In the transmit path of firewire-net (IPv4 over 1394), the following
race condition may occur:
- The networking soft IRQ inserts a datagram into the 1394 async
request transmit DMA.
- The 1394 async transmit completion tasklet runs to finish cleaning
up (unlink datagram from list of pending ones, release skb and
outbound 1394 transaction object) --- before the networking soft IRQ
had a chance to proceed and add the datagram to the list of pending
datagrams.
This caused a panic in the 1394 async transmit completion tasklet when
it dereferenced unitialized list heads:
http://bugzilla.kernel.org/show_bug.cgi?id=15077
The fix is to add checks in the tx soft IRQ and in the tasklet to
determine which of these two is the last referrer to the transaction
object. Then handle the cleanup of the object by the last referrer
rather than assuming that the tasklet is always the last one.
There is another similar race: Between said tasklet and fwnet_close,
i.e. at ifdown. However, that race is much less likely to occur in
practice and shall be fixed in a separate update.
Reported-by: Илья Басин <basinilya@gmail.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
The generic packet receive code takes care of setting netdev->last_rx when necessary, for the sake of the bonding ARP monitor. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Acked-by: Neil Horman <nhorman@txudriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
No need to put ethtool_ops in data, they should be const. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
These are all drivers that don't touch real hardware. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
The AR req handler should not check the generation; higher level code is the better place to handle bus generation changes. The target node ID just needs to be checked for not being the "all nodes" address; in this case don't handle the request and don't respond. Use Address_Error and Type_Error rcodes as appropriate. Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Fix some problems from "firewire: net: allow for unordered unit
discovery":
- fwnet_remove was missing a list_del, causing fwnet_probe to crash if
called after fwnet_remove, e.g. if firewire-ohci was unloaded and
reloaded.
- fwnet_probe should set its new_netdev flag only if it actually
allocated a net_device.
- Use dev_set_drvdata and dev_get_drvdata instead of deprecated direct
access to device.driver_data.
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
The .ndo_tx_timeout callback is currently without function; delete it. Give .watchdog_timeo a proper time value; lower it to 2 seconds. Decrease the .tx_queue_len from 1000 (as in Ethernet card drivers) to 10 because we have only 64 transaction labels available, and responders might have further limits of their AR req contexts. Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Decouple the creation and destruction of the net_device from the order of discovery and removal of nodes with RFC 2734 unit directories since there is no reliable order. The net_device is now created when the first RFC 2734 unit on a card is discovered, and destroyed when the last RFC 2734 unit on a card went away. This includes all remote units as well as the local unit, which is therefore tracked as a peer now too. Also, locking around the list of peers is slightly extended to guard against peer removal. As a side effect, fwnet_peer.pdg_lock has become superfluous and is deleted. Peer data (max_rec, speed, node ID, generation) are updated more carefully. Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Change names of types, variables, functions. Omit debug code. Use get_unaligned*, put_unaligned*. Annotate big endian data. Handle errors in __init. Change whitespace. Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>