The existing code had the following race:
Thread-1 Thread-2
inc/read in_use
inc/read in_use
inc tx_free_list[qos].len
inc tx_free_list[qos].len
The actual in_use value was incremented twice, but thread-1 is going
to free memory based on its stale value, and will free one too many
times. The result is that memory is freed back to the kernel while
its packet is still in the transmit buffer. If the memory is
overwritten before it is transmitted, the hardware will put a valid
checksum on it and send it out (just like it does with good packets).
If by chance the TCP flags are clobbered but not the addresses or
ports, the result can be a broken TCP stream.
The fix is to track the number of freed packets in a single location
(a Fetch-and-Add Unit register). That way it can never get out of sync
with itself.
We try to free up to MAX_SKB_TO_FREE (currently 10) buffers at a time.
If fewer are available we adjust the free count with the difference.
The action of claiming buffers to free is atomic so two threads cannot
claim the same buffers.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Convert the driver to use net_device_ops as it is now mandatory.
Also compensate for the removal of struct sk_buff's dst field.
The changes are mostly mechanical, the content of ethernet-common.c
was moved to ethernet.c and ethernet-common.{c,h} are removed.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Remove the replicated urban legends from the comments and fix a couple of
other silly calls
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Some of the comedi drivers need timer.h to build properly, so put it
in the comedidev.h file to fix these errors.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
There are others remaining due to the __iomem namespace of the
framebuffer data pointer.
Cc: Roberto De Ioris <roberto@unbit.it>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This cleans up a bunch of checkpatch.pl warnings in the udlfb.c file.
Cc: Roberto De Ioris <roberto@unbit.it>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This cleans up a bunch of checkpatch.pl warnings in the udlfb.h file.
Cc: Roberto De Ioris <roberto@unbit.it>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This adds the udlfb driver, a framebuffer driver for DisplayLink devices.
From: Roberto De Ioris <roberto@unbit.it>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
These comments contribute nothing to the code, and most were just cut
and pasted from another driver.
Cc: Kevin Huang <Kevin.Huang@rdc.com.tw>
Cc: Tomy Wang <Tomy.Wang@rdc.com.tw>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
They are not needed, and the version one was pointless now that the code
is merged into the tree.
Cc: Kevin Huang <Kevin.Huang@rdc.com.tw>
Cc: Tomy Wang <Tomy.Wang@rdc.com.tw>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Use dev_dbg() instead.
Cc: Kevin Huang <Kevin.Huang@rdc.com.tw>
Cc: Tomy Wang <Tomy.Wang@rdc.com.tw>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The "in_module_init" flag was wrong, so just remove it, it's not needed.
Cc: Kevin Huang <Kevin.Huang@rdc.com.tw>
Cc: Tomy Wang <Tomy.Wang@rdc.com.tw>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
struct ata_port_info shouldn't be const, so remove that which fixes up
the compiler warnings.
Cc: Kevin Huang <Kevin.Huang@rdc.com.tw>
Cc: Tomy Wang <Tomy.Wang@rdc.com.tw>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Use the PCI_DEVICE macro, that's what it is there for...
Cc: Kevin Huang <Kevin.Huang@rdc.com.tw>
Cc: Tomy Wang <Tomy.Wang@rdc.com.tw>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Move code around so we do not need the function prototypes anymore.
Cc: Kevin Huang <Kevin.Huang@rdc.com.tw>
Cc: Tomy Wang <Tomy.Wang@rdc.com.tw>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This fixes a number of coding style issues in the pata_rdc.h file
Cc: Kevin Huang <Kevin.Huang@rdc.com.tw>
Cc: Tomy Wang <Tomy.Wang@rdc.com.tw>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This fixes build problems in the pata_rdc driver due to api changes in
the libata layer.
Cc: Kevin Huang <Kevin.Huang@rdc.com.tw>
Cc: Tomy Wang <Tomy.Wang@rdc.com.tw>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is our IDE Source code. This is base on kernel 2.6.28. pata_rdc.h
and pata_rdc.c
From: Kevin Huang <Kevin.Huang@rdc.com.tw>
Cc: Tomy Wang <Tomy.Wang@rdc.com.tw>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Now that Bill rewrote the driver "properly", this old thing can be removed.
Cc: Bill Pemberton <wfp5p@virginia.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is the serqt_usb driver rewritten to use usb-serial.
Signed-off-by: Bill Pemberton <wfp5p@virginia.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The remove function uses __devexit, so the .remove assignment needs
__devexit_p() to fix a build error with hotplug disabled.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The remove function uses __devexit, so the .remove assignment needs
__devexit_p() to fix a build error with hotplug disabled.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
While access file_ext->state, we should use device_lock to protect it. The
original codes miss this in some places.
Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
schedule_work returns 0, if the work is already on the work_queue, else
returns non-zero. Do not print error message if heci_bh_handlerwork was
already on queue.
Signed-off-by: Nikanth Karthikesan <knikanth@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Host software could issue interrupts to ME firmware, using H_IG bit. While
Setting H_IG bit, host software should preserve all the other bits in H_CSR
unchanged. In the original function which sets H_CSR register, they first read
the register, then set some bits, and write the whole 32bits back to the
register. And that the special behavior of H_IS (write-one-to-zero) causes problem.
This patch fixes the issue in the following ways:
- Modify heci_set_csr_register() function so that it doesn't change H_IS bit.
- Add interface heci_csr_clear_his() to clear H_IS bit. This function is called
after H_IS checking (dev->host_hw_state & H_IS == H_IS).
- In original heci_csr_disable_interrupts() function, it not only clears H_IE
bit, sometimes it also clears H_IS bit. This patch separates the two parts.
- Avoid calling write_heci_register() function to set H_CSR register directly,
and instead using heci_set_csr_register() function
Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
- Fix typo for enum HECI_WRITE.
- Fix timeout issue. If the time period is greater or equal 15s, it's timeout.
- Add 10ms wait time after disconnect, to ensure that hardware is ready.
Otherwise in the next time connection, hardware resource may be busy.
Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
When spinlock is nested, and the outside one is spin_lock_bh, the inner
spinlock should also be spin_lock_bh, otherwise it will bring softirq-safe
to softirq-unsafe lock conversion.
Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
In orginal code, the device_lock and read_io_lock is mess order when nested,
which may bring dead lock. This patch unify the spinlock order of device_lock
and read_io_lock. First acquire device_lock, then read_io_lock.
Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
When the two locks are nested, the code should always first acquire file_lock,
and then acquire device_lock in order not to generate dead-lock race.
Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix userspace pointer mess.
- In memcmp(), dest and src pointer should be both in kernel space.
- Add (void __user *) modification before userspace pointer.
Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The patch does copy_to/from_user related fixes
*) __copy_from/to_user is enough for user space data buffer checked by access_ok.
*) return -EFAULT if __copy_from/to_user fails.
*) Do not use memcpy to copy from user space.
Signed-off-by: Vibi Sreenivasan <vibi_sreenivasan@cms.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The patch fixes the following warnings.
drivers/staging/rspiusb/rspiusb.c: In function ‘pixel_data’:
drivers/staging/rspiusb/rspiusb.c:267: warning: passing argument 1 of ‘SetPageDirty’ makes
pointer from integer without a cast
drivers/staging/rspiusb/rspiusb.c: In function ‘UnMapUserBuffer’:
drivers/staging/rspiusb/rspiusb.c:500: warning: passing argument 1 of ‘put_page’ makes
pointer from integer without a cast
drivers/staging/rspiusb/rspiusb.c: In function ‘MapUserBuffer’:
drivers/staging/rspiusb/rspiusb.c:662: warning: assignment makes integer from pointer without a cast
drivers/staging/rspiusb/rspiusb.c:670: warning: assignment makes integer from pointer without a cast
Signed-off-by: Vibi Sreenivasan <vibi_sreenivasan@cms.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
It seems that pixis_io and pixis_io2 should do the same thing.
Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This makes the code more readable, makes checkpatch really happy and factorize some code.
Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Before all testcases, do:
mknod /dev/caphash c 253 0
mknod /dev/capuse c 253 1
This patch does the following:
1. caphash write of > CAP_NODE_SIZE bytes overruns node_ptr->data
(test: cat /etc/mime.types > /dev/caphash)
2. make sure we don't dereference a NULL cap_devices[0].head
(test: cat serge@root@abab > /dev/capuse)
3. don't let strlen dereference a NULL target_user etc
(test: echo ab > /dev/capuse)
4. Don't leak a bunch of memory in cap_write(). Note that
technically node_ptr is not needed for the capuse write case.
As a result I have a much more extensive patch splitting up
cap_write(), but I thought a smaller patch that is easier to test
and verify would be a better start. To test:
cnt=0
while [ 1 ]; do
echo /etc/mime.types > /dev/capuse
if [ $((cnt%25)) -eq 0 ]; then
head -2 /proc/meminfo
fi
cnt=$((cnt+1))
sleep 0.3
done
Without this patch, it MemFree steadily drops. With the patch,
it does not.
I have *not* tested this driver (with or without these patches)
with factotum or anything - only using the tests described above.
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
I have just had a bug fix submitted for Oslec which I have applied to
Oslec SVN. The bug can potentially stops the echo canceller adapting
after a few seconds, although it hasn't caused many problems in
practice.
Signed-off-by: David Rowe <david@rowetel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Correct priority problem in the use of ! and &.
The semantic patch that makes this change is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@@ expression E; constant C; @@
- !E & C
+ !(E & C)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Driver from Realtek for the Realtek RTL8192 USB wifi device
Based on the r8187 driver from Andrea Merello <andreamrl@tiscali.it> and
others.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
David Daney