Pablo Neira Ayuso [Tue, 16 Mar 2010 13:30:21 +0000 (13:30 +0000)]
netfilter: ctnetlink: fix reliable event delivery if message building fails
This patch fixes a bug that allows to lose events when reliable
event delivery mode is used, ie. if NETLINK_BROADCAST_SEND_ERROR
and NETLINK_RECV_NO_ENOBUFS socket options are set.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pablo Neira Ayuso [Thu, 18 Mar 2010 14:24:42 +0000 (14:24 +0000)]
netlink: fix NETLINK_RECV_NO_ENOBUFS in netlink_set_err()
Currently, ENOBUFS errors are reported to the socket via
netlink_set_err() even if NETLINK_RECV_NO_ENOBUFS is set. However,
that should not happen. This fixes this problem and it changes the
prototype of netlink_set_err() to return the number of sockets that
have set the NETLINK_RECV_NO_ENOBUFS socket option. This return
value is used in the next patch in these bugfix series.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Steven J. Magnani [Tue, 16 Mar 2010 05:22:44 +0000 (05:22 +0000)]
NET_DMA: free skbs periodically
Under NET_DMA, data transfer can grind to a halt when userland issues a
large read on a socket with a high RCVLOWAT (i.e., 512 KB for both).
This appears to be because the NET_DMA design queues up lots of memcpy
operations, but doesn't issue or wait for them (and thus free the
associated skbs) until it is time for tcp_recvmesg() to return.
The socket hangs when its TCP window goes to zero before enough data is
available to satisfy the read.
Periodically issue asynchronous memcpy operations, and free skbs for ones
that have completed, to prevent sockets from going into zero-window mode.
Signed-off-by: Steven J. Magnani <steve@digidescorp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pablo Neira Ayuso [Tue, 16 Mar 2010 13:30:44 +0000 (13:30 +0000)]
netlink: fix unaligned access in nla_get_be64()
This patch fixes a unaligned access in nla_get_be64() that was
introduced by myself in
a17c859849402315613a0015ac8fbf101acf0cc1.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Lennart Schulte [Wed, 17 Mar 2010 02:16:29 +0000 (02:16 +0000)]
tcp: Fix tcp_mark_head_lost() with packets == 0
A packet is marked as lost in case packets == 0, although nothing should be done.
This results in a too early retransmitted packet during recovery in some cases.
This small patch fixes this issue by returning immediately.
Signed-off-by: Lennart Schulte <lennart.schulte@nets.rwth-aachen.de>
Signed-off-by: Arnd Hannemann <hannemann@nets.rwth-aachen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Wed, 17 Mar 2010 06:04:14 +0000 (06:04 +0000)]
net: ipmr/ip6mr: fix potential out-of-bounds vif_table access
mfc_parent of cache entries is used to index into the vif_table and is
initialised from mfcctl->mfcc_parent. This can take values of to 2^16-1,
while the vif_table has only MAXVIFS (32) entries. The same problem
affects ip6mr.
Refuse invalid values to fix a potential out-of-bounds access. Unlike
the other validity checks, this is checked in ipmr_mfc_add() instead of
the setsockopt handler since its unused in the delete path and might be
uninitialized.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Yegor Yefremov [Sat, 20 Mar 2010 05:43:29 +0000 (22:43 -0700)]
KS8695: update ksp->next_rx_desc_read at the end of rx loop
There is no need to adjust the next rx descriptor after each packet,
so do it only once at the end of the routine.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Carolyn Wyborny [Fri, 19 Mar 2010 06:07:48 +0000 (06:07 +0000)]
igb: Add support for 82576 ET2 Quad Port Server Adapter
Signed-off-by: Carolyn Wyborny <carolyn.wyborny@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Greg Rose [Fri, 19 Mar 2010 03:00:31 +0000 (03:00 +0000)]
ixgbevf: Message formatting cleanups
Clean up some text output formatting.
Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Greg Rose [Fri, 19 Mar 2010 03:00:12 +0000 (03:00 +0000)]
ixgbevf: Shorten up delay timer for watchdog task
The recovery from PF reset works better when you shorten up the delay
until the watchdog task executes.
Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Greg Rose [Fri, 19 Mar 2010 02:59:52 +0000 (02:59 +0000)]
ixgbevf: Fix VF Stats accounting after reset
The counters in the 82599 Virtual Function are not clear on read. They
accumulate to the maximum value and then roll over. They are also not
cleared when the VF executes a soft reset, so it is possible they are
non-zero when the driver loads and starts. This has all been accounted
for in the code that keeps the stats up to date but there is one case
that is not. When the PF driver is reset the counters in the VF are
all reset to zero. This adds an additional accounting overhead into
the VF driver when the PF is reset under its feet. This patch adds
additional counters that are used by the VF driver to accumulate and
save stats after a PF reset has been detected. Prior to this patch
displaying the stats in the VF after the PF has reset would show
bogus data.
Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Mallikarjuna R Chilakala [Fri, 19 Mar 2010 04:41:33 +0000 (04:41 +0000)]
ixgbe: Set IXGBE_RSC_CB(skb)->DMA field to zero after unmapping the address
As per Simon Horman's feedback set IXGBE_RSC_CB(skb)->dma to zero
after unmapping HWRSC DMA address to avoid double freeing.
Signed-off-by: Mallikarjuna R Chilakala <mallikarjuna.chilakala@intel.com>
Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Vasu Dev [Fri, 19 Mar 2010 04:33:10 +0000 (04:33 +0000)]
ixgbe: fix for real_num_tx_queues update issue
Currently netdev_features_change is called before fcoe tx queues
setup is done, so this patch moves calling of netdev_features_change
after tx queues setup is done in ixgbe_init_interrupt_scheme, so
that real_num_tx_queues is updated correctly on each fcoe enable
or disable.
This allows additional fcoe queues updated correctly in vlan driver
for their correct queue selection.
Signed-off-by: Vasu Dev <vasu.dev@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
stephen hemminger [Thu, 18 Mar 2010 11:27:32 +0000 (11:27 +0000)]
TCP: check min TTL on received ICMP packets
This adds RFC5082 checks for TTL on received ICMP packets.
It adds some security against spoofed ICMP packets
disrupting GTSM protected sessions.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Herbert Xu [Thu, 18 Mar 2010 23:00:22 +0000 (23:00 +0000)]
ipv6: Remove redundant dst NULL check in ip6_dst_check
As the only path leading to ip6_dst_check makes an indirect call
through dst->ops, dst cannot be NULL in ip6_dst_check.
This patch removes this check in case it misleads people who
come across this code.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Timo Teräs [Thu, 18 Mar 2010 23:20:20 +0000 (23:20 +0000)]
ipv4: check rt_genid in dst_check
Xfrm_dst keeps a reference to ipv4 rtable entries on each
cached bundle. The only way to renew xfrm_dst when the underlying
route has changed, is to implement dst_check for this. This is
what ipv6 side does too.
The problems started after
87c1e12b5eeb7b30b4b41291bef8e0b41fc3dde9
("ipsec: Fix bogus bundle flowi") which fixed a bug causing xfrm_dst
to not get reused, until that all lookups always generated new
xfrm_dst with new route reference and path mtu worked. But after the
fix, the old routes started to get reused even after they were expired
causing pmtu to break (well it would occationally work if the rtable
gc had run recently and marked the route obsolete causing dst_check to
get called).
Signed-off-by: Timo Teras <timo.teras@iki.fi>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Steve Glendinning [Fri, 19 Mar 2010 05:18:41 +0000 (22:18 -0700)]
smsc95xx: Fix tx checksum offload for small packets
TX checksum offload does not work properly when transmitting
UDP packets with 0, 1 or 2 bytes of data. This patch works
around the problem by calculating checksums for these packets
in the driver.
Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Mallikarjuna R Chilakala [Thu, 18 Mar 2010 15:16:56 +0000 (15:16 +0000)]
ixgbe: Fix 82599 KX4 Wake on LAN issue after an improper system shutdown
Advanced Power Management is disabled for 82599 KX4 connections by
clearing GRC.APME bit, causing it to not wake the system from an
improper system shutdown. By default GRC.APME is enabled and software
is not supposed to clear these settings during adapter probe.
Signed-off-by: Mallikarjuna R Chilakala <mallikarjuna.chilakala@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Mallikarjuna R Chilakala [Thu, 18 Mar 2010 14:34:52 +0000 (14:34 +0000)]
ixgbe: Fix 82599 multispeed fiber link issues due to Tx laser flapping
Fix 82599 link issues during driver load and unload test using multi-speed
10G & 1G fiber modules. When connected back to back sometime 82599 multispeed
fiber modules would link at 1G speed instead of 10G highest speed, due to a
race condition in autotry process involving Tx laser flapping. Move autotry
autoneg-37 tx laser flapping process from multispeed module init setup
to driver unload. This will alert the link partner to restart its
autotry process when it tries to establish the link with the link partner
Signed-off-by: Mallikarjuna R Chilakala <mallikarjuna.chilakala@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Fri, 19 Mar 2010 04:18:19 +0000 (21:18 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6
Eric Dumazet [Fri, 19 Mar 2010 04:16:45 +0000 (21:16 -0700)]
net: Potential null skb->dev dereference
When doing "ifenslave -d bond0 eth0", there is chance to get NULL
dereference in netif_receive_skb(), because dev->master suddenly becomes
NULL after we tested it.
We should use ACCESS_ONCE() to avoid this (or rcu_dereference())
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Guo-Fu Tseng [Wed, 17 Mar 2010 00:09:31 +0000 (00:09 +0000)]
jme: Advance driver version number
Advance driver version number after some bug fix.
Signed-off-by: Guo-Fu Tseng <cooldavid@cooldavid.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Guo-Fu Tseng [Wed, 17 Mar 2010 00:09:30 +0000 (00:09 +0000)]
jme: Protect vlgrp structure by pause RX actions.
Temporary stop the RX IRQ, and disable (sync) tasklet or napi.
And restore it after finished the vlgrp pointer assignment.
Signed-off-by: Guo-Fu Tseng <cooldavid@cooldavid.org>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Guo-Fu Tseng [Wed, 17 Mar 2010 00:09:29 +0000 (00:09 +0000)]
jme: Fix VLAN memory leak
Fix memory leak while receiving 8021q tagged packet which is not
registered by user.
Signed-off-by: Guo-Fu Tseng <cooldavid@cooldavid.org>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Abraham Arce [Tue, 16 Mar 2010 12:24:54 +0000 (12:24 +0000)]
KS8851: Avoid NULL pointer in set rx mode
Kernel NULL pointer dereference when setting mode for IFF_MULTICAST.
Tested on SDP OMAP4430 board.
ks8851 spi1.0: message enable is 0
ks8851 spi1.0: revision 0, MAC f2:f4:2f:56:37:de, IRQ 194
Unable to handle kernel NULL pointer dereference at virtual address
00000000
pgd =
c0004000
[
00000000] *pgd=
00000000
Internal error: Oops: 5 [#1] PREEMPT SMP
last sysfs file:
Modules linked in:
CPU: 0 Not tainted (
2.6.34-rc1-01039-g38d7ed1-dirty #3)
PC is at ks8851_set_rx_mode+0x88/0x124
LR is at bitrev32+0x24/0x2c
<snip>
Backtrace:
[<
c01bfbd8>] ? (ks8851_set_rx_mode+0x0/0x124)
[<
c01d4164>] (__dev_set_rx_mode+0x0/0x90)
[<
c01dc460>] (dev_mc_add+0x0/0x78)
[<
c021f0bc>] (igmp_group_added+0x0/0x64)
[<
c021f174>] (ip_mc_inc_group+0x0/0x150)
[<
c021f3b8>] (ip_mc_up+0x0/0x64)
[<
c0219eb0>] (inetdev_event+0x0/0x3d4)
[<
c0066818>] (notifier_call_chain+0x0/0x78)
[<
c00668b8>] (__raw_notifier_call_chain+0x0/0x24)
[<
c00668dc>] (raw_notifier_call_chain+0x0/0x28)
[<
c01d7484>] (call_netdevice_notifiers+0x0/0x24)
[<
c01d7780>] (__dev_notify_flags+0x0/0x68)
[<
c01d77e8>] (dev_change_flags+0x0/0x4c)
[<
c001f0bc>] (ip_auto_config+0x0/0xf1c)
[<
c0028490>] (do_one_initcall+0x0/0x1bc)
[<
c00084dc>] (kernel_init+0x0/0x234)
Code:
e15130bc e1833012 e14130bc e5943000 (
e5934000)
---[ end trace
ed0fb00a94142792 ]---
Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by: Abraham Arce <x0066660@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alexandra Kossovsky [Fri, 19 Mar 2010 03:29:24 +0000 (20:29 -0700)]
tcp: Fix OOB POLLIN avoidance.
From: Alexandra.Kossovsky@oktetlabs.ru
Fixes kernel bugzilla #15541
Signed-off-by: David S. Miller <davem@davemloft.net>
Tilman Schmidt [Wed, 17 Mar 2010 21:22:07 +0000 (14:22 -0700)]
gigaset: fix build failure
Update the dummy LL interface to the LL interface change
introduced by commit
daab433c03c15fd642c71c94eb51bdd3f32602c8.
This fixes the build failure occurring after that commit when
enabling ISDN_DRV_GIGASET but neither ISDN_I4L nor ISDN_CAPI.
Impact: bugfix
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 16 Mar 2010 21:37:47 +0000 (14:37 -0700)]
bridge: Make first arg to deliver_clone const.
Otherwise we get a warning from the call in br_forward().
Signed-off-by: David S. Miller <davem@davemloft.net>
YOSHIFUJI Hideaki / 吉藤英明 [Mon, 15 Mar 2010 21:51:18 +0000 (21:51 +0000)]
bridge br_multicast: Don't refer to BR_INPUT_SKB_CB(skb)->mrouters_only without IGMP snooping.
Without CONFIG_BRIDGE_IGMP_SNOOPING,
BR_INPUT_SKB_CB(skb)->mrouters_only is not appropriately
initialized, so we can see garbage.
A clear option to fix this is to set it even without that
config, but we cannot optimize out the branch.
Let's introduce a macro that returns value of mrouters_only
and let it return 0 without CONFIG_BRIDGE_IGMP_SNOOPING.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Vitaliy Gusev [Tue, 16 Mar 2010 01:07:51 +0000 (01:07 +0000)]
route: Fix caught BUG_ON during rt_secret_rebuild_oneshot()
route: Fix caught BUG_ON during rt_secret_rebuild_oneshot()
Call rt_secret_rebuild can cause BUG_ON(timer_pending(&net->ipv4.rt_secret_timer)) in
add_timer as there is not any synchronization for call rt_secret_rebuild_oneshot()
for the same net namespace.
Also this issue affects to rt_secret_reschedule().
Thus use mod_timer enstead.
Signed-off-by: Vitaliy Gusev <vgusev@openvz.org>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
YOSHIFUJI Hideaki / 吉藤英明 [Mon, 15 Mar 2010 19:26:56 +0000 (19:26 +0000)]
bridge br_multicast: Fix skb leakage in error path.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
YOSHIFUJI Hideaki / 吉藤英明 [Mon, 15 Mar 2010 19:27:00 +0000 (19:27 +0000)]
bridge br_multicast: Fix handling of Max Response Code in IGMPv3 message.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jiri Slaby [Tue, 16 Mar 2010 05:29:54 +0000 (05:29 +0000)]
NET: netpoll, fix potential NULL ptr dereference
Stanse found that one error path in netpoll_setup dereferences npinfo
even though it is NULL. Avoid that by adding new label and go to that
instead.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Daniel Borkmann <danborkmann@googlemail.com>
Cc: David S. Miller <davem@davemloft.net>
Acked-by: chavey@google.com
Acked-by: Matt Mackall <mpm@selenic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Neil Horman [Tue, 16 Mar 2010 08:14:33 +0000 (08:14 +0000)]
tipc: fix lockdep warning on address assignment
So in the forward porting of various tipc packages, I was constantly
getting this lockdep warning everytime I used tipc-config to set a network
address for the protocol:
[ INFO: possible circular locking dependency detected ]
2.6.33 #1
tipc-config/1326 is trying to acquire lock:
(ref_table_lock){+.-...}, at: [<
ffffffffa0315148>] tipc_ref_discard+0x53/0xd4 [tipc]
but task is already holding lock:
(&(&entry->lock)->rlock#2){+.-...}, at: [<
ffffffffa03150d5>] tipc_ref_lock+0x43/0x63 [tipc]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&(&entry->lock)->rlock#2){+.-...}:
[<
ffffffff8107b508>] __lock_acquire+0xb67/0xd0f
[<
ffffffff8107b78c>] lock_acquire+0xdc/0x102
[<
ffffffff8145471e>] _raw_spin_lock_bh+0x3b/0x6e
[<
ffffffffa03152b1>] tipc_ref_acquire+0xe8/0x11b [tipc]
[<
ffffffffa031433f>] tipc_createport_raw+0x78/0x1b9 [tipc]
[<
ffffffffa031450b>] tipc_createport+0x8b/0x125 [tipc]
[<
ffffffffa030f221>] tipc_subscr_start+0xce/0x126 [tipc]
[<
ffffffffa0308fb2>] process_signal_queue+0x47/0x7d [tipc]
[<
ffffffff81053e0c>] tasklet_action+0x8c/0xf4
[<
ffffffff81054bd8>] __do_softirq+0xf8/0x1cd
[<
ffffffff8100aadc>] call_softirq+0x1c/0x30
[<
ffffffff810549f4>] _local_bh_enable_ip+0xb8/0xd7
[<
ffffffff81054a21>] local_bh_enable_ip+0xe/0x10
[<
ffffffff81454d31>] _raw_spin_unlock_bh+0x34/0x39
[<
ffffffffa0308eb8>] spin_unlock_bh.clone.0+0x15/0x17 [tipc]
[<
ffffffffa0308f47>] tipc_k_signal+0x8d/0xb1 [tipc]
[<
ffffffffa0308dd9>] tipc_core_start+0x8a/0xad [tipc]
[<
ffffffffa01b1087>] 0xffffffffa01b1087
[<
ffffffff8100207d>] do_one_initcall+0x72/0x18a
[<
ffffffff810872fb>] sys_init_module+0xd8/0x23a
[<
ffffffff81009b42>] system_call_fastpath+0x16/0x1b
-> #0 (ref_table_lock){+.-...}:
[<
ffffffff8107b3b2>] __lock_acquire+0xa11/0xd0f
[<
ffffffff8107b78c>] lock_acquire+0xdc/0x102
[<
ffffffff81454836>] _raw_write_lock_bh+0x3b/0x6e
[<
ffffffffa0315148>] tipc_ref_discard+0x53/0xd4 [tipc]
[<
ffffffffa03141ee>] tipc_deleteport+0x40/0x119 [tipc]
[<
ffffffffa0316e35>] release+0xeb/0x137 [tipc]
[<
ffffffff8139dbf4>] sock_release+0x1f/0x6f
[<
ffffffff8139dc6b>] sock_close+0x27/0x2b
[<
ffffffff811116f6>] __fput+0x12a/0x1df
[<
ffffffff811117c5>] fput+0x1a/0x1c
[<
ffffffff8110e49b>] filp_close+0x68/0x72
[<
ffffffff8110e552>] sys_close+0xad/0xe7
[<
ffffffff81009b42>] system_call_fastpath+0x16/0x1b
Finally decided I should fix this. Its a straightforward inversion,
tipc_ref_acquire takes two locks in this order:
ref_table_lock
entry->lock
while tipc_deleteport takes them in this order:
entry->lock (via tipc_port_lock())
ref_table_lock (via tipc_ref_discard())
when the same entry is referenced, we get the above warning. The fix is equally
straightforward. Theres no real relation between the entry->lock and the
ref_table_lock (they just are needed at the same time), so move the entry->lock
aquisition in tipc_ref_acquire down, after we unlock ref_table_lock (this is
safe since the ref_table_lock guards changes to the reference table, and we've
already claimed a slot there. I've tested the below fix and confirmed that it
clears up the lockdep issue
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
James Chapman [Tue, 16 Mar 2010 06:29:20 +0000 (06:29 +0000)]
l2tp: Fix UDP socket reference count bugs in the pppol2tp driver
This patch fixes UDP socket refcnt bugs in the pppol2tp driver.
A bug can cause a kernel stack trace when a tunnel socket is closed.
A way to reproduce the issue is to prepare the UDP socket for L2TP (by
opening a tunnel pppol2tp socket) and then close it before any L2TP
sessions are added to it. The sequence is
Create UDP socket
Create tunnel pppol2tp socket to prepare UDP socket for L2TP
pppol2tp_connect: session_id=0, peer_session_id=0
L2TP SCCRP control frame received (tunnel_id==0)
pppol2tp_recv_core: sock_hold()
pppol2tp_recv_core: sock_put
L2TP ZLB control frame received (tunnel_id=nnn)
pppol2tp_recv_core: sock_hold()
pppol2tp_recv_core: sock_put
Close tunnel management socket
pppol2tp_release: session_id=0, peer_session_id=0
Close UDP socket
udp_lib_close: BUG
The addition of sock_hold() in pppol2tp_connect() solves the problem.
For data frames, two sock_put() calls were added to plug a refcnt leak
per received data frame. The ref that is grabbed at the top of
pppol2tp_recv_core() must always be released, but this wasn't done for
accepted data frames or data frames discarded because of bad UDP
checksums. This leak meant that any UDP socket that had passed L2TP
data traffic (i.e. L2TP data frames, not just L2TP control frames)
using pppol2tp would not be released by the kernel.
WARNING: at include/net/sock.h:435 udp_lib_unhash+0x117/0x120()
Pid: 1086, comm: openl2tpd Not tainted 2.6.33-rc1 #8
Call Trace:
[<
c119e9b7>] ? udp_lib_unhash+0x117/0x120
[<
c101b871>] ? warn_slowpath_common+0x71/0xd0
[<
c119e9b7>] ? udp_lib_unhash+0x117/0x120
[<
c101b8e3>] ? warn_slowpath_null+0x13/0x20
[<
c119e9b7>] ? udp_lib_unhash+0x117/0x120
[<
c11598a7>] ? sk_common_release+0x17/0x90
[<
c11a5e33>] ? inet_release+0x33/0x60
[<
c11577b0>] ? sock_release+0x10/0x60
[<
c115780f>] ? sock_close+0xf/0x30
[<
c106e542>] ? __fput+0x52/0x150
[<
c106b68e>] ? filp_close+0x3e/0x70
[<
c101d2e2>] ? put_files_struct+0x62/0xb0
[<
c101eaf7>] ? do_exit+0x5e7/0x650
[<
c1081623>] ? mntput_no_expire+0x13/0x70
[<
c106b68e>] ? filp_close+0x3e/0x70
[<
c101eb8a>] ? do_group_exit+0x2a/0x70
[<
c101ebe1>] ? sys_exit_group+0x11/0x20
[<
c10029b0>] ? sysenter_do_call+0x12/0x26
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Steve Glendinning [Tue, 16 Mar 2010 09:03:06 +0000 (09:03 +0000)]
smsc95xx: wait for PHY to complete reset during init
This patch ensures the PHY correctly completes its reset before
setting register values.
Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
James Chapman [Tue, 16 Mar 2010 06:46:31 +0000 (06:46 +0000)]
l2tp: Fix oops in pppol2tp_xmit
When transmitting L2TP frames, we derive the outgoing interface's UDP
checksum hardware assist capabilities from the tunnel dst dev. This
can sometimes be NULL, especially when routing protocols are used and
routing changes occur. This patch just checks for NULL dst or dev
pointers when checking for netdev hardware assist features.
BUG: unable to handle kernel NULL pointer dereference at
0000000c
IP: [<
f89d074c>] pppol2tp_xmit+0x341/0x4da [pppol2tp]
*pde =
00000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/class/net/lo/operstate
Modules linked in: pppol2tp pppox ppp_generic slhc ipv6 dummy loop snd_hda_codec_atihdmi snd_hda_intel snd_hda_codec snd_pcm snd_timer snd soundcore snd_page_alloc evdev psmouse serio_raw processor button i2c_piix4 i2c_core ati_agp agpgart pcspkr ext3 jbd mbcache sd_mod ide_pci_generic atiixp ide_core ahci ata_generic floppy ehci_hcd ohci_hcd libata e1000e scsi_mod usbcore nls_base thermal fan thermal_sys [last unloaded: scsi_wait_scan]
Pid: 0, comm: swapper Not tainted (2.6.32.8 #1)
EIP: 0060:[<
f89d074c>] EFLAGS:
00010297 CPU: 3
EIP is at pppol2tp_xmit+0x341/0x4da [pppol2tp]
EAX:
00000000 EBX:
f64d1680 ECX:
000005b9 EDX:
00000000
ESI:
f6b91850 EDI:
f64d16ac EBP:
f6a0c4c0 ESP:
f70a9cac
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
Process swapper (pid: 0, ti=
f70a8000 task=
f70a31c0 task.ti=
f70a8000)
Stack:
000005a9 000005b9 f734c400 f66652c0 f7352e00 f67dc800 00000000 f6b91800
<0>
000005a3 f70ef6c4 f67dcda9 000005a3 f89b192e 00000246 000005a3 f64d1680
<0>
f63633e0 f6363320 f64d1680 f65a7320 f65a7364 f65856c0 f64d1680 f679f02f
Call Trace:
[<
f89b192e>] ? ppp_push+0x459/0x50e [ppp_generic]
[<
f89b217f>] ? ppp_xmit_process+0x3b6/0x430 [ppp_generic]
[<
f89b2306>] ? ppp_start_xmit+0x10d/0x120 [ppp_generic]
[<
c11c15cb>] ? dev_hard_start_xmit+0x21f/0x2b2
[<
c11d0947>] ? sch_direct_xmit+0x48/0x10e
[<
c11c19a0>] ? dev_queue_xmit+0x263/0x3a6
[<
c11e2a9f>] ? ip_finish_output+0x1f7/0x221
[<
c11df682>] ? ip_forward_finish+0x2e/0x30
[<
c11de645>] ? ip_rcv_finish+0x295/0x2a9
[<
c11c0b19>] ? netif_receive_skb+0x3e9/0x404
[<
f814b791>] ? e1000_clean_rx_irq+0x253/0x2fc [e1000e]
[<
f814cb7a>] ? e1000_clean+0x63/0x1fc [e1000e]
[<
c1047eff>] ? sched_clock_local+0x15/0x11b
[<
c11c1095>] ? net_rx_action+0x96/0x195
[<
c1035750>] ? __do_softirq+0xaa/0x151
[<
c1035828>] ? do_softirq+0x31/0x3c
[<
c10358fe>] ? irq_exit+0x26/0x58
[<
c1004b21>] ? do_IRQ+0x78/0x89
[<
c1003729>] ? common_interrupt+0x29/0x30
[<
c101ac28>] ? native_safe_halt+0x2/0x3
[<
c1008c54>] ? default_idle+0x55/0x75
[<
c1009045>] ? c1e_idle+0xd2/0xd5
[<
c100233c>] ? cpu_idle+0x46/0x62
Code: 8d 45 08 f0 ff 45 08 89 6b 08 c7 43 68 7e fb 9c f8 8a 45 24 83 e0 0c 3c 04 75 09 80 63 64 f3 e9 b4 00 00 00 8b 43 18 8b 4c 24 04 <8b> 40 0c 8d 79 11 f6 40 44 0e 8a 43 64 75 51 6a 00 8b 4c 24 08
EIP: [<
f89d074c>] pppol2tp_xmit+0x341/0x4da [pppol2tp] SS:ESP 0068:
f70a9cac
CR2:
000000000000000c
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Steve Glendinning [Tue, 16 Mar 2010 08:46:46 +0000 (08:46 +0000)]
smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver
This patch adds a driver for SMSC's LAN7500 family of USB 2.0
to gigabit ethernet adapters. It's loosely based on the smsc95xx
driver but the device registers for LAN7500 are completely different.
Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Atsushi Nemoto [Tue, 16 Mar 2010 05:27:40 +0000 (05:27 +0000)]
ne: Do not use slashes in irq name string
This patch fixes following warning introduced by commit
12bac0d9f4dbf3445a0319beee848d15fa32775e ("proc: warn on non-existing
proc entries"):
WARNING: at /work/mips-linux/make/linux/fs/proc/generic.c:316 __xlate_proc_name+0xe0/0xe8()
name 'RBHMA4X00/RTL8019'
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jiri Slaby [Tue, 16 Mar 2010 04:53:50 +0000 (04:53 +0000)]
NET: ksz884x, fix lock imbalance
Stanse found that one error path (when alloc_skb fails) in netdev_tx
omits to unlock hw_priv->hwlock. Fix that.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Tristram Ha <Tristram.Ha@micrel.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Tilman Schmidt [Tue, 16 Mar 2010 07:04:01 +0000 (07:04 +0000)]
gigaset: correct range checking off by one error
Correct a potential array overrun due to an off by one error in the
range check on the CAPI CONNECT_REQ CIPValue parameter.
Found and reported by Dan Carpenter using smatch.
Impact: bugfix
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
Adel Gadllah [Sun, 14 Mar 2010 18:16:25 +0000 (19:16 +0100)]
iwlwifi: Silence tfds_in_queue message
Commit
a239a8b47cc0e5e6d7416a89f340beac06d5edaa introduced a
noisy message, that fills up the log very fast.
The error seems not to be fatal (the connection is stable and
performance is ok), so make it IWL_DEBUG_TX rather than IWL_ERR.
Signed-off-by: Adel Gadllah <adel.gadllah@gmail.com>
Cc: stable@kernel.org
Acked-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Felix Fietkau [Fri, 12 Mar 2010 03:02:43 +0000 (04:02 +0100)]
ath9k: fix BUG_ON triggered by PAE frames
When I initially stumbled upon sequence number problems with PAE frames
in ath9k, I submitted a patch to remove all special cases for PAE
frames and let them go through the normal transmit path.
Out of concern about crypto incompatibility issues, this change was
merged instead:
commit
6c8afef551fef87a3bf24f8a74c69a7f2f72fc82
Author: Sujith <Sujith.Manoharan@atheros.com>
Date: Tue Feb 9 10:07:00 2010 +0530
ath9k: Fix sequence numbers for PAE frames
After a lot of testing, I'm able to reliably trigger a driver crash on
rekeying with current versions with this change in place.
It seems that the driver does not support sending out regular MPDUs with
the same TID while an A-MPDU session is active.
This leads to duplicate entries in the TID Tx buffer, which hits the
following BUG_ON in ath_tx_addto_baw():
index = ATH_BA_INDEX(tid->seq_start, bf->bf_seqno);
cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
BUG_ON(tid->tx_buf[cindex] != NULL);
I believe until we actually have a reproducible case of an
incompatibility with another AP using no PAE special cases, we should
simply get rid of this mess.
This patch completely fixes my crash issues in STA mode and makes it
stay connected without throughput drops or connectivity issues even
when the AP is configured to a very short group rekey interval.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Cc: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Grazvydas Ignotas [Thu, 11 Mar 2010 15:45:26 +0000 (17:45 +0200)]
wl1251: fix potential crash
In case debugfs does not init for some reason (or is disabled
on older kernels) driver does not allocate stats.fw_stats
structure, but tries to clear it later and trips on a NULL
pointer:
Unable to handle kernel NULL pointer dereference at virtual address
00000000
PC is at __memzero+0x24/0x80
Backtrace:
[<
bf0ddb88>] (wl1251_debugfs_reset+0x0/0x30 [wl1251])
[<
bf0d6a2c>] (wl1251_op_stop+0x0/0x12c [wl1251])
[<
bf0bc228>] (ieee80211_stop_device+0x0/0x74 [mac80211])
[<
bf0b0d10>] (ieee80211_stop+0x0/0x4ac [mac80211])
[<
c02deeac>] (dev_close+0x0/0xb4)
[<
c02deac0>] (dev_change_flags+0x0/0x184)
[<
c031f478>] (devinet_ioctl+0x0/0x704)
[<
c0320720>] (inet_ioctl+0x0/0x100)
Add a NULL pointer check to fix this.
Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
Acked-by: Kalle Valo <kalle.valo@iki.fi>
Cc: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Michael Braun [Tue, 16 Mar 2010 07:26:22 +0000 (00:26 -0700)]
bridge: Fix br_forward crash in promiscuous mode
From: Michael Braun <michael-dev@fami-braun.de>
bridge: Fix br_forward crash in promiscuous mode
It's a linux-next kernel from 2010-03-12 on an x86 system and it
OOPs in the bridge module in br_pass_frame_up (called by
br_handle_frame_finish) because brdev cannot be dereferenced (its set to
a non-null value).
Adding some BUG_ON statements revealed that
BR_INPUT_SKB_CB(skb)->brdev == br-dev
(as set in br_handle_frame_finish first)
only holds until br_forward is called.
The next call to br_pass_frame_up then fails.
Digging deeper it seems that br_forward either frees the skb or passes
it to NF_HOOK which will in turn take care of freeing the skb. The
same is holds for br_pass_frame_ip. So it seems as if two independent
skb allocations are required. As far as I can see, commit
b33084be192ee1e347d98bb5c9e38a53d98d35e2 ("bridge: Avoid unnecessary
clone on forward path") removed skb duplication and so likely causes
this crash. This crash does not happen on 2.6.33.
I've therefore modified br_forward the same way br_flood has been
modified so that the skb is not freed if skb0 is going to be used
and I can confirm that the attached patch resolves the issue for me.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Herbert Xu [Tue, 16 Mar 2010 03:38:25 +0000 (20:38 -0700)]
bridge: Move NULL mdb check into br_mdb_ip_get
Since all callers of br_mdb_ip_get need to check whether the
hash table is NULL, this patch moves the check into the function.
This fixes the two callers (query/leave handler) that didn't
check it.
Reported-by: Michael Braun <michael-dev@fami-braun.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Lars Ellenberg [Tue, 16 Mar 2010 02:09:28 +0000 (19:09 -0700)]
ISDN: Add PCI ID for HFC-2S/4S Beronet Card PCIe
A few subdevice IDs seem to have been dropped when hfc_multi was
included upstream, just compare the list at
http://www.openvox.cn/viewvc/misdn/trunk/hfc_multi.c?revision=75&view=annotate#l175
with the IDs in drivers/isdn/hardware/mISDN/hfcmulti.c
Added PCIe 2 Port card and LED settings (same as PCI)
Do not use <linux/pci_ids.h> /KKe
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Karsten Keil <keil@b1-systems.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Mon, 15 Mar 2010 23:23:54 +0000 (16:23 -0700)]
Merge branch 'master' of /home/davem/src/GIT/linux-2.6/
Gerrit Renker [Sun, 14 Mar 2010 20:13:19 +0000 (20:13 +0000)]
net-2.6 [Bug-Fix][dccp]: fix oops caused after failed initialisation
dccp: fix panic caused by failed initialisation
This fixes a kernel panic reported thanks to Andre Noll:
if DCCP is compiled into the kernel and any out of the initialisation
steps in net/dccp/proto.c:dccp_init() fail, a subsequent attempt to create
a SOCK_DCCP socket will panic, since inet{,6}_create() are not prevented
from creating DCCP sockets.
This patch fixes the problem by propagating a failure in dccp_init() to
dccp_v{4,6}_init_net(), and from there to dccp_v{4,6}_init(), so that the
DCCP protocol is not made available if its initialisation fails.
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dan Carpenter [Sun, 14 Mar 2010 22:24:08 +0000 (22:24 +0000)]
myri: remove dead code
We can never reach the return statement.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Tilman Schmidt [Sun, 14 Mar 2010 12:58:05 +0000 (12:58 +0000)]
gigaset: prune use of tty_buffer_request_room
Calling tty_buffer_request_room() before tty_insert_flip_string()
is unnecessary, costs CPU and for big buffers can mess up the
multi-page allocation avoidance.
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Acked-by: Karsten Keil <keil@b1-systems.de>
CC: Alan Cox <alan@lxorguk.ukuu.org.uk>, stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Tilman Schmidt [Sun, 14 Mar 2010 12:58:05 +0000 (12:58 +0000)]
gigaset: correct clearing of at_state strings on RING
In RING handling, clear the table of received parameter strings in
a loop like everywhere else, instead of by enumeration which had
already gotten out of sync.
Impact: minor bugfix
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Acked-by: Karsten Keil <keil@b1-systems.de>
CC: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Tilman Schmidt [Sun, 14 Mar 2010 12:58:05 +0000 (12:58 +0000)]
gigaset: avoid registering CAPI driver more than once
Registering/unregistering the Gigaset CAPI driver when a device is
connected/disconnected causes an Oops when disconnecting two Gigaset
devices in a row, because the same capi_driver structure gets
unregistered twice. Fix by making driver registration/unregistration
a separate operation (empty in the ISDN4Linux case) called when the
main module is loaded/unloaded.
Impact: bugfix
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Acked-by: Karsten Keil <keil@b1-systems.de>
CC: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Christoph Egger [Thu, 11 Mar 2010 12:07:54 +0000 (12:07 +0000)]
obsolete config in kernel source: HSO_AUTOPM
CONFIG_HSO_AUTOPM is set by KConfig / set in the Kernel source, makefiles
and won't be ever set this way, therefor simply removing the protected
code.
Signed-off-by: Christoph Egger <siccegge@stud.informatik.uni-erlangen.de>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Christoph Egger [Thu, 11 Mar 2010 12:07:52 +0000 (12:07 +0000)]
obsolete config in kernel source: USE_INTERNAL_TIMER
CONFIG_USE_INTERNAL_TIMER seems to be the remainings of some experiment.
It is explicitely #undef-ed as not working, only referenced from one
source file and rather aged.
Hereby cleaning it from the kernel tree.
Signed-off-by: Christoph Egger <siccegge@stud.informatik.uni-erlangen.de>
Acked-by: Roel Kluin <roel.kluin@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Akinobu Mita [Thu, 11 Mar 2010 12:07:50 +0000 (12:07 +0000)]
atm: use for_each_set_bit()
Replace open-coded loop with for_each_set_bit().
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Chas Williams <chas@cmf.nrl.navy.mil>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Akinobu Mita [Thu, 11 Mar 2010 12:07:49 +0000 (12:07 +0000)]
phonet: use for_each_set_bit()
Replace open-coded loop with for_each_set_bit().
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Randy Dunlap [Fri, 12 Mar 2010 19:23:27 +0000 (19:23 +0000)]
timestamping: fix example build
Fix Makefiles so that Documentation/networking/timestamping/timestamping.c
will build when using the CONFIG_BUILD_DOCSRC kconfig option.
(timestamping.c does not build currently with its simple Makefile.)
Also fix printf format warnings.
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: Patrick Ohly <patrick.ohly@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Julia Lawall [Tue, 9 Mar 2010 11:14:11 +0000 (11:14 +0000)]
drivers/net: drop redundant memset
The region set by the call to memset is immediately overwritten by the
subsequent call to memcpy.
The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@@
expression e1,e2,e3,e4;
@@
- memset(e1,e2,e3);
memcpy(e1,e4,e3);
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ian Munsie [Thu, 11 Mar 2010 12:07:25 +0000 (12:07 +0000)]
i4l: change magic numbers in Eicon DIVA ISDN driver to symbolic names
Replace references to the '20' magic number found throughout the Eicon
ISDN driver for the length of the station_id field in the T30_INFO struct
with the T30_MAX_STATION_ID_LENGTH symbolic constant.
Signed-off-by: Ian Munsie <imunsie@au.ibm.com>
Cc: Armin Schindler <mac@melware.de>
Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: Stoyan Gaydarov <sgayda2@uiuc.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ian Munsie [Thu, 11 Mar 2010 12:07:24 +0000 (12:07 +0000)]
i4l: silence compiler warnings for array access in Eicon DIVA ISDN driver
When compiling this driver, the compiler throws the following warnings:
drivers/isdn/hardware/eicon/message.c:8426: warning: array subscript is above array bounds
drivers/isdn/hardware/eicon/message.c:8427: warning: array subscript is above array bounds
drivers/isdn/hardware/eicon/message.c:8434: warning: array subscript is above array bounds
drivers/isdn/hardware/eicon/message.c:8435: warning: array subscript is above array bounds
drivers/isdn/hardware/eicon/message.c:8436: warning: array subscript is above array bounds
drivers/isdn/hardware/eicon/message.c:8447: warning: array subscript is above array bounds
This arises from the particular semantics the driver is using to write to
the nlc array (static byte[256]). The array has a length in byte 0
followed by a T30_INFO struct starting at byte 1.
The T30_INFO struct has a number of variable length strings after the
station_id entry, which cannot be explicitly defined in the struct and the
driver accesses them with an array index to station_id beyond the length
of station_id.
This patch merely changes the semantics that the driver uses to access the
entries after the station_id entry to use the original 256 byte nlc array
taking the offset and length of the station_id entry to calculate where to
write in the array, thereby silencing the warning.
Signed-off-by: Ian Munsie <imunsie@au.ibm.com>
Cc: Armin Schindler <mac@melware.de>
Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: Stoyan Gaydarov <sgayda2@uiuc.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Roel Kluin [Thu, 11 Mar 2010 12:07:22 +0000 (12:07 +0000)]
isdn: misplaced parenthesis in pof_handle_data()
The parenthesis was misplaced.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Cc: Karsten Keil <isdn@linux-pingi.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stanislaw Gruszka [Tue, 9 Mar 2010 06:55:02 +0000 (06:55 +0000)]
bnx2x: change smp_mb() comment to conform the true
Access to fp->tx_bp_prod is protected by __netif_tx_lock,
smp_mb() is not needed for that.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stanislaw Gruszka [Tue, 9 Mar 2010 06:55:01 +0000 (06:55 +0000)]
bnx2x: remove not necessary compiler barrier
Access to fp->tx_bd_prod is protected by __netif_tx_lock, so we do not
need any barrier for that.
Update of fp->tx_bd_cons in bnx2x_tx_int() is not protected by lock, but
barrier() nor smb_mb() in bnx2x_tx_avail() not guarantee we will see
values that is written on other cpu. Ordering issues between
netif_tx_stop_queue(), netif_tx_queue_stopped(), fp->tx_bd_cons = bd_cons
and bnx2x_tx_avail() are already handled by smp_mb() in bnx2x_tx_int()
and bnx2x_start_xmit().
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stanislaw Gruszka [Tue, 9 Mar 2010 06:55:00 +0000 (06:55 +0000)]
bnx2x: use smp_mb() to keep ordering of read write operations
Since we want to keep ordering of write to fp->bd_tx_cons and
netif_tx_queue_stopped(txq), what is read of txq->state, we have to use
general memory barrier.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ajit Khaparde [Thu, 11 Mar 2010 01:35:59 +0000 (01:35 +0000)]
be2net: fix mccq create for big endian architectures
The request to create an mccq was being dispatched without
doing a byte swap of num_pages. This byte swap is necessary
for Big Endian systems like PPC. Not having this fix leads
mccq create to fail on BE ASICs running newer version of
firmware, thereby causing driver initialization failure.
Signed-off-by: Ajit Khaparde <ajitk@serverengines.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
chaithrika@ti.com [Wed, 10 Mar 2010 22:37:56 +0000 (22:37 +0000)]
TI DaVinci EMAC: Convert to dev_pm_ops
Migrate from the legacy PM hooks to use dev_pm_ops structure.
Signed-off-by: Chaithrika U S <chaithrika@ti.com>
Acked-by: Kevin Hilman <khilman@deeprootsystems.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Sekhar Nori [Tue, 9 Mar 2010 01:20:37 +0000 (01:20 +0000)]
net: davinci emac: use dma_{map, unmap}_single API for cache coherency
The davinci emac driver uses some ARM specific DMA APIs
for cache coherency which have been removed from kernel
with the 2.6.34 merge.
Modify the driver to use the dma_{map, unmap}_single() APIs
defined in dma-mapping.h
Without this fix, the driver fails to compile on Linus's
tree.
Tested on DM365 and OMAP-L138 EVMs.
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Acked-by: Kevin Hilman <khilman@deeprootsystems.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Mon, 15 Mar 2010 22:23:30 +0000 (15:23 -0700)]
e100: Fix ring parameter change handling regression.
When the PCI pool changes were added to fix resume failures:
commit
98468efddb101f8a29af974101c17ba513b07be1
e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failu
and
commit
70abc8cb90e679d8519721e2761d8366a18212a6
e100: Fix broken cbs accounting due to missing memset.
This introduced a problem that can happen if the TX ring size
is increased. We need to size the PCI pool using cbs->max
instead of the default cbs->count value.
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Mon, 15 Mar 2010 03:29:21 +0000 (20:29 -0700)]
Merge branch 'release' of git://git./linux/kernel/git/lenb/linux-acpi-2.6
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: (34 commits)
ACPI: processor: push file static MADT pointer into internal map_madt_entry()
ACPI: processor: refactor internal map_lsapic_id()
ACPI: processor: refactor internal map_x2apic_id()
ACPI: processor: refactor internal map_lapic_id()
ACPI: processor: driver doesn't need to evaluate _PDC
ACPI: processor: remove early _PDC optin quirks
ACPI: processor: add internal processor_physically_present()
ACPI: processor: move acpi_get_cpuid into processor_core.c
ACPI: processor: export acpi_get_cpuid()
ACPI: processor: mv processor_pdc.c processor_core.c
ACPI: processor: mv processor_core.c processor_driver.c
ACPI: plan to delete "acpi=ht" boot option
ACPI: remove "acpi=ht" DMI blacklist
PNPACPI: add bus number support
PNPACPI: add window support
resource: add window support
resource: add bus number support
resource: expand IORESOURCE_TYPE_BITS to make room for bus resource type
acpiphp: Execute ACPI _REG method for hotadded devices
ACPI video: Be more liberal in validating _BQC behaviour
...
Wolfram Sang [Mon, 15 Mar 2010 00:29:41 +0000 (01:29 +0100)]
init dynamic bin_attribute structures
Commit
6992f5334995af474c2b58d010d08bc597f0f2fe ("sysfs: Use one lockdep
class per sysfs attribute.") introduced this requirement. First, at25
was fixed manually. Then, other occurences were found with coccinelle
and the following semantic patch. Results were reviewed and fixed up:
@ init @
identifier struct_name, bin;
@@
struct struct_name {
...
struct bin_attribute bin;
...
};
@ main extends init @
expression E;
statement S;
identifier name, err;
@@
(
struct struct_name *name;
|
- struct struct_name *name = NULL;
+ struct struct_name *name;
)
...
(
sysfs_bin_attr_init(&name->bin);
|
+ sysfs_bin_attr_init(&name->bin);
if (sysfs_create_bin_file(E, &name->bin))
S
|
+ sysfs_bin_attr_init(&name->bin);
err = sysfs_create_bin_file(E, &name->bin);
)
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Len Brown [Mon, 15 Mar 2010 01:30:17 +0000 (21:30 -0400)]
Merge branches 'battery-2.6.34', 'bugzilla-10805', 'bugzilla-14668', 'bugzilla-531916-power-state', 'ht-warn-2.6.34', 'pnp', 'processor-rename', 'sony-2.6.34', 'suse-bugzilla-531547', 'tz-check', 'video' and 'misc-2.6.34' into release
Alex Chiang [Mon, 22 Feb 2010 19:12:00 +0000 (12:12 -0700)]
ACPI: processor: push file static MADT pointer into internal map_madt_entry()
There's no real need for a pointer to the MADT to be global. The only
function who uses it is map_madt_entry.
This allows us to remove some more ugly #ifdefs.
Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Alex Chiang [Mon, 22 Feb 2010 19:11:55 +0000 (12:11 -0700)]
ACPI: processor: refactor internal map_lsapic_id()
Un-nest the if statements for readability.
Remove comments that re-state the obvious.
Change the control flow so that we no longer need a temp variable.
Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Alex Chiang [Mon, 22 Feb 2010 19:11:50 +0000 (12:11 -0700)]
ACPI: processor: refactor internal map_x2apic_id()
Untangle the nested if conditions to make this function look
more similar to the other map_*apic_id() functions.
Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Alex Chiang [Mon, 22 Feb 2010 19:11:44 +0000 (12:11 -0700)]
ACPI: processor: refactor internal map_lapic_id()
Untangle the if() statement a little for readability.
Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Alex Chiang [Mon, 22 Feb 2010 19:11:39 +0000 (12:11 -0700)]
ACPI: processor: driver doesn't need to evaluate _PDC
Now that the early _PDC evaluation path knows how to correctly
evaluate _PDC on only physically present processors, there's no
need for the processor driver to evaluate it later when it loads.
To cover the hotplug case, push _PDC evaluation down into the
hotplug paths.
Cc: x86@kernel.org
Cc: Tony Luck <tony.luck@intel.com>
Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Alex Chiang [Mon, 22 Feb 2010 19:11:34 +0000 (12:11 -0700)]
ACPI: processor: remove early _PDC optin quirks
Now that we check for physically present processors before blindly
evaluating _PDC, we no longer need to maintain a DMI opt-in table
nor a kernel param.
Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Alex Chiang [Mon, 22 Feb 2010 19:11:29 +0000 (12:11 -0700)]
ACPI: processor: add internal processor_physically_present()
Detect if a processor is physically present before evaluating _PDC.
We want this because some BIOS will provide a _PDC even for processors
that are not present. These bogus _PDC methods then attempt to load
non-existent tables, which causes problems.
Avoid those bogus landmines.
Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Alex Chiang [Mon, 22 Feb 2010 19:11:24 +0000 (12:11 -0700)]
ACPI: processor: move acpi_get_cpuid into processor_core.c
Enumerating processors (via MADT/_MAT) belongs in the processor core,
which is always built-in, rather than living in the processor driver
which may not be built.
Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Alex Chiang [Mon, 22 Feb 2010 19:11:19 +0000 (12:11 -0700)]
ACPI: processor: export acpi_get_cpuid()
Rename static get_cpu_id() to acpi_get_cpuid() and export it.
This change also gives us an opportunity to remove the
#ifndef CONFIG_SMP from processor_driver.c and into a header file
where it properly belongs.
Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Alex Chiang [Mon, 22 Feb 2010 19:11:14 +0000 (12:11 -0700)]
ACPI: processor: mv processor_pdc.c processor_core.c
We've renamed the old processor_core.c to processor_driver.c, to
convey the idea that it can be built modular and has driver-like
bits.
Now let's re-create a processor_core.c for the bits needed
statically by the rest of the kernel. The contents of processor_pdc.c
are a good starting spot, so let's just rename that file and
complete our three card monte.
Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Alex Chiang [Mon, 22 Feb 2010 19:11:08 +0000 (12:11 -0700)]
ACPI: processor: mv processor_core.c processor_driver.c
The ACPI processor driver can be built as a module. But it has
pieces of code that should always be built statically into the
kernel.
The plan is for processor_core.c to contain the static bits while
processor_driver.c contains the module-like bits.
Since the bulk of the code in the current processor_core.c is
module-like, first step is to rename the file to processor_driver.c
Next step will re-create processor_core.c and cherry-pick out
the static bits.
Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Alex Chiang <achiang@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Len Brown [Sun, 14 Mar 2010 20:28:46 +0000 (16:28 -0400)]
ACPI: plan to delete "acpi=ht" boot option
Signed-off-by: Len Brown <len.brown@intel.com>
Len Brown [Fri, 19 Feb 2010 04:42:47 +0000 (23:42 -0500)]
ACPI: remove "acpi=ht" DMI blacklist
SuSE added these entries when deploying ACPI in Linux-2.4.
I pulled them into Linux-2.6 on 2003-08-09.
Over the last 6+ years, several entries have proven to be
unnecessary and deleted, while no new entries have been added.
Matthew suggests that they now have negative value, and I agree.
Based-on-patch-by: Matthew Garrett <mjg59@srcf.ucam.org>
Signed-off-by: Len Brown <len.brown@intel.com>
Bjorn Helgaas [Fri, 5 Mar 2010 17:47:57 +0000 (10:47 -0700)]
PNPACPI: add bus number support
Add support for bus number resources. This is for bridges with a range of
bus numbers behind them. Previously, PNP ignored bus number resources.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Bjorn Helgaas [Fri, 5 Mar 2010 17:47:52 +0000 (10:47 -0700)]
PNPACPI: add window support
Add support for resource windows. This is for bridge resources, i.e.,
regions where a bridge forwards transactions from the primary to the
secondary side. This does not add support for *setting* windows via
the /proc interface.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Bjorn Helgaas [Fri, 5 Mar 2010 17:47:47 +0000 (10:47 -0700)]
resource: add window support
Add support for resource windows. This is for bridge resources, i.e.,
regions where a bridge forwards transactions from the primary to the
secondary side.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Bjorn Helgaas [Fri, 5 Mar 2010 17:47:42 +0000 (10:47 -0700)]
resource: add bus number support
Add support for bus number resources. This is for bridges with a range of
bus numbers behind them.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Bjorn Helgaas [Fri, 5 Mar 2010 17:47:26 +0000 (10:47 -0700)]
resource: expand IORESOURCE_TYPE_BITS to make room for bus resource type
No functional change; this just makes room for another resource type.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Dan Carpenter [Sat, 13 Mar 2010 11:14:22 +0000 (14:14 +0300)]
tomoyo: fix potential use after free
The original code returns a freed pointer. This function is expected to
return NULL on errors.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: James Morris <jmorris@namei.org>
Shaohua Li [Thu, 25 Feb 2010 02:59:34 +0000 (10:59 +0800)]
acpiphp: Execute ACPI _REG method for hotadded devices
Per ACPI spec, _ERG method should be executed before device driver
gets control for hotpluged device. Firmware might do some configuration
there. See http://bugzilla.kernel.org/show_bug.cgi?id=10805. In this
machine, _REG method of docked device will configure cardbus bridge.
Signed-off-by: Shaohua Li <shaohua.li@intel.com>
Tested-by: Paul Martin <pm@debian.org>
Signed-off-by: Len Brown <len.brown@intel.com>
Matthew Garrett [Tue, 16 Feb 2010 21:53:50 +0000 (16:53 -0500)]
ACPI video: Be more liberal in validating _BQC behaviour
Right now, if _BQC returns a value we don't understand we immediately
invalidate it. Change this behaviour so we only invalidate it if it
continues to give an invalid answer after we've already set a brightness.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Acked-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Linus Torvalds [Sun, 14 Mar 2010 18:15:45 +0000 (11:15 -0700)]
Merge branch 'core-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86/mce: Fix build bug with CONFIG_PROVE_LOCKING=y && CONFIG_X86_MCE_INTEL=y
Randy Dunlap [Thu, 4 Feb 2010 20:11:09 +0000 (12:11 -0800)]
Add include to i2c-xii.c to fix build error
drivers/i2c/busses/i2c-xiic.c:493: error: implicit declaration of function 'mdelay'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: "Richard Röjfors" <richard.rojfors@pelagicore.com>
Cc: "Ben Dooks (embedded platforms)" <ben-linux@fluff.org>
Cc: linux-i2c@vger.kernel.org
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Richard Röjfors [Tue, 9 Mar 2010 08:17:36 +0000 (09:17 +0100)]
Add the platform data include for the Xilinx XPS IIC Bus Interface
This file was missed in the original patch that went into Linus' tree.
Cc: "Ben Dooks (embedded platforms)" <ben-linux@fluff.org>
Cc: linux-i2c@vger.kernel.org
Signed-off-by: Richard Röjfors <richard.rojfors@pelagicore.com>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sun, 14 Mar 2010 18:13:54 +0000 (11:13 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/dtor/input
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: i8042 - add ALDI/MEDION netbook E1222 to qurik reset table
Input: ALPS - fix stuck buttons on some touchpads
Input: wm831x-on - convert to use genirq
Input: ads7846 - add wakeup support
Input: appletouch - fix integer overflow issue
Input: ad7877 - increase pen up imeout
Input: ads7846 - add support for AD7843 parts
Input: bf54x-keys - fix system hang when pressing a key
Input: alps - add support for the touchpad on Toshiba Tecra A11-11L
Input: remove BKL, fix input_open_file() locking
Input: serio_raw - remove BKL
Input: mousedev - remove BKL
Input: add driver for TWL4030 vibrator device
Input: enable remote wakeup for PNP i8042 keyboard ports
Input: scancode in get/set_keycodes should be unsigned
Input: i8042 - use platfrom_create_bundle() helper
Input: wacom - merge out and in prox events
Input: gamecon - fix off by one range check
Input: wacom - replace WACOM_PKGLEN_PENABLED
Linus Torvalds [Sun, 14 Mar 2010 18:13:24 +0000 (11:13 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/ryusuke/nilfs2
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2:
nilfs2: remove whitespaces before quoted newlines
nilfs2: remove spaces before tabs
nilfs2: fix various typos in comments
nilfs2: fix typo "cout" -> "count" in error message
nilfs2: fix function name typos in docbook comments
nilfs2: fix discrepancy in use of static specifier
Linus Torvalds [Sun, 14 Mar 2010 18:13:04 +0000 (11:13 -0700)]
Merge branch 'i2c-for-linus' of git://git./linux/kernel/git/jdelvare/staging
* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
i2c-algo-bit: Add pre- and post-xfer hooks
at24: Init dynamic bin_attribute structures
i2c: Drop configure option I2C_DEBUG_CHIP
tsl2550: Move from i2c/chips to misc
i2c-i801: Don't use the block buffer for I2C block writes
i2c-powermac: Be less verbose in the absence of real errors.
i2c-smbus: Use device_lock/device_unlock
Linus Torvalds [Sun, 14 Mar 2010 18:11:08 +0000 (11:11 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/ericvh/v9fs
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
9p: Skip check for mandatory locks when unlocking
9p: Fixes a simple bug enabling writes beyond 2GB.
9p: Change the name of new protocol from 9p2010.L to 9p2000.L
fs/9p: re-init the wstat in readdir loop
net/9p: Add sysfs mount_tag file for virtio 9P device
net/9p: Use the tag name in the config space for identifying mount point
This page took 0.050507 seconds and 5 git commands to generate.