aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* Merge branch 'for-davem' of git://gitorious.org/linux-can/linux-can-nextDavid S. Miller2012-11-30
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | Marc Kleine-Budde says: ==================== this pull request is for net-next/master. There is a patch by Alexander Stein fixing a reference counter problem which can make driver unloading impossible (stable Cc'ed). And several patches by me which remove an obsolete mechanism from several drivers, which is already handled at the infrastructure level. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * can: pcan_usb_core: remove obsolete variable open_timeMarc Kleine-Budde2012-11-29
| | | | | | | | | | | | | | | | The variable open_time in the struct peak_usb_device was used to protect peak_usb_set_mode() only to be called, if the interface is up. Now the CAN device infrastructure takes care of this. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
| * can: esd_usb2: remove obsolete variable open_timeMarc Kleine-Budde2012-11-29
| | | | | | | | | | | | | | | | The variable open_time in the struct esd_usb2_net_priv was used to protect esd_usb2_set_mode() only to be called, if the interface is up. Now the CAN device infrastructure takes care of this. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
| * can: ems_usb: remove obsolete variable open_timeMarc Kleine-Budde2012-11-29
| | | | | | | | | | | | | | | | The variable open_time in the struct ems_usb was used to protect ems_usb_set_mode() only to be called, if the interface is up. Now the CAN device infrastructure takes care of this. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
| * can: sja1000: remove obsolete variable open_timeMarc Kleine-Budde2012-11-29
| | | | | | | | | | | | | | | | The variable open_time in the struct sja1000_priv was used to protect sja1000_set_mode() only to be called, if the interface is up. Now the CAN device infrastructure takes care of this. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
| * can: mscan: remove obsolete variable open_timeMarc Kleine-Budde2012-11-29
| | | | | | | | | | | | | | | | The variable open_time in the struct mscan_priv was used to protect mscan_do_set_mode() only to be called, if the interface is up. Now the CAN device infrastructure takes care of this. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
| * can: Do not call dev_put if restart timer is running upon closeAlexander Stein2012-11-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the restart timer is running due to BUS-OFF and the device is disconnected an dev_put will decrease the usage counter to -1 thus blocking the interface removal, resulting in the following dmesg lines repeating every 10s: can: notifier: receive list not found for dev can0 can: notifier: receive list not found for dev can0 can: notifier: receive list not found for dev can0 unregister_netdevice: waiting for can0 to become free. Usage count = -1 Cc: linux-stable <stable@vger.kernel.org> Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
* | mISDN: improve bitops usageAkinobu Mita2012-11-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This improves bitops usages in several points: - Convert u64 to a proper bitmap declaration. This enables to remove superfluous typecasting from 'u64' to 'unsigned long *'. - Convert superfluous atomic bitops to non atomic bitops. The bitmap is allocated on the stack and it is not accessed by any other threads, so using atomic bitops is not necessary. - Use find_next_zero_bit and find_next_zero_bit instead of calling test_bit() for each bit. Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Cc: Karsten Keil <isdn@linux-pingi.de> Cc: netdev@vger.kernel.org Signed-off-by: David S. Miller <davem@davemloft.net>
* | 8021q: fix vlan device to inherit the unicast filtering capability flagYi Zou2012-11-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This bug is observed on running FCoE over a VLAN device associated w/ a real device that has IFF_UNICAST_FLT set since FCoE would add unicast address such as FLOGI MAC to the VLAN interface that FCoE is on. Since currently, VLAN device is not inheriting the IFF_UNICAST_FLT flag from the parent real device even though the real device is capable of doing unicast filtering. This forces the VLAN device and its real device go to promiscuous mode unnecessarily even the added address is actually being added to the available unicast filter table in real device. Signed-off-by: Yi Zou <yi.zou@intel.com> Cc: devel@open-fcoe.org Signed-off-by: David S. Miller <davem@davemloft.net>
* | bonding: delete migrated IP addresses from the rlb hash tableJiri Bohac2012-11-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bonding in balance-alb mode records information from ARP packets passing through the bond in a hash table (rx_hashtbl). At certain situations (e.g. link change of a slave), rlb_update_rx_clients() will send out ARP packets to update ARP caches of other hosts on the network to achieve RX load balancing. The problem is that once an IP address is recorded in the hash table, it stays there indefinitely. If this IP address is migrated to a different host in the network, bonding still sends out ARP packets that poison other systems' ARP caches with invalid information. This patch solves this by looking at all incoming ARP packets, and checking if the source IP address is one of the source addresses stored in the rx_hashtbl. If it is, but the MAC addresses differ, the corresponding hash table entries are removed. Thus, when an IP address is migrated, the first ARP broadcast by its new owner will purge the offending entries of rx_hashtbl. The hash table is hashed by ip_dst. To be able to do the above check efficiently (not walking the whole hash table), we need a reverse mapping (by ip_src). I added three new members in struct rlb_client_info: rx_hashtbl[x].src_first will point to the start of a list of entries for which hash(ip_src) == x. The list is linked with src_next and src_prev. When an incoming ARP packet arrives at rlb_arp_recv() rlb_purge_src_ip() can quickly walk only the entries on the corresponding lists, i.e. the entries that are likely to contain the offending IP address. To avoid confusion, I renamed these existing fields of struct rlb_client_info: next -> used_next prev -> used_prev rx_hashtbl_head -> rx_hashtbl_used_head (The current linked list is _not_ a list of hash table entries with colliding ip_dst. It's a list of entries that are being used; its purpose is to avoid walking the whole hash table when looking for used entries.) Signed-off-by: Jiri Bohac <jbohac@suse.cz> Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | bonding: rlb mode of bond should not alter ARP originating via bridgezheng.li2012-11-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not modify or load balance ARP packets passing through balance-alb mode (wherein the ARP did not originate locally, and arrived via a bridge). Modifying pass-through ARP replies causes an incorrect MAC address to be placed into the ARP packet, rendering peers unable to communicate with the actual destination from which the ARP reply originated. Load balancing pass-through ARP requests causes an entry to be created for the peer in the rlb table, and bond_alb_monitor will occasionally issue ARP updates to all peers in the table instrucing them as to which MAC address they should communicate with; this occurs when some event sets rx_ntt. In the bridged case, however, the MAC address used for the update would be the MAC of the slave, not the actual source MAC of the originating destination. This would render peers unable to communicate with the destinations beyond the bridge. Signed-off-by: Zheng Li <zheng.x.li@oracle.com> Cc: Jay Vosburgh <fubar@us.ibm.com> Cc: Andy Gospodarek <andy@greyhouse.net> Cc: "David S. Miller" <davem@davemloft.net> Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 'master' of ↵David S. Miller2012-11-30
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jesse/openvswitch Conflicts: net/ipv6/exthdrs_core.c Jesse Gross says: ==================== This series of improvements for 3.8/net-next contains four components: * Support for modifying IPv6 headers * Support for matching and setting skb->mark for better integration with things like iptables * Ability to recognize the EtherType for RARP packets * Two small performance enhancements The movement of ipv6_find_hdr() into exthdrs_core.c causes two small merge conflicts. I left it as is but can do the merge if you want. The conflicts are: * ipv6_find_hdr() and ipv6_find_tlv() were both moved to the bottom of exthdrs_core.c. Both should stay. * A new use of ipv6_find_hdr() was added to net/netfilter/ipvs/ip_vs_core.c after this patch. The IPVS user has two instances of the old constant name IP6T_FH_F_FRAG which has been renamed to IP6_FH_F_FRAG. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * | openvswitch: Use RCU callback when detaching netdevices.Jesse Gross2012-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, each time a device is detached from an OVS datapath we call synchronize RCU before freeing associated data structures. However, if a bridge is deleted (which detaches all ports) when many devices are connected then there can be a long delay. This switches to use call_rcu() to group the cost together. Reported-by: Justin Pettit <jpettit@nicira.com> Signed-off-by: Jesse Gross <jesse@nicira.com>
| * | openvswitch: add skb mark matching and set actionAnsis Atteka2012-11-26
| | | | | | | | | | | | | | | | | | | | | This patch adds support for skb mark matching and set action. Signed-off-by: Ansis Atteka <aatteka@nicira.com> Signed-off-by: Jesse Gross <jesse@nicira.com>
| * | net: openvswitch: use this_cpu_ptr per-cpu helperShan Wei2012-11-16
| | | | | | | | | | | | | | | | | | | | | | | | just use more faster this_cpu_ptr instead of per_cpu_ptr(p, smp_processor_id()); Signed-off-by: Shan Wei <davidshan@tencent.com> Reviewed-by: Christoph Lameter <cl@linux.com> Signed-off-by: Jesse Gross <jesse@nicira.com>
| * | openvswitch: add ipv6 'set' actionAnsis Atteka2012-11-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds ipv6 set action functionality. It allows to change traffic class, flow label, hop-limit, ipv6 source and destination address fields. Signed-off-by: Ansis Atteka <aatteka@nicira.com> Signed-off-by: Jesse Gross <jesse@nicira.com>
| * | ipv6: improve ipv6_find_hdr() to skip empty routing headersAnsis Atteka2012-11-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch prepares ipv6_find_hdr() function so that it could be able to skip routing headers, where segements_left is 0. This is required to handle multiple routing header case correctly when changing IPv6 addresses. Signed-off-by: Ansis Atteka <aatteka@nicira.com> Signed-off-by: Jesse Gross <jesse@nicira.com>
| * | ipv6: Move ipv6_find_hdr() out of Netfilter code.Jesse Gross2012-11-09
| | | | | | | | | | | | | | | | | | | | | Open vSwitch will soon also use ipv6_find_hdr() so this moves it out of Netfilter-specific code into a more common location. Signed-off-by: Jesse Gross <jesse@nicira.com>
| * | openvswitch: Process RARP packets with ethertype 0x8035 similar to ARP packets.Mehak Mahajan2012-11-02
| | | | | | | | | | | | | | | | | | | | | | | | With this commit, OVS will match the data in the RARP packets having ethertype 0x8035, in the same way as the data in the ARP packets. Signed-off-by: Mehak Mahajan <mmahajan@nicira.com> Signed-off-by: Jesse Gross <jesse@nicira.com>
* | | core: make GRO methods static.Rami Rosen2012-11-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch changes three methods to be static and removes their EXPORT_SYMBOLs in core/dev.c and their external declaration in netdevice.h. The methods, dev_gro_receive(), napi_frags_finish() and napi_skb_finish(), which are in the GRO rx path, are not used outside core/dev.c. Signed-off-by: Rami Rosen <ramirose@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | doc: make the description of how tcp_ecn works more explicit and clearRick Jones2012-11-29
| | | | | | | | | | | | | | | | | | | | | Make the description of how tcp_ecn works a bit more explicit and clear. Signed-off-by: Rick Jones <rick.jones2@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2012-11-29
|\ \ \ | |_|/ |/| | | | | Signed-off-by: David S. Miller <davem@davemloft.net>
| * | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds2012-11-29
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull networking fixes from David Miller: "Some more fixes trickled in over the past few days: 1) PIM device names can overflow the IFNAMSIZ buffer unless we properly limit the allowed indexes, fix from Eric Dumazet. 2) Under heavy load we can OOPS in icmp reply processing due to an unchecked inet_putpeer() call. Fix from Neal Cardwell. 3) SCTP round trip calculations need to use 64-bit math to avoid overflows, fix from Schoch Christian. 4) Fix a memory leak and an error return flub in SCTP and IRDA triggerable by userspace. Fix from Tommi Rantala and found by the syscall fuzzer (trinity). 5) MLX4 driver gives bogus size to memcpy() call, fix from Amir Vadai. 6) Fix length calculation in VHOST descriptor translation, from Michael S Tsirkin. 7) Ambassador ATM driver loops forever while loading firmware, fix from Dan Carpenter. 8) Over MTU packets in openvswitch warn about wrong device, fix from Jesse Gross. 9) Netfilter IPSET's netlink code can overrun a string buffer because it's not properly limited to IFNAMSIZ. Fix from Florian Westphal. 10) PCAN USB driver sets wrong timestamp in SKB, from Oliver Hartkopp. 11) Make sure the RX ifindex always has a valid value in the CAN BCM driver, even if we haven't received a frame yet. Fix also from Oliver Hartkopp." * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: team: fix hw_features setup atm: forever loop loading ambassador firmware vhost: fix length for cross region descriptor irda: irttp: fix memory leak in irttp_open_tsap() error path net: qmi_wwan: add Huawei E173 net/mlx4_en: Can set maxrate only for TC0 sctp: Error in calculation of RTTvar sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails net: ipmr: limit MRT_TABLE identifiers ipv4: avoid passing NULL to inet_putpeer() in icmpv4_xrlim_allow() can: bcm: initialize ifindex for timeouts without previous frame reception can: peak_usb: fix hwtstamp assignment netfilter: ipset: fix netiface set name overflow openvswitch: Store flow key len if ARP opcode is not request or reply. openvswitch: Print device when warning about over MTU packets.
| | * | Merge branch 'fixes' of ↵David S. Miller2012-11-28
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jesse/openvswitch Two small openswitch fixes from Jesse Gross. Signed-off-by: David S. Miller <davem@davemloft.net>
| | | * openvswitch: Store flow key len if ARP opcode is not request or reply.Mehak Mahajan2012-10-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We currently only extract the ARP payload if the opcode indicates that it is a request or reply. However, we also only set the key length in these situations even though it should still be possible to match on the opcode. There's no real reason to restrict the ARP opcode since all have the same format so this simply removes the check. Signed-off-by: Mehak Mahajan <mmahajan@nicira.com> Signed-off-by: Jesse Gross <jesse@nicira.com>
| | | * openvswitch: Print device when warning about over MTU packets.Jesse Gross2012-10-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If an attempt is made to transmit a packet that is over the device's MTU then we log it using the datapath's name. However, it is much more helpful to use the device name instead. Signed-off-by: Jesse Gross <jesse@nicira.com>
| | * | team: fix hw_features setupJiri Pirko2012-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do this in the same way bonding does. This fixed setup resolves performance issues when using some cards with certain offloading. Signed-off-by: Jiri Pirko <jiri@resnulli.us> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | atm: forever loop loading ambassador firmwareDan Carpenter2012-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There was a forever loop introduced here when we converted this to request_firmware() back in 2008. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Chas Williams <chas@cmf.nrl.navy.mil> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | Merge branch 'master' of git://1984.lsi.us.es/nfDavid S. Miller2012-11-28
| | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | An interface name overflow fix in netfilter via Pablo Neira Ayuso. Signed-off-by: David S. Miller <davem@davemloft.net>
| | | * | netfilter: ipset: fix netiface set name overflowFlorian Westphal2012-11-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | attribute is copied to IFNAMSIZ-size stack variable, but IFNAMSIZ is smaller than IPSET_MAXNAMELEN. Fortunately nfnetlink needs CAP_NET_ADMIN. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| | * | | vhost: fix length for cross region descriptorMichael S. Tsirkin2012-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a single descriptor crosses a region, the second chunk length should be decremented by size translated so far, instead it includes the full descriptor length. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | irda: irttp: fix memory leak in irttp_open_tsap() error pathTommi Rantala2012-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cleanup the memory we allocated earlier in irttp_open_tsap() when we hit this error path. The leak goes back to at least 1da177e4 ("Linux-2.6.12-rc2"). Discovered with Trinity (the syscall fuzzer). Signed-off-by: Tommi Rantala <tt.rantala@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | net: qmi_wwan: add Huawei E173Bjørn Mork2012-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Huawei E173 is a QMI/wwan device which normally appear as 12d1:1436 in Linux. The descriptors displayed in that mode will be picked up by cdc_ether. But the modem has another mode with a different device ID and a slightly different set of descriptors. This is the mode used by Windows like this: 3Modem: USB\VID_12D1&PID_140C&MI_00\6&3A1D2012&0&0000 Networkcard: USB\VID_12D1&PID_140C&MI_01\6&3A1D2012&0&0001 Appli.Inter: USB\VID_12D1&PID_140C&MI_02\6&3A1D2012&0&0002 PC UI Inter: USB\VID_12D1&PID_140C&MI_03\6&3A1D2012&0&0003 Reported-by: Thomas Schäfer <tschaefer@t-online.de> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | net/mlx4_en: Can set maxrate only for TC0Amir Vadai2012-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Had a typo in memcpy. Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | sctp: Error in calculation of RTTvarSchoch Christian2012-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The calculation of RTTVAR involves the subtraction of two unsigned numbers which may causes rollover and results in very high values of RTTVAR when RTT > SRTT. With this patch it is possible to set RTOmin = 1 to get the minimum of RTO at 4 times the clock granularity. Change Notes: v2) *Replaced abs() by abs64() and long by __s64, changed patch description. Signed-off-by: Christian Schoch <e0326715@student.tuwien.ac.at> CC: Vlad Yasevich <vyasevich@gmail.com> CC: Sridhar Samudrala <sri@us.ibm.com> CC: Neil Horman <nhorman@tuxdriver.com> CC: linux-sctp@vger.kernel.org Acked-by: Vlad Yasevich <vyasevich@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscallTommi Rantala2012-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Consider the following program, that sets the second argument to the sendto() syscall incorrectly: #include <string.h> #include <arpa/inet.h> #include <sys/socket.h> int main(void) { int fd; struct sockaddr_in sa; fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/); if (fd < 0) return 1; memset(&sa, 0, sizeof(sa)); sa.sin_family = AF_INET; sa.sin_addr.s_addr = inet_addr("127.0.0.1"); sa.sin_port = htons(11111); sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa)); return 0; } We get -ENOMEM: $ strace -e sendto ./demo sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 ENOMEM (Cannot allocate memory) Propagate the error code from sctp_user_addto_chunk(), so that we will tell user space what actually went wrong: $ strace -e sendto ./demo sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EFAULT (Bad address) Noticed while running Trinity (the syscall fuzzer). Signed-off-by: Tommi Rantala <tt.rantala@gmail.com> Acked-by: Vlad Yasevich <vyasevich@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space ↵Tommi Rantala2012-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fails Trinity (the syscall fuzzer) discovered a memory leak in SCTP, reproducible e.g. with the sendto() syscall by passing invalid user space pointer in the second argument: #include <string.h> #include <arpa/inet.h> #include <sys/socket.h> int main(void) { int fd; struct sockaddr_in sa; fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/); if (fd < 0) return 1; memset(&sa, 0, sizeof(sa)); sa.sin_family = AF_INET; sa.sin_addr.s_addr = inet_addr("127.0.0.1"); sa.sin_port = htons(11111); sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa)); return 0; } As far as I can tell, the leak has been around since ~2003. Signed-off-by: Tommi Rantala <tt.rantala@gmail.com> Acked-by: Vlad Yasevich <vyasevich@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | net: ipmr: limit MRT_TABLE identifiersEric Dumazet2012-11-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Name of pimreg devices are built from following format : char name[IFNAMSIZ]; // IFNAMSIZ == 16 sprintf(name, "pimreg%u", mrt->id); We must therefore limit mrt->id to 9 decimal digits or risk a buffer overflow and a crash. Restrict table identifiers in [0 ... 999999999] interval. Reported-by: Chen Gang <gang.chen@asianux.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | ipv4: avoid passing NULL to inet_putpeer() in icmpv4_xrlim_allow()Neal Cardwell2012-11-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | inet_getpeer_v4() can return NULL under OOM conditions, and while inet_peer_xrlim_allow() is OK with a NULL peer, inet_putpeer() will crash. This code path now uses the same idiom as the others from: 1d861aa4b3fb08822055345f480850205ffe6170 ("inet: Minimize use of cached route inetpeer."). Signed-off-by: Neal Cardwell <ncardwell@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | can: bcm: initialize ifindex for timeouts without previous frame receptionOliver Hartkopp2012-11-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Set in the rx_ifindex to pass the correct interface index in the case of a message timeout detection. Usually the rx_ifindex value is set at receive time. But when no CAN frame has been received the RX_TIMEOUT notification did not contain a valid value. Cc: linux-stable <stable@vger.kernel.org> Reported-by: Andre Naujoks <nautsch2@googlemail.com> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
| | * | | can: peak_usb: fix hwtstamp assignmentOliver Hartkopp2012-11-26
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The skb->tstamp is set to the hardware timestamp when available in the USB urb message. This leads to user visible timestamps which contain the 'uptime' of the USB adapter - and not the usual system generated timestamp. Fix this wrong assignment by applying the available hardware timestamp to the skb_shared_hwtstamps data structure - which is intended for this purpose. Cc: linux-stable <stable@vger.kernel.org> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
| * | | percpu-rwsem: use synchronize_sched_expeditedMikulas Patocka2012-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use synchronize_sched_expedited() instead of synchronize_sched() to improve mount speed. This patch improves mount time from 0.500s to 0.013s for Jeff's test-case. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Reported-and-tested-by: Jeff Chua <jeff.chua.linux@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| * | | Merge branch 'v4l_for_linus' of ↵Linus Torvalds2012-11-27
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "For some media fixes: - dvb_usb_v2: some fixes at the core - Some fixes on some embedded drivers: soc_camera, adv7604, omap3isp, exynos/s5p - Several Exynos4/5 camera fixes - a fix at stv0900 driver - a few USB ID additions to detect more variants of rtl28xxu-based sticks" * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (25 commits) [media] rtl28xxu: 0ccd:00d7 TerraTec Cinergy T Stick+ [media] rtl28xxu: 1d19:1102 Dexatek DK mini DVB-T Dongle [media] mt9v022: fix the V4L2_CID_EXPOSURE control [media] mx2_camera: fix missing unlock on error in mx2_start_streaming() [media] media: omap1_camera: fix const cropping related warnings [media] media: mx1_camera: use the default .set_crop() implementation [media] media: mx2_camera: fix const cropping related warnings [media] media: mx3_camera: fix const cropping related warnings [media] media: pxa_camera: fix const cropping related warnings [media] media: sh_mobile_ceu_camera: fix const cropping related warnings [media] media: sh_vou: fix const cropping related warnings [media] adv7604: restart STDI once if format is not found [media] adv7604: use presets where possible [media] adv7604: Replace prim_mode by mode [media] adv7604: cleanup references [media] dvb_usb_v2: switch interruptible mutex to normal [media] dvb_usb_v2: fix pid_filter callback error logging [media] exynos-gsc: change driver compatible string [media] omap3isp: Fix warning caused by bad subdev events operations prototypes [media] omap3isp: video: Fix warning caused by bad vidioc_s_crop prototype ...
| | * | | [media] rtl28xxu: 0ccd:00d7 TerraTec Cinergy T Stick+Andrew Karpow2012-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | added usb-id as driver supports the stick Signed-off-by: Andrew Karpow <andy@mailbox.tu-berlin.de> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| | * | | [media] rtl28xxu: 1d19:1102 Dexatek DK mini DVB-T DongleAntti Palosaari2012-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add new USB ID as driver supports it. Reported-by: Hubert Lin <hubertwslin@gmail.com> Tested-by: Hubert Lin <hubertwslin@gmail.com> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| | * | | [media] mt9v022: fix the V4L2_CID_EXPOSURE controlAnatolij Gustschin2012-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the MT9V022_TOTAL_SHUTTER_WIDTH register is controlled in manual mode by V4L2_CID_EXPOSURE control, it shouldn't be written directly in mt9v022_s_crop(). In manual mode this register should be set to the V4L2_CID_EXPOSURE control value. Changing this register directly and outside of the actual control function means that the register value is not in sync with the corresponding control value. Thus, the following problem is observed: - setting this control initially succeeds - VIDIOC_S_CROP ioctl() overwrites the MT9V022_TOTAL_SHUTTER_WIDTH register - setting this control to the same value again doesn't result in setting the register since the control value was previously cached and doesn't differ Remove MT9V022_TOTAL_SHUTTER_WIDTH register setting in mt9v022_s_crop() and add a comment explaining why it is not needed in manual mode. Signed-off-by: Anatolij Gustschin <agust@denx.de> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| | * | | [media] mx2_camera: fix missing unlock on error in mx2_start_streaming()Wei Yongjun2012-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the missing unlock on the error handle path in function mx2_start_streaming(). Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| | * | | [media] media: omap1_camera: fix const cropping related warningsGuennadi Liakhovetski2012-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A recent commit "[media] v4l2: make vidioc_s_crop const" introduced warnings in omap1_camera. Fix them by adjusting a function declaration. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| | * | | [media] media: mx1_camera: use the default .set_crop() implementationGuennadi Liakhovetski2012-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | .set_crop() implementation in mx1_camera is identical with the default. Remove the copy to switch to using the default stab. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| | * | | [media] media: mx2_camera: fix const cropping related warningsGuennadi Liakhovetski2012-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A recent commit "[media] v4l2: make vidioc_s_crop const" introduced warnings in mx2_camera. Fix them by cleanly separating writable and read-only variables in cropping operations. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
generated by cgit v1.2.2 (git 2.25.0) at 2025-02-15 06:10:25 -0500