Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

1) 8139cp leaks memory in error paths, from Francois Romieu.

2) do_tcp_sendpages() cannot handle order > 0 pages, but they can
certainly arrive there now, fix from Eric Dumazet.

3) Race condition and sysfs fixes in bonding from Nikolay Aleksandrov.

4) Remain-on-Channel fix in mac80211 from Felix Liao.

5) CCK rate calculation fix in iwlwifi, from Emmanuel Grumbach.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
8139cp: fix coherent mapping leak in error path.
tcp: fix crashes in do_tcp_sendpages()
bonding: fix race condition in bonding_store_slaves_active
bonding: make arp_ip_target parameter checks consistent with sysfs
bonding: fix miimon and arp_interval delayed work race conditions
mac80211: fix remain-on-channel (non-)cancelling
iwlwifi: fix the basic CCK rates calculation

+61 -108
+29 -64
drivers/net/bonding/bond_main.c
··· 3459 3459 3460 3460 /*-------------------------- Device entry points ----------------------------*/ 3461 3461 3462 + static void bond_work_init_all(struct bonding *bond) 3463 + { 3464 + INIT_DELAYED_WORK(&bond->mcast_work, 3465 + bond_resend_igmp_join_requests_delayed); 3466 + INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor); 3467 + INIT_DELAYED_WORK(&bond->mii_work, bond_mii_monitor); 3468 + if (bond->params.mode == BOND_MODE_ACTIVEBACKUP) 3469 + INIT_DELAYED_WORK(&bond->arp_work, bond_activebackup_arp_mon); 3470 + else 3471 + INIT_DELAYED_WORK(&bond->arp_work, bond_loadbalance_arp_mon); 3472 + INIT_DELAYED_WORK(&bond->ad_work, bond_3ad_state_machine_handler); 3473 + } 3474 + 3475 + static void bond_work_cancel_all(struct bonding *bond) 3476 + { 3477 + cancel_delayed_work_sync(&bond->mii_work); 3478 + cancel_delayed_work_sync(&bond->arp_work); 3479 + cancel_delayed_work_sync(&bond->alb_work); 3480 + cancel_delayed_work_sync(&bond->ad_work); 3481 + cancel_delayed_work_sync(&bond->mcast_work); 3482 + } 3483 + 3462 3484 static int bond_open(struct net_device *bond_dev) 3463 3485 { 3464 3486 struct bonding *bond = netdev_priv(bond_dev); ··· 3503 3481 } 3504 3482 read_unlock(&bond->lock); 3505 3483 3506 - INIT_DELAYED_WORK(&bond->mcast_work, bond_resend_igmp_join_requests_delayed); 3484 + bond_work_init_all(bond); 3507 3485 3508 3486 if (bond_is_lb(bond)) { 3509 3487 /* bond_alb_initialize must be called before the timer 3510 3488 * is started. 3511 3489 */ 3512 - if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB))) { 3513 - /* something went wrong - fail the open operation */ 3490 + if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB))) 3514 3491 return -ENOMEM; 3515 - } 3516 - 3517 - INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor); 3518 3492 queue_delayed_work(bond->wq, &bond->alb_work, 0); 3519 3493 } 3520 3494 3521 - if (bond->params.miimon) { /* link check interval, in milliseconds. */ 3522 - INIT_DELAYED_WORK(&bond->mii_work, bond_mii_monitor); 3495 + if (bond->params.miimon) /* link check interval, in milliseconds. */ 3523 3496 queue_delayed_work(bond->wq, &bond->mii_work, 0); 3524 - } 3525 3497 3526 3498 if (bond->params.arp_interval) { /* arp interval, in milliseconds. */ 3527 - if (bond->params.mode == BOND_MODE_ACTIVEBACKUP) 3528 - INIT_DELAYED_WORK(&bond->arp_work, 3529 - bond_activebackup_arp_mon); 3530 - else 3531 - INIT_DELAYED_WORK(&bond->arp_work, 3532 - bond_loadbalance_arp_mon); 3533 - 3534 3499 queue_delayed_work(bond->wq, &bond->arp_work, 0); 3535 3500 if (bond->params.arp_validate) 3536 3501 bond->recv_probe = bond_arp_rcv; 3537 3502 } 3538 3503 3539 3504 if (bond->params.mode == BOND_MODE_8023AD) { 3540 - INIT_DELAYED_WORK(&bond->ad_work, bond_3ad_state_machine_handler); 3541 3505 queue_delayed_work(bond->wq, &bond->ad_work, 0); 3542 3506 /* register to receive LACPDUs */ 3543 3507 bond->recv_probe = bond_3ad_lacpdu_recv; ··· 3538 3530 struct bonding *bond = netdev_priv(bond_dev); 3539 3531 3540 3532 write_lock_bh(&bond->lock); 3541 - 3542 3533 bond->send_peer_notif = 0; 3543 - 3544 3534 write_unlock_bh(&bond->lock); 3545 3535 3546 - if (bond->params.miimon) { /* link check interval, in milliseconds. */ 3547 - cancel_delayed_work_sync(&bond->mii_work); 3548 - } 3549 - 3550 - if (bond->params.arp_interval) { /* arp interval, in milliseconds. */ 3551 - cancel_delayed_work_sync(&bond->arp_work); 3552 - } 3553 - 3554 - switch (bond->params.mode) { 3555 - case BOND_MODE_8023AD: 3556 - cancel_delayed_work_sync(&bond->ad_work); 3557 - break; 3558 - case BOND_MODE_TLB: 3559 - case BOND_MODE_ALB: 3560 - cancel_delayed_work_sync(&bond->alb_work); 3561 - break; 3562 - default: 3563 - break; 3564 - } 3565 - 3566 - if (delayed_work_pending(&bond->mcast_work)) 3567 - cancel_delayed_work_sync(&bond->mcast_work); 3568 - 3536 + bond_work_cancel_all(bond); 3569 3537 if (bond_is_lb(bond)) { 3570 3538 /* Must be called only after all 3571 3539 * slaves have been released ··· 4420 4436 bond_dev->features |= bond_dev->hw_features; 4421 4437 } 4422 4438 4423 - static void bond_work_cancel_all(struct bonding *bond) 4424 - { 4425 - if (bond->params.miimon && delayed_work_pending(&bond->mii_work)) 4426 - cancel_delayed_work_sync(&bond->mii_work); 4427 - 4428 - if (bond->params.arp_interval && delayed_work_pending(&bond->arp_work)) 4429 - cancel_delayed_work_sync(&bond->arp_work); 4430 - 4431 - if (bond->params.mode == BOND_MODE_ALB && 4432 - delayed_work_pending(&bond->alb_work)) 4433 - cancel_delayed_work_sync(&bond->alb_work); 4434 - 4435 - if (bond->params.mode == BOND_MODE_8023AD && 4436 - delayed_work_pending(&bond->ad_work)) 4437 - cancel_delayed_work_sync(&bond->ad_work); 4438 - 4439 - if (delayed_work_pending(&bond->mcast_work)) 4440 - cancel_delayed_work_sync(&bond->mcast_work); 4441 - } 4442 - 4443 4439 /* 4444 4440 * Destroy a bonding device. 4445 4441 * Must be under rtnl_lock when this function is called. ··· 4670 4706 arp_ip_count++) { 4671 4707 /* not complete check, but should be good enough to 4672 4708 catch mistakes */ 4673 - if (!isdigit(arp_ip_target[arp_ip_count][0])) { 4709 + __be32 ip = in_aton(arp_ip_target[arp_ip_count]); 4710 + if (!isdigit(arp_ip_target[arp_ip_count][0]) || 4711 + ip == 0 || ip == htonl(INADDR_BROADCAST)) { 4674 4712 pr_warning("Warning: bad arp_ip_target module parameter (%s), ARP monitoring will not be performed\n", 4675 4713 arp_ip_target[arp_ip_count]); 4676 4714 arp_interval = 0; 4677 4715 } else { 4678 - __be32 ip = in_aton(arp_ip_target[arp_ip_count]); 4679 4716 arp_target[arp_ip_count] = ip; 4680 4717 } 4681 4718 }
+12 -24
drivers/net/bonding/bond_sysfs.c
··· 513 513 int new_value, ret = count; 514 514 struct bonding *bond = to_bond(d); 515 515 516 + if (!rtnl_trylock()) 517 + return restart_syscall(); 516 518 if (sscanf(buf, "%d", &new_value) != 1) { 517 519 pr_err("%s: no arp_interval value specified.\n", 518 520 bond->dev->name); ··· 541 539 pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n", 542 540 bond->dev->name, bond->dev->name); 543 541 bond->params.miimon = 0; 544 - if (delayed_work_pending(&bond->mii_work)) { 545 - cancel_delayed_work(&bond->mii_work); 546 - flush_workqueue(bond->wq); 547 - } 548 542 } 549 543 if (!bond->params.arp_targets[0]) { 550 544 pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n", ··· 552 554 * timer will get fired off when the open function 553 555 * is called. 554 556 */ 555 - if (!delayed_work_pending(&bond->arp_work)) { 556 - if (bond->params.mode == BOND_MODE_ACTIVEBACKUP) 557 - INIT_DELAYED_WORK(&bond->arp_work, 558 - bond_activebackup_arp_mon); 559 - else 560 - INIT_DELAYED_WORK(&bond->arp_work, 561 - bond_loadbalance_arp_mon); 562 - 563 - queue_delayed_work(bond->wq, &bond->arp_work, 0); 564 - } 557 + cancel_delayed_work_sync(&bond->mii_work); 558 + queue_delayed_work(bond->wq, &bond->arp_work, 0); 565 559 } 566 560 567 561 out: 562 + rtnl_unlock(); 568 563 return ret; 569 564 } 570 565 static DEVICE_ATTR(arp_interval, S_IRUGO | S_IWUSR, ··· 953 962 int new_value, ret = count; 954 963 struct bonding *bond = to_bond(d); 955 964 965 + if (!rtnl_trylock()) 966 + return restart_syscall(); 956 967 if (sscanf(buf, "%d", &new_value) != 1) { 957 968 pr_err("%s: no miimon value specified.\n", 958 969 bond->dev->name); ··· 986 993 bond->params.arp_validate = 987 994 BOND_ARP_VALIDATE_NONE; 988 995 } 989 - if (delayed_work_pending(&bond->arp_work)) { 990 - cancel_delayed_work(&bond->arp_work); 991 - flush_workqueue(bond->wq); 992 - } 993 996 } 994 997 995 998 if (bond->dev->flags & IFF_UP) { ··· 994 1005 * timer will get fired off when the open function 995 1006 * is called. 996 1007 */ 997 - if (!delayed_work_pending(&bond->mii_work)) { 998 - INIT_DELAYED_WORK(&bond->mii_work, 999 - bond_mii_monitor); 1000 - queue_delayed_work(bond->wq, 1001 - &bond->mii_work, 0); 1002 - } 1008 + cancel_delayed_work_sync(&bond->arp_work); 1009 + queue_delayed_work(bond->wq, &bond->mii_work, 0); 1003 1010 } 1004 1011 } 1005 1012 out: 1013 + rtnl_unlock(); 1006 1014 return ret; 1007 1015 } 1008 1016 static DEVICE_ATTR(miimon, S_IRUGO | S_IWUSR, ··· 1568 1582 goto out; 1569 1583 } 1570 1584 1585 + read_lock(&bond->lock); 1571 1586 bond_for_each_slave(bond, slave, i) { 1572 1587 if (!bond_is_active_slave(slave)) { 1573 1588 if (new_value) ··· 1577 1590 slave->inactive = 1; 1578 1591 } 1579 1592 } 1593 + read_unlock(&bond->lock); 1580 1594 out: 1581 1595 return ret; 1582 1596 }
+8 -3
drivers/net/ethernet/realtek/8139cp.c
··· 1060 1060 1061 1061 static int cp_alloc_rings (struct cp_private *cp) 1062 1062 { 1063 + struct device *d = &cp->pdev->dev; 1063 1064 void *mem; 1065 + int rc; 1064 1066 1065 - mem = dma_alloc_coherent(&cp->pdev->dev, CP_RING_BYTES, 1066 - &cp->ring_dma, GFP_KERNEL); 1067 + mem = dma_alloc_coherent(d, CP_RING_BYTES, &cp->ring_dma, GFP_KERNEL); 1067 1068 if (!mem) 1068 1069 return -ENOMEM; 1069 1070 1070 1071 cp->rx_ring = mem; 1071 1072 cp->tx_ring = &cp->rx_ring[CP_RX_RING_SIZE]; 1072 1073 1073 - return cp_init_rings(cp); 1074 + rc = cp_init_rings(cp); 1075 + if (rc < 0) 1076 + dma_free_coherent(d, CP_RING_BYTES, cp->rx_ring, cp->ring_dma); 1077 + 1078 + return rc; 1074 1079 } 1075 1080 1076 1081 static void cp_clean_rings (struct cp_private *cp)
+6 -6
drivers/net/wireless/iwlwifi/dvm/rxon.c
··· 1012 1012 * As a consequence, it's not as complicated as it sounds, just add 1013 1013 * any lower rates to the ACK rate bitmap. 1014 1014 */ 1015 - if (IWL_RATE_11M_INDEX < lowest_present_ofdm) 1016 - ofdm |= IWL_RATE_11M_MASK >> IWL_FIRST_CCK_RATE; 1017 - if (IWL_RATE_5M_INDEX < lowest_present_ofdm) 1018 - ofdm |= IWL_RATE_5M_MASK >> IWL_FIRST_CCK_RATE; 1019 - if (IWL_RATE_2M_INDEX < lowest_present_ofdm) 1020 - ofdm |= IWL_RATE_2M_MASK >> IWL_FIRST_CCK_RATE; 1015 + if (IWL_RATE_11M_INDEX < lowest_present_cck) 1016 + cck |= IWL_RATE_11M_MASK >> IWL_FIRST_CCK_RATE; 1017 + if (IWL_RATE_5M_INDEX < lowest_present_cck) 1018 + cck |= IWL_RATE_5M_MASK >> IWL_FIRST_CCK_RATE; 1019 + if (IWL_RATE_2M_INDEX < lowest_present_cck) 1020 + cck |= IWL_RATE_2M_MASK >> IWL_FIRST_CCK_RATE; 1021 1021 /* 1M already there or needed so always add */ 1022 1022 cck |= IWL_RATE_1M_MASK >> IWL_FIRST_CCK_RATE; 1023 1023
+6 -9
net/ipv4/tcp.c
··· 830 830 return mss_now; 831 831 } 832 832 833 - static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffset, 834 - size_t psize, int flags) 833 + static ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset, 834 + size_t size, int flags) 835 835 { 836 836 struct tcp_sock *tp = tcp_sk(sk); 837 837 int mss_now, size_goal; ··· 858 858 if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN)) 859 859 goto out_err; 860 860 861 - while (psize > 0) { 861 + while (size > 0) { 862 862 struct sk_buff *skb = tcp_write_queue_tail(sk); 863 - struct page *page = pages[poffset / PAGE_SIZE]; 864 863 int copy, i; 865 - int offset = poffset % PAGE_SIZE; 866 - int size = min_t(size_t, psize, PAGE_SIZE - offset); 867 864 bool can_coalesce; 868 865 869 866 if (!tcp_send_head(sk) || (copy = size_goal - skb->len) <= 0) { ··· 909 912 TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_PSH; 910 913 911 914 copied += copy; 912 - poffset += copy; 913 - if (!(psize -= copy)) 915 + offset += copy; 916 + if (!(size -= copy)) 914 917 goto out; 915 918 916 919 if (skb->len < size_goal || (flags & MSG_OOB)) ··· 957 960 flags); 958 961 959 962 lock_sock(sk); 960 - res = do_tcp_sendpages(sk, &page, offset, size, flags); 963 + res = do_tcp_sendpages(sk, page, offset, size, flags); 961 964 release_sock(sk); 962 965 return res; 963 966 }
-2
net/mac80211/offchannel.c
··· 458 458 list_move_tail(&roc->list, &tmp_list); 459 459 roc->abort = true; 460 460 } 461 - 462 - ieee80211_start_next_roc(local); 463 461 mutex_unlock(&local->mtx); 464 462 465 463 list_for_each_entry_safe(roc, tmp, &tmp_list, list) {