Pull networking fixes from David Miller:

 1) Several routines do not use netdev_features_t to hold such bitmasks,
    fixes from Patrick McHardy and Bjørn Mork.

 2) Update cpsw IRQ software state and the actual HW irq enabling in the
    correct order.  From Mugunthan V N.

 3) When sending tipc packets to multiple bearers, we have to make
    copies of the SKB rather than just giving the original SKB directly.
    Fix from Gerlando Falauto.

 4) Fix race with bridging topology change timer, from Stephen
    Hemminger.

 5) Fix TCPv6 segmentation handling in GRE and VXLAN, from Pravin B
    Shelar.

 6) Endian bug in USB pegasus driver, from Dan Carpenter.

 7) Fix crashes on MTU reduction in USB asix driver, from Holger
    Eitzenberger.

 8) Don't allow the kernel to BUG() just because the user puts some crap
    in an AF_PACKET mmap() ring descriptor.  Fix from Daniel Borkmann.

 9) Don't use variable sized arrays on the stack in xen-netback, from
    Wei Liu.

10) Fix stats reporting and an unbalanced napi_disable() in be2net
    driver.  From Somnath Kotur and Ajit Khaparde.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (25 commits)
  cxgb4: fix error recovery when t4_fw_hello returns a positive value
  sky2: Fix crash on receiving VLAN frames
  packet: tpacket_v3: do not trigger bug() on wrong header status
  asix: fix BUG in receive path when lowering MTU
  net: qmi_wwan: Add Telewell TW-LTE 4G
  usbnet: pegasus: endian bug in write_mii_word()
  vxlan: Fix TCPv6 segmentation.
  gre: Fix GREv4 TCPv6 segmentation.
  bridge: fix race with topology change timer
  tipc: pskb_copy() buffers when sending on more than one bearer
  tipc: tipc_bcbearer_send(): simplify bearer selection
  tipc: cosmetic: clean up comments and break a long line
  drivers: net: cpsw: irq not disabled in cpsw isr in particular sequence
  xen-netback: better names for thresholds
  xen-netback: avoid allocating variable size array on stack
  xen-netback: remove redundent parameter in netbk_count_requests
  be2net: Fix to fail probe if MSI-X enable fails for a VF
  be2net: avoid napi_disable() when it has not been enabled
  be2net: Fix firmware download for Lancer
  be2net: Fix to receive Multicast Packets when Promiscuous mode is enabled on certain devices
  ...

Pull sparc updates from David Miller:

 1) Hibernation support, as well as removal of excess interrupt
    twiddling in MMU context allocation on sparc64 from Kirill Tkhai.

 2) Kill references to __ARCH_WANT_UNLOCKED_CTXSW.

 3) Sparc32 LEON bug fixes from Daniel Hellstrom and Andreas Larsson.

 4) Provide cmpxchg64(), from Geert Uytterhoeven.

 5) Device refcount and registry bug fixes from Federico Vaga and Wei
    Yongjun.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next:
  serial: sunsu: add missing platform_driver_unregister() when module exit
  sparc32, leon: Do not overwrite previously set irq flow handlers
  sparc/kernel/vio.c: add put_device() after device_find_child()
  sparc64: Do not save/restore interrupts in get_new_mmu_context()
  sparc: Consistently use 'wr' and 'rd' instructions for ASRs.
  sparc64: Kill __ARCH_WANT_UNLOCKED_CTXSW
  sparc64: Provide cmpxchg64()
  sparc64: Do not change num_physpages during initmem freeing
  sparc64: Hibernation support
  sparc,leon: updated GRPCI2 config name
  sparc,leon: support for GRPCI1 PCI host bridge controller
  sparc32,leon: add support for PCI busn resource for GRPCI2

Merge sparc bug fixes that didn't make it into v3.9 into
sparc-next.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

We have registered platform driver when module init, and
need unregister it when module exit.
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This is needed because when scan_of_devices finds the GAISLER_GPTIMER
core that corresponds to the SMP "ticker" timer, the previously set
proper irq flow handler gets overwritten with an incorrect one. This
leads to very flaky timer interrupt handling on some hardware. Proper
updates to handlers can still be done using leon_update_virq_handling.
Signed-off-by: NAndreas Larsson <andreas@gaisler.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The vio_remove() function uses device_find_child() but it does not drop
the reference of the retrieved child.
Signed-off-by: NFederico Vaga <federico.vaga@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Pull MMC update from Chris Ball:
 "MMC highlights for 3.10:

  Core:
   - Introduce MMC_CAP2_NO_PRESCAN_POWERUP to allow skipping
     mmc_power_up() at boot/initialization time if it's already
     happened, for performance (faster boot time) reasons.
   - Fix a bit width test failure that resulted in old eMMC cards being
     put into 1-bit mode when 4-bit mode was available.
   - Expose fwrev/hwrev for MMCv4 parts.
   - Improve card removal logic in the case where the card's removed
     slowly; we were missing card removal events if the card retained
     contact with the slot pads for long enough to reply to a CMD13
     while being removed.

  Drivers:
   - davinci_mmc: Support using PIO instead of DMA.
   - dw_mmc: Add support for Exynos4412.
   - mxcmmc: DT support, use slot-gpio API.
   - mxs-mmc: Add broken-cd/cd-inverted/non-removable DT property
     support.
   - sdhci-sirf: New sdhci-pltfm driver for CSR SiRF SoCs:
       SiRFprimaII: unicore ARM Cortex-A9
       SiRFatlas6: unicore ARM Cortex-A9
       SiRFmarco: dual core ARM Cortex-A9 SMP
   - sdhci-tegra: Add support for Tegra114 platforms, use
     mmc_of_parse()"

* tag 'mmc-updates-for-3.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: (66 commits)
  mmc: sdhci-tegra: fix MODULE_DEVICE_TABLE
  mmc: core: fix init controller performance regression, updated patch
  mmc: mxcmmc: enable DMA support on mpc512x
  mmc: mxcmmc: constify mxcmci_devtype
  mmc: mxcmmc: use slot-gpio API for write-protect detection
  mmc: mxcmmc: add mpc512x SDHC support
  mmc: mxcmmc: fix race conditions for host->req and host->data access
  mmc: mxcmmc: DT support
  mmc: dw_mmc: let device core setup the default pin configuration
  mmc: mxs-mmc: add broken-cd property
  mmc: mxs-mmc: add non-removable property
  mmc: mxs-mmc: add cd-inverted property
  mmc: core: call pm_runtime_put_noidle in pm_runtime_get_sync failed case
  mmc: mxcmmc: Fix bug when card is present during boot
  mmc: core: fix performance regression initializing MMC host controllers
  Revert "mmc: core: wait while adding MMC host to ensure root mounts successfully"
  mmc: atmel-mci: pio hang on block errors
  mmc: core: Fix bit width test failing on old eMMC cards
  mmc: dw_mmc: Use pr_info instead of printk
  mmc: dw_mmc: Check return value of regulator_enable
  ...

Pull hwmon update from Jean Delvare:
 "Only lm75 driver updates this time"

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  hwmon: (lm75) Add support for the Dallas/Maxim DS7505
  hwmon: (lm75) Tune resolution and sample time per chip
  hwmon: (lm75) Prepare to support per-chip resolution and sample time
  hwmon: (lm75) Per-chip configuration register initialization

Pull second round of VFS updates from Al Viro:
 "Assorted fixes"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  xtensa simdisk: fix braino in "xtensa simdisk: switch to proc_create_data()"
  hostfs: use kmalloc instead of kzalloc
  hostfs: move HOSTFS_SUPER_MAGIC to <linux/magic.h>
  hostfs: remove "will unlock" comment
  vfs: use list_move instead of list_del/list_add
  proc_devtree: Replace include linux/module.h with linux/export.h
  create_mnt_ns: unidiomatic use of list_add()
  fs: remove dentry_lru_prune()
  Removed unused typedef to avoid "unused local typedef" warnings.
  kill fs/read_write.h
  fs: Fix hang with BSD accounting on frozen filesystem
  sun3_scsi: add ->show_info()
  nubus: Kill nubus_proc_detach_device()
  more mode_t whack-a-mole...
  do_coredump(): don't wait for thaw if coredump has already been interrupted
  do_mount(): fix a leak introduced in 3.9 ("mount: consolidate permission checks")

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

The inode info structure is zeroed at allocation with kzalloc, and then
all but one of the fields (including the largest, vfs_inode) are
initialised explicitly. Switch to using kmalloc and initialise the
remaining field too.
Reported-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Move HOSTFS_SUPER_MAGIC to <linux/magic.h> to be with it's magical
friends from other file systems.
Reported-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

A "will unlock" comment was added to hostfs in the following commit,
along with a spinlock:

Commit e9193059 ("hostfs: fix races in
dentry_name() and inode_name()").

But the spinlock was subsequently removed in the following commit:

Commit ec2447c2 ("hostfs: simplify
locking").

Since the comment is no longer applicable, remove it.
Reported-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
Cc: Nick Piggin <npiggin@kernel.dk>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Using list_move() instead of list_del() + list_add().
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Pull ARM SoC board specific changes (part 1) from Olof Johansson:
 "These changes are all for board specific files.  These used to make up
  a large portion of the ARM changes in the past, but as we are
  generalizing the support and moving to device tree probing, this has
  gotten significantly smaller.

  The only platform actually adding new code here at the moment is
  Renesas shmobile, as they are still busy converting their code to
  device tree and have not come far enough to not need it."

* tag 'boards-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (43 commits)
  ARM: msm: USB_MSM_OTG needs USB_PHY
  ARM: davinci: da850 evm: fix const qualifier placement
  ARM: davinci: da850 board: add remoteproc support
  ARM: pxa: move debug uart code
  ARM: pxa: select PXA935 on saar & tavorevb
  ARM: mmp: add more compatible names in gpio driver
  ARM: pxa: move PXA_GPIO_TO_IRQ macro
  ARM: pxa: remove cpu_is_xxx in gpio driver
  ARM: Kirkwood: update Network Space Mini v2 description
  ARM: Kirkwood: DT board setup for CloudBox
  ARM: Kirkwood: sort board entries by ASCII-code order
  ARM: OMAP: board-4430sdp: Provide regulator to pwm-backlight
  ARM: OMAP: zoom: Use pwm stack for lcd and keyboard backlight
  ARM: OMAP2+: omap2plus_defconfig: Add support for BMP085 pressure sensor
  omap2+: Remove useless Makefile line
  omap2+: Remove useless Makefile line
  ARM: OMAP: RX-51: add missing regulator supply definitions for lis3lv02d
  ARM: OMAP1: fix omap_udc registration
  ARM: davinci: use is IS_ENABLED macro
  ARM: kirkwood: add MACH_GURUPLUG_DT to defconfig
  ...

Pull ARM platform specific firmware interfaces from Olof Johansson:
 "Two platforms, bcm and exynos have their own firmware interfaces using
  the "secure monitor call", this adds support for those.

  We had originally planned to have a third set of patches in here,
  which would extend support for the existing generic "psci" call that
  is used on multiple platforms as well as Xen and KVM guests, but that
  ended up getting dropped because the patches were not ready in time."

* tag 'firmware-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: bcm: mark bcm_kona_smc_init as __init
  ARM: bcm281xx: Add DT support for SMC handler
  ARM: bcm281xx: Add L2 cache enable code
  ARM: EXYNOS: Add secure firmware support to secondary CPU bring-up
  ARM: EXYNOS: Add IO mapping for non-secure SYSRAM.
  ARM: EXYNOS: Add support for Exynos secure firmware
  ARM: EXYNOS: Add support for secure monitor calls
  ARM: Add interface for registering and calling firmware-specific operations

Pull ARM SoC pinctrl changes for Renesas from Olof Johansson:
 "This is yet another driver change, which is split out just because of
  its size.  As already in 3.9, a lot of changes are going on here, as
  the shmobile platform gets converted from its own pin control API to
  the generic drivers/pinctrl subsystem.

  Based on agreements with Paul Mundt, we are merging the sh-arch-side
  changes here as well"

* tag 'renesas-pinctrl-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (142 commits)
  ARM: shmobile: r8a7779: Remove INTC function GPIOs
  ARM: shmobile: r8a7779: Remove LBSC function GPIOs
  ARM: shmobile: r8a7779: Remove USB function GPIOs
  ARM: shmobile: r8a7779: Remove HSPI function GPIOs
  ARM: shmobile: r8a7779: Remove SCIF function GPIOs
  ARM: shmobile: r8a7779: Remove SDHI and MMCIF function GPIOs
  ARM: shmobile: r8a7779: Remove DU function GPIOs
  ARM: shmobile: r8a7779: Remove DU1_DOTCLKOUT1 GPIO
  ARM: shmobile: r8a7740: Remove SDHI and MMCIF function GPIOs
  ARM: shmobile: r8a7740: Remove LCD0 and LCD1 function GPIOs
  ARM: shmobile: sh73a0: Remove IrDA function GPIOs
  ARM: shmobile: sh73a0: Remove USB function GPIOs
  ARM: shmobile: sh73a0: Remove BSC function GPIOs
  ARM: shmobile: sh73a0: Remove KEYSC function GPIOs
  ARM: shmobile: sh73a0: Remove pull-up function GPIOS
  ARM: shmobile: sh73a0: Remove FSI function GPIOs
  ARM: shmobile: sh73a0: Remove I2C function GPIOs
  ARM: shmobile: sh73a0: Remove SCIFA and SCIFB function GPIOs
  ARM: shmobile: sh73a0: Remove LCDC and LCDC2 function GPIOs
  ARM: shmobile: sh7372: Remove SDHI and MMCIF function GPIOs
  ...

Pull ARM SoC driver changes from Olof Johansson:
 "This is a rather large set of patches for device drivers that for one
  reason or another the subsystem maintainer preferred to get merged
  through the arm-soc tree.  There are both new drivers as well as
  existing drivers that are getting converted from platform-specific
  code into standalone drivers using the appropriate subsystem specific
  interfaces.

  In particular, we can now have pinctrl, clk, clksource and irqchip
  drivers in one file per driver, without the need to call into platform
  specific interface, or to get called from platform specific code, as
  long as all information about the hardware is provided through a
  device tree.

  Most of the drivers we touch this time are for clocksource.  Since now
  most of them are part of drivers/clocksource, I expect that we won't
  have to touch these again from arm-soc and can let the clocksource
  maintainers take care of these in the future.

  Another larger part of this series is specific to the exynos platform,
  which is seeing some significant effort in upstreaming and
  modernization of its device drivers this time around, which
  unfortunately is also the cause for the churn and a lot of the merge
  conflicts.

  There is one new subsystem that gets merged as part of this series:
  the reset controller interface, which is a very simple interface for
  taking devices on the SoC out of reset or back into reset.  Patches to
  use this interface on i.MX follow later in this merge window, and we
  are going to have other platforms (at least tegra and sirf) get
  converted in 3.11.  This will let us get rid of platform specific
  callbacks in a number of platform independent device drivers."

* tag 'drivers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (256 commits)
  irqchip: s3c24xx: add missing __init annotations
  ARM: dts: Disable the RTC by default on exynos5
  clk: exynos5250: Fix parent clock for sclk_mmc{0,1,2,3}
  ARM: exynos: restore mach/regs-clock.h for exynos5
  clocksource: exynos_mct: fix build error on non-DT
  pinctrl: vt8500: wmt: Fix checking return value of pinctrl_register()
  irqchip: vt8500: Convert arch-vt8500 to new irqchip infrastructure
  reset: NULL deref on allocation failure
  reset: Add reset controller API
  dt: describe base reset signal binding
  ARM: EXYNOS: Add arm-pmu DT binding for exynos421x
  ARM: EXYNOS: Add arm-pmu DT binding for exynos5250
  ARM: EXYNOS: Enable PMUs for exynos4
  irqchip: exynos-combiner: Correct combined IRQs for exynos4
  irqchip: exynos-combiner: Add set_irq_affinity function for combiner_irq
  ARM: EXYNOS: fix compilation error introduced due to common clock migration
  clk: exynos5250: Fix divider values for sclk_mmc{0,1,2,3}
  clk: exynos4: export clocks required for fimc-is
  clk: samsung: Fix compilation error
  clk: tegra: fix enum tegra114_clk to match binding
  ...

Since it uses only THIS_MODULE macro, include <linux/export.h>
is the right to go here.
Signed-off-by: NSyam Sidhardhan <s.syam@samsung.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

while list_add(A, B) and list_add(B, A) are equivalent when both A and B
are guaranteed to be empty, the usual idiom is list_add(what, where),
not the other way round...  Not a bug per se, but only by accident and
it makes RTFS harder for no good reason.
Spotted-by: NRajat Sharma <fs.rajat@gmail.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

When pruning a dentry, its ancestor dentry can also be pruned. But
the ancestor dentry does not go through dput(), so it does not get
put on the dentry LRU. Hence associating d_prune with removing the
dentry from the LRU is the wrong.

The fix is remove dentry_lru_prune(). Call file system's d_prune()
callback directly when pruning dentries.
Signed-off-by: NYan, Zheng <zheng.z.yan@intel.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Fix warnings about unused local typedefs (reported by gcc 4.8).

Signed-off-by: Han Shen  (shenhan@google.com)

Change-Id: I4bccc234f1390daa808d2b309ed112e20c0ac096
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

fs/compat.c doesn't need it anymore, so let's just move the remaining
contents (two typedefs) into fs/read_write.c
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

When BSD process accounting is enabled and logs information to a
filesystem which gets frozen, system easily becomes unusable because
each attempt to account process information blocks. Thus e.g. every task
gets blocked in exit.

It seems better to drop accounting information (which can already happen
when filesystem is running out of space) instead of locking system up.
So we just skip the write if the filesystem is frozen.
Reported-by: NNikola Ciprich <nikola.ciprich@linuxbox.cz>
Signed-off-by: NJan Kara <jack@suse.cz>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Based on Al's changes to atari_scsi.
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Commit 59d8053f ("proc: Move non-public
stuff from linux/proc_fs.h to fs/proc/internal.h") broke Apple NuBus
support:

drivers/nubus/proc.c: In function ‘nubus_proc_detach_device’:
drivers/nubus/proc.c:156: error: dereferencing pointer to incomplete type
drivers/nubus/proc.c:158: error: dereferencing pointer to incomplete type

Fortunately nubus_proc_detach_device() is unused, and appears to have never
been used, so just remove it.
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Bisected-by: NMichael Leun <lkml20130126@newton.leun.net>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Basically it's the same as the original DS75 but much faster.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NGuenter Roeck <linux@roeck-us.net>

Most LM75-compatible chips can either sample much faster or with a
much better resolution than the original LM75 chip. So far the lm75
driver did not let the user take benefit of these improvements. Do it
now.

I decided to almost always configure the chip to use the best
resolution possible, which also means the longest sample time. The
only chips for which I didn't are the DS75, DS1775 and STDS75, because
they are really too slow in 12-bit mode (1.2 to 1.5 second worst case)
so I went for 11-bit mode as a more reasonable tradeoff. This choice is
dictated by the fact that the hwmon subsystem is meant for system
monitoring, it has never been supposed to be ultra-fast, and as a
matter of fact we do cache the sampled values in almost all drivers.

If anyone isn't pleased with these default settings, they can always
introduce a platform data structure or DT support for the lm75. That
being said, it seems nobody ever complained that the driver wouldn't
refresh the value faster than every 1.5 second, and the change made
it faster for all chips even in 12-bit mode, so I don't expect any
complaint.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NGuenter Roeck <linux@roeck-us.net>

Prepare the lm75 driver to support per-chip resolution and sample
time. For now we only make the code generic enough to support it, but
we still use the same, unchanged resolution (9-bit) and sample time
(1.5 s) for all chips.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NGuenter Roeck <linux@roeck-us.net>

There is no standard for the configuration register bits of LM75-like
chips. We shouldn't blindly clear bits setting the resolution as they
are either unused or used for something else on some of the supported
chips.

So, switch to per-chip configuration initialization. This will allow
for better tuning later, for example using more resolution bits when
available.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NGuenter Roeck <linux@roeck-us.net>

Since commit 636f9d37 ("cxgb4: Add
support for T4 configuration file"), t4_fw_hello may return a positive
value instead of 0 for success. The recovery code tests only for zero
and fails recovery for any other value.

This fix tests for negative error values and fails only on those cases.
Error recovery after an error injection works after this change.
Signed-off-by: NThadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

After recent 86a9bad3 (net: vlan: add protocol argument to packet
tagging functions) my sky2 started to crash on receive of tagged
frames, with backtrace similar to

    #CRASH!!!
    vlan_do_receive
    __netif_receive_skb_core
    __netif_receive_skb
    netif_receive_skb
    sky2_poll
    ...
    __net_rx_action
    __do_softirq

The problem turned out to be:

    1) sky2 copies small packets from ring on RX, and in its
       receive_copy() skb header is copied manually field, by field, and
       only for some fields;

    2) 86a9bad3  added skb->vlan_proto, which vlan_untag() or
       __vlan_hwaccel_put_tag() set, and which is later used in
       vlan_do_receive().

       That patch updated copy_skb_header() for newly introduced
       skb->vlan_proto, but overlooked the need to also copy it in sky2's
       receive_copy().

Because of 2, we have the following scenario:

    - frame is received and tagged in a ring, by sky2_rx_tag(). Both
      skb->vlan_proto and skb->vlan_tci are set;

    - later skb is decided to be copied, but skb->vlan_proto is
      forgotten and becomes 0.

    - in the beginning of vlan_do_receive() we call

        __be16 vlan_proto = skb->vlan_proto;
        vlan_dev = vlan_find_dev(skb->dev, vlan_proto, vlan_id);

      which eventually invokes

        vlan_proto_idx(vlan_proto)

      and that routine BUGs for everything except ETH_P_8021Q and
      ETH_P_8021AD.

      Oops.

Fix it.

P.S.

Stephen, I wonder, why copy_skb_header() is not used in
sky2.c::receive_copy() ? Problems, where receive_copy was updated field
by field showed several times already, e.g.

    3f42941b    (sky2: propogate rx hash when packet is copied)
    e072b3fa    (sky2: fix receive length error in mixed non-VLAN/VLAN traffic)

Cc: Patrick McHardy <kaber@trash.net>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Cc: Mirko Lindner <mlindner@marvell.com>
Signed-off-by: NKirill Smelkov <kirr@mns.spb.ru>
Acked-by: NStephen Hemminger <stephen@networkplumber.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Jakub reported that it is fairly easy to trigger the BUG() macro
from user space with TPACKET_V3's RX_RING by just giving a wrong
header status flag. We already had a similar situation in commit
7f5c3e3a (``af_packet: remove BUG statement in
tpacket_destruct_skb'') where this was the case in the TX_RING
side that could be triggered from user space. So really, don't use
BUG() or BUG_ON() unless there's really no way out, and i.e.
don't use it for consistency checking when there's user space
involved, no excuses, especially not if you're slapping the user
with WARN + dump_stack + BUG all at once. The two functions are
of concern:

  prb_retire_current_block() [when block status != TP_STATUS_KERNEL]
  prb_open_block() [when block_status != TP_STATUS_KERNEL]

Calls to prb_open_block() are guarded by ealier checks if block_status
is really TP_STATUS_KERNEL (racy!), but the first one BUG() is easily
triggable from user space. System behaves still stable after they are
removed. Also remove that yoda condition entirely, since it's already
guarded.
Reported-by: NJakub Zawadzki <darkjames-ws@darkjames.pl>
Signed-off-by: NDaniel Borkmann <dborkman@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

There is bug in the receive path of the asix driver at the time a
packet is received larger than MTU size and DF bit set:

 BUG: unable to handle kernel paging request at 0000004000000001
 IP: [<ffffffff8126f65b>] skb_release_head_state+0x2d/0xd2
 ...
 Call Trace:
  <IRQ>
  [<ffffffff8126f86d>] ? skb_release_all+0x9/0x1e
  [<ffffffff8126f8ad>] ? __kfree_skb+0x9/0x6f
  [<ffffffffa00b4200>] ? asix_rx_fixup_internal+0xff/0x1ae [asix]
  [<ffffffffa00fb3dc>] ? usbnet_bh+0x4f/0x226 [usbnet]
  ...

It is easily reproducable by setting an MTU of 512 e. g. and sending
something like

  ping -s 1472 -c 1 -M do $SELF

from another box.

And this is because the rx->ax_skb is freed on error, but rx->ax_skb
is not reset, and the size is not reset to zero in this case.

And since the skb is added again to the usbnet->done skb queue it is
accessing already freed memory, resulting in the BUG when freeing a
2nd time.  I therefore think the value 0x0000004000000001 show in the
trace is more or less random data.
Signed-off-by: NHolger Eitzenberger <holger@eitzenberger.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Information from driver description files:

  diag:  VID_19D2&PID_0412&MI_00
  nmea:  VID_19D2&PID_0412&MI_01
  at:    VID_19D2&PID_0412&MI_02
  modem: VID_19D2&PID_0412&MI_03
  net:   VID_19D2&PID_0412&MI_04
Signed-off-by: NTeppo Kotilainen <qubit303@gmail.com>
Acked-by: NBjørn Mork <bjorn@mork.no>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

We're only passing the two high bytes of an integer.  It works for
little endian but not for big endian.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch set correct skb->protocol so that inner packet can
lookup correct gso handler.
Signed-off-by: NPravin B Shelar <pshelar@nicira.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>