1. 02 9月, 2010 7 次提交
  2. 01 9月, 2010 4 次提交
    • L
      ath9k_hw: fix parsing of HT40 5 GHz CTLs · 90487974
      Luis R. Rodriguez 提交于
      The 5 GHz CTL indexes were not being read for all hardware
      devices due to the masking out through the CTL_MODE_M mask
      being one bit too short. Without this the calibrated regulatory
      maximum values were not being picked up when devices operate
      on 5 GHz in HT40 mode. The final output power used for Atheros
      devices is the minimum between the calibrated CTL values and
      what CRDA provides.
      
      Cc: stable@kernel.org [2.6.27+]
      Signed-off-by: NLuis R. Rodriguez <lrodriguez@atheros.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      90487974
    • L
      ath9k_hw: Fix EEPROM uncompress block reading on AR9003 · 803288e6
      Luis R. Rodriguez 提交于
      The EEPROM is compressed on AR9003, upon decompression
      the wrong upper limit was being used for the block which
      prevented the 5 GHz CTL indexes from being used, which are
      stored towards the end of the EEPROM block. This fix allows
      the actual intended regulatory limits to be used on AR9003
      hardware.
      
      Cc: stable@kernel.org [2.6.36+]
      Signed-off-by: NLuis R. Rodriguez <lrodriguez@atheros.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      803288e6
    • J
      wireless: register wiphy rfkill w/o holding cfg80211_mutex · c3d34d5d
      John W. Linville 提交于
      Otherwise lockdep complains...
      
      https://bugzilla.kernel.org/show_bug.cgi?id=17311
      
      [ INFO: possible circular locking dependency detected ]
      2.6.36-rc2-git4 #12
      -------------------------------------------------------
      kworker/0:3/3630 is trying to acquire lock:
       (rtnl_mutex){+.+.+.}, at: [<ffffffff813396c7>] rtnl_lock+0x12/0x14
      
      but task is already holding lock:
       (rfkill_global_mutex){+.+.+.}, at: [<ffffffffa014b129>]
      rfkill_switch_all+0x24/0x49 [rfkill]
      
      which lock already depends on the new lock.
      
      the existing dependency chain (in reverse order) is:
      
      -> #2 (rfkill_global_mutex){+.+.+.}:
             [<ffffffff81079ad7>] lock_acquire+0x120/0x15b
             [<ffffffff813ae869>] __mutex_lock_common+0x54/0x52e
             [<ffffffff813aede9>] mutex_lock_nested+0x34/0x39
             [<ffffffffa014b4ab>] rfkill_register+0x2b/0x29c [rfkill]
             [<ffffffffa0185ba0>] wiphy_register+0x1ae/0x270 [cfg80211]
             [<ffffffffa0206f01>] ieee80211_register_hw+0x1b4/0x3cf [mac80211]
             [<ffffffffa0292e98>] iwl_ucode_callback+0x9e9/0xae3 [iwlagn]
             [<ffffffff812d3e9d>] request_firmware_work_func+0x54/0x6f
             [<ffffffff81065d15>] kthread+0x8c/0x94
             [<ffffffff8100ac24>] kernel_thread_helper+0x4/0x10
      
      -> #1 (cfg80211_mutex){+.+.+.}:
             [<ffffffff81079ad7>] lock_acquire+0x120/0x15b
             [<ffffffff813ae869>] __mutex_lock_common+0x54/0x52e
             [<ffffffff813aede9>] mutex_lock_nested+0x34/0x39
             [<ffffffffa018605e>] cfg80211_get_dev_from_ifindex+0x1b/0x7c [cfg80211]
             [<ffffffffa0189f36>] cfg80211_wext_giwscan+0x58/0x990 [cfg80211]
             [<ffffffff8139a3ce>] ioctl_standard_iw_point+0x1a8/0x272
             [<ffffffff8139a529>] ioctl_standard_call+0x91/0xa7
             [<ffffffff8139a687>] T.723+0xbd/0x12c
             [<ffffffff8139a727>] wext_handle_ioctl+0x31/0x6d
             [<ffffffff8133014e>] dev_ioctl+0x63d/0x67a
             [<ffffffff8131afd9>] sock_ioctl+0x48/0x21d
             [<ffffffff81102abd>] do_vfs_ioctl+0x4ba/0x509
             [<ffffffff81102b5d>] sys_ioctl+0x51/0x74
             [<ffffffff81009e02>] system_call_fastpath+0x16/0x1b
      
      -> #0 (rtnl_mutex){+.+.+.}:
             [<ffffffff810796b0>] __lock_acquire+0xa93/0xd9a
             [<ffffffff81079ad7>] lock_acquire+0x120/0x15b
             [<ffffffff813ae869>] __mutex_lock_common+0x54/0x52e
             [<ffffffff813aede9>] mutex_lock_nested+0x34/0x39
             [<ffffffff813396c7>] rtnl_lock+0x12/0x14
             [<ffffffffa0185cb5>] cfg80211_rfkill_set_block+0x1a/0x7b [cfg80211]
             [<ffffffffa014aed0>] rfkill_set_block+0x80/0xd5 [rfkill]
             [<ffffffffa014b07e>] __rfkill_switch_all+0x3f/0x6f [rfkill]
             [<ffffffffa014b13d>] rfkill_switch_all+0x38/0x49 [rfkill]
             [<ffffffffa014b821>] rfkill_op_handler+0x105/0x136 [rfkill]
             [<ffffffff81060708>] process_one_work+0x248/0x403
             [<ffffffff81062620>] worker_thread+0x139/0x214
             [<ffffffff81065d15>] kthread+0x8c/0x94
             [<ffffffff8100ac24>] kernel_thread_helper+0x4/0x10
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      Acked-by: NJohannes Berg <johannes@sipsolutions.net>
      c3d34d5d
    • D
      netlink: Make NETLINK_USERSOCK work again. · b963ea89
      David S. Miller 提交于
      Once we started enforcing the a nl_table[] entry exist for
      a protocol, NETLINK_USERSOCK stopped working.  Add a dummy
      table entry so that it works again.
      Reported-by: NThomas Voegtle <tv@lio96.de>
      Tested-by: NThomas Voegtle <tv@lio96.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b963ea89
  3. 31 8月, 2010 6 次提交
  4. 29 8月, 2010 1 次提交
  5. 28 8月, 2010 2 次提交
    • J
      net/ipv4: Eliminate kstrdup memory leak · c34186ed
      Julia Lawall 提交于
      The string clone is only used as a temporary copy of the argument val
      within the while loop, and so it should be freed before leaving the
      function.  The call to strsep, however, modifies clone, so a pointer to the
      front of the string is kept in saved_clone, to make it possible to free it.
      
      The sematic match that finds this problem is as follows:
      (http://coccinelle.lip6.fr/)
      
      // <smpl>
      @r exists@
      local idexpression x;
      expression E;
      identifier l;
      statement S;
      @@
      
      *x= \(kasprintf\|kstrdup\)(...);
      ...
      if (x == NULL) S
      ... when != kfree(x)
          when != E = x
      if (...) {
        <... when != kfree(x)
      * goto l;
        ...>
      * return ...;
      }
      // </smpl>
      Signed-off-by: NJulia Lawall <julia@diku.dk>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c34186ed
    • M
      libertas: if_sdio: fix buffer alignment in struct if_sdio_card · 557de5eb
      Mike Rapoport 提交于
      The commit 886275ce (param: lock
      if_sdio's lbs_helper_name and lbs_fw_name against sysfs changes)
      introduced new fields into the if_sdio_card structure. It caused
      missalignment of the if_sdio_card.buffer field and failure at driver
      load time:
      
        ~# modprobe libertas_sdio
        [   62.315124] libertas_sdio: Libertas SDIO driver
        [   62.319976] libertas_sdio: Copyright Pierre Ossman
        [   63.020629] DMA misaligned error with device 48
        [   63.025207] mmci-omap-hs mmci-omap-hs.1: unexpected dma status 800
        [   66.005035] libertas: command 0x0003 timed out
        [   66.009826] libertas: Timeout submitting command 0x0003
        [   66.016296] libertas: PREP_CMD: command 0x0003 failed: -110
      
      Adding explicit alignment attribute for the if_sdio_card.buffer field
      fixes this problem.
      Signed-off-by: NMike Rapoport <mike@compulab.co.il>
      Acked-by: NMarek Vasut <marek.vasut@gmail.com>
      Acked-by: NDan Williams <dcbw@redhat.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      557de5eb
  6. 27 8月, 2010 4 次提交
  7. 26 8月, 2010 2 次提交
    • K
      tcp: select(writefds) don't hang up when a peer close connection · d84ba638
      KOSAKI Motohiro 提交于
      This issue come from ruby language community. Below test program
      hang up when only run on Linux.
      
      	% uname -mrsv
      	Linux 2.6.26-2-486 #1 Sat Dec 26 08:37:39 UTC 2009 i686
      	% ruby -rsocket -ve '
      	BasicSocket.do_not_reverse_lookup = true
      	serv = TCPServer.open("127.0.0.1", 0)
      	s1 = TCPSocket.open("127.0.0.1", serv.addr[1])
      	s2 = serv.accept
      	s2.close
      	s1.write("a") rescue p $!
      	s1.write("a") rescue p $!
      	Thread.new {
      	  s1.write("a")
      	}.join'
      	ruby 1.9.3dev (2010-07-06 trunk 28554) [i686-linux]
      	#<Errno::EPIPE: Broken pipe>
      	[Hang Here]
      
      FreeBSD, Solaris, Mac doesn't. because Ruby's write() method call
      select() internally. and tcp_poll has a bug.
      
      SUS defined 'ready for writing' of select() as following.
      
      |  A descriptor shall be considered ready for writing when a call to an output
      |  function with O_NONBLOCK clear would not block, whether or not the function
      |  would transfer data successfully.
      
      That said, EPIPE situation is clearly one of 'ready for writing'.
      
      We don't have read-side issue because tcp_poll() already has read side
      shutdown care.
      
      |        if (sk->sk_shutdown & RCV_SHUTDOWN)
      |                mask |= POLLIN | POLLRDNORM | POLLRDHUP;
      
      So, Let's insert same logic in write side.
      
      - reference url
        http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/31065
        http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/31068Signed-off-by: NKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d84ba638
    • E
      tcp: fix three tcp sysctls tuning · c5ed63d6
      Eric Dumazet 提交于
      As discovered by Anton Blanchard, current code to autotune 
      tcp_death_row.sysctl_max_tw_buckets, sysctl_tcp_max_orphans and
      sysctl_max_syn_backlog makes little sense.
      
      The bigger a page is, the less tcp_max_orphans is : 4096 on a 512GB
      machine in Anton's case.
      
      (tcp_hashinfo.bhash_size * sizeof(struct inet_bind_hashbucket))
      is much bigger if spinlock debugging is on. Its wrong to select bigger
      limits in this case (where kernel structures are also bigger)
      
      bhash_size max is 65536, and we get this value even for small machines. 
      
      A better ground is to use size of ehash table, this also makes code
      shorter and more obvious.
      
      Based on a patch from Anton, and another from David.
      Reported-and-tested-by: NAnton Blanchard <anton@samba.org>
      Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c5ed63d6
  8. 25 8月, 2010 7 次提交
    • D
      tcp: Combat per-cpu skew in orphan tests. · ad1af0fe
      David S. Miller 提交于
      As reported by Anton Blanchard when we use
      percpu_counter_read_positive() to make our orphan socket limit checks,
      the check can be off by up to num_cpus_online() * batch (which is 32
      by default) which on a 128 cpu machine can be as large as the default
      orphan limit itself.
      
      Fix this by doing the full expensive sum check if the optimized check
      triggers.
      Reported-by: NAnton Blanchard <anton@samba.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      Acked-by: NEric Dumazet <eric.dumazet@gmail.com>
      ad1af0fe
    • D
      pxa168_eth: silence gcc warnings · b2bc8563
      Dan Carpenter 提交于
      Casting "pep->tx_desc_dma" to to a struct tx_desc pointer makes gcc
      complain:
      
      drivers/net/pxa168_eth.c:657: warning:
      	cast to pointer from integer of different size
      Signed-off-by: NDan Carpenter <error27@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b2bc8563
    • D
      pxa168_eth: update call to phy_mii_ioctl() · 4f2c8510
      Dan Carpenter 提交于
      The phy_mii_ioctl() function changed recently.  It now takes a struct
      ifreq pointer directly.
      Signed-off-by: NDan Carpenter <error27@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4f2c8510
    • D
      pxa168_eth: fix error handling in prope · 945c7c73
      Dan Carpenter 提交于
      A couple issues here:
      * Some resources weren't released.
      * If alloc_etherdev() failed it would have caused a NULL dereference
        because "pep" would be null when we checked "if (pep->clk)".
      * Also it's better to propagate the error codes from mdiobus_register()
        instead of just returning -ENOMEM.
      Signed-off-by: NDan Carpenter <error27@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      945c7c73
    • D
      pxa168_eth: remove unneeded null check · 4169591f
      Dan Carpenter 提交于
      "pep->pd" isn't checked consistently in this function.  For example it's
      dereferenced unconditionally on the next line after the end of the if
      condition.  This function is only called from pxa168_eth_probe() and
      pep->pd is always non-NULL so I removed the check.
      Signed-off-by: NDan Carpenter <error27@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4169591f
    • A
      phylib: Fix race between returning phydev and calling adjust_link · ef24b16b
      Anton Vorontsov 提交于
      It is possible that phylib will call adjust_link before returning
      from {,of_}phy_connect(), which may cause the following [very rare,
      though] oops upon reopening the device:
      
        Unable to handle kernel paging request for data at address 0x0000024c
        Oops: Kernel access of bad area, sig: 11 [#1]
        PREEMPT SMP NR_CPUS=2 LTT NESTING LEVEL : 0
        P1021 RDB
        Modules linked in:
        NIP: c0345dac LR: c0345dac CTR: c0345d84
        TASK = dffab6b0[30] 'events/0' THREAD: c0d24000 CPU: 0
        [...]
        NIP [c0345dac] adjust_link+0x28/0x19c
        LR [c0345dac] adjust_link+0x28/0x19c
        Call Trace:
        [c0d25f00] [000045e1] 0x45e1 (unreliable)
        [c0d25f30] [c036c158] phy_state_machine+0x3ac/0x554
        [...]
      
      Here is why. Drivers store phydev in their private structures, e.g.
      gianfar driver:
      
      static int init_phy(struct net_device *dev)
      {
      	...
      	priv->phydev = of_phy_connect(...);
      	...
      }
      
      So that adjust_link could retrieve it back:
      
      static void adjust_link(struct net_device *dev)
      {
      	...
      	struct phy_device *phydev = priv->phydev;
      	...
      }
      
      If the device has been opened before, then phydev->state is set to
      PHY_HALTED (or undefined if the driver didn't call phy_stop()).
      
      Now, phy_connect starts the PHY state machine before returning phydev to
      the driver:
      
      	phy_start_machine(phydev, NULL);
      
      	if (phydev->irq > 0)
      		phy_start_interrupts(phydev);
      
      	return phydev;
      
      The time between 'phy_start_machine()' and 'return phydev' is undefined.
      The start machine routine delays execution for 1 second, which is enough
      for most cases. But under heavy load, or if you're unlucky, it is quite
      possible that PHY state machine will execute before phy_connect()
      returns, and so adjust_link callback will try to dereference phydev,
      which is not yet ready.
      
      To fix the issue, simply initialize the PHY's state to PHY_READY during
      phy_attach(). This will ensure that phylib won't call adjust_link before
      phy_start().
      Signed-off-by: NAnton Vorontsov <avorontsov@mvista.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ef24b16b
    • H
      caif-driver: add HAS_DMA dependency · 9dc002d8
      Heiko Carstens 提交于
      Fix this error on an s390 allyesconfig build:
      
      linux-2.6/drivers/net/caif/caif_spi.c:98:
          undefined reference to `dma_free_coherent'
      
      Cc: Sjur Braendeland <sjur.brandeland@stericsson.com>
      Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9dc002d8
  9. 24 8月, 2010 5 次提交
  10. 23 8月, 2010 2 次提交
    • R
      isdn/avm: fix build when PCMCIA is not enabled · 6a6d01d3
      Randy Dunlap 提交于
      Why wouldn't kconfig symbol ISDN_DRV_AVMB1_B1PCMCIA also depend on
      PCMCIA?
      
      Fix build for PCMCIA not enabled:
      
      ERROR: "b1_free_card" [drivers/isdn/hardware/avm/b1pcmcia.ko] undefined!
      ERROR: "b1ctl_proc_fops" [drivers/isdn/hardware/avm/b1pcmcia.ko] undefined!
      ERROR: "b1_reset_ctr" [drivers/isdn/hardware/avm/b1pcmcia.ko] undefined!
      ERROR: "b1_load_firmware" [drivers/isdn/hardware/avm/b1pcmcia.ko] undefined!
      ERROR: "b1_send_message" [drivers/isdn/hardware/avm/b1pcmcia.ko] undefined!
      ERROR: "b1_release_appl" [drivers/isdn/hardware/avm/b1pcmcia.ko] undefined!
      ERROR: "b1_register_appl" [drivers/isdn/hardware/avm/b1pcmcia.ko] undefined!
      ERROR: "b1_getrevision" [drivers/isdn/hardware/avm/b1pcmcia.ko] undefined!
      ERROR: "b1_detect" [drivers/isdn/hardware/avm/b1pcmcia.ko] undefined!
      ERROR: "b1_interrupt" [drivers/isdn/hardware/avm/b1pcmcia.ko] undefined!
      ERROR: "b1_alloc_card" [drivers/isdn/hardware/avm/b1pcmcia.ko] undefined!
      Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
      Cc: Carsten Paeth <calle@calle.de>
      Cc: Karsten Keil <isdn@linux-pingi.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      6a6d01d3
    • C
      header: fix broken headers for user space · 09cd2b99
      Changli Gao 提交于
      __packed is only defined in kernel space, so we should use
      __attribute__((packed)) for the code shared between kernel and user space.
      
      Two __attribute() annotations are replaced with __attribute__() too.
      Signed-off-by: NChangli Gao <xiaosuo@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      09cd2b99