13 Oct, 2011
1 commit
-
ip_vs_mutext is used by both netns shutdown code and startup
and both implicit uses sk_lock-AF_INET mutex.cleanup CPU-1 startup CPU-2
ip_vs_dst_event() ip_vs_genl_set_cmd()
sk_lock-AF_INET __ip_vs_mutex
sk_lock-AF_INET
__ip_vs_mutex
* DEAD LOCK *A new mutex placed in ip_vs netns struct called sync_mutex is added.
Comments from Julian and Simon added.
This patch has been running for more than 3 month now and it seems to work.Ver. 3
IP_VS_SO_GET_DAEMON in do_ip_vs_get_ctl protected by sync_mutex
instead of __ip_vs_mutex as sugested by Julian.Signed-off-by: Hans Schillstrom
Acked-by: Julian Anastasov
Signed-off-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
03 Oct, 2011
1 commit
-
GRE connections cause ctnetlink event flood because the ASSURED event
is set for every packet received.Reported-by: Denys Fedoryshchenko
Tested-by: Denys Fedoryshchenko
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
28 Sep, 2011
11 commits
-
If reg_vif_xmit cannot find a routing entry, be sure to
free the skb before returning the error.Signed-off-by: Ben Greear
Signed-off-by: David S. Miller -
return value of dst_alloc must be checked before use
Signed-off-by: Madalin Bucur
Signed-off-by: David S. Miller -
return value of dst_alloc must be checked before use
Signed-off-by: Madalin Bucur
Signed-off-by: David S. Miller -
Have to free the skb before returning if we fail
the fib lookup.Signed-off-by: Ben Greear
Signed-off-by: David S. Miller -
Signed-off-by: Dmitry Kravkov
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Signed-off-by: Dmitry Kravkov
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Use register name to initialize attention mask
Signed-off-by: Dmitry Kravkov
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Signed-off-by: Jason Wang
Signed-off-by: David S. Miller
27 Sep, 2011
3 commits
-
proper dma_unmapping and freeing of skb's has to be done in the rx
cleanup for EDMA chipsets when the device is unloaded and this also
seems to address the following warning which shows up occasionally when
the device is unloadedCall Trace:
[] warn_slowpath_common+0x72/0xa0
[] ? dma_debug_device_change+0x19c/0x200
[] ? dma_debug_device_change+0x19c/0x200
[] warn_slowpath_fmt+0x33/0x40
[] dma_debug_device_change+0x19c/0x200
[] notifier_call_chain+0x82/0xb0
[] __blocking_notifier_call_chain+0x60/0x90
[] blocking_notifier_call_chain+0x1f/0x30
[] __device_release_driver+0xa4/0xc0
[] driver_detach+0x97/0xa0
[] bus_remove_driver+0x6c/0xe0
[] ? sysfs_addrm_finish+0x4b/0x60
[] driver_unregister+0x49/0x80
[] ? sysfs_remove_file+0x14/0x20
[] pci_unregister_driver+0x32/0x80
[] ath_pci_exit+0x12/0x20 [ath9k]
[] ath9k_exit+0x17/0x36 [ath9k]
[] ? mutex_unlock+0xd/0x10
[] sys_delete_module+0x13f/0x200
[] ? sys_munmap+0x4b/0x60
[] ? restore_all+0xf/0xf
[] ? spurious_fault+0xe0/0xe0
[] ? trace_hardirqs_on_caller+0xf4/0x180
[] sysenter_do_call+0x12/0x38
---[ end trace 16e1c1521c06bcf9 ]---
Mapped at:
[] debug_dma_map_page+0x48/0x120
[] ath_rx_init+0x3f8/0x4b0 [ath9k]
[] ath9k_init_device+0x4c4/0x7b0 [ath9k]
[] ath_pci_probe+0x263/0x330 [ath9k]Signed-off-by: Mohammed Shafi Shajakhan
Signed-off-by: John W. Linville -
Driver rtl8192cu assigns a new struct rtl_tcb_desc object, but fails to
clear it.Signed-off-by: Larry Finger
Cc: Stable [2.6.39+]
Signed-off-by: John W. Linville -
If iwl_scan_initiate() fails for any reason,
priv->scan_request and priv->scan_vif are left
dangling. This can lead to a crash later when
iwl_bg_scan_completed() tries to run a pending
scan request.In practice, this seems to be very rare due to
the STATUS_SCANNING check earlier. That check,
however, is wrong -- it should allow a scan to
be queued when a reset/roc scan is going on.
When a normal scan is already going on, a new
one can't be issued by mac80211, so that code
can be removed completely. I introduced this
bug when adding off-channel support in commit
266af4c745952e9bebf687dd68af58df553cb59d.Cc: stable@kernel.org [3.0]
Reported-by: Peng Yan
Signed-off-by: Johannes Berg
Signed-off-by: Wey-Yi Guy
Signed-off-by: John W. Linville
23 Sep, 2011
1 commit
-
corrects a critical bug of the GW feature. This bug made all the unicast
packets destined to a GW to be sent as broadcast. This bug is present even if
the sender GW feature is configured as OFF. It's an urgent bug fix and should
be committed as soon as possible.This was a regression introduced by 43676ab590c3f8686fd047d34c3e33803eef71f0
Signed-off-by: Antonio Quartulli
Signed-off-by: Marek Lindner
22 Sep, 2011
14 commits
-
xz_dec_run() could incorrectly return XZ_BUF_ERROR if all of the
following was true:- The caller knows how many bytes of output to expect and only provides
that much output space.- When the last output bytes are decoded, the caller-provided input
buffer ends right before the LZMA2 end of payload marker. So LZMA2
won't provide more output anymore, but it won't know it yet and thus
won't return XZ_STREAM_END yet.- A BCJ filter is in use and it hasn't left any unfiltered bytes in the
temp buffer. This can happen with any BCJ filter, but in practice
it's more likely with filters other than the x86 BCJ.This fixes where
Squashfs thinks that a valid file system is corrupt.This also fixes a similar bug in single-call mode where the uncompressed
size of a block using BCJ + LZMA2 was 0 bytes and caller provided no
output space. Many empty .xz files don't contain any blocks and thus
don't trigger this bug.This also tweaks a closely related detail: xz_dec_bcj_run() could call
xz_dec_lzma2_run() to decode into temp buffer when it was known to be
useless. This was harmless although it wasted a minuscule number of CPU
cycles.Signed-off-by: Lasse Collin
Cc: stable
Signed-off-by: Linus Torvalds -
* git://github.com/davem330/net: (27 commits)
xfrm: Perform a replay check after return from async codepaths
fib:fix BUG_ON in fib_nl_newrule when add new fib rule
ixgbe: fix possible null buffer error
tg3: fix VLAN tagging regression
net: pxa168: Fix build errors by including interrupt.h
netconsole: switch init_netconsole() to late_initcall
gianfar: Fix overflow check and return value for gfar_get_cls_all()
ppp_generic: fix multilink fragment MTU calculation (again)
GRETH: avoid overwrite IP-stack's IP-frags checksum
GRETH: RX/TX bytes were never increased
ipv6: fix a possible double free
b43: Fix beacon problem in ad-hoc mode
Bluetooth: add support for 2011 mac mini
Bluetooth: Add MacBookAir4,1 support
Bluetooth: Fixed BT ST Channel reg order
r8169: do not enable the TBI for anything but the original 8169.
r8169: remove erroneous processing of always set bit.
r8169: fix WOL setting for 8105 and 8111evl
r8169: add MODULE_FIRMWARE for the firmware of 8111evl
r8169: fix the reset setting for 8111evl
... -
* 'for-linus' of git://git.kernel.dk/linux-block:
floppy: use del_timer_sync() in init cleanup
blk-cgroup: be able to remove the record of unplugged device
block: Don't check QUEUE_FLAG_SAME_COMP in __blk_complete_request
mm: Add comment explaining task state setting in bdi_forker_thread()
mm: Cleanup clearing of BDI_pending bit in bdi_forker_thread()
block: simplify force plug flush code a little bit
block: change force plug flush call order
block: Fix queue_flag update when rq_affinity goes from 2 to 1
block: separate priority boosting from REQ_META
block: remove READ_META and WRITE_META
xen-blkback: fixed indentation and comments
xen-blkback: Don't disconnect backend until state switched to XenbusStateClosed. -
When a malformed loglevel value (for example "${abc}") is passed on the
kernel cmdline, the loglevel itself is being set to 0.That then suppresses all following messages, including all the errors
and crashes caused by other malformed cmdline options. This could make
debugging process quite tricky.This patch leaves the previous value of loglevel if the new value is
incorrect and reports an error code in this case.Signed-off-by: Alexander Sverdlin
Signed-off-by: Linus Torvalds -
This is modeled after the smaps code.
It detects transparent hugepages and then does a single gather_stats()
for the page as a whole. This has two benifits:
1. It is more efficient since it does many pages in a single shot.
2. It does not have to break down the huge page.Signed-off-by: Dave Hansen
Acked-by: Hugh Dickins
Acked-by: David Rientjes
Signed-off-by: Linus Torvalds -
gather_pte_stats() does a number of checks on a target page
to see whether it should even be considered for statistics.
This breaks that code out in to a separate function so that
we can use it in the transparent hugepage case in the next
patch.Signed-off-by: Dave Hansen
Acked-by: Hugh Dickins
Reviewed-by: Christoph Lameter
Acked-by: David Rientjes
Signed-off-by: Linus Torvalds -
We need to teach the numa_maps code about transparent huge pages. The
first step is to teach gather_stats() that the pte it is dealing with
might represent more than one page.Note that will we use this in a moment for transparent huge pages since
they have use a single pmd_t which _acts_ as a "surrogate" for a bunch
of smaller pte_t's.I'm a _bit_ unhappy that this interface counts in hugetlbfs page sizes
for hugetlbfs pages and PAGE_SIZE for normal pages. That means that to
figure out how many _bytes_ "dirty=1" means, you must first know the
hugetlbfs page size. That's easier said than done especially if you
don't have visibility in to the mount.But, that's probably a discussion for another day especially since it
would change behavior to fix it. But, just in case anyone wonders why
this patch only passes a '1' in the hugetlb case...Signed-off-by: Dave Hansen
Acked-by: Hugh Dickins
Acked-by: David Rientjes
Signed-off-by: Linus Torvalds -
Incorrect variable was used in validating the akm_suites array from
NL80211_ATTR_AKM_SUITES. In addition, there was no explicit
validation of the array length (we only have room for
NL80211_MAX_NR_AKM_SUITES).This can result in a buffer write overflow for stack variables with
arbitrary data from user space. The nl80211 commands using the affected
functionality require GENL_ADMIN_PERM, so this is only exposed to admin
users.Cc: stable@kernel.org
Signed-off-by: Jouni Malinen
Signed-off-by: John W. Linville -
iwlegacy version of fix:
commit effd4d9aece9184f526e6556786a94d335e38b71
Author: Johannes Berg
Date: Thu Sep 15 11:46:52 2011 -0700iwlagn: do not use interruptible waits
Since the dawn of its time, iwlwifi has used
interruptible waits to wait for synchronous
commands and firmware loading.This leads to "interesting" bugs, because it
can't actually handle the interruptions; for
example when a command sending is interrupted
it will assume the command completed fully,
and then leave it pending, which leads to all
kinds of trouble when the command finishes
later.Since there's no easy way to gracefully deal
with interruptions, fix the driver to not use
interruptible waits.This at least fixes the error
iwlagn 0000:02:00.0: Error: Response NULL in 'REPLY_SCAN_ABORT_CMD'I have seen in P2P testing, but it is likely
that there are other errors caused by this.Cc: stable@kernel.org # 2.6.39+
Signed-off-by: Stanislaw Gruszka
Signed-off-by: John W. Linville -
iwlegacy version of fix:
commit 282cdb325aea4ebbc42ce753b47cc96145eb54bc
Author: Johannes Berg
Date: Mon Sep 12 12:09:10 2011 -0700iwlagn: fix command queue timeout
If the command queue is constantly busy,
which can happen in P2P, the hangcheck
timer will frequently find a command in
it and will eventually reset the device
because nothing sets the timestamp for
this queue when commands are processed.Fix this by setting the timestamp when
a command completes.iwlegacy does not support P2P, but this patch fix possible
unneeded hardware resets, hence is needed.Cc: stable@kernel.org # 2.6.39+
Signed-off-by: Stanislaw Gruszka
Signed-off-by: John W. Linville -
During the endurance testing, rx frames are not getting DMAd from
MAC whereas pcu rx frame counters are getting updated properly.
As per systems team input updated the initval to fix rx dma stuck
issue.Cc: stable@kernel.org
Signed-off-by: Rajkumar Manoharan
Signed-off-by: John W. Linville -
When asyncronous crypto algorithms are used, there might be many
packets that passed the xfrm replay check, but the replay advance
function is not called yet for these packets. So the replay check
function would accept a replay of all of these packets. Also the
system might crash if there are more packets in async processing
than the size of the anti replay window, because the replay advance
function would try to update the replay window beyond the bounds.This pach adds a second replay check after resuming from the async
processing to fix these issues.Signed-off-by: Steffen Klassert
Acked-by: Herbert Xu
Signed-off-by: David S. Miller -
add new fib rule can cause BUG_ON happen
the reproduce shell is
ip rule add pref 38
ip rule add pref 38
ip rule add to 192.168.3.0/24 goto 38
ip rule del pref 38
ip rule add to 192.168.3.0/24 goto 38
ip rule add pref 38then the BUG_ON will happen
del BUG_ON and use (ctarget == NULL) identify whether this rule is unresolvedSigned-off-by: Gao feng
Signed-off-by: Eric Dumazet
Signed-off-by: David S. Miller
21 Sep, 2011
9 commits
-
When no floppy is found the module code can be released while a timer
function is pending or about to be executed.CPU0 CPU1
floppy_init()
timer_softirq()
spin_lock_irq(&base->lock);
detach_timer();
spin_unlock_irq(&base->lock);
-> Interrupt
del_timer();
return -ENODEV;
module_cleanup();
Signed-off-by: Thomas Gleixner
Cc: Jens Axboe
Cc:
Signed-off-by: Andrew Morton
Signed-off-by: Jens Axboe -
The bug is we're not able to remove the device from blkio cgroup's
per-device control files if it gets unplugged.To reproduce the bug:
# mount -t cgroup -o blkio xxx /cgroup
# cd /cgroup
# echo "8:0 1000" > blkio.throttle.read_bps_device
# unplug the device
# cat blkio.throttle.read_bps_device
8:0 1000
# echo "8:0 0" > blkio.throttle.read_bps_device
-bash: echo: write error: No such deviceAfter patching, the device removal will succeed.
Thanks for the comments of Paul, Zefan, and Vivek.
Signed-off-by: Wanlong Gao
Cc: Li Zefan
Cc: Paul Menage
Acked-by: Vivek Goyal
Cc: Jens Axboe
Cc:
Signed-off-by: Andrew Morton
Signed-off-by: Jens Axboe -
It seems that at least one PPC machine would occasionally give a (valid) 0 as
the return value from dma_map, this caused the ixgbe code to not work
correctly. A fix is pending in the PPC tree to not return 0 from dma map, but
we can also fix the driver to make sure we don't mess up in other arches as
well.This patch is applicable to all current stable kernels.
Ref: https://bugzilla.redhat.com/show_bug.cgi?id=683611
Reported-by: Neil Horman
Signed-off-by: Jesse Brandeburg
CC: Alexander Duyck
CC: stable@kernel.org
Tested-by: Thadeu Lima de Souza Cascardo
Tested-by: Phil Schmitt
Signed-off-by: Jeff Kirsher
Signed-off-by: David S. Miller -
commit 92cd3a17ce9c719abb4c28dee3438e0c641f8de4
tg3: Simplify tx bd assignmentsbroke VLAN tagging on outbound packets.
It ifdef'ed BCM_KERNEL_SUPPORTS_8021Q, but this
is not set anywhere. So vlan never gets set, and
all packets are sent with vlan=0.v2: We can just remove the test. vlan_tx_tag_present
is valid regardless of whether the 802.1q module
is built.Tested on BCM5721 rev 11.
Signed-off-by: Kasper Pedersen
Signed-off-by: David S. Miller -
* 'fixes' of git://git.linaro.org/people/arnd/arm-soc:
mach-integrator: fix VGA base regression
arm/dt: Tegra: Update SDHCI nodes to match bindings
ARM: EXYNOS4: fix incorrect pad configuration for keypad row lines
ARM: SAMSUNG: fix to prevent declaring duplicated
ARM: SAMSUNG: fix watchdog reset issue with clk_get()
ARM: S3C64XX: Remove un-used code backlight code on SMDK6410
ARM: EXYNOS4: restart clocksource while system resumes
ARM: EXYNOS4: Fix routing timer interrupt to offline CPU
ARM: EXYNOS4: Fix return type of local_timer_setup()
ARM: EXYNOS4: Fix wrong pll type for vpll
ARM: Dove: fix second SPI initialization call -
* 'for-linus' of git://github.com/chrismason/linux:
Btrfs: reserve sufficient space for ioctl clone -
After commit c5f5c4db3938 ("staging: zcache: fix crash on high memory
swap") cleancache crashes on the first successful get. This was caused
by a remaining virt_to_page() call in zcache_pampd_get_data_and_free()
that only gets run in the cleancache path.The patch converts the virt_to_page() to struct page casting like was
done for other instances in c5f5c4db3938.Signed-off-by: Seth Jennings
Tested-By: Valdis Kletnieks
Acked-by: Dan Magenheimer
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Linus Torvalds -
The changes introduced in commit
cc22b4c18540e5e8bf55c7d124044f9317527d3c
"ARM: set vga memory base at run-time"Makes the Integrator/AP freeze completely. I appears that
this is due to the VGA base address being assigned at PCI
init time, while this base is needed earlier than that.
Moving the initialization of the base address to the
.map_io function solves this problem.Cc: Rob Herring
Cc: Nicolas Pitre
Cc: Arnd Bergmann
Signed-off-by: Linus Walleij
Acked-by: Rob Herring
Signed-off-by: Arnd Bergmann -
The bindings were recently updated to have separate properties for each
type of GPIO. Update the Device Tree source to match that.Signed-off-by: Stephen Warren
Acked-by: Olof Johansson
Signed-off-by: Arnd Bergmann
