- 13 May, 2010 1 commit
-
-
Bart De Schuymer authored
[ 4593.956206] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 [ 4593.956219] IP: [<ffffffffa03357a4>] br_nf_forward_finish+0x154/0x170 [bridge] [ 4593.956232] PGD 195ece067 PUD 1ba005067 PMD 0 [ 4593.956241] Oops: 0000 [#1] SMP [ 4593.956248] last sysfs file: /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:08/ATK0110:00/hwmon/hwmon0/temp2_label [ 4593.956253] CPU 3 ... [ 4593.956380] Pid: 29512, comm: kvm Not tainted 2.6.34-rc7-net #195 P6T DELUXE/System Product Name [ 4593.956384] RIP: 0010:[<ffffffffa03357a4>] [<ffffffffa03357a4>] br_nf_forward_finish+0x154/0x170 [bridge] [ 4593.956395] RSP: 0018:ffff880001e63b78 EFLAGS: 00010246 [ 4593.956399] RAX: 0000000000000608 RBX: ffff880057181700 RCX: ffff8801b813d000 [ 4593.956402] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff880057181700 [ 4593.956406] RBP: ffff880001e63ba8 R08: ffff8801b9d97000 R09: ffffffffa0335650 [ 4593.956410] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801b813d000 [ 4593.956413] R13: ffffffff81ab3940 R14: ffff880057181700 R15: 0000000000000002 [ 4593.956418] FS: 00007fc40d380710(0000) GS:ffff880001e60000(0000) knlGS:0000000000000000 [ 4593.956422] CS: 0010 DS: 002b ES: 002b CR0: 000000008005003b [ 4593.956426] CR2: 0000000000000018 CR3: 00000001ba1d7000 CR4: 00000000000026e0 [ 4593.956429] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4593.956433] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 4593.956437] Process kvm (pid: 29512, threadinfo ffff8801ba566000, task ffff8801b8003870) [ 4593.956441] Stack: [ 4593.956443] 0000000100000020 ffff880001e63ba0 ffff880001e63ba0 ffff880057181700 [ 4593.956451] <0> ffffffffa0335650 ffffffff81ab3940 ffff880001e63bd8 ffffffffa03350e6 [ 4593.956462] <0> ffff880001e63c40 000000000000024d ffff880057181700 0000000080000000 [ 4593.956474] Call Trace: [ 4593.956478] <IRQ> [ 4593.956488] [<ffffffffa0335650>] ? br_nf_forward_finish+0x0/0x170 [bridge] [ 4593.956496] [<ffffffffa03350e6>] NF_HOOK_THRESH+0x56/0x60 [bridge] [ 4593.956504] [<ffffffffa0335282>] br_nf_forward_arp+0x112/0x120 [bridge] [ 4593.956511] [<ffffffff813f7184>] nf_iterate+0x64/0xa0 [ 4593.956519] [<ffffffffa032f920>] ? br_forward_finish+0x0/0x60 [bridge] [ 4593.956524] [<ffffffff813f722c>] nf_hook_slow+0x6c/0x100 [ 4593.956531] [<ffffffffa032f920>] ? br_forward_finish+0x0/0x60 [bridge] [ 4593.956538] [<ffffffffa032f800>] ? __br_forward+0x0/0xc0 [bridge] [ 4593.956545] [<ffffffffa032f86d>] __br_forward+0x6d/0xc0 [bridge] [ 4593.956550] [<ffffffff813c5d8e>] ? skb_clone+0x3e/0x70 [ 4593.956557] [<ffffffffa032f462>] deliver_clone+0x32/0x60 [bridge] [ 4593.956564] [<ffffffffa032f6b6>] br_flood+0xa6/0xe0 [bridge] [ 4593.956571] [<ffffffffa032f800>] ? __br_forward+0x0/0xc0 [bridge] Don't call nf_bridge_update_protocol() for ARP traffic as skb->nf_bridge isn't used in the ARP case. Reported-by:
Stephen Hemminger <shemminger@vyatta.com> Signed-off-by:
Bart De Schuymer <bdschuym@pandora.be> Signed-off-by:
Patrick McHardy <kaber@trash.net>
-
- 11 May, 2010 7 commits
-
-
-
Jan Engelhardt authored
Prepare the arrays for use with the multiregister function. The future layer-3 xt matches can then be easily added to it without needing more (un)register code. Signed-off-by:Jan Engelhardt <jengelh@medozas.de>
-
Jan Engelhardt authored
Since xt_action_param is writable, let's use it. The pointer to 'bool hotdrop' always worried (8 bytes (64-bit) to write 1 byte!). Surprisingly results in a reduction in size: text data bss filename 5457066 692730 357892 vmlinux.o-prev 5456554 692730 357892 vmlinux.o Signed-off-by: -
Jan Engelhardt authored
In future, layer-3 matches will be an xt module of their own, and need to set the fragoff and thoff fields. Adding more pointers would needlessy increase memory requirements (esp. so for 64-bit, where pointers are wider). Signed-off-by: -
Jan Engelhardt authored
Signed-off-by: -
Jan Engelhardt authored
The structures carried - besides match/target - almost the same data. It is possible to combine them, as extensions are evaluated serially, and so, the callers end up a little smaller. text data bss filename -15318 740 104 net/ipv4/netfilter/ip_tables.o +15286 740 104 net/ipv4/netfilter/ip_tables.o -15333 540 152 net/ipv6/netfilter/ip6_tables.o +15269 540 152 net/ipv6/netfilter/ip6_tables.o Signed-off-by: -
-
- 10 May, 2010 32 commits
-
-
Patrick McHardy authored
Restore the rcu_dereference() calls in conntrack/expectation notifier and logger registration/unregistration, but use the _protected variant, which will be required by the upcoming __rcu annotations. Based on patch by Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: -
Patrick McHardy authored
Conflicts: net/bridge/br_device.c net/bridge/br_forward.c Signed-off-by: -
Patrick McHardy authored
=================================================== [ INFO: suspicious rcu_dereference_check() usage. ] --------------------------------------------------- include/net/netfilter/nf_conntrack_l3proto.h:92 invoked rcu_dereference_check() without protection! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 2 locks held by iptables/3197: #0: (sk_lock-AF_INET){+.+.+.}, at: [<ffffffff8149bd8c>] ip_setsockopt+0x7c/0xa0 #1: (&xt[i].mutex){+.+.+.}, at: [<ffffffff8148a5fe>] xt_find_table_lock+0x3e/0x110 stack backtrace: Pid: 3197, comm: iptables Not tainted 2.6.34-rc4 #2 Call Trace: [<ffffffff8105e2e8>] lockdep_rcu_dereference+0xb8/0xc0 [<ffffffff8147fb3b>] nf_ct_l3proto_module_put+0x6b/0x70 [<ffffffff8148d891>] state_mt_destroy+0x11/0x20 [<ffffffff814d3baf>] cleanup_match+0x2f/0x50 [<ffffffff814d3c63>] cleanup_entry+0x33/0x90 [<ffffffff814d5653>] ? __do_replace+0x1a3/0x210 [<ffffffff814d564c>] __do_replace+0x19c/0x210 [<ffffffff814d651a>] do_ipt_set_ctl+0x16a/0x1b0 [<ffffffff8147a610>] nf_sockopt+0x60/0xa0 ... The __nf_ct_l3proto_find() call doesn't actually need rcu read side protection since the caller holds a reference to the protocol. Use rcu_read_lock() anyways to avoid the warning. Kernel bugzilla #15781: https://bugzilla.kernel.org/show_bug.cgi?id=15781Reported-by:Christian Casteyde <casteyde.christian@free.fr> Signed-off-by:
-
Eric Dumazet authored
Now that core network takes care of trans_start updates, dont do it in drivers themselves, if possible. Drivers can avoid one cache miss (on dev->trans_start) in their start_xmit() handler. Exceptions are NETIF_F_LLTX drivers Signed-off-by:
Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Marcel Holtmann authored
There were some left-overs that used sk->sk_sleep instead of the new sk_sleep() helper. Signed-off-by:Marcel Holtmann <marcel@holtmann.org>
-
Tomas Winkler authored
Use strict_strtoul as suggested by checkpatch.pl for more strict input checking. Signed-off-by:
Tomas Winkler <tomas.winkler@intel.com> Signed-off-by:
-
Bing Zhao authored
Get the device type from MODULE_BRINGUP_REQ command response. Signed-off-by:
Bing Zhao <bzhao@marvell.com> Signed-off-by:
-
Bing Zhao authored
Move btmrvl hdev registration code out of btmrvl_add_card(). New function btmrvl_register_hdev() is added. Signed-off-by:
-
Bing Zhao authored
The MODULE_BRINGUP_REQ command response returns success with either 0x00 or 0x0c. Signed-off-by:
-
Dan Carpenter authored
This is mostly cleanup. There is only one caller and it just checks for non-zero return values. Still "ret" should be int because we want to return -EINVAL on errors. Signed-off-by:
Dan Carpenter <error27@gmail.com> Signed-off-by:
-
Marcel Holtmann authored
Instead of having a global workqueue for all controllers, it makes more sense to have a workqueue per controller. Signed-off-by: -
Gustavo F. Padovan authored
On the receipt of an RR(P=1) under RemoteBusy set to TRUE(on the RECV state table) we have to call sendIorRRorRNR(F=1) and just after set RemoteBusy to False. This leads to a freeze in the sending process since it's not allowed send data with RemoteBusy set to true and no one call SendPending-I-Frames after set RemoteBusy to false(The last action for that event). Actually sendIorRRorRNR() calls SendPending-I-Frames but at that moment RemoteBusy is still True and we cannot send any frame, after, no one calls SendPending-I-Frames again and the sending process stops. The solution here is to set RemoteBusy to false inside SendPending-I-Frames just before call SendPending-I-Frames. That will make SendPending-I-Frames able to send frames. This solution is similar to what RR(P=0)(F=0) on the RECV table and RR(P=1) on the SREJ_SENT table do. Actually doesn't make any sense call SendPending-I-Frames if we can send any frame, i. e., RemoteBusy is True. Signed-off-by:
Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by:
-
Gustavo F. Padovan authored
The checks should be done before the the memcpy to avoid buffer overflow. Reported-by:
João Paulo Rechi Vita <jprvita@profusion.mobi> Signed-off-by:
-
Gustavo F. Padovan authored
l2cap_ertm_send() can be called both from user context and bottom half context. The socket locks for that contexts are different, the user context uses a mutex(which can sleep) and the second one uses a spinlock_bh. That creates a race condition when we have interruptions on both contexts at the same time. The better way to solve this is to add a new spinlock to lock l2cap_ertm_send() and the vars it access. The other solution was to defer l2cap_ertm_send() with a workqueue, but we the sending process already has one defer on the hci layer. It's not a good idea add another one. The patch refactor the code to create l2cap_retransmit_frames(), then we encapulate the lock of l2cap_ertm_send() for some call. It also changes l2cap_retransmit_frame() to l2cap_retransmit_one_frame() to avoid confusion Signed-off-by:
-
Gustavo F. Padovan authored
To guarantee that all packets we sent were received we need to wait for theirs ack before shutdown the socket. Signed-off-by:
-
Gustavo F. Padovan authored
Supports Local Busy condition handling through a waitqueue that wake ups each 200ms and try to push the packets to the upper layer. If it can push all the queue then it leaves the Local Busy state. The patch modifies the behaviour of l2cap_ertm_reassembly_sdu() to support retry of the push operation. Signed-off-by:
-
João Paulo Rechi Vita authored
Add checks for invalid tx_seq and fixes the duplicated tx_seq check. Signed-off-by:
-
Gustavo F. Padovan authored
There is a plenty of situation where ERTM shall close the channel, this commit treats the cases regarding Invalid Frame Detection. It create one reassembly SDU function for ERTM and other for Streaming Mode to make the Invalid Frame Detection handling less complex. Signed-off-by:
-
Gustavo F. Padovan authored
Make the code flow cleaner and changes the function to void. It also fixes a potential NULL dereference with skb. Signed-off-by:
-
Gustavo F. Padovan authored
hci_send_acl can't fail, so we can make it void. This patch changes that and all the funcions that use hci_send_acl(). That change exposed a bug on sending connectionless data. We were not reporting the lenght send back to the user space. Signed-off-by:
-
Gustavo F. Padovan authored
A spin_lock_init() call was missing. :) Signed-off-by:
-
Gustavo F. Padovan authored
F-bit set should be processed only if we are in the WAIT_F state. Signed-off-by:
-
Gustavo F. Padovan authored
Trivial clean up. Signed-off-by:
-
Gustavo F. Padovan authored
That action is not specified by the ERTM spec, so removing it. Signed-off-by:
-
Gustavo F. Padovan authored
Signed-off-by:
-
Gustavo F. Padovan authored
We can set the SAR bits in the control field directly. Signed-off-by:
-
João Paulo Rechi Vita authored
Signed-off-by:
-
Gustavo F. Padovan authored
The code was reusing the control var without its reinitialization. Signed-off-by:
-
João Paulo Rechi Vita authored
Add this check to getsockopt makes possible to fail early instead of waiting until listen / connect. Signed-off-by:
-
Gustavo F. Padovan authored
if enable_ertm is true and we have SOCK_STREAM the default mode will be ERTM, otherwise Basic Mode. Signed-off-by:
-
Gustavo F. Padovan authored
The L2CAP Extended Features are still unstable and under development, so we are adding them under the EXPERIMENTAL flag to get more feedback on them. L2CAP Extended Features includes the Enhanced Retransmission and Streaming Modes, Frame Check Sequence (FCS), and Segmentation and Reassemby (SAR). Signed-off-by:
-
Gustavo F. Padovan authored
When the I-frame received is the expected, i.e., its tx_seq is equal to expected_tx_seq and we are under a SREJ, we can just add it to the tail of the list. Doing that we change the complexity from O(n) to O(1). Signed-off-by:
-
