Update to 4.2.3

This commit is contained in:
Ben Hutchings 2015-10-04 02:27:48 +01:00
parent f7856192d9
commit 11e8b8bbe3
4 changed files with 121 additions and 265 deletions

122
debian/changelog vendored
View File

@ -1,4 +1,124 @@
linux (4.2.1-3) UNRELEASED; urgency=medium
linux (4.2.3-1) UNRELEASED; urgency=medium
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.2
- nfc: netlink: Add check on NFC_ATTR_VENDOR_DATA
- nfc: nci: hci: Add check on skb nci_hci_send_cmd parameter
- blk-mq: fix buffer overflow when reading sysfs file of 'pending'
- blk-mq: fix race between timeout and freeing request
- mac80211: enable assoc check for mesh interfaces
- [powerpc*] cxl: Allow release of contexts which have been OPENED but not
STARTED (regression in 4.2)
- ext4: don't manipulate recovery flag when freezing no-journal fs
(regression in 3.18)
- Revert "ext4: remove block_device_ejected" (regression in 4.1)
- [arm64] kconfig: Move LIST_POISON to a safe value
- [arm64] entry: always restore x0 from the stack on syscall return
- [arm64] flush FP/SIMD state correctly after execve()
- [arm64] head.S: initialise mdcr_el2 in el2_setup
- [arm64] errata: add module build workaround for erratum #843419
- [armhf,arm64] KVM: vgic: Check for !irqchip_in_kernel() when mapping
resources (regression in 4.0)
- [arm64] KVM: add workaround for Cortex-A57 erratum #852523
- [powerpc*] pseries: Fix corrupted pdn list (regression in 4.1)
- [powerpc*] eeh: Probe after unbalanced kref check (regression in 4.1)
- [powerpc*] eeh: Fix fenced PHB caused by eeh_slot_error_detail()
(regression in 3.18)
- [powerpc*] powernv/pci-ioda: fix 32-bit TCE table init in kdump kernel
(regression in 4.2)
- [powerpc*] powernv/pci-ioda: fix kdump with non-power-of-2 crashkernel=
(regression in 4.2)
- [powerpc*] pseries: Release DRC when configure_connector fails
(regression in 4.1)
- [powerpc*] mm: Recompute hash value after a failed update
- CIFS: fix type confusion in copy offload ioctl
- mm: check if section present during memory block registering
(regression in 3.19)
- [i386] mm: Initialize pmd_idx in page_table_range_init_count()
- [x86] i915: Set ddi_pll_sel in DP MST path (regression in 4.2)
- Btrfs: check if previous transaction aborted to avoid fs corruption
- nfsd: Fix an FS_LAYOUT_TYPES/LAYOUT_TYPES encode bug
- nfsd: ensure that the ol stateid hash reference is only put once
- nfsd: ensure that delegation stateid hash references are only put once
- NFSv4.1/pnfs: Fix atomicity of commit list updates (regression in 4.0)
- NFSv4: don't set SETATTR for O_RDONLY|O_EXCL
- NFSv4.1/pNFS: Fix borken function _same_data_server_addrs_locked()
- NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2
client
- NFS: nfs_set_pgio_error sometimes misses errors
- NFS41/flexfiles: update inode after write finishes
- NFSv4: Force a post-op attribute update when holding a delegation
- NFS41/flexfiles: zero out DS write wcc
- NFSv4.1/flexfiles: Fix a protocol error in layoutreturn
- NFSv4.1: Fix a protocol issue with CLOSE stateids
- nfs: Fix truncated client owner id without proto type (regression in 4.2)
- Revert "NFSv4: Remove incorrect check in can_open_delegated()"
(regression in 3.19)
- svcrdma: Change maximum server payload back to RPCSVC_MAXPAYLOAD
(regression in 4.2)
- SUNRPC: Ensure that we wait for connections to complete before retrying
(regression in 4.0)
- SUNRPC: Lock the transport layer on shutdown
- [hppa] PCI: Enable 64-bit bus addresses on PA-RISC (regression in 4.2)
- [hppa] Use double word condition in 64bit CAS operation
- fs: if a coredump already exists, unlink and recreate with O_EXCL
- fs: Don't dump core if the corefile would become world-readable.
- mmc: sdhci-of-esdhc: add workaround for pre divider initial value
(regression in 4.2)
- mmc: sdhci: also get preset value and driver type for MMC_DDR52
(regression in 3.16)
- mmc: sdhci: fix dma memory leak in sdhci_pre_req() (regression in 4.0)
- mmc: core: fix race condition in mmc_wait_data_done
- [armhf] iommu/fsl: Really fix init section(s) content (regression in 4.0)
- [armhf] iommu/io-pgtable-arm: Unmap and free table when overwriting with
block
- [x86] iommu/vt-d: Really use upper context table when necessary
(regression in 4.1)
- eCryptfs: Invalidate dcache entries when lower i_nlink is zero
- hfs: fix B-tree corruption after insertion at position 0
- IB/srp: Handle partial connection success correctly
- IB/srp: Stop the scsi_eh_<n> and scsi_tmf_<n> threads if login fails
(regression in 4.2)
- IB/uverbs: reject invalid or unknown opcodes
- IB/uverbs: Fix race between ib_uverbs_open and remove_one
- IB/iser: Fix missing return status check in iser_send_data_out
(regression in 3.19)
- IB/iser: Fix possible bogus DMA unmapping (regression in 3.19)
- IB/mlx5: avoid destroying a NULL mr in reg_user_mr error flow
(regression in 3.19)
- IB/mlx4: Fix incorrect cq flushing in error state (regression in 4.0)
- hfs,hfsplus: cache pages correctly between bnode_create and bnode_free
- jbd2: avoid infinite loop when destroying aborted journal
(regression in 4.2)
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.3
- phylib: fix device deletion order in mdiobus_unregister()
(regression in 4.2)
- sock, diag: fix panic in sock_diag_put_filterinfo
(regression in 3.19)
- net/ipv6: Correct PIM6 mrt_lock handling
- ipv6: fix multipath route replace error recovery (regression in 4.1)
- netlink, mmap: transform mmap skb into full skb on taps
- bridge: fix igmpv3 / mldv2 report parsing (regression in 4.2)
- [armhf] net: mvneta: fix DMA buffer unmapping in mvneta_rx()
(regression in 4.2)
- rtnetlink: catch -EOPNOTSUPP errors from ndo_bridge_getlink
(regression in 4.2)
- macvtap: fix TUNSETSNDBUF values > 64k (regression in 3.19)
- netlink: Fix autobind race condition that leads to zero port ID
(regression in 4.1)
- netlink: Replace rhash_portid with bound
- openvswitch: Zero flows on allocation.
- tcp: add proper TS val into RST packets (regression in 3.18)
- packet: Fix AF_PACKET ABI breakage in 4.2
- net: revert "net_sched: move tp->root allocation into fw_init()"
(regression in 4.1)
- fib_rules: fix fib rule dumps across multiple skbs
- ppp: fix lockdep splat in ppp_dev_uninit() (regression in 4.2)
- [armhf] mvneta: use inband status only when explicitly enabled
(regression in 4.1)
- net/mlx4_core: Capping number of requested MSIXs to MAX_MSIX
- zram: fix possible use after free in zcomp_create()
- [x86] hp-wmi: limit hotkey enable
[ Ben Hutchings ]
* ovl: conditionally use O_LARGEFILE in ovl_copy_up() (Closes: #800724)

View File

@ -1,227 +0,0 @@
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Date: Thu, 10 Sep 2015 17:31:15 -0300
Subject: sctp: fix race on protocol/netns initialization
Origin: https://git.kernel.org/linus/8e2d61e0aed2b7c4ecb35844fe07e0b2b762dee4
Consider sctp module is unloaded and is being requested because an user
is creating a sctp socket.
During initialization, sctp will add the new protocol type and then
initialize pernet subsys:
status = sctp_v4_protosw_init();
if (status)
goto err_protosw_init;
status = sctp_v6_protosw_init();
if (status)
goto err_v6_protosw_init;
status = register_pernet_subsys(&sctp_net_ops);
The problem is that after those calls to sctp_v{4,6}_protosw_init(), it
is possible for userspace to create SCTP sockets like if the module is
already fully loaded. If that happens, one of the possible effects is
that we will have readers for net->sctp.local_addr_list list earlier
than expected and sctp_net_init() does not take precautions while
dealing with that list, leading to a potential panic but not limited to
that, as sctp_sock_init() will copy a bunch of blank/partially
initialized values from net->sctp.
The race happens like this:
CPU 0 | CPU 1
socket() |
__sock_create | socket()
inet_create | __sock_create
list_for_each_entry_rcu( |
answer, &inetsw[sock->type], |
list) { | inet_create
/* no hits */ |
if (unlikely(err)) { |
... |
request_module() |
/* socket creation is blocked |
* the module is fully loaded |
*/ |
sctp_init |
sctp_v4_protosw_init |
inet_register_protosw |
list_add_rcu(&p->list, |
last_perm); |
| list_for_each_entry_rcu(
| answer, &inetsw[sock->type],
sctp_v6_protosw_init | list) {
| /* hit, so assumes protocol
| * is already loaded
| */
| /* socket creation continues
| * before netns is initialized
| */
register_pernet_subsys |
Simply inverting the initialization order between
register_pernet_subsys() and sctp_v4_protosw_init() is not possible
because register_pernet_subsys() will create a control sctp socket, so
the protocol must be already visible by then. Deferring the socket
creation to a work-queue is not good specially because we loose the
ability to handle its errors.
So, as suggested by Vlad, the fix is to split netns initialization in
two moments: defaults and control socket, so that the defaults are
already loaded by when we register the protocol, while control socket
initialization is kept at the same moment it is today.
Fixes: 4db67e808640 ("sctp: Make the address lists per network namespace")
Signed-off-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/sctp/protocol.c | 64 ++++++++++++++++++++++++++++++++++-------------------
1 file changed, 41 insertions(+), 23 deletions(-)
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1166,7 +1166,7 @@ static void sctp_v4_del_protocol(void)
unregister_inetaddr_notifier(&sctp_inetaddr_notifier);
}
-static int __net_init sctp_net_init(struct net *net)
+static int __net_init sctp_defaults_init(struct net *net)
{
int status;
@@ -1259,12 +1259,6 @@ static int __net_init sctp_net_init(stru
sctp_dbg_objcnt_init(net);
- /* Initialize the control inode/socket for handling OOTB packets. */
- if ((status = sctp_ctl_sock_init(net))) {
- pr_err("Failed to initialize the SCTP control sock\n");
- goto err_ctl_sock_init;
- }
-
/* Initialize the local address list. */
INIT_LIST_HEAD(&net->sctp.local_addr_list);
spin_lock_init(&net->sctp.local_addr_lock);
@@ -1280,9 +1274,6 @@ static int __net_init sctp_net_init(stru
return 0;
-err_ctl_sock_init:
- sctp_dbg_objcnt_exit(net);
- sctp_proc_exit(net);
err_init_proc:
cleanup_sctp_mibs(net);
err_init_mibs:
@@ -1291,15 +1282,12 @@ err_sysctl_register:
return status;
}
-static void __net_exit sctp_net_exit(struct net *net)
+static void __net_exit sctp_defaults_exit(struct net *net)
{
/* Free the local address list */
sctp_free_addr_wq(net);
sctp_free_local_addr_list(net);
- /* Free the control endpoint. */
- inet_ctl_sock_destroy(net->sctp.ctl_sock);
-
sctp_dbg_objcnt_exit(net);
sctp_proc_exit(net);
@@ -1307,9 +1295,32 @@ static void __net_exit sctp_net_exit(str
sctp_sysctl_net_unregister(net);
}
-static struct pernet_operations sctp_net_ops = {
- .init = sctp_net_init,
- .exit = sctp_net_exit,
+static struct pernet_operations sctp_defaults_ops = {
+ .init = sctp_defaults_init,
+ .exit = sctp_defaults_exit,
+};
+
+static int __net_init sctp_ctrlsock_init(struct net *net)
+{
+ int status;
+
+ /* Initialize the control inode/socket for handling OOTB packets. */
+ status = sctp_ctl_sock_init(net);
+ if (status)
+ pr_err("Failed to initialize the SCTP control sock\n");
+
+ return status;
+}
+
+static void __net_init sctp_ctrlsock_exit(struct net *net)
+{
+ /* Free the control endpoint. */
+ inet_ctl_sock_destroy(net->sctp.ctl_sock);
+}
+
+static struct pernet_operations sctp_ctrlsock_ops = {
+ .init = sctp_ctrlsock_init,
+ .exit = sctp_ctrlsock_exit,
};
/* Initialize the universe into something sensible. */
@@ -1442,8 +1453,11 @@ static __init int sctp_init(void)
sctp_v4_pf_init();
sctp_v6_pf_init();
- status = sctp_v4_protosw_init();
+ status = register_pernet_subsys(&sctp_defaults_ops);
+ if (status)
+ goto err_register_defaults;
+ status = sctp_v4_protosw_init();
if (status)
goto err_protosw_init;
@@ -1451,9 +1465,9 @@ static __init int sctp_init(void)
if (status)
goto err_v6_protosw_init;
- status = register_pernet_subsys(&sctp_net_ops);
+ status = register_pernet_subsys(&sctp_ctrlsock_ops);
if (status)
- goto err_register_pernet_subsys;
+ goto err_register_ctrlsock;
status = sctp_v4_add_protocol();
if (status)
@@ -1469,12 +1483,14 @@ out:
err_v6_add_protocol:
sctp_v4_del_protocol();
err_add_protocol:
- unregister_pernet_subsys(&sctp_net_ops);
-err_register_pernet_subsys:
+ unregister_pernet_subsys(&sctp_ctrlsock_ops);
+err_register_ctrlsock:
sctp_v6_protosw_exit();
err_v6_protosw_init:
sctp_v4_protosw_exit();
err_protosw_init:
+ unregister_pernet_subsys(&sctp_defaults_ops);
+err_register_defaults:
sctp_v4_pf_exit();
sctp_v6_pf_exit();
sctp_sysctl_unregister();
@@ -1507,12 +1523,14 @@ static __exit void sctp_exit(void)
sctp_v6_del_protocol();
sctp_v4_del_protocol();
- unregister_pernet_subsys(&sctp_net_ops);
+ unregister_pernet_subsys(&sctp_ctrlsock_ops);
/* Free protosw registrations */
sctp_v6_protosw_exit();
sctp_v4_protosw_exit();
+ unregister_pernet_subsys(&sctp_defaults_ops);
+
/* Unregister with socket layer. */
sctp_v6_pf_exit();
sctp_v4_pf_exit();

View File

@ -1,35 +0,0 @@
From: Tim Gardner <tim.gardner@canonical.com>
Date: Tue, 4 Aug 2015 11:26:04 -0600
Subject: workqueue: Make flush_workqueue() available again to non GPL modules
Origin: https://git.kernel.org/linus/1dadafa86a779884f14a6e7a3ddde1a57b0a0a65
Bug-Debian: https://bugs.debian.org/798311
Commit 37b1ef31a568fc02e53587620226e5f3c66454c8 ("workqueue: move
flush_scheduled_work() to workqueue.h") moved the exported non GPL
flush_scheduled_work() from a function to an inline wrapper.
Unfortunately, it directly calls flush_workqueue() which is a GPL function.
This has the effect of changing the licensing requirement for this function
and makes it unavailable to non GPL modules.
See commit ad7b1f841f8a54c6d61ff181451f55b68175e15a ("workqueue: Make
schedule_work() available again to non GPL modules") for precedent.
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
---
kernel/workqueue.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 4c4f061..a413acb 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2614,7 +2614,7 @@ void flush_workqueue(struct workqueue_struct *wq)
out_unlock:
mutex_unlock(&wq->mutex);
}
-EXPORT_SYMBOL_GPL(flush_workqueue);
+EXPORT_SYMBOL(flush_workqueue);
/**
* drain_workqueue - drain a workqueue

View File

@ -89,7 +89,6 @@ features/all/grsecurity/grsecurity-kconfig.patch
features/all/grsecurity/grkernsec_perf_harden.patch
bugfix/all/gfs2-make-statistics-unsigned-suitable-for-use-with-.patch
bugfix/all/workqueue-make-flush_workqueue-available-again-to-no.patch
bugfix/all/dcache-handle-escaped-paths-in-prepend_path.patch
bugfix/all/dcache-reduce-the-scope-of-i_lock-in-d_splice_alias.patch
bugfix/all/vfs-test-for-and-handle-paths-that-are-unreachable-f.patch
@ -97,7 +96,6 @@ bugfix/all/rds-verify-the-underlying-transport-exists-before-cr.patch
bugfix/all/e1000e-fix-tight-loop-implementation-of-systime-read.patch
bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch
bugfix/all/media-uvcvideo-disable-hardware-timestamps-by-defaul.patch
bugfix/all/sctp-fix-race-on-protocol-netns-initialization.patch
bugfix/mips/mips-pgtable-bits.h-correct-_page_global_shift-build.patch
bugfix/all/ovl-conditionally-use-o_largefile-in-ovl_copy_up.patch
bugfix/x86/alsa-hda-disable-power_save_node-for-thinkpads.patch