1. 10 6月, 2016 1 次提交
  2. 03 6月, 2016 1 次提交
    • F
      brcmfmac: add eth_type_trans back for PCIe full dongle · 31143e29
      Franky Lin 提交于
      A regression was introduced in commit 9c349892 ("brcmfmac: revise
      handling events in receive path") which moves eth_type_trans() call
      to brcmf_rx_frame(). Msgbuf layer doesn't use brcmf_rx_frame() but invokes
      brcmf_netif_rx() directly. In such case the Ethernet header was not
      stripped out resulting in null pointer dereference in the networking
      stack.
      
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
      IP: [<ffffffff814c3ce6>] enqueue_to_backlog+0x56/0x260
      PGD 0
      Oops: 0000 [#1] PREEMPT SMP
      Modules linked in: fuse ipt_MASQUERADE nf_nat_masquerade_ipv4
      iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype
      [...]
      rtsx_pci scsi_mod usbcore usb_common i8042 serio nvme nvme_core
      CPU: 7 PID: 1340 Comm: irq/136-brcmf_p Not tainted 4.7.0-rc1-mainline #1
      Hardware name: Dell Inc. XPS 15 9550/0N7TVV, BIOS 01.02.00 04/07/2016
      task: ffff8804a0c5bd00 ti: ffff88049e124000 task.ti: ffff88049e124000
      RIP: 0010:[<ffffffff814c3ce6>] [<ffffffff814c3ce6>]
      enqueue_to_backlog+0x56/0x260
      RSP: 0018:ffff88049e127ca0 EFLAGS: 00010046
      RAX: 0000000000000000 RBX: ffff8804bddd7c40 RCX: 000000000000002f
      RDX: 0000000000000000 RSI: 0000000000000007 RDI: ffff8804bddd7d4c
      RBP: ffff88049e127ce8 R08: 0000000000000000 R09: 0000000000000000
      R10: ffff8804bddd12c0 R11: 000000000000149e R12: 0000000000017c40
      R13: ffff88049e127d08 R14: ffff8804a9bd6d00 R15: ffff8804bddd7d4c
      FS: 0000000000000000(0000) GS:ffff8804bddc0000(0000) knlGS:0000000000000000
      CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000000048 CR3: 0000000001806000 CR4: 00000000003406e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Stack:
      ffff8804bdddad00 ffff8804ad089e00 0000000000000000 0000000000000282
      0000000000000000 ffff8804a9bd6d00 ffff8804a1b27e00 ffff8804a9bd6d00
      ffff88002ee88000 ffff88049e127d28 ffffffff814c3f3b ffffffff81311fc3
      Call Trace:
      [<ffffffff814c3f3b>] netif_rx_internal+0x4b/0x170
      [<ffffffff81311fc3>] ? swiotlb_tbl_unmap_single+0xf3/0x120
      [<ffffffff814c5467>] netif_rx_ni+0x27/0xc0
      [<ffffffffa08519e9>] brcmf_netif_rx+0x49/0x70 [brcmfmac]
      [<ffffffffa08564d4>] brcmf_msgbuf_process_rx+0x2b4/0x570 [brcmfmac]
      [<ffffffff81020017>] ? __xen_set_pgd_hyper+0x57/0xd0
      [<ffffffff810d60b0>] ? irq_forced_thread_fn+0x70/0x70
      [<ffffffffa0857381>] brcmf_proto_msgbuf_rx_trigger+0x31/0xe0 [brcmfmac]
      [<ffffffffa0861e8f>] brcmf_pcie_isr_thread+0x7f/0x110 [brcmfmac]
      [<ffffffff810d60d0>] irq_thread_fn+0x20/0x50
      [<ffffffff810d63ad>] irq_thread+0x12d/0x1c0
      [<ffffffff815d07d5>] ? __schedule+0x2f5/0x7a0
      [<ffffffff810d61d0>] ? wake_threads_waitq+0x30/0x30
      [<ffffffff810d6280>] ? irq_thread_dtor+0xb0/0xb0
      [<ffffffff81098ea8>] kthread+0xd8/0xf0
      [<ffffffff815d4b7f>] ret_from_fork+0x1f/0x40
      [<ffffffff81098dd0>] ? kthread_worker_fn+0x170/0x170
      Code: 1c f5 60 9a 8e 81 9c 58 0f 1f 44 00 00 48 89 45 d0 fa 66 0f 1f
      44 00 00 4c 8d bb 0c 01 00 00 4c 89 ff e8 5e 08 11 00 49 8b 56 20 <48>
      8b 52 48 83 e2 01 74 10 8b 8b 08 01 00 00 8b 15 59 c5 42 00
      RIP [<ffffffff814c3ce6>] enqueue_to_backlog+0x56/0x260
      RSP <ffff88049e127ca0>
      CR2: 0000000000000048
      
      Fixes: 9c349892 ("brcmfmac: revise handling events in receive path")
      Reported-by: NRafal Milecki <zajec5@gmail.com>
      Reported-by: NGrey Christoforo <grey@christoforo.net>
      Reviewed-by: NPieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
      Reviewed-by: NArend Van Spriel <arend@broadcom.com>
      Reviewed-by: NHante Meuleman <hante.meuleman@broadcom.com>
      Signed-off-by: NFranky Lin <franky.lin@broadcom.com>
      [arend@broadcom.com: rephrased the commit message]
      Signed-off-by: NArend van Spriel <arend@broadcom.com>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      31143e29
  3. 28 5月, 2016 2 次提交
  4. 27 5月, 2016 8 次提交
  5. 26 5月, 2016 11 次提交
    • E
      net/mlx4_en: get rid of private net_device_stats · f73a6f43
      Eric Dumazet 提交于
      We simply can use the standard net_device stats.
      
      We do not need to clear fields that are already 0.
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Willem de Bruijn <willemb@google.com>
      Cc: Eugenia Emantayev <eugenia@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f73a6f43
    • E
      net/mlx4_en: get rid of ret_stats · 9ed17db1
      Eric Dumazet 提交于
      mlx4 uses a private struct net_device_stats in a vain attempt
      to avoid races.
      
      This is buggy because multiple cpus could call mlx4_en_get_stats()
      at the same time, so ret_stats can not guarantee stable results.
      
      To fix this, we need to switch to ndo_get_stats64() as this
      method provides per-thread storage.
      
      This allows to reduce mlx4_en_priv bloat.
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Willem de Bruijn <willemb@google.com>
      Cc: Eugenia Emantayev <eugenia@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9ed17db1
    • E
      net/mlx4_en: clear some TX ring stats in mlx4_en_clear_stats() · 45acbac6
      Eric Dumazet 提交于
      mlx4_en_clear_stats() clears about everything but few TX ring
      fields are missing :
      - queue_stopped, wake_queue, tso_packets, xmit_more
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Willem de Bruijn <willemb@google.com>
      Cc: Eugenia Emantayev <eugenia@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      45acbac6
    • E
      net/mlx4_en: fix tx_dropped bug · 63a664b7
      Eric Dumazet 提交于
      1) mlx4_en_xmit() can increment priv->stats.tx_dropped, but this variable
      is overwritten in mlx4_en_DUMP_ETH_STATS().
      
      2) This increment was not SMP safe, as a port might have many TX queues.
      
      Add a per TX ring tx_dropped to fix these issues.
      
      This is u32 as mlx4_en_DUMP_ETH_STATS() will add a 32bit field.
      
      So lets avoid bugs with SNMP agents having to cope with partial
      overwraps. (One of these agents being bond_fold_stats())
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Reported-by: NWillem de Bruijn <willemb@google.com>
      Cc: Eugenia Emantayev <eugenia@mellanox.com>
      Acked-by: NAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      63a664b7
    • M
      net: arc: trivial: Replace comma with a semicolon · 3424d9be
      Marek Vasut 提交于
      Fix a typo in the driver, replace comma with a semicolon at the end
      of statement. While using comma is a legal C here and probably does
      not even generate compiler warning, it was unlikely the intention.
      Signed-off-by: NMarek Vasut <marex@denx.de>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Caesar Wang <wxt@rock-chips.com>
      Cc: Heiko Stuebner <heiko@sntech.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3424d9be
    • M
      net: stmmac: Fix incorrect memcpy source memory · 643d60bf
      Marek Vasut 提交于
      The memcpy() currently copies mdio_bus_data into new_bus->irq, which
      makes no sense, since the mdio_bus_data structure contains more than
      just irqs. The code was likely supposed to copy mdio_bus_data->irqs
      into the new_bus->irq instead, so fix this.
      
      Fixes: e7f4dc35 ("mdio: Move allocation of interrupts into core")
      Signed-off-by: NMarek Vasut <marex@denx.de>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
      Cc: Alexandre Torgue <alexandre.torgue@st.com>
      Reviewed-by: NAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      643d60bf
    • F
      net: alx: use custom skb allocator · 26c5f03b
      Feng Tang 提交于
      This patch follows Eric Dumazet's commit 7b701764 for Atheros
      atl1c driver to fix one exactly same bug in alx driver, that the
      network link will be lost in 1-5 minutes after the device is up.
      
      My laptop Lenovo Y580 with Atheros AR8161 ethernet device hit the
      same problem with kernel 4.4, and it will be cured by Jarod Wilson's
      commit c406700c for alx driver which get merged in 4.5. But there
      are still some alx devices can't function well even with Jarod's
      patch, while this patch could make them work fine. More details on
      	https://bugzilla.kernel.org/show_bug.cgi?id=70761
      
      The debug shows the issue is very likely to be related with the RX
      DMA address, specifically 0x...f80, if RX buffer get 0x...f80 several
      times, their will be RX overflow error and device will stop working.
      
      For kernel 4.5.0 with Jarod's patch which works fine with my
      AR8161/Lennov Y580, if I made some change to the
      	__netdev_alloc_skb
      		--> __alloc_page_frag()
      to make the allocated buffer can get an address with 0x...f80,
      then the same error happens. If I make it to 0x...f40 or 0x....fc0,
      everything will be still fine. So I tend to believe that the
      0x..f80 address cause the silicon to behave abnormally.
      
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=70761
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Johannes Berg <johannes@sipsolutions.net>
      Cc: Jarod Wilson <jarod@redhat.com>
      Signed-off-by: NFeng Tang <feng.tang@intel.com>
      Tested-by: NOle Lukoie <olelukoie@mail.ru>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      26c5f03b
    • I
      team: don't call netdev_change_features under team->lock · f6988cb6
      Ivan Vecera 提交于
      The team_device_event() notifier calls team_compute_features() to fix
      vlan_features under team->lock to protect team->port_list. The problem is
      that subsequent __team_compute_features() calls netdev_change_features()
      to propagate vlan_features to upper vlan devices while team->lock is still
      taken. This can lead to deadlock when NETIF_F_LRO is modified on lower
      devices or team device itself.
      
      Example:
      The team0 as active backup with eth0 and eth1 NICs. Both eth0 & eth1 are
      LRO capable and LRO is enabled. Thus LRO is also enabled on team0.
      
      The command 'ethtool -K team0 lro off' now hangs due to this deadlock:
      
      dev_ethtool()
      -> ethtool_set_features()
       -> __netdev_update_features(team)
        -> netdev_sync_lower_features()
         -> netdev_update_features(lower_1)
          -> __netdev_update_features(lower_1)
          -> netdev_features_change(lower_1)
           -> call_netdevice_notifiers(...)
            -> team_device_event(lower_1)
             -> team_compute_features(team) [TAKES team->lock]
              -> netdev_change_features(team)
               -> __netdev_update_features(team)
                -> netdev_sync_lower_features()
                 -> netdev_update_features(lower_2)
                  -> __netdev_update_features(lower_2)
                  -> netdev_features_change(lower_2)
                   -> call_netdevice_notifiers(...)
                    -> team_device_event(lower_2)
                     -> team_compute_features(team) [DEADLOCK]
      
      The bug is present in team from the beginning but it appeared after the commit
      fd867d51 (net/core: generic support for disabling netdev features down stack)
      that adds synchronization of features with lower devices.
      
      Fixes: fd867d51 (net/core: generic support for disabling netdev features down stack)
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: NIvan Vecera <ivecera@redhat.com>
      Signed-off-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f6988cb6
    • E
      sfc: on MC reset, clear PIO buffer linkage in TXQs · c0795bf6
      Edward Cree 提交于
      Otherwise, if we fail to allocate new PIO buffers, our TXQs will try to
      use the old ones, which aren't there any more.
      
      Fixes: 183233be "sfc: Allocate and link PIO buffers; map them with write-combining"
      Signed-off-by: NEdward Cree <ecree@solarflare.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c0795bf6
    • G
      net: mvneta: Fix lacking spinlock initialization · 91c45e38
      Gregory CLEMENT 提交于
      The spinlock used by the hwbm functions must be initialized by the
      network driver. This commit fixes this lack and the following erros when
      lockdep is enabled:
      
      INFO: trying to register non-static key.
      the code is fine but needs lockdep annotation.
      turning off the locking correctness validator.
      [<c010ff80>] (unwind_backtrace) from [<c010bd08>] (show_stack+0x10/0x14)
      [<c010bd08>] (show_stack) from [<c032913c>] (dump_stack+0xb4/0xe0)
      [<c032913c>] (dump_stack) from [<c01670e4>] (__lock_acquire+0x1f58/0x2060)
      [<c01670e4>] (__lock_acquire) from [<c0167dec>] (lock_acquire+0xa4/0xd0)
      [<c0167dec>] (lock_acquire) from [<c06f6650>] (_raw_spin_lock_irqsave+0x54/0x68)
      [<c06f6650>] (_raw_spin_lock_irqsave) from [<c058e830>] (hwbm_pool_add+0x1c/0xdc)
      [<c058e830>] (hwbm_pool_add) from [<c043f4e8>] (mvneta_bm_pool_use+0x338/0x490)
      [<c043f4e8>] (mvneta_bm_pool_use) from [<c0443198>] (mvneta_probe+0x654/0x1284)
      [<c0443198>] (mvneta_probe) from [<c03b894c>] (platform_drv_probe+0x4c/0xb0)
      [<c03b894c>] (platform_drv_probe) from [<c03b7158>] (driver_probe_device+0x214/0x2c0)
      [<c03b7158>] (driver_probe_device) from [<c03b72c4>] (__driver_attach+0xc0/0xc4)
      [<c03b72c4>] (__driver_attach) from [<c03b5440>] (bus_for_each_dev+0x68/0x9c)
      [<c03b5440>] (bus_for_each_dev) from [<c03b65b8>] (bus_add_driver+0x1a0/0x218)
      [<c03b65b8>] (bus_add_driver) from [<c03b79cc>] (driver_register+0x78/0xf8)
      [<c03b79cc>] (driver_register) from [<c01018f4>] (do_one_initcall+0x90/0x1dc)
      [<c01018f4>] (do_one_initcall) from [<c0900de4>] (kernel_init_freeable+0x15c/0x1fc)
      [<c0900de4>] (kernel_init_freeable) from [<c06eed90>] (kernel_init+0x8/0x114)
      [<c06eed90>] (kernel_init) from [<c0107910>] (ret_from_fork+0x14/0x24)
      
      Fixes: baa11ebc ("net: mvneta: Use the new hwbm framework")
      Reported-by: NRussell King <rmk+kernel@armlinux.org.uk>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NGregory CLEMENT <gregory.clement@free-electrons.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      91c45e38
    • S
      qed: Reset the enable flag for eth protocol. · ec7c7f5c
      Sudarsana Reddy Kalluru 提交于
      This patch fixes the coding error in determining the enable flag for
      the application/protocol. The enable flag should be set for all protocols
      but the eth.
      Signed-off-by: NSudarsana Reddy Kalluru <sudarsana.kalluru@qlogic.com>
      Signed-off-by: NYuval Mintz <Yuval.Mintz@qlogic.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ec7c7f5c
  6. 25 5月, 2016 1 次提交
    • G
      net/qlge: Avoids recursive EEH error · 3275c0c6
      Gavin Shan 提交于
      One timer, whose handler keeps reading on MMIO register for EEH
      core to detect error in time, is started when the PCI device driver
      is loaded. MMIO register can't be accessed during PE reset in EEH
      recovery. Otherwise, the unexpected recursive error is triggered.
      The timer isn't closed that time if the interface isn't brought
      up. So the unexpected recursive error is seen during EEH recovery
      when the interface is down.
      
      This avoids the unexpected recursive EEH error by closing the timer
      in qlge_io_error_detected() before EEH PE reset unconditionally. The
      timer is started unconditionally after EEH PE reset in qlge_io_resume().
      Also, the timer should be closed unconditionally when the device is
      removed from the system permanently in qlge_io_error_detected().
      Reported-by: NShriya R. Kulkarni <shriyakul@in.ibm.com>
      Signed-off-by: NGavin Shan <gwshan@linux.vnet.ibm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3275c0c6
  7. 24 5月, 2016 4 次提交
  8. 23 5月, 2016 1 次提交
    • L
      x86: remove pointless uaccess_32.h complexity · 5b09c3ed
      Linus Torvalds 提交于
      I'm looking at trying to possibly merge the 32-bit and 64-bit versions
      of the x86 uaccess.h implementation, but first this needs to be cleaned
      up.
      
      For example, the 32-bit version of "__copy_to_user_inatomic()" is mostly
      the special cases for the constant size, and it's actually never
      relevant.  Every user except for one aren't actually using a constant
      size anyway, and the one user that uses it is better off just using
      __put_user() instead.
      
      So get rid of the unnecessary complexity.
      
      [ The same cleanup should likely happen to __copy_from_user_inatomic()
        as well, but that one has a lot more users that I need to take a look
        at first ]
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      5b09c3ed
  9. 21 5月, 2016 11 次提交