Denis V. Lunev [Sat, 19 Jan 2008 07:53:31 +0000 (23:53 -0800)]
[NETNS]: Double free in netlink_release.
Netlink protocol table is global for all namespaces. Some netlink
protocols have been virtualized, i.e. they have per/namespace netlink
socket. This difference can easily lead to double free if more than 1
namespace is started. Count the number of kernel netlink sockets to
track that this table is not used any more.
Signed-off-by: Denis V. Lunev <den@openvz.org> Tested-by: Alexey Dobriyan <adobriyan@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Lezcano [Sat, 19 Jan 2008 07:52:35 +0000 (23:52 -0800)]
[IPV6]: Fix ip6_frag ctl
Alexey Dobriyan reported an oops when unsharing the network
indefinitely inside a loop. This is because the ip6_frag is not per
namespace while the ctls are.
That happens at the fragment timer expiration:
inet_frag_secret_rebuild function is called and this one restarts the
timer using the value stored inside the sysctl field.
"mod_timer(&f->secret_timer, now + f->ctl->secret_interval);"
When the network is unshared, ip6_frag.ctl is initialized with the new
sysctl instances, but ip6_frag has only one instance. A race in this
case will appear because f->ctl can be modified during the read access
in the timer callback.
Until the ip6_frag is not per namespace, I discard the assignation to
the ctl field of ip6_frags in ip6_frag_sysctl_init when the network
namespace is not the init net.
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Stefan Roese [Wed, 16 Jan 2008 07:11:15 +0000 (08:11 +0100)]
net: NEWEMAC: Fix problem with mtu > 4080 on non TAH equipped 4xx PPC's
Currently, all non TAH equipped 4xx PPC's call emac_start_xmit() upon
xmit. This routine doesn't check if the frame length exceeds the max.
MAL buffer size.
This patch now changes the driver to call emac_start_xmit_sg() on all
GigE platforms and not only the TAH equipped ones (440GX). This enables
an MTU of 9000 instead 4080.
Signed-off-by: Stefan Roese <sr@denx.de> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Zhu Yi [Thu, 20 Dec 2007 03:27:32 +0000 (11:27 +0800)]
iwlwifi: proper monitor support
This patch changes the iwlwifi driver to properly support
monitor interfaces after the filter flags change.
The patch is originally created by Johannes Berg for iwl4965. I fixed some
of the comments and created a similar patch for iwl3945.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Wed, 19 Dec 2007 13:03:19 +0000 (13:03 +0000)]
libertas: change inference about buffer size in lbs_cmd()
sizeof(*cmd) is going to give the total size of the data structure that
we allocated, more often than not. But the size of the command to be
_sent_ could be a lot smaller, as it is in the KEY_MATERIAL and
SUBSCRIBE_EVENT commands for example. So swap them round; let the caller
set the _command_ size explicitly in the header, and infer the
maximum response size from the data structure.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Tue, 18 Dec 2007 00:22:40 +0000 (19:22 -0500)]
libertas: submit RSSI command on tx timeout, to check whether module is dead
We don't necessarily want to reset the device on a TX timeout. But more
often than not, the real cause is that the firmware has crapped itself,
not just that the network is busy. So submit any harmless command, and
if _that_ times out, then the error handling code will reset the module,
as appropriate.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Mon, 17 Dec 2007 21:03:58 +0000 (16:03 -0500)]
libertas: make lbs_submit_command always 'succeed' and set command timer
Even if it fails, we want to wait a while and try again, with an
ultimate timeout if it the condition persists. So again, just use the
standard command timeout behaviour.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Mon, 17 Dec 2007 20:41:30 +0000 (15:41 -0500)]
libertas: discard DEFER responses to commands; let the timeout trigger
When the firmware returns 0x0004, it wants us to try again later. We can
achieve that simply by throwing out the response and letting the command
timeout code kick in.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Mon, 17 Dec 2007 19:41:13 +0000 (14:41 -0500)]
libertas: allow for PS mode to be disabled when firmware doesn't support it
Otherwise, we go into an endless busy loop trying to enable PS mode when
the command queue is empty, dealing with the error response, and then
trying to enable PS mode again because the command queue is empty.... it
doesn't really save much power.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Mon, 17 Dec 2007 17:35:28 +0000 (12:35 -0500)]
libertas: don't clear priv->dnld_sent after sending sleep confirm
DNLD_RES_RECEIVED is a bit of a misnomer -- we never wait for the result
to be received; it's purely representing the state of the TX path, and
in this case the TX path is definitely busy.
Of course, that means that we don't actually care about DATA_SENT vs.
CMD_SENT either, but that's a can of worms for another day...
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Mon, 17 Dec 2007 04:26:54 +0000 (23:26 -0500)]
libertas: fix buffer handling of PS_MODE commands and responses
Commit 5b8845345e7385d2eb37fac22ba9ab6905988be5 (or, in case the git
workflow is broken and patches get recommitted, the commit entitled
'libertas: rename and re-type bufvirtualaddr to cmdbuf' by dcbw),
introduced a number of bugs where we once had a pointer to a command
_payload_, but now we use the pointer to the command header instead.
The fix isn't wonderfully pretty for now, but it'll get better when we
finish converting all commands so the structures include the header.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Sun, 16 Dec 2007 22:21:00 +0000 (17:21 -0500)]
libertas: fix return from lbs_update_channel()
If we return the channel number in a 'ret' variable where anything
non-zero is later interpreted as an error, that isn't nice. It breaks
WPA, for a start. OLPC trac #5485
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Sat, 15 Dec 2007 05:41:51 +0000 (00:41 -0500)]
libertas: remove some pointless checks for cmdnode buffer being present
We allocate them all at the same time, at startup. If they go missing,
we have more serious things to worry about, and the resulting oops will
be a perfectly acceptable result.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Sat, 15 Dec 2007 06:22:09 +0000 (01:22 -0500)]
libertas: don't use __lbs_cmd() with empty callback in if_usb.c
We're about to change semantics, leaving callers of
lbs_prepare_and_send_command() with the old broken priv->cur_cmd_retcode
crap. The existence of the callback command will be the trigger for the
new semantics when handling the response.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Fri, 14 Dec 2007 02:53:16 +0000 (21:53 -0500)]
libertas: stop attempting to reset devices on unload
It wasn't working anyway -- by the time we get into if_usb_disconnect()
the USB core has already stopped us talking to the thing; even if it's
just on unload and the device still exists.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Fri, 14 Dec 2007 02:48:00 +0000 (21:48 -0500)]
libertas: don't exit worker thread until kthread_stop() is called
The kthread code can't cope with a thread exiting of its own accord and
then someone calling kthread_stop() for it. When the thread detects that
it needs to die, make it wait for kthread_stop() to be called.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Larry Finger [Sun, 16 Dec 2007 18:21:06 +0000 (19:21 +0100)]
b43legacy: Fix rfkill radio LED
This fixes Bug #9414 for b43legacy. This patch is the equivalent of one
submitted earlier for b43.
Since addition of the rfkill callback, the LED associated with the off
switch on the radio has not worked for several reasons:
(1) Essential data in the rfkill structure were missing.
(2) The rfkill structure was initialized after the LED initialization.
(3) There was a minor memory leak if the radio LED structure was inited.
Once the above problems were fixed, additional difficulties were noted:
(4) The radio LED was in the wrong state at startup.
(5) The radio switch had to be manipulated twice for each state change.
(6) A circular mutex locking situation existed.
(7) If rfkill-input is built as a module, it is not automatically loaded.
This patch fixes all of the above and removes a couple of sparse warnings.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Stefano Brivio <stefano.brivio@polimi.it> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Ramkrishna Vepa [Mon, 17 Dec 2007 19:40:15 +0000 (11:40 -0800)]
S2io: Fixes to enable multiple transmit fifos
Multiple transmit fifo initialization -
- Assigned equal scheduling priority for all configured FIFO's.
- Modularized transmit traffic interrupt initialization since it is executed in
s2io_card_up and s2io_link. Enable continuous tx interrupt when link is UP
and vice verse.
- Enable transmit interrupts for all configured transmit fifos.
- Fixed typo errors.
Surjit Reang [Thu, 24 Jan 2008 10:08:59 +0000 (02:08 -0800)]
S2io: Fixes to enable multiple transmit fifo support
Fixes to enable multiple transmit fifos (upto a maximum of eight).
- Moved single tx_lock from struct s2io_nic to struct fifo_info.
- Moved single ufo_in_band_v structure from struct s2io_nic to struct
fifo_info.
- Assign the respective interrupt number for the transmitting fifo in the
transmit descriptor (TXD).
- Added boundary checks for number of FIFOs enabled and FIFO length.
Signed-off-by: Surjit Reang <surjit.reang@neterion.com> Signed-off-by: Sreenivasa Honnur <sreenivasa.honnur@neterion.com> Signed-off-by: Ramkrishna Vepa <ram.vepa@neterion.com> Signed-off-by: Jeff Garzik <jeff@garzik.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Lee Schermerhorn [Fri, 14 Dec 2007 00:02:59 +0000 (16:02 -0800)]
bnx2x depends on ZLIB_INFLATE
The bnx2x module depends on the zlib_inflate functions. The build will
fail if ZLIB_INFLATE has not been selected manually or by building another
module that automatically selects it.
Modify BNX2X config option to 'select ZLIB_INFLATE' like BNX2
and others. This seems to fix it.
Signed-off-by: Lee Schermerhorn <lee.schermerhorn@hp.com> Acked-by: Eliezer Tamir <eliezert@broadcom.com> Cc: Jeff Garzik <jeff@garzik.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Robert P. J. Day [Fri, 14 Dec 2007 00:02:55 +0000 (16:02 -0800)]
pcmcia net: use roundup_pow_of_two() macro instead of grotesque loop
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Cc: Jeff Garzik <jeff@garzik.org> Cc: Dominik Brodowski <linux@dominikbrodowski.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Matheos Worku [Fri, 14 Dec 2007 19:48:36 +0000 (11:48 -0800)]
ixgb: enable sun hardware support for broadcom phy
Implement support for a SUN-specific PHY.
SUN provides a modified 82597-based board with their own
PHY that works with very little modification to the code. This
patch implements this new PHY which is identified by the
subvendor device ID. The device ID of the adapter remains
the same.
Al Viro [Sun, 9 Dec 2007 16:06:41 +0000 (16:06 +0000)]
forcedeth endianness bugs
* misannotation: struct register_test members are actually host-endian
* bug: cpu_to_le64(n) >> 32 instead of cpu_to_le32(n >> 32) in setting
->bufhigh and similar for ->buflow (take low bits, _then_ convert to
little-endian, not the other way round).
* bug: setup_hw_rings() should not convert to little-endian at all (we
feed the result to writel(), not store in shared data structure), let
alone try to play with shifting and masking little-endian values. Introduced
when setup_hw_rings() went in, screwed both 64bit case and the old code for
32bit rings it had replaced.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Al Viro [Sun, 16 Dec 2007 20:53:36 +0000 (20:53 +0000)]
endianness annotations and fixes for olympic
* missing braces in !readl(...) & ...
* trivial endianness annotations
* in olympic_arb_cmd() the loop collecting fragments of
packet is b0rken on big-endian - we have
(next_ptr && (buf_ptr=olympic_priv->olympic_lap + ntohs(next_ptr)))
as condition and it should have swab16(), not ntohs() - it's host-endian
byteswapped, not big-endian. So if we get more than one fragment on big-endian
host, we get screwed.
This ntohs() got missed back when the rest of those had been switched
to swab16() in 2.4.0-test2-pre1 - at a guess, nobody had hit fragmented
packets during the testing of PPC fixes.
PS: Ken Aaker cc'd on assumption that he is the same guy who'd done the
original set of PPC fixes in olympic
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
David Woodhouse [Wed, 12 Dec 2007 22:38:56 +0000 (17:38 -0500)]
libertas: implement suspend and resume core methods
We (ab)use priv->fw_ready to stop the worker thread from sending more
commands or data after the response to the HOST_SLEEP_ACTIVATE command
comes in. And we set it from the callback function _directly_ to ensure
that the worker thread sees it immediately; if we did it in
lbs_suspend() after waking up, that might be too late.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Woodhouse [Wed, 12 Dec 2007 04:42:49 +0000 (23:42 -0500)]
libertas: be more careful about command responses matching cur_cmd
Especially in the light of OLPC trac #5461, in which the firmware starts
sending us seemingly random command responses which bear little relation
to the command we sent it.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
projects / linux-2.6 / log