1. 17 Sep, 2009 10 commits
    • Jarek Poplawski's avatar
      pkt_sched: Fix qstats.qlen updating in dump_stats · a19d2158
      Jarek Poplawski authored
      Some classful qdiscs miss qstats.qlen updating with q.qlen of their
      child qdiscs in dump_stats methods.
      Signed-off-by: default avatarJarek Poplawski <jarkao2@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a19d2158
    • Jens Rosenboom's avatar
      ipv6: Log the affected address when DAD failure occurs · 0522fea6
      Jens Rosenboom authored
      If an interface has multiple addresses, the current message for DAD
      failure isn't really helpful, so this patch adds the address itself to
      the printk.
      Signed-off-by: default avatarJens Rosenboom <me@jayr.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0522fea6
    • Hendrik Brueckner's avatar
      af_iucv: fix race when queueing skbs on the backlog queue · bf95d20f
      Hendrik Brueckner authored
      iucv_sock_recvmsg() and iucv_process_message()/iucv_fragment_skb race
      for dequeuing an skb from the backlog queue.
      
      If iucv_sock_recvmsg() dequeues first, iucv_process_message() calls
      sock_queue_rcv_skb() with an skb that is NULL.
      
      This results in the following kernel panic:
      
      <1>Unable to handle kernel pointer dereference at virtual kernel address (null)
      <4>Oops: 0004 [#1] PREEMPT SMP DEBUG_PAGEALLOC
      <4>Modules linked in: af_iucv sunrpc qeth_l3 dm_multipath dm_mod vmur qeth ccwgroup
      <4>CPU: 0 Not tainted 2.6.30 #4
      <4>Process client-iucv (pid: 4787, task: 0000000034e75940, ksp: 00000000353e3710)
      <4>Krnl PSW : 0704000180000000 000000000043ebca (sock_queue_rcv_skb+0x7a/0x138)
      <4>           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:0 PM:0 EA:3
      <4>Krnl GPRS: 0052900000000000 000003e0016e0fe8 0000000000000000 0000000000000000
      <4>           000000000043eba8 0000000000000002 0000000000000001 00000000341aa7f0
      <4>           0000000000000000 0000000000007800 0000000000000000 0000000000000000
      <4>           00000000341aa7f0 0000000000594650 000000000043eba8 000000003fc2fb28
      <4>Krnl Code: 000000000043ebbe: a7840006            brc     8,43ebca
      <4>           000000000043ebc2: 5930c23c            c       %r3,572(%r12)
      <4>           000000000043ebc6: a724004c            brc     2,43ec5e
      <4>          >000000000043ebca: e3c0b0100024        stg     %r12,16(%r11)
      <4>           000000000043ebd0: a7190000            lghi    %r1,0
      <4>           000000000043ebd4: e310b0200024        stg     %r1,32(%r11)
      <4>           000000000043ebda: c010ffffdce9        larl    %r1,43a5ac
      <4>           000000000043ebe0: e310b0800024        stg     %r1,128(%r11)
      <4>Call Trace:
      <4>([<000000000043eba8>] sock_queue_rcv_skb+0x58/0x138)
      <4> [<000003e0016bcf2a>] iucv_process_message+0x112/0x3cc [af_iucv]
      <4> [<000003e0016bd3d4>] iucv_callback_rx+0x1f0/0x274 [af_iucv]
      <4> [<000000000053a21a>] iucv_message_pending+0xa2/0x120
      <4> [<000000000053b5a6>] iucv_tasklet_fn+0x176/0x1b8
      <4> [<000000000014fa82>] tasklet_action+0xfe/0x1f4
      <4> [<0000000000150a56>] __do_softirq+0x116/0x284
      <4> [<0000000000111058>] do_softirq+0xe4/0xe8
      <4> [<00000000001504ba>] irq_exit+0xba/0xd8
      <4> [<000000000010e0b2>] do_extint+0x146/0x190
      <4> [<00000000001184b6>] ext_no_vtime+0x1e/0x22
      <4> [<00000000001fbf4e>] kfree+0x202/0x28c
      <4>([<00000000001fbf44>] kfree+0x1f8/0x28c)
      <4> [<000000000044205a>] __kfree_skb+0x32/0x124
      <4> [<000003e0016bd8b2>] iucv_sock_recvmsg+0x236/0x41c [af_iucv]
      <4> [<0000000000437042>] sock_aio_read+0x136/0x160
      <4> [<0000000000205e50>] do_sync_read+0xe4/0x13c
      <4> [<0000000000206dce>] vfs_read+0x152/0x15c
      <4> [<0000000000206ed0>] SyS_read+0x54/0xac
      <4> [<0000000000117c8e>] sysc_noemu+0x10/0x16
      <4> [<00000042ff8def3c>] 0x42ff8def3c
      Signed-off-by: default avatarHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bf95d20f
    • Hendrik Brueckner's avatar
      af_iucv: do not call iucv_sock_kill() twice · 7514bab0
      Hendrik Brueckner authored
      For non-accepted sockets on the accept queue, iucv_sock_kill()
      is called twice (in iucv_sock_close() and iucv_sock_cleanup_listen()).
      This typically results in a kernel oops as shown below.
      
      Remove the duplicate call to iucv_sock_kill() and set the SOCK_ZAPPED
      flag in iucv_sock_close() only.
      
      The iucv_sock_kill() function frees a socket only if the socket is zapped
      and orphaned (sk->sk_socket == NULL):
        - Non-accepted sockets are always orphaned and, thus, iucv_sock_kill()
          frees the socket twice.
        - For accepted sockets or sockets created with iucv_sock_create(),
          sk->sk_socket is initialized. This caused the first call to
          iucv_sock_kill() to return immediately. To free these sockets,
          iucv_sock_release() uses sock_orphan() before calling iucv_sock_kill().
      
      <1>Unable to handle kernel pointer dereference at virtual kernel address 000000003edd3000
      <4>Oops: 0011 [#1] PREEMPT SMP DEBUG_PAGEALLOC
      <4>Modules linked in: af_iucv sunrpc qeth_l3 dm_multipath dm_mod qeth vmur ccwgroup
      <4>CPU: 0 Not tainted 2.6.30 #4
      <4>Process iucv_sock_close (pid: 2486, task: 000000003aea4340, ksp: 000000003b75bc68)
      <4>Krnl PSW : 0704200180000000 000003e00168e23a (iucv_sock_kill+0x2e/0xcc [af_iucv])
      <4>           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:2 PM:0 EA:3
      <4>Krnl GPRS: 0000000000000000 000000003b75c000 000000003edd37f0 0000000000000001
      <4>           000003e00168ec62 000000003988d960 0000000000000000 000003e0016b0608
      <4>           000000003fe81b20 000000003839bb58 00000000399977f0 000000003edd37f0
      <4>           000003e00168b000 000003e00168f138 000000003b75bcd0 000000003b75bc98
      <4>Krnl Code: 000003e00168e22a: c0c0ffffe6eb	larl	%r12,3e00168b000
      <4>           000003e00168e230: b90400b2		lgr	%r11,%r2
      <4>           000003e00168e234: e3e0f0980024	stg	%r14,152(%r15)
      <4>          >000003e00168e23a: e310225e0090	llgc	%r1,606(%r2)
      <4>           000003e00168e240: a7110001		tmll	%r1,1
      <4>           000003e00168e244: a7840007		brc	8,3e00168e252
      <4>           000003e00168e248: d507d00023c8	clc	0(8,%r13),968(%r2)
      <4>           000003e00168e24e: a7840009		brc	8,3e00168e260
      <4>Call Trace:
      <4>([<000003e0016b0608>] afiucv_dbf+0x0/0xfffffffffffdea20 [af_iucv])
      <4> [<000003e00168ec6c>] iucv_sock_close+0x130/0x368 [af_iucv]
      <4> [<000003e00168ef02>] iucv_sock_release+0x5e/0xe4 [af_iucv]
      <4> [<0000000000438e6c>] sock_release+0x44/0x104
      <4> [<0000000000438f5e>] sock_close+0x32/0x50
      <4> [<0000000000207898>] __fput+0xf4/0x250
      <4> [<00000000002038aa>] filp_close+0x7a/0xa8
      <4> [<00000000002039ba>] SyS_close+0xe2/0x148
      <4> [<0000000000117c8e>] sysc_noemu+0x10/0x16
      <4> [<00000042ff8deeac>] 0x42ff8deeac
      Signed-off-by: default avatarHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7514bab0
    • Hendrik Brueckner's avatar
      af_iucv: handle non-accepted sockets after resuming from suspend · 56a73de3
      Hendrik Brueckner authored
      After resuming from suspend, all af_iucv sockets are disconnected.
      Ensure that iucv_accept_dequeue() can handle disconnected sockets
      which are not yet accepted.
      Signed-off-by: default avatarHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      56a73de3
    • Hendrik Brueckner's avatar
      af_iucv: fix race in __iucv_sock_wait() · d9973179
      Hendrik Brueckner authored
      Moving prepare_to_wait before the condition to avoid a race between
      schedule_timeout and wake up.
      The race can appear during iucv_sock_connect() and iucv_callback_connack().
      Signed-off-by: default avatarHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d9973179
    • Hendrik Brueckner's avatar
      iucv: use correct output register in iucv_query_maxconn() · b29e4da4
      Hendrik Brueckner authored
      The iucv_query_maxconn() function uses the wrong output register and
      stores the size of the interrupt buffer instead of the maximum number
      of connections.
      
      According to the QUERY IUCV function, general register 1 contains the
      maximum number of connections.
      
      If the maximum number of connections is not set properly, the following
      warning is displayed:
      
      Badness at /usr/src/kernel-source/2.6.30-39.x.20090806/net/iucv/iucv.c:1808
      Modules linked in: netiucv fsm af_iucv sunrpc qeth_l3 dm_multipath dm_mod vmur qeth ccwgroup
      CPU: 0 Tainted: G        W  2.6.30 #4
      Process seq (pid: 16925, task: 0000000030e24a40, ksp: 000000003033bd98)
      Krnl PSW : 0404200180000000 000000000053b270 (iucv_external_interrupt+0x64/0x224)
                 R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:0 CC:2 PM:0 EA:3
      Krnl GPRS: 00000000011279c2 00000000014bdb70 0029000000000000 0000000000000029
                 000000000053b236 000000000001dba4 0000000000000000 0000000000859210
                 0000000000a67f68 00000000008a6100 000000003f83fb90 0000000000004000
                 000000003f8c7bc8 00000000005a2250 000000000053b236 000000003fc2fe08
      Krnl Code: 000000000053b262: e33010000021	clg	%r3,0(%r1)
                 000000000053b268: a7440010		brc	4,53b288
                 000000000053b26c: a7f40001		brc	15,53b26e
                >000000000053b270: c03000184134	larl	%r3,8434d8
                 000000000053b276: eb220030000c	srlg	%r2,%r2,48
                 000000000053b27c: eb6ff0a00004	lmg	%r6,%r15,160(%r15)
                 000000000053b282: c0f4fffff6a7	brcl	15,539fd0
                 000000000053b288: 4310a003		ic	%r1,3(%r10)
      Call Trace:
      ([<000000000053b236>] iucv_external_interrupt+0x2a/0x224)
       [<000000000010e09e>] do_extint+0x132/0x190
       [<00000000001184b6>] ext_no_vtime+0x1e/0x22
       [<0000000000549f7a>] _spin_unlock_irqrestore+0x96/0xa4
      ([<0000000000549f70>] _spin_unlock_irqrestore+0x8c/0xa4)
       [<00000000002101d6>] pipe_write+0x3da/0x5bc
       [<0000000000205d14>] do_sync_write+0xe4/0x13c
       [<0000000000206a7e>] vfs_write+0xae/0x15c
       [<0000000000206c24>] SyS_write+0x54/0xac
       [<0000000000117c8e>] sysc_noemu+0x10/0x16
       [<00000042ff8defcc>] 0x42ff8defcc
      Signed-off-by: default avatarHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b29e4da4
    • Hendrik Brueckner's avatar
      iucv: fix iucv_buffer_cpumask check when calling IUCV functions · d28ecab0
      Hendrik Brueckner authored
      Prior to calling IUCV functions, the DECLARE BUFFER function must have been
      called for at least one CPU to receive IUCV interrupts.
      
      With commit "iucv: establish reboot notifier" (6c005961), a check has been
      introduced to avoid calling IUCV functions if the current CPU does not have
      an interrupt buffer declared.
      Because one interrupt buffer is sufficient, change the condition to ensure
      that one interrupt buffer is available.
      
      In addition, checking the buffer on the current CPU creates a race with
      CPU up/down notifications: before checking the buffer, the IUCV function
      might be interrupted by an smp_call_function() that retrieves the interrupt
      buffer for the current CPU.
      When the IUCV function continues, the check fails and -EIO is returned. If a
      buffer is available on any other CPU, the IUCV function call must be invoked
      (instead of failing with -EIO).
      Signed-off-by: default avatarHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d28ecab0
    • Ursula Braun's avatar
      iucv: suspend/resume error msg for left over pathes · 4c89d86b
      Ursula Braun authored
      During suspend IUCV exploiters have to close their IUCV connections.
      When restoring an image, it can be checked if all IUCV pathes had
      been closed before the Linux instance was suspended. If not, an
      error message is issued to indicate a problem in one of the
      used programs exploiting IUCV communication.
      Signed-off-by: default avatarUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4c89d86b
    • Jens Rosenboom's avatar
      ipv6: Ignore route option with ROUTER_PREF_INVALID · 3933fc95
      Jens Rosenboom authored
      RFC4191 says that "If the Reserved (10) value is received, the Route
      Information Option MUST be ignored.", so this patch makes us conform
      to the RFC. This is different to the usage of the Default Router
      Preference, where an invalid value must indeed be treated as
      PREF_MEDIUM.
      Signed-off-by: default avatarJens Rosenboom <me@jayr.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3933fc95
  2. 16 Sep, 2009 5 commits
  3. 15 Sep, 2009 20 commits
  4. 14 Sep, 2009 2 commits
  5. 11 Sep, 2009 3 commits