)]}' { "log": [ { "commit": "d720ee298ff7ef1495e6f39cd751dd4bab1be85d", "tree": "47f3b26fe64f75e6e713369cc8fee234840634ef", "parents": [ "f72299da3e1a010a3d77fbed0b9ee6abd0a19911" ], "author": { "name": "Hannes Frederic Sowa", "email": "hannes@stressinduktion.org", "time": "Sat Sep 21 06:27:00 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:48 2013 -0700" }, "message": "ipv6: udp packets following an UFO enqueued packet need also be handled by UFO\n\n[ Upstream commit 2811ebac2521ceac84f2bdae402455baa6a7fb47 ]\n\nIn the following scenario the socket is corked:\nIf the first UDP packet is larger then the mtu we try to append it to the\nwrite queue via ip6_ufo_append_data. A following packet, which is smaller\nthan the mtu would be appended to the already queued up gso-skb via\nplain ip6_append_data. This causes random memory corruptions.\n\nIn ip6_ufo_append_data we also have to be careful to not queue up the\nsame skb multiple times. So setup the gso frame only when no first skb\nis available.\n\nThis also fixes a shortcoming where we add the current packet\u0027s length to\ncork-\u003elength but return early because of a packet \u003e mtu with dontfrag set\n(instead of sutracting it again).\n\nFound with trinity.\n\nCc: YOSHIFUJI Hideaki \u003cyoshfuji@linux-ipv6.org\u003e\nSigned-off-by: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f72299da3e1a010a3d77fbed0b9ee6abd0a19911", "tree": "7ea60bcfbe30a8b48fe9e3a5d2af5c08d2f115a9", "parents": [ "832ae42a43dd7ea2a39d7cc0687363d0039da850" ], "author": { "name": "Ansis Atteka", "email": "aatteka@nicira.com", "time": "Wed Sep 18 15:29:53 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:48 2013 -0700" }, "message": "ip: generate unique IP identificator if local fragmentation is allowed\n\n[ Upstream commit 703133de331a7a7df47f31fb9de51dc6f68a9de8 ]\n\nIf local fragmentation is allowed, then ip_select_ident() and\nip_select_ident_more() need to generate unique IDs to ensure\ncorrect defragmentation on the peer.\n\nFor example, if IPsec (tunnel mode) has to encrypt large skbs\nthat have local_df bit set, then all IP fragments that belonged\nto different ESP datagrams would have used the same identificator.\nIf one of these IP fragments would get lost or reordered, then\npeer could possibly stitch together wrong IP fragments that did\nnot belong to the same datagram. This would lead to a packet loss\nor data corruption.\n\nSigned-off-by: Ansis Atteka \u003caatteka@nicira.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "832ae42a43dd7ea2a39d7cc0687363d0039da850", "tree": "840afb1d004cfe470723a78da32fb26f9522285a", "parents": [ "3c5bd142cbe6ca27b0e55451a4c37c703bc6ff66" ], "author": { "name": "Ansis Atteka", "email": "aatteka@nicira.com", "time": "Wed Sep 18 15:29:52 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:47 2013 -0700" }, "message": "ip: use ip_hdr() in __ip_make_skb() to retrieve IP header\n\n[ Upstream commit 749154aa56b57652a282cbde57a57abc278d1205 ]\n\nskb-\u003edata already points to IP header, but for the sake of\nconsistency we can also use ip_hdr() to retrieve it.\n\nSigned-off-by: Ansis Atteka \u003caatteka@nicira.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3c5bd142cbe6ca27b0e55451a4c37c703bc6ff66", "tree": "34681993d7ac2ebce7ddf91216e23529fa4a1d4a", "parents": [ "12021622d44d200b0b7582bb7b9d31c2c36a9852" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Thu Sep 12 17:12:05 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:47 2013 -0700" }, "message": "bridge: Clamp forward_delay when enabling STP\n\n[ Upstream commit be4f154d5ef0ca147ab6bcd38857a774133f5450 ]\n\nAt some point limits were added to forward_delay. However, the\nlimits are only enforced when STP is enabled. This created a\nscenario where you could have a value outside the allowed range\nwhile STP is disabled, which then stuck around even after STP\nis enabled.\n\nThis patch fixes this by clamping the value when we enable STP.\n\nI had to move the locking around a bit to ensure that there is\nno window where someone could insert a value outside the range\nwhile we\u0027re in the middle of enabling STP.\n\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "12021622d44d200b0b7582bb7b9d31c2c36a9852", "tree": "40a1033d82bc3c58f2099b170a1afb34dd4d0bf9", "parents": [ "9dea496eb4b44b347fcf3667e98c70784b07fceb" ], "author": { "name": "Chris Healy", "email": "cphealy@gmail.com", "time": "Wed Sep 11 21:37:47 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:47 2013 -0700" }, "message": "resubmit bridge: fix message_age_timer calculation\n\n[ Upstream commit 9a0620133ccce9dd35c00a96405c8d80938c2cc0 ]\n\nThis changes the message_age_timer calculation to use the BPDU\u0027s max age as\nopposed to the local bridge\u0027s max age. This is in accordance with section\n8.6.2.3.2 Step 2 of the 802.1D-1998 sprecification.\n\nWith the current implementation, when running with very large bridge\ndiameters, convergance will not always occur even if a root bridge is\nconfigured to have a longer max age.\n\nTested successfully on bridge diameters of ~200.\n\nSigned-off-by: Chris Healy \u003ccphealy@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9dea496eb4b44b347fcf3667e98c70784b07fceb", "tree": "7577e253a14b24413809e94d672ab749db1cbdd7", "parents": [ "a8e02b78193d24a73ccedfed64a0d8f5486b7c3c" ], "author": { "name": "Daniel Borkmann", "email": "dborkman@redhat.com", "time": "Wed Sep 11 16:58:36 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:47 2013 -0700" }, "message": "net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit\n\n[ Upstream commit 95ee62083cb6453e056562d91f597552021e6ae7 ]\n\nAlan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not\nbeing encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport\ndoes not seem to have the desired effect:\n\nSCTP + IPv4:\n\n 22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116)\n 192.168.0.2 \u003e 192.168.0.5: AH(spi\u003d0x00000042,sumlen\u003d16,seq\u003d0x1): ESP(spi\u003d0x00000044,seq\u003d0x1), length 72\n 22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340)\n 192.168.0.5 \u003e 192.168.0.2: AH(spi\u003d0x00000043,sumlen\u003d16,seq\u003d0x1):\n\nSCTP + IPv6:\n\n 22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364)\n fe80::222:15ff:fe87:7fc.3333 \u003e fe80::92e6:baff:fe0d:5a54.36767: sctp\n 1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]\n\nMoreover, Alan says:\n\n This problem was seen with both Racoon and Racoon2. Other people have seen\n this with OpenSwan. When IPsec is configured to encrypt all upper layer\n protocols the SCTP connection does not initialize. After using Wireshark to\n follow packets, this is because the SCTP packet leaves Box A unencrypted and\n Box B believes all upper layer protocols are to be encrypted so it drops\n this packet, causing the SCTP connection to fail to initialize. When IPsec\n is configured to encrypt just SCTP, the SCTP packets are observed unencrypted.\n\nIn fact, using `socat sctp6-listen:3333 -` on one end and transferring \"plaintext\"\nstring on the other end, results in cleartext on the wire where SCTP eventually\ndoes not report any errors, thus in the latter case that Alan reports, the\nnon-paranoid user might think he\u0027s communicating over an encrypted transport on\nSCTP although he\u0027s not (tcpdump ... -X):\n\n ...\n 0x0030: 5d70 8e1a 0003 001a 177d eb6c 0000 0000 ]p.......}.l....\n 0x0040: 0000 0000 706c 6169 6e74 6578 740a 0000 ....plaintext...\n\nOnly in /proc/net/xfrm_stat we can see XfrmInTmplMismatch increasing on the\nreceiver side. Initial follow-up analysis from Alan\u0027s bug report was done by\nAlexey Dobriyan. Also thanks to Vlad Yasevich for feedback on this.\n\nSCTP has its own implementation of sctp_v6_xmit() not calling inet6_csk_xmit().\nThis has the implication that it probably never really got updated along with\nchanges in inet6_csk_xmit() and therefore does not seem to invoke xfrm handlers.\n\nSCTP\u0027s IPv4 xmit however, properly calls ip_queue_xmit() to do the work. Since\na call to inet6_csk_xmit() would solve this problem, but result in unecessary\nroute lookups, let us just use the cached flowi6 instead that we got through\nsctp_v6_get_dst(). Since all SCTP packets are being sent through sctp_packet_transmit(),\nwe do the route lookup / flow caching in sctp_transport_route(), hold it in\ntp-\u003edst and skb_dst_set() right after that. If we would alter fl6-\u003edaddr in\nsctp_v6_xmit() to np-\u003eopt-\u003esrcrt, we possibly could run into the same effect\nof not having xfrm layer pick it up, hence, use fl6_update_dst() in sctp_v6_get_dst()\ninstead to get the correct source routed dst entry, which we assign to the skb.\n\nAlso source address routing example from 625034113 (\"sctp: fix sctp to work with\nipv6 source address routing\") still works with this patch! Nevertheless, in RFC5095\nit is actually \u0027recommended\u0027 to not use that anyway due to traffic amplification [1].\nSo it seems we\u0027re not supposed to do that anyway in sctp_v6_xmit(). Moreover, if\nwe overwrite the flow destination here, the lower IPv6 layer will be unable to\nput the correct destination address into IP header, as routing header is added in\nipv6_push_nfrag_opts() but then probably with wrong final destination. Things aside,\nresult of this patch is that we do not have any XfrmInTmplMismatch increase plus on\nthe wire with this patch it now looks like:\n\nSCTP + IPv6:\n\n 08:17:47.074080 IP6 2620:52:0:102f:7a2b:cbff:fe27:1b0a \u003e 2620:52:0:102f:213:72ff:fe32:7eba:\n AH(spi\u003d0x00005fb4,seq\u003d0x1): ESP(spi\u003d0x00005fb5,seq\u003d0x1), length 72\n 08:17:47.074264 IP6 2620:52:0:102f:213:72ff:fe32:7eba \u003e 2620:52:0:102f:7a2b:cbff:fe27:1b0a:\n AH(spi\u003d0x00003d54,seq\u003d0x1): ESP(spi\u003d0x00003d55,seq\u003d0x1), length 296\n\nThis fixes Kernel Bugzilla 24412. This security issue seems to be present since\n2.6.18 kernels. Lets just hope some big passive adversary in the wild didn\u0027t have\nits fun with that. lksctp-tools IPv6 regression test suite passes as well with\nthis patch.\n\n [1] http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf\n\nReported-by: Alan Chester \u003calan.chester@tekelec.com\u003e\nReported-by: Alexey Dobriyan \u003cadobriyan@gmail.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nCc: Hannes Frederic Sowa \u003channes@stressinduktion.org\u003e\nAcked-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a8e02b78193d24a73ccedfed64a0d8f5486b7c3c", "tree": "a3be9ef5e280d822cf87b526207660fab0e69508", "parents": [ "a4942e9911a439060c744705178b766cf3ebe51e" ], "author": { "name": "Nikolay Aleksandrov", "email": "nikolay@redhat.com", "time": "Thu Sep 19 15:02:35 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:47 2013 -0700" }, "message": "netpoll: fix NULL pointer dereference in netpoll_cleanup\n\n[ Upstream commit d0fe8c888b1fd1a2f84b9962cabcb98a70988aec ]\n\nI\u0027ve been hitting a NULL ptr deref while using netconsole because the\nnp-\u003edev check and the pointer manipulation in netpoll_cleanup are done\nwithout rtnl and the following sequence happens when having a netconsole\nover a vlan and we remove the vlan while disabling the netconsole:\n\tCPU 1\t\t\t\t\tCPU2\n\t\t\t\t\tremoves vlan and calls the notifier\nenters store_enabled(), calls\nnetdev_cleanup which checks np-\u003edev\nand then waits for rtnl\n\t\t\t\t\texecutes the netconsole netdev\n\t\t\t\t\trelease notifier making np-\u003edev\n\t\t\t\t\t\u003d\u003d NULL and releases rtnl\ncontinues to dereference a member of\nnp-\u003edev which at this point is \u003d\u003d NULL\n\nSigned-off-by: Nikolay Aleksandrov \u003cnikolay@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a4942e9911a439060c744705178b766cf3ebe51e", "tree": "756b93b477db7ca9b8033af3c4b15ce5067f1856", "parents": [ "835e0aace5b4d85b79e82b80da8da3ea14c4c419" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 26 08:44:06 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:47 2013 -0700" }, "message": "net: flow_dissector: fix thoff for IPPROTO_AH\n\n[ Upstream commit b86783587b3d1d552326d955acee37eac48800f1 ]\n\nIn commit 8ed781668dd49 (\"flow_keys: include thoff into flow_keys for\nlater usage\"), we missed that existing code was using nhoff as a\ntemporary variable that could not always contain transport header\noffset.\n\nThis is not a problem for TCP/UDP because port offset (@poff)\nis 0 for these protocols.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nCc: Nikolay Aleksandrov \u003cnikolay@redhat.com\u003e\nAcked-by: Nikolay Aleksandrov \u003cnikolay@redhat.com\u003e\nAcked-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "835e0aace5b4d85b79e82b80da8da3ea14c4c419", "tree": "dc432f22f13716cf58244f85bd8a6b2e3fb179d3", "parents": [ "8e307e20b3d7b4fc8af7a84762a7653dad486822" ], "author": { "name": "Daniel Borkmann", "email": "dborkman@redhat.com", "time": "Sat Sep 07 20:51:21 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:47 2013 -0700" }, "message": "net: sctp: fix smatch warning in sctp_send_asconf_del_ip\n\n[ Upstream commit 88362ad8f9a6cea787420b57cc27ccacef000dbe ]\n\nThis was originally reported in [1] and posted by Neil Horman [2], he said:\n\n Fix up a missed null pointer check in the asconf code. If we don\u0027t find\n a local address, but we pass in an address length of more than 1, we may\n dereference a NULL laddr pointer. Currently this can\u0027t happen, as the only\n users of the function pass in the value 1 as the addrcnt parameter, but\n its not hot path, and it doesn\u0027t hurt to check for NULL should that ever\n be the case.\n\nThe callpath from sctp_asconf_mgmt() looks okay. But this could be triggered\nfrom sctp_setsockopt_bindx() call with SCTP_BINDX_REM_ADDR and addrcnt \u003e 1\nwhile passing all possible addresses from the bind list to SCTP_BINDX_REM_ADDR\nso that we do *not* find a single address in the association\u0027s bind address\nlist that is not in the packed array of addresses. If this happens when we\nhave an established association with ASCONF-capable peers, then we could get\na NULL pointer dereference as we only check for laddr \u003d\u003d NULL \u0026\u0026 addrcnt \u003d\u003d 1\nand call later sctp_make_asconf_update_ip() with NULL laddr.\n\nBUT: this actually won\u0027t happen as sctp_bindx_rem() will catch such a case\nand return with an error earlier. As this is incredably unintuitive and error\nprone, add a check to catch at least future bugs here. As Neil says, its not\nhot path. Introduced by 8a07eb0a5 (\"sctp: Add ASCONF operation on the\nsingle-homed host\").\n\n [1] http://www.spinics.net/lists/linux-sctp/msg02132.html\n [2] http://www.spinics.net/lists/linux-sctp/msg02133.html\n\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdborkman@redhat.com\u003e\nCc: Michio Honda \u003cmicchie@sfc.wide.ad.jp\u003e\nAcked-By: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nAcked-by: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8e307e20b3d7b4fc8af7a84762a7653dad486822", "tree": "0d7a86f19ba1f4452bcb3613cdbba7b8b5d6dd59", "parents": [ "d45a3625d35eddca15327e99cd72eb5ed2c3ef31" ], "author": { "name": "Dave Jones", "email": "davej@redhat.com", "time": "Thu Sep 05 00:11:19 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:47 2013 -0700" }, "message": "caif: Add missing braces to multiline if in cfctrl_linkup_request\n\n[ Upstream commit 0c1db731bfcf3a9fd6c58132134f8b0f423552f0 ]\n\nThe indentation here implies this was meant to be a multi-line if.\n\nIntroduced several years back in commit c85c2951d4da1236e32f1858db418221e624aba5\n(\"caif: Handle dev_queue_xmit errors.\")\n\nSigned-off-by: Dave Jones \u003cdavej@fedoraproject.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d45a3625d35eddca15327e99cd72eb5ed2c3ef31", "tree": "cf7186d9b448d3756782ac600b1955e8db5ae8c7", "parents": [ "f845e0c5753347df5331b6251da8ea7ddbf59ae9" ], "author": { "name": "Claudiu Manoil", "email": "claudiu.manoil@freescale.com", "time": "Sun Sep 23 22:39:08 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:47 2013 -0700" }, "message": "gianfar: Change default HW Tx queue scheduling mode\n\ncommit b98b8babd6e3370fadb7c6eaacb00eb2f6344a6c upstream.\n\nThis is primarily to address transmission timeout occurrences, when\nmultiple H/W Tx queues are being used concurrently. Because in\nthe priority scheduling mode the controller does not service the\nTx queues equally (but in ascending index order), Tx timeouts are\nbeing triggered rightaway for a basic test with multiple simultaneous\nconnections like:\niperf -c \u003cserver_ip\u003e -n 100M -P 8\n\nresulting in kernel trace:\nNETDEV WATCHDOG: eth1 (fsl-gianfar): transmit queue \u003cX\u003e timed out\n------------[ cut here ]------------\nWARNING: at net/sched/sch_generic.c:255\n...\nand controller reset during intense traffic, and possibly further\ncomplications.\n\nThis patch changes the default H/W Tx scheduling setting (TXSCHED)\nfor multi-queue devices, from priority scheduling mode to a weighted\nround robin mode with equal weights for all H/W Tx queues, and\naddresses the issue above.\n\nSigned-off-by: Claudiu Manoil \u003cclaudiu.manoil@freescale.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f845e0c5753347df5331b6251da8ea7ddbf59ae9", "tree": "6d8b6ce2bbea52ed7eadd9490f3c6c96e6261eeb", "parents": [ "dd7c44612de48b6bbd2f81d4b6e83a9801a902a6" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Tue Sep 24 15:27:45 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:47 2013 -0700" }, "message": "cciss: fix info leak in cciss_ioctl32_passthru()\n\ncommit 58f09e00ae095e46ef9edfcf3a5fd9ccdfad065e upstream.\n\nThe arg64 struct has a hole after -\u003ebuf_size which isn\u0027t cleared. Or if\nany of the calls to copy_from_user() fail then that would cause an\ninformation leak as well.\n\nThis was assigned CVE-2013-2147.\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Mike Miller \u003cmike.miller@hp.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dd7c44612de48b6bbd2f81d4b6e83a9801a902a6", "tree": "e1457e9e094a974d684e6fe23d8b616bbbe41f81", "parents": [ "5602328b0d66cd6c5ef0dd7be081fd779c49c27e" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Tue Sep 24 15:27:44 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:47 2013 -0700" }, "message": "cpqarray: fix info leak in ida_locked_ioctl()\n\ncommit 627aad1c01da6f881e7f98d71fd928ca0c316b1a upstream.\n\nThe pciinfo struct has a two byte hole after -\u003edev_fn so stack\ninformation could be leaked to the user.\n\nThis was assigned CVE-2013-2147.\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Mike Miller \u003cmike.miller@hp.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5602328b0d66cd6c5ef0dd7be081fd779c49c27e", "tree": "42cf974952e6077110ffedf6610ab74fd06e72f0", "parents": [ "f28b823bd4509368d2446a42c9f02bbcc369f275" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:07:13 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:07:13 2013 -0700" }, "message": "Linux 3.4.65\n" }, { "commit": "f28b823bd4509368d2446a42c9f02bbcc369f275", "tree": "114edd63eb2f34e4366e9eabe56d96252b887605", "parents": [ "0d39cce32ae80b52a37eb756bfd7b59ac370ffee" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Sep 11 21:56:54 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "HID: LG: validate HID output report details\n\ncommit 0fb6bd06e06792469acc15bbe427361b56ada528 upstream.\n\nA HID device could send a malicious output report that would cause the\nlg, lg3, and lg4 HID drivers to write beyond the output report allocation\nduring an event, causing a heap overflow:\n\n[ 325.245240] usb 1-1: New USB device found, idVendor\u003d046d, idProduct\u003dc287\n...\n[ 414.518960] BUG kmalloc-4096 (Not tainted): Redzone overwritten\n\nAdditionally, while lg2 did correctly validate the report details, it was\ncleaned up and shortened.\n\nCVE-2013-2893\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReviewed-by: Benjamin Tissoires \u003cbenjamin.tissoires@redhat.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0d39cce32ae80b52a37eb756bfd7b59ac370ffee", "tree": "469183d881e5a39ae14e91b990fe8bf61d910dd7", "parents": [ "01a74c11d3ab3adb842e168ee0c2ac1efe35d71a" ], "author": { "name": "David Rientjes", "email": "rientjes@google.com", "time": "Fri Sep 27 17:08:49 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "mm, memcg: give exiting processes access to memory reserves\n\ncommit 465adcf1ea7b2e49b2e0899366624f5532b64012\n\nA memcg may livelock when oom if the process that grabs the hierarchy\u0027s\noom lock is never the first process with PF_EXITING set in the memcg\u0027s\ntask iteration.\n\nThe oom killer, both global and memcg, will defer if it finds an\neligible process that is in the process of exiting and it is not being\nptraced. The idea is to allow it to exit without using memory reserves\nbefore needlessly killing another process.\n\nThis normally works fine except in the memcg case with a large number of\nthreads attached to the oom memcg. In this case, the memcg oom killer\nonly gets called for the process that grabs the hierarchy\u0027s oom lock;\nall others end up blocked on the memcg\u0027s oom waitqueue. Thus, if the\nprocess that grabs the hierarchy\u0027s oom lock is never the first\nPF_EXITING process in the memcg\u0027s task iteration, the oom killer is\nconstantly deferred without anything making progress.\n\nThe fix is to give PF_EXITING processes access to memory reserves so\nthat we\u0027ve marked them as oom killed without any iteration. This allows\n__mem_cgroup_try_charge() to succeed so that the process may exit. This\nmakes the memcg oom killer exemption for TIF_MEMDIE tasks, now\nimmediately granted for processes with pending SIGKILLs and those in the\nexit path, to be equivalent to what is done for the global oom killer.\n\nSigned-off-by: David Rientjes \u003crientjes@google.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nAcked-by: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[Qiang: backported to 3.4:\n - move the changes from memcontrol.c to oom_kill.c]\nSigned-off-by: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "01a74c11d3ab3adb842e168ee0c2ac1efe35d71a", "tree": "e86f88ce30a35be76462b41f0a0e882ae4943b11", "parents": [ "1751a036be85bbee107b0ffa48584ba5fc59e286" ], "author": { "name": "Liam Girdwood", "email": "liam.r.girdwood@linux.intel.com", "time": "Fri Sep 13 17:43:17 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "ALSA: compress: Fix compress device unregister.\n\ncommit 4028b6c4c03f213260e9290ff3a6b5439aad07ce upstream.\n\nsnd_unregister_device() should return the device type and not stream\ndirection.\n\nSigned-off-by: Liam Girdwood \u003cliam.r.girdwood@linux.intel.com\u003e\nAcked-by: Vinod Koul \u003cvinod.koul@intel.com\u003e\nTested-by: Vinod Koul \u003cvinod.koul@intel.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1751a036be85bbee107b0ffa48584ba5fc59e286", "tree": "a636ddf0bc97a06440e8f1a2e641458ef9b82eb5", "parents": [ "74c2478cbbeb55d62e4c0d224949cd6b0a963986" ], "author": { "name": "Henrik Rydberg", "email": "rydberg@euromail.se", "time": "Thu Sep 26 08:33:16 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "hwmon: (applesmc) Check key count before proceeding\n\ncommit 5f4513864304672e6ea9eac60583eeac32e679f2 upstream.\n\nAfter reports from Chris and Josh Boyer of a rare crash in applesmc,\nGuenter pointed at the initialization problem fixed below. The patch\nhas not been verified to fix the crash, but should be applied\nregardless.\n\nReported-by: \u003cjwboyer@fedoraproject.org\u003e\nSuggested-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Henrik Rydberg \u003crydberg@euromail.se\u003e\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "74c2478cbbeb55d62e4c0d224949cd6b0a963986", "tree": "a67f8f2c7471683605da387cdae3bf1bedee3eed", "parents": [ "cadf1b81a7021b26241819d0a360e22609b57a4b" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Sep 23 10:38:26 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "drm/radeon: disable tests/benchmarks if accel is disabled\n\ncommit 4a1132a023eb48cf10522d84c5908d43b612c041 upstream.\n\nThe tests are only usable if the acceleration engines have\nbeen successfully initialized.\n\nBased on an initial patch from: Alex Ivanov \u003cgnidorah@p0n4ik.tk\u003e\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cadf1b81a7021b26241819d0a360e22609b57a4b", "tree": "f93e403ced6c9a5d7561a89051d54938a8ba3384", "parents": [ "182410bd95348ef1ee5b1bccff8c2c75cec72b44" ], "author": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Fri Sep 20 16:42:15 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "drm/i915/dp: increase i2c-over-aux retry interval on AUX DEFER\n\ncommit 8d16f258217f2f583af1fd57c5144aa4bbe73e48 upstream.\n\nThere is no clear cut rules or specs for the retry interval, as there\nare many factors that affect overall response time. Increase the\ninterval, and even more so on branch devices which may have limited i2c\nbit rates.\n\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\nReference: https://bugs.freedesktop.org/show_bug.cgi?id\u003d60263\nTested-by: Nicolas Suzor \u003cnic@suzor.com\u003e\nReviewed-by: Todd Previte \u003ctprevite@gmail.com\u003e\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "182410bd95348ef1ee5b1bccff8c2c75cec72b44", "tree": "5b27d9df70d66cf8d3e44f4f1c57a3090d0135d7", "parents": [ "594eaa187a86da35487f59b9f2913e0f28fc5826" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Sep 18 19:40:42 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "dm-snapshot: fix performance degradation due to small hash size\n\ncommit 60e356f381954d79088d0455e357db48cfdd6857 upstream.\n\nLVM2, since version 2.02.96, creates origin with zero size, then loads\nthe snapshot driver and then loads the origin. Consequently, the\nsnapshot driver sees the origin size zero and sets the hash size to the\nlower bound 64. Such small hash table causes performance degradation.\n\nThis patch changes it so that the hash size is determined by the size of\nsnapshot volume, not minimum of origin and snapshot size. It doesn\u0027t\nmake sense to set the snapshot size significantly larger than the origin\nsize, so we do not need to take origin size into account when\ncalculating the hash size.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "594eaa187a86da35487f59b9f2913e0f28fc5826", "tree": "14ae81622a3403a6f9f1750000ff38f6f1f45268", "parents": [ "d6dda665ed19ba37bd2657005f56c984f0dbb724" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Sep 18 19:14:22 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "dm snapshot: workaround for a false positive lockdep warning\n\ncommit 5ea330a75bd86b2b2a01d7b85c516983238306fb upstream.\n\nThe kernel reports a lockdep warning if a snapshot is invalidated because\nit runs out of space.\n\nThe lockdep warning was triggered by commit 0976dfc1d0cd80a4e9dfaf87bd87\n(\"workqueue: Catch more locking problems with flush_work()\") in v3.5.\n\nThe warning is false positive. The real cause for the warning is that\nthe lockdep engine treats different instances of md-\u003elock as a single\nlock.\n\nThis patch is a workaround - we use flush_workqueue instead of flush_work.\nThis code path is not performance sensitive (it is called only on\ninitialization or invalidation), thus it doesn\u0027t matter that we flush the\nwhole workqueue.\n\nThe real fix for the problem would be to teach the lockdep engine to treat\ndifferent instances of md-\u003elock as separate locks.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAcked-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d6dda665ed19ba37bd2657005f56c984f0dbb724", "tree": "76248181cae3a682aacbb60bc7c3f8e391bae3a3", "parents": [ "84f66252812f8c09482d5053bb793a7b14f344e3" ], "author": { "name": "Kurt Garloff", "email": "kurt@garloff.de", "time": "Tue Sep 24 14:13:48 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "usb/core/devio.c: Don\u0027t reject control message to endpoint with wrong direction bit\n\ncommit 831abf76643555a99b80a3b54adfa7e4fa0a3259 upstream.\n\nTrying to read data from the Pegasus Technologies NoteTaker (0e20:0101)\n[1] with the Windows App (EasyNote) works natively but fails when\nWindows is running under KVM (and the USB device handed to KVM).\n\nThe reason is a USB control message\n usb 4-2.2: control urb: bRequestType\u003d22 bRequest\u003d09 wValue\u003d0200 wIndex\u003d0001 wLength\u003d0008\nThis goes to endpoint address 0x01 (wIndex); however, endpoint address\n0x01 does not exist. There is an endpoint 0x81 though (same number,\nbut other direction); the app may have meant that endpoint instead.\n\nThe kernel thus rejects the IO and thus we see the failure.\n\nApparently, Linux is more strict here than Windows ... we can\u0027t change\nthe Win app easily, so that\u0027s a problem.\n\nIt seems that the Win app/driver is buggy here and the driver does not\nbehave fully according to the USB HID class spec that it claims to\nbelong to. The device seems to happily deal with that though (and\nseems to not really care about this value much).\n\nSo the question is whether the Linux kernel should filter here.\nRejecting has the risk that somewhat non-compliant userspace apps/\ndrivers (most likely in a virtual machine) are prevented from working.\nNot rejecting has the risk of confusing an overly sensitive device with\nsuch a transfer. Given the fact that Windows does not filter it makes\nthis risk rather small though.\n\nThe patch makes the kernel more tolerant: If the endpoint address in\nwIndex does not exist, but an endpoint with toggled direction bit does,\nit will let the transfer through. (It does NOT change the message.)\n\nWith attached patch, the app in Windows in KVM works.\n usb 4-2.2: check_ctrlrecip: process 13073 (qemu-kvm) requesting ep 01 but needs 81\n\nI suspect this will mostly affect apps in virtual environments; as on\nLinux the apps would have been adapted to the stricter handling of the\nkernel. I have done that for mine[2].\n\n[1] http://www.pegatech.com/\n[2] https://sourceforge.net/projects/notetakerpen/\n\nSigned-off-by: Kurt Garloff \u003ckurt@garloff.de\u003e\nAcked-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "84f66252812f8c09482d5053bb793a7b14f344e3", "tree": "32ccecd748298fda0e372b3851a87f84f27ab97b", "parents": [ "c2d27c8a10cf767f4f1d988cc545db0db82c8244" ], "author": { "name": "Florian Wolter", "email": "wolly84@web.de", "time": "Wed Aug 14 10:33:16 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:53 2013 -0700" }, "message": "xhci: Fix race between ep halt and URB cancellation\n\ncommit 526867c3ca0caa2e3e846cb993b0f961c33c2abb upstream.\n\nThe halted state of a endpoint cannot be cleared over CLEAR_HALT from a\nuser process, because the stopped_td variable was overwritten in the\nhandle_stopped_endpoint() function. So the xhci_endpoint_reset() function will\nrefuse the reset and communication with device can not run over this endpoint.\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d60699\n\nSigned-off-by: Florian Wolter \u003cwolly84@web.de\u003e\nSigned-off-by: Sarah Sharp \u003csarah.a.sharp@linux.intel.com\u003e\nCc: Jonghwan Choi \u003cjhbird.choi@samsung.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c2d27c8a10cf767f4f1d988cc545db0db82c8244", "tree": "3f2f25527ae690c460451c6835bab10254e3b5cf", "parents": [ "d134fa59a21d03ef3bad5f68b6eaa927a8397cae" ], "author": { "name": "Mathias Nyman", "email": "mathias.nyman@linux.intel.com", "time": "Thu Sep 05 11:01:20 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:53 2013 -0700" }, "message": "xhci: Fix oops happening after address device timeout\n\ncommit 284d20552461466b04d6bfeafeb1c47a8891b591 upstream.\n\nWhen a command times out, the command ring is first aborted,\nand then stopped. If the command ring is empty when it is stopped\nthe stop event will point to next command which is not yet set.\nxHCI tries to handle this next event often causing an oops.\n\nDon\u0027t handle command completion events on stopped cmd ring if ring is\nempty.\n\nThis patch should be backported to kernels as old as 3.7, that contain\nthe commit b92cc66c047ff7cf587b318fe377061a353c120f \"xHCI: add aborting\ncommand ring function\"\n\nSigned-off-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nReported-by: Giovanni \u003cgiovanni.nervi@yahoo.com\u003e\nSigned-off-by: Sarah Sharp \u003csarah.a.sharp@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d134fa59a21d03ef3bad5f68b6eaa927a8397cae", "tree": "97b5e3d4ac0f7750996ac8760b59ccd8548a6788", "parents": [ "e5b46b4a861e37b802af33e2108f170b142ca86f" ], "author": { "name": "Mathias Nyman", "email": "mathias.nyman@linux.intel.com", "time": "Fri Aug 30 18:25:49 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:53 2013 -0700" }, "message": "xhci: Ensure a command structure points to the correct trb on the command ring\n\ncommit ec7e43e2d98173483866fe2e4e690143626b659c upstream.\n\nIf a command on the command ring needs to be cancelled before it is handled\nit can be turned to a no-op operation when the ring is stopped.\nWe want to store the command ring enqueue pointer in the command structure\nwhen the command in enqueued for the cancellation case.\n\nSome commands used to store the command ring dequeue pointers instead of enqueue\n(these often worked because enqueue happends to equal dequeue quite often)\n\nOther commands correctly used the enqueue pointer but did not check if it pointed\nto a valid trb or a link trb, this caused for example stop endpoint command to timeout in\nxhci_stop_device() in about 2% of suspend/resume cases.\n\nThis should also solve some weird behavior happening in command cancellation cases.\n\nThis patch is based on a patch submitted by Sarah Sharp to linux-usb, but\nthen forgotten:\n http://marc.info/?l\u003dlinux-usb\u0026m\u003d136269803207465\u0026w\u003d2\n\nThis patch should be backported to kernels as old as 3.7, that contain\nthe commit b92cc66c047ff7cf587b318fe377061a353c120f \"xHCI: add aborting\ncommand ring function\"\n\nSigned-off-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nSigned-off-by: Sarah Sharp \u003csarah.a.sharp@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e5b46b4a861e37b802af33e2108f170b142ca86f", "tree": "a9de8e588c3347738698cff0e48c103a2c9e2fdb", "parents": [ "96c3df85670b3cf3e070b3065b8b616305bc3208" ], "author": { "name": "Malcolm Priestley", "email": "tvboxspy@gmail.com", "time": "Sun Sep 22 19:48:54 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:53 2013 -0700" }, "message": "staging: vt6656: [BUG] main_usb.c oops on device_close move flag earlier.\n\ncommit e3eb270fab7734427dd8171a93e4946fe28674bc upstream.\n\nThe vt6656 is prone to resetting on the usb bus.\n\nIt seems there is a race condition and wpa supplicant is\ntrying to open the device via iw_handlers before its actually\nclosed at a stage that the buffers are being removed.\n\nThe device is longer considered open when the\nbuffers are being removed. So move ~DEVICE_FLAGS_OPENED\nflag to before freeing the device buffers.\n\nSigned-off-by: Malcolm Priestley \u003ctvboxspy@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "96c3df85670b3cf3e070b3065b8b616305bc3208", "tree": "5dfb41afdcd0031458b448390324419e4bf668b2", "parents": [ "d0878f4565ee60ea6413ab1ad2e67e4a78ea17f6" ], "author": { "name": "Josh Boyer", "email": "jwboyer@redhat.com", "time": "Thu Apr 18 07:51:34 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:53 2013 -0700" }, "message": "x86, efi: Don\u0027t map Boot Services on i386\n\ncommit 700870119f49084da004ab588ea2b799689efaf7 upstream.\n\nAdd patch to fix 32bit EFI service mapping (rhbz 726701)\n\nMultiple people are reporting hitting the following WARNING on i386,\n\n WARNING: at arch/x86/mm/ioremap.c:102 __ioremap_caller+0x3d3/0x440()\n Modules linked in:\n Pid: 0, comm: swapper Not tainted 3.9.0-rc7+ #95\n Call Trace:\n [\u003cc102b6af\u003e] warn_slowpath_common+0x5f/0x80\n [\u003cc1023fb3\u003e] ? __ioremap_caller+0x3d3/0x440\n [\u003cc1023fb3\u003e] ? __ioremap_caller+0x3d3/0x440\n [\u003cc102b6ed\u003e] warn_slowpath_null+0x1d/0x20\n [\u003cc1023fb3\u003e] __ioremap_caller+0x3d3/0x440\n [\u003cc106007b\u003e] ? get_usage_chars+0xfb/0x110\n [\u003cc102d937\u003e] ? vprintk_emit+0x147/0x480\n [\u003cc1418593\u003e] ? efi_enter_virtual_mode+0x1e4/0x3de\n [\u003cc102406a\u003e] ioremap_cache+0x1a/0x20\n [\u003cc1418593\u003e] ? efi_enter_virtual_mode+0x1e4/0x3de\n [\u003cc1418593\u003e] efi_enter_virtual_mode+0x1e4/0x3de\n [\u003cc1407984\u003e] start_kernel+0x286/0x2f4\n [\u003cc1407535\u003e] ? repair_env_string+0x51/0x51\n [\u003cc1407362\u003e] i386_start_kernel+0x12c/0x12f\n\nDue to the workaround described in commit 916f676f8 (\"x86, efi: Retain\nboot service code until after switching to virtual mode\") EFI Boot\nService regions are mapped for a period during boot. Unfortunately, with\nthe limited size of the i386 direct kernel map it\u0027s possible that some\nof the Boot Service regions will not be directly accessible, which\ncauses them to be ioremap()\u0027d, triggering the above warning as the\nregions are marked as E820_RAM in the e820 memmap.\n\nThere are currently only two situations where we need to map EFI Boot\nService regions,\n\n 1. To workaround the firmware bug described in 916f676f8\n 2. To access the ACPI BGRT image\n\nbut since we haven\u0027t seen an i386 implementation that requires either,\nthis simple fix should suffice for now.\n\n[ Added to changelog - Matt ]\n\nReported-by: Bryan O\u0027Donoghue \u003cbryan.odonoghue.lkml@nexus-software.ie\u003e\nAcked-by: Tom Zanussi \u003ctom.zanussi@intel.com\u003e\nAcked-by: Darren Hart \u003cdvhart@linux.intel.com\u003e\nCc: Josh Triplett \u003cjosh@joshtriplett.org\u003e\nCc: Matthew Garrett \u003cmjg59@srcf.ucam.org\u003e\nCc: H. Peter Anvin \u003chpa@zytor.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Josh Boyer \u003cjwboyer@redhat.com\u003e\nSigned-off-by: Matt Fleming \u003cmatt.fleming@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d0878f4565ee60ea6413ab1ad2e67e4a78ea17f6", "tree": "7d809c1f76a7a7cfd74726fe6d04d316b209f087", "parents": [ "d4c162c56b4b9af4dda113f865c23ee48df20ad4" ], "author": { "name": "Masoud Sharbiani", "email": "msharbiani@twitter.com", "time": "Fri Sep 20 15:59:07 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:53 2013 -0700" }, "message": "x86/reboot: Add quirk to make Dell C6100 use reboot\u003dpci automatically\n\ncommit 4f0acd31c31f03ba42494c8baf6c0465150e2621 upstream.\n\nDell PowerEdge C6100 machines fail to completely reboot about 20% of the time.\n\nSigned-off-by: Masoud Sharbiani \u003cmsharbiani@twitter.com\u003e\nSigned-off-by: Vinson Lee \u003cvlee@twitter.com\u003e\nCc: Robin Holt \u003cholt@sgi.com\u003e\nCc: Russell King \u003crmk+kernel@arm.linux.org.uk\u003e\nCc: Guan Xuetao \u003cgxt@mprc.pku.edu.cn\u003e\nLink: http://lkml.kernel.org/r/1379717947-18042-1-git-send-email-vlee@freedesktop.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d4c162c56b4b9af4dda113f865c23ee48df20ad4", "tree": "bd96d64943f8dfef94ac8e247966be9f289749b0", "parents": [ "93751c2630fa7eb277b54274e7e7b6cd7660d9ac" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:12:49 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:12:49 2013 -0700" }, "message": "Linux 3.4.64\n" }, { "commit": "93751c2630fa7eb277b54274e7e7b6cd7660d9ac", "tree": "5bf658fe530e16e57300aa6afd087de380d3d72f", "parents": [ "43cbf1f46f0cdc56db7a424c6dda57bd9288376e" ], "author": { "name": "Daniel Santos", "email": "daniel.santos@pobox.com", "time": "Thu Oct 04 17:15:05 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:52 2013 -0700" }, "message": "kernel-doc: bugfix - multi-line macros\n\ncommit 654784284430bf2739985914b65e09c7c35a7273 upstream.\n\nPrior to this patch the following code breaks:\n\n/**\n * multiline_example - this breaks kernel-doc\n */\n #define multiline_example( \\\nmyparam)\n\nProducing this error:\n\nError(somefile.h:983): cannot understand prototype: \u0027multiline_example( \\ \u0027\n\nThis patch fixes the issue by appending all lines ending in a blackslash\n(optionally followed by whitespace), removing the backslash and any\nwhitespace after it prior to appending (just like the C pre-processor\nwould).\n\nThis fixes a break in kerel-doc introduced by the additions to rbtree.h.\n\nSigned-off-by: Daniel Santos \u003cdaniel.santos@pobox.com\u003e\nCc: Randy Dunlap \u003crdunlap@xenotime.net\u003e\nCc: Michal Marek \u003cmmarek@suse.cz\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "43cbf1f46f0cdc56db7a424c6dda57bd9288376e", "tree": "5fd8fad6fabf7dd61bdc68c4c8c3fd57acf3b156", "parents": [ "4d75da4294e10475b3b255e34f446999832f4d17" ], "author": { "name": "Ben Hutchings", "email": "bhutchings@solarflare.com", "time": "Fri Sep 06 22:39:20 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:52 2013 -0700" }, "message": "sfc: Fix efx_rx_buf_offset() for recycled pages\n\nThis bug fix is only for stable branches older than 3.10. The bug was\nfixed upstream by commit 2768935a4660 (\u0027sfc: reuse pages to avoid DMA\nmapping/unmapping costs\u0027), but that change is totally unsuitable for\nstable.\n\nCommit b590ace09d51 (\u0027sfc: Fix efx_rx_buf_offset() in the presence of\nswiotlb\u0027) added an explicit page_offset member to struct\nefx_rx_buffer, which must be set consistently with the u.page and\ndma_addr fields. However, it failed to add the necessary assignment\nin efx_resurrect_rx_buffer(). It also did not correct the calculation\nof efx_rx_buffer::dma_addr in efx_resurrect_rx_buffer(), which assumes\nthat DMA-mapping a page will result in a page-aligned DMA address\n(exactly what swiotlb violates).\n\nAdd the assignment of efx_rx_buffer::page_offset and change the\ncalculation of dma_addr to make use of it.\n\nSigned-off-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4d75da4294e10475b3b255e34f446999832f4d17", "tree": "141abf522596695577126f3497b193f04b4ecbfe", "parents": [ "db68549fe3aee4045e1d7348b20d7c8baf4518c0" ], "author": { "name": "Andi Kleen", "email": "ak@linux.intel.com", "time": "Wed Apr 24 17:03:02 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:52 2013 -0700" }, "message": "perf tools: Handle JITed code in shared memory\n\ncommit 89365e6c9ad4c0e090e4c6a4b67a3ce319381d89 upstream.\n\nNeed to check for /dev/zero.\n\nMost likely more strings are missing too.\n\nSigned-off-by: Andi Kleen \u003cak@linux.intel.com\u003e\nLink: http://lkml.kernel.org/r/1366848182-30449-1-git-send-email-andi@firstfloor.org\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nCc: Vinson Lee \u003cvlee@freedesktop.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "db68549fe3aee4045e1d7348b20d7c8baf4518c0", "tree": "9169045efdd981f5042ad103fbe3e816edce2892", "parents": [ "1d48ca6f38fa39298474708abebeffef4ef2cd2d" ], "author": { "name": "Lino Sanfilippo", "email": "LinoSanfilippo@gmx.de", "time": "Fri Mar 23 02:42:23 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:52 2013 -0700" }, "message": "fanotify: dont merge permission events\n\ncommit 03a1cec1f17ac1a6041996b3e40f96b5a2f90e1b upstream.\n\nBoyd Yang reported a problem for the case that multiple threads of the same\nthread group are waiting for a reponse for a permission event.\nIn this case it is possible that some of the threads are never woken up, even\nif the response for the event has been received\n(see http://marc.info/?l\u003dlinux-kernel\u0026m\u003d131822913806350\u0026w\u003d2).\n\nThe reason is that we are currently merging permission events if they belong to\nthe same thread group. But we are not prepared to wake up more than one waiter\nfor each event. We do\n\nwait_event(group-\u003efanotify_data.access_waitq, event-\u003eresponse ||\n\t\t\tatomic_read(\u0026group-\u003efanotify_data.bypass_perm));\nand after that\n event-\u003eresponse \u003d 0;\n\nwhich is the reason that even if we woke up all waiters for the same event\nsome of them may see event-\u003eresponse being already set 0 again, then go back to\nsleep and block forever.\n\nWith this patch we avoid that more than one thread is waiting for a response\nby not merging permission events for the same thread group any more.\n\nReported-by: Boyd Yang \u003cboyd.yang@gmail.com\u003e\nSigned-off-by: Lino Sanfilippo \u003cLinoSanfilipp@gmx.de\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nCc: Mihai Donțu \u003cmihai.dontu@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1d48ca6f38fa39298474708abebeffef4ef2cd2d", "tree": "54af1961ab8589ebc3e6533c4083c0cdb2581db9", "parents": [ "2cd21fa1b54efaf6b5912ef2833fa474fdcf92b7" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Tue Oct 02 15:41:23 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:52 2013 -0700" }, "message": "perf: Fix perf_cgroup_switch for sw-events\n\ncommit 95cf59ea72331d0093010543b8951bb43f262cac upstream.\n\nJiri reported that he could trigger the WARN_ON_ONCE() in\nperf_cgroup_switch() using sw-events. This is because sw-events share\na cpuctx with multiple PMUs.\n\nUse the -\u003eunique_pmu pointer to limit the pmu iteration to unique\ncpuctx instances.\n\nReported-and-Tested-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/n/tip-so7wi2zf3jjzrwcutm2mkz0j@git.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2cd21fa1b54efaf6b5912ef2833fa474fdcf92b7", "tree": "17a056e20c3937a5af97acd45ac7792a420d78ab", "parents": [ "2927937899b958de968119856ba659d8a4eff037" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Tue Oct 02 15:38:52 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:52 2013 -0700" }, "message": "perf: Clarify perf_cpu_context::active_pmu usage by renaming it to ::unique_pmu\n\ncommit 3f1f33206c16c7b3839d71372bc2ac3f305aa802 upstream.\n\nStephane thought the perf_cpu_context::active_pmu name confusing and\nsuggested using \u0027unique_pmu\u0027 instead.\n\nThis pointer is a pointer to a \u0027random\u0027 pmu sharing the cpuctx\ninstance, therefore limiting a for_each_pmu loop to those where\ncpuctx-\u003eunique_pmu matches the pmu we get a loop over unique cpuctx\ninstances.\n\nSuggested-by: Stephane Eranian \u003ceranian@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/n/tip-kxyjqpfj2fn9gt7kwu5ag9ks@git.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2927937899b958de968119856ba659d8a4eff037", "tree": "51489c3f0826002328a8bf68dccd81c8abeccab3", "parents": [ "72417b659ae9c36e1807bc930240aec202970861" ], "author": { "name": "Li Zefan", "email": "lizefan@huawei.com", "time": "Mon Feb 18 14:13:35 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "cgroup: fail if monitored file and event_control are in different cgroup\n\ncommit f169007b2773f285e098cb84c74aac0154d65ff7 upstream.\n\nIf we pass fd of memory.usage_in_bytes of cgroup A to cgroup.event_control\nof cgroup B, then we won\u0027t get memory usage notification from A but B!\n\nWhat\u0027s worse, if A and B are in different mount hierarchy, we\u0027ll end up\naccessing NULL pointer!\n\nDisallow this kind of invalid usage.\n\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill@shutemov.name\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "72417b659ae9c36e1807bc930240aec202970861", "tree": "0d30d33a47720e99ca5eb7d027613aa823d91e3f", "parents": [ "a59b428bd6a05560d7cb656849866e220946da87" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Sep 09 10:54:22 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "drm/radeon/atom: workaround vbios bug in transmitter table on rs880 (v2)\n\ncommit 91f3a6aaf280294b07c05dfe606e6c27b7ba3c72 upstream.\n\nThe OUTPUT_ENABLE action jumps past the point in the coder where\nthe data_offset is set on certain rs780 cards. This worked\npreviously because the OUTPUT_ENABLE action is always called\nimmediately after the ENABLE action so the data_offset remained\nset. In 6f8bbaf568c7f2c497558bfd04654c0b9841ad57\n(drm/radeon/atom: initialize more atom interpretor elements to 0),\nwe explictly reset data_offset to 0 between atom calls which then\ncaused this to fail. The fix is to just skip calling the\nOUTPUT_ENABLE action on the problematic chipsets. The ENABLE\naction does the same thing and more. Ultimately, we could\nprobably drop the OUTPUT_ENABLE action all together on DCE3\nasics.\n\nfixes:\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d60791\n\nv2: only rs880 seems to be affected\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a59b428bd6a05560d7cb656849866e220946da87", "tree": "02082e1027094899487066f86c3360f662259b34", "parents": [ "b805676fd8265b428ff2a15b3aaa15adecc55bb8" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Aug 27 12:36:01 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "drm/radeon: fix handling of variable sized arrays for router objects\n\ncommit fb93df1c2d8b3b1fb16d6ee9e32554e0c038815d upstream.\n\nThe table has the following format:\n\ntypedef struct _ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT //usSrcDstTableOffset pointing to this structure\n{\n UCHAR ucNumberOfSrc;\n USHORT usSrcObjectID[1];\n UCHAR ucNumberOfDst;\n USHORT usDstObjectID[1];\n}ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT;\n\nusSrcObjectID[] and usDstObjectID[] are variably sized, so we\ncan\u0027t access them directly. Use pointers and update the offset\nappropriately when accessing the Dst members.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b805676fd8265b428ff2a15b3aaa15adecc55bb8", "tree": "693f0e0b36e989da8c66cb8a267e7121f32dc0d3", "parents": [ "da2f15e84f3a463a2f643c0c9922126ebdc7233c" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Aug 26 17:52:12 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "drm/radeon: fix resume on some rs4xx boards (v2)\n\ncommit acf88deb8ddbb73acd1c3fa32fde51af9153227f upstream.\n\nSetting MC_MISC_CNTL.GART_INDEX_REG_EN causes hangs on\nsome boards on resume. The systems seem to work fine\nwithout touching this bit so leave it as is.\n\nv2: read-modify-write the GART_INDEX_REG_EN bit.\nI suspect the problem is that we are losing the other\nsettings in the register.\n\nfixes:\nhttps://bugs.freedesktop.org/show_bug.cgi?id\u003d52952\n\nReported-by: Ondrej Zary \u003clinux@rainbow-software.org\u003e\nTested-by: Daniel Tobias \u003cdan.g.tob@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "da2f15e84f3a463a2f643c0c9922126ebdc7233c", "tree": "eb859a958d6c8590cef225c34abe6d106542ace2", "parents": [ "be70f1f28ecd59be723b3183539255944dad5df5" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Aug 19 11:15:43 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "drm/radeon: update line buffer allocation for dce6\n\ncommit 290d24576ccf1aa0373d2185cedfe262d0d4952a upstream.\n\nWe need to allocate line buffer to each display when\nsetting up the watermarks. Failure to do so can lead\nto a blank screen. This fixes blank screen problems\non dce6 asics.\n\nFixes:\nhttps://bugs.freedesktop.org/show_bug.cgi?id\u003d64850\n\nBased on an initial fix from:\nJay Cornwall \u003cjay.cornwall@amd.com\u003e\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "be70f1f28ecd59be723b3183539255944dad5df5", "tree": "c9972e1868891bf334f4aee6685c12629f3af0bc", "parents": [ "63fffa36d35fedf0124522b8748a79e6817889e9" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Aug 19 11:06:50 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "drm/radeon: update line buffer allocation for dce4.1/5\n\ncommit 0b31e02363b0db4e7931561bc6c141436e729d9f upstream.\n\nWe need to allocate line buffer to each display when\nsetting up the watermarks. Failure to do so can lead\nto a blank screen. This fixes blank screen problems\non dce4.1/5 asics.\n\nBased on an initial fix from:\nJay Cornwall \u003cjay.cornwall@amd.com\u003e\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "63fffa36d35fedf0124522b8748a79e6817889e9", "tree": "432188a677672126d906ccd0f3029fc6bebb5546", "parents": [ "e3695a4006bcddfb92e7f04e7bbf9837972d2768" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Aug 07 19:34:53 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "drm/radeon: fix endian bugs in hw i2c atom routines\n\ncommit 4543eda52113d1e2cc0e9bf416f79597e6ef1ec7 upstream.\n\nNeed to swap the data fetched over i2c properly. This\nis the same fix as the endian fix for aux channel\ntransactions.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e3695a4006bcddfb92e7f04e7bbf9837972d2768", "tree": "397de5fd8b70c45a7559fe2a2129fdc847c12635", "parents": [ "0498605a9cf5417da2306b484f255282b2413688" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Aug 20 14:59:01 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "drm/radeon: fix LCD record parsing\n\ncommit 95663948ba22a4be8b99acd67fbf83e86ddffba4 upstream.\n\nIf the LCD table contains an EDID record, properly account\nfor the edid size when walking through the records.\n\nThis should fix error messages about unknown LCD records.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0498605a9cf5417da2306b484f255282b2413688", "tree": "94c1072dbe6d6543b89ffbc611a7e2bdbf6d6a33", "parents": [ "c931726692f5a8e294d96cec603d3e4ce4f34538" ], "author": { "name": "Ben Skeggs", "email": "bskeggs@redhat.com", "time": "Tue Sep 17 14:21:15 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "drm/ttm: fix the tt_populated check in ttm_tt_destroy()\n\ncommit 182b17c8dc4e83aab000ce86587b6810e515da87 upstream.\n\nAfter a vmalloc failure in ttm_dma_tt_alloc_page_directory(),\nttm_dma_tt_init() will call ttm_tt_destroy() to cleanup, and end up\ninside the driver\u0027s unpopulate() hook when populate() has never yet\nbeen called.\n\nOn nouveau, the first issue to be hit because of this is that\ndma_address[] may be a NULL pointer. After working around this,\nttm_pool_unpopulate() may potentially hit the same issue with\nthe pages[] array.\n\nIt seems to make more sense to avoid calling unpopulate on already\nunpopulated TTMs than to add checks to all the implementations.\n\nSigned-off-by: Ben Skeggs \u003cbskeggs@redhat.com\u003e\nReviewed-by: Thomas Hellstrom \u003cthellstrom@vmware.com\u003e\nCc: Jerome Glisse \u003cjglisse@redhat.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c931726692f5a8e294d96cec603d3e4ce4f34538", "tree": "c660cd0d386f3c73dc257b860767d131c42afb3d", "parents": [ "b77d6514bc7631d95528e63989dbb11d97c7c115" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Sep 11 21:56:56 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "HID: logitech-dj: validate output report details\n\ncommit 297502abb32e225fb23801fcdb0e4f6f8e17099a upstream.\n\nA HID device could send a malicious output report that would cause the\nlogitech-dj HID driver to leak kernel memory contents to the device, or\ntrigger a NULL dereference during initialization:\n\n[ 304.424553] usb 1-1: New USB device found, idVendor\u003d046d, idProduct\u003dc52b\n...\n[ 304.780467] BUG: unable to handle kernel NULL pointer dereference at 0000000000000028\n[ 304.781409] IP: [\u003cffffffff815d50aa\u003e] logi_dj_recv_send_report.isra.11+0x1a/0x90\n\nCVE-2013-2895\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Benjamin Tissoires \u003cbenjamin.tissoires@gmail.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b77d6514bc7631d95528e63989dbb11d97c7c115", "tree": "20b20722862f2f44c65904325a4e29785e8bd1a6", "parents": [ "0049b62c9efc4ef23492976512d4722b3e63de45" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Sep 11 21:56:51 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "HID: zeroplus: validate output report details\n\ncommit 78214e81a1bf43740ce89bb5efda78eac2f8ef83 upstream.\n\nThe zeroplus HID driver was not checking the size of allocated values\nin fields it used. A HID device could send a malicious output report\nthat would cause the driver to write beyond the output report allocation\nduring initialization, causing a heap overflow:\n\n[ 1442.728680] usb 1-1: New USB device found, idVendor\u003d0c12, idProduct\u003d0005\n...\n[ 1466.243173] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten\n\nCVE-2013-2889\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReviewed-by: Benjamin Tissoires \u003cbenjamin.tissoires@redhat.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0049b62c9efc4ef23492976512d4722b3e63de45", "tree": "a098aec5808beb0937fdf3964e23742dd30066b2", "parents": [ "62875332eafea9ee150a6037c0a1a20669e02aa1" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Sep 11 21:56:50 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "HID: provide a helper for validating hid reports\n\ncommit 331415ff16a12147d57d5c953f3a961b7ede348b upstream.\n\nMany drivers need to validate the characteristics of their HID report\nduring initialization to avoid misusing the reports. This adds a common\nhelper to perform validation of the report exisitng, the field existing,\nand the expected number of values within the field.\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReviewed-by: Benjamin Tissoires \u003cbenjamin.tissoires@redhat.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "62875332eafea9ee150a6037c0a1a20669e02aa1", "tree": "71c673017dc9991b143ad989e6b3d20802a13719", "parents": [ "ebce1a846aa297022fc372d59e6829d0453125f2" ], "author": { "name": "Daisuke Nishimura", "email": "nishimura@mxp.nes.nec.co.jp", "time": "Tue Sep 10 18:16:36 2013 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "sched/fair: Fix small race where child-\u003ese.parent,cfs_rq might point to invalid ones\n\ncommit 6c9a27f5da9609fca46cb2b183724531b48f71ad upstream.\n\nThere is a small race between copy_process() and cgroup_attach_task()\nwhere child-\u003ese.parent,cfs_rq points to invalid (old) ones.\n\n parent doing fork() | someone moving the parent to another cgroup\n -------------------------------+---------------------------------------------\n copy_process()\n + dup_task_struct()\n -\u003e parent-\u003ese is copied to child-\u003ese.\n se.parent,cfs_rq of them point to old ones.\n\n cgroup_attach_task()\n + cgroup_task_migrate()\n -\u003e parent-\u003ecgroup is updated.\n + cpu_cgroup_attach()\n + sched_move_task()\n + task_move_group_fair()\n +- set_task_rq()\n -\u003e se.parent,cfs_rq of parent\n are updated.\n\n + cgroup_fork()\n -\u003e parent-\u003ecgroup is copied to child-\u003ecgroup. (*1)\n + sched_fork()\n + task_fork_fair()\n -\u003e se.parent,cfs_rq of child are accessed\n while they point to old ones. (*2)\n\nIn the worst case, this bug can lead to \"use-after-free\" and cause a panic,\nbecause it\u0027s new cgroup\u0027s refcount that is incremented at (*1),\nso the old cgroup(and related data) can be freed before (*2).\n\nIn fact, a panic caused by this bug was originally caught in RHEL6.4.\n\n BUG: unable to handle kernel NULL pointer dereference at (null)\n IP: [\u003cffffffff81051e3e\u003e] sched_slice+0x6e/0xa0\n [...]\n Call Trace:\n [\u003cffffffff81051f25\u003e] place_entity+0x75/0xa0\n [\u003cffffffff81056a3a\u003e] task_fork_fair+0xaa/0x160\n [\u003cffffffff81063c0b\u003e] sched_fork+0x6b/0x140\n [\u003cffffffff8106c3c2\u003e] copy_process+0x5b2/0x1450\n [\u003cffffffff81063b49\u003e] ? wake_up_new_task+0xd9/0x130\n [\u003cffffffff8106d2f4\u003e] do_fork+0x94/0x460\n [\u003cffffffff81072a9e\u003e] ? sys_wait4+0xae/0x100\n [\u003cffffffff81009598\u003e] sys_clone+0x28/0x30\n [\u003cffffffff8100b393\u003e] stub_clone+0x13/0x20\n [\u003cffffffff8100b072\u003e] ? system_call_fastpath+0x16/0x1b\n\nSigned-off-by: Daisuke Nishimura \u003cnishimura@mxp.nes.nec.co.jp\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/039601ceae06$733d3130$59b79390$@mxp.nes.nec.co.jp\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ebce1a846aa297022fc372d59e6829d0453125f2", "tree": "191dd0e90af34c5d7a44615ad16668013f593948", "parents": [ "9f76c47a322910215c42c2e4226f2bef173c84ea" ], "author": { "name": "Stanislaw Gruszka", "email": "sgruszka@redhat.com", "time": "Mon Aug 26 15:18:53 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:50 2013 -0700" }, "message": "rt2800: fix wrong TX power compensation\n\ncommit 6e956da2027c767859128b9bfef085cf2a8e233b upstream.\n\nWe should not do temperature compensation on devices without\nEXTERNAL_TX_ALC bit set (called DynamicTxAgcControl on vendor driver).\nSuch devices can have totally bogus TSSI parameters on the EEPROM,\nbut still threaded by us as valid and result doing wrong TX power\ncalculations.\n\nThis fix inability to connect to AP on slightly longer distance on\nsome Ralink chips/devices.\n\nReported-and-tested-by: Fabien ADAM \u003cid2ndr@crocobox.org\u003e\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9f76c47a322910215c42c2e4226f2bef173c84ea", "tree": "162c58332f8e46689f5ac0837fa2b43681b36895", "parents": [ "1c1c7a7342cb6ef5976823616de9114554796592" ], "author": { "name": "Fabio Porcedda", "email": "fabio.porcedda@gmail.com", "time": "Mon Sep 16 11:47:50 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:50 2013 -0700" }, "message": "net: usb: cdc_ether: Use wwan interface for Telit modules\n\ncommit 0092820407901a0b2c4e343e85f96bb7abfcded1 upstream.\n\nSigned-off-by: Fabio Porcedda \u003cfabio.porcedda@gmail.com\u003e\nAcked-by: Oliver Neukum \u003coliver@neukum.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1c1c7a7342cb6ef5976823616de9114554796592", "tree": "d69eff6615ac112672e635b11e195ff287cbd8e1", "parents": [ "940d5466e08c41c44366d5ea4b36930d1dbd02c3" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Sep 27 08:34:49 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:50 2013 -0700" }, "message": "Revert \"sctp: fix call to SCTP_CMD_PROCESS_SACK in sctp_cmd_interpreter()\"\n\nThis reverts commit c2f5b7507ac5d808f29287d77ee6148358d7fbfe which is\ncommit f6e80abeab928b7c47cc1fbf53df13b4398a2bec.\n\nMichal writes:\n\tMainline commit f6e80abe was introduced in v3.7-rc2 as a\n\tfollow-up fix to commit\n\n\t edfee033 sctp: check src addr when processing SACK to update transport state\n\n\t(from v3.7-rc1) which changed the interpretation of third\n\targument to sctp_cmd_process_sack() and sctp_outq_sack(). But as\n\tcommit edfee033 has never been backported to stable branches,\n\tbackport of commit f6e80abe actually breaks the code rather than\n\tfixing it.\n\nReported-by: Michal Kubecek \u003cmkubecek@suse.cz\u003e\nCc: Zijie Pan \u003czijie.pan@6wind.com\u003e\nCc: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nCc: Vlad Yasevich \u003cvyasevich@gmail.com\u003e\nAcked-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "940d5466e08c41c44366d5ea4b36930d1dbd02c3", "tree": "a52295746a4014592cf10646554d53a46d9354db", "parents": [ "b6a40685765b7ce6f31244a80a5c5a936b29da32" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:16:10 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:16:10 2013 -0700" }, "message": "Linux 3.4.63\n" }, { "commit": "b6a40685765b7ce6f31244a80a5c5a936b29da32", "tree": "c32e39b038ec197b934d81b4a841c5348def763d", "parents": [ "ec00ecafdc391afb652c4115afb73085aa4decd3" ], "author": { "name": "Anand Avati", "email": "avati@redhat.com", "time": "Tue Aug 20 02:21:07 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:52 2013 -0700" }, "message": "fuse: invalidate inode attributes on xattr modification\n\ncommit d331a415aef98717393dda0be69b7947da08eba3 upstream.\n\nCalls like setxattr and removexattr result in updation of ctime.\nTherefore invalidate inode attributes to force a refresh.\n\nSigned-off-by: Anand Avati \u003cavati@redhat.com\u003e\nReviewed-by: Brian Foster \u003cbfoster@redhat.com\u003e\nSigned-off-by: Miklos Szeredi \u003cmszeredi@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ec00ecafdc391afb652c4115afb73085aa4decd3", "tree": "3b5b82daa2c90752080962b06875b0c556a069c0", "parents": [ "579fc7a3f0f07cdf158e629a322121f25029d358" ], "author": { "name": "Maxim Patlasov", "email": "MPatlasov@parallels.com", "time": "Mon Aug 12 20:39:30 2013 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:52 2013 -0700" }, "message": "fuse: postpone end_page_writeback() in fuse_writepage_locked()\n\ncommit 4a4ac4eba1010ef9a804569058ab29e3450c0315 upstream.\n\nThe patch fixes a race between ftruncate(2), mmap-ed write and write(2):\n\n1) An user makes a page dirty via mmap-ed write.\n2) The user performs shrinking truncate(2) intended to purge the page.\n3) Before fuse_do_setattr calls truncate_pagecache, the page goes to\n writeback. fuse_writepage_locked fills FUSE_WRITE request and releases\n the original page by end_page_writeback.\n4) fuse_do_setattr() completes and successfully returns. Since now, i_mutex\n is free.\n5) Ordinary write(2) extends i_size back to cover the page. Note that\n fuse_send_write_pages do wait for fuse writeback, but for another\n page-\u003eindex.\n6) fuse_writepage_locked proceeds by queueing FUSE_WRITE request.\n fuse_send_writepage is supposed to crop inarg-\u003esize of the request,\n but it doesn\u0027t because i_size has already been extended back.\n\nMoving end_page_writeback to the end of fuse_writepage_locked fixes the\nrace because now the fact that truncate_pagecache is successfully returned\ninfers that fuse_writepage_locked has already called end_page_writeback.\nAnd this, in turn, infers that fuse_flush_writepages has already called\nfuse_send_writepage, and the latter used valid (shrunk) i_size. write(2)\ncould not extend it because of i_mutex held by ftruncate(2).\n\nSigned-off-by: Maxim Patlasov \u003cmpatlasov@parallels.com\u003e\nSigned-off-by: Miklos Szeredi \u003cmszeredi@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "579fc7a3f0f07cdf158e629a322121f25029d358", "tree": "1fdd55a828c3af9841f8910d9b0cf328c1013622", "parents": [ "ae48ae828eab7046716a8fcb143dab520f803027" ], "author": { "name": "Grant Likely", "email": "grant.likely@linaro.org", "time": "Wed Aug 28 21:24:17 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:51 2013 -0700" }, "message": "of: Fix missing memory initialization on FDT unflattening\n\ncommit 0640332e073be9207f0784df43595c0c39716e42 upstream.\n\nAny calls to dt_alloc() need to be zeroed. This is a temporary fix, but\nthe allocation function itself needs to zero memory before returning\nit. This is a follow up to patch 9e4012752, \"of: fdt: fix memory\ninitialization for expanded DT\" which fixed one call site but missed\nanother.\n\nSigned-off-by: Grant Likely \u003cgrant.likely@linaro.org\u003e\nAcked-by: Wladislav Wiebe \u003cwladislav.kw@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ae48ae828eab7046716a8fcb143dab520f803027", "tree": "653e8959a865944f72f16b86b7799bac034c4e3c", "parents": [ "d060c0b744c99df4979b4781be0a8204cc93f94c" ], "author": { "name": "Sergei Shtylyov", "email": "sergei.shtylyov@cogentembedded.com", "time": "Sat Aug 24 23:38:15 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:51 2013 -0700" }, "message": "mmc: tmio_mmc_dma: fix PIO fallback on SDHI\n\ncommit f936f9b67b7f8c2eae01dd303a0e90bd777c4679 upstream.\n\nI\u0027m testing SH-Mobile SDHI driver in DMA mode with a new DMA controller using\n\u0027bonnie++\u0027 and getting DMA error after which the tmio_mmc_dma.c code falls back\nto PIO but all commands time out after that. It turned out that the fallback\ncode calls tmio_mmc_enable_dma() with RX/TX channels already freed and pointers\nto them cleared, so that the function bails out early instead of clearing the\nDMA bit in the CTL_DMA_ENABLE register. The regression was introduced by commit\n162f43e31c5a376ec16336e5d0ac973373d54c89 (mmc: tmio: fix a deadlock).\nMoving tmio_mmc_enable_dma() calls to the top of the PIO fallback code in\ntmio_mmc_start_dma_{rx|tx}() helps.\n\nSigned-off-by: Sergei Shtylyov \u003csergei.shtylyov@cogentembedded.com\u003e\nAcked-by: Guennadi Liakhovetski \u003cg.liakhovetski@gmx.de\u003e\nSigned-off-by: Chris Ball \u003ccjb@laptop.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d060c0b744c99df4979b4781be0a8204cc93f94c", "tree": "b4fd4801562a29bbace6439825b35a703f09ad98", "parents": [ "512ecf84714aa7f906807c5149cd4776d157d7ab" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Aug 12 11:04:29 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:51 2013 -0700" }, "message": "drm/edid: add quirk for Medion MD30217PG\n\ncommit 118bdbd86b39dbb843155054021d2c59058f1e05 upstream.\n\nThis LCD monitor (1280x1024 native) has a completely\nbogus detailed timing (640x350@70hz). User reports that\n1280x1024@60 has waves so prefer 1280x1024@75.\n\nManufacturer: MED Model: 7b8 Serial#: 99188\nYear: 2005 Week: 5\nEDID Version: 1.3\nAnalog Display Input, Input Voltage Level: 0.700/0.700 V\nSync: Separate\nMax Image Size [cm]: horiz.: 34 vert.: 27\nGamma: 2.50\nDPMS capabilities: Off; RGB/Color Display\nFirst detailed timing is preferred mode\nredX: 0.645 redY: 0.348 greenX: 0.280 greenY: 0.605\nblueX: 0.142 blueY: 0.071 whiteX: 0.313 whiteY: 0.329\nSupported established timings:\n720x400@70Hz\n640x480@60Hz\n640x480@72Hz\n640x480@75Hz\n800x600@56Hz\n800x600@60Hz\n800x600@72Hz\n800x600@75Hz\n1024x768@60Hz\n1024x768@70Hz\n1024x768@75Hz\n1280x1024@75Hz\nManufacturer\u0027s mask: 0\nSupported standard timings:\nSupported detailed timing:\nclock: 25.2 MHz Image Size: 337 x 270 mm\nh_active: 640 h_sync: 688 h_sync_end 784 h_blank_end 800 h_border: 0\nv_active: 350 v_sync: 350 v_sync_end 352 v_blanking: 449 v_border: 0\nMonitor name: MD30217PG\nRanges: V min: 56 V max: 76 Hz, H min: 30 H max: 83 kHz, PixClock max 145 MHz\nSerial No: 501099188\nEDID (in hex):\n 00ffffffffffff0034a4b80774830100\n 050f010368221b962a0c55a559479b24\n 125054afcf00310a0101010101018180\n 000000000000d60980a0205e63103060\n 0200510e1100001e000000fc004d4433\n 3032313750470a202020000000fd0038\n 4c1e530e000a202020202020000000ff\n 003530313039393138380a2020200078\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nReported-by: friedrich@mailstation.de\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "512ecf84714aa7f906807c5149cd4776d157d7ab", "tree": "7a0cf2765df17412ce3410e546a8ba96f80e9fb9", "parents": [ "d778ca56a22b5ca0c96e39db08b4994166d435d6" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Jul 25 11:49:11 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:51 2013 -0700" }, "message": "isofs: Refuse RW mount of the filesystem instead of making it RO\n\ncommit 17b7f7cf58926844e1dd40f5eb5348d481deca6a upstream.\n\nRefuse RW mount of isofs filesystem. So far we just silently changed it\nto RO mount but when the media is writeable, block layer won\u0027t notice\nthis change and thus will think device is used RW and will block eject\nbutton of the drive. That is unexpected by users because for\nnon-writeable media eject button works just fine.\n\nUserspace mount(8) command handles this just fine and retries mounting\nwith MS_RDONLY set so userspace shouldn\u0027t see any regression. Plus any\ntool mounting isofs is likely confronted with the case of read-only\nmedia where block layer already refuses to mount the filesystem without\nMS_RDONLY set so our behavior shouldn\u0027t be anything new for it.\n\nReported-by: Hui Wang \u003chui.wang@canonical.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d778ca56a22b5ca0c96e39db08b4994166d435d6", "tree": "c780b888c0962eda62dcfa22719ef53f757c52a8", "parents": [ "5a20c03a7dc54e3eea59b0be6027b124235b6761" ], "author": { "name": "Libin", "email": "huawei.libin@huawei.com", "time": "Wed Sep 11 14:20:38 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:51 2013 -0700" }, "message": "mm/huge_memory.c: fix potential NULL pointer dereference\n\ncommit a8f531ebc33052642b4bd7b812eedf397108ce64 upstream.\n\nIn collapse_huge_page() there is a race window between releasing the\nmmap_sem read lock and taking the mmap_sem write lock, so find_vma() may\nreturn NULL. So check the return value to avoid NULL pointer dereference.\n\ncollapse_huge_page\n\tkhugepaged_alloc_page\n\t\tup_read(\u0026mm-\u003emmap_sem)\n\tdown_write(\u0026mm-\u003emmap_sem)\n\tvma \u003d find_vma(mm, address)\n\nSigned-off-by: Libin \u003chuawei.libin@huawei.com\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nReviewed-by: Wanpeng Li \u003cliwanp@linux.vnet.ibm.com\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5a20c03a7dc54e3eea59b0be6027b124235b6761", "tree": "77683c26bbafea4d3f56c71d7bccaf825c45f154", "parents": [ "55ee351dc444224f7bb9697a98b2d06e8625f491" ], "author": { "name": "Greg Thelen", "email": "gthelen@google.com", "time": "Wed Sep 11 14:23:08 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:50 2013 -0700" }, "message": "memcg: fix multiple large threshold notifications\n\ncommit 2bff24a3707093c435ab3241c47dcdb5f16e432b upstream.\n\nA memory cgroup with (1) multiple threshold notifications and (2) at least\none threshold \u003e\u003d2G was not reliable. Specifically the notifications would\neither not fire or would not fire in the proper order.\n\nThe __mem_cgroup_threshold() signaling logic depends on keeping 64 bit\nthresholds in sorted order. mem_cgroup_usage_register_event() sorts them\nwith compare_thresholds(), which returns the difference of two 64 bit\nthresholds as an int. If the difference is positive but has bit[31] set,\nthen sort() treats the difference as negative and breaks sort order.\n\nThis fix compares the two arbitrary 64 bit thresholds returning the\nclassic -1, 0, 1 result.\n\nThe test below sets two notifications (at 0x1000 and 0x81001000):\n cd /sys/fs/cgroup/memory\n mkdir x\n for x in 4096 2164264960; do\n cgroup_event_listener x/memory.usage_in_bytes $x | sed \"s/^/$x listener:/\" \u0026\n done\n echo $$ \u003e x/cgroup.procs\n anon_leaker 500M\n\nv3.11-rc7 fails to signal the 4096 event listener:\n Leaking...\n Done leaking pages.\n\nPatched v3.11-rc7 properly notifies:\n Leaking...\n 4096 listener:2013:8:31:14:13:36\n Done leaking pages.\n\nThe fixed bug is old. It appears to date back to the introduction of\nmemcg threshold notifications in v2.6.34-rc1-116-g2e72b6347c94 \"memcg:\nimplement memory thresholds\"\n\nSigned-off-by: Greg Thelen \u003cgthelen@google.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "55ee351dc444224f7bb9697a98b2d06e8625f491", "tree": "fa356512517c9cc95313eb2471151b0ce1a7a85c", "parents": [ "4013fc200b4df078b77d2fc95de3446c65a9957d" ], "author": { "name": "Jie Liu", "email": "jeff.liu@oracle.com", "time": "Wed Sep 11 14:20:05 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:50 2013 -0700" }, "message": "ocfs2: fix the end cluster offset of FIEMAP\n\ncommit 28e8be31803b19d0d8f76216cb11b480b8a98bec upstream.\n\nCall fiemap ioctl(2) with given start offset as well as an desired mapping\nrange should show extents if possible. However, we somehow figure out the\nend offset of mapping via \u0027mapping_end -\u003d cpos\u0027 before iterating the\nextent records which would cause problems if the given fiemap length is\ntoo small to a cluster size, e.g,\n\nCluster size 4096:\ndebugfs.ocfs2 1.6.3\n Block Size Bits: 12 Cluster Size Bits: 12\n\nThe extended fiemap test utility From David:\nhttps://gist.github.com/anonymous/6172331\n\n# dd if\u003d/dev/urandom of\u003d/ocfs2/test_file bs\u003d1M count\u003d1000\n# ./fiemap /ocfs2/test_file 4096 10\nstart: 4096, length: 10\nFile /ocfs2/test_file has 0 extents:\n#\tLogical Physical Length Flags\n\t^^^^^ \u003c-- No extent is shown\n\nIn this case, at ocfs2_fiemap(): cpos \u003d\u003d mapping_end \u003d\u003d 1. Hence the\nloop of searching extent records was not executed at all.\n\nThis patch remove the in question \u0027mapping_end -\u003d cpos\u0027, and loops\nuntil the cpos is larger than the mapping_end as usual.\n\n# ./fiemap /ocfs2/test_file 4096 10\nstart: 4096, length: 10\nFile /ocfs2/test_file has 1 extents:\n#\tLogical Physical Length Flags\n0:\t0000000000000000 0000000056a01000 0000000006a00000 0000\n\nSigned-off-by: Jie Liu \u003cjeff.liu@oracle.com\u003e\nReported-by: David Weber \u003cwb@munzinger.de\u003e\nTested-by: David Weber \u003cwb@munzinger.de\u003e\nCc: Sunil Mushran \u003csunil.mushran@gmail.com\u003e\nCc: Mark Fashen \u003cmfasheh@suse.de\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4013fc200b4df078b77d2fc95de3446c65a9957d", "tree": "11c747b2702cbbf70d0805abd4fdf1947649ff0b", "parents": [ "150189a130c11c4f346fc8bdb211a102d6a0f201" ], "author": { "name": "Alex Williamson", "email": "alex.williamson@redhat.com", "time": "Sat Jun 15 10:27:19 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:50 2013 -0700" }, "message": "intel-iommu: Fix leaks in pagetable freeing\n\ncommit 3269ee0bd6686baf86630300d528500ac5b516d7 upstream.\n\nAt best the current code only seems to free the leaf pagetables and\nthe root. If you\u0027re unlucky enough to have a large gap (like any\nQEMU guest with more than 3G of memory), only the first chunk of leaf\npagetables are freed (plus the root). This is a massive memory leak.\nThis patch re-writes the pagetable freeing function to use a\nrecursive algorithm and manages to not only free all the pagetables,\nbut does it without any apparent performance loss versus the current\nbroken version.\n\nSigned-off-by: Alex Williamson \u003calex.williamson@redhat.com\u003e\nReviewed-by: Marcelo Tosatti \u003cmtosatti@redhat.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoro@8bytes.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "150189a130c11c4f346fc8bdb211a102d6a0f201", "tree": "1827c4930862b634e5f1d266dcecaf4d21488430", "parents": [ "28f9d084175a2e0df088f5d1d9159819762e8534" ], "author": { "name": "Felix Fietkau", "email": "nbd@openwrt.org", "time": "Wed Aug 28 10:41:42 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:50 2013 -0700" }, "message": "MIPS: ath79: Fix ar933x watchdog clock\n\ncommit a1191927ace7e6f827132aa9e062779eb3f11fa5 upstream.\n\nThe watchdog device on the AR933x is connected to\nthe AHB clock, however the current code uses the\nreference clock. Due to the wrong rate, the watchdog\ndriver can\u0027t calculate correct register values for\na given timeout value and the watchdog unexpectedly\nrestarts the system.\n\nThe code uses the wrong value since the initial\ncommit 04225e1d227c8e68d685936ecf42ac175fec0e54\n(MIPS: ath79: add AR933X specific clock init)\n\nThe patch fixes the code to use the correct clock\nrate to avoid the problem.\n\nSigned-off-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nSigned-off-by: Gabor Juhos \u003cjuhosg@openwrt.org\u003e\nCc: linux-mips@linux-mips.org\nPatchwork: https://patchwork.linux-mips.org/patch/5777/\nSigned-off-by: Ralf Baechle \u003cralf@linux-mips.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "28f9d084175a2e0df088f5d1d9159819762e8534", "tree": "c48da7a3766d04e91832b8cf9ec820f019a019d9", "parents": [ "3fb6304439680cd10ae221f5ddfc531147f6a6cd" ], "author": { "name": "Andrzej Hajda", "email": "a.hajda@samsung.com", "time": "Fri Jun 28 05:44:22 2013 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:49 2013 -0700" }, "message": "media: v4l2: added missing mutex.h include to v4l2-ctrls.h\n\ncommit a19dec6ea94c036af68c31930c1c92681f55af41 upstream.\n\nThis patch fixes following error:\ninclude/media/v4l2-ctrls.h:193:15: error: field ‘_lock’ has incomplete type\ninclude/media/v4l2-ctrls.h: In function ‘v4l2_ctrl_lock’:\ninclude/media/v4l2-ctrls.h:570:2: error: implicit declaration of\n\tfunction ‘mutex_lock’ [-Werror\u003dimplicit-function-declaration]\ninclude/media/v4l2-ctrls.h: In function ‘v4l2_ctrl_unlock’:\ninclude/media/v4l2-ctrls.h:579:2: error: implicit declaration of\n\tfunction ‘mutex_unlock’ [-Werror\u003dimplicit-function-declaration]\n\nSigned-off-by: Andrzej Hajda \u003ca.hajda@samsung.com\u003e\nSigned-off-by: Kyungmin Park \u003ckyungmin.park@samsung.com\u003e\nSigned-off-by: Hans Verkuil \u003chans.verkuil@cisco.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cm.chehab@samsung.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3fb6304439680cd10ae221f5ddfc531147f6a6cd", "tree": "2eb9c0123d8551ccfba6adf83eff849d74a4377a", "parents": [ "9d18e13efe885df3c22df16a30d7ebe5b2d89232" ], "author": { "name": "Vasily Titskiy", "email": "qehgt0@gmail.com", "time": "Fri Aug 30 18:25:04 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:49 2013 -0700" }, "message": "HID: usbhid: quirk for N-Trig DuoSense Touch Screen\n\ncommit 9e0bf92c223dabe0789714f8f85f6e26f8f9cda4 upstream.\n\nThe DuoSense touchscreen device causes a 10 second timeout. This fix\nremoves the delay.\n\nSigned-off-by: Vasily Titskiy \u003cqehgt0@gmail.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9d18e13efe885df3c22df16a30d7ebe5b2d89232", "tree": "3bff9cb989415299959c19bebeb6f7c32d238e4a", "parents": [ "735b7d0c03d9535a1fc74ba8fa4beccdf7ab949d" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Aug 28 22:32:01 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:49 2013 -0700" }, "message": "HID: check for NULL field when setting values\n\ncommit be67b68d52fa28b9b721c47bb42068f0c1214855 upstream.\n\nDefensively check that the field to be worked on is not NULL.\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "735b7d0c03d9535a1fc74ba8fa4beccdf7ab949d", "tree": "abfaac145ee89d1017054db1d28a5fae7f54f368", "parents": [ "2dbe9ce6b7d6aeb1e6ba320837a55fb2cf194e17" ], "author": { "name": "Jiri Kosina", "email": "jkosina@suse.cz", "time": "Mon Sep 02 13:43:00 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:49 2013 -0700" }, "message": "HID: battery: don\u0027t do DMA from stack\n\ncommit 6c2794a2984f4c17a58117a68703cc7640f01c5a upstream.\n\nInstead of using data from stack for DMA in hidinput_get_battery_property(),\nallocate the buffer dynamically.\n\nReported-by: Richard Ryniker \u003cryniker@alum.mit.edu\u003e\nReported-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2dbe9ce6b7d6aeb1e6ba320837a55fb2cf194e17", "tree": "18d92f875600c4a6eed2d55bc09c28fe04b2cae1", "parents": [ "676bb9a417ceec66576daeb24aed2184a82ef544" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Aug 28 22:31:28 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:36 2013 -0700" }, "message": "HID: ntrig: validate feature report details\n\ncommit 875b4e3763dbc941f15143dd1a18d10bb0be303b upstream.\n\nA HID device could send a malicious feature report that would cause the\nntrig HID driver to trigger a NULL dereference during initialization:\n\n[57383.031190] usb 3-1: New USB device found, idVendor\u003d1b96, idProduct\u003d0001\n...\n[57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030\n[57383.315308] IP: [\u003cffffffffa08102de\u003e] ntrig_probe+0x25e/0x420 [hid_ntrig]\n\nCVE-2013-2896\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Rafi Rubin \u003crafi@seas.upenn.edu\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "676bb9a417ceec66576daeb24aed2184a82ef544", "tree": "0fe1e2fc2906db54dd98ffd118a4dd94be056a2e", "parents": [ "355c557b3e0164eaf75aded30e92da5a3a818c5f" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Aug 28 22:29:55 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:34 2013 -0700" }, "message": "HID: validate HID report id size\n\ncommit 43622021d2e2b82ea03d883926605bdd0525e1d1 upstream.\n\nThe \"Report ID\" field of a HID report is used to build indexes of\nreports. The kernel\u0027s index of these is limited to 256 entries, so any\nmalicious device that sets a Report ID greater than 255 will trigger\nmemory corruption on the host:\n\n[ 1347.156239] BUG: unable to handle kernel paging request at ffff88094958a878\n[ 1347.156261] IP: [\u003cffffffff813e4da0\u003e] hid_register_report+0x2a/0x8b\n\nCVE-2013-2888\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "355c557b3e0164eaf75aded30e92da5a3a818c5f", "tree": "562b3d01217c4d9860231dcc5d273e85f880935d", "parents": [ "f09344e3369f147b5c2c91e57ef2e91e2b7e8320" ], "author": { "name": "Stefan Kriwanek", "email": "dev@stefankriwanek.de", "time": "Sun Aug 25 10:46:13 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:34 2013 -0700" }, "message": "HID: Fix Speedlink VAD Cezanne support for some devices\n\ncommit 06bb5219118fb098f4b0c7dcb484b28a52bf1c14 upstream.\n\nSome devices of the \"Speedlink VAD Cezanne\" model need more aggressive fixing\nthan already done.\n\nI made sure through testing that this patch would not interfere with the proper\nworking of a device that is bug-free. (The driver drops EV_REL events with\nabs(val) \u003e\u003d 256, which are not achievable even on the highest laser resolution\nhardware setting.)\n\nSigned-off-by: Stefan Kriwanek \u003cmail@stefankriwanek.de\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f09344e3369f147b5c2c91e57ef2e91e2b7e8320", "tree": "af26edc0b50795e3333c95b8149f5bcf4736e0b4", "parents": [ "08c44ff3a4f24f11a05d9d7969f2d2cd7471beba" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Aug 28 22:30:49 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:34 2013 -0700" }, "message": "HID: pantherlord: validate output report details\n\ncommit 412f30105ec6735224535791eed5cdc02888ecb4 upstream.\n\nA HID device could send a malicious output report that would cause the\npantherlord HID driver to write beyond the output report allocation\nduring initialization, causing a heap overflow:\n\n[ 310.939483] usb 1-1: New USB device found, idVendor\u003d0e8f, idProduct\u003d0003\n...\n[ 315.980774] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten\n\nCVE-2013-2892\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "08c44ff3a4f24f11a05d9d7969f2d2cd7471beba", "tree": "cb5f9a173c6a906b1f36a67a1d498bb785300bb7", "parents": [ "0f528a11451069fc6ea66c40fb9ab518e9d335b3" ], "author": { "name": "Felix Fietkau", "email": "nbd@openwrt.org", "time": "Tue Aug 13 12:33:28 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:33 2013 -0700" }, "message": "ath9k: avoid accessing MRC registers on single-chain devices\n\ncommit a1c781bb20ac1e03280e420abd47a99eb8bbdd3b upstream.\n\nThey are not implemented, and accessing them might trigger errors\n\nSigned-off-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0f528a11451069fc6ea66c40fb9ab518e9d335b3", "tree": "3c123a4b9ce7c98bf48546025fe7ba3d5be7e919", "parents": [ "ad9e765fb1973bf8458f4d5ad88b59040992e0e3" ], "author": { "name": "Felix Fietkau", "email": "nbd@openwrt.org", "time": "Sat Aug 10 15:59:15 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:33 2013 -0700" }, "message": "ath9k: fix rx descriptor related race condition\n\ncommit e96542e55a2aacf4bdeccfe2f17b77c4895b4df2 upstream.\n\nSimilar to a race condition that exists in the tx path, the hardware\nmight re-read the \u0027next\u0027 pointer of a descriptor of the last completed\nframe. This only affects non-EDMA (pre-AR93xx) devices.\n\nTo deal with this race, defer clearing and re-linking a completed rx\ndescriptor until the next one has been processed.\n\nSigned-off-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ad9e765fb1973bf8458f4d5ad88b59040992e0e3", "tree": "1623a15648ef22f0858df94f18f6061c496f1c79", "parents": [ "1df8b64670c1a8e848ff514d3640fffeb14e2435" ], "author": { "name": "Felix Fietkau", "email": "nbd@openwrt.org", "time": "Tue Aug 06 14:18:10 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:33 2013 -0700" }, "message": "ath9k: always clear ps filter bit on new assoc\n\ncommit 026d5b07c03458f9c0ccd19c3850564a5409c325 upstream.\n\nOtherwise in some cases, EAPOL frames might be filtered during the\ninitial handshake, causing delays and assoc failures.\n\nSigned-off-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1df8b64670c1a8e848ff514d3640fffeb14e2435", "tree": "1e7a88c158296947ca1f4120358742595ec44083", "parents": [ "bd925e29c6f5d68ee7ae35789c8a556354dd801b" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Fri Aug 09 13:36:21 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:33 2013 -0700" }, "message": "brcmsmac: Fix WARNING caused by lack of calls to dma_mapping_error()\n\ncommit 67d0cf50bd32b66eab709871714e55725ee30ce4 upstream.\n\nThe driver fails to check the results of DMA mapping in twp places,\nwhich results in the following warning:\n\n[ 28.078515] ------------[ cut here ]------------\n[ 28.078529] WARNING: at lib/dma-debug.c:937 check_unmap+0x47e/0x930()\n[ 28.078533] bcma-pci-bridge 0000:0e:00.0: DMA-API: device driver failed to check map error[device address\u003d0x00000000b5d60d6c] [size\u003d1876 bytes] [mapped as\n single]\n[ 28.078536] Modules linked in: bnep bluetooth vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) ipv6 b43 brcmsmac rtl8192cu rtl8192c_common rtlwifi mac802\n11 brcmutil cfg80211 snd_hda_codec_conexant rng_core snd_hda_intel kvm_amd snd_hda_codec ssb kvm mmc_core snd_pcm snd_seq snd_timer snd_seq_device snd k8temp\n cordic joydev serio_raw hwmon sr_mod sg pcmcia pcmcia_core soundcore cdrom i2c_nforce2 i2c_core forcedeth bcma snd_page_alloc autofs4 ext4 jbd2 mbcache crc1\n6 scsi_dh_alua scsi_dh_hp_sw scsi_dh_rdac scsi_dh_emc scsi_dh ata_generic pata_amd\n[ 28.078602] CPU: 1 PID: 2570 Comm: NetworkManager Tainted: G O 3.10.0-rc7-wl+ #42\n[ 28.078605] Hardware name: Hewlett-Packard HP Pavilion dv2700 Notebook PC/30D6, BIOS F.27 11/27/2008\n[ 28.078607] 0000000000000009 ffff8800bbb03ad8 ffffffff8144f898 ffff8800bbb03b18\n[ 28.078612] ffffffff8103e1eb 0000000000000002 ffff8800b719f480 ffff8800b7b9c010\n[ 28.078617] ffffffff824204c0 ffffffff81754d57 0000000000000754 ffff8800bbb03b78\n[ 28.078622] Call Trace:\n[ 28.078624] \u003cIRQ\u003e [\u003cffffffff8144f898\u003e] dump_stack+0x19/0x1b\n[ 28.078634] [\u003cffffffff8103e1eb\u003e] warn_slowpath_common+0x6b/0xa0\n[ 28.078638] [\u003cffffffff8103e2c1\u003e] warn_slowpath_fmt+0x41/0x50\n[ 28.078650] [\u003cffffffff8122d7ae\u003e] check_unmap+0x47e/0x930\n[ 28.078655] [\u003cffffffff8122de4c\u003e] debug_dma_unmap_page+0x5c/0x70\n[ 28.078679] [\u003cffffffffa04a808c\u003e] dma64_getnextrxp+0x10c/0x190 [brcmsmac]\n[ 28.078691] [\u003cffffffffa04a9042\u003e] dma_rx+0x62/0x240 [brcmsmac]\n[ 28.078707] [\u003cffffffffa0479101\u003e] brcms_c_dpc+0x211/0x9d0 [brcmsmac]\n[ 28.078717] [\u003cffffffffa046d927\u003e] ? brcms_dpc+0x27/0xf0 [brcmsmac]\n[ 28.078731] [\u003cffffffffa046d947\u003e] brcms_dpc+0x47/0xf0 [brcmsmac]\n[ 28.078736] [\u003cffffffff81047dcc\u003e] tasklet_action+0x6c/0xf0\n--snip--\n[ 28.078974] [\u003cffffffff813891bd\u003e] SyS_sendmsg+0xd/0x20\n[ 28.078979] [\u003cffffffff81455c24\u003e] tracesys+0xdd/0xe2\n[ 28.078982] ---[ end trace 6164d1a08148e9c8 ]---\n[ 28.078984] Mapped at:\n[ 28.078985] [\u003cffffffff8122c8fd\u003e] debug_dma_map_page+0x9d/0x150\n[ 28.078989] [\u003cffffffffa04a9322\u003e] dma_rxfill+0x102/0x3d0 [brcmsmac]\n[ 28.079001] [\u003cffffffffa047a13d\u003e] brcms_c_init+0x87d/0x1100 [brcmsmac]\n[ 28.079010] [\u003cffffffffa046d851\u003e] brcms_init+0x21/0x30 [brcmsmac]\n[ 28.079018] [\u003cffffffffa04786e0\u003e] brcms_c_up+0x150/0x430 [brcmsmac]\n\nAs the patch adds a new failure mechanism to dma_rxfill(). When I changed the\ncomment at the start of the routine to add that information, I also polished\nthe wording.\n\nSigned-off-by: Larry Finger \u003cLarry.Finger@lwfinger.net\u003e\nCc: Brett Rudley \u003cbrudley@broadcom.com\u003e\nCc: Franky (Zhenhui) Lin \u003cfrankyl@broadcom.com\u003e\nCc: Hante Meuleman \u003cmeuleman@broadcom.com\u003e\nCc: brcm80211-dev-list@broadcom.com\nAcked-by: Arend van Spriel \u003carend@broadcom.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bd925e29c6f5d68ee7ae35789c8a556354dd801b", "tree": "2745c448862b88a301e1ae7a123847233e05ab38", "parents": [ "64c2a17997fe074edc5c10d8f687ba590c2c2572" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Mon Sep 09 10:20:48 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:33 2013 -0700" }, "message": "ALSA: hda - Add Toshiba Satellite C870 to MSI blacklist\n\ncommit 83f72151352791836a1b9c1542614cc9bf71ac61 upstream.\n\nToshiba Satellite C870 shows interrupt problems occasionally when\ncertain mixer controls like \"Mic Switch\" is toggled. This seems\nworked around by not using MSI.\n\nBugzilla: https://bugzilla.novell.com/show_bug.cgi?id\u003d833585\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "64c2a17997fe074edc5c10d8f687ba590c2c2572", "tree": "99891eda840d41cc102df1ec183361d612e3bbdb", "parents": [ "a7179b89a68c7cb6f8623cedcce02b98d9e072a1" ], "author": { "name": "Mike Dyer", "email": "mike.dyer@md-soft.co.uk", "time": "Fri Aug 16 18:36:28 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:33 2013 -0700" }, "message": "ASoC: wm8960: Fix PLL register writes\n\ncommit 85fa532b6ef920b32598df86b194571a7059a77c upstream.\n\nBit 9 of PLL2,3 and 4 is reserved as \u00270\u0027. The 24bit fractional part\nshould be split across each register in 8bit chunks.\n\nSigned-off-by: Mike Dyer \u003cmike.dyer@md-soft.co.uk\u003e\nSigned-off-by: Mark Brown \u003cbroonie@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a7179b89a68c7cb6f8623cedcce02b98d9e072a1", "tree": "7518b03360ce858e94f7bf57dbe855ca54847d65", "parents": [ "38a0864499c5a2b092e3ef065d9333acf2600e82" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Jun 28 10:34:48 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:32 2013 -0700" }, "message": "rculist: list_first_or_null_rcu() should use list_entry_rcu()\n\ncommit c34ac00caefbe49d40058ae7200bd58725cebb45 upstream.\n\nlist_first_or_null() should test whether the list is empty and return\npointer to the first entry if not in a RCU safe manner. It\u0027s broken\nin several ways.\n\n* It compares __kernel @__ptr with __rcu @__next triggering the\n following sparse warning.\n\n net/core/dev.c:4331:17: error: incompatible types in comparison expression (different address spaces)\n\n* It doesn\u0027t perform rcu_dereference*() and computes the entry address\n using container_of() directly from the __rcu pointer which is\n inconsitent with other rculist interface. As a result, all three\n in-kernel users - net/core/dev.c, macvlan, cgroup - are buggy. They\n dereference the pointer w/o going through read barrier.\n\n* While -\u003enext dereference passes through list_next_rcu(), the\n compiler is still free to fetch -\u003enext more than once and thus\n nullify the \"__ptr !\u003d __next\" condition check.\n\nFix it by making list_first_or_null_rcu() dereference -\u003enext directly\nusing ACCESS_ONCE() and then use list_entry_rcu() on it like other\nrculist accessors.\n\nv2: Paul pointed out that the compiler may fetch the pointer more than\n once nullifying the condition check. ACCESS_ONCE() added on\n -\u003enext dereference.\n\nv3: Restored () around macro param which was accidentally removed.\n Spotted by Paul.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nCc: Dipankar Sarma \u003cdipankar@in.ibm.com\u003e\nCc: \"Paul E. McKenney\" \u003cpaulmck@linux.vnet.ibm.com\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nCc: Patrick McHardy \u003ckaber@trash.net\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nReviewed-by: Josh Triplett \u003cjosh@joshtriplett.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "38a0864499c5a2b092e3ef065d9333acf2600e82", "tree": "cc646b11ee68a86585cae1183c3476b58c55c423", "parents": [ "e200d6be9b4d00e89ace0af82787eb9fc70bdaa9" ], "author": { "name": "Hans de Goede", "email": "hdegoede@redhat.com", "time": "Sat Aug 03 16:37:48 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:32 2013 -0700" }, "message": "usb: config-\u003edesc.bLength may not exceed amount of data returned by the device\n\ncommit b4f17a488ae2e09bfcf95c0e0b4219c246f1116a upstream.\n\nWhile reading the config parsing code I noticed this check is missing, without\nthis check config-\u003edesc.wTotalLength can end up with a value larger then the\ndev-\u003erawdescriptors length for the config, and when userspace then tries to\nget the rawdescriptors bad things may happen.\n\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e200d6be9b4d00e89ace0af82787eb9fc70bdaa9", "tree": "63d305ef499e0842231cee7843a5248b46c35704", "parents": [ "0b25f9294369fe3bc77fad02f744bec01aea8386" ], "author": { "name": "Oliver Neukum", "email": "oneukum@suse.de", "time": "Tue Aug 06 14:22:59 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:32 2013 -0700" }, "message": "USB: cdc-wdm: fix race between interrupt handler and tasklet\n\ncommit 6dd433e6cf2475ce8abec1b467720858c24450eb upstream.\n\nBoth could want to submit the same URB. Some checks of the flag\nintended to prevent that were missing.\n\nSigned-off-by: Oliver Neukum \u003coneukum@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0b25f9294369fe3bc77fad02f744bec01aea8386", "tree": "075212a5c0fb6e493c2631023082d8072fcb8c94", "parents": [ "23595cb6f4e514ea6cef043812bd9c4e097644ff" ], "author": { "name": "Daniel Mack", "email": "zonque@gmail.com", "time": "Wed Aug 21 11:17:21 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:32 2013 -0700" }, "message": "usb: ehci-mxc: check for pdata before dereferencing\n\ncommit f375fc520d4df0cd9fcb570f33c103c6c0311f9e upstream.\n\nCommit 7e8d5cd93fac (\"USB: Add EHCI support for MX27 and MX31 based\nboards\") introduced code that could potentially lead to a NULL pointer\ndereference on driver removal.\n\nFix this by checking for the value of pdata before dereferencing it.\n\nSigned-off-by: Daniel Mack \u003czonque@gmail.com\u003e\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "23595cb6f4e514ea6cef043812bd9c4e097644ff", "tree": "44ca0a89dd874f3cd590e09450cd7d582aeb380d", "parents": [ "659158c56cdc169455bfc43d795a488fb703b747" ], "author": { "name": "Johan Hovold", "email": "jhovold@gmail.com", "time": "Mon Aug 19 13:05:45 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:31 2013 -0700" }, "message": "USB: mos7720: fix big-endian control requests\n\ncommit 3b716caf190ccc6f2a09387210e0e6a26c1d81a4 upstream.\n\nFix endianess bugs in parallel-port code which caused corrupt\ncontrol-requests to be issued on big-endian machines.\n\nReported-by: kbuild test robot \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "659158c56cdc169455bfc43d795a488fb703b747", "tree": "54bf89f1bdef74081f3755c48a81dbe0064f9f8a", "parents": [ "b9ba2a57551649a3386acf0fb54255e5b042bd43" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Fri Aug 16 10:16:59 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:31 2013 -0700" }, "message": "USB: mos7720: use GFP_ATOMIC under spinlock\n\ncommit d0bd9a41186e076ea543c397ad8a67a6cf604b55 upstream.\n\nThe write_parport_reg_nonblock() function shouldn\u0027t sleep because it\u0027s\ncalled with spinlocks held.\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Johan Hovold \u003cjhovold@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b9ba2a57551649a3386acf0fb54255e5b042bd43", "tree": "f9960e58e39dda01a7a0c418108dec5ca2e73317", "parents": [ "b11dc97469e8cf6776c82d2cfe975cf8aa1bd51d" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Tue Aug 20 11:57:35 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:31 2013 -0700" }, "message": "staging: comedi: dt282x: dt282x_ai_insn_read() always fails\n\ncommit 2c4283ca7cdcc6605859c836fc536fcd83a4525f upstream.\n\nIn dt282x_ai_insn_read() we call this macro like:\nwait_for(!mux_busy(), comedi_error(dev, \"timeout\\n\"); return -ETIME;);\nBecause the if statement doesn\u0027t have curly braces it means we always\nreturn -ETIME and the function never succeeds.\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Ian Abbott \u003cabbotti@mev.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b11dc97469e8cf6776c82d2cfe975cf8aa1bd51d", "tree": "f13610d456a3040e4b8ee9244c032f76f3ec9590", "parents": [ "8d1c1a3145ef78b17c3b46d6ee2ccf7f775456da" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Thu Sep 05 08:38:10 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:31 2013 -0700" }, "message": "cifs: ensure that srv_mutex is held when dealing with ssocket pointer\n\ncommit 73e216a8a42c0ef3d08071705c946c38fdbe12b0 upstream.\n\nOleksii reported that he had seen an oops similar to this:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000088\nIP: [\u003cffffffff814dcc13\u003e] sock_sendmsg+0x93/0xd0\nPGD 0\nOops: 0000 [#1] PREEMPT SMP\nModules linked in: ipt_MASQUERADE xt_REDIRECT xt_tcpudp iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack ip_tables x_tables carl9170 ath usb_storage f2fs nfnetlink_log nfnetlink md4 cifs dns_resolver hid_generic usbhid hid af_packet uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_core videodev rfcomm btusb bnep bluetooth qmi_wwan qcserial cdc_wdm usb_wwan usbnet usbserial mii snd_hda_codec_hdmi snd_hda_codec_realtek iwldvm mac80211 coretemp intel_powerclamp kvm_intel kvm iwlwifi snd_hda_intel cfg80211 snd_hda_codec xhci_hcd e1000e ehci_pci snd_hwdep sdhci_pci snd_pcm ehci_hcd microcode psmouse sdhci thinkpad_acpi mmc_core i2c_i801 pcspkr usbcore hwmon snd_timer snd_page_alloc snd ptp rfkill pps_core soundcore evdev usb_common vboxnetflt(O) vboxdrv(O)Oops#2 Part8\n loop tun binfmt_misc fuse msr acpi_call(O) ipv6 autofs4\nCPU: 0 PID: 21612 Comm: kworker/0:1 Tainted: G W O 3.10.1SIGN #28\nHardware name: LENOVO 2306CTO/2306CTO, BIOS G2ET92WW (2.52 ) 02/22/2013\nWorkqueue: cifsiod cifs_echo_request [cifs]\ntask: ffff8801e1f416f0 ti: ffff880148744000 task.ti: ffff880148744000\nRIP: 0010:[\u003cffffffff814dcc13\u003e] [\u003cffffffff814dcc13\u003e] sock_sendmsg+0x93/0xd0\nRSP: 0000:ffff880148745b00 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff880148745b78 RCX: 0000000000000048\nRDX: ffff880148745c90 RSI: ffff880181864a00 RDI: ffff880148745b78\nRBP: ffff880148745c48 R08: 0000000000000048 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff880181864a00\nR13: ffff880148745c90 R14: 0000000000000048 R15: 0000000000000048\nFS: 0000000000000000(0000) GS:ffff88021e200000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000088 CR3: 000000020c42c000 CR4: 00000000001407b0\nOops#2 Part7\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nStack:\n ffff880148745b30 ffffffff810c4af9 0000004848745b30 ffff880181864a00\n ffffffff81ffbc40 0000000000000000 ffff880148745c90 ffffffff810a5aab\n ffff880148745bc0 ffffffff81ffbc40 ffff880148745b60 ffffffff815a9fb8\nCall Trace:\n [\u003cffffffff810c4af9\u003e] ? finish_task_switch+0x49/0xe0\n [\u003cffffffff810a5aab\u003e] ? lock_timer_base.isra.36+0x2b/0x50\n [\u003cffffffff815a9fb8\u003e] ? _raw_spin_unlock_irqrestore+0x18/0x40\n [\u003cffffffff810a673f\u003e] ? try_to_del_timer_sync+0x4f/0x70\n [\u003cffffffff815aa38f\u003e] ? _raw_spin_unlock_bh+0x1f/0x30\n [\u003cffffffff814dcc87\u003e] kernel_sendmsg+0x37/0x50\n [\u003cffffffffa081a0e0\u003e] smb_send_kvec+0xd0/0x1d0 [cifs]\n [\u003cffffffffa081a263\u003e] smb_send_rqst+0x83/0x1f0 [cifs]\n [\u003cffffffffa081ab6c\u003e] cifs_call_async+0xec/0x1b0 [cifs]\n [\u003cffffffffa08245e0\u003e] ? free_rsp_buf+0x40/0x40 [cifs]\nOops#2 Part6\n [\u003cffffffffa082606e\u003e] SMB2_echo+0x8e/0xb0 [cifs]\n [\u003cffffffffa0808789\u003e] cifs_echo_request+0x79/0xa0 [cifs]\n [\u003cffffffff810b45b3\u003e] process_one_work+0x173/0x4a0\n [\u003cffffffff810b52a1\u003e] worker_thread+0x121/0x3a0\n [\u003cffffffff810b5180\u003e] ? manage_workers.isra.27+0x2b0/0x2b0\n [\u003cffffffff810bae00\u003e] kthread+0xc0/0xd0\n [\u003cffffffff810bad40\u003e] ? kthread_create_on_node+0x120/0x120\n [\u003cffffffff815b199c\u003e] ret_from_fork+0x7c/0xb0\n [\u003cffffffff810bad40\u003e] ? kthread_create_on_node+0x120/0x120\nCode: 84 24 b8 00 00 00 4c 89 f1 4c 89 ea 4c 89 e6 48 89 df 4c 89 60 18 48 c7 40 28 00 00 00 00 4c 89 68 30 44 89 70 14 49 8b 44 24 28 \u003cff\u003e 90 88 00 00 00 3d ef fd ff ff 74 10 48 8d 65 e0 5b 41 5c 41\n RIP [\u003cffffffff814dcc13\u003e] sock_sendmsg+0x93/0xd0\n RSP \u003cffff880148745b00\u003e\nCR2: 0000000000000088\n\nThe client was in the middle of trying to send a frame when the\nserver-\u003essocket pointer got zeroed out. In most places, that we access\nthat pointer, the srv_mutex is held. There\u0027s only one spot that I see\nthat the server-\u003essocket pointer gets set and the srv_mutex isn\u0027t held.\nThis patch corrects that.\n\nThe upstream bug report was here:\n\n https://bugzilla.kernel.org/show_bug.cgi?id\u003d60557\n\nReported-by: Oleksii Shevchuk \u003calxchk@gmail.com\u003e\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Steve French \u003csmfrench@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8d1c1a3145ef78b17c3b46d6ee2ccf7f775456da", "tree": "d5b94fde4c74d928b443019d79e084ed6166140b", "parents": [ "df5831d26dcf04c575b3a4d43b3247a1c578aa10" ], "author": { "name": "Shawn Nematbakhsh", "email": "shawnn@chromium.org", "time": "Mon Aug 19 10:36:13 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:31 2013 -0700" }, "message": "usb: xhci: Disable runtime PM suspend for quirky controllers\n\ncommit c8476fb855434c733099079063990e5bfa7ecad6 upstream.\n\nIf a USB controller with XHCI_RESET_ON_RESUME goes to runtime suspend,\na reset will be performed upon runtime resume. Any previously suspended\ndevices attached to the controller will be re-enumerated at this time.\nThis will cause problems, for example, if an open system call on the\ndevice triggered the resume (the open call will fail).\n\nNote that this change is only relevant when persist_enabled is not set\nfor USB devices.\n\nThis patch should be backported to kernels as old as 3.0, that\ncontain the commit c877b3b2ad5cb9d4fe523c5496185cc328ff3ae9 \"xhci: Add\nreset on resume quirk for asrock p67 host\".\n\nSigned-off-by: Shawn Nematbakhsh \u003cshawnn@chromium.org\u003e\nSigned-off-by: Sarah Sharp \u003csarah.a.sharp@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "df5831d26dcf04c575b3a4d43b3247a1c578aa10", "tree": "49994037d5a2eb092ee3a05907c44d7eef63f45d", "parents": [ "5aea7495c35989747bddf461cd400017698a6bd7" ], "author": { "name": "Sarah Sharp", "email": "sarah.a.sharp@linux.intel.com", "time": "Thu Aug 08 10:08:34 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:30 2013 -0700" }, "message": "xhci-plat: Don\u0027t enable legacy PCI interrupts.\n\ncommit 52fb61250a7a132b0cfb9f4a1060a1f3c49e5a25 upstream.\n\nThe xHCI platform driver calls into usb_add_hcd to register the irq for\nits platform device. It does not want the xHCI generic driver to\nregister an interrupt for it at all. The original code did that by\nsetting the XHCI_BROKEN_MSI quirk, which tells the xHCI driver to not\nenable MSI or MSI-X for a PCI host.\n\nUnfortunately, if CONFIG_PCI is enabled, and CONFIG_USB_DW3 is enabled,\nthe xHCI generic driver will attempt to register a legacy PCI interrupt\nfor the xHCI platform device in xhci_try_enable_msi(). This will result\nin a bogus irq being registered, since the underlying device is a\nplatform_device, not a pci_device, and thus the pci_device-\u003eirq pointer\nwill be bogus.\n\nAdd a new quirk, XHCI_PLAT, so that the xHCI generic driver can\ndistinguish between a PCI device that can\u0027t handle MSI or MSI-X, and a\nplatform device that should not have its interrupts touched at all.\nThis quirk may be useful in the future, in case other corner cases like\nthis arise.\n\nThis patch should be backported to kernels as old as 3.9, that\ncontain the commit 00eed9c814cb8f281be6f0f5d8f45025dc0a97eb \"USB: xhci:\ncorrectly enable interrupts\".\n\nSigned-off-by: Sarah Sharp \u003csarah.a.sharp@linux.intel.com\u003e\nReported-by: Yu Y Wang \u003cyu.y.wang@intel.com\u003e\nTested-by: Yu Y Wang \u003cyu.y.wang@intel.com\u003e\nReviewed-by: Felipe Balbi \u003cbalbi@ti.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5aea7495c35989747bddf461cd400017698a6bd7", "tree": "ec57fef434ef6f5db30b3d08b383f3d2d4724bf5", "parents": [ "9fd2380271ba372254ffee4b92745a169311d4ae" ], "author": { "name": "Peter Maydell", "email": "peter.maydell@linaro.org", "time": "Thu Aug 22 17:47:50 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:30 2013 -0700" }, "message": "ARM: PCI: versatile: Fix SMAP register offsets\n\ncommit 99f2b130370b904ca5300079243fdbcafa2c708b upstream.\n\nThe SMAP register offsets in the versatile PCI controller code were\nall off by four. (This didn\u0027t have any observable bad effects\nbecause on this board PHYS_OFFSET is zero, and (a) writing zero to\nthe flags register at offset 0x10 has no effect and (b) the reset\nvalue of the SMAP register is zero anyway, so failing to write SMAP2\ndidn\u0027t matter.)\n\nSigned-off-by: Peter Maydell \u003cpeter.maydell@linaro.org\u003e\nReviewed-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Kevin Hilman \u003ckhilman@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9fd2380271ba372254ffee4b92745a169311d4ae", "tree": "401f5fcd523a7593291552a2fcecf2400db46fca", "parents": [ "774620ba0d5c80f92d9949a54a029cf41b116c57" ], "author": { "name": "Roger Pau Monne", "email": "roger.pau@citrix.com", "time": "Wed Jul 31 17:00:42 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:30 2013 -0700" }, "message": "xen-gnt: prevent adding duplicate gnt callbacks\n\ncommit 5f338d9001094a56cf87bd8a280b4e7ff953bb59 upstream.\n\nWith the current implementation, the callback in the tail of the list\ncan be added twice, because the check done in\ngnttab_request_free_callback is bogus, callback-\u003enext can be NULL if\nit is the last callback in the list. If we add the same callback twice\nwe end up with an infinite loop, were callback \u003d\u003d callback-\u003enext.\n\nReplace this check with a proper one that iterates over the list to\nsee if the callback has already been added.\n\nSigned-off-by: Roger Pau Monné \u003croger.pau@citrix.com\u003e\nCc: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nCc: David Vrabel \u003cdavid.vrabel@citrix.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nAcked-by: Matt Wilson \u003cmsw@amazon.com\u003e\nReviewed-by: David Vrabel \u003cdavid.vrabel@citrix.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "774620ba0d5c80f92d9949a54a029cf41b116c57", "tree": "191beb00298ec09bccd5beca22d00be7df5cf49f", "parents": [ "d2fb5fcd0e84f7e23467ddfb80280c00798aee4c" ], "author": { "name": "Anton Blanchard", "email": "anton@samba.org", "time": "Wed Aug 07 02:01:19 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:30 2013 -0700" }, "message": "powerpc: Handle unaligned ldbrx/stdbrx\n\ncommit 230aef7a6a23b6166bd4003bfff5af23c9bd381f upstream.\n\nNormally when we haven\u0027t implemented an alignment handler for\na load or store instruction the process will be terminated.\n\nThe alignment handler uses the DSISR (or a pseudo one) to locate\nthe right handler. Unfortunately ldbrx and stdbrx overlap lfs and\nstfs so we incorrectly think ldbrx is an lfs and stdbrx is an\nstfs.\n\nThis bug is particularly nasty - instead of terminating the\nprocess we apply an incorrect fixup and continue on.\n\nWith more and more overlapping instructions we should stop\ncreating a pseudo DSISR and index using the instruction directly,\nbut for now add a special case to catch ldbrx/stdbrx.\n\nSigned-off-by: Anton Blanchard \u003canton@samba.org\u003e\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d2fb5fcd0e84f7e23467ddfb80280c00798aee4c", "tree": "69a54676815476c7dba0b1037d1026af3d965eb1", "parents": [ "8283dfa4d7864d1a1cbafbe0b89d83fdbf6204ae" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Sun Sep 08 14:33:50 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:30 2013 -0700" }, "message": "crypto: api - Fix race condition in larval lookup\n\ncommit 77dbd7a95e4a4f15264c333a9e9ab97ee27dc2aa upstream.\n\ncrypto_larval_lookup should only return a larval if it created one.\nAny larval created by another entity must be processed through\ncrypto_larval_wait before being returned.\n\nOtherwise this will lead to a larval being killed twice, which\nwill most likely lead to a crash.\n\nReported-by: Kees Cook \u003ckeescook@chromium.org\u003e\nTested-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8283dfa4d7864d1a1cbafbe0b89d83fdbf6204ae", "tree": "8c00d35874bbb37ae0f56a0c961696ddb9bd9605", "parents": [ "d10b95b412369a7f1d437304db7d02d41fe33e22" ], "author": { "name": "Alan Stern", "email": "stern@rowland.harvard.edu", "time": "Fri Sep 06 11:49:51 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:29 2013 -0700" }, "message": "SCSI: sd: Fix potential out-of-bounds access\n\ncommit 984f1733fcee3fbc78d47e26c5096921c5d9946a upstream.\n\nThis patch fixes an out-of-bounds error in sd_read_cache_type(), found\nby Google\u0027s AddressSanitizer tool. When the loop ends, we know that\n\"offset\" lies beyond the end of the data in the buffer, so no Caching\nmode page was found. In theory it may be present, but the buffer size\nis limited to 512 bytes.\n\nSigned-off-by: Alan Stern \u003cstern@rowland.harvard.edu\u003e\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d10b95b412369a7f1d437304db7d02d41fe33e22", "tree": "39eb23ed7c42c42cc0129ae75bacb54f34a0b819", "parents": [ "5e1f777d673a7d618087f093d1ca551da118d34b" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:37 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:37 2013 -0700" }, "message": "Linux 3.4.62\n" }, { "commit": "5e1f777d673a7d618087f093d1ca551da118d34b", "tree": "af38e08622cc03485104d780092fdfaaf25fbdbf", "parents": [ "f37d940d1b9a0104b857fee8dd2b934cb05dcdfb" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 12 09:53:11 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:11 2013 -0700" }, "message": "Revert \"KVM: X86 emulator: fix source operand decoding for 8bit mov[zs]x instructions\"\n\nThis reverts commit 5b5b30580218eae22609989546bac6e44d0eda6e, which was\ncommit 660696d1d16a71e15549ce1bf74953be1592bcd3 upstream.\n\nPaul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e writes:\n\n[this patch] introduces the following:\n\narch/x86/kvm/emulate.c: In function ‘decode_operand’:\narch/x86/kvm/emulate.c:3974:4: warning: passing argument 1 of ‘decode_register’ makes integer from pointer\n+without a cast [enabled by default]\narch/x86/kvm/emulate.c:789:14: note: expected ‘u8’ but argument is of type ‘struct x86_emulate_ctxt *’\narch/x86/kvm/emulate.c:3974:4: warning: passing argument 2 of ‘decode_register’ makes pointer from integer\n+without a cast [enabled by default]\narch/x86/kvm/emulate.c:789:14: note: expected ‘long unsigned int *’ but argument is of type ‘u8’\n\nBased on the severity of the warnings above, I\u0027m reasonably sure there will\nbe some kind of runtime regressions due to this, but I stopped to investigate\nthe warnings as soon as I saw them, before any run time testing.\n\nIt happens because mainline v3.7-rc1~113^2~40 (dd856efafe60) does this:\n\n-static void *decode_register(u8 modrm_reg, unsigned long *regs,\n+static void *decode_register(struct x86_emulate_ctxt *ctxt, u8 modrm_reg,\n\nSince 660696d1d16a71e1 was only applied to stable 3.4, 3.8, and 3.9 -- and\nthe prerequisite above is in 3.7+, the issue should be limited to 3.4.44+\n\nReported-by: Paul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e\nAcked-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nCc: Gleb Natapov \u003cgleb@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f37d940d1b9a0104b857fee8dd2b934cb05dcdfb", "tree": "fa1f825f43c796f04ce20a88b22c56602e34e844", "parents": [ "73efe77679cf4f7e59d20fb1e366771edb9595f5" ], "author": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Tue Jul 17 15:48:05 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:11 2013 -0700" }, "message": "m32r: make memset() global for CONFIG_KERNEL_BZIP2\u003dy\n\ncommit 9a75c6e5240f7edc5955e8da5b94bde6f96070b3 upstream.\n\nFix the m32r compile error:\n\n arch/m32r/boot/compressed/misc.c:31:14: error: static declaration of \u0027memset\u0027 follows non-static declaration\n make[5]: *** [arch/m32r/boot/compressed/misc.o] Error 1\n make[4]: *** [arch/m32r/boot/compressed/vmlinux] Error 2\n\nby removing the static keyword.\n\nSigned-off-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCc: Hirokazu Takata \u003ctakata@linux-m32r.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "73efe77679cf4f7e59d20fb1e366771edb9595f5", "tree": "288220a962e2668efdbfb10b562b75c8243e31c4", "parents": [ "a44315aeee52062dea1f1f40acd084ab7fc2c8e2" ], "author": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Tue Jul 17 15:48:04 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:11 2013 -0700" }, "message": "m32r: add memcpy() for CONFIG_KERNEL_GZIP\u003dy\n\ncommit a8abbca6617e1caa2344d2d38d0a35f3e5928b79 upstream.\n\nFix the m32r link error:\n\n LD arch/m32r/boot/compressed/vmlinux\n arch/m32r/boot/compressed/misc.o: In function `zlib_updatewindow\u0027:\n misc.c:(.text+0x190): undefined reference to `memcpy\u0027\n misc.c:(.text+0x190): relocation truncated to fit: R_M32R_26_PLTREL against undefined symbol `memcpy\u0027\n make[5]: *** [arch/m32r/boot/compressed/vmlinux] Error 1\n\nby adding our own implementation of memcpy().\n\nSigned-off-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCc: Hirokazu Takata \u003ctakata@linux-m32r.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a44315aeee52062dea1f1f40acd084ab7fc2c8e2", "tree": "f79be4caadd86f4aa4161ce11f79c19c109c8527", "parents": [ "0aa1fedab07204880b8d1e935cc0782b55dfae21" ], "author": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Tue Jul 17 15:48:02 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:11 2013 -0700" }, "message": "m32r: consistently use \"suffix-$(...)\"\n\ncommit df12aef6a19bb2d69859a94936bda0e6ccaf3327 upstream.\n\nCommit a556bec9955c (\"m32r: fix arch/m32r/boot/compressed/Makefile\")\nchanged \"$(suffix_y)\" to \"$(suffix-y)\", but didn\u0027t update any location\nwhere \"suffix_y\" is set, causing:\n\n make[5]: *** No rule to make target `arch/m32r/boot/compressed/vmlinux.bin.\u0027, needed by `arch/m32r/boot/compressed/piggy.o\u0027. Stop.\n make[4]: *** [arch/m32r/boot/compressed/vmlinux] Error 2\n make[3]: *** [zImage] Error 2\n\nCorrect the other locations to fix this.\n\nSigned-off-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCc: Hirokazu Takata \u003ctakata@linux-m32r.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0aa1fedab07204880b8d1e935cc0782b55dfae21", "tree": "6088c4377c064ab757a35b6f95426e5458d65f6a", "parents": [ "d60aa7fc969ffe14cac79b685aad011e66beb210" ], "author": { "name": "Ying Xue", "email": "ying.xue@windriver.com", "time": "Thu Aug 16 12:09:07 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:11 2013 -0700" }, "message": "tipc: fix lockdep warning during bearer initialization\n\n[ Upstream commit 4225a398c1352a7a5c14dc07277cb5cc4473983b ]\n\nWhen the lockdep validator is enabled, it will report the below\nwarning when we enable a TIPC bearer:\n\n[ INFO: possible irq lock inversion dependency detected ]\n---------------------------------------------------------\nPossible interrupt unsafe locking scenario:\n\n CPU0 CPU1\n ---- ----\n lock(ptype_lock);\n local_irq_disable();\n lock(tipc_net_lock);\n lock(ptype_lock);\n \u003cInterrupt\u003e\n lock(tipc_net_lock);\n\n *** DEADLOCK ***\n\nthe shortest dependencies between 2nd lock and 1st lock:\n -\u003e (ptype_lock){+.+...} ops: 10 {\n[...]\nSOFTIRQ-ON-W at:\n [\u003cc1089418\u003e] __lock_acquire+0x528/0x13e0\n [\u003cc108a360\u003e] lock_acquire+0x90/0x100\n [\u003cc1553c38\u003e] _raw_spin_lock+0x38/0x50\n [\u003cc14651ca\u003e] dev_add_pack+0x3a/0x60\n [\u003cc182da75\u003e] arp_init+0x1a/0x48\n [\u003cc182dce5\u003e] inet_init+0x181/0x27e\n [\u003cc1001114\u003e] do_one_initcall+0x34/0x170\n [\u003cc17f7329\u003e] kernel_init+0x110/0x1b2\n [\u003cc155b6a2\u003e] kernel_thread_helper+0x6/0x10\n[...]\n ... key at: [\u003cc17e4b10\u003e] ptype_lock+0x10/0x20\n ... acquired at:\n [\u003cc108a360\u003e] lock_acquire+0x90/0x100\n [\u003cc1553c38\u003e] _raw_spin_lock+0x38/0x50\n [\u003cc14651ca\u003e] dev_add_pack+0x3a/0x60\n [\u003cc8bc18d2\u003e] enable_bearer+0xf2/0x140 [tipc]\n [\u003cc8bb283a\u003e] tipc_enable_bearer+0x1ba/0x450 [tipc]\n [\u003cc8bb3a04\u003e] tipc_cfg_do_cmd+0x5c4/0x830 [tipc]\n [\u003cc8bbc032\u003e] handle_cmd+0x42/0xd0 [tipc]\n [\u003cc148e802\u003e] genl_rcv_msg+0x232/0x280\n [\u003cc148d3f6\u003e] netlink_rcv_skb+0x86/0xb0\n [\u003cc148e5bc\u003e] genl_rcv+0x1c/0x30\n [\u003cc148d144\u003e] netlink_unicast+0x174/0x1f0\n [\u003cc148ddab\u003e] netlink_sendmsg+0x1eb/0x2d0\n [\u003cc1456bc1\u003e] sock_aio_write+0x161/0x170\n [\u003cc1135a7c\u003e] do_sync_write+0xac/0xf0\n [\u003cc11360f6\u003e] vfs_write+0x156/0x170\n [\u003cc11361e2\u003e] sys_write+0x42/0x70\n [\u003cc155b0df\u003e] sysenter_do_call+0x12/0x38\n[...]\n}\n -\u003e (tipc_net_lock){+..-..} ops: 4 {\n[...]\n IN-SOFTIRQ-R at:\n [\u003cc108953a\u003e] __lock_acquire+0x64a/0x13e0\n [\u003cc108a360\u003e] lock_acquire+0x90/0x100\n [\u003cc15541cd\u003e] _raw_read_lock_bh+0x3d/0x50\n [\u003cc8bb874d\u003e] tipc_recv_msg+0x1d/0x830 [tipc]\n [\u003cc8bc195f\u003e] recv_msg+0x3f/0x50 [tipc]\n [\u003cc146a5fa\u003e] __netif_receive_skb+0x22a/0x590\n [\u003cc146ab0b\u003e] netif_receive_skb+0x2b/0xf0\n [\u003cc13c43d2\u003e] pcnet32_poll+0x292/0x780\n [\u003cc146b00a\u003e] net_rx_action+0xfa/0x1e0\n [\u003cc103a4be\u003e] __do_softirq+0xae/0x1e0\n[...]\n}\n\n\u003eFrom the log, we can see three different call chains between\nCPU0 and CPU1:\n\nTime 0 on CPU0:\n\n kernel_init()-\u003einet_init()-\u003edev_add_pack()\n\nAt time 0, the ptype_lock is held by CPU0 in dev_add_pack();\n\nTime 1 on CPU1:\n\n tipc_enable_bearer()-\u003eenable_bearer()-\u003edev_add_pack()\n\nAt time 1, tipc_enable_bearer() first holds tipc_net_lock, and then\nwants to take ptype_lock to register TIPC protocol handler into the\nnetworking stack. But the ptype_lock has been taken by dev_add_pack()\non CPU0, so at this time the dev_add_pack() running on CPU1 has to be\nbusy looping.\n\nTime 2 on CPU0:\n\n netif_receive_skb()-\u003erecv_msg()-\u003etipc_recv_msg()\n\nAt time 2, an incoming TIPC packet arrives at CPU0, hence\ntipc_recv_msg() will be invoked. In tipc_recv_msg(), it first wants\nto hold tipc_net_lock. At the moment, below scenario happens:\n\nOn CPU0, below is our sequence of taking locks:\n\n lock(ptype_lock)-\u003elock(tipc_net_lock)\n\nOn CPU1, our sequence of taking locks looks like:\n\n lock(tipc_net_lock)-\u003elock(ptype_lock)\n\nObviously deadlock may happen in this case.\n\nBut please note the deadlock possibly doesn\u0027t occur at all when the\nfirst TIPC bearer is enabled. Before enable_bearer() -- running on\nCPU1 does not hold ptype_lock, so the TIPC receive handler (i.e.\nrecv_msg()) is not registered successfully via dev_add_pack(), so\nthe tipc_recv_msg() cannot be called by recv_msg() even if a TIPC\nmessage comes to CPU0. But when the second TIPC bearer is\nregistered, the deadlock can perhaps really happen.\n\nTo fix it, we will push the work of registering TIPC protocol\nhandler into workqueue context. After the change, both paths taking\nptype_lock are always in process contexts, thus, the deadlock should\nnever occur.\n\nSigned-off-by: Ying Xue \u003cying.xue@windriver.com\u003e\nSigned-off-by: Jon Maloy \u003cjon.maloy@ericsson.com\u003e\nSigned-off-by: Paul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d60aa7fc969ffe14cac79b685aad011e66beb210", "tree": "53bf249b823fc63b3001606c0f4e2eb4463f6e19", "parents": [ "334e23c6f2c893985cc011fbd9a26f2960ec1a97" ], "author": { "name": "Jason Wang", "email": "jasowang@redhat.com", "time": "Tue Aug 06 17:29:19 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 14 06:02:11 2013 -0700" }, "message": "macvtap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS\n\ncommit ece793fcfc417b3925844be88a6a6dc82ae8f7c6 upstream.\n\nWe try to linearize part of the skb when the number of iov is greater than\nMAX_SKB_FRAGS. This is not enough since each single vector may occupy more than\none pages, so zerocopy_sg_fromiovec() may still fail and may break the guest\nnetwork.\n\nSolve this problem by calculate the pages needed for iov before trying to do\nzerocopy and switch to use copy instead of zerocopy if it needs more than\nMAX_SKB_FRAGS.\n\nThis is done through introducing a new helper to count the pages for iov, and\ncall uarg-\u003ecallback() manually when switching from zerocopy to copy to notify\nvhost.\n\nWe can do further optimization on top.\n\nThis bug were introduced from b92946e2919134ebe2a4083e4302236295ea2a73\n(macvtap: zerocopy: validate vectors before building skb).\n\nCc: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Jason Wang \u003cjasowang@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" } ], "next": "334e23c6f2c893985cc011fbd9a26f2960ec1a97" }