- Aug 07, 2012
-
-
Tushar Dave authored
A bus trace shows that while executing e1000e_down, TCTL is cleared except for the PSP bit. This occurs while in the middle of fetching a TSO packet since the Tx packet buffer is full at that point. Before the device is reset, the e1000_watchdog_task starts to run from the middle (it was apparently pre-empted earlier, although that is not in the trace) and sets TCTL.EN. At that point, 82571 transmits the corrupted packet, apparently because TCTL.MULR was cleared in the middle of fetching a packet, which is forbidden. Driver should just clear TCTL.EN in e1000_reset_hw_82571 instead of clearing the entire register, so as not to change any settings in the middle of fetching a packet. Signed-off-by:
Tushar Dave <tushar.n.dave@intel.com> Tested-by:
Aaron Brown <aaron.f.brown@intel.com> Signed-off-by:
Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
-
Tushar Dave authored
Found that commit d478eb44 was a bad commit. If the link partner is transmitting codeword (even if NULL codeword), then the RXCW.C bit will be set so check for RXCW.CW is unnecessary. Ref: RH BZ 840642 Reported-by:
Fabio Futigami <ffutigam@redhat.com> Signed-off-by:
Tushar Dave <tushar.n.dave@intel.com> CC: Marcelo Ricardo Leitner <mleitner@redhat.com> CC: stable <stable@vger.kernel.org> [2.6.38+] Tested-by:
Aaron Brown <aaron.f.brown@intel.com> Signed-off-by:
Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
-
Eric Dumazet authored
IPv6 needs a cookie in dst_check() call. We need to add rx_dst_cookie and provide a family independent sk_rx_dst_set(sk, skb) method to properly support IPv6 TCP early demux. Signed-off-by:
Eric Dumazet <edumazet@google.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Thomas Meyer authored
The semantic patch that makes this change is available in scripts/coccinelle/api/ptr_ret.cocci. More information about semantic patching is available at http://coccinelle.lip6.fr/ Signed-off-by:
Thomas Meyer <thomas@m3y3r.de> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Hiroaki SHIMODA authored
Some action modules free struct tcf_common in their error path while estimator is still active. This results in est_timer() dereference freed memory. Add gen_kill_estimator() in ipt, pedit and simple action. Signed-off-by:
Hiroaki SHIMODA <shimoda.hiroaki@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Vasiliy Kulikov authored
__neigh_create() returns either a pointer to struct neighbour or PTR_ERR(). But the caller expects it to return either a pointer or NULL. Replace the NULL check with IS_ERR() check. The bug was introduced in a263b309 ("ipv4: Make neigh lookups directly in output packet path."). Signed-off-by:
Vasily Kulikov <segoon@openwall.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Sorin Dumitru authored
We are freeing skb instead of nskb, resulting in a double free on skb and a leak from nskb. Signed-off-by:
Sorin Dumitru <sdumitru@ixiacom.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Arnaud Patard authored
When building with ixp4xx_eth and ptp_ixp46x as module, one is getting the following error: ERROR: "ixp46x_phc_index" [drivers/ptp/ptp_ixp46x.ko] undefined! This has been introduced by commit 509a7c25 . Signed-off-by:
Arnaud Patard <arnaud.patard@rtp-net.org> Acked-by:
Richard Cochran <richardcochran@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Julia Lawall authored
Convert a 0 error return code to a negative one, as returned elsewhere in the function. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ identifier ret; expression e,e1,e2,e3,e4,x; @@ ( if (\(ret != 0\|ret < 0\) || ...) { ... return ...; } | ret = 0 ) ... when != ret = e1 *x = \(kmalloc\|kzalloc\|kcalloc\|devm_kzalloc\|ioremap\|ioremap_nocache\|devm_ioremap\|devm_ioremap_nocache\)(...); ... when != x = e2 when != ret = e3 *if (x == NULL || ...) { ... when != ret = e4 * return ret; } // </smpl> Signed-off-by:
Julia Lawall <julia@diku.dk> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Silviu-Mihai Popescu authored
Fix sparse warning: * symbol 'tcp_wfree' was not declared. Should it be static? Signed-off-by:
Silviu-Mihai Popescu <silviupopescu1990@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Julia Lawall authored
devm_kfree should not have to be explicitly used. The semantic patch that fixes this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression x,d; @@ x = devm_kzalloc(...) ... ?-devm_kfree(d,x); // </smpl> Signed-off-by:
Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Marek Lindner authored
This is a regression introduced by: 2265c141 ("batman-adv: gateway election code refactoring") Reported-by:
Nicolás Echániz <nicoechaniz@codigosur.org> Signed-off-by:
Marek Lindner <lindner_marek@yahoo.de> Acked-by:
Antonio Quartulli <ordex@autistici.org> Signed-off-by:
Antonio Quartulli <ordex@autistici.org> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Karsten Keil authored
If a fixed TEI is used, the initial state of the layer 2 statmachine need to be 4 (TEI assigned). This was true only for Point to Point connections, but not for the other fixed TEIs. It was not found before, because usually only the TEI 0 is used as fixed TEI for PtP mode, but if you try X31 packet mode connections with SAPI 16, TEI 1, it did fail. Signed-off-by:
Karsten Keil <keil@b1-systems.de> Cc: <stable@vger.kernel.org> # 3.5.x Signed-off-by:
David S. Miller <davem@davemloft.net>
-
- Aug 04, 2012
-
-
Jesper Juhl authored
Even when they go beyond 80 characters, user visible strings should be on one line to make them easy to grep for. Signed-off-by:
Jesper Juhl <jj@chaosbits.net> Tested-by:
Jeff Pieper <jeffrey.e.pieper@intel.com> Signed-off-by:
Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
-
Jesper Juhl authored
In the original code ... if ((adapter->hw.mac.type == e1000_i210) || (adapter->hw.mac.type == e1000_i210)) { ... the second check of 'adapter->hw.mac.type' is pointless since it tests for the exact same value as the first. Signed-off-by:
Jesper Juhl <jj@chaosbits.net> Acked-by:
Carolyn Wyborny <carolyn.wyborny@intel.com> Tested-by:
Jeff Pieper <jeffrey.e.pieper@intel.com> Signed-off-by:
Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
-
Carolyn Wyborny authored
Move nvm invalid size check to before size assigned by mac_type for 82575 and later parts in get_invariants function. This fixes a problem found on some 82576 devices where the part will not initialize because the nvm_read function pointer ends up getting assigned to the incorrect function. Reported By: Stefan Assmann <sassmann@redhat.com> Signed-off-by:
Carolyn Wyborny <carolyn.wyborny@intel.com> Tested-by:
Jeff Pieper <jeffrey.e.pieper@intel.com> Signed-off-by:
Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
-
Randy Dunlap authored
Fix build error on cris (not tested, no toolchain here): drivers/net/cris/eth_v10.c: error: too many arguments to function 'e100rxtx_interrupt' Reported-by:
Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by:
Randy Dunlap <rdunlap@xenotime.net> Cc: Mikael Starvik <starvik@axis.com> Cc: Jesper Nilsson <jesper.nilsson@axis.com> Cc: linux-cris-kernel@axis.com Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Peter Meiser authored
Hello, looking at http://sourceforge.net/apps/mediawiki/mbm/index.php?title=Main_Page#Supported_devices, there are branded Ericsson devices from Dell and Toshiba. The to-be-added vendor IDs are 0x413c for Dell and 0x0930 for Toshiba. Please find attached a patch to add these vendor IDs. Signed-off-by:
Peter Meiser <meiser@gmx-topmail.de> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Wu Fengguang authored
Fix a buffer overflow bug by removing the revision and printk. [ 22.016214] isdnloop-ISDN-driver Rev 1.11.6.7 [ 22.097508] isdnloop: (loop0) virtual card added [ 22.174400] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff83244972 [ 22.174400] [ 22.436157] Pid: 1, comm: swapper Not tainted 3.5.0-bisect-00018-gfa8bbb1-dirty #129 [ 22.624071] Call Trace: [ 22.720558] [<ffffffff832448c3>] ? CallcNew+0x56/0x56 [ 22.815248] [<ffffffff8222b623>] panic+0x110/0x329 [ 22.914330] [<ffffffff83244972>] ? isdnloop_init+0xaf/0xb1 [ 23.014800] [<ffffffff832448c3>] ? CallcNew+0x56/0x56 [ 23.090763] [<ffffffff8108e24b>] __stack_chk_fail+0x2b/0x30 [ 23.185748] [<ffffffff83244972>] isdnloop_init+0xaf/0xb1 Signed-off-by:
Fengguang Wu <fengguang.wu@intel.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Haiyang Zhang authored
We need to wait for send_completion msg before put_rndis_request() at the end of rndis_filter_halt_device(). Otherwise, netvsc_send_completion() may reference freed memory which is overwritten, and cause panic. Reported-by:
Long Li <longli@microsoft.com> Reported-by:
Jason Wang <jasowang@redhat.com> Signed-off-by:
Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Yevgeny Petrilin authored
Port1=Eth, Port2=IB restriction is no longer required. Having RoCE, there will always rdma port initialized over ConnectX physical port, no matter whether the link layer is IB or Ethernet. So we always have dual port IB device. Signed-off-by:
Yevgeny Petrilin <yevgenyp@mellanox.co.il> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Yevgeny Petrilin authored
Removing the ring->blocked flag, it is redundant and leads to a race: We close the TX queue and then set the "blocked" flag. Between those 2 operations the completion function can check the "blocked" flag, sees that it is 0, and wouldn't open the TX queue. Using netif_tx_queue_stopped to check the state of the queue to avoid this race. Signed-off-by:
Yevgeny Petrilin <yevgenyp@mellanox.co.il> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Amir Vadai authored
Should NOT check SMAC=DMAC when: 1. loopback is turned on 2. validate_loopback is true. Fixed it accordingly. Signed-off-by:
Amir Vadai <amirv@mellanox.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Hiroaki SHIMODA authored
gact_rand array is accessed by gact->tcfg_ptype whose value is assumed to less than MAX_RAND, but any range checks are not performed. So add a check in tcf_gact_init(). And in tcf_gact(), we can reduce a branch. Signed-off-by:
Hiroaki SHIMODA <shimoda.hiroaki@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Masanari Iida authored
Missing a CR in printk causes 2 messages printed in one line. Signed-off-by:
Masanari Iida <standby24x7@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
- Aug 03, 2012
-
-
Mohammed Shafi Shajakhan authored
AR1111 is same as AR9485. The h/w difference between them is quite insignificant, Felix suggests only very few baseband features may not be available in AR1111. The h/w code for AR9485 is already present, so AR1111 should work fine with the addition of its PID/VID. Cc: stable@vger.kernel.org [2.6.39+] Cc: Felix Bitterli <felixb@qca.qualcomm.com> Reported-by:
Tim Bentley <Tim.Bentley@Gmail.com> Signed-off-by:
Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com> Tested-by:
Tim Bentley <Tim.Bentley@Gmail.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Seth Forshee authored
brcmsmac cannot call freq_reg_info() during channel changes as it does not hold cfg80211_lock, and as a result it generates a lockdep warning. freq_reg_info() is being used to determine whether OFDM is allowed on the current channel, so we can avoid the errant call by using the new IEEE80211_CHAN_NO_OFDM for this purpose instead. Reported-by:
Josh Boyer <jwboyer@redhat.com> Signed-off-by:
Seth Forshee <seth.forshee@canonical.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Daniel Drake authored
The if_sdio_card structure was never being freed, and neither was the command structure used for association. Signed-off-by:
Daniel Drake <dsd@laptop.org> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Woody Hung authored
This patch is going to fix the resuming failed from S3/S4 for rt3290 chip. Signed-off-by:
Woody Hung <Woody.Hung@mediatek.com> Cc: Kevin Chou <kevin.chou@mediatek.com> Signed-off-by:
Chen, Chien-Chia <machen@suse.com> Reviewed-by:
Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Daniel Drake authored
On an OLPC XO-1.5 we have seen the following situation: - the system starts going into suspend - no wake params are set, so the mmc layer removes the card - during remove, we send a command to the card - that command fails, causing if_sdio's reset method to try and remove the mmc card in attempt to reset it - the mmc layer is not happy about being asked to remove a card that it is already removing, and the kernel crashes While the MMC layer could possibly be taught to behave better here, it also seems sensible for libertas not to try and reset a card if we're in the process of removing it anyway. Signed-off-by:
Daniel Drake <dsd@laptop.org> Acked-by:
Dan Williams <dcbw@redhat.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Rafał Miłecki authored
Add some comments by the way Signed-off-by:
Rafał Miłecki <zajec5@gmail.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Rafał Miłecki authored
Signed-off-by:
Rafał Miłecki <zajec5@gmail.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
-
- Aug 02, 2012
-
-
Paul Stewart authored
Restore the default state to the "beacon_found" flag when the channel flags are restored. Otherwise, we can end up with a channel that we can no longer transmit on even when we can see beacons on that channel. Signed-off-by:
Paul Stewart <pstew@chromium.org> Signed-off-by:
Johannes Berg <johannes.berg@intel.com>
-
Seth Forshee authored
Currently the only way for wireless drivers to tell whether or not OFDM is allowed on the current channel is to check the regulatory information. However, this requires hodling cfg80211_mutex, which is not visible to the drivers. Other regulatory restrictions are provided as flags in the channel definition, so let's do similarly with OFDM. This patch adds a new flag, IEEE80211_CHAN_NO_OFDM, to tell drivers that OFDM on a channel is not allowed. This flag is set on any channels for which regulatory indicates that OFDM is prohibited. Signed-off-by:
Seth Forshee <seth.forshee@canonical.com> Tested-by:
Arend van Spriel <arend@broadcom.com> Signed-off-by:
Johannes Berg <johannes.berg@intel.com>
-
Eric Dumazet authored
Remove unused includes after IP cache removal Signed-off-by:
Eric Dumazet <edumazet@google.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Jesper Juhl authored
In bnx2x_mcast_enqueue_cmd() we'll leak the memory allocated to 'new_cmd' if we hit the deafault case of the 'switch (cmd)'. Add a 'kfree(new_cmd)' to that case to avoid the leak. Signed-off-by:
Jesper Juhl <jj@chaosbits.net> Acked-by:
Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Fan Du authored
After SA is setup, one timer is armed to detect soft/hard expiration, however the timer handler uses xtime to do the math. This makes hard expiration occurs first before soft expiration after setting new date with big interval. As a result new child SA is deleted before rekeying the new one. Signed-off-by:
Fan Du <fdu@windriver.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Ben Hutchings authored
Cache the device gso_max_segs in sock::sk_gso_max_segs and use it to limit the size of TSO skbs. This avoids the need to fall back to software GSO for local TCP senders. Signed-off-by:
Ben Hutchings <bhutchings@solarflare.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Ben Hutchings authored
Currently an skb requiring TSO may not fit within a minimum-size TX queue. The TX queue selected for the skb may stall and trigger the TX watchdog repeatedly (since the problem skb will be retried after the TX reset). This issue is designated as CVE-2012-3412. Set the maximum number of TSO segments for our devices to 100. This should make no difference to behaviour unless the actual MSS is less than about 700. Increase the minimum TX queue size accordingly to allow for 2 worst-case skbs, so that there will definitely be space to add an skb after we wake a queue. To avoid invalidating existing configurations, change efx_ethtool_set_ringparam() to fix up values that are too small rather than returning -EINVAL. Signed-off-by:
Ben Hutchings <bhutchings@solarflare.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-