19 Oct, 2016

12 commits

  • We recently got the following warning after setting up a vlan device on
    top of an offloaded bridge and executing 'bridge link':

    WARNING: CPU: 0 PID: 18566 at drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c:81 mlxsw_sp_port_orig_get.part.9+0x55/0x70 [mlxsw_spectrum]
    [...]
    CPU: 0 PID: 18566 Comm: bridge Not tainted 4.8.0-rc7 #1
    Hardware name: Mellanox Technologies Ltd. Mellanox switch/Mellanox switch, BIOS 4.6.5 05/21/2015
    0000000000000286 00000000e64ab94f ffff880406e6f8f0 ffffffff8135eaa3
    0000000000000000 0000000000000000 ffff880406e6f930 ffffffff8108c43b
    0000005106e6f988 ffff8803df398840 ffff880403c60108 ffff880406e6f990
    Call Trace:
    [] dump_stack+0x63/0x90
    [] __warn+0xcb/0xf0
    [] warn_slowpath_null+0x1d/0x20
    [] mlxsw_sp_port_orig_get.part.9+0x55/0x70 [mlxsw_spectrum]
    [] mlxsw_sp_port_attr_get+0xa5/0xb0 [mlxsw_spectrum]
    [] switchdev_port_attr_get+0x4f/0x140
    [] switchdev_port_attr_get+0x100/0x140
    [] switchdev_port_attr_get+0x100/0x140
    [] switchdev_port_bridge_getlink+0x5b/0xc0
    [] ? switchdev_port_fdb_dump+0x90/0x90
    [] rtnl_bridge_getlink+0xe7/0x190
    [] netlink_dump+0x122/0x290
    [] __netlink_dump_start+0x15f/0x190
    [] ? rtnl_bridge_dellink+0x230/0x230
    [] rtnetlink_rcv_msg+0x1a6/0x220
    [] ? __kmalloc_node_track_caller+0x208/0x2c0
    [] ? rtnl_bridge_dellink+0x230/0x230
    [] ? rtnl_newlink+0x890/0x890
    [] netlink_rcv_skb+0xa4/0xc0
    [] rtnetlink_rcv+0x28/0x30
    [] netlink_unicast+0x18c/0x240
    [] netlink_sendmsg+0x2fb/0x3a0
    [] sock_sendmsg+0x38/0x50
    [] SYSC_sendto+0x101/0x190
    [] ? __sys_recvmsg+0x51/0x90
    [] SyS_sendto+0xe/0x10
    [] entry_SYSCALL_64_fastpath+0x1a/0xa4

    The problem is that the 8021q module propagates the call to
    ndo_bridge_getlink() via switchdev ops, but the switch driver doesn't
    recognize the netdev, as it's not offloaded.

    While we can ignore calls being made to non-bridge ports inside the
    driver, a better fix would be to push this check up to the switchdev
    layer.

    Note that these ndos can be called for non-bridged netdev, but this only
    happens in certain PF drivers which don't call the corresponding
    switchdev functions anyway.

    Fixes: 99f44bb3527b ("mlxsw: spectrum: Enable L3 interfaces on top of bridge devices")
    Signed-off-by: Ido Schimmel
    Reported-by: Tamir Winetroub
    Tested-by: Tamir Winetroub
    Signed-off-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Ido Schimmel
     
  • Tamir reported the following trace when processing ARP requests received
    via a vlan device on top of a VLAN-aware bridge:

    NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [swapper/1:0]
    [...]
    CPU: 1 PID: 0 Comm: swapper/1 Tainted: G W 4.8.0-rc7 #1
    Hardware name: Mellanox Technologies Ltd. "MSN2100-CB2F"/"SA001017", BIOS 5.6.5 06/07/2016
    task: ffff88017edfea40 task.stack: ffff88017ee10000
    RIP: 0010:[] [] netdev_all_lower_get_next_rcu+0x33/0x60
    [...]
    Call Trace:

    [] mlxsw_sp_port_lower_dev_hold+0x5a/0xa0 [mlxsw_spectrum]
    [] mlxsw_sp_router_netevent_event+0x80/0x150 [mlxsw_spectrum]
    [] notifier_call_chain+0x4a/0x70
    [] atomic_notifier_call_chain+0x1a/0x20
    [] call_netevent_notifiers+0x1b/0x20
    [] neigh_update+0x306/0x740
    [] neigh_event_ns+0x4e/0xb0
    [] arp_process+0x66f/0x700
    [] ? common_interrupt+0x8c/0x8c
    [] arp_rcv+0x139/0x1d0
    [] ? vlan_do_receive+0xda/0x320
    [] __netif_receive_skb_core+0x524/0xab0
    [] ? dev_queue_xmit+0x10/0x20
    [] ? br_forward_finish+0x3d/0xc0 [bridge]
    [] ? br_handle_vlan+0xf6/0x1b0 [bridge]
    [] __netif_receive_skb+0x18/0x60
    [] netif_receive_skb_internal+0x40/0xb0
    [] netif_receive_skb+0x1c/0x70
    [] br_pass_frame_up+0xc6/0x160 [bridge]
    [] ? deliver_clone+0x37/0x50 [bridge]
    [] ? br_flood+0xcc/0x160 [bridge]
    [] br_handle_frame_finish+0x224/0x4f0 [bridge]
    [] br_handle_frame+0x174/0x300 [bridge]
    [] __netif_receive_skb_core+0x329/0xab0
    [] ? find_next_bit+0x15/0x20
    [] ? cpumask_next_and+0x32/0x50
    [] ? load_balance+0x178/0x9b0
    [] __netif_receive_skb+0x18/0x60
    [] netif_receive_skb_internal+0x40/0xb0
    [] netif_receive_skb+0x1c/0x70
    [] mlxsw_sp_rx_listener_func+0x61/0xb0 [mlxsw_spectrum]
    [] mlxsw_core_skb_receive+0x187/0x200 [mlxsw_core]
    [] mlxsw_pci_cq_tasklet+0x63a/0x9b0 [mlxsw_pci]
    [] tasklet_action+0xf6/0x110
    [] __do_softirq+0xf6/0x280
    [] irq_exit+0xdf/0xf0
    [] do_IRQ+0x54/0xd0
    [] common_interrupt+0x8c/0x8c

    The problem is that netdev_all_lower_get_next_rcu() never advances the
    iterator, thereby causing the loop over the lower adjacency list to run
    forever.

    Fix this by advancing the iterator and avoid the infinite loop.

    Fixes: 7ce856aaaf13 ("mlxsw: spectrum: Add couple of lower device helper functions")
    Signed-off-by: Ido Schimmel
    Reported-by: Tamir Winetroub
    Reviewed-by: Jiri Pirko
    Acked-by: David Ahern
    Signed-off-by: David S. Miller

    Ido Schimmel
     
  • Fixes a panic when calling eth_get_headlen(). Noticed on i40e driver.

    Fixes: d5709f7ab776 ("flow_dissector: For stripped vlan, get vlan info from skb->vlan_tci")
    Signed-off-by: Eric Garver
    Reviewed-by: Jakub Sitnicki
    Acked-by: Amir Vadai
    Signed-off-by: David S. Miller

    Eric Garver
     
  • Using list_move_tail() instead of list_del() + list_add_tail().

    Signed-off-by: Wei Yongjun
    Acked-by: Yuval Mintz
    Signed-off-by: David S. Miller

    Wei Yongjun
     
  • In some rare configurations, we get a warning about the 'index' variable
    being used without an initialization:

    drivers/net/ethernet/rocker/rocker_ofdpa.c: In function ‘ofdpa_port_fib_ipv4.isra.16.constprop’:
    drivers/net/ethernet/rocker/rocker_ofdpa.c:2425:92: warning: ‘index’ may be used uninitialized in this function [-Wmaybe-uninitialized]

    This is a false positive, the logic is just a bit too complex for gcc
    to follow here. Moving the intialization of 'index' a little further
    down makes it clear to gcc that the function always returns an error
    if it is not initialized.

    Signed-off-by: Arnd Bergmann
    Signed-off-by: David S. Miller

    Arnd Bergmann
     
  • The hdr_offset variable is only if we deal with a TCP or UDP packet,
    but as the check surrounding its usage tests for skb_is_gso()
    instead, the compiler has no idea if the variable is initialized
    or not at that point:

    drivers/net/hyperv/netvsc_drv.c: In function ‘netvsc_start_xmit’:
    drivers/net/hyperv/netvsc_drv.c:494:42: error: ‘hdr_offset’ may be used uninitialized in this function [-Werror=maybe-uninitialized]

    This adds an additional check for the transport type, which
    tells the compiler that this path cannot happen. Since the
    get_net_transport_info() function should always be inlined
    here, I don't expect this to result in additional runtime
    checks.

    Signed-off-by: Arnd Bergmann
    Signed-off-by: David S. Miller

    Arnd Bergmann
     
  • gcc found a reference to an uninitialized variable in the error handling
    of bcm_enet_open, introduced by a recent cleanup:

    drivers/net/ethernet/broadcom/bcm63xx_enet.c: In function 'bcm_enet_open'
    drivers/net/ethernet/broadcom/bcm63xx_enet.c:1129:2: warning: 'phydev' may be used uninitialized in this function [-Wmaybe-uninitialized]

    This makes the use of that variable conditional, so we only reference it
    here after it has been used before. Unlike my normal patches, I have not
    build-tested this one, as I don't currently have mips test in my
    randconfig setup.

    Fixes: 625eb8667d6f ("net: ethernet: broadcom: bcm63xx: use phydev from struct net_device")
    Cc: Philippe Reynes
    Reported-by: kbuild test robot
    Signed-off-by: Arnd Bergmann
    Signed-off-by: David S. Miller

    Arnd Bergmann
     
  • reuseport_add_sock() is not used from a module,
    no need to export it.

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • It is possible for the MTU to be changed during the initialization
    process with the VNIC Server. Ensure that the net device is updated
    to reflect the new MTU.

    Signed-off-by: Thomas Falcon
    Signed-off-by: David S. Miller

    Thomas Falcon
     
  • Signed-off-by: Thomas Falcon
    Signed-off-by: David S. Miller

    Thomas Falcon
     
  • Increment driver version to reflect features that have
    been added since release.

    Signed-off-by: Thomas Falcon
    Signed-off-by: David S. Miller

    Thomas Falcon
     
  • Satish reported a problem with the perm multicast router ports not getting
    reenabled after some series of events, in particular if it happens that the
    multicast snooping has been disabled and the port goes to disabled state
    then it will be deleted from the router port list, but if it moves into
    non-disabled state it will not be re-added because the mcast snooping is
    still disabled, and enabling snooping later does nothing.

    Here are the steps to reproduce, setup br0 with snooping enabled and eth1
    added as a perm router (multicast_router = 2):
    1. $ echo 0 > /sys/class/net/br0/bridge/multicast_snooping
    2. $ ip l set eth1 down
    ^ This step deletes the interface from the router list
    3. $ ip l set eth1 up
    ^ This step does not add it again because mcast snooping is disabled
    4. $ echo 1 > /sys/class/net/br0/bridge/multicast_snooping
    5. $ bridge -d -s mdb show

    At this point we have mcast enabled and eth1 as a perm router (value = 2)
    but it is not in the router list which is incorrect.

    After this change:
    1. $ echo 0 > /sys/class/net/br0/bridge/multicast_snooping
    2. $ ip l set eth1 down
    ^ This step deletes the interface from the router list
    3. $ ip l set eth1 up
    ^ This step does not add it again because mcast snooping is disabled
    4. $ echo 1 > /sys/class/net/br0/bridge/multicast_snooping
    5. $ bridge -d -s mdb show
    router ports on br0: eth1

    Note: we can directly do br_multicast_enable_port for all because the
    querier timer already has checks for the port state and will simply
    expire if it's in blocking/disabled. See the comment added by
    commit 9aa66382163e7 ("bridge: multicast: add a comment to
    br_port_state_selection about blocking state")

    Fixes: 561f1103a2b7 ("bridge: Add multicast_snooping sysfs toggle")
    Reported-by: Satish Ashok
    Signed-off-by: Nikolay Aleksandrov
    Signed-off-by: David S. Miller

    Nikolay Aleksandrov
     

18 Oct, 2016

16 commits

  • Remove the unused but set variable icsk in listening_get_next to fix the
    following GCC warning when building with 'W=1':

    net/ipv4/tcp_ipv4.c: In function ‘listening_get_next’:
    net/ipv4/tcp_ipv4.c:1890:31: warning: variable ‘icsk’ set but not used [-Wunused-but-set-variable]

    Signed-off-by: Tobias Klauser
    Signed-off-by: David S. Miller

    Tobias Klauser
     
  • Do not let number of offload queue sets to go more than
    MAX_OFLD_QSETS, which would otherwise crash the driver
    on machines with cores more than MAX_OFLD_QSETS.

    Signed-off-by: Ganesh Goudar
    Signed-off-by: David S. Miller

    Ganesh Goudar
     
  • Remove the unused but set variable dev in ip_do_fragment to fix the
    following GCC warning when building with 'W=1':

    net/ipv4/ip_output.c: In function ‘ip_do_fragment’:
    net/ipv4/ip_output.c:541:21: warning: variable ‘dev’ set but not used [-Wunused-but-set-variable]

    Signed-off-by: Tobias Klauser
    Signed-off-by: David S. Miller

    Tobias Klauser
     
  • Allow autoneg to enable flow control by default.
    The behavior when autoneg is off has not changed.

    Signed-off-by: Niklas Cassel
    Signed-off-by: Jesper Nilsson
    Acked-by: Lars Persson
    Signed-off-by: David S. Miller

    Niklas Cassel
     
  • phy_device->supported is originally set by the PHY driver.
    The ethernet driver should filter phy_device->supported to only contain
    flags supported by the IP.
    The IP supports setting rx and tx flow control independently,
    therefore SUPPORTED_Pause and SUPPORTED_Asym_Pause should not be cleared.
    If the flags are cleared, pause frames cannot be enabled (even if they
    are supported by the PHY).

    Signed-off-by: Niklas Cassel
    Signed-off-by: Jesper Nilsson
    Acked-by: Lars Persson
    Signed-off-by: David S. Miller

    Niklas Cassel
     
  • Remove the unused but set variable master_dev in check_local_dest to fix
    the following GCC warning when building with 'W=1':

    net/hsr/hsr_forward.c: In function ‘check_local_dest’:
    net/hsr/hsr_forward.c:303:21: warning: variable ‘master_dev’ set but not used [-Wunused-but-set-variable]

    Signed-off-by: Tobias Klauser
    Signed-off-by: David S. Miller

    Tobias Klauser
     
  • …kernel/git/jberg/mac80211

    Johannes Berg says:

    ====================
    This is relatively small, mostly to get the SG/crypto
    from stack removal fix that crashes things when VMAP
    stack is used in conjunction with software crypto.

    Aside from that, we have:
    * a fix for AP_VLAN usage with the nl80211 frame command
    * two fixes (and two preparation patches) for A-MSDU, one
    to discard group-addressed (multicast) and unexpected
    4-address A-MSDUs, the other to validate A-MSDU inner
    MAC addresses properly to prevent controlled port bypass
    ====================

    Signed-off-by: David S. Miller <davem@davemloft.net>

    David S. Miller
     
  • Functions bnx2_reg_rd_ind(), bnx2_reg_wr_ind() and bnx2_ctx_wr()
    can be called with IRQs disabled when netconsole is enabled. So they
    should use spin_{,un}lock_irq{save,restore} instead of _bh variants.

    Example call flow:
    bnx2_poll()
    ->bnx2_poll_link()
    ->bnx2_phy_int()
    ->bnx2_set_remote_link()
    ->bnx2_shmem_rd()
    ->bnx2_reg_rd_ind()
    -> spin_lock_bh(&bp->indirect_lock);
    spin_unlock_bh(&bp->indirect_lock);
    ...
    -> __local_bh_enable_ip

    static inline void __local_bh_enable_ip(unsigned long ip)
    WARN_ON_ONCE(in_irq() || irqs_disabled()); <<<<<< WARN

    Cc: Sony Chacko
    Cc: Dept-HSGLinuxNICDev@qlogic.com
    Signed-off-by: Ivan Vecera
    Signed-off-by: David S. Miller

    Ivan Vecera
     
  • Javier Martinez Canillas says:

    ====================
    net: Fix module autoload for several platform drivers

    I noticed that module autoload won't be working in a bunch of platform
    drivers in the net subsystem and this patch series contains the fixes.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • If the driver is built as a module, autoload won't work because the module
    alias information is not filled. So user-space can't match the registered
    device with the corresponding module.

    Export the module alias information using the MODULE_DEVICE_TABLE() macro.

    Before this patch:

    $ modinfo drivers/net/dsa/bcm_sf2.ko | grep alias
    alias: platform:brcm-sf2

    After this patch:

    $ modinfo drivers/net/dsa/bcm_sf2.ko | grep alias
    alias: platform:brcm-sf2
    alias: of:N*T*Cbrcm,bcm7445-switch-v4.0C*
    alias: of:N*T*Cbrcm,bcm7445-switch-v4.0

    Signed-off-by: Javier Martinez Canillas
    Signed-off-by: David S. Miller

    Javier Martinez Canillas
     
  • If the driver is built as a module, autoload won't work because the module
    alias information is not filled. So user-space can't match the registered
    device with the corresponding module.

    Export the module alias information using the MODULE_DEVICE_TABLE() macro.

    Before this patch:

    $ modinfo drivers/net/dsa/b53/b53_mmap.ko | grep alias
    $

    After this patch:

    $ modinfo drivers/net/dsa/b53/b53_mmap.ko | grep alias
    alias: of:N*T*Cbrcm,bcm63xx-switchC*
    alias: of:N*T*Cbrcm,bcm63xx-switch
    alias: of:N*T*Cbrcm,bcm6368-switchC*
    alias: of:N*T*Cbrcm,bcm6368-switch
    alias: of:N*T*Cbrcm,bcm6328-switchC*
    alias: of:N*T*Cbrcm,bcm6328-switch
    alias: of:N*T*Cbrcm,bcm3384-switchC*
    alias: of:N*T*Cbrcm,bcm3384-switch

    Signed-off-by: Javier Martinez Canillas
    Signed-off-by: David S. Miller

    Javier Martinez Canillas
     
  • If the driver is built as a module, autoload won't work because the module
    alias information is not filled. So user-space can't match the registered
    device with the corresponding module.

    Export the module alias information using the MODULE_DEVICE_TABLE() macro.

    Before this patch:

    $ modinfo drivers/net/ethernet/hisilicon//hns_mdio.ko | grep alias
    alias: platform:Hi-HNS_MDIO
    alias: acpi*:HISI0141:*

    After this patch:

    $ modinfo drivers/net/ethernet/hisilicon//hns_mdio.ko | grep alias
    alias: platform:Hi-HNS_MDIO
    alias: of:N*T*Chisilicon,hns-mdioC*
    alias: of:N*T*Chisilicon,hns-mdio
    alias: of:N*T*Chisilicon,mdioC*
    alias: of:N*T*Chisilicon,mdio
    alias: acpi*:HISI0141:*

    Signed-off-by: Javier Martinez Canillas
    Signed-off-by: David S. Miller

    Javier Martinez Canillas
     
  • If the driver is built as a module, autoload won't work because the module
    alias information is not filled. So user-space can't match the registered
    device with the corresponding module.

    Export the module alias information using the MODULE_DEVICE_TABLE() macro.

    Before this patch:

    $ modinfo drivers/net/ethernet/qualcomm/emac/qcom-emac.ko | grep alias
    alias: platform:qcom-emac

    After this patch:

    $ modinfo drivers/net/ethernet/qualcomm/emac/qcom-emac.ko | grep alias
    alias: platform:qcom-emac
    alias: of:N*T*Cqcom,fsm9900-emacC*
    alias: of:N*T*Cqcom,fsm9900-emac

    Signed-off-by: Javier Martinez Canillas
    Acked-by: Timur Tabi
    Signed-off-by: David S. Miller

    Javier Martinez Canillas
     
  • If the driver is built as a module, autoload won't work because the module
    alias information is not filled. So user-space can't match the registered
    device with the corresponding module.

    Export the module alias information using the MODULE_DEVICE_TABLE() macro.

    Before this patch:

    $ modinfo drivers/net/ethernet/hisilicon/hns/hns_dsaf.ko | grep alias
    alias: acpi*:HISI00B2:*
    alias: acpi*:HISI00B1:*

    After this patch:

    $ modinfo drivers/net/ethernet/hisilicon/hns/hns_dsaf.ko | grep alias
    alias: acpi*:HISI00B2:*
    alias: acpi*:HISI00B1:*
    alias: of:N*T*Chisilicon,hns-dsaf-v2C*
    alias: of:N*T*Chisilicon,hns-dsaf-v2
    alias: of:N*T*Chisilicon,hns-dsaf-v1C*
    alias: of:N*T*Chisilicon,hns-dsaf-v1

    Signed-off-by: Javier Martinez Canillas
    Signed-off-by: David S. Miller

    Javier Martinez Canillas
     
  • If the driver is built as a module, autoload won't work because the module
    alias information is not filled. So user-space can't match the registered
    device with the corresponding module.

    Export the module alias information using the MODULE_DEVICE_TABLE() macro.

    Before this patch:

    $ $ modinfo drivers/net/ethernet/aurora/nb8800.ko | grep alias
    $

    After this patch:

    $ modinfo drivers/net/ethernet/aurora/nb8800.ko | grep alias
    alias: of:N*T*Csigma,smp8734-ethernetC*
    alias: of:N*T*Csigma,smp8734-ethernet
    alias: of:N*T*Csigma,smp8642-ethernetC*
    alias: of:N*T*Csigma,smp8642-ethernet
    alias: of:N*T*Caurora,nb8800C*
    alias: of:N*T*Caurora,nb8800

    Signed-off-by: Javier Martinez Canillas
    Acked-by: Mans Rullgard
    Signed-off-by: David S. Miller

    Javier Martinez Canillas
     
  • If the driver is built as a module, autoload won't work because the module
    alias information is not filled. So user-space can't match the registered
    device with the corresponding module.

    Export the module alias information using the MODULE_DEVICE_TABLE() macro.

    Before this patch:

    $ modinfo drivers/net/ethernet/ezchip/nps_enet.ko | grep alias
    $

    After this patch:

    $ modinfo drivers/net/ethernet/ezchip/nps_enet.ko | grep alias
    alias: of:N*T*Cezchip,nps-mgt-enetC*
    alias: of:N*T*Cezchip,nps-mgt-enet

    Signed-off-by: Javier Martinez Canillas
    Signed-off-by: David S. Miller

    Javier Martinez Canillas
     

17 Oct, 2016

4 commits

  • A memory leak of qe occurs when t4_sched_queue_unbind fails,
    so fix this by free'ing qe on the error exit path.

    Signed-off-by: Colin Ian King
    Signed-off-by: David S. Miller

    Colin Ian King
     
  • After Jesper commit back in linux-3.18, we trigger a lockdep
    splat in proc_create_data() while allocating memory from
    pktgen_change_name().

    This patch converts t->if_lock to a mutex, since it is now only
    used from control path, and adds proper locking to pktgen_change_name()

    1) pktgen_thread_lock to protect the outer loop (iterating threads)
    2) t->if_lock to protect the inner loop (iterating devices)

    Note that before Jesper patch, pktgen_change_name() was lacking proper
    protection, but lockdep was not able to detect the problem.

    Fixes: 8788370a1d4b ("pktgen: RCU-ify "if_list" to remove lock in next_to_run()")
    Reported-by: John Sperbeck
    Signed-off-by: Eric Dumazet
    Cc: Jesper Dangaard Brouer
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • Currently, socket lookups for l3mdev (vrf) use cases can match a socket
    that is bound to a port but not a device (ie., a global socket). If the
    sysctl tcp_l3mdev_accept is not set this leads to ack packets going out
    based on the main table even though the packet came in from an L3 domain.
    The end result is that the connection does not establish creating
    confusion for users since the service is running and a socket shows in
    ss output. Fix by requiring an exact dif to sk_bound_dev_if match if the
    skb came through an interface enslaved to an l3mdev device and the
    tcp_l3mdev_accept is not set.

    skb's through an l3mdev interface are marked by setting a flag in
    inet{6}_skb_parm. The IPv6 variant is already set; this patch adds the
    flag for IPv4. Using an skb flag avoids a device lookup on the dif. The
    flag is set in the VRF driver using the IP{6}CB macros. For IPv4, the
    inet_skb_parm struct is moved in the cb per commit 971f10eca186, so the
    match function in the TCP stack needs to use TCP_SKB_CB. For IPv6, the
    move is done after the socket lookup, so IP6CB is used.

    The flags field in inet_skb_parm struct needs to be increased to add
    another flag. There is currently a 1-byte hole following the flags,
    so it can be expanded to u16 without increasing the size of the struct.

    Fixes: 193125dbd8eb ("net: Introduce VRF device driver")
    Signed-off-by: David Ahern
    Signed-off-by: David S. Miller

    David Ahern
     
  • Some crypto implementations (such as the generic CCM wrapper in crypto/)
    use scatterlists to map fields of private data in their struct aead_req.
    This means these data structures cannot live in the vmalloc area, which
    means that they cannot live on the stack (with CONFIG_VMAP_STACK.)

    This currently occurs only with the generic software implementation, but
    the private data and usage is implementation specific, so move the whole
    data structures off the stack into heap by allocating every time we need
    to use them.

    In addition, take care not to put any of our own stack allocations into
    scatterlists. This involves reserving some extra room when allocating the
    aead_request structures, and referring to those allocations in the scatter-
    lists (while copying the data from the stack before the crypto operation)

    Signed-off-by: Ard Biesheuvel
    Signed-off-by: Johannes Berg

    Ard Biesheuvel
     

16 Oct, 2016

4 commits

  • vmxnet3_set_mc() checks new_table_pa returned by dma_map_single()
    with dma_mapping_error(), but even there it assumes zero is invalid pa
    (it assumes dma_mapping_error(...,0) returns true if new_table is NULL).

    The patch adds an explicit variable to track status of new_table_pa.

    Found by Linux Driver Verification project (linuxtesting.org).

    v2: use "bool" and "true"/"false" for boolean variables.
    Signed-off-by: Alexey Khoroshilov
    Signed-off-by: David S. Miller

    Alexey Khoroshilov
     
  • PTR_ERR(NULL) is success. We have to preserve the error code earlier.

    Fixes: 7086605a6ab5 ("stmmac: fix error check when init ptp")
    Signed-off-by: Dan Carpenter
    Signed-off-by: David S. Miller

    Dan Carpenter
     
  • There is a race condition that can occur if EMAC interrupts are
    enabled when phy_disconnect() is called. phy_disconnect() sets
    adjust_link to NULL. When an interrupt occurs, the ISR might
    call phy_mac_interrupt(), which wakes up the workqueue function
    phy_state_machine(). This function might reference adjust_link,
    thereby causing a null pointer exception.

    Signed-off-by: Timur Tabi
    Signed-off-by: David S. Miller

    Timur Tabi
     
  • PCI devices that are 64-bit DMA capable should set the coherent
    DMA mask as well as the streaming DMA mask. On some architectures,
    these are managed separately, and so the coherent DMA mask will be
    left at its default value of 32 if it is not set explicitly. This
    results in errors such as

    r8169 Gigabit Ethernet driver 2.3LK-NAPI loaded
    hwdev DMA mask = 0x00000000ffffffff, dev_addr = 0x00000080fbfff000
    swiotlb: coherent allocation failed for device 0000:02:00.0 size=4096
    CPU: 0 PID: 1062 Comm: systemd-udevd Not tainted 4.8.0+ #35
    Hardware name: AMD Seattle/Seattle, BIOS 10:53:24 Oct 13 2016

    on systems without memory that is 32-bit addressable by PCI devices.

    Signed-off-by: Ard Biesheuvel
    Acked-by: Francois Romieu
    Signed-off-by: David S. Miller

    Ard Biesheuvel
     

15 Oct, 2016

3 commits

  • …m/linux/kernel/git/kvalo/wireless-drivers

    Kalle Valo says:

    ====================
    wireless-drivers fixes for 4.9

    wlcore

    * fix a double free regression causing hard to track crashes

    rtl8xxxu

    * fix driver reload issues, a memory leak and an endian bug

    rtlwifi

    * fix a major regression introduced in 4.9 with firmware loading on
    certain hardware

    ath10k

    * fix regression about broken cal_data debugfs file (since 4.7)

    ath9k

    * revert temperature compensation for AR9003+ devices, it was causing
    too much problems

    ath6kl

    * add Dell OEM SDIO I/O for the Venue 8 Pro
    ====================

    Signed-off-by: David S. Miller <davem@davemloft.net>

    David S. Miller
     
  • Check answers from USB stack and avoid re-sending the request
    multiple times if the device does not respond.

    This fixes the following problem, observed with a probably flaky adapter.

    [62108.732707] usb 1-3: new high-speed USB device number 5 using xhci_hcd
    [62108.914421] usb 1-3: New USB device found, idVendor=0b95, idProduct=7720
    [62108.914463] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
    [62108.914476] usb 1-3: Product: AX88x72A
    [62108.914486] usb 1-3: Manufacturer: ASIX Elec. Corp.
    [62108.914495] usb 1-3: SerialNumber: 000001
    [62114.109109] asix 1-3:1.0 (unnamed net_device) (uninitialized):
    Failed to write reg index 0x0000: -110
    [62114.109139] asix 1-3:1.0 (unnamed net_device) (uninitialized):
    Failed to send software reset: ffffff92
    [62119.109048] asix 1-3:1.0 (unnamed net_device) (uninitialized):
    Failed to write reg index 0x0000: -110
    ...

    Since the USB timeout is 5 seconds, and the operation is retried 30 times,
    this results in

    [62278.180353] INFO: task mtpd:1725 blocked for more than 120 seconds.
    [62278.180373] Tainted: G W 3.18.0-13298-g94ace9e #1
    [62278.180383] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    ...
    [62278.180957] kworker/2:0 D 0000000000000000 0 5744 2 0x00000000
    [62278.180978] Workqueue: usb_hub_wq hub_event
    [62278.181029] ffff880177f833b8 0000000000000046 ffff88017fd00000 ffff88017b126d80
    [62278.181048] ffff880177f83fd8 ffff880065a71b60 0000000000013340 ffff880065a71b60
    [62278.181065] 0000000000000286 0000000103b1c199 0000000000001388 0000000000000002
    [62278.181081] Call Trace:
    [62278.181092] [] ? console_conditional_schedule+0x2c/0x2c
    [62278.181105] [] schedule+0x69/0x6b
    [62278.181117] [] schedule_timeout+0xe3/0x11d
    [62278.181133] [] ? trace_timer_start+0x51/0x51
    [62278.181146] [] do_wait_for_common+0x12f/0x16c
    [62278.181162] [] ? wake_up_process+0x39/0x39
    [62278.181174] [] wait_for_common+0x52/0x6d
    [62278.181187] [] wait_for_completion_timeout+0x13/0x15
    [62278.181201] [] usb_start_wait_urb+0x93/0xf1
    [62278.181214] [] usb_control_msg+0xe1/0x11d
    [62278.181230] [] usbnet_write_cmd+0x9c/0xc6 [usbnet]
    [62278.181286] [] asix_write_cmd+0x4e/0x7e [asix]
    [62278.181300] [] asix_set_sw_mii+0x25/0x4e [asix]
    [62278.181314] [] asix_mdio_read+0x51/0x109 [asix]
    ...

    Signed-off-by: Guenter Roeck
    Signed-off-by: David S. Miller

    Guenter Roeck
     
  • Sparse was complaining when we went to prototype some code
    using ethtool_cmd_speed_set and SPEED_100000, which uses
    the upper 16 bits of __u32 speed for the first time.

    CHECK
    ...
    .../uapi/linux/ethtool.h:123:28: warning:
    cast truncates bits from constant value (186a0 becomes 86a0)

    The warning is actually bogus, as no bits are really lost, but
    we can get rid of the sparse warning with this one small change.

    Reported-by: Preethi Banala
    Signed-off-by: Jesse Brandeburg
    Signed-off-by: David S. Miller

    Jesse Brandeburg
     

14 Oct, 2016

1 commit

  • In cases where the number of tx rings is not a multiple of the number of
    rx rings, the tx completion event will be handled on a different core
    from the transmit and population of the ring. Races on the ring will
    lead to a double-free of the page, and possibly other corruption.

    The rings are initialized by default with a valid multiple of rings,
    based on the number of cpus, therefore an invalid configuration requires
    ethtool to change the ring layout. For instance 'ethtool -L eth0 rx 9 tx
    8' will cause packets received on rx0, and XDP_TX'd to tx48, to be
    completed on cpu3 (48 % 9 == 3).

    Resolve this discrepancy by shifting the irq for the xdp tx queues to
    start again from 0, modulo rx_ring_num.

    Fixes: 9ecc2d86171a ("net/mlx4_en: add xdp forwarding and data write support")
    Reported-by: Jesper Dangaard Brouer
    Signed-off-by: Brenden Blanco
    Signed-off-by: David S. Miller

    Brenden Blanco