1. 09 8月, 2017 5 次提交
    • B
      qmi_wwan: fix NULL deref on disconnect · bbae08e5
      Bjørn Mork 提交于
      qmi_wwan_disconnect is called twice when disconnecting devices with
      separate control and data interfaces.  The first invocation will set
      the interface data to NULL for both interfaces to flag that the
      disconnect has been handled.  But the matching NULL check was left
      out when qmi_wwan_disconnect was added, resulting in this oops:
      
        usb 2-1.4: USB disconnect, device number 4
        qmi_wwan 2-1.4:1.6 wwp0s29u1u4i6: unregister 'qmi_wwan' usb-0000:00:1d.0-1.4, WWAN/QMI device
        BUG: unable to handle kernel NULL pointer dereference at 00000000000000e0
        IP: qmi_wwan_disconnect+0x25/0xc0 [qmi_wwan]
        PGD 0
        P4D 0
        Oops: 0000 [#1] SMP
        Modules linked in: <stripped irrelevant module list>
        CPU: 2 PID: 33 Comm: kworker/2:1 Tainted: G            E   4.12.3-nr44-normandy-r1500619820+ #1
        Hardware name: LENOVO 4291LR7/4291LR7, BIOS CBET4000 4.6-810-g50522254fb 07/21/2017
        Workqueue: usb_hub_wq hub_event [usbcore]
        task: ffff8c882b716040 task.stack: ffffb8e800d84000
        RIP: 0010:qmi_wwan_disconnect+0x25/0xc0 [qmi_wwan]
        RSP: 0018:ffffb8e800d87b38 EFLAGS: 00010246
        RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
        RDX: 0000000000000001 RSI: ffff8c8824f3f1d0 RDI: ffff8c8824ef6400
        RBP: ffff8c8824ef6400 R08: 0000000000000000 R09: 0000000000000000
        R10: ffffb8e800d87780 R11: 0000000000000011 R12: ffffffffc07ea0e8
        R13: ffff8c8824e2e000 R14: ffff8c8824e2e098 R15: 0000000000000000
        FS:  0000000000000000(0000) GS:ffff8c8835300000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 00000000000000e0 CR3: 0000000229ca5000 CR4: 00000000000406e0
        Call Trace:
         ? usb_unbind_interface+0x71/0x270 [usbcore]
         ? device_release_driver_internal+0x154/0x210
         ? qmi_wwan_unbind+0x6d/0xc0 [qmi_wwan]
         ? usbnet_disconnect+0x6c/0xf0 [usbnet]
         ? qmi_wwan_disconnect+0x87/0xc0 [qmi_wwan]
         ? usb_unbind_interface+0x71/0x270 [usbcore]
         ? device_release_driver_internal+0x154/0x210
      Reported-and-tested-by: NNathaniel Roach <nroach44@gmail.com>
      Fixes: c6adf779 ("net: usb: qmi_wwan: add qmap mux protocol support")
      Cc: Daniele Palmas <dnlplm@gmail.com>
      Signed-off-by: NBjørn Mork <bjorn@mork.no>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      bbae08e5
    • G
      ppp: fix xmit recursion detection on ppp channels · 0a0e1a85
      Guillaume Nault 提交于
      Commit e5dadc65 ("ppp: Fix false xmit recursion detect with two ppp
      devices") dropped the xmit_recursion counter incrementation in
      ppp_channel_push() and relied on ppp_xmit_process() for this task.
      But __ppp_channel_push() can also send packets directly (using the
      .start_xmit() channel callback), in which case the xmit_recursion
      counter isn't incremented anymore. If such packets get routed back to
      the parent ppp unit, ppp_xmit_process() won't notice the recursion and
      will call ppp_channel_push() on the same channel, effectively creating
      the deadlock situation that the xmit_recursion mechanism was supposed
      to prevent.
      
      This patch re-introduces the xmit_recursion counter incrementation in
      ppp_channel_push(). Since the xmit_recursion variable is now part of
      the parent ppp unit, incrementation is skipped if the channel doesn't
      have any. This is fine because only packets routed through the parent
      unit may enter the channel recursively.
      
      Finally, we have to ensure that pch->ppp is not going to be modified
      while executing ppp_channel_push(). Instead of taking this lock only
      while calling ppp_xmit_process(), we now have to hold it for the full
      ppp_channel_push() execution. This respects the ppp locks ordering
      which requires locking ->upl before ->downl.
      
      Fixes: e5dadc65 ("ppp: Fix false xmit recursion detect with two ppp devices")
      Signed-off-by: NGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0a0e1a85
    • J
      net: dsa: mediatek: add adjust link support for user ports · 8e6f1521
      John Crispin 提交于
      Manually adjust the port settings of user ports once PHY polling has
      completed. This patch extends the adjust_link callback to configure the
      per port PMCR register, applying the proper values polled from the PHY.
      Without this patch flow control was not always getting setup properly.
      Signed-off-by: NShashidhar Lakkavalli <shashidhar.lakkavalli@openmesh.com>
      Signed-off-by: NMuciri Gatimu <muciri@openmesh.com>
      Signed-off-by: NJohn Crispin <john@phrozen.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8e6f1521
    • D
      net/mlx4_en: don't set CHECKSUM_COMPLETE on SCTP packets · e718fe45
      Davide Caratti 提交于
      if the NIC fails to validate the checksum on TCP/UDP, and validation of IP
      checksum is successful, the driver subtracts the pseudo-header checksum
      from the value obtained by the hardware and sets CHECKSUM_COMPLETE. Don't
      do that if protocol is IPPROTO_SCTP, otherwise CRC32c validation fails.
      
      V2: don't test MLX4_CQE_STATUS_IPV6 if MLX4_CQE_STATUS_IPV4 is set
      Reported-by: NShuang Li <shuali@redhat.com>
      Fixes: f8c6455b ("net/mlx4_en: Extend checksum offloading by CHECKSUM COMPLETE")
      Signed-off-by: NDavide Caratti <dcaratti@redhat.com>
      Acked-by: NSaeed Mahameed <saeedm@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e718fe45
    • H
      random: fix warning message on ia64 and parisc · 51d96dc2
      Helge Deller 提交于
      Fix the warning message on the parisc and IA64 architectures to show the
      correct function name of the caller by using %pS instead of %pF. The
      message is printed with the value of _RET_IP_ which calls
      __builtin_return_address(0) and as such returns the IP address caller
      instead of pointer to a function descriptor of the caller.
      
      The effect of this patch is visible on the parisc and ia64 architectures
      only since those are the ones which use function descriptors while on
      all others %pS and %pF will behave the same.
      
      Cc: Theodore Ts'o <tytso@mit.edu>
      Cc: Jason A. Donenfeld <Jason@zx2c4.com>
      Signed-off-by: NHelge Deller <deller@gmx.de>
      Fixes: eecabf56 ("random: suppress spammy warnings about unseeded randomness")
      Fixes: d06bfd19 ("random: warn when kernel uses unseeded randomness")
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      51d96dc2
  2. 08 8月, 2017 6 次提交
    • C
      qed: Fix a memory allocation failure test in 'qed_mcp_cmd_init()' · eb2a6b80
      Christophe Jaillet 提交于
      We allocate 'p_info->mfw_mb_cur' and 'p_info->mfw_mb_shadow' but we check
      'p_info->mfw_mb_addr' instead of 'p_info->mfw_mb_cur'.
      
      'p_info->mfw_mb_addr' is never 0, because it is initiliazed a few lines
      above in 'qed_load_mcp_offsets()'.
      
      Update the test and check the result of the 2 'kzalloc()' instead.
      Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Acked-by: NTomer Tayar <Tomer.Tayar@cavium.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      eb2a6b80
    • A
      hysdn: fix to a race condition in put_log_buffer · b925ef37
      Anton Volkov 提交于
      The synchronization type that was used earlier to guard the loop that
      deletes unused log buffers may lead to a situation that prevents any
      thread from going through the loop.
      
      The patch deletes previously used synchronization mechanism and moves
      the loop under the spin_lock so the similar cases won't be feasible in
      the future.
      
      Found by by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: NAnton Volkov <avolkov@ispras.ru>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b925ef37
    • J
      s390/qeth: fix L3 next-hop in xmit qeth hdr · ec2c6726
      Julian Wiedmann 提交于
      On L3, the qeth_hdr struct needs to be filled with the next-hop
      IP address.
      The current code accesses rtable->rt_gateway without checking that
      rtable is a valid address. The accidental access to a lowcore area
      results in a random next-hop address in the qeth_hdr.
      rtable (or more precisely, skb_dst(skb)) can be NULL in rare cases
      (for instance together with AF_PACKET sockets).
      This patch adds the missing NULL-ptr checks.
      Signed-off-by: NJulian Wiedmann <jwi@linux.vnet.ibm.com>
      Signed-off-by: NUrsula Braun <ubraun@linux.vnet.ibm.com>
      Fixes: 87e7597b qeth: Move away from using neighbour entries in qeth_l3_fill_header()
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ec2c6726
    • D
      asix: Fix small memory leak in ax88772_unbind() · d0c8f338
      Dean Jenkins 提交于
      When Ethernet frames span mulitple URBs, the netdev buffer memory
      pointed to by the asix_rx_fixup_info structure remains allocated
      during the time gap between the 2 executions of asix_rx_fixup_internal().
      
      This means that if ax88772_unbind() is called within this time
      gap to free the memory of the parent private data structure then
      a memory leak of the part filled netdev buffer memory will occur.
      
      Therefore, create a new function asix_rx_fixup_common_free() to
      free the memory of the netdev buffer and add a call to
      asix_rx_fixup_common_free() from inside ax88772_unbind().
      
      Consequently when an unbind occurs part way through receiving
      an Ethernet frame, the netdev buffer memory that is holding part
      of the received Ethernet frame will now be freed.
      Signed-off-by: NDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d0c8f338
    • D
      asix: Ensure asix_rx_fixup_info members are all reset · 960eb4ee
      Dean Jenkins 提交于
      There is a risk that the members of the structure asix_rx_fixup_info
      become unsynchronised leading to the possibility of a malfunction.
      
      For example, rx->split_head was not being set to false after an
      error was detected so potentially could cause a malformed 32-bit
      Data header word to be formed.
      
      Therefore add function reset_asix_rx_fixup_info() to reset all the
      members of asix_rx_fixup_info so that future processing will start
      with known initial conditions.
      
      Also, if (skb->len != offset) becomes true then call
      reset_asix_rx_fixup_info() so that the processing of the next URB
      starts with known initial conditions. Without the call, the check
      does nothing which potentially could lead to a malfunction
      when the next URB is processed.
      
      In addition, for robustness, call reset_asix_rx_fixup_info() before
      every error path's "return 0". This ensures that the next URB is
      processed from known initial conditions.
      Signed-off-by: NDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      960eb4ee
    • D
      asix: Add rx->ax_skb = NULL after usbnet_skb_return() · 22889dbb
      Dean Jenkins 提交于
      In asix_rx_fixup_internal() there is a risk that rx->ax_skb gets
      reused after passing the Ethernet frame into the network stack via
      usbnet_skb_return().
      
      The risks include:
      
      a) asynchronously freeing rx->ax_skb after passing the netdev buffer
         to the NAPI layer which might corrupt the backlog queue.
      
      b) erroneously reusing rx->ax_skb such as calling skb_put_data() multiple
         times which causes writing off the end of the netdev buffer.
      
      Therefore add a defensive rx->ax_skb = NULL after usbnet_skb_return()
      so that it is not possible to free rx->ax_skb or to apply
      skb_put_data() too many times.
      Signed-off-by: NDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      22889dbb
  3. 07 8月, 2017 4 次提交
    • A
      pinctrl: intel: merrifield: Correct UART pin lists · 5d996132
      Andy Shevchenko 提交于
      UART pin lists consist GPIO numbers which is simply wrong.
      Replace it by pin numbers.
      
      Fixes: 4e80c8f5 ("pinctrl: intel: Add Intel Merrifield pin controller support")
      Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Acked-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
      5d996132
    • G
      pinctrl: armada-37xx: Fix number of pin in south bridge · 6b67c390
      Gregory CLEMENT 提交于
      On the south bridge we have pin from to 29, so it gives 30 pins (and not
      29).
      
      Without this patch the kernel complain with the following traces:
      cat /sys/kernel/debug/pinctrl/d0018800.pinctrl/pingroups
      [  154.530205] armada-37xx-pinctrl d0018800.pinctrl: failed to get pin(29) name
      [  154.537567] ------------[ cut here ]------------
      [  154.542348] WARNING: CPU: 1 PID: 1347 at /home/gclement/open/kernel/marvell-mainline-linux/drivers/pinctrl/core.c:1610 pinctrl_groups_show+0x15c/0x1a0
      [  154.555918] Modules linked in:
      [  154.558890] CPU: 1 PID: 1347 Comm: cat Tainted: G        W       4.13.0-rc1-00001-g19e1b9fa219d #525
      [  154.568316] Hardware name: Marvell Armada 3720 Development Board DB-88F3720-DDR3 (DT)
      [  154.576311] task: ffff80001d32d100 task.stack: ffff80001bdc0000
      [  154.583048] PC is at pinctrl_groups_show+0x15c/0x1a0
      [  154.587816] LR is at pinctrl_groups_show+0x148/0x1a0
      [  154.592847] pc : [<ffff0000083e3adc>] lr : [<ffff0000083e3ac8>] pstate: 00000145
      [  154.600840] sp : ffff80001bdc3c80
      [  154.604255] x29: ffff80001bdc3c80 x28: 00000000f7750000
      [  154.609825] x27: ffff80001d05d198 x26: 0000000000000009
      [  154.615224] x25: ffff0000089ead20 x24: 0000000000000002
      [  154.620705] x23: ffff000008c8e1d0 x22: ffff80001be55700
      [  154.626187] x21: ffff80001d05d100 x20: 0000000000000005
      [  154.631667] x19: 0000000000000006 x18: 0000000000000010
      [  154.637238] x17: 0000000000000000 x16: ffff0000081fc4b8
      [  154.642726] x15: 0000000000000006 x14: ffff0000899e537f
      [  154.648214] x13: ffff0000099e538d x12: 206f742064656c69
      [  154.653613] x11: 6166203a6c727463 x10: 0000000005f5e0ff
      [  154.659094] x9 : ffff80001bdc38c0 x8 : 286e697020746567
      [  154.664576] x7 : ffff000008551870 x6 : 000000000000011b
      [  154.670146] x5 : 0000000000000000 x4 : 0000000000000000
      [  154.675544] x3 : 0000000000000000 x2 : 0000000000000000
      [  154.681025] x1 : ffff000008c8e1d0 x0 : ffff80001be55700
      [  154.686507] Call trace:
      [  154.688668] Exception stack(0xffff80001bdc3ab0 to 0xffff80001bdc3be0)
      [  154.695224] 3aa0:                                   0000000000000006 0001000000000000
      [  154.703310] 3ac0: ffff80001bdc3c80 ffff0000083e3adc ffff80001bdc3bb0 00000000ffffffd8
      [  154.711304] 3ae0: 4554535953425553 6f6674616c703d4d 4349564544006d72 6674616c702b3d45
      [  154.719478] 3b00: 313030643a6d726f 6e69702e30303838 ffff80006c727463 ffff0000089635d8
      [  154.727562] 3b20: ffff80001d1ca0cb ffff000008af0fa4 ffff80001bdc3b40 ffff000008c8e1dc
      [  154.735648] 3b40: ffff80001bdc3bc0 ffff000008223174 ffff80001be55700 ffff000008c8e1d0
      [  154.743731] 3b60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
      [  154.752354] 3b80: 000000000000011b ffff000008551870 286e697020746567 ffff80001bdc38c0
      [  154.760446] 3ba0: 0000000005f5e0ff 6166203a6c727463 206f742064656c69 ffff0000099e538d
      [  154.767910] 3bc0: ffff0000899e537f 0000000000000006 ffff0000081fc4b8 0000000000000000
      [  154.776085] [<ffff0000083e3adc>] pinctrl_groups_show+0x15c/0x1a0
      [  154.782823] [<ffff000008222abc>] seq_read+0x184/0x460
      [  154.787505] [<ffff000008344120>] full_proxy_read+0x60/0xa8
      [  154.793431] [<ffff0000081f9bec>] __vfs_read+0x1c/0x110
      [  154.799001] [<ffff0000081faff4>] vfs_read+0x84/0x140
      [  154.803860] [<ffff0000081fc4fc>] SyS_read+0x44/0xa0
      [  154.808983] [<ffff000008082f30>] el0_svc_naked+0x24/0x28
      [  154.814459] ---[ end trace 4cbb00a92d616b95 ]---
      
      Cc: stable@vger.kernel.org
      Fixes: 87466ccd ("pinctrl: armada-37xx: Add pin controller support
      for Armada 37xx")
      Signed-off-by: NGregory CLEMENT <gregory.clement@free-electrons.com>
      Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
      6b67c390
    • G
      pinctrl: armada-37xx: Fix the pin 23 on south bridge · 9ac6e7cc
      Gregory CLEMENT 提交于
      Pin 23 on South bridge does not belong to the rgmii group. It belongs to
      a separate group which can have 3 functions.
      
      Due to this the fix also have to update the way the functions are
      managed. Until now each groups used NB_FUNCS(which was 2) functions. For
      the mpp23, 3 functions are available but it is the only group which needs
      it, so on the loop involving NB_FUNCS an extra test was added to handle
      only the functions added.
      
      The bug was visible with the merge of the commit 07d065ab "arm64:
      dts: marvell: armada-3720-db: Add vqmmc regulator for SD slot", the gpio
      regulator used the gpio 23, due to this the whole rgmii group was setup
      to gpio which broke the Ethernet support on the Armada 3720 DB
      board. Thanks to this patch, the UHS SD cards (which need the vqmmc)
      _and_ the Ethernet work again.
      
      Cc: stable@vger.kernel.org
      Fixes: 87466ccd ("pinctrl: armada-37xx: Add pin controller support
      for Armada 37xx")
      Signed-off-by: NGregory CLEMENT <gregory.clement@free-electrons.com>
      Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
      9ac6e7cc
    • S
      netvsc: fix race on sub channel creation · 732e4985
      stephen hemminger 提交于
      The existing sub channel code did not wait for all the sub-channels
      to completely initialize. This could lead to race causing crash
      in napi_netif_del() from bad list. The existing code would send
      an init message, then wait only for the initial response that
      the init message was received. It thought it was waiting for
      sub channels but really the init response did the wakeup.
      
      The new code keeps track of the number of open channels and
      waits until that many are open.
      
      Other issues here were:
        * host might return less sub-channels than was requested.
        * the new init status is not valid until after init was completed.
      
      Fixes: b3e6b82a ("hv_netvsc: Wait for sub-channels to be processed during probe")
      Signed-off-by: NStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      732e4985
  4. 06 8月, 2017 1 次提交
  5. 05 8月, 2017 8 次提交
    • D
      IB/hns: checking for IS_ERR() instead of NULL · 5db465f2
      Dan Carpenter 提交于
      The hns_roce_v1_create_lp_qp() returns NULL on error, not error pointers.
      
      Fixes: bfcc681b ("IB/hns: Fix the bug when free mr")
      Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      5db465f2
    • T
      xgene: Always get clk source, but ignore if it's missing for SGMII ports · aaf83aec
      Thomas Bogendoerfer 提交于
      Even the driver doesn't do anything with the clk source for SGMII
      ports it needs to be enabled by doing a devm_clk_get(), if there is
      a clk source in DT.
      
      Fixes: 0db01097 ('xgene: Don't fail probe, if there is no clk resource for SGMII interfaces')
      Signed-off-by: NThomas Bogendoerfer <tbogendoerfer@suse.de>
      Tested-by: NLaura Abbott <labbott@redhat.com>
      Acked-by: NIyappan Subramanian <isubramanian@apm.com>
      Tested-by: NWill Deacon <will.deacon@arm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      aaf83aec
    • L
      RDMA/mlx5: Fix existence check for extended address vector · 931b3c1a
      Leon Romanovsky 提交于
      The extended address vector is the highest bit in be32 variable,
      but it was compared with the lowest. This patch fixes the endianness
      of that check and removes already declared define.
      
      Fixes: 17d2f88f ("IB/mlx5: Add ODP atomics support")
      Reviewed-by: NArtemy Kovalyov <artemyko@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      931b3c1a
    • Y
      IB/uverbs: Fix device cleanup · efdd6f53
      Yishai Hadas 提交于
      Uverbs device should be cleaned up only when there is no
      potential usage of.
      
      As part of ib_uverbs_remove_one which might be triggered upon reset flow
      the device reference count is decreased as expected and leave the final
      cleanup to the FDs that were opened.
      
      Current code increases reference count upon opening a new command FD and
      decreases it upon closing the file. The event FD is opened internally
      and rely on the command FD by taking on it a reference count.
      
      In case that the command FD was closed and just later the event FD we
      may ensure that the device resources as of srcu are still alive as they
      are still in use.
      
      Fixing the above by moving the reference count decreasing to the place
      where the command FD is really freed instead of doing that when it was
      just closed.
      
      fixes: 036b1063 ("IB/uverbs: Enable device removal when there are active user space applications")
      Signed-off-by: NYishai Hadas <yishaih@mellanox.com>
      Reviewed-by: NMatan Barak <matanb@mellanox.com>
      Reviewed-by: NJason Gunthorpe <jgunthorpe@obsidianresearch.com>
      Tested-by: NJason Gunthorpe <jgunthorpe@obsidianresearch.com>
      Signed-off-by: NLeon Romanovsky <leon@kernel.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      efdd6f53
    • L
      RDMA/uverbs: Prevent leak of reserved field · f7a6cb7b
      Leon Romanovsky 提交于
      initialize to zero the response structure to prevent
      the leakage of "resp.reserved" field.
      
      drivers/infiniband/core/uverbs_cmd.c:1178 ib_uverbs_resize_cq() warn:
      	check that 'resp.reserved' doesn't leak information
      
      Fixes: 33b9b3ee ("IB: Add userspace support for resizing CQs")
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Reviewed-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      f7a6cb7b
    • P
      IB/core: Fix race condition in resolving IP to MAC · 5fff41e1
      Parav Pandit 提交于
      Currently while resolving IP address to MAC address single delayed work
      is used for resolving multiple such resolve requests. This singled work
      is essentially performs two tasks.
      (a) any retry needed to resolve and
      (b) it executes the callback function for all completed requests
      
      While work is executing callbacks, any new work scheduled on for this
      workqueue is lost because workqueue has completed looking at all pending
      requests and now looking at callbacks, but work is still under
      execution. Any further retry to look at pending requests in
      process_req() after executing callbacks would lead to similar race
      condition (may be reduce the probably further but doesn't eliminate it).
      Retrying to enqueue work that from queue_req() context is not something
      rest of the kernel modules have followed.
      
      Therefore fix in this patch utilizes kernel facility to enqueue multiple
      work items to a workqueue. This ensures that no such requests
      gets lost in synchronization. Request list is still maintained so that
      rdma_cancel_addr() can unlink the request and get the completion with
      error sooner. Neighbour update event handling continues to be handled in
      same way as before.
      Additionally process_req() work entry cancels any pending work for a
      request that gets completed while processing those requests.
      
      Originally ib_addr was ST workqueue, but it became MT work queue with
      patch of [1]. This patch again makes it similar to ST so that
      neighbour update events handler work item doesn't race with
      other work items.
      
      In one such below trace, (though on 4.5 based kernel) it can be seen
      that process_req() never executed the callback, which is likely for an
      event that was schedule by queue_req() when previous callback was
      getting executed by workqueue.
      
       [<ffffffff816b0dde>] schedule+0x3e/0x90
       [<ffffffff816b3c45>] schedule_timeout+0x1b5/0x210
       [<ffffffff81618c37>] ? ip_route_output_flow+0x27/0x70
       [<ffffffffa027f9c9>] ? addr_resolve+0x149/0x1b0 [ib_addr]
       [<ffffffff816b228f>] wait_for_completion+0x10f/0x170
       [<ffffffff810b6140>] ? try_to_wake_up+0x210/0x210
       [<ffffffffa027f220>] ? rdma_copy_addr+0xa0/0xa0 [ib_addr]
       [<ffffffffa0280120>] rdma_addr_find_l2_eth_by_grh+0x1d0/0x278 [ib_addr]
       [<ffffffff81321297>] ? sub_alloc+0x77/0x1c0
       [<ffffffffa02943b7>] ib_init_ah_from_wc+0x3a7/0x5a0 [ib_core]
       [<ffffffffa0457aba>] cm_req_handler+0xea/0x580 [ib_cm]
       [<ffffffff81015982>] ? __switch_to+0x212/0x5e0
       [<ffffffffa04582fd>] cm_work_handler+0x6d/0x150 [ib_cm]
       [<ffffffff810a14c1>] process_one_work+0x151/0x4b0
       [<ffffffff810a1940>] worker_thread+0x120/0x480
       [<ffffffff816b074b>] ? __schedule+0x30b/0x890
       [<ffffffff810a1820>] ? process_one_work+0x4b0/0x4b0
       [<ffffffff810a1820>] ? process_one_work+0x4b0/0x4b0
       [<ffffffff810a6b1e>] kthread+0xce/0xf0
       [<ffffffff810a6a50>] ? kthread_freezable_should_stop+0x70/0x70
       [<ffffffff816b53a2>] ret_from_fork+0x42/0x70
       [<ffffffff810a6a50>] ? kthread_freezable_should_stop+0x70/0x70
      INFO: task kworker/u144:1:156520 blocked for more than 120 seconds.
      "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this
      message.
      kworker/u144:1  D ffff883ffe1d7600     0 156520      2 0x00000080
      Workqueue: ib_addr process_req [ib_addr]
       ffff883f446fbbd8 0000000000000046 ffff881f95280000 ffff881ff24de200
       ffff883f66120000 ffff883f446f8008 ffff881f95280000 ffff883f6f9208c4
       ffff883f6f9208c8 00000000ffffffff ffff883f446fbbf8 ffffffff816b0dde
      
      [1] http://lkml.iu.edu/hypermail/linux/kernel/1608.1/05834.htmlSigned-off-by: NParav Pandit <parav@mellanox.com>
      Reviewed-by: NMark Bloch <markb@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leon@kernel.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      5fff41e1
    • I
      mlxsw: spectrum_switchdev: Release multicast groups during fini · 852cfeed
      Ido Schimmel 提交于
      Each multicast group (MID) stores a bitmap of ports to which a packet
      should be forwarded to in case an MDB entry associated with the MID is
      hit.
      
      Since the initial introduction of IGMP snooping in commit 3a49b4fd
      ("mlxsw: Adding layer 2 multicast support") the driver didn't correctly
      free these multicast groups upon ungraceful situations such as the
      removal of the upper bridge device or module removal.
      
      The correct way to fix this is to associate each MID with the bridge
      ports member in it and then drop the reference in case the bridge port
      is destroyed, but this will result in a lot more code and will be fixed
      in net-next.
      
      For now, upon module removal, traverse the MID list and release each
      one.
      
      Fixes: 3a49b4fd ("mlxsw: Adding layer 2 multicast support")
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      852cfeed
    • I
      mlxsw: spectrum_switchdev: Don't warn about valid situations · 17b334a8
      Ido Schimmel 提交于
      Some operations in the bridge driver such as MDB deletion are preformed
      in an atomic context and thus deferred to a process context by the
      switchdev infrastructure.
      
      Therefore, by the time the operation is performed by the underlying
      device driver it's possible the bridge port context is already gone.
      This is especially true for removal flows, but theoretically can also be
      invoked during addition.
      
      Remove the warnings in such situations and return normally.
      
      Fixes: c57529e1 ("mlxsw: spectrum: Replace vPorts with Port-VLAN")
      Fixes: 3922285d ("net: bridge: Add support for offloading port attributes")
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      17b334a8
  6. 04 8月, 2017 1 次提交
  7. 03 8月, 2017 15 次提交