1. 28 7月, 2013 5 次提交
  2. 27 7月, 2013 8 次提交
    • N
      atl1c: Fix misuse of netdev_alloc_skb in refilling rx ring · ebe7fdba
      Neil Horman 提交于
      atl1c uses netdev_alloc_skb to refill its rx dma ring, but that call makes no
      guarantees about the suitability of the memory for use in DMA.  As a result
      we've gotten reports of atl1c drivers occasionally hanging and needing to be
      reset:
      https://bugzilla.kernel.org/show_bug.cgi?id=54021
      
      Fix this by modifying the call to use the internal version __netdev_alloc_skb,
      where you can set the gfp_mask explicitly to include GFP_DMA.
      
      Tested by two reporters in the above bug, who have the hardware to validate it.
      Both report immediate cessation of the problem with this patch
      Signed-off-by: NNeil Horman <nhorman@tuxdriver.com>
      CC: Jay Cliburn <jcliburn@gmail.com>
      CC: "David S. Miller" <davem@davemloft.net>
      CC: stable@vger.kernel.org
      Tested-by: NLuis Henriques <luis.henriques@canonical.com>
      Tested-by: NVincent Alquier <vincent.alquier@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ebe7fdba
    • G
      net/tg3: Fix warning from pci_disable_device() · c80dc13d
      Gavin Shan 提交于
      The patch fixes following warning. The PCI device might have been
      disabled somewhere else when we have EEH errors during early stage.
      
      Device tg3 disabling already-disabled device
      WARNING: at drivers/pci/pci.c:1403
      :
      NIP [c00000000044fd5c] .pci_disable_device+0xcc/0xe0
      LR [c00000000044fd58] .pci_disable_device+0xc8/0xe0
      Call Trace:
      [c000003f80bc7370] [c00000000044fd58] .pci_disable_device+0xc8/0xe0
      [c000003f80bc73f0] [d00000001cfe8fc0] .tg3_init_one+0x2f0/0x19f0 [tg3]
      [c000003f80bc74d0] [c0000000004534e8] .local_pci_probe+0x68/0xb0
      [c000003f80bc7560] [c0000000004537c8] .pci_device_probe+0x198/0x1a0
      [c000003f80bc7610] [c0000000004f9e98] .driver_probe_device+0xd8/0x450
      [c000003f80bc76a0] [c0000000004fa3bc] .__driver_attach+0x10c/0x110
      [c000003f80bc7730] [c0000000004f6e94] .bus_for_each_dev+0x94/0x100
      [c000003f80bc77d0] [c0000000004f9634] .driver_attach+0x34/0x50
      [c000003f80bc7850] [c0000000004f8f98] .bus_add_driver+0x288/0x380
      [c000003f80bc78f0] [c0000000004fae2c] .driver_register+0x9c/0x200
      [c000003f80bc7980] [c000000000453214] .__pci_register_driver+0x64/0x90
      [c000003f80bc7a10] [d00000001cff7a60] .tg3_driver_init+0x2c/0x40 [tg3]
      [c000003f80bc7a80] [c00000000000b424] .do_one_initcall+0x144/0x1f0
      [c000003f80bc7b70] [c0000000001244a0] .load_module+0x1f30/0x2700
      [c000003f80bc7d40] [c000000000124e80] .SyS_finit_module+0xc0/0x110
      [c000003f80bc7e30] [c000000000009dd4] syscall_exit+0x0/0x98
      Reported-by: NWei Yang <weiyang@linux.vnet.ibm.com>
      Signed-off-by: NGavin Shan <shangw@linux.vnet.ibm.com>
      Acked-by: NNithin Nayak Sujir <nsujir@broadcom.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c80dc13d
    • G
      net/tg3: Fix kernel crash · d8af4dfd
      Gavin Shan 提交于
      While EEH error happens, we might not have network device instance
      (struct net_device) yet. So we can't access the instance safely and
      check its link state, which causes kernel crash. The patch fixes it.
      
      EEH: Frozen PE#2 on PHB#3 detected
      EEH: This PCI device has failed 1 times in the last hour
      EEH: Notify device drivers to shutdown
      (NULL net_device): PCI I/O error detected
      Unable to handle kernel paging request for data at address 0x00000048
      Faulting instruction address: 0xd00000001c9387a8
      Oops: Kernel access of bad area, sig: 11 [#1]
      SMP NR_CPUS=1024 NUMA PowerNV
      :
      NIP [d00000001c9387a8] .tg3_io_error_detected+0x78/0x2a0 [tg3]
      LR [d00000001c9387a4] .tg3_io_error_detected+0x74/0x2a0 [tg3]
      Call Trace:
      [c000003f93a0f960] [d00000001c9387a4] .tg3_io_error_detected+0x74/0x2a0 [tg3]
      [c000003f93a0fa30] [c00000000003844c] .eeh_report_error+0xac/0x120
      [c000003f93a0fac0] [c0000000000371bc] .eeh_pe_dev_traverse+0x8c/0x150
      [c000003f93a0fb60] [c000000000038858] .eeh_handle_normal_event+0x128/0x3d0
      [c000003f93a0fbf0] [c000000000038db8] .eeh_handle_event+0x2b8/0x2c0
      [c000003f93a0fc90] [c000000000038e80] .eeh_event_handler+0xc0/0x170
      [c000003f93a0fd30] [c0000000000cc000] .kthread+0xf0/0x100
      [c000003f93a0fe30] [c00000000000a0dc] .ret_from_kernel_thread+0x5c/0x80
      Reported-by: NWei Yang <weiyang@linux.vnet.ibm.com>
      Signed-off-by: NGavin Shan <shangw@linux.vnet.ibm.com>
      Acked-by: NNithin Nayak Sujir <nsujir@broadcom.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d8af4dfd
    • F
      sysctl: range checking in do_proc_dointvec_ms_jiffies_conv · d738ce8f
      Francesco Fusco 提交于
      When (integer) sysctl values are expressed in ms and have to be
      represented internally as jiffies. The msecs_to_jiffies function
      returns an unsigned long, which gets assigned to the integer.
      This patch prevents the value to be assigned if bigger than
      INT_MAX, done in a similar way as in cba9f3 ("Range checking in
      do_proc_dointvec_(userhz_)jiffies_conv").
      Signed-off-by: NFrancesco Fusco <ffusco@redhat.com>
      CC: Andrew Morton <akpm@linux-foundation.org>
      CC: linux-kernel@vger.kernel.org
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d738ce8f
    • F
      neigh: prevent overflowing params in /proc/sys/net/ipv4/neigh/ · 555445cd
      Francesco Fusco 提交于
      Without this patch, the fields app_solicit, gc_thresh1, gc_thresh2,
      gc_thresh3, proxy_qlen, ucast_solicit, mcast_solicit could have
      assumed negative values when setting large numbers.
      Signed-off-by: NFrancesco Fusco <ffusco@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      555445cd
    • M
      drivers: net: sun4i-emac: select MDIO_SUN4I · 111cc5da
      Maxime Ripard 提交于
      The EMAC driver can't work without its associated PHY driver. Reflect
      this in the Kconfig options by selecting it.
      Signed-off-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      111cc5da
    • M
    • E
      usbnet: do not pretend to support SG/TSO · 20f01703
      Eric Dumazet 提交于
      usbnet doesn't support yet SG, so drivers should not advertise SG or TSO
      capabilities, as they allow TCP stack to build large TSO packets that
      need to be linearized and might use order-5 pages.
      
      This adds an extra copy overhead and possible allocation failures.
      
      Current code ignore skb_linearize() return code so crashes are even
      possible.
      
      Best is to not pretend SG/TSO is supported, and add this again when/if
      usbnet really supports SG for devices who could get a performance gain.
      
      Based on a prior patch from Freddy Xin <freddy@asix.com.tw>
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      20f01703
  3. 25 7月, 2013 7 次提交
    • D
      Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless · 1df86b4c
      David S. Miller 提交于
      John W. Linville says:
      
      ====================
      This is another batch of fixes intended for the 3.11 stream.  FWIW,
      this is the first request with fixes from the mac80211 and iwlwifi
      trees as well.
      
      Regarding the mac80211 bits, Johannes says:
      
      "Here I have a fix for RSSI thresholds in mesh, two minstrel fixes from
      Felix, an nl80211 fix from Michal and four various fixes I did myself."
      
      As for the iwlwifi bits, Johannes says:
      
      "Here I have a fix for debugfs directory creation (causing a spurious
      error message), two scanning fixes from David Spinadel, an LED fix and
      two patches related to a BA session problem that eventually caused
      firmware crashes from Emmanuel and a small BT fix for older devices as
      well as a workaround for a firmware problem with APs with very small
      beacon intervals from myself."
      
      Along with those:
      
      Arend van Spriel addresses a lock-up and a NULL pointer dereference
      in brcmfmac.
      
      Daniel Drake fixes an unhandled interrupt during device tear down
      in mwifiex.
      
      Larry Finger corrects a wil6210 build error.
      
      Oleksij Rempel fixes two ath9k_htc problems related to keeping the
      driver and firmware in sync.
      
      Solomon Peachy gives us a cw1200 fix to avoid an oops in monitor mode.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1df86b4c
    • F
      net: fix comment above build_skb() · deceb4c0
      Florian Fainelli 提交于
      build_skb() specifies that the data parameter must come from a kmalloc'd
      area, this is only true if frag_size equals 0, because then build_skb()
      will use kzsize(data) to figure out the actual data size. Update the
      comment to reflect that special condition.
      Signed-off-by: NFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      deceb4c0
    • E
      net: sun4i: fix timeout check · 2bf420a7
      Emilio López 提交于
      The current timeout check is comparing two constant values, so it won't
      ever detect a timeout. This patch reworks the affected code a bit so it
      has a chance at detecting timeouts correctly.
      Signed-off-by: NEmilio López <emilio@elopez.com.ar>
      Acked-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      2bf420a7
    • H
      ipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanup · 905a6f96
      Hannes Frederic Sowa 提交于
      Otherwise we end up dereferencing the already freed net->ipv6.mrt pointer
      which leads to a panic (from Srivatsa S. Bhat):
      
      BUG: unable to handle kernel paging request at ffff882018552020
      IP: [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
      PGD 290a067 PUD 207ffe0067 PMD 207ff1d067 PTE 8000002018552060
      Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
      Modules linked in: ebtable_nat ebtables nfs fscache nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables nfsd lockd nfs_acl exportfs auth_rpcgss autofs4 sunrpc 8021q garp bridge stp llc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter
      +ip6_tables ipv6 vfat fat vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support cdc_ether usbnet mii microcode i2c_i801 i2c_core lpc_ich mfd_core shpchp ioatdma dca mlx4_core be2net wmi acpi_cpufreq mperf ext4 jbd2 mbcache dm_mirror dm_region_hash dm_log dm_mod
      CPU: 0 PID: 7 Comm: kworker/u33:0 Not tainted 3.11.0-rc1-ea45e-a #4
      Hardware name: IBM  -[8737R2A]-/00Y2738, BIOS -[B2E120RUS-1.20]- 11/30/2012
      Workqueue: netns cleanup_net
      task: ffff8810393641c0 ti: ffff881039366000 task.ti: ffff881039366000
      RIP: 0010:[<ffffffffa0366b02>]  [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
      RSP: 0018:ffff881039367bd8  EFLAGS: 00010286
      RAX: ffff881039367fd8 RBX: ffff882018552000 RCX: dead000000200200
      RDX: 0000000000000000 RSI: ffff881039367b68 RDI: ffff881039367b68
      RBP: ffff881039367bf8 R08: ffff881039367b68 R09: 2222222222222222
      R10: 2222222222222222 R11: 2222222222222222 R12: ffff882015a7a040
      R13: ffff882014eb89c0 R14: ffff8820289e2800 R15: 0000000000000000
      FS:  0000000000000000(0000) GS:ffff88103fc00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: ffff882018552020 CR3: 0000000001c0b000 CR4: 00000000000407f0
      Stack:
       ffff881039367c18 ffff882014eb89c0 ffff882015e28c00 0000000000000000
       ffff881039367c18 ffffffffa034d9d1 ffff8820289e2800 ffff882014eb89c0
       ffff881039367c58 ffffffff815bdecb ffffffff815bddf2 ffff882014eb89c0
      Call Trace:
       [<ffffffffa034d9d1>] rawv6_close+0x21/0x40 [ipv6]
       [<ffffffff815bdecb>] inet_release+0xfb/0x220
       [<ffffffff815bddf2>] ? inet_release+0x22/0x220
       [<ffffffffa032686f>] inet6_release+0x3f/0x50 [ipv6]
       [<ffffffff8151c1d9>] sock_release+0x29/0xa0
       [<ffffffff81525520>] sk_release_kernel+0x30/0x70
       [<ffffffffa034f14b>] icmpv6_sk_exit+0x3b/0x80 [ipv6]
       [<ffffffff8152fff9>] ops_exit_list+0x39/0x60
       [<ffffffff815306fb>] cleanup_net+0xfb/0x1a0
       [<ffffffff81075e3a>] process_one_work+0x1da/0x610
       [<ffffffff81075dc9>] ? process_one_work+0x169/0x610
       [<ffffffff81076390>] worker_thread+0x120/0x3a0
       [<ffffffff81076270>] ? process_one_work+0x610/0x610
       [<ffffffff8107da2e>] kthread+0xee/0x100
       [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70
       [<ffffffff8162a99c>] ret_from_fork+0x7c/0xb0
       [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70
      Code: 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 66 66 66 66 90 4c 8b 67 30 49 89 fd e8 db 3c 1e e1 49 8b 9c 24 90 08 00 00 48 85 db 74 06 <4c> 39 6b 20 74 20 bb f3 ff ff ff e8 8e 3c 1e e1 89 d8 4c 8b 65
      RIP  [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
       RSP <ffff881039367bd8>
      CR2: ffff882018552020
      Reported-by: NSrivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
      Tested-by: NSrivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
      Signed-off-by: NHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      905a6f96
    • J
      fib_trie: potential out of bounds access in trie_show_stats() · f585a991
      Jerry Snitselaar 提交于
      With the <= max condition in the for loop, it will be always go 1
      element further than needed. If the condition for the while loop is
      never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
      end of nodesizes[].
      Signed-off-by: NJerry Snitselaar <jerry.snitselaar@oracle.com>
      Acked-by: NHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f585a991
    • D
      mlx5: use after free in mlx5_cmd_comp_handler() · 64d2c22a
      Dan Carpenter 提交于
      We can't dereference "ent" after passing it to free_cmd().
      Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      64d2c22a
    • L
      r8169: fix lockdep warning when removing interface · 4ea72445
      Lekensteyn 提交于
      The work queue is initialised in rtl_open (when the interface goes up),
      but canceled in rtl_remove_one (when the PCI device gets removed). If
      the network interface is not brought up, then the work queue struct is
      not initialised. When the device is removed, the attempt to cancel the
      uninitialised work queue causes a lockdep warning.
      
      This patch fixes the issue by moving cancel_work_sync to rtl_close (to
      match rtl_open). (Note that rtl_close is also called via
      unregister_netdev in rtl_remove_one.)
      Signed-off-by: NPeter Wu <lekensteyn@gmail.com>
      Acked-by: NFrancois Romieu <romieu@fr.zoreil.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4ea72445
  4. 24 7月, 2013 2 次提交
  5. 23 7月, 2013 12 次提交
  6. 21 7月, 2013 2 次提交
    • D
      Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless · f5f7ab67
      David S. Miller 提交于
      John W. Linville says:
      
      ====================
      Please accept this batch of fixes intended for the 3.11 tree...
      
      Alexey Khoroshilov fixes a suspend-related race in ath9k_htc.
      
      Arnd Bergmann corrects the alignment of a structure in the ssb code
      to be compatible with ARM devices.
      
      Bob Copeland provides an ath5k fix that corrects a mistaken variable
      initialization.
      
      Felix Fietkau corrects some frame accounting for dropped frames
      in ath9k.
      
      Geert Uytterhoeven brings a Kconfig fix to indicate the DMA
      requirements for rt2x00.
      
      Larry Finger offers two rtlwifi fixes: one that properly initializes
      a callback; and, a scattered collection of Kconfig, Makefile, and
      EXPORT_SYMBOL changes that correct some build problems.
      
      Finally, Sujith Manoharan provides an ath9k fix to disable a feature
      on a specific hardware device.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f5f7ab67
    • D
      Merge branch 'fixes-for-3.11' of git://gitorious.org/linux-can/linux-can · 8d716c7a
      David S. Miller 提交于
      Marc Kleine-Budde says:
      
      ====================
      here are two fixes for the v3.11 release cycle:
      
      Maximilian Schneider contributes a patch for the esd_usb2 CAN driver. It adds
      sanity checking to the data coming from the USB CAN adapter before using it.
      Alexey Khoroshilov from the Linux Driver Verification project fixes an urb leak
      in the error handling of the USB 8dev's usb_8dev_start() function.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8d716c7a
  7. 20 7月, 2013 4 次提交