Commit Graph

1007 Commits

Author SHA1 Message Date
Dave Jones e8af300c3b [PATCH] Fix up non-NUMA breakage in mmzone.h
If CONFIG_NUMA isn't set, we use the define in <linux/mmzone.h> for
early_pfn_to_nid (which defines it to 0).

Because of this, the prototype needs to move inside the CONFIG_NUMA too, or
anal gcc's get really confused.

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:42 -07:00
Dave Jones 8ff8b27bb8 [PATCH] Clean up numa defines in mmzone.h
The recent cleanups to asm-i386/mmzone.h were suboptimal nesting an ifdef of
the same symbol.  This patch removes some of the ifdef'ery to make things more
readable again.

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:42 -07:00
Shaohua Li 3b520b238e [PATCH] MTRR suspend/resume cleanup
There has been some discuss about solving the SMP MTRR suspend/resume
breakage, but I didn't find a patch for it.  This is an intent for it.  The
basic idea is moving mtrr initializing into cpu_identify for all APs (so it
works for cpu hotplug).  For BP, restore_processor_state is responsible for
restoring MTRR.

Signed-off-by: Shaohua Li <shaohua.li@intel.com>
Acked-by: Andi Kleen <ak@muc.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:42 -07:00
Michael Ellerman fd899c0cc7 [PATCH] ppc64: Make idle_loop a ppc_md function
This patch adds an idle member to the ppc_md structure and calls it from
cpu_idle().  If a platform leaves ppc_md.idle as null it will get the default
idle loop default_idle().

Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:40 -07:00
Milton Miller 030ffad23f [PATCH] hvc_console: Register ops when setting up hvc_console
When registering the hvc console port, register a list of ops (read and write)
to go with it, instead of calling fixed function names.

This allows different ports to encode the data differently.

Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:39 -07:00
Milton Miller acad9559f1 [PATCH] hvc_console: Separate hvc_console and vio code 2
Remove all the vio device driver code from hvc_console.c

This will allow us to separate hvsi, hvc, and allow hvc_console to be used
without the ppc64 vio layer.

Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:39 -07:00
Milton Miller d5ee257c33 [PATCH] hvc_console: Separate hvc_console and vio code
Separate the console setup routines of the hvc_console and the vio layer.

Remove the call to find_init_vty from hvc_console.c.

Fail the setup routine if the console doesn't exist, but register the console
again when the specified channel is instantiated.  This scheme maintains the
print buffer semantics while eliminating callout and call back for the console
code.

Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:39 -07:00
Anton Blanchard 5cee73fa04 [PATCH] ppc64: remove duplicate syscall reservation
We already have a prototype for sys_remap_file_pages (239) so there is no need
to reserve it twice.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:37 -07:00
Anton Blanchard 79c2cc7b6d [PATCH] ppc64: add ioprio syscalls
- Clean up sys32_getpriority comment.
- Add ioprio syscalls, and sign extend 32bit versions.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:37 -07:00
Anton Blanchard cf36680887 [PATCH] move ioprio syscalls into syscalls.h
- Make ioprio syscalls return long, like set/getpriority syscalls.
- Move function prototypes into syscalls.h so we can pick them up in the
  32/64bit compat code.

Signed-off-by: Anton Blanchard <anton@samba.org>
Acked-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:37 -07:00
Anton Blanchard 8dc4fd87f2 [PATCH] ppc64: Turn runlatch on in exception entry
Enable the runlatch at the start of each exception.  Unfortunately we are out
of space in the 0x300 handler, so I added it a bit later.

The SPR write is fairly expensive, perhaps we should cache the runlatch state
in the paca and avoid the write when possible.

We don't need to turn the runlatch off, we do that in the idle loop.  Better
to take the hit in the idle loop than for each exception exit.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:37 -07:00
Anton Blanchard a2f7a9ce2a [PATCH] ppc64: Fix runlatch code to work on pseries machines
Not all ppc64 CPUs have the CTRL SPR, so we need a cputable feature for it.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:37 -07:00
Marcelo Tosatti 79b9ce311e [PATCH] print order information when OOM killing
Dump the current allocation order when OOM killing.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:35 -07:00
Mark Fasheh cb2c023375 [PATCH] export generic_drop_inode() to modules
OCFS2 wants to mark an inode which has been orphaned by another node so
that during final iput it takes the correct path through the VFS and can
pass through the OCFS2 delete_inode callback.  Since i_nlink can get out of
date with other nodes, the best way I see to accomplish this is by clearing
i_nlink on those inodes at drop_inode time.  Other than this small amount
of work, nothing different needs to happen, so I think it would be cleanest
to be able to just call generic_drop_inode at the end of the OCFS2
drop_inode callback.

Signed-off-by: Mark Fasheh <mark.fasheh@oracle.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-07 18:23:35 -07:00
Linus Torvalds 043d051615 Merge master.kernel.org:/pub/scm/linux/kernel/git/aegl/linux-2.6 2005-07-07 10:24:51 -07:00
Linus Torvalds c101f3136c Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6 2005-07-06 22:15:13 -07:00
Tony Luck 8d7e35174d [IA64] fix generic/up builds
Jesse Barnes provided the original version of this patch months ago, but
other changes kept conflicting with it, so it got deferred.  Greg Edwards
dug it out of obscurity just over a week ago, and almost immediately
another conflicting patch appeared (Bob Picco's memory-less nodes).

I've resolved the conflicts and got it running again.  CONFIG_SGI_TIOCX
is set to "y" in defconfig, which causes a Tiger to not boot (oops in
tiocx_init).  But that can be resolved later ... get this in now before it
gets stale again.

Signed-off-by: Tony Luck <tony.luck@intel.com>
2005-07-06 18:18:10 -07:00
Linus Torvalds 359ea2f135 Merge rsync://rsync.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2005-07-06 17:04:06 -07:00
Eddie C. Dost e3e01d6005 [SPARC64]: Fix enable_dma() in asm-sparc64/parport.h
Call ebus_dma_enable() before calling ebus_dma_request(), otherwise
ebus_dma_request() returns -EINVAL and enable_dma() calls BUG()...

Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-06 15:41:54 -07:00
Linus Torvalds 107177410b Merge master.kernel.org:/home/rmk/linux-2.6-arm 2005-07-06 15:39:15 -07:00
Tony Luck 67d340f440 Auto merge with /home/aegl/GIT/linus 2005-07-06 15:35:18 -07:00
Prarit Bhargava 7fe4c1b168 [IA64] hotplug/ia64: SN Hotplug Driver - PREEMPT/pcibus_info fix
This patch fixes an issue with the PROM and a kernel running with
CONFIG_PREEMPT enabled.  When CONFIG_PREEMPT is enabled, the size of a
spinlock_t changes -- resulting in the PROM writing to an incorrect location.

Signed-off-by: Prarit Bhargava <prarit@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2005-07-06 15:30:25 -07:00
Prarit Bhargava 6f354b014b [IA64] hotplug/ia64: SN Hotplug Driver - SN Hotplug Driver code
This patch is the SGI hotplug driver and additional changes required for
the driver.  These modifications include changes to the SN io_init.c code
for memory management, the inclusion of new SAL calls to enable and disable
PCI slots, and a hotplug-style driver.

Signed-off-by: Prarit Bhargava <prarit@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2005-07-06 15:29:53 -07:00
Prarit Bhargava 283c7f6ac6 [IA64] hotplug/ia64: SN Hotplug Driver - new SN PROM version code
This patch is a rewrite of the code to check the PROM version.  The current
code has some deficiences in the way PROM comparisons were made.  The minimum
value of PROM that will boot has also been changed to 4.04.

Signed-off-by: Prarit Bhargava <prarit@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2005-07-06 15:29:13 -07:00
Prarit Bhargava c13cf3714f [IA64] hotplug/ia64: SN Hotplug Driver: moving of header files
This patch moves header files out of the arch/ia64/sn directories and into
include/asm-ia64/sn.  These files were being included by other subsystems
and should be under include/asm-ia64/sn.

Signed-off-by: Prarit Bhargava <prarit@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2005-07-06 15:26:51 -07:00
Deepak Saxena 450008b5a6 [PATCH] ARM: 2792/1: IXP4xx iomap API implementation
Patch from Deepak Saxena

This patch implements the iomap API for Intel IXP4xx NPU systems.
We need to implement our own version of the API functions b/c of the
PCI hostbridge does not provide the capability to map PCI I/O space
into the CPU's physical memory space. In addition, if a system has
more than 64M of PCI memory mapped BARs, PCI memory must also be
accessed indirectly.  This patch changes the assignment of PCI I/O
resources to fall into to 0x0000:0xffff range so that we can trap
I/O areas in our ioread/iowrite macros.

Signed-off-by: Deepak Saxena
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2005-07-06 23:06:05 +01:00
Prarit Bhargava cb4cb2cb9b [IA64] hotplug/ia64: SN Hotplug Driver: SN IRQ Fixes
This patch  fixes the SN IRQ code such that cpu affinity and
Hotplug can modify IRQ values.  The sn_irq_info structures are now locked
using a RCU lock mechanism to avoid lock contention in the lost interrupt
WAR code.

Signed-off-by: Prarit Bhargava <prarit@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2005-07-06 14:59:44 -07:00
Herbert Xu fbdae9f3e7 [CRYPTO] Ensure cit_iv is aligned correctly
This patch ensures that cit_iv is aligned according to cra_alignmask
by allocating it as part of the tfm structure.  As a side effect the
crypto layer will also guarantee that the tfm ctx area has enough space
to be aligned by cra_alignmask.  This allows us to remove the extra
space reservation from the Padlock driver.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-06 13:53:29 -07:00
Herbert Xu 9547737799 [CRYPTO] Add alignmask for low-level cipher implementations
The VIA Padlock device requires the input and output buffers to
be aligned on 16-byte boundaries.  This patch adds the alignmask
attribute for low-level cipher implementations to indicate their
alignment requirements.

The mid-level crypt() function will copy the input/output buffers
if they are not aligned correctly before they are passed to the
low-level implementation.

Strictly speaking, some of the software implementations require
the buffers to be aligned on 4-byte boundaries as they do 32-bit
loads.  However, it is not clear whether it is better to copy
the buffers or pay the penalty for unaligned loads/stores.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-06 13:52:09 -07:00
Herbert Xu 40725181b7 [CRYPTO] Add support for low-level multi-block operations
This patch adds hooks for cipher algorithms to implement multi-block
ECB/CBC operations directly.  This is expected to provide significant
performance boots to the VIA Padlock.

It could also be used for improving software implementations such as
AES where operating on multiple blocks at a time may enable certain
optimisations.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-06 13:51:52 -07:00
Jeff Mahoney 5e6557722e [PATCH] openfirmware: generate device table for userspace
This converts the usage of struct of_match to struct of_device_id,
similar to pci_device_id.  This allows a device table to be generated,
which can be parsed by depmod(8) to generate a map file for module
loading.

In order for hotplug to work with macio devices, patches to
module-init-tools and hotplug must be applied.  Those patches are
available at:

 ftp://ftp.suse.com/pub/people/jeffm/linux/macio-hotplug/

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-06 12:55:20 -07:00
Rusty Lynch 6772926bef [PATCH] kprobes: fix namespace problem and sparc64 build
The following renames arch_init, a kprobes function for performing any
architecture specific initialization, to arch_init_kprobes in order to
cleanup the namespace.

Also, this patch adds arch_init_kprobes to sparc64 to fix the sparc64 kprobes
build from the last return probe patch.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-05 19:19:00 -07:00
Andrei Konovalov e6b6239f8e [PATCH] ppc32: add Freescale MPC885ADS board support
This patch adds the Freescale MPC86xADS board support.  The supported
devices are SMC UART and 10Mbit ethernet on SCC1.

The manual for the board says that it "is compatible with the MPC8xxFADS
for software point of view".  That's why this patch extends FADS instead of
introducing a new platform.

FEC is not supported as the "combined FCC/FEC ethernet driver" driver by
Pantelis Antoniou should replace the current FEC driver.

Signed-off-by: Gennadiy Kurtsman <gkurtsman@ru.mvista.com>
Signed-off-by: Andrei Konovalov <akonovalov@ru.mvista.com>
Acked-by: Tom Rini <trini@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-05 19:18:59 -07:00
Linus Torvalds 5432ebb5f6 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2005-07-05 18:41:58 -07:00
David S. Miller c1b4a7e695 [TCP]: Move to new TSO segmenting scheme.
Make TSO segment transmit size decisions at send time not earlier.

The basic scheme is that we try to build as large a TSO frame as
possible when pulling in the user data, but the size of the TSO frame
output to the card is determined at transmit time.

This is guided by tp->xmit_size_goal.  It is always set to a multiple
of MSS and tells sendmsg/sendpage how large an SKB to try and build.

Later, tcp_write_xmit() and tcp_push_one() chop up the packet if
necessary and conditions warrant.  These routines can also decide to
"defer" in order to wait for more ACKs to arrive and thus allow larger
TSO frames to be emitted.

A general observation is that TSO elongates the pipe, thus requiring a
larger congestion window and larger buffering especially at the sender
side.  Therefore, it is important that applications 1) get a large
enough socket send buffer (this is accomplished by our dynamic send
buffer expansion code) 2) do large enough writes.

Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 15:24:38 -07:00
David S. Miller 55c97f3e99 [TCP]: Fix __tcp_push_pending_frames() 'nonagle' handling.
'nonagle' should be passed to the tcp_snd_test() function
as 'TCP_NAGLE_PUSH' if we are checking an SKB not at the
tail of the write_queue.  This is because Nagle does not
apply to such frames since we cannot possibly tack more
data onto them.

However, while doing this __tcp_push_pending_frames() makes
all of the packets in the write_queue use this modified
'nonagle' value.

Fix the bug and simplify this function by just calling
tcp_write_xmit() directly if sk_send_head is non-NULL.

As a result, we can now make tcp_data_snd_check() just call
tcp_push_pending_frames() instead of the specialized
__tcp_data_snd_check().

Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 15:19:38 -07:00
David S. Miller a2e2a59c93 [TCP]: Fix redundant calculations of tcp_current_mss()
tcp_write_xmit() uses tcp_current_mss(), but some of it's callers,
namely __tcp_push_pending_frames(), already has this value available
already.

While we're here, fix the "cur_mss" argument to be "unsigned int"
instead of plain "unsigned".

Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 15:19:23 -07:00
David S. Miller a762a98007 [TCP]: Kill extra cwnd validate in __tcp_push_pending_frames().
The tcp_cwnd_validate() function should only be invoked
if we actually send some frames, yet __tcp_push_pending_frames()
will always invoke it.  tcp_write_xmit() does the call for us,
so the call here can simply be removed.

Also, tcp_write_xmit() can be marked static.

Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 15:18:51 -07:00
David S. Miller 84d3e7b957 [TCP]: Move __tcp_data_snd_check into tcp_output.c
It reimplements portions of tcp_snd_check(), so it
we move it to tcp_output.c we can consolidate it's
logic much easier in a later change.

Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 15:18:18 -07:00
David S. Miller f6302d1d78 [TCP]: Move send test logic out of net/tcp.h
This just moves the code into tcp_output.c, no code logic changes are
made by this patch.

Using this as a baseline, we can begin to untangle the mess of
comparisons for the Nagle test et al.  We will also be able to reduce
all of the redundant computation that occurs when outputting data
packets.

Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 15:18:03 -07:00
David S. Miller fc6415bcb0 [TCP]: Fix quick-ack decrementing with TSO.
On each packet output, we call tcp_dec_quickack_mode()
if the ACK flag is set.  It drops tp->ack.quick until
it hits zero, at which time we deflate the ATO value.

When doing TSO, we are emitting multiple packets with
ACK set, so we should decrement tp->ack.quick that many
segments.

Note that, unlike this case, tcp_enter_cwr() should not
take the tcp_skb_pcount(skb) into consideration.  That
function, one time, readjusts tp->snd_cwnd and moves
into TCP_CA_CWR state.

Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 15:17:45 -07:00
David S. Miller c65f7f00c5 [TCP]: Simplify SKB data portion allocation with NETIF_F_SG.
The ideal and most optimal layout for an SKB when doing
scatter-gather is to put all the headers at skb->data, and
all the user data in the page array.

This makes SKB splitting and combining extremely simple,
especially before a packet goes onto the wire the first
time.

So, when sk_stream_alloc_pskb() is given a zero size, make
sure there is no skb_tailroom().  This is achieved by applying
SKB_DATA_ALIGN() to the header length used here.

Next, make select_size() in TCP output segmentation use a
length of zero when NETIF_F_SG is true on the outgoing
interface.

Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 15:17:25 -07:00
Alexey Dobriyan b8259d9ad1 [NET]: Remove __ARGS from include/net/slhc_vj.h
I suspect "#define __ARGS(x) ()" was deprecated before I was born.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Domen Puncer <domen@coderock.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 15:12:04 -07:00
Christoph Hellwig bc971dee6e [SHAPER]: Switch to spinlocks.
Dave, you were right and the sleeping locks in shaper were
broken. Markus Kanet noticed this and also tested the patch below that
switches locking to spinlocks.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 15:03:46 -07:00
Linus Torvalds d06e7a56d9 Merge rsync://rsync.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 2005-07-05 14:17:40 -07:00
Thomas Graf 3d54b82fdf [PKT_SCHED]: Cleanup qdisc creation and alignment macros
Adds qdisc_alloc() to share code between qdisc_create()
and qdisc_create_dflt(). Hides the qdisc alignment behind
macros and makes use of them.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 14:15:09 -07:00
Thomas Graf e41a33e6ec [PKT_SCHED]: Move sch_generic.c prototypes to correct header file
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 14:14:30 -07:00
Thomas Graf 1cbb3380ef [NET]: Reduce size of sk_buff by 4 bytes
Reduce local_df to a bit field and ip_summed to a 2 bits
field thus saving 13 bits. Move bit fields, packet type,
and protocol into the spare area between the priority
and the destructor. Saves 4 bytes on both, 32bit and
64bit architectures.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 14:13:41 -07:00
Thomas Graf e176fe8954 [NET]: Remove unused security member in sk_buff
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 14:12:44 -07:00
Patrick McHardy 55820ee2f8 [NET]: Fix signedness issues in net/core/filter.c
This is the code to load packet data into a register:

                        k = fentry->k;
                        if (k < 0) {
...
                        } else {
                                u32 _tmp, *p;
                                p = skb_header_pointer(skb, k, 4, &_tmp);
                                if (p != NULL) {
                                        A = ntohl(*p);
                                        continue;
                                }
                        }

skb_header_pointer checks if the requested data is within the
linear area:

        int hlen = skb_headlen(skb);

        if (offset + len <= hlen)
                return skb->data + offset;

When offset is within [INT_MAX-len+1..INT_MAX] the addition will
result in a negative number which is <= hlen.

I couldn't trigger a crash on my AMD64 with 2GB of memory, but a
coworker tried on his x86 machine and it crashed immediately.

This patch fixes the check in skb_header_pointer to handle large
positive offsets similar to skb_copy_bits. Invalid data can still
be accessed using negative offsets (also similar to skb_copy_bits),
anyone using negative offsets needs to verify them himself.

Thanks to Thomas V�gtle <thomas.voegtle@coreworks.de> for verifying the
problem by crashing his machine and providing me with an Oops.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-07-05 14:08:10 -07:00