summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-07-26neigh: prevent overflowing params in /proc/sys/net/ipv4/neigh/Francesco Fusco
Without this patch, the fields app_solicit, gc_thresh1, gc_thresh2, gc_thresh3, proxy_qlen, ucast_solicit, mcast_solicit could have assumed negative values when setting large numbers. Signed-off-by: Francesco Fusco <ffusco@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-26drivers: net: sun4i-emac: select MDIO_SUN4IMaxime Ripard
The EMAC driver can't work without its associated PHY driver. Reflect this in the Kconfig options by selecting it. Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-26drivers: net: allwinner: Fix Kconfig indentationMaxime Ripard
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-26usbnet: do not pretend to support SG/TSOEric Dumazet
usbnet doesn't support yet SG, so drivers should not advertise SG or TSO capabilities, as they allow TCP stack to build large TSO packets that need to be linearized and might use order-5 pages. This adds an extra copy overhead and possible allocation failures. Current code ignore skb_linearize() return code so crashes are even possible. Best is to not pretend SG/TSO is supported, and add this again when/if usbnet really supports SG for devices who could get a performance gain. Based on a prior patch from Freddy Xin <freddy@asix.com.tw> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-25Merge branch 'for-davem' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless John W. Linville says: ==================== This is another batch of fixes intended for the 3.11 stream. FWIW, this is the first request with fixes from the mac80211 and iwlwifi trees as well. Regarding the mac80211 bits, Johannes says: "Here I have a fix for RSSI thresholds in mesh, two minstrel fixes from Felix, an nl80211 fix from Michal and four various fixes I did myself." As for the iwlwifi bits, Johannes says: "Here I have a fix for debugfs directory creation (causing a spurious error message), two scanning fixes from David Spinadel, an LED fix and two patches related to a BA session problem that eventually caused firmware crashes from Emmanuel and a small BT fix for older devices as well as a workaround for a firmware problem with APs with very small beacon intervals from myself." Along with those: Arend van Spriel addresses a lock-up and a NULL pointer dereference in brcmfmac. Daniel Drake fixes an unhandled interrupt during device tear down in mwifiex. Larry Finger corrects a wil6210 build error. Oleksij Rempel fixes two ath9k_htc problems related to keeping the driver and firmware in sync. Solomon Peachy gives us a cw1200 fix to avoid an oops in monitor mode. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-24net: fix comment above build_skb()Florian Fainelli
build_skb() specifies that the data parameter must come from a kmalloc'd area, this is only true if frag_size equals 0, because then build_skb() will use kzsize(data) to figure out the actual data size. Update the comment to reflect that special condition. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-24net: sun4i: fix timeout checkEmilio López
The current timeout check is comparing two constant values, so it won't ever detect a timeout. This patch reworks the affected code a bit so it has a chance at detecting timeouts correctly. Signed-off-by: Emilio López <emilio@elopez.com.ar> Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-24ipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanupHannes Frederic Sowa
Otherwise we end up dereferencing the already freed net->ipv6.mrt pointer which leads to a panic (from Srivatsa S. Bhat): BUG: unable to handle kernel paging request at ffff882018552020 IP: [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6] PGD 290a067 PUD 207ffe0067 PMD 207ff1d067 PTE 8000002018552060 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC Modules linked in: ebtable_nat ebtables nfs fscache nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables nfsd lockd nfs_acl exportfs auth_rpcgss autofs4 sunrpc 8021q garp bridge stp llc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter +ip6_tables ipv6 vfat fat vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support cdc_ether usbnet mii microcode i2c_i801 i2c_core lpc_ich mfd_core shpchp ioatdma dca mlx4_core be2net wmi acpi_cpufreq mperf ext4 jbd2 mbcache dm_mirror dm_region_hash dm_log dm_mod CPU: 0 PID: 7 Comm: kworker/u33:0 Not tainted 3.11.0-rc1-ea45e-a #4 Hardware name: IBM -[8737R2A]-/00Y2738, BIOS -[B2E120RUS-1.20]- 11/30/2012 Workqueue: netns cleanup_net task: ffff8810393641c0 ti: ffff881039366000 task.ti: ffff881039366000 RIP: 0010:[<ffffffffa0366b02>] [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6] RSP: 0018:ffff881039367bd8 EFLAGS: 00010286 RAX: ffff881039367fd8 RBX: ffff882018552000 RCX: dead000000200200 RDX: 0000000000000000 RSI: ffff881039367b68 RDI: ffff881039367b68 RBP: ffff881039367bf8 R08: ffff881039367b68 R09: 2222222222222222 R10: 2222222222222222 R11: 2222222222222222 R12: ffff882015a7a040 R13: ffff882014eb89c0 R14: ffff8820289e2800 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88103fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff882018552020 CR3: 0000000001c0b000 CR4: 00000000000407f0 Stack: ffff881039367c18 ffff882014eb89c0 ffff882015e28c00 0000000000000000 ffff881039367c18 ffffffffa034d9d1 ffff8820289e2800 ffff882014eb89c0 ffff881039367c58 ffffffff815bdecb ffffffff815bddf2 ffff882014eb89c0 Call Trace: [<ffffffffa034d9d1>] rawv6_close+0x21/0x40 [ipv6] [<ffffffff815bdecb>] inet_release+0xfb/0x220 [<ffffffff815bddf2>] ? inet_release+0x22/0x220 [<ffffffffa032686f>] inet6_release+0x3f/0x50 [ipv6] [<ffffffff8151c1d9>] sock_release+0x29/0xa0 [<ffffffff81525520>] sk_release_kernel+0x30/0x70 [<ffffffffa034f14b>] icmpv6_sk_exit+0x3b/0x80 [ipv6] [<ffffffff8152fff9>] ops_exit_list+0x39/0x60 [<ffffffff815306fb>] cleanup_net+0xfb/0x1a0 [<ffffffff81075e3a>] process_one_work+0x1da/0x610 [<ffffffff81075dc9>] ? process_one_work+0x169/0x610 [<ffffffff81076390>] worker_thread+0x120/0x3a0 [<ffffffff81076270>] ? process_one_work+0x610/0x610 [<ffffffff8107da2e>] kthread+0xee/0x100 [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70 [<ffffffff8162a99c>] ret_from_fork+0x7c/0xb0 [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70 Code: 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 66 66 66 66 90 4c 8b 67 30 49 89 fd e8 db 3c 1e e1 49 8b 9c 24 90 08 00 00 48 85 db 74 06 <4c> 39 6b 20 74 20 bb f3 ff ff ff e8 8e 3c 1e e1 89 d8 4c 8b 65 RIP [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6] RSP <ffff881039367bd8> CR2: ffff882018552020 Reported-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com> Tested-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-24fib_trie: potential out of bounds access in trie_show_stats()Jerry Snitselaar
With the <= max condition in the for loop, it will be always go 1 element further than needed. If the condition for the while loop is never met, then max is MAX_STAT_DEPTH, and for loop will walk off the end of nodesizes[]. Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-24mlx5: use after free in mlx5_cmd_comp_handler()Dan Carpenter
We can't dereference "ent" after passing it to free_cmd(). Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-24r8169: fix lockdep warning when removing interfaceLekensteyn
The work queue is initialised in rtl_open (when the interface goes up), but canceled in rtl_remove_one (when the PCI device gets removed). If the network interface is not brought up, then the work queue struct is not initialised. When the device is removed, the attempt to cancel the uninitialised work queue causes a lockdep warning. This patch fixes the issue by moving cancel_work_sync to rtl_close (to match rtl_open). (Note that rtl_close is also called via unregister_netdev in rtl_remove_one.) Signed-off-by: Peter Wu <lekensteyn@gmail.com> Acked-by: Francois Romieu <romieu@fr.zoreil.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-24Merge branch 'master' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2013-07-23fec: Add MODULE_ALIASFabio Estevam
Add MODULE_ALIAS, so that auto module loading can work. Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-22sfc: Enable RX scatter for flows steered by RFSBen Hutchings
Received packets are only scattered if this is enabled in both the matching filter and the receiving queue. This was not being done for filters inserted for RFS, so any packet requiring more than a single descriptor was dropped. Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-22net: pch_gbe depends on x86Jiri Slaby
Since 4bb1667255a86360721291fe59991d033bbc2f2a (build some drivers only when compile-testing), PTP_1588_CLOCK_PCH depends on (X86 || COMPILE_TEST). But PCH_GBE selects PTP_1588_CLOCK_PCH without depending on x86. Fix this by adding the same dependency here. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Reported-by: <fengguang.wu@intel.com> [intel's build test robot] Cc: "David S. Miller" <davem@davemloft.net> Cc: Ben Hutchings <ben@decadent.org.uk> Cc: netdev@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: kbuild-all@01.org Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-22Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nfDavid S. Miller
Pablo Neira Ayuso says: ==================== The following patchset contains Netfilter fixes for your net tree, they are: * Fix potential NULL dereference in the socket match if revision 0 is used, from Eric Dumazet. * Fix missing expectation NAT initialization that results in dumping the NAT part via ctnetlink, thus leading to problems in expectation synchronization through conntrackd, from myself. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-22brcmfmac: bail out of brcmf_txflowblock_if() for non-netdev interfaceArend van Spriel
To avoid ending up in a NULL-pointer access, the function brcmf_txflowblock_if() should only be called for interfaces that have a netdev associated with it. Reviewed-by: Hante Meuleman <meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com> Signed-off-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-07-22brcmfmac: decrement pending 8021x count upon tx failureArend van Spriel
If the transmit fails because there are no hanger slots or any other reason and the packet was an EAPOL packet the pending counter should be decreased although it was not transmitted so the driver does not end up in a dead-lock. Reviewed-by: Hante Meuleman <meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com> Signed-off-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-07-22ath: wil6210: Fix build errorLarry Finger
Building driver wil6210 in 3.10 and 3.11 kernels yields the following errors: CC [M] drivers/net/wireless/ath/wil6210/debugfs.o drivers/net/wireless/ath/wil6210/debugfs.c: In function 'wil_print_ring': drivers/net/wireless/ath/wil6210/debugfs.c:163:11: error: pointer targets in passing argument 5 of 'hex_dump_to_buffer' differ in signedness [-Werror=pointer-sign] false); ^ In file included from include/linux/kernel.h:13:0, from include/linux/cache.h:4, from include/linux/time.h:4, from include/linux/stat.h:18, from include/linux/module.h:10, from drivers/net/wireless/ath/wil6210/debugfs.c:17: include/linux/printk.h:361:13: note: expected 'char *' but argument is of type 'unsigned char *' extern void hex_dump_to_buffer(const void *buf, size_t len, ^ drivers/net/wireless/ath/wil6210/debugfs.c: In function 'wil_txdesc_debugfs_show': drivers/net/wireless/ath/wil6210/debugfs.c:429:10: error: pointer targets in passing argument 5 of 'hex_dump_to_buffer' differ in signedness [-Werror=pointer-sign] sizeof(printbuf), false); ^ In file included from include/linux/kernel.h:13:0, from include/linux/cache.h:4, from include/linux/time.h:4, from include/linux/stat.h:18, from include/linux/module.h:10, from drivers/net/wireless/ath/wil6210/debugfs.c:17: include/linux/printk.h:361:13: note: expected 'char *' but argument is of type 'unsigned char *' extern void hex_dump_to_buffer(const void *buf, size_t len, ^ cc1: all warnings being treated as errors make[5]: *** [drivers/net/wireless/ath/wil6210/debugfs.o] Error 1 make[4]: *** [drivers/net/wireless/ath/wil6210] Error 2 make[3]: *** [drivers/net/wireless/ath] Error 2 make[2]: *** [drivers/net/wireless] Error 2 make[1]: *** [drivers/net] Error 2 make: *** [drivers] Error 2 These errors are fixed by changing the type of the buffer from "unsigned char *" to "char *". Reported-by: Thomas Fjellstrom <thomas@fjellstrom.ca> Tested-by: Thomas Fjellstrom <thomas@fjellstrom.ca> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Stable <stable@vger.kernel.org> [3.10] Cc: Thomas Fjellstrom <thomas@fjellstrom.ca> Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-07-22cw1200: Fix OOPS in monitor modeSolomon Peachy
In monitor mode, priv->vif is NULL, but at one point in the receive path we blindly attempt to dereference it. Add a test to prevent this. Signed-off-by: Solomon Peachy <pizza@shaftnet.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-07-22ath9k_htc: reboot firmware if it was loadedOleksij Rempel
Currently ath9k_htc will reboot firmware only if interface was ever started. Which lead to the problem in case where interface was never started but module need to be reloaded. This patch will partially fix bug "ath9k_htc: Target is unresponsive" https://github.com/qca/open-ath9k-htc-firmware/issues/1 Reproduction case: - plug adapter - make sure nothing will touch it. Stop Networkmanager or blacklist mac address of this adapter. - rmmod ath9k_htc; sleep 1; modprobe ath9k_htc Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Cc: <stable@vger.kernel.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-07-22ath9k_htc: do some initial hardware configurationOleksij Rempel
Currently we configure harwdare and clock, only after interface start. In this case, if we reload module or reboot PC without configuring adapter, firmware will freeze. There is no software way to reset adpter. This patch add initial configuration and set it in disabled state, to avoid this freeze. Behaviour of this patch should be similar to: ifconfig wlan0 up; ifconfig wlan0 down. Bug: https://github.com/qca/open-ath9k-htc-firmware/issues/1 Tested-by: Bo Shi <cnshibo@gmail.com> Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Cc: <stable@vger.kernel.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-07-22mwifiex: fix IRQ enable/disableDaniel Drake
During tear down (e.g. mwifiex_sdio_remove during system suspend), mwifiex left IRQs enabled for a significant period of time when it was unable to handle them correctly. This caused interrupt storms and interfered with the bluetooth interface on the same SDIO card. Solve this by disabling interrupts at the point when they can no longer be handled correctly, which is at the start of mwifiex_remove_card(). For cleanliness, we now enable interrupts in the mwifiex_add_card() path, to be symmetrical with the disabling of interrupts. We also couple the registration of the sdio IRQ handler with the actual enable/disable of interrupts at the hardware level. I also removed a write to this register in mwifiex_init_sdio which seemed pointless and won't cause any ill effects now that we only register the SDIO IRQ handler when we are ready to accept interrupts. Includes some corrections from Amitkumar Karwar. Signed-off-by: Daniel Drake <dsd@laptop.org> Acked-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-07-22Merge branch 'for-john' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes
2013-07-22Merge branch 'for-john' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
2013-07-20Merge branch 'for-davem' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless John W. Linville says: ==================== Please accept this batch of fixes intended for the 3.11 tree... Alexey Khoroshilov fixes a suspend-related race in ath9k_htc. Arnd Bergmann corrects the alignment of a structure in the ssb code to be compatible with ARM devices. Bob Copeland provides an ath5k fix that corrects a mistaken variable initialization. Felix Fietkau corrects some frame accounting for dropped frames in ath9k. Geert Uytterhoeven brings a Kconfig fix to indicate the DMA requirements for rt2x00. Larry Finger offers two rtlwifi fixes: one that properly initializes a callback; and, a scattered collection of Kconfig, Makefile, and EXPORT_SYMBOL changes that correct some build problems. Finally, Sujith Manoharan provides an ath9k fix to disable a feature on a specific hardware device. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-20Merge branch 'fixes-for-3.11' of git://gitorious.org/linux-can/linux-canDavid S. Miller
Marc Kleine-Budde says: ==================== here are two fixes for the v3.11 release cycle: Maximilian Schneider contributes a patch for the esd_usb2 CAN driver. It adds sanity checking to the data coming from the USB CAN adapter before using it. Alexey Khoroshilov from the Linux Driver Verification project fixes an urb leak in the error handling of the USB 8dev's usb_8dev_start() function. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19bridge: do not call setup_timer() multiple timesEric Dumazet
commit 9f00b2e7cf24 ("bridge: only expire the mdb entry when query is received") added a nasty bug as an active timer can be reinitialized. setup_timer() must be done once, no matter how many time mod_timer() is called. br_multicast_new_group() is the right place to do this. Reported-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com> Diagnosed-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Eric Dumazet <edumazet@google.com> Tested-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com> Cc: Cong Wang <amwang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19sysctl net: Keep tcp_syn_retries inside the boundaryMichal Tesar
Limit the min/max value passed to the /proc/sys/net/ipv4/tcp_syn_retries. Signed-off-by: Michal Tesar <mtesar@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19arcnet: cleanup sizeof parameterDan Carpenter
This patch doesn't change the compiled code because ARC_HDR_SIZE is 4 and sizeof(int) is 4, but the intent was to use the header size and not the sizeof the header size. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19veth: add vlan featuresFlavio Leitner
The veth device doesn't provide the vlan features, so TSO for example is disabled and that causes performance issues when using tagged traffic. The test topology looks like this: br0 br1 / \ / \ vnet veth0.10 ----- veth1.10 vnet VM VM The netperf results with current veth driver: MIGRATED TCP STREAM TEST from 192.168.1.1 () port 0 AF_INET to 192.168.1.2 () port 0 AF_INET Recv Send Send Socket Socket Message Elapsed Size Size Size Time Throughput bytes bytes bytes secs. 10^6bits/sec 87380 16384 16384 10.01 2210.22 Now after applying the proposed patch: MIGRATED TCP STREAM TEST from 192.168.1.1 () port 0 AF_INET to 192.168.1.2 () port 0 AF_INET Recv Send Send Socket Socket Message Elapsed Size Size Size Time Throughput bytes bytes bytes secs. 10^6bits/sec 87380 16384 16384 10.00 13067.47 Signed-off-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19qlcnic: Fix guest VLANManish Chopra
o Clear cached vport vlan variable(vp->vlan) in PF on PCI FLR and back-channel termination which will allow to configure guest VLAN on VF after force off/shut down the guest VM. Signed-off-by: Manish Chopra <manish.chopra@qlogic.com> Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19qlcnic: Fix releasing of Tx frag which was never mapped.Jitendra Kalsaria
o Driver was freeing Tx frag which was never mapped before which result into panic as kernel was unable to handle paging request. BUG: unable to handle kernel paging request at ffffc9002552a000 IP: [<ffffffffa05ed762>] qlcnic_release_tx_buffers+0x72/0x170 [qlcnic] PGD 87fc15067 PUD 47febf067 PMD 4758c5067 PTE 0 Oops: 0000 [#1] SMP crash> bt PID: 27343 TASK: ffff8802a5de8080 CPU: 27 COMMAND: "ifconfig" [ffff8802a34b3850] machine_kexec at ffffffff81035b7b [ffff8802a34b38b0] crash_kexec at ffffffff810c0db2 [ffff8802a34b3980] oops_end at ffffffff815111d0 [ffff8802a34b39b0] no_context at ffffffff81046bfb [ffff8802a34b3a00] __bad_area_nosemaphore at ffffffff81046e85 [ffff8802a34b3a50] bad_area_nosemaphore at ffffffff81046f53 [ffff8802a34b3a60] __do_page_fault at ffffffff810476b1 [ffff8802a34b3b80] do_page_fault at ffffffff8151311e [ffff8802a34b3bb0] page_fault at ffffffff815104d5 [exception RIP: qlcnic_release_tx_buffers+114] RIP: ffffffffa05ed762 RSP: ffff8802a34b3c68 RFLAGS: 00010246 RAX: ffff88087989c000 RBX: ffffc90025529ff8 RCX: 0000000000000001 RDX: 0000000000000013 RSI: 0000000000000013 RDI: 0000000000000000 RBP: ffff8802a34b3ca8 R8: 0000000000000000 R9: 0000000000000000 R10: 000000000000000c R11: 0000000000000000 R12: 0000000000000012 R13: ffffc90025529ec0 R14: ffff880761e876e0 R15: 00000000000003ff ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 [ffff8802a34b3cb0] __qlcnic_down at ffffffffa05e8b15 [qlcnic] [ffff8802a34b3d00] qlcnic_close at ffffffffa05e8b78 [qlcnic] [ffff8802a34b3d10] dev_close at ffffffff81449d81 [ffff8802a34b3d30] dev_change_flags at ffffffff814495c1 Signed-off-by: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com> Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19qlcnic: Fix dump template version maskShahed Shaikh
Driver was using wrong mask for template version. Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com> Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19qlcnic: Fix ethtool display for 83xx adapter.Himanshu Madhani
o Commit b938662d88264c1a92611ca1b82fdff5a4e87121 ("qlcnic: Fix ethtool supported port status for 83xx") introduced regression for display of link status for 83xx adapter while refactoring port status display. This patch is to fix the link status display for 83xx adapter. Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com> Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19qlcnic: Fix panic while setting VF's MAC addressManish Chopra
o "qlcnic_sriov" structure pointer should be accessed only when SR-IOV is enabled. Access this pointer after SR-IOV PF check. Signed-off-by: Manish Chopra <manish.chopra@qlogic.com> Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19qlcnic: Fix multicast packet handling for PF and VF.Sucheta Chakraborty
o Multicast MAC was not getting programmed due to which multicast packets were being dropped by FW. This patch fixes commit 168e4fb54c11865668ad50eff81b5f2729e0e0f4 ("qlcnic: Secondary unicast MAC address support.") which introduced bug in handling multicast packets. Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19qlcnic: Fix NULL pointer dereference in VF probe path.Sucheta Chakraborty
o Check for non-NULL set_mac_filter_count function pointer before calling it fixes the panic. This patch fixes regression introduced by patch "qlcnic: Secondary unicast MAC address support." with commit id 168e4fb54c11865668ad50eff81b5f2729e0e0f4. Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19qlcnic: Set __QLCNIC_DEV_UP in adapter state before enabling interruptsPratik Pujar
NAPI poll function does not re-enable the interrupt, if __QLCNIC_DEV_UP is not set in adapter state. This was preventing driver from receiving any packet. Signed-off-by: Pratik Pujar <pratik.pujar@qlogic.com> Signed-off-by: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com> Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19qlcnic: Fix invalid register offset calculationShahed Shaikh
83xx adapter specific code was accessing 82xx register which resulted in invalid register offset. This patch uses proper register access method. Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com> Signed-off-by: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com> Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19vxlan: fix igmp racesstephen hemminger
There are two race conditions in existing code for doing IGMP management in workqueue in vxlan. First, the vxlan_group_used function checks the list of vxlan's without any protection, and it is possible for open followed by close to occur before the igmp work queue runs. To solve these move the check into vxlan_open/stop so it is protected by RTNL. And split into two work structures so that there is no racy reference to underlying device state. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19vxlan: unregister on namespace exitstephen hemminger
Fix memory leaks and other badness from VXLAN network namespace teardown. When network namespace is removed, all the vxlan devices should be unregistered (not closed). Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Reviewed-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-19Merge branch 'master' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2013-07-19can: usb_8dev: fix urb leak on failure path in usb_8dev_start()Alexey Khoroshilov
If usb_8dev_start() fails to submit urb, it unanchors the urb but forgets to free it. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2013-07-19net: can: esd_usb2: check index of array before accessingMaximilian Schneider
The esd_usb2_read_bulk_callback() function is parsing the data that comes from the USB CAN adapter. One datum is used as an index to access the dev->nets[] array. This patch adds the missing bounds checking. Acked-by: Matthias Fuchs <matthias.fuchs@esd.eu> Signed-off-by: Maximilian Schneider <max@schneidersoft.net> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2013-07-18Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds
Pull networking fixes from David Miller: "A couple interesting SKB fragment handling fixes, plus the usual small bits here and there: 1) Fix 64-bit divide build failure on 32-bit platforms in mlx5, from Tim Gardner. 2) Get rid of a stupid reimplementation on "%*phC" in our sysfs MAC address printing helper. 3) Fix NETIF_F_SG capability advertisement in hyperv driver, if the device can't do checksumming offloads then it shouldn't say it can do SG either. From Haiyang Zhang. 4) bgmac needs to depend on PHYLIB, from Hauke Mehrtens. 5) Don't leak DMA mappings on mapping failures, from Neil Horman. 6) We need to reset the transport header of SKBs in ipv4 before we attempt to perform early socket demux, just like ipv6 does. From Eric Dumazet. 7) Add missing locking on vxlan device removal, from Stephen Hemminger. 8) xen-netfront has to make two passes over an SKB to prepare it for transfer. One pass calculates the number of slots needed, the second massages the SKB and fills the slots. Unfortunately, the first pass doesn't calculate the number of slots properly so we can end up trying to build a MAX_SKB_FRAGS + 1 SKB which doesn't work out so well. Fix from Jan Beulich with help and discussion with several others. 9) Fix a similar problem in tun and macvtap, which have to split up scatter-gather elements at PAGE_SIZE boundaries. Don't do zerocopy if it would result in a > MAX_SKB_FRAGS skb. Fixes from Jason Wang. 10) On receive, once we've decoded the VLAN state completely, clear skb->vlan_tci. Otherwise demuxed tunnels underneath can trigger the VLAN code again, corrupting the packet. Fix from Eric Dumazet" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: vlan: fix a race in egress prio management vlan: mask vlan prio bits macvtap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS tuntap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS pkt_sched: sch_qfq: remove a source of high packet delay/jitter xen-netfront: pull on receive skb may need to happen earlier vxlan: add necessary locking on device removal hyperv: Fix the NETIF_F_SG flag setting in netvsc net: Fix sysfs_format_mac() code duplication. be2net: Fix to avoid hardware workaround when not needed macvtap: do not assume 802.1Q when send vlan packets macvtap: fix the missing ret value of TUNSETQUEUE ipv4: set transport header earlier mlx5 core: Fix __udivdi3 when compiling for 32 bit arches bgmac: add dependency to phylib net/irda: fixed style issues in irlan_eth ethtool: fixed trailing statements in ethtool ndisc: bool initializations should use true and false atl1e: unmap partially mapped skb on dma error and free skb
2013-07-18Merge branch 'x86-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Peter Anvin: "Trying again to get the fixes queue, including the fixed IDT alignment patch. The UEFI patch is by far the biggest issue at hand: it is currently causing quite a few machines to boot. Which is sad, because the only reason they would is because their BIOSes touch memory that has already been freed. The other major issue is that we finally have tracked down the root cause of a significant number of machines failing to suspend/resume" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86: Make sure IDT is page aligned x86, suspend: Handle CPUs which fail to #GP on RDMSR x86/platform/ce4100: Add header file for reboot type Revert "UEFI: Don't pass boot services regions to SetVirtualAddressMap()" efivars: check for EFI_RUNTIME_SERVICES
2013-07-18Merge tag 'md-3.11-fixes' of git://neil.brown.name/mdLinus Torvalds
Pull md bug fixes from NeilBrown: "Sorry boss, back at work now boss. Here's them nice shiny patches ya wanted. All nicely tagged and justified for -stable and everyfing: Three bug fixes for md in 3.10 3.10 wasn't a good release for md. The bio changes left a couple of bugs, and an md "fix" created another one. These three patches appear to fix the issues and have been tagged for -stable" * tag 'md-3.11-fixes' of git://neil.brown.name/md: md/raid1: fix bio handling problems in process_checks() md: Remove recent change which allows devices to skip recovery. md/raid10: fix two problems with RAID10 resync.
2013-07-18Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
Pull drm fixes from Dave Airlie: "You'll be terribly disappointed in this, I'm not trying to sneak any features in or anything, its mostly radeon and intel fixes, a couple of ARM driver fixes" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (34 commits) drm/radeon/dpm: add debugfs support for RS780/RS880 (v3) drm/radeon/dpm/atom: fix broken gcc harder drm/radeon/dpm/atom: restructure logic to work around a compiler bug drm/radeon/dpm: fix atom vram table parsing drm/radeon: fix an endian bug in atom table parsing drm/radeon: add a module parameter to disable aspm drm/rcar-du: Use the GEM PRIME helpers drm/shmobile: Use the GEM PRIME helpers uvesafb: Really allow mtrr being 0, as documented and warn()ed radeon kms: do not flush uninitialized hotplug work drm/radeon/dpm/sumo: handle boost states properly when forcing a perf level drm/radeon: align VM PTBs (Page Table Blocks) to 32K drm/radeon: allow selection of alignment in the sub-allocator drm/radeon: never unpin UVD bo v3 drm/radeon: fix UVD fence emit drm/radeon: add fault decode function for CIK drm/radeon: add fault decode function for SI (v2) drm/radeon: add fault decode function for cayman/TN (v2) drm/radeon: use radeon device for request firmware drm/radeon: add missing ttm_eu_backoff_reservation to radeon_bo_list_validate ...
2013-07-18ath9k_hw: Fix multicast search for AR9002 familySujith Manoharan
The multicast search bit is disabled for the AR9003 family, but this is required for AR9002 too. Fix this in the INI override routine. Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>