12 years agosfc: Fix SFE4002 initialisation
Steve Hodgson [Fri, 12 Feb 2010 20:32:27 +0000 (12:32 -0800)]
sfc: Fix SFE4002 initialisation

From: Steve Hodgson <>

Commit 357d46a17e54c9a87e0e6ef3930ff4ab2d232b81 "sfc: QT202x: Remove
unreliable MMD check at initialisation" broke initialisation of the
SFE4002.  efx_mdio_reset_mmd() returns a positive value rather than 0
on success.  The above commit causes this value to be propagated up
by qt202x_reset_phy(), which is treated as a failure by its callers.
Change qt202x_reset_phy() to return 0 if successful.

The PCI layer treats >0 as "fail, but please call remove() anyway",
which means that unloading the driver would cause a crash.  Add a
WARN_ON() on the failure path of efx_pci_probe() to provide early
warning if there are any other cases where we do this.

Signed-off-by: Ben Hutchings <>
Signed-off-by: David S. Miller <>
12 years agoinet: Remove bogus IGMPv3 report handling
Herbert Xu [Sun, 7 Feb 2010 17:26:30 +0000 (17:26 +0000)]
inet: Remove bogus IGMPv3 report handling

Currently we treat IGMPv3 reports as if it were an IGMPv2/v1 report.
This is broken as IGMPv3 reports are formatted differently.  So we
end up suppressing a bogus multicast group (which should be harmless
as long as the leading reserved field is zero).

In fact, IGMPv3 does not allow membership report suppression so
we should simply ignore IGMPv3 membership reports as a host.

This patch does exactly that.  I kept the case statement for it
so people won't accidentally add it back thinking that we overlooked
this case.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
12 years agotcp: fix ICMP-RTO war
Damian Lukowski [Thu, 11 Feb 2010 02:04:08 +0000 (18:04 -0800)]
tcp: fix ICMP-RTO war

Make sure, that TCP has a nonzero RTT estimation after three-way
handshake. Currently, a listening TCP has a value of 0 for srtt,
rttvar and rto right after the three-way handshake is completed
with TCP timestamps disabled.
This will lead to corrupt RTO recalculation and retransmission
flood when RTO is recalculated on backoff reversion as introduced
in "Revert RTO on ICMP destination unreachable"
This behaviour can be provoked by connecting to a server which
"responds first" (like SMTP) and rejecting every packet after
the handshake with dest-unreachable, which will lead to softirq
load on the server (up to 30% per socket in some tests).

Thanks to Ilpo Jarvinen for providing debug patches and to
Denys Fedoryshchenko for reporting and testing.

Changes since v3: Removed bad characters in patchfile.

Reported-by: Denys Fedoryshchenko <>
Signed-off-by: Damian Lukowski <>
Signed-off-by: David S. Miller <>
12 years agoMerge branch 'master' of git://
David S. Miller [Wed, 10 Feb 2010 20:35:24 +0000 (12:35 -0800)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6

12 years agovia-velocity: Fix races on shared interrupts
Simon Kagstrom [Tue, 9 Feb 2010 23:38:25 +0000 (23:38 +0000)]
via-velocity: Fix races on shared interrupts

This patch fixes two potential races in the velocity driver:

* Move the ACK and error handler to the interrupt handler. This fixes a
  potential race with shared interrupts when the other device interrupts
  before the NAPI poll handler has finished. As the velocity driver hasn't
  acked it's own interrupt, it will then steal the interrupt from the
  other device.

* Use spin_lock_irqsave in velocity_poll. In the current code, the
  interrupt handler will deadlock if e.g., the NAPI poll handler is
  executing when an interrupt (for another device) comes in since it
  tries to take the already held lock.

  Also unlock the spinlock only after enabling the interrupt in

The error path is moved to the interrupt handler since this is where the
ISR is checked now.

Signed-off-by: Simon Kagstrom <>
Signed-off-by: Anders Grafstrom <>
Signed-off-by: David S. Miller <>
12 years agovia-velocity: Take spinlock on set coalesce
Simon Kagstrom [Tue, 9 Feb 2010 23:38:07 +0000 (23:38 +0000)]
via-velocity: Take spinlock on set coalesce

velocity_set_coalesce touches ISR and some other sensitive registers not
covered by the rtnl lock, so take the velocity spinlock.

Signed-off-by: Simon Kagstrom <>
Signed-off-by: David S. Miller <>
12 years agovia-velocity: Remove unused IRQ status parameter from rx_srv and tx_srv
Simon Kagstrom [Tue, 9 Feb 2010 23:37:54 +0000 (23:37 +0000)]
via-velocity: Remove unused IRQ status parameter from rx_srv and tx_srv

Signed-off-by: Simon Kagstrom <>
Signed-off-by: David S. Miller <>
12 years agortl8187: Add new device ID
Jelle Martijn Kok [Wed, 10 Feb 2010 15:34:09 +0000 (09:34 -0600)]
rtl8187: Add new device ID

Add new RTL8187B device.

Signed-off-by: Larry Finger <>
Cc: Stable <>
Signed-off-by: John W. Linville <>
12 years agoiwmc3200wifi: Test of wrong pointer after kzalloc in iwm_mlme_update_bss_table()
Roel Kluin [Tue, 9 Feb 2010 11:07:41 +0000 (12:07 +0100)]
iwmc3200wifi: Test of wrong pointer after kzalloc in iwm_mlme_update_bss_table()

The wrong pointer was tested.

Signed-off-by: Roel Kluin <>
Acked-by: Samuel Ortiz <>
Signed-off-by: John W. Linville <>
12 years agoath9k: Fix sequence numbers for PAE frames
Sujith [Tue, 9 Feb 2010 04:37:00 +0000 (10:07 +0530)]
ath9k: Fix sequence numbers for PAE frames

Currently, PAE frames are not assigned proper sequence numbers.
Since sending PAE frames as part of aggregates breaks
crupto with several APs, they are sent as normal MPDUs.
Fix the seqeuence number issue by updating the frame with the
internal sequence number.

Tested-by: Felix Fietkau <>
Signed-off-by: Sujith <>
Signed-off-by: John W. Linville <>
12 years agoMerge branch 'master' of git://
David S. Miller [Tue, 9 Feb 2010 06:45:56 +0000 (22:45 -0800)]
Merge branch 'master' of git://git./linux/kernel/git/holtmann/bluetooth-2.6

12 years agodrivers/net: Correct NULL test
Julia Lawall [Tue, 9 Feb 2010 06:44:18 +0000 (22:44 -0800)]
drivers/net: Correct NULL test

Test the value that was just allocated rather than the previously tested one.

A simplified version of the semantic match that finds this problem is as
follows: (

// <smpl>
expression *x;
expression e;
identifier l;

if (x == NULL || ...) {
    ... when forall
    return ...; }
... when != goto l;
    when != x = e
    when != &x
*x == NULL
// </smpl>

Signed-off-by: Julia Lawall <>
Signed-off-by: David S. Miller <>
12 years agoMAINTAINERS: networking drivers - Add git net-next tree
Joe Perches [Tue, 9 Feb 2010 06:42:40 +0000 (22:42 -0800)]
MAINTAINERS: networking drivers - Add git net-next tree

During the rc period, patches that are not bugfixes
should be done using the net-next tree.

Signed-off-by: Joe Perches <>
Signed-off-by: David S. Miller <>
12 years agonet/sched: Fix module name in Kconfig
Jan Luebbe [Tue, 9 Feb 2010 06:41:44 +0000 (22:41 -0800)]
net/sched: Fix module name in Kconfig

The action modules have been prefixed with 'act_', but the Kconfig
description was not changed.

Signed-off-by: Jan Luebbe <>
Acked-by: Jamal Hadi Salim <>
Signed-off-by: David S. Miller <>
12 years agocxgb3: fix GRO checksum check
Divy Le Ray [Tue, 9 Feb 2010 06:37:24 +0000 (22:37 -0800)]
cxgb3: fix GRO checksum check

Verify the HW checksum state for frames handed to GRO processing.

Signed-off-by: Divy Le Ray <>
Signed-off-by: David S. Miller <>
12 years agodst: call cond_resched() in dst_gc_task()
Eric Dumazet [Mon, 8 Feb 2010 23:00:39 +0000 (15:00 -0800)]
dst: call cond_resched() in dst_gc_task()

Kernel bugzilla #15239

On some workloads, it is quite possible to get a huge dst list to
process in dst_gc_task(), and trigger soft lockup detection.

Fix is to call cond_resched(), as we run in process context.

Reported-by: Pawel Staszewski <>
Tested-by: Pawel Staszewski <>
Signed-off-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
12 years agomac80211: fix deferred hardware scan requests
Johannes Berg [Wed, 3 Feb 2010 09:22:31 +0000 (10:22 +0100)]
mac80211: fix deferred hardware scan requests

Reinette found the reason for the warnings that
happened occasionally when a hw-offloaded scan
finished; her description of the problem:

  mac80211 will defer the handling of scan requests if it is
  busy with management work at the time. The scan requests
  are deferred and run after the work has completed. When
  this occurs there are currently two problems.

  * The scan request for hardware scan is not fully populated
    with the band and channels to scan not initialized.

  * When the scan is queued the state is not correctly updated
    to reflect that a scan is in progress. The problem here is
    that when the driver completes the scan and calls
    ieee80211_scan_completed() a warning will be triggered
    since mac80211 was not aware that a scan was in progress.

The reason is that the queued scan work will start
the hw scan right away when the hw_scan_req struct
has already been allocated. However, in the first
pass it will not have been filled, which happens
at the same time as setting the bits. To fix this,
simply move the allocation after the pending work
test as well, so that the first iteration of the
scan work will call __ieee80211_start_scan() even
in the hardware scan case.

Bug-identified-by: Reinette Chatre <>
Signed-off-by: Johannes Berg <>
Signed-off-by: John W. Linville <>
12 years agoiwlwifi: Fix to set correct ht configuration
Wey-Yi Guy [Fri, 5 Feb 2010 19:40:00 +0000 (11:40 -0800)]
iwlwifi: Fix to set correct ht configuration

iwl_set_rxon_ht() only get called in iwl_post_associate(); which cause
possible incorrect ht configuration. Adding the call in iwl_mac_config() if
IEEE80211_CONF_CHANGE_CHANNEL flag is set to re-configure and send rxon


Signed-off-by: Wey-Yi Guy <>
Signed-off-by: Reinette Chatre <>
Signed-off-by: John W. Linville <>
12 years agomac80211: Fix probe request filtering in IBSS mode
Benoit Papillault [Fri, 5 Feb 2010 00:21:03 +0000 (01:21 +0100)]
mac80211: Fix probe request filtering in IBSS mode

We only reply to probe request if either the requested SSID is the
broadcast SSID or if the requested SSID matches our own SSID. This
latter case was not properly handled since we were replying to different
SSID with the same length as our own SSID.

Signed-off-by: Benoit Papillault <>
Signed-off-by: John W. Linville <>
12 years agonetfilter: nf_conntrack: fix hash resizing with namespaces
Patrick McHardy [Mon, 8 Feb 2010 19:18:07 +0000 (11:18 -0800)]
netfilter: nf_conntrack: fix hash resizing with namespaces

As noticed by Jon Masters <>, the conntrack hash
size is global and not per namespace, but modifiable at runtime through
/sys/module/nf_conntrack/hashsize. Changing the hash size will only
resize the hash in the current namespace however, so other namespaces
will use an invalid hash size. This can cause crashes when enlarging
the hashsize, or false negative lookups when shrinking it.

Move the hash size into the per-namespace data and only use the global
hash size to initialize the per-namespace value when instanciating a
new namespace. Additionally restrict hash resizing to init_net for
now as other namespaces are not handled currently.

Signed-off-by: Patrick McHardy <>
Signed-off-by: David S. Miller <>
12 years agonetfilter: xtables: compat out of scope fix
Alexey Dobriyan [Mon, 8 Feb 2010 19:17:43 +0000 (11:17 -0800)]
netfilter: xtables: compat out of scope fix

As per C99 6.2.4(2) when temporary table data goes out of scope,
the behaviour is undefined:

if (compat) {
struct foo tmp;
private = &tmp;
[dereference private]

Signed-off-by: Alexey Dobriyan <>
Signed-off-by: Patrick McHardy <>
12 years agonetfilter: nf_conntrack: restrict runtime expect hashsize modifications
Alexey Dobriyan [Mon, 8 Feb 2010 19:17:22 +0000 (11:17 -0800)]
netfilter: nf_conntrack: restrict runtime expect hashsize modifications

Expectation hashtable size was simply glued to a variable with no code
to rehash expectations, so it was a bug to allow writing to it.
Make "expect_hashsize" readonly.

Signed-off-by: Alexey Dobriyan <>
Signed-off-by: Patrick McHardy <>
12 years agonetfilter: nf_conntrack: per netns nf_conntrack_cachep
Eric Dumazet [Mon, 8 Feb 2010 19:16:56 +0000 (11:16 -0800)]
netfilter: nf_conntrack: per netns nf_conntrack_cachep

nf_conntrack_cachep is currently shared by all netns instances, but
because of SLAB_DESTROY_BY_RCU special semantics, this is wrong.

If we use a shared slab cache, one object can instantly flight between
one hash table (netns ONE) to another one (netns TWO), and concurrent
reader (doing a lookup in netns ONE, 'finding' an object of netns TWO)
can be fooled without notice, because no RCU grace period has to be
observed between object freeing and its reuse.

We dont have this problem with UDP/TCP slab caches because TCP/UDP
hashtables are global to the machine (and each object has a pointer to
its netns).

If we use per netns conntrack hash tables, we also *must* use per netns
conntrack slab caches, to guarantee an object can not escape from one
namespace to another one.

Signed-off-by: Eric Dumazet <>
[Patrick: added unique slab name allocation]
Signed-off-by: Patrick McHardy <>
12 years agonetfilter: nf_conntrack: fix memory corruption with multiple namespaces
Patrick McHardy [Mon, 8 Feb 2010 19:16:26 +0000 (11:16 -0800)]
netfilter: nf_conntrack: fix memory corruption with multiple namespaces

As discovered by Jon Masters <>, the "untracked"
conntrack, which is located in the data section, might be accidentally
freed when a new namespace is instantiated while the untracked conntrack
is attached to a skb because the reference count it re-initialized.

The best fix would be to use a seperate untracked conntrack per
namespace since it includes a namespace pointer. Unfortunately this is
not possible without larger changes since the namespace is not easily
available everywhere we need it. For now move the untracked conntrack
initialization to the init_net setup function to make sure the reference
count is not re-initialized and handle cleanup in the init_net cleanup
function to make sure namespaces can exit properly while the untracked
conntrack is in use in other namespaces.

Signed-off-by: Patrick McHardy <>
Signed-off-by: David S. Miller <>
12 years agoBluetooth: Keep a copy of each HID device's report descriptor
Michael Poole [Fri, 5 Feb 2010 17:23:43 +0000 (12:23 -0500)]
Bluetooth: Keep a copy of each HID device's report descriptor

The report descriptor is read by user space (via the Service
Discovery Protocol), so it is only available during the ioctl
to connect. However, the HID probe function that needs the
descriptor might not be called until a specific module is
loaded. Keep a copy of the descriptor so it is available for
later use.

Signed-off-by: Michael Poole <>
Signed-off-by: Marcel Holtmann <>
12 years agopktgen: Fix freezing problem
Rafael J. Wysocki [Thu, 4 Feb 2010 22:00:41 +0000 (14:00 -0800)]
pktgen: Fix freezing problem

Add missing try_to_freeze() to one of the pktgen_thread_worker() code
paths so that it doesn't block suspend/hibernation.


Signed-off-by: Rafael J. Wysocki <>
Reported-and-tested-by: Ciprian Dorin Craciun <>
Signed-off-by: David S. Miller <>
12 years agoigb: make certain to reassign legacy interrupt vectors after reset
Alexander Duyck [Wed, 3 Feb 2010 21:59:51 +0000 (21:59 +0000)]
igb: make certain to reassign legacy interrupt vectors after reset

This change corrects an issue that will cause false hangs when using either
82575 or 82580 in legacy interrupt mode.  The issue is caused when there is
a slow traffic flow and an "ethtool -r" is executed while using legacy or
MSI interrupts.  MSI-X is not affected by this issue due to the fact that
we were already reconfiguring the vectors after reset.

If possible it would be best to push this for net-2.6 since it is resolving
a bug but if that is not possible then net-next-2.6 will be fine.

Signed-off-by: Alexander Duyck <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
12 years agoirda: add missing BKL in irnet_ppp ioctl
Thadeu Lima de Souza Cascardo [Mon, 1 Feb 2010 08:21:35 +0000 (08:21 +0000)]
irda: add missing BKL in irnet_ppp ioctl

One ioctl has been forgotten when the BKL was push down into irnet_ppp
ioctl function.

Signed-off-by: Thadeu Lima de Souza Cascardo <>
Signed-off-by: David S. Miller <>
12 years agoirda: unbalanced lock_kernel in irnet_ppp
Thadeu Lima de Souza Cascardo [Mon, 1 Feb 2010 08:21:34 +0000 (08:21 +0000)]
irda: unbalanced lock_kernel in irnet_ppp

Add the missing unlock_kernel in one ioctl operation.

Signed-off-by: Thadeu Lima de Souza Cascardo <>
Signed-off-by: David S. Miller <>
12 years agoixgbe: Fix return of invalid txq
Krishna Kumar [Wed, 3 Feb 2010 13:13:10 +0000 (13:13 +0000)]
ixgbe: Fix return of invalid txq

a developer had complained of getting lots of warnings:

"eth16 selects TX queue 98, but real number of TX queues is 64"

As there was no follow up on that bug, I am submitting this
patch assuming that the other return points will not return
invalid txq's, and also that this fixes the bug (not tested).

Signed-off-by: Krishna Kumar <>
Signed-off-by: Jesse Brandeburg <>
Acked-by: Peter P Waskiewicz Jr <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
12 years agoixgbe: Fix ixgbe_tx_map error path
Anton Blanchard [Wed, 3 Feb 2010 13:12:51 +0000 (13:12 +0000)]
ixgbe: Fix ixgbe_tx_map error path

Commit e5a43549f7a58509a91b299a51337d386697b92c (ixgbe: remove
skb_dma_map/unmap calls from driver) looks to have introduced a bug in
ixgbe_tx_map. If we get an error from a PCI DMA call, we loop backwards
through count until it becomes -1 and return that.

The caller of ixgbe_tx_map expects 0 on error, so return that instead.

Signed-off-by: Anton Blanchard <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
12 years agonetxen: protect resource cleanup by rtnl lock
Amit Kumar Salecha [Tue, 2 Feb 2010 04:16:21 +0000 (04:16 +0000)]
netxen: protect resource cleanup by rtnl lock

o context resources can be in used, while resource cleanup is in progress,
  during fw recover.
o Null pointer execption can occur in send_cmd_desc, if fw recovery
  module frees tx ring without rtnl lock.
o Same applies to ethtool register dump.

Signed-off-by: Amit Kumar Salecha <>
Signed-off-by: David S. Miller <>
12 years agonetxen: fix tx timeout recovery for NX2031 chip
Amit Kumar Salecha [Tue, 2 Feb 2010 04:16:20 +0000 (04:16 +0000)]
netxen: fix tx timeout recovery for NX2031 chip

For NX2031, first try to scrub interrupt before requesting firmware
reset. Return statement was missing after scrubbbing interrupt.

Signed-off-by: Vernon Mauery <>
Signed-off-by: Amit Kumar Salecha <>
Signed-off-by: David S. Miller <>
12 years agoBluetooth: Enter active mode before establishing a SCO link.
Nick Pelly [Fri, 13 Nov 2009 22:16:32 +0000 (14:16 -0800)]
Bluetooth: Enter active mode before establishing a SCO link.

When in sniff mode with a long interval time (1.28s) it can take 4+ seconds
to establish a SCO link. Fix by requesting active mode before requesting
SCO connection. This improves SCO setup time to ~500ms.

Bluetooth headsets that use a long interval time, and exhibit the long
SCO connection time include Motorola H790, HX1 and H17. They have a
CSR 2.1 chipset.

Verified this behavior and fix with host Bluetooth chipsets: BCM4329 and

2009-10-13 14:17:46.183722 > HCI Event: Mode Change (0x14) plen 6
    status 0x00 handle 1 mode 0x02 interval 2048
    Mode: Sniff
2009-10-13 14:17:53.436285 < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
    handle 1 voice setting 0x0060
2009-10-13 14:17:53.445593 > HCI Event: Command Status (0x0f) plen 4
    Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
2009-10-13 14:17:57.788855 > HCI Event: Synchronous Connect Complete 0x2c) plen 17
    status 0x00 handle 257 bdaddr 00:1A:0E:F1:A4:7F type eSCO
    Air mode: CVSD

Signed-off-by: Nick Pelly <>
Signed-off-by: Marcel Holtmann <>
12 years agoBluetooth: Fix memory leak in Marvell BT-over-SDIO driver
Yoichi Yuasa [Thu, 4 Feb 2010 00:55:51 +0000 (09:55 +0900)]
Bluetooth: Fix memory leak in Marvell BT-over-SDIO driver

Signed-off-by: Yoichi Yuasa <>
Signed-off-by: Marcel Holtmann <>
12 years agodccp: fix auto-loading of dccp(_probe)
Gerrit Renker [Tue, 2 Feb 2010 20:16:56 +0000 (20:16 +0000)]
dccp: fix auto-loading of dccp(_probe)

This fixes commit (38ff3e6bb987ec583268da8eb22628293095d43b) ("dccp_probe:
Fix module load dependencies between dccp and dccp_probe", from 15 Jan).

It fixes the construction of the first argument of try_then_request_module(),
where only valid return codes from the first argument should be returned.

What we do now is assign the result of register_jprobe() to ret, without
the side effect of the comparison.

Acked-by: Gerrit Renker <>
Signed-off-by: Neil Horman <>
Signed-off-by: David S. Miller <>
12 years agodccp: fix bug in cache allocation
Gerrit Renker [Mon, 1 Feb 2010 02:12:19 +0000 (02:12 +0000)]
dccp: fix bug in cache allocation

This fixes a bug introduced in commit de4ef86cfce60d2250111f34f8a084e769f23b16
("dccp: fix dccp rmmod when kernel configured to use slub", 17 Jan): the
vsnprintf used sizeof(slab_name_fmt), which became truncated to 4 bytes, since
slab_name_fmt is now a 4-byte pointer and no longer a 32-character array.

This lead to error messages such as
 FATAL: Error inserting dccp: No buffer space available

 >> kernel: [ 1456.341501] kmem_cache_create: duplicate cache cci
generated due to the truncation after the 3rd character.

Fixed for the moment by introducing a symbolic constant. Tested to fix the bug.

Signed-off-by: Gerrit Renker <>
Acked-by: Neil Horman <>
Signed-off-by: David S. Miller <>
12 years agosky2: fix transmit DMA map leakage
stephen hemminger [Mon, 1 Feb 2010 13:41:47 +0000 (13:41 +0000)]
sky2: fix transmit DMA map leakage

The book keeping structure for transmit always had the flags value
cleared so transmit DMA maps were never released correctly.
Based on patch by Jarek Poplawski, problem observed by Michael Breuer.

Signed-off-by: Stephen Hemminger <>
Signed-off-by: David S. Miller <>
12 years agonetlink: fix for too early rmmod
Alexey Dobriyan [Sat, 30 Jan 2010 10:05:05 +0000 (10:05 +0000)]
netlink: fix for too early rmmod

Netlink code does module autoload if protocol userspace is asking for is
not ready. However, module can dissapear right after it was autoloaded.
Example: modprobe/rmmod stress-testing and xfrm_user.ko providing NETLINK_XFRM.

netlink_create() in such situation _will_ create userspace socket and
_will_not_ pin module. Now if module was removed and we're going to call
->netlink_rcv into nothing:

BUG: unable to handle kernel paging request at ffffffffa02f842a
modules are loaded near these addresses here

IP: [<ffffffffa02f842a>] 0xffffffffa02f842a
PGD 161f067 PUD 1623063 PMD baa12067 PTE 0
last sysfs file: /sys/devices/pci0000:00/0000:00:1f.2/host0/target0:0:0/0:0:0:0/block/sda/uevent
Pid: 11515, comm: ip Not tainted 2.6.33-rc5-netns-00594-gaaa5728-dirty #6 P5E/P5E
RIP: 0010:[<ffffffffa02f842a>]  [<ffffffffa02f842a>] 0xffffffffa02f842a
RSP: 0018:ffff8800baa3db48  EFLAGS: 00010292
RAX: ffff8800baa3dfd8 RBX: ffff8800be353640 RCX: 0000000000000000
RDX: ffffffff81959380 RSI: ffff8800bab7f130 RDI: 0000000000000001
RBP: ffff8800baa3db58 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000011
R13: ffff8800be353640 R14: ffff8800bcdec240 R15: ffff8800bd488010
FS:  00007f93749656f0(0000) GS:ffff880002300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffffffffa02f842a CR3: 00000000ba82b000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process ip (pid: 11515, threadinfo ffff8800baa3c000, task ffff8800bab7eb30)
 ffffffff813637c0 ffff8800bd488000 ffff8800baa3dba8 ffffffff8136397d
<0> 0000000000000000 ffffffff81344adc 7fffffffffffffff 0000000000000000
<0> ffff8800baa3ded8 ffff8800be353640 ffff8800bcdec240 0000000000000000
Call Trace:
 [<ffffffff813637c0>] ? netlink_unicast+0x100/0x2d0
 [<ffffffff8136397d>] netlink_unicast+0x2bd/0x2d0


 [<ffffffff81344adc>] ? memcpy_fromiovec+0x6c/0x90
 [<ffffffff81364263>] netlink_sendmsg+0x1d3/0x2d0
 [<ffffffff8133975b>] sock_sendmsg+0xbb/0xf0
 [<ffffffff8106cdeb>] ? __lock_acquire+0x27b/0xa60
 [<ffffffff810a18c3>] ? might_fault+0x73/0xd0
 [<ffffffff810a18c3>] ? might_fault+0x73/0xd0
 [<ffffffff8106db22>] ? __lock_release+0x82/0x170
 [<ffffffff810a190e>] ? might_fault+0xbe/0xd0
 [<ffffffff810a18c3>] ? might_fault+0x73/0xd0
 [<ffffffff81344c77>] ? verify_iovec+0x47/0xd0
 [<ffffffff8133a509>] sys_sendmsg+0x1a9/0x360
 [<ffffffff813c2be5>] ? _raw_spin_unlock_irqrestore+0x65/0x70
 [<ffffffff8106aced>] ? trace_hardirqs_on+0xd/0x10
 [<ffffffff813c2bc2>] ? _raw_spin_unlock_irqrestore+0x42/0x70
 [<ffffffff81197004>] ? __up_read+0x84/0xb0
 [<ffffffff8106ac95>] ? trace_hardirqs_on_caller+0x145/0x190
 [<ffffffff813c207f>] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [<ffffffff8100262b>] system_call_fastpath+0x16/0x1b
Code:  Bad RIP value.
RIP  [<ffffffffa02f842a>] 0xffffffffa02f842a
 RSP <ffff8800baa3db48>
CR2: ffffffffa02f842a

If module was quickly removed after autoloading, return -E.

Return -EPROTONOSUPPORT if module was quickly removed after autoloading.

Signed-off-by: Alexey Dobriyan <>
Signed-off-by: David S. Miller <>
12 years agoaf_key: fix netns ops ordering on module load/unload
Alexey Dobriyan [Sat, 30 Jan 2010 02:53:27 +0000 (02:53 +0000)]
af_key: fix netns ops ordering on module load/unload

1. After sock_register() returns, it's possible to create sockets,
   even if module still not initialized fully (blame generic module code
   for that!)
2. Consequently, pfkey_create() can be called with pfkey_net_id still not
   initialized which will BUG_ON in net_generic():
kernel BUG at include/net/netns/generic.h:43!
3. During netns shutdown, netns ops should be unregistered after
   key manager unregistered because key manager calls can be triggered
   from xfrm_user module:

    general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
pfkey_broadcast+0x111/0x210 [af_key]
pfkey_send_notify+0x16a/0x300 [af_key]
xfrm_flush_sa+0x75/0x90 [xfrm_user]
4. Unregister netns ops after socket ops just in case and for symmetry.

Reported by Luca Tettamanti.

Signed-off-by: Alexey Dobriyan <>
Tested-by: Luca Tettamanti <>
Signed-off-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
12 years agoBluetooth: Do not call rfcomm_session_put() for RFCOMM UA on closed socket
Nick Pelly [Thu, 4 Feb 2010 00:18:36 +0000 (16:18 -0800)]
Bluetooth: Do not call rfcomm_session_put() for RFCOMM UA on closed socket

When processing a RFCOMM UA frame when the socket is closed and we were
not the RFCOMM initiator would cause rfcomm_session_put() to be called
twice during rfcomm_process_rx(). This would cause a kernel panic in
rfcomm_session_close() then.

This could be easily reproduced during disconnect with devices such as
Motorola H270 that send RFCOMM UA followed quickly by L2CAP disconnect
request. This trace for this looks like:

2009-09-21 17:22:37.788895 < ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0041 len 4 [psm 3]
     RFCOMM(s): DISC: cr 0 dlci 20 pf 1 ilen 0 fcs 0x7d
2009-09-21 17:22:37.906204 > HCI Event: Number of Completed Packets (0x13) plen 5
   handle 1 packets 1
2009-09-21 17:22:37.933090 > ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0040 len 4 [psm 3]
     RFCOMM(s): UA: cr 0 dlci 20 pf 1 ilen 0 fcs 0x57
2009-09-21 17:22:38.636764 < ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0041 len 4 [psm 3]
     RFCOMM(s): DISC: cr 0 dlci 0 pf 1 ilen 0 fcs 0x9c
2009-09-21 17:22:38.744125 > HCI Event: Number of Completed Packets (0x13) plen 5
   handle 1 packets 1
2009-09-21 17:22:38.763687 > ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0040 len 4 [psm 3]
     RFCOMM(s): UA: cr 0 dlci 0 pf 1 ilen 0 fcs 0xb6
2009-09-21 17:22:38.783554 > ACL data: handle 1 flags 0x02 dlen 12
   L2CAP(s): Disconn req: dcid 0x0040 scid 0x0041

Avoid calling rfcomm_session_put() twice by skipping this call
in rfcomm_recv_ua() if the socket is closed.

Signed-off-by: Nick Pelly <>
Signed-off-by: Marcel Holtmann <>
12 years agoBluetooth: Fix sleeping function in RFCOMM within invalid context
Marcel Holtmann [Wed, 3 Feb 2010 23:52:18 +0000 (15:52 -0800)]
Bluetooth: Fix sleeping function in RFCOMM within invalid context

With the commit 9e726b17422bade75fba94e625cd35fd1353e682 the
rfcomm_session_put() gets accidentially called from a timeout
callback and results in this:

BUG: sleeping function called from invalid context at net/core/sock.c:1897
in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper
Pid: 0, comm: swapper Tainted: P           2.6.32 #31
Call Trace:
 <IRQ>  [<ffffffff81036455>] __might_sleep+0xf8/0xfa
 [<ffffffff8138ef1d>] lock_sock_nested+0x29/0xc4
 [<ffffffffa03921b3>] lock_sock+0xb/0xd [l2cap]
 [<ffffffffa03948e6>] l2cap_sock_shutdown+0x1c/0x76 [l2cap]
 [<ffffffff8106adea>] ? clockevents_program_event+0x75/0x7e
 [<ffffffff8106bea2>] ? tick_dev_program_event+0x37/0xa5
 [<ffffffffa0394967>] l2cap_sock_release+0x27/0x67 [l2cap]
 [<ffffffff8138c971>] sock_release+0x1a/0x67
 [<ffffffffa03d2492>] rfcomm_session_del+0x34/0x53 [rfcomm]
 [<ffffffffa03d24c5>] rfcomm_session_put+0x14/0x16 [rfcomm]
 [<ffffffffa03d28b4>] rfcomm_session_timeout+0xe/0x1a [rfcomm]
 [<ffffffff810554a8>] run_timer_softirq+0x1e2/0x29a
 [<ffffffffa03d28a6>] ? rfcomm_session_timeout+0x0/0x1a [rfcomm]
 [<ffffffff8104e0f6>] __do_softirq+0xfe/0x1c5
 [<ffffffff8100e8ce>] ? timer_interrupt+0x1a/0x21
 [<ffffffff8100cc4c>] call_softirq+0x1c/0x28
 [<ffffffff8100e05b>] do_softirq+0x33/0x6b
 [<ffffffff8104daf6>] irq_exit+0x36/0x85
 [<ffffffff8100d7a9>] do_IRQ+0xa6/0xbd
 [<ffffffff8100c493>] ret_from_intr+0x0/0xa
 <EOI>  [<ffffffff812585b3>] ? acpi_idle_enter_bm+0x269/0x294
 [<ffffffff812585a9>] ? acpi_idle_enter_bm+0x25f/0x294
 [<ffffffff81373ddc>] ? cpuidle_idle_call+0x97/0x107
 [<ffffffff8100aca0>] ? cpu_idle+0x53/0xaa
 [<ffffffff81429006>] ? rest_init+0x7a/0x7c
 [<ffffffff8177bc8c>] ? start_kernel+0x389/0x394
 [<ffffffff8177b29c>] ? x86_64_start_reservations+0xac/0xb0
 [<ffffffff8177b384>] ? x86_64_start_kernel+0xe4/0xeb

To fix this, the rfcomm_session_put() needs to be moved out of
rfcomm_session_timeout() into rfcomm_process_sessions(). In that
context it is perfectly fine to sleep and disconnect the socket.

Signed-off-by: Marcel Holtmann <>
Tested-by: David John <>
12 years agossb: Fix CONFIG_SSB_SDIOHOST typo
Michael Buesch [Wed, 3 Feb 2010 17:24:35 +0000 (18:24 +0100)]

This fixes a CONFIG_SSB_SDIOHOST typo.

Signed-off-by: Michael Buesch <>
Reported-by: Christoph Egger <>
Tested-By: Albert Herranz <>
Signed-off-by: John W. Linville <>
12 years agob43: Fix throughput regression
Larry Finger [Tue, 2 Feb 2010 16:08:19 +0000 (10:08 -0600)]
b43: Fix throughput regression

Commit c7ab5ef9bcd281135c21b4732c9be779585181be entitled "b43: implement
short slot and basic rate handling" reduced the transmit throughput for
my BCM4311 device from 18 Mb/s to 0.7 Mb/s. The basic rate handling
portion is OK, the problem is in the short slot handling.

Prior to this change, the short slot enable/disable routines were never
called. Experimentation showed that the critical part was changing the
value at offset 0x0010 in the shared memory. This is supposed to contain
the 802.11 Slot Time in usec, but if it is changed from its initial value
of zero, performance is destroyed. On the other hand, changing the value
in the MMIO register corresponding to the Interframe Slot Time increased
performance from 18 to 22 Mb/s. A BCM4306/3 also shows dramatic
improvement of the transmit rate from 5.3 to 19.0 Mb/s.

Other changes in the patch include removal of the magic number for the
MMIO register, and allowing the slot time to be set for any PHY operating
in the 2.4 GHz band. Previously, the routine was executed only for G PHYs.

Signed-off-by: Larry Finger <>
Cc: Stable <> [Any stable version back through 2.6.28]
Signed-off-by: John W. Linville <>
12 years agoBluetooth: Fallback eSCO to SCO on error 0x1a (Unsupported Remote Feature)
Nick Pelly [Wed, 3 Feb 2010 19:42:26 +0000 (11:42 -0800)]
Bluetooth: Fallback eSCO to SCO on error 0x1a (Unsupported Remote Feature)

General Motors carkits that use LGE BT chipsets return this error code
when an eSCO is attempted, despite advertising eSCO support.

2009-08-13 14:41:39.755518 < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
   handle 1 voice setting 0x0060
2009-08-13 14:41:39.757563 > HCI Event: Command Status (0x0f) plen 4
   Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
2009-08-13 14:41:39.789484 > HCI Event: Synchronous Connect Complete (0x2c) plen 17
   status 0x1a handle 257 bdaddr 00:1E:B2:23:5E:B3 type eSCO
   Error: Unsupported Remote Feature / Unsupported LMP Feature

Signed-off-by: Jaikumar Ganesh <>
Signed-off-by: Nick Pelly <>
Signed-off-by: Marcel Holtmann <>
12 years agoconnector: Delete buggy notification code.
Evgeniy Polyakov [Tue, 2 Feb 2010 23:58:48 +0000 (15:58 -0800)]
connector: Delete buggy notification code.

On Tue, Feb 02, 2010 at 02:57:14PM -0800, Greg KH ( wrote:
> > There are at least two ways to fix it: using a big cannon and a small
> > one. The former way is to disable notification registration, since it is
> > not used by anyone at all. Second way is to check whether calling
> > process is root and its destination group is -1 (kind of priveledged
> > one) before command is dispatched to workqueue.
> Well if no one is using it, removing it makes the most sense, right?
> No objection from me, care to make up a patch either way for this?

Getting it is not used, let's drop support for notifications about
(un)registered events from connector.
Another option was to check credentials on receiving, but we can always
restore it without bugs if needed, but genetlink has a wider code base
and none complained, that userspace can not get notification when some
other clients were (un)registered.

Kudos for Sebastian Krahmer <>, who found a bug in the

Signed-off-by: Evgeniy Polyakov <>
Acked-by: Greg Kroah-Hartman <>
Signed-off-by: David S. Miller <>
12 years agoMerge branch 'master' of git://
David S. Miller [Tue, 2 Feb 2010 17:04:58 +0000 (09:04 -0800)]
Merge branch 'master' of git://git./linux/kernel/git/kaber/nf-2.6

12 years agobe2net: use eq-id to calculate cev-isr reg offset
Sathya Perla [Tue, 2 Feb 2010 15:48:40 +0000 (07:48 -0800)]
be2net: use eq-id to calculate cev-isr reg offset

cev-isr reg offset for each function is better calculated using (any) eq-id
alloted to that function instead of using pci-func number(which
does not work in some configurations...)

Signed-off-by: Sathya Perla <>
Signed-off-by: David S. Miller <>
12 years agoMerge branch 'master' of git://
David S. Miller [Mon, 1 Feb 2010 07:34:58 +0000 (23:34 -0800)]
Merge branch 'master' of git://git./linux/kernel/git/holtmann/bluetooth-2.6

12 years agoBluetooth: Use the control channel for raw HID reports
Bastien Nocera [Wed, 20 Jan 2010 12:00:42 +0000 (12:00 +0000)]
Bluetooth: Use the control channel for raw HID reports

In commit 2da31939a42f7a676a0bc5155d6a0a39ed8451f2, support
for Bluetooth hid_output_raw_report was added, but it pushes
the data to the interrupt channel instead of the contol one.

This patch makes hid_output_raw_report use the control channel
instead. Using the interrupt channel was a mistake.

Signed-off-by: Bastien Nocera <>
Signed-off-by: Marcel Holtmann <>
12 years agoBluetooth: Add DFU driver for Atheros Bluetooth chipset AR3011
Vikram Kandukuri [Wed, 6 Jan 2010 13:34:15 +0000 (19:04 +0530)]
Bluetooth: Add DFU driver for Atheros Bluetooth chipset AR3011

Signed-off-by: Vikram Kandukuri <>
Signed-off-by: Alicke Xu <>
Reviewed-by: Luis R. Rodriguez <>
Signed-off-by: Marcel Holtmann <>
12 years agoBluetooth: Redo checks in IRQ handler for shared IRQ support
Mike Frysinger [Mon, 14 Sep 2009 17:43:49 +0000 (13:43 -0400)]
Bluetooth: Redo checks in IRQ handler for shared IRQ support

Commit ac019360fe3 changed the irq handler logic to BUG_ON rather than
returning IRQ_NONE when the incoming argument is invalid.  While this
works in most cases, it doesn't work when the IRQ is shared with other
devices (or when DEBUG_SHIRQ is enabled).

So revert the previous change and replace the warning message with a
comment explaining that we want this behavior.

Signed-off-by: Michael Hennerich <>
Signed-off-by: Mike Frysinger <>
Signed-off-by: Marcel Holtmann <>
12 years agoBluetooth: Fix memory leak in L2CAP
Andrei Emeltchenko [Wed, 23 Dec 2009 11:07:14 +0000 (13:07 +0200)]
Bluetooth: Fix memory leak in L2CAP

Move skb_clone after error confition check so it is not going
potentially out of the scope.

Signed-off-by: Andrei Emeltchenko <>
Acked-by: Gustavo F. Padovan <>
Signed-off-by: Marcel Holtmann <>
12 years agoBluetooth: Remove double free of SKB pointer in L2CAP
Andrei Emeltchenko [Tue, 22 Dec 2009 13:58:08 +0000 (15:58 +0200)]
Bluetooth: Remove double free of SKB pointer in L2CAP

Trivial fix for double free of SKB pointer with kfree_skb to
make code simplier and cleaner. Remove unused variable err.

Signed-off-by: Andrei Emeltchenko <>
Acked-by: Gustavo F. Padovan <>
Signed-off-by: Marcel Holtmann <>
12 years agocdc_ether: Partially revert "usbnet: Set link down initially ..."
Ben Hutchings [Fri, 29 Jan 2010 05:37:18 +0000 (21:37 -0800)]
cdc_ether: Partially revert "usbnet: Set link down initially ..."

Commit 37e8273cd30592d3a82bcb70cbb1bdc4eaeb6b71 ("usbnet: Set link down
initially for drivers that update link state") changed the initial link
state in cdc_ether and other drivers based on the understanding that the
devices they support generate link change interrupts.  However, this is
optional in the CDC Ethernet protocol, and two users have reported in
<> that the link state
for their devices remains down.  Therefore, revert the change in

Signed-off-by: Ben Hutchings <>
Tested-by: Avi Rozen <>
Signed-off-by: David S. Miller <>
12 years agobe2net: Fix memset() arg ordering.
David S. Miller [Fri, 29 Jan 2010 05:36:21 +0000 (21:36 -0800)]
be2net: Fix memset() arg ordering.

Noticed by Ben Hutchings.

Signed-off-by: David S. Miller <>
12 years agobonding: bond_open error return value
stephen hemminger [Mon, 25 Jan 2010 23:34:15 +0000 (23:34 +0000)]
bonding: bond_open error return value

The convention for API functions in kernel is to return errno value;
bond_open would return -1 if alb setup failed. The only reason that
could happen is if kmalloc() failed.

Signed-off-by: Stephen Hemminger <>
Signed-off-by: David S. Miller <>
12 years agoixgbe: if ixgbe_copy_dcb_cfg is going to fail learn about it early
John Fastabend [Wed, 27 Jan 2010 16:38:06 +0000 (16:38 +0000)]
ixgbe: if ixgbe_copy_dcb_cfg is going to fail learn about it early

Call ixgbe_copy_dcb_cfg() earlier in the ixgbe_dcbnl_set_all() so that
we can learn if this is going to fail as early as possible.  Previously,
ixgbe_down or ixgbe_close were being called before this check and the
IXGBE_RESETTING bit was being set and cleared.  Worse if this failed
the corresponding ixgbe_up/ndo_open would not called.

Signed-off-by: John Fastabend <>
Acked-by: PJ Waskiewicz <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
12 years agoixgbe: set the correct DCB bit for pg tx settings
John Fastabend [Wed, 27 Jan 2010 16:37:44 +0000 (16:37 +0000)]
ixgbe: set the correct DCB bit for pg tx settings

Set the correct bit BIT_PG_TX when tx PG settings are set.

Signed-off-by: John Fastabend <>
Acked-by: PJ Waskiewicz <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
12 years agoigbvf: fix issue w/ mapped_as_page being left set after unmap
Alexander Duyck [Wed, 27 Jan 2010 15:30:39 +0000 (15:30 +0000)]
igbvf: fix issue w/ mapped_as_page being left set after unmap

This change fixes an issue in igbvf with mapped_as_page being left set
after a page is unmapped which results in buffers which are mapped via map
single being unmapped as page.

Signed-off-by: Alexander Duyck <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
12 years agodrivers/net: ks8851_mll ethernet network driver
Choi, David [Wed, 27 Jan 2010 06:03:16 +0000 (06:03 +0000)]
drivers/net: ks8851_mll ethernet network driver

Hello David Miller,

I fix a bug in ks8851_mll driver, which has existed since 2.6.32-rc6.

>From : David J. Choi <>

Fix a bug that the data pointers in the interrupt handler are set wrong, which is related with the 5th parameter of request_irq().

Signed-off-by : David J. Choi <>

Signed-off-by: David S. Miller <>
12 years agobe2net: Bug fix to support newer generation of BE ASIC
Ajit Khaparde [Wed, 27 Jan 2010 21:56:44 +0000 (21:56 +0000)]
be2net: Bug fix to support newer generation of BE ASIC

Bug fix in be2net for newer generation of BladeEngine ASIC.

Signed-off-by: Ajit Khaparde <>
Signed-off-by: David S. Miller <>
12 years agoMerge branch 'master' of git://
David S. Miller [Thu, 28 Jan 2010 13:42:33 +0000 (05:42 -0800)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6

12 years agostarfire: clean up properly if firmware loading fails
Ben Hutchings [Tue, 26 Jan 2010 18:27:09 +0000 (18:27 +0000)]
starfire: clean up properly if firmware loading fails

netdev_open() will return without cleaning up net device or hardware state
if firmware loading fails.  This results in a BUG() on a second attempt to
bring the interface up, reported in
<>, and probably has even
worse effects if the driver is removed afterwards.

Call netdev_close() to clean up on failure.


Signed-off-by: Ben Hutchings <>
Reported-by: Michael Moffatt <>
Tested-by: Michael Moffatt <>
Cc: "David S. Miller" <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: David S. Miller <>
12 years agomac80211: fix NULL pointer dereference when ftrace is enabled
Zhu Yi [Tue, 26 Jan 2010 07:58:57 +0000 (15:58 +0800)]
mac80211: fix NULL pointer dereference when ftrace is enabled

I got below kernel oops when I try to bring down the network interface if
ftrace is enabled. The root cause is drv_ampdu_action() is passed with a
NULL ssn pointer in the BA session tear down case. We need to check and
avoid dereferencing it in trace entry assignment.

BUG: unable to handle kernel NULL pointer dereference
Modules linked in: at (null)
IP: [<f98fe02a>] ftrace_raw_event_drv_ampdu_action+0x10a/0x160 [mac80211]
*pde = 00000000
Call Trace:
 [<f98fdf20>] ? ftrace_raw_event_drv_ampdu_action+0x0/0x160 [mac80211]
 [<f98dac4c>] ? __ieee80211_stop_rx_ba_session+0xfc/0x220 [mac80211]
 [<f98d97fb>] ? ieee80211_sta_tear_down_BA_sessions+0x3b/0x50 [mac80211]
 [<f98dc6f6>] ? ieee80211_set_disassoc+0xe6/0x230 [mac80211]
 [<f98dc6ac>] ? ieee80211_set_disassoc+0x9c/0x230 [mac80211]
 [<f98dcbb8>] ? ieee80211_mgd_deauth+0x158/0x170 [mac80211]
 [<f98e4bdb>] ? ieee80211_deauth+0x1b/0x20 [mac80211]
 [<f8987f49>] ? __cfg80211_mlme_deauth+0xe9/0x120 [cfg80211]
 [<f898b870>] ? __cfg80211_disconnect+0x170/0x1d0 [cfg80211]

Cc: Johannes Berg <>
Signed-off-by: Zhu Yi <>
Signed-off-by: John W. Linville <>
12 years agonetfilter: ctnetlink: fix expectation mask dump
Patrick McHardy [Tue, 26 Jan 2010 16:04:02 +0000 (17:04 +0100)]
netfilter: ctnetlink: fix expectation mask dump

The protocol number is not initialized, so userspace can't interpret
the layer 4 data properly.

Signed-off-by: Patrick McHardy <>
12 years agoipv6: conntrack: Add member of user to nf_ct_frag6_queue structure
Shan Wei [Tue, 26 Jan 2010 02:40:38 +0000 (02:40 +0000)]
ipv6: conntrack: Add member of user to nf_ct_frag6_queue structure

The commit 0b5ccb2(title:ipv6: reassembly: use seperate reassembly queues for
conntrack and local delivery) has broken the saddr&&daddr member of
nf_ct_frag6_queue when creating new queue.  And then hash value
generated by nf_hashfn() was not equal with that generated by fq_find().
So, a new received fragment can't be inserted to right queue.

The patch fixes the bug with adding member of user to nf_ct_frag6_queue structure.

Signed-off-by: Shan Wei <>
Acked-by: Patrick McHardy <>
Signed-off-by: David S. Miller <>
12 years agovirtio_net: Make delayed refill more reliable
Herbert Xu [Mon, 25 Jan 2010 23:51:01 +0000 (15:51 -0800)]
virtio_net: Make delayed refill more reliable

I have seen RX stalls on a machine that experienced a suspected
OOM.  After the stall, the RX buffer is empty on the guest side
and there are exactly 16 entries available on the host side.  As
the number of entries is less than that required by a maximal
skb, the host cannot proceed.

The guest did not have a refill job scheduled.

My diagnosis is that an OOM had occured, with the delayed refill
job scheduled.  The job was able to allocate at least one skb, but
not enough to overcome the minimum required by the host to proceed.

As the refill job would only reschedule itself if it failed completely
to allocate any skbs, this would lead to an RX stall.

The following patch removes this stall possibility by always
rescheduling the refill job until the ring is totally refilled.

Testing has shown that the RX stall no longer occurs whereas
previously it would occur within a day.

Signed-off-by: Herbert Xu <>
Acked-by: Rusty Russell <>
Signed-off-by: David S. Miller <>
12 years agosfc: Use fixed-size buffers for MCDI NVRAM requests
Ben Hutchings [Mon, 25 Jan 2010 23:49:59 +0000 (15:49 -0800)]
sfc: Use fixed-size buffers for MCDI NVRAM requests

The low-level MCDI code always uses 32-bit MMIO operations, and
callers must pad input and output buffers to multiples of 4 bytes.
The MCDI NVRAM functions are not doing this.  Also, their buffers are
declared as variable-length arrays with no explicit maximum length.

Switch to a fixed buffer size based on the chunk size used by the
MTD driver (which is a multiple of 4).

Signed-off-by: Ben Hutchings <>
Signed-off-by: David S. Miller <>
12 years agosfc: Add workspace for GMAC bug workaround to MCDI MAC_STATS buffer
Guido Barzini [Mon, 25 Jan 2010 23:49:19 +0000 (15:49 -0800)]
sfc: Add workspace for GMAC bug workaround to MCDI MAC_STATS buffer

Due to a hardware bug in the SFC9000 family, the firmware must
transfer raw GMAC statistics to host memory before aggregating them
into the cooked (speed-independent) MAC statistics.  Extend the stats
buffer to support this.

The length of the buffer is explicit in the MAC_STATS command, so this
change is backward-compatible on both sides.

Signed-off-by: Ben Hutchings <>
Signed-off-by: David S. Miller <>
12 years agotcp_probe: avoid modulus operation and wrap fix
Stephen Hemminger [Mon, 25 Jan 2010 23:47:50 +0000 (15:47 -0800)]
tcp_probe: avoid modulus operation and wrap fix

By rounding up the buffer size to power of 2, several expensive
modulus operations can be avoided.  This patch also solves a bug where
the gap need when ring gets full was not being accounted for.

Signed-off-by: Stephen Hemminger <>
Signed-off-by: David S. Miller <>
12 years agoqlge: Only free resources if they were allocated
Breno Leitao [Mon, 25 Jan 2010 23:46:58 +0000 (15:46 -0800)]
qlge: Only free resources if they were allocated

Currently qlge tries to release regions even if they were not allocated.
This causes messages like the following in the kernel log

Trying to free nonexistent resource <00000000006af400-00000000006af4ff>
Trying to free nonexistent resource <00003c04ff9f4000-00003c04ff9f7fff>
Trying to free nonexistent resource <00003c04ffc00000-00003c04ffcfffff>

This patch fixes the goto logic in order to not release the resources
if they were not allocated.

Signed-off-by: Breno Leitao <>
Signed-off-by: David S. Miller <>
12 years agoath9k: fix eeprom INI values override for 2GHz-only cards
Felix Fietkau [Sat, 23 Jan 2010 19:04:18 +0000 (20:04 +0100)]
ath9k: fix eeprom INI values override for 2GHz-only cards

Among other changes, this commit:

   commit 06d0f0663e11cab4ec5f2c143a118d71a12fbbe9
   Author: Sujith <>
   Date:   Thu Feb 12 10:06:45 2009 +0530

   ath9k: Enable Fractional N mode

changed the hw attach code to fix up initialization values only for
dual band devices, however the commit message did not give a reason as
to why this would be useful or necessary.

According to tests by Jorge Boncompte, this breaks at least some
2GHz-only cards, so the code should be changed back to the
unconditional INI fixup.

Signed-off-by: Felix Fietkau <>
Reported-by: Jorge Boncompte <>
Tested-by: Pavel Roskin <>
Signed-off-by: John W. Linville <>
12 years agoiwlwifi: fix pointer signedness warning
Johannes Berg [Fri, 22 Jan 2010 22:22:34 +0000 (14:22 -0800)]
iwlwifi: fix pointer signedness warning

There are a few station addresses that are
char *, instead of the normal u8 *; gcc
gives pointer signedness warnings for some
of those, so use u8 * consistently.

Signed-off-by: Johannes Berg <>
Signed-off-by: Reinette Chatre <>
Signed-off-by: John W. Linville <>
12 years agonetns xfrm: deal with dst entries in netns
Alexey Dobriyan [Mon, 25 Jan 2010 06:47:53 +0000 (22:47 -0800)]
netns xfrm: deal with dst entries in netns

GC is non-existent in netns, so after you hit GC threshold, no new
dst entries will be created until someone triggers cleanup in init_net.

Make xfrm4_dst_ops and xfrm6_dst_ops per-netns.
This is not done in a generic way, because it woule waste
(AF_MAX - 2) * sizeof(struct dst_ops) bytes per-netns.

Reorder GC threshold initialization so it'd be done before registering
XFRM policies.

Signed-off-by: Alexey Dobriyan <>
Signed-off-by: David S. Miller <>
12 years agosky2: revert config space change
stephen hemminger [Sun, 24 Jan 2010 18:46:06 +0000 (18:46 +0000)]
sky2: revert config space change

Obviously, this register had some other impact that is causing
the regression.  Either it is masking some other access or needs
to be reset in some path.

Either, way it is best to just revert the change for 2.6.33

This reverts commit 166a0fd4c788ec7f10ca8194ec6d526afa12db75.

Signed-off-by: David S. Miller <>
12 years agovlan: fix vlan_skb_recv()
Eric Dumazet [Mon, 25 Jan 2010 03:52:24 +0000 (19:52 -0800)]
vlan: fix vlan_skb_recv()

Bruno Prémont found commit 9793241fe92f7d930
(vlan: Precise RX stats accounting) added a regression for non
hw accelerated vlans.

[   26.390576] BUG: unable to handle kernel NULL pointer dereference at (null)
[   26.396369] IP: [<df856b89>] vlan_skb_recv+0x89/0x280 [8021q]

vlan_dev_info() was used with original device, instead of
skb->dev. Also spotted by Américo Wang.

Reported-By: Bruno Prémont <>
Tested-By: Bruno Prémont <>
Signed-off-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
12 years agonetns xfrm: fix "ip xfrm state|policy count" misreport
Alexey Dobriyan [Sat, 23 Jan 2010 13:37:10 +0000 (13:37 +0000)]
netns xfrm: fix "ip xfrm state|policy count" misreport

"ip xfrm state|policy count" report SA/SP count from init_net,
not from netns of caller process.

Signed-off-by: Alexey Dobriyan <>
Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
12 years agosky2: Enable/disable WOL per hardware device
Mike McCormack [Sat, 23 Jan 2010 10:09:26 +0000 (02:09 -0800)]
sky2: Enable/disable WOL per hardware device

Y2_HW_WOL_ON/Y2_HW_WOL_OFF should be set and cleared per chip,
not per port.  On dual port cards, Y2_HW_WOL_ON should be
enabled if either sky2 port has WOL enabled.

Found while reviewing code for a WOL regression, though this is
probably not the cause of the regression.

Signed-off-by: Mike McCormack <>
Signed-off-by: David S. Miller <>
12 years agonet: Fix IPv6 GSO type checks in Intel ethernet drivers
Sridhar Samudrala [Sat, 23 Jan 2010 10:02:21 +0000 (02:02 -0800)]
net: Fix IPv6 GSO type checks in Intel ethernet drivers

Found this problem when testing IPv6 from a KVM guest to a remote
host via e1000e device on the host.
The following patch fixes the check for IPv6 GSO packet in Intel
ethernet drivers to use skb_is_gso_v6(). SKB_GSO_DODGY is also set
when packets are forwarded from a guest.

Signed-off-by: Sridhar Samudrala <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
12 years agoigb/igbvf: cleanup exception handling in tx_map_adv
Alexander Duyck [Sat, 23 Jan 2010 09:35:00 +0000 (01:35 -0800)]
igb/igbvf: cleanup exception handling in tx_map_adv

After removing the skb_dma_map/unmap calls the exception handling in
igb_tx_map_adv is not correct.  The issue is that the count value was not
being correctly handled so as a result we were not rewinding the ring as
back as we should have been.

Signed-off-by: Alexander Duyck <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
12 years agoMAINTAINERS: Add Intel igbvf maintainer
Jeff Kirsher [Sat, 23 Jan 2010 09:20:22 +0000 (01:20 -0800)]
MAINTAINERS: Add Intel igbvf maintainer

Add igbvf to the list of supported Intel drivers and Alex to the list of

Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
12 years agoe1000/e1000e: don't use small hardware rx buffers
Jesse Brandeburg [Fri, 22 Jan 2010 22:56:16 +0000 (22:56 +0000)]
e1000/e1000e: don't use small hardware rx buffers

When testing the "e1000: enhance frame fragment detection" (and e1000e)
patches we found some bugs with reducing the MTU size.  The 1024 byte
descriptor used with the 1000 mtu test also (re) introduced the
(originally) reported bug, and causes us to need the e1000_clean_tx_irq
"enhance frame fragment detection" fix.

So what has occured here is that 2.6.32 is only vulnerable for mtu <
1500 due to the jumbo specific routines in both e1000 and e1000e.
So, 2.6.32 needs the 2kB buffer len fix for those smaller MTUs, but
is not vulnerable to the original issue reported.  It has been pointed
out that this vulnerability needs to be patched in older kernels that
don't have the e1000 jumbo routine.  Without the jumbo routines, we
need the "enhance frame fragment detection" fix the e1000, old
e1000e is only vulnerable for < 1500 mtu, and needs a similar
fix.  We split the patches up to provide easy backport paths.

There is only a slight bit of extra code when this fix and the
original "enhance frame fragment detection" fixes are applied, so
please apply both, even though it is a bit of overkill.

Signed-off-by: Jesse Brandeburg <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
12 years agofmvj18x_cs: add new id (Panasonic lan & modem card)
Ken Kawasaki [Fri, 22 Jan 2010 11:56:25 +0000 (11:56 +0000)]
fmvj18x_cs: add new id (Panasonic lan & modem card)

fmvj18x_cs, serial_cs:
 add new id
 Panasonic lan & modem card (model name:AL-VML101)

Signed-off-by: Ken Kawasaki <>
Signed-off-by: David S. Miller <>
12 years agobe2net: swap only first 2 fields of mcc_wrb
Sathya Perla [Thu, 21 Jan 2010 22:51:36 +0000 (22:51 +0000)]
be2net: swap only first 2 fields of mcc_wrb

Only the first two fields of mcc wrb - embedded, payload_len
need to be cpu_to_le32() swapped while issuing a cmd to the hw.
The fields tag0, tag1 are opaque and returned back to cpu as is...

Signed-off-by: Sathya Perla <>
Signed-off-by: David S. Miller <>
12 years agoPlease add support for Microsoft MN-120 PCMCIA network card
Ron Murray [Tue, 19 Jan 2010 08:02:48 +0000 (08:02 +0000)]
Please add support for Microsoft MN-120 PCMCIA network card

Please add support for Microsoft MN-120 PCMCIA network card. It's an
old card, I know, but adding support is very easy. You just need to
get tulip_core.c to recognise its vendor/device ID.

Patch for kernel (and many previous) attached.

 .....Ron Murray

Signed-off-by: Ron Murray <>
Signed-off-by: David S. Miller <>
12 years agoMerge branch 'linux-2.6.33.y' of git://
David S. Miller [Sat, 23 Jan 2010 09:08:39 +0000 (01:08 -0800)]
Merge branch 'linux-2.6.33.y' of git://git./linux/kernel/git/inaky/wimax

12 years agoMerge branch 'master' of /home/davem/src/GIT/linux-2.6/
David S. Miller [Sat, 23 Jan 2010 06:45:46 +0000 (22:45 -0800)]
Merge branch 'master' of /home/davem/src/GIT/linux-2.6/

12 years agobe2net: fix bug in rx page posting
Sathya Perla [Fri, 22 Jan 2010 06:52:08 +0000 (22:52 -0800)]
be2net: fix bug in rx page posting

Pages are posted to the rxq in such a way that more than one frag
can share the page. The last frag that uses the page unmaps the
page.  In the case when a page is not fully used (due to lack of space in rxq)
the last frag that uses the page is not being set as a "last_page_user";
instead, the next frag in the rxq is incorrectly being set.

The fix has also been tested on ppc64 with 64k pages...

Signed-off-by: Sathya Perla <>
Signed-off-by: David S. Miller <>
12 years agowimax/i2400m: Add support for more i6x50 SKUs
Inaky Perez-Gonzalez [Wed, 20 Jan 2010 20:41:13 +0000 (12:41 -0800)]
wimax/i2400m: Add support for more i6x50 SKUs

The Intel WiMax Wireless Link 6050 can show under more than one USB
ID. Add support for all, introducing a generic flag (i2400mu->i6050)
that denotes a 6x50 based device.

Signed-off-by: Inaky Perez-Gonzalez <>
12 years agoLinux 2.6.33-rc5
Linus Torvalds [Thu, 21 Jan 2010 23:31:35 +0000 (15:31 -0800)]
Linux 2.6.33-rc5

12 years agoMerge branch 'perf-fixes-for-linus' of git://
Linus Torvalds [Thu, 21 Jan 2010 16:50:04 +0000 (08:50 -0800)]
Merge branch 'perf-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip

* 'perf-fixes-for-linus' of git://
  perf: x86: Add support for the ANY bit
  perf: Change the is_software_event() definition
  perf: Honour event state for aux stream data
  perf: Fix perf_event_do_pending() fallback callsite
  perf kmem: Print usage help for unknown commands
  perf kmem: Increase "Hit" column length
  hw-breakpoints, perf: Fix broken mmiotrace due to dr6 by reference change
  perf timechart: Use tid not pid for COMM change

12 years agoMerge branch 'sched-fixes-for-linus' of git://
Linus Torvalds [Thu, 21 Jan 2010 16:49:52 +0000 (08:49 -0800)]
Merge branch 'sched-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip

* 'sched-fixes-for-linus' of git://
  sched: Reassign prev and switch_count when reacquire_kernel_lock() fail
  sched: Fix vmark regression on big machines

12 years agoMerge branch 'upstream-linus' of git://
Linus Torvalds [Thu, 21 Jan 2010 15:42:59 +0000 (07:42 -0800)]
Merge branch 'upstream-linus' of git://git./linux/kernel/git/jgarzik/libata-dev

* 'upstream-linus' of git://
  libata: retry FS IOs even if it has failed with AC_ERR_INVALID

12 years agoMerge git://
Linus Torvalds [Thu, 21 Jan 2010 15:37:20 +0000 (07:37 -0800)]
Merge git://git./linux/kernel/git/gregkh/tty-2.6

* git://
  tty: fix race in tty_fasync
  serial: serial_cs: oxsemi quirk breaks resume
  serial: imx: bit &/| confusion
  serial: Fix crash if the minimum rate of the device is > 9600 baud
  serial-core: resume serial hardware with no_console_suspend
  serial: 8250_pnp: use wildcard for serial Wacom tablets
  nozomi: quick fix for the close/close bug
  compat_ioctl: Supress "unknown cmd" message on serial /dev/console

12 years agoMerge git://
Linus Torvalds [Thu, 21 Jan 2010 15:36:55 +0000 (07:36 -0800)]
Merge git://git./linux/kernel/git/gregkh/staging-2.6

* git://
  Staging: hv: fix smp problems in the hyperv core code
  Staging: et131x: Fix 2.6.33rc1 regression in et131x
  Staging: asus_oled: fix oops in

12 years agoMerge git://
Linus Torvalds [Thu, 21 Jan 2010 15:36:31 +0000 (07:36 -0800)]
Merge git://git./linux/kernel/git/gregkh/driver-core-2.6

* git://
  Revert "sysdev: fix prototype for memory_sysdev_class show/store functions"
  driver-core: fix devtmpfs crash on s390

12 years agoMerge git://
Linus Torvalds [Thu, 21 Jan 2010 15:35:43 +0000 (07:35 -0800)]
Merge git://git./linux/kernel/git/gregkh/usb-2.6

* git://
  USB: isp1362: fix build failure on ARM systems via irq_flags cleanup
  USB: isp1362: better 64bit printf warning fixes
  USB: fix usbstorage for 2770:915d delivers no FAT
  USB: Fix level of isp1760 Reloading ptd error message
  USB: FHCI: avoid NULL pointer dereference
  USB: Fix duplicate sysfs problem after device reset.
  USB: add speed values for USB 3.0 and wireless controllers
  USB: add missing delay during remote wakeup
  USB: EHCI & UHCI: fix race between root-hub suspend and port resume
  USB: EHCI: fix handling of unusual interrupt intervals
  USB: Don't use GFP_KERNEL while we cannot reset a storage device
  USB: fix bitmask merge error
  usb: serial: fix memory leak in generic driver
  USB: serial: fix USB serial fix kfifo_len locking

12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Thu, 21 Jan 2010 15:32:11 +0000 (07:32 -0800)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  fs/bio.c: fix shadows sparse warning
  drbd: The kernel code is now equivalent to out of tree release 8.3.7
  drbd: Allow online resizing of DRBD devices while peer not reachable (needs to be explicitly forced)
  drbd: Don't go into StandAlone mode when authentification failes because of network error
  drivers/block/drbd/drbd_receiver.c: correct NULL test
  cfq-iosched: Respect ioprio_class when preempting
  genhd: overlapping variable definition
  block: removed unused as_io_context
  DM: Fix device mapper topology stacking
  block: bdev_stack_limits wrapper
  block: Fix discard alignment calculation and printing
  block: Correct handling of bottom device misaligment
  drbd: check on CONFIG_LBDAF, not LBD
  drivers/block/drbd: Correct NULL test
  drbd: Silenced an assert that could triggered after changing write ordering method
  drbd: Kconfig fix
  drbd: Fix for a race between IO and a detach operation [Bugz 262]
  drbd: Use drbd_crypto_is_hash() instead of an open coded check

12 years agoMerge branch 'release' of git://
Linus Torvalds [Thu, 21 Jan 2010 15:29:36 +0000 (07:29 -0800)]
Merge branch 'release' of git://git./linux/kernel/git/lenb/linux-acpi-2.6

* 'release' of git:// (23 commits)
  ACPI: delete acpi_processor_power_verify_c2()
  ACPI: allow C3 > 1000usec
  ACPI: enable C2 and Turbo-mode on Nehalem notebooks on A/C
  ACPI: power_meter: remove double kfree()
  ACPI: processor: restrict early _PDC to opt-in platforms
  ACPI: Fix unused variable warning in sbs.c
  acpi: make ACPI device id constant
  sony-laptop - fix using of uninitialized variable
  ACPI: Fix section mismatch error for acpi_early_processor_set_pdc()
  eeepc-laptop: disable wireless hotplug for 1201N
  eeepc-laptop: add hotplug_disable parameter
  eeepc-laptop: switch to using sparse keymap library
  eeepc-laptop: dmi blacklist to disable pci hotplug code
  eeepc-laptop: disable cpu speed control on EeePC 701
  ACPI: don't cond_resched if irq is disabled
  ACPI: Remove unnecessary cast.
  ACPI: Advertise to BIOS in _OSC: _OST on _PPC changes
  ACPI: EC: Add wait for irq storm
  ACPI: SBS: Move SBS HC callback to faster Notify queue
  x86, ACPI: delete acpi_boot_table_init() return value