Pavel Emelyanov [Thu, 8 May 2008 08:24:25 +0000 (01:24 -0700)]
netns: Fix arbitrary net_device-s corruptions on net_ns stop.
When a net namespace is destroyed, some devices (those, not killed
on ns stop explicitly) are moved back to init_net.
The problem, is that this net_ns change has one point of failure -
the __dev_alloc_name() may be called if a name collision occurs (and
this is easy to trigger). This allocator performs a likely-to-fail
GFP_ATOMIC allocation to find a suitable number. Other possible
conditions that may cause error (for device being ns local or not
registered) are always false in this case.
So, when this call fails, the device is unregistered. But this is
*not* the right thing to do, since after this the device may be
released (and kfree-ed) improperly. E. g. bridges require more
actions (sysfs update, timer disarming, etc.), some other devices
want to remove their private areas from lists, etc.
I. e. arbitrary use-after-free cases may occur.
The proposed fix is the following: since the only reason for the
dev_change_net_namespace to fail is the name generation, we may
give it a unique fall-back name w/o %d-s in it - the dev<ifindex>
one, since ifindexes are still unique.
So make this change, raise the failure-case printk loglevel to
EMERG and replace the unregister_netdevice call with BUG().
[ Use snprintf() -DaveM ]
Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Thu, 8 May 2008 08:15:21 +0000 (01:15 -0700)]
netfilter: nf_conntrack_sip: restrict RTP expect flushing on error to last request
Some Inovaphone PBXs exhibit very stange behaviour: when dialing for
example "123", the device sends INVITE requests for "1", "12" and
"123" back to back. The first requests will elicit error responses
from the receiver, causing the SIP helper to flush the RTP
expectations even though we might still see a positive response.
Note the sequence number of the last INVITE request that contained a
media description and only flush the expectations when receiving a
negative response for that sequence number.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Thu, 8 May 2008 08:13:31 +0000 (01:13 -0700)]
macvlan: Fix memleak on device removal/crash on module removal
As noticed by Ben Greear, macvlan crashes the kernel when unloading the
module. The reason is that it tries to clean up the macvlan_port pointer
on the macvlan device itself instead of the underlying device. A non-NULL
pointer is taken as indication that the macvlan_handle_frame_hook is
valid, when receiving the next packet on the underlying device it tries
to call the NULL hook and crashes.
Clean up the macvlan_port on the correct device to fix this.
Signed-off-by; Patrick McHardy <kaber@trash.net> Tested-by: Ben Greear <greearb@candelatech.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: J.H.M. Dassen (Ray) <jdassen@debian.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Ilpo Järvinen [Thu, 8 May 2008 08:09:11 +0000 (01:09 -0700)]
tcp FRTO: SACK variant is errorneously used with NewReno
Note: there's actually another bug in FRTO's SACK variant, which
is the causing failure in NewReno case because of the error
that's fixed here. I'll fix the SACK case separately (it's
a separate bug really, though related, but in order to fix that
I need to audit tp->snd_nxt usage a bit).
There were two places where SACK variant of FRTO is getting
incorrectly used even if SACK wasn't negotiated by the TCP flow.
This leads to incorrect setting of frto_highmark with NewReno
if a previous recovery was interrupted by another RTO.
An eventual fallback to conventional recovery then incorrectly
considers one or couple of segments as forward transmissions
though they weren't, which then are not LOST marked during
fallback making them "non-retransmittable" until the next RTO.
In a bad case, those segments are really lost and are the only
one left in the window. Thus TCP needs another RTO to continue.
The next FRTO, however, could again repeat the same events
making the progress of the TCP flow extremely slow.
In order for these events to occur at all, FRTO must occur
again in FRTOs step 3 while the key segments must be lost as
well, which is not too likely in practice. It seems to most
frequently with some small devices such as network printers
that *seem* to accept TCP segments only in-order. In cases
were key segments weren't lost, things get automatically
resolved because those wrongly marked segments don't need to be
retransmitted in order to continue.
I found a reproducer after digging up relevant reports (few
reports in total, none at netdev or lkml I know of), some
cases seemed to indicate middlebox issues which seems now
to be a false assumption some people had made. Bugzilla
#10063 _might_ be related. Damon L. Chesser <damon@damtek.com>
had a reproducable case and was kind enough to tcpdump it
for me. With the tcpdump log it was quite trivial to figure
out.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
Adrian Bunk [Tue, 6 May 2008 07:04:47 +0000 (00:04 -0700)]
iwlwifi: make IWLWIFI a tristate
IWLWIFI should be a tristate so that if IWLCORE and/or IWL3945 are m
and none of them is y kbuild doesn't create an empty
drivers/net/wireless/built-in.o
This patch also removes the pointless "default n".
Signed-off-by: Adrian Bunk <bunk@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Chris Wright [Mon, 5 May 2008 20:50:24 +0000 (13:50 -0700)]
dccp: return -EINVAL on invalid feature length
dccp_feat_change() validates length and on error is returning 1.
This happens to work since call chain is checking for 0 == success,
but this is returned to userspace, so make it a real error value.
Signed-off-by: Chris Wright <chrisw@sous-sol.org> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
the driver did not anticipate the case of !CONFIG_PNP which is rare but
still possible. Instead of restricting the driver to PNP-only in the
Kconfig space, add the (trivial) dummy struct pnp_driver - this is that
other drivers use in the !PNP case too.
The driver itself can in theory be initialized on !PNP too in certain
cases, via smsc_ircc_legacy_probe().
Patch only minimally build tested, i dont have this hardware.
Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: David S. Miller <davem@davemloft.net>
Ingo Molnar [Mon, 5 May 2008 08:04:06 +0000 (01:04 -0700)]
irda: fix !PNP support in drivers/net/irda/nsc-ircc.c
x86.git testing found the following build failure in latest -git:
drivers/built-in.o: In function `nsc_ircc_pnp_probe':
nsc-ircc.c:(.text+0xdf1b6): undefined reference to `pnp_get_resource'
nsc-ircc.c:(.text+0xdf1d4): undefined reference to `pnp_get_resource'
nsc-ircc.c:(.text+0xdf1ee): undefined reference to `pnp_get_resource'
nsc-ircc.c:(.text+0xdf237): undefined reference to `pnp_get_resource'
nsc-ircc.c:(.text+0xdf24c): undefined reference to `pnp_get_resource'
drivers/built-in.o:nsc-ircc.c:(.text+0xdf266): more undefined references to `pnp_get_resource' follow
make: *** [.tmp_vmlinux1] Error 1
while generally most users will have PNP enabled, drivers can support
non-PNP build mode too - and most drivers implement it. That is typically
done by providing a dummy pnp_driver structure that will not probe anything.
The fallback routines in the driver will handle this dumber mode of
operation too.
This patch implements that. I have not tested whether this actually
works on real hardware so take care. It does resolve the build bug.
[ Another solution that is used by a few drivers is to exclude the driver
in the Kconfig if PNP is disabled, via "depends on PNP", but this would
limit the availability of the driver needlessly. ]
Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: David S. Miller <davem@davemloft.net>
Pavel Emelyanov [Mon, 5 May 2008 00:59:30 +0000 (17:59 -0700)]
mac80211: Do not free net device after it is unregistered.
The error path in ieee80211_register_hw() may call the unregister_netdev()
and right after it - the free_netdev(), which is wrong, since the
unregister releases the device itself.
So the proposed fix is to NULL the local->mdev after unregister is done
and check this before calling free_netdev().
I checked - no code uses the local->mdev after unregister in this error
path (but even if some did this would be a BUG).
Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Sun, 4 May 2008 08:34:31 +0000 (01:34 -0700)]
niu: Fix probing regression for maramba on-board chips.
Changeset 7f7c4072ea552f97a0898331322f71986a97299c ("niu: Determine
the # of ports from the card's VPD data") caused maramba on-board
NIU ports to stop probing properly.
The old code had a fallback that would use a num_ports value of
4 if all the probing methods failed, but that was removed.
This restores the fallback of 4 ports, to get things working
again.
Bump driver version and release date.
Signed-off-by: David S. Miller <davem@davemloft.net>
Jarek Poplawski [Sun, 4 May 2008 03:46:29 +0000 (20:46 -0700)]
sch_htb: remove from event queue in htb_parent_to_leaf()
There is lack of removing a class from the event queue while changing
from parent to leaf which can cause corruption of this rb tree. This
patch fixes a bug introduced by my patch: "sch_htb: turn intermediate
classes into leaves" commit: 160d5e10f87b1dc88fd9b84b31b1718e0fd76398.
Many thanks to Jan 'yanek' Bortl for finding a way to reproduce this
rare bug and narrowing the test case, which made possible proper
diagnosing.
This patch is recommended for all kernels starting from 2.6.20.
Reported-and-tested-by: Jan 'yanek' Bortl <yanek@ya.bofh.cz> Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Bernard Pidoux [Sat, 3 May 2008 00:03:22 +0000 (17:03 -0700)]
rose: Wrong list_lock argument in rose_node seqops
In rose_node_start() as well as in rose_node_stop() __acquires() and
spin_lock_bh() were wrongly passing rose_neigh_list_lock instead of
rose_node_list_lock arguments.
Signed-off-by: Bernard Pidoux <f6bvp@amsat.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Lezcano [Sat, 3 May 2008 00:00:58 +0000 (17:00 -0700)]
netns: Fix device renaming for sysfs
When a netdev is moved across namespaces with the
'dev_change_net_namespace' function, the 'device_rename' function is
used to fixup kobject and refresh the sysfs tree. The device_rename
function will call kobject_rename and this one will check if there is
an object with the same name and this is the case because we are
renaming the object with the same name.
The use of 'device_rename' seems for me wrong because we usually don't
rename it but just move it across namespaces. As we just want to do a
mini "netdev_[un]register", IMO the functions
'netdev_[un]register_kobject' should be used instead, like an usual
network device [un]registering.
This patch replace device_rename by netdev_unregister_kobject,
followed by netdev_register_kobject.
The netdev_register_kobject will call device_initialize and will raise
a warning indicating the device was already initialized. In order to
fix that, I split the device initialization into a separate function
and use it together with 'netdev_register_kobject' into
register_netdevice. So we can safely call 'netdev_register_kobject' in
'dev_change_net_namespace'.
This fix will allow to properly use the sysfs per namespace which is
coming from -mm tree.
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> Acked-by: Benjamin Thery <benjamin.thery@bull.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Michael Chan [Fri, 2 May 2008 23:57:59 +0000 (16:57 -0700)]
bnx2: Update RV2P firmware for 5709.
The new RV2P firmware fixes 2 issues:
1. The jumbo rx buffer page size is now configurable and set to the
proper PAGE_SIZE. Before, it was assumed to be always 4K.
2. Driver sometimes would crash when receiving jumbo packets mixed
with firmware management packets. This was caused by the old
firmware DMA'ing to the wrong address.
Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Michael Chan [Fri, 2 May 2008 23:57:26 +0000 (16:57 -0700)]
bnx2: Zero out context memory for 5709.
We should zero out the context memory for 5709 before each reset. When
we resume after suspend for example, the memory may not be zero and the
chip may not function correctly.
Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Benjamin Li <benli@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Michael Chan [Fri, 2 May 2008 23:56:44 +0000 (16:56 -0700)]
bnx2: Fix remote PHY initial link state.
On some remote PHY blade systems, the driver receives no initial link
interrupt. As a result, the GMII/MII MAC mode does not get setup properly.
To fix this problem, we add an initial poll of the link state after chip
reset.
With this change, the setting of the initial carrier state in the init
code can be eliminated.
Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Benjamin Li <benli@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Michael Chan [Fri, 2 May 2008 23:56:16 +0000 (16:56 -0700)]
bnx2: Refine remote PHY locking.
bnx2_set_remote_link() should be called under bp->phy_lock to protect
against concurrent polling and interrupt calls. This change is needed
by the next patch which will add one initial poll of the remote PHY
link status.
Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Benjamin Li <benli@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
bridge: forwarding table information for >256 devices
The forwarding table binary interface (my bad choice), only exposes
the port number of the first 8 bits. The bridge code was limited to
256 ports at the time, but now the kernel supports up 1024 ports, so
the upper bits are lost when doing:
brctl showmacs
The fix is to squeeze the extra bits into small hole left in data
structure, to maintain binary compatiablity.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Matt Carlson [Fri, 2 May 2008 23:49:50 +0000 (16:49 -0700)]
tg3: Update version to 3.92
This patch updates the version number to 3.92.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Matt Carlson [Fri, 2 May 2008 23:49:29 +0000 (16:49 -0700)]
tg3: Add link state reporting to UMP firmware
All variants of the 5714, 5715, and 5780 offer a feature called the
"Universal Management Port". This feature is implemented in firmware
and is largely transparent to the driver, except...
It turns out that the UMP firmware needs to know the current status
of the link. Because the firmware cannot touch the PHY registers while
the driver is in control of the device, it needs the driver to report
link status changes through an additional handshaking mechanism.
Without this handshake, it has been observed in the field that the UMP
firmware will not operate correctly.
This patch implements the new handshake with the UMP firmware. Since
the handshake uses the same mechanism ASF heartbeats use, code was
added to detect and wait for completion of a pending previous event.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Matt Carlson [Fri, 2 May 2008 23:48:59 +0000 (16:48 -0700)]
tg3: Fix ethtool loopback test for 5761 BX devices
A CPMU related loopback test bug existed for AX revisions of the 5761.
While that errata has been fixed, the CPMU still slows down the core
clock too far to run the loopback test successfully. This patch
disables the CPMU LINK_SPEED mode just like we do with the AX
revisions of the 5761 and all revisions of the 5784.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Matt Carlson [Fri, 2 May 2008 23:48:36 +0000 (16:48 -0700)]
tg3: Fix 5761 NVRAM sizes
The 5761 NVRAM sizes assigned to the nvram_size member are half as big
as they should be. This patch corrects the NVRAM sizes and replaces
the hardcoded constants with preprocessor constants for readability.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Matt Carlson [Fri, 2 May 2008 23:47:53 +0000 (16:47 -0700)]
tg3: Use constant 500KHz MI clock on adapters with a CPMU
The MI clock is not configured correctly on adapters with the CPMU
present. The tg3 driver has code which statically sets the MI clock to
be a fraction of the speed at which the core clock is running.
However, the CPMU can change the adapter's core clock frequency based
on operating conditions. Consequently, the MI will run slow when the
core's clock has been slowed down.
There is a new 500KHz constant frequency clock available on adapters
with a CPMU. This patch removes the static core clock scaling and
configures the MI clock to use this new 500KHz clock instead.
Running the MI clock at slower speeds will not directly result in data
corruption, but it does challenge the PHY read and write routine timeouts.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Pavel Machek [Fri, 2 May 2008 23:45:10 +0000 (16:45 -0700)]
hci_usb.h: fix hard-to-trigger race
If someone tries to _urb_unlink while _urb_queue_head is running, he'll see
_urb->queue == NULL and fail to do any locking. Prevent that from happening
by strategically placed barriers.
Signed-off-by: Pavel Machek <pavel@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Harvey Harrison [Fri, 2 May 2008 23:44:07 +0000 (16:44 -0700)]
dccp: ccid2.c, ccid3.c use clamp(), clamp_t()
Makes the intention of the nested min/max clear.
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Mike Travis [Fri, 2 May 2008 23:43:08 +0000 (16:43 -0700)]
net: remove NR_CPUS arrays in net/core/dev.c
Remove the fixed size channels[NR_CPUS] array in net/core/dev.c and
dynamically allocate array based on nr_cpu_ids.
Signed-off-by: Mike Travis <travis@sgi.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Harvey Harrison [Fri, 2 May 2008 23:25:46 +0000 (16:25 -0700)]
bluetooth: use get/put_unaligned_* helpers
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: David S. Miller <davem@davemloft.net>
net: Add a WARN_ON_ONCE() to the transmit timeout function
WARN_ON_ONCE() gives a stack trace including the full module list.
Having this in the kernel dump for the timeout case in the
generic netdev watchdog will help us see quicker which driver
is involved. It also allows us to collect statistics
and patterns in terms of which drivers have this event occuring.
Suggested by Andrew Morton
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Ilpo Järvinen [Fri, 2 May 2008 23:20:10 +0000 (16:20 -0700)]
net: Add missing braces to multi-statement if()s
One finds all kinds of crazy things with some shell pipelining.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Acked-by: David Howells <dhowells@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Denis V. Lunev [Fri, 2 May 2008 11:12:41 +0000 (04:12 -0700)]
netns: assign PDE->data before gluing entry into /proc tree
In this unfortunate case, proc_mkdir_mode wrapper can't be used anymore and
this is no way to reuse proc_create_data due to nlinks assignment. So,
copy the code from proc_mkdir and assign PDE->data at the appropriate
moment.
Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Denis V. Lunev [Fri, 2 May 2008 09:46:22 +0000 (02:46 -0700)]
net: assign PDE->data before gluing PDE into /proc tree
Simply replace proc_create and further data assigned with proc_create_data.
Additionally, there is no need to assign NULL to PDE->data after creation,
/proc generic has already done this for us.
Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Ivo van Doorn [Mon, 21 Apr 2008 17:01:09 +0000 (19:01 +0200)]
rt2x00: Fix quality/activity led handling
There was an obvious typo in LED structure
initialization which caused the radio and quality/activity
leds to be incorrectly initialized which resulted in
the leds not being enabled.
Additionally add the rt2x00led_led_activity() handler
that will enable TX/RX activity leds when the radio
is being enabled.
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Bill Moss [Thu, 17 Apr 2008 23:03:40 +0000 (16:03 -0700)]
iwlwifi: fix debug messages during scanning
direct_mask will be set when we are not associated and requesting a
direct scan. The second debug print will be confusing as priv->essid
is not set at that time and it will thus print "<hidden>" while it is
known to which AP a direct scan is requested - as previous debug message
also indicates.
Now make all debugging consistent.
Signed-off-by: Bill Moss <bmoss@clemson.edu> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Guy Cohen [Mon, 21 Apr 2008 22:41:57 +0000 (15:41 -0700)]
iwlwifi: fix current channel is not scanned
All channels should be scanned, including the current channel
when the client is associated.
Removed also unused flag to scan only active channels.
Signed-off-by: Guy Cohen <guy.cohen@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Al Viro [Thu, 1 May 2008 02:52:22 +0000 (03:52 +0100)]
Fix dnotify/close race
We have a race between fcntl() and close() that can lead to
dnotify_struct inserted into inode's list *after* the last descriptor
had been gone from current->files.
Since that's the only point where dnotify_struct gets evicted, we are
screwed - it will stick around indefinitely. Even after struct file in
question is gone and freed. Worse, we can trigger send_sigio() on it at
any later point, which allows to send an arbitrary signal to arbitrary
process if we manage to apply enough memory pressure to get the page
that used to host that struct file and fill it with the right pattern...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Thu, 1 May 2008 02:50:03 +0000 (19:50 -0700)]
x86: Mark OPTIMIZE_INLINING broken
So Ingo finally did figure out why UML broke with this option: UML
passes gcc the -fno-unit-at-a-time flag, and apparently that wreaks
havoc with gcc's inlining.
We could turn off -fno-unit-at-a-time for UML for gcc4+ (which is what
x86 does), but there's bad blood about this whole option, and it does
show that the thing is just fragile as heck.
So let tempers cool, and disable the thing, and we can revisit the
decision later.
Cc: Adrian Bunk <bunk@kernel.org> Cc: David Miller <davem@davemloft.net> Acked-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Thu, 1 May 2008 02:31:52 +0000 (19:31 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86-fixes3
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86-fixes3: (21 commits)
x86: numaq fix
x86: 8K stacks by default
x86: ioremap ram check fix
x86: fix HT cpu booting on 32-bit
x86: optimize inlining off
x86: CONFIG_X86_ELAN fix
x86: Kconfig fix
x86 PAT: fix performance drop for glx, use UC minus for ioremap(), ioremap_nocache() and pci_mmap_page_range()
x86: use defconfigs from x86/configs/*
toshiba: use ioremap_cached
revert: "x86: ioremap(), extend check to all RAM pages"
x86: don't bother printing compat vdso address
fix: x86: support for new UV apic
x86: fix early-BUG message
x86: iommu_sac_force can become static
x86: add proper header for reboot_force
x86 VISWS: build fix
x86, voyager: fix ioremap_nocache()
hpet: fix
x86: unexport kmap_atomic_to_page
...
Noticed by sparse:
net/mac80211/tkip.c:234:25: warning: right shift by bigger than source value
net/mac80211/tkip.c:235:25: warning: right shift by bigger than source value
net/mac80211/tkip.c:236:25: warning: right shift by bigger than source value
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Johannes Berg [Thu, 24 Apr 2008 12:18:37 +0000 (14:18 +0200)]
mac80211: insert WDS peer after adding interface
This reorders the open code so that WDS peer STA info entries
are added after the corresponding interface is added to the
driver so that driver callbacks aren't invoked out of order.
Also make any master device startup fatal.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-2.6:
klist: fix coding style errors in klist.h and klist.c
driver core: remove no longer used "struct class_device"
pcmcia: remove pccard_sysfs_interface warnings
devres: support addresses greater than an unsigned long via dev_ioremap
kobject: do not copy vargs, just pass them around
sysfs: sysfs_update_group stub for CONFIG_SYSFS=n
DEBUGFS: Correct location of debugfs API documentation.
driver core: warn about duplicate driver names on the same bus
klist: implement klist_add_{after|before}()
klist: implement KLIST_INIT() and DEFINE_KLIST()
sysfs: Disallow truncation of files in sysfs
David Brownell [Mon, 28 Apr 2008 08:03:20 +0000 (01:03 -0700)]
pcmcia: remove pccard_sysfs_interface warnings
Make the PCMCIA core stop using class_interface to hide socket attribute
registration. This removes the associated section mismatch warnings, and
helps get to the point where that mechanism can finally be removed.
Simplify that attribute registration by using an attribute_group.
This is a net shrink in object size.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Kumar Gala [Tue, 29 Apr 2008 15:25:48 +0000 (10:25 -0500)]
devres: support addresses greater than an unsigned long via dev_ioremap
Use a resource_size_t instead of unsigned long since some arch's are
capable of having ioremap deal with addresses greater than the size of a
unsigned long.
Signed-off-by: Kumar Gala <galak@kernel.crashing.org> Cc: Tejun Heo <htejun@gmail.com> Cc: Jeff Garzik <jgarzik@pobox.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
driver core: warn about duplicate driver names on the same bus
Currently an attempt to register multiple
drivers with the same name causes the
stack trace with some cryptic error message.
The attached patch adds the necessary check
and the clear error message.
Add klist_add_after() and klist_add_before() which puts a new node
after and before an existing node, respectively. This is useful for
callers which need to keep klist ordered. Note that synchronizing
between simultaneous additions for ordering is the caller's
responsibility.
Ben Hutchings [Mon, 28 Apr 2008 14:59:58 +0000 (15:59 +0100)]
sysfs: Disallow truncation of files in sysfs
sysfs allows attribute files to be truncated, e.g. using ftruncate(), with the
expected effect on their inode. For most attributes, this doesn't change the
"real" size of the file i.e. how much can be read from it. However, the
parameter validation for reading and writing binary attribute files is based
on the inode size and not the size specified in the file's bin_attribute, so it
can be broken by this. For example, if we try using dd to write to such a file:
# pwd
/sys/bus/pci/devices/0000:08:00.0
# ls -l config
-rw-r--r-- 1 root root 4096 Feb 1 17:35 config
# dd if=/dev/zero of=config bs=4 count=1
1+0 records in
1+0 records out
# ls -l config
-rw-r--r-- 1 root root 0 Feb 1 17:50 config
# dd if=/dev/zero of=config bs=4 count=1 seek=128
dd: writing `config': No space left on device
1+0 records in
0+0 records out
Also, after truncation to 0, parameter validation for read and write is
disabled. Most bin_attribute read and write methods also validate the size and
offset, but for some this will allow out-of-range access. This may be a
security issue, though access to such files is often limited to root. In any
case, the validation should remain for safety's sake!)
This was previously reported in Bugzilla as bug 9867.
sysfs should ignore size changes or else refuse them (by returning -EINVAL).
This patch makes it ignore them.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Pavel Emelyanov [Wed, 30 Apr 2008 21:49:54 +0000 (14:49 -0700)]
ipv6: Compilation fix for compat MCAST_MSFILTER sockopts.
The last hunk from the commit dae50295 (ipv4/ipv6 compat: Fix SSM
applications on 64bit kernels.) escaped from the compat_ipv6_setsockopt
to the ipv6_getsockopt (I guess due to patch smartness wrt searching
for context) thus breaking 32-bit and 64-bit-without-compat compilation.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: David L Stevens <dlstevens@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Previously, the 'pfn < max_pfn_mapped' check would've caused us to not
enter the loop. Removing that check means we loop infinitely. The
reason for that is because pfn is 0xfffff, and last_addr is 0xffffffcf.
The remaining check that is used to exit the loop is not sufficient;
when pfn<<PAGE_SHIFT is 0xfffff000, that is less than 0xffffffcf; when
we increment pfn and it overflows (pfn == 0x100000), pfn<<PAGE_SHIFT
ends up being 0. That, of course, is less than last_addr. In effect,
pfn<<PAGE_SHIFT is never lower than last_addr.
The simple fix for this is to limit the last_addr check to the PAGE_MASK;
a patch is below.
Signed-off-by: Andres Salomon <dilinger@debian.org> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Since recent smpboot 32/64-bit merge, my dual Xeon with HT has been
booting only 2 of its 4 cpus (when running an i386 kernel; but x86_64
is okay). J.A. Magallón reports the same.
native_cpu_up: bad cpu 2
native_cpu_up: bad cpu 3
The mach-default cpu_present_to_apicid() was just returning cpu number
(2, 3) instead of apicid (6, 7): looks like we now need the x86_64 code
even for the i386 case.
Comparing with other versions of cpu_present_to_apicid(), it seems a
good idea to include an NR_CPUS test too, since cpu_present() doesn't
include that; but that wasn't a problem here, and may no problem at all.
Prior to that smpboot merge, my Xeon booted the two HT siblings on one
physical first, then the two siblings on the other physical after - when
i386, but alternated them when x86_64. Since the merge, the x86_64
sequence is unchanged, but the i386 sequence is now like x86_64.
I prefer this consistency, and I prefer the new sequence: booting with
maxcpus=2 then uses the independent physicals without HT sharing.
projects / linux-2.6-omap-h63xx.git / log