1. 12 9月, 2015 2 次提交
    • A
      irda: ali-ircc: Fix deadlock in ali_ircc_sir_change_speed() · e8684c88
      Alexey Khoroshilov 提交于
      ali_ircc_sir_change_speed() is always called with self->lock held,
      so acquiring the lock inside it leads to unavoidable deadlock.
      
      Call graph:
      ali_ircc_sir_change_speed() is called from ali_ircc_change_speed()
        ali_ircc_fir_hard_xmit() under spin_lock_irqsave(&self->lock, flags);
        ali_ircc_sir_hard_xmit() under spin_lock_irqsave(&self->lock, flags);
        ali_ircc_net_ioctl() under spin_lock_irqsave(&self->lock, flags);
        ali_ircc_dma_xmit_complete()
          ali_ircc_fir_interrupt()
            ali_ircc_interrupt() under spin_lock(&self->lock);
        ali_ircc_sir_write_wakeup()
          ali_ircc_sir_interrupt()
            ali_ircc_interrupt() under spin_lock(&self->lock);
      
      The patch removes spin_lock/unlock from ali_ircc_sir_change_speed().
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e8684c88
    • A
      bnx2x: use ktime_get_seconds() for timestamp · a19a19de
      Arnd Bergmann 提交于
      commit c48f350f "bnx2x: Add MFW dump support" added the
      bnx2x_update_mfw_dump() function that reads the current time and stores
      it in a 32-bit field that gets passed into a buffer in a fixed format.
      
      This is potentially broken when the epoch overflows in 2038, and
      otherwise overflows in 2106. As we're trying to avoid uses of
      struct timeval for this reason, I noticed the addition of this
      function, and tried to rewrite it in a way that is more explicit
      about the overflow and that will keep working once we deprecate
      struct timeval.
      
      I assume that it is not possible to change the ABI any more, otherwise
      we should try to use a 64-bit field for the seconds right away.
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Cc: Yuval Mintz <Yuval.Mintz@qlogic.com>
      Cc: Ariel Elior <Ariel.Elior@qlogic.com>
      Acked-by: NYuval Mintz <Yuval.Mintz@qlogic.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a19a19de
  2. 11 9月, 2015 4 次提交
  3. 10 9月, 2015 16 次提交
  4. 09 9月, 2015 4 次提交
    • B
      dm9000: fix a typo · 7b901873
      Barry Song 提交于
      Signed-off-by: NBarry Song <Baohua.Song@csr.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7b901873
    • F
      net: dsa: bcm_sf2: Fix ageing conditions and operation · 39797a27
      Florian Fainelli 提交于
      The comparison check between cur_hw_state and hw_state is currently
      invalid because cur_hw_state is right shifted by G_MISTP_SHIFT, while
      hw_state is not, so we end-up comparing bits 2:0 with bits 7:5, which is
      going to cause an additional aging to occur. Fix this by not shifting
      cur_hw_state while reading it, but instead, mask the value with the
      appropriately shitfted bitmask.
      
      The other problem with the fast-ageing process is that we did not set
      the EN_AGE_DYNAMIC bit to request the ageing to occur for dynamically
      learned MAC addresses. Finally, write back 0 to the FAST_AGE_CTRL
      register to avoid leaving spurious bits sets from one operation to the
      other.
      
      Fixes: 12f460f2 ("net: dsa: bcm_sf2: add HW bridging support")
      Signed-off-by: NFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      39797a27
    • E
      usbnet: Fix a race between usbnet_stop() and the BH · fcb0bb6a
      Eugene Shatokhin 提交于
      The race may happen when a device (e.g. YOTA 4G LTE Modem) is
      unplugged while the system is downloading a large file from the Net.
      
      Hardware breakpoints and Kprobes with delays were used to confirm that
      the race does actually happen.
      
      The race is on skb_queue ('next' pointer) between usbnet_stop()
      and rx_complete(), which, in turn, calls usbnet_bh().
      
      Here is a part of the call stack with the code where the changes to the
      queue happen. The line numbers are for the kernel 4.1.0:
      
      *0 __skb_unlink (skbuff.h:1517)
          prev->next = next;
      *1 defer_bh (usbnet.c:430)
          spin_lock_irqsave(&list->lock, flags);
          old_state = entry->state;
          entry->state = state;
          __skb_unlink(skb, list);
          spin_unlock(&list->lock);
          spin_lock(&dev->done.lock);
          __skb_queue_tail(&dev->done, skb);
          if (dev->done.qlen == 1)
              tasklet_schedule(&dev->bh);
          spin_unlock_irqrestore(&dev->done.lock, flags);
      *2 rx_complete (usbnet.c:640)
          state = defer_bh(dev, skb, &dev->rxq, state);
      
      At the same time, the following code repeatedly checks if the queue is
      empty and reads these values concurrently with the above changes:
      
      *0  usbnet_terminate_urbs (usbnet.c:765)
          /* maybe wait for deletions to finish. */
          while (!skb_queue_empty(&dev->rxq)
              && !skb_queue_empty(&dev->txq)
              && !skb_queue_empty(&dev->done)) {
                  schedule_timeout(msecs_to_jiffies(UNLINK_TIMEOUT_MS));
                  set_current_state(TASK_UNINTERRUPTIBLE);
                  netif_dbg(dev, ifdown, dev->net,
                        "waited for %d urb completions\n", temp);
          }
      *1  usbnet_stop (usbnet.c:806)
          if (!(info->flags & FLAG_AVOID_UNLINK_URBS))
              usbnet_terminate_urbs(dev);
      
      As a result, it is possible, for example, that the skb is removed from
      dev->rxq by __skb_unlink() before the check
      "!skb_queue_empty(&dev->rxq)" in usbnet_terminate_urbs() is made. It is
      also possible in this case that the skb is added to dev->done queue
      after "!skb_queue_empty(&dev->done)" is checked. So
      usbnet_terminate_urbs() may stop waiting and return while dev->done
      queue still has an item.
      
      Locking in defer_bh() and usbnet_terminate_urbs() was revisited to avoid
      this race.
      Signed-off-by: NEugene Shatokhin <eugene.shatokhin@rosalab.ru>
      Reviewed-by: NBjørn Mork <bjorn@mork.no>
      Acked-by: NOliver Neukum <oneukum@suse.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fcb0bb6a
    • J
      xen: Use correctly the Xen memory terminologies · 0df4f266
      Julien Grall 提交于
      Based on include/xen/mm.h [1], Linux is mistakenly using MFN when GFN
      is meant, I suspect this is because the first support for Xen was for
      PV. This resulted in some misimplementation of helpers on ARM and
      confused developers about the expected behavior.
      
      For instance, with pfn_to_mfn, we expect to get an MFN based on the name.
      Although, if we look at the implementation on x86, it's returning a GFN.
      
      For clarity and avoid new confusion, replace any reference to mfn with
      gfn in any helpers used by PV drivers. The x86 code will still keep some
      reference of pfn_to_mfn which may be used by all kind of guests
      No changes as been made in the hypercall field, even
      though they may be invalid, in order to keep the same as the defintion
      in xen repo.
      
      Note that page_to_mfn has been renamed to xen_page_to_gfn to avoid a
      name to close to the KVM function gfn_to_page.
      
      Take also the opportunity to simplify simple construction such
      as pfn_to_mfn(page_to_pfn(page)) into xen_page_to_gfn. More complex clean up
      will come in follow-up patches.
      
      [1] http://xenbits.xen.org/gitweb/?p=xen.git;a=commitdiff;h=e758ed14f390342513405dd766e874934573e6cbSigned-off-by: NJulien Grall <julien.grall@citrix.com>
      Reviewed-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>
      Acked-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
      Acked-by: NWei Liu <wei.liu2@citrix.com>
      Signed-off-by: NDavid Vrabel <david.vrabel@citrix.com>
      0df4f266
  5. 07 9月, 2015 6 次提交
  6. 06 9月, 2015 3 次提交
  7. 04 9月, 2015 1 次提交
  8. 03 9月, 2015 4 次提交
    • A
      MIPS: Remove all the uses of custom gpio.h · 832f5dac
      Alban Bedel 提交于
      Currently CONFIG_ARCH_HAVE_CUSTOM_GPIO_H is defined for all MIPS
      machines, and each machine type provides its own gpio.h. However
      only a handful really implement the GPIO API, most just forward
      everythings to gpiolib.
      
      The Alchemy machine is notable as it provides a system to allow
      implementing the GPIO API at the board level. But it is not used by
      any board currently supported, so it can also be removed.
      
      For most machine types we can just remove the custom gpio.h, as well
      as the custom wrappers if some exists. Some of the code found in
      the wrappers must be moved to the respective GPIO driver.
      
      A few more fixes are need in some drivers as they rely on linux/gpio.h
      to provides some machine specific definitions, or used asm/gpio.h
      instead of linux/gpio.h for the gpio API.
      Signed-off-by: NAlban Bedel <albeu@free.fr>
      Reviewed-by: NLinus Walleij <linus.walleij@linaro.org>
      Cc: linux-mips@linux-mips.org
      Cc: Hauke Mehrtens <hauke@hauke-m.de>
      Cc: Rafał Miłecki <zajec5@gmail.com>
      Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Alexandre Courbot <gnurou@gmail.com>
      Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
      Cc: Florian Fainelli <florian@openwrt.org>
      Cc: Manuel Lauss <manuel.lauss@gmail.com>
      Cc: Joe Perches <joe@perches.com>
      Cc: Daniel Walter <dwalter@google.com>
      Cc: Sergey Ryazanov <ryazanov.s.a@gmail.com>
      Cc: Huacai Chen <chenhc@lemote.com>
      Cc: James Hartley <james.hartley@imgtec.com>
      Cc: Andrew Bresticker <abrestic@chromium.org>
      Cc: Paul Burton <paul.burton@imgtec.com>
      Cc: Jiri Kosina <jkosina@suse.cz>
      Cc: Bjorn Helgaas <bhelgaas@google.com>
      Cc: Wolfram Sang <wsa@the-dreams.de>
      Cc: Randy Dunlap <rdunlap@infradead.org>
      Cc: Varka Bhadram <varkabhadram@gmail.com>
      Cc: Masanari Iida <standby24x7@gmail.com>
      Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
      Cc: Michael Buesch <m@bues.ch>
      Cc: abdoulaye berthe <berthe.ab@gmail.com>
      Cc: linux-kernel@vger.kernel.org
      Cc: linux-ide@vger.kernel.org
      Cc: linux-gpio@vger.kernel.org
      Cc: linux-input@vger.kernel.org
      Cc: netdev@vger.kernel.org
      Patchwork: https://patchwork.linux-mips.org/patch/10828/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      832f5dac
    • R
      net: fec: clear receive interrupts before processing a packet · ed63f1dc
      Russell King 提交于
      The patch just to re-submit the patch "db3421c1" because the
      patch "4d494cdc" remove the change.
      
      Clear any pending receive interrupt before we process a pending packet.
      This helps to avoid any spurious interrupts being raised after we have
      fully cleaned the receive ring, while still allowing an interrupt to be
      raised if we receive another packet.
      
      The position of this is critical: we must do this prior to reading the
      next packet status to avoid potentially dropping an interrupt when a
      packet is still pending.
      Acked-by: NFugang Duan <B38611@freescale.com>
      Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ed63f1dc
    • P
      xen-netback: add support for multicast control · 210c34dc
      Paul Durrant 提交于
      Xen's PV network protocol includes messages to add/remove ethernet
      multicast addresses to/from a filter list in the backend. This allows
      the frontend to request the backend only forward multicast packets
      which are of interest thus preventing unnecessary noise on the shared
      ring.
      
      The canonical netif header in git://xenbits.xen.org/xen.git specifies
      the message format (two more XEN_NETIF_EXTRA_TYPEs) so the minimal
      necessary changes have been pulled into include/xen/interface/io/netif.h.
      
      To prevent the frontend from extending the multicast filter list
      arbitrarily a limit (XEN_NETBK_MCAST_MAX) has been set to 64 entries.
      This limit is not specified by the protocol and so may change in future.
      If the limit is reached then the next XEN_NETIF_EXTRA_TYPE_MCAST_ADD
      sent by the frontend will be failed with NETIF_RSP_ERROR.
      Signed-off-by: NPaul Durrant <paul.durrant@citrix.com>
      Cc: Ian Campbell <ian.campbell@citrix.com>
      Cc: Wei Liu <wei.liu2@citrix.com>
      Acked-by: NWei Liu <wei.liu2@citrix.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      210c34dc
    • F
      bgmac: Update fixed_phy_register() · 4db78d31
      Fabio Estevam 提交于
      Commit a5597008 ("phy: fixed_phy: Add gpio to determine link up/down.")
      added a new argument to fixed_phy_register(), but missed to update bgmac
      driver, causing the following build failure:
      
      drivers/net/ethernet/broadcom/bgmac.c:1450:2: error: too few arguments to function 'fixed_phy_register'
      
      Add the missing argument.
      Reported-by: NMark Brown <broonie@kernel.org>
      Signed-off-by: NFabio Estevam <fabio.estevam@freescale.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4db78d31