rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

linux 3.6.7

This commit is contained in:
Justin M. Forbes 2012-11-17 22:37:21 -06:00
parent d94c6eb95a
commit e7887c8a48
4 changed files with 8 additions and 128 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
kernel.spec
View File

@ -54,7 +54,7 @@ Summary: The Linux kernel
# For non-released -rc kernels, this will be appended after the rcX and
# gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
#
%global baserelease 3
%global baserelease 1
%global fedora_build %{baserelease}
# base_sublevel is the kernel version we're starting with and patching
@ -66,7 +66,7 @@ Summary: The Linux kernel
%if 0%{?released_kernel}
# Do we have a -stable update to apply?
%define stable_update 6
%define stable_update 7
# Is it a -stable RC?
%define stable_rc 0
# Set rpm version accordingly
@ -698,9 +698,6 @@ Patch22089: 0010-ext4-fix-ext_remove_space-for-punch_hole-case.patch
Patch22090: 0011-ext4-fix-ext4_flush_completed_IO-wait-semantics.patch
Patch22091: 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch
#rhbz 871923 871848 CVE-2012-4565
Patch22092: net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch
# Debug patches
Patch30000: weird-root-dentry-name-debug.patch
Patch30010: debug-808990.patch
@ -1338,9 +1335,6 @@ ApplyPatch 0010-ext4-fix-ext_remove_space-for-punch_hole-case.patch
ApplyPatch 0011-ext4-fix-ext4_flush_completed_IO-wait-semantics.patch
ApplyPatch 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch
#rhbz 871923 871848 CVE-2012-4565
ApplyPatch net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch
#rhbz 871078
ApplyPatch usb-audio-fix-crash-at-re-preparing-the-PCM-stream.patch
ApplyPatch USB-EHCI-urb-hcpriv-should-not-be-NULL.patch
@ -2055,6 +2049,9 @@ fi
# and build.
%changelog
* Sat Nov 17 2012 Justin M. Forbes <jforbes@linuxtx.org> - 3.6.7-1
- linux 3.6.7
* Fri Nov 16 2012 Josh Boyer <jwboyer@redhat.com>
- Fix oops causing typo in keyspan driver (rhbz 870562)
- Don't WARN_ON empty queues in iwlwifi (rhbz 873001)

117
net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch
View File

@ -1,117 +0,0 @@
Path: news.gmane.org!not-for-mail
From: Jesper Dangaard Brouer <brouer@redhat.com>
Newsgroups: gmane.linux.network
Subject: [net PATCH V2] net: fix divide by zero in tcp algorithm illinois
Date: Wed, 31 Oct 2012 13:45:32 +0100
Lines: 63
Approved: news@gmane.org
Message-ID: <20121031124318.30915.32293.stgit@dragon>
NNTP-Posting-Host: plane.gmane.org
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
X-Trace: ger.gmane.org 1351687472 19921 80.91.229.3 (31 Oct 2012 12:44:32 GMT)
X-Complaints-To: usenet@ger.gmane.org
NNTP-Posting-Date: Wed, 31 Oct 2012 12:44:32 +0000 (UTC)
Cc: Jesper Dangaard Brouer <brouer@redhat.com>, netdev@vger.kernel.org,
Petr Matousek <pmatouse@redhat.com>,
Stephen Hemminger <shemminger@vyatta.com>,
Eric Dumazet <eric.dumazet@gmail.com>
To: "David S. Miller" <davem@davemloft.net>
Original-X-From: netdev-owner@vger.kernel.org Wed Oct 31 13:44:40 2012
Return-path: <netdev-owner@vger.kernel.org>
Envelope-to: linux-netdev-2@plane.gmane.org
Original-Received: from vger.kernel.org ([209.132.180.67])
by plane.gmane.org with esmtp (Exim 4.69)
(envelope-from <netdev-owner@vger.kernel.org>)
id 1TTXex-0002V3-Qk
for linux-netdev-2@plane.gmane.org; Wed, 31 Oct 2012 13:44:40 +0100
Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S932565Ab2JaMo0 (ORCPT <rfc822;linux-netdev-2@m.gmane.org>);
Wed, 31 Oct 2012 08:44:26 -0400
Original-Received: from mx1.redhat.com ([209.132.183.28]:57345 "EHLO mx1.redhat.com"
rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
id S1751941Ab2JaMoZ (ORCPT <rfc822;netdev@vger.kernel.org>);
Wed, 31 Oct 2012 08:44:25 -0400
Original-Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12])
by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q9VCiOkC014655
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
Wed, 31 Oct 2012 08:44:24 -0400
Original-Received: from dragon.localdomain (ovpn-116-61.ams2.redhat.com [10.36.116.61])
by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q9VCiMuW008440;
Wed, 31 Oct 2012 08:44:23 -0400
Original-Received: from [127.0.0.1] (localhost [IPv6:::1])
by dragon.localdomain (Postfix) with ESMTP id 416D0E40666;
Wed, 31 Oct 2012 13:45:32 +0100 (CET)
User-Agent: StGIT/0.14.3
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12
Original-Sender: netdev-owner@vger.kernel.org
Precedence: bulk
List-ID: <netdev.vger.kernel.org>
X-Mailing-List: netdev@vger.kernel.org
Xref: news.gmane.org gmane.linux.network:247871
Archived-At: <http://permalink.gmane.org/gmane.linux.network/247871>
Reading TCP stats when using TCP Illinois congestion control algorithm
can cause a divide by zero kernel oops.
The division by zero occur in tcp_illinois_info() at:
do_div(t, ca->cnt_rtt);
where ca->cnt_rtt can become zero (when rtt_reset is called)
Steps to Reproduce:
1. Register tcp_illinois:
# sysctl -w net.ipv4.tcp_congestion_control=illinois
2. Monitor internal TCP information via command "ss -i"
# watch -d ss -i
3. Establish new TCP conn to machine
Either it fails at the initial conn, or else it needs to wait
for a loss or a reset.
This is only related to reading stats. The function avg_delay() also
performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its
calling point in update_params(). Thus, simply fix tcp_illinois_info().
Function tcp_illinois_info() / get_info() is called without
socket lock. Thus, eliminate any race condition on ca->cnt_rtt
by using a local stack variable. Simply reuse info.tcpv_rttcnt,
as its already set to ca->cnt_rtt.
Function avg_delay() is not affected by this race condition, as
its called with the socket lock.
Cc: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
---
V2:
Address Eric Dumazets input:
- Save 2 bytes of stack, by using info.tcpv_rttcnt.
- Help compiler, and define "u64 t" inside if() lexical scope.
net/ipv4/tcp_illinois.c | 8 +++++---
1 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index 813b43a..834857f 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
.tcpv_rttcnt = ca->cnt_rtt,
.tcpv_minrtt = ca->base_rtt,
};
- u64 t = ca->sum_rtt;
- do_div(t, ca->cnt_rtt);
- info.tcpv_rtt = t;
+ if (info.tcpv_rttcnt > 0) {
+ u64 t = ca->sum_rtt;
+ do_div(t, info.tcpv_rttcnt);
+ info.tcpv_rtt = t;
+ }
nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
}
}

2
sources
View File

@ -1,2 +1,2 @@
1a1760420eac802c541a20ab51a093d1 linux-3.6.tar.xz
11d6d8749d4612a77f43f0531c0f2824 patch-3.6.6.xz
134936c362d8812b5cafcf3c67afdce0 patch-3.6.7.xz

4
usb-audio-fix-crash-at-re-preparing-the-PCM-stream.patch
View File

@ -105,8 +105,8 @@ index 37428f7..5c12a3f 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -552,6 +552,9 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
if (snd_BUG_ON(!subs->data_endpoint))
return -EIO;
goto unlock;
}
+ snd_usb_endpoint_sync_pending_stop(subs->sync_endpoint);
+ snd_usb_endpoint_sync_pending_stop(subs->data_endpoint);