- 22 Apr, 2009 9 commits
-
-
Jean Delvare authored
Patch "af_rose/x25: Sanity check the maximum user frame size" (commit 83e0bbcb) from Alan Cox got locking wrong. If we bail out due to user frame size being too large, we must unlock the socket beforehand. Signed-off-by:
Jean Delvare <jdelvare@suse.de> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Paul Moore authored
The NetLabel address selector mechanism has a problem where it can get mistakenly remove the wrong selector when similar addresses are used. The problem is caused when multiple addresses are configured that have different netmasks but the same address, e.g. 127.0.0.0/8 and 127.0.0.0/24. This patch fixes the problem. Reported-by:
Etienne Basset <etienne.basset@numericable.fr> Signed-off-by:
Paul Moore <paul.moore@hp.com> Acked-by:
James Morris <jmorris@namei.org> Tested-by:
-
Heiko Schocher authored
If using the UCC on a MPC8360 in RMII mode, don;t set UCC_GETH_UPSMR_RPM bit in the upsmr register. Signed-off-by:
Heiko Schocher <hs@denx.de> Acked-by:
Li Yang <leoli@freescale.com> Signed-off-by:
-
Jianjun kong authored
While ifconfig eth0 up kernel calls open() of 8139 driver(8139too.c). In rtl8139_hw_start() of rtl8139_open(), 8139 driver enable RX before setting up the DMA buffer address. In this interval where RX was enabled and DMA buffer address is not yet set up, any incoming broadcast packet would be send to a strange physical address: 0x003e8800 which is the default value of DMA buffer address. Unfortunately, this address is used by Linux kernel. So kernel panics. This patch fix it by setting up DMA buffer address before RX enabled and everything is fine even under broadcast packets attack. Signed-off-by:
Jonathan Lin <jon.lin@vatics.com> Signed-off-by:
Amos Kong <jianjun@zeuux.org> Signed-off-by:
Eric Dumazet <dada1@cosmosbay.com> Signed-off-by:
-
Hendrik Brueckner authored
AF_IUCV runs into a race when queuing incoming iucv messages and receiving the resulting backlog. If the Linux system is under pressure (high load or steal time), the message queue grows up, but messages are not received and queued onto the backlog queue. In that case, applications do not receive any data with recvmsg() even if AF_IUCV puts incoming messages onto the message queue. The race can be avoided if the message queue spinlock in the message_pending callback is spreaded across the entire callback function. Signed-off-by:
Hendrik Brueckner <brueckner@linux.vnet.ibm.com> Signed-off-by:
Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by:
-
Hendrik Brueckner authored
Add few more sk states in iucv_sock_shutdown(). Signed-off-by:
-
Hendrik Brueckner authored
Reject incoming iucv messages if the receive direction has been shut down. It avoids that the queue of outstanding messages increases and exceeds the message limit of the iucv communication path. Signed-off-by:
-
Hendrik Brueckner authored
If iucv_sock_recvmsg() is called with MSG_PEEK flag set, the skb is enqueued twice. If the socket is then closed, the pointer to the skb is freed twice. Remove the skb_queue_head() call for MSG_PEEK, because the skb_recv_datagram() function already handles MSG_PEEK (does not dequeue the skb). Signed-off-by:
-
Ursula Braun authored
Make sure a second invocation of iucv_sock_close() guarantees proper freeing of an iucv path. Signed-off-by:
-
- 21 Apr, 2009 15 commits
-
-
Reinette Chatre authored
A few issues wrt DMA were uncovered when using the driver with swiotlb. - driver should not use memory after it has been mapped - iwl3945's RX queue management cannot use all of iwlagn because the size of the RX buffer is different. Revert back to using iwl3945 specific routines that map/unmap memory. - no need to "dma_syn_single_range_for_cpu" followed by pci_unmap_single, we can just call pci_unmap_single initially - only map the memory area that will be used by device. this is especially relevant to the mapping of iwl_cmd. we should not map the entire structure because the meta data at the beginning of structure contains the address to be used later for unmapping. If the address to be used for unmapping is stored in mapped data it creates a problem. - ensure that _if_ memory needs to be modified after it is mapped that we call _sync_single_for_cpu first, and then release it back to device with _sync_single_for_device - we mapped the wrong length of data for host commands, with mapped length differing with length provided to device, fix that. Thanks to Jason Andryuk <jandryuk@gmail.com> for significant bisecting help to find these issues. This fixes http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1964Signed-off-by:
Reinette Chatre <reinette.chatre@intel.com> Tested-by:
Jason Andryuk <jandryuk@gmail.com> Tested-by:
Ben Gamari <bgamari@gmail.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Reinette Chatre authored
When debugging TX issues it is helpful to know the seq nr of the frame being transmitted. The seq nr is printed as part of ucode's log informing us which frame is being processed. Having this information printed in driver log makes it easy to match activities between driver and firmware. Also make possible to print TX flags directly. These are already printed as part of entire TX command, but having it printed directly in cpu format makes it easier to look at. Signed-off-by:
-
Rami Rosen authored
This patch fixes a build warning in mwl8.c. (Marvell TOPDOG wireless driver) The warning it fixes is: "large integer implicitly truncated to unsigned type." The rx_ctrl member of the mwl8k_rx_desc struct is 8 bit (__u8 ), whereas trying to assign it a 32 bit value (which is returned from cpu_to_le32()) causes the compiler to issue a truncation warning. Signed-off-by:
Rami Rosen <ramirose@gmail.com> Signed-off-by:
-
Johannes Berg authored
When checking whether or not a given frame needs to be moved to be properly aligned to a 4-byte boundary, we use & 4 which wasn't intended, this code should check the lowest two bits. Signed-off-by:
Johannes Berg <johannes@sipsolutions.net> Signed-off-by:
-
Reinette Chatre authored
It is expected that config interface will always succeed as mac80211 will only request what driver supports. The exception here is when a device has rfkill enabled. At this time the rfkill state is unknown to mac80211 and config interface can fail. When this happens we deal with this error instead of printing a WARN. Signed-off-by:
-
Reinette Chatre authored
Users reported lockup with work still trying to run after module has been unloaded. http://thread.gmane.org/gmane.linux.kernel.wireless.general/30594/focus=30601Signed-off-by:
TJ <ubuntu@tjworld.net> Reported-by:
Huaxu Wan <huaxu.wan@linux.intel.com> Signed-off-by:
-
Jay Sternberg authored
Fix the bug where some revisions of 6000 series hardware cannot be used. Later versions of 6000 series have the EEPROM replaced by OTP. For these devices to be used we need to expand valid EEPROM mask. Signed-off-by:
Jay Sternberg <jay.e.sternberg@linux.intel.com> Signed-off-by:
-
Johannes Berg authored
sparse says: drivers/net/wireless/atmel.c:1501:3: warning: Initializer entry defined twice drivers/net/wireless/atmel.c:1505:3: also defined here and it's correct; atmel has its own ndo_change_mtu and shouldn't use eth_change_mtu. Signed-off-by:
-
Ken Kawasaki authored
pcnet_cs: add cis(firmware) of the Allied Telesis LA-PCM Signed-off-by:
Ken Kawasaki <ken_kawasaki@spring.nifty.jp> Signed-off-by:
-
Roland Dreier authored
If creating a workqueue fails, don't jump to the error path where that same workqueue is destroyed, since destroy_workqueue() can't handle a NULL pointer. This was spotted by the Coverity checker (CID 2617). Signed-off-by:
Roland Dreier <rolandd@cisco.com> Signed-off-by:
-
Yevgeny Petrilin authored
The per ring counters are implemented in SW. Now moving to have the total counters as the sum of all rings. This way the numbers will always be consistent and we no longer depend on HW buffer size limitations for those counters that can be insufficient in some cases. Signed-off-by:
Yevgeny Petrilin <yevgenyp@mellanox.co.il> Signed-off-by:
-
Yevgeny Petrilin authored
The former usage was to set the NETIF_F_HW_CSUM flag which is not used in get_tx_csum. It caused Ethtool to show tx checksum as "on" even though it was turned off in previous operation. Signed-off-by:
-
Yevgeny Petrilin authored
The low level driver always assumes this handler exists. The lack of it could cause kernel panic Signed-off-by:
-
Yevgeny Petrilin authored
The query whether the port is up or not should be done at the execution of the restart task and not when it is queued. Signed-off-by:
-
Yevgeny Petrilin authored
In case of failure of either srq creation or page allocation, the cleanup code handled the failed ring as well, and tried to destroy resources that where not allocated. Signed-off-by:
-
- 20 Apr, 2009 16 commits
-
-
-
Matt Carlson authored
The recent NVRAM patches sanitized how the driver deals with NVRAM data, but they failed to bring the SEEPROM interfaces inline with the new strategy. This patch brings the SEEPROM interfaces up to date. This patch also reverts commit 0d489ffb ("tg3: fix big endian MAC address collection failure"). Signed-off-by:
Matt Carlson <mcarlson@broadcom.com> Signed-off-by:
Michael Chan <mchan@broadcom.com> Tested-by:
Robin Holt <holt@sgi.com> Tested-by:
James Bottomley <james.bottomley@HansenPartnership.com> Signed-off-by:
-
Johannes Berg authored
"mac80211: fix basic rates setting from association response" introduced a copy/paste error. Unfortunately, this not just leads to wrong data being passed to the driver but is remotely exploitable for some hardware or driver combinations. Signed-off-by:
-
Kalle Valo authored
Currently beacon loss detection triggers after a scan. A probe request is sent and a message like this is printed to the log: wlan0: beacon loss from AP 00:12:17:e7:98:de - sending probe request But in fact there is no beacon loss, the beacons are just not received because of the ongoing scan. Fix it by updating last_beacon after the scan has finished. Reported-by:
Jaswinder Singh Rajput <jaswinder@kernel.org> Signed-off-by:
Kalle Valo <kalle.valo@iki.fi> Acked-by:
-
Jouni Malinen authored
One of the code paths sending deauth/disassoc events ends up calling this function with rcu_read_lock held, so we must use GFP_ATOMIC in allocation routines. Reported-by:
Jouni Malinen <j@w1.fi> Signed-off-by:
-
Christian Lamparter authored
This patch fixes a hang on resume when the filesystem is not available and request_firmware blocks. However, the device does not accept the firmware on resume. and it will exit with: > firmware part 1 upload failed (-71). > device is in a bad state. please reconnect it! Reported-by:
Christian Lamparter <chunkeey@web.de> Signed-off-by:
-
Robert P. J. Day authored
Remove this unused Kconfig variable, which Intel apparently once promised to make use of but never did. Signed-off-by:
Robert P. J. Day <rpjday@crashcourse.ca> Acked-by:
-
Joerg Albert authored
swap mwl8k_remove and mwl8k_shutdown functions to allow "rmmod mwl8k; modprobe mwl8k" Signed-off-by:
Joerg Albert <jal2@gmx.de> Signed-off-by:
-
Christian Lamparter authored
This patch deactivates powersave in station mode. It does not work correctly yet, so the code does more harm than good. Reported-by:
-
Joe Perches authored
"not" is not printed without a space after %pM Signed-off-by:
Joe Perches <joe@perches.com> Signed-off-by:
-
Ivo van Doorn authored
After suspend & resume the rt2x00 devices won't wakeup anymore due to a broken register information setup. The most important problem is the release of the EEPROM buffer which is completely cleared and never read again after the suspend. Signed-off-by:
Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by:
-
Herbert Xu authored
As the sk_sleep wait queue actually lives in tfile, which may be detached from the tun device, bad things will happen when we use sk_sleep after detaching. Since the tun device is the persistent data structure here (when requested by the user), it makes much more sense to have the wait queue live there. There is no reason to have it in tfile at all since the only time we can wait is if we have a tun attached. In fact we already have a wait queue in tun_struct, so we might as well use it. Reported-by:
Eric W. Biederman <ebiederm@xmission.com> Tested-by:
Christian Borntraeger <borntraeger@de.ibm.com> Tested-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Herbert Xu authored
The commit c70f1829 ("tun: Fix races between tun_net_close and free_netdev") fixed a race where an asynchronous deletion of a tun device can hose a poll(2) on a tun fd attached to that device. However, this came at the cost of moving the tun wait queue into the tun file data structure. The problem with this is that it imposes restrictions on when and where the tun device can access the wait queue since the tun file may change at any time due to detaching and reattaching. In particular, now that we need to use the wait queue on the receive path it becomes difficult to properly synchronise this with the detachment of the tun device. This patch solves the original race in a different way. Since the race is only because the underlying memory gets freed, we can prevent it simply by ensuring that we don't do that until all tun descriptors ever attached to the device (even if they have since be detached because they may still be sitting in poll) have been closed. This is done by using reference counting the attached tun file descriptors. The refcount in tun->sk has been reappropriated for this purpose since it was already being used for that, albeit from the opposite angle. Note that we no longer zero tfile->tun since tun_get will return NULL anyway after the refcount on tfile hits zero. Instead it represents whether this device has ever been attached to a device. Signed-off-by:
-
Ben Hutchings authored
This loop over fragments in napi_fraginfo_skb() was "interesting". Signed-off-by:
Ben Hutchings <bhutchings@solarflare.com> Signed-off-by:
-
-
Marcin Slusarz authored
Signed-off-by:
Marcin Slusarz <marcin.slusarz@gmail.com> Signed-off-by:
-
