Skip to main content

Browse the archive

https://github.com/torvalds/linux
05 April 2024, 19:05:47 UTC
sort by:
Revision Author Date Message Commit Date
a69bf3c Douglas Miller 04 March 2016, 21:36:56 UTC be2net: Don't leak iomapped memory on removal. The adapter->pcicfg resource is either mapped via pci_iomap() or derived from adapter->db. During be_remove() this resource was ignored and so could remain mapped after remove. Add a flag to track whether adapter->pcicfg was mapped or not, then use that flag in be_unmap_pci_bars() to unmap if required. Fixes: 25848c901 ("use PCI MMIO read instead of config read for errors") Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 20:18:31 UTC
cec0556 Neil Horman 04 March 2016, 18:40:48 UTC vmxnet3: avoid calling pskb_may_pull with interrupts disabled vmxnet3 has a function vmxnet3_parse_and_copy_hdr which, among other operations, uses pskb_may_pull to linearize the header portion of an skb. That operation eventually uses local_bh_disable/enable to ensure that it doesn't race with the drivers bottom half handler. Unfortunately, vmxnet3 preforms this parse_and_copy operation with a spinlock held and interrupts disabled. This causes us to run afoul of the WARN_ON_ONCE(irqs_disabled()) warning in local_bh_enable, resulting in this: WARNING: at kernel/softirq.c:159 local_bh_enable+0x59/0x90() (Not tainted) Hardware name: VMware Virtual Platform Modules linked in: ipv6 ppdev parport_pc parport microcode e1000 vmware_balloon vmxnet3 i2c_piix4 sg ext4 jbd2 mbcache sd_mod crc_t10dif sr_mod cdrom mptspi mptscsih mptbase scsi_transport_spi pata_acpi ata_generic ata_piix vmwgfx ttm drm_kms_helper drm i2c_core dm_mirror dm_region_hash dm_log dm_mod [last unloaded: mperf] Pid: 6229, comm: sshd Not tainted 2.6.32-616.el6.i686 #1 Call Trace: [<c04624d9>] ? warn_slowpath_common+0x89/0xe0 [<c0469e99>] ? local_bh_enable+0x59/0x90 [<c046254b>] ? warn_slowpath_null+0x1b/0x20 [<c0469e99>] ? local_bh_enable+0x59/0x90 [<c07bb936>] ? skb_copy_bits+0x126/0x210 [<f8d1d9fe>] ? ext4_ext_find_extent+0x24e/0x2d0 [ext4] [<c07bc49e>] ? __pskb_pull_tail+0x6e/0x2b0 [<f95a6164>] ? vmxnet3_xmit_frame+0xba4/0xef0 [vmxnet3] [<c05d15a6>] ? selinux_ip_postroute+0x56/0x320 [<c0615988>] ? cfq_add_rq_rb+0x98/0x110 [<c0852df8>] ? packet_rcv+0x48/0x350 [<c07c5839>] ? dev_queue_xmit_nit+0xc9/0x140 ... Fix it by splitting vmxnet3_parse_and_copy_hdr into two functions: vmxnet3_parse_hdr, which sets up the internal/on stack ctx datastructure, and pulls the skb (both of which can be done without holding the spinlock with irqs disabled and vmxnet3_copy_header, which just copies the skb to the tx ring under the lock safely. tested and shown to correct the described problem. Applies cleanly to the head of the net tree Signed-off-by: Neil Horman <nhorman@tuxdriver.com> CC: Shrikrishna Khare <skhare@vmware.com> CC: "VMware, Inc." <pv-drivers@vmware.com> CC: "David S. Miller" <davem@davemloft.net> Acked-by: Shrikrishna Khare <skhare@vmware.com> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 20:15:24 UTC
7024b68 David S. Miller 07 March 2016, 19:58:11 UTC Merge tag 'wireless-drivers-for-davem-2016-03-04' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.5 iwlwifi * free firmware paging memory when the module is unloaded or device removed * fix pending frames counter to fix an issue when removing stations ssb * fix a build problem related to ssb_fill_sprom_with_fallback() ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 19:58:11 UTC
979d804 Krzysztof Kozlowski 04 March 2016, 01:04:52 UTC net: ethernet: Add missing MFD_SYSCON dependency on HAS_IOMEM The MFD_SYSCON depends on HAS_IOMEM so when selecting it avoid unmet direct dependencies. Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 19:45:07 UTC
2c42bf4 Thomas Falcon 03 March 2016, 21:22:36 UTC ibmveth: check return of skb_linearize in ibmveth_start_xmit If skb_linearize fails, the driver should drop the packet instead of trying to copy it into the bounce buffer. Signed-off-by: Thomas Falcon <tlfalcon@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 19:38:52 UTC
48906f6 Bjørn Mork 03 March 2016, 21:20:53 UTC cdc_ncm: toggle altsetting to force reset before setup Some devices will silently fail setup unless they are reset first. This is necessary even if the data interface is already in altsetting 0, which it will be when the device is probed for the first time. Briefly toggling the altsetting forces a function reset regardless of the initial state. This fixes a setup problem observed on a number of Huawei devices, appearing to operate in NTB-32 mode even if we explicitly set them to NTB-16 mode. Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 19:37:39 UTC
1666984 Oliver Neukum 07 March 2016, 10:31:10 UTC usbnet: cleanup after bind() in probe() In case bind() works, but a later error forces bailing in probe() in error cases work and a timer may be scheduled. They must be killed. This fixes an error case related to the double free reported in http://www.spinics.net/lists/netdev/msg367669.html and needs to go on top of Linus' fix to cdc-ncm. Signed-off-by: Oliver Neukum <ONeukum@suse.com> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 16:40:16 UTC
a383b7f David S. Miller 07 March 2016, 16:39:16 UTC Merge branch 'mlxsw-fixes' Jiri Pirko says: ==================== mlxsw: couple of fixes Couple of fixes from Ido. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 16:39:16 UTC
5091730 Ido Schimmel 07 March 2016, 14:15:30 UTC mlxsw: pci: Correctly determine if descriptor queue is full The descriptor queues for sending (SDQs) and receiving (RDQs) packets are managed by two counters - producer and consumer - which are both 16-bit in size. A queue is considered full when the difference between the two equals the queue's maximum number of descriptors. However, if the producer counter overflows, then it's possible for the full queue check to fail, as it doesn't take the overflow into account. In such a case, descriptors already passed to the device - but for which a completion has yet to be posted - will be overwritten, thereby causing undefined behavior. The above can be achieved under heavy load (~30 netperf instances). Fix that by casting the subtraction result to u16, preventing it from being treated as a signed integer. Fixes: eda6500a987a ("mlxsw: Add PCI bus implementation") Signed-off-by: Ido Schimmel <idosch@mellanox.com> Signed-off-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 16:39:15 UTC
912b1c8 Ido Schimmel 07 March 2016, 14:15:29 UTC mlxsw: spectrum: Always decrement bridge's ref count Since we only support one VLAN filtering bridge we need to associate a reference count with it, so that when the last port netdev leaves it, we would know that a different bridge can be offloaded to hardware. When a LAG device is memeber in a bridge and port netdevs are leaving the LAG, we should always decrement the bridge's reference count, as it's incremented for any port in the LAG. Fixes: 4dc236c31733 ("mlxsw: spectrum: Handle port leaving LAG while bridged") Signed-off-by: Ido Schimmel <idosch@mellanox.com> Signed-off-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 16:39:15 UTC
4de13d7 Parthasarathy Bhuvaragan 03 March 2016, 16:54:54 UTC tipc: fix nullptr crash during subscription cancel commit 4d5cfcba2f6e ('tipc: fix connection abort during subscription cancel'), removes the check for a valid subscription before calling tipc_nametbl_subscribe(). This will lead to a nullptr exception when we process a subscription cancel request. For a cancel request, a null subscription is passed to tipc_nametbl_subscribe() resulting in exception. In this commit, we call tipc_nametbl_subscribe() only for a valid subscription. Fixes: 4d5cfcba2f6e ('tipc: fix connection abort during subscription cancel') Reported-by: Anders Widell <anders.widell@ericsson.com> Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com> Acked-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 04:00:08 UTC
11f7f79 Colin Ian King 03 March 2016, 13:47:18 UTC net: eth: altera: do not free array priv->mdio->irq priv->mdio->irq used to be allocated and required freeing, but it is now a fixed sized array and should no longer be free'd. Issue detected using static analysis with CoverityScan Fixes: e7f4dc3536a400 ("mdio: Move allocation of interrupts into core") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 03:59:18 UTC
57a0f36 Colin Ian King 03 March 2016, 13:43:34 UTC net/ethoc: do not free array priv->mdio->irq priv->mdio->irq used to be allocated and required freeing, but it is now a fixed sized array and should no longer be free'd. Issue detected using static analysis with CoverityScan Fixes: e7f4dc3536a400 ("mdio: Move allocation of interrupts into core") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Tobias Klauser <tklauser@distanz.ch> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 03:58:51 UTC
44ef548 Phil Sutter 03 March 2016, 13:34:14 UTC net: sched: fix act_ipt for LOG target Before calling the destroy() or target() callbacks, the family parameter field has to be initialized. Otherwise at least the LOG target will refuse to work and upon removal oops the kernel. Cc: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 03:57:35 UTC
eb1f420 Colin Ian King 03 March 2016, 13:27:56 UTC asix: do not free array priv->mdio->irq Used to be allocated and required freeing, but now priv->mdio->irq is now a fixed sized array and should no longer be free'd. Issue detected using static analysis with CoverityScan Fixes: e7f4dc3536a400 ("mdio: Move allocation of interrupts into core") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 03:56:48 UTC
7bfc608 Atsushi Nemoto 03 March 2016, 00:07:51 UTC gianfar: Enable eTSEC-106 erratum w/a for MPC8548E Rev2 Enable workaround for MPC8548E erratum eTSEC 106, "Excess delays when transmitting TOE=1 large frames". (see commit 53fad77375ce "gianfar: Enable eTSEC-20 erratum w/a for P2020 Rev1") This erratum was fixed in Rev 3.1.x. Signed-off-by: Atsushi Nemoto <nemoto@toshiba-tops.co.jp> Acked-by: Claudiu Manoil <claudiu.manoil@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net> 07 March 2016, 03:44:42 UTC
390fd4f David S. Miller 04 March 2016, 19:32:47 UTC Merge tag 'linux-can-fixes-for-4.5-20160304' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2016-03-04 this is a pull request for net/master. There is one patch from Ed Spiridonov, which increases the performance of the mcp251x SPI CAN driver, by avoiding to write to error flag register if it's unnecessary. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 04 March 2016, 19:32:47 UTC
d694b06 Ed Spiridonov 04 March 2016, 06:07:27 UTC can: mcp251x: avoid write to error flag register if it's unnecessary Only two bits (RX0OVR and RX1OVR) are writable in EFLG, write is useless if these bits aren't set. Signed-off-by: Ed Spiridonov <edo.rus@gmail.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> 04 March 2016, 07:45:17 UTC
c1bb0a5 Venkat Duvvuru 02 March 2016, 11:00:28 UTC be2net: don't enable multicast flag in be_enable_if_filters() routine When the interface is opened (in be_open()) the routine be_enable_if_filters() must be called to switch on the basic filtering capabilities of an interface that are not changed at run-time. These include the flags UNTAGGED, BROADCAST and PASS_L3L4_ERRORS. Other flags such as MULTICAST and PROMISC must be enabled later by be_set_rx_mode() based on the state in the netdev/adapter struct. be_enable_if_filters() routine is wrongly trying to enable MULTICAST flag without checking the current adapter state. This can cause the RX_FILTER cmds to the FW to fail. This patch fixes this problem by only enabling the basic filtering flags in be_enable_if_filters(). The VF must be able to issue RX_FILTER cmd with any filter flag, as long as the PF allowed those flags (if_cap_flags) in the iface it provisioned for the VF. This rule is applicable even when the VF doesn't have the FILTMGMT privilege. There is a bug in BE3 FW that wrongly fails RX_FILTER multicast programming cmds on VFs that don't have FILTMGMT privilege. This patch also helps in insulating the VF driver from be_open failures due to the FW bug. A fix for the BE3 FW issue will be available in versions >= 11.0.283.0 and 10.6.334.0 Reported-by: Ivan Vecera <ivecera@redhat.com> Signed-off-by: Venkat Duvvuru <venkatkumar.duvvuru@avagotech.com> Signed-off-by: Sathya Perla <sathya.perla@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 22:18:03 UTC
1d3cd17 Dan Carpenter 02 March 2016, 10:11:10 UTC net: moxa: fix an error code We accidentally return IS_ERR(priv->base) which is 1 instead of PTR_ERR(priv->base) which is the error code. Fixes: 6c821bd9edc9 ('net: Add MOXA ART SoCs ethernet driver') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 22:17:14 UTC
63a0a00 Nimrod Andy 02 March 2016, 09:24:53 UTC MAINTAINERS: add maintainer entry for FREESCALE FEC ethernet driver Add a maintainer entry for FREESCALE FEC ethernet driver and add myself as a maintainer. Signed-off-by: Fugang Duan <fugang.duan@nxp.com> Acked-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 22:15:49 UTC
4024fcf Daniel Borkmann 02 March 2016, 01:32:08 UTC vxlan: fix missing options_len update on RX with collect metadata When signalling to metadata consumers that the metadata_dst entry carries additional GBP extension data for vxlan (TUNNEL_VXLAN_OPT), the dst's vxlan_metadata information is populated, but options_len is left to zero. F.e. in ovs, ovs_flow_key_extract() checks for options_len before extracting the data through ip_tunnel_info_opts_get(). Geneve uses ip_tunnel_info_opts_set() helper in receive path, which sets options_len internally, vxlan however uses ip_tunnel_info_opts(), so when filling vxlan_metadata, we do need to update options_len. Fixes: 4c22279848c5 ("ip-tunnel: Use API to access tunnel metadata options.") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 22:10:31 UTC
42a67c9 Wolfram Sang 01 March 2016, 16:37:59 UTC net: ethernet: renesas: sh_eth: don't open code of_device_get_match_data() This change will also make Coverity happy by avoiding a theoretical NULL pointer dereference; yet another reason is to use the above helper function to tighten the code and make it more readable. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Simon Horman <horms+renesas@verge.net.au> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 21:38:23 UTC
e866863 Wolfram Sang 01 March 2016, 16:37:58 UTC net: ethernet: renesas: ravb_main: don't open code of_device_get_match_data() This change will also make Coverity happy by avoiding a theoretical NULL pointer dereference; yet another reason is to use the above helper function to tighten the code and make it more readable. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Simon Horman <horms+renesas@verge.net.au> Acked-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 21:38:23 UTC
de89e85 Thomas Falcon 01 March 2016, 16:20:09 UTC ibmvnic: Fix ibmvnic_capability struct The ibmvnic_capability struct was defined incorrectly. The last two elements of the struct are in the wrong order. In addition, the number element should be 64-bit. Byteswapping functions are updated as well. Signed-off-by: Thomas Falcon <tlfalcon@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 21:36:31 UTC
5d150a9 Florian Westphal 01 March 2016, 15:15:16 UTC ipv6: re-enable fragment header matching in ipv6_find_hdr When ipv6_find_hdr is used to find a fragment header (caller specifies target NEXTHDR_FRAGMENT) we erronously return -ENOENT for all fragments with nonzero offset. Before commit 9195bb8e381d, when target was specified, we did not enter the exthdr walk loop as nexthdr == target so this used to work. Now we do (so we can skip empty route headers). When we then stumble upon a frag with nonzero frag_off we must return -ENOENT ("header not found") only if the caller did not specifically request NEXTHDR_FRAGMENT. This allows nfables exthdr expression to match ipv6 fragments, e.g. via nft add rule ip6 filter input frag frag-off gt 0 Fixes: 9195bb8e381d ("ipv6: improve ipv6_find_hdr() to skip empty routing headers") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 21:35:20 UTC
bf13c94 Bjørn Mork 01 March 2016, 13:31:02 UTC qmi_wwan: add Sierra Wireless EM74xx device ID The MC74xx and EM74xx modules use different IDs by default, according to the Lenovo EM7455 driver for Windows. Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 21:31:52 UTC
f214fc4 Parthasarathy Bhuvaragan 01 March 2016, 10:07:09 UTC tipc: Revert "tipc: use existing sk_write_queue for outgoing packet chain" reverts commit 94153e36e709e ("tipc: use existing sk_write_queue for outgoing packet chain") In Commit 94153e36e709e, we assume that we fill & empty the socket's sk_write_queue within the same lock_sock() session. This is not true if the link is congested. During congestion, the socket lock is released while we wait for the congestion to cease. This implementation causes a nullptr exception, if the user space program has several threads accessing the same socket descriptor. Consider two threads of the same program performing the following: Thread1 Thread2 -------------------- ---------------------- Enter tipc_sendmsg() Enter tipc_sendmsg() lock_sock() lock_sock() Enter tipc_link_xmit(), ret=ELINKCONG spin on socket lock.. sk_wait_event() : release_sock() grab socket lock : Enter tipc_link_xmit(), ret=0 : release_sock() Wakeup after congestion lock_sock() skb = skb_peek(pktchain); !! TIPC_SKB_CB(skb)->wakeup_pending = tsk->link_cong; In this case, the second thread transmits the buffers belonging to both thread1 and thread2 successfully. When the first thread wakeup after the congestion it assumes that the pktchain is intact and operates on the skb's in it, which leads to the following exception: [2102.439969] BUG: unable to handle kernel NULL pointer dereference at 00000000000000d0 [2102.440074] IP: [<ffffffffa005f330>] __tipc_link_xmit+0x2b0/0x4d0 [tipc] [2102.440074] PGD 3fa3f067 PUD 3fa6b067 PMD 0 [2102.440074] Oops: 0000 [#1] SMP [2102.440074] CPU: 2 PID: 244 Comm: sender Not tainted 3.12.28 #1 [2102.440074] RIP: 0010:[<ffffffffa005f330>] [<ffffffffa005f330>] __tipc_link_xmit+0x2b0/0x4d0 [tipc] [...] [2102.440074] Call Trace: [2102.440074] [<ffffffff8163f0b9>] ? schedule+0x29/0x70 [2102.440074] [<ffffffffa006a756>] ? tipc_node_unlock+0x46/0x170 [tipc] [2102.440074] [<ffffffffa005f761>] tipc_link_xmit+0x51/0xf0 [tipc] [2102.440074] [<ffffffffa006d8ae>] tipc_send_stream+0x11e/0x4f0 [tipc] [2102.440074] [<ffffffff8106b150>] ? __wake_up_sync+0x20/0x20 [2102.440074] [<ffffffffa006dc9c>] tipc_send_packet+0x1c/0x20 [tipc] [2102.440074] [<ffffffff81502478>] sock_sendmsg+0xa8/0xd0 [2102.440074] [<ffffffff81507895>] ? release_sock+0x145/0x170 [2102.440074] [<ffffffff815030d8>] ___sys_sendmsg+0x3d8/0x3e0 [2102.440074] [<ffffffff816426ae>] ? _raw_spin_unlock+0xe/0x10 [2102.440074] [<ffffffff81115c2a>] ? handle_mm_fault+0x6ca/0x9d0 [2102.440074] [<ffffffff8107dd65>] ? set_next_entity+0x85/0xa0 [2102.440074] [<ffffffff816426de>] ? _raw_spin_unlock_irq+0xe/0x20 [2102.440074] [<ffffffff8107463c>] ? finish_task_switch+0x5c/0xc0 [2102.440074] [<ffffffff8163ea8c>] ? __schedule+0x34c/0x950 [2102.440074] [<ffffffff81504e12>] __sys_sendmsg+0x42/0x80 [2102.440074] [<ffffffff81504e62>] SyS_sendmsg+0x12/0x20 [2102.440074] [<ffffffff8164aed2>] system_call_fastpath+0x16/0x1b In this commit, we maintain the skb list always in the stack. Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com> Acked-by: Ying Xue <ying.xue@windriver.com> Acked-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 21:30:29 UTC
1837b2e Benjamin Poirier 29 February 2016, 23:03:33 UTC mld, igmp: Fix reserved tailroom calculation The current reserved_tailroom calculation fails to take hlen and tlen into account. skb: [__hlen__|__data____________|__tlen___|__extra__] ^ ^ head skb_end_offset In this representation, hlen + data + tlen is the size passed to alloc_skb. "extra" is the extra space made available in __alloc_skb because of rounding up by kmalloc. We can reorder the representation like so: [__hlen__|__data____________|__extra__|__tlen___] ^ ^ head skb_end_offset The maximum space available for ip headers and payload without fragmentation is min(mtu, data + extra). Therefore, reserved_tailroom = data + extra + tlen - min(mtu, data + extra) = skb_end_offset - hlen - min(mtu, skb_end_offset - hlen - tlen) = skb_tailroom - min(mtu, skb_tailroom - tlen) ; after skb_reserve(hlen) Compare the second line to the current expression: reserved_tailroom = skb_end_offset - min(mtu, skb_end_offset) and we can see that hlen and tlen are not taken into account. The min() in the third line can be expanded into: if mtu < skb_tailroom - tlen: reserved_tailroom = skb_tailroom - mtu else: reserved_tailroom = tlen Depending on hlen, tlen, mtu and the number of multicast address records, the current code may output skbs that have less tailroom than dev->needed_tailroom or it may output more skbs than needed because not all space available is used. Fixes: 4c672e4b ("ipv6: mld: fix add_grhead skb_over_panic for devs with large MTUs") Signed-off-by: Benjamin Poirier <bpoirier@suse.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 20:41:07 UTC
878e3c1 Igal Liberman 28 February 2016, 21:59:53 UTC fsl/fman: Initialize fman->dev earlier Currently, in a case of error, dev_err is using fman->dev before its initialization and "(NULL device *)" is printed. This patch fixes this issue. Signed-off-by: Igal Liberman <igal.liberman@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 20:21:23 UTC
88f8b1b Gabriel Fernandez 29 February 2016, 16:18:22 UTC stmmac: Fix 'eth0: No PHY found' regression This patch manages the case when you have an Ethernet MAC with a "fixed link", and not connected to a normal MDIO-managed PHY device. The test of phy_bus_name was not helpful because it was never affected and replaced by the mdio test node. Signed-off-by: Gabriel Fernandez <gabriel.fernandez@linaro.org> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net> 03 March 2016, 20:02:05 UTC
ebc9780 David S. Miller 02 March 2016, 19:57:16 UTC Merge branch 'dwc_eth_qos' Lars Persson says: ==================== dwc_eth_qos: stability fixes and support for CMA This series has bug fixes for the dwc_eth_qos ethernet driver. Mainly two stability fixes for problems found by Rabin Vincent: - Successive starts and stops of the interface would trigger a DMA reset timeout. - A race condition in the TX DMA handling could trigger a netdev watchdog timeout. The memory allocation was improved to support use of the CMA as DMA allocator backend. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:57:16 UTC
cd5e412 Lars Persson 29 February 2016, 15:22:34 UTC dwc_eth_qos: do phy_start before resetting hardware This reverts the changed init order from commit 3647bc35bd42 ("dwc_eth_qos: Reset hardware before PHY start") and makes another fix for the race. It turned out that the reset state machine of the dwceqos hardware requires PHY clocks to be present in order to complete the reset cycle. To plug the race with the phy state machine we defer link speed setting until the hardware init has finished. Signed-off-by: Lars Persson <larper@axis.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:57:15 UTC
016a91c Rabin Vincent 29 February 2016, 15:22:33 UTC dwc_eth_qos: use DWCEQOS_MSG_DEFAULT Since debug is hardcoded to 3, the defaults in the DWCEQOS_MSG_DEFAULT macro are never used, which does not seem to be the intended behaviour here. Set debug to -1 like other drivers so that DWCEQOS_MSG_DEFAULT is actually used by default. Signed-off-by: Rabin Vincent <rabinv@axis.com> Signed-off-by: Lars Persson <larper@axis.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:57:15 UTC
e8b0c32 Rabin Vincent 29 February 2016, 15:22:32 UTC dwc_eth_qos: use GFP_KERNEL in dma_alloc_coherent() Since we are in non-atomic context here we can pass GFP_KERNEL to dma_alloc_coherent(). This enables use of the CMA. Signed-off-by: Rabin Vincent <rabinv@axis.com> Signed-off-by: Lars Persson <larper@axis.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:57:15 UTC
d4dc35f Lars Persson 29 February 2016, 15:22:31 UTC dwc_eth_qos: release descriptors outside netif_tx_lock To prepare for using the CMA, we can not be in atomic context when de-allocating DMA buffers. The tx lock was needed only to protect the hw reset against the xmit handler. Now we briefly grab the tx lock while stopping the queue to make sure no thread is inside or will enter the xmit handler. Signed-off-by: Lars Persson <larper@axis.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:57:14 UTC
8afb6c4 Rabin Vincent 29 February 2016, 15:22:30 UTC dwc_eth_qos: fix race condition in dwceqos_start_xmit The xmit handler and the tx_reclaim tasklet had a race on the tx_free variable which could lead to a tx timeout if tx_free was updated after the tx complete interrupt. Signed-off-by: Rabin Vincent <rabinv@axis.com> Signed-off-by: Lars Persson <larper@axis.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:57:14 UTC
11351bf David S. Miller 02 March 2016, 19:42:46 UTC Merge branch 'mlx4-fixes' Or Gerlitz says: ==================== Mellanox 10/40G mlx4 driver fixes for 4.5-rc6 This series contains two fixes for the SRIOV HW LAG that was introduced in 4.5-rc1 and one fix that allows to revoke the administrative MAC that was assigned to VF through the PF. The VF mac fix needs to go for stable too. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:42:46 UTC
6e52242 Jack Morgenstein 02 March 2016, 15:47:46 UTC net/mlx4_core: Allow resetting VF admin mac to zero The VF administrative mac addresses (stored in the PF driver) are initialized to zero when the PF driver starts up. These addresses may be modified in the PF driver through ndo calls initiated by iproute2 or libvirt. While we allow the PF/host to change the VF admin mac address from zero to a valid unicast mac, we do not allow restoring the VF admin mac to zero. We currently only allow changing this mac to a different unicast mac. This leads to problems when libvirt scripts are used to deal with VF mac addresses, and libvirt attempts to revoke the mac so this host will not use it anymore. Fix this by allowing resetting a VF administrative MAC back to zero. Fixes: 8f7ba3ca12f6 ('net/mlx4: Add set VF mac address support') Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Reported-by: Moshe Levi <moshele@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:42:46 UTC
00ada91 Moni Shoua 02 March 2016, 15:47:45 UTC net/mlx4_core: Check the correct limitation on VFs for HA mode The limit of 63 is only for virtual functions while the actual enforcement was for VFs plus physical functions, fix that. Fixes: e57968a10bc1 ('net/mlx4_core: Support the HA mode for SRIOV VFs too') Signed-off-by: Moni Shoua <monis@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:42:45 UTC
03a79f3 Jack Morgenstein 02 March 2016, 15:47:44 UTC net/mlx4_core: Fix lockdep warning in handling of mac/vlan tables In the mac and vlan register/unregister/replace functions, the driver locks the mac table mutex (or vlan table mutex) on both ports. We move to use mutex_lock_nested() to prevent warnings, such as the one below. [ 101.828445] ============================================= [ 101.834820] [ INFO: possible recursive locking detected ] [ 101.841199] 4.5.0-rc2+ #49 Not tainted [ 101.850251] --------------------------------------------- [ 101.856621] modprobe/3054 is trying to acquire lock: [ 101.862514] (&table->mutex#2){+.+.+.}, at: [<ffffffffa079c10e>] __mlx4_register_mac+0x87e/0xa90 [mlx4_core] [ 101.874598] [ 101.874598] but task is already holding lock: [ 101.881703] (&table->mutex#2){+.+.+.}, at: [<ffffffffa079c0f0>] __mlx4_register_mac+0x860/0xa90 [mlx4_core] [ 101.893776] [ 101.893776] other info that might help us debug this: [ 101.901658] Possible unsafe locking scenario: [ 101.901658] [ 101.908859] CPU0 [ 101.911923] ---- [ 101.914985] lock(&table->mutex#2); [ 101.919595] lock(&table->mutex#2); [ 101.924199] [ 101.924199] * DEADLOCK * [ 101.924199] [ 101.931643] May be due to missing lock nesting notation Fixes: 5f61385d2ebc ('net/mlx4_core: Keep VLAN/MAC tables mirrored in multifunc HA mode') Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Suggested-by: Doron Tsur <doront@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:42:45 UTC
ebc363f David S. Miller 02 March 2016, 19:37:27 UTC Merge branch 'mlx5-fixes' Saeed Mahameed says: ==================== Mellanox 100G mlx5 driver fixes This series has few bug fixes for the mlx5 Ethernet driver. Eran fixed a locking issue with time-stamping that could cause a soft-lockup when time-stamping is enabled. Gal fixed the rx/tx packets/bytes counters returned by the driver to actually went through the network stack. Tariq removed a poll CQ optimization which could lead the driver to stop getting interrupts for some of the rings, and a did also fix to HW LRO which is currently broken. He also provided RSS and RX hash fixes for the case of changing the number of rx rings the RX hash/RSS configuration will be out of sync. The time stamping fix from Eran is not for -stable as the feature was only introduced in 4.5 but all of the others are. Changes fro V0: - Eran addressed the irqsave/restore comments from "Dave" and fixed them. This series is generated against net commit 4c0b6eaf373a 'net: thunderx: Fix for Qset error due to CQ full' ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:37:27 UTC
faf4478 Gal Pressman 29 February 2016, 19:17:15 UTC net/mlx5e: Provide correct packet/bytes statistics Using the HW VPort counters for traffic (rx/tx packets/bytes) statistics is wrong. This is because frames dropped due to steering or out of buffer will be counted as received. To fix that, we move to use the packet/bytes accounting done by the driver for what the netdev reports out. Fixes: f62b8bb8f2d3 ('net/mlx5: Extend mlx5_core to support [...]') Signed-off-by: Gal Pressman <galp@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:37:26 UTC
b081da5 Gal Pressman 29 February 2016, 19:17:14 UTC net/mlx5e: Add rx/tx bytes software counters Sum up rx/tx bytes in software as we do for rx/tx packets, to be reported in upcoming statistics fix. Signed-off-by: Gal Pressman <galp@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:37:26 UTC
85082db Tariq Toukan 29 February 2016, 19:17:13 UTC net/mlx5e: Correctly handle RSS indirection table when changing number of channels Upon changing num_channels, reset the RSS indirection table to match the new value. Fixes: 2d75b2bc8a8c ('net/mlx5e: Add ethtool RSS configuration options') Signed-off-by: Tariq Toukan <tariqt@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:37:26 UTC
bdfc028 Tariq Toukan 29 February 2016, 19:17:12 UTC net/mlx5e: Fix ethtool RX hash func configuration change We should modify TIRs explicitly to apply the new RSS configuration. The light ndo close/open calls do not "refresh" them. Fixes: 2d75b2bc8a8c ('net/mlx5e: Add ethtool RSS configuration options') Signed-off-by: Tariq Toukan <tariqt@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:37:25 UTC
0ad9b20 Eran Ben Elisha 29 February 2016, 19:17:11 UTC net/mlx5e: Fix soft lockup when HW Timestamping is enabled Readers/Writers lock for SW timecounter was acquired without disabling interrupts on local CPU. The problematic scenario: * HW timestamping is enabled * Timestamp overflow periodic service task is running on local CPU and holding write_lock for SW timecounter * Completion arrives, triggers interrupt for local CPU. Interrupt routine calls napi_schedule(), which triggers rx/tx skb process. An attempt to read SW timecounter using read_lock is done, which is already locked by a writer on the same CPU and cause soft lockup. Add irqsave/irqrestore for when using the readers/writers lock for writing. Fixes: ef9814deafd0 ('net/mlx5e: Add HW timestamping (TS) support') Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:37:25 UTC
ab0394f Tariq Toukan 29 February 2016, 19:17:10 UTC net/mlx5e: Fix LRO modify Ethtool LRO enable/disable is broken, as of today we only modify TCP TIRs in order to apply the requested configuration. Hardware requires that all TIRs pointing to the same RQ should share the same LRO configuration. For that all other TIRs' LRO fields must be modified as well. Fixes: 5c50368f3831 ('net/mlx5e: Light-weight netdev open/stop') Signed-off-by: Tariq Toukan <tariqt@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:37:25 UTC
59a7c2f Tariq Toukan 29 February 2016, 19:17:09 UTC net/mlx5e: Remove wrong poll CQ optimization With the MLX5E_CQ_HAS_CQES optimization flag, the following buggy flow might occur: - Suppose RX is always busy, TX has a single packet every second. - We poll a single TX cqe and clear its flag. - We never arm it again as RX is always busy. - TX CQ flag is never changed, and new TX cqes are not polled. We revert this optimization. Fixes: e586b3b0baee ('net/mlx5: Ethernet Datapath files') Signed-off-by: Tariq Toukan <tariqt@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 19:37:24 UTC
607e681 Chunhao Lin 02 March 2016, 16:59:15 UTC r8169: Enable RX_MULTI_EN for RTL_GIGA_MAC_VER_41~48 For RTL8168G/RTL8168H/RTL8411B/RTL8107E, enable this flag to eliminate message "AMD-Vi: Event logged [IO_PAGE_FAULT device=01:00.0 domain=0x0002 address=0x0000000000003000 flags=0x0050] in dmesg. Signed-off-by: Chunhao Lin <hau@realtek.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 18:59:14 UTC
68df724 David S. Miller 02 March 2016, 18:35:31 UTC Merge tag 'mac80211-for-davem-2016-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Here are a few more fixes for the current cycle: * check GCMP encryption vs. fragmentation properly; we'd found this problem quite a while ago but waited for the 802.11 spec to be updated * fix RTS/CTS logic in minstrel_ht * fix RX of certain public action frames in AP mode * add mac80211_hwsim to MAC80211 in MAINTAINERS, this helps the kbuild robot pick up the right tree for it ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 18:35:31 UTC
768c83a David S. Miller 02 March 2016, 18:31:58 UTC Merge branch 'bnx2x-fixes' Michal Schmidt says: ==================== bnx2x: endianness fixes this fixes a VLAN crash and some SRIOV bugs in bnx2x observed on ppc64. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 18:31:58 UTC
7e88009 Michal Schmidt 02 March 2016, 12:47:11 UTC bnx2x: fix indentation in bnx2x_sp_task() Fix a case of misleading code indentation. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 18:31:57 UTC
8d1c6bc Michal Schmidt 02 March 2016, 12:47:10 UTC bnx2x: define event data reserved fields as little-endian For consistency with other event data structs and to lessen the chance of a mistake should one of the reserved fields become used in the future, define the reserved fields as little-endian. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 18:31:57 UTC
da47273 Michal Schmidt 02 March 2016, 12:47:09 UTC bnx2x: define fields of struct cfc_del_event_data as little-endian There were no missing endianness conversions in this case, but the fields of struct cfc_del_event_data should be defined as little-endian to get rid of the ugly (__force __le32) casts. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 18:31:56 UTC
ca4f2d5 Michal Schmidt 02 March 2016, 12:47:08 UTC bnx2x: access cfc_del_event only if the opcode is CFC_DEL It's not really a bug, but it was odd that bnx2x_eq_int() read the message data as if it were a cfc_del_event regardless of the event type. It's cleaner to access only the appropriate member of union event_data after checking the event opcode. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 18:31:56 UTC
a524ef7 Michal Schmidt 02 March 2016, 12:47:07 UTC bnx2x: fix receive of VF->PF mailbox messages by the PF on big-endian On ppc64 the PF did not receive messages from VFs correctly. Fields of struct vf_pf_event_data are little-endian. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 18:31:56 UTC
5cc5c2d Michal Schmidt 02 March 2016, 12:47:06 UTC bnx2x: fix sending VF->PF messages on big-endian When a VF is sending a message to the PF, it needs to trigger the PF to tell it the message is ready. The trigger did not work on ppc64. No interrupt appeared in the PF. The bug is due to confusion about the layout of struct trigger_vf_zone. In bnx2x_send_msg2pf() the trigger is written using writeb(), not writel(), so the attempt to define the struct with a reversed layout on big-endian is counter-productive. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 18:31:55 UTC
9cd753a Michal Schmidt 02 March 2016, 12:47:05 UTC bnx2x: fix crash on big-endian when adding VLAN bnx2x crashes during the initialization of the 8021q module on ppc64. The bug is a missing conversion from le32 in bnx2x_handle_classification_eqe() when obtaining the cid value from struct eth_event_data. The fields in struct eth_event_data should all be declared as little-endian and conversions added where missing. Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> 02 March 2016, 18:31:55 UTC
2af8c4d Johannes Berg 26 February 2016, 09:50:34 UTC mac80211_hwsim: treat as part of mac80211 for MAINTAINERS Since I maintain this driver as part of mac80211, add it to the file list for mac80211; this helps submitters send it to me instead of Kalle and also makes the build robot apply the patches for it on the right tree for build attempts. Acked-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com> 02 March 2016, 13:16:48 UTC
735c1e2 Sergei Shtylyov 28 February 2016, 19:50:59 UTC of_mdio: fix kernel-doc for of_phy_connect() The 'flags' parameter of the of_phy_connect() function wasn't described in the kernel-doc comment... Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Signed-off-by: David S. Miller <davem@davemloft.net> 01 March 2016, 22:41:40 UTC
3d73e8f Xin Long 28 February 2016, 02:33:11 UTC sctp: sctp_remaddr_seq_show use the wrong variable to dump transport info Now in sctp_remaddr_seq_show(), we use variable *tsp to get the param *v. but *tsp is also used to traversal transport_addr_list, which will cover the previous value, and make sctp_transport_put work on the wrong transport. So fix it by adding a new variable to get the param *v. Fixes: fba4c330c5b9 ("sctp: hold transport before we access t->asoc in sctp proc") Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> 01 March 2016, 22:35:44 UTC
40b4f0f Xin Long 28 February 2016, 02:03:51 UTC sctp: lack the check for ports in sctp_v6_cmp_addr As the member .cmp_addr of sctp_af_inet6, sctp_v6_cmp_addr should also check the port of addresses, just like sctp_v4_cmp_addr, cause it's invoked by sctp_cmp_addr_exact(). Now sctp_v6_cmp_addr just check the port when two addresses have different family, and lack the port check for two ipv6 addresses. that will make sctp_hash_cmp() cannot work well. so fix it by adding ports comparison in sctp_v6_cmp_addr(). Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> 01 March 2016, 22:25:12 UTC
f0da74b David S. Miller 01 March 2016, 21:52:09 UTC Merge branch 'phy-micrel-fixes' Alexandre Belloni says: ==================== phy: micrel: fix issues with interrupt on atmel boards Since the phy is not polled anymore, there were issues getting a link on the sama5d* xplained boards. I'm not too sure about were those fixes should go and I'm wondering whether the first one shoud be made generic. For the second one, I found the PHY_HAS_MAGICANEG flag that is not used and I wondering whether this is related to that kind of issue. I had a quick look at the history and could'nt find its use. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 01 March 2016, 21:52:09 UTC
99f81af Alexandre Belloni 26 February 2016, 18:18:23 UTC phy: micrel: Disable auto negotiation on startup Disable auto negotiation on init to properly detect an already plugged cable at boot. At boot, when the phy is started, it is in the PHY_UP state. However, if a cable is plugged at boot, because auto negociation is already enabled at the time we get the first interrupt, the phy is already running. But the state machine then switches from PHY_UP to PHY_AN and calls phy_start_aneg(). phy_start_aneg() will not do anything because aneg is already enabled on the phy. It will then wait for a interrupt before going further. This interrupt will never happen unless the cable is unplugged and then replugged. It was working properly before 321beec5047a (net: phy: Use interrupts when available in NOLINK state) because switching to NOLINK meant starting polling the phy, even if IRQ were enabled. Fixes: 321beec5047a (net: phy: Use interrupts when available in NOLINK state) Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: David S. Miller <davem@davemloft.net> 01 March 2016, 21:52:09 UTC
f5aba91 Alexandre Belloni 26 February 2016, 18:18:22 UTC phy: micrel: Ensure interrupts are reenabled on resume At least on ksz8081, when getting back from power down, interrupts are disabled. ensure they are reenabled if they were previously enabled. This fixes resuming which is failing on the xplained boards from atmel since 321beec5047a (net: phy: Use interrupts when available in NOLINK state) Fixes: 321beec5047a (net: phy: Use interrupts when available in NOLINK state) Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: David S. Miller <davem@davemloft.net> 01 March 2016, 21:52:08 UTC
edffc21 Guillaume Nault 26 February 2016, 17:45:34 UTC ppp: lock ppp->flags in ppp_read() and ppp_poll() ppp_read() and ppp_poll() can be called concurrently with ppp_ioctl(). In this case, ppp_ioctl() might call ppp_ccp_closed(), which may update ppp->flags while ppp_read() or ppp_poll() is reading it. The update done by ppp_ccp_closed() isn't atomic due to the bit mask operation ('ppp->flags &= ~(SC_CCP_OPEN | SC_CCP_UP)'), so concurrent readers might get transient values. Reading incorrect ppp->flags may disturb the 'ppp->flags & SC_LOOP_TRAFFIC' test in ppp_read() and ppp_poll(), which in turn can lead to improper decision on whether the PPP unit file is ready for reading or not. Since ppp_ccp_closed() is protected by the Rx and Tx locks (with ppp_lock()), taking the Rx lock is enough for ppp_read() and ppp_poll() to guarantee that ppp_ccp_closed() won't update ppp->flags concurrently. The same reasoning applies to ppp->n_channels. The 'n_channels' field can also be written to concurrently by ppp_ioctl() (through ppp_connect_channel() or ppp_disconnect_channel()). These writes aren't atomic (simple increment/decrement), but are protected by both the Rx and Tx locks (like in the ppp->flags case). So holding the Rx lock before reading ppp->n_channels also prevents concurrent writes. Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net> 01 March 2016, 21:15:07 UTC
a7f4b98 Ivan Vecera 26 February 2016, 08:15:50 UTC bna: fix list corruption Use list_move_tail() to move MAC address entry from list of pending to list of active entries. Simple list_add_tail() leaves the entry also in the first list, this leads to list corruption. Cc: Rasesh Mody <rasesh.mody@qlogic.com> Signed-off-by: Ivan Vecera <ivecera@redhat.com> Acked-by: Rasesh Mody <rasesh.mody@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net> 01 March 2016, 20:19:43 UTC
c44a72a David S. Miller 01 March 2016, 20:10:38 UTC Merge tag 'linux-can-fixes-for-4.5-20160226' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2016-02-26 this is a pull request of one patch for net. The patch by Maximilain Schneider fixes a kfree() problem during disconnect in the gs_usb driver. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 01 March 2016, 20:10:38 UTC
c36dd3e Felix Fietkau 24 February 2016, 11:07:17 UTC mac80211: minstrel_ht: fix a logic error in RTS/CTS handling RTS/CTS needs to be enabled if the rate is a fallback rate *or* if it's a dual-stream rate and the sta is in dynamic SMPS mode. Cc: stable@vger.kernel.org Fixes: a3ebb4e1b763 ("mac80211: minstrel_ht: handle peers in dynamic SMPS") Reported-by: Matías Richart <mrichart@fing.edu.uy> Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com> 01 March 2016, 14:49:51 UTC
1ec7bae Jouni Malinen 29 February 2016, 22:29:00 UTC mac80211: Fix Public Action frame RX in AP mode Public Action frames use special rules for how the BSSID field (Address 3) is set. A wildcard BSSID is used in cases where the transmitter and recipient are not members of the same BSS. As such, we need to accept Public Action frames with wildcard BSSID. Commit db8e17324553 ("mac80211: ignore frames between TDLS peers when operating as AP") added a rule that drops Action frames to TDLS-peers based on an Action frame having different DA (Address 1) and BSSID (Address 3) values. This is not correct since it misses the possibility of BSSID being a wildcard BSSID in which case the Address 1 would not necessarily match. Fix this by allowing mac80211 to accept wildcard BSSID in an Action frame when in AP mode. Fixes: db8e17324553 ("mac80211: ignore frames between TDLS peers when operating as AP") Cc: stable@vger.kernel.org Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> 01 March 2016, 14:45:04 UTC
9acc54b Johannes Berg 26 February 2016, 21:13:40 UTC mac80211: check PN correctly for GCMP-encrypted fragmented MPDUs Just like for CCMP we need to check that for GCMP the fragments have PNs that increment by one; the spec was updated to fix this security issue and now has the following text: The receiver shall discard MSDUs and MMPDUs whose constituent MPDU PN values are not incrementing in steps of 1. Adapt the code for CCMP to work for GCMP as well, luckily the relevant fields already alias each other so no code duplication is needed (just check the aliasing with BUILD_BUG_ON.) Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> 01 March 2016, 14:42:01 UTC
a6522c0 Neil Horman 25 February 2016, 18:02:50 UTC 3c59x: mask LAST_FRAG bit from length field in ring Recently, I fixed a bug in 3c59x: commit 6e144419e4da11a9a4977c8d899d7247d94ca338 Author: Neil Horman <nhorman@tuxdriver.com> Date: Wed Jan 13 12:43:54 2016 -0500 3c59x: fix another page map/single unmap imbalance Which correctly rebalanced dma mapping and unmapping types. Unfortunately it introduced a new bug which causes oopses on older systems. When mapping dma regions, the last entry for a packet in the 3c59x tx ring encodes a LAST_FRAG bit, which is encoded as the high order bit of the buffers length field. When it is unmapped the LAST_FRAG bit is cleared prior to being passed to the unmap function. Unfortunately the commit above fails to do that masking. It was missed in testing because the system on which I tested it had an intel iommu, the driver for which ignores the size field, using only the DMA address as the token to identify the mapping to be released. However, on older systems that rely on swiotlb (or other dma drivers that key off that length field), not masking off that LAST_FRAG high order bit results in parsing a huge size to be release, leading to all sorts of odd corruptions and the like. Fix is easy, just mask the length with 0xFFF. It should really be &(LAST_FRAG-1), but 0xFFF is the style of the file, and I'd like to make this fix minimal and correct before making it prettier. Appies to the net tree cleanly. All testing on both iommu and swiommu based systems produce good results Signed-off-by: Neil Horman <nhorman@tuxdriver.com> CC: Steffen Klassert <klassert@mathematik.tu-chemnitz.de> CC: "David S. Miller" <davem@davemloft.net> Signed-off-by: David S. Miller <davem@davemloft.net> 29 February 2016, 22:03:35 UTC
472681d MINOURA Makoto / 箕浦 真 25 February 2016, 05:20:48 UTC net: ndo_fdb_dump should report -EMSGSIZE to rtnl_fdb_dump. When the send skbuff reaches the end, nlmsg_put and friends returns -EMSGSIZE but it is silently thrown away in ndo_fdb_dump. It is called within a for_each_netdev loop and the first fdb entry of a following netdev could fit in the remaining skbuff. This breaks the mechanism of cb->args[0] and idx to keep track of the entries that are already dumped, which results missing entries in bridge fdb show command. Signed-off-by: Minoura Makoto <minoura@valinux.co.jp> Signed-off-by: David S. Miller <davem@davemloft.net> 26 February 2016, 20:04:02 UTC
10da848 Arnd Bergmann 25 February 2016, 20:57:43 UTC ssb: host_soc depends on sprom Drivers that use the SSB sprom functionality typically 'select SSB_SPROM' from Kconfig, but CONFIG_SSB_HOST_SOC misses this, which results in a build failure unless at least one of the other drivers that selects it is enabled: drivers/built-in.o: In function `ssb_host_soc_get_invariants': (.text+0x459494): undefined reference to `ssb_fill_sprom_with_fallback' This adds the same select statement that is used elsewhere. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Fixes: 541c9a84cd85 ("ssb: pick SoC invariants code from MIPS BCM47xx arch") Signed-off-by: Kalle Valo <kvalo@codeaurora.org> 26 February 2016, 10:47:32 UTC
1a4f655 Kalle Valo 26 February 2016, 10:43:40 UTC Merge tag 'iwlwifi-for-kalle-2016-02-25' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes Two fixes for 4.5: * We forgot to free the paging memory (Matti) * Fix the frames in flight accounting (Liad) 26 February 2016, 10:43:40 UTC
e9a2d81 Maximilain Schneider 23 February 2016, 01:17:28 UTC can: gs_usb: fixed disconnect bug by removing erroneous use of kfree() gs_destroy_candev() erroneously calls kfree() on a struct gs_can *, which is allocated through alloc_candev() and should instead be freed using free_candev() alone. The inappropriate use of kfree() causes the kernel to hang when gs_destroy_candev() is called. Only the struct gs_usb * which is allocated through kzalloc() should be freed using kfree() when the device is disconnected. Signed-off-by: Maximilian Schneider <max@schneidersoft.net> Cc: linux-stable <stable@vger.kernel.org> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> 26 February 2016, 07:36:33 UTC
4c0b6ea Sunil Goutham 24 February 2016, 11:10:50 UTC net: thunderx: Fix for Qset error due to CQ full On Thunderx pass 1.x and pass2 due to a HW errata default CQ DROP_LEVEL of 0x80 is not sufficient to avoid CQ_WR_FULL Qset error when packets are being received at >20Mpps resulting in complete stall of packet reception. This patch will configure it to 0x100 which is what is expected by HW on Thunderx. On future passes of thunderx and other chips HW default/reset value will be 0x100 or higher hence not overwritten. Signed-off-by: Jerin Jacob <jerin.jacob@caviumnetworks.com> Signed-off-by: Sunil Goutham <sgoutham@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net> 25 February 2016, 21:25:34 UTC
f09cf4b Chun-Hao Lin 24 February 2016, 06:18:42 UTC r8169:fix "rtl_counters_cond == 1 (loop: 1000, delay: 10)" log spam. There will be a log spam when there is no cable plugged. Please refer to following links. https://bugzilla.kernel.org/show_bug.cgi?id=104351 https://bugzilla.kernel.org/show_bug.cgi?id=107421 This issue is caused by runtime power management. When there is no cable plugged, the driver will be suspend (runtime suspend) by OS and NIC will be put into the D3 state. During this time, if OS call rtl8169_get_stats64() to dump tally counter, because NIC is in D3 state, the register value read by driver will return all 0xff. This will let driver think tally counter flag is not toggled and then sends the warning message "rtl_counters_cond == 1 (loop: 1000, delay: 10)" to kernel log. For fixing this issue, 1.add checking driver's pm runtime status in rtl8169_get_stats64(). 2.dump tally counter before going runtime suspend for counter accuracy in runtime suspend. Signed-off-by: Chunhao Lin <hau@realtek.com> Signed-off-by: David S. Miller <davem@davemloft.net> 25 February 2016, 21:17:45 UTC
9b36881 Linus Lüssing 24 February 2016, 03:21:42 UTC net: fix bridge multicast packet checksum validation We need to update the skb->csum after pulling the skb, otherwise an unnecessary checksum (re)computation can ocure for IGMP/MLD packets in the bridge code. Additionally this fixes the following splats for network devices / bridge ports with support for and enabled RX checksum offloading: [...] [ 43.986968] eth0: hw csum failure [ 43.990344] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.4.0 #2 [ 43.996193] Hardware name: BCM2709 [ 43.999647] [<800204e0>] (unwind_backtrace) from [<8001cf14>] (show_stack+0x10/0x14) [ 44.007432] [<8001cf14>] (show_stack) from [<801ab614>] (dump_stack+0x80/0x90) [ 44.014695] [<801ab614>] (dump_stack) from [<802e4548>] (__skb_checksum_complete+0x6c/0xac) [ 44.023090] [<802e4548>] (__skb_checksum_complete) from [<803a055c>] (ipv6_mc_validate_checksum+0x104/0x178) [ 44.032959] [<803a055c>] (ipv6_mc_validate_checksum) from [<802e111c>] (skb_checksum_trimmed+0x130/0x188) [ 44.042565] [<802e111c>] (skb_checksum_trimmed) from [<803a06e8>] (ipv6_mc_check_mld+0x118/0x338) [ 44.051501] [<803a06e8>] (ipv6_mc_check_mld) from [<803b2c98>] (br_multicast_rcv+0x5dc/0xd00) [ 44.060077] [<803b2c98>] (br_multicast_rcv) from [<803aa510>] (br_handle_frame_finish+0xac/0x51c) [...] Fixes: 9afd85c9e455 ("net: Export IGMP/MLD message validation code") Reported-by: Álvaro Fernández Rojas <noltari@gmail.com> Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> Signed-off-by: David S. Miller <davem@davemloft.net> 25 February 2016, 21:16:38 UTC
a4690af Stefan Wahren 23 February 2016, 19:23:24 UTC net: qca_spi: clear IFF_TX_SKB_SHARING ether_setup sets IFF_TX_SKB_SHARING but this is not supported by qca_spi as it modifies the skb on xmit. Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com> Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000) Signed-off-by: David S. Miller <davem@davemloft.net> 25 February 2016, 21:12:15 UTC
2b70bad Stefan Wahren 23 February 2016, 19:23:23 UTC net: qca_spi: Don't clear IFF_BROADCAST Currently qcaspi_netdev_setup accidentally clears IFF_BROADCAST. So fix this by keeping the flags from ether_setup. Reported-by: Michael Heimpold <michael.heimpold@i2se.com> Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com> Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000) Signed-off-by: David S. Miller <davem@davemloft.net> 25 February 2016, 21:12:15 UTC
65c38aa David Ahern 23 February 2016, 18:10:26 UTC net: vrf: Remove direct access to skb->data Nik pointed that the VRF driver should be using skb_header_pointer instead of accessing skb->data and bits beyond directly which can be garbage. Fixes: 35402e313663 ("net: Add IPv6 support to VRF device") Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> 25 February 2016, 20:34:26 UTC
ee50c13 Diego Viola 23 February 2016, 15:04:04 UTC net: jme: fix suspend/resume on JMC260 The JMC260 network card fails to suspend/resume because the call to jme_start_irq() was too early, moving the call to jme_start_irq() after the call to jme_reset_link() makes it work. Prior this change suspend/resume would fail unless /sys/power/pm_async=0 was explicitly specified. Relevant bug report: https://bugzilla.kernel.org/show_bug.cgi?id=112351 Signed-off-by: Diego Viola <diego.viola@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> 25 February 2016, 04:58:21 UTC
25ac341 David S. Miller 24 February 2016, 21:58:12 UTC Merge tag 'mac80211-for-davem-2016-02-23' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Another small set of fixes: * stop critical protocol session on disconnect to avoid it getting stuck * wext: fix two RTNL message ordering issues * fix an uninitialized value (found by KASAN) * fix an out-of-bounds access (also found by KASAN) * clear connection keys when freeing them in all cases (IBSS, all other places already did so) * fix expected throughput unit to get consistent values * set default TX aggregation timeout to 0 in minstrel to avoid (really just hide) issues and perform better ==================== Signed-off-by: David S. Miller <davem@davemloft.net> 24 February 2016, 21:58:12 UTC
2da897e Daniel Borkmann 23 February 2016, 01:05:26 UTC bpf: fix csum setting for bpf_set_tunnel_key The fix in 35e2d1152b22 ("tunnels: Allow IPv6 UDP checksums to be correctly controlled.") changed behavior for bpf_set_tunnel_key() when in use with IPv6 and thus uncovered a bug that TUNNEL_CSUM needed to be set but wasn't. As a result, the stack dropped ingress vxlan IPv6 packets, that have been sent via eBPF through collect meta data mode due to checksum now being zero. Since after LCO, we enable IPv4 checksum by default, so make that analogous and only provide a flag BPF_F_ZERO_CSUM_TX for the user to turn it off in IPv4 case. Fixes: 35e2d1152b22 ("tunnels: Allow IPv6 UDP checksums to be correctly controlled.") Fixes: c6c33454072f ("bpf: support ipv6 for bpf_skb_{set,get}_tunnel_key") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> 24 February 2016, 21:23:47 UTC
a8c4a25 Hannes Frederic Sowa 22 February 2016, 17:43:25 UTC ipv4: only create late gso-skb if skb is already set up with CHECKSUM_PARTIAL Otherwise we break the contract with GSO to only pass CHECKSUM_PARTIAL skbs down. This can easily happen with UDP+IPv4 sockets with the first MSG_MORE write smaller than the MTU, second write is a sendfile. Returning -EOPNOTSUPP lets the callers fall back into normal sendmsg path, were we calculate the checksum manually during copying. Commit d749c9cbffd6 ("ipv4: no CHECKSUM_PARTIAL on MSG_MORE corked sockets") started to exposes this bug. Fixes: d749c9cbffd6 ("ipv4: no CHECKSUM_PARTIAL on MSG_MORE corked sockets") Reported-by: Jiri Benc <jbenc@redhat.com> Cc: Jiri Benc <jbenc@redhat.com> Reported-by: Wakko Warner <wakko@animx.eu.org> Cc: Wakko Warner <wakko@animx.eu.org> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net> 24 February 2016, 19:11:34 UTC
c7dfe3a Sebastian Frias 22 February 2016, 12:33:14 UTC net: ethernet: nb8800: support fixed-link DT node Under some circumstances, e.g. when connecting to a switch, the ethernet port will not be connected to a PHY. In that case a "fixed-link" DT node can be used to replace it. https://stackoverflow.com/questions/31046172/device-tree-for-phy-less-connection-to-a-dsa-switch This patch adds support for the "fixed-link" node to the nb8800 driver. Signed-off-by: Sebastian Frias <sf84@laposte.net> Acked-by: Mans Rullgard <mans@mansr.com> Cc: Mason <slash.tmp@free.fr> Signed-off-by: David S. Miller <davem@davemloft.net> 24 February 2016, 16:32:11 UTC
fbb0fa8 Michael Chan 22 February 2016, 07:10:26 UTC bnxt_en: Fix zero padding of tx push data. The arithmetic to zero pad the last 64-bit word in the push buffer is not correct. 1. It should be pdata + length to get to the end. 2. 'pdata' is void pointer and passing it to PTR_ALIGN() will cast the aligned pointer to void. Pass 'end' which is u64 pointer to PTR_ALIGN() instead so that the aligned pointer - 1 is the last 64-bit pointer to data. Signed-off-by: Michael Chan <michael.chan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net> 24 February 2016, 00:12:51 UTC
5146d1f Bernie Harris 21 February 2016, 23:58:05 UTC tunnel: Clear IPCB(skb)->opt before dst_link_failure called IPCB may contain data from previous layers (in the observed case the qdisc layer). In the observed scenario, the data was misinterpreted as ip header options, which later caused the ihl to be set to an invalid value (<5). This resulted in an infinite loop in the mips implementation of ip_fast_csum. This patch clears IPCB(skb)->opt before dst_link_failure can be called for various types of tunnels. This change only applies to encapsulated ipv4 packets. The code introduced in 11c21a30 which clears all of IPCB has been removed to be consistent with these changes, and instead the opt field is cleared unconditionally in ip_tunnel_xmit. The change in ip_tunnel_xmit applies to SIT, GRE, and IPIP tunnels. The relevant vti, l2tp, and pptp functions already contain similar code for clearing the IPCB. Signed-off-by: Bernie Harris <bernie.harris@alliedtelesis.co.nz> Signed-off-by: David S. Miller <davem@davemloft.net> 24 February 2016, 00:11:56 UTC
9bdfb3b Konstantin Khlebnikov 21 February 2016, 07:12:39 UTC tcp: convert cached rtt from usec to jiffies when feeding initial rto Currently it's converted into msecs, thus HZ=1000 intact. Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Fixes: 740b0f1841f6 ("tcp: switch rtt estimations to usec resolution") Signed-off-by: David S. Miller <davem@davemloft.net> 23 February 2016, 23:28:46 UTC
fb5eb24 Patrik Halfar 20 February 2016, 17:49:40 UTC Add Dell Wireless 5809e Gobi 4G HSPA+ Mobile Broadband Card (rev3) to qmi_wwan New revison of Dell Wireless 5809e Gobi 4G HSPA+ Mobile Broadband Card has new idProduct Bus 002 Device 006: ID 413c:81b3 Dell Computer Corp. Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x413c Dell Computer Corp. idProduct 0x81b3 bcdDevice 0.06 iManufacturer 1 Sierra Wireless, Incorporated iProduct 2 Dell Wireless 5809e Gobi™ 4G HSPA+ Mobile Broadband Card iSerial 3 bNumConfigurations 2 Signed-off-by: Patrik Halfar <patrik_halfar@halfarit.cz> Signed-off-by: David S. Miller <davem@davemloft.net> 23 February 2016, 20:42:32 UTC
905e36a Matti Gottlieb 14 February 2016, 15:05:39 UTC iwlwifi: mvm: Fix paging memory leak If the opmode is stopped and started again we did not free the paging buffers. Fix that. In addition when freeing the firmware's paging download buffer, set the pointer to NULL. Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> 23 February 2016, 19:51:30 UTC
b860715 Arend van Spriel 15 February 2016, 13:35:53 UTC cfg80211: stop critical protocol session upon disconnect event When user-space has started a critical protocol session and a disconnect event occurs, the rdev::crit_prot_nlportid remains set. This caused a subsequent NL80211_CMD_CRIT_PROTO_START to fail (-EBUSY). Fix this by clearing the rdev attribute and call .crit_proto_stop() callback upon disconnect event. Reviewed-by: Hante Meuleman <meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com> Signed-off-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> 23 February 2016, 09:41:24 UTC
5e950a7 Ola Olsson 11 February 2016, 00:00:22 UTC nl80211: Zero out the connection keys memory when freeing them. The connection keys are zeroed out in all other cases except this one. Let's fix the last one as well. Signed-off-by: Ola Olsson <ola.olsson@sonymobile.com> Reviewed-by: Julian Calaby <julian.calaby@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> 23 February 2016, 09:40:36 UTC
7a36b93 Felix Fietkau 18 February 2016, 18:49:18 UTC mac80211: minstrel_ht: set default tx aggregation timeout to 0 The value 5000 was put here with the addition of the timeout field to ieee80211_start_tx_ba_session. It was originally added in mac80211 to save resources for drivers like iwlwifi, which only supports a limited number of concurrent aggregation sessions. Since iwlwifi does not use minstrel_ht and other drivers don't need this, 0 is a better default - especially since there have been recent reports of aggregation setup related issues reproduced with ath9k. This should improve stability without causing any adverse effects. Cc: stable@vger.kernel.org Acked-by: Avery Pennarun <apenwarr@gmail.com> Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com> 23 February 2016, 09:39:24 UTC
dea08e6 Linus Torvalds 22 February 2016, 20:18:07 UTC Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "Looks like a lot, but mostly driver fixes scattered all over as usual. Of note: 1) Add conditional sched in nf conntrack in cleanup to avoid NMI watchdogs. From Florian Westphal. 2) Fix deadlock in nfnetlink cttimeout, also from Floarian. 3) Fix handling of slaves in bonding ARP monitor validation, from Jay Vosburgh. 4) Callers of ip_cmsg_send() are responsible for freeing IP options, some were not doing so. Fix from Eric Dumazet. 5) Fix per-cpu bugs in mvneta driver, from Gregory CLEMENT. 6) Fix vlan handling in mv88e6xxx DSA driver, from Vivien Didelot. 7) bcm7xxx PHY driver bug fixes from Florian Fainelli. 8) Avoid unaligned accesses to protocol headers wrt. GRE, from Alexander Duyck. 9) SKB leaks and other problems in arc_emac driver, from Alexander Kochetkov. 10) tcp_v4_inbound_md5_hash() releases listener socket instead of request socket on error path, oops. Fix from Eric Dumazet. 11) Missing socket release in pppoe_rcv_core() that seems to have existed basically forever. From Guillaume Nault. 12) Missing slave_dev unregister in dsa_slave_create() error path, from Florian Fainelli. 13) crypto_alloc_hash() never returns NULL, fix return value check in __tcp_alloc_md5sig_pool. From Insu Yun. 14) Properly expire exception route entries in ipv4, from Xin Long. 15) Fix races in tcp/dccp listener socket dismantle, from Eric Dumazet. 16) Don't set IFF_TX_SKB_SHARING in vxlan, geneve, or GRE, it's not legal. These drivers modify the SKB on transmit. From Jiri Benc. 17) Fix regression in the initialziation of netdev->tx_queue_len. From Phil Sutter. 18) Missing unlock in tipc_nl_add_bc_link() error path, from Insu Yun. 19) SCTP port hash sizing does not properly ensure that table is a power of two in size. From Neil Horman. 20) Fix initializing of software copy of MAC address in fmvj18x_cs driver, from Ken Kawasaki" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (129 commits) bnx2x: Fix 84833 phy command handler bnx2x: Fix led setting for 84858 phy. bnx2x: Correct 84858 PHY fw version bnx2x: Fix 84833 RX CRC bnx2x: Fix link-forcing for KR2 net: ethernet: davicom: fix devicetree irq resource fmvj18x_cs: fix incorrect indexing of dev->dev_addr[] when copying the MAC address Driver: Vmxnet3: Update Rx ring 2 max size net: netcp: rework the code for get/set sw_data in dma desc soc: ti: knav_dma: rename pad in struct knav_dma_desc to sw_data net: ti: netcp: restore get/set_pad_info() functionality MAINTAINERS: Drop myself as xen netback maintainer sctp: Fix port hash table size computation can: ems_usb: Fix possible tx overflow Bluetooth: hci_core: Avoid mixing up req_complete and req_complete_skb net: bcmgenet: Fix internal PHY link state af_unix: Don't use continue to re-execute unix_stream_read_generic loop unix_diag: fix incorrect sign extension in unix_lookup_by_ino bnxt_en: Failure to update PHY is not fatal condition. bnxt_en: Remove unnecessary call to update PHY settings. ... 22 February 2016, 20:18:07 UTC
5c102d0 Linus Torvalds 22 February 2016, 20:12:46 UTC Merge tag 'hwmon-for-linus-v4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Two fixes headed for stable: - Remove an unnecessary speed_index lookup for thermal hook in the gpio-fan driver. The unnecessary speed lookup can hog the system. - Handle negative conversion values correctly in the ads1015 driver" * tag 'hwmon-for-linus-v4.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (gpio-fan) Remove un-necessary speed_index lookup for thermal hook hwmon: (ads1015) Handle negative conversion values correctly 22 February 2016, 20:12:46 UTC
a16152c Linus Torvalds 22 February 2016, 20:04:11 UTC Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull rdma fixes from Doug Ledford: "One ocrdma fix: - The new CQ API support was added to ocrdma, but they got the arming logic wrong, so without this, transfers eventually fail when they fail to arm the interrupt properly under load Two related fixes for mlx4: - When we added the 64bit extended counters support to the core IB code, they forgot to update the RoCE side of the mlx4 driver (the IB side they properly updated). I debated whether or not to include these patches as they could be considered feature enablement patches, but the existing code will blindy copy the 32bit counters, whether any counters were requested at all (a bug). These two patches make it (a) check to see that counters were requested and (b) copy the right counters (the 64bit support is new, the 32bit is not). For that reason I went ahead and took them" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: IB/mlx4: Add support for the port info class for RoCE ports IB/mlx4: Add support for extended counters over RoCE ports RDMA/ocrdma: Fix arm logic to align with new cq API 22 February 2016, 20:04:11 UTC
7ee302f Linus Torvalds 22 February 2016, 19:55:18 UTC Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Some bugfixes from I2C for you: A fix for a RuntimePM regression with OMAP, a fix to enable TCO for Lewisburg platforms, and a typo fix while we are here" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: i801: Adding Intel Lewisburg support for iTCO i2c: uniphier: fix typos in error messages i2c: omap: Fix PM regression with deferred probe for pm_runtime_reinit 22 February 2016, 19:55:18 UTC
back to top