OSDN Git Service
summary |
shortlog | log |
commit |
commitdiff |
tree
first ⋅ prev ⋅ next
Patrick McHardy [Mon, 1 Aug 2005 03:17:31 +0000 (20:17 -0700)]
[NETFILTER]: Restore netfilter assumption in IPv6 multicast
Netfilter assumes that skb->data == skb->nh.ipv6h
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Mon, 1 Aug 2005 03:16:50 +0000 (20:16 -0700)]
[NETFILTER]: Fix deadlock with ip_queue/ip6_queue
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Mon, 1 Aug 2005 03:16:20 +0000 (20:16 -0700)]
[NETFILTER]: Ignore PSH on SYN/ACK in ipt_unclean
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Marcelo Tosatti [Tue, 26 Jul 2005 16:01:08 +0000 (13:01 -0300)]
Merge ... /linux/kernel/git/davem/net-2.4.git
Neil Horman [Tue, 26 Jul 2005 20:30:06 +0000 (13:30 -0700)]
[IPVS]: Close race conditions on ip_vs_conn_tab list modification
In an smp system, it is possible for an connection timer to expire, calling
ip_vs_conn_expire while the connection table is being flushed, before
ct_write_lock_bh is acquired.
Since the list iterator loop in ip_vs_con_flush releases and re-acquires the
spinlock (even though it doesn't re-enable softirqs), it is possible for the
expiration function to modify the connection list, while it is being traversed
in ip_vs_conn_flush.
The result is that the next pointer gets set to NULL, and subsequently
dereferenced, resulting in an oops.
Signed-off-by: Neil Horman <nhorman@redhat.com>
Acked-by: JulianAnastasov
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 26 Jul 2005 20:26:44 +0000 (13:26 -0700)]
[NETLINK]: Fix two socket hashing bugs.
1) netlink_release() should only decrement the hash entry
count if the socket was actually hashed.
This was causing hash->entries to underflow, which
resulting in all kinds of troubles.
On 64-bit systems, this would cause the following
conditional to erroneously trigger:
err = -ENOMEM;
if (BITS_PER_LONG > 32 && unlikely(hash->entries >= UINT_MAX))
goto err;
2) netlink_autobind() needs to propagate the error return from
netlink_insert(). Otherwise, callers will not see the error
as they should and thus try to operate on a socket with a zero pid,
which is very bad.
However, it should not propagate -EBUSY. If two threads race
to autobind the socket, that is fine. This is consistent with the
autobind behavior in other protocols.
So bug #1 above, combined with this one, resulted in hangs
on netlink_sendmsg() calls to the rtnetlink socket. We'd try
to do the user sendmsg() with the socket's pid set to zero,
later we do a socket lookup using that pid (via the value we
stashed away in NETLINK_CB(skb).pid), but that won't give us the
user socket, it will give us the rtnetlink socket. So when we
try to wake up the receive queue, we dive back into rtnetlink_rcv()
which tries to recursively take the rtnetlink semaphore.
Thanks to Jakub Jelink for providing backtraces. Also, thanks to
Herbert Xu for supplying debugging patches to help track this down,
and also finding a mistake in an earlier version of this fix.
Signed-off-by: David S. Miller <davem@davemloft.net>
Tim Yamin [Tue, 26 Jul 2005 11:15:54 +0000 (12:15 +0100)]
Merge ... /linux/kernel/git/davem/sparc-2.4.git/
rsync://rsync.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.4.git/
Jakub Bogusz [Tue, 26 Jul 2005 20:45:51 +0000 (13:45 -0700)]
[SPARC64]: fix sys32_utimes(somefile, NULL)
This patch fixes utimes(somefile, NULL) syscalls on sparc64 kernel with
32-bit userland - use of uninitialized value resulted in making random
timestamps, which confused e.g. sudo.
It has been already fixed (by davem) in linux-2.6 tree 30 months ago.
Signed-off-by: Jakub Bogusz <qboosh@pld-linux.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Tim Yamin [Tue, 26 Jul 2005 11:15:54 +0000 (12:15 +0100)]
The gzip description is as good as the ChangeLog says it is -: "Set n to
length of v, to detect improper tables" and "Don't accidentally grow j
past z". The return 2 instead of the return 0 is so that we actually
error out if we also get inproper tables (for some reason the code
returned "OK" in such cases).
Fix outstanding security bugs in the Linux zlib implementations. See:
a) http://sources.redhat.com/ml/bug-gnu-utils/1999-06/msg00183.html
b) http://bugs.gentoo.org/show_bug.cgi?id=94584
Signed-off-by: Tim Yamin <plasmaroo@gentoo.org>
Signed-off-by: Tavis Ormandy <taviso@gentoo.org>
Larry Woodman [Fri, 15 Jul 2005 15:32:08 +0000 (11:32 -0400)]
[PATCH] workaround inode cache (prune_icache/__refile_inode) SMP races
Over the past couple of weeks we have seen two races in the inode cache
code. The first is between [dispose_list()] and __refile_inode() and the
second is between prune_icache() and truncate_inodes(). I posted both of
these patches but wanted to make sure they got properly reviewed and
included in RHEL3-U6.
Fixes bug 155289.
The first scenerio is:
1.) cpu0 is in __sync_one() just about to call __refile_inode() after
taking the inode_lock and clearing I_LOCK.
spin_lock(&inode_lock);
inode->i_state &= ~I_LOCK;
if (!(inode->i_state & I_FREEING))
__refile_inode(inode);
wake_up(&inode->i_wait);
2.) cpu1 is in [dispose_list()] where it has dropped the inode_lock and calls
clear_inode(). It doesnt block because
I_LOCK is clear so it sets the inode state.
void clear_inode(struct inode *inode)
{
...
wait_on_inode(inode);
...
inode->i_state = I_CLEAR;
...
}
3.) cpu0 calls __refile_inode which places is on one of the four
possible inode lists
static inline void __refile_inode(struct inode *inode)
{
if (inode->i_state & I_DIRTY)
to = &inode->i_sb->s_dirty;
else if (atomic_read(&inode->i_count))
to = &inode_in_use;
else if (inode->i_data.nrpages)
to = &inode_unused_pagecache;
else
to = &inode_unused;
list_del(&inode->i_list);
list_add(&inode->i_list, to);
}
4.) cpu1 returns from clear_inode() then calls destroy_inode() which
kmem_cache_free()s it.
static void destroy_inode(struct inode *inode)
{
if (inode->i_sb->s_op->destroy_inode)
inode->i_sb->s_op->destroy_inode(inode);
else
kmem_cache_free(inode_cachep, inode);
}
5.) at this point we have an inode that has been kmem_cache_free()'d
that is also sitting one of the lists determined by __refile_inode(),
that cant be good!!! Also, the code looks the same in RHEL4.
The second scenerio is:
CPU0 is in prune_icache() called by kswapd and CPU1 is in
invalidate_inodes() called by the auto-mount daemon.
1.) CPU0: prune_icache() sets the I_LOCK bit in an inode on the
inode_unused_pagecache list, releases the inode_lock and calls
invalidate_inode_pages.
2.) CPU1: invalidate_inodes() calls invalidate_list() for the
inode_unused_pagecache list with the node_lock held and sets the
I_FREEING bit in the inode->i_state.
3.) CPU0: prune_icache() acquires the inode_lock and clears the I_LOCK
bit in the inode->i_state.
4.) CPU1: dispose_list() calls clear_inode() without the inode_lock
held. Since the I_LOCK bit is clear, clear_inode() sets inode->i_state =
I_CLEAR, clearing the I_FREEING bit.
5.) CPU0: prune_icache() calls __refile_inode() because clear_inode()
cleared I_FREEING without holding the inode_lock. This inode that is no
longer on the inode_unused_pagecache list which results in that inode
being placed on the inode_unused list.
6.) CPU1: dispose_list() calls destroy_inode() which kmem_cache_free()s
an inode that is also on the inode_unused list.
At this point there is an inode that has been kmem_cache_free()'d and is
also on the inode_unused list.
This patch to clear_inode() acquires the inode_lock before manipulating
the inode->i_state field. This is the only place in the kernel that
manipulates the inode without holding the inode_lock.
Alan Stern [Tue, 26 Jul 2005 18:39:54 +0000 (11:39 -0700)]
[PATCH] file_storage and UHCI bugfixes
The patch below (as547) corrects two minor errors, one in the
file_storage gadget driver (need to send a length-zero packet if a
control response is short) and one in the alternate UHCI driver (need
to set the QH bit in the frame list). Both of these are back-ports of
things that have been in 2.6 for several releases.
Alan Stern
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Pete Zaitcev [Mon, 25 Jul 2005 19:50:46 +0000 (12:50 -0700)]
[PATCH] usb: printer double up()
Doing a double up() is actually safe in Linux, but still, it's a bug.
This fix is present in 2.6.13-rc3.
By Domen Puncer <domen@coderock.org>
up(&usblp->sem) was called twice in a row in this code path.
Marcelo Tosatti [Thu, 7 Jul 2005 06:58:59 +0000 (03:58 -0300)]
Revert [NETLINK]: Fix two socket hashing bugs.
I premutarely applied this fix - its not complete yet.
Revert.
Marcelo [Mon, 4 Jul 2005 16:53:38 +0000 (13:53 -0300)]
Change VERSION to 2.4.32-pre1
Marcelo [Fri, 1 Jul 2005 15:09:04 +0000 (12:09 -0300)]
Merge ... /pub/scm/linux/kernel/git/davem/net-2.4
Andi Kleen [Thu, 30 Jun 2005 13:49:15 +0000 (15:49 +0200)]
[PATCH] x86-64: Enable Nvidia timer override workaround for SMP kernels too
>From Tymm Twillman
In the 2.4.30/31 kernels there is now a backport from the 2.6 kernels of
a workaround for buggy timer overrides in the ACPI tables for many
nvidia chipset based motherboards. Unfortunately the code for this on
x86-64 based systems is conditionally compiled in only for non-SMP
kernels. This is a patch to remove the conditional and allow the code
to be compiled in for SMP kernels as well (we've seen a number of SMP
motherboards which intermittently lock up during boot, and otherwise
sometimes seem unstable without the workaround). Patch so far has been
tested across numerous reboots and several hours uptime.
Signed-off-by: Andi Kleen <ak@suse.de>
Andi Kleen [Thu, 30 Jun 2005 13:47:48 +0000 (15:47 +0200)]
[PATCH] x86-64: Fix build with !CONFIG_SWIOTLB
Allow compilation without CONFIG_SWIOTLB
Pointed out by Tymm Twillman. I did the patch slightly differently
than his version.
Signed-off-by: Andi Kleen <ak@suse.de>
Andi Kleen [Thu, 30 Jun 2005 13:46:32 +0000 (15:46 +0200)]
[PATCH] x86_64: Disable exception stack for stack faults
Stack segment faults were executed on a exception stack. But they
use the normal return path and can schedule there, but scheduling
is not allowed on a exception stack.
Just drop the exception stack for stack segment faults. This
will make some oops triple fault now, but that's better than
allowing user triggerable oops.
Double faults still have this problem, but if they happen you
have enough other problems already that this one doesn't matter
anymore.
2.6 has a more complicated fix here that actually handles
this properly, but for 2.4 the simple version is better.
Found from RedHat QA using crashme
Signed-off-by: Andi Kleen <ak@suse.de>
Andi Kleen [Tue, 28 Jun 2005 13:18:17 +0000 (15:18 +0200)]
[PATCH] Fix canonical checking for segment registers in ptrace
Fix canonical checking for segment registers in ptrace
This avoids a local DOS where a process could oops the kernel by
passing bogus values to ptrace. Some versions of UML did this.
Found by Alexander Nyberg
Signed-off-by: Andi Kleen <ak@suse.de>
Andi Kleen [Tue, 28 Jun 2005 13:17:29 +0000 (15:17 +0200)]
[PATCH] Check for canonical addresses in ptrace
Check for canonical addresses in ptrace
This works around a AMD bug that allows to hang the CPU by passing
illegal addresses.
Signed-off-by: Andi Kleen <ak@suse.de>
Andi Kleen [Tue, 28 Jun 2005 13:16:52 +0000 (15:16 +0200)]
[PATCH] Fix buffer overflow in x86-64/ia64 32bit execve
Fix buffer overflow in x86-64/ia64 32bit execve
Originally noted by Ilja van Sprundel
I fixed it for both x86-64 and IA64. Other architectures
are not affected.
Signed-off-by: Andi Kleen <ak@suse.de>
David S. Miller [Sun, 26 Jun 2005 07:20:15 +0000 (00:20 -0700)]
[NETLINK]: Fix two socket hashing bugs.
1) netlink_release() should only decrement the hash entry
count if the socket was actually hashed.
This was causing hash->entries to underflow, which
resulting in all kinds of troubles.
On 64-bit systems, this would cause the following
conditional to erroneously trigger:
err = -ENOMEM;
if (BITS_PER_LONG > 32 && unlikely(hash->entries >= UINT_MAX))
goto err;
2) netlink_autobind() needs to propagate the error return from
netlink_insert(). Otherwise, callers will not see the error
as they should and thus try to operate on a socket with a zero pid,
which is very bad.
So bug #1 above, combined with this one, resulted in hangs
on netlink_sendmsg() calls to the rtnetlink socket. We'd try
to do the user sendmsg() with the socket's pid set to zero,
later we do a socket lookup using that pid (via the value we
stashed away in NETLINK_CB(skb).pid), but that won't give us the
user socket, it will give us the rtnetlink socket. So when we
try to wake up the receive queue, we dive back into rtnetlink_rcv()
which tries to recursively take the rtnetlink semaphore.
Thanks to Jakub Jelink for providing backtraces, and Herbert Xu for
debugging patches to help track this down.
Signed-off-by: David S. Miller <davem@davemloft.net>
Marcelo [Thu, 23 Jun 2005 00:17:43 +0000 (21:17 -0300)]
Merge ... /linux/kernel/git/davem/sparc-2.4
David S. Miller [Mon, 20 Jun 2005 03:23:14 +0000 (20:23 -0700)]
[SPARC64]: Fix cmsg length checks in Solaris emulation layer.
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Mon, 20 Jun 2005 01:28:11 +0000 (18:28 -0700)]
[SPARC64]: Fix conflicting __bzero_noasi() prototypes.
Signed-off-by: David S. Miller <davem@davemloft.net>
Ralf Baechle [Thu, 9 Jun 2005 16:18:32 +0000 (17:18 +0100)]
[PATCH] update netdev address
Change the address of netdev in 2.4 also.
H. J. Lu [Mon, 6 Jun 2005 18:51:05 +0000 (11:51 -0700)]
[PATCH] newer i386/x86_64 assemblers prohibit instructions for moving between a seg register and a 32bit location
The new i386/x86_64 assemblers no longer accept instructions for moving
between a segment register and a 32bit memory location, i.e.,
movl (%eax),%ds
movl %ds,(%eax)
To generate instructions for moving between a segment register and a
16bit memory location without the 16bit operand size prefix, 0x66,
mov (%eax),%ds
mov %ds,(%eax)
should be used. It will work with both new and old assemblers. The
assembler starting from 2.16.90.0.1 will also support
movw (%eax),%ds
movw %ds,(%eax)
without the 0x66 prefix. I am enclosing patches for 2.4 and 2.6 kernels
here. The resulting kernel binaries should be unchanged as before, with
old and new assemblers, if gcc never generates memory access for
unsigned gsindex;
asm volatile("movl %%gs,%0" : "=g" (gsindex));
If gcc does generate memory access for the code above, the upper bits
in gsindex are undefined and the new assembler doesn't allow it.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Pete Zaitcev [Sat, 4 Jun 2005 21:13:34 +0000 (14:13 -0700)]
[PATCH] USB 2.4.31: ftdi_sio fixes
These are 7 fixes that Ian Abbott sent me in 2.4.31 frame and which were
delayed while 2.4.31 stabilized.
- A big batch of new IDs, backported from 2.6; with renamed CANview
- Change the message about zero length write to warning
- Fix custom baud bases (by Rogier Wolff)
- Unregister user-specified tables, or else we oops on rmmod
- Actually initialize user-specified devices, using FT8U232AM template
- Add ID for UM100 (by Armin Laugher)
- Restore RTS and DTR after B0 (originally by Nathan Croy)
NeilBrown [Wed, 1 Jun 2005 01:20:26 +0000 (11:20 +1000)]
[PATCH] Claim i_alloc_sem while changing file size in nfsd
nfsd should hold i_alloc_sem while calling notify_change
with ATTR_SIZE set, just like do_truncate does.
From: Oleg Drokin <green@linuxhacker.ru>
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
### Diffstat output
./fs/nfsd/vfs.c | 2 ++
1 files changed, 2 insertions(+)
diff ./fs/nfsd/vfs.c~current~ ./fs/nfsd/vfs.c
NeilBrown [Wed, 1 Jun 2005 01:20:26 +0000 (11:20 +1000)]
[PATCH] Don't drop setuid on directories when ownership changed by NFSd
..as setuid means something totally different on directories.
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
diff ./fs/nfsd/vfs.c~current~ ./fs/nfsd/vfs.c
Marcel Holtmann [Wed, 13 Apr 2005 21:28:09 +0000 (23:28 +0200)]
[PATCH] Fix" introduced in 2.4.27pre2 for bluetooth hci_usb race causes kernel hang
> I have noticed a problem with a race condition fix introduced in
> 2.4.27-pre2 that causes the kernel to hang when disconnecting a
> Bluetooth USB dongle or doing 'hciconfig hci0 down'. No message is
> printed, the kernel just doesn't respond anymore.
if this works then we should do the same change in the bfusb driver. A
patch that fixes both drivers is attached.
Marcelo [Thu, 2 Jun 2005 20:44:34 +0000 (17:44 -0300)]
initial v2.4 GIT import