From 70e90679ffce0937deb77e2bd8bd918a24a897fd Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Thu, 6 Nov 2008 23:08:37 -0800 Subject: af_key: mark policy as dead before destroying xfrm_policy_destroy() will oops if not dead policy is passed to it. On error path in pfkey_compile_policy() exactly this happens. Oopsable for CAP_NET_ADMIN owners. Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller diff --git a/net/key/af_key.c b/net/key/af_key.c index 3440a46..5b22e01 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -3188,6 +3188,7 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt, return xp; out: + xp->walk.dead = 1; xfrm_policy_destroy(xp); return NULL; } -- cgit v0.10.2 From c1adbb9681c30e984272b66623c4d5774b3981e1 Mon Sep 17 00:00:00 2001 From: Yevgeny Petrilin Date: Wed, 5 Nov 2008 16:53:50 +0200 Subject: mlx4_en: Start port error flow bug fix Tried to deactivate rx ring that wasn't activated, used wrong index. Signed-off-by: Yevgeny Petrilin Signed-off-by: Jeff Garzik diff --git a/drivers/net/mlx4/en_netdev.c b/drivers/net/mlx4/en_netdev.c index a339afb..a3f7324 100644 --- a/drivers/net/mlx4/en_netdev.c +++ b/drivers/net/mlx4/en_netdev.c @@ -706,7 +706,7 @@ tx_err: mlx4_en_release_rss_steer(priv); rx_err: for (i = 0; i < priv->rx_ring_num; i++) - mlx4_en_deactivate_rx_ring(priv, &priv->rx_ring[rx_index]); + mlx4_en_deactivate_rx_ring(priv, &priv->rx_ring[i]); cq_err: while (rx_index--) mlx4_en_deactivate_cq(priv, &priv->rx_cq[rx_index]); -- cgit v0.10.2 From db053c6b447d083f3c63e5540b70a3e521b468ca Mon Sep 17 00:00:00 2001 From: Paulius Zaleckas Date: Tue, 4 Nov 2008 13:32:31 +0200 Subject: hso: rfkill type should be WWAN Signed-off-by: Paulius Zaleckas Cc: Denis Joseph Barrow Signed-off-by: Jeff Garzik diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index 1164c52..3f49e83 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -2188,7 +2188,7 @@ static void hso_create_rfkill(struct hso_device *hso_dev, char *rfkn; hso_net->rfkill = rfkill_allocate(&interface_to_usbdev(interface)->dev, - RFKILL_TYPE_WLAN); + RFKILL_TYPE_WWAN); if (!hso_net->rfkill) { dev_err(dev, "%s - Out of memory", __func__); return; -- cgit v0.10.2 From 08809b25cf64a7d8deb336b779e527e88830eac9 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 1 Nov 2008 18:20:19 +0000 Subject: el3_common_init() should be __devinit, not __init Signed-off-by: Al Viro Signed-off-by: Jeff Garzik diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c index 3a7bc52..c7a4f3b 100644 --- a/drivers/net/3c509.c +++ b/drivers/net/3c509.c @@ -94,7 +94,7 @@ #include #include -static char version[] __initdata = DRV_NAME ".c:" DRV_VERSION " " DRV_RELDATE " becker@scyld.com\n"; +static char version[] __devinitdata = DRV_NAME ".c:" DRV_VERSION " " DRV_RELDATE " becker@scyld.com\n"; #ifdef EL3_DEBUG static int el3_debug = EL3_DEBUG; @@ -186,7 +186,7 @@ static int max_interrupt_work = 10; static int nopnp; #endif -static int __init el3_common_init(struct net_device *dev); +static int __devinit el3_common_init(struct net_device *dev); static void el3_common_remove(struct net_device *dev); static ushort id_read_eeprom(int index); static ushort read_eeprom(int ioaddr, int index); @@ -537,7 +537,7 @@ static struct mca_driver el3_mca_driver = { static int mca_registered; #endif /* CONFIG_MCA */ -static int __init el3_common_init(struct net_device *dev) +static int __devinit el3_common_init(struct net_device *dev) { struct el3_private *lp = netdev_priv(dev); int err; -- cgit v0.10.2 From cd17fa7b8f1dd24b23c464ebcb14e7c058e15097 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Mon, 3 Nov 2008 23:08:04 +0000 Subject: sfc: Correct address of gPXE boot configuration in EEPROM Due to a hardware bug, the originally assigned range cannot reliably be used for boot configuration and must not be modifiable through ethtool. Signed-off-by: Ben Hutchings Signed-off-by: Jeff Garzik diff --git a/drivers/net/sfc/ethtool.c b/drivers/net/sfc/ethtool.c index fa98af5..cd0d087 100644 --- a/drivers/net/sfc/ethtool.c +++ b/drivers/net/sfc/ethtool.c @@ -174,8 +174,8 @@ static struct efx_ethtool_stat efx_ethtool_stats[] = { /* EEPROM range with gPXE configuration */ #define EFX_ETHTOOL_EEPROM_MAGIC 0xEFAB -#define EFX_ETHTOOL_EEPROM_MIN 0x100U -#define EFX_ETHTOOL_EEPROM_MAX 0x400U +#define EFX_ETHTOOL_EEPROM_MIN 0x800U +#define EFX_ETHTOOL_EEPROM_MAX 0x1800U /************************************************************************** * -- cgit v0.10.2 From 939a9516416ad8ccec27aa05bd19236c550c0c03 Mon Sep 17 00:00:00 2001 From: Jonathan McDowell Date: Tue, 4 Nov 2008 07:51:38 +0000 Subject: [netdrvr] usb/hso: Cleanup rfkill error handling Yup, this appears to be the problem, thanks. I think &hso_net->net->dev is more intuitive for the error message, so I've used that. I've also added missing line endings on the error messages and set our local rfkill structure element to NULL on failure so we don't try to call rfkill_unregister on driver removal if we failed to register at all. The patch below Works For Me (TM); the device is detected fine, can be removed without problems and connects ok. I'll have a prod at why the rfkill stuff isn't working next, but I believe this cleanup of the error handling is appropriate no matter what the issue with registration is. Signed-Off-By: Jonathan McDowell Signed-off-by: Jeff Garzik diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index 3f49e83..8e90891 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -2184,19 +2184,20 @@ static void hso_create_rfkill(struct hso_device *hso_dev, struct usb_interface *interface) { struct hso_net *hso_net = dev2net(hso_dev); - struct device *dev = hso_dev->dev; + struct device *dev = &hso_net->net->dev; char *rfkn; hso_net->rfkill = rfkill_allocate(&interface_to_usbdev(interface)->dev, RFKILL_TYPE_WWAN); if (!hso_net->rfkill) { - dev_err(dev, "%s - Out of memory", __func__); + dev_err(dev, "%s - Out of memory\n", __func__); return; } rfkn = kzalloc(20, GFP_KERNEL); if (!rfkn) { rfkill_free(hso_net->rfkill); - dev_err(dev, "%s - Out of memory", __func__); + hso_net->rfkill = NULL; + dev_err(dev, "%s - Out of memory\n", __func__); return; } snprintf(rfkn, 20, "hso-%d", @@ -2209,7 +2210,8 @@ static void hso_create_rfkill(struct hso_device *hso_dev, kfree(rfkn); hso_net->rfkill->name = NULL; rfkill_free(hso_net->rfkill); - dev_err(dev, "%s - Failed to register rfkill", __func__); + hso_net->rfkill = NULL; + dev_err(dev, "%s - Failed to register rfkill\n", __func__); return; } } -- cgit v0.10.2 From 309f796f301bf1c2731d9b9eb8642c76b523ebf7 Mon Sep 17 00:00:00 2001 From: Ferenc Wagner Date: Mon, 10 Nov 2008 13:37:40 -0800 Subject: vlan: Fix typos in proc output string Signed-off-by: Ferenc Wagner Signed-off-by: David S. Miller diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c index 0feefa4..3628e0a 100644 --- a/net/8021q/vlanproc.c +++ b/net/8021q/vlanproc.c @@ -314,7 +314,7 @@ static int vlandev_seq_show(struct seq_file *seq, void *offset) dev_info->ingress_priority_map[6], dev_info->ingress_priority_map[7]); - seq_printf(seq, "EGRESSS priority Mappings: "); + seq_printf(seq, " EGRESS priority mappings: "); for (i = 0; i < 16; i++) { const struct vlan_priority_tci_mapping *mp = dev_info->egress_priority_map[i]; -- cgit v0.10.2 From 9581483444d002e0b3807d9e66f552f372a6fc5e Mon Sep 17 00:00:00 2001 From: Mike Frysinger Date: Thu, 6 Nov 2008 01:37:00 +0000 Subject: SSB: hide empty sub menu If the target system cannot support SSB, then don't show the menu option as it'll simply be an empty submenu. Signed-off-by: Mike Frysinger Signed-off-by: David S. Miller diff --git a/drivers/ssb/Kconfig b/drivers/ssb/Kconfig index 307b1f6..b1b947e 100644 --- a/drivers/ssb/Kconfig +++ b/drivers/ssb/Kconfig @@ -1,10 +1,11 @@ -menu "Sonics Silicon Backplane" - config SSB_POSSIBLE bool depends on HAS_IOMEM && HAS_DMA default y +menu "Sonics Silicon Backplane" + depends on SSB_POSSIBLE + config SSB tristate "Sonics Silicon Backplane support" depends on SSB_POSSIBLE -- cgit v0.10.2 From fd0fcf5c29dd0339c5f5d86eb2cbe9fdad5bcd73 Mon Sep 17 00:00:00 2001 From: Michael Buesch Date: Thu, 6 Nov 2008 10:49:21 +0000 Subject: ssb: Fix DMA-API compilation for non-PCI systems This fixes compilation of the SSB DMA-API code on non-PCI platforms. Signed-off-by: Michael Buesch Signed-off-by: David S. Miller diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h index e530026..17d9b58 100644 --- a/include/linux/ssb/ssb.h +++ b/include/linux/ssb/ssb.h @@ -427,12 +427,16 @@ static inline int ssb_dma_mapping_error(struct ssb_device *dev, dma_addr_t addr) { switch (dev->bus->bustype) { case SSB_BUSTYPE_PCI: +#ifdef CONFIG_SSB_PCIHOST return pci_dma_mapping_error(dev->bus->host_pci, addr); +#endif + break; case SSB_BUSTYPE_SSB: return dma_mapping_error(dev->dev, addr); default: - __ssb_dma_not_implemented(dev); + break; } + __ssb_dma_not_implemented(dev); return -ENOSYS; } @@ -441,12 +445,16 @@ static inline dma_addr_t ssb_dma_map_single(struct ssb_device *dev, void *p, { switch (dev->bus->bustype) { case SSB_BUSTYPE_PCI: +#ifdef CONFIG_SSB_PCIHOST return pci_map_single(dev->bus->host_pci, p, size, dir); +#endif + break; case SSB_BUSTYPE_SSB: return dma_map_single(dev->dev, p, size, dir); default: - __ssb_dma_not_implemented(dev); + break; } + __ssb_dma_not_implemented(dev); return 0; } @@ -455,14 +463,18 @@ static inline void ssb_dma_unmap_single(struct ssb_device *dev, dma_addr_t dma_a { switch (dev->bus->bustype) { case SSB_BUSTYPE_PCI: +#ifdef CONFIG_SSB_PCIHOST pci_unmap_single(dev->bus->host_pci, dma_addr, size, dir); return; +#endif + break; case SSB_BUSTYPE_SSB: dma_unmap_single(dev->dev, dma_addr, size, dir); return; default: - __ssb_dma_not_implemented(dev); + break; } + __ssb_dma_not_implemented(dev); } static inline void ssb_dma_sync_single_for_cpu(struct ssb_device *dev, @@ -472,15 +484,19 @@ static inline void ssb_dma_sync_single_for_cpu(struct ssb_device *dev, { switch (dev->bus->bustype) { case SSB_BUSTYPE_PCI: +#ifdef CONFIG_SSB_PCIHOST pci_dma_sync_single_for_cpu(dev->bus->host_pci, dma_addr, size, dir); return; +#endif + break; case SSB_BUSTYPE_SSB: dma_sync_single_for_cpu(dev->dev, dma_addr, size, dir); return; default: - __ssb_dma_not_implemented(dev); + break; } + __ssb_dma_not_implemented(dev); } static inline void ssb_dma_sync_single_for_device(struct ssb_device *dev, @@ -490,15 +506,19 @@ static inline void ssb_dma_sync_single_for_device(struct ssb_device *dev, { switch (dev->bus->bustype) { case SSB_BUSTYPE_PCI: +#ifdef CONFIG_SSB_PCIHOST pci_dma_sync_single_for_device(dev->bus->host_pci, dma_addr, size, dir); return; +#endif + break; case SSB_BUSTYPE_SSB: dma_sync_single_for_device(dev->dev, dma_addr, size, dir); return; default: - __ssb_dma_not_implemented(dev); + break; } + __ssb_dma_not_implemented(dev); } static inline void ssb_dma_sync_single_range_for_cpu(struct ssb_device *dev, @@ -509,17 +529,21 @@ static inline void ssb_dma_sync_single_range_for_cpu(struct ssb_device *dev, { switch (dev->bus->bustype) { case SSB_BUSTYPE_PCI: +#ifdef CONFIG_SSB_PCIHOST /* Just sync everything. That's all the PCI API can do. */ pci_dma_sync_single_for_cpu(dev->bus->host_pci, dma_addr, offset + size, dir); return; +#endif + break; case SSB_BUSTYPE_SSB: dma_sync_single_range_for_cpu(dev->dev, dma_addr, offset, size, dir); return; default: - __ssb_dma_not_implemented(dev); + break; } + __ssb_dma_not_implemented(dev); } static inline void ssb_dma_sync_single_range_for_device(struct ssb_device *dev, @@ -530,17 +554,21 @@ static inline void ssb_dma_sync_single_range_for_device(struct ssb_device *dev, { switch (dev->bus->bustype) { case SSB_BUSTYPE_PCI: +#ifdef CONFIG_SSB_PCIHOST /* Just sync everything. That's all the PCI API can do. */ pci_dma_sync_single_for_device(dev->bus->host_pci, dma_addr, offset + size, dir); return; +#endif + break; case SSB_BUSTYPE_SSB: dma_sync_single_range_for_device(dev->dev, dma_addr, offset, size, dir); return; default: - __ssb_dma_not_implemented(dev); + break; } + __ssb_dma_not_implemented(dev); } -- cgit v0.10.2 From c3d4f44f50b65b0b0290e357f8739cfb3f4bcaca Mon Sep 17 00:00:00 2001 From: Maciej Sosnowski Date: Fri, 7 Nov 2008 01:45:52 +0000 Subject: [1/4] I/OAT: fix channel resources free for not allocated channels If the ioatdma driver is loaded but not used it does not allocate descriptors. Before it frees channel resources it should first be sure that they have been previously allocated. Cc: Signed-off-by: Maciej Sosnowski Tested-by: Tom Picard Signed-off-by: Dan Williams Signed-off-by: David S. Miller diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c index b0438c4..dbb8bbb 100644 --- a/drivers/dma/ioat_dma.c +++ b/drivers/dma/ioat_dma.c @@ -807,6 +807,12 @@ static void ioat_dma_free_chan_resources(struct dma_chan *chan) struct ioat_desc_sw *desc, *_desc; int in_use_descs = 0; + /* Before freeing channel resources first check + * if they have been previously allocated for this channel. + */ + if (ioat_chan->desccount == 0) + return; + tasklet_disable(&ioat_chan->cleanup_task); ioat_dma_memcpy_cleanup(ioat_chan); @@ -869,6 +875,7 @@ static void ioat_dma_free_chan_resources(struct dma_chan *chan) ioat_chan->last_completion = ioat_chan->completion_addr = 0; ioat_chan->pending = 0; ioat_chan->dmacount = 0; + ioat_chan->desccount = 0; ioat_chan->watchdog_completion = 0; ioat_chan->last_compl_desc_addr_hw = 0; ioat_chan->watchdog_tcp_cookie = -- cgit v0.10.2 From c2c0b4c5434c0a25f7f7796b29155d53805909f5 Mon Sep 17 00:00:00 2001 From: Maciej Sosnowski Date: Fri, 7 Nov 2008 01:46:33 +0000 Subject: [2/4] I/OAT: fix dma_pin_iovec_pages() error handling Error handling needs to be modified in dma_pin_iovec_pages(). It should return NULL instead of ERR_PTR (pinned_list is checked for NULL in tcp_recvmsg() to determine if iovec pages have been successfully pinned down). In case of error for the first iovec, local_list->nr_iovecs needs to be initialized. Cc: Signed-off-by: Maciej Sosnowski Signed-off-by: David S. Miller diff --git a/drivers/dma/iovlock.c b/drivers/dma/iovlock.c index e763d72..9f6fe46 100644 --- a/drivers/dma/iovlock.c +++ b/drivers/dma/iovlock.c @@ -55,7 +55,6 @@ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len) int nr_iovecs = 0; int iovec_len_used = 0; int iovec_pages_used = 0; - long err; /* don't pin down non-user-based iovecs */ if (segment_eq(get_fs(), KERNEL_DS)) @@ -72,23 +71,21 @@ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len) local_list = kmalloc(sizeof(*local_list) + (nr_iovecs * sizeof (struct dma_page_list)) + (iovec_pages_used * sizeof (struct page*)), GFP_KERNEL); - if (!local_list) { - err = -ENOMEM; + if (!local_list) goto out; - } /* list of pages starts right after the page list array */ pages = (struct page **) &local_list->page_list[nr_iovecs]; + local_list->nr_iovecs = 0; + for (i = 0; i < nr_iovecs; i++) { struct dma_page_list *page_list = &local_list->page_list[i]; len -= iov[i].iov_len; - if (!access_ok(VERIFY_WRITE, iov[i].iov_base, iov[i].iov_len)) { - err = -EFAULT; + if (!access_ok(VERIFY_WRITE, iov[i].iov_base, iov[i].iov_len)) goto unpin; - } page_list->nr_pages = num_pages_spanned(&iov[i]); page_list->base_address = iov[i].iov_base; @@ -109,10 +106,8 @@ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len) NULL); up_read(¤t->mm->mmap_sem); - if (ret != page_list->nr_pages) { - err = -ENOMEM; + if (ret != page_list->nr_pages) goto unpin; - } local_list->nr_iovecs = i + 1; } @@ -122,7 +117,7 @@ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len) unpin: dma_unpin_iovec_pages(local_list); out: - return ERR_PTR(err); + return NULL; } void dma_unpin_iovec_pages(struct dma_pinned_list *pinned_list) -- cgit v0.10.2 From 12ccea24e309d815d058cdc6ee8bf2c4b85f0c5f Mon Sep 17 00:00:00 2001 From: Maciej Sosnowski Date: Fri, 7 Nov 2008 01:46:55 +0000 Subject: [3/4] I/OAT: fix async_tx.callback checking async_tx.callback should be checked for the first not the last descriptor in the chain. Cc: Signed-off-by: Maciej Sosnowski Signed-off-by: David S. Miller diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c index dbb8bbb..ecd743f 100644 --- a/drivers/dma/ioat_dma.c +++ b/drivers/dma/ioat_dma.c @@ -525,7 +525,7 @@ static dma_cookie_t ioat1_tx_submit(struct dma_async_tx_descriptor *tx) } hw->ctl = IOAT_DMA_DESCRIPTOR_CTL_CP_STS; - if (new->async_tx.callback) { + if (first->async_tx.callback) { hw->ctl |= IOAT_DMA_DESCRIPTOR_CTL_INT_GN; if (first != new) { /* move callback into to last desc */ @@ -617,7 +617,7 @@ static dma_cookie_t ioat2_tx_submit(struct dma_async_tx_descriptor *tx) } hw->ctl |= IOAT_DMA_DESCRIPTOR_CTL_CP_STS; - if (new->async_tx.callback) { + if (first->async_tx.callback) { hw->ctl |= IOAT_DMA_DESCRIPTOR_CTL_INT_GN; if (first != new) { /* move callback into to last desc */ -- cgit v0.10.2 From 1207e795568a368928dfd23d6817e47f2e8097e3 Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Fri, 7 Nov 2008 01:47:17 +0000 Subject: [4/4] dca: fixup initialization dependency Mark dca_init as a subsys_initcall since it needs to be ready to go before dependent drivers start registering themselves. Cc: Reported-and-tested-by: Mark Rustad Acked-by: Maciej Sosnowski Signed-off-by: Dan Williams Signed-off-by: David S. Miller diff --git a/drivers/dca/dca-core.c b/drivers/dca/dca-core.c index ec249d2..d883e1b 100644 --- a/drivers/dca/dca-core.c +++ b/drivers/dca/dca-core.c @@ -270,6 +270,6 @@ static void __exit dca_exit(void) dca_sysfs_exit(); } -module_init(dca_init); +subsys_initcall(dca_init); module_exit(dca_exit); -- cgit v0.10.2 From 87b30a6530218cde431a659f2c118cb72175507c Mon Sep 17 00:00:00 2001 From: Benjamin Thery Date: Mon, 10 Nov 2008 16:34:11 -0800 Subject: ipv6: fix ip6_mr_init error path The order of cleanup operations in the error/exit section of ip6_mr_init() is completely inversed. It should be the other way around. Also a del_timer() is missing in the error path. Signed-off-by: Benjamin Thery Signed-off-by: David S. Miller diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c index 182f8a1..52a7eb0 100644 --- a/net/ipv6/ip6mr.c +++ b/net/ipv6/ip6mr.c @@ -981,14 +981,15 @@ int __init ip6_mr_init(void) goto proc_cache_fail; #endif return 0; -reg_notif_fail: - kmem_cache_destroy(mrt_cachep); #ifdef CONFIG_PROC_FS -proc_vif_fail: - unregister_netdevice_notifier(&ip6_mr_notifier); proc_cache_fail: proc_net_remove(&init_net, "ip6_mr_vif"); +proc_vif_fail: + unregister_netdevice_notifier(&ip6_mr_notifier); #endif +reg_notif_fail: + del_timer(&ipmr_expire_timer); + kmem_cache_destroy(mrt_cachep); return err; } -- cgit v0.10.2 From b7b45f47d6f8c83a0f958d7e2924468b6942dd9e Mon Sep 17 00:00:00 2001 From: Harvey Harrison Date: Mon, 10 Nov 2008 16:46:06 -0800 Subject: netfilter: payload_len is be16, add size of struct rather than size of pointer payload_len is a be16 value, not cpu_endian, also the size of a ponter to a struct ipv6hdr was being added, not the size of the struct itself. Signed-off-by: Harvey Harrison Signed-off-by: David S. Miller diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c index 02ddc2b..e90d52f 100644 --- a/net/netfilter/ipvs/ip_vs_xmit.c +++ b/net/netfilter/ipvs/ip_vs_xmit.c @@ -713,7 +713,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, iph = ipv6_hdr(skb); iph->version = 6; iph->nexthdr = IPPROTO_IPV6; - iph->payload_len = old_iph->payload_len + sizeof(old_iph); + iph->payload_len = old_iph->payload_len; + be16_add_cpu(&iph->payload_len, sizeof(*old_iph)); iph->priority = old_iph->priority; memset(&iph->flow_lbl, 0, sizeof(iph->flow_lbl)); iph->daddr = rt->rt6i_dst.addr; -- cgit v0.10.2 From 013cd397532e5803a1625954a884d021653da720 Mon Sep 17 00:00:00 2001 From: Jianjun Kong Date: Mon, 10 Nov 2008 21:37:39 -0800 Subject: mac80211: fix a buffer overrun in station debug code net/mac80211/debugfs_sta.c The trailing zero was written to state[4], it's out of bounds. Signed-off-by: Jianjun Kong Signed-off-by: David S. Miller diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c index 189d0ba..b85c4f2 100644 --- a/net/mac80211/debugfs_sta.c +++ b/net/mac80211/debugfs_sta.c @@ -199,7 +199,7 @@ static ssize_t sta_agg_status_write(struct file *file, /* toggle Rx aggregation command */ tid_num = tid_num - 100; if (tid_static_rx[tid_num] == 1) { - strcpy(state, "off "); + strcpy(state, "off"); ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0, WLAN_REASON_QSTA_REQUIRE_SETUP); sta->ampdu_mlme.tid_state_rx[tid_num] |= -- cgit v0.10.2 From b971e7ac834e9f4bda96d5a96ae9abccd01c1dd8 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Mon, 10 Nov 2008 21:43:08 -0800 Subject: net: fix /proc/net/snmp as memory corruptor icmpmsg_put() can happily corrupt kernel memory, using a static table and forgetting to reset an array index in a loop. Remove the static array since its not safe without proper locking. Signed-off-by: Alexey Dobriyan Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c index 8f5a403..a631a1f 100644 --- a/net/ipv4/proc.c +++ b/net/ipv4/proc.c @@ -237,43 +237,45 @@ static const struct snmp_mib snmp4_net_list[] = { SNMP_MIB_SENTINEL }; +static void icmpmsg_put_line(struct seq_file *seq, unsigned long *vals, + unsigned short *type, int count) +{ + int j; + + if (count) { + seq_printf(seq, "\nIcmpMsg:"); + for (j = 0; j < count; ++j) + seq_printf(seq, " %sType%u", + type[j] & 0x100 ? "Out" : "In", + type[j] & 0xff); + seq_printf(seq, "\nIcmpMsg:"); + for (j = 0; j < count; ++j) + seq_printf(seq, " %lu", vals[j]); + } +} + static void icmpmsg_put(struct seq_file *seq) { #define PERLINE 16 - int j, i, count; - static int out[PERLINE]; + int i, count; + unsigned short type[PERLINE]; + unsigned long vals[PERLINE], val; struct net *net = seq->private; count = 0; for (i = 0; i < ICMPMSG_MIB_MAX; i++) { - - if (snmp_fold_field((void **) net->mib.icmpmsg_statistics, i)) - out[count++] = i; - if (count < PERLINE) - continue; - - seq_printf(seq, "\nIcmpMsg:"); - for (j = 0; j < PERLINE; ++j) - seq_printf(seq, " %sType%u", i & 0x100 ? "Out" : "In", - i & 0xff); - seq_printf(seq, "\nIcmpMsg: "); - for (j = 0; j < PERLINE; ++j) - seq_printf(seq, " %lu", - snmp_fold_field((void **) net->mib.icmpmsg_statistics, - out[j])); - seq_putc(seq, '\n'); - } - if (count) { - seq_printf(seq, "\nIcmpMsg:"); - for (j = 0; j < count; ++j) - seq_printf(seq, " %sType%u", out[j] & 0x100 ? "Out" : - "In", out[j] & 0xff); - seq_printf(seq, "\nIcmpMsg:"); - for (j = 0; j < count; ++j) - seq_printf(seq, " %lu", snmp_fold_field((void **) - net->mib.icmpmsg_statistics, out[j])); + val = snmp_fold_field((void **) net->mib.icmpmsg_statistics, i); + if (val) { + type[count] = i; + vals[count++] = val; + } + if (count == PERLINE) { + icmpmsg_put_line(seq, vals, type, count); + count = 0; + } } + icmpmsg_put_line(seq, vals, type, count); #undef PERLINE } -- cgit v0.10.2 From 5cd33db2120b5ce972568711156f91da83bff2d7 Mon Sep 17 00:00:00 2001 From: Lennert Buytenhek Date: Mon, 10 Nov 2008 21:45:05 -0800 Subject: net: fix setting of skb->tail in skb_recycle_check() Since skb_reset_tail_pointer() reads skb->data, we need to set skb->data before calling skb_reset_tail_pointer(). This was causing spurious skb_over_panic()s from skb_put() being called on a recycled skb that had its skb->tail set to beyond where it should have been. Bug report from Peter van Valderen . Signed-off-by: Lennert Buytenhek Signed-off-by: David S. Miller diff --git a/net/core/skbuff.c b/net/core/skbuff.c index ebb6b94..d49ef83 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -486,8 +486,8 @@ int skb_recycle_check(struct sk_buff *skb, int skb_size) shinfo->frag_list = NULL; memset(skb, 0, offsetof(struct sk_buff, tail)); - skb_reset_tail_pointer(skb); skb->data = skb->head + NET_SKB_PAD; + skb_reset_tail_pointer(skb); return 1; } -- cgit v0.10.2 From 14ee6742b1b5df275cd2d771b4562b4f808c9419 Mon Sep 17 00:00:00 2001 From: Lennert Buytenhek Date: Mon, 10 Nov 2008 21:52:42 -0800 Subject: dsa: fix skb->pkt_type when mac address of slave interface differs When a dsa slave interface has a mac address that differs from that of the master interface, eth_type_trans() won't explicitly set skb->pkt_type back to PACKET_HOST -- we need to do this ourselves before calling eth_type_trans(). Signed-off-by: Lennert Buytenhek Signed-off-by: David S. Miller diff --git a/net/dsa/tag_dsa.c b/net/dsa/tag_dsa.c index bdc0510..3186654 100644 --- a/net/dsa/tag_dsa.c +++ b/net/dsa/tag_dsa.c @@ -159,6 +159,7 @@ static int dsa_rcv(struct sk_buff *skb, struct net_device *dev, skb->dev = ds->ports[source_port]; skb_push(skb, ETH_HLEN); + skb->pkt_type = PACKET_HOST; skb->protocol = eth_type_trans(skb, skb->dev); skb->dev->last_rx = jiffies; diff --git a/net/dsa/tag_edsa.c b/net/dsa/tag_edsa.c index f985ea9..9f4ce55 100644 --- a/net/dsa/tag_edsa.c +++ b/net/dsa/tag_edsa.c @@ -178,6 +178,7 @@ static int edsa_rcv(struct sk_buff *skb, struct net_device *dev, skb->dev = ds->ports[source_port]; skb_push(skb, ETH_HLEN); + skb->pkt_type = PACKET_HOST; skb->protocol = eth_type_trans(skb, skb->dev); skb->dev->last_rx = jiffies; diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c index d311776..efd2669 100644 --- a/net/dsa/tag_trailer.c +++ b/net/dsa/tag_trailer.c @@ -95,6 +95,7 @@ static int trailer_rcv(struct sk_buff *skb, struct net_device *dev, skb->dev = ds->ports[source_port]; skb_push(skb, ETH_HLEN); + skb->pkt_type = PACKET_HOST; skb->protocol = eth_type_trans(skb, skb->dev); skb->dev->last_rx = jiffies; -- cgit v0.10.2 From df02c6ff2e3937379b31ea161b53229134fe92f7 Mon Sep 17 00:00:00 2001 From: Lennert Buytenhek Date: Mon, 10 Nov 2008 21:53:12 -0800 Subject: dsa: fix master interface allmulti/promisc handling Before commit b6c40d68ff6498b7f63ddf97cf0aa818d748dee7 ("net: only invoke dev->change_rx_flags when device is UP"), the dsa driver could sort-of get away with only fiddling with the master interface's allmulti/promisc counts in ->change_rx_flags() and not touching them in ->open() or ->stop(). After this commit (note that it was merged almost simultaneously with the dsa patches, which is why this wasn't caught initially), the breakage that was already there became more apparent. Since it makes no sense to keep the master interface's allmulti or promisc count pinned for a slave interface that is down, copy the vlan driver's sync logic (which does exactly what we want) over to dsa to fix this. Bug report from Dirk Teurlings and Peter van Valderen . Signed-off-by: Lennert Buytenhek Tested-by: Dirk Teurlings Tested-by: Peter van Valderen Signed-off-by: David S. Miller diff --git a/net/dsa/slave.c b/net/dsa/slave.c index 3761688..1af5a79 100644 --- a/net/dsa/slave.c +++ b/net/dsa/slave.c @@ -10,6 +10,7 @@ #include #include +#include #include #include "dsa_priv.h" @@ -49,11 +50,57 @@ void dsa_slave_mii_bus_init(struct dsa_switch *ds) /* slave device handling ****************************************************/ static int dsa_slave_open(struct net_device *dev) { + struct dsa_slave_priv *p = netdev_priv(dev); + struct net_device *master = p->parent->master_netdev; + int err; + + if (!(master->flags & IFF_UP)) + return -ENETDOWN; + + if (compare_ether_addr(dev->dev_addr, master->dev_addr)) { + err = dev_unicast_add(master, dev->dev_addr, ETH_ALEN); + if (err < 0) + goto out; + } + + if (dev->flags & IFF_ALLMULTI) { + err = dev_set_allmulti(master, 1); + if (err < 0) + goto del_unicast; + } + if (dev->flags & IFF_PROMISC) { + err = dev_set_promiscuity(master, 1); + if (err < 0) + goto clear_allmulti; + } + return 0; + +clear_allmulti: + if (dev->flags & IFF_ALLMULTI) + dev_set_allmulti(master, -1); +del_unicast: + if (compare_ether_addr(dev->dev_addr, master->dev_addr)) + dev_unicast_delete(master, dev->dev_addr, ETH_ALEN); +out: + return err; } static int dsa_slave_close(struct net_device *dev) { + struct dsa_slave_priv *p = netdev_priv(dev); + struct net_device *master = p->parent->master_netdev; + + dev_mc_unsync(master, dev); + dev_unicast_unsync(master, dev); + if (dev->flags & IFF_ALLMULTI) + dev_set_allmulti(master, -1); + if (dev->flags & IFF_PROMISC) + dev_set_promiscuity(master, -1); + + if (compare_ether_addr(dev->dev_addr, master->dev_addr)) + dev_unicast_delete(master, dev->dev_addr, ETH_ALEN); + return 0; } @@ -77,9 +124,30 @@ static void dsa_slave_set_rx_mode(struct net_device *dev) dev_unicast_sync(master, dev); } -static int dsa_slave_set_mac_address(struct net_device *dev, void *addr) +static int dsa_slave_set_mac_address(struct net_device *dev, void *a) { - memcpy(dev->dev_addr, addr + 2, 6); + struct dsa_slave_priv *p = netdev_priv(dev); + struct net_device *master = p->parent->master_netdev; + struct sockaddr *addr = a; + int err; + + if (!is_valid_ether_addr(addr->sa_data)) + return -EADDRNOTAVAIL; + + if (!(dev->flags & IFF_UP)) + goto out; + + if (compare_ether_addr(addr->sa_data, master->dev_addr)) { + err = dev_unicast_add(master, addr->sa_data, ETH_ALEN); + if (err < 0) + return err; + } + + if (compare_ether_addr(dev->dev_addr, master->dev_addr)) + dev_unicast_delete(master, dev->dev_addr, ETH_ALEN); + +out: + memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN); return 0; } -- cgit v0.10.2