18 Jul, 2009

10 commits


17 Jul, 2009

11 commits

  • Conflicts:
    drivers/net/wireless/orinoco/main.c

    David S. Miller
     
  • When the driver received an EEM packet with CRC option enabled, driver must
    compute and check the CRC of the Ethernet data. Previous version computes CRC
    on Ethernet data plus the original CRC value. Skbuff is correctly trimed but
    the old length is used when CRC is computed.

    Signed-off-by: Vincent CUISSARD
    Signed-off-by: David S. Miller

    Vincent CUISSARD
     
  • Remove debug DPRINTK in DCB mode netlink interface.

    Signed-off-by: Lucy Liu
    Acked-by: Peter P Waskiewicz Jr
    Signed-off-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Lucy Liu
     
  • This change clears the address data block memory space, which is needed for
    the 82598 which does not have a SAN MAC.

    Signed-off-by: Lucy Liu
    Acked-by: Peter P Waskiewicz Jr
    Signed-off-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Lucy Liu
     
  • The commit changes to shutdown path broke startup on some systems.

    revert commit c0bad0f2e4366d5bbfe0c4a7a80bca8f4b05272b

    Signed-off-by: Stephen Hemminger
    Signed-off-by: David S. Miller

    Stephen Hemminger
     
  • Commit e912b1142be8f1e2c71c71001dc992c6e5eb2ec1
    (net: sk_prot_alloc() should not blindly overwrite memory)
    took care of not zeroing whole new socket at allocation time.

    sock_copy() is another spot where we should be very careful.
    We should not set refcnt to a non null value, until
    we are sure other fields are correctly setup, or
    a lockless reader could catch this socket by mistake,
    while not fully (re)initialized.

    This patch puts sk_node & sk_refcnt to the very beginning
    of struct sock to ease sock_copy() & sk_prot_alloc() job.

    We add appropriate smp_wmb() before sk_refcnt initializations
    to match our RCU requirements (changes to sock keys should
    be committed to memory before sk_refcnt setting)

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • E100 places it's RX packet descriptors inside skb->data and uses them
    with bidirectional streaming DMA mapping. Unfortunately it fails to
    transfer skb->data ownership to the device after it reads the
    descriptor's status, breaking on non-coherent (e.g., ARM) platforms.

    This have to be converted to use coherent memory for the descriptors.

    Signed-off-by: Krzysztof Halasa
    Acked-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Krzysztof Halasa
     
  • Bonding device forbids slave device of different types under the same
    master.

    However, it is possible for a bonding master to change type during its
    lifetime. This can be either from ARPHRD_ETHER to ARPHRD_INFINIBAND
    or the other way arround. The change of type requires device level
    multicast address cleanup because device level multicast addresses
    depend on the device type.

    The patch adds a call to dev_close() before the bonding master changes
    type and dev_open() just after that.

    In the example below I enslaved an IPoIB device (ib0) under
    bond0. Since each bonding master starts as device of type ARPHRD_ETHER
    by default, a change of type occurs when ib0 is enslaved.

    This is how /proc/net/dev_mcast looks like without the patch

    5 bond0 1 0 00ffffffff12601bffff000000000001ff96ca05
    5 bond0 1 0 01005e000116
    5 bond0 1 0 01005e7ffffd
    5 bond0 1 0 01005e000001
    5 bond0 1 0 333300000001
    6 ib0 1 0 00ffffffff12601bffff000000000001ff96ca05
    6 ib0 1 0 333300000001
    6 ib0 1 0 01005e000001
    6 ib0 1 0 01005e7ffffd
    6 ib0 1 0 01005e000116
    6 ib0 1 0 00ffffffff12401bffff00000000000000000001
    6 ib0 1 0 00ffffffff12601bffff00000000000000000001

    and this is how it looks like after the patch.

    5 bond0 1 0 00ffffffff12601bffff000000000001ff96ca05
    5 bond0 1 0 00ffffffff12601bffff00000000000000000001
    5 bond0 1 0 00ffffffff12401bffff0000000000000ffffffd
    5 bond0 1 0 00ffffffff12401bffff00000000000000000116
    5 bond0 1 0 00ffffffff12401bffff00000000000000000001
    6 ib0 1 0 00ffffffff12601bffff000000000001ff96ca05
    6 ib0 1 0 00ffffffff12401bffff00000000000000000116
    6 ib0 1 0 00ffffffff12401bffff0000000000000ffffffd
    6 ib0 2 0 00ffffffff12401bffff00000000000000000001
    6 ib0 2 0 00ffffffff12601bffff00000000000000000001

    Signed-off-by: Moni Shoua
    Signed-off-by: Jay Vosburgh
    Signed-off-by: David S. Miller

    Moni Shoua
     
  • Fix misplaced parenthesis

    Signed-off-by: Roel Kluin
    Signed-off-by: David S. Miller

    roel kluin
     
  • Parentheses are required or the comparison occurs before the bitand.

    Signed-off-by: Roel Kluin
    Signed-off-by: David S. Miller

    roel kluin
     
  • David S. Miller
     

16 Jul, 2009

5 commits

  • When a slab cache uses SLAB_DESTROY_BY_RCU, we must be careful when allocating
    objects, since slab allocator could give a freed object still used by lockless
    readers.

    In particular, nf_conntrack RCU lookups rely on ct->tuplehash[xxx].hnnode.next
    being always valid (ie containing a valid 'nulls' value, or a valid pointer to next
    object in hash chain.)

    kmem_cache_zalloc() setups object with NULL values, but a NULL value is not valid
    for ct->tuplehash[xxx].hnnode.next.

    Fix is to call kmem_cache_alloc() and do the zeroing ourself.

    As spotted by Patrick, we also need to make sure lookup keys are committed to
    memory before setting refcount to 1, or a lockless reader could get a reference
    on the old version of the object. Its key re-check could then pass the barrier.

    Signed-off-by: Eric Dumazet
    Signed-off-by: Patrick McHardy

    Eric Dumazet
     
  • The first argument is the address family, the second one the hook
    number.

    Signed-off-by: Patrick McHardy

    Patrick McHardy
     
  • The use of it was converted to %pM, but the variable
    stuck -- remove it now to not cause spurious warnings.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • Add appropriate MODULE_ALIAS() to facilitate autoloading of can protocol drivers

    Signed-off-by: Lothar Wassmann
    Acked-by: Oliver Hartkopp
    Signed-off-by: David S. Miller

    Lothar Waßmann
     
  • Fix a use after free bug in can protocol drivers

    The release functions of the can protocol drivers lack a call to
    sock_orphan() which leads to referencing freed memory under certain
    circumstances.

    This patch fixes a bug reported here:
    https://lists.berlios.de/pipermail/socketcan-users/2009-July/000985.html

    Signed-off-by: Lothar Wassmann
    Acked-by: Oliver Hartkopp
    Signed-off-by: David S. Miller

    Lothar Waßmann
     

15 Jul, 2009

8 commits

  • Wireless extensions have the unfortunate problem that events
    are multicast netlink messages, and are not independent of
    pointer size. Thus, currently 32-bit tasks on 64-bit platforms
    cannot properly receive events and fail with all kinds of
    strange problems, for instance wpa_supplicant never notices
    disassociations, due to the way the 64-bit event looks (to a
    32-bit process), the fact that the address is all zeroes is
    lost, it thinks instead it is 00:00:00:00:01:00.

    The same problem existed with the ioctls, until David Miller
    fixed those some time ago in an heroic effort.

    A different problem caused by this is that we cannot send the
    ASSOCREQIE/ASSOCRESPIE events because sending them causes a
    32-bit wpa_supplicant on a 64-bit system to overwrite its
    internal information, which is worse than it not getting the
    information at all -- so we currently resort to sending a
    custom string event that it then parses. This, however, has a
    severe size limitation we are frequently hitting with modern
    access points; this limitation would can be lifted after this
    patch by sending the correct binary, not custom, event.

    A similar problem apparently happens for some other netlink
    users on x86_64 with 32-bit tasks due to the alignment for
    64-bit quantities.

    In order to fix these problems, I have implemented a way to
    send compat messages to tasks. When sending an event, we send
    the non-compat event data together with a compat event data in
    skb_shinfo(main_skb)->frag_list. Then, when the event is read
    from the socket, the netlink code makes sure to pass out only
    the skb that is compatible with the task. This approach was
    suggested by David Miller, my original approach required
    always sending two skbs but that had various small problems.

    To determine whether compat is needed or not, I have used the
    MSG_CMSG_COMPAT flag, and adjusted the call path for recv and
    recvfrom to include it, even if those calls do not have a cmsg
    parameter.

    I have not solved one small part of the problem, and I don't
    think it is necessary to: if a 32-bit application uses read()
    rather than any form of recvmsg() it will still get the wrong
    (64-bit) event. However, neither do applications actually do
    this, nor would it be a regression.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • The current function for sending events first allocates the
    event stream buffer, and then an skb to copy the event stream
    into. This can be done in one go. Also, the current function
    leaks kernel data to userspace in a 4 uninitialised bytes,
    initialise those explicitly. Finally also add a few useful
    comments, as opposed to the current comments.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • This makes wireless extensions netns aware. The
    tasklet sending the events is converted to a work
    struct so that we can rtnl_lock() in it.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • This reverts commit adeab1afb7de89555c69aab5ca21300c14af6369.

    As Alan Cox explained, the TTY layer changes that went recently
    to get rid of the tty->low_latency stuff fixes this already,
    and even for -stable it's the ->low_latency changes that should
    go in to fix this, rather than this patch.

    Signed-off-by: David S. Miller

    David S. Miller
     
  • Use the correct function call for skb_reserve in the comment for
    NET_IP_ALIGN.

    Signed-off-by: Tobias Klauser
    Signed-off-by: David S. Miller

    Tobias Klauser
     
  • spin_unlock_irq() will enable interrupt in net_send_packet(),
    this patch changes it to spin_lock_irqsave/spin_lock_irqrestore,
    so that it doesn't enable interrupts when already disabled,
    and netconsole would work properly over cs89x0/isa-skeleton.

    Call trace:
    netconsole write_msg()
    {
    ...
    -> spin_lock_irqsave();
    -> netpoll_send_udp()
    -> netpoll_send_skb()
    -> net_send_packet()
    ->...

    -> spin_unlock_irqrestore();
    ...
    }

    Signed-off-by: Dongdong Deng
    Signed-off-by: David S. Miller

    Dongdong Deng
     
  • Don't forget to unlock a mutex in phy_scan_fixups on a fail path.

    Signed-off-by: Jiri Slaby
    Signed-off-by: David S. Miller

    Jiri Slaby
     
  • Fixes two bugs:
    - ToS/DiffServ inheritance was unintentionally activated when using impair fixed ToS values
    - ECN bit was lost during ToS/DiffServ inheritance

    Signed-off-by: Andreas Jaggi
    Signed-off-by: David S. Miller

    Andreas Jaggi
     

14 Jul, 2009

3 commits


13 Jul, 2009

3 commits

  • Guido Trentalancia reports:

    I am trying to use the kiss driver in the Linux kernel that is being
    shipped with Fedora 10 but unfortunately I get the following oops:

    mkiss: AX.25 Multikiss, Hans Albas PE1AYX
    mkiss: ax0: crc mode is auto.
    ADDRCONF(NETDEV_CHANGE): ax0: link becomes ready
    ------------[ cut here ]------------
    WARNING: at kernel/softirq.c:77 __local_bh_disable+0x2f/0x83() (Not
    tainted)
    [...]
    unloaded: microcode]
    Pid: 0, comm: swapper Not tainted 2.6.27.25-170.2.72.fc10.i686 #1
    [] warn_on_slowpath+0x65/0x8b
    [] ? _spin_unlock_irqrestore+0x22/0x38
    [] ? __enqueue_entity+0xe3/0xeb
    [] ? enqueue_entity+0x203/0x20b
    [] ? enqueue_task_fair+0x3b/0x3f
    [] ? resched_task+0x3a/0x6e
    [] ? _spin_unlock_irqrestore+0x22/0x38
    [] ? _spin_lock_bh+0xb/0x16
    [] __local_bh_disable+0x2f/0x83
    [] local_bh_disable+0xb/0xd
    [] _spin_lock_bh+0xb/0x16
    [] mkiss_receive_buf+0x2fb/0x3a6 [mkiss]
    [] flush_to_ldisc+0xf7/0x198
    [] tty_flip_buffer_push+0x41/0x51
    [] ftdi_process_read+0x375/0x4ad [ftdi_sio]
    [] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio]
    [] usb_hcd_giveback_urb+0x63/0x93
    [] uhci_giveback_urb+0xe5/0x15f
    [] uhci_scan_schedule+0x52e/0x767
    [] ? psmouse_handle_byte+0xc/0xe5
    [] ? acpi_ev_gpe_detect+0xd6/0xe1
    [] uhci_irq+0x110/0x125
    [] usb_hcd_irq+0x40/0xa3
    [] handle_IRQ_event+0x2f/0x64
    [] handle_level_irq+0x74/0xbe
    [] ? handle_level_irq+0x0/0xbe
    [] do_IRQ+0xc7/0xfe
    [] common_interrupt+0x28/0x30
    [] ? acpi_idle_enter_simple+0x162/0x19d
    [] cpuidle_idle_call+0x60/0x92
    [] cpu_idle+0x101/0x134
    [] rest_init+0x4e/0x50
    =======================
    ---[ end trace b7cc8076093467ad ]---
    ------------[ cut here ]------------
    WARNING: at kernel/softirq.c:136 _local_bh_enable_ip+0x3d/0xc4()
    [...]
    Pid: 0, comm: swapper Tainted: G W 2.6.27.25-170.2.72.fc10.i686
    [] warn_on_slowpath+0x65/0x8b
    [] ? _spin_unlock_irqrestore+0x22/0x38
    [] ? __enqueue_entity+0xe3/0xeb
    [] ? enqueue_entity+0x203/0x20b
    [] ? enqueue_task_fair+0x3b/0x3f
    [] ? resched_task+0x3a/0x6e
    [] ? _spin_unlock_irqrestore+0x22/0x38
    [] ? _spin_lock_bh+0xb/0x16
    [] ? mkiss_receive_buf+0x33d/0x3a6 [mkiss]
    [] _local_bh_enable_ip+0x3d/0xc4
    [] local_bh_enable_ip+0x8/0xa
    [] _spin_unlock_bh+0x11/0x13
    [] mkiss_receive_buf+0x33d/0x3a6 [mkiss]
    [] flush_to_ldisc+0xf7/0x198
    [] tty_flip_buffer_push+0x41/0x51
    [] ftdi_process_read+0x375/0x4ad [ftdi_sio]
    [] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio]
    [] usb_hcd_giveback_urb+0x63/0x93
    [] uhci_giveback_urb+0xe5/0x15f
    [] uhci_scan_schedule+0x52e/0x767
    [] ? psmouse_handle_byte+0xc/0xe5
    [] ? acpi_ev_gpe_detect+0xd6/0xe1
    [] uhci_irq+0x110/0x125
    [] usb_hcd_irq+0x40/0xa3
    [] handle_IRQ_event+0x2f/0x64
    [] handle_level_irq+0x74/0xbe
    [] ? handle_level_irq+0x0/0xbe
    [] do_IRQ+0xc7/0xfe
    [] common_interrupt+0x28/0x30
    [] ? acpi_idle_enter_simple+0x162/0x19d
    [] cpuidle_idle_call+0x60/0x92
    [] cpu_idle+0x101/0x134
    [] rest_init+0x4e/0x50
    =======================
    ---[ end trace b7cc8076093467ad ]---
    mkiss: ax0: Trying crc-smack
    mkiss: ax0: Trying crc-flexnet

    The issue was, that the locking code in mkiss was assuming it was only
    ever being called in process or bh context. Fixed by converting the
    involved locking code to use irq-safe locks.

    Review of other networking line disciplines shows that 6pack, both sync
    and async PPP and STRIP have similar issues. The ppp_async one is the
    most interesting one as it sorts out half of the issue as far back as
    2004 in commit http://git.kernel.org/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=2996d8deaeddd01820691a872550dc0cfba0c37d

    Signed-off-by: Ralf Baechle
    Reported-by: Guido Trentalancia
    Signed-off-by: David S. Miller

    Ralf Baechle
     
  • AD_SHORT_TIMEOUT and AD_STATE_LACP_ACTIVITY have the same value, but
    AD_STATE_LACP_ACTIVITY better reflects the intended semantics.

    [ J adds: AD_STATE_LACP_ACTIVITY is a value defined by the standard, and
    should be set here in accordance with 802.3ad 43.4.12; AD_SHORT_TIMEOUT
    is a constant specific to the Linux 802.3ad implementation that happens
    to have the same value ]

    The semantic match that finds this problem is as follows:
    (http://www.emn.fr/x-info/coccinelle/)

    //
    @@
    struct port_params p;
    @@
    * p.port_state |= AD_SHORT_TIMEOUT
    //

    Signed-off-by: Julia Lawall
    Signed-off-by: Jay Vosburgh
    Signed-off-by: David S. Miller

    Julia Lawall
     
  • Remove duplicated #include('s) in
    include/linux/net_dropmon.h

    Signed-off-by: Huang Weiyi
    Signed-off-by: David S. Miller

    Huang Weiyi