- 30 5月, 2008 1 次提交
-
-
由 Arnaldo Carvalho de Melo 提交于
llc_sap_rcv was being preceded by skb_set_owner_r, then calling llc_state_process that calls sock_queue_rcv_skb, that in turn calls skb_set_owner_r again making the space allowed to be used by the socket to be leaked, making the socket to get stuck. Fix it by setting skb->sk at llc_sap_rcv and leave the accounting to be done only at sock_queue_rcv_skb. Reported-by: NDmitry Petukhov <dmgenp@gmail.com> Tested-by: NDmitry Petukhov <dmgenp@gmail.com> Signed-off-by: NArnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 29 5月, 2008 24 次提交
-
-
由 Alexey Dobriyan 提交于
Signed-off-by: NAlexey Dobriyan <adobriyan@parallels.com> Signed-off-by: NPatrick McHardy <kaber@trash.net> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
由 David S. Miller 提交于
-
由 Arjan van de Ven 提交于
in net/bluetooth/rfcomm/sock.c, rfcomm_sk_state_change() does the following operation: if (parent && sock_flag(sk, SOCK_ZAPPED)) { /* We have to drop DLC lock here, otherwise * rfcomm_sock_destruct() will dead lock. */ rfcomm_dlc_unlock(d); rfcomm_sock_kill(sk); rfcomm_dlc_lock(d); } } which is fine, since rfcomm_sock_kill() will call sk_free() which will call rfcomm_sock_destruct() which takes the rfcomm_dlc_lock()... so far so good. HOWEVER, this assumes that the rfcomm_sk_state_change() function always gets called with the rfcomm_dlc_lock() taken. This is the case for all but one case, and in that case where we don't have the lock, we do a double unlock followed by an attempt to take the lock, which due to underflow isn't going anywhere fast. This patch fixes this by moving the stragling case inside the lock, like the other usages of the same call are doing in this code. This was found with the help of the www.kerneloops.org project, where this deadlock was observed 51 times at this point in time: http://www.kerneloops.org/search.php?search=rfcomm_sock_destructSigned-off-by: NArjan van de Ven <arjan@linux.intel.com> Acked-by: NMarcel Holtmann <marcel@holtmann.org> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
由 Senthil Balasubramanian 提交于
This addresses an alignment issue with compare_ether_addr(). The addresses passed to compare_ether_addr should be two bytes aligned. It may function properly in x86 platform. However may not work properly on IA-64 or ARM processor. This also fixes a typo in mlme.c where the sk_buff struct name is incorect. Though sizeof() works for any incorrect structure pointer name as its just a pointer length that we want, lets just fix it. Signed-off-by: NSenthil Balasubramanian <senthilkumar@atheros.com> Signed-off-by: NLuis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Senthil Balasubramanian 提交于
This addresses a NULL pointer dereference in sta_info_get(). TID and sta_info are extracted in ADDBA Timer expiry function through the timer handler's argument. The problem is extracging the TID (which was stored in timer_to_tid[] array of type "u8") through "int *" typecast which may also yield unwanted bytes for the MSB of TID that results in incorrect sta_info and ieee80211_local pointers. ieee80211_local pointer is NULL as illustrated below, it crashes in sta_info_get(). The problem started when extracting ieee80211_local pointer out of sta_info iteself and eventually crashed in stat_info_get(). The proper way to fix is to change the data type of TID to u8 instead of u16. However changing all the occurences requires some prototype changes as well. We should fix this in upcoming patches. Signed-off-by: NSenthil Balasubramanian <senthilkumar@atheros.com> Signed-off-by: NLuis Rodriguez <lrodriguez@atheros.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Yi Zhu 提交于
fix a typo in ieee80211_handle_filtered_frame comment Signed-off-by: NYi Zhu <yi.zhu@intel.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Jussi Kivilinna 提交于
Range check for power_output were missing. Signed-off-by: NJussi Kivilinna <jussi.kivilinna@mbnet.fi> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Guy Cohen 提交于
This patch fixes a case that a wrong maximal rate is selected when searching for better configurations. Signed-off-by: NGuy Cohen <guy.cohen@intel.com> Signed-off-by: NTomas Winkler <tomas.winkler@intel.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Guy Cohen 提交于
When exiting from stay in table state (e.g. timer expiration), all the statistics are reset and the RS flow should not continue but only after enough statistics are collected again. Signed-off-by: NGuy Cohen <guy.cohen@intel.com> Signed-off-by: NTomas Winkler <tomas.winkler@intel.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Scott Ashcroft 提交于
This patch allows the rndis_wlan driver to connect to TKIP PSK networks. It uses the ASSOCIATION_INFORMATION RNDIS call to pull back the IEs and sends them back to userspace using wireless events. Tested on a few wireless networks I have access to. Based on the similar code in ndiswrapper. Signed-off-by: NScott Ashcroft <scott.ashcroft@talk21.com> [edit: cleanups] Signed-off-by: NJussi Kivilinna <jussi.kivilinna@mbnet.fi> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Abhijeet Kolekar 提交于
iwconfig was showing incorrect status messages when disassociated. Patch fixes this by always checking for association status in ioctl calls for getting ap address. Signed-off-by: NAbhijeet Kolekar <abhijeet.kolekar@intel.com> Acked-by: NDan Williams <dcbw@redhat.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Ivo van Doorn 提交于
rt2x00lib_beacondone() is called from interrupt context, this means we cannot use the mac80211 interface iterator that uses the rtnl lock (since that uses a mutex which can sleep). Instead we should use the atomic mac80211 interface iterator. Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Ivo van Doorn 提交于
When the antenna configuration has changed we should reset the antenna RSSI value. Otherwise the value will be influenced by the previous configuration quality which in turn will affect the antenna diversity. Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Ivo van Doorn 提交于
Link quality estimation became quite low for all rt2x00 drivers because the number of retries it took to send the frame were counted as failure. This does not correspond to the legacy driver link quality calculation, by not counting it we will send somewhat more optimistic values to mac80211. Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Ivo van Doorn 提交于
When the tx() handler runs while the device has disapeared, we did return NETDEV_TX_OK but didn't free the skb. Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Tomas Winkler 提交于
This patch switch order of channel and freq (SIOCGIWFREQ) reports in scan results in order to overcome wpa_supplicant inability to handle channel numbers in 5.2Ghz band. Wext reporting channel number is ambiguous as channels 7-12 (802.11j) exist on both bands. Signed-off-by: NTomas Winkler <tomas.winkler@intel.com> Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com> Acked-by: NDan Williams <dcbw@redhat.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Michael Buesch 提交于
This fixes a kernel crash on rmmod, in the case where the controller was restarted before doing the rmmod. Signed-off-by: NMichael Buesch <mb@bu3sch.de> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Tomas Winkler 提交于
This patch fixes iee80211_rx_bss_put/get imbalance introduced by 'mac80211: enable IBSS merging' patch. Signed-off-by: NTomas Winkler <tomas.winkler@intel.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Nicolas Kaiser 提交于
Correct always true conditionals. Signed-off-by: NNicolas Kaiser <nikai@nikai.net> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Michael Buesch 提交于
This updates the beacon template code to upload both templates, if we never uploaded one before. Signed-off-by: NMichael Buesch <mb@bu3sch.de> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Andrea Merello 提交于
The grf5101 RF code needs to invoke grf5101_write_phy_antenna every time the channel is being switch. This should be done passing the channel number to that function. Incorrectly we were passing the same value that is written on the channel RF register. This may cause problems when operating on ch 14. This patch fixes it. Thanks to Alessandro Di Marco who found this issue! Signed-off-by: NAndrea Merello <andreamrl@tiscali.it> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Andrea Merello 提交于
The max2820 RF code needs to invoke max2820_write_phy_antenna every time the channel is being switch. This should be done passing the channel number to that function. Incorrectly we were passing the same value that is written on the channel RF register. This may cause problems when operating on ch 14. This patch fixes it. Thanks to Alessandro Di Marco who found this issue! Signed-off-by: NAndrea Merello <andreamrl@tiscali.it> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Andrea Merello 提交于
The sa2400 RF code needs to invoke sa2400_write_phy_antenna every time the channel is being switch. This should be done passing the channel number to that function. Incorrectly we were passing the same value that is written on the channel RF register. This may cause problems when operating on ch 14. This patch fixes it. Thanks to Alessandro Di Marco who found this issue! Signed-off-by: NAndrea Merello <andreamrl@tiscali.it> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 John W. Linville 提交于
The static function max2820_rf_set_channel is called with conf == NULL within its compilation unit. Originally this defaulted to b/g channel 1, but "cfg80211 API for channels/bitrates, mac80211 and driver conversion" (commit 8318d78a) mistakenly dropped this check. This patch minimally restores the expected behavior. Reported-by: NColin Lai <colin_sh@163.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 27 5月, 2008 2 次提交
-
-
由 Gerrit Renker 提交于
The identification of this bug is thanks to Cheng Wei and Tomasz Grobelny. To avoid divide-by-zero, the implementation previously ignored RTTs smaller than 4 microseconds when performing integer division RTT/4. When the RTT reached a value less than 4 microseconds (as observed on loopback), this prevented the Window Counter CCVal value from advancing. As a result, the receiver stopped sending feedback. This in turn caused non-ending expiries of the nofeedback timer at the sender, so that the sending rate was progressively reduced until reaching the minimum of one packet per 64 seconds. The patch fixes this bug by handling integer division more intelligently. Due to consistent use of dccp_sample_rtt(), divide-by-zero-RTT is avoided. Signed-off-by: NGerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
由 Wei Yongjun 提交于
RFC4340 said: 8.5. Pseudocode ... If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet has short sequence numbers), drop packet and return But DCCP has some mistake to handle short sequence numbers packet, now it drop packet only if P.type is Data, Ack, or DataAck and P.X == 0. Signed-off-by: NWei Yongjun <yjwei@cn.fujitsu.com> Acked-by: NGerrit Renker <gerrit@erg.abdn.ac.uk> Acked-by: NArnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 23 5月, 2008 9 次提交
-
-
由 Patrick McHardy 提交于
Herbert Xu points out that the use of seperate feature bits for features to be propagated to VLAN devices is going to get messy real soon. Replace the VLAN feature bits by a bitmask of feature flags to be propagated and restore the old GSO_SHIFT/MASK values. Signed-off-by: NPatrick McHardy <kaber@trash.net> Acked-by: NHerbert Xu <herbert@gondor.apana.org.au> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
由 David S. Miller 提交于
-
由 Komuro 提交于
fmvj18x_cs: The manfid of "NextCom NC5310 rev B" is MANF_ID_FUJITSU. but this card is MBH10302 based card. use ConfigBase to detect the cardtype for this card. Signed-off-by: NKomuro <komurojun-mbn@nifty.com> Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
-
由 Komuro 提交于
keep bit7,8 of XIRCREG42_SWC1 in set_multicast_list. Signed-off-by: NKomuro <komurojun-mbn@nifty.com> Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
-
由 Wang Chen 提交于
If alloc_skb failed, the recieved packet will be dropped. Do not increase rx_bytes for dropped packet. Signed-off-by: NWang Chen <wangchen@cn.fujitsu.com> Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
-
由 Wang Chen 提交于
Use standard routine for queue purging. Signed-off-by: NWang Chen <wangchen@cn.fujitsu.com> Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
-
由 Wang Chen 提交于
Use standard routine for queue purging. Signed-off-by: NWang Chen <wangchen@cn.fujitsu.com> Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
-
由 Paul Gortmaker 提交于
Commit cac1f3c8 factored out the code for get_phy_id so that it could be reused in multiple places. Turns out that some of the users can be modular, so we need to export this symbol as well. Signed-off-by: NPaul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
-
由 Thomas Graf 提交于
The purpose of nla_parse_nested_compat() is to parse attributes which contain a struct followed by a stream of nested attributes. So far, it called nla_parse_nested() to parse the stream of nested attributes which was wrong, as nla_parse_nested() expects a container attribute as data which holds the attribute stream. It needs to call nla_parse() directly while pointing at the next possible alignment point after the struct in the beginning of the attribute. With this patch, I can no longer reproduce the reported leftover warnings. Signed-off-by: NThomas Graf <tgraf@suug.ch> Acked-by: NPatrick McHardy <kaber@trash.net> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 22 5月, 2008 4 次提交
-
-
由 Krzysztof Halasa 提交于
WAN: protect protocol list in hdlc.c with RTNL. Signed-off-by: NKrzysztof Hałasa <khc@pm.waw.pl> Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
-
由 Julia Lawall 提交于
The following code appears in the function fs_init_instance in the file drivers/net/fs_enet/fs_enet-main.c. if (fep->ops == NULL) { printk(KERN_ERR DRV_MODULE_NAME ": %s No matching ops found (%d).\n", ndev->name, fpi->fs_no); err = -EINVAL; goto err; } This code implies that at the point of err, fep->ops can be NULL, so an extra test is needed before dereferencing this value. This problem was found using the following semantic match (http://www.emn.fr/x-info/coccinelle/) // <smpl> @@ expression E, E1; identifier f; statement S1,S2,S3; @@ * if (E == NULL) { ... when != if (E == NULL) S1 else S2 when != E = E1 * E->f ... when any return ...; } else S3 // </smpl> Signed-off-by: NJulia Lawall <julia@diku.dk> Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
-
由 Sreenivasa Honnur 提交于
- Updated version number Signed-off-by: NSreenivasa Honnur <sreenivasa.honnur@neterion.com> Signed-off-by: NRamkrishna Vepa <ram.vepa@neterion.com> Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
-
由 Sreenivasa Honnur 提交于
- Added napi support when MSIX is enabled. - Moved test_msi function from s2io_open to probe function. Signed-off-by: NSreenivasa Honnur <sreenivasa.honnur@neterion.com> Signed-off-by: NRamkrishna Vepa <ram.vepa@neterion.com> Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
-