- 07 Aug, 2008 3 commits
-
-
Gui Jianfeng authored
If the following packet flow happen, kernel will panic. MathineA MathineB SYN ----------------------> SYN+ACK <---------------------- ACK(bad seq) ----------------------> When a bad seq ACK is received, tcp_v4_md5_do_lookup(skb->sk, ip_hdr(skb)->daddr)) is finally called by tcp_v4_reqsk_send_ack(), but the first parameter(skb->sk) is NULL at that moment, so kernel panic happens. This patch fixes this bug. OOPS output is as following: [ 302.812793] IP: [<c05cfaa6>] tcp_v4_md5_do_lookup+0x12/0x42 [ 302.817075] Oops: 0000 [#1] SMP [ 302.819815] Modules linked in: ipv6 loop dm_multipath rtc_cmos rtc_core rtc_lib pcspkr pcnet32 mii i2c_piix4 parport_pc i2c_core parport ac button ata_piix libata dm_mod mptspi mptscsih mptbase scsi_transport_spi sd_mod scsi_mod crc_t10dif ext3 jbd mbcache uhci_hcd ohci_hcd ehci_hcd [last unloaded: scsi_wait_scan] [ 302.849946] [ 302.851198] Pid: 0, comm: swapper Not tainted (2.6.27-rc1-guijf #5) [ 302.855184] EIP: 0060:[<c05cfaa6>] EFLAGS: 00010296 CPU: 0 [ 302.858296] EIP is at tcp_v4_md5_do_lookup+0x12/0x42 [ 302.861027] EAX: 0000001e EBX: 00000000 ECX: 00000046 EDX: 00000046 [ 302.864867] ESI: ceb69e00 EDI: 1467a8c0 EBP: cf75f180 ESP: c0792e54 [ 302.868333] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [ 302.871287] Process swapper (pid: 0, ti=c0792000 task=c0712340 task.ti=c0746000) [ 302.875592] Stack: c06f413a 00000000 cf75f180 ceb69e00 00000000 c05d0d86 000016d0 ceac5400 [ 302.883275] c05d28f8 000016d0 ceb69e00 ceb69e20 681bf6e3 00001000 00000000 0a67a8c0 [ 302.890971] ceac5400 c04250a3 c06f413a c0792eb0 c0792edc cf59a620 cf59a620 cf59a634 [ 302.900140] Call Trace: [ 302.902392] [<c05d0d86>] tcp_v4_reqsk_send_ack+0x17/0x35 [ 302.907060] [<c05d28f8>] tcp_check_req+0x156/0x372 [ 302.910082] [<c04250a3>] printk+0x14/0x18 [ 302.912868] [<c05d0aa1>] tcp_v4_do_rcv+0x1d3/0x2bf [ 302.917423] [<c05d26be>] tcp_v4_rcv+0x563/0x5b9 [ 302.920453] [<c05bb20f>] ip_local_deliver_finish+0xe8/0x183 [ 302.923865] [<c05bb10a>] ip_rcv_finish+0x286/0x2a3 [ 302.928569] [<c059e438>] dev_alloc_skb+0x11/0x25 [ 302.931563] [<c05a211f>] netif_receive_skb+0x2d6/0x33a [ 302.934914] [<d0917941>] pcnet32_poll+0x333/0x680 [pcnet32] [ 302.938735] [<c05a3b48>] net_rx_action+0x5c/0xfe [ 302.941792] [<c042856b>] __do_softirq+0x5d/0xc1 [ 302.944788] [<c042850e>] __do_softirq+0x0/0xc1 [ 302.948999] [<c040564b>] do_softirq+0x55/0x88 [ 302.951870] [<c04501b1>] handle_fasteoi_irq+0x0/0xa4 [ 302.954986] [<c04284da>] irq_exit+0x35/0x69 [ 302.959081] [<c0405717>] do_IRQ+0x99/0xae [ 302.961896] [<c040422b>] common_interrupt+0x23/0x28 [ 302.966279] [<c040819d>] default_idle+0x2a/0x3d [ 302.969212] [<c0402552>] cpu_idle+0xb2/0xd2 [ 302.972169] ======================= [ 302.974274] Code: fc ff 84 d2 0f 84 df fd ff ff e9 34 fe ff ff 83 c4 0c 5b 5e 5f 5d c3 90 90 57 89 d7 56 53 89 c3 50 68 3a 41 6f c0 e8 e9 55 e5 ff <8b> 93 9c 04 00 00 58 85 d2 59 74 1e 8b 72 10 31 db 31 c9 85 f6 [ 303.011610] EIP: [<c05cfaa6>] tcp_v4_md5_do_lookup+0x12/0x42 SS:ESP 0068:c0792e54 [ 303.018360] Kernel panic - not syncing: Fatal exception in interrupt Signed-off-by:Gui Jianfeng <guijianfeng@cn.fujitsu.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
David S. Miller authored
As noticed by Stephen Hemminger, the root qdisc is denoted by TC_H_ROOT, not zero. Signed-off-by: -
David S. Miller authored
Noticed by Paulius Zaleckas. Signed-off-by:
-
- 06 Aug, 2008 12 commits
-
-
Joakim Koskela authored
Here's a revised version, based on Herbert's comments, of a fix for the ipv4-inner, ipv6-outer interfamily ipsec beet mode. It fixes the network header adjustment during interfamily, as well as makes sure that we reserve enough room for the new ipv6 header if we might have something else as the inner family. Also, the ipv4 pseudo header construction was added. Signed-off-by:
Joakim Koskela <jookos@gmail.com> Acked-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Joakim Koskela authored
Here's a revised version, based on Herbert's comments, of a fix for the ipv6-inner, ipv4-outer interfamily ipsec beet mode. It fixes the network header adjustment in interfamily, and doesn't reserve space for the pseudo header anymore when we have ipv6 as the inner family. Signed-off-by:
-
Krzysztof Piotr Oledzki authored
Starting with 9043476f ("[PATCH] sanitize proc_sysctl") we have two netfilter releated problems: - WARNING: at kernel/sysctl.c:1966 unregister_sysctl_table+0xcc/0x103(), caused by wrong order of ini/fini calls - net.netfilter is duplicated and has truncated set of records Thanks to very useful guidelines from Al Viro, this patch fixes both of them. Signed-off-by:
Krzysztof Piotr Oledzki <ole@ans.pl> Acked-by:
Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
-
Rami Rosen authored
This patch replaces dst_metric() with dst_mtu() in net/ipv6/route.c. Signed-off-by:
Rami Rosen <ramirose@gmail.com> Signed-off-by:
-
Rami Rosen authored
This patch replaces dst_metric() with dst_mtu() in net/ipv4/route.c. Signed-off-by:
-
Linus Torvalds authored
-
Linus Torvalds authored
This re-introduces commit 2b142900, which was reverted due to the regression it caused by commit fca082c9. That regression was not root-caused by the original commit, it was just uncovered by it, and the real fix was done by Alan Stern in commit 580da348 ("Fix USB storage hang on command abort"). We can thus re-introduce the change that was confirmed by Alan Jenkins to be still required by his odd card reader. Cc: Alan Jenkins <alan-jenkins@tuffmail.co.uk> Cc: Alan Stern <stern@rowland.harvard.edu> Cc: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds authored
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (78 commits) AX.25: Fix sysctl registration if !CONFIG_AX25_DAMA_SLAVE pktgen: mac count pktgen: random flow bridge: Eliminate unnecessary forward delay bridge: fix compile warning in net/bridge/br_netfilter.c ipv4: remove unused field in struct flowi (include/net/flow.h). tg3: Fix 'scheduling while atomic' errors net: Kill plain NET_XMIT_BYPASS. net_sched: Add qdisc __NET_XMIT_BYPASS flag net_sched: Add qdisc __NET_XMIT_STOLEN flag iwl3945: fix merge mistake for packet injection iwlwifi: grap nic access before accessing periphery registers iwlwifi: decrement rx skb counter in scan abort handler iwlwifi: fix unhandled interrupt when HW rfkill is on iwlwifi: implement iwl5000_calc_rssi iwlwifi: memory allocation optimization iwlwifi: HW bug fixes p54: Fix potential concurrent access to private data rt2x00: Disable link tuning in rt2500usb iwlwifi: Don't use buffer allocated on the stack for led names ...
-
Ralf Baechle authored
Since 49ffcf8f ("sysctl: update sysctl_check_table") setting struct ctl_table.procname = NULL does no longer work as it used to the way the AX.25 code is expecting it to resulting in the AX.25 sysctl registration code to break if CONFIG_AX25_DAMA_SLAVE was not set as in some distribution kernels. Kernel releases from 2.6.24 are affected. Signed-off-by:
Ralf Baechle <ralf@linux-mips.org> Signed-off-by:
-
Robert Olsson authored
dst_mac_count and src_mac_count patch from Eneas Hunguana We have sent one mac address to much. Signed-off-by:
Robert Olsson <robert.olsson@its.uu.se> Signed-off-by:
-
Robert Olsson authored
Random flow generation has not worked. This fixes it. Signed-off-by:
-
Stephen Hemminger authored
From: Stephen Hemminger <shemminger@vyatta.com> Based upon original patch by Herbert Xu, which contained the following problem description: -------------------- When the forward delay is set to zero, we still delay the setting of the forwarding state by one or possibly two timers depending on whether STP is enabled. This could either turn out to be instantaneous, or horribly slow depending on the load of the machine. As there is nothing preventing us from enabling forwarding straight away, this patch eliminates this potential delay by executing the code directly if the forward delay is zero. The effect of this problem is that immediately after the carrier comes on a port, the bridge will drop all packets received from that port until it enters forwarding mode, thus causing unnecessary packet loss. Note that this patch doesn't fully remove the delay due to the link watcher. We should also check the carrier state when we are about to drop an incoming packet because the port is disabled. But that's for another patch. -------------------- This version of the fix takes a different approach, in that it just does the state change directly. Signed-off-by:
-
- 05 Aug, 2008 25 commits
-
-
Randy Dunlap authored
Fix (fatal error) s390 docbook file to handle renamed header files. Signed-off-by:
Randy Dunlap <randy.dunlap@oracle.com> cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by:
-
Andrew Morton authored
mips allmodconfig: drivers/media/video/vino.c: In function `vino_free_buffer_with_count': drivers/media/video/vino.c:811: warning: passing arg 1 of `virt_to_phys' makes pointer from integer without a cast drivers/media/video/vino.c: In function `vino_allocate_buffer': drivers/media/video/vino.c:889: warning: passing arg 1 of `virt_to_phys' makes pointer from integer without a cast drivers/media/video/vino.c: In function `vino_ioctl': drivers/media/video/vino.c:4364: error: implicit declaration of function `video_usercopy' The patch fixes the error, but not the warnings. Cc: Mauro Carvalho Chehab <mchehab@infradead.org> Cc: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
-
Benny Halevy authored
gcc 4.3.0 correctly emits the following warnings. When a vma covering addr is found, find_vma_prepare indeed returns without setting pprev, rb_link, and rb_parent. mm/mmap.c: In function `insert_vm_struct': mm/mmap.c:2085: warning: `rb_parent' may be used uninitialized in this function mm/mmap.c:2085: warning: `rb_link' may be used uninitialized in this function mm/mmap.c:2084: warning: `prev' may be used uninitialized in this function mm/mmap.c: In function `copy_vma': mm/mmap.c:2124: warning: `rb_parent' may be used uninitialized in this function mm/mmap.c:2124: warning: `rb_link' may be used uninitialized in this function mm/mmap.c:2123: warning: `prev' may be used uninitialized in this function mm/mmap.c: In function `do_brk': mm/mmap.c:1951: warning: `rb_parent' may be used uninitialized in this function mm/mmap.c:1951: warning: `rb_link' may be used uninitialized in this function mm/mmap.c:1949: warning: `prev' may be used uninitialized in this function mm/mmap.c: In function `mmap_region': mm/mmap.c:1092: warning: `rb_parent' may be used uninitialized in this function mm/mmap.c:1092: warning: `rb_link' may be used uninitialized in this function mm/mmap.c:1089: warning: `prev' may be used uninitialized in this function Hugh adds: in fact, none of find_vma_prepare's callers use those values when a vma is found to be already covering addr, it's either an error or an occasion to munmap and repeat. Okay, let's quieten the compiler (but I would prefer it if pprev, rb_link and rb_parent were meaningful in that case, rather than whatever's in them from descending the tree). Signed-off-by:
Benny Halevy <bhalevy@panasas.com> Signed-off-by:
Hugh Dickins <hugh@veritas.com> Cc: "Ryan Hope" <rmh3093@gmail.com> Signed-off-by:
-
Richard Hughes authored
A documentation cleanup patch. With a minor tweak to clarify units for kbs. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by:
mark gross <mgross@linux.intel.com> Signed-off-by:
-
Alexander Beregalov authored
proc: fix warnings fs/proc/base.c:2429: warning: format '%llu' expects type 'long long unsigned int', but argument 3 has type 'u64' fs/proc/base.c:2429: warning: format '%llu' expects type 'long long unsigned int', but argument 4 has type 'u64' fs/proc/base.c:2429: warning: format '%llu' expects type 'long long unsigned int', but argument 5 has type 'u64' fs/proc/base.c:2429: warning: format '%llu' expects type 'long long unsigned int', but argument 6 has type 'u64' fs/proc/base.c:2429: warning: format '%llu' expects type 'long long unsigned int', but argument 7 has type 'u64' fs/proc/base.c:2429: warning: format '%llu' expects type 'long long unsigned int', but argument 8 has type 'u64' fs/proc/base.c:2429: warning: format '%llu' expects type 'long long unsigned int', but argument 9 has type 'u64' Signed-off-by:
Alexander Beregalov <a.beregalov@gmail.com> Acked-by:
Andrea Righi <righi.andrea@gmail.com> Cc: Oleg Nesterov <oleg@tv-sign.ru> Signed-off-by:
-
Huang Weiyi authored
Removed duplicated include <linux/delay.h> in drivers/misc/sgi-gru/grutlbpurge.c. Signed-off-by:
Huang Weiyi <weiyi.huang@gmail.com> Cc: Jack Steiner <steiner@sgi.com> Signed-off-by:
-
Alexander Beregalov authored
fs/omfs/inode.c:495: warning: format '%llx' expects type 'long long unsigned int', but argument 2 has type 'u64' fs/omfs/inode.c:495: warning: format '%llx' expects type 'long long unsigned int', but argument 3 has type '__be64' Signed-off-by:
Bob Copeland <me@bobcopeland.com> Signed-off-by:
-
Randy Dunlap authored
Fix handling of nested structs or unions. The regex to strip (eliminate) nested structs or unions was limited to only 0 or 1 matches. This can cause an uneven number of left/right braces to be stripped, which causes this: Warning(linux-2.6.27-rc1-git2//include/net/mac80211.h:336): No description found for parameter '}' Signed-off-by:
-
Jan Beulich authored
get_order() takes byte-sized input, not a page-granular one. Irrespective of this fix I'm inclined to believe that this doesn't work right anyway - bitmap_allocate_region() has an implicit assumption of 'pos' being suitable for 'order', which this function doesn't seem to enforce (and since it's being called with a byte-granular value there's no reason to believe that the callers would make sure device_addr is passed accordingly - it's also not documented that way). Signed-off-by:
Jan Beulich <jbeulich@novell.com> Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Dmitry Baryshkov <dbaryshkov@gmail.com> Cc: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by:
-
Alexander Beregalov authored
drivers/video/aty/atyfb_base.c:2663: warning: 'aty_resume_chip' defined but not used Signed-off-by:
-
Julia Lawall authored
of_node_put is needed before discarding a value received from of_find_node_by_type, eg in error handling code. The semantic patch that makes the change is as follows: (http://www.emn.fr/x-info/coccinelle/) // <smpl> @@ struct device_node *n; struct device_node *n1; struct device_node *n2; statement S; identifier f1,f2; expression E1,E2; constant C; @@ n = of_find_node_by_type(...) ... if (!n) S ... when != of_node_put(n) when != n1 = f1(n,...) when != E1 = n when any when strict ( + of_node_put(n); return -C; | of_node_put(n); | n2 = f2(n,...) | E2 = n | return ...; ) // </smpl> Signed-off-by:
Julia Lawall <julia@diku.dk> Acked-by:
Krzysztof Helt <krzysztof.h1@wp.pl> Cc: Timur Tabi <timur@freescale.com> Cc: York Sun <yorksun@freescale.com> Signed-off-by:
-
Jean Delvare authored
The name of the i2c buses shows in the output of "i2cdetect -l", so it's important to give informative names. Signed-off-by:
Jean Delvare <khali@linux-fr.org> Acked-by:
Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by:
-
Krzysztof Helt authored
If the 'clear' command is used on the frame buffer with a logo the upper area is filled by few lines but not scrolled anymore. Fix this by removing the protected area for the logo if any part of the logo is cleared. Signed-off-by:
-
David Miller authored
I have a new PCI-E radeon RV380 series card (PCI device ID 5b64) that hangs in my sparc64 boxes when the init scripts set the font. The problem goes away if I disable acceleration. I haven't figured out that bug yet, but along the way I found some corrections to make based upon some auditing. 1) The RB2D_DC_FLUSH_ALL value used by the kernel fb driver and the XORG video driver differ. I've made the kernel match what XORG is using. 2) In radeonfb_engine_reset() we have top-level code structure that roughly looks like: if (family is 300, 350, or V350) do this; else do that; ... if (family is NOT 300, OR family is NOT 350, OR family is NOT V350) do another thing; this last conditional makes no sense, is always true, and obviously was likely meant to be "family is NOT 300, 350, or V350". So I've made the code match the intent. Signed-off-by:
-
Mark Asselstine authored
These functions have been deprecated for some time now but remained until all legacy callers could be removed. With a few commits in 2.6.26 this has happened so now we can remove these deprecated functions. Signed-off-by:
Mark Asselstine <mark.asselstine@windriver.com> Reviewed-by:
Matthew Wilcox <willy@linux.intel.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: Ingo Molnar <mingo@elte.hu> Signed-off-by:
-
Ben Dooks authored
Add the missing MODULE_ALIAS() to the pwm_backlight driver. Cc: Russell King <rmk@arm.linux.org.uk> Signed-off-by:
Ben Dooks <ben-linux@fluff.org> Cc: Richard Purdie <rpurdie@rpsys.net> Signed-off-by:
-
Ben Dooks authored
Make the error paths in the pwm_backlight driver more informative in the probe path, especially for the times that it finds an error. Cc: Russell King <rmk@arm.linux.org.uk> Signed-off-by:
-
Mike Frysinger authored
blackfin RTC driver: drop PIE/stopwatch code since the hardware can only do a max of 1HZ and this same functionality is provided by UIE Signed-off-by:
Mike Frysinger <vapier.adi@gmail.com> Signed-off-by:
Bryan Wu <cooloney@kernel.org> Cc: David Brownell <david-b@pacbell.net> Cc: Alessandro Zummo <a.zummo@towertech.it> Signed-off-by:
-
Mike Frysinger authored
Signed-off-by:
-
Mike Frysinger authored
Since we use the write complete interrupt, wait for it to complete before sleeping so we don't wake right back up due to it Signed-off-by:
-
Mike Frysinger authored
Signed-off-by:
-
Mike Frysinger authored
blackfin RTC driver: don't bother passing the rtc struct down to bfin_rtc_int_{set,clear} since it isnt needed (shaves off ~100bytes) Signed-off-by:Bryan Wu <bryan.wu@analog.com> Signed-off-by:
-
Mike Frysinger authored
Signed-off-by:
-
Sonic Zhang authored
Signed-off-by:
Sonic Zhang <sonic.zhang@analog.com> Signed-off-by:
-
Mike Frysinger authored
blackfin RTC driver: if we dont define irq_set_freq, the common rtc-dev layer will give us the same behavior of returning ENOTTY Signed-off-by:
Mike Frysinger <michael.frysinger@analog.com> Signed-off-by:
-
