-stable review
Subsystems (11)
cover -stable review
This is the start of the stable review cycle for the 2.6.13.1 release. There are 9 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let us know. If anyone is a maintainer of the proper subsystem, and wants to add a signed-off-by: line to the patch, please respond with it.
These patches are sent out with a number of different people on the
Cc: line. If you wish to be a reviewer, please email [email protected] to add your name to the list. If you want to be off the reviewer list, also email us.
Responses should be made by Sat Sep 8 01:00 2005 UTC. Anything received after that time, might be too late.
thanks,
the -stable release team
--
PATCH 1/9 Kconfig: saa7134-dvb must select tda1004x
-stable review patch. If anyone has any objections, please let us know.
------------------
I wish I had seen this before 2.6.13 was released... I guess this only goes to show that there haven't been any testers using saa7134-hybrid dvb/v4l boards that depend on the tda1004x module, during the 2.6.13-rc series :-(
Please apply this to 2.6.14, and also to 2.6.13.1 -stable. Without this patch, users will have to EXPLICITLY select tda1004x in Kconfig. This SHOULD be done automatically when saa7134-dvb is selected. This patch corrects this problem.
saa7134-dvb must select tda1004x
--- drivers/media/video/Kconfig | 1 + 1 files changed, 1 insertion(+)
drivers/media/video/Kconfig +1 -0
@@ -254,6 +254,7 @@ config VIDEO_SAA7134_DVB select VIDEO_BUF_DVB select DVB_MT352 select DVB_CX22702 + select DVB_TDA1004X ---help--- This adds support for DVB cards based on the Philips saa7134 chip.
--
PATCH 2/9 aacraid: 2.6.13 aacraid bad BUG_ON fix
In reply to Chris Wright-stable review patch. If anyone has any objections, please let us know.
------------------
This was noticed by Doug Bazamic and the fix found by Mark Salyzyn at Adaptec.
There was an error in the BUG_ON() statement that validated the calculated fib size which can cause the driver to panic.
--- drivers/scsi/aacraid/aachba.c | 2 +- 1 files changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/aacraid/aachba.c +1 -1
@@ -968,7 +968,7 @@ static int aac_read(struct scsi_cmnd * s fibsize =sizeof (struct aac_read64 ) + ((le32_to_cpu (readcmd->sg.count) -1 ) *sizeof (struct sgentry64 )); -BUG_ON (fibsize > (sizeof (struct hw_fib ) - +BUG_ON (fibsize > (dev->max_fib_size -sizeof (struct aac_fibhdr )));/* * Now send the Fib to the adapter
--
PATCH 3/9 Fix PCI ROM mapping
In reply to Chris Wright-stable review patch. If anyone has any objections, please let us know.
------------------
This fixes a problem with pci_map_rom() which doesn't properly update the ROM BAR value with the address thas allocated for it by the PCI code. This problem, among other, breaks boot on Mac laptops.
It'ss a new version based on Linus latest one with better error checking.
--- drivers/pci/rom.c | 24 +++++++++++++++++------- 1 files changed, 17 insertions(+), 7 deletions(-)
drivers/pci/rom.c +17 -7
@@ -21,13 +21,21 @@* between the ROM and other resources, so enabling it may disable access * to MMIO registers or other card memory. */ -static void pci_enable_rom (struct pci_dev *pdev) +static int pci_enable_rom (struct pci_dev *pdev) { +struct resource *res = pdev->resource +PCI_ROM_RESOURCE ; +struct pci_bus_region region;u32 rom_addr; +if (!res->flags) +return -1 ; + +pcibios_resource_to_bus (pdev, ®ion, res);pci_read_config_dword (pdev, pdev->rom_base_reg, &rom_addr); - rom_addr |=PCI_ROM_ADDRESS_ENABLE ; + rom_addr &= ~PCI_ROM_ADDRESS_MASK ; + rom_addr |= region.start |PCI_ROM_ADDRESS_ENABLE ;pci_write_config_dword (pdev, pdev->rom_base_reg, rom_addr); +return 0 ; }/**
@@ -71,19 +79,21 @@ void __iomem *pci_map_rom(struct pci_dev }else {if (res->flags &IORESOURCE_ROM_COPY ) { *size =pci_resource_len (pdev,PCI_ROM_RESOURCE ); -return (void __iomem *)pci_resource_start (pdev,PCI_ROM_RESOURCE ); +return (void __iomem *)pci_resource_start (pdev, +PCI_ROM_RESOURCE ); }else {/* assign the ROM an address if it doesn't have one */ -if (res->parent ==NULL ) -pci_assign_resource (pdev,PCI_ROM_RESOURCE ); - +if (res->parent ==NULL && +pci_assign_resource (pdev,PCI_ROM_RESOURCE )) +return NULL ; start =pci_resource_start (pdev,PCI_ROM_RESOURCE ); *size =pci_resource_len (pdev,PCI_ROM_RESOURCE );if (*size ==0 )return NULL ;/* Enable ROM space decodes */ -pci_enable_rom (pdev); +if (pci_enable_rom (pdev)) +return NULL ; } }
--
PATCH 4/9 x86: pci_assign_unassigned_resources() update
In reply to Chris Wright-stable review patch. If anyone has any objections, please let us know.
------------------
I had some time to think about PCI assign issues in 2.6.13-rc series.
The major problem here is that we call pci_assign_unassigned_resources() way too early - at subsys_initcall level. Therefore we give no chances to ACPI and PnP routines (called at fs_initcall level) to reserve their respective resources properly, as the comments in drivers/pnp/system.c and drivers/acpi/motherboard.c suggest:
/**
* Reserve motherboard resources after PCI claim BARs,
* but before PCI assign resources for uninitialized PCI devices */
So I moved the pci_assign_unassigned_resources() call to pcibios_assign_resources() (fs_initcall), which should hopefully fix a lot of problems and make PCIBIOS_MIN_IO tweaks unnecessary.
Other changes:
- remove resource assignment code from pcibios_assign_resources(), since it duplicates pci_assign_unassigned_resources() functionality and actually does nothing in 2.6.13;
- modify ROM assignment code as per Ben's suggestion: try to use firmware settings by default (if PCI_ASSIGN_ROMS is not set);
- set CARDBUS_IO_SIZE back to 4K as it's a wonderful stress test for various setups.
Confirmed by Tero Roponen <[email protected]> (who had problems with the 4kB CardBus IO size previously).
--- arch/i386/pci/common.c | 1 arch/i386/pci/i386.c | 49 +++++++++++++++--------------------------------- drivers/pci/setup-bus.c | 2 - 3 files changed, 17 insertions(+), 35 deletions(-)
arch/i386/pci/common.c +0 -1
@@ -165,7 +165,6 @@ static int __init pcibios_init(void)if ((pci_probe &PCI_BIOS_SORT ) && !(pci_probe &PCI_NO_SORT ))pcibios_sort ();#endif -pci_assign_unassigned_resources ();return 0 ; }
arch/i386/pci/i386.c +16 -33
59 lines not on this page · raw message
drivers/pci/setup-bus.c +1 -1
@@ -40,7 +40,7 @@* FIXME: IO should be max 256 bytes. However, since we may * have a P2P bridge below a cardbus bridge, we need 4K. */ -#define CARDBUS_IO_SIZE (256) +#define CARDBUS_IO_SIZE (4*1024)#define CARDBUS_MEM_SIZE (32*1024*1024) static void __devinit
--
PATCH 5/9 : 2.6.13 breaks libpcap (and tcpdump)
In reply to Chris Wright-stable review patch. If anyone has any objections, please let us know.
------------------
[NET]: 2.6.13 breaks libpcap (and tcpdump)
Patrick McHardy says:
Never mind, I got it, we never fall through to the second switch statement anymore. I think we could simply break when load_pointer returns NULL. The switch statement will fall through to the default case and return 0 for all cases but 0 > k >= SKF_AD_OFF.
Here's a patch to do just that.
I left BPF_MSH alone because it's really a hack to calculate the IP header length, which makes no sense when applied to the special data.
--- net/core/filter.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)
net/core/filter.c +3 -3
@@ -182,7 +182,7 @@ int sk_run_filter(struct sk_buff *skb, sA =ntohl (*(u32 *)ptr);continue ; } -return 0 ; +break ;case BPF_LD |BPF_H |BPF_ABS : k = fentry->k; load_h:
@@ -191,7 +191,7 @@ int sk_run_filter(struct sk_buff *skb, sA =ntohs (*(u16 *)ptr);continue ; } -return 0 ; +break ;case BPF_LD |BPF_B |BPF_ABS : k = fentry->k; load_b:
@@ -200,7 +200,7 @@ load_b:A = *(u8 *)ptr;continue ; } -return 0 ; +break ;case BPF_LD |BPF_W |BPF_LEN :A = skb->len;continue ;
--
PATCH 6/9 Fix boundary check in standard multi-block cipher processors
In reply to Chris Wright-stable review patch. If anyone has any objections, please let us know.
------------------
[CRYPTO] Fix boundary check in standard multi-block cipher processors
Fixes Bug 5194 (IPSec related Oops in 2.6.13).
The boundary check in the standard multi-block cipher processors are broken when nbytes is not a multiple of bsize. In those cases it will always process an extra block.
This patch corrects the check so that it processes at most nbytes of data.
--- crypto/cipher.c | 12 +++++++++--- 1 files changed, 9 insertions(+), 3 deletions(-)
crypto/cipher.c +9 -3
@@ -191,6 +191,8 @@ static unsigned int cbc_process_encrypt(u8 *iv = desc->info;unsigned int done =0 ; + nbytes -= bsize; + do { xor(iv, src); fn(crypto_tfm_ctx(tfm), dst, iv);
@@ -198,7 +200,7 @@ static unsigned int cbc_process_encrypt( src += bsize; dst += bsize; - }while ((done += bsize) < nbytes); + }while ((done += bsize) <= nbytes);return done; }
@@ -219,6 +221,8 @@ static unsigned int cbc_process_decrypt(u8 *iv = desc->info;unsigned int done =0 ; + nbytes -= bsize; + do { u8 *tmp_dst = *dst_p;
@@ -230,7 +234,7 @@ static unsigned int cbc_process_decrypt( src += bsize; dst += bsize; - }while ((done += bsize) < nbytes); + }while ((done += bsize) <= nbytes);return done; }
@@ -243,12 +247,14 @@ static unsigned int ecb_process(const stvoid (*fn)(void *,u8 *,const u8 *) = desc->crfn;unsigned int done =0 ; + nbytes -= bsize; +do {fn (crypto_tfm_ctx (tfm), dst, src); src += bsize; dst += bsize; - }while ((done += bsize) < nbytes); + }while ((done += bsize) <= nbytes);return done; }
--
PATCH 7/9 : Use SA_SHIRQ in sparc specific code.
In reply to Chris Wright-stable review patch. If anyone has any objections, please let us know.
------------------
Based upon a report from Jason Wever.
--- drivers/char/rtc.c | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-)
drivers/char/rtc.c +2 -3
@@ -938,10 +938,9 @@ found:/* * XXX Interrupt pin #7 in Espresso is shared between RTC and -* PCI Slot 2 INTA# (and some INTx# in Slot 1). SA_INTERRUPT here -* is asking for trouble with add-on boards. Change to SA_SHIRQ. +* PCI Slot 2 INTA# (and some INTx# in Slot 1). */ -if (request_irq (rtc_irq, rtc_interrupt,SA_INTERRUPT ,"rtc" , (void *)&rtc_port)) { +if (request_irq (rtc_irq, rtc_interrupt,SA_SHIRQ ,"rtc" , (void *)&rtc_port)) {/* * Standard way for sparc to print irq's is to use * __irq_itoa(). I think for EBus it's ok to use %d.
--
PATCH 8/9 : Reassembly trim not clearing CHECKSUM_HW
In reply to Chris Wright-stable review patch. If anyone has any objections, please let us know.
------------------
[IPV4]: Reassembly trim not clearing CHECKSUM_HW
This was found by inspection while looking for checksum problems with the skge driver that sets CHECKSUM_HW. It did not fix the problem, but it looks like it is needed.
If IP reassembly is trimming an overlapping fragment, it should reset (or adjust) the hardware checksum flag on the skb.
--- net/ipv4/ip_fragment.c | 2 +- 1 files changed, 1 insertion(+), 1 deletion(-)
net/ipv4/ip_fragment.c +1 -1
@@ -457,7 +457,7 @@ static void ip_frag_queue(struct ipq *qpif (pskb_pull (skb, ihl) ==NULL ) goto err; -if (pskb_trim (skb, end-offset)) +if (pskb_trim_rcsum (skb, end-offset)) goto err;/* Find out which fragments are in front and at the back of us
--
PATCH 9/9 32bit sendmsg() flaw (CAN-2005-2490)
In reply to Chris Wright-stable review patch. If anyone has any objections, please let us know.
------------------
When we copy 32bit ->msg_control contents to kernel, we walk the same userland data twice without sanity checks on the second pass.
Second version of this patch: the original broke with 64-bit arches running 32-bit-compat-mode executables doing sendmsg() syscalls with unaligned CMSG data areas
Another thing is that we use kmalloc() to allocate and sock_kfree_s() to free afterwards; less serious, but also needs fixing.
Patch by Al Viro, David Miller, David Woodhouse
--- include/net/compat.h | 2 +- net/compat.c | 44 ++++++++++++++++++++++++++------------------ net/socket.c | 3 ++- 3 files changed, 29 insertions(+), 20 deletions(-)
include/net/compat.h +1 -1
@@ -33,7 +33,7 @@ extern asmlinkage long compat_sys_sendmsextern asmlinkage long compat_sys_recvmsg (int ,struct compat_msghdr __user *,unsigned );extern asmlinkage long compat_sys_getsockopt (int ,int ,int ,char __user *,int __user *);extern int put_cmsg_compat (struct msghdr *,int ,int ,int ,void *); -extern int cmsghdr_from_user_compat_to_kern (struct msghdr *,unsigned char *, +extern int cmsghdr_from_user_compat_to_kern (struct msghdr *,struct sock *,unsigned char *,int );#endif /* NET_COMPAT_H */
net/compat.c +26 -18
85 lines not on this page · raw message
net/socket.c +2 -1
@@ -1739,10 +1739,11 @@ asmlinkage long sys_sendmsg(int fd, stru goto out_freeiov; ctl_len = msg_sys.msg_controllen;if ((MSG_CMSG_COMPAT & flags) && ctl_len) { - err =cmsghdr_from_user_compat_to_kern (&msg_sys, ctl,sizeof (ctl)); + err =cmsghdr_from_user_compat_to_kern (&msg_sys, sock->sk, ctl,sizeof (ctl));if (err) goto out_freeiov; ctl_buf = msg_sys.msg_control; + ctl_len = msg_sys.msg_controllen; }else if (ctl_len) {if (ctl_len >sizeof (ctl)) {
--
Re: [PATCH 9/9] [PATCH] 32bit sendmsg() flaw (CAN-2005-2490)
* Chris Wright ([email protected]) wrote:
Minor update from David Miller for clean sparc64 build.
include/net/compat.h +3 -2
@@ -33,7 +33,8 @@ extern asmlinkage long compat_sys_sendmsextern asmlinkage long compat_sys_recvmsg (int ,struct compat_msghdr __user *,unsigned );extern asmlinkage long compat_sys_getsockopt (int ,int ,int ,char __user *,int __user *);extern int put_cmsg_compat (struct msghdr *,int ,int ,int ,void *); -extern int cmsghdr_from_user_compat_to_kern (struct msghdr *,struct sock *,unsigned char *, -int ); + +struct sock ; +extern int cmsghdr_from_user_compat_to_kern (struct msghdr *,struct sock *,unsigned char *,int );#endif /* NET_COMPAT_H */
Full updated patch
------
When we copy 32bit ->msg_control contents to kernel, we walk the same userland data twice without sanity checks on the second pass.
Second version of this patch: the original broke with 64-bit arches running 32-bit-compat-mode executables doing sendmsg() syscalls with unaligned CMSG data areas
Another thing is that we use kmalloc() to allocate and sock_kfree_s() to free afterwards; less serious, but also needs fixing.
Patch by Al Viro, David Miller, David Woodhouse
(sparc64 clean compile fix from David Miller)
--- include/net/compat.h | 5 +++-- net/compat.c | 44 ++++++++++++++++++++++++++------------------ net/socket.c | 3 ++- 3 files changed, 31 insertions(+), 21 deletions(-)
include/net/compat.h +3 -2
@@ -33,7 +33,8 @@ extern asmlinkage long compat_sys_sendmsextern asmlinkage long compat_sys_recvmsg (int ,struct compat_msghdr __user *,unsigned );extern asmlinkage long compat_sys_getsockopt (int ,int ,int ,char __user *,int __user *);extern int put_cmsg_compat (struct msghdr *,int ,int ,int ,void *); -extern int cmsghdr_from_user_compat_to_kern (struct msghdr *,unsigned char *, -int ); + +struct sock ; +extern int cmsghdr_from_user_compat_to_kern (struct msghdr *,struct sock *,unsigned char *,int );#endif /* NET_COMPAT_H */
net/compat.c +26 -18
85 lines not on this page · raw message
net/socket.c +2 -1
@@ -1739,10 +1739,11 @@ asmlinkage long sys_sendmsg(int fd, stru goto out_freeiov; ctl_len = msg_sys.msg_controllen;if ((MSG_CMSG_COMPAT & flags) && ctl_len) { - err =cmsghdr_from_user_compat_to_kern (&msg_sys, ctl,sizeof (ctl)); + err =cmsghdr_from_user_compat_to_kern (&msg_sys, sock->sk, ctl,sizeof (ctl));if (err) goto out_freeiov; ctl_buf = msg_sys.msg_control; + ctl_len = msg_sys.msg_controllen; }else if (ctl_len) {if (ctl_len >sizeof (ctl)) {
[PATCH 10/9] raw_sendmsg DoS (CAN-2005-2492)
In reply to Chris WrightI missed this one when launching review cycle, thanks to Mark Cox for catching oversight.
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Al Viro <[email protected]>
Fix unchecked __get_user that could be tricked into generating a memory read on an arbitrary address. The result of the read is not returned directly but you may be able to divine some information about it, or use the read to cause a crash on some architectures by reading hardware state. CAN-2005-2492.
Fix from Al Viro, ack from Dave Miller.
--- net/ipv4/raw.c | 2 +- net/ipv6/raw.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/ipv4/raw.c +1 -1
@@ -358,7 +358,7 @@ static void raw_probe_proto_opt(struct fif (type && code) {get_user (fl->fl_icmp_type, type); -__get_user (fl->fl_icmp_code, code); +get_user (fl->fl_icmp_code, code); probed =1 ; }break ;
net/ipv6/raw.c +1 -1
@@ -619,7 +619,7 @@ static void rawv6_probe_proto_opt(structif (type && code) {get_user (fl->fl_icmp_type, type); -__get_user (fl->fl_icmp_code, code); +get_user (fl->fl_icmp_code, code); probed =1 ; }break ;
Quoted 5 lines · Chris Wright
This is the start of the stable review cycle for the 2.6.13.1 release. There are 9 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let us know. If anyone is a maintainer of the proper subsystem, and wants to add a signed-off-by: line to the patch, please respond with it.
*snip*
I didn't see the patch from Ivan Kokshaysky ( http://marc.theaimsgroup.com/?l=linux-kernel&m=112541348008047&w=2 ) included.. Without this one my laptop will freeze and die when inserting a something into the cardbus slot, so I would say that it would kind of fit in there.
Any reason why it's not included?
--
Henrik
* Henrik Persson ([email protected]) wrote:
*
Quoted 7 lines
I didn't see the patch from Ivan Kokshaysky (
http://marc.theaimsgroup.com/?l=linux-kernel&m=112541348008047&w=2 ) included.. Without this one my laptop will freeze and die when inserting a something into the cardbus slot, so I would say that it would kind of fit in there.Any reason why it's not included?
It's in there, number 4 in the series.
thanks,
-chris