1. 06 Mar, 2015 1 commit
  2. 05 Mar, 2015 1 commit
    • Emmanuel Grumbach's avatar
      iwlwifi: mvm: BT Coex - fix a NULL pointer exception · 4cd4b50c
      Emmanuel Grumbach authored
      The commit below introduced an unsafe dereference of
      mvmvif->phy_ctxt. It can be NULL even if we hold the mutex.
      We can be handling a BT Coex notification while the vif has
      already been unassigned. This can happen since the BT Coex
      notification is hanled asynchronuously: we can have started
      to handle the BT Coex notification trying to acquire the
      mutex while the unassign flow already got it. The BT Coex
      notification handling will wait for the mutext. I'll get it
      later, but then mvmvif->phy_ctxt will be NULL.
      
      Panic log:
      
      BUG: unable to handle kernel NULL pointer dereference at   (null)
      IP: [<f985180d>] iwl_mvm_bt_notif_iterator+0x9d/0x340 [iwlmvm]
      *pdpt = 0000000000000000 *pde = f000eef300000007
      Oops: 0000 [#1] SMP
      Workqueue: events iwl_mvm_async_handlers_wk [iwlmvm]
      task: ed719b20 ti: ec03e000 task.ti: ec03e000
      EIP: 0060:[<f985180d>] EFLAGS: 00010202 CPU: 2
      EIP is at iwl_mvm_bt_notif_iterator+0x9d/0x340 [iwlmvm]
      EAX: 00000000 EBX: f6d3cb70 ECX: f6d3cb70 EDX: 00000000
      ESI: ec03fe40 EDI: efeb8810 EBP: ec03fdf0 ESP: ec03fdac
       DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
      CR0: 80050033 CR2: 00000000 CR3: 01a1a000 CR4: 001407f0
      Stack:
       f743ca80 f744a404 ec03fdcc c10e3952 00003aba f743ca80 00000246 f743ca80
       00000246 00000000 00000001 00000000 ebd45ff6 ebd458a4 f6d3c500 ebd45578
       ebd44b01 ec03fe18 f99e1bc2 00000002 ebd44bc0 f9851770 00000000 f6d3c500
      Call Trace:
       [<c10e3952>] ? ring_buffer_unlock_commit+0xa2/0xd0
       [<f99e1bc2>] __iterate_interfaces+0x82/0x110 [mac80211]
       [<f9851770>] ? iwl_mvm_bt_coex_reduced_txp+0x140/0x140 [iwlmvm]
       [<f99e1c6a>] ieee80211_iterate_active_interfaces_atomic+0x1a/0x20 [mac80211]
       [<f9851427>] iwl_mvm_bt_coex_notif_handle+0x77/0x280 [iwlmvm]
       [<f9852161>] iwl_mvm_rx_bt_coex_notif_old+0x211/0x220 [iwlmvm]
       [<f9850b8b>] iwl_mvm_rx_bt_coex_notif+0x19b/0x1b0 [iwlmvm]
       [<f983944f>] iwl_mvm_async_handlers_wk+0x7f/0xe0 [iwlmvm]
      
      CC: <stable@vger.kernel.org> [3.19+]
      Fixes: 123f5156 ("iwlwifi: mvm: BT Coex - add support for TTC / RRC")
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      4cd4b50c
  3. 03 Mar, 2015 8 commits
  4. 02 Mar, 2015 3 commits
  5. 01 Mar, 2015 20 commits
    • David S. Miller's avatar
      Merge branch 'bcmgenet_systemport_stats' · 38674a49
      David S. Miller authored
      Florian Fainelli says:
      
      ====================
      net: bcmgenet and systemport statistics fixes
      
      This two patches fix a similar problem in the GENET and SYSTEMPORT drivers
      for software maintained statistics used to track DMA mapping and SKB
      re-allocation failures.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      38674a49
    • Florian Fainelli's avatar
      net: systemport: fix software maintained statistics · 55ff4ea9
      Florian Fainelli authored
      Commit 60b4ea17 ("net: systemport: log RX buffer allocation and RX/TX DMA
      failures") added a few software maintained statistics using
      BCM_SYSPORT_STAT_MIB_RX and BCM_SYSPORT_STAT_MIB_TX. These statistics are read
      from the hardware MIB counters, such that bcm_sysport_update_mib_counters() was
      trying to read from a non-existing MIB offset for these counters.
      
      Fix this by introducing a special type: BCM_SYSPORT_STAT_SOFT, similar to
      BCM_SYSPORT_STAT_NETDEV, such that bcm_sysport_get_ethtool_stats will read from
      the software mib.
      
      Fixes: 60b4ea17 ("net: systemport: log RX buffer allocation and RX/TX DMA failures")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      55ff4ea9
    • Florian Fainelli's avatar
      net: bcmgenet: fix software maintained statistics · f62ba9c1
      Florian Fainelli authored
      Commit 44c8bc3c ("net: bcmgenet: log RX buffer allocation and RX/TX dma
      failures") added a few software maintained statistics using
      BCMGENET_STAT_MIB_RX and BCMGENET_STAT_MIB_TX. These statistics are read from
      the hardware MIB counters, such that bcmgenet_update_mib_counters() was trying
      to read from a non-existing MIB offset for these counters.
      
      Fix this by introducing a special type: BCMGENET_STAT_SOFT, similar to
      BCMGENET_STAT_NETDEV, such that bcmgenet_get_ethtool_stats will read from the
      software mib.
      
      Fixes: 44c8bc3c ("net: bcmgenet: log RX buffer allocation and RX/TX dma failures")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f62ba9c1
    • Florian Westphal's avatar
      rxrpc: don't multiply with HZ twice · 765dd3bb
      Florian Westphal authored
      rxrpc_resend_timeout has an initial value of 4 * HZ; use it as-is.
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      765dd3bb
    • Florian Westphal's avatar
      rxrpc: terminate retrans loop when sending of skb fails · c03ae533
      Florian Westphal authored
      Typo, 'stop' is never set to true.
      Seems intent is to not attempt to retransmit more packets after sendmsg
      returns an error.
      
      This change is based on code inspection only.
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c03ae533
    • Arvid Brodin's avatar
      net/hsr: Fix NULL pointer dereference and refcnt bugs when deleting a HSR interface. · 56b08fdc
      Arvid Brodin authored
      To repeat:
      
      $ sudo ip link del hsr0
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
      IP: [<ffffffff8187f495>] hsr_del_port+0x15/0xa0
      etc...
      
      Bug description:
      
      As part of the hsr master device destruction, hsr_del_port() is called for each of
      the hsr ports. At each such call, the master device is updated regarding features
      and mtu. When the master device is freed before the slave interfaces, master will
      be NULL in hsr_del_port(), which led to a NULL pointer dereference.
      
      Additionally, dev_put() was called on the master device itself in hsr_del_port(),
      causing a refcnt error.
      
      A third bug in the same code path was that the rtnl lock was not taken before
      hsr_del_port() was called as part of hsr_dev_destroy().
      
      The reporter (Nicolas Dichtel) also said: "hsr_netdev_notify() supposes that the
      port will always be available when the notification is for an hsr interface. It's
      wrong. For example, netdev_wait_allrefs() may resend NETDEV_UNREGISTER.". As a
      precaution against this, a check for port == NULL was added in hsr_dev_notify().
      Reported-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
      Fixes: 51f3c605 ("net/hsr: Move slave init to hsr_slave.c.")
      Signed-off-by: default avatarArvid Brodin <arvid.brodin@alten.se>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      56b08fdc
    • Vaishali Thakkar's avatar
      net: pasemi: Use setup_timer and mod_timer · 187d6785
      Vaishali Thakkar authored
      Use timer API functions setup_timer and mod_timer instead
      of structure assignments as they are standard way to set
      the timer and to update the expire field of an active timer
      respectively.
      
      This is done using Coccinelle and semantic patch used for
      this is as follows:
      
      // <smpl>
      @@
      expression x,y,z,a,b;
      @@
      
      -init_timer (&x);
      +setup_timer (&x, y, z);
      +mod_timer (&a, b);
      -x.function = y;
      -x.data = z;
      -x.expires = b;
      -add_timer(&a);
      // </smpl>
      Signed-off-by: default avatarVaishali Thakkar <vthakkar1994@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      187d6785
    • Vaishali Thakkar's avatar
      net: stmmac: Use setup_timer and mod_timer · ccb36da1
      Vaishali Thakkar authored
      Use timer API functions setup_timer and mod_timer instead
      of structure assignments as they are standard way to set
      the timer and to update the expire field of an active timer
      respectively.
      
      This is done using Coccinelle and semantic patch used for
      this is as follows:
      
      // <smpl>
      @@
      expression x,y,z,a,b;
      @@
      
      -init_timer (&x);
      +setup_timer (&x, y, z);
      +mod_timer (&a, b);
      -x.function = y;
      -x.data = z;
      -x.expires = b;
      -add_timer(&a);
      // </smpl>
      Signed-off-by: default avatarVaishali Thakkar <vthakkar1994@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ccb36da1
    • Vaishali Thakkar's avatar
      net: 8390: axnet_cs: Use setup_timer and mod_timer · 6753a971
      Vaishali Thakkar authored
      Use timer API functions setup_timer and mod_timer instead
      of structure assignments as they are standard way to set
      the timer and to update the expire field of an active timer
      respectively.
      
      This is done using Coccinelle and semantic patch used for
      this is as follows:
      
      // <smpl>
      @@
      expression x,y,z,a,b;
      @@
      
      -init_timer (&x);
      +setup_timer (&x, y, z);
      +mod_timer (&a, b);
      -x.function = y;
      -x.data = z;
      -x.expires = b;
      -add_timer(&a);
      // </smpl>
      Signed-off-by: default avatarVaishali Thakkar <vthakkar1994@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6753a971
    • Vaishali Thakkar's avatar
      net: 8390: pcnet_cs: Use setup_timer and mod_timer · fc4ba636
      Vaishali Thakkar authored
      Use timer API functions setup_timer and mod_timer instead
      of structure assignments as they are standard way to set
      the timer and to update the expire field of an active timer
      respectively.
      
      This is done using Coccinelle and semantic patch used for
      this is as follows:
      
      // <smpl>
      @@
      expression x,y,z,a,b;
      @@
      
      -init_timer (&x);
      +setup_timer (&x, y, z);
      +mod_timer (&a, b);
      -x.function = y;
      -x.data = z;
      -x.expires = b;
      -add_timer(&a);
      // </smpl>
      Signed-off-by: default avatarVaishali Thakkar <vthakkar1994@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fc4ba636
    • Vaishali Thakkar's avatar
      net: smc91c92_cs: Use setup_timer and mod_timer · b8b01344
      Vaishali Thakkar authored
      Use timer API functions setup_timer and mod_timer instead
      of structure assignments as they are standard way to set
      the timer and to update the expire field of an active timer
      respectively.
      
      This is done using Coccinelle and semantic patch used for
      this is as follows:
      
      // <smpl>
      @@
      expression x,y,z,a,b;
      @@
      
      -init_timer (&x);
      +setup_timer (&x, y, z);
      +mod_timer (&a, b);
      -x.function = y;
      -x.data = z;
      -x.expires = b;
      -add_timer(&a);
      // </smpl>
      Signed-off-by: default avatarVaishali Thakkar <vthakkar1994@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b8b01344
    • Yannick Guerrini's avatar
      netxen_nic: Fix trivial typos in comments · f7c30688
      Yannick Guerrini authored
      Change 'mutliple' to 'multiple'
      Change 'Firmare' to 'Firmware'
      Signed-off-by: default avatarYannick Guerrini <yguerrini@tomshardware.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f7c30688
    • Yannick Guerrini's avatar
      qlcnic: Fix trivial typo in comment · 00c7eb99
      Yannick Guerrini authored
      Change 'Firmare' to 'Firmware'
      Signed-off-by: default avatarYannick Guerrini <yguerrini@tomshardware.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      00c7eb99
    • Grygorii Strashko's avatar
      net: ti: cpsw: add hibernation callbacks · 8963a504
      Grygorii Strashko authored
      Setting a dev_pm_ops suspend/resume pair but not a set of
      hibernation functions means those pm functions will not be
      called upon hibernation.
      Fix this by using SIMPLE_DEV_PM_OPS, which appropriately
      assigns the suspend and hibernation handlers and move
      cpsw_suspend/resume calbacks under CONFIG_PM_SLEEP
      to avoid build warnings.
      Signed-off-by: default avatarGrygorii Strashko <Grygorii.Strashko@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8963a504
    • Grygorii Strashko's avatar
      net: davinci_mdio: add hibernation callbacks · 2f5c54ce
      Grygorii Strashko authored
      Setting a dev_pm_ops suspend_late/resume_early pair but not a
      set of hibernation functions means those pm functions will
      not be called upon hibernation.
      Fix this by using SET_LATE_SYSTEM_SLEEP_PM_OPS, which appropriately
      assigns the suspend and hibernation handlers and move
      davinci_mdio_x callbacks under CONFIG_PM_SLEEP to avoid build warnings.
      Signed-off-by: default avatarGrygorii Strashko <Grygorii.Strashko@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2f5c54ce
    • Eric Dumazet's avatar
      net: do not use rcu in rtnl_dump_ifinfo() · cac5e65e
      Eric Dumazet authored
      We did a failed attempt in the past to only use rcu in rtnl dump
      operations (commit e67f88dd "net: dont hold rtnl mutex during
      netlink dump callbacks")
      
      Now that dumps are holding RTNL anyway, there is no need to also
      use rcu locking, as it forbids any scheduling ability, like
      GFP_KERNEL allocations that controlling path should use instead
      of GFP_ATOMIC whenever possible.
      
      This should fix following splat Cong Wang reported :
      
       [ INFO: suspicious RCU usage. ]
       3.19.0+ #805 Tainted: G        W
      
       include/linux/rcupdate.h:538 Illegal context switch in RCU read-side critical section!
      
       other info that might help us debug this:
      
       rcu_scheduler_active = 1, debug_locks = 0
       2 locks held by ip/771:
        #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff8182b8f4>] netlink_dump+0x21/0x26c
        #1:  (rcu_read_lock){......}, at: [<ffffffff817d785b>] rcu_read_lock+0x0/0x6e
      
       stack backtrace:
       CPU: 3 PID: 771 Comm: ip Tainted: G        W       3.19.0+ #805
       Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
        0000000000000001 ffff8800d51e7718 ffffffff81a27457 0000000029e729e6
        ffff8800d6108000 ffff8800d51e7748 ffffffff810b539b ffffffff820013dd
        00000000000001c8 0000000000000000 ffff8800d7448088 ffff8800d51e7758
       Call Trace:
        [<ffffffff81a27457>] dump_stack+0x4c/0x65
        [<ffffffff810b539b>] lockdep_rcu_suspicious+0x107/0x110
        [<ffffffff8109796f>] rcu_preempt_sleep_check+0x45/0x47
        [<ffffffff8109e457>] ___might_sleep+0x1d/0x1cb
        [<ffffffff8109e67d>] __might_sleep+0x78/0x80
        [<ffffffff814b9b1f>] idr_alloc+0x45/0xd1
        [<ffffffff810cb7ab>] ? rcu_read_lock_held+0x3b/0x3d
        [<ffffffff814b9f9d>] ? idr_for_each+0x53/0x101
        [<ffffffff817c1383>] alloc_netid+0x61/0x69
        [<ffffffff817c14c3>] __peernet2id+0x79/0x8d
        [<ffffffff817c1ab7>] peernet2id+0x13/0x1f
        [<ffffffff817d8673>] rtnl_fill_ifinfo+0xa8d/0xc20
        [<ffffffff810b17d9>] ? __lock_is_held+0x39/0x52
        [<ffffffff817d894f>] rtnl_dump_ifinfo+0x149/0x213
        [<ffffffff8182b9c2>] netlink_dump+0xef/0x26c
        [<ffffffff8182bcba>] netlink_recvmsg+0x17b/0x2c5
        [<ffffffff817b0adc>] __sock_recvmsg+0x4e/0x59
        [<ffffffff817b1b40>] sock_recvmsg+0x3f/0x51
        [<ffffffff817b1f9a>] ___sys_recvmsg+0xf6/0x1d9
        [<ffffffff8115dc67>] ? handle_pte_fault+0x6e1/0xd3d
        [<ffffffff8100a3a0>] ? native_sched_clock+0x35/0x37
        [<ffffffff8109f45b>] ? sched_clock_local+0x12/0x72
        [<ffffffff8109f6ac>] ? sched_clock_cpu+0x9e/0xb7
        [<ffffffff810cb7ab>] ? rcu_read_lock_held+0x3b/0x3d
        [<ffffffff811abde8>] ? __fcheck_files+0x4c/0x58
        [<ffffffff811ac556>] ? __fget_light+0x2d/0x52
        [<ffffffff817b376f>] __sys_recvmsg+0x42/0x60
        [<ffffffff817b379f>] SyS_recvmsg+0x12/0x1c
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Fixes: 0c7aecd4 ("netns: add rtnl cmd to add and get peer netns ids")
      Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
      Reported-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cac5e65e
    • Geert Uytterhoeven's avatar
      sh_eth: Fix lost MAC address on kexec · a14c7d15
      Geert Uytterhoeven authored
      Commit 740c7f31 ("sh_eth: Ensure DMA engines are stopped before
      freeing buffers") added a call to sh_eth_reset() to the
      sh_eth_set_ringparam() and sh_eth_close() paths.
      
      However, setting the software reset bit(s) in the EDMR register resets
      the MAC Address Registers to zero. Hence after kexec, the new kernel
      doesn't detect a valid MAC address and assigns a random MAC address,
      breaking DHCP.
      
      Set the MAC address again after the reset in sh_eth_dev_exit() to fix
      this.
      
      Tested on r8a7740/armadillo (GETHER) and r8a7791/koelsch (FAST_RCAR).
      
      Fixes: 740c7f31 ("sh_eth: Ensure DMA engines are stopped before freeing buffers")
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a14c7d15
    • Jaedon Shin's avatar
      net: bcmgenet: fix throughtput regression · 4092e6ac
      Jaedon Shin authored
      This patch adds bcmgenet_tx_poll for the tx_rings. This can reduce the
      interrupt load and send xmit in network stack on time. This also
      separated for the completion of tx_ring16 from bcmgenet_poll.
      
      The bcmgenet_tx_reclaim of tx_ring[{0,1,2,3}] operative by an interrupt
      is to be not more than a certain number TxBDs. It is caused by too
      slowly reclaiming the transmitted skb. Therefore, performance
      degradation of xmit after 605ad7f1 ("tcp: refine TSO autosizing").
      Signed-off-by: default avatarJaedon Shin <jaedon.shin@gmail.com>
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4092e6ac
    • Eric Dumazet's avatar
      macvtap: make sure neighbour code can push ethernet header · 2f1d8b9e
      Eric Dumazet authored
      Brian reported crashes using IPv6 traffic with macvtap/veth combo.
      
      I tracked the crashes in neigh_hh_output()
      
      -> memcpy(skb->data - HH_DATA_MOD, hh->hh_data, HH_DATA_MOD);
      
      Neighbour code assumes headroom to push Ethernet header is
      at least 16 bytes.
      
      It appears macvtap has only 14 bytes available on arches
      where NET_IP_ALIGN is 0 (like x86)
      
      Effect is a corruption of 2 bytes right before skb->head,
      and possible crashes if accessing non existing memory.
      
      This fix should also increase IPv4 performance, as paranoid code
      in ip_finish_output2() wont have to call skb_realloc_headroom()
      Reported-by: default avatarBrian Rak <brak@vultr.com>
      Tested-by: default avatarBrian Rak <brak@vultr.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2f1d8b9e
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2015-02-27' of... · 32034e05
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2015-02-27' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      A few patches have accumulated, among them the fix for Linus's
      four-way-handshake problem. The others are various small fixes
      for problems all over, nothing really stands out.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      32034e05
  6. 28 Feb, 2015 5 commits
    • Eric W. Biederman's avatar
      net: Verify permission to link_net in newlink · 06615bed
      Eric W. Biederman authored
      When applicable verify that the caller has permisson to the underlying
      network namespace for a newly created network device.
      
      Similary checks exist for the network namespace a network device will
      be created in.
      
      Fixes: 317f4810 ("rtnl: allow to create device with IFLA_LINK_NETNSID set")
      Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Acked-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      06615bed
    • Eric W. Biederman's avatar
      net: Verify permission to dest_net in newlink · 505ce415
      Eric W. Biederman authored
      When applicable verify that the caller has permision to create a
      network device in another network namespace.  This check is already
      present when moving a network device between network namespaces in
      setlink so all that is needed is to duplicate that check in newlink.
      
      This change almost backports cleanly, but there are context conflicts
      as the code that follows was added in v4.0-rc1
      
      Fixes: b51642f6 net: Enable a userns root rtnl calls that are safe for unprivilged users
      Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Acked-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      505ce415
    • George McCollister's avatar
      drivers: net: cpsw: Set SECURE for dual_emac ucast · 56887149
      George McCollister authored
      Prior to this patch, sending a packet with the source MAC address of one
      of the CPSW interfaces to one of the CPSW slave ports while it's configured in
      dual_emac mode would update the port_num field of the VLAN/Unicast Address
      Table Entry. This would cause it to discard all incoming traffic addressed to
      that MAC address, essentially rendering the port useless until the ALE table is
      cleared (by starting and stopping the interface or rebooting.)
      
      For example, if eth0 has a MAC address of 90:59:af:8f:43:e9 it will have
      an ALE table entry:
      
      00 00 00 00 59 90 02 30 e9 43 8f af
      (VLAN Addr vlan_id=2 unicast type=0 port_num=0 addr=90:59:af:8f:43:e9)
      
      If you configure another device with the same MAC address and connect it
      to the first CPSW slave port and send some traffic the ALE table entry
      becomes:
      
      04 00 00 00 59 90 02 30 e9 43 8f af
      (VLAN Addr vlan_id=2 unicast type=0 port_num=1 addr=90:59:af:8f:43:e9)
      
      >From this point forward all incoming traffic addressed to
      90:59:af:8f:43:e9 will be dropped.
      
      Setting the SECURE bit for the VLAN/Unicast address table entry for each
      interface's MAC address corrects the problem.
      Signed-off-by: default avatarGeorge McCollister <george.mccollister@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      56887149
    • Dan Carpenter's avatar
      niu: fix error handling in niu_class_to_ethflow() · f55ea3d9
      Dan Carpenter authored
      There is a discrepancy here because the niu_class_to_ethflow() returns
      zero on failure and one on success but the caller expected zero on
      success and negative on failure.
      
      The problem means that we allow the user to pass classes and flow_types
      which we don't want.  I've looked at it a bit and I don't see it as a
      very serious bug.
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f55ea3d9
    • Arnd Bergmann's avatar
      net: smc91x: use run-time configuration on all ARM machines · b70661c7
      Arnd Bergmann authored
      The smc91x driver traditionally gets configured at compile-time
      for whichever hardware it runs on. This no longer works on
      ARM as we continue to move to building all-in-one kernels.
      
      Most ARM configurations with this driver already use run-time
      configuration through DT or through platform_data, but a
      few have not been converted yet.
      
      I've checked all ARM boards that use this driver in their
      legacy board files, and converted the ones that were using
      compile-time configuration in smc91x.h to behave like the
      other ones and provide the interrupt polarity along with
      the MMIO configuration (width, stride) at platform device
      creation time.
      
      In particular, these combinations were previously selectable
      in Kconfig but in fact broken:
      
      - sa1100 assabet plus pleb
      - msm combined with any other armv6/v7 platform
      - pxa-idp combined with any non-DMA pxa variant
      - LogicPD PXA270 combined with any other pxa
      - nomadik combined with any other armv4/v5 platform,
        e.g. versatile.
      
      None of these seem critical enough to warrant a backport
      to stable, but it would be nice to clean this up for good.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      ----
      I would like the patch to get merged through netdev, after
      Robert and/or Linus have verified it on at least some hardware.
      
      There are a few other non-ARM platforms using this driver,
      I could do the same patch for those if we want to take
      it further.
      
       arch/arm/mach-msm/board-halibut.c    |   8 ++++-
       arch/arm/mach-msm/board-qsd8x50.c    |   8 ++++-
       arch/arm/mach-pxa/idp.c              |   5 +++
       arch/arm/mach-pxa/lpd270.c           |   8 ++++-
       arch/arm/mach-realview/core.c        |   7 ++++
       arch/arm/mach-realview/realview_eb.c |   2 +-
       arch/arm/mach-sa1100/neponset.c      |   6 ++++
       arch/arm/mach-sa1100/pleb.c          |   7 ++++
       drivers/net/ethernet/smsc/smc91x.c   |   9 +++--
       drivers/net/ethernet/smsc/smc91x.h   | 114 ++----------------------------------------------------------
       10 files changed, 57 insertions(+), 117 deletions(-)
      Tested-by: default avatarRobert Jarzmik <robert.jarzmik@free.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b70661c7
  7. 27 Feb, 2015 2 commits
    • Eric Dumazet's avatar
      rhashtable: use cond_resched() · 5beb5c90
      Eric Dumazet authored
      If a hash table has 128 slots and 16384 elems, expand to 256 slots
      takes more than one second. For larger sets, a soft lockup is detected.
      
      Holding cpu for that long, even in a work queue is a show stopper
      for non preemptable kernels.
      
      cond_resched() at strategic points to allow process scheduler
      to reschedule us.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5beb5c90
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net · 061c1a6e
      David S. Miller authored
      Jeff Kirsher says:
      
      ====================
      Intel Wired LAN Driver Updates 2015-02-26
      
      This series contains fixes for i40e and i40evf only.
      
      Alexey Khoroshilov found a possible leak of 'cmd_buf' when copy_from_user()
      failed in i40e_dbg_command_write(), so resolved by calling kfree().
      
      Shannon provides a fix to ensure the shift and bitwise precedences do not
      work backwards for us by adding parans.  Fixed the driver by preventing
      the driver from allowing stray interrupts or causing system logs from
      un-handled interrupts by combining the ICR0 shutdown with the standard
      interrupt shutdown and add the interrupt clearing to the PCI shutdown
      path.  Fixed an issue where a NVM write times out before a transaction
      can complete, so Shannon added logic to make another attempt by
      reacquiring the semaphore, then retry the write, if the one retry fails,
      we will then give up.  Adds checks to pointers before their use to ensure
      we do not try to dereference NULL pointers when returning values from the
      AdminQ calls.
      
      Akeem adds a check to bail out if the device is already down when checking
      for Tx hang subtask.
      
      Anjali fixes TSO with more than 8 frags per segment issue.  The hardware
      has some limitations which the driver needs to adhere to:
        1) no more than 8 descriptors per packet on the wire
        2) no header can span more than 3 descriptors
      If one of these events happens, the hardware will generate an internal
      error and freeze the Tx queue, so Anjali fixes this by linearizes the skb
      to avoid these situations.  Fixed an issue where the per Traffic Class
      queue count was higher than queues enabled, which will fix a warning
      with multiple function mode where systems regularly have more cores than
      vectors.  Fixed TCP/IPv6 over VXLAN Tx checksum offload, where we were
      checking the outer protocol flags and deciding the flow for the inner
      header.
      
      Jesse fixes a race condition in the transmit hang detection.  Before we
      were having issues of false Tx hang detection, no the driver makes more
      direct with the checks for progress forward by directly checking the head
      write back address and tail register when determining progress.  This
      avoids Tx hangs where the software gets behind, because we are directly
      checking hardware state when determining a hang state.
      
      Neerav fixes the transmit ring Qset handle when DCB reconfigures. The issue
      was when DCB is reconfigured to a single traffic class (TC) and the driver
      did not reset the Tx ring Qset handle to correct the mapping, which caused
      the Tx queue to disable timeouts.  Also as part of DCB reconfiguration flow
      if the Tx queue disable times out, then issue a PF reset to do some level
      of recovery.
      
      Mitch stops flow director on shutdown because, in some cases, the hardware
      would continue to try to access the FDIR ring after entering D3Hot state,
      which would cause either PCIe errors or NMIs, depending upon the system
      configuration.
      
      * NOTE * I have verified that this series of patches for net will not cause
      any merge issues when you sync up your net tree with your net-next tree.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      061c1a6e