1. 31 10月, 2016 13 次提交
  2. 30 10月, 2016 27 次提交
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 2a26d99b
      Linus Torvalds 提交于
      Pull networking fixes from David Miller:
       "Lots of fixes, mostly drivers as is usually the case.
      
         1) Don't treat zero DMA address as invalid in vmxnet3, from Alexey
            Khoroshilov.
      
         2) Fix element timeouts in netfilter's nft_dynset, from Anders K.
            Pedersen.
      
         3) Don't put aead_req crypto struct on the stack in mac80211, from
            Ard Biesheuvel.
      
         4) Several uninitialized variable warning fixes from Arnd Bergmann.
      
         5) Fix memory leak in cxgb4, from Colin Ian King.
      
         6) Fix bpf handling of VLAN header push/pop, from Daniel Borkmann.
      
         7) Several VRF semantic fixes from David Ahern.
      
         8) Set skb->protocol properly in ip6_tnl_xmit(), from Eli Cooper.
      
         9) Socket needs to be locked in udp_disconnect(), from Eric Dumazet.
      
        10) Div-by-zero on 32-bit fix in mlx4 driver, from Eugenia Emantayev.
      
        11) Fix stale link state during failover in NCSCI driver, from Gavin
            Shan.
      
        12) Fix netdev lower adjacency list traversal, from Ido Schimmel.
      
        13) Propvide proper handle when emitting notifications of filter
            deletes, from Jamal Hadi Salim.
      
        14) Memory leaks and big-endian issues in rtl8xxxu, from Jes Sorensen.
      
        15) Fix DESYNC_FACTOR handling in ipv6, from Jiri Bohac.
      
        16) Several routing offload fixes in mlxsw driver, from Jiri Pirko.
      
        17) Fix broadcast sync problem in TIPC, from Jon Paul Maloy.
      
        18) Validate chunk len before using it in SCTP, from Marcelo Ricardo
            Leitner.
      
        19) Revert a netns locking change that causes regressions, from Paul
            Moore.
      
        20) Add recursion limit to GRO handling, from Sabrina Dubroca.
      
        21) GFP_KERNEL in irq context fix in ibmvnic, from Thomas Falcon.
      
        22) Avoid accessing stale vxlan/geneve socket in data path, from
            Pravin Shelar"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (189 commits)
        geneve: avoid using stale geneve socket.
        vxlan: avoid using stale vxlan socket.
        qede: Fix out-of-bound fastpath memory access
        net: phy: dp83848: add dp83822 PHY support
        enic: fix rq disable
        tipc: fix broadcast link synchronization problem
        ibmvnic: Fix missing brackets in init_sub_crq_irqs
        ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context
        Revert "ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context"
        arch/powerpc: Update parameters for csum_tcpudp_magic & csum_tcpudp_nofold
        net/mlx4_en: Save slave ethtool stats command
        net/mlx4_en: Fix potential deadlock in port statistics flow
        net/mlx4: Fix firmware command timeout during interrupt test
        net/mlx4_core: Do not access comm channel if it has not yet been initialized
        net/mlx4_en: Fix panic during reboot
        net/mlx4_en: Process all completions in RX rings after port goes up
        net/mlx4_en: Resolve dividing by zero in 32-bit system
        net/mlx4_core: Change the default value of enable_qos
        net/mlx4_core: Avoid setting ports to auto when only one port type is supported
        net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec
        ...
      2a26d99b
    • S
      firewire: net: really fix maximum possible MTU · 357f4aae
      Stefan Richter 提交于
      The maximum unicast datagram size /without/ link fragmentation is
      4096 - 4 = 4092 (max IEEE 1394 async payload size at >= S800 bus speed,
      minus unfragmented encapssulation header).  Max broadcast datagram size
      without fragmentation is 8 bytes less than that (due to GASP header).
      
      The maximum datagram size /with/ link fragmentation is 0xfff = 4095
      for unicast and broadcast.  This is because the RFC 2734 fragment
      encapsulation header field for datagram size is only 12 bits wide.
      
      Fixes: 5d48f00d('firewire: net: fix maximum possible MTU')
      Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      357f4aae
    • P
      genetlink: Fix generic netlink family unregister · 0e82c763
      pravin shelar 提交于
      This patch fixes a typo in unregister operation.
      
      Following crash is fixed by this patch. It can be easily reproduced
      by repeating modprobe and rmmod module that uses genetlink.
      
      [  261.446686] BUG: unable to handle kernel paging request at ffffffffa0264088
      [  261.448921] IP: [<ffffffff813cb70e>] strcmp+0xe/0x30
      [  261.450494] PGD 1c09067
      [  261.451266] PUD 1c0a063
      [  261.452091] PMD 8068d5067
      [  261.452525] PTE 0
      [  261.453164]
      [  261.453618] Oops: 0000 [#1] SMP
      [  261.454577] Modules linked in: openvswitch(+) ...
      [  261.480753] RIP: 0010:[<ffffffff813cb70e>]  [<ffffffff813cb70e>] strcmp+0xe/0x30
      [  261.483069] RSP: 0018:ffffc90003c0bc28  EFLAGS: 00010282
      [  261.510145] Call Trace:
      [  261.510896]  [<ffffffff816f10ca>] genl_family_find_byname+0x5a/0x70
      [  261.512819]  [<ffffffff816f2319>] genl_register_family+0xb9/0x630
      [  261.514805]  [<ffffffffa02840bc>] dp_init+0xbc/0x120 [openvswitch]
      [  261.518268]  [<ffffffff8100217d>] do_one_initcall+0x3d/0x160
      [  261.525041]  [<ffffffff811808a9>] do_init_module+0x60/0x1f1
      [  261.526754]  [<ffffffff8110687f>] load_module+0x22af/0x2860
      [  261.530144]  [<ffffffff81107026>] SYSC_finit_module+0x96/0xd0
      [  261.531901]  [<ffffffff8110707e>] SyS_finit_module+0xe/0x10
      [  261.533605]  [<ffffffff8100391e>] do_syscall_64+0x6e/0x180
      [  261.535284]  [<ffffffff817c2faf>] entry_SYSCALL64_slow_path+0x25/0x25
      [  261.546512] RIP  [<ffffffff813cb70e>] strcmp+0xe/0x30
      [  261.550198] ---[ end trace 76505a814dd68770 ]---
      
      Fixes: 2ae0f17d ("genetlink: use idr to track families").
      Reported-by: NJarno Rajahalme <jarno@ovn.org>
      CC: Johannes Berg <johannes@sipsolutions.net>
      Signed-off-by: NPravin B Shelar <pshelar@ovn.org>
      Reviewed-by: NJohannes Berg <johannes@sipsolutions.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0e82c763
    • P
      geneve: avoid using stale geneve socket. · fceb9c3e
      pravin shelar 提交于
      This patch is similar to earlier vxlan patch.
      Geneve device close operation frees geneve socket. This
      operation can race with geneve-xmit function which
      dereferences geneve socket. Following patch uses RCU
      mechanism to avoid this situation.
      Signed-off-by: NPravin B Shelar <pshelar@ovn.org>
      Acked-by: NJohn W. Linville <linville@tuxdriver.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fceb9c3e
    • P
      vxlan: avoid using stale vxlan socket. · c6fcc4fc
      pravin shelar 提交于
      When vxlan device is closed vxlan socket is freed. This
      operation can race with vxlan-xmit function which
      dereferences vxlan socket. Following patch uses RCU
      mechanism to avoid this situation.
      Signed-off-by: NPravin B Shelar <pshelar@ovn.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c6fcc4fc
    • M
      qede: Fix out-of-bound fastpath memory access · 087892d2
      Mintz, Yuval 提交于
      Driver allocates a shadow array for transmitted SKBs with X entries;
      That means valid indices are {0,...,X - 1}. [X == 8191]
      Problem is the driver also uses X as a mask for a
      producer/consumer in order to choose the right entry in the
      array which allows access to entry X which is out of bounds.
      
      To fix this, simply allocate X + 1 entries in the shadow array.
      Signed-off-by: NYuval Mintz <Yuval.Mintz@cavium.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      087892d2
    • R
    • D
      Merge tag 'mac80211-next-for-davem-2016-10-28' of... · 32ab0a38
      David S. Miller 提交于
      Merge tag 'mac80211-next-for-davem-2016-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next
      
      Johannes Berg says:
      
      ====================
      Among various cleanups and improvements, we have the following:
       * client FILS authentication support in mac80211 (Jouni)
       * AP/VLAN multicast improvements (Michael Braun)
       * config/advertising support for differing beacon intervals on
         multiple virtual interfaces (Purushottam Kushwaha, myself)
       * deprecate the old WDS mode for cfg80211-based drivers, the
         mode is hardly usable since it doesn't support any "modern"
         features like WPA encryption (2003), HT (2009) or VHT (2014),
         I'm not even sure WEP (introduced in 1997) could be done.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      32ab0a38
    • R
      net: phy: dp83848: add dp83822 PHY support · 30347834
      Roger Quadros 提交于
      This PHY has a compatible register set with DP83848x so
      add support for it.
      Acked-by: NAndrew F. Davis <afd@ti.com>
      Signed-off-by: NRoger Quadros <rogerq@ti.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      30347834
    • G
      enic: fix rq disable · 9fe1c98a
      Govindarajulu Varadarajan 提交于
      When MTU is changed from 9000 to 1500 while there is burst of inbound 9000
      bytes packets, adaptor sometimes delivers 9000 bytes packets to 1500 bytes
      buffers. This causes memory corruption and sometimes crash.
      
      This is because of a race condition in adaptor between "RQ disable"
      clearing descriptor mini-cache and mini-cache valid bit being set by
      completion of descriptor fetch. This can result in stale RQ desc being
      cached and used when packets arrive. In this case, the stale descriptor
      have old MTU value.
      
      Solution is to write RQ->disable twice. The first write will stop any
      further desc fetches, allowing the second disable to clear the mini-cache
      valid bit without danger of a race.
      
      Also, the check for rq->running becoming 0 after writing rq->enable to 0
      is not done properly. When incoming packets are flooding the interface,
      rq->running will pulse high for each dropped packet. Since the driver was
      waiting for 10us between each poll, it is possible to see rq->running = 1
      1000 times in a row, even though it is not actually stuck running.
      This results in false failure of vnic_rq_disable(). Fix is to try more
      than 1000 time without delay between polls to ensure we do not miss when
      running goes low.
      
      In old adaptors rq->enable needs to be re-written to 0 when posted_index
      is reset in vnic_rq_clean() in order to keep rq->prefetch_index in sync.
      Signed-off-by: NGovindarajulu Varadarajan <_govind@gmx.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9fe1c98a
    • J
      tipc: fix broadcast link synchronization problem · 06bd2b1e
      Jon Paul Maloy 提交于
      In commit 2d18ac4b ("tipc: extend broadcast link initialization
      criteria") we tried to fix a problem with the initial synchronization
      of broadcast link acknowledge values. Unfortunately that solution is
      not sufficient to solve the issue.
      
      We have seen it happen that LINK_PROTOCOL/STATE packets with a valid
      non-zero unicast acknowledge number may bypass BCAST_PROTOCOL
      initialization, NAME_DISTRIBUTOR and other STATE packets with invalid
      broadcast acknowledge numbers, leading to premature opening of the
      broadcast link. When the bypassed packets finally arrive, they are
      inadvertently accepted, and the already correctly initialized
      acknowledge number in the broadcast receive link is overwritten by
      the invalid (zero) value of the said packets. After this the broadcast
      link goes stale.
      
      We now fix this by marking the packets where we know the acknowledge
      value is or may be invalid, and then ignoring the acks from those.
      
      To this purpose, we claim an unused bit in the header to indicate that
      the value is invalid. We set the bit to 1 in the initial BCAST_PROTOCOL
      synchronization packet and all initial ("bulk") NAME_DISTRIBUTOR
      packets, plus those LINK_PROTOCOL packets sent out before the broadcast
      links are fully synchronized.
      
      This minor protocol update is fully backwards compatible.
      Reported-by: NJohn Thompson <thompa.atl@gmail.com>
      Tested-by: NJohn Thompson <thompa.atl@gmail.com>
      Signed-off-by: NJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      06bd2b1e
    • T
    • T
      ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context · 9888d7b0
      Thomas Falcon 提交于
      Schedule these XPORT event tasks in the shared workqueue
      so that IRQs are not freed in an interrupt context when
      sub-CRQs are released.
      Signed-off-by: NThomas Falcon <tlfalcon@linux.vnet.ibm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9888d7b0
    • D
      Revert "ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context" · dbc34e73
      David S. Miller 提交于
      This reverts commit 8d7533e5.
      
      It introduced kbuild failures, new version coming.
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      dbc34e73
    • J
      rocker: set physical device for port netdevice · 97699056
      Jiri Pirko 提交于
      Do this so the sysfs has "device" link correctly set.
      Signed-off-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      97699056
    • D
      Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue · 4c96f5b1
      David S. Miller 提交于
      Jeff Kirsher says:
      
      ====================
      Intel Wired LAN Driver Updates 2016-10-27
      
      This series contains fixes to ixgbe and i40e.
      
      Emil fixes a NULL pointer dereference when a macvlan interface is brought
      up while the PF is still down.
      
      David root caused the original panic that was fixed by commit id
      (a036244c "i40e: Fix kernel panic on enable/disable LLDP") and the
      fix was not quite correct, so removed the get_default_tc() and replaced
      it with a #define since there is only one TC supported as a default.
      
      Guilherme Piccoli fixes an issue where if we modprobe the driver module
      without enough MSI-X interrupts, then unload the module and reload it
      again, the kernel would crash.  So if we fail to allocate enough MSI-X
      interrupts, we should disable them since they were previously enabled.
      
      Huaibin Wang found that the order of the arguments for
      ndo_dflt_bridge_getlink() were in the correct order, so fix the order.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4c96f5b1
    • N
      tcp_bbr: add a state transition diagram and accompanying comment · 9b9375b5
      Neal Cardwell 提交于
      Document the possible state transitions for a BBR flow, and also add a
      prose summary of the state machine, covering the life of a typical BBR
      flow.
      Signed-off-by: NNeal Cardwell <ncardwell@google.com>
      Signed-off-by: NYuchung Cheng <ycheng@google.com>
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Signed-off-by: NSoheil Hassas Yeganeh <soheil@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9b9375b5
    • I
      arch/powerpc: Update parameters for csum_tcpudp_magic & csum_tcpudp_nofold · f9d4286b
      Ivan Vecera 提交于
      Commit 01cfbad7 "ipv4: Update parameters for csum_tcpudp_magic to their
      original types" changed parameters for csum_tcpudp_magic and
      csum_tcpudp_nofold for many platforms but not for PowerPC.
      
      Fixes: 01cfbad7 "ipv4: Update parameters for csum_tcpudp_magic to their original types"
      Cc: Alexander Duyck <aduyck@mirantis.com>
      Signed-off-by: NIvan Vecera <ivecera@redhat.com>
      Acked-by: NAlexander Duyck <alexander.h.duyck@intel.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f9d4286b
    • L
      Linux 4.9-rc3 · a909d3e6
      Linus Torvalds 提交于
      a909d3e6
    • L
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 42fd2b50
      Linus Torvalds 提交于
      Pull x86 bugfix from Thomas Gleixner:
       "A single bugfix for the recent changes related to registering the boot
        cpu when this has not happened before prefill_possible_map().
      
        The main problem with this change got fixed already, but we missed the
        case where the local APIC is not yet mapped, when prefill_possible_map()
        is invoked, so the registration of the boot cpu which has the APIC bit
        set in CPUID will explode.
      
        I should have seen that issue earlier, but all I can do now is feeling
        embarassed"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/smpboot: Init apic mapping before usage
      42fd2b50
    • D
      Merge tag 'batadv-next-for-davem-20161027' of git://git.open-mesh.org/linux-merge · a283ad50
      David S. Miller 提交于
      Simon Wunderlich says:
      
      ====================
      This code cleanup patchset includes the following changes (chronological
      order):
      
       - bump version strings, by Simon Wunderlich
      
       - README updates/clean up, by Sven Eckelmann (4 patches)
      
       - Code clean up and restructuring by Sven Eckelmann (2 patches)
      
       - Kerneldoc fix in forw_packet structure, by Linus Luessing
      
       - Remove unused argument in dbg_arp, by Antonio Quartulli
      
       - Add support to build batman-adv without wireless, by Linus Luessing
      
       - Restructure error handling for is_ap_isolated, by Markus Elfring
      
       - Remove unused initialization in various functions, by Sven Eckelmann
      
       - Use better names for fragment and gateway list heads, by Sven
         Eckelmann (2 patches)
      
       - Convert to octal permissions for files, by Sven Eckelmann
      
       - Avoid precedence issues for some macros, by Sven Eckelmann
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a283ad50
    • D
      Merge branch 'mlx4-fixes' · e59cc767
      David S. Miller 提交于
      Tariq Toukan says:
      
      ====================
      mlx4 misc fixes for 4.9
      
      This patchset contains several bug fixes from the team to the
      mlx4 Eth and Core drivers.
      
      Series generated against net commit:
      ecc515d7 'sctp: fix the panic caused by route update'
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e59cc767
    • T
      net/mlx4_en: Save slave ethtool stats command · eb4b6788
      Tariq Toukan 提交于
      Following the previous patch, as an optimization, the slave will
      not even bother sending the DUMP_ETH_STATS command over the
      comm channel.
      Signed-off-by: NTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      eb4b6788
    • J
      net/mlx4_en: Fix potential deadlock in port statistics flow · d2582a03
      Jack Morgenstein 提交于
      mlx4_en_DUMP_ETH_STATS took the *counter mutex* and then
      called the FW command, with WRAPPED attribute. As a result, the fw command
      is wrapped on the Hypervisor when it calls mlx4_en_DUMP_ETH_STATS.
      The FW command wrapper flow on the hypervisor takes the *slave_cmd_mutex*
      during processing.
      
      At the same time, a VF could be in the process of coming up, and could
      call mlx4_QUERY_FUNC_CAP.  On the hypervisor, the command flow takes the
      *slave_cmd_mutex*, then executes mlx4_QUERY_FUNC_CAP_wrapper.
      mlx4_QUERY_FUNC_CAP wrapper calls mlx4_get_default_counter_index(),
      which takes the *counter mutex*. DEADLOCK.
      
      The fix is that the DUMP_ETH_STATS fw command should be called with
      the NATIVE attribute, so that on the hypervisor, this command does not
      enter the wrapper flow.
      
      Since the Hypervisor no longer goes through the wrapper code, we also
      simply return 0 in mlx4_DUMP_ETH_STATS_wrapper (i.e.the function succeeds,
      but the returned data will be all zeroes).
      No need to test if it is the Hypervisor going through the wrapper.
      
      Fixes: f9baff50 ("mlx4_core: Add "native" argument to mlx4_cmd ...")
      Signed-off-by: NJack Morgenstein <jackm@dev.mellanox.co.il>
      Signed-off-by: NTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d2582a03
    • E
      net/mlx4: Fix firmware command timeout during interrupt test · 6f2e0d2c
      Eugenia Emantayev 提交于
      Currently interrupt test that is part of ethtool selftest runs the
      check over all interrupt vectors of the device.
      In mlx4_en package part of interrupt vectors are uninitialized since
      mlx4_ib doesn't exist. This causes NOP FW command to time out.
      Change logic to test current port interrupt vectors only.
      Signed-off-by: NEugenia Emantayev <eugenia@mellanox.com>
      Signed-off-by: NTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      6f2e0d2c
    • J
      net/mlx4_core: Do not access comm channel if it has not yet been initialized · 81d18419
      Jack Morgenstein 提交于
      In the Hypervisor, there are several FW commands which are invoked
      before the comm channel is initialized (in mlx4_multi_func_init).
      These include MOD_STAT_CONFIG, QUERY_DEV_CAP, INIT_HCA, and others.
      
      If any of these commands fails, say with a timeout, the Hypervisor
      driver enters the internal error reset flow. In this flow, the driver
      attempts to notify all slaves via the comm channel that an internal error
      has occurred.
      
      Since the comm channel has not yet been initialized (i.e., mapped via
      ioremap), this will cause dereferencing a NULL pointer.
      
      To fix this, do not access the comm channel in the internal error flow
      if it has not yet been initialized.
      
      Fixes: 55ad3592 ("net/mlx4_core: Enable device recovery flow with SRIOV")
      Fixes: ab9c17a0 ("mlx4_core: Modify driver initialization flow to accommodate SRIOV for Ethernet")
      Signed-off-by: NJack Morgenstein <jackm@dev.mellanox.co.il>
      Signed-off-by: NTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      81d18419
    • E
      net/mlx4_en: Fix panic during reboot · 9d2afba0
      Eugenia Emantayev 提交于
      Fix a kernel panic that occurs as a result of an asynchronous event
      handled in roce_gid_mgmt:
      mlx4_en_get_drvinfo is called and accesses freed resources.
      
      This happens in a shutdown flow only, since pci device is destroyed
      while netdevice is still alive.
      
      Fixes: c27a02cd ("mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC")
      Signed-off-by: NEugenia Emantayev <eugenia@mellanox.com>
      Signed-off-by: NTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9d2afba0