)]}' { "log": [ { "commit": "a16a1647fa6b6783c2e91623e72e86f0c2adac5e", "tree": "949b73345b860aec586d67243eab4a9944a158ad", "parents": [ "c577923756b7fe9071f28a76b66b83b306d1d001" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Mar 16 02:00:34 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Mar 17 01:47:08 2012 -0700" }, "message": "netfilter: ctnetlink: fix race between delete and timeout expiration\n\nKerin Millar reported hardlockups while running `conntrackd -c\u0027\nin a busy firewall. That system (with several processors) was\nacting as backup in a primary-backup setup.\n\nAfter several tries, I found a race condition between the deletion\noperation of ctnetlink and timeout expiration. This patch fixes\nthis problem.\n\nTested-by: Kerin Millar \u003ckerframil@gmail.com\u003e\nReported-by: Kerin Millar \u003ckerframil@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c577923756b7fe9071f28a76b66b83b306d1d001", "tree": "3cdb24e829bf58f5a319c9e9dca491ce295276e1", "parents": [ "b8fbaef586176f6abe0eb7887ddae66e99898b79" ], "author": { "name": "RongQing.Li", "email": "roy.qing.li@gmail.com", "time": "Thu Mar 15 22:54:14 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Mar 16 21:56:42 2012 -0700" }, "message": "ipv6: Don\u0027t dev_hold(dev) in ip6_mc_find_dev_rcu.\n\nip6_mc_find_dev_rcu() is called with rcu_read_lock(), so don\u0027t\nneed to dev_hold().\nWith dev_hold(), not corresponding dev_put(), will lead to leak.\n\n[ bug introduced in 96b52e61be1 (ipv6: mcast: RCU conversions) ]\n\nSigned-off-by: RongQing.Li \u003croy.qing.li@gmail.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cc34eb672eedb5ff248ac3bf9971a76f141fd141", "tree": "c3bb99022ba73eb31440f5774e4c9e635be6721d", "parents": [ "122bdf67f15a22bcabf6c2cab3a545d17ccf68dc" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Tue Mar 13 18:04:25 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Mar 16 01:55:25 2012 -0700" }, "message": "sch_sfq: revert dont put new flow at the end of flows\n\nThis reverts commit d47a0ac7b6 (sch_sfq: dont put new flow at the end of\nflows)\n\nAs Jesper found out, patch sounded great but has bad side effects.\n\nIn stress situation, pushing new flows in front of the queue can prevent\nold flows doing any progress. Packets can stay in SFQ queue for\nunlimited amount of time.\n\nIt\u0027s possible to add heuristics to limit this problem, but this would\nadd complexity outside of SFQ scope.\n\nA more sensible answer to Dave Taht concerns (who reported the issued I\ntried to solve in original commit) is probably to use a qdisc hierarchy\nso that high prio packets dont enter a potentially crowded SFQ qdisc.\n\nReported-by: Jesper Dangaard Brouer \u003cjdb@comx.dk\u003e\nCc: Dave Taht \u003cdave.taht@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "122bdf67f15a22bcabf6c2cab3a545d17ccf68dc", "tree": "194cd16507ab67c34280c0c490268514bbe7f86a", "parents": [ "762ad8a5330325b789cfb6dc896f81cf273ff4e9" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed Mar 14 21:13:11 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Mar 16 01:53:42 2012 -0700" }, "message": "ipv6: fix icmp6_dst_alloc()\n\ncommit 87a115783 ( ipv6: Move xfrm_lookup() call down into\nicmp6_dst_alloc().) forgot to convert one error path, leading\nto crashes in mld_sendpack()\n\nMany thanks to Dave Jones for providing a very complete bug report.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "dfd25ffffc132c00070eed64200e8950da5d7e9d", "tree": "fbce07add57f0ab7a16792b4af461d2f9e265fb6", "parents": [ "4e50391968849860dff1aacde358b4eb14aa5127" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Sat Mar 10 09:20:21 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Mar 11 15:52:12 2012 -0700" }, "message": "tcp: fix syncookie regression\n\ncommit ea4fc0d619 (ipv4: Don\u0027t use rt-\u003ert_{src,dst} in ip_queue_xmit())\nadded a serious regression on synflood handling.\n\nSimon Kirby discovered a successful connection was delayed by 20 seconds\nbefore being responsive.\n\nIn my tests, I discovered that xmit frames were lost, and needed ~4\nretransmits and a socket dst rebuild before being really sent.\n\nIn case of syncookie initiated connection, we use a different path to\ninitialize the socket dst, and inet-\u003ecork.fl.u.ip4 is left cleared.\n\nAs ip_queue_xmit() now depends on inet flow being setup, fix this by\ncopying the temp flowi4 we use in cookie_v4_check().\n\nReported-by: Simon Kirby \u003csim@netnation.com\u003e\nBisected-by: Simon Kirby \u003csim@netnation.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nTested-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ac3f48de09d8f4b73397047e413fadff7f65cfa7", "tree": "ae13a0ca68397df2792e064b0877376d106a2030", "parents": [ "5faa5df1fa2024bd750089ff21dcc4191798263d" ], "author": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Mar 06 21:21:10 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Mar 08 00:30:32 2012 -0800" }, "message": "route: Remove redirect_genid\n\nAs we invalidate the inetpeer tree along with the routing cache now,\nwe don\u0027t need a genid to reset the redirect handling when the routing\ncache is flushed.\n\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5faa5df1fa2024bd750089ff21dcc4191798263d", "tree": "a47a76a4bd9a3b61dcc2d2a34149e6ffecdf8cd8", "parents": [ "dcf353b17007841f91e1735e33790508c84c9ad0" ], "author": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Tue Mar 06 21:20:26 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Mar 08 00:30:24 2012 -0800" }, "message": "inetpeer: Invalidate the inetpeer tree along with the routing cache\n\nWe initialize the routing metrics with the values cached on the\ninetpeer in rt_init_metrics(). So if we have the metrics cached on the\ninetpeer, we ignore the user configured fib_metrics.\n\nTo fix this issue, we replace the old tree with a fresh initialized\ninet_peer_base. The old tree is removed later with a delayed work queue.\n\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5200959b833ddacf28b6ffce8c331dfd6e0ca797", "tree": "a2a85508fb35f524e800b8451ddad8f3682948b1", "parents": [ "d9e179ecec0805c41b17f9a0c3b925d415677772" ], "author": { "name": "Paulius Zaleckas", "email": "paulius.zaleckas@gmail.com", "time": "Tue Mar 06 22:25:22 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Mar 08 00:25:25 2012 -0800" }, "message": "bridge: fix state reporting when port is disabled\n\nNow we have:\neth0: link *down*\nbr0: port 1(eth0) entered *forwarding* state\n\nbr_log_state(p) should be called *after* p-\u003estate is set\nto BR_STATE_DISABLED.\n\nReported-by: Zilvinas Valinskas \u003czilvinas@wilibox.com\u003e\nSigned-off-by: Paulius Zaleckas \u003cpaulius.zaleckas@gmail.com\u003e\nAcked-by: Stephen Hemminger \u003cshemminger@vyatta.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d9e179ecec0805c41b17f9a0c3b925d415677772", "tree": "fb203ed710a1493d4aaf71b85955882834501096", "parents": [ "09c1d446fe0e2e3f34b366a6b3c1b19efa1522af" ], "author": { "name": "Paulius Zaleckas", "email": "paulius.zaleckas@gmail.com", "time": "Tue Mar 06 22:25:14 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Mar 08 00:25:25 2012 -0800" }, "message": "bridge: br_log_state() s/entering/entered/\n\nWhen br_log_state() is reporting state it should say \"entered\"\nistead of \"entering\" since state at this point is already\nchanged.\n\nSigned-off-by: Paulius Zaleckas \u003cpaulius.zaleckas@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9259c483a34a4efbaf60583af3719bed28a3fe45", "tree": "5e3dbac4aeabd5bf83970cb8a2b642c2009a34d4", "parents": [ "d47775c4a7a40ecd048400cf770504ad1f2cd3df", "81e5d41d7ed4f6c61ba3d2414f4f9ddf6d934ebb" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Mar 07 22:49:01 2012 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Mar 07 22:49:01 2012 -0800" }, "message": "Merge branch \u0027fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jesse/openvswitch\n" }, { "commit": "81e5d41d7ed4f6c61ba3d2414f4f9ddf6d934ebb", "tree": "c85f6f4cd07c34a633475a4667f418bf402d21a9", "parents": [ "651a68ea2ce9738b84e928836053b2e0fb5db2ba" ], "author": { "name": "Jesse Gross", "email": "jesse@nicira.com", "time": "Tue Mar 06 15:05:46 2012 -0800" }, "committer": { "name": "Jesse Gross", "email": "jesse@nicira.com", "time": "Wed Mar 07 14:36:57 2012 -0800" }, "message": "openvswitch: Fix checksum update for actions on UDP packets.\n\nWhen modifying IP addresses or ports on a UDP packet we don\u0027t\ncorrectly follow the rules for unchecksummed packets. This meant\nthat packets without a checksum can be given a incorrect new checksum\nand packets with a checksum can become marked as being unchecksummed.\nThis fixes it to handle those requirements.\n\nSigned-off-by: Jesse Gross \u003cjesse@nicira.com\u003e\n" }, { "commit": "651a68ea2ce9738b84e928836053b2e0fb5db2ba", "tree": "1584b5b2c3180745483bd6587bb435178cf0651d", "parents": [ "dcd6c92267155e70a94b3927bce681ce74b80d1f" ], "author": { "name": "Ben Pfaff", "email": "blp@nicira.com", "time": "Tue Mar 06 15:04:04 2012 -0800" }, "committer": { "name": "Jesse Gross", "email": "jesse@nicira.com", "time": "Tue Mar 06 15:04:04 2012 -0800" }, "message": "openvswitch: Honor dp_ifindex, when specified, for vport lookup by name.\n\nWhen OVS_VPORT_ATTR_NAME is specified and dp_ifindex is nonzero, the\nlogical behavior would be for the vport name lookup scope to be limited\nto the specified datapath, but in fact the dp_ifindex value was ignored.\nThis commit causes the search scope to be honored.\n\nSigned-off-by: Ben Pfaff \u003cblp@nicira.com\u003e\nSigned-off-by: Jesse Gross \u003cjesse@nicira.com\u003e\n" }, { "commit": "d6ddef9e641d1229d4ec841dc75ae703171c3e92", "tree": "eb895255cd3d561b189757cc26a5add23702c491", "parents": [ "34efc283a56adaef5756ac93065f46608674ea7d" ], "author": { "name": "Li Wei", "email": "lw@cn.fujitsu.com", "time": "Mon Mar 05 14:45:17 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 06 16:58:47 2012 -0500" }, "message": "IPv6: Fix not join all-router mcast group when forwarding set.\n\nWhen forwarding was set and a new net device is register,\nwe need add this device to the all-router mcast group.\n\nSigned-off-by: Li Wei \u003clw@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "741385119706d4370eb7899c5ca96ad125c520e5", "tree": "ba34e2f3100a95f11a55bdf3b782169095661e47", "parents": [ "739e4505a0e8209622dc71743bfa1c804eacf7f4" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Mar 06 01:22:55 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 06 14:43:50 2012 -0500" }, "message": "netfilter: nf_conntrack: fix early_drop with reliable event delivery\n\nIf reliable event delivery is enabled and ctnetlink fails to deliver\nthe destroy event in early_drop, the conntrack subsystem cannot\ndrop any the candidate flow that was planned to be evicted.\n\nReported-by: Kerin Millar \u003ckerframil@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "739e4505a0e8209622dc71743bfa1c804eacf7f4", "tree": "df98d368f510e4e58f93e10bb8c77a8f7094b036", "parents": [ "a157b9d5b5b626e46eba2ac4e342da8db25cabc4" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 06 01:22:54 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 06 14:43:49 2012 -0500" }, "message": "bridge: netfilter: don\u0027t call iptables on vlan packets if sysctl is off\n\nWhen net.bridge.bridge-nf-filter-vlan-tagged is 0 (default), vlan packets\narriving should not be sent to ip(6)tables by bridge netfilter.\n\nHowever, it turns out that we currently always send VLAN packets to\nnetfilter, if ..\na), CONFIG_VLAN_8021Q is enabled ; or\nb), CONFIG_VLAN_8021Q is not set but rx vlan offload is enabled\n on the bridge port.\n\nThis is because bridge netfilter treats skb with\nskb-\u003eprotocol \u003d\u003d ETH_P_IP{V6} as \"non-vlan packet\".\n\nWith rx vlan offload on or CONFIG_VLAN_8021Q\u003dy, the vlan header has\nalready been removed here, and we cannot rely on skb-\u003eprotocol alone.\n\nFix this by only using skb-\u003eprotocol if the skb has no vlan tag,\nor if a vlan tag is present and filter-vlan-tagged bridge netfilter\nsysctl is enabled.\n\nWe cannot remove the skb-\u003eprotocol \u003d\u003d htons(ETH_P_8021Q) test\nbecause the vlan tag is still around in the CONFIG_VLAN_8021Q\u003dn \u0026\u0026\n\"ethtool -K $itf rxvlan off\" case.\n\nreproducer:\niptables -t raw -I PREROUTING -i br0\niptables -t raw -I PREROUTING -i br0.1\n\nThen send packets to an ip address configured on br0.1 interface.\nEven with net.bridge.bridge-nf-filter-vlan-tagged\u003d0, the 1st rule\nwill match instead of the 2nd one.\n\nWith this patch applied, the 2nd rule will match instead.\nIn the non-local address case, netfilter won\u0027t be consulted after\nthis patch unless the sysctl is switched on.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a157b9d5b5b626e46eba2ac4e342da8db25cabc4", "tree": "9a269ae569dcce683b31a0b87a12ae6487f64000", "parents": [ "8be619d1e430fd87a02587a2a6830b692cb91b84" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Mar 06 01:22:53 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 06 14:43:49 2012 -0500" }, "message": "netfilter: bridge: fix wrong pointer dereference\n\nIn adf7ff8, a invalid dereference was added in ebt_make_names.\n\nCC [M] net/bridge/netfilter/ebtables.o\nnet/bridge/netfilter/ebtables.c: In function `ebt_make_names\u0027:\nnet/bridge/netfilter/ebtables.c:1371:20: warning: `t\u0027 may be used uninitialized in this function [-Wuninitialized]\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8be619d1e430fd87a02587a2a6830b692cb91b84", "tree": "580ca289a8e79a18dc8140e2077d67d29bebcae5", "parents": [ "848edc69192a38bf9d261032f248b14f47e6af8b" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Mar 06 01:22:51 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 06 14:43:49 2012 -0500" }, "message": "netfilter: ctnetlink: remove incorrect spin_[un]lock_bh on NAT module autoload\n\nSince 7d367e0, ctnetlink_new_conntrack is called without holding\nthe nf_conntrack_lock spinlock. Thus, ctnetlink_parse_nat_setup\ndoes not require to release that spinlock anymore in the NAT module\nautoload case.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "848edc69192a38bf9d261032f248b14f47e6af8b", "tree": "799712600cd661118131c8dfa79a231e21293531", "parents": [ "2a15cd2ff488a9fdb55e5e34060f499853b27c77" ], "author": { "name": "Santosh Nayak", "email": "santoshprasadnayak@gmail.com", "time": "Tue Mar 06 01:22:50 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 06 14:43:49 2012 -0500" }, "message": "netfilter: ebtables: fix wrong name length while copying to user-space\n\nuser-space ebtables expects 32 bytes-long names, but xt_match names\nuse 29 bytes. We have to copy less 29 bytes and then, make sure we\nfill the remaining bytes with zeroes.\n\nSigned-off-by: Santosh Nayak \u003csantoshprasadnayak@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4648dc97af9d496218a05353b0e442b3dfa6aaab", "tree": "23de76651009140a71bd3eead8a366b25eb53e47", "parents": [ "5cb917bc4f3882ecee87064483111023086757d3" ], "author": { "name": "Neal Cardwell", "email": "ncardwell@google.com", "time": "Mon Mar 05 19:35:04 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Mar 06 14:43:49 2012 -0500" }, "message": "tcp: fix tcp_shift_skb_data() to not shift SACKed data below snd_una\n\nThis commit fixes tcp_shift_skb_data() so that it does not shift\nSACKed data below snd_una.\n\nThis fixes an issue whose symptoms exactly match reports showing\ntp-\u003esacked_out going negative since 3.3.0-rc4 (see \"WARNING: at\nnet/ipv4/tcp_input.c:3418\" thread on netdev).\n\nSince 2008 (832d11c5cd076abc0aa1eaf7be96c81d1a59ce41)\ntcp_shift_skb_data() had been shifting SACKed ranges that were below\nsnd_una. It checked that the *end* of the skb it was about to shift\nfrom was above snd_una, but did not check that the end of the actual\nshifted range was above snd_una; this commit adds that check.\n\nShifting SACKed ranges below snd_una is problematic because for such\nranges tcp_sacktag_one() short-circuits: it does not declare anything\nas SACKed and does not increase sacked_out.\n\nBefore the fixes in commits cc9a672ee522d4805495b98680f4a3db5d0a0af9\nand daef52bab1fd26e24e8e9578f8fb33ba1d0cb412, shifting SACKed ranges\nbelow snd_una happened to work because tcp_shifted_skb() was always\n(incorrectly) passing in to tcp_sacktag_one() an skb whose end_seq\ntcp_shift_skb_data() had already guaranteed was beyond snd_una. Hence\ntcp_sacktag_one() never short-circuited and always increased\ntp-\u003esacked_out in this case.\n\nAfter those two fixes, my testing has verified that shifting SACKed\nranges below snd_una could cause tp-\u003esacked_out to go negative with\nthe following sequence of events:\n\n(1) tcp_shift_skb_data() sees an skb whose end_seq is beyond snd_una,\n then shifts a prefix of that skb that is below snd_una\n\n(2) tcp_shifted_skb() increments the packet count of the\n already-SACKed prev sk_buff\n\n(3) tcp_sacktag_one() sees the end of the new SACKed range is below\n snd_una, so it short-circuits and doesn\u0027t increase tp-\u003esacked_out\n\n(5) tcp_clean_rtx_queue() sees the SACKed skb has been ACKed,\n decrements tp-\u003esacked_out by this \"inflated\" pcount that was\n missing a matching increase in tp-\u003esacked_out, and hence\n tp-\u003esacked_out underflows to a u32 like 0xFFFFFFFF, which casted\n to s32 is negative.\n\n(6) this leads to the warnings seen in the recent \"WARNING: at\n net/ipv4/tcp_input.c:3418\" thread on the netdev list; e.g.:\n tcp_input.c:3418 WARN_ON((int)tp-\u003esacked_out \u003c 0);\n\nMore generally, I think this bug can be tickled in some cases where\ntwo or more ACKs from the receiver are lost and then a DSACK arrives\nthat is immediately above an existing SACKed skb in the write queue.\n\nThis fix changes tcp_shift_skb_data() to abort this sequence at step\n(1) in the scenario above by noticing that the bytes are below snd_una\nand not shifting them.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d1d81d4c3dd886d5fa25a2c4fa1e39cb89613712", "tree": "8b9ee1f86fa66efeaa58f033a0e0c330c5c43139", "parents": [ "a4b64fbe482c7766f7925f03067fc637716bfa3f" ], "author": { "name": "Ulrich Weber", "email": "ulrich.weber@sophos.com", "time": "Mon Mar 05 04:52:44 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Mar 05 16:45:34 2012 -0500" }, "message": "bridge: check return value of ipv6_dev_get_saddr()\n\notherwise source IPv6 address of ICMPV6_MGM_QUERY packet\nmight be random junk if IPv6 is disabled on interface or\nlink-local address is not yet ready (DAD).\n\nSigned-off-by: Ulrich Weber \u003culrich.weber@sophos.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a4b64fbe482c7766f7925f03067fc637716bfa3f", "tree": "e2e447e8f37092eaccc914ffb6d3eea455cd56fa", "parents": [ "709e1b5cd9e1915ad4f6c470ebf6b55d4a911d8c" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Sun Mar 04 12:32:10 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Mar 04 22:02:55 2012 -0500" }, "message": "rtnetlink: fix rtnl_calcit() and rtnl_dump_ifinfo()\n\nnlmsg_parse() might return an error, so test its return value before\npotential random memory accesses.\n\nErrors introduced in commit 115c9b81928 (rtnetlink: Fix problem with\nbuffer allocation)\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: Greg Rose \u003cgregory.v.rose@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "709e1b5cd9e1915ad4f6c470ebf6b55d4a911d8c", "tree": "2af37cbde55a4b4a0a9872065d28e34ee88aad4d", "parents": [ "aaca735f4f188641c4786af8f20ed39fcce3809c" ], "author": { "name": "Joakim Tjernlund", "email": "joakim.tjernlund@transmode.se", "time": "Thu Mar 01 08:12:19 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Mar 04 21:57:40 2012 -0500" }, "message": "bridge: message age needs to increase, not decrease.\n\ncommit bridge: send proper message_age in config BPDU\nadded this gem:\n bpdu.message_age \u003d (jiffies - root-\u003edesignated_age)\n p-\u003edesignated_age \u003d jiffies + bpdu-\u003emessage_age;\nNotice how bpdu-\u003emessage_age is negated when reassigned to\nbpdu.message_age. This causes message age to decrease breaking the\nSTP protocol.\n\nSigned-off-by: Joakim Tjernlund \u003cJoakim.Tjernlund@transmode.se\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "aaca735f4f188641c4786af8f20ed39fcce3809c", "tree": "d00d17d74a3eb0b657e0af774bfbcfd156972181", "parents": [ "c0638c247f559e1a16ee79e54df14bca2cb679ea" ], "author": { "name": "Joakim Tjernlund", "email": "joakim.tjernlund@transmode.se", "time": "Thu Mar 01 08:12:18 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Mar 04 21:57:39 2012 -0500" }, "message": "bridge: Adjust min age inc for HZ \u003e 256\n\nmin age increment needs to round up its min age tick for all\nHZ values to guarantee message age is increasing.\n\nSigned-off-by: Joakim Tjernlund \u003cJoakim.Tjernlund@transmode.se\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c0638c247f559e1a16ee79e54df14bca2cb679ea", "tree": "5ad6fbbc412db40d4772d3d6473b8eb54800dbbd", "parents": [ "9c5028e9da1255dd2b99762d8627b88b29f68cce" ], "author": { "name": "Neal Cardwell", "email": "ncardwell@google.com", "time": "Fri Mar 02 21:36:51 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Mar 03 14:57:59 2012 -0500" }, "message": "tcp: don\u0027t fragment SACKed skbs in tcp_mark_head_lost()\n\nIn tcp_mark_head_lost() we should not attempt to fragment a SACKed skb\nto mark the first portion as lost. This is for two primary reasons:\n\n(1) tcp_shifted_skb() coalesces adjacent regions of SACKed skbs. When\ndoing this, it preserves the sum of their packet counts in order to\nreflect the real-world dynamics on the wire. But given that skbs can\nhave remainders that do not align to MSS boundaries, this packet count\npreservation means that for SACKed skbs there is not necessarily a\ndirect linear relationship between tcp_skb_pcount(skb) and\nskb-\u003elen. Thus tcp_mark_head_lost()\u0027s previous attempts to fragment\noff and mark as lost a prefix of length (packets - oldcnt)*mss from\nSACKed skbs were leading to occasional failures of the WARN_ON(len \u003e\nskb-\u003elen) in tcp_fragment() (which used to be a BUG_ON(); see the\nrecent \"crash in tcp_fragment\" thread on netdev).\n\n(2) there is no real point in fragmenting off part of a SACKed skb and\ncalling tcp_skb_mark_lost() on it, since tcp_skb_mark_lost() is a NOP\nfor SACKed skbs.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nAcked-by: Ilpo Järvinen \u003cilpo.jarvinen@helsinki.fi\u003e\nAcked-by: Yuchung Cheng \u003cycheng@google.com\u003e\nAcked-by: Nandita Dukkipati \u003cnanditad@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1e804aecd7d447d9a939a9376603008af65e52a0", "tree": "66bd2cff2fa84c71f9d86c3f52f70b503e6d6cba", "parents": [ "65ec698d1368fc64d0b93fb703783d25ec550577", "e899b1119f1428f2b04dd7e9dba94864c33dd30b" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Mar 01 15:40:36 2012 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Mar 01 15:40:36 2012 -0500" }, "message": "Merge branch \u0027master\u0027 of git://1984.lsi.us.es/net\n" }, { "commit": "4c90d3b30334833450ccbb02f452d4972a3c3c3f", "tree": "36581d7c5fa05c1223e6116f981a5857a02dfb43", "parents": [ "ecb971923614775a118bc05ad16b2bde450cac7d" ], "author": { "name": "Neal Cardwell", "email": "ncardwell@google.com", "time": "Sun Feb 26 10:06:19 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 28 15:06:46 2012 -0500" }, "message": "tcp: fix false reordering signal in tcp_shifted_skb\n\nWhen tcp_shifted_skb() shifts bytes from the skb that is currently\npointed to by \u0027highest_sack\u0027 then the increment of\nTCP_SKB_CB(skb)-\u003eseq implicitly advances tcp_highest_sack_seq(). This\nimplicit advancement, combined with the recent fix to pass the correct\nSACKed range into tcp_sacktag_one(), caused tcp_sacktag_one() to think\nthat the newly SACKed range was before the tcp_highest_sack_seq(),\nleading to a call to tcp_update_reordering() with a degree of\nreordering matching the size of the newly SACKed range (typically just\n1 packet, which is a NOP, but potentially larger).\n\nThis commit fixes this by simply calling tcp_sacktag_one() before the\nTCP_SKB_CB(skb)-\u003eseq advancement that can advance our notion of the\nhighest SACKed sequence.\n\nCorrespondingly, we can simplify the code a little now that\ntcp_shifted_skb() should update the lost_cnt_hint in all cases where\nskb \u003d\u003d tp-\u003elost_skb_hint.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "eea79e0713d94b02952f6c591b615710fd40a562", "tree": "053185ed326c93c8bd264d0b0dbd498f1d2fc8f3", "parents": [ "203738e548cefc3fc3c2f73a9063176c9f3583d5", "2b0a53d51b5f263bb581bbdb40ebb9f7e09609b1" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Feb 27 13:14:47 2012 -0500" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Feb 27 13:14:47 2012 -0500" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem\n" }, { "commit": "203738e548cefc3fc3c2f73a9063176c9f3583d5", "tree": "478ff8731ab81f6e35b2fe28ac466850c5f86f48", "parents": [ "3c761ea05a8900a907f32b628611873f6bef24b2", "b072342e266bcac633a8412add1644a77968ce8a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Feb 26 12:47:17 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Feb 26 12:47:17 2012 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\n1) ICMP sockets leave err uninitialized but we try to return it for the\n unsupported MSG_OOB case, reported by Dave Jones.\n\n2) Add new Zaurus device ID entries, from Dave Jones.\n\n3) Pointer calculation in hso driver memset is wrong, from Dan\n Carpenter.\n\n4) ks8851_probe() checks unsigned value as negative, fix also from Dan\n Carpenter.\n\n5) Fix crashes in atl1c driver due to TX queue handling, from Eric\n Dumazet. I anticipate some TX side locking fixes coming in the near\n future for this driver as well.\n\n6) The inline directive fix in Bluetooth which was breaking the build\n only with very new versions of GCC, from Johan Hedberg.\n\n7) Fix crashes in the ATP CLIP code due to ARP cleanups this merge\n window, reported by Meelis Roos and fixed by Eric Dumazet.\n\n8) JME driver doesn\u0027t flush RX FIFO correctly, from Guo-Fu Tseng.\n\n9) Some ip6_route_output() callers test the return value for NULL, but\n this never happens as the convention is to return a dst entry with\n dst-\u003eerror set. Fixes from RonQing Li.\n\n10) Logitech Harmony 900 should be handled by zaurus driver not\n cdc_ether, update white lists and black lists accordingly. From\n Scott Talbert.\n\n11) Receiving from certain kinds of devices there won\u0027t be a MAC header,\n so there is no MAC header to fixup in the IPSEC code, and if we try\n to do it we\u0027ll crash. Fix from Eric Dumazet.\n\n12) Port type array indexing off-by-one in mlx4 driver, fix from Yevgeny\n Petrilin.\n\n13) Fix regression in link-down handling in davinci_emac which causes\n all RX descriptors to be freed up and therefore RX to wedge\n completely, from Christian Riesch.\n\n14) It took two attempts, but ctnetlink soft lockups seem to be\n cured now, from Pablo Neira Ayuso.\n\n15) Endianness bug fix in ENIC driver, from Santosh Nayak.\n\n16) The long ago conversion of the PPP fragmentation code over to\n abstracted SKB list handling wasn\u0027t perfect, once we get an\n out of sequence SKB we don\u0027t flush the rest of them like we\n should. From Ben McKeegan.\n\n17) Fix regression of -\u003eip_summed initialization in sfc driver.\n From Ben Hutchings.\n\n18) Bluetooth timeout mistakenly using msecs instead of jiffies,\n from Andrzej Kaczmarek.\n\n19) Using _sync variant of work cancellation results in deadlocks,\n use the non _sync variants instead. From Andre Guedes.\n\n20) Bluetooth rfcomm code had reference counting problems leading\n to crashes, fix from Octavian Purdila.\n\n21) The conversion of netem over to classful qdisc handling added\n two bugs to netem_dequeue(), fixes from Eric Dumazet.\n\n22) Missing pci_iounmap() in ATM Solos driver. Fix from Julia Lawall.\n\n23) b44_pci_exit() should not have __exit tag since it\u0027s invoked from\n non-__exit code. From Nikola Pajkovsky.\n\n24) The conversion of the neighbour hash tables over to RCU added a\n race, fixed here by adding the necessary reread of tbl-\u003enht, fix\n from Michel Machado.\n\n25) When we added VF (virtual function) attributes for network device\n dumps, this potentially bloats up the size of the dump of one\n network device such that the dump size is too large for the buffer\n allocated by properly written netlink applications.\n\n In particular, if you add 255 VFs to a network device, parts of\n GLIBC stop working.\n\n To fix this, we add an attribute that is used to turn on these\n extended portions of the network device dump. Sophisticaed\n applications like \u0027ip\u0027 that want to see this stuff will be changed\n to set the attribute, whereas things like GLIBC that don\u0027t care\n about VFs simply will not, and therefore won\u0027t be busted by the\n mere presence of VFs on a network device.\n\n Thanks to the tireless work of Greg Rose on this fix.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (53 commits)\n sfc: Fix assignment of ip_summed for pre-allocated skbs\n ppp: fix \u0027ppp_mp_reconstruct bad seq\u0027 errors\n enic: Fix endianness bug.\n gre: fix spelling in comments\n netfilter: ctnetlink: fix soft lockup when netlink adds new entries (v2)\n Revert \"netfilter: ctnetlink: fix soft lockup when netlink adds new entries\"\n davinci_emac: Do not free all rx dma descriptors during init\n mlx4_core: Fixing array indexes when setting port types\n phy: IC+101G and PHY_HAS_INTERRUPT flag\n netdev/phy/icplus: Correct broken phy_init code\n ipsec: be careful of non existing mac headers\n Move Logitech Harmony 900 from cdc_ether to zaurus\n hso: memsetting wrong data in hso_get_count()\n netfilter: ip6_route_output() never returns NULL.\n ethernet/broadcom: ip6_route_output() never returns NULL.\n ipv6: ip6_route_output() never returns NULL.\n jme: Fix FIFO flush issue\n atm: clip: remove clip_tbl\n ipv4: ping: Fix recvmsg MSG_OOB error handling.\n rtnetlink: Fix problem with buffer allocation\n ...\n" }, { "commit": "e899b1119f1428f2b04dd7e9dba94864c33dd30b", "tree": "ca36d6bd86d78c97e146c1534d95168938a73792", "parents": [ "b072342e266bcac633a8412add1644a77968ce8a" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Feb 22 16:14:32 2012 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Sat Feb 25 14:29:09 2012 +0100" }, "message": "netfilter: bridge: fix module autoload in compat case\n\nWe expected 0 if module doesn\u0027t exist, which is no longer the case\n(42046e2e45c109ba703993c510401a11f716c8df,\nnetfilter: x_tables: return -ENOENT for non-existant matches/targets).\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "e807e566e99b644d8d248ba9393a0ba3f1012fdc", "tree": "ea705f137653dc55dc9804d76f59536790aa35dd", "parents": [ "bff528578fc3c4a14227b052a313109b5ffb73da", "7d367e06688dc7a2cc98c2ace04e1296e1d987e2" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 24 17:41:57 2012 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 24 17:41:57 2012 -0500" }, "message": "Merge branch \u0027master\u0027 of git://1984.lsi.us.es/net\n" }, { "commit": "bff528578fc3c4a14227b052a313109b5ffb73da", "tree": "3a8a383ac300e6d864524bd20c248132bb3eb798", "parents": [ "5d69703263d588dbb03f4e57091afd8942d96e6d" ], "author": { "name": "stephen hemminger", "email": "shemminger@vyatta.com", "time": "Fri Feb 24 08:08:20 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 24 17:41:11 2012 -0500" }, "message": "gre: fix spelling in comments\n\nThe original spelling and bad word choice makes these comments hard to read.\n\nSigned-off-by: Stephen Hemminger \u003cshemminger@vyatta.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7d367e06688dc7a2cc98c2ace04e1296e1d987e2", "tree": "bf4a9a6497dec37fdd4a31999cb218277e2ba656", "parents": [ "279072882dc0149e5740dace075e1a49f087046d" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@blackhole.kfki.hu", "time": "Fri Feb 24 11:45:49 2012 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Feb 24 12:24:15 2012 +0100" }, "message": "netfilter: ctnetlink: fix soft lockup when netlink adds new entries (v2)\n\nMarcell Zambo and Janos Farago noticed and reported that when\nnew conntrack entries are added via netlink and the conntrack table\ngets full, soft lockup happens. This is because the nf_conntrack_lock\nis held while nf_conntrack_alloc is called, which is in turn wants\nto lock nf_conntrack_lock while evicting entries from the full table.\n\nThe patch fixes the soft lockup with limiting the holding of the\nnf_conntrack_lock to the minimum, where it\u0027s absolutely required.\nIt required to extend (and thus change) nf_conntrack_hash_insert\nso that it makes sure conntrack and ctnetlink do not add the same entry\ntwice to the conntrack table.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@blackhole.kfki.hu\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "279072882dc0149e5740dace075e1a49f087046d", "tree": "0a375ec930d918c2a0a622e613a59cd8b9b15486", "parents": [ "4a2258ddddefeef3291c0fc66437c73d84261a1e" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Feb 24 12:18:38 2012 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Feb 24 12:19:57 2012 +0100" }, "message": "Revert \"netfilter: ctnetlink: fix soft lockup when netlink adds new entries\"\n\nThis reverts commit af14cca162ddcdea017b648c21b9b091e4bf1fa4.\n\nThis patch contains a race condition between packets and ctnetlink\nin the conntrack addition. A new patch to fix this issue follows up.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "03606895cd98c0a628b17324fd7b5ff15db7e3cd", "tree": "26aab95243f23a5d0cff45ee0d6afd1608afe5df", "parents": [ "4a2258ddddefeef3291c0fc66437c73d84261a1e" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Thu Feb 23 10:55:02 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 23 16:50:45 2012 -0500" }, "message": "ipsec: be careful of non existing mac headers\n\nNiccolo Belli reported ipsec crashes in case we handle a frame without\nmac header (atm in his case)\n\nBefore copying mac header, better make sure it is present.\n\nBugzilla reference: https://bugzilla.kernel.org/show_bug.cgi?id\u003d42809\n\nReported-by: Niccolò Belli \u003cdarkbasic@linuxsystems.it\u003e\nTested-by: Niccolò Belli \u003cdarkbasic@linuxsystems.it\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4a2258ddddefeef3291c0fc66437c73d84261a1e", "tree": "292008df656adc6c8412a79da6bedaff54458eab", "parents": [ "ee932bf9acb2e2c6a309e808000f24856330e3f9", "af14cca162ddcdea017b648c21b9b091e4bf1fa4" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 23 00:20:14 2012 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 23 00:20:14 2012 -0500" }, "message": "Merge branch \u0027nf\u0027 of git://1984.lsi.us.es/net\n" }, { "commit": "5d38b1f8cf8798d4df7809b3f3e38fad4d923e85", "tree": "06ba517dc59090a928dd8feabc348880adc79347", "parents": [ "0541743b4b35f2ddc9e490b4e354930168b60d23" ], "author": { "name": "RongQing.Li", "email": "roy.qing.li@gmail.com", "time": "Tue Feb 21 22:10:51 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 22 15:30:15 2012 -0500" }, "message": "netfilter: ip6_route_output() never returns NULL.\n\nip6_route_output() never returns NULL, so it is wrong to\ncheck if the return value is NULL.\n\nSigned-off-by: RongQing.Li \u003croy.qing.li@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5095d64db1b978bdb31d30fed9e47dbf04f729be", "tree": "a912b34b0f78b40f46fde374fae530211ef22c4c", "parents": [ "ba9adbe67e288823ac1deb7f11576ab5653f833e" ], "author": { "name": "RongQing.Li", "email": "roy.qing.li@gmail.com", "time": "Tue Feb 21 22:10:49 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 22 15:30:14 2012 -0500" }, "message": "ipv6: ip6_route_output() never returns NULL.\n\nip6_route_output() never returns NULL, so it is wrong to\ncheck if the return value is NULL.\n\nSigned-off-by: RongQing.Li \u003croy.qing.li@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "597cdbc2239e6019bbb2dd73b266f436166f0427", "tree": "b6c25dddc2987c9e7811d826f991dd6407783b7f", "parents": [ "a5e7424d424f6398a198ead79d99e0a3c2f24ce8" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Tue Feb 21 10:46:49 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 22 02:23:25 2012 -0500" }, "message": "atm: clip: remove clip_tbl\n\nCommit 32092ecf0644 (atm: clip: Use device neigh support on top of\n\"arp_tbl\".) introduced a bug since clip_tbl is zeroed : Crash occurs in\n__neigh_for_each_release()\n\nidle_timer_check() must use instead arp_tbl and neigh_check_cb() should\nignore non clip neighbours.\n\nIdea from David Miller.\n\nReported-by: Meelis Roos \u003cmroos@linux.ee\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nTested-by: Meelis Roos \u003cmroos@linux.ee\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a5e7424d424f6398a198ead79d99e0a3c2f24ce8", "tree": "2fc4ba0c2664cefb38f47c372260ee379d0e2f79", "parents": [ "115c9b81928360d769a76c632bae62d15206a94a" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 21 17:59:19 2012 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 21 17:59:19 2012 -0500" }, "message": "ipv4: ping: Fix recvmsg MSG_OOB error handling.\n\nDon\u0027t return an uninitialized variable as the error, return\n-EOPNOTSUPP instead.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "115c9b81928360d769a76c632bae62d15206a94a", "tree": "bbbe349bdf3803439cf3a757b9f2a839726348f5", "parents": [ "84338a6c9dbb6ff3de4749864020f8f25d86fc81" ], "author": { "name": "Greg Rose", "email": "gregory.v.rose@intel.com", "time": "Tue Feb 21 16:54:48 2012 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 21 16:56:45 2012 -0500" }, "message": "rtnetlink: Fix problem with buffer allocation\n\nImplement a new netlink attribute type IFLA_EXT_MASK. The mask\nis a 32 bit value that can be used to indicate to the kernel that\ncertain extended ifinfo values are requested by the user application.\nAt this time the only mask value defined is RTEXT_FILTER_VF to\nindicate that the user wants the ifinfo dump to send information\nabout the VFs belonging to the interface.\n\nThis patch fixes a bug in which certain applications do not have\nlarge enough buffers to accommodate the extra information returned\nby the kernel with large numbers of SR-IOV virtual functions.\nThose applications will not send the new netlink attribute with\nthe interface info dump request netlink messages so they will\nnot get unexpectedly large request buffers returned by the kernel.\n\nModifies the rtnl_calcit function to traverse the list of net\ndevices and compute the minimum buffer size that can hold the\ninfo dumps of all matching devices based upon the filter passed\nin via the new netlink attribute filter mask. If no filter\nmask is sent then the buffer allocation defaults to NLMSG_GOODSIZE.\n\nWith this change it is possible to add yet to be defined netlink\nattributes to the dump request which should make it fairly extensible\nin the future.\n\nSigned-off-by: Greg Rose \u003cgregory.v.rose@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "84338a6c9dbb6ff3de4749864020f8f25d86fc81", "tree": "100409d99686fa989c64d4f5aa12721a3fafa5d8", "parents": [ "3d8f93083be54696d3b7f8e8c6c70d411d01f9e8" ], "author": { "name": "Michel Machado", "email": "michel@digirati.com.br", "time": "Tue Feb 21 16:04:13 2012 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 21 16:28:10 2012 -0500" }, "message": "neighbour: Fixed race condition at tbl-\u003enht\n\nWhen the fixed race condition happens:\n\n1. While function neigh_periodic_work scans the neighbor hash table\npointed by field tbl-\u003enht, it unlocks and locks tbl-\u003elock between\nbuckets in order to call cond_resched.\n\n2. Assume that function neigh_periodic_work calls cond_resched, that is,\nthe lock tbl-\u003elock is available, and function neigh_hash_grow runs.\n\n3. Once function neigh_hash_grow finishes, and RCU calls\nneigh_hash_free_rcu, the original struct neigh_hash_table that function\nneigh_periodic_work was using doesn\u0027t exist anymore.\n\n4. Once back at neigh_periodic_work, whenever the old struct\nneigh_hash_table is accessed, things can go badly.\n\nSigned-off-by: Michel Machado \u003cmichel@digirati.com.br\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0dee00686da88cc32753e02e4e8efdd9e326e4d2", "tree": "19552d6f17e99cda523f8ba702c3b465aa7097a8", "parents": [ "8617b093d0031837a7be9b32bc674580cfb5f6b5" ], "author": { "name": "Mohammed Shafi Shajakhan", "email": "mohammed@qca.qualcomm.com", "time": "Mon Feb 20 14:44:01 2012 +0530" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Tue Feb 21 14:45:27 2012 -0500" }, "message": "mac80211: Fix a warning on changing to monitor mode from STA\n\nnothing needs to be done for monitor/AP_VLAN mode on calling\nieee80211_bss_info_change_notify -\u003e drv_bss_info_changed with the change\nflag \u0027BSS_CHANGED_IDLE\u0027. \u0027wl1271\u0027 seems to use BSS_CHANGED_IDLE only for\nSTA and IBSS mode. further the non-idle state of the monitor mode is\ntaken care by the \u0027count\u0027 variable which counts non-idle interfaces.\nieee80211_idle_off(local, \"in use\") will be called.\nthis fixes the following WARNING when we have initially STA mode\n(network manager running) and not associated, and change it to monitor\nmode with network manager disabled and bringing up the monitor mode.\nthis changes the idle state from \u0027true\u0027 (STA unassociated) to \u0027false\u0027\n(MONITOR mode)\nexposed by the commit 405385f8ce7a2ed8f82e216d88b5282142e1288b\n\"mac80211: set bss_conf.idle when vif is connected\"\n\n\tWARNING: net/mac80211/main.c:212\n\tieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]()\n\tHardware name: 64756D6\n\tPid: 3835, comm: ifconfig Tainted: G O\n\t3.3.0-rc3-wl #9\n\tCall Trace:\n\t [\u003cc0133b02\u003e] warn_slowpath_common+0x72/0xa0\n\t [\u003cfc8e8c3f\u003e] ?\n\t ieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]\n\t [\u003cfc8e8c3f\u003e] ?\n\t ieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]\n\t [\u003cc0133b52\u003e] warn_slowpath_null+0x22/0x30\n\t [\u003cfc8e8c3f\u003e]\n\t ieee80211_bss_info_change_notify+0x1cf/0x330 [mac80211]\n\t [\u003cfc8f9de3\u003e] __ieee80211_recalc_idle+0x113/0x430\n\t [mac80211]\n\t [\u003cfc8fabc6\u003e] ieee80211_do_open+0x156/0x7e0 [mac80211]\n\t [\u003cfc8f8a25\u003e] ?\n\t ieee80211_check_concurrent_iface+0x25/0x180 [mac80211]\n\t [\u003cc015dd9f\u003e] ? raw_notifier_call_chain+0x1f/0x30\n\t [\u003cfc8fb290\u003e] ieee80211_open+0x40/0x80 [mac80211]\n\t [\u003cc05894f6\u003e] __dev_open+0x96/0xe0\n\t [\u003cc068fba5\u003e] ? _raw_spin_unlock_bh+0x35/0x40\n\t [\u003cc05881d9\u003e] __dev_change_flags+0x109/0x170\n\t [\u003cc0589423\u003e] dev_change_flags+0x23/0x60\n\t [\u003cc05f3770\u003e] devinet_ioctl+0x6a0/0x770\n\n ieee80211 phy0: device no longer idle - in use\n\nCc: Eliad Peller \u003celiad@wizery.com\u003e\nSigned-off-by: Mohammed Shafi Shajakhan \u003cmohammed@qca.qualcomm.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "8617b093d0031837a7be9b32bc674580cfb5f6b5", "tree": "6f9965790045cc0b73c43033aae859cab79128a2", "parents": [ "5dcbf480473f6c3f06ad2426b7517038a2a18911" ], "author": { "name": "Mohammed Shafi Shajakhan", "email": "mohammed@qca.qualcomm.com", "time": "Mon Feb 20 10:05:31 2012 +0530" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Tue Feb 21 14:45:26 2012 -0500" }, "message": "mac80211: zero initialize count field in ieee80211_tx_rate\n\nrate control algorithms concludes the rate as invalid\nwith rate[i].idx \u003c -1 , while they do also check for rate[i].count is\nnon-zero. it would be safer to zero initialize the \u0027count\u0027 field.\nrecently we had a ath9k rate control crash where the ath9k rate control\nin ath_tx_status assumed to check only for rate[i].count being non-zero\nin one instance and ended up in using invalid rate index for\n\u0027connection monitoring NULL func frames\u0027 which eventually lead to the crash.\nthanks to Pavel Roskin for fixing it and finding the root cause.\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d768639\n\nCc: stable@vger.kernel.org\nCc: Pavel Roskin \u003cproski@gnu.org\u003e\nSigned-off-by: Mohammed Shafi Shajakhan \u003cmohammed@qca.qualcomm.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "af14cca162ddcdea017b648c21b9b091e4bf1fa4", "tree": "1d40e186b7afbd0c7485dd95e1fb6c24174f4d5c", "parents": [ "88ba136d6635b262f77cc418d536115fb8e4d4ab" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@blackhole.kfki.hu", "time": "Tue Feb 21 14:53:57 2012 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Feb 21 16:25:31 2012 +0100" }, "message": "netfilter: ctnetlink: fix soft lockup when netlink adds new entries\n\nMarcell Zambo and Janos Farago noticed and reported that when\nnew conntrack entries are added via netlink and the conntrack table\ngets full, soft lockup happens. This is because the nf_conntrack_lock\nis held while nf_conntrack_alloc is called, which is in turn wants\nto lock nf_conntrack_lock while evicting entries from the full table.\n\nThe patch fixes the soft lockup with limiting the holding of the\nnf_conntrack_lock to the minimum, where it\u0027s absolutely required.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@blackhole.kfki.hu\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "8ebbfb49574818f07a25bc119b1bbdf1c2853a39", "tree": "e7b1ea6c6a3ea522654c685f2f0c9f41466fdcf9", "parents": [ "39e255dab5a993cbebb35598015da1d4a0eb3727", "847c9db5cb50841589b8ebd3da0769b1b02fb3b2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Feb 20 16:13:58 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Feb 20 16:13:58 2012 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nAssorted fixes, sat in -next for a week or so...\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:\n ocfs2: deal with wraparounds of i_nlink in ocfs2_rename()\n vfs: fix compat_sys_stat() handling of overflows in st_nlink\n quota: Fix deadlock with suspend and quotas\n vfs: Provide function to get superblock and wait for it to thaw\n vfs: fix panic in __d_lookup() with high dentry hashtable counts\n autofs4 - fix lockdep splat in autofs\n vfs: fix d_inode_lookup() dentry ref leak\n" }, { "commit": "9d4990a260ce395493848640bed94fb55f440f10", "tree": "ab6505e7c7420234575df3f4451f4da0ac38e6dd", "parents": [ "64f0a836f600e9c31ffd511713ab5d328aa96ac8", "2504a6423b9ab4c36df78227055995644de19edb" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Feb 20 14:47:17 2012 -0500" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Mon Feb 20 14:47:17 2012 -0500" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem\n" }, { "commit": "cd961c2ca98efbe7d738ca8720673fc03538b2b1", "tree": "f53abc9d2ac6bdd0659c46e30ac44e2cbdf74f01", "parents": [ "b01543dfe67bb1d191998e90d20534dc354de059" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed Feb 15 20:28:25 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Feb 19 18:57:50 2012 -0500" }, "message": "netem: fix dequeue\n\ncommit 50612537e9 (netem: fix classful handling) added two errors in\nnetem_dequeue()\n\n1) After checking skb at the head of tfifo queue for time constraints,\n it dequeues tail skb, thus adding unwanted reordering.\n\n2) qdisc stats are updated twice per packet\n (one when packet dequeued from tfifo, once when delivered)\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "216c57b214bd621335ff698b475f6db2802502dc", "tree": "3d436e04f60577c634106db5099f39e376b98a86", "parents": [ "4b5a433ae5348c23caa0b5f0a2fca7c342acb200" ], "author": { "name": "Felix Fietkau", "email": "nbd@openwrt.org", "time": "Wed Feb 08 19:17:11 2012 +0100" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Feb 15 13:56:06 2012 -0500" }, "message": "mac80211: do not call rate control .tx_status before .rate_init\n\nMost rate control implementations assume .get_rate and .tx_status are only\ncalled once the per-station data has been fully initialized.\nminstrel_ht crashes if this assumption is violated.\n\nSigned-off-by: Felix Fietkau \u003cnbd@openwrt.org\u003e\nTested-by: Arend van Spriel \u003carend@broadcom.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "4b5a433ae5348c23caa0b5f0a2fca7c342acb200", "tree": "023096819178eb695a78eb2de271af6470ff29c3", "parents": [ "24d2b8c0ac5c8ec41c26ed432238b0e027184882" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Fri Jan 20 13:55:23 2012 +0100" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Feb 15 13:56:06 2012 -0500" }, "message": "mac80211: call rate control only after init\n\nThere are situations where we don\u0027t have the\nnecessary rate control information yet for\nstation entries, e.g. when associating. This\ncurrently doesn\u0027t really happen due to the\ndummy station handling; explicitly disabling\nrate control when it\u0027s not initialised will\nallow us to remove dummy stations.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "33b5d30cd8b200024d55ac5830c9efde1102ef4c", "tree": "4788d50ad6994a40bda8e146db4ca9674a482b92", "parents": [ "3013dc0cceb9baaf25d5624034eeaa259bf99004", "c27111e5b8d6b1e9296f7075cdc35872f672b524" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Feb 15 13:41:52 2012 -0500" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Feb 15 13:41:52 2012 -0500" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem\n" }, { "commit": "24d2b8c0ac5c8ec41c26ed432238b0e027184882", "tree": "d0331d56b1f94b3614eaade10ca5d1ca0ba8633c", "parents": [ "6de32750822d00bfa92c341166132b0714c5b559" ], "author": { "name": "Ulisses Furquim", "email": "ulisses@profusion.mobi", "time": "Mon Jan 30 18:26:29 2012 -0200" }, "committer": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Wed Feb 15 13:09:26 2012 +0200" }, "message": "Bluetooth: Fix possible use after free in delete path\n\nWe need to use the _sync() version for cancelling the info and security\ntimer in the L2CAP connection delete path. Otherwise the delayed work\nhandler might run after the connection object is freed.\n\nSigned-off-by: Ulisses Furquim \u003culisses@profusion.mobi\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\n" }, { "commit": "6de32750822d00bfa92c341166132b0714c5b559", "tree": "b267e43e5a597578e923cd373961348e7cc7f6fb", "parents": [ "403f048a57050add364827fb3e2650af86463168" ], "author": { "name": "Ulisses Furquim", "email": "ulisses@profusion.mobi", "time": "Mon Jan 30 18:26:28 2012 -0200" }, "committer": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Wed Feb 15 13:09:26 2012 +0200" }, "message": "Bluetooth: Remove usage of __cancel_delayed_work()\n\n__cancel_delayed_work() is being used in some paths where we cannot\nsleep waiting for the delayed work to finish. However, that function\nmight return while the timer is running and the work will be queued\nagain. Replace the calls with safer cancel_delayed_work() version\nwhich spins until the timer handler finishes on other CPUs and\ncancels the delayed work.\n\nSigned-off-by: Ulisses Furquim \u003culisses@profusion.mobi\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\n" }, { "commit": "ca0d6c7ece0e78268cd7c5c378d6b1b610625085", "tree": "23c56a6629b63e20c59ba36971fd181d54c02b6d", "parents": [ "cf33e77b76d7439f21a23a94eab4ab3b405a6a7d" ], "author": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Fri Feb 03 21:29:40 2012 +0200" }, "committer": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Wed Feb 15 13:09:26 2012 +0200" }, "message": "Bluetooth: Add missing QUIRK_NO_RESET test to hci_dev_do_close\n\nWe should only perform a reset in hci_dev_do_close if the\nHCI_QUIRK_NO_RESET flag is set (since in such a case a reset will not be\nperformed when initializing the device).\n\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\n" }, { "commit": "cf33e77b76d7439f21a23a94eab4ab3b405a6a7d", "tree": "3e8ad4b4c7a2cb23835c3c2144457a56eba7129b", "parents": [ "a51cd2be864a3cc0272359b1995e213341dfc7e7" ], "author": { "name": "Octavian Purdila", "email": "octavian.purdila@intel.com", "time": "Fri Jan 27 19:32:39 2012 +0200" }, "committer": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Wed Feb 15 13:09:26 2012 +0200" }, "message": "Bluetooth: Fix RFCOMM session reference counting issue\n\nThere is an imbalance in the rfcomm_session_hold / rfcomm_session_put\noperations which causes the following crash:\n\n[ 685.010159] BUG: unable to handle kernel paging request at 6b6b6b6b\n[ 685.010169] IP: [\u003cc149d76d\u003e] rfcomm_process_dlcs+0x1b/0x15e\n[ 685.010181] *pdpt \u003d 000000002d665001 *pde \u003d 0000000000000000\n[ 685.010191] Oops: 0000 [#1] PREEMPT SMP\n[ 685.010247]\n[ 685.010255] Pid: 947, comm: krfcommd Tainted: G C 3.0.16-mid8-dirty #44\n[ 685.010266] EIP: 0060:[\u003cc149d76d\u003e] EFLAGS: 00010246 CPU: 1\n[ 685.010274] EIP is at rfcomm_process_dlcs+0x1b/0x15e\n[ 685.010281] EAX: e79f551c EBX: 6b6b6b6b ECX: 00000007 EDX: e79f40b4\n[ 685.010288] ESI: e79f4060 EDI: ed4e1f70 EBP: ed4e1f68 ESP: ed4e1f50\n[ 685.010295] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068\n[ 685.010303] Process krfcommd (pid: 947, ti\u003ded4e0000 task\u003ded43e5e0 task.ti\u003ded4e0000)\n[ 685.010308] Stack:\n[ 685.010312] ed4e1f68 c149eb53 e5925150 e79f4060 ed500000 ed4e1f70 ed4e1f80 c149ec10\n[ 685.010331] 00000000 ed43e5e0 00000000 ed4e1f90 ed4e1f9c c149ec87 0000bf54 00000000\n[ 685.010348] 00000000 ee03bf54 c149ec37 ed4e1fe4 c104fe01 00000000 00000000 00000000\n[ 685.010367] Call Trace:\n[ 685.010376] [\u003cc149eb53\u003e] ? rfcomm_process_rx+0x6e/0x74\n[ 685.010387] [\u003cc149ec10\u003e] rfcomm_process_sessions+0xb7/0xde\n[ 685.010398] [\u003cc149ec87\u003e] rfcomm_run+0x50/0x6d\n[ 685.010409] [\u003cc149ec37\u003e] ? rfcomm_process_sessions+0xde/0xde\n[ 685.010419] [\u003cc104fe01\u003e] kthread+0x63/0x68\n[ 685.010431] [\u003cc104fd9e\u003e] ? __init_kthread_worker+0x42/0x42\n[ 685.010442] [\u003cc14dae82\u003e] kernel_thread_helper+0x6/0xd\n\nThis issue has been brought up earlier here:\n\nhttps://lkml.org/lkml/2011/5/21/127\n\nThe issue appears to be the rfcomm_session_put in rfcomm_recv_ua. This\noperation doesn\u0027t seem be to required as for the non-initiator case we\nhave the rfcomm_process_rx doing an explicit put and in the initiator\ncase the last dlc_unlink will drive the reference counter to 0.\n\nThere have been several attempts to fix these issue:\n\n6c2718d Bluetooth: Do not call rfcomm_session_put() for RFCOMM UA on closed socket\n683d949 Bluetooth: Never deallocate a session when some DLC points to it\n\nbut AFAICS they do not fix the issue just make it harder to reproduce.\n\nSigned-off-by: Octavian Purdila \u003coctavian.purdila@intel.com\u003e\nSigned-off-by: Gopala Krishna Murala \u003cgopala.krishna.murala@intel.com\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\n" }, { "commit": "b5a30dda6598af216c070165ece6068f9f00f33a", "tree": "049eff0341a243dbd02af3c83a7166f941177833", "parents": [ "331660637b4e5136602a98200a84f6b65ed8d5be" ], "author": { "name": "Octavian Purdila", "email": "tavi.purdila@gmail.com", "time": "Sun Jan 22 00:28:34 2012 +0200" }, "committer": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Wed Feb 15 13:09:26 2012 +0200" }, "message": "Bluetooth: silence lockdep warning\n\nSince bluetooth uses multiple protocols types, to avoid lockdep\nwarnings, we need to use different lockdep classes (one for each\nprotocol type).\n\nThis is already done in bt_sock_create but it misses a couple of cases\nwhen new connections are created. This patch corrects that to fix the\nfollowing warning:\n\n\u003c4\u003e[ 1864.732366] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\u003c4\u003e[ 1864.733030] [ INFO: possible circular locking dependency detected ]\n\u003c4\u003e[ 1864.733544] 3.0.16-mid3-00007-gc9a0f62 #3\n\u003c4\u003e[ 1864.733883] -------------------------------------------------------\n\u003c4\u003e[ 1864.734408] t.android.btclc/4204 is trying to acquire lock:\n\u003c4\u003e[ 1864.734869] (rfcomm_mutex){+.+.+.}, at: [\u003cc14970ea\u003e] rfcomm_dlc_close+0x15/0x30\n\u003c4\u003e[ 1864.735541]\n\u003c4\u003e[ 1864.735549] but task is already holding lock:\n\u003c4\u003e[ 1864.736045] (sk_lock-AF_BLUETOOTH){+.+.+.}, at: [\u003cc1498bf7\u003e] lock_sock+0xa/0xc\n\u003c4\u003e[ 1864.736732]\n\u003c4\u003e[ 1864.736740] which lock already depends on the new lock.\n\u003c4\u003e[ 1864.736750]\n\u003c4\u003e[ 1864.737428]\n\u003c4\u003e[ 1864.737437] the existing dependency chain (in reverse order) is:\n\u003c4\u003e[ 1864.738016]\n\u003c4\u003e[ 1864.738023] -\u003e #1 (sk_lock-AF_BLUETOOTH){+.+.+.}:\n\u003c4\u003e[ 1864.738549] [\u003cc1062273\u003e] lock_acquire+0x104/0x140\n\u003c4\u003e[ 1864.738977] [\u003cc13d35c1\u003e] lock_sock_nested+0x58/0x68\n\u003c4\u003e[ 1864.739411] [\u003cc1493c33\u003e] l2cap_sock_sendmsg+0x3e/0x76\n\u003c4\u003e[ 1864.739858] [\u003cc13d06c3\u003e] __sock_sendmsg+0x50/0x59\n\u003c4\u003e[ 1864.740279] [\u003cc13d0ea2\u003e] sock_sendmsg+0x94/0xa8\n\u003c4\u003e[ 1864.740687] [\u003cc13d0ede\u003e] kernel_sendmsg+0x28/0x37\n\u003c4\u003e[ 1864.741106] [\u003cc14969ca\u003e] rfcomm_send_frame+0x30/0x38\n\u003c4\u003e[ 1864.741542] [\u003cc1496a2a\u003e] rfcomm_send_ua+0x58/0x5a\n\u003c4\u003e[ 1864.741959] [\u003cc1498447\u003e] rfcomm_run+0x441/0xb52\n\u003c4\u003e[ 1864.742365] [\u003cc104f095\u003e] kthread+0x63/0x68\n\u003c4\u003e[ 1864.742742] [\u003cc14d5182\u003e] kernel_thread_helper+0x6/0xd\n\u003c4\u003e[ 1864.743187]\n\u003c4\u003e[ 1864.743193] -\u003e #0 (rfcomm_mutex){+.+.+.}:\n\u003c4\u003e[ 1864.743667] [\u003cc1061ada\u003e] __lock_acquire+0x988/0xc00\n\u003c4\u003e[ 1864.744100] [\u003cc1062273\u003e] lock_acquire+0x104/0x140\n\u003c4\u003e[ 1864.744519] [\u003cc14d2c70\u003e] __mutex_lock_common+0x3b/0x33f\n\u003c4\u003e[ 1864.744975] [\u003cc14d303e\u003e] mutex_lock_nested+0x2d/0x36\n\u003c4\u003e[ 1864.745412] [\u003cc14970ea\u003e] rfcomm_dlc_close+0x15/0x30\n\u003c4\u003e[ 1864.745842] [\u003cc14990d9\u003e] __rfcomm_sock_close+0x5f/0x6b\n\u003c4\u003e[ 1864.746288] [\u003cc1499114\u003e] rfcomm_sock_shutdown+0x2f/0x62\n\u003c4\u003e[ 1864.746737] [\u003cc13d275d\u003e] sys_socketcall+0x1db/0x422\n\u003c4\u003e[ 1864.747165] [\u003cc14d42f0\u003e] syscall_call+0x7/0xb\n\nSigned-off-by: Octavian Purdila \u003coctavian.purdila@intel.com\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\n" }, { "commit": "6e1da683f79a22fafaada62d547138daaa9e3456", "tree": "d3502a1dd0a2df2d13e9d53a70042f68381e0ee3", "parents": [ "a63752552b95624a9f1dfa3d763870f72f964ad0" ], "author": { "name": "Andrzej Kaczmarek", "email": "andrzej.kaczmarek@tieto.com", "time": "Wed Jan 04 12:10:42 2012 +0100" }, "committer": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Wed Feb 15 13:09:25 2012 +0200" }, "message": "Bluetooth: l2cap_set_timer needs jiffies as timeout value\n\nAfter moving L2CAP timers to workqueues l2cap_set_timer expects timeout\nvalue to be specified in jiffies but constants defined in miliseconds\nare used. This makes timeouts unreliable when CONFIG_HZ is not set to\n1000.\n\n__set_chan_timer macro still uses jiffies as input to avoid multiple\nconversions from/to jiffies for sk_sndtimeo value which is already\nspecified in jiffies.\n\nSigned-off-by: Andrzej Kaczmarek \u003candrzej.kaczmarek@tieto.com\u003e\nAckec-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\n" }, { "commit": "a63752552b95624a9f1dfa3d763870f72f964ad0", "tree": "a18d24a87e98bad9965731a0282fe0216f73a439", "parents": [ "4aa832c27edf902130f8bace1d42cf22468823fa" ], "author": { "name": "Andrzej Kaczmarek", "email": "andrzej.kaczmarek@tieto.com", "time": "Wed Jan 04 12:10:41 2012 +0100" }, "committer": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Wed Feb 15 13:09:25 2012 +0200" }, "message": "Bluetooth: Fix sk_sndtimeo initialization for L2CAP socket\n\nsk_sndtime value should be specified in jiffies thus initial value\nneeds to be converted from miliseconds. Otherwise this timeout is\nunreliable when CONFIG_HZ is not set to 1000.\n\nSigned-off-by: Andrzej Kaczmarek \u003candrzej.kaczmarek@tieto.com\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\n" }, { "commit": "4aa832c27edf902130f8bace1d42cf22468823fa", "tree": "0145f7d8455de5a7e06a3b9be52f2c2ac3857bb2", "parents": [ "19ad9e94f6e2b4b3e1feccfb2466eb6e3e5b8c2a" ], "author": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Sun Jan 08 22:51:16 2012 +0200" }, "committer": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Wed Feb 15 13:09:25 2012 +0200" }, "message": "Bluetooth: Remove bogus inline declaration from l2cap_chan_connect\n\nAs reported by Dan Carpenter this function causes a Sparse warning and\nshouldn\u0027t be declared inline:\n\ninclude/net/bluetooth/l2cap.h:837:30 error: marked inline, but without a\ndefinition\"\n\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\n" }, { "commit": "18daf1644e634bae951a6e3d4d19d89170209762", "tree": "e4d467a93904208cb2c421868646b1cd8f33b34e", "parents": [ "c27111e5b8d6b1e9296f7075cdc35872f672b524" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Fri Jan 13 15:11:30 2012 +0100" }, "committer": { "name": "Johan Hedberg", "email": "johan.hedberg@intel.com", "time": "Wed Feb 15 13:09:25 2012 +0200" }, "message": "Bluetooth: Fix l2cap conn failures for ssp devices\n\nCommit 330605423c fixed l2cap conn establishment for non-ssp remote\ndevices by not setting HCI_CONN_ENCRYPT_PEND every time conn security\nis tested (which was always returning failure on any subsequent\nsecurity checks).\n\nHowever, this broke l2cap conn establishment for ssp remote devices\nwhen an ACL link was already established at SDP-level security. This\nfix ensures that encryption must be pending whenever authentication\nis also pending.\n\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nTested-by: Daniel Wagner \u003cdaniel.wagner@bmw-carit.de\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Johan Hedberg \u003cjohan.hedberg@intel.com\u003e\n" }, { "commit": "58e05f357a039a94aa36475f8c110256f693a239", "tree": "c9f03ac6514a6e4de646880be1f2e6d7764b8fea", "parents": [ "f65bd5ec47a4461bc575d5d34902fd18b6ec5542" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Tue Feb 14 10:11:59 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 14 15:24:26 2012 -0500" }, "message": "netpoll: netpoll_poll_dev() should access dev-\u003eflags\n\ncommit 5a698af53f (bond: service netpoll arp queue on master device)\ntested IFF_SLAVE flag against dev-\u003epriv_flags instead of dev-\u003eflags\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: WANG Cong \u003camwang@redhat.com\u003e\nAcked-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f65bd5ec47a4461bc575d5d34902fd18b6ec5542", "tree": "a3620efc993f54214badf3c9b738a00aab840087", "parents": [ "fc543637525b59af38af2ce09a4dbdd7d5eb27bf" ], "author": { "name": "Axel Lin", "email": "axel.lin@gmail.com", "time": "Mon Feb 13 20:19:14 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 14 14:41:55 2012 -0500" }, "message": "RxRPC: Fix kcalloc parameters swapped\n\nThe first parameter should be \"number of elements\" and the second parameter\nshould be \"element size\".\n\nSigned-off-by: Axel Lin \u003caxel.lin@gmail.com\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0af2a0d0576205dda778d25c6c344fc6508fc81d", "tree": "3f3b3d70ed8d614c2b64ddeaaac27f526e844497", "parents": [ "fbcf88b8833ce2c404b9a0e7caab82b20312cbbc" ], "author": { "name": "Neal Cardwell", "email": "ncardwell@google.com", "time": "Mon Feb 13 20:22:08 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 14 14:38:57 2012 -0500" }, "message": "tcp: fix tcp_shifted_skb() adjustment of lost_cnt_hint for FACK\n\nThis commit ensures that lost_cnt_hint is correctly updated in\ntcp_shifted_skb() for FACK TCP senders. The lost_cnt_hint adjustment\nin tcp_sacktag_one() only applies to non-FACK senders, so FACK senders\nneed their own adjustment.\n\nThis applies the spirit of 1e5289e121372a3494402b1b131b41bfe1cf9b7f -\nexcept now that the sequence range passed into tcp_sacktag_one() is\ncorrect we need only have a special case adjustment for FACK.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "074b85175a43a23fdbde60f55feea636e0bf0f85", "tree": "e6f6fdd82854b2bf25ea5b404cee010806a8fced", "parents": [ "1d6f2097865e64963e90cce04980dce2f9fc023f" ], "author": { "name": "Dimitri Sivanich", "email": "sivanich@sgi.com", "time": "Wed Feb 08 12:39:07 2012 -0800" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Feb 13 20:45:38 2012 -0500" }, "message": "vfs: fix panic in __d_lookup() with high dentry hashtable counts\n\nWhen the number of dentry cache hash table entries gets too high\n(2147483648 entries), as happens by default on a 16TB system, use of a\nsigned integer in the dcache_init() initialization loop prevents the\ndentry_hashtable from getting initialized, causing a panic in\n__d_lookup(). Fix this in dcache_init() and similar areas.\n\nSigned-off-by: Dimitri Sivanich \u003csivanich@sgi.com\u003e\nAcked-by: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "daef52bab1fd26e24e8e9578f8fb33ba1d0cb412", "tree": "93c2cb04a8861280aefcb94961e81e4d5a580095", "parents": [ "cc9a672ee522d4805495b98680f4a3db5d0a0af9" ], "author": { "name": "Neal Cardwell", "email": "ncardwell@google.com", "time": "Sun Feb 12 18:37:10 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 13 01:00:22 2012 -0500" }, "message": "tcp: fix range tcp_shifted_skb() passes to tcp_sacktag_one()\n\nFix the newly-SACKed range to be the range of newly-shifted bytes.\n\nPreviously - since 832d11c5cd076abc0aa1eaf7be96c81d1a59ce41 -\ntcp_shifted_skb() incorrectly called tcp_sacktag_one() with the start\nand end sequence numbers of the skb it passes in set to the range just\nbeyond the range that is newly-SACKed.\n\nThis commit also removes a special-case adjustment to lost_cnt_hint in\ntcp_shifted_skb() since the pre-existing adjustment of lost_cnt_hint\nin tcp_sacktag_one() now properly handles this things now that the\ncorrect start sequence number is passed in.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cc9a672ee522d4805495b98680f4a3db5d0a0af9", "tree": "391c58df73783b8b662f638e14e1f48aa83578e4", "parents": [ "8df54d622a120058ee8bec38743c9b8f091c8e58" ], "author": { "name": "Neal Cardwell", "email": "ncardwell@google.com", "time": "Sun Feb 12 18:37:09 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 13 01:00:21 2012 -0500" }, "message": "tcp: allow tcp_sacktag_one() to tag ranges not aligned with skbs\n\nThis commit allows callers of tcp_sacktag_one() to pass in sequence\nranges that do not align with skb boundaries, as tcp_shifted_skb()\nneeds to do in an upcoming fix in this patch series.\n\nIn fact, now tcp_sacktag_one() does not need to depend on an input skb\nat all, which makes its semantics and dependencies more clear.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8df54d622a120058ee8bec38743c9b8f091c8e58", "tree": "559dc9788cff370bed7b36d61f77708ff4efbaa7", "parents": [ "612b8507c5d545feed2437b3d2239929cac7688d", "70620c46ac2b45c24b0f22002fdf5ddd1f7daf81" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:18:46 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:18:46 2012 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nQuoth David:\n\n1) GRO MAC header comparisons were ethernet specific, breaking other\n link types. This required a multi-faceted fix to cure the originally\n noted case (Infiniband), because IPoIB was lying about it\u0027s actual\n hard header length. Thanks to Eric Dumazet, Roland Dreier, and\n others.\n\n2) Fix build failure when INET_UDP_DIAG is built in and ipv6 is modular.\n From Anisse Astier.\n\n3) Off by ones and other bug fixes in netprio_cgroup from Neil Horman.\n\n4) ipv4 TCP reset generation needs to respect any network interface\n binding from the socket, otherwise route lookups might give a\n different result than all the other segments received. From Shawn\n Lu.\n\n5) Fix unintended regression in ipv4 proxy ARP responses, from Thomas\n Graf.\n\n6) Fix SKB under-allocation bug in sh_eth, from Yoshihiro Shimoda.\n\n7) Revert skge PCI mapping changes that are causing crashes for some\n folks, from Stephen Hemminger.\n\n8) IPV4 route lookups fill in the wildcarded fields of the given flow\n lookup key passed in, which is fine most of the time as this is\n exactly what the caller\u0027s want. However there are a few cases that\n want to retain the original flow key values afterwards, so handle\n those cases properly. Fix from Julian Anastasov.\n\n9) IGB/IXGBE VF lookup bug fixes from Greg Rose.\n\n10) Properly null terminate filename passed to ethtool flash device\n method, from Ben Hutchings.\n\n11) S3 resume fix in via-velocity from David Lv.\n\n12) Fix double SKB free during xmit failure in CAIF, from Dmitry\n Tarnyagin.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (72 commits)\n net: Don\u0027t proxy arp respond if iif \u003d\u003d rt-\u003edst.dev if private VLAN is disabled\n ipv4: Fix wrong order of ip_rt_get_source() and update iph-\u003edaddr.\n netprio_cgroup: fix wrong memory access when NETPRIO_CGROUP\u003dm\n netprio_cgroup: don\u0027t allocate prio table when a device is registered\n netprio_cgroup: fix an off-by-one bug\n bna: fix error handling of bnad_get_flash_partition_by_offset()\n isdn: type bug in isdn_net_header()\n net: Make qdisc_skb_cb upper size bound explicit.\n ixgbe: ethtool: stats user buffer overrun\n ixgbe: dcb: up2tc mapping lost on disable/enable CEE DCB state\n ixgbe: do not update real num queues when netdev is going away\n ixgbe: Fix broken dependency on MAX_SKB_FRAGS being related to page size\n ixgbe: Fix case of Tx Hang in PF with 32 VFs\n ixgbe: fix vf lookup\n igb: fix vf lookup\n e1000: add dropped DMA receive enable back in for WoL\n gro: more generic L2 header check\n IPoIB: Stop lying about hard_header_len and use skb-\u003ecb to stash LL addresses\n zd1211rw: firmware needs duration_id set to zero for non-pspoll frames\n net: enable TC35815 for MIPS again\n ...\n" }, { "commit": "70620c46ac2b45c24b0f22002fdf5ddd1f7daf81", "tree": "1ca143be17f6c1e78b7740c5bb2a4a12b0d059a2", "parents": [ "5dc7883f2a7c25f8df40d7479687153558cd531b" ], "author": { "name": "Thomas Graf", "email": "tgraf@suug.ch", "time": "Fri Feb 10 04:07:11 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 10 15:13:36 2012 -0500" }, "message": "net: Don\u0027t proxy arp respond if iif \u003d\u003d rt-\u003edst.dev if private VLAN is disabled\n\nCommit 653241 (net: RFC3069, private VLAN proxy arp support) changed\nthe behavior of arp proxy to send arp replies back out on the interface\nthe request came in even if the private VLAN feature is disabled.\n\nPreviously we checked rt-\u003edst.dev !\u003d skb-\u003edev for in scenarios, when\nproxy arp is enabled on for the netdevice and also when individual proxy\nneighbour entries have been added.\n\nThis patch adds the check back for the pneigh_lookup() scenario.\n\nSigned-off-by: Thomas Graf \u003ctgraf@suug.ch\u003e\nAcked-by: Jesper Dangaard Brouer \u003chawk@comx.dk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5dc7883f2a7c25f8df40d7479687153558cd531b", "tree": "8f105bb70f72675e6bc4e2bc7516856fb21e24c0", "parents": [ "2b73bc65e2771372c818db7955709c8caedbf8b9" ], "author": { "name": "Li Wei", "email": "lw@cn.fujitsu.com", "time": "Thu Feb 09 21:15:25 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 10 15:12:12 2012 -0500" }, "message": "ipv4: Fix wrong order of ip_rt_get_source() and update iph-\u003edaddr.\n\nThis patch fix a bug which introduced by commit ac8a4810 (ipv4: Save\nnexthop address of LSRR/SSRR option to IPCB.).In that patch, we saved\nthe nexthop of SRR in ip_option-\u003enexthop and update iph-\u003edaddr until\nwe get to ip_forward_options(), but we need to update it before\nip_rt_get_source(), otherwise we may get a wrong src.\n\nSigned-off-by: Li Wei \u003clw@cn.fujitsu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2b73bc65e2771372c818db7955709c8caedbf8b9", "tree": "4cd1bfe8284d9266d45f5de11e3f4d8fbfcdbf4f", "parents": [ "f5c38208d32412d72b97a4f0d44af0eb39feb20b" ], "author": { "name": "Neil Horman", "email": "nhorman@tuxdriver.com", "time": "Fri Feb 10 05:43:38 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 10 15:08:57 2012 -0500" }, "message": "netprio_cgroup: fix wrong memory access when NETPRIO_CGROUP\u003dm\n\nWhen the netprio_cgroup module is not loaded, net_prio_subsys_id\nis -1, and so sock_update_prioidx() accesses cgroup_subsys array\nwith negative index subsys[-1].\n\nMake the code resembles cls_cgroup code, which is bug free.\n\nOrigionally-authored-by: Li Zefan \u003clizf@cn.fujitsu.com\u003e\nSigned-off-by: Li Zefan \u003clizf@cn.fujitsu.com\u003e\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nCC: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f5c38208d32412d72b97a4f0d44af0eb39feb20b", "tree": "66d7a30ed9ec41fc9327b9fc839eec497055c5a9", "parents": [ "a87dfe14a78501c931a4d5481efff6a809aa907d" ], "author": { "name": "Neil Horman", "email": "nhorman@tuxdriver.com", "time": "Fri Feb 10 05:43:37 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 10 15:08:57 2012 -0500" }, "message": "netprio_cgroup: don\u0027t allocate prio table when a device is registered\n\nSo we delay the allocation till the priority is set through cgroup,\nand this makes skb_update_priority() faster when it\u0027s not set.\n\nThis also eliminates an off-by-one bug similar with the one fixed\nin the previous patch.\n\nOrigionally-authored-by: Li Zefan \u003clizf@cn.fujitsu.com\u003e\nSigned-off-by: Li Zefan \u003clizf@cn.fujitsu.com\u003e\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nCC: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a87dfe14a78501c931a4d5481efff6a809aa907d", "tree": "cecc481e2daed8dcd4fafabab04f51796dcbf945", "parents": [ "027a3b617c5490b5287d98921675abcbebeb32df" ], "author": { "name": "Neil Horman", "email": "nhorman@tuxdriver.com", "time": "Fri Feb 10 05:43:36 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 10 15:08:56 2012 -0500" }, "message": "netprio_cgroup: fix an off-by-one bug\n\n# mount -t cgroup xxx /mnt\n # mkdir /mnt/tmp\n # cat /mnt/tmp/net_prio.ifpriomap\n lo 0\n eth0 0\n virbr0 0\n # echo \u0027lo 999\u0027 \u003e /mnt/tmp/net_prio.ifpriomap\n # cat /mnt/tmp/net_prio.ifpriomap\n lo 999\n eth0 0\n virbr0 4101267344\n\nWe got weired output, because we exceeded the boundary of the array.\nWe may even crash the kernel..\n\nOrigionally-authored-by: Li Zefan \u003clizf@cn.fujitsu.com\u003e\nSigned-off-by: Li Zefan \u003clizf@cn.fujitsu.com\u003e\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nCC: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b57e6b560fc2a2742910ac5ca0eb2c46e45aeac2", "tree": "f658087c4d280d8887b4f5e8a90be3380eb61136", "parents": [ "e81a7bd55531a77d8c16d44766db4089c2983f1b" ], "author": { "name": "Mohammed Shafi Shajakhan", "email": "mohammed@qca.qualcomm.com", "time": "Thu Feb 09 19:59:43 2012 +0530" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Thu Feb 09 15:16:04 2012 -0500" }, "message": "mac80211: Fix a rwlock bad magic bug\n\nread_lock(\u0026tpt_trig-\u003etrig.leddev_list_lock) is accessed via the path\nieee80211_open (-\u003e) ieee80211_do_open (-\u003e) ieee80211_mod_tpt_led_trig\n(-\u003e) ieee80211_start_tpt_led_trig (-\u003e) tpt_trig_timer before initializing\nit.\nthe intilization of this read/write lock happens via the path\nieee80211_led_init (-\u003e) led_trigger_register, but we are doing\n\u0027ieee80211_led_init\u0027 after \u0027ieeee80211_if_add\u0027 where we\nregister netdev_ops.\nso we access leddev_list_lock before initializing it and causes the\nfollowing bug in chrome laptops with AR928X cards with the following\nscript\n\nwhile true\ndo\nsudo modprobe -v ath9k\nsleep 3\nsudo modprobe -r ath9k\nsleep 3\ndone\n\n\tBUG: rwlock bad magic on CPU#1, wpa_supplicant/358, f5b9eccc\n\tPid: 358, comm: wpa_supplicant Not tainted 3.0.13 #1\n\tCall Trace:\n\n\t[\u003c8137b9df\u003e] rwlock_bug+0x3d/0x47\n\t[\u003c81179830\u003e] do_raw_read_lock+0x19/0x29\n\t[\u003c8137f063\u003e] _raw_read_lock+0xd/0xf\n\t[\u003cf9081957\u003e] tpt_trig_timer+0xc3/0x145 [mac80211]\n\t[\u003cf9081f3a\u003e] ieee80211_mod_tpt_led_trig+0x152/0x174 [mac80211]\n\t[\u003cf9076a3f\u003e] ieee80211_do_open+0x11e/0x42e [mac80211]\n\t[\u003cf9075390\u003e] ? ieee80211_check_concurrent_iface+0x26/0x13c [mac80211]\n\t[\u003cf9076d97\u003e] ieee80211_open+0x48/0x4c [mac80211]\n\t[\u003c812dbed8\u003e] __dev_open+0x82/0xab\n\t[\u003c812dc0c9\u003e] __dev_change_flags+0x9c/0x113\n\t[\u003c812dc1ae\u003e] dev_change_flags+0x18/0x44\n\t[\u003c8132144f\u003e] devinet_ioctl+0x243/0x51a\n\t[\u003c81321ba9\u003e] inet_ioctl+0x93/0xac\n\t[\u003c812cc951\u003e] sock_ioctl+0x1c6/0x1ea\n\t[\u003c812cc78b\u003e] ? might_fault+0x20/0x20\n\t[\u003c810b1ebb\u003e] do_vfs_ioctl+0x46e/0x4a2\n\t[\u003c810a6ebb\u003e] ? fget_light+0x2f/0x70\n\t[\u003c812ce549\u003e] ? sys_recvmsg+0x3e/0x48\n\t[\u003c810b1f35\u003e] sys_ioctl+0x46/0x69\n\t[\u003c8137fa77\u003e] sysenter_do_call+0x12/0x2\n\nCc: \u003cstable@vger.kernel.org\u003e\nCc: Gary Morain \u003cgmorain@google.com\u003e\nCc: Paul Stewart \u003cpstew@google.com\u003e\nCc: Abhijit Pradhan \u003cabhijit@qca.qualcomm.com\u003e\nCc: Vasanthakumar Thiagarajan \u003cvthiagar@qca.qualcomm.com\u003e\nCc: Rajkumar Manoharan \u003crmanohar@qca.qualcomm.com\u003e\nAcked-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nTested-by: Mohammed Shafi Shajakhan \u003cmohammed@qca.qualcomm.com\u003e\nSigned-off-by: Mohammed Shafi Shajakhan \u003cmohammed@qca.qualcomm.com\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "a8db7b2d197a0d624baab83f0c810b0edbc4ffd0", "tree": "ebd355871baa76453aca87e0556c9bb55447672c", "parents": [ "e0aac52e17a3db68fe2ceae281780a70fc69957f" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Mon Feb 06 13:23:10 2012 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Thu Feb 09 20:47:53 2012 +0100" }, "message": "netfilter: nf_queue: fix queueing of bridged gro skbs\n\nWhen trying to nf_queue GRO/GSO skbs, nf_queue uses skb_gso_segment\nto split the skb.\n\nHowever, if nf_queue is called via bridge netfilter, the mac header\nwon\u0027t be preserved -- packets will thus contain a bogus mac header.\n\nFix this by setting skb-\u003edata to the mac header when skb-\u003enf_bridge\nis set and restoring skb-\u003edata afterwards for all segments.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "16bda13d90c8d5da243e2cfa1677e62ecce26860", "tree": "d10c9e0f9b043170c5bba4599ab1dc006d2a76eb", "parents": [ "9cc00b51a3cbb3b933065a55eaa9bfc306411b7a" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Feb 06 15:14:37 2012 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 09 13:50:34 2012 -0500" }, "message": "net: Make qdisc_skb_cb upper size bound explicit.\n\nJust like skb-\u003ecb[], so that qdisc_skb_cb can be encapsulated inside\nof other data structures.\n\nThis is intended to be used by IPoIB so that it can remember\naddressing information stored at hard_header_ops-\u003ecreate() time that\nit can fetch when the packet gets to the transmit routine.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5ca3b72c5da47d95b83857b768def6172fbc080a", "tree": "9e1dab3a4e055c313aae8b78747d08c201dc91b6", "parents": [ "936d7de3d736e0737542641269436f4b5968e9ef" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Wed Feb 08 08:51:50 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 08 18:26:54 2012 -0500" }, "message": "gro: more generic L2 header check\n\nShlomo Pongratz reported GRO L2 header check was suited for Ethernet\nonly, and failed on IB/ipoib traffic.\n\nHe provided a patch faking a zeroed header to let GRO aggregates frames.\n\nRoland Dreier, Herbert Xu, and others suggested we change GRO L2 header\ncheck to be more generic, ie not assuming L2 header is 14 bytes, but\ntaking into account hard_header_len.\n\n__napi_gro_receive() has special handling for the common case (Ethernet)\nto avoid a memcmp() call and use an inline optimized function instead.\n\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nReported-by: Shlomo Pongratz \u003cshlomop@mellanox.com\u003e\nCc: Roland Dreier \u003croland@kernel.org\u003e\nCc: Or Gerlitz \u003cogerlitz@mellanox.com\u003e\nCc: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nTested-by: Sean Hefty \u003csean.hefty@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6d25886ee2fbc05a7bf4dae5f5ae345cb73df2fd", "tree": "a474640348866b4b7f7ba14bb52978f5963191c0", "parents": [ "3f61cd879c2f112c468e8849949b6fc88c739679" ], "author": { "name": "Anisse Astier", "email": "anisse@astier.eu", "time": "Tue Feb 07 07:39:11 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Feb 07 13:35:28 2012 -0500" }, "message": "net: Fix build regression when INET_UDP_DIAG\u003dy and IPV6\u003dm\n\nTested-by: Anisse Astier \u003canisse@astier.eu\u003e\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e2446eaab5585555a38ea0df4e01ff313dbb4ac9", "tree": "58bf7212d6bebd30ec6477f84440cbbd8dbb3bb1", "parents": [ "5962b35c1de3254a2f03b95efd3b7854b874d7b7" ], "author": { "name": "Shawn Lu", "email": "shawn.lu@ericsson.com", "time": "Sat Feb 04 12:38:09 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Feb 04 18:20:05 2012 -0500" }, "message": "tcp_v4_send_reset: binding oif to iif in no sock case\n\nBinding RST packet outgoing interface to incoming interface\nfor tcp v4 when there is no socket associate with it.\nwhen sk is not NULL, using sk-\u003esk_bound_dev_if instead.\n(suggested by Eric Dumazet).\n\nThis has few benefits:\n1. tcp_v6_send_reset already did that.\n2. This helps tcp connect with SO_BINDTODEVICE set. When\nconnection is lost, we still able to sending out RST using\nsame interface.\n3. we are sending reply, it is most likely to be succeed\nif iif is used\n\nSigned-off-by: Shawn Lu \u003cshawn.lu@ericsson.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5962b35c1de3254a2f03b95efd3b7854b874d7b7", "tree": "f085176f6441a32782294dccdd52336c58b0ba5f", "parents": [ "1715322f3e0600b664fa8b780a07de104f49c104" ], "author": { "name": "Neil Horman", "email": "nhorman@tuxdriver.com", "time": "Fri Feb 03 05:18:43 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Feb 04 16:30:24 2012 -0500" }, "message": "netprio_cgroup: Fix obo in get_prioidx\n\nIt was recently pointed out to me that the get_prioidx function sets a bit in\nthe prioidx map prior to checking to see if the index being set is out of\nbounds. This patch corrects that, avoiding the possiblity of us writing beyond\nthe end of the array\n\nSigned-off-by: Neil Horman \u003cnhorman@tuxdriver.com\u003e\nReported-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nCC: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nCC: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e0aac52e17a3db68fe2ceae281780a70fc69957f", "tree": "ab84852ae04cefecb140b65ad393092f60865730", "parents": [ "29830406415c227a54af429d7b300aabd4754237" ], "author": { "name": "Simon Horman", "email": "horms@verge.net.au", "time": "Fri Jan 27 10:45:27 2012 +0900" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Sat Feb 04 20:27:58 2012 +0100" }, "message": "ipvs: fix matching of fwmark templates during scheduling\n\n\tCommit f11017ec2d1859c661f4e2b12c4a8d250e1f47cf (2.6.37)\nmoved the fwmark variable in subcontext that is invalidated before\nreaching the ip_vs_ct_in_get call. As vaddr is provided as pointer\nin the param structure make sure the fwmark variable is in\nsame context. As the fwmark templates can not be matched,\nmore and more template connections are created and the\ncontrolled connections can not go to single real server.\n\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Simon Horman \u003chorms@verge.net.au\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "157ca9eae92bc5247f93bea4ecb50dfacc283a04", "tree": "2bf88c36d1a7513c3dbb2babd6feb64ed2ce558c", "parents": [ "29830406415c227a54af429d7b300aabd4754237", "07ae2dfcf4f7143ce191c6436da1c33f179af0d6" ], "author": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Fri Feb 03 14:14:07 2012 -0500" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Fri Feb 03 14:14:07 2012 -0500" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem\n" }, { "commit": "6c073a7ee250118b8be3a2379c96fd7f78382b06", "tree": "b398bd9cad821a3543df835e5a0110f270acafb9", "parents": [ "ff05f603c3238010769787f3ba54c48c290ed3e5", "d23a4b3fd6ef70b80411b39b8c8bc548a219ce70" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 02 15:47:33 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 02 15:47:33 2012 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:\n rbd: fix safety of rbd_put_client()\n rbd: fix a memory leak in rbd_get_client()\n ceph: create a new session lock to avoid lock inversion\n ceph: fix length validation in parse_reply_info()\n ceph: initialize client debugfs outside of monc-\u003emutex\n ceph: change \"ceph.layout\" xattr to be \"ceph.file.layout\"\n" }, { "commit": "ab434b60ab07f8c44246b6fb0cddee436687a09a", "tree": "2a680aca91c4906f28cda57093ac76b1e588de5d", "parents": [ "114fc47492e23d93653e4a16664833e98d62a563" ], "author": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Fri Jan 13 22:22:03 2012 -0800" }, "committer": { "name": "Sage Weil", "email": "sage@newdream.net", "time": "Thu Feb 02 12:49:01 2012 -0800" }, "message": "ceph: initialize client debugfs outside of monc-\u003emutex\n\nInitializing debufs under monc-\u003emutex introduces a lock dependency for\nsb-\u003es_type-\u003ei_mutex_key, which (combined with several other dependencies)\nleads to an annoying lockdep warning. There\u0027s no particular reason to do\nthe debugfs setup under this lock, so move it out.\n\nIt used to be the case that our first monmap could come from the OSD; that\nis no longer the case with recent servers, so we will reliably set up the\nclient entry during the initial authentication.\n\nWe don\u0027t have to worry about racing with debugfs teardown by\nceph_debugfs_client_cleanup() because ceph_destroy_client() calls\nceph_msgr_flush() first, which will wait for the message dispatch work\nto complete (and the debugfs init to complete).\n\nFixes: #1940\nSigned-off-by: Sage Weil \u003csage@newdream.net\u003e\n" }, { "commit": "ba7605745d5c99f0e71b3ec6c7cb5ed6afe540ad", "tree": "24f678ef44d316b79d6301ed3ffde26258d6f2ac", "parents": [ "b01377a4200d0dfc7b04a8daabb4739727353703" ], "author": { "name": "Dmitry Tarnyagin", "email": "dmitry.tarnyagin@stericsson.com", "time": "Thu Feb 02 01:21:03 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 02 14:35:12 2012 -0500" }, "message": "caif: Bugfix double kfree_skb upon xmit failure\n\nSKB is freed twice upon send error. The Network stack consumes SKB even\nwhen it returns error code.\n\nSigned-off-by: Sjur Brændeland \u003csjur.brandeland@stericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b01377a4200d0dfc7b04a8daabb4739727353703", "tree": "2c1eef3ae76495872c2b55459c318e9a905c479f", "parents": [ "c31c151b1c4a29da4dc92212aa8648fb4f8557b9" ], "author": { "name": "sjur.brandeland@stericsson.com", "email": "sjur.brandeland@stericsson.com", "time": "Thu Feb 02 01:21:02 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 02 14:35:12 2012 -0500" }, "message": "caif: Bugfix list_del_rcu race in cfmuxl_ctrlcmd.\n\nAlways use cfmuxl_remove_uplayer when removing a up-layer.\ncfmuxl_ctrlcmd() can be called independently and in parallel with\ncfmuxl_remove_uplayer(). The race between them could cause list_del_rcu\nto be called on a node which has been already taken out from the list.\nThat lead to a (rare) crash on accessing poisoned node-\u003eprev inside\nlist_del_rcu.\n\nThis fix ensures that deletion are done holding the same lock.\n\nReported-by: Dmitry Tarnyagin \u003cdmitry.tarnyagin@stericsson.com\u003e\nSigned-off-by: Sjur Brændeland \u003csjur.brandeland@stericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c43b874d5d714f271b80d4c3f49e05d0cbf51ed2", "tree": "c56f3500327b081228d4c7369d39740e9bb4a0a9", "parents": [ "786f528119722f564a22ad953411374e06116333" ], "author": { "name": "Jason Wang", "email": "jasowang@redhat.com", "time": "Thu Feb 02 00:07:00 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 02 14:34:41 2012 -0500" }, "message": "tcp: properly initialize tcp memory limits\n\nCommit 4acb4190 tries to fix the using uninitialized value\nintroduced by commit 3dc43e3, but it would make the\nper-socket memory limits too small.\n\nThis patch fixes this and also remove the redundant codes\nintroduced in 4acb4190.\n\nSigned-off-by: Jason Wang \u003cjasowang@redhat.com\u003e\nAcked-by: Glauber Costa \u003cglommer@parallels.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "07ae2dfcf4f7143ce191c6436da1c33f179af0d6", "tree": "c18ff3f0f4967bee6bf741bcbc703809d73252c9", "parents": [ "3d29dd9b5b160ba4542a9b8f869a220559e633a0" ], "author": { "name": "Eliad Peller", "email": "eliad@wizery.com", "time": "Wed Feb 01 18:48:09 2012 +0200" }, "committer": { "name": "John W. Linville", "email": "linville@tuxdriver.com", "time": "Wed Feb 01 15:26:00 2012 -0500" }, "message": "mac80211: timeout a single frame in the rx reorder buffer\n\nThe current code checks for stored_mpdu_num \u003e 1, causing\nthe reorder_timer to be triggered indefinitely, but the\nframe is never timed-out (until the next packet is received)\n\nSigned-off-by: Eliad Peller \u003celiad@wizery.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nAcked-by: Johannes Berg \u003cjohannes@sipsolutions.net\u003e\nSigned-off-by: John W. Linville \u003clinville@tuxdriver.com\u003e\n" }, { "commit": "786f528119722f564a22ad953411374e06116333", "tree": "122ca6128b967fc4e91ff9a974181536a55f64ed", "parents": [ "efcdbf24fd5daa88060869e51ed49f68b7ac8708" ], "author": { "name": "Ben Hutchings", "email": "bhutchings@solarflare.com", "time": "Wed Feb 01 09:32:25 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 01 14:47:17 2012 -0500" }, "message": "ethtool: Null-terminate filename passed to ethtool_ops::flash_device\n\nThe parameters for ETHTOOL_FLASHDEV include a filename, which ought to\nbe null-terminated. Currently the only driver that implements\nethtool_ops::flash_device attempts to add a null terminator if\nnecessary, but does it wrongly. Do it in the ethtool core instead.\n\nSigned-off-by: Ben Hutchings \u003cbhutchings@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "efcdbf24fd5daa88060869e51ed49f68b7ac8708", "tree": "8c771a1ef2c93f1ba959709d6ffb4fd56af53699", "parents": [ "48c3883999cb06246911e29356d194f96f1c75ef" ], "author": { "name": "Arun Sharma", "email": "asharma@fb.com", "time": "Mon Jan 30 14:16:06 2012 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 01 14:41:50 2012 -0500" }, "message": "net: Disambiguate kernel message\n\nSome of our machines were reporting:\n\nTCP: too many of orphaned sockets\n\neven when the number of orphaned sockets was well below the\nlimit.\n\nWe print a different message depending on whether we\u0027re out\nof TCP memory or there are too many orphaned sockets.\n\nAlso move the check out of line and cleanup the messages\nthat were printed.\n\nSigned-off-by: Arun Sharma \u003casharma@fb.com\u003e\nSuggested-by: Mohan Srinivasan \u003cmohan@fb.com\u003e\nCc: netdev@vger.kernel.org\nCc: linux-kernel@vger.kernel.org\nCc: David Miller \u003cdavem@davemloft.net\u003e\nCc: Glauber Costa \u003cglommer@parallels.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Joe Perches \u003cjoe@perches.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a14a8d93169a8f2b0b000891571659ddbfa3a169", "tree": "36efa74c6f8c635079a8c3e057d25622282f4578", "parents": [ "b527a2331b873b8bf0549a45fc1ff635dd230d15", "6f01fd6e6f6809061b56e78f1e8d143099716d70" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jan 30 10:53:20 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jan 30 10:53:20 2012 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\n1) Setting link attributes can modify the size of the attributes that\n would be reported on a subsequent getlink netlink operation,\n therefore min_ifinfo_dump_size needs to be adjusted. From Stefan\n Gula.\n\n2) Resegmentation of TSO frames while trimming can violate invariants\n expected by callers, namely that the number of segments can only stay\n the same or decrease, never increase. If MSS changes, however, we\n can trim data but then end up with more segments. Fix this by only\n segmenting to the MSS already recorded in the SKB. That\u0027s the\n simplest fix for now and if we want to get more fancy in the future\n that\u0027s a more involved change.\n\n This probably explains some retransmit counter inaccuracies.\n\n From Neal Cardwell.\n\n3) Fix too-many-wakeups in POLL with AF_UNIX sockets, from Eric Dumazet.\n\n4) Fix CAIF crashes wrt. namespace handling. From Eric Dumazet and\n Eric W. Biederman.\n\n5) TCP port selection fixes from Flavio Leitner.\n\n6) More socket memory cgroup build fixes in certain randonfig\n situations. From Glauber Costa.\n\n7) Fix TCP memory sysctl regression reported by Ingo Molnar, also from\n Glauber Costa.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:\n af_unix: fix EPOLLET regression for stream sockets\n tcp: fix tcp_trim_head() to adjust segment count with skb MSS\n net/tcp: Fix tcp memory limits initialization when !CONFIG_SYSCTL\n net caif: Register properly as a pernet subsystem.\n netns: Fail conspicously if someone uses net_generic at an inappropriate time.\n net: explicitly add jump_label.h header to sock.h\n net: RTNETLINK adjusting values of min_ifinfo_dump_size\n ipv6: Fix ip_gre lockless xmits.\n xen-netfront: correct MAX_TX_TARGET calculation.\n netns: fix net_alloc_generic()\n tcp: bind() optimize port allocation\n tcp: bind() fix autoselection to share ports\n l2tp: l2tp_ip - fix possible oops on packet receive\n iwlwifi: fix PCI-E transport \"inta\" race\n mac80211: set bss_conf.idle when vif is connected\n mac80211: update oper_channel on ibss join\n" }, { "commit": "6f01fd6e6f6809061b56e78f1e8d143099716d70", "tree": "bd6b09a01a5f1af65fc12c6ac533f2b1f4caa777", "parents": [ "5b35e1e6e9ca651e6b291c96d1106043c9af314a" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Sat Jan 28 16:11:03 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 30 12:45:07 2012 -0500" }, "message": "af_unix: fix EPOLLET regression for stream sockets\n\nCommit 0884d7aa24 (AF_UNIX: Fix poll blocking problem when reading from\na stream socket) added a regression for epoll() in Edge Triggered mode\n(EPOLLET)\n\nAppropriate fix is to use skb_peek()/skb_unlink() instead of\nskb_dequeue(), and only call skb_unlink() when skb is fully consumed.\n\nThis remove the need to requeue a partial skb into sk_receive_queue head\nand the extra sk-\u003esk_data_ready() calls that added the regression.\n\nThis is safe because once skb is given to sk_receive_queue, it is not\nmodified by a writer, and readers are serialized by u-\u003ereadlock mutex.\n\nThis also reduce number of spinlock acquisition for small reads or\nMSG_PEEK users so should improve overall performance.\n\nReported-by: Nick Mathewson \u003cnickm@freehaven.net\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: Alexey Moiseytsev \u003chimeraster@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5b35e1e6e9ca651e6b291c96d1106043c9af314a", "tree": "d18caadee5e93dc45d0c5fa2c530537cfa14586c", "parents": [ "4acb41903b2f99f3dffd4c3df9acc84ca5942cb2" ], "author": { "name": "Neal Cardwell", "email": "ncardwell@google.com", "time": "Sat Jan 28 17:29:46 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 30 12:42:58 2012 -0500" }, "message": "tcp: fix tcp_trim_head() to adjust segment count with skb MSS\n\nThis commit fixes tcp_trim_head() to recalculate the number of\nsegments in the skb with the skb\u0027s existing MSS, so trimming the head\ncauses the skb segment count to be monotonically non-increasing - it\nshould stay the same or go down, but not increase.\n\nPreviously tcp_trim_head() used the current MSS of the connection. But\nif there was a decrease in MSS between original transmission and ACK\n(e.g. due to PMTUD), this could cause tcp_trim_head() to\ncounter-intuitively increase the segment count when trimming bytes off\nthe head of an skb. This violated assumptions in tcp_tso_acked() that\ntcp_trim_head() only decreases the packet count, so that packets_acked\nin tcp_tso_acked() could underflow, leading tcp_clean_rtx_queue() to\npass u32 pkts_acked values as large as 0xffffffff to\nca_ops-\u003epkts_acked().\n\nAs an aside, if tcp_trim_head() had really wanted the skb to reflect\nthe current MSS, it should have called tcp_set_skb_tso_segs()\nunconditionally, since a decrease in MSS would mean that a\nsingle-packet skb should now be sliced into multiple segments.\n\nSigned-off-by: Neal Cardwell \u003cncardwell@google.com\u003e\nAcked-by: Nandita Dukkipati \u003cnanditad@google.com\u003e\nAcked-by: Ilpo Järvinen \u003cilpo.jarvinen@helsinki.fi\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4acb41903b2f99f3dffd4c3df9acc84ca5942cb2", "tree": "3a2dc1739d654effecd86749e49a40d41019e645", "parents": [ "8a8ee9aff6c3077dd9c2c7a77478e8ed362b96c6" ], "author": { "name": "Glauber Costa", "email": "glommer@parallels.com", "time": "Mon Jan 30 01:20:17 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Jan 30 12:41:06 2012 -0500" }, "message": "net/tcp: Fix tcp memory limits initialization when !CONFIG_SYSCTL\n\nsysctl_tcp_mem() initialization was moved to sysctl_tcp_ipv4.c\nin commit 3dc43e3e4d0b52197d3205214fe8f162f9e0c334, since it\nbecame a per-ns value.\n\nThat code, however, will never run when CONFIG_SYSCTL is\ndisabled, leading to bogus values on those fields - causing hung\nTCP sockets.\n\nThis patch fixes it by keeping an initialization code in\ntcp_init(). It will be overwritten by the first net namespace\ninit if CONFIG_SYSCTL is compiled in, and do the right thing if\nit is compiled out.\n\nIt is also named properly as tcp_init_mem(), to properly signal\nits non-sysctl side effect on TCP limits.\n\nReported-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: Glauber Costa \u003cglommer@parallels.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nLink: http://lkml.kernel.org/r/4F22D05A.8030604@parallels.com\n[ renamed the function, tidied up the changelog a bit ]\nSigned-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f94f72ee673edd6cd9cd36fd954173871808873f", "tree": "c0461aa50c44fb7d3869ca2a5e467447308f85e9", "parents": [ "a51f67a4b440896dfc170ff3ce35994771b1267f", "875ad3f8e7dff6bc1d053e5bfe73d8e8d2e6ae67" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jan 30 08:47:49 2012 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jan 30 08:47:49 2012 -0800" }, "message": "Merge tag \u0027nfs-for-3.3-3\u0027 of git://git.linux-nfs.org/projects/trondmy/linux-nfs\n\nNFS client bugfixes for Linux 3.3 (pull 3)\n\n* tag \u0027nfs-for-3.3-3\u0027 of git://git.linux-nfs.org/projects/trondmy/linux-nfs:\n SUNRPC: Fix machine creds in generic_create_cred and generic_match\n" }, { "commit": "8a8ee9aff6c3077dd9c2c7a77478e8ed362b96c6", "tree": "bb905513ac457b8e7204056a17345ad3a5888db6", "parents": [ "5ee4433efe99b9f39f6eff5052a177bbcfe72cea" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Thu Jan 26 14:04:53 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 27 21:06:03 2012 -0500" }, "message": "net caif: Register properly as a pernet subsystem.\n\ncaif is a subsystem and as such it needs to register with\nregister_pernet_subsys instead of register_pernet_device.\n\nAmong other problems using register_pernet_device was resulting in\nnet_generic being called before the caif_net structure was allocated.\nWhich has been causing net_generic to fail with either BUG_ON\u0027s or by\nreturn NULL pointers.\n\nA more ugly problem that could be caused is packets in flight why the\nsubsystem is shutting down.\n\nTo remove confusion also remove the cruft cause by inappropriately\ntrying to fix this bug.\n\nWith the aid of the previous patch I have tested this patch and\nconfirmed that using register_pernet_subsys makes the failure go away as\nit should.\n\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nAcked-by: Sjur Brændeland \u003csjur.brandeland@stericsson.com\u003e\nTested-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cc0d7b91db000aef1cc12f1d3d4d7f80af9bd419", "tree": "5f0e86afb61b33658ec42b37ae739809ec98cb3d", "parents": [ "9018e93948c6f8f95fbcc9fa05f6c403d6adb406", "b49ba04a3a0382e7314d990707c21094c410425a" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 27 20:40:18 2012 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 27 20:40:18 2012 -0500" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless\n" }, { "commit": "f18da14565819ba43b8321237e2426a2914cc2ef", "tree": "263689dd9f9b39e6995c32e13ac725d1153a5641", "parents": [ "f2b3ee9e4200b32d113b1bd3c93f9a836c97357c" ], "author": { "name": "Stefan Gula", "email": "steweg@gmail.com", "time": "Thu Jan 26 11:01:06 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 26 16:35:57 2012 -0500" }, "message": "net: RTNETLINK adjusting values of min_ifinfo_dump_size\n\nSetting link parameters on a netdevice changes the value\nof if_nlmsg_size(), therefore it is necessary to recalculate\nmin_ifinfo_dump_size.\n\nSigned-off-by: Stefan Gula \u003csteweg@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f2b3ee9e4200b32d113b1bd3c93f9a836c97357c", "tree": "d80ac5e5fddf395762f2b31110757abf833e752e", "parents": [ "40206dd98f066d596d4280558fc5f798165861c7" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Thu Jan 26 10:34:35 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 26 16:34:08 2012 -0500" }, "message": "ipv6: Fix ip_gre lockless xmits.\n\nTunnel devices set NETIF_F_LLTX to bypass HARD_TX_LOCK. Sit and\nipip set this unconditionally in ops-\u003esetup, but gre enables it\nconditionally after parameter passing in ops-\u003enewlink. This is\nnot called during tunnel setup as below, however, so GRE tunnels are\nstill taking the lock.\n\nmodprobe ip_gre\nip tunnel add test0 mode gre remote 10.5.1.1 dev lo\nip link set test0 up\nip addr add 10.6.0.1 dev test0\n # cat /sys/class/net/test0/features\n # $DIR/test_tunnel_xmit 10 10.5.2.1\nip route add 10.5.2.0/24 dev test0\nip tunnel del test0\n\nThe newlink callback is only called in rtnl_netlink, and only if\nthe device is new, as it calls register_netdevice internally. Gre\ntunnels are created at \u0027ip tunnel add\u0027 with ioctl SIOCADDTUNNEL,\nwhich calls ipgre_tunnel_locate, which calls register_netdev.\nrtnl_newlink is called at \u0027ip link set\u0027, but skips ops-\u003enewlink\nand the device is up with locking still enabled. The equivalent\nipip tunnel works fine, btw (just substitute \u0027method gre\u0027 for\n\u0027method ipip\u0027).\n\nOn kernels before /sys/class/net/*/features was removed [1],\nthe first commented out line returns 0x6000 with method gre,\nwhich indicates that NETIF_F_LLTX (0x1000) is not set. With ipip,\nit reports 0x7000. This test cannot be used on recent kernels where\nthe sysfs file is removed (and ETHTOOL_GFEATURES does not currently\nwork for tunnel devices, because they lack dev-\u003eethtool_ops).\n\nThe second commented out line calls a simple transmission test [2]\nthat sends on 24 cores at maximum rate. Results of a single run:\n\nipip:\t\t\t19,372,306\ngre before patch:\t 4,839,753\ngre after patch:\t19,133,873\n\nThis patch replicates the condition check in ipgre_newlink to\nipgre_tunnel_locate. It works for me, both with oseq on and off.\nThis is the first time I looked at rtnetlink and iproute2 code,\nthough, so someone more knowledgeable should probably check the\npatch. Thanks.\n\nThe tail of both functions is now identical, by the way. To avoid\ncode duplication, I\u0027ll be happy to rework this and merge the two.\n\n[1] http://patchwork.ozlabs.org/patch/104610/\n[2] http://kernel.googlecode.com/files/xmit_udp_parallel.c\n\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "073862ba5d249c20bd5c49fc6d904ff0e1f6a672", "tree": "e2bfd8ac4565532845a7213ce33ee7abae65530a", "parents": [ "fddb7b5761f104f034a0e708ece756d9b2eb2cac" ], "author": { "name": "Eric Dumazet", "email": "eric.dumazet@gmail.com", "time": "Thu Jan 26 00:41:38 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 26 13:36:19 2012 -0500" }, "message": "netns: fix net_alloc_generic()\n\nWhen a new net namespace is created, we should attach to it a \"struct\nnet_generic\" with enough slots (even empty), or we can hit the following\nBUG_ON() :\n\n[ 200.752016] kernel BUG at include/net/netns/generic.h:40!\n...\n[ 200.752016] [\u003cffffffff825c3cea\u003e] ? get_cfcnfg+0x3a/0x180\n[ 200.752016] [\u003cffffffff821cf0b0\u003e] ? lockdep_rtnl_is_held+0x10/0x20\n[ 200.752016] [\u003cffffffff825c41be\u003e] caif_device_notify+0x2e/0x530\n[ 200.752016] [\u003cffffffff810d61b7\u003e] notifier_call_chain+0x67/0x110\n[ 200.752016] [\u003cffffffff810d67c1\u003e] raw_notifier_call_chain+0x11/0x20\n[ 200.752016] [\u003cffffffff821bae82\u003e] call_netdevice_notifiers+0x32/0x60\n[ 200.752016] [\u003cffffffff821c2b26\u003e] register_netdevice+0x196/0x300\n[ 200.752016] [\u003cffffffff821c2ca9\u003e] register_netdev+0x19/0x30\n[ 200.752016] [\u003cffffffff81c1c67a\u003e] loopback_net_init+0x4a/0xa0\n[ 200.752016] [\u003cffffffff821b5e62\u003e] ops_init+0x42/0x180\n[ 200.752016] [\u003cffffffff821b600b\u003e] setup_net+0x6b/0x100\n[ 200.752016] [\u003cffffffff821b6466\u003e] copy_net_ns+0x86/0x110\n[ 200.752016] [\u003cffffffff810d5789\u003e] create_new_namespaces+0xd9/0x190\n\nnet_alloc_generic() should take into account the maximum index into the\nptr array, as a subsystem might use net_generic() anytime.\n\nThis also reduces number of reallocations in net_assign_generic()\n\nReported-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nTested-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nCc: Sjur Brændeland \u003csjur.brandeland@stericsson.com\u003e\nCc: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nCc: Pavel Emelyanov \u003cxemul@openvz.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fddb7b5761f104f034a0e708ece756d9b2eb2cac", "tree": "f995ec889ebc1edc3fc9d3b0fe1da1fe9c2d6b76", "parents": [ "2b05ad33e1e624e7f08b8676d270dc7725403b7e" ], "author": { "name": "Flavio Leitner", "email": "fbl@redhat.com", "time": "Wed Jan 25 08:34:52 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 21:50:43 2012 -0500" }, "message": "tcp: bind() optimize port allocation\n\nPort autoselection finds a port and then drop the lock,\nthen right after that, gets the hash bucket again and lock it.\n\nFix it to go direct.\n\nSigned-off-by: Flavio Leitner \u003cfbl@redhat.com\u003e\nSigned-off-by: Marcelo Ricardo Leitner \u003cmleitner@redhat.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2b05ad33e1e624e7f08b8676d270dc7725403b7e", "tree": "0f180ef1fa0efcea96738315917eaa014c2ac8f0", "parents": [ "68315801dbf3ab2001679fd2074c9dc5dcf87dfa" ], "author": { "name": "Flavio Leitner", "email": "fbl@redhat.com", "time": "Wed Jan 25 08:34:51 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 25 21:50:43 2012 -0500" }, "message": "tcp: bind() fix autoselection to share ports\n\nThe current code checks for conflicts when the application\nrequests a specific port. If there is no conflict, then\nthe request is granted.\n\nOn the other hand, the port autoselection done by the kernel\nfails when all ports are bound even when there is a port\nwith no conflict available.\n\nThe fix changes port autoselection to check if there is a\nconflict and use it if not.\n\nSigned-off-by: Flavio Leitner \u003cfbl@redhat.com\u003e\nSigned-off-by: Marcelo Ricardo Leitner \u003cmleitner@redhat.com\u003e\nAcked-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" } ], "next": "68315801dbf3ab2001679fd2074c9dc5dcf87dfa" }