15 Jun, 2009
1 commit
-
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (31 commits)
trivial: remove the trivial patch monkey's name from SubmittingPatches
trivial: Fix a typo in comment of addrconf_dad_start()
trivial: usb: fix missing space typo in doc
trivial: pci hotplug: adding __init/__exit macros to sgi_hotplug
trivial: Remove the hyphen from git commands
trivial: fix ETIMEOUT -> ETIMEDOUT typos
trivial: Kconfig: .ko is normally not included in module names
trivial: SubmittingPatches: fix typo
trivial: Documentation/dell_rbu.txt: fix typos
trivial: Fix Pavel's address in MAINTAINERS
trivial: ftrace:fix description of trace directory
trivial: unnecessary (void*) cast removal in sound/oss/msnd.c
trivial: input/misc: Fix typo in Kconfig
trivial: fix grammo in bus_for_each_dev() kerneldoc
trivial: rbtree.txt: fix rb_entry() parameters in sample code
trivial: spelling fix in ppc code comments
trivial: fix typo in bio_alloc kernel doc
trivial: Documentation/rbtree.txt: cleanup kerneldoc of rbtree.txt
trivial: Miscellaneous documentation typo fixes
trivial: fix typo milisecond/millisecond for documentation and source comments.
...
13 Jun, 2009
3 commits
-
Signed-off-by: Masatake YAMATO
Signed-off-by: Jiri Kosina -
.ko is normally not included in Kconfig help, make it consistent.
Signed-off-by: Pavel Machek
Signed-off-by: Jiri Kosina -
Signed-off-by: Martin Olsson
Signed-off-by: Jiri Kosina
12 Jun, 2009
2 commits
-
This replaces find_vq/del_vq with find_vqs/del_vqs virtio operations,
and updates all drivers. This is needed for MSI support, because MSI
needs to know the total number of vectors upfront.Signed-off-by: Michael S. Tsirkin
Signed-off-by: Rusty Russell (+ lguest/9p compile fixes) -
Add a linked list of all virtqueues for a virtio device: this helps for
debugging and is also needed for upcoming interface change.Also, add a "name" field for clearer debug messages.
Signed-off-by: Rusty Russell
11 Jun, 2009
1 commit
-
* 'tracing-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: (244 commits)
Revert "x86, bts: reenable ptrace branch trace support"
tracing: do not translate event helper macros in print format
ftrace/documentation: fix typo in function grapher name
tracing/events: convert block trace points to TRACE_EVENT(), fix !CONFIG_BLOCK
tracing: add protection around module events unload
tracing: add trace_seq_vprint interface
tracing: fix the block trace points print size
tracing/events: convert block trace points to TRACE_EVENT()
ring-buffer: fix ret in rb_add_time_stamp
ring-buffer: pass in lockdep class key for reader_lock
tracing: add annotation to what type of stack trace is recorded
tracing: fix multiple use of __print_flags and __print_symbolic
tracing/events: fix output format of user stack
tracing/events: fix output format of kernel stack
tracing/trace_stack: fix the number of entries in the header
ring-buffer: discard timestamps that are at the start of the buffer
ring-buffer: try to discard unneeded timestamps
ring-buffer: fix bug in ring_buffer_discard_commit
ftrace: do not profile functions when disabled
tracing: make trace pipe recognize latency format flag
...
09 Jun, 2009
2 commits
-
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
cls_cgroup: Fix oops when user send improperly 'tc filter add' request
r8169: fix crash when large packets are received -
I found a bug in cls_cgroup_change() in cls_cgroup.c.
cls_cgroup_change() expected tca[TCA_OPTIONS] was set from user space properly,
but tc in iproute2-2.6.29-1 (which I used) didn't set it.In the current source code of tc in git, it set tca[TCA_OPTIONS].
git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git
If we always use a newest iproute2 in git when we use cls_cgroup,
we don't face this oops probably.
But I think, kernel shouldn't panic regardless of use program's behaviour.Signed-off-by: Minoru Usui
Signed-off-by: David S. Miller
03 Jun, 2009
1 commit
-
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup
e1000: add missing length check to e1000 receive routine
forcedeth: add phy_power_down parameter, leave phy powered up by default (v2)
Bluetooth: Remove useless flush_work() causing lockdep warnings
02 Jun, 2009
2 commits
-
… when we use cls_cgroup
This patch fixes a bug which unconfigured struct tcf_proto keeps
chaining in tc_ctl_tfilter(), and avoids kernel panic in
cls_cgroup_classify() when we use cls_cgroup.When we execute 'tc filter add', tcf_proto is allocated, initialized
by classifier's init(), and chained. After it's chained,
tc_ctl_tfilter() calls classifier's change(). When classifier's
change() fails, tc_ctl_tfilter() does not free and keeps tcf_proto.In addition, cls_cgroup is initialized in change() not in init(). It
accesses unconfigured struct tcf_proto which is chained before
change(), then hits Oops.Signed-off-by: Minoru Usui <usui@mxm.nes.nec.co.jp>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Tested-by: Minoru Usui <usui@mxm.nes.nec.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
01 Jun, 2009
1 commit
-
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
3c509: Add missing EISA IDs
MAINTAINERS: take maintainership of the cpmac Ethernet driver
net/firmare: Ignore .cis files
ath1e: add new device id for asus hardware
mlx4_en: Fix a kernel panic when waking tx queue
rtl8187: add USB ID for Linksys WUSB54GC-EU v2 USB wifi dongle
at76c50x-usb: avoid mutex deadlock in at76_dwork_hw_scan
mac8390: fix build with NET_POLL_CONTROLLER
cxgb3: link fault fixes
cxgb3: fix dma mapping regression
netfilter: nfnetlink_log: fix wrong skbuff size calculation
netfilter: xt_hashlimit does a wrong SEQ_SKIP
bfin_mac: fix build error due to net_device_ops convert
atlx: move modinfo data from atlx.h to atl1.c
gianfar: fix babbling rx error event bug
cls_cgroup: read classid atomically in classifier
netfilter: nf_ct_dccp: add missing DCCP protocol changes in event cache
netfilter: nf_ct_tcp: fix accepting invalid RST segments
29 May, 2009
1 commit
-
* 'for-2.6.30' of git://linux-nfs.org/~bfields/linux:
svcrdma: dma unmap the correct length for the RPCRDMA header page.
nfsd: Revert "svcrpc: take advantage of tcp autotuning"
nfsd: fix hung up of nfs client while sync write data to nfs server
28 May, 2009
3 commits
-
The svcrdma module was incorrectly unmapping the RPCRDMA header page.
On IBM pserver systems this causes a resource leak that results in
running out of bus address space (10 cthon iterations will reproduce it).
The code was mapping the full page but only unmapping the actual header
length. The fix is to only map the header length.I also cleaned up the use of ib_dma_map_page() calls since the unmap
logic always uses ib_dma_unmap_single(). I made these symmetrical.Signed-off-by: Steve Wise
Signed-off-by: Tom Tucker
Signed-off-by: J. Bruce Fields -
This reverts commit 47a14ef1af48c696b214ac168f056ddc79793d0e "svcrpc:
take advantage of tcp autotuning", which uncovered some further problems
in the server rpc code, causing significant performance regressions in
common cases.We will likely reinstate this patch after releasing 2.6.30 and applying
some work on the underlying fixes to the problem (developed by Trond).Reported-by: Jeff Moyer
Cc: Olga Kornievskaia
Cc: Jim Rees
Cc: Trond Myklebust
Signed-off-by: J. Bruce Fields
27 May, 2009
6 commits
-
This problem was introduced in 72961ecf84d67d6359a1b30f9b2a8427f13e1e71
since no space was reserved for the new attributes NFULA_HWTYPE,
NFULA_HWLEN and NFULA_HWHEADER.Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Patrick McHardy -
The function dl_seq_show() returns 1 (equal to SEQ_SKIP) in case
a seq_printf() call return -1. It should return -1.This SEQ_SKIP behavior brakes processing the proc file e.g. via a
pipe or just through less.Signed-off-by: Jesper Dangaard Brouer
Signed-off-by: Patrick McHardy -
The calls to flush_work() are pointless in a single thread workqueue
and they are actually causing a lockdep warning.=============================================
[ INFO: possible recursive locking detected ]
2.6.30-rc6-02911-gbb803cf #16
---------------------------------------------
bluetooth/2518 is trying to acquire lock:
(bluetooth){+.+.+.}, at: [] flush_work+0x28/0xb0but task is already holding lock:
(bluetooth){+.+.+.}, at: [] worker_thread+0x149/0x25eother info that might help us debug this:
2 locks held by bluetooth/2518:
#0: (bluetooth){+.+.+.}, at: [] worker_thread+0x149/0x25e
#1: (&conn->work_del){+.+...}, at: [] worker_thread+0x149/0x25estack backtrace:
Pid: 2518, comm: bluetooth Not tainted 2.6.30-rc6-02911-gbb803cf #16
Call Trace:
[] ? printk+0xf/0x11
[] __lock_acquire+0x7ce/0xb1b
[] lock_acquire+0x90/0xad
[] ? flush_work+0x28/0xb0
[] flush_work+0x42/0xb0
[] ? flush_work+0x28/0xb0
[] del_conn+0x1c/0x84 [bluetooth]
[] worker_thread+0x18e/0x25e
[] ? worker_thread+0x149/0x25e
[] ? del_conn+0x0/0x84 [bluetooth]
[] ? autoremove_wake_function+0x0/0x33
[] ? worker_thread+0x0/0x25e
[] kthread+0x45/0x6b
[] ? kthread+0x0/0x6b
[] kernel_thread_helper+0x7/0x10Based on a report by Oliver Hartkopp
Signed-off-by: Dave Young
Tested-by: Oliver Hartkopp
Signed-off-by: Marcel Holtmann -
Avoid reading the unsynchronized value cs->classid multiple times,
since it could change concurrently from non-zero to zero; this would
result in the classifier returning a positive result with a bogus
(zero) classid.Signed-off-by: Paul Menage
Reviewed-by: Li Zefan
Signed-off-by: David S. Miller -
* 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:
NFSv4: Fix the case where NFSv4 renewal fails
nfs: fix build error in nfsroot with initconst
XPRTRDMA: fix client rpcrdma FRMR registration on mlx4 devices -
mlx4/connectX FRMR requires local write enable together with remote
rdma write enable. This fixes NFS/RDMA operation over the ConnectX
Infiniband HCA in the default memreg mode.Signed-off-by: Vu Pham
Signed-off-by: Tom Talpey
Signed-off-by: Trond Myklebust
26 May, 2009
1 commit
-
This patch fixes ssthresh accounting issues in tcp_vegas when cwnd decreases
Signed-off-by: Doug Leith
Signed-off-by: David S. Miller
25 May, 2009
2 commits
-
This patch adds the missing protocol state-change event reporting
for DCCP.$ sudo conntrack -E
[NEW] dccp 33 240 src=192.168.0.2 dst=192.168.1.2 sport=57040 dport=5001 [UNREPLIED] src=192.168.1.2 dst=192.168.1.100 sport=5001 dport=57040With this patch:
$ sudo conntrack -E
[NEW] dccp 33 240 REQUEST src=192.168.0.2 dst=192.168.1.2 sport=57040 dport=5001 [UNREPLIED] src=192.168.1.2 dst=192.168.1.100 sport=5001 dport=57040Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Patrick McHardy -
Robert L Mathews discovered that some clients send evil TCP RST segments,
which are accepted by netfilter conntrack but discarded by the
destination. Thus the conntrack entry is destroyed but the destination
retransmits data until timeout.The same technique, i.e. sending properly crafted RST segments, can easily
be used to bypass connlimit/connbytes based restrictions (the sample
script written by Robert can be found in the netfilter mailing list
archives).The patch below adds a new flag and new field to struct ip_ct_tcp_state so
that checking RST segments can be made more strict and thus TCP conntrack
can catch the invalid ones: the RST segment is accepted only if its
sequence number higher than or equal to the highest ack we seen from the
other direction. (The last_ack field cannot be reused because it is used
to catch resent packets.)Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy
22 May, 2009
3 commits
-
rxrpc_alloc_connection() doesn't return an error code on failure, it just
returns NULL. IS_ERR(NULL) is false.Signed-off-by: Dan Carpenter
Signed-off-by: David Howells
Signed-off-by: David S. Miller -
It seems we can fix this by disabling preemption while we re-balance the
trie. This is with the CONFIG_CLASSIC_RCU. It's been stress-tested at high
loads continuesly taking a full BGP table up/down via iproute -batch.Note. fib_trie is not updated for CONFIG_PREEMPT_RCU
Reported-by: Andrei Popa
Signed-off-by: Robert Olsson
Signed-off-by: David S. Miller -
typo -- pkt_dev->nflows is for stats only, the number of concurrent
flows is stored in cflows.Reported-By: Vladimir Ivashchenko
Signed-off-by: Florian Westphal
Signed-off-by: David S. Miller
21 May, 2009
6 commits
-
The use of unspecified protocol in IPv6 initial route prevents quagga to
install IPv6 default route:
# show ipv6 route
S ::/0 [1/0] via fe80::1, eth1_0
K>* ::/0 is directly connected, lo, rej
C>* ::1/128 is directly connected, lo
C>* fe80::/64 is directly connected, eth1_0# ip -6 route
fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440
hoplimit -1
ff00::/8 dev eth1_0 metric 256 mtu 1500 advmss 1440 hoplimit -1
unreachable default dev lo proto none metric -1 error -101 hoplimit 255The attached patch ensures RTPROT_KERNEL to the default initial route
and fixes the problem for quagga.
This is similar to "ipv6: protocol for address routes"
f410a1fba7afa79d2992620e874a343fdba28332.# show ipv6 route
S>* ::/0 [1/0] via fe80::1, eth1_0
C>* ::1/128 is directly connected, lo
C>* fe80::/64 is directly connected, eth1_0# ip -6 route
fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440
hoplimit -1
fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440
hoplimit -1
ff00::/8 dev eth1_0 metric 256 mtu 1500 advmss 1440 hoplimit -1
default via fe80::1 dev eth1_0 proto zebra metric 1024 mtu 1500
advmss 1440 hoplimit -1
unreachable default dev lo proto kernel metric -1 error -101 hoplimit 255Signed-off-by: Jean-Mickael Guerin
Signed-off-by: Stephen Hemminger
Signed-off-by: David S. Miller -
Alexander V. Lukyanov found a regression in 2.6.29 and made a complete
analysis found in http://bugzilla.kernel.org/show_bug.cgi?id=13339
Quoted here because its a perfect one :begin_of_quotation
2.6.29 patch has introduced flexible route cache rebuilding. Unfortunately the
patch has at least one critical flaw, and another problem.rt_intern_hash calculates rthi pointer, which is later used for new entry
insertion. The same loop calculates cand pointer which is used to clean the
list. If the pointers are the same, rtable leak occurs, as first the cand is
removed then the new entry is appended to it.This leak leads to unregister_netdevice problem (usage count > 0).
Another problem of the patch is that it tries to insert the entries in certain
order, to facilitate counting of entries distinct by all but QoS parameters.
Unfortunately, referencing an existing rtable entry moves it to list beginning,
to speed up further lookups, so the carefully built order is destroyed.For the first problem the simplest patch it to set rthi=0 when rthi==cand, but
it will also destroy the ordering.
end_of_quotationProblematic commit is 1080d709fb9d8cd4392f93476ee46a9d6ea05a5b
(net: implement emergency route cache rebulds when gc_elasticity is exceeded)Trying to keep dst_entries ordered is too complex and breaks the fact that
order should depend on the frequency of use for garbage collection.A possible fix is to make rt_intern_hash() simpler, and only makes
rt_check_expire() a litle bit smarter, being able to cope with an arbitrary
entries order. The added loop is running on cache hot data, while cpu
is prefetching next object, so should be unnoticied.Reported-and-analyzed-by: Alexander V. Lukyanov
Signed-off-by: Eric Dumazet
Acked-by: Neil Horman
Signed-off-by: David S. Miller -
rt_check_expire() computes average and standard deviation of chain lengths,
but not correclty reset length to 0 at beginning of each chain.
This probably gives overflows for sum2 (and sum) on loaded machines instead
of meaningful results.Signed-off-by: Eric Dumazet
Acked-by: Neil Horman
Signed-off-by: David S. Miller -
Its possible for cfg80211 to have scheduled the work and for
the global workqueue to not have kicked in prior to a cfg80211
driver's regulatory hint or wiphy_apply_custom_regulatory().Although this is very unlikely its possible and should fix
this race. When this race would happen you are expected to have
hit a null pointer dereference panic.Cc: stable@kernel.org
Signed-off-by: Luis R. Rodriguez
Tested-by: Alan Jenkins
Signed-off-by: John W. Linville -
Another design flaw in wireless extensions (is anybody
surprised?) in the way it handles the iw_encode_ext
structure: The structure is part of the 'extra' memory
but contains the key length explicitly, instead of it
just being the length of the extra buffer - size of
the struct and using the explicit key length only for
the get operation (which only writes it).Therefore, we have this layout:
extra: +-------------------------+
| struct iw_encode_ext { |
| ... |
| u16 key_len; |
| u8 key[0]; |
| }; |
+-------------------------+
| key material |
+-------------------------+Now, all drivers I checked use ext->key_len without
checking that both key_len and the struct fit into the
extra buffer that has been copied from userspace. This
leads to a buffer overrun while reading that buffer,
depending on the driver it may be possible to specify
arbitrary key_len or it may need to be a proper length
for the key algorithm specified.Thankfully, this is only exploitable by root, but root
can actually cause a segfault or use kernel memory as
a key (which you can even get back with siocgiwencode
or siocgiwencodeext from the key buffer).Fix this by verifying that key_len fits into the buffer
along with struct iw_encode_ext.Signed-off-by: Johannes Berg
Signed-off-by: John W. Linville
19 May, 2009
5 commits
-
Commit e81963b1 ("ipv4: Make INET_LRO a bool instead of tristate.")
changed this config from tristate to bool. Add default so that it is
consistent with the help text.Signed-off-by: Frans Pop
Signed-off-by: David S. Miller -
When called with a consumed value that is less than skb_headlen(skb)
bytes into a page frag, skb_seq_read() incorrectly returns an
offset/length relative to skb->data. Ensure that data which should come
from a page frag does.Signed-off-by: Thomas Chenault
Tested-by: Shyam Iyer
Signed-off-by: David S. Miller -
gen_estimator can overflow bps (bytes per second) with Gb links, while
it was designed with a u32 API, with a theorical limit of 34360Mbit
(2^32 bytes)Using 64 bit intermediate avbps/brate counters can allow us to reach
this theorical limit.Signed-off-by: Eric Dumazet
Signed-off-by: Jarek Poplawski
Signed-off-by: David S. Miller -
It is illegal to dereference a skb after a successful ndo_start_xmit()
call. We must store skb length in a local variable instead.Bug was introduced in 2.6.27 by commit 0abf77e55a2459aa9905be4b226e4729d5b4f0cb
(net_sched: Add accessor function for packet length for qdiscs)Signed-off-by: Eric Dumazet
Signed-off-by: David S. Miller -
Commit 518a09ef11 (tcp: Fix recvmsg MSG_PEEK influence of
blocking behavior) lets the loop run longer than the race check
did previously expect, so we need to be more careful with this
check and consider the work we have been doing.I tried my best to deal with urg hole madness too which happens
here:
if (!sock_flag(sk, SOCK_URGINLINE)) {
++*seq;
...
by using additional offset by one but I certainly have very
little interest in testing that part.Signed-off-by: Ilpo Järvinen
Tested-by: Frans Pop
Tested-by: Ian Zimmermann
Signed-off-by: David S. Miller
