Eric Dumazet [Fri, 18 Nov 2011 20:24:32 +0000 (15:24 -0500)]
ipv4: fix redirect handling
commit f39925dbde77 (ipv4: Cache learned redirect information in
inetpeer.) introduced a regression in ICMP redirect handling.
It assumed ipv4_dst_check() would be called because all possible routes
were attached to the inetpeer we modify in ip_rt_redirect(), but thats
not true.
commit 7cc9150ebe (route: fix ICMP redirect validation) tried to fix
this but solution was not complete. (It fixed only one route)
So we must lookup existing routes (including different TOS values) and
call check_peer_redir() on them.
Reported-by: Ivan Zahariev <famzah@icdsoft.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> CC: Flavio Leitner <fbl@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Thu, 17 Nov 2011 04:40:20 +0000 (04:40 +0000)]
ping: dont increment ICMP_MIB_INERRORS
ping module incorrectly increments ICMP_MIB_INERRORS if feeded with a
frame not belonging to its own sockets.
RFC 2011 states that ICMP_MIB_INERRORS should count "the number of ICMP
messages which the entiry received but determined as having
ICMP-specific errors (bad ICMP checksums, bad length, etc.)."
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> CC: Vasiliy Kulikov <segoon@openwall.com> Acked-by: Flavio Leitner <fbl@redhat.com> Acked-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: David S. Miller <davem@davemloft.net>
The hardware has a restriction that the minimum ring size possible
is 128. The number of elements used is controlled by tx_pending and
the overall number of elements in the ring tx_ring_size, therefore it
is okay to limit the number of elements in use to a small value (63)
but still provide a bigger ring.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Veaceslav Falico [Tue, 15 Nov 2011 06:44:42 +0000 (06:44 +0000)]
bonding: Don't allow mode change via sysfs with slaves present
When changing mode via bonding's sysfs, the slaves are not initialized
correctly. Forbid to change modes with slaves present to ensure that every
slave is initialized correctly via bond_enslave().
Signed-off-by: Veaceslav Falico <vfalico@redhat.com> Signed-off-by: Andy Gospodarek <andy@greyhouse.net> Acked-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
stmmac: fix pm functions avoiding sleep on spinlock
This patch fixes the pm functions to avoid the system
sleeps while a spinlock is taken.
Signed-off-by: Francesco Virlinzi <francesco.virlinzi@st.com> Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This patch removes un-needed spin_lock in stmmac_ioctl while reading and
writing mdio registers. While holding spin_lock the code must be
atomic, which is not true in this case as both mdiobus_read and writes
have mutex locks.
Without this patch reading mdio registers via mii-tool results in below
BUG:
mii-tool -vvv eth0"
Using SIOCGMIIPHY=0x8947
BUG: sleeping function called from invalid context at kernel/mutex.c:287
in_atomic(): 1, irqs_disabled(): 0, pid: 614, name: mii-tool
2 locks held by mii-tool/614:
#0: (rtnl_mutex){......}, at: [<c01fd80c>] dev_ioctl+0x550/0x674
#1: (&priv->lock){......}, at: [<c01b34ec>] stmmac_ioctl+0x4c/0x78
[<c002ea14>] (unwind_backtrace+0x0/0xcc) from [<c0272c38>]
(mutex_lock_nested+0x24/0x35c)
[<c0272c38>] (mutex_lock_nested+0x24/0x35c) from [<c01b237c>]
(mdiobus_read+0x44/0x70)
[<c01b237c>] (mdiobus_read+0x44/0x70) from [<c01b0c64>]
(phy_mii_ioctl+0x4c/0x138)
[<c01b0c64>] (phy_mii_ioctl+0x4c/0x138) from [<c01b34fc>]
(stmmac_ioctl+0x5c/0x78)
[<c01b34fc>] (stmmac_ioctl+0x5c/0x78) from [<c01fcec8>]
(dev_ifsioc+0x2a4/0x2c8)
[<c01fcec8>] (dev_ifsioc+0x2a4/0x2c8) from [<c01fd81c>]
(dev_ioctl+0x560/0x674)
[<c01fd81c>] (dev_ioctl+0x560/0x674) from [<c00c36e0>]
(vfs_ioctl+0x2c/0x8c)
[<c00c36e0>] (vfs_ioctl+0x2c/0x8c) from [<c00c4130>]
(do_vfs_ioctl+0x530/0x578)
[<c00c4130>] (do_vfs_ioctl+0x530/0x578) from [<c00c41ac>]
(sys_ioctl+0x34/0x54)
[<c00c41ac>] (sys_ioctl+0x34/0x54) from [<c0028aa0>]
(ret_fast_syscall+0x0/0x2c)
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@st.com> Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
New GMAC devices (newer than the databook 3.50a) have the
HW capability register that provides which features are actually
supported by the hardware.
On old devices many information have to be passed through the
platform, for example: enhanced descriptor structure,
TX COE etc. These are mandatory to properly configure the driver.
This remains still valid because the driver has to support old
Synopsys devices but now it's also able to override them using the
values from the HW capability register if supported.
Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
stmmac: fix advertising 1000Base capabilties for non GMII iface
This patch fixes the way to stop the 1000Base advertising
capabilties for non GMII interfaces.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@st.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This patch uses an mdelay to manage the timeout on
sw reset to be independant of cpu_clk.
Signed-off-by: Francesco Virlinzi <francesco.virlinzi@st.com> Reviewed-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
The default Tx ring size for the sky2 driver is quite large and could
cause excess buffer bloat for many users. The minimum ring size
possible and still allow handling the worst case packet on 64bit platforms
is 38 which gets rounded up to a power of 2. But most packets only require
a couple of ring elements.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
There are several problems with recent change to how IRQ's are setup.
* synchronize_irq in sky2_shutdown would hang because there
was no IRQ setup.
* when device was set to down, some IRQ bits left enabled so a
hardware error would produce IRQ with no handler
* quick link on Optima chip set was enabled without handler
* suspend/resume would leave IRQ on with no handler if device
was down
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Dmitry Kravkov [Tue, 15 Nov 2011 12:07:33 +0000 (12:07 +0000)]
bnx2x: cache-in compressed fw image
Re-request fw from fs may fail for different reasons, once the fw was
loaded we won't release it until driver is removed.
This also resolves the boot problem when initial fw is located on initrd,
but rootfs is still unavailable, in this case device reset will fail due
to absence of fw files.
Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
so the defconfig of the atmel continue to have the support of the network
as before
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Cc: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Bridge multicast snooping of ICMPv6 would incorrectly report a checksum problem
when used with Ethernet devices like sky2 that use CHECKSUM_COMPLETE.
When bytes are removed from skb, the computed checksum needs to be adjusted.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Tested-by: Martin Volf <martin.volf.42@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Einar Lueck [Tue, 15 Nov 2011 02:31:16 +0000 (02:31 +0000)]
qeth: Reduce CPU consumption through less SIGA-r calls
Patch avoids SIGA-r calls in case of SIGA-r required. It only calls
SIGA-r if a threshold of free buffer is reached. CPU consumption is
reduced as a consequence.
Signed-off-by: Einar Lueck <elelueck@de.ibm.com> Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Ursula Braun [Tue, 15 Nov 2011 02:31:14 +0000 (02:31 +0000)]
netiucv: reinsert dev_alloc_name for device naming
Invocation of dev_alloc_name() is re-inserted, because the created
net_device name is used to create the device name for the iucv bus.
This device is created before the register_netdev call.
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
The patch "qeth: exploit asynchronous delivery of storage blocks"
added a WARN_ON in qeth_schedule_recovery. A device recovery should
not cause a kernel warning. This is obviously a debugging left-over
that we forgot to remove.
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Ursula Braun [Tue, 15 Nov 2011 02:31:12 +0000 (02:31 +0000)]
qeth: return with -EPERM if sniffing is not enabled
Without appropriate configuration at the SE, a HiperSockets device
cannot be used for sniffing. Setting the sniffer attribute is rejected
with -EPERM.
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Mon, 14 Nov 2011 10:56:56 +0000 (10:56 +0000)]
tcp: clear xmit timers in tcp_v4_syn_recv_sock()
Simon Kirby reported divides by zero errors in __tcp_select_window()
This happens when inet_csk_route_child_sock() returns a NULL pointer :
We free new socket while we eventually armed keepalive timer in
tcp_create_openreq_child()
Fix this by a call to tcp_clear_xmit_timers()
[ This is a followup to commit 918eb39962dff (net: add missing
bh_unlock_sock() calls) ]
Reported-by: Simon Kirby <sim@hostway.ca> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Simon Kirby <sim@hostway.ca> Signed-off-by: David S. Miller <davem@davemloft.net>
Grant Grundler [Tue, 15 Nov 2011 07:12:42 +0000 (07:12 +0000)]
net-next:asix: V2 more fixes for ax88178 phy init sequence
Now works on Samsung Series 5 (chromebook)
Two fixes here:
o use 0x7F mask for phymode
o read phyid *AFTER* phy is powered up (via GPIOs)
Signed-off-by: Allan Chou <allan@asix.com.tw> Signed-off-by: Grant Grundler <grundler@chromium.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Grant Grundler [Tue, 15 Nov 2011 07:12:41 +0000 (07:12 +0000)]
net-next:asix: reduce AX88772 init time by about 2 seconds
ax88772_reset takes about 2 seconds and is called twice.
Once from ax88772_bind() directly and again indirectly from usbnet_open().
Reset the USB FW/Phy enough to blink the LEDs when inserted.
Signed-off-by: Allan Chou <allan@asix.com.tw> Signed-off-by: Grant Grundler <grundler@chromium.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Grant Grundler [Tue, 15 Nov 2011 07:12:40 +0000 (07:12 +0000)]
net-next:asix:poll in asix_get_phyid in case phy not ready
Sometimes the phy isn't ready after reset...poll and pray it will be soon.
Signed-off-by: Freddy Xin <freddy@asix.com.tw> Signed-off-by: Grant Grundler <grundler@chromium.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Jesper Juhl [Sun, 13 Nov 2011 21:14:32 +0000 (22:14 +0100)]
Net, libertas: Resolve memory leak in if_spi_host_to_card()
If we hit the default case in the switch in if_spi_host_to_card() we'll leak
the memory we allocated for 'packet'. This patch resolves the leak by freeing
the allocated memory in that case.
Signed-off-by: Jesper Juhl <jj@chaosbits.net> Acked-by: Dan Williams <dcbw@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com>
rt2x00: Fix sleep-while-atomic bug in powersaving code.
The generic powersaving code that determines after reception of a frame
whether the device should go back to sleep or whether is could stay
awake was calling rt2x00lib_config directly from RX tasklet context.
On a number of the devices this call can actually sleep, due to having
to confirm that the sleeping commands have been executed successfully.
Fix this by moving the call to rt2x00lib_config to a workqueue call.
This fixes bug https://bugzilla.redhat.com/show_bug.cgi?id=731672
Tested-by: Tomas Trnka <tomastrnka@gmx.com> Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com> Cc: <stable@vger.kernel.org> Acked-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Reported-by: Teika Kazura <teika@lavabit.com> Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com> Acked-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Unfortunately TOS and TCLASS are both present in a dual-stack v6 socket,
furthermore they can have different values. As such one cannot in a
sane way expose both through a single attribute.
Signed-off-by: Maciej Żenczyowski <maze@google.com> CC: Murali Raja <muralira@google.com> CC: Stephen Hemminger <shemminger@vyatta.com> CC: Eric Dumazet <eric.dumazet@gmail.com> CC: David S. Miller <davem@davemloft.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Mark Kamichoff [Wed, 9 Nov 2011 11:48:10 +0000 (11:48 +0000)]
net/usb: Misc. fixes for the LG-VL600 LTE USB modem
Add checking for valid magic values (needed for stability in the event
corrupted packets are received) and remove some other unneeded checks.
Also, fix flagging device as WWAN (Bugzilla bug #39952).
Signed-off-by: Mark Kamichoff <prox@prolixium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Robert Marklund [Tue, 25 Oct 2011 22:05:43 +0000 (22:05 +0000)]
net/smsc911x: Always wait for the chip to be ready
Wait for the chip to be ready before any access to it. On the
Snowball platform we need to enable an external regulator before
the chip comes online, and then it happens that the device is
not yet ready at probe time, so let's wait for it.
Signed-off-by: Robert Marklund <robert.marklund@stericsson.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Josh Boyer [Thu, 10 Nov 2011 15:10:23 +0000 (15:10 +0000)]
ip6_tunnel: copy parms.name after register_netdevice
Commit 1c5cae815d removed an explicit call to dev_alloc_name in ip6_tnl_create
because register_netdevice will now create a valid name. This works for the
net_device itself.
However the tunnel keeps a copy of the name in the parms structure for the
ip6_tnl associated with the tunnel. parms.name is set by copying the net_device
name in ip6_tnl_dev_init_gen. That function is called from ip6_tnl_dev_init in
ip6_tnl_create, but it is done before register_netdevice is called so the name
is set to a bogus value in the parms.name structure.
This shows up if you do a simple tunnel add, followed by a tunnel show:
[root@localhost ~]# ip -6 tunnel add remote fec0::100 local fec0::200
[root@localhost ~]# ip -6 tunnel show
ip6tnl0: ipv6/ipv6 remote :: local :: encaplimit 0 hoplimit 0 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)
ip6tnl%d: ipv6/ipv6 remote fec0::100 local fec0::200 encaplimit 4 hoplimit 64 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)
[root@localhost ~]#
Fix this by moving the strcpy out of ip6_tnl_dev_init_gen, and calling it after
register_netdevice has successfully returned.
Cc: stable@vger.kernel.org Signed-off-by: Josh Boyer <jwboyer@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
david decotigny [Fri, 11 Nov 2011 16:27:34 +0000 (16:27 +0000)]
forcedeth: fix stats on hardware without extended stats support
This change makes sure that tx_packets/rx_bytes ifconfig counters are
updated even on NICs that don't provide hardware support for these
stats: they are now updated in software. For the sake of consistency,
we also now have tx_bytes updated in software (hardware counters
include ethernet CRC, and software doesn't account for it).
Paul Bolle [Sun, 13 Nov 2011 03:36:37 +0000 (03:36 +0000)]
rds: drop "select LLIST"
Commit 1bc144b625 ("net, rds, Replace xlist in net/rds/xlist.h with
llist") added "select LLIST" to the RDS_RDMA Kconfig entry. But there is
no Kconfig symbol named LLIST. The select statement for that symbol is a
nop. Drop it.
lib/llist.o is builtin, so all that's needed to use the llist
functionality is to include linux/llist.h, which this commit also did.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: David S. Miller <davem@davemloft.net>
Jesper Juhl [Mon, 14 Nov 2011 05:09:21 +0000 (00:09 -0500)]
net/packet: remove dead code and unneeded variable from prb_setup_retire_blk_timer()
We test for 'tx_ring' being != zero and BUG() if that's the case. So after
that check there is no way that 'tx_ring' could be anything _but_ zero, so
testing it again is just dead code. Once that dead code is removed, the
'pkc' local variable becomes entirely redundant, so remove that as well.
Signed-off-by: Jesper Juhl <jj@chaosbits.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Nick Bowler [Thu, 10 Nov 2011 09:01:27 +0000 (09:01 +0000)]
ah: Don't return NET_XMIT_DROP on input.
When the ahash driver returns -EBUSY, AH4/6 input functions return
NET_XMIT_DROP, presumably copied from the output code path. But
returning transmit codes on input doesn't make a lot of sense.
Since NET_XMIT_DROP is a positive int, this gets interpreted as
the next header type (i.e., success). As that can only end badly,
remove the check.
Signed-off-by: Nick Bowler <nbowler@elliptictech.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Amitkumar Karwar [Thu, 10 Nov 2011 05:36:21 +0000 (21:36 -0800)]
mwifiex: fix association issue with AP configured in hidden SSID mode
Firmware expects 'max_ssid_length' field in
'struct mwifiex_ie_types_wildcard_ssid_params' to be '0' for
performing SSID specific scan. Currently driver updates it with
an actual SSID length. Hence UUT is not able to find the AP
configured in hidden SSID mode in scan results and association
fails.
max_ssid_length is filled with '0' to fix the issue.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
iwlwifi: avoid a panic when unloading the module with RF Kill
When HW RF kill switch is set to kill the radio, our NIC issues an
interrupt after we stop the APM module. When we unload the module,
the driver disables and cleans the interrupts before stopping the
APM. So we have a real interrupt (inta not zero) pending.
When this interrupts pops up the tasklet has already been killed
and we crash.
Here is a logical description of the flow:
disable and clean interrupts
synchronize interrupts
kill the tasklet
stop the APM <<== creates an RF kill interrupt
free_irq <<== somehow our ISR is called here and we crash
Li Wei [Tue, 8 Nov 2011 21:39:28 +0000 (21:39 +0000)]
ipv4: fix for ip_options_rcv_srr() daddr update.
When opt->srr_is_hit is set skb_rtable(skb) has been updated for
'nexthop' and iph->daddr should always equals to skb_rtable->rt_dst
holds, We need update iph->daddr either.
Signed-off-by: Li Wei <lw@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Nick Bowler [Tue, 8 Nov 2011 12:12:45 +0000 (12:12 +0000)]
ah: Read nexthdr value before overwriting it in ahash input callback.
The AH4/6 ahash input callbacks read out the nexthdr field from the AH
header *after* they overwrite that header. This is obviously not going
to end well. Fix it up.
Signed-off-by: Nick Bowler <nbowler@elliptictech.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Nick Bowler [Tue, 8 Nov 2011 12:12:44 +0000 (12:12 +0000)]
ah: Correctly pass error codes in ahash output callback.
The AH4/6 ahash output callbacks pass nexthdr to xfrm_output_resume
instead of the error code. This appears to be a copy+paste error from
the input case, where nexthdr is expected. This causes the driver to
continuously add AH headers to the datagram until either an allocation
fails and the packet is dropped or the ahash driver hits a synchronous
fallback and the resulting monstrosity is transmitted.
Correct this issue by simply passing the error code unadulterated.
Signed-off-by: Nick Bowler <nbowler@elliptictech.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Paul Bolle [Tue, 8 Nov 2011 10:31:10 +0000 (10:31 +0000)]
net: drivers/net/hippi/Kconfig should be sourced
Commit ff5a3b509e ("hippi: Move the HIPPI driver") moved the HIPPI
driver into drivers/net/hippi. It didn't source
drivers/net/hippi/Kconfig though, so it didn't make all necessary
Kconfig changes. So let drivers/net/kconfig source HIPPI's Kconfig file.
[ Fix syntax error at the end of HIPP's Kconfig file. -DaveM ]
Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Ricardo Ribalda [Mon, 7 Nov 2011 23:31:58 +0000 (23:31 +0000)]
net/temac: FIX segfault when process old irqs
Do not enable the irq until the scatter gather registers are ready to
handle the data. Otherwise an irq from a packet send/received before
last close can lead to an access to an invalid memory region on the irq
handler.
Also, stop the dma engine on close.
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Johannes Berg [Wed, 9 Nov 2011 11:14:16 +0000 (12:14 +0100)]
mac80211: fix race between connection monitor & suspend
When the connection monitor timer fires right before
suspend, the following will happen:
timer fires -> monitor_work gets queued
suspend calls ieee80211_sta_quiesce
ieee80211_sta_quiesce:
- deletes timer
- cancels monitor_work synchronously, running it
[note wrong order of these steps]
monitor_work runs, re-arming the timer
later, timer fires while system should be quiesced
This causes a warning:
WARNING: at net/mac80211/util.c:540 ieee80211_can_queue_work+0x35/0x40 [mac80211]()
but is otherwise harmless. I'm not completely sure
this is the scenario Thomas stumbled across, but it
is the only way I can right now see the warning in
a scenario like the one he reported.
Reported-by: Thomas Meyer <thomas@m3y3r.de> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
cfg80211: fix bug on regulatory core exit on access to last_request
Commit 4d9d88d1 by Scott James Remnant <keybuk@google.com> added
the .uevent() callback for the regulatory device used during
the platform device registration. The change was done to account
for queuing up udev change requests through udevadm triggers.
The change also meant that upon regulatory core exit we will now
send a uevent() but the uevent() callback, reg_device_uevent(),
also accessed last_request. Right before commiting device suicide
we free'd last_request but never set it to NULL so
platform_device_unregister() would lead to bogus kernel paging
request. Fix this and also simply supress uevents right before
we commit suicide as they are pointless.
The impact of not having this present is that a bogus paging
access may occur (only read) upon cfg80211 unload time. You
may also get this BUG complaint below. Although Johannes
could not reproduce the issue this fix is theoretically correct.
Reported-by: Johannes Berg <johannes@sipsolutions.net> Cc: Scott James Remnant <keybuk@google.com> Cc: stable@vger.kernel.org Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Johannes Berg [Tue, 8 Nov 2011 11:28:33 +0000 (12:28 +0100)]
mac80211: fix NULL dereference in radiotap code
When receiving failed PLCP frames is enabled, there
won't be a rate pointer when we add the radiotap
header and thus the kernel will crash. Fix this by
not assuming the rate pointer is always valid. It's
still always valid for frames that have good PLCP
though, and that is checked & enforced.
where I removed the check in this case but didn't
take into account that the rate info would be used.
Reported-by: Xiaokang Qin <xiaokang.qin@intel.com> Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Helmut Schaa [Tue, 8 Nov 2011 13:01:13 +0000 (14:01 +0100)]
ath: Fix NULL ptr dereference in ath_reg_apply_world_flags
This happens with devices using a regulatory domain 0x68 that are only
5Ghz capable because ath_reg_apply_active_scan_flags assumes that we
always have a 2,4Ghz band.
Steffen Klassert [Tue, 11 Oct 2011 01:12:02 +0000 (01:12 +0000)]
ipv4: Fix inetpeer expire time information
As we update the learned pmtu informations on demand, we might
report a nagative expiration time value to userspace if the
pmtu informations are already expired and we have not send a
packet to that inetpeer after expiration. With this patch we
send a expire time of null to userspace after expiration
until the next packet is send to that inetpeer.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net>
oftedal [Mon, 7 Nov 2011 11:47:53 +0000 (11:47 +0000)]
sunhme: Allow usage on SBI based SBus systems
To prevent the SBus driver for Sun Happy Meal cards from being loaded for
PCI cards utilizing the same chipset, a filter was added to the probe
function in commit 0b492fce3d72d982a7981905f85484a1e1ba7fde.
The filter was implemented by checking the name of the parent node in
the OF tree. This patch extends this filter, so that the driver will
load on SBus systems that are based upon SBI SBus Bridges.
Signed-off-by: Kjetil Oftedal <oftedal@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Nico Erfurth [Tue, 8 Nov 2011 07:30:40 +0000 (07:30 +0000)]
Fix incorrect usage of NET_IP_ALIGN
The driver used NET_IP_ALIGN to remove some additional padding inside of
the rx_fixup function. On many architectures NET_IP_ALIGN defaults to 2
which removed the correct amount of bytes.
On MCORE2-machines commit ea812ca1b06113597adcd8e70c0f84a413d97544
introduces a change which sets NET_IP_ALIGN to 0 by default. Which
triggered the bug on these machines.
This fix introduces a new RXW_PADDING define and uses this instead of
NET_IP_ALIGN. The name was taken from the original SMSC7500 driver which
is provided by SMSC.
Signed-off-by: Nico Erfurth <ne@erfurth.eu> Tested-by: Phil Sutter <phil@nwl.cc> Signed-off-by: David S. Miller <davem@davemloft.net>
Brian Haley [Tue, 8 Nov 2011 04:41:42 +0000 (04:41 +0000)]
ipv6: drop packets when source address is multicast
RFC 4291 Section 2.7 says Multicast addresses must not be used as source
addresses in IPv6 packets - drop them on input so we don't process the
packet further.
Signed-off-by: Brian Haley <brian.haley@hp.com> Reported-and-Tested-by: Kumar Sanghvi <divinekumar@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
hayeswang [Mon, 7 Nov 2011 20:44:37 +0000 (20:44 +0000)]
r8169: increase the delay parameter of pm_schedule_suspend
The link down would occur when reseting PHY. And it would take about 2 ~ 5 seconds
from link down to link up. If the delay of pm_schedule_suspend is not long enough,
the device would enter runtime_suspend before link up. After link up, the device
would wake up and reset PHY again. Then, you would find the driver keep in a loop
of runtime_suspend and rumtime_resume.
Signed-off-by: Hayes Wang <hayeswang@realtek.com> Acked-by: Francois Romieu <romieu@fr.zoreil.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Tue, 8 Nov 2011 00:16:02 +0000 (16:16 -0800)]
Linux 3.2-rc1
.. with new name. Because nothing says "really solid kernel release"
like naming it after an extinct animal that just happened to be in the
news lately.
Al Viro [Mon, 7 Nov 2011 21:21:26 +0000 (21:21 +0000)]
VFS: we need to set LOOKUP_JUMPED on mountpoint crossing
Mountpoint crossing is similar to following procfs symlinks - we do
not get ->d_revalidate() called for dentry we have arrived at, with
unpleasant consequences for NFS4.
Linus Torvalds [Mon, 7 Nov 2011 20:38:11 +0000 (12:38 -0800)]
Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf top: Fix live annotation in the --stdio interface
perf top tui: Don't recalc column widths considering just the first page
perf report: Add progress bar when processing time ordered events
perf hists browser: Warn about lost events
perf tools: Fix a typo of command name as trace-cmd
perf hists: Fix recalculation of total_period when sorting entries
perf header: Fix build on old systems
perf ui browser: Handle K_RESIZE in dialog windows
perf ui browser: No need to switch char sets that often
perf hists browser: Use K_TIMER
perf ui: Rename ui__warning_paranoid to ui__error_paranoid
perf ui: Reimplement the popup windows using libslang
perf ui: Reimplement ui__popup_menu using ui__browser
perf ui: Reimplement ui_helpline using libslang
perf ui: Improve handling sigwinch a bit
perf ui progress: Reimplement using slang
perf evlist: Fix grouping of multiple events
Tony Lindgren [Mon, 7 Nov 2011 20:27:10 +0000 (12:27 -0800)]
ARM: OMAP: Fix export.h or module.h includes
Commit 32aaeffbd4a7457bf2f7448b33b5946ff2a960eb (Merge branch
'modsplit-Oct31_2011'...) caused some build errors. Fix these
and make sure we always have export.h or module.h included
for MODULE_ and EXPORT_SYMBOL users:
Axel Lin [Mon, 7 Nov 2011 20:27:10 +0000 (12:27 -0800)]
ARM: OMAP: omap_device: Include linux/export.h
Include linux/export.h to fix below build warning:
CC arch/arm/plat-omap/omap_device.o
arch/arm/plat-omap/omap_device.c:1055: warning: data definition has no type or storage class
arch/arm/plat-omap/omap_device.c:1055: warning: type defaults to 'int' in declaration of 'EXPORT_SYMBOL'
arch/arm/plat-omap/omap_device.c:1055: warning: parameter names (without types) in function declaration
Signed-off-by: Axel Lin <axel.lin@gmail.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
Bluetooth: Use miliseconds for L2CAP channel timeouts
Timers set by __set_chan_timer() should use miliseconds instead of
jiffies. Commit 942ecc9c4643db5ce071562e0a23f99464d6b461 updated
l2cap_set_timer() so it expects timeout to be specified in msecs
instead of jiffies. This makes timeouts unreliable when CONFIG_HZ
is not set to 1000.
Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (47 commits)
forcedeth: fix a few sparse warnings (variable shadowing)
forcedeth: Improve stats counters
forcedeth: remove unneeded stats updates
forcedeth: Acknowledge only interrupts that are being processed
forcedeth: fix race when unloading module
MAINTAINERS/rds: update maintainer
wanrouter: Remove kernel_lock annotations
usbnet: fix oops in usbnet_start_xmit
ixgbe: Fix compile for kernel without CONFIG_PCI_IOV defined
etherh: Add MAINTAINERS entry for etherh
bonding: comparing a u8 with -1 is always false
sky2: fix regression on Yukon Optima
netlink: clarify attribute length check documentation
netlink: validate NLA_MSECS length
i825xx:xscale:8390:freescale: Fix Kconfig dependancies
macvlan: receive multicast with local address
tg3: Update version to 3.121
tg3: Eliminate timer race with reset_task
tg3: Schedule at most one tg3_reset_task run
tg3: Obtain PCI function number from device
...
This reverts commit 330605423ca6eafafb8dcc27502bce1c585d1b06.
The commit introduces regression when two 2.1 devices attempt
establish rfcomm channel. Such connection is refused since there's
a security block issue on l2cap. It means the link is unencrypted.
david decotigny [Sat, 5 Nov 2011 14:38:24 +0000 (14:38 +0000)]
forcedeth: fix a few sparse warnings (variable shadowing)
This fixes the following sparse warnings:
drivers/net/ethernet/nvidia/forcedeth.c:2113:7: warning: symbol 'size' shadows an earlier one
drivers/net/ethernet/nvidia/forcedeth.c:2102:6: originally declared here
drivers/net/ethernet/nvidia/forcedeth.c:2155:7: warning: symbol 'size' shadows an earlier one
drivers/net/ethernet/nvidia/forcedeth.c:2102:6: originally declared here
drivers/net/ethernet/nvidia/forcedeth.c:2227:7: warning: symbol 'size' shadows an earlier one
drivers/net/ethernet/nvidia/forcedeth.c:2215:6: originally declared here
drivers/net/ethernet/nvidia/forcedeth.c:2271:7: warning: symbol 'size' shadows an earlier one
drivers/net/ethernet/nvidia/forcedeth.c:2215:6: originally declared here
drivers/net/ethernet/nvidia/forcedeth.c:2986:20: warning: symbol 'addr' shadows an earlier one
drivers/net/ethernet/nvidia/forcedeth.c:2963:6: originally declared here
Signed-off-by: David Decotigny <david.decotigny@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Mandeep Baines [Sat, 5 Nov 2011 14:38:23 +0000 (14:38 +0000)]
forcedeth: Improve stats counters
Rx byte count was off; instead use the hardware's count. Tx packet
count was counting pre-TSO packets; instead count on-the-wire packets.
Report hardware dropped frame count as rx_fifo_errors.
- The count of transmitted packets reported by the forcedeth driver
reports pre-TSO (TCP Segmentation Offload) packet counts and not the
count of the number of packets sent on the wire. This change fixes
the forcedeth driver to report the correct count. Fixed the code by
copying the count stored in the NIC H/W to the value reported by the
driver.
- Count rx_drop_frame errors as rx_fifo_errors:
We see a lot of rx_drop_frame errors if we disable the rx bottom-halves
for too long. Normally, rx_fifo_errors would be counted in this case.
The rx_drop_frame error count is private to forcedeth and is not
reported by ifconfig or sysfs. The rx_fifo_errors count is currently
unused in the forcedeth driver. It is reported by ifconfig as overruns.
This change reports rx_drop_frame errors as rx_fifo_errors.
Signed-off-by: David Decotigny <david.decotigny@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
david decotigny [Sat, 5 Nov 2011 14:38:22 +0000 (14:38 +0000)]
forcedeth: remove unneeded stats updates
Function ndo_get_stats() updates most of the stats from hardware
registers, making the manual updates un-needed. This change removes
these manual updates. Main exception is rx_missed_errors which needs
manual update.
Another exception is rx_packets, still updated manually in this commit
to make sure this patch doesn't change behavior of driver. This will
be addressed by a future patch.
Signed-off-by: David Decotigny <david.decotigny@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Mike Ditto [Sat, 5 Nov 2011 14:38:21 +0000 (14:38 +0000)]
forcedeth: Acknowledge only interrupts that are being processed
This is to avoid a race, accidentally acknowledging an interrupt that
we didn't notice and won't immediately process. This is based solely
on code inspection; it is not known if there was an actual bug here.
Signed-off-by: David Decotigny <david.decotigny@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
david decotigny [Sat, 5 Nov 2011 14:38:20 +0000 (14:38 +0000)]
forcedeth: fix race when unloading module
When forcedeth module is unloaded, there exists a path that can lead
to mod_timer() after del_timer_sync(), causing an oops. This patch
short-circuits this unneeded path, which originates in
nv_get_ethtool_stats().
Tested:
x86_64 16-way + 3 ethtool -S infinite loops + 100Mbps incoming traffic
+ rmmod/modprobe/ifconfig in a loop
projects / mirror_ubuntu-artful-kernel.git / log