1. 19 Dec, 2012 17 commits
  2. 18 Dec, 2012 6 commits
  3. 17 Dec, 2012 3 commits
    • Vladimir Kondratiev's avatar
      wireless: fix Atheros drivers compilation · 009b9696
      Vladimir Kondratiev authored
      Bug introduced in commit:
      wireless: allow Atheros card to not depend on ath.ko
      
      Commit in question changed CONFIG_ATH_COMMON to CONFIG_ATH_CARDS as
      "Atheros card" indication in drivers/net/wireless/ath/Kconfig but it
      is used also by drivers/net/wireless/Makefile
      
      If there are only Atheros cards that do not require ATH_COMMON, whole
      Makefile for Atheros cards was not executed; and as result, driver
      won't compile in this case.
      
      Change in CONFIG_ option name should be reflected in the
      drivers/net/wireless/Makefile
      Signed-off-by: default avatarVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
      Tested-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      009b9696
    • Gabor Juhos's avatar
      rt2x00: zero-out rx_status · 028014c8
      Gabor Juhos authored
      In commit 'mac80211: support radiotap vendor namespace RX data'
      new fields were added to 'struct ieee80211_rx_status' and those
      fileds must be zeroed. However the rt2x00 driver stores driver
      specific data in the cb array of the rx skbs, so the fields
      might contain garbage and this can cause unexpected behaviour.
      
      The rt2x00 driver from the compat-wireless-2012-12-01
      tarball caused the following warning:
      
        WARNING: at
        /devel/ramips/build_dir/target-mipsel_r2_uClibc-0.9.33.2/linux-ramips_rt305x/
        compat-wireless-2012-12-01/net/mac80211/rx.c:115 ieee80211_rx_irqsafe+0x274/0xbcc
        [mac80211]()
        Modules linked in: dwc_otg ledtrig_usbdev nf_nat_irc
        nf_nat_ftp nf_conntrack_irc nf_conntrack_ftp ipt_MASQUERADE
        iptable_nat nf_nat pppoe xt_conntrack xt_CT xt_NOTRACK iptable_raw
        xt_state nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack pppox
        ipt_REJECT xt_TCPMSS xt_comment xt_multiport xt_mac xt_limit
        iptable_mangle iptable_filter ip_tables xt_tcpudp x_tables ppp_async
        ppp_generic slhc rt2800pci(O) rt2800lib(O) rt2x00soc(O) rt2x00pci(O)
        rt2x00lib(O) mac80211(O) usbcore usb_common nls_base crc_itu_t
        crc_ccitt eeprom_93cx6 cfg80211(O) compat(O) arc4 aes_generic
        crypto_blkcipher cryptomgr aead crypto_hash crypto_algapi leds_gpio
        button_hotplug(O) gpio_keys_polled input_polldev input_core
        Call Trace:
        [<801e96b4>] dump_stack+0x8/0x34
        [<80010a9c>] warn_slowpath_common+0x78/0xa4
        [<80010ae0>] warn_slowpath_null+0x18/0x24
        [<80a9710c>] ieee80211_rx_irqsafe+0x274/0xbcc [mac80211]
      
      The patch ensures that each field gets initialized with
      zeroes.
      
      Cc: <users@rt2x00.serialmonkey.com>
      Signed-off-by: default avatarGabor Juhos <juhosg@openwrt.org>
      Acked-by: default avatarGertjan van Wingerde <gwingerde@gmail.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      028014c8
    • Eric Dumazet's avatar
      tuntap: reset network header before calling skb_get_rxhash() · 76fe4581
      Eric Dumazet authored
      Commit 49974420 (tuntap: dont use skb after netif_rx_ni(skb))
      introduced another bug.
      
      skb_get_rxhash() needs to access the network header, and it was
      set for us in netif_rx_ni().
      
      We need to reset network header or else skb_flow_dissect() behavior
      is out of control.
      Reported-and-tested-by: default avatarKirill A. Shutemov <kirill@shutemov.name>
      Tested-by: default avatarDaniel Borkmann <daniel.borkmann@tik.ee.ethz.ch>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      76fe4581
  4. 16 Dec, 2012 7 commits
  5. 14 Dec, 2012 7 commits
    • Tony Lindgren's avatar
      cpts: Fix build error caused by include of plat/clock.h · e133b539
      Tony Lindgren authored
      Commit 87c0e764 (cpts: introduce time stamping code and a PTP hardware clock)
      mistakenly included plat/clock.h that should not be included by drivers
      even if it exists.
      
      Otherwise we get the following error with at least omap2plus_defconfig:
      
      drivers/net/ethernet/ti/cpts.c:30:24: error: plat/clock.h: No such file or directory
      
      Signed-off-by: Tony Lindgren <tony@atomide.com
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e133b539
    • Christoph Paasch's avatar
      inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock · e337e24d
      Christoph Paasch authored
      If in either of the above functions inet_csk_route_child_sock() or
      __inet_inherit_port() fails, the newsk will not be freed:
      
      unreferenced object 0xffff88022e8a92c0 (size 1592):
        comm "softirq", pid 0, jiffies 4294946244 (age 726.160s)
        hex dump (first 32 bytes):
          0a 01 01 01 0a 01 01 02 00 00 00 00 a7 cc 16 00  ................
          02 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00  ................
        backtrace:
          [<ffffffff8153d190>] kmemleak_alloc+0x21/0x3e
          [<ffffffff810ab3e7>] kmem_cache_alloc+0xb5/0xc5
          [<ffffffff8149b65b>] sk_prot_alloc.isra.53+0x2b/0xcd
          [<ffffffff8149b784>] sk_clone_lock+0x16/0x21e
          [<ffffffff814d711a>] inet_csk_clone_lock+0x10/0x7b
          [<ffffffff814ebbc3>] tcp_create_openreq_child+0x21/0x481
          [<ffffffff814e8fa5>] tcp_v4_syn_recv_sock+0x3a/0x23b
          [<ffffffff814ec5ba>] tcp_check_req+0x29f/0x416
          [<ffffffff814e8e10>] tcp_v4_do_rcv+0x161/0x2bc
          [<ffffffff814eb917>] tcp_v4_rcv+0x6c9/0x701
          [<ffffffff814cea9f>] ip_local_deliver_finish+0x70/0xc4
          [<ffffffff814cec20>] ip_local_deliver+0x4e/0x7f
          [<ffffffff814ce9f8>] ip_rcv_finish+0x1fc/0x233
          [<ffffffff814cee68>] ip_rcv+0x217/0x267
          [<ffffffff814a7bbe>] __netif_receive_skb+0x49e/0x553
          [<ffffffff814a7cc3>] netif_receive_skb+0x50/0x82
      
      This happens, because sk_clone_lock initializes sk_refcnt to 2, and thus
      a single sock_put() is not enough to free the memory. Additionally, things
      like xfrm, memcg, cookie_values,... may have been initialized.
      We have to free them properly.
      
      This is fixed by forcing a call to tcp_done(), ending up in
      inet_csk_destroy_sock, doing the final sock_put(). tcp_done() is necessary,
      because it ends up doing all the cleanup on xfrm, memcg, cookie_values,
      xfrm,...
      
      Before calling tcp_done, we have to set the socket to SOCK_DEAD, to
      force it entering inet_csk_destroy_sock. To avoid the warning in
      inet_csk_destroy_sock, inet_num has to be set to 0.
      As inet_csk_destroy_sock does a dec on orphan_count, we first have to
      increase it.
      
      Calling tcp_done() allows us to remove the calls to
      tcp_clear_xmit_timer() and tcp_cleanup_congestion_control().
      
      A similar approach is taken for dccp by calling dccp_done().
      
      This is in the kernel since 093d2823 (tproxy: fix hash locking issue
      when using port redirection in __inet_inherit_port()), thus since
      version >= 2.6.37.
      Signed-off-by: default avatarChristoph Paasch <christoph.paasch@uclouvain.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e337e24d
    • Duan Jiong's avatar
      ipv6: Change skb->data before using icmpv6_notify() to propagate redirect · 093d04d4
      Duan Jiong authored
      In function ndisc_redirect_rcv(), the skb->data points to the transport
      header, but function icmpv6_notify() need the skb->data points to the
      inner IP packet. So before using icmpv6_notify() to propagate redirect,
      change skb->data to point the inner IP packet that triggered the sending
      of the Redirect, and introduce struct rd_msg to make it easy.
      Signed-off-by: default avatarDuan Jiong <djduanjiong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      093d04d4
    • Konstantin Khlebnikov's avatar
      mac802154: fix destructon ordering for ieee802154 devices · 1e9f9545
      Konstantin Khlebnikov authored
      mutex_destroy() must be called before wpan_phy_free(), because it puts the last
      reference and frees memory. Catched as overwritten poison in kmalloc-2048.
      Signed-off-by: default avatarKonstantin Khlebnikov <khlebnikov@openvz.org>
      Cc: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
      Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: linux-zigbee-devel@lists.sourceforge.net
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1e9f9545
    • Konstantin Khlebnikov's avatar
      bonding: do not cancel works in bond_uninit() · cfb6f99d
      Konstantin Khlebnikov authored
      Bonding initializes these works in bond_open() and cancels in bond_close(),
      thus in bond_uninit() they are already canceled but may be unitialized yet.
      Signed-off-by: default avatarKonstantin Khlebnikov <khlebnikov@openvz.org>
      Cc: Nikolay Aleksandrov <nikolay@redhat.com>
      Cc: Jay Vosburgh <fubar@us.ibm.com>
      Cc: Andy Gospodarek <andy@greyhouse.net>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cfb6f99d
    • Konstantin Khlebnikov's avatar
      stmmac: fix platform driver unregistering · 493682b8
      Konstantin Khlebnikov authored
      This patch fixes platform device drivers unregistering and adds proper error
      handing on module loading.
      Signed-off-by: default avatarKonstantin Khlebnikov <khlebnikov@openvz.org>
      Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      493682b8
    • Konstantin Khlebnikov's avatar
      mISDN: fix race in timer canceling on module unloading · 4a0ae7b0
      Konstantin Khlebnikov authored
      Using timer_pending() without additional syncronization is racy,
      del_timer_sync() must be used here for waiting in-flight handler.
      Bug caught with help from "debug-objects" during random insmod/rmmod.
      Signed-off-by: default avatarKonstantin Khlebnikov <khlebnikov@openvz.org>
      Cc: Karsten Keil <isdn@linux-pingi.de>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: netdev <netdev@vger.kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4a0ae7b0