1. 07 Jan, 2014 1 commit
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · a707271a
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "I'm hoping this is the very last batch of networking fixes for 3.13,
        here goes nothing:
      
         1) Fix crashes in VLAN's header_ops passthru.
      
         2) Bridge multicast code needs to use BH spinlocks to prevent
            deadlocks with timers.  From Curt Brune.
      
         3) ipv6 tunnels lack proper synchornization when updating percpu
            statistics.  From Li RongQing.
      
         4) Fixes to bnx2x driver from Yaniv Rosner, Dmitry Kravkov and Michal
            Kalderon.
      
         5) Avoid undefined operator evaluation order in llc code, from Daniel
            Borkmann.
      
         6) Error paths in various GSO offload paths do not unwind properly,
            in particular they must undo any modifications they have made to
            the SKB.  From Wei-Chun Chao.
      
         7) Fix RX refill races during restore in virtio-net, from Jason Wang.
      
         8) Fix SKB use after free in LLC code, from Daniel Borkmann.
      
         9) Missing unlock and OOPS in netpoll code when VLAN tag handling
            fails.
      
        10) Fix vxlan device attachment wrt ipv6, from Fan Du.
      
        11) Don't allow creating infiniband links to non-infiniband devices,
            from Hangbin Liu.
      
        12) Revert FEC phy reset active low change, it breaks things.  From
            Fabio Estevam.
      
        13) Fix header pointer handling in 6lowpan header building code, from
            Daniel Borkmann.
      
        14) Fix RSS handling in be2net driver, from Vasundhara Volam.
      
        15) Fix modem port indexing in HSO driver, from Dan Williams"
      
      * http://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (38 commits)
        bridge: use spin_lock_bh() in br_multicast_set_hash_max
        ipv6: don't install anycast address for /128 addresses on routers
        hso: fix handling of modem port SERIAL_STATE notifications
        isdn: Drop big endian cpp checks from telespci and hfc_pci drivers
        be2net: fix max_evt_qs calculation for BE3 in SR-IOV config
        be2net: increase the timeout value for loopback-test FW cmd
        be2net: disable RSS when number of RXQs is reduced to 1 via set-channels
        xen-netback: Include header for vmalloc
        net: 6lowpan: fix lowpan_header_create non-compression memcpy call
        fec: Revert "fec: Do not assume that PHY reset is active low"
        bnx2x: fix VLAN configuration for VFs.
        bnx2x: fix AFEX memory overflow
        bnx2x: Clean before update RSS arrives
        bnx2x: Correct number of MSI-X vectors for VFs
        bnx2x: limit number of interrupt vectors for 57711
        qlcnic: Fix bug in Tx completion path
        infiniband: make sure the src net is infiniband when create new link
        {vxlan, inet6} Mark vxlan_dev flags with VXLAN_F_IPV6 properly
        cxgb4: allow large buffer size to have page size
        netpoll: Fix missing TXQ unlock and and OOPS.
        ...
      a707271a
  2. 06 Jan, 2014 18 commits
  3. 05 Jan, 2014 7 commits
  4. 04 Jan, 2014 5 commits
    • Linus Torvalds's avatar
      Linux 3.13-rc7 · d6e0a2dd
      Linus Torvalds authored
      d6e0a2dd
    • Shahed Shaikh's avatar
      qlcnic: Fix bug in Tx completion path · a02bdd42
      Shahed Shaikh authored
      o Driver is using common tx_clean_lock for all Tx queues. This patch
        adds per queue tx_clean_lock.
      o Driver is not updating sw_consumer while processing Tx completion
        when interface is going down. Fixed in this patch.
      Signed-off-by: default avatarShahed Shaikh <shahed.shaikh@qlogic.com>
      Signed-off-by: default avatarManish Chopra <manish.chopra@qlogic.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a02bdd42
    • Hangbin Liu's avatar
      infiniband: make sure the src net is infiniband when create new link · 0d68fc4f
      Hangbin Liu authored
      When we create a new infiniband link with uninfiniband device, e.g. `ip link
      add link em1 type ipoib pkey 0x8001`. We will get a NULL pointer dereference
      cause other dev like Ethernet don't have struct ib_device.
      
      The code path is:
      rtnl_newlink
        |-- ipoib_new_child_link
              |-- __ipoib_vlan_add
                    |-- ipoib_set_dev_features
                          |-- ib_query_device
      
      Fix this bug by make sure the src net is infiniband when create new link.
      Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0d68fc4f
    • fan.du's avatar
      {vxlan, inet6} Mark vxlan_dev flags with VXLAN_F_IPV6 properly · 7bda701e
      fan.du authored
      Even if user doesn't supply the physical netdev to attach vxlan dev
      to, and at the same time user want to vxlan sit top of IPv6, mark
      vxlan_dev flags with VXLAN_F_IPV6 to create IPv6 based socket.
      Otherwise kernel crashes safely every time spitting below messages,
      
      Steps to reproduce:
      ip link add vxlan0 type vxlan id 42 group ff0e::110
      ip link set vxlan0 up
      
      [   62.656266] BUG: unable to handle kernel NULL pointer dereference[   62.656320] ip (3008) used greatest stack depth: 3912 bytes left
       at 0000000000000046
      [   62.656423] IP: [<ffffffff816d822d>] ip6_route_output+0xbd/0xe0
      [   62.656525] PGD 2c966067 PUD 2c9a2067 PMD 0
      [   62.656674] Oops: 0000 [#1] SMP
      [   62.656781] Modules linked in: vxlan netconsole deflate zlib_deflate af_key
      [   62.657083] CPU: 1 PID: 2128 Comm: whoopsie Not tainted 3.12.0+ #182
      [   62.657083] Hardware name: innotek GmbH VirtualBox, BIOS VirtualBox 12/01/2006
      [   62.657083] task: ffff88002e2335d0 ti: ffff88002c94c000 task.ti: ffff88002c94c000
      [   62.657083] RIP: 0010:[<ffffffff816d822d>]  [<ffffffff816d822d>] ip6_route_output+0xbd/0xe0
      [   62.657083] RSP: 0000:ffff88002fd038f8  EFLAGS: 00210296
      [   62.657083] RAX: 0000000000000000 RBX: ffff88002fd039e0 RCX: 0000000000000000
      [   62.657083] RDX: ffff88002fd0eb68 RSI: ffff88002fd0d278 RDI: ffff88002fd0d278
      [   62.657083] RBP: ffff88002fd03918 R08: 0000000002000000 R09: 0000000000000000
      [   62.657083] R10: 00000000000001ff R11: 0000000000000000 R12: 0000000000000001
      [   62.657083] R13: ffff88002d96b480 R14: ffffffff81c8e2c0 R15: 0000000000000001
      [   62.657083] FS:  0000000000000000(0000) GS:ffff88002fd00000(0063) knlGS:00000000f693b740
      [   62.657083] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
      [   62.657083] CR2: 0000000000000046 CR3: 000000002c9d2000 CR4: 00000000000006e0
      [   62.657083] Stack:
      [   62.657083]  ffff88002fd03a40 ffffffff81c8e2c0 ffff88002fd039e0 ffff88002d96b480
      [   62.657083]  ffff88002fd03958 ffffffff816cac8b ffff880019277cc0 ffff8800192b5d00
      [   62.657083]  ffff88002d5bc000 ffff880019277cc0 0000000000001821 0000000000000001
      [   62.657083] Call Trace:
      [   62.657083]  <IRQ>
      [   62.657083]  [<ffffffff816cac8b>] ip6_dst_lookup_tail+0xdb/0xf0
      [   62.657083]  [<ffffffff816caea0>] ip6_dst_lookup+0x10/0x20
      [   62.657083]  [<ffffffffa0020c13>] vxlan_xmit_one+0x193/0x9c0 [vxlan]
      [   62.657083]  [<ffffffff8137b3b7>] ? account+0xc7/0x1f0
      [   62.657083]  [<ffffffffa0021513>] vxlan_xmit+0xd3/0x400 [vxlan]
      [   62.657083]  [<ffffffff8161390d>] dev_hard_start_xmit+0x49d/0x5e0
      [   62.657083]  [<ffffffff81613d29>] dev_queue_xmit+0x2d9/0x480
      [   62.657083]  [<ffffffff817cb854>] ? _raw_write_unlock_bh+0x14/0x20
      [   62.657083]  [<ffffffff81630565>] ? eth_header+0x35/0xe0
      [   62.657083]  [<ffffffff8161bc5e>] neigh_resolve_output+0x11e/0x1e0
      [   62.657083]  [<ffffffff816ce0e0>] ? ip6_fragment+0xad0/0xad0
      [   62.657083]  [<ffffffff816cb465>] ip6_finish_output2+0x2f5/0x470
      [   62.657083]  [<ffffffff816ce166>] ip6_finish_output+0x86/0xc0
      [   62.657083]  [<ffffffff816ce218>] ip6_output+0x78/0xb0
      [   62.657083]  [<ffffffff816eadd6>] mld_sendpack+0x256/0x2a0
      [   62.657083]  [<ffffffff816ebd8c>] mld_ifc_timer_expire+0x17c/0x290
      [   62.657083]  [<ffffffff816ebc10>] ? igmp6_timer_handler+0x80/0x80
      [   62.657083]  [<ffffffff816ebc10>] ? igmp6_timer_handler+0x80/0x80
      [   62.657083]  [<ffffffff81051065>] call_timer_fn+0x45/0x150
      [   62.657083]  [<ffffffff816ebc10>] ? igmp6_timer_handler+0x80/0x80
      [   62.657083]  [<ffffffff81052353>] run_timer_softirq+0x1f3/0x2a0
      [   62.657083]  [<ffffffff8102dfd8>] ? lapic_next_event+0x18/0x20
      [   62.657083]  [<ffffffff8109e36f>] ? clockevents_program_event+0x6f/0x110
      [   62.657083]  [<ffffffff8104a2f6>] __do_softirq+0xd6/0x2b0
      [   62.657083]  [<ffffffff8104a75e>] irq_exit+0x7e/0xa0
      [   62.657083]  [<ffffffff8102ea15>] smp_apic_timer_interrupt+0x45/0x60
      [   62.657083]  [<ffffffff817d3eca>] apic_timer_interrupt+0x6a/0x70
      [   62.657083]  <EOI>
      [   62.657083]  [<ffffffff817d4a35>] ? sysenter_dispatch+0x7/0x1a
      [   62.657083] Code: 4d 8b 85 a8 02 00 00 4c 89 e9 ba 03 04 00 00 48 c7 c6 c0 be 8d 81 48 c7 c7 48 35 a3 81 31 c0 e8 db 68 0e 00 49 8b 85 a8 02 00 00 <0f> b6 40 46 c0 e8 05 0f b6 c0 c1 e0 03 41 09 c4 e9 77 ff ff ff
      [   62.657083] RIP  [<ffffffff816d822d>] ip6_route_output+0xbd/0xe0
      [   62.657083]  RSP <ffff88002fd038f8>
      [   62.657083] CR2: 0000000000000046
      [   62.657083] ---[ end trace ba8a9583d7cd1934 ]---
      [   62.657083] Kernel panic - not syncing: Fatal exception in interrupt
      Signed-off-by: default avatarFan Du <fan.du@windriver.com>
      Reported-by: default avatarRyan Whelan <rcwhelan@gmail.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7bda701e
    • Thadeu Lima de Souza Cascardo's avatar
      cxgb4: allow large buffer size to have page size · 940d9d34
      Thadeu Lima de Souza Cascardo authored
      Since commit 52367a76
      ("cxgb4/cxgb4vf: Code cleanup to enable T4 Configuration File support"),
      we have failures like this during cxgb4 probe:
      
      cxgb4 0000:01:00.4: bad SGE FL page buffer sizes [65536, 65536]
      cxgb4: probe of 0000:01:00.4 failed with error -22
      
      This happens whenever software parameters are used, without a
      configuration file. That happens when the hardware was already
      initialized (after kexec, or after csiostor is loaded).
      
      It happens that these values are acceptable, rendering fl_pg_order equal
      to 0, which is the case of a hard init when the page size is equal or
      larger than 65536.
      
      Accepting fl_large_pg equal to fl_small_pg solves the issue, and
      shouldn't cause any trouble besides a possible performance reduction
      when smaller pages are used. And that can be fixed by a configuration
      file.
      Signed-off-by: default avatarThadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      940d9d34
  5. 03 Jan, 2014 9 commits
    • Linus Torvalds's avatar
      Merge tag 'for-v3.13-fixes' of git://git.infradead.org/battery-2.6 · 9a2f1aad
      Linus Torvalds authored
      Pull battery fixes from Anton Vorontsov:
       "Two fixes:
      
         - fix build error caused by max17042_battery conversion to the regmap
           API.
      
         - fix kernel oops when booting with wakeup_source_activate enabled"
      
      * tag 'for-v3.13-fixes' of git://git.infradead.org/battery-2.6:
        max17042_battery: Fix build errors caused by missing REGMAP_I2C config
        power_supply: Fix Oops from NULL pointer dereference from wakeup_source_activate
      9a2f1aad
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-3.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 23e8e590
      Linus Torvalds authored
      Pull ACPI and PM fixes and new device IDs from Rafael Wysocki:
       "These commits, except for one, are regression fixes and the remaining
        one fixes a divide error leading to a kernel panic.  The majority of
        the regressions fixed here were introduced during the 3.12 cycle, one
        of them is from this cycle and one is older.
      
        Specifics:
      
         - VGA switcheroo was broken for some users as a result of the
           ACPI-based PCI hotplug (ACPIPHP) changes in 3.12, because some
           previously ignored hotplug events started to be handled.  The fix
           causes them to be ignored again.
      
         - There are two more issues related to cpufreq's suspend/resume
           handling changes from the 3.12 cycle addressed by Viresh Kumar's
           fixes.
      
         - intel_pstate triggers a divide error in a timer function if the
           P-state information it needs is missing during initialization.
           This leads to kernel panics on nested KVM clients and is fixed by
           failing the initialization cleanly in those cases.
      
         - PCI initalization code changes during the 3.9 cycle uncovered BIOS
           issues related to ACPI wakeup notifications (some BIOSes send them
           for devices that aren't supposed to support ACPI wakeup).  Work
           around them by installing an ACPI wakeup notify handler for all PCI
           devices with ACPI support.
      
         - The Calxeda cpuilde driver's probe function is tagged as __init,
           which is incorrect and causes a section mismatch to occur during
           build.  Fix from Andre Przywara removes the __init tag from there.
      
         - During the 3.12 cycle ACPIPHP started to print warnings about
           missing _ADR for devices that legitimately don't have it.  Fix from
           Toshi Kani makes it only print the warnings where they make sense"
      
      * tag 'pm+acpi-3.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPIPHP / radeon / nouveau: Fix VGA switcheroo problem related to hotplug
        intel_pstate: Fail initialization if P-state information is missing
        ARM/cpuidle: remove __init tag from Calxeda cpuidle probe function
        PCI / ACPI: Install wakeup notify handlers for all PCI devs with ACPI
        cpufreq: preserve user_policy across suspend/resume
        cpufreq: Clean up after a failing light-weight initialization
        ACPI / PCI / hotplug: Avoid warning when _ADR not present
      23e8e590
    • David S. Miller's avatar
      netpoll: Fix missing TXQ unlock and and OOPS. · aca5f58f
      David S. Miller authored
      The VLAN tag handling code in netpoll_send_skb_on_dev() has two problems.
      
      1) It exits without unlocking the TXQ.
      
      2) It then tries to queue a NULL skb to npinfo->txq.
      Reported-by: default avatarAhmed Tamrawi <atamrawi@iastate.edu>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      aca5f58f
    • Li RongQing's avatar
      ipv6: fix the use of pcpu_tstats in ip6_vti.c · 469bdcef
      Li RongQing authored
      when read/write the 64bit data, the correct lock should be hold.
      and we can use the generic vti6_get_stats to return stats, and
      not define a new one in ip6_vti.c
      
      Fixes: 87b6d218 ("tunnel: implement 64 bits statistics")
      Cc: Stephen Hemminger <stephen@networkplumber.org>
      Cc: Eric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarLi RongQing <roy.qing.li@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      469bdcef
    • Li RongQing's avatar
      ipv6: fix the use of pcpu_tstats in ip6_tunnel · abb6013c
      Li RongQing authored
      when read/write the 64bit data, the correct lock should be hold.
      
      Fixes: 87b6d218 ("tunnel: implement 64 bits statistics")
      
      Cc: Stephen Hemminger <stephen@networkplumber.org>
      Cc: Eric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarLi RongQing <roy.qing.li@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      abb6013c
    • Yasushi Asano's avatar
      ipv6 addrconf: fix preferred lifetime state-changing behavior while valid_lft is infinity · fad8da3e
      Yasushi Asano authored
      Fixed a problem with setting the lifetime of an IPv6
      address. When setting preferred_lft to a value not zero or
      infinity, while valid_lft is infinity(0xffffffff) preferred
      lifetime is set to forever and does not update. Therefore
      preferred lifetime never becomes deprecated. valid lifetime
      and preferred lifetime should be set independently, even if
      valid lifetime is infinity, preferred lifetime must expire
      correctly (meaning it must eventually become deprecated)
      Signed-off-by: default avatarYasushi Asano <yasushi.asano@jp.fujitsu.com>
      Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fad8da3e
    • Daniel Borkmann's avatar
      net: llc: fix use after free in llc_ui_recvmsg · 4d231b76
      Daniel Borkmann authored
      While commit 30a584d9 fixes datagram interface in LLC, a use
      after free bug has been introduced for SOCK_STREAM sockets that do
      not make use of MSG_PEEK.
      
      The flow is as follow ...
      
        if (!(flags & MSG_PEEK)) {
          ...
          sk_eat_skb(sk, skb, false);
          ...
        }
        ...
        if (used + offset < skb->len)
          continue;
      
      ... where sk_eat_skb() calls __kfree_skb(). Therefore, cache
      original length and work on skb_len to check partial reads.
      
      Fixes: 30a584d9 ("[LLX]: SOCK_DGRAM interface fixes")
      Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
      Cc: Stephen Hemminger <stephen@networkplumber.org>
      Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4d231b76
    • Jason Wang's avatar
      virtio-net: fix refill races during restore · 6cd4ce00
      Jason Wang authored
      During restoring, try_fill_recv() was called with neither napi lock nor napi
      disabled. This can lead two try_fill_recv() was called in the same time. Fix
      this by refilling before trying to enable napi.
      
      Fixes 0741bcb5
      (virtio: net: Add freeze, restore handlers to support S4).
      
      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: Rusty Russell <rusty@rustcorp.com.au>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Eric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6cd4ce00
    • Wei-Chun Chao's avatar
      ipv4: fix tunneled VM traffic over hw VXLAN/GRE GSO NIC · 7a7ffbab
      Wei-Chun Chao authored
      VM to VM GSO traffic is broken if it goes through VXLAN or GRE
      tunnel and the physical NIC on the host supports hardware VXLAN/GRE
      GSO offload (e.g. bnx2x and next-gen mlx4).
      
      Two issues -
      (VXLAN) VM traffic has SKB_GSO_DODGY and SKB_GSO_UDP_TUNNEL with
      SKB_GSO_TCP/UDP set depending on the inner protocol. GSO header
      integrity check fails in udp4_ufo_fragment if inner protocol is
      TCP. Also gso_segs is calculated incorrectly using skb->len that
      includes tunnel header. Fix: robust check should only be applied
      to the inner packet.
      
      (VXLAN & GRE) Once GSO header integrity check passes, NULL segs
      is returned and the original skb is sent to hardware. However the
      tunnel header is already pulled. Fix: tunnel header needs to be
      restored so that hardware can perform GSO properly on the original
      packet.
      Signed-off-by: default avatarWei-Chun Chao <weichunc@plumgrid.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7a7ffbab