1. 10 3月, 2011 2 次提交
  2. 09 3月, 2011 4 次提交
    • J
      vxge: update MAINTAINERS · e3806882
      Jon Mason 提交于
      Exar has exited the 10G Ethernet NIC market, orphaning both the s2io and
      vxge drivers.  With the promise of free hardware, I'll take over
      maintainership.
      Signed-off-by: NJon Mason <jdmason@kudzu.us>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e3806882
    • F
      86f99fff
    • S
      r6040: fix multicast operations · c60c9c71
      Shawn Lin 提交于
      The original code does not work well when the number of mulitcast
      address to handle is greater than MCAST_MAX. It only enable promiscous
      mode instead of multicast hash table mode, so the hash table function
      will not be activated and all multicast frames will be recieved in this
      condition.
      
      This patch fixes the following issues with the r6040 NIC operating in
      multicast:
      
      1) When the IFF_ALLMULTI flag is set, we should write 0xffff to the NIC
      hash table registers to make it process multicast traffic.
      
      2) When the number of multicast address to handle is smaller than
      MCAST_MAX, we should use the NIC multicast registers MID1_{L,M,H}.
      
      3) The hashing of the address was not correct, due to an invalid
      substraction (15 - (crc & 0x0f)) instead of (crc & 0x0f) and an
      incorrect crc algorithm (ether_crc_le) instead of (ether_crc).
      
      4) If necessary, we should set HASH_EN flag in MCR0 to enable multicast
      hash table function.
      Reported-by: NMarc Leclerc <marc-leclerc@signaturealpha.com>
      Tested-by: NMarc Leclerc <marc-leclerc@signaturealpha.com>
      Signed-off-by: NShawn Lin <shawn@dmp.com.tw>
      Signed-off-by: NAlbert Chen <albert.chen@rdc.com.tw>
      Signed-off-by: NFlorian Fainelli <florian@openwrt.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c60c9c71
    • N
      rds: prevent BUG_ON triggering on congestion map updates · 6094628b
      Neil Horman 提交于
      Recently had this bug halt reported to me:
      
      kernel BUG at net/rds/send.c:329!
      Oops: Exception in kernel mode, sig: 5 [#1]
      SMP NR_CPUS=1024 NUMA pSeries
      Modules linked in: rds sunrpc ipv6 dm_mirror dm_region_hash dm_log ibmveth sg
      ext4 jbd2 mbcache sd_mod crc_t10dif ibmvscsic scsi_transport_srp scsi_tgt
      dm_mod [last unloaded: scsi_wait_scan]
      NIP: d000000003ca68f4 LR: d000000003ca67fc CTR: d000000003ca8770
      REGS: c000000175cab980 TRAP: 0700   Not tainted  (2.6.32-118.el6.ppc64)
      MSR: 8000000000029032 <EE,ME,CE,IR,DR>  CR: 44000022  XER: 00000000
      TASK = c00000017586ec90[1896] 'krdsd' THREAD: c000000175ca8000 CPU: 0
      GPR00: 0000000000000150 c000000175cabc00 d000000003cb7340 0000000000002030
      GPR04: ffffffffffffffff 0000000000000030 0000000000000000 0000000000000030
      GPR08: 0000000000000001 0000000000000001 c0000001756b1e30 0000000000010000
      GPR12: d000000003caac90 c000000000fa2500 c0000001742b2858 c0000001742b2a00
      GPR16: c0000001742b2a08 c0000001742b2820 0000000000000001 0000000000000001
      GPR20: 0000000000000040 c0000001742b2814 c000000175cabc70 0800000000000000
      GPR24: 0000000000000004 0200000000000000 0000000000000000 c0000001742b2860
      GPR28: 0000000000000000 c0000001756b1c80 d000000003cb68e8 c0000001742b27b8
      NIP [d000000003ca68f4] .rds_send_xmit+0x4c4/0x8a0 [rds]
      LR [d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds]
      Call Trace:
      [c000000175cabc00] [d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds]
      (unreliable)
      [c000000175cabd30] [d000000003ca7e64] .rds_send_worker+0x54/0x100 [rds]
      [c000000175cabdb0] [c0000000000b475c] .worker_thread+0x1dc/0x3c0
      [c000000175cabed0] [c0000000000baa9c] .kthread+0xbc/0xd0
      [c000000175cabf90] [c000000000032114] .kernel_thread+0x54/0x70
      Instruction dump:
      4bfffd50 60000000 60000000 39080001 935f004c f91f0040 41820024 813d017c
      7d094a78 7d290074 7929d182 394a0020 <0b090000> 40e2ff68 4bffffa4 39200000
      Kernel panic - not syncing: Fatal exception
      Call Trace:
      [c000000175cab560] [c000000000012e04] .show_stack+0x74/0x1c0 (unreliable)
      [c000000175cab610] [c0000000005a365c] .panic+0x80/0x1b4
      [c000000175cab6a0] [c00000000002fbcc] .die+0x21c/0x2a0
      [c000000175cab750] [c000000000030000] ._exception+0x110/0x220
      [c000000175cab910] [c000000000004b9c] program_check_common+0x11c/0x180
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      6094628b
  3. 08 3月, 2011 6 次提交
  4. 07 3月, 2011 4 次提交
  5. 04 3月, 2011 10 次提交
    • L
      Merge branch 'for-linus' of... · b65a0e0c
      Linus Torvalds 提交于
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
        DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]
      b65a0e0c
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 · 4438a02f
      Linus Torvalds 提交于
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits)
        MAINTAINERS: Add Andy Gospodarek as co-maintainer.
        r8169: disable ASPM
        RxRPC: Fix v1 keys
        AF_RXRPC: Handle receiving ACKALL packets
        cnic: Fix lost interrupt on bnx2x
        cnic: Prevent status block race conditions with hardware
        net: dcbnl: check correct ops in dcbnl_ieee_set()
        e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead
        igb: fix sparse warning
        e1000: fix sparse warning
        netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values
        dccp: fix oops on Reset after close
        ipvs: fix dst_lock locking on dest update
        davinci_emac: Add Carrier Link OK check in Davinci RX Handler
        bnx2x: update driver version to 1.62.00-6
        bnx2x: properly calculate lro_mss
        bnx2x: perform statistics "action" before state transition.
        bnx2x: properly configure coefficients for MinBW algorithm (NPAR mode).
        bnx2x: Fix ethtool -t link test for MF (non-pmf) devices.
        bnx2x: Fix nvram test for single port devices.
        ...
      4438a02f
    • L
      Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block · fb4b10ab
      Linus Torvalds 提交于
      * 'for-linus' of git://git.kernel.dk/linux-2.6-block:
        block: kill loop_mutex
        blktrace: Remove blk_fill_rwbs_rq.
        block: blk-flush shouldn't call directly into q->request_fn() __blk_run_queue()
        block: add @force_kblockd to __blk_run_queue()
        block: fix kernel-doc format for blkdev_issue_zeroout
        blk-throttle: Do not use kblockd workqueue for throtl work
      fb4b10ab
    • L
      Merge branch 'i_nlink' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 · 83360269
      Linus Torvalds 提交于
      * 'i_nlink' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
        hfs: fix rename() over non-empty directory
        udf: fix i_nlink limit
        fix reiserfs mkdir() breakage
        exofs: i_nlink races in rename()
        nilfs2: i_nlink races in rename()
        minix: i_nlink races in rename()
        ufs: i_nlink races in rename()
        sysv: i_nlink races in rename()
      83360269
    • D
      DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076] · 1362fa07
      David Howells 提交于
      When a DNS resolver key is instantiated with an error indication, attempts to
      read that key will result in an oops because user_read() is expecting there to
      be a payload - and there isn't one [CVE-2011-1076].
      
      Give the DNS resolver key its own read handler that returns the error cached in
      key->type_data.x[0] as an error rather than crashing.
      
      Also make the kenter() at the beginning of dns_resolver_instantiate() limit the
      amount of data it prints, since the data is not necessarily NUL-terminated.
      
      The buggy code was added in:
      
      	commit 4a2d7892
      	Author: Wang Lei <wang840925@gmail.com>
      	Date:   Wed Aug 11 09:37:58 2010 +0100
      	Subject: DNS: If the DNS server returns an error, allow that to be cached [ver #2]
      
      This can trivially be reproduced by any user with the following program
      compiled with -lkeyutils:
      
      	#include <stdlib.h>
      	#include <keyutils.h>
      	#include <err.h>
      	static char payload[] = "#dnserror=6";
      	int main()
      	{
      		key_serial_t key;
      		key = add_key("dns_resolver", "a", payload, sizeof(payload),
      			      KEY_SPEC_SESSION_KEYRING);
      		if (key == -1)
      			err(1, "add_key");
      		if (keyctl_read(key, NULL, 0) == -1)
      			err(1, "read_key");
      		return 0;
      	}
      
      What should happen is that keyctl_read() reports error 6 (ENXIO) to the user:
      
      	dns-break: read_key: No such device or address
      
      but instead the kernel oopses.
      
      This cannot be reproduced with the 'keyutils add' or 'keyutils padd' commands
      as both of those cut the data down below the NUL termination that must be
      included in the data.  Without this dns_resolver_instantiate() will return
      -EINVAL and the key will not be instantiated such that it can be read.
      
      The oops looks like:
      
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
      IP: [<ffffffff811b99f7>] user_read+0x4f/0x8f
      PGD 3bdf8067 PUD 385b9067 PMD 0
      Oops: 0000 [#1] SMP
      last sysfs file: /sys/devices/pci0000:00/0000:00:19.0/irq
      CPU 0
      Modules linked in:
      
      Pid: 2150, comm: dns-break Not tainted 2.6.38-rc7-cachefs+ #468                  /DG965RY
      RIP: 0010:[<ffffffff811b99f7>]  [<ffffffff811b99f7>] user_read+0x4f/0x8f
      RSP: 0018:ffff88003bf47f08  EFLAGS: 00010246
      RAX: 0000000000000001 RBX: ffff88003b5ea378 RCX: ffffffff81972368
      RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003b5ea378
      RBP: ffff88003bf47f28 R08: ffff88003be56620 R09: 0000000000000000
      R10: 0000000000000395 R11: 0000000000000002 R12: 0000000000000000
      R13: 0000000000000000 R14: 0000000000000000 R15: ffffffffffffffa1
      FS:  00007feab5751700(0000) GS:ffff88003e000000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000000010 CR3: 000000003de40000 CR4: 00000000000006f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process dns-break (pid: 2150, threadinfo ffff88003bf46000, task ffff88003be56090)
      Stack:
       ffff88003b5ea378 ffff88003b5ea3a0 0000000000000000 0000000000000000
       ffff88003bf47f68 ffffffff811b708e ffff88003c442bc8 0000000000000000
       00000000004005a0 00007fffba368060 0000000000000000 0000000000000000
      Call Trace:
       [<ffffffff811b708e>] keyctl_read_key+0xac/0xcf
       [<ffffffff811b7c07>] sys_keyctl+0x75/0xb6
       [<ffffffff81001f7b>] system_call_fastpath+0x16/0x1b
      Code: 75 1f 48 83 7b 28 00 75 18 c6 05 58 2b fb 00 01 be bb 00 00 00 48 c7 c7 76 1c 75 81 e8 13 c2 e9 ff 4c 8b b3 e0 00 00 00 4d 85 ed <41> 0f b7 5e 10 74 2d 4d 85 e4 74 28 e8 98 79 ee ff 49 39 dd 48
      RIP  [<ffffffff811b99f7>] user_read+0x4f/0x8f
       RSP <ffff88003bf47f08>
      CR2: 0000000000000010
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      Acked-by: NJeff Layton <jlayton@redhat.com>
      cc: Wang Lei <wang840925@gmail.com>
      Signed-off-by: NJames Morris <jmorris@namei.org>
      1362fa07
    • J
    • L
      Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs · 4c7fd114
      Linus Torvalds 提交于
      * 'for-linus' of git://oss.sgi.com/xfs/xfs:
        xfs: zero proper structure size for geometry calls
      4c7fd114
    • L
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2 · c640e13f
      Linus Torvalds 提交于
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2:
        nilfs2: fix regression that i-flag is not set on changeless checkpoints
      c640e13f
    • S
      r8169: disable ASPM · ba04c7c9
      Stanislaw Gruszka 提交于
      For some time is known that ASPM is causing troubles on r8169, i.e. make
      device randomly stop working without any errors in dmesg.
      
      Currently Tomi Leppikangas reports that system with r8169 device hangs
      with MCE errors when ASPM is enabled:
      https://bugzilla.redhat.com/show_bug.cgi?id=642861#c4
      
      Lets disable ASPM for r8169 devices at all, to avoid problems with
      r8169 PCIe devices at least for some users.
      Reported-by: NTomi Leppikangas <tomi.leppikangas@gmail.com>
      Cc: stable@kernel.org
      Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ba04c7c9
    • P
      block: kill loop_mutex · fd51469f
      Petr Uzel 提交于
      Following steps lead to deadlock in kernel:
      
      dd if=/dev/zero of=img bs=512 count=1000
      losetup -f img
      mkfs.ext2 /dev/loop0
      mount -t ext2 -o loop /dev/loop0 mnt
      umount mnt/
      
      Stacktrace:
      [<c102ec04>] irq_exit+0x36/0x59
      [<c101502c>] smp_apic_timer_interrupt+0x6b/0x75
      [<c127f639>] apic_timer_interrupt+0x31/0x38
      [<c101df88>] mutex_spin_on_owner+0x54/0x5b
      [<fe2250e9>] lo_release+0x12/0x67 [loop]
      [<c10c4eae>] __blkdev_put+0x7c/0x10c
      [<c10a4da5>] fput+0xd5/0x1aa
      [<fe2250cf>] loop_clr_fd+0x1a9/0x1b1 [loop]
      [<fe225110>] lo_release+0x39/0x67 [loop]
      [<c10c4eae>] __blkdev_put+0x7c/0x10c
      [<c10a59d9>] deactivate_locked_super+0x17/0x36
      [<c10b6f37>] sys_umount+0x27e/0x2a5
      [<c10b6f69>] sys_oldumount+0xb/0xe
      [<c1002897>] sysenter_do_call+0x12/0x26
      [<ffffffff>] 0xffffffff
      
      Regression since 2a48fc0a, which introduced the private
      loop_mutex as part of the BKL removal process.
      
      As per [1], the mutex can be safely removed.
      
      [1] http://www.gossamer-threads.com/lists/linux/kernel/1341930
      
      Addresses: https://bugzilla.novell.com/show_bug.cgi?id=669394
      Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=29172Signed-off-by: NPetr Uzel <petr.uzel@suse.cz>
      Cc: stable@kernel.org
      Reviewed-by: NNikanth Karthikesan <knikanth@suse.de>
      Acked-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NJens Axboe <jaxboe@fusionio.com>
      fd51469f
  6. 03 3月, 2011 14 次提交