Commit graph

40228 commits

Author SHA1 Message Date
Kaustav Majumdar
4708b5faf7 [PATCH] pcmcia: update alloc_io_space for conflict checking for multifunction PC card
Some PCMCIA cards do not mention specific IO addresses in the CIS.  In that
case, inside the alloc_io_space function, conflicts are detected (the
function returns 1) for the second function of a multifunction card unless
the length of IO address range required is greater than 0x100.

The following patch will remove this conflict checking for a PCMCIA
function which had not mentioned any specific IO address to be mapped from.

The patch is tested for Linux kernel 2.6.15.4 and works fine in the above
case and is as suggested by Dave Hinds.

Signed-off-by: Kaustav Majumdar <kaustav.majumdar@wipro.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2006-10-25 21:59:39 -04:00
Dominik Brodowski
01918d16c8 [PATCH] pcmcia: add more IDs to hostap_cs.c
As a replacement for the broad manufactor/card ID match we commented out
because of conflicts with pcnet_cs, add two product ID matches.

Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2006-10-25 21:59:38 -04:00
David Brownell
1fbece150a [PATCH] pcmcia: at91_cf update
More correct AT91 CF wakeup logic ... only enable/disable the IRQ wakeup
capability, not the IRQ itself.  That way the we know that the IRQ will be
disabled correctly, in suspend/resume logic instead of ARM IRQ code.

Most of the pin multiplexing setup has moved to the devices.c setup code.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Victor <andrew@sanpeople.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2006-10-25 21:59:37 -04:00
Linus Torvalds
9eed286792 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [DCCP]: Update documentation references.
  [ATM] horizon: read_bia() needs to be __devinit
  [NETFILTER]: Fix ip6_tables extension header bypass bug
  [NETFILTER]: Fix ip6_tables protocol bypass bug
  [XFRM]: Fix xfrm_state accounting
  [IPV4] ipconfig: fix RARP ic_servaddr breakage
2006-10-24 22:01:33 -07:00
Al Viro
2099c99e3b [PATCH] missing includes of io.h
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-24 22:01:11 -07:00
Al Viro
016002312d [PATCH] missing include of dma-mapping.h
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-24 22:01:11 -07:00
Al Viro
aa6c2e62bb [PATCH] IOC4 should depend on PCI
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-24 22:01:11 -07:00
Al Viro
3a51237dc1 [PATCH] uml: mconsole fixes
* when we have stop/sysrq/go, we get pt_regs of whatever executes
   mc_work_proc().  Would be better to see what we had at the time of
   interrupt that got us stop.

 * stop/stop/stop.....  will give stack overflow.  Shouldn't allow stop
   from mconsole_stop().

 * stop/stop/go leaves us inside mconsole_stop() with
	os_set_fd_block(req->originating_fd, 0);
	reactivate_fd(req->originating_fd, MCONSOLE_IRQ);
   just done by nested mconsole_stop().  Ditto.

 * once we'd seen stop, there's a period when INTR commands are executed
   out of order (as they should; we might have the things stuck badly
   enough to never reach mconsole_stop(), but still not badly enough to
   block mconsole_interrupt(); in that situation we _want_ things like
   "cad" to be executed immediately).  Once we enter monsole_stop(), all
   INTR commands will be executed in order, mixed with PROC ones.  We'd
   better let user see that such change of behaviour has happened.
   (Suggested by lennert).

 * stack footprint of monsole_interrupt() is an atrocity; AFAICS we can
   safely make struct mc_request req; static in function there.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-24 22:01:10 -07:00
Keith Packard
6c50444723 [PATCH] Merge headphone and speaker volume controls for Panasonic R4 laptop
Signed-off-by: Keith Packard <keithp@neko.keithp.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-24 21:42:50 -07:00
Gerrit Renker
0e64e94e47 [DCCP]: Update documentation references.
Updates the references to spec documents throughout the code, taking into
account that

* the DCCP, CCID 2, and CCID 3 drafts all became RFCs in March this year

* RFC 1063 was obsoleted by RFC 1191

* draft-ietf-tcpimpl-pmtud-0x.txt was published as an Informational
  RFC, RFC 2923 on 2000-09-22.

All references verified.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-24 16:17:51 -07:00
David S. Miller
977a415f2b [ATM] horizon: read_bia() needs to be __devinit
Thanks to Randy Dunlap.

Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-24 16:16:39 -07:00
Patrick McHardy
6d381634d2 [NETFILTER]: Fix ip6_tables extension header bypass bug
As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on extension header matches.

When extension headers occur in the non-first fragment after the fragment
header (possibly with an incorrect nexthdr value in the fragment header)
a rule looking for this extension header will never match.

Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.
Since all extension headers are before the protocol header this makes sure
an extension header is either not present or in the first fragment, where
we can properly parse it.

With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-24 16:15:10 -07:00
Patrick McHardy
51d8b1a652 [NETFILTER]: Fix ip6_tables protocol bypass bug
As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on protocol matches.

When the protocol header doesn't follow the fragment header immediately,
the fragment header contains the protocol number of the next extension
header. When the extension header and the protocol header are sent in
a second fragment a rule like "ip6tables .. -p udp -j DROP" will never
match.

Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.

With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-24 16:14:04 -07:00
Patrick McHardy
2fab22f2d3 [XFRM]: Fix xfrm_state accounting
xfrm_state_num needs to be increased for XFRM_STATE_ACQ states created
by xfrm_state_find() to prevent the counter from going negative when
the state is destroyed.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-24 15:34:00 -07:00
Al Viro
82571026b9 [IPV4] ipconfig: fix RARP ic_servaddr breakage
memcpy 4 bytes to address of auto unsigned long variable followed
by comparison with u32 is a bloody bad idea.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-24 15:18:36 -07:00
Linus Torvalds
7059abedd2 Linux 2.6.19-rc3 2006-10-23 16:02:02 -07:00
Linus Torvalds
6d03a68e6d Merge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog
* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog: (33 commits)
  [WATCHDOG] remove experimental on iTCO_wdt.c
  [WATCHDOG] Atmel AT91RM9200 rename.
  [WATCHDOG] includes for sample watchdog program.
  [WATCHDOG] watchdog/iTCO_wdt: fix bug related to gcc uninit warning
  [WATCHDOG] add ich8 support to iTCO_wdt.c (patch 2)
  [WATCHDOG] add ich8 support to iTCO_wdt.c
  [WATCHDOG] ioremap balanced with iounmap for drivers/char/watchdog/s3c2410_wdt.c
  [WATCHDOG] w83697hf/hg WDT driver - Kconfig patch
  [WATCHDOG] w83697hf/hg WDT driver - autodetect patch
  [WATCHDOG] w83697hf/hg WDT driver - patch 16
  [WATCHDOG] w83697hf/hg WDT driver - patch 15
  [WATCHDOG] w83697hf/hg WDT driver - patch 14
  [WATCHDOG] w83697hf/hg WDT driver - patch 13
  [WATCHDOG] w83697hf/hg WDT driver - patch 12
  [WATCHDOG] w83697hf/hg WDT driver - patch 11
  [WATCHDOG] w83697hf/hg WDT driver - patch 10
  [WATCHDOG] w83697hf/hg WDT driver - patch 9
  [WATCHDOG] w83697hf/hg WDT driver - patch 8
  [WATCHDOG] w83697hf/hg WDT driver - patch 7
  [WATCHDOG] w83697hf/hg WDT driver - patch 6
  ...
2006-10-23 15:56:26 -07:00
Linus Torvalds
0c0e4668e0 Revert unintentional and bogus change to drivers/pci/quirks.c
In commit 4e8a520150 ("[PKT_SCHED] netem:
Orphan SKB when adding to queue.") Davem mistakenly also included a
temporary diff in his tree that disabled the pci_fixup_video VGA quirk,
which broke sparc64.

This reverts that part of the commit. Sayeth Davem:

  "Greg KH has a patch coming to you soon which will move that VGA code
   back into x86/x86_64/IA64 specific areas and will fix the sparc64
   problem properly."

Special thanks to Claudio Martins <ctpm@ist.utl.pt> for noticing the
error in the first place.

Cc: Claudio Martins <ctpm@ist.utl.pt>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-23 14:25:30 -07:00
Russell King
04fed361da [PATCH] Remove __must_check for device_for_each_child()
Eliminate more __must_check madness.

The return code from device_for_each_child() depends on the values
which the helper function returns.  If the helper function always
returns zero, it's utterly pointless to check the return code from
device_for_each_child().

The only code which knows if the return value should be checked is
the caller itself, so forcing the return code to always be checked
is silly.  Hence, remove the __must_check annotation.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-10-23 11:01:33 -07:00
Linus Torvalds
dee6515b6d Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/perex/alsa
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/perex/alsa:
  [ALSA] hda-intel - Add check of MSI availabity
  [ALSA] version 1.0.13
  [ALSA] Fix addition of user-defined boolean controls
  [ALSA] Fix AC97 power-saving mode
  [ALSA] Fix re-use of va_list
  [ALSA] hda_intel: add ATI RS690 HDMI audio support
  [ALSA] hda-codec - Add model entry for ASUS U5F laptop
  [ALSA] Fix dependency of snd-adlib driver in Kconfig
  [ALSA] Various fixes for suspend/resume of ALSA PCI drivers
  [ALSA] hda-codec - Fix assignment of PCM devices for Realtek codecs
  [ALSA] sound/isa/opti9xx/opti92x-ad1848.c: check kmalloc() return value
  [ALSA] sound/isa/ad1816a/ad1816a.c: check kmalloc() return value
  [ALSA] sound/isa/cmi8330.c: check kmalloc() return value
  [ALSA] sound/isa/gus/interwave.c: check kmalloc() return value
2006-10-23 10:58:33 -07:00
Linus Torvalds
73441c665b Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6:
  JFS: pageno needs to be long
2006-10-23 08:25:00 -07:00
Linus Torvalds
d5a92dd437 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [PKT_SCHED] netem: Orphan SKB when adding to queue.
  [NET]: kernel-doc fix for sock.h
  [NET]: Reduce sizeof(struct flowi) by 20 bytes.
  [IPv6] fib: initialize tb6_lock in common place to give lockdep a key
  [ATM] nicstar: Fix a bogus casting warning
  [ATM] firestream: handle thrown error
  [ATM]: No need to return void
  [ATM]: handle sysfs errors
  [DCCP] ipv6: Fix opt_skb leak.
  [DCCP]: Fix Oops in DCCPv6
2006-10-23 07:51:40 -07:00
Linus Torvalds
d0b72a0817 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: 8-byte align return value from compat_alloc_user_space()
2006-10-23 07:51:20 -07:00
Linus Torvalds
2e11665c5e Merge master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6:
  sh: Convert INTC2 to IRQ table registration.
  sh: Updates for irq-flow-type naming changes.
  sh: Add some missing board headers.
  sh: Fix exception_handling_table alignment.
  sh: Cleanup board header directories.
  sh: Remove board-specific ide.h headers.
  sh: Proper show_stack/show_trace() implementation.
2006-10-23 07:50:00 -07:00
Takashi Iwai
68e7fffc0f [ALSA] hda-intel - Add check of MSI availabity
Check the availability of MSI and turn off MSI automatically when it's
not available on the hardware.  MSI seems broken on some hardwares
but the kernel doesn't know exactly, thus we have to turn the MSI
feature off on the sound driver manually.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-23 14:10:34 +02:00
David S. Miller
a94b1d1fd7 [SPARC64]: 8-byte align return value from compat_alloc_user_space()
Otherwise we get a ton of unaligned exceptions, for cases such
as compat_sys_msgrcv() which go:

	p = compat_alloc_user_space(second + sizeof(struct msgbuf));

and here 'second' can for example be an arbitrary odd value.

Based upon a bug report from Jurij Smakov.

Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-22 21:53:30 -07:00
David S. Miller
4e8a520150 [PKT_SCHED] netem: Orphan SKB when adding to queue.
The networking emulator can queue SKBs for a very long
time, so if you're using netem on the sender side for
large bandwidth/delay product testing, the SKB socket
send queue sizes become artificially larger.

Correct this by calling skb_orphan() in netem_enqueue().

Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-22 21:00:33 -07:00
Randy Dunlap
6a43487f43 [NET]: kernel-doc fix for sock.h
Fix kernel-doc warning in include/net/sock.h:
Warning(/var/linsrc/linux-2619-rc1-pv//include/net/sock.h:894): No description found for parameter 'rcu'

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-22 20:38:00 -07:00
Jaroslav Kysela
a5c81b6484 [ALSA] version 1.0.13
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:56:24 +02:00
Takashi Iwai
ef35be7f52 [ALSA] Fix addition of user-defined boolean controls
Fixed the addition of user-defined boolean controls, the private
data size is corrected to be handled properly.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:15 +02:00
Takashi Iwai
da43deb116 [ALSA] Fix AC97 power-saving mode
Fix the bug in AC97 power-saving mode that the power isn't turned on
when power_save is set to 1 via sysfs during the power off state.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:14 +02:00
Takashi Iwai
dbedca39fe [ALSA] Fix re-use of va_list
The va_list is designed to be used only once.  The current code
may pass va_list arguments multiple times and may cause Oops.
Copy/release the arguments temporarily to avoid this problem.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:13 +02:00
Felix Kuehling
5b15c95f88 [ALSA] hda_intel: add ATI RS690 HDMI audio support
This patch adds support for the HDMI codec of the ATI RS690 IGP northbridge.

Signed-off-by: Felix Kuehling <fkuehlin@ati.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:12 +02:00
Takashi Iwai
264e6e3b0c [ALSA] hda-codec - Add model entry for ASUS U5F laptop
Added a model entry for ASUS U5F laptop with AD1986A codec.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:11 +02:00
Takashi Iwai
c9949452f2 [ALSA] Fix dependency of snd-adlib driver in Kconfig
Added the missing dependency on CONFIG_SND for snd-adlib driver.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:10 +02:00
Takashi Iwai
30b35399ce [ALSA] Various fixes for suspend/resume of ALSA PCI drivers
- Check the return value of pci_enable_device() and request_irq()
  in the suspend.  If any error occurs there, disable the device
  using snd_card_disconnect().
- Call pci_set_power_state() properly with pci_choose_state().
- Fix the order to call pci_set_power_state().
- Removed obsolete house-made PM codes in some drivers.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:10 +02:00
Takashi Iwai
c06134d73c [ALSA] hda-codec - Fix assignment of PCM devices for Realtek codecs
Fixed the assignment of PCM devices for Realtek codecs.
The secondary analog capture should be statically asigned to the
third device regardless whether SPDIF exists or not.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:08 +02:00
Amit Choudhary
5019f75ea1 [ALSA] sound/isa/opti9xx/opti92x-ad1848.c: check kmalloc() return value
Check the return value of kmalloc() in function snd_card_opti9xx_pnp(),
in file sound/isa/opti9xx/opti92x-ad1848.c.

Signed-off-by: Amit Choudhary <amit2030@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:07 +02:00
Amit Choudhary
b1e8a791c7 [ALSA] sound/isa/ad1816a/ad1816a.c: check kmalloc() return value
Check the return value of kmalloc() in function snd_card_ad1816a_pnp(),
in file sound/isa/ad1816a/ad1816a.c.

Signed-off-by: Amit Choudhary <amit2030@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:06 +02:00
Amit Choudhary
fbdbb2205a [ALSA] sound/isa/cmi8330.c: check kmalloc() return value
Check the return value of kmalloc() in function snd_cmi8330_pnp(),
in file sound/isa/cmi8330.c.

Signed-off-by: Amit Choudhary <amit2030@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:05 +02:00
Amit Choudhary
4a81a21b60 [ALSA] sound/isa/gus/interwave.c: check kmalloc() return value
Check the return value of kmalloc() in function snd_interwave_pnp(),
in file sound/isa/gus/interwave.c.

Signed-off-by: Amit Choudhary <amit2030@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22 10:51:02 +02:00
Eric Dumazet
185b1aa122 [NET]: Reduce sizeof(struct flowi) by 20 bytes.
As suggested by David, just kill off some unused fields in dnports to
reduce sizef(struct flowi). If they come back, they should be moved to
nl_u.dn_u in order not to enlarge again struct flowi

[ Modified to really delete this stuff instead of using #if 0. -DaveM ]

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-21 20:24:01 -07:00
Thomas Graf
375216ad0c [IPv6] fib: initialize tb6_lock in common place to give lockdep a key
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-21 20:20:54 -07:00
Alan Cox
69c3014763 [ATM] nicstar: Fix a bogus casting warning
Not enough to make Nicstar 64bit friendly but got squashed in passing so might
as well be applied

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-21 19:55:25 -07:00
Jeff Garzik
663bab6fd0 [ATM] firestream: handle thrown error
gcc emits the following warning:

drivers/atm/firestream.c: In function ‘fs_open’:
drivers/atm/firestream.c:870: warning: ‘tmc0’ may be used uninitialized in this function

This indicates a real bug.  We should check make_rate() return value for
potential errors.

Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-21 19:55:24 -07:00
Tobias Klauser
b45eccdb51 [ATM]: No need to return void
The module_exit function has return-type void and pci_unregister_driver()
returns void anyway.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-21 19:55:23 -07:00
Jeff Garzik
97f80bc66f [ATM]: handle sysfs errors
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-21 19:55:22 -07:00
David S. Miller
fd169f15a6 [DCCP] ipv6: Fix opt_skb leak.
Based upon a patch from Jesper Juhl.  Try to match the
TCP IPv6 code this was copied from as much as possible,
so that it's easy to see where to add the ipv6 pktoptions
support code.

Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-21 19:55:21 -07:00
Gerrit Renker
82709531a8 [DCCP]: Fix Oops in DCCPv6
I think I got the cause for the Oops observed in
http://www.mail-archive.com/dccp@vger.kernel.org/msg00578.html

The problem is always with applications listening on PF_INET6 sockets. Apart
from the mentioned oops, I observed another one one, triggered at irregular
intervals via timer interrupt:

    run_timer_softirq -> dccp_keepalive_timer
                      -> inet_csk_reqsk_queue_prune
                      -> reqsk_free
                      -> dccp_v6_reqsk_destructor

The latter function is the problem and is also the last function to be called
in said kernel panic.

In any case, there is a real problem with allocating the right request_sock
which is what this patch tackles.

It fixes the following problem:
 - application listens on PF_INET6
 - DCCPv4 packet comes in, is handed over to dccp_v4_do_rcv, from there
   to dccp_v4_conn_request

Now: socket is PF_INET6, packet is IPv4. The following code then furnishes the
connection with IPv6 - request_sock operations:

   req = reqsk_alloc(sk->sk_prot->rsk_prot);

The first problem is that all further incoming packets will get a Reset since
the connection can not be looked up.

The second problem is worse:
 --> reqsk_alloc is called instead of inet6_reqsk_alloc
 --> consequently inet6_rsk_offset is never set (dangling pointer)
 --> the request_sock_ops are nevertheless still dccp6_request_ops
 --> destructor is called via reqsk_free
 --> dccp_v6_reqsk_destructor tries to free random memory location (inet6_rsk_offset not set)
 --> panic

I have tested this for a while, DCCP sockets are now handled correctly in all
three scenarios (v4/v6 only/v4-mapped).

Commiter note: I've added the dccp_request_sock_ops forward declaration to keep
               the tree building and to reduce the size of the patch for 2.6.19,
               later I'll move the functions to the top of the affected source
               code to match what we have in the TCP counterpart, where this
               problem hasn't existed in the first place, dumb me not to have
               done the same thing on DCCP land 8)

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2006-10-21 19:55:20 -07:00
Linus Torvalds
5cfc35cf79 Merge branch 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6
* 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6:
  [PATCH] x86-64: increase PHB1 split transaction timeout
  [PATCH] x86-64: Fix C3 timer test
2006-10-21 16:52:40 -07:00