Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1354574 > unrolled thread
| Started by | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| First post | 2016-03-10 00:20 +0100 |
| Last post | 2016-03-10 01:00 +0100 |
| Articles | 20 on this page of 113 — 1 participant |
Back to article view | Back to linux.kernel
[3.13.y-ckt stable] Linux 3.13.11-ckt36 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
[PATCH 3.13.y-ckt 059/138] mm: replace vma_lock_anon_vma with anon_vma_lock_read/write Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
[PATCH 3.13.y-ckt 009/138] iio: dac: mcp4725: set iio name property in sysfs Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
[PATCH 3.13.y-ckt 017/138] drm/i915/dp: fall back to 18 bpp when sink capability is unknown Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
[PATCH 3.13.y-ckt 070/138] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
[PATCH 3.13.y-ckt 109/138] KVM: async_pf: do not warn on page allocation failures Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 126/138] sctp: translate network order to host order when users get a hmacid Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 113/138] hpfs: don't truncate the file when delete fails Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 119/138] pptp: fix illegal memory access caused by multiple bind()s Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 117/138] tcp: fix NULL deref in tcp_v4_send_ack() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 090/138] ALSA: seq: Drop superfluous error/debug messages after malloc failures Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 131/138] rtnl: RTM_GETNETCONF: fix wrong return value Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 123/138] ipv6: fix a lockdep splat Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 137/138] af_unix: Don't set err in unix_stream_read_generic unless there was an error Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 134/138] bonding: Fix ARP monitor validation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 130/138] pppoe: fix reference counting in PPPoE proxy Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 138/138] pipe: limit the per-user amount of pages allocated in pipes Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 110/138] tracing: Fix showing function event in available_events Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 114/138] do_last(): don't let a bogus return value from ->open() et.al. to confuse us Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 125/138] net:Add sysctl_max_skb_frags Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 111/138] libceph: don't bail early from try_read() when skipping a message Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 120/138] sctp: allow setting SCTP_SACK_IMMEDIATELY by the application Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 101/138] USB: option: add "4G LTE usb-modem U901" Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 115/138] af_iucv: Validate socket address length in iucv_sock_bind() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 122/138] net/ipv6: add sysctl option accept_ra_min_hop_limit Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 132/138] unix_diag: fix incorrect sign extension in unix_lookup_by_ino Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 127/138] af_unix: Guard against other == sk in unix_dgram_sendmsg Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 129/138] net/mlx4_en: Count HW buffer overrun only once Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 112/138] KVM: x86: MMU: fix ubsan index-out-of-range warning Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 097/138] drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 077/138] workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 116/138] net: dp83640: Fix tx timestamp overflow handling. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 128/138] qmi_wwan: add "4G LTE usb-modem U901" Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 136/138] net/mlx4_en: Choose time-stamping shift value according to HW frequency Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 118/138] af_unix: fix struct pid memory leak Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 135/138] ipv4: fix memory leaks in ip_cmsg_send() callers Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 133/138] sctp: Fix port hash table size computation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 124/138] unix: correctly track in-flight fds in sending process user_struct Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 121/138] ipv6/udp: use sticky pktinfo egress ifindex on connect() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
[PATCH 3.13.y-ckt 103/138] ext4: fix bh->b_state corruption Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 082/138] ARM: 8519/1: ICST: try other dividends than 1 Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 074/138] phy: twl4030-usb: Relase usb phy on unload Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 099/138] USB: option: add support for SIM7100E Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 063/138] pty: fix possible use after free of tty->driver_data Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 094/138] tracing: Fix freak link error caused by branch tracer Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 108/138] sunrpc/cache: fix off-by-one in qword_get() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 089/138] xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 085/138] ext4: don't read blocks from disk after extents being swapped Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 067/138] ALSA: dummy: Implement timer backend switching more safely Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 100/138] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 081/138] s390/dasd: fix refcount for PAV reassignment Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 064/138] pty: make sure super_block is still valid in final /dev/tty close Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 106/138] drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 096/138] drm/radeon: use post-decrement in error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 086/138] bio: return EINTR if copying to user space got interrupted Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 093/138] tracepoints: Do not trace when cpu is offline Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 072/138] ALSA: timer: Fix race between stop and interrupt Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 088/138] xen/pciback: Save the number of MSI-X entries to be copied later. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 065/138] ALSA: hda - Fix speaker output from VAIO AiO machines Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 091/138] ALSA: seq: Fix leak of pool buffer at concurrent writes Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 084/138] ext4: fix potential integer overflow Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 092/138] dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 095/138] ALSA: seq: Fix double port list deletion Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 104/138] ext4: fix crashes in dioread_nolock mode Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 058/138] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 107/138] can: ems_usb: Fix possible tx overflow Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 083/138] btrfs: properly set the termination value of ctx->pos in readdir Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 105/138] kernel/resource.c: fix muxed resource handling in __request_region() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 079/138] cifs: fix erroneous return value Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 087/138] xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 066/138] klist: fix starting point removed bug in klist iterators Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 102/138] hwmon: (ads1015) Handle negative conversion values correctly Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 098/138] NFSv4: Fix a dentry leak on alias use Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
[PATCH 3.13.y-ckt 053/138] SCSI: Add Marvell Console to VPD blacklist Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 021/138] intel_scu_ipcutil: underflow in scu_reg_access() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 041/138] target: Fix Task Aborted Status (TAS) handling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 020/138] iio: inkern: fix a NULL dereference on error Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 056/138] dump_stack: avoid potential deadlocks Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 027/138] libata: fix sff host state machine locking while polling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 060/138] radix-tree: fix oops after radix_tree_iter_retry Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 049/138] ALSA: timer: Fix leftover link at closing Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 057/138] mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 046/138] target: Fix remote-port TMR ABORT + se_cmd fabric stop Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 048/138] [media] tda1004x: only update the frontend properties if locked Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 051/138] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 023/138] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 037/138] radix-tree: fix race in gang lookup Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 035/138] ALSA: seq: Fix lockdep warnings due to double mutex locks Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 036/138] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 030/138] module: wrapper for symbol name. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 042/138] target: Add TFO->abort_task for aborted task resources release Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 040/138] xhci: Fix list corruption in urb dequeue at host removal Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 047/138] target: Fix race with SCF_SEND_DELAYED_TAS handling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 045/138] target: Fix TAS handling for multi-session se_node_acls Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 038/138] Revert "xhci: don't finish a TD if we get a short-transfer event mid TD" Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 008/138] x86/entry/compat: Add missing CLAC to entry_INT80_32 Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 024/138] ALSA: pcm: Fix potential deadlock in OSS emulation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 054/138] drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 022/138] ALSA: seq: Fix race at closing in virmidi driver Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 052/138] scsi_dh_rdac: always retry MODE SELECT on command lock violation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 031/138] ALSA: hda - Add fixup for Mac Mini 7,1 model Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 050/138] [media] saa7134-alsa: Only frees registered sound cards Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 061/138] crypto: user - lock crypto_alg_list on alg dump Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
[PATCH 3.13.y-ckt 012/138] libata: disable forced PORTS_IMPL for >= AHCI 1.3 Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
[PATCH 3.13.y-ckt 019/138] crypto: algif_hash - wait for crypto_ahash_init() to complete Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
[PATCH 3.13.y-ckt 004/138] EVM: Use crypto_memneq() for digest comparisons Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
[PATCH 3.13.y-ckt 003/138] iw_cxgb3: Fix incorrectly returning error on success Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
[PATCH 3.13.y-ckt 005/138] ALSA: usb-audio: avoid freeing umidi object twice Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
[PATCH 3.13.y-ckt 014/138] mac80211: Requeue work after scan complete for all VIF types. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
[PATCH 3.13.y-ckt 013/138] mac80211: start_next_roc only if scan was actually running Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
[PATCH 3.13.y-ckt 007/138] bcache: Fix a lockdep splat in an error path Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
[PATCH 3.13.y-ckt 018/138] target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
[PATCH 3.13.y-ckt 010/138] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
Page 1 of 6 [1] 2 3 4 5 6 Next page →
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:20 +0100 |
| Subject | [3.13.y-ckt stable] Linux 3.13.11-ckt36 stable review |
| Message-ID | <raVyx-6Nd-3@gated-at.bofh.it> |
This is the start of the review cycle for the Linux 3.13.11-ckt36 stable
kernel.
This version contains 138 new patches, summarized below. The new patches
are posted as replies to this message and also available in this git branch:
http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.13.y-review
git://kernel.ubuntu.com/ubuntu/linux.git linux-3.13.y-review
The review period for version 3.13.11-ckt36 will be open for the next three
days. To report a problem, please reply to the relevant follow-up patch
message.
For more information about the Linux 3.13.y-ckt extended stable kernel
series, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable .
-Kamal
--
Documentation/networking/ip-sysctl.txt | 8 +
Documentation/sysctl/fs.txt | 23 ++
arch/arm/common/icst.c | 9 +-
arch/powerpc/kernel/module_64.c | 2 +-
arch/x86/ia32/ia32entry.S | 1 +
arch/x86/kvm/paging_tmpl.h | 2 +-
crypto/algif_hash.c | 4 +-
crypto/crypto_user.c | 6 +-
crypto/shash.c | 7 +-
drivers/ata/ahci.c | 20 ++
drivers/ata/libahci.c | 4 +-
drivers/ata/libata-sff.c | 32 +--
drivers/dma/dw/core.c | 15 +-
drivers/gpu/drm/i915/intel_display.c | 20 +-
drivers/gpu/drm/i915/intel_i2c.c | 2 +-
drivers/gpu/drm/qxl/qxl_ioctl.c | 3 +-
drivers/gpu/drm/radeon/radeon_sa.c | 5 +
drivers/gpu/drm/radeon/radeon_ttm.c | 2 +-
drivers/hwmon/ads1015.c | 2 +-
drivers/iio/dac/mcp4725.c | 1 +
drivers/iio/inkern.c | 2 +
drivers/infiniband/hw/cxgb3/iwch_cm.c | 4 +-
drivers/infiniband/ulp/isert/ib_isert.c | 19 ++
drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +
drivers/iommu/dmar.c | 2 +-
drivers/iommu/intel_irq_remapping.c | 2 +-
drivers/md/bcache/super.c | 8 +-
drivers/media/dvb-frontends/tda1004x.c | 9 +
drivers/media/pci/saa7134/saa7134-alsa.c | 5 +-
drivers/net/bonding/bond_main.c | 39 +++-
drivers/net/can/usb/ems_usb.c | 14 +-
drivers/net/ethernet/mellanox/mlx4/en_clock.c | 25 ++-
drivers/net/ethernet/mellanox/mlx4/en_port.c | 4 +-
drivers/net/phy/dp83640.c | 17 ++
drivers/net/ppp/pppoe.c | 2 +
drivers/net/ppp/pptp.c | 34 ++-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/pci/pcie/aer/aerdrv.c | 4 +-
drivers/pci/pcie/aer/aerdrv.h | 1 -
drivers/pci/pcie/aer/aerdrv_core.c | 2 -
drivers/pci/xen-pcifront.c | 10 +-
drivers/phy/phy-twl4030-usb.c | 1 +
drivers/platform/x86/intel_scu_ipcutil.c | 2 +-
drivers/s390/block/dasd_alias.c | 23 +-
drivers/scsi/device_handler/scsi_dh_rdac.c | 4 +-
drivers/scsi/qla2xxx/tcm_qla2xxx.c | 16 ++
drivers/scsi/scsi_devinfo.c | 1 +
drivers/scsi/sg.c | 2 +-
drivers/staging/android/binder.c | 2 +-
drivers/target/iscsi/iscsi_target.c | 13 ++
drivers/target/iscsi/iscsi_target_configfs.c | 8 +
drivers/target/iscsi/iscsi_target_util.c | 4 +-
drivers/target/iscsi/iscsi_target_util.h | 1 +
drivers/target/loopback/tcm_loop.c | 6 +
drivers/target/sbp/sbp_target.c | 6 +
drivers/target/target_core_configfs.c | 4 +
drivers/target/target_core_device.c | 43 ++++
drivers/target/target_core_file.c | 29 +--
drivers/target/target_core_iblock.c | 56 ++---
drivers/target/target_core_tmr.c | 150 +++++++++----
drivers/target/target_core_transport.c | 289 ++++++++++++++++++--------
drivers/target/tcm_fc/tcm_fc.h | 1 +
drivers/target/tcm_fc/tfc_cmd.c | 5 +
drivers/target/tcm_fc/tfc_conf.c | 1 +
drivers/tty/pty.c | 21 +-
drivers/tty/serial/omap-serial.c | 8 +-
drivers/usb/gadget/tcm_usb_gadget.c | 6 +
drivers/usb/host/xhci-pci.c | 4 +-
drivers/usb/host/xhci-ring.c | 10 -
drivers/usb/host/xhci.c | 4 +-
drivers/usb/serial/cp210x.c | 2 +
drivers/usb/serial/option.c | 9 +
drivers/vhost/scsi.c | 6 +
drivers/xen/xen-pciback/pciback_ops.c | 9 +-
fs/bio.c | 12 +-
fs/btrfs/backref.c | 10 +-
fs/btrfs/delayed-inode.c | 3 +-
fs/btrfs/delayed-inode.h | 2 +-
fs/btrfs/inode.c | 14 +-
fs/cifs/cifsencrypt.c | 2 +-
fs/devpts/inode.c | 20 ++
fs/ext4/inode.c | 72 +++++--
fs/ext4/move_extent.c | 15 +-
fs/ext4/resize.c | 2 +-
fs/hpfs/namei.c | 31 +--
fs/namei.c | 4 +
fs/namespace.c | 1 +
fs/nfs/nfs4proc.c | 4 +-
fs/ocfs2/dlm/dlmrecovery.c | 2 +
fs/pipe.c | 47 ++++-
include/asm-generic/cputime_nsecs.h | 5 +-
include/drm/drm_fixed.h | 53 ++++-
include/linux/compiler.h | 2 +-
include/linux/devpts_fs.h | 4 +
include/linux/ipv6.h | 1 +
include/linux/nfs_fs.h | 4 +-
include/linux/pipe_fs_i.h | 4 +
include/linux/radix-tree.h | 22 +-
include/linux/rmap.h | 14 --
include/linux/sched.h | 1 +
include/linux/skbuff.h | 1 +
include/linux/tracepoint.h | 6 +
include/net/af_unix.h | 4 +-
include/net/scm.h | 1 +
include/sound/rawmidi.h | 4 +
include/target/iscsi/iscsi_transport.h | 1 +
include/target/target_core_backend.h | 3 +
include/target/target_core_base.h | 4 +-
include/target/target_core_fabric.h | 1 +
include/uapi/linux/ipv6.h | 1 +
kernel/module.c | 26 ++-
kernel/resource.c | 5 +-
kernel/sysctl.c | 14 ++
kernel/trace/trace_events.c | 3 +-
kernel/workqueue.c | 18 +-
lib/dump_stack.c | 7 +-
lib/klist.c | 6 +-
lib/radix-tree.c | 12 +-
mm/backing-dev.c | 2 +-
mm/mmap.c | 56 +++--
mm/vmstat.c | 3 +-
net/ceph/messenger.c | 4 +-
net/core/scm.c | 7 +
net/core/skbuff.c | 2 +
net/core/sysctl_net_core.c | 10 +
net/ipv4/devinet.c | 2 +-
net/ipv4/ip_sockglue.c | 2 +
net/ipv4/ping.c | 4 +-
net/ipv4/raw.c | 4 +-
net/ipv4/tcp.c | 4 +-
net/ipv4/tcp_ipv4.c | 13 +-
net/ipv4/udp.c | 4 +-
net/ipv6/addrconf.c | 12 +-
net/ipv6/datagram.c | 3 +
net/ipv6/ip6_flowlabel.c | 5 +-
net/ipv6/ndisc.c | 16 +-
net/iucv/af_iucv.c | 3 +
net/mac80211/ibss.c | 1 -
net/mac80211/mesh.c | 11 -
net/mac80211/mesh.h | 4 -
net/mac80211/mlme.c | 2 -
net/mac80211/scan.c | 16 +-
net/rfkill/core.c | 16 +-
net/sctp/protocol.c | 47 ++++-
net/sctp/socket.c | 10 +-
net/sunrpc/cache.c | 2 +-
net/unix/af_unix.c | 28 ++-
net/unix/diag.c | 2 +-
net/unix/garbage.c | 8 +-
security/integrity/evm/evm_main.c | 3 +-
sound/core/hwdep.c | 3 +-
sound/core/oss/pcm_oss.c | 21 +-
sound/core/rawmidi.c | 169 ++++++++++-----
sound/core/seq/seq_clientmgr.c | 3 +
sound/core/seq/seq_fifo.c | 4 +-
sound/core/seq/seq_memory.c | 19 +-
sound/core/seq/seq_ports.c | 240 +++++++++++----------
sound/core/seq/seq_prioq.c | 4 +-
sound/core/seq/seq_queue.c | 4 +-
sound/core/seq/seq_timer.c | 91 ++++++--
sound/core/seq/seq_virmidi.c | 23 +-
sound/core/timer.c | 72 +++++--
sound/drivers/dummy.c | 37 ++--
sound/pci/hda/patch_cirrus.c | 27 +++
sound/pci/hda/patch_hdmi.c | 3 +-
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/soc-pcm.c | 3 +-
sound/usb/midi.c | 1 -
virt/kvm/async_pf.c | 2 +-
169 files changed, 1815 insertions(+), 813 deletions(-)
Al Viro (1):
do_last(): don't let a bogus return value from ->open() et.al. to confuse us
Alex Leung (1):
target: Fix Task Aborted Status (TAS) handling
Alexandra Yates (1):
ahci: Intel DNV device IDs SATA
Amir Vadai (1):
net/mlx4_en: Count HW buffer overrun only once
Andreas Schwab (1):
powerpc: Fix dedotify for binutils >= 2.26
Andrey Konovalov (1):
ALSA: usb-audio: avoid freeing umidi object twice
Andrey Skvortsov (1):
USB: option: add support for SIM7100E
Andy Lutomirski (1):
x86/entry/compat: Add missing CLAC to entry_INT80_32
Andy Shevchenko (1):
dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer
Anton Protopopov (2):
cifs: fix erroneous return value
rtnl: RTM_GETNETCONF: fix wrong return value
Arnd Bergmann (1):
tracing: Fix freak link error caused by branch tracer
Benjamin Coddington (1):
NFSv4: Fix a dentry leak on alias use
Bjørn Mork (2):
USB: option: add "4G LTE usb-modem U901"
qmi_wwan: add "4G LTE usb-modem U901"
CQ Tang (1):
iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG
Christian Borntraeger (1):
KVM: async_pf: do not warn on page allocation failures
Christoph Hellwig (1):
nfs: fix nfs_size_to_loff_t
Dan Carpenter (2):
iio: inkern: fix a NULL dereference on error
intel_scu_ipcutil: underflow in scu_reg_access()
David Henningsson (1):
ALSA: hda - Fix static checker warning in patch_hdmi.c
David Sterba (1):
btrfs: properly set the termination value of ctx->pos in readdir
Dmitry V. Levin (1):
unix_diag: fix incorrect sign extension in unix_lookup_by_ino
Eliad Peller (1):
mac80211: start_next_roc only if scan was actually running
Eric Dumazet (5):
dump_stack: avoid potential deadlocks
tcp: fix NULL deref in tcp_v4_send_ack()
af_unix: fix struct pid memory leak
ipv6: fix a lockdep splat
ipv4: fix memory leaks in ip_cmsg_send() callers
Eric W. Biederman (1):
umount: Do not allow unmounting rootfs.
Eryu Guan (1):
ext4: don't read blocks from disk after extents being swapped
Eugenia Emantayev (1):
net/mlx4_en: Choose time-stamping shift value according to HW frequency
Filipe Manana (1):
Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl
Gerd Hoffmann (1):
drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command
Gerhard Uttenthaler (1):
can: ems_usb: Fix possible tx overflow
Guillaume Nault (1):
pppoe: fix reference counting in PPPoE proxy
Hangbin Liu (1):
net/ipv6: add sysctl option accept_ra_min_hop_limit
Hannes Frederic Sowa (2):
pptp: fix illegal memory access caused by multiple bind()s
unix: correctly track in-flight fds in sending process user_struct
Hannes Reinecke (2):
scsi_dh_rdac: always retry MODE SELECT on command lock violation
bio: return EINTR if copying to user space got interrupted
Hans Westgaard Ry (1):
net:Add sysctl_max_skb_frags
Hariprasad S (1):
iw_cxgb3: Fix incorrectly returning error on success
Harry Wentland (1):
drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil
Herbert Xu (1):
crypto: shash - Fix has_key setting
Herton R. Krzesinski (2):
pty: fix possible use after free of tty->driver_data
pty: make sure super_block is still valid in final /dev/tty close
Ilya Dryomov (1):
libceph: don't bail early from try_read() when skipping a message
Insu Yun (1):
ext4: fix potential integer overflow
James Bottomley (1):
klist: fix starting point removed bug in klist iterators
Jan Kara (2):
ext4: fix bh->b_state corruption
ext4: fix crashes in dioread_nolock mode
Jani Nikula (1):
drm/i915/dp: fall back to 18 bpp when sink capability is unknown
Jay Vosburgh (1):
bonding: Fix ARP monitor validation
Johannes Berg (1):
rfkill: fix rfkill_fop_read wait_event usage
Ken Lin (1):
USB: cp210x: add IDs for GE B650V3 and B850V3 boards
Kent Overstreet (1):
bcache: Fix a lockdep splat in an error path
Kirill A. Shutemov (1):
drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration
Konrad Rzeszutek Wilk (3):
xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY
xen/pciback: Save the number of MSI-X entries to be copied later.
xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted.
Konstantin Khlebnikov (2):
mm: replace vma_lock_anon_vma with anon_vma_lock_read/write
radix-tree: fix oops after radix_tree_iter_retry
Linus Torvalds (1):
vmstat: explicitly schedule per-cpu work on the CPU we need it to run on
Linus Walleij (2):
ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz()
ARM: 8519/1: ICST: try other dividends than 1
Lisa Du (1):
drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE
Lu Baolu (1):
usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms
Manfred Rudigier (1):
net: dp83640: Fix tx timestamp overflow handling.
Marcelo Ricardo Leitner (1):
sctp: allow setting SCTP_SACK_IMMEDIATELY by the application
Mathias Krause (1):
crypto: user - lock crypto_alg_list on alg dump
Mathias Nyman (2):
Revert "xhci: don't finish a TD if we get a short-transfer event mid TD"
xhci: Fix list corruption in urb dequeue at host removal
Matthew Wilcox (1):
radix-tree: fix race in gang lookup
Mauro Carvalho Chehab (2):
[media] tda1004x: only update the frontend properties if locked
[media] saa7134-alsa: Only frees registered sound cards
Mika Westerberg (1):
SCSI: Add Marvell Console to VPD blacklist
Mike Christie (1):
target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors
Mike Krinkin (1):
KVM: x86: MMU: fix ubsan index-out-of-range warning
Mikulas Patocka (1):
hpfs: don't truncate the file when delete fails
Neil Horman (1):
sctp: Fix port hash table size computation
Nicholas Bellinger (6):
target: Add TFO->abort_task for aborted task resources release
target: Fix LUN_RESET active TMR descriptor handling
target: Fix LUN_RESET active I/O handling for ACK_KREF
target: Fix TAS handling for multi-session se_node_acls
target: Fix remote-port TMR ABORT + se_cmd fabric stop
target: Fix race with SCF_SEND_DELAYED_TAS handling
Nicolai Hähnle (1):
drm/radeon: hold reference to fences in radeon_sa_bo_new
Paolo Abeni (1):
ipv6/udp: use sticky pktinfo egress ifindex on connect()
Peter Hurley (1):
serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485)
Peter Rosin (1):
hwmon: (ads1015) Handle negative conversion values correctly
Rainer Weikusat (2):
af_unix: Guard against other == sk in unix_dgram_sendmsg
af_unix: Don't set err in unix_stream_read_generic unless there was an error
Rasmus Villemoes (2):
drm/i915: fix error path in intel_setup_gmbus()
drm/radeon: use post-decrement in error handling
Rusty Russell (1):
module: wrapper for symbol name.
Ryan Ware (1):
EVM: Use crypto_memneq() for digest comparisons
Sachin Kulkarni (1):
mac80211: Requeue work after scan complete for all VIF types.
Sebastian Andrzej Siewior (1):
PCI/AER: Flush workqueue on device remove to avoid use-after-free
Simon Guinot (1):
kernel/resource.c: fix muxed resource handling in __request_region()
Stefan Haberland (2):
s390/dasd: prevent incorrect length error under z/VM after PAV changes
s390/dasd: fix refcount for PAV reassignment
Stefan Hajnoczi (1):
sunrpc/cache: fix off-by-one in qword_get()
Steven Rostedt (Red Hat) (2):
tracepoints: Do not trace when cpu is offline
tracing: Fix showing function event in available_events
Takashi Iwai (19):
ALSA: seq: Fix race at closing in virmidi driver
ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check
ALSA: pcm: Fix potential deadlock in OSS emulation
ALSA: seq: Fix yet another races among ALSA timer accesses
ALSA: timer: Fix link corruption due to double start or stop
ALSA: hda - Add fixup for Mac Mini 7,1 model
ALSA: Move EXPORT_SYMBOL() in appropriate places
ALSA: rawmidi: Make snd_rawmidi_transmit() race-free
ALSA: rawmidi: Fix race at copying & updating the position
ALSA: seq: Fix lockdep warnings due to double mutex locks
ALSA: timer: Fix leftover link at closing
ALSA: hda - Fix speaker output from VAIO AiO machines
ALSA: dummy: Implement timer backend switching more safely
ALSA: timer: Fix wrong instance passed to slave callbacks
ALSA: timer: Fix race between stop and interrupt
ALSA: timer: Fix race at concurrent reads
ALSA: seq: Drop superfluous error/debug messages after malloc failures
ALSA: seq: Fix leak of pool buffer at concurrent writes
ALSA: seq: Fix double port list deletion
Tejun Heo (4):
Revert "workqueue: make sure delayed work run in local cpu"
libata: disable forced PORTS_IMPL for >= AHCI 1.3
libata: fix sff host state machine locking while polling
workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup
Tetsuo Handa (1):
mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress
Tony Lindgren (1):
phy: twl4030-usb: Relase usb phy on unload
Ursula Braun (1):
af_iucv: Validate socket address length in iucv_sock_bind()
Vinod Koul (1):
ASoC: dpcm: fix the BE state on hw_free
Wang, Rui Y (1):
crypto: algif_hash - wait for crypto_ahash_init() to complete
Willy Tarreau (1):
pipe: limit the per-user amount of pages allocated in pipes
Xin Long (1):
sctp: translate network order to host order when users get a hmacid
Yong Li (1):
iio: dac: mcp4725: set iio name property in sysfs
xuejiufei (1):
ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup
zengtao (1):
cputime: Prevent 32bit overflow in time[val|spec]_to_cputime()
[toc] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 059/138] mm: replace vma_lock_anon_vma with anon_vma_lock_read/write |
| Message-ID | <raVyz-6Nd-65@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Konstantin Khlebnikov <koct9i@gmail.com>
commit 12352d3cae2cebe18805a91fab34b534d7444231 upstream.
Sequence vma_lock_anon_vma() - vma_unlock_anon_vma() isn't safe if
anon_vma appeared between lock and unlock. We have to check anon_vma
first or call anon_vma_prepare() to be sure that it's here. There are
only few users of these legacy helpers. Let's get rid of them.
This patch fixes anon_vma lock imbalance in validate_mm(). Write lock
isn't required here, read lock is enough.
And reorders expand_downwards/expand_upwards: security_mmap_addr() and
wrapping-around check don't have to be under anon vma lock.
Link: https://lkml.kernel.org/r/CACT4Y+Y908EjM2z=706dv4rV6dWtxTLK9nFg9_7DhRMLppBo2g@mail.gmail.com
Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
include/linux/rmap.h | 14 -------------
mm/mmap.c | 56 ++++++++++++++++++++++++----------------------------
2 files changed, 26 insertions(+), 44 deletions(-)
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index fc7c6cb..8a3ded5 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -114,20 +114,6 @@ static inline struct anon_vma *page_anon_vma(struct page *page)
return page_rmapping(page);
}
-static inline void vma_lock_anon_vma(struct vm_area_struct *vma)
-{
- struct anon_vma *anon_vma = vma->anon_vma;
- if (anon_vma)
- down_write(&anon_vma->root->rwsem);
-}
-
-static inline void vma_unlock_anon_vma(struct vm_area_struct *vma)
-{
- struct anon_vma *anon_vma = vma->anon_vma;
- if (anon_vma)
- up_write(&anon_vma->root->rwsem);
-}
-
static inline void anon_vma_lock_write(struct anon_vma *anon_vma)
{
down_write(&anon_vma->root->rwsem);
diff --git a/mm/mmap.c b/mm/mmap.c
index e3bd471..daab5f9 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -411,11 +411,16 @@ void validate_mm(struct mm_struct *mm)
unsigned long highest_address = 0;
struct vm_area_struct *vma = mm->mmap;
while (vma) {
+ struct anon_vma *anon_vma = vma->anon_vma;
struct anon_vma_chain *avc;
- vma_lock_anon_vma(vma);
- list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
- anon_vma_interval_tree_verify(avc);
- vma_unlock_anon_vma(vma);
+
+ if (anon_vma) {
+ anon_vma_lock_read(anon_vma);
+ list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
+ anon_vma_interval_tree_verify(avc);
+ anon_vma_unlock_read(anon_vma);
+ }
+
highest_address = vma->vm_end;
vma = vma->vm_next;
i++;
@@ -2097,32 +2102,27 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
*/
int expand_upwards(struct vm_area_struct *vma, unsigned long address)
{
- int error;
+ int error = 0;
if (!(vma->vm_flags & VM_GROWSUP))
return -EFAULT;
- /*
- * We must make sure the anon_vma is allocated
- * so that the anon_vma locking is not a noop.
- */
+ /* Guard against wrapping around to address 0. */
+ if (address < PAGE_ALIGN(address+4))
+ address = PAGE_ALIGN(address+4);
+ else
+ return -ENOMEM;
+
+ /* We must make sure the anon_vma is allocated. */
if (unlikely(anon_vma_prepare(vma)))
return -ENOMEM;
- vma_lock_anon_vma(vma);
/*
* vma->vm_start/vm_end cannot change under us because the caller
* is required to hold the mmap_sem in read mode. We need the
* anon_vma lock to serialize against concurrent expand_stacks.
- * Also guard against wrapping around to address 0.
*/
- if (address < PAGE_ALIGN(address+4))
- address = PAGE_ALIGN(address+4);
- else {
- vma_unlock_anon_vma(vma);
- return -ENOMEM;
- }
- error = 0;
+ anon_vma_lock_write(vma->anon_vma);
/* Somebody else might have raced and expanded it already */
if (address > vma->vm_end) {
@@ -2140,7 +2140,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
* updates, but we only hold a shared mmap_sem
* lock here, so we need to protect against
* concurrent vma expansions.
- * vma_lock_anon_vma() doesn't help here, as
+ * anon_vma_lock_write() doesn't help here, as
* we don't guarantee that all growable vmas
* in a mm share the same root anon vma.
* So, we reuse mm->page_table_lock to guard
@@ -2160,7 +2160,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
}
}
}
- vma_unlock_anon_vma(vma);
+ anon_vma_unlock_write(vma->anon_vma);
khugepaged_enter_vma_merge(vma, vma->vm_flags);
validate_mm(vma->vm_mm);
return error;
@@ -2175,25 +2175,21 @@ int expand_downwards(struct vm_area_struct *vma,
{
int error;
- /*
- * We must make sure the anon_vma is allocated
- * so that the anon_vma locking is not a noop.
- */
- if (unlikely(anon_vma_prepare(vma)))
- return -ENOMEM;
-
address &= PAGE_MASK;
error = security_mmap_addr(address);
if (error)
return error;
- vma_lock_anon_vma(vma);
+ /* We must make sure the anon_vma is allocated. */
+ if (unlikely(anon_vma_prepare(vma)))
+ return -ENOMEM;
/*
* vma->vm_start/vm_end cannot change under us because the caller
* is required to hold the mmap_sem in read mode. We need the
* anon_vma lock to serialize against concurrent expand_stacks.
*/
+ anon_vma_lock_write(vma->anon_vma);
/* Somebody else might have raced and expanded it already */
if (address < vma->vm_start) {
@@ -2211,7 +2207,7 @@ int expand_downwards(struct vm_area_struct *vma,
* updates, but we only hold a shared mmap_sem
* lock here, so we need to protect against
* concurrent vma expansions.
- * vma_lock_anon_vma() doesn't help here, as
+ * anon_vma_lock_write() doesn't help here, as
* we don't guarantee that all growable vmas
* in a mm share the same root anon vma.
* So, we reuse mm->page_table_lock to guard
@@ -2229,7 +2225,7 @@ int expand_downwards(struct vm_area_struct *vma,
}
}
}
- vma_unlock_anon_vma(vma);
+ anon_vma_unlock_write(vma->anon_vma);
khugepaged_enter_vma_merge(vma, vma->vm_flags);
validate_mm(vma->vm_mm);
return error;
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 009/138] iio: dac: mcp4725: set iio name property in sysfs |
| Message-ID | <raVyA-6Nd-71@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Yong Li <sdliyong@gmail.com> commit 97a249e98a72d6b79fb7350a8dd56b147e9d5bdb upstream. Without this change, the name entity for mcp4725 is missing in /sys/bus/iio/devices/iio\:device*/name With this change, name is reported correctly Signed-off-by: Yong Li <sdliyong@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- drivers/iio/dac/mcp4725.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iio/dac/mcp4725.c b/drivers/iio/dac/mcp4725.c index 9f57ae8..247e54c 100644 --- a/drivers/iio/dac/mcp4725.c +++ b/drivers/iio/dac/mcp4725.c @@ -302,6 +302,7 @@ static int mcp4725_probe(struct i2c_client *client, data->client = client; indio_dev->dev.parent = &client->dev; + indio_dev->name = id->name; indio_dev->info = &mcp4725_info; indio_dev->channels = &mcp4725_channel; indio_dev->num_channels = 1; -- 2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 017/138] drm/i915/dp: fall back to 18 bpp when sink capability is unknown |
| Message-ID | <raVyA-6Nd-73@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jani Nikula <jani.nikula@intel.com>
commit 5efd407674068dede403551bea3b0b134c32513a upstream.
Per DP spec, the source device should fall back to 18 bpp, VESA range
RGB when the sink capability is unknown. Fix the color depth
clamping. 18 bpp color depth should ensure full color range in automatic
mode.
The clamping has been HDMI specific since its introduction in
commit 996a2239f93b03c5972923f04b097f65565c5bed
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date: Fri Apr 19 11:24:34 2013 +0200
drm/i915: Disable high-bpc on pre-1.4 EDID screens
Reported-and-tested-by: Dihan Wickremasuriya <nayomal@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=105331
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1452695720-7076-1-git-send-email-jani.nikula@intel.com
(cherry picked from commit 013dd9e038723bbd2aa67be51847384b75be8253)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/i915/intel_display.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index cb8515b..4d9933a 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -8590,11 +8590,21 @@ connected_sink_compute_bpp(struct intel_connector * connector,
pipe_config->pipe_bpp = connector->base.display_info.bpc*3;
}
- /* Clamp bpp to 8 on screens without EDID 1.4 */
- if (connector->base.display_info.bpc == 0 && bpp > 24) {
- DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of 24\n",
- bpp);
- pipe_config->pipe_bpp = 24;
+ /* Clamp bpp to default limit on screens without EDID 1.4 */
+ if (connector->base.display_info.bpc == 0) {
+ int type = connector->base.connector_type;
+ int clamp_bpp = 24;
+
+ /* Fall back to 18 bpp when DP sink capability is unknown. */
+ if (type == DRM_MODE_CONNECTOR_DisplayPort ||
+ type == DRM_MODE_CONNECTOR_eDP)
+ clamp_bpp = 18;
+
+ if (bpp > clamp_bpp) {
+ DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of %d\n",
+ bpp, clamp_bpp);
+ pipe_config->pipe_bpp = clamp_bpp;
+ }
}
}
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 070/138] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() |
| Message-ID | <raVyA-6Nd-69@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit 5070fb14a0154f075c8b418e5bc58a620ae85a45 upstream.
When trying to set the ICST 307 clock to 25174000 Hz I ran into
this arithmetic error: the icst_hz_to_vco() correctly figure out
DIVIDE=2, RDW=100 and VDW=99 yielding a frequency of
25174000 Hz out of the VCO. (I replicated the icst_hz() function
in a spreadsheet to verify this.)
However, when I called icst_hz() on these VCO settings it would
instead return 4122709 Hz. This causes an error in the common
clock driver for ICST as the common clock framework will call
.round_rate() on the clock which will utilize icst_hz_to_vco()
followed by icst_hz() suggesting the erroneous frequency, and
then the clock gets set to this.
The error did not manifest in the old clock framework since
this high frequency was only used by the CLCD, which calls
clk_set_rate() without first calling clk_round_rate() and since
the old clock framework would not call clk_round_rate() before
setting the frequency, the correct values propagated into
the VCO.
After some experimenting I figured out that it was due to a simple
arithmetic overflow: the divisor for 24Mhz reference frequency
as reference becomes 24000000*2*(99+8)=0x132212400 and the "1"
in bit 32 overflows and is lost.
But introducing an explicit 64-by-32 bit do_div() and casting
the divisor into (u64) we get the right frequency back, and the
right frequency gets set.
Tested on the ARM Versatile.
Cc: linux-clk@vger.kernel.org
Cc: Pawel Moll <pawel.moll@arm.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/arm/common/icst.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/arch/arm/common/icst.c b/arch/arm/common/icst.c
index 2dc6da70..d3c0e69 100644
--- a/arch/arm/common/icst.c
+++ b/arch/arm/common/icst.c
@@ -16,7 +16,7 @@
*/
#include <linux/module.h>
#include <linux/kernel.h>
-
+#include <asm/div64.h>
#include <asm/hardware/icst.h>
/*
@@ -29,7 +29,11 @@ EXPORT_SYMBOL(icst525_s2div);
unsigned long icst_hz(const struct icst_params *p, struct icst_vco vco)
{
- return p->ref * 2 * (vco.v + 8) / ((vco.r + 2) * p->s2div[vco.s]);
+ u64 dividend = p->ref * 2 * (u64)(vco.v + 8);
+ u32 divisor = (vco.r + 2) * p->s2div[vco.s];
+
+ do_div(dividend, divisor);
+ return (unsigned long)dividend;
}
EXPORT_SYMBOL(icst_hz);
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 109/138] KVM: async_pf: do not warn on page allocation failures |
| Message-ID | <raVIe-6Sb-3@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Christian Borntraeger <borntraeger@de.ibm.com> commit d7444794a02ff655eda87e3cc54e86b940e7736f upstream. In async_pf we try to allocate with NOWAIT to get an element quickly or fail. This code also handle failures gracefully. Lets silence potential page allocation failures under load. qemu-system-s39: page allocation failure: order:0,mode:0x2200000 [...] Call Trace: ([<00000000001146b8>] show_trace+0xf8/0x148) [<000000000011476a>] show_stack+0x62/0xe8 [<00000000004a36b8>] dump_stack+0x70/0x98 [<0000000000272c3a>] warn_alloc_failed+0xd2/0x148 [<000000000027709e>] __alloc_pages_nodemask+0x94e/0xb38 [<00000000002cd36a>] new_slab+0x382/0x400 [<00000000002cf7ac>] ___slab_alloc.constprop.30+0x2dc/0x378 [<00000000002d03d0>] kmem_cache_alloc+0x160/0x1d0 [<0000000000133db4>] kvm_setup_async_pf+0x6c/0x198 [<000000000013dee8>] kvm_arch_vcpu_ioctl_run+0xd48/0xd58 [<000000000012fcaa>] kvm_vcpu_ioctl+0x372/0x690 [<00000000002f66f6>] do_vfs_ioctl+0x3be/0x510 [<00000000002f68ec>] SyS_ioctl+0xa4/0xb8 [<0000000000781c5e>] system_call+0xd6/0x264 [<000003ffa24fa06a>] 0x3ffa24fa06a Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Dominik Dingel <dingel@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- virt/kvm/async_pf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c index f2c80d5..9190950 100644 --- a/virt/kvm/async_pf.c +++ b/virt/kvm/async_pf.c @@ -152,7 +152,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn, * do alloc nowait since if we are going to sleep anyway we * may as well sleep faulting in page */ - work = kmem_cache_zalloc(async_pf_cache, GFP_NOWAIT); + work = kmem_cache_zalloc(async_pf_cache, GFP_NOWAIT | __GFP_NOWARN); if (!work) return 0; -- 2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 126/138] sctp: translate network order to host order when users get a hmacid |
| Message-ID | <raVIe-6Sb-7@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Xin Long <lucien.xin@gmail.com>
commit 7a84bd46647ff181eb2659fdc99590e6f16e501d upstream.
Commit ed5a377d87dc ("sctp: translate host order to network order when
setting a hmacid") corrected the hmacid byte-order when setting a hmacid.
but the same issue also exists on getting a hmacid.
We fix it by changing hmacids to host order when users get them with
getsockopt.
Fixes: Commit ed5a377d87dc ("sctp: translate host order to network order when setting a hmacid")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/sctp/socket.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index fdd6a8305..2aac2d8 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5385,6 +5385,7 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
struct sctp_hmac_algo_param *hmacs;
__u16 data_len = 0;
u32 num_idents;
+ int i;
if (!ep->auth_enable)
return -EACCES;
@@ -5402,8 +5403,12 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
return -EFAULT;
if (put_user(num_idents, &p->shmac_num_idents))
return -EFAULT;
- if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
- return -EFAULT;
+ for (i = 0; i < num_idents; i++) {
+ __u16 hmacid = ntohs(hmacs->hmac_ids[i]);
+
+ if (copy_to_user(&p->shmac_idents[i], &hmacid, sizeof(__u16)))
+ return -EFAULT;
+ }
return 0;
}
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 113/138] hpfs: don't truncate the file when delete fails |
| Message-ID | <raVIe-6Sb-5@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Mikulas Patocka <mikulas@twibright.com>
commit b6853f78e763d42c7a158d8de3549c9827c604ab upstream.
The delete opration can allocate additional space on the HPFS filesystem
due to btree split. The HPFS driver checks in advance if there is
available space, so that it won't corrupt the btree if we run out of space
during splitting.
If there is not enough available space, the HPFS driver attempted to
truncate the file, but this results in a deadlock since the commit
7dd29d8d865efdb00c0542a5d2c87af8c52ea6c7 ("HPFS: Introduce a global mutex
and lock it on every callback from VFS").
This patch removes the code that tries to truncate the file and -ENOSPC is
returned instead. If the user hits -ENOSPC on delete, he should try to
delete other files (that are stored in a leaf btree node), so that the
delete operation will make some space for deleting the file stored in
non-leaf btree node.
Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
fs/hpfs/namei.c | 31 +++----------------------------
1 file changed, 3 insertions(+), 28 deletions(-)
diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
index 5f60bb2..12da295 100644
--- a/fs/hpfs/namei.c
+++ b/fs/hpfs/namei.c
@@ -377,12 +377,11 @@ static int hpfs_unlink(struct inode *dir, struct dentry *dentry)
struct inode *inode = dentry->d_inode;
dnode_secno dno;
int r;
- int rep = 0;
int err;
hpfs_lock(dir->i_sb);
hpfs_adjust_length(name, &len);
-again:
+
err = -ENOENT;
de = map_dirent(dir, hpfs_i(dir)->i_dno, name, len, &dno, &qbh);
if (!de)
@@ -402,33 +401,9 @@ again:
hpfs_error(dir->i_sb, "there was error when removing dirent");
err = -EFSERROR;
break;
- case 2: /* no space for deleting, try to truncate file */
-
+ case 2: /* no space for deleting */
err = -ENOSPC;
- if (rep++)
- break;
-
- dentry_unhash(dentry);
- if (!d_unhashed(dentry)) {
- hpfs_unlock(dir->i_sb);
- return -ENOSPC;
- }
- if (generic_permission(inode, MAY_WRITE) ||
- !S_ISREG(inode->i_mode) ||
- get_write_access(inode)) {
- d_rehash(dentry);
- } else {
- struct iattr newattrs;
- /*printk("HPFS: truncating file before delete.\n");*/
- newattrs.ia_size = 0;
- newattrs.ia_valid = ATTR_SIZE | ATTR_CTIME;
- err = notify_change(dentry, &newattrs, NULL);
- put_write_access(inode);
- if (!err)
- goto again;
- }
- hpfs_unlock(dir->i_sb);
- return -ENOSPC;
+ break;
default:
drop_nlink(inode);
err = 0;
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 119/138] pptp: fix illegal memory access caused by multiple bind()s |
| Message-ID | <raVIe-6Sb-9@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hannes Frederic Sowa <hannes@stressinduktion.org>
commit 9a368aff9cb370298fa02feeffa861f2db497c18 upstream.
Several times already this has been reported as kasan reports caused by
syzkaller and trinity and people always looked at RCU races, but it is
much more simple. :)
In case we bind a pptp socket multiple times, we simply add it to
the callid_sock list but don't remove the old binding. Thus the old
socket stays in the bucket with unused call_id indexes and doesn't get
cleaned up. This causes various forms of kasan reports which were hard
to pinpoint.
Simply don't allow multiple binds and correct error handling in
pptp_bind. Also keep sk_state bits in place in pptp_connect.
Fixes: 00959ade36acad ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
Cc: Dmitry Kozlov <xeb@mail.ru>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Dave Jones <davej@codemonkey.org.uk>
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/ppp/pptp.c | 34 ++++++++++++++++++++++++----------
1 file changed, 24 insertions(+), 10 deletions(-)
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 0710214..bb1ab1f 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -131,24 +131,27 @@ static int lookup_chan_dst(u16 call_id, __be32 d_addr)
return i < MAX_CALLID;
}
-static int add_chan(struct pppox_sock *sock)
+static int add_chan(struct pppox_sock *sock,
+ struct pptp_addr *sa)
{
static int call_id;
spin_lock(&chan_lock);
- if (!sock->proto.pptp.src_addr.call_id) {
+ if (!sa->call_id) {
call_id = find_next_zero_bit(callid_bitmap, MAX_CALLID, call_id + 1);
if (call_id == MAX_CALLID) {
call_id = find_next_zero_bit(callid_bitmap, MAX_CALLID, 1);
if (call_id == MAX_CALLID)
goto out_err;
}
- sock->proto.pptp.src_addr.call_id = call_id;
- } else if (test_bit(sock->proto.pptp.src_addr.call_id, callid_bitmap))
+ sa->call_id = call_id;
+ } else if (test_bit(sa->call_id, callid_bitmap)) {
goto out_err;
+ }
- set_bit(sock->proto.pptp.src_addr.call_id, callid_bitmap);
- rcu_assign_pointer(callid_sock[sock->proto.pptp.src_addr.call_id], sock);
+ sock->proto.pptp.src_addr = *sa;
+ set_bit(sa->call_id, callid_bitmap);
+ rcu_assign_pointer(callid_sock[sa->call_id], sock);
spin_unlock(&chan_lock);
return 0;
@@ -417,7 +420,6 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
struct sock *sk = sock->sk;
struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr;
struct pppox_sock *po = pppox_sk(sk);
- struct pptp_opt *opt = &po->proto.pptp;
int error = 0;
if (sockaddr_len < sizeof(struct sockaddr_pppox))
@@ -425,10 +427,22 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
lock_sock(sk);
- opt->src_addr = sp->sa_addr.pptp;
- if (add_chan(po))
+ if (sk->sk_state & PPPOX_DEAD) {
+ error = -EALREADY;
+ goto out;
+ }
+
+ if (sk->sk_state & PPPOX_BOUND) {
error = -EBUSY;
+ goto out;
+ }
+
+ if (add_chan(po, &sp->sa_addr.pptp))
+ error = -EBUSY;
+ else
+ sk->sk_state |= PPPOX_BOUND;
+out:
release_sock(sk);
return error;
}
@@ -499,7 +513,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
}
opt->dst_addr = sp->sa_addr.pptp;
- sk->sk_state = PPPOX_CONNECTED;
+ sk->sk_state |= PPPOX_CONNECTED;
end:
release_sock(sk);
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 117/138] tcp: fix NULL deref in tcp_v4_send_ack() |
| Message-ID | <raVIe-6Sb-15@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Eric Dumazet <edumazet@google.com>
commit e62a123b8ef7c5dc4db2c16383d506860ad21b47 upstream.
Neal reported crashes with this stack trace :
RIP: 0010:[<ffffffff8c57231b>] tcp_v4_send_ack+0x41/0x20f
...
CR2: 0000000000000018 CR3: 000000044005c000 CR4: 00000000001427e0
...
[<ffffffff8c57258e>] tcp_v4_reqsk_send_ack+0xa5/0xb4
[<ffffffff8c1a7caa>] tcp_check_req+0x2ea/0x3e0
[<ffffffff8c19e420>] tcp_rcv_state_process+0x850/0x2500
[<ffffffff8c1a6d21>] tcp_v4_do_rcv+0x141/0x330
[<ffffffff8c56cdb2>] sk_backlog_rcv+0x21/0x30
[<ffffffff8c098bbd>] tcp_recvmsg+0x75d/0xf90
[<ffffffff8c0a8700>] inet_recvmsg+0x80/0xa0
[<ffffffff8c17623e>] sock_aio_read+0xee/0x110
[<ffffffff8c066fcf>] do_sync_read+0x6f/0xa0
[<ffffffff8c0673a1>] SyS_read+0x1e1/0x290
[<ffffffff8c5ca262>] system_call_fastpath+0x16/0x1b
The problem here is the skb we provide to tcp_v4_send_ack() had to
be parked in the backlog of a new TCP fastopen child because this child
was owned by the user at the time an out of window packet arrived.
Before queuing a packet, TCP has to set skb->dev to NULL as the device
could disappear before packet is removed from the queue.
Fix this issue by using the net pointer provided by the socket (being a
timewait or a request socket).
IPv6 is immune to the bug : tcp_v6_send_response() already gets the net
pointer from the socket if provided.
Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path")
Reported-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jerry Chu <hkchu@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/ipv4/tcp_ipv4.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index fcb88df..98f3eb8 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -710,7 +710,8 @@ release_sk1:
outside socket context is ugly, certainly. What can I do?
*/
-static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
+static void tcp_v4_send_ack(struct net *net,
+ struct sk_buff *skb, u32 seq, u32 ack,
u32 win, u32 tsval, u32 tsecr, int oif,
struct tcp_md5sig_key *key,
int reply_flags, u8 tos)
@@ -725,7 +726,6 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
];
} rep;
struct ip_reply_arg arg;
- struct net *net = dev_net(skb_dst(skb)->dev);
memset(&rep.th, 0, sizeof(struct tcphdr));
memset(&arg, 0, sizeof(arg));
@@ -786,7 +786,8 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
struct inet_timewait_sock *tw = inet_twsk(sk);
struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
- tcp_v4_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
+ tcp_v4_send_ack(sock_net(sk), skb,
+ tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
tcp_time_stamp + tcptw->tw_ts_offset,
tcptw->tw_ts_recent,
@@ -805,8 +806,10 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
/* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
* sk->sk_state == TCP_SYN_RECV -> for Fast Open.
*/
- tcp_v4_send_ack(skb, (sk->sk_state == TCP_LISTEN) ?
- tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
+ u32 seq = (sk->sk_state == TCP_LISTEN) ? tcp_rsk(req)->snt_isn + 1 :
+ tcp_sk(sk)->snd_nxt;
+
+ tcp_v4_send_ack(sock_net(sk), skb, seq,
tcp_rsk(req)->rcv_nxt, req->rcv_wnd,
tcp_time_stamp,
req->ts_recent,
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 090/138] ALSA: seq: Drop superfluous error/debug messages after malloc failures |
| Message-ID | <raVIe-6Sb-19@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Takashi Iwai <tiwai@suse.de>
commit 24db8bbaa3fcfaf0c2faccbff5864b58088ac1f6 upstream.
The kernel memory allocators already report the errors when the
requested allocation fails, thus we don't need to warn it again in
each caller side.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ kamal: backport to 3.13-stable: context ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
sound/core/seq/seq_fifo.c | 4 +---
sound/core/seq/seq_memory.c | 8 ++------
sound/core/seq/seq_ports.c | 4 +---
sound/core/seq/seq_prioq.c | 4 +---
sound/core/seq/seq_queue.c | 4 +---
sound/core/seq/seq_timer.c | 4 +---
6 files changed, 7 insertions(+), 21 deletions(-)
diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
index 0d75afa..42c9bd8 100644
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -33,10 +33,8 @@ struct snd_seq_fifo *snd_seq_fifo_new(int poolsize)
struct snd_seq_fifo *f;
f = kzalloc(sizeof(*f), GFP_KERNEL);
- if (f == NULL) {
- snd_printd("malloc failed for snd_seq_fifo_new() \n");
+ if (!f)
return NULL;
- }
f->pool = snd_seq_pool_new(poolsize);
if (f->pool == NULL) {
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index f478f77..99eaf4a 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -387,10 +387,8 @@ int snd_seq_pool_init(struct snd_seq_pool *pool)
return 0;
pool->ptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
- if (pool->ptr == NULL) {
- snd_printd("seq: malloc for sequencer events failed\n");
+ if (!pool->ptr)
return -ENOMEM;
- }
/* add new cells to the free cell list */
spin_lock_irqsave(&pool->lock, flags);
@@ -463,10 +461,8 @@ struct snd_seq_pool *snd_seq_pool_new(int poolsize)
/* create pool block */
pool = kzalloc(sizeof(*pool), GFP_KERNEL);
- if (pool == NULL) {
- snd_printd("seq: malloc failed for pool\n");
+ if (!pool)
return NULL;
- }
spin_lock_init(&pool->lock);
pool->ptr = NULL;
pool->free = NULL;
diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
index 67c91d2..3bf67ec 100644
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -141,10 +141,8 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
/* create a new port */
new_port = kzalloc(sizeof(*new_port), GFP_KERNEL);
- if (! new_port) {
- snd_printd("malloc failed for registering client port\n");
+ if (!new_port)
return NULL; /* failure, out of memory */
- }
/* init port data */
new_port->addr.client = client->number;
new_port->addr.port = -1;
diff --git a/sound/core/seq/seq_prioq.c b/sound/core/seq/seq_prioq.c
index 29896ab..9d73507 100644
--- a/sound/core/seq/seq_prioq.c
+++ b/sound/core/seq/seq_prioq.c
@@ -59,10 +59,8 @@ struct snd_seq_prioq *snd_seq_prioq_new(void)
struct snd_seq_prioq *f;
f = kzalloc(sizeof(*f), GFP_KERNEL);
- if (f == NULL) {
- snd_printd("oops: malloc failed for snd_seq_prioq_new()\n");
+ if (!f)
return NULL;
- }
spin_lock_init(&f->lock);
f->head = NULL;
diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 4c9aa46..77ec214 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -111,10 +111,8 @@ static struct snd_seq_queue *queue_new(int owner, int locked)
struct snd_seq_queue *q;
q = kzalloc(sizeof(*q), GFP_KERNEL);
- if (q == NULL) {
- snd_printd("malloc failed for snd_seq_queue_new()\n");
+ if (!q)
return NULL;
- }
spin_lock_init(&q->owner_lock);
spin_lock_init(&q->check_lock);
diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
index 6ec30a9..e16b197 100644
--- a/sound/core/seq/seq_timer.c
+++ b/sound/core/seq/seq_timer.c
@@ -56,10 +56,8 @@ struct snd_seq_timer *snd_seq_timer_new(void)
struct snd_seq_timer *tmr;
tmr = kzalloc(sizeof(*tmr), GFP_KERNEL);
- if (tmr == NULL) {
- snd_printd("malloc failed for snd_seq_timer_new() \n");
+ if (!tmr)
return NULL;
- }
spin_lock_init(&tmr->lock);
/* reset setup to defaults */
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 131/138] rtnl: RTM_GETNETCONF: fix wrong return value |
| Message-ID | <raVIf-6Sb-23@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Anton Protopopov <a.s.protopopov@gmail.com> commit a97eb33ff225f34a8124774b3373fd244f0e83ce upstream. An error response from a RTM_GETNETCONF request can return the positive error value EINVAL in the struct nlmsgerr that can mislead userspace. Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Luis Henriques <luis.henriques@canonical.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- net/ipv4/devinet.c | 2 +- net/ipv6/addrconf.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index f4b34d8..6844710 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -1785,7 +1785,7 @@ static int inet_netconf_get_devconf(struct sk_buff *in_skb, if (err < 0) goto errout; - err = EINVAL; + err = -EINVAL; if (!tb[NETCONFA_IFINDEX]) goto errout; diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index dd8b55b..c476142 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -531,7 +531,7 @@ static int inet6_netconf_get_devconf(struct sk_buff *in_skb, if (err < 0) goto errout; - err = EINVAL; + err = -EINVAL; if (!tb[NETCONFA_IFINDEX]) goto errout; -- 2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 123/138] ipv6: fix a lockdep splat |
| Message-ID | <raVIf-6Sb-21@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Eric Dumazet <edumazet@google.com>
commit 44c3d0c1c0a880354e9de5d94175742e2c7c9683 upstream.
Silence lockdep false positive about rcu_dereference() being
used in the wrong context.
First one should use rcu_dereference_protected() as we own the spinlock.
Second one should be a normal assignation, as no barrier is needed.
Fixes: 18367681a10bd ("ipv6 flowlabel: Convert np->ipv6_fl_list to RCU.")
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/ipv6/ip6_flowlabel.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index e7fb710..0d8b127 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -529,12 +529,13 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
case IPV6_FL_A_PUT:
spin_lock_bh(&ip6_sk_fl_lock);
for (sflp = &np->ipv6_fl_list;
- (sfl = rcu_dereference(*sflp))!=NULL;
+ (sfl = rcu_dereference_protected(*sflp,
+ lockdep_is_held(&ip6_sk_fl_lock))) != NULL;
sflp = &sfl->next) {
if (sfl->fl->label == freq.flr_label) {
if (freq.flr_label == (np->flow_label&IPV6_FLOWLABEL_MASK))
np->flow_label &= ~IPV6_FLOWLABEL_MASK;
- *sflp = rcu_dereference(sfl->next);
+ *sflp = sfl->next;
spin_unlock_bh(&ip6_sk_fl_lock);
fl_release(sfl->fl);
kfree_rcu(sfl, rcu);
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 137/138] af_unix: Don't set err in unix_stream_read_generic unless there was an error |
| Message-ID | <raVIf-6Sb-25@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Rainer Weikusat <rweikusat@mobileactivedefense.com>
commit 1b92ee3d03af6643df395300ba7748f19ecdb0c5 upstream.
The present unix_stream_read_generic contains various code sequences of
the form
err = -EDISASTER;
if (<test>)
goto out;
This has the unfortunate side effect of possibly causing the error code
to bleed through to the final
out:
return copied ? : err;
and then to be wrongly returned if no data was copied because the caller
didn't supply a data buffer, as demonstrated by the program available at
http://pad.lv/1540731
Change it such that err is only set if an error condition was detected.
Fixes: 3822b5c2fc62 ("af_unix: Revert 'lock_interruptible' in stream receive code")
Reported-by: Joseph Salisbury <joseph.salisbury@canonical.com>
Signed-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16:
- modify unix_stream_recvmsg() instead of unix_stream_read_generic()
- adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/unix/af_unix.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 3974413..17a824b 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2089,13 +2089,15 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
long timeo;
int skip;
- err = -EINVAL;
- if (sk->sk_state != TCP_ESTABLISHED)
+ if (unlikely(sk->sk_state != TCP_ESTABLISHED)) {
+ err = -EINVAL;
goto out;
+ }
- err = -EOPNOTSUPP;
- if (flags&MSG_OOB)
+ if (unlikely(flags & MSG_OOB)) {
+ err = -EOPNOTSUPP;
goto out;
+ }
target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
timeo = sock_rcvtimeo(sk, noblock);
@@ -2143,9 +2145,11 @@ again:
goto unlock;
unix_state_unlock(sk);
- err = -EAGAIN;
- if (!timeo)
+ if (!timeo) {
+ err = -EAGAIN;
break;
+ }
+
mutex_unlock(&u->readlock);
timeo = unix_stream_data_wait(sk, timeo, last);
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 134/138] bonding: Fix ARP monitor validation |
| Message-ID | <raVIf-6Sb-31@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jay Vosburgh <jay.vosburgh@canonical.com>
commit 21a75f0915dde8674708b39abfcda113911c49b1 upstream.
The current logic in bond_arp_rcv will accept an incoming ARP for
validation if (a) the receiving slave is either "active" (which includes
the currently active slave, or the current ARP slave) or, (b) there is a
currently active slave, and it has received an ARP since it became active.
For case (b), the receiving slave isn't the currently active slave, and is
receiving the original broadcast ARP request, not an ARP reply from the
target.
This logic can fail if there is no currently active slave. In
this situation, the ARP probe logic cycles through all slaves, assigning
each in turn as the "current_arp_slave" for one arp_interval, then setting
that one as "active," and sending an ARP probe from that slave. The
current logic expects the ARP reply to arrive on the sending
current_arp_slave, however, due to switch FDB updating delays, the reply
may be directed to another slave.
This can arise if the bonding slaves and switch are working, but
the ARP target is not responding. When the ARP target recovers, a
condition may result wherein the ARP target host replies faster than the
switch can update its forwarding table, causing each ARP reply to be sent
to the previous current_arp_slave. This will never pass the logic in
bond_arp_rcv, as neither of the above conditions (a) or (b) are met.
Some experimentation on a LAN shows ARP reply round trips in the
200 usec range, but my available switches never update their FDB in less
than 4000 usec.
This patch changes the logic in bond_arp_rcv to additionally
accept an ARP reply for validation on any slave if there is a current ARP
slave and it sent an ARP probe during the previous arp_interval.
Fixes: aeea64ac717a ("bonding: don't trust arp requests unless active slave really works")
Cc: Veaceslav Falico <vfalico@gmail.com>
Cc: Andy Gospodarek <gospo@cumulusnetworks.com>
Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
[ kamal: backported to 3.13: adjusted context ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/bonding/bond_main.c | 39 +++++++++++++++++++++++++++++----------
1 file changed, 29 insertions(+), 10 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 54d2dc4..f7788a1 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -269,6 +269,8 @@ struct bond_parm_tbl ad_select_tbl[] = {
static int bond_init(struct net_device *bond_dev);
static void bond_uninit(struct net_device *bond_dev);
+static bool bond_time_in_interval(struct bonding *bond, unsigned long last_act,
+ int mod);
/*---------------------------- General routines -----------------------------*/
@@ -2334,6 +2336,7 @@ int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
struct slave *slave)
{
struct arphdr *arp = (struct arphdr *)skb->data;
+ struct slave *curr_arp_slave;
unsigned char *arp_ptr;
__be32 sip, tip;
int alen;
@@ -2378,17 +2381,29 @@ int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
bond->params.arp_validate, slave_do_arp_validate(bond, slave),
&sip, &tip);
- /*
- * Backup slaves won't see the ARP reply, but do come through
- * here for each ARP probe (so we swap the sip/tip to validate
- * the probe). In a "redundant switch, common router" type of
- * configuration, the ARP probe will (hopefully) travel from
- * the active, through one switch, the router, then the other
- * switch before reaching the backup.
+ curr_arp_slave = rcu_dereference(bond->current_arp_slave);
+
+ /* We 'trust' the received ARP enough to validate it if:
+ *
+ * (a) the slave receiving the ARP is active (which includes the
+ * current ARP slave, if any), or
*
- * We 'trust' the arp requests if there is an active slave and
- * it received valid arp reply(s) after it became active. This
- * is done to avoid endless looping when we can't reach the
+ * (b) the receiving slave isn't active, but there is a currently
+ * active slave and it received valid arp reply(s) after it became
+ * the currently active slave, or
+ *
+ * (c) there is an ARP slave that sent an ARP during the prior ARP
+ * interval, and we receive an ARP reply on any slave. We accept
+ * these because switch FDB update delays may deliver the ARP
+ * reply to a slave other than the sender of the ARP request.
+ *
+ * Note: for (b), backup slaves are receiving the broadcast ARP
+ * request, not a reply. This request passes from the sending
+ * slave through the L2 switch(es) to the receiving slave. Since
+ * this is checking the request, sip/tip are swapped for
+ * validation.
+ *
+ * This is done to avoid endless looping when we can't reach the
* arp_ip_target and fool ourselves with our own arp requests.
*/
if (bond_is_active_slave(slave))
@@ -2397,6 +2412,10 @@ int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
time_after(slave_last_rx(bond, bond->curr_active_slave),
bond->curr_active_slave->jiffies))
bond_validate_arp(bond, slave, tip, sip);
+ else if (curr_arp_slave && (arp->ar_op == htons(ARPOP_REPLY)) &&
+ bond_time_in_interval(bond,
+ dev_trans_start(curr_arp_slave->dev), 1))
+ bond_validate_arp(bond, slave, sip, tip);
out_unlock:
read_unlock(&bond->lock);
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 130/138] pppoe: fix reference counting in PPPoE proxy |
| Message-ID | <raVIf-6Sb-35@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Guillaume Nault <g.nault@alphalink.fr>
commit 29e73269aa4d36f92b35610c25f8b01c789b0dc8 upstream.
Drop reference on the relay_po socket when __pppoe_xmit() succeeds.
This is already handled correctly in the error path.
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/ppp/pppoe.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 1cfd4e8..ec98278 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -392,6 +392,8 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
if (!__pppoe_xmit(sk_pppox(relay_po), skb))
goto abort_put;
+
+ sock_put(sk_pppox(relay_po));
} else {
if (sock_queue_rcv_skb(sk, skb))
goto abort_kfree;
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 138/138] pipe: limit the per-user amount of pages allocated in pipes |
| Message-ID | <raVIf-6Sb-39@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Willy Tarreau <w@1wt.eu>
commit 759c01142a5d0f364a462346168a56de28a80f52 upstream.
On no-so-small systems, it is possible for a single process to cause an
OOM condition by filling large pipes with data that are never read. A
typical process filling 4000 pipes with 1 MB of data will use 4 GB of
memory. On small systems it may be tricky to set the pipe max size to
prevent this from happening.
This patch makes it possible to enforce a per-user soft limit above
which new pipes will be limited to a single page, effectively limiting
them to 4 kB each, as well as a hard limit above which no new pipes may
be created for this user. This has the effect of protecting the system
against memory abuse without hurting other users, and still allowing
pipes to work correctly though with less data at once.
The limit are controlled by two new sysctls : pipe-user-pages-soft, and
pipe-user-pages-hard. Both may be disabled by setting them to zero. The
default soft limit allows the default number of FDs per process (1024)
to create pipes of the default size (64kB), thus reaching a limit of 64MB
before starting to create only smaller pipes. With 256 processes limited
to 1024 FDs each, this results in 1024*64kB + (256*1024 - 1024) * 4kB =
1084 MB of memory allocated for a user. The hard limit is disabled by
default to avoid breaking existing applications that make intensive use
of pipes (eg: for splicing).
Reported-by: socketpair@gmail.com
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mitigates: CVE-2013-4312 (Linux 2.0+)
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
Documentation/sysctl/fs.txt | 23 ++++++++++++++++++++++
fs/pipe.c | 47 +++++++++++++++++++++++++++++++++++++++++++--
include/linux/pipe_fs_i.h | 4 ++++
include/linux/sched.h | 1 +
kernel/sysctl.c | 14 ++++++++++++++
5 files changed, 87 insertions(+), 2 deletions(-)
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 88152f2..302b5ed 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -32,6 +32,8 @@ Currently, these files are in /proc/sys/fs:
- nr_open
- overflowuid
- overflowgid
+- pipe-user-pages-hard
+- pipe-user-pages-soft
- protected_hardlinks
- protected_symlinks
- suid_dumpable
@@ -159,6 +161,27 @@ The default is 65534.
==============================================================
+pipe-user-pages-hard:
+
+Maximum total number of pages a non-privileged user may allocate for pipes.
+Once this limit is reached, no new pipes may be allocated until usage goes
+below the limit again. When set to 0, no limit is applied, which is the default
+setting.
+
+==============================================================
+
+pipe-user-pages-soft:
+
+Maximum total number of pages a non-privileged user may allocate for pipes
+before the pipe size gets limited to a single page. Once this limit is reached,
+new pipes will be limited to a single page in size for this user in order to
+limit total memory usage, and trying to increase them using fcntl() will be
+denied until usage goes below the limit again. The default value allows to
+allocate up to 1024 pipes at their default size. When set to 0, no limit is
+applied.
+
+==============================================================
+
protected_hardlinks:
A long-standing class of security issues is the hardlink-based
diff --git a/fs/pipe.c b/fs/pipe.c
index 3e7ab27..47f79ac 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -39,6 +39,12 @@ unsigned int pipe_max_size = 1048576;
*/
unsigned int pipe_min_size = PAGE_SIZE;
+/* Maximum allocatable pages per user. Hard limit is unset by default, soft
+ * matches default values.
+ */
+unsigned long pipe_user_pages_hard;
+unsigned long pipe_user_pages_soft = PIPE_DEF_BUFFERS * INR_OPEN_CUR;
+
/*
* We use a start+len construction, which provides full use of the
* allocated memory.
@@ -791,20 +797,49 @@ pipe_fasync(int fd, struct file *filp, int on)
return retval;
}
+static void account_pipe_buffers(struct pipe_inode_info *pipe,
+ unsigned long old, unsigned long new)
+{
+ atomic_long_add(new - old, &pipe->user->pipe_bufs);
+}
+
+static bool too_many_pipe_buffers_soft(struct user_struct *user)
+{
+ return pipe_user_pages_soft &&
+ atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_soft;
+}
+
+static bool too_many_pipe_buffers_hard(struct user_struct *user)
+{
+ return pipe_user_pages_hard &&
+ atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_hard;
+}
+
struct pipe_inode_info *alloc_pipe_info(void)
{
struct pipe_inode_info *pipe;
pipe = kzalloc(sizeof(struct pipe_inode_info), GFP_KERNEL);
if (pipe) {
- pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * PIPE_DEF_BUFFERS, GFP_KERNEL);
+ unsigned long pipe_bufs = PIPE_DEF_BUFFERS;
+ struct user_struct *user = get_current_user();
+
+ if (!too_many_pipe_buffers_hard(user)) {
+ if (too_many_pipe_buffers_soft(user))
+ pipe_bufs = 1;
+ pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * pipe_bufs, GFP_KERNEL);
+ }
+
if (pipe->bufs) {
init_waitqueue_head(&pipe->wait);
pipe->r_counter = pipe->w_counter = 1;
- pipe->buffers = PIPE_DEF_BUFFERS;
+ pipe->buffers = pipe_bufs;
+ pipe->user = user;
+ account_pipe_buffers(pipe, 0, pipe_bufs);
mutex_init(&pipe->mutex);
return pipe;
}
+ free_uid(user);
kfree(pipe);
}
@@ -815,6 +850,8 @@ void free_pipe_info(struct pipe_inode_info *pipe)
{
int i;
+ account_pipe_buffers(pipe, pipe->buffers, 0);
+ free_uid(pipe->user);
for (i = 0; i < pipe->buffers; i++) {
struct pipe_buffer *buf = pipe->bufs + i;
if (buf->ops)
@@ -1205,6 +1242,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer));
}
+ account_pipe_buffers(pipe, pipe->buffers, nr_pages);
pipe->curbuf = 0;
kfree(pipe->bufs);
pipe->bufs = bufs;
@@ -1276,6 +1314,11 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
ret = -EPERM;
goto out;
+ } else if ((too_many_pipe_buffers_hard(pipe->user) ||
+ too_many_pipe_buffers_soft(pipe->user)) &&
+ !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN)) {
+ ret = -EPERM;
+ goto out;
}
ret = pipe_set_size(pipe, nr_pages);
break;
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index ab57526..b3374f6 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -42,6 +42,7 @@ struct pipe_buffer {
* @fasync_readers: reader side fasync
* @fasync_writers: writer side fasync
* @bufs: the circular array of pipe buffers
+ * @user: the user who created this pipe
**/
struct pipe_inode_info {
struct mutex mutex;
@@ -57,6 +58,7 @@ struct pipe_inode_info {
struct fasync_struct *fasync_readers;
struct fasync_struct *fasync_writers;
struct pipe_buffer *bufs;
+ struct user_struct *user;
};
/*
@@ -140,6 +142,8 @@ void pipe_unlock(struct pipe_inode_info *);
void pipe_double_lock(struct pipe_inode_info *, struct pipe_inode_info *);
extern unsigned int pipe_max_size, pipe_min_size;
+extern unsigned long pipe_user_pages_hard;
+extern unsigned long pipe_user_pages_soft;
int pipe_proc_fn(struct ctl_table *, int, void __user *, size_t *, loff_t *);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 3f3128b..7069678e 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -684,6 +684,7 @@ struct user_struct {
#endif
unsigned long locked_shm; /* How many pages of mlocked shm ? */
unsigned long unix_inflight; /* How many files in flight in unix sockets */
+ atomic_long_t pipe_bufs; /* how many pages are allocated in pipe buffers */
#ifdef CONFIG_KEYS
struct key *uid_keyring; /* UID specific keyring */
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index bbf0a95..3ac328e 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1654,6 +1654,20 @@ static struct ctl_table fs_table[] = {
.proc_handler = &pipe_proc_fn,
.extra1 = &pipe_min_size,
},
+ {
+ .procname = "pipe-user-pages-hard",
+ .data = &pipe_user_pages_hard,
+ .maxlen = sizeof(pipe_user_pages_hard),
+ .mode = 0644,
+ .proc_handler = proc_doulongvec_minmax,
+ },
+ {
+ .procname = "pipe-user-pages-soft",
+ .data = &pipe_user_pages_soft,
+ .maxlen = sizeof(pipe_user_pages_soft),
+ .mode = 0644,
+ .proc_handler = proc_doulongvec_minmax,
+ },
{ }
};
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 110/138] tracing: Fix showing function event in available_events |
| Message-ID | <raVIf-6Sb-45@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org> commit d045437a169f899dfb0f6f7ede24cc042543ced9 upstream. The ftrace:function event is only displayed for parsing the function tracer data. It is not used to enable function tracing, and does not include an "enable" file in its event directory. Originally, this event was kept separate from other events because it did not have a ->reg parameter. But perf added a "reg" parameter for its use which caused issues, because it made the event available to functions where it was not compatible for. Commit 9b63776fa3ca9 "tracing: Do not enable function event with enable" added a TRACE_EVENT_FL_IGNORE_ENABLE flag that prevented the function event from being enabled by normal trace events. But this commit missed keeping the function event from being displayed by the "available_events" directory, which is used to show what events can be enabled by set_event. One documented way to enable all events is to: cat available_events > set_event But because the function event is displayed in the available_events, this now causes an INVALID error: cat: write error: Invalid argument Reported-by: Chunyu Hu <chuhu@redhat.com> Fixes: 9b63776fa3ca9 "tracing: Do not enable function event with enable" Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- kernel/trace/trace_events.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 396c823..1a79aff 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -604,7 +604,8 @@ t_next(struct seq_file *m, void *v, loff_t *pos) * The ftrace subsystem is for showing formats only. * They can not be enabled or disabled via the event files. */ - if (call->class && call->class->reg) + if (call->class && call->class->reg && + !(call->flags & TRACE_EVENT_FL_IGNORE_ENABLE)) return file; } -- 2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 114/138] do_last(): don't let a bogus return value from ->open() et.al. to confuse us |
| Message-ID | <raVIg-6Sb-49@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit c80567c82ae4814a41287618e315a60ecf513be6 upstream.
... into returning a positive to path_openat(), which would interpret that
as "symlink had been encountered" and proceed to corrupt memory, etc.
It can only happen due to a bug in some ->open() instance or in some LSM
hook, etc., so we report any such event *and* make sure it doesn't trick
us into further unpleasantness.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
fs/namei.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/namei.c b/fs/namei.c
index 3c87058..c8e698d 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3085,6 +3085,10 @@ opened:
goto exit_fput;
}
out:
+ if (unlikely(error > 0)) {
+ WARN_ON(1);
+ error = -EINVAL;
+ }
if (got_write)
mnt_drop_write(nd->path.mnt);
path_put(&save_parent);
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-10 00:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 125/138] net:Add sysctl_max_skb_frags |
| Message-ID | <raVIg-6Sb-53@gated-at.bofh.it> |
| In reply to | #1354574 |
3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hans Westgaard Ry <hans.westgaard.ry@oracle.com>
commit 5f74f82ea34c0da80ea0b49192bb5ea06e063593 upstream.
Devices may have limits on the number of fragments in an skb they support.
Current codebase uses a constant as maximum for number of fragments one
skb can hold and use.
When enabling scatter/gather and running traffic with many small messages
the codebase uses the maximum number of fragments and may thereby violate
the max for certain devices.
The patch introduces a global variable as max number of fragments.
Signed-off-by: Hans Westgaard Ry <hans.westgaard.ry@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
include/linux/skbuff.h | 1 +
net/core/skbuff.c | 2 ++
net/core/sysctl_net_core.c | 10 ++++++++++
net/ipv4/tcp.c | 4 ++--
4 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 090a81d..ab38ef2 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -148,6 +148,7 @@ struct sk_buff;
#else
#define MAX_SKB_FRAGS (65536/PAGE_SIZE + 1)
#endif
+extern int sysctl_max_skb_frags;
typedef struct skb_frag_struct skb_frag_t;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a6c16df..eb118c7 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -75,6 +75,8 @@
struct kmem_cache *skbuff_head_cache __read_mostly;
static struct kmem_cache *skbuff_fclone_cache __read_mostly;
+int sysctl_max_skb_frags __read_mostly = MAX_SKB_FRAGS;
+EXPORT_SYMBOL(sysctl_max_skb_frags);
/**
* skb_panic - private function for out-of-line support
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index f3413ae..d796239 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -27,6 +27,7 @@ static int one = 1;
static int ushort_max = USHRT_MAX;
static int min_sndbuf = SOCK_MIN_SNDBUF;
static int min_rcvbuf = SOCK_MIN_RCVBUF;
+static int max_skb_frags = MAX_SKB_FRAGS;
#ifdef CONFIG_RPS
static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
@@ -362,6 +363,15 @@ static struct ctl_table net_core_table[] = {
.mode = 0644,
.proc_handler = proc_dointvec
},
+ {
+ .procname = "max_skb_frags",
+ .data = &sysctl_max_skb_frags,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = &one,
+ .extra2 = &max_skb_frags,
+ },
{ }
};
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index fda904e..43f384d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -887,7 +887,7 @@ new_segment:
i = skb_shinfo(skb)->nr_frags;
can_coalesce = skb_can_coalesce(skb, i, page, offset);
- if (!can_coalesce && i >= MAX_SKB_FRAGS) {
+ if (!can_coalesce && i >= sysctl_max_skb_frags) {
tcp_mark_push(tp, skb);
goto new_segment;
}
@@ -1170,7 +1170,7 @@ new_segment:
if (!skb_can_coalesce(skb, i, pfrag->page,
pfrag->offset)) {
- if (i == MAX_SKB_FRAGS || !sg) {
+ if (i == sysctl_max_skb_frags || !sg) {
tcp_mark_push(tp, skb);
goto new_segment;
}
--
2.7.0
[toc] | [prev] | [next] | [standalone]
Page 1 of 6 [1] 2 3 4 5 6 Next page →
Back to top | Article view | linux.kernel
csiph-web