Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits)
af_unix: limit recursion level
pch_gbe driver: The wrong of initializer entry
pch_gbe dreiver: chang author
ucc_geth: fix ucc halt problem in half duplex mode
inet: Fix __inet_inherit_port() to correctly increment bsockets and num_owners
ehea: Add some info messages and fix an issue
hso: fix disable_net
NET: wan/x25_asy, move lapb_unregister to x25_asy_close_tty
cxgb4vf: fix setting unicast/multicast addresses ...
net, ppp: Report correct error code if unit allocation failed
DECnet: don't leak uninitialized stack byte
au1000_eth: fix invalid address accessing the MAC enable register
dccp: fix error in updating the GAR
tcp: restrict net.ipv4.tcp_adv_win_scale (#20312)
netns: Don't leak others' openreq-s in proc
Net: ceph: Makefile: Remove unnessary code
vhost/net: fix rcu check usage
econet: fix CVE-2010-3848
econet: fix CVE-2010-3850
econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849
...
+280
-203
+1
Documentation/networking/ip-sysctl.txt
+1
Documentation/networking/ip-sysctl.txt
+4
-3
drivers/isdn/icn/icn.c
+4
-3
drivers/isdn/icn/icn.c
···
1627
1627
static int __init icn_init(void)
1628
1628
{
1629
1629
char *p;
1630
-
char rev[10];
1630
+
char rev[20];
1631
1631
1632
1632
memset(&dev, 0, sizeof(icn_dev));
1633
1633
dev.memaddr = (membase & 0x0ffc000);
···
1637
1637
spin_lock_init(&dev.devlock);
1638
1638
1639
1639
if ((p = strchr(revision, ':'))) {
1640
-
strcpy(rev, p + 1);
1640
+
strncpy(rev, p + 1, 20);
1641
1641
p = strchr(rev, '$');
1642
-
*p = 0;
1642
+
if (p)
1643
+
*p = 0;
1643
1644
} else
1644
1645
strcpy(rev, " ??? ");
1645
1646
printk(KERN_NOTICE "ICN-ISDN-driver Rev%smem=0x%08lx\n", rev,
+3
-3
drivers/net/Kconfig
+3
-3
drivers/net/Kconfig
···
2543
2543
depends on PCI
2544
2544
select MII
2545
2545
---help---
2546
-
This is a gigabit ethernet driver for Topcliff PCH.
2547
-
Topcliff PCH is the platform controller hub that is used in Intel's
2546
+
This is a gigabit ethernet driver for EG20T PCH.
2547
+
EG20T PCH is the platform controller hub that is used in Intel's
2548
2548
general embedded platform.
2549
-
Topcliff PCH has Gigabit Ethernet interface.
2549
+
EG20T PCH has Gigabit Ethernet interface.
2550
2550
Using this interface, it is able to access system devices connected
2551
2551
to Gigabit Ethernet.
2552
2552
This driver enables Gigabit Ethernet function.
+5
-5
drivers/net/au1000_eth.c
+5
-5
drivers/net/au1000_eth.c
···
155
155
spin_lock_irqsave(&aup->lock, flags);
156
156
157
157
if (force_reset || (!aup->mac_enabled)) {
158
-
writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
158
+
writel(MAC_EN_CLOCK_ENABLE, aup->enable);
159
159
au_sync_delay(2);
160
160
writel((MAC_EN_RESET0 | MAC_EN_RESET1 | MAC_EN_RESET2
161
-
| MAC_EN_CLOCK_ENABLE), &aup->enable);
161
+
| MAC_EN_CLOCK_ENABLE), aup->enable);
162
162
au_sync_delay(2);
163
163
164
164
aup->mac_enabled = 1;
···
503
503
504
504
au1000_hard_stop(dev);
505
505
506
-
writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
506
+
writel(MAC_EN_CLOCK_ENABLE, aup->enable);
507
507
au_sync_delay(2);
508
-
writel(0, &aup->enable);
508
+
writel(0, aup->enable);
509
509
au_sync_delay(2);
510
510
511
511
aup->tx_full = 0;
···
1119
1119
/* set a random MAC now in case platform_data doesn't provide one */
1120
1120
random_ether_addr(dev->dev_addr);
1121
1121
1122
-
writel(0, &aup->enable);
1122
+
writel(0, aup->enable);
1123
1123
aup->mac_enabled = 0;
1124
1124
1125
1125
pd = pdev->dev.platform_data;
+45
-28
drivers/net/cxgb4vf/cxgb4vf_main.c
+45
-28
drivers/net/cxgb4vf/cxgb4vf_main.c
···
816
816
}
817
817
818
818
/*
819
-
* Collect up to maxaddrs worth of a netdevice's unicast addresses into an
820
-
* array of addrss pointers and return the number collected.
819
+
* Collect up to maxaddrs worth of a netdevice's unicast addresses, starting
820
+
* at a specified offset within the list, into an array of addrss pointers and
821
+
* return the number collected.
821
822
*/
822
-
static inline int collect_netdev_uc_list_addrs(const struct net_device *dev,
823
-
const u8 **addr,
824
-
unsigned int maxaddrs)
823
+
static inline unsigned int collect_netdev_uc_list_addrs(const struct net_device *dev,
824
+
const u8 **addr,
825
+
unsigned int offset,
826
+
unsigned int maxaddrs)
825
827
{
828
+
unsigned int index = 0;
826
829
unsigned int naddr = 0;
827
830
const struct netdev_hw_addr *ha;
828
831
829
-
for_each_dev_addr(dev, ha) {
830
-
addr[naddr++] = ha->addr;
831
-
if (naddr >= maxaddrs)
832
-
break;
833
-
}
832
+
for_each_dev_addr(dev, ha)
833
+
if (index++ >= offset) {
834
+
addr[naddr++] = ha->addr;
835
+
if (naddr >= maxaddrs)
836
+
break;
837
+
}
834
838
return naddr;
835
839
}
836
840
837
841
/*
838
-
* Collect up to maxaddrs worth of a netdevice's multicast addresses into an
839
-
* array of addrss pointers and return the number collected.
842
+
* Collect up to maxaddrs worth of a netdevice's multicast addresses, starting
843
+
* at a specified offset within the list, into an array of addrss pointers and
844
+
* return the number collected.
840
845
*/
841
-
static inline int collect_netdev_mc_list_addrs(const struct net_device *dev,
842
-
const u8 **addr,
843
-
unsigned int maxaddrs)
846
+
static inline unsigned int collect_netdev_mc_list_addrs(const struct net_device *dev,
847
+
const u8 **addr,
848
+
unsigned int offset,
849
+
unsigned int maxaddrs)
844
850
{
851
+
unsigned int index = 0;
845
852
unsigned int naddr = 0;
846
853
const struct netdev_hw_addr *ha;
847
854
848
-
netdev_for_each_mc_addr(ha, dev) {
849
-
addr[naddr++] = ha->addr;
850
-
if (naddr >= maxaddrs)
851
-
break;
852
-
}
855
+
netdev_for_each_mc_addr(ha, dev)
856
+
if (index++ >= offset) {
857
+
addr[naddr++] = ha->addr;
858
+
if (naddr >= maxaddrs)
859
+
break;
860
+
}
853
861
return naddr;
854
862
}
855
863
···
870
862
u64 mhash = 0;
871
863
u64 uhash = 0;
872
864
bool free = true;
873
-
u16 filt_idx[7];
865
+
unsigned int offset, naddr;
874
866
const u8 *addr[7];
875
-
int ret, naddr = 0;
867
+
int ret;
876
868
const struct port_info *pi = netdev_priv(dev);
877
869
878
870
/* first do the secondary unicast addresses */
879
-
naddr = collect_netdev_uc_list_addrs(dev, addr, ARRAY_SIZE(addr));
880
-
if (naddr > 0) {
871
+
for (offset = 0; ; offset += naddr) {
872
+
naddr = collect_netdev_uc_list_addrs(dev, addr, offset,
873
+
ARRAY_SIZE(addr));
874
+
if (naddr == 0)
875
+
break;
876
+
881
877
ret = t4vf_alloc_mac_filt(pi->adapter, pi->viid, free,
882
-
naddr, addr, filt_idx, &uhash, sleep);
878
+
naddr, addr, NULL, &uhash, sleep);
883
879
if (ret < 0)
884
880
return ret;
885
881
···
891
879
}
892
880
893
881
/* next set up the multicast addresses */
894
-
naddr = collect_netdev_mc_list_addrs(dev, addr, ARRAY_SIZE(addr));
895
-
if (naddr > 0) {
882
+
for (offset = 0; ; offset += naddr) {
883
+
naddr = collect_netdev_mc_list_addrs(dev, addr, offset,
884
+
ARRAY_SIZE(addr));
885
+
if (naddr == 0)
886
+
break;
887
+
896
888
ret = t4vf_alloc_mac_filt(pi->adapter, pi->viid, free,
897
-
naddr, addr, filt_idx, &mhash, sleep);
889
+
naddr, addr, NULL, &mhash, sleep);
898
890
if (ret < 0)
899
891
return ret;
892
+
free = false;
900
893
}
901
894
902
895
return t4vf_set_addr_hash(pi->adapter, pi->viid, uhash != 0,
+59
-35
drivers/net/cxgb4vf/t4vf_hw.c
+59
-35
drivers/net/cxgb4vf/t4vf_hw.c
···
1014
1014
unsigned int naddr, const u8 **addr, u16 *idx,
1015
1015
u64 *hash, bool sleep_ok)
1016
1016
{
1017
-
int i, ret;
1017
+
int offset, ret = 0;
1018
+
unsigned nfilters = 0;
1019
+
unsigned int rem = naddr;
1018
1020
struct fw_vi_mac_cmd cmd, rpl;
1019
-
struct fw_vi_mac_exact *p;
1020
-
size_t len16;
1021
1021
1022
-
if (naddr > ARRAY_SIZE(cmd.u.exact))
1022
+
if (naddr > FW_CLS_TCAM_NUM_ENTRIES)
1023
1023
return -EINVAL;
1024
-
len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
1025
-
u.exact[naddr]), 16);
1026
1024
1027
-
memset(&cmd, 0, sizeof(cmd));
1028
-
cmd.op_to_viid = cpu_to_be32(FW_CMD_OP(FW_VI_MAC_CMD) |
1029
-
FW_CMD_REQUEST |
1030
-
FW_CMD_WRITE |
1031
-
(free ? FW_CMD_EXEC : 0) |
1032
-
FW_VI_MAC_CMD_VIID(viid));
1033
-
cmd.freemacs_to_len16 = cpu_to_be32(FW_VI_MAC_CMD_FREEMACS(free) |
1034
-
FW_CMD_LEN16(len16));
1025
+
for (offset = 0; offset < naddr; /**/) {
1026
+
unsigned int fw_naddr = (rem < ARRAY_SIZE(cmd.u.exact)
1027
+
? rem
1028
+
: ARRAY_SIZE(cmd.u.exact));
1029
+
size_t len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
1030
+
u.exact[fw_naddr]), 16);
1031
+
struct fw_vi_mac_exact *p;
1032
+
int i;
1035
1033
1036
-
for (i = 0, p = cmd.u.exact; i < naddr; i++, p++) {
1037
-
p->valid_to_idx =
1038
-
cpu_to_be16(FW_VI_MAC_CMD_VALID |
1039
-
FW_VI_MAC_CMD_IDX(FW_VI_MAC_ADD_MAC));
1040
-
memcpy(p->macaddr, addr[i], sizeof(p->macaddr));
1034
+
memset(&cmd, 0, sizeof(cmd));
1035
+
cmd.op_to_viid = cpu_to_be32(FW_CMD_OP(FW_VI_MAC_CMD) |
1036
+
FW_CMD_REQUEST |
1037
+
FW_CMD_WRITE |
1038
+
(free ? FW_CMD_EXEC : 0) |
1039
+
FW_VI_MAC_CMD_VIID(viid));
1040
+
cmd.freemacs_to_len16 =
1041
+
cpu_to_be32(FW_VI_MAC_CMD_FREEMACS(free) |
1042
+
FW_CMD_LEN16(len16));
1043
+
1044
+
for (i = 0, p = cmd.u.exact; i < fw_naddr; i++, p++) {
1045
+
p->valid_to_idx = cpu_to_be16(
1046
+
FW_VI_MAC_CMD_VALID |
1047
+
FW_VI_MAC_CMD_IDX(FW_VI_MAC_ADD_MAC));
1048
+
memcpy(p->macaddr, addr[offset+i], sizeof(p->macaddr));
1049
+
}
1050
+
1051
+
1052
+
ret = t4vf_wr_mbox_core(adapter, &cmd, sizeof(cmd), &rpl,
1053
+
sleep_ok);
1054
+
if (ret && ret != -ENOMEM)
1055
+
break;
1056
+
1057
+
for (i = 0, p = rpl.u.exact; i < fw_naddr; i++, p++) {
1058
+
u16 index = FW_VI_MAC_CMD_IDX_GET(
1059
+
be16_to_cpu(p->valid_to_idx));
1060
+
1061
+
if (idx)
1062
+
idx[offset+i] =
1063
+
(index >= FW_CLS_TCAM_NUM_ENTRIES
1064
+
? 0xffff
1065
+
: index);
1066
+
if (index < FW_CLS_TCAM_NUM_ENTRIES)
1067
+
nfilters++;
1068
+
else if (hash)
1069
+
*hash |= (1ULL << hash_mac_addr(addr[offset+i]));
1070
+
}
1071
+
1072
+
free = false;
1073
+
offset += fw_naddr;
1074
+
rem -= fw_naddr;
1041
1075
}
1042
1076
1043
-
ret = t4vf_wr_mbox_core(adapter, &cmd, sizeof(cmd), &rpl, sleep_ok);
1044
-
if (ret)
1045
-
return ret;
1046
-
1047
-
for (i = 0, p = rpl.u.exact; i < naddr; i++, p++) {
1048
-
u16 index = FW_VI_MAC_CMD_IDX_GET(be16_to_cpu(p->valid_to_idx));
1049
-
1050
-
if (idx)
1051
-
idx[i] = (index >= FW_CLS_TCAM_NUM_ENTRIES
1052
-
? 0xffff
1053
-
: index);
1054
-
if (index < FW_CLS_TCAM_NUM_ENTRIES)
1055
-
ret++;
1056
-
else if (hash)
1057
-
*hash |= (1 << hash_mac_addr(addr[i]));
1058
-
}
1077
+
/*
1078
+
* If there were no errors or we merely ran out of room in our MAC
1079
+
* address arena, return the number of filters actually written.
1080
+
*/
1081
+
if (ret == 0 || ret == -ENOMEM)
1082
+
ret = nfilters;
1059
1083
return ret;
1060
1084
}
1061
1085
+14
-4
drivers/net/ehea/ehea_main.c
+14
-4
drivers/net/ehea/ehea_main.c
···
400
400
skb_arr_rq1[index] = netdev_alloc_skb(dev,
401
401
EHEA_L_PKT_SIZE);
402
402
if (!skb_arr_rq1[index]) {
403
+
ehea_info("Unable to allocate enough skb in the array\n");
403
404
pr->rq1_skba.os_skbs = fill_wqes - i;
404
405
break;
405
406
}
···
423
422
struct net_device *dev = pr->port->netdev;
424
423
int i;
425
424
426
-
for (i = 0; i < pr->rq1_skba.len; i++) {
425
+
if (nr_rq1a > pr->rq1_skba.len) {
426
+
ehea_error("NR_RQ1A bigger than skb array len\n");
427
+
return;
428
+
}
429
+
430
+
for (i = 0; i < nr_rq1a; i++) {
427
431
skb_arr_rq1[i] = netdev_alloc_skb(dev, EHEA_L_PKT_SIZE);
428
-
if (!skb_arr_rq1[i])
432
+
if (!skb_arr_rq1[i]) {
433
+
ehea_info("No enough memory to allocate skb array\n");
429
434
break;
435
+
}
430
436
}
431
437
/* Ring doorbell */
432
-
ehea_update_rq1a(pr->qp, nr_rq1a);
438
+
ehea_update_rq1a(pr->qp, i);
433
439
}
434
440
435
441
static int ehea_refill_rq_def(struct ehea_port_res *pr,
···
743
735
744
736
skb = netdev_alloc_skb(dev,
745
737
EHEA_L_PKT_SIZE);
746
-
if (!skb)
738
+
if (!skb) {
739
+
ehea_info("Not enough memory to allocate skb\n");
747
740
break;
741
+
}
748
742
}
749
743
skb_copy_to_linear_data(skb, ((char *)cqe) + 64,
750
744
cqe->num_bytes_transfered - 4);
+3
-3
drivers/net/pch_gbe/pch_gbe_main.c
+3
-3
drivers/net/pch_gbe/pch_gbe_main.c
···
1
1
/*
2
2
* Copyright (C) 1999 - 2010 Intel Corporation.
3
-
* Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
3
+
* Copyright (C) 2010 OKI SEMICONDUCTOR CO., LTD.
4
4
*
5
5
* This code was derived from the Intel e1000e Linux driver.
6
6
*
···
2464
2464
module_init(pch_gbe_init_module);
2465
2465
module_exit(pch_gbe_exit_module);
2466
2466
2467
-
MODULE_DESCRIPTION("OKI semiconductor PCH Gigabit ethernet Driver");
2468
-
MODULE_AUTHOR("OKI semiconductor, <masa-korg@dsn.okisemi.com>");
2467
+
MODULE_DESCRIPTION("EG20T PCH Gigabit ethernet Driver");
2468
+
MODULE_AUTHOR("OKI SEMICONDUCTOR, <toshiharu-linux@dsn.okisemi.com>");
2469
2469
MODULE_LICENSE("GPL");
2470
2470
MODULE_VERSION(DRV_VERSION);
2471
2471
MODULE_DEVICE_TABLE(pci, pch_gbe_pcidev_id);
+4
-4
drivers/net/pch_gbe/pch_gbe_param.c
+4
-4
drivers/net/pch_gbe/pch_gbe_param.c
···
434
434
.err = "using default of "
435
435
__MODULE_STRING(PCH_GBE_DEFAULT_TXD),
436
436
.def = PCH_GBE_DEFAULT_TXD,
437
-
.arg = { .r = { .min = PCH_GBE_MIN_TXD } },
438
-
.arg = { .r = { .max = PCH_GBE_MAX_TXD } }
437
+
.arg = { .r = { .min = PCH_GBE_MIN_TXD,
438
+
.max = PCH_GBE_MAX_TXD } }
439
439
};
440
440
struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
441
441
tx_ring->count = TxDescriptors;
···
450
450
.err = "using default of "
451
451
__MODULE_STRING(PCH_GBE_DEFAULT_RXD),
452
452
.def = PCH_GBE_DEFAULT_RXD,
453
-
.arg = { .r = { .min = PCH_GBE_MIN_RXD } },
454
-
.arg = { .r = { .max = PCH_GBE_MAX_RXD } }
453
+
.arg = { .r = { .min = PCH_GBE_MIN_RXD,
454
+
.max = PCH_GBE_MAX_RXD } }
455
455
};
456
456
struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
457
457
rx_ring->count = RxDescriptors;
+22
-21
drivers/net/ppp_generic.c
+22
-21
drivers/net/ppp_generic.c
···
2584
2584
*/
2585
2585
dev_net_set(dev, net);
2586
2586
2587
-
ret = -EEXIST;
2588
2587
mutex_lock(&pn->all_ppp_mutex);
2589
2588
2590
2589
if (unit < 0) {
2591
2590
unit = unit_get(&pn->units_idr, ppp);
2592
2591
if (unit < 0) {
2593
-
*retp = unit;
2592
+
ret = unit;
2594
2593
goto out2;
2595
2594
}
2596
2595
} else {
2596
+
ret = -EEXIST;
2597
2597
if (unit_find(&pn->units_idr, unit))
2598
2598
goto out2; /* unit already exists */
2599
2599
/*
···
2668
2668
ppp->closing = 1;
2669
2669
ppp_unlock(ppp);
2670
2670
unregister_netdev(ppp->dev);
2671
+
unit_put(&pn->units_idr, ppp->file.index);
2671
2672
} else
2672
2673
ppp_unlock(ppp);
2673
2674
2674
-
unit_put(&pn->units_idr, ppp->file.index);
2675
2675
ppp->file.dead = 1;
2676
2676
ppp->owner = NULL;
2677
2677
wake_up_interruptible(&ppp->file.rwait);
···
2859
2859
* by holding all_ppp_mutex
2860
2860
*/
2861
2861
2862
-
/* associate pointer with specified number */
2863
-
static int unit_set(struct idr *p, void *ptr, int n)
2862
+
static int __unit_alloc(struct idr *p, void *ptr, int n)
2864
2863
{
2865
2864
int unit, err;
2866
2865
···
2870
2871
}
2871
2872
2872
2873
err = idr_get_new_above(p, ptr, n, &unit);
2873
-
if (err == -EAGAIN)
2874
-
goto again;
2874
+
if (err < 0) {
2875
+
if (err == -EAGAIN)
2876
+
goto again;
2877
+
return err;
2878
+
}
2875
2879
2876
-
if (unit != n) {
2880
+
return unit;
2881
+
}
2882
+
2883
+
/* associate pointer with specified number */
2884
+
static int unit_set(struct idr *p, void *ptr, int n)
2885
+
{
2886
+
int unit;
2887
+
2888
+
unit = __unit_alloc(p, ptr, n);
2889
+
if (unit < 0)
2890
+
return unit;
2891
+
else if (unit != n) {
2877
2892
idr_remove(p, unit);
2878
2893
return -EINVAL;
2879
2894
}
···
2898
2885
/* get new free unit number and associate pointer with it */
2899
2886
static int unit_get(struct idr *p, void *ptr)
2900
2887
{
2901
-
int unit, err;
2902
-
2903
-
again:
2904
-
if (!idr_pre_get(p, GFP_KERNEL)) {
2905
-
printk(KERN_ERR "PPP: No free memory for idr\n");
2906
-
return -ENOMEM;
2907
-
}
2908
-
2909
-
err = idr_get_new_above(p, ptr, 0, &unit);
2910
-
if (err == -EAGAIN)
2911
-
goto again;
2912
-
2913
-
return unit;
2888
+
return __unit_alloc(p, ptr, 0);
2914
2889
}
2915
2890
2916
2891
/* put unit number back to a pool */
+2
-1
drivers/net/ucc_geth.h
+2
-1
drivers/net/ucc_geth.h
···
899
899
#define UCC_GETH_UTFS_INIT 512 /* Tx virtual FIFO size
900
900
*/
901
901
#define UCC_GETH_UTFET_INIT 256 /* 1/2 utfs */
902
-
#define UCC_GETH_UTFTT_INIT 512
902
+
#define UCC_GETH_UTFTT_INIT 256 /* 1/2 utfs
903
+
due to errata */
903
904
/* Gigabit Ethernet (1000 Mbps) */
904
905
#define UCC_GETH_URFS_GIGA_INIT 4096/*2048*/ /* Rx virtual
905
906
FIFO size */
+6
-4
drivers/net/usb/hso.c
+6
-4
drivers/net/usb/hso.c
···
2994
2994
2995
2995
case HSO_INTF_BULK:
2996
2996
/* It's a regular bulk interface */
2997
-
if (((port_spec & HSO_PORT_MASK) == HSO_PORT_NETWORK) &&
2998
-
!disable_net)
2999
-
hso_dev = hso_create_net_device(interface, port_spec);
3000
-
else
2997
+
if ((port_spec & HSO_PORT_MASK) == HSO_PORT_NETWORK) {
2998
+
if (!disable_net)
2999
+
hso_dev =
3000
+
hso_create_net_device(interface, port_spec);
3001
+
} else {
3001
3002
hso_dev =
3002
3003
hso_create_bulk_serial_device(interface, port_spec);
3004
+
}
3003
3005
if (!hso_dev)
3004
3006
goto exit;
3005
3007
break;
+6
-5
drivers/net/wan/x25_asy.c
+6
-5
drivers/net/wan/x25_asy.c
···
498
498
static int x25_asy_close(struct net_device *dev)
499
499
{
500
500
struct x25_asy *sl = netdev_priv(dev);
501
-
int err;
502
501
503
502
spin_lock(&sl->lock);
504
503
if (sl->tty)
···
506
507
netif_stop_queue(dev);
507
508
sl->rcount = 0;
508
509
sl->xleft = 0;
509
-
err = lapb_unregister(dev);
510
-
if (err != LAPB_OK)
511
-
printk(KERN_ERR "x25_asy_close: lapb_unregister error -%d\n",
512
-
err);
513
510
spin_unlock(&sl->lock);
514
511
return 0;
515
512
}
···
590
595
static void x25_asy_close_tty(struct tty_struct *tty)
591
596
{
592
597
struct x25_asy *sl = tty->disc_data;
598
+
int err;
593
599
594
600
/* First make sure we're connected. */
595
601
if (!sl || sl->magic != X25_ASY_MAGIC)
···
600
604
if (sl->dev->flags & IFF_UP)
601
605
dev_close(sl->dev);
602
606
rtnl_unlock();
607
+
608
+
err = lapb_unregister(sl->dev);
609
+
if (err != LAPB_OK)
610
+
printk(KERN_ERR "x25_asy_close: lapb_unregister error -%d\n",
611
+
err);
603
612
604
613
tty->disc_data = NULL;
605
614
sl->tty = NULL;
+1
-1
drivers/net/wireless/ath/ath9k/recv.c
+1
-1
drivers/net/wireless/ath/ath9k/recv.c
+1
-1
drivers/net/wireless/ath/carl9170/main.c
+1
-1
drivers/net/wireless/ath/carl9170/main.c
+1
drivers/net/wireless/b43/sdio.c
+1
drivers/net/wireless/b43/sdio.c
+1
drivers/ssb/b43_pci_bridge.c
+1
drivers/ssb/b43_pci_bridge.c
···
24
24
{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4312) },
25
25
{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4315) },
26
26
{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4318) },
27
+
{ PCI_DEVICE(PCI_VENDOR_ID_BCM_GVC, 0x4318) },
27
28
{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4319) },
28
29
{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4320) },
29
30
{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4321) },
+3
-2
drivers/vhost/net.c
+3
-2
drivers/vhost/net.c
···
129
129
size_t hdr_size;
130
130
struct socket *sock;
131
131
132
-
sock = rcu_dereference_check(vq->private_data,
133
-
lockdep_is_held(&vq->mutex));
132
+
/* TODO: check that we are running from vhost_worker?
133
+
* Not sure it's worth it, it's straight-forward enough. */
134
+
sock = rcu_dereference_check(vq->private_data, 1);
134
135
if (!sock)
135
136
return;
136
137
+1
include/linux/pci_ids.h
+1
include/linux/pci_ids.h
···
2047
2047
#define PCI_DEVICE_ID_AFAVLAB_P030 0x2182
2048
2048
#define PCI_SUBDEVICE_ID_AFAVLAB_P061 0x2150
2049
2049
2050
+
#define PCI_VENDOR_ID_BCM_GVC 0x14a4
2050
2051
#define PCI_VENDOR_ID_BROADCOM 0x14e4
2051
2052
#define PCI_DEVICE_ID_TIGON3_5752 0x1600
2052
2053
#define PCI_DEVICE_ID_TIGON3_5752M 0x1601
+2
include/net/af_unix.h
+2
include/net/af_unix.h
···
10
10
extern void unix_notinflight(struct file *fp);
11
11
extern void unix_gc(void);
12
12
extern void wait_for_unix_gc(void);
13
+
extern struct sock *unix_get_socket(struct file *filp);
13
14
14
15
#define UNIX_HASH_SIZE 256
15
16
···
57
56
spinlock_t lock;
58
57
unsigned int gc_candidate : 1;
59
58
unsigned int gc_maybe_cycle : 1;
59
+
unsigned char recursion_level;
60
60
struct socket_wq peer_wq;
61
61
};
62
62
#define unix_sk(__sk) ((struct unix_sock *)__sk)
-22
net/ceph/Makefile
-22
net/ceph/Makefile
···
1
1
#
2
2
# Makefile for CEPH filesystem.
3
3
#
4
-
5
-
ifneq ($(KERNELRELEASE),)
6
-
7
4
obj-$(CONFIG_CEPH_LIB) += libceph.o
8
5
9
6
libceph-objs := ceph_common.o messenger.o msgpool.o buffer.o pagelist.o \
···
13
16
ceph_fs.o ceph_strings.o ceph_hash.o \
14
17
pagevec.o
15
18
16
-
else
17
-
#Otherwise we were called directly from the command
18
-
# line; invoke the kernel build system.
19
-
20
-
KERNELDIR ?= /lib/modules/$(shell uname -r)/build
21
-
PWD := $(shell pwd)
22
-
23
-
default: all
24
-
25
-
all:
26
-
$(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_LIB=m modules
27
-
28
-
modules_install:
29
-
$(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_LIB=m modules_install
30
-
31
-
clean:
32
-
$(MAKE) -C $(KERNELDIR) M=$(PWD) clean
33
-
34
-
endif
+2
-1
net/dccp/input.c
+2
-1
net/dccp/input.c
···
239
239
dccp_update_gsr(sk, seqno);
240
240
241
241
if (dh->dccph_type != DCCP_PKT_SYNC &&
242
-
(ackno != DCCP_PKT_WITHOUT_ACK_SEQ))
242
+
ackno != DCCP_PKT_WITHOUT_ACK_SEQ &&
243
+
after48(ackno, dp->dccps_gar))
243
244
dp->dccps_gar = ackno;
244
245
} else {
245
246
unsigned long now = jiffies;
+2
net/decnet/af_decnet.c
+2
net/decnet/af_decnet.c
+42
-49
net/econet/af_econet.c
+42
-49
net/econet/af_econet.c
···
31
31
#include <linux/skbuff.h>
32
32
#include <linux/udp.h>
33
33
#include <linux/slab.h>
34
+
#include <linux/vmalloc.h>
34
35
#include <net/sock.h>
35
36
#include <net/inet_common.h>
36
37
#include <linux/stat.h>
···
277
276
#endif
278
277
#ifdef CONFIG_ECONET_AUNUDP
279
278
struct msghdr udpmsg;
280
-
struct iovec iov[msg->msg_iovlen+1];
279
+
struct iovec iov[2];
281
280
struct aunhdr ah;
282
281
struct sockaddr_in udpdest;
283
282
__kernel_size_t size;
284
-
int i;
285
283
mm_segment_t oldfs;
284
+
char *userbuf;
286
285
#endif
287
286
288
287
/*
···
298
297
299
298
mutex_lock(&econet_mutex);
300
299
301
-
if (saddr == NULL) {
302
-
struct econet_sock *eo = ec_sk(sk);
303
-
304
-
addr.station = eo->station;
305
-
addr.net = eo->net;
306
-
port = eo->port;
307
-
cb = eo->cb;
308
-
} else {
309
-
if (msg->msg_namelen < sizeof(struct sockaddr_ec)) {
310
-
mutex_unlock(&econet_mutex);
311
-
return -EINVAL;
312
-
}
313
-
addr.station = saddr->addr.station;
314
-
addr.net = saddr->addr.net;
315
-
port = saddr->port;
316
-
cb = saddr->cb;
317
-
}
300
+
if (saddr == NULL || msg->msg_namelen < sizeof(struct sockaddr_ec)) {
301
+
mutex_unlock(&econet_mutex);
302
+
return -EINVAL;
303
+
}
304
+
addr.station = saddr->addr.station;
305
+
addr.net = saddr->addr.net;
306
+
port = saddr->port;
307
+
cb = saddr->cb;
318
308
319
309
/* Look for a device with the right network number. */
320
310
dev = net2dev_map[addr.net];
···
320
328
}
321
329
}
322
330
323
-
if (len + 15 > dev->mtu) {
324
-
mutex_unlock(&econet_mutex);
325
-
return -EMSGSIZE;
326
-
}
327
-
328
331
if (dev->type == ARPHRD_ECONET) {
329
332
/* Real hardware Econet. We're not worthy etc. */
330
333
#ifdef CONFIG_ECONET_NATIVE
331
334
unsigned short proto = 0;
332
335
int res;
336
+
337
+
if (len + 15 > dev->mtu) {
338
+
mutex_unlock(&econet_mutex);
339
+
return -EMSGSIZE;
340
+
}
333
341
334
342
dev_hold(dev);
335
343
···
343
351
344
352
eb = (struct ec_cb *)&skb->cb;
345
353
346
-
/* BUG: saddr may be NULL */
347
354
eb->cookie = saddr->cookie;
348
355
eb->sec = *saddr;
349
356
eb->sent = ec_tx_done;
···
406
415
return -ENETDOWN; /* No socket - can't send */
407
416
}
408
417
418
+
if (len > 32768) {
419
+
err = -E2BIG;
420
+
goto error;
421
+
}
422
+
409
423
/* Make up a UDP datagram and hand it off to some higher intellect. */
410
424
411
425
memset(&udpdest, 0, sizeof(udpdest));
···
442
446
443
447
/* tack our header on the front of the iovec */
444
448
size = sizeof(struct aunhdr);
445
-
/*
446
-
* XXX: that is b0rken. We can't mix userland and kernel pointers
447
-
* in iovec, since on a lot of platforms copy_from_user() will
448
-
* *not* work with the kernel and userland ones at the same time,
449
-
* regardless of what we do with set_fs(). And we are talking about
450
-
* econet-over-ethernet here, so "it's only ARM anyway" doesn't
451
-
* apply. Any suggestions on fixing that code? -- AV
452
-
*/
453
449
iov[0].iov_base = (void *)&ah;
454
450
iov[0].iov_len = size;
455
-
for (i = 0; i < msg->msg_iovlen; i++) {
456
-
void __user *base = msg->msg_iov[i].iov_base;
457
-
size_t iov_len = msg->msg_iov[i].iov_len;
458
-
/* Check it now since we switch to KERNEL_DS later. */
459
-
if (!access_ok(VERIFY_READ, base, iov_len)) {
460
-
mutex_unlock(&econet_mutex);
461
-
return -EFAULT;
462
-
}
463
-
iov[i+1].iov_base = base;
464
-
iov[i+1].iov_len = iov_len;
465
-
size += iov_len;
451
+
452
+
userbuf = vmalloc(len);
453
+
if (userbuf == NULL) {
454
+
err = -ENOMEM;
455
+
goto error;
466
456
}
457
+
458
+
iov[1].iov_base = userbuf;
459
+
iov[1].iov_len = len;
460
+
err = memcpy_fromiovec(userbuf, msg->msg_iov, len);
461
+
if (err)
462
+
goto error_free_buf;
467
463
468
464
/* Get a skbuff (no data, just holds our cb information) */
469
465
if ((skb = sock_alloc_send_skb(sk, 0,
470
466
msg->msg_flags & MSG_DONTWAIT,
471
-
&err)) == NULL) {
472
-
mutex_unlock(&econet_mutex);
473
-
return err;
474
-
}
467
+
&err)) == NULL)
468
+
goto error_free_buf;
475
469
476
470
eb = (struct ec_cb *)&skb->cb;
477
471
···
477
491
udpmsg.msg_name = (void *)&udpdest;
478
492
udpmsg.msg_namelen = sizeof(udpdest);
479
493
udpmsg.msg_iov = &iov[0];
480
-
udpmsg.msg_iovlen = msg->msg_iovlen + 1;
494
+
udpmsg.msg_iovlen = 2;
481
495
udpmsg.msg_control = NULL;
482
496
udpmsg.msg_controllen = 0;
483
497
udpmsg.msg_flags=0;
···
485
499
oldfs = get_fs(); set_fs(KERNEL_DS); /* More privs :-) */
486
500
err = sock_sendmsg(udpsock, &udpmsg, size);
487
501
set_fs(oldfs);
502
+
503
+
error_free_buf:
504
+
vfree(userbuf);
488
505
#else
489
506
err = -EPROTOTYPE;
490
507
#endif
508
+
error:
491
509
mutex_unlock(&econet_mutex);
492
510
493
511
return err;
···
661
671
err = 0;
662
672
switch (cmd) {
663
673
case SIOCSIFADDR:
674
+
if (!capable(CAP_NET_ADMIN))
675
+
return -EPERM;
676
+
664
677
edev = dev->ec_ptr;
665
678
if (edev == NULL) {
666
679
/* Magic up a new one. */
+1
-2
net/ipv4/inet_hashtables.c
+1
-2
net/ipv4/inet_hashtables.c
+5
-1
net/ipv4/sysctl_net_ipv4.c
+5
-1
net/ipv4/sysctl_net_ipv4.c
···
26
26
static int tcp_retr1_max = 255;
27
27
static int ip_local_port_range_min[] = { 1, 1 };
28
28
static int ip_local_port_range_max[] = { 65535, 65535 };
29
+
static int tcp_adv_win_scale_min = -31;
30
+
static int tcp_adv_win_scale_max = 31;
29
31
30
32
/* Update system visible IP port range */
31
33
static void set_local_port_range(int range[2])
···
428
426
.data = &sysctl_tcp_adv_win_scale,
429
427
.maxlen = sizeof(int),
430
428
.mode = 0644,
431
-
.proc_handler = proc_dointvec
429
+
.proc_handler = proc_dointvec_minmax,
430
+
.extra1 = &tcp_adv_win_scale_min,
431
+
.extra2 = &tcp_adv_win_scale_max,
432
432
},
433
433
{
434
434
.procname = "tcp_tw_reuse",
+1
-1
net/ipv4/tcp.c
+1
-1
net/ipv4/tcp.c
···
2246
2246
/* Values greater than interface MTU won't take effect. However
2247
2247
* at the point when this call is done we typically don't yet
2248
2248
* know which interface is going to be used */
2249
-
if (val < 64 || val > MAX_TCP_WINDOW) {
2249
+
if (val < TCP_MIN_MSS || val > MAX_TCP_WINDOW) {
2250
2250
err = -EINVAL;
2251
2251
break;
2252
2252
}
+3
-1
net/ipv4/tcp_ipv4.c
+3
-1
net/ipv4/tcp_ipv4.c
+32
-5
net/unix/af_unix.c
+32
-5
net/unix/af_unix.c
···
1343
1343
sock_wfree(skb);
1344
1344
}
1345
1345
1346
+
#define MAX_RECURSION_LEVEL 4
1347
+
1346
1348
static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
1347
1349
{
1348
1350
int i;
1351
+
unsigned char max_level = 0;
1352
+
int unix_sock_count = 0;
1353
+
1354
+
for (i = scm->fp->count - 1; i >= 0; i--) {
1355
+
struct sock *sk = unix_get_socket(scm->fp->fp[i]);
1356
+
1357
+
if (sk) {
1358
+
unix_sock_count++;
1359
+
max_level = max(max_level,
1360
+
unix_sk(sk)->recursion_level);
1361
+
}
1362
+
}
1363
+
if (unlikely(max_level > MAX_RECURSION_LEVEL))
1364
+
return -ETOOMANYREFS;
1349
1365
1350
1366
/*
1351
1367
* Need to duplicate file references for the sake of garbage
···
1372
1356
if (!UNIXCB(skb).fp)
1373
1357
return -ENOMEM;
1374
1358
1375
-
for (i = scm->fp->count-1; i >= 0; i--)
1376
-
unix_inflight(scm->fp->fp[i]);
1377
-
return 0;
1359
+
if (unix_sock_count) {
1360
+
for (i = scm->fp->count - 1; i >= 0; i--)
1361
+
unix_inflight(scm->fp->fp[i]);
1362
+
}
1363
+
return max_level;
1378
1364
}
1379
1365
1380
1366
static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
···
1411
1393
struct sk_buff *skb;
1412
1394
long timeo;
1413
1395
struct scm_cookie tmp_scm;
1396
+
int max_level;
1414
1397
1415
1398
if (NULL == siocb->scm)
1416
1399
siocb->scm = &tmp_scm;
···
1450
1431
goto out;
1451
1432
1452
1433
err = unix_scm_to_skb(siocb->scm, skb, true);
1453
-
if (err)
1434
+
if (err < 0)
1454
1435
goto out_free;
1436
+
max_level = err + 1;
1455
1437
unix_get_secdata(siocb->scm, skb);
1456
1438
1457
1439
skb_reset_transport_header(skb);
···
1534
1514
if (sock_flag(other, SOCK_RCVTSTAMP))
1535
1515
__net_timestamp(skb);
1536
1516
skb_queue_tail(&other->sk_receive_queue, skb);
1517
+
if (max_level > unix_sk(other)->recursion_level)
1518
+
unix_sk(other)->recursion_level = max_level;
1537
1519
unix_state_unlock(other);
1538
1520
other->sk_data_ready(other, len);
1539
1521
sock_put(other);
···
1566
1544
int sent = 0;
1567
1545
struct scm_cookie tmp_scm;
1568
1546
bool fds_sent = false;
1547
+
int max_level;
1569
1548
1570
1549
if (NULL == siocb->scm)
1571
1550
siocb->scm = &tmp_scm;
···
1630
1607
1631
1608
/* Only send the fds in the first buffer */
1632
1609
err = unix_scm_to_skb(siocb->scm, skb, !fds_sent);
1633
-
if (err) {
1610
+
if (err < 0) {
1634
1611
kfree_skb(skb);
1635
1612
goto out_err;
1636
1613
}
1614
+
max_level = err + 1;
1637
1615
fds_sent = true;
1638
1616
1639
1617
err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
···
1650
1626
goto pipe_err_free;
1651
1627
1652
1628
skb_queue_tail(&other->sk_receive_queue, skb);
1629
+
if (max_level > unix_sk(other)->recursion_level)
1630
+
unix_sk(other)->recursion_level = max_level;
1653
1631
unix_state_unlock(other);
1654
1632
other->sk_data_ready(other, size);
1655
1633
sent += size;
···
1871
1845
unix_state_lock(sk);
1872
1846
skb = skb_dequeue(&sk->sk_receive_queue);
1873
1847
if (skb == NULL) {
1848
+
unix_sk(sk)->recursion_level = 0;
1874
1849
if (copied >= target)
1875
1850
goto unlock;
1876
1851
+8
-1
net/unix/garbage.c
+8
-1
net/unix/garbage.c
···
96
96
unsigned int unix_tot_inflight;
97
97
98
98
99
-
static struct sock *unix_get_socket(struct file *filp)
99
+
struct sock *unix_get_socket(struct file *filp)
100
100
{
101
101
struct sock *u_sock = NULL;
102
102
struct inode *inode = filp->f_path.dentry->d_inode;
···
259
259
}
260
260
261
261
static bool gc_in_progress = false;
262
+
#define UNIX_INFLIGHT_TRIGGER_GC 16000
262
263
263
264
void wait_for_unix_gc(void)
264
265
{
266
+
/*
267
+
* If number of inflight sockets is insane,
268
+
* force a garbage collect right now.
269
+
*/
270
+
if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
271
+
unix_gc();
265
272
wait_event(unix_gc_wait, gc_in_progress == false);
266
273
}
267
274