1. 30 4月, 2013 5 次提交
  2. 29 4月, 2013 2 次提交
    • H
      ipvs: ip_vs_sip_fill_param() BUG: bad check of return value · f7a1dd6e
      Hans Schillstrom 提交于
      The reason for this patch is crash in kmemdup
      caused by returning from get_callid with uniialized
      matchoff and matchlen.
      
      Removing Zero check of matchlen since it's done by ct_sip_get_header()
      
      BUG: unable to handle kernel paging request at ffff880457b5763f
      IP: [<ffffffff810df7fc>] kmemdup+0x2e/0x35
      PGD 27f6067 PUD 0
      Oops: 0000 [#1] PREEMPT SMP
      Modules linked in: xt_state xt_helper nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_mangle xt_connmark xt_conntrack ip6_tables nf_conntrack_ftp ip_vs_ftp nf_nat xt_tcpudp iptable_mangle xt_mark ip_tables x_tables ip_vs_rr ip_vs_lblcr ip_vs_pe_sip ip_vs nf_conntrack_sip nf_conntrack bonding igb i2c_algo_bit i2c_core
      CPU 5
      Pid: 0, comm: swapper/5 Not tainted 3.9.0-rc5+ #5                  /S1200KP
      RIP: 0010:[<ffffffff810df7fc>]  [<ffffffff810df7fc>] kmemdup+0x2e/0x35
      RSP: 0018:ffff8803fea03648  EFLAGS: 00010282
      RAX: ffff8803d61063e0 RBX: 0000000000000003 RCX: 0000000000000003
      RDX: 0000000000000003 RSI: ffff880457b5763f RDI: ffff8803d61063e0
      RBP: ffff8803fea03658 R08: 0000000000000008 R09: 0000000000000011
      R10: 0000000000000011 R11: 00ffffffff81a8a3 R12: ffff880457b5763f
      R13: ffff8803d67f786a R14: ffff8803fea03730 R15: ffffffffa0098e90
      FS:  0000000000000000(0000) GS:ffff8803fea00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: ffff880457b5763f CR3: 0000000001a0c000 CR4: 00000000001407e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process swapper/5 (pid: 0, threadinfo ffff8803ee18c000, task ffff8803ee18a480)
      Stack:
       ffff8803d822a080 000000000000001c ffff8803fea036c8 ffffffffa000937a
       ffffffff81f0d8a0 000000038135fdd5 ffff880300000014 ffff880300110000
       ffffffff150118ac ffff8803d7e8a000 ffff88031e0118ac 0000000000000000
      Call Trace:
       <IRQ>
      
       [<ffffffffa000937a>] ip_vs_sip_fill_param+0x13a/0x187 [ip_vs_pe_sip]
       [<ffffffffa007b209>] ip_vs_sched_persist+0x2c6/0x9c3 [ip_vs]
       [<ffffffff8107dc53>] ? __lock_acquire+0x677/0x1697
       [<ffffffff8100972e>] ? native_sched_clock+0x3c/0x7d
       [<ffffffff8100972e>] ? native_sched_clock+0x3c/0x7d
       [<ffffffff810649bc>] ? sched_clock_cpu+0x43/0xcf
       [<ffffffffa007bb1e>] ip_vs_schedule+0x181/0x4ba [ip_vs]
      ...
      Signed-off-by: NHans Schillstrom <hans@schillstrom.com>
      Acked-by: NJulian Anastasov <ja@ssi.bg>
      Signed-off-by: NSimon Horman <horms@verge.net.au>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f7a1dd6e
    • G
      net: tun: release the reference of tun device in tun_recvmsg · 3811ae76
      Gao feng 提交于
      We forget to release the reference of tun device in tun_recvmsg.
      bug introduced in commit 54f968d6
      (tuntap: move socket to tun_file)
      Signed-off-by: NGao feng <gaofeng@cn.fujitsu.com>
      Acked-by: NJason Wang <jasowang@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3811ae76
  3. 25 4月, 2013 18 次提交
  4. 22 4月, 2013 4 次提交
  5. 21 4月, 2013 6 次提交
    • L
      Merge branch 'x86-kdump-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 830ac852
      Linus Torvalds 提交于
      Pull kdump fixes from Peter Anvin:
       "The kexec/kdump people have found several problems with the support
        for loading over 4 GiB that was introduced in this merge cycle.  This
        is partly due to a number of design problems inherent in the way the
        various pieces of kdump fit together (it is pretty horrifically manual
        in many places.)
      
        After a *lot* of iterations this is the patchset that was agreed upon,
        but of course it is now very late in the cycle.  However, because it
        changes both the syntax and semantics of the crashkernel option, it
        would be desirable to avoid a stable release with the broken
        interfaces."
      
      I'm not happy with the timing, since originally the plan was to release
      the final 3.9 tomorrow.  But apparently I'm doing an -rc8 instead...
      
      * 'x86-kdump-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        kexec: use Crash kernel for Crash kernel low
        x86, kdump: Change crashkernel_high/low= to crashkernel=,high/low
        x86, kdump: Retore crashkernel= to allocate under 896M
        x86, kdump: Set crashkernel_low automatically
      830ac852
    • L
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · db93f8b4
      Linus Torvalds 提交于
      Pull x86 fixes from Peter Anvin:
       "Three groups of fixes:
      
         1. Make sure we don't execute the early microcode patching if family
            < 6, since it would touch MSRs which don't exist on those
            families, causing crashes.
      
         2. The Xen partial emulation of HyperV can be dealt with more
            gracefully than just disabling the driver.
      
         3. More EFI variable space magic.  In particular, variables hidden
            from runtime code need to be taken into account too."
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86, microcode: Verify the family before dispatching microcode patching
        x86, hyperv: Handle Xen emulation of Hyper-V more gracefully
        x86,efi: Implement efi_no_storage_paranoia parameter
        efi: Export efi_query_variable_store() for efivars.ko
        x86/Kconfig: Make EFI select UCS2_STRING
        efi: Distinguish between "remaining space" and actually used space
        efi: Pass boot services variable info to runtime code
        Move utf16 functions to kernel core and rename
        x86,efi: Check max_size only if it is non-zero.
        x86, efivars: firmware bug workarounds should be in platform code
      db93f8b4
    • L
      Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm · 8c3a13c8
      Linus Torvalds 提交于
      Pull ARM fixes from Russell King:
       "A set of fixes from various people - Will Deacon gets a prize for
        removing code this time around.  The biggest fix in this lot is
        sorting out the ARM740T mess.  The rest are relatively small fixes."
      
      * 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
        ARM: 7699/1: sched_clock: Add more notrace to prevent recursion
        ARM: 7698/1: perf: fix group validation when using enable_on_exec
        ARM: 7697/1: hw_breakpoint: do not use __cpuinitdata for dbg_cpu_pm_nb
        ARM: 7696/1: Fix kexec by setting outer_cache.inv_all for Feroceon
        ARM: 7694/1: ARM, TCM: initialize TCM in paging_init(), instead of setup_arch()
        ARM: 7692/1: iop3xx: move IOP3XX_PERIPHERAL_VIRT_BASE
        ARM: modules: don't export cpu_set_pte_ext when !MMU
        ARM: mm: remove broken condition check for v4 flushing
        ARM: mm: fix numerous hideous errors in proc-arm740.S
        ARM: cache: remove ARMv3 support code
        ARM: tlbflush: remove ARMv3 support
      8c3a13c8
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 851b3f32
      Linus Torvalds 提交于
      Pull sparc fixes from David Miller:
      
       1) Fix race in sparc64 TLB shootdowns, we have to synchronize with the
          sibling cpus completing if we are passing them a reference via
          pointer to a data structure.
      
       2) Fix cleaning of bitmaps in sparc32, from Akinobu Mita.
      
       3) Fix various sparc header mistakes, some of which resulted in
          userland build breakage.  From Sam Ravnborg.
      
       4) Kill ghost declarations and defines missed when several bits of code
          got deleted recently.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc64: Fix race in TLB batch processing.
        sparc: use asm-generic version of types.h
        bbc_i2c: fix section mismatch warning
        sparc: use generic headers
        sparc:cleanup unused code in smp_32.h
        sparc/iommu: fix typo s/265KB/256KB/
        sparc/srmmu: clear trailing edge of bitmap properly
        sparc:remove unused declaration smp_boot_cpus()
      851b3f32
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c437d888
      Linus Torvalds 提交于
      Pull networking updates from David Miller:
      
       1) ax88796 does 64-bit divides which causes link errors on ARM, fix
          from Arnd Bergmann.
      
       2) Once an improper offload setting is detected on an SKB we don't rate
          limit the log message so we can very easily live lock.  From Ben
          Greear.
      
       3) Openvswitch cannot report vport configuration changes reliably
          because it didn't preallocate the netlink notification message
          before changing state.  From Jesse Gross.
      
       4) The effective UID/GID SCM credentials fix, from Linus.
      
       5) When a user explicitly asks for wireless authentication, cfg80211
          isn't told about the AP detachment leaving inconsistent state.  Fix
          from Johannes Berg.
      
       6) Fix self-MAC checks in batman-adv on multi-mesh nodes, from Antonio
          Quartulli.
      
       7) Revert build_skb() change sin IGB driver, can result in memory
          corruption.  From Alexander Duyck.
      
       8) Fix setting VLANs on virtual functions in IXGBE, from Greg Rose.
      
       9) Fix TSO races in qlcnic driver, from Sritej Velaga.
      
      10) In bnx2x the kernel driver and UNDI firmware can try to program the
          chip at the same time, resulting in corruption.  Add proper
          synchronization.  From Dmitry Kravkov.
      
      11) Fix corruption of status block in firmware ram in bxn2x, from Ariel
          Elior.
      
      12) Fix load balancing hash regression of bonding driver in forwarding
          configurations, from Eric Dumazet.
      
      13) Fix TS ECR regression in TCP by calling tcp_replace_ts_recent() in
          all the right spots, from Eric Dumazet.
      
      14) Fix several bonding bugs having to do with address manintainence,
          including not removing address when configuration operations
          encounter errors, missed locking on the address lists, missing
          refcounting on VLAN objects, etc.  All from Nikolay Aleksandrov.
      
      15) Add workarounds for firmware bugs in LTE qmi_wwan devices, wherein
          the devices fail to add a proper ethernet header while on LTE
          networks but otherwise properly do so on 2G and 3G ones.  From Bjørn
          Mork.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (38 commits)
        net: fix incorrect credentials passing
        net: rate-limit warn-bad-offload splats.
        net: ax88796: avoid 64 bit arithmetic
        qlge: Update version to 1.00.00.32.
        qlge: Fix ethtool autoneg advertising.
        qlge: Fix receive path to drop error frames
        net: qmi_wwan: prevent duplicate mac address on link (firmware bug workaround)
        net: qmi_wwan: fixup destination address (firmware bug workaround)
        net: qmi_wwan: fixup missing ethernet header (firmware bug workaround)
        bonding: in bond_mc_swap() bond's mc addr list is walked without lock
        bonding: disable netpoll on enslave failure
        bonding: primary_slave & curr_active_slave are not cleaned on enslave failure
        bonding: vlans don't get deleted on enslave failure
        bonding: mc addresses don't get deleted on enslave failure
        pkt_sched: fix error return code in fw_change_attrs()
        irda: small read past the end of array in debug code
        tcp: call tcp_replace_ts_recent() from tcp_ack()
        netfilter: xt_rpfilter: skip locally generated broadcast/multicast, too
        netfilter: ipset: bitmap:ip,mac: fix listing with timeout
        bonding: fix l23 and l34 load balancing in forwarding path
        ...
      c437d888
    • L
      net: fix incorrect credentials passing · 83f1b4ba
      Linus Torvalds 提交于
      Commit 257b5358 ("scm: Capture the full credentials of the scm
      sender") changed the credentials passing code to pass in the effective
      uid/gid instead of the real uid/gid.
      
      Obviously this doesn't matter most of the time (since normally they are
      the same), but it results in differences for suid binaries when the wrong
      uid/gid ends up being used.
      
      This just undoes that (presumably unintentional) part of the commit.
      Reported-by: NAndy Lutomirski <luto@amacapital.net>
      Cc: Eric W. Biederman <ebiederm@xmission.com>
      Cc: Serge E. Hallyn <serge@hallyn.com>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: stable@vger.kernel.org
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      Acked-by: N"Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      83f1b4ba
  6. 20 4月, 2013 5 次提交