summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2011-06-06possible memory corruption in cifs_parse_mount_options()Vasily Averin
error path after mountdata check frees uninitialized mountdata_copy Signed-off-by: Vasily Averin <vvs@sw.ru> Signed-off-by: Steve French <sfrench@us.ibm.com>
2011-06-06x86/amd-iommu: Fix 3 possible endless loopsJoerg Roedel
The driver contains several loops counting on an u16 value where the exit-condition is checked against variables that can have values up to 0xffff. In this case the loops will never exit. This patch fixed 3 such loops. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2011-06-06ext4: fixed tracepoints cleanupLukas Czerner
While creating fixed tracepoints for ext3, basically by porting them from ext4, I found a lot of useless retyping, wrong type usage, useless variable passing and other inconsistencies in the ext4 fixed tracepoint code. This patch cleans the fixed tracepoint code for ext4 and also simplify some of them. Signed-off-by: Lukas Czerner <lczerner@redhat.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
2011-06-06[S390] fix kvm defines for 31 bit compileMartin Schwidefsky
KVM is not available for 31 bit but the KVM defines cause warnings: arch/s390/include/asm/pgtable.h: In function 'ptep_test_and_clear_user_dirty': arch/s390/include/asm/pgtable.h:817: warning: integer constant is too large for 'unsigned long' type arch/s390/include/asm/pgtable.h:818: warning: integer constant is too large for 'unsigned long' type arch/s390/include/asm/pgtable.h: In function 'ptep_test_and_clear_user_young': arch/s390/include/asm/pgtable.h:837: warning: integer constant is too large for 'unsigned long' type arch/s390/include/asm/pgtable.h:838: warning: integer constant is too large for 'unsigned long' type Add 31 bit versions of the KVM defines to remove the warnings. Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2011-06-06[S390] use generic RCU page-table freeing codeMartin Schwidefsky
Replace the s390 specific rcu page-table freeing code with the generic variant. This requires to duplicate the definition for the struct mmu_table_batch as s390 does not use the generic tlb flush code. While we are at it remove the restriction that page table fragments can not be reused after a single fragment has been freed with rcu and split out allocation and freeing of page tables with pgstes. Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2011-06-06[S390] qdio: Split SBAL entry flagsJan Glauber
The qdio SBAL entry flag is made-up of four different values that are independent of one another. Some of the bits are reserved by the hardware and should not be changed by qdio. Currently all four values are overwritten since the SBAL entry flag is defined as an u32. Split the SBAL entry flag into four u8's as defined by the hardware and don't touch the reserved bits. Signed-off-by: Jan Glauber <jang@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2011-06-06[S390] kvm-s390: fix stfle facilities numbers >=64Christian Borntraeger
Currently KVM masks out the known good facilities only for the first double word, but passed the 2nd double word without filtering. This breaks some code on newer systems: [ 0.593966] ------------[ cut here ]------------ [ 0.594086] WARNING: at arch/s390/oprofile/hwsampler.c:696 [ 0.594213] Modules linked in: [ 0.594321] Modules linked in: [ 0.594439] CPU: 0 Not tainted 3.0.0-rc1 #46 [ 0.594564] Process swapper (pid: 1, task: 00000001effa8038, ksp: 00000001effafab8) [ 0.594735] Krnl PSW : 0704100180000000 00000000004ab89a (hwsampler_setup+0x75a/0x7b8) [ 0.594910] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:1 PM:0 EA:3 [ 0.595120] Krnl GPRS: ffffffff00000000 00000000ffffffea ffffffffffffffea 00000000004a98f8 [ 0.595351] 00000000004aa002 0000000000000001 000000000080e720 000000000088b9f8 [ 0.595522] 000000000080d3e8 0000000000000000 0000000000000000 000000000080e464 [ 0.595725] 0000000000000000 00000000005db198 00000000004ab3a2 00000001effafd98 [ 0.595901] Krnl Code: 00000000004ab88c: c0e5000673ca brasl %r14,57a020 [ 0.596071] 00000000004ab892: a7f4fc77 brc 15,4ab180 [ 0.596276] 00000000004ab896: a7f40001 brc 15,4ab898 [ 0.596454] >00000000004ab89a: a7c8ffa1 lhi %r12,-95 [ 0.596657] 00000000004ab89e: a7f4fc71 brc 15,4ab180 [ 0.596854] 00000000004ab8a2: a7f40001 brc 15,4ab8a4 [ 0.597029] 00000000004ab8a6: a7f4ff22 brc 15,4ab6ea [ 0.597230] 00000000004ab8aa: c0200011009a larl %r2,6cb9de [ 0.597441] Call Trace: [ 0.597511] ([<00000000004ab3a2>] hwsampler_setup+0x262/0x7b8) [ 0.597676] [<0000000000875812>] oprofile_arch_init+0x32/0xd0 [ 0.597834] [<0000000000875788>] oprofile_init+0x28/0x74 [ 0.597991] [<00000000001001be>] do_one_initcall+0x3a/0x170 [ 0.598151] [<000000000084fa22>] kernel_init+0x142/0x1ec [ 0.598314] [<000000000057db16>] kernel_thread_starter+0x6/0xc [ 0.598468] [<000000000057db10>] kernel_thread_starter+0x0/0xc [ 0.598606] Last Breaking-Event-Address: [ 0.598707] [<00000000004ab896>] hwsampler_setup+0x756/0x7b8 [ 0.598863] ---[ end trace ce3179037f4e3e5b ]--- So lets also mask the 2nd double word. Facilites 66,76,76,77 should be fine. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2011-06-06[S390] kvm-s390: Fix host crash on misbehaving guestsChristian Borntraeger
commit 9ff4cfb3fcfd48b49fdd9be7381b3be340853aa4 ([S390] kvm-390: Let kernel exit SIE instruction on work) fixed a problem of commit commit cd3b70f5d4d82f85d1e1d6e822f38ae098cf7c72 ([S390] virtualization aware cpu measurement) but uncovered another one. If a kvm guest accesses guest real memory that doesnt exist, the page fault handler calls the sie hook, which then rewrites the return psw from sie_inst to either sie_exit or sie_reenter. On return, the page fault handler will then detect the wrong access as a kernel fault causing a kernel oops in sie_reenter or sie_exit. We have to add these two addresses to the exception table to allow graceful exits. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2011-06-06ASoC: Add missing break in WM8915 FLL source selectionMark Brown
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@ti.com>
2011-06-06ASoC: Only update SYSCLK_ENA when pausing WM8915 SYSCLKMark Brown
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@ti.com>
2011-06-06ARM: 6894/1: mmci: trigger card detect IRQs on falling and rising edgesLinus Walleij
Right now the card detect IRQ for MMCI is requested without any flags which will give some default machine-specified IRQ behaviour. However on the U300 rising+falling edges (such as can be expected from a simple GPIO to generate when inserting/removing a card) need to be requested explicitly. Cc: Rabin Vincent <rabin.vincent@stericsson.com> Cc: Ulf Hansson <ulf.hansson@stericsson.com> Cc: Sebastian Rasmussen <sebastian.rasmussen@stericsson.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-06ARM: 6952/1: fix lockdep warning of "unannotated irqs-off"Ming Lei
This patch fixes the lockdep warning of "unannotated irqs-off"[1]. After entering __irq_usr, arm core will disable interrupt automatically, but __irq_usr does not annotate the irq disable, so lockdep may complain the warning if it has chance to check this in irq handler. This patch adds trace_hardirqs_off in __irq_usr before entering irq_handler to handle the irq, also calls ret_to_user_from_irq to avoid calling disable_irq again. This is also a fix for irq off tracer. [1], lockdep warning log of "unannotated irqs-off" [ 13.804687] ------------[ cut here ]------------ [ 13.809570] WARNING: at kernel/lockdep.c:3335 check_flags+0x78/0x1d0() [ 13.816467] Modules linked in: [ 13.819732] Backtrace: [ 13.822357] [<c01cb42c>] (dump_backtrace+0x0/0x100) from [<c06abb14>] (dump_stack+0x20/0x24) [ 13.831268] r6:c07d8c2c r5:00000d07 r4:00000000 r3:00000000 [ 13.837280] [<c06abaf4>] (dump_stack+0x0/0x24) from [<c01ffc04>] (warn_slowpath_common+0x5c/0x74) [ 13.846649] [<c01ffba8>] (warn_slowpath_common+0x0/0x74) from [<c01ffc48>] (warn_slowpath_null+0x2c/0x34) [ 13.856781] r8:00000000 r7:00000000 r6:c18b8194 r5:60000093 r4:ef182000 [ 13.863708] r3:00000009 [ 13.866485] [<c01ffc1c>] (warn_slowpath_null+0x0/0x34) from [<c0237d84>] (check_flags+0x78/0x1d0) [ 13.875823] [<c0237d0c>] (check_flags+0x0/0x1d0) from [<c023afc8>] (lock_acquire+0x4c/0x150) [ 13.884704] [<c023af7c>] (lock_acquire+0x0/0x150) from [<c06af638>] (_raw_spin_lock+0x4c/0x84) [ 13.893798] [<c06af5ec>] (_raw_spin_lock+0x0/0x84) from [<c01f9a44>] (sched_ttwu_pending+0x58/0x8c) [ 13.903320] r6:ef92d040 r5:00000003 r4:c18b8180 [ 13.908233] [<c01f99ec>] (sched_ttwu_pending+0x0/0x8c) from [<c01f9a90>] (scheduler_ipi+0x18/0x1c) [ 13.917663] r6:ef183fb0 r5:00000003 r4:00000000 r3:00000001 [ 13.923645] [<c01f9a78>] (scheduler_ipi+0x0/0x1c) from [<c01bc458>] (do_IPI+0x9c/0xfc) [ 13.932006] [<c01bc3bc>] (do_IPI+0x0/0xfc) from [<c06b0888>] (__irq_usr+0x48/0xe0) [ 13.939971] Exception stack(0xef183fb0 to 0xef183ff8) [ 13.945281] 3fa0: ffffffc3 0001500c 00000001 0001500c [ 13.953948] 3fc0: 00000050 400b45f0 400d9000 00000000 00000001 400d9600 6474e552 bea05b3c [ 13.962585] 3fe0: 400d96c0 bea059c0 400b6574 400b65d8 20000010 ffffffff [ 13.969573] r6:00000403 r5:fa240100 r4:ffffffff r3:20000010 [ 13.975585] ---[ end trace efc4896ab0fb62cb ]--- [ 13.980468] possible reason: unannotated irqs-off. [ 13.985534] irq event stamp: 1610 [ 13.989044] hardirqs last enabled at (1610): [<c01c703c>] no_work_pending+0x8/0x2c [ 13.997131] hardirqs last disabled at (1609): [<c01c7024>] ret_slow_syscall+0xc/0x1c [ 14.005371] softirqs last enabled at (0): [<c01fe5e4>] copy_process+0x2cc/0xa24 [ 14.013183] softirqs last disabled at (0): [< (null)>] (null) Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-06ARM: 6951/1: include .bss in memory layout informationRabin Vincent
The "Virtual memory kernel layout" message at startup already prints .text and .data. Print .bss too. Signed-off-by: Rabin Vincent <rabin@rab.in> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-06ARM: 6948/1: Fix .size directives for __arm{7,9}tdmi_proc_infoBen Hutchings
gas used to accept (and ignore?) .size directives which referred to undefined symbols, as these do. In binutils 2.21 these are treated as fatal errors. The issue in proc-arm7tdmi.S was also fixed independently by Peter Chubb. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-06ARM: 6947/2: mach-u300: fix compilation error in timerLinus Walleij
The introduction of the mmio timer accidentally referenced the old clocksource struct which does not exist anymore. Fix this by using a simple string instead. Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-06ARM: 6946/1: vexpress: move v2m clock init to init_earlyRob Herring
Commit 7ff550de99141cbd3be0129d563cc4554fdde9f6 breaks vexpress booting. The v2m clock table needs to be setup in init_early before the timer initialization occurs. Signed-off-by: Rob Herring <rob.herring@calxeda.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-06Merge branch 'for-3.0' of ↵Mark Brown
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound-2.6 into for-3.0
2011-06-06video: Fix use-after-free by vga16fb on rmmodBruno Prémont
Since fb_info is now refcounted and thus may get freed at any time it gets unregistered module unloading will try to unregister framebuffer as stored in platform data on probe though this pointer may be stale. Cleanup platform data on framebuffer release. CC: stable@kernel.org Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org> Signed-off-by: Paul Mundt <lethal@linux-sh.org>
2011-06-06Linux 3.0-rc2v3.0-rc2Linus Torvalds
2011-06-06mm: fix ENOSPC returned by handle_mm_fault()Hugh Dickins
Al Viro observes that in the hugetlb case, handle_mm_fault() may return a value of the kind ENOSPC when its caller is expecting a value of the kind VM_FAULT_SIGBUS: fix alloc_huge_page()'s failure returns. Signed-off-by: Hugh Dickins <hughd@google.com> Acked-by: Al Viro <viro@zeniv.linux.org.uk> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-06-06sh: Remove compressed kernel libgcc dependency.Paul Mundt
SH-2A is unable to combine the kernel and libgcc objects due to fundamental disagreements over FDPIC settings. As the kernel already contains all of the libgcc bits broken out, there's not much need to bother with the linking anymore, as everything can already be derived from the lib dir. This simply plugs in the necessary bits to ensure that everything is built uniformly, enabling us to wean the compressed build off of explicit libgcc linking. Reported-by: Phil Edworthy <phil.edworthy@renesas.com> Signed-off-by: Paul Mundt <lethal@linux-sh.org>
2011-06-06Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: usb - turn off de-emphasis in s/pdif for cm6206 ALSA: asihpi: Use angle brackets for system includes ALSA: fm801: add error handling if auto-detect fails ALSA: hda - Check pin support EAPD in ad198x_power_eapd_write ALSA: hda - Fix HP and Front pins of ad1988/ad1989 in ad198x_power_eapd() ALSA: 6fire: Don't leak firmware in error path ASoC: Fix wm_hubs input PGA ZC bits ASoC: Fix dapm_is_shared_kcontrol so everything isn't shared
2011-06-06Merge branch 'hwmon-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: hwmon: (max6642): Better chip detection schema hwmon: (coretemp) Further relax temperature range checks hwmon: (coretemp) Fix TjMax detection for older CPUs hwmon: (coretemp) Relax target temperature range check hwmon: (max6642) Rename temp_fault sysfs attribute to temp2_fault
2011-06-06KVM: Initialize kvm before registering the mmu notifierMike Waychison
It doesn't make sense to ever see a half-initialized kvm structure on mmu notifier callbacks. Previously, 85722cda changed the ordering to ensure that the mmu_lock was initialized before mmu notifier registration, but there is still a race where the mmu notifier could come in and try accessing other portions of struct kvm before they are intialized. Solve this by moving the mmu notifier registration to occur after the structure is completely initialized. Google-Bug-Id: 452199 Signed-off-by: Mike Waychison <mikew@google.com> Signed-off-by: Avi Kivity <avi@redhat.com>
2011-06-06KVM: x86: use proper port value when checking io instruction permissionMarcelo Tosatti
Commit f6511935f42 moved the permission check for io instructions to the ->check_perm callback. It failed to copy the port value from RDX register for string and "in,out ax,dx" instructions. Fix it by reading RDX register at decode stage when appropriate. Fixes FC8.32 installation. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2011-06-06ARM: mx51/sdma: Check the chip revision in run-timeFabio Estevam
Check the MX51 chip revision in run-time so that the correct SDMA firmware can be loaded. While at it also remove the silicon revision from the sdma_script_start_addrs structure name for MX51. All the MX51 revisions share the same SDMA start addresses. Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
2011-06-06arm: mxs: include asm/processor.h for cpu_relax()Wolfram Sang
I get this build error as of today: arch/arm/mach-mxs/ocotp.c: In function 'mxs_get_ocotp': arch/arm/mach-mxs/ocotp.c:54: error: implicit declaration of function 'cpu_relax' make[2]: *** [arch/arm/mach-mxs/ocotp.o] Error 1 Looks like it has been indirectly included before which broke now. Include it directly. Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Cc: Shawn Guo <shawn.guo@freescale.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
2011-06-06Merge branch 'fix/asoc' into for-linusTakashi Iwai
2011-06-06ext4: use FIEMAP_EXTENT_LAST flag for last extent in fiemap Lukas Czerner
Currently we are not marking the extent as the last one (FIEMAP_EXTENT_LAST) if there is a hole at the end of the file. This is because we just do not check for it right now and continue searching for next extent. But at the point we hit the hole at the end of the file, it is too late. This commit adds check for the allocated block in subsequent extent and if there is no more extents (block = EXT_MAX_BLOCKS) just flag the current one as the last one. This behaviour has been spotted unintentionally by 252 xfstest, when the test hangs out, because of wrong loop condition. However on other filesystems (like xfs) it will exit anyway, because we notice the last extent flag and exit. With this patch xfstest 252 does not hang anymore, ext4 fiemap implementation still reports bad extent type in some cases, however this seems to be different issue. Signed-off-by: Lukas Czerner <lczerner@redhat.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
2011-06-06ext4: Fix max file size and logical block counting of extent format fileLukas Czerner
Kazuya Mio reported that he was able to hit BUG_ON(next == lblock) in ext4_ext_put_gap_in_cache() while creating a sparse file in extent format and fill the tail of file up to its end. We will hit the BUG_ON when we write the last block (2^32-1) into the sparse file. The root cause of the problem lies in the fact that we specifically set s_maxbytes so that block at s_maxbytes fit into on-disk extent format, which is 32 bit long. However, we are not storing start and end block number, but rather start block number and length in blocks. It means that in order to cover extent from 0 to EXT_MAX_BLOCK we need EXT_MAX_BLOCK+1 to fit into len (because we counting block 0 as well) - and it does not. The only way to fix it without changing the meaning of the struct ext4_extent members is, as Kazuya Mio suggested, to lower s_maxbytes by one fs block so we can cover the whole extent we can get by the on-disk extent format. Also in many places EXT_MAX_BLOCK is used as length instead of maximum logical block number as the name suggests, it is all a bit messy. So this commit renames it to EXT_MAX_BLOCKS and change its usage in some places to actually be maximum number of blocks in the extent. The bug which this commit fixes can be reproduced as follows: dd if=/dev/zero of=/mnt/mp1/file bs=<blocksize> count=1 seek=$((2**32-2)) sync dd if=/dev/zero of=/mnt/mp1/file bs=<blocksize> count=1 seek=$((2**32-1)) Reported-by: Kazuya Mio <k-mio@sx.jp.nec.com> Signed-off-by: Lukas Czerner <lczerner@redhat.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
2011-06-05USB: xhci - fix interval calculation for FS isoc endpointsDmitry Torokhov
Full-speed isoc endpoints specify interval in exponent based form in frames, not microframes, so we need to adjust accordingly. NEC xHCI host controllers will return an error code of 0x11 if a full speed isochronous endpoint is added with the Interval field set to something less than 3 (2^3 = 8 microframes, or one frame). It is impossible for a full speed device to have an interval smaller than one frame. This was always an issue in the xHCI driver, but commit dfa49c4ad120a784ef1ff0717168aa79f55a483a "USB: xhci - fix math in xhci_get_endpoint_interval()" removed the clamping of the minimum value in the Interval field, which revealed this bug. This needs to be backported to stable kernels back to 2.6.31. Reported-by: Matt Evans <matt@ozlabs.org> Signed-off-by: Dmitry Torokhov <dtor@vmware.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Cc: stable@kernel.org
2011-06-06cfq-iosched: fix locking around ioc->ioc_data assignmentJens Axboe
Since we are modifying this RCU pointer, we need to hold the lock protecting it around it. This fixes a potential reuse and double free of a cfq io_context structure. The bug has been in CFQ for a long time, it hit very few people but those it did hit seemed to see it a lot. Tracked in RH bugzilla here: https://bugzilla.redhat.com/show_bug.cgi?id=577968 Credit goes to Paul Bolle for figuring out that the issue was around the one-hit ioc->ioc_data cache. Thanks to his hard work the issue is now fixed. Cc: stable@kernel.org Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-06-06sh: fix wrong icache/dcache address-array start addr in cache-debugfs.Srinivas KANDAGATLA
This patch fixes a icache/dcache address-array start address while dumping its entires in debugfs. Perviously the code was attempting to remember the address in static variable, which is no more required for debugfs, as the function can be executed in one pass. Without this patch the start address ends up in wrong place and the /sys/kernel/debug/sh/icache or dcache debugfs contents may not be correct. Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@st.com> Cc: Stuart Menefy <stuart.menefy@st.com> Signed-off-by: Paul Mundt <lethal@linux-sh.org>
2011-06-05ext4: correct comments for ext4_free_blocks()Yongqiang Yang
metadata is not parameter of ext4_free_blocks() any more. Signed-off-by: Yongqiang Yang <xiaoqiangnk@gmail.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
2011-06-05Merge branch 'pablo/nf-2.6-updates' of git://1984.lsi.us.es/net-2.6David S. Miller
2011-06-05net: fix smc91x.c device tree supportGrant Likely
Fix missing semicolon at end of smc91x.c match tabledevice driver. Also remove unnecessary #ifdef around of_match_table pointer. Signed-off-by: Grant Likely <grant.likely@secretlab.ca> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-06-06netfilter: use unsigned variables for packet lengths in ip[6]_queue.Dave Jones
Netlink message lengths can't be negative, so use unsigned variables. Signed-off-by: Dave Jones <davej@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-06netfilter: nf_conntrack: fix ct refcount leak in l4proto->error()Pablo Neira Ayuso
This patch fixes a refcount leak of ct objects that may occur if l4proto->error() assigns one conntrack object to one skbuff. In that case, we have to skip further processing in nf_conntrack_in(). With this patch, we can also fix wrong return values (-NF_ACCEPT) for special cases in ICMP[v6] that should not bump the invalid/error statistic counters. Reported-by: Zoltan Menyhart <Zoltan.Menyhart@bull.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-06netfilter: nf_nat: fix crash in nf_nat_csumJulian Anastasov
Fix crash in nf_nat_csum when mangling packets in OUTPUT hook where skb->dev is not defined, it is set later before POSTROUTING. Problem happens for CHECKSUM_NONE. We can check device from rt but using CHECKSUM_PARTIAL should be safe (skb_checksum_help). Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-06netfilter: ipset: Use the stored first cidr value instead of '1'Jozsef Kadlecsik
The stored cidr values are tried one after anoter. The boolean condition evaluated to '1' instead of the first stored cidr or the default host cidr. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-06netfilter: ipset: Fix return code for destroy when sets are in useJozsef Kadlecsik
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-06ipvs: restore support for iptables SNATJulian Anastasov
Fix the IPVS priority in LOCAL_IN hook, so that SNAT target in POSTROUTING is supported for IPVS traffic as in 2.6.36 where it worked depending on module load order. Before 2.6.37 we used priority 100 in LOCAL_IN to process remote requests. We used the same priority as iptables SNAT and if IPVS handlers are installed before SNAT handlers we supported SNAT in POSTROUTING for the IPVS traffic. If SNAT is installed before IPVS, the netfilter handlers are before IPVS and netfilter checks the NAT table twice for the IPVS requests: once in LOCAL_IN where IPS_SRC_NAT_DONE is set and second time in POSTROUTING where the SNAT rules are ignored because IPS_SRC_NAT_DONE was already set in LOCAL_IN. But in 2.6.37 we changed the IPVS priority for LOCAL_IN with the goal to be unique (101) forgetting the fact that for IPVS traffic we should not walk both LOCAL_IN and POSTROUTING nat tables. So, change the priority for processing remote IPVS requests from 101 to 99, i.e. before NAT_SRC (100) because we prefer to support SNAT in POSTROUTING instead of LOCAL_IN. It also moves the priority for IPVS replies from 99 to 98. Use constants instead of magic numbers at these places. Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-06netfilter: add more values to enum ip_conntrack_infoEric Dumazet
Following error is raised (and other similar ones) : net/ipv4/netfilter/nf_nat_standalone.c: In function ‘nf_nat_fn’: net/ipv4/netfilter/nf_nat_standalone.c:119:2: warning: case value ‘4’ not in enumerated type ‘enum ip_conntrack_info’ gcc barfs on adding two enum values and getting a not enumerated result : case IP_CT_RELATED+IP_CT_IS_REPLY: Add missing enum values Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> CC: David Miller <davem@davemloft.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-05bonding: reset queue mapping prior to transmission to physical device (v5)Neil Horman
The bonding driver is multiqueue enabled, in which each queue represents a slave to enable optional steering of output frames to given slaves against the default output policy. However, it needs to reset the skb->queue_mapping prior to queuing to the physical device or the physical slave (if it is multiqueue) could wind up transmitting on an unintended tx queue Change Notes: v2) Based on first pass review, updated the patch to restore the origional queue mapping that was found in bond_select_queue, rather than simply resetting to zero. This preserves the value of queue_mapping when it was set on receive in the forwarding case which is desireable. v3) Fixed spelling an casting error in skb->cb v4) fixed to store raw queue_mapping to avoid double decrement v5) Eric D requested that ->cb access be wrapped in a macro. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> CC: Jay Vosburgh <fubar@us.ibm.com> CC: Andy Gospodarek <andy@greyhouse.net> CC: "David S. Miller" <davem@davemloft.net> Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-06-05qlcnic: Avoid double free of skb in tx pathSucheta Chakraborty
buffer->skb should be marked NULL to avoid double free of the skb. Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: Anirban Chakraborty <anirban.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-06-05qlcnic: Fix bug in FW queue dumpAnirban Chakraborty
Due to a change in FW template, a bug was introduced in dump queue entries. This is fixed by reinitializing queue address before looping for each que dump operation. Signed-off-by: Anirban Chakraborty <anirban.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-06-05fix return values of l2tp_dfs_seq_open()Al Viro
More fallout from struct net lifetime rules review: PTR_ERR() is *already* negative and failing ->open() should return negatives on failure. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-06-05get_net_ns_by_fd() oopses if proc_ns_fget() returns an errorAl Viro
BTW, looking through the code related to struct net lifetime rules has caught something else: struct net *get_net_ns_by_fd(int fd) { ... file = proc_ns_fget(fd); if (!file) goto out; ei = PROC_I(file->f_dentry->d_inode); while in proc_ns_fget() we have two return ERR_PTR(...) and not a single path that would return NULL. The other caller of proc_ns_fget() treats ERR_PTR() correctly... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-06-05drm/radeon/kms/atom: fix PHY initAlex Deucher
The PHY was not initialized correctly after ac89af1e1010640db072416c786f97391b85790f since the function bailed early as an encoder was not assigned. The encoder isn't necessary for PHY init so just assign to 0 for init so that the table is executed. Reported-by: Ari Savolainen <ari.m.savolainen@gmail.com> Tested-by: Ari Savolainen <ari.m.savolainen@gmail.com> Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-05Merge branch 'for-linus' of git://android.git.kernel.org/kernel/tegraLinus Torvalds
* 'for-linus' of git://android.git.kernel.org/kernel/tegra: ARM: Tegra: Harmony: Fix conflicting GPIO numbering