02 Feb, 2015

2 commits


01 Feb, 2015

1 commit

  • Pull i2c fixes from Wolfram Sang:
    "i2c driver bugfixes (s3c2410, slave-eeprom, sh_mobile), size
    regression "bugfix" (i2c slave), documentation bugfix (st).

    Also, one documentation update (da9063), so some devicetrees can now
    be verified"

    * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
    i2c: sh_mobile: terminate DMA reads properly
    i2c: Only include slave support if selected
    i2c: s3c2410: fix ABBA deadlock by keeping clock prepared
    i2c: slave-eeprom: fix boundary check when using sysfs
    i2c: st: Rename clock reference to something that exists
    DT: i2c: Add devices handled by the da9063 MFD driver

    Linus Torvalds
     

31 Jan, 2015

5 commits


30 Jan, 2015

6 commits

  • misc i915 fixes, mostly all stable material as well.

    * tag 'drm-intel-fixes-2015-01-29' of git://anongit.freedesktop.org/drm-intel:
    drm/i915: BDW Fix Halo PCI IDs marked as ULT.
    drm/i915: Fix and clean BDW PCH identification
    drm/i915: Only fence tiled region of object.
    drm/i915: fix inconsistent brightness after resume
    drm/i915: Init PPGTT before context enable

    Dave Airlie
     
  • VT switch back/forth from console to xserver (for example) has potential
    to go horribly wrong if a dynamic DP MST connector ends up in the saved
    modeset that is restored when switching back to fbcon.

    When removing a dynamic connector, don't forget to clean up the saved
    state.

    v1: original
    v2: null out set->fb if no more connectors to avoid making i915 cranky

    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1184968
    Cc: stable@vger.kernel.org #v3.17+
    Signed-off-by: Rob Clark
    Signed-off-by: Dave Airlie

    Rob Clark
     
  • Pull device mapper fixes from Mike Snitzer:
    "One stable fix for a dm-cache 3.19-rc6 regression and one stable fix
    for dm-thin:

    - fix DM cache metadata open/lookup error paths to properly use
    ERR_PTR and IS_ERR (fixes: 3.19-rc6 "stable" commit 9b1cc9f251)

    - fix DM thin-provisioning to disallow userspace from sending
    messages to the thin-pool if the pool is in READ_ONLY or FAIL mode
    since no metadata changes are allowed in these modes"

    * tag 'dm-3.19-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
    dm thin: don't allow messages to be sent to a pool target in READ_ONLY or FAIL mode
    dm cache: fix missing ERR_PTR returns and handling

    Linus Torvalds
     
  • Pull Ceph fixes from Sage Weil:
    "These paches from Ilya finally squash a race condition with layered
    images that he's been chasing for a while"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
    rbd: drop parent_ref in rbd_dev_unprobe() unconditionally
    rbd: fix rbd_dev_parent_get() when parent_overlap == 0

    Linus Torvalds
     
  • Pull final pin control fix from Linus Walleij:
    "A late pin control fix for the v3.19 series: The AT91 gpio controller
    would miss wakeup events, this single fix make it work properly"

    [ "Final"? Yeah, I'll believe that once I've actually released 3.19 ;) - Linus ]

    * tag 'pinctrl-v3.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
    pinctrl: at91: allow to have disabled gpio bank

    Linus Torvalds
     
  • The core VM already knows about VM_FAULT_SIGBUS, but cannot return a
    "you should SIGSEGV" error, because the SIGSEGV case was generally
    handled by the caller - usually the architecture fault handler.

    That results in lots of duplication - all the architecture fault
    handlers end up doing very similar "look up vma, check permissions, do
    retries etc" - but it generally works. However, there are cases where
    the VM actually wants to SIGSEGV, and applications _expect_ SIGSEGV.

    In particular, when accessing the stack guard page, libsigsegv expects a
    SIGSEGV. And it usually got one, because the stack growth is handled by
    that duplicated architecture fault handler.

    However, when the generic VM layer started propagating the error return
    from the stack expansion in commit fee7e49d4514 ("mm: propagate error
    from stack expansion even for guard page"), that now exposed the
    existing VM_FAULT_SIGBUS result to user space. And user space really
    expected SIGSEGV, not SIGBUS.

    To fix that case, we need to add a VM_FAULT_SIGSEGV, and teach all those
    duplicate architecture fault handlers about it. They all already have
    the code to handle SIGSEGV, so it's about just tying that new return
    value to the existing code, but it's all a bit annoying.

    This is the mindless minimal patch to do this. A more extensive patch
    would be to try to gather up the mostly shared fault handling logic into
    one generic helper routine, and long-term we really should do that
    cleanup.

    Just from this patch, you can generally see that most architectures just
    copied (directly or indirectly) the old x86 way of doing things, but in
    the meantime that original x86 model has been improved to hold the VM
    semaphore for shorter times etc and to handle VM_FAULT_RETRY and other
    "newer" things, so it would be a good idea to bring all those
    improvements to the generic case and teach other architectures about
    them too.

    Reported-and-tested-by: Takashi Iwai
    Tested-by: Jan Engelhardt
    Acked-by: Heiko Carstens # "s390 still compiles and boots"
    Cc: linux-arch@vger.kernel.org
    Cc: stable@vger.kernel.org
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

28 Jan, 2015

8 commits

  • You can't modify the metadata in these modes. It's better to fail these
    messages immediately than let the block-manager deny write locks on
    metadata blocks. Otherwise these failed metadata changes will trigger
    'needs_check' to get set in the metadata superblock -- requiring repair
    using the thin_check utility.

    Signed-off-by: Joe Thornber
    Signed-off-by: Mike Snitzer
    Cc: stable@vger.kernel.org

    Joe Thornber
     
  • Commit 9b1cc9f251 ("dm cache: share cache-metadata object across
    inactive and active DM tables") mistakenly ignored the use of ERR_PTR
    returns. Restore missing IS_ERR checks and ERR_PTR returns where
    appropriate.

    Reported-by: Dan Carpenter
    Signed-off-by: Joe Thornber
    Signed-off-by: Mike Snitzer
    Cc: stable@vger.kernel.org

    Joe Thornber
     
  • This effectively reverts the last hunk of 392a9dad7e77 ("rbd: detect
    when clone image is flattened").

    The problem with parent_overlap != 0 condition is that it's possible
    and completely valid to have an image with parent_overlap == 0 whose
    parent state needs to be cleaned up on unmap. The next commit, which
    drops the "clone image now standalone" logic, opens up another window
    of opportunity to hit this, but even without it

    # cat parent-ref.sh
    #!/bin/bash
    rbd create --image-format 2 --size 1 foo
    rbd snap create foo@snap
    rbd snap protect foo@snap
    rbd clone foo@snap bar
    rbd resize --allow-shrink --size 0 bar
    rbd resize --size 1 bar
    DEV=$(rbd map bar)
    rbd unmap $DEV

    leaves rbd_device/rbd_spec/etc and rbd_client along with ceph_client
    hanging around.

    My thinking behind calling rbd_dev_parent_put() unconditionally is that
    there shouldn't be any requests in flight at that point in time as we
    are deep into unmap sequence. Hence, even if rbd_dev_unparent() caused
    by flatten is delayed by in-flight requests, it will have finished by
    the time we reach rbd_dev_unprobe() caused by unmap, thus turning
    unconditional rbd_dev_parent_put() into a no-op.

    Fixes: http://tracker.ceph.com/issues/10352

    Cc: stable@vger.kernel.org # 3.11+
    Signed-off-by: Ilya Dryomov
    Reviewed-by: Josh Durgin
    Reviewed-by: Alex Elder

    Ilya Dryomov
     
  • The comment for rbd_dev_parent_get() said

    * We must get the reference before checking for the overlap to
    * coordinate properly with zeroing the parent overlap in
    * rbd_dev_v2_parent_info() when an image gets flattened. We
    * drop it again if there is no overlap.

    but the "drop it again if there is no overlap" part was missing from
    the implementation. This lead to absurd parent_ref values for images
    with parent_overlap == 0, as parent_ref was incremented for each
    img_request and virtually never decremented.

    Fix this by leveraging the fact that refresh path calls
    rbd_dev_v2_parent_info() under header_rwsem and use it for read in
    rbd_dev_parent_get(), instead of messing around with atomics. Get rid
    of barriers in rbd_dev_v2_parent_info() while at it - I don't see what
    they'd pair with now and I suspect we are in a pretty miserable
    situation as far as proper locking goes regardless.

    Cc: stable@vger.kernel.org # 3.11+
    Signed-off-by: Ilya Dryomov
    Reviewed-by: Josh Durgin
    Reviewed-by: Alex Elder

    Ilya Dryomov
     
  • Pull drm fixes from Dave Airlie:
    "This feels larger than I'd like but its for three reasons.

    a) amdkfd finalising the API more, this is a new feature introduced
    last merge window, and I'd prefer to make the tweaks to the API
    before it first gets into a stable release.

    b) radeon regression required splitting an internal API to fix
    properly, so it just changed a few more lines

    c) vmwgfx fix changes a lock from a mutex->spin lock, this is fallout
    from the new sleep checking.

    Otherwise there is just some tda998x fixes"

    * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
    drm/radeon: Remove rdev->gart.pages_addr array
    drm/radeon: Restore GART table contents after pinning it in VRAM v3
    drm/radeon: Split off gart_get_page_entry ASIC hook from set_page_entry
    drm/amdkfd: Fix bug in call to init_pipelines()
    drm/amdkfd: Fix bug in pipelines initialization
    drm/radeon: Don't increment pipe_id in kgd_init_pipeline
    drm/i2c: tda998x: set the CEC I2C address based on the slave I2C address
    drm/vmwgfx: Replace the hw mutex with a hw spinlock
    drm/amdkfd: Allow user to limit only queues per device
    drm/amdkfd: PQM handle queue creation fault
    drm: tda998x: Fix EDID read timeout on HDMI connect
    drm: tda998x: Protect the page register

    Linus Torvalds
     
  • Pull networking fixes from David Miller:

    1) Don't OOPS on socket AIO, from Christoph Hellwig.

    2) Scheduled scans should be aborted upon RFKILL, from Emmanuel
    Grumbach.

    3) Fix sleep in atomic context in kvaser_usb, from Ahmed S Darwish.

    4) Fix RCU locking across copy_to_user() in bpf code, from Alexei
    Starovoitov.

    5) Lots of crash, memory leak, short TX packet et al bug fixes in
    sh_eth from Ben Hutchings.

    6) Fix memory corruption in SCTP wrt. INIT collitions, from Daniel
    Borkmann.

    7) Fix return value logic for poll handlers in netxen, enic, and bnx2x.
    From Eric Dumazet and Govindarajulu Varadarajan.

    8) Header length calculation fix in mac80211 from Fred Chou.

    9) mv643xx_eth doesn't handle highmem correctly in non-TSO code paths.
    From Ezequiel Garcia.

    10) udp_diag has bogus logic in it's hash chain skipping, copy same fix
    tcp diag used. From Herbert Xu.

    11) amd-xgbe programs wrong rx flow control register, from Thomas
    Lendacky.

    12) Fix race leading to use after free in ping receive path, from Subash
    Abhinov Kasiviswanathan.

    13) Cache redirect routes otherwise we can get a heavy backlog of rcu
    jobs liberating DST_NOCACHE entries. From Hannes Frederic Sowa.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (48 commits)
    net: don't OOPS on socket aio
    stmmac: prevent probe drivers to crash kernel
    bnx2x: fix napi poll return value for repoll
    ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too
    sh_eth: Fix DMA-API usage for RX buffers
    sh_eth: Check for DMA mapping errors on transmit
    sh_eth: Ensure DMA engines are stopped before freeing buffers
    sh_eth: Remove RX overflow log messages
    ping: Fix race in free in receive path
    udp_diag: Fix socket skipping within chain
    can: kvaser_usb: Fix state handling upon BUS_ERROR events
    can: kvaser_usb: Retry the first bulk transfer on -ETIMEDOUT
    can: kvaser_usb: Send correct context to URB completion
    can: kvaser_usb: Do not sleep in atomic context
    ipv4: try to cache dst_entries which would cause a redirect
    samples: bpf: relax test_maps check
    bpf: rcu lock must not be held when calling copy_to_user()
    net: sctp: fix slab corruption from use after free on INIT collisions
    net: mv643xx_eth: Fix highmem support in non-TSO egress path
    sh_eth: Fix serialisation of interrupt disable with interrupt & NAPI handlers
    ...

    Linus Torvalds
     
  • In the case when alloc_netdev fails we return NULL to a caller. But there is no
    check for NULL in the probe drivers. This patch changes NULL to an error
    pointer. The function description is amended to reflect what we may get
    returned.

    Signed-off-by: Andy Shevchenko
    Signed-off-by: David S. Miller

    Andy Shevchenko
     
  • Pull one more module fix from Rusty Russell:
    "SCSI was using module_refcount() to figure out when the module was
    unloading: this broke with new atomic refcounting. The code is still
    suspicious, but this solves the WARN_ON()"

    * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
    scsi: always increment reference count

    Linus Torvalds
     

27 Jan, 2015

18 commits

  • With the commit d75b1ade567ffab ("net: less interrupt masking in NAPI") napi
    repoll is done only when work_done == budget. When in busy_poll is we return 0
    in napi_poll. We should return budget.

    Signed-off-by: Govindarajulu Varadarajan
    Acked-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Govindarajulu Varadarajan
     
  • - Use the return value of dma_map_single(), rather than calling
    virt_to_page() separately
    - Check for mapping failue
    - Call dma_unmap_single() rather than dma_sync_single_for_cpu()

    Signed-off-by: Ben Hutchings
    Signed-off-by: David S. Miller

    Ben Hutchings
     
  • dma_map_single() may fail if an IOMMU or swiotlb is in use, so
    we need to check for this.

    Signed-off-by: Ben Hutchings
    Signed-off-by: David S. Miller

    Ben Hutchings
     
  • Currently we try to clear EDRRR and EDTRR and immediately continue to
    free buffers. This is unsafe because:

    - In general, register writes are not serialised with DMA, so we still
    have to wait for DMA to complete somehow
    - The R8A7790 (R-Car H2) manual states that the TX running flag cannot
    be cleared by writing to EDTRR
    - The same manual states that clearing the RX running flag only stops
    RX DMA at the next packet boundary

    I applied this patch to the driver to detect DMA writes to freed
    buffers:

    > --- a/drivers/net/ethernet/renesas/sh_eth.c
    > +++ b/drivers/net/ethernet/renesas/sh_eth.c
    > @@ -1098,7 +1098,14 @@ static void sh_eth_ring_free(struct net_device *ndev)
    > /* Free Rx skb ringbuffer */
    > if (mdp->rx_skbuff) {
    > for (i = 0; i < mdp->num_rx_ring; i++)
    > + memcpy(mdp->rx_skbuff[i]->data,
    > + "Hello, world", 12);
    > + msleep(100);
    > + for (i = 0; i < mdp->num_rx_ring; i++) {
    > + WARN_ON(memcmp(mdp->rx_skbuff[i]->data,
    > + "Hello, world", 12));
    > dev_kfree_skb(mdp->rx_skbuff[i]);
    > + }
    > }
    > kfree(mdp->rx_skbuff);
    > mdp->rx_skbuff = NULL;

    then ran the loop:

    while ethtool -G eth0 rx 128 ; ethtool -G eth0 rx 64; do echo -n .; done

    and 'ping -f' toward the sh_eth port from another machine. The
    warning fired several times a minute.

    To fix these issues:

    - Deactivate all TX descriptors rather than writing to EDTRR
    - As there seems to be no way of telling when RX DMA is stopped,
    perform a soft reset to ensure that both DMA enginess are stopped
    - To reduce the possibility of the reset truncating a transmitted
    frame, disable egress and wait a reasonable time to reach a
    packet boundary before resetting
    - Update statistics before resetting

    (The 'reasonable time' does not allow for CS/CD in half-duplex
    mode, but half-duplex no longer seems reasonable!)

    Signed-off-by: Ben Hutchings
    Signed-off-by: David S. Miller

    Ben Hutchings
     
  • If RX traffic is overflowing the FIFO or DMA ring, logging every time
    this happens just makes things worse. These errors are visible in the
    statistics anyway.

    Signed-off-by: Ben Hutchings
    Signed-off-by: David S. Miller

    Ben Hutchings
     
  • While being in an ERROR_WARNING state, and receiving further
    bus error events with error counters still in the ERROR_WARNING
    range of 97-127 inclusive, the state handling code erroneously
    reverts back to ERROR_ACTIVE.

    Per the CAN standard, only revert to ERROR_ACTIVE when the
    error counters are less than 96.

    Moreover, in certain Kvaser models, the BUS_ERROR flag is
    always set along with undefined bits in the M16C status
    register. Thus use bitwise operators instead of full equality
    for checking that register against bus errors.

    Signed-off-by: Ahmed S. Darwish
    Cc: linux-stable
    Signed-off-by: Marc Kleine-Budde

    Ahmed S. Darwish
     
  • On some x86 laptops, plugging a Kvaser device again after an
    unplug makes the firmware always ignore the very first command.
    For such a case, provide some room for retries instead of
    completely exiting the driver init code.

    Signed-off-by: Ahmed S. Darwish
    Cc: linux-stable
    Signed-off-by: Marc Kleine-Budde

    Ahmed S. Darwish
     
  • Send expected argument to the URB completion hander: a CAN
    netdevice instead of the network interface private context
    `kvaser_usb_net_priv'.

    This was discovered by having some garbage in the kernel
    log in place of the netdevice names: can0 and can1.

    Signed-off-by: Ahmed S. Darwish
    Cc: linux-stable
    Signed-off-by: Marc Kleine-Budde

    Ahmed S. Darwish
     
  • Upon receiving a hardware event with the BUS_RESET flag set,
    the driver kills all of its anchored URBs and resets all of
    its transmit URB contexts.

    Unfortunately it does so under the context of URB completion
    handler `kvaser_usb_read_bulk_callback()', which is often
    called in an atomic context.

    While the device is flooded with many received error packets,
    usb_kill_urb() typically sleeps/reschedules till the transfer
    request of each killed URB in question completes, leading to
    the sleep in atomic bug. [3]

    In v2 submission of the original driver patch [1], it was
    stated that the URBs kill and tx contexts reset was needed
    since we don't receive any tx acknowledgments later and thus
    such resources will be locked down forever. Fortunately this
    is no longer needed since an earlier bugfix in this patch
    series is now applied: all tx URB contexts are reset upon CAN
    channel close. [2]

    Moreover, a BUS_RESET is now treated _exactly_ like a BUS_OFF
    event, which is the recommended handling method advised by
    the device manufacturer.

    [1] http://article.gmane.org/gmane.linux.network/239442
    http://www.webcitation.org/6Vr2yagAQ

    [2] can: kvaser_usb: Reset all URB tx contexts upon channel close
    889b77f7fd2bcc922493d73a4c51d8a851505815

    [3] Stacktrace:

    [] dump_stack+0x45/0x57
    [] __schedule_bug+0x41/0x4f
    [] __schedule+0x5f1/0x700
    [] ? _raw_spin_unlock_irqrestore+0xa/0x10
    [] schedule+0x24/0x70
    [] usb_kill_urb+0x65/0xa0
    [] ? prepare_to_wait_event+0x110/0x110
    [] usb_kill_anchored_urbs+0x48/0x80
    [] kvaser_usb_unlink_tx_urbs+0x18/0x50 [kvaser_usb]
    [] kvaser_usb_rx_error+0xc0/0x400 [kvaser_usb]
    [] ? vprintk_default+0x1a/0x20
    [] kvaser_usb_read_bulk_callback+0x4c1/0x5f0 [kvaser_usb]
    [] __usb_hcd_giveback_urb+0x5e/0xc0
    [] usb_hcd_giveback_urb+0x41/0x110
    [] finish_urb+0x98/0x180 [ohci_hcd]
    [] ? acct_account_cputime+0x17/0x20
    [] ? local_clock+0x15/0x30
    [] ohci_work+0x1fb/0x5a0 [ohci_hcd]
    [] ? process_backlog+0xb1/0x130
    [] ohci_irq+0xeb/0x270 [ohci_hcd]
    [] usb_hcd_irq+0x21/0x30
    [] handle_irq_event_percpu+0x43/0x120
    [] handle_irq_event+0x3d/0x60
    [] handle_fasteoi_irq+0x74/0x110
    [] handle_irq+0x1d/0x30
    [] do_IRQ+0x57/0x100
    [] common_interrupt+0x6a/0x6a

    Signed-off-by: Ahmed S. Darwish
    Cc: linux-stable
    Signed-off-by: Marc Kleine-Budde

    Ahmed S. Darwish
     
  • …/balbi/usb into usb-linus

    Felipe writes:

    usb: fixes for v3.19-rc6

    Just two fixes pending. A fix USB PHY for non-OF case and
    a fix for dwc2 running on samsung SoC.

    Signed-off-by: Felipe Balbi <balbi@ti.com>

    Greg Kroah-Hartman
     
  • Merge misc fixes from Andrew Morton:
    "Six fixes"

    * emailed patches from Andrew Morton :
    drivers/rtc/rtc-s5m.c: terminate s5m_rtc_id array with empty element
    printk: add dummy routine for when CONFIG_PRINTK=n
    mm/vmscan: fix highidx argument type
    memcg: remove extra newlines from memcg oom kill log
    x86, build: replace Perl script with Shell script
    mm: page_alloc: embed OOM killing naturally into allocation slowpath

    Linus Torvalds
     
  • Commit 69ad0dd7af22b61d9e0e68e56b6290121618b0fb
    Author: Ezequiel Garcia
    Date: Mon May 19 13:59:59 2014 -0300

    net: mv643xx_eth: Use dma_map_single() to map the skb fragments

    caused a nasty regression by removing the support for highmem skb
    fragments. By using page_address() to get the address of a fragment's
    page, we are assuming a lowmem page. However, such assumption is incorrect,
    as fragments can be in highmem pages, resulting in very nasty issues.

    This commit fixes this by using the skb_frag_dma_map() helper,
    which takes care of mapping the skb fragment properly. Additionally,
    the type of mapping is now tracked, so it can be unmapped using
    dma_unmap_page or dma_unmap_single when appropriate.

    This commit also fixes the error path in txq_init() to release the
    resources properly.

    Fixes: 69ad0dd7af22 ("net: mv643xx_eth: Use dma_map_single() to map the skb fragments")
    Reported-by: Russell King
    Signed-off-by: Ezequiel Garcia
    Signed-off-by: David S. Miller

    Ezequiel Garcia
     
  • In order to stop the RX path accessing the RX ring while it's being
    stopped or resized, we clear the interrupt mask (EESIPR) and then call
    free_irq() or synchronise_irq(). This is insufficient because the
    interrupt handler or NAPI poller may set EESIPR again after we clear
    it. Also, in sh_eth_set_ringparam() we currently don't disable NAPI
    polling at all.

    I could easily trigger a crash by running the loop:

    while ethtool -G eth0 rx 128 && ethtool -G eth0 rx 64; do echo -n .; done

    and 'ping -f' toward the sh_eth port from another machine.

    To fix this:
    - Add a software flag (irq_enabled) to signal whether interrupts
    should be enabled
    - In the interrupt handler, if the flag is clear then clear EESIPR
    and return
    - In the NAPI poller, if the flag is clear then don't set EESIPR
    - Set the flag before enabling interrupts in sh_eth_dev_init() and
    sh_eth_set_ringparam()
    - Clear the flag and serialise with the interrupt and NAPI
    handlers before clearing EESIPR in sh_eth_close() and
    sh_eth_set_ringparam()

    After this, I could run the loop for 100,000 iterations successfully.

    Signed-off-by: Ben Hutchings
    Signed-off-by: David S. Miller

    Ben Hutchings
     
  • If the device is down then no packet buffers should be allocated.
    We also must not touch its registers as it may be powered off.

    Signed-off-by: Ben Hutchings
    Signed-off-by: David S. Miller

    Ben Hutchings
     
  • We must only ever stop TX queues when they are full or the net device
    is not 'ready' so far as the net core, and specifically the watchdog,
    is concerned. Otherwise, the watchdog may fire *immediately* if no
    packets have been added to the queue in the last 5 seconds.

    What's more, sh_eth_tx_timeout() will likely crash if called while
    we're resizing the TX ring.

    I could easily trigger this by running the loop:

    while ethtool -G eth0 rx 128 && ethtool -G eth0 rx 64; do echo -n .; done

    Signed-off-by: Ben Hutchings
    Signed-off-by: David S. Miller

    Ben Hutchings
     
  • If an skb to be transmitted is shorter than the minimum Ethernet frame
    length, we currently set the DMA descriptor length to the minimum but
    do not add zero-padding. This could result in leaking sensitive
    data. We also pass different lengths to dma_map_single() and
    dma_unmap_single().

    Use skb_padto() to pad properly, before calling dma_map_single().

    Signed-off-by: Ben Hutchings
    Signed-off-by: David S. Miller

    Ben Hutchings
     
  • In Dual EMAC, the default VLANs are used to segregate Rx packets between
    the ports, so adding the same default VLAN to the switch will affect the
    normal packet transfers. So returning error on addition of dual EMAC
    default VLANs.

    Even if EMAC 0 default port VLAN is added to EMAC 1, it will lead to
    break dual EMAC port separations.

    Fixes: d9ba8f9e6298 (driver: net: ethernet: cpsw: dual emac interface implementation)
    Cc: # v3.9+
    Reported-by: Felipe Balbi
    Signed-off-by: Mugunthan V N
    Signed-off-by: David S. Miller

    Mugunthan V N
     
  • Suspend/resume regression fix for 3.19.

    * 'drm-fixes-3.19' of git://people.freedesktop.org/~agd5f/linux:
    drm/radeon: Remove rdev->gart.pages_addr array
    drm/radeon: Restore GART table contents after pinning it in VRAM v3
    drm/radeon: Split off gart_get_page_entry ASIC hook from set_page_entry

    Dave Airlie