summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* batman-adv: remove extra layer between hash and hash element - hash bucketMarek Lindner2011-03-0510-294/+298
| | | | Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: separate ethernet comparing calls from hash functionsMarek Lindner2011-03-058-42/+51
| | | | | | | Note: The function compare_ether_addr() provided by the Linux kernel requires aligned memory. Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: Fix possible buffer overflow in softif neigh list outputLinus Lüssing2011-03-051-21/+1
| | | | | | | | | | | | | | | | | | When printing the soft interface table the number of entries in the softif neigh list are first being counted and a fitting buffer allocated. After that the softif neigh list gets locked again and the buffer printed - which has the following two issues: For one thing, the softif neigh list might have grown when reacquiring the rcu lock, which results in writing outside of the allocated buffer. Furthermore 31 Bytes are not enough for printing an entry with a vid of more than 2 digits. The manual buffering is unnecessary, we can safely print to the seq directly during the rcu_read_lock(). Signed-off-by: Linus Lüssing <linus.luessing@ascom.ch> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: Increase orig_node refcount before releasing rcu read lockLinus Lüssing2011-03-052-3/+5
| | | | | | | | | When unicast_send_skb() is increasing the orig_node's refcount another thread might have been freeing this orig_node already. We need to increase the refcount in the rcu read lock protected area to avoid that. Signed-off-by: Linus Lüssing <linus.luessing@ascom.ch> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: Make bat_priv->curr_gw an rcu protected pointerLinus Lüssing2011-03-052-32/+72
| | | | | | | | | | | | The rcu protected macros rcu_dereference() and rcu_assign_pointer() for the bat_priv->curr_gw need to be used, as well as spin/rcu locking. Otherwise we might end up using a curr_gw pointer pointing to already freed memory. Reported-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Linus Lüssing <linus.luessing@ascom.ch> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: make broadcast seqno operations atomicMarek Lindner2011-03-053-22/+37
| | | | | | | | | | | | Batman-adv could receive several payload broadcasts at the same time that would trigger access to the broadcast seqno sliding window to determine whether this is a new broadcast or not. If these incoming broadcasts are accessing the sliding window simultaneously it could be left in an inconsistent state. Therefore it is necessary to make sure this access is atomic. Reported-by: Linus Lüssing <linus.luessing@web.de> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: protect bit operations to count OGMs with spinlockMarek Lindner2011-03-052-34/+33
| | | | | Reported-by: Linus Lüssing <linus.luessing@saxnet.de> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: Correct rcu refcounting for batman_ifMarek Lindner2011-03-054-38/+33
| | | | | | | | | | | It might be possible that 2 threads access the same data in the same rcu grace period. The first thread calls call_rcu() to decrement the refcount and free the data while the second thread increases the refcount to use the data. To avoid this race condition all refcount operations have to be atomic. Reported-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: Correct rcu refcounting for softif_neighMarek Lindner2011-03-052-17/+16
| | | | | | | | | | | It might be possible that 2 threads access the same data in the same rcu grace period. The first thread calls call_rcu() to decrement the refcount and free the data while the second thread increases the refcount to use the data. To avoid this race condition all refcount operations have to be atomic. Reported-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: Correct rcu refcounting for gw_nodeMarek Lindner2011-03-052-22/+17
| | | | | | | | | | | It might be possible that 2 threads access the same data in the same rcu grace period. The first thread calls call_rcu() to decrement the refcount and free the data while the second thread increases the refcount to use the data. To avoid this race condition all refcount operations have to be atomic. Reported-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: Correct rcu refcounting for neigh_nodeMarek Lindner2011-03-057-174/+313
| | | | | | | | | | | It might be possible that 2 threads access the same data in the same rcu grace period. The first thread calls call_rcu() to decrement the refcount and free the data while the second thread increases the refcount to use the data. To avoid this race condition all refcount operations have to be atomic. Reported-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: protect bonding with rcu locksSimon Wunderlich2011-03-057-163/+195
| | | | | | | | | | bonding / alternating candidates need to be secured by rcu locks as well. This patch therefore converts the bonding list from a plain pointer list to a rcu securable lists and references the bonding candidates. Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: protect ogm counter arrays with spinlockMarek Lindner2011-03-053-6/+33
| | | | Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: protect originator nodes with reference countersMarek Lindner2011-03-054-19/+78
| | | | Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: protect each hash row with rcu locksMarek Lindner2011-03-058-45/+141
| | | | Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: protect neigh_nodes used outside of rcu_locks with refcountingMarek Lindner2011-03-051-9/+31
| | | | Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: free neighbors when an interface is deactivatedMarek Lindner2011-03-051-2/+7
| | | | | | | | | hardif_disable_interface() calls purge_orig_ref() to immediately free all neighbors associated with the interface that is going down. purge_orig_neighbors() checked if the interface status is IF_INACTIVE which is set to IF_NOT_IN_USE shortly before calling purge_orig_ref(). Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: protect neighbor list with rcu locksMarek Lindner2011-03-053-21/+57
| | | | Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: convert neighbor list to hlistMarek Lindner2011-03-053-28/+35
| | | | Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: protect neighbor nodes with reference countersMarek Lindner2011-03-054-8/+28
| | | | Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
* batman-adv: Remove two duplicate includes.Jesper Juhl2011-02-141-2/+0
| | | | | | | | Remove duplicate inclusion of "send.h" and "routing.h" from net/batman-adv/soft-interface.c Signed-off-by: Jesper Juhl <jj@chaosbits.net> Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Disallow originator addressing within mesh layerLinus Lüssing2011-02-111-6/+1
| | | | | | | | | | | For a host in the mesh network, the batman layer should be transparent. However, we had one exception, data packets within the mesh network which have the same destination as a originator are being routed to that node, although there is no host that node's bat0 interface and therefore gets dropped anyway. This commit removes this exception. Signed-off-by: Linus Lüssing <linus.luessing@ascom.ch> Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Remove duplicate types.h inclusionsLinus Lüssing2011-02-1110-14/+0
| | | | | | | | | types.h is included by main.h, which is included at the beginning of any other c-file anyway. Therefore this commit removes those duplicate inclussions. Signed-off-by: Linus Lüssing <linus.luessing@ascom.ch> Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Split combined variable declarationsMarek Lindner2011-02-111-2/+2
| | | | | | | | | Multiple variable declarations in a single statements over multiple lines can be split into multiple variable declarations without changing the actual behavior. Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Use successive sequence numbers for fragmentsSven Eckelmann2011-02-111-4/+4
| | | | | | | | | | | | | | | | | The two fragments of an unicast packet must have successive sequence numbers to allow the receiver side to detect matching fragments and merge them again. The current implementation doesn't provide that property because a sequence of two atomic_inc_return may be interleaved with another sequence which also changes the variable. The access to the fragment sequence number pool has either to be protected by correct locking or it has to reserve two sequence numbers in a single fetch. The latter one can easily be done by increasing the value of the last used sequence number by 2 in a single step. The generated window of two currently unused sequence numbers can now be scattered across the two fragments. Reported-by: Linus Lüssing <linus.luessing@web.de> Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Merge README of v2011.0.0 releaseSven Eckelmann2011-01-311-8/+8
| | | | Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Update copyright yearsSven Eckelmann2011-01-3139-39/+39
| | | | Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Remove unused variablesSven Eckelmann2011-01-312-10/+1
| | | | Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Remove declaration of batman_skb_recvSven Eckelmann2011-01-312-6/+9
| | | | | | | batman_skb_recv can be defined in hard-interface.c as static because it is never used outside of that file. Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Remove unused definitionsSven Eckelmann2011-01-311-15/+0
| | | | Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Remove dangling declaration of hash_remove_elementSven Eckelmann2011-01-311-5/+0
| | | | Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: remove unused parametersSimon Wunderlich2011-01-314-14/+10
| | | | | | | | Some function parameters are obsolete now and can be removed. Reported-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de> Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Calculate correct size for merged packetsSven Eckelmann2011-01-314-3/+31
| | | | | | | | | | | | | | | | | | | | The routing algorithm must be able to decide if a fragment can be merged with the missing part and still be passed to a forwarding interface. The fragments can only differ by one byte in case that the original payload had an uneven length. In that situation the sender has to inform all possible receivers that the tail is one byte longer using the flag UNI_FRAG_LARGETAIL. The combination of UNI_FRAG_LARGETAIL and UNI_FRAG_HEAD flag makes it possible to calculate the correct length for even and uneven sized payloads. The original formula missed to add the unicast header at all and forgot to remove the fragment header of the second fragment. This made the results highly unreliable and only useful for machines with large differences between the configured MTUs. Reported-by: Russell Senior <russell@personaltelco.net> Reported-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Sven Eckelmann <sven@narfation.org>
* batman-adv: Create roughly equal sized fragmentsSven Eckelmann2011-01-311-2/+3
| | | | | | | | | | | | | | | | | | | | | The routing algorithm must know how large two fragments are to be able to decide that it is safe to merge them or if it should resubmit without waiting for the second part. When these two fragments have a too different size, it is not possible to guess right in every situation. The user could easily configure the MTU of the attached cards so that one fragment is forwarded and the other one is added to the fragments table to wait for the missing part. For even sized packets, it is possible to split it so that the resulting packages are equal sized by ignoring the old non-fragment header at the beginning of the original packet. This still creates different sized fragments for uneven sized packets. Reported-by: Russell Senior <russell@personaltelco.net> Reported-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Sven Eckelmann <sven@narfation.org>
* Linux 2.6.38-rc2v2.6.38-rc2Linus Torvalds2011-01-221-1/+1
|
* Merge branch 'media_fixes' of ↵Linus Torvalds2011-01-22133-2661/+2442
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'media_fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (101 commits) [media] staging/lirc: fix mem leaks and ptr err usage [media] hdpvr: reduce latency of i2c read/write w/recycled buffer [media] hdpvr: enable IR part [media] rc/mceusb: timeout should be in ns, not us [media] v4l2-device: fix 'use-after-freed' oops [media] v4l2-dev: don't memset video_device.dev [media] zoran: use video_device_alloc instead of kmalloc [media] w9966: zero device state after a detach [media] v4l: Fix a use-before-set in the control framework [media] v4l: Include linux/videodev2.h in media/v4l2-ctrls.h [media] DocBook/v4l: update V4L2 revision and update copyright years [media] DocBook/v4l: fix validation error in dev-rds.xml [media] v4l2-ctrls: queryctrl shouldn't attempt to replace V4L2_CID_PRIVATE_BASE IDs [media] v4l2-ctrls: fix missing 'read-only' check [media] pvrusb2: Provide more information about IR units to lirc_zilog and ir-kbd-i2c [media] ir-kbd-i2c: Add back defaults setting for Zilog Z8's at addr 0x71 [media] lirc_zilog: Update TODO.lirc_zilog [media] lirc_zilog: Add Andy Walls to copyright notice and authors list [media] lirc_zilog: Remove useless struct i2c_driver.command function [media] lirc_zilog: Remove unneeded tests for existence of the IR Tx function ...
| * [media] staging/lirc: fix mem leaks and ptr err usageJarod Wilson2011-01-196-6/+20
| | | | | | | | | | | | | | | | | | | | | | When the lirc drivers were converted over to using memdup_user, I mistakenly also removed corresponding calls to kfree. Add those back. I also screwed up on the allocation error check in lirc_serial, using if (PTR_ERR()) instead of if (IS_ERR()), which broke transmit. Reported-by: Jiri Fojtasek <jiri.fojtasek@hlohovec.net> Signed-off-by: Jarod Wilson <jarod@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] hdpvr: reduce latency of i2c read/write w/recycled bufferJarod Wilson2011-01-192-17/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current hdpvr code kmalloc's a new buffer for every i2c read and write. Rather than do that, lets allocate a buffer in the driver's device struct and just use that every time. The size I've chosen for the buffer is the maximum size I could ascertain might be used by either ir-kbd-i2c or lirc_zilog, plus a bit of padding (lirc_zilog may use up to 100 bytes on tx, rounded that up to 128). Note that this might also remedy user reports of very sluggish behavior of IR receive with hdpvr hardware. v2: make sure (len <= (dev->i2c_buf)) [Jean Delvare] Reported-by: Jean Delvare <khali@linux-fr.org> Acked-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Jarod Wilson <jarod@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] hdpvr: enable IR partJarod Wilson2011-01-195-77/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A number of things going on here, but the end result is that the IR part on the hdpvr gets enabled, and can be used with ir-kbd-i2c and/or lirc_zilog. First up, there are some conditional build fixes that come into play whether i2c is built-in or modular. Second, we're swapping out i2c_new_probed_device() for i2c_new_device(), as in my testing, probing always fails, but we *know* that all hdpvr devices have a z8 chip at 0x70 and 0x71. Third, we're poking at an i2c address directly without a client, and writing some magic bits to actually turn on this IR part (this could use some improvement in the future). Fourth, some of the i2c_adapter storage has been reworked, as the existing implementation used to lead to an oops following i2c changes c. 2.6.31. Earlier editions of this patch have been floating around the 'net for a while, including being patched into Fedora kernels, and they *do* work. This specific version isn't yet tested, beyond loading ir-kbd-i2c and confirming that it does bind to the RX address of the hdpvr. [mchehab@redhat.com: I2C_CLASS_TV_ANALOG is not defined. Fix compilation bug] Signed-off-by: Jarod Wilson <jarod@redhat.com> Acked-by: Andy Walls <awalls@md.metrocast.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] rc/mceusb: timeout should be in ns, not usJarod Wilson2011-01-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes an egregious bug in mceusb driver, where the receiver was being put into idle mode far sooner than it should have, thanks to storing a timeout value that in us where it should be ns. Basically, the receiver kept going into idle mode before a trailing space had been fully received, which was causing problems for some protocols, most notably manifesting as lirc userspace never receiving a trailing space for any rc5 signals. Signed-off-by: Jarod Wilson <jarod@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] v4l2-device: fix 'use-after-freed' oopsHans Verkuil2011-01-191-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a bug in v4l2_device_unregister where the sd pointer can be dereferenced after it was freed. Normally the i2c adapter is removed before this function is called. Removing the adapter will also unregister all subdevs on that adapter, so generally v4l2_device_unregister has nothing to do. However, in the case of a platform i2c bus that bus is generally not freed. In that case, after freeing the i2c subdevice the code will fall into the second block when it tests if the subdev is a SPI device. But by that time the subdev is already freed and the kernel oopses. The fix is trivial: continue with the loop after freeing the i2c or spi subdevice. Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Reported-by: Daniel Drake <dsd@laptop.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] v4l2-dev: don't memset video_device.devHans Verkuil2011-01-191-5/+4
| | | | | | | | | | | | | | | | | | | | | | Zeroing video_device.dev causes a memory leak if video_set_drvdata was called before video_register_device was called. video_set_drvdata calls dev_set_drvdata which allocates video_device.dev.p. memsetting this will prevent freeing of that memory. Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] zoran: use video_device_alloc instead of kmallocHans Verkuil2011-01-191-1/+1
| | | | | | | | | | Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] w9966: zero device state after a detachHans Verkuil2011-01-191-0/+1
| | | | | | | | | | | | | | | | After a detach zero the whole device state to ensure a clean slate on the next attach. Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] v4l: Fix a use-before-set in the control frameworkLaurent Pinchart2011-01-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | v4l2_queryctrl sets the step value based on the control type. That would be fine if it used the control type stored in the V4L2 kernel control object, not the one stored in the userspace ioctl structure that has just been memset to 0. Fix this. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] v4l: Include linux/videodev2.h in media/v4l2-ctrls.hLaurent Pinchart2011-01-191-0/+1
| | | | | | | | | | | | | | The later makes extensive use of structures defined in the former. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] DocBook/v4l: update V4L2 revision and update copyright yearsHans Verkuil2011-01-193-4/+5
| | | | | | | | | | Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] DocBook/v4l: fix validation error in dev-rds.xmlHans Verkuil2011-01-191-2/+4
| | | | | | | | | | Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] v4l2-ctrls: queryctrl shouldn't attempt to replace ↵Hans Verkuil2011-01-191-1/+4
| | | | | | | | | | | | | | | | | | | | | | V4L2_CID_PRIVATE_BASE IDs When queryctrl is called with a V4L2_CID_PRIVATE_BASE control ID, then currently it is replaced by the real internal ID. This is not according to the spec so keep the V4L2_CID_PRIVATE_BASE ID in this case. Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| * [media] v4l2-ctrls: fix missing 'read-only' checkHans Verkuil2011-01-191-0/+3
| | | | | | | | | | | | | | | | | | VIDIOC_S_CTRL did not check against read-only controls. Even worse, for controls of type CTRL_CLASS it would cause a kernel oops since those controls do not have a s_ctrl op. Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-25 01:29:04 +0100