rpms/kernel/F-11 net-fix-wrong-sizeof.patch, NONE, 1.1 net-unix-fix-sending-fds-in-multiple-buffers.patch, NONE, 1.1 sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch, NONE, 1.1 sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch, NONE, 1.1 smsc95xx-fix-transmission-where-zlp-is-expected.patch, NONE, 1.1 tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch, NONE, 1.1 x86-fix-csum_ipv6_magic-asm-memory-clobber.patch, NONE, 1.1 kernel.spec, 1.1761, 1.1762

Tue Oct 13 10:26:01 UTC 2009

Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-11
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv15967

Modified Files:
	kernel.spec 
Added Files:
	net-fix-wrong-sizeof.patch 
	net-unix-fix-sending-fds-in-multiple-buffers.patch 
	sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch 
	sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch 
	smsc95xx-fix-transmission-where-zlp-is-expected.patch 
	tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch 
	x86-fix-csum_ipv6_magic-asm-memory-clobber.patch 
Log Message:
Networking fixes taken from 2.6.31-stable

net-fix-wrong-sizeof.patch:
 Documentation/networking/timestamping/timestamping.c |    2 +-
 drivers/net/iseries_veth.c                           |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- NEW FILE net-fix-wrong-sizeof.patch ---
>From b607bd900051efc3308c4edc65dd98b34b230021 Mon Sep 17 00:00:00 2001
From: Jean Delvare <khali at linux-fr.org>
Date: Fri, 2 Oct 2009 09:55:19 -0700
Subject: net: Fix wrong sizeof

From: Jean Delvare <khali at linux-fr.org>

commit b607bd900051efc3308c4edc65dd98b34b230021 upstream.

Which is why I have always preferred sizeof(struct foo) over
sizeof(var).

Signed-off-by: Jean Delvare <khali at linux-fr.org>
Acked-by: Randy Dunlap <rdunlap at xenotime.net>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

---
 Documentation/networking/timestamping/timestamping.c |    2 +-
 drivers/net/iseries_veth.c                           |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/Documentation/networking/timestamping/timestamping.c
+++ b/Documentation/networking/timestamping/timestamping.c
@@ -381,7 +381,7 @@ int main(int argc, char **argv)
 	memset(&hwtstamp, 0, sizeof(hwtstamp));
 	strncpy(hwtstamp.ifr_name, interface, sizeof(hwtstamp.ifr_name));
 	hwtstamp.ifr_data = (void *)&hwconfig;
-	memset(&hwconfig, 0, sizeof(&hwconfig));
+	memset(&hwconfig, 0, sizeof(hwconfig));
 	hwconfig.tx_type =
 		(so_timestamping_flags & SOF_TIMESTAMPING_TX_HARDWARE) ?
 		HWTSTAMP_TX_ON : HWTSTAMP_TX_OFF;
--- a/drivers/net/iseries_veth.c
+++ b/drivers/net/iseries_veth.c
@@ -495,7 +495,7 @@ static void veth_take_cap_ack(struct vet
 			   cnx->remote_lp);
 	} else {
 		memcpy(&cnx->cap_ack_event, event,
-		       sizeof(&cnx->cap_ack_event));
+		       sizeof(cnx->cap_ack_event));
 		cnx->state |= VETH_STATE_GOTCAPACK;
 		veth_kick_statemachine(cnx);
 	}

net-unix-fix-sending-fds-in-multiple-buffers.patch:
 af_unix.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- NEW FILE net-unix-fix-sending-fds-in-multiple-buffers.patch ---
>From f599901a049da787808b6df8f876d61bb4ab13b2 Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi at suse.cz>
Date: Fri, 11 Sep 2009 11:31:45 -0700
Subject: net: unix: fix sending fds in multiple buffers

From: Miklos Szeredi <mszeredi at suse.cz>

[ Upstream commit 8ba69ba6a324b13e1190fc31e41954d190fd4f1d ]

Kalle Olavi Niemitalo reported that:

  "..., when one process calls sendmsg once to send 43804 bytes of
  data and one file descriptor, and another process then calls recvmsg
  three times to receive the 16032+16032+11740 bytes, each of those
  recvmsg calls returns the file descriptor in the ancillary data.  I
  confirmed this with strace.  The behaviour differs from Linux
  2.6.26, where reportedly only one of those recvmsg calls (I think
  the first one) returned the file descriptor."

This bug was introduced by a patch from me titled "net: unix: fix inflight
counting bug in garbage collector", commit 6209344f5.

And the reason is, quoting Kalle:

  "Before your patch, unix_attach_fds() would set scm->fp = NULL, so
  that if the loop in unix_stream_sendmsg() ran multiple iterations,
  it could not call unix_attach_fds() again.  But now,
  unix_attach_fds() leaves scm->fp unchanged, and I think this causes
  it to be called multiple times and duplicate the same file
  descriptors to each struct sk_buff."

Fix this by introducing a flag that is cleared at the start and set
when the fds attached to the first buffer.  The resulting code should
work equivalently to the one on 2.6.26.

Reported-by: Kalle Olavi Niemitalo <kon at iki.fi>
Signed-off-by: Miklos Szeredi <mszeredi at suse.cz>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
---
 net/unix/af_unix.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1501,6 +1501,7 @@ static int unix_stream_sendmsg(struct ki
 	struct sk_buff *skb;
 	int sent = 0;
 	struct scm_cookie tmp_scm;
+	bool fds_sent = false;
 
 	if (NULL == siocb->scm)
 		siocb->scm = &tmp_scm;
@@ -1562,12 +1563,14 @@ static int unix_stream_sendmsg(struct ki
 		size = min_t(int, size, skb_tailroom(skb));
 
 		memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
-		if (siocb->scm->fp) {
+		/* Only send the fds in the first buffer */
+		if (siocb->scm->fp && !fds_sent) {
 			err = unix_attach_fds(siocb->scm, skb);
 			if (err) {
 				kfree_skb(skb);
 				goto out_err;
 			}
+			fds_sent = true;
 		}
 
 		err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);

sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch:
 sit.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- NEW FILE sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch ---
>From a9cb3db986f8bceaa741175cf016b0b7df59caf0 Mon Sep 17 00:00:00 2001
From: Sascha Hlusiak <contact at saschahlusiak.de>
Date: Tue, 29 Sep 2009 11:27:05 +0000
Subject: sit: fix off-by-one in ipip6_tunnel_get_prl

From: Sascha Hlusiak <contact at saschahlusiak.de>

[ Upstream commit 298bf12ddb25841804f26234a43b89da1b1c0e21 ]

When requesting all prl entries (kprl.addr == INADDR_ANY) and there are
more prl entries than there is space passed from userspace, the existing
code would always copy cmax+1 entries, which is more than can be handled.

This patch makes the kernel copy only exactly cmax entries.

Signed-off-by: Sascha Hlusiak <contact at saschahlusiak.de>
Acked-By: Fred L. Templin <Fred.L.Templin at boeing.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
---
 net/ipv6/sit.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -261,7 +261,7 @@ static int ipip6_tunnel_get_prl(struct i
 
 	c = 0;
 	for (prl = t->prl; prl; prl = prl->next) {
-		if (c > cmax)
+		if (c >= cmax)
 			break;
 		if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
 			continue;

sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch:
 sky2.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- NEW FILE sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch ---
>From c15e9e9c5bf3e5df18ba054050119d084f905499 Mon Sep 17 00:00:00 2001
From: Mike McCormack <mikem at ring3k.org>
Date: Mon, 21 Sep 2009 04:08:52 +0000
Subject: sky2: Set SKY2_HW_RAM_BUFFER in sky2_init

From: Mike McCormack <mikem at ring3k.org>

[ Upstream commit 74a61ebf653c6abe459f228eb40e9f24f7ef1fb7 ]

The SKY2_HW_RAM_BUFFER bit in hw->flags was checked in sky2_mac_init(),
 before being set later in sky2_up().

Setting SKY2_HW_RAM_BUFFER in sky2_init() where other hw->flags are set
 should avoid this problem recurring.

Signed-off-by: Mike McCormack <mikem at ring3k.org>
Acked-by: Stephen Hemminger <shemminger at vyatta.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
---
 drivers/net/sky2.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1447,7 +1447,6 @@ static int sky2_up(struct net_device *de
 	if (ramsize > 0) {
 		u32 rxspace;
 
-		hw->flags |= SKY2_HW_RAM_BUFFER;
 		pr_debug(PFX "%s: ram buffer %dK\n", dev->name, ramsize);
 		if (ramsize < 16)
 			rxspace = ramsize / 2;
@@ -2887,6 +2886,9 @@ static int __devinit sky2_init(struct sk
 			++hw->ports;
 	}
 
+	if (sky2_read8(hw, B2_E_0))
+		hw->flags |= SKY2_HW_RAM_BUFFER;
+
 	return 0;
 }
 

smsc95xx-fix-transmission-where-zlp-is-expected.patch:
 drivers/net/usb/smsc95xx.c |    2 +-
 drivers/net/usb/usbnet.c   |    2 +-
 include/linux/usb/usbnet.h |    1 +
 3 files changed, 3 insertions(+), 2 deletions(-)

--- NEW FILE smsc95xx-fix-transmission-where-zlp-is-expected.patch ---
>From 710bf937ca93632f2a7e7a7c6a9068c1ff4e4e44 Mon Sep 17 00:00:00 2001
From: Steve Glendinning <steve.glendinning at smsc.com>
Date: Tue, 22 Sep 2009 04:00:27 +0000
Subject: smsc95xx: fix transmission where ZLP is expected

From: Steve Glendinning <steve.glendinning at smsc.com>

[ Upstream commit ec4756238239f1a331d9fb95bad8b281dad56855 ]

Usbnet framework assumes USB hardware doesn't handle zero length
packets, but SMSC LAN95xx requires these to be sent for correct
operation.

This patch fixes an easily reproducible tx lockup when sending a frame
that results in exactly 512 bytes in a USB transmission (e.g. a UDP
frame with 458 data bytes, due to IP headers and our USB headers).  It
adds an extra flag to usbnet for the hardware driver to indicate that
it can handle and requires the zero length packets.

This patch should not affect other usbnet users, please also consider
for -stable.

Signed-off-by: Steve Glendinning <steve.glendinning at smsc.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
---
 drivers/net/usb/smsc95xx.c |    2 +-
 drivers/net/usb/usbnet.c   |    2 +-
 include/linux/usb/usbnet.h |    1 +
 3 files changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1232,7 +1232,7 @@ static const struct driver_info smsc95xx
 	.rx_fixup	= smsc95xx_rx_fixup,
 	.tx_fixup	= smsc95xx_tx_fixup,
 	.status		= smsc95xx_status,
-	.flags		= FLAG_ETHER,
+	.flags		= FLAG_ETHER | FLAG_SEND_ZLP,
 };
 
 static const struct usb_device_id products[] = {
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -957,7 +957,7 @@ int usbnet_start_xmit (struct sk_buff *s
 	 * NOTE:  strictly conforming cdc-ether devices should expect
 	 * the ZLP here, but ignore the one-byte packet.
 	 */
-	if ((length % dev->maxpacket) == 0) {
+	if (!(info->flags & FLAG_SEND_ZLP) && (length % dev->maxpacket) == 0) {
 		urb->transfer_buffer_length++;
 		if (skb_tailroom(skb)) {
 			skb->data[skb->len] = 0;
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -87,6 +87,7 @@ struct driver_info {
 
 #define FLAG_FRAMING_AX 0x0040		/* AX88772/178 packets */
 #define FLAG_WLAN	0x0080		/* use "wlan%d" names */
+#define FLAG_SEND_ZLP	0x0200		/* hw requires ZLPs are sent */
 
 
 	/* init device ... can sleep, or cause probe() failure */

tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch:
 tcp_minisocks.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- NEW FILE tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch ---
>From 362d5749032d6426162f3e545ad353a40f2f0d97 Mon Sep 17 00:00:00 2001
From: Robert Varga <nite at hq.alert.sk>
Date: Tue, 15 Sep 2009 23:49:21 -0700
Subject: tcp: fix CONFIG_TCP_MD5SIG + CONFIG_PREEMPT timer BUG()

From: Robert Varga <nite at hq.alert.sk>

[ Upstream commit 657e9649e745b06675aa5063c84430986cdc3afa ]

I have recently came across a preemption imbalance detected by:

<4>huh, entered ffffffff80644630 with preempt_count 00000102, exited with 00000101?
<0>------------[ cut here ]------------
<2>kernel BUG at /usr/src/linux/kernel/timer.c:664!
<0>invalid opcode: 0000 [1] PREEMPT SMP

with ffffffff80644630 being inet_twdr_hangman().

This appeared after I enabled CONFIG_TCP_MD5SIG and played with it a
bit, so I looked at what might have caused it.

One thing that struck me as strange is tcp_twsk_destructor(), as it
calls tcp_put_md5sig_pool() -- which entails a put_cpu(), causing the
detected imbalance. Found on 2.6.23.9, but 2.6.31 is affected as well,
as far as I can tell.

Signed-off-by: Robert Varga <nite at hq.alert.sk>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
---
 net/ipv4/tcp_minisocks.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -362,7 +362,7 @@ void tcp_twsk_destructor(struct sock *sk
 #ifdef CONFIG_TCP_MD5SIG
 	struct tcp_timewait_sock *twsk = tcp_twsk(sk);
 	if (twsk->tw_md5_keylen)
-		tcp_put_md5sig_pool();
+		tcp_free_md5sig_pool();
 #endif
 }
 

x86-fix-csum_ipv6_magic-asm-memory-clobber.patch:
 checksum_32.h |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- NEW FILE x86-fix-csum_ipv6_magic-asm-memory-clobber.patch ---
>From 392d814daf460a9564d29b2cebc51e1ea34e0504 Mon Sep 17 00:00:00 2001
From: Samuel Thibault <samuel.thibault at ens-lyon.org>
Date: Thu, 1 Oct 2009 15:44:02 -0700
Subject: x86: fix csum_ipv6_magic asm memory clobber

From: Samuel Thibault <samuel.thibault at ens-lyon.org>

commit 392d814daf460a9564d29b2cebc51e1ea34e0504 upstream.

Just like ip_fast_csum, the assembly snippet in csum_ipv6_magic needs a
memory clobber, as it is only passed the address of the buffer, not a
memory reference to the buffer itself.

This caused failures in Hurd's pfinetv4 when we tried to compile it with
gcc-4.3 (bogus checksums).

Signed-off-by: Samuel Thibault <samuel.thibault at ens-lyon.org>
Cc: Ingo Molnar <mingo at elte.hu>
Cc: Thomas Gleixner <tglx at linutronix.de>
Cc: "H. Peter Anvin" <hpa at zytor.com>
Acked-by: "David S. Miller" <davem at davemloft.net>
Cc: Andi Kleen <andi at firstfloor.org>
Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

---
 arch/x86/include/asm/checksum_32.h |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/arch/x86/include/asm/checksum_32.h
+++ b/arch/x86/include/asm/checksum_32.h
@@ -161,7 +161,8 @@ static inline __sum16 csum_ipv6_magic(co
 	    "adcl $0, %0	;\n"
 	    : "=&r" (sum)
 	    : "r" (saddr), "r" (daddr),
-	      "r" (htonl(len)), "r" (htonl(proto)), "0" (sum));
+	      "r" (htonl(len)), "r" (htonl(proto)), "0" (sum)
+	    : "memory");
 
 	return csum_fold(sum);
 }


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-11/kernel.spec,v
retrieving revision 1.1761
retrieving revision 1.1762
diff -u -p -r1.1761 -r1.1762
--- kernel.spec	13 Oct 2009 10:04:06 -0000	1.1761
+++ kernel.spec	13 Oct 2009 10:26:00 -0000	1.1762
@@ -788,6 +788,15 @@ Patch15520: tracing-correct-module-bound
 # fix boot hang on some systems
 Patch15600: acpi-revert-attach-device-to-handle-early.patch
 
+# networking fixes from 2.6.31-stable
+Patch15700: net-fix-wrong-sizeof.patch
+Patch15710: net-unix-fix-sending-fds-in-multiple-buffers.patch
+Patch15720: sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch
+Patch15730: sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch
+Patch15740: smsc95xx-fix-transmission-where-zlp-is-expected.patch
+Patch15750: tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch
+Patch15760: x86-fix-csum_ipv6_magic-asm-memory-clobber.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1473,6 +1482,15 @@ ApplyPatch tracing-correct-module-bounda
 # fix boot hang on some systems
 ApplyPatch acpi-revert-attach-device-to-handle-early.patch
 
+# networking fixes from 2.6.31-stable
+ApplyPatch net-fix-wrong-sizeof.patch
+ApplyPatch net-unix-fix-sending-fds-in-multiple-buffers.patch
+ApplyPatch sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch
+ApplyPatch sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch
+ApplyPatch smsc95xx-fix-transmission-where-zlp-is-expected.patch
+ApplyPatch tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch
+ApplyPatch x86-fix-csum_ipv6_magic-asm-memory-clobber.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2061,6 +2079,9 @@ fi
 # and build.
 
 %changelog
+* Tue Oct 13 2009 Chuck Ebbert <cebbert at redhat.com> 2.6.30.9-83
+- Networking fixes taken from 2.6.31-stable
+
 * Tue Oct 13 2009 Chuck Ebbert <cebbert at redhat.com> 2.6.30.9-82
 - Fix boot hang with ACPI on some systems.
 


