summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'master' of ↵David S. Miller2010-07-262-3/+3
|\ | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
| * ath9k: fix dma direction for map/unmap in ath_rx_taskletMing Lei2010-07-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | For edma, we should use DMA_BIDIRECTIONAL, or else use DMA_FROM_DEVICE. This is found to address "BUG at arch/x86/mm/physaddr.c:5" as described here: http://lkml.org/lkml/2010/7/14/21 Signed-off-by: Ming Lei <tom.leiming@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * wireless: use netif_rx_ni in ieee80211_send_layer2_updateJohn W. Linville2010-07-201-1/+1
| | | | | | | | | | | | | | | | | | These synthetic frames are all triggered from userland requests in process context. https://bugzilla.kernel.org/show_bug.cgi?id=16412 Signed-off-by: John W. Linville <linville@tuxdriver.com>
* | net: dev_forward_skb should call nf_resetBen Greear2010-07-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | With conn-track zones and probably with different network namespaces, the netfilter logic needs to be re-calculated on packet receive. If the netfilter logic is not reset, it will not be recalculated properly. This patch adds the nf_reset logic to dev_forward_skb. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net sched: fix race in mirred device removalstephen hemminger2010-07-242-3/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes hang when target device of mirred packet classifier action is removed. If a mirror or redirection action is configured to cause packets to go to another device, the classifier holds a ref count, but was assuming the adminstrator cleaned up all redirections before removing. The fix is to add a notifier and cleanup during unregister. The new list is implicitly protected by RTNL mutex because it is held during filter add/delete as well as notifier. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Acked-by: Jamal Hadi Salim <hadi@cyberus.ca> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 'wimax-2.6.35.y' of ↵David S. Miller2010-07-242-0/+3
|\ \ | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/inaky/wimax
| * | wimax/i2400m: Add PID & VID for Intel WiMAX 6250Alexey Shvetsov2010-07-222-0/+3
| | | | | | | | | | | | | | | | | | This version of intel wimax device was found in my IBM ThinkPad x201 Signed-off-by: Alexey Shvetsov <alexxy@gentoo.org>
* | | tun: avoid BUG, dump packet on GSO errorsMichael S. Tsirkin2010-07-241-2/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are still some LRO cards that cause GSO errors in tun, and BUG on this is an unfriendly way to tell the admin to disable LRO. Further, experience shows we might have more GSO bugs lurking. See https://bugzilla.kernel.org/show_bug.cgi?id=16413 as a recent example. dumping a packet will make it easier to figure it out. Replace BUG with warning+dump+drop the packet to make GSO errors in tun less critical and easier to debug. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Alex Unigovsky <unik@compot.ru> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | bonding: set device in RLB ARP packet handlerGreg Edwards2010-07-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After: commit 6146b1a4da98377e4abddc91ba5856bef8f23f1e Author: Jay Vosburgh <fubar@us.ibm.com> Date: Tue Nov 4 17:51:15 2008 -0800 bonding: Fix ALB mode to balance traffic on VLANs the dev field in the RLB ARP packet handler was set to NULL to wildcard and accommodate balancing VLANs on top of bonds. This has the side-effect of the packet handler being called against other, non RLB-enabled bonds, and a kernel oops results when it tries to dereference rx_hashtbl in rlb_update_entry_from_arp(), which won't be set for those bonds, e.g. active-backup. With the __netif_receive_skb() changes from: commit 1f3c8804acba841b5573b953f5560d2683d2db0d Author: Andy Gospodarek <andy@greyhouse.net> Date: Mon Dec 14 10:48:58 2009 +0000 bonding: allow arp_ip_targets on separate vlans to use arp validation frames received on VLANs correctly make their way to the bond's handler, so we no longer need to wildcard the device. The oops can be reproduced by: modprobe bonding echo active-backup > /sys/class/net/bond0/bonding/mode echo 100 > /sys/class/net/bond0/bonding/miimon ifconfig bond0 xxx.xxx.xxx.xxx netmask xxx.xxx.xxx.xxx echo +eth0 > /sys/class/net/bond0/bonding/slaves echo +eth1 > /sys/class/net/bond0/bonding/slaves echo +bond1 > /sys/class/net/bonding_masters echo balance-alb > /sys/class/net/bond1/bonding/mode echo 100 > /sys/class/net/bond1/bonding/miimon ifconfig bond1 xxx.xxx.xxx.xxx netmask xxx.xxx.xxx.xxx echo +eth2 > /sys/class/net/bond1/bonding/slaves echo +eth3 > /sys/class/net/bond1/bonding/slaves Pass some traffic on bond0. Boom. [ Tested, behaves as advertised. I do not believe a test of the bonding mode is necessary, as there is no race between the packet handler and the bonding mode changing (the mode can only change when the device is closed). Also updated the log message to include the reproduction and full commit ids. -J ] Signed-off-by: Greg Edwards <greg.edwards@hp.com> Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Acked-by: Andy Gospodarek <andy@greyhouse.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ipv6: Don't add routes to ipv6 disabled interfaces.Brian Haley2010-07-221-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | If the interface has IPv6 disabled, don't add a multicast or link-local route since we won't be adding a link-local address. Reported-by: Mahesh Kelkar <maheshkelkar@gmail.com> Signed-off-by: Brian Haley <brian.haley@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | net: Fix skb_copy_expand() handling of ->csum_startDavid S. Miller2010-07-221-1/+2
| | | | | | | | | | | | | | | | | | It should only be adjusted if ip_summed == CHECKSUM_PARTIAL. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | net: Fix corruption of skb csum field in pskb_expand_head() of net/core/skbuff.cAndrea Shepard2010-07-221-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make pskb_expand_head() check ip_summed to make sure csum_start is really csum_start and not csum before adjusting it. This fixes a bug I encountered using a Sun Quad-Fast Ethernet card and VLANs. On my configuration, the sunhme driver produces skbs with differing amounts of headroom on receive depending on the packet size. See line 2030 of drivers/net/sunhme.c; packets smaller than RX_COPY_THRESHOLD have 52 bytes of headroom but packets larger than that cutoff have only 20 bytes. When these packets reach the VLAN driver, vlan_check_reorder_header() calls skb_cow(), which, if the packet has less than NET_SKB_PAD (== 32) bytes of headroom, uses pskb_expand_head() to make more. Then, pskb_expand_head() needs to adjust a lot of offsets into the skb, including csum_start. Since csum_start is a union with csum, if the packet has a valid csum value this will corrupt it, which was the effect I observed. The sunhme hardware computes receive checksums, so the skbs would be created by the driver with ip_summed == CHECKSUM_COMPLETE and a valid csum field, and then pskb_expand_head() would corrupt the csum field, leading to an "hw csum error" message later on, for example in icmp_rcv() for pings larger than the sunhme RX_COPY_THRESHOLD. On the basis of the comment at the beginning of include/linux/skbuff.h, I believe that the csum_start skb field is only meaningful if ip_csummed is CSUM_PARTIAL, so this patch makes pskb_expand_head() adjust it only in that case to avoid corrupting a valid csum value. Please see my more in-depth disucssion of tracking down this bug for more details if you like: http://puellavulnerata.livejournal.com/112186.html http://puellavulnerata.livejournal.com/112567.html http://puellavulnerata.livejournal.com/112891.html http://puellavulnerata.livejournal.com/113096.html http://puellavulnerata.livejournal.com/113591.html I am not subscribed to this list, so please CC me on replies. Signed-off-by: Andrea Shepard <andrea@persephoneslair.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | macvtap: Limit packet queue lengthHerbert Xu2010-07-223-4/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mark Wagner reported OOM symptoms when sending UDP traffic over a macvtap link to a kvm receiver. This appears to be caused by the fact that macvtap packet queues are unlimited in length. This means that if the receiver can't keep up with the rate of flow, then we will hit OOM. Of course it gets worse if the OOM killer then decides to kill the receiver. This patch imposes a cap on the packet queue length, in the same way as the tuntap driver, using the device TX queue length. Please note that macvtap currently has no way of giving congestion notification, that means the software device TX queue cannot be used and packets will always be dropped once the macvtap driver queue fills up. This shouldn't be a great problem for the scenario where macvtap is used to feed a kvm receiver, as the traffic is most likely external in origin so congestion notification can't be applied anyway. Of course, if anybody decides to complain about guest-to-guest UDP packet loss down the track, then we may have to revisit this. Incidentally, this patch also fixes a real memory leak when macvtap_get_queue fails. Chris Wright noticed that for this patch to work, we need a non-zero TX queue length. This patch includes his work to change the default macvtap TX queue length to 500. Reported-by: Mark Wagner <mwagner@redhat.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Acked-by: Chris Wright <chrisw@sous-sol.org> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ixgbe/igb: catch invalid VF settingsAndy Gospodarek2010-07-212-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some ixgbe cards put an invalid VF device ID in the PCIe SR-IOV capability. The ixgbe driver is only valid for PFs or non SR-IOV hardware. It seems that the same problem could occur on igb hardware as well, so if we discover we are trying to initialize a VF in ixbge_probe or igb_probe, print an error and exit. Based on a patch for ixgbe from Chris Wright <chrisw@sous-sol.org>. Signed-off-by: Andy Gospodarek <andy@greyhouse.net> Cc: Chris Wright <chrisw@sous-sol.org> Acked-by: Chris Wright <chrisw@sous-sol.org> Acked-by: Greg Rose <gregory.v.rose@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | bnx2x: Advance a module versionVladislav Zolotarov2010-07-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Advance a module version to 1.52.53-2. Signed-off-by: Vladislav Zolotarov <vladz@broadcom.com> Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | bnx2x: Protect statistics ramrod and sequence numberVladislav Zolotarov2010-07-211-9/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug fix: Protect statistics ramrod sending code and a statistics counter update with a spinlock. Otherwise there was a race condition that would allow sending a statistics ramrods with the same sequence number or with sequence numbers not in a natural order, which would cause a FW assert. Signed-off-by: Vladislav Zolotarov <vladz@broadcom.com> Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | bnx2x: Protect a SM state changeVladislav Zolotarov2010-07-212-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug fix: Protect the statistics state machine state update with a spinlock. Otherwise there was a race condition that would cause the statistics to stay enabled despite the fact that they were disabled in the LINK_DOWN event handler. Signed-off-by: Vladislav Zolotarov <vladz@broadcom.com> Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | bridge: Partially disable netpoll supportHerbert Xu2010-07-192-31/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The new netpoll code in bridging contains use-after-free bugs that are non-trivial to fix. This patch fixes this by removing the code that uses skbs after they're freed. As a consequence, this means that we can no longer call bridge from the netpoll path, so this patch also removes the controller function in order to disable netpoll. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Thanks, Signed-off-by: David S. Miller <davem@davemloft.net>
* | | tcp: fix crash in tcp_xmit_retransmit_queueIlpo Järvinen2010-07-191-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It can happen that there are no packets in queue while calling tcp_xmit_retransmit_queue(). tcp_write_queue_head() then returns NULL and that gets deref'ed to get sacked into a local var. There is no work to do if no packets are outstanding so we just exit early. This oops was introduced by 08ebd1721ab8fd (tcp: remove tp->lost_out guard to make joining diff nicer). Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Reported-by: Lennart Schulte <lennart.schulte@nets.rwth-aachen.de> Tested-by: Lennart Schulte <lennart.schulte@nets.rwth-aachen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | Merge branch 'master' of ↵David S. Miller2010-07-192-5/+6
|\ \ \ | | |/ | |/| | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
| * | rt2x00: Fix lockdep warning in rt2x00lib_probe_dev()Stephen Boyd2010-07-161-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The rt2x00dev->intf_work workqueue is never initialized when a driver is probed for a non-existent device (in this case rt2500usb). On such a path we call rt2x00lib_remove_dev() to free any resources initialized during the probe before we use INIT_WORK to initialize the workqueue. This causes lockdep to get confused since the lock used in the workqueue hasn't been initialized yet but is now being acquired during cancel_work_sync() called by rt2x00lib_remove_dev(). Fix this by initializing the workqueue first before we attempt to probe the device. This should make lockdep happy and avoid breaking any assumptions about how the library cleans up after a probe fails. phy0 -> rt2x00lib_probe_dev: Error - Failed to allocate device. INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. Pid: 2027, comm: modprobe Not tainted 2.6.35-rc5+ #60 Call Trace: [<ffffffff8105fe59>] register_lock_class+0x152/0x31f [<ffffffff81344a00>] ? usb_control_msg+0xd5/0x111 [<ffffffff81061bde>] __lock_acquire+0xce/0xcf4 [<ffffffff8105f6fd>] ? trace_hardirqs_off+0xd/0xf [<ffffffff81492aef>] ? _raw_spin_unlock_irqrestore+0x33/0x41 [<ffffffff810628d5>] lock_acquire+0xd1/0xf7 [<ffffffff8104f037>] ? __cancel_work_timer+0x99/0x17e [<ffffffff8104f06e>] __cancel_work_timer+0xd0/0x17e [<ffffffff8104f037>] ? __cancel_work_timer+0x99/0x17e [<ffffffff8104f136>] cancel_work_sync+0xb/0xd [<ffffffffa0096675>] rt2x00lib_remove_dev+0x25/0xb0 [rt2x00lib] [<ffffffffa0096bf7>] rt2x00lib_probe_dev+0x380/0x3ed [rt2x00lib] [<ffffffff811d78a7>] ? __raw_spin_lock_init+0x31/0x52 [<ffffffffa00bbd2c>] ? T.676+0xe/0x10 [rt2x00usb] [<ffffffffa00bbe4f>] rt2x00usb_probe+0x121/0x15e [rt2x00usb] [<ffffffff813468bd>] usb_probe_interface+0x151/0x19e [<ffffffff812ea08e>] driver_probe_device+0xa7/0x136 [<ffffffff812ea167>] __driver_attach+0x4a/0x66 [<ffffffff812ea11d>] ? __driver_attach+0x0/0x66 [<ffffffff812e96ca>] bus_for_each_dev+0x54/0x89 [<ffffffff812e9efd>] driver_attach+0x19/0x1b [<ffffffff812e9b64>] bus_add_driver+0xb4/0x204 [<ffffffff812ea41b>] driver_register+0x98/0x109 [<ffffffff813465dd>] usb_register_driver+0xb2/0x173 [<ffffffffa00ca000>] ? rt2500usb_init+0x0/0x20 [rt2500usb] [<ffffffffa00ca01e>] rt2500usb_init+0x1e/0x20 [rt2500usb] [<ffffffff81000203>] do_one_initcall+0x6d/0x17a [<ffffffff8106cae8>] sys_init_module+0x9c/0x1e0 [<ffffffff8100296b>] system_call_fastpath+0x16/0x1b Signed-off-by: Stephen Boyd <bebarino@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * | hostap_pci: set dev->base_addr during probeJohn W. Linville2010-07-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "hostap: Protect against initialization interrupt" (which reinstated "wireless: hostap, fix oops due to early probing interrupt") reintroduced Bug 16111. This is because hostap_pci wasn't setting dev->base_addr, which is now checked in prism2_interrupt. As a result, initialization was failing for PCI-based hostap devices. This corrects that oversight. Signed-off-by: John W. Linville <linville@tuxdriver.com>
* | | IPv6: fix CoA check in RH2 input handler (mip6_rthdr_input())Arnaud Ebalard2010-07-181-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The input handler for Type 2 Routing Header (mip6_rthdr_input()) checks if the CoA in the packet matches the CoA in the XFRM state. Current check is buggy: it compares the adddress in the Type 2 Routing Header, i.e. the HoA, against the expected CoA in the state. The comparison should be made against the address in the destination field of the IPv6 header. The bug remained unnoticed because the main (and possibly only current) user of the code (UMIP MIPv6 Daemon) initializes the XFRM state with the unspecified address, i.e. explicitly allows everything. Yoshifuji-san, can you ack that one? Signed-off-by: Arnaud Ebalard <arno@natisbad.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | ibmveth: lost IRQ while closing/opening device leads to service lossRobert Jennings2010-07-161-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The order of freeing the IRQ and freeing the device in firmware in ibmveth_close can cause the adapter to become unusable after a subsequent ibmveth_open. Only a reboot of the OS will make the network device usable again. This is seen when cycling the adapter up and down while there is network activity. There is a window where an IRQ will be left unserviced (H_EOI will not be called). The solution is to make a VIO_IRQ_DISABLE h_call, free the device with firmware, and then call free_irq. Signed-off-by: Robert Jennings <rcj@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | Merge branch 'vhost-net' of ↵David S. Miller2010-07-161-4/+9
|\ \ \ | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
| * | | vhost: avoid pr_err on condition guest can triggerMichael S. Tsirkin2010-07-161-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Guest can trigger packet truncation by posting a very short buffer and disabling buffer merging. Convert pr_err to pr_debug to avoid log from filling up when this happens. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | | vhost-net: avoid flush under lockMichael S. Tsirkin2010-07-151-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We flush under vq mutex when changing backends. This creates a deadlock as workqueue being flushed needs this lock as well. https://bugzilla.redhat.com/show_bug.cgi?id=612421 Drop the vq mutex before flush: we have the device mutex which is sufficient to prevent another ioctl from touching the vq. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | | | ipmr: Don't leak memory if fib lookup fails.Ben Greear2010-07-151-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This was detected using two mcast router tables. The pimreg for the second interface did not have a specific mrule, so packets received by it were handled by the default table, which had nothing configured. This caused the ipmr_fib_lookup to fail, causing the memory leak. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | net: fix problem in reading sock TX queueTom Herbert2010-07-142-10/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix problem in reading the tx_queue recorded in a socket. In dev_pick_tx, the TX queue is read by doing a check with sk_tx_queue_recorded on the socket, followed by a sk_tx_queue_get. The problem is that there is not mutual exclusion across these calls in the socket so it it is possible that the queue in the sock can be invalidated after sk_tx_queue_recorded is called so that sk_tx_queue get returns -1, which sets 65535 in queue_index and thus dev_pick_tx returns 65536 which is a bogus queue and can cause crash in dev_queue_xmit. We fix this by only calling sk_tx_queue_get which does the proper checks. The interface is that sk_tx_queue_get returns the TX queue if the sock argument is non-NULL and TX queue is recorded, else it returns -1. sk_tx_queue_recorded is no longer used so it can be completely removed. Signed-off-by: Tom Herbert <therbert@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | net/core: neighbour update OopsDoug Kehn2010-07-141-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When configuring DMVPN (GRE + openNHRP) and a GRE remote address is configured a kernel Oops is observed. The obserseved Oops is caused by a NULL header_ops pointer (neigh->dev->header_ops) in neigh_update_hhs() when void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *) = neigh->dev->header_ops->cache_update; is executed. The dev associated with the NULL header_ops is the GRE interface. This patch guards against the possibility that header_ops is NULL. This Oops was first observed in kernel version 2.6.26.8. Signed-off-by: Doug Kehn <rdkehn@yahoo.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | net: skb_tx_hash() fix relative to skb_orphan_try()Eric Dumazet2010-07-141-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit fc6055a5ba31e2 (net: Introduce skb_orphan_try()) added early orphaning of skbs. This unfortunately added a performance regression in skb_tx_hash() in case of stacked devices (bonding, vlans, ...) Since skb->sk is now NULL, we cannot access sk->sk_hash anymore to spread tx packets to multiple NIC queues on multiqueue devices. skb_tx_hash() in this case only uses skb->protocol, same value for all flows. skb_orphan_try() can copy sk->sk_hash into skb->rxhash and skb_tx_hash() can use this saved sk_hash value to compute its internal hash value. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | rfs: call sock_rps_record_flow() in tcp_splice_read()Changli Gao2010-07-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rfs: call sock_rps_record_flow() in tcp_splice_read() call sock_rps_record_flow() in tcp_splice_read(), so the applications using splice(2) or sendfile(2) can utilize RFS. Signed-off-by: Changli Gao <xiaosuo@gmail.com> ---- net/ipv4/tcp.c | 1 + 1 file changed, 1 insertion(+) Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | xfrm: do not assume that template resolving always returns xfrmsTimo Teräs2010-07-141-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | xfrm_resolve_and_create_bundle() assumed that, if policies indicated presence of xfrms, bundle template resolution would always return some xfrms. This is not true for 'use' level policies which can result in no xfrm's being applied if there is no suitable xfrm states. This fixes a crash by this incorrect assumption. Reported-by: George Spelvin <linux@horizon.com> Bisected-by: George Spelvin <linux@horizon.com> Tested-by: George Spelvin <linux@horizon.com> Signed-off-by: Timo Teräs <timo.teras@iki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | axnet_cs: use spin_lock_irqsave in ax_interruptKen Kawasaki2010-07-121-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use spin_lock_irqsave instead of spin_lock in ax_interrupt because the interrupt handler can also be invoked from ei_watchdog. Signed-off-by: Ken Kawasaki <ken_kawasaki@spring.nifty.jp> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | dsa: Fix Kconfig dependencies.David S. Miller2010-07-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Based upon a report by Randy Dunlap. DSA needs PHYLIB, but PHYLIB needs NET_ETHERNET. So, in order to select PHYLIB we have to make DSA depend upon NET_ETHERNET. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | act_nat: not all of the ICMP packets need an IP header payloadChangli Gao2010-07-121-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | not all of the ICMP packets need an IP header payload, so we check the length of the skbs only when the packets should have an IP header payload. Based upon analysis and initial patch by Rodrigo Partearroyo González. Signed-off-by: Changli Gao <xiaosuo@gmail.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> ---- net/sched/act_nat.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | Merge branch 'master' of ↵David S. Miller2010-07-122-2/+17
|\ \ \ \ | | |/ / | |/| | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
| * | | ath9k_htc: fix memory leak in ath9k_hif_usb_alloc_urbsRajkumar Manoharan2010-07-071-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Failure cases within ath9k_hif_usb_alloc_urbs are failed to release allocated memory. Signed-off-by: Rajkumar Manoharan <rmanoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * | | iwlwifi: remove key information during device restartReinette Chatre2010-07-021-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When there is a firmware error or the firmware is reloaded for some other reason we currently clear all station information, including keys associated with them. A problem is that we do not clear some other information regarding keys that are not stored in the station structs. The consequence of this is that when the device is reconfigured after the firmware reload we can, among other things, run out of key indices. This fixes: https://bugzilla.kernel.org/show_bug.cgi?id=16232 http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2221 Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com>
* | | | r8169: incorrect identifier for a 8168dpFrancois Romieu2010-07-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Merge error. See CFG_METHOD_8 (0x3c800000 + 0x00300000) since version 8.002.00 of Realtek's driver. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: Hayes <hayeswang@realtek.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | Phonet: fix skb leak in pipe endpoint accept()Rémi Denis-Courmont2010-07-081-0/+1
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | Bluetooth: Update sec_level/auth_type for already existing connectionsVille Tervo2010-07-081-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update auth level for already existing connections if it is lower than required by new connection. Signed-off-by: Ville Tervo <ville.tervo@nokia.com> Reviewed-by: Emeltchenko Andrei <andrei.emeltchenko@nokia.com> Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* | | | Bluetooth: Reset the security level after an authentication failureJohan Hedberg2010-07-081-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When authentication fails for a connection the assumed security level should be set back to BT_SECURITY_LOW so that subsequent connect attempts over the same link don't falsely assume that security is adequate enough. Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* | | | Bluetooth: Check L2CAP pending status before sending connect requestAndrei Emeltchenko2010-07-081-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to race condition in L2CAP state machine L2CAP Connection Request may be sent twice for SDP with the same source channel id. Problems reported connecting to Apple products, some carkit, Blackberry phones. ... 2010-06-07 21:18:03.651031 < ACL data: handle 1 flags 0x02 dlen 12 L2CAP(s): Connect req: psm 1 scid 0x0040 2010-06-07 21:18:03.653473 > HCI Event: Number of Completed Packets (0x13) plen 5 handle 1 packets 1 2010-06-07 21:18:03.653808 > HCI Event: Auth Complete (0x06) plen 3 status 0x00 handle 1 2010-06-07 21:18:03.653869 < ACL data: handle 1 flags 0x02 dlen 12 L2CAP(s): Connect req: psm 1 scid 0x0040 ... Patch uses L2CAP_CONF_CONNECT_PEND flag to mark that L2CAP Connection Request has been sent already. Modified version of patch from Ville Tervo. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* | | | NET: SB1250: Initialize .ownerRalf Baechle2010-07-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Ralf Baechle <ralf@linux-mips.org> drivers/net/sb1250-mac.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | vxge: show startup message with KERN_INFOWu Fengguang2010-07-071-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The original KERN_CRIT will mess up terminals. CC: Sreenivasa Honnur <Sreenivasa.Honnur@neterion.com> Signed-off-by: Wu Fengguang <fengguang.wu@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | ll_temac: Fix missing iounmapsDenis Kirjanov2010-07-071-5/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix missing iounmaps. Signed-off-by: Denis Kirjanov <dkirjanov@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | bridge: Clear IPCB before possible entry into IP stackHerbert Xu2010-07-071-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The bridge protocol lives dangerously by having incestuous relations with the IP stack. In this instance an abomination has been created where a bogus IPCB area from a bridged packet leads to a crash in the IP stack because it's interpreted as IP options. This patch papers over the problem by clearing the IPCB area in that particular spot. To fix this properly we'd also need to parse any IP options if present but I'm way too lazy for that. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Cheers, Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | bridge br_multicast: BUG: unable to handle kernel NULL pointer dereferenceHerbert Xu2010-07-051-9/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On Tue, Jul 06, 2010 at 08:48:35AM +0800, Herbert Xu wrote: > > bridge: Restore NULL check in br_mdb_ip_get Resend with proper attribution. bridge: Restore NULL check in br_mdb_ip_get Somewhere along the line the NULL check in br_mdb_ip_get went AWOL, causing crashes when we receive an IGMP packet with no multicast table allocated. This patch restores it and ensures all br_mdb_*_get functions use it. Reported-by: Frank Arnold <frank.arnold@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Thanks, Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | net: Fix definition of netif_vdbg() when VERBOSE_DEBUG is definedBen Hutchings2010-07-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | netif_vdbg() was originally defined as entirely equivalent to netdev_vdbg(), but I assume that it was intended to take the same parameters as netif_dbg() etc. (Currently it is only used by the sfc driver, in which I worked on that assumption.) In commit a4ed89c I changed the definition used when VERBOSE_DEBUG is not defined, but I failed to notice that the definition used when VERBOSE_DEBUG is defined was also not as I expected. Change that to match netif_dbg() as well. Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
OpenPOWER on IntegriCloud