11 Jun, 2012

2 commits

  • commit 3fa2a1df909 (virtio-net: per cpu 64 bit stats (v2)) added a race
    on 32bit arches.

    We must use separate syncp for rx and tx path as they can be run at the
    same time on different cpus. Thus one sequence increment can be lost and
    readers spin forever.

    Signed-off-by: Eric Dumazet
    Cc: Stephen Hemminger
    Cc: Michael S. Tsirkin
    Cc: Jason Wang
    Acked-by: Rusty Russell
    Acked-by: Michael S. Tsirkin
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • While reworking the r8169 driver a few months ago to perform the
    smallest amount of work in the irq handler, I took care of avoiding
    any irq mask register operation in the slow work dedicated user
    context thread. The slow work thread scheduled an extra round of NAPI
    work which would ultimately set the irq mask register as required,
    thus keeping such irq mask operations in the NAPI handler.
    It would eventually race with the irq handler and delay NAPI execution
    for - assuming no further irq - a whole ksoftirqd period. Mildly a
    problem for rare link changes or corner case PCI events.

    The race was always lost after the last bh disabling lock had been
    removed from the work thread and people started wondering where those
    pesky "NOHZ: local_softirq_pending 08" messages came from.

    Actually the irq mask register _can_ be set up directly in the slow
    work thread.

    Signed-off-by: Francois Romieu
    Reported-by: Dave Jones
    Tested-by: Marc Dionne
    Cc: Thomas Gleixner
    Cc: Hayes Wang
    Signed-off-by: David S. Miller

    françois romieu
     

10 Jun, 2012

1 commit

  • I originally sent this patch to , but Jiri Kosina did
    not feel that this is fully appropriate for the trivial tree.

    Using linux/tcp.h from C++ results in:

    cat t.cc
    #include
    int main() { }

    g++ -c t.cc

    In file included from t.cc:1:
    /usr/include/linux/tcp.h:72: error: '__u32 __fswab32(__u32)' cannot appear in a constant-expression
    /usr/include/linux/tcp.h:72: error: a function call cannot appear in a constant-expression
    ...

    Attached trivial patch fixes this problem.

    Tested:
    - the t.cc above compiles with g++ and
    - the following program generates the same output before/after
    the patch:

    #include
    #include

    int main ()
    {
    #define P(a) printf("%s: %08x\n", #a, (int)a)
    P(TCP_FLAG_CWR);
    P(TCP_FLAG_ECE);
    P(TCP_FLAG_URG);
    P(TCP_FLAG_ACK);
    P(TCP_FLAG_PSH);
    P(TCP_FLAG_RST);
    P(TCP_FLAG_SYN);
    P(TCP_FLAG_FIN);
    P(TCP_RESERVED_BITS);
    P(TCP_DATA_OFFSET);
    #undef P
    return 0;
    }

    Signed-off-by: Paul Pluzhnikov
    Signed-off-by: David S. Miller

    Paul Pluzhnikov
     

09 Jun, 2012

4 commits

  • Fix kernel-doc warnings in drivers/net/phy:

    Warning(drivers/net/phy/mdio_bus.c:109): No description found for parameter 'mdio_bus_np'
    Warning(drivers/net/phy/mdio_bus.c:109): Excess function parameter 'mdio_np' description in 'of_mdio_find_bus'

    Signed-off-by: Randy Dunlap
    Signed-off-by: David S. Miller

    Randy Dunlap
     
  • Fix kernel-doc warnings in net/core:

    Warning(net/core/skbuff.c:3368): No description found for parameter 'delta_truesize'
    Warning(net/core/filter.c:628): No description found for parameter 'pfp'
    Warning(net/core/filter.c:628): Excess function parameter 'sk' description in 'sk_unattached_filter_create'

    Signed-off-by: Randy Dunlap
    Signed-off-by: David S. Miller

    Randy Dunlap
     
  • As soon as hardware is notified of a transmit, we no longer can assume
    skb can be dereferenced, as TX completion might have freed the packet.

    Signed-off-by: Eric Dumazet
    Cc: Sathya Perla
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • Commit 081b1b1bb27f (l2tp: fix l2tp_ip_sendmsg() route handling) added
    a race, in case IP route cache is disabled.

    In this case, we should not do the dst_release(&rt->dst), since it'll
    free the dst immediately, instead of waiting a RCU grace period.

    Signed-off-by: Eric Dumazet
    Cc: James Chapman
    Cc: Denys Fedoryshchenko
    Signed-off-by: David S. Miller

    Eric Dumazet
     

08 Jun, 2012

8 commits

  • This reverts commit efa230f2c68abab817f13473077f8d0cc74f43f3.

    BQL doesn't work with how this driver currently only takes TX
    interrupts every 1/4 of the TX ring. That behavior needs to be fixed,
    but that's a larger non-trivial task and for now we have to revert
    BQL support as this makes the device currently completely unusable.

    Signed-off-by: David S. Miller

    David S. Miller
     
  • The commit ba27ec66ffeb78cbf fixes the Kconfig of the
    driver when built as module allowing to select/unselect
    the PCI and Platform modules that are not anymore mutually
    exclusive. This patch fixes and guarantees that the driver
    builds on all the platforms w/ w/o PCI and when select/unselect
    the two stmmac supports. In case of there are some problems
    on both the configuration and the pci/pltf registration the
    module_init will fail.

    v2: set the CONFIG_STMMAC_PLATFORM enabled by default.
    I've just noticed that this can actually help on
    some configurations that don't enable any STMMAC
    options by default (e.g. SPEAr).

    v3: change printk level when do not register the driver.

    Reported-by: Fengguang Wu
    Signed-off-by: Giuseppe Cavallaro
    Signed-off-by: David S. Miller

    Giuseppe CAVALLARO
     
  • RFC 4293 defines ipIfStatsOutOctets (similar definition for
    ipSystemStatsOutOctets):

    The total number of octets in IP datagrams delivered to the lower
    layers for transmission. Octets from datagrams counted in
    ipIfStatsOutTransmits MUST be counted here.

    And ipIfStatsOutTransmits:

    The total number of IP datagrams that this entity supplied to the
    lower layers for transmission. This includes datagrams generated
    locally and those forwarded by this entity.

    Therefore, IPSTATS_MIB_OUTOCTETS must be incremented when incrementing
    IPSTATS_MIB_OUTFORWDATAGRAMS.

    IP_UPD_PO_STATS is not used since ipIfStatsOutRequests must not
    include forwarded datagrams:

    The total number of IP datagrams that local IP user-protocols
    (including ICMP) supplied to IP in requests for transmission. Note
    that this counter does not include any datagrams counted in
    ipIfStatsOutForwDatagrams.

    Signed-off-by: Vincent Bernat
    Signed-off-by: David S. Miller

    Vincent Bernat
     
  • I accidentally triggered this printk, which amused me for a few moments.
    Given we're post 2.2, we could just -EACCES, but does anyone even care about Appletalk now ?
    I figure it's better to leave sleeping dogs lie, and just update the message.

    Signed-off-by: Dave Jones
    Signed-off-by: David S. Miller

    Dave Jones
     
  • The newer flavors of Yukon II use a different method for receive
    checksum offload. This is indicated in the driver by the SKY2_HW_NEW_LE
    flag. On these newer chips, the BMU_ENA_RX_CHKSUM should not be set.

    The driver would get incorrectly toggle the bit, enabling the old
    checksum logic on these chips and cause a BUG_ON() assertion. If
    receive checksum was toggled via ethtool.

    Reported-by: Kirill Smelkov
    Signed-off-by: Stephen Hemminger
    Signed-off-by: David S. Miller

    stephen hemminger
     
  • Commit 5339ab8b1dd82 (ipv6: fib: Convert fib6_age() to
    dst_neigh_lookup().) seems to have mistakenly inverted the
    exception for cached NTF_ROUTER routes.

    Signed-off-by: Thomas Graf
    Signed-off-by: David S. Miller

    Thomas Graf
     
  • Denys found out "ip neigh" output was truncated to
    about 54 neighbours.

    Signed-off-by: Eric Dumazet
    Reported-by: Denys Fedoryshchenko
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • We must prevent module unloading if some devices are still attached to
    l2tp_eth driver.

    Signed-off-by: Eric Dumazet
    Reported-by: Denys Fedoryshchenko
    Tested-by: Denys Fedoryshchenko
    Cc: James Chapman
    Signed-off-by: David S. Miller

    Eric Dumazet
     

07 Jun, 2012

9 commits

  • John Linville says:
    ====================
    Amitkumar Karwar gives us a cfg80211 fix that changes some state
    tracking in order to avoid a WARNING.

    Arik Nemtsov provide a mac80211 fix for an RCU-related race.

    Avinash Patil shares a pair of mwifiex fixes, one which invalidates
    some stale configuration data before a channel change and another to
    restrict hidden SSID support to zero-length SSIDs only.

    Chun-Yeow Yeoh brings a mac80211 fix for a mesh problem triggered
    when combining multiple mesh networks into one.

    Felix Fietkau provides a mac80211 lockdep fix.

    Joe Perches fixes a couple of thinkos related to bitwise operations.

    Johannes Berg comes through with a flurry of fixes. The iwlwifi ones
    address a problem Linus recently reported, and some of the fallout
    discovered while fixing it. The mac80211 fix properly cleans-up
    remain-on-channel work on an interface that is stopped. The others
    are clean-ups for regressions caused by stricter checking of possible
    virtual interfaces supported by wireless drivers.

    Meenakshi Venkataraman provides a mac80211 fix for an off-by-one error.

    Seth Forshee provides a fix to make the wireless adapters used in
    some Mac boxes work after being in S3 power saving state.

    Stanislaw Gruszka offers a copule of fixes, a fix for a mac80211
    scanning regression and an rt2x00 fix to avoid some lockdep spew.

    Last but not least, Vinicius Costa Gomes provides a bluetooth fix
    for a typo that "was preventing important features of Bluetooth
    from working".
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • …wireless into for-davem

    John W. Linville
     
  • John W. Linville
     
  • commit 5faa5df1fa2024 (inetpeer: Invalidate the inetpeer tree along with
    the routing cache) added a race :

    Before freeing an inetpeer, we must respect a RCU grace period, and make
    sure no user will attempt to increase refcnt.

    inetpeer_invalidate_tree() waits for a RCU grace period before inserting
    inetpeer tree into gc_list and waking the worker. At that time, no
    concurrent lookup can find a inetpeer in this tree.

    Signed-off-by: Eric Dumazet
    Cc: Steffen Klassert
    Acked-by: Steffen Klassert
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • Adding device IDs for Aircard 320U and two other devices
    found in the out-of-tree version of this driver.

    Cc: linux@sierrawireless.com
    Cc: Autif Khan
    Cc: Tom Cassidy
    Cc: stable@vger.kernel.org
    Signed-off-by: Bjørn Mork
    Acked-by: Greg Kroah-Hartman
    Signed-off-by: David S. Miller

    Bjørn Mork
     
  • Commit 452503ebc (ARM: Orion: Eth: Add clk/clkdev support.) broke
    the building of the driver on architectures which don't have clk
    support. In particular PPC32 Pegasos which uses this driver.

    Add #ifdef around the clk API usage.

    Signed-off-by: Andrew Lunn
    Signed-off-by: David S. Miller

    Andrew Lunn
     
  • This patches fixes the driver when built as dynamic module.
    In fact, the platform part cannot be built and the probe fails
    (thanks to Bob Liu that reported this bug).

    v2: as D. Miller suggested, it is not necessary to make the
    pci and the platform code mutually exclusive.
    Having both could also help, at built time ,to verify that
    all the code is validated and compiles fine.

    v3: removed wrong Reviewed-by from the patch

    Reported-by: Bob Liu
    cc: Rayagond Kokatanur
    Signed-off-by: Giuseppe Cavallaro
    Signed-off-by: David S. Miller

    Giuseppe CAVALLARO
     
  • Fixed the driver's documentation that was obsolete and didn't
    report new platform fields (recently added).

    Signed-off-by: Giuseppe Cavallaro
    Signed-off-by: David S. Miller

    Giuseppe CAVALLARO
     
  • Signed-off-by: Giuseppe Cavallaro
    Signed-off-by: David S. Miller

    Giuseppe CAVALLARO
     

06 Jun, 2012

6 commits

  • The hardware bit IXGBE_RXD_STAT_VP appears to be set even when Rx
    stripping is disabled. This results in passing frames up the stack
    which do not have the 802.1Q tag stripped but have the tci bits
    set as if it was.

    Working around this with a check for the feature flag bit. I
    would welcome any better ideas or a pointer to exactly which
    bits in the hardware register need to be cleared to get the
    IXGBE_RXD_STAT_VP bit to be set per data sheet.

    Signed-off-by: John Fastabend
    Acked-by: Alexander Duyck
    Tested-by: Marcus Dennis
    Signed-off-by: Jeff Kirsher

    John Fastabend
     
  • DCB can be used independent of if RX VLAN stripping is enabled
    or disabled so remove erroneous check.

    Also enable or disable VLAN stripping when features are applied so
    hardware and feature flags are in sync.

    CC: Alexander Duyck
    Signed-off-by: John Fastabend
    Tested-by: Marcus Dennis
    Signed-off-by: Jeff Kirsher

    John Fastabend
     
  • commit 44abd5c12767a8c567dc4e45fd9aec3b13ca85e0 introduced NULL pointer
    dereferences when attempting to access the check_reset_block function
    pointer on 8257x and 80003es2lan non-copper devices.

    This fix should be applied back through 3.4.

    Signed-off-by: Bruce Allan
    Tested-by: Jeff Pieper
    Signed-off-by: Jeff Kirsher

    Bruce Allan
     
  • If a given interface combination doesn't contain
    a required interface type then we missed checking
    that and erroneously allowed it even though iface
    type wasn't there at all. Add a check that makes
    sure that all interface types are accounted for.

    Cc: stable@kernel.org
    Reported-by: Mohammed Shafi Shajakhan
    Signed-off-by: Johannes Berg
    Signed-off-by: John W. Linville

    Johannes Berg
     
  • Otherwise the LEDs stick around and cause issues the
    next time around since they're still there but not
    really hooked up.

    Cc: stable@kernel.org
    Signed-off-by: Johannes Berg
    Signed-off-by: John W. Linville

    Johannes Berg
     
  • Linus reported that due to mac80211 failing to register
    the device (due to WoWLAN) his machine crashed etc. as
    we double-freed the vmalloc() firmware area. His patch
    to fix it was very similar to this one but I noticed
    that there's another bug in the area: we complete the
    completion before starting, so since we're running in
    a work struct context stop() could be called while in
    the middle of start() which will almost certainly lead
    to issues.

    Make a modification similar to his to avoid the double-
    free but also move the completion to another spot so it
    is only done after start() either finished or failed so
    that stop() can have a consistent state.

    Reported-by: Linus Torvalds
    Signed-off-by: Johannes Berg
    Signed-off-by: John W. Linville

    Johannes Berg
     

05 Jun, 2012

10 commits

  • Most probably a typo, the check should have been for BT_SK_DEFER_SETUP
    instead of BT_DEFER_SETUP (which right now only represents a socket
    option).

    Signed-off-by: Vinicius Costa Gomes
    Acked-by: Andrei Emeltchenko
    Signed-off-by: Gustavo Padovan

    Vinicius Costa Gomes
     
  • If CONFIG_PM_SLEEP is disabled, then iwlwifi doesn't
    support suspend/resume handlers and thus mac80211
    (correctly) refuses advertising WoWLAN. Disable
    WoWLAN in the driver in this case.

    Cc: stable@kernel.org
    Reported-by: Sebastian Kemper
    Signed-off-by: Johannes Berg
    Signed-off-by: John W. Linville

    Johannes Berg
     
  • sta_info_cleanup locks the sta_list using rcu_read_lock however
    the delete operation isn't rcu safe. A race between sta_info_cleanup
    timer being called and a STA being removed can occur which leads
    to a panic while traversing sta_list. Fix this by switching to the
    RCU-safe versions.

    Cc: stable@vger.kernel.org
    Reported-by: Eyal Shapira
    Signed-off-by: Arik Nemtsov
    Signed-off-by: John W. Linville

    Arik Nemtsov
     
  • MacBook Pro models with BCM4331 wireless have been found to have the ext
    PA lines disabled after resuming from S3 without external power attach.
    This causes them to be unable to transmit. Add a workaround to ensure
    that the ext PA lines are enabled on BCM4331. Also extend all handling
    of ext PA line muxing to BCM43431 as is done in the Broadcom SDK.

    BugLink: http://bugs.launchpad.net/bugs/925577
    Cc: Arend van Spriel
    Cc: Hauke Mehrtens
    Cc: stable@vger.kernel.org
    Signed-off-by: Seth Forshee
    Signed-off-by: John W. Linville

    Seth Forshee
     
  • Remove spinlock as atomic_t can be used instead. Note we use only 16
    lower bits, upper bits are changed but we impilcilty cast to u16.

    This fix possible deadlock on IBSS mode reproted by lockdep:

    =================================
    [ INFO: inconsistent lock state ]
    3.4.0-wl+ #4 Not tainted
    ---------------------------------
    inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
    kworker/u:2/30374 [HC0[0]:SC0[0]:HE1:SE1] takes:
    (&(&intf->seqlock)->rlock){+.?...}, at: [] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
    {IN-SOFTIRQ-W} state was registered at:
    [] __lock_acquire+0x47b/0x1050
    [] lock_acquire+0x84/0xf0
    [] _raw_spin_lock+0x33/0x40
    [] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
    [] rt2x00queue_write_tx_frame+0x1a/0x300 [rt2x00lib]
    [] rt2x00mac_tx+0x7f/0x380 [rt2x00lib]
    [] __ieee80211_tx+0x1b3/0x300 [mac80211]
    [] ieee80211_tx+0x105/0x130 [mac80211]
    [] ieee80211_xmit+0xad/0x100 [mac80211]
    [] ieee80211_subif_start_xmit+0x2d9/0x930 [mac80211]
    [] dev_hard_start_xmit+0x307/0x660
    [] sch_direct_xmit+0xa1/0x1e0
    [] dev_queue_xmit+0x183/0x730
    [] neigh_resolve_output+0xfa/0x1e0
    [] ip_finish_output+0x24a/0x460
    [] ip_output+0xb7/0x100
    [] ip_local_out+0x20/0x60
    [] igmpv3_sendpack+0x4f/0x60
    [] igmp_ifc_timer_expire+0x29f/0x330
    [] run_timer_softirq+0x15c/0x2f0
    [] __do_softirq+0xae/0x1e0
    irq event stamp: 18380437
    hardirqs last enabled at (18380437): [] __slab_alloc.clone.3+0x67/0x5f0
    hardirqs last disabled at (18380436): [] __slab_alloc.clone.3+0x33/0x5f0
    softirqs last enabled at (18377616): [] __do_softirq+0x123/0x1e0
    softirqs last disabled at (18377611): [] do_softirq+0x9d/0xe0

    other info that might help us debug this:
    Possible unsafe locking scenario:

    CPU0
    ----
    lock(&(&intf->seqlock)->rlock);

    lock(&(&intf->seqlock)->rlock);

    *** DEADLOCK ***

    4 locks held by kworker/u:2/30374:
    #0: (wiphy_name(local->hw.wiphy)){++++.+}, at: [] process_one_work+0x109/0x3f0
    #1: ((&sdata->work)){+.+.+.}, at: [] process_one_work+0x109/0x3f0
    #2: (&ifibss->mtx){+.+.+.}, at: [] ieee80211_ibss_work+0x1b/0x470 [mac80211]
    #3: (&intf->beacon_skb_mutex){+.+...}, at: [] rt2x00queue_update_beacon+0x24/0x50 [rt2x00lib]

    stack backtrace:
    Pid: 30374, comm: kworker/u:2 Not tainted 3.4.0-wl+ #4
    Call Trace:
    [] print_usage_bug+0x1f6/0x220
    [] mark_lock+0x2c2/0x300
    [] ? check_usage_forwards+0xc0/0xc0
    [] __lock_acquire+0x4bc/0x1050
    [] ? __kmalloc_track_caller+0x1c0/0x1d0
    [] ? copy_skb_header+0x26/0x90
    [] lock_acquire+0x84/0xf0
    [] ? rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
    [] _raw_spin_lock+0x33/0x40
    [] ? rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
    [] rt2x00queue_create_tx_descriptor+0x380/0x490 [rt2x00lib]
    [] rt2x00queue_update_beacon_locked+0x5f/0xb0 [rt2x00lib]
    [] rt2x00queue_update_beacon+0x2d/0x50 [rt2x00lib]
    [] rt2x00mac_bss_info_changed+0x1ca/0x200 [rt2x00lib]
    [] ? rt2x00mac_remove_interface+0x70/0x70 [rt2x00lib]
    [] ieee80211_bss_info_change_notify+0xe0/0x1d0 [mac80211]
    [] __ieee80211_sta_join_ibss+0x3b8/0x610 [mac80211]
    [] ? mark_held_locks+0x64/0xc0
    [] ? virt_efi_query_capsule_caps+0x12/0x50
    [] ieee80211_sta_join_ibss+0xf9/0x140 [mac80211]
    [] ieee80211_ibss_work+0x416/0x470 [mac80211]
    [] ? trace_hardirqs_on+0xb/0x10
    [] ? skb_dequeue+0x4b/0x70
    [] ieee80211_iface_work+0x13f/0x230 [mac80211]
    [] ? process_one_work+0x109/0x3f0
    [] process_one_work+0x185/0x3f0
    [] ? process_one_work+0x109/0x3f0
    [] ? ieee80211_teardown_sdata+0xa0/0xa0 [mac80211]
    [] worker_thread+0x116/0x270
    [] ? manage_workers+0x1e0/0x1e0
    [] kthread+0x84/0x90
    [] ? __init_kthread_worker+0x60/0x60
    [] kernel_thread_helper+0x6/0x10

    Cc: stable@vger.kernel.org
    Signed-off-by: Stanislaw Gruszka
    Acked-by: Helmut Schaa
    Acked-by: Gertjan van Wingerde
    Signed-off-by: John W. Linville

    Stanislaw Gruszka
     
  • Using | with a constant is always true.
    Likely this should have be &.

    Signed-off-by: Joe Perches
    Acked-by: Arend van Spriel
    Signed-off-by: John W. Linville

    Joe Perches
     
  • Using | with a constant is always true.
    Likely this should have be &.

    cc: Ben Greear
    Signed-off-by: Joe Perches
    Signed-off-by: John W. Linville

    Joe Perches
     
  • Fixes a lockdep warning:

    ===================================================
    [ INFO: suspicious rcu_dereference_check() usage. ]
    ---------------------------------------------------
    net/mac80211/agg-rx.c:148 invoked rcu_dereference_check() without protection!

    other info that might help us debug this:

    rcu_scheduler_active = 1, debug_locks = 1
    1 lock held by arecord/11226:
    #0: (&tid_agg_rx->session_timer){+.-...}, at: [] call_timer_fn+0x0/0x360

    stack backtrace:
    Pid: 11226, comm: arecord Not tainted 3.1.0-kml #16
    Call Trace:
    [] lockdep_rcu_dereference+0xa4/0xc0
    [] sta_rx_agg_session_timer_expired+0xc9/0x110 [mac80211]
    [] ? ieee80211_process_addba_resp+0x220/0x220 [mac80211]
    [] call_timer_fn+0x8a/0x360
    [] ? init_timer_deferrable_key+0x30/0x30
    [] ? _raw_spin_unlock_irq+0x30/0x70
    [] run_timer_softirq+0x139/0x310
    [] ? put_lock_stats.isra.25+0xe/0x40
    [] ? lock_release_holdtime.part.26+0xdc/0x160
    [] ? ieee80211_process_addba_resp+0x220/0x220 [mac80211]
    [] __do_softirq+0xc8/0x3c0
    [] ? tick_dev_program_event+0x48/0x110
    [] ? tick_program_event+0x1f/0x30
    [] ? putname+0x35/0x50
    [] call_softirq+0x1c/0x30
    [] do_softirq+0xa5/0xe0
    [] irq_exit+0xae/0xe0
    [] smp_apic_timer_interrupt+0x6b/0x98
    [] apic_timer_interrupt+0x73/0x80
    [] ? free_debug_processing+0x1a1/0x1d5
    [] ? putname+0x35/0x50
    [] __slab_free+0x31/0x2ca
    [] ? _raw_spin_unlock_irqrestore+0x4a/0x90
    [] ? __debug_check_no_obj_freed+0x15f/0x210
    [] ? lock_release_nested+0x84/0xc0
    [] ? kmem_cache_free+0x105/0x250
    [] ? putname+0x35/0x50
    [] ? putname+0x35/0x50
    [] kmem_cache_free+0x23f/0x250
    [] putname+0x35/0x50
    [] do_sys_open+0x16d/0x1d0
    [] sys_open+0x20/0x30
    [] system_call_fastpath+0x16/0x1b

    Reported-by: Johannes Berg
    Signed-off-by: Felix Fietkau
    Signed-off-by: John W. Linville

    Felix Fietkau
     
  • When any interface goes down, it could be the one that we
    were doing a remain-on-channel with. We therefore need to
    cancel the remain-on-channel and flush the related work
    structs so they don't run after the interface has been
    removed or even destroyed.

    It's also possible in this case that an off-channel SKB
    was never transmitted, so free it if this is the case.
    Note that this can also happen if the driver finishes
    the off-channel period without ever starting it.

    Cc: stable@kernel.org
    Reported-by: Nirav Shah
    Signed-off-by: Johannes Berg
    Signed-off-by: John W. Linville

    Johannes Berg
     
  • Enforcing interface combinations broke uses of hwsim
    with multiple virtual interfaces. Advertise that all
    combinations are possible to fix this.

    Reported-by: Nirav Shah
    Signed-off-by: Johannes Berg
    Signed-off-by: John W. Linville

    Johannes Berg