* Re: [Security] [SECURITY] DECnet: need to validate user data and access data?
From: Steven Whitehouse @ 2011-03-22 9:13 UTC (permalink / raw)
To: Eugene Teo; +Cc: Dan Rosenberg, davem, netdev, security, linux-decnet-user
In-Reply-To: <AANLkTinbj295sZvXrQm6uhH9+DbAbY1AZU7Eo5_dC6HP@mail.gmail.com>
Hi,
On Tue, 2011-03-22 at 15:42 +0800, Eugene Teo wrote:
> Cc'ed the decnet list. Looks like it's still active even though the
> status is orphan.
>
Well, kind of active :-) I don't think there is a lot of development
going on despite davem's recent changes to the routing code.
These functions are used in relation to conninit messages which, on the
incoming side are checked in dn_nsp_in.c:dn_find_listener() via the
calls to dn_check_idf() so that we should never queue an incorrectly
formatted message to the socket. The intent was that all messages should
be checked as early as possible on entry to the code so that we can then
rely on their content later on without needing to check again.
I hope that answers your question, but let me know if you need anything
else,
Steve.
> On Tue, Mar 22, 2011 at 7:41 AM, Dan Rosenberg <drosenberg@vsecurity.com> wrote:
> > In net/decnet/af_decnet.c, in the dn_access_copy() and dn_user_copy()
> > functions, which are called from dn_connect(), length values are
> > retrieved from incoming skb data and used as size values to copy
> > functions:
> >
> > static void dn_access_copy(struct sk_buff *skb, struct accessdata_dn *acc)
> > {
> > unsigned char *ptr = skb->data;
> >
> > acc->acc_userl = *ptr++;
> > memcpy(&acc->acc_user, ptr, acc->acc_userl);
> > ptr += acc->acc_userl;
> >
> > acc->acc_passl = *ptr++;
> > memcpy(&acc->acc_pass, ptr, acc->acc_passl);
> > ptr += acc->acc_passl;
> >
> > acc->acc_accl = *ptr++;
> > memcpy(&acc->acc_acc, ptr, acc->acc_accl);
> >
> > skb_pull(skb, acc->acc_accl + acc->acc_passl + acc->acc_userl + 3);
> >
> > }
> >
> > static void dn_user_copy(struct sk_buff *skb, struct optdata_dn *opt)
> > {
> > unsigned char *ptr = skb->data;
> > u16 len = *ptr++; /* yes, it's 8bit on the wire */
> >
> > BUG_ON(len > 16); /* we've checked the contents earlier */
> > opt->opt_optl = cpu_to_le16(len);
> > opt->opt_status = 0;
> > memcpy(opt->opt_data, ptr, len);
> > skb_pull(skb, len + 1);
> > }
> >
> >
> > Despite the BUG_ON and comment suggesting these lengths have been
> > validated, I don't think this is actually the case - it looks like these
> > fields are validated for outbound data, but I see no validation for
> > inbound data (unless I'm mistaken, which is entirely possible). If this
> > is the case, this can allow remote attackers to cause controllable heap
> > corruption. I'd appreciate it if someone who knows this protocol better
> > than I do took a look at this and implemented appropriate error handling
> > if it needs it.
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [slab poison overwritten] Re: [GIT] Networking
From: Ingo Molnar @ 2011-03-22 9:07 UTC (permalink / raw)
To: Eric Dumazet
Cc: David Miller, torvalds, akpm, netdev, linux-kernel,
Peter Zijlstra, Thomas Gleixner, Arnd Bergmann, Pekka Enberg
In-Reply-To: <20110321173941.GB3892@elte.hu>
* Ingo Molnar <mingo@elte.hu> wrote:
> here's the same but with kallsyms enabled.
Sorry, wrong log - find below a kallsyms enabled one.
I'll test the patches in this thread.
Thanks,
Ingo
--------------->
calling dell_init+0x0/0xa @ 1
initcall dell_init+0x0/0xa returned -19 after 2 usecs
calling dell_wmi_init+0x0/0xd4 @ 1
dell-wmi: No known WMI GUID found
initcall dell_wmi_init+0x0/0xd4 returned -19 after 2 usecs
calling tc1100_init+0x0/0x78 @ 1
initcall tc1100_init+0x0/0x78 returned -19 after 2 usecs
calling hdaps_init+0x0/0x2d @ 1
hdaps: supported laptop not found!
hdaps: driver init failed (ret=-19)!
initcall hdaps_init+0x0/0x2d returned -19 after 2 usecs
calling fujitsu_init+0x0/0x21d @ 1
fujitsu-laptop: driver 0.6.0 successfully loaded.
initcall fujitsu_init+0x0/0x21d returned 0 after 393 usecs
calling acpi_pcc_init+0x0/0x23 @ 1
initcall acpi_pcc_init+0x0/0x23 returned 0 after 59 usecs
calling intel_menlow_module_init+0x0/0x8f @ 1
initcall intel_menlow_module_init+0x0/0x8f returned -19 after 13 usecs
calling msi_wmi_init+0x0/0x15b @ 1
This machine doesn't have MSI-hotkeys through WMI
initcall msi_wmi_init+0x0/0x15b returned -19 after 3 usecs
calling asus_acpi_init+0x0/0xdf @ 1
initcall asus_acpi_init+0x0/0xdf returned -19 after 98 usecs
calling topstar_laptop_init+0x0/0x22 @ 1
Topstar Laptop ACPI extras driver loaded
initcall topstar_laptop_init+0x0/0x22 returned 0 after 50 usecs
calling ibm_rtl_init+0x0/0x245 @ 1
initcall ibm_rtl_init+0x0/0x245 returned -19 after 2 usecs
calling flow_cache_init_global+0x0/0x112 @ 1
initcall flow_cache_init_global+0x0/0x112 returned 0 after 179 usecs
calling pg_init+0x0/0x2b0 @ 1
pktgen: Packet Generator for packet performance testing. Version: 2.74
usb usb2: rpm_suspend returns 0
usb usb1: rpm_suspend flags 0x9
usb usb1: rpm_suspend returns 0
initcall pg_init+0x0/0x2b0 returned 0 after 1543240 usecs
calling llc_init+0x0/0x1b @ 1
initcall llc_init+0x0/0x1b returned 0 after 2 usecs
calling snap_init+0x0/0x33 @ 1
initcall snap_init+0x0/0x33 returned 0 after 6 usecs
calling blackhole_module_init+0x0/0xf @ 1
initcall blackhole_module_init+0x0/0xf returned 0 after 2 usecs
calling police_init_module+0x0/0xf @ 1
initcall police_init_module+0x0/0xf returned 0 after 2 usecs
calling ipt_init_module+0x0/0xf @ 1
initcall ipt_init_module+0x0/0xf returned 0 after 1 usecs
calling skbedit_init_module+0x0/0xf @ 1
initcall skbedit_init_module+0x0/0xf returned 0 after 1 usecs
calling red_module_init+0x0/0xf @ 1
initcall red_module_init+0x0/0xf returned 0 after 1 usecs
calling gred_module_init+0x0/0xf @ 1
initcall gred_module_init+0x0/0xf returned 0 after 1 usecs
calling ingress_module_init+0x0/0xf @ 1
initcall ingress_module_init+0x0/0xf returned 0 after 1 usecs
calling dsmark_module_init+0x0/0xf @ 1
initcall dsmark_module_init+0x0/0xf returned 0 after 2 usecs
calling sfb_module_init+0x0/0xf @ 1
initcall sfb_module_init+0x0/0xf returned 0 after 1 usecs
calling sfq_module_init+0x0/0xf @ 1
initcall sfq_module_init+0x0/0xf returned 0 after 1 usecs
calling prio_module_init+0x0/0xf @ 1
initcall prio_module_init+0x0/0xf returned 0 after 1 usecs
calling multiq_module_init+0x0/0xf @ 1
initcall multiq_module_init+0x0/0xf returned 0 after 1 usecs
calling atm_init+0x0/0xf @ 1
initcall atm_init+0x0/0xf returned 0 after 1 usecs
calling netem_module_init+0x0/0x1c @ 1
netem: version 1.3
initcall netem_module_init+0x0/0x1c returned 0 after 1710 usecs
calling mqprio_module_init+0x0/0xf @ 1
initcall mqprio_module_init+0x0/0xf returned 0 after 1 usecs
calling choke_module_init+0x0/0xf @ 1
initcall choke_module_init+0x0/0xf returned 0 after 1 usecs
calling init_fw+0x0/0xf @ 1
initcall init_fw+0x0/0xf returned 0 after 1 usecs
calling init_rsvp+0x0/0xf @ 1
initcall init_rsvp+0x0/0xf returned 0 after 1 usecs
calling init_basic+0x0/0xf @ 1
initcall init_basic+0x0/0xf returned 0 after 1 usecs
calling cls_flow_init+0x0/0xf @ 1
initcall cls_flow_init+0x0/0xf returned 0 after 1 usecs
calling init_em_cmp+0x0/0xf @ 1
initcall init_em_cmp+0x0/0xf returned 0 after 1 usecs
calling init_em_meta+0x0/0xf @ 1
initcall init_em_meta+0x0/0xf returned 0 after 1 usecs
calling nfnetlink_init+0x0/0x26 @ 1
Netfilter messages via NETLINK v0.30.
initcall nfnetlink_init+0x0/0x26 returned 0 after 3335 usecs
calling nfnetlink_log_init+0x0/0xbe @ 1
initcall nfnetlink_log_init+0x0/0xbe returned 0 after 12 usecs
calling nf_conntrack_standalone_init+0x0/0xf @ 1
nf_conntrack version 0.5.0 (16004 buckets, 64016 max)
initcall nf_conntrack_standalone_init+0x0/0xf returned 0 after 5043 usecs
calling nf_conntrack_ftp_init+0x0/0x1ae @ 1
initcall nf_conntrack_ftp_init+0x0/0x1ae returned 0 after 3 usecs
calling nf_conntrack_irc_init+0x0/0x15e @ 1
initcall nf_conntrack_irc_init+0x0/0x15e returned 0 after 2 usecs
calling xt_init+0x0/0xc6 @ 1
initcall xt_init+0x0/0xc6 returned 0 after 4 usecs
calling tcpudp_mt_init+0x0/0x14 @ 1
initcall tcpudp_mt_init+0x0/0x14 returned 0 after 2 usecs
calling ip_vs_init+0x0/0xe9 @ 1
IPVS: Creating netns size=904 id=0
IPVS: __ip_vs_control_init(): alloc_percpu.
usb usb1: rpm_suspend flags 0xa
usb usb1: rpm_suspend returns 0
IPVS: cannot register namespace.
IPVS: can't setup control.
initcall ip_vs_init+0x0/0xe9 returned -12 after 27614 usecs
initcall ip_vs_init+0x0/0xe9 returned with error code -12
calling ip_vs_rr_init+0x0/0xf @ 1
IPVS: [rr] scheduler registered.
initcall ip_vs_rr_init+0x0/0xf returned 0 after 2902 usecs
calling ip_vs_wlc_init+0x0/0xf @ 1
IPVS: [wlc] scheduler registered.
initcall ip_vs_wlc_init+0x0/0xf returned 0 after 2978 usecs
calling ip_vs_lblc_init+0x0/0x33 @ 1
IPVS: [lblc] scheduler registered.
initcall ip_vs_lblc_init+0x0/0x33 returned 0 after 3080 usecs
calling ip_vs_sed_init+0x0/0xf @ 1
IPVS: [sed] scheduler registered.
initcall ip_vs_sed_init+0x0/0xf returned 0 after 2987 usecs
calling ip_vs_nq_init+0x0/0xf @ 1
IPVS: [nq] scheduler registered.
initcall ip_vs_nq_init+0x0/0xf returned 0 after 2902 usecs
calling sysctl_ipv4_init+0x0/0x71 @ 1
initcall sysctl_ipv4_init+0x0/0x71 returned 0 after 274 usecs
calling init_syncookies+0x0/0x16 @ 1
initcall init_syncookies+0x0/0x16 returned 0 after 31 usecs
calling ah4_init+0x0/0x63 @ 1
initcall ah4_init+0x0/0x63 returned 0 after 2 usecs
calling esp4_init+0x0/0x63 @ 1
initcall esp4_init+0x0/0x63 returned 0 after 1 usecs
calling tunnel4_init+0x0/0x63 @ 1
initcall tunnel4_init+0x0/0x63 returned 0 after 1 usecs
calling ipv4_netfilter_init+0x0/0x10 @ 1
initcall ipv4_netfilter_init+0x0/0x10 returned 0 after 1 usecs
calling ip_tables_init+0x0/0x8d @ 1
ip_tables: (C) 2000-2006 Netfilter Core Team
initcall ip_tables_init+0x0/0x8d returned 0 after 3935 usecs
calling iptable_mangle_init+0x0/0x40 @ 1
=============================================================================
BUG kmalloc-1024: Poison overwritten
-----------------------------------------------------------------------------
INFO: 0xbd542464-0xbd54246f. First byte 0x0 instead of 0x6b
INFO: Allocated in ops_init.constprop.5+0x4a/0xe0 age=186 cpu=1 pid=1
INFO: Freed in ops_free+0x2a/0x30 age=168 cpu=1 pid=1
INFO: Slab 0xbf818800 objects=15 used=8 fp=0xbd542180 flags=0x3d0040c1
INFO: Object 0xbd542180 @offset=8576 fp=0xbd5425b0
Bytes b4 0xbd542170: 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
Object 0xbd542180: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542190: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5421a0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5421b0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5421c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5421d0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5421e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5421f0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542200: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542210: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542220: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542230: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542240: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542250: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542260: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542270: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542280: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542290: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5422a0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5422b0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5422c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5422d0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5422e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5422f0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542300: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542310: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542320: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542330: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542340: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542350: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542360: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542370: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542380: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542390: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5423a0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5423b0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5423c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5423d0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5423e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5423f0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542400: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542410: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542420: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542430: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542440: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542450: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542460: 6b 6b 6b 6b 00 5c 26 05 e0 75 54 bd 80 14 c1 81 kkkk.\&.�uT�..�.
Object 0xbd542470: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542480: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542490: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5424a0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5424b0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5424c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5424d0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5424e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd5424f0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542500: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542510: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542520: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542530: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542540: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542550: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542560: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object 0xbd542570: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk�
Redzone 0xbd542580: bb bb bb bb ����
Padding 0xbd5425a8: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
Pid: 1, comm: swapper Not tainted 2.6.38-tip-08708-g9ad1933-dirty #109548
Call Trace:
[<8109919b>] print_trailer+0xab/0x110
[<8109932c>] check_bytes_and_report+0xdc/0x120
[<8109a04b>] check_object+0x1db/0x230
[<81098dbb>] ? check_valid_pointer+0x2b/0x60
[<818bb338>] alloc_debug_processing+0x74/0xf2
[<8102f834>] ? __call_console_drivers+0x64/0x80
[<818bb878>] __slab_alloc.constprop.18+0x1a3/0x1fd
[<81792dc1>] ? ipt_alloc_initial_table+0x31/0x1b0
[<81792dc1>] ? ipt_alloc_initial_table+0x31/0x1b0
[<8109b11a>] __kmalloc+0xca/0x100
[<81792dc1>] ipt_alloc_initial_table+0x31/0x1b0
[<81c74fa5>] iptable_mangle_net_init+0x11/0x4c
[<816f89ef>] ops_init.constprop.5+0x2f/0xe0
[<8173e5ea>] ? xt_register_match+0x4a/0x60
[<816f8ae3>] register_pernet_operations+0x43/0x80
[<816f8b8c>] register_pernet_subsys+0x1c/0x30
[<81c74fee>] iptable_mangle_init+0xe/0x40
[<81c3881e>] do_one_initcall+0x51/0x134
[<81c74fe0>] ? iptable_mangle_init+0x0/0x40
[<81c74fe0>] ? iptable_mangle_init+0x0/0x40
[<81c38a2a>] kernel_init+0x129/0x1b5
[<81c38901>] ? kernel_init+0x0/0x1b5
[<818c907e>] kernel_thread_helper+0x6/0xd
FIX kmalloc-1024: Restoring 0xbd542464-0xbd54246f=0x6b
FIX kmalloc-1024: Marking all objects used
usb usb2: rpm_suspend flags 0x9
usb usb2: rpm_suspend returns 0
initcall iptable_mangle_init+0x0/0x40 returned 0 after 674576 usecs
calling ulog_tg_init+0x0/0xe2 @ 1
initcall ulog_tg_init+0x0/0xe2 returned 0 after 9 usecs
calling cubictcp_register+0x0/0x73 @ 1
TCP cubic registered
initcall cubictcp_register+0x0/0x73 returned 0 after 1879 usecs
calling xfrm_user_init+0x0/0x41 @ 1
Initializing XFRM netlink socket
initcall xfrm_user_init+0x0/0x41 returned 0 after 2914 usecs
calling inet6_init+0x0/0x27f @ 1
NET: Registered protocol family 10
initcall inet6_init+0x0/0x27f returned 0 after 6231 usecs
calling ah6_init+0x0/0x63 @ 1
initcall ah6_init+0x0/0x63 returned 0 after 1 usecs
calling esp6_init+0x0/0x63 @ 1
initcall esp6_init+0x0/0x63 returned 0 after 2 usecs
calling ipcomp6_init+0x0/0x63 @ 1
initcall ipcomp6_init+0x0/0x63 returned 0 after 1 usecs
calling xfrm6_tunnel_init+0x0/0xc5 @ 1
initcall xfrm6_tunnel_init+0x0/0xc5 returned 0 after 141 usecs
calling tunnel6_init+0x0/0x63 @ 1
initcall tunnel6_init+0x0/0x63 returned 0 after 1 usecs
calling xfrm6_transport_init+0x0/0x14 @ 1
initcall xfrm6_transport_init+0x0/0x14 returned 0 after 2 usecs
calling xfrm6_mode_tunnel_init+0x0/0x14 @ 1
initcall xfrm6_mode_tunnel_init+0x0/0x14 returned 0 after 1 usecs
calling xfrm6_ro_init+0x0/0x14 @ 1
initcall xfrm6_ro_init+0x0/0x14 returned 0 after 1 usecs
calling mip6_init+0x0/0xb4 @ 1
Mobile IPv6
initcall mip6_init+0x0/0xb4 returned 0 after 1116 usecs
calling ip6_tables_init+0x0/0x8d @ 1
ip6_tables: (C) 2000-2006 Netfilter Core Team
initcall ip6_tables_init+0x0/0x8d returned 0 after 4010 usecs
calling nf_conntrack_l3proto_ipv6_init+0x0/0xd9 @ 1
initcall nf_conntrack_l3proto_ipv6_init+0x0/0xd9 returned 0 after 93 usecs
calling nf_defrag_init+0x0/0x4a @ 1
initcall nf_defrag_init+0x0/0x4a returned 0 after 23 usecs
calling log_tg6_init+0x0/0x24 @ 1
initcall log_tg6_init+0x0/0x24 returned 0 after 1 usecs
calling sit_init+0x0/0x52 @ 1
IPv6 over IPv4 tunneling driver
initcall sit_init+0x0/0x52 returned 0 after 3741 usecs
calling packet_init+0x0/0x39 @ 1
NET: Registered protocol family 17
initcall packet_init+0x0/0x39 returned 0 after 3078 usecs
calling ipsec_pfkey_init+0x0/0x69 @ 1
NET: Registered protocol family 15
^ permalink raw reply
* Re: [PATCH 4/4] drivers/net/fec: Don't mess with configured MAC addresses.
From: Shawn Guo @ 2011-03-22 8:55 UTC (permalink / raw)
To: Lothar Waßmann; +Cc: netdev, u.kleine-koenig
In-Reply-To: <19848.21653.877174.416543@ipc1.ka-ro>
On Tue, Mar 22, 2011 at 08:49:41AM +0100, Lothar Waßmann wrote:
> Hi,
>
> Shawn Guo writes:
> > On Mon, Mar 21, 2011 at 05:37:36PM +0100, Lothar Waßmann wrote:
> > > The FEC driver currently uses the MAC address assigned to the first
> > > interface incremented by one for the second interface.
> > >
> > > Change this to be able to configure distinct MAC addresses via
> > > platform_data.
> > >
> > > Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
> > > ---
> > > drivers/net/fec.c | 9 ++-------
> > > 1 files changed, 2 insertions(+), 7 deletions(-)
> > >
> > > diff --git a/drivers/net/fec.c b/drivers/net/fec.c
> > > index 3666524..9d89e99 100644
> > > --- a/drivers/net/fec.c
> > > +++ b/drivers/net/fec.c
> > > @@ -750,13 +750,12 @@ static void __inline__ fec_get_mac(struct net_device *ndev)
> > > /*
> > > * 2) from flash or fuse (via platform data)
> > > */
> > > + if (pdata)
> > > + memcpy(iap, pdata->mac, ETH_ALEN);
> > > if (!is_valid_ether_addr(iap)) {
> > > #ifdef CONFIG_M5272
> > > if (FEC_FLASHMAC)
> > > iap = (unsigned char *)FEC_FLASHMAC;
> > > -#else
> > > - if (pdata)
> > > - memcpy(iap, pdata->mac, ETH_ALEN);
> > > #endif
> > > }
> > >
> > > @@ -772,10 +771,6 @@ static void __inline__ fec_get_mac(struct net_device *ndev)
> > > }
> > >
> > > memcpy(ndev->dev_addr, iap, ETH_ALEN);
> > > -
> > > - /* Adjust MAC if using macaddr */
> > > - if (iap == macaddr)
> > > - ndev->dev_addr[ETH_ALEN-1] = macaddr[ETH_ALEN-1] + fep->pdev->id;
> > > }
> > >
> > > /* ------------------------------------------------------------------------- */
> > > --
> > > 1.5.6.5
> > >
> > >
> > NAK.
> >
> > The 'mac' was designed as an optional member of fec
> > platform_data, as some platforms may not be able to provide it. This
> > patch breaks the order of getting mac, and will not work on the
> > platform that does not provide an valid mac with either platform_data
> > or controller mac registers, even there may be one in the kernel
> > command line.
> >
> > The existing code takes mac address from kernel command line as the
> > first choice, and only falls through on other options when it's
> > invalid/unavailable. So an valid mac from kernel command line will
> > always get fec work anyway.
> >
> The problem is that you can only assign one mac address on the kernel
> cmdline and the second one will be derived from the first one.
> And even if the MAC address is set via platform_data it will not be
> used for the second interface.
>
Yes, these are problems. But we can fix them like the following while
still make fec0 work with fec.macaddr. This is useful on the platform
that neither platform code nor boot loader gives an valid mac address.
@@ -721,7 +721,7 @@ static void __inline__ fec_get_mac(struct net_device *ndev)
{
struct fec_enet_private *fep = netdev_priv(ndev);
struct fec_platform_data *pdata = fep->pdev->dev.platform_data;
- unsigned char *iap, tmpaddr[ETH_ALEN];
+ unsigned char iap[ETH_ALEN], tmpaddr[ETH_ALEN];
/*
* try to get mac address in following order:
@@ -729,7 +729,10 @@ static void __inline__ fec_get_mac(struct net_device *ndev)
* 1) module parameter via kernel command line in form
* fec.macaddr=0x00,0x04,0x9f,0x01,0x30,0xe0
*/
- iap = macaddr;
+ if (fep->pdev->id == 0)
+ memcpy(iap, macaddr, ETH_ALEN);
+ else
+ memset(iap, 0, ETH_ALEN);
/*
* 2) from flash or fuse (via platform data)
@@ -752,14 +755,10 @@ static void __inline__ fec_get_mac(struct net_device *ndev)
be32_to_cpu(readl(fep->hwp + FEC_ADDR_LOW));
*((unsigned short *) &tmpaddr[4]) =
be16_to_cpu(readl(fep->hwp + FEC_ADDR_HIGH) >> 16);
- iap = &tmpaddr[0];
+ memcpy(iap, tmpaddr, ETH_ALEN);
}
memcpy(ndev->dev_addr, iap, ETH_ALEN);
-
- /* Adjust MAC if using macaddr */
- if (iap == macaddr)
- ndev->dev_addr[ETH_ALEN-1] = macaddr[ETH_ALEN-1] + fep->pdev->id;
}
> IMO an ethernet driver has no business in inventing arbitrary MAC
> addresses. Either the MAC address is supplied by the boot loader or
> the platform code or it has to be assigned from userspace via
> ifconfig.
>
ifconfig will not be an option if we need to mount nfs as rootfs.
So we at lease need to have kernel command line for fec0 mac address
for the last chance, if neither platform data nor boot loader provides
mac address. And let ifconfig provide mac for fec1 from user space.
--
Regards,
Shawn
^ permalink raw reply
* Re: [PATCH v2 4/4] ipv4: optimize route adding on secondary promotion
From: David Miller @ 2011-03-22 8:07 UTC (permalink / raw)
To: ja; +Cc: netdev
In-Reply-To: <201103192213.p2JMDs0S003092@ja.ssi.bg>
From: Julian Anastasov <ja@ssi.bg>
Date: Sun, 20 Mar 2011 00:13:54 +0200
> Optimize the calling of fib_add_ifaddr for all
> secondary addresses after the promoted one to start from
> their place, not from the new place of the promoted
> secondary. It will save some CPU cycles because we
> are sure the promoted secondary was first for the subnet
> and all next secondaries do not change their place.
>
> Signed-off-by: Julian Anastasov <ja@ssi.bg>
Applied.
^ permalink raw reply
* Re: [PATCH v2 3/4] ipv4: remove the routes on secondary promotion
From: David Miller @ 2011-03-22 8:07 UTC (permalink / raw)
To: ja; +Cc: netdev
In-Reply-To: <201103192213.p2JMDq9n003083@ja.ssi.bg>
From: Julian Anastasov <ja@ssi.bg>
Date: Sun, 20 Mar 2011 00:13:52 +0200
> The secondary address promotion relies on fib_sync_down_addr
> to remove all routes created for the secondary addresses when
> the old primary address is deleted. It does not happen for cases
> when the primary address is also in another subnet. Fix that
> by deleting local and broadcast routes for all secondaries while
> they are on device list and by faking that all addresses from
> this subnet are to be deleted. It relies on fib_del_ifaddr being
> able to ignore the IPs from the concerned subnet while checking
> for duplication.
>
> Signed-off-by: Julian Anastasov <ja@ssi.bg>
Applied.
^ permalink raw reply
* Re: [PATCH v2 2/4] ipv4: fix route deletion for IPs on many subnets
From: David Miller @ 2011-03-22 8:07 UTC (permalink / raw)
To: ja; +Cc: netdev
In-Reply-To: <201103192213.p2JMDnvB003074@ja.ssi.bg>
From: Julian Anastasov <ja@ssi.bg>
Date: Sun, 20 Mar 2011 00:13:49 +0200
> Alex Sidorenko reported for problems with local
> routes left after IP addresses are deleted. It happens
> when same IPs are used in more than one subnet for the
> device.
>
> Fix fib_del_ifaddr to restrict the checks for duplicate
> local and broadcast addresses only to the IFAs that use
> our primary IFA or another primary IFA with same address.
> And we expect the prefsrc to be matched when the routes
> are deleted because it is possible they to differ only by
> prefsrc. This patch prevents local and broadcast routes
> to be leaked until their primary IP is deleted finally
> from the box.
>
> As the secondary address promotion needs to delete
> the routes for all secondaries that used the old primary IFA,
> add option to ignore these secondaries from the checks and
> to assume they are already deleted, so that we can safely
> delete the route while these IFAs are still on the device list.
>
> Reported-by: Alex Sidorenko <alexandre.sidorenko@hp.com>
> Signed-off-by: Julian Anastasov <ja@ssi.bg>
Applied.
^ permalink raw reply
* Re: [PATCH v2 1/4] ipv4: match prefsrc when deleting routes
From: David Miller @ 2011-03-22 8:07 UTC (permalink / raw)
To: ja; +Cc: netdev
In-Reply-To: <201103192213.p2JMDkuD003065@ja.ssi.bg>
From: Julian Anastasov <ja@ssi.bg>
Date: Sun, 20 Mar 2011 00:13:46 +0200
> fib_table_delete forgets to match the routes by prefsrc.
> Callers can specify known IP in fc_prefsrc and we should remove
> the exact route. This is needed for cases when same local or
> broadcast addresses are used in different subnets and the
> routes differ only in prefsrc. All callers that do not provide
> fc_prefsrc will ignore the route prefsrc as before and will
> delete the first occurence. That is how the ip route del default
> magic works.
>
> Current callers are:
>
> - ip_rt_ioctl where rtentry_to_fib_config provides fc_prefsrc only
> when the provided device name matches IP label with colon.
>
> - inet_rtm_delroute where RTA_PREFSRC is optional too
>
> - fib_magic which deals with routes when deleting addresses
> and where the fc_prefsrc is always set with the primary IP
> for the concerned IFA.
>
> Signed-off-by: Julian Anastasov <ja@ssi.bg>
Applied.
^ permalink raw reply
* Re: [PATCH 3/4] drivers/net/fec: Fix dual MAC support on i.MX28
From: David Miller @ 2011-03-22 8:07 UTC (permalink / raw)
To: LW; +Cc: shawn.guo, netdev, u.kleine-koenig
In-Reply-To: <19848.22512.18596.3017@ipc1.ka-ro>
From: Lothar Waßmann <LW@KARO-electronics.de>
Date: Tue, 22 Mar 2011 09:04:00 +0100
> Shawn Guo writes:
>> > +static int dual_mac;
>> > +module_param(dual_mac, int, S_IRUGO);
>> > +
>>
>> As you are detecting dual_mac in probe function, is this necessary?
>>
> Not really. I added this is only for debugging.
Please do not add driver-specific module parameters.
^ permalink raw reply
* Re: [PATCH 3/4] drivers/net/fec: Fix dual MAC support on i.MX28
From: Lothar Waßmann @ 2011-03-22 8:04 UTC (permalink / raw)
To: Shawn Guo; +Cc: netdev, u.kleine-koenig
In-Reply-To: <20110322072832.GD28098@S2100-06.ap.freescale.net>
Hi,
Shawn Guo writes:
> Hi Lothar,
>
> On Mon, Mar 21, 2011 at 05:37:35PM +0100, Lothar Waßmann wrote:
> > The variant of the FEC chip found on i.MX28 features two distinct
> > ethernet MACs that both share a single MII interface. When
> > deconfiguring the eth0 interface, the MII interface is currently being
> > switched off, so that the second MAC won't work any more.
> >
> I'm wondering what the use case is you intend to support with this
> patch.
>
The patch enables the use of both MACs independently from each other.
Without this patch deconfiguring eth0 would leave eth1 in an unusable
state.
> > Make sure, the first MAC is never disabled when the second FEC device
> > is registered.
> >
> > Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
> > ---
> > drivers/net/fec.c | 38 +++++++++++++++++++++++++++++++++-----
> > 1 files changed, 33 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/net/fec.c b/drivers/net/fec.c
> > index 2436db8..3666524 100644
> > --- a/drivers/net/fec.c
> > +++ b/drivers/net/fec.c
> > @@ -82,6 +82,9 @@ static unsigned char macaddr[ETH_ALEN];
> > module_param_array(macaddr, byte, NULL, 0);
> > MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address");
> >
> > +static int dual_mac;
> > +module_param(dual_mac, int, S_IRUGO);
> > +
>
> As you are detecting dual_mac in probe function, is this necessary?
>
Not really. I added this is only for debugging.
> > #if defined(CONFIG_M5272)
> > /*
> > * Some hardware gets it MAC address out of local flash memory.
> > @@ -456,6 +459,8 @@ static void
> > fec_stop(struct net_device *ndev)
> > {
> > struct fec_enet_private *fep = netdev_priv(ndev);
> > + const struct platform_device_id *id_entry =
> > + platform_get_device_id(fep->pdev);
> >
> > /* We cannot expect a graceful transmit stop without link !!! */
> > if (fep->link) {
> > @@ -466,11 +471,22 @@ fec_stop(struct net_device *ndev)
> > printk("fec_stop : Graceful transmit stop did not complete !\n");
> > }
> >
> > - /* Whack a reset. We should wait for this. */
> > - writel(FEC_ECNTRL_RESET, fep->hwp + FEC_ECNTRL);
> > - udelay(10);
> > - writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED);
> > - writel(FEC_DEFAULT_IMASK, fep->hwp + FEC_IMASK);
> > + if ((id_entry->driver_data & FEC_QUIRK_ENET_MAC) && dual_mac &&
> > + fep->pdev->id == 0) {
> > + /* clear the RDAR/TDAR bits to stop recv/xmit,
> > + * but do not reset the controller since the second MAC
> > + * may still be using the MII interface and requires ETHER_EN
> > + * on the first MAC to be asserted for MII interrupts!
> > + */
> > + writel(0, fep->hwp + FEC_ECNTRL);
> > + writel(FEC_ECNTRL_ETHER_EN, fep->hwp + FEC_ECNTRL);
> > + } else {
> > + /* Whack a reset. We should wait for this. */
> > + writel(FEC_ECNTRL_RESET, fep->hwp + FEC_ECNTRL);
> > + udelay(10);
> > + writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED);
> > + writel(FEC_DEFAULT_IMASK, fep->hwp + FEC_IMASK);
> > + }
> > }
> >
> > static void
> > @@ -1135,6 +1151,8 @@ static int
> > fec_enet_open(struct net_device *ndev)
> > {
> > struct fec_enet_private *fep = netdev_priv(ndev);
> > + const struct platform_device_id *id_entry =
> > + platform_get_device_id(fep->pdev);
> > int ret;
> >
> > /* I should reset the ring buffers here, but I don't yet know
> > @@ -1145,6 +1163,14 @@ fec_enet_open(struct net_device *ndev)
> > if (ret)
> > return ret;
> >
> > + if ((id_entry->driver_data & FEC_QUIRK_ENET_MAC) &&
> > + fep->pdev->id == 0) {
> > + /* ETHER_EN on first MAC has to be asserted
> > + * in order to generate MII interrupts
> > + */
> > + fec_restart(ndev, 0);
> > + }
> > +
>
> Is this relevant to the use case you intend to support? Or something
> is broken without these codes?
>
Actually this is not necessary any more, since with this patch the
first MAC is not being disabled on close any more. Looks like a single
problem fixed in two different places...
> > /* Probe and connect to PHY when open the interface */
> > ret = fec_enet_mii_probe(ndev);
> > if (ret) {
> > @@ -1435,6 +1461,8 @@ fec_probe(struct platform_device *pdev)
> > if (ret)
> > goto failed_register;
> >
> > + if (pdev->id > 0)
> > + dual_mac = 1;
> > return 0;
> >
> Blank line above 'return 0;'?
>
OK.
Lothar Waßmann
--
___________________________________________________________
Ka-Ro electronics GmbH | Pascalstraße 22 | D - 52076 Aachen
Phone: +49 2408 1402-0 | Fax: +49 2408 1402-10
Geschäftsführer: Matthias Kaussen
Handelsregistereintrag: Amtsgericht Aachen, HRB 4996
www.karo-electronics.de | info@karo-electronics.de
___________________________________________________________
^ permalink raw reply
* Re: [PATCH] NET: smsc95xx: don't use stack for async writes to the device
From: David Miller @ 2011-03-22 8:02 UTC (permalink / raw)
To: marc.zyngier; +Cc: netdev, steve.glendinning
In-Reply-To: <1300456438-13286-1-git-send-email-marc.zyngier@arm.com>
From: Marc Zyngier <marc.zyngier@arm.com>
Date: Fri, 18 Mar 2011 13:53:58 +0000
> The set_multicast operation performs asynchronous writes to the
> device, with some addresses pointing to the stack. Bad things may
> happen, and this is trapped CONFIG_DMA_API_DEBUG:
...
> Move the two offenders to the private structure which is kmalloc-ed,
> and thus safe.
>
> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
> Cc: Steve Glendinning <steve.glendinning@smsc.com>
Applied, thanks.
^ permalink raw reply
* Re: [PATCH v2] net: implement dev_disable_lro() hw_features compatibility
From: David Miller @ 2011-03-22 8:00 UTC (permalink / raw)
To: mirq-linux; +Cc: netdev, bhutchings
In-Reply-To: <32d98168b9b4ae553cc3647c30da85be05a28c95.1300503092.git.mirq-linux@rere.qmqm.pl>
From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Date: Sat, 19 Mar 2011 03:56:34 +0100 (CET)
> Implement compatibility with new hw_features for dev_disable_lro().
> This is a transition path - dev_disable_lro() should be later
> integrated into netdev_fix_features() after all drivers are converted.
>
> Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
I'll apply this, thanks.
^ permalink raw reply
* Re: [PATCH 4/4] drivers/net/fec: Don't mess with configured MAC addresses.
From: Lothar Waßmann @ 2011-03-22 7:49 UTC (permalink / raw)
To: Shawn Guo; +Cc: netdev, u.kleine-koenig
In-Reply-To: <20110322074336.GE28098@S2100-06.ap.freescale.net>
Hi,
Shawn Guo writes:
> On Mon, Mar 21, 2011 at 05:37:36PM +0100, Lothar Waßmann wrote:
> > The FEC driver currently uses the MAC address assigned to the first
> > interface incremented by one for the second interface.
> >
> > Change this to be able to configure distinct MAC addresses via
> > platform_data.
> >
> > Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
> > ---
> > drivers/net/fec.c | 9 ++-------
> > 1 files changed, 2 insertions(+), 7 deletions(-)
> >
> > diff --git a/drivers/net/fec.c b/drivers/net/fec.c
> > index 3666524..9d89e99 100644
> > --- a/drivers/net/fec.c
> > +++ b/drivers/net/fec.c
> > @@ -750,13 +750,12 @@ static void __inline__ fec_get_mac(struct net_device *ndev)
> > /*
> > * 2) from flash or fuse (via platform data)
> > */
> > + if (pdata)
> > + memcpy(iap, pdata->mac, ETH_ALEN);
> > if (!is_valid_ether_addr(iap)) {
> > #ifdef CONFIG_M5272
> > if (FEC_FLASHMAC)
> > iap = (unsigned char *)FEC_FLASHMAC;
> > -#else
> > - if (pdata)
> > - memcpy(iap, pdata->mac, ETH_ALEN);
> > #endif
> > }
> >
> > @@ -772,10 +771,6 @@ static void __inline__ fec_get_mac(struct net_device *ndev)
> > }
> >
> > memcpy(ndev->dev_addr, iap, ETH_ALEN);
> > -
> > - /* Adjust MAC if using macaddr */
> > - if (iap == macaddr)
> > - ndev->dev_addr[ETH_ALEN-1] = macaddr[ETH_ALEN-1] + fep->pdev->id;
> > }
> >
> > /* ------------------------------------------------------------------------- */
> > --
> > 1.5.6.5
> >
> >
> NAK.
>
> The 'mac' was designed as an optional member of fec
> platform_data, as some platforms may not be able to provide it. This
> patch breaks the order of getting mac, and will not work on the
> platform that does not provide an valid mac with either platform_data
> or controller mac registers, even there may be one in the kernel
> command line.
>
> The existing code takes mac address from kernel command line as the
> first choice, and only falls through on other options when it's
> invalid/unavailable. So an valid mac from kernel command line will
> always get fec work anyway.
>
The problem is that you can only assign one mac address on the kernel
cmdline and the second one will be derived from the first one.
And even if the MAC address is set via platform_data it will not be
used for the second interface.
IMO an ethernet driver has no business in inventing arbitrary MAC
addresses. Either the MAC address is supplied by the boot loader or
the platform code or it has to be assigned from userspace via
ifconfig.
Lothar Waßmann
--
___________________________________________________________
Ka-Ro electronics GmbH | Pascalstraße 22 | D - 52076 Aachen
Phone: +49 2408 1402-0 | Fax: +49 2408 1402-10
Geschäftsführer: Matthias Kaussen
Handelsregistereintrag: Amtsgericht Aachen, HRB 4996
www.karo-electronics.de | info@karo-electronics.de
___________________________________________________________
^ permalink raw reply
* Re: [PATCH 4/4] drivers/net/fec: Don't mess with configured MAC addresses.
From: Shawn Guo @ 2011-03-22 7:43 UTC (permalink / raw)
To: Lothar Waßmann; +Cc: netdev, u.kleine-koenig
In-Reply-To: <a6ba75577552abe8d5045434030c276d5f45779a.1300724245.git.LW@KARO-electronics.de>
On Mon, Mar 21, 2011 at 05:37:36PM +0100, Lothar Waßmann wrote:
> The FEC driver currently uses the MAC address assigned to the first
> interface incremented by one for the second interface.
>
> Change this to be able to configure distinct MAC addresses via
> platform_data.
>
> Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
> ---
> drivers/net/fec.c | 9 ++-------
> 1 files changed, 2 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/fec.c b/drivers/net/fec.c
> index 3666524..9d89e99 100644
> --- a/drivers/net/fec.c
> +++ b/drivers/net/fec.c
> @@ -750,13 +750,12 @@ static void __inline__ fec_get_mac(struct net_device *ndev)
> /*
> * 2) from flash or fuse (via platform data)
> */
> + if (pdata)
> + memcpy(iap, pdata->mac, ETH_ALEN);
> if (!is_valid_ether_addr(iap)) {
> #ifdef CONFIG_M5272
> if (FEC_FLASHMAC)
> iap = (unsigned char *)FEC_FLASHMAC;
> -#else
> - if (pdata)
> - memcpy(iap, pdata->mac, ETH_ALEN);
> #endif
> }
>
> @@ -772,10 +771,6 @@ static void __inline__ fec_get_mac(struct net_device *ndev)
> }
>
> memcpy(ndev->dev_addr, iap, ETH_ALEN);
> -
> - /* Adjust MAC if using macaddr */
> - if (iap == macaddr)
> - ndev->dev_addr[ETH_ALEN-1] = macaddr[ETH_ALEN-1] + fep->pdev->id;
> }
>
> /* ------------------------------------------------------------------------- */
> --
> 1.5.6.5
>
>
NAK.
The 'mac' was designed as an optional member of fec
platform_data, as some platforms may not be able to provide it. This
patch breaks the order of getting mac, and will not work on the
platform that does not provide an valid mac with either platform_data
or controller mac registers, even there may be one in the kernel
command line.
The existing code takes mac address from kernel command line as the
first choice, and only falls through on other options when it's
invalid/unavailable. So an valid mac from kernel command line will
always get fec work anyway.
--
Regards,
Shawn
^ permalink raw reply
* Re: [Security] [SECURITY] DECnet: need to validate user data and access data?
From: Eugene Teo @ 2011-03-22 7:42 UTC (permalink / raw)
To: Dan Rosenberg; +Cc: davem, netdev, security, linux-decnet-user
In-Reply-To: <1300750901.1813.15.camel@dan>
Cc'ed the decnet list. Looks like it's still active even though the
status is orphan.
On Tue, Mar 22, 2011 at 7:41 AM, Dan Rosenberg <drosenberg@vsecurity.com> wrote:
> In net/decnet/af_decnet.c, in the dn_access_copy() and dn_user_copy()
> functions, which are called from dn_connect(), length values are
> retrieved from incoming skb data and used as size values to copy
> functions:
>
> static void dn_access_copy(struct sk_buff *skb, struct accessdata_dn *acc)
> {
> unsigned char *ptr = skb->data;
>
> acc->acc_userl = *ptr++;
> memcpy(&acc->acc_user, ptr, acc->acc_userl);
> ptr += acc->acc_userl;
>
> acc->acc_passl = *ptr++;
> memcpy(&acc->acc_pass, ptr, acc->acc_passl);
> ptr += acc->acc_passl;
>
> acc->acc_accl = *ptr++;
> memcpy(&acc->acc_acc, ptr, acc->acc_accl);
>
> skb_pull(skb, acc->acc_accl + acc->acc_passl + acc->acc_userl + 3);
>
> }
>
> static void dn_user_copy(struct sk_buff *skb, struct optdata_dn *opt)
> {
> unsigned char *ptr = skb->data;
> u16 len = *ptr++; /* yes, it's 8bit on the wire */
>
> BUG_ON(len > 16); /* we've checked the contents earlier */
> opt->opt_optl = cpu_to_le16(len);
> opt->opt_status = 0;
> memcpy(opt->opt_data, ptr, len);
> skb_pull(skb, len + 1);
> }
>
>
> Despite the BUG_ON and comment suggesting these lengths have been
> validated, I don't think this is actually the case - it looks like these
> fields are validated for outbound data, but I see no validation for
> inbound data (unless I'm mistaken, which is entirely possible). If this
> is the case, this can allow remote attackers to cause controllable heap
> corruption. I'd appreciate it if someone who knows this protocol better
> than I do took a look at this and implemented appropriate error handling
> if it needs it.
^ permalink raw reply
* Re: [PATCH v2 09/13] can: pruss CAN driver.
From: Subhasish Ghosh @ 2011-03-22 7:30 UTC (permalink / raw)
To: Arnd Bergmann, linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r
Cc: sachi-EvXpCiN+lbve9wHmmfpqLFaTQe2KTcn/,
davinci-linux-open-source-VycZQUHpC/PFrsHnngEfi1aTQe2KTcn/,
open list:CAN NETWORK DRIVERS, nsekhar-l0cyMroinI0, open list,
open list:CAN NETWORK DRIVERS, m-watkins-l0cyMroinI0,
Wolfgang Grandegger
In-Reply-To: <201102181607.20787.arnd-r2nGTMty4D4@public.gmane.org>
Hello,
> This is a detailed walk through the can driver. The pruss_can.c
> file mostly looks good, there are very tiny changes that I'm
> suggesting to improve the code. I assume that you wrote that file.
>
> The pruss_can_api.c is a bit of a mess and looks like it was copied
> from some other code base and just barely changed to follow Linux
> coding style. I can tell from the main driver file that you can do
> better than that.
> My recommendation for that would be to throw it away and reimplement
> the few parts that you actually need, in proper coding style.
> You can also try to fix the file according to the comments I give
> you below, but I assume that would be signficantly more work.
>
> Moving everything into one file also makes things easier to read
> here and lets you identifer more quickly what is unused.
SG - I have almost re-implemented the API layer, will be merging with the
driver file itself.
>> +#ifdef __CAN_DEBUG
>> +#define __can_debug(fmt, args...) printk(KERN_DEBUG "can_debug: " fmt,
>> ## args)
>> +#else
>> +#define __can_debug(fmt, args...)
>> +#endif
>> +#define __can_err(fmt, args...) printk(KERN_ERR "can_err: " fmt, ##
>> args)
>
> Better use the existing dev_dbg() and dev_err() macros that provide the
> same functionality in a more standard way. You already use them in
> some places, as I noticed.
>
> If you don't have a way to pass a meaningful device, you can use
> pr_debug/pr_err.
>
SG - Ok
>> +void omapl_pru_can_rx_wQ(struct work_struct *work)
>> +{
>
> This is only used in the same file, so better make it static.
SG - This is removed, used NAPI as recommended.
>
>> + if (-1 == pru_can_get_intr_status(priv->dev, &priv->can_rx_hndl))
>> + return;
>
> Don't make up your own return values, just use the standard error codes,
> e.g. -EIO or -EAGAIN, whatever fits.
SG - Ok
>
> The more common way to write the comparison would be the other way round,
>
> if (pru_can_get_intr_status(priv->dev, &priv->can_rx_hndl) == -EAGAIN)
> return;
>
> or, simpler
>
> if (pru_can_get_intr_status(priv->dev, &priv->can_rx_hndl))
> return;
SG - Ok
>
>> +irqreturn_t omapl_tx_can_intr(int irq, void *dev_id)
>> +{
>
> This also should be static
SG - Ok
>
>> + for (bit_set = 0; ((priv->can_tx_hndl.u32interruptstatus & 0xFF)
>> + >> bit_set != 0); bit_set++)
>> + ;
>
> bit_set = fls(priv->can_tx_hndl.u32interruptstatus & 0xFF); ?
>
SG - Ok
>> +irqreturn_t omapl_rx_can_intr(int irq, void *dev_id)
>
> static
SG - Ok
>
>> diff --git a/drivers/net/can/da8xx_pruss/pruss_can_api.c
>> b/drivers/net/can/da8xx_pruss/pruss_can_api.c
>> new file mode 100644
>> index 0000000..2f7438a
>> --- /dev/null
>> +++ b/drivers/net/can/da8xx_pruss/pruss_can_api.c
>
> A lot of code in this file seems to be unused. Is that right?
> I would suggest adding only the code that is actually being
> used. If you add more functionality later, you can always
> add back the low-level functions, but dead code usually
> turns into broken code quickly.
>
SG - Ok
>> +static can_emu_drv_inst gstr_can_inst[ecanmaxinst];
>
> This is global data and probably needs some for of locking
SG - Ok
>
>> +/*
>> + * pru_can_set_brp() Updates the BRP register of PRU0
>> + * and PRU1 of OMAP L138. This API will be called by the
>> + * Application to updtae the BRP register of PRU0 and PRU1
>> + *
>> + * param u16bitrateprescaler The can bus bitrate
>> + * prescaler value be set
>> + *
>> + * return SUCCESS or FAILURE
>> + */
>> +s16 pru_can_set_brp(struct device *dev, u16 u16bitrateprescaler)
>> +{
>
> unused.
SG - Ok
>
>> + u32 u32offset;
>> +
>> + if (u16bitrateprescaler > 255) {
>> + return -1;
>> + }
>
> non-standard error code. It also doesn't match the comment, which
> claims it is SUCCESS or FAILURE, both of which are (rightfully)
> not defined.
SG - Ok
>
>> + u32offset = (PRU_CAN_RX_CLOCK_BRP_REGISTER);
>> + pruss_writel(dev, u32offset, (u32 *) &u16bitrateprescaler, 1);
>> +
>> + u32offset = (PRU_CAN_TX_CLOCK_BRP_REGISTER);
>> + pruss_writel(dev, u32offset, (u32 *) &u16bitrateprescaler, 1);
>
SG - Ok
> You pass a 32 bit pointer to a 16 bit local variable here.
> This has an undefined effect, and if you build this code on
> a big-endian platform, it cannot possibly do anything good.
>
> pruss_writel() is defined in a funny way if it takes a thirty-two bit
> input argument by reference, rather than by value. What is going
> on there?
>
>> +s16 pru_can_set_bit_timing(struct device *dev,
>> + can_bit_timing_consts *pstrbittiming)
>
> unused.
>
SG - Ok
>> + u32 u32offset;
>> + u32 u32serregister;
>
> It's a bit silly to put the name of the type into the name
> of a variable. You already spell it out in the definition.
SG - Ok
>
>> +s16 pru_can_write_data_to_mailbox(struct device *dev,
>> + can_emu_app_hndl *pstremuapphndl)
>> +{
>> + s16 s16subrtnretval;
>> + u32 u32offset;
>> +
>> + if (pstremuapphndl == NULL) {
>> + return -1;
>> + }
>
> nonstandard error code. Also, why the heck is type function
> return type s16 when the only possible return values are 0
> and -1? Just make this an int.
SG - Ok
>
>> + switch ((u8) pstremuapphndl->ecanmailboxnumber) {
>> + case 0:
>> + u32offset = (PRU_CAN_TX_MAILBOX0);
>> + break;
>> + case 1:
>> + u32offset = (PRU_CAN_TX_MAILBOX1);
>> + break;
>> + case 2:
>> + u32offset = (PRU_CAN_TX_MAILBOX2);
>> + break;
>> + case 3:
>> + u32offset = (PRU_CAN_TX_MAILBOX3);
>> + break;
>> + case 4:
>> + u32offset = (PRU_CAN_TX_MAILBOX4);
>> + break;
>> + case 5:
>> + u32offset = (PRU_CAN_TX_MAILBOX5);
>> + break;
>> + case 6:
>> + u32offset = (PRU_CAN_TX_MAILBOX6);
>> + break;
>> + case 7:
>> + u32offset = (PRU_CAN_TX_MAILBOX7);
>> + break;
>> + default:
>> + return -1;
>> + }
>
> Lovely switch statement. I'm sure you find a better way to express this
> ;-)
SG - Ok.
>
>> + s16subrtnretval = pruss_writel(dev, u32offset,
>> + (u32 *) &(pstremuapphndl->strcanmailbox), 4);
>> + if (s16subrtnretval == -1) {
>> + return -1;
>> + }
>> + return 0;
>> +}
>
> return pruss_writel(...) ?
SG - Ok.
>
>> +
>> +/*
>> + * pru_can_get_intr_status()
>> + * Gets the interrupts status register value.
>> + * This API will be called by the Application
>> + * to get the interrupts status register value
>> + *
>> + * param u8prunumber PRU number for which IntStatusReg
>> + * has to be read
>> + *
>> + * return SUCCESS or FAILURE
>> + */
>> +s16 pru_can_get_intr_status(struct device *dev,
>> + can_emu_app_hndl *pstremuapphndl)
>> +{
>> + u32 u32offset;
>> + s16 s16subrtnretval = -1;
>> +
>> + if (pstremuapphndl == NULL) {
>> + return -1;
>> + }
>
> In every function you check that pstremuapphndl is present. This seems
> rather pointless. How about just making sure you never pass a NULL
> value to these functions? That should not be hard at all from the
> high-level driver.
SG - OK.
>
>> + if (pstremuapphndl->u8prunumber == DA8XX_PRUCORE_1) {
>> + u32offset = (PRU_CAN_TX_INTERRUPT_STATUS_REGISTER);
>> + } else if (pstremuapphndl->u8prunumber == DA8XX_PRUCORE_0) {
>> + u32offset = (PRU_CAN_RX_INTERRUPT_STATUS_REGISTER);
>> + } else {
>> + return -1;
>> + }
>> +
>> + s16subrtnretval = pruss_readl(dev, u32offset,
>> + (u32 *) &pstremuapphndl->u32interruptstatus, 1);
>> + if (s16subrtnretval == -1) {
>> + return -1;
>> + }
>
> You can also get rid of all these {} braces around one-line statements.
SG - OK.
>
>> +/*
>> + * pru_can_get_mailbox_status() Gets the mailbox status
>> + * register value. This API will be called by the Application
>> + * to get the mailbox status register value
>> + *
>> + * return SUCCESS or FAILURE
>> + */
>> +s16 pru_can_get_mailbox_status(struct device *dev,
>> + can_emu_app_hndl *pstremuapphndl)
>
> unused
.
SG - OK.
>
>> +/*
>> + * pru_can_config_mode_set() Sets the timing value
>> + * for data transfer. This API will be called by the Application
>> + * to set timing valus for data transfer
>> + *
>> + * return SUCCESS or FAILURE
>> + */
>> +s16 pru_can_config_mode_set(struct device *dev, bool bconfigmodeflag)
>
> unused.
SG - OK.
>
>> + u32offset = (PRU_CAN_TX_GLOBAL_CONTROL_REGISTER & 0xFFFF);
>> + u32value = 0x00000000;
>> + s16subrtnretval = pruss_writel(dev, u32offset, (u32 *) &u32value, 1);
>> + if (s16subrtnretval == -1) {
>> + return -1;
>> + }
>> +
>> + u32offset = (PRU_CAN_TX_GLOBAL_STATUS_REGISTER & 0xFFFF);
>> + u32value = 0x00000040;
>> + s16subrtnretval = pruss_writel(dev, u32offset, (u32 *) &u32value, 1);
>> + if (s16subrtnretval == -1) {
>> + return -1;
>> + }
>> + u32offset = (PRU_CAN_RX_GLOBAL_STATUS_REGISTER & 0xFFFF);
>> + u32value = 0x00000040;
>> + s16subrtnretval = pruss_writel(dev, u32offset, (u32 *) &u32value, 1);
>> + if (s16subrtnretval == -1) {
>> + return -1;
>> + }
>
> <skipping 50 (!) more of these>
>
> After the third time of writing the same code, you should have noticed
> that
> there is some duplication involved that can trivially be reduced. A good
> way to express the same would be a table with the contents:
>
SG - OK.
Thanks for taking the pain to review this. But, the good
part is that
everything works fine. All this got cluttered as
development &
design changes happened. Hopefully, the cleaned up code
will
also work as well :-)
> static struct pru_can_register_init {
> u16 offset;
> u32 value;
> } = {
> { PRU_CAN_TX_GLOBAL_CONTROL_REGISTER, 0, },
> { PRU_CAN_TX_GLOBAL_STATUS_REGISTER, 0x40, },
> { PRU_CAN_RX_GLOBAL_STATUS_REGISTER, 0x40, },
> ...
> };
>
>
>> +
>> +
>> +/*
>> + * pru_can_emu_open() Opens the can emu for
>> + * application to use. This API will be called by the Application
>> + * to Open the can emu for application to use.
>> + *
>> + * param pstremuapphndl Pointer to application handler
>> + * structure
>> + *
>> + * return SUCCESS or FAILURE
>> + */
>> +s16 pru_can_emu_open(struct device *dev, can_emu_app_hndl
>> *pstremuapphndl)
>
> unused.
SG - OK.
>
>> +/*
>> + * brief pru_can_emu_close() Closes the can emu for other
>> + * applications to use. This API will be called by the Application to
>> Close
>> + * the can emu for other applications to use
>> + *
>> + * param pstremuapphndl Pointer to application handler structure
>> + *
>> + * return SUCCESS or FAILURE
>> + */
>> +s16 pru_can_emu_close(struct device *dev, can_emu_app_hndl
>> *pstremuapphndl)
>
> unused
SG - OK.
>
>> +s16 pru_can_emu_sreset(struct device *dev)
>> +{
>> + return 0;
>> +}
>
> pointless.
SG - OK.
>
>> +s16 pru_can_tx(struct device *dev, u8 u8mailboxnumber, u8 u8prunumber)
>> +{
>> + u32 u32offset = 0;
>> + u32 u32value = 0;
>> + s16 s16subrtnretval = -1;
>> +
>> + if (DA8XX_PRUCORE_1 == u8prunumber) {
>> + switch (u8mailboxnumber) {
>> + case 0:
>> + u32offset = (PRU_CAN_TX_MAILBOX0_STATUS_REGISTER & 0xFFFF);
>> + u32value = 0x00000080;
>> + s16subrtnretval = pruss_writel(dev, u32offset,
>> + (u32 *) &u32value, 1);
>> + if (s16subrtnretval == -1) {
>> + return -1;
>> + }
>> + break;
>> + case 1:
>> + u32offset = (PRU_CAN_TX_MAILBOX1_STATUS_REGISTER & 0xFFFF);
>> + u32value = 0x00000080;
>> + s16subrtnretval = pruss_writel(dev, u32offset,
>> + (u32 *) &u32value, 1);
>> + if (s16subrtnretval == -1) {
>> + return -1;
>> + }
>> + break;
>> + case 2:
>> + u32offset = (PRU_CAN_TX_MAILBOX2_STATUS_REGISTER & 0xFFFF);
>
> Another pointless switch statement.
SG - OK.
>
>> +s16 pru_can_mask_ints(struct device *dev, u32 int_mask)
>> +{
>> + return 0;
>> +}
>> +
>> +int pru_can_get_error_cnt(struct device *dev, u8 u8prunumber)
>> +{
>> + return 0;
>> +}
>
> useless.
SG - OK.
>
>> +int pru_can_get_intc_status(struct device *dev)
>> +{
>> + u32 u32offset = 0;
>> + u32 u32getvalue = 0;
>> + u32 u32clrvalue = 0;
>> +
>> + u32offset = (PRUSS_INTC_STATCLRINT1 & 0xFFFF);
>> + pruss_readl(dev, u32offset, (u32 *) &u32getvalue, 1);
>> +
>> + if (u32getvalue & 4)
>> + u32clrvalue = 34; /* CLR Event 34 */
>> +
>> + if (u32getvalue & 2)
>> + u32clrvalue = 33; /* CLR Event 33 */
>> +
>> + if (u32clrvalue) {
>> + u32offset = (PRUSS_INTC_STATIDXCLR & 0xFFFF);
>> + pruss_writel(dev, u32offset, &u32clrvalue, 1);
>> + } else
>> + return -1;
>
> Could the controller signal both event 34 and 33 simultaneously?
> The only user of this function looks at the individual bits
> of the return value again, which looks wrong for all possible
> return values here.
>
SG - OK. The System Events are mapped to 10 host interrupts (PRU to
ARM/DSP),
as I our case two system events can be mapped to a single
host interrupt.
>> +#ifndef _PRU_CAN_API_H_
>> +#define CAN_BIT_TIMINGS (0x273)
>> +
>> +/* Timer Clock is sourced from DDR freq (PLL1 SYS CLK 2) */
>> +#define TIMER_CLK_FREQ 132000000
>> +
>> +#define TIMER_SETUP_DELAY 14
>> +#define GPIO_SETUP_DELAY 150
>> +
>> +#define CAN_RX_PRU_0 PRUSS_NUM0
>> +#define CAN_TX_PRU_1 PRUSS_NUM1
>> +
>> +/* Number of Instruction in the Delay loop */
>> +#define DELAY_LOOP_LENGTH 2
>> +
>> +#define PRU1_BASE_ADDR 0x2000
>> +
>> +#define PRU_CAN_TX_GLOBAL_CONTROL_REGISTER (PRU1_BASE_ADDR)
>> +#define PRU_CAN_TX_GLOBAL_STATUS_REGISTER (PRU1_BASE_ADDR + 0x04)
>> +#define PRU_CAN_TX_INTERRUPT_MASK_REGISTER (PRU1_BASE_ADDR + 0x08)
>> +#define PRU_CAN_TX_INTERRUPT_STATUS_REGISTER (PRU1_BASE_ADDR + 0x0C)
>> +#define PRU_CAN_TX_MAILBOX0_STATUS_REGISTER (PRU1_BASE_ADDR + 0x10)
>> +#define PRU_CAN_TX_MAILBOX1_STATUS_REGISTER (PRU1_BASE_ADDR + 0x14)
>
> The header file should be used for interfaces between the two .c files,
> don't mix that with hardware specific definitions. Sometimes you may want
> to have register number lists in a header, if that list is going to be
> used in multiple places. In this case, there is just one user, so better
> move all those definitions over there.
SG - OK.
>
>> +typedef enum {
>> + ecaninst0 = 0,
>> + ecaninst1,
>> + ecanmaxinst
>> +} can_instance_enum;
>> +
>> +typedef enum {
>> + ecanmailbox0 = 0,
>> + ecanmailbox1,
>> + ecanmailbox2,
>> + ecanmailbox3,
>> + ecanmailbox4,
>> + ecanmailbox5,
>> + ecanmailbox6,
>> + ecanmailbox7
>> +} can_mailbox_number;
>> +
>> +typedef enum {
>> + ecandirectioninit = 0,
>> + ecantransmit,
>> + ecanreceive
>> +} can_transfer_direction;
>
> The values are all unused, you only use the typedefs.
> IMHO it would be more sensible to just pass these as unsigned int
> or u32 values, but if you prefer, there is no reason to just do
>
> typedef u32 can_mailbox_number;
>
> etc.
SG - OK.
>
>> +typedef struct {
>> + u16 u16extendedidentifier;
>> + u16 u16baseidentifier;
>> + u8 u8data7;
>> + u8 u8data6;
>> + u8 u8data5;
>> + u8 u8data4;
>> + u8 u8data3;
>> + u8 u8data2;
>> + u8 u8data1;
>> + u8 u8data0;
>> + u16 u16datalength;
>> + u16 u16crc;
>> +} can_mail_box_structure;
>
> Please don't use typedef for complex data structures, and learn about
> better naming of identifiers. I would suggest writing this as
>
> struct pru_can_mailbox {
> u16 ext_id;
> u16 base_id;
> u8 data[8]; /* note: reverse order */
> u16 len;
> u16 crc;
> };
>
> Sames rules apply to the other structures.
SG - OK.
>
> Arnd
^ permalink raw reply
* Re: [PATCH 3/4] drivers/net/fec: Fix dual MAC support on i.MX28
From: Shawn Guo @ 2011-03-22 7:28 UTC (permalink / raw)
To: Lothar Waßmann; +Cc: netdev, u.kleine-koenig
In-Reply-To: <e8566dc34c4fd544ac630cf7908e4fb613e3ec1a.1300724245.git.LW@KARO-electronics.de>
Hi Lothar,
On Mon, Mar 21, 2011 at 05:37:35PM +0100, Lothar Waßmann wrote:
> The variant of the FEC chip found on i.MX28 features two distinct
> ethernet MACs that both share a single MII interface. When
> deconfiguring the eth0 interface, the MII interface is currently being
> switched off, so that the second MAC won't work any more.
>
I'm wondering what the use case is you intend to support with this
patch.
> Make sure, the first MAC is never disabled when the second FEC device
> is registered.
>
> Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
> ---
> drivers/net/fec.c | 38 +++++++++++++++++++++++++++++++++-----
> 1 files changed, 33 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/fec.c b/drivers/net/fec.c
> index 2436db8..3666524 100644
> --- a/drivers/net/fec.c
> +++ b/drivers/net/fec.c
> @@ -82,6 +82,9 @@ static unsigned char macaddr[ETH_ALEN];
> module_param_array(macaddr, byte, NULL, 0);
> MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address");
>
> +static int dual_mac;
> +module_param(dual_mac, int, S_IRUGO);
> +
As you are detecting dual_mac in probe function, is this necessary?
> #if defined(CONFIG_M5272)
> /*
> * Some hardware gets it MAC address out of local flash memory.
> @@ -456,6 +459,8 @@ static void
> fec_stop(struct net_device *ndev)
> {
> struct fec_enet_private *fep = netdev_priv(ndev);
> + const struct platform_device_id *id_entry =
> + platform_get_device_id(fep->pdev);
>
> /* We cannot expect a graceful transmit stop without link !!! */
> if (fep->link) {
> @@ -466,11 +471,22 @@ fec_stop(struct net_device *ndev)
> printk("fec_stop : Graceful transmit stop did not complete !\n");
> }
>
> - /* Whack a reset. We should wait for this. */
> - writel(FEC_ECNTRL_RESET, fep->hwp + FEC_ECNTRL);
> - udelay(10);
> - writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED);
> - writel(FEC_DEFAULT_IMASK, fep->hwp + FEC_IMASK);
> + if ((id_entry->driver_data & FEC_QUIRK_ENET_MAC) && dual_mac &&
> + fep->pdev->id == 0) {
> + /* clear the RDAR/TDAR bits to stop recv/xmit,
> + * but do not reset the controller since the second MAC
> + * may still be using the MII interface and requires ETHER_EN
> + * on the first MAC to be asserted for MII interrupts!
> + */
> + writel(0, fep->hwp + FEC_ECNTRL);
> + writel(FEC_ECNTRL_ETHER_EN, fep->hwp + FEC_ECNTRL);
> + } else {
> + /* Whack a reset. We should wait for this. */
> + writel(FEC_ECNTRL_RESET, fep->hwp + FEC_ECNTRL);
> + udelay(10);
> + writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED);
> + writel(FEC_DEFAULT_IMASK, fep->hwp + FEC_IMASK);
> + }
> }
>
> static void
> @@ -1135,6 +1151,8 @@ static int
> fec_enet_open(struct net_device *ndev)
> {
> struct fec_enet_private *fep = netdev_priv(ndev);
> + const struct platform_device_id *id_entry =
> + platform_get_device_id(fep->pdev);
> int ret;
>
> /* I should reset the ring buffers here, but I don't yet know
> @@ -1145,6 +1163,14 @@ fec_enet_open(struct net_device *ndev)
> if (ret)
> return ret;
>
> + if ((id_entry->driver_data & FEC_QUIRK_ENET_MAC) &&
> + fep->pdev->id == 0) {
> + /* ETHER_EN on first MAC has to be asserted
> + * in order to generate MII interrupts
> + */
> + fec_restart(ndev, 0);
> + }
> +
Is this relevant to the use case you intend to support? Or something
is broken without these codes?
> /* Probe and connect to PHY when open the interface */
> ret = fec_enet_mii_probe(ndev);
> if (ret) {
> @@ -1435,6 +1461,8 @@ fec_probe(struct platform_device *pdev)
> if (ret)
> goto failed_register;
>
> + if (pdev->id > 0)
> + dual_mac = 1;
> return 0;
>
Blank line above 'return 0;'?
--
Regards,
Shawn
> failed_register:
> --
> 1.5.6.5
>
>
^ permalink raw reply
* [PATCH net-next-2.6 5/5] be2net: remove one useless line
From: Sathya Perla @ 2011-03-22 6:49 UTC (permalink / raw)
To: davem; +Cc: netdev, Sathya Perla
In-Reply-To: <1300776569-15586-5-git-send-email-sathya.perla@emulex.com>
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
---
drivers/net/benet/be_main.c | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 8638913..a24fb45 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -2330,7 +2330,6 @@ static int be_setup(struct be_adapter *adapter)
return 0;
- be_mcc_queues_destroy(adapter);
rx_qs_destroy:
be_rx_queues_destroy(adapter);
tx_qs_destroy:
--
1.6.5.2
^ permalink raw reply related
* [PATCH net-next-2.6 4/5] be2net: cancel be_worker in be_shutdown() even when i/f is down
From: Sathya Perla @ 2011-03-22 6:49 UTC (permalink / raw)
To: davem; +Cc: netdev, Sathya Perla
In-Reply-To: <1300776569-15586-4-git-send-email-sathya.perla@emulex.com>
As the be_worker() workqueue is scheduled in be_probe() it must
be canceled unconditionally in be_shutdown().
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
---
drivers/net/benet/be_main.c | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 3bf79d1..8638913 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -3155,8 +3155,7 @@ static void be_shutdown(struct pci_dev *pdev)
struct be_adapter *adapter = pci_get_drvdata(pdev);
struct net_device *netdev = adapter->netdev;
- if (netif_running(netdev))
- cancel_delayed_work_sync(&adapter->work);
+ cancel_delayed_work_sync(&adapter->work);
netif_device_detach(netdev);
--
1.6.5.2
^ permalink raw reply related
* [PATCH net-next-2.6 2/5] be2net: parse vid and vtm fields of rx-compl only if vlanf bit is set
From: Sathya Perla @ 2011-03-22 6:49 UTC (permalink / raw)
To: davem; +Cc: netdev, Sathya Perla
In-Reply-To: <1300776569-15586-2-git-send-email-sathya.perla@emulex.com>
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
---
drivers/net/benet/be_main.c | 34 +++++++++++++++++++++++-----------
1 files changed, 23 insertions(+), 11 deletions(-)
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 7a5d6a3..6616300 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1101,8 +1101,12 @@ static void be_parse_rx_compl_v1(struct be_adapter *adapter,
AMAP_GET_BITS(struct amap_eth_rx_compl_v1, numfrags, compl);
rxcp->pkt_type =
AMAP_GET_BITS(struct amap_eth_rx_compl_v1, cast_enc, compl);
- rxcp->vtm = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, vtm, compl);
- rxcp->vid = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, vlan_tag, compl);
+ if (rxcp->vlanf) {
+ rxcp->vtm = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, vtm,
+ compl);
+ rxcp->vid = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, vlan_tag,
+ compl);
+ }
}
static void be_parse_rx_compl_v0(struct be_adapter *adapter,
@@ -1127,8 +1131,12 @@ static void be_parse_rx_compl_v0(struct be_adapter *adapter,
AMAP_GET_BITS(struct amap_eth_rx_compl_v0, numfrags, compl);
rxcp->pkt_type =
AMAP_GET_BITS(struct amap_eth_rx_compl_v0, cast_enc, compl);
- rxcp->vtm = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, vtm, compl);
- rxcp->vid = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, vlan_tag, compl);
+ if (rxcp->vlanf) {
+ rxcp->vtm = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, vtm,
+ compl);
+ rxcp->vid = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, vlan_tag,
+ compl);
+ }
}
static struct be_rx_compl_info *be_rx_compl_get(struct be_rx_obj *rxo)
@@ -1150,15 +1158,19 @@ static struct be_rx_compl_info *be_rx_compl_get(struct be_rx_obj *rxo)
else
be_parse_rx_compl_v0(adapter, compl, rxcp);
- /* vlanf could be wrongly set in some cards. ignore if vtm is not set */
- if ((adapter->function_mode & 0x400) && !rxcp->vtm)
- rxcp->vlanf = 0;
+ if (rxcp->vlanf) {
+ /* vlanf could be wrongly set in some cards.
+ * ignore if vtm is not set */
+ if ((adapter->function_mode & 0x400) && !rxcp->vtm)
+ rxcp->vlanf = 0;
- if (!lancer_chip(adapter))
- rxcp->vid = swab16(rxcp->vid);
+ if (!lancer_chip(adapter))
+ rxcp->vid = swab16(rxcp->vid);
- if ((adapter->pvid == rxcp->vid) && !adapter->vlan_tag[rxcp->vid])
- rxcp->vlanf = 0;
+ if ((adapter->pvid == rxcp->vid) &&
+ !adapter->vlan_tag[rxcp->vid])
+ rxcp->vlanf = 0;
+ }
/* As the compl has been parsed, reset it; we wont touch it again */
compl->dw[offsetof(struct amap_eth_rx_compl_v1, valid) / 32] = 0;
--
1.6.5.2
^ permalink raw reply related
* [PATCH net-next-2.6 3/5] be2net: remove redundant code in be_worker()
From: Sathya Perla @ 2011-03-22 6:49 UTC (permalink / raw)
To: davem; +Cc: netdev, Sathya Perla
In-Reply-To: <1300776569-15586-3-git-send-email-sathya.perla@emulex.com>
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
---
drivers/net/benet/be_main.c | 8 +++-----
1 files changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 6616300..3bf79d1 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1868,6 +1868,9 @@ static void be_worker(struct work_struct *work)
struct be_rx_obj *rxo;
int i;
+ if (!adapter->ue_detected && !lancer_chip(adapter))
+ be_detect_dump_ue(adapter);
+
/* when interrupts are not yet enabled, just reap any pending
* mcc completions */
if (!netif_running(adapter->netdev)) {
@@ -1880,9 +1883,6 @@ static void be_worker(struct work_struct *work)
be_cq_notify(adapter, mcc_obj->cq.id, false, mcc_compl);
}
- if (!adapter->ue_detected && !lancer_chip(adapter))
- be_detect_dump_ue(adapter);
-
goto reschedule;
}
@@ -1900,8 +1900,6 @@ static void be_worker(struct work_struct *work)
be_post_rx_frags(rxo, GFP_KERNEL);
}
}
- if (!adapter->ue_detected && !lancer_chip(adapter))
- be_detect_dump_ue(adapter);
reschedule:
schedule_delayed_work(&adapter->work, msecs_to_jiffies(1000));
--
1.6.5.2
^ permalink raw reply related
* [PATCH net-next-2.6 1/5] be2net: refactor code that decides adapter->num_rx_queues
From: Sathya Perla @ 2011-03-22 6:49 UTC (permalink / raw)
To: davem; +Cc: netdev, Sathya Perla
In-Reply-To: <1300776569-15586-1-git-send-email-sathya.perla@emulex.com>
The code has been refactored to not set num_rx_qs inside be_enable_msix().
num_rx_qs is now set at the time of queue creation based on the number of
available msix vectors.
Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
---
drivers/net/benet/be.h | 8 +++--
drivers/net/benet/be_main.c | 66 ++++++++++++++++++++++---------------------
2 files changed, 39 insertions(+), 35 deletions(-)
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index f803c58..3937bca 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -84,7 +84,8 @@ static inline char *nic_name(struct pci_dev *pdev)
#define MCC_CQ_LEN 256
#define MAX_RSS_QS 4 /* BE limit is 4 queues/port */
-#define BE_MAX_MSIX_VECTORS (MAX_RSS_QS + 1 + 1)/* RSS qs + 1 def Rx + Tx */
+#define MAX_RX_QS (MAX_RSS_QS + 1) /* RSS qs + 1 def Rx */
+#define BE_MAX_MSIX_VECTORS (MAX_RX_QS + 1)/* RX + TX */
#define BE_NAPI_WEIGHT 64
#define MAX_RX_POST BE_NAPI_WEIGHT /* Frags posted at a time */
#define RX_FRAGS_REFILL_WM (RX_Q_LEN - MAX_RX_POST)
@@ -276,7 +277,7 @@ struct be_adapter {
spinlock_t mcc_cq_lock;
struct msix_entry msix_entries[BE_MAX_MSIX_VECTORS];
- bool msix_enabled;
+ u32 num_msix_vec;
bool isr_registered;
/* TX Rings */
@@ -287,7 +288,7 @@ struct be_adapter {
u32 cache_line_break[8];
/* Rx rings */
- struct be_rx_obj rx_obj[MAX_RSS_QS + 1]; /* one default non-rss Q */
+ struct be_rx_obj rx_obj[MAX_RX_QS];
u32 num_rx_qs;
u32 big_page_size; /* Compounded page size shared by rx wrbs */
@@ -351,6 +352,7 @@ struct be_adapter {
extern const struct ethtool_ops be_ethtool_ops;
+#define msix_enabled(adapter) (adapter->num_msix_vec > 0)
#define tx_stats(adapter) (&adapter->tx_stats)
#define rx_stats(rxo) (&rxo->stats)
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index a71163f..7a5d6a3 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1567,12 +1567,31 @@ static void be_rx_queues_destroy(struct be_adapter *adapter)
}
}
+static u32 be_num_rxqs_want(struct be_adapter *adapter)
+{
+ if (multi_rxq && (adapter->function_caps & BE_FUNCTION_CAPS_RSS) &&
+ !adapter->sriov_enabled && !(adapter->function_mode & 0x400)) {
+ return 1 + MAX_RSS_QS; /* one default non-RSS queue */
+ } else {
+ dev_warn(&adapter->pdev->dev,
+ "No support for multiple RX queues\n");
+ return 1;
+ }
+}
+
static int be_rx_queues_create(struct be_adapter *adapter)
{
struct be_queue_info *eq, *q, *cq;
struct be_rx_obj *rxo;
int rc, i;
+ adapter->num_rx_qs = min(be_num_rxqs_want(adapter),
+ msix_enabled(adapter) ?
+ adapter->num_msix_vec - 1 : 1);
+ if (adapter->num_rx_qs != MAX_RX_QS)
+ dev_warn(&adapter->pdev->dev,
+ "Can create only %d RX queues", adapter->num_rx_qs);
+
adapter->big_page_size = (1 << get_order(rx_frag_size)) * PAGE_SIZE;
for_all_rx_queues(adapter, rxo, i) {
rxo->adapter = adapter;
@@ -1878,51 +1897,35 @@ reschedule:
static void be_msix_disable(struct be_adapter *adapter)
{
- if (adapter->msix_enabled) {
+ if (msix_enabled(adapter)) {
pci_disable_msix(adapter->pdev);
- adapter->msix_enabled = false;
- }
-}
-
-static int be_num_rxqs_get(struct be_adapter *adapter)
-{
- if (multi_rxq && (adapter->function_caps & BE_FUNCTION_CAPS_RSS) &&
- !adapter->sriov_enabled && !(adapter->function_mode & 0x400)) {
- return 1 + MAX_RSS_QS; /* one default non-RSS queue */
- } else {
- dev_warn(&adapter->pdev->dev,
- "No support for multiple RX queues\n");
- return 1;
+ adapter->num_msix_vec = 0;
}
}
static void be_msix_enable(struct be_adapter *adapter)
{
#define BE_MIN_MSIX_VECTORS (1 + 1) /* Rx + Tx */
- int i, status;
+ int i, status, num_vec;
- adapter->num_rx_qs = be_num_rxqs_get(adapter);
+ num_vec = be_num_rxqs_want(adapter) + 1;
- for (i = 0; i < (adapter->num_rx_qs + 1); i++)
+ for (i = 0; i < num_vec; i++)
adapter->msix_entries[i].entry = i;
- status = pci_enable_msix(adapter->pdev, adapter->msix_entries,
- adapter->num_rx_qs + 1);
+ status = pci_enable_msix(adapter->pdev, adapter->msix_entries, num_vec);
if (status == 0) {
goto done;
} else if (status >= BE_MIN_MSIX_VECTORS) {
+ num_vec = status;
if (pci_enable_msix(adapter->pdev, adapter->msix_entries,
- status) == 0) {
- adapter->num_rx_qs = status - 1;
- dev_warn(&adapter->pdev->dev,
- "Could alloc only %d MSIx vectors. "
- "Using %d RX Qs\n", status, adapter->num_rx_qs);
+ num_vec) == 0)
goto done;
- }
}
return;
done:
- adapter->msix_enabled = true;
+ adapter->num_msix_vec = num_vec;
+ return;
}
static void be_sriov_enable(struct be_adapter *adapter)
@@ -2003,8 +2006,7 @@ err_msix:
err:
dev_warn(&adapter->pdev->dev,
"MSIX Request IRQ failed - err %d\n", status);
- pci_disable_msix(adapter->pdev);
- adapter->msix_enabled = false;
+ be_msix_disable(adapter);
return status;
}
@@ -2013,7 +2015,7 @@ static int be_irq_register(struct be_adapter *adapter)
struct net_device *netdev = adapter->netdev;
int status;
- if (adapter->msix_enabled) {
+ if (msix_enabled(adapter)) {
status = be_msix_register(adapter);
if (status == 0)
goto done;
@@ -2046,7 +2048,7 @@ static void be_irq_unregister(struct be_adapter *adapter)
return;
/* INTx */
- if (!adapter->msix_enabled) {
+ if (!msix_enabled(adapter)) {
free_irq(netdev->irq, adapter);
goto done;
}
@@ -2088,7 +2090,7 @@ static int be_close(struct net_device *netdev)
be_cq_notify(adapter, rxo->cq.id, false, 0);
}
- if (adapter->msix_enabled) {
+ if (msix_enabled(adapter)) {
vec = be_msix_vec_get(adapter, tx_eq);
synchronize_irq(vec);
@@ -2261,7 +2263,7 @@ static int be_setup(struct be_adapter *adapter)
BE_IF_FLAGS_PASS_L3L4_ERRORS;
en_flags |= BE_IF_FLAGS_PASS_L3L4_ERRORS;
- if (be_multi_rxq(adapter)) {
+ if (adapter->function_caps & BE_FUNCTION_CAPS_RSS) {
cap_flags |= BE_IF_FLAGS_RSS;
en_flags |= BE_IF_FLAGS_RSS;
}
--
1.6.5.2
^ permalink raw reply related
* [PATCH net-next-2.6 0/5] resending patch series minus one patch
From: Sathya Perla @ 2011-03-22 6:49 UTC (permalink / raw)
To: davem; +Cc: netdev, Sathya Perla
Hi Dave, I'm re-sending my previous patch series minus the "don't drop vlan
pkts" patch (I'll address this in a separate patch.)
Pls apply. Thanks.
Sathya Perla (5):
be2net: refactor code that decides adapter->num_rx_queues
be2net: parse vid and vtm fields of rx-compl only if vlanf bit is set
be2net: remove redundant code in be_worker()
be2net: cancel be_worker() in be_shutdown() even when i/f is down
be2net: remove one useless line
drivers/net/benet/be.h | 8 ++-
drivers/net/benet/be_main.c | 112 +++++++++++++++++++++++-------------------
2 files changed, 66 insertions(+), 54 deletions(-)
^ permalink raw reply
* Hello
From: Mr.Pt. Lee @ 2011-03-22 4:10 UTC (permalink / raw)
Hello
It is understandable that you might be a bit apprehensive because you do not know, but I have a lucrative business proposal of mutual interest to share with you. I got your reference in my search for someone who suits my proposed business relationship.
I am Mr P. Lee of South Korea, happily married with children, and I am Director of Hang Seng Bank Ltd., in charge of the International Remittance Department. I have a confidential business proposal for you. I need you to assist me in implementing a business project from Hong Kong to your country. It is the transfer of large sums of money. Everything about this transaction shall be legally done without hitch. Please try to observe utmost discretion in all matters concerning this issue.
After funds have been successfully transferred into your account, we will share in proportion to both of us agreed. I prefer you to me on my private e-mail address (petercleejp@yahoo.cn) and then after that I will give you more information about this operation. If you're interested, send me the following urgently:
1st Names and surnames
2nd Occupation
3rd Private phone number
4th Current contact address
Please, if you do not want to delete this e-mail and do not hunt, because I am putting my career and life of my family at stake with this venture. Although nothing ventured nothing gained.
Your earliest response to this letter will be appreciated.
Sincerely,
Mr.Pt. Lee
Hang Seng Bank Limited
Hong Kong. () Asian
E-mail: - petercleejp@yahoo.cn
^ permalink raw reply
* Re: [GIT] Networking
From: David Miller @ 2011-03-22 4:09 UTC (permalink / raw)
To: torvalds; +Cc: akpm, netdev, linux-kernel
In-Reply-To: <AANLkTinN3qszBjbJdkXb2TPBkAW0mXGC=Ri1zKL9gdNg@mail.gmail.com>
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 21 Mar 2011 12:24:12 -0700
> That said, I'm delaying this pull request due to the known issues with
> it - let me know when you've updated it with the fix for the
> use-after-free fixes and the slab corruptor (the latter of which I
> haven't seen a patch for yet)
I've intergrated several bug fixes, including those for all of the
problems Ingo reported:
1) Non-netlink ipsec configurations fail to initialize
replay info, resulting in OOPS. Fix from Wei Yongjun.
2) L2TP marks l2tp_eth_net_ops as __net_initdata causing OOPS
on module unload, fix from James Chapman.
3) lock_kernel removal regression fixes from Eric Dumazet and
Arnd Bergmann. Both IPX and Appletalk could release a socket
while holding that socket's lock.
4) C_CAN driver enables interrupts before chip is actually ready,
fix from Jan Altenberg.
5) Use after free in macvlan, fix from Eric W. Biederman.
6) ipv6 creates dup "neigh" sysfs directories, also from Eric
W. Biederman.
7) VETH over-increments TX/RX byte counters, also from Eric
W. Biederman.
8) Two IPVS bug fixes:
a) Reverse NULL check after allocation, from Eric Dumazet.
b) mutex lockdep key invalidly in dynamic memory, fix from
Simon Horman.
Please pull, thanks a lot:
The following changes since commit a44f99c7efdb88fa41128065c9a9445c19894e34:
Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6 (2011-03-20 18:14:55 -0700)
are available in the git repository at:
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6.git master
Alex Dubov (1):
gianfar: Fall back to software tcp/udp checksum on older controllers
Arnd Bergmann (1):
net/appletalk: fix atalk_release use after free
Ben Hutchings (1):
ethtool: Compat handling for struct ethtool_rxnfc
Dan Carpenter (1):
ftmac100: use resource_size()
David S. Miller (3):
niu: Rename NIU parent platform device name to fix conflict.
Merge branch 'master' of git://git.kernel.org/.../kaber/nf-2.6
Merge branch 'vhost-net-next' of git://git.kernel.org/.../mst/vhost
Eric Dumazet (6):
vlan: should take into account needed_headroom
r8169: fix a bug in rtl8169_init_phy()
netfilter: xtables: fix reentrancy
snmp: SNMP_UPD_PO_STATS_BH() always called from softirq
ipx: fix ipx_release()
ipvs: fix a typo in __ip_vs_control_init()
Eric W. Biederman (3):
macvlan: Fix use after free of struct macvlan_port.
net ipv6: Fix duplicate /proc/sys/net/ipv6/neigh directory entries.
veth: Fix the byte counters
Herbert Xu (1):
bridge: Reset IPCB when entering IP stack on NF_FORWARD
James Chapman (1):
l2tp: fix possible oops on l2tp_eth module unload
Jan Altenberg (1):
can: c_can: Do basic c_can configuration _before_ enabling the interrupts
Jason Wang (3):
vhost-net: check the support of mergeable buffer outside the receive loop
vhost-net: Unify the code of mergeable and big buffer handling
vhost: lock receive queue, not the socket
Jozsef Kadlecsik (2):
netfilter: ipset: fix address ranges at hash:*port* types
netfilter: ipset: fix checking the type revision at create command
Krishna Kumar (1):
vhost: Cleanup vhost.c and net.c
Michael S. Tsirkin (2):
vhost: copy_from_user -> __copy_from_user
vhost-net: remove unlocked use of receive_queue
Mike Frysinger (1):
headers: use __aligned_xx types for userspace
Neil Horman (1):
net: fix incorrect spelling in drop monitor protocol
Nicolas de Pesloüan (1):
bonding: fix a typo in a comment
Roger Luethi (1):
ethtool: __ethtool_set_sg: check for function pointer before using it
Simon Horman (1):
IPVS: Use global mutex in ip_vs_app.c
Vasiliy Kulikov (2):
econet: 4 byte infoleak to the network
netfilter: ipt_CLUSTERIP: fix buffer overflow
Wei Yongjun (1):
xfrm: Fix initialize repl field of struct xfrm_state
drivers/net/bonding/bond_main.c | 2 +-
drivers/net/can/c_can/c_can.c | 6 +-
drivers/net/ftmac100.c | 2 +-
drivers/net/gianfar.c | 16 ++-
drivers/net/gianfar.h | 1 +
drivers/net/macvlan.c | 18 ++-
drivers/net/niu.c | 2 +-
drivers/net/r8169.c | 4 +-
drivers/net/veth.c | 2 +-
drivers/vhost/net.c | 159 ++++--------------------
drivers/vhost/vhost.c | 55 ++++++---
include/linux/ethtool.h | 34 +++++
include/linux/if_ppp.h | 16 ++--
include/linux/netfilter/ipset/ip_set_getport.h | 10 ++
include/linux/netfilter/nfnetlink_log.h | 4 +-
include/linux/netfilter/nfnetlink_queue.h | 4 +-
include/linux/netfilter/xt_connbytes.h | 4 +-
include/linux/netfilter/xt_quota.h | 2 +-
include/net/ip_vs.h | 2 -
include/net/snmp.h | 4 +-
include/net/xfrm.h | 1 +
net/8021q/vlan_dev.c | 1 +
net/appletalk/ddp.c | 3 +
net/bridge/br_netfilter.c | 3 +
net/core/drop_monitor.c | 2 +-
net/core/ethtool.c | 3 +
net/econet/af_econet.c | 2 +-
net/ipv4/netfilter/ip_tables.c | 4 +-
net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 +-
net/ipv6/netfilter/ip6_tables.c | 4 +-
net/ipv6/sysctl_net_ipv6.c | 18 ++-
net/ipx/af_ipx.c | 2 +-
net/l2tp/l2tp_eth.c | 2 +-
net/netfilter/ipset/ip_set_core.c | 22 +++-
net/netfilter/ipset/ip_set_hash_ipport.c | 34 ++----
net/netfilter/ipset/ip_set_hash_ipportip.c | 34 ++----
net/netfilter/ipset/ip_set_hash_ipportnet.c | 34 ++----
net/netfilter/ipset/ip_set_hash_netport.c | 30 ++----
net/netfilter/ipvs/ip_vs_app.c | 23 ++--
net/netfilter/ipvs/ip_vs_ctl.c | 2 +-
net/socket.c | 114 ++++++++++++++++-
net/xfrm/xfrm_state.c | 15 ++-
net/xfrm/xfrm_user.c | 2 +-
43 files changed, 383 insertions(+), 324 deletions(-)
^ permalink raw reply
* Re: [slab poison overwritten] Re: [GIT] Networking
From: David Miller @ 2011-03-22 3:40 UTC (permalink / raw)
To: horms
Cc: eric.dumazet, mingo, torvalds, akpm, netdev, linux-kernel,
a.p.zijlstra, tglx, arnd, penberg, ja, hans
In-Reply-To: <20110322011801.GE27019@verge.net.au>
From: Simon Horman <horms@verge.net.au>
Date: Tue, 22 Mar 2011 10:18:01 +0900
> IPVS: Use global mutex in ip_vs_app.c
>
> As part of the work to make IPVS network namespace aware
> __ip_vs_app_mutex was replaced by a per-namespace lock,
> ipvs->app_mutex. ipvs->app_key is also supplied for debugging purposes.
>
> Unfortunately this implementation results in ipvs->app_key residing
> in non-static storage which at the very least causes a lockdep warning.
>
> This patch takes the rather heavy-handed approach of reinstating
> __ip_vs_app_mutex which will cover access to the ipvs->list_head
> of all network namespaces.
...
> Signed-off-by: Simon Horman <horms@verge.net.au>
Applied, thanks Simon.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox