Arjan van de Ven [Thu, 29 May 2008 08:32:47 +0000 (01:32 -0700)]
bluetooth: fix locking bug in the rfcomm socket cleanup handling
in net/bluetooth/rfcomm/sock.c, rfcomm_sk_state_change() does the
following operation:
if (parent && sock_flag(sk, SOCK_ZAPPED)) {
/* We have to drop DLC lock here, otherwise
* rfcomm_sock_destruct() will dead lock. */
rfcomm_dlc_unlock(d);
rfcomm_sock_kill(sk);
rfcomm_dlc_lock(d);
}
}
which is fine, since rfcomm_sock_kill() will call sk_free() which will call
rfcomm_sock_destruct() which takes the rfcomm_dlc_lock()... so far so good.
HOWEVER, this assumes that the rfcomm_sk_state_change() function always gets
called with the rfcomm_dlc_lock() taken. This is the case for all but one
case, and in that case where we don't have the lock, we do a double unlock
followed by an attempt to take the lock, which due to underflow isn't
going anywhere fast.
This patch fixes this by moving the stragling case inside the lock, like
the other usages of the same call are doing in this code.
This was found with the help of the www.kerneloops.org project, where this
deadlock was observed 51 times at this point in time:
http://www.kerneloops.org/search.php?search=rfcomm_sock_destruct
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: David S. Miller <davem@davemloft.net>
mac80211: fix alignment issue with compare_ether_addr()
This addresses an alignment issue with compare_ether_addr().
The addresses passed to compare_ether_addr should be two bytes aligned.
It may function properly in x86 platform. However may not work properly
on IA-64 or ARM processor.
This also fixes a typo in mlme.c where the sk_buff struct name is incorect.
Though sizeof() works for any incorrect structure pointer name as its just
a pointer length that we want, lets just fix it.
Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com> Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
mac80211: Fix for NULL pointer dereference in sta_info_get()
This addresses a NULL pointer dereference in sta_info_get().
TID and sta_info are extracted in ADDBA Timer expiry function
through the timer handler's argument.
The problem is extracging the TID (which was stored in
timer_to_tid[] array of type "u8") through "int *" typecast which
may also yield unwanted bytes for the MSB of TID that results
in incorrect sta_info and ieee80211_local pointers.
ieee80211_local pointer is NULL as illustrated below, it crashes in
sta_info_get(). The problem started when extracting ieee80211_local
pointer out of sta_info iteself and eventually crashed in
stat_info_get().
The proper way to fix is to change the data type of TID to u8
instead of u16. However changing all the occurences requires
some prototype changes as well. We should fix this in upcoming
patches.
Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com> Signed-off-by: Luis Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Guy Cohen [Tue, 27 May 2008 03:29:35 +0000 (11:29 +0800)]
iwlwifi: fix rate scale TLC column selection bug
This patch fixes a case that a wrong maximal rate is selected when
searching for better configurations.
Signed-off-by: Guy Cohen <guy.cohen@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Guy Cohen [Tue, 27 May 2008 03:29:34 +0000 (11:29 +0800)]
iwlwifi: fix exit from stay_in_table state
When exiting from stay in table state (e.g. timer expiration),
all the statistics are reset and the RS flow should not continue
but only after enough statistics are collected again.
Signed-off-by: Guy Cohen <guy.cohen@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Scott Ashcroft [Mon, 26 May 2008 21:06:15 +0000 (00:06 +0300)]
rndis_wlan: Make connections to TKIP PSK networks work
This patch allows the rndis_wlan driver to connect to TKIP PSK
networks. It uses the ASSOCIATION_INFORMATION RNDIS call to pull back
the IEs and sends them back to userspace using wireless events. Tested
on a few wireless networks I have access to. Based on the similar
code in ndiswrapper.
Signed-off-by: Scott Ashcroft <scott.ashcroft@talk21.com>
[edit: cleanups] Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Abhijeet Kolekar [Fri, 23 May 2008 17:15:26 +0000 (10:15 -0700)]
mac80211 : Fixes the status message for iwconfig
iwconfig was showing incorrect status messages when disassociated.
Patch fixes this by always checking for association status in
ioctl calls for getting ap address.
Signed-off-by: Abhijeet Kolekar <abhijeet.kolekar@intel.com> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Ivo van Doorn [Fri, 23 May 2008 16:14:02 +0000 (18:14 +0200)]
rt2x00: Use atomic interface iteration in irq context
rt2x00lib_beacondone() is called from interrupt context,
this means we cannot use the mac80211 interface iterator
that uses the rtnl lock (since that uses a mutex which can sleep).
Instead we should use the atomic mac80211 interface iterator.
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Ivo van Doorn [Fri, 23 May 2008 16:13:56 +0000 (18:13 +0200)]
rt2x00: Reset antenna RSSI after switch
When the antenna configuration has changed we should reset
the antenna RSSI value. Otherwise the value will be influenced
by the previous configuration quality which in turn will affect
the antenna diversity.
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Ivo van Doorn [Fri, 23 May 2008 16:13:49 +0000 (18:13 +0200)]
rt2x00: Don't count retries as failure
Link quality estimation became quite low for all rt2x00 drivers
because the number of retries it took to send the frame were
counted as failure.
This does not correspond to the legacy driver link quality calculation,
by not counting it we will send somewhat more optimistic values to
mac80211.
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Tomas Winkler [Thu, 22 May 2008 22:36:36 +0000 (01:36 +0300)]
mac80211: reorder channel and freq reporting in wext scan report
This patch switch order of channel and freq (SIOCGIWFREQ) reports
in scan results in order to overcome wpa_supplicant inability
to handle channel numbers in 5.2Ghz band.
Wext reporting channel number is ambiguous as channels 7-12 (802.11j)
exist on both bands.
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Andrea Merello [Sat, 10 May 2008 11:34:16 +0000 (13:34 +0200)]
rtl8180: fix wrong parameter in grf5101_rf_set_channel
The grf5101 RF code needs to invoke grf5101_write_phy_antenna every time the
channel is being switch.
This should be done passing the channel number to that function.
Incorrectly we were passing the same value that is written on the
channel RF register.
This may cause problems when operating on ch 14.
This patch fixes it.
Thanks to Alessandro Di Marco who found this issue!
Signed-off-by: Andrea Merello <andreamrl@tiscali.it> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Andrea Merello [Sat, 10 May 2008 11:32:34 +0000 (13:32 +0200)]
rtl8180: fix wrong parameter in max2820_rf_set_channel
The max2820 RF code needs to invoke max2820_write_phy_antenna every time the
channel is being switch.
This should be done passing the channel number to that function.
Incorrectly we were passing the same value that is written on the
channel RF register.
This may cause problems when operating on ch 14.
This patch fixes it.
Thanks to Alessandro Di Marco who found this issue!
Signed-off-by: Andrea Merello <andreamrl@tiscali.it> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Andrea Merello [Sat, 10 May 2008 11:30:12 +0000 (13:30 +0200)]
rtl8180: fix wrong parameter in sa2400_rf_set_channel
The sa2400 RF code needs to invoke sa2400_write_phy_antenna every time the
channel is being switch.
This should be done passing the channel number to that function.
Incorrectly we were passing the same value that is written on the
channel RF register.
This may cause problems when operating on ch 14.
This patch fixes it.
Thanks to Alessandro Di Marco who found this issue!
Signed-off-by: Andrea Merello <andreamrl@tiscali.it> Signed-off-by: John W. Linville <linville@tuxdriver.com>
John W. Linville [Tue, 27 May 2008 21:01:55 +0000 (17:01 -0400)]
rtl8180: avoid NULL dereference in max2820_rf_set_channel
The static function max2820_rf_set_channel is called with conf == NULL
within its compilation unit. Originally this defaulted to b/g channel
1, but "cfg80211 API for channels/bitrates, mac80211 and driver
conversion" (commit 8318d78a44d49ac1edf2bdec7299de3617c4232e) mistakenly
dropped this check. This patch minimally restores the expected
behavior.
Reported-by: Colin Lai <colin_sh@163.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Gerrit Renker [Tue, 27 May 2008 13:33:54 +0000 (06:33 -0700)]
dccp ccid-3: Fix "t_ipi explosion" bug
The identification of this bug is thanks to Cheng Wei and Tomasz
Grobelny.
To avoid divide-by-zero, the implementation previously ignored RTTs
smaller than 4 microseconds when performing integer division RTT/4.
When the RTT reached a value less than 4 microseconds (as observed on
loopback), this prevented the Window Counter CCVal value from
advancing. As a result, the receiver stopped sending feedback. This in
turn caused non-ending expiries of the nofeedback timer at the sender,
so that the sending rate was progressively reduced until reaching the
minimum of one packet per 64 seconds.
The patch fixes this bug by handling integer division more
intelligently. Due to consistent use of dccp_sample_rtt(),
divide-by-zero-RTT is avoided.
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
Wei Yongjun [Tue, 27 May 2008 13:22:38 +0000 (06:22 -0700)]
dccp: Fix to handle short sequence numbers packet correctly
RFC4340 said:
8.5. Pseudocode
...
If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet
has short sequence numbers), drop packet and return
But DCCP has some mistake to handle short sequence numbers packet, now
it drop packet only if P.type is Data, Ack, or DataAck and P.X == 0.
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Fri, 23 May 2008 07:22:04 +0000 (00:22 -0700)]
vlan: Use bitmask of feature flags instead of seperate feature bits
Herbert Xu points out that the use of seperate feature bits for features
to be propagated to VLAN devices is going to get messy real soon.
Replace the VLAN feature bits by a bitmask of feature flags to be
propagated and restore the old GSO_SHIFT/MASK values.
Signed-off-by: Patrick McHardy <kaber@trash.net> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Komuro [Mon, 5 May 2008 01:51:12 +0000 (10:51 +0900)]
fmvj18x_cs: add NextCom NC5310 rev B support
fmvj18x_cs: The manfid of "NextCom NC5310 rev B" is MANF_ID_FUJITSU.
but this card is MBH10302 based card.
use ConfigBase to detect the cardtype for this card.
Signed-off-by: Komuro <komurojun-mbn@nifty.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Paul Gortmaker [Thu, 22 May 2008 16:43:50 +0000 (12:43 -0400)]
phylib: do EXPORT_SYMBOL on get_phy_id
Commit cac1f3c8 factored out the code for get_phy_id so that it
could be reused in multiple places. Turns out that some of the
users can be modular, so we need to export this symbol as well.
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Thomas Graf [Thu, 22 May 2008 17:48:59 +0000 (10:48 -0700)]
netlink: Fix nla_parse_nested_compat() to call nla_parse() directly
The purpose of nla_parse_nested_compat() is to parse attributes which
contain a struct followed by a stream of nested attributes. So far,
it called nla_parse_nested() to parse the stream of nested attributes
which was wrong, as nla_parse_nested() expects a container attribute
as data which holds the attribute stream. It needs to call
nla_parse() directly while pointing at the next possible alignment
point after the struct in the beginning of the attribute.
With this patch, I can no longer reproduce the reported leftover
warnings.
Signed-off-by: Thomas Graf <tgraf@suug.ch> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Matteo Croce [Tue, 13 May 2008 22:58:32 +0000 (00:58 +0200)]
cpmac bugfixes and enhancements
* Resolve some locking issues using atomic_inc/atomic_dec
* move status code in cpmac_check_status
* unmark the BROKEN flag in Kconfig
* move code which should have been in platform code in
arch/mips/ar7/platform.c
* fixed an IRQ storm which lets the kernel hang
* fixed a double call to netif_start_queue which causes a kernel panic
* don't fail to register the PHY, works on many devices now
Signed-off-by: Matteo Croce <matteo@openwrt.org> Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Anton Vorontsov [Fri, 16 May 2008 19:04:51 +0000 (23:04 +0400)]
uli526x: add support for netpoll
This patch adds netpoll support for the uli526x ethernet driver --
simply call the interrupt handler for polling.
To do this without disable_irq()/enable_irq() pair we should fully
protect the handler. Luckily, it's already using irqsave spinlock,
the only unprotected place is interrupts re-enabling write. It was
safe to re-enable interrupts without holding the spinlock, but with
netpoll possibility now it doesn't seem so.
Patch was tested using netconsole and KGDBoE.
Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Andy Fleming [Thu, 15 May 2008 22:00:21 +0000 (17:00 -0500)]
ucc_geth: Fix arguments to dma map/unmap functions
We were passing NULL as the device. When we actually start supporting
more interesting memory configurations, this will break things, so
we proactively are fixing the bug.
Signed-off-by: Andy Fleming <afleming@freescale.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
PHYLIB was first marked as BROKEN on S390, then the enclosing menu marked
as non-S390, then the two dependencies merged with the conversion to
menuconfig. Reduce to non-S390.
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
The padto does not work because the driver code evaluates `len' later on and
there are cases where skb->len is not updated accordingly.
This was observed with ARP frames (skb->len = 42 bytes, !skb_cloned(),
skb_tailroom = 84 bytes). Then in skb_pad(), the first condition is true, where
skb->len is not updated. As a consequence, the driver uses 42 bytes instead of
the 60 bytes, and the ARP frame never makes it onto the wire.
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Use netdev_alloc_skb. This sets skb->dev and allows arch specific
allocation. Also simplify and cleanup the alignment code.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Pierre Ynard [Wed, 14 May 2008 23:20:16 +0000 (16:20 -0700)]
rndis_host: increase delay in command response loop
Some devices running some WinCE firmware (with SC_* Samsung processors
according to the SynCE project, verified on a HTC P3600 device) fail to
register because they apparently need extra time to respond correctly to
requests. Increase the existing delay to satisfy them. Based on code
from the SynCE project, on a suggestion of David Brownell.
This patch Works For Me(tm).
Signed-off-by: Pierre Ynard <linkfanel@yahoo.fr> Acked-by: David Brownell <david-b@pacbell.net> Cc: Greg KH <greg@kroah.com> Cc: Jeff Garzik <jeff@garzik.org> Cc: "David S. Miller" <davem@davemloft.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Andrew Morton [Wed, 14 May 2008 23:20:15 +0000 (16:20 -0700)]
drivers/net/tokenring/olympic.c: fix warning
When dev_name() is changed to return `const char *':
drivers/net/tokenring/olympic.c: In function 'olympic_probe':
drivers/net/tokenring/olympic.c:234: warning: assignment discards qualifiers from pointer target type
Cc: Jeff Garzik <jeff@garzik.org> Cc: Greg KH <greg@kroah.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Andrew Morton [Wed, 14 May 2008 23:20:15 +0000 (16:20 -0700)]
drivers/net/tokenring/3c359.c: squish a warning
When dev_name() is changed to return `const char *':
drivers/net/tokenring/3c359.c: In function 'xl_probe':
drivers/net/tokenring/3c359.c:318: warning: assignment discards qualifiers from pointer target type
Cc: Jeff Garzik <jeff@garzik.org> Cc: Greg KH <greg@kroah.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Andrew Morton [Wed, 14 May 2008 23:20:14 +0000 (16:20 -0700)]
pcnet32: fix warning
pci_name() will be changed to return `const char *':
drivers/net/pcnet32.c: In function 'pcnet32_probe1':
drivers/net/pcnet32.c:1884: warning: passing argument 2 of 'pcnet32_alloc_ring' discards qualifiers from pointer target type
Cc: Jeff Garzik <jeff@garzik.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Andrew Morton [Wed, 14 May 2008 23:20:12 +0000 (16:20 -0700)]
[netdrvr] dm9000: use delayed work to update mii phy state fix
use cancel_delayed_work_sync()
Cc: Ben Dooks <ben-linux@fluff.org> Cc: Enrico Scholz <enrico.scholz@sigma-chemnitz.de> Cc: Jeff Garzik <jeff@garzik.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Ben Hutchings [Fri, 16 May 2008 20:21:06 +0000 (21:21 +0100)]
sfc: Remove sub-minor component from driver version
This driver has diverged from the out-of-tree driver to which the version
number originally applied. It should be identified primarily by kernel
version.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Rami Rosen [Thu, 22 May 2008 00:47:54 +0000 (17:47 -0700)]
net: The world is not perfect patch.
Unless there will be any objection here, I suggest consider the
following patch which simply removes the code for the
-DI_WISH_WORLD_WERE_PERFECT in the three methods which use it.
The compilation errors we get when using -DI_WISH_WORLD_WERE_PERFECT
show that this code was not built and not used for really a long time.
Signed-off-by: Rami Rosen <ramirose@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Ilpo Järvinen [Thu, 22 May 2008 00:40:05 +0000 (17:40 -0700)]
tcp: Make prior_ssthresh a u32
If previous window was above representable values of u16,
strange things will happen if undo with the truncated value
is called for. Alternatively, this could be fixed by some
max trickery but that would limit undoing high-speed undos.
Adds 16-bit hole but there isn't anything to fill it with.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
and here to print HW addresses, the hex cases are not significant.
Thanks to Harvey Harrison to introduce the hex_asc_hi/hex_asc_lo helpers.
Signed-off-by: Denis Cheng <crquan@gmail.com> Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
tcp: TCP connection times out if ICMP frag needed is delayed
We are seeing an issue with TCP in handling an ICMP frag needed
message that is received after net.ipv4.tcp_retries1 retransmits.
The default value of retries1 is 3. So if the path mtu changes
and ICMP frag needed is lost for the first 3 retransmits or if
it gets delayed until 3 retransmits are done, TCP doesn't update
MSS correctly and continues to retransmit the orginal message
until it timesout after tcp_retries2 retransmits.
I am seeing this issue even with the latest 2.6.25.4 kernel.
In tcp_retransmit_timer(), when retransmits counter exceeds
tcp_retries1 value, the dst cache entry of the socket is reset.
At this time, if we receive an ICMP frag needed message, the
dst entry gets updated with the new MTU, but the TCP sockets
dst_cache entry remains NULL.
So the next time when we try to retransmit after the ICMP frag
needed is received, tcp_retransmit_skb() gets called. Here the
cur_mss value is calculated at the start of the routine with
a NULL sk_dst_cache. Instead we should call tcp_current_mss after
the rebuild_header that caches the dst entry with the updated mtu.
Also the rebuild_header should be called before tcp_fragment
so that skb is fragmented if the mss goes down.
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Wed, 21 May 2008 21:08:38 +0000 (14:08 -0700)]
netfilter: Move linux/types.h inclusions outside of #ifdef __KERNEL__
Greg Steuck <greg@nest.cx> points out that some of the netfilter
headers can't be used in userspace without including linux/types.h
first. The headers include their own linux/types.h include statements,
these are stripped by make headers-install because they are inside
#ifdef __KERNEL__ however. Move them out to fix this.
Reported and Tested by Greg Steuck.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
David Woodhouse [Mon, 19 May 2008 15:32:02 +0000 (16:32 +0100)]
libertas: Fix ethtool statistics
Fix various problems:
- We converted MESH_ACCESS to a direct command but missed this caller.
- We were trying to access mesh stats even on meshless firmware.
- We should really zero the buffer if something goes wrong.
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Helmut Schaa [Tue, 20 May 2008 07:56:37 +0000 (09:56 +0200)]
mac80211: fix NULL pointer dereference in ieee80211_compatible_rates
Fix a possible NULL pointer dereference in ieee80211_compatible_rates
introduced in the patch "mac80211: fix association with some APs". If no bss
is available just use all supported rates in the association request.
Signed-off-by: Helmut Schaa <hschaa@suse.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Denis V. Lunev [Tue, 20 May 2008 22:12:44 +0000 (15:12 -0700)]
pktgen: make sure that pktgen_thread_worker has been executed
The following courruption can happen during pktgen stop:
list_del corruption. prev->next should be ffff81007e8a5e70, but was 6b6b6b6b6b6b6b6b
kernel BUG at lib/list_debug.c:67!
:pktgen:pktgen_thread_worker+0x374/0x10b0
? autoremove_wake_function+0x0/0x40
? _spin_unlock_irqrestore+0x42/0x80
? :pktgen:pktgen_thread_worker+0x0/0x10b0
kthread+0x4d/0x80
child_rip+0xa/0x12
? restore_args+0x0/0x30
? kthread+0x0/0x80
? child_rip+0x0/0x12
RIP list_del+0x48/0x70
The problem is that pktgen_thread_worker can not be executed if kthread_stop
has been called too early. Insert a completion on the normal initialization
path to make sure that pktgen_thread_worker will gain the control for sure.
Signed-off-by: Denis V. Lunev <den@openvz.org> Acked-by: Alexey Dobriyan <adobriyan@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Johannes Berg [Mon, 19 May 2008 05:18:10 +0000 (07:18 +0200)]
mac80211: don't claim iwspy support
We removed iwspy support a very long time ago because it is useless, but
forgot to stop claiming to support it. Apparently, nobody cares, but
remove it nonetheless.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Patrick McHardy [Tue, 20 May 2008 21:54:50 +0000 (14:54 -0700)]
[VLAN]: Propagate selected feature bits to VLAN devices
Propagate feature bits from the NETDEV_FEAT_CHANGE notifier. For now
only TSO is propagated for devices that announce their ability to
support TSO in combination with VLAN accel by setting the NETIF_F_VLAN_TSO
flag.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Bob Copeland [Tue, 13 May 2008 01:16:44 +0000 (21:16 -0400)]
ath5k: Fix loop variable initializations
In ath5k_tasklet_rx, both status structures 'rxs' and 'rs' are
initialized at the top of the tasklet, but not within the loop.
If the loop is executed multiple times in the tasklet then the
variables may see changes from previous packets.
For TKIP, this results in 'Invalid Michael MIC' errors if two packets
are processed in the tasklet: rxs.flag gets set to RX_DECRYPTED by
mac80211 when it decrypts the first encrypted packet. The subsequent
packet will have RX_DECRYPTED set upon entry to mac80211, so mac80211
will not try to decrypt it.
We currently initialize all but two fields in the structures, so fix
the other two.
Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Patrick McHardy [Tue, 20 May 2008 21:37:36 +0000 (14:37 -0700)]
vlan: Correctly handle device notifications for layered VLAN devices
Commit 30688a9 ([VLAN]: Handle vlan devices net namespace changing)
changed the device notifier to special-case notifications for VLAN
devices, effectively disabling state propagation to underlying VLAN
devices. This is needed for layered VLANs though, so restore the
original behaviour.
Signed-off-by: Patrick McHardy <kaber@trash.net> Acked-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
projects / linux-2.6 / log