1. 14 11月, 2008 2 次提交
  2. 13 11月, 2008 1 次提交
  3. 12 11月, 2008 5 次提交
  4. 11 11月, 2008 7 次提交
  5. 10 11月, 2008 1 次提交
    • M
      net: unix: fix inflight counting bug in garbage collector · 6209344f
      Miklos Szeredi 提交于
      Previously I assumed that the receive queues of candidates don't
      change during the GC.  This is only half true, nothing can be received
      from the queues (see comment in unix_gc()), but buffers could be added
      through the other half of the socket pair, which may still have file
      descriptors referring to it.
      
      This can result in inc_inflight_move_tail() erronously increasing the
      "inflight" counter for a unix socket for which dec_inflight() wasn't
      previously called.  This in turn can trigger the "BUG_ON(total_refs <
      inflight_refs)" in a later garbage collection run.
      
      Fix this by only manipulating the "inflight" counter for sockets which
      are candidates themselves.  Duplicating the file references in
      unix_attach_fds() is also needed to prevent a socket becoming a
      candidate for GC while the skb that contains it is not yet queued.
      Reported-by: NAndrea Bittau <a.bittau@cs.ucl.ac.uk>
      Signed-off-by: NMiklos Szeredi <mszeredi@suse.cz>
      CC: stable@kernel.org
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      6209344f
  6. 07 11月, 2008 2 次提交
    • D
      net: Fix recursive descent in __scm_destroy(). · 3b53fbf4
      David S. Miller 提交于
      __scm_destroy() walks the list of file descriptors in the scm_fp_list
      pointed to by the scm_cookie argument.
      
      Those, in turn, can close sockets and invoke __scm_destroy() again.
      
      There is nothing which limits how deeply this can occur.
      
      The idea for how to fix this is from Linus.  Basically, we do all of
      the fput()s at the top level by collecting all of the scm_fp_list
      objects hit by an fput().  Inside of the initial __scm_destroy() we
      keep running the list until it is empty.
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3b53fbf4
    • D
      net: Fix recursive descent in __scm_destroy(). · f8d570a4
      David Miller 提交于
      __scm_destroy() walks the list of file descriptors in the scm_fp_list
      pointed to by the scm_cookie argument.
      
      Those, in turn, can close sockets and invoke __scm_destroy() again.
      
      There is nothing which limits how deeply this can occur.
      
      The idea for how to fix this is from Linus.  Basically, we do all of
      the fput()s at the top level by collecting all of the scm_fp_list
      objects hit by an fput().  Inside of the initial __scm_destroy() we
      keep running the list until it is empty.
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      f8d570a4
  7. 06 11月, 2008 2 次提交
    • B
      bonding: send IPv6 neighbor advertisement on failover · 305d552a
      Brian Haley 提交于
      This patch adds better IPv6 failover support for bonding devices,
      especially when in active-backup mode and there are only IPv6 addresses
      configured, as reported by Alex Sidorenko.
      
      - Creates a new file, net/drivers/bonding/bond_ipv6.c, for the
         IPv6-specific routines.  Both regular bonds and VLANs over bonds
         are supported.
      
      - Adds a new tunable, num_unsol_na, to limit the number of unsolicited
         IPv6 Neighbor Advertisements that are sent on a failover event.
         Default is 1.
      
      - Creates two new IPv6 neighbor discovery functions:
      
         ndisc_build_skb()
         ndisc_send_skb()
      
         These were required to support VLANs since we have to be able to
         add the VLAN id to the skb since ndisc_send_na() and friends
         shouldn't be asked to do this.  These two routines are basically
         __ndisc_send() split into two pieces, in a slightly different order.
      
      - Updates Documentation/networking/bonding.txt and bumps the rev of bond
         support to 3.4.0.
      
      On failover, this new code will generate one packet:
      
      - An unsolicited IPv6 Neighbor Advertisement, which helps the switch
         learn that the address has moved to the new slave.
      
      Testing has shown that sending just the NA results in pretty good
      behavior when in active-back mode, I saw no lost ping packets for example.
      Signed-off-by: NBrian Haley <brian.haley@hp.com>
      Signed-off-by: NJay Vosburgh <fubar@us.ibm.com>
      Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
      305d552a
    • J
      pkt_sched: Fix qdisc len in qdisc_peek_dequeued() · 61c9eaf9
      Jarek Poplawski 提交于
      A packet dequeued and stored as gso_skb in qdisc_peek_dequeued() should
      be seen as part of the queue for sch->q.qlen queries until it's really
      dequeued with qdisc_dequeue_peeked(), so qlen needs additional updating
      in these functions. (Updating qstats.backlog shouldn't matter here.)
      Signed-off-by: NJarek Poplawski <jarkao2@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      61c9eaf9
  8. 05 11月, 2008 1 次提交
  9. 04 11月, 2008 1 次提交
  10. 01 11月, 2008 18 次提交