| 2abad79 | Andy Shevchenko | 06 January 2015, 21:17:53 UTC | qla3xxx: don't allow never end busy loop The counter variable wasn't increased at all which may stuck under certain circumstances. Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 January 2015, 22:41:36 UTC |
| 627d2cc | David S. Miller | 06 January 2015, 19:24:49 UTC | Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge Included changes: - ensure bonding is used (if enabled) for packets coming in the soft interface - fix race condition to avoid orig_nodes to be deleted right after being added - avoid false positive lockdep splats by assigning lockclass to the proper hashtable lock objects - avoid miscounting of multicast 'disabled' nodes in the network - fix memory leak in the Global Translation Table in case of originator interval change Signed-off-by: David S. Miller <davem@davemloft.net> | 06 January 2015, 19:24:49 UTC |
| 07ff890 | Palik, Imre | 06 January 2015, 15:44:44 UTC | xen-netback: fixing the propagation of the transmit shaper timeout Since e9ce7cb6b107 ("xen-netback: Factor queue-specific data into queue struct"), the transimt shaper timeout is always set to 0. The value the user sets via xenbus is never propagated to the transmit shaper. This patch fixes the issue. Cc: Anthony Liguori <aliguori@amazon.com> Signed-off-by: Imre Palik <imrep@amazon.de> Acked-by: Ian Campbell <ian.campbell@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 January 2015, 19:17:37 UTC |
| 15ecf7a | David S. Miller | 06 January 2015, 18:29:27 UTC | Merge tag 'mac80211-for-davem-2015-01-06' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Here's just a single fix - a revert of a patch that broke the p54 and cw2100 drivers (arguably due to bad assumptions there.) Since this affects kernels since 3.17, I decided to revert for now and we'll revisit this optimisation properly for -next. Signed-off-by: David S. Miller <davem@davemloft.net> | 06 January 2015, 18:29:27 UTC |
| a5e3125 | hayeswang | 06 January 2015, 09:41:58 UTC | r8152: support ndo_features_check Support ndo_features_check to avoid: - the transport offset is more than the hw limitation when using hw checksum. - the skb->len of a GSO packet is more than the limitation. Signed-off-by: Hayes Wang <hayeswang@realtek.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 January 2015, 18:29:13 UTC |
| 9d31b3c | Linus Lüssing | 13 December 2014, 22:32:15 UTC | batman-adv: fix potential TT client + orig-node memory leak This patch fixes a potential memory leak which can occur once an originator times out. On timeout the according global translation table entry might not get purged correctly. Furthermore, the non purged TT entry will cause its orig-node to leak, too. Which additionally can lead to the new multicast optimization feature not kicking in because of a therefore bogus counter. In detail: The batadv_tt_global_entry->orig_list holds the reference to the orig-node. Usually this reference is released after BATADV_PURGE_TIMEOUT through: _batadv_purge_orig()-> batadv_purge_orig_node()->batadv_update_route()->_batadv_update_route()-> batadv_tt_global_del_orig() which purges this global tt entry and releases the reference to the orig-node. However, if between two batadv_purge_orig_node() calls the orig-node timeout grew to 2*BATADV_PURGE_TIMEOUT then this call path isn't reached. Instead the according orig-node is removed from the originator hash in _batadv_purge_orig(), the batadv_update_route() part is skipped and won't be reached anymore. Fixing the issue by moving batadv_tt_global_del_orig() out of the rcu callback. Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> Acked-by: Antonio Quartulli <antonio@meshcoding.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> | 06 January 2015, 10:07:01 UTC |
| a516488 | Linus Lüssing | 30 October 2014, 04:40:47 UTC | batman-adv: fix multicast counter when purging originators When purging an orig_node we should only decrease counter tracking the number of nodes without multicast optimizations support if it was increased through this orig_node before. A not yet quite initialized orig_node (meaning it did not have its turn in the mcast-tvlv handler so far) which gets purged would not adhere to this and will lead to a counter imbalance. Fixing this by adding a check whether the orig_node is mcast-initalized before decreasing the counter in the mcast-orig_node-purging routine. Introduced by 60432d756cf06e597ef9da511402dd059b112447 ("batman-adv: Announce new capability via multicast TVLV") Reported-by: Tobias Hachmer <tobias@hachmer.de> Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> | 06 January 2015, 10:06:04 UTC |
| e8829f0 | Linus Lüssing | 30 October 2014, 04:40:46 UTC | batman-adv: fix counter for multicast supporting nodes A miscounting of nodes having multicast optimizations enabled can lead to multicast packet loss in the following scenario: If the first OGM a node receives from another one has no multicast optimizations support (no multicast tvlv) then we are missing to increase the counter. This potentially leads to the wrong assumption that we could safely use multicast optimizations. Fixings this by increasing the counter if the initial OGM has the multicast TVLV unset, too. Introduced by 60432d756cf06e597ef9da511402dd059b112447 ("batman-adv: Announce new capability via multicast TVLV") Reported-by: Tobias Hachmer <tobias@hachmer.de> Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> | 06 January 2015, 10:05:42 UTC |
| f44d540 | Martin Hundebøll | 11 November 2014, 15:22:23 UTC | batman-adv: fix lock class for decoding hash in network-coding.c batadv_has_set_lock_class() is called with the wrong hash table as first argument (probably due to a copy-paste error), which leads to false positives when running with lockdep. Introduced-by: 612d2b4fe0a1ff2f8389462a6f8be34e54124c05 ("batman-adv: network coding - save overheard and tx packets for decoding") Signed-off-by: Martin Hundebøll <martin@hundeboll.net> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> | 06 January 2015, 10:05:12 UTC |
| 2c667a3 | Linus Lüssing | 30 October 2014, 05:23:40 UTC | batman-adv: fix delayed foreign originator recognition Currently it can happen that the reception of an OGM from a new originator is not being accepted. More precisely it can happen that an originator struct gets allocated and initialized (batadv_orig_node_new()), even the TQ gets calculated and set correctly (batadv_iv_ogm_calc_tq()) but still the periodic orig_node purging thread will decide to delete it if it has a chance to jump between these two function calls. This is because batadv_orig_node_new() initializes the last_seen value to zero and its caller (batadv_iv_ogm_orig_get()) makes it visible to other threads by adding it to the hash table already. batadv_iv_ogm_calc_tq() will set the last_seen variable to the correct, current time a few lines later but if the purging thread jumps in between that it will think that the orig_node timed out and will wrongly schedule it for deletion already. If the purging interval is the same as the originator interval (which is the default: 1 second), then this game can continue for several rounds until the random OGM jitter added enough difference between these two (in tests, two to about four rounds seemed common). Fixing this by initializing the last_seen variable of an orig_node to the current time before adding it to the hash table. Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> | 06 January 2015, 10:05:09 UTC |
| 329887a | Simon Wunderlich | 13 August 2014, 12:26:56 UTC | batman-adv: fix and simplify condition when bonding should be used The current condition actually does NOT consider bonding when the interface the packet came in from is the soft interface, which is the opposite of what it should do (and the comment describes). Fix that and slightly simplify the condition. Reported-by: Ray Gibson <booray@gmail.com> Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> | 06 January 2015, 10:05:07 UTC |
| 1e359a5 | Johannes Berg | 05 January 2015, 09:28:49 UTC | Revert "mac80211: Fix accounting of the tailroom-needed counter" This reverts commit ca34e3b5c808385b175650605faa29e71e91991b. It turns out that the p54 and cw2100 drivers assume that there's tailroom even when they don't say they really need it. However, there's currently no way for them to explicitly say they do need it, so for now revert this. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=90331. Cc: stable@vger.kernel.org Fixes: ca34e3b5c808 ("mac80211: Fix accounting of the tailroom-needed counter") Reported-by: Christopher Chavez <chrischavez@gmx.us> Bisected-by: Larry Finger <Larry.Finger@lwfinger.net> Debugged-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> | 05 January 2015, 09:33:46 UTC |
| 7ce67a3 | Felipe Balbi | 02 January 2015, 22:15:59 UTC | net: ethernet: cpsw: fix hangs with interrupts The CPSW IP implements pulse-signaled interrupts. Due to that we must write a correct, pre-defined value to the CPDMA_MACEOIVECTOR register so the controller generates a pulse on the correct IRQ line to signal the End Of Interrupt. The way the driver is written today, all four IRQ lines are requested using the same IRQ handler and, because of that, we could fall into situations where a TX IRQ fires but we tell the controller that we ended an RX IRQ (or vice-versa). This situation triggers an IRQ storm on the reserved IRQ 127 of INTC which will in turn call ack_bad_irq() which will, then, print a ton of: unexpected IRQ trap at vector 00 In order to fix the problem, we are moving all calls to cpdma_ctlr_eoi() inside the IRQ handler and making sure we *always* write the correct value to the CPDMA_MACEOIVECTOR register. Note that the algorithm assumes that IRQ numbers and value-to-be-written-to-EOI are proportional, meaning that a write of value 0 would trigger an EOI pulse for the RX_THRESHOLD Interrupt and that's the IRQ number sitting in the 0-th index of our irqs_table array. This, however, is safe at least for current implementations of CPSW so we will refrain from making the check smarter (and, as a side-effect, slower) until we actually have a platform where IRQ lines are swapped. This patch has been tested for several days with AM335x- and AM437x-based platforms. AM57x was left out because there are still pending patches to enable ethernet in mainline for that platform. A read of the TRM confirms the statement on previous paragraph. Reported-by: Yegor Yefremov <yegorslists@googlemail.com> Fixes: 510a1e7 (drivers: net: davinci_cpdma: acknowledge interrupt properly) Cc: <stable@vger.kernel.org> # v3.9+ Signed-off-by: Felipe Balbi <balbi@ti.com> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 05 January 2015, 03:18:34 UTC |
| 9dac623 | Govindarajulu Varadarajan | 02 January 2015, 15:23:27 UTC | enic: free all rq buffs when allocation fails When allocation of all RQs fail, we do not free previously allocated buffers, before returning error. This causes memory leak. This patch fixes this by calling vnic_rq_clean(), which frees all the rq buffers. Signed-off-by: Govindarajulu Varadarajan <_govind@gmx.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 02 January 2015, 21:43:45 UTC |
| 531ad42 | Kristian Evensen | 02 January 2015, 15:21:45 UTC | qmi_wwan: Set random MAC on devices with buggy fw Some buggy firmwares export an incorrect MAC address (00:a0:c6:00:00:00). This makes for example checking devices for random MAC addresses tricky, and you might end up with multiple network interfaces with the same address. This patch tries to fix, or at least improve, the situation by setting the MAC address of devices with this firmware bug to a random address. I tested the patch with two devices that has this firmware bug (Huawei E398 and E392), and network traffic worked fine after changing the address. Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 02 January 2015, 21:41:47 UTC |
| 24cc59d | Ben Pfaff | 31 December 2014, 16:45:46 UTC | openvswitch: Consistently include VLAN header in flow and port stats. Until now, when VLAN acceleration was in use, the bytes of the VLAN header were not included in port or flow byte counters. They were however included when VLAN acceleration was not used. This commit corrects the inconsistency, by always including the VLAN header in byte counters. Previous discussion at http://openvswitch.org/pipermail/dev/2014-December/049521.html Reported-by: Motonori Shindo <mshindo@vmware.com> Signed-off-by: Ben Pfaff <blp@nicira.com> Reviewed-by: Flavio Leitner <fbl@sysclose.org> Acked-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 02 January 2015, 21:14:20 UTC |
| 843925f | Herbert Xu | 31 December 2014, 13:39:23 UTC | tcp: Do not apply TSO segment limit to non-TSO packets Thomas Jarosch reported IPsec TCP stalls when a PMTU event occurs. In fact the problem was completely unrelated to IPsec. The bug is also reproducible if you just disable TSO/GSO. The problem is that when the MSS goes down, existing queued packet on the TX queue that have not been transmitted yet all look like TSO packets and get treated as such. This then triggers a bug where tcp_mss_split_point tells us to generate a zero-sized packet on the TX queue. Once that happens we're screwed because the zero-sized packet can never be removed by ACKs. Fixes: 1485348d242 ("tcp: Apply device TSO segment limit earlier") Reported-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Cheers, Signed-off-by: David S. Miller <davem@davemloft.net> | 02 January 2015, 21:13:20 UTC |
| c484994 | Kostya Belezko | 30 December 2014, 17:27:09 UTC | Altera TSE: Add missing phydev Altera network device doesn't come up after ifconfig eth0 down ifconfig eth0 up The reason behind is clearing priv->phydev during tse_shutdown(). The phydev is not restored back at tse_open(). Resubmiting as to follow Tobias Klauser suggestion. phy_start/phy_stop are called on each ifup/ifdown and phy_disconnect is called once during the module removal. Signed-off-by: Kostya Belezko <bkostya@hotmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 02 January 2015, 20:45:10 UTC |
| 2b972ac | David S. Miller | 02 January 2015, 20:41:33 UTC | Merge branch 'mlx4-net' Or Gerlitz says: ==================== mlx4 driver fixes for 3.19-rc2 Please push Maor's patch to -stable >= 3.17 Jack's fixes error-flow issues introduced in 3.19-rc1, no need for -stable. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 02 January 2015, 20:41:33 UTC |
| d0d0125 | Jack Morgenstein | 30 December 2014, 09:59:50 UTC | net/mlx4_core: Fix error flow in mlx4_init_hca() We shouldn't call UNMAP_FA here, this is done in mlx4_load_one. If mlx4_query_func fails, we need to invoke CLOSE_HCA for both native and master. Fixes: a0eacca948d2 ('net/mlx4_core: Refactor mlx4_load_one') Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 02 January 2015, 20:41:29 UTC |
| a51e0df | Maor Gottlieb | 30 December 2014, 09:59:49 UTC | net/mlx4_core: Correcly update the mtt's offset in the MR re-reg flow Previously, mlx4_mt_rereg_write filled the MPT's entity_size with the old MTT's page shift, which could result in using an incorrect offset. Fix the initialization to be after we calculate the new MTT offset. In addition, assign mtt order to -1 after calling mlx4_mtt_cleanup. This is necessary in order to mark the MTT as invalid and avoid freeing it later. Fixes: e630664 ('mlx4_core: Add helper functions to support MR re-registration') Signed-off-by: Maor Gottlieb <maorg@mellanox.com> Signed-off-by: Matan Barak <matanb@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 02 January 2015, 20:41:28 UTC |
| 7824acd | Yongjian Xu | 30 December 2014, 08:03:46 UTC | qlcnic: Fix return value in qlcnic_probe() If the check of adapter fails and goes into the 'else' branch, the return value 'err' should not still be zero. Signed-off-by: Yongjian Xu <xuyongjiande@gmail.com> Acked-by: Shahed Shaikh <shahed.shaikh@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 01 January 2015, 00:21:19 UTC |
| 0f113b8 | Julia Lawall | 29 December 2014, 17:04:42 UTC | net: axienet: fix error return code Return a negative error code on failure. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ identifier ret; expression e1,e2; @@ ( if (\(ret < 0\|ret != 0\)) { ... return ret; } | ret = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: David S. Miller <davem@davemloft.net> | 01 January 2015, 00:19:00 UTC |
| 3d2232f | Julia Lawall | 29 December 2014, 17:04:40 UTC | net: sun4i-emac: fix error return code Return a negative error code on failure. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ identifier ret; expression e1,e2; @@ ( if (\(ret < 0\|ret != 0\)) { ... return ret; } | ret = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: David S. Miller <davem@davemloft.net> | 01 January 2015, 00:19:00 UTC |
| f12e77c | Julia Lawall | 29 December 2014, 17:04:37 UTC | myri10ge: fix error return code Return a negative error code on failure. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ identifier ret; expression e1,e2; @@ ( if (\(ret < 0\|ret != 0\)) { ... return ret; } | ret = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> The patch also modifies the test of mgp->cmd to satisfy checkpatch. Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: David S. Miller <davem@davemloft.net> | 01 January 2015, 00:19:00 UTC |
| 8a0a1f8 | Julia Lawall | 29 December 2014, 17:04:36 UTC | net: Xilinx: fix error return code Return a negative error code on failure. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ identifier ret; expression e1,e2; @@ ( if (\(ret < 0\|ret != 0\)) { ... return ret; } | ret = 0 ) ... when != ret = e1 when != &ret *if(...) { ... when != ret = e2 when forall return ret; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: David S. Miller <davem@davemloft.net> | 01 January 2015, 00:19:00 UTC |
| 4e4804b | David S. Miller | 01 January 2015, 00:17:03 UTC | Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2014-12-31 This series contains updates to fixes for e100, igb and i40e. John Linville fixes a typo in e100 that has been around for some time, where an attempted revert actually inverted the test for eeprom_mdix_enabled. Todd fixes up a code comment that should have been removed back in 2007. Joe Perches fixes a possible memory leak in i40e which was reported by Dan Carpenter using smatch. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 01 January 2015, 00:17:03 UTC |
| e3fe44c | Joe Perches | 08 December 2014, 04:28:39 UTC | i40e: Fix possible memory leak in i40e_dbg_dump_desc I didn't notice that return in the code, fix it by adding a goto out instead to free the memory. Fixes: > New smatch warnings: > drivers/net/ethernet/intel/i40e/i40e_debugfs.c:832 i40e_dbg_dump_desc() warn: possible memory leak of 'ring' Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Joe Perches <joe@perches.com> Tested-by: Jim Young <james.m.young@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> | 31 December 2014, 23:40:12 UTC |
| 2184aa3 | Todd Fujinaka | 27 November 2014, 01:00:02 UTC | igb: Remove unneeded FIXME Remove a FIXME comment that was missed in a commit on 1/2007. Signed-off-by: Todd Fujinaka <todd.fujinaka@intel.com> Reported-by: nick <xerofoify@gmail.com> Tested-by: Aaron Brown <aaron.f.brown@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> | 31 December 2014, 20:11:06 UTC |
| a3566b5 | John W. Linville | 15 November 2014, 01:19:53 UTC | e100: fix typo in MDI/MDI-X eeprom check in e100_phy_init Although it doesn't explicitly say so, commit 60ffa478759f39a2 ("e100: Fix MDIO/MDIO-X") appears to be intended to revert the earlier commit 648951451e6d2d53 ("e100: fixed e100 MDI/MDI-X issues"). However, careful examination reveals that the attempted revert actually _inverted_ the test for eeprom_mdix_enabled. That is bound to program a few PHYs incorrectly... https://bugzilla.redhat.com/show_bug.cgi?id=1156417 Signed-off-by: "John W. Linville" <linville@tuxdriver.com> Tested-by: Aaron Brown <aaron.f.brown@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> | 31 December 2014, 19:55:40 UTC |
| 2c90331 | Linus Torvalds | 30 December 2014, 18:45:47 UTC | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix double SKB free in bluetooth 6lowpan layer, from Jukka Rissanen. 2) Fix receive checksum handling in enic driver, from Govindarajulu Varadarajan. 3) Fix NAPI poll list corruption in virtio_net and caif_virtio, from Herbert Xu. Also, add code to detect drivers that have this mistake in the future. 4) Fix doorbell endianness handling in mlx4 driver, from Amir Vadai. 5) Don't clobber IP6CB() before xfrm6_policy_check() is called in TCP input path,f rom Nicolas Dichtel. 6) Fix MPLS action validation in openvswitch, from Pravin B Shelar. 7) Fix double SKB free in vxlan driver, also from Pravin. 8) When we scrub a packet, which happens when we are switching the context of the packet (namespace, etc.), we should reset the secmark. From Thomas Graf. 9) ->ndo_gso_check() needs to do more than return true/false, it also has to allow the driver to clear netdev feature bits in order for the caller to be able to proceed properly. From Jesse Gross. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (62 commits) genetlink: A genl_bind() to an out-of-range multicast group should not WARN(). netlink/genetlink: pass network namespace to bind/unbind ne2k-pci: Add pci_disable_device in error handling bonding: change error message to debug message in __bond_release_one() genetlink: pass multicast bind/unbind to families netlink: call unbind when releasing socket netlink: update listeners directly when removing socket genetlink: pass only network namespace to genl_has_listeners() netlink: rename netlink_unbind() to netlink_undo_bind() net: Generalize ndo_gso_check to ndo_features_check net: incorrect use of init_completion fixup neigh: remove next ptr from struct neigh_table net: xilinx: Remove unnecessary temac_property in the driver net: phy: micrel: use generic config_init for KSZ8021/KSZ8031 net/core: Handle csum for CHECKSUM_COMPLETE VXLAN forwarding openvswitch: fix odd_ptr_err.cocci warnings Bluetooth: Fix accepting connections when not using mgmt Bluetooth: Fix controller configuration with HCI_QUIRK_INVALID_BDADDR brcmfmac: Do not crash if platform data is not populated ipw2200: select CFG80211_WEXT ... | 30 December 2014, 18:45:47 UTC |
| 6ab1e8d | Linus Torvalds | 30 December 2014, 18:36:59 UTC | Merge tag 'linux-kselftest-3.19-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fix from Shuah Khan: "Fix exec test compile warnings" * tag 'linux-kselftest-3.19-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/exec: Use %zu to format size_t | 30 December 2014, 18:36:59 UTC |
| 5faa015 | Linus Torvalds | 30 December 2014, 05:09:57 UTC | Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6 Pull CIFS fixes from Steve French: "A set of three minor cifs fixes" * 'for-linus' of git://git.samba.org/sfrench/cifs-2.6: cifs: make new inode cache when file type is different Fix signed/unsigned pointer warning Convert MessageID in smb2_hdr to LE | 30 December 2014, 05:09:57 UTC |
| b9d4a35 | Linus Torvalds | 30 December 2014, 04:43:10 UTC | Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull UDF & isofs fixes from Jan Kara: "A couple of UDF fixes of handling of corrupted media and one iso9660 fix of the same" * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Reduce repeated dereferences udf: Check component length before reading it udf: Check path length when reading symlink udf: Verify symlink size before loading it udf: Verify i_size when loading inode isofs: Fix unchecked printing of ER records | 30 December 2014, 04:43:10 UTC |
| df90dcd | Linus Torvalds | 30 December 2014, 02:50:02 UTC | Merge tag 'pm+acpi-3.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management and ACPI material from Rafael J Wysocki: "These are fixes (operating performance points library, cpufreq-dt driver, cpufreq core, ACPI backlight, cpupower tool), cleanups (cpuidle), new processor IDs for the RAPL (Running Average Power Limit) power capping driver, and a modification of the generic power domains framework allowing modular drivers to call one of its helper functions. Specifics: - Fix for a potential NULL pointer dereference in the cpufreq core due to an initialization race condition (Ethan Zhao). - Fixes for abuse of the OPP (Operating Performance Points) API related to RCU and other minor issues in the OPP library and the cpufreq-dt driver (Dmitry Torokhov). - cpuidle governors cleanup making them measure idle duration in a better way without using the CPUIDLE_FLAG_TIME_INVALID flag which allows that flag to be dropped from the ACPI cpuidle driver and from the core too (Len Brown). - New ACPI backlight blacklist entries for Samsung machines without a working native backlight interface that need to use the ACPI backlight instead (Aaron Lu). - New CPU IDs of future Intel Xeon CPUs for the Intel RAPL power capping driver (Jacob Pan). - Generic power domains framework modification to export the of_genpd_get_from_provider() function to modular drivers that will allow future driver modifications to be based on the mainline (Amit Daniel Kachhap). - Two fixes for the cpupower tool (Michal Privoznik, Prarit Bhargava)" * tag 'pm+acpi-3.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / video: Add some Samsung models to disable_native_backlight list tools / cpupower: Fix no idle state information return value tools / cpupower: Correctly detect if running as root cpufreq: fix a NULL pointer dereference in __cpufreq_governor() cpufreq-dt: defer probing if OPP table is not ready PM / OPP: take RCU lock in dev_pm_opp_get_opp_count PM / OPP: fix warning in of_free_opp_table() PM / OPP: add some lockdep annotations powercap / RAPL: add IDs for future Xeon CPUs PM / Domains: Export of_genpd_get_from_provider function cpuidle / ACPI: remove unused CPUIDLE_FLAG_TIME_INVALID cpuidle: ladder: Better idle duration measurement without using CPUIDLE_FLAG_TIME_INVALID cpuidle: menu: Better idle duration measurement without using CPUIDLE_FLAG_TIME_INVALID | 30 December 2014, 02:50:02 UTC |
| dc97a1a | David S. Miller | 29 December 2014, 21:31:49 UTC | genetlink: A genl_bind() to an out-of-range multicast group should not WARN(). Users can request to bind to arbitrary multicast groups, so warning when the requested group number is out of range is not appropriate. And with the warning removed, and the 'err' variable properly given an initial value, we can remove 'found' altogether. Reported-by: Sedat Dilek <sedat.dilek@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 December 2014, 21:31:49 UTC |
| 346eef2 | Linus Torvalds | 29 December 2014, 21:30:50 UTC | Merge tag 'spi-v3.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few driver specific fixes here, the DMA burst size increase in the spfi driver is a fix to make the hardware happier in some situations" * tag 'spi-v3.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: img-spfi: Increase DMA burst size spi: img-spfi: Enable controller before starting TX DMA spi: sh-msiof: Add runtime PM lock in initializing | 29 December 2014, 21:30:50 UTC |
| 034496f | Linus Torvalds | 29 December 2014, 21:24:38 UTC | Merge tag 'regulator-v3.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull one regulator fix from Mark Brown: "One fix here, a fix for the voltage mapping on one of the s2mps11 regulators which broke systems using it including apparently the Gear 2 smartwatches" * tag 'regulator-v3.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: s2mps11: Fix dw_mmc failure on Gear 2 | 29 December 2014, 21:24:38 UTC |
| 5e6c2c9 | Linus Torvalds | 29 December 2014, 21:19:56 UTC | Merge tag 'mmc-v3.19-2' of git://git.linaro.org/people/ulf.hansson/mmc Pull one MMC fix from Ulf Hansson: "MMC core: - Fix selection of buswidth for mmc hosts supporting 1-bit only" * tag 'mmc-v3.19-2' of git://git.linaro.org/people/ulf.hansson/mmc: mmc: core: stop trying to switch width when only one bit is supported | 29 December 2014, 21:19:56 UTC |
| 4c5d499 | Linus Torvalds | 29 December 2014, 21:13:41 UTC | Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux Pull thermal management updates from Zhang Rui: "First of all, the most important change is the thermal cpu cooling fixes. The major fix here is to have proper sequencing between cpufreq layer and thermal cpu cooling registration. A take away of this fix is an improvement in the thermal drivers code. Thermal drivers that require cpu cooling do not need to check for cpufreq layer. The requirement now is to propagate the error code, if any, while registering cpu cooling device. Thanks to Viresh for implementing the required CPUfreq changes. Second, a new driver is introduced for int340x processor thermal device. Given that int340x thermal is disabled by default, and this processor thermal device is only available on limited platforms, plus the driver does nothing but exposes some thermal limitation information for user space to use, thus I think it is safe to include it in this pull request after missing 3.19-rc2. Specifics: - Thermal cpu cooling fixes and cleanups. - introduce INT340X processor thermal reporting device driver. - several small fixes and cleanups for int340x thermal drivers" * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux: (43 commits) Thermal/int340x/int3403: Free acpi notification handler Thermal/int340x/processor_thermal: Fix memory leak Thermal/int340x/int3403: Fix memory leak thermal: int340x: Introduce processor reporting device thermal: int340x_thermal: drop owner assignment from platform_drivers thermal: drop owner assignment from platform_drivers thermal: cpu_cooling: document node in struct cpufreq_cooling_device thermal/powerclamp: add ids for future xeon cpus Thermal/int340x: Handle properly the case when _trt or _art acpi entry is missing thermal: cpu_cooling: return ERR_PTR() for !CPU_THERMAL or !THERMAL_OF thermal: cpu_cooling: small memory leak on error thermal: ti-soc-thermal: Do not print error message in the EPROBE_DEFER case thermal: db8500: Do not print error message in the EPROBE_DEFER case thermal: imx: Do not print error message in the EPROBE_DEFER case thermal: Fix cdev registration with THERMAL_NO_LIMIT on 64bit drivers: thermal: Remove ARCH_HAS_BANDGAP dependency for samsung thermal:core:fix: Check return code of the ->get_max_state() callback thermal: cpu_cooling: update copyright tags thermal: cpu_cooling: Use cpufreq_dev->freq_table for finding level/freq thermal: cpu_cooling: Store frequencies in descending order ... | 29 December 2014, 21:13:41 UTC |
| 45f87de | Michal Hocko | 29 December 2014, 19:30:35 UTC | mm: get rid of radix tree gfp mask for pagecache_get_page Commit 2457aec63745 ("mm: non-atomically mark page accessed during page cache allocation where possible") has added a separate parameter for specifying gfp mask for radix tree allocations. Not only this is less than optimal from the API point of view because it is error prone, it is also buggy currently because grab_cache_page_write_begin is using GFP_KERNEL for radix tree and if fgp_flags doesn't contain FGP_NOFS (mostly controlled by fs by AOP_FLAG_NOFS flag) but the mapping_gfp_mask has __GFP_FS cleared then the radix tree allocation wouldn't obey the restriction and might recurse into filesystem and cause deadlocks. This is the case for most filesystems unfortunately because only ext4 and gfs2 are using AOP_FLAG_NOFS. Let's simply remove radix_gfp_mask parameter because the allocation context is same for both page cache and for the radix tree. Just make sure that the radix tree gets only the sane subset of the mask (e.g. do not pass __GFP_WRITE). Long term it is more preferable to convert remaining users of AOP_FLAG_NOFS to use mapping_gfp_mask instead and simplify this interface even further. Reported-by: Dave Chinner <david@fromorbit.com> Signed-off-by: Michal Hocko <mhocko@suse.cz> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 29 December 2014, 20:45:45 UTC |
| 651c329 | Rafael J. Wysocki | 29 December 2014, 20:24:13 UTC | Merge branch 'acpi-video' * acpi-video: ACPI / video: Add some Samsung models to disable_native_backlight list | 29 December 2014, 20:24:13 UTC |
| 4f2f277 | Rafael J. Wysocki | 29 December 2014, 20:24:00 UTC | Merge branches 'pm-domains', 'powercap' and 'pm-tools' * pm-domains: PM / Domains: Export of_genpd_get_from_provider function * powercap: powercap / RAPL: add IDs for future Xeon CPUs * pm-tools: tools / cpupower: Fix no idle state information return value tools / cpupower: Correctly detect if running as root | 29 December 2014, 20:24:00 UTC |
| ff23ab2 | Rafael J. Wysocki | 29 December 2014, 20:23:41 UTC | Merge branches 'pm-cpufreq' and 'pm-cpuidle' * pm-cpufreq: cpufreq: fix a NULL pointer dereference in __cpufreq_governor() cpufreq-dt: defer probing if OPP table is not ready * pm-cpuidle: cpuidle / ACPI: remove unused CPUIDLE_FLAG_TIME_INVALID cpuidle: ladder: Better idle duration measurement without using CPUIDLE_FLAG_TIME_INVALID cpuidle: menu: Better idle duration measurement without using CPUIDLE_FLAG_TIME_INVALID | 29 December 2014, 20:23:41 UTC |
| e0288b0 | Rafael J. Wysocki | 29 December 2014, 20:23:13 UTC | Merge branch 'pm-opp' * pm-opp: PM / OPP: take RCU lock in dev_pm_opp_get_opp_count PM / OPP: fix warning in of_free_opp_table() PM / OPP: add some lockdep annotations | 29 December 2014, 20:23:13 UTC |
| 1c2d26e | Alexandre Belloni | 17 December 2014, 18:32:06 UTC | mmc: core: stop trying to switch width when only one bit is supported mmc_select_bus_width() will try to switch to MMC_BUS_WIDTH_4 even if MMC_CAP_4_BIT_DATA and MMC_CAP_8_BIT_DATA are not set in host->caps. Return as soon as possible when those flags are not set Fixes: 577fb13199b1 (mmc: rework selection of bus speed mode) Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Cc: <stable@vger.kernel.org> # 3.17 Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> | 29 December 2014, 13:49:28 UTC |
| b7392d2 | Linus Torvalds | 29 December 2014, 00:49:37 UTC | Linux 3.19-rc2 | 29 December 2014, 00:49:37 UTC |
| 2ea1e35 | Linus Torvalds | 28 December 2014, 21:08:08 UTC | Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "The important fixes are for two bugs introduced by the merge window. On top of this, add a couple of WARN_ONs and stop spamming dmesg on pretty much every boot of a virtual machine" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvm: warn on more invariant breakage kvm: fix sorting of memslots with base_gfn == 0 kvm: x86: drop severity of "generation wraparound" message kvm: x86: vmx: reorder some msr writing | 28 December 2014, 21:08:08 UTC |
| 9a6b871 | Linus Torvalds | 28 December 2014, 21:02:27 UTC | Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fix from Al Viro: "An embarrassing bug in lustre patches from this cycle ;-/" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: [regression] braino in "lustre: use is_root_inode()" | 28 December 2014, 21:02:27 UTC |
| dbaff30 | Paolo Bonzini | 27 December 2014, 20:08:16 UTC | kvm: warn on more invariant breakage Modifying a non-existent slot is not allowed. Also check that the first loop doesn't move a deleted slot beyond the used part of the mslots array. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | 28 December 2014, 09:01:25 UTC |
| efbeec7 | Paolo Bonzini | 27 December 2014, 17:01:00 UTC | kvm: fix sorting of memslots with base_gfn == 0 Before commit 0e60b0799fed (kvm: change memslot sorting rule from size to GFN, 2014-12-01), the memslots' sorting key was npages, meaning that a valid memslot couldn't have its sorting key equal to zero. On the other hand, a valid memslot can have base_gfn == 0, and invalid memslots are identified by base_gfn == npages == 0. Because of this, commit 0e60b0799fed broke the invariant that invalid memslots are at the end of the mslots array. When a memslot with base_gfn == 0 was created, any invalid memslot before it were left in place. This can be fixed by changing the insertion to use a ">=" comparison instead of "<=", but some care is needed to avoid breaking the case of deleting a memslot; see the comment in update_memslots. Thanks to Tiejun Chen for posting an initial patch for this bug. Reported-by: Jamie Heilman <jamie@audible.transient.net> Reported-by: Andy Lutomirski <luto@amacapital.net> Tested-by: Jamie Heilman <jamie@audible.transient.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | 28 December 2014, 09:01:17 UTC |
| 29169f8 | Linus Torvalds | 27 December 2014, 21:12:00 UTC | Merge tag 'sound-3.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Just a couple of fixes for the new Intel Skylake HD-audio support" * tag 'sound-3.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda_intel: apply the Seperate stream_tag for Skylake ALSA: hda_controller: Separate stream_tag for input and output streams. | 27 December 2014, 21:12:00 UTC |
| a629df7 | Paolo Bonzini | 22 December 2014, 09:43:39 UTC | kvm: x86: drop severity of "generation wraparound" message Since most virtual machines raise this message once, it is a bit annoying. Make it KERN_DEBUG severity. Cc: stable@vger.kernel.org Fixes: 7a2e8aaf0f6873b47bc2347f216ea5b0e4c258ab Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | 27 December 2014, 20:52:28 UTC |
| baa0352 | Tiejun Chen | 23 December 2014, 08:21:11 UTC | kvm: x86: vmx: reorder some msr writing The commit 34a1cd60d17f, "x86: vmx: move some vmx setting from vmx_init() to hardware_setup()", tried to refactor some codes specific to vmx hardware setting into hardware_setup(), but some msr writing should depend on our previous setting condition like enable_apicv, enable_ept and so on. Reported-by: Jamie Heilman <jamie@audible.transient.net> Tested-by: Jamie Heilman <jamie@audible.transient.net> Signed-off-by: Tiejun Chen <tiejun.chen@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | 27 December 2014, 20:52:10 UTC |
| 023e2cf | Johannes Berg | 23 December 2014, 20:00:06 UTC | netlink/genetlink: pass network namespace to bind/unbind Netlink families can exist in multiple namespaces, and for the most part multicast subscriptions are per network namespace. Thus it only makes sense to have bind/unbind notifications per network namespace. To achieve this, pass the network namespace of a given client socket to the bind/unbind functions. Also do this in generic netlink, and there also make sure that any bind for multicast groups that only exist in init_net is rejected. This isn't really a problem if it is accepted since a client in a different namespace will never receive any notifications from such a group, but it can confuse the family if not rejected (it's also possible to silently (without telling the family) accept it, but it would also have to be ignored on unbind so families that take any kind of action on bind/unbind won't do unnecessary work for invalid clients like that. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 December 2014, 08:07:50 UTC |
| eb69c5b | Jia-Ju Bai | 23 December 2014, 03:29:03 UTC | ne2k-pci: Add pci_disable_device in error handling For linux-3.18.0 The driver lacks pci_disable_device in error handling code of ne2k_pci_init_one, so the device enabled by pci_enable_device is not disabled when errors occur. This patch fixes this problem. Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 December 2014, 07:20:55 UTC |
| a22a9e4 | Wengang Wang | 23 December 2014, 01:24:36 UTC | bonding: change error message to debug message in __bond_release_one() In __bond_release_one(), when the interface is not a slave or not a slave of "this" master, it log error message. The message actually should be a debug message matching what bond_enslave() does. Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com> Acked-by: Ding Tianhong <dingtianhong@huawei.com> Signed-off-by: Andy Gospodarek <gospo@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 December 2014, 07:20:55 UTC |
| 24f626d | David S. Miller | 27 December 2014, 07:20:30 UTC | Merge branch 'netlink_multicast' Johannes Berg says: ==================== netlink/genetlink cleanups & multicast improvements I'm looking at using the multicast group functionality in a way that would benefit from knowing when there are subscribers to avoid collecting the required data when there aren't any. During this I noticed that the unbind for multicast groups doesn't actually work - it's never called when sockets are closed. Luckily, nobody actually uses the functionality. While looking at the code trying to find why it's not called and where the multicast listeners are actually removed, I found the potential cleanup in patch 3. Patch 2 also has a cleanup for a generic netlink API in this area. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 27 December 2014, 07:20:30 UTC |
| c380d9a | Johannes Berg | 23 December 2014, 19:54:40 UTC | genetlink: pass multicast bind/unbind to families In order to make the newly fixed multicast bind/unbind functionality in generic netlink, pass them down to the appropriate family. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 December 2014, 07:20:23 UTC |
| 7d68536 | Johannes Berg | 22 December 2014, 17:56:38 UTC | netlink: call unbind when releasing socket Currently, netlink_unbind() is only called when the socket explicitly unbinds, which limits its usefulness (luckily there are no users of it yet anyway.) Call netlink_unbind() also when a socket is released, so it becomes possible to track listeners with this callback and without also implementing a netlink notifier (and checking netlink_has_listeners() in there.) Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 December 2014, 07:20:23 UTC |
| b10dcb3 | Johannes Berg | 22 December 2014, 17:56:37 UTC | netlink: update listeners directly when removing socket The code is now confusing to read - first in one function down (netlink_remove) any group subscriptions are implicitly removed by calling __sk_del_bind_node(), but the subscriber database is only updated far later by calling netlink_update_listeners(). Move the latter call to just after removal from the list so it is easier to follow the code. This also enables moving the locking inside the kernel-socket conditional, which improves the normal socket destruction path. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 December 2014, 07:20:23 UTC |
| f8403a2 | Johannes Berg | 22 December 2014, 17:56:36 UTC | genetlink: pass only network namespace to genl_has_listeners() There's no point to force the caller to know about the internal genl_sock to use inside struct net, just have them pass the network namespace. This doesn't really change code generation since it's an inline, but makes the caller less magic - there's never any reason to pass another socket. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 December 2014, 07:20:23 UTC |
| 02c81ab | Johannes Berg | 22 December 2014, 17:56:35 UTC | netlink: rename netlink_unbind() to netlink_undo_bind() The new name is more expressive - this isn't a generic unbind function but rather only a little undo helper for use only in netlink_bind(). Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 December 2014, 07:20:23 UTC |
| 5242d42 | Al Viro | 27 December 2014, 03:43:19 UTC | [regression] braino in "lustre: use is_root_inode()" In one of the places (ll_md_blocking_ast()) we had open-coded !is_root_inode(inode) and replaced it with is_root_inode(inode). See the last chunk of f76c23: - inode != inode->i_sb->s_root->d_inode) + is_root_inode(inode)) should've been + !is_root_inode(inode)) obviously... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> | 27 December 2014, 03:43:19 UTC |
| eb46e22 | David S. Miller | 26 December 2014, 23:23:37 UTC | Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Johan Hedberg says: ==================== Here's one more bluetooth pull request for 3.19. We've got two fixes: - Fix for accepting connections with old user space versions of BlueZ - Fix for Bluetooth controllers that don't have a public address Both of these are regressions that were introduced in 3.17, so the appropriate Cc: stable annotations are provided. Please let me know if there are any issues pulling. Thanks. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 26 December 2014, 23:23:37 UTC |
| b63a2a1 | David S. Miller | 26 December 2014, 23:08:38 UTC | Merge tag 'wireless-drivers-for-davem-2014-12-26' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers o Paul made a Kconfig dependency fix to ipw2200, it was not possible to enable that driver because Wireless Extensions is now disabled by default. o Mika fixed brcmfmac not to crash when platform data is not populated o Emmanuel provided few fixes to iwlwifi, he says: "I have here new device IDs and a fix for double free bug I introduced. I also fix an issue with the RFKILL interrupt - the HW needs us to ACK the interrupt again after we reset it. Liad fixes an issue with the firmware debugging infrastructure. While working on torture scenarios of firmware restarts, Eliad found an issue which he fixed." Signed-off-by: David S. Miller <davem@davemloft.net> | 26 December 2014, 23:08:38 UTC |
| 5f35227 | Jesse Gross | 24 December 2014, 06:37:26 UTC | net: Generalize ndo_gso_check to ndo_features_check GSO isn't the only offload feature with restrictions that potentially can't be expressed with the current features mechanism. Checksum is another although it's a general issue that could in theory apply to anything. Even if it may be possible to implement these restrictions in other ways, it can result in duplicate code or inefficient per-packet behavior. This generalizes ndo_gso_check so that drivers can remove any features that don't make sense for a given packet, similar to netif_skb_features(). It also converts existing driver restrictions to the new format, completing the work that was done to support tunnel protocols since the issues apply to checksums as well. By actually removing features from the set that are used to do offloading, it solves another problem with the existing interface. In these cases, GSO would run with the original set of features and not do anything because it appears that segmentation is not required. CC: Tom Herbert <therbert@google.com> CC: Joe Stringer <joestringer@nicira.com> CC: Eric Dumazet <edumazet@google.com> CC: Hayes Wang <hayeswang@realtek.com> Signed-off-by: Jesse Gross <jesse@nicira.com> Acked-by: Tom Herbert <therbert@google.com> Fixes: 04ffcb255f22 ("net: Add ndo_gso_check") Tested-by: Hayes Wang <hayeswang@realtek.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 December 2014, 22:20:56 UTC |
| 6e4ab36 | Nicholas Mc Guire | 23 December 2014, 17:47:50 UTC | net: incorrect use of init_completion fixup The second init_completion call should be a reinit_completion here. patch is against 3.18.0 linux-next Signed-off-by: Nicholas Mc Guire <der.herr@hofr.at> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 December 2014, 22:07:50 UTC |
| ef8f342 | Nicolas Dichtel | 23 December 2014, 16:50:37 UTC | neigh: remove next ptr from struct neigh_table After commit d7480fd3b173 ("neigh: remove dynamic neigh table registration support"), this field is not used anymore. CC: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 December 2014, 22:07:08 UTC |
| 16d8614 | Appana Durga Kedareswara Rao | 23 December 2014, 12:37:55 UTC | net: xilinx: Remove unnecessary temac_property in the driver This property is no longer used in the code yet the code looks for it in the device tree. It does not cause an error if it's not in the tree. Signed-off-by: Kedareswara rao Appana <appanad@xilinx.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 December 2014, 22:06:20 UTC |
| 58628a7 | Linus Torvalds | 26 December 2014, 21:41:05 UTC | Merge branch 'parisc-3.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc build fix from Helge Deller: "This unbreaks the kernel compilation on parisc with gcc-4.9" * 'parisc-3.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: fix out-of-register compiler error in ldcw inline assembler function | 26 December 2014, 21:41:05 UTC |
| d0e1df9 | Johan Hovold | 23 December 2014, 11:59:17 UTC | net: phy: micrel: use generic config_init for KSZ8021/KSZ8031 Use generic config_init callback also for KSZ8021 and KSZ8031. This has been avoided this far due to commit b838b4aced99 ("phy/micrel: KSZ8031RNL RMII clock reconfiguration bug"), which claims that the PHY becomes unresponsive if the broadcast-disable flag is set before configuring the clock mode. Turns out that the problem seemingly worked-around by the above mentioned commit was really due to a hardware-configuration issue, where the PHY was in fact strapped to address 3 rather than 0. Tested-by: Bruno Thomsen <bth@kamstrup.dk> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 December 2014, 21:19:50 UTC |
| 2c26d34 | Jay Vosburgh | 19 December 2014, 23:32:00 UTC | net/core: Handle csum for CHECKSUM_COMPLETE VXLAN forwarding When using VXLAN tunnels and a sky2 device, I have experienced checksum failures of the following type: [ 4297.761899] eth0: hw csum failure [...] [ 4297.765223] Call Trace: [ 4297.765224] <IRQ> [<ffffffff8172f026>] dump_stack+0x46/0x58 [ 4297.765235] [<ffffffff8162ba52>] netdev_rx_csum_fault+0x42/0x50 [ 4297.765238] [<ffffffff8161c1a0>] ? skb_push+0x40/0x40 [ 4297.765240] [<ffffffff8162325c>] __skb_checksum_complete+0xbc/0xd0 [ 4297.765243] [<ffffffff8168c602>] tcp_v4_rcv+0x2e2/0x950 [ 4297.765246] [<ffffffff81666ca0>] ? ip_rcv_finish+0x360/0x360 These are reliably reproduced in a network topology of: container:eth0 == host(OVS VXLAN on VLAN) == bond0 == eth0 (sky2) -> switch When VXLAN encapsulated traffic is received from a similarly configured peer, the above warning is generated in the receive processing of the encapsulated packet. Note that the warning is associated with the container eth0. The skbs from sky2 have ip_summed set to CHECKSUM_COMPLETE, and because the packet is an encapsulated Ethernet frame, the checksum generated by the hardware includes the inner protocol and Ethernet headers. The receive code is careful to update the skb->csum, except in __dev_forward_skb, as called by dev_forward_skb. __dev_forward_skb calls eth_type_trans, which in turn calls skb_pull_inline(skb, ETH_HLEN) to skip over the Ethernet header, but does not update skb->csum when doing so. This patch resolves the problem by adding a call to skb_postpull_rcsum to update the skb->csum after the call to eth_type_trans. Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 26 December 2014, 21:16:51 UTC |
| 45db073 | John David Anglin | 14 December 2014, 15:49:11 UTC | parisc: fix out-of-register compiler error in ldcw inline assembler function The __ldcw macro has a problem when its argument needs to be reloaded from memory. The output memory operand and the input register operand both need to be reloaded using a register in class R1_REGS when generating 64-bit code. This fails because there's only a single register in the class. Instead, use a memory clobber. This also makes the __ldcw macro a compiler memory barrier. Signed-off-by: John David Anglin <dave.anglin@bell.net> Cc: <stable@vger.kernel.org> [3.13+] Signed-off-by: Helge Deller <deller@gmx.de> | 26 December 2014, 16:47:01 UTC |
| d679582 | Libin Yang | 19 December 2014, 00:44:31 UTC | ALSA: hda_intel: apply the Seperate stream_tag for Skylake The total stream number of Skylake's input and output stream exceeds 15, which will cause some streams do not work because of the overflow on SDxCTL.STRM field if using the legacy stream tag allocation method. This patch uses the new stream tag allocation method by add the flag AZX_DCAPS_SEPARATE_STREAM_TAG for Skylake platform. Signed-off-by: Libin Yang <libin.yang@intel.com> Reviewed-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> | 26 December 2014, 11:21:31 UTC |
| 93e3423 | Rafal Redzimski | 19 December 2014, 00:44:30 UTC | ALSA: hda_controller: Separate stream_tag for input and output streams. Implemented separate stream_tag assignment for input and output streams. According to hda specification stream tag must be unique throughout the input streams group, however an output stream might use a stream tag which is already in use by an input stream. This change is necessary to support HW which provides a total of more than 15 stream DMA engines which with legacy implementation causes an overflow on SDxCTL.STRM field (and the whole SDxCTL register) and as a result usage of Reserved value 0 in the SDxCTL.STRM field which confuses HDA controller. Signed-off-by: Rafal Redzimski <rafal.f.redzimski@intel.com> Signed-off-by: Jayachandran B <jayachandran.b@intel.com> Signed-off-by: Libin Yang <libin.yang@intel.com> Reviewed-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> | 26 December 2014, 11:21:21 UTC |
| 08b022a | Linus Torvalds | 26 December 2014, 00:04:15 UTC | Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "Xmas fixes pull: core: one atomic fix, revert the WARN_ON dumb buffers patch. agp: fixup Dave J. nouveau: fix 3.18 regression for old userspace tegra fixes: vblank and iommu fixes amdkfd: fix bugs shown by testing with userspace, init apertures once msm: hdmi fixes and cleanup i915: misc fixes There is also a link ordering fix that I've asked to be cc'ed to you, putting iommu before gpu, it fixes an issue with amdkfd when things are all in the kernel, but I didn't like sending it via my tree without discussion. I'll probably be a bit on/off for a few weeks with pulls now, due to holidays and LCA, so don't be surprised if stuff gets a bit backed up, and things end up a bit large due to lag" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (28 commits) Revert "drm/gem: Warn on illegal use of the dumb buffer interface v2" agp: Fix up email address & attributions in AGP MODULE_AUTHOR tags nouveau: bring back legacy mmap handler drm/msm/hdmi: rework HDMI IRQ handler drm/msm/hdmi: enable regulators before clocks to avoid warnings drm/msm/mdp5: update irqs on crtc<->encoder link change drm/msm: block incoming update on pending updates drm/atomic: fix potential null ptr on plane enable drm/msm: Deletion of unnecessary checks before the function call "release_firmware" drm/msm: Deletion of unnecessary checks before two function calls drm/tegra: dc: Select root window for event dispatch drm/tegra: gem: Use the proper size for GEM objects drm/tegra: gem: Flush buffer objects upon allocation drm/tegra: dc: Fix a potential race on page-flip completion drm/tegra: dc: Consistently use the same pipe drm/irq: Add drm_crtc_vblank_count() drm/irq: Add drm_crtc_handle_vblank() drm/irq: Add drm_crtc_send_vblank_event() drm/i915: Disable PSMI sleep messages on all rings around context switches drm/i915: Force the CS stall for invalidate flushes ... | 26 December 2014, 00:04:15 UTC |
| ebda37c | Linus Torvalds | 25 December 2014, 23:56:34 UTC | Merge tag 'for-linus-2' of git://git.code.sf.net/p/openipmi/linux-ipmi Pull ipmi driver bugfixes from Corey Minyard: "Fix two bugs: One that lockdep turned up, I didn't go far enough with cleanup of attributes for IPMI. This has been there a long time; my previous fix of this didn't fix all the attributes. One fix for some arches that need an explicit linux/ctype.h for isspace()" * tag 'for-linus-2' of git://git.code.sf.net/p/openipmi/linux-ipmi: ipmi: Fix compile issue with isspace() ipmi: Finish cleanup of BMC attributes | 25 December 2014, 23:56:34 UTC |
| 4aa6118 | Wu Fengguang | 24 December 2014, 06:41:39 UTC | openvswitch: fix odd_ptr_err.cocci warnings net/openvswitch/vport-gre.c:188:5-11: inconsistent IS_ERR and PTR_ERR, PTR_ERR on line 189 PTR_ERR should access the value just tested by IS_ERR Semantic patch information: There can be false positives in the patch case, where it is the call IS_ERR that is wrong. Generated by: scripts/coccinelle/tests/odd_ptr_err.cocci CC: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Acked-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 20:18:09 UTC |
| 6a8fc95 | Johan Hedberg | 24 December 2014, 18:43:11 UTC | Bluetooth: Fix accepting connections when not using mgmt When connectable mode is enabled (page scan on) through some non-mgmt method the HCI_CONNECTABLE flag will not be set. For backwards compatibility with user space versions not using mgmt we should not require HCI_CONNECTABLE to be set if HCI_MGMT is not set. Reported-by: Pali Rohár <pali.rohar@gmail.com> Tested-by: Pali Rohár <pali.rohar@gmail.com> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Cc: stable@vger.kernel.org # 3.17+ | 24 December 2014, 19:02:00 UTC |
| 8bfe844 | Marcel Holtmann | 23 December 2014, 22:10:48 UTC | Bluetooth: Fix controller configuration with HCI_QUIRK_INVALID_BDADDR When controllers set the HCI_QUIRK_INVALID_BDADDR flag, it is required by userspace to program a valid public Bluetooth device address into the controller before it can be used. After successful address configuration, the internal state changes and the controller runs the complete initialization procedure. However one small difference is that this is no longer the HCI_SETUP stage. The HCI_SETUP stage is only valid during initial controller setup. In this case the stack runs the initialization as part of the HCI_CONFIG stage. The controller version information, default name and supported commands are only stored during HCI_SETUP. While these information are static, they are not read initially when HCI_QUIRK_INVALID_BDADDR is set. So when running in HCI_CONFIG state, these information need to be updated as well. This especially impacts Bluetooth 4.1 and later controllers using extended feature pages and second event mask page. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Cc: stable@vger.kernel.org # 3.17+ | 24 December 2014, 18:35:46 UTC |
| 8975842 | Mika Westerberg | 23 December 2014, 14:48:32 UTC | brcmfmac: Do not crash if platform data is not populated The driver looks for pdata->oob_irq_supported to find out if wowl can be supported. However, not all platforms populate pdata in which case we crash the kernel because of NULL pointer dereference. Fixes: 330b4e4be937 ("brcmfmac: Add wowl support for SDIO devices.") Reported-by: Christophe Prigent <christophe.prigent@intel.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> | 24 December 2014, 13:26:46 UTC |
| dddd602 | Paul Bolle | 22 December 2014, 18:10:17 UTC | ipw2200: select CFG80211_WEXT Commit 24a0aa212ee2 ("cfg80211: make WEXT compatibility unselectable") made it impossible to depend on CFG80211_WEXT. It does still allow to select that symbol. (Yes, the commit summary is confusing.) So make IPW2200 select CFG80211_WEXT, so that the ipw2200 driver can be enabled in config again. Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> | 24 December 2014, 13:15:25 UTC |
| ee4629f | Mark Brown | 24 December 2014, 12:57:54 UTC | Merge remote-tracking branches 'spi/fix/img-spfi' and 'spi/fix/msiof' into spi-linus | 24 December 2014, 12:57:54 UTC |
| 76fe5e9 | Andrew Bresticker | 22 December 2014, 19:35:15 UTC | spi: img-spfi: Increase DMA burst size A 1-byte burst size is rather inefficient and has been shown to cause TX issues during testing. Increase the DMA burst size to 4-bytes for both RX and TX DMA when using the 8-bit FIFO. Signed-off-by: Andrew Bresticker <abrestic@chromium.org> Signed-off-by: Mark Brown <broonie@kernel.org> | 24 December 2014, 12:20:03 UTC |
| b8fb4e0 | Thomas Graf | 23 December 2014, 00:13:18 UTC | net: Reset secmark when scrubbing packet skb_scrub_packet() is called when a packet switches between a context such as between underlay and overlay, between namespaces, or between L3 subnets. While we already scrub the packet mark, connection tracking entry, and cached destination, the security mark/context is left intact. It seems wrong to inherit the security context of a packet when going from overlay to underlay or across forwarding paths. Signed-off-by: Thomas Graf <tgraf@suug.ch> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 05:21:43 UTC |
| 796f2da | Toshiaki Makita | 22 December 2014, 10:04:14 UTC | net: Fix stacked vlan offload features computation When vlan tags are stacked, it is very likely that the outer tag is stored in skb->vlan_tci and skb->protocol shows the inner tag's vlan_proto. Currently netif_skb_features() first looks at skb->protocol even if there is the outer tag in vlan_tci, thus it incorrectly retrieves the protocol encapsulated by the inner vlan instead of the inner vlan protocol. This allows GSO packets to be passed to HW and they end up being corrupted. Fixes: 58e998c6d239 ("offloading: Force software GSO for multiple vlan tags.") Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 05:08:33 UTC |
| e51a08b | David S. Miller | 24 December 2014, 04:57:38 UTC | Merge branch 'openvswitch-net' Pravin B Shelar says: ==================== openvswitch: datapath fixes Following patch series is mostly targeted to MPLS fixes. other patches are related datapth transmit path error handling. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:57:38 UTC |
| 74f4727 | Pravin B Shelar | 24 December 2014, 00:20:36 UTC | vxlan: Fix double free of skb. In case of error vxlan_xmit_one() can free already freed skb. Also fixes memory leak of dst-entry. Fixes: acbf74a7630 ("vxlan: Refactor vxlan driver to make use of the common UDP tunnel functions"). Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:57:31 UTC |
| 997e068 | Pravin B Shelar | 24 December 2014, 00:20:32 UTC | openvswitch: Fix vport_send double free Today vport-send has complex error handling because it involves freeing skb and updating stats depending on return value from vport send implementation. This can be simplified by delegating responsibility of freeing skb to the vport implementation for all cases. So that vport-send needs just update stats. Fixes: 91b7514cdf ("openvswitch: Unify vport error stats handling") Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:57:31 UTC |
| cbe7e76 | Pravin B Shelar | 24 December 2014, 00:20:28 UTC | openvswitch: Fix GSO with multiple MPLS label. MPLS GSO needs to know inner most protocol to process GSO packets. Fixes: 25cd9ba0abc ("openvswitch: Add basic MPLS support to kernel"). Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:57:31 UTC |
| ec449f4 | Pravin B Shelar | 24 December 2014, 00:20:20 UTC | openvswitch: Fix MPLS action validation. Linux stack does not implement GSO for packet with multiple encapsulations. Therefore there was check in MPLS action validation to detect such case, But this check introduced bug which deleted one or more actions from actions list. Following patch removes this check to fix the validation. Fixes: 25cd9ba0abc ("openvswitch: Add basic MPLS support to kernel"). Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Reported-by: Srinivas Neginhal <sneginha@vmware.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:57:31 UTC |
| 4cc1bec | Pravin B Shelar | 24 December 2014, 00:20:16 UTC | mpls: Fix allowed protocols for mpls gso MPLS and Tunnel GSO does not work together. Reject packet which request such GSO. Fixes: 0d89d2035f ("MPLS: Add limited GSO support"). Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:57:31 UTC |
| d0edc7b | Pravin B Shelar | 24 December 2014, 00:20:11 UTC | mpls: Fix config check for mpls. Fixes MPLS GSO for case when mpls is compiled as kernel module. Fixes: 0d89d2035f ("MPLS: Add limited GSO support"). Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:57:30 UTC |
| ceb8d5b | Herbert Xu | 20 December 2014, 20:16:25 UTC | net: Rearrange loop in net_rx_action This patch rearranges the loop in net_rx_action to reduce the amount of jumping back and forth when reading the code. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:20:21 UTC |
| 6bd373e | Herbert Xu | 20 December 2014, 20:16:24 UTC | net: Always poll at least one device in net_rx_action We should only perform the softnet_break check after we have polled at least one device in net_rx_action. Otherwise a zero or negative setting of netdev_budget can lock up the whole system. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:20:21 UTC |
| 001ce54 | Herbert Xu | 20 December 2014, 20:16:22 UTC | net: Detect drivers that reschedule NAPI and exhaust budget The commit d75b1ade567ffab085e8adbbdacf0092d10cd09c (net: less interrupt masking in NAPI) required drivers to leave poll_list empty if the entire budget is consumed. We have already had two broken drivers so let's add a check for this. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:20:21 UTC |
| 726ce70 | Herbert Xu | 20 December 2014, 20:16:21 UTC | net: Move napi polling code out of net_rx_action This patch creates a new function napi_poll and moves the napi polling code from net_rx_action into it. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:20:21 UTC |
| 0d16449 | Antonio Quartulli | 20 December 2014, 12:48:57 UTC | batman-adv: avoid NULL dereferences and fix if check Gateway having bandwidth_down equal to zero are not accepted at all and so never added to the Gateway list. For this reason checking the bandwidth_down member in batadv_gw_out_of_range() is useless. This is probably a copy/paste error and this check was supposed to be "!gw_node" only. Moreover, the way the check is written now may also lead to a NULL dereference. Fix this by rewriting the if-condition properly. Introduced by 414254e342a0d58144de40c3da777521ebaeeb07 ("batman-adv: tvlv - gateway download/upload bandwidth container") Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> Reported-by: David Binderman <dcb314@hotmail.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:13:37 UTC |
| 0402e44 | Sven Eckelmann | 20 December 2014, 12:48:56 UTC | batman-adv: Unify fragment size calculation The fragmentation code was replaced in 610bfc6bc99bc83680d190ebc69359a05fc7f605 ("batman-adv: Receive fragmented packets and merge") by an implementation which can handle up to 16 fragments of a packet. The packet is prepared for the split in fragments by the function batadv_frag_send_packet and the actual split is done by batadv_frag_create. Both functions calculate the size of a fragment themself. But their calculation differs because batadv_frag_send_packet also subtracts ETH_HLEN. Therefore, the check in batadv_frag_send_packet "can a full fragment can be created?" may return true even when batadv_frag_create cannot create a full fragment. The function batadv_frag_create doesn't check the size of the skb before splitting it and therefore might try to create a larger fragment than the remaining buffer. This creates an integer underflow and an invalid len is given to skb_split. Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: David S. Miller <davem@davemloft.net> | 24 December 2014, 04:13:37 UTC |
