| b5c37fe | Daniel Borkmann | 08 February 2013, 03:04:35 UTC | net: sctp: sctp_endpoint_free: zero out secret key data On sctp_endpoint_destroy, previously used sensitive keying material should be zeroed out before the memory is returned, as we already do with e.g. auth keys when released. Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Acked-by: Vlad Yasevich <vyasevic@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 19:54:24 UTC |
| 6ba542a | Daniel Borkmann | 08 February 2013, 03:04:34 UTC | net: sctp: sctp_setsockopt_auth_key: use kzfree instead of kfree In sctp_setsockopt_auth_key, we create a temporary copy of the user passed shared auth key for the endpoint or association and after internal setup, we free it right away. Since it's sensitive data, we should zero out the key before returning the memory back to the allocator. Thus, use kzfree instead of kfree, just as we do in sctp_auth_key_put(). Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 19:54:24 UTC |
| ab54ee8 | Heiko Carstens | 08 February 2013, 00:19:11 UTC | atm/iphase: rename fregt_t -> ffreg_t We have conflicting type qualifiers for "freg_t" in s390's ptrace.h and the iphase atm device driver, which causes the compile error below. Unfortunately the s390 typedef can't be renamed, since it's a user visible api, nor can I change the include order in s390 code to avoid the conflict. So simply rename the iphase typedef to a new name. Fixes this compile error: In file included from drivers/atm/iphase.c:66:0: drivers/atm/iphase.h:639:25: error: conflicting type qualifiers for 'freg_t' In file included from next/arch/s390/include/asm/ptrace.h:9:0, from next/arch/s390/include/asm/lowcore.h:12, from next/arch/s390/include/asm/thread_info.h:30, from include/linux/thread_info.h:54, from include/linux/preempt.h:9, from include/linux/spinlock.h:50, from include/linux/seqlock.h:29, from include/linux/time.h:5, from include/linux/stat.h:18, from include/linux/module.h:10, from drivers/atm/iphase.c:43: next/arch/s390/include/uapi/asm/ptrace.h:197:3: note: previous declaration of 'freg_t' was here Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Acked-by: chas williams - CONTRACTOR <chas@cmf.nrl.navy.mil> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 19:22:05 UTC |
| 9c79330 | Lucas Stach | 07 February 2013, 16:18:39 UTC | net: usb: fix regression from FLAG_NOARP code In commit 6509141f9c2ba74df6cc72ec35cd1865276ae3a4 ("usbnet: add new flag FLAG_NOARP for usb net devices"), the newly added flag NOARP was using an already defined value, which broke drivers using flag MULTI_PACKET. Signed-off-by: Lucas Stach <dev@lynxeye.de> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 06:49:49 UTC |
| 87c084a | Eric Dumazet | 07 February 2013, 14:00:34 UTC | l2tp: dont play with skb->truesize Andrew Savchenko reported a DNS failure and we diagnosed that some UDP sockets were unable to send more packets because their sk_wmem_alloc was corrupted after a while (tx_queue column in following trace) $ cat /proc/net/udp sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode ref pointer drops ... 459: 00000000:0270 00000000:0000 07 00000000:00000000 00:00000000 00000000 0 0 4507 2 ffff88003d612380 0 466: 00000000:0277 00000000:0000 07 00000000:00000000 00:00000000 00000000 0 0 4802 2 ffff88003d613180 0 470: 076A070A:007B 00000000:0000 07 FFFF4600:00000000 00:00000000 00000000 123 0 5552 2 ffff880039974380 0 470: 010213AC:007B 00000000:0000 07 00000000:00000000 00:00000000 00000000 0 0 4986 2 ffff88003dbd3180 0 470: 010013AC:007B 00000000:0000 07 00000000:00000000 00:00000000 00000000 0 0 4985 2 ffff88003dbd2e00 0 470: 00FCA8C0:007B 00000000:0000 07 FFFFFB00:00000000 00:00000000 00000000 0 0 4984 2 ffff88003dbd2a80 0 ... Playing with skb->truesize is tricky, especially when skb is attached to a socket, as we can fool memory charging. Just remove this code, its not worth trying to be ultra precise in xmit path. Reported-by: Andrew Savchenko <bircoph@gmail.com> Tested-by: Andrew Savchenko <bircoph@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 06:49:49 UTC |
| 586c31f | Daniel Borkmann | 07 February 2013, 00:55:37 UTC | net: sctp: sctp_auth_key_put: use kzfree instead of kfree For sensitive data like keying material, it is common practice to zero out keys before returning the memory back to the allocator. Thus, use kzfree instead of kfree. Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Vlad Yasevich <vyasevich@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 04:43:42 UTC |
| 6cddded | David S. Miller | 08 February 2013, 04:37:36 UTC | Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jesse/openvswitch into openvswitch Jesse Gross says: ==================== One bug fix for net/3.8 for a long standing problem that was reported a few times recently. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 04:37:36 UTC |
| 0c35565 | David S. Miller | 08 February 2013, 04:31:47 UTC | Merge branch 'netback' Ian Campbell says: ==================== The Xen netback implementation contains a couple of flaws which can allow a guest to cause a DoS in the backend domain, potentially affecting other domains in the system. CVE-2013-0216 is a failure to sanity check the ring producer/consumer pointers which can allow a guest to cause netback to loop for an extended period preventing other work from occurring. CVE-2013-0217 is a memory leak on an error path which is guest triggerable. The following series contains the fixes for these issues, as previously included in Xen Security Advisory 39: http://lists.xen.org/archives/html/xen-announce/2013-02/msg00001.html Changes in v2: - Typo and block comment format fixes - Added stable Cc ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 04:31:47 UTC |
| b914972 | Ian Campbell | 06 February 2013, 23:41:38 UTC | netback: correct netbk_tx_err to handle wrap around. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Jan Beulich <JBeulich@suse.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 04:29:29 UTC |
| 4cc7c1c | Ian Campbell | 06 February 2013, 23:41:37 UTC | xen/netback: free already allocated memory on failure in xen_netbk_get_requests Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 04:29:28 UTC |
| 7d5145d | Matthew Daley | 06 February 2013, 23:41:36 UTC | xen/netback: don't leak pages on failure in xen_netbk_tx_check_gop. Signed-off-by: Matthew Daley <mattjd@gmail.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Jan Beulich <JBeulich@suse.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 04:29:28 UTC |
| 4885628 | Ian Campbell | 06 February 2013, 23:41:35 UTC | xen/netback: shutdown the ring if it contains garbage. A buggy or malicious frontend should not be able to confuse netback. If we spot anything which is not as it should be then shutdown the device and don't try to continue with the ring in a potentially hostile state. Well behaved and non-hostile frontends will not be penalised. As well as making the existing checks for such errors fatal also add a new check that ensures that there isn't an insane number of requests on the ring (i.e. more than would fit in the ring). If the ring contains garbage then previously is was possible to loop over this insane number, getting an error each time and therefore not generating any more pending requests and therefore not exiting the loop in xen_netbk_tx_build_gops for an externded period. Also turn various netdev_dbg calls which no precipitate a fatal error into netdev_err, they are rate limited because the device is shutdown afterwards. This fixes at least one known DoS/softlockup of the backend domain. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Acked-by: Jan Beulich <JBeulich@suse.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 08 February 2013, 04:29:28 UTC |
| e21b9d0 | Bjørn Mork | 06 February 2013, 05:22:08 UTC | net: qmi_wwan: add more Huawei devices, including E320 Adding new class/subclass/protocol combinations based on the GPLed out-of-tree Huawei driver. One of these has already appeared on a device labelled as "E320". Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 February 2013, 21:09:40 UTC |
| 96316c5 | Bjørn Mork | 06 February 2013, 05:21:53 UTC | net: cdc_ncm: add another Huawei vendor specific device Adding a new vendor specific class/subclass/protocol combination for CDC NCM devices based on information from a GPLed out-of-tree driver from Huawei. Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 February 2013, 21:09:40 UTC |
| 41ab3e3 | Tommi Rantala | 06 February 2013, 03:24:02 UTC | ipv6/ip6_gre: fix error case handling in ip6gre_tunnel_xmit() ip6gre_tunnel_xmit() is leaking the skb when we hit this error branch, and the -1 return value from this function is bogus. Use the error handling we already have in place in ip6gre_tunnel_xmit() for this error case to fix this. Signed-off-by: Tommi Rantala <tt.rantala@gmail.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 February 2013, 21:02:05 UTC |
| 6731d20 | Ilpo Järvinen | 04 February 2013, 02:14:25 UTC | tcp: fix for zero packets_in_flight was too broad There are transients during normal FRTO procedure during which the packets_in_flight can go to zero between write_queue state updates and firing the resulting segments out. As FRTO processing occurs during that window the check must be more precise to not match "spuriously" :-). More specificly, e.g., when packets_in_flight is zero but FLAG_DATA_ACKED is true the problematic branch that set cwnd into zero would not be taken and new segments might be sent out later. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Tested-by: Eric Dumazet <edumazet@google.com> Acked-by: Neal Cardwell <ncardwell@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 06 February 2013, 20:53:03 UTC |
| b6ec447 | David S. Miller | 06 February 2013, 19:51:14 UTC | Merge branch 'wireless' John W. Linville says: ==================== Please consider this pull request for the 3.8 stream... Included is a bluetooth pull. Gustavo says: "Two simple fixes for 3.8. One of the patches fixes a situation where the connection wasn't terminated if a timeout ocurrs for LE an SCO connections. The other fixes prevent NULL dereference in the SMP code, it is a security fix as well." Along with those... Hauke Mehrtens provides a couple of ssb and bcma bus fixes that prevent oopses when unloading those modules. Larry Finger provides and rtlwifi fix to avoid a "scheduling while atomic" bug. Last but certainly not least, Arend van Spriel bring a brcmsmac fix that reworks the mac80211 .flush() callback in order to avoid the dreaded brcms_c_wait_for_tx_completion warnings. This one looks a little large, but I think it is safe and isolated to brcmsmac in any case. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 06 February 2013, 19:51:14 UTC |
| b3b66ae | John W. Linville | 06 February 2013, 18:55:44 UTC | Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem | 06 February 2013, 18:55:44 UTC |
| 7b2385b | Arend van Spriel | 02 February 2013, 13:36:50 UTC | brcmsmac: rework of mac80211 .flush() callback operation This patch addresses a long standing issue of the driver with the mac80211 .flush() callback. Since implementing the .flush() callback a number of issues have been fixed, but a WARN_ON_ONCE() was still triggered because the timeout on the flush could still occur. This patch changes the awkward design using msleep() into one using a waitqueue. The waiting flush() context will kick the transmit dma when it is idle and the timeout used waiting for the event is set to 500 ms. Worst case there can be 64 frames outstanding for transmit in the driver. At a rate of 1Mbps that would take 1.5 seconds assuming MTU is 1500 bytes and ignoring retries. The WARN_ON_ONCE() is also removed as this was put in to indicate the flush timeout as a reason for the driver to stall. That was not happening since fixing endless AMPDU retries with following upstream commit: commit 85091fc0a75653e239dc8379658515e577544927 Author: Arend van Spriel <arend@broadcom.com> Date: Thu Feb 23 18:38:22 2012 +0100 brcm80211: smac: fix endless retry of A-MPDU transmissions bugzilla: 42840 <https://bugzilla.kernel.org/show_bug.cgi?id=42840> bugzilla@redhat: <https://bugzilla.redhat.com/show_bug.cgi?id=799168> bugzilla@redhat: <https://bugzilla.redhat.com/show_bug.cgi?id=787649> Cc: Jonathan Nieder <jrnieder@gmail.com> Cc: Stanislaw Gruszka <sgruszka@redhat.com> Cc: Camaleón <noelamac@gmail.com> Cc: Milan Bouchet-Valat <nalimilan@club-internet.fr> Cc: Seth Forshee <seth.forshee@canonical.com> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com> Reviewed-by: Hante Meuleman <meuleman@broadcom.com> Reviewed-by: Piotr Haber <phaber@broadcom.com> Signed-off-by: Arend van Spriel <arend@broadcom.com> Acked-by: Seth Forshee <seth.forshee@canonical.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> | 04 February 2013, 21:46:28 UTC |
| 600485e | Hauke Mehrtens | 03 February 2013, 22:25:34 UTC | ssb: unregister gpios before unloading ssb This patch unregisters the gpio chip before ssb gets unloaded. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: John W. Linville <linville@tuxdriver.com> | 04 February 2013, 21:46:24 UTC |
| c50ae94 | Hauke Mehrtens | 03 February 2013, 22:25:33 UTC | bcma: unregister gpios before unloading bcma This patch unregisters the gpio chip before bcma gets unloaded. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Reported-by: Piotr Haber <phaber@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> | 04 February 2013, 21:46:24 UTC |
| a5ffbe0 | Larry Finger | 02 February 2013, 21:55:00 UTC | rtlwifi: Fix scheduling while atomic bug Kernel commits 41affd5 and 6539306 changed the locking in rtl_lps_leave() from a spinlock to a mutex by doing the calls indirectly from a work queue to reduce the time that interrupts were disabled. This change was fine for most systems; however a scheduling while atomic bug was reported in https://bugzilla.redhat.com/show_bug.cgi?id=903881. The backtrace indicates that routine rtl_is_special(), which calls rtl_lps_leave() in three places was entered in atomic context. These direct calls are replaced by putting a request on the appropriate work queue. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Reported-and-tested-by: Nathaniel Doherty <ntdoherty@gmail.com> Cc: Nathaniel Doherty <ntdoherty@gmail.com> Cc: Stanislaw Gruszka <sgruszka@redhat.com> Cc: Stable <stable@vger.kernel.org> Signed-off-by: John W. Linville <linville@tuxdriver.com> | 04 February 2013, 21:41:56 UTC |
| 4c52d3d | John W. Linville | 04 February 2013, 21:40:07 UTC | Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth | 04 February 2013, 21:40:07 UTC |
| bf414b3 | Bjørn Mork | 31 January 2013, 08:36:05 UTC | net: usbnet: fix tx_dropped statistics It is normal for minidrivers accumulating frames to return NULL from their tx_fixup function. We do not want to count this as a drop, or log any debug messages. A different exit path is therefore chosen for such drivers, skipping the debug message and the tx_dropped increment. The test for accumulating drivers was however completely bogus, making the exit path selection depend on whether the user had enabled tx_err logging or not. This would arbitrarily mess up accounting for both accumulating and non-accumulating minidrivers, and would result in unwanted debug messages for the accumulating drivers. Fix by testing for FLAG_MULTI_PACKET instead, which probably was the intention from the beginning. This usage match the documented behaviour of this flag: Indicates to usbnet, that USB driver accumulates multiple IP packets. Affects statistic (counters) and short packet handling. Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net> | 04 February 2013, 18:07:31 UTC |
| 5f1e942 | Vijay Subramanian | 31 January 2013, 08:24:19 UTC | tcp: ipv6: Update MIB counters for drops This patch updates LINUX_MIB_LISTENDROPS and LINUX_MIB_LISTENOVERFLOWS in tcp_v6_conn_request() and tcp_v6_err(). tcp_v6_conn_request() in particular can drop SYNs for various reasons which are not currently tracked. Signed-off-by: Vijay Subramanian <subramanian.vijay@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 04 February 2013, 18:06:27 UTC |
| 848bf15 | Vijay Subramanian | 31 January 2013, 08:24:06 UTC | tcp: Update MIB counters for drops This patch updates LINUX_MIB_LISTENDROPS in tcp_v4_conn_request() and tcp_v4_err(). tcp_v4_conn_request() in particular can drop SYNs for various reasons which are not currently tracked. Signed-off-by: Vijay Subramanian <subramanian.vijay@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 04 February 2013, 18:06:27 UTC |
| 9665d5d | Phil Sutter | 01 February 2013, 07:21:41 UTC | packet: fix leakage of tx_ring memory When releasing a packet socket, the routine packet_set_ring() is reused to free rings instead of allocating them. But when calling it for the first time, it fills req->tp_block_nr with the value of rb->pg_vec_len which in the second invocation makes it bail out since req->tp_block_nr is greater zero but req->tp_block_size is zero. This patch solves the problem by passing a zeroed auto-variable to packet_set_ring() upon each invocation from packet_release(). As far as I can tell, this issue exists even since 69e3c75 (net: TX_RING and packet mmap), i.e. the original inclusion of TX ring support into af_packet, but applies only to sockets with both RX and TX ring allocated, which is probably why this was unnoticed all the time. Signed-off-by: Phil Sutter <phil.sutter@viprinet.com> Cc: Johann Baudy <johann.baudy@gnu-log.net> Cc: Daniel Borkmann <dborkman@redhat.com> Acked-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 03 February 2013, 21:15:23 UTC |
| 92df9b2 | Pravin B Shelar | 01 February 2013, 15:18:49 UTC | net: Fix inner_network_header assignment in skb-copy. Use correct inner offset to set inner_network_offset. Found by inspection. Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 03 February 2013, 21:10:36 UTC |
| 2e5f421 | Eric Dumazet | 03 February 2013, 09:13:05 UTC | tcp: frto should not set snd_cwnd to 0 Commit 9dc274151a548 (tcp: fix ABC in tcp_slow_start()) uncovered a bug in FRTO code : tcp_process_frto() is setting snd_cwnd to 0 if the number of in flight packets is 0. As Neal pointed out, if no packet is in flight we lost our chance to disambiguate whether a loss timeout was spurious. We should assume it was a proper loss. Reported-by: Pasi Kärkkäinen <pasik@iki.fi> Signed-off-by: Neal Cardwell <ncardwell@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Cc: Yuchung Cheng <ycheng@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 03 February 2013, 21:00:25 UTC |
| 973ec44 | Eric Dumazet | 02 February 2013, 05:23:16 UTC | tcp: fix an infinite loop in tcp_slow_start() Since commit 9dc274151a548 (tcp: fix ABC in tcp_slow_start()), a nul snd_cwnd triggers an infinite loop in tcp_slow_start() Avoid this infinite loop and log a one time error for further analysis. FRTO code is suspected to cause this bug. Reported-by: Pasi Kärkkäinen <pasik@iki.fi> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Neal Cardwell <ncardwell@google.com> Cc: Yuchung Cheng <ycheng@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 03 February 2013, 21:00:25 UTC |
| 59fa534 | David S. Miller | 03 February 2013, 04:09:32 UTC | Merge branch 'fixes-for-3.8' of git://gitorious.org/linux-can/linux-can Marc Kleine-Budde says: ==================== here's a patch for net for the v3.8 release cycle. Alexander Stein noticed that the c_can hardware has a fixed bit in the IFx_MASK2 register. His patch fixes writing of this register by always setting this bit. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 03 February 2013, 04:09:32 UTC |
| 559bcac | David S. Miller | 30 January 2013, 03:58:04 UTC | via-rhine: Fix bugs in NAPI support. 1) rhine_tx() should use dev_kfree_skb() not dev_kfree_skb_irq() 2) rhine_slow_event_task's NAPI triggering logic is racey, it should just hit the interrupt mask register. This is the same as commit 7dbb491878a2c51d372a8890fa45a8ff80358af1 ("r8169: avoid NAPI scheduling delay.") made to fix the same problem in the r8169 driver. From Francois Romieu. Reported-by: Jamie Gloudon <jamie.gloudon@gmail.com> Tested-by: Jamie Gloudon <jamie.gloudon@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 03 February 2013, 03:58:25 UTC |
| 9165bf2 | David S. Miller | 01 February 2013, 19:50:16 UTC | Merge branch 'wireless' John W. Linville says: ==================== This is a small batch of fixes intended for the 3.8 stream... There are two pulls from Johannes. Regarding mac80211, Johannes says: "One fix from Dan for a possible memory overrun." Regarding iwlwifi, Johannes says: "I have one fix from Emmanuel reverting a previous fix that caused more trouble than it's worth." Along with those: Arend van Spriel fixes a fatal error in brcsmac related to tx status processing. Bing Zhao corrects a problem where mwifiex would fail to complete a scan in the event of an IE processing error. Larry Finger fixes a thinko in rtlwifi in which the wrong skb variable was being used in some cases. Rafał Miłecki fixes a thinko in an ID check in the bcma flash code. ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 01 February 2013, 19:50:16 UTC |
| ed6882a | John W. Linville | 01 February 2013, 18:43:25 UTC | Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem | 01 February 2013, 18:43:25 UTC |
| 2bd3bc4 | Alexander Stein | 13 December 2012, 09:06:10 UTC | can: c_can: Set reserved bit in IFx_MASK2 to 1 on write According to C_CAN documentation, the reserved bit in IFx_MASK2 register is fixed 1. Cc: linux-stable <stable@vger.kernel.org> Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> | 01 February 2013, 09:20:22 UTC |
| 66555e9 | Yuchung Cheng | 31 January 2013, 19:16:46 UTC | tcp: detect SYN/data drop when F-RTO is disabled On receiving the SYN-ACK, Fast Open checks icsk_retransmit for SYN retransmission to detect SYN/data drops. But if F-RTO is disabled, icsk_retransmit is reset at step D of tcp_fastretrans_alert() ( under tcp_ack()) before tcp_rcv_fastopen_synack(). The fix is to use total_retrans instead which accounts for SYN retransmission regardless the use of F-RTO. Signed-off-by: Yuchung Cheng <ycheng@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 January 2013, 19:20:07 UTC |
| 700163d | Tom Parkin | 31 January 2013, 01:02:26 UTC | l2tp: correctly handle ancillary data in the ip6 recv path l2tp_ip6 is incorrectly using the IPv4-specific ip_cmsg_recv to handle ancillary data. This means that socket options such as IPV6_RECVPKTINFO are not honoured in userspace. Convert l2tp_ip6 to use the IPv6-specific handler. Ref: net/ipv6/udp.c Signed-off-by: Tom Parkin <tparkin@katalix.com> Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: Chris Elston <celston@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 January 2013, 18:53:09 UTC |
| 8e72d37 | Tom Parkin | 31 January 2013, 01:02:25 UTC | ipv6: export ip6_datagram_recv_ctl ip6_datagram_recv_ctl and ip6_datagram_send_ctl are used for handling IPv6 ancillary data. Since ip6_datagram_send_ctl is already publicly exported for use in modules, ip6_datagram_recv_ctl should also be available to support ancillary data in the receive path. Signed-off-by: Tom Parkin <tparkin@katalix.com> Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 January 2013, 18:53:08 UTC |
| 73df66f | Tom Parkin | 31 January 2013, 01:02:24 UTC | ipv6: rename datagram_send_ctl and datagram_recv_ctl The datagram_*_ctl functions in net/ipv6/datagram.c are IPv6-specific. Since datagram_send_ctl is publicly exported it should be appropriately named to reflect the fact that it's for IPv6 only. Signed-off-by: Tom Parkin <tparkin@katalix.com> Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 January 2013, 18:53:08 UTC |
| 4c02e2d | Andre Guedes | 30 January 2013, 14:50:55 UTC | Bluetooth: Fix hci_conn timeout routine If occurs a LE or SCO hci_conn timeout and the connection is already established (BT_CONNECTED state), the connection is not terminated as expected. This bug can be reproduced using l2test or scotest tool. Once the connection is established, kill l2test/scotest and the connection won't be terminated. This patch fixes hci_conn_disconnect helper so it is able to terminate LE and SCO connections, as well as ACL. Signed-off-by: Andre Guedes <andre.guedes@openbossa.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> | 31 January 2013, 17:38:02 UTC |
| 8cf9fa1 | Johan Hedberg | 29 January 2013, 16:44:23 UTC | Bluetooth: Fix handling of unexpected SMP PDUs The conn->smp_chan pointer can be NULL if SMP PDUs arrive at unexpected moments. To avoid NULL pointer dereferences the code should be checking for this and disconnect if an unexpected SMP PDU arrives. This patch fixes the issue by adding a check for conn->smp_chan for all other PDUs except pairing request and security request (which are are the first PDUs to come to initialize the SMP context). Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> CC: stable@vger.kernel.org Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> | 31 January 2013, 17:35:42 UTC |
| 3d6d7ab | Daniele Palmas | 30 January 2013, 02:47:06 UTC | NET: qmi_wwan: add Telit LE920 support Add VID, PID and fixed interface for Telit LE920 Signed-off-by: Daniele Palmas <dnlplm@gmail.com> Acked-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 January 2013, 01:28:00 UTC |
| bd30e94 | Marcelo Ricardo Leitner | 29 January 2013, 22:26:08 UTC | ipv6: do not create neighbor entries for local delivery They will be created at output, if ever needed. This avoids creating empty neighbor entries when TPROXYing/Forwarding packets for addresses that are not even directly reachable. Note that IPv4 already handles it this way. No neighbor entries are created for local input. Tested by myself and customer. Signed-off-by: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 31 January 2013, 01:26:07 UTC |
| 70c37bf | Bjørn Mork | 28 January 2013, 23:51:28 UTC | net: usbnet: prevent buggy devices from killing us A device sending 0 length frames as fast as it can has been observed killing the host system due to the resulting memory pressure. Temporarily disable RX skb allocation and URB submission when the current error ratio is high, preventing us from trying to allocate an infinite number of skbs. Reenable as soon as we are finished processing the done queue, allowing the device to continue working after short error bursts. Signed-off-by: Bjørn Mork <bjorn@mork.no> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: David S. Miller <davem@davemloft.net> | 30 January 2013, 22:35:44 UTC |
| 8a7d7cb | Bing Zhao | 29 January 2013, 22:38:02 UTC | mwifiex: fix incomplete scan in case of IE parsing error A scan request is split into multiple scan commands queued in scan_pending_q. Each scan command will be sent to firmware and its response is handlded one after another. If any error is detected while parsing IE in command response buffer the remaining data will be ignored and error is returned. We should check if there is any more scan commands pending in the queue before returning error. This ensures that we will call cfg80211_scan_done if this is the last scan command, or send next scan command in scan_pending_q to firmware. Cc: "3.6+" <stable@vger.kernel.org> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> | 30 January 2013, 19:13:09 UTC |
| 6cdd20c | Neil Horman | 29 January 2013, 21:15:45 UTC | vmxnet3: set carrier state properly on probe vmxnet3 fails to set netif_carrier_off on probe, meaning that when an interface is opened the __LINK_STATE_NOCARRIER bit is already cleared, and so /sys/class/net/<ifname>/operstate remains in the unknown state. Correct this by setting netif_carrier_off on probe, like other drivers do. Also, while we're at it, lets remove the netif_carrier_ok checks from the link_state_update function, as that check is atomically contained within the netif_carrier_[on|off] functions anyway Tested successfully by myself Signed-off-by: Neil Horman <nhorman@tuxdriver.com> CC: "David S. Miller" <davem@davemloft.net> CC: "VMware, Inc." <pv-drivers@vmware.com> CC: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 21:29:22 UTC |
| 2860030 | Bruce Allan | 28 January 2013, 00:43:48 UTC | e1000e: enable ECC on I217/I218 to catch packet buffer memory errors In rare instances, memory errors have been detected in the internal packet buffer memory on I217/I218 when stressed under certain environmental conditions. Enable Error Correcting Code (ECC) in hardware to catch both correctable and uncorrectable errors. Correctable errors will be handled by the hardware. Uncorrectable errors in the packet buffer will cause the packet to be received with an error indication in the buffer descriptor causing the packet to be discarded. If the uncorrectable error is in the descriptor itself, the hardware will stop and interrupt the driver indicating the error. The driver will then reset the hardware in order to clear the error and restart. Both types of errors will be accounted for in statistics counters. Signed-off-by: Bruce Allan <bruce.w.allan@intel.com> Cc: <stable@vger.kernel.org> # 3.5.x & 3.6.x Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 21:01:33 UTC |
| eb492f7 | Milos Vyletel | 29 January 2013, 09:59:00 UTC | bonding: unset primary slave via sysfs When bonding module is loaded with primary parameter and one decides to unset primary slave using sysfs these settings are not preserved during bond device restart. Primary slave is only unset once and it's not remembered in bond->params structure. Below is example of recreation. grep OPTS /etc/sysconfig/network-scripts/ifcfg-bond0 BONDING_OPTS="mode=active-backup miimon=100 primary=eth01" grep "Primary Slave" /proc/net/bonding/bond0 Primary Slave: eth01 (primary_reselect always) echo "" > /sys/class/net/bond0/bonding/primary grep "Primary Slave" /proc/net/bonding/bond0 Primary Slave: None sed -i -e 's/primary=eth01//' /etc/sysconfig/network-scripts/ifcfg-bond0 grep OPTS /etc/sysconfig/network-scripts/ifcfg-bond BONDING_OPTS="mode=active-backup miimon=100 " ifdown bond0 && ifup bond0 without patch: grep "Primary Slave" /proc/net/bonding/bond0 Primary Slave: eth01 (primary_reselect always) with patch: grep "Primary Slave" /proc/net/bonding/bond0 Primary Slave: None Reviewed-by: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Milos Vyletel <milos.vyletel@sde.cz> Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 20:43:35 UTC |
| 2aeef18 | Nivedita Singhvi | 28 January 2013, 17:52:37 UTC | tcp: Increment LISTENOVERFLOW and LISTENDROPS in tcp_v4_conn_request() We drop a connection request if the accept backlog is full and there are sufficient packets in the syn queue to warrant starting drops. Increment the appropriate counters so this isn't silent, for accurate stats and help in debugging. This patch assumes LINUX_MIB_LISTENDROPS is a superset of/includes the counter LINUX_MIB_LISTENOVERFLOWS. Signed-off-by: Nivedita Singhvi <niv@us.ibm.com> Acked-by: Vijay Subramanian <subramanian.vijay@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 20:43:04 UTC |
| 5e98a36 | YOSHIFUJI Hideaki / 吉藤英明 | 28 January 2013, 10:44:29 UTC | ipv6 addrconf: Fix interface identifiers of 802.15.4 devices. The "Universal/Local" (U/L) bit must be complmented according to RFC4944 and RFC2464. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 20:43:04 UTC |
| 00d3d51 | Sarveshwar Bandi | 28 January 2013, 04:17:01 UTC | be2net: Updating Module Author string and log message string to "Emulex Corporation" Signed-off-by: Sarveshwar Bandi <sarveshwar.bandi@emulex.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 20:43:04 UTC |
| 9e85722 | Jason Wang | 28 January 2013, 01:05:19 UTC | tuntap: allow polling/writing/reading when detached We forbid polling, writing and reading when the file were detached, this may complex the user in several cases: - when guest pass some buffers to vhost/qemu and then disable some queues, host/qemu needs to do its own cleanup on those buffers which is complex sometimes. We can do this simply by allowing a user can still write to an disabled queue. Write to an disabled queue will cause the packet pass to the kernel and read will get nothing. - align the polling behavior with macvtap which never fails when the queue is created. This can simplify the polling errors handling of its user (e.g vhost) We can simply achieve this by don't assign NULL to tfile->tun when detached. Signed-off-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 20:43:04 UTC |
| 2b8b328 | Jason Wang | 28 January 2013, 01:05:18 UTC | vhost_net: handle polling errors when setting backend Currently, the polling errors were ignored, which can lead following issues: - vhost remove itself unconditionally from waitqueue when stopping the poll, this may crash the kernel since the previous attempt of starting may fail to add itself to the waitqueue - userspace may think the backend were successfully set even when the polling failed. Solve this by: - check poll->wqh before trying to remove from waitqueue - report polling errors in vhost_poll_start(), tx_poll_start(), the return value will be checked and returned when userspace want to set the backend After this fix, there still could be a polling failure after backend is set, it will addressed by the next patch. Signed-off-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 20:43:03 UTC |
| 692a998 | Jason Wang | 28 January 2013, 01:05:17 UTC | vhost_net: correct error handling in vhost_net_set_backend() Currently, when vhost_init_used() fails the sock refcnt and ubufs were leaked. Correct this by calling vhost_init_used() before assign ubufs and restore the oldsock when it fails. Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 20:43:03 UTC |
| af668b3 | Michael S. Tsirkin | 28 January 2013, 00:38:02 UTC | tun: fix carrier on/off status Commit c8d68e6be1c3b242f1c598595830890b65cea64a removed carrier off call from tun_detach since it's now called on queue disable and not only on tun close. This confuses userspace which used this flag to detect a free tun. To fix, put this back but under if (clean). Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Jason Wang <jasowang@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Tested-by: Toralf Förster <toralf.foerster@gmx.de> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 20:43:03 UTC |
| 604dfd6 | Cong Wang | 27 January 2013, 21:14:08 UTC | pktgen: correctly handle failures when adding a device The return value of pktgen_add_device() is not checked, so even if we fail to add some device, for example, non-exist one, we still see "OK:...". This patch fixes it. After this patch, I got: # echo "add_device non-exist" > /proc/net/pktgen/kpktgend_0 -bash: echo: write error: No such device # cat /proc/net/pktgen/kpktgend_0 Running: Stopped: Result: ERROR: can not add device non-exist # echo "add_device eth0" > /proc/net/pktgen/kpktgend_0 # cat /proc/net/pktgen/kpktgend_0 Running: Stopped: eth0 Result: OK: add_device=eth0 (Candidate for -stable) Cc: David S. Miller <davem@davemloft.net> Signed-off-by: Cong Wang <amwang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 20:43:03 UTC |
| a13d310 | Johannes Naab | 23 January 2013, 11:36:51 UTC | netem: fix delay calculation in rate extension The delay calculation with the rate extension introduces in v3.3 does not properly work, if other packets are still queued for transmission. For the delay calculation to work, both delay types (latency and delay introduces by rate limitation) have to be handled differently. The latency delay for a packet can overlap with the delay of other packets. The delay introduced by the rate however is separate, and can only start, once all other rate-introduced delays finished. Latency delay is from same distribution for each packet, rate delay depends on the packet size. .: latency delay -: rate delay x: additional delay we have to wait since another packet is currently transmitted .....---- Packet 1 .....xx------ Packet 2 .....------ Packet 3 ^^^^^ latency stacks ^^ rate delay doesn't stack ^^ latency stacks -----> time When a packet is enqueued, we first consider the latency delay. If other packets are already queued, we can reduce the latency delay until the last packet in the queue is send, however the latency delay cannot be <0, since this would mean that the rate is overcommitted. The new reference point is the time at which the last packet will be send. To find the time, when the packet should be send, the rate introduces delay has to be added on top of that. Signed-off-by: Johannes Naab <jn@stusta.de> Acked-by: Hagen Paul Pfeifer <hagen@jauu.net> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 20:43:02 UTC |
| 80d84ef | Tom Parkin | 22 January 2013, 05:13:48 UTC | l2tp: prevent l2tp_tunnel_delete racing with userspace close If a tunnel socket is created by userspace, l2tp hooks the socket destructor in order to clean up resources if userspace closes the socket or crashes. It also caches a pointer to the struct sock for use in the data path and in the netlink interface. While it is safe to use the cached sock pointer in the data path, where the skb references keep the socket alive, it is not safe to use it elsewhere as such access introduces a race with userspace closing the socket. In particular, l2tp_tunnel_delete is prone to oopsing if a multithreaded userspace application closes a socket at the same time as sending a netlink delete command for the tunnel. This patch fixes this oops by forcing l2tp_tunnel_delete to explicitly look up a tunnel socket held by userspace using sockfd_lookup(). Signed-off-by: Tom Parkin <tparkin@katalix.com> Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 29 January 2013, 20:43:02 UTC |
| fc16e88 | Linus Torvalds | 29 January 2013, 00:23:07 UTC | Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc Pull powerpc fixes from Benjamin Herrenschmidt: "Whenever you have a chance between two dives, you might want to consider pulling my merge branch to pickup a few fixes for 3.8 that have been accumulating for the last couple of weeks (I was myself travelling then on vacation). Nothing major, just a handful of powerpc bug fixes that I consider worth getting in before 3.8 goes final." And I'll have everybody know that I'm not diving for several days yet. Snif. * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc: Max next_tb to prevent from replaying timer interrupt powerpc: kernel/kgdb.c: Fix memory leakage powerpc/book3e: Disable interrupt after preempt_schedule_irq powerpc/oprofile: Fix error in oprofile power7_marked_instr_event() function powerpc/pasemi: Fix crash on reboot powerpc: Fix MAX_STACK_TRACE_ENTRIES too low warning for ppc32 | 29 January 2013, 00:23:07 UTC |
| 689dfa8 | Tiejun Chen | 15 January 2013, 17:01:19 UTC | powerpc: Max next_tb to prevent from replaying timer interrupt With lazy interrupt, we always call __check_irq_replaysome with decrementers_next_tb to check if we need to replay timer interrupt. So in hotplug case we also need to set decrementers_next_tb as MAX to make sure __check_irq_replay don't replay timer interrupt when return as we expect, otherwise we'll trap here infinitely. Signed-off-by: Tiejun Chen <tiejun.chen@windriver.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | 28 January 2013, 23:18:16 UTC |
| fefd9e6 | Cong Ding | 14 January 2013, 07:26:32 UTC | powerpc: kernel/kgdb.c: Fix memory leakage the variable backup_current_thread_info isn't freed before existing the function. Signed-off-by: Cong Ding <dinggnu@gmail.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | 28 January 2013, 23:18:15 UTC |
| 572177d | Tiejun Chen | 06 January 2013, 00:49:34 UTC | powerpc/book3e: Disable interrupt after preempt_schedule_irq In preempt case current arch_local_irq_restore() from preempt_schedule_irq() may enable hard interrupt but we really should disable interrupts when we return from the interrupt, and so that we don't get interrupted after loading SRR0/1. Signed-off-by: Tiejun Chen <tiejun.chen@windriver.com> CC: <stable@vger.kernel.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | 28 January 2013, 23:18:15 UTC |
| 46ed7a7 | Carl E. Love | 29 November 2012, 06:42:03 UTC | powerpc/oprofile: Fix error in oprofile power7_marked_instr_event() function The calculation for the left shift of the mask OPROFILE_PM_PMCSEL_MSK has an error. The calculation is should be to shift left by (max_cntrs - cntr) times the width of the pmsel field width. However, the #define OPROFILE_MAX_PMC_NUM was used instead of OPROFILE_PMSEL_FIELD_WIDTH. This patch fixes the calculation. Signed-off-by: Carl Love <cel@us.ibm.com> Acked-by: Paul Mackerras <paulus@samba.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | 28 January 2013, 23:18:14 UTC |
| 72640d8 | Steven Rostedt | 21 January 2013, 17:23:26 UTC | powerpc/pasemi: Fix crash on reboot commit f96972f2dc "kernel/sys.c: call disable_nonboot_cpus() in kernel_restart()" added a call to disable_nonboot_cpus() on kernel_restart(), which tries to shutdown all the CPUs except the first one. The issue with the PA Semi, is that it does not support CPU hotplug. When the call is made to __cpu_down(), it calls the notifiers CPU_DOWN_PREPARE, and then tries to take the CPU down. One of the notifiers to the CPU hotplug code, is the cpufreq. The DOWN_PREPARE will call __cpufreq_remove_dev() which calls cpufreq_driver->exit. The PA Semi exit handler unmaps regions of I/O that is used by an interrupt that goes off constantly (system_reset_common, but it goes off during normal system operations too). I'm not sure exactly what this interrupt does. Running a simple function trace, you can see it goes off quite a bit: # tracer: function # # TASK-PID CPU# TIMESTAMP FUNCTION # | | | | | <idle>-0 [001] 1558.859363: .pasemi_system_reset_exception <-.system_reset_exception <idle>-0 [000] 1558.860112: .pasemi_system_reset_exception <-.system_reset_exception <idle>-0 [000] 1558.861109: .pasemi_system_reset_exception <-.system_reset_exception <idle>-0 [001] 1558.861361: .pasemi_system_reset_exception <-.system_reset_exception <idle>-0 [000] 1558.861437: .pasemi_system_reset_exception <-.system_reset_exception When the region is unmapped, the system crashes with: Disabling non-boot CPUs ... Error taking CPU1 down: -38 Unable to handle kernel paging request for data at address 0xd0000800903a0100 Faulting instruction address: 0xc000000000055fcc Oops: Kernel access of bad area, sig: 11 [#1] PREEMPT SMP NR_CPUS=64 NUMA PA Semi PWRficient Modules linked in: shpchp NIP: c000000000055fcc LR: c000000000055fb4 CTR: c0000000000df1fc REGS: c0000000012175d0 TRAP: 0300 Not tainted (3.8.0-rc4-test-dirty) MSR: 9000000000009032 <SF,HV,EE,ME,IR,DR,RI> CR: 24000088 XER: 00000000 SOFTE: 0 DAR: d0000800903a0100, DSISR: 42000000 TASK = c0000000010e9008[0] 'swapper/0' THREAD: c000000001214000 CPU: 0 GPR00: d0000800903a0000 c000000001217850 c0000000012167e0 0000000000000000 GPR04: 0000000000000000 0000000000000724 0000000000000724 0000000000000000 GPR08: 0000000000000000 0000000000000000 0000000000000001 0000000000a70000 GPR12: 0000000024000080 c00000000fff0000 ffffffffffffffff 000000003ffffae0 GPR16: ffffffffffffffff 0000000000a21198 0000000000000060 0000000000000000 GPR20: 00000000008fdd35 0000000000a21258 000000003ffffaf0 0000000000000417 GPR24: 0000000000a226d0 c000000000000000 0000000000000000 0000000000000000 GPR28: c00000000138b358 0000000000000000 c000000001144818 d0000800903a0100 NIP [c000000000055fcc] .set_astate+0x5c/0xa4 LR [c000000000055fb4] .set_astate+0x44/0xa4 Call Trace: [c000000001217850] [c000000000055fb4] .set_astate+0x44/0xa4 (unreliable) [c0000000012178f0] [c00000000005647c] .restore_astate+0x2c/0x34 [c000000001217980] [c000000000054668] .pasemi_system_reset_exception+0x6c/0x88 [c000000001217a00] [c000000000019ef0] .system_reset_exception+0x48/0x84 [c000000001217a80] [c000000000001e40] system_reset_common+0x140/0x180 Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | 28 January 2013, 23:18:14 UTC |
| f94d4fe | Linus Torvalds | 28 January 2013, 23:15:34 UTC | Merge tag 'md-3.8-fixes' of git://neil.brown.name/md Pull dmraid fix from NeilBrown: "Just one fix for md in 3.8 dmraid assess redundancy and replacements slightly inaccurately which could lead to some degraded arrays failing to assemble." * tag 'md-3.8-fixes' of git://neil.brown.name/md: DM-RAID: Fix RAID10's check for sufficient redundancy | 28 January 2013, 23:15:34 UTC |
| 41d82bd | Li Zhong | 02 December 2012, 20:19:22 UTC | powerpc: Fix MAX_STACK_TRACE_ENTRIES too low warning for ppc32 This patch fixes MAX_STACK_TRACE_ENTRIES too low warning for ppc32, which is similar to commit 12660b17. Reported-by: Christian Kujau <lists@nerdbynature.de> Signed-off-by: Li Zhong <zhong@linux.vnet.ibm.com> Tested-by: Christian Kujau <lists@nerdbynature.de> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> | 28 January 2013, 23:10:22 UTC |
| 45e72af | Linus Torvalds | 28 January 2013, 19:53:49 UTC | Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-fixes Pull GFS2 fix from Steven Whitehouse. * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-fixes: GFS2: fix skip unlock condition | 28 January 2013, 19:53:49 UTC |
| ae2c3d9 | Linus Torvalds | 28 January 2013, 19:52:56 UTC | Merge tag 'iommu-fixes-v3.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fix from Joerg Roedel: "One fix for the AMD IOMMU driver to work around broken BIOSes found in the field. Some BIOSes forget to enable a workaround for a hardware problem which might cause the IOMMU to stop working under high load conditions. The fix makes sure this workaround is enabled." * tag 'iommu-fixes-v3.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: IOMMU, AMD Family15h Model10-1Fh erratum 746 Workaround | 28 January 2013, 19:52:56 UTC |
| 325a86b | Linus Torvalds | 28 January 2013, 19:51:57 UTC | Merge tag 'mfd-for-linus-3.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6 Pull MFD fixes from Samuel Ortiz: "This is the first pull request for MFD fixes for 3.8 We have some build failure fixes (twl4030, vexpress, abx500 and tps65910), some actual runtime oops and lockup fixes (rtsx, da9052), and some more hypothetical NULL pointers dereferences fixes for pcf50633 and max776xx. Then we also have additional rtsx fixes for a correct switch output voltage and clock divider correctness for rtl8411 (rtsx driver), and irqdomain fix for db8550-prcmu, and some more cosmetic fixes for arizona and wm5102." * tag 'mfd-for-linus-3.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6: mfd: rtsx: Fix oops when rtsx_pci_sdmmc is not probed mfd: wm5102: Fix definition of WM5102_MAX_REGISTER mfd: twl4030: Don't warn about uninitialized return code mfd: da9052/53 lockup fix mfd: rtsx: Add clock divider hook mmc: rtsx: Call MFD hook to switch output voltage mfd: rtsx: Add output voltage switch hook mfd: Fix compile errors and warnings when !CONFIG_AB8500_BM mfd: vexpress: Export global functions to fix build error mfd: arizona: Check errors from regcache_sync() mfd: tc3589x: Use simple irqdomain mfd: pcf50633: Init pcf->dev before using it mfd: max77693: Init max77693->dev before using it mfd: max77686: Init max77686->dev before using it mfd: db8500-prcmu: Fix irqdomain usage mfd: tps65910: Select REGMAP_IRQ in Kconfig to fix build error mfd: arizona: Disable control interface reporting for WM5102 and WM5110 | 28 January 2013, 19:51:57 UTC |
| 0a06ad8 | Larry Finger | 27 January 2013, 22:24:25 UTC | rtlwifi: Fix the usage of the wrong variable in usb.c In routine _rtl_rx_pre_process(), skb_dequeue() is called to get an skb; however, the wrong variable name is used in subsequent calls. Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Guenter Roeck <linux@roeck-us.net> Cc: Stable <stable@vger.kernel.org> Signed-off-by: John W. Linville <linville@tuxdriver.com> | 28 January 2013, 19:48:53 UTC |
| 6b112de | Rafał Miłecki | 27 January 2013, 13:30:29 UTC | bcma: fix NAND flash validation Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> | 28 January 2013, 19:48:53 UTC |
| 0e33e48 | Arend van Spriel | 22 January 2013, 21:47:40 UTC | brcmsmac: fix tx status processing This issue was reported on the wireless list (see [1]) in which brcmsmac ran into a fatal error: [ 588.284074] brcmsmac bcma0:0: frameid != txh->TxFrameID [ 588.284098] brcmsmac bcma0:0: MI_TFS: fatal [ 588.284103] brcmsmac bcma0:0: wl0: fatal error, reinitializing [ 588.286208] ieee80211 phy0: Hardware restart was requested The tx status feedback is processed in a loop limiting the number of frames processed in one run. The code terminate processing when the limit is reached regardless the txstatus value read from the device register. When that status is is flagged as being valid it must be processed as the hardware will clear it after is has been read. Bisecting was done by Seth Forshee and showed following commit as the culprit: commit 57fe504817ccec9b6ac23e973d2925343bf1e3b6 Author: Piotr Haber <phaber@broadcom.com> Date: Wed Nov 28 21:44:07 2012 +0100 brcmsmac: fix bounds checking in tx/rx [1] http://www.spinics.net/lists/linux-wireless/msg101293.html Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Tested-by: Seth Forshee <seth.forshee@canonical.com> Reviewed-by: Hante Meuleman <meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com> Signed-off-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> | 28 January 2013, 19:48:52 UTC |
| 006da9e | John W. Linville | 28 January 2013, 19:47:43 UTC | Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes | 28 January 2013, 19:47:43 UTC |
| cb73e2b | John W. Linville | 28 January 2013, 19:46:50 UTC | Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 | 28 January 2013, 19:46:50 UTC |
| 22f8379 | Linus Torvalds | 28 January 2013, 19:41:37 UTC | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking updates from David Miller: "Much more accumulated than I would have liked due to an unexpected bout with a nasty flu: 1) AH and ESP input don't set ECN field correctly because the transport head of the SKB isn't set correctly, fix from Li RongQing. 2) If netfilter conntrack zones are disabled, we can return an uninitialized variable instead of the proper error code. Fix from Borislav Petkov. 3) Fix double SKB free in ath9k driver beacon handling, from Felix Feitkau. 4) Remove bogus assumption about netns cleanup ordering in nf_conntrack, from Pablo Neira Ayuso. 5) Remove a bogus BUG_ON in the new TCP fastopen code, from Eric Dumazet. It uses spin_is_locked() in it's test and is therefore unsuitable for UP. 6) Fix SELINUX labelling regressions added by the tuntap multiqueue changes, from Paul Moore. 7) Fix CRC errors with jumbo frame receive in tg3 driver, from Nithin Nayak Sujir. 8) CXGB4 driver sets interrupt coalescing parameters only on first queue, rather than all of them. Fix from Thadeu Lima de Souza Cascardo. 9) Fix regression in the dispatch of read/write registers in dm9601 driver, from Tushar Behera. 10) ipv6_append_data miscalculates header length, from Romain KUNTZ. 11) Fix PMTU handling regressions on ipv4 routes, from Steffen Klassert, Timo Teräs, and Julian Anastasov. 12) In 3c574_cs driver, add necessary parenthesis to "x << y & z" expression. From Nickolai Zeldovich. 13) macvlan_get_size() causes underallocation netlink message space, fix from Eric Dumazet. 14) Avoid division by zero in xfrm_replay_advance_bmp(), from Nickolai Zeldovich. Amusingly the zero check was already there, we were just performing it after the modulus :-) 15) Some more splice bug fixes from Eric Dumazet, which fix things mostly eminating from how we now more aggressively use high-order pages in SKBs. 16) Fix size calculation bug when freeing hash tables in the IPSEC xfrm code, from Michal Kubecek. 17) Fix PMTU event propagation into socket cached routes, from Steffen Klassert. 18) Fix off by one in TX buffer release in netxen driver, from Eric Dumazet. 19) Fix rediculous memory allocation requirements introduced by the tuntap multiqueue changes, from Jason Wang. 20) Remove bogus AMD platform workaround in r8169 driver that causes major problems in normal operation, from Timo Teräs. 21) virtio-net set affinity and select queue don't handle discontiguous cpu numbers properly, fix from Wanlong Gao. 22) Fix a route refcounting issue in loopback driver, from Eric Dumazet. There's a similar fix coming that we might add to the macvlan driver as well. 23) Fix SKB leaks in batman-adv's distributed arp table code, from Matthias Schiffer. 24) r8169 driver gives descriptor ownership back the hardware before we're done reading the VLAN tag out of it, fix from Francois Romieu. 25) Checksums not calculated properly in GRE tunnel driver fix from Pravin B Shelar. 26) Fix SCTP memory leak on namespace exit." * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (101 commits) dm9601: support dm9620 variant SCTP: Free the per-net sysctl table on net exit. v2 net: phy: icplus: fix broken INTR pin settings net: phy: icplus: Use the RGMII interface mode to configure clock delays IP_GRE: Fix kernel panic in IP_GRE with GRE csum. sctp: set association state to established in dupcook_a handler ip6mr: limit IPv6 MRT_TABLE identifiers r8169: fix vlan tag read ordering. net: cdc_ncm: use IAD provided by the USB core batman-adv: filter ARP packets with invalid MAC addresses in DAT batman-adv: check for more types of invalid IP addresses in DAT batman-adv: fix skb leak in batadv_dat_snoop_incoming_arp_reply() net: loopback: fix a dst refcounting issue virtio-net: reset virtqueue affinity when doing cpu hotplug virtio-net: split out clean affinity function virtio-net: fix the set affinity bug when CPU IDs are not consecutive can: pch_can: fix invalid error codes can: ti_hecc: fix invalid error codes can: c_can: fix invalid error codes r8169: remove the obsolete and incorrect AMD workaround ... | 28 January 2013, 19:41:37 UTC |
| 318fe78 | Suravee Suthikulpanit | 24 January 2013, 19:17:53 UTC | IOMMU, AMD Family15h Model10-1Fh erratum 746 Workaround The IOMMU may stop processing page translations due to a perceived lack of credits for writing upstream peripheral page service request (PPR) or event logs. If the L2B miscellaneous clock gating feature is enabled the IOMMU does not properly register credits after the log request has completed, leading to a potential system hang. BIOSes are supposed to disable L2B micellaneous clock gating by setting L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b. This patch corrects that for those which do not enable this workaround. Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com> Acked-by: Borislav Petkov <bp@suse.de> Cc: stable@vger.kernel.org Signed-off-by: Joerg Roedel <joro@8bytes.org> | 28 January 2013, 14:26:54 UTC |
| d4e0bfe | David Teigland | 03 January 2013, 22:52:07 UTC | GFS2: fix skip unlock condition The recent commit fb6791d100d1bba20b5cdbc4912e1f7086ec60f8 included the wrong logic. The lvbptr check was incorrectly added after the patch was tested. Signed-off-by: David Teigland <teigland@redhat.com> Signed-off-by: Steven Whitehouse <swhiteho@redhat.com> | 28 January 2013, 09:49:15 UTC |
| 6642f91 | Peter Korsgaard | 27 January 2013, 12:34:22 UTC | dm9601: support dm9620 variant dm9620 is a newer variant of dm9601 with more features (usb 2.0, checksum offload, ..), but it can also be put in a dm9601 compatible mode, allowing us to reuse the existing driver. This does mean that the extended features like checksum offload cannot be used, but that's hardly critical on a 100mbps interface. Thanks to Sławek Wernikowski <slawek@wernikowski.net> for providing me with a dm9620 based device to test. Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk> Signed-off-by: David S. Miller <davem@davemloft.net> | 28 January 2013, 05:18:04 UTC |
| 5f19d12 | Vlad Yasevich | 24 January 2013, 16:02:47 UTC | SCTP: Free the per-net sysctl table on net exit. v2 Per-net sysctl table needs to be explicitly freed at net exit. Otherwise we see the following with kmemleak: unreferenced object 0xffff880402d08000 (size 2048): comm "chrome_sandbox", pid 18437, jiffies 4310887172 (age 9097.630s) hex dump (first 32 bytes): b2 68 89 81 ff ff ff ff 20 04 04 f8 01 88 ff ff .h...... ....... 04 00 00 00 a4 01 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff815b4aad>] kmemleak_alloc+0x21/0x3e [<ffffffff81110352>] slab_post_alloc_hook+0x28/0x2a [<ffffffff81113fad>] __kmalloc_track_caller+0xf1/0x104 [<ffffffff810f10c2>] kmemdup+0x1b/0x30 [<ffffffff81571e9f>] sctp_sysctl_net_register+0x1f/0x72 [<ffffffff8155d305>] sctp_net_init+0x100/0x39f [<ffffffff814ad53c>] ops_init+0xc6/0xf5 [<ffffffff814ad5b7>] setup_net+0x4c/0xd0 [<ffffffff814ada5e>] copy_net_ns+0x6d/0xd6 [<ffffffff810938b1>] create_new_namespaces+0xd7/0x147 [<ffffffff810939f4>] copy_namespaces+0x63/0x99 [<ffffffff81076733>] copy_process+0xa65/0x1233 [<ffffffff81077030>] do_fork+0x10b/0x271 [<ffffffff8100a0e9>] sys_clone+0x23/0x25 [<ffffffff815dda73>] stub_clone+0x13/0x20 [<ffffffffffffffff>] 0xffffffffffffffff I fixed the spelling of sysctl_header so the code actually compiles. -- EWB. Reported-by: Martin Mokrejs <mmokrejs@fold.natur.cuni.cz> Signed-off-by: Vlad Yasevich <vyasevich@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 28 January 2013, 05:09:32 UTC |
| 014f2ff | Giuseppe CAVALLARO | 23 January 2013, 00:22:37 UTC | net: phy: icplus: fix broken INTR pin settings This patch fixes the setting of the INTR pin that is valid for IP101 A/G device and not for the IP1001. Reported-by: Anunay Saxena <anunay.saxena@st.com> Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 28 January 2013, 05:08:22 UTC |
| b4a4963 | Stuart Menefy | 23 January 2013, 00:22:36 UTC | net: phy: icplus: Use the RGMII interface mode to configure clock delays Like several other PHY devices which support RGMII, the IC+1001 allows additional delays to by added to the RX_CLK and TX_CLK signals to compensate for skew between the clock and data signals. Previously this was always enabled, but this change makes use of the different RGMII interface modes to allow the user to specify whether this should be enabled. Signed-off-by: Stuart Menefy <stuart.menefy@st.com> Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 28 January 2013, 05:08:22 UTC |
| 5465740 | Pravin B Shelar | 23 January 2013, 11:45:42 UTC | IP_GRE: Fix kernel panic in IP_GRE with GRE csum. Due to IP_GRE GSO support, GRE can recieve non linear skb which results in panic in case of GRE_CSUM. Following patch fixes it by using correct csum API. Bug introduced in commit 6b78f16e4bdde3936b (gre: add GSO support) Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 28 January 2013, 05:07:34 UTC |
| 9839ff0 | Xufeng Zhang | 23 January 2013, 16:44:34 UTC | sctp: set association state to established in dupcook_a handler While sctp handling a duplicate COOKIE-ECHO and the action is 'Association restart', sctp_sf_do_dupcook_a() will processing the unexpected COOKIE-ECHO for peer restart, but it does not set the association state to SCTP_STATE_ESTABLISHED, so the association could stuck in SCTP_STATE_SHUTDOWN_PENDING state forever. This violates the sctp specification: RFC 4960 5.2.4. Handle a COOKIE ECHO when a TCB Exists Action A) In this case, the peer may have restarted. ..... After this, the endpoint shall enter the ESTABLISHED state. To resolve this problem, adding a SCTP_CMD_NEW_STATE cmd to the command list before SCTP_CMD_REPLY cmd, this will set the restart association to SCTP_STATE_ESTABLISHED state properly and also avoid I-bit being set in the DATA chunk header when COOKIE_ACK is bundled with DATA chunks. Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Vlad Yasevich <vyasevich@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 28 January 2013, 00:32:23 UTC |
| 75356a8 | Dan Carpenter | 23 January 2013, 20:38:34 UTC | ip6mr: limit IPv6 MRT_TABLE identifiers We did this for IPv4 in b49d3c1e1c "net: ipmr: limit MRT_TABLE identifiers" but we need to do it for IPv6 as well. On IPv6 the name is "pim6reg" instead of "pimreg" so there is one less digit allowed. The strcpy() is in ip6mr_reg_vif(). Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 28 January 2013, 00:31:03 UTC |
| ce11ff5 | françois romieu | 24 January 2013, 13:30:06 UTC | r8169: fix vlan tag read ordering. Control of receive descriptor must not be returned to ethernet chipset before vlan tag processing is done. VLAN tag receive word is now reset both in normal and error path. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Spotted-by: Timo Teras <timo.teras@iki.fi> Cc: Hayes Wang <hayeswang@realtek.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 28 January 2013, 00:28:58 UTC |
| 56a666d | Bjørn Mork | 25 January 2013, 23:36:59 UTC | net: cdc_ncm: use IAD provided by the USB core commit 9992c2e (net: cdc_ncm: workaround for missing CDC Union) added code to lookup an IAD for the interface we are probing. This is redundant. The USB core has already done the lookup and saved the result in the USB interface struct. Use that instead. Cc: Greg Suarez <gsuarez@smithmicro.com> Cc: Alexey Orishko <alexey.orishko@stericsson.com> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net> | 28 January 2013, 00:27:39 UTC |
| 2afd0a2 | David S. Miller | 28 January 2013, 00:10:36 UTC | Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge Included changes ares: - fix an skb memleak in DAT - fix the ARP filtering routine in DAT by preventing bogus entries to overwrite already existing ones in the local cache. - fix the ARP filtering routine in DAT by preventing it to parse and add to the cache bogus entries Signed-off-by: David S. Miller <davem@davemloft.net> | 28 January 2013, 00:10:36 UTC |
| b618ad1 | Matthias Schiffer | 24 January 2013, 17:18:27 UTC | batman-adv: filter ARP packets with invalid MAC addresses in DAT We never want multicast MAC addresses in the Distributed ARP Table, so it's best to completely ignore ARP packets containing them where we expect unicast addresses. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> Acked-by: Antonio Quartulli <ordex@autistici.org> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org> | 27 January 2013, 13:02:39 UTC |
| 757dd82 | Matthias Schiffer | 24 January 2013, 17:18:26 UTC | batman-adv: check for more types of invalid IP addresses in DAT There are more types of IP addresses that may appear in ARP packets that we don't want to process. While some of these should never appear in sane ARP packets, a 0.0.0.0 source is used for duplicate address detection and thus seen quite often. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> Acked-by: Antonio Quartulli <ordex@autistici.org> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org> | 27 January 2013, 13:02:39 UTC |
| 0d15bec | Matthias Schiffer | 23 January 2013, 17:11:53 UTC | batman-adv: fix skb leak in batadv_dat_snoop_incoming_arp_reply() The callers of batadv_dat_snoop_incoming_arp_reply() assume the skb has been freed when it returns true; fix this by calling kfree_skb before returning as it is done in batadv_dat_snoop_incoming_arp_request(). Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Acked-by: Antonio Quartulli <ordex@autistici.org> Signed-off-by: Antonio Quartulli <ordex@autistici.org> | 27 January 2013, 13:02:39 UTC |
| 1591ab6 | David S. Miller | 27 January 2013, 06:37:22 UTC | Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless John W. Linville says: ==================== This is a batch of fixes intende for the 3.8 stream. Regarding the iwlwifi bits, Johannes says this: "Please pull to get a single fix from Emmanuel for a bug I introduced due to misunderstanding the code." Regarding the mac80211 bits, Johannes says this: "I have a few small fixes for you: * some mesh frames would cause encryption warnings -- fixes from Bob * scanning would pretty much break an association if we transmitted anything to the AP while scanning -- fix from Stanislaw * mode injection was broken by channel contexts -- fix from Felix * FT roaming was broken: hardware crypto would get disabled by it" Along with that, a handful of other fixes confined to specific drivers. Avinash Patil fixes a typo in a NULL check in mwifiex. Larry Finger fixes a build warning in rtlwifi. Seems safe... Stanislaw Gruszka fixes iwlegacy to prevent microcode errors when switching from IBSS mode to STA mode. Felix Fietkau provides a trio of ath9k fixes related to proper tuning. Please let me know if there are problems! ==================== Signed-off-by: David S. Miller <davem@davemloft.net> | 27 January 2013, 06:37:22 UTC |
| 794ed39 | Eric Dumazet | 25 January 2013, 07:44:41 UTC | net: loopback: fix a dst refcounting issue Ben Greear reported crashes in ip_rcv_finish() on a stress test involving many macvlans. We tracked the bug to a dst use after free. ip_rcv_finish() was calling dst->input() and got garbage for dst->input value. It appears the bug is in loopback driver, lacking a skb_dst_force() before calling netif_rx(). As a result, a non refcounted dst, normally protected by a RCU read_lock section, was escaping this section and could be freed before the packet being processed. [<ffffffff813a3c4d>] loopback_xmit+0x64/0x83 [<ffffffff81477364>] dev_hard_start_xmit+0x26c/0x35e [<ffffffff8147771a>] dev_queue_xmit+0x2c4/0x37c [<ffffffff81477456>] ? dev_hard_start_xmit+0x35e/0x35e [<ffffffff8148cfa6>] ? eth_header+0x28/0xb6 [<ffffffff81480f09>] neigh_resolve_output+0x176/0x1a7 [<ffffffff814ad835>] ip_finish_output2+0x297/0x30d [<ffffffff814ad6d5>] ? ip_finish_output2+0x137/0x30d [<ffffffff814ad90e>] ip_finish_output+0x63/0x68 [<ffffffff814ae412>] ip_output+0x61/0x67 [<ffffffff814ab904>] dst_output+0x17/0x1b [<ffffffff814adb6d>] ip_local_out+0x1e/0x23 [<ffffffff814ae1c4>] ip_queue_xmit+0x315/0x353 [<ffffffff814adeaf>] ? ip_send_unicast_reply+0x2cc/0x2cc [<ffffffff814c018f>] tcp_transmit_skb+0x7ca/0x80b [<ffffffff814c3571>] tcp_connect+0x53c/0x587 [<ffffffff810c2f0c>] ? getnstimeofday+0x44/0x7d [<ffffffff810c2f56>] ? ktime_get_real+0x11/0x3e [<ffffffff814c6f9b>] tcp_v4_connect+0x3c2/0x431 [<ffffffff814d6913>] __inet_stream_connect+0x84/0x287 [<ffffffff814d6b38>] ? inet_stream_connect+0x22/0x49 [<ffffffff8108d695>] ? _local_bh_enable_ip+0x84/0x9f [<ffffffff8108d6c8>] ? local_bh_enable+0xd/0x11 [<ffffffff8146763c>] ? lock_sock_nested+0x6e/0x79 [<ffffffff814d6b38>] ? inet_stream_connect+0x22/0x49 [<ffffffff814d6b49>] inet_stream_connect+0x33/0x49 [<ffffffff814632c6>] sys_connect+0x75/0x98 This bug was introduced in linux-2.6.35, in commit 7fee226ad2397b (net: add a noref bit on skb dst) skb_dst_force() is enforced in dev_queue_xmit() for devices having a qdisc. Reported-by: Ben Greear <greearb@candelatech.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Tested-by: Ben Greear <greearb@candelatech.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 January 2013, 06:30:35 UTC |
| 8de4b2f | Wanlong Gao | 24 January 2013, 23:51:31 UTC | virtio-net: reset virtqueue affinity when doing cpu hotplug Add a cpu notifier to virtio-net, so that we can reset the virtqueue affinity if the cpu hotplug happens. It improve the performance through enabling or disabling the virtqueue affinity after doing cpu hotplug. Cc: Rusty Russell <rusty@rustcorp.com.au> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: Eric Dumazet <erdnetdev@gmail.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: virtualization@lists.linux-foundation.org Cc: netdev@vger.kernel.org Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 January 2013, 06:22:51 UTC |
| 8898c21 | Wanlong Gao | 24 January 2013, 23:51:30 UTC | virtio-net: split out clean affinity function Split out the clean affinity function to virtnet_clean_affinity(). Cc: Rusty Russell <rusty@rustcorp.com.au> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: Eric Dumazet <erdnetdev@gmail.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: virtualization@lists.linux-foundation.org Cc: netdev@vger.kernel.org Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 January 2013, 06:22:51 UTC |
| 47be247 | Wanlong Gao | 24 January 2013, 23:51:29 UTC | virtio-net: fix the set affinity bug when CPU IDs are not consecutive As Michael mentioned, set affinity and select queue will not work very well when CPU IDs are not consecutive, this can happen with hot unplug. Fix this bug by traversal the online CPUs, and create a per cpu variable to find the mapping from CPU to the preferable virtual-queue. Cc: Rusty Russell <rusty@rustcorp.com.au> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: Eric Dumazet <erdnetdev@gmail.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: virtualization@lists.linux-foundation.org Cc: netdev@vger.kernel.org Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> | 27 January 2013, 06:22:51 UTC |
| 2d1484f | Wei WANG | 27 January 2013, 00:55:16 UTC | mfd: rtsx: Fix oops when rtsx_pci_sdmmc is not probed If rtsx_pci_sdmmc is not probed, function pointer pcr->slots[].card_event will point to NULL, and thus rtsx_pci_card_detect will reference a NULL pointer. Check card_event pointer before referencing it can avoid kernel panic. Signed-off-by: Wei WANG <wei_wang@realsil.com.cn> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> | 27 January 2013, 01:18:07 UTC |
| ff0decd | Mark Brown | 25 January 2013, 15:53:51 UTC | mfd: wm5102: Fix definition of WM5102_MAX_REGISTER Updated in latest datasheet. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> | 27 January 2013, 01:18:07 UTC |
| f65e9ea | Arnd Bergmann | 25 January 2013, 14:14:26 UTC | mfd: twl4030: Don't warn about uninitialized return code If the twl4030_write_script function gets called with a zero length argument, its return value does not get set. We know that all scripts have a nonzero length, but returning an error in case they ever do is probably appropriate. Without this patch, building omap2plus_defconfig results in: drivers/mfd/twl4030-power.c: In function 'load_twl4030_script': drivers/mfd/twl4030-power.c:414:5: error: 'err' may be used uninitialized in this function Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Reviewed-by: Amit Kucheria <amit.kucheria@linaro.org> Cc: Kevin Hilman <khilman@deeprootsystems.com> Cc: "Kristo, Tero" <t-kristo@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> | 27 January 2013, 01:18:01 UTC |
| 0a8c290 | Ashish Jangam | 25 January 2013, 08:33:49 UTC | mfd: da9052/53 lockup fix An issue has been reported where the PMIC either locks up or fails to respond following a system Reset. This could result in a second write in which the bus writes the current content of the write buffer to address of the last I2C access. The failure case is where this unwanted write transfers incorrect data to a critical register. This patch fixes this issue to by following any read or write with a dummy read to a safe register address. A safe register address is one where the contents will not affect the operation of the system. Signed-off-by: Ashish Jangam <ashish.jangam@kpitcummins.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> | 27 January 2013, 00:35:32 UTC |
| ab4e8f8 | Wei WANG | 23 January 2013, 01:51:06 UTC | mfd: rtsx: Add clock divider hook Add callback function conv_clk_and_div_n to convert between SSC clock and its divider N. For rtl8411, the formula to calculate SSC clock divider N is different with the other card reader models. Signed-off-by: Wei WANG <wei_wang@realsil.com.cn> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> | 27 January 2013, 00:30:20 UTC |
