summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* bnx2x, cnic, bnx2i: use new FW/HSIDmitry Kravkov2010-10-0619-3222/+4764
| | | | | | | | | | | | | | | | This is the new FW HSI blob and the relevant definitions without logic changes. It also included code adaptation for new HSI. New features are not enabled. New FW/HSI includes: - Support for 57712 HW - Future support for VF (not used) - Improvements in FW interrupts scheme - FW FCoE hooks (stubs for future usage) Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: add 6.0.34 fw filesDmitry Kravkov2010-10-063-0/+38096
| | | | | | | | New firmware files for all bnx2x devices Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: create folder for bnx2x firmware filesDmitry Kravkov2010-10-065-5/+6
| | | | | | Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Fine-tune ring init code.Michael Chan2010-10-062-6/+19
| | | | | | | | | | Initialize the rings only during cnic_uio_open() and shut them down during cnic_uio_close(). Check for the new bit CNIC_LCL_FL_RINGS_INITED before checking for ring interrupt. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Use pfid for internal memory offsets.Michael Chan2010-10-062-70/+75
| | | | | | | | | | The pfid (physical function ID) is the same as PCI function on production devices. The pfid for future devices will be different and will be used for internal memory offsets. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Pass cp pointer to BNX2X_HW_CID.Michael Chan2010-10-062-11/+11
| | | | | | | | Preparation work for upcoming firmware interface changes. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* [PATCH net-next] tg3: Set real_num_rx_queues for non-multiq devsMatt Carlson2010-10-061-0/+1
| | | | | | | | | | | | Commit 2ddaad397c47de012dfb956b0c05540da1a0dde5 entitled "tg3: Use netif_set_real_num_{rx,tx}_queues()" added a new call to netif_set_real_num_rx_queues in tg3_enable_msix(). This call also needs to be added to the legacy path to correctly reflect the actual number of rx queues. Signed-off-by: Matt Carlson <mcarlson@broadcom.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'vhost-net-next' of ↵David S. Miller2010-10-063-12/+57
|\ | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
| * vhost: max s/g to match qemuJason Wang2010-10-053-12/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Qemu supports up to UIO_MAXIOV s/g so we have to match that because guest drivers may rely on this. Allocate indirect and log arrays dynamically to avoid using too much contigious memory and make the length of hdr array to match the header length since each iovec entry has a least one byte. Test with copying large files w/ and w/o migration in both linux and windows guests. Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | bna: scope and dead code cleanupRasesh Mody2010-10-0511-692/+170
| | | | | | | | | | | | | | | | | | | | As suggested by Stephen Hemminger: 1) Made functions and data structures static wherever possible. 2) Removed unused code. Signed-off-by: Debashis Dutt <ddutt@brocade.com> Signed-off-by: Rasesh Mody <rmody@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bna: fix interrupt handlingRasesh Mody2010-10-051-21/+27
| | | | | | | | | | | | | | | | | | This fix handles the case when IRQ handler is called (for shared IRQs) even before the driver is ready to handle interrupts. Signed-off-by: Debashis Dutt <ddutt@brocade.com> Signed-off-by: Rasesh Mody <rmody@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | fib: RCU conversion of fib_lookup()Eric Dumazet2010-10-0510-77/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fib_lookup() converted to be called in RCU protected context, no reference taken and released on a contended cache line (fib_clntref) fib_table_lookup() and fib_semantic_match() get an additional parameter. struct fib_info gets an rcu_head field, and is freed after an rcu grace period. Stress test : (Sending 160.000.000 UDP frames on same neighbour, IP route cache disabled, dual E5540 @2.53GHz, 32bit kernel, FIB_HASH) (about same results for FIB_TRIE) Before patch : real 1m31.199s user 0m13.761s sys 23m24.780s After patch: real 1m5.375s user 0m14.997s sys 15m50.115s Before patch Profile : 13044.00 15.4% __ip_route_output_key vmlinux 8438.00 10.0% dst_destroy vmlinux 5983.00 7.1% fib_semantic_match vmlinux 5410.00 6.4% fib_rules_lookup vmlinux 4803.00 5.7% neigh_lookup vmlinux 4420.00 5.2% _raw_spin_lock vmlinux 3883.00 4.6% rt_set_nexthop vmlinux 3261.00 3.9% _raw_read_lock vmlinux 2794.00 3.3% fib_table_lookup vmlinux 2374.00 2.8% neigh_resolve_output vmlinux 2153.00 2.5% dst_alloc vmlinux 1502.00 1.8% _raw_read_lock_bh vmlinux 1484.00 1.8% kmem_cache_alloc vmlinux 1407.00 1.7% eth_header vmlinux 1406.00 1.7% ipv4_dst_destroy vmlinux 1298.00 1.5% __copy_from_user_ll vmlinux 1174.00 1.4% dev_queue_xmit vmlinux 1000.00 1.2% ip_output vmlinux After patch Profile : 13712.00 15.8% dst_destroy vmlinux 8548.00 9.9% __ip_route_output_key vmlinux 7017.00 8.1% neigh_lookup vmlinux 4554.00 5.3% fib_semantic_match vmlinux 4067.00 4.7% _raw_read_lock vmlinux 3491.00 4.0% dst_alloc vmlinux 3186.00 3.7% neigh_resolve_output vmlinux 3103.00 3.6% fib_table_lookup vmlinux 2098.00 2.4% _raw_read_lock_bh vmlinux 2081.00 2.4% kmem_cache_alloc vmlinux 2013.00 2.3% _raw_spin_lock vmlinux 1763.00 2.0% __copy_from_user_ll vmlinux 1763.00 2.0% ip_output vmlinux 1761.00 2.0% ipv4_dst_destroy vmlinux 1631.00 1.9% eth_header vmlinux 1440.00 1.7% _raw_read_unlock_bh vmlinux Reference results, if IP route cache is enabled : real 0m29.718s user 0m10.845s sys 7m37.341s 25213.00 29.5% __ip_route_output_key vmlinux 9011.00 10.5% dst_release vmlinux 4817.00 5.6% ip_push_pending_frames vmlinux 4232.00 5.0% ip_finish_output vmlinux 3940.00 4.6% udp_sendmsg vmlinux 3730.00 4.4% __copy_from_user_ll vmlinux 3716.00 4.4% ip_route_output_flow vmlinux 2451.00 2.9% __xfrm_lookup vmlinux 2221.00 2.6% ip_append_data vmlinux 1718.00 2.0% _raw_spin_lock_bh vmlinux 1655.00 1.9% __alloc_skb vmlinux 1572.00 1.8% sock_wfree vmlinux 1345.00 1.6% kfree vmlinux Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bonding: add retransmit membership reports tunableFlavio Leitner2010-10-055-0/+72
| | | | | | | | | | | | | | | | Allow sysadmins to configure the number of multicast membership report sent on a link failure event. Signed-off-by: Flavio Leitner <fleitner@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bonding: fix to rejoin multicast groups immediatelyFlavio Leitner2010-10-051-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The IGMP specs states that if the system receives a membership report, it shouldn't send another for the next minute. However, if a link failure happens right after that, the backup slave and the switch connected to this slave will not know about the multicast and the traffic will hang for about a minute. This patch fixes it to rejoin multicast groups immediately after a failover restoring the multicast traffic. Signed-off-by: Flavio Leitner <fleitner@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bonding: rejoin multicast groups on VLANsFlavio Leitner2010-10-052-11/+50
| | | | | | | | | | | | | | | | | | | | | | | | During a failover, the IGMP membership is sent to update the switch restoring the traffic, but it misses groups added to VLAN devices running on top of bonding devices. This patch changes it to iterate over all VLAN devices on top of it sending IGMP memberships too. Signed-off-by: Flavio Leitner <fleitner@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ehea: converting msleeps to waitqueue on check_sqs() functionBreno Leitao2010-10-052-7/+12
| | | | | | | | | | | | | | Removing the msleep() call in check_sqs() function, and replacing by a wait queue. Signed-off-by: Breno Leitao <leitao@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ehea: using wait queues instead of msleep on ehea_flush_sqBreno Leitao2010-10-052-7/+13
| | | | | | | | | | | | | | | | | | This patch just remove a msleep loop and change to wait queue, making the code cleaner. Signed-off-by: Breno Leitao <leitao@linux.vnet.ibm.com> Acked-by: David Howells <dhowells@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | ixgbevf: declare functions as staticEmil Tantilov2010-10-053-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Following patch fixes warnings reported by `make namespacecheck` Reported by Stephen Hemminger CC: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Acked-by: Greg Rose <greg.v.rose@intel.com> Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | AF_UNIX: Implement SO_TIMESTAMP and SO_TIMETAMPNS on Unix socketsAlban Crequy2010-10-051-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Userspace applications can already request to receive timestamps with: setsockopt(sockfd, SOL_SOCKET, SO_TIMESTAMP, ...) Although setsockopt() returns zero (success), timestamps are not added to the ancillary data. This patch fixes that on SOCK_DGRAM and SOCK_SEQPACKET Unix sockets. Signed-off-by: Alban Crequy <alban.crequy@collabora.co.uk> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net neigh: RCU conversion of neigh hash tableEric Dumazet2010-10-056-100/+170
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | David This is the first step for RCU conversion of neigh code. Next patches will convert hash_buckets[] and "struct neighbour" to RCU protected objects. Thanks [PATCH net-next] net neigh: RCU conversion of neigh hash table Instead of storing hash_buckets, hash_mask and hash_rnd in "struct neigh_table", a new structure is defined : struct neigh_hash_table { struct neighbour **hash_buckets; unsigned int hash_mask; __u32 hash_rnd; struct rcu_head rcu; }; And "struct neigh_table" has an RCU protected pointer to such a neigh_hash_table. This means the signature of (*hash)() function changed: We need to add a third parameter with the actual hash_rnd value, since this is not anymore a neigh_table field. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net neigh: neigh_delete() and neigh_add() changesEric Dumazet2010-10-051-22/+17
| | | | | | | | | | | | | | | | neigh_delete() and neigh_add() dont need to touch device refcount, we hold RTNL when calling them, so device cannot disappear under us. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: add a core netdev->rx_dropped counterEric Dumazet2010-10-0511-34/+26
|/ | | | | | | | | | | | | | | | | | In various situations, a device provides a packet to our stack and we drop it before it enters protocol stack : - softnet backlog full (accounted in /proc/net/softnet_stat) - bad vlan tag (not accounted) - unknown/unregistered protocol (not accounted) We can handle a per-device counter of such dropped frames at core level, and automatically adds it to the device provided stats (rx_dropped), so that standard tools can be used (ifconfig, ip link, cat /proc/net/dev) This is a generalization of commit 8990f468a (net: rx_dropped accounting), thus reverting it. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ppp: Use a real SKB control block in fragmentation engine.David S. Miller2010-10-051-21/+25
| | | | | | | | | Do this instead of subverting fields in skb proper. The macros that could very easily match variable or function names were also just asking for trouble. Signed-off-by: David S. Miller <davem@davemloft.net>
* ipv6: make __ipv6_isatap_ifid staticstephen hemminger2010-10-052-4/+1
| | | | | | | | Another exported symbol only used in one file Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* fib: fib_rules_cleanup can be staticstephen hemminger2010-10-052-3/+1
| | | | | | | | fib_rules_cleanup_ups is only defined and used in one place. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* fib: cleanupsEric Dumazet2010-10-053-182/+206
| | | | | | | | Code style cleanups before upcoming functional changes. C99 initializer for fib_props array. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* wimax: make functions localstephen hemminger2010-10-056-23/+11
| | | | | | | | | | | | Make wimax variables and functions local if possible. Compile tested only. This also removes a couple of unused EXPORT_SYMBOL. If this breaks some out of tree code, please fix that by putting the code in the kernel tree. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* qlcnic: remove dead codestephen hemminger2010-10-052-176/+0
| | | | | | | | This driver has several pieces of dead code (found by running make namespacecheck). This patch removes them. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* caif: remove duplicated includeNicolas Kaiser2010-10-051-1/+0
| | | | | | | | Remove duplicated include. Signed-off-by: Nicolas Kaiser <nikai@nikai.net> Acked-by: Sjur Braendeland <sjur.brandeland@stericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* don't let BCM63XX_PHY depend on non-existant symbolUwe Kleine-König2010-10-051-1/+0
| | | | | | | | | | | | | The kernel doesn't have a symbol called BCM63XX. There is a symbol BCM63XX_ENET (introduced in 9b1fc55a0500, 6 weeks after 09bb9aa0ed that introduced BCM63XX_PHY), but the driver compiles without that, too. Cc: Maxime Bizon <mbizon@freebox.fr> Cc: Florian Fainelli <florian@openwrt.org> Cc: David S. Miller <davem@davemloft.net> Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* net/phy: fix many "defined but unused" warningsUwe Kleine-König2010-10-0515-15/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | MODULE_DEVICE_TABLE only expands to something if it's compiled for a module. So when building-in support for the phys, the mdio_device_id tables are unused. Marking them with __maybe_unused fixes the following warnings: drivers/net/phy/bcm63xx.c:134: warning: 'bcm63xx_tbl' defined but not used drivers/net/phy/broadcom.c:933: warning: 'broadcom_tbl' defined but not used drivers/net/phy/cicada.c:162: warning: 'cicada_tbl' defined but not used drivers/net/phy/davicom.c:222: warning: 'davicom_tbl' defined but not used drivers/net/phy/et1011c.c:114: warning: 'et1011c_tbl' defined but not used drivers/net/phy/icplus.c:137: warning: 'icplus_tbl' defined but not used drivers/net/phy/lxt.c:226: warning: 'lxt_tbl' defined but not used drivers/net/phy/marvell.c:724: warning: 'marvell_tbl' defined but not used drivers/net/phy/micrel.c:234: warning: 'micrel_tbl' defined but not used drivers/net/phy/national.c:154: warning: 'ns_tbl' defined but not used drivers/net/phy/qsemi.c:141: warning: 'qs6612_tbl' defined but not used drivers/net/phy/realtek.c:82: warning: 'realtek_tbl' defined but not used drivers/net/phy/smsc.c:257: warning: 'smsc_tbl' defined but not used drivers/net/phy/ste10Xp.c:135: warning: 'ste10Xp_tbl' defined but not used drivers/net/phy/vitesse.c:195: warning: 'vitesse_tbl' defined but not used Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: relax rtnl_dereference()David S. Miller2010-10-051-4/+6
| | | | | | | | | | | | | | rtnl_dereference() is used in contexts where RTNL is held, to fetch an RCU protected pointer. Updates to this pointer are prevented by RTNL, so we dont need smp_read_barrier_depends() and the ACCESS_ONCE() provided in rcu_dereference_check(). rtnl_dereference() is mainly a macro to document the locking invariant. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ipvs: Use frag walker helper in SCTP proto support.David S. Miller2010-10-051-9/+10
| | | | | Signed-off-by: David S. Miller <davem@davemloft.net> Acked-by: Simon Horman <horms@verge.net.au>
* net: dynamic ingress_queue allocationEric Dumazet2010-10-055-27/+71
| | | | | | | | | | | ingress being not used very much, and net_device->ingress_queue being quite a big object (128 or 256 bytes), use a dynamic allocation if needed (tc qdisc add dev eth0 ingress ...) dev_ingress_queue(dev) helper should be used only with RTNL taken. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* qlcnic: set mtu lower limitSritej Velaga2010-10-042-3/+4
| | | | | | | | Setting mtu < 68 is not supported. Signed-off-by: Sritej Velaga <sritej.velaga@qlogic.com> Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* qlcnic: cleanup port mode settingSritej Velaga2010-10-041-40/+0
| | | | | | | | Port mode setting is not required for Qlogic CNA adapters. Signed-off-by: Sritej Velaga <sritej.velaga@qlogic.com> Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* qlcnic: sparse warning fixesSucheta Chakraborty2010-10-042-11/+11
| | | | | | Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* qlcnic: fix vlan TSO on big endian machineSucheta Chakraborty2010-10-043-8/+20
| | | | | | | | | o desc->vlan_tci is in __le16 format. Doing htons and cpu_to_le64 again on vlan_tci, result in invalid value on ppc. Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* qlcnic: fix endianess for lroSucheta Chakraborty2010-10-042-3/+10
| | | | | | | | | ipaddress in ifa->ifa_address field are in big endian format. Also device requires ip address in big endian only. Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* qlcnic: fix diag registerAmit Kumar Salecha2010-10-041-3/+3
| | | | | | | | regs_buff[i] and diag_registers[j] array should use different index variable. Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* qlcnic: fix eswitch statsAmit Kumar Salecha2010-10-042-9/+34
| | | | | | | | | Some of the counters are not implemented in fw. Fw return NOT AVAILABLE VALUE as (0xffffffffffffffff). Adding these counters, result in invalid value. Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* qlcnic: fix internal loopback testAmit Kumar Salecha2010-10-042-8/+37
| | | | | | | | | | o Loop 10 times with delay of 1 ms to rcv packet. o Print garbage packet. o Try send/receive MAX(16) packet, instead of exit from test, if a packet is not received. Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'master' of ↵David S. Miller2010-10-0421-59/+124
|\ | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: net/ipv4/Kconfig net/ipv4/tcp_timer.c
| * sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac()Dan Rosenberg2010-10-031-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The sctp_asoc_get_hmac() function iterates through a peer's hmac_ids array and attempts to ensure that only a supported hmac entry is returned. The current code fails to do this properly - if the last id in the array is out of range (greater than SCTP_AUTH_HMAC_ID_MAX), the id integer remains set after exiting the loop, and the address of an out-of-bounds entry will be returned and subsequently used in the parent function, causing potentially ugly memory corruption. This patch resets the id integer to 0 on encountering an invalid id so that NULL will be returned after finishing the loop if no valid ids are found. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * sctp: prevent reading out-of-bounds memoryDan Rosenberg2010-10-031-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two user-controlled allocations in SCTP are subsequently dereferenced as sockaddr structs, without checking if the dereferenced struct members fall beyond the end of the allocated chunk. There doesn't appear to be any information leakage here based on how these members are used and additional checking, but it's still worth fixing. [akpm@linux-foundation.org: remove unfashionable newlines, fix gmail tab->space conversion] Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Cc: David Miller <davem@davemloft.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * ipv4: correct IGMP behavior on v3 query during v2-compatibility modeDavid Stevens2010-10-031-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | A recent patch to allow IGMPv2 responses to IGMPv3 queries bypasses length checks for valid query lengths, incorrectly resets the v2_seen timer, and does not support IGMPv1. The following patch responds with a v2 report as required by IGMPv2 while correcting the other problems introduced by the patch. Signed-Off-By: David L Stevens <dlstevens@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * netdev: Depend on INET before selecting INET_LROBen Hutchings2010-10-031-2/+2
| | | | | | | | | | | | | | | | | | | | Since 'select' ignores dependencies, drivers that select INET_LRO must depend on INET. This fixes the broken configuration reported in <http://article.gmane.org/gmane.linux.kernel/825646>. Reported-by: Subrata Modak <subrata@linux.vnet.ibm.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
| * Revert "ipv4: Make INET_LRO a bool instead of tristate."Ben Hutchings2010-10-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit e81963b180ac502fda0326edf059b1e29cdef1a2. LRO is now deprecated in favour of GRO, and only a few drivers use it, so it is desirable to build it as a module in distribution kernels. The original change to prevent building it as a module was made in an attempt to avoid the case where some dependents are set to y and some to m, and INET_LRO can be set to m rather than y. However, the Kconfig system will reliably set INET_LRO=y in this case. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
| * net: Fix the condition passed to sk_wait_event()Nagendra Tomar2010-10-031-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the condition (3rd arg) passed to sk_wait_event() in sk_stream_wait_memory(). The incorrect check in sk_stream_wait_memory() causes the following soft lockup in tcp_sendmsg() when the global tcp memory pool has exhausted. >>> snip <<< localhost kernel: BUG: soft lockup - CPU#3 stuck for 11s! [sshd:6429] localhost kernel: CPU 3: localhost kernel: RIP: 0010:[sk_stream_wait_memory+0xcd/0x200] [sk_stream_wait_memory+0xcd/0x200] sk_stream_wait_memory+0xcd/0x200 localhost kernel: localhost kernel: Call Trace: localhost kernel: [sk_stream_wait_memory+0x1b1/0x200] sk_stream_wait_memory+0x1b1/0x200 localhost kernel: [<ffffffff802557c0>] autoremove_wake_function+0x0/0x40 localhost kernel: [ipv6:tcp_sendmsg+0x6e6/0xe90] tcp_sendmsg+0x6e6/0xce0 localhost kernel: [sock_aio_write+0x126/0x140] sock_aio_write+0x126/0x140 localhost kernel: [xfs:do_sync_write+0xf1/0x130] do_sync_write+0xf1/0x130 localhost kernel: [<ffffffff802557c0>] autoremove_wake_function+0x0/0x40 localhost kernel: [hrtimer_start+0xe3/0x170] hrtimer_start+0xe3/0x170 localhost kernel: [vfs_write+0x185/0x190] vfs_write+0x185/0x190 localhost kernel: [sys_write+0x50/0x90] sys_write+0x50/0x90 localhost kernel: [system_call+0x7e/0x83] system_call+0x7e/0x83 >>> snip <<< What is happening is, that the sk_wait_event() condition passed from sk_stream_wait_memory() evaluates to true for the case of tcp global memory exhaustion. This is because both sk_stream_memory_free() and vm_wait are true which causes sk_wait_event() to *not* call schedule_timeout(). Hence sk_stream_wait_memory() returns immediately to the caller w/o sleeping. This causes the caller to again try allocation, which again fails and again calls sk_stream_wait_memory(), and so on. [ Bug introduced by commit c1cbe4b7ad0bc4b1d98ea708a3fecb7362aa4088 ("[NET]: Avoid atomic xchg() for non-error case") -DaveM ] Signed-off-by: Nagendra Singh Tomar <tomer_iisc@yahoo.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * net: Fix IPv6 PMTU disc. w/ asymmetric routesMaciej Żenczykowski2010-10-031-4/+24
| | | | | | | | | | Signed-off-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
View Lorry Controller Status