)]}' { "log": [ { "commit": "31c46473d6a31ac1948c189624b472f26a6365e9", "tree": "63c5f7fee9abeb70822af493e281ed331f0ebc13", "parents": [ "87c7f759d1546a27d46d8cc2778ffecaa5f542c6" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Wed Nov 28 12:28:24 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jan 17 08:51:20 2013 -0800" }, "message": "libceph: remove \u0027osdtimeout\u0027 option\n\nThis would reset a connection with any OSD that had an outstanding\nrequest that was taking more than N seconds. The idea was that if the\nOSD was buggy, the client could compensate by resending the request.\n\nIn reality, this only served to hide server bugs, and we haven\u0027t\nactually seen such a bug in quite a while. Moreover, the userspace\nclient code never did this.\n\nMore importantly, often the request is taking a long time because the\nOSD is trying to recover, or overloaded, and killing the connection\nand retrying would only make the situation worse by giving the OSD\nmore work to do.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\n(cherry picked from commit 83aff95eb9d60aff5497e9f44a2ae906b86d8e88)\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b14d552774ed848ca1ca94d8adedcd743e3aa671", "tree": "36e3c23c3b3a2923a95b01583a48a31fccafff40", "parents": [ "e0996e350216f727b0f0e6219e79c8da5b3d1416" ], "author": { "name": "Michal Hocko", "email": "mhocko@suse.cz", "time": "Fri Jan 04 15:35:12 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:07:18 2013 -0800" }, "message": "mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT\n\ncommit 53a59fc67f97374758e63a9c785891ec62324c81 upstream.\n\nSince commit e303297e6c3a (\"mm: extended batches for generic\nmmu_gather\") we are batching pages to be freed until either\ntlb_next_batch cannot allocate a new batch or we are done.\n\nThis works just fine most of the time but we can get in troubles with\nnon-preemptible kernel (CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY)\non large machines where too aggressive batching might lead to soft\nlockups during process exit path (exit_mmap) because there are no\nscheduling points down the free_pages_and_swap_cache path and so the\nfreeing can take long enough to trigger the soft lockup.\n\nThe lockup is harmless except when the system is setup to panic on\nsoftlockup which is not that unusual.\n\nThe simplest way to work around this issue is to limit the maximum\nnumber of batches in a single mmu_gather. 10k of collected pages should\nbe safe to prevent from soft lockups (we would have 2ms for one) even if\nthey are all freed without an explicit scheduling point.\n\nThis patch doesn\u0027t add any new explicit scheduling points because it\nrelies on zap_pmd_range during page tables zapping which calls\ncond_resched per PMD.\n\nThe following lockup has been reported for 3.0 kernel with a huge\nprocess (in order of hundreds gigs but I do know any more details).\n\n BUG: soft lockup - CPU#56 stuck for 22s! [kernel:31053]\n Modules linked in: af_packet nfs lockd fscache auth_rpcgss nfs_acl sunrpc mptctl mptbase autofs4 binfmt_misc dm_round_robin dm_multipath bonding cpufreq_conservative cpufreq_userspace cpufreq_powersave pcc_cpufreq mperf microcode fuse loop osst sg sd_mod crc_t10dif st qla2xxx scsi_transport_fc scsi_tgt netxen_nic i7core_edac iTCO_wdt joydev e1000e serio_raw pcspkr edac_core iTCO_vendor_support acpi_power_meter rtc_cmos hpwdt hpilo button container usbhid hid dm_mirror dm_region_hash dm_log linear uhci_hcd ehci_hcd usbcore usb_common scsi_dh_emc scsi_dh_alua scsi_dh_hp_sw scsi_dh_rdac scsi_dh dm_snapshot pcnet32 mii edd dm_mod raid1 ext3 mbcache jbd fan thermal processor thermal_sys hwmon cciss scsi_mod\n Supported: Yes\n CPU 56\n Pid: 31053, comm: kernel Not tainted 3.0.31-0.9-default #1 HP ProLiant DL580 G7\n RIP: 0010: _raw_spin_unlock_irqrestore+0x8/0x10\n RSP: 0018:ffff883ec1037af0 EFLAGS: 00000206\n RAX: 0000000000000e00 RBX: ffffea01a0817e28 RCX: ffff88803ffd9e80\n RDX: 0000000000000200 RSI: 0000000000000206 RDI: 0000000000000206\n RBP: 0000000000000002 R08: 0000000000000001 R09: ffff887ec724a400\n R10: 0000000000000000 R11: dead000000200200 R12: ffffffff8144c26e\n R13: 0000000000000030 R14: 0000000000000297 R15: 000000000000000e\n FS: 00007ed834282700(0000) GS:ffff88c03f200000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n CR2: 000000000068b240 CR3: 0000003ec13c5000 CR4: 00000000000006e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n Process kernel (pid: 31053, threadinfo ffff883ec1036000, task ffff883ebd5d4100)\n Call Trace:\n release_pages+0xc5/0x260\n free_pages_and_swap_cache+0x9d/0xc0\n tlb_flush_mmu+0x5c/0x80\n tlb_finish_mmu+0xe/0x50\n exit_mmap+0xbd/0x120\n mmput+0x49/0x120\n exit_mm+0x122/0x160\n do_exit+0x17a/0x430\n do_group_exit+0x3d/0xb0\n get_signal_to_deliver+0x247/0x480\n do_signal+0x71/0x1b0\n do_notify_resume+0x98/0xb0\n int_signal+0x12/0x17\n DWARF2 unwinder stuck at int_signal+0x12/0x17\n\nSigned-off-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7164ac211086207dc371e3b32165226e28e2dcfa", "tree": "e7dc397786bda21d8476ce0174433a34c5b99bee", "parents": [ "fdbe6fecef94b6171de7a2ccfe543a694c9c41bc" ], "author": { "name": "Andy Lutomirski", "email": "luto@amacapital.net", "time": "Sat Dec 01 12:37:20 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:07:16 2013 -0800" }, "message": "PCI: Reduce Ricoh 0xe822 SD card reader base clock frequency to 50MHz\n\ncommit 812089e01b9f65f90fc8fc670d8cce72a0e01fbb upstream.\n\nOtherwise it fails like this on cards like the Transcend 16GB SDHC card:\n\n mmc0: new SDHC card at address b368\n mmcblk0: mmc0:b368 SDC 15.0 GiB\n mmcblk0: error -110 sending status command, retrying\n mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response 0x900, card status 0xb0\n\nTested on my Lenovo x200 laptop.\n\n[bhelgaas: changelog]\nSigned-off-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nAcked-by: Chris Ball \u003ccjb@laptop.org\u003e\nCC: Manoj Iyer \u003cmanoj.iyer@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d21383fcbb535f90b429279852988d675ed22d67", "tree": "7f395982de610bfc355082ae351deb01a19a5060", "parents": [ "34fb350281ced2a72707a5c0064f69992d440edb" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Jul 17 01:41:30 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:07:15 2013 -0800" }, "message": "tcp: implement RFC 5961 4.2\n\n[ Upstream commit 0c24604b68fc7810d429d6c3657b6f148270e528 ]\n\nImplement the RFC 5691 mitigation against Blind\nReset attack using SYN bit.\n\nSection 4.2 of RFC 5961 advises to send a Challenge ACK and drop\nincoming packet, instead of resetting the session.\n\nAdd a new SNMP counter to count number of challenge acks sent\nin response to SYN packets.\n(netstat -s | grep TCPSYNChallenge)\n\nRemove obsolete TCPAbortOnSyn, since we no longer abort a TCP session\nbecause of a SYN flag.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Kiran Kumar Kella \u003ckkiran@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "34fb350281ced2a72707a5c0064f69992d440edb", "tree": "91f806c64e65601adf09564a83b4c44f4db080be", "parents": [ "c87b45599a4e0d8741abeb85d1d8d5f0c1fb13be" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Jul 17 10:13:05 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:07:14 2013 -0800" }, "message": "tcp: implement RFC 5961 3.2\n\n[ Upstream commit 282f23c6ee343126156dd41218b22ece96d747e3 ]\n\nImplement the RFC 5691 mitigation against Blind\nReset attack using RST bit.\n\nIdea is to validate incoming RST sequence,\nto match RCV.NXT value, instead of previouly accepted\nwindow : (RCV.NXT \u003c\u003d SEG.SEQ \u003c RCV.NXT+RCV.WND)\n\nIf sequence is in window but not an exact match, send\na \"challenge ACK\", so that the other part can resend an\nRST with the appropriate sequence.\n\nAdd a new sysctl, tcp_challenge_ack_limit, to limit\nnumber of challenge ACK sent per second.\n\nAdd a new SNMP counter to count number of challenge acks sent.\n(netstat -s | grep TCPChallengeACK)\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Kiran Kumar Kella \u003ckkiran@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d46699a94ddf2dd4d83e986a759b64981b37fc5b", "tree": "c2de686ba7429ce5ac341c97ccdf673374c3f1be", "parents": [ "6eec2413cb320bdd0139ba0db3888d27f746ea2b" ], "author": { "name": "Christoph Paasch", "email": "christoph.paasch@uclouvain.be", "time": "Fri Dec 14 04:07:58 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:07:14 2013 -0800" }, "message": "inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock\n\n[ Upstream commit e337e24d6624e74a558aa69071e112a65f7b5758 ]\n\nIf in either of the above functions inet_csk_route_child_sock() or\n__inet_inherit_port() fails, the newsk will not be freed:\n\nunreferenced object 0xffff88022e8a92c0 (size 1592):\n comm \"softirq\", pid 0, jiffies 4294946244 (age 726.160s)\n hex dump (first 32 bytes):\n 0a 01 01 01 0a 01 01 02 00 00 00 00 a7 cc 16 00 ................\n 02 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [\u003cffffffff8153d190\u003e] kmemleak_alloc+0x21/0x3e\n [\u003cffffffff810ab3e7\u003e] kmem_cache_alloc+0xb5/0xc5\n [\u003cffffffff8149b65b\u003e] sk_prot_alloc.isra.53+0x2b/0xcd\n [\u003cffffffff8149b784\u003e] sk_clone_lock+0x16/0x21e\n [\u003cffffffff814d711a\u003e] inet_csk_clone_lock+0x10/0x7b\n [\u003cffffffff814ebbc3\u003e] tcp_create_openreq_child+0x21/0x481\n [\u003cffffffff814e8fa5\u003e] tcp_v4_syn_recv_sock+0x3a/0x23b\n [\u003cffffffff814ec5ba\u003e] tcp_check_req+0x29f/0x416\n [\u003cffffffff814e8e10\u003e] tcp_v4_do_rcv+0x161/0x2bc\n [\u003cffffffff814eb917\u003e] tcp_v4_rcv+0x6c9/0x701\n [\u003cffffffff814cea9f\u003e] ip_local_deliver_finish+0x70/0xc4\n [\u003cffffffff814cec20\u003e] ip_local_deliver+0x4e/0x7f\n [\u003cffffffff814ce9f8\u003e] ip_rcv_finish+0x1fc/0x233\n [\u003cffffffff814cee68\u003e] ip_rcv+0x217/0x267\n [\u003cffffffff814a7bbe\u003e] __netif_receive_skb+0x49e/0x553\n [\u003cffffffff814a7cc3\u003e] netif_receive_skb+0x50/0x82\n\nThis happens, because sk_clone_lock initializes sk_refcnt to 2, and thus\na single sock_put() is not enough to free the memory. Additionally, things\nlike xfrm, memcg, cookie_values,... may have been initialized.\nWe have to free them properly.\n\nThis is fixed by forcing a call to tcp_done(), ending up in\ninet_csk_destroy_sock, doing the final sock_put(). tcp_done() is necessary,\nbecause it ends up doing all the cleanup on xfrm, memcg, cookie_values,\nxfrm,...\n\nBefore calling tcp_done, we have to set the socket to SOCK_DEAD, to\nforce it entering inet_csk_destroy_sock. To avoid the warning in\ninet_csk_destroy_sock, inet_num has to be set to 0.\nAs inet_csk_destroy_sock does a dec on orphan_count, we first have to\nincrease it.\n\nCalling tcp_done() allows us to remove the calls to\ntcp_clear_xmit_timer() and tcp_cleanup_congestion_control().\n\nA similar approach is taken for dccp by calling dccp_done().\n\nThis is in the kernel since 093d282321 (tproxy: fix hash locking issue\nwhen using port redirection in __inet_inherit_port()), thus since\nversion \u003e\u003d 2.6.37.\n\nSigned-off-by: Christoph Paasch \u003cchristoph.paasch@uclouvain.be\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "cd924e960d3c2ae1654109b5b9e88cec334f7126", "tree": "ed7bec78c3e2930df0c86d44aae32d2c4dddb23f", "parents": [ "475261dbbf5d85e1a298886385d859ada787ae1f" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Oct 16 15:03:14 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:06:58 2013 -0800" }, "message": "freezer: add missing mb\u0027s to freezer_count() and freezer_should_skip()\n\ncommit dd67d32dbc5de299d70cc9e10c6c1e29ffa56b92 upstream.\n\nA task is considered frozen enough between freezer_do_not_count() and\nfreezer_count() and freezers use freezer_should_skip() to test this\ncondition. This supposedly works because freezer_count() always calls\ntry_to_freezer() after clearing %PF_FREEZER_SKIP.\n\nHowever, there currently is nothing which guarantees that\nfreezer_count() sees %true freezing() after clearing %PF_FREEZER_SKIP\nwhen freezing is in progress, and vice-versa. A task can escape the\nfreezing condition in effect by freezer_count() seeing !freezing() and\nfreezer_should_skip() seeing %PF_FREEZER_SKIP.\n\nThis patch adds smp_mb()\u0027s to freezer_count() and\nfreezer_should_skip() such that either %true freezing() is visible to\nfreezer_count() or !PF_FREEZER_SKIP is visible to\nfreezer_should_skip().\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Rafael J. Wysocki \u003crjw@sisk.pl\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "25747cc45825ffc0192779a224d3bb9bc4b9edbd", "tree": "eec6ef8ba6fcf4b5177efa110be793568dd8de02", "parents": [ "711cf004f2148f1d1967bc5eca025019e5001212" ], "author": { "name": "Christoffer Dall", "email": "cdall@cs.columbia.edu", "time": "Fri Dec 21 13:03:50 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:06:48 2013 -0800" }, "message": "mm: Fix PageHead when !CONFIG_PAGEFLAGS_EXTENDED\n\ncommit ad4b3fb7ff9940bcdb1e4cd62bd189d10fa636ba upstream.\n\nUnfortunately with !CONFIG_PAGEFLAGS_EXTENDED, (!PageHead) is false, and\n(PageHead) is true, for tail pages. If this is indeed the intended\nbehavior, which I doubt because it breaks cache cleaning on some ARM\nsystems, then the nomenclature is highly problematic.\n\nThis patch makes sure PageHead is only true for head pages and PageTail\nis only true for tail pages, and neither is true for non-compound pages.\n\n[ This buglet seems ancient - seems to have been introduced back in Apr\n 2008 in commit 6a1e7f777f61: \"pageflags: convert to the use of new\n macros\". And the reason nobody noticed is because the PageHead()\n tests are almost all about just sanity-checking, and only used on\n pages that are actual page heads. The fact that the old code returned\n true for tail pages too was thus not really noticeable. - Linus ]\n\nSigned-off-by: Christoffer Dall \u003ccdall@cs.columbia.edu\u003e\nAcked-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Will Deacon \u003cWill.Deacon@arm.com\u003e\nCc: Steve Capper \u003cSteve.Capper@arm.com\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7361a9019ff8d45dc835f987ccefbbeb4f560f09", "tree": "3744f41659abc558471e7c5ce040b230486f070e", "parents": [ "5a76bf41fe85c0ebdf4fe1fcdf729697b11a5338" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Thu Dec 20 15:05:16 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:06:30 2013 -0800" }, "message": "exec: do not leave bprm-\u003einterp on stack\n\ncommit b66c5984017533316fd1951770302649baf1aa33 upstream.\n\nIf a series of scripts are executed, each triggering module loading via\nunprintable bytes in the script header, kernel stack contents can leak\ninto the command line.\n\nNormally execution of binfmt_script and binfmt_misc happens recursively.\nHowever, when modules are enabled, and unprintable bytes exist in the\nbprm-\u003ebuf, execution will restart after attempting to load matching\nbinfmt modules. Unfortunately, the logic in binfmt_script and\nbinfmt_misc does not expect to get restarted. They leave bprm-\u003einterp\npointing to their local stack. This means on restart bprm-\u003einterp is\nleft pointing into unused stack memory which can then be copied into the\nuserspace argv areas.\n\nAfter additional study, it seems that both recursion and restart remains\nthe desirable way to handle exec with scripts, misc, and modules. As\nsuch, we need to protect the changes to interp.\n\nThis changes the logic to require allocation for any changes to the\nbprm-\u003einterp. To avoid adding a new kmalloc to every exec, the default\nvalue is left as-is. Only when passing through binfmt_script or\nbinfmt_misc does an allocation take place.\n\nFor a proof of concept, see DoTest.sh from:\n\n http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: halfdog \u003cme@halfdog.net\u003e\nCc: P J P \u003cppandit@redhat.com\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "78a685beb044864de000a6f7339bce57513172bb", "tree": "768425b1ce982640ddc3f4690ca9cd43dd6b1bb5", "parents": [ "b947fcbcca85da6ad3ec79f6aa86b550f458e049" ], "author": { "name": "Mel Gorman", "email": "mgorman@suse.de", "time": "Wed Dec 05 14:01:41 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 17 10:37:42 2012 -0800" }, "message": "tmpfs: fix shared mempolicy leak\n\ncommit 18a2f371f5edf41810f6469cb9be39931ef9deb9 upstream.\n\nThis fixes a regression in 3.7-rc, which has since gone into stable.\n\nCommit 00442ad04a5e (\"mempolicy: fix a memory corruption by refcount\nimbalance in alloc_pages_vma()\") changed get_vma_policy() to raise the\nrefcount on a shmem shared mempolicy; whereas shmem_alloc_page() went\non expecting alloc_page_vma() to drop the refcount it had acquired.\nThis deserves a rework: but for now fix the leak in shmem_alloc_page().\n\nHugh: shmem_swapin() did not need a fix, but surely it\u0027s clearer to use\nthe same refcounting there as in shmem_alloc_page(), delete its onstack\nmempolicy, and the strange mpol_cond_copy() and __mpol_cond_copy() -\nthose were invented to let swapin_readahead() make an unknown number of\ncalls to alloc_pages_vma() with one mempolicy; but since 00442ad04a5e,\nalloc_pages_vma() has kept refcount in balance, so now no problem.\n\nReported-and-tested-by: Tommi Rantala \u003ctt.rantala@gmail.com\u003e\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9cbecb443503ba3dd6a620e8e43a0273e14dc204", "tree": "bb6aa7240a08b3da5c4edbd1e08d3a5151eea7d5", "parents": [ "6417635908e7643800141fc1d6cf7fe43f4fb5e3" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Nov 21 18:37:38 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 03 11:47:01 2012 -0800" }, "message": "drm/radeon: add new SI pci id\n\ncommit 0181bd5dea2ed0696f84591a92da0b6a1f1a2e62 upstream.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d0e85e04fb57a65a6096a0b18c97ba5892d676d9", "tree": "7942daf6baa0d4d5ddf9015523059cc07e972996", "parents": [ "51b8318a818623899f9eb24ce697d43301bbe349" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Thu Jun 21 12:49:23 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:45 2012 -0800" }, "message": "libceph: drop declaration of ceph_con_get()\n\ncommit 261030215d970c62f799e6e508e3c68fc7ec2aa9 upstream.\n\nFor some reason the declaration of ceph_con_get() and\nceph_con_put() did not get deleted in this commit:\n d59315ca libceph: drop ceph_con_get/put helpers and nref member\n\nClean that up.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nCc: Herton Ronaldo Krzesinski \u003cherton.krzesinski@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dfae3b3451c6da14df1fa62d76c8a4345d21bdb2", "tree": "d674f1e1998b9ae902ab74f235e1bd39d31525d4", "parents": [ "73bba6fc44591587254fec8e867a99b5a2a28ba7" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Mon Sep 24 20:59:48 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:44 2012 -0800" }, "message": "libceph: check for invalid mapping\n\n(cherry picked from commit d63b77f4c552cc3a20506871046ab0fcbc332609)\n\nIf we encounter an invalid (e.g., zeroed) mapping, return an error\nand avoid a divide by zero.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "63c1362476141f4fb340e8236d41674be9fc1983", "tree": "13be911ab412f8e02ec6cdfa2688bc5b4296c0a2", "parents": [ "265fb7c177f9db75d628b3479b6223c1c8110e67" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Fri Jul 20 17:29:55 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:41 2012 -0800" }, "message": "libceph: clean up con flags\n\n(cherry picked from commit 4a8616920860920abaa51193146fe36b38ef09aa)\n\nRename flags with CON_FLAG prefix, move the definitions into the c file,\nand (better) document their meaning.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "265fb7c177f9db75d628b3479b6223c1c8110e67", "tree": "85f85c837e89f7d09041a26bb60a5b35495afc93", "parents": [ "cb9f8855591613dff0909c99d46a29e10eb39b25" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Fri Jul 20 17:24:40 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:41 2012 -0800" }, "message": "libceph: replace connection state bits with states\n\n(cherry picked from commit 8dacc7da69a491c515851e68de6036f21b5663ce)\n\nUse a simple set of 6 enumerated values for the socket states (CON_STATE_*)\nand use those instead of the state bits. All of the con-\u003estate checks are\nnow under the protection of the con mutex, so this is safe. It also\nsimplifies many of the state checks because we can check for anything other\nthan the expected state instead of various bits for races we can think of.\n\nThis appears to hold up well to stress testing both with and without socket\nfailure injection on the server side.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "59d02721bb2838893596d5617659fe907dd45518", "tree": "126ac6b7dba3ef26cb4c6e32b7bc2faf74c1c35d", "parents": [ "9beb73fcb83317786226b4203d7e56c6b0f43adb" ], "author": { "name": "Guanjun He", "email": "gjhe@suse.com", "time": "Sun Jul 08 19:50:33 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:38 2012 -0800" }, "message": "libceph: prevent the race of incoming work during teardown\n\n(cherry picked from commit a2a3258417eb6a1799cf893350771428875a8287)\n\nAdd an atomic variable \u0027stopping\u0027 as flag in struct ceph_messenger,\nset this flag to 1 in function ceph_destroy_client(), and add the condition code\nin function ceph_data_ready() to test the flag value, if true(1), just return.\n\nSigned-off-by: Guanjun He \u003cgjhe@suse.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9beb73fcb83317786226b4203d7e56c6b0f43adb", "tree": "625dd1aa57201317108b56b11ae83195655d7939", "parents": [ "d92d11da1dd8531150823ff429ae29a0cf5e438d" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Mon Jul 09 14:22:34 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:38 2012 -0800" }, "message": "libceph: initialize msgpool message types\n\n(cherry picked from commit d50b409fb8698571d8209e5adfe122e287e31290)\n\nInitialize the type field for messages in a msgpool. The caller was doing\nthis for osd ops, but not for the reply messages.\n\nReported-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "638ba1765d03bdc3a972bfca69fd0a4a4eda717c", "tree": "75da2d47d2997f1a2800dbc7bea2f4d5520f47bf", "parents": [ "db90f992eb77188ce3e2b95d36f99ba194e04e66" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Wed Jun 27 12:24:08 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:37 2012 -0800" }, "message": "libceph: set peer name on con_open, not init\n\n(cherry picked from commit b7a9e5dd40f17a48a72f249b8bbc989b63bae5fd)\n\nThe peer name may change on each open attempt, even when the connection is\nreused.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a94af04be86f81d5e3973a37e6a861f329418f1e", "tree": "f9894d5ba822a10d31b1cf310dfd14f47c214bb6", "parents": [ "abb46df87f784b398bcdb5091175d24456e42f11" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Wed May 23 14:35:23 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:28 2012 -0800" }, "message": "libceph: define and use an explicit CONNECTED state\n\n(cherry picked from commit e27947c767f5bed15048f4e4dad3e2eb69133697)\n\nThere is no state explicitly defined when a ceph connection is fully\noperational. So define one.\n\nIt\u0027s set when the connection sequence completes successfully, and is\ncleared when the connection gets closed.\n\nBe a little more careful when examining the old state when a socket\ndisconnect event is reported.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9021a42c794bf96156be9ad556ef707814a361ff", "tree": "54475c6baca932d1eb1272038a380a5e474e8e52", "parents": [ "1c623b046a6c72666d81afa004f8bf7f70cd4391" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Thu Jun 21 12:49:23 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:25 2012 -0800" }, "message": "libceph: drop ceph_con_get/put helpers and nref member\n\n(cherry picked from commit d59315ca8c0de00df9b363f94a2641a30961ca1c)\n\nThese are no longer used. Every ceph_connection instance is embedded in\nanother structure, and refcounts manipulated via the get/put ops.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ce4516fbb42d2ad5adba4699ebc1703d4e08e821", "tree": "19b4f581d776e60440b57de8400a976c4facddd8", "parents": [ "ae048538ab62c31f67d42e00a3183b8870809a3c" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Fri Jun 01 14:56:43 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:24 2012 -0800" }, "message": "libceph: make ceph_con_revoke_message() a msg op\n\n(cherry picked from commit 8921d114f5574c6da2cdd00749d185633ecf88f3)\n\nceph_con_revoke_message() is passed both a message and a ceph\nconnection. A ceph_msg allocated for incoming messages on a\nconnection always has a pointer to that connection, so there\u0027s no\nneed to provide the connection when revoking such a message.\n\nNote that the existing logic does not preclude the message supplied\nbeing a null/bogus message pointer. The only user of this interface\nis the OSD client, and the only value an osd client passes is a\nrequest\u0027s r_reply field. That is always non-null (except briefly in\nan error path in ceph_osdc_alloc_request(), and that drops the\nonly reference so the request won\u0027t ever have a reply to revoke).\nSo we can safely assume the passed-in message is non-null, but add a\nBUG_ON() to make it very obvious we are imposing this restriction.\n\nRename the function ceph_msg_revoke_incoming() to reflect that it is\nreally an operation on an incoming message.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ae048538ab62c31f67d42e00a3183b8870809a3c", "tree": "f77272ada51185c3892dab22dba5775b827be59c", "parents": [ "bfd357201d3ffc6cc621e4c69fd47e7d457e5f3a" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Fri Jun 01 14:56:43 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:24 2012 -0800" }, "message": "libceph: make ceph_con_revoke() a msg operation\n\n(cherry picked from commit 6740a845b2543cc46e1902ba21bac743fbadd0dc)\n\nceph_con_revoke() is passed both a message and a ceph connection.\nNow that any message associated with a connection holds a pointer\nto that connection, there\u0027s no need to provide the connection when\nrevoking a message.\n\nThis has the added benefit of precluding the possibility of the\nproviding the wrong connection pointer. If the message\u0027s connection\npointer is null, it is not being tracked by any connection, so\nrevoking it is a no-op. This is supported as a convenience for\nupper layers, so they can revoke a message that is not actually\n\"in flight.\"\n\nRename the function ceph_msg_revoke() to reflect that it is really\nan operation on a message, not a connection.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e84e066e5c8c858d3954b2ef1da25c14309e4cef", "tree": "fa927a404b1bdd81fb9102824549cc04dee8f875", "parents": [ "35067a20685e5f51513c3633256e658fc71e847e" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Fri Jun 01 14:56:43 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:23 2012 -0800" }, "message": "libceph: have messages point to their connection\n\n(cherry picked from commit 38941f8031bf042dba3ced6394ba3a3b16c244ea)\n\nWhen a ceph message is queued for sending it is placed on a list of\npending messages (ceph_connection-\u003eout_queue). When they are\nactually sent over the wire, they are moved from that list to\nanother (ceph_connection-\u003eout_sent). When acknowledgement for the\nmessage is received, it is removed from the sent messages list.\n\nDuring that entire time the message is \"in the possession\" of a\nsingle ceph connection. Keep track of that connection in the\nmessage. This will be used in the next patch (and is a helpful\nbit of information for debugging anyway).\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6880138c03448b3c375a3d7a8ef6acd688e6fb40", "tree": "32fcab0d28584b1ba13756cbdfd4f870065ecd69", "parents": [ "9403ae33bf946342b23cfe3dbf3e4c9b86860c97" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Sat May 26 23:26:43 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:23 2012 -0800" }, "message": "libceph: fully initialize connection in con_init()\n\n(cherry picked from commit 1bfd89f4e6e1adc6a782d94aa5d4c53be1e404d7)\n\nMove the initialization of a ceph connection\u0027s private pointer,\noperations vector pointer, and peer name information into\nceph_con_init(). Rearrange the arguments so the connection pointer\nis first. Hide the byte-swapping of the peer entity number inside\nceph_con_init()\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "31a84d83433edc79151e28762c1992c0708b222c", "tree": "4be92156c4e1ee9c363f83fc6c2596cf608b8199", "parents": [ "51588ed26f489e50bfd2359d55abcb4d907149bc" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Sat May 26 23:26:43 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:22 2012 -0800" }, "message": "libceph: embed ceph connection structure in mon_client\n\n(cherry picked from commit 67130934fb579fdf0f2f6d745960264378b57dc8)\n\nA monitor client has a pointer to a ceph connection structure in it.\nThis is the only one of the three ceph client types that do it this\nway; the OSD and MDS clients embed the connection into their main\nstructures. There is always exactly one ceph connection for a\nmonitor client, so there is no need to allocate it separate from the\nmonitor client structure.\n\nSo switch the ceph_mon_client structure to embed its\nceph_connection structure.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0bcd15777405bf024a3ec591731582f7263ea1c0", "tree": "e6e909ce1c506b160a4f8121701681fd5a697778", "parents": [ "bc327474a0c9f3477be61b2d3e33833ef7b01bf9" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Tue May 22 22:15:49 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:22 2012 -0800" }, "message": "libceph: start tracking connection socket state\n\n(cherry picked from commit ce2c8903e76e690846a00a0284e4bd9ee954d680)\n\nStart explicitly keeping track of the state of a ceph connection\u0027s\nsocket, separate from the state of the connection itself. Create\nplaceholder functions to encapsulate the state transitions.\n\n --------\n | NEW* | transient initial state\n --------\n | con_sock_state_init()\n v\n ----------\n | CLOSED | initialized, but no socket (and no\n ---------- TCP connection)\n ^ \\\n | \\ con_sock_state_connecting()\n | ----------------------\n | \\\n + con_sock_state_closed() \\\n |\\ \\\n | \\ \\\n | ----------- \\\n | | CLOSING | socket event; \\\n | ----------- await close \\\n | ^ |\n | | |\n | + con_sock_state_closing() |\n | / \\ |\n | / --------------- |\n | / \\ v\n | / --------------\n | / -----------------| CONNECTING | socket created, TCP\n | | / -------------- connect initiated\n | | | con_sock_state_connected()\n | | v\n -------------\n | CONNECTED | TCP connection established\n -------------\n\nMake the socket state an atomic variable, reinforcing that it\u0027s a\ndistinct transtion with no possible \"intermediate/both\" states.\nThis is almost certainly overkill at this point, though the\ntransitions into CONNECTED and CLOSING state do get called via\nsocket callback (the rest of the transitions occur with the\nconnection mutex held). We can back out the atomicity later.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil\u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bc327474a0c9f3477be61b2d3e33833ef7b01bf9", "tree": "fabf603a635c91daf1afd423f48fbc7574fa0400", "parents": [ "d910c114b6da5b78c88889eff1b3f9e83c6f81cb" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Tue May 22 11:41:43 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:21 2012 -0800" }, "message": "libceph: start separating connection flags from state\n\n(cherry picked from commit 928443cd9644e7cfd46f687dbeffda2d1a357ff9)\n\nA ceph_connection holds a mixture of connection state (as in \"state\nmachine\" state) and connection flags in a single \"state\" field. To\nmake the distinction more clear, define a new \"flags\" field and use\nit rather than the \"state\" field to hold Boolean flag values.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil\u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d910c114b6da5b78c88889eff1b3f9e83c6f81cb", "tree": "3bef4800c3888c84e61436de727ddba440eeb33b", "parents": [ "4874ba9c07e2fa418cd7272d657f5cc883efd35a" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Sat May 26 23:26:43 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:21 2012 -0800" }, "message": "libceph: embed ceph messenger structure in ceph_client\n\n(cherry picked from commit 15d9882c336db2db73ccf9871ae2398e452f694c)\n\nA ceph client has a pointer to a ceph messenger structure in it.\nThere is always exactly one ceph messenger for a ceph client, so\nthere is no need to allocate it separate from the ceph client\nstructure.\n\nSwitch the ceph_client structure to embed its ceph_messenger\nstructure.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Yehuda Sadeh \u003cyehuda@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "809c58f1bd5fa3d3e9ff1d3614c00c1a1239abf1", "tree": "b706507a913b80898d6fd4a870189c96763f3c1f", "parents": [ "ac7a42681718cd7474cec70f198f0684ba7444eb" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Tue May 29 21:47:38 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:21 2012 -0800" }, "message": "libceph: kill bad_proto ceph connection op\n\n(cherry picked from commit 6384bb8b8e88a9c6bf2ae0d9517c2c0199177c34)\n\nNo code sets a bad_proto method in its ceph connection operations\nvector, so just get rid of it.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Yehuda Sadeh \u003cyehuda@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ac7a42681718cd7474cec70f198f0684ba7444eb", "tree": "30312de527b0b0a602b29b5c9d9c925e48d7f463", "parents": [ "e7fda85c9dab7396c5ed7345ab7c6fcdf4ffc366" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Tue May 22 11:41:43 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:20 2012 -0800" }, "message": "libceph: eliminate connection state \"DEAD\"\n\n(cherry picked from commit e5e372da9a469dfe3ece40277090a7056c566838)\n\nThe ceph connection state \"DEAD\" is never set and is therefore not\nneeded. Eliminate it.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Yehuda Sadeh \u003cyehuda@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "49da293c7dc4401c2c7963a2c70f633b1c8fa8c5", "tree": "7e61b4bfd7e2c192ba47b8db4866f3f9e7c039c2", "parents": [ "21cbad59b07693104dda76ee4afef41302b2b8fb" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Tue Jul 10 11:53:34 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:10 2012 -0800" }, "message": "libceph: fix messenger retry\n\n(cherry picked from commit 5bdca4e0768d3e0f4efa43d9a2cc8210aeb91ab9)\n\nIn ancient times, the messenger could both initiate and accept connections.\nAn artifact if that was data structures to store/process an incoming\nceph_msg_connect request and send an outgoing ceph_msg_connect_reply.\nSadly, the negotiation code was referencing those structures and ignoring\nimportant information (like the peer\u0027s connect_seq) from the correct ones.\n\nAmong other things, this fixes tight reconnect loops where the server sends\nRETRY_SESSION and we (the client) retries with the same connect_seq as last\ntime. This bug pretty easily triggered by injecting socket failures on the\nMDS and running some fs workload like workunits/direct_io/test_sync_io.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ed35fbcd3cf73dfbff59bf8c20c772925562bc45", "tree": "7a93030aa0bd809eb111d339cd82a0c29b32be74", "parents": [ "4f33c7ed3796a5078cd9eef0d3af4ebf8f7e1b99" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Wed May 16 15:16:39 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:08 2012 -0800" }, "message": "ceph: use info returned by get_authorizer\n\n(cherry picked from commit 8f43fb53894079bf0caab6e348ceaffe7adc651a)\n\nRather than passing a bunch of arguments to be filled in with the\ncontent of the ceph_auth_handshake buffer now returned by the\nget_authorizer method, just use the returned information in the\ncaller, and drop the unnecessary arguments.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4f33c7ed3796a5078cd9eef0d3af4ebf8f7e1b99", "tree": "04ad359931118b3023e230b48dbba1a2184e8ad4", "parents": [ "83d28f7956228e0dd1774aed1096392d3bfc0597" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Wed May 16 15:16:39 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:07 2012 -0800" }, "message": "ceph: have get_authorizer methods return pointers\n\n(cherry picked from commit a3530df33eb91d787d08c7383a0a9982690e42d0)\n\nHave the get_authorizer auth_client method return a ceph_auth\npointer rather than an integer, pointer-encoding any returned\nerror value. This is to pave the way for making use of the\nreturned value in an upcoming patch.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "018a2a13f3cb5e205618b1357124ff25eb3a8223", "tree": "cdbe7ee5776a748574c31d42721b97870ac2fad1", "parents": [ "0f56a54fced6bee6e56a8b84f9adb65a41032866" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Wed May 16 15:16:39 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:07 2012 -0800" }, "message": "ceph: messenger: reduce args to create_authorizer\n\n(cherry picked from commit 74f1869f76d043bad12ec03b4d5f04a8c3d1f157)\n\nMake use of the new ceph_auth_handshake structure in order to reduce\nthe number of arguments passed to the create_authorizor method in\nceph_auth_client_ops. Use a local variable of that type as a\nshorthand in the get_authorizer method definitions.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0f56a54fced6bee6e56a8b84f9adb65a41032866", "tree": "fbe92f0375167e2f0b17ce0159b464a89cc667d4", "parents": [ "33f0577a991d6d00805450ea29da5a91f6acd1a8" ], "author": { "name": "Alex Elder", "email": "elder@inktank.com", "time": "Wed May 16 15:16:38 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:07 2012 -0800" }, "message": "ceph: define ceph_auth_handshake type\n\n(cherry picked from commit 6c4a19158b96ea1fb8acbe0c1d5493d9dcd2f147)\n\nThe definitions for the ceph_mds_session and ceph_osd both contain\nfive fields related only to \"authorizers.\" Encapsulate those fields\ninto their own struct type, allowing for better isolation in some\nupcoming patches.\n\nFix the #includes in \"linux/ceph/osd_client.h\" to lay out their more\ncomplete canonical path.\n\nSigned-off-by: Alex Elder \u003celder@inktank.com\u003e\nReviewed-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9a0117ae53308d0d8284ba5664ed4c1d0ec54176", "tree": "fa01a51137fbb7785b485ff4940c6d24fc5685aa", "parents": [ "20501b9e6e1db8e7ab6668ef15d697b1c057a50a" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Mon May 07 15:36:49 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:03 2012 -0800" }, "message": "crush: fix tree node weight lookup\n\n(cherry picked from commit f671d4cd9b36691ac4ef42cde44c1b7a84e13631)\n\nFix the node weight lookup for tree buckets by using a correct accessor.\n\nReflects ceph.git commit d287ade5bcbdca82a3aef145b92924cf1e856733.\n\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "506b4672ace55889c16d4e9d5515e0c1ae7832d5", "tree": "36da5c2597634f1398bb0f0d8cfdcec2fc617569", "parents": [ "55649211861616c26aa25c9e710c5691837975e4" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Mon May 07 15:38:35 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:38:03 2012 -0800" }, "message": "crush: clean up types, const-ness\n\n(cherry picked from commit 8b12d47b80c7a34dffdd98244d99316db490ec58)\n\nMove various types from int -\u003e __u32 (or similar), and add const as\nappropriate.\n\nThis reflects changes that have been present in the userland implementation\nfor some time.\n\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "41a496238dae4c117548be819b0a3b3edbc48dc8", "tree": "83190bcf55b89b79825b2f98ae493db4428f9885", "parents": [ "1c694ffc72666085a5ad880fef913ee2c8c69c4a" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Nov 07 12:42:47 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:13 2012 -0800" }, "message": "ALSA: Add a reference counter to card instance\n\ncommit a0830dbd4e42b38aefdf3fb61ba5019a1a99ea85 upstream.\n\nFor more strict protection for wild disconnections, a refcount is\nintroduced to the card instance, and let it up/down when an object is\nreferred via snd_lookup_*() in the open ops.\n\nThe free-after-last-close check is also changed to check this refcount\ninstead of the empty list, too.\n\nReported-by: Matthieu CASTET \u003cmatthieu.castet@parrot.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "588c72e88125b1abe50efb3f1b6b768b98302e2c", "tree": "63c14c345a99ea6e6bc52f76ab0ed756514ec131", "parents": [ "0ada2107a13f1b1ae8bdd5fec32912bc40f4e679" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Tue Jun 12 16:54:16 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:12 2012 -0800" }, "message": "nfsd: add get_uint for u32\u0027s\n\ncommit a007c4c3e943ecc054a806c259d95420a188754b upstream.\n\nI don\u0027t think there\u0027s a practical difference for the range of values\nthese interfaces should see, but it would be safer to be unambiguous.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nCc: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4435990b6d456a8c5cac203c025d1f10e0b48a93", "tree": "69364585dbc2eca1b9d073544416e515417c16f4", "parents": [ "537d86c490a03bcb56dfa24c0327c18e61b1ced5" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Fri Oct 26 00:36:40 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:11 2012 -0800" }, "message": "mac80211: verify that skb data is present\n\ncommit 9b395bc3be1cebf0144a127c7e67d56dbdac0930 upstream.\n\nA number of places in the mesh code don\u0027t check that\nthe frame data is present and in the skb header when\ntrying to access. Add those checks and the necessary\npskb_may_pull() calls. This prevents accessing data\nthat doesn\u0027t actually exist.\n\nTo do this, export ieee80211_get_mesh_hdrlen() to be\nable to use it in mac80211.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "da205c80275a7f7a90c2baab423783c55c406878", "tree": "ca82d03015baada1f76432e5fc4f4a0777ec00e4", "parents": [ "ccd37ab3230af7b32db1a139d9fe95918813bc23" ], "author": { "name": "Konrad Rzeszutek Wilk", "email": "konrad.wilk@oracle.com", "time": "Wed Oct 31 12:38:31 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:15:54 2012 -0800" }, "message": "xen/mmu: Use Xen specific TLB flush instead of the generic one.\n\ncommit 95a7d76897c1e7243d4137037c66d15cbf2cce76 upstream.\n\nAs Mukesh explained it, the MMUEXT_TLB_FLUSH_ALL allows the\nhypervisor to do a TLB flush on all active vCPUs. If instead\nwe were using the generic one (which ends up being xen_flush_tlb)\nwe end up making the MMUEXT_TLB_FLUSH_LOCAL hypercall. But\nbefore we make that hypercall the kernel will IPI all of the\nvCPUs (even those that were asleep from the hypervisor\nperspective). The end result is that we needlessly wake them\nup and do a TLB flush when we can just let the hypervisor\ndo it correctly.\n\nThis patch gives around 50% speed improvement when migrating\nidle guest\u0027s from one host to another.\n\nOracle-bug: 14630170\n\nTested-by: Jingjie Jiang \u003cjingjie.jiang@oracle.com\u003e\nSuggested-by: Mukesh Rathor \u003cmukesh.rathor@oracle.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a57a57aea0ad2ced60a8aa59d49fe542f23efb72", "tree": "348774a982105146820cab6908d92b4b04958e07", "parents": [ "7a32a0b9985742493575ffa1c6fedf043d966708" ], "author": { "name": "Josh Triplett", "email": "josh@joshtriplett.org", "time": "Fri Sep 28 17:55:44 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 31 10:03:18 2012 -0700" }, "message": "efi: Defer freeing boot services memory until after ACPI init\n\ncommit 785107923a83d8456bbd8564e288a24d84109a46 upstream.\n\nSome new ACPI 5.0 tables reference resources stored in boot services\nmemory, so keep that memory around until we have ACPI and can extract\ndata from it.\n\nSigned-off-by: Josh Triplett \u003cjosh@joshtriplett.org\u003e\nLink: http://lkml.kernel.org/r/baaa6d44bdc4eb0c58e5d1b4ccd2c729f854ac55.1348876882.git.josh@joshtriplett.org\nSigned-off-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nCc: Matt Fleming \u003cmatt@console-pimps.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "368845fde9e704288f370df57988767aab6042b4", "tree": "0ba42c19ff563daa24bdc08c2c1d7cf3bbaabd7d", "parents": [ "c87ece5a158f3907193202d84f2a316a4c363768" ], "author": { "name": "Yinghai Lu", "email": "yinghai@kernel.org", "time": "Mon Oct 22 16:35:18 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 31 10:02:56 2012 -0700" }, "message": "x86, mm: Trim memory in memblock to be page aligned\n\ncommit 6ede1fd3cb404c0016de6ac529df46d561bd558b upstream.\n\nWe will not map partial pages, so need to make sure memblock\nallocation will not allocate those bytes out.\n\nAlso we will use for_each_mem_pfn_range() to loop to map memory\nrange to keep them consistent.\n\nSigned-off-by: Yinghai Lu \u003cyinghai@kernel.org\u003e\nLink: http://lkml.kernel.org/r/CAE9FiQVZirvaBMFYRfXMmWEcHbKSicQEHz4VAwUv0xFCk51ZNw@mail.gmail.com\nAcked-by: Jacob Shin \u003cjacob.shin@amd.com\u003e\nSigned-off-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8357dde8b780b426d398f9e3701fdc16f0856766", "tree": "027378c8e6fb03205da85714bdb6f2095026a761", "parents": [ "f88df5ff96f5ea632aa2d193d2c9019aa4c728d9" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Oct 16 12:51:45 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 31 10:02:32 2012 -0700" }, "message": "drm/radeon: add some new SI PCI ids\n\ncommit b6aa22db7857ab7ed042d6c56b800bfc727cfdff upstream.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f2a713d25e8b95e065c90af72f461e99427e20f8", "tree": "557a4cb321242a78f9adaf0fc5801b641b0afe3b", "parents": [ "3ba595416b15151d2eaa12578c17cbfd64c06aec" ], "author": { "name": "Brian Norris", "email": "computersforpeace@gmail.com", "time": "Fri Jul 13 09:28:24 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:16 2012 -0700" }, "message": "mtd: nand: allow NAND_NO_SUBPAGE_WRITE to be set from driver\n\ncommit bf7a01bf7987b63b121d572b240c132ec44129c4 upstream.\n\nThe NAND_CHIPOPTIONS_MSK has limited utility and is causing real bugs. It\nsilently masks off at least one flag that might be set by the driver\n(NAND_NO_SUBPAGE_WRITE). This breaks the GPMI NAND driver and possibly\nothers.\n\nReally, as long as driver writers exercise a small amount of care with\nNAND_* options, this mask is not necessary at all; it was only here to\nprevent certain options from accidentally being set by the driver. But the\noriginal thought turns out to be a bad idea occasionally. Thus, kill it.\n\nNote, this patch fixes some major gpmi-nand breakage.\n\nSigned-off-by: Brian Norris \u003ccomputersforpeace@gmail.com\u003e\nTested-by: Huang Shijie \u003cshijie8@gmail.com\u003e\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: David Woodhouse \u003cDavid.Woodhouse@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2d2f242f248f19c4618bde9091d20416e2c9a1f6", "tree": "5b15e35dde9a352bde196de7619b7268271df260", "parents": [ "14a547a85a7fa2b6473eaa73b83e2055b476a5dc" ], "author": { "name": "Florian Zumbiehl", "email": "florz@florz.de", "time": "Sun Oct 07 15:51:58 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:15 2012 -0700" }, "message": "vlan: don\u0027t deliver frames for unknown vlans to protocols\n\n[ Upstream commit 48cc32d38a52d0b68f91a171a8d00531edc6a46e ]\n\n6a32e4f9dd9219261f8856f817e6655114cfec2f made the vlan code skip marking\nvlan-tagged frames for not locally configured vlans as PACKET_OTHERHOST if\nthere was an rx_handler, as the rx_handler could cause the frame to be received\non a different (virtual) vlan-capable interface where that vlan might be\nconfigured.\n\nAs rx_handlers do not necessarily return RX_HANDLER_ANOTHER, this could cause\nframes for unknown vlans to be delivered to the protocol stack as if they had\nbeen received untagged.\n\nFor example, if an ipv6 router advertisement that\u0027s tagged for a locally not\nconfigured vlan is received on an interface with macvlan interfaces attached,\nmacvlan\u0027s rx_handler returns RX_HANDLER_PASS after delivering the frame to the\nmacvlan interfaces, which caused it to be passed to the protocol stack, leading\nto ipv6 addresses for the announced prefix being configured even though those\nare completely unusable on the underlying interface.\n\nThe fix moves marking as PACKET_OTHERHOST after the rx_handler so the\nrx_handler, if there is one, sees the frame unchanged, but afterwards,\nbefore the frame is delivered to the protocol stack, it gets marked whether\nthere is an rx_handler or not.\n\nSigned-off-by: Florian Zumbiehl \u003cflorz@florz.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6114941a295ff186d29ab7462cce6a41a089c354", "tree": "9f75aa36c394130269ce8bd1adf23255ee5ab295", "parents": [ "70f7f1c70af637a23ca09ba1d2d7c966d1bd5990" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Thu Oct 04 20:15:49 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:15 2012 -0700" }, "message": "infiniband: pass rdma_cm module to netlink_dump_start\n\n[ Upstream commit 809d5fc9bf6589276a12bd4fd611e4c7ff9940c3 ]\n\nset netlink_dump_control.module to avoid panic.\n\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nCc: Roland Dreier \u003croland@kernel.org\u003e\nCc: Sean Hefty \u003csean.hefty@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "70f7f1c70af637a23ca09ba1d2d7c966d1bd5990", "tree": "b00dea2ae29b7459a2ff702134cc0824ecd0265d", "parents": [ "f0dc514c8a0fd7ee7b1f6a3ccdae3b38e6ee1578" ], "author": { "name": "Gao feng", "email": "gaofeng@cn.fujitsu.com", "time": "Thu Oct 04 20:15:48 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:15 2012 -0700" }, "message": "netlink: add reference of module in netlink_dump_start\n\n[ Upstream commit 6dc878a8ca39e93f70c42f3dd7260bde10c1e0f1 ]\n\nI get a panic when I use ss -a and rmmod inet_diag at the\nsame time.\n\nIt\u0027s because netlink_dump uses inet_diag_dump which belongs to module\ninet_diag.\n\nI search the codes and find many modules have the same problem. We\nneed to add a reference to the module which the cb-\u003edump belongs to.\n\nThanks for all help from Stephen,Jan,Eric,Steffen and Pablo.\n\nChange From v3:\nchange netlink_dump_start to inline,suggestion from Pablo and\nEric.\n\nChange From v2:\ndelete netlink_dump_done,and call module_put in netlink_dump\nand netlink_sock_destruct.\n\nSigned-off-by: Gao feng \u003cgaofeng@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9b62355a6daff8696ec7f7b1283b6a39650b9f14", "tree": "3e61e0e953d36b3f6b8705384bec209dcc228425", "parents": [ "baecc6ef799c7ab9a5fc0ba29ee560a5c264f306" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Mon Oct 22 12:56:58 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:13 2012 -0700" }, "message": "SUNRPC: Fix a UDP transport regression\n\ncommit f39c1bfb5a03e2d255451bff05be0d7255298fa4 and\ncommit 84e28a307e376f271505af65a7b7e212dd6f61f4 upstream.\n\nCommit 43cedbf0e8dfb9c5610eb7985d5f21263e313802 (SUNRPC: Ensure that\nwe grab the XPRT_LOCK before calling xprt_alloc_slot) is causing\nhangs in the case of NFS over UDP mounts.\n\nSince neither the UDP or the RDMA transport mechanism use dynamic slot\nallocation, we can skip grabbing the socket lock for those transports.\nAdd a new rpc_xprt_op to allow switching between the TCP and UDP/RDMA\ncase.\n\nNote that the NFSv4.1 back channel assigns the slot directly\nthrough rpc_run_bc_task, so we can ignore that case.\n\nReported-by: Dick Streefland \u003cdick.streefland@altium.nl\u003e\nSigned-off-by: Bryan Schumaker \u003cbjschuma@netapp.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0b0ea6a363eb3f5802adcb07c8c23e052a10d6bb", "tree": "5da08e9b81132440bba37497163a4b23e4366d17", "parents": [ "285ff6c4a762f556275182bcef767b61174c0424" ], "author": { "name": "Lin Ming", "email": "mlin@ss.pku.edu.cn", "time": "Sat Jul 07 18:26:10 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:28:00 2012 -0700" }, "message": "ipvs: fix oops on NAT reply in br_nf context\n\ncommit 9e33ce453f8ac8452649802bee1f410319408f4b upstream.\n\nIPVS should not reset skb-\u003enf_bridge in FORWARD hook\nby calling nf_reset for NAT replies. It triggers oops in\nbr_nf_forward_finish.\n\n[ 579.781508] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004\n[ 579.781669] IP: [\u003cffffffff817b1ca5\u003e] br_nf_forward_finish+0x58/0x112\n[ 579.781792] PGD 218f9067 PUD 0\n[ 579.781865] Oops: 0000 [#1] SMP\n[ 579.781945] CPU 0\n[ 579.781983] Modules linked in:\n[ 579.782047]\n[ 579.782080]\n[ 579.782114] Pid: 4644, comm: qemu Tainted: G W 3.5.0-rc5-00006-g95e69f9 #282 Hewlett-Packard /30E8\n[ 579.782300] RIP: 0010:[\u003cffffffff817b1ca5\u003e] [\u003cffffffff817b1ca5\u003e] br_nf_forward_finish+0x58/0x112\n[ 579.782455] RSP: 0018:ffff88007b003a98 EFLAGS: 00010287\n[ 579.782541] RAX: 0000000000000008 RBX: ffff8800762ead00 RCX: 000000000001670a\n[ 579.782653] RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff8800762ead00\n[ 579.782845] RBP: ffff88007b003ac8 R08: 0000000000016630 R09: ffff88007b003a90\n[ 579.782957] R10: ffff88007b0038e8 R11: ffff88002da37540 R12: ffff88002da01a02\n[ 579.783066] R13: ffff88002da01a80 R14: ffff88002d83c000 R15: ffff88002d82a000\n[ 579.783177] FS: 0000000000000000(0000) GS:ffff88007b000000(0063) knlGS:00000000f62d1b70\n[ 579.783306] CS: 0010 DS: 002b ES: 002b CR0: 000000008005003b\n[ 579.783395] CR2: 0000000000000004 CR3: 00000000218fe000 CR4: 00000000000027f0\n[ 579.783505] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 579.783684] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n[ 579.783795] Process qemu (pid: 4644, threadinfo ffff880021b20000, task ffff880021aba760)\n[ 579.783919] Stack:\n[ 579.783959] ffff88007693cedc ffff8800762ead00 ffff88002da01a02 ffff8800762ead00\n[ 579.784110] ffff88002da01a02 ffff88002da01a80 ffff88007b003b18 ffffffff817b26c7\n[ 579.784260] ffff880080000000 ffffffff81ef59f0 ffff8800762ead00 ffffffff81ef58b0\n[ 579.784477] Call Trace:\n[ 579.784523] \u003cIRQ\u003e\n[ 579.784562]\n[ 579.784603] [\u003cffffffff817b26c7\u003e] br_nf_forward_ip+0x275/0x2c8\n[ 579.784707] [\u003cffffffff81704b58\u003e] nf_iterate+0x47/0x7d\n[ 579.784797] [\u003cffffffff817ac32e\u003e] ? br_dev_queue_push_xmit+0xae/0xae\n[ 579.784906] [\u003cffffffff81704bfb\u003e] nf_hook_slow+0x6d/0x102\n[ 579.784995] [\u003cffffffff817ac32e\u003e] ? br_dev_queue_push_xmit+0xae/0xae\n[ 579.785175] [\u003cffffffff8187fa95\u003e] ? _raw_write_unlock_bh+0x19/0x1b\n[ 579.785179] [\u003cffffffff817ac417\u003e] __br_forward+0x97/0xa2\n[ 579.785179] [\u003cffffffff817ad366\u003e] br_handle_frame_finish+0x1a6/0x257\n[ 579.785179] [\u003cffffffff817b2386\u003e] br_nf_pre_routing_finish+0x26d/0x2cb\n[ 579.785179] [\u003cffffffff817b2cf0\u003e] br_nf_pre_routing+0x55d/0x5c1\n[ 579.785179] [\u003cffffffff81704b58\u003e] nf_iterate+0x47/0x7d\n[ 579.785179] [\u003cffffffff817ad1c0\u003e] ? br_handle_local_finish+0x44/0x44\n[ 579.785179] [\u003cffffffff81704bfb\u003e] nf_hook_slow+0x6d/0x102\n[ 579.785179] [\u003cffffffff817ad1c0\u003e] ? br_handle_local_finish+0x44/0x44\n[ 579.785179] [\u003cffffffff81551525\u003e] ? sky2_poll+0xb35/0xb54\n[ 579.785179] [\u003cffffffff817ad62a\u003e] br_handle_frame+0x213/0x229\n[ 579.785179] [\u003cffffffff817ad417\u003e] ? br_handle_frame_finish+0x257/0x257\n[ 579.785179] [\u003cffffffff816e3b47\u003e] __netif_receive_skb+0x2b4/0x3f1\n[ 579.785179] [\u003cffffffff816e69fc\u003e] process_backlog+0x99/0x1e2\n[ 579.785179] [\u003cffffffff816e6800\u003e] net_rx_action+0xdf/0x242\n[ 579.785179] [\u003cffffffff8107e8a8\u003e] __do_softirq+0xc1/0x1e0\n[ 579.785179] [\u003cffffffff8135a5ba\u003e] ? trace_hardirqs_off_thunk+0x3a/0x6c\n[ 579.785179] [\u003cffffffff8188812c\u003e] call_softirq+0x1c/0x30\n\nThe steps to reproduce as follow,\n\n1. On Host1, setup brige br0(192.168.1.106)\n2. Boot a kvm guest(192.168.1.105) on Host1 and start httpd\n3. Start IPVS service on Host1\n ipvsadm -A -t 192.168.1.106:80 -s rr\n ipvsadm -a -t 192.168.1.106:80 -r 192.168.1.105:80 -m\n4. Run apache benchmark on Host2(192.168.1.101)\n ab -n 1000 http://192.168.1.106/\n\nip_vs_reply4\n ip_vs_out\n handle_response\n ip_vs_notrack\n nf_reset()\n {\n skb-\u003enf_bridge \u003d NULL;\n }\n\nActually, IPVS wants in this case just to replace nfct\nwith untracked version. So replace the nf_reset(skb) call\nin ip_vs_notrack() with a nf_conntrack_put(skb-\u003enfct) call.\n\nSigned-off-by: Lin Ming \u003cmlin@ss.pku.edu.cn\u003e\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Simon Horman \u003chorms@verge.net.au\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0fc58b2ff3f70a6bcfac562c68ec62939c37268a", "tree": "b18b3e78186d41acd9c5b1ba73c3e5a3aff807d3", "parents": [ "7fcbcdc96302e9d3e3b36df4fbc86a4c82761092" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@blackhole.kfki.hu", "time": "Mon May 07 02:35:44 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:28:00 2012 -0700" }, "message": "netfilter: ipset: fix timeout value overflow bug\n\ncommit 127f559127f5175e4bec3dab725a34845d956591 upstream.\n\nLarge timeout parameters could result wrong timeout values due to\nan overflow at msec to jiffies conversion (reported by Andreas Herz)\n\n[ This patch was mangled by Pablo Neira Ayuso since David Laight and\n Eric Dumazet noticed that we were using hardcoded 1000 instead of\n MSEC_PER_SEC to calculate the timeout ]\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@blackhole.kfki.hu\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7fcbcdc96302e9d3e3b36df4fbc86a4c82761092", "tree": "770030ce43176a21b837307e7f8a4474d95d7296", "parents": [ "486aaeb0b972820ed704bdf416270ec4b0950da3" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Aug 29 16:25:49 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:28:00 2012 -0700" }, "message": "netfilter: nf_conntrack: fix racy timer handling with reliable events\n\ncommit 5b423f6a40a0327f9d40bc8b97ce9be266f74368 upstream.\n\nExisting code assumes that del_timer returns true for alive conntrack\nentries. However, this is not true if reliable events are enabled.\nIn that case, del_timer may return true for entries that were\njust inserted in the dying list. Note that packets / ctnetlink may\nhold references to conntrack entries that were just inserted to such\nlist.\n\nThis patch fixes the issue by adding an independent timer for\nevent delivery. This increases the size of the ecache extension.\nStill we can revisit this later and use variable size extensions\nto allocate this area on demand.\n\nTested-by: Oliver Smith \u003colipro@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "04a30bd9dccbeee2cc6b035e42a37e9be0fa8c6c", "tree": "8b8c631b4b951e9a1676464c8f033143b979f7ed", "parents": [ "33efe2910bf7865a7d1fba4b06c9fa4b6fda6856" ], "author": { "name": "Mel Gorman", "email": "mgorman@suse.de", "time": "Mon Oct 08 16:29:17 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:56 2012 +0900" }, "message": "mempolicy: fix a race in shared_policy_replace()\n\ncommit b22d127a39ddd10d93deee3d96e643657ad53a49 upstream.\n\nshared_policy_replace() use of sp_alloc() is unsafe. 1) sp_node cannot\nbe dereferenced if sp-\u003elock is not held and 2) another thread can modify\nsp_node between spin_unlock for allocating a new sp node and next\nspin_lock. The bug was introduced before 2.6.12-rc2.\n\nKosaki\u0027s original patch for this problem was to allocate an sp node and\npolicy within shared_policy_replace and initialise it when the lock is\nreacquired. I was not keen on this approach because it partially\nduplicates sp_alloc(). As the paths were sp-\u003elock is taken are not that\nperformance critical this patch converts sp-\u003elock to sp-\u003emutex so it can\nsleep when calling sp_alloc().\n\n[kosaki.motohiro@jp.fujitsu.com: Original patch]\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nAcked-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nReviewed-by: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Josh Boyer \u003cjwboyer@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "53bf1469924e07385b4493d3cbd78551d4afaaa3", "tree": "26fd323abf51bc1e9a5362b3ebbd0869425bea6d", "parents": [ "743b911d8b2214bfa9ecd1631edbe6f61f8fdced" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Thu Sep 20 10:01:49 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:41 2012 +0900" }, "message": "xfrm_user: ensure user supplied esn replay window is valid\n\n[ Upstream commit ecd7918745234e423dd87fcc0c077da557909720 ]\n\nThe current code fails to ensure that the netlink message actually\ncontains as many bytes as the header indicates. If a user creates a new\nstate or updates an existing one but does not supply the bytes for the\nwhole ESN replay window, the kernel copies random heap bytes into the\nreplay bitmap, the ones happen to follow the XFRMA_REPLAY_ESN_VAL\nnetlink attribute. This leads to following issues:\n\n1. The replay window has random bits set confusing the replay handling\n code later on.\n\n2. A malicious user could use this flaw to leak up to ~3.5kB of heap\n memory when she has access to the XFRM netlink interface (requires\n CAP_NET_ADMIN).\n\nKnown users of the ESN replay window are strongSwan and Steffen\u0027s\niproute2 patch (\u003chttp://patchwork.ozlabs.org/patch/85962/\u003e). The latter\nuses the interface with a bitmap supplied while the former does not.\nstrongSwan is therefore prone to run into issue 1.\n\nTo fix both issues without breaking existing userland allow using the\nXFRMA_REPLAY_ESN_VAL netlink attribute with either an empty bitmap or a\nfully specified one. For the former case we initialize the in-kernel\nbitmap with zero, for the latter we copy the user supplied bitmap. For\nstate updates the full bitmap must be supplied.\n\nTo prevent overflows in the bitmap length calculation the maximum size\nof bmp_len is limited to 128 by this patch -- resulting in a maximum\nreplay window of 4096 packets. This should be sufficient for all real\nlife scenarios (RFC 4303 recommends a default replay window size of 64).\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nCc: Martin Willi \u003cmartin@revosec.ch\u003e\nCc: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "20eb20851385e53d27dff9ed79c4e68e58e3d9da", "tree": "b3a5a5e16f823d5ca39f44124bf18b5f63fa2a2f", "parents": [ "657197486950474bf30290344339fd0914fe99c9" ], "author": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Sep 04 00:03:29 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:40 2012 +0900" }, "message": "xfrm: Workaround incompatibility of ESN and async crypto\n\n[ Upstream commit 3b59df46a449ec9975146d71318c4777ad086744 ]\n\nESN for esp is defined in RFC 4303. This RFC assumes that the\nsequence number counters are always up to date. However,\nthis is not true if an async crypto algorithm is employed.\n\nIf the sequence number counters are not up to date on sequence\nnumber check, we may incorrectly update the upper 32 bit of\nthe sequence number. This leads to a DOS.\n\nWe workaround this by comparing the upper sequence number,\n(used for authentication) with the upper sequence number\ncomputed after the async processing. We drop the packet\nif these numbers are different.\n\nTo do this, we introduce a recheck function that does this\ncheck in the ESN case.\n\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nAcked-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "268b7d491c88845b410b2dfc84af54075db35c4d", "tree": "b3cbc271f68d91146ba0557a01c96c3073f5e162", "parents": [ "c5500c74ff1414578161b796557b382d5cbaf024" ], "author": { "name": "Flavio Leitner", "email": "fbl@redhat.com", "time": "Fri Sep 21 21:04:34 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 08:32:25 2012 -0700" }, "message": "serial: set correct baud_base for EXSYS EX-41092 Dual 16950\n\ncommit 26e8220adb0aec43b7acafa0f1431760eee28522 upstream.\n\nApparently the same card model has two IDs, so this patch\ncomplements the commit 39aced68d664291db3324d0fcf0985ab5626aac2\nadding the missing one.\n\nSigned-off-by: Flavio Leitner \u003cfbl@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "97ed537eaa6ff11c9a1df342364e25d0996bc117", "tree": "e8aae3109bf171e537f3472f5a1e66edd3c0255e", "parents": [ "34b6567e91b3ff6209c16b3868ec95e0e1cddc1f" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Thu Jul 19 13:52:53 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:40 2012 -0700" }, "message": "kthread_worker: reimplement flush_kthread_work() to allow freeing the work item being executed\n\ncommit 46f3d976213452350f9d10b0c2780c2681f7075b upstream.\n\nkthread_worker provides minimalistic workqueue-like interface for\nusers which need a dedicated worker thread (e.g. for realtime\npriority). It has basic queue, flush_work, flush_worker operations\nwhich mostly match the workqueue counterparts; however, due to the way\nflush_work() is implemented, it has a noticeable difference of not\nallowing work items to be freed while being executed.\n\nWhile the current users of kthread_worker are okay with the current\nbehavior, the restriction does impede some valid use cases. Also,\nremoving this difference isn\u0027t difficult and actually makes the code\neasier to understand.\n\nThis patch reimplements flush_kthread_work() such that it uses a\nflush_work item instead of queue/done sequence numbers.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Colin Cross \u003cccross@google.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9a227fcb842a03fce5b8a6da0da40f5601ec6908", "tree": "d186f0f90e021d9fc9a35ab009cdcab3e315c8a2", "parents": [ "80257cbe62ea0919153c43421746269ab68473bf" ], "author": { "name": "John Stultz", "email": "john.stultz@linaro.org", "time": "Tue Sep 11 15:04:19 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:36 2012 -0700" }, "message": "time: Move ktime_t overflow checking into timespec_valid_strict\n\ncommit cee58483cf56e0ba355fdd97ff5e8925329aa936 upstream\n\nAndreas Bombe reported that the added ktime_t overflow checking added to\ntimespec_valid in commit 4e8b14526ca7 (\"time: Improve sanity checking of\ntimekeeping inputs\") was causing problems with X.org because it caused\ntimeouts larger then KTIME_T to be invalid.\n\nPreviously, these large timeouts would be clamped to KTIME_MAX and would\nnever expire, which is valid.\n\nThis patch splits the ktime_t overflow checking into a new\ntimespec_valid_strict function, and converts the timekeeping codes\ninternal checking to use this more strict function.\n\nReported-and-tested-by: Andreas Bombe \u003caeb@debian.org\u003e\nCc: Zhouping Liu \u003czliu@redhat.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8e878154f5658ba93cf9bb2b491a930ec195de3d", "tree": "7c90f9cafce87cdf0b5629933a35144ee3d11d44", "parents": [ "504471eb5044e4a1dd10950d1a3efab39ba2083a" ], "author": { "name": "John Stultz", "email": "john.stultz@linaro.org", "time": "Tue Sep 11 15:04:17 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:36 2012 -0700" }, "message": "time: Improve sanity checking of timekeeping inputs\n\ncommit 4e8b14526ca7fb046a81c94002c1c43b6fdf0e9b upstream.\n\nUnexpected behavior could occur if the time is set to a value large\nenough to overflow a 64bit ktime_t (which is something larger then the\nyear 2262).\n\nAlso unexpected behavior could occur if large negative offsets are\ninjected via adjtimex.\n\nSo this patch improves the sanity check timekeeping inputs by\nimproving the timespec_valid() check, and then makes better use of\ntimespec_valid() to make sure we don\u0027t set the time to an invalid\nnegative value or one that overflows ktime_t.\n\nNote: This does not protect from setting the time close to overflowing\nktime_t and then letting natural accumulation cause the overflow.\n\nReported-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nReported-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Zhouping Liu \u003czliu@redhat.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: http://lkml.kernel.org/r/1344454580-17031-1-git-send-email-john.stultz@linaro.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e194fab8d7ebe95db5609f1cb6794c2afcc3118f", "tree": "2367f196d1cfa94a2078834bee0d4a64734eb884", "parents": [ "6418cc471b5d8a64ce22d2aa827fcb275e61449c" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Fri Jun 22 13:36:05 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:35 2012 -0700" }, "message": "sched: Fix race in task_group()\n\ncommit 8323f26ce3425460769605a6aece7a174edaa7d1 upstream.\n\nStefan reported a crash on a kernel before a3e5d1091c1 (\"sched:\nDon\u0027t call task_group() too many times in set_task_rq()\"), he\nfound the reason to be that the multiple task_group()\ninvocations in set_task_rq() returned different values.\n\nLooking at all that I found a lack of serialization and plain\nwrong comments.\n\nThe below tries to fix it using an extra pointer which is\nupdated under the appropriate scheduler locks. Its not pretty,\nbut I can\u0027t really see another way given how all the cgroup\nstuff works.\n\nReported-and-tested-by: Stefan Bader \u003cstefan.bader@canonical.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/r/1340364965.18025.71.camel@twins\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0fcc0805df9cf7483e927cf6a4dc94938318c06a", "tree": "5218645ca3737cf7ec1d9b3a039b6a1ec8048931", "parents": [ "27d50469825fd267f44e13fb0627b011c0da6abd" ], "author": { "name": "Vinicius Costa Gomes", "email": "vinicius.gomes@openbossa.org", "time": "Thu Aug 23 21:32:43 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:34 2012 -0700" }, "message": "Bluetooth: Change signature of smp_conn_security()\n\ncommit cc110922da7e902b62d18641a370fec01a9fa794 upstream.\n\nTo make it clear that it may be called from contexts that may not have\nany knowledge of L2CAP, we change the connection parameter, to receive\na hci_conn.\n\nThis also makes it clear that it is checking the security of the link.\n\nSigned-off-by: Vinicius Costa Gomes \u003cvinicius.gomes@openbossa.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2607b9407db4cbc16d5a130c8c16702711c3b7be", "tree": "396f6488dd277120460e0c4cd098a1a9e36b47f6", "parents": [ "4368ade3ff2bfff1033f9e5758630b3d4e8f7e71" ], "author": { "name": "Jakob Bornecrantz", "email": "jakob@vmware.com", "time": "Thu Aug 16 08:29:03 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:23 2012 -0700" }, "message": "drm: Check for invalid cursor flags\n\ncommit 7c4eaca4162d0b5ad4fb39f974d7ffd71b9daa09 upstream.\n\nSigned-off-by: Jakob Bornecrantz \u003cjakob@vmware.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e60b883144de35ea312a7570460cfe6a42af61c1", "tree": "55bf5ed0bebeb5d0eaf57982cf6308531950a4f4", "parents": [ "86236252d2449313bdbac790023cbc957bf6e426" ], "author": { "name": "Will Deacon", "email": "will.deacon@arm.com", "time": "Fri Aug 10 15:22:09 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:21 2012 -0700" }, "message": "mutex: Place lock in contended state after fastpath_lock failure\n\ncommit 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 upstream.\n\nARM recently moved to asm-generic/mutex-xchg.h for its mutex\nimplementation after the previous implementation was found to be missing\nsome crucial memory barriers. However, this has revealed some problems\nrunning hackbench on SMP platforms due to the way in which the\nMUTEX_SPIN_ON_OWNER code operates.\n\nThe symptoms are that a bunch of hackbench tasks are left waiting on an\nunlocked mutex and therefore never get woken up to claim it. This boils\ndown to the following sequence of events:\n\n Task A Task B Task C Lock value\n0 1\n1 lock() 0\n2 lock() 0\n3 spin(A) 0\n4 unlock() 1\n5 lock() 0\n6 cmpxchg(1,0) 0\n7 contended() -1\n8 lock() 0\n9 spin(C) 0\n10 unlock() 1\n11 cmpxchg(1,0) 0\n12 unlock() 1\n\nAt this point, the lock is unlocked, but Task B is in an uninterruptible\nsleep with nobody to wake it up.\n\nThis patch fixes the problem by ensuring we put the lock into the\ncontended state if we fail to acquire it on the fastpath, ensuring that\nany blocked waiters are woken up when the mutex is released.\n\nSigned-off-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Chris Mason \u003cchris.mason@fusionio.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nReviewed-by: Nicolas Pitre \u003cnico@linaro.org\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/n/tip-6e9lrw2avczr0617fzl5vqb8@git.kernel.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f15e72437813a8943aaa3f7528e464923c31437f", "tree": "04dc4af22e6a25c098b22bb443d535102affc6b8", "parents": [ "010ec57f5f6706fbafe9b198846c35500de7aa91" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Mon Sep 03 14:56:02 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:19 2012 -0700" }, "message": "NFS: Fix the initialisation of the readdir \u0027cookieverf\u0027 array\n\ncommit c3f52af3e03013db5237e339c817beaae5ec9e3a upstream.\n\nWhen the NFS_COOKIEVERF helper macro was converted into a static\ninline function in commit 99fadcd764 (nfs: convert NFS_*(inode)\nhelpers to static inline), we broke the initialisation of the\nreaddir cookies, since that depended on doing a memset with an\nargument of \u0027sizeof(NFS_COOKIEVERF(inode))\u0027 which therefore\nchanged from sizeof(be32 cookieverf[2]) to sizeof(be32 *).\n\nAt this point, NFS_COOKIEVERF seems to be more of an obfuscation\nthan a helper, so the best thing would be to just get rid of it.\n\nAlso see: https://bugzilla.kernel.org/show_bug.cgi?id\u003d46881\n\nReported-by: Andi Kleen \u003candi@firstfloor.org\u003e\nReported-by: David Binderman \u003cdcb314@hotmail.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c648535596087f7d17458c293d69829ff6e60a6c", "tree": "e53d6a8026ad35a0cadda0e812faa95c8ef054c4", "parents": [ "dca2dd18c62e3b90cb71534e0a715d246ce7196d" ], "author": { "name": "Wen Congyang", "email": "wency@cn.fujitsu.com", "time": "Thu Sep 20 14:04:47 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:08 2012 -0700" }, "message": "tracing: Don\u0027t call page_to_pfn() if page is NULL\n\ncommit 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa upstream.\n\nWhen allocating memory fails, page is NULL. page_to_pfn() will\ncause the kernel panicked if we don\u0027t use sparsemem vmemmap.\n\nLink: http://lkml.kernel.org/r/505AB1FF.8020104@cn.fujitsu.com\n\nAcked-by: Mel Gorman \u003cmel@csn.ul.ie\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Minchan Kim \u003cminchan@kernel.org\u003e\nSigned-off-by: Wen Congyang \u003cwency@cn.fujitsu.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "449efd1d33fcf40a81f902ceed6a21a406f8d105", "tree": "2369eb51e11ae3f8ce450055593a6649e7675980", "parents": [ "967c0e4ab954d228ca87d85c523ae8a65c03cc5e" ], "author": { "name": "Stefano Stabellini", "email": "stefano.stabellini@eu.citrix.com", "time": "Wed Sep 12 12:44:30 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:06 2012 -0700" }, "message": "xen/m2p: do not reuse kmap_op-\u003edev_bus_addr\n\ncommit 2fc136eecd0c647a6b13fcd00d0c41a1a28f35a5 upstream.\n\nIf the caller passes a valid kmap_op to m2p_add_override, we use\nkmap_op-\u003edev_bus_addr to store the original mfn, but dev_bus_addr is\npart of the interface with Xen and if we are batching the hypercalls it\nmight not have been written by the hypervisor yet. That means that later\non Xen will write to it and we\u0027ll think that the original mfn is\nactually what Xen has written to it.\n\nRather than \"stealing\" struct members from kmap_op, keep using\npage-\u003eindex to store the original mfn and add another parameter to\nm2p_remove_override to get the corresponding kmap_op instead.\nIt is now responsibility of the caller to keep track of which kmap_op\ncorresponds to a particular page in the m2p_override (gntdev, the only\nuser of this interface that passes a valid kmap_op, is already doing that).\n\nReported-and-Tested-By: Sander Eikelenboom \u003clinux@eikelenboom.it\u003e\nSigned-off-by: Stefano Stabellini \u003cstefano.stabellini@eu.citrix.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "32e653056d900d3ecc984733dbfcea34c92bf6d0", "tree": "6f7adb3847243b894ed8f6b1589109c53bd03f0f", "parents": [ "fea0071c60870fbebc605ef72d87668d72dbbd81" ], "author": { "name": "Jianguo Wu", "email": "wujianguo@huawei.com", "time": "Mon Sep 17 14:08:56 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:05 2012 -0700" }, "message": "mm/ia64: fix a memory block size bug\n\ncommit 05cf96398e1b6502f9e191291b715c7463c9d5dd upstream.\n\nI found following definition in include/linux/memory.h, in my IA64\nplatform, SECTION_SIZE_BITS is equal to 32, and MIN_MEMORY_BLOCK_SIZE\nwill be 0.\n\n #define MIN_MEMORY_BLOCK_SIZE (1 \u003c\u003c SECTION_SIZE_BITS)\n\nBecause MIN_MEMORY_BLOCK_SIZE is int type and length of 32bits,\nso MIN_MEMORY_BLOCK_SIZE(1 \u003c\u003c 32) will will equal to 0.\nActually when SECTION_SIZE_BITS \u003e\u003d 31, MIN_MEMORY_BLOCK_SIZE will be wrong.\nThis will cause wrong system memory infomation in sysfs.\nI think it should be:\n\n #define MIN_MEMORY_BLOCK_SIZE (1UL \u003c\u003c SECTION_SIZE_BITS)\n\nAnd \"echo offline \u003e memory0/state\" will cause following call trace:\n\n kernel BUG at mm/memory_hotplug.c:885!\n sh[6455]: bugcheck! 0 [1]\n Pid: 6455, CPU 0, comm: sh\n psr : 0000101008526030 ifs : 8000000000000fa4 ip : [\u003ca0000001008c40f0\u003e] Not tainted (3.6.0-rc1)\n ip is at offline_pages+0x210/0xee0\n Call Trace:\n show_stack+0x80/0xa0\n show_regs+0x640/0x920\n die+0x190/0x2c0\n die_if_kernel+0x50/0x80\n ia64_bad_break+0x3d0/0x6e0\n ia64_native_leave_kernel+0x0/0x270\n offline_pages+0x210/0xee0\n alloc_pages_current+0x180/0x2a0\n\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Jiang Liu \u003cjiang.liu@huawei.com\u003e\nCc: \"Luck, Tony\" \u003ctony.luck@intel.com\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cf499a04f9b5c8d2218257046b66b3062401673a", "tree": "9c9930f689aa9df537462aed2e08e423dd181a3a", "parents": [ "f0868b703758f19c2ced945c2c3fce1c151ab369" ], "author": { "name": "Bjørn Mork", "email": "bjorn@mork.no", "time": "Sun Sep 02 15:41:34 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:55 2012 -0700" }, "message": "kobject: fix oops with \"input0: bad kobj_uevent_env content in show_uevent()\"\n\ncommit 60e233a56609fd963c59e99bd75c663d63fa91b6 upstream.\n\nFengguang Wu \u003cfengguang.wu@intel.com\u003e writes:\n\n\u003e After the __devinit* removal series, I can still get kernel panic in\n\u003e show_uevent(). So there are more sources of bug..\n\u003e\n\u003e Debug patch:\n\u003e\n\u003e @@ -343,8 +343,11 @@ static ssize_t show_uevent(struct device\n\u003e goto out;\n\u003e\n\u003e /* copy keys to file */\n\u003e - for (i \u003d 0; i \u003c env-\u003eenvp_idx; i++)\n\u003e + dev_err(dev, \"uevent %d env[%d]: %s/.../%s\\n\", env-\u003ebuflen, env-\u003eenvp_idx, top_kobj-\u003ename, dev-\u003ekobj.name);\n\u003e + for (i \u003d 0; i \u003c env-\u003eenvp_idx; i++) {\n\u003e + printk(KERN_ERR \"uevent %d env[%d]: %s\\n\", (int)count, i, env-\u003eenvp[i]);\n\u003e count +\u003d sprintf(\u0026buf[count], \"%s\\n\", env-\u003eenvp[i]);\n\u003e + }\n\u003e\n\u003e Oops message, the env[] is again not properly initilized:\n\u003e\n\u003e [ 44.068623] input input0: uevent 61 env[805306368]: input0/.../input0\n\u003e [ 44.069552] uevent 0 env[0]: (null)\n\nThis is a completely different CONFIG_HOTPLUG problem, only\ndemonstrating another reason why CONFIG_HOTPLUG should go away. I had a\nhard time trying to disable it anyway ;-)\n\nThe problem this time is lots of code assuming that a call to\nadd_uevent_var() will guarantee that env-\u003ebuflen \u003e 0. This is not true\nif CONFIG_HOTPLUG is unset. So things like this end up overwriting\nenv-\u003eenvp_idx because the array index is -1:\n\n\tif (add_uevent_var(env, \"MODALIAS\u003d\"))\n\t\treturn -ENOMEM;\n len \u003d input_print_modalias(\u0026env-\u003ebuf[env-\u003ebuflen - 1],\n\t\t\t\t sizeof(env-\u003ebuf) - env-\u003ebuflen,\n\t\t\t\t dev, 0);\n\nDon\u0027t know what the best action is, given that there seem to be a *lot*\nof this around the kernel. This patch \"fixes\" the problem for me, but I\ndon\u0027t know if it can be considered an appropriate fix.\n\n[ It is the correct fix for now, for 3.7 forcing CONFIG_HOTPLUG to\nalways be on is the longterm fix, but it\u0027s too late for 3.6 and older\nkernels to resolve this that way - gregkh ]\n\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nTested-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d409354d1b8a1e47b8f29887179949ec951ffe83", "tree": "a60384b71bacbc43d1dc3b1a5136b1e7a8ebc99f", "parents": [ "e66a381518f9ebf98cdc583d20ae706aa5d1dc28" ], "author": { "name": "Ian Chen", "email": "ian.cy.chen@samsung.com", "time": "Wed Aug 29 15:05:36 2012 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:54 2012 -0700" }, "message": "mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.\n\ncommit 3550ccdb9d8d350e526b809bf3dd92b550a74fe1 upstream.\n\nFor several MoviNAND eMMC parts, there are known issues with secure\nerase and secure trim. For these specific MoviNAND devices, we skip\nthese operations.\n\nSpecifically, there is a bug in the eMMC firmware that causes\nunrecoverable corruption when the MMC is erased with MMC_CAP_ERASE\nenabled.\n\nReferences:\n\nhttp://forum.xda-developers.com/showthread.php?t\u003d1644364\nhttps://plus.google.com/111398485184813224730/posts/21pTYfTsCkB#111398485184813224730/posts/21pTYfTsCkB\n\nSigned-off-by: Ian Chen \u003cian.cy.chen@samsung.com\u003e\nReviewed-by: Namjae Jeon \u003clinkinjeon@gmail.com\u003e\nAcked-by: Jaehoon Chung \u003cjh80.chung@samsung.com\u003e\nReviewed-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Chris Ball \u003ccjb@laptop.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d156b47c4242843096e4a13f8ace5a0626bde3e9", "tree": "517ce331697fce4a5aadba64df99919e60235c53", "parents": [ "9b52a3b313497af37dcdba4ba4c0c95809db525c" ], "author": { "name": "Al Viro", "email": "viro@ZenIV.linux.org.uk", "time": "Mon Aug 20 14:59:25 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:54 2012 -0700" }, "message": "perf_event: Switch to internal refcount, fix race with close()\n\ncommit a6fa941d94b411bbd2b6421ffbde6db3c93e65ab upstream.\n\nDon\u0027t mess with file refcounts (or keep a reference to file, for\nthat matter) in perf_event. Use explicit refcount of its own\ninstead. Deal with the race between the final reference to event\ngoing away and new children getting created for it by use of\natomic_long_inc_not_zero() in inherit_event(); just have the\nlatter free what it had allocated and return NULL, that works\nout just fine (children of siblings of something doomed are\ncreated as singletons, same as if the child of leader had been\ncreated and immediately killed).\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/r/20120820135925.GG23464@ZenIV.linux.org.uk\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f92e8b0ddb85dfe7d8d2547516c873ec8dd9838e", "tree": "ab1d76761b98911b413eb705cad3516311e50fd6", "parents": [ "5975bc201acbe121eaf22ee41076a08b92abc26f" ], "author": { "name": "Miklos Szeredi", "email": "mszeredi@suse.cz", "time": "Mon Sep 17 22:31:38 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:51 2012 -0700" }, "message": "vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill()\n\ncommit b161dfa6937ae46d50adce8a7c6b12233e96e7bd upstream.\n\nIBM reported a soft lockup after applying the fix for the rename_lock\ndeadlock. Commit c83ce989cb5f (\"VFS: Fix the nfs sillyrename regression\nin kernel 2.6.38\") was found to be the culprit.\n\nThe nfs sillyrename fix used DCACHE_DISCONNECTED to indicate that the\ndentry was killed. This flag can be set on non-killed dentries too,\nwhich results in infinite retries when trying to traverse the dentry\ntree.\n\nThis patch introduces a separate flag: DCACHE_DENTRY_KILLED, which is\nonly set in d_kill() and makes try_to_ascend() test only this flag.\n\nIBM reported successful test results with this patch.\n\nSigned-off-by: Miklos Szeredi \u003cmszeredi@suse.cz\u003e\nCc: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6cacd608448898cf0b7bb4353e1a92c6dc7d5dd9", "tree": "b028a0fbe2a78e7f1cec0403b5061fb83cea5d03", "parents": [ "b9d798a996cddfc4c1045e9af97ee434ccab4956" ], "author": { "name": "Yuval Mintz", "email": "yuvalmin@broadcom.com", "time": "Sun Aug 26 00:35:45 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:50 2012 -0700" }, "message": "bnx2x: fix 57840_MF pci id\n\n[ Upstream commit 5c879d2094946081af934739850c7260e8b25d3c ]\n\nCommit c3def943c7117d42caaed3478731ea7c3c87190e have added support for\nnew pci ids of the 57840 board, while failing to change the obsolete value\nin \u0027pci_ids.h\u0027.\nThis patch does so, allowing the probe of such devices.\n\nSigned-off-by: Yuval Mintz \u003cyuvalmin@broadcom.com\u003e\nSigned-off-by: Eilon Greenstein \u003ceilong@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7c799a1e1ca2bc766574078b684c14474da9f704", "tree": "3920b2c94d08c9355c0f6f3e94b30f8ffd42529b", "parents": [ "9e296becde8a8da5bcc1a8e22f27bdf9bd8636fe" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Aug 21 06:21:17 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:37 2012 -0700" }, "message": "af_netlink: force credentials passing [CVE-2012-3520]\n\n[ Upstream commit e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea ]\n\nPablo Neira Ayuso discovered that avahi and\npotentially NetworkManager accept spoofed Netlink messages because of a\nkernel bug. The kernel passes all-zero SCM_CREDENTIALS ancillary data\nto the receiver if the sender did not provide such data, instead of not\nincluding any such data at all or including the correct data from the\npeer (as it is the case with AF_UNIX).\n\nThis bug was introduced in commit 16e572626961\n(af_unix: dont send SCM_CREDENTIALS by default)\n\nThis patch forces passing credentials for netlink, as\nbefore the regression.\n\nAnother fix would be to not add SCM_CREDENTIALS in\nnetlink messages if not provided by the sender, but it\nmight break some programs.\n\nWith help from Florian Weimer \u0026 Petr Matousek\n\nThis issue is designated as CVE-2012-3520\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Petr Matousek \u003cpmatouse@redhat.com\u003e\nCc: Florian Weimer \u003cfweimer@redhat.com\u003e\nCc: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9e296becde8a8da5bcc1a8e22f27bdf9bd8636fe", "tree": "be7a8a0b16cb84b2781b7e210e9749b8236092db", "parents": [ "d09b3b2b1183848e287bc0b6397f8d05945becc4" ], "author": { "name": "Eric Leblond", "email": "eric@regit.org", "time": "Thu Aug 16 22:02:58 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:37 2012 -0700" }, "message": "af_packet: don\u0027t emit packet on orig fanout group\n\n[ Upstream commit c0de08d04215031d68fa13af36f347a6cfa252ca ]\n\nIf a packet is emitted on one socket in one group of fanout sockets,\nit is transmitted again. It is thus read again on one of the sockets\nof the fanout group. This result in a loop for software which\ngenerate packets when receiving one.\nThis retransmission is not the intended behavior: a fanout group\nmust behave like a single socket. The packet should not be\ntransmitted on a socket if it originates from a socket belonging\nto the same fanout group.\n\nThis patch fixes the issue by changing the transmission check to\ntake fanout group info account.\n\nReported-by: Aleksandr Kotov \u003ca1k@mail.ru\u003e\nSigned-off-by: Eric Leblond \u003ceric@regit.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4658b24b2dd0e4c6215db2203743fa999765e8a0", "tree": "9a88804f646780a2424a5ac87586151e923b1b64", "parents": [ "0a1f711681e0d7068b69c0697c4ba284fbf1b2bf" ], "author": { "name": "Ben Hutchings", "email": "bhutchings@solarflare.com", "time": "Mon Jul 30 16:11:42 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:34 2012 -0700" }, "message": "tcp: Apply device TSO segment limit earlier\n\n[ Upstream commit 1485348d2424e1131ea42efc033cbd9366462b01 ]\n\nCache the device gso_max_segs in sock::sk_gso_max_segs and use it to\nlimit the size of TSO skbs. This avoids the need to fall back to\nsoftware GSO for local TCP senders.\n\nSigned-off-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2dc3b21fbca98bd3c8d9e53acf5d966add3c7606", "tree": "6fe9f88dec40cfca839962a5a363848b27afb744", "parents": [ "00709f7f01c3a10252f030f0bdacecbb349d7be4" ], "author": { "name": "Ben Hutchings", "email": "bhutchings@solarflare.com", "time": "Mon Jul 30 15:57:00 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:34 2012 -0700" }, "message": "net: Allow driver to limit number of GSO segments per skb\n\n[ Upstream commit 30b678d844af3305cda5953467005cebb5d7b687 ]\n\nA peer (or local user) may cause TCP to use a nominal MSS of as little\nas 88 (actual MSS of 76 with timestamps). Given that we have a\nsufficiently prodigious local sender and the peer ACKs quickly enough,\nit is nevertheless possible to grow the window for such a connection\nto the point that we will try to send just under 64K at once. This\nresults in a single skb that expands to 861 segments.\n\nIn some drivers with TSO support, such an skb will require hundreds of\nDMA descriptors; a substantial fraction of a TX ring or even more than\na full ring. The TX queue selected for the skb may stall and trigger\nthe TX watchdog repeatedly (since the problem skb will be retried\nafter the TX reset). This particularly affects sfc, for which the\nissue is designated as CVE-2012-3412.\n\nTherefore:\n1. Add the field net_device::gso_max_segs holding the device-specific\n limit.\n2. In netif_skb_features(), if the number of segments is too high then\n mask out GSO features to force fall back to software GSO.\n\nSigned-off-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "952227d5c4d522502b7b815b16be6e991bbaeaed", "tree": "89ffbc3abe99e861e2e6e06c3e8dcdb1901cb7df", "parents": [ "1aac2e73a8af6ce1cd6e938967dd17e2c8d38994" ], "author": { "name": "Gustavo Padovan", "email": "gustavo.padovan@collabora.co.uk", "time": "Tue Jul 10 19:10:06 2012 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 26 15:00:43 2012 -0700" }, "message": "USB: add USB_VENDOR_AND_INTERFACE_INFO() macro\n\ncommit d81a5d1956731c453b85c141458d4ff5d6cc5366 upstream.\n\nA lot of Broadcom Bluetooth devices provides vendor specific interface\nclass and we are getting flooded by patches adding new device support.\nThis change will help us enable support for any other Broadcom with vendor\nspecific device that arrives in the future.\n\nOnly the product id changes for those devices, so this macro would be\nperfect for us:\n\n{ USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }\n\nSigned-off-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Gustavo Padovan \u003cgustavo.padovan@collabora.co.uk\u003e\nAcked-by: Henrik Rydberg \u003crydberg@bitmath.se\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8b9f3861678e35b18cef66728d0fa896bbda65b6", "tree": "99a1336ea8e0dcc55d1c7f2a61f21526cfcf2f88", "parents": [ "75a757189880a31759ed25c23229f085890cddb1" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sun Aug 05 19:04:57 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 26 15:00:42 2012 -0700" }, "message": "ext4: make sure the journal sb is written in ext4_clear_journal_err()\n\ncommit d796c52ef0b71a988364f6109aeb63d79c5b116b upstream.\n\nAfter we transfer set the EXT4_ERROR_FS bit in the file system\nsuperblock, it\u0027s not enough to call jbd2_journal_clear_err() to clear\nthe error indication from journal superblock --- we need to call\njbd2_journal_update_sb_errno() as well. Otherwise, when the root file\nsystem is mounted read-only, the journal is replayed, and the error\nindicator is transferred to the superblock --- but the s_errno field\nin the jbd2 superblock is left set (since although we cleared it in\nmemory, we never flushed it out to disk).\n\nThis can end up confusing e2fsck. We should make e2fsck more robust\nin this case, but the kernel shouldn\u0027t be leaving things in this\nconfused state, either.\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "844bebfd9d09f92cdf4fac108e5f0d38cd389fff", "tree": "1231da2a36976b91202784d038c516a51fb59cec", "parents": [ "3407b51859d0e65ed66ccb0080c495a1f03cda6a" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Aug 06 10:03:59 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 26 15:00:41 2012 -0700" }, "message": "drm/radeon: add some new SI pci ids\n\ncommit 2f292004dd1fb005788dc0a9cdd5559812ed866e upstream.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "95c92481f69cf89aa1db689940368c09fb425281", "tree": "acde98d86b0fbe22041ed1cb771641ed986a08cd", "parents": [ "733e9ad978a1530328ff78aff3186c20000e5b4e" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Mon Apr 30 16:21:37 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:33 2012 -0700" }, "message": "Input: eeti_ts: pass gpio value instead of IRQ\n\ncommit 4eef6cbfcc03b294d9d334368a851b35b496ce53 upstream.\n\nThe EETI touchscreen asserts its IRQ line as soon as it has data in its\ninternal buffers. The line is automatically deasserted once all data has\nbeen read via I2C. Hence, the driver has to monitor the GPIO line and\ncannot simply rely on the interrupt handler reception.\n\nIn the current implementation of the driver, irq_to_gpio() is used to\ndetermine the GPIO number from the i2c_client\u0027s IRQ value.\n\nAs irq_to_gpio() is not available on all platforms, this patch changes\nthis and makes the driver ignore the passed in IRQ. Instead, a GPIO is\nadded to the platform_data struct and gpio_to_irq is used to derive the\nIRQ from that GPIO. If this fails, bail out. The driver is only able to\nwork in environments where the touchscreen GPIO can be mapped to an\nIRQ.\n\nWithout this patch, building raumfeld_defconfig results in:\n\ndrivers/input/touchscreen/eeti_ts.c: In function \u0027eeti_ts_irq_active\u0027:\ndrivers/input/touchscreen/eeti_ts.c:65:2: error: implicit declaration of function \u0027irq_to_gpio\u0027 [-Werror\u003dimplicit-function-declaration]\n\nSigned-off-by: Daniel Mack \u003czonque@gmail.com\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nCc: Sven Neumann \u003cs.neumann@raumfeld.com\u003e\nCc: linux-input@vger.kernel.org\nCc: Haojian Zhuang \u003chaojian.zhuang@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5784dff6267c788b40a2c9931b13a079e9011936", "tree": "f67c7bcaefa1454cf18f383e90a2a8d9d8a3fb52", "parents": [ "0f27ec339c656ab8dc9255ac8a61a1cecd32d599" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Sun Aug 05 14:58:37 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:32 2012 -0700" }, "message": "ARM: pxa: remove irq_to_gpio from ezx-pcap driver\n\ncommit 59ee93a528b94ef4e81a08db252b0326feff171f upstream.\n\nThe irq_to_gpio function was removed from the pxa platform\nin linux-3.2, and this driver has been broken since.\n\nThere is actually no in-tree user of this driver that adds\nthis platform device, but the driver can and does get enabled\non some platforms.\n\nWithout this patch, building ezx_defconfig results in:\n\ndrivers/mfd/ezx-pcap.c: In function \u0027pcap_isr_work\u0027:\ndrivers/mfd/ezx-pcap.c:205:2: error: implicit declaration of function \u0027irq_to_gpio\u0027 [-Werror\u003dimplicit-function-declaration]\n\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nAcked-by: Haojian Zhuang \u003chaojian.zhuang@gmail.com\u003e\nCc: Samuel Ortiz \u003csameo@linux.intel.com\u003e\nCc: Daniel Ribeiro \u003cdrwyrm@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "26665db4f7fa71c56eeb9205e79927cfc21e70c4", "tree": "8b5dc2c10b8b0aa9c1d1711daf991ae3df30db02", "parents": [ "12dae51a7567bb1e583ee0de6af538db256504db" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sat Jul 14 20:27:52 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:29 2012 -0700" }, "message": "random: remove rand_initialize_irq()\n\ncommit c5857ccf293968348e5eb4ebedc68074de3dcda6 upstream.\n\nWith the new interrupt sampling system, we are no longer using the\ntimer_rand_state structure in the irq descriptor, so we can stop\ninitializing it now.\n\n[ Merged in fixes from Sedat to find some last missing references to\n rand_initialize_irq() ]\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "38e16fc638792ddc12da853c4836602a8708e166", "tree": "1fee9674e85a885501c4905cdf017cd5d6e15089", "parents": [ "29aef9dee78ac45c5bd7f91434b05144ec220abd" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Wed Jul 04 16:19:30 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:28 2012 -0700" }, "message": "random: add tracepoints for easier debugging and verification\n\ncommit 00ce1db1a634746040ace24c09a4e3a7949a3145 upstream.\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "29aef9dee78ac45c5bd7f91434b05144ec220abd", "tree": "16b4c0aed90542db6e0cb1d45ff2e483ee3f2eae", "parents": [ "f5caa70697d4da107f8fd33fe74977a8ec192aaf" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Jul 05 10:35:23 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:28 2012 -0700" }, "message": "random: add new get_random_bytes_arch() function\n\ncommit c2557a303ab6712bb6e09447df828c557c710ac9 upstream.\n\nCreate a new function, get_random_bytes_arch() which will use the\narchitecture-specific hardware random number generator if it is\npresent. Change get_random_bytes() to not use the HW RNG, even if it\nis avaiable.\n\nThe reason for this is that the hw random number generator is fast (if\nit is present), but it requires that we trust the hardware\nmanufacturer to have not put in a back door. (For example, an\nincreasing counter encrypted by an AES key known to the NSA.)\n\nIt\u0027s unlikely that Intel (for example) was paid off by the US\nGovernment to do this, but it\u0027s impossible for them to prove otherwise\n --- especially since Bull Mountain is documented to use AES as a\nwhitener. Hence, the output of an evil, trojan-horse version of\nRDRAND is statistically indistinguishable from an RDRAND implemented\nto the specifications claimed by Intel. Short of using a tunnelling\nelectronic microscope to reverse engineer an Ivy Bridge chip and\ndisassembling and analyzing the CPU microcode, there\u0027s no way for us\nto tell for sure.\n\nSince users of get_random_bytes() in the Linux kernel need to be able\nto support hardware systems where the HW RNG is not present, most\ntime-sensitive users of this interface have already created their own\ncryptographic RNG interface which uses get_random_bytes() as a seed.\nSo it\u0027s much better to use the HW RNG to improve the existing random\nnumber generator, by mixing in any entropy returned by the HW RNG into\n/dev/random\u0027s entropy pool, but to always _use_ /dev/random\u0027s entropy\npool.\n\nThis way we get almost of the benefits of the HW RNG without any\npotential liabilities. The only benefits we forgo is the\nspeed/performance enhancements --- and generic kernel code can\u0027t\ndepend on depend on get_random_bytes() having the speed of a HW RNG\nanyway.\n\nFor those places that really want access to the arch-specific HW RNG,\nif it is available, we provide get_random_bytes_arch().\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "1d0eb350ee278cb257178a14c4c9d965d7d2835e", "tree": "16b4cc295085db157d441e2b08821f92d9161363", "parents": [ "e0604ba541f04a542ee9a7f6a468a60688ad8c72" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 04 11:16:01 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:27 2012 -0700" }, "message": "random: create add_device_randomness() interface\n\ncommit a2080a67abe9e314f9e9c2cc3a4a176e8a8f8793 upstream.\n\nAdd a new interface, add_device_randomness() for adding data to the\nrandom pool that is likely to differ between two devices (or possibly\neven per boot). This would be things like MAC addresses or serial\nnumbers, or the read-out of the RTC. This does *not* add any actual\nentropy to the pool, but it initializes the pool to different values\nfor devices that might otherwise be identical and have very little\nentropy available to them (particularly common in the embedded world).\n\n[ Modified by tytso to mix in a timestamp, since there may be some\n variability caused by the time needed to detect/configure the hardware\n in question. ]\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0110bbfbc8ed1b5240a51e8c767c44a856424139", "tree": "f3ac162b4925c7e841413db59dabff88324640ae", "parents": [ "cabf5b0af54cec6a2f9ce674cbc96fc8aa2fc468" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Mon Jul 02 07:52:16 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:10 2012 -0700" }, "message": "random: make \u0027add_interrupt_randomness()\u0027 do something sane\n\ncommit 775f4b297b780601e61787b766f306ed3e1d23eb upstream.\n\nWe\u0027ve been moving away from add_interrupt_randomness() for various\nreasons: it\u0027s too expensive to do on every interrupt, and flooding the\nCPU with interrupts could theoretically cause bogus floods of entropy\nfrom a somewhat externally controllable source.\n\nThis solves both problems by limiting the actual randomness addition\nto just once a second or after 64 interrupts, whicever comes first.\nDuring that time, the interrupt cycle data is buffered up in a per-cpu\npool. Also, we make sure the the nonblocking pool used by urandom is\ninitialized before we start feeding the normal input pool. This\nassures that /dev/urandom is returning unpredictable data as soon as\npossible.\n\n(Based on an original patch by Linus, but significantly modified by\ntytso.)\n\nTested-by: Eric Wustrow \u003cewust@umich.edu\u003e\nReported-by: Eric Wustrow \u003cewust@umich.edu\u003e\nReported-by: Nadia Heninger \u003cnadiah@cs.ucsd.edu\u003e\nReported-by: Zakir Durumeric \u003czakir@umich.edu\u003e\nReported-by: J. Alex Halderman \u003cjhalderm@umich.edu\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "27cd8f51344dcf4799c7a092c1797402b833126a", "tree": "4af5fa7d852c6f73795dd0ea9508b86283fb009e", "parents": [ "b6e9ffcdb09fbf28665e025aa31fda702689786c" ], "author": { "name": "Josh Boyer", "email": "jwboyer@redhat.com", "time": "Wed Jul 25 10:40:34 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:39 2012 -0700" }, "message": "posix_types.h: Cleanup stale __NFDBITS and related definitions\n\ncommit 8ded2bbc1845e19c771eb55209aab166ef011243 upstream.\n\nRecently, glibc made a change to suppress sign-conversion warnings in\nFD_SET (glibc commit ceb9e56b3d1). This uncovered an issue with the\nkernel\u0027s definition of __NFDBITS if applications #include\n\u003clinux/types.h\u003e after including \u003csys/select.h\u003e. A build failure would\nbe seen when passing the -Werror\u003dsign-compare and -D_FORTIFY_SOURCE\u003d2\nflags to gcc.\n\nIt was suggested that the kernel should either match the glibc\ndefinition of __NFDBITS or remove that entirely. The current in-kernel\nuses of __NFDBITS can be replaced with BITS_PER_LONG, and there are no\nuses of the related __FDELT and __FDMASK defines. Given that, we\u0027ll\ncontinue the cleanup that was started with commit 8b3d1cda4f5f\n(\"posix_types: Remove fd_set macros\") and drop the remaining unused\nmacros.\n\nAdditionally, linux/time.h has similar macros defined that expand to\nnothing so we\u0027ll remove those at the same time.\n\nReported-by: Jeff Law \u003claw@redhat.com\u003e\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Josh Boyer \u003cjwboyer@redhat.com\u003e\n[ .. and fix up whitespace as per akpm ]\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d3b42543cf269243ccf2add49008db879ff7f146", "tree": "db596959747095c3c76fa57fd8420a33a2974615", "parents": [ "c7815406caf7efdd805e893caef4a63e61b7645e" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Jul 17 12:39:26 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:37 2012 -0700" }, "message": "workqueue: perform cpu down operations from low priority cpu_notifier()\n\ncommit 6575820221f7a4dd6eadecf7bf83cdd154335eda upstream.\n\nCurrently, all workqueue cpu hotplug operations run off\nCPU_PRI_WORKQUEUE which is higher than normal notifiers. This is to\nensure that workqueue is up and running while bringing up a CPU before\nother notifiers try to use workqueue on the CPU.\n\nPer-cpu workqueues are supposed to remain working and bound to the CPU\nfor normal CPU_DOWN_PREPARE notifiers. This holds mostly true even\nwith workqueue offlining running with higher priority because\nworkqueue CPU_DOWN_PREPARE only creates a bound trustee thread which\nruns the per-cpu workqueue without concurrency management without\nexplicitly detaching the existing workers.\n\nHowever, if the trustee needs to create new workers, it creates\nunbound workers which may wander off to other CPUs while\nCPU_DOWN_PREPARE notifiers are in progress. Furthermore, if the CPU\ndown is cancelled, the per-CPU workqueue may end up with workers which\naren\u0027t bound to the CPU.\n\nWhile reliably reproducible with a convoluted artificial test-case\ninvolving scheduling and flushing CPU burning work items from CPU down\nnotifiers, this isn\u0027t very likely to happen in the wild, and, even\nwhen it happens, the effects are likely to be hidden by the following\nsuccessful CPU down.\n\nFix it by using different priorities for up and down notifiers - high\npriority for up operations and low priority for down operations.\n\nWorkqueue cpu hotplug operations will soon go through further cleanup.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: \"Rafael J. Wysocki\" \u003crjw@sisk.pl\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "20855fe2097ccfde927c6997101ae35340f1d278", "tree": "b185ec5c08472d49f5c96c65c0a4b9d51e41cfc1", "parents": [ "ecbd55f98e07e25d4017077d0a611ce6c766257b" ], "author": { "name": "Mikulas Patocka", "email": "mikulas@artax.karlin.mff.cuni.cz", "time": "Thu Jul 19 06:13:36 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:30 2012 -0700" }, "message": "tun: fix a crash bug and a memory leak\n\ncommit b09e786bd1dd66418b69348cb110f3a64764626a upstream.\n\nThis patch fixes a crash\ntun_chr_close -\u003e netdev_run_todo -\u003e tun_free_netdev -\u003e sk_release_kernel -\u003e\nsock_release -\u003e iput(SOCK_INODE(sock))\nintroduced by commit 1ab5ecb90cb6a3df1476e052f76a6e8f6511cb3d\n\nThe problem is that this socket is embedded in struct tun_struct, it has\nno inode, iput is called on invalid inode, which modifies invalid memory\nand optionally causes a crash.\n\nsock_release also decrements sockets_in_use, this causes a bug that\n\"sockets: used\" field in /proc/*/net/sockstat keeps on decreasing when\ncreating and closing tun devices.\n\nThis patch introduces a flag SOCK_EXTERNALLY_ALLOCATED that instructs\nsock_release to not free the inode and not decrement sockets_in_use,\nfixing both memory corruption and sockets_in_use underflow.\n\nIt should be backported to 3.3 an 3.4 stabke.\n\nSigned-off-by: Mikulas Patocka \u003cmikulas@artax.karlin.mff.cuni.cz\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7b689c5d930f281e417597af9f817ba03dc9d898", "tree": "75bb26f8fc89a58f25377e60cf2af6879fb795b0", "parents": [ "2830f9a08c084bcf40819942f04d0ca500faf4b8" ], "author": { "name": "Tony Luck", "email": "tony.luck@intel.com", "time": "Wed Jul 11 10:20:47 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:29 2012 -0700" }, "message": "x86/mce: Fix siginfo_t-\u003esi_addr value for non-recoverable memory faults\n\ncommit 6751ed65dc6642af64f7b8a440a75563c8aab7ae upstream.\n\nIn commit dad1743e5993f1 (\"x86/mce: Only restart instruction after machine\ncheck recovery if it is safe\") we fixed mce_notify_process() to force a\nsignal to the current process if it was not restartable (RIPV bit not\nset in MCG_STATUS). But doing it here means that the process doesn\u0027t\nget told the virtual address of the fault via siginfo_t-\u003esi_addr. This\nwould prevent application level recovery from the fault.\n\nMake a new MF_MUST_KILL flag bit for memory_failure() et al. to use so\nthat we will provide the right information with the signal.\n\nSigned-off-by: Tony Luck \u003ctony.luck@intel.com\u003e\nAcked-by: Borislav Petkov \u003cborislav.petkov@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "480692b1562b07a4bb8e4d6e49bf7fd2acefbea2", "tree": "3b9fa92da4f35c273294a6ef66b3862fe59bf4f9", "parents": [ "0d0eef55e03a76885b5d665b1f5572e1f4975886" ], "author": { "name": "Roland Dreier", "email": "roland@purestorage.com", "time": "Mon Jul 16 15:34:21 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:26 2012 -0700" }, "message": "target: Add generation of LOGICAL BLOCK ADDRESS OUT OF RANGE\n\ncommit e2397c704429025bc6b331a970f699e52f34283e upstream.\n\nMany SCSI commands are defined to return a CHECK CONDITION / ILLEGAL\nREQUEST with ASC set to LOGICAL BLOCK ADDRESS OUT OF RANGE if the\ninitiator sends a command that accesses a too-big LBA. Add an enum\nvalue and case entries so that target code can return this status.\n\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "016e7d822a72c4cbcbf7e4bc6d590cf50879ec26", "tree": "2655c509eaf1460f1ebfe8704f6d7ac2d55d5a14", "parents": [ "3cdeda1e763ccb2287c6ee76ece14145027653a9" ], "author": { "name": "Samuel Ortiz", "email": "sameo@linux.intel.com", "time": "Thu May 10 19:45:51 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 19 08:59:00 2012 -0700" }, "message": "NFC: Export nfc.h to userland\n\ncommit dbd4fcaf8d664fab4163b1f8682e41ad8bff3444 upstream.\n\nThe netlink commands and attributes, along with the socket structure\ndefinitions need to be exported.\n\nSigned-off-by: Samuel Ortiz \u003csameo@linux.intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "765bdc4d82fadcddfec19222a545e904633c7816", "tree": "1086773f08d9e4727c1cb6f90543258372db5673", "parents": [ "dd3cded0f516201d3b72999e588a6d67e00cb82f" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue Jul 17 02:39:54 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 19 08:59:00 2012 -0700" }, "message": "timekeeping: Provide hrtimer update function\n\nThis is a backport of f6c06abfb3972ad4914cef57d8348fcb2932bc3b\n\nTo finally fix the infamous leap second issue and other race windows\ncaused by functions which change the offsets between the various time\nbases (CLOCK_MONOTONIC, CLOCK_REALTIME and CLOCK_BOOTTIME) we need a\nfunction which atomically gets the current monotonic time and updates\nthe offsets of CLOCK_REALTIME and CLOCK_BOOTTIME with minimalistic\noverhead. The previous patch which provides ktime_t offsets allows us\nto make this function almost as cheap as ktime_get() which is going to\nbe replaced in hrtimer_interrupt().\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nReviewed-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nAcked-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Prarit Bhargava \u003cprarit@redhat.com\u003e\nSigned-off-by: John Stultz \u003cjohnstul@us.ibm.com\u003e\nLink: http://lkml.kernel.org/r/1341960205-56738-7-git-send-email-johnstul@us.ibm.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: John Stultz \u003cjohnstul@us.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5e5006e64cae9603841405af9febb67064869d83", "tree": "f3a41ebc96d577c9a9c726329d9093c7d477046d", "parents": [ "738c88c1b8ebe16c3ecd1694871474b470275d82" ], "author": { "name": "John Stultz", "email": "johnstul@us.ibm.com", "time": "Tue Jul 17 02:39:50 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 19 08:58:59 2012 -0700" }, "message": "hrtimer: Provide clock_was_set_delayed()\n\nThis is a backport of f55a6faa384304c89cfef162768e88374d3312cb\n\nclock_was_set() cannot be called from hard interrupt context because\nit calls on_each_cpu().\n\nFor fixing the widely reported leap seconds issue it is necessary to\ncall it from hard interrupt context, i.e. the timer tick code, which\ndoes the timekeeping updates.\n\nProvide a new function which denotes it in the hrtimer cpu base\nstructure of the cpu on which it is called and raise the hrtimer\nsoftirq. We then execute the clock_was_set() notificiation from\nsoftirq context in run_hrtimer_softirq(). The hrtimer softirq is\nrarely used, so polling the flag there is not a performance issue.\n\n[ tglx: Made it depend on CONFIG_HIGH_RES_TIMERS. We really should get\n rid of all this ifdeffery ASAP ]\n\nSigned-off-by: John Stultz \u003cjohnstul@us.ibm.com\u003e\nReported-by: Jan Engelhardt \u003cjengelh@inai.de\u003e\nReviewed-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nAcked-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Prarit Bhargava \u003cprarit@redhat.com\u003e\nLink: http://lkml.kernel.org/r/1341960205-56738-2-git-send-email-johnstul@us.ibm.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: John Stultz \u003cjohnstul@us.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7490d0a4cfefa16f9d8ce636eb5b2e13d2432db3", "tree": "70ee2418549bd1af674a7bda391140a45a5e11ce", "parents": [ "667fb5508900340d657645e0bfc9bf210a1fc363" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Fri Jun 22 15:52:09 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 19 08:58:56 2012 -0700" }, "message": "sched/nohz: Rewrite and fix load-avg computation -- again\n\ncommit 5167e8d5417bf5c322a703d2927daec727ea40dd upstream.\n\nThanks to Charles Wang for spotting the defects in the current code:\n\n - If we go idle during the sample window -- after sampling, we get a\n negative bias because we can negate our own sample.\n\n - If we wake up during the sample window we get a positive bias\n because we push the sample to a known active period.\n\nSo rewrite the entire nohz load-avg muck once again, now adding\ncopious documentation to the code.\n\nReported-and-tested-by: Doug Smythies \u003cdsmythies@telus.net\u003e\nReported-and-tested-by: Charles Wang \u003cmuming.wq@gmail.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nLink: http://lkml.kernel.org/r/1340373782.18025.74.camel@twins\n[ minor edits ]\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7ad71f960f0f6e06cbded278809674afc515036a", "tree": "df62cd2fb579dc1ded7ec28c669ed03bf506ffe9", "parents": [ "0fa627b15c842095b5147f381fa1943a6a46bb01" ], "author": { "name": "Yinghai Lu", "email": "yinghai@kernel.org", "time": "Wed Jul 11 14:02:56 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:45 2012 -0700" }, "message": "memblock: free allocated memblock_reserved_regions later\n\ncommit 29f6738609e40227dabcc63bfb3b84b3726a75bd upstream.\n\nmemblock_free_reserved_regions() calls memblock_free(), but\nmemblock_free() would double reserved.regions too, so we could free the\nold range for reserved.regions.\n\nAlso tj said there is another bug which could be related to this.\n\n| I don\u0027t think we\u0027re saving any noticeable\n| amount by doing this \"free - give it to page allocator - reserve\n| again\" dancing. We should just allocate regions aligned to page\n| boundaries and free them later when memblock is no longer in use.\n\nin that case, when DEBUG_PAGEALLOC, will get panic:\n\n memblock_free: [0x0000102febc080-0x0000102febf080] memblock_free_reserved_regions+0x37/0x39\n BUG: unable to handle kernel paging request at ffff88102febd948\n IP: [\u003cffffffff836a5774\u003e] __next_free_mem_range+0x9b/0x155\n PGD 4826063 PUD cf67a067 PMD cf7fa067 PTE 800000102febd160\n Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\n CPU 0\n Pid: 0, comm: swapper Not tainted 3.5.0-rc2-next-20120614-sasha #447\n RIP: 0010:[\u003cffffffff836a5774\u003e] [\u003cffffffff836a5774\u003e] __next_free_mem_range+0x9b/0x155\n\nSee the discussion at https://lkml.org/lkml/2012/6/13/469\n\nSo try to allocate with PAGE_SIZE alignment and free it later.\n\nReported-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Yinghai Lu \u003cyinghai@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0e343dbe08acb440f7914d989bcc32c1d1576735", "tree": "224d26c553fc27c2a556cb52ffd8d8b692a64f8f", "parents": [ "a2db97f10ba81ce924323e580a223ce8d17d685c" ], "author": { "name": "Jiang Liu", "email": "jiang.liu@huawei.com", "time": "Wed Jul 11 14:01:52 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:44 2012 -0700" }, "message": "memory hotplug: fix invalid memory access caused by stale kswapd pointer\n\ncommit d8adde17e5f858427504725218c56aef90e90fc7 upstream.\n\nkswapd_stop() is called to destroy the kswapd work thread when all memory\nof a NUMA node has been offlined. But kswapd_stop() only terminates the\nwork thread without resetting NODE_DATA(nid)-\u003ekswapd to NULL. The stale\npointer will prevent kswapd_run() from creating a new work thread when\nadding memory to the memory-less NUMA node again. Eventually the stale\npointer may cause invalid memory access.\n\nAn example stack dump as below. It\u0027s reproduced with 2.6.32, but latest\nkernel has the same issue.\n\n BUG: unable to handle kernel NULL pointer dereference at (null)\n IP: [\u003cffffffff81051a94\u003e] exit_creds+0x12/0x78\n PGD 0\n Oops: 0000 [#1] SMP\n last sysfs file: /sys/devices/system/memory/memory391/state\n CPU 11\n Modules linked in: cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq microcode fuse loop dm_mod tpm_tis rtc_cmos i2c_i801 rtc_core tpm serio_raw pcspkr sg tpm_bios igb i2c_core iTCO_wdt rtc_lib mptctl iTCO_vendor_support button dca bnx2 usbhid hid uhci_hcd ehci_hcd usbcore sd_mod crc_t10dif edd ext3 mbcache jbd fan ide_pci_generic ide_core ata_generic ata_piix libata thermal processor thermal_sys hwmon mptsas mptscsih mptbase scsi_transport_sas scsi_mod\n Pid: 7949, comm: sh Not tainted 2.6.32.12-qiuxishi-5-default #92 Tecal RH2285\n RIP: 0010:exit_creds+0x12/0x78\n RSP: 0018:ffff8806044f1d78 EFLAGS: 00010202\n RAX: 0000000000000000 RBX: ffff880604f22140 RCX: 0000000000019502\n RDX: 0000000000000000 RSI: 0000000000000202 RDI: 0000000000000000\n RBP: ffff880604f22150 R08: 0000000000000000 R09: ffffffff81a4dc10\n R10: 00000000000032a0 R11: ffff880006202500 R12: 0000000000000000\n R13: 0000000000c40000 R14: 0000000000008000 R15: 0000000000000001\n FS: 00007fbc03d066f0(0000) GS:ffff8800282e0000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n CR2: 0000000000000000 CR3: 000000060f029000 CR4: 00000000000006e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n Process sh (pid: 7949, threadinfo ffff8806044f0000, task ffff880603d7c600)\n Stack:\n ffff880604f22140 ffffffff8103aac5 ffff880604f22140 ffffffff8104d21e\n ffff880006202500 0000000000008000 0000000000c38000 ffffffff810bd5b1\n 0000000000000000 ffff880603d7c600 00000000ffffdd29 0000000000000003\n Call Trace:\n __put_task_struct+0x5d/0x97\n kthread_stop+0x50/0x58\n offline_pages+0x324/0x3da\n memory_block_change_state+0x179/0x1db\n store_mem_state+0x9e/0xbb\n sysfs_write_file+0xd0/0x107\n vfs_write+0xad/0x169\n sys_write+0x45/0x6e\n system_call_fastpath+0x16/0x1b\n Code: ff 4d 00 0f 94 c0 84 c0 74 08 48 89 ef e8 1f fd ff ff 5b 5d 31 c0 41 5c c3 53 48 8b 87 20 06 00 00 48 89 fb 48 8b bf 18 06 00 00 \u003c8b\u003e 00 48 c7 83 18 06 00 00 00 00 00 00 f0 ff 0f 0f 94 c0 84 c0\n RIP exit_creds+0x12/0x78\n RSP \u003cffff8806044f1d78\u003e\n CR2: 0000000000000000\n\n[akpm@linux-foundation.org: add pglist_data.kswapd locking comments]\nSigned-off-by: Xishi Qiu \u003cqiuxishi@huawei.com\u003e\nSigned-off-by: Jiang Liu \u003cjiang.liu@huawei.com\u003e\nAcked-by: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nAcked-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nAcked-by: Mel Gorman \u003cmgorman@suse.de\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nReviewed-by: Minchan Kim \u003cminchan@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2c07f25ea7800adb36cd8da9b58c4ecd3fc3d064", "tree": "b312e3b679b544de20569f8e31dd1469e8a72be1", "parents": [ "5318edefb61eddf91d4c4a089644fcee3ccfda62" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Jun 12 15:24:40 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:42 2012 -0700" }, "message": "splice: fix racy pipe-\u003ebuffers uses\n\ncommit 047fe3605235888f3ebcda0c728cb31937eadfe6 upstream.\n\nDave Jones reported a kernel BUG at mm/slub.c:3474! triggered\nby splice_shrink_spd() called from vmsplice_to_pipe()\n\ncommit 35f3d14dbbc5 (pipe: add support for shrinking and growing pipes)\nadded capability to adjust pipe-\u003ebuffers.\n\nProblem is some paths don\u0027t hold pipe mutex and assume pipe-\u003ebuffers\ndoesn\u0027t change for their duration.\n\nFix this by adding nr_pages_max field in struct splice_pipe_desc, and\nuse it in place of pipe-\u003ebuffers where appropriate.\n\nsplice_shrink_spd() loses its struct pipe_inode_info argument.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Jens Axboe \u003caxboe@kernel.dk\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Tom Herbert \u003ctherbert@google.com\u003e\nTested-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n[bwh: Backported to 3.2:\n - Adjust context in vmsplice_to_pipe()\n - Update one more call to splice_shrink_spd(), from skb_splice_bits()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "acf8fbd7c1182204ed723dee365bc5ba9a503dd6", "tree": "6479ee55435b097d79e5e1fe45a1c1e7a3f030d6", "parents": [ "ff99851d5277c6131301a09f687aa3976ced31e7" ], "author": { "name": "Andrea Arcangeli", "email": "aarcange@redhat.com", "time": "Wed Jun 20 12:52:57 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:42 2012 -0700" }, "message": "thp: avoid atomic64_read in pmd_read_atomic for 32bit PAE\n\ncommit e4eed03fd06578571c01d4f1478c874bb432c815 upstream.\n\nIn the x86 32bit PAE CONFIG_TRANSPARENT_HUGEPAGE\u003dy case while holding the\nmmap_sem for reading, cmpxchg8b cannot be used to read pmd contents under\nXen.\n\nSo instead of dealing only with \"consistent\" pmdvals in\npmd_none_or_trans_huge_or_clear_bad() (which would be conceptually\nsimpler) we let pmd_none_or_trans_huge_or_clear_bad() deal with pmdvals\nwhere the low 32bit and high 32bit could be inconsistent (to avoid having\nto use cmpxchg8b).\n\nThe only guarantee we get from pmd_read_atomic is that if the low part of\nthe pmd was found null, the high part will be null too (so the pmd will be\nconsidered unstable). And if the low part of the pmd is found \"stable\"\nlater, then it means the whole pmd was read atomically (because after a\npmd is stable, neither MADV_DONTNEED nor page faults can alter it anymore,\nand we read the high part after the low part).\n\nIn the 32bit PAE x86 case, it is enough to read the low part of the pmdval\natomically to declare the pmd as \"stable\" and that\u0027s true for THP and no\nTHP, furthermore in the THP case we also have a barrier() that will\nprevent any inconsistent pmdvals to be cached by a later re-read of the\n*pmd.\n\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Jonathan Nieder \u003cjrnieder@gmail.com\u003e\nCc: Ulrich Obergfell \u003cuobergfe@redhat.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Larry Woodman \u003clwoodman@redhat.com\u003e\nCc: Petr Matousek \u003cpmatouse@redhat.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Jan Beulich \u003cjbeulich@suse.com\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@gmail.com\u003e\nTested-by: Andrew Jones \u003cdrjones@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ff99851d5277c6131301a09f687aa3976ced31e7", "tree": "1a7d2b5c47af230cb78978aefe87ba6655a8af45", "parents": [ "e5982925c66c542aa41b17ee35fc233ae1521898" ], "author": { "name": "Andrea Arcangeli", "email": "aarcange@redhat.com", "time": "Tue May 29 15:06:49 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:41 2012 -0700" }, "message": "mm: pmd_read_atomic: fix 32bit PAE pmd walk vs pmd_populate SMP race condition\n\ncommit 26c191788f18129af0eb32a358cdaea0c7479626 upstream.\n\nWhen holding the mmap_sem for reading, pmd_offset_map_lock should only\nrun on a pmd_t that has been read atomically from the pmdp pointer,\notherwise we may read only half of it leading to this crash.\n\nPID: 11679 TASK: f06e8000 CPU: 3 COMMAND: \"do_race_2_panic\"\n #0 [f06a9dd8] crash_kexec at c049b5ec\n #1 [f06a9e2c] oops_end at c083d1c2\n #2 [f06a9e40] no_context at c0433ded\n #3 [f06a9e64] bad_area_nosemaphore at c043401a\n #4 [f06a9e6c] __do_page_fault at c0434493\n #5 [f06a9eec] do_page_fault at c083eb45\n #6 [f06a9f04] error_code (via page_fault) at c083c5d5\n EAX: 01fb470c EBX: fff35000 ECX: 00000003 EDX: 00000100 EBP:\n 00000000\n DS: 007b ESI: 9e201000 ES: 007b EDI: 01fb4700 GS: 00e0\n CS: 0060 EIP: c083bc14 ERR: ffffffff EFLAGS: 00010246\n #7 [f06a9f38] _spin_lock at c083bc14\n #8 [f06a9f44] sys_mincore at c0507b7d\n #9 [f06a9fb0] system_call at c083becd\n start len\n EAX: ffffffda EBX: 9e200000 ECX: 00001000 EDX: 6228537f\n DS: 007b ESI: 00000000 ES: 007b EDI: 003d0f00\n SS: 007b ESP: 62285354 EBP: 62285388 GS: 0033\n CS: 0073 EIP: 00291416 ERR: 000000da EFLAGS: 00000286\n\nThis should be a longstanding bug affecting x86 32bit PAE without THP.\nOnly archs with 64bit large pmd_t and 32bit unsigned long should be\naffected.\n\nWith THP enabled the barrier() in pmd_none_or_trans_huge_or_clear_bad()\nwould partly hide the bug when the pmd transition from none to stable,\nby forcing a re-read of the *pmd in pmd_offset_map_lock, but when THP is\nenabled a new set of problem arises by the fact could then transition\nfreely in any of the none, pmd_trans_huge or pmd_trans_stable states.\nSo making the barrier in pmd_none_or_trans_huge_or_clear_bad()\nunconditional isn\u0027t good idea and it would be a flakey solution.\n\nThis should be fully fixed by introducing a pmd_read_atomic that reads\nthe pmd in order with THP disabled, or by reading the pmd atomically\nwith cmpxchg8b with THP enabled.\n\nLuckily this new race condition only triggers in the places that must\nalready be covered by pmd_none_or_trans_huge_or_clear_bad() so the fix\nis localized there but this bug is not related to THP.\n\nNOTE: this can trigger on x86 32bit systems with PAE enabled with more\nthan 4G of ram, otherwise the high part of the pmd will never risk to be\ntruncated because it would be zero at all times, in turn so hiding the\nSMP race.\n\nThis bug was discovered and fully debugged by Ulrich, quote:\n\n----\n[..]\npmd_none_or_trans_huge_or_clear_bad() loads the content of edx and\neax.\n\n 496 static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t\n *pmd)\n 497 {\n 498 /* depend on compiler for an atomic pmd read */\n 499 pmd_t pmdval \u003d *pmd;\n\n // edi \u003d pmd pointer\n0xc0507a74 \u003csys_mincore+548\u003e: mov 0x8(%esp),%edi\n...\n // edx \u003d PTE page table high address\n0xc0507a84 \u003csys_mincore+564\u003e: mov 0x4(%edi),%edx\n...\n // eax \u003d PTE page table low address\n0xc0507a8e \u003csys_mincore+574\u003e: mov (%edi),%eax\n\n[..]\n\nPlease note that the PMD is not read atomically. These are two \"mov\"\ninstructions where the high order bits of the PMD entry are fetched\nfirst. Hence, the above machine code is prone to the following race.\n\n- The PMD entry {high|low} is 0x0000000000000000.\n The \"mov\" at 0xc0507a84 loads 0x00000000 into edx.\n\n- A page fault (on another CPU) sneaks in between the two \"mov\"\n instructions and instantiates the PMD.\n\n- The PMD entry {high|low} is now 0x00000003fda38067.\n The \"mov\" at 0xc0507a8e loads 0xfda38067 into eax.\n----\n\nReported-by: Ulrich Obergfell \u003cuobergfe@redhat.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Larry Woodman \u003clwoodman@redhat.com\u003e\nCc: Petr Matousek \u003cpmatouse@redhat.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "10762419cafd82a9a3a6f68bef54c29f1af75842" }