- 02 Aug, 2009 3 commits
-
-
Eric Dumazet authored
memcpy() should take into account size of pointers, not only number of pointers to copy. Signed-off-by:
Eric Dumazet <eric.dumazet@gmail.com> Acked-by:
Pavel Emelyanov <xemul@openvz.org> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Eric Dumazet authored
Failure to call unregister_pernet_gen_device() can exhaust memory if module is loaded/unloaded many times. Signed-off-by:
Cyrill Gorcunov <gorcunov@openvz.org> Signed-off-by:
-
Ben McKeegan authored
This patch fixes the corner cases where the sum of MTU of the free channels (adjusted for fragmentation overheads) is less than the MTU of PPP link. There are at least 3 situations where this case might arise: - some of the channels are busy - the multilink session is running in a degraded state (i.e. with less than its full complement of active channels) - by design, where multilink protocol is being used to artificially increase the effective link MTU of a single link. Without this patch, at most 1 fragment is ever sent per free channel for a given PPP frame and any remaining part of the PPP frame that does not fit into those fragments is silently discarded. This patch restores the original behaviour which was broken by commit 9c705260 'ppp:ppp_mp_explode() redesign'. Once all 'free' channels have been given a fragment, an additional fragment is queued to each available channel in turn, as many times as necessary, until the entire PPP frame has been consumed. Signed-off-by:
Ben McKeegan <ben@netservers.co.uk> Signed-off-by:
-
- 31 Jul, 2009 3 commits
-
-
Peter P Waskiewicz Jr authored
When a user disables interrupt throttling with ethtool on 82599 devices, the interrupt timer may not be re-enabled if hardware RSC is running. The RSC completions in hardware don't complete before the next ITR event tries to fire, so the ITR timer never gets re-armed. This patch increases the amount of time between interrupts when throttling is disabled (rx-usecs = 0) when the hardware RSC deature is enabled. Signed-off-by:
Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Signed-off-by:
Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by:
-
Peter P Waskiewicz Jr authored
A second set of feature flag bits was added, and the hardware RSC engine flags were moved there. However, the code itself didn't make the move completely to use the new bitmap. Signed-off-by:
Mallikarjuna R Chilakala <mallikarjuna.chilakala@intel.com> Signed-off-by:
-
Peter P Waskiewicz Jr authored
Our ndo_poll_controller callback is broken for anything but non-multiqueue setups. This fixes that issue. Signed-off-by:
-
- 30 Jul, 2009 9 commits
-
-
Jiajun Wu authored
Parameter order for using mk_ic_value(count, time) was reversed, the patch fixes this. Signed-off-by:
Jiajun Wu <b06378@freescale.com> Signed-off-by:
Li Yang <leoli@freescale.com> Signed-off-by:
-
Eric Dumazet authored
If a socket is hashed in last slot of pppoe hash table (PPPOE_HASH_SIZE-1) we report it many times (up to filling seq buffer) (Only the last socket of last slot) Signed-off-by:
-
roel kluin authored
start_code is 69 words, but the code always writes a multiple of 16 words, so the last 11 words written are outside the array. Signed-off-by:
Roel Kluin <roel.kluin@gmail.com> Signed-off-by:
-
roel kluin authored
If arp_format_neigh_entry() can be called with n->dev->addr_len == 0, then a write to hbuffer[-1] occurs. Signed-off-by:
-
roel kluin authored
if dev_alloc_skb() fails on the first iteration, a write to cp->rx_ring[-1] occurs. Signed-off-by:
-
Tobias Klauser authored
Use the %pI4 format string instead of %d.%d.%d.%d and NIPQUAD. Signed-off-by:
Tobias Klauser <tklauser@distanz.ch> Signed-off-by:
Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by:
-
Michael Chan authored
Changing to GFP_ATOMIC because the only caller in cnic/bnx2i may be calling this function while holding spin_lock. This problem was discovered by Mike Christie. Signed-off-by:
Michael Chan <mchan@broadcom.com> Acked-by:
Mike Christie <michaelc@cs.wisc.edu> Signed-off-by:
-
Julia Lawall authored
The test on map4 should be a test on map6. The semantic match that finds this problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // <smpl> @@ expression *x; identifier f; constant char *C; @@ x = \(kmalloc\|kcalloc\|kzalloc\)(...); ... when != x == NULL when != x != NULL when != (x || ...) ( kfree(x) | f(...,C,...,x,...) | *f(...,x,...) | *x->f ) // </smpl> Signed-off-by:
Julia Lawall <julia@diku.dk> Acked-by:
Paul Moore <paul.moore@hp.com> Signed-off-by:
-
-
- 29 Jul, 2009 3 commits
-
-
Johannes Berg authored
Jan reported that his b43-based laptop hangs during suspend. The problem turned out to be mac80211 asking the driver to stop the hardware before removing interfaces, and interface removal caused b43 to touch the hardware (while down, which causes the hang). This patch fixes mac80211 to do reorder these operations to have them in the correct order -- first remove interfaces and then stop the hardware. Some more code is necessary to be able to do so in a race-free manner, in particular it is necessary to not process frames received during quiescing. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13337. Reported-by:
Jan Scholz <scholz@fias.uni-frankfurt.de> Signed-off-by:
Johannes Berg <johannes@sipsolutions.net> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Roel Kluin authored
Several arrays were read before checking whether the index was within bounds. ARRAY_SIZE() should be used to determine the size of arrays. rates->rates has an arraysize of 1, so calling get_common_rates() with a rates_size of MAX_RATES (14) was causing reads out of bounds. tmp_size can increment at most to (ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1), so that should be the number of elements of tmp[]. A goto can be eliminated: ret was already set upon its declaration. Signed-off-by:
-
Roel Kluin authored
reads bss->rates[j] before checking bounds of index, and should use ARRAY_SIZE to determine the size of the array. Signed-off-by:
Holger Schurig <hs4233@mail.mn-solutions.de> Acked-by:
Dan Williams <dcbw@redhat.com> Signed-off-by:
-
- 28 Jul, 2009 1 commit
-
-
Stephen Hemminger authored
Even though reverse path filter was changed from simple boolean to trinary control, the loose mode only works if both all and device are configured because of this logic error. Signed-off-by:
Stephen Hemminger <shemminger@vyatta.com> Signed-off-by:
-
- 27 Jul, 2009 19 commits
-
-
Luis R. Rodriguez authored
Signed-off-by:
Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by:
-
Roel Kluin authored
tid is bounded (above) by the size of default_tid_to_tx_fifo (17 elements), but the size of priv->stations[].tid[] is MAX_TID_COUNT (9) elements. Signed-off-by:
-
Roel Kluin authored
Incorrect limits leads to reads outside array bounds. Signed-off-by:
-
Roel Kluin authored
SSID_rid has space for only 3 ssids. txPowerLevels[i] is read before the bounds check for i Signed-off-by:
-
Dan Carpenter authored
iwm_wdev_alloc() returns an ERR_PTR on failure and not null. It also prints its own dev_err() message so I removed that as well. Compile tested only. Sorry. Found by smatch (http://repo.or.cz/w/smatch.git). Signed-off-by:
Dan Carpenter <error27@gmail.com> Acked-by:
Zhu Yi <yi.zhu@intel.com> Signed-off-by:
-
reinette chatre authored
We need to provide a reasonable minimum that will result in a working setup if used. Set minimum to be 10 to provide for 4 standard TX queues + 1 command queue + 2 (unused) HCCA queues + 4 HT queues (one per AC). We allow the user to change the number of queues used via a module parameter and use this minimum value to check if it is valid. Without this patch a user can select a value for the number of queues that will result in a failing setup. Signed-off-by:
Reinette Chatre <reinette.chatre@intel.com> Reviewed-by:
Tomas Winkler <tomas.winkler@intel.com> Acked-by:
-
Johannes Berg authored
I had a problem on 4965 hardware (well, probably other hardware too, but others don't survive my stress testing right now, unfortunately) where the driver was sending invalid commands to the device, but no such thing could be seen from the driver's point of view. I could reproduce this fairly easily by sending multiple TCP streams with iperf on different TIDs, though sometimes a single iperf stream was sufficient. It even happened with a single core, but I have forced preemption turned on. The culprit was a queue overrun, where we advanced the queue's write pointer over the read pointer. After careful analysis I've come to the conclusion that the cause is a race condition between iwlwifi and mac80211. mac80211, of course, checks whether the queue is stopped, before transmitting a frame. This effectively looks like this: lock(queues) if (stopped(queue)) { unlock(queues) return busy; } unlock(queues) ... <-- this place will be important there is some more code here drv_tx(frame) The driver, on the other hand, can stop and start queues, which does lock(queues) mark_running/stopped(queue) unlock(queues) [if marked running: wake up tasklet to send pending frames] Now, however, once the driver starts the queue, mac80211 can see that and end up at the marked place above, at which point for some reason the driver seems to stop the queue again (I don't understand that) and then we end up transmitting while the queue is actually full. Now, this shouldn't actually matter much, but for some reason I've seen it happen multiple times in a row and the queue actually overflows, at which point the queue bites itself in the tail and things go completely wrong. This patch fixes this by just dropping the packet should this have happened, and making the lock in iwlwifi cover everything so iwlwifi can't race against itself (dropping the lock there might make it more likely, but it did seem to happen without that too). Since we can't hold the lock across drv_tx() above, I see no way to fix this in mac80211, but I also don't understand why I haven't seen this before -- maybe I just never stress tested it this badly. With this patch, the device has survived many minutes of simultanously sending two iperf streams on different TIDs with combined throughput of about 60 Mbps. Signed-off-by: -
Michael Chan authored
When a net device goes down or when the bnx2i driver is unloaded, the code was not generating the ISCSI_KEVENT_IF_DOWN message properly and this could cause the userspace driver to crash. This is fixed by sending the message properly in the shutdown path. cnic_uio_stop() is also added to send the message when bnx2i is unregistering. Signed-off-by:
-
Deepak Saxena authored
irttp_dup() copies a tsap_cb struct, but does not initialize the spinlock in the new structure, which confuses lockdep. Signed-off-by:
Deepak Saxena <dsaxena@mvista.com> Signed-off-by:
Ingo Molnar <mingo@elte.hu> Signed-off-by:
Thomas Gleixner <tglx@linutronix.de> Signed-off-by:
-
Don Skidmore authored
There is an 82599 errata that UDP frames with a zero checksum are incorrectly marked as checksum invalid by the hardware. This was leading to misleading hw_csum_rx_error counts. This patch adds a test around this counter increase for this condition. Signed-off-by:
Don Skidmore <donald.c.skidmore@intel.com> Signed-off-by:
-
françois romieu authored
More stuff for http://bugzilla.kernel.org/show_bug.cgi?id=9512 Some 8168 are unable to WoL when receiving is not enabled (plain old 8169 do not seem to care). It is not exactly pretty to leave the receiver enabled but we should now enable DMA late enough for it to be safe. Some late stage boot failure due to pxe and friends may benefit from the delayed enabling of bus-mastering as well. Signed-off-by:
Francois Romieu <romieu@fr.zoreil.com> Tested-by:
Jaromír Cápík <tavvva@volny.cz> Cc: Edward Hsu <edward_hsu@realtek.com.tw>
-
Dhananjay Phadke authored
Reset consumer of status rings to 0 when cleaning up sw resources. Status rings are not deleted during suspend since they have napi objects. This ensures correct rx processing across suspen-resume. Signed-off-by:
Dhananjay Phadke <dhananjay@netxen.com> Signed-off-by:
-
Xiaotian Feng authored
kobject_init_and_add will alloc memory for kobj->name, so in br_add_if error path, simply use kobject_del will not free memory for kobj->name. Fix by using kobject_put instead, kobject_put will internally calls kobject_del and frees memory for kobj->name. Signed-off-by:
Xiaotian Feng <dfeng@redhat.com> Acked-by:
-
Alessandro Rubini authored
Signed-off-by:
Alessandro Rubini <rubini@unipv.it> Acked-by:
Andrea Gallo <andrea.gallo@stericsson.com> Signed-off-by:
-
Ralf Baechle authored
The use of a static buffer in rose2asc() to return its result is not threadproof and can result in corruption if multiple threads are trying to use one of the procfs files based on rose2asc(). Signed-off-by:
Ralf Baechle <ralf@linux-mips.org> Signed-off-by:
-
Roel Kluin authored
io[i] is read before the bounds check on i, order should be reversed Signed-off-by:
-
roel kluin authored
io[i] is read before the bounds check on i, order should be reversed Signed-off-by:
-
roel kluin authored
loop bound looks to be wrong, for an array of length 8 Signed-off-by:
-
roel kluin authored
phy_idx is checked to be < 4, but np->phys[] is 2 elements long Signed-off-by:
-
- 23 Jul, 2009 2 commits
-
-
Andy Gospodarek authored
Calls to device_init_wakeup should not be necessary in drivers that use device_set_wakeup_enable since pci_pm_init will set the can_wakeup flag for the device when initialized. Signed-off-by:
Andy Gospodarek <andy@greyhouse.net> Acked-by:
-
Lucy Liu authored
Certain types of control packets (LLDP, LACP, etc.) are not supposed to have a priority tag or vlan tag inserted. Ixgbe driver is currently priority tagging everything (if packet is not on a VLAN interface). This patch modifies DCB mode, so that packets marked with skb priority TC_PRIO_CONTROL are not priority tagged. It also transmits these packets on the highest priority traffic class. Programs (like dcbd) can set the skb priority using a socket option. Or, a tc filter can be configured to set the priority value. Using the value TC_PRIO_CONTROL (7) has the benefit that it is already defined in the kernel, and the bonding LACP code already sets the skb->priority field to this value. Signed-off-by:
Lucy Liu <lucy.liu@intel.com> Acked-by:
-
