From 338f7566e5c26a9547e25d54863ae4e4e5c856d1 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Tue, 16 May 2006 15:02:12 -0700 Subject: [PKT_SCHED]: Potential jiffy wrap bug in dev_watchdog(). There is a potential jiffy wraparound bug in the transmit watchdog that is easily avoided by using time_after(). Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller --- net/sched/sch_generic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 31eb83717c..138ea92ed2 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -193,8 +193,10 @@ static void dev_watchdog(unsigned long arg) netif_running(dev) && netif_carrier_ok(dev)) { if (netif_queue_stopped(dev) && - (jiffies - dev->trans_start) > dev->watchdog_timeo) { - printk(KERN_INFO "NETDEV WATCHDOG: %s: transmit timed out\n", dev->name); + time_after(jiffies, dev->trans_start + dev->watchdog_timeo)) { + + printk(KERN_INFO "NETDEV WATCHDOG: %s: transmit timed out\n", + dev->name); dev->tx_timeout(dev); } if (!mod_timer(&dev->watchdog_timer, jiffies + dev->watchdog_timeo)) -- cgit v1.2.2 From 53d42f541278b6c97724465b19bae4730d7a85c8 Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Tue, 16 May 2006 15:07:28 -0700 Subject: [IPX]: Correct argument type of ipxrtr_delete(). A single caller passes __u32. Inside function "net" is compared with __u32 (__be32 really, just wasn't annotated). Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller --- net/ipx/ipx_route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipx/ipx_route.c b/net/ipx/ipx_route.c index 67774448ef..a394c6fe19 100644 --- a/net/ipx/ipx_route.c +++ b/net/ipx/ipx_route.c @@ -119,7 +119,7 @@ out: return rc; } -static int ipxrtr_delete(long net) +static int ipxrtr_delete(__u32 net) { struct ipx_route *r, *tmp; int rc; -- cgit v1.2.2 From 4ac396c0467993853d3d58c0975151515700c07b Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Tue, 16 May 2006 15:17:49 -0700 Subject: [IPX]: Correct return type of ipx_map_frame_type(). Casting BE16 to int and back may or may not work. Correct, to be sure. Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller --- net/ipx/af_ipx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c index 2dbf134d52..811d998725 100644 --- a/net/ipx/af_ipx.c +++ b/net/ipx/af_ipx.c @@ -944,9 +944,9 @@ out: return rc; } -static int ipx_map_frame_type(unsigned char type) +static __be16 ipx_map_frame_type(unsigned char type) { - int rc = 0; + __be16 rc = 0; switch (type) { case IPX_FRAME_ETHERII: rc = htons(ETH_P_IPX); break; -- cgit v1.2.2 From 6599519e9c6c56ff0f9a4ffd53f90c5b65b902f4 Mon Sep 17 00:00:00 2001 From: Adrian Bunk Date: Tue, 16 May 2006 15:23:40 -0700 Subject: [TR]: Remove an unused export. This patch removes the unused EXPORT_SYMBOL(tr_source_route). (Note, the usage in net/llc/llc_output.c can't be modular.) Signed-off-by: Adrian Bunk Signed-off-by: David S. Miller --- net/802/tr.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/802/tr.c b/net/802/tr.c index afd8385c0c..e9dc803f2f 100644 --- a/net/802/tr.c +++ b/net/802/tr.c @@ -643,6 +643,5 @@ static int __init rif_init(void) module_init(rif_init); -EXPORT_SYMBOL(tr_source_route); EXPORT_SYMBOL(tr_type_trans); EXPORT_SYMBOL(alloc_trdev); -- cgit v1.2.2 From d8fd0a73169e90022dc3ccf3083ca24573b44b5c Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Tue, 16 May 2006 15:24:41 -0700 Subject: [IPV6]: Endian fix in net/ipv6/netfilter/ip6t_eui64.c:match(). Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller --- net/ipv6/netfilter/ip6t_eui64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c index 94dbdb8b45..4f6b84c8f4 100644 --- a/net/ipv6/netfilter/ip6t_eui64.c +++ b/net/ipv6/netfilter/ip6t_eui64.c @@ -40,7 +40,7 @@ match(const struct sk_buff *skb, memset(eui64, 0, sizeof(eui64)); - if (eth_hdr(skb)->h_proto == ntohs(ETH_P_IPV6)) { + if (eth_hdr(skb)->h_proto == htons(ETH_P_IPV6)) { if (skb->nh.ipv6h->version == 0x6) { memcpy(eui64, eth_hdr(skb)->h_source, 3); memcpy(eui64 + 5, eth_hdr(skb)->h_source + 3, 3); -- cgit v1.2.2 From 8872d8e1c4311dd7e5086975df9c76120a0be83b Mon Sep 17 00:00:00 2001 From: "Angelo P. Castellani" Date: Tue, 16 May 2006 21:42:11 -0700 Subject: [TCP]: reno sacked_out count fix From: "Angelo P. Castellani" Using NewReno, if a sk_buff is timed out and is accounted as lost_out, it should also be removed from the sacked_out. This is necessary because recovery using NewReno fast retransmit could take up to a lot RTTs and the sk_buff RTO can expire without actually being really lost. left_out = sacked_out + lost_out in_flight = packets_out - left_out + retrans_out Using NewReno without this patch, on very large network losses, left_out becames bigger than packets_out + retrans_out (!!). For this reason unsigned integer in_flight overflows to 2^32 - something. Signed-off-by: David S. Miller --- net/ipv4/tcp_input.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 9f0cca4c4f..4a538bc168 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -1662,6 +1662,8 @@ static void tcp_update_scoreboard(struct sock *sk, struct tcp_sock *tp) if (!(TCP_SKB_CB(skb)->sacked&TCPCB_TAGBITS)) { TCP_SKB_CB(skb)->sacked |= TCPCB_LOST; tp->lost_out += tcp_skb_pcount(skb); + if (IsReno(tp)) + tcp_remove_reno_sacks(sk, tp, tcp_skb_pcount(skb) + 1); /* clear xmit_retrans hint */ if (tp->retransmit_skb_hint && -- cgit v1.2.2