From 3cd567439655123856560676db56369cbcf697bb Mon Sep 17 00:00:00 2001 From: Justin M. Forbes Date: Nov 18 2012 04:33:31 +0000 Subject: linux 3.6.7 --- diff --git a/kernel.spec b/kernel.spec index 3404ca9..8e179c2 100644 --- a/kernel.spec +++ b/kernel.spec @@ -54,7 +54,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 3 +%global baserelease 1 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -66,7 +66,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 6 +%define stable_update 7 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -763,9 +763,6 @@ Patch22089: 0010-ext4-fix-ext_remove_space-for-punch_hole-case.patch Patch22090: 0011-ext4-fix-ext4_flush_completed_IO-wait-semantics.patch Patch22091: 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch -#rhbz 871923 871848 CVE-2012-4565 -Patch22092: net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch - Patch22100: uprobes-upstream-backport.patch #rhbz 871078 @@ -1494,9 +1491,6 @@ ApplyPatch 0010-ext4-fix-ext_remove_space-for-punch_hole-case.patch ApplyPatch 0011-ext4-fix-ext4_flush_completed_IO-wait-semantics.patch ApplyPatch 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch -#rhbz 871923 871848 CVE-2012-4565 -ApplyPatch net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch - ApplyPatch uprobes-upstream-backport.patch #rhbz 871078 @@ -2376,6 +2370,9 @@ fi # '-' | | # '-' %changelog +* Sat Nov 17 2012 Justin M. Forbes - 3.6.7-1 +- linux 3.6.7 + * Fri Nov 16 2012 Josh Boyer - Fix oops causing typo in keyspan driver (rhbz 870562) - Don't WARN_ON empty queues in iwlwifi (rhbz 873001) diff --git a/net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch b/net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch deleted file mode 100644 index 109ee17..0000000 --- a/net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch +++ /dev/null @@ -1,117 +0,0 @@ -Path: news.gmane.org!not-for-mail -From: Jesper Dangaard Brouer -Newsgroups: gmane.linux.network -Subject: [net PATCH V2] net: fix divide by zero in tcp algorithm illinois -Date: Wed, 31 Oct 2012 13:45:32 +0100 -Lines: 63 -Approved: news@gmane.org -Message-ID: <20121031124318.30915.32293.stgit@dragon> -NNTP-Posting-Host: plane.gmane.org -Mime-Version: 1.0 -Content-Type: text/plain; charset="utf-8" -Content-Transfer-Encoding: 7bit -X-Trace: ger.gmane.org 1351687472 19921 80.91.229.3 (31 Oct 2012 12:44:32 GMT) -X-Complaints-To: usenet@ger.gmane.org -NNTP-Posting-Date: Wed, 31 Oct 2012 12:44:32 +0000 (UTC) -Cc: Jesper Dangaard Brouer , netdev@vger.kernel.org, - Petr Matousek , - Stephen Hemminger , - Eric Dumazet -To: "David S. Miller" -Original-X-From: netdev-owner@vger.kernel.org Wed Oct 31 13:44:40 2012 -Return-path: -Envelope-to: linux-netdev-2@plane.gmane.org -Original-Received: from vger.kernel.org ([209.132.180.67]) - by plane.gmane.org with esmtp (Exim 4.69) - (envelope-from ) - id 1TTXex-0002V3-Qk - for linux-netdev-2@plane.gmane.org; Wed, 31 Oct 2012 13:44:40 +0100 -Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand - id S932565Ab2JaMo0 (ORCPT ); - Wed, 31 Oct 2012 08:44:26 -0400 -Original-Received: from mx1.redhat.com ([209.132.183.28]:57345 "EHLO mx1.redhat.com" - rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP - id S1751941Ab2JaMoZ (ORCPT ); - Wed, 31 Oct 2012 08:44:25 -0400 -Original-Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) - by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q9VCiOkC014655 - (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); - Wed, 31 Oct 2012 08:44:24 -0400 -Original-Received: from dragon.localdomain (ovpn-116-61.ams2.redhat.com [10.36.116.61]) - by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q9VCiMuW008440; - Wed, 31 Oct 2012 08:44:23 -0400 -Original-Received: from [127.0.0.1] (localhost [IPv6:::1]) - by dragon.localdomain (Postfix) with ESMTP id 416D0E40666; - Wed, 31 Oct 2012 13:45:32 +0100 (CET) -User-Agent: StGIT/0.14.3 -X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 -Original-Sender: netdev-owner@vger.kernel.org -Precedence: bulk -List-ID: -X-Mailing-List: netdev@vger.kernel.org -Xref: news.gmane.org gmane.linux.network:247871 -Archived-At: - -Reading TCP stats when using TCP Illinois congestion control algorithm -can cause a divide by zero kernel oops. - -The division by zero occur in tcp_illinois_info() at: - do_div(t, ca->cnt_rtt); -where ca->cnt_rtt can become zero (when rtt_reset is called) - -Steps to Reproduce: - 1. Register tcp_illinois: - # sysctl -w net.ipv4.tcp_congestion_control=illinois - 2. Monitor internal TCP information via command "ss -i" - # watch -d ss -i - 3. Establish new TCP conn to machine - -Either it fails at the initial conn, or else it needs to wait -for a loss or a reset. - -This is only related to reading stats. The function avg_delay() also -performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its -calling point in update_params(). Thus, simply fix tcp_illinois_info(). - -Function tcp_illinois_info() / get_info() is called without -socket lock. Thus, eliminate any race condition on ca->cnt_rtt -by using a local stack variable. Simply reuse info.tcpv_rttcnt, -as its already set to ca->cnt_rtt. -Function avg_delay() is not affected by this race condition, as -its called with the socket lock. - -Cc: Petr Matousek -Signed-off-by: Jesper Dangaard Brouer - ---- -V2: - Address Eric Dumazets input: - - Save 2 bytes of stack, by using info.tcpv_rttcnt. - - Help compiler, and define "u64 t" inside if() lexical scope. - - - net/ipv4/tcp_illinois.c | 8 +++++--- - 1 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c -index 813b43a..834857f 100644 ---- a/net/ipv4/tcp_illinois.c -+++ b/net/ipv4/tcp_illinois.c -@@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext, - .tcpv_rttcnt = ca->cnt_rtt, - .tcpv_minrtt = ca->base_rtt, - }; -- u64 t = ca->sum_rtt; - -- do_div(t, ca->cnt_rtt); -- info.tcpv_rtt = t; -+ if (info.tcpv_rttcnt > 0) { -+ u64 t = ca->sum_rtt; - -+ do_div(t, info.tcpv_rttcnt); -+ info.tcpv_rtt = t; -+ } - nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info); - } - } - diff --git a/sources b/sources index d3c14f4..0d260fa 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ 1a1760420eac802c541a20ab51a093d1 linux-3.6.tar.xz -11d6d8749d4612a77f43f0531c0f2824 patch-3.6.6.xz +134936c362d8812b5cafcf3c67afdce0 patch-3.6.7.xz diff --git a/usb-audio-fix-crash-at-re-preparing-the-PCM-stream.patch b/usb-audio-fix-crash-at-re-preparing-the-PCM-stream.patch index 6d840ea..9f3e6f9 100644 --- a/usb-audio-fix-crash-at-re-preparing-the-PCM-stream.patch +++ b/usb-audio-fix-crash-at-re-preparing-the-PCM-stream.patch @@ -105,8 +105,8 @@ index 37428f7..5c12a3f 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -552,6 +552,9 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) - if (snd_BUG_ON(!subs->data_endpoint)) - return -EIO; + goto unlock; + } + snd_usb_endpoint_sync_pending_stop(subs->sync_endpoint); + snd_usb_endpoint_sync_pending_stop(subs->data_endpoint);