summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* gro: Open-code frags copy in skb_gro_receiveHerbert Xu2009-05-271-3/+6
| | | | | | | | | | | gcc does a poor job at generating code for the memcpy of the frags array in skb_gro_receive, which is the primary purpose of that function when merging frags. In particular, it can't utilise the alignment information of the source and destination. This patch open-codes the copy so we process words instead of bytes. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* ixgbe: Fix build warningPeter P Waskiewicz Jr2009-05-261-1/+0
| | | | | | | This patch fixes a build warning due to an unused label. Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* phy: Eliminate references to BUS_ID_SIZE.David S. Miller2009-05-261-2/+2
| | | | | | | | | | | Just use the constant 20 to keep things working. If someone is so motivated, this can be converted over to dynamic strings. I tried and it's a lot of work. But for now this is good enough. Signed-off-by: David S. Miller <davem@davemloft.net>
* nl80211: Eliminate reference to BUS_ID_SIZE.David S. Miller2009-05-261-1/+1
| | | | | | | It's going away. Just leave the constant "20" here so that behavior doesn't change. Signed-off-by: David S. Miller <davem@davemloft.net>
* sh_eth: Remove references to BUS_ID_SIZE, use MII_BUS_ID_SIZE instead.David S. Miller2009-05-261-1/+1
| | | | Signed-off-by: David S. Miller <davem@davemloft.net>
* cpmac: Remove references to BUS_ID_SIZE, use MII_BUS_ID_SIZE.David S. Miller2009-05-261-1/+1
| | | | Signed-off-by: David S. Miller <davem@davemloft.net>
* ixp4xx_eth: Remove references to BUS_ID_SIZE.David S. Miller2009-05-261-2/+2
| | | | | | Use MII_BUS_ID_SIZE instead. Signed-off-by: David S. Miller <davem@davemloft.net>
* net: Remove bogus reference to BUS_ID_SIZE in sysfs code.David S. Miller2009-05-261-1/+0
| | | | | | | | | | BUS_ID_SIZE is really no more, and device names are dynamically allocated and thus can be any necessary size. So remove the BUG check here making sure BUS_ID_SIZE is at least as large as IFNAMSIZ. Signed-off-by: David S. Miller <davem@davemloft.net>
* r8169: Use a different default for each familyJean Delvare2009-05-261-17/+22
| | | | | | | | | | | | The r8169 driver supports 3 different families of network chips (RTL8169, RTL8168 and RTL8101). When an unknown version is found, the driver currently always defaults to the RTL8169 variant. This has very little chance to ever work for chips of the other families. So better define a per-family default. Signed-off-by: Jean Delvare <jdelvare@suse.de> Acked-by: Francois Romieu <romieu@fr.zoreil.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net/ucc_geth: allow to set mac address on running deviceKevin Hao2009-05-261-1/+32
| | | | | | | | | | | | Inspired by the patch for 8139too (bda6a15a). Currently we can't set mac address on a running ucc_geth device. But this is needed when you use this device as a bonding slave in bonding device in balance-alb mode. So add this feature for ucc_geth device. Signed-off-by: Kevin Hao <kexin.hao@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* niu: Add support for C10NEMTanli Chang2009-05-261-10/+47
| | | | | | | | This patch is for supporting C10NEM. C10NEM is a switch module, which has back-to-back XAUI link connected to blades. Signed-off-by: Tanli Chang <tanli.chang@sun.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ixgbe: fix 82598 SFP initialization after driver load.Don Skidmore2009-05-263-19/+39
| | | | | | | | | | | | | | | | | | | | | | | | If we loaded the driver with out a SFP module plugged in it would leave it in a state that make it later unable to link when a module was plugged in. This patch corrects that by: ixgbe_probe() - moving the check for IXGBE_ERR_SFP_NOT_PRESENT from after get_invariants() to after reset_hw() as now reset_hw() is where this condition will be indentified. ixgbe_reset_hw_82598() - Enable this function to now return IXGBE_ERR_SFP_NOT_PRESENT. ixgbe_identify_sfp_module_generic() - This where the lack of SFP module is detected. Modifications are added to allow a different return value for modules that just haven't been plugged in yet. Other functions were updated to allow correct logging. Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com> Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ixgbe: Remove device ID 0x10d8Peter P Waskiewicz Jr2009-05-262-2/+0
| | | | | | | | | | | | Device ID 0x10d8 is the default silicon device ID for 82599. However, the device will not be functional without an EEPROM, so we want to prevent the driver from loading on the device. Otherwise, the driver will load, but no PHY setup or PCIe setup will occur, causing the device to be unusable. To prevent users from encountering this, just remove the device ID. Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* igb/e1000e: update PSSR_MDIX value to reflect correct bitAlexander Duyck2009-05-262-2/+2
| | | | | | | | | | | The phy port status register has the MDI-X status bit on bit 11, not bit 3 as is currently setup in the define. This patch corrects that so the correct bit is checked on igp PHY types. Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com> Acked-by: Bruce Allan <bruce.w.allan@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* igb: Record host memory receive overflow in net_statsJesper Dangaard Brouer2009-05-262-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | Based on previous patch from Jesper Dangaard Brouer. The RNBC (Receive No Buffers Count) register for the 82576, indicate that frames were received when there were no available buffers in host memory to store those frames (receive descriptor head and tail pointers were equal). The packet is still received by the NIC if there is space in the FIFO on the NIC. As the RNBC value is not a packet drop, the driver stores this value in net_stats.rx_fifo_errors to indicate that there were no system buffers available for the incoming packet. Actual dropped packets are counted in the MPC value. Saving the stats in dev->net_stats makes it visible via /proc/net/dev as "fifo", and thus viewable to ifconfig as "overruns" and 'netstat -i' as "RX-OVR". The Receive No Buffers Count (RNBC) can already be queried by ethtool -S as "rx_no_buffer_count". Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> CC: Jesper Dangaard Brouer <hawk@comx.dk> Signed-off-by: David S. Miller <davem@davemloft.net>
* igb: Implement reading of reg RQDPC (Receive Queue Drop Packet Count)Jesper Dangaard Brouer2009-05-263-10/+38
| | | | | | | | | | | | | | | | | | | | Based on the previous patches from Jesper Dangaard Brouer <hawk@comx.dk> Implement reading the per queue drop stats register RQDPC (Receive Queue Drop Packet Count). It counts the number of packets dropped by a queue due to lack of descriptors available. Notice RQDPC (Receive Queue Drop Packet Count) stats only gets incremented, if the DROP_EN bit it set (in the SRRCTL register for that queue). If DROP_EN bit is NOT set, then the some what equivalent count is stored in RNBC (not per queue basis). The RQDPC register is only 12 bit, thus the precision might suffer due to overrun in-netween the watchdog polling interval. Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> CC: Jesper Dangaard Brouer <hawk@comx.dk> Signed-off-by: David S. Miller <davem@davemloft.net>
* igb: add RQDPC (Receive Queue Drop Packet Count) register macroJeff Kirsher2009-05-261-0/+1
| | | | | Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* 8139*: convert printk() to pr_<foo>()Alexander Beregalov2009-05-262-84/+66
| | | | | | | Also convert DPRINTK to pr_debug and dev_printk to dev_<foo>. Signed-off-by: Alexander Beregalov <a.beregalov@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* 3c5xx: convert printk() to pr_<foo>()Alexander Beregalov2009-05-264-242/+233
| | | | | Signed-off-by: Alexander Beregalov <a.beregalov@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* 3c50x: convert printk() to pr_<foo>()Alexander Beregalov2009-05-265-219/+216
| | | | | Signed-off-by: Alexander Beregalov <a.beregalov@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* atl1: use netdev->statsEric Dumazet2009-05-252-4/+3
| | | | | | | | Get rid of private struct net_device_stats in "struct atl1e_adapter", and use one provided in struct net_device instead. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: txq_trans_update() helperEric Dumazet2009-05-255-1/+15
| | | | | | | | | | | | | | | | We would like to get rid of netdev->trans_start = jiffies; that about all net drivers have to use in their start_xmit() function, and use txq->trans_start instead. This can be done generically in core network, as suggested by David. Some devices, (particularly loopback) dont need trans_start update, because they dont have transmit watchdog. We could add a new device flag, or rely on fact that txq->tran_start can be updated is txq->xmit_lock_owner is different than -1. Use a helper function to hide our choice. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: sh_eth: Add support SH7724Yoshihiro Shimoda2009-05-253-6/+111
| | | | | | | Signed-off-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com> Signed-off-by: Kuninori Morimoto <morimoto.kuninori@renesas.com> Signed-off-by: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: sh_eth: CPU dependency code collect to "struct sh_eth_cpu_data"Yoshihiro Shimoda2009-05-252-251/+386
| | | | | | | | This improves readability by collecting CPU dependency code. Signed-off-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com> Signed-off-by: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: sh_eth: fix receive desciptor loopYoshihiro Shimoda2009-05-251-0/+1
| | | | | | | | Fix the problem that this driver not update rxdesc in sh_eth_rx. Signed-off-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com> Signed-off-by: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: sh_eth: fix TX/RX descriptor not set physical memoryYoshihiro Shimoda2009-05-251-23/+12
| | | | | | | | Fix the probrem that TX/RX descirptor not set physical memory. Signed-off-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com> Signed-off-by: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: sh_eth: fix cache coherency issueYoshihiro Shimoda2009-05-251-0/+4
| | | | | | | | Fix the problem that may not work receive process by cache coherency issue. Signed-off-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com> Signed-off-by: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* pkt_sched: gen_estimator: Fix signed integers right-shifts.Jarek Poplawski2009-05-251-2/+2
| | | | | | | | | Right-shifts of signed integers are implementation-defined so unportable. With feedback from: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: Remove obsolete MV64360 config optionGabriel Paubert2009-05-251-1/+1
| | | | | Signed-off-by: Gabriel Paubert <paubert@iram.es> Signed-off-by: David S. Miller <davem@davemloft.net>
* iwmc3200wifi: fix link error when CFG80211 is not selectedZhu Yi2009-05-251-1/+2
| | | | | | | | | | The patch makes iwmc3200wifi select CFG80211 instead of LIB80211. This fixed module link error reported by Randy Dunlap <randy.dunlap@oracle.com> when compiling iwmc3200wifi without cfg80211 selected. WIRELESS_EXT is also selected by iwmc3200wifi. Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: remove COMPAT_NET_DEV_OPSAlexander Beregalov2009-05-258-123/+0
| | | | | | | | All drivers are already converted to new net_device_ops API and nobody uses old API anymore. Signed-off-by: Alexander Beregalov <a.beregalov@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'master' of ↵David S. Miller2009-05-2517-69/+87
|\ | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: drivers/net/wireless/ath/ath5k/phy.c drivers/net/wireless/iwlwifi/iwl-agn.c drivers/net/wireless/iwlwifi/iwl3945-base.c
| * gianfar: fix BUG under load after introduction of skb recyclingLennert Buytenhek2009-05-251-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since commit 0fd56bb5be6455d0d42241e65aed057244665e5e ("gianfar: Add support for skb recycling"), gianfar puts skbuffs that are in the rx ring back onto the recycle list as-is in case there was a receive error, but this breaks the following invariant: that all skbuffs on the recycle list have skb->data = skb->head + NET_SKB_PAD. The RXBUF_ALIGNMENT realignment done in gfar_new_skb() will be done twice on skbuffs recycled in this way, causing there not to be enough room in the skb anymore to receive a full packet, eventually leading to an skb_over_panic from gfar_clean_rx_ring() -> skb_put(). Resetting the skb->data pointer to skb->head + NET_SKB_PAD before putting the skb back onto the recycle list restores the mentioned invariant, and should fix this issue. Reported-by: Michael Guntsche <mike@it-loops.com> Tested-by: Michael Guntsche <mike@it-loops.com> Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * RxRPC: Error handling for rxrpc_alloc_connection()Dan Carpenter2009-05-211-6/+6
| | | | | | | | | | | | | | | | | | rxrpc_alloc_connection() doesn't return an error code on failure, it just returns NULL. IS_ERR(NULL) is false. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * ipv4: Fix oops with FIB_TRIERobert Olsson2009-05-211-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | It seems we can fix this by disabling preemption while we re-balance the trie. This is with the CONFIG_CLASSIC_RCU. It's been stress-tested at high loads continuesly taking a full BGP table up/down via iproute -batch. Note. fib_trie is not updated for CONFIG_PREEMPT_RCU Reported-by: Andrei Popa Signed-off-by: Robert Olsson <robert.olsson@its.uu.se> Signed-off-by: David S. Miller <davem@davemloft.net>
| * pktgen: do not access flows[] beyond its lengthFlorian Westphal2009-05-211-1/+1
| | | | | | | | | | | | | | | | | | typo -- pkt_dev->nflows is for stats only, the number of concurrent flows is stored in cflows. Reported-By: Vladimir Ivashchenko <hazard@francoudi.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
| * gigaset: beyond ARRAY_SIZE of iwb->dataRoel Kluin2009-05-211-1/+1
| | | | | | | | | | Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * IPv6: set RTPROT_KERNEL to initial routeJean-Mickael Guerin2009-05-201-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The use of unspecified protocol in IPv6 initial route prevents quagga to install IPv6 default route: # show ipv6 route S ::/0 [1/0] via fe80::1, eth1_0 K>* ::/0 is directly connected, lo, rej C>* ::1/128 is directly connected, lo C>* fe80::/64 is directly connected, eth1_0 # ip -6 route fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit -1 ff00::/8 dev eth1_0 metric 256 mtu 1500 advmss 1440 hoplimit -1 unreachable default dev lo proto none metric -1 error -101 hoplimit 255 The attached patch ensures RTPROT_KERNEL to the default initial route and fixes the problem for quagga. This is similar to "ipv6: protocol for address routes" f410a1fba7afa79d2992620e874a343fdba28332. # show ipv6 route S>* ::/0 [1/0] via fe80::1, eth1_0 C>* ::1/128 is directly connected, lo C>* fe80::/64 is directly connected, eth1_0 # ip -6 route fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit -1 fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit -1 ff00::/8 dev eth1_0 metric 256 mtu 1500 advmss 1440 hoplimit -1 default via fe80::1 dev eth1_0 proto zebra metric 1024 mtu 1500 advmss 1440 hoplimit -1 unreachable default dev lo proto kernel metric -1 error -101 hoplimit 255 Signed-off-by: Jean-Mickael Guerin <jean-mickael.guerin@6wind.com> Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * Merge branch 'master' of ↵David S. Miller2009-05-2010-53/+68
| |\ | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
| | * wireless: beyond ARRAY_SIZE of intf->crypto_statsRoel Kluin2009-05-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Do not go beyond ARRAY_SIZE of intf->crypto_stats Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Acked-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * iwlwifi: update 5000 ucode support to version 2 of APIJay Sternberg2009-05-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | enable iwl driver to support 5000 ucode having version 2 of API Signed-off-by: Jay Sternberg <jay.e.sternberg@linux.intel.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * cfg80211: fix race between core hint and driver's custom applyLuis R. Rodriguez2009-05-201-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Its possible for cfg80211 to have scheduled the work and for the global workqueue to not have kicked in prior to a cfg80211 driver's regulatory hint or wiphy_apply_custom_regulatory(). Although this is very unlikely its possible and should fix this race. When this race would happen you are expected to have hit a null pointer dereference panic. Cc: stable@kernel.org Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Tested-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * airo: fix airo_get_encode{,ext} buffer overflow like I mean it...John W. Linville2009-05-201-9/+14
| | | | | | | | | | | | | | | | | | | | | | | | "airo: airo_get_encode{,ext} potential buffer overflow" was actually a no-op, due to an unrecognized type overflow in an assignment. Oddly, gcc only seems to tell me about it when using -Wextra...grrr... Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath5k: fix interpolation with equal power levelsFabio Rossi2009-05-201-21/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | When the EEPROM contains weird values for the power levels we have to fix the interpolation process. Signed-off-by: Fabio Rossi <rossi.f@inwind.it> Acked-by: Nick Kossifidis <mickflemm@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * iwlwifi: do not cancel delayed work inside spin_lock_irqsaveReinette Chatre2009-05-203-17/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Calling cancel_delayed_work() from inside spin_lock_irqsave, introduces a potential deadlock. As explained by Johannes Berg <johannes@sipsolutions.net> A - lock T - timer phase CPU 1 CPU 2 --------------------------------------------- some place that calls cancel_timer_sync() (which is the | code) lock-irq(A) | "lock-irq"(T) | "unlock"(T) | wait(T) unlock(A) timer softirq "lock"(T) run(T) "unlock"(T) irq handler lock(A) unlock(A) Now all that again, interleaved, leading to deadlock: lock-irq(A) "lock"(T) run(T) IRQ during or maybe before run(T) --> lock(A) "lock-irq"(T) wait(T) We fix this by moving the call to cancel_delayed_work() into workqueue. There are cases where the work may not actually be queued or running at the time we are trying to cancel it, but cancel_delayed_work() is able to deal with this. Also cleanup iwl_set_mode related to this call. This function (iwl_set_mode) is only called when bringing interface up and there will thus not be any scanning done. No need to try to cancel scanning. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13224, which was also reported at http://marc.info/?l=linux-wireless&m=124081921903223&w=2 . Tested-by: Miles Lane <miles.lane@gmail.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Acked-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath5k: fix exp off-by-one when computing OFDM delta slopeForrest Zhang2009-05-201-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit e8f055f0c3b ("ath5k: Update reset code") subtly changed the code that computes floating point values for the PHY3_TIMING register such that the exponent is off by a decimal point, which can cause problems with OFDM channel operation. get_bitmask_order() actually returns the highest bit set plus one, whereas the previous code wanted the highest bit set. Instead, use ilog2 which is what this code is really calculating. Also check coef_scaled to handle the (invalid) case where we need log2(0). Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * wext: verify buffer size for SIOCSIWENCODEEXTJohannes Berg2009-05-201-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Another design flaw in wireless extensions (is anybody surprised?) in the way it handles the iw_encode_ext structure: The structure is part of the 'extra' memory but contains the key length explicitly, instead of it just being the length of the extra buffer - size of the struct and using the explicit key length only for the get operation (which only writes it). Therefore, we have this layout: extra: +-------------------------+ | struct iw_encode_ext { | | ... | | u16 key_len; | | u8 key[0]; | | }; | +-------------------------+ | key material | +-------------------------+ Now, all drivers I checked use ext->key_len without checking that both key_len and the struct fit into the extra buffer that has been copied from userspace. This leads to a buffer overrun while reading that buffer, depending on the driver it may be possible to specify arbitrary key_len or it may need to be a proper length for the key algorithm specified. Thankfully, this is only exploitable by root, but root can actually cause a segfault or use kernel memory as a key (which you can even get back with siocgiwencode or siocgiwencodeext from the key buffer). Fix this by verifying that key_len fits into the buffer along with struct iw_encode_ext. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath5k: fix scanning in AR2424Pavel Roskin2009-05-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | AR5K_PHY_PLL_40MHZ_5413 should not be ORed with AR5K_PHY_MODE_RAD_RF5112 for 5 GHz channels. The incorrect PLL value breaks scanning in the countries where 5 GHz channels are allowed. Signed-off-by: Pavel Roskin <proski@gnu.org> Acked-by: Nick Kossifidis <mickflemm@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * | net: fix rtable leak in net/ipv4/route.cEric Dumazet2009-05-201-38/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Alexander V. Lukyanov found a regression in 2.6.29 and made a complete analysis found in http://bugzilla.kernel.org/show_bug.cgi?id=13339 Quoted here because its a perfect one : begin_of_quotation 2.6.29 patch has introduced flexible route cache rebuilding. Unfortunately the patch has at least one critical flaw, and another problem. rt_intern_hash calculates rthi pointer, which is later used for new entry insertion. The same loop calculates cand pointer which is used to clean the list. If the pointers are the same, rtable leak occurs, as first the cand is removed then the new entry is appended to it. This leak leads to unregister_netdevice problem (usage count > 0). Another problem of the patch is that it tries to insert the entries in certain order, to facilitate counting of entries distinct by all but QoS parameters. Unfortunately, referencing an existing rtable entry moves it to list beginning, to speed up further lookups, so the carefully built order is destroyed. For the first problem the simplest patch it to set rthi=0 when rthi==cand, but it will also destroy the ordering. end_of_quotation Problematic commit is 1080d709fb9d8cd4392f93476ee46a9d6ea05a5b (net: implement emergency route cache rebulds when gc_elasticity is exceeded) Trying to keep dst_entries ordered is too complex and breaks the fact that order should depend on the frequency of use for garbage collection. A possible fix is to make rt_intern_hash() simpler, and only makes rt_check_expire() a litle bit smarter, being able to cope with an arbitrary entries order. The added loop is running on cache hot data, while cpu is prefetching next object, so should be unnoticied. Reported-and-analyzed-by: Alexander V. Lukyanov <lav@yar.ru> Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | net: fix length computation in rt_check_expire()Eric Dumazet2009-05-201-2/+3
| |/ | | | | | | | | | | | | | | | | | | | | rt_check_expire() computes average and standard deviation of chain lengths, but not correclty reset length to 0 at beginning of each chain. This probably gives overflows for sum2 (and sum) on loaded machines instead of meaningful results. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
OpenPOWER on IntegriCloud