linux-toradex.git/include/net, branch v3.10.15

net_sched: restore "linklayer atm" handling

2013-09-14T13:54:55+00:00

[ Upstream commit 8a8e3d84b1719a56f9151909e80ea6ebc5b8e318 ]

commit 56b765b79 ("htb: improved accuracy at high rates")
broke the "linklayer atm" handling.

 tc class add ... htb rate X ceil Y linklayer atm

The linklayer setting is implemented by modifying the rate table
which is send to the kernel.  No direct parameter were
transferred to the kernel indicating the linklayer setting.

The commit 56b765b79 ("htb: improved accuracy at high rates")
removed the use of the rate table system.

To keep compatible with older iproute2 utils, this patch detects
the linklayer by parsing the rate table.  It also supports future
versions of iproute2 to send this linklayer parameter to the
kernel directly. This is done by using the __reserved field in
struct tc_ratespec, to convey the choosen linklayer option, but
only using the lower 4 bits of this field.

Linklayer detection is limited to speeds below 100Mbit/s, because
at high rates the rtab is gets too inaccurate, so bad that
several fields contain the same values, this resembling the ATM
detect.  Fields even start to contain "0" time to send, e.g. at
1000Mbit/s sending a 96 bytes packet cost "0", thus the rtab have
been more broken than we first realized.

Signed-off-by: Jesper Dangaard Brouer 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ip_tunnel: Do not use inner ip-header-id for tunnel ip-header-id.

2013-09-14T13:54:55+00:00

[ Upstream commit 4221f40513233fa8edeef7fc82e44163fde03b9b ]

Using inner-id for tunnel id is not safe in some rare cases.
E.g. packets coming from multiple sources entering same tunnel
can have same id. Therefore on tunnel packet receive we
could have packets from two different stream but with same
source and dst IP with same ip-id which could confuse ip packet
reassembly.

Following patch reverts optimization from commit
490ab08127 (IP_GRE: Fix IP-Identification.)

Signed-off-by: Pravin B Shelar 
CC: Jarno Rajahalme 
CC: Ansis Atteka 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

genl: Hold reference on correct module while netlink-dump.

2013-09-14T13:54:55+00:00

[ Upstream commit 33c6b1f6b154894321f5734e50c66621e9134e7e ]

netlink dump operations take module as parameter to hold
reference for entire netlink dump duration.
Currently it holds ref only on genl module which is not correct
when we use ops registered to genl from another module.
Following patch adds module pointer to genl_ops so that netlink
can hold ref count on it.

Signed-off-by: Pravin B Shelar 
CC: Jesse Gross 
CC: Johannes Berg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

mac80211: add a flag to indicate CCK support for HT clients

2013-09-08T05:09:59+00:00

commit 2dfca312a91631311c1cf7c090246cc8103de038 upstream.

brcm80211 cannot handle sending frames with CCK rates as part of an
A-MPDU session. Other drivers may have issues too. Set the flag in all
drivers that have been tested with CCK rates.

This fixes a reported brcmsmac regression introduced in
commit ef47a5e4f1aaf1d0e2e6875e34b2c9595897bef6
"mac80211/minstrel_ht: fix cck rate sampling"

Reported-by: Tom Gundersen 
Signed-off-by: Felix Fietkau 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman

ndisc: Add missing inline to ndisc_addr_option_pad

2013-08-12T01:35:26+00:00

[ Upstream commit d9d10a30964504af834d8d250a0c76d4ae91eb1e ]

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data

2013-07-28T23:29:49+00:00

[ Upstream commit 8822b64a0fa64a5dd1dfcf837c5b0be83f8c05d1 ]

We accidentally call down to ip6_push_pending_frames when uncorking
pending AF_INET data on a ipv6 socket. This results in the following
splat (from Dave Jones):

skbuff: skb_under_panic: text:ffffffff816765f6 len:48 put:40 head:ffff88013deb6df0 data:ffff88013deb6dec tail:0x2c end:0xc0 dev:
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:126!
invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Modules linked in: dccp_ipv4 dccp 8021q garp bridge stp dlci mpoa snd_seq_dummy sctp fuse hidp tun bnep nfnetlink scsi_transport_iscsi rfcomm can_raw can_bcm af_802154 appletalk caif_socket can caif ipt_ULOG x25 rose af_key pppoe pppox ipx phonet irda llc2 ppp_generic slhc p8023 psnap p8022 llc crc_ccitt atm bluetooth
+netrom ax25 nfc rfkill rds af_rxrpc coretemp hwmon kvm_intel kvm crc32c_intel snd_hda_codec_realtek ghash_clmulni_intel microcode pcspkr snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hwdep usb_debug snd_seq snd_seq_device snd_pcm e1000e snd_page_alloc snd_timer ptp snd pps_core soundcore xfs libcrc32c
CPU: 2 PID: 8095 Comm: trinity-child2 Not tainted 3.10.0-rc7+ #37
task: ffff8801f52c2520 ti: ffff8801e6430000 task.ti: ffff8801e6430000
RIP: 0010:[]  [] skb_panic+0x63/0x65
RSP: 0018:ffff8801e6431de8  EFLAGS: 00010282
RAX: 0000000000000086 RBX: ffff8802353d3cc0 RCX: 0000000000000006
RDX: 0000000000003b90 RSI: ffff8801f52c2ca0 RDI: ffff8801f52c2520
RBP: ffff8801e6431e08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88022ea0c800
R13: ffff88022ea0cdf8 R14: ffff8802353ecb40 R15: ffffffff81cc7800
FS:  00007f5720a10740(0000) GS:ffff880244c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000005862000 CR3: 000000022843c000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Stack:
 ffff88013deb6dec 000000000000002c 00000000000000c0 ffffffff81a3f6e4
 ffff8801e6431e18 ffffffff8159a9aa ffff8801e6431e90 ffffffff816765f6
 ffffffff810b756b 0000000700000002 ffff8801e6431e40 0000fea9292aa8c0
Call Trace:
 [] skb_push+0x3a/0x40
 [] ip6_push_pending_frames+0x1f6/0x4d0
 [] ? mark_held_locks+0xbb/0x140
 [] udp_v6_push_pending_frames+0x2b9/0x3d0
 [] ? udplite_getfrag+0x20/0x20
 [] udp_lib_setsockopt+0x1aa/0x1f0
 [] ? fget_light+0x387/0x4f0
 [] udpv6_setsockopt+0x34/0x40
 [] sock_common_setsockopt+0x14/0x20
 [] SyS_setsockopt+0x71/0xd0
 [] tracesys+0xdd/0xe2
Code: 00 00 48 89 44 24 10 8b 87 d8 00 00 00 48 89 44 24 08 48 8b 87 e8 00 00 00 48 c7 c7 c0 04 aa 81 48 89 04 24 31 c0 e8 e1 7e ff ff <0f> 0b 55 48 89 e5 0f 0b 55 48 89 e5 0f 0b 55 48 89 e5 0f 0b 55
RIP  [] skb_panic+0x63/0x65
 RSP 

This patch adds a check if the pending data is of address family AF_INET
and directly calls udp_push_ending_frames from udp_v6_push_pending_frames
if that is the case.

This bug was found by Dave Jones with trinity.

(Also move the initialization of fl6 below the AF_INET check, even if
not strictly necessary.)

Signed-off-by: Hannes Frederic Sowa 
Cc: Dave Jones 
Cc: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ipv6,mcast: always hold idev->lock before mca_lock

2013-07-28T23:29:49+00:00

[ Upstream commit 8965779d2c0e6ab246c82a405236b1fb2adae6b2, with
  some bits from commit b7b1bfce0bb68bd8f6e62a28295922785cc63781
  ("ipv6: split duplicate address detection and router solicitation timer")
  to get the __ipv6_get_lladdr() used by this patch. ]

dingtianhong reported the following deadlock detected by lockdep:

 ======================================================
 [ INFO: possible circular locking dependency detected ]
 3.4.24.05-0.1-default #1 Not tainted
 -------------------------------------------------------
 ksoftirqd/0/3 is trying to acquire lock:
  (&ndev->lock){+.+...}, at: [] ipv6_get_lladdr+0x74/0x120

 but task is already holding lock:
  (&mc->mca_lock){+.+...}, at: [] mld_send_report+0x40/0x150

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #1 (&mc->mca_lock){+.+...}:
        [] validate_chain+0x637/0x730
        [] __lock_acquire+0x2f7/0x500
        [] lock_acquire+0x114/0x150
        [] rt_spin_lock+0x4a/0x60
        [] igmp6_group_added+0x3b/0x120
        [] ipv6_mc_up+0x38/0x60
        [] ipv6_find_idev+0x3d/0x80
        [] addrconf_notify+0x3d5/0x4b0
        [] notifier_call_chain+0x3f/0x80
        [] raw_notifier_call_chain+0x11/0x20
        [] call_netdevice_notifiers+0x32/0x60
        [] __dev_notify_flags+0x34/0x80
        [] dev_change_flags+0x40/0x70
        [] do_setlink+0x237/0x8a0
        [] rtnl_newlink+0x3ec/0x600
        [] rtnetlink_rcv_msg+0x160/0x310
        [] netlink_rcv_skb+0x89/0xb0
        [] rtnetlink_rcv+0x27/0x40
        [] netlink_unicast+0x140/0x180
        [] netlink_sendmsg+0x33e/0x380
        [] sock_sendmsg+0x112/0x130
        [] __sys_sendmsg+0x44e/0x460
        [] sys_sendmsg+0x44/0x70
        [] system_call_fastpath+0x16/0x1b

 -> #0 (&ndev->lock){+.+...}:
        [] check_prev_add+0x3de/0x440
        [] validate_chain+0x637/0x730
        [] __lock_acquire+0x2f7/0x500
        [] lock_acquire+0x114/0x150
        [] rt_read_lock+0x42/0x60
        [] ipv6_get_lladdr+0x74/0x120
        [] mld_newpack+0xb6/0x160
        [] add_grhead+0xab/0xc0
        [] add_grec+0x3ab/0x460
        [] mld_send_report+0x5a/0x150
        [] igmp6_timer_handler+0x4e/0xb0
        [] call_timer_fn+0xca/0x1d0
        [] run_timer_softirq+0x1df/0x2e0
        [] handle_pending_softirqs+0xf7/0x1f0
        [] __do_softirq_common+0x7b/0xf0
        [] __thread_do_softirq+0x1af/0x210
        [] run_ksoftirqd+0xe1/0x1f0
        [] kthread+0xae/0xc0
        [] kernel_thread_helper+0x4/0x10

actually we can just hold idev->lock before taking pmc->mca_lock,
and avoid taking idev->lock again when iterating idev->addr_list,
since the upper callers of mld_newpack() already take
read_lock_bh(&idev->lock).

Reported-by: dingtianhong 
Cc: dingtianhong 
Cc: Hideaki YOSHIFUJI 
Cc: David S. Miller 
Cc: Hannes Frederic Sowa 
Tested-by: Ding Tianhong 
Tested-by: Chen Weilong 
Signed-off-by: Cong Wang 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ip_tunnel: remove __net_init/exit from exported functions

2013-06-13T10:00:59+00:00

If CONFIG_NET_NS is not set then __net_init is the same as __init and
__net_exit is the same as __exit. These functions will be removed from
memory after the module loads or is removed. Functions that are exported
for use by other functions should never be labeled for removal.

Bug introduced by commit c54419321455631079c
("GRE: Refactor GRE tunneling code.")

Reported-by: Steinar H. Gunderson 
Signed-off-by: Steven Rostedt 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

2013-06-12T14:57:04+00:00

Bluetooth: Fix mgmt handling of power on failures

2013-06-12T14:20:55+00:00

If hci_dev_open fails we need to ensure that the corresponding
mgmt_set_powered command gets an appropriate response. This patch fixes
the missing response by adding a new mgmt_set_powered_failed function
that's used to indicate a power on failure to mgmt. Since a situation
with the device being rfkilled may require special handling in user
space the patch uses a new dedicated mgmt status code for this.

Signed-off-by: Johan Hedberg 
Cc: stable@vger.kernel.org
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo Padovan 
Signed-off-by: John W. Linville