linux-toradex.git, branch v2.6.16.53

Linux 2.6.16.53

2007-07-25T21:05:45+00:00

Linux 2.6.16.53-rc1

2007-07-22T17:38:02+00:00

[IPV6]: MSG_ERRQUEUE messages do not pass to connected raw sockets

2007-07-22T16:29:30+00:00

Taken from http://bugzilla.kernel.org/show_bug.cgi?id=8747

Problem Description:

It is related to the possibility to obtain MSG_ERRQUEUE messages from the udp
and raw sockets, both connected and unconnected.

There is a little typo in net/ipv6/icmp.c code, which prevents such messages
to be delivered to the errqueue of the correspond raw socket, when the socket
is CONNECTED.  The typo is due to swap of local/remote addresses.

Consider __raw_v6_lookup() function from net/ipv6/raw.c. When a raw socket is
looked up usual way, it is something like:

sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr, IP6CB(skb)->iif);

where "daddr" is a destination address of the incoming packet (IOW our local
address), "saddr" is a source address of the incoming packet (the remote end).

But when the raw socket is looked up for some icmp error report, in
net/ipv6/icmp.c:icmpv6_notify() , daddr/saddr are obtained from the echoed
fragment of the "bad" packet, i.e.  "daddr" is the original destination
address of that packet, "saddr" is our local address.  Hence, for
icmpv6_notify() must use "saddr, daddr" in its arguments, not "daddr, saddr"
...

Steps to reproduce:

Create some raw socket, connect it to an address, and cause some error
situation: f.e. set ttl=1 where the remote address is more than 1 hop to reach.
Set IPV6_RECVERR .
Then send something and wait for the error (f.e. poll() with POLLERR|POLLIN).
You should receive "time exceeded" icmp message (because of "ttl=1"), but the
socket do not receive it.

If you do not connect your raw socket, you will receive MSG_ERRQUEUE
successfully.  (The reason is that for unconnected socket there are no actual
checks for local/remote addresses).

Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[NET]: Fix gen_estimator timer removal race

2007-07-22T16:26:20+00:00

As noticed by Jarek Poplawski , the timer removal in
gen_kill_estimator races with the timer function rearming the timer.

Check whether the timer list is empty before rearming the timer
in the timer function to fix this.

Signed-off-by: Patrick McHardy 
Acked-by: Jarek Poplawski 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

SCTP: Add scope_id validation for link-local binds

2007-07-22T16:24:56+00:00

SCTP currently permits users to bind to link-local addresses,
but doesn't verify that the scope id specified at bind matches
the interface that the address is configured on.  It was report
that this can hang a system.

Signed-off-by: Vlad Yasevich 
Signed-off-by: Adrian Bunk

[NET] skbuff: remove export of static symbol

2007-07-22T16:11:42+00:00

skb_clone_fraglist is static so it shouldn't be exported.

Signed-off-by: Johannes Berg 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[NETFILTER]: nf_conntrack: don't track locally generated special ICMP error

2007-07-22T16:07:48+00:00

The conntrack assigned to locally generated ICMP error is usually the one
assigned to the original packet which has caused the error. But if
the original packet is handled as invalid by nf_conntrack, no conntrack
is assigned to the original packet. Then nf_ct_attach() cannot assign
any conntrack to the ICMP error packet. In that case the current
nf_conntrack_icmp assigns appropriate conntrack to it. But the current
code mistakes the direction of the packet. As a result, NAT code mistakes
the address to be mangled.

To fix the bug, this changes nf_conntrack_icmp not to assign conntrack
to such ICMP error. Actually no address is necessary to be mangled
in this case.

Spotted by Jordan Russell.

Upstream commit ID: 130e7a83d7ec8c5c673225e0fa8ea37b1ed507a5

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

ide: clear bmdma status in ide_intr() for ICHx controllers (revised #4)

2007-07-22T16:05:44+00:00

patch 1/2 (revised):
- Fix drive->waiting_for_dma to work with CDB-intr devices.
- Do the dma status clearing in ide_intr() and add a new
  hwif->ide_dma_clear_irq for Intel ICHx controllers.

Revised per Alan, Sergei and Bart's advice.

Patch against 2.6.20-rc6. Tested ok on my ICH4 and pdc20275 adapters.
Please review/apply, thanks.

Signed-off-by: Albert Lee 
Signed-off-by: Adrian Bunk

8139too.c: fix netpoll deadlock

2007-07-22T16:03:53+00:00

fix deadlock in the 8139too driver: poll handlers should never forcibly
enable local interrupts, because they might be used by netpoll/printk
from IRQ context.

  =================================
  [ INFO: inconsistent lock state ]
  2.6.19 #11
  ---------------------------------
  inconsistent {softirq-on-W} -> {in-softirq-W} usage.
  swapper/1 [HC0[0]:SC1[1]:HE1:SE0] takes:
   (&npinfo->poll_lock){-+..}, at: [] net_rx_action+0x64/0x1de
  {softirq-on-W} state was registered at:
    [] mark_lock+0x5b/0x39c
    [] mark_held_locks+0x4b/0x68
    [] trace_hardirqs_on+0x115/0x139
    [] rtl8139_poll+0x3d7/0x3f4
    [] netpoll_poll+0x82/0x32f
    [] netpoll_send_skb+0xc9/0x12f
    [] netpoll_send_udp+0x253/0x25b
    [] write_msg+0x40/0x65
    [] __call_console_drivers+0x45/0x51
    [] _call_console_drivers+0x5d/0x61
    [] release_console_sem+0x11f/0x1d8
    [] register_console+0x1ac/0x1b3
    [] init_netconsole+0x55/0x67
    [] init+0x9a/0x24e
    [] kernel_thread_helper+0x7/0x10
    [] 0xffffffff
  irq event stamp: 819992
  hardirqs last  enabled at (819992): [] net_rx_action+0x39/0x1de
  hardirqs last disabled at (819991): [] net_rx_action+0x141/0x1de
  softirqs last  enabled at (817552): [] __do_softirq+0xa3/0xa8
  softirqs last disabled at (819987): [] do_softirq+0x5b/0xc9

  other info that might help us debug this:
  no locks held by swapper/1.

  stack backtrace:
   [] dump_trace+0x63/0x1e8
   [] show_trace_log_lvl+0x19/0x2e
   [] show_trace+0x12/0x14
   [] dump_stack+0x14/0x16
   [] print_usage_bug+0x23c/0x246
   [] mark_lock+0x108/0x39c
   [] __lock_acquire+0x361/0x9ed
   [] lock_acquire+0x56/0x72
   [] _spin_lock+0x35/0x42
   [] net_rx_action+0x64/0x1de
   [] __do_softirq+0x52/0xa8
   [] do_softirq+0x5b/0xc9
   [] irq_exit+0x3c/0x48
   [] do_IRQ+0xa4/0xbd
   [] common_interrupt+0x2e/0x34
   [] vprintk+0x2c0/0x309
   [] printk+0x1b/0x1d
   [] init+0x80/0x24e
   [] kernel_thread_helper+0x7/0x10
   =======================

Signed-off-by: Ingo Molnar 
Signed-off-by: Adrian Bunk

ieee1394: forgotten dereference...

2007-07-22T16:01:20+00:00

Going through the string and waiting for _pointer_ to become '\0'
is not what the authors meant...

Signed-off-by: Al Viro 
Acked-by: Ben Collins 
Signed-off-by: Adrian Bunk