csum_start\n\n[ Upstream commit 50bceae9bd3569d56744882f3012734d48a1d413 ]\n\nIf a TCP retransmission gets partially ACKed and collapsed multiple\ntimes it is possible for the headroom to grow beyond 64K which will\noverflow the 16bit skb-\u003ecsum_start which is based on the start of\nthe headroom. It has been observed rarely in the wild with IPoIB due\nto the 64K MTU.\n\nVerify if the acking and collapsing resulted in a headroom exceeding\nwhat csum_start can cover and reallocate the headroom if so.\n\nA big thank you to Jim Foraker \u003cforaker1@llnl.gov\u003e and the team at\nLLNL for helping out with the investigation and testing.\n\nReported-by: Jim Foraker \u003cforaker1@llnl.gov\u003e\nSigned-off-by: Thomas Graf \u003ctgraf@suug.ch\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d0d7ee05a623ba00e4ffc4a07e67c6649cac5cae", "tree": "7d571a1cc16e32e4fba6f4011d8253883691ee42", "parents": [ "f29e2461ef6daf7440d00b3ea5978f69f6c057cb" ], "author": { "name": "Dmitry Popov", "email": "dp@highloadlab.com", "time": "Thu Apr 11 08:55:07 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:07 2013 -0700" }, "message": "tcp: incoming connections might use wrong route under synflood\n\n[ Upstream commit d66954a066158781ccf9c13c91d0316970fe57b6 ]\n\nThere is a bug in cookie_v4_check (net/ipv4/syncookies.c):\n\tflowi4_init_output(\u0026fl4, 0, sk-\u003esk_mark, RT_CONN_FLAGS(sk),\n\t\t\t RT_SCOPE_UNIVERSE, IPPROTO_TCP,\n\t\t\t inet_sk_flowi_flags(sk),\n\t\t\t (opt \u0026\u0026 opt-\u003esrr) ? opt-\u003efaddr : ireq-\u003ermt_addr,\n\t\t\t ireq-\u003eloc_addr, th-\u003esource, th-\u003edest);\n\nHere we do not respect sk-\u003esk_bound_dev_if, therefore wrong dst_entry may be\ntaken. This dst_entry is used by new socket (get_cookie_sock -\u003e\ntcp_v4_syn_recv_sock), so its packets may take the wrong path.\n\nSigned-off-by: Dmitry Popov \u003cdp@highloadlab.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f29e2461ef6daf7440d00b3ea5978f69f6c057cb", "tree": "9b6452791e55485ce98a055a601b7c811d3c4248", "parents": [ "1ab6b2a5a0970c887166b732fd3ad347979f2cec" ], "author": { "name": "Michael Riesch", "email": "michael.riesch@omicron.at", "time": "Mon Apr 08 05:45:26 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:07 2013 -0700" }, "message": "rtnetlink: Call nlmsg_parse() with correct header length\n\n[ Upstream commit 88c5b5ce5cb57af6ca2a7cf4d5715fa320448ff9 ]\n\nSigned-off-by: Michael Riesch \u003cmichael.riesch@omicron.at\u003e\nCc: Jiri Benc \u003cjbenc@redhat.com\u003e\nCc: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nAcked-by: Mark Rustad \u003cmark.d.rustad@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1ab6b2a5a0970c887166b732fd3ad347979f2cec", "tree": "816c2b7f42d8a6779bb48adba53ec461560937e8", "parents": [ "ba12001651d677a8742aa465d3996885d2568f98" ], "author": { "name": "Patrick McHardy", "email": "kaber@trash.net", "time": "Fri Apr 05 20:42:05 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:07 2013 -0700" }, "message": "netfilter: don\u0027t reset nf_trace in nf_reset()\n\n[ Upstream commit 124dff01afbdbff251f0385beca84ba1b9adda68 ]\n\nCommit 130549fe (\"netfilter: reset nf_trace in nf_reset\") added code\nto reset nf_trace in nf_reset(). This is wrong and unnecessary.\n\nnf_reset() is used in the following cases:\n\n- when passing packets up the the socket layer, at which point we want to\n release all netfilter references that might keep modules pinned while\n the packet is queued. nf_trace doesn\u0027t matter anymore at this point.\n\n- when encapsulating or decapsulating IPsec packets. We want to continue\n tracing these packets after IPsec processing.\n\n- when passing packets through virtual network devices. Only devices on\n that encapsulate in IPv4/v6 matter since otherwise nf_trace is not\n used anymore. Its not entirely clear whether those packets should\n be traced after that, however we\u0027ve always done that.\n\n- when passing packets through virtual network devices that make the\n packet cross network namespace boundaries. This is the only cases\n where we clearly want to reset nf_trace and is also what the\n original patch intended to fix.\n\nAdd a new function nf_reset_trace() and use it in dev_forward_skb() to\nfix this properly.\n\nSigned-off-by: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ba12001651d677a8742aa465d3996885d2568f98", "tree": "e525dc1f19a8aaf8229fe90c7f085d81c95da0b8", "parents": [ "2a11e5fe4e27757d6316f25119ec02d4b3ab199a" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Wed Apr 03 16:14:47 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:07 2013 -0700" }, "message": "af_unix: If we don\u0027t care about credentials coallesce all messages\n\n[ Upstream commit 0e82e7f6dfeec1013339612f74abc2cdd29d43d2 ]\n\nIt was reported that the following LSB test case failed\nhttps://lsbbugs.linuxfoundation.org/attachment.cgi?id\u003d2144 because we\nwere not coallescing unix stream messages when the application was\nexpecting us to.\n\nThe problem was that the first send was before the socket was accepted\nand thus sock-\u003esk_socket was NULL in maybe_add_creds, and the second\nsend after the socket was accepted had a non-NULL value for sk-\u003esocket\nand thus we could tell the credentials were not needed so we did not\nbother.\n\nThe unnecessary credentials on the first message cause\nunix_stream_recvmsg to start verifying that all messages had the same\ncredentials before coallescing and then the coallescing failed because\nthe second message had no credentials.\n\nIgnoring credentials when we don\u0027t care in unix_stream_recvmsg fixes a\nlong standing pessimization which would fail to coallesce messages when\nreading from a unix stream socket if the senders were different even if\nwe did not care about their credentials.\n\nI have tested this and verified that the in the LSB test case mentioned\nabove that the messages do coallesce now, while the were failing to\ncoallesce without this change.\n\nReported-by: Karel Srot \u003cksrot@redhat.com\u003e\nReported-by: Ding Tianhong \u003cdingtianhong@huawei.com\u003e\nSigned-off-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2a11e5fe4e27757d6316f25119ec02d4b3ab199a", "tree": "aa6572cb2cee20fccd29a2bf2e0aa11893fff2f0", "parents": [ "643094adbef902c4a1f5a544f1f8eb8512e7ff8c" ], "author": { "name": "nikolay@redhat.com", "email": "nikolay@redhat.com", "time": "Thu Apr 11 09:18:56 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:07 2013 -0700" }, "message": "bonding: IFF_BONDING is not stripped on enslave failure\n\n[ Upstream commit b6a5a7b9a528a8b4c8bec940b607c5dd9102b8cc ]\n\nWhile enslaving a new device and after IFF_BONDING flag is set, in case\nof failure it is not stripped from the device\u0027s priv_flags while\ncleaning up, which could lead to other problems.\nCleaning at err_close because the flag is set after dev_open().\n\nv2: no change\n\nSigned-off-by: Nikolay Aleksandrov \u003cnikolay@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "643094adbef902c4a1f5a544f1f8eb8512e7ff8c", "tree": "9e0aba96e458e4ae750c9a84a712812bdaf70560", "parents": [ "74595d06f51d68bbc25c5864d15566ea5049a33a" ], "author": { "name": "nikolay@redhat.com", "email": "nikolay@redhat.com", "time": "Sat Apr 06 00:54:38 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:06 2013 -0700" }, "message": "bonding: fix bonding_masters race condition in bond unloading\n\n[ Upstream commit 69b0216ac255f523556fa3d4ff030d857eaaa37f ]\n\nWhile the bonding module is unloading, it is considered that after\nrtnl_link_unregister all bond devices are destroyed but since no\nsynchronization mechanism exists, a new bond device can be created\nvia bonding_masters before unregister_pernet_subsys which would\nlead to multiple problems (e.g. NULL pointer dereference, wrong RIP,\nlist corruption).\n\nThis patch fixes the issue by removing any bond devices left in the\nnetns after bonding_masters is removed from sysfs.\n\nSigned-off-by: Nikolay Aleksandrov \u003cnikolay@redhat.com\u003e\nAcked-by: Veaceslav Falico \u003cvfalico@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "74595d06f51d68bbc25c5864d15566ea5049a33a", "tree": "528c86b75a9564be4c9341efafb6ce14c697b6b5", "parents": [ "617f13b4194b6aad612733a932bc89d883d9325e" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Tue Apr 02 14:36:46 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:06 2013 -0700" }, "message": "atl1e: limit gso segment size to prevent generation of wrong ip length fields\n\n[ Upstream commit 31d1670e73f4911fe401273a8f576edc9c2b5fea ]\n\nThe limit of 0x3c00 is taken from the windows driver.\n\nSuggested-by: Huang, Xiong \u003cxiong@qca.qualcomm.com\u003e\nCc: Huang, Xiong \u003cxiong@qca.qualcomm.com\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "617f13b4194b6aad612733a932bc89d883d9325e", "tree": "ab3ae7170a72801d5b9cca9092abc09d05b02747", "parents": [ "ef95e3d5d7325b87ca22c4aa72710ac152315559" ], "author": { "name": "Vlad Yasevich", "email": "vyasevic@redhat.com", "time": "Tue Apr 02 17:10:07 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:06 2013 -0700" }, "message": "net: count hw_addr syncs so that unsync works properly.\n\n[ Upstream commit 4543fbefe6e06a9e40d9f2b28d688393a299f079 ]\n\nA few drivers use dev_uc_sync/unsync to synchronize the\naddress lists from master down to slave/lower devices. In\nsome cases (bond/team) a single address list is synched down\nto multiple devices. At the time of unsync, we have a leak\nin these lower devices, because \"synced\" is treated as a\nboolean and the address will not be unsynced for anything after\nthe first device/call.\n\nTreat \"synced\" as a count (same as refcount) and allow all\nunsync calls to work.\n\nSigned-off-by: Vlad Yasevich \u003cvyasevic@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ef95e3d5d7325b87ca22c4aa72710ac152315559", "tree": "4dbcc03fae31b3c7bd1ecd1b16162514671934b4", "parents": [ "815b1018620edb2f86fc7a7740b9a0e726446929" ], "author": { "name": "Balakumaran Kannan", "email": "kumaran.4353@gmail.com", "time": "Tue Apr 02 16:15:05 2013 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:06 2013 -0700" }, "message": "net IPv6 : Fix broken IPv6 routing table after loopback down-up\n\n[ Upstream commit 25fb6ca4ed9cad72f14f61629b68dc03c0d9713f ]\n\nIPv6 Routing table becomes broken once we do ifdown, ifup of the loopback(lo)\ninterface. After down-up, routes of other interface\u0027s IPv6 addresses through\n\u0027lo\u0027 are lost.\n\nIPv6 addresses assigned to all interfaces are routed through \u0027lo\u0027 for internal\ncommunication. Once \u0027lo\u0027 is down, those routing entries are removed from routing\ntable. But those removed entries are not being re-created properly when \u0027lo\u0027 is\nbrought up. So IPv6 addresses of other interfaces becomes unreachable from the\nsame machine. Also this breaks communication with other machines because of\nNDISC packet processing failure.\n\nThis patch fixes this issue by reading all interface\u0027s IPv6 addresses and adding\nthem to IPv6 routing table while bringing up \u0027lo\u0027.\n\n\u003d\u003dTesting\u003d\u003d\nBefore applying the patch:\n$ route -A inet6\nKernel IPv6 routing table\nDestination Next Hop Flag Met Ref Use If\n2000::20/128 :: U 256 0 0 eth0\nfe80::/64 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n::1/128 :: Un 0 1 0 lo\n2000::20/128 :: Un 0 1 0 lo\nfe80::xxxx:xxxx:xxxx:xxxx/128 :: Un 0 1 0 lo\nff00::/8 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n$ sudo ifdown lo\n$ sudo ifup lo\n$ route -A inet6\nKernel IPv6 routing table\nDestination Next Hop Flag Met Ref Use If\n2000::20/128 :: U 256 0 0 eth0\nfe80::/64 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n::1/128 :: Un 0 1 0 lo\nff00::/8 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n$\n\nAfter applying the patch:\n$ route -A inet6\nKernel IPv6 routing\ntable\nDestination Next Hop Flag Met Ref Use If\n2000::20/128 :: U 256 0 0 eth0\nfe80::/64 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n::1/128 :: Un 0 1 0 lo\n2000::20/128 :: Un 0 1 0 lo\nfe80::xxxx:xxxx:xxxx:xxxx/128 :: Un 0 1 0 lo\nff00::/8 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n$ sudo ifdown lo\n$ sudo ifup lo\n$ route -A inet6\nKernel IPv6 routing table\nDestination Next Hop Flag Met Ref Use If\n2000::20/128 :: U 256 0 0 eth0\nfe80::/64 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n::1/128 :: Un 0 1 0 lo\n2000::20/128 :: Un 0 1 0 lo\nfe80::xxxx:xxxx:xxxx:xxxx/128 :: Un 0 1 0 lo\nff00::/8 :: U 256 0 0 eth0\n::/0 :: !n -1 1 1 lo\n$\n\nSigned-off-by: Balakumaran Kannan \u003cBalakumaran.Kannan@ap.sony.com\u003e\nSigned-off-by: Maruthi Thotad \u003cMaruthi.Thotad@ap.sony.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "815b1018620edb2f86fc7a7740b9a0e726446929", "tree": "ca42f78750875df5b2fd4ff4e10588768f750042", "parents": [ "7b806e764b487cf1f348d1e4377f99853935ff7c" ], "author": { "name": "Vasily Averin", "email": "vvs@parallels.com", "time": "Mon Apr 01 03:01:32 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:06 2013 -0700" }, "message": "cbq: incorrect processing of high limits\n\n[ Upstream commit f0f6ee1f70c4eaab9d52cf7d255df4bd89f8d1c2 ]\n\ncurrently cbq works incorrectly for limits \u003e 10% real link bandwidth,\nand practically does not work for limits \u003e 50% real link bandwidth.\nBelow are results of experiments taken on 1 Gbit link\n\n In shaper | Actual Result\n-----------+---------------\n 100M | 108 Mbps\n 200M | 244 Mbps\n 300M | 412 Mbps\n 500M | 893 Mbps\n\nThis happen because of q-\u003enow changes incorrectly in cbq_dequeue():\nwhen it is called before real end of packet transmitting,\nL2T is greater than real time delay, q_now gets an extra boost\nbut never compensate it.\n\nTo fix this problem we prevent change of q-\u003enow until its synchronization\nwith real time.\n\nSigned-off-by: Vasily Averin \u003cvvs@openvz.org\u003e\nReviewed-by: Alexey Kuznetsov \u003ckuznet@ms2.inr.ac.ru\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7b806e764b487cf1f348d1e4377f99853935ff7c", "tree": "9d3c9f73bd315529f9d52903a22f7970179ebd14", "parents": [ "e979f5408b145c0d2b0bf6622952c09a43bcd23a" ], "author": { "name": "Wei Yongjun", "email": "yongjun_wei@trendmicro.com.cn", "time": "Tue Apr 09 10:07:19 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:06 2013 -0700" }, "message": "netrom: fix invalid use of sizeof in nr_recvmsg()\n\n[ Upstream commit c802d759623acbd6e1ee9fbdabae89159a513913 ]\n\nsizeof() when applied to a pointer typed expression gives the size of the\npointer, not that of the pointed data.\nIntroduced by commit 3ce5ef(netrom: fix info leak via msg_name in nr_recvmsg)\n\nSigned-off-by: Wei Yongjun \u003cyongjun_wei@trendmicro.com.cn\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e979f5408b145c0d2b0bf6622952c09a43bcd23a", "tree": "a050da7143f3f523ab3b658557063add6185e9e7", "parents": [ "1a4dc01afc19f4a30c015ef62a43930241ee15b1" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:52:00 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:05 2013 -0700" }, "message": "tipc: fix info leaks via msg_name in recv_msg/recv_stream\n\n[ Upstream commit 60085c3d009b0df252547adb336d1ccca5ce52ec ]\n\nThe code in set_orig_addr() does not initialize all of the members of\nstruct sockaddr_tipc when filling the sockaddr info -- namely the union\nis only partly filled. This will make recv_msg() and recv_stream() --\nthe only users of this function -- leak kernel stack memory as the\nmsg_name member is a local variable in net/socket.c.\n\nAdditionally to that both recv_msg() and recv_stream() fail to update\nthe msg_namelen member to 0 while otherwise returning with 0, i.e.\n\"success\". This is the case for, e.g., non-blocking sockets. This will\nlead to a 128 byte kernel stack leak in net/socket.c.\n\nFix the first issue by initializing the memory of the union with\nmemset(0). Fix the second one by setting msg_namelen to 0 early as it\nwill be updated later if we\u0027re going to fill the msg_name member.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Jon Maloy \u003cjon.maloy@ericsson.com\u003e\nCc: Allan Stephens \u003callan.stephens@windriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1a4dc01afc19f4a30c015ef62a43930241ee15b1", "tree": "924086b5c572dac58ef0ac8879e1ea820c196676", "parents": [ "1091d7dddb9f0fc287bf17c5f6c7859fe0bc50b3" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:51:59 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:05 2013 -0700" }, "message": "rose: fix info leak via msg_name in rose_recvmsg()\n\n[ Upstream commit 4a184233f21645cf0b719366210ed445d1024d72 ]\n\nThe code in rose_recvmsg() does not initialize all of the members of\nstruct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info.\nNor does it initialize the padding bytes of the structure inserted by\nthe compiler for alignment. This will lead to leaking uninitialized\nkernel stack bytes in net/socket.c.\n\nFix the issue by initializing the memory used for sockaddr info with\nmemset(0).\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Ralf Baechle \u003cralf@linux-mips.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1091d7dddb9f0fc287bf17c5f6c7859fe0bc50b3", "tree": "61ceaeec4813c11d8b0fc406d88f5f356edf1f8b", "parents": [ "cd5e3d9ff117b6cff7a82b076be20dc91eec3f4f" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:51:58 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:05 2013 -0700" }, "message": "NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg()\n\n[ Upstream commit d26d6504f23e803824e8ebd14e52d4fc0a0b09cb ]\n\nThe code in llcp_sock_recvmsg() does not initialize all the members of\nstruct sockaddr_nfc_llcp when filling the sockaddr info. Nor does it\ninitialize the padding bytes of the structure inserted by the compiler\nfor alignment.\n\nAlso, if the socket is in state LLCP_CLOSED or is shutting down during\nreceive the msg_namelen member is not updated to 0 while otherwise\nreturning with 0, i.e. \"success\". The msg_namelen update is also\nmissing for stream and seqpacket sockets which don\u0027t fill the sockaddr\ninfo.\n\nBoth issues lead to the fact that the code will leak uninitialized\nkernel stack bytes in net/socket.c.\n\nFix the first issue by initializing the memory used for sockaddr info\nwith memset(0). Fix the second one by setting msg_namelen to 0 early.\nIt will be updated later if we\u0027re going to fill the msg_name member.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Lauro Ramos Venancio \u003clauro.venancio@openbossa.org\u003e\nCc: Aloisio Almeida Jr \u003caloisio.almeida@openbossa.org\u003e\nCc: Samuel Ortiz \u003csameo@linux.intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "cd5e3d9ff117b6cff7a82b076be20dc91eec3f4f", "tree": "2a86cd6125faf1ae2d4436bbca4163e8af24940a", "parents": [ "40aea043862dd46aa865587223e084da2e3e37cf" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:51:57 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:05 2013 -0700" }, "message": "netrom: fix info leak via msg_name in nr_recvmsg()\n\n[ Upstream commits 3ce5efad47b62c57a4f5c54248347085a750ce0e and\n c802d759623acbd6e1ee9fbdabae89159a513913 ]\n\nIn case msg_name is set the sockaddr info gets filled out, as\nrequested, but the code fails to initialize the padding bytes of\nstruct sockaddr_ax25 inserted by the compiler for alignment. Also\nthe sax25_ndigis member does not get assigned, leaking four more\nbytes.\n\nBoth issues lead to the fact that the code will leak uninitialized\nkernel stack bytes in net/socket.c.\n\nFix both issues by initializing the memory with memset(0).\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Ralf Baechle \u003cralf@linux-mips.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "40aea043862dd46aa865587223e084da2e3e37cf", "tree": "5bc92d84d808aa2eac326ded541424736f78bf3f", "parents": [ "dbd99572c687037ca7ddb31df2d7fd364732c670" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:51:56 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:05 2013 -0700" }, "message": "llc: Fix missing msg_namelen update in llc_ui_recvmsg()\n\n[ Upstream commit c77a4b9cffb6215a15196ec499490d116dfad181 ]\n\nFor stream sockets the code misses to update the msg_namelen member\nto 0 and therefore makes net/socket.c leak the local, uninitialized\nsockaddr_storage variable to userland -- 128 bytes of kernel stack\nmemory. The msg_namelen update is also missing for datagram sockets\nin case the socket is shutting down during receive.\n\nFix both issues by setting msg_namelen to 0 early. It will be\nupdated later if we\u0027re going to fill the msg_name member.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@ghostprotocols.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "dbd99572c687037ca7ddb31df2d7fd364732c670", "tree": "b1bb07420d7803b58fb15b2548a170e611cab07f", "parents": [ "d3dd6298cdf289b410c030f0d329020cffd85a1d" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:51:54 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:05 2013 -0700" }, "message": "iucv: Fix missing msg_namelen update in iucv_sock_recvmsg()\n\n[ Upstream commit a5598bd9c087dc0efc250a5221e5d0e6f584ee88 ]\n\nThe current code does not fill the msg_name member in case it is set.\nIt also does not set the msg_namelen member to 0 and therefore makes\nnet/socket.c leak the local, uninitialized sockaddr_storage variable\nto userland -- 128 bytes of kernel stack memory.\n\nFix that by simply setting msg_namelen to 0 as obviously nobody cared\nabout iucv_sock_recvmsg() not filling the msg_name in case it was set.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Ursula Braun \u003cursula.braun@de.ibm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d3dd6298cdf289b410c030f0d329020cffd85a1d", "tree": "a1a797d7cb34156d1233b41bec10e8e50a495891", "parents": [ "3300687d7ebb7a8abd9945843629b09194d97430" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:51:53 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:05 2013 -0700" }, "message": "irda: Fix missing msg_namelen update in irda_recvmsg_dgram()\n\n[ Upstream commit 5ae94c0d2f0bed41d6718be743985d61b7f5c47d ]\n\nThe current code does not fill the msg_name member in case it is set.\nIt also does not set the msg_namelen member to 0 and therefore makes\nnet/socket.c leak the local, uninitialized sockaddr_storage variable\nto userland -- 128 bytes of kernel stack memory.\n\nFix that by simply setting msg_namelen to 0 as obviously nobody cared\nabout irda_recvmsg_dgram() not filling the msg_name in case it was\nset.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Samuel Ortiz \u003csamuel@sortiz.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3300687d7ebb7a8abd9945843629b09194d97430", "tree": "295d964990f8c342f62b0816a04df330f309f5b6", "parents": [ "2d97f68d03180ad0a47fdb7c02f0fecdac9ad9a7" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:51:52 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:04 2013 -0700" }, "message": "caif: Fix missing msg_namelen update in caif_seqpkt_recvmsg()\n\n[ Upstream commit 2d6fbfe733f35c6b355c216644e08e149c61b271 ]\n\nThe current code does not fill the msg_name member in case it is set.\nIt also does not set the msg_namelen member to 0 and therefore makes\nnet/socket.c leak the local, uninitialized sockaddr_storage variable\nto userland -- 128 bytes of kernel stack memory.\n\nFix that by simply setting msg_namelen to 0 as obviously nobody cared\nabout caif_seqpkt_recvmsg() not filling the msg_name in case it was\nset.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Sjur Braendeland \u003csjur.brandeland@stericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2d97f68d03180ad0a47fdb7c02f0fecdac9ad9a7", "tree": "a6e89fe7325ebee91833c2c967f3e493e33bdf43", "parents": [ "a776cc3f3ae0b7d0f6137f4dc98470e3d4bb52d0" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:51:50 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:04 2013 -0700" }, "message": "Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg()\n\n[ Upstream commit e11e0455c0d7d3d62276a0c55d9dfbc16779d691 ]\n\nIf RFCOMM_DEFER_SETUP is set in the flags, rfcomm_sock_recvmsg() returns\nearly with 0 without updating the possibly set msg_namelen member. This,\nin turn, leads to a 128 byte kernel stack leak in net/socket.c.\n\nFix this by updating msg_namelen in this case. For all other cases it\nwill be handled in bt_sock_stream_recvmsg().\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nCc: Gustavo Padovan \u003cgustavo@padovan.org\u003e\nCc: Johan Hedberg \u003cjohan.hedberg@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a776cc3f3ae0b7d0f6137f4dc98470e3d4bb52d0", "tree": "f9d1b0c839e9c1fef99b4d99f51af6dfd201e5ca", "parents": [ "03730954ad1dd8b5027565c1e20b427d5be5a66f" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:51:49 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:04 2013 -0700" }, "message": "Bluetooth: fix possible info leak in bt_sock_recvmsg()\n\n[ Upstream commit 4683f42fde3977bdb4e8a09622788cc8b5313778 ]\n\nIn case the socket is already shutting down, bt_sock_recvmsg() returns\nwith 0 without updating msg_namelen leading to net/socket.c leaking the\nlocal, uninitialized sockaddr_storage variable to userland -- 128 bytes\nof kernel stack memory.\n\nFix this by moving the msg_namelen assignment in front of the shutdown\ntest.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nCc: Gustavo Padovan \u003cgustavo@padovan.org\u003e\nCc: Johan Hedberg \u003cjohan.hedberg@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "03730954ad1dd8b5027565c1e20b427d5be5a66f", "tree": "4003c893160251abc800846487f319a1dc808843", "parents": [ "0e242b8561d006aa66c12ab997cc3d729cf2c9ca" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:51:48 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:04 2013 -0700" }, "message": "ax25: fix info leak via msg_name in ax25_recvmsg()\n\n[ Upstream commit ef3313e84acbf349caecae942ab3ab731471f1a1 ]\n\nWhen msg_namelen is non-zero the sockaddr info gets filled out, as\nrequested, but the code fails to initialize the padding bytes of struct\nsockaddr_ax25 inserted by the compiler for alignment. Additionally the\nmsg_namelen value is updated to sizeof(struct full_sockaddr_ax25) but is\nnot always filled up to this size.\n\nBoth issues lead to the fact that the code will leak uninitialized\nkernel stack bytes in net/socket.c.\n\nFix both issues by initializing the memory with memset(0).\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Ralf Baechle \u003cralf@linux-mips.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0e242b8561d006aa66c12ab997cc3d729cf2c9ca", "tree": "254267c454c08f4ce4ca20273cd88498781e9397", "parents": [ "bf6f841f7fde2731ea39698064a81492ce777fa6" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 01:51:47 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:04 2013 -0700" }, "message": "atm: update msg_namelen in vcc_recvmsg()\n\n[ Upstream commit 9b3e617f3df53822345a8573b6d358f6b9e5ed87 ]\n\nThe current code does not fill the msg_name member in case it is set.\nIt also does not set the msg_namelen member to 0 and therefore makes\nnet/socket.c leak the local, uninitialized sockaddr_storage variable\nto userland -- 128 bytes of kernel stack memory.\n\nFix that by simply setting msg_namelen to 0 as obviously nobody cared\nabout vcc_recvmsg() not filling the msg_name in case it was set.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bf6f841f7fde2731ea39698064a81492ce777fa6", "tree": "592082d61397b8ec643b1c73a0e39ad7e02dc5b2", "parents": [ "c61642cce0247175489666d90ebd59f8a04e7c76" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Apr 19 17:26:26 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:03 2013 -0700" }, "message": "sparc64: Fix race in TLB batch processing.\n\n[ Commits f36391d2790d04993f48da6a45810033a2cdf847 and\n f0af97070acbad5d6a361f485828223a4faaa0ee upstream. ]\n\nAs reported by Dave Kleikamp, when we emit cross calls to do batched\nTLB flush processing we have a race because we do not synchronize on\nthe sibling cpus completing the cross call.\n\nSo meanwhile the TLB batch can be reset (tb-\u003etlb_nr set to zero, etc.)\nand either flushes are missed or flushes will flush the wrong\naddresses.\n\nFix this by using generic infrastructure to synchonize on the\ncompletion of the cross call.\n\nThis first required getting the flush_tlb_pending() call out from\nswitch_to() which operates with locks held and interrupts disabled.\nThe problem is that smp_call_function_many() cannot be invoked with\nIRQs disabled and this is explicitly checked for with WARN_ON_ONCE().\n\nWe get the batch processing outside of locked IRQ disabled sections by\nusing some ideas from the powerpc port. Namely, we only batch inside\nof arch_{enter,leave}_lazy_mmu_mode() calls. If we\u0027re not in such a\nregion, we flush TLBs synchronously.\n\n1) Get rid of xcall_flush_tlb_pending and per-cpu type\n implementations.\n\n2) Do TLB batch cross calls instead via:\n\n\tsmp_call_function_many()\n\t\ttlb_pending_func()\n\t\t\t__flush_tlb_pending()\n\n3) Batch only in lazy mmu sequences:\n\n\ta) Add \u0027active\u0027 member to struct tlb_batch\n\tb) Define __HAVE_ARCH_ENTER_LAZY_MMU_MODE\n\tc) Set \u0027active\u0027 in arch_enter_lazy_mmu_mode()\n\td) Run batch and clear \u0027active\u0027 in arch_leave_lazy_mmu_mode()\n\te) Check \u0027active\u0027 in tlb_batch_add_one() and do a synchronous\n flush if it\u0027s clear.\n\n4) Add infrastructure for synchronous TLB page flushes.\n\n\ta) Implement __flush_tlb_page and per-cpu variants, patch\n\t as needed.\n\tb) Likewise for xcall_flush_tlb_page.\n\tc) Implement smp_flush_tlb_page() to invoke the cross-call.\n\td) Wire up global_flush_tlb_page() to the right routine based\n upon CONFIG_SMP\n\n5) It turns out that singleton batches are very common, 2 out of every\n 3 batch flushes have only a single entry in them.\n\n The batch flush waiting is very expensive, both because of the poll\n on sibling cpu completeion, as well as because passing the tlb batch\n pointer to the sibling cpus invokes a shared memory dereference.\n\n Therefore, in flush_tlb_pending(), if there is only one entry in\n the batch perform a completely asynchronous global_flush_tlb_page()\n instead.\n\nReported-by: Dave Kleikamp \u003cdave.kleikamp@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nAcked-by: Dave Kleikamp \u003cdave.kleikamp@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c61642cce0247175489666d90ebd59f8a04e7c76", "tree": "b05f246d9e65422b243f1ff9dcbd41a6af01247c", "parents": [ "3ab8db7b9c2e0a399e65a95999e0794a85c63975" ], "author": { "name": "Jiri Slaby", "email": "jslaby@suse.cz", "time": "Fri Apr 26 13:48:53 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:03 2013 -0700" }, "message": "TTY: fix atime/mtime regression\n\ncommit 37b7f3c76595e23257f61bd80b223de8658617ee upstream.\n\nIn commit b0de59b5733d (\"TTY: do not update atime/mtime on read/write\")\nwe removed timestamps from tty inodes to fix a security issue and waited\nif something breaks. Well, \u0027w\u0027, the utility to find out logged users\nand their inactivity time broke. It shows that users are inactive since\nthe time they logged in.\n\nTo revert to the old behaviour while still preventing attackers to\nguess the password length, we update the timestamps in one-minute\nintervals by this patch.\n\nSigned-off-by: Jiri Slaby \u003cjslaby@suse.cz\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3ab8db7b9c2e0a399e65a95999e0794a85c63975", "tree": "63b1cbf8ad7016b4a0f6b360da0f18c77762461d", "parents": [ "6bcd3002a29b597e2774a733b74c204c1b344026" ], "author": { "name": "Jiri Slaby", "email": "jslaby@suse.cz", "time": "Fri Feb 15 15:25:05 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:03 2013 -0700" }, "message": "TTY: do not update atime/mtime on read/write\n\ncommit b0de59b5733d18b0d1974a060860a8b5c1b36a2e upstream.\n\nOn http://vladz.devzero.fr/013_ptmx-timing.php, we can see how to find\nout length of a password using timestamps of /dev/ptmx. It is\ndocumented in \"Timing Analysis of Keystrokes and Timing Attacks on\nSSH\". To avoid that problem, do not update time when reading\nfrom/writing to a TTY.\n\nI am afraid of regressions as this is a behavior we have since 0.97\nand apps may expect the time to be current, e.g. for monitoring\nwhether there was a change on the TTY. Now, there is no change. So\nthis would better have a lot of testing before it goes upstream.\n\nReferences: CVE-2013-0160\n\nSigned-off-by: Jiri Slaby \u003cjslaby@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6bcd3002a29b597e2774a733b74c204c1b344026", "tree": "dcc922057f94881f9deaa8339b068a8e4499bb44", "parents": [ "a5a9e7c9c19b03b471d3ec148698e90a1958bfcb" ], "author": { "name": "Zhao Hongjiang", "email": "zhaohongjiang@huawei.com", "time": "Fri Apr 26 11:03:53 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:03 2013 -0700" }, "message": "aio: fix possible invalid memory access when DEBUG is enabled\n\ncommit 91d80a84bbc8f28375cca7e65ec666577b4209ad upstream.\n\ndprintk() shouldn\u0027t access @ring after it\u0027s unmapped.\n\nSigned-off-by: Zhao Hongjiang \u003czhaohongjiang@huawei.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a5a9e7c9c19b03b471d3ec148698e90a1958bfcb", "tree": "9a0a0978a2d97851863af6a098176771e28869c3", "parents": [ "8fdeb71b5022b4578e3339b861019c5a00c77700" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:20:25 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:20:25 2013 -0700" }, "message": "Linux 3.4.42\n" }, { "commit": "8fdeb71b5022b4578e3339b861019c5a00c77700", "tree": "cc4927db4b7ffea456e2df5e330e18bceb5e5aa7", "parents": [ "b00919cd72ed9753390a9fbb5541cbba12e5e826" ], "author": { "name": "Josef Bacik", "email": "jbacik@fusionio.com", "time": "Fri Apr 05 20:50:09 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:56 2013 -0700" }, "message": "Btrfs: make sure nbytes are right after log replay\n\ncommit 4bc4bee4595662d8bff92180d5c32e3313a704b0 upstream.\n\nWhile trying to track down a tree log replay bug I noticed that fsck was always\ncomplaining about nbytes not being right for our fsynced file. That is because\nthe new fsync stuff doesn\u0027t wait for ordered extents to complete, so the inodes\nnbytes are not necessarily updated properly when we log it. So to fix this we\nneed to set nbytes to whatever it is on the inode that is on disk, so when we\nreplay the extents we can just add the bytes that are being added as we replay\nthe extent. This makes it work for the case that we have the wrong nbytes or\nthe case that we logged everything and nbytes is actually correct. With this\nI\u0027m no longer getting nbytes errors out of btrfsck.\n\nSigned-off-by: Josef Bacik \u003cjbacik@fusionio.com\u003e\nSigned-off-by: Chris Mason \u003cchris.mason@fusionio.com\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nReviewed-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b00919cd72ed9753390a9fbb5541cbba12e5e826", "tree": "a6bf9da2987a4fc45b918aba60f651e279ca8285", "parents": [ "5de41ebef9458aa13955c5a3792c2f86d6e4fdda" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 19 09:53:07 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:56 2013 -0700" }, "message": "vm: convert mtdchar mmap to vm_iomap_memory() helper\n\ncommit 8558e4a26b00225efeb085725bc319f91201b239 upstream.\n\nThis is my example conversion of a few existing mmap users. The mtdchar\ncase is actually disabled right now (and stays disabled), but I did it\nbecause it showed up on my \"git grep\", and I was familiar with the code\ndue to fixing an overflow problem in the code in commit 9c603e53d380\n(\"mtdchar: fix offset overflow detection\").\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5de41ebef9458aa13955c5a3792c2f86d6e4fdda", "tree": "1244c2f117a1a27676baa623e9de70538e2f857e", "parents": [ "b67bca9e17d63641aceefe5d5b112c065b478206" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 19 09:46:39 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:56 2013 -0700" }, "message": "vm: convert HPET mmap to vm_iomap_memory() helper\n\ncommit 2323036dfec8ce3ce6e1c86a49a31b039f3300d1 upstream.\n\nThis is my example conversion of a few existing mmap users. The HPET\ncase is simple, widely available, and easy to test (Clemens Ladisch sent\na trivial test-program for it).\n\nTest-program-by: Clemens Ladisch \u003cclemens@ladisch.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b67bca9e17d63641aceefe5d5b112c065b478206", "tree": "69902e8a9bb6608e3c4146fb536cde4f30fb8c31", "parents": [ "ada37d85783ec8e314bd9b020b89d8a63a7587f2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 19 09:57:35 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:56 2013 -0700" }, "message": "vm: convert fb_mmap to vm_iomap_memory() helper\n\ncommit fc9bbca8f650e5f738af8806317c0a041a48ae4a upstream.\n\nThis is my example conversion of a few existing mmap users. The\nfb_mmap() case is a good example because it is a bit more complicated\nthan some: fb_mmap() mmaps one of two different memory areas depending\non the page offset of the mmap (but happily there is never any mixing of\nthe two, so the helper function still works).\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ada37d85783ec8e314bd9b020b89d8a63a7587f2", "tree": "87c265516e819be02cde78cc1217e58d834d81de", "parents": [ "c420060e7b21368c21972e8a29e4ff56abb9d219" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 19 10:01:04 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:56 2013 -0700" }, "message": "vm: convert snd_pcm_lib_mmap_iomem() to vm_iomap_memory() helper\n\ncommit 0fe09a45c4848b5b5607b968d959fdc1821c161d upstream.\n\nThis is my example conversion of a few existing mmap users. The pcm\nmmap case is one of the more straightforward ones.\n\nAcked-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c420060e7b21368c21972e8a29e4ff56abb9d219", "tree": "069e6e4afb23f00817a7daf0bec549435359ab27", "parents": [ "726cc91ed26521f3e678346e5745203a70edd456" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 16 13:45:37 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:56 2013 -0700" }, "message": "vm: add vm_iomap_memory() helper function\n\ncommit b4cbb197c7e7a68dbad0d491242e3ca67420c13e upstream.\n\nVarious drivers end up replicating the code to mmap() their memory\nbuffers into user space, and our core memory remapping function may be\nvery flexible but it is unnecessarily complicated for the common cases\nto use.\n\nOur internal VM uses pfn\u0027s (\"page frame numbers\") which simplifies\nthings for the VM, and allows us to pass physical addresses around in a\ndenser and more efficient format than passing a \"phys_addr_t\" around,\nand having to shift it up and down by the page size. But it just means\nthat drivers end up doing that shifting instead at the interface level.\n\nIt also means that drivers end up mucking around with internal VM things\nlike the vma details (vm_pgoff, vm_start/end) way more than they really\nneed to.\n\nSo this just exports a function to map a certain physical memory range\ninto user space (using a phys_addr_t based interface that is much more\nnatural for a driver) and hides all the complexity from the driver.\nSome drivers will still end up tweaking the vm_page_prot details for\nthings like prefetching or cacheability etc, but that\u0027s actually\nrelevant to the driver, rather than caring about what the page offset of\nthe mapping is into the particular IO memory region.\n\nAcked-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n\n" }, { "commit": "726cc91ed26521f3e678346e5745203a70edd456", "tree": "499c4469d19b686025457586bdff9832bdd19c81", "parents": [ "6b48c21afcf0f9f01bb37144a5da3274a3590404" ], "author": { "name": "Dave Airlie", "email": "airlied@gmail.com", "time": "Fri Jan 25 11:38:56 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:56 2013 -0700" }, "message": "fbcon: fix locking harder\n\ncommit 054430e773c9a1e26f38e30156eff02dedfffc17 upstream.\n\nOkay so Alan\u0027s patch handled the case where there was no registered fbcon,\nhowever the other path entered in set_con2fb_map pit.\n\nIn there we called fbcon_takeover, but we also took the console lock in a couple\nof places. So push the console lock out to the callers of set_con2fb_map,\n\nthis means fbmem and switcheroo needed to take the lock around the fb notifier\nentry points that lead to this.\n\nThis should fix the efifb regression seen by Maarten.\n\nTested-by: Maarten Lankhorst \u003cmaarten.lankhorst@canonical.com\u003e\nTested-by: Lu Hua \u003chuax.lu@intel.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6b48c21afcf0f9f01bb37144a5da3274a3590404", "tree": "7fb41caeefc902a7a329419767af089851f36359", "parents": [ "da307d100cd4979e353e8265d0691263aa2a0086" ], "author": { "name": "Stephane Eranian", "email": "eranian@google.com", "time": "Tue Apr 16 13:51:43 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "perf/x86: Fix offcore_rsp valid mask for SNB/IVB\n\ncommit f1923820c447e986a9da0fc6bf60c1dccdf0408e upstream.\n\nThe valid mask for both offcore_response_0 and\noffcore_response_1 was wrong for SNB/SNB-EP,\nIVB/IVB-EP. It was possible to write to\nreserved bit and cause a GP fault crashing\nthe kernel.\n\nThis patch fixes the problem by correctly marking the\nreserved bits in the valid mask for all the processors\nmentioned above.\n\nA distinction between desktop and server parts is introduced\nbecause bits 24-30 are only available on the server parts.\n\nThis version of the patch is just a rebase to perf/urgent tree\nand should apply to older kernels as well.\n\nSigned-off-by: Stephane Eranian \u003ceranian@google.com\u003e\nCc: peterz@infradead.org\nCc: jolsa@redhat.com\nCc: ak@linux.intel.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "da307d100cd4979e353e8265d0691263aa2a0086", "tree": "616b976a535fa6a9e8fdebcde048c9260d52897b", "parents": [ "a3c21277df060c3c83b2aba4120d0370cf204d36" ], "author": { "name": "Tommi Rantala", "email": "tt.rantala@gmail.com", "time": "Sat Apr 13 22:49:14 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "perf: Treat attr.config as u64 in perf_swevent_init()\n\ncommit 8176cced706b5e5d15887584150764894e94e02f upstream.\n\nTrinity discovered that we fail to check all 64 bits of\nattr.config passed by user space, resulting to out-of-bounds\naccess of the perf_swevent_enabled array in\nsw_perf_event_destroy().\n\nIntroduced in commit b0a873ebb (\"perf: Register PMU\nimplementations\").\n\nSigned-off-by: Tommi Rantala \u003ctt.rantala@gmail.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: davej@redhat.com\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@ghostprotocols.net\u003e\nLink: http://lkml.kernel.org/r/1365882554-30259-1-git-send-email-tt.rantala@gmail.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a3c21277df060c3c83b2aba4120d0370cf204d36", "tree": "718623a53484bf035f4e90989210480a6374c47e", "parents": [ "d6b8c333ca71eba35911fc4460ca37568ccfa9c0" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Apr 07 14:05:39 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "crypto: algif - suppress sending source address information in recvmsg\n\ncommit 72a763d805a48ac8c0bf48fdb510e84c12de51fe upstream.\n\nThe current code does not set the msg_namelen member to 0 and therefore\nmakes net/socket.c leak the local sockaddr_storage variable to userland\n-- 128 bytes of kernel stack memory. Fix that.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d6b8c333ca71eba35911fc4460ca37568ccfa9c0", "tree": "da26dfb9cb9e1e4b672dd22bea47f4486bf6d75b", "parents": [ "f4ec6e0f475dd23157042a150c8f3dcfa528a8ca" ], "author": { "name": "Rafał Miłecki", "email": "zajec5@gmail.com", "time": "Tue Apr 02 15:57:26 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "ssb: implement spurious tone avoidance\n\ncommit 46fc4c909339f5a84d1679045297d9d2fb596987 upstream.\n\nAnd make use of it in b43. This fixes a regression introduced with\n49d55cef5b1925a5c1efb6aaddaa40fc7c693335\nb43: N-PHY: implement spurious tone avoidance\nThis commit made BCM4322 use only MCS 0 on channel 13, which of course\nresulted in performance drop (down to 0.7Mb/s).\n\nReported-by: Stefan Brüns \u003cstefan.bruens@rwth-aachen.de\u003e\nSigned-off-by: Rafał Miłecki \u003czajec5@gmail.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f4ec6e0f475dd23157042a150c8f3dcfa528a8ca", "tree": "fd22cbce7e12e2347b05ec744bb1299d4e9ba0d9", "parents": [ "563868a2e90aa94d8af2dbdb2e448ed03b4847e5" ], "author": { "name": "Felix Fietkau", "email": "nbd@openwrt.org", "time": "Wed Apr 10 15:26:06 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "ath9k_hw: change AR9580 initvals to fix a stability issue\n\ncommit f09a878511997c25a76bf111a32f6b8345a701a5 upstream.\n\nThe hardware parsing of Control Wrapper Frames needs to be disabled, as\nit has been causing spurious decryption error reports. The initvals for\nother chips have been updated to disable it, but AR9580 was left out for\nsome reason.\n\nSigned-off-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "563868a2e90aa94d8af2dbdb2e448ed03b4847e5", "tree": "a8928a0d99b9bf908ab4cd7c66b780797d459ed4", "parents": [ "bb93ad5d30517e917aec4062c97c7712c4acaa0f" ], "author": { "name": "Felix Fietkau", "email": "nbd@openwrt.org", "time": "Sun Apr 07 21:10:48 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "ath9k_htc: accept 1.x firmware newer than 1.3\n\ncommit 319e7bd96aca64a478f3aad40711c928405b8b77 upstream.\n\nSince the firmware has been open sourced, the minor version has been\nbumped to 1.4 and the API/ABI will stay compatible across further 1.x\nreleases.\n\nSigned-off-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bb93ad5d30517e917aec4062c97c7712c4acaa0f", "tree": "d46a4287688b6176fc57fa5d11ee38cbd629e2e4", "parents": [ "9c275826b7522820c0346250bc373e32dfbec13d" ], "author": { "name": "Will Deacon", "email": "will.deacon@arm.com", "time": "Fri Apr 12 19:04:19 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "ARM: 7698/1: perf: fix group validation when using enable_on_exec\n\ncommit cb2d8b342aa084d1f3ac29966245dec9163677fb upstream.\n\nEvents may be created with attr-\u003edisabled \u003d\u003d 1 and attr-\u003eenable_on_exec\n\u003d\u003d 1, which confuses the group validation code because events with the\nPERF_EVENT_STATE_OFF are not considered candidates for scheduling, which\nmay lead to failure at group scheduling time.\n\nThis patch fixes the validation check for ARM, so that events in the\nOFF state are still considered when enable_on_exec is true.\n\nReported-by: Sudeep KarkadaNagesha \u003cSudeep.KarkadaNagesha@arm.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@ghostprotocols.net\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nSigned-off-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9c275826b7522820c0346250bc373e32dfbec13d", "tree": "dc6d8cd1e20ff4fa1daa678d858072779e545ef6", "parents": [ "410537558144cc886d780a02af9a09a122bff35b" ], "author": { "name": "Illia Ragozin", "email": "illia.ragozin@grapecom.com", "time": "Wed Apr 10 19:43:34 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "ARM: 7696/1: Fix kexec by setting outer_cache.inv_all for Feroceon\n\ncommit cd272d1ea71583170e95dde02c76166c7f9017e6 upstream.\n\nOn Feroceon the L2 cache becomes non-coherent with the CPU\nwhen the L1 caches are disabled. Thus the L2 needs to be invalidated\nafter both L1 caches are disabled.\n\nOn kexec before the starting the code for relocation the kernel,\nthe L1 caches are disabled in cpu_froc_fin (cpu_v7_proc_fin for Feroceon),\nbut after L2 cache is never invalidated, because inv_all is not set\nin cache-feroceon-l2.c.\nSo kernel relocation and decompression may has (and usually has) errors.\nSetting the function enables L2 invalidation and fixes the issue.\n\nSigned-off-by: Illia Ragozin \u003cillia.ragozin@grapecom.com\u003e\nAcked-by: Jason Cooper \u003cjason@lakedaemon.net\u003e\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "410537558144cc886d780a02af9a09a122bff35b", "tree": "4bb0fec2c15698657d1d5929db9ca3f8d5759954", "parents": [ "2a6b0247eee46f424e032fb7431cc4700ad19ea5" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Mar 18 12:22:34 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "sched: Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s\n\ncommit 383efcd00053ec40023010ce5034bd702e7ab373 upstream.\n\ntry_to_wake_up_local() should only be invoked to wake up another\ntask in the same runqueue and BUG_ON()s are used to enforce the\nrule. Missing try_to_wake_up_local() can stall workqueue\nexecution but such stalls are likely to be finite either by\nanother work item being queued or the one blocked getting\nunblocked. There\u0027s no reason to trigger BUG while holding rq\nlock crashing the whole system.\n\nConvert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/20130318192234.GD3042@htj.dyndns.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2a6b0247eee46f424e032fb7431cc4700ad19ea5", "tree": "99660b47a9ccc8e1123f4363ca0a95875a7f7ea6", "parents": [ "f56d137aa68f8edadac247aa48b335f2776954ff" ], "author": { "name": "Andrew Honig", "email": "ahonig@google.com", "time": "Fri Mar 29 09:35:21 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "KVM: Allow cross page reads and writes from cached translations.\n\ncommit 8f964525a121f2ff2df948dac908dcc65be21b5b upstream.\n\nThis patch adds support for kvm_gfn_to_hva_cache_init functions for\nreads and writes that will cross a page. If the range falls within\nthe same memslot, then this will be a fast operation. If the range\nis split between two memslots, then the slower kvm_read_guest and\nkvm_write_guest are used.\n\nTested: Test against kvm_clock unit tests.\n\nSigned-off-by: Andrew Honig \u003cahonig@google.com\u003e\nSigned-off-by: Gleb Natapov \u003cgleb@redhat.com\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f56d137aa68f8edadac247aa48b335f2776954ff", "tree": "7972505b31b9bcdd778e652ad5632167cd22998d", "parents": [ "f6dfc740c1d8f6133d2f53c1074770c13d040364" ], "author": { "name": "Andy Honig", "email": "ahonig@google.com", "time": "Wed Feb 20 14:49:16 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)\n\ncommit a2c118bfab8bc6b8bb213abfc35201e441693d55 upstream.\n\nIf the guest specifies a IOAPIC_REG_SELECT with an invalid value and follows\nthat with a read of the IOAPIC_REG_WINDOW KVM does not properly validate\nthat request. ioapic_read_indirect contains an\nASSERT(redir_index \u003c IOAPIC_NUM_PINS), but the ASSERT has no effect in\nnon-debug builds. In recent kernels this allows a guest to cause a kernel\noops by reading invalid memory. In older kernels (pre-3.3) this allows a\nguest to read from large ranges of host memory.\n\nTested: tested against apic unit tests.\n\nSigned-off-by: Andrew Honig \u003cahonig@google.com\u003e\nSigned-off-by: Marcelo Tosatti \u003cmtosatti@redhat.com\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f6dfc740c1d8f6133d2f53c1074770c13d040364", "tree": "db8b3ad3d7e1eb26fadae2a233ae1a4db53784b8", "parents": [ "ce7d8662581f032101ca70bbe1a2e62cd93fd1bc" ], "author": { "name": "Andy Honig", "email": "ahonig@google.com", "time": "Wed Feb 20 14:48:10 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797)\n\ncommit 0b79459b482e85cb7426aa7da683a9f2c97aeae1 upstream.\n\nThere is a potential use after free issue with the handling of\nMSR_KVM_SYSTEM_TIME. If the guest specifies a GPA in a movable or removable\nmemory such as frame buffers then KVM might continue to write to that\naddress even after it\u0027s removed via KVM_SET_USER_MEMORY_REGION. KVM pins\nthe page in memory so it\u0027s unlikely to cause an issue, but if the user\nspace component re-purposes the memory previously used for the guest, then\nthe guest will be able to corrupt that memory.\n\nTested: Tested against kvmclock unit test\n\nSigned-off-by: Andrew Honig \u003cahonig@google.com\u003e\nSigned-off-by: Marcelo Tosatti \u003cmtosatti@redhat.com\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "ce7d8662581f032101ca70bbe1a2e62cd93fd1bc", "tree": "56fe1217a3f7f21a9cf7dd4e5aebc214a4a90efd", "parents": [ "e3aa8553976945b33cc83c6432fab7568ba11b04" ], "author": { "name": "Andy Honig", "email": "ahonig@google.com", "time": "Mon Mar 11 09:34:52 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796)\n\ncommit c300aa64ddf57d9c5d9c898a64b36877345dd4a9 upstream.\n\nIf the guest sets the GPA of the time_page so that the request to update the\ntime straddles a page then KVM will write onto an incorrect page. The\nwrite is done byusing kmap atomic to get a pointer to the page for the time\nstructure and then performing a memcpy to that page starting at an offset\nthat the guest controls. Well behaved guests always provide a 32-byte aligned\naddress, however a malicious guest could use this to corrupt host kernel\nmemory.\n\nTested: Tested against kvmclock unit test.\n\nSigned-off-by: Andrew Honig \u003cahonig@google.com\u003e\nSigned-off-by: Marcelo Tosatti \u003cmtosatti@redhat.com\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e3aa8553976945b33cc83c6432fab7568ba11b04", "tree": "78029b7054800737c27506d84ca063d2d65a8fef", "parents": [ "cf276742f2dcdf5258aac98447e8b4b9fba55aaa" ], "author": { "name": "Vyacheslav Dubeyko", "email": "slava@dubeyko.com", "time": "Wed Apr 17 15:58:33 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "hfsplus: fix potential overflow in hfsplus_file_truncate()\n\ncommit 12f267a20aecf8b84a2a9069b9011f1661c779b4 upstream.\n\nChange a u32 to loff_t hfsplus_file_truncate().\n\nSigned-off-by: Vyacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nCc: Christoph Hellwig \u003chch@infradead.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Hin-Tak Leung \u003chtl10@users.sourceforge.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cf276742f2dcdf5258aac98447e8b4b9fba55aaa", "tree": "6de34c2bd35c7c5756470dabd4c30df3d7fc3b3d", "parents": [ "f42097f7eb860a967d1629c4bb00f2a083edc1dc" ], "author": { "name": "Emese Revfy", "email": "re.emese@gmail.com", "time": "Wed Apr 17 15:58:36 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "kernel/signal.c: stop info leak via the tkill and the tgkill syscalls\n\ncommit b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f upstream.\n\nThis fixes a kernel memory contents leak via the tkill and tgkill syscalls\nfor compat processes.\n\nThis is visible in the siginfo_t-\u003e_sifields._rt.si_sigval.sival_ptr field\nwhen handling signals delivered from tkill.\n\nThe place of the infoleak:\n\nint copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)\n{\n ...\n put_user_ex(ptr_to_compat(from-\u003esi_ptr), \u0026to-\u003esi_ptr);\n ...\n}\n\nSigned-off-by: Emese Revfy \u003cre.emese@gmail.com\u003e\nReviewed-by: PaX Team \u003cpageexec@freemail.hu\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f42097f7eb860a967d1629c4bb00f2a083edc1dc", "tree": "4ce01e4ea7e752794e5e7c1bf6067227467d70bd", "parents": [ "4f969dd6ce2941f9ce917684a058af2d7f6c77e9" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Wed Apr 17 15:58:30 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "hugetlbfs: add swap entry check in follow_hugetlb_page()\n\ncommit 9cc3a5bd40067b9a0fbd49199d0780463fc2140f upstream.\n\nWith applying the previous patch \"hugetlbfs: stop setting VM_DONTDUMP in\ninitializing vma(VM_HUGETLB)\" to reenable hugepage coredump, if a memory\nerror happens on a hugepage and the affected processes try to access the\nerror hugepage, we hit VM_BUG_ON(atomic_read(\u0026page-\u003e_count) \u003c\u003d 0) in\nget_page().\n\nThe reason for this bug is that coredump-related code doesn\u0027t recognise\n\"hugepage hwpoison entry\" with which a pmd entry is replaced when a memory\nerror occurs on a hugepage.\n\nIn other words, physical address information is stored in different bit\nlayout between hugepage hwpoison entry and pmd entry, so\nfollow_hugetlb_page() which is called in get_dump_page() returns a wrong\npage from a given address.\n\nThe expected behavior is like this:\n\n absent is_swap_pte FOLL_DUMP Expected behavior\n -------------------------------------------------------------------\n true false false hugetlb_fault\n false true false hugetlb_fault\n false false false return page\n true false true skip page (to avoid allocation)\n false true true hugetlb_fault\n false false true return page\n\nWith this patch, we can call hugetlb_fault() and take proper actions (we\nwait for migration entries, fail with VM_FAULT_HWPOISON_LARGE for\nhwpoisoned entries,) and as the result we can dump all hugepages except\nfor hwpoisoned ones.\n\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: HATAYAMA Daisuke \u003cd.hatayama@jp.fujitsu.com\u003e\nAcked-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4f969dd6ce2941f9ce917684a058af2d7f6c77e9", "tree": "28ee747a52ccf87c02a939683c9e75c24b73cdf2", "parents": [ "110360768eb74d67bac851b7c0209a923258a314" ], "author": { "name": "Christoph Fritz", "email": "chf.fritz@googlemail.com", "time": "Thu Apr 11 21:32:57 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "can: sja1000: fix handling on dt properties on little endian systems\n\ncommit 0443de5fbf224abf41f688d8487b0c307dc5a4b4 upstream.\n\nTo get correct endianes on little endian cpus (like arm) while reading device\ntree properties, this patch replaces of_get_property() with\nof_property_read_u32(). While there use of_property_read_bool() for the\nhandling of the boolean \"nxp,no-comparator-bypass\" property.\n\nSigned-off-by: Christoph Fritz \u003cchf.fritz@googlemail.com\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "110360768eb74d67bac851b7c0209a923258a314", "tree": "b51a45e613abfe9c2c27f7d210be22a56103b83b", "parents": [ "816e2bb1b20b734d2e4286c12f0b18ae9dff35ab" ], "author": { "name": "Michael Bohan", "email": "mbohan@codeaurora.org", "time": "Tue Mar 19 19:19:25 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "hrtimer: Don\u0027t reinitialize a cpu_base lock on CPU_UP\n\ncommit 84cc8fd2fe65866e49d70b38b3fdf7219dd92fe0 upstream.\n\nThe current code makes the assumption that a cpu_base lock won\u0027t be\nheld if the CPU corresponding to that cpu_base is offline, which isn\u0027t\nalways true.\n\nIf a hrtimer is not queued, then it will not be migrated by\nmigrate_hrtimers() when a CPU is offlined. Therefore, the hrtimer\u0027s\ncpu_base may still point to a CPU which has subsequently gone offline\nif the timer wasn\u0027t enqueued at the time the CPU went down.\n\nNormally this wouldn\u0027t be a problem, but a cpu_base\u0027s lock is blindly\nreinitialized each time a CPU is brought up. If a CPU is brought\nonline during the period that another thread is performing a hrtimer\noperation on a stale hrtimer, then the lock will be reinitialized\nunder its feet, and a SPIN_BUG() like the following will be observed:\n\n\u003c0\u003e[ 28.082085] BUG: spinlock already unlocked on CPU#0, swapper/0/0\n\u003c0\u003e[ 28.087078] lock: 0xc4780b40, value 0x0 .magic: dead4ead, .owner: \u003cnone\u003e/-1, .owner_cpu: -1\n\u003c4\u003e[ 42.451150] [\u003cc0014398\u003e] (unwind_backtrace+0x0/0x120) from [\u003cc0269220\u003e] (do_raw_spin_unlock+0x44/0xdc)\n\u003c4\u003e[ 42.460430] [\u003cc0269220\u003e] (do_raw_spin_unlock+0x44/0xdc) from [\u003cc071b5bc\u003e] (_raw_spin_unlock+0x8/0x30)\n\u003c4\u003e[ 42.469632] [\u003cc071b5bc\u003e] (_raw_spin_unlock+0x8/0x30) from [\u003cc00a9ce0\u003e] (__hrtimer_start_range_ns+0x1e4/0x4f8)\n\u003c4\u003e[ 42.479521] [\u003cc00a9ce0\u003e] (__hrtimer_start_range_ns+0x1e4/0x4f8) from [\u003cc00aa014\u003e] (hrtimer_start+0x20/0x28)\n\u003c4\u003e[ 42.489247] [\u003cc00aa014\u003e] (hrtimer_start+0x20/0x28) from [\u003cc00e6190\u003e] (rcu_idle_enter_common+0x1ac/0x320)\n\u003c4\u003e[ 42.498709] [\u003cc00e6190\u003e] (rcu_idle_enter_common+0x1ac/0x320) from [\u003cc00e6440\u003e] (rcu_idle_enter+0xa0/0xb8)\n\u003c4\u003e[ 42.508259] [\u003cc00e6440\u003e] (rcu_idle_enter+0xa0/0xb8) from [\u003cc000f268\u003e] (cpu_idle+0x24/0xf0)\n\u003c4\u003e[ 42.516503] [\u003cc000f268\u003e] (cpu_idle+0x24/0xf0) from [\u003cc06ed3c0\u003e] (rest_init+0x88/0xa0)\n\u003c4\u003e[ 42.524319] [\u003cc06ed3c0\u003e] (rest_init+0x88/0xa0) from [\u003cc0c00978\u003e] (start_kernel+0x3d0/0x434)\n\nAs an example, this particular crash occurred when hrtimer_start() was\nexecuted on CPU #0. The code locked the hrtimer\u0027s current cpu_base\ncorresponding to CPU #1. CPU #0 then tried to switch the hrtimer\u0027s\ncpu_base to an optimal CPU which was online. In this case, it selected\nthe cpu_base corresponding to CPU #3.\n\nBefore it could proceed, CPU #1 came online and reinitialized the\nspinlock corresponding to its cpu_base. Thus now CPU #0 held a lock\nwhich was reinitialized. When CPU #0 finally ended up unlocking the\nold cpu_base corresponding to CPU #1 so that it could switch to CPU\n#3, we hit this SPIN_BUG() above while in switch_hrtimer_base().\n\nCPU #0 CPU #1\n---- ----\n... \u003coffline\u003e\nhrtimer_start()\nlock_hrtimer_base(base #1)\n... init_hrtimers_cpu()\nswitch_hrtimer_base() ...\n... raw_spin_lock_init(\u0026cpu_base-\u003elock)\nraw_spin_unlock(\u0026cpu_base-\u003elock) ...\n\u003cspin_bug\u003e\n\nSolve this by statically initializing the lock.\n\nSigned-off-by: Michael Bohan \u003cmbohan@codeaurora.org\u003e\nLink: http://lkml.kernel.org/r/1363745965-23475-1-git-send-email-mbohan@codeaurora.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "816e2bb1b20b734d2e4286c12f0b18ae9dff35ab", "tree": "390509d174235bd9a79a0b8d5ccd586c0d9b66a9", "parents": [ "94402d16da4e122c8976b61145432e1c3ccfbd29" ], "author": { "name": "Russell King", "email": "rmk+kernel@arm.linux.org.uk", "time": "Mon Apr 08 11:44:57 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "ARM: Do 15e0d9e37c (ARM: pm: let platforms select cpu_suspend support) properly\n\ncommit b6c7aabd923a17af993c5a5d5d7995f0b27c000a upstream.\n\nLet\u0027s do the changes properly and fix the same problem everywhere, not\njust for one case.\n\nSigned-off-by: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "94402d16da4e122c8976b61145432e1c3ccfbd29", "tree": "2b219306dc31f07d5f63c6530ac3f3b3bafff5f4", "parents": [ "06ce3e44cb3152be067f7a637a08df8c577f4620" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:43:02 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:43:02 2013 -0700" }, "message": "Linux 3.4.41\n" }, { "commit": "06ce3e44cb3152be067f7a637a08df8c577f4620", "tree": "e0d9cd8135403a581fc3823f0d86d44216af3905", "parents": [ "880f56d9b7d77917de8bde461c69e4293cc04dd0" ], "author": { "name": "David Woodhouse", "email": "David.Woodhouse@intel.com", "time": "Tue Oct 09 15:08:10 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:27 2013 -0700" }, "message": "mtd: Disable mtdchar mmap on MMU systems\n\ncommit f5cf8f07423b2677cebebcebc863af77223a4972 upstream.\n\nThis code was broken because it assumed that all MTD devices were map-based.\nDisable it for now, until it can be fixed properly for the next merge window.\n\nSigned-off-by: David Woodhouse \u003cDavid.Woodhouse@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "880f56d9b7d77917de8bde461c69e4293cc04dd0", "tree": "6e28aa3e5bf064105f5f5e75b4f1956f3936bd53", "parents": [ "2931b31ff9987ddbaebc4101e159a9e298e792ef" ], "author": { "name": "Hayes Wang", "email": "hayeswang@realtek.com", "time": "Sat Apr 13 12:26:32 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:27 2013 -0700" }, "message": "r8169: fix auto speed down issue\n\ncommit e2409d83434d77874b461b78af6a19cd6e6a1280 upstream.\n\nIt would cause no link after suspending or shutdowning when the\nnic changes the speed to 10M and connects to a link partner which\nforces the speed to 100M.\n\nCheck the link partner ability to determine which speed to set.\n\nSigned-off-by: Hayes Wang \u003chayeswang@realtek.com\u003e\nAcked-by: Francois Romieu \u003cromieu@fr.zoreil.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2931b31ff9987ddbaebc4101e159a9e298e792ef", "tree": "4d87d6b3001869a27a329fe11b4901851dce6507", "parents": [ "a7d507200f9a0de5b0d516cd67d088fa399ed54a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 13 15:15:30 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:27 2013 -0700" }, "message": "kobject: fix kset_find_obj() race with concurrent last kobject_put()\n\ncommit a49b7e82cab0f9b41f483359be83f44fbb6b4979 upstream.\n\nAnatol Pomozov identified a race condition that hits module unloading\nand re-loading. To quote Anatol:\n\n \"This is a race codition that exists between kset_find_obj() and\n kobject_put(). kset_find_obj() might return kobject that has refcount\n equal to 0 if this kobject is freeing by kobject_put() in other\n thread.\n\n Here is timeline for the crash in case if kset_find_obj() searches for\n an object tht nobody holds and other thread is doing kobject_put() on\n the same kobject:\n\n THREAD A (calls kset_find_obj()) THREAD B (calls kobject_put())\n splin_lock()\n atomic_dec_return(kobj-\u003ekref), counter gets zero here\n ... starts kobject cleanup ....\n spin_lock() // WAIT thread A in kobj_kset_leave()\n iterate over kset-\u003elist\n atomic_inc(kobj-\u003ekref) (counter becomes 1)\n spin_unlock()\n spin_lock() // taken\n // it does not know that thread A increased counter so it\n remove obj from list\n spin_unlock()\n vfree(module) // frees module object with containing kobj\n\n // kobj points to freed memory area!!\n kobject_put(kobj) // OOPS!!!!\n\n The race above happens because module.c tries to use kset_find_obj()\n when somebody unloads module. The module.c code was introduced in\n commit 6494a93d55fa\"\n\nAnatol supplied a patch specific for module.c that worked around the\nproblem by simply not using kset_find_obj() at all, but rather than make\na local band-aid, this just fixes kset_find_obj() to be thread-safe\nusing the proper model of refusing the get a new reference if the\nrefcount has already dropped to zero.\n\nSee examples of this proper refcount handling not only in the kref\ndocumentation, but in various other equivalent uses of this pattern by\ngrepping for atomic_inc_not_zero().\n\n[ Side note: the module race does indicate that module loading and\n unloading is not properly serialized wrt sysfs information using the\n module mutex. That may require further thought, but this is the\n correct fix at the kobject layer regardless. ]\n\nReported-analyzed-and-tested-by: Anatol Pomozov \u003canatol.pomozov@gmail.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a7d507200f9a0de5b0d516cd67d088fa399ed54a", "tree": "8caf4ac36f94212939adfbdcf7f58326706c585d", "parents": [ "7ad0908564a3554f9b13258a7927411af62bf3bc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 08 12:57:30 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:27 2013 -0700" }, "message": "mtdchar: fix offset overflow detection\n\ncommit 9c603e53d380459fb62fec7cd085acb0b74ac18f upstream.\n\nSasha Levin has been running trinity in a KVM tools guest, and was able\nto trigger the BUG_ON() at arch/x86/mm/pat.c:279 (verifying the range of\nthe memory type). The call trace showed that it was mtdchar_mmap() that\ncreated an invalid remap_pfn_range().\n\nThe problem is that mtdchar_mmap() does various really odd and subtle\nthings with the vma page offset etc, and uses the wrong types (and the\nwrong overflow) detection for it.\n\nFor example, the page offset may well be 32-bit on a 32-bit\narchitecture, but after shifting it up by PAGE_SHIFT, we need to use a\npotentially 64-bit resource_size_t to correctly hold the full value.\n\nAlso, we need to check that the vma length plus offset doesn\u0027t overflow\nbefore we check that it is smaller than the length of the mtdmap region.\n\nThis fixes things up and tries to make the code a bit easier to read.\n\nReported-and-tested-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nAcked-by: Suresh Siddha \u003csuresh.b.siddha@intel.com\u003e\nAcked-by: Artem Bityutskiy \u003cdedekind1@gmail.com\u003e\nCc: David Woodhouse \u003cdwmw2@infradead.org\u003e\nCc: linux-mtd@lists.infradead.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Brad Spengler \u003cspender@grsecurity.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7ad0908564a3554f9b13258a7927411af62bf3bc", "tree": "6d0c0ebded4a05e03751638cff10e5a41d1cf86e", "parents": [ "e082a177477ef0221076a201236a20c8f51c0090" ], "author": { "name": "Boris Ostrovsky", "email": "boris.ostrovsky@oracle.com", "time": "Sat Mar 23 09:36:36 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:27 2013 -0700" }, "message": "x86, mm: Patch out arch_flush_lazy_mmu_mode() when running on bare metal\n\ncommit 511ba86e1d386f671084b5d0e6f110bb30b8eeb2 upstream.\n\nInvoking arch_flush_lazy_mmu_mode() results in calls to\npreempt_enable()/disable() which may have performance impact.\n\nSince lazy MMU is not used on bare metal we can patch away\narch_flush_lazy_mmu_mode() so that it is never called in such\nenvironment.\n\n[ hpa: the previous patch \"Fix vmalloc_fault oops during lazy MMU\n updates\" may cause a minor performance regression on\n bare metal. This patch resolves that performance regression. It is\n somewhat unclear to me if this is a good -stable candidate. ]\n\nSigned-off-by: Boris Ostrovsky \u003cboris.ostrovsky@oracle.com\u003e\nLink: http://lkml.kernel.org/r/1364045796-10720-2-git-send-email-konrad.wilk@oracle.com\nTested-by: Josh Boyer \u003cjwboyer@redhat.com\u003e\nTested-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nAcked-by: Borislav Petkov \u003cbp@suse.de\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e082a177477ef0221076a201236a20c8f51c0090", "tree": "82cb598b351d5c5bd27ac003d53613b09555ac7c", "parents": [ "fdd9ce008f3de39fa7fcd17717f1d7a0895269ea" ], "author": { "name": "Samu Kallio", "email": "samu.kallio@aberdeencloud.com", "time": "Sat Mar 23 09:36:35 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:27 2013 -0700" }, "message": "x86, mm, paravirt: Fix vmalloc_fault oops during lazy MMU updates\n\ncommit 1160c2779b826c6f5c08e5cc542de58fd1f667d5 upstream.\n\nIn paravirtualized x86_64 kernels, vmalloc_fault may cause an oops\nwhen lazy MMU updates are enabled, because set_pgd effects are being\ndeferred.\n\nOne instance of this problem is during process mm cleanup with memory\ncgroups enabled. The chain of events is as follows:\n\n- zap_pte_range enables lazy MMU updates\n- zap_pte_range eventually calls mem_cgroup_charge_statistics,\n which accesses the vmalloc\u0027d mem_cgroup per-cpu stat area\n- vmalloc_fault is triggered which tries to sync the corresponding\n PGD entry with set_pgd, but the update is deferred\n- vmalloc_fault oopses due to a mismatch in the PUD entries\n\nThe OOPs usually looks as so:\n\n------------[ cut here ]------------\nkernel BUG at arch/x86/mm/fault.c:396!\ninvalid opcode: 0000 [#1] SMP\n.. snip ..\nCPU 1\nPid: 10866, comm: httpd Not tainted 3.6.10-4.fc18.x86_64 #1\nRIP: e030:[\u003cffffffff816271bf\u003e] [\u003cffffffff816271bf\u003e] vmalloc_fault+0x11f/0x208\n.. snip ..\nCall Trace:\n [\u003cffffffff81627759\u003e] do_page_fault+0x399/0x4b0\n [\u003cffffffff81004f4c\u003e] ? xen_mc_extend_args+0xec/0x110\n [\u003cffffffff81624065\u003e] page_fault+0x25/0x30\n [\u003cffffffff81184d03\u003e] ? mem_cgroup_charge_statistics.isra.13+0x13/0x50\n [\u003cffffffff81186f78\u003e] __mem_cgroup_uncharge_common+0xd8/0x350\n [\u003cffffffff8118aac7\u003e] mem_cgroup_uncharge_page+0x57/0x60\n [\u003cffffffff8115fbc0\u003e] page_remove_rmap+0xe0/0x150\n [\u003cffffffff8115311a\u003e] ? vm_normal_page+0x1a/0x80\n [\u003cffffffff81153e61\u003e] unmap_single_vma+0x531/0x870\n [\u003cffffffff81154962\u003e] unmap_vmas+0x52/0xa0\n [\u003cffffffff81007442\u003e] ? pte_mfn_to_pfn+0x72/0x100\n [\u003cffffffff8115c8f8\u003e] exit_mmap+0x98/0x170\n [\u003cffffffff810050d9\u003e] ? __raw_callee_save_xen_pmd_val+0x11/0x1e\n [\u003cffffffff81059ce3\u003e] mmput+0x83/0xf0\n [\u003cffffffff810624c4\u003e] exit_mm+0x104/0x130\n [\u003cffffffff8106264a\u003e] do_exit+0x15a/0x8c0\n [\u003cffffffff810630ff\u003e] do_group_exit+0x3f/0xa0\n [\u003cffffffff81063177\u003e] sys_exit_group+0x17/0x20\n [\u003cffffffff8162bae9\u003e] system_call_fastpath+0x16/0x1b\n\nCalling arch_flush_lazy_mmu_mode immediately after set_pgd makes the\nchanges visible to the consistency checks.\n\nRedHat-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id\u003d914737\nTested-by: Josh Boyer \u003cjwboyer@redhat.com\u003e\nReported-and-Tested-by: Krishna Raman \u003ckraman@redhat.com\u003e\nSigned-off-by: Samu Kallio \u003csamu.kallio@aberdeencloud.com\u003e\nLink: http://lkml.kernel.org/r/1364045796-10720-1-git-send-email-konrad.wilk@oracle.com\nTested-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fdd9ce008f3de39fa7fcd17717f1d7a0895269ea", "tree": "f69986fac5f79f8dc785ef2b490162d17f80c8a7", "parents": [ "bff6627568427d14375d84426f491646fdf71a1f" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sat Apr 06 10:10:27 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:27 2013 -0700" }, "message": "sched_clock: Prevent 64bit inatomicity on 32bit systems\n\ncommit a1cbcaa9ea87b87a96b9fc465951dcf36e459ca2 upstream.\n\nThe sched_clock_remote() implementation has the following inatomicity\nproblem on 32bit systems when accessing the remote scd-\u003eclock, which\nis a 64bit value.\n\nCPU0\t\t\tCPU1\n\nsched_clock_local()\tsched_clock_remote(CPU0)\n...\n\t\t\tremote_clock \u003d scd[CPU0]-\u003eclock\n\t\t\t read_low32bit(scd[CPU0]-\u003eclock)\ncmpxchg64(scd-\u003eclock,...)\n\t\t\t read_high32bit(scd[CPU0]-\u003eclock)\n\nWhile the update of scd-\u003eclock is using an atomic64 mechanism, the\nreadout on the remote cpu is not, which can cause completely bogus\nreadouts.\n\nIt is a quite rare problem, because it requires the update to hit the\nnarrow race window between the low/high readout and the update must go\nacross the 32bit boundary.\n\nThe resulting misbehaviour is, that CPU1 will see the sched_clock on\nCPU1 ~4 seconds ahead of it\u0027s own and update CPU1s sched_clock value\nto this bogus timestamp. This stays that way due to the clamping\nimplementation for about 4 seconds until the synchronization with\nCLOCK_MONOTONIC undoes the problem.\n\nThe issue is hard to observe, because it might only result in a less\naccurate SCHED_OTHER timeslicing behaviour. To create observable\ndamage on realtime scheduling classes, it is necessary that the bogus\nupdate of CPU1 sched_clock happens in the context of an realtime\nthread, which then gets charged 4 seconds of RT runtime, which results\nin the RT throttler mechanism to trigger and prevent scheduling of RT\ntasks for a little less than 4 seconds. So this is quite unlikely as\nwell.\n\nThe issue was quite hard to decode as the reproduction time is between\n2 days and 3 weeks and intrusive tracing makes it less likely, but the\nfollowing trace recorded with trace_clock\u003dglobal, which uses\nsched_clock_local(), gave the final hint:\n\n \u003cidle\u003e-0 0d..30 400269.477150: hrtimer_cancel: hrtimer\u003d0xf7061e80\n \u003cidle\u003e-0 0d..30 400269.477151: hrtimer_start: hrtimer\u003d0xf7061e80 ...\nirq/20-S-587 1d..32 400273.772118: sched_wakeup: comm\u003d ... target_cpu\u003d0\n \u003cidle\u003e-0 0dN.30 400273.772118: hrtimer_cancel: hrtimer\u003d0xf7061e80\n\nWhat happens is that CPU0 goes idle and invokes\nsched_clock_idle_sleep_event() which invokes sched_clock_local() and\nCPU1 runs a remote wakeup for CPU0 at the same time, which invokes\nsched_remote_clock(). The time jump gets propagated to CPU0 via\nsched_remote_clock() and stays stale on both cores for ~4 seconds.\n\nThere are only two other possibilities, which could cause a stale\nsched clock:\n\n1) ktime_get() which reads out CLOCK_MONOTONIC returns a sporadic\n wrong value.\n\n2) sched_clock() which reads the TSC returns a sporadic wrong value.\n\n#1 can be excluded because sched_clock would continue to increase for\n one jiffy and then go stale.\n\n#2 can be excluded because it would not make the clock jump\n forward. It would just result in a stale sched_clock for one jiffy.\n\nAfter quite some brain twisting and finding the same pattern on other\ntraces, sched_clock_remote() remained the only place which could cause\nsuch a problem and as explained above it\u0027s indeed racy on 32bit\nsystems.\n\nSo while on 64bit systems the readout is atomic, we need to verify the\nremote readout on 32bit machines. We need to protect the local-\u003eclock\nreadout in sched_clock_remote() on 32bit as well because an NMI could\nhit between the low and the high readout, call sched_clock_local() and\nmodify local-\u003eclock.\n\nThanks to Siegfried Wulsch for bearing with my debug requests and\ngoing through the tedious tasks of running a bunch of reproducer\nsystems to generate the debug information which let me decode the\nissue.\n\nReported-by: Siegfried Wulsch \u003cSiegfried.Wulsch@rovema.de\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nLink: http://lkml.kernel.org/r/alpine.LFD.2.02.1304051544160.21884@ionos\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bff6627568427d14375d84426f491646fdf71a1f", "tree": "92f948a75726e69ffbb8e2cfb6fe927d21cba155", "parents": [ "e3a55052f4773105dbd23f72dec4aeac82dea871" ], "author": { "name": "Dave Airlie", "email": "airlied@gmail.com", "time": "Fri Apr 12 13:25:20 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "udl: handle EDID failure properly.\n\ncommit 1baee58638fc58248625255f5c5fcdb987f11b1f upstream.\n\nDon\u0027t oops seems proper.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e3a55052f4773105dbd23f72dec4aeac82dea871", "tree": "287ba056309faab0f819fa03b74f6770430d5b49", "parents": [ "7077c66b3ab3a1d336648cf88f54df43709ebac3" ], "author": { "name": "Thomas Hellstrom", "email": "thellstrom@vmware.com", "time": "Tue Nov 06 11:31:49 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "kref: Implement kref_get_unless_zero v3\n\ncommit 4b20db3de8dab005b07c74161cb041db8c5ff3a7 upstream.\n\nThis function is intended to simplify locking around refcounting for\nobjects that can be looked up from a lookup structure, and which are\nremoved from that lookup structure in the object destructor.\nOperations on such objects require at least a read lock around\nlookup + kref_get, and a write lock around kref_put + remove from lookup\nstructure. Furthermore, RCU implementations become extremely tricky.\nWith a lookup followed by a kref_get_unless_zero *with return value check*\nlocking in the kref_put path can be deferred to the actual removal from\nthe lookup structure and RCU lookups become trivial.\n\nv2: Formatting fixes.\nv3: Invert the return value.\n\nSigned-off-by: Thomas Hellstrom \u003cthellstrom@vmware.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7077c66b3ab3a1d336648cf88f54df43709ebac3", "tree": "2afe6bfbe8770c1acd0bc4b715a46e0309b045ed", "parents": [ "eced4ec1b69c8cc5428ef29b947376bc6d57c8ce" ], "author": { "name": "Suleiman Souhlal", "email": "suleiman@google.com", "time": "Sat Apr 13 16:03:06 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "vfs: Revert spurious fix to spinning prevention in prune_icache_sb\n\ncommit 5b55d708335a9e3e4f61f2dadf7511502205ccd1 upstream.\n\nRevert commit 62a3ddef6181 (\"vfs: fix spinning prevention in prune_icache_sb\").\n\nThis commit doesn\u0027t look right: since we are looking at the tail of the\nlist (sb-\u003es_inode_lru.prev) if we want to skip an inode, we should put\nit back at the head of the list instead of the tail, otherwise we will\nkeep spinning on it.\n\nDiscovered when investigating why prune_icache_sb came top in perf\nreports of a swapping load.\n\nSigned-off-by: Suleiman Souhlal \u003csuleiman@google.com\u003e\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "eced4ec1b69c8cc5428ef29b947376bc6d57c8ce", "tree": "33df82d0e27871e3351d970eb97772ec6de7c417", "parents": [ "e0b4cef3446f77889a3699309a9aad5f70d9a939" ], "author": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Wed Apr 10 15:00:27 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "target: Fix incorrect fallthrough of ALUA Standby/Offline/Transition CDBs\n\ncommit 30f359a6f9da65a66de8cadf959f0f4a0d498bba upstream.\n\nThis patch fixes a bug where a handful of informational / control CDBs\nthat should be allowed during ALUA access state Standby/Offline/Transition\nwhere incorrectly returning CHECK_CONDITION + ASCQ_04H_ALUA_TG_PT_*.\n\nThis includes INQUIRY + REPORT_LUNS, which would end up preventing LUN\nregistration when LUN scanning occured during these ALUA access states.\n\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nCc: Hannes Reinecke \u003chare@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e0b4cef3446f77889a3699309a9aad5f70d9a939", "tree": "c99a47cd4eead0da7b2f21e6bccd665f7601c6b8", "parents": [ "b7dba0e4be51d0924af476456d2cb0f903e8aa77" ], "author": { "name": "Sachin Prabhu", "email": "sprabhu@redhat.com", "time": "Tue Apr 09 18:17:41 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "cifs: Allow passwords which begin with a delimitor\n\ncommit c369c9a4a7c82d33329d869cbaf93304cc7a0c40 upstream.\n\nFixes a regression in cifs_parse_mount_options where a password\nwhich begins with a delimitor is parsed incorrectly as being a blank\npassword.\n\nSigned-off-by: Sachin Prabhu \u003csprabhu@redhat.com\u003e\nAcked-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Steve French \u003csfrench@us.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b7dba0e4be51d0924af476456d2cb0f903e8aa77", "tree": "320c19743b4e6d21a47726e2a80b13a77b9438b5", "parents": [ "706d153865d8efb9164faf220a66f224969fed84" ], "author": { "name": "Lukasz Dorau", "email": "lukasz.dorau@intel.com", "time": "Wed Apr 03 10:27:17 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "SCSI: libsas: fix handling vacant phy in sas_set_ex_phy()\n\ncommit d4a2618fa77b5e58ec15342972bd3505a1c3f551 upstream.\n\nIf a result of the SMP discover function is PHY VACANT,\nthe content of discover response structure (dr) is not valid.\nIt sometimes happens that dr-\u003eattached_sas_addr can contain\neven SAS address of other phy. In such case an invalid phy\nis created, what causes NULL pointer dereference during\ndestruction of expander\u0027s phys.\n\nSo if a result of SMP function is PHY VACANT, the content of discover\nresponse structure (dr) must not be copied to phy structure.\n\nThis patch fixes the following bug:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000030\nIP: [\u003cffffffff811c9002\u003e] sysfs_find_dirent+0x12/0x90\nCall Trace:\n [\u003cffffffff811c95f5\u003e] sysfs_get_dirent+0x35/0x80\n [\u003cffffffff811cb55e\u003e] sysfs_unmerge_group+0x1e/0xb0\n [\u003cffffffff813329f4\u003e] dpm_sysfs_remove+0x24/0x90\n [\u003cffffffff8132b0f4\u003e] device_del+0x44/0x1d0\n [\u003cffffffffa016fc59\u003e] sas_rphy_delete+0x9/0x20 [scsi_transport_sas]\n [\u003cffffffffa01a16f6\u003e] sas_destruct_devices+0xe6/0x110 [libsas]\n [\u003cffffffff8107ac7c\u003e] process_one_work+0x16c/0x350\n [\u003cffffffff8107d84a\u003e] worker_thread+0x17a/0x410\n [\u003cffffffff81081b76\u003e] kthread+0x96/0xa0\n [\u003cffffffff81464944\u003e] kernel_thread_helper+0x4/0x10\n\nSigned-off-by: Lukasz Dorau \u003clukasz.dorau@intel.com\u003e\nSigned-off-by: Pawel Baldysiak \u003cpawel.baldysiak@intel.com\u003e\nReviewed-by: Maciej Patelczyk \u003cmaciej.patelczyk@intel.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "706d153865d8efb9164faf220a66f224969fed84", "tree": "cfb5227a75df24e304aeb01eec6ede1e40144a57", "parents": [ "e3573b2133637edf3a6cb39241e9270affa535c7" ], "author": { "name": "Chris Wilson", "email": "chris@chris-wilson.co.uk", "time": "Fri Aug 24 09:12:22 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "drm/i915: Use the correct size of the GTT for placing the per-process entries\n\ncommit 9a0f938bde74bf9e50bd75c8de9e38c1787398cd upstream.\n\nThe current layout is to place the per-process tables at the end of the\nGTT. However, this is currently using a hardcoded maximum size for the GTT\nand not taking in account limitations imposed by the BIOS. Use the value\nfor the total number of entries allocated in the table as provided by\nthe configuration registers.\n\nReported-by: Matthew Garrett \u003cmjg@redhat.com\u003e\nSigned-off-by: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nCc: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nCc: Ben Widawsky \u003cben@bwidawsk.net\u003e\nCc: Matthew Garret \u003cmjg@redhat.com\u003e\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nCc: Jonathan Nieder \u003cjrnieder@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e3573b2133637edf3a6cb39241e9270affa535c7", "tree": "d4ccc29a2ac633ab2b848304acf3446ac018827a", "parents": [ "e264d3cf890eb1ead5200731b9e3dbd1d1b71fa8" ], "author": { "name": "Huacai Chen", "email": "chenhc@lemote.com", "time": "Sun Apr 07 02:14:14 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "PM / reboot: call syscore_shutdown() after disable_nonboot_cpus()\n\ncommit 6f389a8f1dd22a24f3d9afc2812b30d639e94625 upstream.\n\nAs commit 40dc166c (PM / Core: Introduce struct syscore_ops for core\nsubsystems PM) say, syscore_ops operations should be carried with one\nCPU on-line and interrupts disabled. However, after commit f96972f2d\n(kernel/sys.c: call disable_nonboot_cpus() in kernel_restart()),\nsyscore_shutdown() is called before disable_nonboot_cpus(), so break\nthe rules. We have a MIPS machine with a 8259A PIC, and there is an\nexternal timer (HPET) linked at 8259A. Since 8259A has been shutdown\ntoo early (by syscore_shutdown()), disable_nonboot_cpus() runs without\ntimer interrupt, so it hangs and reboot fails. This patch call\nsyscore_shutdown() a little later (after disable_nonboot_cpus()) to\navoid reboot failure, this is the same way as poweroff does.\n\nFor consistency, add disable_nonboot_cpus() to kernel_halt().\n\nSigned-off-by: Huacai Chen \u003cchenhc@lemote.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e264d3cf890eb1ead5200731b9e3dbd1d1b71fa8", "tree": "f0ac71897029ad2ec81178e32aec9eddb24e769e", "parents": [ "b43105dee8480ca5784de5c858d1cccee74ebfb1" ], "author": { "name": "Namhyung Kim", "email": "namhyung.kim@lge.com", "time": "Mon Apr 01 21:46:23 2013 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "tracing: Fix double free when function profile init failed\n\ncommit 83e03b3fe4daffdebbb42151d5410d730ae50bd1 upstream.\n\nOn the failure path, stat-\u003estart and stat-\u003epages will refer same page.\nSo it\u0027ll attempt to free the same page again and get kernel panic.\n\nLink: http://lkml.kernel.org/r/1364820385-32027-1-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "b43105dee8480ca5784de5c858d1cccee74ebfb1" }