linux-toradex.git/drivers/net, branch v3.4.97

can: peak_pci: prevent use after free at netdev removal

2014-07-01T03:01:30+00:00

commit 0b5a958cf4df3a5cd578b861471e62138f55c85e upstream.

As remarked by Christopher R. Baker in his post at

http://marc.info/?l=linux-can&m=139707295706465&w=2

there's a possibility for an use after free condition at device removal.

This simplified patch introduces an additional variable to prevent the issue.
Thanks for catching this.

Reported-by: Christopher R. Baker 
Signed-off-by: Stephane Grosjean 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman

net/mlx4_core: Preserve pci_dev_data after __mlx4_remove_one()

2014-06-26T19:10:28+00:00

[ Upstream commit befdf8978accecac2e0739e6b5075afc62db37fe ]

This patch wrap up a helper function __mlx4_remove_one() which does the tear
down function but preserve the drv_data. Functions like
mlx4_pci_err_detected() and mlx4_restart_one() will call this one with out
releasing drvdata.

Signed-off-by: Wei Yang 
Signed-off-by: Greg Kroah-Hartman

mlx4_core: Stash PCI ID driver_data in mlx4_priv structure

2014-06-26T19:10:28+00:00

[ No upstream commit, this is a cherry picked backport enabler. ]

From: Roland Dreier 

That way we can check flags later on, when we've finished with the
pci_device_id structure.  Also convert the "is VF" flag to an enum:
"Never do in the preprocessor what can be done in C."

Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

team: fix mtu setting

2014-06-26T19:10:28+00:00

[ Upstream commit 9d0d68faea6962d62dd501cd6e71ce5cc8ed262b ]

Now it is not possible to set mtu to team device which has a port
enslaved to it. The reason is that when team_change_mtu() calls
dev_set_mtu() for port device, notificator for NETDEV_PRECHANGEMTU
event is called and team_device_event() returns NOTIFY_BAD forbidding
the change. So fix this by returning NOTIFY_DONE here in case team is
changing mtu in team_change_mtu().

Introduced-by: 3d249d4c "net: introduce ethernet teaming device"
Signed-off-by: Jiri Pirko 
Acked-by: Flavio Leitner 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

mlx4_en: don't use napi_synchronize inside mlx4_en_netpoll

2014-06-16T20:45:45+00:00

commit c98235cb8584a72e95786e17d695a8e5fafcd766 upstream.

The mlx4 driver is triggering schedules while atomic inside
mlx4_en_netpoll:

	spin_lock_irqsave(&cq->lock, flags);
	napi_synchronize(&cq->napi);
		^^^^^ msleep here
	mlx4_en_process_rx_cq(dev, cq, 0);
	spin_unlock_irqrestore(&cq->lock, flags);

This was part of a patch by Alexander Guller from Mellanox in 2011,
but it still isn't upstream.

Signed-off-by: Chris Mason 
Acked-By: Amir Vadai 
Signed-off-by: David S. Miller 
Signed-off-by: Jiri Slaby 
Cc: Masoud Sharbiani 
Signed-off-by: Greg Kroah-Hartman

ath9k: protect tid->sched check

2014-06-07T23:02:16+00:00

commit 21f8aaee0c62708654988ce092838aa7df4d25d8 upstream.

We check tid->sched without a lock taken on ath_tx_aggr_sleep(). That
is race condition which can result of doing list_del(&tid->list) twice
(second time with poisoned list node) and cause crash like shown below:

[424271.637220] BUG: unable to handle kernel paging request at 00100104
[424271.637328] IP: [] ath_tx_aggr_sleep+0x62/0xe0 [ath9k]
...
[424271.639953] Call Trace:
[424271.639998]  [] ? ath9k_get_survey+0x110/0x110 [ath9k]
[424271.640083]  [] ath9k_sta_notify+0x42/0x50 [ath9k]
[424271.640177]  [] sta_ps_start+0x8f/0x1c0 [mac80211]
[424271.640258]  [] ? free_compound_page+0x2e/0x40
[424271.640346]  [] ieee80211_rx_handlers+0x9d5/0x2340 [mac80211]
[424271.640437]  [] ? kmem_cache_free+0x1d8/0x1f0
[424271.640510]  [] ? kfree_skbmem+0x34/0x90
[424271.640578]  [] ? put_page+0x2c/0x40
[424271.640640]  [] ? kfree_skbmem+0x34/0x90
[424271.640706]  [] ? kfree_skbmem+0x34/0x90
[424271.640787]  [] ? ieee80211_rx_handlers_result+0x73/0x1d0 [mac80211]
[424271.640897]  [] ieee80211_prepare_and_rx_handle+0x520/0xad0 [mac80211]
[424271.641009]  [] ? ieee80211_rx_handlers+0x2ed/0x2340 [mac80211]
[424271.641104]  [] ? ip_output+0x7e/0xd0
[424271.641182]  [] ieee80211_rx+0x307/0x7c0 [mac80211]
[424271.641266]  [] ath_rx_tasklet+0x88e/0xf70 [ath9k]
[424271.641358]  [] ? ieee80211_rx+0x1dc/0x7c0 [mac80211]
[424271.641445]  [] ath9k_tasklet+0xcb/0x130 [ath9k]

Bug report:
https://bugzilla.kernel.org/show_bug.cgi?id=70551

Reported-and-tested-by: Max Sydorenko 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
[bwh: Backported to 3.2:
 - Adjust context
 - Use spin_unlock_bh() directly]
Signed-off-by: Ben Hutchings 
[gkh: backported to 3.4:
 - adjust context
 - back out bwh's spinlock change]
Signed-off-by: Greg Kroah-Hartman

xen-netfront: reduce gso_max_size to account for max TCP header

2014-06-07T23:02:15+00:00

commit 9ecd1a75d977e2e8c48139c7d3efed183f898d94 upstream.

The maximum packet including header that can be handled by netfront / netback
wire format is 65535. Reduce gso_max_size accordingly.

Drop skb and print warning when skb->len > 65535. This can 1) save the effort
to send malformed packet to netback, 2) help spotting misconfiguration of
netfront in the future.

Signed-off-by: Wei Liu 
Acked-by: Ian Campbell 
Signed-off-by: David S. Miller 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
[hq: Backported to 3.4: adjust context]
Signed-off-by: Qiang Huang 
Signed-off-by: Greg Kroah-Hartman

can: sja1000: fix {pre,post}_irq() handling and IRQ handler return value

2014-06-07T23:02:15+00:00

commit 2fea6cd303c0d0cd9067da31d873b6a6d5bd75e7 upstream.

This patch fixes the issue that the sja1000_interrupt() function may have
returned IRQ_NONE without processing the optional pre_irq() and post_irq()
function before. Further the irq processing counter 'n' is moved to the end of
the while statement to return correct IRQ_[NONE|HANDLED] values at error
conditions.

Reported-by: Wolfgang Grandegger 
Acked-by: Wolfgang Grandegger 
Signed-off-by: Oliver Hartkopp 
Signed-off-by: Marc Kleine-Budde 
[bwh: Backported to 3.2: s/SJA1000_IER/REG_IER/; s/SJA1000_IR/REG_IR/]
Signed-off-by: Ben Hutchings 
Cc: Qiang Huang 
Signed-off-by: Greg Kroah-Hartman

b43: ensue that BCMA is "y" when B43 is "y"

2014-06-07T23:02:14+00:00

commit 693026ef2e751fd94d2e6c71028e68343cc875d5 upstream.

When b43 gets build into the kernel and it should use bcma we have to
ensure that bcma was also build into the kernel and not as a module.
In this patch this is also done for SSB, although you can not
build b43 without ssb support for now.

This fixes a build problem reported by Randy Dunlap in
5187EB95.2060605@infradead.org

Reported-By: Randy Dunlap 
Signed-off-by: Hauke Mehrtens 
Signed-off-by: John W. Linville 
Signed-off-by: Ben Hutchings 
Cc: Qiang Huang 
Signed-off-by: Greg Kroah-Hartman

ixgbe: fix registration order of driver and DCA nofitication

2014-06-07T23:02:14+00:00

commit f01fc1a82c2ee68726b400fadb156bd623b5f2f1 upstream.

ixgbe_notify_dca cannot be called before driver registration
because it expects driver's klist_devices to be allocated and
initialized. While on it make sure debugfs files are removed
when registration fails.

Signed-off-by: Jakub Kicinski 
Tested-by: Phil Schmitt 
Signed-off-by: Jeff Kirsher 
Signed-off-by: David S. Miller 
[bwh: Backported to 3.2: no debugfs support]
Signed-off-by: Ben Hutchings 
Cc: Qiang Huang 
Signed-off-by: Greg Kroah-Hartman