Skip to content
  1. Jun 08, 2016
  2. Jun 07, 2016
  3. Jun 06, 2016
    • Michal Schmidt's avatar
      bnx2x: allow adding VLANs while interface is down · a02cc9d3
      Michal Schmidt authored
      Since implementing VLAN filtering in commit 05cc5a39
      
      
      ("bnx2x: add vlan filtering offload") bnx2x refuses to add a VLAN while
      the interface is down:
      
        # ip link add link enp3s0f0 enp3s0f0_10 type vlan id 10
        RTNETLINK answers: Bad address
      
      and in dmesg (with bnx2x.debug=0x20):
        bnx2x: [bnx2x_vlan_rx_add_vid:12941(enp3s0f0)]Ignoring VLAN
        configuration the interface is down
      
      Other drivers have no problem with this.
      Fix this peculiar behavior in the following way:
       - Accept requests to add/kill VID regardless of the device state.
         Maintain the requested list of VIDs in the bp->vlan_reg list.
       - If the device is up, try to configure the VID list into the hardware.
         If we run out of VLAN credits or encounter a failure configuring an
         entry, fall back to accepting all VLANs.
         If we successfully configure all entries from the list, turn the
         fallback off.
       - Use the same code for reconfiguring VLANs during NIC load.
      
      Signed-off-by: default avatarMichal Schmidt <mschmidt@redhat.com>
      Acked-by: default avatarYuval Mintz <Yuval.Mintz@qlogic.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a02cc9d3
  4. Jun 05, 2016
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-for-davem-2016-06-04' of... · 4ef36e15
      David S. Miller authored
      Merge tag 'wireless-drivers-for-davem-2016-06-04' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      wireless-drivers fixes for 4.7
      
      brcmfmac
      
      * add fallback RSSI report for devices that do not report per-chain values
      * fix a null pointer derefence regression on PCIe full dongle devices
      
      rtlwifi
      
      * fix scheduling while atomic regression from commit 49f86ec2
      
      
      
      MAINTAINERS
      
      * add file patterns for wireless device tree bindings
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4ef36e15
  5. Jun 04, 2016
  6. Jun 03, 2016
    • Franky Lin's avatar
      brcmfmac: add eth_type_trans back for PCIe full dongle · 31143e29
      Franky Lin authored
      A regression was introduced in commit 9c349892 ("brcmfmac: revise
      handling events in receive path") which moves eth_type_trans() call
      to brcmf_rx_frame(). Msgbuf layer doesn't use brcmf_rx_frame() but invokes
      brcmf_netif_rx() directly. In such case the Ethernet header was not
      stripped out resulting in null pointer dereference in the networking
      stack.
      
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
      IP: [<ffffffff814c3ce6>] enqueue_to_backlog+0x56/0x260
      PGD 0
      Oops: 0000 [#1] PREEMPT SMP
      Modules linked in: fuse ipt_MASQUERADE nf_nat_masquerade_ipv4
      iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype
      [...]
      rtsx_pci scsi_mod usbcore usb_common i8042 serio nvme nvme_core
      CPU: 7 PID: 1340 Comm: irq/136-brcmf_p Not tainted 4.7.0-rc1-mainline #1
      Hardware name: Dell Inc. XPS 15 9550/0N7TVV, BIOS 01.02.00 04/07/2016
      task: ffff8804a0c5bd00 ti: ffff88049e124000 task.ti: ffff88049e124000
      RIP: 0010:[<ffffffff814c3ce6>] [<ffffffff814c3ce6>]
      enqueue_to_backlog+0x56/0x260
      RSP: 0018:ffff88049e127ca0 EFLAGS: 00010046
      RAX: 0000000000000000 RBX: ffff8804bddd7c40 RCX: 000000000000002f
      RDX: 0000000000000000 RSI: 0000000000000007 RDI: ffff8804bddd7d4c
      RBP: ffff88049e127ce8 R08: 0000000000000000 R09: 0000000000000000
      R10: ffff8804bddd12c0 R11: 000000000000149e R12: 0000000000017c40
      R13: ffff88049e127d08 R14: ffff8804a9bd6d00 R15: ffff8804bddd7d4c
      FS: 0000000000000000(0000) GS:ffff8804bddc0000(0000) knlGS:0000000000000000
      CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000000048 CR3: 0000000001806000 CR4: 00000000003406e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Stack:
      ffff8804bdddad00 ffff8804ad089e00 0000000000000000 0000000000000282
      0000000000000000 ffff8804a9bd6d00 ffff8804a1b27e00 ffff8804a9bd6d00
      ffff88002ee88000 ffff88049e127d28 ffffffff814c3f3b ffffffff81311fc3
      Call Trace:
      [<ffffffff814c3f3b>] netif_rx_internal+0x4b/0x170
      [<ffffffff81311fc3>] ? swiotlb_tbl_unmap_single+0xf3/0x120
      [<ffffffff814c5467>] netif_rx_ni+0x27/0xc0
      [<ffffffffa08519e9>] brcmf_netif_rx+0x49/0x70 [brcmfmac]
      [<ffffffffa08564d4>] brcmf_msgbuf_process_rx+0x2b4/0x570 [brcmfmac]
      [<ffffffff81020017>] ? __xen_set_pgd_hyper+0x57/0xd0
      [<ffffffff810d60b0>] ? irq_forced_thread_fn+0x70/0x70
      [<ffffffffa0857381>] brcmf_proto_msgbuf_rx_trigger+0x31/0xe0 [brcmfmac]
      [<ffffffffa0861e8f>] brcmf_pcie_isr_thread+0x7f/0x110 [brcmfmac]
      [<ffffffff810d60d0>] irq_thread_fn+0x20/0x50
      [<ffffffff810d63ad>] irq_thread+0x12d/0x1c0
      [<ffffffff815d07d5>] ? __schedule+0x2f5/0x7a0
      [<ffffffff810d61d0>] ? wake_threads_waitq+0x30/0x30
      [<ffffffff810d6280>] ? irq_thread_dtor+0xb0/0xb0
      [<ffffffff81098ea8>] kthread+0xd8/0xf0
      [<ffffffff815d4b7f>] ret_from_fork+0x1f/0x40
      [<ffffffff81098dd0>] ? kthread_worker_fn+0x170/0x170
      Code: 1c f5 60 9a 8e 81 9c 58 0f 1f 44 00 00 48 89 45 d0 fa 66 0f 1f
      44 00 00 4c 8d bb 0c 01 00 00 4c 89 ff e8 5e 08 11 00 49 8b 56 20 <48>
      8b 52 48 83 e2 01 74 10 8b 8b 08 01 00 00 8b 15 59 c5 42 00
      RIP [<ffffffff814c3ce6>] enqueue_to_backlog+0x56/0x260
      RSP <ffff88049e127ca0>
      CR2: 0000000000000048
      
      Fixes: 9c349892
      
       ("brcmfmac: revise handling events in receive path")
      Reported-by: default avatarRafal Milecki <zajec5@gmail.com>
      Reported-by: default avatarGrey Christoforo <grey@christoforo.net>
      Reviewed-by: default avatarPieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
      Reviewed-by: default avatarArend Van Spriel <arend@broadcom.com>
      Reviewed-by: default avatarHante Meuleman <hante.meuleman@broadcom.com>
      Signed-off-by: default avatarFranky Lin <franky.lin@broadcom.com>
      [arend@broadcom.com: rephrased the commit message]
      Signed-off-by: default avatarArend van Spriel <arend@broadcom.com>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      31143e29
    • Kangjie Lu's avatar
      rds: fix an infoleak in rds_inc_info_copy · 4116def2
      Kangjie Lu authored
      
      
      The last field "flags" of object "minfo" is not initialized.
      Copying this object out may leak kernel stack data.
      Assign 0 to it to avoid leak.
      
      Signed-off-by: default avatarKangjie Lu <kjlu@gatech.edu>
      Acked-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4116def2
    • Kangjie Lu's avatar
      tipc: fix an infoleak in tipc_nl_compat_link_dump · 5d2be142
      Kangjie Lu authored
      
      
      link_info.str is a char array of size 60. Memory after the NULL
      byte is not initialized. Sending the whole object out can cause
      a leak.
      
      Signed-off-by: default avatarKangjie Lu <kjlu@gatech.edu>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5d2be142
    • Eric Dumazet's avatar
      Possible problem with e6afc8ac ("udp: remove headers from UDP packets before queueing") · ce25d66a
      Eric Dumazet authored
      Paul Moore tracked a regression caused by a recent commit, which
      mistakenly assumed that sk_filter() could be avoided if socket
      had no current BPF filter.
      
      The intent was to avoid udp_lib_checksum_complete() overhead.
      
      But sk_filter() also checks skb_pfmemalloc() and
      security_sock_rcv_skb(), so better call it.
      
      Fixes: e6afc8ac
      
       ("udp: remove headers from UDP packets before queueing")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarPaul Moore <paul@paul-moore.com>
      Tested-by: default avatarPaul Moore <paul@paul-moore.com>
      Tested-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
      Cc: samanthakumar <samanthakumar@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ce25d66a
    • Vincent Palatin's avatar
      stmmac: do not sleep in atomic context for mdio_reset · f55d84b0
      Vincent Palatin authored
      
      
      stmmac_mdio_reset() has been updated to use msleep rather udelay
      (as some PHY requires a one second delay there).
      It called from stmmac_resume() within the spin_lock_irqsave block
      atomic context triggering 'scheduling while atomic'.
      
      The stmmac_priv lock usage is not fully documented, but it seems
      to protect the access to the MAC registers / DMA structures rather
      than the MDIO bus or the PHY (which have separate locking),
      so we can push the spin_lock after the stmmac_mdio_reset call.
      
      Signed-off-by: default avatarVincent Palatin <vpalatin@chromium.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f55d84b0
  7. Jun 02, 2016
    • Arnd Bergmann's avatar
      qed: fix qed_fill_link() error handling · 14b84e86
      Arnd Bergmann authored
      
      
      gcc warns about qed_fill_link possibly accessing uninitialized data:
      
      drivers/net/ethernet/qlogic/qed/qed_main.c: In function 'qed_fill_link':
      drivers/net/ethernet/qlogic/qed/qed_main.c:1170:35: error: 'link_caps' may be used uninitialized in this function [-Werror=maybe-uninitialized]
      
      While this warning is only about the specific case of CONFIG_QED_SRIOV
      being disabled but the function getting called for a VF (which should
      never happen), another possibility is that qed_mcp_get_*() fails without
      returning data.
      
      This rearranges the code so we bail out in either of the two cases
      and print a warning instead of accessing the uninitialized data.
      
      The qed_link_output structure remains untouched in this case, but
      all callers first call memset() on it, so at least we are not leaking
      stack data then.
      
      As discussed, we also use a compile-time check to ensure we never
      use any of the VF code if CONFIG_QED_SRIOV is disabled, and the
      PCI device table is updated to no longer bind to virtual functions
      in that configuration.
      
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarYuval Mintz <Yuval.Mintz@qlogic.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      14b84e86
    • Colin Ian King's avatar
      net/ethoc: fix null dereference on error exit path · bfa49cfc
      Colin Ian King authored
      
      
      priv is assigned to NULL however some of the early error exit paths to
      label 'free' dereference priv, causing a null pointer dereference.
      
      Move the label 'free' to just the free_netdev statement, and add a new
      exit path 'free2' for the error cases were clk_disable_unprepare needs
      calling before the final free.
      
      Fixes issue found by CoverityScan, CID#113260
      
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Reviewed-by: default avatarMax Filippov <jcmvbkbc@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bfa49cfc
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · fc14963f
      David S. Miller authored
      
      
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for your net tree,
      they are:
      
      1) Fix incorrect timestamp in nfnetlink_queue introduced when addressing
         y2038 safe timestamp, from Florian Westphal.
      
      2) Get rid of leftover conntrack definition from the previous merge
         window, oneliner from Florian.
      
      3) Make nf_queue handler pernet to resolve race on dereferencing the
         hook state structure with netns removal, from Eric Biederman.
      
      4) Ensure clean exit on unregistered helper ports, from Taehee Yoo.
      
      5) Restore FLOWI_FLAG_KNOWN_NH in nf_dup_ipv6. This got lost while
         generalizing xt_TEE to add packet duplication support in nf_tables,
         from Paolo Abeni.
      
      6) Insufficient netlink NFTA_SET_TABLE attribute check in
         nf_tables_getset(), from Phil Turnbull.
      
      7) Reject helper registration on duplicated ports via modparams.
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fc14963f
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2016-06-01' of... · 31843af4
      David S. Miller authored
      
      Merge tag 'mac80211-for-davem-2016-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      Three small fixes for the current cycle:
       * missing netlink attribute check in hwsim wmediumd (Martin)
       * fast xmit structure alignment fix (Felix)
       * mesh path flush/synchronisation fix (Bob)
      ====================
      
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      31843af4
  8. Jun 01, 2016
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 6b15d665
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix negative error code usage in ATM layer, from Stefan Hajnoczi.
      
       2) If CONFIG_SYSCTL is disabled, the default TTL is not initialized
          properly.  From Ezequiel Garcia.
      
       3) Missing spinlock init in mvneta driver, from Gregory CLEMENT.
      
       4) Missing unlocks in hwmb error paths, also from Gregory CLEMENT.
      
       5) Fix deadlock on team->lock when propagating features, from Ivan
          Vecera.
      
       6) Work around buffer offset hw bug in alx chips, from Feng Tang.
      
       7) Fix double listing of SCTP entries in sctp_diag dumps, from Xin
          Long.
      
       8) Various statistics bug fixes in mlx4 from Eric Dumazet.
      
       9) Fix some randconfig build errors wrt fou ipv6 from Arnd Bergmann.
      
      10) All of l2tp was namespace aware, but the ipv6 support code was not
          doing so.  From Shmulik Ladkani.
      
      11) Handle on-stack hrtimers properly in pktgen, from Guenter Roeck.
      
      12) Propagate MAC changes properly through VLAN devices, from Mike
          Manning.
      
      13) Fix memory leak in bnx2x_init_one(), from Vitaly Kuznetsov.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (62 commits)
        sfc: Track RPS flow IDs per channel instead of per function
        usbnet: smsc95xx: fix link detection for disabled autonegotiation
        virtio_net: fix virtnet_open and virtnet_probe competing for try_fill_recv
        bnx2x: avoid leaking memory on bnx2x_init_one() failures
        fou: fix IPv6 Kconfig options
        openvswitch: update checksum in {push,pop}_mpls
        sctp: sctp_diag should dump sctp socket type
        net: fec: update dirty_tx even if no skb
        vlan: Propagate MAC address to VLANs
        atm: iphase: off by one in rx_pkt()
        atm: firestream: add more reserved strings
        vxlan: Accept user specified MTU value when create new vxlan link
        net: pktgen: Call destroy_hrtimer_on_stack()
        timer: Export destroy_hrtimer_on_stack()
        net: l2tp: Make l2tp_ip6 namespace aware
        Documentation: ip-sysctl.txt: clarify secure_redirects
        sfc: use flow dissector helpers for aRFS
        ieee802154: fix logic error in ieee802154_llsec_parse_dev_addr
        net: nps_enet: Disable interrupts before napi reschedule
        net/lapb: tuse %*ph to dump buffers
        ...
      6b15d665
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 58c1f995
      Linus Torvalds authored
      Pull sparc fixes from David Miller:
       "sparc64 mmu context allocation and trap return bug fixes"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc64: Fix return from trap window fill crashes.
        sparc: Harden signal return frame checks.
        sparc64: Take ctx_alloc_lock properly in hugetlb_setup().
      58c1f995
    • Jon Cooper's avatar
      sfc: Track RPS flow IDs per channel instead of per function · faf8dcc1
      Jon Cooper authored
      
      
      Otherwise we get confused when two flows on different channels get the
       same flow ID.
      
      Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      faf8dcc1
    • Christoph Fritz's avatar
      usbnet: smsc95xx: fix link detection for disabled autonegotiation · d69d1694
      Christoph Fritz authored
      
      
      To detect link status up/down for connections where autonegotiation is
      explicitly disabled, we don't get an irq but need to poll the status
      register for link up/down detection.
      This patch adds a workqueue to poll for link status.
      
      Signed-off-by: default avatarChristoph Fritz <chf.fritz@googlemail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d69d1694
    • wangyunjian's avatar
      virtio_net: fix virtnet_open and virtnet_probe competing for try_fill_recv · f00e35e2
      wangyunjian authored
      
      
      In function virtnet_open() and virtnet_probe(), func try_fill_recv() may
      be executed at the same time. VQ in virtqueue_add() has not been protected
      well and BUG_ON will be triggered when virito_net.ko being removed.
      
      Signed-off-by: default avatarYunjian Wang <wangyunjian@huawei.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f00e35e2
    • Vitaly Kuznetsov's avatar
      bnx2x: avoid leaking memory on bnx2x_init_one() failures · bae5499c
      Vitaly Kuznetsov authored
      
      
      bnx2x_init_bp() allocates memory with bnx2x_alloc_mem_bp() so if we
      fail later in bnx2x_init_one() we need to free this memory
      with bnx2x_free_mem_bp() to avoid leakages. E.g. I'm observing memory
      leaks reported by kmemleak when a failure (unrelated) happens in
      bnx2x_vfpf_acquire().
      
      Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Acked-by: default avatarYuval Mintz <Yuval.Mintz@qlogic.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bae5499c