linux-toradex.git/drivers/net, branch v4.9.96

xen-netfront: Fix hang on device removal

2018-04-24T07:34:10+00:00

commit c2d2e6738a209f0f9dffa2dc8e7292fc45360d61 upstream.

A toolstack may delete the vif frontend and backend xenstore entries
while xen-netfront is in the removal code path.  In that case, the
checks for xenbus_read_driver_state would return XenbusStateUnknown, and
xennet_remove would hang indefinitely.  This hang prevents system
shutdown.

xennet_remove must be able to handle XenbusStateUnknown, and
netback_changed must also wake up the wake_queue for that state as well.

Fixes: 5b5971df3bc2 ("xen-netfront: remove warning when unloading module")

Signed-off-by: Jason Andryuk 
Cc: Eduardo Otubo 
Reviewed-by: Boris Ostrovsky 
Signed-off-by: Juergen Gross 
Signed-off-by: Greg Kroah-Hartman

Revert "net: phy: micrel: Restore led_mode and clk_sel on resume"

2018-04-20T06:21:08+00:00

This reverts commit d7ba3c00047dfd88fe0360a2d27169b54c88c4f1 which was
commit 79e498a9c7da0737829ff864aae44df434105676 upstream.

Turns out it breaks things, so drop it.

Reported-by: Naresh Kamboju 
Cc: Leonard Crestez 
Cc: Florian Fainelli 
Cc: David S. Miller 
Cc: Sasha Levin 
Cc: Dan Rue 
Signed-off-by: Greg Kroah-Hartman

lan78xx: Correctly indicate invalid OTP

2018-04-20T06:21:08+00:00

[ Upstream commit 4bfc33807a9a02764bdd1e42e794b3b401240f27 ]

lan78xx_read_otp tries to return -EINVAL in the event of invalid OTP
content, but the value gets overwritten before it is returned and the
read goes ahead anyway. Make the read conditional as it should be
and preserve the error code.

Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Signed-off-by: Phil Elwell 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

slip: Check if rstate is initialized before uncompressing

2018-04-20T06:21:07+00:00

[ Upstream commit 3f01ddb962dc506916c243f9524e8bef97119b77 ]

On receiving a packet the state index points to the rstate which must be
used to fill up IP and TCP headers. But if the state index points to a
rstate which is unitialized, i.e. filled with zeros, it gets stuck in an
infinite loop inside ip_fast_csum trying to compute the ip checsum of a
header with zero length.

89.666953:   <2> [] slhc_uncompress+0x464/0x468
89.666965:   <2> [] ppp_receive_nonmp_frame+0x3b4/0x65c
89.666978:   <2> [] ppp_receive_frame+0x64/0x7e0
89.666991:   <2> [] ppp_input+0x104/0x198
89.667005:   <2> [] pppopns_recv_core+0x238/0x370
89.667027:   <2> [] __sk_receive_skb+0xdc/0x250
89.667040:   <2> [] pppopns_recv+0x44/0x60
89.667053:   <2> [] __sock_queue_rcv_skb+0x16c/0x24c
89.667065:   <2> [] sock_queue_rcv_skb+0x2c/0x38
89.667085:   <2> [] raw_rcv+0x124/0x154
89.667098:   <2> [] raw_local_deliver+0x1e0/0x22c
89.667117:   <2> [] ip_local_deliver_finish+0x70/0x24c
89.667131:   <2> [] ip_local_deliver+0x100/0x10c

./scripts/faddr2line vmlinux slhc_uncompress+0x464/0x468 output:
 ip_fast_csum at arch/arm64/include/asm/checksum.h:40
 (inlined by) slhc_uncompress at drivers/net/slip/slhc.c:615

Adding a variable to indicate if the current rstate is initialized. If
such a packet arrives, move to toss state.

Signed-off-by: Tejaswi Tanikella 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN

2018-04-20T06:21:07+00:00

[ Upstream commit 53765341ee821c0a0f1dec41adc89c9096ad694c ]

The Cinterion AHS8 is a 3G device with one embedded WWAN interface
using cdc_ether as a driver.

The modem is controlled via AT commands through the exposed TTYs.

AT+CGDCONT write command can be used to activate or deactivate a WWAN
connection for a PDP context defined with the same command. UE
supports one WWAN adapter.

Signed-off-by: Bassem Boubaker 
Acked-by: Oliver Neukum 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

rtl8187: Fix NULL pointer dereference in priv->conf_mutex

2018-04-20T06:21:07+00:00

commit 7972326a26b5bf8dc2adac575c4e03ee7e9d193a upstream.

This can be reproduced by bind/unbind the driver multiple times
in AM3517 board.

Analysis revealed that rtl8187_start() was invoked before probe
finishes(ie. before the mutex is initialized).

 INFO: trying to register non-static key.
 the code is fine but needs lockdep annotation.
 turning off the locking correctness validator.
 CPU: 0 PID: 821 Comm: wpa_supplicant Not tainted 4.9.80-dirty #250
 Hardware name: Generic AM3517 (Flattened Device Tree)
 [] (unwind_backtrace) from [] (show_stack+0x10/0x14)
 [] (show_stack) from [] (register_lock_class+0x4f4/0x55c)
 [] (register_lock_class) from [] (__lock_acquire+0x74/0x1938)
 [] (__lock_acquire) from [] (lock_acquire+0xfc/0x23c)
 [] (lock_acquire) from [] (mutex_lock_nested+0x50/0x3b0)
 [] (mutex_lock_nested) from [] (rtl8187_start+0x2c/0xd54)
 [] (rtl8187_start) from [] (drv_start+0xa8/0x320)
 [] (drv_start) from [] (ieee80211_do_open+0x2bc/0x8e4)
 [] (ieee80211_do_open) from [] (__dev_open+0xb8/0x120)
 [] (__dev_open) from [] (__dev_change_flags+0x88/0x14c)
 [] (__dev_change_flags) from [] (dev_change_flags+0x18/0x48)
 [] (dev_change_flags) from [] (devinet_ioctl+0x738/0x840)
 [] (devinet_ioctl) from [] (sock_ioctl+0x164/0x2f4)
 [] (sock_ioctl) from [] (do_vfs_ioctl+0x8c/0x9d0)
 [] (do_vfs_ioctl) from [] (SyS_ioctl+0x6c/0x7c)
 [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x1c)
 Unable to handle kernel NULL pointer dereference at virtual address 00000000
 pgd = cd1ec000
 [00000000] *pgd=8d1de831, *pte=00000000, *ppte=00000000
 Internal error: Oops: 817 [#1] PREEMPT ARM
 Modules linked in:
 CPU: 0 PID: 821 Comm: wpa_supplicant Not tainted 4.9.80-dirty #250
 Hardware name: Generic AM3517 (Flattened Device Tree)
 task: ce73eec0 task.stack: cd1ea000
 PC is at mutex_lock_nested+0xe8/0x3b0
 LR is at mutex_lock_nested+0xd0/0x3b0

Cc: stable@vger.kernel.org
Signed-off-by: Sudhir Sreedharan 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

vrf: Fix use after free and double free in vrf_finish_output

2018-04-13T17:48:37+00:00

commit 82dd0d2a9a76fc8fa2b18d80b987d455728bf83a upstream.

Miguel reported an skb use after free / double free in vrf_finish_output
when neigh_output returns an error. The vrf driver should return after
the call to neigh_output as it takes over the skb on error path as well.

Patch is a simplified version of Miguel's patch which was written for 4.9,
and updated to top of tree.

Fixes: 8f58336d3f78a ("net: Add ethernet header for pass through VRF device")
Signed-off-by: Miguel Fadon Perlines 
Signed-off-by: David Ahern 
Signed-off-by: David S. Miller 
[ backport to 4.4 and 4.9 dropped the sock_confirm_neigh and
  changed neigh_output to dst_neigh_output ]
Signed-off-by: Greg Kroah-Hartman

net/mlx4_core: Fix memory leak while delete slave's resources

2018-04-13T17:48:36+00:00

[ Upstream commit 461d5f1b59490ce0096dfda45e10038c122a7892 ]

mlx4_delete_all_resources_for_slave in resource tracker should free all
memory allocated for a slave.
While releasing memory of fs_rule, it misses releasing memory of
fs_rule->mirr_mbox.

Fixes: 78efed275117 ('net/mlx4_core: Support mirroring VF DMFS rules on both ports')
Signed-off-by: Moshe Shemesh 
Signed-off-by: Tariq Toukan 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

team: move dev_mc_sync after master_upper_dev_link in team_port_add

2018-04-13T17:48:36+00:00

[ Upstream commit 982cf3b3999d39a2eaca0a65542df33c19b5d814 ]

The same fix as in 'bonding: move dev_mc_sync after master_upper_dev_link
in bond_enslave' is needed for team driver.

The panic can be reproduced easily:

  ip link add team1 type team
  ip link set team1 up
  ip link add link team1 vlan1 type vlan id 80
  ip link set vlan1 master team1

Fixes: cb41c997d444 ("team: team should sync the port's uc/mc addrs when add a port")
Signed-off-by: Xin Long 
Acked-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net/mlx4_en: Fix mixed PFC and Global pause user control requests

2018-04-13T17:48:36+00:00

[ Upstream commit 6e8814ceb7e8f468659ef9253bd212c07ae19584 ]

Global pause and PFC configuration should be mutually exclusive (i.e. only
one of them at most can be set). However, once PFC was turned off,
driver automatically turned Global pause on. This is a bug.

Fix the driver behaviour to turn off PFC/Global once the user turned the
other on.

This also fixed a weird behaviour that at a current time, the profile
had both PFC and global pause configuration turned on, which is
Hardware-wise impossible and caused returning false positive indication
to query tools.

In addition, fix error code when setting global pause or PFC to change
metadata only upon successful change.

Also, removed useless debug print.

Fixes: af7d51852631 ("net/mlx4_en: Add DCB PFC support through CEE netlink commands")
Fixes: c27a02cd94d6 ("mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC")
Signed-off-by: Eran Ben Elisha 
Signed-off-by: Tariq Toukan 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman