1. 23 Nov, 2012 3 commits
  2. 22 Nov, 2012 3 commits
  3. 21 Nov, 2012 19 commits
    • Florian Westphal's avatar
      netfilter: cttimeout: fix buffer overflow · e93b5f9f
      Florian Westphal authored
      Chen Gang reports:
      the length of nla_data(cda[CTA_TIMEOUT_NAME]) is not limited in server side.
      
      And indeed, its used to strcpy to a fixed-sized buffer.
      
      Fortunately, nfnetlink users need CAP_NET_ADMIN.
      Reported-by: default avatarChen Gang <gang.chen@asianux.com>
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      e93b5f9f
    • Jozsef Kadlecsik's avatar
      netfilter: ipset: Fix range bug in hash:ip,port,net · 4fe198e6
      Jozsef Kadlecsik authored
      Due to the missing ininitalization at adding/deleting entries, when
      a plain_ip,port,net element was the object, multiple elements were
      added/deleted instead. The bug came from the missing dangling
      default initialization.
      
      The error-prone default initialization is corrected in all hash:* types.
      Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      4fe198e6
    • Dave Hansen's avatar
      fix incorrect NR_FREE_PAGES accounting (appears like memory leak) · ef6c5be6
      Dave Hansen authored
      There have been some 3.7-rc reports of vm issues, including some kswapd
      bugs and, more importantly, some memory "leaks":
      
      	http://www.spinics.net/lists/linux-mm/msg46187.html
      	https://bugzilla.kernel.org/show_bug.cgi?id=50181
      
      Commit 1fb3f8ca ("mm: compaction: capture a suitable high-order page
      immediately when it is made available") took split_free_page() and
      reused it for the compaction code.  It does something curious with
      capture_free_page() (previously known as split_free_page()):
      
        int capture_free_page(struct page *page, int alloc_order,
        ...
                __mod_zone_page_state(zone, NR_FREE_PAGES, -(1UL << order));
      
        -       /* Split into individual pages */
        -       set_page_refcounted(page);
        -       split_page(page, order);
        +       if (alloc_order != order)
        +               expand(zone, page, alloc_order, order,
        +                       &zone->free_area[order], migratetype);
      
      Note that expand() puts the pages _back_ in the allocator, but it does
      not bump NR_FREE_PAGES.  We "return" 'alloc_order' worth of pages, but
      we accounted for removing 'order' in the __mod_zone_page_state() call.
      
      For the old split_page()-style use (order==alloc_order) the bug will not
      trigger.  But, when called from the compaction code where we
      occasionally get a larger page out of the buddy allocator than we need,
      we will run in to this.
      
      This patch simply changes the NR_FREE_PAGES manipulation to the correct
      'alloc_order' instead of 'order'.
      
      I've been able to repeatedly trigger this in my testing environment.
      The amount "leaked" very closely tracks the imbalance I see in buddy
      pages vs.  NR_FREE_PAGES.  I have confirmed that this patch fixes the
      imbalance
      Signed-off-by: default avatarDave Hansen <dave@linux.vnet.ibm.com>
      Acked-by: default avatarMel Gorman <mgorman@suse.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ef6c5be6
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · db9d8c60
      Linus Torvalds authored
      Pull networking updates from David Miller:
      
       1) inet6_csk_update_pmtu() must return NULL or non-NULL, so translate
          ERR_PTR to NULL, as needed.  Fix from Eric Dumazet.
      
       2) Fix copy&paste error in IRDA sir_dev ->set_speed method invocation,
          it was testing the NULL'ness of a different method to guard the
          call.  Fix from Alexander Shiyan.
      
       3) Fix build regression of xilinx driver, from Jeff Mahoney.
      
       4) Make XEN netfront (like XEN netback) handle compound pages in SKBs
          properly.  From Ian Campbell.
      
       5) Fix inverted logic of team_dev_queue_xmit() return value checks,
          from Jiri Pirko and Dan Carpenter.
      
       6) dma_poll_create() no longer allows a NULL device argument, breaking
          both ixp4xx drivers.  Fix from Xi Wang.
      
       7) ne2000 driver doesn't hook up the parent device properly, breaking
          udev matching.  Fix from Alan Cox.
      
       8) Locking and memory leak fixes in Near Field Communications layer.
          From Thierry Escande, Szymon Janc, and Waldemar Rymarkiewicz.
      
       9) sis900 resume regression, sis900_set_mode() is being called with the
          iomem pointer instead of the expected device private.  Fix from
          Francois Romieu.
      
      10) Fix IBSS regression caused by uninitializing the ibss-internals
          before performing an emptyness check, from Simon WUnderlich.
      
      11) Fix SNIFFER mode regression in iwlwifi driver, from Johannes Berg.
      
      12) Fix task wedges in mwifiex_cmd_timeout_func(), from Bing Zhao.
      
      13) Add back wireless sysfs directory, too much stuff depends upon it
          being there (actually I'd say it never should have been removed to
          begin with).  From Johannes Berg.
      
      14) Fix hang introduced by suspend/resume changes in ath9k.  Fix from
          Sujith Manoharan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (24 commits)
        team: bcast: convert return value of team_dev_queue_xmit() to bool correctly
        bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices.
        xen/netfront: handle compound page fragments on transmit
        net: fix build failure in xilinx
        irda: sir_dev: Fix copy/paste typo
        ipv6: fix inet6_csk_update_pmtu() return value
        ixp4xx_hss: avoid calling dma_pool_create() with NULL dev
        ixp4xx_eth: avoid calling dma_pool_create() with NULL dev
        ne2000: add the right platform device
        of/net/mdio-gpio: Fix pdev->id issue when using devicetrees.
        NFC: Fix pn533 target mode memory leak
        NFC: pn533: Fix mem leak in pn533_in_dep_link_up
        NFC: pn533: Fix use after free
        NFC: pn533: Fix missing lock while operating on commands list
        NFC: Fix nfc_llcp_local chained list insertion
        ath9k_hw: Fix regression in device reset
        sis900: fix sis900_set_mode call parameters.
        iwlwifi: don't WARN when a non empty queue is disabled
        wireless: add back sysfs directory
        mwifiex: report error to MMC core if we cannot suspend
        ...
      db9d8c60
    • Jiri Pirko's avatar
      team: bcast: convert return value of team_dev_queue_xmit() to bool correctly · 403f43c9
      Jiri Pirko authored
      The thing is that team_dev_queue_xmit() returns NET_XMIT_* or -E*.
      bc_trasmit() should return true in case all went well. So use ! to get
      correct retval from team_dev_queue_xmit() result.
      This bug caused iface statistics to be badly computed.
      
      This bug was introduced by:
      team: add broadcast mode (5fc88991)
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarJiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      403f43c9
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-for-v3.7-late' of... · 45e77159
      Linus Torvalds authored
      Merge tag 'pinctrl-for-v3.7-late' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
      
      Pull pinctrl fix from Linus Walleij:
       "A simple pinctrl Kconfig oneliner arriving late.
      
        Final (hopefully) oneliner for the pinctrl subsystem targeted at v3.7"
      
      * tag 'pinctrl-for-v3.7-late' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl/samsung: don't allow enabling pinctrl-samsung standalone
      45e77159
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security · 85c0805a
      Linus Torvalds authored
      Pull selinux RCU fixlet from James Morris.
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
        selinux: fix sel_netnode_insert() suspicious rcu dereference
      85c0805a
    • Chun-Yi Lee's avatar
      sign-file: fix the perl warning message when extracting ASN.1 · 916492b1
      Chun-Yi Lee authored
      There have the following warning message when running modules install
      for sign ko files:
      
        # make modules_install
        ...
          INSTALL drivers/input/touchscreen/pcap_ts.ko
        Found = in conditional, should be == at scripts/sign-file line 164.
        Found = in conditional, should be == at scripts/sign-file line 161.
        Found = in conditional, should be == at scripts/sign-file line 159.
      
      This patch change replace '=' by '==' in elsif conditions for avoid the
      above warning messages.
      Signed-off-by: default avatarChun-Yi Lee <jlee@suse.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      916492b1
    • Sarveshwar Bandi's avatar
      bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices. · 0e376bd0
      Sarveshwar Bandi authored
      Patch sets the lowest gso_max_size and gso_max_segs values of the slave devices during enslave and detach.
      Signed-off-by: default avatarSarveshwar Bandi <sarveshwar.bandi@emulex.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0e376bd0
    • Ian Campbell's avatar
      xen/netfront: handle compound page fragments on transmit · f36c3747
      Ian Campbell authored
      An SKB paged fragment can consist of a compound page with order > 0.
      However the netchannel protocol deals only in PAGE_SIZE frames.
      
      Handle this in xennet_make_frags by iterating over the frames which
      make up the page.
      
      This is the netfront equivalent to 6a8ed462 for netback.
      Signed-off-by: default avatarIan Campbell <ian.campbell@citrix.com>
      Cc: netdev@vger.kernel.org
      Cc: xen-devel@lists.xen.org
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Konrad Rzeszutek Wilk <konrad@kernel.org>
      Cc: ANNIE LI <annie.li@oracle.com>
      Cc: Sander Eikelenboom <linux@eikelenboom.it>
      Cc: Stefan Bader <stefan.bader@canonical.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f36c3747
    • John W. Linville's avatar
      Merge branch 'master' of... · f30a9443
      John W. Linville authored
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
      
      John W. Linville says:
      
      ====================
      This is a batch of fixes intended for 3.7...
      
      Included are two pulls.  Regarding the mac80211 tree, Johannes says:
      
      "Please pull my mac80211.git tree (see below) to get two more fixes for
      3.7. Both fix regressions introduced *before* this cycle that weren't
      noticed until now, one for IBSS not cleaning up properly and the other
      to add back the "wireless" sysfs directory for Fedora's startup scripts."
      
      Regarding the iwlwifi tree, Johannes says:
      
      "Please also pull my iwlwifi.git tree, I have two fixes: one to remove a
      spurious warning that can actually trigger in legitimate situations, and
      the other to fix a regression from when monitor mode was changed to use
      the "sniffer" firmware mode."
      
      Also included is an nfc tree pull.  Samuel says:
      
      "We mostly have pn533 fixes here, 2 memory leaks and an early unlocking fix.
      Moreover, we also have an LLCP adapter linked list insertion fix."
      
      On top of that, a few more bits...  Albert Pool adds a USB ID
      to rtlwifi.  Bing Zhao provides two mwifiex fixes -- one to fix
      a system hang during a command timeout, and the other to properly
      report a suspend error to the MMC core.  Finally, Sujith Manoharan
      fixes a thinko that would trigger an ath9k hang during device reset.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f30a9443
    • Dave Jones's avatar
      selinux: fix sel_netnode_insert() suspicious rcu dereference · 88a693b5
      Dave Jones authored
      ===============================
      [ INFO: suspicious RCU usage. ]
      3.5.0-rc1+ #63 Not tainted
      -------------------------------
      security/selinux/netnode.c:178 suspicious rcu_dereference_check() usage!
      
      other info that might help us debug this:
      
      rcu_scheduler_active = 1, debug_locks = 0
      1 lock held by trinity-child1/8750:
       #0:  (sel_netnode_lock){+.....}, at: [<ffffffff812d8f8a>] sel_netnode_sid+0x16a/0x3e0
      
      stack backtrace:
      Pid: 8750, comm: trinity-child1 Not tainted 3.5.0-rc1+ #63
      Call Trace:
       [<ffffffff810cec2d>] lockdep_rcu_suspicious+0xfd/0x130
       [<ffffffff812d91d1>] sel_netnode_sid+0x3b1/0x3e0
       [<ffffffff812d8e20>] ? sel_netnode_find+0x1a0/0x1a0
       [<ffffffff812d24a6>] selinux_socket_bind+0xf6/0x2c0
       [<ffffffff810cd1dd>] ? trace_hardirqs_off+0xd/0x10
       [<ffffffff810cdb55>] ? lock_release_holdtime.part.9+0x15/0x1a0
       [<ffffffff81093841>] ? lock_hrtimer_base+0x31/0x60
       [<ffffffff812c9536>] security_socket_bind+0x16/0x20
       [<ffffffff815550ca>] sys_bind+0x7a/0x100
       [<ffffffff816c03d5>] ? sysret_check+0x22/0x5d
       [<ffffffff810d392d>] ? trace_hardirqs_on_caller+0x10d/0x1a0
       [<ffffffff8133b09e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
       [<ffffffff816c03a9>] system_call_fastpath+0x16/0x1b
      
      This patch below does what Paul McKenney suggested in the previous thread.
      Signed-off-by: default avatarDave Jones <davej@redhat.com>
      Reviewed-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Acked-by: default avatarPaul Moore <paul@paul-moore.com>
      Cc: Eric Paris <eparis@parisplace.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
      88a693b5
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · 99b6e1e7
      Linus Torvalds authored
      Pull missed powerpc fixes from Benjamin Herrenschmidt:
       "Here are small 52xx fixes that Anatolij asked me to pull a while back
        and that I completely missed.  The stuff is local to that platform
        code, and was in next for a while, so it should still go into 3.7."
      
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
        powerpc/mpc5200: move lpbfifo node and fix its interrupt property
        powerpc: 52xx: nop out unsupported critical IRQs
        powerpc/pcm030: add pcm030-audio-fabric to dts
      99b6e1e7
    • Linus Torvalds's avatar
      Merge tag 'stable/for-linus-3.7-rc6-tag' of... · 74dcc3f9
      Linus Torvalds authored
      Merge tag 'stable/for-linus-3.7-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen
      
      Pull Xen bug-fix from Konrad Rzeszutek Wilk:
       - Fix regression introduced by commit ceb90fa0 ("xen/privcmd: add
         PRIVCMD_MMAPBATCH_V2 ioctl").
      
      * tag 'stable/for-linus-3.7-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
        xen/privcmd: Correctly return success from IOCTL_PRIVCMD_MMAPBATCH
      74dcc3f9
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/virt/kvm/kvm · 87885b70
      Linus Torvalds authored
      Pull KVM maintainership update from Avi Kivity:
       "After many years of maintaining KVM, I am moving on.  It was a real
        pleasure for me to work with so many talented and dedicated hackers on
        this project.
      
        Replacing me will be one of those talented and dedicated hackers,
        Gleb, who has authored hundreds of patches in and around KVM."
      
      * git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: taking co-maintenance
        KVM: Retire as maintainer
      87885b70
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v3.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · c60b6896
      Linus Torvalds authored
      Pull IOMMU fixes from Joerg Roedel:
       "Some fixes and a MAINTAINERS update to remove my lost AMD email
        address from the file.  The fixes take care of a resource leak and a
        problem on VT-d with the new IOMMU group code."
      
      * tag 'iommu-fixes-v3.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        intel-iommu: Fix lookup in add device
        iommu/tegra-smmu.c: fix dentry reference leak in smmu_debugfs_stats_show().
        iommu/amd: Update MAINTAINERS entry
      c60b6896
    • Linus Torvalds's avatar
      Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · ca6215df
      Linus Torvalds authored
      Pull reiserfs and ext3 fixes from Jan Kara:
       "Fixes of reiserfs deadlocks when quotas are enabled (locking there was
        completely busted by BKL conversion) and also one small ext3 fix in
        the trim interface."
      
      * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        ext3: Avoid underflow of in ext3_trim_fs()
        reiserfs: Move quota calls out of write lock
        reiserfs: Protect reiserfs_quota_write() with write lock
        reiserfs: Protect reiserfs_quota_on() with write lock
        reiserfs: Fix lock ordering during remount
      ca6215df
    • Mats Petersson's avatar
      xen/privcmd: Correctly return success from IOCTL_PRIVCMD_MMAPBATCH · 68fa965d
      Mats Petersson authored
      This is a regression introduced by ceb90fa0 (xen/privcmd: add
      PRIVCMD_MMAPBATCH_V2 ioctl).  It broke xentrace as it used
      xc_map_foreign() instead of xc_map_foreign_bulk().
      
      Most code-paths prefer the MMAPBATCH_V2, so this wasn't very obvious
      that it broke. The return value is set early on to -EINVAL, and if all
      goes well, the "set top bits of the MFN's" never gets called, so the
      return value is still EINVAL when the function gets to the end, causing
      the caller to think it went wrong (which it didn't!)
      
      Now also including Andres "move the ret = -EINVAL into the error handling
      path, as this avoids other similar errors in future.
      Signed-off-by: default avatarMats Petersson <mats.petersson@citrix.com>
      Acked-by: default avatarAndres Lagar-Cavilla <andres@lagarcavilla.org>
      Acked-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
      Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      68fa965d
    • Benjamin Herrenschmidt's avatar
      Merge remote-tracking branch 'agust/merge' into merge · d6dc2461
      Benjamin Herrenschmidt authored
      Anatolij 52xx updates:
      
      Patch for pcm030 device tree fixing the probe() in pcm030-audio-fabric
      driver. Changes to this driver have been merged in 3.7-rc1 via ASoC
      tree, but this required device tree patch was submitted separately to
      the linux-ppc list and is still missing in mainline. Without this patch
      the probe() in pcm030-audio-fabric driver wrongly returns -ENODEV.
      
      A patch from Wolfram fixing wrong invalid critical irq warnings for
      all mpc5200 boards.
      
      Another patch for all mpc5200 device trees fixing wrong L1 cell in
      the LPB FIFO interrupt property and moving the LPB FIFO node to the
      common mpc5200b.dtsi file so that this common node will be present
      in all mpc5200 device trees.
      d6dc2461
  4. 20 Nov, 2012 9 commits
  5. 19 Nov, 2012 6 commits