1. 09 Jun, 2009 1 commit
  2. 02 Jun, 2009 3 commits
    • Minoru Usui's avatar
      net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel... · 12186be7
      Minoru Usui authored
      
      net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup
      
      This patch fixes a bug which unconfigured struct tcf_proto keeps
      chaining in tc_ctl_tfilter(), and avoids kernel panic in
      cls_cgroup_classify() when we use cls_cgroup.
      
      When we execute 'tc filter add', tcf_proto is allocated, initialized
      by classifier's init(), and chained.  After it's chained,
      tc_ctl_tfilter() calls classifier's change().  When classifier's
      change() fails, tc_ctl_tfilter() does not free and keeps tcf_proto.
      
      In addition, cls_cgroup is initialized in change() not in init().  It
      accesses unconfigured struct tcf_proto which is chained before
      change(), then hits Oops.
      
      Signed-off-by: default avatarMinoru Usui <usui@mxm.nes.nec.co.jp>
      Signed-off-by: default avatarJarek Poplawski <jarkao2@gmail.com>
      Signed-off-by: default avatarJamal Hadi Salim <hadi@cyberus.ca>
      Tested-by: default avatarMinoru Usui <usui@mxm.nes.nec.co.jp>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      12186be7
    • Neil Horman's avatar
      e1000: add missing length check to e1000 receive routine · ea30e119
      Neil Horman authored
      
      
      	Patch to fix bad length checking in e1000.  E1000 by default does two
      things:
      
      1) Spans rx descriptors for packets that don't fit into 1 skb on recieve
      2) Strips the crc from a frame by subtracting 4 bytes from the length prior to
      doing an skb_put
      
      Since the e1000 driver isn't written to support receiving packets that span
      multiple rx buffers, it checks the End of Packet bit of every frame, and
      discards it if its not set.  This places us in a situation where, if we have a
      spanning packet, the first part is discarded, but the second part is not (since
      it is the end of packet, and it passes the EOP bit test).  If the second part of
      the frame is small (4 bytes or less), we subtract 4 from it to remove its crc,
      underflow the length, and wind up in skb_over_panic, when we try to skb_put a
      huge number of bytes into the skb.  This amounts to a remote DOS attack through
      careful selection of frame size in relation to interface MTU.  The fix for this
      is already in the e1000e driver, as well as the e1000 sourceforge driver, but no
      one ever pushed it to e1000.  This is lifted straight from e1000e, and prevents
      small frames from causing the underflow described above
      
      Signed-off-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Tested-by: default avatarAndy Gospodarek <andy@greyhouse.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ea30e119
    • Ed Swierk's avatar
      forcedeth: add phy_power_down parameter, leave phy powered up by default (v2) · 5a9a8e32
      Ed Swierk authored
      Add a phy_power_down parameter to forcedeth: set to 1 to power down the
      phy and disable the link when an interface goes down; set to 0 to always
      leave the phy powered up.
      
      The phy power state persists across reboots; Windows, some BIOSes, and
      older versions of Linux don't bother to power up the phy again, forcing
      users to remove all power to get the interface working (see
      http://bugzilla.kernel.org/show_bug.cgi?id=13072
      
      ).  Leaving the phy
      powered on is the safest default behavior.  Users accustomed to seeing
      the link state reflect the interface state and/or wanting to minimize
      power consumption can set phy_power_down=1 if compatibility with other
      OSes is not an issue.
      
      Signed-off-by: default avatarEd Swierk <eswierk@aristanetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5a9a8e32
  3. 01 Jun, 2009 3 commits
  4. 29 May, 2009 9 commits
  5. 27 May, 2009 4 commits
  6. 26 May, 2009 4 commits
    • Mike Frysinger's avatar
      bfin_mac: fix build error due to net_device_ops convert · b63dc8fe
      Mike Frysinger authored
      
      
      The previous commit "convert to net_device_ops" broke the Blackfin MAC
      driver as it declared the new structure before the function it used:
        CC      drivers/net/bfin_mac.o
      drivers/net/bfin_mac.c:984: error: ‘bfin_mac_close’ undeclared here (not in a function)
      make[1]: *** [drivers/net/bfin_mac.o] Error 1
      
      Signed-off-by: default avatarMike Frysinger <vapier@gentoo.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b63dc8fe
    • Alex Chiang's avatar
      atlx: move modinfo data from atlx.h to atl1.c · 5ad18900
      Alex Chiang authored
      
      
      Both atl1.c and atl2.c include atlx.h, which defines some modinfo
      stuff. But atl2.c seems like it doesn't want the modinfo data
      from atlx.h, as it defines its own.
      
      Running modinfo on atl2.ko, we get conflicting information:
      
      $ /sbin/modinfo drivers/net/atlx/atl2.ko | egrep "version|description|author"
      version:        2.2.3
      description:    Atheros Fast Ethernet Network Driver
      author:         Atheros Corporation <xiong.huang@atheros.com>, Chris Snook <csnook@redhat.com>
      version:        2.1.3
      author:         Xiong Huang <xiong.huang@atheros.com>, 	Chris Snook <csnook@redhat.com>, Jay Cliburn <jcliburn@gmail.com>
      
      Move the modinfo data out of atlx.h and into atl1.c to eliminate
      the confusion:
      
      $ /sbin/modinfo drivers/net/atlx/atl1.ko | egrep "version|description|author"
      version:        2.1.3
      author:         Xiong Huang <xiong.huang@atheros.com>, 	Chris Snook <csnook@redhat.com>, Jay Cliburn <jcliburn@gmail.com>
      description:    Atheros L1 Gigabit Ethernet Driver
      
      $ /sbin/modinfo drivers/net/atlx/atl2.ko | egrep "version|description|author"
      version:        2.2.3
      description:    Atheros Fast Ethernet Network Driver
      author:         Atheros Corporation <xiong.huang@atheros.com>, Chris Snook <csnook@redhat.com>
      
      Reported-by: default avatarScott Scriven <scott.scriven@hp.com>
      Signed-off-by: default avatarAlex Chiang <achiang@hp.com>
      Acked-by: default avatarJay Cliburn <jcliburn@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5ad18900
    • Xiaotian Feng's avatar
      gianfar: fix babbling rx error event bug · 18a36c1a
      Xiaotian Feng authored
      
      
      Gianfar interrupt handler uses IEVENT_ERR_MASK to check and handle errors.
      Babbling RX error (IEVENT_BABR) should be included in IEVENT_ERROR_MASK.
      Otherwise if BABR is raised, it never gets handled nor cleared, and an
      interrupt storm results. This has been observed to happen on sending a
      burst of ethernet frames to a gianfar based board.
      
      Signed-off-by: default avatarXiaotian Feng <xiaotian.feng@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      18a36c1a
    • Paul Menage's avatar
      cls_cgroup: read classid atomically in classifier · e65fcfd6
      Paul Menage authored
      
      
      Avoid reading the unsynchronized value cs->classid multiple times,
      since it could change concurrently from non-zero to zero; this would
      result in the classifier returning a positive result with a bogus
      (zero) classid.
      
      Signed-off-by: default avatarPaul Menage <menage@google.com>
      Reviewed-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e65fcfd6
  7. 25 May, 2009 7 commits
  8. 22 May, 2009 1 commit
    • Inaky Perez-Gonzalez's avatar
      wimax/i2400m: usb: fix device reset on autosuspend while not yet idle · e069c0cf
      Inaky Perez-Gonzalez authored
      
      
      When the i2400m is connected to a network, the host interface (USB)
      cannot be suspended. For that to happen, the device has to have
      negotiated with the basestation to put the link on IDLE state.
      
      If the host tries to put the device in standby while it is connected
      but not idle, the device resets, as the driver should not do that.
      
      To avoid triggering that, when the USB susbsytem requires the driver
      to autosuspend the device, the driver checks if the device is not yet
      idle. If it is not, the request is rejected (will be retried again
      later on after the autosuspend timeout). At some point the device will
      enter idle and the request will succeed (unless of course, there is
      network traffic, but at that point, there is no idle neither in the
      link or the host interface).
      
      Signed-off-by: default avatarInaky Perez-Gonzalez <inaky@linux.intel.com>
      e069c0cf
  9. 21 May, 2009 4 commits
  10. 20 May, 2009 4 commits
    • Jean-Mickael Guerin's avatar
      IPv6: set RTPROT_KERNEL to initial route · 4f724279
      Jean-Mickael Guerin authored
      The use of unspecified protocol in IPv6 initial route prevents quagga to
      install IPv6 default route:
      # show ipv6 route
      S   ::/0 [1/0] via fe80::1, eth1_0
      K>* ::/0 is directly connected, lo, rej
      C>* ::1/128 is directly connected, lo
      C>* fe80::/64 is directly connected, eth1_0
      
      # ip -6 route
      fe80::/64 dev eth1_0  proto kernel  metric 256  mtu 1500 advmss 1440
      hoplimit -1
      ff00::/8 dev eth1_0  metric 256  mtu 1500 advmss 1440 hoplimit -1
      unreachable default dev lo  proto none  metric -1  error -101 hoplimit 255
      
      The attached patch ensures RTPROT_KERNEL to the default initial route
      and fixes the problem for quagga.
      This is similar to "ipv6: protocol for address routes"
      f410a1fb
      
      .
      
      # show ipv6 route
      S>* ::/0 [1/0] via fe80::1, eth1_0
      C>* ::1/128 is directly connected, lo
      C>* fe80::/64 is directly connected, eth1_0
      
      # ip -6 route
      fe80::/64 dev eth1_0  proto kernel  metric 256  mtu 1500 advmss 1440
      hoplimit -1
      fe80::/64 dev eth1_0  proto kernel  metric 256  mtu 1500 advmss 1440
      hoplimit -1
      ff00::/8 dev eth1_0  metric 256  mtu 1500 advmss 1440 hoplimit -1
      default via fe80::1 dev eth1_0  proto zebra  metric 1024  mtu 1500
      advmss 1440 hoplimit -1
      unreachable default dev lo  proto kernel  metric -1  error -101 hoplimit 255
      
      Signed-off-by: default avatarJean-Mickael Guerin <jean-mickael.guerin@6wind.com>
      Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4f724279
    • David S. Miller's avatar
    • Eric Dumazet's avatar
      net: fix rtable leak in net/ipv4/route.c · 1ddbcb00
      Eric Dumazet authored
      Alexander V. Lukyanov found a regression in 2.6.29 and made a complete
      analysis found in http://bugzilla.kernel.org/show_bug.cgi?id=13339
      Quoted here because its a perfect one :
      
      begin_of_quotation
       2.6.29 patch has introduced flexible route cache rebuilding. Unfortunately the
       patch has at least one critical flaw, and another problem.
      
       rt_intern_hash calculates rthi pointer, which is later used for new entry
       insertion. The same loop calculates cand pointer which is used to clean the
       list. If the pointers are the same, rtable leak occurs, as first the cand is
       removed then the new entry is appended to it.
      
       This leak leads to unregister_netdevice problem (usage count > 0).
      
       Another problem of the patch is that it tries to insert the entries in certain
       order, to facilitate counting of entries distinct by all but QoS parameters.
       Unfortunately, referencing an existing rtable entry moves it to list beginning,
       to speed up further lookups, so the carefully built order is destroyed.
      
       For the first problem the simplest patch it to set rthi=0 when rthi==cand, but
       it will also destroy the ordering.
      end_of_quotation
      
      Problematic commit is 1080d709
      
      
      (net: implement emergency route cache rebulds when gc_elasticity is exceeded)
      
      Trying to keep dst_entries ordered is too complex and breaks the fact that
      order should depend on the frequency of use for garbage collection.
      
      A possible fix is to make rt_intern_hash() simpler, and only makes
      rt_check_expire() a litle bit smarter, being able to cope with an arbitrary
      entries order. The added loop is running on cache hot data, while cpu
      is prefetching next object, so should be unnoticied.
      
      Reported-and-analyzed-by: default avatarAlexander V. Lukyanov <lav@yar.ru>
      Signed-off-by: default avatarEric Dumazet <dada1@cosmosbay.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1ddbcb00
    • Eric Dumazet's avatar
      net: fix length computation in rt_check_expire() · cf8da764
      Eric Dumazet authored
      
      
      rt_check_expire() computes average and standard deviation of chain lengths,
      but not correclty reset length to 0 at beginning of each chain.
      This probably gives overflows for sum2 (and sum) on loaded machines instead
      of meaningful results.
      
      Signed-off-by: default avatarEric Dumazet <dada1@cosmosbay.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cf8da764