AgeCommit message (Collapse)AuthorFilesLines
2016-07-05ipv6: Fix mem leak in rt6i_pcpuMartin KaFai Lau1-0/+1
It was first reported and reproduced by Petr (thanks!) in free_percpu(rt->rt6i_pcpu) used to always happen in ip6_dst_destroy(). However, after fixing a deadlock bug in commit 9c7370a166b4 ("ipv6: Fix a potential deadlock when creating pcpu rt"), free_percpu() is not called before setting non_pcpu_rt->rt6i_pcpu to NULL. It is worth to note that rt6i_pcpu is protected by table->tb6_lock. kmemleak somehow did not report it. We nailed it down by observing the pcpu entries in /proc/vmallocinfo (first suggested by Hannes, thanks!). Signed-off-by: Martin KaFai Lau <> Fixes: 9c7370a166b4 ("ipv6: Fix a potential deadlock when creating pcpu rt") Reported-by: Petr Novopashenniy <> Tested-by: Petr Novopashenniy <> Acked-by: Hannes Frederic Sowa <> Cc: Hannes Frederic Sowa <> Cc: Petr Novopashenniy <> Signed-off-by: David S. Miller <>
2016-07-05net: fix decnet rtnexthop parsingVegard Nossum1-9/+12
dn_fib_count_nhs() could enter an infinite loop if nhp->rtnh_len == 0 (i.e. if userspace passes a malformed netlink message). Let's use the helpers from net/nexthop.h which take care of all this stuff. We can do exactly the same as e.g. fib_count_nexthops() and fib_get_nhs() from net/ipv4/fib_semantics.c. This fixes the softlockup for me. Cc: Thomas Graf <> Signed-off-by: Vegard Nossum <> Signed-off-by: David S. Miller <>
2016-07-05cxgb4: update latest firmware version supportedGanesh Goudar1-6/+6
Change t4fw_version.h to update latest firmware version number Signed-off-by: Ganesh Goudar <> Signed-off-by: David S. Miller <>
2016-07-05net/mlx5: Avoid setting unused var when modifying vport node GUIDOr Gerlitz1-3/+0
GCC complains on unused-but-set-variable, clean this up. Fixes: 23898c763f4a ('net/mlx5: E-Switch, Modify node guid on vf set MAC') Signed-off-by: Or Gerlitz <> Acked-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-05bonding: fix enslavement slave link notificationsAviv Heller1-0/+1
Currently, link notifications are not sent by bond_set_slave_link_state() upon enslavement if the slave is enslaved when up. This happens because slave->link default init value is 0, which is the same as BOND_LINK_UP, resulting in bond_set_slave_link_state() ignoring this transition. This patch sets the default value of slave->link to BOND_LINK_NOCHANGE, assuring it will count as a state transition and thus trigger notification logic. Signed-off-by: Aviv Heller <> Reviewed-by: Jiri Pirko <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-05r8152: fix runtime function for RTL8152hayeswang1-7/+17
The RTL8152 doesn't have U1U2 and U2P3 features, so use different runtime functions for RTL812 and RTL8153 by adding autosuspend_en() to rtl_ops. Signed-off-by: Hayes Wang <> Signed-off-by: David S. Miller <>
2016-07-04qeth: delete napi struct when removing a qeth deviceUrsula Braun2-0/+2
A qeth_card contains a napi_struct linked to the net_device during device probing. This struct must be deleted when removing the qeth device, otherwise Panic on oops can occur when qeth devices are repeatedly removed and added. Fixes: a1c3ed4c9ca ("qeth: NAPI support for l2 and l3 discipline") Cc: # v2.6.37+ Signed-off-by: Ursula Braun <> Tested-by: Alexander Klein <> Signed-off-by: David S. Miller <>
2016-07-04Revert "fsl/fman: fix error handling"David S. Miller1-1/+1
This reverts commit a788a4a040e003574b8ad17115706ab1601ec572. This patch is wrong, the type returned doesn't fit what the error pointer macros expect. Signed-off-by: David S. Miller <>
2016-07-04fsl/fman: fix error handlingChristophe Jaillet1-1/+1
This is likely that checking 'fman->fifo_offset' instead of 'fman->cam_offset' is expected here. Signed-off-by: Christophe JAILLET <> Signed-off-by: David S. Miller <>
2016-07-04cdc_ncm: workaround for EM7455 "silent" data interfaceBjørn Mork1-0/+7
Several Lenovo users have reported problems with their Sierra Wireless EM7455 modem. The driver has loaded successfully and the MBIM management channel has appeared to work, including establishing a connection to the mobile network. But no frames have been received over the data interface. The problem affects all EM7455 and MC7455, and is assumed to affect other modems based on the same Qualcomm chipset and baseband firmware. Testing narrowed the problem down to what seems to be a firmware timing bug during initialization. Adding a short sleep while probing is sufficient to make the problem disappear. Experiments have shown that 1-2 ms is too little to have any effect, while 10-20 ms is enough to reliably succeed. Reported-by: Stefan Armbruster <> Reported-by: Ralph Plawetzki <> Reported-by: Andreas Fett <> Reported-by: Rasmus Lerdorf <> Reported-by: Samo Ratnik <> Reported-and-tested-by: Aleksander Morgado <> Signed-off-by: Bjørn Mork <> Signed-off-by: David S. Miller <>
2016-07-04RDS: fix rds_tcp_init() error pathVegard Nossum1-2/+3
If register_pernet_subsys() fails, we shouldn't try to call unregister_pernet_subsys(). Fixes: 467fa15356 ("RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.") Cc: Cc: Sowmini Varadhan <> Cc: David S. Miller <> Signed-off-by: Vegard Nossum <> Acked-by: Sowmini Varadhan <> Acked-by: Santosh Shilimkar <> Signed-off-by: David S. Miller <>
2016-07-04geneve: fix max_mtu settingHaishuang Yan1-2/+7
For ipv6+udp+geneve encapsulation data, the max_mtu should subtract sizeof(ipv6hdr), instead of sizeof(iphdr). Signed-off-by: Haishuang Yan <> Signed-off-by: David S. Miller <>
2016-07-02net: phy: dp83867: Fix initialization of PHYCR registerStefan Hauser1-4/+9
When initializing the PHY control register, the FIFO depth bits are written without reading the previous register value, i.e. all other bits are overwritten with zero. This disables automatic MDI-X configuration, which is enabled by default. Fix initialization by doing a read/modify/write operation. Signed-off-by: Stefan Hauser <> Reviewed-by: Florian Fainelli <> Signed-off-by: David S. Miller <>
2016-07-02enc28j60: Fix race condition in enc28j60 driverSergio Valverde1-2/+5
The interrupt worker code for the enc28j60 relies only on the TXIF flag to determinate if the packet transmission was completed. However the datasheet specifies in section 12.1.3 that TXERIF will clear the TXRTS after a transmit abort. Also in section 12.1.4 that TXIF will be set when TXRTS transitions from '1' to '0'. Therefore the TXIF flag is enabled during transmission errors. This causes a race condition, since the worker code will invoke enc28j60_tx_clear() -> netif_wake_queue(), potentially invoking the ndo_start_xmit function to send a new packet. The enc28j60_send_packet function uses a workqueue that invokes enc28j60_hw_tx(). In between this function is called, the worker from the interrupt handler will enter the path for error handler because of the TXERIF flag, causing to invoke enc28j60_tx_clear() again and releasing the packet scheduled for transmission, causing a kernel crash with due a NULL pointer. These crashes due a NULL pointer were observed under stress conditions of the device. A BUG_ON() sequence was used to validate the issue was fixed, and has been running without problems for 2 years now. Signed-off-by: Diego Dompe <> Acked-by: Sergio Valverde <> Signed-off-by: David S. Miller <>
2016-07-02net: stmmac: Fix null-function call in ISR on stmmac1000Matt Corallo1-1/+1
(resent due to overhelpful mail client corrupting patch) At least on Meson GXBB, the CORE_IRQ_MTL_RX_OVERFLOW interrupt is thrown with the stmmac1000 driver, which does not support set_rx_tail_ptr. With this patch and the clock fixes, 1G ethernet works on ODROID-C2. Signed-off-by: Matt Corallo <> Signed-off-by: David S. Miller <>
2016-07-01tipc: fix nl compat regression for link statisticsRichard Alpe1-1/+1
Fix incorrect use of nla_strlcpy() where the first NLA_HDRLEN bytes of the link name where left out. Making the output of tipc-config -ls look something like: Link statistics: dcast-link 1:data0-1.1.2:data0 1:data0-1.1.3:data0 Also, for the record, the patch that introduce this regression claims "Sending the whole object out can cause a leak". Which isn't very likely as this is a compat layer, where the data we are parsing is generated by us and we know the string to be NULL terminated. But you can of course never be to secure. Fixes: 5d2be1422e02 (tipc: fix an infoleak in tipc_nl_compat_link_dump) Signed-off-by: Richard Alpe <> Signed-off-by: David S. Miller <>
2016-07-01net: bcmsysport: Device stats are unsigned longFlorian Fainelli1-1/+1
On 64bits kernels, device stats are 64bits wide, not 32bits. Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver") Signed-off-by: Florian Fainelli <> Signed-off-by: David S. Miller <>
2016-07-01macsec: set actual real device for xmit when !protect_framesDaniel Borkmann1-0/+1
Avoid recursions of dev_queue_xmit() to the wrong net device when frames are unprotected, since at that time skb->dev still points to our own macsec dev and unlike macsec_encrypt_finish() dev pointer doesn't get updated to real underlying device. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Daniel Borkmann <> Acked-by: Sabrina Dubroca <> Acked-by: Hannes Frederic Sowa <> Signed-off-by: David S. Miller <>
2016-07-01net_sched: fix mirrored packets checksumWANG Cong3-19/+20
Similar to commit 9b368814b336 ("net: fix bridge multicast packet checksum validation") we need to fixup the checksum for CHECKSUM_COMPLETE when pushing skb on RX path. Otherwise we get similar splats. Cc: Jamal Hadi Salim <> Cc: Tom Herbert <> Signed-off-by: Cong Wang <> Acked-by: Jamal Hadi Salim <> Signed-off-by: David S. Miller <>
2016-07-01packet: Use symmetric hash for PACKET_FANOUT_HASH.David S. Miller3-1/+45
People who use PACKET_FANOUT_HASH want a symmetric hash, meaning that they want packets going in both directions on a flow to hash to the same bucket. The core kernel SKB hash became non-symmetric when the ipv6 flow label and other entities were incorporated into the standard flow hash order to increase entropy. But there are no users of PACKET_FANOUT_HASH who want an assymetric hash, they all want a symmetric one. Therefore, use the flow dissector to compute a flat symmetric hash over only the protocol, addresses and ports. This hash does not get installed into and override the normal skb hash, so this change has no effect whatsoever on the rest of the stack. Reported-by: Eric Leblond <> Tested-by: Eric Leblond <> Signed-off-by: David S. Miller <>
2016-07-01Merge branch 'mlx5-fixes'David S. Miller10-121/+335
Saeed Mahameed says: ==================== Mellanox 100G mlx5 resiliency and xmit path fixes This series provides two set of fixes to the mlx5 driver: - Resiliency fixes for reset flow and internal pci errors - xmit path fixes Please consider queuing those patches for -stable (4.6). Reset flow fixes for core driver: - Add more commands to the list of error simulated commands when pci errors occur - Avoid calling sleeping function by the health poll thread - Fix incorrect page count when in internal error - Fix timeout in wait vital for VFs - Deadlock fix and Timeout handling in commands interface Reset flow and resiliency fixes for mlx5e netdev driver: - Handle RQ flush in error cases - Implement ndo_tx_timeout callback - Timeout if SQ doesn't flush during close - Log link state changes - Validate BW weight values of ETS xmit path fixes: - Fix wrong fallback assumption in select queue callback - Account for all L2 headers when copying headers into inline segment ==================== Signed-off-by: David S. Miller <>
2016-07-01net/mlx5e: Log link state changesShaker Daibes1-2/+5
Add Link UP/Down prints to kernel log when link state changes Signed-off-by: Shaker Daibes <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5e: Validate BW weight values of ETSRana Shahout2-3/+6
Valid weight assigned to ETS TClass values are 1-100 Fixes: 08fb1dacdd76 ('net/mlx5e: Support DCBNL IEEE ETS') Signed-off-by: Rana Shahout <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5e: Fix select queue callbackRana Shahout2-3/+18
The default fallback function used by mlx5e select queue can return any TX queues in range [>num_real_tx_queues). The current implementation assumes that the fallback function returns a number in the range [0.. number of channels). Actually dev->num_real_tx_queues = (number of channels) * dev->num_tc; which is more than the expected range if num_tc is configured and could lead to crashes. To fix this we test if num_tc is not configured we can safely return the fallback suggestion, if not we will reciprocal_scale the fallback result and normalize it to the desired range. Fixes: 08fb1dacdd76 ('net/mlx5e: Support DCBNL IEEE ETS') Signed-off-by: Rana Shahout <> Signed-off-by: Saeed Mahameed <> Reported-by: Doug Ledford <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5e: Copy all L2 headers into inline segmentMatthew Finlay1-2/+2
ConnectX4-Lx uses an inline wqe mode that currently defaults to requiring the entire L2 header be included in the wqe. This patch fixes mlx5e_get_inline_hdr_size() to account for all L2 headers (VLAN, QinQ, etc) using skb_network_offset(skb). Fixes: e586b3b0baee ("net/mlx5: Ethernet Datapath files") Signed-off-by: Matthew Finlay <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5e: Handle RQ flush in error casesDaniel Jurgens3-3/+61
Add a timeout to avoid an infinite loop waiting for RQ's to flush. This occurs during AER/EEH and will also happen if the device stops posting completions due to internal error or reset, or if moving the RQ to the error state fails. Also cleanup posted receive resources when closing the RQ. Fixes: f62b8bb8f2d3 ('net/mlx5: Extend mlx5_core to support ConnectX-4 Ethernet functionality') Signed-off-by: Daniel Jurgens <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5e: Implement ndo_tx_timeout callbackDaniel Jurgens2-0/+47
Add callback to handle TX timeouts. Fixes: f62b8bb8f2d3 ('net/mlx5: Extend mlx5_core to support ConnectX-4 Ethernet functionality') Signed-off-by: Daniel Jurgens <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5e: Timeout if SQ doesn't flush during closeDaniel Jurgens3-3/+56
Avoid an infinite loop by timing out waiting for the SQ to flush. Also clean up the TX descriptors if that happens. Fixes: f62b8bb8f2d3 ('net/mlx5: Extend mlx5_core to support ConnectX-4 Ethernet functionality') Signed-off-by: Daniel Jurgens <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5: Add timeout handle to commands with callbackMohamad Haj Yahia2-7/+32
The current implementation does not handle timeout in case of command with callback request, and this can lead to deadlock if the command doesn't get fw response. Add delayed callback timeout work before posting the command to fw. In case of real fw command completion we will cancel the delayed work. In case of fw command timeout the callback timeout handler will be called and it will simulate fw completion with timeout error. Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters') Signed-off-by: Mohamad Haj Yahia <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5: Fix potential deadlock in command mode changeMohamad Haj Yahia1-46/+33
Call command completion handler in case of timeout when working in interrupts mode. Avoid flushing the commands workqueue after acquiring the semaphores to prevent a potential deadlock. Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters') Signed-off-by: Mohamad Haj Yahia <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5: Fix wait_vital for VFs and remove fixed sleepDaniel Jurgens1-26/+15
The device ID for VFs is in a different location than PFs. This results in the poll always timing out for VFs. There's no good way to read the VF device ID without using the PF's configuration space. Switch to waiting for the health poll to start incrementing. Also remove the 1s sleep at the beginning. fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core driver') Signed-off-by: Daniel Jurgens <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5: Fix incorrect page count when in internal errorDaniel Jurgens1-19/+44
Change page cleanup flow when in internal error to properly decrement the page counts when reclaiming pages. The prevents timing out waiting for extra pages that were actually cleaned up previously. fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core driver') Signed-off-by: Daniel Jurgens <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5: Avoid calling sleeping function by the health poll threadMohamad Haj Yahia1-3/+8
In internal error state the health poll thread will eventually call synchronize_irq() (to safely trigger command completions) which might sleep, so we are calling sleeping function from atomic context which is invalid. Here we move trigger_cmd_completions(dev) to enter error state which is the earliest stage in error state handling. This way we won't need to wait for next health poll to trigger command completions and will solve the scheduling while atomic issue. mlx5_enter_error_state can be called from two contexts, protect it with dev->intf_state_lock Fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core driver') Signed-off-by: Mohamad Haj Yahia <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01net/mlx5: Fix teardown errors that happen in pci error handlerMohamad Haj Yahia1-4/+8
In case of internal error state we will simulate the commands status through the return value translation function, but we need to simulate all the teardown fw commands as successful so we will not have fw command failure prints. This also fix memory leaks that happen because we skip teardown stages due to failed fw commands. Fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core driver') Signed-off-by: Mohamad Haj Yahia <> Signed-off-by: Saeed Mahameed <> Signed-off-by: David S. Miller <>
2016-07-01bonding: prevent out of bound accessesEric Dumazet3-10/+15
ether_addr_equal_64bits() requires some care about its arguments, namely that 8 bytes might be read, even if last 2 byte values are not used. KASan detected a violation with null_mac_addr and lacpdu_mcast_addr in bond_3ad.c Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c : Although the 8-byte alignment was there, KASan would detect out of bound accesses. Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB") Signed-off-by: Eric Dumazet <> Reported-by: Dmitry Vyukov <> Acked-by: Dmitry Vyukov <> Acked-by: Nikolay Aleksandrov <> Acked-by: Ding Tianhong <> Signed-off-by: David S. Miller <>
2016-07-01net: mvneta: fix open() error cleanupRussell King - ARM Linux1-0/+2
If mvneta_mdio_probe() fails, a kernel warning is triggered due to missing cleanup in the error path. Add the necessary cleanup. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 281 at kernel/irq/manage.c:1814 __free_percpu_irq+0xfc/0x130 percpu IRQ 38 still enabled on CPU0! Modules linked in: bnep bluetooth xhci_plat_hcd xhci_hcd marvell_cesa armada_thermal des_generic ehci_orion mcp3021 spi_orion sfp mdio_i2c evbug fuse CPU: 1 PID: 281 Comm: connmand Not tainted 4.7.0-rc2+ #53 Hardware name: Marvell Armada 380/385 (Device Tree) Backtrace: [<c0013488>] (dump_backtrace) from [<c00137d0>] (show_stack+0x18/0x1c) r6:60010093 r5:ffffffff r4:00000000 r3:dc8ba500 [<c00137b8>] (show_stack) from [<c02c6fe0>] (dump_stack+0xa4/0xdc) [<c02c6f3c>] (dump_stack) from [<c002d4ec>] (__warn+0xd8/0x104) r6:c081e6a0 r5:00000000 r4:edfe5d50 r3:dc8ba500 [<c002d414>] (__warn) from [<c002d5d0>] (warn_slowpath_fmt+0x40/0x48) r10:a0010013 r8:c09356f8 r7:00000026 r6:ef11a260 r5:edd7b980 r4:ef11a200 [<c002d594>] (warn_slowpath_fmt) from [<c008c8e0>] (__free_percpu_irq+0xfc/0x130) r3:00000026 r2:c081e7ac [<c008c7e4>] (__free_percpu_irq) from [<c008c95c>] (free_percpu_irq+0x48/0x74) r10:00008914 r8:00000000 r7:ffffffed r6:c09356f8 r5:00000026 r4:ef11a200 [<c008c914>] (free_percpu_irq) from [<c043dd70>] (mvneta_open+0x118/0x134) r6:ffffffed r5:ef01e640 r4:ef01e000 r3:ef01e000 [<c043dc58>] (mvneta_open) from [<c055f5b4>] (__dev_open+0xa4/0x108) r7:ef01e030 r6:c06ff3d8 r5:ffff9003 r4:ef01e000 [<c055f510>] (__dev_open) from [<c055f844>] (__dev_change_flags+0x94/0x150) r7:00001002 r6:00000001 r5:ffff9003 r4:ef01e000 [<c055f7b0>] (__dev_change_flags) from [<c055f938>] (dev_change_flags+0x20/0x50) r8:00000000 r7:c09334c8 r6:00001002 r5:00000148 r4:ef01e000 r3:00008914 [<c055f918>] (dev_change_flags) from [<c05de044>] (devinet_ioctl+0x6f4/0x7e0) r8:00000000 r7:c09334c8 r6:00000000 r5:ee87200c r4:00000000 r3:00008914 [<c05dd950>] (devinet_ioctl) from [<c05e0168>] (inet_ioctl+0x1b8/0x1c8) r10:beb4499c r9:edfe4000 r8:ecf13280 r7:c096cf00 r6:beb4499c r5:eef7c240 r4:00008914 [<c05dffb0>] (inet_ioctl) from [<c053c898>] (sock_ioctl+0x78/0x300) [<c053c820>] (sock_ioctl) from [<c0155ecc>] (do_vfs_ioctl+0x98/0xa60) r7:00000011 r6:00008914 r5:00000011 r4:c01568d0 [<c0155e34>] (do_vfs_ioctl) from [<c01568d0>] (SyS_ioctl+0x3c/0x60) r10:00000000 r9:edfe4000 r8:beb4499c r7:00000011 r6:00008914 r5:ecf13280 r4:ecf13280 [<c0156894>] (SyS_ioctl) from [<c000fe60>] (ret_fast_syscall+0x0/0x1c) r8:c0010004 r7:00000036 r6:00000011 r5:000a2978 r4:00000000 r3:00009003 ---[ end trace 711f625d5b04b3a7 ]--- Signed-off-by: Russell King <> Tested-by: Jon Nettleton <> Signed-off-by: David S. Miller <>
2016-07-01r8152: clear LINK_OFF_WAKE_EN after autoresumehayeswang1-0/+11
LINK_OFF_WAKE_EN should be cleared after autoresume, otherwise after system suspend, the system would wake up when linking off occurs. Signed-off-by: Hayes Wang <> Signed-off-by: David S. Miller <>
2016-07-01qlcnic: add wmb() call in transmit data path.Sony Chacko1-0/+2
Call wmb() to ensure writes are complete before hardware fetches updated Tx descriptors. Signed-off-by: Sony Chacko <> Signed-off-by: David S. Miller <>
2016-06-30usbnet: Stop RX Q on MTU changeSoohoon Lee1-3/+7
When MTU is changed unlink_urbs() flushes RX Q but mean while usbnet_bh() can fill up the Q at the same time. Depends on which HCD is down there unlink takes long time then the flush never ends. Signed-off-by: Soohoon Lee <> Reviewed-by: Kimball Murray <> Signed-off-by: David S. Miller <>
2016-06-30ipv4: Fix ip_skb_dst_mtu to use the sk passed by ip_finish_outputShmulik Ladkani3-6/+5
ip_skb_dst_mtu uses skb->sk, assuming it is an AF_INET socket (e.g. it calls ip_sk_use_pmtu which casts sk as an inet_sk). However, in the case of UDP tunneling, the skb->sk is not necessarily an inet socket (could be AF_PACKET socket, or AF_UNSPEC if arriving from tun/tap). OTOH, the sk passed as an argument throughout IP stack's output path is the one which is of PMTU interest: - In case of local sockets, sk is same as skb->sk; - In case of a udp tunnel, sk is the tunneling socket. Fix, by passing ip_finish_output's sk to ip_skb_dst_mtu. This augments 7026b1ddb6 'netfilter: Pass socket pointer down through okfn().' Signed-off-by: Shmulik Ladkani <> Reviewed-by: Hannes Frederic Sowa <> Signed-off-by: David S. Miller <>
2016-06-30Merge branch 'master' of ↵David S. Miller2-14/+11
git:// Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2016-06-29 This series contains fixes to e1000e and ixgbevf. Jarod Wilson's fix for e1000e was a follow-on patch to his previous fix to keep the hardware VLAN CTAG's for receive and transmit in sync, which in turn resolves the original issue, so revert a portion of the original fix. Xin Long noticed that the ret_val needed to be initialized to IXGBE_ERR_MBX, instead of -IXGBE_ERR_MBX. ==================== Signed-off-by: David S. Miller <>
2016-06-29Merge tag 'nfs-for-4.7-2' of git:// Torvalds8-23/+45
Pull NFS client bugfixes from Anna Schumaker: "Stable bugfixes: - Fix _cancel_empty_pagelist - Fix a double page unlock - Make nfs_atomic_open() call d_drop() on all ->open_context() errors. - Fix another OPEN_DOWNGRADE bug Other bugfixes: - Ensure we handle delegation errors in nfs4_proc_layoutget() - Layout stateids start out as being invalid - Add sparse lock annotations for pnfs_find_alloc_layout - Handle bad delegation stateids in nfs4_layoutget_handle_exception - Fix up O_DIRECT results - Fix potential use after free of state in nfs4_do_reclaim. - Mark the layout stateid invalid when all segments are removed - Don't let readdirplus revalidate an inode that was marked as stale - Fix potential race in nfs_fhget() - Fix an unused variable warning" * tag 'nfs-for-4.7-2' of git:// NFS: Fix another OPEN_DOWNGRADE bug make nfs_atomic_open() call d_drop() on all ->open_context() errors. NFS: Fix an unused variable warning NFS: Fix potential race in nfs_fhget() NFS: Don't let readdirplus revalidate an inode that was marked as stale NFSv4.1/pnfs: Mark the layout stateid invalid when all segments are removed NFS: Fix a double page unlock pnfs_nfs: fix _cancel_empty_pagelist nfs4: Fix potential use after free of state in nfs4_do_reclaim. NFS: Fix up O_DIRECT results NFS/pnfs: handle bad delegation stateids in nfs4_layoutget_handle_exception NFSv4.1/pnfs: Add sparse lock annotations for pnfs_find_alloc_layout NFSv4.1/pnfs: Layout stateids start out as being invalid NFSv4.1/pnfs: Ensure we handle delegation errors in nfs4_proc_layoutget()
2016-06-29Merge branch 'stable-4.7' of git:// Torvalds4-28/+25
Pull audit fixes from Paul Moore: "Two small patches to fix audit problems in 4.7-rcX: the first fixes a potential kref leak, the second removes some header file noise. The first is an important bug fix that really should go in before 4.7 is released, the second is not critical, but falls into the very-nice- to-have category so I'm including in the pull request. Both patches are straightforward, self-contained, and pass our testsuite without problem" * 'stable-4.7' of git:// audit: move audit_get_tty to reduce scope and kabi changes audit: move calcs after alloc and check when logging set loginuid
2016-06-29Merge git:// Torvalds140-893/+1270
Pull networking fixes from David Miller: "I've been traveling so this accumulates more than week or so of bug fixing. It perhaps looks a little worse than it really is. 1) Fix deadlock in ath10k driver, from Ben Greear. 2) Increase scan timeout in iwlwifi, from Luca Coelho. 3) Unbreak STP by properly reinjecting STP packets back into the stack. Regression fix from Ido Schimmel. 4) Mediatek driver fixes (missing malloc failure checks, leaking of scratch memory, wrong indexing when mapping TX buffers, etc.) from John Crispin. 5) Fix endianness bug in icmpv6_err() handler, from Hannes Frederic Sowa. 6) Fix hashing of flows in UDP in the ruseport case, from Xuemin Su. 7) Fix netlink notifications in ovs for tunnels, delete link messages are never emitted because of how the device registry state is handled. From Nicolas Dichtel. 8) Conntrack module leaks kmemcache on unload, from Florian Westphal. 9) Prevent endless jump loops in nft rules, from Liping Zhang and Pablo Neira Ayuso. 10) Not early enough spinlock initialization in mlx4, from Eric Dumazet. 11) Bind refcount leak in act_ipt, from Cong WANG. 12) Missing RCU locking in HTB scheduler, from Florian Westphal. 13) Several small MACSEC bug fixes from Sabrina Dubroca (missing RCU barrier, using heap for SG and IV, and erroneous use of async flag when allocating AEAD conext.) 14) RCU handling fix in TIPC, from Ying Xue. 15) Pass correct protocol down into ipv4_{update_pmtu,redirect}() in SIT driver, from Simon Horman. 16) Socket timer deadlock fix in TIPC from Jon Paul Maloy. 17) Fix potential deadlock in team enslave, from Ido Schimmel. 18) Memory leak in KCM procfs handling, from Jiri Slaby. 19) ESN generation fix in ipv4 ESP, from Herbert Xu. 20) Fix GFP_KERNEL allocations with locks held in act_ife, from Cong WANG. 21) Use after free in netem, from Eric Dumazet. 22) Uninitialized last assert time in multicast router code, from Tom Goff. 23) Skip raw sockets in sock_diag destruction broadcast, from Willem de Bruijn. 24) Fix link status reporting in thunderx, from Sunil Goutham. 25) Limit resegmentation of retransmit queue so that we do not retransmit too large GSO frames. From Eric Dumazet. 26) Delay bpf program release after grace period, from Daniel Borkmann" * git:// (141 commits) openvswitch: fix conntrack netlink event delivery qed: Protect the doorbell BAR with the write barriers. neigh: Explicitly declare RCU-bh read side critical section in neigh_xmit() e1000e: keep VLAN interfaces functional after rxvlan off cfg80211: fix proto in ieee80211_data_to_8023 for frames without LLC header qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag() bpf, perf: delay release of BPF prog after grace period net: bridge: fix vlan stats continue counter tcp: do not send too big packets at retransmit time ibmvnic: fix to use list_for_each_safe() when delete items net: thunderx: Fix TL4 configuration for secondary Qsets net: thunderx: Fix link status reporting net/mlx5e: Reorganize ethtool statistics net/mlx5e: Fix number of PFC counters reported to ethtool net/mlx5e: Prevent adding the same vxlan port net/mlx5e: Check for BlueFlame capability before allocating SQ uar net/mlx5e: Change enum to better reflect usage net/mlx5: Add ConnectX-5 PCIe 4.0 to list of supported devices net/mlx5: Update command strings net: marvell: Add separate config ANEG function for Marvell 88E1111 ...
2016-06-29Merge branch 'for-linus' of ↵Linus Torvalds2-8/+1
git:// Pull s390 fixes from Martin Schwidefsky: "Another two bug fixes for 4.7: - The revert of patch which removed boot information for systems using an intermediate boot kernel, e.g. the SLES12 grub setup. - A fix for an incorrect inline assembly constraint that causes broken code to be generated with gcc 4.8.5" * 'for-linus' of git:// s390: fix test_fp_ctl inline assembly contraints Revert "s390/kdump: Clear subchannel ID to signal non-CCW/SCSI IPL"
2016-06-29Merge tag 'pinctrl-v4.7-3' of ↵Linus Torvalds7-9/+18
git:// Pull pin control fixes from Linus Walleij: "Here are a bunch of fixes for pin control. Just drivers and a MAINTAINERS fixup: - Driver fixes for i.MX, single register, Tegra and BayTrail. - MAINTAINERS entry for the documentation" * tag 'pinctrl-v4.7-3' of git:// pinctrl: baytrail: Fix mingled clock pins MAINTAINERS: belong Documentation/pinctrl.txt properly pinctrl: tegra: Fix build dependency gpio: tegra: Make lockdep class file-scoped pinctrl: single: Fix missing flush of posted write for a wakeirq pinctrl: imx: Do not treat a PIN without MUX register as an error
2016-06-29Merge branch 'for-4.7-fixes' of ↵Linus Torvalds1-72/+76
git:// Pull cgroup fixes from Tejun Heo: "Three fix patches. Two are for cgroup / css init failure path. The last one makes css_set_lock irq-safe as the deadline scheduler ends up calling put_css_set() from irq context" * 'for-4.7-fixes' of git:// cgroup: Disable IRQs while holding css_set_lock cgroup: set css->id to -1 during init cgroup: remove redundant cleanup in css_create
2016-06-29ixgbevf: ixgbevf_write/read_posted_mbx should use IXGBE_ERR_MBX to ↵Xin Long1-2/+2
initialize ret_val Now ixgbevf_write/read_posted_mbx use -IXGBE_ERR_MBX as the initiative return value, but it's incorrect, cause in ixgbevf_vlan_rx_add_vid(), it use err == IXGBE_ERR_MBX, the err returned from mac.ops.set_vfta, and in ixgbevf_set_vfta_vf, it return from write/read_posted. so we should initialize err with IXGBE_ERR_MBX, instead of -IXGBE_ERR_MBX. With this fix, the other functions that called it also can work well, cause they only care about if err is 0 or not. Signed-off-by: Xin Long <> Tested-by: Andrew Bowers <> Signed-off-by: Jeff Kirsher <>
2016-06-29e1000e: keep Rx/Tx HW_VLAN_CTAG in syncJarod Wilson1-12/+9
The bit in the e1000 driver that mentions explicitly that the hardware has no support for separate RX/TX VLAN accel toggling rings true for e1000e as well, and thus both NETIF_F_HW_VLAN_CTAG_RX and NETIF_F_HW_VLAN_CTAG_TX need to be kept in sync. Revert a portion of commit 889ad456660461 ("e1000e: keep VLAN interfaces functional after rxvlan off") since keeping the bits in sync resolves the original issue. Signed-off-by: Jarod Wilson <> Tested-by: Aaron Brown <> Signed-off-by: Jeff Kirsher <>
2016-06-29Merge tag 'mac80211-for-davem-2016-06-29-v2' of ↵David S. Miller2-3/+6
git:// Johannes Berg says: ==================== Just two small fixes * fix mesh peer link counter, decrement wasn't always done at all * fix ethertype (length) for packets without RFC 1042 or bridge tunnel header ==================== Signed-off-by: David S. Miller <>