Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8172ba51 authored by Linus Torvalds's avatar Linus Torvalds
Browse files
Pull networking fixes from David Miller:

 1) Fix use-after-free with mac80211 RX A-MPDU reorder timer, from
    Johannes Berg.

 2) iwlwifi leaks memory every module load/unload cycles, fix from Larry
    Finger.

 3) Need to use for_each_netdev_safe() in rtnl_group_changelink()
    otherwise we can crash, from WANG Cong.

 4) mlx4 driver does register_netdev() too early in the probe sequence,
    from Ido Shamay.

 5) Don't allow router discovery hop limit to decrease the interface's
    hop limit, from D.S. Ljungmark.

 6) tx_packets and tx_bytes improperly accounted for certain classes of
    USB network devices, fix from Ben Hutchings.

 7) ip{6}mr_rules_init() mistakenly use plain kfree to release the ipmr
    tables in the error path, they must instead use ip{6}mr_free_table().
    Fix from WANG Cong.

 8) cxgb4 doesn't properly quiesce all RX activity before unregistering
    the netdevice.  Fix from Hariprasad Shenai.

 9) Fix hash corruptions in ipvlan driver, from Jiri Benc.

10) nla_memcpy(), like a real memcpy, should fully initialize the
    destination buffer, even if the source attribute is smaller.  Fix
    from Jiri Benc.

11) Fix wrong error code returned from iucv_sock_sendmsg().  We should
    use whatever sock_alloc_send_skb() put into 'err'.  From Eugene
    Crosser.

12) Fix slab object leak on module unload in TIPC, from Ying Xue.

13) Need a READ_ONCE() when reading the cached RX socket route in
    tcp_v{4,6}_early_demux().  From Michal Kubecek.

14) Still too many problems with TPC support in the ath9k driver, so
    disable it for now.  From Felix Fietkau.

15) When in AP mode the rtlwifi driver can leak DMA mappings, fix from
    Larry Finger.

16) Missing kzalloc() failure check in gs_usb CAN driver, from Colin Ian
    King.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits)
  cxgb4: Fix to dump devlog, even if FW is crashed
  cxgb4: Firmware macro changes for fw verison 1.13.32.0
  bnx2x: Fix kdump when iommu=on
  bnx2x: Fix kdump on 4-port device
  mac80211: fix RX A-MPDU session reorder timer deletion
  MAINTAINERS: Update Intel Wired Ethernet Driver info
  tipc: fix a slab object leak
  net/usb/r8152: add device id for Lenovo TP USB 3.0 Ethernet
  af_iucv: fix AF_IUCV sendmsg() errno
  openvswitch: Return vport module ref before destruction
  netlink: pad nla_memcpy dest buffer with zeroes
  bonding: Bonding Overriding Configuration logic restored.
  ipvlan: fix check for IP addresses in control path
  ipvlan: do not use rcu operations for address list
  ipvlan: protect against concurrent link removal
  ipvlan: fix addr hash list corruption
  net: fec: setup right value for mdio hold time
  net: tcp6: fix double call of tcp_v6_fill_cb()
  cxgb4vf: Fix sparse warnings
  netns: don't clear nsid too early on removal
  ...
parents d4039314 f5f321c4
Loading
Loading
Loading
Loading
+12 −13
Original line number Diff line number Diff line
@@ -5136,22 +5136,21 @@ M: Deepak Saxena <dsaxena@plexity.net>
S:	Maintained
F:	drivers/char/hw_random/ixp4xx-rng.c

INTEL ETHERNET DRIVERS (e100/e1000/e1000e/fm10k/igb/igbvf/ixgb/ixgbe/ixgbevf/i40e/i40evf)
INTEL ETHERNET DRIVERS
M:	Jeff Kirsher <jeffrey.t.kirsher@intel.com>
M:	Jesse Brandeburg <jesse.brandeburg@intel.com>
M:	Bruce Allan <bruce.w.allan@intel.com>
M:	Carolyn Wyborny <carolyn.wyborny@intel.com>
M:	Don Skidmore <donald.c.skidmore@intel.com>
M:	Greg Rose <gregory.v.rose@intel.com>
M:	Matthew Vick <matthew.vick@intel.com>
M:	John Ronciak <john.ronciak@intel.com>
M:	Mitch Williams <mitch.a.williams@intel.com>
M:	Linux NICS <linux.nics@intel.com>
L:	e1000-devel@lists.sourceforge.net
R:	Jesse Brandeburg <jesse.brandeburg@intel.com>
R:	Shannon Nelson <shannon.nelson@intel.com>
R:	Carolyn Wyborny <carolyn.wyborny@intel.com>
R:	Don Skidmore <donald.c.skidmore@intel.com>
R:	Matthew Vick <matthew.vick@intel.com>
R:	John Ronciak <john.ronciak@intel.com>
R:	Mitch Williams <mitch.a.williams@intel.com>
L:	intel-wired-lan@lists.osuosl.org
W:	http://www.intel.com/support/feedback.htm
W:	http://e1000.sourceforge.net/
T:	git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net.git
T:	git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-next.git
Q:	http://patchwork.ozlabs.org/project/intel-wired-lan/list/
T:	git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue.git
T:	git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue.git
S:	Supported
F:	Documentation/networking/e100.txt
F:	Documentation/networking/e1000.txt
+2 −1
Original line number Diff line number Diff line
@@ -3850,7 +3850,8 @@ static inline int bond_slave_override(struct bonding *bond,
	/* Find out if any slaves have the same mapping as this skb. */
	bond_for_each_slave_rcu(bond, slave, iter) {
		if (slave->queue_id == skb->queue_mapping) {
			if (bond_slave_can_tx(slave)) {
			if (bond_slave_is_up(slave) &&
			    slave->link == BOND_LINK_UP) {
				bond_dev_queue_xmit(bond, skb, slave->dev);
				return 0;
			}
+11 −7
Original line number Diff line number Diff line
@@ -592,13 +592,12 @@ static int flexcan_poll_state(struct net_device *dev, u32 reg_esr)
		rx_state = unlikely(reg_esr & FLEXCAN_ESR_RX_WRN) ?
			   CAN_STATE_ERROR_WARNING : CAN_STATE_ERROR_ACTIVE;
		new_state = max(tx_state, rx_state);
	} else if (unlikely(flt == FLEXCAN_ESR_FLT_CONF_PASSIVE)) {
	} else {
		__flexcan_get_berr_counter(dev, &bec);
		new_state = CAN_STATE_ERROR_PASSIVE;
		new_state = flt == FLEXCAN_ESR_FLT_CONF_PASSIVE ?
			    CAN_STATE_ERROR_PASSIVE : CAN_STATE_BUS_OFF;
		rx_state = bec.rxerr >= bec.txerr ? new_state : 0;
		tx_state = bec.rxerr <= bec.txerr ? new_state : 0;
	} else {
		new_state = CAN_STATE_BUS_OFF;
	}

	/* state hasn't changed */
@@ -1158,12 +1157,19 @@ static int flexcan_probe(struct platform_device *pdev)
	const struct flexcan_devtype_data *devtype_data;
	struct net_device *dev;
	struct flexcan_priv *priv;
	struct regulator *reg_xceiver;
	struct resource *mem;
	struct clk *clk_ipg = NULL, *clk_per = NULL;
	void __iomem *base;
	int err, irq;
	u32 clock_freq = 0;

	reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
	if (PTR_ERR(reg_xceiver) == -EPROBE_DEFER)
		return -EPROBE_DEFER;
	else if (IS_ERR(reg_xceiver))
		reg_xceiver = NULL;

	if (pdev->dev.of_node)
		of_property_read_u32(pdev->dev.of_node,
						"clock-frequency", &clock_freq);
@@ -1224,9 +1230,7 @@ static int flexcan_probe(struct platform_device *pdev)
	priv->pdata = dev_get_platdata(&pdev->dev);
	priv->devtype_data = devtype_data;

	priv->reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
	if (IS_ERR(priv->reg_xceiver))
		priv->reg_xceiver = NULL;
	priv->reg_xceiver = reg_xceiver;

	netif_napi_add(dev, &priv->napi, flexcan_poll, FLEXCAN_NAPI_WEIGHT);

+2 −0
Original line number Diff line number Diff line
@@ -901,6 +901,8 @@ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *
	}

	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
	if (!dev)
		return -ENOMEM;
	init_usb_anchor(&dev->rx_submitted);

	atomic_set(&dev->active_channels, 0);
+42 −27
Original line number Diff line number Diff line
@@ -25,7 +25,6 @@
#include <linux/can/dev.h>
#include <linux/can/error.h>

#define MAX_TX_URBS			16
#define MAX_RX_URBS			4
#define START_TIMEOUT			1000 /* msecs */
#define STOP_TIMEOUT			1000 /* msecs */
@@ -443,6 +442,7 @@ struct kvaser_usb_error_summary {
	};
};

/* Context for an outstanding, not yet ACKed, transmission */
struct kvaser_usb_tx_urb_context {
	struct kvaser_usb_net_priv *priv;
	u32 echo_index;
@@ -456,8 +456,13 @@ struct kvaser_usb {
	struct usb_endpoint_descriptor *bulk_in, *bulk_out;
	struct usb_anchor rx_submitted;

	/* @max_tx_urbs: Firmware-reported maximum number of oustanding,
	 * not yet ACKed, transmissions on this device. This value is
	 * also used as a sentinel for marking free tx contexts.
	 */
	u32 fw_version;
	unsigned int nchannels;
	unsigned int max_tx_urbs;
	enum kvaser_usb_family family;

	bool rxinitdone;
@@ -467,19 +472,18 @@ struct kvaser_usb {

struct kvaser_usb_net_priv {
	struct can_priv can;

	spinlock_t tx_contexts_lock;
	int active_tx_contexts;
	struct kvaser_usb_tx_urb_context tx_contexts[MAX_TX_URBS];

	struct usb_anchor tx_submitted;
	struct completion start_comp, stop_comp;
	struct can_berr_counter bec;

	struct kvaser_usb *dev;
	struct net_device *netdev;
	int channel;

	struct can_berr_counter bec;
	struct completion start_comp, stop_comp;
	struct usb_anchor tx_submitted;

	spinlock_t tx_contexts_lock;
	int active_tx_contexts;
	struct kvaser_usb_tx_urb_context tx_contexts[];
};

static const struct usb_device_id kvaser_usb_table[] = {
@@ -592,8 +596,8 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id,
			 * for further details.
			 */
			if (tmp->len == 0) {
				pos = round_up(pos,
					       dev->bulk_in->wMaxPacketSize);
				pos = round_up(pos, le16_to_cpu(dev->bulk_in->
								wMaxPacketSize));
				continue;
			}

@@ -657,9 +661,13 @@ static int kvaser_usb_get_software_info(struct kvaser_usb *dev)
	switch (dev->family) {
	case KVASER_LEAF:
		dev->fw_version = le32_to_cpu(msg.u.leaf.softinfo.fw_version);
		dev->max_tx_urbs =
			le16_to_cpu(msg.u.leaf.softinfo.max_outstanding_tx);
		break;
	case KVASER_USBCAN:
		dev->fw_version = le32_to_cpu(msg.u.usbcan.softinfo.fw_version);
		dev->max_tx_urbs =
			le16_to_cpu(msg.u.usbcan.softinfo.max_outstanding_tx);
		break;
	}

@@ -715,7 +723,7 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,

	stats = &priv->netdev->stats;

	context = &priv->tx_contexts[tid % MAX_TX_URBS];
	context = &priv->tx_contexts[tid % dev->max_tx_urbs];

	/* Sometimes the state change doesn't come after a bus-off event */
	if (priv->can.restart_ms &&
@@ -744,7 +752,7 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
	spin_lock_irqsave(&priv->tx_contexts_lock, flags);

	can_get_echo_skb(priv->netdev, context->echo_index);
	context->echo_index = MAX_TX_URBS;
	context->echo_index = dev->max_tx_urbs;
	--priv->active_tx_contexts;
	netif_wake_queue(priv->netdev);

@@ -1329,7 +1337,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
		 * number of events in case of a heavy rx load on the bus.
		 */
		if (msg->len == 0) {
			pos = round_up(pos, dev->bulk_in->wMaxPacketSize);
			pos = round_up(pos, le16_to_cpu(dev->bulk_in->
							wMaxPacketSize));
			continue;
		}

@@ -1512,11 +1521,13 @@ static int kvaser_usb_open(struct net_device *netdev)

static void kvaser_usb_reset_tx_urb_contexts(struct kvaser_usb_net_priv *priv)
{
	int i;
	int i, max_tx_urbs;

	max_tx_urbs = priv->dev->max_tx_urbs;

	priv->active_tx_contexts = 0;
	for (i = 0; i < MAX_TX_URBS; i++)
		priv->tx_contexts[i].echo_index = MAX_TX_URBS;
	for (i = 0; i < max_tx_urbs; i++)
		priv->tx_contexts[i].echo_index = max_tx_urbs;
}

/* This method might sleep. Do not call it in the atomic context
@@ -1702,14 +1713,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
		*msg_tx_can_flags |= MSG_FLAG_REMOTE_FRAME;

	spin_lock_irqsave(&priv->tx_contexts_lock, flags);
	for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++) {
		if (priv->tx_contexts[i].echo_index == MAX_TX_URBS) {
	for (i = 0; i < dev->max_tx_urbs; i++) {
		if (priv->tx_contexts[i].echo_index == dev->max_tx_urbs) {
			context = &priv->tx_contexts[i];

			context->echo_index = i;
			can_put_echo_skb(skb, netdev, context->echo_index);
			++priv->active_tx_contexts;
			if (priv->active_tx_contexts >= MAX_TX_URBS)
			if (priv->active_tx_contexts >= dev->max_tx_urbs)
				netif_stop_queue(netdev);

			break;
@@ -1743,7 +1754,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
		spin_lock_irqsave(&priv->tx_contexts_lock, flags);

		can_free_echo_skb(netdev, context->echo_index);
		context->echo_index = MAX_TX_URBS;
		context->echo_index = dev->max_tx_urbs;
		--priv->active_tx_contexts;
		netif_wake_queue(netdev);

@@ -1881,7 +1892,9 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
	if (err)
		return err;

	netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS);
	netdev = alloc_candev(sizeof(*priv) +
			      dev->max_tx_urbs * sizeof(*priv->tx_contexts),
			      dev->max_tx_urbs);
	if (!netdev) {
		dev_err(&intf->dev, "Cannot alloc candev\n");
		return -ENOMEM;
@@ -2009,6 +2022,13 @@ static int kvaser_usb_probe(struct usb_interface *intf,
		return err;
	}

	dev_dbg(&intf->dev, "Firmware version: %d.%d.%d\n",
		((dev->fw_version >> 24) & 0xff),
		((dev->fw_version >> 16) & 0xff),
		(dev->fw_version & 0xffff));

	dev_dbg(&intf->dev, "Max oustanding tx = %d URBs\n", dev->max_tx_urbs);

	err = kvaser_usb_get_card_info(dev);
	if (err) {
		dev_err(&intf->dev,
@@ -2016,11 +2036,6 @@ static int kvaser_usb_probe(struct usb_interface *intf,
		return err;
	}

	dev_dbg(&intf->dev, "Firmware version: %d.%d.%d\n",
		((dev->fw_version >> 24) & 0xff),
		((dev->fw_version >> 16) & 0xff),
		(dev->fw_version & 0xffff));

	for (i = 0; i < dev->nchannels; i++) {
		err = kvaser_usb_init_one(intf, id, i);
		if (err) {
Loading