summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2011-11-25Merge branch 'gpio-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson * 'gpio-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson: gpio: pca953x: Staticise pca953x_get_altdata()
2011-11-25x86: consolidate xchg and xadd macrosJeremy Fitzhardinge
They both have a basic "put new value in location, return old value" pattern, so they can use the same macro easily. Signed-off-by: Jeremy Fitzhardinge <jeremy@goop.org>
2011-11-25x86/cmpxchg: add a locked add() helperJeremy Fitzhardinge
Mostly to remove some conditional code in spinlock.h. Signed-off-by: Jeremy Fitzhardinge <jeremy@goop.org>
2011-11-25netns: fix proxy ARP entries listing on a netnsJorge Boncompte [DTI2]
Skip entries from foreign network namespaces. Signed-off-by: Jorge Boncompte [DTI2] <jorge@dti2.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-25hwmon: Remove redundant spi driver bus initializationLars-Peter Clausen
In ancient times it was necessary to manually initialize the bus field of an spi_driver to spi_bus_type. These days this is done in spi_register_driver(), so we can drop the manual assignment. The patch was generated using the following coccinelle semantic patch: // <smpl> @@ identifier _driver; @@ struct spi_driver _driver = { .driver = { - .bus = &spi_bus_type, }, }; // </smpl> Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Cc: Jean Delvare <khali@linux-fr.org> Cc: Guenter Roeck <guenter.roeck@ericsson.com> Cc: lm-sensors@lm-sensors.org Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
2011-11-25net/netlabel: copy and paste bug in netlbl_cfg_unlbl_map_add()Dan Carpenter
This was copy and pasted from the IPv4 code. We're calling the ip4 version of that function and map4 is NULL. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-24ext4: fix racy use-after-free in ext4_end_io_dio()Tejun Heo
ext4_end_io_dio() queues io_end->work and then clears iocb->private; however, io_end->work calls aio_complete() which frees the iocb object. If that slab object gets reallocated, then ext4_end_io_dio() can end up clearing someone else's iocb->private, this use-after-free can cause a leak of a struct ext4_io_end_t structure. Detected and tested with slab poisoning. [ Note: Can also reproduce using 12 fio's against 12 file systems with the following configuration file: [global] direct=1 ioengine=libaio iodepth=1 bs=4k ba=4k size=128m [create] filename=${TESTDIR} rw=write -- tytso ] Google-Bug-Id: 5354697 Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Reported-by: Kent Overstreet <koverstreet@google.com> Tested-by: Kent Overstreet <koverstreet@google.com> Cc: stable@kernel.org
2011-11-25powerpc/44x: Add mtd ndfc to the ppx44x defconfigTony Breeds
Signed-off-by: Tony Breeds <tony@bakeyournoodle.com> Acked-by: Josh Boyer <jwboyer@gmail.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2011-11-25powerpc: Fix compiliation with hugetlbfs enabledKumar Gala
arch/powerpc/mm/hugetlbpage.c: In function 'reserve_hugetlb_gpages': arch/powerpc/mm/hugetlbpage.c:312:2: error: implicit declaration of function 'parse_args' Signed-off-by: Kumar Gala <galak@kernel.crashing.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2011-11-24cgroup_freezer: fix freezing groups with stopped tasksMichal Hocko
2d3cbf8b (cgroup_freezer: update_freezer_state() does incorrect state transitions) removed is_task_frozen_enough and replaced it with a simple frozen call. This, however, breaks freezing for a group with stopped tasks because those cannot be frozen and so the group remains in CGROUP_FREEZING state (update_if_frozen doesn't count stopped tasks) and never reaches CGROUP_FROZEN. Let's add is_task_frozen_enough back and use it at the original locations (update_if_frozen and try_to_freeze_cgroup). Semantically we consider stopped tasks as frozen enough so we should consider both cases when testing frozen tasks. Testcase: mkdir /dev/freezer mount -t cgroup -o freezer none /dev/freezer mkdir /dev/freezer/foo sleep 1h & pid=$! kill -STOP $pid echo $pid > /dev/freezer/foo/tasks echo FROZEN > /dev/freezer/foo/freezer.state while true do cat /dev/freezer/foo/freezer.state [ "`cat /dev/freezer/foo/freezer.state`" = "FROZEN" ] && break sleep 1 done echo OK Signed-off-by: Michal Hocko <mhocko@suse.cz> Acked-by: Li Zefan <lizf@cn.fujitsu.com> Cc: Tomasz Buchert <tomasz.buchert@inria.fr> Cc: Paul Menage <paul@paulmenage.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: stable@kernel.org Signed-off-by: Tejun Heo <htejun@gmail.com>
2011-11-24Merge branch 'fixes-dss' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes
2011-11-24Merge branch 'fixes' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes
2011-11-24Merge branch 'at91/defconfig' into fixesArnd Bergmann
2011-11-24ARM: at91: enable additional boards in existing soc defconfig filesJean-Christophe PLAGNIOL-VILLARD
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Cc: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2011-11-24ARM: at91: refresh soc defconfig files for 3.2Jean-Christophe PLAGNIOL-VILLARD
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Cc: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2011-11-24ARM: at91: rename defconfig files appropriatelyJean-Christophe PLAGNIOL-VILLARD
rename all Atmel reference board as soc defconfig Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Cc: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2011-11-24Merge branch 'mxs/for-arnd' of ↵Arnd Bergmann
git://git.linaro.org/people/shawnguo/linux-2.6 into fixes
2011-11-24arch/powerpc/sysdev/ehv_pic.c: add missing kfreeJulia Lawall
At this point, ehv_pic has been allocated but not stored anywhere, so it should be freed before leaving the function. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @exists@ local idexpression x; statement S,S1; expression E; identifier fl; expression *ptr != NULL; @@ x = \(kmalloc\|kzalloc\|kcalloc\)(...); ... if (x == NULL) S <... when != x when != if (...) { <+...kfree(x)...+> } when any when != true x == NULL x->fl ...> ( if (x == NULL) S1 | if (...) { ... when != x when forall ( return \(0\|<+...x...+>\|ptr\); | * return ...; ) } ) // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Acked-by: Timur Tabi <timur@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2011-11-24powerpc/fsl-lbc: Fix for fsl_upmAlexandre Rusev
If Freescale LBC driver fails to initialise itself from device tree, then internal structure is freed only but not NULL-fied. As result functions fsl_lbc_find() after checking the structure is not NULL are trying to access device registers. Signed-off-by: Alexandre Rusev <arusev@dev.rtsoft.ru> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2011-11-24drivers/edac/mpc85xx_edac.c: fix memory controller compatible for edacShaohui Xie
compatible in dts has been changed, so the driver needs to be updated accordingly. Signed-off-by: Shaohui Xie <Shaohui.Xie@freescale.com> Cc: Grant Likely <grant.likely@secretlab.ca> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2011-11-24powerpc/qe: Fixup QE_General4 errataJoakim Tjernlund
QE_General4 should only round up the divisor iff divisor is > 3. Rounding up lower divisors makes the error too big, causing USB on MPC832x to fail. Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se> Acked-by: Timur Tabi <timur@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2011-11-24slub: avoid potential NULL dereference or corruptionEric Dumazet
show_slab_objects() can trigger NULL dereferences or memory corruption. Another cpu can change its c->page to NULL or c->node to NUMA_NO_NODE while we use them. Use ACCESS_ONCE(c->page) and ACCESS_ONCE(c->node) to make sure this cannot happen. Acked-by: Christoph Lameter <cl@linux.com> Acked-by: David Rientjes <rientjes@google.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Pekka Enberg <penberg@kernel.org>
2011-11-24slub: use irqsafe_cpu_cmpxchg for put_cpu_partialChristoph Lameter
The cmpxchg must be irq safe. The fallback for this_cpu_cmpxchg only disables preemption which results in per cpu partial page operation potentially failing on non x86 platforms. This patch fixes the following problem reported by Christian Kujau: I seem to hit it with heavy disk & cpu IO is in progress on this PowerBook G4. Full dmesg & .config: http://nerdbynature.de/bits/3.2.0-rc1/oops/ I've enabled some debug options and now it really points to slub.c:2166 http://nerdbynature.de/bits/3.2.0-rc1/oops/oops4m.jpg With debug options enabled I'm currently in the xmon debugger, not sure what to make of it yet, I'll try to get something useful out of it :) Reported-by: Christian Kujau <lists@nerdbynature.de> Tested-by: Christian Kujau <lists@nerdbynature.de> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Acked-by: David Rientjes <rientjes@google.com> Signed-off-by: Christoph Lameter <cl@linux.com> Signed-off-by: Pekka Enberg <penberg@kernel.org>
2011-11-23powerpc/85xx: Fix compile error on p3060_qds.cKumar Gala
arch/powerpc/platforms/85xx/p3060_qds.c: In function '__machine_initcall_p3060_qds_declare_of_platform_devices': arch/powerpc/platforms/85xx/p3060_qds.c:73:1: error: implicit declaration of function 'declare_of_platform_devices' declare_of_platform_devices should have been corenet_ds_publish_devices. Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2011-11-23powerpc/p3060qds: Fix select of 'MPC8xxx_GPIO'Paul Bolle
The driver for the Freescale P3060 QDS got added by commit 96cc017c5b ("[...] Add support for P3060QDS board"). Its Kconfig entry selects MPC8xxx_GPIO. But at the time that driver got added MPC8xxx_GPIO was already renamed to GPIO_MPC8XXX, by commit c68308dd50c ("gpio: move mpc8xxx/512x gpio driver to drivers/gpio"). So make this driver select GPIO_MPC8XXX. Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Acked-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2011-11-23powerpc/p1023: set IRQ[4:6,11] to active-high level sensitive for PCIeRoy Zang
P1023 external IRQ[4:6, 11] are not pin out, but the interrupts are utilized by the PCIe controllers. As they are not exposed as pins we need to set them as active-high (internal to the SoC these interrupts are pulled down). IRQs[0:3,7:10] are pulled up on the board so we have them set as active-low. Signed-off-by: Roy Zang <tie-fei.zang@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2011-11-23Linux 3.2-rc3v3.2-rc3Linus Torvalds
2011-11-23Merge git://github.com/rustyrussell/linuxLinus Torvalds
* git://github.com/rustyrussell/linux: virtio-pci: make reset operation safer virtio-mmio: Correct the name of the guest features selector virtio: add HAS_IOMEM dependency to MMIO platform bus driver
2011-11-24virtio-pci: make reset operation saferMichael S. Tsirkin
virtio pci device reset actually just does an I/O write, which in PCI is really posted, that is it can complete on CPU before the device has received it. Further, interrupts might have been pending on another CPU, so device callback might get invoked after reset. This conflicts with how drivers use reset, which is typically: reset unregister a callback running after reset completed can race with unregister, potentially leading to use after free bugs. Fix by flushing out the write, and flushing pending interrupts. This assumes that device is never reset from its vq/config callbacks, or in parallel with being added/removed, document this assumption. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2011-11-24virtio-mmio: Correct the name of the guest features selectorSasha Levin
Guest features selector spelling mistake. Cc: Pawel Moll <pawel.moll@arm.com> Cc: Rusty Russell <rusty@rustcorp.com.au> Cc: virtualization@lists.linux-foundation.org Signed-off-by: Sasha Levin <levinsasha928@gmail.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2011-11-24virtio: add HAS_IOMEM dependency to MMIO platform bus driverHeiko Carstens
Fix this compile error on s390: CC [M] drivers/virtio/virtio_mmio.o drivers/virtio/virtio_mmio.c: In function 'vm_get_features': drivers/virtio/virtio_mmio.c:107:2: error: implicit declaration of function 'writel' Cc: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Acked-by: Pawel Moll <pawel.moll@arm.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2011-11-23Merge branch 'upstream-linus' of git://github.com/jgarzik/libata-devLinus Torvalds
* 'upstream-linus' of git://github.com/jgarzik/libata-dev: libata: fix build without BMDMA [libata] ahci_platform: fix DT probing
2011-11-23ipv4: Save nexthop address of LSRR/SSRR option to IPCB.Li Wei
We can not update iph->daddr in ip_options_rcv_srr(), It is too early. When some exception ocurred later (eg. in ip_forward() when goto sr_failed) we need the ip header be identical to the original one as ICMP need it. Add a field 'nexthop' in struct ip_options to save nexthop of LSRR or SSRR option. Signed-off-by: Li Wei <lw@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-23ehea: Use round_jiffies_relative to align workqueueAnton Blanchard
Use round_jiffies_relative to align the ehea workqueue and avoid extra wakeups. Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-23ehea: Reduce memory usage in buffer poolsAnton Blanchard
Now that we enable multiqueue by default the ehea driver is using quite a lot of memory for its buffer pools. With 4 queues we consume 64MB in the jumbo packet ring, 16MB in the medium packet ring and 16MB in the tiny packet ring. We should only fill the jumbo ring once the MTU is increased but for now halve it's size so it consumes 32MB. Also reduce the tiny packet ring, with 4 queues we had 16k entries which is overkill. Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-23qlge: fix size of external list for TX address descriptorsThadeu Lima de Souza Cascardo
When transmiting a fragmented skb, qlge fills a descriptor with the fragment addresses, after DMA-mapping them. If there are more than eight fragments, it will use the eighth descriptor as a pointer to an external list. After mapping this external list, called OAL to a structure containing more descriptors, it fills it with the extra fragments. However, considering that systems with pages larger than 8KiB would have less than 8 fragments, which was true before commit a715dea3c8e, it defined a macro for the OAL size as 0 in those cases. Now, if a skb with more than 8 fragments (counting skb->data as one fragment), this would start overwriting the list of addresses already mapped and would make the driver fail to properly unmap the right addresses on architectures with pages larger than 8KiB. Besides that, the list of mappings was one size too small, since it must have a mapping for the maxinum number of skb fragments plus one for skb->data and another for the OAL. So, even on architectures with page sizes 4KiB and 8KiB, a skb with the maximum number of fragments would make the driver overwrite its counter for the number of mappings, which, again, would make it fail to unmap the mapped DMA addresses. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-23bnx2x: Fix 5461x LEDYaniv Rosner
Fix port identify test on 5461x PHY by driving LEDs through MDIO. Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-23Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci: PCI hotplug: shpchp: don't blindly claim non-AMD 0x7450 device IDs PCI: pciehp: wait 100 ms after Link Training check PCI: pciehp: wait 1000 ms before Link Training check PCI: pciehp: Retrieve link speed after link is trained PCI: Let PCI_PRI depend on PCI PCI: Fix compile errors with PCI_ATS and !PCI_IOV PCI / ACPI: Make acpiphp ignore root bridges using PCIe native hotplug
2011-11-23Merge branch 'hwmod_dss_fixes_3.2rc' of git://git.pwsan.com/linux-2.6 into ↵Tony Lindgren
fixes-dss
2011-11-23Merge branch 'fixes-v3.2-rc2' into fixesTony Lindgren
2011-11-23ARM: OMAP2+: Fix Compilation error when omap_l3_noc built as moduleGovindraj.R
Fix below compilation failure on mainline kernel 3.2-rc1 when omap_l3_noc.c is built as module. arch/arm/mach-omap2/omap_l3_noc.c:240: error: expected ',' or ';' before 'MODULE_DEVICE_TABLE' Signed-off-by: Govindraj.R <govindraj.raja@ti.com> Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2011-11-23ARM: OMAP2+: Remove empty io.hThomas Weber
The file arch/arm/mach-omap2/io.h is empty, so we can remove it. Signed-off-by: Thomas Weber <weber@corscience.de> Acked-by: Kevin Hilman <khilman@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2011-11-23ARM: OMAP2: select ARM_AMBA if OMAP3_EMU is definedMing Lei
This patch selects ARM_AMBA if OMAP3_EMU is defined because OC_ETM depends on ARM_AMBA, so fix the link failure[1]. [1], arch/arm/kernel/built-in.o: In function `etm_remove': /home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:609: undefined reference to `amba_release_regions' arch/arm/kernel/built-in.o: In function `etb_remove': /home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:409: undefined reference to `amba_release_regions' arch/arm/kernel/built-in.o: In function `etm_init': /home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:640: undefined reference to `amba_driver_register' /home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:646: undefined reference to `amba_driver_register' /home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:648: undefined reference to `amba_driver_unregister' arch/arm/kernel/built-in.o: In function `etm_probe': /home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:545: undefined reference to `amba_request_regions' /home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:595: undefined reference to `amba_release_regions' arch/arm/kernel/built-in.o: In function `etb_probe': /home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:347: undefined reference to `amba_request_regions' /home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:392: undefined reference to `amba_release_regions' arch/arm/mach-omap2/built-in.o: In function `emu_init': /home/tom/git/omap/linux-2.6-omap/arch/arm/mach-omap2/emu.c:62: undefined reference to `amba_device_register' /home/tom/git/omap/linux-2.6-omap/arch/arm/mach-omap2/emu.c:63: undefined reference to `amba_device_register' make: *** [.tmp_vmlinux1] Error 1 making modules Signed-off-by: Ming Lei <tom.leiming@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Tony Lindgren <tony@atomide.com>
2011-11-23ARM: OMAP: smartreflex: fix IRQ handling bugFelipe Balbi
Fix a bug which has been on this driver since it was added by the original commit 984aa6db which would never clear IRQSTATUS bits. Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Kevin Hilman <khilman@ti.com> Cc: stable@vger.kernel.org Signed-off-by: Tony Lindgren <tony@atomide.com>
2011-11-23ARM: OMAP: PM: only register TWL with voltage layer when device is presentKevin Hilman
Current code registers voltage layer details for TWL PMIC even when a TWL has not been registered. Fix this to only register the TWL with voltage layer when the TWL PMIC is initialized by board-level code. Signed-off-by: Kevin Hilman <khilman@ti.com> Cc: stable@vger.kernel.org Signed-off-by: Tony Lindgren <tony@atomide.com>
2011-11-23ARM: OMAP: hwmod: Fix the addr space, irq, dma count APIssricharan
The address spaces, irqs and dma reqs count APIs return the number of corresponding entries in a hwmod including a additional null value or a -1 terminator in the structure introduced recently. More information here: - 212738a4: omap_hwmod: use a terminator record with omap_hwmod_mpu_irqs arrays - 78183f3f: omap_hwmod: use a null structure record to terminate omap_hwmod_addr_space arrays - bc614958: omap_hwmod: use a terminator record with omap_hwmod_dma_info arrays The issue with irqs and dma info was originally reported by Benoit Cousson. The devices which have multiple hwmods and use device_build_ss are broken with this, as their resources are populated with a extra null value, subsequently the probe fails. So fix the API not to include the array terminator in the count. Reported-by: Benoit Cousson <b-cousson@ti.com> Signed-off-by: Santosh Shilimkar <santosh.shilimar@ti.com> Signed-off-by: sricharan <r.sricharan@ti.com> Signed-off-by: Benoit Cousson <b-cousson@ti.com> Cc: Paul Walmsley <paul@pwsan.com> Cc: stable@vger.kernel.org Signed-off-by: Tony Lindgren <tony@atomide.com>
2011-11-23ipv4 : igmp : fix error handle in ip_mc_add_src()Jun Zhao
When add sources to interface failure, need to roll back the sfcount[MODE] to before state. We need to match it corresponding. Acked-by: David L Stevens <dlstevens@us.ibm.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Jun Zhao <mypopydev@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-23ipv6: tcp: fix tcp_v6_conn_request()Eric Dumazet
Since linux 2.6.26 (commit c6aefafb7ec6 : Add IPv6 support to TCP SYN cookies), we can drop a SYN packet reusing a TIME_WAIT socket. (As a matter of fact we fail to send the SYNACK answer) As the client resends its SYN packet after a one second timeout, we accept it, because first packet removed the TIME_WAIT socket before being dropped. This probably explains why nobody ever noticed or complained. Reported-by: Jesse Young <jlyo@jlyo.org> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-23Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs: eCryptfs: Extend array bounds for all filename chars eCryptfs: Flush file in vma close eCryptfs: Prevent file create race condition
2011-11-23eCryptfs: Extend array bounds for all filename charsTyler Hicks
From mhalcrow's original commit message: Characters with ASCII values greater than the size of filename_rev_map[] are valid filename characters. ecryptfs_decode_from_filename() will access kernel memory beyond that array, and ecryptfs_parse_tag_70_packet() will then decrypt those characters. The attacker, using the FNEK of the crafted file, can then re-encrypt the characters to reveal the kernel memory past the end of the filename_rev_map[] array. I expect low security impact since this array is statically allocated in the text area, and the amount of memory past the array that is accessible is limited by the largest possible ASCII filename character. This patch solves the issue reported by mhalcrow but with an implementation suggested by Linus to simply extend the length of filename_rev_map[] to 256. Characters greater than 0x7A are mapped to 0x00, which is how invalid characters less than 0x7A were previously being handled. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reported-by: Michael Halcrow <mhalcrow@google.com> Cc: stable@kernel.org
generated by cgit (git 2.34.1) at 2025-09-11 18:12:58 +0000