[ 44/48] bridging: fix rx_handlers return code

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Cristian Bercaru [ Upstream commit 3bc1b1add7a8484cc4a261c3e128dbe1528ce01f ] The frames for which rx_handlers return RX_HANDLER_CONSUMED are no longer counted as dropped. They are counted as

[ 46/48] rtnl: fix info leak on RTM_GETLINK request for VF devices

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Mathias Krause [ Upstream commit 84d73cd3fb142bf1298a8c13fd4ca50fd2432372 ] Initialize the mac address buffer with 0 as the driver specific function will probably not fill the whole buffer. In

[ 45/48] ipv6: stop multicast forwarding to process interface scoped addresses

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Hannes Frederic Sowa [ Upstream commit ddf64354af4a702ee0b85d0a285ba74c7278a460 ] v2: a) used struct ipv6_addr_props v3: a) reverted changes for ipv6_addr_props v4: a) do not use __ipv6_addr

[ 43/48] netlabel: correctly list all the static label mappings

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Paul Moore [ Upstream commits 0c1233aba1e948c37f6dc7620cb7c253fcd71ce9 and a6a8fe950e1b8596bb06f2c89c3a1a4bf2011ba9 ] When we have a large number of static label mappings that spill across t

[ 40/48] tcp: fix double-counted receiver RTT when leaving receiver fast path

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Neal Cardwell [ Upstream commit aab2b4bf224ef8358d262f95b568b8ad0cecf0a0 ] We should not update ts_recent and call tcp_rcv_rtt_measure_ts() both before and after going to step5. That wastes CP

[ 18/40] hwmon: (lineage-pem) Add missing terminating entry for pem_[input|fan]_attributes

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Axel Lin commit df069079c153d22adf6c28dcc0b1cf62bba75167 upstream. Signed-off-by: Axel Lin Acked-by: Jean Delvare Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman --- driver

[ 17/40] ALSA: seq: Fix missing error handling in snd_seq_timer_open()

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 66efdc71d95887b652a742a5dae51fa834d71465 upstream. snd_seq_timer_open() didn't catch the whole error path but let through if the timer id is a slave. This may lead to Oops

[ 32/40] rds: limit the size allocated by rds_message_alloc()

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Cong Wang [ Upstream commit ece6b0a2b25652d684a7ced4ae680a863af041e0 ] Dave Jones reported the following bug: "When fed mangled socket data, rds will trust what userspace gives it, and tries

[ 21/40] selinux: use GFP_ATOMIC under spin_lock

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter commit 4502403dcf8f5c76abd4dbab8726c8e4ecb5cd34 upstream. The call tree here is: sk_clone_lock() <- takes bh_lock_sock(newsk); xfrm_sk_clone_policy() __xfrm_sk_clone

[ 37/40] bridging: fix rx_handlers return code

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Cristian Bercaru [ Upstream commit 3bc1b1add7a8484cc4a261c3e128dbe1528ce01f ] The frames for which rx_handlers return RX_HANDLER_CONSUMED are no longer counted as dropped. They are counted as

[ 40/40] dcbnl: fix various netlink info leaks

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Mathias Krause [ Upstream commit 29cd8ae0e1a39e239a3a7b67da1986add1199fc0 ] The dcb netlink interface leaks stack memory in various places: * perm_addr[] buffer is only filled at max with 12 o

Re: [ 29/75] perf,x86: fix kernel crash with PEBS/BTS after suspend/resume

On Mon, Mar 18, 2013 at 10:06 PM, Greg Kroah-Hartman wrote: > 3.8-stable review patch. If anyone has any objections, please let me know. > Greg, you also need to pick David Rientjes patch to fix compilation on non X86 architectures. Thanks. > -- > > From: Stephane Eranian > > com

[ 39/40] rtnl: fix info leak on RTM_GETLINK request for VF devices

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Mathias Krause [ Upstream commit 84d73cd3fb142bf1298a8c13fd4ca50fd2432372 ] Initialize the mac address buffer with 0 as the driver specific function will probably not fill the whole buffer. In

[ 38/40] ipv6: stop multicast forwarding to process interface scoped addresses

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Hannes Frederic Sowa [ Upstream commit ddf64354af4a702ee0b85d0a285ba74c7278a460 ] v2: a) used struct ipv6_addr_props v3: a) reverted changes for ipv6_addr_props v4: a) do not use __ipv6_addr

[ 26/40] btrfs: use rcu_barrier() to wait for bdev puts at unmount

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Eric Sandeen commit bc178622d40d87e75abc131007342429c9b03351 upstream. Doing this would reliably fail with -EBUSY for me: # mount /dev/sdb2 /mnt/scratch; umount /mnt/scratch; mkfs.btrfs -f /de

[ 35/40] tun: add a missing nf_reset() in tun_net_xmit()

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit f8af75f3517a24838a36eb5797a1a3e60bf9e276 ] Dave reported following crash : general protection fault: [#1] SMP CPU 2 Pid: 25407, comm: qemu-kvm Not tainted

[ 20/40] powerpc: Fix cputable entry for 970MP rev 1.0

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Benjamin Herrenschmidt commit d63ac5f6cf31c8a83170a9509b350c1489a7262b upstream. Commit 44ae3ab3358e962039c36ad4ae461ae9fb29596c forgot to update the entry for the 970MP rev 1.0 processor when

[ 19/40] w1: fix oops when w1_search is called from netlink connector

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Marcin Jurkowski commit 9d1817cab2f030f6af360e961cc69bb1da8ad765 upstream. On Sat, Mar 02, 2013 at 10:45:10AM +0100, Sven Geggus wrote: > This is the bad commit I found doing git bisect: > 04f4

[ 34/40] tcp: fix double-counted receiver RTT when leaving receiver fast path

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Neal Cardwell [ Upstream commit aab2b4bf224ef8358d262f95b568b8ad0cecf0a0 ] We should not update ts_recent and call tcp_rcv_rtt_measure_ts() both before and after going to step5. That wastes CP

[ 33/40] net: ipv6: Dont purge default router if accept_ra=2

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Lorenzo Colitti [ Upstream commit 3e8b0ac3e41e3c88a5522d5df7212438ab51 ] Setting net.ipv6.conf..accept_ra=2 causes the kernel to accept RAs even when forwarding is enabled. However, enabli

Re: [PULL] vhost: tcm_vhost fixes for 3.9

On Mon, Mar 18, 2013 at 02:10:03PM -0700, Nicholas A. Bellinger wrote: > On Mon, 2013-03-18 at 21:54 +0200, Michael S. Tsirkin wrote: > > On Mon, Mar 18, 2013 at 01:01:36PM -0400, David Miller wrote: > > > From: "Michael S. Tsirkin" > > > Date: Mon, 18 Mar 2013 13:20:03 +0200 > > > > > > > The fo

[ 31/40] l2tp: Restore socket refcount when sendmsg succeeds

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Guillaume Nault [ Upstream commit 8b82547e33e85fc24d4d172a93c796de1fefa81a ] The sendmsg() syscall handler for PPPoL2TP doesn't decrease the socket reference counter after successful transmiss

[ 30/40] loopdev: fix a deadlock

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Guo Chao commit 5370019dc2d2c2ff90e95d181468071362934f3a upstream. bd_mutex and lo_ctl_mutex can be held in different order. Path #1: blkdev_open blkdev_get __blkdev_get (hold bd_mutex)

[ 29/40] block: use i_size_write() in bd_set_size()

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Guo Chao commit d646a02a9d44d1421f273ae3923d97b47b918176 upstream. blkdev_ioctl(GETBLKSIZE) uses i_size_read() to read size of block device. If we update block size directly, reader may see int

[ 28/40] hwmon: (sht15) Fix memory leak if regulator_enable() fails

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Ben Hutchings Commit 3e78080f8148 ('hwmon: (sht15) Check return value of regulator_enable()') depends on the use of devm_kmalloc() for automatic resource cleanup in the failure cases, which was

[ 27/40] drm/i915: EBUSY status handling added to i915_gem_fault().

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Dmitry Rogozhkin commit e79e0fe380847493266fba557217e2773c61bd1b upstream. Subsequent threads returning EBUSY from vm_insert_pfn() was not handled correctly. As a result concurrent access from

[ 36/40] netlabel: correctly list all the static label mappings

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Paul Moore [ Upstream commits 0c1233aba1e948c37f6dc7620cb7c253fcd71ce9 and a6a8fe950e1b8596bb06f2c89c3a1a4bf2011ba9 ] When we have a large number of static label mappings that spill across t

[ 15/40] md: protect against crash upon fsync on ro array

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Sebastian Riemer commit bbfa57c0f2243a7c31fd248d22e9861a2802cad5 upstream. If an fsync occurs on a read-only array, we need to send a completion for the IO and may not increment the active IO c

[PATCH tip/core/rcu 0/7] Fixes for 3.9

Hello! This series contains the following fixes for RCU: 1. Whitespace fix courtesy of Jiang Fang. 2. Avoid raising softirq from CPUs going offline. 3. Remove obsolete CPU-hotplug comment, courtesy of Srivatsa Bhat. 4. Delete unused "wakemask" field. 5. Fix hlist_bl_s

[ 02/40] virtio: rng: disallow multiple device registrations, fixes crashes

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Amit Shah commit e84e7a56a3aa2963db506299e29a5f3f09377f9b upstream. The code currently only supports one virtio-rng device at a time. Invoking guests with multiple devices causes the guest to b

[ 12/40] ext3: Fix format string issues

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Lars-Peter Clausen commit 8d0c2d10dd72c5292eda7a06231056a4c972e4cc upstream. ext3_msg() takes the printk prefix as the second parameter and the format string as the third parameter. Two callers

[ 24/40] perf,x86: fix link failure for non-Intel configs

3.0-stable review patch. If anyone has any objections, please let me know. -- From: David Rientjes commit 6c4d3bc99b3341067775efd4d9d13cc8e655fd7c upstream. Commit 1d9d8639c063 ("perf,x86: fix kernel crash with PEBS/BTS after suspend/resume") introduces a link failure since pe

[PATCH tip/core/rcu 2/7] rcu: Avoid invoking RCU core on offline CPUs

From: "Paul E. McKenney" Offline CPUs transition through the scheduler to the idle loop one last time before being shut down. This can result in RCU raising softirq on this CPU, which is at best useless given that the CPU's callbacks will be offloaded at CPU_DEAD time. This commit therefore avo

Re: [PATCH] x86, kdump: Set crashkernel_low automatically

On 03/18/2013 01:00 PM, Vivek Goyal wrote: > On Mon, Mar 18, 2013 at 12:10:47PM -0700, H. Peter Anvin wrote: >> On 03/18/2013 08:33 AM, Vivek Goyal wrote: >>> >>> Thinking more about it, if ongoing DMA is an issue, then setting up >>> software iotlb in those areas is also prone to being overwritten

[PATCH tip/core/rcu 4/7] rcu: Delete unused rcu_node "wakemask" field

From: "Paul E. McKenney" Signed-off-by: Paul E. McKenney --- kernel/rcutree.h | 3 --- 1 file changed, 3 deletions(-) diff --git a/kernel/rcutree.h b/kernel/rcutree.h index c896b50..8e75609 100644 --- a/kernel/rcutree.h +++ b/kernel/rcutree.h @@ -134,9 +134,6 @@ struct rcu_node {

[PATCH tip/core/rcu 1/7] rcu: Fix spacing problem

From: Jiang Fang Signed-off-by: Jiang Fang Signed-off-by: Paul E. McKenney --- kernel/rcutree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/rcutree.c b/kernel/rcutree.c index 5b8ad82..157539a 100644 --- a/kernel/rcutree.c +++ b/kernel/rcutree.c @@ -3171,7 +3171,7

[PATCH tip/core/rcu 7/7] rcu: Tone down debugging during boot-up and shutdown.

From: "Paul E. McKenney" In some situations, randomly delaying RCU grace-period initialization can cause more trouble than help. This commit therefore restricts this type of RCU self-torture to runtime, giving it a rest during boot and shutdown. Reported-by: Sasha Levin Signed-off-by: Paul E.

[PATCH tip/core/rcu 6/7] rcu: Add softirq-stall indications to stall-warning messages

From: "Paul E. McKenney" If RCU's softirq handler is prevented from executing, an RCU CPU stall warning can result. Ways to prevent RCU's softirq handler from executing include: (1) CPU spinning with interrupts disabled, (2) infinite loop in some softirq handler, and (3) in -rt kernels, an infin

[PATCH tip/core/rcu 3/7] rcu: Remove comment referring to __stop_machine()

From: "Srivatsa S. Bhat" Although it used to be that CPU_DYING notifiers executed on the outgoing CPU with interrupts disabled and with all other CPUs spinning, this is no longer the case. This commit therefore removes this obsolete comment. Signed-off-by: Srivatsa S. Bhat Signed-off-by: Paul

[PATCH tip/core/rcu 5/7] rcu: Fix hlist_bl_set_first_rcu() annotation

From: Steven Whitehouse Abhi noticed that we were getting a complaint from the RCU subsystem about access of an RCU protected list under the write side bit lock. This commit adds additional annotation to check both the RCU read lock and the write side bit lock before printing a message. Reported

[ 23/40] perf,x86: fix wrmsr_on_cpu() warning on suspend/resume

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Linus Torvalds commit 2a6e06b2aed6995af401dcd4feb5e79a0c7ea554 upstream. Commit 1d9d8639c063 ("perf,x86: fix kernel crash with PEBS/BTS after suspend/resume") fixed a crash when doing PEBS perf

Re: [ 29/75] perf,x86: fix kernel crash with PEBS/BTS after suspend/resume

On Mon, Mar 18, 2013 at 10:11:28PM +0100, Stephane Eranian wrote: > On Mon, Mar 18, 2013 at 10:06 PM, Greg Kroah-Hartman > wrote: > > 3.8-stable review patch. If anyone has any objections, please let me know. > > > Greg, you also need to pick David Rientjes patch to fix compilation on > non X86 a

[ 22/40] perf,x86: fix kernel crash with PEBS/BTS after suspend/resume

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Stephane Eranian commit 1d9d8639c063caf6efc2447f5f26aa637f844ff6 upstream. This patch fixes a kernel crash when using precise sampling (PEBS) after a suspend/resume. Turns out the CPU notifier

Re: [PATCH] x86: mm: accurate the comments for STEP_SIZE_SHIFT macro

On Mon, Mar 18, 2013 at 12:14 PM, H. Peter Anvin wrote: > Instead, try to explain why 5 is the correct value in the current code > and how it is (or should be!) derived. initial mapped size is PMD_SIZE, aka 2M. if we use step_size to be PUD_SIZE aka 1G, as most worse case that 1G is cross the 1G

[ 16/40] Revert duplicated perf commit.

3.0-stable review patch. If anyone has any objections, please let me know. -- This reverts commit 2431496fbdd142ccc83138d94f3f510a36ce9270 as it was applied incorrectly twice. Thanks to Jiri for pointing this out. Signed-off-by: Greg Kroah-Hartman Cc: Jiri Slaby Cc: Andrew Va

[ 25/40] s390/mm: fix flush_tlb_kernel_range()

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Heiko Carstens commit f6a70a07079518280022286a1dceb797d12e1edf upstream. Our flush_tlb_kernel_range() implementation calls __tlb_flush_mm() with &init_mm as argument. __tlb_flush_mm() however w

[ 14/40] TTY: do not reset masters packet mode

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Jiri Slaby commit b81273a132177edd806476b953f6afeb17b786d5 upstream. Now that login from util-linux is forced to drop all references to a TTY which it wants to hangup (to reach reference count

[ 11/40] signal: always clear sa_restorer on execve

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Kees Cook commit 2ca39528c01a933f6689cd6505ce65bd6d68a530 upstream. When the new signal handlers are set up, the location of sa_restorer is not cleared, leaking a parent process's address space

[ 13/40] tty: serial: fix typo "ARCH_S5P6450"

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Paul Bolle commit 827aa0d36d486f359808c8fb931cf7a71011a09d upstream. This could have been either ARCH_S5P64X0 or CPU_S5P6450. Looking at commit 2555e663b367b8d555e76023f4de3f6338c28d6c ("ARM: S

[ 10/40] staging: vt6656: Fix oops on resume from suspend.

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Malcolm Priestley commit 6987a6dabfc40222ef767f67b57212fe3a0225fb upstream. Remove usb_put_dev from vt6656_suspend and usb_get_dev from vt6566_resume. These are not normally in suspend/resume

[ 05/40] usb: cp210x new Vendor/Device IDs

3.0-stable review patch. If anyone has any objections, please let me know. -- From: "Matwey V. Kornilov" commit be3101c23394af59694c8a2aae6d07f5da62fea5 upstream. This patch adds support for the Lake Shore Cryotronics devices to the CP210x driver. These lines are ported from

[ 01/40] qcaux: add Franklin U600

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Dan Williams commit 2d90e63603ac235aecd7d20e234616e0682c8b1f upstream. 4 ports; AT/PPP is standard CDC-ACM. The other three (added by this patch) are QCDM/DIAG, possibly GPS, and unknown. Sig

[ 09/40] USB: EHCI: dont check DMA values in QH overlays

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit feca7746d5d9e84b105a613b7f3b6ad00d327372 upstream. This patch (as1661) fixes a rather obscure bug in ehci-hcd. In a couple of places, the driver compares the DMA address stor

[ 08/40] USB: storage: fix Huawei mode switching regression

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Bjørn Mork commit ab4b71644a26d1ab92b987b2fd30e17c25e89f85 upstream. This reverts commit 200e0d99 ("USB: storage: optimize to match the Huawei USB storage devices and support new switch command

[ 23/48] powerpc: Fix cputable entry for 970MP rev 1.0

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Benjamin Herrenschmidt commit d63ac5f6cf31c8a83170a9509b350c1489a7262b upstream. Commit 44ae3ab3358e962039c36ad4ae461ae9fb29596c forgot to update the entry for the 970MP rev 1.0 processor when

[ 21/48] w1: fix oops when w1_search is called from netlink connector

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Marcin Jurkowski commit 9d1817cab2f030f6af360e961cc69bb1da8ad765 upstream. On Sat, Mar 02, 2013 at 10:45:10AM +0100, Sven Geggus wrote: > This is the bad commit I found doing git bisect: > 04f4

[ 34/48] loopdev: fix a deadlock

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Guo Chao commit 5370019dc2d2c2ff90e95d181468071362934f3a upstream. bd_mutex and lo_ctl_mutex can be held in different order. Path #1: blkdev_open blkdev_get __blkdev_get (hold bd_mutex)

[ 33/48] block: use i_size_write() in bd_set_size()

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Guo Chao commit d646a02a9d44d1421f273ae3923d97b47b918176 upstream. blkdev_ioctl(GETBLKSIZE) uses i_size_read() to read size of block device. If we update block size directly, reader may see int

[ 42/48] macvlan: Set IFF_UNICAST_FLT flag to prevent unnecessary promisc mode.

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Vlad Yasevich [ Upstream commit 87ab7f6f2874f1115817e394a7ed2dea1c72549e ] Macvlan already supports hw address filters. Set the IFF_UNICAST_FLT so that it doesn't needlesly enter PROMISC mode

[ 00/40] 3.0.70-stable review

This is the start of the stable review cycle for the 3.0.70 release. There are 40 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Mar 20 21:10:06 UTC 2013. Anything receive

[ 07/40] usb: serial: Add Rigblaster Advantage to device table

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Steve Conklin commit a57e82a18779ab8a5e5a1f5841cef937cf578913 upstream. The Rigblaster Advantage is an amateur radio interface sold by West Mountain Radio. It contains a cp210x serial interface

[ 06/40] USB: added support for Cinterions products AH6 and PLS8

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Christian Schmiedl commit 1941138e1c024ecb5bd797d414928d3eb94d8662 upstream. add support for Cinterion's products AH6 and PLS8 by adding Product IDs and USB_DEVICE tuples. Signed-off-by: Chris

Re: [PULL] vhost: tcm_vhost fixes for 3.9

On Mon, 2013-03-18 at 21:54 +0200, Michael S. Tsirkin wrote: > On Mon, Mar 18, 2013 at 01:01:36PM -0400, David Miller wrote: > > From: "Michael S. Tsirkin" > > Date: Mon, 18 Mar 2013 13:20:03 +0200 > > > > > The following changes since commit > > > 8c6216d7f118a128678270824b6a1286a63863ca: > > >

[ 04/40] USB: cdc-wdm: fix buffer overflow

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Oliver Neukum commit c0f5ecee4e741667b2493c742b60b6218d40b3aa upstream. The buffer for responses must not overflow. If this would happen, set a flag, drop the data and return an error after use

[ 03/40] USB: option: add Huawei E5331

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Bjørn Mork commit daec90e7382cbd0e73eb6861109b3da91e5ab1f3 upstream. Another device using CDC ACM with vendor specific protocol to mark serial functions. Signed-off-by: Bjørn Mork Signed-off-

[ 39/48] net: ipv6: Dont purge default router if accept_ra=2

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Lorenzo Colitti [ Upstream commit 3e8b0ac3e41e3c88a5522d5df7212438ab51 ] Setting net.ipv6.conf..accept_ra=2 causes the kernel to accept RAs even when forwarding is enabled. However, enabli

[ 38/48] rds: limit the size allocated by rds_message_alloc()

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Cong Wang [ Upstream commit ece6b0a2b25652d684a7ced4ae680a863af041e0 ] Dave Jones reported the following bug: "When fed mangled socket data, rds will trust what userspace gives it, and tries

[ 48/48] 6lowpan: Fix endianness issue in is_addr_link_local().

3.4-stable review patch. If anyone has any objections, please let me know. -- From: YOSHIFUJI Hideaki [ Upstream commit 9026c4927254f5bea695cc3ef2e255280e6a3011 ] Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/iee

Re: [PATCH 4/4] selftests: Add basic posix timers selftests

On Fri, 15 Mar 2013 17:54:02 +0100 Frederic Weisbecker wrote: > Add some initial basic tests on a few posix timers > interface such as setitimer() and timer_settime(). > > These simply check that expiration happens in a reasonable > timeframe after expected elapsed clock time (user time, > user

[PATCH v3] x86, kdump: Set crashkernel_low automatically

Current code does not set low range for crashkernel if the user does not specify that. That cause regressions on system that does not support intel_iommu properly. Chao said that his system does work well on 3.8 without extra parameter. even iommu does not work with kdump. Set crashkernel_low au

[ 47/48] dcbnl: fix various netlink info leaks

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Mathias Krause [ Upstream commit 29cd8ae0e1a39e239a3a7b67da1986add1199fc0 ] The dcb netlink interface leaks stack memory in various places: * perm_addr[] buffer is only filled at max with 12 o

[ 27/48] s390: critical section cleanup vs. machine checks

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Martin Schwidefsky commit 6551fbdfd8b85d1ab5822ac98abb4fb449bcfae0 upstream. The current machine check code uses the registers stored by the machine in the lowcore at __LC_GPREGS_SAVE_AREA as t

[ 36/48] drm/i915: Increase the RC6p threshold.

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Stéphane Marchesin commit 0920a48719f1ceefc909387a64f97563848c7854 upstream. This increases GEN6_RC6p_THRESHOLD from 10 to 15. For some reason this avoids the gen6_gt_check_fifodbg.isra

[ 32/48] hwmon: (sht15) Fix memory leak if regulator_enable() fails

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Ben Hutchings Commit 3e78080f8148 ('hwmon: (sht15) Check return value of regulator_enable()') depends on the use of devm_kmalloc() for automatic resource cleanup in the failure cases, which was

[ 31/48] drm/i915: EBUSY status handling added to i915_gem_fault().

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Dmitry Rogozhkin commit e79e0fe380847493266fba557217e2773c61bd1b upstream. Subsequent threads returning EBUSY from vm_insert_pfn() was not handled correctly. As a result concurrent access from

[ 30/48] atmel_lcdfb: fix 16-bpp modes on older SOCs

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Johan Hovold commit a79eac7165ed62114e6ca197195aa5060a54f137 upstream. Fix regression introduced by commit 787f9fd23283 ("atmel_lcdfb: support 16bit BGR:565 mode, remove unsupported 15bit modes

[ 29/48] btrfs: use rcu_barrier() to wait for bdev puts at unmount

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Sandeen commit bc178622d40d87e75abc131007342429c9b03351 upstream. Doing this would reliably fail with -EBUSY for me: # mount /dev/sdb2 /mnt/scratch; umount /mnt/scratch; mkfs.btrfs -f /de

[ 28/48] s390/mm: fix flush_tlb_kernel_range()

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Heiko Carstens commit f6a70a07079518280022286a1dceb797d12e1edf upstream. Our flush_tlb_kernel_range() implementation calls __tlb_flush_mm() with &init_mm as argument. __tlb_flush_mm() however w

[ 17/48] perf,x86: fix kernel crash with PEBS/BTS after suspend/resume

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Stephane Eranian commit 1d9d8639c063caf6efc2447f5f26aa637f844ff6 upstream. This patch fixes a kernel crash when using precise sampling (PEBS) after a suspend/resume. Turns out the CPU notifier

[ 26/48] perf,x86: fix link failure for non-Intel configs

3.4-stable review patch. If anyone has any objections, please let me know. -- From: David Rientjes commit 6c4d3bc99b3341067775efd4d9d13cc8e655fd7c upstream. Commit 1d9d8639c063 ("perf,x86: fix kernel crash with PEBS/BTS after suspend/resume") introduces a link failure since pe

[ 25/48] perf,x86: fix wrmsr_on_cpu() warning on suspend/resume

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Linus Torvalds commit 2a6e06b2aed6995af401dcd4feb5e79a0c7ea554 upstream. Commit 1d9d8639c063 ("perf,x86: fix kernel crash with PEBS/BTS after suspend/resume") fixed a crash when doing PEBS perf

[ 24/48] selinux: use GFP_ATOMIC under spin_lock

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Dan Carpenter commit 4502403dcf8f5c76abd4dbab8726c8e4ecb5cd34 upstream. The call tree here is: sk_clone_lock() <- takes bh_lock_sock(newsk); xfrm_sk_clone_policy() __xfrm_sk_clone

[ 20/48] hwmon: (lineage-pem) Add missing terminating entry for pem_[input|fan]_attributes

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Axel Lin commit df069079c153d22adf6c28dcc0b1cf62bba75167 upstream. Signed-off-by: Axel Lin Acked-by: Jean Delvare Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman --- driver

[ 19/48] hwmon: (pmbus/ltc2978) Fix temperature reporting

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Guenter Roeck commit 8c958c703ef8804093437959221951eaf0e1e664 upstream. On LTC2978, only READ_TEMPERATURE is supported. It reports the internal junction temperature. This register is unpaged.

[ 18/48] ALSA: seq: Fix missing error handling in snd_seq_timer_open()

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 66efdc71d95887b652a742a5dae51fa834d71465 upstream. snd_seq_timer_open() didn't catch the whole error path but let through if the timer id is a slave. This may lead to Oops

[ 11/48] staging: vt6656: Fix oops on resume from suspend.

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Malcolm Priestley commit 6987a6dabfc40222ef767f67b57212fe3a0225fb upstream. Remove usb_put_dev from vt6656_suspend and usb_get_dev from vt6566_resume. These are not normally in suspend/resume

[ 15/48] tty: serial: fix typo "ARCH_S5P6450"

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Paul Bolle commit 827aa0d36d486f359808c8fb931cf7a71011a09d upstream. This could have been either ARCH_S5P64X0 or CPU_S5P6450. Looking at commit 2555e663b367b8d555e76023f4de3f6338c28d6c ("ARM: S

Re: [PATCH 4/4] selftests: Add basic posix timers selftests

2013/3/18 Andrew Morton : > On Fri, 15 Mar 2013 17:54:02 +0100 Frederic Weisbecker > wrote: > >> Add some initial basic tests on a few posix timers >> interface such as setitimer() and timer_settime(). >> >> These simply check that expiration happens in a reasonable >> timeframe after expected el

[ 06/48] usb: cp210x new Vendor/Device IDs

3.4-stable review patch. If anyone has any objections, please let me know. -- From: "Matwey V. Kornilov" commit be3101c23394af59694c8a2aae6d07f5da62fea5 upstream. This patch adds support for the Lake Shore Cryotronics devices to the CP210x driver. These lines are ported from

[ 13/48] ext3: Fix format string issues

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Lars-Peter Clausen commit 8d0c2d10dd72c5292eda7a06231056a4c972e4cc upstream. ext3_msg() takes the printk prefix as the second parameter and the format string as the third parameter. Two callers

[PATCH 02/12] SELinux: define mapping for CAP_COMPROMISE_KERNEL

From: Josh Boyer Add the name of the new CAP_COMPROMISE_KERNEL capability. This allows SELinux policies to properly map CAP_COMPROMISE_KERNEL to the appropriate capability class. Signed-off-by: Josh Boyer --- security/selinux/include/classmap.h | 4 ++-- 1 file changed, 2 insertions(+), 2 dele

[PATCH 03/12] Secure boot: Add a dummy kernel parameter that will switch on Secure Boot mode

From: Josh Boyer This forcibly drops CAP_COMPROMISE_KERNEL from both cap_permitted and cap_bset in the init_cred struct, which everything else inherits from. This works on any machine and can be used to develop even if the box doesn't have UEFI. Signed-off-by: Josh Boyer --- Documentation/ker

[PATCH 01/12] Security: Add CAP_COMPROMISE_KERNEL

Caring about protecting the kernel from UID 0 was previously relatively uninteresting, since an attacker could simply modify the kernel, a module or an earlier part of the boot chain in order to insert new code. However, there are now a range of widely-deployed mechanisms for ensuring the authentic

[PATCH 10/12] acpi: Ignore acpi_rsdp kernel parameter in a secure boot environment

From: Josh Boyer This option allows userspace to pass the RSDP address to the kernel. This could potentially be used to circumvent the secure boot trust model. We ignore the setting if we don't have the CAP_COMPROMISE_KERNEL capability. Signed-off-by: Josh Boyer --- drivers/acpi/osl.c | 2 +-

[PATCH 09/12] Require CAP_COMPROMISE_KERNEL for /dev/mem and /dev/kmem access

Allowing users to write to address space makes it possible for the kernel to be subverted. Restrict this when we need to protect the kernel. Signed-off-by: Matthew Garrett --- drivers/char/mem.c | 6 ++ 1 file changed, 6 insertions(+) diff --git a/drivers/char/mem.c b/drivers/char/mem.c ind

[PATCH 08/12] asus-wmi: Restrict debugfs interface

We have no way of validating what all of the Asus WMI methods do on a given machine, and there's a risk that some will allow hardware state to be manipulated in such a way that arbitrary code can be executed in the kernel. Add a capability check to prevent that. Signed-off-by: Matthew Garrett ---

[PATCH 07/12] ACPI: Limit access to custom_method

It must be impossible for even root to get code executed in kernel context under a secure boot environment. custom_method effectively allows arbitrary access to system memory, so it needs to have a capability check here. Signed-off-by: Matthew Garrett --- drivers/acpi/custom_method.c | 3 +++ 1

[PATCH 06/12] x86: Require CAP_COMPROMISE_KERNEL for IO port access

IO port access would permit users to gain access to PCI configuration registers, which in turn (on a lot of hardware) give access to MMIO register space. This would potentially permit root to trigger arbitrary DMA, so lock it down by default. Signed-off-by: Matthew Garrett --- arch/x86/kernel/io

[PATCH 05/12] PCI: Require CAP_COMPROMISE_KERNEL for PCI BAR access

Any hardware that can potentially generate DMA has to be locked down from userspace in order to avoid it being possible for an attacker to cause arbitrary kernel behaviour. Default to paranoid - in future we can potentially relax this for sufficiently IOMMU-isolated devices. Signed-off-by: Matthew

Re: [ 29/75] perf,x86: fix kernel crash with PEBS/BTS after suspend/resume

On Mon, Mar 18, 2013 at 10:20 PM, Greg Kroah-Hartman wrote: > On Mon, Mar 18, 2013 at 10:11:28PM +0100, Stephane Eranian wrote: >> On Mon, Mar 18, 2013 at 10:06 PM, Greg Kroah-Hartman >> wrote: >> > 3.8-stable review patch. If anyone has any objections, please let me know. >> > >> Greg, you also

<    1   2   3   4   5   6   7   8   9   10   >