OSDN Git Service
Jamal Hadi Salim [Tue, 10 Jun 2008 21:25:34 +0000 (14:25 -0700)]
ipsec: pfkey should ignore events when no listeners
When pfkey has no km listeners, it still does a lot of work
before finding out there aint nobody out there.
If a tree falls in a forest and no one is around to hear it, does it make
a sound? In this case it makes a lot of noise:
With this short-circuit adding 10s of thousands of SAs using
netlink improves performance by ~10%.
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Herbert Xu [Tue, 10 Jun 2008 21:08:25 +0000 (14:08 -0700)]
pppoe: Unshare skb before anything else
We need to unshare the skb first as otherwise pskb_may_pull may
write to a shared skb which could be bad.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Herbert Xu [Tue, 10 Jun 2008 21:07:25 +0000 (14:07 -0700)]
net pppoe: Check packet length on all receive paths
The length field in the PPPOE header wasn't checked completely.
This patch causes all packets shorter than the declared length
to be dropped.
It also changes the memcpy_toiovec call to skb_copy_datagram_iovec
so that paged packets (rare for PPPOE) are handled properly.
Thanks to Ilja of the Netric Security Team for discovering and
reporting this bug, and Chris Wright for the total_len check.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Akinobu Mita [Tue, 10 Jun 2008 19:50:14 +0000 (12:50 -0700)]
isdn: use simple_read_from_buffer()
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Alexey Dobriyan [Tue, 10 Jun 2008 19:49:31 +0000 (12:49 -0700)]
isdn divas: fix proc creation
1. creating proc entry and not saving pointer to PDE and checking it
is not going to work.
2. if proc entry wasn't created, no reason to remove it on error path.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pradeep Singh Rautela [Tue, 10 Jun 2008 19:46:52 +0000 (12:46 -0700)]
drivers/atm/eni.h: remove unused macro KERNEL_OFFSET
KERNEL_OFFSET macro in eni.h is not required as it is not used anywhere.
Remove the unused macro from eni.h header file.
Signed-off-by: Pradeep Singh <rautelap@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Arnaldo Carvalho de Melo [Tue, 10 Jun 2008 19:39:35 +0000 (12:39 -0700)]
inet{6}_request_sock: Init ->opt and ->pktopts in the constructor
Wei Yongjun noticed that we may call reqsk_free on request sock objects where
the opt fields may not be initialized, fix it by introducing inet_reqsk_alloc
where we initialize ->opt to NULL and set ->pktopts to NULL in
inet6_reqsk_alloc.
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Rami Rosen [Tue, 10 Jun 2008 19:37:42 +0000 (12:37 -0700)]
ipv4: Remove unused declaration from include/net/tcp.h.
- The tcp_unhash() method in /include/net/tcp.h is no more needed, as the
unhash method in tcp_prot structure is now inet_unhash (instead of
tcp_unhash in the
past); see tcp_prot structure in net/ipv4/tcp_ipv4.c.
- So, this patch removes tcp_unhash() declaration from include/net/tcp.h
Signed-off-by: Rami Rosen <ramirose@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
James Chapman [Tue, 10 Jun 2008 19:35:00 +0000 (12:35 -0700)]
l2tp: Fix potential memory corruption in pppol2tp_recvmsg()
This patch fixes a potential memory corruption in
pppol2tp_recvmsg(). If skb->len is bigger than the caller's buffer
length, memcpy_toiovec() will go into unintialized data on the kernel
heap, interpret it as an iovec and start modifying memory.
The fix is to change the memcpy_toiovec() call to
skb_copy_datagram_iovec() so that paged packets (rare for PPPOL2TP)
are handled properly. Also check that the caller's buffer is big
enough for the data and set the MSG_TRUNC flag if it is not so.
Reported-by: Ilja <ilja@netric.org>
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pavel Emelyanov [Mon, 9 Jun 2008 22:53:30 +0000 (15:53 -0700)]
ipv6 netns: init net is used to set bindv6only for new sock
The bindv6only is tuned via sysctl. It is already on a struct net
and per-net sysctls allow for its modification (ipv6_sysctl_net_init).
Despite this the value configured in the init net is used for the
rest of them.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ingo Molnar [Mon, 9 Jun 2008 22:47:38 +0000 (15:47 -0700)]
irda: net/irda build fix: mcs7780
-tip testing found the following build error:
drivers/built-in.o: In function `mcs_receive_irq':
mcs7780.c:(.text+0x4e429): undefined reference to `crc32_le'
drivers/built-in.o: In function `mcs_hard_xmit':
mcs7780.c:(.text+0x4e9af): undefined reference to `crc32_le'
with:
http://redhat.com/~mingo/misc/config-Sun_Jun__8_22_56_14_CEST_2008.bad
the reason is a missing enablement of the CRC32 library in the Kconfig.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Samuel Ortiz <samuel@sortiz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Matt Carlson [Mon, 9 Jun 2008 22:41:33 +0000 (15:41 -0700)]
tg3: Update version to 3.92.1
This patch increments the version to 3.92.1.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Matt Carlson [Mon, 9 Jun 2008 22:41:12 +0000 (15:41 -0700)]
tg3: Fix 5761 WOL
On 5761 non-e devices, two problems prevent the administrator from
overriding the WOL settings in the device's NVRAM.
The first problem is that GPIO 0 and GPIO 2 have been swapped. This
change prevented the administrator from turning on WOL when it is
disabled in NVRAM. The fix is to add a new path for the 5761 that
swaps the two GPIOs in the code as well.
The second problem is that GPIO 1 could not be toggled by the driver
because the GPIO is shared with the debug UART GPIO. This will prevent
the administrator from being able to turn WOL off if it was enabled in
NVRAM. The fix is to always disable the debug UART after a GRC reset.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Matt Carlson [Mon, 9 Jun 2008 22:40:26 +0000 (15:40 -0700)]
tg3: Fix a flags typo
This patch fixes a problem where the TG3_FLAG_10_100_ONLY flag was
testing against the wrong flags variable.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Matt Carlson [Mon, 9 Jun 2008 22:39:55 +0000 (15:39 -0700)]
tg3: Fix 5714S / 5715S / 5780S link failures
The git commit
ef167e27039eeaea6d3cdd5c547b082e89840bdd entitled
"Fix supporting flowctrl code" introduced a bug that prevents 5714S,
5715S and 5780S devices from falling back to a forced link mode. The
problem is that the added flow control check will always fail if flow
control is set to autoneg and either RX or TX (or both) flow control
is enabled. The driver defaults to setting flow control to autoneg
and advertises both RX and TX flow control.
The fix is to remove the errant check.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Marcin Slusarz [Sun, 8 Jun 2008 11:13:06 +0000 (13:13 +0200)]
iwlwifi: fix oops in iwl3945_led_brightness_set
fix race between:
ieee80211_open->ieee80211_led_radio->led_trigger_event->led_set_brightness->iwl3945_led_brightness_set
(which assumes that "led->priv" is not NULL)
and
iwl3945_pci_probe->iwl3945_setup_deferred_work->(...)->iwl3945_bg_alive_start->iwl3945_alive_start->iwl3945_led_register->iwl3945_led_register_led
which sets priv field in struct iwl3945_led
after
led->led_dev.brightness_set = iwl3945_led_brightness_set;
(...)
led_classdev_register(device, &led->led_dev);
http://kerneloops.org/guilty.php?guilty=iwl3945_led_brightness_set&version=2.6.25-release&start=
1671168&end=
1703935&class=oops
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: Zhu Yi <yi.zhu@intel.com>
Cc: Reinette Chatre <reinette.chatre@intel.com>
Cc: Tomas Winkler <tomas.winkler@intel.com>
Cc: linux-wireless@vger.kernel.org
Cc: ipw3945-devel@lists.sourceforge.net
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Adrian Bunk [Thu, 5 Jun 2008 18:29:49 +0000 (21:29 +0300)]
include/linux/ssb/ssb_driver_gige.h typo fix
This patch fixes a typo in the name of a config variable.
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Reviewed-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Assaf Krauss [Thu, 5 Jun 2008 16:55:21 +0000 (19:55 +0300)]
mac80211: Checking IBSS support while changing channel in ad-hoc mode
This patch adds a check to the set_channel flow. When attempting to change
the channel while in IBSS mode, and the new channel does not support IBSS
mode, the flow return with an error value with no consequences on the
mac80211 and driver state.
Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Dan Williams [Wed, 4 Jun 2008 17:59:34 +0000 (13:59 -0400)]
mac80211: decrease IBSS creation latency
Sufficient scans (at least 2 or 3) should have been done within 7
seconds to find an existing IBSS to join. This should improve IBSS
creation latency; and since IBSS merging is still in effect, shouldn't
have detrimental effects on eventual IBSS convergence.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Michael Buesch [Thu, 5 Jun 2008 14:55:10 +0000 (16:55 +0200)]
zd1211rw: Fix data padding for QoS
This patch fixes a data alignment issue in the zd1211rw driver.
The IEEE80211_STYPE_QOS_DATA bit should be used as a bitwise test
to test for the presence of the 2 byte QoS control field.
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Assaf Krauss [Wed, 4 Jun 2008 17:27:59 +0000 (20:27 +0300)]
mac80211: Fixing slow IBSS rejoin
This patch fixes the issue of slow reconnection to an IBSS cell after
disconnection from it. Now the interface's bssid is reset upon ifdown.
ieee80211_sta_find_ibss:
if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
(bss = ieee80211_rx_bss_get(dev, bssid,
local->hw.conf.channel->center_freq,
ifsta->ssid, ifsta->ssid_len)))
Note:
In general disconnection is still not handled properly in mac80211
Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Holger Schurig [Wed, 4 Jun 2008 09:10:40 +0000 (11:10 +0200)]
libertas: fix sleep confirmation
This fixes an issus that made "iwconfig eth1 power on" non-working.
When we get a "PS sleep" event, we have to confirm this to the firmware.
The confirm happens with a command, but this command is special: the
firmware won't send us a response. if_cs_host_to_card() is setting
priv->dnld_sent anyway, so this variable stayed at DNLD_DATA_SENT and
was never cleared back.
Now I put the special knowledge that the CMD_802_11_PS_MODE with
CMD_SUBCMD_SLEEP_CONFIRMED doesn't need to need a response by directly
clearing the dnld_sent state in lbs_send_confirmsleep().
Signed-off-by: Holger Schurig <hs4233@mail.mn-solutions.de>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Dan Williams [Wed, 4 Jun 2008 03:39:55 +0000 (23:39 -0400)]
mac80211: send association event on IBSS create
Otherwise userspace has no idea the IBSS creation succeeded.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Dan Williams [Mon, 2 Jun 2008 21:51:23 +0000 (17:51 -0400)]
ipw2200: queue direct scans
When another scan is in progress, a direct scan gets dropped on the
floor. However, that direct scan is usually the scan that's really
needed by userspace, and gets stomped on by all the broadcast scans the
ipw2200 driver issues internally. Make sure the direct scan happens
eventually, and as a bonus ensure that the passive scan worker is
cleaned up when appropriate.
The change of request_passive_scan form a struct work to struct
delayed_work is only to make the set_wx_scan() code a bit simpler, it's
still only used with a delay of 0 to match previous behavior.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
James Chapman [Wed, 4 Jun 2008 22:54:07 +0000 (15:54 -0700)]
l2tp: Fix possible oops if transmitting or receiving when tunnel goes down
Some problems have been experienced in the field which cause an oops
in the pppol2tp driver if L2TP tunnels fail while passing data.
The pppol2tp driver uses private data that is referenced via the
sk->sk_user_data of its UDP and PPPoL2TP sockets. This patch makes
sure that the driver uses sock_hold() when it holds a reference to the
sk pointer. This affects its sendmsg(), recvmsg(), getname(),
[gs]etsockopt() and ioctl() handlers.
Tested by ISP where problem was seen. System has been up 10 days with
no oops since running this patch. Without the patch, an oops would
occur every 1-2 days.
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Octavian Purdila [Wed, 4 Jun 2008 22:45:58 +0000 (15:45 -0700)]
tcp: Fix for race due to temporary drop of the socket lock in skb_splice_bits.
skb_splice_bits temporary drops the socket lock while iterating over
the socket queue in order to break a reverse locking condition which
happens with sendfile. This, however, opens a window of opportunity
for tcp_collapse() to aggregate skbs and thus potentially free the
current skb used in skb_splice_bits and tcp_read_sock.
This patch fixes the problem by (re-)getting the same "logical skb"
after the lock has been temporary dropped.
Based on idea and initial patch from Evgeniy Polyakov.
Signed-off-by: Octavian Purdila <opurdila@ixiacom.com>
Acked-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Sridhar Samudrala [Wed, 4 Jun 2008 22:19:35 +0000 (15:19 -0700)]
tcp: Increment OUTRSTS in tcp_send_active_reset()
TCP "resets sent" counter is not incremented when a TCP Reset is
sent via tcp_send_active_reset().
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Denis V. Lunev [Wed, 4 Jun 2008 22:16:12 +0000 (15:16 -0700)]
raw: Raw socket leak.
The program below just leaks the raw kernel socket
int main() {
int fd = socket(PF_INET, SOCK_RAW, IPPROTO_UDP);
struct sockaddr_in addr;
memset(&addr, 0, sizeof(addr));
inet_aton("127.0.0.1", &addr.sin_addr);
addr.sin_family = AF_INET;
addr.sin_port = htons(2048);
sendto(fd, "a", 1, MSG_MORE, &addr, sizeof(addr));
return 0;
}
Corked packet is allocated via sock_wmalloc which holds the owner socket,
so one should uncork it and flush all pending data on close. Do this in the
same way as in UDP.
Signed-off-by: Denis V. Lunev <den@openvz.org>
Acked-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
James Chapman [Wed, 4 Jun 2008 22:07:32 +0000 (15:07 -0700)]
lt2p: Fix possible WARN_ON from socket code when UDP socket is closed
If an L2TP daemon closes a tunnel socket while packets are queued in
the tunnel's reorder queue, a kernel warning is logged because the
socket is closed while skbs are still referencing it. The fix is to
purge the queue in the socket's release handler.
WARNING: at include/net/sock.h:351 udp_lib_unhash+0x41/0x68()
Pid: 12998, comm: openl2tpd Not tainted 2.6.25 #8
[<
c0423c58>] warn_on_slowpath+0x41/0x51
[<
c05d33a7>] udp_lib_unhash+0x41/0x68
[<
c059424d>] sk_common_release+0x23/0x90
[<
c05d16be>] udp_lib_close+0x8/0xa
[<
c05d8684>] inet_release+0x42/0x48
[<
c0592599>] sock_release+0x14/0x60
[<
c059299f>] sock_close+0x29/0x30
[<
c046ef52>] __fput+0xad/0x15b
[<
c046f1d9>] fput+0x17/0x19
[<
c046c8c4>] filp_close+0x50/0x5a
[<
c046da06>] sys_close+0x69/0x9f
[<
c04048ce>] syscall_call+0x7/0xb
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Wed, 4 Jun 2008 21:58:13 +0000 (14:58 -0700)]
Merge branch 'master' of /linux/kernel/git/linville/wireless-2.6
Felix Homann [Thu, 29 May 2008 07:36:45 +0000 (00:36 -0700)]
USB ID for Philips CPWUA054/00 Wireless USB Adapter 11g
Enable the Philips CPWUA054/00 in p54usb.
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Michael Buesch [Mon, 2 Jun 2008 14:15:23 +0000 (16:15 +0200)]
ssb: Fix context assertion in ssb_pcicore_dev_irqvecs_enable
This fixes a context assertion in ssb that makes b44 print
out warnings on resume.
This fixes the following kernel oops:
http://www.kerneloops.org/oops.php?number=12732
http://www.kerneloops.org/oops.php?number=11410
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Holger Schurig [Fri, 30 May 2008 12:53:22 +0000 (14:53 +0200)]
libertas: fix command size for CMD_802_11_SUBSCRIBE_EVENT
The size was two small by two bytes.
Signed-off-by: Holger Schurig
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Dan Williams [Thu, 29 May 2008 18:38:28 +0000 (14:38 -0400)]
ipw2200: expire and use oldest BSS on adhoc create
If there are no networks on the free list, expire the oldest one when
creating a new adhoc network. Because ipw2200 and the ieee80211 stack
don't actually cull old networks and place them back on the free list
unless they are needed for new probe responses, over time the free list
would become empty and creating an adhoc network would fail due to the !
list_empty(...) check.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Andrew Morton [Wed, 28 May 2008 19:40:39 +0000 (12:40 -0700)]
airo warning fix
WARNING: space prohibited between function name and open parenthesis '('
#22: FILE: drivers/net/wireless/airo.c:2907:
+ while ((IN4500 (ai, COMMAND) & COMMAND_BUSY) && (delay < 10000)) {
total: 0 errors, 1 warnings, 8 lines checked
./patches/wireless-airo-waitbusy-wont-delay.patch has style problems, please review. If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
Please run checkpatch prior to sending patches
Cc: Dan Williams <dcbw@redhat.com>
Cc: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Michael Buesch [Thu, 22 May 2008 15:06:36 +0000 (17:06 +0200)]
b43legacy: Fix controller restart crash
This fixes a kernel crash on rmmod, in the case where the controller
was restarted before doing the rmmod.
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Vlad Yasevich [Wed, 4 Jun 2008 19:40:15 +0000 (12:40 -0700)]
sctp: Fix ECN markings for IPv6
Commit
e9df2e8fd8fbc95c57dbd1d33dada66c4627b44c ("[IPV6]: Use
appropriate sock tclass setting for routing lookup.") also changed the
way that ECN capable transports mark this capability in IPv6. As a
result, SCTP was not marking ECN capablity because the traffic class
was never set. This patch brings back the markings for IPv6 traffic.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Vlad Yasevich [Wed, 4 Jun 2008 19:39:36 +0000 (12:39 -0700)]
sctp: Flush the queue only once during fast retransmit.
When fast retransmit is triggered by a sack, we should flush the queue
only once so that only 1 retransmit happens. Also, since we could
potentially have non-fast-rtx chunks on the retransmit queue, we need
make sure any chunks eligable for fast retransmit are sent first
during fast retransmission.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Tested-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Vlad Yasevich [Wed, 4 Jun 2008 19:39:11 +0000 (12:39 -0700)]
sctp: Start T3-RTX timer when fast retransmitting lowest TSN
When we are trying to fast retransmit the lowest outstanding TSN, we
need to restart the T3-RTX timer, so that subsequent timeouts will
correctly tag all the packets necessary for retransmissions.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Tested-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Vlad Yasevich [Wed, 4 Jun 2008 19:38:43 +0000 (12:38 -0700)]
sctp: Correctly implement Fast Recovery cwnd manipulations.
Correctly keep track of Fast Recovery state and do not reduce
congestion window multiple times during sucht state.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Tested-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Gui Jianfeng [Wed, 4 Jun 2008 19:38:07 +0000 (12:38 -0700)]
sctp: Move sctp_v4_dst_saddr out of loop
There's no need to execute sctp_v4_dst_saddr() for each
iteration, just move it out of loop.
Signed-off-by: Gui Jianfeng <guijianfeng@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Gui Jianfeng [Wed, 4 Jun 2008 19:37:33 +0000 (12:37 -0700)]
sctp: retran_path update bug fix
If the current retran_path is the only active one, it should
update it to the the next inactive one.
Signed-off-by: Gui Jianfeng <guijianfeng@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Wed, 4 Jun 2008 19:10:21 +0000 (12:10 -0700)]
Merge branch 'net-2.6-misc-
20080605a' of git://git.linux-ipv6.org/gitroot/yoshfuji/linux-2.6-fix
Ilpo Järvinen [Wed, 4 Jun 2008 19:07:44 +0000 (12:07 -0700)]
tcp: fix skb vs fack_count out-of-sync condition
This bug is able to corrupt fackets_out in very rare cases.
In order for this to cause corruption:
1) DSACK in the middle of previous SACK block must be generated.
2) In order to take that particular branch, part or all of the
DSACKed segment must already be SACKed so that we have that
in cache in the first place.
3) The new info must be top enough so that fackets_out will be
updated on this iteration.
...then fack_count is updated while skb wasn't, then we walk again
that particular segment thus updating fack_count twice for
a single skb and finally that value is assigned to fackets_out
by tcp_sacktag_one.
It is safe to call tcp_sacktag_one just once for a segment (at
DSACK), no need to call again for plain SACK.
Potential problem of the miscount are limited to premature entry
to recovery and to inflated reordering metric (which could even
cancel each other out in the most the luckiest scenarios :-)).
Both are quite insignificant in worst case too and there exists
also code to reset them (fackets_out once sacked_out becomes zero
and reordering metric on RTO).
This has been reported by a number of people, because it occurred
quite rarely, it has been very evasive. Andy Furniss was able to
get it to occur couple of times so that a bit more info was
collected about the problem using a debug patch, though it still
required lot of checking around. Thanks also to others who have
tried to help here.
This is listed as Bugzilla #10346. The bug was introduced by
me in commit
68f8353b48 ([TCP]: Rewrite SACK block processing &
sack_recv_cache use), I probably thought back then that there's
need to scan that entry twice or didn't dare to make it go
through it just once there. Going through twice would have
required restoring fack_count after the walk but as noted above,
I chose to drop the additional walk step altogether here.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Mark Asselstine [Wed, 4 Jun 2008 19:06:28 +0000 (12:06 -0700)]
sunhme: Cleanup use of deprecated calls to save_and_cli and restore_flags.
Make use of local_irq_save and local_irq_restore rather then the
deprecated save_and_cli and restore_flags calls.
Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Adrian-Ken Rueegsegger [Wed, 4 Jun 2008 19:04:55 +0000 (12:04 -0700)]
xfrm: xfrm_algo: correct usage of RIPEMD-160
This patch fixes the usage of RIPEMD-160 in xfrm_algo which in turn
allows hmac(rmd160) to be used as authentication mechanism in IPsec
ESP and AH (see RFC 2857).
Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Denis V. Lunev [Wed, 4 Jun 2008 11:49:08 +0000 (15:49 +0400)]
[IPV6]: Do not change protocol for UDPv6 sockets with pending sent data.
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Denis V. Lunev [Wed, 4 Jun 2008 11:49:07 +0000 (15:49 +0400)]
[IPV6]: inet_sk(sk)->cork.opt leak
IPv6 UDP sockets wth IPv4 mapped address use udp_sendmsg to send the data
actually. In this case ip_flush_pending_frames should be called instead
of ip6_flush_pending_frames.
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Denis V. Lunev [Wed, 4 Jun 2008 11:49:06 +0000 (15:49 +0400)]
[IPV6]: Do not change protocol for raw IPv6 sockets.
It is not allowed to change underlying protocol for
int fd = socket(PF_INET6, SOCK_RAW, IPPROTO_UDP);
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
YOSHIFUJI Hideaki [Wed, 4 Jun 2008 04:02:49 +0000 (13:02 +0900)]
[IPV6] NETNS: Handle ancillary data in appropriate namespace.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
YOSHIFUJI Hideaki [Wed, 4 Jun 2008 04:01:37 +0000 (13:01 +0900)]
[IPV6]: Check outgoing interface even if source address is unspecified.
The outgoing interface index (ipi6_ifindex) in IPV6_PKTINFO
ancillary data, is not checked if the source address (ipi6_addr)
is unspecified. If the ipi6_ifindex is the not-exist interface,
it should be fail.
Based on patch from Shan Wei <shanwei@cn.fujitsu.com> and
Brian Haley <brian.haley@hp.com>.
Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
Signed-off-by: Brian Haley <brian.haley@hp.com>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Yang Hongyang [Wed, 28 May 2008 08:27:28 +0000 (16:27 +0800)]
[IPV6]: Fix the data length of get destination options with short length
If get destination options with length which is not enough for that
option,getsockopt() will still return the real length of the option,
which is larger then the buffer space.
This is because ipv6_getsockopt_sticky() returns the real length of
the option.
This patch fix this problem.
Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Yang Hongyang [Wed, 28 May 2008 08:23:47 +0000 (16:23 +0800)]
[IPV6]: Fix the return value of get destination options with NULL data pointer
If we pass NULL data buffer to getsockopt(), it will return 0,
and the option length is set to -EFAULT:
getsockopt(sk, IPPROTO_IPV6, IPV6_DSTOPTS, NULL, &len);
This is because ipv6_getsockopt_sticky() will return -EFAULT or
-EINVAL if some error occur.
This patch fix this problem.
Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
YOSHIFUJI Hideaki [Tue, 27 May 2008 08:37:49 +0000 (17:37 +0900)]
[IPV6] ADDRCONF: Allow longer lifetime on 64bit archs.
- Allow longer lifetimes (>= 0x7fffffff/HZ) on 64bit archs
by using unsigned long.
- Shadow this arithmetic overflow workaround by introducing
helper functions: addrconf_timeout_fixup() and
addrconf_finite_timeout().
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
YOSHIFUJI Hideaki [Fri, 30 May 2008 02:35:03 +0000 (11:35 +0900)]
[IPV4] TUNNEL4: Fix incoming packet length check for inter-protocol tunnel.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Colin [Mon, 26 May 2008 16:04:43 +0000 (00:04 +0800)]
[IPV6] TUNNEL6: Fix incoming packet length check for inter-protocol tunnel.
I discover a strange behavior in [ipv4 in ipv6] tunnel. When IPv6 tunnel
payload is less than 40(0x28), packet can be sent to network, received in
physical interface, but not seen in IP tunnel interface. No counter increase
in tunnel interface.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Thomas Graf [Wed, 28 May 2008 14:54:22 +0000 (16:54 +0200)]
[IPV6] ADDRCONF: Check range of prefix length
As of now, the prefix length is not vaildated when adding or deleting
addresses. The value is passed directly into the inet6_ifaddr structure
and later passed on to memcmp() as length indicator which relies on
the value never to exceed 128 (bits).
Due to the missing check, the currently code allows for any 8 bit
value to be passed on as prefix length while using the netlink
interface, and any 32 bit value while using the ioctl interface.
[Use unsigned int instead to generate better code - yoshfuji]
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
YOSHIFUJI Hideaki [Tue, 3 Jun 2008 16:30:25 +0000 (01:30 +0900)]
[IPV6] UDP: Possible dst leak in udpv6_sendmsg.
ip6_sk_dst_lookup returns held dst entry. It should be released
on all paths beyond this point. Add missed release when up->pending
is set.
Bug report and initial patch by Denis V. Lunev <den@openvz.org>.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: Denis V. Lunev <den@openvz.org>
YOSHIFUJI Hideaki [Thu, 29 May 2008 10:55:05 +0000 (19:55 +0900)]
[SCTP]: Fix NULL dereference of asoc.
Commit
7cbca67c073263c179f605bdbbdc565ab29d801d ("[IPV6]: Support
Source Address Selection API (RFC5014)") introduced NULL dereference
of asoc to sctp_v6_get_saddr in net/sctp/ipv6.c.
Pointed out by Johann Felix Soden <johfel@users.sourceforge.net>.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
David S. Miller [Wed, 4 Jun 2008 18:50:00 +0000 (11:50 -0700)]
Merge branch 'davem-fixes' of /linux/kernel/git/jgarzik/netdev-2.6
Ilpo Järvinen [Wed, 4 Jun 2008 18:34:22 +0000 (11:34 -0700)]
tcp: Fix inconsistency source (CA_Open only when !tcp_left_out(tp))
It is possible that this skip path causes TCP to end up into an
invalid state where ca_state was left to CA_Open while some
segments already came into sacked_out. If next valid ACK doesn't
contain new SACK information TCP fails to enter into
tcp_fastretrans_alert(). Thus at least high_seq is set
incorrectly to a too high seqno because some new data segments
could be sent in between (and also, limited transmit is not
being correctly invoked there). Reordering in both directions
can easily cause this situation to occur.
I guess we would want to use tcp_moderate_cwnd(tp) there as well
as it may be possible to use this to trigger oversized burst to
network by sending an old ACK with huge amount of SACK info, but
I'm a bit unsure about its effects (mainly to FlightSize), so to
be on the safe side I just currently fixed it minimally to keep
TCP's state consistent (obviously, such nasty ACKs have been
possible this far). Though it seems that FlightSize is already
underestimated by some amount, so probably on the long term we
might want to trigger recovery there too, if appropriate, to make
FlightSize calculation to resemble reality at the time when the
losses where discovered (but such change scares me too much now
and requires some more thinking anyway how to do that as it
likely involves some code shuffling).
This bug was found by Brian Vowell while running my TCP debug
patch to find cause of another TCP issue (fackets_out
miscount).
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jarek Poplawski [Wed, 4 Jun 2008 16:58:27 +0000 (09:58 -0700)]
netfilter: nf_conntrack_ipv6: fix inconsistent lock state in nf_ct_frag6_gather()
[ 63.531438] =================================
[ 63.531520] [ INFO: inconsistent lock state ]
[ 63.531520] 2.6.26-rc4 #7
[ 63.531520] ---------------------------------
[ 63.531520] inconsistent {softirq-on-W} -> {in-softirq-W} usage.
[ 63.531520] tcpsic6/3864 [HC0[0]:SC1[1]:HE1:SE0] takes:
[ 63.531520] (&q->lock#2){-+..}, at: [<
c07175b0>] ipv6_frag_rcv+0xd0/0xbd0
[ 63.531520] {softirq-on-W} state was registered at:
[ 63.531520] [<
c0143bba>] __lock_acquire+0x3aa/0x1080
[ 63.531520] [<
c0144906>] lock_acquire+0x76/0xa0
[ 63.531520] [<
c07a8f0b>] _spin_lock+0x2b/0x40
[ 63.531520] [<
c0727636>] nf_ct_frag6_gather+0x3f6/0x910
...
According to this and another similar lockdep report inet_fragment
locks are taken from nf_ct_frag6_gather() with softirqs enabled, but
these locks are mainly used in softirq context, so disabling BHs is
necessary.
Reported-and-tested-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dong Wei [Wed, 4 Jun 2008 16:57:51 +0000 (09:57 -0700)]
netfilter: xt_connlimit: fix accouning when receive RST packet in ESTABLISHED state
In xt_connlimit match module, the counter of an IP is decreased when
the TCP packet is go through the chain with ip_conntrack state TW.
Well, it's very natural that the server and client close the socket
with FIN packet. But when the client/server close the socket with RST
packet(using so_linger), the counter for this connection still exsit.
The following patch can fix it which is based on linux-2.6.25.4
Signed-off-by: Dong Wei <dwei.zh@gmail.com>
Acked-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Thomas Graf [Tue, 3 Jun 2008 23:37:33 +0000 (16:37 -0700)]
route: Remove unused ifa_anycast field
The field was supposed to allow the creation of an anycast route by
assigning an anycast address to an address prefix. It was never
implemented so this field is unused and serves no purpose. Remove it.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Thomas Graf [Tue, 3 Jun 2008 23:36:54 +0000 (16:36 -0700)]
netlink: Improve returned error codes
Make nlmsg_trim(), nlmsg_cancel(), genlmsg_cancel(), and
nla_nest_cancel() void functions.
Return -EMSGSIZE instead of -1 if the provided message buffer is not
big enough.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Thomas Graf [Tue, 3 Jun 2008 23:36:27 +0000 (16:36 -0700)]
route: Mark unused routing attributes as such
Also removes an unused policy entry for an attribute which is
only used in kernel->user direction.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Thomas Graf [Tue, 3 Jun 2008 23:36:01 +0000 (16:36 -0700)]
route: Mark unused route cache flags as such.
Also removes an obsolete check for the unused flag RTCF_MASQ.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Brice Goglin [Tue, 3 Jun 2008 23:07:45 +0000 (16:07 -0700)]
net_dma: remove duplicate assignment in dma_skb_copy_datagram_iovec
No need to compute copy twice in the frags loop in
dma_skb_copy_datagram_iovec().
Signed-off-by: Brice Goglin <Brice.Goglin@inria.fr>
Acked-by: Shannon Nelson <shannon.nelson@intel.com>
Signed-off-by: Maciej Sosnowski <maciej.sosnowski@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stephen Hemminger [Tue, 3 Jun 2008 23:03:15 +0000 (16:03 -0700)]
net: neighbour table ABI problem
The neighbor table time of last use information is returned in the
incorrect unit. Kernel to user space ABI's need to use USER_HZ (or
milliseconds), otherwise the application has to try and discover the
real system HZ value which is problematic. Linux has standardized on
keeping USER_HZ consistent (100hz) even when kernel is running
internally at some other value.
This change is small, but it breaks the ABI for older version of
iproute2 utilities. But these utilities are already broken since they
are looking at the psched_hz values which are completely different. So
let's just go ahead and fix both kernel and user space. Older
utilities will just print wrong values.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Adrian Bunk [Tue, 3 Jun 2008 23:00:01 +0000 (16:00 -0700)]
bridge: update URL
This patch updates the URL of the bridge homepage.
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pavel Emelyanov [Tue, 3 Jun 2008 22:18:36 +0000 (15:18 -0700)]
irda: Sock leak on error path in irda_create.
Bad type/protocol specified result in sk leak.
Fix is simple - release the sk if bad values are given,
but to make it possible just to call sk_free(), I move
some sk initialization a bit lower.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jarek Poplawski [Tue, 3 Jun 2008 21:53:46 +0000 (14:53 -0700)]
ax25: Fix NULL pointer dereference and lockup.
From: Jarek Poplawski <jarkao2@gmail.com>
There is only one function in AX25 calling skb_append(), and it really
looks suspicious: appends skb after previously enqueued one, but in
the meantime this previous skb could be removed from the queue.
This patch Fixes it the simple way, so this is not fully compatible with
the current method, but testing hasn't shown any problems.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dave Young [Mon, 2 Jun 2008 06:50:52 +0000 (23:50 -0700)]
bluetooth: rfcomm_dev_state_change deadlock fix
There's logic in __rfcomm_dlc_close:
rfcomm_dlc_lock(d);
d->state = BT_CLOSED;
d->state_changed(d, err);
rfcomm_dlc_unlock(d);
In rfcomm_dev_state_change, it's possible that rfcomm_dev_put try to
take the dlc lock, then we will deadlock.
Here fixed it by unlock dlc before rfcomm_dev_get in
rfcomm_dev_state_change.
why not unlock just before rfcomm_dev_put? it's because there's
another problem. rfcomm_dev_get/rfcomm_dev_del will take
rfcomm_dev_lock, but in rfcomm_dev_add the lock order is :
rfcomm_dev_lock --> dlc lock
so I unlock dlc before the taken of rfcomm_dev_lock.
Actually it's a regression caused by commit
1905f6c736cb618e07eca0c96e60e3c024023428 ("bluetooth :
__rfcomm_dlc_close lock fix"), the dlc state_change could be two
callbacks : rfcomm_sk_state_change and rfcomm_dev_state_change. I
missed the rfcomm_sk_state_change that time.
Thanks Arjan van de Ven <arjan@linux.intel.com> for the effort in
commit
4c8411f8c115def968820a4df6658ccfd55d7f1a ("bluetooth: fix
locking bug in the rfcomm socket cleanup handling") but he missed the
rfcomm_dev_state_change lock issue.
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Mon, 2 Jun 2008 22:30:44 +0000 (15:30 -0700)]
Merge git://git./linux/kernel/git/herbert/crypto-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
[CRYPTO] cts: Init SG tables
Linus Torvalds [Mon, 2 Jun 2008 22:28:45 +0000 (15:28 -0700)]
Merge branch 'upstream-linus' of git://git./linux/kernel/git/mfasheh/ocfs2
* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2:
[PATCH 3/3] ocfs2/net: Silence build warnings
[PATCH 2/3] ocfs2/dlm: Silence build warnings
[PATCH 1/3] ocfs2/net: Silence build warnings
ocfs2: Rename 'user_stack' plugin structure to 'ocfs2_user_plugin'
Anton Vorontsov [Sun, 1 Jun 2008 09:49:32 +0000 (11:49 +0200)]
mmc_spi: mmc_spi.h should include linux/interrupts.h
Since mmc_spi.h uses irqreturn_t type, it should include appropriate
header, otherwise build will break if users didn't include it (some of
them do not use interrupts).
Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Mon, 2 Jun 2008 22:26:02 +0000 (15:26 -0700)]
Merge git://git./linux/kernel/git/sam/kbuild-fixes
* git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fixes:
kbuild: fix $(src) assignmnet with external modules
Linus Torvalds [Mon, 2 Jun 2008 22:25:27 +0000 (15:25 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/cooloney/blackfin-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/blackfin-2.6:
8250 Serial Driver: revert extra IRQ flag definition patch
Blackfin arch: update anomaly headers from toolchain trunk
Blackfin arch: Remove bad and usless code
Blackfin arch: Fix bug - set corret SSEL and IRQ to enable AD7877 on BF527
Blackfin arch: Fix typo. it should be _outsw_8
Blackfin arch: Cleanup no functional changes
Linus Torvalds [Mon, 2 Jun 2008 22:25:03 +0000 (15:25 -0700)]
Merge branch 'merge' of git://git./linux/kernel/git/paulus/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
[POWERPC] Fix DMA nodes in the MPC8610 HPCD device tree
[POWERPC] Export empty_zero_page and copy_page in arch/ppc
[POWERPC] Add "memory" clobber to MMIO accessors
[POWERPC] pasemi: update pasemi_defconfig, enable electra_cf
electra_cf: Add MODULE_DEVICE_TABLE()
Alexey Dobriyan [Mon, 2 Jun 2008 05:46:51 +0000 (15:46 +1000)]
[CRYPTO] cts: Init SG tables
Steps to reproduce:
modprobe tcrypt # with CONFIG_DEBUG_SG=y
testing cts(cbc(aes)) encryption
test 1 (128 bit key):
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:65!
invalid opcode: 0000 [1] PREEMPT SMP DEBUG_PAGEALLOC
CPU 0
Modules linked in: tea xts twofish twofish_common tcrypt(+) [maaaany]
Pid: 16151, comm: modprobe Not tainted 2.6.26-rc4-fat #7
RIP: 0010:[<
ffffffffa0bf032e>] [<
ffffffffa0bf032e>] :cts:cts_cbc_encrypt+0x151/0x355
RSP: 0018:
ffff81016f497a88 EFLAGS:
00010286
RAX:
ffffe20009535d58 RBX:
ffff81016f497af0 RCX:
0000000087654321
RDX:
ffff8100010d4f28 RSI:
ffff81016f497ee8 RDI:
ffff81016f497ac0
RBP:
ffff81016f497c38 R08:
0000000000000000 R09:
0000000000000011
R10:
ffffffff00000008 R11:
ffff8100010d4f28 R12:
ffff81016f497ac0
R13:
ffff81016f497b30 R14:
0000000000000010 R15:
0000000000000010
FS:
00007fac6fa276f0(0000) GS:
ffffffff8060e000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
000000008005003b
CR2:
00007f12ca7cc000 CR3:
000000016f441000 CR4:
00000000000026e0
DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
DR3:
0000000000000000 DR6:
00000000ffff4ff0 DR7:
0000000000000400
Process modprobe (pid: 16151, threadinfo
ffff81016f496000, task
ffff8101755b4ae0)
Stack:
0000000000000001 ffff81016f496000 ffffffff80719f78 0000000000000001
0000000000000001 ffffffff8020c87c ffff81016f99c918 20646c756f772049
65687420656b696c 0000000000000020 0000000000000000 0000000033341102
Call Trace:
[<
ffffffff8020c87c>] ? restore_args+0x0/0x30
[<
ffffffffa04aa311>] ? :aes_generic:crypto_aes_expand_key+0x311/0x369
[<
ffffffff802ab453>] ? check_object+0x15a/0x213
[<
ffffffff802aad22>] ? init_object+0x6e/0x76
[<
ffffffff802ac3ae>] ? __slab_free+0xfc/0x371
[<
ffffffffa0bf05ed>] :cts:crypto_cts_encrypt+0xbb/0xca
[<
ffffffffa07108de>] ? :crypto_blkcipher:setkey+0xc7/0xec
[<
ffffffffa07110b8>] :crypto_blkcipher:async_encrypt+0x38/0x3a
[<
ffffffffa2ce9341>] :tcrypt:test_cipher+0x261/0x7c6
[<
ffffffffa2cfd9df>] :tcrypt:tcrypt_mod_init+0x9df/0x1b30
[<
ffffffff80261e35>] sys_init_module+0x9e/0x1b2
[<
ffffffff8020c15a>] system_call_after_swapgs+0x8a/0x8f
Code: 45 c0 e8 aa 24 63 df 48 c1 e8 0c 48 b9 00 00 00 00 00 e2 ff ff 48 8b 55 88 48 6b c0 68 48 01 c8 b9 21 43 65 87 48 39 4d 80 74 04 <0f> 0b eb fe f6 c2 01 74 04 0f 0b eb fe 83 e2 03 4c 89 ef 44 89
RIP [<
ffffffffa0bf032e>] :cts:cts_cbc_encrypt+0x151/0x355
RSP <
ffff81016f497a88>
---[ end trace e8bahiarjand37fd ]---
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Sam Ravnborg [Sat, 31 May 2008 20:28:40 +0000 (22:28 +0200)]
kbuild: fix $(src) assignmnet with external modules
When we introduced support for KBUILD_EXTRA_SYMBOLS
we started to include the externam module's kbuild
file when doing the final modpost step.
As external modules often do:
ccflags-y := -I$(src)
We had problems because $(src) was unassinged and
gcc then used the next parameter for -I resulting in
strange build failures.
Fix is to assign $(src) and $(obj) when building
external modules.
This fixes: http://bugzilla.kernel.org/show_bug.cgi?id=10798
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Tvrtko <tvrtko.ursulin@sophos.com>
Cc: Andrea Arcangeli <andrea@qumranet.com>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Bryan Wu [Sat, 31 May 2008 08:10:04 +0000 (16:10 +0800)]
8250 Serial Driver: revert extra IRQ flag definition patch
As Russell pointed out, original patch will break some serial configurations
because of the dependency of the <asm/serial.h> header file.
Revert it first and try to find out other solution later
Cc: Javier Herrero <jherrero@hvsistemas.es>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Russell King <rmk+lkml@arm.linux.org.uk>
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Mike Frysinger [Sat, 31 May 2008 07:47:17 +0000 (15:47 +0800)]
Blackfin arch: update anomaly headers from toolchain trunk
Signed-off-by: Mike Frysinger <vapier.adi@gmail.com>
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Michael Hennerich [Sat, 31 May 2008 07:35:40 +0000 (15:35 +0800)]
Blackfin arch: Remove bad and usless code
Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Bryan Wu [Sat, 31 May 2008 07:17:25 +0000 (15:17 +0800)]
Blackfin arch: Fix bug - set corret SSEL and IRQ to enable AD7877 on BF527
AD7877 use SSEL_2 (P9.9) and IRQ_PF8 (P9.14) on BF527
- populating JP3 to enable STAMP
- disable SW11.2 to disconnect SSEL_2/PF12 from Rotary NAND
- disable SW18.1 to disconnect SSEL_2 from MAX1233 touchscreen chip
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Timur Tabi [Fri, 30 May 2008 22:12:05 +0000 (08:12 +1000)]
[POWERPC] Fix DMA nodes in the MPC8610 HPCD device tree
The node for DMA2 in the MPC8610 HPCD device tree has the wrong compatible
properties. This breaks the DMA driver and the sound driver.
Signed-off-by: Timur Tabi <timur@freescale.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Tony Breeds [Wed, 28 May 2008 00:52:19 +0000 (10:52 +1000)]
[POWERPC] Export empty_zero_page and copy_page in arch/ppc
Currently ext4 and fuse fail to link if modular:
ERROR: "copy_page" [fs/fuse/fuse.ko] undefined!
ERROR: "empty_zero_page" [fs/ext4/ext4dev.ko] undefined!
make[3]: *** [__modpost] Error 1
make[2]: *** [modules] Error 2
make[1]: *** [sub-make] Error 2
While arch ppc exists it may as well compile, so this exports those
symbols (which are already exported in arch/powerpc).
Signed-off-by: Tony Breeds <tony@bakeyournoodle.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Benjamin Herrenschmidt [Wed, 28 May 2008 00:18:17 +0000 (10:18 +1000)]
[POWERPC] Add "memory" clobber to MMIO accessors
Gcc might re-order MMIO accessors vs. surrounding consistent
memory accesses, which is a "bad thing", and could break drivers.
This fixes it by adding a "memory" clobber to the MMIO accessors,
which should prevent gcc from doing that reordering.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Grant Grundler [Mon, 12 May 2008 06:37:51 +0000 (00:37 -0600)]
[netdrvr] tulip: oops in tulip_interrupt when hibernating with swsusp/suspend2
The following patch is seems to fix the tulip suspend/resume panic:
http://bugzilla.kernel.org/show_bug.cgi?id=8952#c46
My attempts at a cleaner patch failed and Pavel thinks this is OK.
Original from: kernelbugs@tap.homeip.net
Signed-off-by: Grant Grundler <grundler@parisc-linux.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Alexey Dobriyan [Thu, 22 May 2008 22:00:25 +0000 (02:00 +0400)]
atl1: fix 4G memory corruption bug
When using 4+ GB RAM and SWIOTLB is active, the driver corrupts
memory by writing an skb after the relevant DMA page has been
unmapped. Although this doesn't happen when *not* using bounce
buffers, clearing the pointer to the DMA page after unmapping
it fixes the problem.
http://marc.info/?t=
120861317000005&r=2&w=2
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Jay Cliburn <jacliburn@bellsouth.net>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Li Yang [Fri, 23 May 2008 10:11:27 +0000 (18:11 +0800)]
ucc_geth_ethtool: Add a missing HW stats counter
Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: Li Yang <leoli@freescale.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Joakim Tjernlund [Fri, 23 May 2008 10:11:26 +0000 (18:11 +0800)]
ucc_geth_ethtool: Fix typo
Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: Li Yang <leoli@freescale.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Rusty Russell [Mon, 26 May 2008 07:48:13 +0000 (17:48 +1000)]
virtio: fix delayed xmit of packet and freeing of old packets.
Because we cache the last failed-to-xmit packet, if there are no
packets queued behind that one we may never send it (reproduced here
as TCP stalls, "cured" by an outgoing ping).
Cc: Mark McLoughlin <markmc@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Rusty Russell [Mon, 26 May 2008 07:42:42 +0000 (17:42 +1000)]
virtio: fix virtio_net xmit of freed skb bug
If we fail to transmit a packet, we assume the queue is full and put
the skb into last_xmit_skb. However, if more space frees up before we
xmit it, we loop, and the result can be transmitting the same skb twice.
Fix is simple: set skb to NULL if we've used it in some way, and check
before sending.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Brice Goglin [Wed, 28 May 2008 07:10:01 +0000 (09:10 +0200)]
myri10ge: update driver version
Update myri10ge version to 1.3.99-1.347.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Cesar Eduardo Barros [Fri, 30 May 2008 00:58:36 +0000 (21:58 -0300)]
sc92031: remove bogus unlikely()
Commit
5a0a92e67b5009a71e011658da04fb92dad8961f mentions len < ETH_ZLEN
is true for ARP packets. This obviously is not unlikely.
Signed-off-by: Cesar Eduardo Barros <cesarb@cesarb.net>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Wang Chen [Fri, 30 May 2008 03:18:55 +0000 (11:18 +0800)]
[netdrvr] CS89X0: Add cleanup for dma after fail
After request_dma() succeeding, any error path should do free_dma().
Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Ben Hutchings [Fri, 30 May 2008 21:18:35 +0000 (22:18 +0100)]
[netdrvr] sfc: Report XAUI link down at default log level
This is normal when the external link is down so don't report it as an error.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Linus Torvalds [Fri, 30 May 2008 22:39:05 +0000 (15:39 -0700)]
Merge branch 'upstream-linus' of git://git./linux/kernel/git/jgarzik/libata-dev
* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
ahci: change the Device IDs of nvidia MCP7B AHCI controller in ahci.c
[libata] sata_fsl: Fix broken driver, add port multiplier (PMP) support
libata: SRST can't be trusted on PMP sil3726
libata: fix libata-scsi kernel-doc notation
ata: Convert to static DEFINE_SPINLOCK(lock)
ata_piix: fix macbook ich8m problems
sata_mv: implement SoC guideline SATA_S11
sata_mv: workaround for 60x1 errata sata13
sata_mv: nuke unreleased GenIIe revisions
sata_mv: PHY_MODEx errata fixes
sata_mv: move SOC_FLAG to hpriv
Sunil Mushran [Tue, 13 May 2008 01:31:37 +0000 (18:31 -0700)]
[PATCH 3/3] ocfs2/net: Silence build warnings
This patch silences the build warnings concerning o2net_init_nst()
and friends when building without CONFIG_DEBUG_FS enabled.
Signed-off-by: Sunil Mushran <sunil.mushran@oracle.com>
Signed-off-by: Mark Fasheh <mfasheh@suse.com>