Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
tag: v2.6.34-rc2-gi…
Commits on Mar 22, 2010
  1. Linus Torvalds

    Fix up prototype for sys_ipc breakage

    torvalds authored
    Commit 45575f5 ("ppc64 sys_ipc breakage in 2.6.34-rc2") fixed the
    definition of the sys_ipc() helper, but didn't fix the prototype in
    <linux/syscalls.h>
    
    Reported-and-tested-by: Andreas Schwab <schwab@linux-m68k.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  2. Linus Torvalds

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel…

    torvalds authored
    …/git/mst/vhost
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
      virtio: console: Check if port is valid in resize_console
      virtio: console: Generate a kobject CHANGE event on adding 'name' attribute
  3. Linus Torvalds

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

    torvalds authored
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (38 commits)
      ip_gre: include route header_len in max_headroom calculation
      if_tunnel.h: add missing ams/byteorder.h include
      ipv4: Don't drop redirected route cache entry unless PTMU actually expired
      net: suppress lockdep-RCU false positive in FIB trie.
      Bluetooth: Fix kernel crash on L2CAP stress tests
      Bluetooth: Convert debug files to actually use debugfs instead of sysfs
      Bluetooth: Fix potential bad memory access with sysfs files
      netfilter: ctnetlink: fix reliable event delivery if message building fails
      netlink: fix NETLINK_RECV_NO_ENOBUFS in netlink_set_err()
      NET_DMA: free skbs periodically
      netlink: fix unaligned access in nla_get_be64()
      tcp: Fix tcp_mark_head_lost() with packets == 0
      net: ipmr/ip6mr: fix potential out-of-bounds vif_table access
      KS8695: update ksp->next_rx_desc_read at the end of rx loop
      igb: Add support for 82576 ET2 Quad Port Server Adapter
      ixgbevf: Message formatting cleanups
      ixgbevf: Shorten up delay timer for watchdog task
      ixgbevf: Fix VF Stats accounting after reset
      ixgbe: Set IXGBE_RSC_CB(skb)->DMA field to zero after unmapping the address
      ixgbe: fix for real_num_tx_queues update issue
      ...
  4. Linus Torvalds

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel…

    torvalds authored
    …/git/bp/bp
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
      edac, mce: Filter out invalid values
  5. Linus Torvalds

    rxrpc: Check allocation failure.

    Tetsuo Handa authored torvalds committed
    alloc_skb() can return NULL.
    
    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  6. Dan Carpenter Linus Torvalds

    AFS: Potential null dereference

    error27 authored torvalds committed
    It seems clear from the surrounding code that xpermits is allowed to be
    NULL here.
    
    Signed-off-by: Dan Carpenter <error27@gmail.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  7. Anton Blanchard Linus Torvalds

    ppc64 sys_ipc breakage in 2.6.34-rc2

    antonblanchard authored torvalds committed
    I chased down a fail on ppc64 on 2.6.34-rc2 where an application that
    uses shared memory was getting a SEGV.
    
    Commit baed7fc ("Add generic sys_ipc
    wrapper") changed the second argument from an unsigned long to an int.
    When we call shmget the system call wrappers for sys_ipc will sign
    extend second (ie the size) which truncates it.  It took a while to
    track down because the call succeeds and strace shows the untruncated
    size :)
    
    The patch below changes second from an int to an unsigned long which
    fixes shmget on ppc64 (and I assume s390, sparc64 and mips64).
    
    Signed-off-by: Anton Blanchard <anton@samba.org>
    --
    
    I assume the function prototypes for the other IPC methods would cause us
    to sign or zero extend second where appropriate (avoiding any security
    issues). Come to think of it, the syscall wrappers for each method should do
    that for us as well.
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  8. Rafael J. Wysocki Linus Torvalds

    x86 / perf: Fix suspend to RAM on HP nx6325

    rjwysocki authored torvalds committed
    Commit 3f6da39
    (perf: Rework and fix the arch CPU-hotplug hooks) broke suspend to
    RAM on my HP nx6325 (and most likely on other AMD-based boxes too)
    by allowing amd_pmu_cpu_offline() to be executed for CPUs that are
    going offline as part of the suspend process.  The problem is that
    cpuhw->amd_nb may be NULL already, so the function should make sure
    it's not NULL before accessing the object pointed to by it.
    
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  9. edac, mce: Filter out invalid values

    Borislav Petkov authored
    Print the CPU associated with the error only when the field is valid.
    
    Cc: <stable@kernel.org> # .32.x .33.x
    Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
  10. mstsirkin

    virtio: console: Check if port is valid in resize_console

    Amit Shah authored mstsirkin committed
    The console port could have been hot-unplugged. Check if it is valid
    before working on it.
    
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
  11. mstsirkin

    virtio: console: Generate a kobject CHANGE event on adding 'name' att…

    Amit Shah authored mstsirkin committed
    …ribute
    
    When the host lets us know what 'name' a port is assigned, we create the
    sysfs 'name' attribute. Generate a 'change' event after this so that
    udev wakes up and acts on the rules for virtio-ports (currently there's
    only one rule that creates a symlink from the 'name' to the actual char
    device).
    
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
  12. Timo Teräs davem330

    ip_gre: include route header_len in max_headroom calculation

    fabled authored davem330 committed
    Taking route's header_len into account, and updating gre device
    needed_headroom will give better hints on upper bound of required
    headroom. This is useful if the gre traffic is xfrm'ed.
    
    Signed-off-by: Timo Teras <timo.teras@iki.fi>
    Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  13. Paulius Zaleckas davem330

    if_tunnel.h: add missing ams/byteorder.h include

    pauliuszaleckas authored davem330 committed
    When compiling userspace application which includes
    if_tunnel.h and uses GRE_* defines you will get undefined
    reference to __cpu_to_be16.
    
    Fix this by adding missing #include <asm/byteorder.h>
    
    Cc: stable@kernel.org
    Signed-off-by: Paulius Zaleckas <paulius.zaleckas@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  14. davem330

    ipv4: Don't drop redirected route cache entry unless PTMU actually ex…

    Guenter Roeck authored davem330 committed
    …pired
    
    TCP sessions over IPv4 can get stuck if routers between endpoints
    do not fragment packets but implement PMTU instead, and we are using
    those routers because of an ICMP redirect.
    
    Setup is as follows
    
           MTU1    MTU2   MTU1
        A--------B------C------D
    
    with MTU1 > MTU2. A and D are endpoints, B and C are routers. B and C
    implement PMTU and drop packets larger than MTU2 (for example because
    DF is set on all packets). TCP sessions are initiated between A and D.
    There is packet loss between A and D, causing frequent TCP
    retransmits.
    
    After the number of retransmits on a TCP session reaches tcp_retries1,
    tcp calls dst_negative_advice() prior to each retransmit. This results
    in route cache entries for the peer to be deleted in
    ipv4_negative_advice() if the Path MTU is set.
    
    If the outstanding data on an affected TCP session is larger than
    MTU2, packets sent from the endpoints will be dropped by B or C, and
    ICMP NEEDFRAG will be returned. A and D receive NEEDFRAG messages and
    update PMTU.
    
    Before the next retransmit, tcp will again call dst_negative_advice(),
    causing the route cache entry (with correct PMTU) to be deleted. The
    retransmitted packet will be larger than MTU2, causing it to be
    dropped again.
    
    This sequence repeats until the TCP session aborts or is terminated.
    
    Problem is fixed by removing redirected route cache entries in
    ipv4_negative_advice() only if the PMTU is expired.
    
    Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  15. davem330
  16. Paul E. McKenney davem330

    net: suppress lockdep-RCU false positive in FIB trie.

    paulmck authored davem330 committed
    Allow fib_find_node() to be called either under rcu_read_lock()
    protection or with RTNL held.
    
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
Commits on Mar 21, 2010
  1. Marcel Holtmann

    Bluetooth: Fix kernel crash on L2CAP stress tests

    Andrei Emeltchenko authored holtmann committed
    Added very simple check that req buffer has enough space to
    fit configuration parameters. Shall be enough to reject packets
    with configuration size more than req buffer.
    
    Crash trace below
    
    [ 6069.659393] Unable to handle kernel paging request at virtual address 02000205
    [ 6069.673034] Internal error: Oops: 805 [#1] PREEMPT
    ...
    [ 6069.727172] PC is at l2cap_add_conf_opt+0x70/0xf0 [l2cap]
    [ 6069.732604] LR is at l2cap_recv_frame+0x1350/0x2e78 [l2cap]
    ...
    [ 6070.030303] Backtrace:
    [ 6070.032806] [<bf1c2880>] (l2cap_add_conf_opt+0x0/0xf0 [l2cap]) from
    [<bf1c6624>] (l2cap_recv_frame+0x1350/0x2e78 [l2cap])
    [ 6070.043823]  r8:dc5d3100 r7:df2a91d6 r6:00000001 r5:df2a8000 r4:00000200
    [ 6070.050659] [<bf1c52d4>] (l2cap_recv_frame+0x0/0x2e78 [l2cap]) from
    [<bf1c8408>] (l2cap_recv_acldata+0x2bc/0x350 [l2cap])
    [ 6070.061798] [<bf1c814c>] (l2cap_recv_acldata+0x0/0x350 [l2cap]) from
    [<bf0037a4>] (hci_rx_task+0x244/0x478 [bluetooth])
    [ 6070.072631]  r6:dc647700 r5:00000001 r4:df2ab740
    [ 6070.077362] [<bf003560>] (hci_rx_task+0x0/0x478 [bluetooth]) from
    [<c006b9fc>] (tasklet_action+0x78/0xd8)
    [ 6070.087005] [<c006b984>] (tasklet_action+0x0/0xd8) from [<c006c160>]
    
    Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
    Acked-by: Gustavo F. Padovan <gustavo@padovan.org>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
  2. Marcel Holtmann

    Bluetooth: Convert debug files to actually use debugfs instead of sysfs

    holtmann authored
    Some of the debug files ended up wrongly in sysfs, because at that point
    of time, debugfs didn't exist. Convert these files to use debugfs and
    also seq_file. This patch converts all of these files at once and then
    removes the exported symbol for the Bluetooth sysfs class.
    
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
  3. Marcel Holtmann

    Bluetooth: Fix potential bad memory access with sysfs files

    holtmann authored
    When creating a high number of Bluetooth sockets (L2CAP, SCO
    and RFCOMM) it is possible to scribble repeatedly on arbitrary
    pages of memory. Ensure that the content of these sysfs files is
    always less than one page. Even if this means truncating. The
    files in question are scheduled to be moved over to debugfs in
    the future anyway.
    
    Based on initial patches from Neil Brown and Linus Torvalds
    
    Reported-by: Neil Brown <neilb@suse.de>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Commits on Mar 20, 2010
  1. davem330
  2. davem330

    netfilter: ctnetlink: fix reliable event delivery if message building…

    Pablo Neira Ayuso authored davem330 committed
    … fails
    
    This patch fixes a bug that allows to lose events when reliable
    event delivery mode is used, ie. if NETLINK_BROADCAST_SEND_ERROR
    and NETLINK_RECV_NO_ENOBUFS socket options are set.
    
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  3. davem330

    netlink: fix NETLINK_RECV_NO_ENOBUFS in netlink_set_err()

    Pablo Neira Ayuso authored davem330 committed
    Currently, ENOBUFS errors are reported to the socket via
    netlink_set_err() even if NETLINK_RECV_NO_ENOBUFS is set. However,
    that should not happen. This fixes this problem and it changes the
    prototype of netlink_set_err() to return the number of sockets that
    have set the NETLINK_RECV_NO_ENOBUFS socket option. This return
    value is used in the next patch in these bugfix series.
    
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  4. smagnani davem330

    NET_DMA: free skbs periodically

    smagnani authored davem330 committed
    Under NET_DMA, data transfer can grind to a halt when userland issues a
    large read on a socket with a high RCVLOWAT (i.e., 512 KB for both).
    This appears to be because the NET_DMA design queues up lots of memcpy
    operations, but doesn't issue or wait for them (and thus free the
    associated skbs) until it is time for tcp_recvmesg() to return.
    The socket hangs when its TCP window goes to zero before enough data is
    available to satisfy the read.
    
    Periodically issue asynchronous memcpy operations, and free skbs for ones
    that have completed, to prevent sockets from going into zero-window mode.
    
    Signed-off-by: Steven J. Magnani <steve@digidescorp.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  5. davem330

    netlink: fix unaligned access in nla_get_be64()

    Pablo Neira Ayuso authored davem330 committed
    This patch fixes a unaligned access in nla_get_be64() that was
    introduced by myself in a17c859.
    
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  6. davem330

    tcp: Fix tcp_mark_head_lost() with packets == 0

    Lennart Schulte authored davem330 committed
    A packet is marked as lost in case packets == 0, although nothing should be done.
    This results in a too early retransmitted packet during recovery in some cases.
    This small patch fixes this issue by returning immediately.
    
    Signed-off-by: Lennart Schulte <lennart.schulte@nets.rwth-aachen.de>
    Signed-off-by: Arnd Hannemann <hannemann@nets.rwth-aachen.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  7. Patrick McHardy davem330

    net: ipmr/ip6mr: fix potential out-of-bounds vif_table access

    kaber authored davem330 committed
    mfc_parent of cache entries is used to index into the vif_table and is
    initialised from mfcctl->mfcc_parent. This can take values of to 2^16-1,
    while the vif_table has only MAXVIFS (32) entries. The same problem
    affects ip6mr.
    
    Refuse invalid values to fix a potential out-of-bounds access. Unlike
    the other validity checks, this is checked in ipmr_mfc_add() instead of
    the setsockopt handler since its unused in the delete path and might be
    uninitialized.
    
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  8. Yegor Yefremov davem330

    KS8695: update ksp->next_rx_desc_read at the end of rx loop

    yegorich authored davem330 committed
    There is no need to adjust the next rx descriptor after each packet,
    so do it only once at the end of the routine.
    
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
  9. davem330

    igb: Add support for 82576 ET2 Quad Port Server Adapter

    Carolyn Wyborny authored davem330 committed
    Signed-off-by: Carolyn Wyborny <carolyn.wyborny@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  10. davem330

    ixgbevf: Message formatting cleanups

    Greg Rose authored davem330 committed
    Clean up some text output formatting.
    
    Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  11. davem330

    ixgbevf: Shorten up delay timer for watchdog task

    Greg Rose authored davem330 committed
    The recovery from PF reset works better when you shorten up the delay
    until the watchdog task executes.
    
    Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  12. davem330

    ixgbevf: Fix VF Stats accounting after reset

    Greg Rose authored davem330 committed
    The counters in the 82599 Virtual Function are not clear on read.  They
    accumulate to the maximum value and then roll over.  They are also not
    cleared when the VF executes a soft reset, so it is possible they are
    non-zero when the driver loads and starts.  This has all been accounted
    for in the code that keeps the stats up to date but there is one case
    that is not.  When the PF driver is reset the counters in the VF are
    all reset to zero.  This adds an additional accounting overhead into
    the VF driver when the PF is reset under its feet.  This patch adds
    additional counters that are used by the VF driver to accumulate and
    save stats after a PF reset has been detected.  Prior to this patch
    displaying the stats in the VF after the PF has reset would show
    bogus data.
    
    Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  13. davem330

    ixgbe: Set IXGBE_RSC_CB(skb)->DMA field to zero after unmapping the a…

    Mallikarjuna R Chilakala authored davem330 committed
    …ddress
    
    As per Simon Horman's feedback set IXGBE_RSC_CB(skb)->dma to zero
    after unmapping HWRSC DMA address to avoid double freeing.
    
    Signed-off-by:  Mallikarjuna R Chilakala <mallikarjuna.chilakala@intel.com>
    Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  14. davem330

    ixgbe: fix for real_num_tx_queues update issue

    Vasu Dev authored davem330 committed
    Currently netdev_features_change is called before fcoe tx queues
    setup is done, so this patch moves calling of netdev_features_change
    after tx queues setup is done in ixgbe_init_interrupt_scheme, so
    that real_num_tx_queues is updated correctly on each fcoe enable
    or disable.
    
    This allows additional fcoe queues updated correctly in vlan driver
    for their correct queue selection.
    
    Signed-off-by: Vasu Dev <vasu.dev@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  15. davem330

    TCP: check min TTL on received ICMP packets

    stephen hemminger authored davem330 committed
    This adds RFC5082 checks for TTL on received ICMP packets.
    It adds some security against spoofed ICMP packets
    disrupting GTSM protected sessions.
    
    Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  16. Herbert Xu davem330

    ipv6: Remove redundant dst NULL check in ip6_dst_check

    herbertx authored davem330 committed
    As the only path leading to ip6_dst_check makes an indirect call
    through dst->ops, dst cannot be NULL in ip6_dst_check.
    
    This patch removes this check in case it misleads people who
    come across this code.
    
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
Something went wrong with that request. Please try again.