- 26 Feb, 2008 18 commits
-
-
Arnaldo Carvalho de Melo authored
Upstream commit: 8cf8e5a6 Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=9825 The inet_diag_lock_handler function uses ERR_PTR to encode errors but its callers were testing against NULL. This only happens when the only inet_diag modular user, DCCP, is not built into the kernel or available as a module. Also there was a problem with not dropping the mutex lock when a handler was not found, also fixed in this patch. This caused an OOPS and ss would then hang on subsequent calls, as &inet_diag_table_mutex was being left locked. Thanks to spike at ml.yaroslavl.ru for report it after trying 'ss -d' on a kernel that doesn't have DCCP available. This bug was introduced in cset d523a328 ("Fix inet_diag dead-lock regression"), after 2.6.24-rc3, so just 2.6.24 seems to be affected. Signed-off-by:
Arnaldo Carvalho de Melo <acme@redhat.com> Acked-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
-
Herbert Xu authored
Upstream commit: 2614fa59 When I moved the nexthdr setting out of IPComp I accidently moved the reading of ipch->nexthdr after the decompression. Unfortunately this means that we'd be reading from a stale ipch pointer which doesn't work very well. This patch moves the reading up so that we get the correct nexthdr value. Signed-off-by:
-
Herbert Xu authored
Upstream commit: b1641064 I made a silly typo by entering IPPROTO_IP (== 0) instead of IPPROTO_IPIP (== 4). This broke the reception of incompressible packets. Signed-off-by:
-
Julian Anastasov authored
Upstream commit: c18865f3 fib_info can be shared by many route prefixes but we don't want duplicate alternative routes for a prefix+tos+priority. Last change was not correct to check fib_treeref because it accounts usage from other prefixes. Additionally, avoid replacement without error if new route is same, as Joonwoo Park suggests. Signed-off-by:
Julian Anastasov <ja@ssi.bg> Signed-off-by:
-
Julian Anastasov authored
Upstream commit: 936f6f8e Update fib_trie with some fib_hash fixes: - check for duplicate alternative routes for prefix+tos+priority when replacing route - properly insert by matching tos together with priority - fix alias walking to use list_for_each_entry_continue for insertion and deletion when fa_head is not NULL - copy state from fa to new_fa on replace (not a problem for now) - additionally, avoid replacement without error if new route is same, as Joonwoo Park suggests. Signed-off-by:
-
Stephen Hemminger authored
Upstream commit: dded9161 if_addrlabel.h is needed for iproute2 usage. Signed-off-by:
Stephen Hemminger <stephen.hemminger@vyatta.com> Signed-off-by:
-
Stephen Hemminger authored
Upstream commit: 268bcca1 Setting up a meta match causes a kernel OOPS because of uninitialized elements in tree. [ 37.322381] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 37.322381] IP: [<ffffffff883fc717>] :em_meta:em_meta_destroy+0x17/0x80 [ 37.322381] Call Trace: [ 37.322381] [<ffffffff803ec83d>] tcf_em_tree_destroy+0x2d/0xa0 [ 37.322381] [<ffffffff803ecc8c>] tcf_em_tree_validate+0x2dc/0x4a0 [ 37.322381] [<ffffffff803f06d2>] nla_parse+0x92/0xe0 [ 37.322381] [<ffffffff883f9672>] :cls_basic:basic_change+0x202/0x3c0 [ 37.322381] [<ffffffff802a3917>] kmem_cache_alloc+0x67/0xa0 [ 37.322381] [<ffffffff803ea221>] tc_ctl_tfilter+0x3b1/0x580 [ 37.322381] [<ffffffff803dffd0>] rtnetlink_rcv_msg+0x0/0x260 [ 37.322381] [<ffffffff803ee944>] netlink_rcv_skb+0x74/0xa0 [ 37.322381] [<ffffffff803dffc8>] rtnetlink_rcv+0x18/0x20 [ 37.322381] [<ffffffff803ee6c3>] netlink_unicast+0x263/0x290 [ 37.322381] [<ffffffff803cf276>] __alloc_skb+0x96/0x160 [ 37.322381] [<ffffffff803ef014>] netlink_sendmsg+0x274/0x340 [ 37.322381] [<ffffffff803c7c3b>] sock_sendmsg+0x12b/0x140 [ 37.322381] [<ffffffff8024de90>] autoremove_wake_function+0x0/0x30 [ 37.322381] [<ffffffff8024de90>] autoremove_wake_function+0x0/0x30 [ 37.322381] [<ffffffff803c7c3b>] sock_sendmsg+0x12b/0x140 [ 37.322381] [<ffffffff80288611>] zone_statistics+0xb1/0xc0 [ 37.322381] [<ffffffff803c7e5e>] sys_sendmsg+0x20e/0x360 [ 37.322381] [<ffffffff803c7411>] sockfd_lookup_light+0x41/0x80 [ 37.322381] [<ffffffff8028d04b>] handle_mm_fault+0x3eb/0x7f0 [ 37.322381] [<ffffffff8020c2fb>] system_call_after_swapgs+0x7b/0x80 Signed-off-by:
Stephen Hemminger <shemminger@vyatta.com> Signed-off-by:
-
Paul Moore authored
Upstream commit: e1770d97 As pointed out by Adrian Bunk, commit 45c950e0 ("fix memory leak in netlabel code") caused a double-free when security_netlbl_sid_to_secattr() fails. This patch fixes this by removing the netlbl_secattr_destroy() call from that function since we are already releasing the secattr memory in selinux_netlbl_sock_setsid(). Signed-off-by:
Paul Moore <paul.moore@hp.com> Signed-off-by:
-
Stephen Hemminger authored
Upstream commit: 04f217ac If userspace passes a unknown match index into em_meta, then em_meta_change will return an error and the data for the match will not be set. This then causes an null pointer dereference when the cleanup is done in the error path via tcf_em_tree_destroy. Since the tree structure comes kzalloc, it is initialized to NULL. Discovered when testing a new version of tc command against an accidental older kernel. Signed-off-by:
-
Shan Wei authored
Upstream commit: 16ca3f91 In strategy_allowed_congestion_control of the 2.6.24 kernel, when sysctl_string return 1 on success,it should call tcp_set_allowed_congestion_control to set the allowed congestion control.But, it don't. the sysctl_string return 1 on success, otherwise return negative, never return 0.The patch fix the problem. Signed-off-by:
Shan Wei <shanwei@cn.fujitsu.com> Acked-by:
-
James Bottomley authored
patch 366c246d in mainline. Some devices report medium error locations incorrectly. Add guards to make sure the reported bad lba is actually in the request that caused it. Additionally remove the large case statment for sector sizes and replace it with the proper u64 divisions. Tested-by:
Mike Snitzer <snitzer@gmail.com> Cc: Stable Tree <stable@kernel.org> Cc: Tony Battersby <tonyb@cybernetics.com> Signed-off-by:
James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by:
-
Al Viro authored
patch 9c52fab2 in mainline. The MSSR constants didn't match the reality - bitfield declarations used to be correct (1000BT_FD - bit 11, 1000BT_HD - bit 10), but enum had them the other way round. Went unnoticed until the switch from the bitfields use to the explicit arithmetics and I hadn't caught that one when verifying correctness of change... Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by:
-
David Chinner authored
patch 450790a2 in mainline. Several occurrences of oops in xfs_file_readdir() on ia32 have been reported since 2.6.24 was released. This is a regression introduced in 2.6.24 and is relatively easy to hit. The patch below fixes the problem. Signed-off-by:
Dave Chinner <dgc@sgi.com> Signed-off-by:
Lachlan McIlroy <lachlan@sgi.com> Signed-off-by:
-
Nishanth Aravamudan authored
patch a3d0c6aa in mainline. When I replaced hugetlb_dynamic_pool with nr_overcommit_hugepages I used proc_doulongvec_minmax() directly. However, hugetlb.c's locking rules require that all counter modifications occur under the hugetlb_lock. Add a callback into the hugetlb code similar to the one for nr_hugepages. Grab the lock around the manipulation of nr_overcommit_hugepages in proc_doulongvec_minmax(). Signed-off-by:
Nishanth Aravamudan <nacc@us.ibm.com> Acked-by:
Adam Litke <agl@us.ibm.com> Cc: David Gibson <david@gibson.dropbear.id.au> Cc: William Lee Irwin III <wli@holomorphy.com> Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
-
Ulisses Furquim authored
patch ac74c00e in mainline. As the IN_ONESHOT bit is never set when an event is sent we must check it in the watch's mask and not in the event's mask. Signed-off-by:
Ulisses Furquim <ulissesf@gmail.com> Reported-by:
"Clem Taylor" <clem.taylor@gmail.com> Tested-by:
-
Trond Myklebust authored
patch 5d47a356 in mainline. If the inode is flagged as having an invalid mapping, then we can't rely on the PageUptodate() flag. Ensure that we don't use the "anti-fragmentation" write optimisation in nfs_updatepage(), since that will cause NFS to write out areas of the page that are no longer guaranteed to be up to date. A potential corruption could occur in the following scenario: client 1 client 2 =============== =============== fd=open("f",O_CREAT|O_WRONLY,0644); write(fd,"fubar\n",6); // cache last page close(fd); fd=open("f",O_WRONLY|O_APPEND); write(fd,"foo\n",4); close(fd); fd=open("f",O_WRONLY|O_APPEND); write(fd,"bar\n",4); close(fd); ----- The bug may lead to the file "f" reading 'fubar\n\0\0\0\nbar\n' because client 2 does not update the cached page after re-opening the file for write. Instead it keeps it marked as PageUptodate() until someone calls invalidate_inode_pages2() (typically by calling read()). The bug was introduced by commit 44b11874 "NFS: Separate metadata and page cache revalidation mechanisms" Signed-off-by:
Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by:
-
Jozsef Kadlecsik authored
[NETFILTER]: nf_conntrack_tcp: conntrack reopening fix [Upstream commits b2155e7f + d0c1fd7a ] TCP connection tracking in netfilter did not handle TCP reopening properly: active close was taken into account for one side only and not for any side, which is fixed now. The patch includes more comments to explain the logic how the different cases are handled. The bug was discovered by Jeff Chua. Signed-off-by:
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
-
David Miller authored
[SPARC/SPARC64]: Fix usage of .section .sched.text in assembler code. Upstream commit: c6d64c16 ld will generate an unique named section when assembler do not use "ax" but gcc does. Add the missing annotation. Signed-off-by:
Sam Ravnborg <sam@ravnborg.org> Signed-off-by:
-
- 11 Feb, 2008 2 commits
-
-
Greg Kroah-Hartman authored
-
Bastian Blank authored
patch 712a30e6 in mainline. Commit 8811930d ("splice: missing user pointer access verification") added the proper access_ok() calls to copy_from_user_mmap_sem() which ensures we can copy the struct iovecs from userspace to the kernel. But we also must check whether we can access the actual memory region pointed to by the struct iovec to fix the access checks properly. Signed-off-by:
Bastian Blank <waldi@debian.org> Acked-by:
Oliver Pinter <oliver.pntr@gmail.com> Cc: Jens Axboe <jens.axboe@oracle.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by:
-
- 08 Feb, 2008 20 commits
-
-
Greg Kroah-Hartman authored
-
Jens Axboe authored
patch 8811930d in mainline. vmsplice_to_user() must always check the user pointer and length with access_ok() before copying. Likewise, for the slow path of copy_from_user_mmap_sem() we need to check that we may read from the user region. Signed-off-by:
Jens Axboe <jens.axboe@oracle.com> Cc: Wojciech Purczynski <cliph@research.coseinc.com> Signed-off-by:
-
Dave Airlie authored
(submitted upstream as 19a8f59a ) perhaps bonghits could turn on my bus-mastering because the drm certainly never bothered doing it before. Signed-off-by:
Dave Airlie <airlied@linux.ie> Signed-off-by:
-
Michael E Brown authored
patch 7d640c4a in mainline. This reverts commit 109f0e93 . The original patch breaks BIOS updates on all Dell machines. The path to the firmware file for the dell_rbu driver changes, which breaks all of the userspace tools which rely on it. Note that this patch re-introduces a problem with i2c name collision that was previously fixed by this patch. Signed-off-by:
Michael E Brown <michael_e_brown@dell.com> Signed-off-by:
-
Nick Piggin authored
patch 124d3b70 in mainline. Frederik Himpe reported an unkillable and un-straceable pan process. Zero length iovecs can go into an infinite loop in writev, because the iovec iterator does not always advance over them. The sequence required to trigger this is not trivial. I think it requires that a zero-length iovec be followed by a non-zero-length iovec which causes a pagefault in the atomic usercopy. This causes the writev code to drop back into single-segment copy mode, which then tries to copy the 0 bytes of the zero-length iovec; a zero length copy looks like a failure though, so it loops. Put a test into iov_iter_advance to catch zero-length iovecs. We could just put the test in the fallback path, but I feel it is more robust to skip over zero-length iovecs throughout the code (iovec iterator may be used in filesystems too, so it should be robust). Signed-off-by:
Nick Piggin <npiggin@suse.de> Signed-off-by:
Ingo Molnar <mingo@elte.hu> Signed-off-by:
-
Srivatsa Vaddagiri authored
patch 296825cb in mainline. The reason why we are getting better wakeup latencies for !FAIR_USER_SCHED is because of this snippet of code in place_entity(): if (!initial) { /* sleeps upto a single latency don't count. */ if (sched_feat(NEW_FAIR_SLEEPERS) && entity_is_task(se)) ^^^^^^^^^^^^^^^^^^ vruntime -= sysctl_sched_latency; /* ensure we never gain time by being placed backwards. */ vruntime = max_vruntime(se->vruntime, vruntime); } NEW_FAIR_SLEEPERS feature gives credit for sleeping only to tasks and not group-level entities. With the patch attached, I could see that wakeup latencies with FAIR_USER_SCHED are restored to the same level as !FAIR_USER_SCHED. Signed-off-by:
-
Peter Zijlstra authored
patch ef9884e6 in mainline. Michel Dänzr has bisected an interactivity problem with plus-reniced tasks back to this commit: 810e95cc is first bad commit commit 810e95cc Author: Peter Zijlstra <a.p.zijlstra@chello.nl> Date: Mon Oct 15 17:00:14 2007 +0200 sched: another wakeup_granularity fix unit mis-match: wakeup_gran was used against a vruntime fix this by assymetrically scaling the vtime of positive reniced tasks. Bisected-by:
Michel Dänzer <michel@tungstengraphics.com> Signed-off-by:
Peter Zijlstra <a.p.zijlstra@chello.nl> Signed-off-by:
-
Michael Buesch authored
(not in mainline, as it is not applicable.) We must reject new incompatible firmware early to avoid running into strange transmission failures. The current development tree supports newer firmware revisions. These revisions cause strange failures on the stable 2.6.24 kernel. Add a check to avoid confusing users a lot. Signed-off-by:
Michael Buesch <mb@bu3sch.de> Signed-off-by:
-
Stephen Smalley authored
patch b1aa5301 in mainline. The proc net rewrite had a side effect on selinux, leading it to mislabel the /proc/net inodes, thereby leading to incorrect denials. Fix security_genfs_sid to ignore extra leading / characters in the path supplied by selinux_proc_get_sid since we now get "//net/..." rather than "/net/...". Signed-off-by:
Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by:
James Morris <jmorris@namei.org> Signed-off-by:
-
Stefano Brivio authored
patch 8dd0100c in mainline. This fixes four resource leakages. In any error path we must deallocate the DMA frame slots we previously allocated by request_slot(). This is done by storing the ring pointers before doing any ring allocation and restoring the old pointers in case of an error. This patch by Michael Buesch has been ported to b43legacy. Cc: Michael Buesch <mb@bu3sch.de> Signed-off-by:
Stefano Brivio <stefano.brivio@polimi.it> Signed-off-by:
John W. Linville <linville@tuxdriver.com> Signed-off-by:
-
Stefano Brivio authored
patch 9eca9a8e in mainline. We must drop any packets we are not able to encrypt. We must not send them unencrypted or with an all-zero-key (which basically is the same as unencrypted, from a security point of view). This might only trigger shortly after resume before mac80211 reassociated and reconfigured the keys. It is safe to drop these packets, as the association they belong to is not guaranteed anymore anyway. This is a security fix in the sense that it prevents information leakage. This patch by Michael Buesch has been ported to b43legacy. Cc: Michael Buesch <mb@bu3sch.de> Signed-off-by:
-
Stefano Brivio authored
patch ada50731 in mainline. This patch makes suspend/resume work with the b43legacy driver. We must not overwrite the MAC addresses in the init function, as this would also overwrite the MAC on resume. With an all-zero MAC the device firmware is not able to ACK any received packets anymore. Fix this by moving the initializion stuff that must be done on init but not on resume to the start function. Also zero out filter_flags to make sure we don't have some flags from a previous instance for a tiny timeframe until mac80211 reconfigures them. This patch by Michael Buesch has been ported to b43legacy. Cc: Michael Buesch <mb@bu3sch.de> Signed-off-by:
-
Stefano Brivio authored
patch 0cd67d48 in mainline. Fix the crash reported below, which seems to happen on bcm4306 rev. 2 devices only while using PIO: Oops: 0000 [#1] PREEMPT Modules linked in: b43(F) rfkill(F) led_class(F) input_polldev(F) arc4 b43legacy mac80211 cfg80211 i915 drm snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device ohci1394 ieee1394 ssb pcmcia snd_intel8x0m ehci_hcd uhci_hcd evdev Pid: 0, comm: swapper Tainted: GF (2.6.24st3 #2) EIP: 0060:[<f90f667b>] EFLAGS: 00010002 CPU: 0 EIP is at b43legacy_pio_handle_txstatus+0xbb/0x210 [b43legacy] EAX: 0000049b EBX: f11f8044 ECX: 00000001 EDX: 00000000 ESI: f1ff8000 EDI: 00000000 EBP: f11f8040 ESP: c04f4ef4 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process swapper (pid: 0, ti=c04f4000 task=c0488300 task.ti=c04b8000) Stack: f90f2788 c05009f0 c0500900 000010f7 f1053823 c04f4f24 dfb8e800 00000003 f1368000 00000007 00000296 f90f1975 00001000 010c0800 01000000 00000007 f90f6391 f11f8000 00000082 c04f4f4a 00000000 00004fd0 10f70000 8c061000 Call Trace: [<f90f2788>] b43legacy_debugfs_log_txstat+0x48/0xb0 [b43legacy] [<f90f1975>] b43legacy_handle_hwtxstatus+0x75/0x80 [b43legacy] [<f90f6391>] b43legacy_pio_rx+0x201/0x280 [b43legacy] [<f90e4fa3>] b43legacy_interrupt_tasklet+0x2e3/0x870 [b43legacy] [<c0123567>] tasklet_action+0x27/0x60 [<c01237b4>] __do_softirq+0x54/0xb0 [<c010686b>] do_softirq+0x7b/0xe0 [<c01457c0>] handle_level_irq+0x0/0x110 [<c01457c0>] handle_level_irq+0x0/0x110 [<c0123758>] irq_exit+0x38/0x40 [<c0106953>] do_IRQ+0x83/0xd0 [<c011812f>] __update_rq_clock+0x4f/0x180 [<c0104b4f>] common_interrupt+0x23/0x28 [<c011007b>] wakeup_code+0x7b/0xde [<c02b1039>] acpi_processor_idle+0x24a/0x3c9 [<c01025c7>] cpu_idle+0x47/0x80 [<c04b9ad5>] start_kernel+0x205/0x290 [<c04b9360>] unknown_bootoption+0x0/0x1f0 ======================= Code: 0f 00 00 81 fb ff 00 00 00 0f 87 36 01 00 00 8d 04 db 85 ff 8d 6c c6 40 8d 5d 04 0f 85 ef 00 00 00 fe 4e 0e 0f b7 46 0c 8b 53 04 <8b> 4a 50 29 c8 83 e8 52 66 89 46 0c 8b 54 24 14 80 7a 0b 00 74 EIP: [<f90f667b>] b43legacy_pio_handle_txstatus+0xbb/0x210 [b43legacy] SS:ESP 0068:c04f4ef4 Kernel panic - not syncing: Fatal exception in interrupt Signed-off-by:
-
Michael Buesch authored
patch 8dd0100c in mainline. This fixes four resource leakages. In any error path we must deallocate the DMA frame slots we previously allocated by request_slot(). This is done by storing the ring pointers before doing any ring allocation and restoring the old pointers in case of an error. Signed-off-by:
-
Michael Buesch authored
patch 09552ccd in mainline We must drop any packets we are not able to encrypt. We must not send them unencrypted or with an all-zero-key (which basically is the same as unencrypted, from a security point of view). This might only trigger shortly after resume before mac80211 reassociated and reconfigured the keys. It is safe to drop these packets, as the association they belong to is not guaranteed anymore anyway. This is a security fix in the sense that it prevents information leakage. Signed-off-by:
-
Michael Buesch authored
patch 7be1bb6b in mainline. This patch makes suspend/resume work with the b43 driver. We must not overwrite the MAC addresses in the init function, as this would also overwrite the MAC on resume. With an all-zero MAC the device firmware is not able to ACK any received packets anymore. Fix this by moving the initializion stuff that must be done on init but not on resume to the start function. Also zero out filter_flags to make sure we don't have some flags from a previous instance for a tiny timeframe until mac80211 reconfigures them. Signed-off-by:
-
Stephen Hemminger authored
patch 82637e80 in mainline This patch disables config mode access after clearing PCI settings. Without this change WOL won't work on some BIOS's Signed-off-by:
Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by:
-
Stephen Hemminger authored
patch a7bffe72 in mainline. If the sky2 deadman timer forces a recovery, the multicast hash list is lost. Move the call to sky2_set_multicast to the end of sky2_up() so all paths that bring device up will restore multicast. Signed-off-by:
-
Sam Ravnborg authored
patch 3a900d89 in mainline The apm module were renamed to apm_32 during the merge of 32 and 64 bit x86 which is unfortunate. As apm is 32 bit specific we like to keep the _32 in the filename but the module should be named apm. Fix this in the Makefile. Reported-by:
"A.E.Lawrence" <lawrence_a_e@ntlworld.com> Signed-off-by:
Thomas Gleixner <tglx@linutronix.de> Signed-off-by:
-
Len Brown authored
These minor changes sync the latest ACPI blacklist into 2.6.24. The main benefit of this patch is to make any future changes easier to apply. The immediate benefit is one less dmesg line on Acer systems. Signed-off-by:
Len Brown <len.brown@intel.com> Signed-off-by:
-
