Update to 3.2.23
svn path=/dists/sid/linux/; revision=19246
This commit is contained in:
Ben Hutchings
parent
65a94ef6e2
commit
016f1a0814
|
|
@ -1,9 +1,25 @@
|
|||
linux (3.2.22-1) UNRELEASED; urgency=low
|
||||
linux (3.2.23-1) UNRELEASED; urgency=low
|
||||
|
||||
* New upstream stable update:
|
||||
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.22
|
||||
- nilfs2: ensure proper cache clearing for gc-inodes
|
||||
- ath9k_hw: avoid possible infinite loop in ar9003_get_pll_sqsum_dvc
|
||||
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.23
|
||||
- splice: fix racy pipe->buffers uses
|
||||
- NFC: Prevent multiple buffer overflows in NCI (CVE-2012-3364)
|
||||
- NFC: Return from rawsock_release when sk is NULL
|
||||
- md/raid5: Do not add data_offset before call to is_badblock
|
||||
- md/raid5: In ops_run_io, inc nr_pending before calling
|
||||
md_wait_for_blocked_rdev
|
||||
- md/raid10: fix failure when trying to repair a read error.
|
||||
- udf: Avoid run away loop when partition table length is corrupted
|
||||
- udf: Fortify loading of sparing table (CVE-2012-3400)
|
||||
- l2tp: fix a race in l2tp_ip_sendmsg()
|
||||
- netpoll: fix netpoll_send_udp() bugs
|
||||
- Btrfs: run delayed directory updates during log replay
|
||||
- ocfs2: clear unaligned io flag when dio fails
|
||||
- aio: make kiocb->private NUll in init_sync_kiocb()
|
||||
- mm: Hold a file reference in madvise_remove
|
||||
|
||||
[ Ben Hutchings ]
|
||||
* linux-libc-dev: Fix redundant 'GNU glibc' in description (Closes: #631228)
|
||||
|
|
|
|||
|
|
@ -1,31 +0,0 @@
|
|||
From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
|
||||
Date: Sun, 22 Jan 2012 00:20:40 +0000
|
||||
Subject: ethtool: allow ETHTOOL_GSSET_INFO for users
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
commit f80400a26a2e8bff541de12834a1134358bb6642 upstream.
|
||||
|
||||
Allow ETHTOOL_GSSET_INFO ethtool ioctl() for unprivileged users.
|
||||
ETHTOOL_GSTRINGS is already allowed, but is unusable without this one.
|
||||
|
||||
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
|
||||
Acked-by: Ben Hutchings <bhutchings@solarflare.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
net/core/ethtool.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
|
||||
index 921aa2b..369b418 100644
|
||||
--- a/net/core/ethtool.c
|
||||
+++ b/net/core/ethtool.c
|
||||
@@ -1311,6 +1311,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
|
||||
case ETHTOOL_GRXCSUM:
|
||||
case ETHTOOL_GTXCSUM:
|
||||
case ETHTOOL_GSG:
|
||||
+ case ETHTOOL_GSSET_INFO:
|
||||
case ETHTOOL_GSTRINGS:
|
||||
case ETHTOOL_GTSO:
|
||||
case ETHTOOL_GPERMADDR:
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
From: Jason Wang <jasowang@redhat.com>
|
||||
Date: Wed, 30 May 2012 21:18:10 +0000
|
||||
Subject: net: sock: validate data_len before allocating skb in
|
||||
sock_alloc_send_pskb()
|
||||
|
||||
commit cc9b17ad29ecaa20bfe426a8d4dbfb94b13ff1cc upstream.
|
||||
|
||||
We need to validate the number of pages consumed by data_len, otherwise frags
|
||||
array could be overflowed by userspace. So this patch validate data_len and
|
||||
return -EMSGSIZE when data_len may occupies more frags than MAX_SKB_FRAGS.
|
||||
|
||||
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
net/core/sock.c | 7 +++++--
|
||||
1 file changed, 5 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/net/core/sock.c b/net/core/sock.c
|
||||
index 653f8c0..9e5b71f 100644
|
||||
--- a/net/core/sock.c
|
||||
+++ b/net/core/sock.c
|
||||
@@ -1592,6 +1592,11 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
|
||||
gfp_t gfp_mask;
|
||||
long timeo;
|
||||
int err;
|
||||
+ int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
|
||||
+
|
||||
+ err = -EMSGSIZE;
|
||||
+ if (npages > MAX_SKB_FRAGS)
|
||||
+ goto failure;
|
||||
|
||||
gfp_mask = sk->sk_allocation;
|
||||
if (gfp_mask & __GFP_WAIT)
|
||||
@@ -1610,14 +1615,12 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
|
||||
if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
|
||||
skb = alloc_skb(header_len, gfp_mask);
|
||||
if (skb) {
|
||||
- int npages;
|
||||
int i;
|
||||
|
||||
/* No pages, we're done... */
|
||||
if (!data_len)
|
||||
break;
|
||||
|
||||
- npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
|
||||
skb->truesize += data_len;
|
||||
skb_shinfo(skb)->nr_frags = npages;
|
||||
for (i = 0; i < npages; i++) {
|
||||
|
|
@ -305,7 +305,6 @@ features/all/hidepid/0004-proc-fix-mount-t-proc-o-AAA.patch
|
|||
|
||||
bugfix/all/NFSv4-Reduce-the-footprint-of-the-idmapper.patch
|
||||
bugfix/all/NFSv4-Further-reduce-the-footprint-of-the-idmapper.patch
|
||||
bugfix/all/net-sock-validate-data_len-before-allocating-skb-in-.patch
|
||||
|
||||
bugfix/all/macvtap-zerocopy-fix-offset-calculation-when-buildin.patch
|
||||
bugfix/all/macvtap-zerocopy-fix-truesize-underestimation.patch
|
||||
|
|
@ -314,7 +313,6 @@ bugfix/all/macvtap-zerocopy-set-SKBTX_DEV_ZEROCOPY-only-when-sk.patch
|
|||
bugfix/all/macvtap-zerocopy-validate-vectors-before-building-sk.patch
|
||||
|
||||
bugfix/all/KVM-Fix-buffer-overflow-in-kvm_set_irq.patch
|
||||
bugfix/all/ethtool-allow-ETHTOOL_GSSET_INFO-for-users.patch
|
||||
|
||||
# CPU sysdev removal from 3.3 and x86 CPU auto-loading from 3.4
|
||||
features/all/cpu-devices/driver-core-implement-sysdev-functionality-for-regul.patch
|
||||
|
|
|
|||
Loading…
Reference in New Issue