- 28 Jun, 2017 4 commits
-
-
Miaoqing Pan authored
The bug was triggered when do suspend/resuming continuously on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel 4.12.0-041200rc4-generic. But can't reproduce on DELL E5440 + AR9300 PCIE chips. The warning is caused by accessing invalid pointer sc->rng_task. sc->rng_task is not be cleared after kthread_stop(sc->rng_task) be called in ath9k_rng_stop(). Because the kthread is stopped before ath9k_rng_kthread() be scheduled. So set sc->rng_task to null after kthread_stop(sc->rng_task) to resolve this issue. WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100 CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031 Hardware name: Dell Inc. Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013 task: ffff950170fdda00 task.stack: ffffa22c01538000 RIP: 0010:kthread_stop+0xf1/0x100 RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246 RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000 RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680 RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680 R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018 FS: 00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0 Call Trace: ath9k_rng_stop+0x1a/0x20 [ath9k] ath9k_stop+0x3b/0x1d0 [ath9k] drv_stop+0x33/0xf0 [mac80211] ieee80211_stop_device+0x43/0x50 [mac80211] ieee80211_do_stop+0x4f2/0x810 [mac80211] Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043Reported-by:
Giulio Genovese <giulio.genovese@gmail.com> Tested-by:
Miaoqing Pan <miaoqing@codeaurora.org> Signed-off-by:
Kalle Valo <kvalo@qca.qualcomm.com>
-
Bhumika Goyal authored
Declare thermal_cooling_device_ops structure as const as it is only passed as an argument to the function thermal_cooling_device_register and this argument is of type const. So, declare the structure as const. Signed-off-by:
Bhumika Goyal <bhumirks@gmail.com> Signed-off-by:
-
Miaoqing Pan authored
The hard coded register 0x9864 and 0x9924 are invalid for ar9300 chips. Cc: <stable@vger.kernel.org> Signed-off-by:
-
Miaoqing Pan authored
One scenario that could lead to UAF is two threads writing simultaneously to the "tx99" debug file. One of them would set the "start" value to true and follow to ath9k_tx99_init(). Inside the function it would set the sc->tx99_state to true after allocating sc->tx99skb. Then, the other thread would execute write_file_tx99() and call ath9k_tx99_deinit(). sc->tx99_state would be freed. After that, the first thread would continue inside ath9k_tx99_init() and call r = ath9k_tx99_send(sc, sc->tx99_skb, &txctl); that would make use of the freed sc->tx99_skb memory. Cc: <stable@vger.kernel.org> Signed-off-by:
-
- 27 Jun, 2017 9 commits
-
-
Christophe Jaillet authored
If 'wiphy_new()' fails, we leak 'ops'. Add a new label in the error handling path to free it in such a case. Cc: stable@vger.kernel.org Fixes: 5c22fb85 ("brcmfmac: add wowl gtk rekeying offload support") Signed-off-by:
Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by:
Kalle Valo <kvalo@codeaurora.org>
-
Arend Van Spriel authored
The function brcmf_net_attach() can only fail when register_netdevice() fails. When this happens register_netdevice() calls priv_destructor, ie. brcmf_cfg80211_free_netdev() freeing the vif instance. Also upon this failure brcmf_net_attach() calls free_netdev(). However, callers are also doing cleanup resulting in double free. In some places they need netdev private space as it holds parameters to communicate with the device. So we want to do the cleanup only in callers of brcmf_net_attach() by making the following changes: - set priv_destructor after register_netdevice() succeeds. - remove call to free_netdev() in brcmf_net_attach(). - call free_netdev() in brcmf_net_detach() for unregistered netdev. - add free_netdev() if brcmf_net_attach() fails for a created interface. Fixes: cf124db5 ("net: Fix inconsistent teardown and release of private netdev state.") Reviewed-by:
Hante Meuleman <hante.meuleman@broadcom.com> Reviewed-by:
Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com> Reviewed-by:
Franky Lin <franky.lin@broadcom.com> Signed-off-by:
Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by:
-
Colin Ian King authored
Trivial fix to spelling mistake in en_dbg debug message Signed-off-by:
Colin Ian King <colin.king@canonical.com> Acked-by:
Tariq Toukan <tariqt@mellanox.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
David S. Miller authored
Matthias Schiffer says: ==================== net: add netlink_ext_ack support to rtnl_link_ops Same changes as http://patchwork.ozlabs.org/patch/780351/ , split into separate patches for each rtnl_link_ops field as requested. ==================== Signed-off-by:
-
Matthias Schiffer authored
Add support for extended error reporting. Signed-off-by:
Matthias Schiffer <mschiffer@universe-factory.net> Acked-by:
David Ahern <dsahern@gmail.com> Signed-off-by:
-
Matthias Schiffer authored
Add support for extended error reporting. Signed-off-by:
-
Matthias Schiffer authored
Add support for extended error reporting. Signed-off-by:
-
Matthias Schiffer authored
Add support for extended error reporting. Signed-off-by:
-
Matthias Schiffer authored
Add support for extended error reporting. Signed-off-by:
-
- 25 Jun, 2017 27 commits
-
-
Michael Grzeschik authored
In case the MACB is directly connected to a non-mdio PHY/device, it should be possible to provide a fixed link configuration in the DT. Signed-off-by:
Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by:
-
David S. Miller authored
Merge tag 'wireless-drivers-next-for-davem-2017-06-25' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for 4.13 New features and bug fixes to quite a few different drivers, but nothing really special standing out. What makes me happy that we have now more vendors actively contributing to upstream drivers. In this pull request we have patches from Broadcom, Intel, Qualcomm, Realtek and Redpine Signals, and I still have patches from Marvell and Quantenna pending in patchwork. Now that's something comparing to how things looked 11 years ago in Jeff Garzik's "State of the Union: Wireless" email: https://lkml.org/lkml/2006/1/5/671 Major changes: wil6210 * add low level RF sector interface via nl80211 vendor commands * add module parameter ftm_mode to load separate firmware for factory testing * support devices with different PCIe bar size * add support for PCIe D3hot in system suspend * remove ioctl interface which should not be in a wireless driver ath10k * go back to using dma_alloc_coherent() for firmware scratch memory * add per chain RSSI reporting brcmfmac * add support multi-scheduled scan * add scheduled scan support for specified BSSIDs * add support for brcm43430 revision 0 wlcore * add wil1285 compatible rsi * add RS9113 USB support iwlwifi * FW API documentation improvements (for tools and htmldoc) * continuing work for the new A000 family * bump the maximum supported FW API to 31 * improve the differentiation between 8000, 9000 and A000 families ==================== Signed-off-by:
-
David S. Miller authored
Marcelo Ricardo Leitner says: ==================== sctp: RFC 4960 Errata fixes This patchset contains fixes for 4 Errata topics from https://tools.ietf.org/html/draft-ietf-tsvwg-rfc4960-errata-01 Namely, sections: 3.12. Order of Adjustments of partial_bytes_acked and cwnd 3.22. Increase of partial_bytes_acked in Congestion Avoidance 3.26. CWND Increase in Congestion Avoidance Phase 3.27. Refresh of cwnd and ssthresh after Idle Period Tests performed with netperf using net namespaces, with drop rates at 0%, 0.5% and 1% by netem, IPv4 and IPv6, 10 runs for each combination. I couldn't spot differences on the stats. With and without these patches the results vary in a similar way in terms of throughput and retransmissions. Tests with 20ms delay and 20ms delay + drops at 0.5% and 1% also had results in a similar way, no noticeable difference. Looking at cwnd, it was possible to notice slightly lower values being used while still sustaining same throughput profile. ==================== Signed-off-by:
-
Marcelo Ricardo Leitner authored
RFC 4960 Errata 3.27 identifies that ssthresh should be adjusted to cwnd because otherwise it could cause the transport to lock into congestion avoidance phase specially if ssthresh was previously reduced by some packet drop, leading to poor performance. The Errata says to adjust ssthresh to cwnd only once, though the same goal is achieved by updating it every time we update cwnd too. The caveat is that we could take longer to get back up to speed but that should be compensated by the fact that we don't adjust on RTO basis (as RFC says) but based on Heartbeats, which are usually way longer. See-also: https://tools.ietf.org/html/draft-ietf-tsvwg-rfc4960-errata-01#section-3.27Signed-off-by:
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by:
-
Marcelo Ricardo Leitner authored
RFC4960 Errata 3.26 identified that at the same time RFC4960 states that cwnd should never grow more than 1*MTU per RTT, Section 7.2.2 was underspecified and as described could allow increasing cwnd more than that. This patch updates it so partial_bytes_acked is maxed to cwnd if flight_size doesn't reach cwnd, protecting it from such case. See-also: https://tools.ietf.org/html/draft-ietf-tsvwg-rfc4960-errata-01#section-3.26Signed-off-by:
-
Marcelo Ricardo Leitner authored
As per RFC4960 Errata 3.22, this condition is not needed anymore as it could cause the partial_bytes_acked to not consider the TSNs acked in the Gap Ack Blocks although they were received by the peer successfully. This patch thus drops the check for new Cumulative TSN Ack Point, leaving just the flight_size < cwnd one. See-also: https://tools.ietf.org/html/draft-ietf-tsvwg-rfc4960-errata-01#section-3.22Signed-off-by:
-
Marcelo Ricardo Leitner authored
RFC4960 Errata 3.12 says RFC4960 is unclear about the order of adjustments applied to partial_bytes_acked and cwnd in the congestion avoidance phase, and that the actual order should be: partial_bytes_acked is reset to (partial_bytes_acked - cwnd). Next, cwnd is increased by MTU. We were first increasing cwnd, and then subtracting the new value pba, which leads to a different result as pba is smaller than what it should and could cause cwnd to not grow as much. See-also: https://tools.ietf.org/html/draft-ietf-tsvwg-rfc4960-errata-01#section-3.12Signed-off-by:
-
Mintz, Yuval authored
Looks like commit f663dd9a ("net: core: explicitly select a txq before doing l2 forwarding") has removed the need for this dedicated xmit function [it even explicitly states so in its commit log message] but it hasn't removed the definition of the ndo. Signed-off-by:
Yuval Mintz <Yuval.Mintz@cavium.com> CC: Jason Wang <jasowang@redhat.com> CC: John Fastabend <john.r.fastabend@intel.com> Signed-off-by:
-
David S. Miller authored
Timur Tabi says: ==================== net: qcom/emac: various minor improvements A collection of minor fixes and features to the Qualcomm Technologies EMAC network driver. ==================== Signed-off-by: -
Timur Tabi authored
On emulation systems, the EMAC's internal PHY ("SGMII") is not present, but is not needed for network functionality. So just display a warning message and ignore the SGMII. Tested-by:Philip Elcan <pelcan@codeaurora.org> Tested-by:
Adam Wallis <awallis@codeaurora.org> Signed-off-by:
Timur Tabi <timur@codeaurora.org> Signed-off-by:
-
Timur Tabi authored
On ACPI systems, the driver depends on firmware pre-initializing the EMAC because we don't have access to the clocks, and the EMAC has specific clock programming requirements. Therefore, we don't want to reset the EMAC while we are completing the initialization. Tested-by:
Richard Ruigrok <rruigrok@codeaurora.org> Signed-off-by:
-
Timur Tabi authored
The shutdown function halts all DMA and interrupts, so that all operations are discontinued when the system shuts down, e.g. via kexec or a forced reboot. Tested-by:
Tyler Baicar <tbaicar@codeaurora.org> Signed-off-by:
-
Mateusz Jurczyk authored
Verify that the caller-provided sockaddr structure is large enough to contain the sa_family field, before accessing it in bind() and connect() handlers of the AF_IUCV socket. Since neither syscall enforces a minimum size of the corresponding memory region, very short sockaddrs (zero or one byte long) result in operating on uninitialized memory while referencing .sa_family. Fixes: 52a82e23 ("af_iucv: Validate socket address length in iucv_sock_bind()") Signed-off-by:
Mateusz Jurczyk <mjurczyk@google.com> [jwi: removed unneeded null-check for addr] Signed-off-by:
Julian Wiedmann <jwi@linux.vnet.ibm.com> Signed-off-by:
-
Hans Wippel authored
Use proper endianness conversion for an skb protocol assignment. Given that IUCV is only available on big endian systems (s390), this simply avoids an endianness warning reported by sparse. Signed-off-by:
Hans Wippel <hwippel@linux.vnet.ibm.com> Reviewed-by:
Ursula Braun <ubraun@linux.vnet.ibm.com> Signed-off-by:
-
Dan Carpenter authored
We're accidentally returning the wrong variable. "cmode" is uninitialized at this point so it causes a static checker warning. Fixes: 6335e9f2 ("net: dsa: mv88e6xxx: mv88e6390X SERDES support") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by:
Andrew Lunn <andrew@lunn.ch> Signed-off-by:
-
David S. Miller authored
Simon Horman says: ==================== nfp: add flower app with representors this series adds a flower app to the NFP driver. It initialises four types of netdevs: * PF netdev - lower-device for communication of packets to device * PF representor netdev * VF representor netdevs * Phys port representor netdevs The PF netdev acts as a lower-device which sends and receives packets to and from the firmware. The representors act as upper-devices. For TX representors attach a metadata dst to the skb which is used by the PF netdev to prepend metadata to the packet before forwarding the firmware. On RX the PF netdev looks up the representor based on the prepended metadata received from the firmware and forwards the skb to the representor after removing the metadata. Control queues are used to send and receive control messages which are used to communicate configuration information with the firmware. These are in separate vNIC to the queues belonging to the PF netdev. The control queues are not exposed to use-space via a netdev or any other means. The first 9 patches of this series provide app-independent infrastructure to instantiate representors and the remaining 3 patches provide an app which uses this infrastructure. As the name implies this app is targeted at providing offload of TC flower. Flower offload - allowing classifiers to be attached to representor netdevs - is intended to be provided by follow-up patches at which point it will become the dominant feature of the app. Minor changes since v2 noted in changelogs of individual patches. Review of v1 and v2 of this patchset have been addressed either through discussion on-list or changes in this patchset. ==================== Signed-off-by: -
Simon Horman authored
Initialise VF and PF representors in flower app. Based in part on work by Benjamin LaHaise, Bert van Leeuwen and Jakub Kicinski. Signed-off-by:
Simon Horman <simon.horman@netronome.com> Reviewed-by:
Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by:
-
Simon Horman authored
Add app for flower offload. At this point the PF netdev and phys port representor netdevs are initialised. Follow-up work will add support for VF and PF representors and beyond that offloading the flower classifier. Based in part on work by Benjamin LaHaise and Bert van Leeuwen. Signed-off-by:
-
Simon Horman authored
In preparation for adding a new flower app - targeted at offloading the flower classifier - provide support for control message that it will use to communicate with the NFP. Based in part on work by Bert van Leeuwen. Signed-off-by:
-
Simon Horman authored
Allow tx/rx with metadata port id. This will be used for tx/rx of representor netdevs acting as upper-devices while a pf netdev acts as a lower-device. Signed-off-by:
-
Simon Horman authored
Provide port rather than vNIC as parameter of nfp_net_get_mac_addr. This is to allow this function to be used by representor netdevs where a vNIC may have more than one physical port none of which are associated with the vNIC. Signed-off-by:
-
Simon Horman authored
Add app-callbacks for app-specific initialisation of SRIOV. Disabling SRIOV is brought forward in nfp_pci_remove() so that nfp_app_sriov_disable is called while the app still exists. This is intended to be used to implement representor netdevs for virtual ports. Signed-off-by:
-
Simon Horman authored
Provide helpers for stats and xmit on representor netdevs. Parts based on work by Bert van Leeuwen, Benjamin LaHaise and Jakub Kicinski. Signed-off-by:
-
Simon Horman authored
Provide infrastructure to create and destroy representors of a given type. Parts based on work by Bert van Leeuwen, Benjamin LaHaise, and Jakub Kicinski. Signed-off-by:
-
Simon Horman authored
If present map mac_stats and vf_cfg BARs. These will be used by representor netdevs to read statistics for phys port and vf representors. Also provide defines describing the layout of the mac_stats area. Similar defines are already present for the cf_cfg area. Based in part on work by Jakub Kicinski. Signed-off-by:
-
Jakub Kicinski authored
Move MAC/PHY port init into a helper to make it easier to reuse it in the representor code. Signed-off-by:
-
Jakub Kicinski authored
Add app callback for reporting eswitch mode. Non-SRIOV apps should not implement this callback, nfp_app code will then respond with -EOPNOTSUPP. Signed-off-by:
-
