1. 14 Oct, 2014 40 commits
    • David S. Miller's avatar
      Merge branch 'qlcnic' · 82b009f9
      David S. Miller authored
      Rajesh Borundia says:
      
      ====================
      qlcnic: Bug fixes
      
      This series fixes following issues.
      
      * We were programming maximum number of arguments supported by
        adapter instead of required in a command.
      * Destroy tx command requires three arguments instead of two.
      
      Please apply these patches to net.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      82b009f9
    • Rajesh Borundia's avatar
      qlcnic: Fix number of arguments in destroy tx context command · d47d2fdd
      Rajesh Borundia authored
      o Number of arguments taken by destroy tx command is three
        instead of two.
      Signed-off-by: default avatarRajesh Borundia <rajesh.borundia@qlogic.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d47d2fdd
    • Rajesh Borundia's avatar
      qlcnic: Fix programming number of arguments in a command. · 2a1ef4b5
      Rajesh Borundia authored
      o Initially we were programming maximum number of arguments.
        Instead we should program number of arguments required in
        a command.
      o Maximum number of arguments for 82xx adapter is four. Fix it
        for GET_ESWITCH_STATS command.
      Signed-off-by: default avatarRajesh Borundia <rajesh.borundia@qlogic.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2a1ef4b5
    • Mark Rustad's avatar
      genl_magic: Resolve logical-op warnings · db404b13
      Mark Rustad authored
      Resolve "logical 'and' applied to non-boolean constant" warnings"
      that appear in W=2 builds by adding !! to a bit test.
      Signed-off-by: default avatarMark Rustad <mark.d.rustad@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      db404b13
    • David S. Miller's avatar
      net: Trap attempts to call sock_kfree_s() with a NULL pointer. · e53da5fb
      David S. Miller authored
      Unlike normal kfree() it is never right to call sock_kfree_s() with
      a NULL pointer, because sock_kfree_s() also has the side effect of
      discharging the memory from the sockets quota.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e53da5fb
    • Cong Wang's avatar
      rds: avoid calling sock_kfree_s() on allocation failure · dee49f20
      Cong Wang authored
      It is okay to free a NULL pointer but not okay to mischarge the socket optmem
      accounting. Compile test only.
      
      Reported-by: rucsoftsec@gmail.com
      Cc: Chien Yen <chien.yen@oracle.com>
      Cc: Stephen Hemminger <stephen@networkplumber.org>
      Signed-off-by: default avatarCong Wang <cwang@twopensource.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dee49f20
    • Hariprasad Shenai's avatar
      cxgb4: Fix FW flash logic using ethtool · 22c0b963
      Hariprasad Shenai authored
      Use t4_fw_upgrade instead of t4_load_fw to write firmware into FLASH, since
      t4_load_fw doesn't co-ordinate with the firmware and the adapter can get hosed
      enough to require a power cycle of the system.
      
      Based on original work by Casey Leedom <leedom@chelsio.com>
      Signed-off-by: default avatarHariprasad Shenai <hariprasad@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      22c0b963
    • David S. Miller's avatar
      Merge branch 'stmmac' · 6e36145d
      David S. Miller authored
      Giuseppe Cavallaro says:
      
      ====================
      stmmac: review and fix the dwmac-sti glue-logic
      
      This patch is to review the whole glue logic adopted on STi SoCs that
      was bugged.
      In the old glue-logic there was a lot of confusion when setup the
      retiming especially for STiD127 where, for example, the bits 6 and 7
      (in the GMAC  control register) have a different meaning of what is
      used for STiH4xx SoCs. So we cannot adopt the same glue for all these
      SoCs.
      Moreover, GiGa on STiD127 didn't work and, for all the SoCs, the RGMII
      couldn't run when the speed was 10Mbps (because the clock was not properly
      managed).
      Note that the phy clock needs to be provided by the platform as well as
      documented in the related binding file (updated as consequence).
      
      The old code supported too many configurations never adopted and validated.
      This made the code very complex to maintain and debug in case of issues.
      
      The patch simplifies all the configurations as commented in the tables
      inside the file and obviously it has been tested on all the boards
      based on the SoCs mentioned.
      
      With this patch, the dwmac-sti is also ready to support new configurations that
      will be available on next SoC generations.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6e36145d
    • Giuseppe CAVALLARO's avatar
      stmmac: dwmac-sti: review the glue-logic for STi4xx and STiD127 SoCs · 53b26b9b
      Giuseppe CAVALLARO authored
      This patch is to review the whole glue logic adopted on STi SoCs that
      was bugged.
      
      In the old glue-logic there was a lot of confusion when setup the
      retiming especially for STiD127 where, for example, the bits 6 and 7
      (in the GMAC  control register) have a different meaning of what is
      used for STiH4xx SoCs. So we cannot adopt the same glue for all these
      SoCs.
      Moreover, GiGa on STiD127 didn't work and, for all the SoCs, the RGMII
      couldn't run when the speed was 10Mbps (because the clock was not properly
      managed).
      Note that the phy clock needs to be provided by the platform as well as
      documented in the related binding file (updated as consequence).
      
      The old code supported too many configurations never adopted and validated.
      This made the code very complex to maintain and debug in case of issues.
      
      The patch simplifies all the configurations as commented in the tables
      inside the file and obviously it has been tested on all the boards
      based on the SoCs mentioned.
      
      With this patch, the dwmac-sti is also ready to support new configurations that
      will be available on next SoC generations.
      Signed-off-by: default avatarGiuseppe Cavallaro <peppe.cavallaro@st.com>
      Cc: Srinivas Kandagatla <srinivas.kandagatla@st.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      53b26b9b
    • Giuseppe CAVALLARO's avatar
      stmmac: make the STi Layer compatible to STiH407 · 160e1fd1
      Giuseppe CAVALLARO authored
      This adds the missing compatibility to the STiH407 SoC.
      Signed-off-by: default avatarGiuseppe Cavallaro <peppe.cavallaro@st.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      160e1fd1
    • Giuseppe CAVALLARO's avatar
      stmmac: platform: fix FIXED_PHY support. · 8c2a7a5d
      Giuseppe CAVALLARO authored
      On several STi platforms: e.g. stihxxx-b2120 an Ethernet switch is
      embedded and connected to the stmmac via RGMII mode. So this is managed
      by using the FIXED_PHY. In that case, the support in the platform needs
      to be fixed to allow the stmmac to dialog with the switch via fixed-link
      by using phy_bus_name property.
      Signed-off-by: default avatarGiuseppe Cavallaro <peppe.cavallaro@st.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8c2a7a5d
    • Guenter Roeck's avatar
      dsa: mv88e6171: Fix tag_protocol check · 77b3a4dc
      Guenter Roeck authored
      tag_protocol is now an enum, so drivers have to check against it.
      
      Cc: Andrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Acked-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      77b3a4dc
    • David S. Miller's avatar
      Merge branch 'xgene' · 4d1bafbe
      David S. Miller authored
      Iyappan Subramanian says:
      
      ====================
      Adding SGMII based 1GbE basic support to APM X-Gene SoC ethernet driver.
      
      v2: Address comments from v1
      * Split the patchset into two, the first one being preparatory patch
      * Added link_state function pointer to the xgene_mac_ops structure
      * Added xgene_indirect_ctl structure for indirect read/write arguments
      
      v1:
      * Initial version
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4d1bafbe
    • Iyappan Subramanian's avatar
    • Iyappan Subramanian's avatar
    • Iyappan Subramanian's avatar
      drivers: net: xgene: Preparing for adding SGMII based 1GbE · dc8385f0
      Iyappan Subramanian authored
      - Added link_state function pointer to the xgene__mac_ops structure
      - Moved ring manager (pdata->rm) assignment to xgene_enet_setup_ops
      - Removed unused variable (pdata->phy_addr) and macro (FULL_DUPLEX)
      Signed-off-by: default avatarIyappan Subramanian <isubramanian@apm.com>
      Signed-off-by: default avatarKeyur Chudgar <kchudgar@apm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dc8385f0
    • Iyappan Subramanian's avatar
    • Alexei Starovoitov's avatar
      net: filter: move common defines into bpf_common.h · c15952dc
      Alexei Starovoitov authored
      userspace programs that use eBPF instruction macros need to include two files:
      uapi/linux/filter.h and uapi/linux/bpf.h
      Move common macro definitions that are shared between classic BPF and eBPF
      into uapi/linux/bpf_common.h, so that user app can include only one bpf.h file
      
      Cc: Daniel Borkmann <dborkman@redhat.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c15952dc
    • Fabian Frederick's avatar
      caif_usb: use target structure member in memset · 91c4467e
      Fabian Frederick authored
      parent cfusbl was used instead of first structure member 'layer'
      Suggested-by: default avatarJoe Perches <joe@perches.com>
      Signed-off-by: default avatarFabian Frederick <fabf@skynet.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      91c4467e
    • Fabian Frederick's avatar
      caif_usb: remove redundant memory message · 7970f191
      Fabian Frederick authored
      Let MM subsystem display out of memory messages.
      Signed-off-by: default avatarFabian Frederick <fabf@skynet.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7970f191
    • Fabian Frederick's avatar
      caif: replace kmalloc/memset 0 by kzalloc · 6ff1e1e3
      Fabian Frederick authored
      Also add blank line after declaration
      Signed-off-by: default avatarFabian Frederick <fabf@skynet.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6ff1e1e3
    • Mugunthan V N's avatar
      drivers: net: cpsw: remove child devices while driver detach · 030b16a0
      Mugunthan V N authored
      remove all the child devices from the system to make sure that re-insert of
      cpsw module doesn't fail on child device populated by of_platform_populate().
      Signed-off-by: default avatarMugunthan V N <mugunthanvnm@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      030b16a0
    • Mugunthan V N's avatar
      drivers: net: davinci_cpdma: remove spinlock as SOFTIRQ-unsafe lock order detected · fc7a99fb
      Mugunthan V N authored
      remove spinlock in cpdma_desc_pool_destroy() as there is no active cpdma
      channel and iounmap should be called without auquiring lock.
      
      root@dra7xx-evm:~# modprobe -r ti_cpsw
      [   50.539743]
      [   50.541312] ======================================================
      [   50.547796] [ INFO: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected ]
      [   50.554826] 3.14.19-02124-g95c5b7b #308 Not tainted
      [   50.559939] ------------------------------------------------------
      [   50.566416] modprobe/1921 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
      [   50.573347]  (vmap_area_lock){+.+...}, at: [<c01127fc>] find_vmap_area+0x10/0x6c
      [   50.581132]
      [   50.581132] and this task is already holding:
      [   50.587249]  (&(&pool->lock)->rlock#2){..-...}, at: [<bf017c74>] cpdma_ctlr_destroy+0x5c/0x114 [davinci_cpdma]
      [   50.597766] which would create a new lock dependency:
      [   50.603048]  (&(&pool->lock)->rlock#2){..-...} -> (vmap_area_lock){+.+...}
      [   50.610296]
      [   50.610296] but this new dependency connects a SOFTIRQ-irq-safe lock:
      [   50.618601]  (&(&pool->lock)->rlock#2){..-...}
      ... which became SOFTIRQ-irq-safe at:
      [   50.626829]   [<c06585a4>] _raw_spin_lock_irqsave+0x38/0x4c
      [   50.632677]   [<bf01773c>] cpdma_desc_free.constprop.7+0x28/0x58 [davinci_cpdma]
      [   50.640437]   [<bf0177e8>] __cpdma_chan_free+0x7c/0xa8 [davinci_cpdma]
      [   50.647289]   [<bf017908>] __cpdma_chan_process+0xf4/0x134 [davinci_cpdma]
      [   50.654512]   [<bf017984>] cpdma_chan_process+0x3c/0x54 [davinci_cpdma]
      [   50.661455]   [<bf0277e8>] cpsw_poll+0x14/0xa8 [ti_cpsw]
      [   50.667038]   [<c05844f4>] net_rx_action+0xc0/0x1e8
      [   50.672150]   [<c0048234>] __do_softirq+0xcc/0x304
      [   50.677183]   [<c004873c>] irq_exit+0xa8/0xfc
      [   50.681751]   [<c000eeac>] handle_IRQ+0x50/0xb0
      [   50.686513]   [<c0008638>] gic_handle_irq+0x28/0x5c
      [   50.691628]   [<c06590a4>] __irq_svc+0x44/0x5c
      [   50.696289]   [<c0658ab4>] _raw_spin_unlock_irqrestore+0x34/0x44
      [   50.702591]   [<c065a9c4>] do_page_fault.part.9+0x144/0x3c4
      [   50.708433]   [<c065acb8>] do_page_fault+0x74/0x84
      [   50.713453]   [<c00083dc>] do_DataAbort+0x34/0x98
      [   50.718391]   [<c065923c>] __dabt_usr+0x3c/0x40
      [   50.723148]
      [   50.723148] to a SOFTIRQ-irq-unsafe lock:
      [   50.728893]  (vmap_area_lock){+.+...}
      ... which became SOFTIRQ-irq-unsafe at:
      [   50.736476] ...  [<c06584e8>] _raw_spin_lock+0x28/0x38
      [   50.741876]   [<c011376c>] alloc_vmap_area.isra.28+0xb8/0x300
      [   50.747908]   [<c0113a44>] __get_vm_area_node.isra.29+0x90/0x134
      [   50.754210]   [<c011486c>] get_vm_area_caller+0x3c/0x48
      [   50.759692]   [<c0114be0>] vmap+0x40/0x78
      [   50.763900]   [<c09442f0>] check_writebuffer_bugs+0x54/0x1a0
      [   50.769835]   [<c093eac0>] start_kernel+0x320/0x388
      [   50.774952]   [<80008074>] 0x80008074
      [   50.778793]
      [   50.778793] other info that might help us debug this:
      [   50.778793]
      [   50.787181]  Possible interrupt unsafe locking scenario:
      [   50.787181]
      [   50.794295]        CPU0                    CPU1
      [   50.799042]        ----                    ----
      [   50.803785]   lock(vmap_area_lock);
      [   50.807446]                                local_irq_disable();
      [   50.813652]                                lock(&(&pool->lock)->rlock#2);
      [   50.820782]                                lock(vmap_area_lock);
      [   50.827086]   <Interrupt>
      [   50.829823]     lock(&(&pool->lock)->rlock#2);
      [   50.834490]
      [   50.834490]  *** DEADLOCK ***
      [   50.834490]
      [   50.840695] 4 locks held by modprobe/1921:
      [   50.844981]  #0:  (&__lockdep_no_validate__){......}, at: [<c03e53e8>] driver_detach+0x44/0xb8
      [   50.854038]  #1:  (&__lockdep_no_validate__){......}, at: [<c03e53f4>] driver_detach+0x50/0xb8
      [   50.863102]  #2:  (&(&ctlr->lock)->rlock){......}, at: [<bf017c34>] cpdma_ctlr_destroy+0x1c/0x114 [davinci_cpdma]
      [   50.873890]  #3:  (&(&pool->lock)->rlock#2){..-...}, at: [<bf017c74>] cpdma_ctlr_destroy+0x5c/0x114 [davinci_cpdma]
      [   50.884871]
      the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
      [   50.892827] -> (&(&pool->lock)->rlock#2){..-...} ops: 167 {
      [   50.898703]    IN-SOFTIRQ-W at:
      [   50.901995]                     [<c06585a4>] _raw_spin_lock_irqsave+0x38/0x4c
      [   50.909476]                     [<bf01773c>] cpdma_desc_free.constprop.7+0x28/0x58 [davinci_cpdma]
      [   50.918878]                     [<bf0177e8>] __cpdma_chan_free+0x7c/0xa8 [davinci_cpdma]
      [   50.927366]                     [<bf017908>] __cpdma_chan_process+0xf4/0x134 [davinci_cpdma]
      [   50.936218]                     [<bf017984>] cpdma_chan_process+0x3c/0x54 [davinci_cpdma]
      [   50.944794]                     [<bf0277e8>] cpsw_poll+0x14/0xa8 [ti_cpsw]
      [   50.952009]                     [<c05844f4>] net_rx_action+0xc0/0x1e8
      [   50.958765]                     [<c0048234>] __do_softirq+0xcc/0x304
      [   50.965432]                     [<c004873c>] irq_exit+0xa8/0xfc
      [   50.971635]                     [<c000eeac>] handle_IRQ+0x50/0xb0
      [   50.978035]                     [<c0008638>] gic_handle_irq+0x28/0x5c
      [   50.984788]                     [<c06590a4>] __irq_svc+0x44/0x5c
      [   50.991085]                     [<c0658ab4>] _raw_spin_unlock_irqrestore+0x34/0x44
      [   50.999023]                     [<c065a9c4>] do_page_fault.part.9+0x144/0x3c4
      [   51.006510]                     [<c065acb8>] do_page_fault+0x74/0x84
      [   51.013171]                     [<c00083dc>] do_DataAbort+0x34/0x98
      [   51.019738]                     [<c065923c>] __dabt_usr+0x3c/0x40
      [   51.026129]    INITIAL USE at:
      [   51.029335]                    [<c06585a4>] _raw_spin_lock_irqsave+0x38/0x4c
      [   51.036729]                    [<bf017d78>] cpdma_chan_submit+0x4c/0x2f0 [davinci_cpdma]
      [   51.045225]                    [<bf02863c>] cpsw_ndo_open+0x378/0x6bc [ti_cpsw]
      [   51.052897]                    [<c058747c>] __dev_open+0x9c/0x104
      [   51.059287]                    [<c05876ec>] __dev_change_flags+0x88/0x160
      [   51.066420]                    [<c05877e4>] dev_change_flags+0x18/0x48
      [   51.073270]                    [<c05ed51c>] devinet_ioctl+0x61c/0x6e0
      [   51.080029]                    [<c056ee54>] sock_ioctl+0x5c/0x298
      [   51.086418]                    [<c01350a4>] do_vfs_ioctl+0x78/0x61c
      [   51.092993]                    [<c01356ac>] SyS_ioctl+0x64/0x74
      [   51.099200]                    [<c000e580>] ret_fast_syscall+0x0/0x48
      [   51.105956]  }
      [   51.107696]  ... key      at: [<bf019000>] __key.21312+0x0/0xfffff650 [davinci_cpdma]
      [   51.115912]  ... acquired at:
      [   51.119019]    [<c00899ac>] lock_acquire+0x9c/0x104
      [   51.124138]    [<c06584e8>] _raw_spin_lock+0x28/0x38
      [   51.129341]    [<c01127fc>] find_vmap_area+0x10/0x6c
      [   51.134547]    [<c0114960>] remove_vm_area+0x8/0x6c
      [   51.139659]    [<c0114a7c>] __vunmap+0x20/0xf8
      [   51.144318]    [<c001c350>] __arm_iounmap+0x10/0x18
      [   51.149440]    [<bf017d08>] cpdma_ctlr_destroy+0xf0/0x114 [davinci_cpdma]
      [   51.156560]    [<bf026294>] cpsw_remove+0x48/0x8c [ti_cpsw]
      [   51.162407]    [<c03e62c8>] platform_drv_remove+0x18/0x1c
      [   51.168063]    [<c03e4c44>] __device_release_driver+0x70/0xc8
      [   51.174094]    [<c03e5458>] driver_detach+0xb4/0xb8
      [   51.179212]    [<c03e4a6c>] bus_remove_driver+0x4c/0x90
      [   51.184693]    [<c00b024c>] SyS_delete_module+0x10c/0x198
      [   51.190355]    [<c000e580>] ret_fast_syscall+0x0/0x48
      [   51.195661]
      [   51.197217]
      the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock:
      [   51.205986] -> (vmap_area_lock){+.+...} ops: 520 {
      [   51.211032]    HARDIRQ-ON-W at:
      [   51.214321]                     [<c06584e8>] _raw_spin_lock+0x28/0x38
      [   51.221090]                     [<c011376c>] alloc_vmap_area.isra.28+0xb8/0x300
      [   51.228750]                     [<c0113a44>] __get_vm_area_node.isra.29+0x90/0x134
      [   51.236690]                     [<c011486c>] get_vm_area_caller+0x3c/0x48
      [   51.243811]                     [<c0114be0>] vmap+0x40/0x78
      [   51.249654]                     [<c09442f0>] check_writebuffer_bugs+0x54/0x1a0
      [   51.257239]                     [<c093eac0>] start_kernel+0x320/0x388
      [   51.263994]                     [<80008074>] 0x80008074
      [   51.269474]    SOFTIRQ-ON-W at:
      [   51.272769]                     [<c06584e8>] _raw_spin_lock+0x28/0x38
      [   51.279525]                     [<c011376c>] alloc_vmap_area.isra.28+0xb8/0x300
      [   51.287190]                     [<c0113a44>] __get_vm_area_node.isra.29+0x90/0x134
      [   51.295126]                     [<c011486c>] get_vm_area_caller+0x3c/0x48
      [   51.302245]                     [<c0114be0>] vmap+0x40/0x78
      [   51.308094]                     [<c09442f0>] check_writebuffer_bugs+0x54/0x1a0
      [   51.315669]                     [<c093eac0>] start_kernel+0x320/0x388
      [   51.322423]                     [<80008074>] 0x80008074
      [   51.327906]    INITIAL USE at:
      [   51.331112]                    [<c06584e8>] _raw_spin_lock+0x28/0x38
      [   51.337775]                    [<c011376c>] alloc_vmap_area.isra.28+0xb8/0x300
      [   51.345352]                    [<c0113a44>] __get_vm_area_node.isra.29+0x90/0x134
      [   51.353197]                    [<c011486c>] get_vm_area_caller+0x3c/0x48
      [   51.360224]                    [<c0114be0>] vmap+0x40/0x78
      [   51.365977]                    [<c09442f0>] check_writebuffer_bugs+0x54/0x1a0
      [   51.373464]                    [<c093eac0>] start_kernel+0x320/0x388
      [   51.380131]                    [<80008074>] 0x80008074
      [   51.385517]  }
      [   51.387260]  ... key      at: [<c0a66948>] vmap_area_lock+0x10/0x20
      [   51.393841]  ... acquired at:
      [   51.396945]    [<c00899ac>] lock_acquire+0x9c/0x104
      [   51.402060]    [<c06584e8>] _raw_spin_lock+0x28/0x38
      [   51.407266]    [<c01127fc>] find_vmap_area+0x10/0x6c
      [   51.412478]    [<c0114960>] remove_vm_area+0x8/0x6c
      [   51.417592]    [<c0114a7c>] __vunmap+0x20/0xf8
      [   51.422252]    [<c001c350>] __arm_iounmap+0x10/0x18
      [   51.427369]    [<bf017d08>] cpdma_ctlr_destroy+0xf0/0x114 [davinci_cpdma]
      [   51.434487]    [<bf026294>] cpsw_remove+0x48/0x8c [ti_cpsw]
      [   51.440336]    [<c03e62c8>] platform_drv_remove+0x18/0x1c
      [   51.446000]    [<c03e4c44>] __device_release_driver+0x70/0xc8
      [   51.452031]    [<c03e5458>] driver_detach+0xb4/0xb8
      [   51.457147]    [<c03e4a6c>] bus_remove_driver+0x4c/0x90
      [   51.462628]    [<c00b024c>] SyS_delete_module+0x10c/0x198
      [   51.468289]    [<c000e580>] ret_fast_syscall+0x0/0x48
      [   51.473584]
      [   51.475140]
      [   51.475140] stack backtrace:
      [   51.479703] CPU: 0 PID: 1921 Comm: modprobe Not tainted 3.14.19-02124-g95c5b7b #308
      [   51.487744] [<c0016090>] (unwind_backtrace) from [<c0012060>] (show_stack+0x10/0x14)
      [   51.495865] [<c0012060>] (show_stack) from [<c0652a20>] (dump_stack+0x78/0x94)
      [   51.503444] [<c0652a20>] (dump_stack) from [<c0086f18>] (check_usage+0x408/0x594)
      [   51.511293] [<c0086f18>] (check_usage) from [<c00870f8>] (check_irq_usage+0x54/0xb0)
      [   51.519416] [<c00870f8>] (check_irq_usage) from [<c0088724>] (__lock_acquire+0xe54/0x1b90)
      [   51.528077] [<c0088724>] (__lock_acquire) from [<c00899ac>] (lock_acquire+0x9c/0x104)
      [   51.536291] [<c00899ac>] (lock_acquire) from [<c06584e8>] (_raw_spin_lock+0x28/0x38)
      [   51.544417] [<c06584e8>] (_raw_spin_lock) from [<c01127fc>] (find_vmap_area+0x10/0x6c)
      [   51.552726] [<c01127fc>] (find_vmap_area) from [<c0114960>] (remove_vm_area+0x8/0x6c)
      [   51.560935] [<c0114960>] (remove_vm_area) from [<c0114a7c>] (__vunmap+0x20/0xf8)
      [   51.568693] [<c0114a7c>] (__vunmap) from [<c001c350>] (__arm_iounmap+0x10/0x18)
      [   51.576362] [<c001c350>] (__arm_iounmap) from [<bf017d08>] (cpdma_ctlr_destroy+0xf0/0x114 [davinci_cpdma])
      [   51.586494] [<bf017d08>] (cpdma_ctlr_destroy [davinci_cpdma]) from [<bf026294>] (cpsw_remove+0x48/0x8c [ti_cpsw])
      [   51.597261] [<bf026294>] (cpsw_remove [ti_cpsw]) from [<c03e62c8>] (platform_drv_remove+0x18/0x1c)
      [   51.606659] [<c03e62c8>] (platform_drv_remove) from [<c03e4c44>] (__device_release_driver+0x70/0xc8)
      [   51.616237] [<c03e4c44>] (__device_release_driver) from [<c03e5458>] (driver_detach+0xb4/0xb8)
      [   51.625264] [<c03e5458>] (driver_detach) from [<c03e4a6c>] (bus_remove_driver+0x4c/0x90)
      [   51.633749] [<c03e4a6c>] (bus_remove_driver) from [<c00b024c>] (SyS_delete_module+0x10c/0x198)
      [   51.642781] [<c00b024c>] (SyS_delete_module) from [<c000e580>] (ret_fast_syscall+0x0/0x48)
      Signed-off-by: default avatarMugunthan V N <mugunthanvnm@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fc7a99fb
    • Mugunthan V N's avatar
      drivers: net: davinci_cpdma: remove kfree on objects allocated with devm_* apis · ff9538b1
      Mugunthan V N authored
      memories allocated with devm_* apis must not be freed with kfree apis,
      so removing the kfree calls
      
      Fixes: e1943128 ('drivers: net: davinci_cpdma: Convert kzalloc() to devm_kzalloc().')
      Signed-off-by: default avatarMugunthan V N <mugunthanvnm@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ff9538b1
    • Prashant Sreedharan's avatar
      tg3: Add skb->xmit_more support · 2c7c9ea4
      Prashant Sreedharan authored
      Ring TX doorbell only if xmit_more is not set or the queue is stopped.
      Suggested-by: default avatarDaniel Borkmann <dborkman@redhat.com>
      Signed-off-by: default avatarPrashant Sreedharan <prashant@broadcom.com>
      Signed-off-by: default avatarMichael Chan <mchan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2c7c9ea4
    • Jiri Pirko's avatar
      ipv4: fix nexthop attlen check in fib_nh_match · f76936d0
      Jiri Pirko authored
      fib_nh_match does not match nexthops correctly. Example:
      
      ip route add 172.16.10/24 nexthop via 192.168.122.12 dev eth0 \
                                nexthop via 192.168.122.13 dev eth0
      ip route del 172.16.10/24 nexthop via 192.168.122.14 dev eth0 \
                                nexthop via 192.168.122.15 dev eth0
      
      Del command is successful and route is removed. After this patch
      applied, the route is correctly matched and result is:
      RTNETLINK answers: No such process
      
      Please consider this for stable trees as well.
      
      Fixes: 4e902c57 ("[IPv4]: FIB configuration using struct fib_config")
      Signed-off-by: default avatarJiri Pirko <jiri@resnulli.us>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f76936d0
    • Eric Dumazet's avatar
      tcp: fix tcp_ack() performance problem · ad971f61
      Eric Dumazet authored
      We worked hard to improve tcp_ack() performance, by not accessing
      skb_shinfo() in fast path (cd7d8498 tcp: change tcp_skb_pcount()
      location)
      
      We still have one spurious access because of ACK timestamping,
      added in commit e1c8a607 ("net-timestamp: ACK timestamp for
      bytestreams")
      
      By checking if sk_tsflags has SOF_TIMESTAMPING_TX_ACK set,
      we can avoid two cache line misses for the common case.
      
      While we are at it, add two prefetchw() :
      
      One in tcp_ack() to bring skb at the head of write queue.
      
      One in tcp_clean_rtx_queue() loop to bring following skb,
      as we will delete skb from the write queue and dirty skb->next->prev.
      
      Add a couple of [un]likely() clauses.
      
      After this patch, tcp_ack() is no longer the most consuming
      function in tcp stack.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Willem de Bruijn <willemb@google.com>
      Cc: Neal Cardwell <ncardwell@google.com>
      Cc: Yuchung Cheng <ycheng@google.com>
      Cc: Van Jacobson <vanj@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ad971f61
    • David S. Miller's avatar
      Merge branch 'isdn' · 14cee8e3
      David S. Miller authored
      Tilman Schmidt says:
      
      ====================
      Coverity patches for drivers/isdn
      
      Here's a series of patches for the ISDN CAPI subsystem and the
      Gigaset ISDN driver.
      Patches 1 to 7 are specific fixes for Coverity warnings.
      Patches 8 to 11 fix related problems with the handling of invalid
      CAPI command codes I noticed while working on this.
      Patch 12 fixes an unrelated problem I noticed during the subsequent
      regression tests.
      It would be great if these could still be merged.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      14cee8e3
    • Tilman Schmidt's avatar
      isdn/gigaset: fix usb_gigaset write_cmd result race · 86f8ef2c
      Tilman Schmidt authored
      In usb_gigaset function gigaset_write_cmd(), the length field of
      the command buffer structure could be cleared by the transmit
      tasklet before it was used for the function's return value.
      Fix by copying to a local variable before scheduling the tasklet.
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      86f8ef2c
    • Tilman Schmidt's avatar
      isdn/capi: don't return NULL from capi_cmd2str() · 340184b3
      Tilman Schmidt authored
      capi_cmd2str() is used in many places to build log messages.
      None of them is prepared to handle NULL as a result.
      Change the function to return printable string "INVALID_COMMAND"
      instead.
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      340184b3
    • Tilman Schmidt's avatar
      isdn/capi: handle CAPI 2.0 message parser failures · 2bf3a09e
      Tilman Schmidt authored
      Have callers of capi_cmsg2message and capi_message2cmsg handle
      non-zero return values indicating failure.
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2bf3a09e
    • Tilman Schmidt's avatar
      isdn/capi: prevent NULL pointer dereference on invalid CAPI command · 5510ab18
      Tilman Schmidt authored
      An invalid CAPI 2.0 command/subcommand combination may retrieve a
      NULL pointer from the cpars[] array which will later be dereferenced
      by the parser routines.
      Fix by adding NULL pointer checks in strategic places.
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5510ab18
    • Tilman Schmidt's avatar
      isdn/capi: refactor command/subcommand table accesses · 854d23b7
      Tilman Schmidt authored
      Encapsulate accesses to the CAPI 2.0 command/subcommand name and
      parameter tables in a single place in preparation for redesign.
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      854d23b7
    • Tilman Schmidt's avatar
      isdn/capi: prevent index overrun from command_2_index() · 5362247a
      Tilman Schmidt authored
      The result of the function command_2_index() is used to index two
      arrays mnames[] and cpars[] with max. index 0x4e but in its current
      form that function can produce results up to 3*(0x9+0x9)+0x7f =
      0xb5.
      Fix by clamping all result values potentially overrunning the arrays
      to zero which is already handled as an invalid value.
      
      Re-spotted with Coverity.
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5362247a
    • Tilman Schmidt's avatar
      isdn/capi: correct capi20_manufacturer argument type mismatch · 9ea8aa8d
      Tilman Schmidt authored
      Function capi20_manufacturer() is declared with unsigned int cmd
      argument but called with unsigned long.
      Fix by correcting the function prototype since the actual argument
      is part of the user visible API.
      
      Spotted with Coverity.
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9ea8aa8d
    • Tilman Schmidt's avatar
      isdn/gigaset: fix non-heap pointer deallocation · b8324f94
      Tilman Schmidt authored
      at_state structures may be allocated individually or as part of a
      cardstate or bc_state structure. The disconnect() function handled
      both cases, creating a risk that it might try to deallocate an
      at_state structure that had not been allocated individually.
      Fix by splitting disconnect() into two variants handling cases
      with and without an associated B channel separately, and adding
      an explicit check.
      
      Spotted with Coverity.
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b8324f94
    • Tilman Schmidt's avatar
      isdn/gigaset: fix NULL pointer dereference · 846ac301
      Tilman Schmidt authored
      In do_action, a NULL pointer might be passed to function start_dial
      which will dereference it.
      Fix by adding a check for NULL before the call.
      
      Spotted with Coverity.
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      846ac301
    • Tilman Schmidt's avatar
      isdn/gigaset: limit raw CAPI message dump length · 097933dd
      Tilman Schmidt authored
      In dump_rawmsg, the length field from a received data package was
      used unscrutinized, allowing an attacker to control the size of the
      allocated buffer and the number of times the output loop iterates.
      Fix by limiting to a reasonable value.
      
      Spotted with Coverity.
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      097933dd
    • Tilman Schmidt's avatar
      isdn/gigaset: make sure controller name is null terminated · ee7ff5fe
      Tilman Schmidt authored
      In gigaset_isdn_regdev, the name field may not have a null terminator
      if the source string's length is equal to the buffer size.
      Fix by zero filling the structure and excluding the last byte of the
      name field from the copy.
      
      Spotted with Coverity.
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ee7ff5fe
    • Tilman Schmidt's avatar
      isdn/gigaset: missing break in do_facility_req · 1bdc07eb
      Tilman Schmidt authored
      If we take the unsupported supplementary service notification mask
      path, we end up falling through and overwriting the error code.
      Insert a break statement to skip the remainder of the switch case
      and proceed to sending the reply message.
      
      Spotted with Coverity.
      Reported-by: default avatarDave Jones <davej@redhat.com>
      Signed-off-by: default avatarTilman Schmidt <tilman@imap.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1bdc07eb