From 751bd8474e3c294236f151401d2acb9451f3f82b Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Thu, 15 Aug 2013 17:39:48 +0000 Subject: [PATCH] Update to 3.10.7 svn path=/dists/sid/linux/; revision=20496 --- debian/changelog | 66 ++++++++- ...pt-to-send-extended-INQUIRY-command-.patch | 33 ----- ...-of-netdev_alloc_skb-in-refilling-rx.patch | 131 ------------------ ...-retry-handling-in-ext4_ext_truncate.patch | 21 --- ...tify-info-leak-in-copy_event_to_user.patch | 26 ---- debian/patches/series | 4 - 6 files changed, 65 insertions(+), 216 deletions(-) delete mode 100644 debian/patches/bugfix/all/SCSI-Don-t-attempt-to-send-extended-INQUIRY-command-.patch delete mode 100644 debian/patches/bugfix/all/atl1c-Fix-misuse-of-netdev_alloc_skb-in-refilling-rx.patch delete mode 100644 debian/patches/bugfix/all/ext4-fix-retry-handling-in-ext4_ext_truncate.patch delete mode 100644 debian/patches/bugfix/all/fanotify-info-leak-in-copy_event_to_user.patch diff --git a/debian/changelog b/debian/changelog index 06628307d..08095a568 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,4 +1,68 @@ -linux (3.10.5-2) UNRELEASED; urgency=low +linux (3.10.7-1) UNRELEASED; urgency=low + + * New upstream stable update: + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.6 + - [arm] Modify vectors page to defend against ROP buffer overflow attacks + - [armel] 7790/1: Fix deferred mm switch on VIVT processors + - [armel] 7791/1: a.out: remove partial a.out support + - [powerpc] VPHN topology change updates all siblings + - hwmon: (max6697) fix MAX6581 ideality + - USB: mos7840: fix race in register handling + - USB: mos7840: fix race in led handling + - mac80211: fix duplicate retransmission detection + - mac80211: fix ethtool stats for non-station interfaces + - ixgbe: Fix Tx Hang issue with lldpad on 82598EB + - Bluetooth: ath3k: don't use stack memory for DMA + - Bluetooth: fix wrong use of PTR_ERR() in btusb + - svcrpc: fix gss-proxy xdr decoding oops + - svcrpc: fix gss_rpc_upcall create error + - svcrpc: fix kfree oops in gss-proxy code + - zram: avoid invalid memory access in zram_exit() + - zram: use zram->lock to protect zram_free_page() in swap free notify path + - zram: avoid double free in function zram_bvec_write() + - zram: avoid access beyond the zram device + - zram: protect sysfs handler from invalid memory access + - Revert "cpuidle: Quickly notice prediction failure in general case" + - cpufreq: Fix cpufreq driver module refcount balance after suspend/resume + - Revert "cpuidle: Quickly notice prediction failure for repeat mode" + - drm/radeon: Disable dma rings for bo moves on r6xx + - xen-blkfront: use a different scatterlist for each request + - drm/radeon: never unpin UVD bo v3 + - Btrfs: fix crash regarding to ulist_add_merge + - [s390] bitops: fix find_next_bit_left + - ipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanup + - usbnet: do not pretend to support SG/TSO + - net_sched: Fix stack info leak in cbq_dump_wrr(). + - af_key: more info leaks in pfkey messages + - net_sched: info leak in atm_tc_dump_class() + - 8139cp: Add dma_mapping_error checking + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.7 + - [powerpc] Save the TAR register earlier + - [powerpc] tm: Fix context switching TAR, PPR and DSCR SPRs + - ext4: make sure group number is bumped after a inode allocation race + - regmap: cache: Make sure to sync the last register in a block + - hwmon: (adt7470) Fix incorrect return code check + - media: em28xx: fix assignment of the eeprom data + - ACPI / PM: Walk physical_node_list under physical_node_lock + - ALSA: 6fire: fix DMA issues with URB transfer_buffer usage + - Btrfs: release both paths before logging dir/changed extents + - LOCKD: Don't call utsname()->nodename from nlmclnt_setlockargs + - SUNRPC: Don't auto-disconnect from the local rpcbind socket + - SUNRPC: If the rpcbind channel is disconnected, fail the call to + unregister + - virtio/console: Quit from splice_write if pipe->nrbufs is 0 + - virtio/console: Add pipe_lock/unlock for splice_write + - virtio: console: fix race with port unplug and open/close + - virtio: console: fix race in port_fops_open() and port unplug + - virtio: console: clean up port data immediately at time of unplug + - virtio: console: fix raising SIGIO after port unplug + - virtio: console: return -ENODEV on all read operations after unplug + - drm/radeon: stop sending invalid UVD destroy msg + - ext4: flush the extent status cache during EXT4_IOC_SWAP_BOOT + - cifs: extend the buffer length enought for sprintf() using + - zram: allow request end to coincide with disksize + - reiserfs: fix deadlock in umount + - [x86] drm/i915: initialize gt_lock early with other spin locks [ Ben Hutchings ] * [x86] Enable ASUS_OLED as module (Closes: #680016) diff --git a/debian/patches/bugfix/all/SCSI-Don-t-attempt-to-send-extended-INQUIRY-command-.patch b/debian/patches/bugfix/all/SCSI-Don-t-attempt-to-send-extended-INQUIRY-command-.patch deleted file mode 100644 index 54a3ed1f8..000000000 --- a/debian/patches/bugfix/all/SCSI-Don-t-attempt-to-send-extended-INQUIRY-command-.patch +++ /dev/null @@ -1,33 +0,0 @@ -From: "Martin K. Petersen" -Date: Tue, 30 Jul 2013 22:58:34 -0400 -Subject: [SCSI] Don't attempt to send extended INQUIRY command if - skip_vpd_pages is set -Origin: https://git.kernel.org/cgit/linux/kernel/git/jejb/scsi.git/commit?id=7562523e84ddc742fe1f9db8bd76b01acca89f6b -Bug-Debian: http://bugs.debian.org/719002 - -If a device has the skip_vpd_pages flag set we should simply fail the -scsi_get_vpd_page() call. - -Signed-off-by: Martin K. Petersen -Acked-by: Alan Stern -Tested-by: Stuart Foster -Cc: stable@vger.kernel.org -Signed-off-by: James Bottomley ---- - drivers/scsi/scsi.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c -index 3b1ea34..eaa808e 100644 ---- a/drivers/scsi/scsi.c -+++ b/drivers/scsi/scsi.c -@@ -1031,6 +1031,9 @@ int scsi_get_vpd_page(struct scsi_device *sdev, u8 page, unsigned char *buf, - { - int i, result; - -+ if (sdev->skip_vpd_pages) -+ goto fail; -+ - /* Ask for all the pages supported by this device */ - result = scsi_vpd_inquiry(sdev, buf, 0, buf_len); - if (result) diff --git a/debian/patches/bugfix/all/atl1c-Fix-misuse-of-netdev_alloc_skb-in-refilling-rx.patch b/debian/patches/bugfix/all/atl1c-Fix-misuse-of-netdev_alloc_skb-in-refilling-rx.patch deleted file mode 100644 index c55c21dc4..000000000 --- a/debian/patches/bugfix/all/atl1c-Fix-misuse-of-netdev_alloc_skb-in-refilling-rx.patch +++ /dev/null @@ -1,131 +0,0 @@ -From: Eric Dumazet -Date: Mon, 29 Jul 2013 10:24:04 -0700 -Subject: atl1c: Fix misuse of netdev_alloc_skb in refilling rx ring -Origin: https://git.kernel.org/linus/7b70176421993866e616f1cbc4d0dd4054f1bf78 - -On Mon, 2013-07-29 at 08:30 -0700, Eric Dumazet wrote: -> On Mon, 2013-07-29 at 13:09 +0100, Luis Henriques wrote: -> -> > -> > I confirm that I can't reproduce the issue using this patch. -> > -> -> Thanks, I'll send a polished patch, as this one had an error if -> build_skb() returns NULL (in case sk_buff allocation fails) - -Please try the following patch : It should use 2K frags instead of 4K -for normal 1500 mtu - -Thanks ! - -[PATCH] atl1c: use custom skb allocator - -We had reports ( https://bugzilla.kernel.org/show_bug.cgi?id=54021 ) -that using high order pages for skb allocations is problematic for atl1c - -We do not know exactly what the problem is, but we suspect that crossing -4K pages is not well supported by this hardware. - -Use a custom allocator, using page allocator and 2K fragments for -optimal stack behavior. We might make this allocator generic -in future kernels. - -Signed-off-by: Eric Dumazet -Cc: Luis Henriques -Cc: Neil Horman -Signed-off-by: David S. Miller ---- - drivers/net/ethernet/atheros/atl1c/atl1c.h | 3 ++ - drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 40 ++++++++++++++++++++++++- - 2 files changed, 42 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c.h b/drivers/net/ethernet/atheros/atl1c/atl1c.h -index b2bf324..0f05565 100644 ---- a/drivers/net/ethernet/atheros/atl1c/atl1c.h -+++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h -@@ -520,6 +520,9 @@ struct atl1c_adapter { - struct net_device *netdev; - struct pci_dev *pdev; - struct napi_struct napi; -+ struct page *rx_page; -+ unsigned int rx_page_offset; -+ unsigned int rx_frag_size; - struct atl1c_hw hw; - struct atl1c_hw_stats hw_stats; - struct mii_if_info mii; /* MII interface info */ -diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c -index 786a874..a36a760 100644 ---- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c -+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c -@@ -481,10 +481,15 @@ static int atl1c_set_mac_addr(struct net_device *netdev, void *p) - static void atl1c_set_rxbufsize(struct atl1c_adapter *adapter, - struct net_device *dev) - { -+ unsigned int head_size; - int mtu = dev->mtu; - - adapter->rx_buffer_len = mtu > AT_RX_BUF_SIZE ? - roundup(mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN, 8) : AT_RX_BUF_SIZE; -+ -+ head_size = SKB_DATA_ALIGN(adapter->rx_buffer_len + NET_SKB_PAD) + -+ SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); -+ adapter->rx_frag_size = roundup_pow_of_two(head_size); - } - - static netdev_features_t atl1c_fix_features(struct net_device *netdev, -@@ -952,6 +957,10 @@ static void atl1c_free_ring_resources(struct atl1c_adapter *adapter) - kfree(adapter->tpd_ring[0].buffer_info); - adapter->tpd_ring[0].buffer_info = NULL; - } -+ if (adapter->rx_page) { -+ put_page(adapter->rx_page); -+ adapter->rx_page = NULL; -+ } - } - - /** -@@ -1639,6 +1648,35 @@ static inline void atl1c_rx_checksum(struct atl1c_adapter *adapter, - skb_checksum_none_assert(skb); - } - -+static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter) -+{ -+ struct sk_buff *skb; -+ struct page *page; -+ -+ if (adapter->rx_frag_size > PAGE_SIZE) -+ return netdev_alloc_skb(adapter->netdev, -+ adapter->rx_buffer_len); -+ -+ page = adapter->rx_page; -+ if (!page) { -+ adapter->rx_page = page = alloc_page(GFP_ATOMIC); -+ if (unlikely(!page)) -+ return NULL; -+ adapter->rx_page_offset = 0; -+ } -+ -+ skb = build_skb(page_address(page) + adapter->rx_page_offset, -+ adapter->rx_frag_size); -+ if (likely(skb)) { -+ adapter->rx_page_offset += adapter->rx_frag_size; -+ if (adapter->rx_page_offset >= PAGE_SIZE) -+ adapter->rx_page = NULL; -+ else -+ get_page(page); -+ } -+ return skb; -+} -+ - static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter) - { - struct atl1c_rfd_ring *rfd_ring = &adapter->rfd_ring; -@@ -1660,7 +1698,7 @@ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter) - while (next_info->flags & ATL1C_BUFFER_FREE) { - rfd_desc = ATL1C_RFD_DESC(rfd_ring, rfd_next_to_use); - -- skb = netdev_alloc_skb(adapter->netdev, adapter->rx_buffer_len); -+ skb = atl1c_alloc_skb(adapter); - if (unlikely(!skb)) { - if (netif_msg_rx_err(adapter)) - dev_warn(&pdev->dev, "alloc rx buffer failed\n"); diff --git a/debian/patches/bugfix/all/ext4-fix-retry-handling-in-ext4_ext_truncate.patch b/debian/patches/bugfix/all/ext4-fix-retry-handling-in-ext4_ext_truncate.patch deleted file mode 100644 index 760668539..000000000 --- a/debian/patches/bugfix/all/ext4-fix-retry-handling-in-ext4_ext_truncate.patch +++ /dev/null @@ -1,21 +0,0 @@ -From: Theodore Ts'o -Date: Mon, 29 Jul 2013 16:12:56 +0000 -Subject: ext4: fix retry handling in ext4_ext_truncate() -Origin: https://git.kernel.org/cgit/linux/kernel/git/tytso/ext4.git/commit/?id=94eec0fc3520c759831763d866421b4d60b599b4 - -We tested for ENOMEM instead of -ENOMEM. Oops. - -Signed-off-by: "Theodore Ts'o" -Cc: stable@vger.kernel.org ---- ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -4389,7 +4389,7 @@ void ext4_ext_truncate(handle_t *handle, - retry: - err = ext4_es_remove_extent(inode, last_block, - EXT_MAX_BLOCKS - last_block); -- if (err == ENOMEM) { -+ if (err == -ENOMEM) { - cond_resched(); - congestion_wait(BLK_RW_ASYNC, HZ/50); - goto retry; diff --git a/debian/patches/bugfix/all/fanotify-info-leak-in-copy_event_to_user.patch b/debian/patches/bugfix/all/fanotify-info-leak-in-copy_event_to_user.patch deleted file mode 100644 index 3ef34e31f..000000000 --- a/debian/patches/bugfix/all/fanotify-info-leak-in-copy_event_to_user.patch +++ /dev/null @@ -1,26 +0,0 @@ -From: Dan Carpenter -Date: Wed, 19 Jun 2013 10:05:29 +1000 -Subject: fanotify: info leak in copy_event_to_user() -Origin: http://www.ozlabs.org/~akpm/mmotm/broken-out/fanotify-info-leak-in-copy_event_to_user.patch - -The ->reserverd field isn't cleared so we leak one byte of stack -information to userspace. - -Signed-off-by: Dan Carpenter -Cc: Eric Paris -Cc: Al Viro -Signed-off-by: Andrew Morton ---- - fs/notify/fanotify/fanotify_user.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/fs/notify/fanotify/fanotify_user.c -+++ b/fs/notify/fanotify/fanotify_user.c -@@ -121,6 +121,7 @@ static int fill_event_metadata(struct fs - metadata->event_len = FAN_EVENT_METADATA_LEN; - metadata->metadata_len = FAN_EVENT_METADATA_LEN; - metadata->vers = FANOTIFY_METADATA_VERSION; -+ metadata->reserved = 0; - metadata->mask = event->mask & FAN_ALL_OUTGOING_EVENTS; - metadata->pid = pid_vnr(event->tgid); - if (unlikely(event->mask & FAN_Q_OVERFLOW)) diff --git a/debian/patches/series b/debian/patches/series index 10175b6e4..35458e590 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -70,7 +70,6 @@ bugfix/all/ath6kl-do-not-use-virt_addr_valid.patch features/all/cpu-devices/Partially-revert-cpufreq-Add-support-for-x86-cpuinfo.patch bugfix/x86/viafb-autoload-on-olpc-xo1.5-only.patch bugfix/all/misc-bmp085-Enable-building-as-a-module.patch -bugfix/all/fanotify-info-leak-in-copy_event_to_user.patch # ARM hardware support features/arm/ARM-dts-imx-add-imx5x-usbmisc-entries.patch @@ -111,9 +110,6 @@ features/all/iwlwifi-bump-required-firmware-API-version-for-3160-.patch bugfix/m68k/ethernat-kconfig.patch bugfix/all/nl80211-fix-another-nl80211_fam-attrbuf-race.patch -bugfix/all/ext4-fix-retry-handling-in-ext4_ext_truncate.patch -bugfix/all/atl1c-Fix-misuse-of-netdev_alloc_skb-in-refilling-rx.patch -bugfix/all/SCSI-Don-t-attempt-to-send-extended-INQUIRY-command-.patch # m68k IRQ bugfix bugfix/m68k/atari-irqs.patch