1. 16 Jan, 2017 6 commits
    • Arnd Bergmann's avatar
      cpmac: remove hopeless #warning · d43e6fb4
      Arnd Bergmann authored
      The #warning was present 10 years ago when the driver first got merged.
      As the platform is rather obsolete by now, it seems very unlikely that
      the warning will cause anyone to fix the code properly.
      
      kernelci.org reports the warning for every build in the meantime, so
      I think it's better to just turn it into a code comment to reduce
      noise.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d43e6fb4
    • Masaru Nagai's avatar
      ravb: do not use zero-length alignment DMA descriptor · 8ec3e8a1
      Masaru Nagai authored
      Due to alignment requirements of the hardware transmissions are split into
      two DMA descriptors, a small padding descriptor of 0 - 3 bytes in length
      followed by a descriptor for rest of the packet.
      
      In the case of IP packets the first descriptor will never be zero due to
      the way that the stack aligns buffers for IP packets. However, for non-IP
      packets it may be zero.
      
      In that case it has been reported that timeouts occur, presumably because
      transmission stops at the first zero-length DMA descriptor and thus the
      packet is not transmitted. However, in my environment a BUG is triggered as
      follows:
      
      [   20.381417] ------------[ cut here ]------------
      [   20.386054] kernel BUG at lib/swiotlb.c:495!
      [   20.390324] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
      [   20.395805] Modules linked in:
      [   20.398862] CPU: 0 PID: 2089 Comm: mz Not tainted 4.10.0-rc3-00001-gf13ad2db193f #162
      [   20.406689] Hardware name: Renesas Salvator-X board based on r8a7796 (DT)
      [   20.413474] task: ffff80063b1f1900 task.stack: ffff80063a71c000
      [   20.419404] PC is at swiotlb_tbl_map_single+0x178/0x2ec
      [   20.424625] LR is at map_single+0x4c/0x98
      [   20.428629] pc : [<ffff00000839c4c0>] lr : [<ffff00000839c680>] pstate: 800001c5
      [   20.436019] sp : ffff80063a71f9b0
      [   20.439327] x29: ffff80063a71f9b0 x28: ffff80063a20d500
      [   20.444636] x27: ffff000008ed5000 x26: 0000000000000000
      [   20.449944] x25: 000000067abe2adc x24: 0000000000000000
      [   20.455252] x23: 0000000000200000 x22: 0000000000000001
      [   20.460559] x21: 0000000000175ffe x20: ffff80063b2a0010
      [   20.465866] x19: 0000000000000000 x18: 0000ffffcae6fb20
      [   20.471173] x17: 0000ffffa09ba018 x16: ffff0000087c8b70
      [   20.476480] x15: 0000ffffa084f588 x14: 0000ffffa09cfa14
      [   20.481787] x13: 0000ffffcae87ff0 x12: 000000000063abe2
      [   20.487098] x11: ffff000008096360 x10: ffff80063abe2adc
      [   20.492407] x9 : 0000000000000000 x8 : 0000000000000000
      [   20.497718] x7 : 0000000000000000 x6 : ffff000008ed50d0
      [   20.503028] x5 : 0000000000000000 x4 : 0000000000000001
      [   20.508338] x3 : 0000000000000000 x2 : 000000067abe2adc
      [   20.513648] x1 : 00000000bafff000 x0 : 0000000000000000
      [   20.518958]
      [   20.520446] Process mz (pid: 2089, stack limit = 0xffff80063a71c000)
      [   20.526798] Stack: (0xffff80063a71f9b0 to 0xffff80063a720000)
      [   20.532543] f9a0:                                   ffff80063a71fa30 ffff00000839c680
      [   20.540374] f9c0: ffff80063b2a0010 ffff80063b2a0010 0000000000000001 0000000000000000
      [   20.548204] f9e0: 000000000000006e ffff80063b23c000 ffff80063b23c000 0000000000000000
      [   20.556034] fa00: ffff80063b23c000 ffff80063a20d500 000000013b1f1900 0000000000000000
      [   20.563864] fa20: ffff80063ffd18e0 ffff80063b2a0010 ffff80063a71fa60 ffff00000839cd10
      [   20.571694] fa40: ffff80063b2a0010 0000000000000000 ffff80063ffd18e0 000000067abe2adc
      [   20.579524] fa60: ffff80063a71fa90 ffff000008096380 ffff80063b2a0010 0000000000000000
      [   20.587353] fa80: 0000000000000000 0000000000000001 ffff80063a71fac0 ffff00000864f770
      [   20.595184] faa0: ffff80063b23caf0 0000000000000000 0000000000000000 0000000000000140
      [   20.603014] fac0: ffff80063a71fb60 ffff0000087e6498 ffff80063a20d500 ffff80063b23c000
      [   20.610843] fae0: 0000000000000000 ffff000008daeaf0 0000000000000000 ffff000008daeb00
      [   20.618673] fb00: ffff80063a71fc0c ffff000008da7000 ffff80063b23c090 ffff80063a44f000
      [   20.626503] fb20: 0000000000000000 ffff000008daeb00 ffff80063a71fc0c ffff000008da7000
      [   20.634333] fb40: ffff80063b23c090 0000000000000000 ffff800600000037 ffff0000087e63d8
      [   20.642163] fb60: ffff80063a71fbc0 ffff000008807510 ffff80063a692400 ffff80063a20d500
      [   20.649993] fb80: ffff80063a44f000 ffff80063b23c000 ffff80063a69249c 0000000000000000
      [   20.657823] fba0: 0000000000000000 ffff80063a087800 ffff80063b23c000 ffff80063a20d500
      [   20.665653] fbc0: ffff80063a71fc10 ffff0000087e67dc ffff80063a20d500 ffff80063a692400
      [   20.673483] fbe0: ffff80063b23c000 0000000000000000 ffff80063a44f000 ffff80063a69249c
      [   20.681312] fc00: ffff80063a5f1a10 000000103a087800 ffff80063a71fc70 ffff0000087e6b24
      [   20.689142] fc20: ffff80063a5f1a80 ffff80063a71fde8 000000000000000f 00000000000005ea
      [   20.696972] fc40: ffff80063a5f1a10 0000000000000000 000000000000000f ffff00000887fbd0
      [   20.704802] fc60: fffffff43a5f1a80 0000000000000000 ffff80063a71fc80 ffff000008880240
      [   20.712632] fc80: ffff80063a71fd90 ffff0000087c7a34 ffff80063afc7180 0000000000000000
      [   20.720462] fca0: 0000ffffcae6fe18 0000000000000014 0000000060000000 0000000000000015
      [   20.728292] fcc0: 0000000000000123 00000000000000ce ffff0000088d2000 ffff80063b1f1900
      [   20.736122] fce0: 0000000000008933 ffff000008e7cb80 ffff80063a71fd80 ffff0000087c50a4
      [   20.743951] fd00: 0000000000008933 ffff000008e7cb80 ffff000008e7cb80 000000100000000e
      [   20.751781] fd20: ffff80063a71fe4c 0000ffff00000300 0000000000000123 0000000000000000
      [   20.759611] fd40: 0000000000000000 ffff80063b1f0000 000000000000000e 0000000000000300
      [   20.767441] fd60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
      [   20.775271] fd80: 0000000000000000 0000000000000000 ffff80063a71fda0 ffff0000087c8c20
      [   20.783100] fda0: 0000000000000000 ffff000008082f30 0000000000000000 0000800637260000
      [   20.790930] fdc0: ffffffffffffffff 0000ffffa0903078 0000000000000000 000000001ea87232
      [   20.798760] fde0: 000000000000000f ffff80063a71fe40 ffff800600000014 ffff000000000001
      [   20.806590] fe00: 0000000000000000 0000000000000000 ffff80063a71fde8 0000000000000000
      [   20.814420] fe20: 0000000000000000 0000000000000000 0000000000000000 0000000000000001
      [   20.822249] fe40: 0000000203000011 0000000000000000 0000000000000000 ffff80063a68aa00
      [   20.830079] fe60: ffff80063a68aa00 0000000000000003 0000000000008933 ffff0000081f1b9c
      [   20.837909] fe80: 0000000000000000 ffff000008082f30 0000000000000000 0000800637260000
      [   20.845739] fea0: ffffffffffffffff 0000ffffa07ca81c 0000000060000000 0000000000000015
      [   20.853569] fec0: 0000000000000003 000000001ea87232 000000000000000f 0000000000000000
      [   20.861399] fee0: 0000ffffcae6fe18 0000000000000014 0000000000000300 0000000000000000
      [   20.869228] ff00: 00000000000000ce 0000000000000000 00000000ffffffff 0000000000000000
      [   20.877059] ff20: 0000000000000002 0000ffffcae87ff0 0000ffffa09cfa14 0000ffffa084f588
      [   20.884888] ff40: 0000000000000000 0000ffffa09ba018 0000ffffcae6fb20 000000001ea87010
      [   20.892718] ff60: 0000ffffa09b9000 0000ffffcae6fe30 0000ffffcae6fe18 000000000000000f
      [   20.900548] ff80: 0000000000000003 000000001ea87232 0000000000000000 0000000000000000
      [   20.908378] ffa0: 0000000000000000 0000ffffcae6fdc0 0000ffffa09a7824 0000ffffcae6fdc0
      [   20.916208] ffc0: 0000ffffa0903078 0000000060000000 0000000000000003 00000000000000ce
      [   20.924038] ffe0: 0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff
      [   20.931867] Call trace:
      [   20.934312] Exception stack(0xffff80063a71f7e0 to 0xffff80063a71f910)
      [   20.940750] f7e0: 0000000000000000 0001000000000000 ffff80063a71f9b0 ffff00000839c4c0
      [   20.948580] f800: ffff80063a71f840 ffff00000888a6e4 ffff80063a24c418 ffff80063a24c448
      [   20.956410] f820: 0000000000000000 ffff00000811cd54 ffff80063a71f860 ffff80063a24c458
      [   20.964240] f840: ffff80063a71f870 ffff00000888b258 ffff80063a24c418 0000000000000001
      [   20.972070] f860: ffff80063a71f910 ffff80063a7b7028 ffff80063a71f890 ffff0000088825e4
      [   20.979899] f880: 0000000000000000 00000000bafff000 000000067abe2adc 0000000000000000
      [   20.987729] f8a0: 0000000000000001 0000000000000000 ffff000008ed50d0 0000000000000000
      [   20.995560] f8c0: 0000000000000000 0000000000000000 ffff80063abe2adc ffff000008096360
      [   21.003390] f8e0: 000000000063abe2 0000ffffcae87ff0 0000ffffa09cfa14 0000ffffa084f588
      [   21.011219] f900: ffff0000087c8b70 0000ffffa09ba018
      [   21.016097] [<ffff00000839c4c0>] swiotlb_tbl_map_single+0x178/0x2ec
      [   21.022362] [<ffff00000839c680>] map_single+0x4c/0x98
      [   21.027411] [<ffff00000839cd10>] swiotlb_map_page+0xa4/0x138
      [   21.033072] [<ffff000008096380>] __swiotlb_map_page+0x20/0x7c
      [   21.038821] [<ffff00000864f770>] ravb_start_xmit+0x174/0x668
      [   21.044484] [<ffff0000087e6498>] dev_hard_start_xmit+0x8c/0x120
      [   21.050407] [<ffff000008807510>] sch_direct_xmit+0x108/0x1a0
      [   21.056064] [<ffff0000087e67dc>] __dev_queue_xmit+0x194/0x4cc
      [   21.061807] [<ffff0000087e6b24>] dev_queue_xmit+0x10/0x18
      [   21.067214] [<ffff000008880240>] packet_sendmsg+0xf40/0x1220
      [   21.072873] [<ffff0000087c7a34>] sock_sendmsg+0x18/0x2c
      [   21.078097] [<ffff0000087c8c20>] SyS_sendto+0xb0/0xf0
      [   21.083150] [<ffff000008082f30>] el0_svc_naked+0x24/0x28
      [   21.088462] Code: d34bfef7 2a1803f3 1a9f86d6 35fff878 (d4210000)
      [   21.094611] ---[ end trace 5bc544ad491f3814 ]---
      [   21.099234] Kernel panic - not syncing: Fatal exception in interrupt
      [   21.105587] Kernel Offset: disabled
      [   21.109073] Memory Limit: none
      [   21.112126] ---[ end Kernel panic - not syncing: Fatal exception in interrupt
      
      Fixes: 2f45d190 ("ravb: minimize TX data copying")
      Signed-off-by: Masaru Nagai <masaru.nagai.vx@renesas.com
      Signed-off-by: default avatarSimon Horman <horms+renesas@verge.net.au>
      Acked-by: default avatarSergei Shtylyov <sergei.shtylyov@cogentembedded.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8ec3e8a1
    • Eric Dumazet's avatar
      mlx4: do not call napi_schedule() without care · 8cf699ec
      Eric Dumazet authored
      Disable BH around the call to napi_schedule() to avoid following warning
      
      [   52.095499] NOHZ: local_softirq_pending 08
      [   52.421291] NOHZ: local_softirq_pending 08
      [   52.608313] NOHZ: local_softirq_pending 08
      
      Fixes: 8d59de8f ("net/mlx4_en: Process all completions in RX rings after port goes up")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Erez Shitrit <erezsh@mellanox.com>
      Cc: Eugenia Emantayev <eugenia@mellanox.com>
      Cc: Tariq Toukan <tariqt@mellanox.com>
      Acked-by: default avatarTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8cf699ec
    • David S. Miller's avatar
      Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth · 50719195
      David S. Miller authored
      Johan Hedberg says:
      
      ====================
      pull request: bluetooth 2017-01-16
      
      Here are a couple of important 802.15.4 driver fixes for the 4.10
      kernel.
      
      Please let me know if there are any issues pulling. Thanks.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      50719195
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2017-01-13' of... · 1a717fcf
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2017-01-13' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      We have a number of fixes, in part because I was late
      in actually sending them out - will try to do better in
      the future:
       * handle VHT opmode properly when hostapd is controlling
         full station state
       * two fixes for minimum channel width in mac80211
       * don't leave SMPS set to junk in HT capabilities
       * fix headroom when forwarding mesh packets, recently
         broken by another fix that failed to take into account
         frame encryption
       * fix the TID in null-data packets indicating EOSP (end
         of service period) in U-APSD
       * prevent attempting to use (and then failing which
         results in crashes) TXQs on stations that aren't added
         to the driver yet
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1a717fcf
    • Lance Richardson's avatar
      openvswitch: maintain correct checksum state in conntrack actions · 75f01a4c
      Lance Richardson authored
      When executing conntrack actions on skbuffs with checksum mode
      CHECKSUM_COMPLETE, the checksum must be updated to account for
      header pushes and pulls. Otherwise we get "hw csum failure"
      logs similar to this (ICMP packet received on geneve tunnel
      via ixgbe NIC):
      
      [  405.740065] genev_sys_6081: hw csum failure
      [  405.740106] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G          I     4.10.0-rc3+ #1
      [  405.740108] Call Trace:
      [  405.740110]  <IRQ>
      [  405.740113]  dump_stack+0x63/0x87
      [  405.740116]  netdev_rx_csum_fault+0x3a/0x40
      [  405.740118]  __skb_checksum_complete+0xcf/0xe0
      [  405.740120]  nf_ip_checksum+0xc8/0xf0
      [  405.740124]  icmp_error+0x1de/0x351 [nf_conntrack_ipv4]
      [  405.740132]  nf_conntrack_in+0xe1/0x550 [nf_conntrack]
      [  405.740137]  ? find_bucket.isra.2+0x62/0x70 [openvswitch]
      [  405.740143]  __ovs_ct_lookup+0x95/0x980 [openvswitch]
      [  405.740145]  ? netif_rx_internal+0x44/0x110
      [  405.740149]  ovs_ct_execute+0x147/0x4b0 [openvswitch]
      [  405.740153]  do_execute_actions+0x22e/0xa70 [openvswitch]
      [  405.740157]  ovs_execute_actions+0x40/0x120 [openvswitch]
      [  405.740161]  ovs_dp_process_packet+0x84/0x120 [openvswitch]
      [  405.740166]  ovs_vport_receive+0x73/0xd0 [openvswitch]
      [  405.740168]  ? udp_rcv+0x1a/0x20
      [  405.740170]  ? ip_local_deliver_finish+0x93/0x1e0
      [  405.740172]  ? ip_local_deliver+0x6f/0xe0
      [  405.740174]  ? ip_rcv_finish+0x3a0/0x3a0
      [  405.740176]  ? ip_rcv_finish+0xdb/0x3a0
      [  405.740177]  ? ip_rcv+0x2a7/0x400
      [  405.740180]  ? __netif_receive_skb_core+0x970/0xa00
      [  405.740185]  netdev_frame_hook+0xd3/0x160 [openvswitch]
      [  405.740187]  __netif_receive_skb_core+0x1dc/0xa00
      [  405.740194]  ? ixgbe_clean_rx_irq+0x46d/0xa20 [ixgbe]
      [  405.740197]  __netif_receive_skb+0x18/0x60
      [  405.740199]  netif_receive_skb_internal+0x40/0xb0
      [  405.740201]  napi_gro_receive+0xcd/0x120
      [  405.740204]  gro_cell_poll+0x57/0x80 [geneve]
      [  405.740206]  net_rx_action+0x260/0x3c0
      [  405.740209]  __do_softirq+0xc9/0x28c
      [  405.740211]  irq_exit+0xd9/0xf0
      [  405.740213]  do_IRQ+0x51/0xd0
      [  405.740215]  common_interrupt+0x93/0x93
      
      Fixes: 7f8a436e ("openvswitch: Add conntrack action")
      Signed-off-by: default avatarLance Richardson <lrichard@redhat.com>
      Acked-by: default avatarPravin B Shelar <pshelar@ovn.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      75f01a4c
  2. 13 Jan, 2017 5 commits
    • Shannon Nelson's avatar
      tcp: fix tcp_fastopen unaligned access complaints on sparc · 003c9410
      Shannon Nelson authored
      Fix up a data alignment issue on sparc by swapping the order
      of the cookie byte array field with the length field in
      struct tcp_fastopen_cookie, and making it a proper union
      to clean up the typecasting.
      
      This addresses log complaints like these:
          log_unaligned: 113 callbacks suppressed
          Kernel unaligned access at TPC[976490] tcp_try_fastopen+0x2d0/0x360
          Kernel unaligned access at TPC[9764ac] tcp_try_fastopen+0x2ec/0x360
          Kernel unaligned access at TPC[9764c8] tcp_try_fastopen+0x308/0x360
          Kernel unaligned access at TPC[9764e4] tcp_try_fastopen+0x324/0x360
          Kernel unaligned access at TPC[976490] tcp_try_fastopen+0x2d0/0x360
      
      Cc: Eric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarShannon Nelson <shannon.nelson@oracle.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      003c9410
    • David Lebrun's avatar
      ipv6: sr: fix several BUGs when preemption is enabled · fa79581e
      David Lebrun authored
      When CONFIG_PREEMPT=y, CONFIG_IPV6=m and CONFIG_SEG6_HMAC=y,
      seg6_hmac_init() is called during the initialization of the ipv6 module.
      This causes a subsequent call to smp_processor_id() with preemption
      enabled, resulting in the following trace.
      
      [   20.451460] BUG: using smp_processor_id() in preemptible [00000000] code: systemd/1
      [   20.452556] caller is debug_smp_processor_id+0x17/0x19
      [   20.453304] CPU: 0 PID: 1 Comm: systemd Not tainted 4.9.0-rc5-00973-g46738b13 #1
      [   20.454406]  ffffc9000062fc18 ffffffff813607b2 0000000000000000 ffffffff81a7f782
      [   20.455528]  ffffc9000062fc48 ffffffff813778dc 0000000000000000 00000000001dcf98
      [   20.456539]  ffffffffa003bd08 ffffffff81af93e0 ffffc9000062fc58 ffffffff81377905
      [   20.456539] Call Trace:
      [   20.456539]  [<ffffffff813607b2>] dump_stack+0x63/0x7f
      [   20.456539]  [<ffffffff813778dc>] check_preemption_disabled+0xd1/0xe3
      [   20.456539]  [<ffffffff81377905>] debug_smp_processor_id+0x17/0x19
      [   20.460260]  [<ffffffffa0061f3b>] seg6_hmac_init+0xfa/0x192 [ipv6]
      [   20.460260]  [<ffffffffa0061ccc>] seg6_init+0x39/0x6f [ipv6]
      [   20.460260]  [<ffffffffa006121a>] inet6_init+0x21a/0x321 [ipv6]
      [   20.460260]  [<ffffffffa0061000>] ? 0xffffffffa0061000
      [   20.460260]  [<ffffffff81000457>] do_one_initcall+0x8b/0x115
      [   20.460260]  [<ffffffff811328a3>] do_init_module+0x53/0x1c4
      [   20.460260]  [<ffffffff8110650a>] load_module+0x1153/0x14ec
      [   20.460260]  [<ffffffff81106a7b>] SYSC_finit_module+0x8c/0xb9
      [   20.460260]  [<ffffffff81106a7b>] ? SYSC_finit_module+0x8c/0xb9
      [   20.460260]  [<ffffffff81106abc>] SyS_finit_module+0x9/0xb
      [   20.460260]  [<ffffffff810014d1>] do_syscall_64+0x62/0x75
      [   20.460260]  [<ffffffff816834f0>] entry_SYSCALL64_slow_path+0x25/0x25
      
      Moreover, dst_cache_* functions also call smp_processor_id(), generating
      a similar trace.
      
      This patch uses raw_cpu_ptr() in seg6_hmac_init() rather than this_cpu_ptr()
      and disable preemption when using dst_cache_* functions.
      Signed-off-by: default avatarDavid Lebrun <david.lebrun@uclouvain.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fa79581e
    • Florian Fainelli's avatar
      net: systemport: Decouple flow control from __bcm_sysport_tx_reclaim · 148d3d02
      Florian Fainelli authored
      The __bcm_sysport_tx_reclaim() function is used to reclaim transmit
      resources in different places within the driver. Most of them should
      not affect the state of the transit flow control.
      
      Introduce bcm_sysport_tx_clean() which cleans the ring, but does not
      re-enable flow control towards the networking stack, and make
      bcm_sysport_tx_reclaim() do the actual transmit queue flow control.
      
      Fixes: 80105bef ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      148d3d02
    • Michal Kazior's avatar
      mac80211: prevent skb/txq mismatch · dbef5362
      Michal Kazior authored
      Station structure is considered as not uploaded
      (to driver) until drv_sta_state() finishes. This
      call is however done after the structure is
      attached to mac80211 internal lists and hashes.
      This means mac80211 can lookup (and use) station
      structure before it is uploaded to a driver.
      
      If this happens (structure exists, but
      sta->uploaded is false) fast_tx path can still be
      taken. Deep in the fastpath call the sta->uploaded
      is checked against to derive "pubsta" argument for
      ieee80211_get_txq(). If sta->uploaded is false
      (and sta is actually non-NULL) ieee80211_get_txq()
      effectively downgraded to vif->txq.
      
      At first glance this may look innocent but coerces
      mac80211 into a state that is almost guaranteed
      (codel may drop offending skb) to crash because a
      station-oriented skb gets queued up on
      vif-oriented txq. The ieee80211_tx_dequeue() ends
      up looking at info->control.flags and tries to use
      txq->sta which in the fail case is NULL.
      
      It's probably pointless to pretend one can
      downgrade skb from sta-txq to vif-txq.
      
      Since downgrading unicast traffic to vif->txq must
      not be done there's no txq to put a frame on if
      sta->uploaded is false. Therefore the code is made
      to fall back to regular tx() op path if the
      described condition is hit.
      
      Only drivers using wake_tx_queue were affected.
      
      Example crash dump before fix:
      
       Unable to handle kernel paging request at virtual address ffffe26c
       PC is at ieee80211_tx_dequeue+0x204/0x690 [mac80211]
       [<bf4252a4>] (ieee80211_tx_dequeue [mac80211]) from
       [<bf4b1388>] (ath10k_mac_tx_push_txq+0x54/0x1c0 [ath10k_core])
       [<bf4b1388>] (ath10k_mac_tx_push_txq [ath10k_core]) from
       [<bf4bdfbc>] (ath10k_htt_txrx_compl_task+0xd78/0x11d0 [ath10k_core])
       [<bf4bdfbc>] (ath10k_htt_txrx_compl_task [ath10k_core])
       [<bf51c5a4>] (ath10k_pci_napi_poll+0x54/0xe8 [ath10k_pci])
       [<bf51c5a4>] (ath10k_pci_napi_poll [ath10k_pci]) from
       [<c0572e90>] (net_rx_action+0xac/0x160)
      Reported-by: default avatarMohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
      Signed-off-by: default avatarMichal Kazior <michal.kazior@tieto.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      dbef5362
    • Felix Fietkau's avatar
      mac80211: initialize SMPS field in HT capabilities · 43071d8f
      Felix Fietkau authored
      ibss and mesh modes copy the ht capabilites from the band without
      overriding the SMPS state. Unfortunately the default value 0 for the
      SMPS field means static SMPS instead of disabled.
      
      This results in HT ibss and mesh setups using only single-stream rates,
      even though SMPS is not supposed to be active.
      
      Initialize SMPS to disabled for all bands on ieee80211_hw_register to
      ensure that the value is sane where it is not overriden with the real
      SMPS state.
      Reported-by: default avatarElektra Wagenrad <onelektra@gmx.net>
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      [move VHT TODO comment to a better place]
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      43071d8f
  3. 12 Jan, 2017 14 commits
  4. 11 Jan, 2017 15 commits
    • stephen hemminger's avatar
      netvsc: add rcu_read locking to netvsc callback · 0719e72c
      stephen hemminger authored
      The receive callback (in tasklet context) is using RCU to get reference
      to associated VF network device but this is not safe. RCU read lock
      needs to be held. Found by running with full lockdep debugging
      enabled.
      
      Fixes: f207c10d ("hv_netvsc: use RCU to protect vf_netdev")
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0719e72c
    • Martynas Pumputis's avatar
      vxlan: Set ports in flow key when doing route lookups · 4ecb1d83
      Martynas Pumputis authored
      Otherwise, a xfrm policy with sport/dport being set cannot be matched.
      Signed-off-by: default avatarMartynas Pumputis <martynas@weave.works>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4ecb1d83
    • hayeswang's avatar
      r8152: fix the sw rx checksum is unavailable · 19c0f40d
      hayeswang authored
      Fix the hw rx checksum is always enabled, and the user couldn't switch
      it to sw rx checksum.
      
      Note that the RTL_VER_01 only support sw rx checksum only. Besides,
      the hw rx checksum for RTL_VER_02 is disabled after
      commit b9a321b4 ("r8152: Fix broken RX checksums."). Re-enable it.
      Signed-off-by: default avatarHayes Wang <hayeswang@realtek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      19c0f40d
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · ba836a6f
      Linus Torvalds authored
      Merge fixes from Andrew Morton:
       "27 fixes.
      
        There are three patches that aren't actually fixes. They're simple
        function renamings which are nice-to-have in mainline as ongoing net
        development depends on them."
      
      * akpm: (27 commits)
        timerfd: export defines to userspace
        mm/hugetlb.c: fix reservation race when freeing surplus pages
        mm/slab.c: fix SLAB freelist randomization duplicate entries
        zram: support BDI_CAP_STABLE_WRITES
        zram: revalidate disk under init_lock
        mm: support anonymous stable page
        mm: add documentation for page fragment APIs
        mm: rename __page_frag functions to __page_frag_cache, drop order from drain
        mm: rename __alloc_page_frag to page_frag_alloc and __free_page_frag to page_frag_free
        mm, memcg: fix the active list aging for lowmem requests when memcg is enabled
        mm: don't dereference struct page fields of invalid pages
        mailmap: add codeaurora.org names for nameless email commits
        signal: protect SIGNAL_UNKILLABLE from unintentional clearing.
        mm: pmd dirty emulation in page fault handler
        ipc/sem.c: fix incorrect sem_lock pairing
        lib/Kconfig.debug: fix frv build failure
        mm: get rid of __GFP_OTHER_NODE
        mm: fix remote numa hits statistics
        mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done}
        ocfs2: fix crash caused by stale lvb with fsdlm plugin
        ...
      ba836a6f
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · cff3b2c4
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix rtlwifi crash, from Larry Finger.
      
       2) Memory disclosure in appletalk ipddp routing code, from Vlad
          Tsyrklevich.
      
       3) r8152 can erroneously split an RX packet into multiple URBs if the
          Rx FIFO is not empty when we suspend. Fix this by waiting for the
          FIFO to empty before suspending. From Hayes Wang.
      
       4) Two GRO fixes (enter slow path when not enough SKB tail room exists,
          disable frag0 optimizations when there are IPV6 extension headers)
          from Eric Dumazet and Herbert Xu.
      
       5) A series of mlx5e bug fixes (do source udp port offloading for
          tunnels properly, Ip fragment matching fixes, handling firmware
          errors properly when installing TC rules, etc.) from Saeed Mahameed,
          Or Gerlitz, Roi Dayan, Hadar Hen Zion, Gil Rockah, and Daniel
          Jurgens.
      
       6) Two VRF fixes from David Ahern (don't skip multipath selection for
          VRF paths, disallow VRF to be configured with table ID 0).
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (35 commits)
        net: vrf: do not allow table id 0
        net: phy: marvell: fix Marvell 88E1512 used in SGMII mode
        sctp: Fix spelling mistake: "Atempt" -> "Attempt"
        net: ipv4: Fix multipath selection with vrf
        cgroup: move CONFIG_SOCK_CGROUP_DATA to init/Kconfig
        gro: use min_t() in skb_gro_reset_offset()
        net/mlx5: Only cancel recovery work when cleaning up device
        net/mlx5e: Remove WARN_ONCE from adaptive moderation code
        net/mlx5e: Un-register uplink representor on nic_disable
        net/mlx5e: Properly handle FW errors while adding TC rules
        net/mlx5e: Fix kbuild warnings for uninitialized parameters
        net/mlx5e: Set inline mode requirements for matching on IP fragments
        net/mlx5e: Properly get address type of encapsulation IP headers
        net/mlx5e: TC ipv4 tunnel encap offload error flow fixes
        net/mlx5e: Warn when rejecting offload attempts of IP tunnels
        net/mlx5e: Properly handle offloading of source udp port for IP tunnels
        gro: Disable frag0 optimization on IPv6 ext headers
        gro: Enter slow-path if there is no tailroom
        mlx4: Return EOPNOTSUPP instead of ENOTSUPP
        net/af_iucv: don't use paged skbs for TX on HiperSockets
        ...
      cff3b2c4
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · a6b6e616
      Linus Torvalds authored
      Pull crypto fix from Herbert Xu:
       "This fixes a regression in aesni that renders it useless if it's
        built-in with a modular pcbc configuration"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: aesni - Fix failure when built-in with modular pcbc
      a6b6e616
    • Johannes Berg's avatar
      mac80211: recalculate min channel width on VHT opmode changes · d2941df8
      Johannes Berg authored
      When an associated station changes its VHT operating mode this
      can/will affect the bandwidth it's using, and consequently we
      must recalculate the minimum bandwidth we need to use. Failure
      to do so can lead to one of two scenarios:
       1) we use a too high bandwidth, this is benign
       2) we use a too narrow bandwidth, causing rate control and
          actual PHY configuration to be out of sync, which can in
          turn cause problems/crashes
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      d2941df8
    • Johannes Berg's avatar
      mac80211: calculate min channel width correctly · 96aa2e7c
      Johannes Berg authored
      In the current minimum chandef code there's an issue in that the
      recalculation can happen after rate control is initialized for a
      station that has a wider bandwidth than the current chanctx, and
      then rate control can immediately start using those higher rates
      which could cause problems.
      
      Observe that first of all that this problem is because we don't
      take non-associated and non-uploaded stations into account. The
      restriction to non-associated is quite pointless and is one of
      the causes for the problem described above, since the rate init
      will happen before the station is set to associated; no frames
      could actually be sent until associated, but the rate table can
      already contain higher rates and that might cause problems.
      
      Also, rejecting non-uploaded stations is wrong, since the rate
      control can select higher rates for those as well.
      
      Secondly, it's then necessary to recalculate the minimal config
      before initializing rate control, so that when rate control is
      initialized, the higher rates are already available. This can be
      done easily by adding the necessary function call in rate init.
      
      Change-Id: Ib9bc02d34797078db55459d196993f39dcd43070
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      96aa2e7c
    • Beni Lev's avatar
      cfg80211: consider VHT opmode on station update · 06f7c88c
      Beni Lev authored
      Currently, this attribute is only fetched on station addition, but
      not on station change. Since this info is only present in the assoc
      request, with full station state support in the driver it cannot be
      present when the station is added.
      
      Thus, add support for changing the VHT opmode on station update if
      done before (or while) the station is marked as associated. After
      this, ignore it, since it used to be ignored.
      Signed-off-by: default avatarBeni Lev <beni.lev@intel.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      06f7c88c
    • Emmanuel Grumbach's avatar
      mac80211: fix the TID on NDPs sent as EOSP carrier · d7f84244
      Emmanuel Grumbach authored
      In the commit below, I forgot to translate the mac80211's
      AC to QoS IE order. Moreover, the condition in the if was
      wrong. Fix both issues.
      This bug would hit only with clients that didn't set all
      the ACs as delivery enabled.
      
      Fixes: f438ceb8 ("mac80211: uapsd_queues is in QoS IE order")
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      d7f84244
    • Cedric Izoard's avatar
      mac80211: Fix headroom allocation when forwarding mesh pkt · c38c39bf
      Cedric Izoard authored
      This patch fix issue introduced by my previous commit that
      tried to ensure enough headroom was present, and instead
      broke it.
      
      When forwarding mesh pkt, mac80211 may also add security header,
      and it must therefore be taken into account in the needed headroom.
      
      Fixes: d8da0b5d ("mac80211: Ensure enough headroom when forwarding mesh pkt")
      Signed-off-by: default avatarCedric Izoard <cedric.izoard@ceva-dsp.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      c38c39bf
    • David Ahern's avatar
      net: vrf: do not allow table id 0 · 24c63bbc
      David Ahern authored
      Frank reported that vrf devices can be created with a table id of 0.
      This breaks many of the run time table id checks and should not be
      allowed. Detect this condition at create time and fail with EINVAL.
      
      Fixes: 193125db ("net: Introduce VRF device driver")
      Reported-by: default avatarFrank Kellermann <frank.kellermann@atos.net>
      Signed-off-by: default avatarDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      24c63bbc
    • Russell King's avatar
      net: phy: marvell: fix Marvell 88E1512 used in SGMII mode · a13c0652
      Russell King authored
      When an Marvell 88E1512 PHY is connected to a nic in SGMII mode, the
      fiber page is used for the SGMII host-side connection.  The PHY driver
      notices that SUPPORTED_FIBRE is set, so it tries reading the fiber page
      for the link status, and ends up reading the MAC-side status instead of
      the outgoing (copper) link.  This leads to incorrect results reported
      via ethtool.
      
      If the PHY is connected via SGMII to the host, ignore the fiber page.
      However, continue to allow the existing power management code to
      suspend and resume the fiber page.
      
      Fixes: 6cfb3bcc ("Marvell phy: check link status in case of fiber link.")
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a13c0652
    • Colin Ian King's avatar
      sctp: Fix spelling mistake: "Atempt" -> "Attempt" · eb004603
      Colin Ian King authored
      Trivial fix to spelling mistake in WARN_ONCE message
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      eb004603
    • David Ahern's avatar
      net: ipv4: Fix multipath selection with vrf · 7a18c5b9
      David Ahern authored
      fib_select_path does not call fib_select_multipath if oif is set in the
      flow struct. For VRF use cases oif is always set, so multipath route
      selection is bypassed. Use the FLOWI_FLAG_SKIP_NH_OIF to skip the oif
      check similar to what is done in fib_table_lookup.
      
      Add saddr and proto to the flow struct for the fib lookup done by the
      VRF driver to better match hash computation for a flow.
      
      Fixes: 613d09b3 ("net: Use VRF device index for lookups on TX")
      Signed-off-by: default avatarDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7a18c5b9