8 years agotcp: mark tcp_congestion_ops read_mostly
Stephen Hemminger [Thu, 10 Mar 2011 08:40:17 +0000]
tcp: mark tcp_congestion_ops read_mostly

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoipv4: Optimize flow initialization in fib_validate_source().
David S. Miller [Thu, 10 Mar 2011 04:57:50 +0000]
ipv4: Optimize flow initialization in fib_validate_source().

Like in commit 44713b67db10c774f14280c129b0d5fd13c70cf2
("ipv4: Optimize flow initialization in output route lookup."
we can optimize the on-stack flow setup to only initialize
the members which are actually used.

Otherwise we bzero the entire structure, then initialize
explicitly the first half of it.

Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoipv4: Optimize flow initialization in input route lookup.
David S. Miller [Thu, 10 Mar 2011 04:42:07 +0000]
ipv4: Optimize flow initialization in input route lookup.

Like in commit 44713b67db10c774f14280c129b0d5fd13c70cf2
("ipv4: Optimize flow initialization in output route lookup."
we can optimize the on-stack flow setup to only initialize
the members which are actually used.

Otherwise we bzero the entire structure, then initialize
explicitly the first half of it.

Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agotcp: ioctl type SIOCOUTQNSD returns amount of data not sent
Mario Schuknecht [Wed, 9 Mar 2011 22:08:09 +0000]
tcp: ioctl type SIOCOUTQNSD returns amount of data not sent

In contrast to SIOCOUTQ which returns the amount of data sent
but not yet acknowledged plus data not yet sent this patch only
returns the data not sent.

For various methods of live streaming bitrate control it may
be helpful to know how much data are in the tcp outqueue are
not sent yet.

Signed-off-by: Mario Schuknecht <m.schuknecht@dresearch.de>
Signed-off-by: Steffen Sledz <sledz@dresearch.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoipv4: Lookup multicast routes by rtable using helper.
David S. Miller [Wed, 9 Mar 2011 22:06:20 +0000]
ipv4: Lookup multicast routes by rtable using helper.

Create a common helper for this operation, since we do
it identically in three spots.

Suggested by Eric Dumazet.

Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agobonding: move procfs code into bond_procfs.c
Amerigo Wang [Sun, 6 Mar 2011 21:58:46 +0000]
bonding: move procfs code into bond_procfs.c

V2: Move #ifdef CONFIG_PROC_FS into bonding.h, as suggested by David.

bond_main.c is bloating, separate the procfs code out,
move them to bond_procfs.c

Signed-off-by: WANG Cong <amwang@redhat.com>
Reviewed-by: Jiri Pirko <jpirko@redhat.com>
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoPhonet: kill the ST-Ericsson pipe controller Kconfig
Rémi Denis-Courmont [Tue, 8 Mar 2011 22:44:13 +0000]
Phonet: kill the ST-Ericsson pipe controller Kconfig

This is now a run-time choice so that a single kernel can support both
old and new generation ISI modems. Support for manually enabling the
pipe flow is removed as it did not work properly, does not fit well
with the socket API, and I am not aware of any use at the moment.

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoPhonet: support active connection without pipe controller on modem
Rémi Denis-Courmont [Tue, 8 Mar 2011 22:44:12 +0000]
Phonet: support active connection without pipe controller on modem

This provides support for newer ISI modems with no need for the
earlier experimental compile-time alternative choice. With this,
we can now use the same kernel and userspace with both types of
modems.

This also avoids confusing two different and incompatible state
machines, actively connected vs accepted sockets, and adds
connection response error handling (processing "SYN/RST" of sorts).

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoPhonet: provide pipe socket option to retrieve the pipe identifier
Rémi Denis-Courmont [Tue, 8 Mar 2011 22:44:11 +0000]
Phonet: provide pipe socket option to retrieve the pipe identifier

User-space sometimes needs this information. In particular, the GPRS
context or the AT commands pipe setups may use the pipe handle as a
reference.

This removes the settable pipe handle with CONFIG_PHONET_PIPECTRLR.
It did not handle error cases correctly. Furthermore, the kernel
*could* implement a smart scheme for allocating handles (if ever
needed), but userspace really cannot.

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoPhonet: allocate sock from accept syscall rather than soft IRQ
Rémi Denis-Courmont [Tue, 8 Mar 2011 22:44:10 +0000]
Phonet: allocate sock from accept syscall rather than soft IRQ

This moves most of the accept logic to process context like other
socket stacks do. Then we can use a few more common socket helpers
and simplify a bit.

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoPhonet: factor common code to send control messages
Rémi Denis-Courmont [Tue, 8 Mar 2011 22:44:09 +0000]
Phonet: factor common code to send control messages

With the addition of the pipe controller, there is now quite a bit
of repetitive code for small signaling messages. Lets factor it.

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoPhonet: correct pipe backlog callback return values
Rémi Denis-Courmont [Tue, 8 Mar 2011 22:44:08 +0000]
Phonet: correct pipe backlog callback return values

In some cases, the Phonet pipe backlog callbacks returned negative
errno instead of NET_RX_* values.

In other cases, NET_RX_DROP was returned for invalid packets, even
though it seems only intended for buffering problems (not for
deliberately discarded packets).

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoPhonet: return an error when packet TX fails
Rémi Denis-Courmont [Tue, 8 Mar 2011 22:44:07 +0000]
Phonet: return an error when packet TX fails

Phonet assumes that packets are never dropped. We try our best to
avoid this situation. But lets return ENOBUFS if queueing to the
network device fails so that the caller knows things went wrong.

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoPhonet: fix NULL dereference on TX path with implicit source
Rémi Denis-Courmont [Tue, 8 Mar 2011 22:44:06 +0000]
Phonet: fix NULL dereference on TX path with implicit source

The previous Phonet patch series introduced per-socket implicit
destination (i.e. connect()). In that case, the destination
socket address is NULL in the transmit function.
However commit a8059512b120362b15424f152b2548fe8b11bd0c
("Phonet: implement per-socket destination/peer address")
is incomplete and would trigger a NULL dereference.
(Fortunately, the code is not in released kernel, and in fact
 currently not reachable.)

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoinetpeer: Don't disable BH for initial fast RCU lookup.
David S. Miller [Tue, 8 Mar 2011 22:59:28 +0000]
inetpeer: Don't disable BH for initial fast RCU lookup.

If modifications on other cpus are ok, then modifications to
the tree during lookup done by the local cpu are ok too.

Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoixgbe: fix compile failure in ixgbe_init_mbx_params_pf
Andy Gospodarek [Tue, 8 Mar 2011 22:26:00 +0000]
ixgbe: fix compile failure in ixgbe_init_mbx_params_pf

This commit:

    commit d7c8a29fc8bd20ba45ec2f52577ed04a988a9500
    Author: Emil Tantilov <emil.s.tantilov@intel.com>
    Date:   Thu Mar 3 09:25:02 2011 +0000

        ixgbe: improve logic in ixgbe_init_mbx_params_pf

incorrectly added a line that accessed mbx->udelay.  I'm sure the intent
was mbx->usec_delay.  This patch fixes the compilation error.

Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agodsa/mv88e6060: support nonzero mii base address
Peter Korsgaard [Mon, 7 Mar 2011 05:49:47 +0000]
dsa/mv88e6060: support nonzero mii base address

The mv88e6060 uses either the lower 16 or upper 16 mii addresses,
depending on the value of the EE_CLK/ADDR4 pin. Support both
configurations by using the sw_addr setting as base address.

Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Acked-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoMerge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/bwh/sfc...
David S. Miller [Tue, 8 Mar 2011 19:32:45 +0000]
Merge branch 'for-davem' of git://git./linux/kernel/git/bwh/sfc-next-2.6

8 years agoMerge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/jkirsher/net...
David S. Miller [Tue, 8 Mar 2011 19:08:35 +0000]
Merge branch 'master' of /linux/kernel/git/jkirsher/net-next-2.6

8 years agoipv4: Fix scope value used in route src-address caching.
David S. Miller [Tue, 8 Mar 2011 19:03:21 +0000]
ipv4: Fix scope value used in route src-address caching.

We have to use cfg->fc_scope not the final nh_scope value.

Reported-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoipv4: Cache source address in nexthop entries.
David S. Miller [Tue, 8 Mar 2011 04:54:48 +0000]
ipv4: Cache source address in nexthop entries.

When doing output route lookups, we have to select the source address
if the user has not specified an explicit one.

First, if the route has an explicit preferred source address
specified, then we use that.

Otherwise we search the route's outgoing interface for a suitable
address.

This search can be precomputed and cached at route insertion time.

The only missing part is that we have to refresh this precomputed
value any time addresses are added or removed from the interface, and
this is accomplished by fib_update_nh_saddrs().

Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoixgbe: fix setting and reporting of advertised speeds
Emil Tantilov [Fri, 4 Mar 2011 09:06:10 +0000]
ixgbe: fix setting and reporting of advertised speeds

Add the ability to set 100/F on x540.
Fix reporting of advertised modes by adding check for phy.autoneg_advertised

Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Tested-by: Stephen Ko <stephen.s.ko@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoixgbe: fix spelling errors
Emil Tantilov [Thu, 3 Mar 2011 09:25:07 +0000]
ixgbe: fix spelling errors

Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Tested-by: Stephen Ko <stephen.s.ko@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoixgbe: improve logic in ixgbe_init_mbx_params_pf
Emil Tantilov [Thu, 3 Mar 2011 09:25:02 +0000]
ixgbe: improve logic in ixgbe_init_mbx_params_pf

Use if/then instead of an all-inclusive case statement.

Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Tested-by: Stephen Ko <stephen.s.ko@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoixgbe: add function description
Emil Tantilov [Thu, 3 Mar 2011 09:24:56 +0000]
ixgbe: add function description

Add description for ixgbe_init_eeprom_params_X540 and whitespace fix.

Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Tested-by: Stephen Ko <stephen.s.ko@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoixgbe: Enable flow control pause parameter auto-negotiation support
Emil Tantilov [Sat, 26 Feb 2011 06:40:16 +0000]
ixgbe: Enable flow control pause parameter auto-negotiation support

This patch enables flow control pause parameters auto-negotiation support
to 82599 based 10G Base-T, backplane devices and multi-speed fiber optics
modules at 1G speed

Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Tested-by: Stephen Ko <stephen.s.ko@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoixgbe: Add x540 statistic counter definitions
Emil Tantilov [Sat, 26 Feb 2011 06:40:11 +0000]
ixgbe: Add x540 statistic counter definitions

Add defines to accumulate and display x540 PHY statistic counters on
transmit/receive.

Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Tested-by: Stephen Ko <stephen.s.ko@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoixgbe: clear correct counters for flow control on 82599
Emil Tantilov [Sat, 26 Feb 2011 06:40:05 +0000]
ixgbe: clear correct counters for flow control on 82599

The 82599 was not correctly having some of it's counters cleared for flow
control.  This change corrects that.

Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoixgbe: cleanup PHY init
Emil Tantilov [Fri, 25 Feb 2011 07:49:39 +0000]
ixgbe: cleanup PHY init

This change cleans up several situations in which we were either stepping
over possible errors, or calling initialization routines multiple times.
Also includes whitespace fixes where applicable.

Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Tested-by: Stephen Ko <stephen.s.ko@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoixgbe: add support to FCoE DDP in target mode
Yi Zou [Tue, 1 Feb 2011 07:22:16 +0000]
ixgbe: add support to FCoE DDP in target mode

Add support to the ndo_fcoe_ddp_target() to allow the Intel 82599 device to
also provide DDP offload capability when the upper FCoE protocol stack is
operating as a target.

Signed-off-by: Yi Zou <yi.zou@intel.com>
Signed-off-by: Kiran Patil <kiran.patil@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agovlan: add support to ndo_fcoe_ddp_target()
Yi Zou [Tue, 1 Feb 2011 07:22:11 +0000]
vlan: add support to ndo_fcoe_ddp_target()

Add the new target ddp offload support ndo_fcoe_ddp_target().

Signed-off-by: Yi Zou <yi.zou@intel.com>
Signed-off-by: Kiran Patil <kiran.patil@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agonet: add ndo_fcoe_ddp_target() to support FCoE DDP in target mode
Yi Zou [Tue, 1 Feb 2011 07:22:06 +0000]
net: add ndo_fcoe_ddp_target() to support FCoE DDP in target mode

The Fiber Channel over Ethernet (FCoE) Direct Data Placement (DDP) can also be
used for FCoE target, where the DDP used for read I/O on an initiator can be
used on an FCoE target to speed up the write I/O to the target from the initiator.
The added ndo_fcoe_ddp_target() works in the similar way as the existing
ndo_fcoe_ddp_setup() to allow the underlying hardware set up the DDP context
accordingly when it gets called from the FCoE target implementation on top
the existing Open-FCoE fcoe/libfc protocol stack so without losing the ability
to provide DDP for read I/O as an initiator, it can also provide DDP offload
to the write I/O coming from the initiator as a target.

Signed-off-by: Yi Zou <yi.zou@intel.com>
Signed-off-by: Kiran Patil <kiran.patil@intel.com>
Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoixgbe: fix missing function pointer conversion
Don Skidmore [Sun, 6 Mar 2011 02:59:20 +0000]
ixgbe: fix missing function pointer conversion

In the previous commit:
  commit 5e655105e3e19d746f9e95c514b014c11c3d1b6a
  Author: Don Skidmore <donald.c.skidmore@intel.com>
  Date:   Fri Feb 25 01:58:04 2011 +0000

  ixgbe: add function pointer for semaphore function

there was one release of the semaphore function call which
did not get converted to a function pointer.

Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoigb: Add stats output for OS2BMC feature on i350 devices
Carolyn Wyborny [Sat, 26 Feb 2011 07:42:37 +0000]
igb: Add stats output for OS2BMC feature on i350 devices

This patch adds statistics output for OS2BMC feature which is configured
by eeprom on capable devices.

Signed-off-by: Carolyn Wyborny <carolyn.wyborny@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoe1000e: fix build issue due to undefined reference to crc32_le
Emil Tantilov [Mon, 14 Feb 2011 08:19:24 +0000]
e1000e: fix build issue due to undefined reference to crc32_le

kernel build fails with:

drivers/built-in.o: In function `e1000_lv_jumbo_workaround_ich8lan':
(.text+0x3e7a8): undefined reference to `crc32_le'

when CONFIG_CRC32 is not set or does not match the CONFIG_E1000E
selection.

Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Reviewed-by: Bruce Allan <bruce.w.allan@intel.com>
Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

8 years agoaf_unix: remove unused struct sockaddr_un cruft
Hagen Paul Pfeifer [Fri, 4 Mar 2011 11:45:06 +0000]
af_unix: remove unused struct sockaddr_un cruft

Signed-off-by: Hagen Paul Pfeifer <hagen@jauu.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agosctp: several declared/set but unused fixes
Hagen Paul Pfeifer [Fri, 4 Mar 2011 11:45:05 +0000]
sctp: several declared/set but unused fixes

Signed-off-by: Hagen Paul Pfeifer <hagen@jauu.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoaf_packet: struct socket declared/assigned but unused
Hagen Paul Pfeifer [Fri, 4 Mar 2011 11:45:04 +0000]
af_packet: struct socket declared/assigned but unused

Signed-off-by: Hagen Paul Pfeifer <hagen@jauu.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agomcast: net_device dev not used
Hagen Paul Pfeifer [Fri, 4 Mar 2011 11:45:03 +0000]
mcast: net_device dev not used

ip6_mc_source(), ip6_mc_msfilter() as well as ip6_mc_msfget() declare
and assign dev but do not use the variable afterwards.

Signed-off-by: Hagen Paul Pfeifer <hagen@jauu.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agos2io: fix uninitialized compile warning
Shan Wei [Fri, 4 Mar 2011 01:23:58 +0000]
s2io: fix uninitialized compile warning

drivers/net/s2io.c:7559: warning: ‘tcp_len’ may be used uninitialized in this function

Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agobonding: COW before overwriting the destination MAC address
Changli Gao [Wed, 2 Mar 2011 21:07:14 +0000]
bonding: COW before overwriting the destination MAC address

When there is a ptype handler holding a clone of this skb, whose
destination MAC addresse is overwritten, the owner of this handler may
get a corrupted packet.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agobonding: remove the unused dummy functions when net poll controller isn't enabled
Changli Gao [Wed, 2 Mar 2011 18:26:21 +0000]
bonding: remove the unused dummy functions when net poll controller isn't enabled

These two functions are only used when net poll controller is enabled.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoMerge branch 'davem-next.r8169' of git://git.kernel.org/pub/scm/linux/kernel/git...
David S. Miller [Mon, 7 Mar 2011 23:39:24 +0000]
Merge branch 'davem-next.r8169' of git://git./linux/kernel/git/romieu/netdev-2.6

8 years agonet: allow handlers to be processed for orig_dev
Jiri Pirko [Mon, 28 Feb 2011 20:26:31 +0000]
net: allow handlers to be processed for orig_dev

This was there before, I forgot about this. Allows deliveries to
ptype_base handlers registered for orig_dev. I presume this is still
desired.

Signed-off-by: Jiri Pirko <jpirko@redhat.com>
Reviewed-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agobe2net: Add multicast filter capability for Lancer
Padmanabh Ratnakar [Mon, 7 Mar 2011 03:09:36 +0000]
be2net: Add multicast filter capability for Lancer

Lancer requires multicast capability flag set during IFACE_CREATE
for adding multicast filters.

Signed-off-by: Padmanabh Ratnakar <padmanabh.ratnakar@emulex.com>
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
Signed-off-by: Subramanian Seetharaman <subbu.seetharaman@emulex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agobe2net: Disarm CQ and EQ to disable interrupt in Lancer
Padmanabh Ratnakar [Mon, 7 Mar 2011 03:09:17 +0000]
be2net: Disarm CQ and EQ to disable interrupt in Lancer

For Lancer disable interrupts in close by disarming CQs and EQs.
Change the order of calls in be_close to achieve the correct result.

Signed-off-by: Padmanabh Ratnakar <padmanabh.ratnakar@emulex.com>
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
Signed-off-by: Subramanian Seetharaman <subbu.seetharaman@emulex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agobe2net: Remove TX Queue stop in close
Padmanabh Ratnakar [Mon, 7 Mar 2011 03:09:04 +0000]
be2net: Remove TX Queue stop in close

Remove TX Queue stop in close

Signed-off-by: Padmanabh Ratnakar <padmanabh.ratnakar@emulex.com>
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
Signed-off-by: Subramanian Seetharaman <subbu.seetharaman@emulex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agobe2net: Change f/w command versions for Lancer
Padmanabh Ratnakar [Mon, 7 Mar 2011 03:08:52 +0000]
be2net: Change f/w command versions for Lancer

Change f/w command versions for Lancer

Signed-off-by: Padmanabh Ratnakar <padmanabh.ratnakar@emulex.com>
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
Signed-off-by: Subramanian Seetharaman <subbu.seetharaman@emulex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agobe2net: Add error recovery during load for Lancer
Padmanabh Ratnakar [Mon, 7 Mar 2011 03:08:36 +0000]
be2net: Add error recovery during load for Lancer

Add error recovery during load for Lancer

Signed-off-by: Padmanabh Ratnakar <padmanabh.ratnakar@emulex.com>
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
Signed-off-by: Subramanian Seetharaman <subbu.seetharaman@emulex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agobe2net: Checksum field valid only for TCP/UDP
Padmanabh Ratnakar [Mon, 7 Mar 2011 03:08:16 +0000]
be2net: Checksum field valid only for TCP/UDP

L4 checksum field is valid only for TCP/UDP packets in Lancer

Signed-off-by: Padmanabh Ratnakar <padmanabh.ratnakar@emulex.com>
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
Signed-off-by: Subramanian Seetharaman <subbu.seetharaman@emulex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agobe2net: Remove ERR compl workaround for Lancer
Padmanabh Ratnakar [Mon, 7 Mar 2011 03:07:58 +0000]
be2net: Remove ERR compl workaround for Lancer

Workaround added for Lancer in handling RX ERR completion received
when no RX buffers are posted is not needed.

Signed-off-by: Padmanabh Ratnakar <padmanabh.ratnakar@emulex.com>
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
Signed-off-by: Subramanian Seetharaman <subbu.seetharaman@emulex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoipv4: Inline fib_semantic_match into check_leaf
David S. Miller [Mon, 7 Mar 2011 23:01:10 +0000]
ipv4: Inline fib_semantic_match into check_leaf

This elimiates a lot of pure overhead due to parameter
passing.

Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoipv4: Validate route entry type at insert instead of every lookup.
David S. Miller [Mon, 7 Mar 2011 22:27:38 +0000]
ipv4: Validate route entry type at insert instead of every lookup.

fib_semantic_match() requires that if the type doesn't signal an
automatic error, it must be of type RTN_UNICAST, RTN_LOCAL,
RTN_BROADCAST, RTN_ANYCAST, or RTN_MULTICAST.

Checking this every route lookup is pointless work.

Instead validate it during route insertion, via fib_create_info().

Also, there was nothing making sure the type value was less than
RTN_MAX, so add that missing check while we're here.

Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agonetdevice: Convert printk to pr_info in netif_tx_stop_queue
Joe Perches [Tue, 1 Mar 2011 07:06:12 +0000]
netdevice: Convert printk to pr_info in netif_tx_stop_queue

This allows any caller to be prefaced by any specific
pr_fmt to better identify which device driver is using
this function inappropriately.

Add terminating newline.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoMerge branch 'batman-adv/next' of git://git.open-mesh.org/ecsv/linux-merge
David S. Miller [Mon, 7 Mar 2011 08:37:13 +0000]
Merge branch 'batman-adv/next' of git://git.open-mesh.org/ecsv/linux-merge

8 years agobatman-adv: Disallow regular interface as mesh device
Sven Eckelmann [Fri, 4 Mar 2011 21:36:41 +0000]
batman-adv: Disallow regular interface as mesh device

When trying to associate a net_device with another net_device which
already exists, batman-adv assumes that this interface is a fully
initialized batman mesh interface without checking it. The behaviour
when accessing data behind netdev_priv of a random net_device is
undefined and potentially dangerous.

Reported-by: Linus Lüssing <linus.luessing@ascom.ch>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: Remove unused hdr_size variable in route_unicast_packet()
Linus Lüssing [Wed, 2 Mar 2011 17:39:31 +0000]
batman-adv: Remove unused hdr_size variable in route_unicast_packet()

Signed-off-by: Linus Lüssing <linus.luessing@ascom.ch>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: rename batman_if struct to hard_iface
Marek Lindner [Fri, 18 Feb 2011 12:33:20 +0000]
batman-adv: rename batman_if struct to hard_iface

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: rename global if_list to hardif_list
Marek Lindner [Fri, 18 Feb 2011 12:33:19 +0000]
batman-adv: rename global if_list to hardif_list

Batman-adv works with "hard interfaces" as well as "soft interfaces".
The new name should better make clear which kind of interfaces this
list stores.

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: remove orig_hash spinlock
Marek Lindner [Wed, 19 Jan 2011 20:01:44 +0000]
batman-adv: remove orig_hash spinlock

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: increase refcount in create_neighbor to be consistent
Marek Lindner [Fri, 18 Feb 2011 12:28:11 +0000]
batman-adv: increase refcount in create_neighbor to be consistent

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: Correct rcu refcounting for orig_node
Marek Lindner [Fri, 18 Feb 2011 12:28:10 +0000]
batman-adv: Correct rcu refcounting for orig_node

It might be possible that 2 threads access the same data in the same
rcu grace period. The first thread calls call_rcu() to decrement the
refcount and free the data while the second thread increases the
refcount to use the data. To avoid this race condition all refcount
operations have to be atomic.

Reported-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: remove extra layer between hash and hash element - hash bucket
Marek Lindner [Fri, 18 Feb 2011 12:28:09 +0000]
batman-adv: remove extra layer between hash and hash element - hash bucket

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: separate ethernet comparing calls from hash functions
Marek Lindner [Fri, 18 Feb 2011 12:28:08 +0000]
batman-adv: separate ethernet comparing calls from hash functions

Note: The function compare_ether_addr() provided by the Linux kernel
requires aligned memory.

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: Fix possible buffer overflow in softif neigh list output
Linus Lüssing [Fri, 18 Feb 2011 12:20:13 +0000]
batman-adv: Fix possible buffer overflow in softif neigh list output

When printing the soft interface table the number of entries in the
softif neigh list are first being counted and a fitting buffer
allocated. After that the softif neigh list gets locked again and
the buffer printed - which has the following two issues:

For one thing, the softif neigh list might have grown when reacquiring
the rcu lock, which results in writing outside of the allocated buffer.
Furthermore 31 Bytes are not enough for printing an entry with a vid
of more than 2 digits.

The manual buffering is unnecessary, we can safely print to the seq
directly during the rcu_read_lock().

Signed-off-by: Linus Lüssing <linus.luessing@ascom.ch>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: Increase orig_node refcount before releasing rcu read lock
Linus Lüssing [Sun, 13 Feb 2011 21:13:04 +0000]
batman-adv: Increase orig_node refcount before releasing rcu read lock

When unicast_send_skb() is increasing the orig_node's refcount another
thread might have been freeing this orig_node already. We need to
increase the refcount in the rcu read lock protected area to avoid that.

Signed-off-by: Linus Lüssing <linus.luessing@ascom.ch>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: Make bat_priv->curr_gw an rcu protected pointer
Linus Lüssing [Sun, 13 Feb 2011 21:13:02 +0000]
batman-adv: Make bat_priv->curr_gw an rcu protected pointer

The rcu protected macros rcu_dereference() and rcu_assign_pointer()
for the bat_priv->curr_gw need to be used, as well as spin/rcu locking.

Otherwise we might end up using a curr_gw pointer pointing to already
freed memory.

Reported-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Linus Lüssing <linus.luessing@ascom.ch>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: make broadcast seqno operations atomic
Marek Lindner [Tue, 25 Jan 2011 21:52:11 +0000]
batman-adv: make broadcast seqno operations atomic

Batman-adv could receive several payload broadcasts at the same time
that would trigger access to the broadcast seqno sliding window to
determine whether this is a new broadcast or not. If these incoming
broadcasts are accessing the sliding window simultaneously it could
be left in an inconsistent state. Therefore it is necessary to make
sure this access is atomic.

Reported-by: Linus Lüssing <linus.luessing@web.de>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: protect bit operations to count OGMs with spinlock
Marek Lindner [Tue, 25 Jan 2011 21:52:10 +0000]
batman-adv: protect bit operations to count OGMs with spinlock

Reported-by: Linus Lüssing <linus.luessing@saxnet.de>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: Correct rcu refcounting for batman_if
Marek Lindner [Thu, 10 Feb 2011 14:33:51 +0000]
batman-adv: Correct rcu refcounting for batman_if

It might be possible that 2 threads access the same data in the same
rcu grace period. The first thread calls call_rcu() to decrement the
refcount and free the data while the second thread increases the
refcount to use the data. To avoid this race condition all refcount
operations have to be atomic.

Reported-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: Correct rcu refcounting for softif_neigh
Marek Lindner [Thu, 10 Feb 2011 14:33:50 +0000]
batman-adv: Correct rcu refcounting for softif_neigh

It might be possible that 2 threads access the same data in the same
rcu grace period. The first thread calls call_rcu() to decrement the
refcount and free the data while the second thread increases the
refcount to use the data. To avoid this race condition all refcount
operations have to be atomic.

Reported-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: Correct rcu refcounting for gw_node
Marek Lindner [Thu, 10 Feb 2011 14:33:49 +0000]
batman-adv: Correct rcu refcounting for gw_node

It might be possible that 2 threads access the same data in the same
rcu grace period. The first thread calls call_rcu() to decrement the
refcount and free the data while the second thread increases the
refcount to use the data. To avoid this race condition all refcount
operations have to be atomic.

Reported-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: Correct rcu refcounting for neigh_node
Marek Lindner [Thu, 10 Feb 2011 14:33:53 +0000]
batman-adv: Correct rcu refcounting for neigh_node

It might be possible that 2 threads access the same data in the same
rcu grace period. The first thread calls call_rcu() to decrement the
refcount and free the data while the second thread increases the
refcount to use the data. To avoid this race condition all refcount
operations have to be atomic.

Reported-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: protect bonding with rcu locks
Simon Wunderlich [Wed, 19 Jan 2011 20:01:43 +0000]
batman-adv: protect bonding with rcu locks

bonding / alternating candidates need to be secured by rcu locks
as well. This patch therefore converts the bonding list
from a plain pointer list to a rcu securable lists and references
the bonding candidates.

Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: protect ogm counter arrays with spinlock
Marek Lindner [Wed, 19 Jan 2011 20:01:42 +0000]
batman-adv: protect ogm counter arrays with spinlock

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: protect originator nodes with reference counters
Marek Lindner [Wed, 19 Jan 2011 20:01:42 +0000]
batman-adv: protect originator nodes with reference counters

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: protect each hash row with rcu locks
Marek Lindner [Wed, 19 Jan 2011 20:01:40 +0000]
batman-adv: protect each hash row with rcu locks

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: protect neigh_nodes used outside of rcu_locks with refcounting
Marek Lindner [Wed, 19 Jan 2011 20:01:39 +0000]
batman-adv: protect neigh_nodes used outside of rcu_locks with refcounting

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: free neighbors when an interface is deactivated
Marek Lindner [Wed, 19 Jan 2011 19:16:10 +0000]
batman-adv: free neighbors when an interface is deactivated

hardif_disable_interface() calls purge_orig_ref() to immediately free
all neighbors associated with the interface that is going down.
purge_orig_neighbors() checked if the interface status is IF_INACTIVE
which is set to IF_NOT_IN_USE shortly before calling purge_orig_ref().

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: protect neighbor list with rcu locks
Marek Lindner [Sun, 12 Dec 2010 21:57:12 +0000]
batman-adv: protect neighbor list with rcu locks

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: convert neighbor list to hlist
Marek Lindner [Sun, 12 Dec 2010 21:57:11 +0000]
batman-adv: convert neighbor list to hlist

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agobatman-adv: protect neighbor nodes with reference counters
Marek Lindner [Sun, 12 Dec 2010 21:57:10 +0000]
batman-adv: protect neighbor nodes with reference counters

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

8 years agor8169: convert to new VLAN model.
Francois Romieu [Tue, 1 Mar 2011 16:18:33 +0000]
r8169: convert to new VLAN model.

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Reviewed-by: Jesse Gross <jesse@nicira.com>

8 years agor8169: support control of advertising.
Oliver Neukum [Thu, 6 Jan 2011 20:55:13 +0000]
r8169: support control of advertising.

This allows "ethtool advertise" to control the speed and duplex
features the device offers the switch.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>

8 years agor8169: support the new chips for RTL8105E.
Hayes Wang [Tue, 22 Feb 2011 09:26:21 +0000]
r8169: support the new chips for RTL8105E.

Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Acked-by: Francois Romieu <romieu@fr.zoreil.com>

8 years agoipv4: Remove flowi from struct rtable.
David S. Miller [Sat, 5 Mar 2011 05:47:09 +0000]
ipv4: Remove flowi from struct rtable.

The only necessary parts are the src/dst addresses, the
interface indexes, the TOS, and the mark.

The rest is unnecessary bloat, which amounts to nearly
50 bytes on 64-bit.

Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoipv4: Set rt->rt_iif more sanely on output routes.
David S. Miller [Sat, 5 Mar 2011 05:35:25 +0000]
ipv4: Set rt->rt_iif more sanely on output routes.

rt->rt_iif is only ever inspected on input routes, for example DCCP
uses this to populate a route lookup flow key when generating replies
to another packet.

Therefore, setting it to anything other than zero on output routes
makes no sense.

Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoipv4: Use passed-in protocol in ip_route_newports().
David S. Miller [Sat, 5 Mar 2011 05:31:48 +0000]
ipv4: Use passed-in protocol in ip_route_newports().

Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoipv4: Get peer more cheaply in rt_init_metrics().
David S. Miller [Sat, 5 Mar 2011 05:26:07 +0000]
ipv4: Get peer more cheaply in rt_init_metrics().

We know this is a new route object, so doing atomics and
stuff makes no sense at all.

Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoipv4: Optimize flow initialization in output route lookup.
David S. Miller [Sat, 5 Mar 2011 05:24:47 +0000]
ipv4: Optimize flow initialization in output route lookup.

We burn a lot of useless cycles, cpu store buffer traffic, and
memory operations memset()'ing the on-stack flow used to perform
output route lookups in __ip_route_output_key().

Only the first half of the flow object members even matter for
output route lookups in this context, specifically:

FIB rules matching cares about:

dst, src, tos, iif, oif, mark

FIB trie lookup cares about:

dst

FIB semantic match cares about:

tos, scope, oif

Therefore only initialize these specific members and elide the
memset entirely.

On Niagara2 this kills about ~300 cycles from the output route
lookup path.

Likely, we can take things further, since all callers of output
route lookups essentially throw away the on-stack flow they use.
So they don't care if we use it as a scratch-pad to compute the
final flow key.

Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>

8 years agoinetpeer: seqlock optimization
Eric Dumazet [Fri, 4 Mar 2011 22:33:59 +0000]
inetpeer: seqlock optimization

David noticed :

------------------
Eric, I was profiling the non-routing-cache case and something that
stuck out is the case of calling inet_getpeer() with create==0.

If an entry is not found, we have to redo the lookup under a spinlock
to make certain that a concurrent writer rebalancing the tree does
not "hide" an existing entry from us.

This makes the case of a create==0 lookup for a not-present entry
really expensive.  It is on the order of 600 cpu cycles on my
Niagara2.

I added a hack to not do the relookup under the lock when create==0
and it now costs less than 300 cycles.

This is now a pretty common operation with the way we handle COW'd
metrics, so I think it's definitely worth optimizing.
-----------------

One solution is to use a seqlock instead of a spinlock to protect struct
inet_peer_base.

After a failed avl tree lookup, we can easily detect if a writer did
some changes during our lookup. Taking the lock and redo the lookup is
only necessary in this case.

Note: Add one private rcu_deref_locked() macro to place in one spot the
access to spinlock included in seqlock.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 years agoMerge branch 'for-davem' of ssh://master.kernel.org/pub/scm/linux/kernel/git/linville...
David S. Miller [Fri, 4 Mar 2011 20:48:25 +0000]
Merge branch 'for-davem' of ssh:///linux/kernel/git/linville/wireless-next-2.6

8 years agoMerge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wirel...
John W. Linville [Fri, 4 Mar 2011 19:10:40 +0000]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-next-2.6 into for-davem

8 years agosfc: Use write-combining to reduce TX latency
Ben Hutchings [Tue, 22 Feb 2011 17:26:10 +0000]
sfc: Use write-combining to reduce TX latency

Based on work by Neil Turton <nturton@solarflare.com> and
Kieran Mansley <kmansley@solarflare.com>.

The BIU has now been verified to handle 3- and 4-dword writes within a
single 128-bit register correctly.  This means we can enable write-
combining and only insert write barriers between writes to distinct
registers.

This has been observed to save about 0.5 us when pushing a TX
descriptor to an empty TX queue.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>

8 years agoMerge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
David S. Miller [Fri, 4 Mar 2011 05:27:42 +0000]
Merge branch 'master' of /linux/kernel/git/davem/net-2.6

Conflicts:
drivers/net/bnx2x/bnx2x.h

8 years agoMerge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris...
Linus Torvalds [Thu, 3 Mar 2011 23:48:01 +0000]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
  DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]

8 years agoMerge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
Linus Torvalds [Thu, 3 Mar 2011 23:43:15 +0000]
Merge git://git./linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits)
  MAINTAINERS: Add Andy Gospodarek as co-maintainer.
  r8169: disable ASPM
  RxRPC: Fix v1 keys
  AF_RXRPC: Handle receiving ACKALL packets
  cnic: Fix lost interrupt on bnx2x
  cnic: Prevent status block race conditions with hardware
  net: dcbnl: check correct ops in dcbnl_ieee_set()
  e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead
  igb: fix sparse warning
  e1000: fix sparse warning
  netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values
  dccp: fix oops on Reset after close
  ipvs: fix dst_lock locking on dest update
  davinci_emac: Add Carrier Link OK check in Davinci RX Handler
  bnx2x: update driver version to 1.62.00-6
  bnx2x: properly calculate lro_mss
  bnx2x: perform statistics "action" before state transition.
  bnx2x: properly configure coefficients for MinBW algorithm (NPAR mode).
  bnx2x: Fix ethtool -t link test for MF (non-pmf) devices.
  bnx2x: Fix nvram test for single port devices.
  ...

8 years agoMerge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block
Linus Torvalds [Thu, 3 Mar 2011 23:42:35 +0000]
Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block

* 'for-linus' of git://git.kernel.dk/linux-2.6-block:
  block: kill loop_mutex
  blktrace: Remove blk_fill_rwbs_rq.
  block: blk-flush shouldn't call directly into q->request_fn() __blk_run_queue()
  block: add @force_kblockd to __blk_run_queue()
  block: fix kernel-doc format for blkdev_issue_zeroout
  blk-throttle: Do not use kblockd workqueue for throtl work

8 years agoMerge branch 'i_nlink' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6
Linus Torvalds [Thu, 3 Mar 2011 23:37:59 +0000]
Merge branch 'i_nlink' of git://git./linux/kernel/git/viro/vfs-2.6

* 'i_nlink' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
  hfs: fix rename() over non-empty directory
  udf: fix i_nlink limit
  fix reiserfs mkdir() breakage
  exofs: i_nlink races in rename()
  nilfs2: i_nlink races in rename()
  minix: i_nlink races in rename()
  ufs: i_nlink races in rename()
  sysv: i_nlink races in rename()

8 years agoDNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]
David Howells [Thu, 3 Mar 2011 11:28:58 +0000]
DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]

When a DNS resolver key is instantiated with an error indication, attempts to
read that key will result in an oops because user_read() is expecting there to
be a payload - and there isn't one [CVE-2011-1076].

Give the DNS resolver key its own read handler that returns the error cached in
key->type_data.x[0] as an error rather than crashing.

Also make the kenter() at the beginning of dns_resolver_instantiate() limit the
amount of data it prints, since the data is not necessarily NUL-terminated.

The buggy code was added in:

commit 4a2d789267e00b5a1175ecd2ddefcc78b83fbf09
Author: Wang Lei <wang840925@gmail.com>
Date:   Wed Aug 11 09:37:58 2010 +0100
Subject: DNS: If the DNS server returns an error, allow that to be cached [ver #2]

This can trivially be reproduced by any user with the following program
compiled with -lkeyutils:

#include <stdlib.h>
#include <keyutils.h>
#include <err.h>
static char payload[] = "#dnserror=6";
int main()
{
key_serial_t key;
key = add_key("dns_resolver", "a", payload, sizeof(payload),
      KEY_SPEC_SESSION_KEYRING);
if (key == -1)
err(1, "add_key");
if (keyctl_read(key, NULL, 0) == -1)
err(1, "read_key");
return 0;
}

What should happen is that keyctl_read() reports error 6 (ENXIO) to the user:

dns-break: read_key: No such device or address

but instead the kernel oopses.

This cannot be reproduced with the 'keyutils add' or 'keyutils padd' commands
as both of those cut the data down below the NUL termination that must be
included in the data.  Without this dns_resolver_instantiate() will return
-EINVAL and the key will not be instantiated such that it can be read.

The oops looks like:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
IP: [<ffffffff811b99f7>] user_read+0x4f/0x8f
PGD 3bdf8067 PUD 385b9067 PMD 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:19.0/irq
CPU 0
Modules linked in:

Pid: 2150, comm: dns-break Not tainted 2.6.38-rc7-cachefs+ #468                  /DG965RY
RIP: 0010:[<ffffffff811b99f7>]  [<ffffffff811b99f7>] user_read+0x4f/0x8f
RSP: 0018:ffff88003bf47f08  EFLAGS: 00010246
RAX: 0000000000000001 RBX: ffff88003b5ea378 RCX: ffffffff81972368
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003b5ea378
RBP: ffff88003bf47f28 R08: ffff88003be56620 R09: 0000000000000000
R10: 0000000000000395 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffffffffffffffa1
FS:  00007feab5751700(0000) GS:ffff88003e000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000003de40000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process dns-break (pid: 2150, threadinfo ffff88003bf46000, task ffff88003be56090)
Stack:
 ffff88003b5ea378 ffff88003b5ea3a0 0000000000000000 0000000000000000
 ffff88003bf47f68 ffffffff811b708e ffff88003c442bc8 0000000000000000
 00000000004005a0 00007fffba368060 0000000000000000 0000000000000000
Call Trace:
 [<ffffffff811b708e>] keyctl_read_key+0xac/0xcf
 [<ffffffff811b7c07>] sys_keyctl+0x75/0xb6
 [<ffffffff81001f7b>] system_call_fastpath+0x16/0x1b
Code: 75 1f 48 83 7b 28 00 75 18 c6 05 58 2b fb 00 01 be bb 00 00 00 48 c7 c7 76 1c 75 81 e8 13 c2 e9 ff 4c 8b b3 e0 00 00 00 4d 85 ed <41> 0f b7 5e 10 74 2d 4d 85 e4 74 28 e8 98 79 ee ff 49 39 dd 48
RIP  [<ffffffff811b99f7>] user_read+0x4f/0x8f
 RSP <ffff88003bf47f08>
CR2: 0000000000000010

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
cc: Wang Lei <wang840925@gmail.com>
Signed-off-by: James Morris <jmorris@namei.org>