aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* Merge branch 'for-linus' of ↵Linus Torvalds2007-05-21
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband * 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband: IB/cm: Improve local id allocation IPoIB/cm: Fix SRQ WR leak IB/ipoib: Fix typos in error messages IB/mlx4: Check if SRQ is full when posting receive IB/mlx4: Pass send queue sizes from userspace to kernel IB/mlx4: Fix check of opcode in mlx4_ib_post_send() mlx4_core: Fix array overrun in dump_dev_cap_flags() IB/mlx4: Fix RESET to RESET and RESET to ERROR transitions IB/mthca: Fix RESET to ERROR transition IB/mlx4: Set GRH:HopLimit when sending globally routed MADs IB/mthca: Set GRH:HopLimit when building MLX headers IB/mlx4: Fix check of max_qp_dest_rdma in modify QP IB/mthca: Fix use-after-free on device restart IB/ehca: Return proper error code if register_mr fails IPoIB: Handle P_Key table reordering IB/core: Use start_port() and end_port() IB/core: Add helpers for uncached GID and P_Key searches IB/ipath: Fix potential deadlock with multicast spinlocks IB/core: Free umem when mm is already gone
| * IB/cm: Improve local id allocationMichael S. Tsirkin2007-05-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The IB CM uses an idr for local id allocations, with a running counter as start_id. This fails to generate distinct ids if 1. An id is constantly created and destroyed 2. A chunk of ids just beyond the current next_id value is occupied This in turn leads to an increased chance of connection request being mis-detected as a duplicate, sometimes for several retries, until next_id gets past the block of allocated ids. This has been observed in practice. As a fix, remember the last id allocated and start immediately above it. This also fixes a problem with the old code, where next_id might overflow and become negative. Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il> Acked-by: Sean Hefty <sean.hefty@intel.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IPoIB/cm: Fix SRQ WR leakMichael S. Tsirkin2007-05-21
| | | | | | | | | | | | | | | | | | | | | | | | | | SRQ WR leakage has been observed with IPoIB/CM: e.g. flipping ports on and off will, with time, leak out all WRs and then all connections will start getting RNR NAKs. Fix this in the way suggested by spec: move the QP being destroyed to the error state, wait for "Last WQE Reached" event and then post WR on a "drain QP" connected to the same CQ. Once we observe a completion on the drain QP, it's safe to call ib_destroy_qp. Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ipoib: Fix typos in error messagesMichael S. Tsirkin2007-05-21
| | | | | | | | | | | | | | Trivial error message fixups. Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/mlx4: Check if SRQ is full when posting receiveRoland Dreier2007-05-20
| | | | | | | | | | | | Make mlx4_post_srq_recv() fail if the SRQ is full (head == tail). Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/mlx4: Pass send queue sizes from userspace to kernelEli Cohen2007-05-20
| | | | | | | | | | | | | | | | | | | | | | | | Pass the number of WQEs for the send queue and their size from userspace to the kernel to avoid having to keep the QP size calculations in sync between the kernel driver and libmlx4. This fixes a bug seen with the current mlx4_ib driver and current libmlx4 caused by a difference in the calculated sizes for SQ WQEs. Also, this gives more flexibility for userspace to experiment with using multiple WQE BBs for a single SQ WQE. Signed-off-by: Eli Cohen <eli@mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/mlx4: Fix check of opcode in mlx4_ib_post_send()Roland Dreier2007-05-19
| | | | | | | | | | | | | | | | | | wr->opcode is invalid if it's >= ARRAY_SIZE(mlx4_ib_opcode), not just strictly >. This was spotted by the Coverity checker (CID 1643). Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * mlx4_core: Fix array overrun in dump_dev_cap_flags()Roland Dreier2007-05-19
| | | | | | | | | | | | | | | | Don't overrun fname[] array when decoding device flags. This was spotted by the Coverity checker (CID 1642). Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/mlx4: Fix RESET to RESET and RESET to ERROR transitionsMichael S. Tsirkin2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | According to the IB spec, a QP can be moved from RESET back to RESET or to the ERROR state, but mlx4 firmware does not support this and returns an error if we try. Fix the RESET to RESET transition by just returning 0 without doing anything, and fix RESET to ERROR by moving the QP from RESET to INIT with dummy parameters and then transitioning from INIT to ERROR. Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/mthca: Fix RESET to ERROR transitionMichael S. Tsirkin2007-05-19
| | | | | | | | | | | | | | | | | | | | According to the IB spec, a QP can be moved from RESET to the ERROR state, but mthca firmware does not support this and returns an error if we try. Work around this FW limitation by moving the QP from RESET to INIT with dummy parameters and then transitioning from INIT to ERROR. Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/mlx4: Set GRH:HopLimit when sending globally routed MADsRoland Dreier2007-05-19
| | | | | | | | | | | | | | This is the same issue discovered in mthca by Rolf Manderscheid <rvm@obsidianresearch.com>. Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/mthca: Set GRH:HopLimit when building MLX headersRolf Manderscheid2007-05-19
| | | | | | | | | | | | | | | | | | | | | | Global CM packets used by rmda_cm were being sent with a GRH:hopLimit of zero, causing them to be dropped by the router. The problem is a missing initialization of the hop_limit field in mthca_read_ah(), which was called by build_mlx_header() when sending a MAD on QP1. Signed-off-by: Rolf Manderscheid <rvm@obsidianresearch.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/mlx4: Fix check of max_qp_dest_rdma in modify QPEli Cohen2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | max_qp_dest_rdma is already in natural units - no need to shift. This was discovered by a test that deliberately requests more outstanding atomic operation than the device supports. Found by Sagi Rotem at Mellanox. Signed-off-by: Eli Cohen <eli@mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/mthca: Fix use-after-free on device restartAli Ayoub2007-05-19
| | | | | | | | | | | | Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ehca: Return proper error code if register_mr failsHoang-Nam Nguyen2007-05-19
| | | | | | | | | | | | | | | | | | | | Set the return code of ehca_register_mr() to ENOMEM if the corresponding firmware call fails due to out of resources. Some other error codes were explicitly mapped to EINVAL -- just remove those cases so they get mapped to the default case, which already returns EINVAL anyway. Signed-off-by: Hoang-Nam Nguyen <hnguyen@de.ibm.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IPoIB: Handle P_Key table reorderingYosef Etigin2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | SM reconfiguration or failover possibly causes a shuffling of the values in the P_Key table. Right now, IPoIB only queries for the P_Key index once when it creates the device QP, and hence there are problems if the index of a P_Key value changes. Fix this by using the PKEY_CHANGE event to trigger a recheck of the P_Key index. Signed-off-by: Yosef Etigin <yosefe@voltaire.com> Acked-by: Michael S. Tsirkin <mst@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/core: Use start_port() and end_port()Roland Dreier2007-05-19
| | | | | | | | | | | | | | Clean up ib_query_port() and ib_modify_port() slightly by using the just-added start_port() and end_port() helpers. Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/core: Add helpers for uncached GID and P_Key searchesYosef Etigin2007-05-19
| | | | | | | | | | | | | | | | | | | | Add ib_find_gid() and ib_find_pkey() functions that use uncached device queries. The calls might block but the returns are always up-to-date. Cache P_Key and GID table lengths in core to avoid extra port info queries. Signed-off-by: Yosef Etigin <yosefe@voltaire.com> Acked-by: Michael S. Tsirkin <mst@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ipath: Fix potential deadlock with multicast spinlocksRoland Dreier2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Lockdep found the following potential deadlock between mcast_lock and n_mcast_grps_lock: mcast_lock is taken from both interrupt context and process context, so spin_lock_irqsave() must be used to take it. n_mcast_grps_lock is only taken from process context, so at first it seems safe to take it with plain spin_lock(); however, it also nests inside mcast_lock, and hence we could deadlock: cpu A cpu B ipath_mcast_add(): spin_lock_irq(&mcast_lock); ipath_mcast_detach(): spin_lock(&n_mcast_grps_lock); <enter interrupt> ipath_mcast_find(): spin_lock_irqsave(&mcast_lock); spin_lock(&n_mcast_grps_lock); Fix this by using spin_lock_irq() to take n_mcast_grps_lock. Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/core: Free umem when mm is already goneEli Cohen2007-05-19
| | | | | | | | | | | | | | | | | | | | Free umem when task's mm is already destroyed by the time ib_umem_release gets called. Found by Dotan Barak at Mellanox. Signed-off-by: Eli Cohen <eli@mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
* | Merge git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fixLinus Torvalds2007-05-21
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fix: mm/slab: fix section mismatch warning mm: fix section mismatch warnings init/main: use __init_refok to fix section mismatch kbuild: introduce __init_refok/__initdata_refok to supress section mismatch warnings all-archs: consolidate .data section definition in asm-generic all-archs: consolidate .text section definition in asm-generic kbuild: add "Section mismatch" warning whitelist for powerpc kbuild: make better section mismatch reports on i386, arm and mips kbuild: make modpost section warnings clearer kconfig: search harder for curses library in check-lxdialog.sh kbuild: include limits.h in sumversion.c for PATH_MAX powerpc: Fix the MODALIAS generation in modpost for of devices
| * | mm/slab: fix section mismatch warningSam Ravnborg2007-05-19
| | | | | | | | | | | | | | | | | | | | | Use the new __init_refok marker to avoid the section mismatch warning from slab.c Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
| * | mm: fix section mismatch warningsSam Ravnborg2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | modpost had two cases hardcoded for mm/ Shift over to __init_refok and kill the hardcoded function names in modpost. This has the drawback that the functions will always be kept no matter configuration. With previous code the function were placed in init section if configuration allowed it. Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
| * | init/main: use __init_refok to fix section mismatchSam Ravnborg2007-05-19
| | | | | | | | | | | | | | | | | | | | | Kill a special case in modpost by introducing the __init_refok marker. Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
| * | kbuild: introduce __init_refok/__initdata_refok to supress section mismatch ↵Sam Ravnborg2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | warnings Throughout the kernel there are a few legitimite references to init or exit sections. Most of these are covered by the patterns included in modpost but a few nees special attention. To avoid hardcoding a lot of function names in modpost introduce a marker so relevant function/data can be marked. When modpost see a reference to a init/exit function from a function/data marked no warning will be issued. Idea from: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sam Ravnborg <sam@ravnborg.org> Cc: Andrew Morton <akpm@linux-foundation.org>
| * | all-archs: consolidate .data section definition in asm-genericSam Ravnborg2007-05-19
| | | | | | | | | | | | | | | | | | | | | With this consolidation we can now modify the .data section definition in one spot for all archs. Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
| * | all-archs: consolidate .text section definition in asm-genericSam Ravnborg2007-05-19
| | | | | | | | | | | | | | | | | | Move definition of .text section to asm-generic. Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
| * | kbuild: add "Section mismatch" warning whitelist for powerpcLi Yang2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the following class of "Section mismatch" warnings when building powerpc platforms. WARNING: arch/powerpc/kernel/built-in.o - Section mismatch: reference to .init.data:.got2 from prom_entry (offset 0x0) WARNING: arch/powerpc/platforms/built-in.o - Section mismatch: reference to .init.text:mpc8313_rdb_probe from .machine.desc after 'mach_mpc8313_rdb' (at offset 0x4) .... Signed-off-by: Li Yang <leoli@freescale.com> Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
| * | kbuild: make better section mismatch reports on i386, arm and mipsAtsushi Nemoto2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On i386, ARM and MIPS, warn_sec_mismatch() sometimes fails to show usefull symbol name. This is because empty 'refsym' due to 0 r_addend value. This patch is to adjust r_addend value, consulting with apply_relocate() routine in kernel code. Without this patch: MODPOST vmlinux WARNING: init/built-in.o - Section mismatch: reference to .init.text: from .text between 'rest_init' (at offset 0xf4) and 'try_name' WARNING: mm/built-in.o - Section mismatch: reference to .init.text: from .text between 'kmem_cache_create' (at offset 0x18a39) and 'cache_reap' WARNING: mm/built-in.o - Section mismatch: reference to .init.text: from .text between 'kmem_cache_create' (at offset 0x18a6b) and 'cache_reap' With this patch: MODPOST vmlinux WARNING: mm/built-in.o - Section mismatch: reference to .init.text:set_up_list3s from .text between 'kmem_cache_create' (at offset 0x18a39) and 'cache_reap' WARNING: mm/built-in.o - Section mismatch: reference to .init.text:set_up_list3s from .text between 'kmem_cache_create' (at offset 0x18a6b) and 'cache_reap' Now modpost can detect "kernel_init" name (and whitelist it) and show "set_up_list3s" name. Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
| * | kbuild: make modpost section warnings clearerRussell King2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change modpost section mismatch warnings to be less confusing; model them on the binutils linker warnings which we all know how to interpret. Also, fix the wrong ordering of arguments for the final case - fromsec and refsymname were reversed. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
| * | kconfig: search harder for curses library in check-lxdialog.shMike Frysinger2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The check-lxdialog.sh script searches for "libFOO.so" which fails on OS X, due to their special naming of libraries like "libfoo.dylib". This patch turns the curses lib search into extensible loops and adds dylib as a valid extension. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
| * | kbuild: include limits.h in sumversion.c for PATH_MAXMike Frysinger2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | POSIX says limits.h defines PATH_MAX so we should include it (which fixes compiling on some systems like OS X). Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
| * | powerpc: Fix the MODALIAS generation in modpost for of devicesSylvain Munaut2007-05-19
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the devices may have multiple (or none) compatible properties, the uevent generated internally by the kernel may have multiple "C..." entries. So the MODALIAS stored in the module must have wilcard before and after the compatible entry. Also, if the 'compatible' field is not used for matching, there will be no 'C' and that must handled as well. The previous code handled all those case incorrectly and it "mostly" worked ... but not always. Signed-off-by: Sylvain Munaut <tnt@246tNt.com> Signed-off-by: Paul Mackerras <paulus@samba.org> Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
* | Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6Linus Torvalds2007-05-21
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | * 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6: [S390] More verbose show_mem() like other architectures. [S390] Make use of kretprobe_assert. [S390] Wire up signald, timerfd and eventfd syscalls. [S390] Wire up sys_utimensat. [S390] cio: Update documentation.
| * | [S390] More verbose show_mem() like other architectures.Heiko Carstens2007-05-21
| | | | | | | | | | | | | | | Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
| * | [S390] Make use of kretprobe_assert.Heiko Carstens2007-05-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | s390 change for git commit 0f95b7fc839bc3272b1bf2325d8748a649bd3534. That is print kprobes debug data before BUG(). Cc: Ananth N Mavinakayanahalli <ananth@in.ibm.com> Cc: Maneesh Soni <maneesh@in.ibm.com> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
| * | [S390] Wire up signald, timerfd and eventfd syscalls.Heiko Carstens2007-05-21
| | | | | | | | | | | | | | | Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
| * | [S390] Wire up sys_utimensat.Heiko Carstens2007-05-21
| | | | | | | | | | | | | | | | | | | | | | | | Wire up sys_utimensat, reserve syscall number for sys_fallocate and add a couple of syscalls to the ignore list to get rid of warings. Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
| * | [S390] cio: Update documentation.Cornelia Huck2007-05-21
| |/ | | | | | | | | | | | | | | | | - read_dev_chars()/read_conf_data() are deprecated. Don't document them, but advise to issue the channel program from the driver itself. - Remove some really obsolete and incorrect stuff. Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
* | Merge branch 'master' of ↵Linus Torvalds2007-05-21
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 * 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [NET]: Fix race condition about network device name allocation. [IPV4]: icmp: fix crash with sysctl_icmp_errors_use_inbound_ifaddr [NETFILTER]: nf_conntrack_ipv4: fix incorrect #ifdef config name [NETFILTER]: nf_conntrack: fix use-after-free in helper destroy callback invocation [IPSEC] pfkey: Load specific algorithm in pfkey_add rather than all [TCP] FRTO: Prevent state inconsistency in corner cases [TCP] FRTO: Add missing ECN CWR sending to one of the responses [NET]: Fix net/core/skbuff.c gcc-3.2.3 compilation error [RFKILL]: Fix check for correct rfkill allocation [IPV6]: Add ip6_tunnel.h to headers_install
| * | [NET]: Fix race condition about network device name allocation.Stephen Hemminger2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kenji Kaneshige found this race between device removal and registration. On unregister it is possible for the old device to exist, because sysfs file is still open. A new device with 'eth%d' will select the same name, but sysfs kobject register will fial. The following changes the shutdown order slightly. It hold a removes the sysfs entries earlier (on unregister_netdevice), but holds a kobject reference. Then when todo runs the actual last put free happens. Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [IPV4]: icmp: fix crash with sysctl_icmp_errors_use_inbound_ifaddrPatrick McHardy2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When icmp_send is called on the local output path before the packet hits ip_output, skb->dev is not set, causing a crash when sysctl_icmp_errors_use_inbound_ifaddr is set. This can happen with the netfilter REJECT target or IPsec tunnels. Let routing decide the ICMP source address in that case, since the packet is locally generated there is no inbound interface and the sysctl should not apply. The option actually seems to be unfixable broken, on the path after ip_output() skb->dev points to the outgoing device and we don't know the incoming device anymore, so its going to do the absolute wrong thing and pick the address of the outgoing interface. Add a comment about this. Reported by Curtis Doty <Curtis@GreenKey.net>. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [NETFILTER]: nf_conntrack_ipv4: fix incorrect #ifdef config namePatrick McHardy2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The option is named CONFIG_NF_NAT not CONFIG_IP_NF_NAT. Remove the ifdef completely since helpers also expect defragmented packet even without NAT. Noticed by Robert P. J. Day <rpjday@mindspring.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [NETFILTER]: nf_conntrack: fix use-after-free in helper destroy callback ↵Patrick McHardy2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | invocation When the helper module is removed for a master connection that has a fulfilled expectation, but has already timed out and got removed from the hash tables, nf_conntrack_helper_unregister can't find the master connection to unset the helper, causing a use-after-free when the expected connection is destroyed and releases the last reference to the master. The helper destroy callback was introduced for the PPtP helper to clean up expectations and expected connections when the master connection times out, but doing this from destroy_conntrack only works for unfulfilled expectations since expected connections hold a reference to the master, preventing its destruction. Move the destroy callback to the timeout function, which fixes both problems. Reported/tested by Gabor Burjan <buga@buvoshetes.hu>. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [IPSEC] pfkey: Load specific algorithm in pfkey_add rather than allHerbert Xu2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a natural extension of the changeset [XFRM]: Probe selected algorithm only. which only removed the probe call for xfrm_user. This patch does exactly the same thing for af_key. In other words, we load the algorithm requested by the user rather than everything when adding xfrm states in af_key. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [TCP] FRTO: Prevent state inconsistency in corner casesIlpo Järvinen2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | State could become inconsistent in two cases: 1) Userspace disabled FRTO by tuning sysctl when one of the TCP flows was in the middle of FRTO algorithm (and then RTO is again triggered) 2) SACK reneging occurs during FRTO algorithm A simple solution is just to abort the previous FRTO when such obscure condition occurs... Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [TCP] FRTO: Add missing ECN CWR sending to one of the responsesIlpo Järvinen2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The conservative spurious RTO response did not queue CWR even though the sending rate was lowered. Whenever reduction happens regardless of reason, CWR should be sent (forgetting to send it is not very fatal though). A better approach would be to queue CWR when one of the sending rate reducing responses (rate-halving one or this conservative response) is used already at RTO. Doing that would allow CWR to be sent along with the two new data segments that are sent during FRTO. However, it's a bit "racy" because userland could tune the response sysctl to a more aggressive one in between. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [NET]: Fix net/core/skbuff.c gcc-3.2.3 compilation errorMikael Pettersson2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Compiling 2.6.22-rc1 with gcc-3.2.3 for i486 fails with: gcc -m32 -Wp,-MD,net/core/.skbuff.o.d -nostdinc -isystem /home/mikpe/pkgs/linux-x86/gnu/lib/gcc-lib/i486-pc-linux-gnu/3.2.3/include -D__KERNEL__ -Iinclude -include include/linux/autoconf.h -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common -O2 -pipe -msoft-float -mregparm=3 -freg-struct-return -mpreferred-stack-boundary=4 -march=i486 -ffreestanding -maccumulate-outgoing-args -DCONFIG_AS_CFI=1 -Iinclude/asm-i386/mach-default -fomit-frame-pointer -D"KBUILD_STR(s)=#s" -D"KBUILD_BASENAME=KBUILD_STR(skbuff)" -D"KBUILD_MODNAME=KBUILD_STR(skbuff)" -c -o net/core/skbuff.o net/core/skbuff.c net/core/skbuff.c:648:1: directives may not be used inside a macro argument net/core/skbuff.c:647:39: unterminated argument list invoking macro "memcpy" net/core/skbuff.c: In function `pskb_expand_head': net/core/skbuff.c:651: `memcpy' undeclared (first use in this function) net/core/skbuff.c:651: (Each undeclared identifier is reported only once net/core/skbuff.c:651: for each function it appears in.) net/core/skbuff.c:651: syntax error before "skb" make[2]: *** [net/core/skbuff.o] Error 1 make[1]: *** [net/core] Error 2 make: *** [net] Error 2 The patch below implements a simple workaround which is to clone the offending memcpy() call and specialise it for the two different scenarios. Other workarounds are of course possible: e.g. bind the varying parameter in a local variable, or use a macro or inline function to perform the varying computation. Signed-off-by: Mikael Pettersson <mikpe@it.uu.se> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [RFKILL]: Fix check for correct rfkill allocationIvo van Doorn2007-05-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | coverity has spotted a bug in rfkill.c (bug id #1627), in rfkill_allocate() NULL was returns if the kzalloc() works, and deref the NULL pointer if it fails, Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [IPV6]: Add ip6_tunnel.h to headers_installDeepak Saxena2007-05-19
| |/ | | | | | | | | | | | | | | | | The Mobile IPv6 package (http://www.mobile-ipv6.org/software/) needs this header file to build the tunnelctl component. The header already looks sanitized so is safe to export. Signed-off-by: Deepak Saxena <dsaxena@mvista.com> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.2 (git 2.25.0) at 2024-12-29 01:55:36 -0500