* [33/49] [SCSI] bfa: fix system crash when reading sysfs fc_host statistics
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
@ 2011-01-05 23:00 ` Greg KH
2011-01-05 23:00 ` [34/49] igb: only use vlan_gro_receive if vlans are registered Greg KH
` (15 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:00 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Krishna Gudipati,
James Bottomley
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Krishna Gudipati <kgudipat@brocade.com>
commit 7873ca4e4401f0ecd8868bf1543113467e6bae61 upstream.
The port data structure related to fc_host statistics collection is
not initialized. This causes system crash when reading the fc_host
statistics. The fix is to initialize port structure during driver
attach.
Signed-off-by: Krishna Gudipati <kgudipat@brocade.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/scsi/bfa/bfa_core.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/drivers/scsi/bfa/bfa_core.c
+++ b/drivers/scsi/bfa/bfa_core.c
@@ -84,11 +84,32 @@ bfa_cfg_get_meminfo(struct bfa_iocfc_cfg
for (i = 0; hal_mods[i]; i++)
hal_mods[i]->meminfo(cfg, &km_len, &dm_len);
+ dm_len += bfa_port_meminfo();
meminfo->meminfo[BFA_MEM_TYPE_KVA - 1].mem_len = km_len;
meminfo->meminfo[BFA_MEM_TYPE_DMA - 1].mem_len = dm_len;
}
+static void
+bfa_com_port_attach(struct bfa_s *bfa, struct bfa_meminfo_s *mi)
+{
+ struct bfa_port_s *port = &bfa->modules.port;
+ uint32_t dm_len;
+ uint8_t *dm_kva;
+ uint64_t dm_pa;
+
+ dm_len = bfa_port_meminfo();
+ dm_kva = bfa_meminfo_dma_virt(mi);
+ dm_pa = bfa_meminfo_dma_phys(mi);
+
+ memset(port, 0, sizeof(struct bfa_port_s));
+ bfa_port_attach(port, &bfa->ioc, bfa, bfa->trcmod, bfa->logm);
+ bfa_port_mem_claim(port, dm_kva, dm_pa);
+
+ bfa_meminfo_dma_virt(mi) = dm_kva + dm_len;
+ bfa_meminfo_dma_phys(mi) = dm_pa + dm_len;
+}
+
/**
* Use this function to do attach the driver instance with the BFA
* library. This function will not trigger any HW initialization
@@ -140,6 +161,7 @@ bfa_attach(struct bfa_s *bfa, void *bfad
for (i = 0; hal_mods[i]; i++)
hal_mods[i]->attach(bfa, bfad, cfg, meminfo, pcidev);
+ bfa_com_port_attach(bfa, meminfo);
}
/**
^ permalink raw reply [flat|nested] 19+ messages in thread* [34/49] igb: only use vlan_gro_receive if vlans are registered
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
2011-01-05 23:00 ` [33/49] [SCSI] bfa: fix system crash when reading sysfs fc_host statistics Greg KH
@ 2011-01-05 23:00 ` Greg KH
2011-01-26 22:37 ` Alexander Duyck
2011-01-05 23:00 ` [35/49] net: release dst entry while cache-hot for GSO case too Greg KH
` (14 subsequent siblings)
16 siblings, 1 reply; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:00 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Alexander Duyck,
Jeff Kirsher, Eric Dumazet, David S. Miller
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Alexander Duyck <alexander.h.duyck@intel.com>
commit 31b24b955c3ebbb6f3008a6374e61cf7c05a193c upstream.
This change makes it so that vlan_gro_receive is only used if vlans have been
registered to the adapter structure. Previously we were just sending all vlan
tagged frames in via this function but this results in a null pointer
dereference when vlans are not registered.
[ This fixes bugzilla entry 15582 -Eric Dumazet]
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/igb/igb_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -4560,7 +4560,7 @@ static void igb_receive_skb(struct igb_r
bool vlan_extracted = (adapter->vlgrp && (status & E1000_RXD_STAT_VP));
skb_record_rx_queue(skb, ring->queue_index);
- if (vlan_extracted)
+ if (vlan_extracted && adapter->vlgrp)
vlan_gro_receive(&ring->napi, adapter->vlgrp,
le16_to_cpu(rx_desc->wb.upper.vlan),
skb);
^ permalink raw reply [flat|nested] 19+ messages in thread* Re: [34/49] igb: only use vlan_gro_receive if vlans are registered
2011-01-05 23:00 ` [34/49] igb: only use vlan_gro_receive if vlans are registered Greg KH
@ 2011-01-26 22:37 ` Alexander Duyck
0 siblings, 0 replies; 19+ messages in thread
From: Alexander Duyck @ 2011-01-26 22:37 UTC (permalink / raw)
To: Greg KH
Cc: linux-kernel@vger.kernel.org, stable@kernel.org,
stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Kirsher, Jeffrey T, Eric Dumazet, David S. Miller
On 1/5/2011 3:00 PM, Greg KH wrote:
> 2.6.32-longterm review patch. If anyone has any objections, please let us know.
>
> ------------------
>
> From: Alexander Duyck<alexander.h.duyck@intel.com>
>
> commit 31b24b955c3ebbb6f3008a6374e61cf7c05a193c upstream.
>
> This change makes it so that vlan_gro_receive is only used if vlans have been
> registered to the adapter structure. Previously we were just sending all vlan
> tagged frames in via this function but this results in a null pointer
> dereference when vlans are not registered.
>
> [ This fixes bugzilla entry 15582 -Eric Dumazet]
>
> Signed-off-by: Alexander Duyck<alexander.h.duyck@intel.com>
> Signed-off-by: Jeff Kirsher<jeffrey.t.kirsher@intel.com>
> Acked-by: Eric Dumazet<eric.dumazet@gmail.com>
> Signed-off-by: David S. Miller<davem@davemloft.net>
> Signed-off-by: Greg Kroah-Hartman<gregkh@suse.de>
>
> ---
> drivers/net/igb/igb_main.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- a/drivers/net/igb/igb_main.c
> +++ b/drivers/net/igb/igb_main.c
> @@ -4560,7 +4560,7 @@ static void igb_receive_skb(struct igb_r
> bool vlan_extracted = (adapter->vlgrp&& (status& E1000_RXD_STAT_VP));
>
> skb_record_rx_queue(skb, ring->queue_index);
> - if (vlan_extracted)
> + if (vlan_extracted && adapter->vlgrp)
> vlan_gro_receive(&ring->napi, adapter->vlgrp,
> le16_to_cpu(rx_desc->wb.upper.vlan),
> skb);
>
>
I was just reviewing some history on this and I noticed that this patch
appears to be applied to the wrong kernel. The change isn't needed for
2.6.32 as evidenced by the fact that vlan_extracted already includes
adapter->vlgrp as part of computing it's value. However, the change is
needed for 2.6.33. The original bugzilla include the patch for that kernel.
Thanks,
Alex
^ permalink raw reply [flat|nested] 19+ messages in thread
* [35/49] net: release dst entry while cache-hot for GSO case too
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
2011-01-05 23:00 ` [33/49] [SCSI] bfa: fix system crash when reading sysfs fc_host statistics Greg KH
2011-01-05 23:00 ` [34/49] igb: only use vlan_gro_receive if vlans are registered Greg KH
@ 2011-01-05 23:00 ` Greg KH
2011-01-05 23:00 ` [36/49] install_special_mapping skips security_file_mmap check Greg KH
` (13 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:00 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Krishna Kumar, Eric Dumazet,
David S. Miller, Andrey Vagin
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Krishna Kumar <krkumar2@in.ibm.com>
commit 068a2de57ddf4f472e32e7af868613c574ad1d88 upstream.
Non-GSO code drops dst entry for performance reasons, but
the same is missing for GSO code. Drop dst while cache-hot
for GSO case too.
Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/core/dev.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1747,6 +1747,14 @@ gso:
skb->next = nskb->next;
nskb->next = NULL;
+
+ /*
+ * If device doesnt need nskb->dst, release it right now while
+ * its hot in this cpu cache
+ */
+ if (dev->priv_flags & IFF_XMIT_DST_RELEASE)
+ skb_dst_drop(nskb);
+
rc = ops->ndo_start_xmit(nskb, dev);
if (unlikely(rc != NETDEV_TX_OK)) {
nskb->next = skb->next;
^ permalink raw reply [flat|nested] 19+ messages in thread* [36/49] install_special_mapping skips security_file_mmap check.
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (2 preceding siblings ...)
2011-01-05 23:00 ` [35/49] net: release dst entry while cache-hot for GSO case too Greg KH
@ 2011-01-05 23:00 ` Greg KH
2011-01-05 23:00 ` [37/49] USB: misc: uss720.c: add another vendor/product ID Greg KH
` (12 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:00 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Tavis Ormandy, Kees Cook,
Robert Swiecki
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Tavis Ormandy <taviso@cmpxchg8b.com>
commit 462e635e5b73ba9a4c03913b77138cd57ce4b050 upstream.
The install_special_mapping routine (used, for example, to setup the
vdso) skips the security check before insert_vm_struct, allowing a local
attacker to bypass the mmap_min_addr security restriction by limiting
the available pages for special mappings.
bprm_mm_init() also skips the check, and although I don't think this can
be used to bypass any restrictions, I don't see any reason not to have
the security check.
$ uname -m
x86_64
$ cat /proc/sys/vm/mmap_min_addr
65536
$ cat install_special_mapping.s
section .bss
resb BSS_SIZE
section .text
global _start
_start:
mov eax, __NR_pause
int 0x80
$ nasm -D__NR_pause=29 -DBSS_SIZE=0xfffed000 -f elf -o install_special_mapping.o install_special_mapping.s
$ ld -m elf_i386 -Ttext=0x10000 -Tbss=0x11000 -o install_special_mapping install_special_mapping.o
$ ./install_special_mapping &
[1] 14303
$ cat /proc/14303/maps
0000f000-00010000 r-xp 00000000 00:00 0 [vdso]
00010000-00011000 r-xp 00001000 00:19 2453665 /home/taviso/install_special_mapping
00011000-ffffe000 rwxp 00000000 00:00 0 [stack]
It's worth noting that Red Hat are shipping with mmap_min_addr set to
4096.
Signed-off-by: Tavis Ormandy <taviso@google.com>
Acked-by: Kees Cook <kees@ubuntu.com>
Acked-by: Robert Swiecki <swiecki@google.com>
[ Changed to not drop the error code - akpm ]
Reviewed-by: James Morris <jmorris@namei.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/exec.c | 5 +++++
mm/mmap.c | 16 ++++++++++++----
2 files changed, 17 insertions(+), 4 deletions(-)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -247,6 +247,11 @@ static int __bprm_mm_init(struct linux_b
vma->vm_start = vma->vm_end - PAGE_SIZE;
vma->vm_flags = VM_STACK_FLAGS;
vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+
+ err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
+ if (err)
+ goto err;
+
err = insert_vm_struct(mm, vma);
if (err)
goto err;
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2290,6 +2290,7 @@ int install_special_mapping(struct mm_st
unsigned long addr, unsigned long len,
unsigned long vm_flags, struct page **pages)
{
+ int ret;
struct vm_area_struct *vma;
vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
@@ -2306,16 +2307,23 @@ int install_special_mapping(struct mm_st
vma->vm_ops = &special_mapping_vmops;
vma->vm_private_data = pages;
- if (unlikely(insert_vm_struct(mm, vma))) {
- kmem_cache_free(vm_area_cachep, vma);
- return -ENOMEM;
- }
+ ret = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
+ if (ret)
+ goto out;
+
+ ret = insert_vm_struct(mm, vma);
+ if (ret)
+ goto out;
mm->total_vm += len >> PAGE_SHIFT;
perf_event_mmap(vma);
return 0;
+
+out:
+ kmem_cache_free(vm_area_cachep, vma);
+ return ret;
}
static DEFINE_MUTEX(mm_all_locks_mutex);
^ permalink raw reply [flat|nested] 19+ messages in thread* [37/49] USB: misc: uss720.c: add another vendor/product ID
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (3 preceding siblings ...)
2011-01-05 23:00 ` [36/49] install_special_mapping skips security_file_mmap check Greg KH
@ 2011-01-05 23:00 ` Greg KH
2011-01-05 23:00 ` [38/49] USB: ftdi_sio: Add D.O.Tec PID Greg KH
` (11 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:00 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Thomas Sailer
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Thomas Sailer <t.sailer@alumni.ethz.ch>
commit ecc1624a2fff45780959efbcb73ace18fdb3c58d upstream.
Fabio Battaglia report that he has another cable that works with this
driver, so this patch adds its vendor/product ID.
Signed-off-by: Thomas Sailer <t.sailer@alumni.ethz.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/misc/uss720.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -3,7 +3,7 @@
/*
* uss720.c -- USS720 USB Parport Cable.
*
- * Copyright (C) 1999, 2005
+ * Copyright (C) 1999, 2005, 2010
* Thomas Sailer (t.sailer@alumni.ethz.ch)
*
* This program is free software; you can redistribute it and/or modify
@@ -775,6 +775,8 @@ static struct usb_device_id uss720_table
{ USB_DEVICE(0x0557, 0x2001) },
{ USB_DEVICE(0x0729, 0x1284) },
{ USB_DEVICE(0x1293, 0x0002) },
+ { USB_DEVICE(0x1293, 0x0002) },
+ { USB_DEVICE(0x050d, 0x0002) },
{ } /* Terminating entry */
};
^ permalink raw reply [flat|nested] 19+ messages in thread* [38/49] USB: ftdi_sio: Add D.O.Tec PID
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (4 preceding siblings ...)
2011-01-05 23:00 ` [37/49] USB: misc: uss720.c: add another vendor/product ID Greg KH
@ 2011-01-05 23:00 ` Greg KH
2011-01-05 23:00 ` [39/49] USB: usb-storage: unusual_devs entry for the Samsung YP-CP3 Greg KH
` (10 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:00 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Florian Faber
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Florian Faber <faberman@linuxproaudio.org>
commit 5363cdc3c5da9bd431552cf5989ab481596f0c6d upstream.
Add FTDI PID to identify D.O.Tec devices correctly.
Signed-off-by: Florian Faber <faberman@linuxproaudio.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 5 +++++
2 files changed, 6 insertions(+)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -802,6 +802,7 @@ static struct usb_device_id id_table_com
{ USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LOGBOOKML_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
{ USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
{ }, /* Optional parameter entry */
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1088,6 +1088,11 @@
#define MJSG_HD_RADIO_PID 0x937C
/*
+ * D.O.Tec products (http://www.directout.eu)
+ */
+#define FTDI_DOTEC_PID 0x9868
+
+/*
* Xverve Signalyzer tools (http://www.signalyzer.com/)
*/
#define XVERVE_SIGNALYZER_ST_PID 0xBCA0
^ permalink raw reply [flat|nested] 19+ messages in thread* [39/49] USB: usb-storage: unusual_devs entry for the Samsung YP-CP3
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (5 preceding siblings ...)
2011-01-05 23:00 ` [38/49] USB: ftdi_sio: Add D.O.Tec PID Greg KH
@ 2011-01-05 23:00 ` Greg KH
2011-01-05 23:00 ` [40/49] p54usb: add 5 more USBIDs Greg KH
` (9 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:00 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Vitaly Kuznetsov, Alan Stern,
Matthew Dharm
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Vitaly Kuznetsov <vitty@altlinux.ru>
commit d73a9b3001f29271c2e9f2a806b05a431c5d9591 upstream.
Add an unusual_devs entry for the Samsung YP-CP3 MP4 player.
User was getting the following errors in dmesg:
usb 2-6: reset high speed USB device using ehci_hcd and address 2
usb 2-6: reset high speed USB device using ehci_hcd and address 2
usb 2-6: reset high speed USB device using ehci_hcd and address 2
usb 2-6: USB disconnect, address 2
sd 3:0:0:0: [sdb] Assuming drive cache: write through
sdb:<2>ldm_validate_partition_table(): Disk read failed.
Dev sdb: unable to read RDB block 0
unable to read partition table
Signed-off-by: Vitaly Kuznetsov <vitty@altlinux.ru>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
CC: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/storage/unusual_devs.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -481,6 +481,13 @@ UNUSUAL_DEV( 0x04e8, 0x507c, 0x0220, 0x
US_SC_DEVICE, US_PR_DEVICE, NULL,
US_FL_MAX_SECTORS_64),
+/* Reported by Vitaly Kuznetsov <vitty@altlinux.ru> */
+UNUSUAL_DEV( 0x04e8, 0x5122, 0x0000, 0x9999,
+ "Samsung",
+ "YP-CP3",
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG),
+
/* Entry and supporting patch by Theodore Kilgore <kilgota@auburn.edu>.
* Device uses standards-violating 32-byte Bulk Command Block Wrappers and
* reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011.
^ permalink raw reply [flat|nested] 19+ messages in thread* [40/49] p54usb: add 5 more USBIDs
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (6 preceding siblings ...)
2011-01-05 23:00 ` [39/49] USB: usb-storage: unusual_devs entry for the Samsung YP-CP3 Greg KH
@ 2011-01-05 23:00 ` Greg KH
2011-01-05 23:00 ` [41/49] p54usb: New USB ID for Gemtek WUBI-100GW Greg KH
` (8 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:00 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Christian Lamparter,
John W. Linville
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Christian Lamparter <chunkeey@googlemail.com>
commit 16cad7fba037b34ca32cc0adac65bc089d969fb8 upstream.
This patch adds five more USBIDs to the table.
Source:
http://www.linuxant.com/pipermail/driverloader/2005q3/002307.html
http://wireless.kernel.org/en/users/Drivers/p54/devices (by M. Davis)
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/p54/p54usb.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -42,6 +42,7 @@ MODULE_FIRMWARE("isl3887usb");
static struct usb_device_id p54u_table[] __devinitdata = {
/* Version 1 devices (pci chip + net2280) */
+ {USB_DEVICE(0x0411, 0x0050)}, /* Buffalo WLI2-USB2-G54 */
{USB_DEVICE(0x045e, 0x00c2)}, /* Microsoft MN-710 */
{USB_DEVICE(0x0506, 0x0a11)}, /* 3COM 3CRWE254G72 */
{USB_DEVICE(0x0707, 0xee06)}, /* SMC 2862W-G */
@@ -54,9 +55,12 @@ static struct usb_device_id p54u_table[]
{USB_DEVICE(0x0846, 0x4220)}, /* Netgear WG111 */
{USB_DEVICE(0x09aa, 0x1000)}, /* Spinnaker Proto board */
{USB_DEVICE(0x0cde, 0x0006)}, /* Medion 40900, Roper Europe */
+ {USB_DEVICE(0x0db0, 0x6826)}, /* MSI UB54G (MS-6826) */
{USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
{USB_DEVICE(0x124a, 0x4023)}, /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
+ {USB_DEVICE(0x1435, 0x0210)}, /* Inventel UR054G */
{USB_DEVICE(0x1630, 0x0005)}, /* 2Wire 802.11g USB (v1) / Z-Com */
+ {USB_DEVICE(0x182d, 0x096b)}, /* Sitecom WL-107 */
{USB_DEVICE(0x1915, 0x2234)}, /* Linksys WUSB54G OEM */
{USB_DEVICE(0x1915, 0x2235)}, /* Linksys WUSB54G Portable OEM */
{USB_DEVICE(0x2001, 0x3701)}, /* DLink DWL-G120 Spinnaker */
@@ -91,6 +95,7 @@ static struct usb_device_id p54u_table[]
{USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */
{USB_DEVICE(0x1668, 0x1050)}, /* Actiontec 802UIG-1 */
{USB_DEVICE(0x2001, 0x3704)}, /* DLink DWL-G122 rev A2 */
+ {USB_DEVICE(0x2001, 0x3705)}, /* D-Link DWL-G120 rev C1 */
{USB_DEVICE(0x413c, 0x5513)}, /* Dell WLA3310 USB Wireless Adapter */
{USB_DEVICE(0x413c, 0x8102)}, /* Spinnaker DUT */
{USB_DEVICE(0x413c, 0x8104)}, /* Cohiba Proto board */
^ permalink raw reply [flat|nested] 19+ messages in thread* [41/49] p54usb: New USB ID for Gemtek WUBI-100GW
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (7 preceding siblings ...)
2011-01-05 23:00 ` [40/49] p54usb: add 5 more USBIDs Greg KH
@ 2011-01-05 23:00 ` Greg KH
2011-01-05 23:01 ` [42/49] sound: Prevent buffer overflow in OSS load_mixer_volumes Greg KH
` (7 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:00 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Larry Finger, Eduardo Costa,
John W. Linville
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Eduardo Costa <ecosta.tmp@gmail.com>
commit 56e6417b49132d4f56e9f2241d31942b90b46315 upstream.
This USB ID is for the WUBI-100GW 802.11g Wireless LAN USB Device that
uses p54usb.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Eduardo Costa <ecosta.tmp@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/p54/p54usb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -59,6 +59,7 @@ static struct usb_device_id p54u_table[]
{USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
{USB_DEVICE(0x124a, 0x4023)}, /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
{USB_DEVICE(0x1435, 0x0210)}, /* Inventel UR054G */
+ {USB_DEVICE(0x15a9, 0x0002)}, /* Gemtek WUBI-100GW 802.11g */
{USB_DEVICE(0x1630, 0x0005)}, /* 2Wire 802.11g USB (v1) / Z-Com */
{USB_DEVICE(0x182d, 0x096b)}, /* Sitecom WL-107 */
{USB_DEVICE(0x1915, 0x2234)}, /* Linksys WUSB54G OEM */
^ permalink raw reply [flat|nested] 19+ messages in thread* [42/49] sound: Prevent buffer overflow in OSS load_mixer_volumes
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (8 preceding siblings ...)
2011-01-05 23:00 ` [41/49] p54usb: New USB ID for Gemtek WUBI-100GW Greg KH
@ 2011-01-05 23:01 ` Greg KH
2011-01-05 23:01 ` [43/49] mv_xor: fix race in tasklet function Greg KH
` (6 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Dan Rosenberg, Takashi Iwai
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Dan Rosenberg <drosenberg@vsecurity.com>
commit d81a12bc29ae4038770e05dce4ab7f26fd5880fb upstream.
The load_mixer_volumes() function, which can be triggered by
unprivileged users via the SOUND_MIXER_SETLEVELS ioctl, is vulnerable to
a buffer overflow. Because the provided "name" argument isn't
guaranteed to be NULL terminated at the expected 32 bytes, it's possible
to overflow past the end of the last element in the mixer_vols array.
Further exploitation can result in an arbitrary kernel write (via
subsequent calls to load_mixer_volumes()) leading to privilege
escalation, or arbitrary kernel reads via get_mixer_levels(). In
addition, the strcmp() may leak bytes beyond the mixer_vols array.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/oss/soundcard.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/oss/soundcard.c
+++ b/sound/oss/soundcard.c
@@ -87,7 +87,7 @@ int *load_mixer_volumes(char *name, int
int i, n;
for (i = 0; i < num_mixer_volumes; i++) {
- if (strcmp(name, mixer_vols[i].name) == 0) {
+ if (strncmp(name, mixer_vols[i].name, 32) == 0) {
if (present)
mixer_vols[i].num = i;
return mixer_vols[i].levels;
@@ -99,7 +99,7 @@ int *load_mixer_volumes(char *name, int
}
n = num_mixer_volumes++;
- strcpy(mixer_vols[n].name, name);
+ strncpy(mixer_vols[n].name, name, 32);
if (present)
mixer_vols[n].num = n;
^ permalink raw reply [flat|nested] 19+ messages in thread* [43/49] mv_xor: fix race in tasklet function
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (9 preceding siblings ...)
2011-01-05 23:01 ` [42/49] sound: Prevent buffer overflow in OSS load_mixer_volumes Greg KH
@ 2011-01-05 23:01 ` Greg KH
2011-01-05 23:01 ` [44/49] ima: fix add LSM rule bug Greg KH
` (5 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Saeed Bishara, Dan Williams
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Saeed Bishara <saeed@marvell.com>
commit 8333f65ef094e47020cd01452b4637e7daf5a77f upstream.
use mv_xor_slot_cleanup() instead of __mv_xor_slot_cleanup() as the former function
aquires the spin lock that needed to protect the drivers data.
Signed-off-by: Saeed Bishara <saeed@marvell.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/dma/mv_xor.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -448,7 +448,7 @@ mv_xor_slot_cleanup(struct mv_xor_chan *
static void mv_xor_tasklet(unsigned long data)
{
struct mv_xor_chan *chan = (struct mv_xor_chan *) data;
- __mv_xor_slot_cleanup(chan);
+ mv_xor_slot_cleanup(chan);
}
static struct mv_xor_desc_slot *
^ permalink raw reply [flat|nested] 19+ messages in thread* [44/49] ima: fix add LSM rule bug
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (10 preceding siblings ...)
2011-01-05 23:01 ` [43/49] mv_xor: fix race in tasklet function Greg KH
@ 2011-01-05 23:01 ` Greg KH
2011-01-05 23:01 ` [45/49] ALSA: hda: Use LPIB for Dell Latitude 131L Greg KH
` (4 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Mimi Zohar, James Morris,
Serge Hallyn, David Safford
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
commit 867c20265459d30a01b021a9c1e81fb4c5832aa9 upstream.
If security_filter_rule_init() doesn't return a rule, then not everything
is as fine as the return code implies.
This bug only occurs when the LSM (eg. SELinux) is disabled at runtime.
Adding an empty LSM rule causes ima_match_rules() to always succeed,
ignoring any remaining rules.
default IMA TCB policy:
# PROC_SUPER_MAGIC
dont_measure fsmagic=0x9fa0
# SYSFS_MAGIC
dont_measure fsmagic=0x62656572
# DEBUGFS_MAGIC
dont_measure fsmagic=0x64626720
# TMPFS_MAGIC
dont_measure fsmagic=0x01021994
# SECURITYFS_MAGIC
dont_measure fsmagic=0x73636673
< LSM specific rule >
dont_measure obj_type=var_log_t
measure func=BPRM_CHECK
measure func=FILE_MMAP mask=MAY_EXEC
measure func=FILE_CHECK mask=MAY_READ uid=0
Thus without the patch, with the boot parameters 'tcb selinux=0', adding
the above 'dont_measure obj_type=var_log_t' rule to the default IMA TCB
measurement policy, would result in nothing being measured. The patch
prevents the default TCB policy from being replaced.
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Cc: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Cc: David Safford <safford@watson.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
security/integrity/ima/ima_policy.c | 2 ++
1 file changed, 2 insertions(+)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -249,6 +249,8 @@ static int ima_lsm_rule_init(struct ima_
result = security_filter_rule_init(entry->lsm[lsm_rule].type,
Audit_equal, args,
&entry->lsm[lsm_rule].rule);
+ if (!entry->lsm[lsm_rule].rule)
+ return -EINVAL;
return result;
}
^ permalink raw reply [flat|nested] 19+ messages in thread* [45/49] ALSA: hda: Use LPIB for Dell Latitude 131L
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (11 preceding siblings ...)
2011-01-05 23:01 ` [44/49] ima: fix add LSM rule bug Greg KH
@ 2011-01-05 23:01 ` Greg KH
2011-01-05 23:01 ` [46/49] ALSA: hda: Use LPIB quirk for Dell Inspiron m101z/1120 Greg KH
` (3 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Daniel T Chen <crimsun@ubuntu.com>
commit 9919c7619c52d01e89103bca405cc3d4a2b1ac31 upstream.
BugLink: https://launchpad.net/bugs/530346
The OR has verified that position_fix=1 is necessary to work around
errors on his machine.
Reported-by: Tom Louwrier
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/pci/hda/hda_intel.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2229,6 +2229,7 @@ static struct snd_pci_quirk position_fix
SND_PCI_QUIRK(0x1025, 0x009f, "Acer Aspire 5110", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB),
SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
^ permalink raw reply [flat|nested] 19+ messages in thread* [46/49] ALSA: hda: Use LPIB quirk for Dell Inspiron m101z/1120
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (12 preceding siblings ...)
2011-01-05 23:01 ` [45/49] ALSA: hda: Use LPIB for Dell Latitude 131L Greg KH
@ 2011-01-05 23:01 ` Greg KH
2011-01-05 23:01 ` [47/49] block: Deprecate QUEUE_FLAG_CLUSTER and use queue_limits instead Greg KH
` (2 subsequent siblings)
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Daniel T Chen <crimsun@ubuntu.com>
commit e03fa055bc126e536c7f65862e08a9b143138ea9 upstream.
Sjoerd Simons reports that, without using position_fix=1, recording
experiences overruns. Work around that by applying the LPIB quirk
for his hardware.
Reported-and-tested-by: Sjoerd Simons <sjoerd@debian.org>
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/pci/hda/hda_intel.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2230,6 +2230,7 @@ static struct snd_pci_quirk position_fix
SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell Inspiron 1120", POS_FIX_LPIB),
SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
^ permalink raw reply [flat|nested] 19+ messages in thread* [47/49] block: Deprecate QUEUE_FLAG_CLUSTER and use queue_limits instead
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (13 preceding siblings ...)
2011-01-05 23:01 ` [46/49] ALSA: hda: Use LPIB quirk for Dell Inspiron m101z/1120 Greg KH
@ 2011-01-05 23:01 ` Greg KH
2011-01-05 23:01 ` [48/49] sctp: Fix a race between ICMP protocol unreachable and connect() Greg KH
2011-01-05 23:01 ` [49/49] posix-cpu-timers: workaround to suppress the problems with mt exec Greg KH
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Martin K. Petersen,
Mike Snitzer, Jens Axboe
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Martin K. Petersen <martin.petersen@oracle.com>
commit e692cb668fdd5a712c6ed2a2d6f2a36ee83997b4 upstream.
When stacking devices, a request_queue is not always available. This
forced us to have a no_cluster flag in the queue_limits that could be
used as a carrier until the request_queue had been set up for a
metadevice.
There were several problems with that approach. First of all it was up
to the stacking device to remember to set queue flag after stacking had
completed. Also, the queue flag and the queue limits had to be kept in
sync at all times. We got that wrong, which could lead to us issuing
commands that went beyond the max scatterlist limit set by the driver.
The proper fix is to avoid having two flags for tracking the same thing.
We deprecate QUEUE_FLAG_CLUSTER and use the queue limit directly in the
block layer merging functions. The queue_limit 'no_cluster' is turned
into 'cluster' to avoid double negatives and to ease stacking.
Clustering defaults to being enabled as before. The queue flag logic is
removed from the stacking function, and explicitly setting the cluster
flag is no longer necessary in DM and MD.
Reported-by: Ed Lin <ed.lin@promise.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
block/blk-merge.c | 6 +++---
block/blk-settings.c | 24 ++----------------------
drivers/md/dm-table.c | 5 -----
drivers/md/md.c | 3 ---
drivers/scsi/scsi_lib.c | 3 +--
include/linux/blkdev.h | 9 ++++++---
6 files changed, 12 insertions(+), 38 deletions(-)
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -22,7 +22,7 @@ static unsigned int __blk_recalc_rq_segm
return 0;
fbio = bio;
- cluster = test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
+ cluster = blk_queue_cluster(q);
seg_size = 0;
phys_size = nr_phys_segs = 0;
for_each_bio(bio) {
@@ -88,7 +88,7 @@ EXPORT_SYMBOL(blk_recount_segments);
static int blk_phys_contig_segment(struct request_queue *q, struct bio *bio,
struct bio *nxt)
{
- if (!test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags))
+ if (!blk_queue_cluster(q))
return 0;
if (bio->bi_seg_back_size + nxt->bi_seg_front_size >
@@ -124,7 +124,7 @@ int blk_rq_map_sg(struct request_queue *
int nsegs, cluster;
nsegs = 0;
- cluster = test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
+ cluster = blk_queue_cluster(q);
/*
* for each bio in rq
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -103,7 +103,7 @@ void blk_set_default_limits(struct queue
lim->alignment_offset = 0;
lim->io_opt = 0;
lim->misaligned = 0;
- lim->no_cluster = 0;
+ lim->cluster = 1;
}
EXPORT_SYMBOL(blk_set_default_limits);
@@ -477,15 +477,6 @@ EXPORT_SYMBOL(blk_queue_io_opt);
void blk_queue_stack_limits(struct request_queue *t, struct request_queue *b)
{
blk_stack_limits(&t->limits, &b->limits, 0);
-
- if (!t->queue_lock)
- WARN_ON_ONCE(1);
- else if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags)) {
- unsigned long flags;
- spin_lock_irqsave(t->queue_lock, flags);
- queue_flag_clear(QUEUE_FLAG_CLUSTER, t);
- spin_unlock_irqrestore(t->queue_lock, flags);
- }
}
EXPORT_SYMBOL(blk_queue_stack_limits);
@@ -561,7 +552,7 @@ int blk_stack_limits(struct queue_limits
t->io_min = max(t->io_min, b->io_min);
t->io_opt = lcm(t->io_opt, b->io_opt);
- t->no_cluster |= b->no_cluster;
+ t->cluster &= b->cluster;
/* Physical block size a multiple of the logical block size? */
if (t->physical_block_size & (t->logical_block_size - 1)) {
@@ -652,17 +643,6 @@ void disk_stack_limits(struct gendisk *d
printk(KERN_NOTICE "%s: Warning: Device %s is misaligned\n",
top, bottom);
}
-
- if (!t->queue_lock)
- WARN_ON_ONCE(1);
- else if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags)) {
- unsigned long flags;
-
- spin_lock_irqsave(t->queue_lock, flags);
- if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags))
- queue_flag_clear(QUEUE_FLAG_CLUSTER, t);
- spin_unlock_irqrestore(t->queue_lock, flags);
- }
}
EXPORT_SYMBOL(disk_stack_limits);
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1082,11 +1082,6 @@ void dm_table_set_restrictions(struct dm
*/
q->limits = *limits;
- if (limits->no_cluster)
- queue_flag_clear_unlocked(QUEUE_FLAG_CLUSTER, q);
- else
- queue_flag_set_unlocked(QUEUE_FLAG_CLUSTER, q);
-
dm_table_set_integrity(t);
/*
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3959,9 +3959,6 @@ static int md_alloc(dev_t dev, char *nam
goto abort;
mddev->queue->queuedata = mddev;
- /* Can be unlocked because the queue is new: no concurrency */
- queue_flag_set_unlocked(QUEUE_FLAG_CLUSTER, mddev->queue);
-
blk_queue_make_request(mddev->queue, md_make_request);
disk = alloc_disk(1 << shift);
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1636,9 +1636,8 @@ struct request_queue *__scsi_alloc_queue
blk_queue_max_segment_size(q, dma_get_max_seg_size(dev));
- /* New queue, no concurrency on queue_flags */
if (!shost->use_clustering)
- queue_flag_clear_unlocked(QUEUE_FLAG_CLUSTER, q);
+ q->limits.cluster = 0;
/*
* set a reasonable default alignment on word boundaries: the
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -318,7 +318,7 @@ struct queue_limits {
unsigned short max_phys_segments;
unsigned char misaligned;
- unsigned char no_cluster;
+ unsigned char cluster;
};
struct request_queue
@@ -440,7 +440,6 @@ struct request_queue
#endif
};
-#define QUEUE_FLAG_CLUSTER 0 /* cluster several segments into 1 */
#define QUEUE_FLAG_QUEUED 1 /* uses generic tag queueing */
#define QUEUE_FLAG_STOPPED 2 /* queue is stopped */
#define QUEUE_FLAG_SYNCFULL 3 /* read queue has been filled */
@@ -461,7 +460,6 @@ struct request_queue
#define QUEUE_FLAG_DISCARD 17 /* supports DISCARD */
#define QUEUE_FLAG_DEFAULT ((1 << QUEUE_FLAG_IO_STAT) | \
- (1 << QUEUE_FLAG_CLUSTER) | \
(1 << QUEUE_FLAG_STACKABLE) | \
(1 << QUEUE_FLAG_SAME_COMP))
@@ -627,6 +625,11 @@ enum {
#define rq_data_dir(rq) ((rq)->cmd_flags & 1)
+static inline unsigned int blk_queue_cluster(struct request_queue *q)
+{
+ return q->limits.cluster;
+}
+
/*
* We regard a request as sync, if either a read or a sync write
*/
^ permalink raw reply [flat|nested] 19+ messages in thread* [48/49] sctp: Fix a race between ICMP protocol unreachable and connect()
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (14 preceding siblings ...)
2011-01-05 23:01 ` [47/49] block: Deprecate QUEUE_FLAG_CLUSTER and use queue_limits instead Greg KH
@ 2011-01-05 23:01 ` Greg KH
2011-01-05 23:01 ` [49/49] posix-cpu-timers: workaround to suppress the problems with mt exec Greg KH
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Vlad Yasevich,
David S. Miller
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Vlad Yasevich <vladislav.yasevich@hp.com>
commit 50b5d6ad63821cea324a5a7a19854d4de1a0a819 upstream.
ICMP protocol unreachable handling completely disregarded
the fact that the user may have locked the socket. It proceeded
to destroy the association, even though the user may have
held the lock and had a ref on the association. This resulted
in the following:
Attempt to release alive inet socket f6afcc00
=========================
[ BUG: held lock freed! ]
-------------------------
somenu/2672 is freeing memory f6afcc00-f6afcfff, with a lock still held
there!
(sk_lock-AF_INET){+.+.+.}, at: [<c122098a>] sctp_connect+0x13/0x4c
1 lock held by somenu/2672:
#0: (sk_lock-AF_INET){+.+.+.}, at: [<c122098a>] sctp_connect+0x13/0x4c
stack backtrace:
Pid: 2672, comm: somenu Not tainted 2.6.32-telco #55
Call Trace:
[<c1232266>] ? printk+0xf/0x11
[<c1038553>] debug_check_no_locks_freed+0xce/0xff
[<c10620b4>] kmem_cache_free+0x21/0x66
[<c1185f25>] __sk_free+0x9d/0xab
[<c1185f9c>] sk_free+0x1c/0x1e
[<c1216e38>] sctp_association_put+0x32/0x89
[<c1220865>] __sctp_connect+0x36d/0x3f4
[<c122098a>] ? sctp_connect+0x13/0x4c
[<c102d073>] ? autoremove_wake_function+0x0/0x33
[<c12209a8>] sctp_connect+0x31/0x4c
[<c11d1e80>] inet_dgram_connect+0x4b/0x55
[<c11834fa>] sys_connect+0x54/0x71
[<c103a3a2>] ? lock_release_non_nested+0x88/0x239
[<c1054026>] ? might_fault+0x42/0x7c
[<c1054026>] ? might_fault+0x42/0x7c
[<c11847ab>] sys_socketcall+0x6d/0x178
[<c10da994>] ? trace_hardirqs_on_thunk+0xc/0x10
[<c1002959>] syscall_call+0x7/0xb
This was because the sctp_wait_for_connect() would aqcure the socket
lock and then proceed to release the last reference count on the
association, thus cause the fully destruction path to finish freeing
the socket.
The simplest solution is to start a very short timer in case the socket
is owned by user. When the timer expires, we can do some verification
and be able to do the release properly.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/net/sctp/sm.h | 1 +
include/net/sctp/structs.h | 3 +++
net/sctp/input.c | 22 ++++++++++++++++++----
net/sctp/sm_sideeffect.c | 35 +++++++++++++++++++++++++++++++++++
net/sctp/transport.c | 2 ++
5 files changed, 59 insertions(+), 4 deletions(-)
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -278,6 +278,7 @@ int sctp_do_sm(sctp_event_t event_type,
/* 2nd level prototypes */
void sctp_generate_t3_rtx_event(unsigned long peer);
void sctp_generate_heartbeat_event(unsigned long peer);
+void sctp_generate_proto_unreach_event(unsigned long peer);
void sctp_ootb_pkt_free(struct sctp_packet *);
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1008,6 +1008,9 @@ struct sctp_transport {
/* Heartbeat timer is per destination. */
struct timer_list hb_timer;
+ /* Timer to handle ICMP proto unreachable envets */
+ struct timer_list proto_unreach_timer;
+
/* Since we're using per-destination retransmission timers
* (see above), we're also using per-destination "transmitted"
* queues. This probably ought to be a private struct
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -427,11 +427,25 @@ void sctp_icmp_proto_unreachable(struct
{
SCTP_DEBUG_PRINTK("%s\n", __func__);
- sctp_do_sm(SCTP_EVENT_T_OTHER,
- SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
- asoc->state, asoc->ep, asoc, t,
- GFP_ATOMIC);
+ if (sock_owned_by_user(sk)) {
+ if (timer_pending(&t->proto_unreach_timer))
+ return;
+ else {
+ if (!mod_timer(&t->proto_unreach_timer,
+ jiffies + (HZ/20)))
+ sctp_association_hold(asoc);
+ }
+
+ } else {
+ if (timer_pending(&t->proto_unreach_timer) &&
+ del_timer(&t->proto_unreach_timer))
+ sctp_association_put(asoc);
+ sctp_do_sm(SCTP_EVENT_T_OTHER,
+ SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+ asoc->state, asoc->ep, asoc, t,
+ GFP_ATOMIC);
+ }
}
/* Common lookup code for icmp/icmpv6 error handler. */
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -397,6 +397,41 @@ out_unlock:
sctp_transport_put(transport);
}
+/* Handle the timeout of the ICMP protocol unreachable timer. Trigger
+ * the correct state machine transition that will close the association.
+ */
+void sctp_generate_proto_unreach_event(unsigned long data)
+{
+ struct sctp_transport *transport = (struct sctp_transport *) data;
+ struct sctp_association *asoc = transport->asoc;
+
+ sctp_bh_lock_sock(asoc->base.sk);
+ if (sock_owned_by_user(asoc->base.sk)) {
+ SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+
+ /* Try again later. */
+ if (!mod_timer(&transport->proto_unreach_timer,
+ jiffies + (HZ/20)))
+ sctp_association_hold(asoc);
+ goto out_unlock;
+ }
+
+ /* Is this structure just waiting around for us to actually
+ * get destroyed?
+ */
+ if (asoc->base.dead)
+ goto out_unlock;
+
+ sctp_do_sm(SCTP_EVENT_T_OTHER,
+ SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+ asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
+
+out_unlock:
+ sctp_bh_unlock_sock(asoc->base.sk);
+ sctp_association_put(asoc);
+}
+
+
/* Inject a SACK Timeout event into the state machine. */
static void sctp_generate_sack_event(unsigned long data)
{
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -108,6 +108,8 @@ static struct sctp_transport *sctp_trans
(unsigned long)peer);
setup_timer(&peer->hb_timer, sctp_generate_heartbeat_event,
(unsigned long)peer);
+ setup_timer(&peer->proto_unreach_timer,
+ sctp_generate_proto_unreach_event, (unsigned long)peer);
/* Initialize the 64-bit random nonce sent with heartbeat. */
get_random_bytes(&peer->hb_nonce, sizeof(peer->hb_nonce));
^ permalink raw reply [flat|nested] 19+ messages in thread* [49/49] posix-cpu-timers: workaround to suppress the problems with mt exec
2011-01-05 23:44 [00/49] 2.6.32.28-longterm review (try 2) Greg KH
` (15 preceding siblings ...)
2011-01-05 23:01 ` [48/49] sctp: Fix a race between ICMP protocol unreachable and connect() Greg KH
@ 2011-01-05 23:01 ` Greg KH
16 siblings, 0 replies; 19+ messages in thread
From: Greg KH @ 2011-01-05 23:01 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Oleg Nesterov
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit e0a70217107e6f9844628120412cb27bb4cea194 upstream.
posix-cpu-timers.c correctly assumes that the dying process does
posix_cpu_timers_exit_group() and removes all !CPUCLOCK_PERTHREAD
timers from signal->cpu_timers list.
But, it also assumes that timer->it.cpu.task is always the group
leader, and thus the dead ->task means the dead thread group.
This is obviously not true after de_thread() changes the leader.
After that almost every posix_cpu_timer_ method has problems.
It is not simple to fix this bug correctly. First of all, I think
that timer->it.cpu should use struct pid instead of task_struct.
Also, the locking should be reworked completely. In particular,
tasklist_lock should not be used at all. This all needs a lot of
nontrivial and hard-to-test changes.
Change __exit_signal() to do posix_cpu_timers_exit_group() when
the old leader dies during exec. This is not the fix, just the
temporary hack to hide the problem for 2.6.37 and stable. IOW,
this is obviously wrong but this is what we currently have anyway:
cpu timers do not work after mt exec.
In theory this change adds another race. The exiting leader can
detach the timers which were attached to the new leader. However,
the window between de_thread() and release_task() is small, we
can pretend that sys_timer_create() was called before de_thread().
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/exit.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -92,6 +92,14 @@ static void __exit_signal(struct task_st
posix_cpu_timers_exit_group(tsk);
else {
/*
+ * This can only happen if the caller is de_thread().
+ * FIXME: this is the temporary hack, we should teach
+ * posix-cpu-timers to handle this case correctly.
+ */
+ if (unlikely(has_group_leader_pid(tsk)))
+ posix_cpu_timers_exit_group(tsk);
+
+ /*
* If there is any task waiting for the group exit
* then notify it:
*/
^ permalink raw reply [flat|nested] 19+ messages in thread