Merge branch 'master' into rawhide/user/myoung/xendom0
Conflicts: kernel.spec
This commit is contained in:
Michael Young
commit
ddb95b3a12
|
|
@ -0,0 +1,42 @@
|
|||
bridge: Fix mglist corruption that leads to memory corruption
|
||||
|
||||
The list mp->mglist is used to indicate whether a multicast group
|
||||
is active on the bridge interface itself as opposed to one of the
|
||||
constituent interfaces in the bridge.
|
||||
|
||||
Unfortunately the operation that adds the mp->mglist node to the
|
||||
list neglected to check whether it has already been added. This
|
||||
leads to list corruption in the form of nodes pointing to itself.
|
||||
|
||||
Normally this would be quite obvious as it would cause an infinite
|
||||
loop when walking the list. However, as this list is never actually
|
||||
walked (which means that we don't really need it, I'll get rid of
|
||||
it in a subsequent patch), this instead is hidden until we perform
|
||||
a delete operation on the affected nodes.
|
||||
|
||||
As the same node may now be pointed to by more than one node, the
|
||||
delete operations can then cause modification of freed memory.
|
||||
|
||||
This was observed in practice to cause corruption in 512-byte slabs,
|
||||
most commonly leading to crashes in jbd2.
|
||||
|
||||
Thanks to Josef Bacik for pointing me in the right direction.
|
||||
|
||||
Reported-by: Ian Page Hands <ihands@redhat.com>
|
||||
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
||||
|
||||
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
|
||||
index f701a21..802d3f8 100644
|
||||
--- a/net/bridge/br_multicast.c
|
||||
+++ b/net/bridge/br_multicast.c
|
||||
@@ -719,7 +719,8 @@ static int br_multicast_add_group(struct net_bridge *br,
|
||||
goto err;
|
||||
|
||||
if (!port) {
|
||||
- hlist_add_head(&mp->mglist, &br->mglist);
|
||||
+ if (hlist_unhashed(&mp->mglist))
|
||||
+ hlist_add_head(&mp->mglist, &br->mglist);
|
||||
mod_timer(&mp->timer, now + br->multicast_membership_interval);
|
||||
goto out;
|
||||
}
|
||||
|
||||
|
|
@ -435,7 +435,7 @@ CONFIG_VIRTIO_BALLOON=m
|
|||
CONFIG_VIRTIO_NET=m
|
||||
CONFIG_VMXNET3=m
|
||||
CONFIG_HW_RANDOM_VIRTIO=m
|
||||
CONFIG_VIRTIO_CONSOLE=m
|
||||
CONFIG_VIRTIO_CONSOLE=y
|
||||
CONFIG_VHOST_NET=m
|
||||
|
||||
#
|
||||
|
|
|
|||
44
kernel.spec
44
kernel.spec
|
|
@ -83,9 +83,9 @@ Summary: The Linux kernel
|
|||
# The next upstream release sublevel (base_sublevel+1)
|
||||
%define upstream_sublevel %(echo $((%{base_sublevel} + 1)))
|
||||
# The rc snapshot level
|
||||
%define rcrev 4
|
||||
%define rcrev 5
|
||||
# The git snapshot level
|
||||
%define gitrev 3
|
||||
%define gitrev 0
|
||||
# Set rpm version accordingly
|
||||
%define rpmversion 2.6.%{upstream_sublevel}
|
||||
%endif
|
||||
|
|
@ -739,6 +739,14 @@ Patch12421: fs-call-security_d_instantiate-in-d_obtain_alias.patch
|
|||
|
||||
Patch12438: ath5k-fix-fast-channel-change.patch
|
||||
|
||||
Patch12440: bridge-fix-mglist-corruption-that-leads-to-memory-corruption.patch
|
||||
|
||||
# rhbz#676860
|
||||
Patch12441: usb-sierra-add-airprime-direct-ip.patch
|
||||
|
||||
# rhbz#672265
|
||||
Patch12442: revert-block-check-bdev-readonly.patch
|
||||
|
||||
# Xen patches
|
||||
# git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen.git branches
|
||||
#Patch20000: xen.next-2.6.38.patch
|
||||
|
|
@ -1364,6 +1372,14 @@ ApplyPatch fs-call-security_d_instantiate-in-d_obtain_alias.patch
|
|||
# rhbz#672778
|
||||
ApplyPatch ath5k-fix-fast-channel-change.patch
|
||||
|
||||
ApplyPatch bridge-fix-mglist-corruption-that-leads-to-memory-corruption.patch
|
||||
|
||||
# rhbz#676860
|
||||
ApplyPatch usb-sierra-add-airprime-direct-ip.patch
|
||||
|
||||
# rhbz#672265
|
||||
ApplyPatch revert-block-check-bdev-readonly.patch
|
||||
|
||||
# Xen patches
|
||||
#ApplyPatch xen.next-2.6.38.patch
|
||||
#ApplyPatch xen.upstream.core.patch
|
||||
|
|
@ -1973,16 +1989,22 @@ fi
|
|||
# plz don't put in a version string unless you're going to tag
|
||||
# and build.
|
||||
|
||||
# ___________________________________________________________
|
||||
# / This branch is for Fedora 15. You probably want to commit \
|
||||
# \ to the F-14 branch instead, or in addition to this one. /
|
||||
# -----------------------------------------------------------
|
||||
# \ ^__^
|
||||
# \ (@@)\_______
|
||||
# (__)\ )\/\
|
||||
# ||----w |
|
||||
# || ||
|
||||
%changelog
|
||||
* Wed Feb 16 2011 Chuck Ebbert <cebbert@redhat.com>
|
||||
- Add support for Airprime/Sierra USB IP modem (#676860)
|
||||
- Make virtio_console built-in on x86_64 (#677713)
|
||||
- Revert check for read-only block device added in .38 (#672265)
|
||||
|
||||
* Tue Feb 15 2011 Kyle McMartin <kmcmartin@redhat.com> 2.6.38-0.rc5.git0.1
|
||||
- Linux 2.6.38-rc5 (81 minutes later...)
|
||||
|
||||
* Sun Feb 13 2011 Chuck Ebbert <cebbert@redhat.com> 2.6.38-0.rc4.git7.1
|
||||
- Linux 2.6.38-rc4-git7
|
||||
|
||||
* Sat Feb 12 2011 Chuck Ebbert <cebbert@redhat.com> 2.6.38-0.rc4.git6.1
|
||||
- Linux 2.6.38-rc4-git6
|
||||
- Fix memory corruption caused by bug in bridge code.
|
||||
|
||||
* Fri Feb 11 2011 Michael Young <m.a.young@durham.ac.uk>
|
||||
- Try Konrad's devel/next-2.6.38 instead of Jeremy's xen/next-2.6.38
|
||||
which didn't boot last time
|
||||
|
|
|
|||
|
|
@ -0,0 +1,33 @@
|
|||
This reverts commit 75f1dc0d076d1c1168f2115f1941ea627d38bd5a. The revert
|
||||
could not be done automatically because changes after that commit
|
||||
altered the code too much.
|
||||
|
||||
Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
|
||||
|
||||
--- a/fs/block_dev.c
|
||||
+++ b/fs/block_dev.c
|
||||
@@ -1215,12 +1215,6 @@ int blkdev_get(struct block_device *bdev
|
||||
|
||||
res = __blkdev_get(bdev, mode, 0);
|
||||
|
||||
- /* __blkdev_get() may alter read only status, check it afterwards */
|
||||
- if (!res && (mode & FMODE_WRITE) && bdev_read_only(bdev)) {
|
||||
- __blkdev_put(bdev, mode, 0);
|
||||
- res = -EACCES;
|
||||
- }
|
||||
-
|
||||
if (whole) {
|
||||
/* finish claiming */
|
||||
mutex_lock(&bdev->bd_mutex);
|
||||
@@ -1298,6 +1292,11 @@ struct block_device *blkdev_get_by_path(
|
||||
if (err)
|
||||
return ERR_PTR(err);
|
||||
|
||||
+ if ((mode & FMODE_WRITE) && bdev_read_only(bdev)) {
|
||||
+ blkdev_put(bdev, mode);
|
||||
+ return ERR_PTR(-EACCES);
|
||||
+ }
|
||||
+
|
||||
return bdev;
|
||||
}
|
||||
EXPORT_SYMBOL(blkdev_get_by_path);
|
||||
3
sources
3
sources
|
|
@ -1,3 +1,2 @@
|
|||
c8ee37b4fdccdb651e0603d35350b434 linux-2.6.37.tar.bz2
|
||||
8b5f3778a5d7e692a909c3af38ba48d1 patch-2.6.38-rc4.bz2
|
||||
2f49110768f86c316045e56840b0a978 patch-2.6.38-rc4-git3.bz2
|
||||
1047f39477ddccf8219443bb2982c87f patch-2.6.38-rc5.bz2
|
||||
|
|
|
|||
|
|
@ -0,0 +1,30 @@
|
|||
From: Jon Thomas <jthomas@redhat.com>
|
||||
Subj: Add new ID for Airprime/Sierra USB IP modem
|
||||
|
||||
I picked up a new Sierra usb 308 (At&t Shockwave) on 2/2011 and the vendor code
|
||||
is 0x0f3d
|
||||
|
||||
Looking up vendor and product id's I see:
|
||||
|
||||
0f3d Airprime, Incorporated
|
||||
0112 CDMA 1xEVDO PC Card, PC 5220
|
||||
|
||||
Sierra and Airprime are somehow related and I'm guessing the At&t usb 308 might
|
||||
be have some common hardware with the AirPrime SL809x.
|
||||
|
||||
I patched sierra.c with this and it works.
|
||||
|
||||
Signed-off-by: Jon Thomas <jthomas@redhat.com>
|
||||
|
||||
--- a/drivers/usb/serial/sierra.c
|
||||
+++ b/drivers/usb/serial/sierra.c
|
||||
@@ -301,6 +301,9 @@ static const struct usb_device_id id_tab
|
||||
{ USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless Direct IP modems */
|
||||
.driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
|
||||
},
|
||||
+ { USB_DEVICE(0x0f3d, 0x68A3), /* Airprime/Sierra Wireless Direct IP modems */
|
||||
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
|
||||
+ },
|
||||
{ USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
|
||||
|
||||
{ }
|
||||
Loading…
Reference in New Issue