1. 15 Jan, 2015 6 commits
    • Ahmed S. Darwish's avatar
      can: kvaser_usb: Don't free packets when tight on URBs · b442723f
      Ahmed S. Darwish authored
      Flooding the Kvaser CAN to USB dongle with multiple reads and
      writes in high frequency caused seemingly-random panics in the
      kernel.
      
      On further inspection, it seems the driver erroneously freed the
      to-be-transmitted packet upon getting tight on URBs and returning
      NETDEV_TX_BUSY, leading to invalid memory writes and double frees
      at a later point in time.
      
      Note:
      
      Finding no more URBs/transmit-contexts and returning NETDEV_TX_BUSY
      is a driver bug in and out of itself: it means that our start/stop
      queue flow control is broken.
      
      This patch only fixes the (buggy) error handling code; the root
      cause shall be fixed in a later commit.
      Acked-by: default avatarOlivier Sobrie <olivier@sobrie.be>
      Signed-off-by: default avatarAhmed S. Darwish <ahmed.darwish@valeo.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      b442723f
    • Roger Quadros's avatar
      can: c_can: use regmap_update_bits() to modify RAMINIT register · 47e3485a
      Roger Quadros authored
      use of regmap_read() and regmap_write() in c_can_hw_raminit_syscon()
      is not safe as the RAMINIT register can be shared between different drivers
      at least for TI SoCs.
      
      To make the modification atomic we switch to using regmap_update_bits().
      
      regmap_update_bits() skips writing to the register if it's read content is the
      same as what is going to be written. This causes an issue for us when we
      need to clear the DONE bit with the initial condition START:0, DONE:1 as
      DONE bit must be written with 1 to clear it.
      
      So we defer the clearing of DONE bit to later when we set the START bit.
      There we are sure that START bit is changed from 0 to 1 so the write of
      1 to already set DONE bit will happen.
      Signed-off-by: default avatarRoger Quadros <rogerq@ti.com>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      47e3485a
    • Oliver Hartkopp's avatar
      can: m_can: tag current CAN FD controllers as non-ISO · 6cfda7fb
      Oliver Hartkopp authored
      During the CAN FD standardization process within the ISO it turned out that
      the failure detection capability has to be improved.
      
      The CAN in Automation organization (CiA) defined the already implemented CAN
      FD controllers as 'non-ISO' and the upcoming improved CAN FD controllers as
      'ISO' compliant. See at http://www.can-cia.com/index.php?id=1937
      
      Finally there will be three types of CAN FD controllers in the future:
      
      1. ISO compliant (fixed)
      2. non-ISO compliant (fixed, like the M_CAN IP v3.0.1 in m_can.c)
      3. ISO/non-ISO CAN FD controllers (switchable, like the PEAK USB FD)
      
      So the current M_CAN driver for the M_CAN IP v3.0.1 has to expose its non-ISO
      implementation by setting the CAN_CTRLMODE_FD_NON_ISO ctrlmode at startup.
      As this bit cannot be switched at configuration time CAN_CTRLMODE_FD_NON_ISO
      must not be set in ctrlmode_supported of the current M_CAN driver.
      Signed-off-by: default avatarOliver Hartkopp <socketcan@hartkopp.net>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      6cfda7fb
    • Oliver Hartkopp's avatar
      can: dev: fix crtlmode_supported check · 9b1087aa
      Oliver Hartkopp authored
      When changing flags in the CAN drivers ctrlmode the provided new content has to
      be checked whether the bits are allowed to be changed. The bits that are to be
      changed are given as a bitfield in cm->mask. Therefore checking against
      cm->flags is wrong as the content can hold any kind of values.
      
      The iproute2 tool sets the bits in cm->mask and cm->flags depending on the
      detected command line options. To be robust against bogus user space
      applications additionally sanitize the provided flags with the provided mask.
      
      Cc: Wolfgang Grandegger <wg@grandegger.com>
      Signed-off-by: default avatarOliver Hartkopp <socketcan@hartkopp.net>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      9b1087aa
    • Marc Kleine-Budde's avatar
      MAINTAINERS: update linux-can git repositories · 870482a4
      Marc Kleine-Budde authored
      The linux-can upstream git repositories are now hosted on kernel.org, update
      MAINTAINERS accordingly.
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      870482a4
    • Sriharsha Basavapatna's avatar
      be2net: Allow GRE to work concurrently while a VxLAN tunnel is configured · 16dde0d6
      Sriharsha Basavapatna authored
      Other tunnels like GRE break while VxLAN offloads are enabled in Skyhawk-R. To
      avoid this, we should restrict offload features on a per-packet basis in such
      conditions.
      Signed-off-by: default avatarSriharsha Basavapatna <sriharsha.basavapatna@emulex.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      16dde0d6
  2. 14 Jan, 2015 17 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · a6391a92
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Don't use uninitialized data in IPVS, from Dan Carpenter.
      
       2) conntrack race fixes from Pablo Neira Ayuso.
      
       3) Fix TX hangs with i40e, from Jesse Brandeburg.
      
       4) Fix budget return from poll calls in dnet and alx, from Eric
          Dumazet.
      
       5) Fix bugus "if (unlikely(x) < 0)" test in AF_PACKET, from Christoph
          Jaeger.
      
       6) Fix bug introduced by conversion to list_head in TIPC retransmit
          code, from Jon Paul Maloy.
      
       7) Don't use GFP_NOIO under spinlock in USB kaweth driver, from Alexey
          Khoroshilov.
      
       8) Fix bridge build with INET disabled, from Arnd Bergmann.
      
       9) Fix netlink array overrun for PROBE attributes in openvswitch, from
          Thomas Graf.
      
      10) Don't hold spinlock across synchronize_irq() in tg3 driver, from
          Prashant Sreedharan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits)
        tg3: Release tp->lock before invoking synchronize_irq()
        tg3: tg3_reset_task() needs to use rtnl_lock to synchronize
        tg3: tg3_timer() should grab tp->lock before checking for tp->irq_sync
        team: avoid possible underflow of count_pending value for notify_peers and mcast_rejoin
        openvswitch: packet messages need their own probe attribtue
        i40e: adds FCoE configure option
        cxgb4vf: Fix queue allocation for 40G adapter
        netdevice: Add missing parentheses in macro
        bridge: only provide proxy ARP when CONFIG_INET is enabled
        neighbour: fix base_reachable_time(_ms) not effective immediatly when changed
        net: fec: fix MDIO bus assignement for dual fec SoC's
        xen-netfront: use different locks for Rx and Tx stats
        drivers: net: cpsw: fix multicast flush in dual emac mode
        cxgb4vf: Initialize mdio_addr before using it
        net: Corrected the comment describing the ndo operations to reflect the actual prototype for couple of operations
        usb/kaweth: use GFP_ATOMIC under spin_lock in usb_start_wait_urb()
        MAINTAINERS: add me as ibmveth maintainer
        tipc: fix bug in broadcast retransmit code
        update ip-sysctl.txt documentation (v2)
        net/at91_ether: prepare and unprepare clock
        ...
      a6391a92
    • David S. Miller's avatar
      Merge branch 'tg3-net' · c637dbce
      David S. Miller authored
      Prashant Sreedharan says:
      
      ====================
      tg3: synchronize_irq() should be called without taking locks
      
      v2: Added Reported-by, Tested-by fields and reference to the thread that
          reported the problem
      
      This series addresses the problem reported by Peter Hurley in mail thread
      https://lkml.org/lkml/2015/1/12/1082
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c637dbce
    • Prashant Sreedharan's avatar
      tg3: Release tp->lock before invoking synchronize_irq() · 932f19de
      Prashant Sreedharan authored
      synchronize_irq() can sleep waiting, for pending IRQ handlers so driver
      should release the tp->lock spin lock before invoking synchronize_irq()
      Reported-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Tested-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Signed-off-by: default avatarPrashant Sreedharan <prashant@broadcom.com>
      Signed-off-by: default avatarMichael Chan <mchan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      932f19de
    • Prashant Sreedharan's avatar
      tg3: tg3_reset_task() needs to use rtnl_lock to synchronize · db84bf43
      Prashant Sreedharan authored
      Currently tg3_reset_task() uses only tp->lock for synchronizing with code
      paths like tg3_open() etc. But since tp->lock is released before doing
      synchronize_irq(), rtnl_lock should be taken in tg3_reset_task() to
      synchronize it with other code paths.
      Reported-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Tested-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Signed-off-by: default avatarPrashant Sreedharan <prashant@broadcom.com>
      Signed-off-by: default avatarMichael Chan <mchan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      db84bf43
    • Prashant Sreedharan's avatar
      tg3: tg3_timer() should grab tp->lock before checking for tp->irq_sync · 4fd190a9
      Prashant Sreedharan authored
      This is to avoid the race between tg3_timer() and the execution paths
      which does not invoke tg3_timer_stop() and releases tp->lock before
      calling synchronize_irq()
      Reported-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Tested-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Signed-off-by: default avatarPrashant Sreedharan <prashant@broadcom.com>
      Signed-off-by: default avatarMichael Chan <mchan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4fd190a9
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 48c53db2
      Linus Torvalds authored
      Pull kvm fixes from Paolo Bonzini:
       "Two bugfixes for arm64.  I will have another pull request next week,
        but otherwise things are calm"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        arm64: KVM: Fix HCR setting for 32bit guests
        arm64: KVM: Fix TLB invalidation by IPA/VMID
      48c53db2
    • Jiri Pirko's avatar
      team: avoid possible underflow of count_pending value for notify_peers and mcast_rejoin · b0d11b42
      Jiri Pirko authored
      This patch is fixing a race condition that may cause setting
      count_pending to -1, which results in unwanted big bulk of arp messages
      (in case of "notify peers").
      
      Consider following scenario:
      
      count_pending == 2
         CPU0                                           CPU1
      					team_notify_peers_work
      					  atomic_dec_and_test (dec count_pending to 1)
      					  schedule_delayed_work
       team_notify_peers
         atomic_add (adding 1 to count_pending)
      					team_notify_peers_work
      					  atomic_dec_and_test (dec count_pending to 1)
      					  schedule_delayed_work
      					team_notify_peers_work
      					  atomic_dec_and_test (dec count_pending to 0)
         schedule_delayed_work
      					team_notify_peers_work
      					  atomic_dec_and_test (dec count_pending to -1)
      
      Fix this race by using atomic_dec_if_positive - that will prevent
      count_pending running under 0.
      
      Fixes: fc423ff0 ("team: add peer notification")
      Fixes: 492b200e  ("team: add support for sending multicast rejoins")
      Signed-off-by: default avatarJiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarJiri Benc <jbenc@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b0d11b42
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · 6fb400d3
      Linus Torvalds authored
      Pull s390 fixes from Martin Schwidefsky:
       "Two small performance tweaks, the plumbing for the execveat system
        call and a couple of bug fixes"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/uprobes: fix user space PER events
        s390/bpf: Fix JMP_JGE_X (A > X) and JMP_JGT_X (A >= X)
        s390/bpf: Fix ALU_NEG (A = -A)
        s390/mm: avoid using pmd_to_page for !USE_SPLIT_PMD_PTLOCKS
        s390/timex: fix get_tod_clock_ext() inline assembly
        s390: wire up execveat syscall
        s390/kernel: use stnsm 255 instead of stosm 0
        s390/vtime: Get rid of redundant WARN_ON
        s390/zcrypt: kernel oops at insmod of the z90crypt device driver
      6fb400d3
    • Thomas Graf's avatar
      openvswitch: packet messages need their own probe attribtue · 1ba39804
      Thomas Graf authored
      User space is currently sending a OVS_FLOW_ATTR_PROBE for both flow
      and packet messages. This leads to an out-of-bounds access in
      ovs_packet_cmd_execute() because OVS_FLOW_ATTR_PROBE >
      OVS_PACKET_ATTR_MAX.
      
      Introduce a new OVS_PACKET_ATTR_PROBE with the same numeric value
      as OVS_FLOW_ATTR_PROBE to grow the range of accepted packet attributes
      while maintaining to be binary compatible with existing OVS binaries.
      
      Fixes: 05da5898 ("openvswitch: Add support for OVS_FLOW_ATTR_PROBE.")
      Reported-by: default avatarSander Eikelenboom <linux@eikelenboom.it>
      Tracked-down-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarThomas Graf <tgraf@suug.ch>
      Reviewed-by: default avatarJesse Gross <jesse@nicira.com>
      Acked-by: default avatarPravin B Shelar <pshelar@nicira.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1ba39804
    • Vasu Dev's avatar
      i40e: adds FCoE configure option · 776d4e9f
      Vasu Dev authored
      Adds FCoE config option I40E_FCOE, so that FCoE can be enabled
      as needed but otherwise have it disabled by default.
      
      This also eliminate multiple FCoE config checks, instead now just
      one config check for CONFIG_I40E_FCOE.
      
      The I40E FCoE was added with 3.17 kernel and therefore this patch
      shall be applied to stable 3.17 kernel also.
      
      CC: <stable@vger.kernel.org>
      Signed-off-by: default avatarVasu Dev <vasu.dev@intel.com>
      Tested-by: default avatarJim Young <jamesx.m.young@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      776d4e9f
    • Hariprasad Shenai's avatar
    • Linus Torvalds's avatar
      Merge tag 'locks-v3.19-1' of git://git.samba.org/jlayton/linux · fb005c47
      Linus Torvalds authored
      Pull file locking fix from Jeff Layton:
       "Just a simple bugfix for a regression that I introduced into v3.18
        with the internal lease API overhaul -- mea culpa.  Kudos to Linda and
        Neil for tracking this down and fixing it"
      
      * tag 'locks-v3.19-1' of git://git.samba.org/jlayton/linux:
        locks: fix NULL-deref in generic_delete_lease
      fb005c47
    • Benjamin Poirier's avatar
      netdevice: Add missing parentheses in macro · 4ccce02e
      Benjamin Poirier authored
      For example, one could conceivably call
      	for_each_netdev_in_bond_rcu(condition ? bond1 : bond2, slave)
      and get an unexpected result.
      Signed-off-by: default avatarBenjamin Poirier <bpoirier@suse.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4ccce02e
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 31238e61
      Linus Torvalds authored
      Pull block layer fixes from Jens Axboe:
       "The major part is an update to the NVMe driver, fixing various issues
        around surprise removal and hung controllers.  Most of that is from
        Keith, and parts are simple blk-mq fixes or exports/additions of minor
        functions to aid this effort, and parts are changes directly to the
        NVMe driver.
      
        Apart from the above, this contains:
      
         - Small blk-mq change from me, killing an unused member of the
           hardware queue structure.
      
         - Small fix from Ming Lei, fixing up a few drivers that didn't
           properly check for ERR_PTR() returns from blk_mq_init_queue()"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        NVMe: Fix locking on abort handling
        NVMe: Start and stop h/w queues on reset
        NVMe: Command abort handling fixes
        NVMe: Admin queue removal handling
        NVMe: Reference count admin queue usage
        NVMe: Start all requests
        blk-mq: End unstarted requests on a dying queue
        blk-mq: Allow requests to never expire
        blk-mq: Add helper to abort requeued requests
        blk-mq: Let drivers cancel requeue_work
        blk-mq: Export if requests were started
        blk-mq: Wake tasks entering queue on dying
        blk-mq: get rid of ->cmd_size in the hardware queue
        block: fix checking return value of blk_mq_init_queue
        block: wake up waiters when a queue is marked dying
        NVMe: Fix double free irq
        blk-mq: Export freeze/unfreeze functions
        blk-mq: Exit queue on alloc failure
      31238e61
    • Arnd Bergmann's avatar
      bridge: only provide proxy ARP when CONFIG_INET is enabled · d92cfdbb
      Arnd Bergmann authored
      When IPV4 support is disabled, we cannot call arp_send from
      the bridge code, which would result in a kernel link error:
      
      net/built-in.o: In function `br_handle_frame_finish':
      :(.text+0x59914): undefined reference to `arp_send'
      :(.text+0x59a50): undefined reference to `arp_tbl'
      
      This makes the newly added proxy ARP support in the bridge
      code depend on the CONFIG_INET symbol and lets the compiler
      optimize the code out to avoid the link error.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Fixes: 95850116 ("bridge: Add support for IEEE 802.11 Proxy ARP")
      Cc: Kyeyoon Park <kyeyoonp@codeaurora.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d92cfdbb
    • Jean-Francois Remy's avatar
      neighbour: fix base_reachable_time(_ms) not effective immediatly when changed · 4bf6980d
      Jean-Francois Remy authored
      When setting base_reachable_time or base_reachable_time_ms on a
      specific interface through sysctl or netlink, the reachable_time
      value is not updated.
      
      This means that neighbour entries will continue to be updated using the
      old value until it is recomputed in neigh_period_work (which
          recomputes the value every 300*HZ).
      On systems with HZ equal to 1000 for instance, it means 5mins before
      the change is effective.
      
      This patch changes this behavior by recomputing reachable_time after
      each set on base_reachable_time or base_reachable_time_ms.
      The new value will become effective the next time the neighbour's timer
      is triggered.
      
      Changes are made in two places: the netlink code for set and the sysctl
      handling code. For sysctl, I use a proc_handler. The ipv6 network
      code does provide its own handler but it already refreshes
      reachable_time correctly so it's not an issue.
      Any other user of neighbour which provide its own handlers must
      refresh reachable_time.
      Signed-off-by: default avatarJean-Francois Remy <jeff@melix.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4bf6980d
    • Stefan Agner's avatar
      net: fec: fix MDIO bus assignement for dual fec SoC's · 3d125f9c
      Stefan Agner authored
      On i.MX28, the MDIO bus is shared between the two FEC instances.
      The driver makes sure that the second FEC uses the MDIO bus of the
      first FEC. This is done conditionally if FEC_QUIRK_ENET_MAC is set.
      However, in newer designs, such as Vybrid or i.MX6SX, each FEC MAC
      has its own MDIO bus. Simply removing the quirk FEC_QUIRK_ENET_MAC
      is not an option since other logic, triggered by this quirk, is
      still needed.
      
      Furthermore, there are board designs which use the same MDIO bus
      for both PHY's even though the second bus would be available on the
      SoC side. Such layout are popular since it saves pins on SoC side.
      Due to the above quirk, those boards currently do work fine. The
      boards in the mainline tree with such a layout are:
      - Freescale Vybrid Tower with TWR-SER2 (vf610-twr.dts)
      - Freescale i.MX6 SoloX SDB Board (imx6sx-sdb.dts)
      
      This patch adds a new quirk FEC_QUIRK_SINGLE_MDIO for i.MX28, which
      makes sure that the MDIO bus of the first FEC is used in any case.
      
      However, the boards above do have a SoC with a MDIO bus for each FEC
      instance. But the PHY's are not connected in a 1:1 configuration. A
      proper device tree description is needed to allow the driver to
      figure out where to find its PHY. This patch fixes that shortcoming
      by adding a MDIO bus child node to the first FEC instance, along
      with the two PHY's on that bus, and making use of the phy-handle
      property to add a reference to the PHY's.
      Acked-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarStefan Agner <stefan@agner.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3d125f9c
  3. 13 Jan, 2015 17 commits