- [kernel] perf: fix perf_swevent_enabled array out-of-bound access (Petr Matousek) [962793 962794] {CVE-2013-2094}

- [kernel] perf: fix perf_swevent_enabled array out-of-bound access (Petr Matousek) [962793 962794] {CVE-2013-2094}

- [virt] kvm: accept unaligned MSR_KVM_SYSTEM_TIME writes (Petr Matousek) [917020 917021] {CVE-2013-1796}
- [char] tty: hold lock across tty buffer finding and buffer filling (Prarit Bhargava) [928686 901780]
- [net] tcp: fix for zero packets_in_flight was too broad (Thomas Graf) [927309 920794]
- [net] tcp: frto should not set snd_cwnd to 0 (Thomas Graf) [927309 920794]
- [net] tcp: fix an infinite loop in tcp_slow_start() (Thomas Graf) [927309 920794]
- [net] tcp: fix ABC in tcp_slow_start() (Thomas Graf) [927309 920794]
- [netdrv] ehea: avoid accessing a NULL vgrp (Steve Best) [921535 911359]
- [net] sunrpc: Get rid of the redundant xprt->shutdown bit field (J. Bruce Fields) [915579 893584]
- [virt] kvm: do not #GP on unaligned MSR_KVM_SYSTEM_TIME write (Gleb Natapov) [917020 917021] {CVE-2013-1796}
- [drm] i915: bounds check execbuffer relocation count (Nikola Pajkovsky) [920523 920525] {CVE-2013-0913}
- [x86] irq: add quirk for broken interrupt remapping on 55XX chipsets (Neil Horman) [911267 887006]
- [kvm] Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (Gleb Natapov) [917024 917025] {CVE-2013-1797}
- [kvm] Fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (Gleb Natapov) [917020 917021] {CVE-2013-1796}
- [kvm] Fix bounds checking in ioapic indirect register reads (Gleb Natapov) [917030 917032] {CVE-2013-1798}
- [kvm] x86: release kvmclock page on reset (Gleb Natapov) [917024 917025] {CVE-2013-1797}
- [security] keys: Fix race with concurrent install_user_keyrings() (David Howells) [916681 913258] {CVE-2013-1792}
- [virt] hv_balloon: Make adjustments to the pressure report (Jason Wang) [909156 902232]

- [kernel] utrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL (Oleg Nesterov) [912073 912074] {CVE-2013-0871}

- [kernel] utrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL (Oleg Nesterov) [912073 912074] {CVE-2013-0871}

- [fs] Fix sget() race with failing mount (Eric Sandeen) [883276]

- [virt] kvm: invalid opcode oops on SET_SREGS with OSXSAVE bit set (Petr Matousek) [862903 862904] {CVE-2012-4461}
- [fs] fuse: optimize __fuse_direct_io() (Brian Foster) [865305 858850]
- [fs] fuse: optimize fuse_get_user_pages() (Brian Foster) [865305 858850]
- [fs] fuse: use get_user_pages_fast() (Brian Foster) [865305 858850]
- [fs] fuse: pass iov[] to fuse_get_user_pages() (Brian Foster) [865305 858850]
- [fs] mm: minor cleanup of iov_iter_single_seg_count() (Brian Foster) [865305 858850]
- [fs] fuse: use req->page_descs[] for argpages cases (Brian Foster) [865305 858850]
- [fs] fuse: add per-page descriptor <offset, length> to fuse_req (Brian Foster) [865305 858850]
- [fs] fuse: rework fuse_do_ioctl() (Brian Foster) [865305 858850]
- [fs] fuse: rework fuse_perform_write() (Brian Foster) [865305 858850]
- [fs] fuse: rework fuse_readpages() (Brian Foster) [865305 858850]
- [fs] fuse: categorize fuse_get_req() (Brian Foster) [865305 858850]
- [fs] fuse: general infrastructure for pages[] of variable size (Brian Foster) [865305 858850]
- [fs] exec: do not leave bprm->interp on stack (Josh Poimboeuf) [880145 880146] {CVE-2012-4530}
- [fs] exec: use -ELOOP for max recursion depth (Josh Poimboeuf) [880145 880146] {CVE-2012-4530}
- [scsi] have scsi_internal_device_unblock take new state (Frantisek Hrbata) [878774 854140]
- [scsi] add new SDEV_TRANSPORT_OFFLINE state (Chris Leech) [878774 854140]
- [kernel] cpu: fix cpu_chain section mismatch (Frederic Weisbecker) [876090 852148]
- [kernel] sched: Don't modify cpusets during suspend/resume (Frederic Weisbecker) [876090 852148]
- [kernel] sched, cpuset: Drop __cpuexit from cpu hotplug callbacks (Frederic Weisbecker) [876090 852148]
- [kernel] sched: adjust when cpu_active and cpuset configurations are updated during cpu on/offlining (Frantisek Hrbata) [876090 852148]
- [kernel] cpu: return better errno on cpu hotplug failure (Frederic Weisbecker) [876090 852148]
- [kernel] cpu: introduce cpu_notify(), __cpu_notify(), cpu_notify_nofail() (Frederic Weisbecker) [876090 852148]
- [fs] nfs: Properly handle the case where the delegation is revoked (Steve Dickson) [846840 842435]
- [fs] nfs: Move cl_delegations to the nfs_server struct (Steve Dickson) [846840 842435]
- [fs] nfs: Introduce nfs_detach_delegations() (Steve Dickson) [846840 842435]
- [fs] nfs: Fix a number of RCU issues in the NFSv4 delegation code (Steve Dickson) [846840 842435]

- [drm] i915: don't clobber the pipe param in sanitize_modesetting (Frantisek Hrbata) [876549 857792]
- [drm] i915: Sanitize BIOS debugging bits from PIPECONF (Frantisek Hrbata) [876549 857792]
- [net] fix divide by zero in tcp algorithm illinois (Flavio Leitner) [871920 866514] {CVE-2012-4565}
- [fs] xfs: fix reading of wrapped log data (Dave Chinner) [876499 874322]
- [x86] mm: fix signedness issue in mmap_rnd() (Petr Matousek) [876496 875036]
- [net] WARN if struct ip_options was allocated directly by kmalloc (Jiri Pirko) [877950 872799]
- [fs] block_dev: Fix crash when block device is read and block size is changed at the same time (Frantisek Hrbata) [864826 855906]
- [mm] tracing: Move include of trace/events/kmem.h out of header into slab.c (Jeff Moyer) [864826 855906]
- [mm] slab: Move kmalloc tracepoint out of inline code (Jeff Moyer) [864826 855906]
- [netdrv] bnx2x: organize BDs calculation for stop/resume (Frantisek Hrbata) [874022 819842]
- [netdrv] bnx2x: fix panic when TX ring is full (Michal Schmidt) [874022 819842]

- [usb] usbhid: Fix use-after-free in USBHID (James Paradis) [864827 857518]
- [usb] Add kernel parameter to force io_watchdog for Intel EHCI HCD (James Paradis) [865713 846024]
- [block] Fix hanging kernel threads in blk_execute_rq() (James Paradis) [865308 855984]
- [mm] hugetlb: do not use vma_hugecache_offset() for vma_prio_tree_foreach (Frederic Weisbecker) [843034 843035] {CVE-2012-2133}
- [mm] hugepages: fix use after free bug in "quota" handling (Frederic Weisbecker) [843034 843035] {CVE-2012-2133}
- [mm] hugetlb: fix pgoff computation when unmapping page from vma (Frederic Weisbecker) [843034 843035] {CVE-2012-2133}
- [mm] hugetlb: fix ENOSPC returned by handle_mm_fault() (Frederic Weisbecker) [843034 843035] {CVE-2012-2133}
- [fs] gfs2: Write out dirty inode metadata in delayed deletes (Frantisek Hrbata) [859326 748827]
- [usb] core: Fix device removal race condition (James Paradis) [864821 849188]
- [mm] x86_32: fix SHLIB_BASE address typo (Aristeu S. Rozanski F) [804955 804956] {CVE-2012-1568}
- [hid] hidraw: fix window in hidraw_release (Don Zickus) [841824 839973]
- [hid] hidraw: protect hidraw_disconnect() better (Don Zickus) [841824 839973]
- [hid] hidraw: remove excessive _EMERG messages from hidraw (Don Zickus) [841824 839973]
- [hid] hidraw: fix hidraw_disconnect() (Don Zickus) [841824 839973]
- [hid] fix a NULL pointer dereference in hidraw_write (Don Zickus) [841824 839973]
- [hid] fix a NULL pointer dereference in hidraw_ioctl (Don Zickus) [841824 839973]
- [hid] remove BKL from hidraw (Don Zickus) [841824 839973]
- [mm] x86_32: randomize SHLIB_BASE (Aristeu Rozanski) [804955 804956] {CVE-2012-1568}
- [block] fix up use after free in __blkdev_get (Jeff Moyer) [853943 847838]
- [scsi] remove no longer valid BUG_ON in scsi_lld_busy (Jeff Garzik) [860640 842881]
- [scsi] fix NULL request_queue in scsi_requeue_run_queue() (Jeff Garzik) [860640 842881]
- [net] svcrpc: fix BUG() in svc_tcp_clear_pages (J. Bruce Fields) [856106 769045]
- [scsi] lpfc: Fixed SCSI device reset escalation (Rob Evers) [861390 827566]
- [scsi] lpfc: Fix abort status (Rob Evers) [861390 827566]
- [kernel] cgroup: add cgroup_root_mutex (Frederic Weisbecker) [858954 844531]
- [mm] Hold a file reference in madvise_remove (Jerome Marchand) [849738 849739] {CVE-2012-3511}
- [base] driver-core: fix device_register race (Rob Evers) [860784 833098]
- [netdrv] e1000e: drop check of RXCW.CW to eliminate link going up and down (Dean Nelson) [857055 847310]
- [scsi] be2iscsi: Format the MAC_ADDR with sysfs (Rob Evers) [863147 827594]
- [usb] usbdevfs: Add a USBDEVFS_GET_CAPABILITIES ioctl (Don Zickus) [841667 828271]
- [fs] udf: fix retun value on error path in udf_load_logicalvol (Nikola Pajkovsky) [843142 843143] {CVE-2012-3400}
- [fs] udf: Improve table length check to avoid possible overflow (Nikola Pajkovsky) [843142 843143] {CVE-2012-3400}
- [fs] udf: Fortify loading of sparing table (Nikola Pajkovsky) [843142 843143] {CVE-2012-3400}
- [fs] udf: Avoid run away loop when partition table length is corrupted (Nikola Pajkovsky) [843142 843143] {CVE-2012-3400}
- [fs] udf: Use 'ret' instead of abusing 'i' in udf_load_logicalvol() (Nikola Pajkovsky) [843142 843143] {CVE-2012-3400}
- [netdrv] bnx2x: Add remote-fault link detection (Michal Schmidt) [852450 814877]
- [net] sunrpc: svc_xprt sends on closed socket should stop immediately (J. Bruce Fields) [853257 849702]
- [mm] Never OOM kill tasks outside of memory cgroup when memory.limit_in_bytes is exceeded by a Transparent Huge Page (Larry Woodman) [860942 811255]
- [powerpc] pseries: Support lower minimum entitlement for virtual processors (Steve Best) [860165 822651]
- [usbhid] hiddev: Consolidate device existence checks in hiddev_ioctl (Don Zickus) [841824 839973]
- [usbhid] hiddev: Fix race between disconnect and hiddev_ioctl (Don Zickus) [841824 839973]
- [usbhid] hiddev: protect against disconnect/NULL-dereference race (Don Zickus) [841824 839973]
- [crypto] algapi: Move larval completion into algboss (Herbert Xu) [854476 832135]
- [fs] xfs: disable xfsaild idle mode (Brian Foster) [860787 813137]
- [fs] xfs: fix the logspace waiting algorithm (Brian Foster) [860787 813137]
- [fs] xfs: add AIL pushing tracepoints (Brian Foster) [860787 813137]
- [fs] xfs: force the log if we encounter pinned buffers in .iop_pushbuf (Brian Foster) [860787 813137]
- [fs] xfs: do not update xa_last_pushed_lsn for locked items (Brian Foster) [860787 813137]

- [net] core: Fix napi_gro_frags vs netpoll path (Amerigo Wang) [857854 845347]
- [netdrv] benet: disable BH in callers of be_process_mcc() (Amerigo Wang) [857854 845347]
- [net] bonding: remove IFF_IN_NETPOLL flag (Amerigo Wang) [857854 845347]
- [mm] fix contig_page_data kABI breakage and related memory corruption (Satoru Moriya) [857012 853007]
- [net] sctp: backport sctp cache ipv6 source after route lookup (Michele Baldessari) [858284 855759]
- [net] sctp: backport support of sctp multi-homing ipv6 source address selection (Michele Baldessari) [858284 855759]
- [net] ipv6: backport RTA_PREFSRC ipv6 source route selection support (Michele Baldessari) [858285 851118]
- [netdrv] sfc: Fix maximum number of TSO segments and minimum TX queue size (Nikolay Aleksandrov) [845556 845557] {CVE-2012-3412}
- [s390] zfcp: No automatic port_rescan on events (Hendrik Brueckner) [856316 855131]
- [fs] xfs: push the AIL from memory reclaim and periodic sync (Dave Chinner) [856686 855139]

- [md] raid1, raid10: avoid deadlock during resync/recovery. (Dave Wysochanski) [845464 835613]
- [fs] dlm: fix deadlock between dlm_send and dlm_controld (David Teigland) [849051 824964]
- [ata] libata: Add space to fix 2GB ATA Flash Disk/ADMA428M blacklist (Prarit Bhargava) [851445 843849]
- [fs] nfs: nfs_attr_use_mounted_on_file() missing return value (Frantisek Hrbata) [847945 842312]
- [fs] gfs2: Make gfs2_write_end not dirty the inode with every write (Robert S Peterson) [849551 844814]
- [net] sched/act_mirred: do not drop packets when fails to mirror it (Jason Wang) [851444 846585]
- [net] sched: fix race in mirred device removal (Jason Wang) [851444 846585]
- [net] sched: printk message severity (Jason Wang) [851444 846585]
- [net] sched: act_mirred cleanup (Jason Wang) [851444 846585]
- [kernel] sched: Fix signed unsigned comparison in check_preempt_tick() (Frederic Weisbecker) [843102 835797]
- [netdrv] be2net: reduce gso_max_size setting to account for ethernet header (Ivan Vecera) [842757 834185]
- [powerpc] Fix wrong divisor in usecs_to_cputime backport (Steve Best) [847727 821374]
- [fs] procfs: do not confuse jiffies with cputime64_t (Frantisek Hrbata) [847727 821374]
- [kernel] time: Add nsecs_to_cputime64 interface for asm-generic (Steve Best) [847727 821374]
- [powerpc] Fix wrong divisor in usecs_to_cputime (Steve Best) [847727 821374]

- [net] 8021q/vlan: filter device events on bonds (Neil Horman) [842429 841983]

- [kernel] Prevent keyctl new_session from causing a panic (David Howells) [833433 827424] {CVE-2012-2745}
- [net] ipv6/netfilter: fix null pointer dereference in nf_ct_frag6_reasm() (Petr Matousek) [833410 833412] {CVE-2012-2744}
- [fs] nfs: Map minor mismatch error to protocol not support error (Steve Dickson) [832365 796352]
- [fs] ext4: Fix overflow caused by missing cast in ext4_fallocate() (Lukas Czerner) [833034 830209]
- [ata] libata: Add 2GB ATA Flash Disk/ADMA428M to DMA blacklist (Prarit Bhargava) [832363 812904]
- [netdrv] r8169: fix typo in firmware filenames (Ivan Vecera) [832359 829211]

- [scsi] fcoe: Do not switch context in vport_delete callback (Neil Horman) [809388 806119]

- Revert: [fs] NFSv4: include bitmap in nfsv4 get acl data (Sachin Prabhu) [753231 753232] {CVE-2011-4131}