From 3d2b80aa7e9fc7a3188c556a397204f8df7bf355 Mon Sep 17 00:00:00 2001 From: Chuck Ebbert Date: Sat, 19 Feb 2011 10:06:55 -0500 Subject: [PATCH] Linux 2.6.38-rc5-git5 --- ...tion-that-leads-to-memory-corruption.patch | 42 ------------------- kernel.spec | 15 ++----- revert-block-check-bdev-readonly.patch | 33 --------------- sources | 2 +- 4 files changed, 5 insertions(+), 87 deletions(-) delete mode 100644 bridge-fix-mglist-corruption-that-leads-to-memory-corruption.patch delete mode 100644 revert-block-check-bdev-readonly.patch diff --git a/bridge-fix-mglist-corruption-that-leads-to-memory-corruption.patch b/bridge-fix-mglist-corruption-that-leads-to-memory-corruption.patch deleted file mode 100644 index 198a93b35..000000000 --- a/bridge-fix-mglist-corruption-that-leads-to-memory-corruption.patch +++ /dev/null @@ -1,42 +0,0 @@ -bridge: Fix mglist corruption that leads to memory corruption - -The list mp->mglist is used to indicate whether a multicast group -is active on the bridge interface itself as opposed to one of the -constituent interfaces in the bridge. - -Unfortunately the operation that adds the mp->mglist node to the -list neglected to check whether it has already been added. This -leads to list corruption in the form of nodes pointing to itself. - -Normally this would be quite obvious as it would cause an infinite -loop when walking the list. However, as this list is never actually -walked (which means that we don't really need it, I'll get rid of -it in a subsequent patch), this instead is hidden until we perform -a delete operation on the affected nodes. - -As the same node may now be pointed to by more than one node, the -delete operations can then cause modification of freed memory. - -This was observed in practice to cause corruption in 512-byte slabs, -most commonly leading to crashes in jbd2. - -Thanks to Josef Bacik for pointing me in the right direction. - -Reported-by: Ian Page Hands -Signed-off-by: Herbert Xu - -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index f701a21..802d3f8 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -719,7 +719,8 @@ static int br_multicast_add_group(struct net_bridge *br, - goto err; - - if (!port) { -- hlist_add_head(&mp->mglist, &br->mglist); -+ if (hlist_unhashed(&mp->mglist)) -+ hlist_add_head(&mp->mglist, &br->mglist); - mod_timer(&mp->timer, now + br->multicast_membership_interval); - goto out; - } - diff --git a/kernel.spec b/kernel.spec index 46607e3f3..b1256f982 100644 --- a/kernel.spec +++ b/kernel.spec @@ -84,7 +84,7 @@ Summary: The Linux kernel # The rc snapshot level %define rcrev 5 # The git snapshot level -%define gitrev 1 +%define gitrev 5 # Set rpm version accordingly %define rpmversion 2.6.%{upstream_sublevel} %endif @@ -733,14 +733,9 @@ Patch12421: fs-call-security_d_instantiate-in-d_obtain_alias.patch Patch12438: ath5k-fix-fast-channel-change.patch -Patch12440: bridge-fix-mglist-corruption-that-leads-to-memory-corruption.patch - # rhbz#676860 Patch12441: usb-sierra-add-airprime-direct-ip.patch -# rhbz#672265 -Patch12442: revert-block-check-bdev-readonly.patch - %endif BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root @@ -1356,14 +1351,9 @@ ApplyPatch fs-call-security_d_instantiate-in-d_obtain_alias.patch # rhbz#672778 ApplyPatch ath5k-fix-fast-channel-change.patch -ApplyPatch bridge-fix-mglist-corruption-that-leads-to-memory-corruption.patch - # rhbz#676860 ApplyPatch usb-sierra-add-airprime-direct-ip.patch -# rhbz#672265 -ApplyPatch revert-block-check-bdev-readonly.patch - # END OF PATCH APPLICATIONS %endif @@ -1967,6 +1957,9 @@ fi # and build. %changelog +* Sat Feb 19 2011 Chuck Ebbert 2.6.38-0.rc5.git5.1 +- Linux 2.6.38-rc5-git5 + * Wed Feb 16 2011 Chuck Ebbert 2.6.38-0.rc5.git1.1 - Linux 2.6.38-rc5-git1 - Add support for Airprime/Sierra USB IP modem (#676860) diff --git a/revert-block-check-bdev-readonly.patch b/revert-block-check-bdev-readonly.patch deleted file mode 100644 index 6227f0458..000000000 --- a/revert-block-check-bdev-readonly.patch +++ /dev/null @@ -1,33 +0,0 @@ -This reverts commit 75f1dc0d076d1c1168f2115f1941ea627d38bd5a. The revert -could not be done automatically because changes after that commit -altered the code too much. - -Signed-off-by: Chuck Ebbert - ---- a/fs/block_dev.c -+++ b/fs/block_dev.c -@@ -1215,12 +1215,6 @@ int blkdev_get(struct block_device *bdev - - res = __blkdev_get(bdev, mode, 0); - -- /* __blkdev_get() may alter read only status, check it afterwards */ -- if (!res && (mode & FMODE_WRITE) && bdev_read_only(bdev)) { -- __blkdev_put(bdev, mode, 0); -- res = -EACCES; -- } -- - if (whole) { - /* finish claiming */ - mutex_lock(&bdev->bd_mutex); -@@ -1298,6 +1292,11 @@ struct block_device *blkdev_get_by_path( - if (err) - return ERR_PTR(err); - -+ if ((mode & FMODE_WRITE) && bdev_read_only(bdev)) { -+ blkdev_put(bdev, mode); -+ return ERR_PTR(-EACCES); -+ } -+ - return bdev; - } - EXPORT_SYMBOL(blkdev_get_by_path); diff --git a/sources b/sources index a768c0c04..446dbd2ba 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ c8ee37b4fdccdb651e0603d35350b434 linux-2.6.37.tar.bz2 1047f39477ddccf8219443bb2982c87f patch-2.6.38-rc5.bz2 -e3169a111c4528759a82c5000f73ed96 patch-2.6.38-rc5-git1.bz2 +2a9b4be83199c4b90269b2fe81f55619 patch-2.6.38-rc5-git5.bz2