Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
tcp: Fix tcp_hybla zero congestion window growth with small rho and large cwnd.
net: Fix netdev_run_todo dead-lock
tcp: Fix possible double-ack w/ user dma
net: only invoke dev->change_rx_flags when device is UP
netrom: Fix sock_orphan() use in nr_release
ax25: Quick fix for making sure unaccepted sockets get destroyed.
Revert "ax25: Fix std timer socket destroy handling."
[Bluetooth] Add reset quirk for A-Link BlueUSB21 dongle
[Bluetooth] Add reset quirk for new Targus and Belkin dongles
[Bluetooth] Fix double frees on error paths of btusb and bpa10x drivers
+38
-39
-2
drivers/bluetooth/bpa10x.c
-2
drivers/bluetooth/bpa10x.c
···
256
256
BT_ERR("%s urb %p submission failed (%d)",
257
257
hdev->name, urb, -err);
258
258
usb_unanchor_urb(urb);
259
-
kfree(buf);
260
259
}
261
260
262
261
usb_free_urb(urb);
···
297
298
BT_ERR("%s urb %p submission failed (%d)",
298
299
hdev->name, urb, -err);
299
300
usb_unanchor_urb(urb);
300
-
kfree(buf);
301
301
}
302
302
303
303
usb_free_urb(urb);
+5
-3
drivers/bluetooth/btusb.c
+5
-3
drivers/bluetooth/btusb.c
···
102
102
{ USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
103
103
104
104
/* Broadcom BCM2046 */
105
+
{ USB_DEVICE(0x0a5c, 0x2146), .driver_info = BTUSB_RESET },
105
106
{ USB_DEVICE(0x0a5c, 0x2151), .driver_info = BTUSB_RESET },
106
107
107
108
/* Apple MacBook Pro with Broadcom chip */
···
114
113
115
114
/* Targus ACB10US */
116
115
{ USB_DEVICE(0x0a5c, 0x2100), .driver_info = BTUSB_RESET },
116
+
{ USB_DEVICE(0x0a5c, 0x2154), .driver_info = BTUSB_RESET },
117
117
118
118
/* ANYCOM Bluetooth USB-200 and USB-250 */
119
119
{ USB_DEVICE(0x0a5c, 0x2111), .driver_info = BTUSB_RESET },
···
151
149
/* Belkin F8T012 and F8T013 devices */
152
150
{ USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
153
151
{ USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
152
+
153
+
/* Belkin F8T016 device */
154
+
{ USB_DEVICE(0x050d, 0x016a), .driver_info = BTUSB_RESET },
154
155
155
156
/* Digianswer devices */
156
157
{ USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
···
276
271
BT_ERR("%s urb %p submission failed (%d)",
277
272
hdev->name, urb, -err);
278
273
usb_unanchor_urb(urb);
279
-
kfree(buf);
280
274
}
281
275
282
276
usb_free_urb(urb);
···
358
354
BT_ERR("%s urb %p submission failed (%d)",
359
355
hdev->name, urb, -err);
360
356
usb_unanchor_urb(urb);
361
-
kfree(buf);
362
357
}
363
358
364
359
usb_free_urb(urb);
···
478
475
BT_ERR("%s urb %p submission failed (%d)",
479
476
hdev->name, urb, -err);
480
477
usb_unanchor_urb(urb);
481
-
kfree(buf);
482
478
}
483
479
484
480
usb_free_urb(urb);
+3
net/ax25/af_ax25.c
+3
net/ax25/af_ax25.c
+5
-3
net/ax25/ax25_std_timer.c
+5
-3
net/ax25/ax25_std_timer.c
···
39
39
40
40
switch (ax25->state) {
41
41
case AX25_STATE_0:
42
-
if (!sk ||
43
-
sock_flag(sk, SOCK_DESTROY) ||
44
-
sock_flag(sk, SOCK_DEAD)) {
42
+
/* Magic here: If we listen() and a new link dies before it
43
+
is accepted() it isn't 'dead' so doesn't get removed. */
44
+
if (!sk || sock_flag(sk, SOCK_DESTROY) ||
45
+
(sk->sk_state == TCP_LISTEN &&
46
+
sock_flag(sk, SOCK_DEAD))) {
45
47
if (sk) {
46
48
sock_hold(sk);
47
49
ax25_destroy_socket(ax25);
+16
-27
net/core/dev.c
+16
-27
net/core/dev.c
···
2918
2918
return 0;
2919
2919
}
2920
2920
2921
+
static void dev_change_rx_flags(struct net_device *dev, int flags)
2922
+
{
2923
+
if (dev->flags & IFF_UP && dev->change_rx_flags)
2924
+
dev->change_rx_flags(dev, flags);
2925
+
}
2926
+
2921
2927
static int __dev_set_promiscuity(struct net_device *dev, int inc)
2922
2928
{
2923
2929
unsigned short old_flags = dev->flags;
···
2961
2955
current->uid, current->gid,
2962
2956
audit_get_sessionid(current));
2963
2957
2964
-
if (dev->change_rx_flags)
2965
-
dev->change_rx_flags(dev, IFF_PROMISC);
2958
+
dev_change_rx_flags(dev, IFF_PROMISC);
2966
2959
}
2967
2960
return 0;
2968
2961
}
···
3027
3022
}
3028
3023
}
3029
3024
if (dev->flags ^ old_flags) {
3030
-
if (dev->change_rx_flags)
3031
-
dev->change_rx_flags(dev, IFF_ALLMULTI);
3025
+
dev_change_rx_flags(dev, IFF_ALLMULTI);
3032
3026
dev_set_rx_mode(dev);
3033
3027
}
3034
3028
return 0;
···
3351
3347
* Load in the correct multicast list now the flags have changed.
3352
3348
*/
3353
3349
3354
-
if (dev->change_rx_flags && (old_flags ^ flags) & IFF_MULTICAST)
3355
-
dev->change_rx_flags(dev, IFF_MULTICAST);
3350
+
if ((old_flags ^ flags) & IFF_MULTICAST)
3351
+
dev_change_rx_flags(dev, IFF_MULTICAST);
3356
3352
3357
3353
dev_set_rx_mode(dev);
3358
3354
···
3812
3808
}
3813
3809
3814
3810
/* Delayed registration/unregisteration */
3815
-
static DEFINE_SPINLOCK(net_todo_list_lock);
3816
3811
static LIST_HEAD(net_todo_list);
3817
3812
3818
3813
static void net_set_todo(struct net_device *dev)
3819
3814
{
3820
-
spin_lock(&net_todo_list_lock);
3821
3815
list_add_tail(&dev->todo_list, &net_todo_list);
3822
-
spin_unlock(&net_todo_list_lock);
3823
3816
}
3824
3817
3825
3818
static void rollback_registered(struct net_device *dev)
···
4143
4142
* free_netdev(y1);
4144
4143
* free_netdev(y2);
4145
4144
*
4146
-
* We are invoked by rtnl_unlock() after it drops the semaphore.
4145
+
* We are invoked by rtnl_unlock().
4147
4146
* This allows us to deal with problems:
4148
4147
* 1) We can delete sysfs objects which invoke hotplug
4149
4148
* without deadlocking with linkwatch via keventd.
4150
4149
* 2) Since we run with the RTNL semaphore not held, we can sleep
4151
4150
* safely in order to wait for the netdev refcnt to drop to zero.
4151
+
*
4152
+
* We must not return until all unregister events added during
4153
+
* the interval the lock was held have been completed.
4152
4154
*/
4153
-
static DEFINE_MUTEX(net_todo_run_mutex);
4154
4155
void netdev_run_todo(void)
4155
4156
{
4156
4157
struct list_head list;
4157
4158
4158
-
/* Need to guard against multiple cpu's getting out of order. */
4159
-
mutex_lock(&net_todo_run_mutex);
4160
-
4161
-
/* Not safe to do outside the semaphore. We must not return
4162
-
* until all unregister events invoked by the local processor
4163
-
* have been completed (either by this todo run, or one on
4164
-
* another cpu).
4165
-
*/
4166
-
if (list_empty(&net_todo_list))
4167
-
goto out;
4168
-
4169
4159
/* Snapshot list, allow later requests */
4170
-
spin_lock(&net_todo_list_lock);
4171
4160
list_replace_init(&net_todo_list, &list);
4172
-
spin_unlock(&net_todo_list_lock);
4161
+
4162
+
__rtnl_unlock();
4173
4163
4174
4164
while (!list_empty(&list)) {
4175
4165
struct net_device *dev
···
4192
4200
/* Free network device */
4193
4201
kobject_put(&dev->dev.kobj);
4194
4202
}
4195
-
4196
-
out:
4197
-
mutex_unlock(&net_todo_run_mutex);
4198
4203
}
4199
4204
4200
4205
static struct net_device_stats *internal_stats(struct net_device *dev)
+1
-1
net/core/rtnetlink.c
+1
-1
net/core/rtnetlink.c
+5
-1
net/ipv4/tcp_hybla.c
+5
-1
net/ipv4/tcp_hybla.c
···
150
150
ca->snd_cwnd_cents -= 128;
151
151
tp->snd_cwnd_cnt = 0;
152
152
}
153
-
153
+
/* check when cwnd has not been incremented for a while */
154
+
if (increment == 0 && odd == 0 && tp->snd_cwnd_cnt >= tp->snd_cwnd) {
155
+
tp->snd_cwnd++;
156
+
tp->snd_cwnd_cnt = 0;
157
+
}
154
158
/* clamp down slowstart cwnd to ssthresh value. */
155
159
if (is_slowstart)
156
160
tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
+2
-1
net/ipv4/tcp_input.c
+2
-1
net/ipv4/tcp_input.c
+1
-1
net/netrom/af_netrom.c
+1
-1
net/netrom/af_netrom.c
···
525
525
if (sk == NULL) return 0;
526
526
527
527
sock_hold(sk);
528
+
sock_orphan(sk);
528
529
lock_sock(sk);
529
530
nr = nr_sk(sk);
530
531
···
549
548
sk->sk_state = TCP_CLOSE;
550
549
sk->sk_shutdown |= SEND_SHUTDOWN;
551
550
sk->sk_state_change(sk);
552
-
sock_orphan(sk);
553
551
sock_set_flag(sk, SOCK_DESTROY);
554
552
break;
555
553