From 3ba08b00e0d8413d79be9cab8ec085ceb6ae6fd6 Mon Sep 17 00:00:00 2001 From: Jarek Poplawski Date: Sat, 3 May 2008 20:46:29 -0700 Subject: sch_htb: remove from event queue in htb_parent_to_leaf() There is lack of removing a class from the event queue while changing from parent to leaf which can cause corruption of this rb tree. This patch fixes a bug introduced by my patch: "sch_htb: turn intermediate classes into leaves" commit: 160d5e10f87b1dc88fd9b84b31b1718e0fd76398. Many thanks to Jan 'yanek' Bortl for finding a way to reproduce this rare bug and narrowing the test case, which made possible proper diagnosing. This patch is recommended for all kernels starting from 2.6.20. Reported-and-tested-by: Jan 'yanek' Bortl Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c index 66148cc..5bc1ed4 100644 --- a/net/sched/sch_htb.c +++ b/net/sched/sch_htb.c @@ -1197,12 +1197,16 @@ static inline int htb_parent_last_child(struct htb_class *cl) return 1; } -static void htb_parent_to_leaf(struct htb_class *cl, struct Qdisc *new_q) +static void htb_parent_to_leaf(struct htb_sched *q, struct htb_class *cl, + struct Qdisc *new_q) { struct htb_class *parent = cl->parent; BUG_TRAP(!cl->level && cl->un.leaf.q && !cl->prio_activity); + if (parent->cmode != HTB_CAN_SEND) + htb_safe_rb_erase(&parent->pq_node, q->wait_pq + parent->level); + parent->level = 0; memset(&parent->un.inner, 0, sizeof(parent->un.inner)); INIT_LIST_HEAD(&parent->un.leaf.drop_list); @@ -1300,7 +1304,7 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg) htb_deactivate(q, cl); if (last_child) - htb_parent_to_leaf(cl, new_q); + htb_parent_to_leaf(q, cl, new_q); if (--cl->refcnt == 0) htb_destroy_class(sch, cl); -- cgit v0.10.2 From c8005785102e5b67ecf213f06a3d6c001f6f8cb4 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Sat, 3 May 2008 20:56:42 -0700 Subject: net: Fix useless comment reference loop. include/linux/skbuff.h says: /* These elements must be at the end, see alloc_skb() for details. */ net/core/skbuff.c says: * See comment in sk_buff definition, just before the 'tail' member This patch contains my guess as to the actual reason rather than a dead comment reference loop. Signed-off-by: Johannes Berg Signed-off-by: David S. Miller diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 4fe605f..5c459f2 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -200,7 +200,9 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask, goto nodata; /* - * See comment in sk_buff definition, just before the 'tail' member + * Only clear those fields we need to clear, not those that we will + * actually initialise below. Hence, don't put any more fields after + * the tail pointer in struct sk_buff! */ memset(skb, 0, offsetof(struct sk_buff, tail)); skb->truesize = size + sizeof(struct sk_buff); -- cgit v0.10.2 From 41fef0ee7b8f3fe3f3dd2ddc9b170f3d88bce595 Mon Sep 17 00:00:00 2001 From: Marcin Slusarz Date: Sat, 3 May 2008 21:03:01 -0700 Subject: xfrm: convert empty xfrm_audit_* macros to functions it removes these warnings when CONFIG_AUDITSYSCALL is unset: net/xfrm/xfrm_user.c: In function 'xfrm_add_sa': net/xfrm/xfrm_user.c:412: warning: unused variable 'sid' net/xfrm/xfrm_user.c:411: warning: unused variable 'sessionid' net/xfrm/xfrm_user.c:410: warning: unused variable 'loginuid' net/xfrm/xfrm_user.c: In function 'xfrm_del_sa': net/xfrm/xfrm_user.c:485: warning: unused variable 'sid' net/xfrm/xfrm_user.c:484: warning: unused variable 'sessionid' net/xfrm/xfrm_user.c:483: warning: unused variable 'loginuid' net/xfrm/xfrm_user.c: In function 'xfrm_add_policy': net/xfrm/xfrm_user.c:1132: warning: unused variable 'sid' net/xfrm/xfrm_user.c:1131: warning: unused variable 'sessionid' net/xfrm/xfrm_user.c:1130: warning: unused variable 'loginuid' net/xfrm/xfrm_user.c: In function 'xfrm_get_policy': net/xfrm/xfrm_user.c:1382: warning: unused variable 'sid' net/xfrm/xfrm_user.c:1381: warning: unused variable 'sessionid' net/xfrm/xfrm_user.c:1380: warning: unused variable 'loginuid' net/xfrm/xfrm_user.c: In function 'xfrm_add_pol_expire': net/xfrm/xfrm_user.c:1620: warning: unused variable 'sid' net/xfrm/xfrm_user.c:1619: warning: unused variable 'sessionid' net/xfrm/xfrm_user.c:1618: warning: unused variable 'loginuid' net/xfrm/xfrm_user.c: In function 'xfrm_add_sa_expire': net/xfrm/xfrm_user.c:1658: warning: unused variable 'sid' net/xfrm/xfrm_user.c:1657: warning: unused variable 'sessionid' net/xfrm/xfrm_user.c:1656: warning: unused variable 'loginuid' Signed-off-by: Marcin Slusarz Signed-off-by: David S. Miller diff --git a/include/net/xfrm.h b/include/net/xfrm.h index d1350bc..2933d747 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -648,14 +648,46 @@ extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, extern void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb, u8 proto); #else -#define xfrm_audit_policy_add(x, r, a, se, s) do { ; } while (0) -#define xfrm_audit_policy_delete(x, r, a, se, s) do { ; } while (0) -#define xfrm_audit_state_add(x, r, a, se, s) do { ; } while (0) -#define xfrm_audit_state_delete(x, r, a, se, s) do { ; } while (0) -#define xfrm_audit_state_replay_overflow(x, s) do { ; } while (0) -#define xfrm_audit_state_notfound_simple(s, f) do { ; } while (0) -#define xfrm_audit_state_notfound(s, f, sp, sq) do { ; } while (0) -#define xfrm_audit_state_icvfail(x, s, p) do { ; } while (0) + +static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, + u32 auid, u32 ses, u32 secid) +{ +} + +static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, + u32 auid, u32 ses, u32 secid) +{ +} + +static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, + u32 auid, u32 ses, u32 secid) +{ +} + +static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, + u32 auid, u32 ses, u32 secid) +{ +} + +static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, + struct sk_buff *skb) +{ +} + +static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, + u16 family) +{ +} + +static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, + __be32 net_spi, __be32 net_seq) +{ +} + +static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, + struct sk_buff *skb, u8 proto) +{ +} #endif /* CONFIG_AUDITSYSCALL */ static inline void xfrm_pol_hold(struct xfrm_policy *policy) -- cgit v0.10.2 From e544ff00da4b53069dbca3debbfb02d455f72467 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Sat, 3 May 2008 21:10:58 -0700 Subject: lapbeth: Release ->ethdev when unregistering device. Otherwise it leaks forever. Based upon a report by Roland Signed-off-by: David S. Miller diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c index b5860b9..24fd613 100644 --- a/drivers/net/wan/lapbether.c +++ b/drivers/net/wan/lapbether.c @@ -459,6 +459,7 @@ static void __exit lapbeth_cleanup_driver(void) list_for_each_safe(entry, tmp, &lapbeth_devices) { lapbeth = list_entry(entry, struct lapbethdev, node); + dev_put(lapbeth->ethdev); unregister_netdevice(lapbeth->axdev); } rtnl_unlock(); -- cgit v0.10.2 From be0c007ac64f880a946995d6d1fc654acc81484d Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Sun, 4 May 2008 01:34:31 -0700 Subject: niu: Fix probing regression for maramba on-board chips. Changeset 7f7c4072ea552f97a0898331322f71986a97299c ("niu: Determine the # of ports from the card's VPD data") caused maramba on-board NIU ports to stop probing properly. The old code had a fallback that would use a num_ports value of 4 if all the probing methods failed, but that was removed. This restores the fallback of 4 ports, to get things working again. Bump driver version and release date. Signed-off-by: David S. Miller diff --git a/drivers/net/niu.c b/drivers/net/niu.c index 4009c4c..57cfd72 100644 --- a/drivers/net/niu.c +++ b/drivers/net/niu.c @@ -1,6 +1,6 @@ /* niu.c: Neptune ethernet driver. * - * Copyright (C) 2007 David S. Miller (davem@davemloft.net) + * Copyright (C) 2007, 2008 David S. Miller (davem@davemloft.net) */ #include @@ -33,8 +33,8 @@ #define DRV_MODULE_NAME "niu" #define PFX DRV_MODULE_NAME ": " -#define DRV_MODULE_VERSION "0.8" -#define DRV_MODULE_RELDATE "April 24, 2008" +#define DRV_MODULE_VERSION "0.9" +#define DRV_MODULE_RELDATE "May 4, 2008" static char version[] __devinitdata = DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n"; @@ -7264,8 +7264,11 @@ static int __devinit niu_get_and_validate_port(struct niu *np) parent->num_ports = nr64(ESPC_NUM_PORTS_MACS) & ESPC_NUM_PORTS_MACS_VAL; + /* All of the current probing methods fail on + * Maramba on-board parts. + */ if (!parent->num_ports) - return -ENODEV; + parent->num_ports = 4; } } } -- cgit v0.10.2 From c37aa90b0458d87342e0bb083f6bf7d113220d09 Mon Sep 17 00:00:00 2001 From: Pavel Emelyanov Date: Sun, 4 May 2008 17:57:29 -0700 Subject: bridge: Net device leak in br_add_bridge(). In case the register_netdevice() call fails the device is leaked, since the out: label is just rtnl_unlock()+return. Free the device. Signed-off-by: Pavel Emelyanov Signed-off-by: David S. Miller diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c index 77a981a..bff0f5b 100644 --- a/net/bridge/br_if.c +++ b/net/bridge/br_if.c @@ -280,8 +280,10 @@ int br_add_bridge(const char *name) } ret = register_netdevice(dev); - if (ret) + if (ret) { + free_netdev(dev); goto out; + } ret = br_sysfs_addbr(dev); if (ret) -- cgit v0.10.2 From e340a90e6e07bba6e6b3fc39dd5fa76f95579d7c Mon Sep 17 00:00:00 2001 From: Pavel Emelyanov Date: Sun, 4 May 2008 17:58:07 -0700 Subject: bridge: Consolidate error paths in br_add_bridge(). This actually had to be merged with the patch #1, but I decided not to mix two changes in one patch. There are already two calls to free_netdev() in there, so merge them into one. Signed-off-by: Pavel Emelyanov Signed-off-by: David S. Miller diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c index bff0f5b..c2397f5 100644 --- a/net/bridge/br_if.c +++ b/net/bridge/br_if.c @@ -273,17 +273,13 @@ int br_add_bridge(const char *name) rtnl_lock(); if (strchr(dev->name, '%')) { ret = dev_alloc_name(dev, dev->name); - if (ret < 0) { - free_netdev(dev); - goto out; - } + if (ret < 0) + goto out_free; } ret = register_netdevice(dev); - if (ret) { - free_netdev(dev); - goto out; - } + if (ret) + goto out_free; ret = br_sysfs_addbr(dev); if (ret) @@ -291,6 +287,10 @@ int br_add_bridge(const char *name) out: rtnl_unlock(); return ret; + +out_free: + free_netdev(dev); + goto out; } int br_del_bridge(const char *name) -- cgit v0.10.2 From 339a7c41c913035bf58579f6e47b4ba29da83795 Mon Sep 17 00:00:00 2001 From: Pavel Emelyanov Date: Sun, 4 May 2008 17:59:30 -0700 Subject: mac80211: Do not free net device after it is unregistered. The error path in ieee80211_register_hw() may call the unregister_netdev() and right after it - the free_netdev(), which is wrong, since the unregister releases the device itself. So the proposed fix is to NULL the local->mdev after unregister is done and check this before calling free_netdev(). I checked - no code uses the local->mdev after unregister in this error path (but even if some did this would be a BUG). Signed-off-by: Pavel Emelyanov Signed-off-by: David S. Miller diff --git a/net/mac80211/main.c b/net/mac80211/main.c index 9ad4e36..915afad 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -1766,6 +1766,7 @@ fail_wep: fail_rate: ieee80211_debugfs_remove_netdev(IEEE80211_DEV_TO_SUB_IF(local->mdev)); unregister_netdevice(local->mdev); + local->mdev = NULL; fail_dev: rtnl_unlock(); sta_info_stop(local); @@ -1773,8 +1774,10 @@ fail_sta_info: debugfs_hw_del(local); destroy_workqueue(local->hw.workqueue); fail_workqueue: - ieee80211_if_free(local->mdev); - local->mdev = NULL; + if (local->mdev != NULL) { + ieee80211_if_free(local->mdev); + local->mdev = NULL; + } fail_mdev_alloc: wiphy_unregister(local->hw.wiphy); return result; -- cgit v0.10.2 From 65e4113684e50cee75357ce10dc9026b0929e4e9 Mon Sep 17 00:00:00 2001 From: Pavel Emelyanov Date: Sun, 4 May 2008 18:00:05 -0700 Subject: atm: Do not free already unregistered net device. Both br2684_push and br2684_exit do so, but unregister_netdev() releases the device itself. Signed-off-by: Pavel Emelyanov Signed-off-by: David S. Miller diff --git a/net/atm/br2684.c b/net/atm/br2684.c index 1b22806..3a74ff8 100644 --- a/net/atm/br2684.c +++ b/net/atm/br2684.c @@ -350,7 +350,6 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb) list_del(&brdev->br2684_devs); read_unlock(&devs_lock); unregister_netdev(net_dev); - free_netdev(net_dev); } return; } @@ -771,7 +770,6 @@ static void __exit br2684_exit(void) list_del(&brdev->br2684_devs); unregister_netdev(net_dev); - free_netdev(net_dev); } } -- cgit v0.10.2 From 1e0ba0060ffcee2e766ec3159196235b1a2a0ff3 Mon Sep 17 00:00:00 2001 From: Pavel Emelyanov Date: Sun, 4 May 2008 18:00:36 -0700 Subject: atm: Bad locking on br2684_devs modifications. The list_del happens under read-locked devs_lock. Signed-off-by: Pavel Emelyanov Signed-off-by: David S. Miller diff --git a/net/atm/br2684.c b/net/atm/br2684.c index 3a74ff8..13858e2 100644 --- a/net/atm/br2684.c +++ b/net/atm/br2684.c @@ -346,9 +346,9 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb) /* skb==NULL means VCC is being destroyed */ br2684_close_vcc(brvcc); if (list_empty(&brdev->brvccs)) { - read_lock(&devs_lock); + write_lock_irq(&devs_lock); list_del(&brdev->br2684_devs); - read_unlock(&devs_lock); + write_unlock_irq(&devs_lock); unregister_netdev(net_dev); } return; -- cgit v0.10.2 From 0bbeafd0118fc3ae54990064760c889d41dc21d6 Mon Sep 17 00:00:00 2001 From: Satoru SATOH Date: Sun, 4 May 2008 22:12:43 -0700 Subject: ip: Make use of the inline function dst_metric_locked() Signed-off-by: Satoru SATOH Signed-off-by: David S. Miller diff --git a/include/net/ip.h b/include/net/ip.h index 6d7bcd5..3b40bc2 100644 --- a/include/net/ip.h +++ b/include/net/ip.h @@ -210,7 +210,7 @@ int ip_dont_fragment(struct sock *sk, struct dst_entry *dst) { return (inet_sk(sk)->pmtudisc == IP_PMTUDISC_DO || (inet_sk(sk)->pmtudisc == IP_PMTUDISC_WANT && - !(dst_metric(dst, RTAX_LOCK)&(1<u.dst.metrics)); if (fi->fib_mtu == 0) { rt->u.dst.metrics[RTAX_MTU-1] = rt->u.dst.dev->mtu; - if (rt->u.dst.metrics[RTAX_LOCK-1] & (1 << RTAX_MTU) && + if (dst_metric_locked(&rt->u.dst, RTAX_MTU) && rt->rt_gateway != rt->rt_dst && rt->u.dst.dev->mtu > 576) rt->u.dst.metrics[RTAX_MTU-1] = 576; -- cgit v0.10.2 From 5ffc02a158997b1eb91ade8d02bcf521ff79a218 Mon Sep 17 00:00:00 2001 From: Satoru SATOH Date: Sun, 4 May 2008 22:14:42 -0700 Subject: ip: Use inline function dst_metric() instead of direct access to dst->metric[] There are functions to refer to the value of dst->metric[THE_METRIC-1] directly without use of a inline function "dst_metric" defined in net/dst.h. The following patch changes them to use the inline function consistently. Signed-off-by: Satoru SATOH Signed-off-by: David S. Miller diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c index 2f665a5..f50e88b 100644 --- a/net/decnet/dn_route.c +++ b/net/decnet/dn_route.c @@ -235,14 +235,14 @@ static void dn_dst_update_pmtu(struct dst_entry *dst, u32 mtu) else min_mtu -= 21; - if (dst->metrics[RTAX_MTU-1] > mtu && mtu >= min_mtu) { + if (dst_metric(dst, RTAX_MTU) > mtu && mtu >= min_mtu) { if (!(dst_metric_locked(dst, RTAX_MTU))) { dst->metrics[RTAX_MTU-1] = mtu; dst_set_expires(dst, dn_rt_mtu_expires); } if (!(dst_metric_locked(dst, RTAX_ADVMSS))) { u32 mss = mtu - DN_MAX_NSP_DATA_HEADER; - if (dst->metrics[RTAX_ADVMSS-1] > mss) + if (dst_metric(dst, RTAX_ADVMSS) > mss) dst->metrics[RTAX_ADVMSS-1] = mss; } } @@ -805,12 +805,12 @@ static int dn_rt_set_next_hop(struct dn_route *rt, struct dn_fib_res *res) rt->u.dst.neighbour = n; } - if (rt->u.dst.metrics[RTAX_MTU-1] == 0 || - rt->u.dst.metrics[RTAX_MTU-1] > rt->u.dst.dev->mtu) + if (dst_metric(&rt->u.dst, RTAX_MTU) == 0 || + dst_metric(&rt->u.dst, RTAX_MTU) > rt->u.dst.dev->mtu) rt->u.dst.metrics[RTAX_MTU-1] = rt->u.dst.dev->mtu; mss = dn_mss_from_pmtu(dev, dst_mtu(&rt->u.dst)); - if (rt->u.dst.metrics[RTAX_ADVMSS-1] == 0 || - rt->u.dst.metrics[RTAX_ADVMSS-1] > mss) + if (dst_metric(&rt->u.dst, RTAX_ADVMSS) == 0 || + dst_metric(&rt->u.dst, RTAX_ADVMSS) > mss) rt->u.dst.metrics[RTAX_ADVMSS-1] = mss; return 0; } diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 9084055..92f90ae 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -1468,14 +1468,14 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph, /* BSD 4.2 compatibility hack :-( */ if (mtu == 0 && - old_mtu >= rth->u.dst.metrics[RTAX_MTU-1] && + old_mtu >= dst_metric(&rth->u.dst, RTAX_MTU) && old_mtu >= 68 + (iph->ihl << 2)) old_mtu -= iph->ihl << 2; mtu = guess_mtu(old_mtu); } - if (mtu <= rth->u.dst.metrics[RTAX_MTU-1]) { - if (mtu < rth->u.dst.metrics[RTAX_MTU-1]) { + if (mtu <= dst_metric(&rth->u.dst, RTAX_MTU)) { + if (mtu < dst_metric(&rth->u.dst, RTAX_MTU)) { dst_confirm(&rth->u.dst); if (mtu < ip_rt_min_pmtu) { mtu = ip_rt_min_pmtu; @@ -1497,7 +1497,7 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph, static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu) { - if (dst->metrics[RTAX_MTU-1] > mtu && mtu >= 68 && + if (dst_metric(dst, RTAX_MTU) > mtu && mtu >= 68 && !(dst_metric_locked(dst, RTAX_MTU))) { if (mtu < ip_rt_min_pmtu) { mtu = ip_rt_min_pmtu; @@ -1624,14 +1624,14 @@ static void rt_set_nexthop(struct rtable *rt, struct fib_result *res, u32 itag) } else rt->u.dst.metrics[RTAX_MTU-1]= rt->u.dst.dev->mtu; - if (rt->u.dst.metrics[RTAX_HOPLIMIT-1] == 0) + if (dst_metric(&rt->u.dst, RTAX_HOPLIMIT) == 0) rt->u.dst.metrics[RTAX_HOPLIMIT-1] = sysctl_ip_default_ttl; - if (rt->u.dst.metrics[RTAX_MTU-1] > IP_MAX_MTU) + if (dst_metric(&rt->u.dst, RTAX_MTU) > IP_MAX_MTU) rt->u.dst.metrics[RTAX_MTU-1] = IP_MAX_MTU; - if (rt->u.dst.metrics[RTAX_ADVMSS-1] == 0) + if (dst_metric(&rt->u.dst, RTAX_ADVMSS) == 0) rt->u.dst.metrics[RTAX_ADVMSS-1] = max_t(unsigned int, rt->u.dst.dev->mtu - 40, ip_rt_min_advmss); - if (rt->u.dst.metrics[RTAX_ADVMSS-1] > 65535 - 40) + if (dst_metric(&rt->u.dst, RTAX_ADVMSS) > 65535 - 40) rt->u.dst.metrics[RTAX_ADVMSS-1] = 65535 - 40; #ifdef CONFIG_NET_CLS_ROUTE diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index eda4f4a..8ac15a6 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -66,6 +66,7 @@ #include #include #include +#include #include #include #include @@ -605,7 +606,7 @@ static u32 tcp_rto_min(struct sock *sk) u32 rto_min = TCP_RTO_MIN; if (dst && dst_metric_locked(dst, RTAX_RTO_MIN)) - rto_min = dst->metrics[RTAX_RTO_MIN - 1]; + rto_min = dst_metric(dst, RTAX_RTO_MIN); return rto_min; } @@ -769,7 +770,7 @@ void tcp_update_metrics(struct sock *sk) dst->metrics[RTAX_RTTVAR - 1] = m; else dst->metrics[RTAX_RTTVAR-1] -= - (dst->metrics[RTAX_RTTVAR-1] - m)>>2; + (dst_metric(dst, RTAX_RTTVAR) - m)>>2; } if (tp->snd_ssthresh >= 0xFFFF) { @@ -788,21 +789,21 @@ void tcp_update_metrics(struct sock *sk) dst->metrics[RTAX_SSTHRESH-1] = max(tp->snd_cwnd >> 1, tp->snd_ssthresh); if (!dst_metric_locked(dst, RTAX_CWND)) - dst->metrics[RTAX_CWND-1] = (dst->metrics[RTAX_CWND-1] + tp->snd_cwnd) >> 1; + dst->metrics[RTAX_CWND-1] = (dst_metric(dst, RTAX_CWND) + tp->snd_cwnd) >> 1; } else { /* Else slow start did not finish, cwnd is non-sense, ssthresh may be also invalid. */ if (!dst_metric_locked(dst, RTAX_CWND)) - dst->metrics[RTAX_CWND-1] = (dst->metrics[RTAX_CWND-1] + tp->snd_ssthresh) >> 1; - if (dst->metrics[RTAX_SSTHRESH-1] && + dst->metrics[RTAX_CWND-1] = (dst_metric(dst, RTAX_CWND) + tp->snd_ssthresh) >> 1; + if (dst_metric(dst, RTAX_SSTHRESH) && !dst_metric_locked(dst, RTAX_SSTHRESH) && - tp->snd_ssthresh > dst->metrics[RTAX_SSTHRESH-1]) + tp->snd_ssthresh > dst_metric(dst, RTAX_SSTHRESH)) dst->metrics[RTAX_SSTHRESH-1] = tp->snd_ssthresh; } if (!dst_metric_locked(dst, RTAX_REORDERING)) { - if (dst->metrics[RTAX_REORDERING-1] < tp->reordering && + if (dst_metric(dst, RTAX_REORDERING) < tp->reordering && tp->reordering != sysctl_tcp_reordering) dst->metrics[RTAX_REORDERING-1] = tp->reordering; } diff --git a/net/ipv6/route.c b/net/ipv6/route.c index a493ad9..12bba08 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1243,11 +1243,11 @@ install_route: } } - if (rt->u.dst.metrics[RTAX_HOPLIMIT-1] == 0) + if (dst_metric(&rt->u.dst, RTAX_HOPLIMIT) == 0) rt->u.dst.metrics[RTAX_HOPLIMIT-1] = -1; - if (!rt->u.dst.metrics[RTAX_MTU-1]) + if (!dst_metric(&rt->u.dst, RTAX_MTU)) rt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(dev); - if (!rt->u.dst.metrics[RTAX_ADVMSS-1]) + if (!dst_metric(&rt->u.dst, RTAX_ADVMSS)) rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->u.dst)); rt->u.dst.dev = dev; rt->rt6i_idev = idev; -- cgit v0.10.2 From fa1b1cff3d06550d23ef540c4f97ca83c021b473 Mon Sep 17 00:00:00 2001 From: Jamal Hadi Salim Date: Mon, 5 May 2008 00:22:35 -0700 Subject: net_cls_act: Make act_simple use of netlink policy. Convert to netlink helpers by using netlink policy validation. As a side effect fixes a leak. Signed-off-by: Jamal Hadi Salim Signed-off-by: David S. Miller diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c index 64b2d13..269ab51 100644 --- a/net/sched/act_simple.c +++ b/net/sched/act_simple.c @@ -6,7 +6,7 @@ * as published by the Free Software Foundation; either version * 2 of the License, or (at your option) any later version. * - * Authors: Jamal Hadi Salim (2005) + * Authors: Jamal Hadi Salim (2005-8) * */ @@ -34,6 +34,7 @@ static struct tcf_hashinfo simp_hash_info = { .lock = &simp_lock, }; +#define SIMP_MAX_DATA 32 static int tcf_simp(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res) { struct tcf_defact *d = a->priv; @@ -69,23 +70,24 @@ static int tcf_simp_release(struct tcf_defact *d, int bind) return ret; } -static int alloc_defdata(struct tcf_defact *d, u32 datalen, void *defdata) +static int alloc_defdata(struct tcf_defact *d, char *defdata) { - d->tcfd_defdata = kmemdup(defdata, datalen, GFP_KERNEL); + d->tcfd_defdata = kstrndup(defdata, SIMP_MAX_DATA, GFP_KERNEL); if (unlikely(!d->tcfd_defdata)) return -ENOMEM; - d->tcfd_datalen = datalen; + return 0; } -static int realloc_defdata(struct tcf_defact *d, u32 datalen, void *defdata) +static int realloc_defdata(struct tcf_defact *d, char *defdata) { kfree(d->tcfd_defdata); - return alloc_defdata(d, datalen, defdata); + return alloc_defdata(d, defdata); } static const struct nla_policy simple_policy[TCA_DEF_MAX + 1] = { [TCA_DEF_PARMS] = { .len = sizeof(struct tc_defact) }, + [TCA_DEF_DATA] = { .type = NLA_STRING, .len = SIMP_MAX_DATA }, }; static int tcf_simp_init(struct nlattr *nla, struct nlattr *est, @@ -95,28 +97,24 @@ static int tcf_simp_init(struct nlattr *nla, struct nlattr *est, struct tc_defact *parm; struct tcf_defact *d; struct tcf_common *pc; - void *defdata; - u32 datalen = 0; + char *defdata; int ret = 0, err; if (nla == NULL) return -EINVAL; - err = nla_parse_nested(tb, TCA_DEF_MAX, nla, NULL); + err = nla_parse_nested(tb, TCA_DEF_MAX, nla, simple_policy); if (err < 0) return err; if (tb[TCA_DEF_PARMS] == NULL) return -EINVAL; - parm = nla_data(tb[TCA_DEF_PARMS]); - defdata = nla_data(tb[TCA_DEF_DATA]); - if (defdata == NULL) + if (tb[TCA_DEF_DATA] == NULL) return -EINVAL; - datalen = nla_len(tb[TCA_DEF_DATA]); - if (datalen == 0) - return -EINVAL; + parm = nla_data(tb[TCA_DEF_PARMS]); + defdata = nla_data(tb[TCA_DEF_DATA]); pc = tcf_hash_check(parm->index, a, bind, &simp_hash_info); if (!pc) { @@ -126,7 +124,7 @@ static int tcf_simp_init(struct nlattr *nla, struct nlattr *est, return -ENOMEM; d = to_defact(pc); - ret = alloc_defdata(d, datalen, defdata); + ret = alloc_defdata(d, defdata); if (ret < 0) { kfree(pc); return ret; @@ -138,7 +136,7 @@ static int tcf_simp_init(struct nlattr *nla, struct nlattr *est, tcf_simp_release(d, bind); return -EEXIST; } - realloc_defdata(d, datalen, defdata); + realloc_defdata(d, defdata); } spin_lock_bh(&d->tcf_lock); @@ -172,7 +170,7 @@ static inline int tcf_simp_dump(struct sk_buff *skb, struct tc_action *a, opt.bindcnt = d->tcf_bindcnt - bind; opt.action = d->tcf_action; NLA_PUT(skb, TCA_DEF_PARMS, sizeof(opt), &opt); - NLA_PUT(skb, TCA_DEF_DATA, d->tcfd_datalen, d->tcfd_defdata); + NLA_PUT_STRING(skb, TCA_DEF_DATA, d->tcfd_defdata); t.install = jiffies_to_clock_t(jiffies - d->tcf_tm.install); t.lastuse = jiffies_to_clock_t(jiffies - d->tcf_tm.lastuse); t.expires = jiffies_to_clock_t(d->tcf_tm.expires); -- cgit v0.10.2 From c17f888f8fc2e47e2b4a51424f8ccf564ae87576 Mon Sep 17 00:00:00 2001 From: Ingo Molnar Date: Mon, 5 May 2008 01:04:06 -0700 Subject: irda: fix !PNP support in drivers/net/irda/nsc-ircc.c x86.git testing found the following build failure in latest -git: drivers/built-in.o: In function `nsc_ircc_pnp_probe': nsc-ircc.c:(.text+0xdf1b6): undefined reference to `pnp_get_resource' nsc-ircc.c:(.text+0xdf1d4): undefined reference to `pnp_get_resource' nsc-ircc.c:(.text+0xdf1ee): undefined reference to `pnp_get_resource' nsc-ircc.c:(.text+0xdf237): undefined reference to `pnp_get_resource' nsc-ircc.c:(.text+0xdf24c): undefined reference to `pnp_get_resource' drivers/built-in.o:nsc-ircc.c:(.text+0xdf266): more undefined references to `pnp_get_resource' follow make: *** [.tmp_vmlinux1] Error 1 triggered via this config: http://redhat.com/~mingo/misc/config-Sat_May__3_20_53_13_CEST_2008.bad while generally most users will have PNP enabled, drivers can support non-PNP build mode too - and most drivers implement it. That is typically done by providing a dummy pnp_driver structure that will not probe anything. The fallback routines in the driver will handle this dumber mode of operation too. This patch implements that. I have not tested whether this actually works on real hardware so take care. It does resolve the build bug. [ Another solution that is used by a few drivers is to exclude the driver in the Kconfig if PNP is disabled, via "depends on PNP", but this would limit the availability of the driver needlessly. ] Signed-off-by: Ingo Molnar Signed-off-by: David S. Miller diff --git a/drivers/net/irda/nsc-ircc.c b/drivers/net/irda/nsc-ircc.c index a873d2b..a7714da 100644 --- a/drivers/net/irda/nsc-ircc.c +++ b/drivers/net/irda/nsc-ircc.c @@ -100,7 +100,9 @@ static int nsc_ircc_probe_39x(nsc_chip_t *chip, chipio_t *info); static int nsc_ircc_init_108(nsc_chip_t *chip, chipio_t *info); static int nsc_ircc_init_338(nsc_chip_t *chip, chipio_t *info); static int nsc_ircc_init_39x(nsc_chip_t *chip, chipio_t *info); +#ifdef CONFIG_PNP static int nsc_ircc_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *id); +#endif /* These are the known NSC chips */ static nsc_chip_t chips[] = { @@ -156,9 +158,11 @@ static const struct pnp_device_id nsc_ircc_pnp_table[] = { MODULE_DEVICE_TABLE(pnp, nsc_ircc_pnp_table); static struct pnp_driver nsc_ircc_pnp_driver = { +#ifdef CONFIG_PNP .name = "nsc-ircc", .id_table = nsc_ircc_pnp_table, .probe = nsc_ircc_pnp_probe, +#endif }; /* Some prototypes */ @@ -916,6 +920,7 @@ static int nsc_ircc_probe_39x(nsc_chip_t *chip, chipio_t *info) return 0; } +#ifdef CONFIG_PNP /* PNP probing */ static int nsc_ircc_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *id) { @@ -952,6 +957,7 @@ static int nsc_ircc_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *i return 0; } +#endif /* * Function nsc_ircc_setup (info) -- cgit v0.10.2 From 7a1aa309f21ea2f6c31f364341e4027ecf4e79bc Mon Sep 17 00:00:00 2001 From: Ingo Molnar Date: Mon, 5 May 2008 01:06:54 -0700 Subject: irda: fix !PNP support for drivers/net/irda/smsc-ircc2.c x86.git testing found this build bug on v2.6.26-rc1: ERROR: "pnp_get_resource" [drivers/net/irda/smsc-ircc2.ko] undefined! make[1]: *** [__modpost] Error 1 make: *** [modules] Error 2 the driver did not anticipate the case of !CONFIG_PNP which is rare but still possible. Instead of restricting the driver to PNP-only in the Kconfig space, add the (trivial) dummy struct pnp_driver - this is that other drivers use in the !PNP case too. The driver itself can in theory be initialized on !PNP too in certain cases, via smsc_ircc_legacy_probe(). Patch only minimally build tested, i dont have this hardware. Signed-off-by: Ingo Molnar Signed-off-by: David S. Miller diff --git a/drivers/net/irda/smsc-ircc2.c b/drivers/net/irda/smsc-ircc2.c index 1f26da7..cfe0194 100644 --- a/drivers/net/irda/smsc-ircc2.c +++ b/drivers/net/irda/smsc-ircc2.c @@ -376,6 +376,7 @@ MODULE_DEVICE_TABLE(pnp, smsc_ircc_pnp_table); static int pnp_driver_registered; +#ifdef CONFIG_PNP static int __init smsc_ircc_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id) { @@ -402,7 +403,9 @@ static struct pnp_driver smsc_ircc_pnp_driver = { .id_table = smsc_ircc_pnp_table, .probe = smsc_ircc_pnp_probe, }; - +#else /* CONFIG_PNP */ +static struct pnp_driver smsc_ircc_pnp_driver; +#endif /******************************************************************************* * -- cgit v0.10.2 From 19443178fbfbf40db15c86012fc37df1a44ab857 Mon Sep 17 00:00:00 2001 From: Chris Wright Date: Mon, 5 May 2008 13:50:24 -0700 Subject: dccp: return -EINVAL on invalid feature length dccp_feat_change() validates length and on error is returning 1. This happens to work since call chain is checking for 0 == success, but this is returned to userspace, so make it a real error value. Signed-off-by: Chris Wright Acked-by: Arnaldo Carvalho de Melo Signed-off-by: David S. Miller diff --git a/net/dccp/feat.c b/net/dccp/feat.c index 4a4f6ce..933a0ec 100644 --- a/net/dccp/feat.c +++ b/net/dccp/feat.c @@ -32,7 +32,7 @@ int dccp_feat_change(struct dccp_minisock *dmsk, u8 type, u8 feature, if (len > 3) { DCCP_WARN("invalid length %d\n", len); - return 1; + return -EINVAL; } /* XXX add further sanity checks */ -- cgit v0.10.2 From 5f6b1ea41b46bc63f667f9b30d939b49734c20b0 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Tue, 6 May 2008 00:00:16 -0700 Subject: Revert "atm: Do not free already unregistered net device." This reverts commit 65e4113684e50cee75357ce10dc9026b0929e4e9. Unlike the other cases Pavel fixed, this case did not setup a netdev->destructor of free_netdev, therefore this change was not correct. Signed-off-by: David S. Miller diff --git a/net/atm/br2684.c b/net/atm/br2684.c index 13858e2..9d52ebf 100644 --- a/net/atm/br2684.c +++ b/net/atm/br2684.c @@ -350,6 +350,7 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb) list_del(&brdev->br2684_devs); write_unlock_irq(&devs_lock); unregister_netdev(net_dev); + free_netdev(net_dev); } return; } @@ -770,6 +771,7 @@ static void __exit br2684_exit(void) list_del(&brdev->br2684_devs); unregister_netdev(net_dev); + free_netdev(net_dev); } } -- cgit v0.10.2 From 1da5ea1a8bf4ddb82831528223c853821cb1c9ab Mon Sep 17 00:00:00 2001 From: Adrian Bunk Date: Tue, 6 May 2008 00:04:47 -0700 Subject: iwlwifi: make IWLWIFI a tristate IWLWIFI should be a tristate so that if IWLCORE and/or IWL3945 are m and none of them is y kbuild doesn't create an empty drivers/net/wireless/built-in.o This patch also removes the pointless "default n". Signed-off-by: Adrian Bunk Signed-off-by: David S. Miller diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig index d5b7a76..62fb89d 100644 --- a/drivers/net/wireless/iwlwifi/Kconfig +++ b/drivers/net/wireless/iwlwifi/Kconfig @@ -1,6 +1,5 @@ config IWLWIFI - bool - default n + tristate config IWLCORE tristate "Intel Wireless Wifi Core" -- cgit v0.10.2 From 9d1045ad68fcccfaf1393cc463ab6357693e8d1d Mon Sep 17 00:00:00 2001 From: Jamal Hadi Salim Date: Tue, 6 May 2008 00:10:24 -0700 Subject: net_cls_act: act_simple dont ignore realloc code reallocation of the policy data was being ignored. It could fail. Simplify so that there is no need for reallocating. Signed-off-by: Jamal Hadi Salim Signed-off-by: David S. Miller diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c index 269ab51..1d421d0 100644 --- a/net/sched/act_simple.c +++ b/net/sched/act_simple.c @@ -79,10 +79,14 @@ static int alloc_defdata(struct tcf_defact *d, char *defdata) return 0; } -static int realloc_defdata(struct tcf_defact *d, char *defdata) +static void reset_policy(struct tcf_defact *d, char *defdata, + struct tc_defact *p) { - kfree(d->tcfd_defdata); - return alloc_defdata(d, defdata); + spin_lock_bh(&d->tcf_lock); + d->tcf_action = p->action; + memset(d->tcfd_defdata, 0, SIMP_MAX_DATA); + strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA); + spin_unlock_bh(&d->tcf_lock); } static const struct nla_policy simple_policy[TCA_DEF_MAX + 1] = { @@ -129,6 +133,7 @@ static int tcf_simp_init(struct nlattr *nla, struct nlattr *est, kfree(pc); return ret; } + d->tcf_action = parm->action; ret = ACT_P_CREATED; } else { d = to_defact(pc); @@ -136,13 +141,9 @@ static int tcf_simp_init(struct nlattr *nla, struct nlattr *est, tcf_simp_release(d, bind); return -EEXIST; } - realloc_defdata(d, defdata); + reset_policy(d, defdata, parm); } - spin_lock_bh(&d->tcf_lock); - d->tcf_action = parm->action; - spin_unlock_bh(&d->tcf_lock); - if (ret == ACT_P_CREATED) tcf_hash_insert(pc, &simp_hash_info); return ret; -- cgit v0.10.2