summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* irda: prevent integer underflow in IRLMP_ENUMDEVICESDan Rosenberg2010-12-231-7/+11
| | | | | | | | | | | If the user-provided len is less than the expected offset, the IRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large size value. While this isn't be a security issue on x86 because it will get caught by the access_ok() check, it may leak large amounts of kernel heap on other architectures. In any event, this patch fixes it. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* tcp: fix listening_get_next()Eric Dumazet2010-12-231-2/+2
| | | | | | | | | | | | | | Alexey Vlasov found /proc/net/tcp could sometime loop and display millions of sockets in LISTEN state. In 2.6.29, when we converted TCP hash tables to RCU, we left two sk_next() calls in listening_get_next(). We must instead use sk_nulls_next() to properly detect an end of chain. Reported-by: Alexey Vlasov <renton@renton.name> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'master' of ↵David S. Miller2010-12-226-9/+36
|\ | | | | | | ssh://master.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
| * mac80211: fix mesh forwardingJohannes Berg2010-12-221-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | Under memory pressure, the mac80211 mesh code may helpfully print a message that it failed to clone a mesh frame and then will proceed to crash trying to use it anyway. Fix that. Cc: stable@kernel.org [2.6.27+] Signed-off-by: Johannes Berg <johannes.berg@intel.com> Acked-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * hostap: remove netif_stop_queue from initMeelis Roos2010-12-201-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | Fix runtime warning with backtrace from hostap by removing netif_stop_queue() call before register_netdev. Tested to work fine on hostap_pci Prism 2.5. (This removes a warning about calling netif_stop_queue before register_netdev is called. -- JWL) Signed-off-by: Meelis Roos <mroos@linux.ee> Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * mac80211/rt2x00: add ieee80211_tx_status_ni()Johannes Stezenbach2010-12-204-7/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All rt2x00 drivers except rt2800pci call ieee80211_tx_status() from a workqueue, which causes "NOHZ: local_softirq_pending 08" messages. To fix it, add ieee80211_tx_status_ni() similar to ieee80211_rx_ni() which can be called from process context, and call it from rt2x00lib_txdone(). For the rt2800pci special case a driver flag is introduced. https://bugzilla.kernel.org/show_bug.cgi?id=24892 Signed-off-by: Johannes Stezenbach <js@sig21.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* | atl1c: Do not use legacy PCI power managementRafael J. Wysocki2010-12-221-24/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | The atl1c driver uses the legacy PCI power management, so it has to do some PCI-specific things in its ->suspend() and ->resume() callbacks and they are not done correctly. Convert atl1c to the new PCI power management framework and make it let the PCI subsystem handle all of the PCI-specific aspects of device handling during system power transitions. Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
* | MAINTAINERS: email address changeDon Fry2010-12-211-1/+1
| | | | | | | | | | | | | | My ISP has changed and therefore my email address. Signed-off-by: Don Fry <pcnet32@frontier.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: Fix range checks in tcf_valid_offset().David S. Miller2010-12-211-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This function has three bugs: 1) The offset should be valid most of the time, this is just a sanity check, therefore we should use "likely" not "unlikely" 2) This is the only place where we can check for arithmetic overflow of the pointer plus the length. 3) The existing range checks are off by one, the valid range is skb->head to skb_tail_pointer(), inclusive. Based almost entirely upon a patch by Ralph Loader. Reported-by: Ralph Loader <suckfish@ihug.co.nz> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net_sched: sch_sfq: fix allot handlingEric Dumazet2010-12-201-12/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When deploying SFQ/IFB here at work, I found the allot management was pretty wrong in sfq, even changing allot from short to int... We should init allot for each new flow, not using a previous value found in slot. Before patch, I saw bursts of several packets per flow, apparently denying the default "quantum 1514" limit I had on my SFQ class. class sfq 11:1 parent 11: (dropped 0, overlimits 0 requeues 0) backlog 0b 7p requeues 0 allot 11546 class sfq 11:46 parent 11: (dropped 0, overlimits 0 requeues 0) backlog 0b 1p requeues 0 allot -23873 class sfq 11:78 parent 11: (dropped 0, overlimits 0 requeues 0) backlog 0b 5p requeues 0 allot 11393 After patch, better fairness among each flow, allot limit being respected, allot is positive : class sfq 11:e parent 11: (dropped 0, overlimits 0 requeues 86) backlog 0b 3p requeues 86 allot 596 class sfq 11:94 parent 11: (dropped 0, overlimits 0 requeues 0) backlog 0b 3p requeues 0 allot 1468 class sfq 11:a4 parent 11: (dropped 0, overlimits 0 requeues 0) backlog 0b 4p requeues 0 allot 650 class sfq 11:bb parent 11: (dropped 0, overlimits 0 requeues 0) backlog 0b 3p requeues 0 allot 596 Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | typhoon: memory corruption in typhoon_get_drvinfo()Dan Carpenter2010-12-201-1/+0
| | | | | | | | | | | | | | | | | | | | | | info->version only has space for 32 characters but my UTS_RELEASE is "2.6.37-rc6-next-20101217-05817-ge935fc8-dirty" so it doesn't fit. This is supposed to be the version of the driver, not the kernel version. This driver doesn't have a version so lets just leave it blank. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: Add USB PID for new MOSCHIP USB ethernet controller MCS7832 variantAndreas Mohr2010-12-201-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | Due to active notification of the new MCS7832 version by the manufacturer (Mr. Milton; thanks!) -- quote: "functionality same as MCS7830", I'm now submitting this patch (on -rc6), intended for networking.git and -stable. - add MCS7832 USB PID to be able to support this new device variant, too - add related descriptions Signed-off-by: Andreas Mohr <andi@lisas.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net_sched: always clone skbsChangli Gao2010-12-201-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pawel reported a panic related to handling shared skbs in ixgbe incorrectly. So we need to revert my previous patch to work around this bug. Instead of reverting the patch completely, I just revert the essential lines, so we can add the previous optimization back more easily in future. commit 3511c9132f8b1e1b5634e41a3331c44b0c13be70 Author: Changli Gao <xiaosuo@gmail.com> Date: Sat Oct 16 13:04:08 2010 +0000 net_sched: remove the unused parameter of qdisc_create_dflt() Reported-by: Pawel Staszewski <pstaszewski@itcare.pl> Signed-off-by: Changli Gao <xiaosuo@gmail.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed.David Stevens2010-12-193-11/+27
| | | | | | | | | | | | | | | | | | | | | | | | This patch modifies IPsec6 to fragment IPv6 packets that are locally generated as needed. This version of the patch only fragments in tunnel mode, so that fragment headers will not be obscured by ESP in transport mode. Signed-off-by: David L Stevens <dlstevens@us.ibm.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netlink: fix gcc -Wconversion compilation warningDmitry V. Levin2010-12-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | $ cat << EOF | gcc -Wconversion -xc -S -o/dev/null - unsigned f(void) {return NLMSG_HDRLEN;} EOF <stdin>: In function 'f': <stdin>:3:26: warning: negative integer implicitly converted to unsigned type Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name> Signed-off-by: David S. Miller <davem@davemloft.net>
* | asix: add USB ID for Logitec LAN-GTJ U2AArnaud Ebalard2010-12-171-0/+4
| | | | | | | | | | | | | | | | | | | | Logitec LAN-GTJ U2A (http://www.pro.logitec.co.jp/pro/g/gLAN-GTJU2A/) USB 2.0 10/10/1000 Ethernet adapter is based on ASIX AX88178 chipset. This patch adds missing USB ID for the device. Signed-off-by: Arnaud Ebalard <arno@natisbad.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* | tehuti: Firmware filename is tehuti/bdx.binBen Hutchings2010-12-171-2/+2
| | | | | | | | | | | | | | | | | | | | My conversion of tehuti to use request_firmware() was confused about the filename of the firmware blob. Change the driver to match the blob. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Andy Gospodarek <andy@greyhouse.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ipv6: don't flush routes when setting loopback downstephen hemminger2010-12-161-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | When loopback device is being brought down, then keep the route table entries because they are special. The entries in the local table for linklocal routes and ::1 address should not be purged. This is a sub optimal solution to the problem and should be replaced by a better fix in future. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Acked-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | sctp: fix the return value of getting the sctp partial delivery pointWei Yongjun2010-12-161-1/+1
| | | | | | | | | | | | | | | | | | Get the sctp partial delivery point using SCTP_PARTIAL_DELIVERY_POINT socket option should return 0 if success, not -ENOTSUPP. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net/veth: Fix packet checksummingMichał Mirosław2010-12-161-1/+3
| | | | | | | | | | | | | | | | | | We can't change ip_summed from CHECKSUM_PARTIAL to CHECKSUM_NONE or CHECKSUM_UNNECESSARY because checksum in packet's headers is not valid and will cause invalid checksum when frame is forwarded. Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bridge: fix IPv6 queries for bridge multicast snoopingDavid Stevens2010-12-161-1/+1
| | | | | | | | | | | | | | | | This patch fixes a missing ntohs() for bridge IPv6 multicast snooping. Signed-off-by: David L Stevens <dlstevens@us.ibm.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: fix nulls list corruptions in sk_prot_allocOctavian Purdila2010-12-166-12/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Special care is taken inside sk_port_alloc to avoid overwriting skc_node/skc_nulls_node. We should also avoid overwriting skc_bind_node/skc_portaddr_node. The patch fixes the following crash: BUG: unable to handle kernel paging request at fffffffffffffff0 IP: [<ffffffff812ec6dd>] udp4_lib_lookup2+0xad/0x370 [<ffffffff812ecc22>] __udp4_lib_lookup+0x282/0x360 [<ffffffff812ed63e>] __udp4_lib_rcv+0x31e/0x700 [<ffffffff812bba45>] ? ip_local_deliver_finish+0x65/0x190 [<ffffffff812bbbf8>] ? ip_local_deliver+0x88/0xa0 [<ffffffff812eda35>] udp_rcv+0x15/0x20 [<ffffffff812bba45>] ip_local_deliver_finish+0x65/0x190 [<ffffffff812bbbf8>] ip_local_deliver+0x88/0xa0 [<ffffffff812bb2cd>] ip_rcv_finish+0x32d/0x6f0 [<ffffffff8128c14c>] ? netif_receive_skb+0x99c/0x11c0 [<ffffffff812bb94b>] ip_rcv+0x2bb/0x350 [<ffffffff8128c14c>] netif_receive_skb+0x99c/0x11c0 Signed-off-by: Leonard Crestez <lcrestez@ixiacom.com> Signed-off-by: Octavian Purdila <opurdila@ixiacom.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | be2net: use mutex instead of spin lock for mbox_lockIvan Vecera2010-12-163-32/+47
| | | | | | | | | | | | | | | | | | | | Since the mbox polling uses the schedule_timeout, the mbox_lock should be a mutex and not a spin lock. The commit f25b03a replaced udelay() with schedule_timeout() but didn't change mbox_lock to semaphore or mutex. Signed-off-by: Ivan Vecera <ivecera@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bonding/vlan: Fix mangled NAs on slaves without VLAN tag insertionBen Hutchings2010-12-161-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | bond_na_send() attempts to insert a VLAN tag in between building and sending packets of the respective formats. If the slave does not implement hardware VLAN tag insertion then vlan_put_tag() will mangle the network-layer header because the Ethernet header is not present at this point (unlike in bond_arp_send()). Fix this by adding the tag out-of-line and relying on dev_hard_start_xmit() to insert it inline if necessary. Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Reviewed-by: Jesse Gross <jesse@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bonding: Change active slave quietly when bond is downBen Hutchings2010-12-161-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | bond_change_active_slave() may be called when a slave is added, even if the bond has not been brought up yet. It may then attempt to send packets, and further it may use mcast_work which is uninitialised before the bond is brought up. Add the necessary checks for netif_running(bond->dev). Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bonding/vlan: Remove redundant VLAN tag insertion logicBen Hutchings2010-12-161-26/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A bond may have a mixture of slave devices with and without hardware VLAN tag insertion capability. Therefore it always claims this capability and performs software VLAN tag insertion if the slave does not. Since commit 7b9c60903714bf0a19d746b228864bad3497284e, this has also been done by dev_hard_start_xmit(). The result is that VLAN- tagged skbs are now double-tagged when transmitted through slave devices without hardware VLAN tag insertion! Remove the now-redundant logic from bond_dev_queue_xmit(). Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Reviewed-by: Jesse Gross <jesse@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | axnet_cs: move id (0x1bf, 0x2328) to axnet_csKen Kawasaki2010-12-162-1/+1
| | | | | | | | | | | | | | | | | | axnet_cs: Accton EN2328 or compatible (id: 0x01bf, 0x2328) uses Asix chip. So it works better with axnet_cs instead of pcnet_cs. Signed-off-by: Ken Kawasaki <ken_kawasaki@spring.nifty.jp> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ipv6: delete expired route in ip6_pmtu_deliverAndrey Vagin2010-12-161-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The first big packets sent to a "low-MTU" client correctly triggers the creation of a temporary route containing the reduced MTU. But after the temporary route has expired, new ICMP6 "packet too big" will be sent, rt6_pmtu_discovery will find the previous EXPIRED route check that its mtu isn't bigger then in icmp packet and do nothing before the temporary route will not deleted by gc. I make the simple experiment: while :; do time ( dd if=/dev/zero bs=10K count=1 | ssh hostname dd of=/dev/null ) || break; done The "time" reports real 0m0.197s if a temporary route isn't expired, but it reports real 0m52.837s (!!!!) immediately after a temporare route has expired. Signed-off-by: Andrey Vagin <avagin@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bonding: Fix slave selection bug.Hillf Danton2010-12-161-2/+2
| | | | | | | | | | | | | | | | The returned slave is incorrect, if the net device under check is not charged yet by the master. Signed-off-by: Hillf Danton <dhillf@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 'master' of ↵David S. Miller2010-12-1512-10/+148
|\ \ | |/ | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
| * p54usb: New USB ID for Gemtek WUBI-100GWEduardo Costa2010-12-141-0/+1
| | | | | | | | | | | | | | | | | | | | This USB ID is for the WUBI-100GW 802.11g Wireless LAN USB Device that uses p54usb. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Eduardo Costa <ecosta.tmp@gmail.com> Cc: Stable <stable@kernel.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * mac80211: avoid calling ieee80211_work_work unconditionallyHerton Ronaldo Krzesinski2010-12-131-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On suspend, there might be usb wireless drivers which wrongly trigger the warning in ieee80211_work_work. If an usb driver doesn't have a suspend hook, the usb stack will disconnect the device. On disconnect, a mac80211 driver calls ieee80211_unregister_hw, which calls dev_close, which calls ieee80211_stop, and in the end calls ieee80211_work_purge-> ieee80211_work_work. The problem is that this call to ieee80211_work_purge comes after mac80211 is suspended, triggering the warning even when we don't have work queued in work_list (the expected case when already suspended), because it always calls ieee80211_work_work. So, just call ieee80211_work_work in ieee80211_work_purge if we really have to abort work. This addresses the warning reported at https://bugzilla.kernel.org/show_bug.cgi?id=24402 Signed-off-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * p54usb: add 5 more USBIDsChristian Lamparter2010-12-131-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds five more USBIDs to the table. Source: http://www.linuxant.com/pipermail/driverloader/2005q3/002307.html http://wireless.kernel.org/en/users/Drivers/p54/devices (by M. Davis) Cc: <stable@kernel.org> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * mac80211: Fix NULL-pointer deference on ibss merge when not readyTim Harvey2010-12-131-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dev_open will eventually call ieee80211_ibss_join which sets up the skb used for beacons/probe-responses however it is possible to receive beacons that attempt to merge before this occurs causing a null pointer dereference. Check ssid_len as that is the last thing set in ieee80211_ibss_join. This occurs quite easily in the presence of adhoc nodes with hidden SSID's revised previous patch to check further up based on irc feedback Signed-off-by: Tim Harvey <harvey.tim@gmail.com> Reviewed-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * libertas: fix potential NULL-pointer dereferenceSven Neumann2010-12-131-1/+1
| | | | | | | | | | | | | | | | | | | | The code wants to check if there's a channel and it is not disabled, but it used to check if channel is not NULL and accessed the channel struct if this check failed. Signed-off-by: Sven Neumann <s.neumann@raumfeld.com> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * Merge branch 'master' of ↵John W. Linville2010-12-132-2/+5
| |\ | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6
| | * Bluetooth: add NULL pointer check in HCIJun Nie2010-12-081-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | If we fail to find a hci device pointer in hci_uart, don't try to deref the NULL one we do have. Signed-off-by: Jun Nie <njun@marvell.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
| | * Bluetooth: Fix initial RFCOMM DLC security levelJohan Hedberg2010-12-061-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to commit 63ce0900 connections initiated through TTYs created with "rfcomm bind ..." would have security level BT_SECURITY_SDP instead of BT_SECURITY_LOW. This would cause instant connection failure between any two SSP capable devices due to the L2CAP connect request to RFCOMM being sent before authentication has been performed. This patch fixes the regression by always initializing the DLC security level to BT_SECURITY_LOW. Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com> Acked-by: Luiz Augusto von Dentz <luiz.dentz-von@nokia.com> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
| * | iwlagn: implement layout-agnostic EEPROM readingWey-Yi Guy2010-12-096-1/+120
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From: Johannes Berg <johannes.berg@intel.com> The current EEPROM reading code has some layout assumptions that now turned out to be false with some newer versions of the EEPROM. Luckily, we can avoid all such assumptions by using data in the EEPROM itself, so implement using that. However, for risk mitigation purposes, keep the old reading code for current hardware for now. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
| * | iwlagn: rename enhanced txpower fieldsJohannes Berg2010-12-092-5/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some fields we didn't previously use from the enhanced TX power structure will be needed in the next patch, so rename them to their correct names to be able to use them and change code reading them accordingly. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
* | | pppoe.c: Fix kernel panic caused by __pppoe_xmitAndrej Ota2010-12-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | __pppoe_xmit function return value was invalid resulting in additional call to kfree_skb on already freed skb. This resulted in memory corruption and consequent kernel panic after PPPoE peer terminated the link. This fixes commit 55c95e738da85373965cb03b4f975d0fd559865b. Reported-by: Gorik Van Steenberge <gvs@zemos.net> Reported-by: Daniel Kenzelmann <kernel.bugzilla@kenzelmann.dyndns.info> Reported-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com> Reported-by: Pawel Staszewski <pstaszewski@artcom.pl> Diagnosed-by: Andrej Ota <andrej@ota.si> Diagnosed-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com> Tested-by: Pawel Staszewski <pstaszewski@artcom.pl> Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: Andrej Ota <andrej@ota.si> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | WAN: Fix a TX IRQ causing BUG() in PC300 and PCI200SYN drivers.Krzysztof Halasa2010-12-121-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We must not wake the TX queue without free TX descriptors. sca_xmit() expects at least one free descriptor and BUGs otherwise. Problem reported and fix tested by Bernie Innocenti and Ward Vandewege. Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | bnx2x: Advance a version number to 1.60.01-0Vladislav Zolotarov2010-12-121-2/+2
| | | | | | | | | | | | | | | | | | Signed-off-by: Vladislav Zolotarov <vladz@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | bnx2x: Fixed a compilation warningVladislav Zolotarov2010-12-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | bnx2x_src_init_t2() is used only when BCM_CNIC is defined. So, to avoid a compilation warning, we won't define it unless BCM_CNIC is defined. Signed-off-by: Vladislav Zolotarov <vladz@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | bnx2x: LSO code was broken on BE platformsVladislav Zolotarov2010-12-121-16/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make the LSO code work on BE platforms: parsing_data field of a parsing BD (PBD) for 57712 was improperly composed which made FW read wrong values for TCP header's length and offset and, as a result, the corresponding PCI device was performing bad DMA reads triggering EEH. Signed-off-by: Vladislav Zolotarov <vladz@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | qlge: Fix deadlock when cancelling worker.Ron Mercer2010-12-123-8/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Removing usage of rtnl_lock() to protect firmware interface registers. These registers are accessed in some worker threads and can create a deadlock if rtnl_lock is taken by upper layers while the worker is still pending. We remove rtnl_lock and use a driver mutex just while mailboxes are accessed. Signed-off-by: Ron Mercer <ron.mercer@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | Merge branch 'vhost-net' of ↵David S. Miller2010-12-121-1/+2
|\ \ \ | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
| * | | vhost: correctly set bits of dirty pagesMichael S. Tsirkin2010-11-291-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix two bugs in dirty page logging: When counting pages we should increase address by 1 instead of VHOST_PAGE_SIZE. Make log_write() correctly process requests that cross pages with write_address not starting at page boundary. Reported-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | | | net: fix skb_defer_rx_timestamp()Eric Dumazet2010-12-101-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After commit c1f19b51d1d8 (net: support time stamping in phy devices.), kernel might crash if CONFIG_NETWORK_PHY_TIMESTAMPING=y and skb_defer_rx_timestamp() handles a packet without an ethernet header. Fixes kernel bugzilla #24102 Reference: https://bugzilla.kernel.org/show_bug.cgi?id=24102 Reported-and-tested-by: Andrew Watts <akwatts@ymail.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | cxgb4vf: Ingress Queue Entry Size needs to be 64 bytesCasey Leedom2010-12-101-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Was using L1_CACHE_BYTES for the Ingress Queue Entry Size but it really needs to be 64 bytes in order to support the largest message sizes. Signed-off-by: Casey Leedom <leedom@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
OpenPOWER on IntegriCloud