The error exit path needs err explicitly set. Otherwise it
returns success and the only caller, xfrm_output_resume(),
would oops in skb_dst(skb)->ops derefence as skb_dst(skb) is
NULL.

Bug introduced in commit bb65a9cb (xfrm: removes a superfluous
check and add a statistic).
Signed-off-by: NTimo Teräs <timo.teras@iki.fi>
Cc: Li RongQing <roy.qing.li@gmail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Commit 55257d72 (virtio-net: fill only rx
queues which are being used) only does the napi enabling during open for
curr_queue_pairs. This will break multiqueue receiving since napi of new queues
were still disabled after changing the number of queues.

This patch fixes this by enabling napi for all possible queues during open.

Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: NJason Wang <jasowang@redhat.com>
Acked-by: NRusty Russell <rusty@rustcorp.com.au>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch is a fix for a bug triggering newly_acked_sacked < 0
in tcp_ack(.).

The bug is triggered by sacked_out decreasing relative to prior_sacked,
but packets_out remaining the same as pior_packets. This is because the
snapshot of prior_packets is taken after tcp_sacktag_write_queue() while
prior_sacked is captured before tcp_sacktag_write_queue(). The problem
is: tcp_sacktag_write_queue (tcp_match_skb_to_sack() -> tcp_fragment)
adjusts the pcount for packets_out and sacked_out (MSS change or other
reason). As a result, this delta in pcount is reflected in
(prior_sacked - sacked_out) but not in (prior_packets - packets_out).

This patch does the following:
1) initializes prior_packets at the start of tcp_ack() so as to
capture the delta in packets_out created by tcp_fragment.
2) introduces a new "previous_packets_out" variable that snapshots
packets_out right before tcp_clean_rtx_queue, so pkts_acked can be
correctly computed as before.
3) Computes pkts_acked using previous_packets_out, and computes
newly_acked_sacked using prior_packets.
Signed-off-by: NNandita Dukkipati <nanditad@google.com>
Acked-by: NYuchung Cheng <ycheng@google.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Included change:
- fix double free in case of failure during mesh initialisation
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Commit bfd428da ("net: ethernet: sun: initialize variables directly")
dropped the only loop that was using i but did not remove the actual
variable, therefore causing a warning when building. This patch drops
the now redundant line.
Reported-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NEmilio López <emilio@elopez.com.ar>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Commit e998fd41 ("net: ethernet: korina: initialize variables directly")
dropped the only loop that was using i but did not remove the actual
variable, therefore causing a warning when building. This patch drops
the now redundant line.
Signed-off-by: NEmilio López <emilio@elopez.com.ar>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Commit 3b0aaef8 ("net: ethernet: apple: initialize variables directly")
dropped the only loop that was using i but did not remove the actual
variable, therefore causing a warning when building. This patch drops
the now redundant line.
Signed-off-by: NEmilio López <emilio@elopez.com.ar>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Added support for Cinterion's PLxx WWAN Interface by adding QMI_FIXED_INTF with
Cinterion's Vendor ID as well as Product ID and WWAN Interface Number.
Signed-off-by: NHans-Christoph Schemmel <hans-christoph.schemmel@gemalto.com>
Signed-off-by: NChristian Schmiedl <christian.schmiedl@gemalto.com>
Acked-by: NBjørn Mork <bjorn@mork.no>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Ben Hutchings says:

====================
Somewhat surprisingly, the net_dropmonitor reporting script doesn't work
at all.  This series fixes it and then makes it slightly more efficient.
====================
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Acked-by: NNeil Horman <nhorman@tuxdriver.com>

We can read /proc/kallsyms in a fraction of a second, so why waste
a further fraction of a second showing progress?
Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The sort order of dictionaries in Python is undocumented.  Use
tuples instead, which are documented to be lexically ordered.
Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The comparison between traced and symbol addresses is backwards: if
the traced address doesn't exactly match a symbol (which we don't
expect it to), we'll show the next symbol and the offset to it,
whereas we should show the previous symbol and the offset from it.

Cc: stable@vger.kernel.org
Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This works much better if we don't treat protocol numbers as addresses.

Cc: stable@vger.kernel.org
Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

MVF is a family while MVF600 is a particular SoC in the family.  We
generally prefer to use SoC rather than family name in compatible string
to define a particular type of fec device.  And this is how fec_dt_ids
works for all those IMX fec variants.  Let's change mvf to mvf600 to
have it work in the same way.
Signed-off-by: NShawn Guo <shawn.guo@linaro.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

o After change in EPORT features of 82xx adapter, netdev->features needs to
  be updated to reflect EPORT feature updates but driver was manipulating
  netdev->features at wrong place.
o This patch uses netdev_update_features() and .ndo_fix_features() to
  update netdev->features properly.
Signed-off-by: NShahed Shaikh <shahed.shaikh@qlogic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Code is removed because netdev->trans_start updates made by the driver
will be ignored by the kernel.
Signed-off-by: NSony Chacko <sony.chacko@qlogic.com>
Signed-off-by: NShahed Shaikh <shahed.shaikh@qlogic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix error paths in probe to assign proper error codes to probe return value.
Signed-off-by: NSony Chacko <sony.chacko@qlogic.com>
Signed-off-by: NShahed Shaikh <shahed.shaikh@qlogic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NNithin Nayak Sujir <nsujir@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

After resetting the device, the driver waits for a signature to be
updated to know that firmware has completed initialization. However, the
call to tg3_poll_fw() is being done too late and we're writing to the
GRC_MODE register before it has completely initialized, causing
contention with firmware.  This logic has existed since day one but is
causing PCIE link to go down randomly at startup on one platform once
every few hundred reboots.

Move the tg3_poll_fw() up to before we write to the GRC_MODE register
after reset.
Signed-off-by: NNithin Nayak Sujir <nsujir@broadcom.com>
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

On errors in batadv_mesh_init(), bat_counters will be freed in both
batadv_mesh_free() and batadv_softif_init_late(). This patch fixes this
by returning earlier from batadv_softif_init_late() in case of errors in
batadv_mesh_init() and by setting bat_counters to NULL after freeing.
Signed-off-by: NMartin Hundebøll <martin@hundeboll.net>
Signed-off-by: NMarek Lindner <lindner_marek@yahoo.de>
Signed-off-by: NAntonio Quartulli <ordex@autistici.org>

John W. Linville says:

====================
This pull request is intended for the 3.10 series.  It contains a
variety of fixes for problems discovered during the merge window and
after 3.10-rc1.

For the mac80211 bits, Johannes says the following:

"This is what I have:
 * a patch from Felix to fix RCU usage in his rate table code
 * a patch from Ilan to add the wdev id to some notifications so they can
   actually be used by userspace
 * Sasha Levin found an issue in how hwsim handles devices
 * a fix for a bug in the wiphy_register() error path that's been there forever
 * three fixes for WoWLAN
 * AP mode frame matching was erroneously giving frames to all virtual AP
   interfaces (reported by Jouni)
 * a fix for HT handling in my CSA changes, found by Sujith
 * a fix for some locking simplifications gone wrong
 * Ben Greear found more cfg80211/mac80211 state confusion
 * and a fix for another bug found by Jouni: local state changes need to be
   reported by mac80211 to cfg80211 so it disconnects properly."

And for the iwlwifi bits, he says:

"I have fixes for a firmware crash during resume, multicast RX,
aggregation and a workaround for a firmware scanning bug."

Along with those...

Albert Pool adds a USB ID to the rtl8192cu driver.

Arend van Spriel restores a driver option support flag that had been
removed from 3.9 due to a bug in that version of the driver.

Felix Fietkau fixes a trio of ath9k issues with a series of small
patches.

Geert Uytterhoeven provides a Kconfig fix for ath9k (which you also
merged, so it isn't in the diff here).

Larry Finger gives us a fix for a build warning on big-endian systems
for rtlwifi.

Rafał Miłecki adds some core IDs to the bcma driver.

Sujith Manoharan fixes a module unloading crash in ath9k, and corrects
some calibration settings for AR9485.
====================
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch cures transmit timeout's with DHCP observed
while running under KVM. When the transmit ring is cleaned out,
the Byte Queue Limit values need to be reset.
Signed-off-by: NStephen Hemminger <stephen@networkplumber.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch fixes a potential race with concurrently running asynchronous
write requests.  The values for device's RX control register are now
stored in dynamically allocated buffers so each URB submission has it's
own copy.  Doing it the old way is data clobbering prone.

This patch is against latest 'net' tree.
Signed-off-by: NPetko Manolov <petkan@nucleusys.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In get_capi_ctr_by_nr() and get_capi_appl_by_nr() the parameter comes
from skb->data.  The current code can underflow to one space before the
start of the array.

The sanity check isn't needed in __get_capi_appl_by_nr() but I changed
it to match the others.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

Starting with commit 91226790
`bnx2x: use FW 7.8.17', the bnx2x driver no longer requests the FW to perform
IP checksums for IPv4 packets.

This behaviour needs to be revised for 57710/57711 chips -
when using GSO, if the driver will not set the IP checksum flag then packets
will be transmitted by the chip without a valid IP checksum, resulting in
a drop of all such packets on the receiver-side.
Signed-off-by: NYuval Mintz <yuvalmin@broadcom.com>
Signed-off-by: NDmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: NEilon Greenstein <eilong@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Another fix needed in ipgre_err(), as parse_gre_header() might change
skb->head.

Bug added in commit c5441932 (GRE: Refactor GRE tunneling code.)
Signed-off-by: NEric Dumazet <edumazet@google.com>
Cc: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

8168evl offloaded checksums are wrong since commit
e5195c1f ("r8169: fix 8168evl frame padding.")
pads small packets to 60 bytes (without ethernet checksum). Typical symptoms
appear as UDP checksums which are wrong by the count of added bytes.

It isn't worth compensating. Let the driver checksum.

Due to the skb length changes, TSO code is moved before the Tx descriptor gets
written.
Signed-off-by: NFrancois Romieu <romieu@fr.zoreil.com>
Tested-by: NHolger Hoffstätte <holger.hoffstaette@googlemail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When bond_3ad_get_active_agg_info() is used in all show_ad_ functions
it is not protected against slave manipulation and since it walks over
the slaves and uses them, this can easily result in NULL pointer
dereference or use of freed memory. Both the new wrapper and the
internal function are exported to the bonding as they're needed in
different places.
Signed-off-by: NNikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When getting arp_ip_targets if we encounter a bad IP, arp_ip_count still
gets increased and all the targets after the wrong one will not be probed
if arp_interval is enabled after that (unless a new IP target is added
through sysfs) because of the zero entry, in this case reading
arp_ip_target through sysfs will show valid targets even if there's a
zero entry.
Example: 1.2.3.4,4.5.6.7,blah,5.6.7.8
When retrieving the list from arp_ip_target the output would be:
1.2.3.4,4.5.6.7,5.6.7.8
but there will be a 0 entry between 4.5.6.7 and 5.6.7.8. If arp_interval
is enabled after that 5.6.7.8 will never be checked because of that.
Signed-off-by: NNikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

There're few pr_debug() places that can provide the IPv4 address in
dotted decimal format instead which is more helpful.
Signed-off-by: NNikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Changing the mode without any locking can result in multiple races (e.g.
upping a bond, enslaving/releasing). Depending on which race is hit the
impact can vary from incosistent bond state to kernel crash.
Use RTNL to synchronize the mode setting with the dangerous races.
Signed-off-by: NNikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

'discovery->data.info' length is 22, NICKNAME_MAX_LEN is 21, so the
strncpy() will always left the last byte of 'discovery->data.info'
uninitialized.

When 'text' length is longer than 21 (NICKNAME_MAX_LEN), if still left
the last byte of 'discovery->data.info' uninitialized, the next
strlen() will cause issue.

Also 'discovery->data' is 'struct irda_device_info' which defined in
"include/uapi/...", it may copy to user mode, so need whole initialized.

All together, need use kzalloc() instead of kmalloc() to initialize all
members firstly.
Signed-off-by: NChen Gang <gang.chen@asianux.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The net/netlabel/netlabel_domainhash.c:netlbl_domhsh_add() function
does not properly validate new domain hash entries resulting in
potential problems when an administrator attempts to add an invalid
entry.  One such problem, as reported by Vlad Halilov, is a kernel
BUG (found in netlabel_domainhash.c:netlbl_domhsh_audit_add()) when
adding an IPv6 outbound mapping with a CIPSO configuration.

This patch corrects this problem by adding the necessary validation
code to netlbl_domhsh_add() via the newly created
netlbl_domhsh_validate() function.

Ideally this patch should also be pushed to the currently active
-stable trees.
Reported-by: NVlad Halilov <vlad.halilov@gmail.com>
Signed-off-by: NPaul Moore <pmoore@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

commit 0178b695 ("ipv6: Copy cork options in ip6_append_data")
added some code duplication and bad error recovery, leading to potential
crash in ip6_cork_release() as kfree() could be called with garbage.

use kzalloc() to make sure this wont happen.
Signed-off-by: NEric Dumazet <edumazet@google.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: Neal Cardwell <ncardwell@google.com>

Fix some instances where vxlan fdb 'used' field is not updated after the entry
is used.

v2: rename vxlan_find_mac() as __vxlan_find_mac() and create a new vxlan_find_mac()
that also updates ->used field.
Signed-off-by: NSridhar Samudrala <sri@us.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Add the missing iounmap() before return from gianfar_ptp_probe()
in the error handling case.
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

After a tx attempt, an A-MPDU subframe can still have fi->retries at 0
(if the retry count wasn't incremented due to powersave).
In that case it is still tracked as part of the block ack window, so
when draining the tid queue, its sequence number needs to be cleared
from the pending frame bitmap.
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch fixes some issues introduced in the rate control API rework.
When not running aggregation, copy bf->rates into info->control.rates
before applying the rate control status to it.
In ath_lookup_rate, the rates need to be pulled from bf->rates, not the
tx info.
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>