1. 16 Dec, 2016 3 commits
    • Dongpo Li's avatar
      net: ethernet: hisi_femac: Call SET_NETDEV_DEV() · 2087d421
      Dongpo Li authored
      The hisi_femac driver calls into PHYLIB which now checks for
      net_device->dev.parent, so make sure we do set it before calling into
      any MDIO/PHYLIB related function.
      
      Fixes: ec988ad7 ("phy: Don't increment MDIO bus refcount unless it's a different owner")
      Signed-off-by: default avatarDongpo Li <lidongpo@hisilicon.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2087d421
    • Andrew Lunn's avatar
      net: dsa: mv88e6xxx: Fix opps when adding vlan bridge · 66e2809d
      Andrew Lunn authored
      A port is not necessarily assigned to a netdev. And a port does not
      need to be a member of a bridge. So when iterating over all ports,
      check before using the netdev and bridge_dev for a port. Otherwise we
      dereference a NULL pointer.
      
      Fixes: da9c359e ("net: dsa: mv88e6xxx: check hardware VLAN in use")
      Signed-off-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Reviewed-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      66e2809d
    • Thomas Gleixner's avatar
      net/3com/3c515: Fix timer handling, prevent leaks and crashes · e28ceeb1
      Thomas Gleixner authored
      The timer handling in this driver is broken in several ways:
      
      - corkscrew_open() initializes and arms a timer before requesting the
        device interrupt. If the request fails the timer stays armed.
      
        A second call to corkscrew_open will unconditionally reinitialize the
        quued timer and arm it again. Also a immediate device removal will leave
        the timer queued because close() is not called (open() failed) and
        therefore nothing issues del_timer().
      
        The reinitialization corrupts the link chain in the timer wheel hash
        bucket and causes a NULL pointer dereference when the timer wheel tries
        to operate on that hash bucket. Immediate device removal lets the link
        chain poke into freed and possibly reused memory.
      
        Solution: Arm the timer after the successful irq request.
      
      - corkscrew_close() uses del_timer()
      
        On close the timer is disarmed with del_timer() which lets the following
        code race against a concurrent timer expiry function.
      
        Solution: Use del_timer_sync() instead
      
      - corkscrew_close() calls del_timer() unconditionally
      
        del_timer() is invoked even if the timer was never initialized. This
        works by chance because the struct containing the timer is zeroed at
        allocation time.
      
        Solution: Move the setup of the timer into corkscrew_setup().
      Reported-by: default avatarMatthew Whitehead <tedheadster@gmail.com>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e28ceeb1
  2. 13 Dec, 2016 2 commits
  3. 12 Dec, 2016 30 commits
  4. 11 Dec, 2016 5 commits