diff --git a/execve-improve-interactivity-with-large-arguments.patch b/execve-improve-interactivity-with-large-arguments.patch deleted file mode 100644 index 7908e6c..0000000 --- a/execve-improve-interactivity-with-large-arguments.patch +++ /dev/null @@ -1,36 +0,0 @@ -From: Roland McGrath -Date: Wed, 8 Sep 2010 02:36:28 +0000 (-0700) -Subject: execve: improve interactivity with large arguments -X-Git-Tag: v2.6.36-rc4~13 -X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=7993bc1f4663c0db67bb8f0d98e6678145b387cd - -execve: improve interactivity with large arguments - -This adds a preemption point during the copying of the argument and -environment strings for execve, in copy_strings(). There is already -a preemption point in the count() loop, so this doesn't add any new -points in the abstract sense. - -When the total argument+environment strings are very large, the time -spent copying them can be much more than a normal user time slice. -So this change improves the interactivity of the rest of the system -when one process is doing an execve with very large arguments. - -Signed-off-by: Roland McGrath -Reviewed-by: KOSAKI Motohiro -Signed-off-by: Linus Torvalds ---- - -diff --git a/fs/exec.c b/fs/exec.c -index 1b63237..6f2d777 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -419,6 +419,8 @@ static int copy_strings(int argc, const char __user *const __user *argv, - while (len > 0) { - int offset, bytes_to_copy; - -+ cond_resched(); -+ - offset = pos % PAGE_SIZE; - if (offset == 0) - offset = PAGE_SIZE; diff --git a/execve-make-responsive-to-sigkill-with-large-arguments.patch b/execve-make-responsive-to-sigkill-with-large-arguments.patch deleted file mode 100644 index a9e531a..0000000 --- a/execve-make-responsive-to-sigkill-with-large-arguments.patch +++ /dev/null @@ -1,51 +0,0 @@ -From: Roland McGrath -Date: Wed, 8 Sep 2010 02:37:06 +0000 (-0700) -Subject: execve: make responsive to SIGKILL with large arguments -X-Git-Tag: v2.6.36-rc4~12 -X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=9aea5a65aa7a1af9a4236dfaeb0088f1624f9919 - -execve: make responsive to SIGKILL with large arguments - -An execve with a very large total of argument/environment strings -can take a really long time in the execve system call. It runs -uninterruptibly to count and copy all the strings. This change -makes it abort the exec quickly if sent a SIGKILL. - -Note that this is the conservative change, to interrupt only for -SIGKILL, by using fatal_signal_pending(). It would be perfectly -correct semantics to let any signal interrupt the string-copying in -execve, i.e. use signal_pending() instead of fatal_signal_pending(). -We'll save that change for later, since it could have user-visible -consequences, such as having a timer set too quickly make it so that -an execve can never complete, though it always happened to work before. - -Signed-off-by: Roland McGrath -Reviewed-by: KOSAKI Motohiro -Signed-off-by: Linus Torvalds ---- - -diff --git a/fs/exec.c b/fs/exec.c -index 6f2d777..828dd24 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -376,6 +376,9 @@ static int count(const char __user * const __user * argv, int max) - argv++; - if (i++ >= max) - return -E2BIG; -+ -+ if (fatal_signal_pending(current)) -+ return -ERESTARTNOHAND; - cond_resched(); - } - } -@@ -419,6 +422,10 @@ static int copy_strings(int argc, const char __user *const __user *argv, - while (len > 0) { - int offset, bytes_to_copy; - -+ if (fatal_signal_pending(current)) { -+ ret = -ERESTARTNOHAND; -+ goto out; -+ } - cond_resched(); - - offset = pos % PAGE_SIZE; diff --git a/kernel.spec b/kernel.spec index 9bbccfc..0ef8362 100644 --- a/kernel.spec +++ b/kernel.spec @@ -47,7 +47,7 @@ Summary: The Linux kernel # reset this by hand to 1 (or to 0 and then use rpmdev-bumpspec). # scripts/rebase.sh should be made to do that for you, actually. # -%global baserelease 171 +%global baserelease 172 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -61,7 +61,7 @@ Summary: The Linux kernel # Do we have a -stable update to apply? %define stable_update 25 # Is it a -stable RC? -%define stable_rc 1 +%define stable_rc 0 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev .%{stable_update} @@ -835,19 +835,6 @@ Patch14130: kvm-mmu-fix-conflict-access-permissions-in-direct-sp.patch Patch14200: net-do-not-check-capable-if-kernel.patch -# Mitigate DOS with large argument lists -Patch14210: execve-improve-interactivity-with-large-arguments.patch -Patch14211: execve-make-responsive-to-sigkill-with-large-arguments.patch -Patch14212: setup_arg_pages-diagnose-excessive-argument-size.patch - -Patch14220: xen-fix-typo-in-xen-irq-fix.patch - -# rhbz#447489 -Patch14224: skge-quirk-to-4gb-dma.patch - -# rhbz#629158 -Patch14225: r8169-fix-dma-allocations.patch - # rhbz#596475 Patch14226: add-support-for-ricoh-e822-sdhci.patch @@ -1552,20 +1539,6 @@ ApplyPatch kvm-mmu-fix-conflict-access-permissions-in-direct-sp.patch # rhbz #598796 ApplyPatch net-do-not-check-capable-if-kernel.patch -# Mitigate DOS with large argument lists -#ApplyPatch execve-improve-interactivity-with-large-arguments.patch -#ApplyPatch execve-make-responsive-to-sigkill-with-large-arguments.patch -#ApplyPatch setup_arg_pages-diagnose-excessive-argument-size.patch - -# Fix typo in Xen patch from 2.6.22 that causes hang on boot. -#ApplyPatch xen-fix-typo-in-xen-irq-fix.patch - -# rhbz#629158 -#ApplyPatch r8169-fix-dma-allocations.patch - -# rhbz#447489 -#ApplyPatch skge-quirk-to-4gb-dma.patch - # rhbz#596475 ApplyPatch add-support-for-ricoh-e822-sdhci.patch @@ -2221,6 +2194,9 @@ fi %kernel_variant_files -k vmlinux %{with_kdump} kdump %changelog +* Fri Oct 29 2010 Chuck Ebbert 2.6.32.25-172 +- Linux 2.6.32.25 + * Fri Oct 22 2010 Chuck Ebbert 2.6.32.25-171.rc1 - Linux 2.6.32.25-rc1 - Comment out patches merged upstream: diff --git a/r8169-fix-dma-allocations.patch b/r8169-fix-dma-allocations.patch deleted file mode 100644 index aa1e52d..0000000 --- a/r8169-fix-dma-allocations.patch +++ /dev/null @@ -1,199 +0,0 @@ -diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c -index 62e784a..6608094 100644 ---- a/drivers/net/r8169.c -+++ b/drivers/net/r8169.c -@@ -1201,7 +1201,8 @@ static void rtl8169_update_counters(struct net_device *dev) - if ((RTL_R8(ChipCmd) & CmdRxEnb) == 0) - return; - -- counters = pci_alloc_consistent(tp->pci_dev, sizeof(*counters), &paddr); -+ counters = dma_alloc_coherent(&tp->pci_dev->dev, sizeof(*counters), -+ &paddr, GFP_KERNEL); - if (!counters) - return; - -@@ -1222,7 +1223,8 @@ static void rtl8169_update_counters(struct net_device *dev) - RTL_W32(CounterAddrLow, 0); - RTL_W32(CounterAddrHigh, 0); - -- pci_free_consistent(tp->pci_dev, sizeof(*counters), counters, paddr); -+ dma_free_coherent(&tp->pci_dev->dev, sizeof(*counters), counters, -+ paddr); - } - - static void rtl8169_get_ethtool_stats(struct net_device *dev, -@@ -3300,13 +3302,13 @@ static int rtl8169_open(struct net_device *dev) - * Rx and Tx desscriptors needs 256 bytes alignment. - * pci_alloc_consistent provides more. - */ -- tp->TxDescArray = pci_alloc_consistent(pdev, R8169_TX_RING_BYTES, -- &tp->TxPhyAddr); -+ tp->TxDescArray = dma_alloc_coherent(&pdev->dev, R8169_TX_RING_BYTES, -+ &tp->TxPhyAddr, GFP_KERNEL); - if (!tp->TxDescArray) - goto out; - -- tp->RxDescArray = pci_alloc_consistent(pdev, R8169_RX_RING_BYTES, -- &tp->RxPhyAddr); -+ tp->RxDescArray = dma_alloc_coherent(&pdev->dev, R8169_RX_RING_BYTES, -+ &tp->RxPhyAddr, GFP_KERNEL); - if (!tp->RxDescArray) - goto err_free_tx_0; - -@@ -3337,11 +3339,11 @@ out: - err_release_ring_2: - rtl8169_rx_clear(tp); - err_free_rx_1: -- pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray, -- tp->RxPhyAddr); -+ dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray, -+ tp->RxPhyAddr); - err_free_tx_0: -- pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray, -- tp->TxPhyAddr); -+ dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray, -+ tp->TxPhyAddr); - goto out; - } - -@@ -3974,7 +3976,7 @@ static void rtl8169_free_rx_skb(struct rtl8169_private *tp, - { - struct pci_dev *pdev = tp->pci_dev; - -- pci_unmap_single(pdev, le64_to_cpu(desc->addr), tp->rx_buf_sz, -+ dma_unmap_single(&pdev->dev, le64_to_cpu(desc->addr), tp->rx_buf_sz, - PCI_DMA_FROMDEVICE); - dev_kfree_skb(*sk_buff); - *sk_buff = NULL; -@@ -3999,7 +4001,7 @@ static inline void rtl8169_map_to_asic(struct RxDesc *desc, dma_addr_t mapping, - static struct sk_buff *rtl8169_alloc_rx_skb(struct pci_dev *pdev, - struct net_device *dev, - struct RxDesc *desc, int rx_buf_sz, -- unsigned int align) -+ unsigned int align, gfp_t gfp) - { - struct sk_buff *skb; - dma_addr_t mapping; -@@ -4007,13 +4009,13 @@ static struct sk_buff *rtl8169_alloc_rx_skb(struct pci_dev *pdev, - - pad = align ? align : NET_IP_ALIGN; - -- skb = netdev_alloc_skb(dev, rx_buf_sz + pad); -+ skb = __netdev_alloc_skb(dev, rx_buf_sz + pad, gfp); - if (!skb) - goto err_out; - - skb_reserve(skb, align ? ((pad - 1) & (unsigned long)skb->data) : pad); - -- mapping = pci_map_single(pdev, skb->data, rx_buf_sz, -+ mapping = dma_map_single(&pdev->dev, skb->data, rx_buf_sz, - PCI_DMA_FROMDEVICE); - - rtl8169_map_to_asic(desc, mapping, rx_buf_sz); -@@ -4038,7 +4040,7 @@ static void rtl8169_rx_clear(struct rtl8169_private *tp) - } - - static u32 rtl8169_rx_fill(struct rtl8169_private *tp, struct net_device *dev, -- u32 start, u32 end) -+ u32 start, u32 end, gfp_t gfp) - { - u32 cur; - -@@ -4053,7 +4055,7 @@ static u32 rtl8169_rx_fill(struct rtl8169_private *tp, struct net_device *dev, - - skb = rtl8169_alloc_rx_skb(tp->pci_dev, dev, - tp->RxDescArray + i, -- tp->rx_buf_sz, tp->align); -+ tp->rx_buf_sz, tp->align, gfp); - if (!skb) - break; - -@@ -4081,7 +4083,7 @@ static int rtl8169_init_ring(struct net_device *dev) - memset(tp->tx_skb, 0x0, NUM_TX_DESC * sizeof(struct ring_info)); - memset(tp->Rx_skbuff, 0x0, NUM_RX_DESC * sizeof(struct sk_buff *)); - -- if (rtl8169_rx_fill(tp, dev, 0, NUM_RX_DESC) != NUM_RX_DESC) -+ if (rtl8169_rx_fill(tp, dev, 0, NUM_RX_DESC, GFP_KERNEL) != NUM_RX_DESC) - goto err_out; - - rtl8169_mark_as_last_descriptor(tp->RxDescArray + NUM_RX_DESC - 1); -@@ -4098,7 +4100,8 @@ static void rtl8169_unmap_tx_skb(struct pci_dev *pdev, struct ring_info *tx_skb, - { - unsigned int len = tx_skb->len; - -- pci_unmap_single(pdev, le64_to_cpu(desc->addr), len, PCI_DMA_TODEVICE); -+ dma_unmap_single(&pdev->dev, le64_to_cpu(desc->addr), len, -+ PCI_DMA_TODEVICE); - desc->opts1 = 0x00; - desc->opts2 = 0x00; - desc->addr = 0x00; -@@ -4244,7 +4247,8 @@ static int rtl8169_xmit_frags(struct rtl8169_private *tp, struct sk_buff *skb, - txd = tp->TxDescArray + entry; - len = frag->size; - addr = ((void *) page_address(frag->page)) + frag->page_offset; -- mapping = pci_map_single(tp->pci_dev, addr, len, PCI_DMA_TODEVICE); -+ mapping = dma_map_single(&tp->pci_dev->dev, addr, len, -+ PCI_DMA_TODEVICE); - - /* anti gcc 2.95.3 bugware (sic) */ - status = opts1 | len | (RingEnd * !((entry + 1) % NUM_TX_DESC)); -@@ -4318,7 +4322,8 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, - tp->tx_skb[entry].skb = skb; - } - -- mapping = pci_map_single(tp->pci_dev, skb->data, len, PCI_DMA_TODEVICE); -+ mapping = dma_map_single(&tp->pci_dev->dev, skb->data, len, -+ PCI_DMA_TODEVICE); - - tp->tx_skb[entry].len = len; - txd->addr = cpu_to_le64(mapping); -@@ -4486,8 +4491,9 @@ static inline bool rtl8169_try_rx_copy(struct sk_buff **sk_buff, - if (!skb) - goto out; - -- pci_dma_sync_single_for_cpu(tp->pci_dev, addr, pkt_size, -- PCI_DMA_FROMDEVICE); -+ -+ dma_sync_single_for_cpu(&tp->pci_dev->dev, addr, pkt_size, -+ PCI_DMA_FROMDEVICE); - skb_reserve(skb, NET_IP_ALIGN); - skb_copy_from_linear_data(*sk_buff, skb->data, pkt_size); - *sk_buff = skb; -@@ -4554,11 +4560,11 @@ static int rtl8169_rx_interrupt(struct net_device *dev, - rtl8169_rx_csum(skb, desc); - - if (rtl8169_try_rx_copy(&skb, tp, pkt_size, addr)) { -- pci_dma_sync_single_for_device(pdev, addr, -+ dma_sync_single_for_device(&pdev->dev, addr, - pkt_size, PCI_DMA_FROMDEVICE); - rtl8169_mark_to_asic(desc, tp->rx_buf_sz); - } else { -- pci_unmap_single(pdev, addr, tp->rx_buf_sz, -+ dma_unmap_single(&pdev->dev, addr, tp->rx_buf_sz, - PCI_DMA_FROMDEVICE); - tp->Rx_skbuff[entry] = NULL; - } -@@ -4584,7 +4590,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev, - count = cur_rx - tp->cur_rx; - tp->cur_rx = cur_rx; - -- delta = rtl8169_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx); -+ delta = rtl8169_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx, GFP_ATOMIC); - if (!delta && count && netif_msg_intr(tp)) - printk(KERN_INFO "%s: no Rx buffer allocated\n", dev->name); - tp->dirty_rx += delta; -@@ -4770,10 +4776,10 @@ static int rtl8169_close(struct net_device *dev) - - free_irq(dev->irq, dev); - -- pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray, -- tp->RxPhyAddr); -- pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray, -- tp->TxPhyAddr); -+ dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray, -+ tp->RxPhyAddr); -+ dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray, -+ tp->TxPhyAddr); - tp->TxDescArray = NULL; - tp->RxDescArray = NULL; - diff --git a/setup_arg_pages-diagnose-excessive-argument-size.patch b/setup_arg_pages-diagnose-excessive-argument-size.patch deleted file mode 100644 index ead972a..0000000 --- a/setup_arg_pages-diagnose-excessive-argument-size.patch +++ /dev/null @@ -1,42 +0,0 @@ -From: Roland McGrath -Date: Wed, 8 Sep 2010 02:35:49 +0000 (-0700) -Subject: setup_arg_pages: diagnose excessive argument size -X-Git-Tag: v2.6.36-rc4~14 -X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=1b528181b2ffa14721fb28ad1bd539fe1732c583 - -setup_arg_pages: diagnose excessive argument size - -The CONFIG_STACK_GROWSDOWN variant of setup_arg_pages() does not -check the size of the argument/environment area on the stack. -When it is unworkably large, shift_arg_pages() hits its BUG_ON. -This is exploitable with a very large RLIMIT_STACK limit, to -create a crash pretty easily. - -Check that the initial stack is not too large to make it possible -to map in any executable. We're not checking that the actual -executable (or intepreter, for binfmt_elf) will fit. So those -mappings might clobber part of the initial stack mapping. But -that is just userland lossage that userland made happen, not a -kernel problem. - -Signed-off-by: Roland McGrath -Reviewed-by: KOSAKI Motohiro -Signed-off-by: Linus Torvalds ---- - -diff --git a/fs/exec.c b/fs/exec.c -index 2d94552..1b63237 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -594,6 +594,11 @@ int setup_arg_pages(struct linux_binprm *bprm, - #else - stack_top = arch_align_stack(stack_top); - stack_top = PAGE_ALIGN(stack_top); -+ -+ if (unlikely(stack_top < mmap_min_addr) || -+ unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr)) -+ return -ENOMEM; -+ - stack_shift = vma->vm_end - stack_top; - - bprm->p -= stack_shift; diff --git a/skge-quirk-to-4gb-dma.patch b/skge-quirk-to-4gb-dma.patch deleted file mode 100644 index ebd146d..0000000 --- a/skge-quirk-to-4gb-dma.patch +++ /dev/null @@ -1,70 +0,0 @@ -Skge devices installed on some Gigabyte motherboards are not able to -perform 64 dma correctly due to board PCI implementation, so limit -DMA to 32bit if such boards are detected. - -Bug was reported here: -https://bugzilla.redhat.com/show_bug.cgi?id=447489 - -Signed-off-by: Stanislaw Gruszka -Tested-by: Luya Tshimbalanga ---- - drivers/net/skge.c | 22 +++++++++++++++++++++- - 1 files changed, 21 insertions(+), 1 deletions(-) - -diff --git a/drivers/net/skge.c b/drivers/net/skge.c -index a8a6358..571d4c3 100644 ---- a/drivers/net/skge.c -+++ b/drivers/net/skge.c -@@ -43,5 +43,6 @@ - #include - #include -+#include - #include - - #include "skge.h" -@@ -3869,6 +3870,8 @@ static void __devinit skge_show_addr(struct net_device *dev) - netif_info(skge, probe, skge->netdev, "addr %pM\n", dev->dev_addr); - } - -+static int only_32bit_dma; -+ - static int __devinit skge_probe(struct pci_dev *pdev, - const struct pci_device_id *ent) - { -@@ -3890,7 +3893,7 @@ static int __devinit skge_probe(struct pci_dev *pdev, - - pci_set_master(pdev); - -- if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) { -+ if (!only_32bit_dma && !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) { - using_dac = 1; - err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)); - } else if (!(err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))) { -@@ -4148,8 +4151,25 @@ static struct pci_driver skge_driver = { - .shutdown = skge_shutdown, - }; - -+#ifndef CONFIG_DMI -+#warning "DMA quirk for Gigabyte nForce boards will not be applied" -+#endif -+ -+static struct dmi_system_id skge_32bit_dma_boards[] = { -+ { -+ .ident = "Gigabyte nForce boards", -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co"), -+ DMI_MATCH(DMI_BOARD_NAME, "nForce"), -+ }, -+ }, -+ {} -+}; -+ - static int __init skge_init_module(void) - { -+ if (dmi_check_system(skge_32bit_dma_boards)) -+ only_32bit_dma = 1; - skge_debug_init(); - return pci_register_driver(&skge_driver); - } --- -1.5.5.6 diff --git a/sources b/sources index fec6be1..c0a59b1 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ 260551284ac224c3a43c4adac7df4879 linux-2.6.32.tar.bz2 -e3346e3b4b92f048b8ecded829f45cdf patch-2.6.32.24.bz2 -811287361e4449aaad026b1c2df79d63 patch-2.6.32.25-rc1.bz2 +d8fff54efff6c5f7b07e5370a5e9f119 patch-2.6.32.25.bz2 diff --git a/xen-fix-typo-in-xen-irq-fix.patch b/xen-fix-typo-in-xen-irq-fix.patch deleted file mode 100644 index 3a9fb62..0000000 --- a/xen-fix-typo-in-xen-irq-fix.patch +++ /dev/null @@ -1,13 +0,0 @@ -Fix typo in Xen patch from 2.6.35.5 - ---- linux-2.6.35.noarch.orig/drivers/xen/events.c -+++ linux-2.6.35.noarch/drivers/xen/events.c -@@ -935,7 +935,7 @@ static struct irq_chip xen_dynamic_chip - .retrigger = retrigger_dynirq, - }; - --static struct irq_chip en_percpu_chip __read_mostly = { -+static struct irq_chip xen_percpu_chip __read_mostly = { - .name = "xen-percpu", - - .disable = disable_dynirq,