linux-toradex.git/drivers/net, branch v3.10.62

rt2x00: do not align payload on modern H/W

2014-12-06T23:05:49+00:00

commit cfd9167af14eb4ec21517a32911d460083ee3d59 upstream.

RT2800 and newer hardware require padding between header and payload if
header length is not multiple of 4.

For historical reasons we also align payload to to 4 bytes boundary, but
such alignment is not needed on modern H/W.

Patch fixes skb_under_panic problems reported from time to time:

https://bugzilla.kernel.org/show_bug.cgi?id=84911
https://bugzilla.kernel.org/show_bug.cgi?id=72471
http://marc.info/?l=linux-wireless&m=139108549530402&w=2
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1087591

Panic happened because we eat 4 bytes of skb headroom on each
(re)transmission when sending frame without the payload and the header
length not being multiple of 4 (i.e. QoS header has 26 bytes). On such
case because paylad_aling=2 is bigger than header_align=0 we increase
header_align by 4 bytes. To prevent that we could change the check to:

	if (payload_length && payload_align > header_align)
		header_align += 4;

but not aligning payload at all is more effective and alignment is not
really needed by H/W (that has been tested on OpenWrt project for few
years now).

Reported-and-tested-by: Antti S. Lankila 
Debugged-by: Antti S. Lankila 
Reported-by: Henrik Asp 
Originally-From: Helmut Schaa 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

can: dev: avoid calling kfree_skb() from interrupt context

2014-12-06T23:05:49+00:00

commit 5247a589c24022ab34e780039cc8000c48f2035e upstream.

ikfree_skb() is Called in can_free_echo_skb(), which might be called from (TX
Error) interrupt, which triggers the folloing warning:

[ 1153.360705] ------------[ cut here ]------------
[ 1153.360715] WARNING: CPU: 0 PID: 31 at net/core/skbuff.c:563 skb_release_head_state+0xb9/0xd0()
[ 1153.360772] Call Trace:
[ 1153.360778]  [] dump_stack+0x41/0x52
[ 1153.360782]  [] warn_slowpath_common+0x7e/0xa0
[ 1153.360784]  [] ? skb_release_head_state+0xb9/0xd0
[ 1153.360786]  [] ? skb_release_head_state+0xb9/0xd0
[ 1153.360788]  [] warn_slowpath_null+0x22/0x30
[ 1153.360791]  [] skb_release_head_state+0xb9/0xd0
[ 1153.360793]  [] skb_release_all+0x10/0x30
[ 1153.360795]  [] kfree_skb+0x36/0x80
[ 1153.360799]  [] ? can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360802]  [] can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360805]  [] esd_pci402_interrupt+0x34c/0x57a [esd402]
[ 1153.360809]  [] handle_irq_event_percpu+0x35/0x180
[ 1153.360811]  [] ? handle_irq_event_percpu+0xa3/0x180
[ 1153.360813]  [] handle_irq_event+0x31/0x50
[ 1153.360816]  [] handle_fasteoi_irq+0x6f/0x120
[ 1153.360818]  [] ? handle_edge_irq+0x110/0x110
[ 1153.360822]  [] handle_irq+0x71/0x90
[ 1153.360823]    [] do_IRQ+0x3c/0xd0
[ 1153.360829]  [] common_interrupt+0x2c/0x34
[ 1153.360834]  [] ? finish_task_switch+0x47/0xf0
[ 1153.360836]  [] __schedule+0x35b/0x7e0
[ 1153.360839]  [] ? console_unlock+0x2c4/0x4d0
[ 1153.360842]  [] ? n_tty_receive_buf_common+0x890/0x890
[ 1153.360845]  [] ? process_one_work+0x196/0x370
[ 1153.360847]  [] schedule+0x23/0x60
[ 1153.360849]  [] worker_thread+0x161/0x460
[ 1153.360852]  [] ? __wake_up_locked+0x1f/0x30
[ 1153.360854]  [] ? rescuer_thread+0x2f0/0x2f0
[ 1153.360856]  [] kthread+0xa1/0xc0
[ 1153.360859]  [] ret_from_kernel_thread+0x21/0x30
[ 1153.360861]  [] ? kthread_create_on_node+0x110/0x110
[ 1153.360863] ---[ end trace 5ff83639cbb74b35 ]---

This patch replaces the kfree_skb() by dev_kfree_skb_any().

Signed-off-by: Thomas Körper 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman

can: esd_usb2: fix memory leak on disconnect

2014-12-06T23:05:48+00:00

commit efbd50d2f62fc1f69a3dcd153e63ba28cc8eb27f upstream.

It seems struct esd_usb2 dev is not deallocated on disconnect. The patch adds
the missing deallocation.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Acked-by: Matthias Fuchs 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman

pptp: fix stack info leak in pptp_getname()

2014-12-06T23:05:47+00:00

[ Upstream commit a5f6fc28d6e6cc379c6839f21820e62262419584 ]

pptp_getname() only partially initializes the stack variable sa,
particularly only fills the pptp part of the sa_addr union. The code
thereby discloses 16 bytes of kernel stack memory via getsockname().

Fix this by memset(0)'ing the union before.

Cc: Dmitry Kozlov 
Signed-off-by: Mathias Krause 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

qmi_wwan: Add support for HP lt4112 LTE/HSPA+ Gobi 4G Modem

2014-12-06T23:05:47+00:00

[ Upstream commit bb2bdeb83fb125c95e47fc7eca2a3e8f868e2a74 ]

Added the USB VID/PID for the HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e)

Signed-off-by: Martin Hauke 
Acked-by: Bjørn Mork 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ieee802154: fix error handling in ieee802154fake_probe()

2014-12-06T23:05:46+00:00

[ Upstream commit 8c2dd54485ccee7fc4086611e188478584758c8d ]

In case of any failure ieee802154fake_probe() just calls unregister_netdev().
But it does not look safe to unregister netdevice before it was registered.

The patch implements straightforward resource deallocation in case of
failure in ieee802154fake_probe().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net/mlx4_en: Fix BlueFlame race

2014-11-21T17:22:55+00:00

commit 2d4b646613d6b12175b017aca18113945af1faf3 upstream.

Fix a race between BlueFlame flow and stamping in post send flow.
Example:
	SW: Build WQE 0 on the TX buffer, except the ownership bit
	SW: Set ownership for WQE 0 on the TX buffer
	SW: Ring doorbell for WQE 0
	SW: Build WQE 1 on the TX buffer, except the ownership bit
	SW: Set ownership for WQE 1 on the TX buffer
	HW: Read WQE 0 and then WQE 1, before doorbell was rung/BF was done for WQE 1
	HW: Produce CQEs for WQE 0 and WQE 1
	SW: Process the CQEs, and stamp WQE 0 and WQE 1 accordingly (on the TX buffer)
	SW: Copy WQE 1 from the TX buffer to the BF register - ALREADY STAMPED!
	HW: CQE error with index 0xFFFF  - the BF WQE's control segment is STAMPED,
		so the BF index is 0xFFFF. Error: Invalid Opcode.
As a result QP enters the error state and no traffic can be sent.

Solution:
When stamping - do not stamp last completed wqe.

Signed-off-by: Eugenia Emantayev 
Signed-off-by: Amir Vadai 
Signed-off-by: David S. Miller 
Cc: Vinson Lee 
Signed-off-by: Greg Kroah-Hartman

macvtap: Fix csum_start when VLAN tags are present

2014-11-21T17:22:53+00:00

commit 3ce9b20f1971690b8b3b620e735ec99431573b39 upstream.

When VLAN is in use in macvtap_put_user, we end up setting
csum_start to the wrong place.  The result is that the whoever
ends up doing the checksum setting will corrupt the packet instead
of writing the checksum to the expected location, usually this
means writing the checksum with an offset of -4.

This patch fixes this by adjusting csum_start when VLAN tags are
detected.

Fixes: f09e2249c4f5 ("macvtap: restore vlan header on user read")
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: David S. Miller

iwlwifi: configure the LTR

2014-11-21T17:22:53+00:00

commit 9180ac50716a097a407c6d7e7e4589754a922260 upstream.

The LTR is the handshake between the device and the root
complex about the latency allowed when the bus exits power
save. This configuration was missing and this led to high
latency in the link power up. The end user could experience
high latency in the network because of this.

Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Greg Kroah-Hartman

vio: fix reuse of vio_dring slot

2014-11-21T17:22:52+00:00

[ Upstream commit d0aedcd4f14a22e23b313f42b7e6e6ebfc0fbc31 ]

vio_dring_avail() will allow use of every dring entry, but when the last
entry is allocated then dr->prod == dr->cons which is indistinguishable from
the ring empty condition. This causes the next allocation to reuse an entry.
When this happens in sunvdc, the server side vds driver begins nack'ing the
messages and ends up resetting the ldc channel. This problem does not effect
sunvnet since it checks for < 2.

The fix here is to just never allocate the very last dring slot so that full
and empty are not the same condition. The request start path was changed to
check for the ring being full a bit earlier, and to stop the blk_queue if
there is no space left. The blk_queue will be restarted once the ring is
only half full again. The number of ring entries was increased to 512 which
matches the sunvnet and Solaris vdc drivers, and greatly reduces the
frequency of hitting the ring full condition and the associated blk_queue
stop/starting. The checks in sunvent were adjusted to account for
vio_dring_avail() returning 1 less.

Orabug: 19441666
OraBZ: 14983

Signed-off-by: Dwight Engen 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman