aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2012-12-02 19:39:00 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2012-12-02 19:39:00 -0500
commit7e5530af11be68f3109672aed59243f82e1272f0 (patch)
tree743e83fcc3a4ebdc3f5a3df394f6a227086cb617 /drivers
parent4ccc804586c9ad1622687a24223c6ad2955759cc (diff)
parent892a925e42adb8192a3c832ad29cbc780fc466f6 (diff)
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) 8139cp leaks memory in error paths, from Francois Romieu. 2) do_tcp_sendpages() cannot handle order > 0 pages, but they can certainly arrive there now, fix from Eric Dumazet. 3) Race condition and sysfs fixes in bonding from Nikolay Aleksandrov. 4) Remain-on-Channel fix in mac80211 from Felix Liao. 5) CCK rate calculation fix in iwlwifi, from Emmanuel Grumbach. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: 8139cp: fix coherent mapping leak in error path. tcp: fix crashes in do_tcp_sendpages() bonding: fix race condition in bonding_store_slaves_active bonding: make arp_ip_target parameter checks consistent with sysfs bonding: fix miimon and arp_interval delayed work race conditions mac80211: fix remain-on-channel (non-)cancelling iwlwifi: fix the basic CCK rates calculation
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/bonding/bond_main.c93
-rw-r--r--drivers/net/bonding/bond_sysfs.c36
-rw-r--r--drivers/net/ethernet/realtek/8139cp.c11
-rw-r--r--drivers/net/wireless/iwlwifi/dvm/rxon.c12
4 files changed, 55 insertions, 97 deletions
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 5f5b69f37d2e..a7d47350ea4b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3459,6 +3459,28 @@ static int bond_xmit_hash_policy_l34(struct sk_buff *skb, int count)
3459 3459
3460/*-------------------------- Device entry points ----------------------------*/ 3460/*-------------------------- Device entry points ----------------------------*/
3461 3461
3462static void bond_work_init_all(struct bonding *bond)
3463{
3464 INIT_DELAYED_WORK(&bond->mcast_work,
3465 bond_resend_igmp_join_requests_delayed);
3466 INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
3467 INIT_DELAYED_WORK(&bond->mii_work, bond_mii_monitor);
3468 if (bond->params.mode == BOND_MODE_ACTIVEBACKUP)
3469 INIT_DELAYED_WORK(&bond->arp_work, bond_activebackup_arp_mon);
3470 else
3471 INIT_DELAYED_WORK(&bond->arp_work, bond_loadbalance_arp_mon);
3472 INIT_DELAYED_WORK(&bond->ad_work, bond_3ad_state_machine_handler);
3473}
3474
3475static void bond_work_cancel_all(struct bonding *bond)
3476{
3477 cancel_delayed_work_sync(&bond->mii_work);
3478 cancel_delayed_work_sync(&bond->arp_work);
3479 cancel_delayed_work_sync(&bond->alb_work);
3480 cancel_delayed_work_sync(&bond->ad_work);
3481 cancel_delayed_work_sync(&bond->mcast_work);
3482}
3483
3462static int bond_open(struct net_device *bond_dev) 3484static int bond_open(struct net_device *bond_dev)
3463{ 3485{
3464 struct bonding *bond = netdev_priv(bond_dev); 3486 struct bonding *bond = netdev_priv(bond_dev);
@@ -3481,41 +3503,27 @@ static int bond_open(struct net_device *bond_dev)
3481 } 3503 }
3482 read_unlock(&bond->lock); 3504 read_unlock(&bond->lock);
3483 3505
3484 INIT_DELAYED_WORK(&bond->mcast_work, bond_resend_igmp_join_requests_delayed); 3506 bond_work_init_all(bond);
3485 3507
3486 if (bond_is_lb(bond)) { 3508 if (bond_is_lb(bond)) {
3487 /* bond_alb_initialize must be called before the timer 3509 /* bond_alb_initialize must be called before the timer
3488 * is started. 3510 * is started.
3489 */ 3511 */
3490 if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB))) { 3512 if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB)))
3491 /* something went wrong - fail the open operation */
3492 return -ENOMEM; 3513 return -ENOMEM;
3493 }
3494
3495 INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
3496 queue_delayed_work(bond->wq, &bond->alb_work, 0); 3514 queue_delayed_work(bond->wq, &bond->alb_work, 0);
3497 } 3515 }
3498 3516
3499 if (bond->params.miimon) { /* link check interval, in milliseconds. */ 3517 if (bond->params.miimon) /* link check interval, in milliseconds. */
3500 INIT_DELAYED_WORK(&bond->mii_work, bond_mii_monitor);
3501 queue_delayed_work(bond->wq, &bond->mii_work, 0); 3518 queue_delayed_work(bond->wq, &bond->mii_work, 0);
3502 }
3503 3519
3504 if (bond->params.arp_interval) { /* arp interval, in milliseconds. */ 3520 if (bond->params.arp_interval) { /* arp interval, in milliseconds. */
3505 if (bond->params.mode == BOND_MODE_ACTIVEBACKUP)
3506 INIT_DELAYED_WORK(&bond->arp_work,
3507 bond_activebackup_arp_mon);
3508 else
3509 INIT_DELAYED_WORK(&bond->arp_work,
3510 bond_loadbalance_arp_mon);
3511
3512 queue_delayed_work(bond->wq, &bond->arp_work, 0); 3521 queue_delayed_work(bond->wq, &bond->arp_work, 0);
3513 if (bond->params.arp_validate) 3522 if (bond->params.arp_validate)
3514 bond->recv_probe = bond_arp_rcv; 3523 bond->recv_probe = bond_arp_rcv;
3515 } 3524 }
3516 3525
3517 if (bond->params.mode == BOND_MODE_8023AD) { 3526 if (bond->params.mode == BOND_MODE_8023AD) {
3518 INIT_DELAYED_WORK(&bond->ad_work, bond_3ad_state_machine_handler);
3519 queue_delayed_work(bond->wq, &bond->ad_work, 0); 3527 queue_delayed_work(bond->wq, &bond->ad_work, 0);
3520 /* register to receive LACPDUs */ 3528 /* register to receive LACPDUs */
3521 bond->recv_probe = bond_3ad_lacpdu_recv; 3529 bond->recv_probe = bond_3ad_lacpdu_recv;
@@ -3530,34 +3538,10 @@ static int bond_close(struct net_device *bond_dev)
3530 struct bonding *bond = netdev_priv(bond_dev); 3538 struct bonding *bond = netdev_priv(bond_dev);
3531 3539
3532 write_lock_bh(&bond->lock); 3540 write_lock_bh(&bond->lock);
3533
3534 bond->send_peer_notif = 0; 3541 bond->send_peer_notif = 0;
3535
3536 write_unlock_bh(&bond->lock); 3542 write_unlock_bh(&bond->lock);
3537 3543
3538 if (bond->params.miimon) { /* link check interval, in milliseconds. */ 3544 bond_work_cancel_all(bond);
3539 cancel_delayed_work_sync(&bond->mii_work);
3540 }
3541
3542 if (bond->params.arp_interval) { /* arp interval, in milliseconds. */
3543 cancel_delayed_work_sync(&bond->arp_work);
3544 }
3545
3546 switch (bond->params.mode) {
3547 case BOND_MODE_8023AD:
3548 cancel_delayed_work_sync(&bond->ad_work);
3549 break;
3550 case BOND_MODE_TLB:
3551 case BOND_MODE_ALB:
3552 cancel_delayed_work_sync(&bond->alb_work);
3553 break;
3554 default:
3555 break;
3556 }
3557
3558 if (delayed_work_pending(&bond->mcast_work))
3559 cancel_delayed_work_sync(&bond->mcast_work);
3560
3561 if (bond_is_lb(bond)) { 3545 if (bond_is_lb(bond)) {
3562 /* Must be called only after all 3546 /* Must be called only after all
3563 * slaves have been released 3547 * slaves have been released
@@ -4436,26 +4420,6 @@ static void bond_setup(struct net_device *bond_dev)
4436 bond_dev->features |= bond_dev->hw_features; 4420 bond_dev->features |= bond_dev->hw_features;
4437} 4421}
4438 4422
4439static void bond_work_cancel_all(struct bonding *bond)
4440{
4441 if (bond->params.miimon && delayed_work_pending(&bond->mii_work))
4442 cancel_delayed_work_sync(&bond->mii_work);
4443
4444 if (bond->params.arp_interval && delayed_work_pending(&bond->arp_work))
4445 cancel_delayed_work_sync(&bond->arp_work);
4446
4447 if (bond->params.mode == BOND_MODE_ALB &&
4448 delayed_work_pending(&bond->alb_work))
4449 cancel_delayed_work_sync(&bond->alb_work);
4450
4451 if (bond->params.mode == BOND_MODE_8023AD &&
4452 delayed_work_pending(&bond->ad_work))
4453 cancel_delayed_work_sync(&bond->ad_work);
4454
4455 if (delayed_work_pending(&bond->mcast_work))
4456 cancel_delayed_work_sync(&bond->mcast_work);
4457}
4458
4459/* 4423/*
4460* Destroy a bonding device. 4424* Destroy a bonding device.
4461* Must be under rtnl_lock when this function is called. 4425* Must be under rtnl_lock when this function is called.
@@ -4706,12 +4670,13 @@ static int bond_check_params(struct bond_params *params)
4706 arp_ip_count++) { 4670 arp_ip_count++) {
4707 /* not complete check, but should be good enough to 4671 /* not complete check, but should be good enough to
4708 catch mistakes */ 4672 catch mistakes */
4709 if (!isdigit(arp_ip_target[arp_ip_count][0])) { 4673 __be32 ip = in_aton(arp_ip_target[arp_ip_count]);
4674 if (!isdigit(arp_ip_target[arp_ip_count][0]) ||
4675 ip == 0 || ip == htonl(INADDR_BROADCAST)) {
4710 pr_warning("Warning: bad arp_ip_target module parameter (%s), ARP monitoring will not be performed\n", 4676 pr_warning("Warning: bad arp_ip_target module parameter (%s), ARP monitoring will not be performed\n",
4711 arp_ip_target[arp_ip_count]); 4677 arp_ip_target[arp_ip_count]);
4712 arp_interval = 0; 4678 arp_interval = 0;
4713 } else { 4679 } else {
4714 __be32 ip = in_aton(arp_ip_target[arp_ip_count]);
4715 arp_target[arp_ip_count] = ip; 4680 arp_target[arp_ip_count] = ip;
4716 } 4681 }
4717 } 4682 }
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index ef8d2a080d17..1877ed7ca086 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -513,6 +513,8 @@ static ssize_t bonding_store_arp_interval(struct device *d,
513 int new_value, ret = count; 513 int new_value, ret = count;
514 struct bonding *bond = to_bond(d); 514 struct bonding *bond = to_bond(d);
515 515
516 if (!rtnl_trylock())
517 return restart_syscall();
516 if (sscanf(buf, "%d", &new_value) != 1) { 518 if (sscanf(buf, "%d", &new_value) != 1) {
517 pr_err("%s: no arp_interval value specified.\n", 519 pr_err("%s: no arp_interval value specified.\n",
518 bond->dev->name); 520 bond->dev->name);
@@ -539,10 +541,6 @@ static ssize_t bonding_store_arp_interval(struct device *d,
539 pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n", 541 pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
540 bond->dev->name, bond->dev->name); 542 bond->dev->name, bond->dev->name);
541 bond->params.miimon = 0; 543 bond->params.miimon = 0;
542 if (delayed_work_pending(&bond->mii_work)) {
543 cancel_delayed_work(&bond->mii_work);
544 flush_workqueue(bond->wq);
545 }
546 } 544 }
547 if (!bond->params.arp_targets[0]) { 545 if (!bond->params.arp_targets[0]) {
548 pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n", 546 pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
@@ -554,19 +552,12 @@ static ssize_t bonding_store_arp_interval(struct device *d,
554 * timer will get fired off when the open function 552 * timer will get fired off when the open function
555 * is called. 553 * is called.
556 */ 554 */
557 if (!delayed_work_pending(&bond->arp_work)) { 555 cancel_delayed_work_sync(&bond->mii_work);
558 if (bond->params.mode == BOND_MODE_ACTIVEBACKUP) 556 queue_delayed_work(bond->wq, &bond->arp_work, 0);
559 INIT_DELAYED_WORK(&bond->arp_work,
560 bond_activebackup_arp_mon);
561 else
562 INIT_DELAYED_WORK(&bond->arp_work,
563 bond_loadbalance_arp_mon);
564
565 queue_delayed_work(bond->wq, &bond->arp_work, 0);
566 }
567 } 557 }
568 558
569out: 559out:
560 rtnl_unlock();
570 return ret; 561 return ret;
571} 562}
572static DEVICE_ATTR(arp_interval, S_IRUGO | S_IWUSR, 563static DEVICE_ATTR(arp_interval, S_IRUGO | S_IWUSR,
@@ -962,6 +953,8 @@ static ssize_t bonding_store_miimon(struct device *d,
962 int new_value, ret = count; 953 int new_value, ret = count;
963 struct bonding *bond = to_bond(d); 954 struct bonding *bond = to_bond(d);
964 955
956 if (!rtnl_trylock())
957 return restart_syscall();
965 if (sscanf(buf, "%d", &new_value) != 1) { 958 if (sscanf(buf, "%d", &new_value) != 1) {
966 pr_err("%s: no miimon value specified.\n", 959 pr_err("%s: no miimon value specified.\n",
967 bond->dev->name); 960 bond->dev->name);
@@ -993,10 +986,6 @@ static ssize_t bonding_store_miimon(struct device *d,
993 bond->params.arp_validate = 986 bond->params.arp_validate =
994 BOND_ARP_VALIDATE_NONE; 987 BOND_ARP_VALIDATE_NONE;
995 } 988 }
996 if (delayed_work_pending(&bond->arp_work)) {
997 cancel_delayed_work(&bond->arp_work);
998 flush_workqueue(bond->wq);
999 }
1000 } 989 }
1001 990
1002 if (bond->dev->flags & IFF_UP) { 991 if (bond->dev->flags & IFF_UP) {
@@ -1005,15 +994,12 @@ static ssize_t bonding_store_miimon(struct device *d,
1005 * timer will get fired off when the open function 994 * timer will get fired off when the open function
1006 * is called. 995 * is called.
1007 */ 996 */
1008 if (!delayed_work_pending(&bond->mii_work)) { 997 cancel_delayed_work_sync(&bond->arp_work);
1009 INIT_DELAYED_WORK(&bond->mii_work, 998 queue_delayed_work(bond->wq, &bond->mii_work, 0);
1010 bond_mii_monitor);
1011 queue_delayed_work(bond->wq,
1012 &bond->mii_work, 0);
1013 }
1014 } 999 }
1015 } 1000 }
1016out: 1001out:
1002 rtnl_unlock();
1017 return ret; 1003 return ret;
1018} 1004}
1019static DEVICE_ATTR(miimon, S_IRUGO | S_IWUSR, 1005static DEVICE_ATTR(miimon, S_IRUGO | S_IWUSR,
@@ -1582,6 +1568,7 @@ static ssize_t bonding_store_slaves_active(struct device *d,
1582 goto out; 1568 goto out;
1583 } 1569 }
1584 1570
1571 read_lock(&bond->lock);
1585 bond_for_each_slave(bond, slave, i) { 1572 bond_for_each_slave(bond, slave, i) {
1586 if (!bond_is_active_slave(slave)) { 1573 if (!bond_is_active_slave(slave)) {
1587 if (new_value) 1574 if (new_value)
@@ -1590,6 +1577,7 @@ static ssize_t bonding_store_slaves_active(struct device *d,
1590 slave->inactive = 1; 1577 slave->inactive = 1;
1591 } 1578 }
1592 } 1579 }
1580 read_unlock(&bond->lock);
1593out: 1581out:
1594 return ret; 1582 return ret;
1595} 1583}
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index b01f83a044c4..609125a249d9 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -1060,17 +1060,22 @@ static int cp_init_rings (struct cp_private *cp)
1060 1060
1061static int cp_alloc_rings (struct cp_private *cp) 1061static int cp_alloc_rings (struct cp_private *cp)
1062{ 1062{
1063 struct device *d = &cp->pdev->dev;
1063 void *mem; 1064 void *mem;
1065 int rc;
1064 1066
1065 mem = dma_alloc_coherent(&cp->pdev->dev, CP_RING_BYTES, 1067 mem = dma_alloc_coherent(d, CP_RING_BYTES, &cp->ring_dma, GFP_KERNEL);
1066 &cp->ring_dma, GFP_KERNEL);
1067 if (!mem) 1068 if (!mem)
1068 return -ENOMEM; 1069 return -ENOMEM;
1069 1070
1070 cp->rx_ring = mem; 1071 cp->rx_ring = mem;
1071 cp->tx_ring = &cp->rx_ring[CP_RX_RING_SIZE]; 1072 cp->tx_ring = &cp->rx_ring[CP_RX_RING_SIZE];
1072 1073
1073 return cp_init_rings(cp); 1074 rc = cp_init_rings(cp);
1075 if (rc < 0)
1076 dma_free_coherent(d, CP_RING_BYTES, cp->rx_ring, cp->ring_dma);
1077
1078 return rc;
1074} 1079}
1075 1080
1076static void cp_clean_rings (struct cp_private *cp) 1081static void cp_clean_rings (struct cp_private *cp)
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index 10896393e5a0..2830ea290502 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1012,12 +1012,12 @@ static void iwl_calc_basic_rates(struct iwl_priv *priv,
1012 * As a consequence, it's not as complicated as it sounds, just add 1012 * As a consequence, it's not as complicated as it sounds, just add
1013 * any lower rates to the ACK rate bitmap. 1013 * any lower rates to the ACK rate bitmap.
1014 */ 1014 */
1015 if (IWL_RATE_11M_INDEX < lowest_present_ofdm) 1015 if (IWL_RATE_11M_INDEX < lowest_present_cck)
1016 ofdm |= IWL_RATE_11M_MASK >> IWL_FIRST_CCK_RATE; 1016 cck |= IWL_RATE_11M_MASK >> IWL_FIRST_CCK_RATE;
1017 if (IWL_RATE_5M_INDEX < lowest_present_ofdm) 1017 if (IWL_RATE_5M_INDEX < lowest_present_cck)
1018 ofdm |= IWL_RATE_5M_MASK >> IWL_FIRST_CCK_RATE; 1018 cck |= IWL_RATE_5M_MASK >> IWL_FIRST_CCK_RATE;
1019 if (IWL_RATE_2M_INDEX < lowest_present_ofdm) 1019 if (IWL_RATE_2M_INDEX < lowest_present_cck)
1020 ofdm |= IWL_RATE_2M_MASK >> IWL_FIRST_CCK_RATE; 1020 cck |= IWL_RATE_2M_MASK >> IWL_FIRST_CCK_RATE;
1021 /* 1M already there or needed so always add */ 1021 /* 1M already there or needed so always add */
1022 cck |= IWL_RATE_1M_MASK >> IWL_FIRST_CCK_RATE; 1022 cck |= IWL_RATE_1M_MASK >> IWL_FIRST_CCK_RATE;
1023 1023