1. 29 3月, 2012 1 次提交
  2. 28 3月, 2012 3 次提交
    • A
      Bluetooth: Fix memory leaks due to chan refcnt · 8d7e1c7f
      Andrei Emeltchenko 提交于
      When we queue delayed work we hold(chan) and delayed work
      shall put(chan) after execution.
      Signed-off-by: NAndrei Emeltchenko <andrei.emeltchenko@intel.com>
      Signed-off-by: NGustavo Padovan <gustavo@padovan.org>
      8d7e1c7f
    • J
      Bluetooth: hci_core: fix NULL-pointer dereference at unregister · 94324962
      Johan Hovold 提交于
      Make sure hci_dev_open returns immediately if hci_dev_unregister has
      been called.
      
      This fixes a race between hci_dev_open and hci_dev_unregister which can
      lead to a NULL-pointer dereference.
      
      Bug is 100% reproducible using hciattach and a disconnected serial port:
      
      0. # hciattach -n /dev/ttyO1 any noflow
      
      1. hci_dev_open called from hci_power_on grabs req lock
      2. hci_init_req executes but device fails to initialise (times out
         eventually)
      3. hci_dev_open is called from hci_sock_ioctl and sleeps on req lock
      4. hci_uart_tty_close calls hci_dev_unregister and sleeps on req lock in
         hci_dev_do_close
      5. hci_dev_open (1) releases req lock
      6. hci_dev_do_close grabs req lock and returns as device is not up
      7. hci_dev_unregister sleeps in destroy_workqueue
      8. hci_dev_open (3) grabs req lock, calls hci_init_req and eventually sleeps
      9. hci_dev_unregister finishes, while hci_dev_open is still running...
      
      [   79.627136] INFO: trying to register non-static key.
      [   79.632354] the code is fine but needs lockdep annotation.
      [   79.638122] turning off the locking correctness validator.
      [   79.643920] [<c00188bc>] (unwind_backtrace+0x0/0xf8) from [<c00729c4>] (__lock_acquire+0x1590/0x1ab0)
      [   79.653594] [<c00729c4>] (__lock_acquire+0x1590/0x1ab0) from [<c00733f8>] (lock_acquire+0x9c/0x128)
      [   79.663085] [<c00733f8>] (lock_acquire+0x9c/0x128) from [<c0040a88>] (run_timer_softirq+0x150/0x3ac)
      [   79.672668] [<c0040a88>] (run_timer_softirq+0x150/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
      [   79.682281] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
      [   79.690856] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
      [   79.699157] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
      [   79.708648] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
      [   79.718048] Exception stack(0xcf281fb0 to 0xcf281ff8)
      [   79.723358] 1fa0:                                     0001e6a0 be8dab00 0001e698 00036698
      [   79.731933] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
      [   79.740509] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
      [   79.747497] Unable to handle kernel NULL pointer dereference at virtual address 00000000
      [   79.756011] pgd = cf3b4000
      [   79.758850] [00000000] *pgd=8f0c7831, *pte=00000000, *ppte=00000000
      [   79.765502] Internal error: Oops: 80000007 [#1]
      [   79.770294] Modules linked in:
      [   79.773529] CPU: 0    Tainted: G        W     (3.3.0-rc6-00002-gb5d5c87 #421)
      [   79.781066] PC is at 0x0
      [   79.783721] LR is at run_timer_softirq+0x16c/0x3ac
      [   79.788787] pc : [<00000000>]    lr : [<c0040aa4>]    psr: 60000113
      [   79.788787] sp : cf281ee0  ip : 00000000  fp : cf280000
      [   79.800903] r10: 00000004  r9 : 00000100  r8 : b6f234d0
      [   79.806427] r7 : c0519c28  r6 : cf093488  r5 : c0561a00  r4 : 00000000
      [   79.813323] r3 : 00000000  r2 : c054eee0  r1 : 00000001  r0 : 00000000
      [   79.820190] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
      [   79.827728] Control: 10c5387d  Table: 8f3b4019  DAC: 00000015
      [   79.833801] Process gpsd (pid: 1265, stack limit = 0xcf2802e8)
      [   79.839965] Stack: (0xcf281ee0 to 0xcf282000)
      [   79.844573] 1ee0: 00000002 00000000 c0040a24 00000000 00000002 cf281f08 00200200 00000000
      [   79.853210] 1f00: 00000000 cf281f18 cf281f08 00000000 00000000 00000000 cf281f18 cf281f18
      [   79.861816] 1f20: 00000000 00000001 c056184c 00000000 00000001 b6f234d0 c0561848 00000004
      [   79.870452] 1f40: cf280000 c003a3b8 c051e79c 00000001 00000000 00000100 3fa9e7b8 0000000a
      [   79.879089] 1f60: 00000025 cf280000 00000025 00000000 00000000 b6f234d0 00000000 00000004
      [   79.887756] 1f80: 00000000 c003a924 c053ad38 c0013a50 fa200000 cf281fb0 ffffffff c0008530
      [   79.896362] 1fa0: 0001e6a0 0000aab8 80000010 c037499c 0001e6a0 be8dab00 0001e698 00036698
      [   79.904998] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
      [   79.913665] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff 00fbf700 04ffff00
      [   79.922302] [<c0040aa4>] (run_timer_softirq+0x16c/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
      [   79.931945] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
      [   79.940582] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
      [   79.948913] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
      [   79.958404] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
      [   79.967773] Exception stack(0xcf281fb0 to 0xcf281ff8)
      [   79.973083] 1fa0:                                     0001e6a0 be8dab00 0001e698 00036698
      [   79.981658] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
      [   79.990234] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
      [   79.997161] Code: bad PC value
      [   80.000396] ---[ end trace 6f6739840475f9ee ]---
      [   80.005279] Kernel panic - not syncing: Fatal exception in interrupt
      
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: NJohan Hovold <jhovold@gmail.com>
      Acked-by: NMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
      94324962
    • S
      Bluetooth: Fix Endian Bug. · 6e4aff10
      Santosh Nayak 提交于
      Fix network to host endian conversion for L2CAP chan id.
      Signed-off-by: NSantosh Nayak <santoshprasadnayak@gmail.com>
      Acked-by: NAndrei Emeltchenko <andrei.emeltchenko@intel.com>
      Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>
      6e4aff10
  3. 27 3月, 2012 3 次提交
  4. 23 3月, 2012 6 次提交
    • A
      bonding: remove entries for master_ip and vlan_ip and query devices instead · eaddcd76
      Andy Gospodarek 提交于
      The following patch aimed to resolve an issue where secondary, tertiary,
      etc. addresses added to bond interfaces could overwrite the
      bond->master_ip and vlan_ip values.
      
              commit 917fbdb3
              Author: Henrik Saavedra Persson <henrik.e.persson@ericsson.com>
              Date:   Wed Nov 23 23:37:15 2011 +0000
      
                  bonding: only use primary address for ARP
      
      That patch was good because it prevented bonds using ARP monitoring from
      sending frames with an invalid source IP address.  Unfortunately, it
      didn't always work as expected.
      
      When using an ioctl (like ifconfig does) to set the IP address and
      netmask, 2 separate ioctls are actually called to set the IP and netmask
      if the mask chosen doesn't match the standard mask for that class of
      address.  The first ioctl did not have a mask that matched the one in
      the primary address and would still cause the device address to be
      overwritten.  The second ioctl that was called to set the mask would
      then detect as secondary and ignored, but the damage was already done.
      
      This was not an issue when using an application that used netlink
      sockets as the setting of IP and netmask came down at once.  The
      inconsistent behavior between those two interfaces was something that
      needed to be resolved.
      
      While I was thinking about how I wanted to resolve this, Ralf Zeidler
      came with a patch that resolved this on a RHEL kernel by keeping a full
      shadow of the entries in dev->ifa_list for the bonding device and vlan
      devices in the bonding driver.  I didn't like the duplication of the
      list as I want to see the 'bonding' struct and code shrink rather than
      grow, but liked the general idea.
      
      As the Subject indicates this patch drops the master_ip and vlan_ip
      elements from the 'bonding' and 'vlan_entry' structs, respectively.
      This can be done because a device's address-list is now traversed to
      determine the optimal source IP address for ARP requests and for checks
      to see if the bonding device has a particular IP address.  This code
      could have all be contained inside the bonding driver, but it made more
      sense to me to EXPORT and call inet_confirm_addr since it did exactly
      what was needed.
      
      I tested this and a backported patch and everything works as expected.
      Ralf also helped with verification of the backported patch.
      
      Thanks to Ralf for all his help on this.
      
      v2: Whitespace and organizational changes based on suggestions from Jay
      Vosburgh and Dave Miller.
      
      v3: Fixup incorrect usage of rcu_read_unlock based on Dave Miller's
      suggestion.
      Signed-off-by: NAndy Gospodarek <andy@greyhouse.net>
      CC: Ralf Zeidler <ralf.zeidler@nsn.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      eaddcd76
    • R
      netfilter: remove forward module param confusion. · 523f610e
      Rusty Russell 提交于
      It used to be an int, and it got changed to a bool parameter at least
      7 years ago.  It happens that NF_ACCEPT and NF_DROP are 0 and 1, so
      this works, but it's unclear, and the check that it's in range is not
      required.
      Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      523f610e
    • S
      xfrm: Access the replay notify functions via the registered callbacks · 1265fd61
      Steffen Klassert 提交于
      We call the wrong replay notify function when we use ESN replay
      handling. This leads to the fact that we don't send notifications
      if we use ESN. Fix this by calling the registered callbacks instead
      of xfrm_replay_notify().
      Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1265fd61
    • S
      xfrm: Remove unused xfrm_state from xfrm_state_check_space · 26b2072e
      Steffen Klassert 提交于
      The xfrm_state argument is unused in this function, so remove it.
      Also the name xfrm_state_check_space does not really match what this
      function does. It actually checks if we have enough head and tailroom
      on the skb. So we rename the function to xfrm_skb_check_space.
      Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      26b2072e
    • D
      RDS: use gfp flags from caller in conn_alloc() · f0229eaa
      Dan Carpenter 提交于
      We should be using the gfp flags the caller specified here, instead of
      GFP_KERNEL.  I think this might be a bugfix, depending on the value of
      "sock->sk->sk_allocation" when we call rds_conn_create_outgoing() in
      rds_sendmsg().  Otherwise, it's just a cleanup.
      Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
      Acked-by: NVenkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f0229eaa
    • D
      netlabel: use GFP flags from caller instead of GFP_ATOMIC · 64b5fad5
      Dan Carpenter 提交于
      This function takes a GFP flags as a parameter, but they are never used.
      We don't take a lock in this function so there is no reason to prefer
      GFP_ATOMIC over the caller's GFP flags.
      
      There is only one caller, cipso_v4_map_cat_rng_ntoh(), and it passes
      GFP_ATOMIC as the GFP flags so this doesn't change how the code works.
      It's just a cleanup.
      Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      64b5fad5
  5. 22 3月, 2012 2 次提交
  6. 21 3月, 2012 2 次提交
  7. 20 3月, 2012 6 次提交
  8. 17 3月, 2012 3 次提交
  9. 16 3月, 2012 5 次提交
  10. 14 3月, 2012 5 次提交
    • P
      mac80211: Don't let regulatory make us deaf · 3117bbdb
      Paul Stewart 提交于
      When regulatory information changes our HT behavior (e.g,
      when we get a country code from the AP we have just associated
      with), we should use this information to change the power with
      which we transmit, and what channels we transmit.  Sometimes
      the channel parameters we derive from regulatory information
      contradicts the parameters we used in association.  For example,
      we could have associated specifying HT40, but the regulatory
      rules we apply may forbid HT40 operation.
      
      In the situation above, we should reconfigure ourselves to
      transmit in HT20 only, however it makes no sense for us to
      disable receive in HT40, since if we associated with these
      parameters, the AP has every reason to expect we can and
      will receive packets this way.  The code in mac80211 does
      not have the capability of sending the appropriate action
      frames to signal a change in HT behaviour so the AP has
      no clue we can no longer receive frames encoded this way.
      In some broken AP implementations, this can leave us
      effectively deaf if the AP never retries in lower HT rates.
      
      This change breaks up the channel_type parameter in the
      ieee80211_enable_ht function into a separate receive and
      transmit part.  It honors the channel flags set by regulatory
      in order to configure the rate control algorithm, but uses
      the capability flags to configure the channel on the radio,
      since these were used in association to set the AP's transmit
      rate.
      Signed-off-by: NPaul Stewart <pstew@chromium.org>
      Cc: Sam Leffler <sleffler@chromium.org>
      Cc: Johannes Berg <johannes@sipsolutions.net>
      Reviewed-by: NLuis R Rodriguez <mcgrof@frijolero.org>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      3117bbdb
    • J
      mac80211: rename bss_conf timestamp to last_tsf · e9ac0745
      Johannes Berg 提交于
      This value is not really very useful by itself,
      yet some drivers (including iwlwifi until I can
      figure out what it should do) use it. At least
      rename it to "last_tsf" to indicate the meaning
      and add a note that it may be really old.
      
      I suspect the value may become useful combined
      with the rx_status->mactime, but we don't (yet)
      store that value and pass it to the driver.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      e9ac0745
    • J
      cfg80211: clarify timestamp in cfg80211_inform_bss · 7b8bcff2
      Johannes Berg 提交于
      This is intended to be the timestamp sent by the
      peer in the beacon/probe response, not any form
      of host timestamp. Clarify the documentation and
      variable names.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      7b8bcff2
    • J
      mac80211: linearize SKBs as needed for crypto · a8286911
      Johannes Berg 提交于
      Not linearizing every SKB will help actually pass
      non-linear SKBs all the way up when on an encrypted
      connection. For now, linearize TKIP completely as
      it is lower performance and I don't quite grok all
      the details.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      a8286911
    • J
      mac80211: move RX WEP weak IV counting · 617bbde8
      Johannes Berg 提交于
      This is better done inside the WEP decrypt
      function where it doesn't have to check all
      the conditions any more since they've been
      tested already.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      617bbde8
  11. 13 3月, 2012 4 次提交