1. 22 1月, 2016 2 次提交
  2. 08 1月, 2016 1 次提交
  3. 12 12月, 2015 4 次提交
  4. 04 12月, 2015 2 次提交
  5. 03 12月, 2015 5 次提交
  6. 10 11月, 2015 1 次提交
    • J
      net: mvneta: Fix memory use after free. · 8c94ddbc
      Justin Maggard 提交于
      After changing an interface's MTU, then bringing the interface down and
      back up again, I immediately saw tons of kernel messages like below.
      The reason for this bad behavior is mvneta_rxq_drop_pkts(), which calls
      dma_unmap_single() on already-freed memory.  So we need to switch the
      order of those two operations.
      
      [  152.388518] BUG: Bad page state in process ifconfig  pfn:1b518
      [  152.388526] page:dff3dbc0 count:0 mapcount:0 mapping:  (null) index:0x0
      [  152.395178] flags: 0x200(arch_1)
      [  152.398441] page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
      [  152.398446] bad because of flags:
      [  152.398450] flags: 0x200(arch_1)
      [  152.401716] Modules linked in:
      [  152.401728] CPU: 0 PID: 1453 Comm: ifconfig Tainted: P    B      O    4.1.12.armada.1 #1
      [  152.401733] Hardware name: Marvell Armada 370/XP (Device Tree)
      [  152.401749] [<c0015b1c>] (unwind_backtrace) from [<c0011d8c>] (show_stack+0x10/0x14)
      [  152.401762] [<c0011d8c>] (show_stack) from [<c06aa68c>] (dump_stack+0x74/0x90)
      [  152.401772] [<c06aa68c>] (dump_stack) from [<c0096c08>] (bad_page+0xc4/0x124)
      [  152.401783] [<c0096c08>] (bad_page) from [<c0099378>] (get_page_from_freelist+0x4e4/0x644)
      [  152.401794] [<c0099378>] (get_page_from_freelist) from [<c0099620>] (__alloc_pages_nodemask+0x148/0x784)
      [  152.401805] [<c0099620>] (__alloc_pages_nodemask) from [<c00ac658>] (kmalloc_order+0x10/0x20)
      [  152.401818] [<c00ac658>] (kmalloc_order) from [<c04c6f44>] (mvneta_rx_refill+0xc4/0xe8)
      [  152.401830] [<c04c6f44>] (mvneta_rx_refill) from [<c04c96c0>] (mvneta_setup_rxqs+0x298/0x39c)
      [  152.401842] [<c04c96c0>] (mvneta_setup_rxqs) from [<c04c9904>] (mvneta_open+0x3c/0x150)
      [  152.401853] [<c04c9904>] (mvneta_open) from [<c0597764>] (__dev_open+0xac/0x124)
      [  152.401864] [<c0597764>] (__dev_open) from [<c05979e4>] (__dev_change_flags+0x8c/0x148)
      [  152.401875] [<c05979e4>] (__dev_change_flags) from [<c0597ac0>] (dev_change_flags+0x18/0x48)
      [  152.401886] [<c0597ac0>] (dev_change_flags) from [<c060d308>] (devinet_ioctl+0x620/0x6d0)
      [  152.401897] [<c060d308>] (devinet_ioctl) from [<c057d810>] (sock_ioctl+0x64/0x288)
      [  152.401908] [<c057d810>] (sock_ioctl) from [<c00dcb7c>] (do_vfs_ioctl+0x78/0x608)
      [  152.401918] [<c00dcb7c>] (do_vfs_ioctl) from [<c00dd170>] (SyS_ioctl+0x64/0x74)
      [  152.401930] [<c00dd170>] (SyS_ioctl) from [<c000f3a0>] (ret_fast_syscall+0x0/0x3c)
      Signed-off-by: NJustin Maggard <jmaggard@netgear.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8c94ddbc
  7. 26 10月, 2015 2 次提交
  8. 30 9月, 2015 4 次提交
  9. 25 9月, 2015 1 次提交
    • R
      net: fix phy refcounting in a bunch of drivers · 04d53b20
      Russell King 提交于
      of_phy_find_device() increments the phy struct device refcount, which
      we need to properly balance.  Add code to network drivers using this
      function to ensure that the struct device refcount is correctly
      balanced.
      
      For xgene, looking back in the history, we should be able to use
      of_phy_connect() with a zero flags argument for the DT case as this is
      how the driver used to operate prior to de7b5b3d ("net: eth: xgene:
      change APM X-Gene SoC platform ethernet to support ACPI").
      
      This leaves the Cavium Thunder BGX unfixed; fixing this driver is a
      complicated task, one which the maintainers need to be involved with.
      Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      04d53b20
  10. 16 9月, 2015 1 次提交
  11. 22 7月, 2015 1 次提交
  12. 21 7月, 2015 1 次提交
    • S
      net: mvneta: fix refilling for Rx DMA buffers · a84e3289
      Simon Guinot 提交于
      With the actual code, if a memory allocation error happens while
      refilling a Rx descriptor, then the original Rx buffer is both passed
      to the networking stack (in a SKB) and let in the Rx ring. This leads
      to various kernel oops and crashes.
      
      As a fix, this patch moves Rx descriptor refilling ahead of building
      SKB with the associated Rx buffer. In case of a memory allocation
      failure, data is dropped and the original DMA buffer is put back into
      the Rx ring.
      Signed-off-by: NSimon Guinot <simon.guinot@sequanux.org>
      Fixes: c5aff182 ("net: mvneta: driver for Marvell Armada 370/XP network unit")
      Cc: <stable@vger.kernel.org> # v3.8+
      Tested-by: NYoann Sculo <yoann@sculo.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a84e3289
  13. 01 7月, 2015 2 次提交
  14. 23 6月, 2015 1 次提交
  15. 12 5月, 2015 1 次提交
  16. 07 4月, 2015 1 次提交
  17. 04 4月, 2015 1 次提交
  18. 09 12月, 2014 2 次提交
    • E
      net: mvneta: fix race condition in mvneta_tx() · 5f478b41
      Eric Dumazet 提交于
      mvneta_tx() dereferences skb to get skb->len too late,
      as hardware might have completed the transmit and TX completion
      could have freed the skb from another cpu.
      
      Fixes: 71f6d1b3 ("net: mvneta: replace Tx timer with a real interrupt")
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      5f478b41
    • W
      net: mvneta: fix Tx interrupt delay · aebea2ba
      willy tarreau 提交于
      The mvneta driver sets the amount of Tx coalesce packets to 16 by
      default. Normally that does not cause any trouble since the driver
      uses a much larger Tx ring size (532 packets). But some sockets
      might run with very small buffers, much smaller than the equivalent
      of 16 packets. This is what ping is doing for example, by setting
      SNDBUF to 324 bytes rounded up to 2kB by the kernel.
      
      The problem is that there is no documented method to force a specific
      packet to emit an interrupt (eg: the last of the ring) nor is it
      possible to make the NIC emit an interrupt after a given delay.
      
      In this case, it causes trouble, because when ping sends packets over
      its raw socket, the few first packets leave the system, and the first
      15 packets will be emitted without an IRQ being generated, so without
      the skbs being freed. And since the socket's buffer is small, there's
      no way to reach that amount of packets, and the ping ends up with
      "send: no buffer available" after sending 6 packets. Running with 3
      instances of ping in parallel is enough to hide the problem, because
      with 6 packets per instance, that's 18 packets total, which is enough
      to grant a Tx interrupt before all are sent.
      
      The original driver in the LSP kernel worked around this design flaw
      by using a software timer to clean up the Tx descriptors. This timer
      was slow and caused terrible network performance on some Tx-bound
      workloads (such as routing) but was enough to make tools like ping
      work correctly.
      
      Instead here, we simply set the packet counts before interrupt to 1.
      This ensures that each packet sent will produce an interrupt. NAPI
      takes care of coalescing interrupts since the interrupt is disabled
      once generated.
      
      No measurable performance impact nor CPU usage were observed on small
      nor large packets, including when saturating the link on Tx, and this
      fixes tools like ping which rely on too small a send buffer. If one
      wants to increase this value for certain workloads where it is safe
      to do so, "ethtool -C $dev tx-frames" will override this default
      setting.
      
      This fix needs to be applied to stable kernels starting with 3.10.
      Tested-By: NMaggie Mae Roxas <maggie.mae.roxas@gmail.com>
      Signed-off-by: NWilly Tarreau <w@1wt.eu>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      aebea2ba
  19. 01 11月, 2014 1 次提交
  20. 26 8月, 2014 2 次提交
  21. 08 8月, 2014 1 次提交
  22. 09 7月, 2014 2 次提交
    • T
      net: mvneta: Fix big endian issue in mvneta_txq_desc_csum() · 0a198587
      Thomas Fitzsimmons 提交于
      This commit fixes the command value generated for CSUM calculation
      when running in big endian mode.  The Ethernet protocol ID for IP was
      being unconditionally byte-swapped in the layer 3 protocol check (with
      swab16), which caused the mvneta driver to not function correctly in
      big endian mode.  This patch byte-swaps the ID conditionally with
      htons.
      
      Cc: <stable@vger.kernel.org> # v3.13+
      Signed-off-by: NThomas Fitzsimmons <fitzsim@fitzsim.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0a198587
    • T
      net: mvneta: fix operation in 10 Mbit/s mode · 4d12bc63
      Thomas Petazzoni 提交于
      As reported by Maggie Mae Roxas, the mvneta driver doesn't behave
      properly in 10 Mbit/s mode. This is due to a misconfiguration of the
      MVNETA_GMAC_AUTONEG_CONFIG register: bit MVNETA_GMAC_CONFIG_MII_SPEED
      must be set for a 100 Mbit/s speed, but cleared for a 10 Mbit/s speed,
      which the driver was not properly doing. This commit adjusts that by
      setting the MVNETA_GMAC_CONFIG_MII_SPEED bit only in 100 Mbit/s mode,
      and relying on the fact that all the speed related bits of this
      register are cleared at the beginning of the mvneta_adjust_link()
      function.
      
      This problem exists since c5aff182 ("net: mvneta: driver for
      Marvell Armada 370/XP network unit") which is the commit that
      introduced the mvneta driver in the kernel.
      
      Cc: <stable@vger.kernel.org> # v3.8+
      Fixes: c5aff182 ("net: mvneta: driver for Marvell Armada 370/XP network unit")
      Reported-by: NMaggie Mae Roxas <maggie.mae.roxas@gmail.com>
      Cc: Maggie Mae Roxas <maggie.mae.roxas@gmail.com>
      Signed-off-by: NThomas Petazzoni <thomas.petazzoni@free-electrons.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4d12bc63
  23. 03 6月, 2014 1 次提交