Update to 3.2.17
svn path=/dists/sid/linux-2.6/; revision=18989
This commit is contained in:
Ben Hutchings
parent
ea1716c4a4
commit
763201715b
|
|
@ -1,4 +1,7 @@
|
|||
linux-2.6 (3.2.16-2) UNRELEASED; urgency=low
|
||||
linux-2.6 (3.2.17-1) UNRELEASED; urgency=low
|
||||
|
||||
* New upstream stable update:
|
||||
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.17
|
||||
|
||||
[ Ben Hutchings ]
|
||||
* aufs: Enable AUFS_EXPORT
|
||||
|
|
|
|||
|
|
@ -1,42 +0,0 @@
|
|||
From: Jason Baron <jbaron@redhat.com>
|
||||
Date: Fri, 16 Mar 2012 16:34:03 -0400
|
||||
Subject: [PATCH] Don't limit non-nested epoll paths
|
||||
|
||||
commit 93dc6107a76daed81c07f50215fa6ae77691634f upstream.
|
||||
|
||||
Commit 28d82dc1c4ed ("epoll: limit paths") that I did to limit the
|
||||
number of possible wakeup paths in epoll is causing a few applications
|
||||
to longer work (dovecot for one).
|
||||
|
||||
The original patch is really about limiting the amount of epoll nesting
|
||||
(since epoll fds can be attached to other fds). Thus, we probably can
|
||||
allow an unlimited number of paths of depth 1. My current patch limits
|
||||
it at 1000. And enforce the limits on paths that have a greater depth.
|
||||
|
||||
This is captured in: https://bugzilla.redhat.com/show_bug.cgi?id=681578
|
||||
|
||||
Signed-off-by: Jason Baron <jbaron@redhat.com>
|
||||
Cc: Andrew Morton <akpm@linux-foundation.org>
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
fs/eventpoll.c | 4 ++++
|
||||
1 files changed, 4 insertions(+), 0 deletions(-)
|
||||
|
||||
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
|
||||
index ea54cde..4d9d3a4 100644
|
||||
--- a/fs/eventpoll.c
|
||||
+++ b/fs/eventpoll.c
|
||||
@@ -988,6 +988,10 @@ static int path_count[PATH_ARR_SIZE];
|
||||
|
||||
static int path_count_inc(int nests)
|
||||
{
|
||||
+ /* Allow an arbitrary number of depth 1 paths */
|
||||
+ if (nests == 0)
|
||||
+ return 0;
|
||||
+
|
||||
if (++path_count[nests] > path_limits[nests])
|
||||
return -1;
|
||||
return 0;
|
||||
--
|
||||
1.7.9.1
|
||||
|
||||
|
|
@ -1,52 +0,0 @@
|
|||
From: Trond Myklebust <Trond.Myklebust@netapp.com>
|
||||
Date: Wed, 18 Apr 2012 12:20:10 -0400
|
||||
Subject: [PATCH 1/2] NFSv4: Ensure that the LOCK code sets exception->inode
|
||||
|
||||
commit 05ffe24f5290dc095f98fbaf84afe51ef404ccc5 upstream.
|
||||
|
||||
All callers of nfs4_handle_exception() that need to handle
|
||||
NFS4ERR_OPENMODE correctly should set exception->inode
|
||||
|
||||
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
---
|
||||
fs/nfs/nfs4proc.c | 9 +++++++--
|
||||
1 file changed, 7 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
|
||||
index f82bde0..3c787d0 100644
|
||||
--- a/fs/nfs/nfs4proc.c
|
||||
+++ b/fs/nfs/nfs4proc.c
|
||||
@@ -4558,7 +4558,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
|
||||
static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
|
||||
{
|
||||
struct nfs_server *server = NFS_SERVER(state->inode);
|
||||
- struct nfs4_exception exception = { };
|
||||
+ struct nfs4_exception exception = {
|
||||
+ .inode = state->inode,
|
||||
+ };
|
||||
int err;
|
||||
|
||||
do {
|
||||
@@ -4576,7 +4578,9 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request
|
||||
static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
|
||||
{
|
||||
struct nfs_server *server = NFS_SERVER(state->inode);
|
||||
- struct nfs4_exception exception = { };
|
||||
+ struct nfs4_exception exception = {
|
||||
+ .inode = state->inode,
|
||||
+ };
|
||||
int err;
|
||||
|
||||
err = nfs4_set_lock_state(state, request);
|
||||
@@ -4676,6 +4680,7 @@ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *
|
||||
{
|
||||
struct nfs4_exception exception = {
|
||||
.state = state,
|
||||
+ .inode = state->inode,
|
||||
};
|
||||
int err;
|
||||
|
||||
--
|
||||
1.7.10
|
||||
|
||||
|
|
@ -1,44 +0,0 @@
|
|||
From: Trond Myklebust <Trond.Myklebust@netapp.com>
|
||||
Date: Wed, 18 Apr 2012 12:48:35 -0400
|
||||
Subject: [PATCH 2/2] NFSv4: Ensure that we check lock exclusive/shared type
|
||||
against open modes
|
||||
|
||||
commit 55725513b5ef9d462aa3e18527658a0362aaae83 upstream.
|
||||
|
||||
Since we may be simulating flock() locks using NFS byte range locks,
|
||||
we can't rely on the VFS having checked the file open mode for us.
|
||||
|
||||
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
---
|
||||
fs/nfs/nfs4proc.c | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
|
||||
index 3c787d0..ba837d9 100644
|
||||
--- a/fs/nfs/nfs4proc.c
|
||||
+++ b/fs/nfs/nfs4proc.c
|
||||
@@ -4726,6 +4726,20 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
|
||||
|
||||
if (state == NULL)
|
||||
return -ENOLCK;
|
||||
+ /*
|
||||
+ * Don't rely on the VFS having checked the file open mode,
|
||||
+ * since it won't do this for flock() locks.
|
||||
+ */
|
||||
+ switch (request->fl_type & (F_RDLCK|F_WRLCK|F_UNLCK)) {
|
||||
+ case F_RDLCK:
|
||||
+ if (!(filp->f_mode & FMODE_READ))
|
||||
+ return -EBADF;
|
||||
+ break;
|
||||
+ case F_WRLCK:
|
||||
+ if (!(filp->f_mode & FMODE_WRITE))
|
||||
+ return -EBADF;
|
||||
+ }
|
||||
+
|
||||
do {
|
||||
status = nfs4_proc_setlk(state, cmd, request);
|
||||
if ((status != -EAGAIN) || IS_SETLK(cmd))
|
||||
--
|
||||
1.7.10
|
||||
|
||||
|
|
@ -1,183 +0,0 @@
|
|||
From: Eric Dumazet <eric.dumazet@gmail.com>
|
||||
Date: Mon, 2 Apr 2012 22:33:02 +0000
|
||||
Subject: [PATCH] net: fix /proc/net/dev regression
|
||||
|
||||
commit 2def16ae6b0c77571200f18ba4be049b03d75579 upstream.
|
||||
|
||||
Commit f04565ddf52 (dev: use name hash for dev_seq_ops) added a second
|
||||
regression, as some devices are missing from /proc/net/dev if many
|
||||
devices are defined.
|
||||
|
||||
When seq_file buffer is filled, the last ->next/show() method is
|
||||
canceled (pos value is reverted to value prior ->next() call)
|
||||
|
||||
Problem is after above commit, we dont restart the lookup at right
|
||||
position in ->start() method.
|
||||
|
||||
Fix this by removing the internal 'pos' pointer added in commit, since
|
||||
we need to use the 'loff_t *pos' provided by seq_file layer.
|
||||
|
||||
This also reverts commit 5cac98dd0 (net: Fix corruption
|
||||
in /proc/*/net/dev_mcast), since its not needed anymore.
|
||||
|
||||
Reported-by: Ben Greear <greearb@candelatech.com>
|
||||
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
|
||||
Cc: Mihai Maruseac <mmaruseac@ixiacom.com>
|
||||
Tested-by: Ben Greear <greearb@candelatech.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
include/linux/netdevice.h | 2 --
|
||||
net/core/dev.c | 58 ++++++++++-----------------------------------
|
||||
net/core/dev_addr_lists.c | 3 ++-
|
||||
3 files changed, 15 insertions(+), 48 deletions(-)
|
||||
|
||||
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
|
||||
index 1f77540..5cbaa20 100644
|
||||
--- a/include/linux/netdevice.h
|
||||
+++ b/include/linux/netdevice.h
|
||||
@@ -2604,8 +2604,6 @@ extern void net_disable_timestamp(void);
|
||||
extern void *dev_seq_start(struct seq_file *seq, loff_t *pos);
|
||||
extern void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos);
|
||||
extern void dev_seq_stop(struct seq_file *seq, void *v);
|
||||
-extern int dev_seq_open_ops(struct inode *inode, struct file *file,
|
||||
- const struct seq_operations *ops);
|
||||
#endif
|
||||
|
||||
extern int netdev_class_create_file(struct class_attribute *class_attr);
|
||||
diff --git a/net/core/dev.c b/net/core/dev.c
|
||||
index 6c7dc9d..c25d453 100644
|
||||
--- a/net/core/dev.c
|
||||
+++ b/net/core/dev.c
|
||||
@@ -4028,54 +4028,41 @@ static int dev_ifconf(struct net *net, char __user *arg)
|
||||
|
||||
#ifdef CONFIG_PROC_FS
|
||||
|
||||
-#define BUCKET_SPACE (32 - NETDEV_HASHBITS)
|
||||
-
|
||||
-struct dev_iter_state {
|
||||
- struct seq_net_private p;
|
||||
- unsigned int pos; /* bucket << BUCKET_SPACE + offset */
|
||||
-};
|
||||
+#define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1)
|
||||
|
||||
#define get_bucket(x) ((x) >> BUCKET_SPACE)
|
||||
#define get_offset(x) ((x) & ((1 << BUCKET_SPACE) - 1))
|
||||
#define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o))
|
||||
|
||||
-static inline struct net_device *dev_from_same_bucket(struct seq_file *seq)
|
||||
+static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff_t *pos)
|
||||
{
|
||||
- struct dev_iter_state *state = seq->private;
|
||||
struct net *net = seq_file_net(seq);
|
||||
struct net_device *dev;
|
||||
struct hlist_node *p;
|
||||
struct hlist_head *h;
|
||||
- unsigned int count, bucket, offset;
|
||||
+ unsigned int count = 0, offset = get_offset(*pos);
|
||||
|
||||
- bucket = get_bucket(state->pos);
|
||||
- offset = get_offset(state->pos);
|
||||
- h = &net->dev_name_head[bucket];
|
||||
- count = 0;
|
||||
+ h = &net->dev_name_head[get_bucket(*pos)];
|
||||
hlist_for_each_entry_rcu(dev, p, h, name_hlist) {
|
||||
- if (count++ == offset) {
|
||||
- state->pos = set_bucket_offset(bucket, count);
|
||||
+ if (++count == offset)
|
||||
return dev;
|
||||
- }
|
||||
}
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
-static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
|
||||
+static inline struct net_device *dev_from_bucket(struct seq_file *seq, loff_t *pos)
|
||||
{
|
||||
- struct dev_iter_state *state = seq->private;
|
||||
struct net_device *dev;
|
||||
unsigned int bucket;
|
||||
|
||||
- bucket = get_bucket(state->pos);
|
||||
do {
|
||||
- dev = dev_from_same_bucket(seq);
|
||||
+ dev = dev_from_same_bucket(seq, pos);
|
||||
if (dev)
|
||||
return dev;
|
||||
|
||||
- bucket++;
|
||||
- state->pos = set_bucket_offset(bucket, 0);
|
||||
+ bucket = get_bucket(*pos) + 1;
|
||||
+ *pos = set_bucket_offset(bucket, 1);
|
||||
} while (bucket < NETDEV_HASHENTRIES);
|
||||
|
||||
return NULL;
|
||||
@@ -4088,33 +4075,20 @@ static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
|
||||
void *dev_seq_start(struct seq_file *seq, loff_t *pos)
|
||||
__acquires(RCU)
|
||||
{
|
||||
- struct dev_iter_state *state = seq->private;
|
||||
-
|
||||
rcu_read_lock();
|
||||
if (!*pos)
|
||||
return SEQ_START_TOKEN;
|
||||
|
||||
- /* check for end of the hash */
|
||||
- if (state->pos == 0 && *pos > 1)
|
||||
+ if (get_bucket(*pos) >= NETDEV_HASHENTRIES)
|
||||
return NULL;
|
||||
|
||||
- return dev_from_new_bucket(seq);
|
||||
+ return dev_from_bucket(seq, pos);
|
||||
}
|
||||
|
||||
void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
|
||||
{
|
||||
- struct net_device *dev;
|
||||
-
|
||||
++*pos;
|
||||
-
|
||||
- if (v == SEQ_START_TOKEN)
|
||||
- return dev_from_new_bucket(seq);
|
||||
-
|
||||
- dev = dev_from_same_bucket(seq);
|
||||
- if (dev)
|
||||
- return dev;
|
||||
-
|
||||
- return dev_from_new_bucket(seq);
|
||||
+ return dev_from_bucket(seq, pos);
|
||||
}
|
||||
|
||||
void dev_seq_stop(struct seq_file *seq, void *v)
|
||||
@@ -4213,13 +4187,7 @@ static const struct seq_operations dev_seq_ops = {
|
||||
static int dev_seq_open(struct inode *inode, struct file *file)
|
||||
{
|
||||
return seq_open_net(inode, file, &dev_seq_ops,
|
||||
- sizeof(struct dev_iter_state));
|
||||
-}
|
||||
-
|
||||
-int dev_seq_open_ops(struct inode *inode, struct file *file,
|
||||
- const struct seq_operations *ops)
|
||||
-{
|
||||
- return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state));
|
||||
+ sizeof(struct seq_net_private));
|
||||
}
|
||||
|
||||
static const struct file_operations dev_seq_fops = {
|
||||
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
|
||||
index 29c07fe..626698f 100644
|
||||
--- a/net/core/dev_addr_lists.c
|
||||
+++ b/net/core/dev_addr_lists.c
|
||||
@@ -696,7 +696,8 @@ static const struct seq_operations dev_mc_seq_ops = {
|
||||
|
||||
static int dev_mc_seq_open(struct inode *inode, struct file *file)
|
||||
{
|
||||
- return dev_seq_open_ops(inode, file, &dev_mc_seq_ops);
|
||||
+ return seq_open_net(inode, file, &dev_mc_seq_ops,
|
||||
+ sizeof(struct seq_net_private));
|
||||
}
|
||||
|
||||
static const struct file_operations dev_mc_seq_fops = {
|
||||
--
|
||||
1.7.9.5
|
||||
|
||||
|
|
@ -1,132 +0,0 @@
|
|||
From: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
Date: Sat, 28 Apr 2012 08:29:56 -0700
|
||||
Subject: [PATCH] Revert "autofs: work around unhappy compat problem on
|
||||
x86-64"
|
||||
|
||||
commit fcbf94b9dedd2ce08e798a99aafc94fec8668161 upstream.
|
||||
|
||||
This reverts commit a32744d4abae24572eff7269bc17895c41bd0085.
|
||||
|
||||
While that commit was technically the right thing to do, and made the
|
||||
x86-64 compat mode work identically to native 32-bit mode (and thus
|
||||
fixing the problem with a 32-bit systemd install on a 64-bit kernel), it
|
||||
turns out that the automount binaries had workarounds for this compat
|
||||
problem.
|
||||
|
||||
Now, the workarounds are disgusting: doing an "uname()" to find out the
|
||||
architecture of the kernel, and then comparing it for the 64-bit cases
|
||||
and fixing up the size of the read() in automount for those. And they
|
||||
were confused: it's not actually a generic 64-bit issue at all, it's
|
||||
very much tied to just x86-64, which has different alignment for an
|
||||
'u64' in 64-bit mode than in 32-bit mode.
|
||||
|
||||
But the end result is that fixing the compat layer actually breaks the
|
||||
case of a 32-bit automount on a x86-64 kernel.
|
||||
|
||||
There are various approaches to fix this (including just doing a
|
||||
"strcmp()" on current->comm and comparing it to "automount"), but I
|
||||
think that I will do the one that teaches pipes about a special "packet
|
||||
mode", which will allow user space to not have to care too deeply about
|
||||
the padding at the end of the autofs packet.
|
||||
|
||||
That change will make the compat workaround unnecessary, so let's revert
|
||||
it first, and get automount working again in compat mode. The
|
||||
packetized pipes will then fix autofs for systemd.
|
||||
|
||||
Reported-and-requested-by: Michael Tokarev <mjt@tls.msk.ru>
|
||||
Cc: Ian Kent <raven@themaw.net>
|
||||
Cc: stable@kernel.org # for 3.3
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
[bwh: Backported to 3.2: adjust context]
|
||||
---
|
||||
fs/autofs4/autofs_i.h | 1 -
|
||||
fs/autofs4/dev-ioctl.c | 1 -
|
||||
fs/autofs4/inode.c | 2 --
|
||||
fs/autofs4/waitq.c | 22 +++-------------------
|
||||
4 files changed, 3 insertions(+), 23 deletions(-)
|
||||
|
||||
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
|
||||
index eb1cc92..d8d8e7b 100644
|
||||
--- a/fs/autofs4/autofs_i.h
|
||||
+++ b/fs/autofs4/autofs_i.h
|
||||
@@ -110,7 +110,6 @@ struct autofs_sb_info {
|
||||
int sub_version;
|
||||
int min_proto;
|
||||
int max_proto;
|
||||
- int compat_daemon;
|
||||
unsigned long exp_timeout;
|
||||
unsigned int type;
|
||||
int reghost_enabled;
|
||||
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
|
||||
index 9dacb85..3dfd615 100644
|
||||
--- a/fs/autofs4/dev-ioctl.c
|
||||
+++ b/fs/autofs4/dev-ioctl.c
|
||||
@@ -385,7 +385,6 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
|
||||
sbi->pipefd = pipefd;
|
||||
sbi->pipe = pipe;
|
||||
sbi->catatonic = 0;
|
||||
- sbi->compat_daemon = is_compat_task();
|
||||
}
|
||||
out:
|
||||
mutex_unlock(&sbi->wq_mutex);
|
||||
--- a/fs/autofs4/inode.c
|
||||
+++ b/fs/autofs4/inode.c
|
||||
@@ -19,7 +19,6 @@
|
||||
#include <linux/parser.h>
|
||||
#include <linux/bitops.h>
|
||||
#include <linux/magic.h>
|
||||
-#include <linux/compat.h>
|
||||
#include "autofs_i.h"
|
||||
#include <linux/module.h>
|
||||
|
||||
@@ -225,7 +224,6 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
|
||||
set_autofs_type_indirect(&sbi->type);
|
||||
sbi->min_proto = 0;
|
||||
sbi->max_proto = 0;
|
||||
- sbi->compat_daemon = is_compat_task();
|
||||
mutex_init(&sbi->wq_mutex);
|
||||
spin_lock_init(&sbi->fs_lock);
|
||||
sbi->queues = NULL;
|
||||
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
|
||||
index 9c098db..da8876d 100644
|
||||
--- a/fs/autofs4/waitq.c
|
||||
+++ b/fs/autofs4/waitq.c
|
||||
@@ -91,24 +91,7 @@ static int autofs4_write(struct autofs_sb_info *sbi,
|
||||
|
||||
return (bytes > 0);
|
||||
}
|
||||
-
|
||||
-/*
|
||||
- * The autofs_v5 packet was misdesigned.
|
||||
- *
|
||||
- * The packets are identical on x86-32 and x86-64, but have different
|
||||
- * alignment. Which means that 'sizeof()' will give different results.
|
||||
- * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
|
||||
- */
|
||||
-static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
|
||||
-{
|
||||
- size_t pktsz = sizeof(struct autofs_v5_packet);
|
||||
-#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
|
||||
- if (sbi->compat_daemon > 0)
|
||||
- pktsz -= 4;
|
||||
-#endif
|
||||
- return pktsz;
|
||||
-}
|
||||
-
|
||||
+
|
||||
static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
|
||||
struct autofs_wait_queue *wq,
|
||||
int type)
|
||||
@@ -172,7 +155,8 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
|
||||
{
|
||||
struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
|
||||
|
||||
- pktsz = autofs_v5_packet_size(sbi);
|
||||
+ pktsz = sizeof(*packet);
|
||||
+
|
||||
packet->wait_queue_token = wq->wait_queue_token;
|
||||
packet->len = wq->name.len;
|
||||
memcpy(packet->name, wq->name.name, wq->name.len);
|
||||
--
|
||||
1.7.10
|
||||
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
From: Xi Wang <xi.wang@gmail.com>
|
||||
Date: Mon, 23 Apr 2012 04:06:42 -0400
|
||||
Message-Id: <1335168402-25174-2-git-send-email-xi.wang@gmail.com>
|
||||
Subject: [PATCH v2 2/2] drm/i915: fix integer overflow in
|
||||
i915_gem_do_execbuffer()
|
||||
|
||||
On 32-bit systems, a large args->num_cliprects from userspace via ioctl
|
||||
may overflow the allocation size, leading to out-of-bounds access.
|
||||
|
||||
This vulnerability was introduced in commit 432e58ed ("drm/i915: Avoid
|
||||
allocation for execbuffer object list").
|
||||
|
||||
Signed-off-by: Xi Wang <xi.wang@gmail.com>
|
||||
Cc: Chris Wilson <chris@chris-wilson.co.uk>
|
||||
Cc: stable@vger.kernel.org
|
||||
---
|
||||
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 5 +++++
|
||||
1 files changed, 5 insertions(+), 0 deletions(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
||||
index 7c50e58..de43194 100644
|
||||
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
||||
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
||||
@@ -1133,6 +1133,11 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
+ if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) {
|
||||
+ DRM_DEBUG("execbuf with %u cliprects\n",
|
||||
+ args->num_cliprects);
|
||||
+ return -EINVAL;
|
||||
+ }
|
||||
cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects),
|
||||
GFP_KERNEL);
|
||||
if (cliprects == NULL) {
|
||||
--
|
||||
1.7.5.4
|
||||
|
||||
|
|
@ -1,37 +0,0 @@
|
|||
From: Xi Wang <xi.wang@gmail.com>
|
||||
Date: Mon, 23 Apr 2012 04:06:41 -0400
|
||||
Message-Id: <1335168402-25174-1-git-send-email-xi.wang@gmail.com>
|
||||
Subject: [PATCH v2 1/2] drm/i915: fix integer overflow in
|
||||
i915_gem_execbuffer2()
|
||||
|
||||
On 32-bit systems, a large args->buffer_count from userspace via ioctl
|
||||
may overflow the allocation size, leading to out-of-bounds access.
|
||||
|
||||
This vulnerability was introduced in commit 8408c282 ("drm/i915:
|
||||
First try a normal large kmalloc for the temporary exec buffers").
|
||||
|
||||
Signed-off-by: Xi Wang <xi.wang@gmail.com>
|
||||
Cc: Chris Wilson <chris@chris-wilson.co.uk>
|
||||
Cc: stable@vger.kernel.org
|
||||
[bwh: Backported to 3.2: adjust context]
|
||||
---
|
||||
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 3 ++-
|
||||
1 files changed, 2 insertions(+), 1 deletions(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
||||
index f51a696..7c50e58 100644
|
||||
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
||||
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
||||
@@ -1404,7 +1404,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
|
||||
struct drm_i915_gem_exec_object2 *exec2_list = NULL;
|
||||
int ret;
|
||||
|
||||
- if (args->buffer_count < 1) {
|
||||
+ if (args->buffer_count < 1 ||
|
||||
+ args->buffer_count > UINT_MAX / sizeof(*exec2_list)) {
|
||||
DRM_ERROR("execbuf2 with %d buffers\n", args->buffer_count);
|
||||
return -EINVAL;
|
||||
}
|
||||
--
|
||||
1.7.5.4
|
||||
|
||||
|
|
@ -1,146 +0,0 @@
|
|||
From: Gertjan van Wingerde <gwingerde@gmail.com>
|
||||
Date: Wed, 28 Dec 2011 01:53:18 +0100
|
||||
Subject: [PATCH] rt2x00: Identify rt2800usb chipsets.
|
||||
|
||||
commit bc93eda7e903ff75cefcb6e247ed9b8e9f8e9783 upstream.
|
||||
|
||||
According to the latest USB ID database these are all RT2770 / RT2870 / RT307x
|
||||
devices.
|
||||
|
||||
Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
|
||||
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
|
||||
Signed-off-by: John W. Linville <linville@tuxdriver.com>
|
||||
[bwh: Backported to 3.2: adjust context for previously cherry-picked
|
||||
commit d42a179b941a9e4cc6cf41d0f3cbadd75fc48a89 'rt2x00: Add support
|
||||
for D-Link DWA-127 to rt2800usb']
|
||||
---
|
||||
drivers/net/wireless/rt2x00/rt2800usb.c | 26 ++++++++++++--------------
|
||||
1 file changed, 12 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
|
||||
index 486fd49..5bff495 100644
|
||||
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
|
||||
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
|
||||
@@ -914,12 +914,14 @@ static struct usb_device_id rt2800usb_device_table[] = {
|
||||
{ USB_DEVICE(0x050d, 0x8053) },
|
||||
{ USB_DEVICE(0x050d, 0x805c) },
|
||||
{ USB_DEVICE(0x050d, 0x815c) },
|
||||
+ { USB_DEVICE(0x050d, 0x825a) },
|
||||
{ USB_DEVICE(0x050d, 0x825b) },
|
||||
{ USB_DEVICE(0x050d, 0x935a) },
|
||||
{ USB_DEVICE(0x050d, 0x935b) },
|
||||
/* Buffalo */
|
||||
{ USB_DEVICE(0x0411, 0x00e8) },
|
||||
{ USB_DEVICE(0x0411, 0x0158) },
|
||||
+ { USB_DEVICE(0x0411, 0x015d) },
|
||||
{ USB_DEVICE(0x0411, 0x016f) },
|
||||
{ USB_DEVICE(0x0411, 0x01a2) },
|
||||
/* Corega */
|
||||
@@ -934,6 +936,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
|
||||
{ USB_DEVICE(0x07d1, 0x3c0e) },
|
||||
{ USB_DEVICE(0x07d1, 0x3c0f) },
|
||||
{ USB_DEVICE(0x07d1, 0x3c11) },
|
||||
+ { USB_DEVICE(0x07d1, 0x3c13) },
|
||||
+ { USB_DEVICE(0x07d1, 0x3c15) },
|
||||
{ USB_DEVICE(0x07d1, 0x3c16) },
|
||||
{ USB_DEVICE(0x2001, 0x3c1b) },
|
||||
/* Draytek */
|
||||
@@ -943,6 +947,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
|
||||
{ USB_DEVICE(0x7392, 0x7711) },
|
||||
{ USB_DEVICE(0x7392, 0x7717) },
|
||||
{ USB_DEVICE(0x7392, 0x7718) },
|
||||
+ { USB_DEVICE(0x7392, 0x7722) },
|
||||
/* Encore */
|
||||
{ USB_DEVICE(0x203d, 0x1480) },
|
||||
{ USB_DEVICE(0x203d, 0x14a9) },
|
||||
@@ -977,6 +982,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
|
||||
{ USB_DEVICE(0x1737, 0x0070) },
|
||||
{ USB_DEVICE(0x1737, 0x0071) },
|
||||
{ USB_DEVICE(0x1737, 0x0077) },
|
||||
+ { USB_DEVICE(0x1737, 0x0078) },
|
||||
/* Logitec */
|
||||
{ USB_DEVICE(0x0789, 0x0162) },
|
||||
{ USB_DEVICE(0x0789, 0x0163) },
|
||||
@@ -1000,9 +1006,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
|
||||
{ USB_DEVICE(0x0db0, 0x871b) },
|
||||
{ USB_DEVICE(0x0db0, 0x871c) },
|
||||
{ USB_DEVICE(0x0db0, 0x899a) },
|
||||
+ /* Ovislink */
|
||||
+ { USB_DEVICE(0x1b75, 0x3071) },
|
||||
+ { USB_DEVICE(0x1b75, 0x3072) },
|
||||
/* Para */
|
||||
{ USB_DEVICE(0x20b8, 0x8888) },
|
||||
/* Pegatron */
|
||||
+ { USB_DEVICE(0x1d4d, 0x0002) },
|
||||
{ USB_DEVICE(0x1d4d, 0x000c) },
|
||||
{ USB_DEVICE(0x1d4d, 0x000e) },
|
||||
{ USB_DEVICE(0x1d4d, 0x0011) },
|
||||
@@ -1055,7 +1065,9 @@ static struct usb_device_id rt2800usb_device_table[] = {
|
||||
/* Sparklan */
|
||||
{ USB_DEVICE(0x15a9, 0x0006) },
|
||||
/* Sweex */
|
||||
+ { USB_DEVICE(0x177f, 0x0153) },
|
||||
{ USB_DEVICE(0x177f, 0x0302) },
|
||||
+ { USB_DEVICE(0x177f, 0x0313) },
|
||||
/* U-Media */
|
||||
{ USB_DEVICE(0x157e, 0x300e) },
|
||||
{ USB_DEVICE(0x157e, 0x3013) },
|
||||
@@ -1139,25 +1151,20 @@ static struct usb_device_id rt2800usb_device_table[] = {
|
||||
{ USB_DEVICE(0x13d3, 0x3322) },
|
||||
/* Belkin */
|
||||
{ USB_DEVICE(0x050d, 0x1003) },
|
||||
- { USB_DEVICE(0x050d, 0x825a) },
|
||||
/* Buffalo */
|
||||
{ USB_DEVICE(0x0411, 0x012e) },
|
||||
{ USB_DEVICE(0x0411, 0x0148) },
|
||||
{ USB_DEVICE(0x0411, 0x0150) },
|
||||
- { USB_DEVICE(0x0411, 0x015d) },
|
||||
/* Corega */
|
||||
{ USB_DEVICE(0x07aa, 0x0041) },
|
||||
{ USB_DEVICE(0x07aa, 0x0042) },
|
||||
{ USB_DEVICE(0x18c5, 0x0008) },
|
||||
/* D-Link */
|
||||
{ USB_DEVICE(0x07d1, 0x3c0b) },
|
||||
- { USB_DEVICE(0x07d1, 0x3c13) },
|
||||
- { USB_DEVICE(0x07d1, 0x3c15) },
|
||||
{ USB_DEVICE(0x07d1, 0x3c17) },
|
||||
{ USB_DEVICE(0x2001, 0x3c17) },
|
||||
/* Edimax */
|
||||
{ USB_DEVICE(0x7392, 0x4085) },
|
||||
- { USB_DEVICE(0x7392, 0x7722) },
|
||||
/* Encore */
|
||||
{ USB_DEVICE(0x203d, 0x14a1) },
|
||||
/* Fujitsu Stylistic 550 */
|
||||
@@ -1173,19 +1180,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
|
||||
/* LevelOne */
|
||||
{ USB_DEVICE(0x1740, 0x0605) },
|
||||
{ USB_DEVICE(0x1740, 0x0615) },
|
||||
- /* Linksys */
|
||||
- { USB_DEVICE(0x1737, 0x0078) },
|
||||
/* Logitec */
|
||||
{ USB_DEVICE(0x0789, 0x0168) },
|
||||
{ USB_DEVICE(0x0789, 0x0169) },
|
||||
/* Motorola */
|
||||
{ USB_DEVICE(0x100d, 0x9032) },
|
||||
- /* Ovislink */
|
||||
- { USB_DEVICE(0x1b75, 0x3071) },
|
||||
- { USB_DEVICE(0x1b75, 0x3072) },
|
||||
/* Pegatron */
|
||||
{ USB_DEVICE(0x05a6, 0x0101) },
|
||||
- { USB_DEVICE(0x1d4d, 0x0002) },
|
||||
{ USB_DEVICE(0x1d4d, 0x0010) },
|
||||
/* Planex */
|
||||
{ USB_DEVICE(0x2019, 0x5201) },
|
||||
@@ -1204,9 +1205,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
|
||||
{ USB_DEVICE(0x083a, 0xc522) },
|
||||
{ USB_DEVICE(0x083a, 0xd522) },
|
||||
{ USB_DEVICE(0x083a, 0xf511) },
|
||||
- /* Sweex */
|
||||
- { USB_DEVICE(0x177f, 0x0153) },
|
||||
- { USB_DEVICE(0x177f, 0x0313) },
|
||||
/* Zyxel */
|
||||
{ USB_DEVICE(0x0586, 0x341a) },
|
||||
#endif
|
||||
--
|
||||
1.7.10
|
||||
|
||||
|
|
@ -10,17 +10,18 @@ Cc: Matthew Garrett <mjg@redhat.com>
|
|||
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
|
||||
Link: http://lkml.kernel.org/r/1318848017-12301-1-git-send-email-matt@console-pimps.org
|
||||
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
|
||||
[bwh: Adjust context to apply after commit
|
||||
3a91135a4b1720f83810399e596937598b38b158 'efi: Add new variable attributes'
|
||||
in 3.2.17]
|
||||
---
|
||||
include/linux/efi.h | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
diff --git a/include/linux/efi.h b/include/linux/efi.h
|
||||
index e46d771..d407c88 100644
|
||||
--- a/include/linux/efi.h
|
||||
+++ b/include/linux/efi.h
|
||||
@@ -472,6 +472,13 @@ extern int __init efi_setup_pcdp_console(char *);
|
||||
#define EFI_VARIABLE_RUNTIME_ACCESS 0x0000000000000004
|
||||
|
||||
EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | \
|
||||
EFI_VARIABLE_APPEND_WRITE)
|
||||
/*
|
||||
+ * The type of search to perform when calling boottime->locate_handle
|
||||
+ */
|
||||
|
|
@ -32,6 +33,3 @@ index e46d771..d407c88 100644
|
|||
* EFI Device Path information
|
||||
*/
|
||||
#define EFI_DEV_HW 0x01
|
||||
--
|
||||
1.7.10
|
||||
|
||||
|
|
|
|||
|
|
@ -78,13 +78,11 @@
|
|||
+ features/all/fs-hardlink-creation-restrictions.patch
|
||||
+ features/all/fs-hardlink-creation-restrictions-fix.patch
|
||||
+ features/all/fs-hardlink-creation-restriction-cleanup.patch
|
||||
+ bugfix/all/Don-t-limit-non-nested-epoll-paths.patch
|
||||
+ bugfix/all/kbuild-do-not-check-for-ancient-modutils-tools.patch
|
||||
|
||||
# Temporary, until the original change has been tested some more
|
||||
+ debian/revert-CIFS-Respect-negotiated-MaxMpxCount.patch
|
||||
|
||||
+ bugfix/all/net-fix-proc-net-dev-regression.patch
|
||||
+ bugfix/arm/ARM-orion5x-Fix-GPIO-enable-bits-for-MPP9.patch
|
||||
|
||||
# Update all Hyper-V drivers to 3.4-rc1 (no longer staging)
|
||||
|
|
@ -166,8 +164,6 @@
|
|||
+ features/x86/hyperv/0076-net-hyperv-Fix-the-code-handling-tx-busy.patch
|
||||
+ features/x86/hyperv/0077-hv-remove-the-second-argument-of-k-un-map_atomic.patch
|
||||
|
||||
+ features/all/rt2x00-Identify-rt2800usb-chipsets.patch
|
||||
|
||||
+ features/x86/efi-stub/0001-x86-Add-missing-bzImage-fields-to-struct-setup_heade.patch
|
||||
+ features/x86/efi-stub/0002-x86-Don-t-use-magic-strings-for-EFI-loader-signature.patch
|
||||
+ features/x86/efi-stub/0003-efi.h-Add-struct-definition-for-boot-time-services.patch
|
||||
|
|
@ -188,11 +184,6 @@
|
|||
|
||||
+ bugfix/all/brcmsmac-INTERMEDIATE-but-not-AMPDU-only-when-tracin.patch
|
||||
+ bugfix/all/NFSv4-Rate-limit-the-state-manager-for-lock-reclaim-.patch
|
||||
+ bugfix/all/NFSv4-Ensure-that-the-LOCK-code-sets-exception-inode.patch
|
||||
+ bugfix/all/NFSv4-Ensure-that-we-check-lock-exclusive-shared-typ.patch
|
||||
+ bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_execbuffer2.patch
|
||||
+ bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_do_execbuffer.patch
|
||||
+ bugfix/all/revert-autofs-work-around-unhappy-compat-problem-on-.patch
|
||||
|
||||
# Temporary, until the next ABI bump
|
||||
+ debian/revert-rtc-Provide-flag-for-rtc-devices-that-don-t-s.patch
|
||||
|
|
|
|||
Loading…
Reference in New Issue