- 11 Oct, 2010 14 commits
-
-
David S. Miller authored
Conflicts: net/core/ethtool.c
-
Kees Cook authored
Several other ethtool functions leave heap uncleared (potentially) by drivers. Some interfaces appear safe (eeprom, etc), in that the sizes are well controlled. In some situations (e.g. unchecked error conditions), the heap will remain unchanged in areas before copying back to userspace. Note that these are less of an issue since these all require CAP_NET_ADMIN. Cc: stable@kernel.org Signed-off-by:
Kees Cook <kees.cook@canonical.com> Acked-by:
Ben Hutchings <bhutchings@solarflare.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Jiri Slaby authored
Stanse found that pch_gbe_xmit_frame uses skb after it is freed. Fix that. Signed-off-by:
Jiri Slaby <jslaby@suse.cz> Cc: Masayuki Ohtake <masa-korg@dsn.okisemi.com> Acked-by:
Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by:
-
Jiri Slaby authored
Stanse found that i2400m_rx frees skb, but still uses skb->len even though it has skb_len defined. So use skb_len properly in the code. And also define it unsinged int rather than size_t to solve compilation warnings. Signed-off-by:
Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> Signed-off-by:
-
Jiri Slaby authored
Stanse found that ia_init_one locks a spinlock and inside of that it calls ia_start which calls: * request_irq * tx_init which does kmalloc(GFP_KERNEL) Both of them can thus sleep and result in a deadlock. I don't see a reason to have a per-device spinlock there which is used only there and inited right before the lock location. So remove it completely. Signed-off-by:
-
Jiri Slaby authored
Stanse found that mpc_push frees skb and then it dereferences it. It is a typo, new_skb should be dereferenced there. Signed-off-by:
-
Jiri Slaby authored
Stanse found we do in console_show: kfree_skb(skb); return skb->len; which is not good. Fix that by remembering the len and use it in the function instead. Signed-off-by:
-
Eric Dumazet authored
When a new dst is used to send a frame, neigh_resolve_output() tries to associate an struct hh_cache to this dst, calling neigh_hh_init() with the neigh rwlock write locked. Most of the time, hh_cache is already known and linked into neighbour, so we find it and increment its refcount. This patch changes the logic so that we call neigh_hh_init() with neighbour lock read locked only, so that fast path can be run in parallel by concurrent cpus. This brings part of the speedup we got with commit c7d4426a (introduce DST_NOCACHE flag) for non cached dsts, even for cached ones, removing one of the contention point that routers hit on multiqueue enabled machines. Further improvements would need to use a seqlock instead of an rwlock to protect neigh->ha[], to not dirty neigh too often and remove two atomic ops. Signed-off-by:
-
Oskar Schirmer authored
with hardware slow in negotiation, the system did freeze while trying to mount root on nfs at boot time. the link state has not been initialised so network stack tried to start transmission right away. this caused instant retries, as the driver solely stated business upon link down, rendering the system unusable. notify carrier off initially to prevent transmission until phylib will report link up. Signed-off-by:
Oskar Schirmer <oskar@linutronix.de> Signed-off-by:
-
Samuel Ortiz authored
While parsing the GetValuebyClass command frame, we could potentially write passed the skb->data pointer. Cc: stable@kernel.org Reported-by:
Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by:
Samuel Ortiz <samuel@sortiz.org>
-
Samuel Ortiz authored
Cc: stable@kernel.org Reported-by:
-
Roel Kluin authored
Test whether index exceeds fw->size before reading the element Signed-off-by:
Roel Kluin <roel.kluin@gmail.com> Signed-off-by:
-
Samuel Ortiz authored
The code intends to lock the irnet_socket, so adding a mutex to it allows for a complet BKL removal. Signed-off-by: -
Samuel Ortiz authored
Most of the times, lock_kernel() was pointless or could simply be replaced by lock_sock(). Signed-off-by:
-
- 09 Oct, 2010 6 commits
-
-
Eric Dumazet authored
sundance get_stats() should not be run concurrently, add a lock to avoid potential losses. Note: Remove unused rx_lock field Signed-off-by:
-
Nicolas Kaiser authored
Simplify: ((a && !b) || (!a && b)) => (a != b) Signed-off-by:
Nicolas Kaiser <nikai@nikai.net> Signed-off-by:
-
Nicolas Kaiser authored
Simplify: ((a && b) || (!a && !b)) => (a == b) Signed-off-by:
Breno Leitao <leitao@linux.vnet.ibm.com> Signed-off-by:
-
Changli Gao authored
Signed-off-by:
Changli Gao <xiaosuo@gmail.com> Signed-off-by:
-
Stanislaw Gruszka authored
Use DMA API as PCI equivalents will be deprecated. This change also allow to allocate with GFP_KERNEL where possible. Tested-by:
Neal Becker <ndbecker2@gmail.com> Signed-off-by:
Stanislaw Gruszka <sgruszka@redhat.com> Acked-by:
-
Stanislaw Gruszka authored
We have fedora bug report where driver fail to initialize after suspend/resume because of memory allocation errors: https://bugzilla.redhat.com/show_bug.cgi?id=629158 To fix use GFP_KERNEL allocation where possible. Tested-by:
-
- 08 Oct, 2010 20 commits
-
-
Tom Herbert authored
The rx->count reference is used to track reference counts to the number of rx-queue kobjects created for the device. This patch eliminates initialization of the counter in netif_alloc_rx_queues and instead increments the counter each time a kobject is created. This is now symmetric with the decrement that is done when an object is released. Signed-off-by:
Tom Herbert <therbert@google.com> Acked-by:
-
Rémi Denis-Courmont authored
There are a bunch of issues that need to be fixed, including: - GFP_KERNEL allocations from atomic context (and GFP_ATOMIC in process context), - abuse of the setsockopt() call convention, - unprotected/unlocked static variables... IMHO, we will need to alter the userspace ABI when we fix it. So mark the configuration option as EXPERIMENTAL for the time being (or should it be BROKEN instead?). Signed-off-by:
Rémi Denis-Courmont <remi.denis-courmont@nokia.com> Signed-off-by:
-
Rémi Denis-Courmont authored
The current code works like this: int garbage, status; socklen_t len = sizeof(status); /* enable pipe */ setsockopt(fd, SOL_PNPIPE, PNPIPE_ENABLE, &garbage, sizeof(garbage)); /* disable pipe */ setsockopt(fd, SOL_PNPIPE, PNPIPE_DISABLE, &garbage, sizeof(garbage)); /* get status */ getsockopt(fd, SOL_PNPIPE, PNPIPE_INQ, &status, &len); ...which does not follow the usual socket option pattern. This patch merges all three "options" into a single gettable&settable option, before Linux 2.6.37 gets out: int status; socklen_t len = sizeof(status); /* enable pipe */ status = 1; setsockopt(fd, SOL_PNPIPE, PNPIPE_ENABLE, &status, sizeof(status)); /* disable pipe */ status = 0; setsockopt(fd, SOL_PNPIPE, PNPIPE_ENABLE, &status, sizeof(status)); /* get status */ getsockopt(fd, SOL_PNPIPE, PNPIPE_ENABLE, &status, &len); This also fixes the error code from EFAULT to ENOTCONN. Signed-off-by:
-
Rémi Denis-Courmont authored
As it currently is, the new code path is not compatible with existing Nokia modems. This would break existing userspace for Nokia modem, such as the existing oFono ISI driver. Signed-off-by:
-
Rémi Denis-Courmont authored
Signed-off-by:
-
Amit Kumar Salecha authored
Signed-off-by:
Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by:
-
Sritej Velaga authored
This patch just rename all P3 #define to P3P. Signed-off-by:
Sritej Velaga <sritej.velaga@qlogic.com> Signed-off-by:
-
Rajesh Borundia authored
o Allow promiscous mode setting for VF's depending upon the configuration. Signed-off-by:
Rajesh Borundia <rajesh.borundia@qlogic.com> Signed-off-by:
-
Sritej Velaga authored
Remove "Flex-10" from board description. Signed-off-by:
-
Amit Kumar Salecha authored
LRO was not getting enable after interface down/up. Signed-off-by:
-
Amit Kumar Salecha authored
Put device in quiescent mode during internal loopback test. Before running test, set state to NEED_QUISCENT. After getting ack from all function, change state to QUISCENT and perform test. Signed-off-by:
-
Amit Kumar Salecha authored
Currently fw recovery usage global workqueue. As same workqueue used by kernel for ethtool and etc., supporting quiescent mode is not possible, without driver private workqueue. Signed-off-by:
-
David S. Miller authored
Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6
-
John W. Linville authored
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem Conflicts: Documentation/feature-removal-schedule.txt drivers/net/wireless/ipw2x00/ipw2200.c
-
Dimitris Michailidis authored
Commit "fib: RCU conversion of fib_lookup()" removed rcu_read_lock() from __mkroute_output but left a couple of calls to rcu_read_unlock() in there. This causes lockdep to complain that the rcu_read_unlock() call in __ip_route_output_key causes a lock inbalance and quickly crashes the kernel. The below fixes this for me. Signed-off-by:
Dimitris Michailidis <dm@chelsio.com> Acked-by:
-
Kees Cook authored
Calling ETHTOOL_GRXCLSRLALL with a large rule_cnt will allocate kernel heap without clearing it. For the one driver (niu) that implements it, it will leave the unused portion of heap unchanged and copy the full contents back to userspace. Signed-off-by:
-
-
Ben Hutchings authored
The filter engine will time-out and ignore filters beyond 200-something hops. We also need to avoid infinite loops in efx_filter_search() when the table is full. Signed-off-by:
-
Ben Hutchings authored
Synchronise the comment with the preceding implementation change. Signed-off-by:
-
Dan Carpenter authored
setup.phone and setup.eazmsn are 32 character buffers. rcvmsg.msg_data.byte_array is a 48 character buffer. sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn is 50 chars. The rcvmsg struct comes from the memcpy_fromio() in receivemessage(). I guess that means it's data off the wire. I'm not very familiar with this code but I don't see any reason to assume these strings are NULL terminated. Also it's weird that "dn" in a 50 character buffer but we only seem to use 32 characters. In drivers/isdn/sc/scioc.h, "dn" is only a 49 character buffer. So potentially there is still an issue there. The important thing for now is to prevent the memory corruption. Signed-off-by:
Dan Carpenter <error27@gmail.com> Signed-off-by:
-
