gmane.linux.ubuntu.devel.kernel.general

[kteam-tools][PATCH] ktl: Git.current_branch() optimization

Kamal Mostafa — 2013-05-24T22:06:48

Query 'git symbolic-ref HEAD' instead of iterating the 'git branch' list.

Also changed behavior if current_branch() is called in a detached HEAD state:
  before: returned the string "(no branch)"
  now: throws an exception ktl.git.GetError GitError("no current branch")

No existing caller depends on the old "(no branch)" behavior.

Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 ktl/git.py | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/ktl/git.py b/ktl/git.py
index 9483ad4..7b18275 100644
--- a/ktl/git.py
+++ b/ktl/git.py
< at >< at > -94,17 +94,10 < at >< at > class Git:
     #
     < at >classmethod
     def current_branch(cls):
-        retval = ""
-        status, result = run_command("git branch", cls.debug)
-        if status == 0:
-            for line in result:
-                if line != '' and line[0] == '*':
-                    retval = line[1:].strip()
-                    break
-        else:
-            raise GitError(result)
-
-        return retval
+        status, result = run_command("git symbolic-ref --short HEAD", cls.debug)
+        if status != 0:
+            raise GitError("no current branch")
+        return result[0]
 
     # show
     #

[kteam-tools][PATCH] ktl: Git.config() allows 'git config' queries

Kamal Mostafa — 2013-05-24T22:06:03

API interface to 'git config'.

Examples:

    print Git.config("user.email")
    kamal< at >canonical.com

    print Git.config("remote.origin.url")
    git://kernel.ubuntu.com/ubuntu/kteam-tools.git

Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 ktl/git.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/ktl/git.py b/ktl/git.py
index 48abc99..9483ad4 100644
--- a/ktl/git.py
+++ b/ktl/git.py
< at >< at > -39,6 +39,17 < at >< at > class Git:
 
         return retval
 
+    # config
+    #
+    # Return the requested git config value. E.g. config("user.email")
+    #
+    < at >classmethod
+    def config(cls, key):
+        status, result = run_command("git config %s" % key, cls.debug)
+        if status != 0:
+            raise GitError(result)
+        return result[0]
+
     # branches
     #
     # Return a list of all the git branches known to this git repository.

Mainline Build v3.9.4

Mainline Builds — 2013-05-24T20:15:07

The mainline build for v3.9.4 is now complete and available at the URL
below:

    http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.9.4-saucy/

See the CHANGES file for the list of changes from the previous version:

    http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.9.4-saucy/CHANGES

Note that these builds do not contain any Ubuntu specific patches and
are not supported.

Kernel Team

Mainline Build v3.4.47

Mainline Builds — 2013-05-24T19:45:27

The mainline build for v3.4.47 is now complete and available at the URL
below:

    http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.4.47-quantal/

See the CHANGES file for the list of changes from the previous version:

    http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.4.47-quantal/CHANGES

Note that these builds do not contain any Ubuntu specific patches and
are not supported.

Kernel Team

Mainline Build v3.0.80

Mainline Builds — 2013-05-24T19:30:07

The mainline build for v3.0.80 is now complete and available at the URL
below:

    http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.0.80-oneiric/

See the CHANGES file for the list of changes from the previous version:

    http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.0.80-oneiric/CHANGES

Note that these builds do not contain any Ubuntu specific patches and
are not supported.

Kernel Team

[ 3.8.y.z extended stable ] Patch "drivers/rtc/rtc-pcf2123.c: fix error return code in pcf2123_probe()" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:37:57

This is a note to let you know that I have just added a patch titled

    drivers/rtc/rtc-pcf2123.c: fix error return code in pcf2123_probe()

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From 4a5161635508be653d2f941ceb32c9a3b20d28ce Mon Sep 17 00:00:00 2001
From: Wei Yongjun <yongjun_wei< at >trendmicro.com.cn>
Date: Mon, 29 Apr 2013 16:21:07 -0700
Subject: drivers/rtc/rtc-pcf2123.c: fix error return code in pcf2123_probe()

commit 35623715818dfa720cccf99cd280dcbb4b78da23 upstream.

Fix to return -ENODEV in the chip not found error handling
case instead of 0, as done elsewhere in this function.

Signed-off-by: Wei Yongjun <yongjun_wei< at >trendmicro.com.cn>
Cc: Jingoo Han <jg1.han< at >samsung.com>
Signed-off-by: Andrew Morton <akpm< at >linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds< at >linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 drivers/rtc/rtc-pcf2123.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/rtc/rtc-pcf2123.c b/drivers/rtc/rtc-pcf2123.c
index 02b742a..6dd6b38 100644
--- a/drivers/rtc/rtc-pcf2123.c
+++ b/drivers/rtc/rtc-pcf2123.c
< at >< at > -265,6 +265,7 < at >< at > static int pcf2123_probe(struct spi_device *spi)

 if (!(rxbuf[0] & 0x20)) {
 dev_err(&spi->dev, "chip not found\n");
+ret = -ENODEV;
 goto kfree_exit;
 }

--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "packet: tpacket_v3: do not trigger bug() on wrong header status" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:38:00

This is a note to let you know that I have just added a patch titled

    packet: tpacket_v3: do not trigger bug() on wrong header status

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From c24c57af34f44b4dae00fa248771cad55f019c3d Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <dborkman< at >redhat.com>
Date: Fri, 3 May 2013 02:57:00 +0000
Subject: packet: tpacket_v3: do not trigger bug() on wrong header status

[ Upstream commit 8da3056c04bfc5f69f840ab038a38389e2de8189 ]

Jakub reported that it is fairly easy to trigger the BUG() macro
from user space with TPACKET_V3's RX_RING by just giving a wrong
header status flag. We already had a similar situation in commit
7f5c3e3a80e6654 (``af_packet: remove BUG statement in
tpacket_destruct_skb'') where this was the case in the TX_RING
side that could be triggered from user space. So really, don't use
BUG() or BUG_ON() unless there's really no way out, and i.e.
don't use it for consistency checking when there's user space
involved, no excuses, especially not if you're slapping the user
with WARN + dump_stack + BUG all at once. The two functions are
of concern:

  prb_retire_current_block() [when block status != TP_STATUS_KERNEL]
  prb_open_block() [when block_status != TP_STATUS_KERNEL]

Calls to prb_open_block() are guarded by ealier checks if block_status
is really TP_STATUS_KERNEL (racy!), but the first one BUG() is easily
triggable from user space. System behaves still stable after they are
removed. Also remove that yoda condition entirely, since it's already
guarded.

Reported-by: Jakub Zawadzki <darkjames-ws< at >darkjames.pl>
Signed-off-by: Daniel Borkmann <dborkman< at >redhat.com>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 net/packet/af_packet.c | 53 ++++++++++++++++++++++----------------------------
 1 file changed, 23 insertions(+), 30 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c111bd0..d376545 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
< at >< at > -693,36 +693,33 < at >< at > static void prb_open_block(struct tpacket_kbdq_core *pkc1,

 smp_rmb();

-if (likely(TP_STATUS_KERNEL == BLOCK_STATUS(pbd1))) {
+/* We could have just memset this but we will lose the
+ * flexibility of making the priv area sticky
+ */

-/* We could have just memset this but we will lose the
- * flexibility of making the priv area sticky
- */
-BLOCK_SNUM(pbd1) = pkc1->knxt_seq_num++;
-BLOCK_NUM_PKTS(pbd1) = 0;
-BLOCK_LEN(pbd1) = BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
-getnstimeofday(&ts);
-h1->ts_first_pkt.ts_sec = ts.tv_sec;
-h1->ts_first_pkt.ts_nsec = ts.tv_nsec;
-pkc1->pkblk_start = (char *)pbd1;
-pkc1->nxt_offset = pkc1->pkblk_start + BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
-BLOCK_O2FP(pbd1) = (__u32)BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
-BLOCK_O2PRIV(pbd1) = BLK_HDR_LEN;
-pbd1->version = pkc1->version;
-pkc1->prev = pkc1->nxt_offset;
-pkc1->pkblk_end = pkc1->pkblk_start + pkc1->kblk_size;
-prb_thaw_queue(pkc1);
-_prb_refresh_rx_retire_blk_timer(pkc1);
+BLOCK_SNUM(pbd1) = pkc1->knxt_seq_num++;
+BLOCK_NUM_PKTS(pbd1) = 0;
+BLOCK_LEN(pbd1) = BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);

-smp_wmb();
+getnstimeofday(&ts);

-return;
-}
+h1->ts_first_pkt.ts_sec = ts.tv_sec;
+h1->ts_first_pkt.ts_nsec = ts.tv_nsec;

-WARN(1, "ERROR block:%p is NOT FREE status:%d kactive_blk_num:%d\n",
-pbd1, BLOCK_STATUS(pbd1), pkc1->kactive_blk_num);
-dump_stack();
-BUG();
+pkc1->pkblk_start = (char *)pbd1;
+pkc1->nxt_offset = pkc1->pkblk_start + BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
+
+BLOCK_O2FP(pbd1) = (__u32)BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
+BLOCK_O2PRIV(pbd1) = BLK_HDR_LEN;
+
+pbd1->version = pkc1->version;
+pkc1->prev = pkc1->nxt_offset;
+pkc1->pkblk_end = pkc1->pkblk_start + pkc1->kblk_size;
+
+prb_thaw_queue(pkc1);
+_prb_refresh_rx_retire_blk_timer(pkc1);
+
+smp_wmb();
 }

 /*
< at >< at > -813,10 +810,6 < at >< at > static void prb_retire_current_block(struct tpacket_kbdq_core *pkc,
 prb_close_block(pkc, pbd, po, status);
 return;
 }
-
-WARN(1, "ERROR-pbd[%d]:%p\n", pkc->kactive_blk_num, pbd);
-dump_stack();
-BUG();
 }

 static int prb_curr_blk_in_use(struct tpacket_kbdq_core *pkc,
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "net: use netdev_features_t in skb_needs_linearize()" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:38:00

This is a note to let you know that I have just added a patch titled

    net: use netdev_features_t in skb_needs_linearize()

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From 95764f27aab524f7433987bc01d656eebb4b66bf Mon Sep 17 00:00:00 2001
From: Patrick McHardy <kaber< at >trash.net>
Date: Wed, 1 May 2013 22:36:49 +0000
Subject: net: use netdev_features_t in skb_needs_linearize()

[ Upstream commit 6708c9e5cc9bfc7c9a00ce9c0fdd0b1d4952b3d1 ]

Signed-off-by: Patrick McHardy <kaber< at >trash.net>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 net/core/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index d592214..e55fb91 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
< at >< at > -2290,7 +2290,7 < at >< at > EXPORT_SYMBOL(netif_skb_features);
  *2. skb is fragmented and the device does not support SG.
  */
 static inline int skb_needs_linearize(struct sk_buff *skb,
-      int features)
+      netdev_features_t features)
 {
 return skb_is_nonlinear(skb) &&
 ((skb_has_frag_list(skb) &&
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "watchdog: Fix race condition in registration code" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:37:57

This is a note to let you know that I have just added a patch titled

    watchdog: Fix race condition in registration code

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From bdd6bb3b6109788330bf149bd9d41990545beebf Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux< at >roeck-us.net>
Date: Fri, 5 Apr 2013 21:22:43 -0700
Subject: watchdog: Fix race condition in registration code

commit 60403f7a4d9368d187f79cba5e4672d01df37574 upstream.

A race condition exists when registering the first watchdog device.
Sequence of events:

- watchdog_register_device calls watchdog_dev_register
- watchdog_dev_register creates the watchdog misc device by calling
  misc_register.
  At that time, the matching character device (/dev/watchdog0) does not yet
  exist, and old_wdd is not set either.
- Userspace gets an event and opens /dev/watchdog
- watchdog_open is called and sets wdd = old_wdd, which is still NULL,
  and tries to dereference it. This causes the kernel to panic.

Seen with systemd trying to open /dev/watchdog immediately after
it was created.

Reported-by: Arkadiusz Miskiewicz <arekm< at >maven.pl>
Signed-off-by: Guenter Roeck <linux< at >roeck-us.net>
Tested-by: Arkadiusz Miskiewicz <arekm< at >maven.pl>
Signed-off-by: Wim Van Sebroeck <wim< at >iguana.be>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 drivers/watchdog/watchdog_dev.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
index ef8edec..05a5310 100644
--- a/drivers/watchdog/watchdog_dev.c
+++ b/drivers/watchdog/watchdog_dev.c
< at >< at > -524,6 +524,7 < at >< at > int watchdog_dev_register(struct watchdog_device *watchdog)
 int err, devno;

 if (watchdog->id == 0) {
+old_wdd = watchdog;
 watchdog_miscdev.parent = watchdog->parent;
 err = misc_register(&watchdog_miscdev);
 if (err != 0) {
< at >< at > -532,9 +533,9 < at >< at > int watchdog_dev_register(struct watchdog_device *watchdog)
 if (err == -EBUSY)
 pr_err("%s: a legacy watchdog module is probably present.\n",
 watchdog->info->identity);
+old_wdd = NULL;
 return err;
 }
-old_wdd = watchdog;
 }

 /* Fill in the data structures */
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "drm/i915: don't intel_crt_init on any ULT machines" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:38:03

This is a note to let you know that I have just added a patch titled

    drm/i915: don't intel_crt_init on any ULT machines

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From 1c1d6d5d6c89fa54403ee053141795ad71fd7ee0 Mon Sep 17 00:00:00 2001
From: Paulo Zanoni <paulo.r.zanoni< at >intel.com>
Date: Fri, 12 Apr 2013 18:16:53 -0300
Subject: drm/i915: don't intel_crt_init on any ULT machines

commit c40c0f5bd5b0f09e4386d2cf26c96c89c45ee539 upstream.

We may have DDI_BUF_CTL(PORT_A) configured with 2 lanes and still not
have CRT, so just check for !IS_ULT. This problem happened on a real
machine and resulted in a very ugly dmesg.

Signed-off-by: Paulo Zanoni <paulo.r.zanoni< at >intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter< at >ffwll.ch>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 drivers/gpu/drm/i915/intel_display.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e05d0ba..b17d8a8 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
< at >< at > -8452,7 +8452,7 < at >< at > static void intel_setup_outputs(struct drm_device *dev)
 I915_WRITE(PFIT_CONTROL, 0);
 }

-if (!(HAS_DDI(dev) && (I915_READ(DDI_BUF_CTL(PORT_A)) & DDI_A_4_LANES)))
+if (!IS_ULT(dev))
 intel_crt_init(dev);

 if (HAS_DDI(dev)) {
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "ipv6: do not clear pinet6 field" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:38:02

This is a note to let you know that I have just added a patch titled

    ipv6: do not clear pinet6 field

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From c86318e07265d34f5579defb6d76c3c37ae2e507 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet< at >google.com>
Date: Thu, 9 May 2013 10:28:16 +0000
Subject: ipv6: do not clear pinet6 field

[ Upstream commit f77d602124d865c38705df7fa25c03de9c284ad2 ]

We have seen multiple NULL dereferences in __inet6_lookup_established()

After analysis, I found that inet6_sk() could be NULL while the
check for sk_family == AF_INET6 was true.

Bug was added in linux-2.6.29 when RCU lookups were introduced in UDP
and TCP stacks.

Once an IPv6 socket, using SLAB_DESTROY_BY_RCU is inserted in a hash
table, we no longer can clear pinet6 field.

This patch extends logic used in commit fcbdf09d9652c891
("net: fix nulls list corruptions in sk_prot_alloc")

TCP/UDP/UDPLite IPv6 protocols provide their own .clear_sk() method
to make sure we do not clear pinet6 field.

At socket clone phase, we do not really care, as cloning the parent (non
NULL) pinet6 is not adding a fatal race.

Signed-off-by: Eric Dumazet <edumazet< at >google.com>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 include/net/sock.h  | 12 ++++++++++++
 net/core/sock.c     | 12 ------------
 net/ipv6/tcp_ipv6.c | 12 ++++++++++++
 net/ipv6/udp.c      | 13 ++++++++++++-
 net/ipv6/udp_impl.h |  2 ++
 net/ipv6/udplite.c  |  2 +-
 6 files changed, 39 insertions(+), 14 deletions(-)

diff --git a/include/net/sock.h b/include/net/sock.h
index 25afaa0..873abca 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
< at >< at > -862,6 +862,18 < at >< at > struct inet_hashinfo;
 struct raw_hashinfo;
 struct module;

+/*
+ * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes
+ * un-modified. Special care is taken when initializing object to zero.
+ */
+static inline void sk_prot_clear_nulls(struct sock *sk, int size)
+{
+if (offsetof(struct sock, sk_node.next) != 0)
+memset(sk, 0, offsetof(struct sock, sk_node.next));
+memset(&sk->sk_node.pprev, 0,
+       size - offsetof(struct sock, sk_node.pprev));
+}
+
 /* Networking protocol blocks we attach to sockets.
  * socket layer -> transport layer interface
  * transport -> network interface is defined by struct inet_proto
diff --git a/net/core/sock.c b/net/core/sock.c
index bc131d4..b8af814 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
< at >< at > -1189,18 +1189,6 < at >< at > static void sock_copy(struct sock *nsk, const struct sock *osk)
 #endif
 }

-/*
- * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes
- * un-modified. Special care is taken when initializing object to zero.
- */
-static inline void sk_prot_clear_nulls(struct sock *sk, int size)
-{
-if (offsetof(struct sock, sk_node.next) != 0)
-memset(sk, 0, offsetof(struct sock, sk_node.next));
-memset(&sk->sk_node.pprev, 0,
-       size - offsetof(struct sock, sk_node.pprev));
-}
-
 void sk_prot_clear_portaddr_nulls(struct sock *sk, int size)
 {
 unsigned long nulls1, nulls2;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 89dfedd..4cc834a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
< at >< at > -1931,6 +1931,17 < at >< at > void tcp6_proc_exit(struct net *net)
 }
 #endif

+static void tcp_v6_clear_sk(struct sock *sk, int size)
+{
+struct inet_sock *inet = inet_sk(sk);
+
+/* we do not want to clear pinet6 field, because of RCU lookups */
+sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
+
+size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
+memset(&inet->pinet6 + 1, 0, size);
+}
+
 struct proto tcpv6_prot = {
 .name= "TCPv6",
 .owner= THIS_MODULE,
< at >< at > -1974,6 +1985,7 < at >< at > struct proto tcpv6_prot = {
 #ifdef CONFIG_MEMCG_KMEM
 .proto_cgroup= tcp_proto_cgroup,
 #endif
+.clear_sk= tcp_v6_clear_sk,
 };

 static const struct inet6_protocol tcpv6_protocol = {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index fb08329..cdffb60 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
< at >< at > -1424,6 +1424,17 < at >< at > void udp6_proc_exit(struct net *net) {
 }
 #endif /* CONFIG_PROC_FS */

+void udp_v6_clear_sk(struct sock *sk, int size)
+{
+struct inet_sock *inet = inet_sk(sk);
+
+/* we do not want to clear pinet6 field, because of RCU lookups */
+sk_prot_clear_portaddr_nulls(sk, offsetof(struct inet_sock, pinet6));
+
+size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
+memset(&inet->pinet6 + 1, 0, size);
+}
+
 /* ------------------------------------------------------------------------ */

 struct proto udpv6_prot = {
< at >< at > -1454,7 +1465,7 < at >< at > struct proto udpv6_prot = {
 .compat_setsockopt = compat_udpv6_setsockopt,
 .compat_getsockopt = compat_udpv6_getsockopt,
 #endif
-.clear_sk   = sk_prot_clear_portaddr_nulls,
+.clear_sk   = udp_v6_clear_sk,
 };

 static struct inet_protosw udpv6_protosw = {
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index d757104..4691ed5 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
< at >< at > -31,6 +31,8 < at >< at > extern intudpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
 extern intudpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb);
 extern voidudpv6_destroy_sock(struct sock *sk);

+extern void udp_v6_clear_sk(struct sock *sk, int size);
+
 #ifdef CONFIG_PROC_FS
 extern intudp6_seq_show(struct seq_file *seq, void *v);
 #endif
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 1d08e21..dfcc4be 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
< at >< at > -56,7 +56,7 < at >< at > struct proto udplitev6_prot = {
 .compat_setsockopt = compat_udpv6_setsockopt,
 .compat_getsockopt = compat_udpv6_getsockopt,
 #endif
-.clear_sk   = sk_prot_clear_portaddr_nulls,
+.clear_sk   = udp_v6_clear_sk,
 };

 static struct inet_protosw udplite6_protosw = {
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "macvlan: fix passthru mode race between dev removal and rx path" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:38:02

This is a note to let you know that I have just added a patch titled

    macvlan: fix passthru mode race between dev removal and rx path

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From 484017b9444e25ff3d6b8cab30ee1d5502c66d7a Mon Sep 17 00:00:00 2001
From: Jiri Pirko <jiri< at >resnulli.us>
Date: Thu, 9 May 2013 04:23:40 +0000
Subject: macvlan: fix passthru mode race between dev removal and rx path

[ Upstream commit 233c7df0821c4190e2d3f4be0f2ca0ab40a5ed8c ]

Currently, if macvlan in passthru mode is created and data are rxed and
you remove this device, following panic happens:

NULL pointer dereference at 0000000000000198
IP: [<ffffffffa0196058>] macvlan_handle_frame+0x153/0x1f7 [macvlan]

I'm using following script to trigger this:
<script>
while [ 1 ]
do
ip link add link e1 name macvtap0 type macvtap mode passthru
ip link set e1 up
ip link set macvtap0 up
IFINDEX=`ip link |grep macvtap0 | cut -f 1 -d ':'`
cat /dev/tap$IFINDEX  >/dev/null &
ip link del dev macvtap0
done
</script>

I run this script while "ping -f" is running on another machine to send
packets to e1 rx.

Reason of the panic is that list_first_entry() is blindly called in
macvlan_handle_frame() even if the list was empty. vlan is set to
incorrect pointer which leads to the crash.

I'm fixing this by protecting port->vlans list by rcu and by preventing
from getting incorrect pointer in case the list is empty.

Introduced by: commit eb06acdc85585f2 "macvlan: Introduce 'passthru' mode to takeover the underlying device"

Signed-off-by: Jiri Pirko <jiri< at >resnulli.us>
Acked-by: Eric Dumazet <edumazet< at >google.com>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 drivers/net/macvlan.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index e5cb723..d30fc4d 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
< at >< at > -204,7 +204,8 < at >< at > static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
 }

 if (port->passthru)
-vlan = list_first_entry(&port->vlans, struct macvlan_dev, list);
+vlan = list_first_or_null_rcu(&port->vlans,
+      struct macvlan_dev, list);
 else
 vlan = macvlan_hash_lookup(port, eth->h_dest);
 if (vlan == NULL)
< at >< at > -771,7 +772,7 < at >< at > int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
 if (err < 0)
 goto destroy_port;

-list_add_tail(&vlan->list, &port->vlans);
+list_add_tail_rcu(&vlan->list, &port->vlans);
 netif_stacked_transfer_operstate(lowerdev, dev);

 return 0;
< at >< at > -797,7 +798,7 < at >< at > void macvlan_dellink(struct net_device *dev, struct list_head *head)
 {
 struct macvlan_dev *vlan = netdev_priv(dev);

-list_del(&vlan->list);
+list_del_rcu(&vlan->list);
 unregister_netdevice_queue(dev, head);
 }
 EXPORT_SYMBOL_GPL(macvlan_dellink);
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "3c59x: fix PCI resource management" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:38:01

This is a note to let you know that I have just added a patch titled

    3c59x: fix PCI resource management

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From a1bfebfeeeb948e1cf55d9c3d03ec3f3885cd8aa Mon Sep 17 00:00:00 2001
From: Sergei Shtylyov <sshtylyov< at >ru.mvista.com>
Date: Thu, 9 May 2013 11:14:07 +0000
Subject: 3c59x: fix PCI resource management

[ Upstream commit 4b264a1676e70dc656ba53a8cac690f2d4b65f4e ]

The driver wrongly claimed I/O ports at an address returned by pci_iomap() --
even if it was passed an MMIO address.  Fix this by claiming/releasing all PCI
resources in the PCI driver's probe()/remove() methods instead and get rid of
'must_free_region' flag weirdness (why would Cardbus claim anything for us?).

Signed-off-by: Sergei Shtylyov <sshtylyov< at >ru.mvista.com>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 drivers/net/ethernet/3com/3c59x.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 44de6ce..a3052e7 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
< at >< at > -632,7 +632,6 < at >< at > struct vortex_private {
 pm_state_valid:1,/* pci_dev->saved_config_space has sane contents */
 open:1,
 medialock:1,
-must_free_region:1,/* Flag: if zero, Cardbus owns the I/O region */
 large_frames:1,/* accept large frames */
 handling_irq:1;/* private in_irq indicator */
 /* {get|set}_wol operations are already serialized by rtnl.
< at >< at > -1012,6 +1011,12 < at >< at > static int vortex_init_one(struct pci_dev *pdev,
 if (rc < 0)
 goto out;

+rc = pci_request_regions(pdev, DRV_NAME);
+if (rc < 0) {
+pci_disable_device(pdev);
+goto out;
+}
+
 unit = vortex_cards_found;

 if (global_use_mmio < 0 && (unit >= MAX_UNITS || use_mmio[unit] < 0)) {
< at >< at > -1027,6 +1032,7 < at >< at > static int vortex_init_one(struct pci_dev *pdev,
 if (!ioaddr) /* If mapping fails, fall-back to BAR 0... */
 ioaddr = pci_iomap(pdev, 0, 0);
 if (!ioaddr) {
+pci_release_regions(pdev);
 pci_disable_device(pdev);
 rc = -ENOMEM;
 goto out;
< at >< at > -1036,6 +1042,7 < at >< at > static int vortex_init_one(struct pci_dev *pdev,
    ent->driver_data, unit);
 if (rc < 0) {
 pci_iounmap(pdev, ioaddr);
+pci_release_regions(pdev);
 pci_disable_device(pdev);
 goto out;
 }
< at >< at > -1178,11 +1185,6 < at >< at > static int vortex_probe1(struct device *gendev, void __iomem *ioaddr, int irq,

 /* PCI-only startup logic */
 if (pdev) {
-/* EISA resources already marked, so only PCI needs to do this here */
-/* Ignore return value, because Cardbus drivers already allocate for us */
-if (request_region(dev->base_addr, vci->io_size, print_name) != NULL)
-vp->must_free_region = 1;
-
 /* enable bus-mastering if necessary */
 if (vci->flags & PCI_USES_MASTER)
 pci_set_master(pdev);
< at >< at > -1220,7 +1222,7 < at >< at > static int vortex_probe1(struct device *gendev, void __iomem *ioaddr, int irq,
    &vp->rx_ring_dma);
 retval = -ENOMEM;
 if (!vp->rx_ring)
-goto free_region;
+goto free_device;

 vp->tx_ring = (struct boom_tx_desc *)(vp->rx_ring + RX_RING_SIZE);
 vp->tx_ring_dma = vp->rx_ring_dma + sizeof(struct boom_rx_desc) * RX_RING_SIZE;
< at >< at > -1485,9 +1487,7 < at >< at > free_ring:
 + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
 vp->rx_ring,
 vp->rx_ring_dma);
-free_region:
-if (vp->must_free_region)
-release_region(dev->base_addr, vci->io_size);
+free_device:
 free_netdev(dev);
 pr_err(PFX "vortex_probe1 fails.  Returns %d\n", retval);
 out:
< at >< at > -3255,8 +3255,9 < at >< at > static void vortex_remove_one(struct pci_dev *pdev)
 + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
 vp->rx_ring,
 vp->rx_ring_dma);
-if (vp->must_free_region)
-release_region(dev->base_addr, vp->io_size);
+
+pci_release_regions(pdev);
+
 free_netdev(dev);
 }

--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "pch_dma: Use GFP_ATOMIC because called from interrupt context" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:37:57

This is a note to let you know that I have just added a patch titled

    pch_dma: Use GFP_ATOMIC because called from interrupt context

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From 4e1c06e8d04140f1349156f4c23158f54e14b351 Mon Sep 17 00:00:00 2001
From: Tomoya MORINAGA <tomoya.rohm< at >gmail.com>
Date: Tue, 12 Feb 2013 11:25:33 +0900
Subject: pch_dma: Use GFP_ATOMIC because called from interrupt context

commit 5c1ef59168c485318e40ba485c1eba57d81d0faa upstream.

pdc_desc_get() is called from pd_prep_slave_sg, and the function is
called from interrupt context(e.g. Uart driver "pch_uart.c").
In fact, I saw kernel error message.
So, GFP_ATOMIC must be used not GFP_NOIO.

Signed-off-by: Tomoya MORINAGA <tomoya.rohm< at >gmail.com>
Signed-off-by: Vinod Koul <vinod.koul< at >intel.com>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 drivers/dma/pch_dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
index 3f26172..34c36ec 100644
--- a/drivers/dma/pch_dma.c
+++ b/drivers/dma/pch_dma.c
< at >< at > -476,7 +476,7 < at >< at > static struct pch_dma_desc *pdc_desc_get(struct pch_dma_chan *pd_chan)
 dev_dbg(chan2dev(&pd_chan->chan), "scanned %d descriptors\n", i);

 if (!ret) {
-ret = pdc_alloc_desc(&pd_chan->chan, GFP_NOIO);
+ret = pdc_alloc_desc(&pd_chan->chan, GFP_ATOMIC);
 if (ret) {
 spin_lock(&pd_chan->lock);
 pd_chan->descs_allocated++;
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "ipv6, gre: do not leak info to user-space" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:38:02

This is a note to let you know that I have just added a patch titled

    ipv6,gre: do not leak info to user-space

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From 7d0652d41236018756a7818fbd8f1f746aa0b1d6 Mon Sep 17 00:00:00 2001
From: Amerigo Wang <amwang< at >redhat.com>
Date: Thu, 9 May 2013 21:56:37 +0000
Subject: ipv6,gre: do not leak info to user-space

[ Upstream commit 5dbd5068430b8bd1c19387d46d6c1a88b261257f ]

There is a hole in struct ip6_tnl_parm2, so we have to
zero the struct on stack before copying it to user-space.

Cc: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Cong Wang <amwang< at >redhat.com>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 net/ipv6/ip6_gre.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 131dd09..a4c5ae7 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
< at >< at > -1137,6 +1137,7 < at >< at > static int ip6gre_tunnel_ioctl(struct net_device *dev,
 }
 if (t == NULL)
 t = netdev_priv(dev);
+memset(&p, 0, sizeof(p));
 ip6gre_tnl_parm_to_user(&p, &t->parms);
 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
 err = -EFAULT;
< at >< at > -1184,6 +1185,7 < at >< at > static int ip6gre_tunnel_ioctl(struct net_device *dev,
 if (t) {
 err = 0;

+memset(&p, 0, sizeof(p));
 ip6gre_tnl_parm_to_user(&p, &t->parms);
 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
 err = -EFAULT;
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "if_cablemodem.h: Add parenthesis around ioctl macros" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:38:02

This is a note to let you know that I have just added a patch titled

    if_cablemodem.h: Add parenthesis around ioctl macros

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From 92f96ed610ad3508f3d397b47bd39fa83eca6be4 Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer< at >redhat.com>
Date: Wed, 8 May 2013 09:45:47 +0000
Subject: if_cablemodem.h: Add parenthesis around ioctl macros

[ Upstream commit 4f924b2aa4d3cb30f07e57d6b608838edcbc0d88 ]

Protect the SIOCGCM* ioctl macros with parenthesis.

Reported-by: Paul Wouters <pwouters< at >redhat.com>
Signed-off-by: Josh Boyer <jwboyer< at >redhat.com>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 include/uapi/linux/if_cablemodem.h | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/uapi/linux/if_cablemodem.h b/include/uapi/linux/if_cablemodem.h
index 9ca1007..ee6b3c4 100644
--- a/include/uapi/linux/if_cablemodem.h
+++ b/include/uapi/linux/if_cablemodem.h
< at >< at > -12,11 +12,11 < at >< at >
  */

 /* some useful defines for sb1000.c e cmconfig.c - fv */
-#define SIOCGCMSTATSSIOCDEVPRIVATE+0/* get cable modem stats */
-#define SIOCGCMFIRMWARESIOCDEVPRIVATE+1/* get cm firmware version */
-#define SIOCGCMFREQUENCYSIOCDEVPRIVATE+2/* get cable modem frequency */
-#define SIOCSCMFREQUENCYSIOCDEVPRIVATE+3/* set cable modem frequency */
-#define SIOCGCMPIDSSIOCDEVPRIVATE+4/* get cable modem PIDs */
-#define SIOCSCMPIDSSIOCDEVPRIVATE+5/* set cable modem PIDs */
+#define SIOCGCMSTATS(SIOCDEVPRIVATE+0)/* get cable modem stats */
+#define SIOCGCMFIRMWARE(SIOCDEVPRIVATE+1)/* get cm firmware version */
+#define SIOCGCMFREQUENCY(SIOCDEVPRIVATE+2)/* get cable modem frequency */
+#define SIOCSCMFREQUENCY(SIOCDEVPRIVATE+3)/* set cable modem frequency */
+#define SIOCGCMPIDS(SIOCDEVPRIVATE+4)/* get cable modem PIDs */
+#define SIOCSCMPIDS(SIOCDEVPRIVATE+5)/* set cable modem PIDs */

 #endif
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "bridge: fix race with topology change timer" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:38:00

This is a note to let you know that I have just added a patch titled

    bridge: fix race with topology change timer

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From e42056419e11756ea979e538704bc1529cddfdfb Mon Sep 17 00:00:00 2001
From: stephen hemminger <stephen< at >networkplumber.org>
Date: Thu, 2 May 2013 14:23:28 +0000
Subject: bridge: fix race with topology change timer

[ Upstream commit 83401eb4990ff6af55aeed8f49681558544192e6 ]

A bridge should only send topology change notice if it is not
the root bridge. It is possible for message age timer to elect itself
as a new root bridge, and still have a topology change timer running
but waiting for bridge lock on other CPU.

Solve the race by checking if we are root bridge before continuing.
This was the root cause of the cases where br_send_tcn_bpdu would OOPS.

Reported-by: JerryKang <jerry.kang< at >samsung.com>
Signed-off-by: Stephen Hemminger <stephen< at >networkplumber.org>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 net/bridge/br_stp_timer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index c3530a8..950663d 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
< at >< at > -107,7 +107,7 < at >< at > static void br_tcn_timer_expired(unsigned long arg)

 br_debug(br, "tcn timer expired\n");
 spin_lock(&br->lock);
-if (br->dev->flags & IFF_UP) {
+if (!br_is_root_bridge(br) && (br->dev->flags & IFF_UP)) {
 br_transmit_tcn(br);

 mod_timer(&br->tcn_timer,jiffies + br->bridge_hello_time);
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "3c59x: fix freeing nonexistent resource on driver unload" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:38:01

This is a note to let you know that I have just added a patch titled

    3c59x: fix freeing nonexistent resource on driver unload

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From 0b38cddcef89f19bff6f10f06d7492f34cfa925d Mon Sep 17 00:00:00 2001
From: Sergei Shtylyov <sergei.shtylyov< at >cogentembedded.com>
Date: Thu, 2 May 2013 11:10:22 +0000
Subject: 3c59x: fix freeing nonexistent resource on driver unload

[ Upstream commit c81400be716aa4c76f6ebf339ba94358dbbf6da6 ]

When unloading the driver that drives an EISA board, a message similar to the
following one is displayed:

Trying to free nonexistent resource <0000000000013000-000000000001301f>

Then an user is unable to reload the driver because the resource it requested in
the previous load hasn't been freed. This happens most probably due to a typo in
vortex_eisa_remove() which calls release_region() with 'dev->base_addr'  instead
of 'edev->base_addr'...

Reported-by: Matthew Whitehead <tedheadster< at >gmail.com>
Tested-by: Matthew Whitehead <tedheadster< at >gmail.com>
Signed-off-by: Sergei Shtylyov <sergei.shtylyov< at >cogentembedded.com>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 drivers/net/ethernet/3com/3c59x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index ed0feb3..44de6ce 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
< at >< at > -951,7 +951,7 < at >< at > static int vortex_eisa_remove(struct device *device)

 unregister_netdev(dev);
 iowrite16(TotalReset|0x14, ioaddr + EL3_CMD);
-release_region(dev->base_addr, VORTEX_TOTAL_SIZE);
+release_region(edev->base_addr, VORTEX_TOTAL_SIZE);

 free_netdev(dev);
 return 0;
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "net: vlan, ethtool: netdev_features_t is more than 32 bit" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:38:00

This is a note to let you know that I have just added a patch titled

    net: vlan,ethtool: netdev_features_t is more than 32 bit

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From 4ace94030726250d367f5e709e55faa6367b7fb2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn< at >mork.no>
Date: Wed, 1 May 2013 23:06:42 +0000
Subject: net: vlan,ethtool: netdev_features_t is more than 32 bit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b29d3145183da4e07d4b570fa8acdd3ac4a5c572 ]

Signed-off-by: Bjørn Mork <bjorn< at >mork.no>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 net/8021q/vlan_dev.c | 2 +-
 net/core/ethtool.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 4a6d31a..9cbcfcd 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
< at >< at > -617,7 +617,7 < at >< at > static netdev_features_t vlan_dev_fix_features(struct net_device *dev,
 netdev_features_t features)
 {
 struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
-u32 old_features = features;
+netdev_features_t old_features = features;

 features &= real_dev->vlan_features;
 features |= NETIF_F_RXCSUM;
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index a870543..2a53731 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
< at >< at > -1418,7 +1418,7 < at >< at > int dev_ethtool(struct net *net, struct ifreq *ifr)
 void __user *useraddr = ifr->ifr_data;
 u32 ethcmd;
 int rc;
-u32 old_features;
+netdev_features_t old_features;

 if (!dev || !netif_device_present(dev))
 return -ENODEV;
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "net: tun: release the reference of tun device in tun_recvmsg" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:37:58

This is a note to let you know that I have just added a patch titled

    net: tun: release the reference of tun device in tun_recvmsg

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From ea895dbc54bc27cc1bdb9956b620983cd20fac47 Mon Sep 17 00:00:00 2001
From: Gao feng <gaofeng< at >cn.fujitsu.com>
Date: Wed, 24 Apr 2013 21:59:23 +0000
Subject: net: tun: release the reference of tun device in tun_recvmsg

[ Upstream commit 3811ae76bc84e5dc1a670ae10695f046b310bee1 ]

We forget to release the reference of tun device in tun_recvmsg.
bug introduced in commit 54f968d6efdbf7dec36faa44fc11f01b0e4d1990
(tuntap: move socket to tun_file)

Signed-off-by: Gao feng <gaofeng< at >cn.fujitsu.com>
Acked-by: Jason Wang <jasowang< at >redhat.com>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 drivers/net/tun.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index cb95fe5..522dc0a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
< at >< at > -1471,14 +1471,17 < at >< at > static int tun_recvmsg(struct kiocb *iocb, struct socket *sock,
 if (!tun)
 return -EBADFD;

-if (flags & ~(MSG_DONTWAIT|MSG_TRUNC))
-return -EINVAL;
+if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) {
+ret = -EINVAL;
+goto out;
+}
 ret = tun_do_read(tun, tfile, iocb, m->msg_iov, total_len,
   flags & MSG_DONTWAIT);
 if (ret > total_len) {
 m->msg_flags |= MSG_TRUNC;
 ret = flags & MSG_TRUNC ? ret : total_len;
 }
+out:
 tun_put(tun);
 return ret;
 }
--
1.8.1.2

[ 3.8.y.z extended stable ] Patch "tcp: reset timer after any SYNACK retransmit" has been added to staging queue

Kamal Mostafa — 2013-05-24T17:37:59

This is a note to let you know that I have just added a patch titled

    tcp: reset timer after any SYNACK retransmit

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From c6bb76b5e686b95ea8c9559dc612e0a1c2836582 Mon Sep 17 00:00:00 2001
From: Yuchung Cheng <ycheng< at >google.com>
Date: Mon, 29 Apr 2013 08:44:51 +0000
Subject: tcp: reset timer after any SYNACK retransmit

[ Upstream commit cd75eff64dae8856afbf6ef0f0ca3c145465d8e0 ]

Linux immediately returns SYNACK on (spurious) SYN retransmits, but
keeps the SYNACK timer running independently. Thus the timer may
fire right after the SYNACK retransmit and causes a SYN-SYNACK
cross-fire burst.

Adopt the fast retransmit/recovery idea in established state by
re-arming the SYNACK timer after the fast (SYNACK) retransmit. The
timer may fire late up to 500ms due to the current SYNACK timer wheel,
but it's OK to be conservative when network is congested. Eric's new
listener design should address this issue.

Signed-off-by: Yuchung Cheng <ycheng< at >google.com>
Acked-by: Eric Dumazet <edumazet< at >google.com>
Acked-by: Neal Cardwell <ncardwell< at >google.com>
Signed-off-by: David S. Miller <davem< at >davemloft.net>
Signed-off-by: Kamal Mostafa <kamal< at >canonical.com>
---
 net/ipv4/tcp_minisocks.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index f35f2df..18e230d 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
< at >< at > -581,8 +581,13 < at >< at > struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
  *
  * Note that even if there is new data in the SYN packet
  * they will be thrown away too.
+ *
+ * Reset timer after retransmitting SYNACK, similar to
+ * the idea of fast retransmit in recovery.
  */
-inet_rtx_syn_ack(sk, req);
+if (!inet_rtx_syn_ack(sk, req))
+req->expires = min(TCP_TIMEOUT_INIT << req->num_timeout,
+   TCP_RTO_MAX) + jiffies;
 return NULL;
 }

--
1.8.1.2