1. 25 3月, 2011 2 次提交
  2. 24 3月, 2011 24 次提交
  3. 23 3月, 2011 2 次提交
  4. 22 3月, 2011 12 次提交
    • M
      NET: smsc95xx: don't use stack for async writes to the device · 3c0f3c60
      Marc Zyngier 提交于
      The set_multicast operation performs asynchronous writes to the
      device, with some addresses pointing to the stack. Bad things may
      happen, and this is trapped CONFIG_DMA_API_DEBUG:
      
      [    5.237762] WARNING: at /build/buildd/linux-linaro-omap-2.6.38/lib/dma-debug.c:867 check_for_stack+0xd4/0x100()
      [    5.237792] ehci-omap ehci-omap.0: DMA-API: device driver maps memory fromstack [addr=d9c77dec]
      [    5.237792] Modules linked in: smsc95xx(+) usbnet twl6030_usb twl4030_pwrbutton leds_gpio omap_wdt omap2_mcspi
      [    5.237854] [<c006d618>] (unwind_backtrace+0x0/0xf8) from [<c00a6a14>] (warn_slowpath_common+0x54/0x64)
      [    5.237884] [<c00a6a14>] (warn_slowpath_common+0x54/0x64) from [<c00a6ab8>] (warn_slowpath_fmt+0x30/0x40)
      [    5.237915] [<c00a6ab8>] (warn_slowpath_fmt+0x30/0x40) from [<c034e9d8>] (check_for_stack+0xd4/0x100)
      [    5.237915] [<c034e9d8>] (check_for_stack+0xd4/0x100) from [<c034fea8>] (debug_dma_map_page+0xb4/0xdc)
      [    5.237976] [<c034fea8>] (debug_dma_map_page+0xb4/0xdc) from [<c04242f0>] (map_urb_for_dma+0x26c/0x304)
      [    5.237976] [<c04242f0>] (map_urb_for_dma+0x26c/0x304) from [<c0424594>] (usb_hcd_submit_urb+0x78/0x19c)
      [    5.238037] [<c0424594>] (usb_hcd_submit_urb+0x78/0x19c) from [<bf049c5c>] (smsc95xx_write_reg_async+0xb4/0x130 [smsc95xx])
      [    5.238067] [<bf049c5c>] (smsc95xx_write_reg_async+0xb4/0x130 [smsc95xx]) from [<bf049dd4>] (smsc95xx_set_multicast+0xfc/0x148 [smsc95xx])
      [    5.238098] [<bf049dd4>] (smsc95xx_set_multicast+0xfc/0x148 [smsc95xx]) from [<bf04a118>] (smsc95xx_reset+0x2f8/0x68c [smsc95xx])
      [    5.238128] [<bf04a118>] (smsc95xx_reset+0x2f8/0x68c [smsc95xx]) from [<bf04a8cc>] (smsc95xx_bind+0xcc/0x188 [smsc95xx])
      [    5.238159] [<bf04a8cc>] (smsc95xx_bind+0xcc/0x188 [smsc95xx]) from [<bf03ef1c>] (usbnet_probe+0x204/0x4c4 [usbnet])
      [    5.238220] [<bf03ef1c>] (usbnet_probe+0x204/0x4c4 [usbnet]) from [<c0429078>] (usb_probe_interface+0xe4/0x1c4)
      [    5.238250] [<c0429078>] (usb_probe_interface+0xe4/0x1c4) from [<c03a8770>] (really_probe+0x64/0x160)
      [    5.238250] [<c03a8770>] (really_probe+0x64/0x160) from [<c03a8a30>] (driver_probe_device+0x48/0x60)
      [    5.238281] [<c03a8a30>] (driver_probe_device+0x48/0x60) from [<c03a8ad4>] (__driver_attach+0x8c/0x90)
      [    5.238311] [<c03a8ad4>] (__driver_attach+0x8c/0x90) from [<c03a7b24>] (bus_for_each_dev+0x50/0x7c)
      [    5.238311] [<c03a7b24>] (bus_for_each_dev+0x50/0x7c) from [<c03a82ec>] (bus_add_driver+0x190/0x250)
      [    5.238311] [<c03a82ec>] (bus_add_driver+0x190/0x250) from [<c03a8cf8>] (driver_register+0x78/0x13c)
      [    5.238433] [<c03a8cf8>] (driver_register+0x78/0x13c) from [<c0428040>] (usb_register_driver+0x78/0x13c)
      [    5.238464] [<c0428040>] (usb_register_driver+0x78/0x13c) from [<c005b680>] (do_one_initcall+0x34/0x188)
      [    5.238494] [<c005b680>] (do_one_initcall+0x34/0x188) from [<c00e11f0>] (sys_init_module+0xb0/0x1c0)
      [    5.238525] [<c00e11f0>] (sys_init_module+0xb0/0x1c0) from [<c0065c40>] (ret_fast_syscall+0x0/0x30)
      
      Move the two offenders to the private structure which is kmalloc-ed,
      and thus safe.
      Signed-off-by: NMarc Zyngier <marc.zyngier@arm.com>
      Cc: Steve Glendinning <steve.glendinning@smsc.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3c0f3c60
    • E
      veth: Fix the byte counters · 675071a2
      Eric W. Biederman 提交于
      Commit 44540960 "veth: move loopback logic to common location" introduced
      a bug in the packet counters.  I don't understand why that happened as it
      is not explained in the comments and the mut check in dev_forward_skb
      retains the assumption that skb->len is the total length of the packet.
      
      I just measured this emperically by setting up a veth pair between two
      noop network namespaces setting and attempting a telnet connection between
      the two.  I saw three packets in each direction and the byte counters were
      exactly 14*3 = 42 bytes high in each direction.  I got the actual
      packet lengths with tcpdump.
      
      So remove the extra ETH_HLEN from the veth byte count totals.
      Signed-off-by: NEric W. Biederman <ebiederm@aristanetworks.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      675071a2
    • E
      macvlan: Fix use after free of struct macvlan_port. · d5cd9244
      Eric W. Biederman 提交于
      When the macvlan driver was extended to call unregisgter_netdevice_queue
      in 23289a37, a use after free of struct
      macvlan_port was introduced.  The code in dellink relied on unregister_netdevice
      actually unregistering the net device so it would be safe to free macvlan_port.
      
      Since unregister_netdevice_queue can just queue up the unregister instead of
      performing the unregiser immediately we free the macvlan_port too soon and
      then the code in macvlan_stop removes the macaddress for the set of macaddress
      to listen for and uses memory that has already been freed.
      
      To fix this add a reference count to track when it is safe to free the macvlan_port
      and move the call of macvlan_port_destroy into macvlan_uninit which is guaranteed
      to be called after the final macvlan_port_close.
      Signed-off-by: NEric W. Biederman <ebiederm@aristanetworks.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d5cd9244
    • J
      can: c_can: Do basic c_can configuration _before_ enabling the interrupts · 4f2d56c4
      Jan Altenberg 提交于
      I ran into some trouble while testing the SocketCAN driver for the BOSCH
      C_CAN controller. The interface is not correctly initialized, if I put
      some CAN traffic on the line, _while_ the interface is being started
      (which means: the interface doesn't come up correcty, if there's some RX
      traffic while doing 'ifconfig can0 up').
      
      The current implementation enables the controller interrupts _before_
      doing the basic c_can configuration. I think, this should be done the
      other way round.
      
      The patch below fixes things for me.
      Signed-off-by: NJan Altenberg <jan@linutronix.de>
      Acked-by: NKurt Van Dijck <kurt.van.dijck@eia.be>
      Acked-by: NWolfgang Grandegger <wg@grandegger.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4f2d56c4
    • M
      ath9k: Fix kernel panic in AR2427 · 61e1b0b0
      Mohammed Shafi Shajakhan 提交于
      Kernel panic occurs just after AR2427 establishes connection with AP.
      Unless aggregation is enabled we don't initialize the TID structure.
      Thus accesing the elements of the TID structure when aggregation is
      disabled, leads to NULL pointer dereferencing.
      
      [  191.320358] Call Trace:
      [  191.320364]  [<fd250ea7>] ? ath9k_tx+0xa7/0x200 [ath9k]
      [  191.320376]  [<fd1ec7fc>] ? __ieee80211_tx+0x5c/0x1e0 [mac80211]
      [  191.320386]  [<fd1edd2b>] ? ieee80211_tx+0x7b/0x90 [mac80211]
      [  191.320395]  [<fd1edddd>] ? ieee80211_xmit+0x9d/0x1d0 [mac80211]
      [  191.320401]  [<c014218f>] ? wake_up_state+0xf/0x20
      [  191.320405]  [<c015dbc8>] ? signal_wake_up+0x28/0x40
      [  191.320410]  [<c012a578>] ? default_spin_lock_flags+0x8/0x10
      [  191.320420]  [<fd1ee308>] ? ieee80211_subif_start_xmit+0x2e8/0x7c0
      [mac80211]
      [  191.320425]  [<c058f905>] ? do_page_fault+0x295/0x3a0
      [  191.320431]  [<c04c4a3d>] ? dev_hard_start_xmit+0x1ad/0x210
      [  191.320436]  [<c04d96b5>] ? sch_direct_xmit+0x105/0x170
      [  191.320445]  [<fd1f161a>] ? get_sta_flags+0x2a/0x40 [mac80211]
      [  191.320449]  [<c04c780f>] ? dev_queue_xmit+0x37f/0x4b0
      [  191.320452]  [<c04d75b0>] ? eth_header+0x0/0xb0
      [  191.320456]  [<c04cc479>] ? neigh_resolve_output+0xe9/0x310
      [  191.320461]  [<c053d295>] ? ip6_output_finish+0xa5/0x110
      [  191.320464]  [<c053e354>] ? ip6_output2+0x134/0x250
      [  191.320468]  [<c053f7dd>] ? ip6_output+0x6d/0x100
      [  191.320471]  [<c0559665>] ? mld_sendpack+0x395/0x3e0
      [  191.320475]  [<c0557f81>] ? add_grhead+0x31/0xa0
      [  191.320478]  [<c055a83c>] ? mld_send_cr+0x1bc/0x2b0
      [  191.320482]  [<c01535d9>] ? irq_exit+0x39/0x70
      [  191.320485]  [<c055a940>] ? mld_ifc_timer_expire+0x10/0x40
      [  191.320489]  [<c015b92e>] ? run_timer_softirq+0x13e/0x2c0
      [  191.320493]  [<c0103a30>] ? common_interrupt+0x30/0x40
      [  191.320498]  [<c055a930>] ? mld_ifc_timer_expire+0x0/0x40
      [  191.320502]  [<c0153358>] ? __do_softirq+0x98/0x1b0
      [  191.320506]  [<c01534b5>] ? do_softirq+0x45/0x50
      [  191.320509]  [<c0153605>] ? irq_exit+0x65/0x70
      [  191.320513]  [<c05917dc>] ? smp_apic_timer_interrupt+0x5c/0x8b
      [  191.320516]  [<c0103df1>] ? apic_timer_interrupt+0x31/0x40
      [  191.320521]  [<c016007b>] ? k_getrusage+0x12b/0x2f0
      [  191.320525]  [<c039e384>] ? acpi_idle_enter_simple+0x117/0x148
      [  191.320529]  [<c04a20da>] ? cpuidle_idle_call+0x7a/0x100
      [  191.320532]  [<c01021d4>] ? cpu_idle+0x94/0xd0
      [  191.320536]  [<c057ab88>] ? rest_init+0x58/0x60
      [  191.320541]  [<c07a58ec>] ? start_kernel+0x351/0x357
      [  191.320544]  [<c07a53c7>] ? unknown_bootoption+0x0/0x19e
      [  191.320548]  [<c07a50aa>] ? i386_start_kernel+0xaa/0xb1
      [  191.320550] Code: 03 66 3d 00 03 0f 84 7c 02 00 00 83 c3 18 0f b6 03
      8b 4d e0 89 c3 83 e3 0f 6b c3 48 89 5d d8 8d 04 06 8d 50 0c 89 55 d0 8b
      40 20 <8b> 00 3b 01 0f 85 8e 02 00 00 f6 47 20 40 0f 84 29 ff ff ff 8b
      [  191.320634] EIP: [<fd2586d4>] ath_tx_start+0x474/0x770 [ath9k] SS:ESP
      0068:c0761a90
      [  191.320642] CR2: 0000000000000000
      [  191.320647] ---[ end trace 9296ef23b9076ece ]---
      [  191.320650] Kernel panic - not syncing: Fatal exception in interrupt
      
      Cc: stable@kernel.org
      Signed-off-by: NMohammed Shafi Shajakhan <mshajakhan@atheros.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      61e1b0b0
    • I
      rtlwifi: Fix memset argument order · 6e9d592f
      Ilia Mirkin 提交于
      These were found using the following semantic match:
      // <smpl>
      @@expression E1; type T;@@
      * memset(E1, ... * sizeof(T) * ..., ...);
      // </smpl>
      
      Also take this opportunity to remove the unnecessary void* casts.
      Signed-off-by: NIlia Mirkin <imirkin@alum.mit.edu>
      Tested-by: NLarry Finger <Larry.Finger@lwfinger.net>
      Acked-by: NLarry Finger <Larry.Finger@lwfinger.net>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      6e9d592f
    • P
      rt2x00: Add unknown Toshiba device · 5da201a4
      Peter Lemenkov 提交于
      Add unknown Toshiba device, mentioned in rt3572sta sources, under
      CONFIG_RT2800USB_UNKNOWN
      Signed-off-by: NPeter Lemenkov <lemenkov@gmail.com>
      Acked-by: NIvo van Doorn <IvDoorn@gmail.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      5da201a4
    • P
      rt2x00: Add 2L Central Europe BV 8070 · 9a745972
      Peter Lemenkov 提交于
      Add 2L Central Europe BV 8070 under CONFIG_RT2800USB_UNKNOWN
      Signed-off-by: NPeter Lemenkov <lemenkov@gmail.com>
      Acked-by: NIvo van Doorn <IvDoorn@gmail.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      9a745972
    • P
      rt2x00: Add Planex Communications, Inc. RT8070 · 7a2a75bc
      Peter Lemenkov 提交于
      Add Planex Communications, Inc. RT8070 under CONFIG_RT2800USB_UNKNOWN
      Signed-off-by: NPeter Lemenkov <lemenkov@gmail.com>
      Acked-by: NIvo van Doorn <IvDoorn@gmail.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      7a2a75bc
    • P
      rt2x00: Add rt2870 device id · 2cea5b3c
      Peter Lemenkov 提交于
      Add ID for Asus USB-N11 Wi-FI adapter. Tested by me.
      Signed-off-by: NPeter Lemenkov <lemenkov@gmail.com>
      Acked-by: NIvo van Doorn <IvDoorn@gmail.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      2cea5b3c
    • J
      orinoco: Maintain lock until entry removed from list · 3bf184a7
      Joe Gunn 提交于
      Removing an entry from the scan_list should be performed while holding
      the lock.
      Signed-off-by: NJoseph J. Gunn <armadefuego@yahoo.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      3bf184a7
    • D
      iwlwifi: missing unlock on error path · f8a22a2b
      Dan Carpenter 提交于
      We should unlock here instead of returning -EINVAL directly.
      Signed-off-by: NDan Carpenter <error27@gmail.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      f8a22a2b