1. 24 11月, 2012 1 次提交
  2. 23 11月, 2012 3 次提交
  3. 22 11月, 2012 11 次提交
    • F
      netfilter: cttimeout: fix buffer overflow · e93b5f9f
      Florian Westphal 提交于
      Chen Gang reports:
      the length of nla_data(cda[CTA_TIMEOUT_NAME]) is not limited in server side.
      
      And indeed, its used to strcpy to a fixed-sized buffer.
      
      Fortunately, nfnetlink users need CAP_NET_ADMIN.
      Reported-by: NChen Gang <gang.chen@asianux.com>
      Signed-off-by: NFlorian Westphal <fw@strlen.de>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      e93b5f9f
    • J
      netfilter: ipset: Fix range bug in hash:ip,port,net · 4fe198e6
      Jozsef Kadlecsik 提交于
      Due to the missing ininitalization at adding/deleting entries, when
      a plain_ip,port,net element was the object, multiple elements were
      added/deleted instead. The bug came from the missing dangling
      default initialization.
      
      The error-prone default initialization is corrected in all hash:* types.
      Signed-off-by: NJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      4fe198e6
    • D
      fix incorrect NR_FREE_PAGES accounting (appears like memory leak) · ef6c5be6
      Dave Hansen 提交于
      There have been some 3.7-rc reports of vm issues, including some kswapd
      bugs and, more importantly, some memory "leaks":
      
      	http://www.spinics.net/lists/linux-mm/msg46187.html
      	https://bugzilla.kernel.org/show_bug.cgi?id=50181
      
      Commit 1fb3f8ca ("mm: compaction: capture a suitable high-order page
      immediately when it is made available") took split_free_page() and
      reused it for the compaction code.  It does something curious with
      capture_free_page() (previously known as split_free_page()):
      
        int capture_free_page(struct page *page, int alloc_order,
        ...
                __mod_zone_page_state(zone, NR_FREE_PAGES, -(1UL << order));
      
        -       /* Split into individual pages */
        -       set_page_refcounted(page);
        -       split_page(page, order);
        +       if (alloc_order != order)
        +               expand(zone, page, alloc_order, order,
        +                       &zone->free_area[order], migratetype);
      
      Note that expand() puts the pages _back_ in the allocator, but it does
      not bump NR_FREE_PAGES.  We "return" 'alloc_order' worth of pages, but
      we accounted for removing 'order' in the __mod_zone_page_state() call.
      
      For the old split_page()-style use (order==alloc_order) the bug will not
      trigger.  But, when called from the compaction code where we
      occasionally get a larger page out of the buddy allocator than we need,
      we will run in to this.
      
      This patch simply changes the NR_FREE_PAGES manipulation to the correct
      'alloc_order' instead of 'order'.
      
      I've been able to repeatedly trigger this in my testing environment.
      The amount "leaked" very closely tracks the imbalance I see in buddy
      pages vs.  NR_FREE_PAGES.  I have confirmed that this patch fixes the
      imbalance
      Signed-off-by: NDave Hansen <dave@linux.vnet.ibm.com>
      Acked-by: NMel Gorman <mgorman@suse.de>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      ef6c5be6
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · db9d8c60
      Linus Torvalds 提交于
      Pull networking updates from David Miller:
      
       1) inet6_csk_update_pmtu() must return NULL or non-NULL, so translate
          ERR_PTR to NULL, as needed.  Fix from Eric Dumazet.
      
       2) Fix copy&paste error in IRDA sir_dev ->set_speed method invocation,
          it was testing the NULL'ness of a different method to guard the
          call.  Fix from Alexander Shiyan.
      
       3) Fix build regression of xilinx driver, from Jeff Mahoney.
      
       4) Make XEN netfront (like XEN netback) handle compound pages in SKBs
          properly.  From Ian Campbell.
      
       5) Fix inverted logic of team_dev_queue_xmit() return value checks,
          from Jiri Pirko and Dan Carpenter.
      
       6) dma_poll_create() no longer allows a NULL device argument, breaking
          both ixp4xx drivers.  Fix from Xi Wang.
      
       7) ne2000 driver doesn't hook up the parent device properly, breaking
          udev matching.  Fix from Alan Cox.
      
       8) Locking and memory leak fixes in Near Field Communications layer.
          From Thierry Escande, Szymon Janc, and Waldemar Rymarkiewicz.
      
       9) sis900 resume regression, sis900_set_mode() is being called with the
          iomem pointer instead of the expected device private.  Fix from
          Francois Romieu.
      
      10) Fix IBSS regression caused by uninitializing the ibss-internals
          before performing an emptyness check, from Simon WUnderlich.
      
      11) Fix SNIFFER mode regression in iwlwifi driver, from Johannes Berg.
      
      12) Fix task wedges in mwifiex_cmd_timeout_func(), from Bing Zhao.
      
      13) Add back wireless sysfs directory, too much stuff depends upon it
          being there (actually I'd say it never should have been removed to
          begin with).  From Johannes Berg.
      
      14) Fix hang introduced by suspend/resume changes in ath9k.  Fix from
          Sujith Manoharan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (24 commits)
        team: bcast: convert return value of team_dev_queue_xmit() to bool correctly
        bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices.
        xen/netfront: handle compound page fragments on transmit
        net: fix build failure in xilinx
        irda: sir_dev: Fix copy/paste typo
        ipv6: fix inet6_csk_update_pmtu() return value
        ixp4xx_hss: avoid calling dma_pool_create() with NULL dev
        ixp4xx_eth: avoid calling dma_pool_create() with NULL dev
        ne2000: add the right platform device
        of/net/mdio-gpio: Fix pdev->id issue when using devicetrees.
        NFC: Fix pn533 target mode memory leak
        NFC: pn533: Fix mem leak in pn533_in_dep_link_up
        NFC: pn533: Fix use after free
        NFC: pn533: Fix missing lock while operating on commands list
        NFC: Fix nfc_llcp_local chained list insertion
        ath9k_hw: Fix regression in device reset
        sis900: fix sis900_set_mode call parameters.
        iwlwifi: don't WARN when a non empty queue is disabled
        wireless: add back sysfs directory
        mwifiex: report error to MMC core if we cannot suspend
        ...
      db9d8c60
    • J
      team: bcast: convert return value of team_dev_queue_xmit() to bool correctly · 403f43c9
      Jiri Pirko 提交于
      The thing is that team_dev_queue_xmit() returns NET_XMIT_* or -E*.
      bc_trasmit() should return true in case all went well. So use ! to get
      correct retval from team_dev_queue_xmit() result.
      This bug caused iface statistics to be badly computed.
      
      This bug was introduced by:
      team: add broadcast mode (5fc88991)
      Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NJiri Pirko <jiri@resnulli.us>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      403f43c9
    • L
      Merge tag 'pinctrl-for-v3.7-late' of... · 45e77159
      Linus Torvalds 提交于
      Merge tag 'pinctrl-for-v3.7-late' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
      
      Pull pinctrl fix from Linus Walleij:
       "A simple pinctrl Kconfig oneliner arriving late.
      
        Final (hopefully) oneliner for the pinctrl subsystem targeted at v3.7"
      
      * tag 'pinctrl-for-v3.7-late' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl/samsung: don't allow enabling pinctrl-samsung standalone
      45e77159
    • L
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security · 85c0805a
      Linus Torvalds 提交于
      Pull selinux RCU fixlet from James Morris.
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
        selinux: fix sel_netnode_insert() suspicious rcu dereference
      85c0805a
    • C
      sign-file: fix the perl warning message when extracting ASN.1 · 916492b1
      Chun-Yi Lee 提交于
      There have the following warning message when running modules install
      for sign ko files:
      
        # make modules_install
        ...
          INSTALL drivers/input/touchscreen/pcap_ts.ko
        Found = in conditional, should be == at scripts/sign-file line 164.
        Found = in conditional, should be == at scripts/sign-file line 161.
        Found = in conditional, should be == at scripts/sign-file line 159.
      
      This patch change replace '=' by '==' in elsif conditions for avoid the
      above warning messages.
      Signed-off-by: NChun-Yi Lee <jlee@suse.com>
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      916492b1
    • S
      bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices. · 0e376bd0
      Sarveshwar Bandi 提交于
      Patch sets the lowest gso_max_size and gso_max_segs values of the slave devices during enslave and detach.
      Signed-off-by: NSarveshwar Bandi <sarveshwar.bandi@emulex.com>
      Acked-by: NEric Dumazet <edumazet@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0e376bd0
    • I
      xen/netfront: handle compound page fragments on transmit · f36c3747
      Ian Campbell 提交于
      An SKB paged fragment can consist of a compound page with order > 0.
      However the netchannel protocol deals only in PAGE_SIZE frames.
      
      Handle this in xennet_make_frags by iterating over the frames which
      make up the page.
      
      This is the netfront equivalent to 6a8ed462 for netback.
      Signed-off-by: NIan Campbell <ian.campbell@citrix.com>
      Cc: netdev@vger.kernel.org
      Cc: xen-devel@lists.xen.org
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Konrad Rzeszutek Wilk <konrad@kernel.org>
      Cc: ANNIE LI <annie.li@oracle.com>
      Cc: Sander Eikelenboom <linux@eikelenboom.it>
      Cc: Stefan Bader <stefan.bader@canonical.com>
      Acked-by: NEric Dumazet <edumazet@google.com>
      Acked-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f36c3747
    • J
      Merge branch 'master' of... · f30a9443
      John W. Linville 提交于
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
      
      John W. Linville says:
      
      ====================
      This is a batch of fixes intended for 3.7...
      
      Included are two pulls.  Regarding the mac80211 tree, Johannes says:
      
      "Please pull my mac80211.git tree (see below) to get two more fixes for
      3.7. Both fix regressions introduced *before* this cycle that weren't
      noticed until now, one for IBSS not cleaning up properly and the other
      to add back the "wireless" sysfs directory for Fedora's startup scripts."
      
      Regarding the iwlwifi tree, Johannes says:
      
      "Please also pull my iwlwifi.git tree, I have two fixes: one to remove a
      spurious warning that can actually trigger in legitimate situations, and
      the other to fix a regression from when monitor mode was changed to use
      the "sniffer" firmware mode."
      
      Also included is an nfc tree pull.  Samuel says:
      
      "We mostly have pn533 fixes here, 2 memory leaks and an early unlocking fix.
      Moreover, we also have an LLCP adapter linked list insertion fix."
      
      On top of that, a few more bits...  Albert Pool adds a USB ID
      to rtlwifi.  Bing Zhao provides two mwifiex fixes -- one to fix
      a system hang during a command timeout, and the other to properly
      report a suspend error to the MMC core.  Finally, Sujith Manoharan
      fixes a thinko that would trigger an ath9k hang during device reset.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f30a9443
  4. 21 11月, 2012 15 次提交
  5. 20 11月, 2012 10 次提交