Commit Graph

99538 Commits

Author SHA1 Message Date
David S. Miller
ea2aca084b Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Conflicts:

	Documentation/feature-removal-schedule.txt
	drivers/net/wan/hdlc_fr.c
	drivers/net/wireless/iwlwifi/iwl-4965.c
	drivers/net/wireless/iwlwifi/iwl3945-base.c
2008-07-05 23:08:07 -07:00
David S. Miller
f3032be921 Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/linville/wireless-next-2.6 2008-07-05 21:41:53 -07:00
Patrick McHardy
70c03b49b8 vlan: Add GVRP support
Add GVRP support for dynamically registering VLANs with switches.

By default GVRP is disabled because we only support the applicant-only
participant model, which means it should not be enabled on vlans that
are members of a bridge. Since there is currently no way to cleanly
determine that, the user is responsible for enabling it.

The code is pretty small and low impact, its wrapped in a config
option though because it depends on the GARP implementation and
the STP core.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 21:26:57 -07:00
Patrick McHardy
ce305002e1 vlan: Move device unregistration before lower dev cleanup
Move the unregister_netdevice() call for the VLAN device before cleanup
for the lower device. This is needed by GVRP so it can send a leave
message before the applicant on the lower device is cleaned up.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 21:26:41 -07:00
Patrick McHardy
b3ce0325f2 vlan: Change vlan_dev_set_vlan_flag() to handle multiple flags at once
Change vlan_dev_set_vlan_flag() to handle multiple flags at once and
rename to vlan_dev_change_flags(). This allows to to use it from the
netlink interface, which in turn allows to handle necessary adjustments
when changing flags centrally.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 21:26:27 -07:00
Patrick McHardy
eca9ebac65 net: Add GARP applicant-only participant
Add an implementation of the GARP (Generic Attribute Registration Protocol)
applicant-only participant. This will be used by the following patch to
add GVRP support to the VLAN code.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 21:26:13 -07:00
Patrick McHardy
7c85fbf065 bridge: Use STP demux
Use the STP demux layer for receiving STP PDUs instead of directly
registering with LLC.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 21:25:56 -07:00
Patrick McHardy
a19800d704 net: Add STP demux layer
Add small STP demux layer for demuxing STP PDUs based on MAC address.
This is needed to run both GARP and STP in parallel (or even load the
modules) since both use LLC_SAP_BSPAN.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 21:25:39 -07:00
Pavel Emelyanov
ef28d1a20f MIB: add struct net to UDP6_INC_STATS_BH
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Acked-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 21:19:40 -07:00
Pavel Emelyanov
235b9f7ac5 MIB: add struct net to UDP6_INC_STATS_USER
As simple as the patch #1 in this set.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Acked-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 21:19:20 -07:00
Pavel Emelyanov
0283328e23 MIB: add struct net to UDP_INC_STATS_BH
Two special cases here - one is rxrpc - I put init_net there
explicitly, since we haven't touched this part yet. The second
place is in __udp4_lib_rcv - we already have a struct net there,
but I have to move its initialization above to make it ready
at the "drop" label.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Acked-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 21:18:48 -07:00
Pavel Emelyanov
629ca23c33 MIB: add struct net to UDP_INC_STATS_USER
Nothing special - all the places already have a struct sock
at hands, so use the sock_net() net.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Acked-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 21:18:07 -07:00
David S. Miller
4ce2417bfb Merge branch 'davem-next' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6 2008-07-05 21:03:31 -07:00
Denis V. Lunev
32cb5b4e03 netns: selective flush of rt_cache
dst cache is marked as expired on the per/namespace basis by previous
path. Right now we have to implement selective cache shrinking. This
procedure has been ported from older OpenVz codebase.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 19:06:12 -07:00
Denis V. Lunev
e84f84f276 netns: place rt_genid into struct net
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 19:04:32 -07:00
Denis V. Lunev
b00180defd ipv4: pass current value of rt_genid into rt_hash
Basically, there is no difference to atomic_read internally or pass it as
a parameter as rt_hash is inline.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 19:04:09 -07:00
Denis V. Lunev
86c657f6b5 netns: add struct net parameter to rt_cache_invalidate
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 19:03:31 -07:00
Denis V. Lunev
9f5e97e536 netns: make rt_secret_rebuild timer per namespace
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 19:02:59 -07:00
Denis V. Lunev
39a23e7508 netns: register net.ipv4.route.flush in each namespace
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 19:02:33 -07:00
Denis V. Lunev
639e104fac ipv4: remove static flush_delay variable
flush delay is used as an external storage for net.ipv4.route.flush sysctl
entry. It is write-only.

The ctl_table->data for this entry is used once. Fix this case to point
to the stack to remove global variable. Do this to avoid additional
variable on struct net in the next patch.

Possible race (as it was before) accessing this local variable is removed
using flush_mutex.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 19:02:06 -07:00
Denis V. Lunev
ae299fc051 net: add fib_rules_ops to flush_cache method
This is required to pass namespace context into rt_cache_flush called from
->flush_cache.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 19:01:28 -07:00
Denis V. Lunev
76e6ebfb40 netns: add namespace parameter to rt_cache_flush
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-05 19:00:44 -07:00
Alan Cox
055e5110ae 8390: Split 8390 support into a pausing and a non pausing driver core
Only a few ISA controllers need the pausing version of the 8390 core
while PCMCIA, later ISA and PCI do not. More importantly the ISA delays
can break non ISA boxes so we must use a different build of 8390.c for
the two sets of controllers.

No changes since last time as all the points of concerns raised proved to
be invalid

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:47:51 -04:00
Krzysztof Halasa
141766cf97 WAN: Remove no longer needed pvc_desc in FR code.
Remove no longer needed struct pvc_desc in FR code.
Requires "WAN: convert drivers to use built-in netdev_stats" patch.

Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:47:42 -04:00
Krzysztof Halasa
198191c4a7 WAN: convert drivers to use built-in netdev_stats
There is no point in using separate net_device_stats structs when
the one in struct net_device is present. Compiles.

Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:47:41 -04:00
PJ Waskiewicz
844290e560 igb: add NAPI Rx queue support
Update the NAPI implementation to use the new napi_struct infrstructure.
This removes the need of multiple net_device structs to implement a
multiqueue NAPI.

Signed-off-by: PJ Waskiewicz <peter.p.waskiewicz.jr.@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:47:01 -04:00
Alexander Duyck
662d7205b3 igb: fix init on 82575 with MNG enabled
This patch resolves an issue seen on 82575 adapters with managability
pass-thru enabled, which could cause the system to panic.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:47:00 -04:00
Auke Kok
652fff3214 igb: eliminate hw from the hw_dbg macro arguments
Various cosmetic cleanups. Comment fixes. Eliminate the hw part out
of the hw_dbg macro since it's always used.

Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:46:59 -04:00
Alexander Duyck
d67ce5338c igb: fix parameter options
Currently there are items in the driver to support parameters, but there
are no parameters being added to the driver.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:46:59 -04:00
Jeff Kirsher
733596bea6 igb: cleanup function header comments
Function header comments do not match function name.

Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:46:58 -04:00
Mitch Williams
3b644cf6ce igb: Remove adapter struct from these function call parameters
Simplify a bunch of calls to these functions by moving the adapter
struct out of the function arguments since that is not needed.

Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:46:57 -04:00
Jeff Kirsher
5c3cad754c igb: limit EEPROM access
EEPROM access beyond the base eeprom page is unsupported.

Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:46:56 -04:00
Pekka Enberg
532f4aee93 ipg: run-time configurable jumbo frame support
Make jumbo frame support configurable via ifconfig mtu option as suggested by
Stephen Hemminger.

Cc: Stephen Hemminger <stephen.hemminger@vyatta.com>
Tested-by: Andrew Savchenko <Bircoph@list.ru>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:46:54 -04:00
Pekka Enberg
da02b23192 ipg: per-device max_rxframe_size
Add a ->max_rxframe member to struct ipg_nic_private and convert the users of
IPG_MAX_RXFRAME_SIZE to use it instead to enable per-device jumbo frame
configuration.

Tested-by: Andrew Savchenko <Bircoph@list.ru>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:46:53 -04:00
Pekka Enberg
39f205854c ipg: per-device rxsupport_size
Add a ->max_rxframe member to struct ipg_nic_private and convert the users of
IPG_RXSUPPORT_SIZE to use it instead to enable per-device jumbo frame
configuration.

Tested-by: Andrew Savchenko <Bircoph@list.ru>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:46:53 -04:00
Pekka Enberg
18a9cdb9c7 ipg: per-device rxfrag_size
Add a ->max_rxframe member to struct ipg_nic_private and convert the users of
IPG_RXFRAG_SIZE to use it instead to enable per-device jumbo frame
configuration.

Tested-by: Andrew Savchenko <Bircoph@list.ru>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:46:52 -04:00
Pekka Enberg
8304295521 ipg: remove jumbo frame #ifdef from mtu
Remove JUMBO_FRAME #ifdef from dev->mtu setting in ipg_nic_open() so that we
can make IPG_TXFRAG_SIZE configurable.

Tested-by: Andrew Savchenko <Bircoph@list.ru>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:46:51 -04:00
Pekka Enberg
024f4d88b4 ipg: always compile in jumbo frame support
Add a ->is_jumbo boolean to struct ipg_nic_private and fix up
ipg_interrupt_handler() to call the jumbo frame version of ipg_nic_rx() if the
boolean is set to true. Also remove the JUMBO_FRAME #ifdefs so we can always
compile in support for jumbo frames.

Tested-by: Andrew Savchenko <Bircoph@list.ru>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:46:51 -04:00
Jeff Garzik
16e605a2a0 Merge branch 'r8169-next' of git://git.kernel.org/pub/scm/linux/kernel/git/romieu/netdev-2.6 into upstream-next 2008-07-04 08:35:57 -04:00
Laurent Pinchart
c5a78ac00c fs_enet: restore promiscuous and multicast settings in restart()
The restart() function is called when the link state changes and resets
multicast and promiscuous settings. This patch restores those settings at the
end of restart().

Signed-off-by: Laurent Pinchart <laurentp@cse-semaphore.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:21:53 -04:00
Sathya Narayanan
6c688f4294 ibm_newemac: Fixes entry of short packets
Short packets has to be discarded by the driver. So this patch addresses the
issue of discarding the short packets of size lesser then ethernet header
size.

Signed-off-by: Sathya Narayanan <sathyan@teamf1.com>
Signed-off-by: Stefan Roese <sr@denx.de>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:17:20 -04:00
Sathya Narayanan
ab9b30cc3e ibm_newemac: Fixes kernel crashes when speed of cable connected changes
The descriptor pointers were not initialized to NIL values, so it was
poiniting to some random addresses which was completely invalid. This
fix takes care of initializing the descriptor to NIL values and clearing
the valid descriptors on clean ring operation.

Signed-off-by: Sathya Narayanan <sathyan@teamf1.com>
Signed-off-by: Stefan Roese <sr@denx.de>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:17:18 -04:00
Roland Dreier
7732123379 pasemi_mac: Access iph->tot_len with correct endianness
iph->tot_len is stored in network byte order, so access it using
ntohs().  This doesn't have any real world impact on pasemi_mac, since
the device only exists as part of a big-endian system-on-chip, but
fixing this gets rid of a sparse warning and avoids having a bad example
in the tree.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:15:31 -04:00
Roland Dreier
3ff2cd230d ehea: Access iph->tot_len with correct endianness
iph->tot_len is stored in network byte order, so access it using
ntohs().  This doesn't have any real world impact on ehea, since ehea
only exists for big-endian platfroms (at the moment at least) but fixing
this gets rid of a sparse warning and avoids having a bad example in the
tree.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:15:28 -04:00
Jan-Bernd Themann
2f69ae01c8 ehea: fix race condition
When ehea_stop is called the function
cancel_work_sync(&port->reset_task) is used to ensure
that the reset task is not running anymore. We need an
additional flag to ensure that it can not be scheduled
after this call again for a certain time.

Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:10:41 -04:00
Jan-Bernd Themann
b0afffe89b ehea: add MODULE_DEVICE_TABLE
Required to allow distros to easily detect when ehea
module needs to be loaded

Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:10:07 -04:00
Jan-Bernd Themann
5c2cec143a ehea: fix might sleep problem
A mutex has to be replaced by spinlocks as it can be called from
a context which does not allow sleeping.
The kzalloc flag GFP_KERNEL has to be replaced by GFP_ATOMIC
for the same reason.

Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:10:06 -04:00
Tobias Diedrich
97bff0953d forcedeth: fix lockdep warning on ethtool -s
After enabling CONFIG_LOCKDEP and CONFIG_PROVE_LOCKING I get the
following warning when ethtool -s is first called on one of the
forcedeth ports:

=================================
[ INFO: inconsistent lock state ]
2.6.26-rc4 #28
---------------------------------
inconsistent {in-hardirq-W} -> {hardirq-on-W} usage.
ethtool/1985 [HC0[0]:SC0[1]:HE1:SE0] takes:
 (&np->lock){++..}, at: [<ffffffffa000c5fd>] nv_set_settings+0xc8/0x3de [forcedeth]
{in-hardirq-W} state was registered at:
  [<ffffffffffffffff>] 0xffffffffffffffff
irq event stamp: 3606
hardirqs last  enabled at (3605): [<ffffffff8068106f>] _spin_unlock_irqrestore+0x3f/0x68
hardirqs last disabled at (3604): [<ffffffff80680d38>] _spin_lock_irqsave+0x13/0x46
softirqs last  enabled at (3534): [<ffffffff80246ba5>] __do_softirq+0xbc/0xc5
softirqs last disabled at (3606): [<ffffffff80680b33>] _spin_lock_bh+0x11/0x41

other info that might help us debug this:
2 locks held by ethtool/1985:
 #0:  (rtnl_mutex){--..}, at: [<ffffffff80596072>] rtnl_lock+0x12/0x14
 #1:  (_xmit_ETHER){-+..}, at: [<ffffffffa000c5e8>] nv_set_settings+0xb3/0x3de [forcedeth]
stack backtrace:
Pid: 1985, comm: ethtool Not tainted 2.6.26-rc4 #28
Call Trace:
 [<ffffffff8025f190>] print_usage_bug+0x162/0x173
 [<ffffffff8025fa8b>] mark_lock+0x231/0x41f
 [<ffffffff802607cf>] __lock_acquire+0x4e7/0xcac
 [<ffffffff8025fe64>] ? trace_hardirqs_on+0xf1/0x115
 [<ffffffff80272c3a>] ? disable_irq_nosync+0x6f/0x7b
 [<ffffffff80261375>] lock_acquire+0x55/0x6e
 [<ffffffffa000c5fd>] ? :forcedeth:nv_set_settings+0xc8/0x3de
 [<ffffffff80680b15>] _spin_lock+0x2f/0x3c
 [<ffffffffa000c5fd>] :forcedeth:nv_set_settings+0xc8/0x3de
 [<ffffffff8058f8bb>] dev_ethtool+0x186/0xea3
 [<ffffffff8067f446>] ? mutex_lock_nested+0x243/0x275
 [<ffffffff8025df2b>] ? debug_mutex_free_waiter+0x46/0x4a
 [<ffffffff8067f469>] ? mutex_lock_nested+0x266/0x275
 [<ffffffff8058e1ce>] dev_ioctl+0x4eb/0x600
 [<ffffffff8068106f>] ? _spin_unlock_irqrestore+0x3f/0x68
 [<ffffffff80580f91>] sock_ioctl+0x1f5/0x202
 [<ffffffff802a322e>] vfs_ioctl+0x2a/0x77
 [<ffffffff802a34d6>] do_vfs_ioctl+0x25b/0x270
 [<ffffffff806807b6>] ? trace_hardirqs_on_thunk+0x35/0x3a
 [<ffffffff802a352d>] sys_ioctl+0x42/0x65
 [<ffffffff8021fffb>] system_call_after_swapgs+0x7b/0x80

This is caused by the following snippet in nv_set_settings:

	netif_carrier_off(dev);
	if (netif_running(dev)) {
		nv_disable_irq(dev);
		netif_tx_lock_bh(dev);
		spin_lock(&np->lock);
		/* stop engines */
		nv_stop_rxtx(dev);
		spin_unlock(&np->lock);
		netif_tx_unlock_bh(dev);
	}

Because of nv_disable_irq this is probably not really a problem
though (I guess) and replacing the spin_lock with spin_lock_irqsave
could keep interrupts disabled for a longer period of time because
of delays in nv_stop_rx and nv_stop_tx.

Signed-off-by: Tobias Diedrich <ranma+kernel@tdiedrich.de>
Cc: Ayaz Abdulla <aabdulla@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:09:52 -04:00
Krzysztof Halasa
54364b752e Add missing skb->dev assignment in Frame Relay RX code
Commit 4c13eb6657 ([ETH]: Make
eth_type_trans set skb->dev like the other *_type_trans) removed
skb->dev assignment from hdlc_fr.c:fr_rx(). Unfortunately it was also
needed for cases other than eth_type_trans().

Adding it back.

It's quite serious and may be a security risk as it causes a wrong
input interface indication (the physical hdlcX instead of logical
pvcX). Probably -stable class fix.

Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-07-04 08:09:39 -04:00
Patrick McHardy
ab1b20467c bridge: fix use-after-free in br_cleanup_bridges()
Unregistering a bridge device may cause virtual devices stacked on the
bridge, like vlan or macvlan devices, to be unregistered as well.
br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
devices during cleanup. This is not enough however, if one of the
additionally unregistered devices is next in the list to the bridge
device, it will get freed as well and the iteration continues on
the freed element.

Restart iteration after each bridge device removal from the beginning to
fix this, similar to what rtnl_link_unregister() does.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-03 03:53:42 -07:00