)]}'
{
  "log": [
    {
      "commit": "1280938465132080915aef414a1f40f62831bab9",
      "tree": "a2055fce3874fea9ddec94d17658e7d3ec18dc66",
      "parents": [
        "05bec9da3978124bde3b40bfa0404760f45aa399"
      ],
      "author": {
        "name": "Hannes Frederic Sowa",
        "email": "hannes@stressinduktion.org",
        "time": "Fri Mar 15 11:32:30 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 28 12:11:54 2013 -0700"
      },
      "message": "inet: limit length of fragment queue hash table bucket lists\n\n[ Upstream commit 5a3da1fe9561828d0ca7eca664b16ec2b9bf0055 ]\n\nThis patch introduces a constant limit of the fragment queue hash\ntable bucket list lengths. Currently the limit 128 is choosen somewhat\narbitrary and just ensures that we can fill up the fragment cache with\nempty packets up to the default ip_frag_high_thresh limits. It should\njust protect from list iteration eating considerable amounts of cpu.\n\nIf we reach the maximum length in one hash bucket a warning is printed.\nThis is implemented on the caller side of inet_frag_find to distinguish\nbetween the different users of inet_fragment.c.\n\nI dropped the out of memory warning in the ipv4 fragment lookup path,\nbecause we already get a warning by the slab allocator.\n\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: Jesper Dangaard Brouer \u003cjbrouer@redhat.com\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "08ebc8f4c0acb1e9a104e66fdc2bb5b4e29171f5",
      "tree": "faa7ef1cf3416911fee70d3f7c8a328fd166ad41",
      "parents": [
        "b6da578e2a610a64e89f2a983f7675eb301c5d35"
      ],
      "author": {
        "name": "Vlad Yasevich",
        "email": "vyasevic@redhat.com",
        "time": "Wed Mar 13 04:18:58 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 28 12:11:53 2013 -0700"
      },
      "message": "rtnetlink: Mask the rta_type when range checking\n\n[ Upstream commit a5b8db91442fce9c9713fcd656c3698f1adde1d6 ]\n\nRange/validity checks on rta_type in rtnetlink_rcv_msg() do\nnot account for flags that may be set.  This causes the function\nto return -EINVAL when flags are set on the type (for example\nNLA_F_NESTED).\n\nSigned-off-by: Vlad Yasevich \u003cvyasevic@redhat.com\u003e\nAcked-by: Thomas Graf \u003ctgraf@suug.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "b6da578e2a610a64e89f2a983f7675eb301c5d35",
      "tree": "e9a01ac902578dcb3c0cca6b9126e294d02942a7",
      "parents": [
        "6a2d122cdd939e33279baf351c7cbf12c50eaeb5"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Thu Mar 14 05:40:32 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 28 12:11:53 2013 -0700"
      },
      "message": "tcp: fix skb_availroom()\n\n[ Upstream commit 16fad69cfe4adbbfa813de516757b87bcae36d93 ]\n\nChrome OS team reported a crash on a Pixel ChromeBook in TCP stack :\n\nhttps://code.google.com/p/chromium/issues/detail?id\u003d182056\n\ncommit a21d45726acac (tcp: avoid order-1 allocations on wifi and tx\npath) did a poor choice adding an \u0027avail_size\u0027 field to skb, while\nwhat we really needed was a \u0027reserved_tailroom\u0027 one.\n\nIt would have avoided commit 22b4a4f22da (tcp: fix retransmit of\npartially acked frames) and this commit.\n\nCrash occurs because skb_split() is not aware of the \u0027avail_size\u0027\nmanagement (and should not be aware)\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: Mukesh Agrawal \u003cquiche@chromium.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "ca42fad953eab535f12b04cea9622b253faebb0b",
      "tree": "99575f5db9dd65133d270207f58aaa55859f6e5f",
      "parents": [
        "0aa8bf90399754022f547b69e1812abe8bba4c0b"
      ],
      "author": {
        "name": "Xufeng Zhang",
        "email": "xufeng.zhang@windriver.com",
        "time": "Thu Mar 07 21:39:37 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 28 12:11:53 2013 -0700"
      },
      "message": "sctp: don\u0027t break the loop while meeting the active_path so as to find the matched transport\n\n[ Upstream commit 2317f449af30073cfa6ec8352e4a65a89e357bdd ]\n\nsctp_assoc_lookup_tsn() function searchs which transport a certain TSN\nwas sent on, if not found in the active_path transport, then go search\nall the other transports in the peer\u0027s transport_addr_list, however, we\nshould continue to the next entry rather than break the loop when meet\nthe active_path transport.\n\nSigned-off-by: Xufeng Zhang \u003cxufeng.zhang@windriver.com\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nAcked-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "0aa8bf90399754022f547b69e1812abe8bba4c0b",
      "tree": "1a8adaa01451430320715b5b6a1cfc9a5596f511",
      "parents": [
        "147289d28fb7b7c10a9f8a2cd9e274a41fc3f1f6"
      ],
      "author": {
        "name": "Vlad Yasevich",
        "email": "vyasevich@gmail.com",
        "time": "Tue Mar 12 15:53:23 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 28 12:11:53 2013 -0700"
      },
      "message": "sctp: Use correct sideffect command in duplicate cookie handling\n\n[ Upstream commit f2815633504b442ca0b0605c16bf3d88a3a0fcea ]\n\nWhen SCTP is done processing a duplicate cookie chunk, it tries\nto delete a newly created association.  For that, it has to set\nthe right association for the side-effect processing to work.\nHowever, when it uses the SCTP_CMD_NEW_ASOC command, that performs\nmore work then really needed (like hashing the associationa and\nassigning it an id) and there is no point to do that only to\ndelete the association as a next step.  In fact, it also creates\nan impossible condition where an association may be found by\nthe getsockopt() call, and that association is empty.  This\ncauses a crash in some sctp getsockopts.\n\nThe solution is rather simple.  We simply use SCTP_CMD_SET_ASOC\ncommand that doesn\u0027t have all the overhead and does exactly\nwhat we need.\n\nReported-by: Karl Heiss \u003ckheiss@gmail.com\u003e\nTested-by: Karl Heiss \u003ckheiss@gmail.com\u003e\nCC: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "7436bcf6158d70346928b9b26568f5bb3213a36f",
      "tree": "a092676a959c4df2bcdd230d0421e3a03f28ffec",
      "parents": [
        "1c93c2e727a02efe7e143c6d6798facbab31d9e1"
      ],
      "author": {
        "name": "David Ward",
        "email": "david.ward@ll.mit.edu",
        "time": "Mon Mar 11 10:43:39 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 28 12:11:52 2013 -0700"
      },
      "message": "net/ipv4: Ensure that location of timestamp option is stored\n\n[ Upstream commit 4660c7f498c07c43173142ea95145e9dac5a6d14 ]\n\nThis is needed in order to detect if the timestamp option appears\nmore than once in a packet, to remove the option if the packet is\nfragmented, etc. My previous change neglected to store the option\nlocation when the router addresses were prespecified and Pointer \u003e\nLength. But now the option location is also stored when Flag is an\nunrecognized value, to ensure these option handling behaviors are\nstill performed.\n\nSigned-off-by: David Ward \u003cdavid.ward@ll.mit.edu\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "7cba6aeae533a95c6f49752c859adadf8439f42b",
      "tree": "6e8525229ed45d19aa62a9f323fa724f367ef80d",
      "parents": [
        "32ceecc2587ac7e079f17dbc9d5158928667baad"
      ],
      "author": {
        "name": "YOSHIFUJI Hideaki",
        "email": "yoshfuji@linux-ipv6.org",
        "time": "Sat Mar 09 09:11:57 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Mar 20 13:05:02 2013 -0700"
      },
      "message": "6lowpan: Fix endianness issue in is_addr_link_local().\n\n[ Upstream commit 9026c4927254f5bea695cc3ef2e255280e6a3011 ]\n\nSigned-off-by: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "32ceecc2587ac7e079f17dbc9d5158928667baad",
      "tree": "b2c94f11009103aa536863f880cad60ca8aa653c",
      "parents": [
        "78d3a467490d72c699393947f1e566fa28672947"
      ],
      "author": {
        "name": "Mathias Krause",
        "email": "minipli@googlemail.com",
        "time": "Sat Mar 09 05:52:21 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Mar 20 13:05:02 2013 -0700"
      },
      "message": "dcbnl: fix various netlink info leaks\n\n[ Upstream commit 29cd8ae0e1a39e239a3a7b67da1986add1199fc0 ]\n\nThe dcb netlink interface leaks stack memory in various places:\n* perm_addr[] buffer is only filled at max with 12 of the 32 bytes but\n  copied completely,\n* no in-kernel driver fills all fields of an IEEE 802.1Qaz subcommand,\n  so we\u0027re leaking up to 58 bytes for ieee_ets structs, up to 136 bytes\n  for ieee_pfc structs, etc.,\n* the same is true for CEE -- no in-kernel driver fills the whole\n  struct,\n\nPrevent all of the above stack info leaks by properly initializing the\nbuffers/structures involved.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "78d3a467490d72c699393947f1e566fa28672947",
      "tree": "cee705e2e0e50ff854f4e6932d969379776999e2",
      "parents": [
        "47d7ed18c33cc4e9cba603c7ca776c40037ae842"
      ],
      "author": {
        "name": "Mathias Krause",
        "email": "minipli@googlemail.com",
        "time": "Sat Mar 09 05:52:20 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Mar 20 13:05:02 2013 -0700"
      },
      "message": "rtnl: fix info leak on RTM_GETLINK request for VF devices\n\n[ Upstream commit 84d73cd3fb142bf1298a8c13fd4ca50fd2432372 ]\n\nInitialize the mac address buffer with 0 as the driver specific function\nwill probably not fill the whole buffer. In fact, all in-kernel drivers\nfill only ETH_ALEN of the MAX_ADDR_LEN bytes, i.e. 6 of the 32 possible\nbytes. Therefore we currently leak 26 bytes of stack memory to userland\nvia the netlink interface.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "47d7ed18c33cc4e9cba603c7ca776c40037ae842",
      "tree": "9e4ffec7197c072c6d371e28f9b5138de627fd01",
      "parents": [
        "c7a226b6464bfdc67433adcfe9e17b816157af98"
      ],
      "author": {
        "name": "Hannes Frederic Sowa",
        "email": "hannes@stressinduktion.org",
        "time": "Fri Mar 08 02:07:23 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Mar 20 13:05:02 2013 -0700"
      },
      "message": "ipv6: stop multicast forwarding to process interface scoped addresses\n\n[ Upstream commit ddf64354af4a702ee0b85d0a285ba74c7278a460 ]\n\nv2:\na) used struct ipv6_addr_props\n\nv3:\na) reverted changes for ipv6_addr_props\n\nv4:\na) do not use __ipv6_addr_needs_scope_id\n\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nAcked-by: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "c7a226b6464bfdc67433adcfe9e17b816157af98",
      "tree": "40d3476093756d2d9883f6aac2cc5a93b7eab742",
      "parents": [
        "8c6292ad910d6070a38fda048df788e02b8abe84"
      ],
      "author": {
        "name": "Cristian Bercaru",
        "email": "B43982@freescale.com",
        "time": "Fri Mar 08 07:03:38 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Mar 20 13:05:02 2013 -0700"
      },
      "message": "bridging: fix rx_handlers return code\n\n[ Upstream commit 3bc1b1add7a8484cc4a261c3e128dbe1528ce01f ]\n\nThe frames for which rx_handlers return RX_HANDLER_CONSUMED are no longer\ncounted as dropped. They are counted as successfully received by\n\u0027netif_receive_skb\u0027.\n\nThis allows network interface drivers to correctly update their RX-OK and\nRX-DRP counters based on the result of \u0027netif_receive_skb\u0027.\n\nSigned-off-by: Cristian Bercaru \u003cB43982@freescale.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "8c6292ad910d6070a38fda048df788e02b8abe84",
      "tree": "2df9752c4dc0014a3fd791af6f84d3e4f995c7d4",
      "parents": [
        "e86429f5b4367734a4df8ffa46212d64934c310c"
      ],
      "author": {
        "name": "Paul Moore",
        "email": "pmoore@redhat.com",
        "time": "Wed Mar 06 11:45:24 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Mar 20 13:05:01 2013 -0700"
      },
      "message": "netlabel: correctly list all the static label mappings\n\n[ Upstream commits 0c1233aba1e948c37f6dc7620cb7c253fcd71ce9 and\n  a6a8fe950e1b8596bb06f2c89c3a1a4bf2011ba9 ]\n\nWhen we have a large number of static label mappings that spill across\nthe netlink message boundary we fail to properly save our state in the\nnetlink_callback struct which causes us to repeat the same listings.\nThis patch fixes this problem by saving the state correctly between\ncalls to the NetLabel static label netlink \"dumpit\" routines.\n\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "8bd2b8faec4d80e2c77645dcfd838d5f79e9e15b",
      "tree": "9b64b622e7d4f1616e69ee4e6e048ae49d35e406",
      "parents": [
        "6202fe4eec7b98b7391865c8aebe513bc1f14009"
      ],
      "author": {
        "name": "Neal Cardwell",
        "email": "ncardwell@google.com",
        "time": "Mon Mar 04 06:23:05 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Mar 20 13:05:01 2013 -0700"
      },
      "message": "tcp: fix double-counted receiver RTT when leaving receiver fast path\n\n[ Upstream commit aab2b4bf224ef8358d262f95b568b8ad0cecf0a0 ]\n\nWe should not update ts_recent and call tcp_rcv_rtt_measure_ts() both\nbefore and after going to step5. That wastes CPU and double-counts the\nreceiver-side RTT sample.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "6202fe4eec7b98b7391865c8aebe513bc1f14009",
      "tree": "d22e072024d814324cde88bc96d03e2274bf33b1",
      "parents": [
        "2b2066c41aba3032831ff5402bbd3b68ff5b9d47"
      ],
      "author": {
        "name": "Lorenzo Colitti",
        "email": "lorenzo@google.com",
        "time": "Sun Mar 03 20:46:46 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Mar 20 13:05:01 2013 -0700"
      },
      "message": "net: ipv6: Don\u0027t purge default router if accept_ra\u003d2\n\n[ Upstream commit 3e8b0ac3e41e3c882222a5522d5df7212438ab51 ]\n\nSetting net.ipv6.conf.\u003cinterface\u003e.accept_ra\u003d2 causes the kernel\nto accept RAs even when forwarding is enabled. However, enabling\nforwarding purges all default routes on the system, breaking\nconnectivity until the next RA is received. Fix this by not\npurging default routes on interfaces that have accept_ra\u003d2.\n\nSigned-off-by: Lorenzo Colitti \u003clorenzo@google.com\u003e\nAcked-by: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "2b2066c41aba3032831ff5402bbd3b68ff5b9d47",
      "tree": "900a0dbb2feae815df7e3c1fbad05f56a5c871d8",
      "parents": [
        "136d76de5b72b4a45eec80e4e5ee14f397aa1fed"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "amwang@redhat.com",
        "time": "Sun Mar 03 16:18:11 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Mar 20 13:05:01 2013 -0700"
      },
      "message": "rds: limit the size allocated by rds_message_alloc()\n\n[ Upstream commit ece6b0a2b25652d684a7ced4ae680a863af041e0 ]\n\nDave Jones reported the following bug:\n\n\"When fed mangled socket data, rds will trust what userspace gives it,\nand tries to allocate enormous amounts of memory larger than what\nkmalloc can satisfy.\"\n\nWARNING: at mm/page_alloc.c:2393 __alloc_pages_nodemask+0xa0d/0xbe0()\nHardware name: GA-MA78GM-S2H\nModules linked in: vmw_vsock_vmci_transport vmw_vmci vsock fuse bnep dlci bridge 8021q garp stp mrp binfmt_misc l2tp_ppp l2tp_core rfcomm s\nPid: 24652, comm: trinity-child2 Not tainted 3.8.0+ #65\nCall Trace:\n [\u003cffffffff81044155\u003e] warn_slowpath_common+0x75/0xa0\n [\u003cffffffff8104419a\u003e] warn_slowpath_null+0x1a/0x20\n [\u003cffffffff811444ad\u003e] __alloc_pages_nodemask+0xa0d/0xbe0\n [\u003cffffffff8100a196\u003e] ? native_sched_clock+0x26/0x90\n [\u003cffffffff810b2128\u003e] ? trace_hardirqs_off_caller+0x28/0xc0\n [\u003cffffffff810b21cd\u003e] ? trace_hardirqs_off+0xd/0x10\n [\u003cffffffff811861f8\u003e] alloc_pages_current+0xb8/0x180\n [\u003cffffffff8113eaaa\u003e] __get_free_pages+0x2a/0x80\n [\u003cffffffff811934fe\u003e] kmalloc_order_trace+0x3e/0x1a0\n [\u003cffffffff81193955\u003e] __kmalloc+0x2f5/0x3a0\n [\u003cffffffff8104df0c\u003e] ? local_bh_enable_ip+0x7c/0xf0\n [\u003cffffffffa0401ab3\u003e] rds_message_alloc+0x23/0xb0 [rds]\n [\u003cffffffffa04043a1\u003e] rds_sendmsg+0x2b1/0x990 [rds]\n [\u003cffffffff810b21cd\u003e] ? trace_hardirqs_off+0xd/0x10\n [\u003cffffffff81564620\u003e] sock_sendmsg+0xb0/0xe0\n [\u003cffffffff810b2052\u003e] ? get_lock_stats+0x22/0x70\n [\u003cffffffff810b24be\u003e] ? put_lock_stats.isra.23+0xe/0x40\n [\u003cffffffff81567f30\u003e] sys_sendto+0x130/0x180\n [\u003cffffffff810b872d\u003e] ? trace_hardirqs_on+0xd/0x10\n [\u003cffffffff816c547b\u003e] ? _raw_spin_unlock_irq+0x3b/0x60\n [\u003cffffffff816cd767\u003e] ? sysret_check+0x1b/0x56\n [\u003cffffffff810b8695\u003e] ? trace_hardirqs_on_caller+0x115/0x1a0\n [\u003cffffffff81341d8e\u003e] ? trace_hardirqs_on_thunk+0x3a/0x3f\n [\u003cffffffff816cd742\u003e] system_call_fastpath+0x16/0x1b\n---[ end trace eed6ae990d018c8b ]---\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nCc: Dave Jones \u003cdavej@redhat.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Venkat Venkatsubra \u003cvenkat.x.venkatsubra@oracle.com\u003e\nSigned-off-by: Cong Wang \u003camwang@redhat.com\u003e\nAcked-by: Venkat Venkatsubra \u003cvenkat.x.venkatsubra@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "136d76de5b72b4a45eec80e4e5ee14f397aa1fed",
      "tree": "80fb7a9d156401590fa78da5bc35d9ea80b8713c",
      "parents": [
        "0530082c3595511fa2bfc1434a5ad809e5ec90a3"
      ],
      "author": {
        "name": "Guillaume Nault",
        "email": "g.nault@alphalink.fr",
        "time": "Fri Mar 01 05:02:02 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Mar 20 13:05:01 2013 -0700"
      },
      "message": "l2tp: Restore socket refcount when sendmsg succeeds\n\n[ Upstream commit 8b82547e33e85fc24d4d172a93c796de1fefa81a ]\n\nThe sendmsg() syscall handler for PPPoL2TP doesn\u0027t decrease the socket\nreference counter after successful transmissions. Any successful\nsendmsg() call from userspace will then increase the reference counter\nforever, thus preventing the kernel\u0027s session and tunnel data from\nbeing freed later on.\n\nThe problem only happens when writing directly on L2TP sockets.\nPPP sockets attached to L2TP are unaffected as the PPP subsystem\nuses pppol2tp_xmit() which symmetrically increase/decrease reference\ncounters.\n\nThis patch adds the missing call to sock_put() before returning from\npppol2tp_sendmsg().\n\nSigned-off-by: Guillaume Nault \u003cg.nault@alphalink.fr\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "1ecb6934fa86281d26d60d984f0e0e6554531813",
      "tree": "7189db0c2e263bba7e36a27e0079d4cbb0993e7e",
      "parents": [
        "d3e8a1806bb6a9f2b4d56de44a87efc18e3e82fd"
      ],
      "author": {
        "name": "Trond Myklebust",
        "email": "Trond.Myklebust@netapp.com",
        "time": "Fri Feb 22 14:57:57 2013 -0500"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 14 11:29:42 2013 -0700"
      },
      "message": "SUNRPC: Don\u0027t start the retransmission timer when out of socket space\n\ncommit a9a6b52ee1baa865283a91eb8d443ee91adfca56 upstream.\n\nIf the socket is full, we\u0027re better off just waiting until it empties,\nor until the connection is broken. The reason why we generally don\u0027t\nwant to time out is that the call to xprt-\u003eops-\u003erelease_xprt() will\ntrigger a connection reset, which isn\u0027t helpful...\n\nLet\u0027s make an exception for soft RPC calls, since they have to provide\ntimeout guarantees.\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "7e5e167c5c1b44f408fa8f8a8f062f234cd0f0d6",
      "tree": "4d07cc6f35b269d6ce80e678db56ba36dcb8e57f",
      "parents": [
        "5623a7cc4e3f0f461586b10b78967bb5f53fa096"
      ],
      "author": {
        "name": "J. Bruce Fields",
        "email": "bfields@redhat.com",
        "time": "Sun Feb 10 11:33:48 2013 -0500"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Mar 04 06:06:43 2013 +0800"
      },
      "message": "svcrpc: make svc_age_temp_xprts enqueue under sv_lock\n\ncommit e75bafbff2270993926abcc31358361db74a9bc2 upstream.\n\nsvc_age_temp_xprts expires xprts in a two-step process: first it takes\nthe sv_lock and moves the xprts to expire off their server-wide list\n(sv_tempsocks or sv_permsocks) to a local list.  Then it drops the\nsv_lock and enqueues and puts each one.\n\nI see no reason for this: svc_xprt_enqueue() will take sp_lock, but the\nsv_lock and sp_lock are not otherwise nested anywhere (and documentation\nat the top of this file claims it\u0027s correct to nest these with sp_lock\ninside.)\n\nTested-by: Jason Tibbitts \u003ctibbs@math.uh.edu\u003e\nTested-by: Paweł Sikora \u003cpawel.sikora@agmk.net\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "8c2223fc19032e7b8761e46c15e1ed167a252285",
      "tree": "0054de1a82d88309207385e115d051179b583578",
      "parents": [
        "e5a096aa0aeb1fc8ad8b3d6bd70d322a0d65edc4"
      ],
      "author": {
        "name": "Mathias Krause",
        "email": "minipli@googlemail.com",
        "time": "Sat Feb 23 01:13:47 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 28 06:59:06 2013 -0800"
      },
      "message": "sock_diag: Fix out-of-bounds access to sock_diag_handlers[]\n\n[ Upstream commit 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0 ]\n\nUserland can send a netlink message requesting SOCK_DIAG_BY_FAMILY\nwith a family greater or equal then AF_MAX -- the array size of\nsock_diag_handlers[]. The current code does not test for this\ncondition therefore is vulnerable to an out-of-bound access opening\ndoors for a privilege escalation.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "e5a096aa0aeb1fc8ad8b3d6bd70d322a0d65edc4",
      "tree": "d5055028b4ac0b56b49b6d65237038c5c7f46778",
      "parents": [
        "785e5dce256ea5bdf4871af13f9908b74264b515"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Thu Feb 21 12:18:52 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 28 06:59:06 2013 -0800"
      },
      "message": "ipv6: use a stronger hash for tcp\n\n[ Upstream commit 08dcdbf6a7b9d14c2302c5bd0c5390ddf122f664 ]\n\nIt looks like its possible to open thousands of TCP IPv6\nsessions on a server, all landing in a single slot of TCP hash\ntable. Incoming packets have to lookup sockets in a very\nlong list.\n\nWe should hash all bits from foreign IPv6 addresses, using\na salt and hash mix, not a simple XOR.\n\ninet6_ehashfn() can also separately use the ports, instead\nof xoring them.\n\nReported-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Yuchung Cheng \u003cycheng@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "785e5dce256ea5bdf4871af13f9908b74264b515",
      "tree": "f4ca23b59e0623fe10600a1a7b8b6d63279986ff",
      "parents": [
        "1e6b5fb5ce92028f6c87864712ed7290446a4c11"
      ],
      "author": {
        "name": "Li Wei",
        "email": "lw@cn.fujitsu.com",
        "time": "Thu Feb 21 00:09:54 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 28 06:59:06 2013 -0800"
      },
      "message": "ipv4: fix a bug in ping_err().\n\n[ Upstream commit b531ed61a2a2a77eeb2f7c88b49aa5ec7d9880d8 ]\n\nWe should get \u0027type\u0027 and \u0027code\u0027 from the outer ICMP header.\n\nSigned-off-by: Li Wei \u003clw@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "b5428e471b91192a2438d04c1d2ff2b3d4708366",
      "tree": "e1a3431cc3f210338fae06ced15b266352544d56",
      "parents": [
        "6e95f970d1cb6801b5f26d2c167fb1e0ad6c5dba"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Tue Feb 12 06:16:53 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 28 06:59:06 2013 -0800"
      },
      "message": "net: fix infinite loop in __skb_recv_datagram()\n\n[ Upstream commit 77c1090f94d1b0b5186fb13a1b71b47b1343f87f ]\n\nTommi was fuzzing with trinity and reported the following problem :\n\ncommit 3f518bf745 (datagram: Add offset argument to __skb_recv_datagram)\nmissed that a raw socket receive queue can contain skbs with no payload.\n\nWe can loop in __skb_recv_datagram() with MSG_PEEK mode, because\nwait_for_packet() is not prepared to skip these skbs.\n\n[   83.541011] INFO: rcu_sched detected stalls on CPUs/tasks: {}\n(detected by 0, t\u003d26002 jiffies, g\u003d27673, c\u003d27672, q\u003d75)\n[   83.541011] INFO: Stall ended before state dump start\n[  108.067010] BUG: soft lockup - CPU#0 stuck for 22s! [trinity-child31:2847]\n...\n[  108.067010] Call Trace:\n[  108.067010]  [\u003cffffffff818cc103\u003e] __skb_recv_datagram+0x1a3/0x3b0\n[  108.067010]  [\u003cffffffff818cc33d\u003e] skb_recv_datagram+0x2d/0x30\n[  108.067010]  [\u003cffffffff819ed43d\u003e] rawv6_recvmsg+0xad/0x240\n[  108.067010]  [\u003cffffffff818c4b04\u003e] sock_common_recvmsg+0x34/0x50\n[  108.067010]  [\u003cffffffff818bc8ec\u003e] sock_recvmsg+0xbc/0xf0\n[  108.067010]  [\u003cffffffff818bf31e\u003e] sys_recvfrom+0xde/0x150\n[  108.067010]  [\u003cffffffff81ca4329\u003e] system_call_fastpath+0x16/0x1b\n\nReported-by: Tommi Rantala \u003ctt.rantala@gmail.com\u003e\nTested-by: Tommi Rantala \u003ctt.rantala@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nAcked-by: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "6e95f970d1cb6801b5f26d2c167fb1e0ad6c5dba",
      "tree": "478d6b2bc46eba7e68ffcfe3054cac491f404eea",
      "parents": [
        "a9115fba99247ad51211beb3ffd23b6553c80ee9"
      ],
      "author": {
        "name": "Stephen Hemminger",
        "email": "stephen@networkplumber.org",
        "time": "Mon Feb 11 08:22:22 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 28 06:59:05 2013 -0800"
      },
      "message": "bridge: set priority of STP packets\n\n[ Upstream commit 547b4e718115eea74087e28d7fa70aec619200db ]\n\nSpanning Tree Protocol packets should have always been marked as\ncontrol packets, this causes them to get queued in the high prirority\nFIFO. As Radia Perlman mentioned in her LCA talk, STP dies if bridge\ngets overloaded and can\u0027t communicate. This is a long-standing bug back\nto the first versions of Linux bridge.\n\nSigned-off-by: Stephen Hemminger \u003cstephen@networkplumber.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "94fab0a18e9cbec420c58c7b12b93acf1663c3fd",
      "tree": "3257222639a169f5a25876ad2bca46dbddce426b",
      "parents": [
        "f641de91169472dc398fbd971cef380ad8d0f787"
      ],
      "author": {
        "name": "Sarveshwar Bandi",
        "email": "sarveshwar.bandi@emulex.com",
        "time": "Wed Oct 10 01:15:01 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:49:07 2013 -0800"
      },
      "message": "bridge: Pull ip header into skb-\u003edata before looking into ip header.\n\n[ Upstream commit 6caab7b0544e83e6c160b5e80f5a4a7dd69545c7 ]\n\nIf lower layer driver leaves the ip header in the skb fragment, it needs to\nbe first pulled into skb-\u003edata before inspecting ip header length or ip version\nnumber.\n\nSigned-off-by: Sarveshwar Bandi \u003csarveshwar.bandi@emulex.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "f641de91169472dc398fbd971cef380ad8d0f787",
      "tree": "5fd7cea4a429f37f04ed28ac53738ebfd4c77dcf",
      "parents": [
        "2813296332187d222b96363fe29f10929f7a5228"
      ],
      "author": {
        "name": "Ilpo Järvinen",
        "email": "ilpo.jarvinen@helsinki.fi",
        "time": "Mon Feb 04 02:14:25 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:49:06 2013 -0800"
      },
      "message": "tcp: fix for zero packets_in_flight was too broad\n\n[ Upstream commit 6731d2095bd4aef18027c72ef845ab1087c3ba63 ]\n\nThere are transients during normal FRTO procedure during which\nthe packets_in_flight can go to zero between write_queue state\nupdates and firing the resulting segments out. As FRTO processing\noccurs during that window the check must be more precise to\nnot match \"spuriously\" :-). More specificly, e.g., when\npackets_in_flight is zero but FLAG_DATA_ACKED is true the problematic\nbranch that set cwnd into zero would not be taken and new segments\nmight be sent out later.\n\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@helsinki.fi\u003e\nTested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "2813296332187d222b96363fe29f10929f7a5228",
      "tree": "10dfdbd0714285dbb4385bfd38f67ae968b6a4aa",
      "parents": [
        "42671f1e6fd8922b071bd3fd3e0cfad7226c654d"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Sun Feb 03 09:13:05 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:49:06 2013 -0800"
      },
      "message": "tcp: frto should not set snd_cwnd to 0\n\n[ Upstream commit 2e5f421211ff76c17130b4597bc06df4eeead24f ]\n\nCommit 9dc274151a548 (tcp: fix ABC in tcp_slow_start())\nuncovered a bug in FRTO code :\ntcp_process_frto() is setting snd_cwnd to 0 if the number\nof in flight packets is 0.\n\nAs Neal pointed out, if no packet is in flight we lost our\nchance to disambiguate whether a loss timeout was spurious.\n\nWe should assume it was a proper loss.\n\nReported-by: Pasi Kärkkäinen \u003cpasik@iki.fi\u003e\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Ilpo Järvinen \u003cilpo.jarvinen@helsinki.fi\u003e\nCc: Yuchung Cheng \u003cycheng@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "d6f5498856f31246818bbe4ebfa710ce92730a37",
      "tree": "a535cd9a4c02fbb51ca3cf21aaba2c5d18f5f423",
      "parents": [
        "8a501d87edf7190e8fe1741d9312dfcb6361c538"
      ],
      "author": {
        "name": "Daniel Borkmann",
        "email": "dborkman@redhat.com",
        "time": "Fri Feb 08 03:04:35 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:49:06 2013 -0800"
      },
      "message": "net: sctp: sctp_endpoint_free: zero out secret key data\n\n[ Upstream commit b5c37fe6e24eec194bb29d22fdd55d73bcc709bf ]\n\nOn sctp_endpoint_destroy, previously used sensitive keying material\nshould be zeroed out before the memory is returned, as we already do\nwith e.g. auth keys when released.\n\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nAcked-by: Vlad Yasevich \u003cvyasevic@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "8a501d87edf7190e8fe1741d9312dfcb6361c538",
      "tree": "abf0a0ba0fcad5bb747f349517e937cd63c77406",
      "parents": [
        "4c921d0ed5d49a93613530f4dd405fc2db3ccb84"
      ],
      "author": {
        "name": "Daniel Borkmann",
        "email": "dborkman@redhat.com",
        "time": "Fri Feb 08 03:04:34 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:49:05 2013 -0800"
      },
      "message": "net: sctp: sctp_setsockopt_auth_key: use kzfree instead of kfree\n\n[ Upstream commit 6ba542a291a5e558603ac51cda9bded347ce7627 ]\n\nIn sctp_setsockopt_auth_key, we create a temporary copy of the user\npassed shared auth key for the endpoint or association and after\ninternal setup, we free it right away. Since it\u0027s sensitive data, we\nshould zero out the key before returning the memory back to the\nallocator. Thus, use kzfree instead of kfree, just as we do in\nsctp_auth_key_put().\n\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "4c921d0ed5d49a93613530f4dd405fc2db3ccb84",
      "tree": "2c88fd1c499ead4485c59908979d435ab7ccef03",
      "parents": [
        "b4129dae20d6e106cb197008d9adf617e1affa89"
      ],
      "author": {
        "name": "Neil Horman",
        "email": "nhorman@tuxdriver.com",
        "time": "Thu Jan 17 11:15:08 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:49:05 2013 -0800"
      },
      "message": "sctp: refactor sctp_outq_teardown to insure proper re-initalization\n\n[ Upstream commit 2f94aabd9f6c925d77aecb3ff020f1cc12ed8f86 ]\n\nJamie Parsons reported a problem recently, in which the re-initalization of an\nassociation (The duplicate init case), resulted in a loss of receive window\nspace.  He tracked down the root cause to sctp_outq_teardown, which discarded\nall the data on an outq during a re-initalization of the corresponding\nassociation, but never reset the outq-\u003eoutstanding_data field to zero.  I wrote,\nand he tested this fix, which does a proper full re-initalization of the outq,\nfixing this problem, and hopefully future proofing us from simmilar issues down\nthe road.\n\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nReported-by: Jamie Parsons \u003cJamie.Parsons@metaswitch.com\u003e\nTested-by: Jamie Parsons \u003cJamie.Parsons@metaswitch.com\u003e\nCC: Jamie Parsons \u003cJamie.Parsons@metaswitch.com\u003e\nCC: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nCC: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCC: netdev@vger.kernel.org\nAcked-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "f60f85403b3a5b566ba0eaf174930f6a626d33ad",
      "tree": "9adc81bec9debf7768180899b00bcf3c94be33ae",
      "parents": [
        "d78378096e74b2fd0b42b74156ba0ae0567ea226"
      ],
      "author": {
        "name": "Phil Sutter",
        "email": "phil.sutter@viprinet.com",
        "time": "Fri Feb 01 07:21:41 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:49:05 2013 -0800"
      },
      "message": "packet: fix leakage of tx_ring memory\n\n[ Upstream commit 9665d5d62487e8e7b1f546c00e11107155384b9a ]\n\nWhen releasing a packet socket, the routine packet_set_ring() is reused\nto free rings instead of allocating them. But when calling it for the\nfirst time, it fills req-\u003etp_block_nr with the value of rb-\u003epg_vec_len\nwhich in the second invocation makes it bail out since req-\u003etp_block_nr\nis greater zero but req-\u003etp_block_size is zero.\n\nThis patch solves the problem by passing a zeroed auto-variable to\npacket_set_ring() upon each invocation from packet_release().\n\nAs far as I can tell, this issue exists even since 69e3c75 (net: TX_RING\nand packet mmap), i.e. the original inclusion of TX ring support into\naf_packet, but applies only to sockets with both RX and TX ring\nallocated, which is probably why this was unnoticed all the time.\n\nSigned-off-by: Phil Sutter \u003cphil.sutter@viprinet.com\u003e\nCc: Johann Baudy \u003cjohann.baudy@gnu-log.net\u003e\nCc: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nAcked-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "909978d73590b07c3a050a569cc3bd44b1f9355c",
      "tree": "f62315f8be65677c9421c5e68d9f6000098a0a3e",
      "parents": [
        "6c1128b87d5814de27f8ddc445783a81914b194f"
      ],
      "author": {
        "name": "Marcelo Ricardo Leitner",
        "email": "mleitner@redhat.com",
        "time": "Tue Jan 29 22:26:08 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:49:05 2013 -0800"
      },
      "message": "ipv6: do not create neighbor entries for local delivery\n\n[ Upstream commit bd30e947207e2ea0ff2c08f5b4a03025ddce48d3 ]\n\nThey will be created at output, if ever needed. This avoids creating\nempty neighbor entries when TPROXYing/Forwarding packets for addresses\nthat are not even directly reachable.\n\nNote that IPv4 already handles it this way. No neighbor entries are\ncreated for local input.\n\nTested by myself and customer.\n\nSigned-off-by: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Marcelo Ricardo Leitner \u003cmleitner@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "6c1128b87d5814de27f8ddc445783a81914b194f",
      "tree": "97ea12d58e9aa3013aa9a5e0cf6d6d6d03a5bc80",
      "parents": [
        "e38660420e8e12d7fd6b58069d985b6298aad176"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "amwang@redhat.com",
        "time": "Sun Jan 27 21:14:08 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:49:05 2013 -0800"
      },
      "message": "pktgen: correctly handle failures when adding a device\n\n[ Upstream commit 604dfd6efc9b79bce432f2394791708d8e8f6efc ]\n\nThe return value of pktgen_add_device() is not checked, so\neven if we fail to add some device, for example, non-exist one,\nwe still see \"OK:...\". This patch fixes it.\n\nAfter this patch, I got:\n\n\t# echo \"add_device non-exist\" \u003e /proc/net/pktgen/kpktgend_0\n\t-bash: echo: write error: No such device\n\t# cat /proc/net/pktgen/kpktgend_0\n\tRunning:\n\tStopped:\n\tResult: ERROR: can not add device non-exist\n\t# echo \"add_device eth0\" \u003e /proc/net/pktgen/kpktgend_0\n\t# cat /proc/net/pktgen/kpktgend_0\n\tRunning:\n\tStopped: eth0\n\tResult: OK: add_device\u003deth0\n\n(Candidate for -stable)\n\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Cong Wang \u003camwang@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "07da6b22a219ba7907ad41118f0e77f4b8fae9a9",
      "tree": "6369b3eefe623706dba649d01051a2343c47e40c",
      "parents": [
        "6320f430b95a00ef958d7e98655823bfb3c1b918"
      ],
      "author": {
        "name": "Romain KUNTZ",
        "email": "r.kuntz@ipflavors.com",
        "time": "Wed Jan 16 12:47:40 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:48:54 2013 -0800"
      },
      "message": "ipv6: fix header length calculation in ip6_append_data()\n\n[ Upstream commit 7efdba5bd9a2f3e2059beeb45c9fa55eefe1bced ]\n\nCommit 299b0767 (ipv6: Fix IPsec slowpath fragmentation problem)\nhas introduced a error in the header length calculation that\nprovokes corrupted packets when non-fragmentable extensions\nheaders (Destination Option or Routing Header Type 2) are used.\n\nrt-\u003ert6i_nfheader_len is the length of the non-fragmentable\nextension header, and it should be substracted to\nrt-\u003edst.header_len, and not to exthdrlen, as it was done before\ncommit 299b0767.\n\nThis patch reverts to the original and correct behavior. It has\nbeen successfully tested with and without IPsec on packets\nthat include non-fragmentable extensions headers.\n\nSigned-off-by: Romain Kuntz \u003cr.kuntz@ipflavors.com\u003e\nAcked-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "3b69055b43c57783a8bf99a8e40f773580e451a1",
      "tree": "acf7a6f31138e0642b1233c56dcd43c9112d777c",
      "parents": [
        "0ad715758022062a34bccede6200803e26480c97"
      ],
      "author": {
        "name": "Romain Kuntz",
        "email": "r.kuntz@ipflavors.com",
        "time": "Wed Jan 09 15:02:26 2013 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:48:54 2013 -0800"
      },
      "message": "ipv6: fix the noflags test in addrconf_get_prefix_route\n\n[ Upstream commit 85da53bf1c336bb07ac038fb951403ab0478d2c5 ]\n\nThe tests on the flags in addrconf_get_prefix_route() does no make\nmuch sense: the \u0027noflags\u0027 parameter contains the set of flags that\nmust not match with the route flags, so the test must be done\nagainst \u0027noflags\u0027, and not against \u0027flags\u0027.\n\nSigned-off-by: Romain Kuntz \u003cr.kuntz@ipflavors.com\u003e\nAcked-by: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "0ad715758022062a34bccede6200803e26480c97",
      "tree": "60a4afb6dd1aa6842c41b886bcdaf4d9b96b4b2c",
      "parents": [
        "7f8d73f9e71d58187f42d26088578be5d2d70859"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Jan 07 21:17:00 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:48:54 2013 -0800"
      },
      "message": "net: prevent setting ttl\u003d0 via IP_TTL\n\n[ Upstream commit c9be4a5c49cf51cc70a993f004c5bb30067a65ce ]\n\nA regression is introduced by the following commit:\n\n\tcommit 4d52cfbef6266092d535237ba5a4b981458ab171\n\tAuthor: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\n\tDate:   Tue Jun 2 00:42:16 2009 -0700\n\n\t    net: ipv4/ip_sockglue.c cleanups\n\n\t    Pure cleanups\n\nbut it is not a pure cleanup...\n\n\t-               if (val !\u003d -1 \u0026\u0026 (val \u003c 1 || val\u003e255))\n\t+               if (val !\u003d -1 \u0026\u0026 (val \u003c 0 || val \u003e 255))\n\nSince there is no reason provided to allow ttl\u003d0, change it back.\n\nReported-by: nitin padalia \u003cpadalia.nitin@gmail.com\u003e\nCc: nitin padalia \u003cpadalia.nitin@gmail.com\u003e\nCc: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "a256a4c2001293548f0851b66ea8f39b704bac72",
      "tree": "304505ae5ae7959b388c3c919975b738e2492af1",
      "parents": [
        "7308f843f36c30dd1247989a45611760567ea44f"
      ],
      "author": {
        "name": "Johan Hedberg",
        "email": "johan.hedberg@intel.com",
        "time": "Tue Jan 29 10:44:23 2013 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 14 10:48:53 2013 -0800"
      },
      "message": "Bluetooth: Fix handling of unexpected SMP PDUs\n\ncommit 8cf9fa1240229cbdd888236c0c43fcbad680cf00 upstream.\n\nThe conn-\u003esmp_chan pointer can be NULL if SMP PDUs arrive at unexpected\nmoments. To avoid NULL pointer dereferences the code should be checking\nfor this and disconnect if an unexpected SMP PDU arrives. This patch\nfixes the issue by adding a check for conn-\u003esmp_chan for all other PDUs\nexcept pairing request and security request (which are are the first\nPDUs to come to initialize the SMP context).\n\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "5a099d740ffdff7b217f23d7d871c4fb0c24a24b",
      "tree": "9692967860d7e2ddbc06ea3646c54241ea59c4dc",
      "parents": [
        "4b56ffb0c322d955c7fe6bae60711479b7ef6519"
      ],
      "author": {
        "name": "Stanislaw Gruszka",
        "email": "sgruszka@redhat.com",
        "time": "Thu Dec 20 14:41:18 2012 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Feb 03 18:24:42 2013 -0600"
      },
      "message": "mac80211: synchronize scan off/on-channel and PS states\n\ncommit aacde9ee45225f7e0b90960f479aef83c66bfdc0 upstream.\n\nSince:\n\ncommit b23b025fe246f3acc2988eb6d400df34c27cb8ae\nAuthor: Ben Greear \u003cgreearb@candelatech.com\u003e\nDate:   Fri Feb 4 11:54:17 2011 -0800\n\n    mac80211: Optimize scans on current operating channel.\n\nwe do not disable PS while going back to operational channel (on\nieee80211_scan_state_suspend) and deffer that until scan finish.\nBut since we are allowed to send frames, we can send a frame to AP\nwithout PM bit set, so disable PS on AP side. Then when we switch\nto off-channel (in ieee80211_scan_state_resume) we do not enable PS.\nHence we are off-channel with PS disabled, frames are not buffered\nby AP.\n\nTo fix remove offchannel_ps_disable argument and always enable PS when\ngoing off-channel and disable it when going on-channel, like it was\nbefore.\n\nCc: stable@vger.kernel.org # 2.6.39+\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nTested-by: Seth Forshee \u003cseth.forshee@canonical.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "5a6d60801c24f6966cf73894258134778ddccde5",
      "tree": "e2ec46e0454cd0815c65a17c83c3d3ba60a43561",
      "parents": [
        "99141c253f45822edfab14fa34bfa47f56d803ad"
      ],
      "author": {
        "name": "Anderson Lizardo",
        "email": "anderson.lizardo@openbossa.org",
        "time": "Sun Jan 06 18:28:53 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Feb 03 18:24:41 2013 -0600"
      },
      "message": "Bluetooth: Fix incorrect strncpy() in hidp_setup_hid()\n\ncommit 0a9ab9bdb3e891762553f667066190c1d22ad62b upstream.\n\nThe length parameter should be sizeof(req-\u003ename) - 1 because there is no\nguarantee that string provided by userspace will contain the trailing\n\u0027\\0\u0027.\n\nCan be easily reproduced by manually setting req-\u003ename to 128 non-zero\nbytes prior to ioctl(HIDPCONNADD) and checking the device name setup on\ninput subsystem:\n\n$ cat /sys/devices/pnp0/00\\:04/tty/ttyS0/hci0/hci0\\:1/input8/name\nAAAAAA[...]AAAAAAAAf0:af:f0:af:f0:af\n\n(\"f0:af:f0:af:f0:af\" is the device bluetooth address, taken from \"phys\"\nfield in struct hid_device due to overflow.)\n\nSigned-off-by: Anderson Lizardo \u003canderson.lizardo@openbossa.org\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "e4fcbe5297a8c6e512c68a77c660a8cdd7d315e4",
      "tree": "47139ed414cd13e6aaa4dd461acd81e87dd75e97",
      "parents": [
        "df2f07099760702c9f3664230263b6be3142b7d7"
      ],
      "author": {
        "name": "Johannes Berg",
        "email": "johannes.berg@intel.com",
        "time": "Fri Jan 11 14:34:25 2013 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Feb 03 18:24:41 2013 -0600"
      },
      "message": "mac80211: fix FT roaming\n\ncommit 1626e0fa740dec8665a973cf2349405cdfeb46dc upstream.\n\nDuring FT roaming, wpa_supplicant attempts to set the\nkey before association. This used to be rejected, but\nas a side effect of my commit 66e67e418908442389d3a9e\n(\"mac80211: redesign auth/assoc\") the key was accepted\ncausing hardware crypto to not be used for it as the\nstation isn\u0027t added to the driver yet.\n\nIt would be possible to accept the key and then add it\nto the driver when the station has been added. However,\nthis may run into issues with drivers using the state-\nbased station adding if they accept the key only after\nassociation like it used to be.\n\nFor now, revert to the behaviour from before the auth\nand assoc change.\n\nReported-by: Cédric Debarge \u003ccedric.debarge@acksys.fr\u003e\nTested-by: Cédric Debarge \u003ccedric.debarge@acksys.fr\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "dec3b6a0b8a4b1503617c45b351aedbd63adab58",
      "tree": "0ea51a4da048c6ecabb5141ea1306dd2f6a666fb",
      "parents": [
        "112ae50d212e65816b9de8ea0010a430569d2fc6"
      ],
      "author": {
        "name": "Szymon Janc",
        "email": "szymon.janc@tieto.com",
        "time": "Tue Dec 11 08:51:19 2012 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Feb 03 18:24:40 2013 -0600"
      },
      "message": "Bluetooth: Fix sending HCI commands after reset\n\ncommit dbccd791a3fbbdac12c33834b73beff3984988e9 upstream.\n\nAfter sending reset command wait for its command complete event before\nsending next command. Some chips sends CC event for command received\nbefore reset if reset was send before chip replied with CC.\n\nThis is also required by specification that host shall not send\nadditional HCI commands before receiving CC for reset.\n\n\u003c HCI Command: Reset (0x03|0x0003) plen 0                              [hci0] 18.404612\n\u003e HCI Event: Command Complete (0x0e) plen 4                            [hci0] 18.405850\n      Write Extended Inquiry Response (0x03|0x0052) ncmd 1\n        Status: Success (0x00)\n\u003c HCI Command: Read Local Supported Features (0x04|0x0003) plen 0      [hci0] 18.406079\n\u003e HCI Event: Command Complete (0x0e) plen 4                            [hci0] 18.407864\n      Reset (0x03|0x0003) ncmd 1\n        Status: Success (0x00)\n\u003c HCI Command: Read Local Supported Features (0x04|0x0003) plen 0      [hci0] 18.408062\n\u003e HCI Event: Command Complete (0x0e) plen 12                           [hci0] 18.408835\n\nSigned-off-by: Szymon Janc \u003cszymon.janc@tieto.com\u003e\nAcked-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "50cda8f4439d715e080ced70d1e6d9ec07f95e6c",
      "tree": "551efdfc5513a4ba2d28d71f49ef60c3d2452e0d",
      "parents": [
        "02585b8bdc988de82b45088a3f2092af2e6b2816"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Thu Dec 06 09:37:23 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:20 2013 -0800"
      },
      "message": "rbd: remove linger unconditionally\n\nIn __unregister_linger_request(), the request is being removed\nfrom the osd client\u0027s req_linger list only when the request\nhas a non-null osd pointer.  It should be done whether or not\nthe request currently has an osd.\n\nThis is most likely a non-issue because I believe the request\nwill always have an osd when this function is called.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit 61c74035626beb25a39b0273ccf7d75510bc36a1)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "02585b8bdc988de82b45088a3f2092af2e6b2816",
      "tree": "e3d5daa4bae518a8af0b52c835a98753987993b9",
      "parents": [
        "31c46473d6a31ac1948c189624b472f26a6365e9"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Thu Nov 29 08:37:03 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:20 2013 -0800"
      },
      "message": "ceph: don\u0027t reference req after put\n\nIn __unregister_request(), there is a call to list_del_init()\nreferencing a request that was the subject of a call to\nceph_osdc_put_request() on the previous line.  This is not\nsafe, because the request structure could have been freed\nby the time we reach the list_del_init().\n\nFix this by reversing the order of these lines.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-off-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit 7d5f24812bd182a2471cb69c1c2baf0648332e1f)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "31c46473d6a31ac1948c189624b472f26a6365e9",
      "tree": "63c5f7fee9abeb70822af493e281ed331f0ebc13",
      "parents": [
        "87c7f759d1546a27d46d8cc2778ffecaa5f542c6"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Wed Nov 28 12:28:24 2012 -0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:20 2013 -0800"
      },
      "message": "libceph: remove \u0027osdtimeout\u0027 option\n\nThis would reset a connection with any OSD that had an outstanding\nrequest that was taking more than N seconds.  The idea was that if the\nOSD was buggy, the client could compensate by resending the request.\n\nIn reality, this only served to hide server bugs, and we haven\u0027t\nactually seen such a bug in quite a while.  Moreover, the userspace\nclient code never did this.\n\nMore importantly, often the request is taking a long time because the\nOSD is trying to recover, or overloaded, and killing the connection\nand retrying would only make the situation worse by giving the OSD\nmore work to do.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\n(cherry picked from commit 83aff95eb9d60aff5497e9f44a2ae906b86d8e88)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "3aa540b869b9bd734ec60246ae1dfe35ab3530e0",
      "tree": "16ba9e7dc0e84780777252216fb37f73a7348df7",
      "parents": [
        "9aaab33ec9b7b9cb745fc47dfe20b991ff468d72"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Fri Dec 07 09:57:58 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:20 2013 -0800"
      },
      "message": "libceph: avoid using freed osd in __kick_osd_requests()\n\nIf an osd has no requests and no linger requests, __reset_osd()\nwill just remove it with a call to __remove_osd().  That drops\na reference to the osd, and therefore the osd may have been free\nby the time __reset_osd() returns.  That function offers no\nindication this may have occurred, and as a result the osd will\ncontinue to be used even when it\u0027s no longer valid.\n\nChange__reset_osd() so it returns an error (ENODEV) when it\ndeletes the osd being reset.  And change __kick_osd_requests() so it\nreturns immediately (before referencing osd again) if __reset_osd()\nreturns *any* error.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit 685a7555ca69030739ddb57a47f0ea8ea80196a4)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "9aaab33ec9b7b9cb745fc47dfe20b991ff468d72",
      "tree": "abd1bd5c9e0cc05901d8be2f6978fbabb37573f3",
      "parents": [
        "7f5b160daddeaa55e441aca16010fab8299dfe9e"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Mon Oct 29 11:01:42 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:19 2013 -0800"
      },
      "message": "libceph: fix osdmap decode error paths\n\nEnsure that we set the err value correctly so that we do not pass a 0\nvalue to ERR_PTR and confuse the calling code.  (In particular,\nosd_client.c handle_map() will BUG(!newmap)).\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\n(cherry picked from commit 0ed7285e0001b960c888e5455ae982025210ed3d)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "7f5b160daddeaa55e441aca16010fab8299dfe9e",
      "tree": "7d2d3f3d9a3f099fc4882336a5aac88b137f2ce1",
      "parents": [
        "5bd9eb5a0891df0a806f265db504661fd558529c"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Thu Dec 27 20:27:04 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:19 2013 -0800"
      },
      "message": "libceph: fix protocol feature mismatch failure path\n\nWe should not set con-\u003estate to CLOSED here; that happens in\nceph_fault() in the caller, where it first asserts that the state\nis not yet CLOSED.  Avoids a BUG when the features don\u0027t match.\n\nSince the fail_protocol() has become a trivial wrapper, replace\ncalls to it with direct calls to reset_connection().\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\n(cherry picked from commit 0fa6ebc600bc8e830551aee47a0e929e818a1868)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "5bd9eb5a0891df0a806f265db504661fd558529c",
      "tree": "d05704dd4b1a3b1f57a8833209f16834f8c70ad4",
      "parents": [
        "1cc023b2653ad66b58970460165d0859943f41e7"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Wed Dec 26 10:43:57 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:19 2013 -0800"
      },
      "message": "libceph: WARN, don\u0027t BUG on unexpected connection states\n\nA number of assertions in the ceph messenger are implemented with\nBUG_ON(), killing the system if connection\u0027s state doesn\u0027t match\nwhat\u0027s expected.  At this point our state model is (evidently) not\nwell understood enough for these assertions to trigger a BUG().\nConvert all BUG_ON(con-\u003estate...) calls to be WARN_ON(con-\u003estate...)\nso we learn about these issues without killing the machine.\n\nWe now recognize that a connection fault can occur due to a socket\nclosure at any time, regardless of the state of the connection.  So\nthere is really nothing we can assert about the state of the\nconnection at that point so eliminate that assertion.\n\nReported-by: Ugis \u003cugis22@gmail.com\u003e\nTested-by: Ugis \u003cugis22@gmail.com\u003e\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit 122070a2ffc91f87fe8e8493eb0ac61986c5557c)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "1cc023b2653ad66b58970460165d0859943f41e7",
      "tree": "d203ac370ffdbfd6631053214852b283633fc1f6",
      "parents": [
        "a9ded438f7c08525df2ce19e8aeb112efd3090c9"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Wed Dec 26 14:31:40 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:19 2013 -0800"
      },
      "message": "libceph: always reset osds when kicking\n\nWhen ceph_osdc_handle_map() is called to process a new osd map,\nkick_requests() is called to ensure all affected requests are\nupdated if necessary to reflect changes in the osd map.  This\nhappens in two cases:  whenever an incremental map update is\nprocessed; and when a full map update (or the last one if there is\nmore than one) gets processed.\n\nIn the former case, the kick_requests() call is followed immediately\nby a call to reset_changed_osds() to ensure any connections to osds\naffected by the map change are reset.  But for full map updates\nthis isn\u0027t done.\n\nBoth cases should be doing this osd reset.\n\nRather than duplicating the reset_changed_osds() call, move it into\nthe end of kick_requests().\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit e6d50f67a6b1a6252a616e6e629473b5c4277218)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "a9ded438f7c08525df2ce19e8aeb112efd3090c9",
      "tree": "a553fd350ca11b52b3537c18b4e9ebb3120c1e96",
      "parents": [
        "0d3b9fff8bc11bc7d745c6b34c098b1c548fec65"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Wed Dec 19 15:52:36 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:19 2013 -0800"
      },
      "message": "libceph: move linger requests sooner in kick_requests()\n\nThe kick_requests() function is called by ceph_osdc_handle_map()\nwhen an osd map change has been indicated.  Its purpose is to\nre-queue any request whose target osd is different from what it\nwas when it was originally sent.\n\nIt is structured as two loops, one for incomplete but registered\nrequests, and a second for handling completed linger requests.\nAs a special case, in the first loop if a request marked to linger\nhas not yet completed, it is moved from the request list to the\nlinger list.  This is as a quick and dirty way to have the second\nloop handle sending the request along with all the other linger\nrequests.\n\nBecause of the way it\u0027s done now, however, this quick and dirty\nsolution can result in these incomplete linger requests never\ngetting re-sent as desired.  The problem lies in the fact that\nthe second loop only arranges for a linger request to be sent\nif it appears its target osd has changed.  This is the proper\nhandling for *completed* linger requests (it avoids issuing\nthe same linger request twice to the same osd).\n\nBut although the linger requests added to the list in the first loop\nmay have been sent, they have not yet completed, so they need to be\nre-sent regardless of whether their target osd has changed.\n\nThe first required fix is we need to avoid calling __map_request()\non any incomplete linger request.  Otherwise the subsequent\n__map_request() call in the second loop will find the target osd\nhas not changed and will therefore not re-send the request.\n\nSecond, we need to be sure that a sent but incomplete linger request\ngets re-sent.  If the target osd is the same with the new osd map as\nit was when the request was originally sent, this won\u0027t happen.\nThis can be fixed through careful handling when we move these\nrequests from the request list to the linger list, by unregistering\nthe request *before* it is registered as a linger request.  This\nworks because a side-effect of unregistering the request is to make\nthe request\u0027s r_osd pointer be NULL, and *that* will ensure the\nsecond loop actually re-sends the linger request.\n\nProcessing of such a request is done at that point, so continue with\nthe next one once it\u0027s been moved.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit ab60b16d3c31b9bd9fd5b39f97dc42c52a50b67d)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "0d3b9fff8bc11bc7d745c6b34c098b1c548fec65",
      "tree": "ebbfc836e334670d9b538d4bf92b4fad9983c17b",
      "parents": [
        "1d2522a000b6f6a0c836d586bbb39bacaae9b390"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Thu Dec 06 07:22:04 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:19 2013 -0800"
      },
      "message": "libceph: register request before unregister linger\n\nIn kick_requests(), we need to register the request before we\nunregister the linger request.  Otherwise the unregister will\nreset the request\u0027s osd pointer to NULL.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit c89ce05e0c5a01a256100ac6a6019f276bdd1ca6)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "1d2522a000b6f6a0c836d586bbb39bacaae9b390",
      "tree": "6c70bf7705fbcb354e327d9a88afdd8549818595",
      "parents": [
        "76fb865bcfeba57652edf054fd36aeed38ba5ceb"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Mon Dec 17 12:23:48 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:19 2013 -0800"
      },
      "message": "libceph: don\u0027t use rb_init_node() in ceph_osdc_alloc_request()\n\nThe red-black node in the ceph osd request structure is initialized\nin ceph_osdc_alloc_request() using rbd_init_node().  We do need to\ninitialize this, because in __unregister_request() we call\nRB_EMPTY_NODE(), which expects the node it\u0027s checking to have\nbeen initialized.  But rb_init_node() is apparently overkill, and\nmay in fact be on its way out.  So use RB_CLEAR_NODE() instead.\n\nFor a little more background, see this commit:\n    4c199a93 rbtree: empty nodes have no color\"\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit a978fa20fb657548561dddbfb605fe43654f0825)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "76fb865bcfeba57652edf054fd36aeed38ba5ceb",
      "tree": "8cdaf89d02edb6bdb5dcb5c4c1bf976bf3969c5e",
      "parents": [
        "281c5d9e31a2411055bc750d81dd38d11131648e"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Mon Dec 17 12:23:48 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:19 2013 -0800"
      },
      "message": "libceph: init event-\u003enode in ceph_osdc_create_event()\n\nThe red-black node node in the ceph osd event structure is not\ninitialized in create_osdc_create_event().  Because this node can\nbe the subject of a RB_EMPTY_NODE() call later on, we should ensure\nthe node is initialized properly for that.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit 3ee5234df68d253c415ba4f2db72ad250d9c21a9)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "281c5d9e31a2411055bc750d81dd38d11131648e",
      "tree": "f42562cdaed0ddb70e90c5470145ad879d2cb915",
      "parents": [
        "6ea5c964ecc4037d4ae56694982be253bd821685"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Thu Dec 06 07:22:04 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:19 2013 -0800"
      },
      "message": "libceph: init osd-\u003eo_node in create_osd()\n\nThe red-black node node in the ceph osd structure is not initialized\nin create_osd().  Because this node can be the subject of a\nRB_EMPTY_NODE() call later on, we should ensure the node is\ninitialized properly for that.  Add a call to RB_CLEAR_NODE()\ninitialize it.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit f407731d12214e7686819018f3a1e9d7b6f83a02)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "6ea5c964ecc4037d4ae56694982be253bd821685",
      "tree": "dc0a6999e694922ee62c80a1fade25111eabb49d",
      "parents": [
        "1c0bd4af222ba3a54bf3ba489127323079d0816d"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Fri Dec 14 16:47:41 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:19 2013 -0800"
      },
      "message": "libceph: report connection fault with warning\n\nWhen a connection\u0027s socket disconnects, or if there\u0027s a protocol\nerror of some kind on the connection, a fault is signaled and\nthe connection is reset (closed and reopened, basically).  We\ncurrently get an error message on the log whenever this occurs.\n\nA ceph connection will attempt to reestablish a socket connection\nrepeatedly if a fault occurs.  This means that these error messages\nwill get repeatedly added to the log, which is undesirable.\n\nChange the error message to be a warning, so they don\u0027t get\nlogged by default.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit 28362986f8743124b3a0fda20a8ed3e80309cce1)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "1c0bd4af222ba3a54bf3ba489127323079d0816d",
      "tree": "8fed3cceb5fab95771e8ef105e779a6be070a3c3",
      "parents": [
        "b4659d8e7001600f06080f2b3f1922d0f4d96478"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Fri Dec 07 19:50:07 2012 -0600"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:18 2013 -0800"
      },
      "message": "libceph: socket can close in any connection state\n\nA connection\u0027s socket can close for any reason, independent of the\nstate of the connection (and without irrespective of the connection\nmutex).  As a result, the connectino can be in pretty much any state\nat the time its socket is closed.\n\nHandle those other cases at the top of con_work().  Pull this whole\nblock of code into a separate function to reduce the clutter.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit 7bb21d68c535ad8be38e14a715632ae398b37ac1)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "b4659d8e7001600f06080f2b3f1922d0f4d96478",
      "tree": "9cd38deb8ad331ed104db77bf95202d7130b13a9",
      "parents": [
        "a871375b5548cbcd28c9b97040da7f6470a96a72"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Mon Sep 24 21:01:02 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:18 2013 -0800"
      },
      "message": "ceph: propagate layout error on osd request creation\n\nIf we are creating an osd request and get an invalid layout, return\nan EINVAL to the caller.  We switch up the return to have an error\ncode instead of NULL implying -ENOMEM.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\n(cherry picked from commit 6816282dab3a72efe8c0d182c1bc2960d87f4322)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "848842e67d24fed13a2aece3d03e235267e5a3a6",
      "tree": "c1ea5e2cd143b718dd4533eabeeb463040eb45ff",
      "parents": [
        "5ca99e71a9a6cf33a217690f5d87bc0129d1effd"
      ],
      "author": {
        "name": "Johannes Berg",
        "email": "johannes.berg@intel.com",
        "time": "Thu Dec 13 23:08:52 2012 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:04 2013 -0800"
      },
      "message": "mac80211: use del_timer_sync for final sta cleanup timer deletion\n\ncommit a56f992cdabc63f56b4b142885deebebf936ff76 upstream.\n\nThis is a very old bug, but there\u0027s nothing that prevents the\ntimer from running while the module is being removed when we\nonly do del_timer() instead of del_timer_sync().\n\nThe timer should normally not be running at this point, but\nit\u0027s not clearly impossible (or we could just remove this.)\n\nTested-by: Ben Greear \u003cgreearb@candelatech.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "5ca99e71a9a6cf33a217690f5d87bc0129d1effd",
      "tree": "39b61c587f7db1096394e25e6335620ce646ceaa",
      "parents": [
        "4a3b5681d6b64611375903695481641debd1c308"
      ],
      "author": {
        "name": "Stanislaw Gruszka",
        "email": "sgruszka@redhat.com",
        "time": "Tue Dec 11 10:48:23 2012 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:51:03 2013 -0800"
      },
      "message": "mac80211: fix ibss scanning\n\ncommit 34bcf71502413f8903ade93746f2d0f04b937a78 upstream.\n\nDo not scan on no-IBSS and disabled channels in IBSS mode. Doing this\ncan trigger Microcode errors on iwlwifi and iwlegacy drivers.\n\nAlso rename ieee80211_request_internal_scan() function since it is only\nused in IBSS mode and simplify calling it from ieee80211_sta_find_ibss().\n\nThis patch should address:\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d883414\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d49411\n\nReported-by: Jesse Kahtava \u003cjesse_kahtava@f-m.fm\u003e\nReported-by: Mikko Rapeli  \u003cmikko.rapeli@iki.fi\u003e\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "c7cde2b3d27a5417021d7fc6da0f7941eab63769",
      "tree": "631311ec7d39f6a50d4f4b7c147b60bf958bf065",
      "parents": [
        "297456d8fe2b141f0f05b5d6ff48a4cd0b5f5889"
      ],
      "author": {
        "name": "Trond Myklebust",
        "email": "Trond.Myklebust@netapp.com",
        "time": "Thu Nov 08 10:01:26 2012 -0500"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:50:50 2013 -0800"
      },
      "message": "SUNRPC: Fix validity issues with rpc_pipefs sb-\u003es_fs_info\n\ncommit 642fe4d00db56d65060ce2fd4c105884414acb16 upstream.\n\nrpc_kill_sb() must defer calling put_net() until after the notifier\nhas been called, since most (all?) of the notifier callbacks assume\nthat sb-\u003es_fs_info points to a valid net namespace. It also must not\ncall put_net() if the call to rpc_fill_super was unsuccessful.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d48421\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nCc: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "11d607dd94b7e1e4190f20581643555e620e3366",
      "tree": "43d6ee6738bb7046f74073d995f0724067a39126",
      "parents": [
        "d5b319960ab9e0770b6ecae94045b512cd3029b7"
      ],
      "author": {
        "name": "Trond Myklebust",
        "email": "Trond.Myklebust@netapp.com",
        "time": "Mon Jan 07 14:30:46 2013 -0500"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:50:46 2013 -0800"
      },
      "message": "SUNRPC: Ensure we release the socket write lock if the rpc_task exits early\n\ncommit 87ed50036b866db2ec2ba16b2a7aec4a2b0b7c39 upstream.\n\nIf the rpc_task exits while holding the socket write lock before it has\nallocated an rpc slot, then the usual mechanism for releasing the write\nlock in xprt_release() is defeated.\n\nThe problem occurs if the call to xprt_lock_write() initially fails, so\nthat the rpc_task is put on the xprt-\u003esending wait queue. If the task\nexits after being assigned the lock by __xprt_lock_write_func, but\nbefore it has retried the call to xprt_lock_and_alloc_slot(), then\nit calls xprt_release() while holding the write lock, but will\nimmediately exit due to the test for task-\u003etk_rqstp !\u003d NULL.\n\nReported-by: Chris Perl \u003cchris.perl@gmail.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "d5b319960ab9e0770b6ecae94045b512cd3029b7",
      "tree": "77347dd5c93539b00d5196f68023cd1b9453e278",
      "parents": [
        "65ac5efcd7e36ddf4cbe7d9e7f844a016dba4f7d"
      ],
      "author": {
        "name": "Trond Myklebust",
        "email": "Trond.Myklebust@netapp.com",
        "time": "Fri Jan 04 12:23:21 2013 -0500"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:50:46 2013 -0800"
      },
      "message": "SUNRPC: Ensure that we free the rpc_task after cleanups are done\n\ncommit c6567ed1402c55e19b012e66a8398baec2a726f3 upstream.\n\nThis patch ensures that we free the rpc_task after the cleanup callbacks\nare done in order to avoid a deadlock problem that can be triggered if\nthe callback needs to wait for another workqueue item to complete.\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nCc: Weston Andros Adamson \u003cdros@netapp.com\u003e\nCc: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Bruce Fields \u003cbfields@fieldses.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "65ac5efcd7e36ddf4cbe7d9e7f844a016dba4f7d",
      "tree": "27db0a36734c29f0631a7a5915c9ffb54b4e75b8",
      "parents": [
        "b53673dcf8a31a4b2f41fdf2fa168b7c693fd7b3"
      ],
      "author": {
        "name": "Stanislav Kinsbursky",
        "email": "skinsbursky@parallels.com",
        "time": "Mon Dec 17 20:18:52 2012 +0300"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jan 17 08:50:45 2013 -0800"
      },
      "message": "SUNRPC: continue run over clients list on PipeFS event instead of break\n\ncommit cd6c5968582a273561464fe6b1e8cc8214be02df upstream.\n\nThere are SUNRPC clients, which program doesn\u0027t have pipe_dir_name. These\nclients can be skipped on PipeFS events, because nothing have to be created or\ndestroyed. But instead of breaking in case of such a client was found, search\nfor suitable client over clients list have to be continued. Otherwise some\nclients could not be covered by PipeFS event handler.\n\nSigned-off-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "1a0da46b46bc9b27414fcb1f1ad6f0eeee311f5e",
      "tree": "9c1e1a6bd1e689fc93213f7db5fbf7cee4de5b03",
      "parents": [
        "7e2741804be03faf0eaba1df228e2ba5c07ecdd7"
      ],
      "author": {
        "name": "Gustavo Padovan",
        "email": "gustavo.padovan@collabora.co.uk",
        "time": "Wed Nov 21 00:50:21 2012 -0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:07:17 2013 -0800"
      },
      "message": "Bluetooth: cancel power_on work when unregistering the device\n\ncommit b9b5ef188e5a2222cfc16ef62a4703080750b451 upstream.\n\nWe need to cancel the hci_power_on work in order to avoid it run when we\ntry to free the hdev.\n\n[ 1434.201149] ------------[ cut here ]------------\n[ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0()\n[ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: hci\n_power_on+0x0/0x90\n[ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G        W    3.7.0-rc5-next-\n20121112-sasha-00018-g2f4ce0e #127\n[ 1434.210760] Call Trace:\n[ 1434.210760]  [\u003cffffffff819f3d6e\u003e] ? debug_print_object+0x8e/0xb0\n[ 1434.210760]  [\u003cffffffff8110b887\u003e] warn_slowpath_common+0x87/0xb0\n[ 1434.210760]  [\u003cffffffff8110b911\u003e] warn_slowpath_fmt+0x41/0x50\n[ 1434.210760]  [\u003cffffffff819f3d6e\u003e] debug_print_object+0x8e/0xb0\n[ 1434.210760]  [\u003cffffffff8376b750\u003e] ? hci_dev_open+0x310/0x310\n[ 1434.210760]  [\u003cffffffff83bf94e5\u003e] ? _raw_spin_unlock_irqrestore+0x55/0xa0\n[ 1434.210760]  [\u003cffffffff819f3ee5\u003e] __debug_check_no_obj_freed+0xa5/0x230\n[ 1434.210760]  [\u003cffffffff83785db0\u003e] ? bt_host_release+0x10/0x20\n[ 1434.210760]  [\u003cffffffff819f4d15\u003e] debug_check_no_obj_freed+0x15/0x20\n[ 1434.210760]  [\u003cffffffff8125eee7\u003e] kfree+0x227/0x330\n[ 1434.210760]  [\u003cffffffff83785db0\u003e] bt_host_release+0x10/0x20\n[ 1434.210760]  [\u003cffffffff81e539e5\u003e] device_release+0x65/0xc0\n[ 1434.210760]  [\u003cffffffff819d3975\u003e] kobject_cleanup+0x145/0x190\n[ 1434.210760]  [\u003cffffffff819d39cd\u003e] kobject_release+0xd/0x10\n[ 1434.210760]  [\u003cffffffff819d33cc\u003e] kobject_put+0x4c/0x60\n[ 1434.210760]  [\u003cffffffff81e548b2\u003e] put_device+0x12/0x20\n[ 1434.210760]  [\u003cffffffff8376a334\u003e] hci_free_dev+0x24/0x30\n[ 1434.210760]  [\u003cffffffff82fd8fe1\u003e] vhci_release+0x31/0x60\n[ 1434.210760]  [\u003cffffffff8127be12\u003e] __fput+0x122/0x250\n[ 1434.210760]  [\u003cffffffff811cab0d\u003e] ? rcu_user_exit+0x9d/0xd0\n[ 1434.210760]  [\u003cffffffff8127bf49\u003e] ____fput+0x9/0x10\n[ 1434.210760]  [\u003cffffffff81133402\u003e] task_work_run+0xb2/0xf0\n[ 1434.210760]  [\u003cffffffff8106cfa7\u003e] do_notify_resume+0x77/0xa0\n[ 1434.210760]  [\u003cffffffff83bfb0ea\u003e] int_signal+0x12/0x17\n[ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]---\n\nReported-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "7e2741804be03faf0eaba1df228e2ba5c07ecdd7",
      "tree": "e9740f5b6e5a6f93343732adfc8e55b75680de1c",
      "parents": [
        "2145cea1e0be3262768fef384a87f426ecad06fe"
      ],
      "author": {
        "name": "Gustavo Padovan",
        "email": "gustavo.padovan@collabora.co.uk",
        "time": "Tue Nov 20 23:25:54 2012 -0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:07:17 2013 -0800"
      },
      "message": "Bluetooth: Add missing lock nesting notation\n\ncommit dc2a0e20fbc85a71c63aa4330b496fda33f6bf80 upstream.\n\nThis patch fixes the following report, it happens when accepting rfcomm\nconnections:\n\n[  228.165378] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[  228.165378] [ INFO: possible recursive locking detected ]\n[  228.165378] 3.7.0-rc1-00536-gc1d5dc4 #120 Tainted: G        W\n[  228.165378] ---------------------------------------------\n[  228.165378] bluetoothd/1341 is trying to acquire lock:\n[  228.165378]  (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+...}, at:\n[\u003cffffffffa0000aa0\u003e] bt_accept_dequeue+0xa0/0x180 [bluetooth]\n[  228.165378]\n[  228.165378] but task is already holding lock:\n[  228.165378]  (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+...}, at:\n[\u003cffffffffa0205118\u003e] rfcomm_sock_accept+0x58/0x2d0 [rfcomm]\n[  228.165378]\n[  228.165378] other info that might help us debug this:\n[  228.165378]  Possible unsafe locking scenario:\n[  228.165378]\n[  228.165378]        CPU0\n[  228.165378]        ----\n[  228.165378]   lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);\n[  228.165378]   lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);\n[  228.165378]\n[  228.165378]  *** DEADLOCK ***\n[  228.165378]\n[  228.165378]  May be due to missing lock nesting notation\n\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "2ee4432e82437a7c051c254b065fbf5d4581e1a3",
      "tree": "67e44acf4a1296e1bb719746b579c0a7e8efacad",
      "parents": [
        "29eac3795e2bb2a319f84438d45a4dbcc500cc6c"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Sun Oct 21 19:57:11 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:07:15 2013 -0800"
      },
      "message": "tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation\n\n[ Upstream commit 354e4aa391ed50a4d827ff6fc11e0667d0859b25 ]\n\nRFC 5961 5.2 [Blind Data Injection Attack].[Mitigation]\n\n  All TCP stacks MAY implement the following mitigation.  TCP stacks\n  that implement this mitigation MUST add an additional input check to\n  any incoming segment.  The ACK value is considered acceptable only if\n  it is in the range of ((SND.UNA - MAX.SND.WND) \u003c\u003d SEG.ACK \u003c\u003d\n  SND.NXT).  All incoming segments whose ACK value doesn\u0027t satisfy the\n  above condition MUST be discarded and an ACK sent back.\n\nMove tcp_send_challenge_ack() before tcp_ack() to avoid a forward\ndeclaration.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Neal Cardwell \u003cncardwell@google.com\u003e\nCc: Yuchung Cheng \u003cycheng@google.com\u003e\nCc: Jerry Chu \u003chkchu@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "29eac3795e2bb2a319f84438d45a4dbcc500cc6c",
      "tree": "649547e7bd72a54fa349d90aa7d50f0ef7d635b2",
      "parents": [
        "f451931e294c83d811783799f8a6c29929fc8e85"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Tue Nov 13 05:37:18 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:07:15 2013 -0800"
      },
      "message": "tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming()\n\n[ Upstream commit bd090dfc634ddd711a5fbd0cadc6e0ab4977bcaf ]\n\nWe added support for RFC 5961 in latest kernels but TCP fails\nto perform exhaustive check of ACK sequence.\n\nWe can update our view of peer tsval from a frame that is\nlater discarded by tcp_ack()\n\nThis makes timestamps enabled sessions vulnerable to injection of\na high tsval : peers start an ACK storm, since the victim\nsends a dupack each time it receives an ACK from the other peer.\n\nAs tcp_validate_incoming() is called before tcp_ack(), we should\nnot peform tcp_replace_ts_recent() from it, and let callers do it\nat the right time.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Neal Cardwell \u003cncardwell@google.com\u003e\nCc: Yuchung Cheng \u003cycheng@google.com\u003e\nCc: Nandita Dukkipati \u003cnanditad@google.com\u003e\nCc: H.K. Jerry Chu \u003chkchu@google.com\u003e\nCc: Romain Francoise \u003cromain@orebokech.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "f451931e294c83d811783799f8a6c29929fc8e85",
      "tree": "2ea952d980f047320f2ad1358117dbb65877cc1d",
      "parents": [
        "d21383fcbb535f90b429279852988d675ed22d67"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Tue Jul 17 12:29:30 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:07:15 2013 -0800"
      },
      "message": "tcp: refine SYN handling in tcp_validate_incoming\n\n[ Upstream commit e371589917011efe6ff8c7dfb4e9e81934ac5855 ]\n\nFollowup of commit 0c24604b68fc (tcp: implement RFC 5961 4.2)\n\nAs reported by Vijay Subramanian, we should send a challenge ACK\ninstead of a dup ack if a SYN flag is set on a packet received out of\nwindow.\n\nThis permits the ratelimiting to work as intended, and to increase\ncorrect SNMP counters.\n\nSuggested-by: Vijay Subramanian \u003csubramanian.vijay@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Vijay Subramanian \u003csubramanian.vijay@gmail.com\u003e\nCc: Kiran Kumar Kella \u003ckkiran@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "d21383fcbb535f90b429279852988d675ed22d67",
      "tree": "7f395982de610bfc355082ae351deb01a19a5060",
      "parents": [
        "34fb350281ced2a72707a5c0064f69992d440edb"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Tue Jul 17 01:41:30 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:07:15 2013 -0800"
      },
      "message": "tcp: implement RFC 5961 4.2\n\n[ Upstream commit 0c24604b68fc7810d429d6c3657b6f148270e528 ]\n\nImplement the RFC 5691 mitigation against Blind\nReset attack using SYN bit.\n\nSection 4.2 of RFC 5961 advises to send a Challenge ACK and drop\nincoming packet, instead of resetting the session.\n\nAdd a new SNMP counter to count number of challenge acks sent\nin response to SYN packets.\n(netstat -s | grep TCPSYNChallenge)\n\nRemove obsolete TCPAbortOnSyn, since we no longer abort a TCP session\nbecause of a SYN flag.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Kiran Kumar Kella \u003ckkiran@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "34fb350281ced2a72707a5c0064f69992d440edb",
      "tree": "91f806c64e65601adf09564a83b4c44f4db080be",
      "parents": [
        "c87b45599a4e0d8741abeb85d1d8d5f0c1fb13be"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Tue Jul 17 10:13:05 2012 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:07:14 2013 -0800"
      },
      "message": "tcp: implement RFC 5961 3.2\n\n[ Upstream commit 282f23c6ee343126156dd41218b22ece96d747e3 ]\n\nImplement the RFC 5691 mitigation against Blind\nReset attack using RST bit.\n\nIdea is to validate incoming RST sequence,\nto match RCV.NXT value, instead of previouly accepted\nwindow : (RCV.NXT \u003c\u003d SEG.SEQ \u003c RCV.NXT+RCV.WND)\n\nIf sequence is in window but not an exact match, send\na \"challenge ACK\", so that the other part can resend an\nRST with the appropriate sequence.\n\nAdd a new sysctl, tcp_challenge_ack_limit, to limit\nnumber of challenge ACK sent per second.\n\nAdd a new SNMP counter to count number of challenge acks sent.\n(netstat -s | grep TCPChallengeACK)\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Kiran Kumar Kella \u003ckkiran@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "c7078c2c5da80e387420795a5a0857b1cd711fc9",
      "tree": "02bb5384d076eac6a05edc3d441db0228abe337f",
      "parents": [
        "d46699a94ddf2dd4d83e986a759b64981b37fc5b"
      ],
      "author": {
        "name": "Stefan Hasko",
        "email": "hasko.stevo@gmail.com",
        "time": "Fri Dec 21 15:04:59 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:07:14 2013 -0800"
      },
      "message": "net: sched: integer overflow fix\n\n[ Upstream commit d2fe85da52e89b8012ffad010ef352a964725d5f ]\n\nFixed integer overflow in function htb_dequeue\n\nSigned-off-by: Stefan Hasko \u003chasko.stevo@gmail.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "d46699a94ddf2dd4d83e986a759b64981b37fc5b",
      "tree": "c2de686ba7429ce5ac341c97ccdf673374c3f1be",
      "parents": [
        "6eec2413cb320bdd0139ba0db3888d27f746ea2b"
      ],
      "author": {
        "name": "Christoph Paasch",
        "email": "christoph.paasch@uclouvain.be",
        "time": "Fri Dec 14 04:07:58 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:07:14 2013 -0800"
      },
      "message": "inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock\n\n[ Upstream commit e337e24d6624e74a558aa69071e112a65f7b5758 ]\n\nIf in either of the above functions inet_csk_route_child_sock() or\n__inet_inherit_port() fails, the newsk will not be freed:\n\nunreferenced object 0xffff88022e8a92c0 (size 1592):\n  comm \"softirq\", pid 0, jiffies 4294946244 (age 726.160s)\n  hex dump (first 32 bytes):\n    0a 01 01 01 0a 01 01 02 00 00 00 00 a7 cc 16 00  ................\n    02 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffff8153d190\u003e] kmemleak_alloc+0x21/0x3e\n    [\u003cffffffff810ab3e7\u003e] kmem_cache_alloc+0xb5/0xc5\n    [\u003cffffffff8149b65b\u003e] sk_prot_alloc.isra.53+0x2b/0xcd\n    [\u003cffffffff8149b784\u003e] sk_clone_lock+0x16/0x21e\n    [\u003cffffffff814d711a\u003e] inet_csk_clone_lock+0x10/0x7b\n    [\u003cffffffff814ebbc3\u003e] tcp_create_openreq_child+0x21/0x481\n    [\u003cffffffff814e8fa5\u003e] tcp_v4_syn_recv_sock+0x3a/0x23b\n    [\u003cffffffff814ec5ba\u003e] tcp_check_req+0x29f/0x416\n    [\u003cffffffff814e8e10\u003e] tcp_v4_do_rcv+0x161/0x2bc\n    [\u003cffffffff814eb917\u003e] tcp_v4_rcv+0x6c9/0x701\n    [\u003cffffffff814cea9f\u003e] ip_local_deliver_finish+0x70/0xc4\n    [\u003cffffffff814cec20\u003e] ip_local_deliver+0x4e/0x7f\n    [\u003cffffffff814ce9f8\u003e] ip_rcv_finish+0x1fc/0x233\n    [\u003cffffffff814cee68\u003e] ip_rcv+0x217/0x267\n    [\u003cffffffff814a7bbe\u003e] __netif_receive_skb+0x49e/0x553\n    [\u003cffffffff814a7cc3\u003e] netif_receive_skb+0x50/0x82\n\nThis happens, because sk_clone_lock initializes sk_refcnt to 2, and thus\na single sock_put() is not enough to free the memory. Additionally, things\nlike xfrm, memcg, cookie_values,... may have been initialized.\nWe have to free them properly.\n\nThis is fixed by forcing a call to tcp_done(), ending up in\ninet_csk_destroy_sock, doing the final sock_put(). tcp_done() is necessary,\nbecause it ends up doing all the cleanup on xfrm, memcg, cookie_values,\nxfrm,...\n\nBefore calling tcp_done, we have to set the socket to SOCK_DEAD, to\nforce it entering inet_csk_destroy_sock. To avoid the warning in\ninet_csk_destroy_sock, inet_num has to be set to 0.\nAs inet_csk_destroy_sock does a dec on orphan_count, we first have to\nincrease it.\n\nCalling tcp_done() allows us to remove the calls to\ntcp_clear_xmit_timer() and tcp_cleanup_congestion_control().\n\nA similar approach is taken for dccp by calling dccp_done().\n\nThis is in the kernel since 093d282321 (tproxy: fix hash locking issue\nwhen using port redirection in __inet_inherit_port()), thus since\nversion \u003e\u003d 2.6.37.\n\nSigned-off-by: Christoph Paasch \u003cchristoph.paasch@uclouvain.be\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "6eec2413cb320bdd0139ba0db3888d27f746ea2b",
      "tree": "10b2a223fa456da36a25132ac2a8a65917476f07",
      "parents": [
        "a9b876220838f045ab3c365f668477771e149c3c"
      ],
      "author": {
        "name": "Akinobu Mita",
        "email": "akinobu.mita@gmail.com",
        "time": "Wed Dec 26 02:32:10 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:07:03 2013 -0800"
      },
      "message": "batman-adv: fix random jitter calculation\n\n[ Upstream commit 143cdd8f33909ff5a153e3f02048738c5964ba26 ]\n\nbatadv_iv_ogm_emit_send_time() attempts to calculates a random integer\nin the range of \u0027orig_interval +- BATADV_JITTER\u0027 by the below lines.\n\n        msecs \u003d atomic_read(\u0026bat_priv-\u003eorig_interval) - BATADV_JITTER;\n        msecs +\u003d (random32() % 2 * BATADV_JITTER);\n\nBut it actually gets \u0027orig_interval\u0027 or \u0027orig_interval - BATADV_JITTER\u0027\nbecause \u0027%\u0027 and \u0027*\u0027 have same precedence and associativity is\nleft-to-right.\n\nThis adds the parentheses at the appropriate position so that it matches\noriginal intension.\n\nSigned-off-by: Akinobu Mita \u003cakinobu.mita@gmail.com\u003e\nAcked-by: Antonio Quartulli \u003cordex@autistici.org\u003e\nCc: Marek Lindner \u003clindner_marek@yahoo.de\u003e\nCc: Simon Wunderlich \u003csiwu@hrz.tu-chemnitz.de\u003e\nCc: Antonio Quartulli \u003cordex@autistici.org\u003e\nCc: b.a.t.m.a.n@lists.open-mesh.org\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: netdev@vger.kernel.org\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "f762136f85f60e7d9e8a0422f078bb187fbfc9f0",
      "tree": "9d986bde672f6ec0a4a090bc5d2a2fca7d6b1d91",
      "parents": [
        "b2aa2e70f9d6d5c4aadccdda5956991e8d1869e8"
      ],
      "author": {
        "name": "Neal Cardwell",
        "email": "ncardwell@google.com",
        "time": "Sun Dec 09 11:09:54 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:06:29 2013 -0800"
      },
      "message": "inet_diag: validate port comparison byte code to prevent unsafe reads\n\n[ Upstream commit 5e1f54201cb481f40a04bc47e1bc8c093a189e23 ]\n\nAdd logic to verify that a port comparison byte code operation\nactually has the second inet_diag_bc_op from which we read the port\nfor such operations.\n\nPreviously the code blindly referenced op[1] without first checking\nwhether a second inet_diag_bc_op struct could fit there. So a\nmalicious user could make the kernel read 4 bytes beyond the end of\nthe bytecode array by claiming to have a whole port comparison byte\ncode (2 inet_diag_bc_op structs) when in fact the bytecode was not\nlong enough to hold both.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "b2aa2e70f9d6d5c4aadccdda5956991e8d1869e8",
      "tree": "51ca0f2c9904ab94cbcabf5d18484daf24fdd0b7",
      "parents": [
        "879fc99ecd078f64849b95c47cf7e28705ac8884"
      ],
      "author": {
        "name": "Neal Cardwell",
        "email": "ncardwell@google.com",
        "time": "Sat Dec 08 19:43:23 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:06:28 2013 -0800"
      },
      "message": "inet_diag: avoid unsafe and nonsensical prefix matches in inet_diag_bc_run()\n\n[ Upstream commit f67caec9068cee426ec23cf9005a1dee2ecad187 ]\n\nAdd logic to check the address family of the user-supplied conditional\nand the address family of the connection entry. We now do not do\nprefix matching of addresses from different address families (AF_INET\nvs AF_INET6), except for the previously existing support for having an\nIPv4 prefix match an IPv4-mapped IPv6 address (which this commit\nmaintains as-is).\n\nThis change is needed for two reasons:\n\n(1) The addresses are different lengths, so comparing a 128-bit IPv6\nprefix match condition to a 32-bit IPv4 connection address can cause\nus to unwittingly walk off the end of the IPv4 address and read\ngarbage or oops.\n\n(2) The IPv4 and IPv6 address spaces are semantically distinct, so a\nsimple bit-wise comparison of the prefixes is not meaningful, and\nwould lead to bogus results (except for the IPv4-mapped IPv6 case,\nwhich this commit maintains).\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "879fc99ecd078f64849b95c47cf7e28705ac8884",
      "tree": "eb570cc6cfc09defa928478ba30d6718e07a8ab3",
      "parents": [
        "457a04b96314023464f8249975b1efb4eef1c925"
      ],
      "author": {
        "name": "Neal Cardwell",
        "email": "ncardwell@google.com",
        "time": "Sat Dec 08 19:43:22 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:06:28 2013 -0800"
      },
      "message": "inet_diag: validate byte code to prevent oops in inet_diag_bc_run()\n\n[ Upstream commit 405c005949e47b6e91359159c24753519ded0c67 ]\n\nAdd logic to validate INET_DIAG_BC_S_COND and INET_DIAG_BC_D_COND\noperations.\n\nPreviously we did not validate the inet_diag_hostcond, address family,\naddress length, and prefix length. So a malicious user could make the\nkernel read beyond the end of the bytecode array by claiming to have a\nwhole inet_diag_hostcond when the bytecode was not long enough to\ncontain a whole inet_diag_hostcond of the given address family. Or\nthey could make the kernel read up to about 27 bytes beyond the end of\na connection address by passing a prefix length that exceeded the\nlength of addresses of the given family.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "457a04b96314023464f8249975b1efb4eef1c925",
      "tree": "62ce6effc1ee518280963821970df01659e3bc29",
      "parents": [
        "1755fd2e38a0541dab207df5d42d92b567695497"
      ],
      "author": {
        "name": "Neal Cardwell",
        "email": "ncardwell@google.com",
        "time": "Sat Dec 08 19:43:21 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:06:28 2013 -0800"
      },
      "message": "inet_diag: fix oops for IPv4 AF_INET6 TCP SYN-RECV state\n\n[ Upstream commit 1c95df85ca49640576de2f0a850925957b547b84 ]\n\nFix inet_diag to be aware of the fact that AF_INET6 TCP connections\ninstantiated for IPv4 traffic and in the SYN-RECV state were actually\ncreated with inet_reqsk_alloc(), instead of inet6_reqsk_alloc(). This\nmeans that for such connections inet6_rsk(req) returns a pointer to a\nrandom spot in memory up to roughly 64KB beyond the end of the\nrequest_sock.\n\nWith this bug, for a server using AF_INET6 TCP sockets and serving\nIPv4 traffic, an inet_diag user like `ss state SYN-RECV` would lead to\ninet_diag_fill_req() causing an oops or the export to user space of 16\nbytes of kernel memory as a garbage IPv6 address, depending on where\nthe garbage inet6_rsk(req) pointed.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "eab34a33cfdda79711f6c66a9f9d7a558238eed8",
      "tree": "09d4e99697f1c9efc2787c2345fd32ebf01f0fa8",
      "parents": [
        "6b015f351d9c8a1800f4e234fbfbcc0198bf0b5f"
      ],
      "author": {
        "name": "Johannes Berg",
        "email": "johannes.berg@intel.com",
        "time": "Sun Dec 09 23:41:06 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:06:28 2013 -0800"
      },
      "message": "ipv4: ip_check_defrag must not modify skb before unsharing\n\n[ Upstream commit 1bf3751ec90cc3174e01f0d701e8449ce163d113 ]\n\nip_check_defrag() might be called from af_packet within the\nRX path where shared SKBs are used, so it must not modify\nthe input SKB before it has unshared it for defragmentation.\nUse skb_copy_bits() to get the IP header and only pull in\neverything later.\n\nThe same is true for the other caller in macvlan as it is\ncalled from dev-\u003erx_handler which can also get a shared SKB.\n\nReported-by: Eric Leblond \u003ceric@regit.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "dff343c7f4dfa5650d5d3a78f58f080ec9f14a25",
      "tree": "3d5b4f30adc719ef3475042cbe2d09b4c818f343",
      "parents": [
        "d0804c62db373041db42aa976edf2b9e5f5ae9ed"
      ],
      "author": {
        "name": "Tommi Rantala",
        "email": "tt.rantala@gmail.com",
        "time": "Thu Nov 22 03:23:16 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:06:27 2013 -0800"
      },
      "message": "sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall\n\n[ Upstream commit 6e51fe7572590d8d86e93b547fab6693d305fd0d ]\n\nConsider the following program, that sets the second argument to the\nsendto() syscall incorrectly:\n\n #include \u003cstring.h\u003e\n #include \u003carpa/inet.h\u003e\n #include \u003csys/socket.h\u003e\n\n int main(void)\n {\n         int fd;\n         struct sockaddr_in sa;\n\n         fd \u003d socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/);\n         if (fd \u003c 0)\n                 return 1;\n\n         memset(\u0026sa, 0, sizeof(sa));\n         sa.sin_family \u003d AF_INET;\n         sa.sin_addr.s_addr \u003d inet_addr(\"127.0.0.1\");\n         sa.sin_port \u003d htons(11111);\n\n         sendto(fd, NULL, 1, 0, (struct sockaddr *)\u0026sa, sizeof(sa));\n\n         return 0;\n }\n\nWe get -ENOMEM:\n\n $ strace -e sendto ./demo\n sendto(3, NULL, 1, 0, {sa_family\u003dAF_INET, sin_port\u003dhtons(11111), sin_addr\u003dinet_addr(\"127.0.0.1\")}, 16) \u003d -1 ENOMEM (Cannot allocate memory)\n\nPropagate the error code from sctp_user_addto_chunk(), so that we will\ntell user space what actually went wrong:\n\n $ strace -e sendto ./demo\n sendto(3, NULL, 1, 0, {sa_family\u003dAF_INET, sin_port\u003dhtons(11111), sin_addr\u003dinet_addr(\"127.0.0.1\")}, 16) \u003d -1 EFAULT (Bad address)\n\nNoticed while running Trinity (the syscall fuzzer).\n\nSigned-off-by: Tommi Rantala \u003ctt.rantala@gmail.com\u003e\nAcked-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "d0804c62db373041db42aa976edf2b9e5f5ae9ed",
      "tree": "6144f8e82a58e3709a2b9e7c7f95e45f1e9d25cb",
      "parents": [
        "1097b6a83df844d5145a1f9821300028857d8ca9"
      ],
      "author": {
        "name": "Tommi Rantala",
        "email": "tt.rantala@gmail.com",
        "time": "Tue Nov 27 04:01:46 2012 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Jan 11 09:06:27 2013 -0800"
      },
      "message": "sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails\n\n[ Upstream commit be364c8c0f17a3dd42707b5a090b318028538eb9 ]\n\nTrinity (the syscall fuzzer) discovered a memory leak in SCTP,\nreproducible e.g. with the sendto() syscall by passing invalid\nuser space pointer in the second argument:\n\n #include \u003cstring.h\u003e\n #include \u003carpa/inet.h\u003e\n #include \u003csys/socket.h\u003e\n\n int main(void)\n {\n         int fd;\n         struct sockaddr_in sa;\n\n         fd \u003d socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/);\n         if (fd \u003c 0)\n                 return 1;\n\n         memset(\u0026sa, 0, sizeof(sa));\n         sa.sin_family \u003d AF_INET;\n         sa.sin_addr.s_addr \u003d inet_addr(\"127.0.0.1\");\n         sa.sin_port \u003d htons(11111);\n\n         sendto(fd, NULL, 1, 0, (struct sockaddr *)\u0026sa, sizeof(sa));\n\n         return 0;\n }\n\nAs far as I can tell, the leak has been around since ~2003.\n\nSigned-off-by: Tommi Rantala \u003ctt.rantala@gmail.com\u003e\nAcked-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "47abf714aab1e2f5c293f54a3bd3f0ef7534c38e",
      "tree": "4191867335b51780b7d380664b8ee4946d5d04a2",
      "parents": [
        "b127f3f930bbeedc3b10b150a4f43a6abeb75836"
      ],
      "author": {
        "name": "Thierry Escande",
        "email": "thierry.escande@linux.intel.com",
        "time": "Fri Oct 12 15:25:43 2012 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Dec 03 11:47:12 2012 -0800"
      },
      "message": "NFC: Fix nfc_llcp_local chained list insertion\n\ncommit 16a78e9fed5e8baa8480ae3413f4328c4537c599 upstream.\n\nlist_add was called with swapped parameters\n\nSigned-off-by: Thierry Escande \u003cthierry.escande@linux.intel.com\u003e\nSigned-off-by: Samuel Ortiz \u003csameo@linux.intel.com\u003e\nSigned-off-by: Peter Huewe \u003cpeterhuewe@gmx.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "c9fa3f41a91e5c279968e5c9962b578aca003c98",
      "tree": "25e582885cd27b3e14e6601c7e9c4c5152b25d05",
      "parents": [
        "5e937c8ffe7d6ba56a699684a4bc5f6b3edd05a5"
      ],
      "author": {
        "name": "Oliver Hartkopp",
        "email": "socketcan@hartkopp.net",
        "time": "Mon Nov 26 22:24:23 2012 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Dec 03 11:47:10 2012 -0800"
      },
      "message": "can: bcm: initialize ifindex for timeouts without previous frame reception\n\ncommit 81b401100c01d2357031e874689f89bd788d13cd upstream.\n\nSet in the rx_ifindex to pass the correct interface index in the case of a\nmessage timeout detection. Usually the rx_ifindex value is set at receive\ntime. But when no CAN frame has been received the RX_TIMEOUT notification\ndid not contain a valid value.\n\nReported-by: Andre Naujoks \u003cnautsch2@googlemail.com\u003e\nSigned-off-by: Oliver Hartkopp \u003csocketcan@hartkopp.net\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "e41cd8f166f6b9a0767dce3cbce65d1f4941b8ba",
      "tree": "4c749c7fcad63ea49b325110df2462cf908d4839",
      "parents": [
        "fceca5e72e787dd0a8ea29e22a874e363389356c"
      ],
      "author": {
        "name": "Simon Wunderlich",
        "email": "simon.wunderlich@s2003.tu-chemnitz.de",
        "time": "Tue Nov 13 18:43:03 2012 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Dec 03 11:47:08 2012 -0800"
      },
      "message": "mac80211: deinitialize ibss-internals after emptiness check\n\ncommit b78a4932f5fb11fadf41e69c606a33fa6787574c upstream.\n\nThe check whether the IBSS is active and can be removed should be\nperformed before deinitializing the fields used for the check/search.\nOtherwise, the configured BSS will not be found and removed properly.\n\nTo make it more clear for the future, rename sdata-\u003eu.ibss to the\nlocal pointer ifibss which is used within the checks.\n\nThis behaviour was introduced by\nf3209bea110cade12e2b133da8b8499689cb0e2e\n(\"mac80211: fix IBSS teardown race\")\n\nSigned-off-by: Simon Wunderlich \u003csiwu@hrz.tu-chemnitz.de\u003e\nCc: Ignacy Gawedzki \u003ci@lri.fr\u003e\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "2214cc8d585df2bbfc894d0a3acc5a629fa1a985",
      "tree": "0c790c1d026a518096bbf8df282845e1678811c1",
      "parents": [
        "4f442c50be050521667a8974fcc80cc8b881b2a6"
      ],
      "author": {
        "name": "Szymon Janc",
        "email": "szymon.janc@tieto.com",
        "time": "Fri Jun 08 11:33:33 2012 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Dec 03 11:46:36 2012 -0800"
      },
      "message": "Bluetooth: Fix using uninitialized option in RFCMode\n\ncommit 8f321f853ea33330c7141977cd34804476e2e07e upstream.\n\nIf remote device sends bogus RFC option with invalid length,\nundefined options values are used. Fix this by using defaults when\nremote misbehaves.\n\nThis also fixes the following warning reported by gcc 4.7.0:\n\nnet/bluetooth/l2cap_core.c: In function \u0027l2cap_config_rsp\u0027:\nnet/bluetooth/l2cap_core.c:3302:13: warning: \u0027rfc.max_pdu_size\u0027 may be used uninitialized in this function [-Wmaybe-uninitialized]\nnet/bluetooth/l2cap_core.c:3266:24: note: \u0027rfc.max_pdu_size\u0027 was declared here\nnet/bluetooth/l2cap_core.c:3298:25: warning: \u0027rfc.monitor_timeout\u0027 may be used uninitialized in this function [-Wmaybe-uninitialized]\nnet/bluetooth/l2cap_core.c:3266:24: note: \u0027rfc.monitor_timeout\u0027 was declared here\nnet/bluetooth/l2cap_core.c:3297:25: warning: \u0027rfc.retrans_timeout\u0027 may be used uninitialized in this function [-Wmaybe-uninitialized]\nnet/bluetooth/l2cap_core.c:3266:24: note: \u0027rfc.retrans_timeout\u0027 was declared here\nnet/bluetooth/l2cap_core.c:3295:2: warning: \u0027rfc.mode\u0027 may be used uninitialized in this function [-Wmaybe-uninitialized]\nnet/bluetooth/l2cap_core.c:3266:24: note: \u0027rfc.mode\u0027 was declared here\n\nSigned-off-by: Szymon Janc \u003cszymon.janc@tieto.com\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "dfae3b3451c6da14df1fa62d76c8a4345d21bdb2",
      "tree": "d674f1e1998b9ae902ab74f235e1bd39d31525d4",
      "parents": [
        "73bba6fc44591587254fec8e867a99b5a2a28ba7"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Mon Sep 24 20:59:48 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:44 2012 -0800"
      },
      "message": "libceph: check for invalid mapping\n\n(cherry picked from commit d63b77f4c552cc3a20506871046ab0fcbc332609)\n\nIf we encounter an invalid (e.g., zeroed) mapping, return an error\nand avoid a divide by zero.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "631015e45ee3bdcde1fe75e7d04fdfece6e42016",
      "tree": "14b91e053f35fe5a15eae14d61107d72d572dae1",
      "parents": [
        "a872024581f2e73edbea6eece56361ce508ea881"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Wed Oct 24 16:12:58 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:43 2012 -0800"
      },
      "message": "libceph: avoid NULL kref_put when osd reset races with alloc_msg\n\n(cherry picked from commit 9bd952615a42d7e2ce3fa2c632e808e804637a1a)\n\nThe ceph_on_in_msg_alloc() method drops con-\u003emutex while it allocates a\nmessage.  If that races with a timeout that resends a zillion messages and\nresets the connection, and the -\u003ealloc_msg() method returns a NULL message,\nit will call ceph_msg_put(NULL) and BUG.\n\nFix by only calling put if msg is non-NULL.\n\nFixes http://tracker.newdream.net/issues/3142\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "a872024581f2e73edbea6eece56361ce508ea881",
      "tree": "187dfd29a02badb7576b932ca6ed83e45acea20d",
      "parents": [
        "21e292e34c48c03fb6638c2d1295ca12dac97b03"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Mon Oct 08 20:37:30 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:43 2012 -0800"
      },
      "message": "rbd: reset BACKOFF if unable to re-queue\n\n(cherry picked from commit 588377d6199034c36d335e7df5818b731fea072c)\n\nIf ceph_fault() is unable to queue work after a delay, it sets the\nBACKOFF connection flag so con_work() will attempt to do so.\n\nIn con_work(), when BACKOFF is set, if queue_delayed_work() doesn\u0027t\nresult in newly-queued work, it simply ignores this condition and\nproceeds as if no backoff delay were desired.  There are two\nproblems with this--one of which is a bug.\n\nThe first problem is simply that the intended behavior is to back\noff, and if we aren\u0027t able queue the work item to run after a delay\nwe\u0027re not doing that.\n\nThe only reason queue_delayed_work() won\u0027t queue work is if the\nprovided work item is already queued.  In the messenger, this\nmeans that con_work() is already scheduled to be run again.  So\nif we simply set the BACKOFF flag again when this occurs, we know\nthe next con_work() call will again attempt to hold off activity\non the connection until after the delay.\n\nThe second problem--the bug--is a leak of a reference count.  If\nqueue_delayed_work() returns 0 in con_work(), con-\u003eops-\u003eput() drops\nthe connection reference held on entry to con_work().  However,\nprocessing is (was) allowed to continue, and at the end of the\nfunction a second con-\u003eops-\u003eput() is called.\n\nThis patch fixes both problems.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "21e292e34c48c03fb6638c2d1295ca12dac97b03",
      "tree": "ba7de4f8fdac94c211b946544cd6a35cf9bd74e0",
      "parents": [
        "76cb69279f83889cf98fd9f16f5d50bcc2779442"
      ],
      "author": {
        "name": "Alex Elder",
        "email": "elder@inktank.com",
        "time": "Fri Sep 21 17:59:58 2012 -0500"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:43 2012 -0800"
      },
      "message": "libceph: only kunmap kmapped pages\n\n(cherry picked from commit 5ce765a540f34d1e2005e1210f49f67fdf11e997)\n\nIn write_partial_msg_pages(), pages need to be kmapped in order to\nperform a CRC-32c calculation on them.  As an artifact of the way\nthis code used to be structured, the kunmap() call was separated\nfrom the kmap() call and both were done conditionally.  But the\nconditions under which the kmap() and kunmap() calls were made\ndiffered, so there was a chance a kunmap() call would be done on a\npage that had not been mapped.\n\nThe symptom of this was tripping a BUG() in kunmap_high() when\npkmap_count[nr] became 0.\n\nReported-by: Bryan K. Wright \u003cbryan@virginia.edu\u003e\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "76cb69279f83889cf98fd9f16f5d50bcc2779442",
      "tree": "06e827efbfa9ad7ad36b3962b7dfac7c507ecbcd",
      "parents": [
        "523693067608f067bcbe94f23a4feb4dfcfa2db8"
      ],
      "author": {
        "name": "Jim Schutt",
        "email": "jaschut@sandia.gov",
        "time": "Fri Aug 10 10:37:38 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:43 2012 -0800"
      },
      "message": "libceph: avoid truncation due to racing banners\n\n(cherry picked from commit 6d4221b53707486dfad3f5bfe568d2ce7f4c9863)\n\nBecause the Ceph client messenger uses a non-blocking connect, it is\npossible for the sending of the client banner to race with the\narrival of the banner sent by the peer.\n\nWhen ceph_sock_state_change() notices the connect has completed, it\nschedules work to process the socket via con_work().  During this\ntime the peer is writing its banner, and arrival of the peer banner\nraces with con_work().\n\nIf con_work() calls try_read() before the peer banner arrives, there\nis nothing for it to do, after which con_work() calls try_write() to\nsend the client\u0027s banner.  In this case Ceph\u0027s protocol negotiation\ncan complete succesfully.\n\nThe server-side messenger immediately sends its banner and addresses\nafter accepting a connect request, *before* actually attempting to\nread or verify the banner from the client.  As a result, it is\npossible for the banner from the server to arrive before con_work()\ncalls try_read().  If that happens, try_read() will read the banner\nand prepare protocol negotiation info via prepare_write_connect().\nprepare_write_connect() calls con_out_kvec_reset(), which discards\nthe as-yet-unsent client banner.  Next, con_work() calls\ntry_write(), which sends the protocol negotiation info rather than\nthe banner that the peer is expecting.\n\nThe result is that the peer sees an invalid banner, and the client\nreports \"negotiation failed\".\n\nFix this by moving con_out_kvec_reset() out of\nprepare_write_connect() to its callers at all locations except the\none where the banner might still need to be sent.\n\n[elder@inktak.com: added note about server-side behavior]\n\nSigned-off-by: Jim Schutt \u003cjaschut@sandia.gov\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "523693067608f067bcbe94f23a4feb4dfcfa2db8",
      "tree": "c32daf4e0d6f08870763c8773d597e489985a76f",
      "parents": [
        "b8e03e320f9156e870f8cc66b0d9fca9f24d36c8"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Sun Aug 19 12:29:16 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:43 2012 -0800"
      },
      "message": "libceph: delay debugfs initialization until we learn global_id\n\n(cherry picked from commit d1c338a509cea5378df59629ad47382810c38623)\n\nThe debugfs directory includes the cluster fsid and our unique global_id.\nWe need to delay the initialization of the debug entry until we have\nlearned both the fsid and our global_id from the monitor or else the\nsecond client can\u0027t create its debugfs entry and will fail (and multiple\nclient instances aren\u0027t properly reflected in debugfs).\n\nReported by: Yan, Zheng \u003czheng.z.yan@intel.com\u003e\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Yehuda Sadeh \u003cyehuda@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "b8e03e320f9156e870f8cc66b0d9fca9f24d36c8",
      "tree": "230886a24e185f2f8e2120f05456c823d47c62f9",
      "parents": [
        "59238927cc8ea6c1e4a8a1136e17598648832db0"
      ],
      "author": {
        "name": "Sylvain Munaut",
        "email": "tnt@246tNt.com",
        "time": "Thu Aug 02 09:12:59 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:42 2012 -0800"
      },
      "message": "libceph: fix crypto key null deref, memory leak\n\n(cherry picked from commit f0666b1ac875ff32fe290219b150ec62eebbe10e)\n\nAvoid crashing if the crypto key payload was NULL, as when it was not correctly\nallocated and initialized.  Also, avoid leaking it.\n\nSigned-off-by: Sylvain Munaut \u003ctnt@246tNt.com\u003e\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "59238927cc8ea6c1e4a8a1136e17598648832db0",
      "tree": "b2039951363d52164113f84a84823be816758e18",
      "parents": [
        "7389a76f02bf56340f26fa933b9fc6a1dece9148"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Mon Jul 30 18:19:45 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:42 2012 -0800"
      },
      "message": "libceph: recheck con state after allocating incoming message\n\n(cherry picked from commit 6139919133377652992a5fe134e22abce3e9c25e)\n\nWe drop the lock when calling the -\u003ealloc_msg() con op, which means\nwe need to (a) not clobber con-\u003ein_msg without the mutex held, and (b)\nwe need to verify that we are still in the OPEN state when we retake\nit to avoid causing any mayhem.  If the state does change, -EAGAIN\nwill get us back to con_work() and loop.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "7389a76f02bf56340f26fa933b9fc6a1dece9148",
      "tree": "0c4fbaaf31b0e51b8f1e745a92c23980b1309a31",
      "parents": [
        "328677c24bbae17f3f91ffce3b2351a27933741c"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Mon Jul 30 18:19:30 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:42 2012 -0800"
      },
      "message": "libceph: change ceph_con_in_msg_alloc convention to be less weird\n\n(cherry picked from commit 4740a623d20c51d167da7f752b63e2b8714b2543)\n\nThis function\u0027s calling convention is very limiting.  In particular,\nwe can\u0027t return any error other than ENOMEM (and only implicitly),\nwhich is a problem (see next patch).\n\nInstead, return an normal 0 or error code, and make the skip a pointer\noutput parameter.  Drop the useless in_hdr argument (we have the con\npointer).\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "328677c24bbae17f3f91ffce3b2351a27933741c",
      "tree": "1260cfe3b6af6134d91a342c419206fb9cff3249",
      "parents": [
        "900fbd910f53a417a6b0859bd2cde7ae48ac4bb2"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Mon Jul 30 18:17:13 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:42 2012 -0800"
      },
      "message": "libceph: avoid dropping con mutex before fault\n\n(cherry picked from commit 8636ea672f0c5ab7478c42c5b6705ebd1db7eb6a)\n\nThe ceph_fault() function takes the con mutex, so we should avoid\ndropping it before calling it.  This fixes a potential race with\nanother thread calling ceph_con_close(), or _open(), or similar (we\ndon\u0027t reverify con-\u003estate after retaking the lock).\n\nAdd annotation so that lockdep realizes we will drop the mutex before\nreturning.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "900fbd910f53a417a6b0859bd2cde7ae48ac4bb2",
      "tree": "eed8fb8ac93d796b0e8b58c96be9d2fcac65d8ea",
      "parents": [
        "da75ae3c0d4c40587fa7583952b98072d811a7d2"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Mon Jul 30 18:16:56 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:42 2012 -0800"
      },
      "message": "libceph: verify state after retaking con lock after dispatch\n\n(cherry picked from commit 7b862e07b1a4d5c963d19027f10ea78085f27f9b)\n\nWe drop the con mutex when delivering a message.  When we retake the\nlock, we need to verify we are still in the OPEN state before\npreparing to read the next tag, or else we risk stepping on a\nconnection that has been closed.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "da75ae3c0d4c40587fa7583952b98072d811a7d2",
      "tree": "e385de76be9881ae001899c7615b2f360e5ca5ee",
      "parents": [
        "6cdaef1be27bc05ab4197b3ab4e3ee1d326cf04c"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Mon Jul 30 18:16:40 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:42 2012 -0800"
      },
      "message": "libceph: revoke mon_client messages on session restart\n\n(cherry picked from commit 4f471e4a9c7db0256834e1b376ea50c82e345c3c)\n\nRevoke all mon_client messages when we shut down the old connection.\nThis is mostly moot since we are re-using the same ceph_connection,\nbut it is cleaner.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "6cdaef1be27bc05ab4197b3ab4e3ee1d326cf04c",
      "tree": "275f9277dbf50f31e26e37122cb11244797e3fa3",
      "parents": [
        "8992551d85934e0dc4683068612758831d1d4899"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Mon Jul 30 18:16:16 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:41 2012 -0800"
      },
      "message": "libceph: fix handling of immediate socket connect failure\n\n(cherry picked from commit 8007b8d626b49c34fb146ec16dc639d8b10c862f)\n\nIf the connect() call immediately fails such that sock \u003d\u003d NULL, we\nstill need con_close_socket() to reset our socket state to CLOSED.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "8992551d85934e0dc4683068612758831d1d4899",
      "tree": "6062a1b0e92bbc7ac8268a3e494e23536ed096d1",
      "parents": [
        "63c1362476141f4fb340e8236d41674be9fc1983"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Fri Jul 20 17:30:40 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:41 2012 -0800"
      },
      "message": "libceph: clear all flags on con_close\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\n(cherry picked from commit 43c7427d100769451601b8a36988ac0528ce0124)\n"
    },
    {
      "commit": "63c1362476141f4fb340e8236d41674be9fc1983",
      "tree": "13be911ab412f8e02ec6cdfa2688bc5b4296c0a2",
      "parents": [
        "265fb7c177f9db75d628b3479b6223c1c8110e67"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Fri Jul 20 17:29:55 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:41 2012 -0800"
      },
      "message": "libceph: clean up con flags\n\n(cherry picked from commit 4a8616920860920abaa51193146fe36b38ef09aa)\n\nRename flags with CON_FLAG prefix, move the definitions into the c file,\nand (better) document their meaning.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "265fb7c177f9db75d628b3479b6223c1c8110e67",
      "tree": "85f85c837e89f7d09041a26bb60a5b35495afc93",
      "parents": [
        "cb9f8855591613dff0909c99d46a29e10eb39b25"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Fri Jul 20 17:24:40 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:41 2012 -0800"
      },
      "message": "libceph: replace connection state bits with states\n\n(cherry picked from commit 8dacc7da69a491c515851e68de6036f21b5663ce)\n\nUse a simple set of 6 enumerated values for the socket states (CON_STATE_*)\nand use those instead of the state bits.  All of the con-\u003estate checks are\nnow under the protection of the con mutex, so this is safe.  It also\nsimplifies many of the state checks because we can check for anything other\nthan the expected state instead of various bits for races we can think of.\n\nThis appears to hold up well to stress testing both with and without socket\nfailure injection on the server side.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "cb9f8855591613dff0909c99d46a29e10eb39b25",
      "tree": "b9ecd8498d938908b7faf945fd5ecde58621cbff",
      "parents": [
        "3b5a9ead0b4845aaa7e80fcd6166f2c6740a1c6f"
      ],
      "author": {
        "name": "Sage Weil",
        "email": "sage@inktank.com",
        "time": "Fri Jul 20 17:19:43 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Nov 26 11:38:41 2012 -0800"
      },
      "message": "libceph: drop unnecessary CLOSED check in socket state change callback\n\n(cherry picked from commit d7353dd5aaf22ed611fbcd0d4a4a12fb30659290)\n\n\nIf we are CLOSED, the socket is closed and we won\u0027t get these.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    }
  ],
  "next": "3b5a9ead0b4845aaa7e80fcd6166f2c6740a1c6f"
}