summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-11-20pptp: fix stack info leak in pptp_getname()Mathias Krause
pptp_getname() only partially initializes the stack variable sa, particularly only fills the pptp part of the sa_addr union. The code thereby discloses 16 bytes of kernel stack memory via getsockname(). Fix this by memset(0)'ing the union before. Cc: Dmitry Kozlov <xeb@mail.ru> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-21Merge branch 'drm-fixes-3.18' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie
into drm-fixes fix one regression and one endian issue. * 'drm-fixes-3.18' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: fix endian swapping in vbios fetch for tdp table drm/radeon: disable native backlight control on pre-r6xx asics (v2)
2014-11-20i40e: trigger SW INT with no ITR waitShannon Nelson
Since we want the SW INT to go off as soon as possible, write the extra bits that will turn off the ITR wait for the interrupt. Change-ID: I6d5382ba60840fa32abb7dea17c839eb4b5f68f7 Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20i40evf: remove unnecessary elseMitch Williams
Since the if part of this statement contains a break, there's no reason for the else. Clean up the code and make it more obvious that the delay happens each time through the loop. Change-ID: I9292eaf7dd687688bdc401b8bd8d1d14f6944460 Signed-off-by: Mitch Williams <mitch.a.williams@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20i40evf: make comparisons consistentMitch Williams
Most of the null-checking in this driver is of the style if (!foo), except these few. Make these checks consistent with the rest of the code. Change-ID: I991924f34072fa607a1b626a8b3f1fa5195d43e9 Reported-by: Joe Perches <joe@perches.com> Signed-off-by: Mitch Williams <mitch.a.williams@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20i40evf: make checkpatch happyMitch Williams
This patch is the result of running checkpatch on the i40evf driver with the --strict option. The vast majority of changes are adding/removing blank lines, aligning function parameters, and correcting over-long lines. The only possible functional change is changing the flags member of the adapter structure to be non-volatile. However, according to the kernel documentation, this is not necessary and the volatile should be removed. Change-ID: Ie8c6414800924f529bef831e8845292b970fe2ed Signed-off-by: Mitch Williams <mitch.a.williams@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20i40evf: update header commentsMitch Williams
No code changes. Update comments to match actual function declarations. Change-ID: Ib830d2f154ee917a104955c0914267fc98f3d2c8 Signed-off-by: Mitch Williams <mitch.a.williams@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20i40e: don't overload fieldsMitch Williams
Overloading the msg_size field in the arq_event_info struct is just a bad idea. It leads to repeated bugs when the structure is used in a loop, since the input value (buffer size) is overwritten by the output value (actual message length). Fix this by splitting the field into two and renaming to indicate the actual function of each field. Since the arq_event struct has now changed, we need to change the drivers to support this. Note that we no longer need to initialize the buffer size each time we go through a loop as this value is no longer destroyed by arq processing. In the process, we also fix a bug in i40evf_verify_api_ver where the buffer size was not correctly reinitialized each time through the loop. Change-ID: Ic7f9633cdd6f871f93e698dfb095e29c696f5581 Signed-off-by: Mitch Williams <mitch.a.williams@intel.com> Acked-by: Shannon Nelson <shannon.nelson@intel.com> Acked-by: Ashish Shah <ashish.n.shah@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20ixgbevf: add netpoll supportEmil Tantilov
This patch adds ixgbevf_netpoll() a callback for .ndo_poll_controller to allow for the VF interface to be used with netconsole. CC: Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20ixgbevf: compare total_rx_packets and budget in ixgbevf_clean_rx_irqEmil Tantilov
total_rx_packets is the number of packets we had cleaned, and budget is the total number of packets that we could clean per poll. Instead of altering both of these values we can save ourselves one write to memory by just comparing total_rx_packets to the budget and as long as we are less than budget we continue cleaning. Also change the do{}while logic to while{} in order to avoid processing packets when budget is 0. CC: Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20ixgbevf: Change receive model to use double buffered page based receivesEmil Tantilov
This patch changes the basic receive path for ixgbevf so that instead of receiving the data into an skb it is received into a double buffered page. The main change is that the receives will be done in pages only and then pull the header out of the page and copy it into the sk_buff data. This has the advantages of reduced cache misses and improved performance on IOMMU enabled systems. v2: - added pfmemalloc check to a new function for reusable page - moved atomic_inc outside of #if/else in ixgbevf_add_rx_frag() - reverted the removal of the api check in ixgbevf_change_mtu() CC: Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20ixgbevf: Update Rx next to clean in real timeEmil Tantilov
Since the next_to_clean value is only accessed by the Rx interrupt handler we can save on stack space by just storing our updated values back in next_to_clean instead of using the stack variable i. This should help to reduce stack space and we can further collapse the size of the function. Also removed non_eop_descs counter as it was never shown in the stats. CC: Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20ixgbevf: reorder main loop in ixgbe_clean_rx_irq to allow for do/while/continueEmil Tantilov
This change allows us to go from a loop based on the descriptor to one primarily based on the budget. The advantage to this is that we can avoid carrying too many values from one iteration to the next. CC: Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20ixgbevf: Cleanup variable usage, improve stack performanceEmil Tantilov
This change is meant to help cleanup the usage of temporary variables within the Rx hot-path by removing unnecessary variables and reducing the scope of variables that do not need to exist outside the main loop. CC: Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20ixgbevf: Combine the logic for post Rx processing into single functionEmil Tantilov
This patch cleans up ixgbevf_clean_rx_irq() by merging several similar operations into a new function - ixgbevf_process_skb_fields(). CC: Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20ixgbevf: Test Rx status bits directly out of the descriptorEmil Tantilov
Instead of keeping a local copy of the status bits from the descriptor we can just read them directly - this is accomplished with the addition of ixgbevf_test_staterr(). In addition instead of doing a byteswap on the status bits value, we can byteswap the constant values we are testing since that can be done at compile time which should help to improve performance on big-endian systems. CC: Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20ixgbevf: Update ixgbevf_alloc_rx_buffers to handle clearing of status bitsEmil Tantilov
Instead of clearing the status bits in the cleanup it makes more sense to just clear the status bits on allocation. This way we can leave the Rx descriptor rings as a read only memory block until we actually have buffers to give back to the hardware. CC: Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com> Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2014-11-20x86, syscall: Fix _TIF_NOHZ handling in syscall_trace_enter_phase1Andy Lutomirski
TIF_NOHZ is 19 (i.e. _TIF_SYSCALL_TRACE | _TIF_NOTIFY_RESUME | _TIF_SINGLESTEP), not (1<<19). This code is involved in Dave's trinity lockup, but I don't see why it would cause any of the problems he's seeing, except inadvertently by causing a different path through entry_64.S's syscall handling. Signed-off-by: Andy Lutomirski <luto@amacapital.net> Cc: Don Zickus <dzickus@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Dave Jones <davej@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Link: http://lkml.kernel.org/r/a6cd3b60a3f53afb6e1c8081b0ec30ff19003dd7.1416434075.git.luto@amacapital.net Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2014-11-20mwifiex: Add USB8766 supportKristian Evensen
Adds new VID/PID for the Marvell 88W8766. The kernel currently only supports the device as PCI, but it is also available using USB. An example of a device delivered with the 88W8766 as USB is the Globalscale Mirabox. TX buffer size is set to driver default (2K), as we do not know the firmware requirement. Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-20net: brcm80211: Deletion of unnecessary checks before two function callsMarkus Elfring
The functions brcmu_pkt_buf_free_skb() and release_firmware() test whether their argument is NULL and then return immediately. Thus the test around the call is not needed. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Acked-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-20Merge tag 'mac80211-next-for-john-2014-11-20' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Johannes Berg <johannes@sipsolutions.net> says: "It has been a while since my last pull request, so we accumulated another relatively large set of changes: * TDLS off-channel support set from Arik/Liad, with some support patches I did * custom regulatory fixes from Arik * minstrel VHT fix (and a small optimisation) from Felix * add back radiotap vendor namespace support (myself) * random MAC address scanning for cfg80211/mac80211/hwsim (myself) * CSA improvements (Luca) * WoWLAN Net Detect (wake on network found) support (Luca) * and lots of other smaller changes from many people" Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-20brcmfmac: don't include linux/unaligned/access_ok.hJohannes Berg
This is a specific implementation, <asm/unaligned.h> is the multiplexer that has the arch-specific knowledge of which of the implementations needs to be used, so include that. This issue was revealed by kbuild testing when <asm/unaligned.h> was added in <linux/ieee80211.h> resulting in redefinition of get_unaligned_be16 (and probably others). Cc: stable@vger.kernel.org # v3.17 Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-20drm/radeon: fix endian swapping in vbios fetch for tdp tableAlex Deucher
Value needs to be swapped on BE. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-11-20drm/radeon: disable native backlight control on pre-r6xx asics (v2)Alex Deucher
Just use the acpi interface. That's what windows uses on this generation and it's the only thing that seems to work reliably on these generation parts. You can still force the native backlight interface by setting radeon.backlight=1 Bug: https://bugzilla.kernel.org/show_bug.cgi?id=88501 v2: merge into above if/else block Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2014-11-20of/selftest: Fix testing when /aliases is missingGrant Likely
The /aliases node isn't always present in the device tree, but the unittest code assumes that /aliases is there. Add a check when inserting the testcase data to see if of_aliases needs to be updated, and undo the settings when the nodes are removed. Signed-off-by: Grant Likely <grant.likely@linaro.org> Cc: Rob Herring <robh+dt@kernel.org> Cc: Gaurav Minocha <gaurav.minocha.os@gmail.com> Cc: <stable@vger.kernel.org>
2014-11-19IB/isert: Adjust CQ size to HW limitsChris Moore
isert has an issue of trying to create a CQ with more CQEs than are supported by the hardware, that currently results in failures during isert_device creation during first session login. This is the isert version of the patch that Minh Tran submitted for iser, and is simple a workaround required to function with existing ocrdma hardware. Signed-off-by: Chris Moore <chris.moore@emulex.com> Reviewied-by: Sagi Grimberg <sagig@mellanox.com> Cc: <stable@vger.kernel.org> # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-11-20Merge tag 'drm-intel-fixes-2014-11-19' of ↵Dave Airlie
git://anongit.freedesktop.org/drm-intel into drm-fixes two regression fixes. * tag 'drm-intel-fixes-2014-11-19' of git://anongit.freedesktop.org/drm-intel: drm/i915: Kick fbdev before vgacon drm/i915: drop WaSetupGtModeTdRowDispatch:snb
2014-11-20ACPI / PM: Ignore wakeup setting if the ACPI companion can't wake upRafael J. Wysocki
As reported by Dmitry, on some Chromebooks there are devices with corresponding ACPI objects and with unusual system wakeup configuration. Namely, they technically are wakeup-capable, but the wakeup is handled via a platform-specific out-of-band mechanism and the ACPI PM layer has no information on the wakeup capability. As a result, device_may_wakeup(dev) called from acpi_dev_suspend_late() returns 'true' for those devices, but the wakeup.flags.valid flag is unset for the corresponding ACPI device objects, so acpi_device_wakeup() reproducibly fails for them causing acpi_dev_suspend_late() to return an error code. The entire system suspend is then aborted and the machines in question cannot suspend at all. Address the problem by ignoring the device_may_wakeup(dev) return value in acpi_dev_suspend_late() if the ACPI companion of the device being handled has wakeup.flags.valid unset (in which case it is clear that the wakeup is supposed to be handled by other means). This fixes a regression introduced by commit a76e9bd89ae7 (i2c: attach/detach I2C client device to the ACPI power domain) as the affected systems could suspend and resume successfully before that commit. Fixes: a76e9bd89ae7 (i2c: attach/detach I2C client device to the ACPI power domain) Reported-by: Dmitry Torokhov <dtor@chromium.org> Reviewed-by: Dmitry Torokhov <dtor@chromium.org> Cc: 3.13+ <stable@vger.kernel.org> # 3.13+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-11-19Merge branch 'bonding_4ad'David S. Miller
Xie Jianhua says: ==================== bonding: Introduce 4 AD link speed The speed field of AD Port Key was based on bitmask, it supported 5 kinds of link speed at most, as there were only 5 bits in the speed field of the AD Port Key. This patches series change the speed type (AD_LINK_SPEED_BITMASK) from bitmask to enum type in order to enhance speed type from 5 to 32, and then introduce 4 AD link speed to fix agg_bandwidth. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19bonding: Introduce 4 AD link speed to fix agg_bandwidthJianhua Xie
This patch adds [2.5|20|40|56] Gbps enum definition, and fixes aggregated bandwidth calculation based on above slave links. CC: Jay Vosburgh <j.vosburgh@gmail.com> CC: Veaceslav Falico <vfalico@gmail.com> CC: Andy Gospodarek <andy@greyhouse.net> CC: David S. Miller <davem@davemloft.net> Signed-off-by: Jianhua Xie <jianhua.xie@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19bonding: change AD_LINK_SPEED_BITMASK to enum to suport more speedJianhua Xie
Port Key was determined as 16 bits according to the link speed, duplex and user key (which is yet not supported). In the old speed field, 5 bits are for speed [1|10|100|1000|10000]Mbps as below: -------------------------------------------------------------- Port key :| User key | Speed | Duplex| -------------------------------------------------------------- 16 6 1 0 This patch keeps the old layout, but changes AD_LINK_SPEED_BITMASK from bit type to an enum type. In this way, the speed field can expand speed type from 5 to 32. CC: Jay Vosburgh <j.vosburgh@gmail.com> CC: Veaceslav Falico <vfalico@gmail.com> CC: Andy Gospodarek <andy@greyhouse.net> CC: David S. Miller <davem@davemloft.net> Signed-off-by: Jianhua Xie <jianhua.xie@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19cxgb4i : Don't block unload/cxgb4 unload when remote closes TCP connectionAnish Bhatt
cxgb4i was returning wrong error and not releasing module reference if remote end abruptly closed TCP connection. This prevents the cxgb4 network module from being unloaded, further affecting other network drivers dependent on cxgb4 Sending to net as this affects all cxgb4 based network drivers. Signed-off-by: Anish Bhatt <anish@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19ipv6: delete protocol and unregister rtnetlink when cleanupDuan Jiong
pim6_protocol was added when initiation, but it not deleted. Similarly, unregister RTNL_FAMILY_IP6MR rtnetlink. Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com> Reviewed-by: Cong Wang <cwang@twopensource.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19PCI: Support 64-bit bridge windows if we have 64-bit dma_addr_tYinghai Lu
Aaron reported that a 32-bit x86 kernel with Physical Address Extension (PAE) support complains about bridge prefetchable memory windows above 4GB: pci_bus 0000:00: root bus resource [mem 0x380000000000-0x383fffffffff] ... pci 0000:03:00.0: reg 0x10: [mem 0x383fffc00000-0x383fffdfffff 64bit pref] pci 0000:03:00.0: reg 0x20: [mem 0x383fffe04000-0x383fffe07fff 64bit pref] pci 0000:03:00.1: reg 0x10: [mem 0x383fffa00000-0x383fffbfffff 64bit pref] pci 0000:03:00.1: reg 0x20: [mem 0x383fffe00000-0x383fffe03fff 64bit pref] pci 0000:00:02.2: PCI bridge to [bus 03-04] pci 0000:00:02.2: bridge window [io 0x1000-0x1fff] pci 0000:00:02.2: bridge window [mem 0x91900000-0x91cfffff] pci 0000:00:02.2: can't handle 64-bit address space for bridge In this kernel, unsigned long is 32 bits and dma_addr_t is 64 bits. Previously we used "unsigned long" to hold the bridge window address. But this is a bus address, so we should use dma_addr_t instead. Use dma_addr_t to hold the bridge window base and limit. The question of whether the CPU can actually *address* the window is separate and depends on what the physical address space of the CPU is and whether the host bridge does any address translation. [bhelgaas: fix "shift count > width of type", changelog, stable tag] Fixes: d56dbf5bab8c ("PCI: Allocate 64-bit BARs above 4G when possible") Link: https://bugzilla.kernel.org/show_bug.cgi?id=88131 Reported-by: Aaron Ma <mapengyu@gmail.com> Tested-by: Aaron Ma <mapengyu@gmail.com> Signed-off-by: Yinghai Lu <yinghai@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> CC: stable@vger.kernel.org # v3.14+
2014-11-19bury skb_copy_to_page()Al Viro
no callers since 3.0 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-19fold verify_iovec() into copy_msghdr_from_user()Al Viro
... and do the same on the compat side of things. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-19{compat_,}verify_iovec(): switch to generic copying of iovecsAl Viro
use {compat_,}rw_copy_check_uvector(). As the result, we are guaranteed that all iovecs seen in ->msg_iov by ->sendmsg() and ->recvmsg() will pass access_ok(). Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-19separate kernel- and userland-side msghdrAl Viro
Kernel-side struct msghdr is (currently) using the same layout as userland one, but it's not a one-to-one copy - even without considering 32bit compat issues, we have msg_iov, msg_name and msg_control copied to kernel[1]. It's fairly localized, so we get away with a few functions where that knowledge is needed (and we could shrink that set even more). Pretty much everything deals with the kernel-side variant and the few places that want userland one just use a bunch of force-casts to paper over the differences. The thing is, kernel-side definition of struct msghdr is *not* exposed in include/uapi - libc doesn't see it, etc. So we can add struct user_msghdr, with proper annotations and let the few places that ever deal with those beasts use it for userland pointers. Saner typechecking aside, that will allow to change the layout of kernel-side msghdr - e.g. replace msg_iov/msg_iovlen there with struct iov_iter, getting rid of the need to modify the iovec as we copy data to/from it, etc. We could introduce kernel_msghdr instead, but that would create much more noise - the absolute majority of the instances would need to have the type switched to kernel_msghdr and definition of struct msghdr in include/linux/socket.h is not going to be seen by userland anyway. This commit just introduces user_msghdr and switches the few places that are dealing with userland-side msghdr to it. [1] actually, it's even trickier than that - we copy msg_control for sendmsg, but keep the userland address on recvmsg. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-11-19ath9k_common: make sure DEBUG_FS and RELAY enabledOleksij Rempel
currently ath9k_common depends on this components. Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-19Merge tag 'mac80211-for-john-2014-11-18' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg <johannes@sipsolutions.net> says: "Here's another last minute fix, for minstrel HT crashing depending on the value of some uninitialised stack." Signed-off-by: John W. Linville <linville@tuxdriver.com>
2014-11-19bpf: fix arraymap NULL deref and missing overflow and zero size checksAlexei Starovoitov
- fix NULL pointer dereference: kernel/bpf/arraymap.c:41 array_map_alloc() error: potential null dereference 'array'. (kzalloc returns null) kernel/bpf/arraymap.c:41 array_map_alloc() error: we previously assumed 'array' could be null (see line 40) - integer overflow check was missing in arraymap (hashmap checks for overflow via kmalloc_array()) - arraymap can round_up(value_size, 8) to zero. check was missing. - hashmap was missing zero size check as well, since roundup_pow_of_two() can truncate into zero - found a typo in the arraymap comment and unnecessary empty line Fix all of these issues and make both overflow checks explicit U32 in size. Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19Merge commit '4e6ce4dc7ce71d0886908d55129d5d6482a27ff9' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
2014-11-19Merge tag 'linux-can-fixes-for-3.18-20141118' of ↵David S. Miller
git://gitorious.org/linux-can/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2014-11-18 this is a pull request of 17 patches for net/master for the v3.18 release cycle. The last patch of this pull request ("can: m_can: update to support CAN FD features") adds, as the description says, a new feature to the m_can driver. As the m_can driver has been added in v3.18 there is no risk of causing a regression. Give me a note if this is not okay and I'll create a new pull request without it. There is a patch for the CAN infrastructure by Thomas Körper which fixes calling kfree_skb() from interrupt context. Roman Fietze fixes a typo also in the infrastructure. A patch by Dong Aisheng adds a generic helper function to tell if a skb is normal CAN or CAN-FD frame. Alexey Khoroshilov of the Linux Driver Verification project fixes a memory leak in the esd_usb2 driver. Two patches by Sudip Mukherjee remove unused variables and fixe the signess of a variable. Three patches by me add the missing .ndo_change_mtu callback to the xilinx_can, rcar_can and gs_usb driver. The remaining patches improve the m_can driver: David Cohen adds the missing CONFIG_HAS_IOMEM dependency. Dong Aisheng provides 6 bugfix patches (most important: missing RAM init, sleep in NAPI poll, dlc in RTR). While the last of his patches adds CAN FD support to the driver. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19netlink: Deletion of an unnecessary check before the function call ↵Markus Elfring
"__module_get" The __module_get() function tests whether its argument is NULL and then returns immediately. Thus the test around the call is not needed. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19net: pktgen: Deletion of an unnecessary check before the function call ↵Markus Elfring
"proc_remove" The proc_remove() function tests whether its argument is NULL and then returns immediately. Thus the test around the call is not needed. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19usbnet: rtl8150: remove unused variableSudip Mukherjee
remove unused variable Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19net/mlx4_en: Add VXLAN ndo calls to the PF net device ops tooOr Gerlitz
This is currently missing, which results in a crash when one attempts to set VXLAN tunnel over the mlx4_en when acting as PF. [ 2408.785472] BUG: unable to handle kernel NULL pointer dereference at (null) [...] [ 2408.994104] Call Trace: [ 2408.996584] [<ffffffffa021f7f5>] ? vxlan_get_rx_port+0xd6/0x103 [vxlan] [ 2409.003316] [<ffffffffa021f71f>] ? vxlan_lowerdev_event+0xf2/0xf2 [vxlan] [ 2409.010225] [<ffffffffa0630358>] mlx4_en_start_port+0x862/0x96a [mlx4_en] [ 2409.017132] [<ffffffffa063070f>] mlx4_en_open+0x17f/0x1b8 [mlx4_en] While here, make sure to invoke vxlan_get_rx_port() only when VXLAN offloads are actually enabled and not when they are only supported. Reported-by: Ido Shamay <idos@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19bonding: fix curr_active_slave/carrier with loadbalance arp monitoringNikolay Aleksandrov
Since commit 6fde8f037e60 ("bonding: fix locking in bond_loadbalance_arp_mon()") we can have a stale bond carrier state and stale curr_active_slave when using arp monitoring in loadbalance modes. The reason is that in bond_loadbalance_arp_mon() we can't have do_failover == true but slave_state_changed == false, whenever do_failover is true then slave_state_changed is also true. Then the following piece from bond_loadbalance_arp_mon(): if (slave_state_changed) { bond_slave_state_change(bond); if (BOND_MODE(bond) == BOND_MODE_XOR) bond_update_slave_arr(bond, NULL); } else if (do_failover) { block_netpoll_tx(); bond_select_active_slave(bond); unblock_netpoll_tx(); } will execute only the first branch, always and regardless of do_failover. Since these two events aren't related in such way, we need to decouple and consider them separately. For example this issue could lead to the following result: Bonding Mode: load balancing (round-robin) *MII Status: down* MII Polling Interval (ms): 0 Up Delay (ms): 0 Down Delay (ms): 0 ARP Polling Interval (ms): 100 ARP IP target/s (n.n.n.n form): 192.168.9.2 Slave Interface: ens12 *MII Status: up* Speed: 10000 Mbps Duplex: full Link Failure Count: 2 Permanent HW addr: 00:0f:53:01:42:2c Slave queue ID: 0 Slave Interface: eth1 *MII Status: up* Speed: Unknown Duplex: Unknown Link Failure Count: 70 Permanent HW addr: 52:54:00:2f:0f:8e Slave queue ID: 0 Since some interfaces are up, then the status of the bond should also be up, but it will never change unless something invokes bond_set_carrier() (i.e. enslave, bond_select_active_slave etc). Now, if I force the calling of bond_select_active_slave via for example changing primary_reselect (it can change in any mode), then the MII status goes to "up" because it calls bond_select_active_slave() which should've been done from bond_loadbalance_arp_mon() itself. CC: Veaceslav Falico <vfalico@gmail.com> CC: Jay Vosburgh <j.vosburgh@gmail.com> CC: Andy Gospodarek <andy@greyhouse.net> CC: Ding Tianhong <dingtianhong@huawei.com> Fixes: 6fde8f037e60 ("bonding: fix locking in bond_loadbalance_arp_mon()") Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com> Acked-by: Veaceslav Falico <vfalico@gmail.com> Acked-by: Andy Gospodarek <gospo@cumulusnetworks.com> Acked-by: Ding Tianhong <dingtianhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19Merge branch 'stmmac-next'David S. Miller
Giuseppe Cavallaro says: ==================== stmmac: update driver documentation Recently many changes have been done inside the driver so this patch updates the driver's doc for example reviewing information for the rx and tx processes that are managed by napi method, adding new information for missing glue-logic files etc. Also this reviews and fixes what is reported when run kernel-doc script. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-19stmmac: review driver when run kernel-docGiuseppe CAVALLARO
When run ./scripts/kernel-doc several warnings are reported so this patch fix them. Also it reviews many comments and adds new ones. Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>