1. 24 11月, 2011 1 次提交
  2. 23 11月, 2011 3 次提交
  3. 22 11月, 2011 5 次提交
  4. 19 11月, 2011 2 次提交
  5. 17 11月, 2011 2 次提交
  6. 15 11月, 2011 1 次提交
  7. 14 11月, 2011 5 次提交
    • M
      net-netlink: Add a new attribute to expose TCLASS values via netlink · 06236ac3
      Maciej Żenczykowski 提交于
      commit 3ceca749 added a TOS attribute.
      
      Unfortunately TOS and TCLASS are both present in a dual-stack v6 socket,
      furthermore they can have different values.  As such one cannot in a
      sane way expose both through a single attribute.
      Signed-off-by: NMaciej Żenczyowski <maze@google.com>
      CC: Murali Raja <muralira@google.com>
      CC: Stephen Hemminger <shemminger@vyatta.com>
      CC: Eric Dumazet <eric.dumazet@gmail.com>
      CC: David S. Miller <davem@davemloft.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      06236ac3
    • A
      bridge: Fix potential deadlock on br->multicast_lock · ef5e0d82
      Andrey Vagin 提交于
      multicast_lock is taken in softirq context, so we should use
      spin_lock_bh() in userspace.
      
      call-chain in softirq context:
      run_timer_softirq()
      	br_multicast_query_expired()
      
      call-chain in userspace:
      sysfs_write_file()
      	store_multicast_snooping()
      		br_multicast_toggle()
      Signed-off-by: NAndrew Vagin <avagin@openvz.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ef5e0d82
    • J
      ip6_tunnel: copy parms.name after register_netdevice · 731abb9c
      Josh Boyer 提交于
      Commit 1c5cae81 removed an explicit call to dev_alloc_name in ip6_tnl_create
      because register_netdevice will now create a valid name.  This works for the
      net_device itself.
      
      However the tunnel keeps a copy of the name in the parms structure for the
      ip6_tnl associated with the tunnel.  parms.name is set by copying the net_device
      name in ip6_tnl_dev_init_gen.  That function is called from ip6_tnl_dev_init in
      ip6_tnl_create, but it is done before register_netdevice is called so the name
      is set to a bogus value in the parms.name structure.
      
      This shows up if you do a simple tunnel add, followed by a tunnel show:
      
      [root@localhost ~]# ip -6 tunnel add remote fec0::100 local fec0::200
      [root@localhost ~]# ip -6 tunnel show
      ip6tnl0: ipv6/ipv6 remote :: local :: encaplimit 0 hoplimit 0 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)
      ip6tnl%d: ipv6/ipv6 remote fec0::100 local fec0::200 encaplimit 4 hoplimit 64 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)
      [root@localhost ~]#
      
      Fix this by moving the strcpy out of ip6_tnl_dev_init_gen, and calling it after
      register_netdevice has successfully returned.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NJosh Boyer <jwboyer@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      731abb9c
    • P
      rds: drop "select LLIST" · 77c1c7c4
      Paul Bolle 提交于
      Commit 1bc144b6 ("net, rds, Replace xlist in net/rds/xlist.h with
      llist") added "select LLIST" to the RDS_RDMA Kconfig entry. But there is
      no Kconfig symbol named LLIST. The select statement for that symbol is a
      nop. Drop it.
      
      lib/llist.o is builtin, so all that's needed to use the llist
      functionality is to include linux/llist.h, which this commit also did.
      Signed-off-by: NPaul Bolle <pebolle@tiscali.nl>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      77c1c7c4
    • J
      net/packet: remove dead code and unneeded variable from prb_setup_retire_blk_timer() · 3ed90f76
      Jesper Juhl 提交于
      We test for 'tx_ring' being != zero and BUG() if that's the case. So after
      that check there is no way that 'tx_ring' could be anything _but_ zero, so
      testing it again is just dead code. Once that dead code is removed, the
      'pkc' local variable becomes entirely redundant, so remove that as well.
      Signed-off-by: NJesper Juhl <jj@chaosbits.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3ed90f76
  8. 13 11月, 2011 1 次提交
  9. 10 11月, 2011 7 次提交
    • L
      ipv4: fix for ip_options_rcv_srr() daddr update. · b12f62ef
      Li Wei 提交于
      When opt->srr_is_hit is set skb_rtable(skb) has been updated for
      'nexthop' and iph->daddr should always equals to skb_rtable->rt_dst
      holds, We need update iph->daddr either.
      Signed-off-by: NLi Wei <lw@cn.fujitsu.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b12f62ef
    • N
      ah: Read nexthdr value before overwriting it in ahash input callback. · b7ea81a5
      Nick Bowler 提交于
      The AH4/6 ahash input callbacks read out the nexthdr field from the AH
      header *after* they overwrite that header.  This is obviously not going
      to end well.  Fix it up.
      Signed-off-by: NNick Bowler <nbowler@elliptictech.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b7ea81a5
    • N
      ah: Correctly pass error codes in ahash output callback. · 069294e8
      Nick Bowler 提交于
      The AH4/6 ahash output callbacks pass nexthdr to xfrm_output_resume
      instead of the error code.  This appears to be a copy+paste error from
      the input case, where nexthdr is expected.  This causes the driver to
      continuously add AH headers to the datagram until either an allocation
      fails and the packet is dropped or the ahash driver hits a synchronous
      fallback and the resulting monstrosity is transmitted.
      
      Correct this issue by simply passing the error code unadulterated.
      Signed-off-by: NNick Bowler <nbowler@elliptictech.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      069294e8
    • J
      mac80211: fix race between connection monitor & suspend · 0ecfe806
      Johannes Berg 提交于
      When the connection monitor timer fires right before
      suspend, the following will happen:
       timer fires -> monitor_work gets queued
       suspend calls ieee80211_sta_quiesce
       ieee80211_sta_quiesce:
        - deletes timer
        - cancels monitor_work synchronously, running it
        [note wrong order of these steps]
       monitor_work runs, re-arming the timer
       later, timer fires while system should be quiesced
      
      This causes a warning:
      
      WARNING: at net/mac80211/util.c:540 ieee80211_can_queue_work+0x35/0x40 [mac80211]()
      
      but is otherwise harmless. I'm not completely sure
      this is the scenario Thomas stumbled across, but it
      is the only way I can right now see the warning in
      a scenario like the one he reported.
      Reported-by: NThomas Meyer <thomas@m3y3r.de>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      0ecfe806
    • L
      cfg80211: fix bug on regulatory core exit on access to last_request · 58ebacc6
      Luis R. Rodriguez 提交于
      Commit 4d9d88d1 by Scott James Remnant <keybuk@google.com> added
      the .uevent() callback for the regulatory device used during
      the platform device registration. The change was done to account
      for queuing up udev change requests through udevadm triggers.
      The change also meant that upon regulatory core exit we will now
      send a uevent() but the uevent() callback, reg_device_uevent(),
      also accessed last_request. Right before commiting device suicide
      we free'd last_request but never set it to NULL so
      platform_device_unregister() would lead to bogus kernel paging
      request. Fix this and also simply supress uevents right before
      we commit suicide as they are pointless.
      
      This fix is required for kernels >= v2.6.39
      
      $ git describe --contains 4d9d88d1
      v2.6.39-rc1~468^2~25^2^2~21
      
      The impact of not having this present is that a bogus paging
      access may occur (only read) upon cfg80211 unload time. You
      may also get this BUG complaint below. Although Johannes
      could not reproduce the issue this fix is theoretically correct.
      
      mac80211_hwsim: unregister radios
      mac80211_hwsim: closing netlink
      BUG: unable to handle kernel paging request at ffff88001a06b5ab
      IP: [<ffffffffa030df9a>] reg_device_uevent+0x1a/0x50 [cfg80211]
      PGD 1836063 PUD 183a063 PMD 1ffcb067 PTE 1a06b160
      Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
      CPU 0
      Modules linked in: cfg80211(-) [last unloaded: mac80211]
      
      Pid: 2279, comm: rmmod Tainted: G        W   3.1.0-wl+ #663 Bochs Bochs
      RIP: 0010:[<ffffffffa030df9a>]  [<ffffffffa030df9a>] reg_device_uevent+0x1a/0x50 [cfg80211]
      RSP: 0000:ffff88001c5f9d58  EFLAGS: 00010286
      RAX: 0000000000000000 RBX: ffff88001d2eda88 RCX: ffff88001c7468fc
      RDX: ffff88001a06b5a0 RSI: ffff88001c7467b0 RDI: ffff88001c7467b0
      RBP: ffff88001c5f9d58 R08: 000000000000ffff R09: 000000000000ffff
      R10: 0000000000000000 R11: 0000000000000001 R12: ffff88001c7467b0
      R13: ffff88001d2eda78 R14: ffffffff8164a840 R15: 0000000000000001
      FS:  00007f8a91d8a6e0(0000) GS:ffff88001fc00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      CR2: ffff88001a06b5ab CR3: 000000001c62e000 CR4: 00000000000006f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process rmmod (pid: 2279, threadinfo ffff88001c5f8000, task ffff88000023c780)
      Stack:
       ffff88001c5f9d98 ffffffff812ff7e5 ffffffff8176ab3d ffff88001c7468c2
       000000000000ffff ffff88001d2eda88 ffff88001c7467b0 ffff880000114820
       ffff88001c5f9e38 ffffffff81241dc7 ffff88001c5f9db8 ffffffff81040189
      Call Trace:
       [<ffffffff812ff7e5>] dev_uevent+0xc5/0x170
       [<ffffffff81241dc7>] kobject_uevent_env+0x1f7/0x490
       [<ffffffff81040189>] ? sub_preempt_count+0x29/0x60
       [<ffffffff814cab1a>] ? _raw_spin_unlock_irqrestore+0x4a/0x90
       [<ffffffff81305307>] ? devres_release_all+0x27/0x60
       [<ffffffff8124206b>] kobject_uevent+0xb/0x10
       [<ffffffff812fee27>] device_del+0x157/0x1b0
       [<ffffffff8130377d>] platform_device_del+0x1d/0x90
       [<ffffffff81303b76>] platform_device_unregister+0x16/0x30
       [<ffffffffa030fffd>] regulatory_exit+0x5d/0x180 [cfg80211]
       [<ffffffffa032bec3>] cfg80211_exit+0x2b/0x45 [cfg80211]
       [<ffffffff8109a84c>] sys_delete_module+0x16c/0x220
       [<ffffffff8108a23e>] ? trace_hardirqs_on_caller+0x7e/0x120
       [<ffffffff814cba02>] system_call_fastpath+0x16/0x1b
      Code: <all your base are belong to me>
      RIP  [<ffffffffa030df9a>] reg_device_uevent+0x1a/0x50 [cfg80211]
       RSP <ffff88001c5f9d58>
      CR2: ffff88001a06b5ab
      ---[ end trace 147c5099a411e8c0 ]---
      Reported-by: NJohannes Berg <johannes@sipsolutions.net>
      Cc: Scott James Remnant <keybuk@google.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      58ebacc6
    • J
      mac80211: fix bug in ieee80211_build_probe_req · 5b2bbf75
      Johannes Berg 提交于
      ieee80211_probereq_get() can return NULL in
      which case we should clean up & return NULL
      in ieee80211_build_probe_req() as well.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      5b2bbf75
    • J
      mac80211: fix NULL dereference in radiotap code · f8d1ccf1
      Johannes Berg 提交于
      When receiving failed PLCP frames is enabled, there
      won't be a rate pointer when we add the radiotap
      header and thus the kernel will crash. Fix this by
      not assuming the rate pointer is always valid. It's
      still always valid for frames that have good PLCP
      though, and that is checked & enforced.
      
      This was broken by my
      commit fc885189
      Author: Johannes Berg <johannes.berg@intel.com>
      Date:   Fri Jul 30 13:23:12 2010 +0200
      
          mac80211: don't check rates on PLCP error frames
      
      where I removed the check in this case but didn't
      take into account that the rate info would be used.
      Reported-by: NXiaokang Qin <xiaokang.qin@intel.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      f8d1ccf1
  10. 09 11月, 2011 4 次提交
  11. 08 11月, 2011 8 次提交
    • A
      Bluetooth: Use miliseconds for L2CAP channel timeouts · f3f668b0
      Andrzej Kaczmarek 提交于
      Timers set by __set_chan_timer() should use miliseconds instead of
      jiffies. Commit 942ecc9c updated
      l2cap_set_timer() so it expects timeout to be specified in msecs
      instead of jiffies. This makes timeouts unreliable when CONFIG_HZ
      is not set to 1000.
      Signed-off-by: NAndrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
      Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>
      f3f668b0
    • A
      Bluetooth: Revert: Fix L2CAP connection establishment · 4dff523a
      Arek Lichwa 提交于
      This reverts commit 33060542.
      The commit introduces regression when two 2.1 devices attempt
      establish rfcomm channel. Such connection is refused since there's
      a security block issue on l2cap. It means the link is unencrypted.
      
      2011-09-16 18:08:46.567616 < ACL data: handle 1 flags 0x00 dlen 24
          0000: 14 00 40 00 06 00 02 00  0f 35 03 19 12 00 ff ff
      ..@......5....˙˙
          0010: 35 05 0a 00 00 ff ff 00                           5....˙˙.
      2011-09-16 18:08:46.572377 > HCI Event: Number of Completed Packets
      (0x13) plen 5
          handle 1 packets 1
      2011-09-16 18:08:46.577931 > ACL data: handle 1 flags 0x02 dlen 88
          L2CAP(d): cid 0x0040 len 84 [psm 0]
            0000: 07 00 02 00 4f 00 4c 35  4a 35 48 09 00 00 0a 00
      ....O.L5J5H.....
            0010: 01 00 00 09 00 01 35 03  19 12 00 09 00 05 35 03
      ......5.......5.
            0020: 19 10 02 09 00 09 35 08  35 06 19 12 00 09 01 02
      ......5.5.......
            0030: 09 02 00 09 01 02 09 02  01 09 00 0a 09 02 02 09
      ................
            0040: 00 00 09 02 03 09 00 00  09 02 04 28 01 09 02 05
      ...........(....
            0050: 09 00 02 00                                       ....
      2011-09-16 18:08:46.626057 < HCI Command: Authentication Requested
      (0x01|0x0011) plen 2
          handle 1
      2011-09-16 18:08:46.627614 > HCI Event: Command Status (0x0f) plen 4
          Authentication Requested (0x01|0x0011) status 0x00 ncmd 1
      2011-09-16 18:08:46.627675 > HCI Event: Link Key Request (0x17) plen 6
          bdaddr 00:00:F2:6A:29:69
      2011-09-16 18:08:46.634999 < HCI Command: Link Key Request Reply
      (0x01|0x000b) plen 22
          bdaddr 00:00:F2:6A:29:69 key 58CD393179FC902E5E8F512A855EE532
      2011-09-16 18:08:46.683278 > HCI Event: Command Complete (0x0e) plen 10
          Link Key Request Reply (0x01|0x000b) ncmd 1
          status 0x00 bdaddr 00:00:F2:6A:29:69
      2011-09-16 18:08:46.764729 > HCI Event: Auth Complete (0x06) plen 3
          status 0x00 handle 1
      2011-09-16 18:08:46.764821 < ACL data: handle 1 flags 0x00 dlen 12
          0000: 08 00 01 00 02 05 04 00  03 00 41 00              ..........A.
      2011-09-16 18:08:46.764851 > HCI Event: Command Status (0x0f) plen 4
          Unknown (0x00|0x0000) status 0x00 ncmd 2
      2011-09-16 18:08:46.768117 > HCI Event: Number of Completed Packets
      (0x13) plen 5
          handle 1 packets 1
      2011-09-16 18:08:46.770894 > ACL data: handle 1 flags 0x02 dlen 16
          L2CAP(s): Connect rsp: dcid 0x0000 scid 0x0041 result 3 status 0
            Connection refused - security block
      2011-09-16 18:08:49.000691 < ACL data: handle 1 flags 0x00 dlen 12
          0000: 08 00 01 00 06 06 04 00  40 00 40 00              ........@.@.
      2011-09-16 18:08:49.015675 > HCI Event: Number of Completed Packets
      (0x13) plen 5
          handle 1 packets 1
      2011-09-16 18:08:49.016927 > ACL data: handle 1 flags 0x02 dlen 12
          L2CAP(s): Disconn rsp: dcid 0x0040 scid 0x0040
      2011-09-16 18:08:51.009480 < HCI Command: Disconnect (0x01|0x0006) plen
      3
          handle 1 reason 0x13
          Reason: Remote User Terminated Connection
      2011-09-16 18:08:51.011525 > HCI Event: Command Status (0x0f) plen 4
          Disconnect (0x01|0x0006) status 0x00 ncmd 1
      2011-09-16 18:08:51.123494 > HCI Event: Disconn Complete (0x05) plen 4
          status 0x00 handle 1 reason 0x16
          Reason: Connection Terminated by Local Host
      Signed-off-by: NArek Lichwa <arkadiusz.lichwa@tieto.com>
      Signed-off-by: NGustavo F. Padovan <padovan@profusion.mobi>
      4dff523a
    • R
      wanrouter: Remove kernel_lock annotations · 039c811c
      Richard Weinberger 提交于
      The BKL is gone, these annotations are useless.
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      039c811c
    • J
      mac80211: uAPSD - fix IEEE80211_FCTL_MOREDATA bit setting · 24b9c373
      Janusz.Dziedzic@tieto.com 提交于
      Set IEEE80211_FCTL_MOREDATA bit also in case we have buffered
      frames (more than one) only for one AC.
      Signed-off-by: NJanusz Dziedzic <janusz.dziedzic@tieto.com>
      Reviewed-by: NJohannes Berg <johannes@sipsolutions.net>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      24b9c373
    • J
      cfg80211: fix cmp_ies · 3b6ef633
      Johannes Berg 提交于
      When comparing two items by IE, the sort order
      wasn't stable, which could lead to issues in the
      rbtree. Make it stable by making a missing IE
      sort before a present IE.
      
      Also sort by length first if it differs and then
      by contents.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      3b6ef633
    • J
      cfg80211: allow setting TXQ parameters only in AP mode · 133a3ff2
      Johannes Berg 提交于
      In other modes the parameters should not be set.
      Right now, mac80211 will set them, even if the
      user asked for setting them on VLANs which the
      driver doesn't know about, causing all kinds of
      trouble.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      133a3ff2
    • J
      nl80211: fix HT capability attribute validation · 6c739419
      Johannes Berg 提交于
      Since the NL80211_ATTR_HT_CAPABILITY attribute is
      used as a struct, it needs a minimum, not maximum
      length. Enforce that properly. Not doing so could
      potentially lead to reading after the buffer.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      6c739419
    • E
      mac80211: use min rate as basic rate for buggy APs · 3432f923
      Eliad Peller 提交于
      Some buggy APs (and even P2P_GO) don't advertise their
      basic rates in the association response.
      
      In such case, use the min supported rate as the
      basic rate.
      Reported-by: NPontus Fuchs <pontus.fuchs@gmail.com>
      Signed-off-by: NEliad Peller <eliad@wizery.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      3432f923
  12. 04 11月, 2011 1 次提交
    • O
      af_packet: de-inline some helper functions · eea49cc9
      Olof Johansson 提交于
      This popped some compiler errors due to mismatched prototypes. Just
      remove most manual inlines, the compiler should be able to figure out
      what makes sense to inline and not.
      
      net/packet/af_packet.c:252: warning: 'prb_curr_blk_in_use' declared inline after being called
      net/packet/af_packet.c:252: warning: previous declaration of 'prb_curr_blk_in_use' was here
      net/packet/af_packet.c:258: warning: 'prb_queue_frozen' declared inline after being called
      net/packet/af_packet.c:258: warning: previous declaration of 'prb_queue_frozen' was here
      net/packet/af_packet.c:248: warning: 'packet_previous_frame' declared inline after being called
      net/packet/af_packet.c:248: warning: previous declaration of 'packet_previous_frame' was here
      net/packet/af_packet.c:251: warning: 'packet_increment_head' declared inline after being called
      net/packet/af_packet.c:251: warning: previous declaration of 'packet_increment_head' was here
      Signed-off-by: NOlof Johansson <olof@lixom.net>
      Cc: Chetan Loke <loke.chetan@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      eea49cc9