- 29 Jun, 2010 2 commits
-
-
Ben Hutchings authored
On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer overflow and the buffer may be smaller than needed. Since ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at least denial of service. Signed-off-by:
Ben Hutchings <bhutchings@solarflare.com> Cc: stable@kernel.org Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Andy Gospodarek authored
Support for netpoll over bonded interfaces was added here: commit f6dc31a8 Author: WANG Cong <amwang@redhat.com> Date: Thu May 6 00:48:51 2010 -0700 bonding: make bonding support netpoll but it is bad enough that we should probably just disable netpoll over bonding until some of the locking logic in the bonding driver is changed or converted completely to RCU. Simple actions like changing the active slave in active-backup mode will hang the box if a high enough printk debugging level is enabled. Keeping the old code around will be good for anyone that wants to work on it (and for after the RCU conversion), so I propose this small patch rather than ripping it all out. Signed-off-by:
Andy Gospodarek <andy@greyhouse.net> Signed-off-by:
Jay Vosburgh <fubar@us.ibm.com> Signed-off-by:
-
- 27 Jun, 2010 3 commits
-
-
David Woodhouse authored
Commit e13647c1 (phylib: Add support for the LXT973 phy.) added a new ID but neglected to also add it to the MODULE_DEVICE_TABLE. Signed-off-by:
David Woodhouse <David.Woodhouse@intel.com> Signed-off-by:
-
Jiri Slaby authored
Stanse found that lp is dereferenced earlier than checked for being NULL in hysdn_rx_netpkt. Move the initialization below the test. Signed-off-by:
Jiri Slaby <jslaby@suse.cz> Cc: Karsten Keil <isdn@linux-pingi.de> Cc: "David S. Miller" <davem@davemloft.net> Cc: Stephen Hemminger <shemminger@vyatta.com> Cc: Patrick McHardy <kaber@trash.net> Cc: netdev@vger.kernel.org Signed-off-by:
-
Michal Schmidt authored
When pci_enable_msix() returned ret<0, entries and vxge_entries were leaked. While at it, use the centralized exit idiom in the function. Signed-off-by:
Michal Schmidt <mschmidt@redhat.com> Acked-by:
Ram Vepa <ram.vepa@exar.com> Signed-off-by:
-
- 26 Jun, 2010 8 commits
-
-
Tilman Schmidt authored
CAPI applications can handle several connections in parallel, so one connection state per application isn't sufficient. Store the connection state in the channel structure instead. Impact: bugfix Signed-off-by:
Tilman Schmidt <tilman@imap.cc> Signed-off-by:
-
Tilman Schmidt authored
Adapt to buggy device firmware which accepts setting HLC only in the same command line as BC, by encoding HLC and BC in a single command if both are specified, and rejecting HLC without BC. Impact: bugfix Signed-off-by:
-
Tilman Schmidt authored
The Gigaset CAPI driver handled all DATA_B3_REQ messages as if the Delivery Confirmation flag bit was set, delaying the emission of the DATA_B3_CONF reply until the data was actually transmitted. Some CAPI applications (notably Asterisk) aren't happy with that behaviour. Change it to actually evaluate the Delivery Confirmation flag as described the CAPI specification. Impact: bugfix Signed-off-by:
-
Tilman Schmidt authored
Make the Gigaset CAPI driver select L2_VOICE (AT^SBPR=2) as the layer 2 encoding for transparent connections, like the ISDN4Linux variant. L2_BITSYNC (AT^SBPR=0) mutes internal connections and distorts external ones. Impact: bugfix Signed-off-by:
-
Tilman Schmidt authored
Fix the Gigaset CAPI driver to limit the length of a connection's payload data receive buffers to the corresponding CAPI application's data buffer size, as some real-life CAPI applications tend to be rather unhappy if they receive bigger data blocks than requested. Impact: bugfix Signed-off-by:
-
Florian Fainelli authored
If the call to phy_connect fails, we will return directly instead of freeing the previously allocated struct net_device. Signed-off-by:
Florian Fainelli <florian@openwrt.org> CC: stable@kernel.org Signed-off-by:
-
Ken Kawasaki authored
smc91c92_cs: Fix the problem that lan & modem does not work simultaneously in the Megahertz multi-function card. We need to write MEGAHERTZ_ISR to retrigger interrupt. Signed-off-by:
Ken Kawasaki <ken_kawasaki@spring.nifty.jp> Signed-off-by:
-
stephen hemminger authored
The addition of TLLAO option created a kernel OOPS regression for the case where neighbor advertisement is being sent via proxy path. When using proxy, ipv6_get_ifaddr() returns NULL causing the NULL dereference. Change causing the bug was: commit f7734fdf Author: Octavian Purdila <opurdila@ixiacom.com> Date: Fri Oct 2 11:39:15 2009 +0000 make TLLAO option for NA packets configurable Signed-off-by:
Stephen Hemminger <shemminger@vyatta.com> Acked-by:
YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by:
-
- 25 Jun, 2010 1 commit
-
-
Gustavo F. Padovan authored
commit ff6e2163 accidentally added a regression on the bnep code. Fixing it. Signed-off-by:
Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by:
-
- 24 Jun, 2010 1 commit
-
-
Timo Teräs authored
Fix the bundle validation code to not assume having a valid policy. When we have multiple transformations for a xfrm policy, the bundle instance will be a chain of bundles with only the first one having the policy reference. When policy_genid is bumped it will expire the first bundle in the chain which is equivalent of expiring the whole chain. Reported-bisected-and-tested-by:
Justin P. Mattock <justinmattock@gmail.com> Signed-off-by:
Timo Teräs <timo.teras@iki.fi> Signed-off-by:
-
- 23 Jun, 2010 4 commits
-
-
Brandon Philips authored
sky2_phy_reinit is called by the ethtool helpers sky2_set_settings, sky2_nway_reset and sky2_set_pauseparam when netif_running. However, at the end of sky2_phy_init GM_GP_CTRL has GM_GPCR_RX_ENA and GM_GPCR_TX_ENA cleared. So, doing these commands causes the device to stop working: $ ethtool -r eth0 $ ethtool -A eth0 autoneg off Fix this issue by enabling Rx/Tx after running sky2_phy_init in sky2_phy_reinit. Signed-off-by:
Brandon Philips <bphilips@suse.de> Tested-by:
Mike McCormack <mikem@ring3k.org> Signed-off-by:
-
Dmitry Kravkov authored
Disable statistics initialization for eth clients that do not support statistics. This prevents memory corruption on bnx2x hw. Signed-off-by:
Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by:
Michael Chan <mchan@broadcom.com> Signed-off-by:
Eilon Greenstein <eilong@broadcom.com>
-
Anirban Chakraborty authored
netxen_nic and qlcnic driver depends on firmware_class module. Signed-off-by:
Anirban Chakraborty <anirban.chakraborty@qlogic.com> Signed-off-by:
Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by:
-
Eric Dumazet authored
commit aa2ea058 (tcp: fix outsegs stat for TSO segments) incorrectly assumed SNMP_ADD_STATS() was used from BH context. Fix this using mib[!in_softirq()] instead of mib[0] Signed-off-by:
Eric Dumazet <eric.dumazet@gmail.com> CC: Tom Herbert <therbert@google.com> Signed-off-by:
-
- 22 Jun, 2010 2 commits
-
-
-
Filip Aben authored
This patch removes the setting of the low_latency flag. tty_flip_buffer_push() is occasionally being called in irq context, which causes a hang if the low_latency flag is set. Removing the low_latency flag only seems to impact the flush to ldisc, which will now be put on a workqueue. Signed-off-by:
Filip Aben <f.aben@option.com> Signed-off-by:
-
- 21 Jun, 2010 3 commits
-
-
Herbert Xu authored
It has been reported that the new UFO software fallback path fails under certain conditions with NFS. I tracked the problem down to the generation of UFO packets that are smaller than the MTU. The software fallback path simply discards these packets. This patch fixes the problem by not generating such packets on the UFO path. Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
-
Helge Deller authored
Fix commit 4cd24eaf (net: use netdev_mc_count and netdev_mc_empty when appropriate) Signed-off-by:
Helge Deller <deller@gmx.de> Signed-off-by:
-
Ralf Baechle authored
$ make CONFIG_DEBUG_SECTION_MISMATCH=y [...] WARNING: drivers/net/built-in.o(.data+0x0): Section mismatch in reference from the variable mipsnet_driver to the function .init.text:mipsnet_probe() The variable mipsnet_driver references the function __init mipsnet_probe() If the reference is valid then annotate the variable with __init* or __refdata (see linux/init.h) or name the variable: *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console, [...] Fixed by making mipsnet_probe __devinit. Signed-off-by:
Ralf Baechle <ralf@linux-mips.org> drivers/net/mipsnet.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) Signed-off-by:
-
- 18 Jun, 2010 1 commit
-
-
Bob Copeland authored
ath5k assumes ah_current_channel is always a valid pointer in several places, but a newly created interface may not have a channel. To avoid null pointer dereferences, set it up to point to the first available channel until later reconfigured. This fixes the following oops: $ rmmod ath5k $ insmod ath5k $ iw phy0 set distance 11000 BUG: unable to handle kernel NULL pointer dereference at 00000006 IP: [<d0a1ff24>] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] *pde = 00000000 Oops: 0000 [#1] last sysfs file: /sys/devices/pci0000:00/0000:00:0e.0/ieee80211/phy0/index Modules linked in: usbhid option usb_storage usbserial usblp evdev lm90 scx200_acb i2c_algo_bit i2c_dev i2c_core via_rhine ohci_hcd ne2k_pci 8390 leds_alix2 xt_IMQ imq nf_nat_tftp nf_conntrack_tftp nf_nat_irc nf_cc Pid: 1597, comm: iw Not tainted (2.6.32.14 #8) EIP: 0060:[<d0a1ff24>] EFLAGS: 00010296 CPU: 0 EIP is at ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] EAX: 000000c2 EBX: 00000000 ECX: ffffffff EDX: c12d2080 ESI: 00000019 EDI: cf8c0000 EBP: d0a30edc ESP: cfa09bf4 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process iw (pid: 1597, ti=cfa09000 task=cf88a000 task.ti=cfa09000) Stack: d0a34f35 d0a353f8 d0a30edc 000000fe cf8c0000 00000000 1900063d cfa8c9e0 <0> cfa8c9e8 cfa8c0c0 cfa8c000 d0a27f0c 199d84b4 cfa8c200 00000010 d09bfdc7 <0> 00000000 00000000 ffffffff d08e0d28 cf9263c0 00000001 cfa09cc4 00000000 Call Trace: [<d0a27f0c>] ? ath5k_hw_attach+0xc8c/0x3c10 [ath5k] [<d09bfdc7>] ? __ieee80211_request_smps+0x1347/0x1580 [mac80211] [<d08e0d28>] ? nl80211_send_scan_start+0x7b8/0x4520 [cfg80211] [<c10f5db9>] ? nla_parse+0x59/0xc0 [<c11ca8d9>] ? genl_rcv_msg+0x169/0x1a0 [<c11ca770>] ? genl_rcv_msg+0x0/0x1a0 [<c11c7e68>] ? netlink_rcv_skb+0x38/0x90 [<c11c9649>] ? genl_rcv+0x19/0x30 [<c11c7c03>] ? netlink_unicast+0x1b3/0x220 [<c11c893e>] ? netlink_sendmsg+0x26e/0x290 [<c11a409e>] ? sock_sendmsg+0xbe/0xf0 [<c1032780>] ? autoremove_wake_function+0x0/0x50 [<c104d846>] ? __alloc_pages_nodemask+0x106/0x530 [<c1074933>] ? do_lookup+0x53/0x1b0 [<c10766f9>] ? __link_path_walk+0x9b9/0x9e0 [<c11acab0>] ? verify_iovec+0x50/0x90 [<c11a42b1>] ? sys_sendmsg+0x1e1/0x270 [<c1048e50>] ? find_get_page+0x10/0x50 [<c104a96f>] ? filemap_fault+0x5f/0x370 [<c1059159>] ? __do_fault+0x319/0x370 [<c11a55b4>] ? sys_socketcall+0x244/0x290 [<c101962c>] ? do_page_fault+0x1ec/0x270 [<c1019440>] ? do_page_fault+0x0/0x270 [<c1002ae5>] ? syscall_call+0x7/0xb Code: 00 b8 fe 00 00 00 b9 f8 53 a3 d0 89 5c 24 14 89 7c 24 10 89 44 24 0c 89 6c 24 08 89 4c 24 04 c7 04 24 35 4f a3 d0 e8 7c 30 60 f0 <0f> b7 43 06 ba 06 00 00 00 a8 10 75 0e 83 e0 20 83 f8 01 19 d2 EIP: [<d0a1ff24>] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] SS:ESP 0068:cfa09bf4 CR2: 0000000000000006 ---[ end trace 54f73d6b10ceb87b ]--- Cc: stable@kernel.org Reported-by:
Steve Brown <sbrown@cortland.com> Signed-off-by:
Bob Copeland <me@bobcopeland.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
- 17 Jun, 2010 7 commits
-
-
stephen hemminger authored
It is common in end-node, non STP bridges to set forwarding delay to zero; which causes the forwarding database cleanup to run every clock tick. Change to run only as soon as needed or at next ageing timer interval which ever is sooner. Use round_jiffies_up macro rather than attempting round up by changing value. Signed-off-by:
-
FUJITA Tomonori authored
This removes dma_get_ops() prefetch optimization in bnx2. bnx2 uses dma_get_ops() to see if dma_sync_single_for_cpu() is noop. bnx2 does prefetch if it's noop. But dma_get_ops() isn't available on all the architectures (only the architectures that uses dma_map_ops struct have it). Using dma_get_ops() in drivers leads to compilation breakage on many architectures. This patch removes dma_get_ops() and changes bnx2 to do prefetch on all the architectures. This adds useless prefetch on non-coherent architectures but this is harmless. It is also unlikely to cause the performance drop. [ Remove now unused local variable 'pdev' -DaveM ] Signed-off-by:
FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by:
-
Sergey Matyukevich authored
This patch implements a proper modification of RX skb buffers before recycling. Adjusting only skb->data is not enough because after that skb->tail and skb->len become incorrect. Signed-off-by:
Sergey Matyukevich <geomatsi@gmail.com> Signed-off-by:
-
Ken Kawasaki authored
pcnet_cs: serial_cs: add new id (TOSHIBA Modem/LAN Card) Signed-off-by: -
Anton Vorontsov authored
Issuing the following command on host: $ ifconfig eth2 mtu 1600 ; ping 10.0.0.27 -s 1485 -c 1 Makes some boards (tested with MPC8315 rev 1.1 and MPC8313 rev 1.0) oops like this: skb_over_panic: text:c0195914 len:1537 put:1537 head:c79e4800 data:c79e4880 tail:0xc79e4e81 end:0xc79e4e80 dev:eth1 ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:127! Oops: Exception in kernel mode, sig: 5 [#1] MPC831x RDB last sysfs file: /sys/kernel/uevent_seqnum Modules linked in: NIP: c01c1840 LR: c01c1840 CTR: c016d918 [...] NIP [c01c1840] skb_over_panic+0x48/0x5c LR [c01c1840] skb_over_panic+0x48/0x5c Call Trace: [c0339d50] [c01c1840] skb_over_panic+0x48/0x5c (unreliable) [c0339d60] [c01c3020] skb_put+0x5c/0x60 [c0339d70] [c0195914] gfar_clean_rx_ring+0x25c/0x3d0 [c0339dc0] [c01976e8] gfar_poll+0x170/0x1bc Dumped buffer descriptors showed that eTSEC's length/truncation logic sometimes passes oversized packets, i.e. for the above ICMP packet the following two buffer descriptors may become ready: status=1400 length=1536 status=1800 length=1541 So, it seems that gianfar actually receives the whole big frame, and it tries to place the packet into two BDs. This situation confuses the driver, and so the skb_put() sanity check fails. This patch fixes the issue by adding an appropriate check, i.e. the driver should not try to process frames with buffer descriptor's length over rx_buffer_size (i.e. maxfrm and mrblr). Note that sometimes eTSEC works correctly, i.e. in the second (last) buffer descriptor bits 'truncated' and 'crcerr' are set, and so there's no oops. Though I couldn't find any logic when it works correctly and when not. Signed-off-by:
Anton Vorontsov <avorontsov@mvista.com> Signed-off-by:
-
Jan-Bernd Themann authored
Port reset operations and memory add/remove operations need to be serialized to avoid a kernel deadlock. The deadlock is caused by calling the napi_disable() function twice. Therefore we have to employ the dlpar_mem_lock in the ehea_reset_port function as well Signed-off-by:
Jan-Bernd Themann <themann@de.ibm.com> Signed-off-by:
-
Jan-Bernd Themann authored
In the eHEA poll function an rmb() is required. Without that some packets on the receive queue are not seen and thus delayed until the next interrupt is handled for the same receive queue. Signed-off-by:
-
- 16 Jun, 2010 8 commits
-
-
Don Skidmore authored
These comments were forgotten in the initial patch to add this functionality. This patch corrects that. Signed-off-by:
Don Skidmore <donald.c.skidmore@intel.com> Signed-off-by:
Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by:
-
Tom Hughes authored
https://bugzilla.kernel.org/show_bug.cgi?id=16183 The sch_teql module, which can be used to load balance over a set of underlying interfaces, stopped working after 2.6.30 and has been broken in all kernels since then for any underlying interface which requires the addition of link level headers. The problem is that the transmit routine relies on being able to access the destination address in the skb in order to do address resolution once it has decided which underlying interface it is going to transmit through. In 2.6.31 the IFF_XMIT_DST_RELEASE flag was introduced, and set by default for all interfaces, which causes the destination address to be released before the transmit routine for the interface is called. The solution is to clear that flag for teql interfaces. Signed-off-by:
Tom Hughes <tom@compton.nu> Acked-by:
-
Manfred Rudigier authored
Previously the RCTRL_TS_ENABLE bit was set unconditionally. However, if the RCTRL_TS_ENABLE is set without TMR_CTRL[TE], the driver does not work properly on some boards (Anton had problems with the MPC8313ERDB and MPC8568EMDS). With this patch the bit will only be set if requested from user space with the SIOCSHWTSTAMP ioctl command, meaning that time stamping is disabled during normal operation. Users who are not interested in time stamps will not experience problems with buggy CPU revisions or performance drops any more. The setting of TMR_CTRL[TE] is still up to the user. This is considered safe because users wanting HW timestamps must initialize the eTSEC clock first anyway, e.g. with the recently submitted PTP clock driver. Signed-off-by:
Manfred Rudigier <manfred.rudigier@omicron.at> Reviewed-by:
Anton Vorontsov <cbouatmailru@gmail.com> Signed-off-by:
-
-
Christoph Fritz authored
regression introduced by b8d92c9c In function ‘ieee80211_work_rx_queued_mgmt’: warning: ‘rma’ may be used uninitialized in this function this re-adds default value WORK_ACT_NONE back to rma Signed-off-by:
Christoph Fritz <chf.fritz@googlemail.com> Signed-off-by:
-
Herbert Xu authored
The bridge multicast patches introduced an OOM crash in the forward path, when deliver_clone fails to clone the skb. Reported-by:
Mark Wagner <mwagner@redhat.com> Signed-off-by:
-
Amit Kumar Salecha authored
CRB window register is not per pci-func for NX3031, so caching can result in incorrect values. Signed-off-by:
-
Amit Kumar Salecha authored
Rcv producer should be read in spin-lock. Signed-off-by:
-
