aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2010-12-09ACPI: EC: Add another dmi match entry for MSI hardwareAlexey Starikovskiy1-0/+3
http://bugzilla.kernel.org/show_bug.cgi?id=15418 Signed-off-by: Alexey Starikovskiy <[email protected]> cc: [email protected] Signed-off-by: Len Brown <[email protected]>
2010-12-09[SCSI] hpsa: fix redefinition of PCI_DEVICE_ID_CISSFMike Miller1-7/+1
PCI_DEVICE_ID_CISSF is defined as 323b in pci_ids.h but redefined as 3fff in hpsa.c. The ID of 3fff will _never_ ship as a standalone controller. It is intended only as part a complete storage solution. As such, this patch removes the redefinition and the StorageWorks P1210m from the product table. It also removes a duplicate line for the "unknown" controller support. Signed-off-by: James Bottomley <[email protected]>
2010-12-09ACPI battery: update status upon sysfs queryZhang Rui1-0/+5
Sometimes the Battery driver doesn't get notifications when it's plugged/unplugged. And this results in the incorrect Battery status reported by the power supply sysfs I/F. Update Battery status first when querying from sysfs. http://marc.info/?l=linux-acpi&m=128855015826728&w=2 Tested_by: Seblu <[email protected]> Signed-off-by: Zhang Rui <[email protected]> Signed-off-by: Len Brown <[email protected]>
2010-12-09ACPI ac: update AC status upon sysfs queryZhang Rui1-17/+29
http://marc.info/?l=linux-acpi&m=128855015826728&w=2 https://bugzilla.kernel.org/show_bug.cgi?id=21722 Tested_by: Seblu <[email protected]> Signed-off-by: Zhang Rui <[email protected]> Signed-off-by: Len Brown <[email protected]>
2010-12-09[SCSI] qla2xxx: Update version number to 8.03.05-k0.Madhuranath Iyengar1-2/+2
Signed-off-by: Madhuranath Iyengar <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] qla2xxx: Properly set the return value in qla2xxx_eh_abort function.Saurav Kashyap1-1/+1
A return value is not set for the successful case and it has a garbage value. This fix will set the default value to SUCCESS and in case of any failures it is changed. Signed-off-by: Saurav Kashyap <[email protected]> Signed-off-by: Madhuranath Iyengar <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] qla2xxx: Correct issue where NPIV-config data was not being allocated ↵Andrew Vasquez1-0/+1
for 82xx parts. This would cause a panic while reading the NPIV-config data. Cc: [email protected] Signed-off-by: Andrew Vasquez <[email protected]> Signed-off-by: Madhuranath Iyengar <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] qla2xxx: Change MSI initialization from using incorrect request_irq ↵Mike Hernandez2-3/+3
parameter. IRQF_SHARED flag should not be set when calling request_irq for MSI since this interrupt mechanism cannot be shared like standard INTx. Signed-off-by: Mike Hernandez <[email protected]> Signed-off-by: Madhuranath Iyengar <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] qla2xxx: Populate Command Type 6 LUN field properly.Mike Hernandez2-0/+2
Use the host_to_fcp_swap call to correctly populate the LUN field in the Command Type 6 path. This field is used during LUN reset cleanup and must match the field used in the FCP command. Cc: [email protected] Signed-off-by: Mike Hernandez <[email protected]> Signed-off-by: Madhuranath Iyengar <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09Btrfs: fixup return code for btrfs_del_orphan_itemJosef Bacik1-1/+5
If the orphan item doesn't exist, we return 1, which doesn't make any sense to the callers. Instead return -ENOENT if we didn't find the item. Thanks, Signed-off-by: Josef Bacik <[email protected]>
2010-12-09Btrfs: do not do fast caching if we are allocating blocks for tree_rootJosef Bacik1-6/+12
Since the fast caching uses normal tree locking, we can possibly deadlock if we get to the caching via a btrfs_search_slot() on the tree_root. So just check to see if the root we are on is the tree root, and just don't do the fast caching. Reported-by: Sage Weil <[email protected]> Signed-off-by: Josef Bacik <[email protected]>
2010-12-09Btrfs: deal with space cache errors betterJosef Bacik2-9/+13
Currently if the space cache inode generation number doesn't match the generation number in the space cache header we will just fail to load the space cache, but we won't mark the space cache as an error, so we'll keep getting that error each time somebody tries to cache that block group until we actually clear the thing. Fix this by marking the space cache as having an error so we only get the message once. This patch also makes it so that we don't try and setup space cache for a block group that isn't cached, since we won't be able to write it out anyway. None of these problems are actual problems, they are just annoying and sub-optimal. Thanks, Signed-off-by: Josef Bacik <[email protected]>
2010-12-09Btrfs: fix use after free in O_DIRECTJosef Bacik1-2/+1
This fixes a bug where we use dip after we have freed it. Instead just use the file_offset that was passed to the function. Thanks, Signed-off-by: Josef Bacik <[email protected]>
2010-12-09[SCSI] zfcp: Issue FCP command without holding SCSI host_lockChristof Schmitt2-7/+5
Interrupting the connection to the FCP channel while I/O requests are being issued can lead to this deadlock. scsi_dispatch_cmd already holds the host_lock while the recovery trigger tries to acquire the host_lock again when iterating through the scsi_devices. INFO: lockdep is turned off. BUG: spinlock lockup on CPU#1, blast/9660, 0000000078f38878 CPU: 1 Not tainted 2.6.35.7SWEN2 #2 Process blast (pid: 9660, task: 0000000071f75940, ksp: 0000000074393ac0) 0000000074393640 00000000743935c0 0000000000000002 0000000000000000 0000000074393660 00000000743935d8 00000000743935d8 00000000005590c2 0000000000000000 0000000078f38878 0000000026ede800 0000000078f38878 000000000000000d 040000000000000c 0000000074393628 0000000000000000 0000000000000000 0000000000100b2a 00000000743935c0 0000000074393600 Call Trace: ([<0000000000100a32>] show_trace+0xee/0x144) [<00000000003be202>] do_raw_spin_lock+0x112/0x178 [<000000000055d408>] _raw_spin_lock_irqsave+0x90/0xb0 [<00000000003f1514>] __scsi_iterate_devices+0x38/0xbc [<00000000004849b0>] zfcp_erp_clear_adapter_status+0xd0/0x16c [<000000000048587a>] zfcp_erp_adapter_reopen+0x3a/0xb4 [<0000000000489812>] zfcp_fsf_req_send+0x166/0x180 [<000000000048c8d6>] zfcp_fsf_fcp_cmnd+0x272/0x408 [<000000000048f864>] zfcp_scsi_queuecommand+0x11c/0x1e0 [<00000000003f1f2a>] scsi_dispatch_cmd+0x1d6/0x324 [<00000000003f9910>] scsi_request_fn+0x42c/0x56c [<00000000003828ae>] __blk_run_queue+0x86/0x140 [<000000000037f742>] elv_insert+0x11a/0x208 [<000000000038104c>] blk_insert_cloned_request+0x84/0xe4 [<000003c0032b7c64>] dm_dispatch_request+0x6c/0x94 [dm_mod] [<000003c0032b7d5c>] map_request+0xd0/0x100 [dm_mod] [<000003c0032b9a78>] dm_request_fn+0xec/0x1bc [dm_mod] [<0000000000382c0e>] generic_unplug_device+0x5a/0x6c [<000003c0032b7f98>] dm_unplug_all+0x74/0x9c [dm_mod] [<00000000001d1272>] sync_page+0x76/0x9c [<00000000001d12ba>] sync_page_killable+0x22/0x60 [<000000000055a768>] __wait_on_bit_lock+0xc0/0x124 [<00000000001d1140>] __lock_page_killable+0x78/0x84 [<00000000001d351c>] generic_file_aio_read+0x5a4/0x7e8 [<0000000000228ec0>] do_sync_read+0xc8/0x12c [<0000000000229edc>] vfs_read+0xac/0x1ac [<000000000022a0d8>] SyS_read+0x58/0xa8 [<00000000001146de>] sysc_noemu+0x10/0x16 [<00000200000493c4>] 0x200000493c4 INFO: lockdep is turned off. Call zfcp_fsf_fcp_cmnd without the host_lock and disable the interrupts when acquiring the req_q_lock. According to the patch description in "[PATCH] Eliminate error handler overload of the SCSI serial number", the serial_number is not used, so simply drop the queuecommand wrapper function and run zfcp_scsi_queuecommand without holding the host_lock. Reviewed-by: Swen Schillig <[email protected]> Signed-off-by: Christof Schmitt <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] zfcp: Prevent usage w/o holding a referenceSwen Schillig1-3/+6
The ERP got values assigned for which no reference was taken. This can lead to an unpredictable race condition. Fix this by only assigning the values which are required and for which a reference was pulled or is held implicitly. Signed-off-by: Swen Schillig <[email protected]> Signed-off-by: Christof Schmitt <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] zfcp: No ERP escalation on gpn_ft evalSwen Schillig1-0/+2
If the evaluation of GPN_FT requests wants to remove an invalid port from the system the zfcp_erp_port_shutdown function is triggered. Depending on the system status a superior action (e.g. adapter reopen) is required. This can lead to an invalid mem access of the port struct which might be freed at the time since the superior action is not holding a reference of the port which triggered this ERP action. Signed-off-by: Swen Schillig <[email protected]> Signed-off-by: Christof Schmitt <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] zfcp: Correct false abort data assignment.Swen Schillig1-1/+1
The request data assignment between the fsf abort initiator and its corresponding handler is not consistent and leads to an unpredictable behaviour, e.g. kernel panic. This patch fixes this issue and assigns the correct value. Signed-off-by: Swen Schillig <[email protected]> Signed-off-by: Christof Schmitt <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] zfcp: Fix common FCP request receptionSwen Schillig1-2/+2
The reception of a common FCP request should only be evaluated if the corresponding SCSI request data is available. Therefore put the information under the lock protection and verify the existence before processing. This fixes the following kernel panic. Unable to handle kernel pointer dereference at virtual kernel address 0000000180000000 Oops: 003b [#1] PREEMPT SMP DEBUG_PAGEALLOC CPU: 0 Not tainted 2.6.35.7-45.x.20101007-s390xdefault #1 Process blast (pid: 9711, task: 00000000a3be8e40, ksp: 00000000b221bac0) Krnl PSW : 0704300180000000 0000000000489878 (zfcp_fsf_fcp_handler_common+0x4c/0x3a0) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:3 PM:0 EA:3 Krnl GPRS: 00000000b663c1b8 0000000180000000 000000007ab5bdf0 0000000000000000 00000000b0ccd800 0000000000000018 07000000a3be8e78 00000000b5d3e600 000000007ab5bdf0 0000000000000066 00000000b72137f0 00000000b72137f0 0000000000000000 00000000005a8178 00000000bdf37a60 00000000bdf379f0 Krnl Code: 0000000000489866: e3c030000004 lg %r12,0(%r3) 000000000048986c: e310c0000004 lg %r1,0(%r12) 0000000000489872: e31011e00004 lg %r1,480(%r1) >0000000000489878: 581011ec l %r1,492(%r1) 000000000048987c: a774001c brc 7,4898b4 0000000000489880: b91400b1 lgfr %r11,%r1 0000000000489884: 5810405c l %r1,92(%r4) 0000000000489888: 5510d00c cl %r1,12(%r13) Call Trace: ([<000000000010d344>] debug_event_common+0x22c/0x244) [<000000000048a0b4>] zfcp_fsf_fcp_cmnd_handler+0x2c/0x3b4 [<000000000048b5b6>] zfcp_fsf_req_complete+0x1b6/0x9dc [<000000000048bede>] zfcp_fsf_reqid_check+0x102/0x138 [<000000000048e478>] zfcp_qdio_int_resp+0x70/0x110 [<000000000044a1ec>] qdio_kick_handler+0xb0/0x19c [<000000000044c228>] __tiqdio_inbound_processing+0x30c/0xebc [<000000000014a5fc>] tasklet_action+0x1b4/0x1e8 [<000000000014b676>] __do_softirq+0x106/0x1cc [<000000000010d91a>] do_softirq+0xe6/0xec [<000000000014b0c8>] irq_exit+0xd4/0xd8 [<00000000004307ec>] do_IRQ+0x7c0/0xf54 [<0000000000114d28>] io_return+0x0/0x16 [<000000000055fef0>] sub_preempt_count+0x50/0xe4 ([<00000000b1f873c0>] 0xb1f873c0) [<000000000055e25a>] _raw_spin_unlock+0x46/0x74 [<0000000000241c40>] __d_lookup+0x288/0x2c8 [<000000000023502c>] do_lookup+0x7c/0x25c [<0000000000237fa8>] link_path_walk+0x5e4/0xe2c [<0000000000238a00>] path_walk+0x98/0x148 [<0000000000238c98>] do_path_lookup+0x74/0xc0 [<000000000023989c>] user_path_at+0x64/0xa4 [<000000000022e366>] vfs_fstatat+0x4e/0xb0 [<000000000022e4d6>] SyS_newstat+0x2e/0x54 [<00000000001146de>] sysc_noemu+0x10/0x16 [<0000020000153456>] 0x20000153456 INFO: lockdep is turned off. Last Breaking-Event-Address: [<000000000048a0ae>] zfcp_fsf_fcp_cmnd_handler+0x26/0x3b4 Signed-off-by: Swen Schillig <[email protected]> Signed-off-by: Christof Schmitt <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] Eliminate error handler overload of the SCSI serial numberJames Bottomley2-29/+2
The error handler is using the test cmd->serial_number == 0 in the abort routines to signal that the command to be aborted has already completed normally. This design was to close a race window in the original error handler where a command could go through the normal completion routines after it timed out but before error handling was started. Mike Anderson pointed out that when we converted our timeout and softirq completions, we picked up atomicity here because the block layer now mediates this with the REQ_ATOM_COMPLETE flag and guarantees that *either* the command times out or our done routine is called, but ensures we can't get both occurring. That makes the serial number zero check redundant and it can be removed. Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] pmcraid: disable msix and expand device config entryAnil Ravindranath2-5/+5
Firmware requires a larger configuration entry size than the driver currently allows, and MSI-X pretty much doesn't work with current FW, so disable it for now. Signed-off-by: Anil Ravindranath <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] bsg: correct fault if queue object removed while dev_t openJames Smart1-0/+8
This patch corrects an issue in bsg that results in a general protection fault if an LLD is removed while an application is using an open file handle to a bsg device, and the application issues an ioctl. The fault occurs because the class_dev is NULL, having been cleared in bsg_unregister_queue() when the driver was removed. With this patch, a check is made for the class_dev, and the application will receive ENXIO if the related object is gone. Signed-off-by: Carl Lajeunesse <[email protected]> Signed-off-by: James Smart <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09[SCSI] osd: checking NULL instead of ERR_PTR()Dan Carpenter1-2/+2
bio_map_kern() returns ERR_PTRs on failure and never returns NULL. [jejb: remove redundant unlikely spotted by Tobias Klauser] Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Boaz Harrosh <[email protected]> Signed-off-by: James Bottomley <[email protected]>
2010-12-09regulator: tps6586x: correct register tableDanny Huang1-3/+3
Correct the register table for SM2, LDO8, RTC Change-Id: I45348cec5ffbb7da9bd7523764fb611b537236b8 Signed-off-by: Danny Huang <[email protected]> Signed-off-by: Olof Johansson <[email protected]> Signed-off-by: Stephen Warren <[email protected]> Acked-by: Mark Brown <[email protected]> Signed-off-by: Liam Girdwood <[email protected]>
2010-12-09regulator: tps6586x: Handle both enable reg/bits being the sameDanny Huang1-0/+4
Change-Id: I40400bb65eab496bb1becd26b37a9653b99d4f41 Signed-off-by: Danny Huang <[email protected]> Signed-off-by: Olof Johansson <[email protected]> Signed-off-by: Stephen Warren <[email protected]> Acked-by: Mark Brown <[email protected]> (Split into separate patches) Signed-off-by: Liam Girdwood <[email protected]>
2010-12-09regulator: tps6586x: Fix TPS6586X_DVM to store goreg/bitDanny Huang1-6/+13
Change-Id: Idacf5e1e51dbbbcd5ea93f310a4e907977e7359e Signed-off-by: Danny Huang <[email protected]> Signed-off-by: Olof Johansson <[email protected]> Signed-off-by: Stephen Warren <[email protected]> Acked-by: Mark Brown <[email protected]> (Split into separate patches) (Minor formatting fixes) Signed-off-by: Liam Girdwood <[email protected]>
2010-12-09regulator: tps6586x: Add missing bit mask generationDanny Huang1-2/+2
Change-Id: I76eaceb31b56264f6978af15db1e6fc7e2e01b5a Signed-off-by: Danny Huang <[email protected]> Signed-off-by: Olof Johansson <[email protected]> Signed-off-by: Stephen Warren <[email protected]> Acked-by: Mark Brown <[email protected]> (Split into separate patches) Signed-off-by: Liam Girdwood <[email protected]>
2010-12-09drm/radeon/kms: don't apply 7xx HDP flush workaround on AGPAlex Deucher1-3/+8
It should be required for all 7xx asics, but seems to cause problems on some AGP 7xx chips. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=19002 Signed-off-by: Alex Deucher <[email protected]> Reported-and-Tested-by: Duncan <[email protected]> Cc: [email protected] Signed-off-by: Dave Airlie <[email protected]>
2010-12-09drm: use after free in drm_queue_vblank_event()Dan Carpenter1-2/+2
The "e" pointer is either NULL or freed when we call drm_vblank_put(dev, e->pipe) on the error path. Just pass the "pipe" variable directly instead. I changed another caller to use "pipe" as well for consistency. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2010-12-09Merge branch 'fix/asoc' into for-linusTakashi Iwai5-12/+16
2010-12-09Merge branch 'fix/hda' into for-linusTakashi Iwai5-32/+30
2010-12-09ALSA: HDA: Quirk for Dell Vostro 320 to make microphone workDavid Henningsson1-2/+1
BugLink: http://launchpad.net/497546 Confirmed that the ideapad model works better than the current quirk for Dell Vostro 320. Cc: [email protected] (2.6.35+) Signed-off-by: David Henningsson <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2010-12-09drm/kms: remove spaces from connector names (v2)Alex Deucher1-5/+5
Grub doesn't parse spaces in parameters correctly, so this makes it impossible to force video= parameters for kms on the grub kernel command line. v2: shorten the names to make them easier to type. Reported-by: Sergej Pupykin <[email protected]> Cc: Sergej Pupykin <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected] Signed-off-by: Dave Airlie <[email protected]>
2010-12-09md: protect against NULL reference when waiting to start a raid10.NeilBrown2-4/+3
When we fail to start a raid10 for some reason, we call md_unregister_thread to kill the thread that was created. Unfortunately md_thread() will then make one call into the handler (raid10d) even though md_wakeup_thread has not been called. This is not safe and as md_unregister_thread is called after mddev->private has been set to NULL, it will definitely cause a NULL dereference. So fix this at both ends: - md_thread should only call the handler if THREAD_WAKEUP has been set. - raid10 should call md_unregister_thread before setting things to NULL just like all the other raid modules do. This is applicable to 2.6.35 and later. Cc: [email protected] Reported-by: "Citizen" <[email protected]> Signed-off-by: NeilBrown <[email protected]>
2010-12-09md: fix bug with re-adding of partially recovered device.NeilBrown1-2/+5
With v0.90 metadata, a hot-spare does not become a full member of the array until recovery is complete. So if we re-add such a device to the array, we know that all of it is as up-to-date as the event count would suggest, and so it a bitmap-based recovery is possible. However with v1.x metadata, the hot-spare immediately becomes a full member of the array, but it record how much of the device has been recovered. If the array is stopped and re-assembled recovery starts from this point. When such a device is hot-added to an array we currently lose the 'how much is recovered' information and incorrectly included it as a full in-sync member (after bitmap-based fixup). This is wrong and unsafe and could corrupt data. So be more careful about setting saved_raid_disk - which is what guides the re-adding of devices back into an array. The new code matches the code in slot_store which does a similar thing, which is encouraging. This is suitable for any -stable kernel. Reported-by: "Dailey, Nate" <[email protected]> Cc: [email protected] Signed-off-by: NeilBrown <[email protected]>
2010-12-09md: fix possible deadlock in handling flush requests.NeilBrown1-2/+4
As recorded in https://bugzilla.kernel.org/show_bug.cgi?id=24012 it is possible for a flush request through md to hang. This is due to an interaction between the recursion avoidance in generic_make_request, the insistence in md of only having one flush active at a time, and the possibility of dm (or md) submitting two flush requests to a device from the one generic_make_request. If a generic_make_request call into dm causes two flush requests to be queued (as happens if the dm table has two targets - they get one each), these two will be queued inside generic_make_request. Assume they are for the same md device. The first is processed and causes 1 or more flush requests to be sent to lower devices. These get queued within generic_make_request too. Then the second flush to the md device gets handled and it blocks waiting for the first flush to complete. But it won't complete until the two lower-device requests complete, and they haven't even been submitted yet as they are on the generic_make_request queue. The deadlock can be broken by using a separate thread to submit the requests to lower devices. md has such a thread readily available: md_wq. So use it to submit these requests. Reported-by: Giacomo Catenazzi <[email protected]> Tested-by: Giacomo Catenazzi <[email protected]> Signed-off-by: NeilBrown <[email protected]>
2010-12-09md: move code in to submit_flushes.NeilBrown1-6/+6
submit_flushes is called from exactly one place. Move the code that is before and after that call into submit_flushes. This has not functional change, but will make the next patch smaller and easier to follow. Signed-off-by: NeilBrown <[email protected]>
2010-12-09md: remove handling of flush_pending in md_submit_flush_dataNeilBrown1-6/+3
None of the functions called between setting flush_pending to 1, and atomic_dec_and_test can change flush_pending, or will anything running in any other thread (as ->flush_bio is not NULL). So the atomic_dec_and_test will always succeed. So remove the atomic_sec and the atomic_dec_and_test. Signed-off-by: NeilBrown <[email protected]>
2010-12-08econet: Fix crash in aun_incoming().David S. Miller1-1/+5
Unconditional use of skb->dev won't work here, try to fetch the econet device via skb_dst()->dev instead. Suggested by Eric Dumazet. Reported-by: Nelson Elhage <[email protected]> Tested-by: Nelson Elhage <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-12-08IB/uverbs: Handle large number of entries in poll CQDan Carpenter1-43/+56
In ib_uverbs_poll_cq() code there is a potential integer overflow if userspace passes in a large cmd.ne. The calls to kmalloc() would allocate smaller buffers than intended, leading to memory corruption. There iss also an information leak if resp wasn't all used. Unprivileged userspace may call this function, although only if an RDMA device that uses this function is present. Fix this by copying CQ entries one at a time, which avoids the allocation entirely, and also by moving this copying into a function that makes sure to initialize all memory copied to userspace. Special thanks to Jason Gunthorpe <[email protected]> for his help and advice. Cc: <[email protected]> Signed-off-by: Dan Carpenter <[email protected]> [ Monkey around with things a bit to avoid bad code generation by gcc when designated initializers are used. - Roland ] Signed-off-by: Roland Dreier <[email protected]>
2010-12-08tcp: protect sysctl_tcp_cookie_size readsEric Dumazet1-12/+15
Make sure sysctl_tcp_cookie_size is read once in tcp_cookie_size_check(), or we might return an illegal value to caller if sysctl_tcp_cookie_size is changed by another cpu. Signed-off-by: Eric Dumazet <[email protected]> Cc: Ben Hutchings <[email protected]> Cc: William Allen Simpson <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-12-08tcp: avoid a possible divide by zeroEric Dumazet1-2/+4
sysctl_tcp_tso_win_divisor might be set to zero while one cpu runs in tcp_tso_should_defer(). Make sure we dont allow a divide by zero by reading sysctl_tcp_tso_win_divisor exactly once. Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-12-08orinoco: fix TKIP countermeasure behaviourDavid Kilroy1-2/+2
Enable the port when disabling countermeasures, and disable it on enabling countermeasures. This bug causes the response of the system to certain attacks to be ineffective. It also prevents wpa_supplicant from getting scan results, as wpa_supplicant disables countermeasures on startup - preventing the hardware from scanning. wpa_supplicant works with ap_mode=2 despite this bug because the commit handler re-enables the port. The log tends to look like: State: DISCONNECTED -> SCANNING Starting AP scan for wildcard SSID Scan requested (ret=0) - scan timeout 5 seconds EAPOL: disable timer tick EAPOL: Supplicant port status: Unauthorized Scan timeout - try to get results Failed to get scan results Failed to get scan results - try scanning again Setting scan request: 1 sec 0 usec Starting AP scan for wildcard SSID Scan requested (ret=-1) - scan timeout 5 seconds Failed to initiate AP scan. Reported by: Giacomo Comes <[email protected]> Signed-off by: David Kilroy <[email protected]> Cc: [email protected] Signed-off-by: John W. Linville <[email protected]>
2010-12-08orinoco: clear countermeasure setting on commitDavid Kilroy1-0/+6
... and interface up. In these situations, you are usually trying to connect to a new AP, so keeping TKIP countermeasures active is confusing. This is already how the driver behaves (inadvertently). However, querying SIOCGIWAUTH may tell userspace that countermeasures are active when they aren't. Clear the setting so that the reporting matches what the driver has done.. Signed-off by: David Kilroy <[email protected]> Cc: [email protected] Signed-off-by: John W. Linville <[email protected]>
2010-12-08mac80211: Fix BUG in pskb_expand_head when transmitting shared skbsHelmut Schaa1-3/+18
mac80211 doesn't handle shared skbs correctly at the moment. As a result a possible resize can trigger a BUG in pskb_expand_head. [ 676.030000] Kernel bug detected[#1]: [ 676.030000] Cpu 0 [ 676.030000] $ 0 : 00000000 00000000 819662ff 00000002 [ 676.030000] $ 4 : 81966200 00000020 00000000 00000020 [ 676.030000] $ 8 : 819662e0 800043c0 00000002 00020000 [ 676.030000] $12 : 3b9aca00 00000000 00000000 00470000 [ 676.030000] $16 : 80ea2000 00000000 00000000 00000000 [ 676.030000] $20 : 818aa200 80ea2018 80ea2000 00000008 [ 676.030000] $24 : 00000002 800ace5c [ 676.030000] $28 : 8199a000 8199bd20 81938f88 80f180d4 [ 676.030000] Hi : 0000026e [ 676.030000] Lo : 0000757e [ 676.030000] epc : 801245e4 pskb_expand_head+0x44/0x1d8 [ 676.030000] Not tainted [ 676.030000] ra : 80f180d4 ieee80211_skb_resize+0xb0/0x114 [mac80211] [ 676.030000] Status: 1000a403 KERNEL EXL IE [ 676.030000] Cause : 10800024 [ 676.030000] PrId : 0001964c (MIPS 24Kc) [ 676.030000] Modules linked in: mac80211_hwsim rt2800lib rt2x00soc rt2x00pci rt2x00lib mac80211 crc_itu_t crc_ccitt cfg80211 compat arc4 aes_generic deflate ecb cbc [last unloaded: rt2800pci] [ 676.030000] Process kpktgend_0 (pid: 97, threadinfo=8199a000, task=81879f48, tls=00000000) [ 676.030000] Stack : ffffffff 00000000 00000000 00000014 00000004 80ea2000 00000000 00000000 [ 676.030000] 818aa200 80f180d4 ffffffff 0000000a 81879f78 81879f48 81879f48 00000018 [ 676.030000] 81966246 80ea2000 818432e0 80f1a420 80203050 81814d98 00000001 81879f48 [ 676.030000] 81879f48 00000018 81966246 818432e0 0000001a 8199bdd4 0000001c 80f1b72c [ 676.030000] 80203020 8001292c 80ef4aa2 7f10b55d 801ab5b8 81879f48 00000188 80005c90 [ 676.030000] ... [ 676.030000] Call Trace: [ 676.030000] [<801245e4>] pskb_expand_head+0x44/0x1d8 [ 676.030000] [<80f180d4>] ieee80211_skb_resize+0xb0/0x114 [mac80211] [ 676.030000] [<80f1a420>] ieee80211_xmit+0x150/0x22c [mac80211] [ 676.030000] [<80f1b72c>] ieee80211_subif_start_xmit+0x6f4/0x73c [mac80211] [ 676.030000] [<8014361c>] pktgen_thread_worker+0xfac/0x16f8 [ 676.030000] [<8002ebe8>] kthread+0x7c/0x88 [ 676.030000] [<80008e0c>] kernel_thread_helper+0x10/0x18 [ 676.030000] [ 676.030000] [ 676.030000] Code: 24020001 10620005 2502001f <0200000d> 0804917a 00000000 2502001f 00441023 00531021 Fix this by making a local copy of shared skbs prior to mangeling them. To avoid copying the skb unnecessarily move the skb_copy call below the checks that don't need write access to the skb. Also, move the assignment of nh_pos and h_pos below the skb_copy to point to the correct skb. It would be possible to avoid another resize of the copied skb by using skb_copy_expand instead of skb_copy but that would make the patch more complex. Also, shared skbs are a corner case right now, so the resize shouldn't matter much. Cc: Johannes Berg <[email protected]> Signed-off-by: Helmut Schaa <[email protected]> Cc: [email protected] Signed-off-by: John W. Linville <[email protected]>
2010-12-08ath9k_htc: Fix suspend/resumeSujith Manoharan4-2/+18
The HW has to be set to FULLSLEEP mode during suspend, when no interface has been brought up. Not doing this would break resume, as the chip won't be powered up at all. Signed-off-by: Sujith Manoharan <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2010-12-08ath5k: Put the right tsf value in mesh beaconsJavier Cardona1-1/+2
Signed-off-by: Javier Cardona <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2010-12-08ath5k: Prevent mesh interfaces from being counted as ad-hocJavier Cardona1-1/+1
This results in an erroneus num_adhoc_vifs count, as the this counter was incremented but not decremented for mesh interfaces. Signed-off-by: Javier Cardona <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2010-12-08ath5k: Fix beaconing in mesh modeJavier Cardona1-3/+5
This patch fixes the oops below when attempting to bring up a mesh interface on ath5k hardware. [ 128.933099] kernel BUG at drivers/net/wireless/ath/ath5k/base.c:197! [ 128.933099] invalid opcode: 0000 [#1] (...) [ 128.933099] Call Trace: [ 128.933099] [<c83b77fa>] ? ath5k_beacon_update+0x57/0x1f8 [ath5k] [ 128.933099] [<c02d9a40>] ? __sysfs_add_one+0x28/0x76 [ 128.933099] [<c83b830e>] ? ath5k_bss_info_changed+0x13f/0x173 [ath5k] [ 128.933099] [<c82ff629>] ? ieee80211_config_beacon+0xc0/0x17e [mac80211] [ 128.933099] [<c82f073e>] ? ieee80211_bss_info_change_notify+0x182/0x18b [mac80211] [ 128.933099] [<c83b81cf>] ? ath5k_bss_info_changed+0x0/0x173 [ath5k] [ 128.933099] [<c82ff6d6>] ? ieee80211_config_beacon+0x16d/0x17e [mac80211] [ 128.933099] [<c82ff753>] ? ieee80211_add_beacon+0x34/0x39 [mac80211] [ 128.933099] [<c830a4ed>] ? ieee80211s_init+0xf8/0x10f [mac80211] [ 128.933099] [<c830a5df>] ? ieee80211_mesh_init_sdata+0xdb/0x154 [mac80211] Signed-off-by: Javier Cardona <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2010-12-08orinoco: initialise priv->hw before assigning the interruptDavid Kilroy2-14/+14
The interrupt handler takes a lock - but since commit bcad6e80f3f this lock goes through an indirection specified in the hermes_t structure. We must therefore initialise the structure before setting up the interrupt handler. Fix orinoco_cs and spectrum_cs <https://bugzilla.kernel.org/show_bug.cgi?id=23932> Bisected by: Matt Domsch <[email protected]> Signed-off by: David Kilroy <[email protected]> Cc: [email protected] Signed-off-by: John W. Linville <[email protected]>
2010-12-08ehea: Fixing LRO configurationBreno Leitao2-2/+14
In order to set LRO on ehea, the user must set a module parameter, which is not the standard way to do so. This patch adds a way to set LRO using the ethtool tool. Signed-off-by: Breno Leitao <[email protected]> Signed-off-by: David S. Miller <[email protected]>