The skb_morph function only freed the data part of the dst skb, but leaked
the auxiliary data such as the netfilter fields. This patch fixes this by
moving the relevant parts from __kfree_skb to skb_release_all and calling
it in skb_morph.
It also makes kfree_skbmem static since it's no longer called anywhere else
and it now no longer does skb_release_data.
Thanks to Yasuyuki KOZAKAI for finding this problem and posting a patch for
it.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
The inet_ehash_locks_alloc() looks like this:
#ifdef CONFIG_NUMA
if (size > PAGE_SIZE)
x = vmalloc(...);
else
#endif
x = kmalloc(...);
Unlike it, the inet_ehash_locks_alloc() looks like this:
#ifdef CONFIG_NUMA
if (size > PAGE_SIZE)
vfree(x);
else
#else
kfree(x);
#endif
The error is obvious - if the NUMA is on and the size
is less than the PAGE_SIZE we leak the pointer (kfree is
inside the #else branch).
Compiler doesn't warn us because after the kfree(x) there's
a "x = NULL" assignment, so here's another (minor?) bug: we
don't set x to NULL under certain circumstances.
Boring explanation, I know... Patch explains it better.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
The change 050f009e16
[IPSEC]: Lock state when copying non-atomic fields to user-space
caused a regression.
Ingo Molnar reports that it causes a potential dead-lock found by the
lock validator as it tries to take x->lock within xfrm_state_lock while
numerous other sites take the locks in opposite order.
For 2.6.24, the best fix is to simply remove the added locks as that puts
us back in the same state as we've been in for years. For later kernels
a proper fix would be to reverse the locking order for every xfrm state
user such that if x->lock is taken together with xfrm_state_lock then
it is to be taken within it.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
While adding sg chaining support to iSER, a "for" loop was replaced
with a "for_each_sg" loop. The "for" loop included the incrementation
of 2 variables. Only one of them is incremented in the current
"for_each_sg" loop. This caused iSER to think that all data is
unaligned, and all data was copied to aligned buffers.
This patch increments the missing counter inside the "for_each_sg"
loop whenever necessary.
Signed-off-by: Erez Zilber <erezz@voltaire.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Wrong choice of port number caused modify_qp() to fail -- fixed.
Signed-off-by: Joachim Fenkes <fenkes@de.ibm.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
If a card has no IRQ then pass no interrupt handler but allow polled
usage.
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Hopefully there is a better long term solution but for now lets favour
reliability.
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
sil24 unnecessarily used LIBATA_MAX_PRD and ATAPI sg table was short
by one entry which might cause very obscure problems. This patch
updates sg table sizing such that
* One full page is used for PRB + sg table. On 4k page,
this results in 253 sg's.
* Make ATAPI sg block properly sized.
* Make build fail if command block size doesn't equal PAGE_SIZE.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
There are two bugs in disabled port handling.
* test in PORT_PATA0 is reversed
* ->prereset should return -ENOENT for disabled ports not 0
The first bug makes the PATA channel considered disabled but the
second bug saves the day by returning 0. The net result is that cable
is always left at ATA_CBL_UNKNOWN. This results in false 80c
configuration and thus transfer errors.
This patch fixes both bugs.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Since writing to two reserved bits ain't much of a housekeeping, I think it's
time we get rid of the custom error handler in this driver. ;-)
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
As it is crypto_remove_spawn may try to unregister an instance which is
yet to be registered. This patch fixes this by checking whether the
instance has been registered before attempting to remove it.
It also removes a bogus cra_destroy check in crypto_register_instance as
1) it's outside the mutex;
2) we have a check in __crypto_register_alg already.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
It seems that newer versions of gcc have regressed in their abilities to
analyse initialisations. This patch moves the initialisations up to avoid
the warnings.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
The original code has striking complexity to perform a query
which can be reduced to a very simple compare.
FIN seqno may be included to write_seq but it should not make
any significant difference here compared to skb->len which was
used previously. One won't end up there with SYN still queued.
Use of write_seq check guarantees that there's a valid skb in
send_head so I removed the extra check.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Acked-by: John Heffner <jheffner@psc.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
It seems that the checked range for receiver window check should
begin from the first rather than from the last skb that is going
to be included to the probe. And that can be achieved without
reference to skbs at all, snd_nxt and write_seq provides the
correct seqno already. Plus, it SHOULD account packets that are
necessary to trigger fast retransmit [RFC4821].
Location of snd_wnd < probe_size/size_needed check is bogus
because it will cause the other if() match as well (due to
snd_nxt >= snd_una invariant).
Removed dead obvious comment.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This patch adds the ax88796 device driver to the r7785rp defconfig.
Signed-off-by: Magnus Damm <damm@igel.co.jp>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
This patch adds the ax88796 device driver to the r7780mp defconfig.
Signed-off-by: Magnus Damm <damm@igel.co.jp>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
This patch fixes CF support for R2D-1 boards. Both R2D-1 and
R2D-PLUS are equipped with CF IRQs, but the R2D-1 FPGA version
seem to deliver IRQ spikes with certain CF cards during libata
probing. This patch enables polling for R2D-1 as a workaround
for this broken FGPA logic.
R2D-1 CF support was recently introduced by commit:
43f4b8c757.
Signed-off-by: Magnus Damm <damm@igel.co.jp>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Your mail to 'Tlan-devel' with the subject
drivers/net/tlan question
Is being held until the list moderator can review it for approval.
The reason it is being held:
Post by non-member to a members-only list
Signed-off-by: Gabriel Craciunescu <nix.or.die@googlemail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
SPIN_LOCK_UNLOCKED is deprecated, use DEFINE_SPINLOCK instead
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
xs_setup_{udp,tcp}() can now become static.
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
From: Charles Hardin <chardin@2wire.com>
Kernel needs to respond to an SADB_GET with the same message type to
conform to the RFC 2367 Section 3.1.5
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Found this occasionally.
The CONFIG_INET=n is hardly ever set, but if it is the
irlan_eth_send_gratuitous_arp() compilation should produce a
warning about unused variable in_dev.
Too pedantic? :)
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Currently, gpio_keys.c assumes the GPIOs to be already properly configured;
this patch changes gpio-keys to perform explicit calls to gpio_request() and
gpio_configure_input().
This matches the behaviour of leds-gpio.
Signed-off-by: Herbert Valerio Riedel <hvr@gnu.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
When booting under Microsoft Virtual Machine, the noloop quirk is
needed, otherwise PS/2 mouse is not properly detected.
Reported-by: Lawrence Steeger <vendor@russte.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
We know exactly what IRQ we are using, so synchronize_irq()
suits much better. Plus synchronize_sched() will not work
for us in -rt kernels.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Acked-by: Mattia Dongili <malattia@linux.it>
Properly set up parent on input devices registered by sonypi.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Acked-by: Mattia Dongili <malattia@linux.it>
Properly set up parent on input devices registered by sony-laptop.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Acked-by: Mattia Dongili <malattia@linux.it>
Move the code which marks the minor number as free to mmc_blk_put() so
that it happens on the final close() (or removal), instead of doing it
at removal even when the device is still logically open.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
It is possible to handle arbitrary block sizes with tifm card reader by
conditionally switching to PIO in case such block has to be delivered. At
the beginning of each request, DMA is either disabled (non-power-of-2 block
size) or set to load time user preference.
Signed-off-by: Alex Dubov <oakad@yahoo.com>
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
Some cards have been reported to signal that they're ready prematurely.
Checking both the busy bit and card state solves the issue.
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
We need to send signals with the proper PC, or gdb gets
confused, and lots of tests fail. This should fix that.
Signed-off-by: Robin Getz <robin.getz@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>
Should not need separate cplb entry though as we cover L1 with a 4 meg page
Signed-off-by: Mike Frysinger <michael.frysinger@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>
- remove duplicated defines for the BF561
- generalize L2 support (so that it works for BF54x) and mark it executable
- add support for reading/executing the Boot ROM sections
(since it has data/functions we may need at runtime)
- and fixup names for each map
Signed-off-by: Mike Frysinger <michael.frysinger@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>
- no need to declare their sizes in the common header
- no need to tack on the section attribute as only the definition matters, not references
Signed-off-by: Mike Frysinger <michael.frysinger@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>
