10 Apr, 2007

1 commit


03 Apr, 2007

1 commit


30 Mar, 2007

1 commit

  • The input_device pointer is not refcounted, which means the device may
    disappear while packets are queued, causing a crash when ifb passes packets
    with a stale skb->dev pointer to netif_rx().

    Fix by storing the interface index instead and do a lookup where neccessary.

    Signed-off-by: Patrick McHardy
    Acked-by: Jamal Hadi Salim
    Signed-off-by: David S. Miller

    Patrick McHardy
     

28 Mar, 2007

1 commit

  • During both HTB and HFSC class deletion the class is removed from the
    class hash before calling qdisc_tree_decrease_qlen. This makes the
    ->get operation in qdisc_tree_decrease_qlen fail, so it passes a NULL
    pointer to ->qlen_notify, causing an oops.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

27 Mar, 2007

1 commit


26 Mar, 2007

1 commit


23 Mar, 2007

1 commit

  • Turning up the warnings on gcc makes it emit warnings
    about the placement of 'inline' in function declarations.
    Here's everything that was under net/

    Signed-off-by: Dave Jones
    Signed-off-by: David S. Miller

    Dave Jones
     

15 Feb, 2007

1 commit

  • After Al Viro (finally) succeeded in removing the sched.h #include in module.h
    recently, it makes sense again to remove other superfluous sched.h includes.
    There are quite a lot of files which include it but don't actually need
    anything defined in there. Presumably these includes were once needed for
    macros that used to live in sched.h, but moved to other header files in the
    course of cleaning it up.

    To ease the pain, this time I did not fiddle with any header files and only
    removed #includes from .c-files, which tend to cause less trouble.

    Compile tested against 2.6.20-rc2 and 2.6.20-rc2-mm2 (with offsets) on alpha,
    arm, i386, ia64, mips, powerpc, and x86_64 with allnoconfig, defconfig,
    allmodconfig, and allyesconfig as well as a few randconfigs on x86_64 and all
    configs in arch/arm/configs on arm. I also checked that no new warnings were
    introduced by the patch (actually, some warnings are removed that were emitted
    by unnecessarily included header files).

    Signed-off-by: Tim Schmielau
    Acked-by: Russell King
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Tim Schmielau
     

14 Feb, 2007

1 commit


13 Feb, 2007

1 commit

  • Many struct file_operations in the kernel can be "const". Marking them const
    moves these to the .rodata section, which avoids false sharing with potential
    dirty data. In addition it'll catch accidental writes at compile time to
    these shared resources.

    Signed-off-by: Arjan van de Ven
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Arjan van de Ven
     

11 Feb, 2007

1 commit


09 Feb, 2007

4 commits


02 Feb, 2007

1 commit

  • The x_tables patch broke target module autoloading in the ipt action
    by replacing the ipt_find_target call (which does autoloading) by
    xt_find_target (which doesn't do autoloading). Additionally xt_find_target
    may return ERR_PTR values in case of an error, which are not handled.

    Use xt_request_find_target, which does both autoloading and ERR_PTR
    handling properly. Also don't forget to drop the target module reference
    again when xt_check_target fails.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

09 Dec, 2006

2 commits


07 Dec, 2006

1 commit

  • When the first fw classifier is initialized, there is a small window
    between the ->init() and ->change() calls, during which the classifier
    is active but not entirely set up and tp->root is still NULL (->init()
    does nothing).

    When a packet is queued during this window a NULL pointer dereference
    occurs in fw_classify() when trying to dereference head->mask;

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

03 Dec, 2006

14 commits

  • Not returning -EINVAL, because someone might want to use the value
    zero in some future gact_prob algorithm?

    Signed-off-by: Kim Nordlund
    Signed-off-by: David S. Miller

    Kim Nordlund
     
  • The tc actions increased the size of struct tc_police, which broke
    compatibility with old iproute binaries since both the act_police
    and the old NET_CLS_POLICE code check for an exact size match.

    Since the new members are not even used, the simple fix is to also
    accept the size of the old structure. Dumping is not affected since
    old userspace will receive a bigger structure, which is handled fine.

    Signed-off-by: Patrick McHardy
    Acked-by: Jamal Hadi Salim
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • This patch removes the following unused EXPORT_SYMBOL's:
    - sch_api.c: qdisc_lookup
    - sch_generic.c: __netdev_watchdog_up
    - sch_generic.c: noop_qdisc_ops
    - sch_generic.c: qdisc_alloc

    Signed-off-by: Adrian Bunk
    Signed-off-by: David S. Miller

    Adrian Bunk
     
  • When peeking at the next packet in a child qdisc by calling dequeue/requeue,
    the upper qdisc qlen counter may get out of sync in case the requeue fails.
    The qdisc and the child qdisc both have their counter decremented, but since
    no packet is given to the upper qdisc it won't decrement its counter itself.

    requeue should not fail, so this is mostly for "correctness".

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • Convert HTB to use qdisc_tree_decrease_len() and add a callback
    for deactivating a class when its child queue becomes empty.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • Convert HFSC to use qdisc_tree_decrease_len() and add a callback
    for deactivating a class when its child queue becomes empty.

    All queue purging goes through hfsc_purge_queue(), which is used in
    three cases: grafting, class creation (when a leaf class is turned
    into an intermediate class by attaching a new class) and class
    deletion. In all cases qdisc_tree_decrease_len() is needed.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • Convert the "simple" qdiscs to use qdisc_tree_decrease_qlen() where
    necessary:

    - all graft operations
    - destruction of old child qdiscs in prio, red and tbf change operation
    - purging of queue in sfq change operation

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • There are multiple problems related to qlen adjustment that can lead
    to an upper qdisc getting out of sync with the real number of packets
    queued, leading to endless dequeueing attempts by the upper layer code.

    All qdiscs must maintain an accurate q.qlen counter. There are basically
    two groups of operations affecting the qlen: operations that propagate
    down the tree (enqueue, dequeue, requeue, drop, reset) beginning at the
    root qdisc and operations only affecting a subtree or single qdisc
    (change, graft, delete class). Since qlen changes during operations from
    the second group don't propagate to ancestor qdiscs, their qlen values
    become desynchronized.

    This patch adds a function to propagate qlen changes up the qdisc tree,
    optionally calling a callback function to perform qdisc-internal
    maintenance when the child qdisc becomes empty. The follow-up patches
    will convert all qdiscs to use this function where necessary.

    Noticed by Timo Steinbach .

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • Set parent classids in default qdiscs to allow walking up the tree
    from outside the qdiscs. This is needed by the next patch.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • qlen adjustment should happen immediately in ->delete and not in the
    class destroy function because the reference count will not hit zero in
    ->delete (sch_api holds a reference) but in ->put. Since the qdisc
    lock is released between deletion of the class and final destruction
    this creates an externally visible error in the qlen counter.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • Signed-off-by: Arnaldo Carvalho de Melo

    Arnaldo Carvalho de Melo
     
  • Signed-off-by: Al Viro
    Signed-off-by: David S. Miller

    Al Viro
     
  • Based on patch by Patrick McHardy.

    Add a new option, NET_SCH_FIFO, which provides a simple fifo qdisc
    without requiring CONFIG_NET_SCHED.

    The d80211 stack needs a generic fifo qdisc for WME. At present it
    uses net/d80211/fifo_qdisc.c which is functionally equivalent to
    sch_fifo.c. This patch will allow the d80211 stack to remove
    net/d80211/fifo_qdisc.c and use sch_fifo.c instead.

    Signed-off-by: David Kimdon
    Signed-off-by: David S. Miller

    David Kimdon
     
  • nfmark is being used in various subsystems and has become
    the defacto mark field for all kinds of packets. Therefore
    it makes sense to rename it to `mark' and remove the
    dependency on CONFIG_NETFILTER.

    Signed-off-by: Thomas Graf
    Signed-off-by: David S. Miller

    Thomas Graf
     

08 Nov, 2006

1 commit


01 Nov, 2006

1 commit


23 Oct, 2006

1 commit


12 Oct, 2006

1 commit


04 Oct, 2006

2 commits


29 Sep, 2006

1 commit

  • The move of qdisc destruction to a rcu callback broke locking in the
    entire qdisc layer by invalidating previously valid assumptions about
    the context in which changes to the qdisc tree occur.

    The two assumptions were:

    - since changes only happen in process context, read_lock doesn't need
    bottem half protection. Now invalid since destruction of inner qdiscs,
    classifiers, actions and estimators happens in the RCU callback unless
    they're manually deleted, resulting in dead-locks when read_lock in
    process context is interrupted by write_lock_bh in bottem half context.

    - since changes only happen under the RTNL, no additional locking is
    necessary for data not used during packet processing (f.e. u32_list).
    Again, since destruction now happens in the RCU callback, this assumption
    is not valid anymore, causing races while using this data, which can
    result in corruption or use-after-free.

    Instead of "fixing" this by disabling bottem halfs everywhere and adding
    new locks/refcounting, this patch makes these assumptions valid again by
    moving destruction back to process context. Since only the dev->qdisc
    pointer is protected by RCU, but ->enqueue and the qdisc tree are still
    protected by dev->qdisc_lock, destruction of the tree can be performed
    immediately and only the final free needs to happen in the rcu callback
    to make sure dev_queue_xmit doesn't access already freed memory.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy