26 Jan, 2009
3 commits
-
Currently encap_oa is left uninitialized, so it contains garbage data which
is visible to userland via Netlink. Initialize it by zeroing it out.Signed-off-by: Timo Teras
Acked-by: Herbert Xu
Signed-off-by: David S. Miller -
802.1Q expanded the maximum ethernet frame size by 4 bytes for the
VLAN tag. We're not taking this into account in virtio_net, which
means the buffers we provide to the backend in the virtqueue RX ring
aren't big enough to hold a full MTU VLAN packet. For QEMU/KVM,
this results in the backend exiting with a packet truncation error.Signed-off-by: Alex Williamson
Acked-by: Mark McLoughlin
Signed-off-by: David S. Miller -
drivers/s390/net/lcs.c: In function 'lcs_new_device':
drivers/s390/net/lcs.c:2179: error: implicit declaration of function 'lcs_set_multicast_list'Reported-by: Kamalesh Babulal
Signed-off-by: Heiko Carstens
Signed-off-by: Ursula Braun
Signed-off-by: David S. Miller
23 Jan, 2009
24 commits
-
There is a race between sctp_rcv() and sctp_accept() where we
have moved the association from the listening socket to the
accepted socket, but sctp_rcv() processing cached the old
socket and continues to use it.The easy solution is to check for the socket mismatch once we've
grabed the socket lock. If we hit a mis-match, that means
that were are currently holding the lock on the listening socket,
but the association is refrencing a newly accepted socket. We need
to drop the lock on the old socket and grab the lock on the new one.A more proper solution might be to create accepted sockets when
the new association is established, similar to TCP. That would
eliminate the race for 1-to-1 style sockets, but it would still
existing for 1-to-many sockets where a user wished to peeloff an
association. For now, we'll live with this easy solution as
it addresses the problem.Reported-by: Michal Hocko
Reported-by: Karsten Keil
Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller -
Recent changes to the retransmit code exposed a long standing
bug where it was possible for a chunk to be time stamped
after the retransmit timer was reset. This caused a rare
situation where the retrnamist timer has expired, but
nothing was marked for retrnasmission because all of
timesamps on data were less then 1 rto ago. As result,
the timer was never restarted since nothing was retransmitted,
and this resulted in a hung association that did couldn't
complete the data transfer. The solution is to timestamp
the chunk when it's added to the packet for transmission
purposes. After the packet is trsnmitted the rtx timer
is restarted. This guarantees that when the timer expires,
there will be data to retransmit.Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller -
Commit 62aeaff5ccd96462b7077046357a6d7886175a57
(sctp: Start T3-RTX timer when fast retransmitting lowest TSN)
introduced a regression where it was possible to forcibly
restart the sctp retransmit timer at the transmission of any
new chunk. This resulted in much longer timeout times and
sometimes hung sctp connections.Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller -
crc32c algorithm provides a byteswaped result. On little-endian
arches, the result ends up in big-endian/network byte order.
On big-endinan arches, the result ends up in little-endian
order and needs to be byte swapped again. Thus calling cpu_to_le32
gives the right output.Tested-by: Jukka Taimisto
Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller -
All supported SMSC PHYs implement the standard "power down" bit 11 of
BMCR, so this patch adds support using the generic genphy_{suspend,resume}
functions.Signed-off-by: Steve Glendinning
Signed-off-by: David S. Miller -
Suspend/resume routines check for phydrv != NULL, but that is
wrong because "phydrv" comes from container_of(drv). If drv is NULL,
then container_of(drv) will return non-NULL result, and the checks
won't work.The Freescale TBI PHYs are driver-less, so "drv" is NULL, and that
leads to the following oops:Unable to handle kernel paging request for data at address 0xffffffe4
Faulting instruction address: 0xc0215554
Oops: Kernel access of bad area, sig: 11 [#1]
[...]
NIP [c0215554] mdio_bus_suspend+0x34/0x70
LR [c01cc508] suspend_device+0x258/0x2bc
Call Trace:
[cfad3da0] [cfad3db8] 0xcfad3db8 (unreliable)
[cfad3db0] [c01cc508] suspend_device+0x258/0x2bc
[cfad3dd0] [c01cc62c] dpm_suspend+0xc0/0x140
[cfad3e20] [c01cc6f4] device_suspend+0x48/0x5c
[cfad3e40] [c0068dd8] suspend_devices_and_enter+0x8c/0x148
[cfad3e60] [c00690f8] enter_state+0x100/0x118
[cfad3e80] [c00691c0] state_store+0xb0/0xe4
[cfad3ea0] [c018c938] kobj_attr_store+0x24/0x3c
[cfad3eb0] [c00ea9a8] flush_write_buffer+0x58/0x7c
[cfad3ed0] [c00eadf0] sysfs_write_file+0x58/0xa0
[cfad3ef0] [c009e810] vfs_write+0xb4/0x16c
[cfad3f10] [c009ed40] sys_write+0x4c/0x90
[cfad3f40] [c0014954] ret_from_syscall+0x0/0x38
[...]This patch fixes the issue, plus removes unneeded parentheses
and fixes indentation level in mdio_bus_suspend().Signed-off-by: Anton Vorontsov
Signed-off-by: David S. Miller -
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
A link change interrupt might be queued and activated after the loopback was set
and it will cause the loopback to fail. The PHY lock should be kept until the
loopback test is over.That implies that the bnx2x_test_link should used within the loopback function
and not bnx2x_wait_for_link since that function also takes the PHY linkSigned-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Waiting for the FW to response requires a memory barrier
Signed-off-by: Michal Kalderon
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
rmmod might hang without this patch since the reference counter is not going
downSigned-off-by: Yitchak Gertner
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Call carrier off should not be called after register_netdev since after
register netdev open can be called at any time followed by an interrupt that
will set it to carrier_on and the probe will resume control and set it to offSigned-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Failures on load were not handled correctly - separate the flow to handle
different failures
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Calling napi disabled unconditionally at netif stop
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
To avoid complications, make sure that the HW is in reset (as it should be)
before trying to take it out of reset. In normal flows, the HW is indeed in rest
so this should have no effectSigned-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
be consistent with mac80211 drivers and return correct return code.
NETDEV_TX_OK is 0, but we need to be consistent wrt formatting amongst
implementationsre: http://marc.info/?l=linux-wireless&m=123119327419865&w=2
Signed-off-by: Reinette Chatre
Reviewed-by: Tomas Winkler
Signed-off-by: John W. Linville -
Giuseppe Cala (The second "a" in "Cala" should be
a grave, U+00E0) reported success on zd1211-devs@lists.sourceforge.net.
The chip info is:
zd1211b chip 0df6:0036 v4810 high 00-0c-f6 AL2230_RF pa0 g--N-The Sitecom WL-603 is detected as a zd1211b with a AL2230 RF transceiver chip.
Signed-off-by: Giuseppe Cala
Signed-off-by: Hin-Tak Leung
Signed-off-by: John W. Linville -
In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
However Artur Skawina has shown that it can happen in reverse order as well.
This is very bad and could lead to memory corruptions, oopses and panics.Thanks to Artur Skawina for reporting and debugging this issue.
Signed-off-by: Christian Lamparter
Tested-by: Artur Skawina
Signed-off-by: John W. Linville -
If we let the firmware do the data encryption, we have to remove the ICV and
(M)MIC at the end of the frame before we can give it back to mac80211.
Or, these data frames have a few trailing bytes on cooked monitor interfaces.Signed-off-by: Christian Lamparter
Signed-off-by: John W. Linville -
This patch fixes a obvious memory leak in the eeprom parser.
Signed-off-by: Christian Lamparter
Signed-off-by: John W. Linville -
KERN_INFO is too "loud" for messages that are generated by the ordinary
events, such as accociation. Use of KERN_DEBUG is consistent with
mac80211.Suggested by Michael Gilbert
Signed-off-by: Pavel Roskin
Signed-off-by: John W. Linville -
Mac80211 provides 2 structures to handle bitrates, namely
ieee80211_rate and ieee80211_tx_rate. To determine the short preamble
mode for an outgoing frame, the flag IEEE80211_TX_RC_USE_SHORT_PREAMBLE
must be checked on ieee80211_tx_rate and not ieee80211_rate (which rt2x00 did).This fixes a regression which was triggered in 2.6.29-rcX as reported by Chris Clayton.
Signed-off-by: Ivo van Doorn
Tested-By: Chris Clayton
Signed-off-by: John W. Linville -
wlan0: switched to short barker preamble (BSSID=00:01:aa:bb:cc:dd)
wlan0: switched to short slot (BSSID=)should be:
wlan0: switched to short barker preamble (BSSID=00:01:aa:bb:cc:dd)
wlan0: switched to short slot (BSSID=00:01:aa:bb:cc:dd)Signed-off-by: Christian Lamparter
Signed-off-by: John W. Linville -
[ 56.923623] BUG: sleeping function called from invalid context at /home/bor/src/linux-git/mm/slub.c:1599
[ 56.923644] in_atomic(): 0, irqs_disabled(): 1, pid: 3031, name: wpa_supplicant
[ 56.923656] 2 locks held by wpa_supplicant/3031:
[ 56.923662] #0: (rtnl_mutex){--..}, at: [] rtnl_lock+0xf/0x20
[ 56.923703] #1: (&priv->lock){++..}, at: [] orinoco_ioctl_set_genie+0x52/0x130 [orinoco]
[ 56.923782] irq event stamp: 910
[ 56.923788] hardirqs last enabled at (909): [] __kmalloc+0x7b/0x140
[ 56.923820] hardirqs last disabled at (910): [] _spin_lock_irqsave+0x19/0x80
[ 56.923847] softirqs last enabled at (880): [] __do_softirq+0xc4/0x110
[ 56.923865] softirqs last disabled at (871): [] do_softirq+0x8e/0xe0
[ 56.923895] Pid: 3031, comm: wpa_supplicant Not tainted 2.6.29-rc2-1avb #1
[ 56.923905] Call Trace:
[ 56.923919] [] ? do_softirq+0x8e/0xe0
[ 56.923941] [] __might_sleep+0xd2/0x100
[ 56.923952] [] __kmalloc+0xd7/0x140
[ 56.923963] [] ? _spin_lock_irqsave+0x6a/0x80
[ 56.923981] [] ? orinoco_ioctl_set_genie+0x79/0x130 [orinoco]
[ 56.923999] [] ? orinoco_ioctl_set_genie+0x52/0x130 [orinoco]
[ 56.924017] [] orinoco_ioctl_set_genie+0x79/0x130 [orinoco]
[ 56.924036] [] ? copy_from_user+0x35/0x130
[ 56.924061] [] ioctl_standard_call+0x196/0x380
[ 56.924085] [] ? __dev_get_by_name+0x85/0xb0
[ 56.924096] [] wext_handle_ioctl+0x14f/0x230
[ 56.924113] [] ? orinoco_ioctl_set_genie+0x0/0x130 [orinoco]
[ 56.924132] [] dev_ioctl+0x495/0x570
[ 56.924155] [] ? sys_sendto+0xa5/0xd0
[ 56.924171] [] ? mark_held_locks+0x48/0x90
[ 56.924183] [] ? sock_ioctl+0x0/0x280
[ 56.924193] [] sock_ioctl+0xfd/0x280
[ 56.924203] [] ? sock_ioctl+0x0/0x280
[ 56.924235] [] vfs_ioctl+0x20/0x80
[ 56.924246] [] do_vfs_ioctl+0x72/0x570
[ 56.924257] [] ? sys_send+0x32/0x40
[ 56.924268] [] ? sys_socketcall+0x1d0/0x2a0
[ 56.924280] [] ? sysenter_exit+0xf/0x16
[ 56.924292] [] sys_ioctl+0x39/0x70
[ 56.924302] [] sysenter_do_call+0x12/0x31Signed-off-by: Andrey Borzenkov
Cc: stable@kernel.org
Signed-off-by: John W. Linville -
After launching mesh discovery in tx path, reference count was not being
decremented. This was preventing module unload.Signed-off-by: Brian Cavagnolo
Signed-off-by: Andrey Yurovsky
Acked-by: Johannes Berg
Signed-off-by: John W. Linville
22 Jan, 2009
3 commits
-
mcs7830_set_reg() and mcs7830_get_reg() are called with buffers
from stack which must not be used directly for USB transfers.
This causes corruption of the stack particulary on non x86
architectures because DMA may be used for these transfers.Signed-off-by: Christian Eggers
Acked-by: Arnd Bergmann
Signed-off-by: David S. Miller -
Improve usbnet's devdbg to always type-check diagnostic arguments,
like dev_dbg (device.h). This makes no change to the resulting size of
usbnet modules.This patch also removes an #ifdef DEBUG directive from rndis_wlan so
it's devdbg statements are always type-checked at compile time.Signed-off-by: Steve Glendinning
Signed-off-by: David Brownell
Signed-off-by: David S. Miller -
Caused by call to request_module() while holding nf_conntrack_lock.
Reported-and-tested-by: Kövesdi György
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller
21 Jan, 2009
8 commits
-
The previous fix to paged packets broke the merging because it
reset the skb->len before we added it to the merged packet. This
wasn't detected because it simply resulted in the truncation of
the packet while the missing bit is subsequently retransmitted.The fix is to store skb->len before we clobber it.
Signed-off-by: Herbert Xu
Signed-off-by: David S. Miller -
When a frag is shorter than an Ethernet header, we'd return a
zeroed packet instead of aborting. This patch fixes that.Signed-off-by: Herbert Xu
Signed-off-by: David S. Miller -
We need to perform skb_postpull_rcsum after pulling the IPv6
header in order to maintain the correctness of the complete
checksum.This patch also adds a missing iph reload after pulling.
Signed-off-by: Herbert Xu
Signed-off-by: David S. Miller -
while(--j >= 0) keeps spinning when j is unsigned:
Signed-off-by: Roel Kluin
Signed-off-by: David S. Miller -
Don't forget to call pci_disable_device() in myri10ge_remove()
and when myri10ge_probe() fails.By the way, update the copyright years.
Signed-off-by: Brice Goglin
Signed-off-by: David S. Miller -
register_pernet_gen_subsys omits mutex_unlock in one fail path.
Fix it.Signed-off-by: Jiri Slaby
Signed-off-by: David S. Miller -
This reverts commit fc8c7dc1b29560c016a67a34ccff32a712b5aa86.
As indicated by Jiri Klimes, this won't work. These numbers are
not only used the size validation, they are also used to locate
attributes sitting after the message.Signed-off-by: David S. Miller
20 Jan, 2009
2 commits
-
Roel Kluin reported a bug in two error paths where skbs were wrongly
being freed using kfree(). He provided a fix where it was replaced to
kfree_skb(), as it should be.However, in i2400mu_rx(), the error path was missing returning an
indication of the failure. Changed to reset rx_skb to NULL and return
it to the caller, i2400mu_rxd(). It will be treated as a transient
error and just ignore the packet.Depending on the buffering conditions inside the device, the data
packet might be dropped or the device will signal the host again for
data-ready-to-read and the host will retry.Signed-off-by: Inaky Perez-Gonzalez
Signed-off-by: David S. Miller -
Contrary to what the docs say, the 'extended interrupt cause' bit in
the interrupt cause register (bit 1) appears to not be maskable on at
least some of the mv643xx_eth platforms, making writing zeroes to the
interrupt mask register but not the extended interrupt mask register
insufficient to stop interrupts from occuring. Therefore, also write
zeroes to the extended interrupt mask register when shutting down the
port.This fixes the interrupt storm seen on the Pegasos board when shutting
down the interface.Signed-off-by: Lennert Buytenhek
Signed-off-by: David S. Miller
