OSDN Git Service
David S. Miller [Mon, 10 Aug 2009 03:47:39 +0000 (20:47 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6
Bob Dunlop [Thu, 6 Aug 2009 16:01:03 +0000 (12:01 -0400)]
libertas: correct packing of rxpd structure
Older Gcc compilers (3.4.5 tested) need additional hints in order to get
the packing of the rxpd structure (which contains a 16 bit union)
correct on the ARM processor.
struct txpd does not need these hints since it contains a 32 bit union
that packs naturally.
Signed-off-by: R.J.Dunlop <rdunlop@guralp.com>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Lennert Buytenhek [Mon, 3 Aug 2009 19:59:09 +0000 (21:59 +0200)]
mwl8k: prevent module unload hang
We need to unregister our ieee80211_hw before resetting the chip, as
the former causes firmware commands to be issued which will time out
once the chip has been reset.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Acked-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Lennert Buytenhek [Mon, 3 Aug 2009 19:58:57 +0000 (21:58 +0200)]
mwl8k: prevent crash in ->configure_filter() if no interface was added
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Acked-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Lennert Buytenhek [Mon, 3 Aug 2009 19:58:47 +0000 (21:58 +0200)]
mwl8k: call pci_unmap_single() before accessing command structure again
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Acked-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Lennert Buytenhek [Mon, 3 Aug 2009 19:58:39 +0000 (21:58 +0200)]
mwl8k: add various missing GET_HW_SPEC endian conversions
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Acked-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Lennert Buytenhek [Mon, 3 Aug 2009 19:58:26 +0000 (21:58 +0200)]
mwl8k: fix NULL pointer dereference on receive out-of-memory
When we go into out-of-memory and fail to allocate skbuffs to
refill the receive ring with, rxq_process can end up running into
a receive ring entry that is marked as host-owned but doesn't have
an associated skbuff. If this happens, we must break out of the
rx processing loop instead of trying to process the descriptor.
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Acked-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Zhu Yi [Mon, 27 Jul 2009 02:10:20 +0000 (10:10 +0800)]
ipw2x00: Write outside array bounds
> channel_index loops up to IPW_SCAN_CHANNELS, but is used after being
> incremented. This might be able to access 1 past the end of the array
Reported-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
David S. Miller [Thu, 6 Aug 2009 20:18:22 +0000 (13:18 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/lowpan/lowpan
Eric Dumazet [Thu, 6 Aug 2009 03:55:04 +0000 (03:55 +0000)]
irda: Fix irda_getname() leak
irda_getname() can leak kernel memory to user.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Thu, 6 Aug 2009 02:27:43 +0000 (02:27 +0000)]
appletalk: fix atalk_getname() leak
atalk_getname() can leak 8 bytes of kernel memory to user
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Thu, 6 Aug 2009 03:31:07 +0000 (03:31 +0000)]
netrom: Fix nr_getname() leak
nr_getname() can leak kernel memory to user.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Thu, 6 Aug 2009 03:48:36 +0000 (03:48 +0000)]
econet: Fix econet_getname() leak
econet_getname() can leak kernel memory to user.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Thu, 6 Aug 2009 03:34:06 +0000 (03:34 +0000)]
rose: Fix rose_getname() leak
rose_getname() can leak kernel memory to user.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dmitry Eremin-Solenikov [Mon, 3 Aug 2009 13:53:00 +0000 (17:53 +0400)]
af_ieee802154: provide dummy get/setsockopt
Provide dummt get/setsockopt implementations to stop these
syscalls from oopsing on our sockets.
Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Dmitry Eremin-Solenikov [Sun, 2 Aug 2009 10:12:01 +0000 (14:12 +0400)]
af_ieee802154: fix ioctl processing
fix two errors in ioctl processing:
1) if the ioctl isn't supported one should return -ENOIOCTLCMD
2) don't call ndo_do_ioctl if the device doesn't provide it
Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Pascal Terjan [Wed, 5 Aug 2009 04:11:39 +0000 (04:11 +0000)]
Add IDs for 3C905B-TX Fast Etherlink XL PCI
We found this old card which was not supported, and physically
looks similar to the other 3C905B we have (9055).
After adding the IDs it seems to work fine (MII report, dhcp, scp, ...)
Acked-by: Steffen Klassert <klassert@mathematik.tu-chemnitz.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Mon, 27 Jul 2009 15:03:18 +0000 (08:03 -0700)]
phonet: phonet_device_get() fix
net/phonet/pn_dev.c: In function `phonet_device_get':
net/phonet/pn_dev.c:99: warning: 'dev' might be used uninitialized in this function
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Wei Yongjun [Tue, 4 Aug 2009 21:44:39 +0000 (21:44 +0000)]
dccp: missing destroy of percpu counter variable while unload module
percpu counter dccp_orphan_count is init in dccp_init() by
percpu_counter_init() while dccp module is loaded, but the
destroy of it is missing while dccp module is unloaded. We
can get the kernel WARNING about this. Reproduct by the
following commands:
$ modprobe dccp
$ rmmod dccp
$ modprobe dccp
WARNING: at lib/list_debug.c:26 __list_add+0x27/0x5c()
Hardware name: VMware Virtual Platform
list_add corruption. next->prev should be prev (
c080c0c4), but was (null). (next
=
ca7188cc).
Modules linked in: dccp(+) nfsd lockd nfs_acl auth_rpcgss exportfs sunrpc
Pid: 1956, comm: modprobe Not tainted 2.6.31-rc5 #55
Call Trace:
[<
c042f8fa>] warn_slowpath_common+0x6a/0x81
[<
c053a6cb>] ? __list_add+0x27/0x5c
[<
c042f94f>] warn_slowpath_fmt+0x29/0x2c
[<
c053a6cb>] __list_add+0x27/0x5c
[<
c053c9b3>] __percpu_counter_init+0x4d/0x5d
[<
ca9c90c7>] dccp_init+0x19/0x2ed [dccp]
[<
c0401141>] do_one_initcall+0x4f/0x111
[<
ca9c90ae>] ? dccp_init+0x0/0x2ed [dccp]
[<
c06971b5>] ? notifier_call_chain+0x26/0x48
[<
c0444943>] ? __blocking_notifier_call_chain+0x45/0x51
[<
c04516f7>] sys_init_module+0xac/0x1bd
[<
c04028e4>] sysenter_do_call+0x12/0x22
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dhananjay Phadke [Tue, 4 Aug 2009 10:39:03 +0000 (10:39 +0000)]
netxen: fix dma mask update calculation
Fix dma mask calculation that caps at 63-bit addressing even
when firmware advertises full 64-bit support.
Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ingo Molnar [Tue, 4 Aug 2009 21:16:58 +0000 (21:16 +0000)]
net: Fix spinlock use in alloc_netdev_mq()
-tip testing found this lockdep warning:
[ 2.272010] calling net_dev_init+0x0/0x164 @ 1
[ 2.276033] device class 'net': registering
[ 2.280191] INFO: trying to register non-static key.
[ 2.284005] the code is fine but needs lockdep annotation.
[ 2.284005] turning off the locking correctness validator.
[ 2.284005] Pid: 1, comm: swapper Not tainted 2.6.31-rc5-tip #1145
[ 2.284005] Call Trace:
[ 2.284005] [<
7958eb4e>] ? printk+0xf/0x11
[ 2.284005] [<
7904f83c>] __lock_acquire+0x11b/0x622
[ 2.284005] [<
7908c9b7>] ? alloc_debug_processing+0xf9/0x144
[ 2.284005] [<
7904e2be>] ? mark_held_locks+0x3a/0x52
[ 2.284005] [<
7908dbc4>] ? kmem_cache_alloc+0xa8/0x13f
[ 2.284005] [<
7904e475>] ? trace_hardirqs_on_caller+0xa2/0xc3
[ 2.284005] [<
7904fdf6>] lock_acquire+0xb3/0xd0
[ 2.284005] [<
79489678>] ? alloc_netdev_mq+0xf5/0x1ad
[ 2.284005] [<
79591514>] _spin_lock_bh+0x2d/0x5d
[ 2.284005] [<
79489678>] ? alloc_netdev_mq+0xf5/0x1ad
[ 2.284005] [<
79489678>] alloc_netdev_mq+0xf5/0x1ad
[ 2.284005] [<
793a38f2>] ? loopback_setup+0x0/0x74
[ 2.284005] [<
798eecd0>] loopback_net_init+0x20/0x5d
[ 2.284005] [<
79483efb>] register_pernet_device+0x23/0x4b
[ 2.284005] [<
798f5c9f>] net_dev_init+0x115/0x164
[ 2.284005] [<
7900104f>] do_one_initcall+0x4a/0x11a
[ 2.284005] [<
798f5b8a>] ? net_dev_init+0x0/0x164
[ 2.284005] [<
79066f6d>] ? register_irq_proc+0x8c/0xa8
[ 2.284005] [<
798cc29a>] do_basic_setup+0x42/0x52
[ 2.284005] [<
798cc30a>] kernel_init+0x60/0xa1
[ 2.284005] [<
798cc2aa>] ? kernel_init+0x0/0xa1
[ 2.284005] [<
79003e03>] kernel_thread_helper+0x7/0x10
[ 2.284078] device: 'lo': device_add
[ 2.288248] initcall net_dev_init+0x0/0x164 returned 0 after 11718 usecs
[ 2.292010] calling neigh_init+0x0/0x66 @ 1
[ 2.296010] initcall neigh_init+0x0/0x66 returned 0 after 0 usecs
it's using an zero-initialized spinlock. This is a side-effect of:
dev_unicast_init(dev);
in alloc_netdev_mq() making use of dev->addr_list_lock.
The device has just been allocated freshly, it's not accessible
anywhere yet so no locking is needed at all - in fact it's wrong
to lock it here (the lock isnt initialized yet).
This bug was introduced via:
| commit
a6ac65db2329e7685299666f5f7b6093c7b0f3a0
| Date: Thu Jul 30 01:06:12 2009 +0000
|
| net: restore the original spinlock to protect unicast list
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Acked-by: Jiri Pirko <jpirko@redhat.com>
Tested-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Hannes Hering [Tue, 4 Aug 2009 18:48:39 +0000 (11:48 -0700)]
ehea: Fix napi list corruption on ifconfig down
This patch fixes the napi list handling when an ehea interface is shut
down to avoid corruption of the napi list.
Signed-off-by: Hannes Hering <hering2@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alexander Duyck [Tue, 4 Aug 2009 18:46:41 +0000 (11:46 -0700)]
igbvf: Allow VF driver to correctly recognize failure to set mac
The VF driver was not correctly recognizing that it did not correctly set
it's mac address. As a result the VF driver was unable to receive network
traffic until being unloaded and reloaded. The issue was root caused to
the fact that the CTS bit was not taken into account when checking for the
request being NAKed.
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jean Delvare [Tue, 4 Aug 2009 04:10:01 +0000 (21:10 -0700)]
3c59x: Fix build failure with gcc 3.2
Fix the following build failure with gcc 3.2:
CC [M] drivers/net/3c59x.o
drivers/net/3c59x.c:2726:1: directives may not be used inside a macro argument
drivers/net/3c59x.c:2725:59: unterminated argument list invoking macro "pr_err"
drivers/net/3c59x.c: In function `dump_tx_ring':
drivers/net/3c59x.c:2727: implicit declaration of function `pr_err'
drivers/net/3c59x.c:2731: syntax error before ')' token
Apparently gcc 3.2 doesn't like #if interleaved with a macro call.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 4 Aug 2009 02:05:50 +0000 (19:05 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6
Mike McCormack [Fri, 31 Jul 2009 01:57:42 +0000 (01:57 +0000)]
sky2: Avoid transmits during sky2_down()
This patch supersedes my previous patch "sky2: Avoid transmitting
during sky2_restart".
I have reworked the patch to avoid crashes during both sky2_restart()
and sky2_set_ringparam().
Without this patch, the sky2 driver can be crashed by doing:
# pktgen eth1 & (transmit many packets on eth1)
# ethtool -G eth1 tx 510
I am aware you object to storing extra state, but I can't see a way
around this. Without remembering that we're restarting,
netif_wake_queue() is called in the ISR from sky2_tx_complete(), and
netif_tx_lock() is used in sky2_tx_done(). If anybody can see a way
around this, please let me know.
Signed-off-by: Mike McCormack <mikem@ring3k.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Reinette Chatre [Mon, 3 Aug 2009 19:10:16 +0000 (12:10 -0700)]
iwlagn: do not send key clear commands when rfkill enabled
Do all key clearing except sending sommands to device when rfkill
enabled. When rfkill enabled the interface is brought down and will
be brought back up correctly after rfkill is enabled again.
Same change is not needed for iwl3945 as it ignores return code when
sending key clearing command to device.
This fixes http://bugzilla.kernel.org/show_bug.cgi?id=13742
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Tested-by: Frans Pop <elendil@planet.nl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Roel Kluin [Sun, 2 Aug 2009 07:44:12 +0000 (09:44 +0200)]
libertas: Read buffer overflow
Check whether index is within bounds before testing the element.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Julia Lawall [Sat, 1 Aug 2009 08:55:53 +0000 (10:55 +0200)]
drivers/net/wireless: introduce missing kfree
Error handling code following a kzalloc should free the allocated data.
The semantic match that finds the problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@r exists@
local idexpression x;
statement S;
expression E;
identifier f,f1,l;
position p1,p2;
expression *ptr != NULL;
@@
x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
<... when != x
when != if (...) { <+...x...+> }
(
x->f1 = E
|
(x->f1 == NULL || ...)
|
f(...,x->f1,...)
)
...>
(
return \(0\|<+...x...+>\|ptr\);
|
return@p2 ...;
)
@script:python@
p1 << r.p1;
p2 << r.p2;
@@
print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Julia Lawall [Mon, 3 Aug 2009 09:11:45 +0000 (11:11 +0200)]
drivers/net/wireless/iwlwifi: introduce missing kfree
Move orthogonal error handling code up before a kzalloc, so that it
doesn't have to free the allocated data.
The semantic match that finds the problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@r exists@
local idexpression x;
statement S;
expression E;
identifier f,f1,l;
position p1,p2;
expression *ptr != NULL;
@@
x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
<... when != x
when != if (...) { <+...x...+> }
(
x->f1 = E
|
(x->f1 == NULL || ...)
|
f(...,x->f1,...)
)
...>
(
return \(0\|<+...x...+>\|ptr\);
|
return@p2 ...;
)
@script:python@
p1 << r.p1;
p2 << r.p2;
@@
print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Patrick Simmons [Sun, 2 Aug 2009 08:46:28 +0000 (02:46 -0600)]
zd1211rw: fix unaligned access in zd_mac_rx
Fix an unaligned memory access in the zd_mac_rx function of zd1211rw
that causes problems on SPARC64.
Signed-off-by: Patrick Simmons <linuxrocks123@netscape.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Luis R. Rodriguez [Fri, 31 Jul 2009 00:43:48 +0000 (17:43 -0700)]
cfg80211: fix regression on beacon world roaming feature
A regression was added through patch
a4ed90d6:
"cfg80211: respect API on orig_flags on channel for beacon hint"
We did indeed respect _orig flags but the intention was not clearly
stated in the commit log. This patch fixes firmware issues picked
up by iwlwifi when we lift passive scan of beaconing restrictions
on channels its EEPROM has been configured to always enable.
By doing so though we also disallowed beacon hints on devices
registering their wiphy with custom world regulatory domains
enabled, this happens to be currently ath5k, ath9k and ar9170.
The passive scan and beacon restrictions on those devices would
never be lifted even if we did find a beacon and the hardware did
support such enhancements when world roaming.
Since Johannes indicates iwlwifi firmware cannot be changed to
allow beacon hinting we set up a flag now to specifically allow
drivers to disable beacon hints for devices which cannot use them.
We enable the flag on iwlwifi to disable beacon hints and by default
enable it for all other drivers. It should be noted beacon hints lift
passive scan flags and beacon restrictions when we receive a beacon from
an AP on any 5 GHz non-DFS channels, and channels 12-14 on the 2.4 GHz
band. We don't bother with channels 1-11 as those channels are allowed
world wide.
This should fix world roaming for ath5k, ath9k and ar9170, thereby
improving scan time when we receive the first beacon from any AP,
and also enabling beaconing operation (AP/IBSS/Mesh) on cards which
would otherwise not be allowed to do so. Drivers not using custom
regulatory stuff (wiphy_apply_custom_regulatory()) were not affected
by this as the orig_flags for the channels would have been cleared
upon wiphy registration.
I tested this with a world roaming ath5k card.
Cc: Jouni Malinen <jouni.malinen@atheros.com>
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Johannes Berg [Wed, 29 Jul 2009 20:07:44 +0000 (22:07 +0200)]
cfg80211: add two missing NULL pointer checks
These pointers can be NULL, the is_mesh() case isn't
ever hit in the current kernel, but cmp_ies() can be
hit under certain conditions.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Cc: stable@kernel.org [2.6.29, 2.6.30]
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Mallikarjuna R Chilakala [Mon, 3 Aug 2009 07:20:38 +0000 (07:20 +0000)]
ixgbe: Patch to modify 82598 PCIe completion timeout values
The default completion timeout values for 82598 should be in the
range of 50us to 50ms, however the hardware default for these
parts is 500us to 1ms which is less than the 10ms recommended by
the pcie spec. To address this we need to increase the value to
either 10ms to 250ms for capability version 1 configuration, or
16ms to 55ms for version 2.
Signed-off-by: Mallikarjuna R Chilakala <mallikarjuna.chilakala@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dave Young [Mon, 3 Aug 2009 04:26:16 +0000 (04:26 +0000)]
bluetooth: rfcomm_init bug fix
rfcomm tty may be used before rfcomm_tty_driver initilized,
The problem is that now socket layer init before tty layer, if userspace
program do socket callback right here then oops will happen.
reporting in:
http://marc.info/?l=linux-bluetooth&m=
124404919324542&w=2
make 3 changes:
1. remove #ifdef in rfcomm/core.c,
make it blank function when rfcomm tty not selected in rfcomm.h
2. tune the rfcomm_init error patch to ensure
tty driver initilized before rfcomm socket usage.
3. remove __exit for rfcomm_cleanup_sockets
because above change need call it in a __init function.
Reported-by: Oliver Hartkopp <oliver@hartkopp.net>
Tested-by: Oliver Hartkopp <oliver@hartkopp.net>
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Yevgeny Petrilin [Mon, 3 Aug 2009 03:22:18 +0000 (20:22 -0700)]
mlx4_en: Fix double pci unmapping.
In cases of fragmented skb, with the data pointers being wrapped around
the TX buffer, the completion handling code would not forward the data
pointer and the firs fragment was unmapped several times, while others
were not unmapped at all.
Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
Andreas Eversberg [Mon, 27 Jul 2009 07:24:04 +0000 (07:24 +0000)]
mISDN: Fix handling of receive buffer size in L1oIP
The size of receive buffer pointer was used to get size of
receive buffer instead of recvbuf_size itself, so only 4/8
bytes could be transfered.
This is a regression to 2.6.30 introduced by commit
8c90e11e3543d7de612194a042a148caeaab5f1d
mISDN: Use kernel_{send,recv}msg instead of open coding
Signed-off-by: Andreas Eversberg <andreas@eversberg.eu>
Signed-off-by: Karsten Keil <keil@b1-systems.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Don Fry [Fri, 31 Jul 2009 08:45:29 +0000 (08:45 +0000)]
pcnet32: VLB support fixes
VLB support has been broken since at least 2004-2005 period as some
changes introduced back then assumed that ->pci_dev is always valid,
lets try to fix it:
- remove duplicated SET_NETDEV_DEV() call
- call SET_NETDEV_DEV() only for PCI devices
- check for ->pci_dev validity in pcnet32_open()
[ Alternatively we may consider removing VLB support but there would not
be much gain in it since an extra driver code needed for VLB support is
minimal and quite simple. ]
This takes care of the following entry from Dan's list:
drivers/net/pcnet32.c +1889 pcnet32_probe1(298) warning: variable derefenced before check 'pdev'
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Acked-by: Don Fry <pcnet32@verizon.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Don Fry [Fri, 31 Jul 2009 08:40:06 +0000 (08:40 +0000)]
pcnet32: remove superfluous NULL pointer check in pcnet32_probe1()
Move the debug printk() into the proper place and remove superfluous
NULL pointer check in pcnet32_probe1().
This takes care of the following entry from Dan's list:
drivers/net/pcnet32.c +1889 pcnet32_probe1(298) warning: variable derefenced before check 'pdev'
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Acked-by: Don Fry <pcnet32@verizon.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jiri Pirko [Thu, 30 Jul 2009 01:06:12 +0000 (01:06 +0000)]
net: restore the original spinlock to protect unicast list
There is a path when an assetion in dev_unicast_sync() appears.
igmp6_group_added -> dev_mc_add -> __dev_set_rx_mode ->
-> vlan_dev_set_rx_mode -> dev_unicast_sync
Therefore we cannot protect this list with rtnl. This patch restores the
original protecting this list with spinlock.
Signed-off-by: Jiri Pirko <jpirko@redhat.com>
Tested-by: Meelis Roos <mroos@linux.ee>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dhananjay Phadke [Sat, 1 Aug 2009 21:36:16 +0000 (21:36 +0000)]
netxen: fix coherent dma mask setting
Change default dma mask for NX3031 to 39 bit with ability
to update it to 64-bit (if firmware indicates support). Old
code was restricting it under 4GB (32-bit), sometimes causing
failure to allocate descriptor rings on heavily populated
system. NX2031 based NICs will still get 32-bit coherent mask.
Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
roel kluin [Fri, 31 Jul 2009 03:43:59 +0000 (03:43 +0000)]
mISDN: Read buffer overflow
Check whether index is within bounds before testing the element.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Karsten Keil <keil@b1-systems.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
roel kluin [Sat, 1 Aug 2009 20:20:13 +0000 (20:20 +0000)]
s6gmac: Read buffer overflow
Check whether index is within bounds before testing the element.
In the last iteration i is PHY_MAX_ADDR. the condition
`!(p = pd->mii.bus->phy_map[PHY_MAX_ADDR])' is undefined and may
evaluate to false, which leads to a dereference of this invalid
phy_map in the phy_connect() below.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
roel kluin [Sat, 1 Aug 2009 20:26:52 +0000 (20:26 +0000)]
tulip: Read buffer overflow
Check whether index is within bounds before testing the element.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Tue, 28 Jul 2009 02:36:15 +0000 (02:36 +0000)]
net: net_assign_generic() fix
memcpy() should take into account size of pointers,
not only number of pointers to copy.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Tue, 28 Jul 2009 03:47:39 +0000 (03:47 +0000)]
pppol2tp: calls unregister_pernet_gen_device() at unload time
Failure to call unregister_pernet_gen_device() can exhaust memory
if module is loaded/unloaded many times.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ben McKeegan [Tue, 28 Jul 2009 07:43:57 +0000 (07:43 +0000)]
ppp: fix lost fragments in ppp_mp_explode() (resubmit)
This patch fixes the corner cases where the sum of MTU of the free
channels (adjusted for fragmentation overheads) is less than the MTU
of PPP link. There are at least 3 situations where this case might
arise:
- some of the channels are busy
- the multilink session is running in a degraded state (i.e. with less
than its full complement of active channels)
- by design, where multilink protocol is being used to artificially
increase the effective link MTU of a single link.
Without this patch, at most 1 fragment is ever sent per free channel
for a given PPP frame and any remaining part of the PPP frame that
does not fit into those fragments is silently discarded.
This patch restores the original behaviour which was broken by commit
9c705260feea6ae329bc6b6d5f6d2ef0227eda0a 'ppp:ppp_mp_explode()
redesign'. Once all 'free' channels have been given a fragment, an
additional fragment is queued to each available channel in turn, as many
times as necessary, until the entire PPP frame has been consumed.
Signed-off-by: Ben McKeegan <ben@netservers.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Peter P Waskiewicz Jr [Thu, 30 Jul 2009 12:26:00 +0000 (12:26 +0000)]
ixgbe: Fix RSC completion delay causing Rx interrupts to stop
When a user disables interrupt throttling with ethtool on 82599 devices,
the interrupt timer may not be re-enabled if hardware RSC is running. The
RSC completions in hardware don't complete before the next ITR event tries
to fire, so the ITR timer never gets re-armed. This patch increases the
amount of time between interrupts when throttling is disabled (rx-usecs =
0) when the hardware RSC deature is enabled.
Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Peter P Waskiewicz Jr [Thu, 30 Jul 2009 12:25:28 +0000 (12:25 +0000)]
ixgbe: Fix usage of second flags bitmap when using LRO/RSC
A second set of feature flag bits was added, and the hardware RSC engine
flags were moved there. However, the code itself didn't make the move
completely to use the new bitmap.
Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Acked-by: Mallikarjuna R Chilakala <mallikarjuna.chilakala@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Peter P Waskiewicz Jr [Thu, 30 Jul 2009 12:25:09 +0000 (12:25 +0000)]
ixgbe: Fix netpoll to be properly multiqueue aware
Our ndo_poll_controller callback is broken for anything but non-multiqueue
setups. This fixes that issue.
Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jiajun Wu [Thu, 30 Jul 2009 21:20:42 +0000 (14:20 -0700)]
gianfar: fix coalescing setup in ethtool support
Parameter order for using mk_ic_value(count, time) was reversed,
the patch fixes this.
Signed-off-by: Jiajun Wu <b06378@freescale.com>
Signed-off-by: Li Yang <leoli@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Tue, 28 Jul 2009 23:43:08 +0000 (23:43 +0000)]
pppoe: fix /proc/net/pppoe
If a socket is hashed in last slot of pppoe hash table (PPPOE_HASH_SIZE-1)
we report it many times (up to filling seq buffer)
(Only the last socket of last slot)
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
roel kluin [Wed, 29 Jul 2009 03:18:56 +0000 (03:18 +0000)]
eexpress: Read buffer overflow
start_code is 69 words, but the code always writes a multiple of 16 words,
so the last 11 words written are outside the array.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
roel kluin [Wed, 29 Jul 2009 23:46:59 +0000 (23:46 +0000)]
ipv4: ARP neigh procfs buffer overflow
If arp_format_neigh_entry() can be called with n->dev->addr_len == 0, then a
write to hbuffer[-1] occurs.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
roel kluin [Thu, 30 Jul 2009 00:26:32 +0000 (00:26 +0000)]
3c515: Write outside array bounds
if dev_alloc_skb() fails on the first iteration, a write to
cp->rx_ring[-1] occurs.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Tobias Klauser [Thu, 30 Jul 2009 20:10:50 +0000 (13:10 -0700)]
docbook: fix printk of ip address
Use the %pI4 format string instead of %d.%d.%d.%d and NIPQUAD.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Michael Chan [Wed, 29 Jul 2009 08:49:52 +0000 (08:49 +0000)]
iscsi: Use GFP_ATOMIC in iscsi_offload_mesg().
Changing to GFP_ATOMIC because the only caller in cnic/bnx2i may
be calling this function while holding spin_lock.
This problem was discovered by Mike Christie.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Acked-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Julia Lawall [Thu, 30 Jul 2009 04:38:19 +0000 (04:38 +0000)]
net/netlabel: Add kmalloc NULL tests
The test on map4 should be a test on map6.
The semantic match that finds this problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@@
expression *x;
identifier f;
constant char *C;
@@
x = \(kmalloc\|kcalloc\|kzalloc\)(...);
... when != x == NULL
when != x != NULL
when != (x || ...)
(
kfree(x)
|
f(...,C,...,x,...)
|
*f(...,x,...)
|
*x->f
)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Thu, 30 Jul 2009 17:35:45 +0000 (10:35 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6
Johannes Berg [Tue, 28 Jul 2009 16:10:17 +0000 (18:10 +0200)]
mac80211: fix suspend
Jan reported that his b43-based laptop hangs during suspend.
The problem turned out to be mac80211 asking the driver to
stop the hardware before removing interfaces, and interface
removal caused b43 to touch the hardware (while down, which
causes the hang).
This patch fixes mac80211 to do reorder these operations to
have them in the correct order -- first remove interfaces
and then stop the hardware. Some more code is necessary to
be able to do so in a race-free manner, in particular it is
necessary to not process frames received during quiescing.
Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13337.
Reported-by: Jan Scholz <scholz@fias.uni-frankfurt.de>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Roel Kluin [Tue, 28 Jul 2009 10:05:00 +0000 (12:05 +0200)]
libertas: Read buffer overflow
Several arrays were read before checking whether the index was within
bounds. ARRAY_SIZE() should be used to determine the size of arrays.
rates->rates has an arraysize of 1, so calling get_common_rates()
with a rates_size of MAX_RATES (14) was causing reads out of bounds.
tmp_size can increment at most to (ARRAY_SIZE(lbs_bg_rates) - 1) *
(*rates_size - 1), so that should be the number of elements of tmp[].
A goto can be eliminated: ret was already set upon its declaration.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Roel Kluin [Tue, 28 Jul 2009 07:59:47 +0000 (09:59 +0200)]
libertas: Read outside array bounds
reads bss->rates[j] before checking bounds of index, and should use
ARRAY_SIZE to determine the size of the array.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Holger Schurig <hs4233@mail.mn-solutions.de>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Stephen Hemminger [Tue, 28 Jul 2009 01:39:45 +0000 (18:39 -0700)]
ip: fix logic of reverse path filter sysctl
Even though reverse path filter was changed from simple boolean to
trinary control, the loose mode only works if both all and device are
configured because of this logic error.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Luis R. Rodriguez [Mon, 27 Jul 2009 15:38:25 +0000 (08:38 -0700)]
mac80211: do not queue work after suspend in the dynamic ps timer
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Roel Kluin [Sat, 25 Jul 2009 21:34:31 +0000 (23:34 +0200)]
iwlwifi: Read outside array bounds
tid is bounded (above) by the size of default_tid_to_tx_fifo (17 elements), but
the size of priv->stations[].tid[] is MAX_TID_COUNT (9) elements.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Roel Kluin [Sat, 25 Jul 2009 21:21:22 +0000 (23:21 +0200)]
ath9k: Read outside array bounds
Incorrect limits leads to reads outside array bounds.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Roel Kluin [Sat, 25 Jul 2009 21:02:32 +0000 (23:02 +0200)]
airo: Buffer overflow
SSID_rid has space for only 3 ssids.
txPowerLevels[i] is read before the bounds check for i
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Dan Carpenter [Sat, 25 Jul 2009 12:22:59 +0000 (15:22 +0300)]
wireless: ERR_PTR vs null
iwm_wdev_alloc() returns an ERR_PTR on failure and not null. It also
prints its own dev_err() message so I removed that as well.
Compile tested only. Sorry.
Found by smatch (http://repo.or.cz/w/smatch.git).
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
reinette chatre [Tue, 21 Jul 2009 16:29:07 +0000 (09:29 -0700)]
iwlagn: fix minimum number of queues setting
We need to provide a reasonable minimum that will result in a
working setup if used. Set minimum to be 10 to provide for
4 standard TX queues + 1 command queue + 2 (unused) HCCA queues +
4 HT queues (one per AC).
We allow the user to change the number of queues used via a module
parameter and use this minimum value to check if it is valid. Without
this patch a user can select a value for the number of queues that
will result in a failing setup.
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Reviewed-by: Tomas Winkler <tomas.winkler@intel.com>
Acked-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Johannes Berg [Fri, 24 Jul 2009 18:13:14 +0000 (11:13 -0700)]
iwlwifi: fix TX queue race
I had a problem on 4965 hardware (well, probably other hardware too,
but others don't survive my stress testing right now, unfortunately)
where the driver was sending invalid commands to the device, but no
such thing could be seen from the driver's point of view. I could
reproduce this fairly easily by sending multiple TCP streams with
iperf on different TIDs, though sometimes a single iperf stream was
sufficient. It even happened with a single core, but I have forced
preemption turned on.
The culprit was a queue overrun, where we advanced the queue's write
pointer over the read pointer. After careful analysis I've come to
the conclusion that the cause is a race condition between iwlwifi
and mac80211.
mac80211, of course, checks whether the queue is stopped, before
transmitting a frame. This effectively looks like this:
lock(queues)
if (stopped(queue)) {
unlock(queues)
return busy;
}
unlock(queues)
... <-- this place will be important
there is some more code here
drv_tx(frame)
The driver, on the other hand, can stop and start queues, which does
lock(queues)
mark_running/stopped(queue)
unlock(queues)
[if marked running: wake up tasklet to send pending frames]
Now, however, once the driver starts the queue, mac80211 can see that
and end up at the marked place above, at which point for some reason the
driver seems to stop the queue again (I don't understand that) and then
we end up transmitting while the queue is actually full.
Now, this shouldn't actually matter much, but for some reason I've seen
it happen multiple times in a row and the queue actually overflows, at
which point the queue bites itself in the tail and things go completely
wrong.
This patch fixes this by just dropping the packet should this have
happened, and making the lock in iwlwifi cover everything so iwlwifi
can't race against itself (dropping the lock there might make it more
likely, but it did seem to happen without that too).
Since we can't hold the lock across drv_tx() above, I see no way to fix
this in mac80211, but I also don't understand why I haven't seen this
before -- maybe I just never stress tested it this badly.
With this patch, the device has survived many minutes of simultanously
sending two iperf streams on different TIDs with combined throughput
of about 60 Mbps.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Michael Chan [Mon, 27 Jul 2009 18:25:58 +0000 (11:25 -0700)]
cnic: Fix ISCSI_KEVENT_IF_DOWN message handling.
When a net device goes down or when the bnx2i driver is unloaded,
the code was not generating the ISCSI_KEVENT_IF_DOWN message
properly and this could cause the userspace driver to crash.
This is fixed by sending the message properly in the shutdown path.
cnic_uio_stop() is also added to send the message when bnx2i is
unregistering.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Deepak Saxena [Mon, 27 Jul 2009 17:49:44 +0000 (10:49 -0700)]
net: irda: init spinlock after memcpy
irttp_dup() copies a tsap_cb struct, but does not initialize the
spinlock in the new structure, which confuses lockdep.
Signed-off-by: Deepak Saxena <dsaxena@mvista.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Don Skidmore [Thu, 23 Jul 2009 18:00:39 +0000 (18:00 +0000)]
ixgbe: fix for 82599 errata marking UDP checksum errors
There is an 82599 errata that UDP frames with a zero checksum are
incorrectly marked as checksum invalid by the hardware. This was
leading to misleading hw_csum_rx_error counts. This patch adds a
test around this counter increase for this condition.
Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
françois romieu [Fri, 24 Jul 2009 12:34:19 +0000 (12:34 +0000)]
r8169: WakeOnLan fix for the 8168
More stuff for http://bugzilla.kernel.org/show_bug.cgi?id=9512
Some 8168 are unable to WoL when receiving is not enabled (plain
old 8169 do not seem to care).
It is not exactly pretty to leave the receiver enabled but we
should now enable DMA late enough for it to be safe. Some late
stage boot failure due to pxe and friends may benefit from the
delayed enabling of bus-mastering as well.
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Tested-by: Jaromír Cápík <tavvva@volny.cz>
Cc: Edward Hsu <edward_hsu@realtek.com.tw>
Dhananjay Phadke [Mon, 27 Jul 2009 03:17:21 +0000 (20:17 -0700)]
netxen: reset ring consumer during cleanup
Reset consumer of status rings to 0 when cleaning
up sw resources. Status rings are not deleted
during suspend since they have napi objects.
This ensures correct rx processing across suspen-resume.
Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Xiaotian Feng [Thu, 23 Jul 2009 23:06:32 +0000 (23:06 +0000)]
net/bridge: use kobject_put to release kobject in br_add_if error path
kobject_init_and_add will alloc memory for kobj->name, so in br_add_if
error path, simply use kobject_del will not free memory for kobj->name.
Fix by using kobject_put instead, kobject_put will internally calls
kobject_del and frees memory for kobj->name.
Signed-off-by: Xiaotian Feng <dfeng@redhat.com>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alessandro Rubini [Wed, 22 Jul 2009 12:49:08 +0000 (12:49 +0000)]
smc91x.h: add config for Nomadik evaluation kit
Signed-off-by: Alessandro Rubini <rubini@unipv.it>
Acked-by: Andrea Gallo <andrea.gallo@stericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ralf Baechle [Mon, 27 Jul 2009 02:11:14 +0000 (19:11 -0700)]
NET: ROSE: Don't use static buffer.
The use of a static buffer in rose2asc() to return its result is not
threadproof and can result in corruption if multiple threads are trying
to use one of the procfs files based on rose2asc().
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Roel Kluin [Mon, 27 Jul 2009 01:53:17 +0000 (18:53 -0700)]
eepro: Read buffer overflow
io[i] is read before the bounds check on i, order should be reversed
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
roel kluin [Sat, 25 Jul 2009 12:38:33 +0000 (12:38 +0000)]
tokenring: Read buffer overflow
io[i] is read before the bounds check on i, order should be reversed
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
roel kluin [Sat, 25 Jul 2009 12:01:50 +0000 (12:01 +0000)]
at1700: Read buffer overflow
loop bound looks to be wrong, for an array of length 8
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
roel kluin [Sat, 25 Jul 2009 07:41:12 +0000 (07:41 +0000)]
fealnx: Write outside array bounds
phy_idx is checked to be < 4, but np->phys[] is 2 elements long
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Andy Gospodarek [Wed, 22 Jul 2009 09:34:00 +0000 (09:34 +0000)]
ixgbe: remove unnecessary call to device_init_wakeup
Calls to device_init_wakeup should not be necessary in drivers that use
device_set_wakeup_enable since pci_pm_init will set the can_wakeup flag
for the device when initialized.
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Lucy Liu [Wed, 22 Jul 2009 14:07:33 +0000 (14:07 +0000)]
ixgbe: Don't priority tag control frames in DCB mode
Certain types of control packets (LLDP, LACP, etc.) are not supposed to have a
priority tag or vlan tag inserted. Ixgbe driver is currently priority
tagging everything (if packet is not on a VLAN interface).
This patch modifies DCB mode, so that packets marked with skb priority
TC_PRIO_CONTROL are not priority tagged. It also transmits these packets on
the highest priority traffic class.
Programs (like dcbd) can set the skb priority using a socket option. Or, a tc
filter can be configured to set the priority value. Using the value
TC_PRIO_CONTROL (7) has the benefit that it is already defined in the kernel,
and the bonding LACP code already sets the skb->priority field to this value.
Signed-off-by: Lucy Liu <lucy.liu@intel.com>
Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Yi Zou [Wed, 22 Jul 2009 14:07:12 +0000 (14:07 +0000)]
ixgbe: Enable FCoE offload when DCB is enabled for 82599
Currently, FCoE offload feature is turned on when the kernel config has
CONFIG_FCOE or CONFIG_FCOE_MODULE set. However, we really want to turn
FCoE offload on when there is FCoE traffic passing and turn it off when
it's just LAN traffic. Since FCoE depends on a lossless network provided
by DCB, this allows us to have FCoE turned on/off when user turns on DCB
using dcbtool.
Signed-off-by: Yi Zou <yi.zou@intel.com>
Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Mark Ware [Thu, 23 Jul 2009 17:56:48 +0000 (10:56 -0700)]
net: Rework mdio-ofgpio driver to use of_mdio infrastructure
Changes to the fs_enet driver
aa73832c5a80d6c52c69b18af858d88fa595dd3c
("net: Rework fs_enet driver to use of_mdio infrastructure")
cause kernel crashes when using the mdio-ofgpio driver.
This patch replicates similar changes made to the fs_enet mii-bitbang
drivers. It has been tested on a custom mpc8280 based board using an
NFS mounted root.
Signed-off-by: Mark Ware <mware@elphinstone.net>
Acked-by: Grant Likely <grant.likely@secretlab.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Uwe Kleine-König [Tue, 21 Jul 2009 10:11:39 +0000 (10:11 +0000)]
register at91_ether using platform_driver_probe
at91ether_probe lives in .init.text, so using platform_driver_register
to register it is wrong because binding a device after the init memory
is discarded (e.g. via sysfs) results in an oops.
As requested by David Brownell platform_driver_probe is used instead of
moving the probe function to .devinit.text as proposed initially.
This saves some memory, but devices registered after the driver is
probed are not bound (probably there are none) and binding via sysfs
isn't possible.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: Andrew Victor <linux@maxim.org.za>
Signed-off-by: David S. Miller <davem@davemloft.net>
Rafael J. Wysocki [Wed, 22 Jul 2009 02:58:55 +0000 (02:58 +0000)]
skge: Enable WoL by default if supported
If skge hardware is capable of waking up the system from sleep,
enable magic packet WoL during driver initialisation.
This makes WoL work without calling 'ethtool -s ethX wol g'
for each adapter.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Tested-by: Michael Guntsche <mike@it-loops.com>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Wed, 22 Jul 2009 18:18:40 +0000 (11:18 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6
Alexander Beregalov [Wed, 22 Jul 2009 01:16:51 +0000 (01:16 +0000)]
net: KS8851 needs to depend on MII
fix this build error when CONFIG_MII is not set
drivers/net/ks8851.c:999: undefined reference to `generic_mii_ioctl'
drivers/net/ks8851.c:1050: undefined reference to `mii_link_ok'
drivers/net/ks8851.c:1056: undefined reference to `mii_nway_restart'
drivers/net/ks8851.c:1044: undefined reference to `mii_ethtool_sset'
drivers/net/ks8851.c:1038: undefined reference to `mii_ethtool_gset'
Signed-off-by: Alexander Beregalov <a.beregalov@gmail.com>
Acked-by: Ben Dooks <ben@simtec.co.uk>
Ajit Khaparde [Wed, 22 Jul 2009 16:28:55 +0000 (09:28 -0700)]
be2net: Bug fix in the non-lro path. Size of received packet was not updated in statistics properly.
This patch fixes a bug in the non-lro path. Wrong size of received
packet was being passed for updating receive statistics. This patch
is against the net-2.6 git.
Signed-off-by: Ajit Khaparde <ajitk@serverengines.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Anton Vorontsov [Thu, 16 Jul 2009 21:31:47 +0000 (21:31 +0000)]
ucc_geth: Revive fixed link support
Since commit
0b9da337dca972e7a4144e298ec3adb8f244d4a4 ("Rework
ucc_geth driver to use of_mdio infrastructure") the fixed-link
support is broken.
This patch fixes the support by removing !ug_info->phy_node check,
and adds a call to of_phy_connect_fixed_link() if a phy is not attached
to the MAC.
Also, remove an old fixed-link code that we don't use any longer.
Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Anton Vorontsov [Thu, 16 Jul 2009 21:31:42 +0000 (21:31 +0000)]
gianfar: Revive fixed link support
Since commit
fe192a49118f5b1272317d60c7930ece4e13ae49 ("Rework gianfar
driver to use of_mdio infrastructure") the fixed-link support is
broken, the driver oopses at init_phy():
Unable to handle kernel paging request for data at address 0x000000e4
Faulting instruction address: 0xc01cf298
Oops: Kernel access of bad area, sig: 11 [#1]
[...]
NIP [
c01cf298] init_phy+0x80/0xdc
LR [
c01cf250] init_phy+0x38/0xdc
Call Trace:
[
cf81fe80] [
c01d1cf8] gfar_enet_open+0x6c/0x19c
[
cf81fea0] [
c024494c] dev_open+0xfc/0x134
[
cf81fec0] [
c0242edc] dev_change_flags+0x84/0x1ac
[
cf81fee0] [
c0399ee0] ic_open_devs+0x168/0x2d8
[
cf81ff20] [
c039b2e8] ip_auto_config+0x90/0x2a4
[
cf81ff60] [
c0003884] do_one_initcall+0x34/0x1a8
This patch fixes the oops, and removes phy_node checks, and adds a call
to of_phy_connect_fixed_link() if a phy isn't attached..
Also, remove an old fixed-link code that we don't use any longer.
Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Anton Vorontsov [Thu, 16 Jul 2009 21:31:36 +0000 (21:31 +0000)]
fs_enet: Revive fixed link support
Since commit
aa73832c5a80d6c52c69b18af858d88fa595dd3c ("Rework
fs_enet driver to use of_mdio infrastructure") the fixed-link support
is broken in the fs_enet driver.
This patch fixes the support by removing a check for phy_node, and adding
a call to of_phy_connect_fixed_link().
Also set netdev parent device via SET_NETDEV_DEV() call, this is needed
so that OF MDIO core could find a node pointer for a device.
Plus, fix "if (IS_ERR(phydev))" check, in case of errors,
of_phy_connect() returns NULL, not ERR_PTR as phy_connect().
Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Anton Vorontsov [Thu, 16 Jul 2009 21:31:31 +0000 (21:31 +0000)]
of/mdio: Add support function for Ethernet fixed-link property
Fixed-link support is broken for the ucc_eth, gianfar, and fs_enet
device drivers. The "OF MDIO rework" patches removed most of the
support. Instead of re-adding fixed-link stuff to the drivers, this
patch adds a support function for parsing the fixed-link property
and obtaining a dummy phy to match.
Note: the dummy phy handling in arch/powerpc is a bit of a hack and
needs to be reworked. This function is being added now to solve the
regression in the Ethernet drivers, but it should be considered a
temporary measure until the fixed link handling can be reworked.
Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Mike McCormack [Wed, 22 Jul 2009 03:57:56 +0000 (20:57 -0700)]
sky2: Avoid races in sky2_down
Reset rx chain before trying to drain it.
Shut interrupts off last, incase there's something to report.
Signed-off-by: Mike McCormack <mikem@ring3k.org>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Julia Lawall [Sun, 19 Jul 2009 06:09:25 +0000 (06:09 +0000)]
drivers/net/mlx4: Adjust constant
The values in the advertising field are typically ADVERTISED_xxx, not
SUPPORTED_xxx. Both SUPPORTED_10000baseT_Full and
ADVERTISED_1000baseT_Full have the same value.
The semantic match that finds this problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@@
struct ethtool_cmd E;
@@
*E.advertising = SUPPORTED_10000baseT_Full
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Julia Lawall [Sun, 19 Jul 2009 05:26:35 +0000 (05:26 +0000)]
drivers/net: Move a dereference below a NULL test
If the NULL test is necessary, then the dereference should be moved below
the NULL test.
The semantic patch that makes this change is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@@
type T;
expression E,E1;
identifier i,fld;
statement S;
@@
- T i = E->fld;
+ T i;
... when != E=E1
when != i
if (E == NULL||...) S
+ i = E->fld;
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Julia Lawall [Sun, 19 Jul 2009 06:13:04 +0000 (06:13 +0000)]
drivers/net: Move a dereference below a NULL test
If the NULL test is necessary, then the dereferences should be moved below
the NULL test.
The semantic patch that makes this change is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@@
type T;
expression E,E1;
identifier i,fld;
statement S;
@@
- T i = E->fld;
+ T i;
... when != E=E1
when != i
BUG_ON (E == NULL||...);
+ i = E->fld;
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Marek Vasut [Thu, 16 Jul 2009 17:19:53 +0000 (19:19 +0200)]
libertas: Fix problem with broken V4 firmware on CF8381
Firmware V4 on CF8381 reports region code shifted by 1 byte to left.
The following patch checks for this and handles it properly.
Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>