[linux] 02/02: Update to 3.16.7-ckt18

debian-kernel at lists.debian.org debian-kernel at lists.debian.org
Thu Oct 15 17:51:48 UTC 2015


This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch jessie
in repository linux.

commit af10a24f8168ce7bfab19fc779982656dabb0a26
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Thu Oct 15 18:50:51 2015 +0100

    Update to 3.16.7-ckt18
    
    Drop our patches that were included in it.
    Fix an ABI change in netlink.
    Revert a patch that was wrongly included in it.
---
 debian/changelog                                   |  75 ++++++-
 ...rconf-validate-new-MTU-before-applying-it.patch |  61 ------
 ...the-underlying-transport-exists-before-cr.patch |  74 -------
 ...fix-race-on-protocol-netns-initialization.patch | 227 ---------------------
 .../all/virtio-net-drop-netif_f_fraglist.patch     |  36 ----
 ...rm-orion5x-fix-legacy-orion5x-irq-numbers.patch | 115 +++++++++++
 .../netlink-fix-abi-change-in-3.16.7-ckt18.patch   |  43 ++++
 debian/patches/series                              |   6 +-
 8 files changed, 234 insertions(+), 403 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index 56aa1a8..f6c55ab 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,10 +1,83 @@
-linux (3.16.7-ckt17-2) UNRELEASED; urgency=medium
+linux (3.16.7-ckt18-1) UNRELEASED; urgency=medium
+
+  * New upstream stable update:
+    http://kernel.ubuntu.com/stable/ChangeLog-3.16.7-ckt18
+    - mac80211: enable assoc check for mesh interfaces
+    - PCI: Add VPD function 0 quirk for Intel Ethernet devices
+    - staging: comedi: usbduxsigma: don't clobber ai_timer in command test
+    - staging: comedi: usbduxsigma: don't clobber ao_timer in command test
+    - [armhf] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than
+      512 bytes
+    - [x86] KVM: MMU: fix validation of mmio page fault (regression in 3.11)
+    - iio: industrialio-buffer: Fix iio_buffer_poll return value
+      (regression in 3.13)
+    - iio: event: Remove negative error code from iio_event_poll
+      (regression in 3.13)
+    - NFSv4: don't set SETATTR for O_RDONLY|O_EXCL
+    - fs: Set the size of empty dirs to 0. (regression in 3.16.7-ckt15)
+    - [x86] staging: comedi: adl_pci7x3x: fix digital output on PCI-7230
+    - blk-mq: fix buffer overflow when reading sysfs file of 'pending'
+    - NFS: nfs_set_pgio_error sometimes misses errors
+    - NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2
+      client
+    - usb: host: ehci-sys: delete useless bus_to_hcd conversion
+    - USB: symbolserial: Use usb_get_serial_port_data (regression in 3.10)
+    - igb: Fix oops caused by missing queue pairing (regression in 3.14)
+    - eCryptfs: Invalidate dcache entries when lower i_nlink is zero
+    - libxfs: readahead of dir3 data blocks should use the read verifier
+    - xfs: Fix xfs_attr_leafblock definition
+    - [arm64] kconfig: Move LIST_POISON to a safe value
+    - Btrfs: check if previous transaction aborted to avoid fs corruption
+    - xfs: Fix file type directory corruption for btree directories
+    - [arm64] flush FP/SIMD state correctly after execve()
+    - xfs: return errors from partial I/O failures to files
+    - drm/radeon/atom: Send out the full AUX address
+    - [x86] drm/i915: Always mark the object as dirty when used by the GPU
+    - IB/uverbs: reject invalid or unknown opcodes
+    - [x86] crypto: ghash-clmulni: specify context size for ghash async
+      algorithm
+    - fs: create and use seq_show_option for escaping
+    - scsi: fix scsi_error_handler vs. scsi_host_dev_release race
+    - [x86] drm/i915: Limit the number of loops for reading a split 64bit
+      register (regression in 3.16.7-ckt16)
+    - hfs,hfsplus: cache pages correctly between bnode_create and bnode_free
+    - hfs: fix B-tree corruption after insertion at position 0
+    - [armel/versatile,armhf] Input: ambakmi - fix system PM by converting to
+      modern callbacks (regression in 3.14)
+    - svcrdma: Fix send_reply() scatter/gather set-up
+    - [x86] mm: Initialize pmd_idx in page_table_range_init_count()
+    - batman-adv: fix multicast counter when purging originators
+    - batman-adv: fix counter for multicast supporting nodes
+    - batman-adv: Fix potential synchronization issues in mcast tvlv handler
+    - batman-adv: Fix potentially broken skb network header access
+    - [powerpc/powerpc64] mm: Fix pte_pagesize_index() crash on 4K w/64K hash
+    - ath10k: fix dma_mapping_error() handling
+    - mmc: sdhci: also get preset value and driver type for MMC_DDR52
+      (regression in 3.16)
+    - IB/mlx4: Fix potential deadlock when sending mad to wire
+    - IB/mlx4: Forbid using sysfs to change RoCE pkeys
+    - IB/uverbs: Fix race between ib_uverbs_open and remove_one
+    - mmc: core: fix race condition in mmc_wait_data_done
+    - task_work: remove fifo ordering guarantee
+    - netlink, mmap: fix edge-case leakages in nf queue zero-copy
+    - md: flush ->event_work before stopping array.
+    - md/raid10: always set reshape_safe when initializing reshape_position.
+    - ext4: fix loss of delalloc extent info in ext4_zero_range()
+    - [powerpc,ppc64el] MSI: Fix race condition in tearing down MSI interrupts
+    - UBI: block: Add missing cache flushes
+    - net/ipv6: Correct PIM6 mrt_lock handling
+    - netlink, mmap: transform mmap skb into full skb on taps
+    - openvswitch: Zero flows on allocation.
+    - fib_rules: fix fib rule dumps across multiple skbs
 
   [ Aurelien Jarno ]
   * [mips*/octeon] Enable CAVIUM_CN63XXP1 (Closes: #800595)
 
   [ Ben Hutchings ]
   * nbd: Restore request timeout detection (Closes: #770479)
+  * netlink: Fix ABI change in 3.16.7-ckt18
+  * Revert "ARM: orion5x: fix legacy orion5x IRQ numbers", mistakenly
+    included in 3.16.7-ckt18
 
  -- Aurelien Jarno <aurel32 at debian.org>  Sat, 03 Oct 2015 22:32:19 +0200
 
diff --git a/debian/patches/bugfix/all/ipv6-addrconf-validate-new-MTU-before-applying-it.patch b/debian/patches/bugfix/all/ipv6-addrconf-validate-new-MTU-before-applying-it.patch
deleted file mode 100644
index 2c3cd56..0000000
--- a/debian/patches/bugfix/all/ipv6-addrconf-validate-new-MTU-before-applying-it.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From: Marcelo Leitner <mleitner at redhat.com>
-Date: Mon, 23 Feb 2015 11:17:13 -0300
-Subject: ipv6: addrconf: validate new MTU before applying it
-Origin: https://git.kernel.org/linus/77751427a1ff25b27d47a4c36b12c3c8667855ac
-
-Currently we don't check if the new MTU is valid or not and this allows
-one to configure a smaller than minimum allowed by RFCs or even bigger
-than interface own MTU, which is a problem as it may lead to packet
-drops.
-
-If you have a daemon like NetworkManager running, this may be exploited
-by remote attackers by forging RA packets with an invalid MTU, possibly
-leading to a DoS. (NetworkManager currently only validates for values
-too small, but not for too big ones.)
-
-The fix is just to make sure the new value is valid. That is, between
-IPV6_MIN_MTU and interface's MTU.
-
-Note that similar check is already performed at
-ndisc_router_discovery(), for when kernel itself parses the RA.
-
-Signed-off-by: Marcelo Ricardo Leitner <mleitner at redhat.com>
-Signed-off-by: Sabrina Dubroca <sd at queasysnail.net>
-Signed-off-by: David S. Miller <davem at davemloft.net>
----
- net/ipv6/addrconf.c | 17 ++++++++++++++++-
- 1 file changed, 16 insertions(+), 1 deletion(-)
-
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -4789,6 +4789,21 @@ int addrconf_sysctl_forward(struct ctl_t
- 	return ret;
- }
- 
-+static
-+int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
-+			void __user *buffer, size_t *lenp, loff_t *ppos)
-+{
-+	struct inet6_dev *idev = ctl->extra1;
-+	int min_mtu = IPV6_MIN_MTU;
-+	struct ctl_table lctl;
-+
-+	lctl = *ctl;
-+	lctl.extra1 = &min_mtu;
-+	lctl.extra2 = idev ? &idev->dev->mtu : NULL;
-+
-+	return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
-+}
-+
- static void dev_disable_change(struct inet6_dev *idev)
- {
- 	struct netdev_notifier_info info;
-@@ -4940,7 +4955,7 @@ static struct addrconf_sysctl_table
- 			.data		= &ipv6_devconf.mtu6,
- 			.maxlen		= sizeof(int),
- 			.mode		= 0644,
--			.proc_handler	= proc_dointvec,
-+			.proc_handler	= addrconf_sysctl_mtu,
- 		},
- 		{
- 			.procname	= "accept_ra",
diff --git a/debian/patches/bugfix/all/rds-verify-the-underlying-transport-exists-before-cr.patch b/debian/patches/bugfix/all/rds-verify-the-underlying-transport-exists-before-cr.patch
deleted file mode 100644
index 0afc574..0000000
--- a/debian/patches/bugfix/all/rds-verify-the-underlying-transport-exists-before-cr.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From: Sasha Levin <sasha.levin at oracle.com>
-Date: Tue, 8 Sep 2015 10:53:40 -0400
-Subject: RDS: verify the underlying transport exists before creating a
- connection
-Origin: https://git.kernel.org/linus/74e98eb085889b0d2d4908f59f6e00026063014f
-
-There was no verification that an underlying transport exists when creating
-a connection, this would cause dereferencing a NULL ptr.
-
-It might happen on sockets that weren't properly bound before attempting to
-send a message, which will cause a NULL ptr deref:
-
-[135546.047719] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN
-[135546.051270] Modules linked in:
-[135546.051781] CPU: 4 PID: 15650 Comm: trinity-c4 Not tainted 4.2.0-next-20150902-sasha-00041-gbaa1222-dirty #2527
-[135546.053217] task: ffff8800835bc000 ti: ffff8800bc708000 task.ti: ffff8800bc708000
-[135546.054291] RIP: __rds_conn_create (net/rds/connection.c:194)
-[135546.055666] RSP: 0018:ffff8800bc70fab0  EFLAGS: 00010202
-[135546.056457] RAX: dffffc0000000000 RBX: 0000000000000f2c RCX: ffff8800835bc000
-[135546.057494] RDX: 0000000000000007 RSI: ffff8800835bccd8 RDI: 0000000000000038
-[135546.058530] RBP: ffff8800bc70fb18 R08: 0000000000000001 R09: 0000000000000000
-[135546.059556] R10: ffffed014d7a3a23 R11: ffffed014d7a3a21 R12: 0000000000000000
-[135546.060614] R13: 0000000000000001 R14: ffff8801ec3d0000 R15: 0000000000000000
-[135546.061668] FS:  00007faad4ffb700(0000) GS:ffff880252000000(0000) knlGS:0000000000000000
-[135546.062836] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
-[135546.063682] CR2: 000000000000846a CR3: 000000009d137000 CR4: 00000000000006a0
-[135546.064723] Stack:
-[135546.065048]  ffffffffafe2055c ffffffffafe23fc1 ffffed00493097bf ffff8801ec3d0008
-[135546.066247]  0000000000000000 00000000000000d0 0000000000000000 ac194a24c0586342
-[135546.067438]  1ffff100178e1f78 ffff880320581b00 ffff8800bc70fdd0 ffff880320581b00
-[135546.068629] Call Trace:
-[135546.069028] ? __rds_conn_create (include/linux/rcupdate.h:856 net/rds/connection.c:134)
-[135546.069989] ? rds_message_copy_from_user (net/rds/message.c:298)
-[135546.071021] rds_conn_create_outgoing (net/rds/connection.c:278)
-[135546.071981] rds_sendmsg (net/rds/send.c:1058)
-[135546.072858] ? perf_trace_lock (include/trace/events/lock.h:38)
-[135546.073744] ? lockdep_init (kernel/locking/lockdep.c:3298)
-[135546.074577] ? rds_send_drop_to (net/rds/send.c:976)
-[135546.075508] ? __might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3795)
-[135546.076349] ? __might_fault (mm/memory.c:3795)
-[135546.077179] ? rds_send_drop_to (net/rds/send.c:976)
-[135546.078114] sock_sendmsg (net/socket.c:611 net/socket.c:620)
-[135546.078856] SYSC_sendto (net/socket.c:1657)
-[135546.079596] ? SYSC_connect (net/socket.c:1628)
-[135546.080510] ? trace_dump_stack (kernel/trace/trace.c:1926)
-[135546.081397] ? ring_buffer_unlock_commit (kernel/trace/ring_buffer.c:2479 kernel/trace/ring_buffer.c:2558 kernel/trace/ring_buffer.c:2674)
-[135546.082390] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749)
-[135546.083410] ? trace_event_raw_event_sys_enter (include/trace/events/syscalls.h:16)
-[135546.084481] ? do_audit_syscall_entry (include/trace/events/syscalls.h:16)
-[135546.085438] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749)
-[135546.085515] rds_ib_laddr_check(): addr 36.74.25.172 ret -99 node type -1
-
-Acked-by: Santosh Shilimkar <santosh.shilimkar at oracle.com>
-Signed-off-by: Sasha Levin <sasha.levin at oracle.com>
-Signed-off-by: David S. Miller <davem at davemloft.net>
----
- net/rds/connection.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/net/rds/connection.c
-+++ b/net/rds/connection.c
-@@ -183,6 +183,12 @@ static struct rds_connection *__rds_conn
- 		}
- 	}
- 
-+	if (trans == NULL) {
-+		kmem_cache_free(rds_conn_slab, conn);
-+		conn = ERR_PTR(-ENODEV);
-+		goto out;
-+	}
-+
- 	conn->c_trans = trans;
- 
- 	ret = trans->conn_alloc(conn, gfp);
diff --git a/debian/patches/bugfix/all/sctp-fix-race-on-protocol-netns-initialization.patch b/debian/patches/bugfix/all/sctp-fix-race-on-protocol-netns-initialization.patch
deleted file mode 100644
index b128cd4..0000000
--- a/debian/patches/bugfix/all/sctp-fix-race-on-protocol-netns-initialization.patch
+++ /dev/null
@@ -1,227 +0,0 @@
-From: Marcelo Ricardo Leitner <marcelo.leitner at gmail.com>
-Date: Thu, 10 Sep 2015 17:31:15 -0300
-Subject: sctp: fix race on protocol/netns initialization
-Origin: https://git.kernel.org/linus/8e2d61e0aed2b7c4ecb35844fe07e0b2b762dee4
-
-Consider sctp module is unloaded and is being requested because an user
-is creating a sctp socket.
-
-During initialization, sctp will add the new protocol type and then
-initialize pernet subsys:
-
-        status = sctp_v4_protosw_init();
-        if (status)
-                goto err_protosw_init;
-
-        status = sctp_v6_protosw_init();
-        if (status)
-                goto err_v6_protosw_init;
-
-        status = register_pernet_subsys(&sctp_net_ops);
-
-The problem is that after those calls to sctp_v{4,6}_protosw_init(), it
-is possible for userspace to create SCTP sockets like if the module is
-already fully loaded. If that happens, one of the possible effects is
-that we will have readers for net->sctp.local_addr_list list earlier
-than expected and sctp_net_init() does not take precautions while
-dealing with that list, leading to a potential panic but not limited to
-that, as sctp_sock_init() will copy a bunch of blank/partially
-initialized values from net->sctp.
-
-The race happens like this:
-
-     CPU 0                           |  CPU 1
-  socket()                           |
-   __sock_create                     | socket()
-    inet_create                      |  __sock_create
-     list_for_each_entry_rcu(        |
-        answer, &inetsw[sock->type], |
-        list) {                      |   inet_create
-      /* no hits */                  |
-     if (unlikely(err)) {            |
-      ...                            |
-      request_module()               |
-      /* socket creation is blocked  |
-       * the module is fully loaded  |
-       */                            |
-       sctp_init                     |
-        sctp_v4_protosw_init         |
-         inet_register_protosw       |
-          list_add_rcu(&p->list,     |
-                       last_perm);   |
-                                     |  list_for_each_entry_rcu(
-                                     |     answer, &inetsw[sock->type],
-        sctp_v6_protosw_init         |     list) {
-                                     |     /* hit, so assumes protocol
-                                     |      * is already loaded
-                                     |      */
-                                     |  /* socket creation continues
-                                     |   * before netns is initialized
-                                     |   */
-        register_pernet_subsys       |
-
-Simply inverting the initialization order between
-register_pernet_subsys() and sctp_v4_protosw_init() is not possible
-because register_pernet_subsys() will create a control sctp socket, so
-the protocol must be already visible by then. Deferring the socket
-creation to a work-queue is not good specially because we loose the
-ability to handle its errors.
-
-So, as suggested by Vlad, the fix is to split netns initialization in
-two moments: defaults and control socket, so that the defaults are
-already loaded by when we register the protocol, while control socket
-initialization is kept at the same moment it is today.
-
-Fixes: 4db67e808640 ("sctp: Make the address lists per network namespace")
-Signed-off-by: Vlad Yasevich <vyasevich at gmail.com>
-Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner at gmail.com>
-Signed-off-by: David S. Miller <davem at davemloft.net>
----
- net/sctp/protocol.c | 64 ++++++++++++++++++++++++++++++++++-------------------
- 1 file changed, 41 insertions(+), 23 deletions(-)
-
---- a/net/sctp/protocol.c
-+++ b/net/sctp/protocol.c
-@@ -1166,7 +1166,7 @@ static void sctp_v4_del_protocol(void)
- 	unregister_inetaddr_notifier(&sctp_inetaddr_notifier);
- }
- 
--static int __net_init sctp_net_init(struct net *net)
-+static int __net_init sctp_defaults_init(struct net *net)
- {
- 	int status;
- 
-@@ -1259,12 +1259,6 @@ static int __net_init sctp_net_init(stru
- 
- 	sctp_dbg_objcnt_init(net);
- 
--	/* Initialize the control inode/socket for handling OOTB packets.  */
--	if ((status = sctp_ctl_sock_init(net))) {
--		pr_err("Failed to initialize the SCTP control sock\n");
--		goto err_ctl_sock_init;
--	}
--
- 	/* Initialize the local address list. */
- 	INIT_LIST_HEAD(&net->sctp.local_addr_list);
- 	spin_lock_init(&net->sctp.local_addr_lock);
-@@ -1280,9 +1274,6 @@ static int __net_init sctp_net_init(stru
- 
- 	return 0;
- 
--err_ctl_sock_init:
--	sctp_dbg_objcnt_exit(net);
--	sctp_proc_exit(net);
- err_init_proc:
- 	cleanup_sctp_mibs(net);
- err_init_mibs:
-@@ -1291,15 +1282,12 @@ err_sysctl_register:
- 	return status;
- }
- 
--static void __net_exit sctp_net_exit(struct net *net)
-+static void __net_exit sctp_defaults_exit(struct net *net)
- {
- 	/* Free the local address list */
- 	sctp_free_addr_wq(net);
- 	sctp_free_local_addr_list(net);
- 
--	/* Free the control endpoint.  */
--	inet_ctl_sock_destroy(net->sctp.ctl_sock);
--
- 	sctp_dbg_objcnt_exit(net);
- 
- 	sctp_proc_exit(net);
-@@ -1307,9 +1295,32 @@ static void __net_exit sctp_net_exit(str
- 	sctp_sysctl_net_unregister(net);
- }
- 
--static struct pernet_operations sctp_net_ops = {
--	.init = sctp_net_init,
--	.exit = sctp_net_exit,
-+static struct pernet_operations sctp_defaults_ops = {
-+	.init = sctp_defaults_init,
-+	.exit = sctp_defaults_exit,
-+};
-+
-+static int __net_init sctp_ctrlsock_init(struct net *net)
-+{
-+	int status;
-+
-+	/* Initialize the control inode/socket for handling OOTB packets.  */
-+	status = sctp_ctl_sock_init(net);
-+	if (status)
-+		pr_err("Failed to initialize the SCTP control sock\n");
-+
-+	return status;
-+}
-+
-+static void __net_init sctp_ctrlsock_exit(struct net *net)
-+{
-+	/* Free the control endpoint.  */
-+	inet_ctl_sock_destroy(net->sctp.ctl_sock);
-+}
-+
-+static struct pernet_operations sctp_ctrlsock_ops = {
-+	.init = sctp_ctrlsock_init,
-+	.exit = sctp_ctrlsock_exit,
- };
- 
- /* Initialize the universe into something sensible.  */
-@@ -1443,8 +1454,11 @@ static __init int sctp_init(void)
- 	sctp_v4_pf_init();
- 	sctp_v6_pf_init();
- 
--	status = sctp_v4_protosw_init();
-+	status = register_pernet_subsys(&sctp_defaults_ops);
-+	if (status)
-+		goto err_register_defaults;
- 
-+	status = sctp_v4_protosw_init();
- 	if (status)
- 		goto err_protosw_init;
- 
-@@ -1452,9 +1466,9 @@ static __init int sctp_init(void)
- 	if (status)
- 		goto err_v6_protosw_init;
- 
--	status = register_pernet_subsys(&sctp_net_ops);
-+	status = register_pernet_subsys(&sctp_ctrlsock_ops);
- 	if (status)
--		goto err_register_pernet_subsys;
-+		goto err_register_ctrlsock;
- 
- 	status = sctp_v4_add_protocol();
- 	if (status)
-@@ -1470,12 +1484,14 @@ out:
- err_v6_add_protocol:
- 	sctp_v4_del_protocol();
- err_add_protocol:
--	unregister_pernet_subsys(&sctp_net_ops);
--err_register_pernet_subsys:
-+	unregister_pernet_subsys(&sctp_ctrlsock_ops);
-+err_register_ctrlsock:
- 	sctp_v6_protosw_exit();
- err_v6_protosw_init:
- 	sctp_v4_protosw_exit();
- err_protosw_init:
-+	unregister_pernet_subsys(&sctp_defaults_ops);
-+err_register_defaults:
- 	sctp_v4_pf_exit();
- 	sctp_v6_pf_exit();
- 	sctp_sysctl_unregister();
-@@ -1508,12 +1524,14 @@ static __exit void sctp_exit(void)
- 	sctp_v6_del_protocol();
- 	sctp_v4_del_protocol();
- 
--	unregister_pernet_subsys(&sctp_net_ops);
-+	unregister_pernet_subsys(&sctp_ctrlsock_ops);
- 
- 	/* Free protosw registrations */
- 	sctp_v6_protosw_exit();
- 	sctp_v4_protosw_exit();
- 
-+	unregister_pernet_subsys(&sctp_defaults_ops);
-+
- 	/* Unregister with socket layer. */
- 	sctp_v6_pf_exit();
- 	sctp_v4_pf_exit();
diff --git a/debian/patches/bugfix/all/virtio-net-drop-netif_f_fraglist.patch b/debian/patches/bugfix/all/virtio-net-drop-netif_f_fraglist.patch
deleted file mode 100644
index efb551f..0000000
--- a/debian/patches/bugfix/all/virtio-net-drop-netif_f_fraglist.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From: Jason Wang <jasowang at redhat.com>
-Date: Wed, 5 Aug 2015 10:34:04 +0800
-Subject: virtio-net: drop NETIF_F_FRAGLIST
-Origin: https://git.kernel.org/linus/48900cb6af4282fa0fb6ff4d72a81aa3dadb5c39
-
-virtio declares support for NETIF_F_FRAGLIST, but assumes
-that there are at most MAX_SKB_FRAGS + 2 fragments which isn't
-always true with a fraglist.
-
-A longer fraglist in the skb will make the call to skb_to_sgvec overflow
-the sg array, leading to memory corruption.
-
-Drop NETIF_F_FRAGLIST so we only get what we can handle.
-
-Cc: Michael S. Tsirkin <mst at redhat.com>
-Signed-off-by: Jason Wang <jasowang at redhat.com>
-Acked-by: Michael S. Tsirkin <mst at redhat.com>
-Signed-off-by: David S. Miller <davem at davemloft.net>
----
- drivers/net/virtio_net.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/virtio_net.c
-+++ b/drivers/net/virtio_net.c
-@@ -1652,9 +1652,9 @@ static int virtnet_probe(struct virtio_d
- 	/* Do we support "hardware" checksums? */
- 	if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
- 		/* This opens up the world of extra features. */
--		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
-+		dev->hw_features |= NETIF_F_HW_CSUM | NETIF_F_SG;
- 		if (csum)
--			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
-+			dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
- 
- 		if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
- 			dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
diff --git a/debian/patches/bugfix/arm/revert-arm-orion5x-fix-legacy-orion5x-irq-numbers.patch b/debian/patches/bugfix/arm/revert-arm-orion5x-fix-legacy-orion5x-irq-numbers.patch
new file mode 100644
index 0000000..7a56395
--- /dev/null
+++ b/debian/patches/bugfix/arm/revert-arm-orion5x-fix-legacy-orion5x-irq-numbers.patch
@@ -0,0 +1,115 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Subject: Revert "ARM: orion5x: fix legacy orion5x IRQ numbers"
+Forwarded: http://mid.gmane.org/1444879386.31451.42.camel@decadent.org.uk
+
+This reverts commit b5614b199b9990b015ae0973db5adf53e7be1651, which was
+commit 5be9fc23cdb42e1d383ecc8eae8a8ff70a752708 upstream.  The bug it
+fixes was introduced in 3.18.
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -565,7 +565,6 @@ config ARCH_ORION5X
+ 	select MVEBU_MBUS
+ 	select PCI
+ 	select PLAT_ORION_LEGACY
+-	select MULTI_IRQ_HANDLER
+ 	help
+ 	  Support for the following Marvell Orion 5x series SoCs:
+ 	  Orion-1 (5181), Orion-VoIP (5181L), Orion-NAS (5182),
+--- a/arch/arm/mach-orion5x/include/mach/irqs.h
++++ b/arch/arm/mach-orion5x/include/mach/irqs.h
+@@ -16,42 +16,42 @@
+ /*
+  * Orion Main Interrupt Controller
+  */
+-#define IRQ_ORION5X_BRIDGE		(1 + 0)
+-#define IRQ_ORION5X_DOORBELL_H2C	(1 + 1)
+-#define IRQ_ORION5X_DOORBELL_C2H	(1 + 2)
+-#define IRQ_ORION5X_UART0		(1 + 3)
+-#define IRQ_ORION5X_UART1		(1 + 4)
+-#define IRQ_ORION5X_I2C			(1 + 5)
+-#define IRQ_ORION5X_GPIO_0_7		(1 + 6)
+-#define IRQ_ORION5X_GPIO_8_15		(1 + 7)
+-#define IRQ_ORION5X_GPIO_16_23		(1 + 8)
+-#define IRQ_ORION5X_GPIO_24_31		(1 + 9)
+-#define IRQ_ORION5X_PCIE0_ERR		(1 + 10)
+-#define IRQ_ORION5X_PCIE0_INT		(1 + 11)
+-#define IRQ_ORION5X_USB1_CTRL		(1 + 12)
+-#define IRQ_ORION5X_DEV_BUS_ERR		(1 + 14)
+-#define IRQ_ORION5X_PCI_ERR		(1 + 15)
+-#define IRQ_ORION5X_USB_BR_ERR		(1 + 16)
+-#define IRQ_ORION5X_USB0_CTRL		(1 + 17)
+-#define IRQ_ORION5X_ETH_RX		(1 + 18)
+-#define IRQ_ORION5X_ETH_TX		(1 + 19)
+-#define IRQ_ORION5X_ETH_MISC		(1 + 20)
+-#define IRQ_ORION5X_ETH_SUM		(1 + 21)
+-#define IRQ_ORION5X_ETH_ERR		(1 + 22)
+-#define IRQ_ORION5X_IDMA_ERR		(1 + 23)
+-#define IRQ_ORION5X_IDMA_0		(1 + 24)
+-#define IRQ_ORION5X_IDMA_1		(1 + 25)
+-#define IRQ_ORION5X_IDMA_2		(1 + 26)
+-#define IRQ_ORION5X_IDMA_3		(1 + 27)
+-#define IRQ_ORION5X_CESA		(1 + 28)
+-#define IRQ_ORION5X_SATA		(1 + 29)
+-#define IRQ_ORION5X_XOR0		(1 + 30)
+-#define IRQ_ORION5X_XOR1		(1 + 31)
++#define IRQ_ORION5X_BRIDGE		0
++#define IRQ_ORION5X_DOORBELL_H2C	1
++#define IRQ_ORION5X_DOORBELL_C2H	2
++#define IRQ_ORION5X_UART0		3
++#define IRQ_ORION5X_UART1		4
++#define IRQ_ORION5X_I2C			5
++#define IRQ_ORION5X_GPIO_0_7		6
++#define IRQ_ORION5X_GPIO_8_15		7
++#define IRQ_ORION5X_GPIO_16_23		8
++#define IRQ_ORION5X_GPIO_24_31		9
++#define IRQ_ORION5X_PCIE0_ERR		10
++#define IRQ_ORION5X_PCIE0_INT		11
++#define IRQ_ORION5X_USB1_CTRL		12
++#define IRQ_ORION5X_DEV_BUS_ERR		14
++#define IRQ_ORION5X_PCI_ERR		15
++#define IRQ_ORION5X_USB_BR_ERR		16
++#define IRQ_ORION5X_USB0_CTRL		17
++#define IRQ_ORION5X_ETH_RX		18
++#define IRQ_ORION5X_ETH_TX		19
++#define IRQ_ORION5X_ETH_MISC		20
++#define IRQ_ORION5X_ETH_SUM		21
++#define IRQ_ORION5X_ETH_ERR		22
++#define IRQ_ORION5X_IDMA_ERR		23
++#define IRQ_ORION5X_IDMA_0		24
++#define IRQ_ORION5X_IDMA_1		25
++#define IRQ_ORION5X_IDMA_2		26
++#define IRQ_ORION5X_IDMA_3		27
++#define IRQ_ORION5X_CESA		28
++#define IRQ_ORION5X_SATA		29
++#define IRQ_ORION5X_XOR0		30
++#define IRQ_ORION5X_XOR1		31
+ 
+ /*
+  * Orion General Purpose Pins
+  */
+-#define IRQ_ORION5X_GPIO_START	33
++#define IRQ_ORION5X_GPIO_START	32
+ #define NR_GPIO_IRQS		32
+ 
+ #define NR_IRQS			(IRQ_ORION5X_GPIO_START + NR_GPIO_IRQS)
+--- a/arch/arm/mach-orion5x/irq.c
++++ b/arch/arm/mach-orion5x/irq.c
+@@ -42,7 +42,7 @@ __exception_irq_entry orion5x_legacy_han
+ 	stat = readl_relaxed(MAIN_IRQ_CAUSE);
+ 	stat &= readl_relaxed(MAIN_IRQ_MASK);
+ 	if (stat) {
+-		unsigned int hwirq = 1 + __fls(stat);
++		unsigned int hwirq = __fls(stat);
+ 		handle_IRQ(hwirq, regs);
+ 		return;
+ 	}
+@@ -51,7 +51,7 @@ __exception_irq_entry orion5x_legacy_han
+ 
+ void __init orion5x_init_irq(void)
+ {
+-	orion_irq_init(1, MAIN_IRQ_MASK);
++	orion_irq_init(0, MAIN_IRQ_MASK);
+ 
+ #ifdef CONFIG_MULTI_IRQ_HANDLER
+ 	set_handle_irq(orion5x_legacy_handle_irq);
diff --git a/debian/patches/debian/netlink-fix-abi-change-in-3.16.7-ckt18.patch b/debian/patches/debian/netlink-fix-abi-change-in-3.16.7-ckt18.patch
new file mode 100644
index 0000000..9f7f310
--- /dev/null
+++ b/debian/patches/debian/netlink-fix-abi-change-in-3.16.7-ckt18.patch
@@ -0,0 +1,43 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Wed, 14 Oct 2015 21:13:59 +0100
+Subject: netlink: Fix ABI change in 3.16.7-ckt18
+Forwarded: not-needed
+
+netlink_alloc_skb() was changed into an inline wrapper for the new
+function __netlink_alloc_skb().  As it was exported, we need to change
+it back to avoid an ABI break.
+
+--- a/include/linux/netlink.h
++++ b/include/linux/netlink.h
+@@ -70,12 +70,9 @@ extern int netlink_has_listeners(struct
+ extern struct sk_buff *__netlink_alloc_skb(struct sock *ssk, unsigned int size,
+ 					   unsigned int ldiff, u32 dst_portid,
+ 					   gfp_t gfp_mask);
+-static inline struct sk_buff *
++extern struct sk_buff *
+ netlink_alloc_skb(struct sock *ssk, unsigned int size, u32 dst_portid,
+-		  gfp_t gfp_mask)
+-{
+-	return __netlink_alloc_skb(ssk, size, 0, dst_portid, gfp_mask);
+-}
++		  gfp_t gfp_mask);
+ 
+ extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, int nonblock);
+ extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 portid,
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1929,6 +1929,14 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(__netlink_alloc_skb);
+ 
++struct sk_buff *
++netlink_alloc_skb(struct sock *ssk, unsigned int size, u32 dst_portid,
++		  gfp_t gfp_mask)
++{
++	return __netlink_alloc_skb(ssk, size, 0, dst_portid, gfp_mask);
++}
++EXPORT_SYMBOL_GPL(netlink_alloc_skb);
++
+ int netlink_has_listeners(struct sock *sk, unsigned int group)
+ {
+ 	int res = 0;
diff --git a/debian/patches/series b/debian/patches/series
index 4b35a66..b5a5cee 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -629,15 +629,12 @@ debian/revert-acpica-utilities-split-io-address-types-from-.patch
 debian/x86-mm-avoid-abi-change-in-3.16.7-ckt17.patch
 debian/bh-avoid-abi-change-in-3.16.7-ckt17.patch
 debian/net-sched-avoid-abi-change-in-3.16.7-ckt17.patch
+debian/netlink-fix-abi-change-in-3.16.7-ckt18.patch
 
-bugfix/all/ipv6-addrconf-validate-new-MTU-before-applying-it.patch
-bugfix/all/virtio-net-drop-netif_f_fraglist.patch
-bugfix/all/rds-verify-the-underlying-transport-exists-before-cr.patch
 bugfix/all/namei-lift-open-coded-terminate_walk-in-follow_dotdo.patch
 bugfix/all/dcache-handle-escaped-paths-in-prepend_path.patch
 bugfix/all/vfs-test-for-and-handle-paths-that-are-unreachable-f.patch
 bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch
-bugfix/all/sctp-fix-race-on-protocol-netns-initialization.patch
 bugfix/all/ipc-sem.c-fully-initialize-sem_array-before-making-i.patch
 bugfix/all/Initialize-msg-shm-IPC-objects-before-doing-ipc_addid.patch
 bugfix/x86/i2c-i801-Use-wait_event_timeout-to-wait-for-interrup.patch
@@ -645,3 +642,4 @@ bugfix/all/media-uvcvideo-disable-hardware-timestamps-by-defaul.patch
 bugfix/all/nbd-fix-timeout-detection.patch
 bugfix/all/nbd-remove-variable-pid.patch
 bugfix/all/nbd-add-locking-for-tasks.patch
+bugfix/arm/revert-arm-orion5x-fix-legacy-orion5x-irq-numbers.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git



More information about the Kernel-svn-changes mailing list