23 Aug, 2013
2 commits
-
commit fba875591 ("disable TX in be_close()") disabled TX in be_close()
to protect be_xmit() from touching freed up queues in the AER recovery
flow. But, TX must be disabled *before* cleaning up TX completions in
the close() path, not after. This allows be_tx_compl_clean() to free up
all TX-req skbs that were notified to the HW.Signed-off-by: Sathya Perla
Signed-off-by: David S. Miller -
Merge in a fix for RX MAC address filter programming bug in the sfc
driver.Signed-off-by: David S. Miller
22 Aug, 2013
2 commits
-
As Sergei Shtylyov explained in the #mipslinux IRC channel:
[Mon 2013-08-19 12:28:21 PM PDT] guys, are you sure it's not "DMA off stack" case?
[Mon 2013-08-19 12:28:35 PM PDT] it's a known stack corruptor on non-coherent arches
[Mon 2013-08-19 12:31:48 PM PDT] headless: for usb/ehci?
[Mon 2013-08-19 12:34:11 PM PDT] headless: explain
[Mon 2013-08-19 12:35:38 PM PDT] usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited
[Mon 2013-08-19 12:35:58 PM PDT] and EHCI uses DMA on control xfers (as well as all the others)Signed-off-by: Daniel Gimpelevich
Acked-by: Greg Kroah-Hartman
Signed-off-by: David S. Miller -
There is no need to get an interface specification if we know it's the
wrong one.Signed-off-by: Daniel Gimpelevich
Acked-by: Greg Kroah-Hartman
Signed-off-by: David S. Miller
21 Aug, 2013
8 commits
-
commit 385904f819e3 ('sfc: Don't use
efx_filter_{build,hash,increment}() for default MAC filters') used the
wrong name to find the index of default RX MAC filters at insertion/
update time. This could result in memory corruption and would in any
case silently fail to update the filter.Signed-off-by: Ben Hutchings
-
John W. Linville says:
====================
Regarding the iwlwifi bits, Johannes says:"We revert an rfkill bugfix that unfortunately caused more bugs, shuffle
some code to avoid touching the PCIe device before it's enabled and
disconnect if firmware fails to do our bidding. I also have Stanislaw's
fix to not crash in some channel switch scenarios."As for the mac80211 bits, Johannes says:
"This time, I have one fix from Dan Carpenter for users of
nl80211hdr_put(), and one fix from myself fixing a regression with the
libertas driver."Along with the above...
Dan Carpenter fixes some incorrectly placed "address of" operators
in hostap that caused copying of junk data.Jussi Kivilinna corrects zd1201 to use an allocated buffer rather
than the stack for a URB operation.
====================Signed-off-by: David S. Miller
-
This is to fix a problem in the rtl8211 where the driver
wasn't properly enabled the interrupt on link change status.
it has to enable the ineterrupt on the bit 10 in the register 18
(INER).Reported-by: Sharma Bhupesh
Signed-off-by: Giuseppe Cavallaro
Signed-off-by: David S. Miller -
Do not clear Broadcast/Multicast/Unicast Wake Flag or LanWake in
Config5. This is necessary to preserve WOL state when the driver is
loaded. Although the r8168 vendor driver does not write Config5 (it has
been commented out), Hayes Wang from Realtek said that masking bits like
this is more sensible.Signed-off-by: Peter Wu
Acked-by: Francois Romieu
Signed-off-by: David S. Miller -
If via_ircc_open() fails, data structures of the driver left uninitialized,
but probe (via_init_one()) returns zero. That can lead to null pointer dereference
in via_remove_one(), since it does not check drvdata for NULL.The patch implements proper error code propagation.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov
Signed-off-by: David S. Miller -
When the user turns off VNET_HDR support on the
macvtap device, there is no way to provide any
offload information to the user. So, it's safer
to ignore offload setting then depend on the user
setting them correctly.Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller -
When the user turns off IFF_VNET_HDR flag, attempts to change
offload features via TUNSETOFFLOAD do not work. This could cause
GSO packets to be delivered to the user when the user is
not prepared to handle them.To solve, allow processing of TUNSETOFFLOAD when IFF_VNET_HDR is
disabled.Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller -
In macvtap, tap_features specific the features of that the user
has specified via ioctl(). If we treat macvtap as a macvlan+tap
then we could all the tap a pseudo-device and give it other features
like SG and GSO. Then we can stop using the features of lower
device (macvlan) when forwarding the traffic the tap.This solves the issue of possible checksum offload mismatch between
tap feature and macvlan features.Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller
20 Aug, 2013
8 commits
-
There are possible HW configurations in which PFs will have SR-IOV capability
but will have Max VFs set to 0 - this happens when there are Multi-Function
devices where the VFs are allocated to only some of the PFs.DMAE is configured to support VFs only if the configuring PF has supported VFs.
In case the first PF to be loaded will be one without supported VFs, it will
not configure DMAE to the VF-supporting mode. When VFs of other PFs will be
loaded later on, they will not be able to communicate with their PF.This changes the requirement for configuring DMAE for VF-supporting mode;
If the device has SR-IOV capabilities there must be some PF that has
max supported VFs > 0, thus it will configure the DMAE for supporting VFs.Signed-off-by: Ariel Elior
Signed-off-by: Yuval Mintz
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Since SR-IOV can be activated dynamically and iproute2 can be called
asynchronously, the various callbacks need a robust sanity check before
attempting to access the SR-IOV database and members since there are numerous
states in which it can find the driver (e.g., PF is down, sriov was not enabled
yet, VF is down, etc.).In many of the states the callback result will be null pointer dereference.
Signed-off-by: Ariel Elior
Signed-off-by: Yuval Mintz
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
During probe, VFs might erroneously try to access the shared memory (which
only PFs are capabale of accessing), causing benign attentions to appear.Signed-off-by: Yuval Mintz
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
When publishing information via getfeatcfg(), bnx2x driver didn't consider
remote errors (e.g., switch that doesn't support DCBX) when setting the
error flags.Signed-off-by: Dmitry Kravkov
Signed-off-by: Yuval Mintz
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
After notification that DCBX configuration has ended arrived to the driver,
the driver configured the FW/HW in sleepless context.
As a result, it was possible to reach a race (mostly with CNIC registration)
in which the configuration will return a timeout, failing to set the DCBX
results correctly.This patch moves the configuration following the DCBX end into the slowpath
RTNL task (i.e., sleepless context protected by the RTNL lock), allowing the
configuration to cope with such races.Signed-off-by: Dmitry Kravkov
Signed-off-by: Yuval Mintz
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Since commit 3deb816 "bnx2x: Add a periodic task for link PHY events"
link state changes can be detected not only via the attention flow but also
from the periodic task.
If the link state will change in such a manner (i.e., via the periodic task),
dropless flow-control will not be configured.This patch remedies the issue, adding the missing configuration to all required
flows.Signed-off-by: Dmitry Kravkov
Signed-off-by: Yuval Mintz
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
…wireless into for-davem
-
Pull drm fixes from Dave Airlie:
"Bit late with these, was under the weather for a a few days, nothing
too crazy:Some radeon regression fixes, one intel regression fix, and one fix to
avoid a warn with i915 when used with dma-buf"* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/i915: unpin backing storage in dmabuf_unmap
drm/radeon: fix WREG32_OR macro setting bits in a register
drm/radeon/r7xx: fix copy paste typo in golden register setup
drm/i915: Don't deref pipe->cpu_transcoder in the hangcheck code
drm/radeon: fix UVD message buffer validation
19 Aug, 2013
2 commits
-
* tag 'drm-intel-fixes-2013-08-15' of git://people.freedesktop.org/~danvet/drm-intel: (153 commits)
drm/i915: Don't deref pipe->cpu_transcoder in the hangcheck code -
This fixes a WARN in i915_gem_free_object when the
obj->pages_pin_count isn't 0.v2: Add locking to unmap, noticed by Chris Wilson. Note that even
though we call unmap with our own dev->struct_mutex held that won't
result in an immediate deadlock since we never go through the dma_buf
interfaces for our own, reimported buffers. But it's still easy to
blow up and anger lockdep, but that's already the case with our ->map
implementation. Fixing this for real will involve per dma-buf ww mutex
locking by the callers. And lots of fun. So go with the duct-tape
approach for now.Cc: Chris Wilson
Reported-by: Maarten Lankhorst
Cc: Maarten Lankhorst
Tested-by: Armin K. (v1)
Tested-by: Dave Airlie
Acked-by: Maarten Lankhorst
Signed-off-by: Daniel Vetter
Signed-off-by: Dave Airlie
17 Aug, 2013
3 commits
-
Pull clock controller fixes from Michael Turquette:
"Two small fixes for the Zynq clock controller introduced in 3.11-rc1
and another Exynos clock patch which fixes a regression that prevents
the video pipeline from functioning on that platform"* tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mturquette/linux:
clk: exynos4: Add CLK_GET_RATE_NOCACHE flag for the Exynos4x12 ISP clocks
clk/zynq/clkc: Add CLK_SET_RATE_PARENT flag to ethernet muxes
clk/zynq/clkc: Add dedicated spinlock for the SWDT -
Pull USB fixes from Greg KH:
"Here are some small USB fixes for 3.11-rc6 that have accumulated.Nothing huge, a EHCI fix that solves a much-reported audio USB
problem, some usb-serial driver endian fixes and other minor fixes, a
wireless USB oops fix, and two new quirks"* tag 'usb-3.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
USB: keyspan: fix null-deref at disconnect and release
USB: mos7720: fix broken control requests
usb: add two quirky touchscreen
USB: ti_usb_3410_5052: fix big-endian firmware handling
USB: adutux: fix big-endian device-type reporting
USB: usbtmc: fix big-endian probe of Rigol devices
USB: mos7840: fix big-endian probe
USB-Serial: Fix error handling of usb_wwan
wusbcore: fix kernel panic when disconnecting a wireless USB->serial device
USB: EHCI: accept very late isochronous URBs -
Pull networking fixes from David Miller:
1) Fix SKB leak in 8139cp, from Dave Jones.
2) Fix use of *_PAGES interfaces with mlx5 firmware, from Moshe Lazar.
3) RCU conversion of macvtap introduced two races, fixes by Eric
Dumazet4) Synchronize statistic flows in bnx2x driver to prevent corruption,
from Dmitry Kravkov5) Undo optimization in IP tunneling, we were using the inner IP header
in some cases to inherit the IP ID, but that isn't correct in some
circumstances. From Pravin B Shelar6) Use correct struct size when parsing netlink attributes in
rtnl_bridge_getlink(). From Asbjoern Sloth Toennesen7) Length verifications in tun_get_user() are bogus, from Weiping Pan
and Dan Carpenter8) Fix bad merge resolution during 3.11 networking development in
openvswitch, albeit a harmless one which added some unreachable
code. From Jesse Gross9) Wrong size used in flexible array allocation in openvswitch, from
Pravin B Shelar10) Clear out firmware capability flags the be2net driver isn't ready to
handle yet, from Sarveshwar Bandi11) Revert DMA mapping error checking addition to cxgb3 driver, it's
buggy. From Alexey Kardashevskiy12) Fix regression in packet scheduler rate limiting when working with a
link layer of ATM. From Jesper Dangaard Brouer13) Fix several errors in TCP Cubic congestion control, in particular
overflow errors in timestamp calculations. From Eric Dumazet and
Van Jacobson14) In ipv6 routing lookups, we need to backtrack if subtree traversal
don't result in a match. From Hannes Frederic Sowa15) ipgre_header() returns incorrect packet offset. Fix from Timo Teräs
16) Get "low latency" out of the new MIB counter names. From Eliezer
Tamir17) State check in ndo_dflt_fdb_del() is inverted, from Sridhar
Samudrala18) Handle TCP Fast Open properly in netfilter conntrack, from Yuchung
Cheng19) Wrong memcpy length in pcan_usb driver, from Stephane Grosjean
20) Fix dealock in TIPC, from Wang Weidong and Ding Tianhong
21) call_rcu() call to destroy SCTP transport is done too early and
might result in an oops. From Daniel Borkmann22) Fix races in genetlink family dumps, from Johannes Berg
23) Flags passed into macvlan by the user need to be validated properly,
from Michael S Tsirkin24) Fix skge build on 32-bit, from Stephen Hemminger
25) Handle malformed TCP headers properly in xt_TCPMSS, from Pablo Neira
Ayuso26) Fix handling of stacked vlans in vlan_dev_real_dev(), from Nikolay
Aleksandrov27) Eliminate MTU calculation overflows in esp{4,6}, from Daniel
Borkmann28) neigh_parms need to be setup before calling the ->ndo_neigh_setup()
method. From Veaceslav Falico29) Kill out-of-bounds prefetch in fib_trie, from Eric Dumazet
30) Don't dereference MLD query message if the length isn't value in the
bridge multicast code, from Linus Lüssing31) Fix VXLAN IGMP join regression due to an inverted check, from Cong
Wang* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (70 commits)
net/mlx5_core: Support MANAGE_PAGES and QUERY_PAGES firmware command changes
tun: signedness bug in tun_get_user()
qlcnic: Fix diagnostic interrupt test for 83xx adapters
qlcnic: Fix beacon state return status handling
qlcnic: Fix set driver version command
net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset
net_sched: restore "linklayer atm" handling
drivers/net/ethernet/via/via-velocity.c: update napi implementation
Revert "cxgb3: Check and handle the dma mapping errors"
be2net: Clear any capability flags that driver is not interested in.
openvswitch: Reset tunnel key between input and output.
openvswitch: Use correct type while allocating flex array.
openvswitch: Fix bad merge resolution.
tun: compare with 0 instead of total_len
rtnetlink: rtnl_bridge_getlink: Call nlmsg_find_attr() with ifinfomsg header
ethernet/arc/arc_emac - fix NAPI "work > weight" warning
ip_tunnel: Do not use inner ip-header-id for tunnel ip-header-id.
bnx2x: prevent crash in shutdown flow with CNIC
bnx2x: fix PTE write access error
bnx2x: fix memory leak in VF
...
16 Aug, 2013
7 commits
-
In the previous QUERY_PAGES command version we used one command to get the
required amount of boot, init and post init pages. The new version uses the
op_mod field to specify whether the query is for the required amount of boot,
init or post init pages. In addition the output field size for the required
amount of pages increased from 16 to 32 bits.In MANAGE_PAGES command the input_num_entries and output_num_entries fields
sizes changed from 16 to 32 bits and the PAS tables offset changed to 0x10.In the pages request event the num_pages field also changed to 32 bits.
In the HCA-capabilities-layout the size and location of max_qp_mcg field has
been changed to support 24 bits.This patch isn't compatible with firmware versions < 5; however, it turns out that the
first GA firmware we will publish will not support previous versions so this should be OK.Signed-off-by: Moshe Lazer
Signed-off-by: Eli Cohen
Signed-off-by: David S. Miller -
The recent fix d9bf5f1309 "tun: compare with 0 instead of total_len" is
not totally correct. Because "len" and "sizeof()" are size_t type, that
means they are never less than zero.Signed-off-by: Dan Carpenter
Acked-by: Michael S. Tsirkin
Acked-by: Neil Horman
Signed-off-by: David S. Miller -
o Do not allow interrupt test when adapter is resetting.
Signed-off-by: Manish Chopra
Signed-off-by: Sucheta Chakraborty
Signed-off-by: David S. Miller -
o Driver was misinterpreting the return status for beacon
state query leading to incorrect interpretation of beacon
state and logging an error message for successful status.
Fixed the driver to properly interpret the return status.Signed-off-by: Sucheta Chakraborty
Signed-off-by: David S. Miller -
Driver was issuing set driver version command through all
functions in the adapter. Fix the driver to issue set driver
version once per adapter, through function 0.Signed-off-by: Himanshu Madhani
Signed-off-by: Sucheta Chakraborty
Signed-off-by: David S. Miller -
Commit d8af4dfd8 ("net/tg3: Fix kernel crash") introduced a possible
NULL pointer dereference in tg3 driver when !netdev || !netif_running(netdev)
condition is met and netdev is NULL. Then, the jump to the 'done' label
calls dev_close() with a netdevice that is NULL. Therefore, only call
dev_close() when we have a netdevice, but one that is not running.[ Add the same checks in tg3_io_slot_reset() per Gavin Shan - by Nithin
Nayak Sujir ]Reported-by: Dave Jones
Signed-off-by: Daniel Borkmann
Cc: Gavin Shan
Cc: Michael Chan
Signed-off-by: Nithin Nayak Sujir
Signed-off-by: Nithin Nayak Sujir
Signed-off-by: Michael Chan
Signed-off-by: David S. Miller -
This bug (introduced in 3.10) in WREG32_OR made
commit d3418eacad403033e95e49dc14afa37c2112c134
"drm/radeon/evergreen: setup HDMI before enabling it"
cause a regression. Sometimes audio over HDMI wasn't working, sometimes
display was corrupted.This fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=60687
https://bugzilla.kernel.org/show_bug.cgi?id=60709
https://bugs.freedesktop.org/show_bug.cgi?id=67767Signed-off-by: Rafał Miłecki
Cc: stable@vger.kernel.org
Signed-off-by: Alex Deucher
15 Aug, 2013
8 commits
-
Drivers supporting NAPI should use a NAPI-specific function for receiving
packets. Hence netif_rx is changed to netif_receive_skb.Furthermore netif_napi_del should be used in the probe and remove function
to clean up the NAPI resource information.Thanks to Francois Romieu, David Shwatrz and Rami Rosen for their help on
this patch.Signed-off-by: Julia Lawall
Signed-off-by: David S. Miller -
This reverts commit f83331bab149e29fa2c49cf102c0cd8c3f1ce9f9.
As the tests PPC64 (powernv platform) show, IOMMU pages are leaking
when transferring big amount of small packets (
Cc: Santosh Rastapur
Cc: Jay Fenlason
Cc: David S. Miller
Cc: Divy Le ray
Signed-off-by: Alexey Kardashevskiy
Acked-by: Divy Le Ray
Signed-off-by: David S. Miller -
It is possible for some versions of firmware to advertise capabilities that driver
is not ready to handle. This may lead to controller stall. Since the driver is
interested only in subset of flags, clearing the rest.Signed-off-by: Sarveshwar Bandi
Signed-off-by: David S. Miller -
Uses the wrong array size for some asics which can lead
to garbage getting written to registers.Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=60674Signed-off-by: Alex Deucher
Cc: stable@vger.kernel.org -
Make sure to fail properly if the device is not accepted during attach
in order to avoid null-pointer derefs (of missing interface private
data) at disconnect or release.Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold
Signed-off-by: Greg Kroah-Hartman -
The parallel-port code of the drivers used a stack allocated
control-request buffer for asynchronous (and possibly deferred) control
requests. This not only violates the no-DMA-from-stack requirement but
could also lead to corrupt control requests being submitted.Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold
Signed-off-by: Greg Kroah-Hartman -
These devices tend to become unresponsive after S3
Signed-off-by: Oliver Neukum
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman -
If we get an error event really early in the driver setup sequence,
which gen3 is especially prone to with various display GTT faults we
Oops. So try to avoid this.Additionally with Haswell the transcoders are a separate bank of
registers from the pipes (4 transcoders, 3 pipes). In event of an
error, we want to be sure we have a complete and accurate picture of
the machine state, so record all the transcoders in addition to all
the active pipes.This regression has been introduced in
commit 702e7a56af3780d8b3a717f698209bef44187bb0
Author: Paulo Zanoni
Date: Tue Oct 23 18:29:59 2012 -0200drm/i915: convert PIPECONF to use transcoder instead of pipe
Based on the patch "drm/i915: Dump all transcoder registers on error"
from Chris Wilson:v2: Rebase so that we don't try to be clever and try to figure out the
cpu transcoder from hw state. That exercise should be done when we
analyze the error state offline.The actual bugfix is to not call intel_pipe_to_cpu_transcoder in the
error state capture code in case the pipes aren't fully set up yet.v3: Simplifiy the err->num_transcoders computation a bit. While at it
make the error capture stuff save on systems without a display block.v4: Fix fail, spotted by Jani.
v5: Completely new commit message, cc: stable.
Cc: Paulo Zanoni
Cc: Damien Lespiau
Cc: Jani Nikula
Cc: Chris Wilson
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=60021
Cc: stable@vger.kernel.org
Tested-by: Dustin King
Reviewed-by: Jani Nikula
Reviewed-by: Chris Wilson
Signed-off-by: Daniel Vetter
