Commit graph

27088 commits

Author SHA1 Message Date
Santiago Leon 860f242eb5 [PATCH] ibmveth change buffer pools dynamically
This patch provides a sysfs interface to change some properties of the
ibmveth buffer pools (size of the buffers, number of buffers per pool,
and whether a pool is active).  Ethernet drivers use ethtool to provide
this type of functionality.  However, the buffers in the ibmveth driver
can have an arbitrary size (not only regular, mini, and jumbo which are
the only sizes that ethtool can change), and also ibmveth can have an
arbitrary number of buffer pools

Under heavy load we have seen dropped packets which obviously kills TCP
performance.  We have created several fixes that mitigate this issue,
but we definitely need a way of changing the number of buffers for an
adapter dynamically.  Also, changing the size of the buffers allows
users to change the MTU to something big (bigger than a jumbo frame)
greatly improving performance on partition to partition transfers.

The patch creates directories pool1...pool4 in the device directory in
sysfs, each with files: num, size, and active (which default to the
values in the mainline version).

Comments and suggestions are welcome...
--
Santiago A. Leon
Power Linux Development
IBM Linux Technology Center

Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-05-24 01:30:37 -04:00
Adrian Bunk 7b32a31289 [PATCH] drivers/net/s2io.c: make bus_speed[] static
On Mon, May 15, 2006 at 12:56:37AM -0700, Andrew Morton wrote:
>...
> Changes since 2.6.17-rc3-mm1:
>...
>  git-netdev-all.patch
>...
>  git trees
>...

This patch makes the needlessly global bus_speed[] static.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-05-24 01:28:14 -04:00
Jeff Garzik 75ac6ae818 Merge branch 'upstream-fixes' into upstream 2006-05-24 01:28:05 -04:00
Stephen Hemminger a1433ac4ab [PATCH] sky2: fix jumbo packet support
The truncate threshold calculation to prevent receiver from getting stuck
was incorrect, and it didn't take into account the upper limit on bits
in the register so the jumbo packet support was broken.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-05-24 00:36:09 -04:00
Jeff Garzik db21e578e5 Merge branch 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream 2006-05-24 00:29:57 -04:00
Jeff Garzik 6ed14254cb [netdrvr pcnet_cs, myri] trim trailing whitespace 2006-05-24 00:28:37 -04:00
Marcin Juszkiewicz cf393ebed0 [PATCH] pcnet_cs: Add TRENDnet TE-CF100 ethernet adapter ID
Add TRENDnet TE-CF100 ethernet adapter to pcnet_cs list.

product info: "Fast Ethernet", "CF Size PC Card", "1.0", ""
 manfid: 0x0149, 0xc1ab

Signed-off-by: Marcin Juszkiewicz <openembedded@hrw.one.pl>

 drivers/net/pcmcia/pcnet_cs.c |    2 ++
 1 file changed, 2 insertions(+)
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-05-24 00:27:31 -04:00
Brice Goglin 0da34b6dfe [PATCH] Add Myri-10G Ethernet driver
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Andrew J. Gallatin <gallatin@myri.com>

 drivers/net/Kconfig                            |   17
 drivers/net/Makefile                           |    1
 drivers/net/myri10ge/Makefile                  |    5
 drivers/net/myri10ge/myri10ge.c                | 2851 +++++++++++++++
 drivers/net/myri10ge/myri10ge_mcp.h            |  205 +
 drivers/net/myri10ge/myri10ge_mcp_gen_header.h |   58
 include/linux/pci_ids.h                        |    1
 7 files changed, 3138 insertions(+)
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-05-24 00:27:31 -04:00
Brice Goglin 3a720d726a [PATCH] Revive pci_find_ext_capability
This patch revives pci_find_ext_capability (has been disabled a couple month
ago since it was not used anywhere. See http://lkml.org/lkml/2006/1/20/247).
It will now be used by the myri10ge driver.

Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Andrew J. Gallatin <gallatin@myri.com>

 drivers/pci/pci.c   |    3 +--
 include/linux/pci.h |    2 ++
 2 files changed, 3 insertions(+), 2 deletions(-)
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-05-24 00:27:31 -04:00
Jeff Garzik d99ef36ed7 Merge branch 'master' into upstream 2006-05-24 00:27:05 -04:00
Stephen Hemminger 387e2b0439 [BRIDGE]: need to ref count the LLC sap
Bridge will OOPS on removal if other application has the SAP open.
The bridge SAP might be shared with other usages, so need
to do reference counting on module removal rather than explicit
close/delete.

Since packet might arrive after or during removal, need to clear
the receive function handle, so LLC only hands it to user (if any).

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-23 15:20:25 -07:00
Chris Wright 4a06373913 [NETFILTER]: SNMP NAT: fix memleak in snmp_object_decode
If kmalloc fails, error path leaks data allocated from asn1_oid_decode().

Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-23 15:15:13 -07:00
Patrick McHardy 4d942d8b39 [NETFILTER]: H.323 helper: fix sequence extension parsing
When parsing unknown sequence extensions the "son"-pointer points behind
the last known extension for this type, don't try to interpret it.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-23 15:15:10 -07:00
Patrick McHardy 7185989db4 [NETFILTER]: H.323 helper: fix parser error propagation
The condition "> H323_ERROR_STOP" can never be true since H323_ERROR_STOP
is positive and is the highest possible return code, while real errors are
negative, fix the checks. Also only abort on real errors in some spots
that were just interpreting any return value != 0 as error.

Fixes crashes caused by use of stale data after a parsing error occured:

BUG: unable to handle kernel paging request at virtual address bfffffff
 printing eip:
c01aa0f8
*pde = 1a801067
*pte = 00000000
Oops: 0000 [#1]
PREEMPT
Modules linked in: ip_nat_h323 ip_conntrack_h323 nfsd exportfs sch_sfq sch_red cls_fw sch_hfsc  xt_length ipt_owner xt_MARK iptable_mangle nfs lockd sunrpc pppoe pppoxx
CPU:    0
EIP:    0060:[<c01aa0f8>]    Not tainted VLI
EFLAGS: 00210646   (2.6.17-rc4 #8)
EIP is at memmove+0x19/0x22
eax: d77264e9   ebx: d77264e9   ecx: e88d9b17   edx: d77264e9
esi: bfffffff   edi: bfffffff   ebp: de6a7680   esp: c0349db8
ds: 007b   es: 007b   ss: 0068
Process asterisk (pid: 3765, threadinfo=c0349000 task=da068540)
Stack: <0>00000006 c0349e5e d77264e3 e09a2b4e e09a38a0 d7726052 d7726124 00000491
       00000006 00000006 00000006 00000491 de6a7680 d772601e d7726032 c0349f74
       e09a2dc2 00000006 c0349e5e 00000006 00000000 d76dda28 00000491 c0349f74
Call Trace:
 [<e09a2b4e>] mangle_contents+0x62/0xfe [ip_nat]
 [<e09a2dc2>] ip_nat_mangle_tcp_packet+0xa1/0x191 [ip_nat]
 [<e0a2712d>] set_addr+0x74/0x14c [ip_nat_h323]
 [<e0ad531e>] process_setup+0x11b/0x29e [ip_conntrack_h323]
 [<e0ad534f>] process_setup+0x14c/0x29e [ip_conntrack_h323]
 [<e0ad57bd>] process_q931+0x3c/0x142 [ip_conntrack_h323]
 [<e0ad5dff>] q931_help+0xe0/0x144 [ip_conntrack_h323]
...

Found by the PROTOS c07-h2250v4 testsuite.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-23 15:15:08 -07:00
Jeff Garzik bdad69b23c Merge branch 'e1000-7.0.38-k4' of git://lost.foo-projects.org/~ahkok/git/netdev-2.6 into upstream 2006-05-23 17:21:33 -04:00
Jeff Garzik 9528454f9c Merge branch 'master' into upstream 2006-05-23 17:20:58 -04:00
Auke Kok 440c052d6f e1000: bump version to 7.0.38-k4
Signed-off-by: Auke Kok <auke.jan.h.kok@intel.com>
2006-05-23 13:36:19 -07:00
Auke Kok fdf35d3c49 e1000: remove changelog in driver
This honours the request to remove the changelog in the driver code.

Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
2006-05-23 13:36:14 -07:00
Auke Kok a1943b5a79 e1000: Fix date string in Makefile
I forgot to update the date string in the Makefile last time.

Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
2006-05-23 13:36:10 -07:00
Auke Kok 76c224bc9f e1000: remove leading and trailing whitespace.
Some leading and trailing whitespace made it into the driver code here.

Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
2006-05-23 13:36:06 -07:00
Auke Kok a42a507cd3 e1000: remove backslash r debug printfs
This removes unwanted characters in the debug output that should have
never been there.

Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
2006-05-23 13:36:01 -07:00
Auke Kok c653e6351e e1000: add shutdown handler back to fix WOL
Someone was waaay too aggressive and removed e1000's reboot notifier
instead of porting it to the new way of the shutdown handler.  This change
broke wake on lan.  Add the shutdown handler back in using the same method
as e100 uses.

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
2006-05-23 13:35:57 -07:00
Mauro Carvalho Chehab 14ba3e7b31 V4L/DVB (4041): Fix compilation on PPC 64
Those functions don't exist on PPC64 architecture.

Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
2006-05-23 16:08:29 -03:00
Jean Delvare 8b6c879c81 V4L/DVB (4040a): Fix the following section warnings:
reference to .init.text: from .text between 'dvb_bt8xx_probe'
(at offset 0x122c) and 'dvb_bt8xx_remove'
reference to .init.text: from .text between 'dvb_bt8xx_probe'
(at offset 0x1267) and 'dvb_bt8xx_remove'

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
2006-05-23 15:56:50 -03:00
Manu Abraham 3c2c54910f V4L/DVB (4037): Make the bridge devices that depend on I2C dependant on I2C
Ref: Bugzilla 6179, 6589

Signed-off-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
2006-05-23 15:56:38 -03:00
Adrian Bunk 9d8a51f801 V4L/DVB (3927): Fix VIDEO_DEV=m, VIDEO_V4L1_COMPAT=y
If CONFIG_VIDEO_DEV=m and CONFIG_VIDEO_V4L1_COMPAT=y, v4l1-compat should
be built as a module (currently, it isn't built at all leading to
problems with modules using it).

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
2006-05-23 15:56:20 -03:00
Linus Torvalds 1faadface9 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: Respect gfp_t argument to dma_alloc_coherent().
2006-05-23 10:40:43 -07:00
Linus Torvalds 9cfe864842 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NETFILTER]: SNMP NAT: fix memory corruption
  [IRDA]: fixup type of ->lsap_state
  [IRDA]: fix 16/32 bit confusion
  [NET]: Fix "ntohl(ntohs" bugs
  [BNX2]: Use kmalloc instead of array
  [BNX2]: Fix bug in bnx2_nvram_write()
  [TG3]: Add some missing rx error counters
2006-05-23 10:40:19 -07:00
Jens Axboe fd0ff8aa1d [PATCH] blk: fix gendisk->in_flight accounting during barrier sequence
While executing barrrier sequence, the bar_rq which carries actual
write was accounted as normal IO on completion, while it wasn't on
queueing.  This caused gendisk->in_flight to be decremented by 1 after
each barrier thus messed up statistics.

This patch makes bar_rq not accounted as normal IO.  As the containing
barrier request as a whole is accounted, part of it shouldn't be.

Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-23 10:39:43 -07:00
David Woodhouse 0f04108237 [PATCH] powerpc: wire up sys_[gs]et_robust_list
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Paul Mackerras <paulus@samba.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-23 10:35:32 -07:00
David Woodhouse b471f55427 [PATCH] powerpc: check Cell SPU syscall number range _before_ using it
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Paul Mackerras <paulus@samba.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-23 10:35:32 -07:00
David Woodhouse 5a4fa16396 [PATCH] powerpc: fill hole in Cell SPU syscall table
Syscall number 224 was absent from the table, which I believe means that
the SPU can cause an oops by attempting to use it.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Paul Mackerras <paulus@samba.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-23 10:35:32 -07:00
Florin Malita bb6e093da2 [PATCH] orinoco: possible null pointer dereference in orinoco_rx_monitor()
If the skb allocation fails, the current error path calls
dev_kfree_skb_irq() with a NULL argument.  Also, 'err' is not being used.

Coverity CID: 275.

Signed-off-by: Florin Malita <fmalita@gmail.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-23 10:35:32 -07:00
Pavel Machek 30d6b2f374 [PATCH] swsusp: fix typo in cr0 handling
Writing cr0 to cr2 register can't be right.  This fixes the typo.  I wonder
how it could survive so long.

Signed-off-by: Pavel Machek <pavel@suse.cz>
Cc: Zachary Amsden <zach@vmware.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-23 10:35:32 -07:00
Tobias Powalowski ff4547f4aa [PATCH] tty_insert_flip_string_flags() license fix
We still don't have the tty layer licensing compatibility quite right.

tty_insert_flip_char() used to be inlined in include/linux/tty_flip.h.  It
is now out-of-lined and hence needs EXPORT_SYMBOL() to be back-compatible.

One known offender is the Intel Modem driver.

Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-23 10:35:31 -07:00
NeilBrown a2eb0c101d [PATCH] md: Make sure bi_max_vecs is set properly in bio_split
Else a subsequent bio_clone might make a mess.

Signed-off-by: Neil Brown <neilb@suse.de>
Cc: "Don Dupuis" <dondster@gmail.com>
Acked-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-23 10:35:31 -07:00
NeilBrown 5c4c33318d [PATCH] md: fix possible oops when starting a raid0 array
This loop that sets up the hash_table has problems.

Careful examination will show that the last time through, everything but
the first line is pointless.  This is because all it does is change 'cur'
and 'size' and neither of these are used after the loop.  This should ring
warning bells...  That last time through the loop,

        size += conf->strip_zone[cur].size

can index off the end of the strip_zone array.  Depending on what it finds
there, it might exit the loop cleanly, or it might spin going further and
further beyond the array until it hits an unmapped address.

This patch rearranges the code so that the last, pointless, iteration of
the loop never happens.  i.e.  the one statement of the last loop that is
needed is moved the the end of the previous loop - or to before the loop
starts - and the loop counter starts from 1 instead of 0.

Cc: "Don Dupuis" <dondster@gmail.com>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-23 10:35:31 -07:00
NeilBrown f2d395865f [PATCH] knfsd: Fix two problems that can cause rmmod nfsd to die
Both cause the 'entries' count in the export cache to be non-zero at module
removal time, so unregistering that cache fails and results in an oops.

1/ exp_pseudoroot (used for NFSv4 only) leaks a reference to an export
   entry.
2/ sunrpc_cache_update doesn't increment the entries count when it adds
   an entry.

Thanks to "david m.  richter" <richterd@citi.umich.edu> for triggering the
problem and finding one of the bugs.

Cc: "david m. richter" <richterd@citi.umich.edu>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-23 10:35:31 -07:00
Andrew Morton e46e490368 [PATCH] sys_sync_file_range(): move exported flags outside __KERNEL__
These flags are needed by userspace - move them outside __KERNEL__

(Pointed out by dwmw2)

Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-23 10:35:31 -07:00
Auke Kok 777e1d4a0f ixgb: increment version to 1.0.104-k2
Increment the driver version to 1.0.104-k2

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: John Ronciak <john.ronciak@intel.com>
2006-05-23 10:35:08 -07:00
Auke Kok 9b8118df48 ixgb: add tx timeout counter
This adds a TX timeout counter to the ethtool stats, a tx timeout
debug message, and sets the timer to 5 seconds.

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: John Ronciak <john.ronciak@intel.com>
2006-05-23 10:35:04 -07:00
Auke Kok ec9c3f5d3b ixgb: use DPRINTK and msglvl, and ethtool to control it
Use DPRINTK and msglvl, and ethtool to control it. Add proper names
to netdev structs and mappings.

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: John Ronciak <john.ronciak@intel.com>
2006-05-23 10:34:59 -07:00
Auke Kok c85fd6f0de ixgb: remove hardcoded number
This adds a define for an awkward and uncommented value.

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: John Ronciak <john.ronciak@intel.com>
2006-05-23 10:30:02 -07:00
Auke Kok 940829e2f9 ixgb: add copper 10gig driver id
Add support for Copper 10GbE device ID 109E

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: John Ronciak <john.ronciak@intel.com>
2006-05-23 10:29:58 -07:00
Auke Kok f017f14b3f ixgb: add NETIF_F_LLTX analogous to e1000
add NETIF_F_LLTX code like e1000 has

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: John Ronciak <john.ronciak@intel.com>
2006-05-23 10:29:53 -07:00
Auke Kok 953784d66d ixgb: fix flow control
Make default flow control only have *sending* of flow control packets
enabled, and fix to disable / enable flow control correctly. Set flow
control defaults to disable receiving flow control from the link
partner, to fix the transmit fifo overlow errata

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: John Ronciak <john.ronciak@intel.com>
2006-05-23 10:29:50 -07:00
Auke Kok 4de17c8c72 ixgb: remove duplicate code setting duplex and speed
Removed duplicate code.  Create ixgb_set_speed_duplex function to contain
duplicate code.

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: John Ronciak <john.ronciak@intel.com>
2006-05-23 10:29:46 -07:00
Auke Kok 96f9c2e277 ixgb: fix rare early tso completion
Fix rare early completion when using TSO.  This essentially is the
e1000 fix, with code that was mostly already written. Another skb frag
was also needed.

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: John Ronciak <john.ronciak@intel.com>
2006-05-23 10:29:41 -07:00
David S. Miller 42f142371e [SPARC64]: Respect gfp_t argument to dma_alloc_coherent().
Using asm-generic/dma-mapping.h does not work because pushing
the call down to pci_alloc_coherent() causes the gfp_t argument
of dma_alloc_coherent() to be ignored.

Fix this by implementing things directly, and adding a gfp_t
argument we can use in the internal call down to the PCI DMA
implementation of pci_alloc_coherent().

This fixes massive memory corruption when using the sound driver
layer, which passes things like __GFP_COMP down into these
routines and (correctly) expects that to work.

Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-23 02:07:22 -07:00
Patrick McHardy f41d5bb1d9 [NETFILTER]: SNMP NAT: fix memory corruption
Fix memory corruption caused by snmp_trap_decode:

- When snmp_trap_decode fails before the id and address are allocated,
  the pointers contain random memory, but are freed by the caller
  (snmp_parse_mangle).

- When snmp_trap_decode fails after allocating just the ID, it tries
  to free both address and ID, but the address pointer still contains
  random memory. The caller frees both ID and random memory again.

- When snmp_trap_decode fails after allocating both, it frees both,
  and the callers frees both again.

The corruption can be triggered remotely when the ip_nat_snmp_basic
module is loaded and traffic on port 161 or 162 is NATed.

Found by multiple testcases of the trap-app and trap-enc groups of the
PROTOS c06-snmpv1 testsuite.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-22 16:55:14 -07:00