1. 12 7月, 2009 2 次提交
  2. 10 7月, 2009 4 次提交
    • R
      cxgb3: Fix crash caused by stashing wrong netdev_queue · e594e96e
      Roland Dreier 提交于
      Commit c3a8c5b6 ("cxgb3: move away from LLTX") exposed a bug in how
      cxgb3 looks up the netdev_queue it stashes away in a qset during
      initialization.  For multiport devices, the TX queue index it uses is
      offset by the first_qset index of each port.  This leads to a crash
      once LLTX is removed, since hard_start_xmit is called with one TX
      queue lock held, while the TX reclaim timer task grabs a different
      (wrong) TX queue lock when it frees skbs.
      
      Fix this by removing the first_qset offset used to look up the TX
      queue passed into t3_sge_alloc_qset() from setup_sge_qsets().
      Signed-off-by: NRoland Dreier <rolandd@cisco.com>
      Acked-by: NDivy Le Ray <divy@chelsio.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e594e96e
    • Y
      ixgbe: Fix coexistence of FCoE and Flow Director in 82599 · 8faa2a78
      Yi Zou 提交于
      Fix coexistence of Fiber Channel over Ethernet (FCoE) and Flow Director (FDIR)
      in 82599 and remove the disabling of FDIR when FCoE is enabled.
      
      Currently, FDIR is turned off when FCoE is enabled under the assumption that
      FCoE is always enabled with DCB being turned on. However, FDIR does not have
      to be turned off all the time when FCoE is enabled since FCoE can be enabled
      without DCB being turned on, e.g., use link pause only. This patch makes sure
      that when DCB is turned on or off, FDIR is turned on or off correspondingly;
      and when FCoE is enabled, it does not disable FDIR, rather, it will have FDIR
      set up properly so FCoE and FDIR can coexist regardless of DCB being on or off.
      Signed-off-by: NYi Zou <yi.zou@intel.com>
      Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8faa2a78
    • J
      memory barrier: adding smp_mb__after_lock · ad462769
      Jiri Olsa 提交于
      Adding smp_mb__after_lock define to be used as a smp_mb call after
      a lock.
      
      Making it nop for x86, since {read|write|spin}_lock() on x86 are
      full memory barriers.
      Signed-off-by: NJiri Olsa <jolsa@redhat.com>
      Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ad462769
    • J
      net: adding memory barrier to the poll and receive callbacks · a57de0b4
      Jiri Olsa 提交于
      Adding memory barrier after the poll_wait function, paired with
      receive callbacks. Adding fuctions sock_poll_wait and sk_has_sleeper
      to wrap the memory barrier.
      
      Without the memory barrier, following race can happen.
      The race fires, when following code paths meet, and the tp->rcv_nxt
      and __add_wait_queue updates stay in CPU caches.
      
      CPU1                         CPU2
      
      sys_select                   receive packet
        ...                        ...
        __add_wait_queue           update tp->rcv_nxt
        ...                        ...
        tp->rcv_nxt check          sock_def_readable
        ...                        {
        schedule                      ...
                                      if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
                                              wake_up_interruptible(sk->sk_sleep)
                                      ...
                                   }
      
      If there was no cache the code would work ok, since the wait_queue and
      rcv_nxt are opposit to each other.
      
      Meaning that once tp->rcv_nxt is updated by CPU2, the CPU1 either already
      passed the tp->rcv_nxt check and sleeps, or will get the new value for
      tp->rcv_nxt and will return with new data mask.
      In both cases the process (CPU1) is being added to the wait queue, so the
      waitqueue_active (CPU2) call cannot miss and will wake up CPU1.
      
      The bad case is when the __add_wait_queue changes done by CPU1 stay in its
      cache, and so does the tp->rcv_nxt update on CPU2 side.  The CPU1 will then
      endup calling schedule and sleep forever if there are no more data on the
      socket.
      
      Calls to poll_wait in following modules were ommited:
      	net/bluetooth/af_bluetooth.c
      	net/irda/af_irda.c
      	net/irda/irnet/irnet_ppp.c
      	net/mac80211/rc80211_pid_debugfs.c
      	net/phonet/socket.c
      	net/rds/af_rds.c
      	net/rfkill/core.c
      	net/sunrpc/cache.c
      	net/sunrpc/rpc_pipe.c
      	net/tipc/socket.c
      Signed-off-by: NJiri Olsa <jolsa@redhat.com>
      Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a57de0b4
  3. 09 7月, 2009 16 次提交
  4. 08 7月, 2009 8 次提交
    • L
      mac80211: minstrel: avoid accessing negative indices in rix_to_ndx() · 3938b45c
      Luciano Coelho 提交于
      If rix is not found in mi->r[], i will become -1 after the loop.  This value
      is eventually used to access arrays, so we were accessing arrays with a
      negative index, which is obviously not what we want to do.  This patch fixes
      this potential problem.
      Signed-off-by: NLuciano Coelho <luciano.coelho@nokia.com>
      Acked-by: NFelix Fietkau <nbd@openwrt.org>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      3938b45c
    • J
      cfg80211: fix refcount leak · 2dce4c2b
      Johannes Berg 提交于
      The code in cfg80211's cfg80211_bss_update erroneously
      grabs a reference to the BSS, which means that it will
      never be freed.
      Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
      Cc: stable@kernel.org [2.6.29, 2.6.30]
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      2dce4c2b
    • J
      hp-wmi: fix rfkill bug · 76d8b64e
      Johannes Berg 提交于
      Fix the third (I think) polarity error I accidentally
      introduced in the rfkill rewrite to make wireless work
      again on (certain?) HP laptops.
      Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
      Tested-by: NMaciej Rutecki <maciej.rutecki@gmail.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      76d8b64e
    • A
      mac80211: fix allocation in mesh_queue_preq · 59615b5f
      Andrey Yurovsky 提交于
      We allocate a PREQ queue node in mesh_queue_preq, however the allocation
      may cause us to sleep.  Use GFP_ATOMIC to prevent this.
      
      [ 1869.126498] BUG: scheduling while atomic: ping/1859/0x10000100
      [ 1869.127164] Modules linked in: ath5k mac80211 ath
      [ 1869.128310] Pid: 1859, comm: ping Not tainted 2.6.30-wl #1
      [ 1869.128754] Call Trace:
      [ 1869.129293]  [<c1023a2b>] __schedule_bug+0x48/0x4d
      [ 1869.129866]  [<c13b5533>] __schedule+0x77/0x67a
      [ 1869.130544]  [<c1026f2e>] ? release_console_sem+0x17d/0x185
      [ 1869.131568]  [<c807cf47>] ? mesh_queue_preq+0x2b/0x165 [mac80211]
      [ 1869.132318]  [<c13b5b3e>] schedule+0x8/0x1f
      [ 1869.132807]  [<c1023c12>] __cond_resched+0x16/0x2f
      [ 1869.133478]  [<c13b5bf0>] _cond_resched+0x27/0x32
      [ 1869.134191]  [<c108a370>] kmem_cache_alloc+0x1c/0xcf
      [ 1869.134714]  [<c10273ae>] ? printk+0x15/0x17
      [ 1869.135670]  [<c807cf47>] mesh_queue_preq+0x2b/0x165 [mac80211]
      [ 1869.136731]  [<c807d1f8>] mesh_nexthop_lookup+0xee/0x12d [mac80211]
      [ 1869.138130]  [<c807417e>] ieee80211_xmit+0xe6/0x2b2 [mac80211]
      [ 1869.138935]  [<c80be46d>] ? ath5k_hw_setup_rx_desc+0x0/0x66 [ath5k]
      [ 1869.139831]  [<c80c97bc>] ? ath5k_tasklet_rx+0xba/0x506 [ath5k]
      [ 1869.140863]  [<c8075191>] ieee80211_subif_start_xmit+0x6c9/0x6e4
      [mac80211]
      [ 1869.141665]  [<c105cf1c>] ? handle_level_irq+0x78/0x9d
      [ 1869.142390]  [<c12e3f93>] dev_hard_start_xmit+0x168/0x1c7
      [ 1869.143092]  [<c12f1f17>] __qdisc_run+0xe1/0x1b7
      [ 1869.143612]  [<c12e25ff>] qdisc_run+0x18/0x1a
      [ 1869.144248]  [<c12e62f4>] dev_queue_xmit+0x16a/0x25a
      [ 1869.144785]  [<c13b6dcc>] ? _read_unlock_bh+0xe/0x10
      [ 1869.145465]  [<c12eacdb>] neigh_resolve_output+0x19c/0x1c7
      [ 1869.146182]  [<c130e2da>] ? ip_finish_output+0x0/0x51
      [ 1869.146697]  [<c130e2a0>] ip_finish_output2+0x182/0x1bc
      [ 1869.147358]  [<c130e327>] ip_finish_output+0x4d/0x51
      [ 1869.147863]  [<c130e9d5>] ip_output+0x80/0x85
      [ 1869.148515]  [<c130cc49>] dst_output+0x9/0xb
      [ 1869.149141]  [<c130dec6>] ip_local_out+0x17/0x1a
      [ 1869.149632]  [<c130e0bc>] ip_push_pending_frames+0x1f3/0x255
      [ 1869.150343]  [<c13247ff>] raw_sendmsg+0x5e6/0x667
      [ 1869.150883]  [<c1033c55>] ? insert_work+0x6a/0x73
      [ 1869.151834]  [<c8071e00>] ?
      ieee80211_invoke_rx_handlers+0x17da/0x1ae8 [mac80211]
      [ 1869.152630]  [<c132bd68>] inet_sendmsg+0x3b/0x48
      [ 1869.153232]  [<c12d7deb>] __sock_sendmsg+0x45/0x4e
      [ 1869.153740]  [<c12d8537>] sock_sendmsg+0xb8/0xce
      [ 1869.154519]  [<c80be46d>] ? ath5k_hw_setup_rx_desc+0x0/0x66 [ath5k]
      [ 1869.155289]  [<c1036b25>] ? autoremove_wake_function+0x0/0x30
      [ 1869.155859]  [<c115992b>] ? __copy_from_user_ll+0x11/0xce
      [ 1869.156573]  [<c1159d99>] ? copy_from_user+0x31/0x54
      [ 1869.157235]  [<c12df646>] ? verify_iovec+0x40/0x6e
      [ 1869.157778]  [<c12d869a>] sys_sendmsg+0x14d/0x1a5
      [ 1869.158714]  [<c8072c40>] ? __ieee80211_rx+0x49e/0x4ee [mac80211]
      [ 1869.159641]  [<c80c83fe>] ? ath5k_rxbuf_setup+0x6d/0x8d [ath5k]
      [ 1869.160543]  [<c80be46d>] ? ath5k_hw_setup_rx_desc+0x0/0x66 [ath5k]
      [ 1869.161434]  [<c80beba4>] ? ath5k_hw_get_rxdp+0xe/0x10 [ath5k]
      [ 1869.162319]  [<c80c97bc>] ? ath5k_tasklet_rx+0xba/0x506 [ath5k]
      [ 1869.163063]  [<c1005627>] ? enable_8259A_irq+0x40/0x43
      [ 1869.163594]  [<c101edb8>] ? __dequeue_entity+0x23/0x27
      [ 1869.164793]  [<c100187a>] ? __switch_to+0x2b/0x105
      [ 1869.165442]  [<c1021d5f>] ? finish_task_switch+0x5b/0x74
      [ 1869.166129]  [<c12d963a>] sys_socketcall+0x14b/0x17b
      [ 1869.166612]  [<c1002b95>] syscall_call+0x7/0xb
      Signed-off-by: NAndrey Yurovsky <andrey@cozybit.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      59615b5f
    • S
      iwmc3200wifi: add Kconfig help · a7a4e41e
      Samuel Ortiz 提交于
      We're missing a Kconfig help for the iwmc3200wifi driver.
      Signed-off-by: NSamuel Ortiz <samuel.ortiz@intel.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      a7a4e41e
    • V
      ath9k: Fix leak in tx descriptor · cbfe89c6
      Vasanthakumar Thiagarajan 提交于
      When we reclaim the tx desc, we always assume that the
      last desc is a holding desc, which is not true, and skip it.
      If the tx queue is drained during channel change, internal
      reset and etc, the last descriptor may not be the holding
      descriptor and we fail to reclaim them. This results in the
      following two issues.
      
      1. Tx stuck - We drop all the frames coming from upper layer
      due to shortage in tx desc.
      
      2. Crash - If we fail to reclaim a tx descriptor, we miss to
      update the tx BA window with the seq number of the frame
      associated to that desc, which, at some point, result in
      the following crash due to an assert failure in ath_tx_addto_baw().
      
      This patch fixes these two issues.
      
       kernel BUG at ../drivers/net/wireless/ath/ath9k/xmit.c:180!
      [155064.304164] invalid opcode: 0000 [#1] SMP
       Call Trace:
        [<fbc6d83b>] ? ath9k_tx+0xeb/0x160 [ath9k]
        [<fbbc9591>]  ipv6? __ieee80211_tx+0x41/0x120 [mac80211]
        [<fbbcb5ae>] ?  aes_i586ieee80211_master_start_xmit+0x28e/0x560 [mac80211]
        [<c037e501>]  aes_generic? _spin_lock_irqsave+0x31/0x40
        [<c02f347b>] ? dev_hard_start_xmit+0x16b/0x1c0
        [<c03058b5>] ? __qdisc_run+0x1b5/0x200
        [<fbbcda5a>] ?  af_packetieee80211_select_queue+0xa/0x100 [mac80211]
        [<c02f53b7>] ?  i915dev_queue_xmit+0x2e7/0x3f0
        [<fbbc9b49>] ? ieee80211_subif_start_xmit+0x369/0x7a0 [mac80211]
        [<c031bc35>] ? ip_output+0x55/0xb0
        [<c02e0188>] ? show_memcpy_count+0x18/0x60
        [<c02eb186>] ? __kfree_skb+0x36/0x90
        [<c02f2202>] ?  binfmt_miscdev_queue_xmit_nit+0xd2/0x110
        [<c02f347b>] ? dev_hard_start_xmit+0x16b/0x1c0
        [<c03058b5>] ? __qdisc_run+0x1b5/0x200
        [<c033bca7>] ?  scoarp_create+0x57/0x2a0
        [<c02f53b7>] ?  bridgedev_queue_xmit+0x2e7/0x3f0
        [<c03034a0>] ? eth_header+0x0/0xc0
        [<c033b95f>]  stp? arp_xmit+0x5f/0x70
        [<c033bf4f>] ? arp_send+0x5f/0x70
        [<c033c8f5>]  bnep? arp_solicit+0x105/0x210
        [<c02fa5aa>] ? neigh_timer_handler+0x19a/0x390
        [<c013bf88>] ? run_timer_softirq+0x138/0x210
        [<c02fa410>] ?  ppdevneigh_timer_handler+0x0/0x390
        [<c02fa410>] ? neigh_timer_handler+0x0/0x390
      Signed-off-by: NVasanthakumar Thiagarajan <vasanth@atheros.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      cbfe89c6
    • L
      b43/b43legacy: fix radio LED initialization · fd4973c5
      Larry Finger 提交于
      Fix condition in which radio LED did not initialize correctly, and remove
      4 compilation warnings.
      
      After the recent changes in rfkill, the radio LED used by b43/b43legacy
      did not always initialize correctly.
      
      Both b43 and b43legacy used the deprecated variable radio_enabled in
      struct ieee80211_conf.
      Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      fd4973c5
    • J
      Wireless: nl80211, fix lock imbalance · 1f5fc70a
      Jiri Slaby 提交于
      Don't forget to unlock cfg80211_mutex in one fail path of
      nl80211_set_wiphy.
      Signed-off-by: NJiri Slaby <jirislaby@gmail.com>
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      1f5fc70a
  5. 07 7月, 2009 5 次提交
  6. 06 7月, 2009 5 次提交