~ubuntu-kernel/ubuntu/+source/linux/+git/natty:seg

Last commit made on 2013-03-12
Get this branch:
git clone -b seg https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/natty
Members of Ubuntu Kernel Repositories can upload to this branch. Log in for directions.

Branch merges

Branch information

Recent commits

fb77ebc... by Chris J Arges

UBUNTU: Ubuntu-2.6.38-17.68~hf1142685v20130312

Signed-off-by: Chris J Arges <email address hidden>

96715d0... by Ingo Molnar <email address hidden>

perf, x86: Complain louder about BIOSen corrupting CPU/PMU state and continue

BugLink: http://bugs.launchpad.net/bugs/1153769

Eric Dumazet reported that hardware PMU events do not work on his
system, due to the BIOS corrupting PMU state:

    Performance Events: PEBS fmt0+, Core2 events, Broken BIOS detected, using software events only.
    [Firmware Bug]: the BIOS has corrupted hw-PMU resources (MSR 186 is 43003c)

Linus suggested that we continue in the face of such BIOS-induced CPU
state corruption:

   http://lkml.org/lkml/2011/3/24/608

Such BIOSes will have to be fixed - Linux developers rely on a working and
fully capable PMU and the BIOS interfering with the CPU's PMU state is simply
not acceptable.

So this patch changes perf to continue when it detects such BIOS
interaction, some hardware events may be unreliable due to the BIOS
writing and re-writing them - there's not much the kernel can do
about that but to detect the corruption and report it.

Reported-and-tested-by: Eric Dumazet <email address hidden>
Suggested-by: Linus Torvalds <email address hidden>
Acked-by: Peter Zijlstra <email address hidden>
Cc: Thomas Gleixner <email address hidden>
Cc: Arnaldo Carvalho de Melo <email address hidden>
Cc: Frederic Weisbecker <email address hidden>
Cc: Mike Galbraith <email address hidden>
Cc: Steven Rostedt <email address hidden>
LKML-Reference: <new-submission>
Signed-off-by: Ingo Molnar <email address hidden>
(cherry picked from commit 45daae575e08bbf7405c5a3633e956fa364d1b4f)

Signed-off-by: Chris J Arges <email address hidden>

5abad9d... by John Johansen

UBUNTU SAUCE: apparmor: fix lp1056078

BugLink: http://bugs.launchpad.net/bugs/1056078

Profile replacement can cause a long chain of profiles to build up
that get freed in a cascading chain of free_profile calls. Because
free_profile is being called via aa_put_profile (and hence kref_put)
each profile free is done via what amounts to recursion. That is
free_profile indirectly calls free_profile on the next profile in the
chain via aa_put_profile.

Break this recursion by directly walking the chain, and as long as
a profile is being freed because it has no more references continue
on to the next profile. This results in at most 2 levels of free_profile
being called.

Signed-off-by: John Johansen <email address hidden>
Signed-off-by: Chris J Arges <email address hidden>

0c1793c... by Chris J Arges

UBUNTU: Bump ABI

Ignore: yes
Signed-off-by: Chris J Arges <email address hidden>

503654d... by Chris J Arges

UBUNTU: Start new release

Ignore: yes
Signed-off-by: Chris J Arges <email address hidden>

6c417a4... by Luis Henriques

UBUNTU: Ubuntu-2.6.38-16.67

Signed-off-by: Luis Henriques <email address hidden>

dbecd07... by Oleg Nesterov <email address hidden>

cred: copy_process() should clear child->replacement_session_keyring

CVE-2012-2745

BugLink: http://bugs.launchpad.net/bugs/1023535

keyctl_session_to_parent(task) sets ->replacement_session_keyring,
it should be processed and cleared by key_replace_session_keyring().

However, this task can fork before it notices TIF_NOTIFY_RESUME and
the new child gets the bogus ->replacement_session_keyring copied by
dup_task_struct(). This is obviously wrong and, if nothing else, this
leads to put_cred(already_freed_cred).

change copy_creds() to clear this member. If copy_process() fails
before this point the wrong ->replacement_session_keyring doesn't
matter, exit_creds() won't be called.

Cc: <email address hidden>
Signed-off-by: Oleg Nesterov <email address hidden>
Acked-by: David Howells <email address hidden>
Signed-off-by: Linus Torvalds <email address hidden>
(cherry picked from commit 79549c6dfda0603dba9a70a53467ce62d9335c33)

Signed-off-by: Tim Gardner <email address hidden>
Acked-by: Brad Figg <email address hidden>

1cd9ff0... by Andrew Lutomirski

mm: Hold a file reference in madvise_remove

CVE-2012-3511

BugLink: http://bugs.launchpad.net/bugs/1042447

Otherwise the code races with munmap (causing a use-after-free
of the vma) or with close (causing a use-after-free of the struct
file).

The bug was introduced by commit 90ed52ebe481 ("[PATCH] holepunch: fix
mmap_sem i_mutex deadlock")

Cc: Hugh Dickins <email address hidden>
Cc: Miklos Szeredi <email address hidden>
Cc: Badari Pulavarty <email address hidden>
Cc: Nick Piggin <email address hidden>
Cc: <email address hidden>
Signed-off-by: Andy Lutomirski <email address hidden>
Signed-off-by: Linus Torvalds <email address hidden>
(back ported from commit 9ab4233dd08036fe34a89c7dc6f47a8bf2eb29eb)
Acked-by: Herton Ronaldo Krzesinski <email address hidden>
Acked-by: Brad Figg <email address hidden>
Signed-off-by: Tim Gardner <email address hidden>

ce862bd... by Ben Hutchings (Solarflare)

sfc: Fix maximum number of TSO segments and minimum TX queue size

CVE-2012-3412

BugLink: http://bugs.launchpad.net/bugs/1037456

Currently an skb requiring TSO may not fit within a minimum-size TX
queue. The TX queue selected for the skb may stall and trigger the TX
watchdog repeatedly (since the problem skb will be retried after the
TX reset). This issue is designated as CVE-2012-3412.

Set the maximum number of TSO segments for our devices to 100. This
should make no difference to behaviour unless the actual MSS is less
than about 700. Increase the minimum TX queue size accordingly to
allow for 2 worst-case skbs, so that there will definitely be space
to add an skb after we wake a queue.

To avoid invalidating existing configurations, change
efx_ethtool_set_ringparam() to fix up values that are too small rather
than returning -EINVAL.

Signed-off-by: Ben Hutchings <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
(back ported from commit 7e6d06f0de3f74ca929441add094518ae332257c)

Signed-off-by: Tim Gardner <email address hidden>
Acked-by: Herton Krzesinski <email address hidden>

7ae3b27... by Ben Hutchings (Solarflare)

sfc: Replace some literal constants with EFX_PAGE_SIZE/EFX_BUF_SIZE

CVE-2012-3412

BugLink: http://bugs.launchpad.net/bugs/1037456

The 'page size' for PCIe DMA, i.e. the alignment of boundaries at
which DMA must be broken, is 4KB. Name this value as EFX_PAGE_SIZE
and use it in efx_max_tx_len(). Redefine EFX_BUF_SIZE as
EFX_PAGE_SIZE since its value is also a result of that requirement,
and use it in efx_init_special_buffer().

Signed-off-by: Ben Hutchings <email address hidden>
(back ported from commit 5b6262d0ccf759a16fabe11d904a2531125a4b71)

Signed-off-by: Tim Gardner <email address hidden>
Acked-by: Brad Figg <email address hidden>
Acked-by: Herton Krzesinski <email address hidden>