1. 29 Jul, 2015 16 commits
  2. 23 Jul, 2015 12 commits
  3. 22 Jul, 2015 12 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c5dfd654
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Don't use shared bluetooth antenna in iwlwifi driver for management
          frames, from Emmanuel Grumbach.
      
       2) Fix device ID check in ath9k driver, from Felix Fietkau.
      
       3) Off by one in xen-netback BUG checks, from Dan Carpenter.
      
       4) Fix IFLA_VF_PORT netlink attribute validation, from Daniel Borkmann.
      
       5) Fix races in setting peeked bit flag in SKBs during datagram
          receive.  If it's shared we have to clone it otherwise the value can
          easily be corrupted.  Fix from Herbert Xu.
      
       6) Revert fec clock handling change, causes regressions.  From Fabio
          Estevam.
      
       7) Fix use after free in fq_codel and sfq packet schedulers, from WANG
          Cong.
      
       8) ipvlan bug fixes (memory leaks, missing rcu_dereference_bh, etc.)
          from WANG Cong and Konstantin Khlebnikov.
      
       9) Memory leak in act_bpf packet action, from Alexei Starovoitov.
      
      10) ARM bpf JIT bug fixes from Nicolas Schichan.
      
      11) Fix backwards compat of ANY_LAYOUT in virtio_net driver, from
          Michael S Tsirkin.
      
      12) Destruction of bond with different ARP header types not handled
          correctly, fix from Nikolay Aleksandrov.
      
      13) Revert GRO receive support in ipv6 SIT tunnel driver, causes
          regressions because the GRO packets created cannot be processed
          properly on the GSO side if we forward the frame.  From Herbert Xu.
      
      14) TCCR update race and other fixes to ravb driver from Sergei
          Shtylyov.
      
      15) Fix SKB leaks in caif_queue_rcv_skb(), from Eric Dumazet.
      
      16) Fix panics on packet scheduler filter replace, from Daniel Borkmann.
      
      17) Make sure AF_PACKET sees properly IP headers in defragmented frames
          (via PACKET_FANOUT_FLAG_DEFRAG option), from Edward Hyunkoo Jee.
      
      18) AF_NETLINK cannot hold mutex in RCU callback, fix from Florian
          Westphal.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (84 commits)
        ravb: fix ring memory allocation
        net: phy: dp83867: Fix warning check for setting the internal delay
        openvswitch: allocate nr_node_ids flow_stats instead of num_possible_nodes
        netlink: don't hold mutex in rcu callback when releasing mmapd ring
        ARM: net: fix vlan access instructions in ARM JIT.
        ARM: net: handle negative offsets in BPF JIT.
        ARM: net: fix condition for load_order > 0 when translating load instructions.
        tcp: suppress a division by zero warning
        drivers: net: cpsw: remove tx event processing in rx napi poll
        inet: frags: fix defragmented packet's IP header for af_packet
        net: mvneta: fix refilling for Rx DMA buffers
        stmmac: fix setting of driver data in stmmac_dvr_probe
        sched: cls_flow: fix panic on filter replace
        sched: cls_flower: fix panic on filter replace
        sched: cls_bpf: fix panic on filter replace
        net/mdio: fix mdio_bus_match for c45 PHY
        net: ratelimit warnings about dst entry refcount underflow or overflow
        caif: fix leaks and race in caif_queue_rcv_skb()
        qmi_wwan: add the second QMI/network interface for Sierra Wireless MC7305/MC7355
        ravb: fix race updating TCCR
        ...
      c5dfd654
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 5a5ca73a
      Linus Torvalds authored
      Pull ARM64 fixes from Catalin Marinas:
      
       - arm64 build fix following the move of the thread_struct to the end of
         task_struct and the asm offsets becoming too large for the AArch64
         ISA
      
       - preparatory patch for moving irq_data struct members (applied now to
         reduce dependency for the next merging window)
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        ARM64/irq: Use access helper irq_data_get_affinity_mask()
        arm64: switch_to: calculate cpu context pointer using separate register
      5a5ca73a
    • Jiang Liu's avatar
      ARM64/irq: Use access helper irq_data_get_affinity_mask() · 3bc38fc1
      Jiang Liu authored
      This is a preparatory patch for moving irq_data struct members.
      Signed-off-by: default avatarJiang Liu <jiang.liu@linux.intel.com>
      Reviewed-by: default avatarHanjun Guo <hanjun.guo@linaro.org>
      Cc: linux-arm-kernel@lists.infradead.org
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      3bc38fc1
    • Will Deacon's avatar
      arm64: switch_to: calculate cpu context pointer using separate register · c0d3fce5
      Will Deacon authored
      Commit 0c8c0f03 ("x86/fpu, sched: Dynamically allocate 'struct fpu'")
      moved the thread_struct to the bottom of task_struct. As a result, the
      offset is now too large to be used in an immediate add on arm64 with
      some kernel configs:
      
      arch/arm64/kernel/entry.S: Assembler messages:
      arch/arm64/kernel/entry.S:588: Error: immediate out of range
      arch/arm64/kernel/entry.S:597: Error: immediate out of range
      
      This patch calculates the offset using an additional register instead of
      an immediate offset.
      
      Fixes: 0c8c0f03 ("x86/fpu, sched: Dynamically allocate 'struct fpu'")
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Olof Johansson <olof@lixom.net>
      Cc: Ingo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Tested-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      c0d3fce5
    • Sergei Shtylyov's avatar
      ravb: fix ring memory allocation · d8b48911
      Sergei Shtylyov authored
      The driver is written as if it can adapt to a low memory situation  allocating
      less RX  skbs and TX aligned buffers than the respective RX/TX ring sizes.  In
      reality  though  the driver  would malfunction in this case. Stop being overly
      smart and just fail in such situation -- this is achieved by moving the memory
      allocation from ravb_ring_format() to ravb_ring_init().
      
      We leave dma_map_single() calls in place but make their failure non-fatal
      by marking the corresponding RX descriptors  with zero data size which should
      prevent DMA to an invalid addresses.
      Signed-off-by: default avatarSergei Shtylyov <sergei.shtylyov@cogentembedded.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d8b48911
    • Dan Murphy's avatar
      net: phy: dp83867: Fix warning check for setting the internal delay · a46fa260
      Dan Murphy authored
      Fix warning: logical ‘or’ of collectively exhaustive tests is always true
      
      Change the internal delay check from an 'or' condition to an 'and'
      condition.
      Reported-by: default avatarDavid Binderman <dcb314@hotmail.com>
      Signed-off-by: default avatarDan Murphy <dmurphy@ti.com>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a46fa260
    • Chris J Arges's avatar
      openvswitch: allocate nr_node_ids flow_stats instead of num_possible_nodes · bac541e4
      Chris J Arges authored
      Some architectures like POWER can have a NUMA node_possible_map that
      contains sparse entries. This causes memory corruption with openvswitch
      since it allocates flow_cache with a multiple of num_possible_nodes() and
      assumes the node variable returned by for_each_node will index into
      flow->stats[node].
      
      Use nr_node_ids to allocate a maximal sparse array instead of
      num_possible_nodes().
      
      The crash was noticed after 3af229f2 was applied as it changed the
      node_possible_map to match node_online_map on boot.
      Fixes: 3af229f2Signed-off-by: default avatarChris J Arges <chris.j.arges@canonical.com>
      Acked-by: default avatarPravin B Shelar <pshelar@nicira.com>
      Acked-by: default avatarNishanth Aravamudan <nacc@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bac541e4
    • Florian Westphal's avatar
      netlink: don't hold mutex in rcu callback when releasing mmapd ring · 0470eb99
      Florian Westphal authored
      Kirill A. Shutemov says:
      
      This simple test-case trigers few locking asserts in kernel:
      
      int main(int argc, char **argv)
      {
              unsigned int block_size = 16 * 4096;
              struct nl_mmap_req req = {
                      .nm_block_size          = block_size,
                      .nm_block_nr            = 64,
                      .nm_frame_size          = 16384,
                      .nm_frame_nr            = 64 * block_size / 16384,
              };
              unsigned int ring_size;
      	int fd;
      
      	fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
              if (setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, &req, sizeof(req)) < 0)
                      exit(1);
              if (setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, &req, sizeof(req)) < 0)
                      exit(1);
      
      	ring_size = req.nm_block_nr * req.nm_block_size;
      	mmap(NULL, 2 * ring_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
      	return 0;
      }
      
      +++ exited with 0 +++
      BUG: sleeping function called from invalid context at /home/kas/git/public/linux-mm/kernel/locking/mutex.c:616
      in_atomic(): 1, irqs_disabled(): 0, pid: 1, name: init
      3 locks held by init/1:
       #0:  (reboot_mutex){+.+...}, at: [<ffffffff81080959>] SyS_reboot+0xa9/0x220
       #1:  ((reboot_notifier_list).rwsem){.+.+..}, at: [<ffffffff8107f379>] __blocking_notifier_call_chain+0x39/0x70
       #2:  (rcu_callback){......}, at: [<ffffffff810d32e0>] rcu_do_batch.isra.49+0x160/0x10c0
      Preemption disabled at:[<ffffffff8145365f>] __delay+0xf/0x20
      
      CPU: 1 PID: 1 Comm: init Not tainted 4.1.0-00009-gbddf4c4818e0 #253
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Debian-1.8.2-1 04/01/2014
       ffff88017b3d8000 ffff88027bc03c38 ffffffff81929ceb 0000000000000102
       0000000000000000 ffff88027bc03c68 ffffffff81085a9d 0000000000000002
       ffffffff81ca2a20 0000000000000268 0000000000000000 ffff88027bc03c98
      Call Trace:
       <IRQ>  [<ffffffff81929ceb>] dump_stack+0x4f/0x7b
       [<ffffffff81085a9d>] ___might_sleep+0x16d/0x270
       [<ffffffff81085bed>] __might_sleep+0x4d/0x90
       [<ffffffff8192e96f>] mutex_lock_nested+0x2f/0x430
       [<ffffffff81932fed>] ? _raw_spin_unlock_irqrestore+0x5d/0x80
       [<ffffffff81464143>] ? __this_cpu_preempt_check+0x13/0x20
       [<ffffffff8182fc3d>] netlink_set_ring+0x1ed/0x350
       [<ffffffff8182e000>] ? netlink_undo_bind+0x70/0x70
       [<ffffffff8182fe20>] netlink_sock_destruct+0x80/0x150
       [<ffffffff817e484d>] __sk_free+0x1d/0x160
       [<ffffffff817e49a9>] sk_free+0x19/0x20
      [..]
      
      Cong Wang says:
      
      We can't hold mutex lock in a rcu callback, [..]
      
      Thomas Graf says:
      
      The socket should be dead at this point. It might be simpler to
      add a netlink_release_ring() function which doesn't require
      locking at all.
      Reported-by: default avatar"Kirill A. Shutemov" <kirill@shutemov.name>
      Diagnosed-by: default avatarCong Wang <cwang@twopensource.com>
      Suggested-by: default avatarThomas Graf <tgraf@suug.ch>
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0470eb99
    • David S. Miller's avatar
      Merge branch 'arm-bpf-fixes' · 7c8cbaca
      David S. Miller authored
      Nicolas Schichan says:
      
      ====================
      BPF JIT fixes for ARM
      
      These patches are fixing bugs in the ARM JIT and should probably find
      their way to a stable kernel. All 60 test_bpf tests in Linux 4.1 release
      are now passing OK (was 54 out of 60 before).
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7c8cbaca
    • Nicolas Schichan's avatar
      ARM: net: fix vlan access instructions in ARM JIT. · c18fe54b
      Nicolas Schichan authored
      This makes BPF_ANC | SKF_AD_VLAN_TAG and BPF_ANC | SKF_AD_VLAN_TAG_PRESENT
      have the same behaviour as the in kernel VM and makes the test_bpf LD_VLAN_TAG
      and LD_VLAN_TAG_PRESENT tests pass.
      Signed-off-by: default avatarNicolas Schichan <nschichan@freebox.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c18fe54b
    • Nicolas Schichan's avatar
      ARM: net: handle negative offsets in BPF JIT. · 6d715e30
      Nicolas Schichan authored
      Previously, the JIT would reject negative offsets known during code
      generation and mishandle negative offsets provided at runtime.
      
      Fix that by calling bpf_internal_load_pointer_neg_helper()
      appropriately in the jit_get_skb_{b,h,w} slow path helpers and by forcing
      the execution flow to the slow path helpers when the offset is
      negative.
      Signed-off-by: default avatarNicolas Schichan <nschichan@freebox.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6d715e30
    • Nicolas Schichan's avatar
      ARM: net: fix condition for load_order > 0 when translating load instructions. · 7aed35cb
      Nicolas Schichan authored
      To check whether the load should take the fast path or not, the code
      would check that (r_skb_hlen - load_order) is greater than the offset
      of the access using an "Unsigned higher or same" condition. For
      halfword accesses and an skb length of 1 at offset 0, that test is
      valid, as we end up comparing 0xffffffff(-1) and 0, so the fast path
      is taken and the filter allows the load to wrongly succeed. A similar
      issue exists for word loads at offset 0 and an skb length of less than
      4.
      
      Fix that by using the condition "Signed greater than or equal"
      condition for the fast path code for load orders greater than 0.
      Signed-off-by: default avatarNicolas Schichan <nschichan@freebox.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7aed35cb