I'm announcing the release of the 3.2.99 kernel. All users of the 3.2 kernel series should upgrade. The updated 3.2.y git tree can be found at: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-3.2.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git The diff from 3.2.98 is attached to this message. Ben. ------------ Documentation/kernel-parameters.txt | 3 - Makefile | 2 +- arch/s390/kernel/dis.c | 4 +- arch/x86/include/asm/alternative.h | 4 +- arch/x86/kernel/alternative.c | 129 +++------- arch/x86/kernel/smpboot.c | 20 +- arch/x86/kvm/svm.c | 7 + arch/x86/kvm/vmx.c | 4 + arch/x86/kvm/x86.c | 5 +- arch/x86/kvm/x86.h | 2 + arch/x86/lib/x86-opcode-map.txt | 2 +- arch/x86/mm/kaiser.c | 5 +- arch/x86/xen/smp.c | 6 +- block/blk-core.c | 3 + drivers/char/tpm/tpm.c | 6 + drivers/infiniband/hw/mlx4/qp.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 23 +- drivers/input/misc/adxl34x.c | 2 +- drivers/md/dm-bufio.c | 15 +- drivers/md/dm-table.c | 32 ++- drivers/md/dm.c | 12 +- drivers/media/rc/ir-lirc-codec.c | 9 +- drivers/media/video/cx231xx/cx231xx-cards.c | 3 +- drivers/media/video/omap/omap_vout.c | 3 +- drivers/mtd/nand/nand_base.c | 9 +- drivers/net/wireless/rt2x00/rt2x00usb.c | 6 +- drivers/pci/pcie/aer/aerdrv_core.c | 9 +- drivers/rtc/interface.c | 16 +- drivers/scsi/bfa/bfad_debugfs.c | 5 +- drivers/staging/media/as102/as102_fw.c | 28 ++- drivers/staging/usbip/stub_rx.c | 58 +++-- drivers/staging/usbip/stub_tx.c | 7 + drivers/staging/usbip/usbip_common.h | 1 + .../staging/usbip/userspace/libsrc/usbip_common.c | 2 +- .../staging/usbip/userspace/libsrc/vhci_driver.c | 8 +- drivers/staging/usbip/vhci_hcd.c | 39 --- drivers/staging/usbip/vhci_sysfs.c | 20 +- drivers/usb/core/devio.c | 14 ++ drivers/usb/core/quirks.c | 3 + drivers/usb/serial/garmin_gps.c | 22 +- drivers/video/udlfb.c | 10 +- fs/9p/vfs_inode.c | 3 + fs/9p/vfs_inode_dotl.c | 3 + fs/autofs4/waitq.c | 45 +++- fs/coda/upcall.c | 3 +- fs/ecryptfs/messaging.c | 8 +- fs/isofs/isofs.h | 2 +- fs/isofs/rock.h | 2 +- fs/isofs/util.c | 2 +- fs/nfs/nfs4proc.c | 18 +- fs/nilfs2/segment.c | 6 +- fs/ocfs2/alloc.c | 2 +- fs/ocfs2/file.c | 9 +- include/linux/blkdev.h | 1 + include/linux/usb/ch9.h | 19 ++ include/net/sctp/sctp.h | 2 + include/net/sctp/structs.h | 8 +- kernel/cpu.c | 11 - kernel/extable.c | 2 + kernel/trace/blktrace.c | 76 ++++-- net/9p/client.c | 3 +- net/9p/trans_virtio.c | 13 +- net/l2tp/l2tp_core.c | 42 ++-- net/l2tp/l2tp_core.h | 3 + net/l2tp/l2tp_eth.c | 96 +++++-- net/l2tp/l2tp_ppp.c | 276 ++++++++++++--------- net/netfilter/xt_TCPMSS.c | 43 ++-- net/netfilter/xt_TCPOPTSTRIP.c | 19 +- net/rds/rdma.c | 4 + net/sctp/ipv6.c | 160 ++++++------ net/sctp/protocol.c | 12 +- net/sctp/socket.c | 33 ++- net/sctp/transport.c | 4 +- net/sctp/ulpevent.c | 2 +- sound/core/seq/seq_clientmgr.c | 10 +- sound/core/seq/seq_clientmgr.h | 1 + sound/core/timer_compat.c | 12 +- sound/pci/hda/hda_intel.c | 3 + sound/usb/clock.c | 9 +- sound/usb/mixer.c | 15 +- 80 files changed, 906 insertions(+), 636 deletions(-) Al Viro (2): autofs4: autofs4_wait() vs. autofs4_catatonic_mode() race autofs4: catatonic_mode vs. notify_daemon race Alan (1): usbip: Fix sscanf handling Alan Stern (1): USB: usbfs: compute urb->actual_length for isochronous Alexander Potapenko (1): sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Alexander Steffen (1): tpm-dev-common: Reject too short writes Alexandre Belloni (1): rtc: set the alarm to the next expiring timer Andreas Rohner (1): nilfs2: fix race condition that causes file system corruption Arnd Bergmann (2): Input: adxl34x - do not treat FIFO_MODE() as boolean isofs: fix timestamps beyond 2027 Bart Van Assche (1): IB/srp: Avoid that a cable pull can trigger a kernel crash Bart Westgeest (1): staging: usbip: removed #if 0'd out code Ben Hutchings (1): Linux 3.2.99 Bernhard Rosenkraenzer (1): USB: Add delay-init quirk for Corsair K70 LUX keyboards Brent Taylor (1): mtd: nand: Fix writing mtdoops to nand flash. Chuck Lever (1): nfs: Fix ugly referral attributes Colin Ian King (1): rtc: interface: ignore expired timers when enqueuing new timers Dan Carpenter (2): scsi: bfa: integer overflow in debugfs eCryptfs: use after free in ecryptfs_release_messaging() Eric Biggers (1): dm bufio: fix integer overflow when limiting maximum cache size Eric Dumazet (1): netfilter: xt_TCPMSS: add more sanity tests on tcph->doff Eric W. Biederman (1): net/sctp: Always set scope_id in sctp_inet6_skb_msgname Felipe Balbi (1): usb: add helper to extract bits 12:11 of wMaxPacketSize Gabriele Paoloni (1): PCI/AER: Report non-fatal errors only to the affected endpoint Guenter Roeck (1): kaiser: Set _PAGE_NX only if supported Guillaume Nault (5): l2tp: ensure sessions are freed after their PPPOL2TP socket l2tp: don't register sessions in l2tp_session_create() l2tp: initialise l2tp_eth sessions before registering them l2tp: protect sock pointer of struct pppol2tp_session with RCU l2tp: initialise PPP sessions before registering them Hou Tao (1): dm: fix race between dm_get_from_kobject() and __dm_destroy() Jan Harkes (1): coda: fix 'kernel memory exposure attempt' in fsync Jason Gunthorpe (1): sctp: Fixup v4mapped behaviour to comply with Sock API Jens Axboe (1): blktrace: fix unlocked access to init/start-stop/teardown Johan Hovold (2): USB: serial: garmin_gps: fix I/O after failed probe and remove USB: serial: garmin_gps: fix memory leak on probe errors Ladi Prosek (1): KVM: nVMX: set IDTR and GDTR limits when loading L1 host state Ladislav Michl (1): video: udlfb: Fix read EDID timeout Lepton Wu (1): kaiser: Set _PAGE_NX only if supported Mark Bloch (1): IB/mlx4: Increase maximal message size under UD QP Markus Elfring (1): media: omap_vout: Fix a possible null pointer dereference in omap_vout_open() Masami Hiramatsu (1): x86/decoder: Add new TEST instruction pattern Mauro Carvalho Chehab (1): cx231xx: Fix the max number of interfaces Michele Baldessari (1): media: Don't do DMA on stack for firmware upload in the AS102 driver Mike Snitzer (1): dm: discard support requires all targets in a table support discards Mohamed Ghannam (2): RDS: Heap OOB write in rds_message_alloc_sgs() RDS: null pointer dereference in rds_atomic_free_op Nadav Amit (1): KVM: vmx: Inject #GP on invalid PAT CR NeilBrown (2): autofs: don't fail mount for transient error autofs: fix careless error in recent commit Pablo Neira Ayuso (3): netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr() netfilter: xt_TCPMSS: fix handling of malformed TCP header and options Paolo Bonzini (1): KVM: SVM: obey guest PAT Phil Oester (2): netfilter: xt_TCPMSS: Fix missing fragmentation handling netfilter: xt_TCPMSS: correct return value in tcpmss_mangle_packet Rusty Russell (1): x86/smp: Don't ever patch back to UP if we unplug cpus Sean Young (1): media: rc: check for integer overflow Shuah Khan (4): usbip: fix stub_rx: get_pipe() to validate endpoint number usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input usbip: prevent vhci_hcd driver from leaking a socket pointer address usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer Stanislaw Gruszka (1): rt2x00usb: mark device removed when get ENOENT usb error Takashi Iwai (5): ALSA: timer: Remove kernel warning at compat ioctl error paths ALSA: usb-audio: Add sanity checks to FE parser ALSA: usb-audio: Fix potential out-of-bound access at parsing SU ALSA: usb-audio: Add sanity checks in v2 clock parsers ALSA: seq: Make ioctls race-free Tom Parkin (3): l2tp: add session reorder queue purge function to core l2tp: purge session reorder queue on delete l2tp: push all ppp pseudowire shutdown through .release handler Tuomas Tynkkynen (2): fs/9p: Compare qid.path in v9fs_test_inode net/9p: Switch to wait_event_killable() Vasily Gorbik (1): s390/disassembler: increase show_code buffer size Vijendar Mukunda (1): ALSA: hda: Add Raven PCI ID Waiman Long (1): blktrace: Fix potential deadlock between delete & sysfs ops Younger Liu (1): ocfs2: fix issue that ocfs2_setattr() does not deal with new_i_size==i_size Zhou Chengming (1): kprobes, x86/alternatives: Use text_mutex to protect smp_alt_modules