From: Greg Kroah-Hartman Date: Thu, 29 Jul 2010 22:38:01 +0000 (-0700) Subject: .27 patches X-Git-Tag: v2.6.27.49~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c1bacda23c18473a5acc7f82dde2709096c30aac;p=thirdparty%2Fkernel%2Fstable-queue.git .27 patches --- diff --git a/queue-2.6.27/bonding-select-current-active-slave-when-enslaving-device-for-mode-tlb-and-alb.patch b/queue-2.6.27/bonding-select-current-active-slave-when-enslaving-device-for-mode-tlb-and-alb.patch new file mode 100644 index 00000000000..8589b7aed05 --- /dev/null +++ b/queue-2.6.27/bonding-select-current-active-slave-when-enslaving-device-for-mode-tlb-and-alb.patch @@ -0,0 +1,115 @@ +From 5a29f7893fbe681f1334285be7e41e56f0de666c Mon Sep 17 00:00:00 2001 +From: Jiri Pirko +Date: Wed, 25 Mar 2009 17:23:38 -0700 +Subject: bonding: select current active slave when enslaving device for mode tlb and alb + +From: Jiri Pirko + +commit 5a29f7893fbe681f1334285be7e41e56f0de666c upstream. + +I've hit an issue on my system when I've been using RealTek RTL8139D cards in +bonding interface in mode balancing-alb. When I enslave a card, the current +active slave (bond->curr_active_slave) is not set and the link is therefore +not functional. + +---- +# cat /proc/net/bonding/bond0 +Ethernet Channel Bonding Driver: v3.5.0 (November 4, 2008) + +Bonding Mode: adaptive load balancing +Primary Slave: None +Currently Active Slave: None +MII Status: up +MII Polling Interval (ms): 100 +Up Delay (ms): 0 +Down Delay (ms): 0 + +Slave Interface: eth1 +MII Status: up +Link Failure Count: 0 +Permanent HW addr: 00:1f:1f:01:2f:22 +---- + +The thing that gets it right is when I unplug the cable and then I put it back +into the NIC. Then the current active slave is set to eth1 and link is working +just fine. Here is dmesg log with bonding DEBUG messages turned on: +---- +ADDRCONF(NETDEV_UP): bond0: link is not ready +event_dev: bond0, event: 1 +IFF_MASTER +event_dev: bond0, event: 8 +IFF_MASTER +bond_ioctl: master=bond0, cmd=35216 +slave_dev=cac5d800: +slave_dev->name=eth1: +eth1: ! NETIF_F_VLAN_CHALLENGED +event_dev: eth1, event: 8 +eth1: link up, 100Mbps, full-duplex, lpa 0xC5E1 +event_dev: eth1, event: 1 +event_dev: eth1, event: 8 +IFF_SLAVE +Initial state of slave_dev is BOND_LINK_UP +bonding: bond0: enslaving eth1 as an active interface with an up link. +ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready +event_dev: bond0, event: 4 +IFF_MASTER +bond0: no IPv6 routers present + +<<<>>> + +eth1: link down +event_dev: eth1, event: 4 +IFF_SLAVE +bonding: bond0: link status definitely down for interface eth1, disabling it +event_dev: bond0, event: 4 +IFF_MASTER + +<<<>>> + +eth1: link up, 100Mbps, full-duplex, lpa 0xC5E1 +event_dev: eth1, event: 4 +IFF_SLAVE +bonding: bond0: link status definitely up for interface eth1. +bonding: bond0: making interface eth1 the new active one. +event_dev: eth1, event: 8 +IFF_SLAVE +event_dev: eth1, event: 8 +IFF_SLAVE +bonding: bond0: first active interface up! +event_dev: bond0, event: 4 +IFF_MASTER +---- + +The current active slave is set by calling bond_select_active_slave() function +from bond_miimon_commit() function when the slave (eth1) link goes to state up. + +I also tested this on other machine with Broadcom NetXtreme II BCM5708 +1000Base-T NIC and there all works fine. The thing is that this adapter is down +and goes up after few seconds after it is enslaved. + +This patch calls bond_select_active_slave() in bond_enslave() function for modes +alb and tlb and makes sure that the current active slave is set up properly even +when the slave state is already up. Tested on both systems, works fine. + +Notice: The same problem can maybe also occrur in mode 8023AD but I'm unable to +test that. + +Signed-off-by: Jiri Pirko +Signed-off-by: David S. Miller +Cc: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/bonding/bond_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1705,6 +1705,7 @@ int bond_enslave(struct net_device *bond + case BOND_MODE_ALB: + new_slave->state = BOND_STATE_ACTIVE; + bond_set_slave_inactive_flags(new_slave); ++ bond_select_active_slave(bond); + break; + default: + dprintk("This slave is always active in trunk mode\n"); diff --git a/queue-2.6.27/ecryptfs-bugfix-for-error-related-to-ecryptfs_hash_buckets.patch b/queue-2.6.27/ecryptfs-bugfix-for-error-related-to-ecryptfs_hash_buckets.patch new file mode 100644 index 00000000000..f67e2e474f2 --- /dev/null +++ b/queue-2.6.27/ecryptfs-bugfix-for-error-related-to-ecryptfs_hash_buckets.patch @@ -0,0 +1,75 @@ +From a6f80fb7b5986fda663d94079d3bba0937a6b6ff Mon Sep 17 00:00:00 2001 +From: Andre Osterhues +Date: Tue, 13 Jul 2010 15:59:17 -0500 +Subject: ecryptfs: Bugfix for error related to ecryptfs_hash_buckets + +From: Andre Osterhues + +commit a6f80fb7b5986fda663d94079d3bba0937a6b6ff upstream. + +The function ecryptfs_uid_hash wrongly assumes that the +second parameter to hash_long() is the number of hash +buckets instead of the number of hash bits. +This patch fixes that and renames the variable +ecryptfs_hash_buckets to ecryptfs_hash_bits to make it +clearer. + +Fixes: CVE-2010-2492 + +Signed-off-by: Andre Osterhues +Signed-off-by: Tyler Hicks +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/messaging.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/fs/ecryptfs/messaging.c ++++ b/fs/ecryptfs/messaging.c +@@ -30,9 +30,9 @@ static struct mutex ecryptfs_msg_ctx_lis + + static struct hlist_head *ecryptfs_daemon_hash; + struct mutex ecryptfs_daemon_hash_mux; +-static int ecryptfs_hash_buckets; ++static int ecryptfs_hash_bits; + #define ecryptfs_uid_hash(uid) \ +- hash_long((unsigned long)uid, ecryptfs_hash_buckets) ++ hash_long((unsigned long)uid, ecryptfs_hash_bits) + + static u32 ecryptfs_msg_counter; + static struct ecryptfs_msg_ctx *ecryptfs_msg_ctx_arr; +@@ -599,18 +599,19 @@ int ecryptfs_init_messaging(unsigned int + } + mutex_init(&ecryptfs_daemon_hash_mux); + mutex_lock(&ecryptfs_daemon_hash_mux); +- ecryptfs_hash_buckets = 1; +- while (ecryptfs_number_of_users >> ecryptfs_hash_buckets) +- ecryptfs_hash_buckets++; ++ ecryptfs_hash_bits = 1; ++ while (ecryptfs_number_of_users >> ecryptfs_hash_bits) ++ ecryptfs_hash_bits++; + ecryptfs_daemon_hash = kmalloc((sizeof(struct hlist_head) +- * ecryptfs_hash_buckets), GFP_KERNEL); ++ * (1 << ecryptfs_hash_bits)), ++ GFP_KERNEL); + if (!ecryptfs_daemon_hash) { + rc = -ENOMEM; + printk(KERN_ERR "%s: Failed to allocate memory\n", __func__); + mutex_unlock(&ecryptfs_daemon_hash_mux); + goto out; + } +- for (i = 0; i < ecryptfs_hash_buckets; i++) ++ for (i = 0; i < (1 << ecryptfs_hash_bits); i++) + INIT_HLIST_HEAD(&ecryptfs_daemon_hash[i]); + mutex_unlock(&ecryptfs_daemon_hash_mux); + ecryptfs_msg_ctx_arr = kmalloc((sizeof(struct ecryptfs_msg_ctx) +@@ -680,7 +681,7 @@ void ecryptfs_release_messaging(unsigned + int i; + + mutex_lock(&ecryptfs_daemon_hash_mux); +- for (i = 0; i < ecryptfs_hash_buckets; i++) { ++ for (i = 0; i < (1 << ecryptfs_hash_bits); i++) { + int rc; + + hlist_for_each_entry(daemon, elem, diff --git a/queue-2.6.27/kbuild-fix-modpost-segfault.patch b/queue-2.6.27/kbuild-fix-modpost-segfault.patch new file mode 100644 index 00000000000..566cab25565 --- /dev/null +++ b/queue-2.6.27/kbuild-fix-modpost-segfault.patch @@ -0,0 +1,50 @@ +From 1c938663d58b5b2965976a6f54cc51b5d6f691aa Mon Sep 17 00:00:00 2001 +From: Krzysztof Halasa +Date: Fri, 11 Jun 2010 01:08:20 +0200 +Subject: kbuild: Fix modpost segfault +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Halasa + +commit 1c938663d58b5b2965976a6f54cc51b5d6f691aa upstream. + +Alan writes: + +> program: /home/alan/GitTrees/linux-2.6-mid-ref/scripts/mod/modpost -o +> Module.symvers -S vmlinux.o +> +> Program received signal SIGSEGV, Segmentation fault. + +It just hit me. +It's the offset calculation in reloc_location() which overflows: + return (void *)elf->hdr + sechdrs[section].sh_offset + + (r->r_offset - sechdrs[section].sh_addr); + +E.g. for the first rodata r entry: +r->r_offset < sechdrs[section].sh_addr +and the expression in the parenthesis produces 0xFFFFFFE0 or something +equally wise. + +Reported-by: Alan +Signed-off-by: Krzysztof Hałasa +Tested-by: Alan +Signed-off-by: Michal Marek +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/mod/modpost.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1292,7 +1292,7 @@ static unsigned int *reloc_location(stru + int section = sechdr->sh_info; + + return (void *)elf->hdr + sechdrs[section].sh_offset + +- (r->r_offset - sechdrs[section].sh_addr); ++ r->r_offset - sechdrs[section].sh_addr; + } + + static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) diff --git a/queue-2.6.27/series b/queue-2.6.27/series index ebe664c9154..8d8ffd84700 100644 --- a/queue-2.6.27/series +++ b/queue-2.6.27/series @@ -12,3 +12,6 @@ amd64-agp-probe-unknown-agp-devices-the-right-way.patch x86-calgary-increase-max-phb-number.patch x86-calgary-limit-the-max-phb-number-to-256.patch ipoib-fix-world-writable-child-interface-control-sysfs-attributes.patch +bonding-select-current-active-slave-when-enslaving-device-for-mode-tlb-and-alb.patch +kbuild-fix-modpost-segfault.patch +ecryptfs-bugfix-for-error-related-to-ecryptfs_hash_buckets.patch