aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-02-18Merge tag 'ext4_for_linus_stable' of ↵Linus Torvalds6-23/+43
git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Miscellaneous ext4 bug fixes for v3.14" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: jbd2: fix use after free in jbd2_journal_start_reserved() ext4: don't leave i_crtime.tv_sec uninitialized ext4: fix online resize with a non-standard blocks per group setting ext4: fix online resize with very large inode tables ext4: don't try to modify s_flags if the the file system is read-only ext4: fix error paths in swap_inode_boot_loader() ext4: fix xfstest generic/299 block validity failures
2014-02-18ahci: disable NCQ on Samsung pci-e SSDs on macbooksLevente Kurusa1-0/+14
Samsung's pci-e SSDs with device ID 0x1600 which are found on some macbooks time out on NCQ commands. Blacklist NCQ on the device so that the affected machines can at least boot. Original-patch-by: Levente Kurusa <[email protected]> Signed-off-by: Tejun Heo <[email protected]> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=60731 Cc: [email protected]
2014-02-18drm/ttm: Fix memory leak in ttm_agp_backend.cMasanari Iida1-0/+1
This patch fix a memory leak found by cppcheck. [drivers/gpu/drm/ttm/ttm_agp_backend.c:129]: (error) Memory leak: agp_be Signed-off-by: Masanari Iida <[email protected]> Reviewed-by: Thomas Hellstrom <[email protected]>
2014-02-18drm/ttm: declare 'struct device' in ttm_page_alloc.hAlexandre Courbot1-0/+2
Declare 'struct device' explicitly in ttm_page_alloc.h as this file does not include any file declaring it. This removes the following warning: warning: 'struct device' declared inside parameter list Signed-off-by: Alexandre Courbot <[email protected]> Reviewed-by: Thierry Reding <[email protected]>
2014-02-18Merge branch 'drm-nouveau-next' of ↵Dave Airlie14-12/+69
git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes Nothing too exciting, mostly fixes for ancient boards, but a pretty important fix for DP on some systems. Thanks, * 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6: drm/nouveau: fix TTM_PL_TT memtype on pre-nv50 drm/nv50/disp: use correct register to determine DP display bpp drm/nouveau/fb: use correct ram oclass for nv1a hardware drm/nv50/gr: add missing nv_error parameter priv drm/nouveau: fix ENG_RUNLIST register address drm/nv4c/bios: disallow retrieving from prom on nv4x igp's drm/nv4c/vga: decode register is in a different place on nv4x igp's drm/nv4c/mc: nv4x igp's have a different msi rearm register drm/nouveau: set irq_enabled manually
2014-02-18Merge tag 'drm-intel-fixes-2014-02-14' of ↵Dave Airlie4-6/+49
ssh://git.freedesktop.org/git/drm-intel into drm-fixes 3 fixes plus 1 prep patch, all four cc: stable. Jani will take over from here and the plan is that he'll do 3.14-fixes for the entire release just to work things out a bit. * tag 'drm-intel-fixes-2014-02-14' of ssh://git.freedesktop.org/git/drm-intel: drm/i915/dp: add native aux defer retry limit drm/i915/dp: increase native aux defer retry timeout drm/i915: Prevent MI_DISPLAY_FLIP straddling two cachelines on IVB drm/i915: Add intel_ring_cachline_align()
2014-02-18Merge branch 'tda998x-fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-cubox ↵Dave Airlie1-1/+3
into drm-fixes fix for leak in tda998x * 'tda998x-fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-cubox: drm/i2c: tda998x: Fix memory leak in tda998x_encoder_init error path.
2014-02-17jbd2: fix use after free in jbd2_journal_start_reserved()Dan Carpenter1-2/+4
If start_this_handle() fails then it leads to a use after free of "handle". Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: "Theodore Ts'o" <[email protected]> Cc: [email protected]
2014-02-18drm/nouveau: fix TTM_PL_TT memtype on pre-nv50Ilia Mirkin1-1/+1
Commit a55409066 ("drm/nv50-: map TTM_PL_SYSTEM through a BAR for CPU access") made it possible to work with tiled memory. However mem->mm_node is not a nouveau_mem for AGP-using pre-NV50 cards, but a drm_mm_node, as created by the ttm_bo_manager_func. As such, extend the untiled check to explicitly include all pre-nv50 cards. Reported-by: Ronald <[email protected]> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74613 Signed-off-by: Ilia Mirkin <[email protected]> Tested-by: Ronald Uitermark <[email protected]> Acked-by: Maarten Lankhorst <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nv50/disp: use correct register to determine DP display bppIlia Mirkin1-1/+1
Commit 0a0afd282f ("drm/nv50-/disp: move DP link training to core and train from supervisor") added code that uses the wrong register for computing the display bpp, used for bandwidth calculation. Adjust to use the same register as used by exec_clkcmp and nv50_disp_intr_unk20_2_dp. Reported-by: Torsten Wagner <[email protected]> Reported-by: Michael Gulick <[email protected]> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=67628 Cc: [email protected] # 3.9+ Signed-off-by: Ilia Mirkin <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nouveau/fb: use correct ram oclass for nv1a hardwareEmil Velikov1-1/+1
commit 8613e7314ac254fdd67ed46192f021d76141e4c9 Author: Ben Skeggs <[email protected]> Date: Mon Oct 21 08:50:25 2013 +1000 drm/nouveau/fb: remove ram oclass argument from base fb constructor Introduced a unfortunate regression by using nv10 ram oclass for nv1a hardware, causing corruption and eventually system lockup. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74866 Reported-by: John F. Godfrey <[email protected]> Signed-off-by: Emil Velikov <[email protected]> Cc: [email protected] # 3.13+ Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nv50/gr: add missing nv_error parameter privIlia Mirkin1-1/+1
Commit ea7dce901 ("drm/nv50/gr: print mpc trap name when it's not an mp trap") added an nv_error call that was missing the priv parameter. This causes GPFs if the error is ever hit. Signed-off-by: Ilia Mirkin <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nouveau: fix ENG_RUNLIST register addressAlexandre Courbot1-1/+1
Address of the ENG_RUNLIST register should be 0x002284 + (engine * 8), not 0x002284 + (engine * 4). Signed-off-by: Alexandre Courbot <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nv4c/bios: disallow retrieving from prom on nv4x igp'sIlia Mirkin1-0/+4
Suggested-by: Marcin Kościelnicki <[email protected]> Signed-off-by: Ilia Mirkin <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nv4c/vga: decode register is in a different place on nv4x igp'sIlia Mirkin1-1/+3
Suggested-by: Marcin Kościelnicki <[email protected]> Signed-off-by: Ilia Mirkin <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nv4c/mc: nv4x igp's have a different msi rearm registerIlia Mirkin6-6/+54
See https://bugs.freedesktop.org/show_bug.cgi?id=74492 Reported-by: Ronald <[email protected]> Suggested-by: Marcin Kościelnicki <[email protected]> Signed-off-by: Ilia Mirkin <[email protected]> Signed-off-by: Ben Skeggs <[email protected]>
2014-02-18drm/nouveau: set irq_enabled manuallyIlia Mirkin1-0/+3
Since commit 0fa9061ae8c ("drm/nouveau/mc: handle irq-related setup ourselves"), drm_device->irq_enabled remained unset. This is needed in order to properly wait for a vblank event in the generic drm code. See https://bugs.freedesktop.org/show_bug.cgi?id=74195 Reported-by: Jan Janecek <[email protected]> Signed-off-by: Ilia Mirkin <[email protected]> Cc: [email protected] # 3.10+ Signed-off-by: Ben Skeggs <[email protected]>
2014-02-17ARM: 7957/1: add DSB after icache flush in __flush_icache_all()Vinayak Kale1-0/+1
Add DSB after icache flush to complete the cache maintenance operation. Signed-off-by: Vinayak Kale <[email protected]> Acked-by: Catalin Marinas <[email protected]> Cc: <[email protected]> Signed-off-by: Russell King <[email protected]>
2014-02-17Fix uses of dma_max_pfn() when converting to a limiting addressRussell King2-2/+2
We must use a 64-bit for this, otherwise overflowed bits get lost, and that can result in a lower than intended value set. Fixes: 8e0cb8a1f6ac ("ARM: 7797/1: mmc: Use dma_max_pfn(dev) helper for bounce_limit calculations") Fixes: 7d35496dd982 ("ARM: 7796/1: scsi: Use dma_max_pfn(dev) helper for bounce_limit calculations") Tested-Acked-by: Santosh Shilimkar <[email protected]> Reviewed-by: Ulf Hansson <[email protected]> Signed-off-by: Russell King <[email protected]>
2014-02-17ipv4: fix counter in_slow_totDuan Jiong1-2/+2
since commit 89aef8921bf("ipv4: Delete routing cache."), the counter in_slow_tot can't work correctly. The counter in_slow_tot increase by one when fib_lookup() return successfully in ip_route_input_slow(), but actually the dst struct maybe not be created and cached, so we can increase in_slow_tot after the dst struct is created. Signed-off-by: Duan Jiong <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-02-17Merge branch 'for-linus' of ↵Linus Torvalds7-37/+96
git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client Pull Ceph fixes from Sage Weil: "We have some patches fixing up ACL support issues from Zheng and Guangliang and a mount option to enable/disable this support. (These fixes were somewhat delayed by the Chinese holiday.) There is also a small fix for cached readdir handling when directories are fragmented" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: fix __dcache_readdir() ceph: add acl, noacl options for cephfs mount ceph: make ceph_forget_all_cached_acls() static inline ceph: add missing init_acl() for mkdir() and atomic_open() ceph: fix ceph_set_acl() ceph: fix ceph_removexattr() ceph: remove xattr when null value is given to setxattr() ceph: properly handle XATTR_CREATE and XATTR_REPLACE
2014-02-17Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds10-28/+78
Pull CIFS fixes from Steve French: "Three cifs fixes, the most important fixing the problem with passing bogus pointers with writev (CVE-2014-0069). Two additional cifs fixes are still in review (including the fix for an append problem which Al also discovered)" * 'for-linus' of git://git.samba.org/sfrench/cifs-2.6: CIFS: Fix too big maxBuf size for SMB3 mounts cifs: ensure that uncached writes handle unmapped areas correctly [CIFS] Fix cifsacl mounts over smb2 to not call cifs
2014-02-17FS-Cache: Handle removal of unadded object to the fscache_object_list rb treeDavid Howells2-0/+8
When FS-Cache allocates an object, the following sequence of events can occur: -->fscache_alloc_object() -->cachefiles_alloc_object() [via cache->ops->alloc_object] <--[returns new object] -->fscache_attach_object() <--[failed] -->cachefiles_put_object() [via cache->ops->put_object] -->fscache_object_destroy() -->fscache_objlist_remove() -->rb_erase() to remove the object from fscache_object_list. resulting in a crash in the rbtree code. The problem is that the object is only added to fscache_object_list on the success path of fscache_attach_object() where it calls fscache_objlist_add(). So if fscache_attach_object() fails, the object won't have been added to the objlist rbtree. We do, however, unconditionally try to remove the object from the tree. Thanks to NeilBrown for finding this and suggesting this solution. Reported-by: NeilBrown <[email protected]> Signed-off-by: David Howells <[email protected]> Tested-by: (a customer of) NeilBrown <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2014-02-17reiserfs: fix utterly brain-damaged indentation.Dave Jones1-700/+195
This has been this way for years, and every time I stumble across it I lose my lunch. After coming across it for the nth time in the Coverity results, I had to overcome the bystander effect and do something about it. This ignores the 79 column limit in favor of making it look like C instead of gibberish. The correct thing to do here would be to lose some of the indentation by breaking this function up into several smaller ones. I might do that at some point if I have the stomach to look at this again. (Also some of those overlong ternary operations would likely be more readable as regular if's) Signed-off-by: Dave Jones <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2014-02-17irtty-sir.c: Do not set_termios() on irtty_close()Tommie Gannert1-1/+0
Issuing set_termios() from irtty_close() causes kernel Oops for unplugged usb-serial devices. Since no other tty_ldisc calls set_termios() on close and no tty driver seem to check if tty->device_data is NULL or not on entry to set_termios(), the only solution I can come up with is to remove the irtty_stop_receiver() call, which only updates termios. Signed-off-by: Tommie Gannert <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-02-17Merge branch 'master' of ↵John W. Linville9-16/+75
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2014-02-17Merge tag 'dma-buf-for-3.14' of ↵Linus Torvalds2-14/+13
git://git.kernel.org/pub/scm/linux/kernel/git/sumits/dma-buf Pull dma-buf fix from Sumit Semwal: "Just some debugfs output updates. There's another patch related to dma-buf, but it'll get upstreamed via Greg KH's pull request" * tag 'dma-buf-for-3.14' of git://git.kernel.org/pub/scm/linux/kernel/git/sumits/dma-buf: dma-buf: update debugfs output
2014-02-17Merge branch 'for-linus' of ↵Linus Torvalds4-1/+5
git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32 Pull AVR32 fixes from Hans-Christian Egtvedt. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32: avr32: add generic vga.h to Kbuild avr32: add generic ioremap_wc() definition in io.h avr32: Makefile: add '-D__linux__' flag for gcc-4.4.7 use avr32: fix missing module.h causing build failure in mimc200/fram.c
2014-02-17ceph: fix __dcache_readdir()Yan, Zheng1-1/+9
If directory is fragmented, readdir() read its dirfrags one by one. After reading all dirfrags, the corresponding dentries are sorted in (frag_t, off) order in the dcache. If dentries of a directory are all cached, __dcache_readdir() can use the cached dentries to satisfy readdir syscall. But when checking if a given dentry is after the position of readdir, __dcache_readdir() compares numerical value of frag_t directly. This is wrong, it should use ceph_frag_compare(). Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17ceph: add acl, noacl options for cephfs mountSage Weil1-4/+28
Make the 'acl' option dependent on having ACL support compiled in. Make the 'noacl' option work even without it so that one can always ask it to be off and not error out on mount when it is not supported. Signed-off-by: Guangliang Zhao <[email protected]> Signed-off-by: Sage Weil <[email protected]>
2014-02-17ceph: make ceph_forget_all_cached_acls() static inlineGuangliang Zhao2-6/+6
Signed-off-by: Guangliang Zhao <[email protected]> Reviewed-by: Alex Elder <[email protected]> Signed-off-by: Sage Weil <[email protected]>
2014-02-17ceph: add missing init_acl() for mkdir() and atomic_open()Yan, Zheng2-5/+9
Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17ceph: fix ceph_set_acl()Yan, Zheng1-5/+1
If acl is equivalent to file mode permission bits, ceph_set_acl() needs to remove any existing acl xattr. Use __ceph_setxattr() to handle both setting and removing acl xattr cases, it doesn't return -ENODATA when there is no acl xattr. Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17ceph: fix ceph_removexattr()Yan, Zheng1-1/+1
Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17ceph: remove xattr when null value is given to setxattr()Yan, Zheng2-4/+17
For the setxattr request, introduce a new flag CEPH_XATTR_REMOVE to distinguish null value case from the zero-length value case. Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17ceph: properly handle XATTR_CREATE and XATTR_REPLACEYan, Zheng1-12/+26
return -EEXIST if XATTR_CREATE is set and xattr alread exists. return -ENODATA if XATTR_REPLACE is set but xattr does not exist. Signed-off-by: Yan, Zheng <[email protected]>
2014-02-17Merge branch 'merge' of ↵Linus Torvalds18-91/+172
git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc Pull powerpc fixes from Ben Herrenschmidt: "Here are some more powerpc fixes for 3.14 The main one is a nasty issue with the NUMA balancing support which requires a small generic change and the addition of a new accessor to set _PAGE_NUMA. Both have been reviewed and acked by Mel and Rik. The changelog should have plenty of details but basically, without this fix, we get random user segfaults and/or corruptions due to missing TLB/hash flushes. Aneesh series of 3 patches fixes it. We have some vDSO vs. perf fixes from Anton, some small EEH fixes from Gavin, a ppc32 regression vs the stack overflow detector, and a fix for the way we handle PCIe host bridge speed settings on pseries (which is needed for proper operations of AMD graphics cards on Power8)" * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/eeh: Disable EEH on reboot powerpc/eeh: Cleanup on eeh_subsystem_enabled powerpc/powernv: Rework EEH reset powerpc: Use unstripped VDSO image for more accurate profiling data powerpc: Link VDSOs at 0x0 mm: Use ptep/pmdp_set_numa() for updating _PAGE_NUMA bit mm: Dirty accountable change only apply to non prot numa case powerpc/mm: Add new "set" flag argument to pte/pmd update function powerpc/pseries: Add Gen3 definitions for PCIE link speed powerpc/pseries: Fix regression on PCI link speed powerpc: Set the correct ksp_limit on ppc32 when switching to irq stack
2014-02-17printk: fix syslog() overflowing user bufferLinus Torvalds1-2/+0
This is not a buffer overflow in the traditional sense: we don't overflow any *kernel* buffers, but we do mis-count the amount of data we copy back to user space for the SYSLOG_ACTION_READ_ALL case. In particular, if the user buffer is too small to hold everything, and *if* there is a continuation line at just the right place, we can end up giving the user more data than he asked for. The reason is that we first count up the number of bytes all the log records contains, then we walk the records again until we've skipped the records at the beginning that won't fit, and then we walk the rest of the records and copy them to the user space buffer. And in between that "skip the initial records that won't fit" and the "copy the records that *will* fit to user space", we reset the 'prev' variable that contained the record information for the last record not copied. That meant that when we started copying to user space, we now had a different character count than what we had originally calculated in the first record walk-through. The fix is to simply not clear the 'prev' flags value (in both cases where we had the same logic: syslog_print_all and kmsg_dump_get_buffer: the latter is used for pstore-like dumping) Reported-and-tested-by: Debabrata Banerjee <[email protected]> Acked-by: Kay Sievers <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: Jeff Mahoney <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2014-02-17HID: hyperv: make sure input buffer is big enoughDavid Herrmann1-3/+8
We need at least HID_MAX_BUFFER_SIZE (4096) bytes as input buffer. HID core depends on this as it requires every input report to be at least as big as advertised. Signed-off-by: David Herrmann <[email protected]> Signed-off-by: K. Y. Srinivasan <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
2014-02-17HID: Bluetooth: hidp: make sure input buffers are big enoughDavid Herrmann2-2/+18
HID core expects the input buffers to be at least of size 4096 (HID_MAX_BUFFER_SIZE). Other sizes will result in buffer-overflows if an input-report is smaller than advertised. We could, like i2c, compute the biggest report-size instead of using HID_MAX_BUFFER_SIZE, but this will blow up if report-descriptors are changed after ->start() has been called. So lets be safe and just use the biggest buffer we have. Note that this adds an additional copy to the HIDP input path. If there is a way to make sure the skb-buf is big enough, we should use that instead. The best way would be to make hid-core honor the @size argument, though, that sounds easier than it is. So lets just fix the buffer-overflows for now and afterwards look for a faster way for all transport drivers. Signed-off-by: David Herrmann <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
2014-02-17bonding: 802.3ad: make aggregator_identifier bond-privateJiri Bohac2-4/+3
aggregator_identifier is used to assign unique aggregator identifiers to aggregators of a bond during device enslaving. aggregator_identifier is currently a global variable that is zeroed in bond_3ad_initialize(). This sequence will lead to duplicate aggregator identifiers for eth1 and eth3: create bond0 change bond0 mode to 802.3ad enslave eth0 to bond0 //eth0 gets agg id 1 enslave eth1 to bond0 //eth1 gets agg id 2 create bond1 change bond1 mode to 802.3ad enslave eth2 to bond1 //aggregator_identifier is reset to 0 //eth2 gets agg id 1 enslave eth3 to bond0 //eth3 gets agg id 2 Fix this by making aggregator_identifier private to the bond. Signed-off-by: Jiri Bohac <[email protected]> Acked-by: Veaceslav Falico <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-02-17usbnet: remove generic hard_header_len checkEmil Goode10-21/+45
This patch removes a generic hard_header_len check from the usbnet module that is causing dropped packages under certain circumstances for devices that send rx packets that cross urb boundaries. One example is the AX88772B which occasionally send rx packets that cross urb boundaries where the remaining partial packet is sent with no hardware header. When the buffer with a partial packet is of less number of octets than the value of hard_header_len the buffer is discarded by the usbnet module. With AX88772B this can be reproduced by using ping with a packet size between 1965-1976. The bug has been reported here: https://bugzilla.kernel.org/show_bug.cgi?id=29082 This patch introduces the following changes: - Removes the generic hard_header_len check in the rx_complete function in the usbnet module. - Introduces a ETH_HLEN check for skbs that are not cloned from within a rx_fixup callback. - For safety a hard_header_len check is added to each rx_fixup callback function that could be affected by this change. These extra checks could possibly be removed by someone who has the hardware to test. - Removes a call to dev_kfree_skb_any() and instead utilizes the dev->done list to queue skbs for cleanup. The changes place full responsibility on the rx_fixup callback functions that clone skbs to only pass valid skbs to the usbnet_skb_return function. Signed-off-by: Emil Goode <[email protected]> Reported-by: Igor Gnatenko <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-02-17NFSv4: Use the correct net namespace in nfs4_update_serverTrond Myklebust3-10/+12
We need to use the same net namespace that was used to resolve the hostname and sockaddr arguments. Fixes: 32e62b7c3ef09 (NFS: Add nfs4_update_server) Cc: Chuck Lever <[email protected]> Signed-off-by: Trond Myklebust <[email protected]>
2014-02-17gre: add link local route when local addr is anyNicolas Dichtel1-0/+2
This bug was reported by Steinar H. Gunderson and was introduced by commit f7cb8886335d ("sit/gre6: don't try to add the same route two times"). root@morgental:~# ip tunnel add foo mode gre remote 1.2.3.4 ttl 64 root@morgental:~# ip link set foo up mtu 1468 root@morgental:~# ip -6 route show dev foo fe80::/64 proto kernel metric 256 but after the above commit, no such route shows up. There is no link local route because dev->dev_addr is 0 (because local ipv4 address is 0), hence no link local address is configured. In this scenario, the link local address is added manually: 'ip -6 addr add fe80::1 dev foo' and because prefix is /128, no link local route is added by the kernel. Even if the right things to do is to add the link local address with a /64 prefix, we need to restore the previous behavior to avoid breaking userpace. Reported-by: Steinar H. Gunderson <[email protected]> Signed-off-by: Nicolas Dichtel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-02-17batman-adv: fix potential kernel paging error for unicast transmissionsAntonio Quartulli1-2/+7
batadv_send_skb_prepare_unicast(_4addr) might reallocate the skb's data. If it does then our ethhdr pointer is not valid anymore in batadv_send_skb_unicast(), resulting in a kernel paging error. Fixing this by refetching the ethhdr pointer after the potential reallocation. Signed-off-by: Linus Lüssing <[email protected]> Signed-off-by: Antonio Quartulli <[email protected]>
2014-02-17batman-adv: avoid double free when orig_node initialization failsAntonio Quartulli1-4/+2
In the failure path of the orig_node initialization routine the orig_node->bat_iv.bcast_own field is free'd twice: first in batadv_iv_ogm_orig_get() and then later in batadv_orig_node_free_rcu(). Fix it by removing the kfree in batadv_iv_ogm_orig_get(). Signed-off-by: Antonio Quartulli <[email protected]> Signed-off-by: Marek Lindner <[email protected]>
2014-02-17batman-adv: free skb on TVLV parsing successAntonio Quartulli1-0/+2
When the TVLV parsing routine succeed the skb is left untouched thus leading to a memory leak. Fix this by consuming the skb in case of success. Introduced by ef26157747d42254453f6b3ac2bd8bd3c53339c3 ("batman-adv: tvlv - basic infrastructure") Reported-by: Russel Senior <[email protected]> Signed-off-by: Antonio Quartulli <[email protected]> Tested-by: Russell Senior <[email protected]> Signed-off-by: Marek Lindner <[email protected]>
2014-02-17batman-adv: fix TT CRC computation by ensuring byte orderAntonio Quartulli1-4/+12
When computing the CRC on a 2byte variable the order of the bytes obviously alters the final result. This means that computing the CRC over the same value on two archs having different endianess leads to different numbers. The global and local translation table CRC computation routine makes this mistake while processing the clients VIDs. The result is a continuous CRC mismatching between nodes having different endianess. Fix this by converting the VID to Network Order before processing it. This guarantees that every node uses the same byte order. Introduced by 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b ("batman-adv: make the TT CRC logic VLAN specific") Reported-by: Russel Senior <[email protected]> Signed-off-by: Antonio Quartulli <[email protected]> Tested-by: Russell Senior <[email protected]> Signed-off-by: Marek Lindner <[email protected]>
2014-02-17batman-adv: fix potential orig_node reference leakSimon Wunderlich1-0/+2
Since batadv_orig_node_new() sets the refcount to two, assuming that the calling function will use a reference for putting the orig_node into a hash or similar, both references must be freed if initialization of the orig_node fails. Otherwise that object may be leaked in that error case. Reported-by: Antonio Quartulli <[email protected]> Signed-off-by: Simon Wunderlich <[email protected]> Signed-off-by: Marek Lindner <[email protected]> Signed-off-by: Antonio Quartulli <[email protected]>
2014-02-17batman-adv: avoid potential race condition when adding a new neighbourAntonio Quartulli3-6/+56
When adding a new neighbour it is important to atomically perform the following: - check if the neighbour already exists - append the neighbour to the proper list If the two operations are not performed in an atomic context it is possible that two concurrent insertions add the same neighbour twice. Signed-off-by: Antonio Quartulli <[email protected]> Signed-off-by: Marek Lindner <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.