<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/net, branch v3.2.68</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>enic: fix rx skb checksum</title>
<updated>2015-02-20T00:49:41+00:00</updated>
<author>
<name>Govindarajulu Varadarajan</name>
<email>_govind@gmx.com</email>
</author>
<published>2014-12-18T10:28:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=58aa2f36823a7db2ae0962d47ce36823cd02d035'/>
<id>58aa2f36823a7db2ae0962d47ce36823cd02d035</id>
<content type='text'>
[ Upstream commit 17e96834fd35997ca7cdfbf15413bcd5a36ad448 ]

Hardware always provides compliment of IP pseudo checksum. Stack expects
whole packet checksum without pseudo checksum if CHECKSUM_COMPLETE is set.

This causes checksum error in nf &amp; ovs.

kernel: qg-19546f09-f2: hw csum failure
kernel: CPU: 9 PID: 0 Comm: swapper/9 Tainted: GF          O--------------   3.10.0-123.8.1.el7.x86_64 #1
kernel: Hardware name: Cisco Systems Inc UCSB-B200-M3/UCSB-B200-M3, BIOS B200M3.2.2.3.0.080820141339 08/08/2014
kernel: ffff881218f40000 df68243feb35e3a8 ffff881237a43ab8 ffffffff815e237b
kernel: ffff881237a43ad0 ffffffff814cd4ca ffff8829ec71eb00 ffff881237a43af0
kernel: ffffffff814c6232 0000000000000286 ffff8829ec71eb00 ffff881237a43b00
kernel: Call Trace:
kernel: &lt;IRQ&gt;  [&lt;ffffffff815e237b&gt;] dump_stack+0x19/0x1b
kernel: [&lt;ffffffff814cd4ca&gt;] netdev_rx_csum_fault+0x3a/0x40
kernel: [&lt;ffffffff814c6232&gt;] __skb_checksum_complete_head+0x62/0x70
kernel: [&lt;ffffffff814c6251&gt;] __skb_checksum_complete+0x11/0x20
kernel: [&lt;ffffffff8155a20c&gt;] nf_ip_checksum+0xcc/0x100
kernel: [&lt;ffffffffa049edc7&gt;] icmp_error+0x1f7/0x35c [nf_conntrack_ipv4]
kernel: [&lt;ffffffff814cf419&gt;] ? netif_rx+0xb9/0x1d0
kernel: [&lt;ffffffffa040eb7b&gt;] ? internal_dev_recv+0xdb/0x130 [openvswitch]
kernel: [&lt;ffffffffa04c8330&gt;] nf_conntrack_in+0xf0/0xa80 [nf_conntrack]
kernel: [&lt;ffffffff81509380&gt;] ? inet_del_offload+0x40/0x40
kernel: [&lt;ffffffffa049e302&gt;] ipv4_conntrack_in+0x22/0x30 [nf_conntrack_ipv4]
kernel: [&lt;ffffffff815005ca&gt;] nf_iterate+0xaa/0xc0
kernel: [&lt;ffffffff81509380&gt;] ? inet_del_offload+0x40/0x40
kernel: [&lt;ffffffff81500664&gt;] nf_hook_slow+0x84/0x140
kernel: [&lt;ffffffff81509380&gt;] ? inet_del_offload+0x40/0x40
kernel: [&lt;ffffffff81509dd4&gt;] ip_rcv+0x344/0x380

Hardware verifies IP &amp; tcp/udp header checksum but does not provide payload
checksum, use CHECKSUM_UNNECESSARY. Set it only if its valid IP tcp/udp packet.

Cc: Jiri Benc &lt;jbenc@redhat.com&gt;
Cc: Stefan Assmann &lt;sassmann@redhat.com&gt;
Reported-by: Sunil Choudhary &lt;schoudha@redhat.com&gt;
Signed-off-by: Govindarajulu Varadarajan &lt;_govind@gmx.com&gt;
Reviewed-by: Jiri Benc &lt;jbenc@redhat.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 17e96834fd35997ca7cdfbf15413bcd5a36ad448 ]

Hardware always provides compliment of IP pseudo checksum. Stack expects
whole packet checksum without pseudo checksum if CHECKSUM_COMPLETE is set.

This causes checksum error in nf &amp; ovs.

kernel: qg-19546f09-f2: hw csum failure
kernel: CPU: 9 PID: 0 Comm: swapper/9 Tainted: GF          O--------------   3.10.0-123.8.1.el7.x86_64 #1
kernel: Hardware name: Cisco Systems Inc UCSB-B200-M3/UCSB-B200-M3, BIOS B200M3.2.2.3.0.080820141339 08/08/2014
kernel: ffff881218f40000 df68243feb35e3a8 ffff881237a43ab8 ffffffff815e237b
kernel: ffff881237a43ad0 ffffffff814cd4ca ffff8829ec71eb00 ffff881237a43af0
kernel: ffffffff814c6232 0000000000000286 ffff8829ec71eb00 ffff881237a43b00
kernel: Call Trace:
kernel: &lt;IRQ&gt;  [&lt;ffffffff815e237b&gt;] dump_stack+0x19/0x1b
kernel: [&lt;ffffffff814cd4ca&gt;] netdev_rx_csum_fault+0x3a/0x40
kernel: [&lt;ffffffff814c6232&gt;] __skb_checksum_complete_head+0x62/0x70
kernel: [&lt;ffffffff814c6251&gt;] __skb_checksum_complete+0x11/0x20
kernel: [&lt;ffffffff8155a20c&gt;] nf_ip_checksum+0xcc/0x100
kernel: [&lt;ffffffffa049edc7&gt;] icmp_error+0x1f7/0x35c [nf_conntrack_ipv4]
kernel: [&lt;ffffffff814cf419&gt;] ? netif_rx+0xb9/0x1d0
kernel: [&lt;ffffffffa040eb7b&gt;] ? internal_dev_recv+0xdb/0x130 [openvswitch]
kernel: [&lt;ffffffffa04c8330&gt;] nf_conntrack_in+0xf0/0xa80 [nf_conntrack]
kernel: [&lt;ffffffff81509380&gt;] ? inet_del_offload+0x40/0x40
kernel: [&lt;ffffffffa049e302&gt;] ipv4_conntrack_in+0x22/0x30 [nf_conntrack_ipv4]
kernel: [&lt;ffffffff815005ca&gt;] nf_iterate+0xaa/0xc0
kernel: [&lt;ffffffff81509380&gt;] ? inet_del_offload+0x40/0x40
kernel: [&lt;ffffffff81500664&gt;] nf_hook_slow+0x84/0x140
kernel: [&lt;ffffffff81509380&gt;] ? inet_del_offload+0x40/0x40
kernel: [&lt;ffffffff81509dd4&gt;] ip_rcv+0x344/0x380

Hardware verifies IP &amp; tcp/udp header checksum but does not provide payload
checksum, use CHECKSUM_UNNECESSARY. Set it only if its valid IP tcp/udp packet.

Cc: Jiri Benc &lt;jbenc@redhat.com&gt;
Cc: Stefan Assmann &lt;sassmann@redhat.com&gt;
Reported-by: Sunil Choudhary &lt;schoudha@redhat.com&gt;
Signed-off-by: Govindarajulu Varadarajan &lt;_govind@gmx.com&gt;
Reviewed-by: Jiri Benc &lt;jbenc@redhat.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>tg3: tg3_disable_ints using uninitialized mailbox value to disable interrupts</title>
<updated>2015-02-20T00:49:41+00:00</updated>
<author>
<name>Prashant Sreedharan</name>
<email>prashant@broadcom.com</email>
</author>
<published>2014-12-20T20:16:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1da9db7a92d9bde36e4d1e3ac02eece72d078993'/>
<id>1da9db7a92d9bde36e4d1e3ac02eece72d078993</id>
<content type='text'>
[ Upstream commit 05b0aa579397b734f127af58e401a30784a1e315 ]

During driver load in tg3_init_one, if the driver detects DMA activity before
intializing the chip tg3_halt is called. As part of tg3_halt interrupts are
disabled using routine tg3_disable_ints. This routine was using mailbox value
which was not initialized (default value is 0). As a result driver was writing
0x00000001 to pci config space register 0, which is the vendor id / device id.

This driver bug was exposed because of the commit a7877b17a667 (PCI: Check only
the Vendor ID to identify Configuration Request Retry). Also this issue is only
seen in older generation chipsets like 5722 because config space write to offset
0 from driver is possible. The newer generation chips ignore writes to offset 0.
Also without commit a7877b17a667, for these older chips when a GRC reset is
issued the Bootcode would reprogram the vendor id/device id, which is the reason
this bug was masked earlier.

Fixed by initializing the interrupt mailbox registers before calling tg3_halt.

Please queue for -stable.

Reported-by: Nils Holland &lt;nholland@tisys.org&gt;
Reported-by: Marcelo Ricardo Leitner &lt;marcelo.leitner@gmail.com&gt;
Signed-off-by: Prashant Sreedharan &lt;prashant@broadcom.com&gt;
Signed-off-by: Michael Chan &lt;mchan@broadcom.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 05b0aa579397b734f127af58e401a30784a1e315 ]

During driver load in tg3_init_one, if the driver detects DMA activity before
intializing the chip tg3_halt is called. As part of tg3_halt interrupts are
disabled using routine tg3_disable_ints. This routine was using mailbox value
which was not initialized (default value is 0). As a result driver was writing
0x00000001 to pci config space register 0, which is the vendor id / device id.

This driver bug was exposed because of the commit a7877b17a667 (PCI: Check only
the Vendor ID to identify Configuration Request Retry). Also this issue is only
seen in older generation chipsets like 5722 because config space write to offset
0 from driver is possible. The newer generation chips ignore writes to offset 0.
Also without commit a7877b17a667, for these older chips when a GRC reset is
issued the Bootcode would reprogram the vendor id/device id, which is the reason
this bug was masked earlier.

Fixed by initializing the interrupt mailbox registers before calling tg3_halt.

Please queue for -stable.

Reported-by: Nils Holland &lt;nholland@tisys.org&gt;
Reported-by: Marcelo Ricardo Leitner &lt;marcelo.leitner@gmail.com&gt;
Signed-off-by: Prashant Sreedharan &lt;prashant@broadcom.com&gt;
Signed-off-by: Michael Chan &lt;mchan@broadcom.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>can: dev: fix crtlmode_supported check</title>
<updated>2015-02-20T00:49:37+00:00</updated>
<author>
<name>Oliver Hartkopp</name>
<email>socketcan@hartkopp.net</email>
</author>
<published>2015-01-05T17:40:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0d189b4451f424bdb4296a0c791b9cd731bc317e'/>
<id>0d189b4451f424bdb4296a0c791b9cd731bc317e</id>
<content type='text'>
commit 9b1087aa5e86448fe6ad40a58964e35f3ba423d5 upstream.

When changing flags in the CAN drivers ctrlmode the provided new content has to
be checked whether the bits are allowed to be changed. The bits that are to be
changed are given as a bitfield in cm-&gt;mask. Therefore checking against
cm-&gt;flags is wrong as the content can hold any kind of values.

The iproute2 tool sets the bits in cm-&gt;mask and cm-&gt;flags depending on the
detected command line options. To be robust against bogus user space
applications additionally sanitize the provided flags with the provided mask.

Cc: Wolfgang Grandegger &lt;wg@grandegger.com&gt;
Signed-off-by: Oliver Hartkopp &lt;socketcan@hartkopp.net&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 9b1087aa5e86448fe6ad40a58964e35f3ba423d5 upstream.

When changing flags in the CAN drivers ctrlmode the provided new content has to
be checked whether the bits are allowed to be changed. The bits that are to be
changed are given as a bitfield in cm-&gt;mask. Therefore checking against
cm-&gt;flags is wrong as the content can hold any kind of values.

The iproute2 tool sets the bits in cm-&gt;mask and cm-&gt;flags depending on the
detected command line options. To be robust against bogus user space
applications additionally sanitize the provided flags with the provided mask.

Cc: Wolfgang Grandegger &lt;wg@grandegger.com&gt;
Signed-off-by: Oliver Hartkopp &lt;socketcan@hartkopp.net&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ath5k: fix hardware queue index assignment</title>
<updated>2015-02-20T00:49:29+00:00</updated>
<author>
<name>Felix Fietkau</name>
<email>nbd@openwrt.org</email>
</author>
<published>2014-11-30T20:52:57+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=5ba19ff071cd79972df3e02d3c6ae17460eb7317'/>
<id>5ba19ff071cd79972df3e02d3c6ae17460eb7317</id>
<content type='text'>
commit 9e4982f6a51a2442f1bb588fee42521b44b4531c upstream.

Like with ath9k, ath5k queues also need to be ordered by priority.
queue_info-&gt;tqi_subtype already contains the correct index, so use it
instead of relying on the order of ath5k_hw_setup_tx_queue calls.

Signed-off-by: Felix Fietkau &lt;nbd@openwrt.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 9e4982f6a51a2442f1bb588fee42521b44b4531c upstream.

Like with ath9k, ath5k queues also need to be ordered by priority.
queue_info-&gt;tqi_subtype already contains the correct index, so use it
instead of relying on the order of ath5k_hw_setup_tx_queue calls.

Signed-off-by: Felix Fietkau &lt;nbd@openwrt.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ath9k: fix BE/BK queue order</title>
<updated>2015-02-20T00:49:28+00:00</updated>
<author>
<name>Felix Fietkau</name>
<email>nbd@openwrt.org</email>
</author>
<published>2014-11-30T19:38:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=e002a8ffe3cc016aa809c1b6134b0e154841710d'/>
<id>e002a8ffe3cc016aa809c1b6134b0e154841710d</id>
<content type='text'>
commit 78063d81d353e10cbdd279c490593113b8fdae1c upstream.

Hardware queues are ordered by priority. Use queue index 0 for BK, which
has lower priority than BE.

Signed-off-by: Felix Fietkau &lt;nbd@openwrt.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 78063d81d353e10cbdd279c490593113b8fdae1c upstream.

Hardware queues are ordered by priority. Use queue index 0 for BK, which
has lower priority than BE.

Signed-off-by: Felix Fietkau &lt;nbd@openwrt.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ath9k_hw: fix hardware queue allocation</title>
<updated>2015-02-20T00:49:28+00:00</updated>
<author>
<name>Felix Fietkau</name>
<email>nbd@openwrt.org</email>
</author>
<published>2014-11-30T19:38:40+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=6e33b48166ea43b23daf9f80b944d29118c8d70c'/>
<id>6e33b48166ea43b23daf9f80b944d29118c8d70c</id>
<content type='text'>
commit ad8fdccf9c197a89e2d2fa78c453283dcc2c343f upstream.

The driver passes the desired hardware queue index for a WMM data queue
in qinfo-&gt;tqi_subtype. This was ignored in ath9k_hw_setuptxqueue, which
instead relied on the order in which the function is called.

Reported-by: Hubert Feurstein &lt;h.feurstein@gmail.com&gt;
Signed-off-by: Felix Fietkau &lt;nbd@openwrt.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit ad8fdccf9c197a89e2d2fa78c453283dcc2c343f upstream.

The driver passes the desired hardware queue index for a WMM data queue
in qinfo-&gt;tqi_subtype. This was ignored in ath9k_hw_setuptxqueue, which
instead relied on the order in which the function is called.

Reported-by: Hubert Feurstein &lt;h.feurstein@gmail.com&gt;
Signed-off-by: Felix Fietkau &lt;nbd@openwrt.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drivers/net: macvtap and tun depend on INET</title>
<updated>2015-01-01T01:27:52+00:00</updated>
<author>
<name>Ben Hutchings</name>
<email>ben@decadent.org.uk</email>
</author>
<published>2014-10-31T03:10:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ab25611227cffac1b1bc8e115e0719158ac8568c'/>
<id>ab25611227cffac1b1bc8e115e0719158ac8568c</id>
<content type='text'>
commit de11b0e8c569b96c2cf6a811e3805b7aeef498a3 upstream.

These drivers now call ipv6_proxy_select_ident(), which is defined
only if CONFIG_INET is enabled.  However, they have really depended
on CONFIG_INET for as long as they have allowed sending GSO packets
from userland.

Reported-by: kbuild test robot &lt;fengguang.wu@intel.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
Fixes: f43798c27684 ("tun: Allow GSO using virtio_net_hdr")
Fixes: b9fb9ee07e67 ("macvtap: add GSO/csum offload support")
Fixes: 5188cd44c55d ("drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets")
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit de11b0e8c569b96c2cf6a811e3805b7aeef498a3 upstream.

These drivers now call ipv6_proxy_select_ident(), which is defined
only if CONFIG_INET is enabled.  However, they have really depended
on CONFIG_INET for as long as they have allowed sending GSO packets
from userland.

Reported-by: kbuild test robot &lt;fengguang.wu@intel.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
Fixes: f43798c27684 ("tun: Allow GSO using virtio_net_hdr")
Fixes: b9fb9ee07e67 ("macvtap: add GSO/csum offload support")
Fixes: 5188cd44c55d ("drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets")
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets</title>
<updated>2015-01-01T01:27:51+00:00</updated>
<author>
<name>Ben Hutchings</name>
<email>ben@decadent.org.uk</email>
</author>
<published>2014-10-30T18:27:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=540aa5b743b3ba2c7651f3e311a0fc8d4865534e'/>
<id>540aa5b743b3ba2c7651f3e311a0fc8d4865534e</id>
<content type='text'>
commit 5188cd44c55db3e92cd9e77a40b5baa7ed4340f7 upstream.

UFO is now disabled on all drivers that work with virtio net headers,
but userland may try to send UFO/IPv6 packets anyway.  Instead of
sending with ID=0, we should select identifiers on their behalf (as we
used to).

Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
Fixes: 916e4cf46d02 ("ipv6: reuse ip6_frag_id from ip6_ufo_append_data")
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
[bwh: For 3.2, net/ipv6/output_core.c is a completely new file]
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 5188cd44c55db3e92cd9e77a40b5baa7ed4340f7 upstream.

UFO is now disabled on all drivers that work with virtio net headers,
but userland may try to send UFO/IPv6 packets anyway.  Instead of
sending with ID=0, we should select identifiers on their behalf (as we
used to).

Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
Fixes: 916e4cf46d02 ("ipv6: reuse ip6_frag_id from ip6_ufo_append_data")
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
[bwh: For 3.2, net/ipv6/output_core.c is a completely new file]
</pre>
</div>
</content>
</entry>
<entry>
<title>can: esd_usb2: fix memory leak on disconnect</title>
<updated>2014-12-14T16:23:57+00:00</updated>
<author>
<name>Alexey Khoroshilov</name>
<email>khoroshilov@ispras.ru</email>
</author>
<published>2014-10-10T20:31:07+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=923edc8735ff7ac9e16cc4a6bbcb7b9d87e03644'/>
<id>923edc8735ff7ac9e16cc4a6bbcb7b9d87e03644</id>
<content type='text'>
commit efbd50d2f62fc1f69a3dcd153e63ba28cc8eb27f upstream.

It seems struct esd_usb2 dev is not deallocated on disconnect. The patch adds
the missing deallocation.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov &lt;khoroshilov@ispras.ru&gt;
Acked-by: Matthias Fuchs &lt;matthias.fuchs@esd.eu&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit efbd50d2f62fc1f69a3dcd153e63ba28cc8eb27f upstream.

It seems struct esd_usb2 dev is not deallocated on disconnect. The patch adds
the missing deallocation.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov &lt;khoroshilov@ispras.ru&gt;
Acked-by: Matthias Fuchs &lt;matthias.fuchs@esd.eu&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>can: dev: avoid calling kfree_skb() from interrupt context</title>
<updated>2014-12-14T16:23:57+00:00</updated>
<author>
<name>Thomas Körper</name>
<email>thomas.koerper@esd.eu</email>
</author>
<published>2014-10-31T06:33:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=42cccc215d8778b7b1658c93b7d91c6949111a0c'/>
<id>42cccc215d8778b7b1658c93b7d91c6949111a0c</id>
<content type='text'>
commit 5247a589c24022ab34e780039cc8000c48f2035e upstream.

ikfree_skb() is Called in can_free_echo_skb(), which might be called from (TX
Error) interrupt, which triggers the folloing warning:

[ 1153.360705] ------------[ cut here ]------------
[ 1153.360715] WARNING: CPU: 0 PID: 31 at net/core/skbuff.c:563 skb_release_head_state+0xb9/0xd0()
[ 1153.360772] Call Trace:
[ 1153.360778]  [&lt;c167906f&gt;] dump_stack+0x41/0x52
[ 1153.360782]  [&lt;c105bb7e&gt;] warn_slowpath_common+0x7e/0xa0
[ 1153.360784]  [&lt;c158b909&gt;] ? skb_release_head_state+0xb9/0xd0
[ 1153.360786]  [&lt;c158b909&gt;] ? skb_release_head_state+0xb9/0xd0
[ 1153.360788]  [&lt;c105bc42&gt;] warn_slowpath_null+0x22/0x30
[ 1153.360791]  [&lt;c158b909&gt;] skb_release_head_state+0xb9/0xd0
[ 1153.360793]  [&lt;c158be90&gt;] skb_release_all+0x10/0x30
[ 1153.360795]  [&lt;c158bf06&gt;] kfree_skb+0x36/0x80
[ 1153.360799]  [&lt;f8486938&gt;] ? can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360802]  [&lt;f8486938&gt;] can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360805]  [&lt;f849a12c&gt;] esd_pci402_interrupt+0x34c/0x57a [esd402]
[ 1153.360809]  [&lt;c10a75b5&gt;] handle_irq_event_percpu+0x35/0x180
[ 1153.360811]  [&lt;c10a7623&gt;] ? handle_irq_event_percpu+0xa3/0x180
[ 1153.360813]  [&lt;c10a7731&gt;] handle_irq_event+0x31/0x50
[ 1153.360816]  [&lt;c10a9c7f&gt;] handle_fasteoi_irq+0x6f/0x120
[ 1153.360818]  [&lt;c10a9c10&gt;] ? handle_edge_irq+0x110/0x110
[ 1153.360822]  [&lt;c1011b61&gt;] handle_irq+0x71/0x90
[ 1153.360823]  &lt;IRQ&gt;  [&lt;c168152c&gt;] do_IRQ+0x3c/0xd0
[ 1153.360829]  [&lt;c1680b6c&gt;] common_interrupt+0x2c/0x34
[ 1153.360834]  [&lt;c107d277&gt;] ? finish_task_switch+0x47/0xf0
[ 1153.360836]  [&lt;c167c27b&gt;] __schedule+0x35b/0x7e0
[ 1153.360839]  [&lt;c10a5334&gt;] ? console_unlock+0x2c4/0x4d0
[ 1153.360842]  [&lt;c13df500&gt;] ? n_tty_receive_buf_common+0x890/0x890
[ 1153.360845]  [&lt;c10707b6&gt;] ? process_one_work+0x196/0x370
[ 1153.360847]  [&lt;c167c723&gt;] schedule+0x23/0x60
[ 1153.360849]  [&lt;c1070de1&gt;] worker_thread+0x161/0x460
[ 1153.360852]  [&lt;c1090fcf&gt;] ? __wake_up_locked+0x1f/0x30
[ 1153.360854]  [&lt;c1070c80&gt;] ? rescuer_thread+0x2f0/0x2f0
[ 1153.360856]  [&lt;c1074f01&gt;] kthread+0xa1/0xc0
[ 1153.360859]  [&lt;c1680401&gt;] ret_from_kernel_thread+0x21/0x30
[ 1153.360861]  [&lt;c1074e60&gt;] ? kthread_create_on_node+0x110/0x110
[ 1153.360863] ---[ end trace 5ff83639cbb74b35 ]---

This patch replaces the kfree_skb() by dev_kfree_skb_any().

Signed-off-by: Thomas Körper &lt;thomas.koerper@esd.eu&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 5247a589c24022ab34e780039cc8000c48f2035e upstream.

ikfree_skb() is Called in can_free_echo_skb(), which might be called from (TX
Error) interrupt, which triggers the folloing warning:

[ 1153.360705] ------------[ cut here ]------------
[ 1153.360715] WARNING: CPU: 0 PID: 31 at net/core/skbuff.c:563 skb_release_head_state+0xb9/0xd0()
[ 1153.360772] Call Trace:
[ 1153.360778]  [&lt;c167906f&gt;] dump_stack+0x41/0x52
[ 1153.360782]  [&lt;c105bb7e&gt;] warn_slowpath_common+0x7e/0xa0
[ 1153.360784]  [&lt;c158b909&gt;] ? skb_release_head_state+0xb9/0xd0
[ 1153.360786]  [&lt;c158b909&gt;] ? skb_release_head_state+0xb9/0xd0
[ 1153.360788]  [&lt;c105bc42&gt;] warn_slowpath_null+0x22/0x30
[ 1153.360791]  [&lt;c158b909&gt;] skb_release_head_state+0xb9/0xd0
[ 1153.360793]  [&lt;c158be90&gt;] skb_release_all+0x10/0x30
[ 1153.360795]  [&lt;c158bf06&gt;] kfree_skb+0x36/0x80
[ 1153.360799]  [&lt;f8486938&gt;] ? can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360802]  [&lt;f8486938&gt;] can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360805]  [&lt;f849a12c&gt;] esd_pci402_interrupt+0x34c/0x57a [esd402]
[ 1153.360809]  [&lt;c10a75b5&gt;] handle_irq_event_percpu+0x35/0x180
[ 1153.360811]  [&lt;c10a7623&gt;] ? handle_irq_event_percpu+0xa3/0x180
[ 1153.360813]  [&lt;c10a7731&gt;] handle_irq_event+0x31/0x50
[ 1153.360816]  [&lt;c10a9c7f&gt;] handle_fasteoi_irq+0x6f/0x120
[ 1153.360818]  [&lt;c10a9c10&gt;] ? handle_edge_irq+0x110/0x110
[ 1153.360822]  [&lt;c1011b61&gt;] handle_irq+0x71/0x90
[ 1153.360823]  &lt;IRQ&gt;  [&lt;c168152c&gt;] do_IRQ+0x3c/0xd0
[ 1153.360829]  [&lt;c1680b6c&gt;] common_interrupt+0x2c/0x34
[ 1153.360834]  [&lt;c107d277&gt;] ? finish_task_switch+0x47/0xf0
[ 1153.360836]  [&lt;c167c27b&gt;] __schedule+0x35b/0x7e0
[ 1153.360839]  [&lt;c10a5334&gt;] ? console_unlock+0x2c4/0x4d0
[ 1153.360842]  [&lt;c13df500&gt;] ? n_tty_receive_buf_common+0x890/0x890
[ 1153.360845]  [&lt;c10707b6&gt;] ? process_one_work+0x196/0x370
[ 1153.360847]  [&lt;c167c723&gt;] schedule+0x23/0x60
[ 1153.360849]  [&lt;c1070de1&gt;] worker_thread+0x161/0x460
[ 1153.360852]  [&lt;c1090fcf&gt;] ? __wake_up_locked+0x1f/0x30
[ 1153.360854]  [&lt;c1070c80&gt;] ? rescuer_thread+0x2f0/0x2f0
[ 1153.360856]  [&lt;c1074f01&gt;] kthread+0xa1/0xc0
[ 1153.360859]  [&lt;c1680401&gt;] ret_from_kernel_thread+0x21/0x30
[ 1153.360861]  [&lt;c1074e60&gt;] ? kthread_create_on_node+0x110/0x110
[ 1153.360863] ---[ end trace 5ff83639cbb74b35 ]---

This patch replaces the kfree_skb() by dev_kfree_skb_any().

Signed-off-by: Thomas Körper &lt;thomas.koerper@esd.eu&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
</feed>
