23 Aug, 2013
2 commits
-
commit fba875591 ("disable TX in be_close()") disabled TX in be_close()
to protect be_xmit() from touching freed up queues in the AER recovery
flow. But, TX must be disabled *before* cleaning up TX completions in
the close() path, not after. This allows be_tx_compl_clean() to free up
all TX-req skbs that were notified to the HW.Signed-off-by: Sathya Perla
Signed-off-by: David S. Miller -
Merge in a fix for RX MAC address filter programming bug in the sfc
driver.Signed-off-by: David S. Miller
22 Aug, 2013
2 commits
-
As Sergei Shtylyov explained in the #mipslinux IRC channel:
[Mon 2013-08-19 12:28:21 PM PDT] guys, are you sure it's not "DMA off stack" case?
[Mon 2013-08-19 12:28:35 PM PDT] it's a known stack corruptor on non-coherent arches
[Mon 2013-08-19 12:31:48 PM PDT] headless: for usb/ehci?
[Mon 2013-08-19 12:34:11 PM PDT] headless: explain
[Mon 2013-08-19 12:35:38 PM PDT] usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited
[Mon 2013-08-19 12:35:58 PM PDT] and EHCI uses DMA on control xfers (as well as all the others)Signed-off-by: Daniel Gimpelevich
Acked-by: Greg Kroah-Hartman
Signed-off-by: David S. Miller -
There is no need to get an interface specification if we know it's the
wrong one.Signed-off-by: Daniel Gimpelevich
Acked-by: Greg Kroah-Hartman
Signed-off-by: David S. Miller
21 Aug, 2013
8 commits
-
commit 385904f819e3 ('sfc: Don't use
efx_filter_{build,hash,increment}() for default MAC filters') used the
wrong name to find the index of default RX MAC filters at insertion/
update time. This could result in memory corruption and would in any
case silently fail to update the filter.Signed-off-by: Ben Hutchings
-
John W. Linville says:
====================
Regarding the iwlwifi bits, Johannes says:"We revert an rfkill bugfix that unfortunately caused more bugs, shuffle
some code to avoid touching the PCIe device before it's enabled and
disconnect if firmware fails to do our bidding. I also have Stanislaw's
fix to not crash in some channel switch scenarios."As for the mac80211 bits, Johannes says:
"This time, I have one fix from Dan Carpenter for users of
nl80211hdr_put(), and one fix from myself fixing a regression with the
libertas driver."Along with the above...
Dan Carpenter fixes some incorrectly placed "address of" operators
in hostap that caused copying of junk data.Jussi Kivilinna corrects zd1201 to use an allocated buffer rather
than the stack for a URB operation.
====================Signed-off-by: David S. Miller
-
This is to fix a problem in the rtl8211 where the driver
wasn't properly enabled the interrupt on link change status.
it has to enable the ineterrupt on the bit 10 in the register 18
(INER).Reported-by: Sharma Bhupesh
Signed-off-by: Giuseppe Cavallaro
Signed-off-by: David S. Miller -
Do not clear Broadcast/Multicast/Unicast Wake Flag or LanWake in
Config5. This is necessary to preserve WOL state when the driver is
loaded. Although the r8168 vendor driver does not write Config5 (it has
been commented out), Hayes Wang from Realtek said that masking bits like
this is more sensible.Signed-off-by: Peter Wu
Acked-by: Francois Romieu
Signed-off-by: David S. Miller -
If via_ircc_open() fails, data structures of the driver left uninitialized,
but probe (via_init_one()) returns zero. That can lead to null pointer dereference
in via_remove_one(), since it does not check drvdata for NULL.The patch implements proper error code propagation.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov
Signed-off-by: David S. Miller -
When the user turns off VNET_HDR support on the
macvtap device, there is no way to provide any
offload information to the user. So, it's safer
to ignore offload setting then depend on the user
setting them correctly.Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller -
When the user turns off IFF_VNET_HDR flag, attempts to change
offload features via TUNSETOFFLOAD do not work. This could cause
GSO packets to be delivered to the user when the user is
not prepared to handle them.To solve, allow processing of TUNSETOFFLOAD when IFF_VNET_HDR is
disabled.Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller -
In macvtap, tap_features specific the features of that the user
has specified via ioctl(). If we treat macvtap as a macvlan+tap
then we could all the tap a pseudo-device and give it other features
like SG and GSO. Then we can stop using the features of lower
device (macvlan) when forwarding the traffic the tap.This solves the issue of possible checksum offload mismatch between
tap feature and macvlan features.Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller
20 Aug, 2013
7 commits
-
There are possible HW configurations in which PFs will have SR-IOV capability
but will have Max VFs set to 0 - this happens when there are Multi-Function
devices where the VFs are allocated to only some of the PFs.DMAE is configured to support VFs only if the configuring PF has supported VFs.
In case the first PF to be loaded will be one without supported VFs, it will
not configure DMAE to the VF-supporting mode. When VFs of other PFs will be
loaded later on, they will not be able to communicate with their PF.This changes the requirement for configuring DMAE for VF-supporting mode;
If the device has SR-IOV capabilities there must be some PF that has
max supported VFs > 0, thus it will configure the DMAE for supporting VFs.Signed-off-by: Ariel Elior
Signed-off-by: Yuval Mintz
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Since SR-IOV can be activated dynamically and iproute2 can be called
asynchronously, the various callbacks need a robust sanity check before
attempting to access the SR-IOV database and members since there are numerous
states in which it can find the driver (e.g., PF is down, sriov was not enabled
yet, VF is down, etc.).In many of the states the callback result will be null pointer dereference.
Signed-off-by: Ariel Elior
Signed-off-by: Yuval Mintz
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
During probe, VFs might erroneously try to access the shared memory (which
only PFs are capabale of accessing), causing benign attentions to appear.Signed-off-by: Yuval Mintz
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
When publishing information via getfeatcfg(), bnx2x driver didn't consider
remote errors (e.g., switch that doesn't support DCBX) when setting the
error flags.Signed-off-by: Dmitry Kravkov
Signed-off-by: Yuval Mintz
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
After notification that DCBX configuration has ended arrived to the driver,
the driver configured the FW/HW in sleepless context.
As a result, it was possible to reach a race (mostly with CNIC registration)
in which the configuration will return a timeout, failing to set the DCBX
results correctly.This patch moves the configuration following the DCBX end into the slowpath
RTNL task (i.e., sleepless context protected by the RTNL lock), allowing the
configuration to cope with such races.Signed-off-by: Dmitry Kravkov
Signed-off-by: Yuval Mintz
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Since commit 3deb816 "bnx2x: Add a periodic task for link PHY events"
link state changes can be detected not only via the attention flow but also
from the periodic task.
If the link state will change in such a manner (i.e., via the periodic task),
dropless flow-control will not be configured.This patch remedies the issue, adding the missing configuration to all required
flows.Signed-off-by: Dmitry Kravkov
Signed-off-by: Yuval Mintz
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
…wireless into for-davem
16 Aug, 2013
6 commits
-
In the previous QUERY_PAGES command version we used one command to get the
required amount of boot, init and post init pages. The new version uses the
op_mod field to specify whether the query is for the required amount of boot,
init or post init pages. In addition the output field size for the required
amount of pages increased from 16 to 32 bits.In MANAGE_PAGES command the input_num_entries and output_num_entries fields
sizes changed from 16 to 32 bits and the PAS tables offset changed to 0x10.In the pages request event the num_pages field also changed to 32 bits.
In the HCA-capabilities-layout the size and location of max_qp_mcg field has
been changed to support 24 bits.This patch isn't compatible with firmware versions < 5; however, it turns out that the
first GA firmware we will publish will not support previous versions so this should be OK.Signed-off-by: Moshe Lazer
Signed-off-by: Eli Cohen
Signed-off-by: David S. Miller -
The recent fix d9bf5f1309 "tun: compare with 0 instead of total_len" is
not totally correct. Because "len" and "sizeof()" are size_t type, that
means they are never less than zero.Signed-off-by: Dan Carpenter
Acked-by: Michael S. Tsirkin
Acked-by: Neil Horman
Signed-off-by: David S. Miller -
o Do not allow interrupt test when adapter is resetting.
Signed-off-by: Manish Chopra
Signed-off-by: Sucheta Chakraborty
Signed-off-by: David S. Miller -
o Driver was misinterpreting the return status for beacon
state query leading to incorrect interpretation of beacon
state and logging an error message for successful status.
Fixed the driver to properly interpret the return status.Signed-off-by: Sucheta Chakraborty
Signed-off-by: David S. Miller -
Driver was issuing set driver version command through all
functions in the adapter. Fix the driver to issue set driver
version once per adapter, through function 0.Signed-off-by: Himanshu Madhani
Signed-off-by: Sucheta Chakraborty
Signed-off-by: David S. Miller -
Commit d8af4dfd8 ("net/tg3: Fix kernel crash") introduced a possible
NULL pointer dereference in tg3 driver when !netdev || !netif_running(netdev)
condition is met and netdev is NULL. Then, the jump to the 'done' label
calls dev_close() with a netdevice that is NULL. Therefore, only call
dev_close() when we have a netdevice, but one that is not running.[ Add the same checks in tg3_io_slot_reset() per Gavin Shan - by Nithin
Nayak Sujir ]Reported-by: Dave Jones
Signed-off-by: Daniel Borkmann
Cc: Gavin Shan
Cc: Michael Chan
Signed-off-by: Nithin Nayak Sujir
Signed-off-by: Nithin Nayak Sujir
Signed-off-by: Michael Chan
Signed-off-by: David S. Miller
15 Aug, 2013
3 commits
-
Drivers supporting NAPI should use a NAPI-specific function for receiving
packets. Hence netif_rx is changed to netif_receive_skb.Furthermore netif_napi_del should be used in the probe and remove function
to clean up the NAPI resource information.Thanks to Francois Romieu, David Shwatrz and Rami Rosen for their help on
this patch.Signed-off-by: Julia Lawall
Signed-off-by: David S. Miller -
This reverts commit f83331bab149e29fa2c49cf102c0cd8c3f1ce9f9.
As the tests PPC64 (powernv platform) show, IOMMU pages are leaking
when transferring big amount of small packets (
Cc: Santosh Rastapur
Cc: Jay Fenlason
Cc: David S. Miller
Cc: Divy Le ray
Signed-off-by: Alexey Kardashevskiy
Acked-by: Divy Le Ray
Signed-off-by: David S. Miller -
It is possible for some versions of firmware to advertise capabilities that driver
is not ready to handle. This may lead to controller stall. Since the driver is
interested only in subset of flags, clearing the rest.Signed-off-by: Sarveshwar Bandi
Signed-off-by: David S. Miller
14 Aug, 2013
8 commits
-
Since we set "len = total_len" in the beginning of tun_get_user(),
so we should compare the new len with 0, instead of total_len,
or the if statement always returns false.Signed-off-by: Weiping Pan
Signed-off-by: David S. Miller -
Initially I improperly set a boundary for maximum number of input
packets to process on NAPI poll ("work") so it might be more than
expected amount ("weight").This was really harmless but seeing WARN_ON_ONCE on every device boot is
not nice. So trivial fix ("
Cc: linux-kernel@vger.kernel.org
Signed-off-by: David S. Miller -
There might be a crash as during shutdown flow CNIC might try
to access resources already freed by bnx2x.
Change bnx2x_close() into dev_close() in __bnx2x_remove (shutdown flow)
to guarantee CNIC is notified of the device's change of status.Signed-off-by: Yuval Mintz
Signed-off-by: Dmitry Kravkov
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
PTE write access error might occur in MF_ALLOWED mode when IOMMU
is active. The patch adds rmmod HSI indicating to MFW to stop
running queries which might trigger this failure.Signed-off-by: Barak Witkowsky
Signed-off-by: Dmitry Kravkov
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Signed-off-by: Ariel Elior
Signed-off-by: Dmitry Kravkov
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
ETS can be enabled as a result of DCB negotiation, then
fairness must be recalculated after each negotiation.Signed-off-by: Dmitry Kravkov
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Signed-off-by: David S. Miller -
Add locking to protect different statistics flows from
running simultaneously.
This in order to serialize statistics requests sent to FW,
otherwise two outstanding queries may cause FW assert.Signed-off-by: Dmitry Kravkov
Signed-off-by: Ariel Elior
Signed-off-by: Eilon Greenstein
Acked-by: Neal Cardwell
Signed-off-by: David S. Miller -
The DMA sync should sync the whole receive buffer, not just
part of it. Fixes log messages dma_sync_check.Signed-off-by: Stephen Hemminger
Signed-off-by: David S. Miller
13 Aug, 2013
1 commit
-
In stmmac_init_rx_buffers():
* add missing handling of dma_map_single() error
* remove superfluous unlikely() optimization while at itAdd stmmac_free_rx_buffers() helper and use it in dma_free_rx_skbufs().
In init_dma_desc_rings():
* add missing handling of kmalloc_array() errors
* fix handling of dma_alloc_coherent() and stmmac_init_rx_buffers() errors
* make function return an error value on error and 0 on successIn stmmac_open():
* add handling of init_dma_desc_rings() return valueSigned-off-by: Bartlomiej Zolnierkiewicz
Signed-off-by: Kyungmin Park
Signed-off-by: David S. Miller
12 Aug, 2013
2 commits
-
Fix possibly wrong memcpy() bytes length since some CAN records received from
PCAN-USB could define a DLC field in range [9..15].
In that case, the real DLC value MUST be used to move forward the record pointer
but, only 8 bytes max. MUST be copied into the data field of the struct
can_frame object of the skb given to the network core.Cc: linux-stable
Signed-off-by: Stephane Grosjean
Signed-off-by: Marc Kleine-Budde
Signed-off-by: David S. Miller -
Since commit ac4e4af1e59e1 ("macvtap: Consistently use rcu functions"),
Thomas gets two different warnings :BUG: using smp_processor_id() in preemptible [00000000] code: vhost-45891/45892
caller is macvtap_do_read+0x45c/0x600 [macvtap]
CPU: 1 PID: 45892 Comm: vhost-45891 Not tainted 3.11.0-bisecttest #13
Call Trace:
([] show_trace+0x126/0x144)
[] show_stack+0xc6/0xd4
[] dump_stack+0x74/0xd8
[] debug_smp_processor_id+0xf6/0x114
[] macvtap_do_read+0x45c/0x600 [macvtap]
[] macvtap_recvmsg+0x60/0x88 [macvtap]
[] handle_rx+0x5b2/0x800 [vhost_net]
[] vhost_worker+0x15c/0x1c4 [vhost]
[] kthread+0xd8/0xe4
[] kernel_thread_starter+0x6/0xc
[] kernel_thread_starter+0x0/0xcAnd
BUG: using smp_processor_id() in preemptible [00000000] code: vhost-45897/45898
caller is macvlan_start_xmit+0x10a/0x1b4 [macvlan]
CPU: 1 PID: 45898 Comm: vhost-45897 Not tainted 3.11.0-bisecttest #16
Call Trace:
([] show_trace+0x126/0x144)
[] show_stack+0xc6/0xd4
[] dump_stack+0x74/0xd4
[] debug_smp_processor_id+0xf6/0x114
[] macvlan_start_xmit+0x10a/0x1b4 [macvlan]
[] macvtap_get_user+0x982/0xbc4 [macvtap]
[] macvtap_sendmsg+0x4e/0x60 [macvtap]
[] handle_tx+0x494/0x5ec [vhost_net]
[] vhost_worker+0x15c/0x1c4 [vhost]
[] kthread+0xd8/0xe4
[] kernel_thread_starter+0x6/0xc
[] kernel_thread_starter+0x0/0xc
2 locks held by vhost-45897/45898:
#0: (&vq->mutex){+.+.+.}, at: [] handle_tx+0x54/0x5ec [vhost_net]
#1: (rcu_read_lock){.+.+..}, at: [] macvtap_get_user+0x824/0xbc4 [macvtap]In the first case, macvtap_put_user() calls macvlan_count_rx()
in a preempt-able context, and this is not allowed.In the second case, macvtap_get_user() calls
macvlan_start_xmit() with BH enabled, and this is not allowed.Reported-by: Thomas Huth
Bisected-by: Thomas Huth
Signed-off-by: Eric Dumazet
Tested-by: Thomas Huth
Cc: Vlad Yasevich
Signed-off-by: David S. Miller
10 Aug, 2013
1 commit
-
This patch fixed the condition of extend_desc for jumbo frame.
There is no check routine for extend_desc in the stmmac_jumbo_frm function.
Even though extend_desc is set if dma_tx is used instead of dma_etx.
It causes kernel panic.Signed-off-by: Byungho An
Signed-off-by: David S. Miller
