Commit Graph

300057 Commits

Author SHA1 Message Date
Jiri Bohac
13a8e0c8cd bonding: don't increase rx_dropped after processing LACPDUs
Since commit 3aba891d, bonding processes LACP frames (802.3ad
mode) with bond_handle_frame(). Currently a copy of the skb is
made and the original is left to be processed by other
rx_handlers and the rest of the network stack by returning
RX_HANDLER_ANOTHER.  As there is no protocol handler for
PKT_TYPE_LACPDU, the frame is dropped and dev->rx_dropped
increased.

Fix this by making bond_handle_frame() return RX_HANDLER_CONSUMED
if bonding has processed the LACP frame.

Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-10 23:30:01 -04:00
Eric W. Biederman
38bf195398 connector/userns: replace netlink uses of cap_raised() with capable()
In 2009 Philip Reiser notied that a few users of netlink connector
interface needed a capability check and added the idiom
cap_raised(nsp->eff_cap, CAP_SYS_ADMIN) to a few of them, on the premise
that netlink was asynchronous.

In 2011 Patrick McHardy noticed we were being silly because netlink is
synchronous and removed eff_cap from the netlink_skb_params and changed
the idiom to cap_raised(current_cap(), CAP_SYS_ADMIN).

Looking at those spots with a fresh eye we should be calling
capable(CAP_SYS_ADMIN).  The only reason I can see for not calling capable
is that it once appeared we were not in the same task as the caller which
would have made calling capable() impossible.

In the initial user_namespace the only difference between between
cap_raised(current_cap(), CAP_SYS_ADMIN) and capable(CAP_SYS_ADMIN) are a
few sanity checks and the fact that capable(CAP_SYS_ADMIN) sets
PF_SUPERPRIV if we use the capability.

Since we are going to be using root privilege setting PF_SUPERPRIV seems
the right thing to do.

The motivation for this that patch is that in a child user namespace
cap_raised(current_cap(),...) tests your capabilities with respect to that
child user namespace not capabilities in the initial user namespace and
thus will allow processes that should be unprivielged to use the kernel
services that are only protected with cap_raised(current_cap(),..).

To fix possible user_namespace issues and to just clean up the code
replace cap_raised(current_cap(), CAP_SYS_ADMIN) with
capable(CAP_SYS_ADMIN).

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Philipp Reisner <philipp.reisner@linbit.com>
Acked-by: Serge E. Hallyn <serge.hallyn@canonical.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Cc: Vasiliy Kulikov <segoon@openwall.com>
Cc: David Howells <dhowells@redhat.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-10 23:21:39 -04:00
Nicolas Dichtel
e0268868ba sctp: check cached dst before using it
dst_check() will take care of SA (and obsolete field), hence
IPsec rekeying scenario is taken into account.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Vlad Yaseivch <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-10 23:15:47 -04:00
Eric Dumazet
c57b546840 pktgen: fix crash at module unload
commit 7d3d43dab4 (net: In unregister_netdevice_notifier unregister
the netdevices.) makes pktgen crashing at module unload.

[  296.820578] BUG: spinlock bad magic on CPU#6, rmmod/3267
[  296.820719]  lock: ffff880310c38000, .magic: ffff8803, .owner: <none>/-1, .owner_cpu: -1
[  296.820943] Pid: 3267, comm: rmmod Not tainted 3.4.0-rc5+ #254
[  296.821079] Call Trace:
[  296.821211]  [<ffffffff8168a715>] spin_dump+0x8a/0x8f
[  296.821345]  [<ffffffff8168a73b>] spin_bug+0x21/0x26
[  296.821507]  [<ffffffff812b4741>] do_raw_spin_lock+0x131/0x140
[  296.821648]  [<ffffffff8169188e>] _raw_spin_lock+0x1e/0x20
[  296.821786]  [<ffffffffa00cc0fd>] __pktgen_NN_threads+0x4d/0x140 [pktgen]
[  296.821928]  [<ffffffffa00ccf8d>] pktgen_device_event+0x10d/0x1e0 [pktgen]
[  296.822073]  [<ffffffff8154ed4f>] unregister_netdevice_notifier+0x7f/0x100
[  296.822216]  [<ffffffffa00d2a0b>] pg_cleanup+0x48/0x73 [pktgen]
[  296.822357]  [<ffffffff8109528e>] sys_delete_module+0x17e/0x2a0
[  296.822502]  [<ffffffff81699652>] system_call_fastpath+0x16/0x1b

Hold the pktgen_thread_lock while splicing pktgen_threads, and test
pktgen_exiting in pktgen_device_event() to make unload faster.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-10 23:10:24 -04:00
David S. Miller
59b9997bab Revert "net: maintain namespace isolation between vlan and real device"
This reverts commit 8a83a00b07.

It causes regressions for S390 devices, because it does an
unconditional DST drop on SKBs for vlans and the QETH device
needs the neighbour entry hung off the DST for certain things
on transmit.

Arnd can't remember exactly why he even needed this change.

Conflicts:

	drivers/net/macvlan.c
	net/8021q/vlan_dev.c
	net/core/dev.c

Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-10 23:03:34 -04:00
Thadeu Lima de Souza Cascardo
380ec964bc ehea: fix losing of NEQ events when one event occurred early
The NEQ interrupt is only triggered when there was no previous pending
interrupt. If we request irq handling after an interrupt has occurred,
we will never get an interrupt until we call H_RESET_EVENTS.

Events seem to be cleared when we first register the NEQ. So, when we
requested irq handling right after registering it, a possible race with
an interrupt was much less likely. Now, there is a chance we may lose
this race and never get any events.

The fix here is to poll and acknowledge any events that might have
happened right after registering the irq handler.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-10 22:45:54 -04:00
Benjamin Poirier
cfb8c3aa59 igb: fix rtnl race in PM resume path
Since the caller (PM resume code) is not the one holding rtnl, when taking the
'else' branch rtnl may be released at any moment, thereby defeating the whole
purpose of this code block.

Signed-off-by: Benjamin Poirier <bpoirier@suse.de>
Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-10 22:44:46 -04:00
David S. Miller
dccd9ecc37 ipv4: Do not use dead fib_info entries.
Due to RCU lookups and RCU based release, fib_info objects can
be found during lookup which have fi->fib_dead set.

We must ignore these entries, otherwise we risk dereferencing
the parts of the entry which are being torn down.

Reported-by: Yevgen Pronenko <yevgen.pronenko@sonymobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-10 22:16:32 -04:00
David S. Miller
0e0c55165b Merge branch 'sfc-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/bwh/sfc 2012-05-09 22:49:57 -04:00
Julien Ducourthial
477206a018 r8169: fix unsigned int wraparound with TSO
The r8169 may get stuck or show bad behaviour after activating TSO :
the net_device is not stopped when it has no more TX descriptors.
This problem comes from TX_BUFS_AVAIL which may reach -1 when all
transmit descriptors are in use. The patch simply tries to keep positive
values.

Tested with 8111d(onboard) on a D510MO, and with 8111e(onboard) on a
Zotac 890GXITX.

Signed-off-by: Julien Ducourthial <jducourt@free.fr>
Acked-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-08 19:34:10 -04:00
David S. Miller
c5baa80ac8 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jesse/openvswitch 2012-05-08 19:31:32 -04:00
Ben Hutchings
3132d2827d sfc: Fix division by zero when using one RX channel and no SR-IOV
If RSS is disabled on the PF (efx->n_rx_channels == 1) we try to set
up the indirection table so that VFs can use it, setting
efx->rss_spread = efx_vf_size(efx).  But if SR-IOV was disabled at
compile time, this evaluates to 0 and we end up dividing by zero when
initialising the table.

I considered changing the fallback definition of efx_vf_size() to
return 1, but its value is really meaningless if we are not going to
enable VFs.  Therefore add a condition of efx_sriov_wanted(efx) in
efx_probe_interrupts().

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
2012-05-08 18:26:40 +01:00
Pravin B Shelar
072ae6314a openvswitch: Validation of IPv6 set port action uses IPv4 header
When the kernel validates set TCP/UDP port actions, it looks at
the ports in the existing flow to make sure that the L4 header exists.
However, these actions always use the IPv4 version of the struct.
Following patch fixes this by checking for flow ip protocol first.

Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
2012-05-07 17:23:10 -07:00
Johannes Berg
1c430a727f net: compare_ether_addr[_64bits]() has no ordering
Neither compare_ether_addr() nor compare_ether_addr_64bits()
(as it can fall back to the former) have comparison semantics
like memcmp() where the sign of the return value indicates sort
order. We had a bug in the wireless code due to a blind memcmp
replacement because of this.

A cursory look suggests that the wireless bug was the only one
due to this semantic difference.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-07 19:21:29 -04:00
Bjørn Mork
6eddcb4c82 cdc_ether: Ignore bogus union descriptor for RNDIS devices
Some RNDIS devices include a bogus CDC Union descriptor pointing
to non-existing interfaces.  The RNDIS code is already prepared
to handle devices without a CDC Union descriptor by hardwiring
the driver to use interfaces 0 and 1, which is correct for the
devices with the bogus descriptor as well. So we can reuse the
existing workaround.

Cc: Markus Kolb <linux-201011@tower-net.de>
Cc: Iker Salmón San Millán <shaola@esdebian.org>
Cc: Jonathan Nieder <jrnieder@gmail.com>
Cc: Oliver Neukum <oliver@neukum.org>
Cc: 655387@bugs.debian.org
Cc: stable@vger.kernel.org
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-06 13:11:55 -04:00
Ariel Elior
24f06716cd bnx2x: bug fix when loading after SAN boot
This is a bug fix for an "interface fails to load" issue.
The issue occurs when bnx2x driver loads after UNDI driver was previously
loaded over the chip. In such a scenario the UNDI driver is loaded and operates
in the pre-boot kernel, within its own specific host memory address range.
When the pre-boot stage is complete, the real kernel is loaded, in a new and
distinct host memory address range. The transition from pre-boot stage to boot
is asynchronous from UNDI point of view.

A race condition occurs when UNDI driver triggers a DMAE transaction to valid
host addresses in the pre-boot stage, when control is diverted to the real
kernel. This results in access to illegal addresses by our HW as the addresses
which were valid in the preboot stage are no longer considered valid.
Specifically, the 'was_error' bit in the pci glue of our device is set. This
causes all following pci transactions from chip to host to timeout (in
accordance to the pci spec).

Signed-off-by: Ariel Elior <ariele@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-06 13:10:38 -04:00
David S. Miller
6e1344e808 Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless 2012-05-04 12:07:15 -04:00
David S. Miller
8af3994e23 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net 2012-05-04 10:55:50 -04:00
Andrei Emeltchenko
dd7f5c9e5c e1000: Silence sparse warnings by correcting type
Silence sparse warnings shown below:
...
drivers/net/ethernet/intel/e1000/e1000_main.c:3435:17: warning:
	cast to restricted __le64
drivers/net/ethernet/intel/e1000/e1000_main.c:3435:17: warning:
	cast to restricted __le64
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2012-05-04 04:00:00 -07:00
John Fastabend
dad8a3b3ea igb, ixgbe: netdev_tx_reset_queue incorrectly called from tx init path
igb and ixgbe incorrectly call netdev_tx_reset_queue() from
i{gb|xgbe}_clean_tx_ring() this sort of works in most cases except
when the number of real tx queues changes. When the number of real
tx queues changes netdev_tx_reset_queue() only gets called on the
new number of queues so when we reduce the number of queues we risk
triggering the watchdog timer and repeated device resets.

So this is not only a cosmetic issue but causes real bugs. For
example enabling/disabling DCB or FCoE in ixgbe will trigger this.

CC: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: John Fastabend <john.r.fastabend@intel.com>
Tested-by: John Bishop <johnx.bishop@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2012-05-04 03:58:33 -07:00
Ansis Atteka
4cb6e116bb openvswitch: Release rtnl_lock if ovs_vport_cmd_build_info() failed.
This patch fixes a possible lock-up bug where rtnl_lock might not
get released.

Signed-off-by: Ansis Atteka <aatteka@nicira.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
2012-05-03 18:40:38 -07:00
Linus Torvalds
0a6ba092d1 Second MFD pull request for 3.4 fixes
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJPov/QAAoJEIqAPN1PVmxK3t4QAJXtU74wUapW6af+7jejEkCF
 ehKTSzETSgjmMM8kMSqKb0Szo2lXfrYEu6in7j0U4OJskPsxmlCaK7+wOL8kBden
 nLB2jVV5qxgU4FnCatEintKQFg9MAy2pZvGXqXbFXT/OkGMXnhVY2jUxO0T5pPTs
 5HGlP56//AuuI8prpUDjICa4LlR9LkVuZG+gwlkJhK6PqkNfL9RrNvkeVhoRcOFH
 Ch9+C5GbPFsFevXf870NwL3uFpAK3D7lX8ryfCeKJru83SiUwcJIZQTDQ1F+1+vI
 /bhTa3elxyMEsZfjNkvRoKF27fWDyCfDHirlebM4jJTEJR3PAFgQ2p3dxggaFELc
 JyF0pjev3i+KVdUce+OFv7z9kbT+gnAUqMtJS8OwmzB2BHR/WUgsfZVt6LNAmgpy
 BL7C61jsWW2qkjwTlDY53pInrV7EEeRwrDu65k57uen99Cne0OouHaBmnvelSn+9
 brDFHu0fKD+tfq98cl2iIhZkZiMgqHV5OoACnDvHiyRCGQp8Z8IrWac21AzsLmHv
 rMDSftgXOV8hhjrirw3fHnwCoLoK2HzI4/SWudRCz+PVdoE4NgZvCnERuCvER5zM
 7a/t8ZQz9FUsBSDx90anDxxuCRAKNb4A5wwu0VoV0fcNQow97gudrAQXtql0d7jo
 UktFQhSp6bIC8+TK2rWG
 =YIOH
 -----END PGP SIGNATURE-----

Merge tag 'mfd-for-linus-3.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6

Pull second set of MFD fixes from Samuel Ortiz:
 "This time we only have a one liner fixing an omap-usb build error."

* tag 'mfd-for-linus-3.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6:
  mfd: Fix build breakage in omap-usb-host.c
2012-05-03 17:21:05 -07:00
Linus Torvalds
65e62b502b Merge branch 'efi-vars' from Matthew Garrett
* efi-vars:
  efivars: Improve variable validation
2012-05-03 17:19:48 -07:00
Matthew Garrett
54b3a4d311 efivars: Improve variable validation
Ben Hutchings pointed out that the validation in efivars was inadequate -
most obviously, an entry with size 0 would server as a DoS against the
kernel. Improve this based on his suggestions.

Signed-off-by: Matthew Garrett <mjg@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-05-03 17:19:19 -07:00
Linus Torvalds
6b4c555a6b Change summary:
1) Fix regression that could cause a misdiagnosis, which in turn could
    lead to an erroneous 3.0 Gbps -> 1.5 downshift, particularly when hotplug
    and suspend/resume is involved.
 
 2) Fix a regression that led to ata%d controller ids being numbered one
    larger than in <= 3.4-rc3 (oh, the horror!).  Controller ids should now be
    as expected.
 
 3) add some DT, PCI id's
 
 4) ata/pata_arasan_cf: minor cpp fixing/cleaning
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIVAwUAT6LKvSWzCDIBeCsvAQIq2BAAikXKo+1ZVjeG4qRQvjCLFC0vaP7Roflr
 aWpcl4Dmrq3MFw7L69uUnYnZETaBETiMuXYqj8ysaB6EUZHcXYUvgK96iWU4+gmb
 rLVXj5KJqMREQiAxwvYhhYYEsJHeKWSdNJKhCJPL9knfDzrB8rYznfSSZCpBNazk
 cKPJFBQJbIfbhtJce1QRatnT0B7bEJongnEmNiaBKoUyfdJslUw7XqfxwWRGphwg
 QGJez8GPDKPRnKL9d8j1zoDjTTrSSPCkpyGwl66cGov65CRFJKekanz9l7+E5ztY
 Uzyce/ew3VUXYFErIJUGzVu9pdBWdYnrDHvnvMbOgiy2kUfdVLNfQ3p8mToHTaN7
 SBuzrNwG+UxSMMioXdE4yLaQ8mI2xY4XC6iaHHSb0f30xmzCvLRZ8FbOXM/gETAd
 s65lLC+9ebrmVdz15MLLbJsjgnovpgMehpjAZ6EZhKxbw0oAnybrRLceilKBDSkl
 gzjK38HKZke08EZ0t5QsNOPV878ELY0exl724YRk35W5kTJkvUptFDmbgJ5s/uAx
 BJinG2xHGp0HAbdSfxrFbBmUjlCO0cmdUWVk7ZxvEsWQ7EGmLleCFFSbCeTWA6Ah
 QRDZpEWA9wjku1Q6d05KYfz364nUksKds1VobHCOwodsPdWdWs59oYbNf38Gu/mh
 qlgFHFVU/j0=
 =c7fz
 -----END PGP SIGNATURE-----

Merge tag 'tag/upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev

Pull libata fixes from Jeff Garzik:

1) Fix regression that could cause a misdiagnosis, which in turn could
   lead to an erroneous 3.0 Gbps -> 1.5 downshift, particularly when hotplug
   and suspend/resume is involved.

2) Fix a regression that led to ata%d controller ids being numbered one
   larger than in <= 3.4-rc3 (oh, the horror!).  Controller ids should now be
   as expected.

3) add some DT, PCI id's

4) ata/pata_arasan_cf: minor cpp fixing/cleaning

* tag 'tag/upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  ata: ahci_platform: Add synopsys ahci controller in DT's compatible list
  ata/pata_arasan_cf: Move arasan_cf_pm_ops out of #ifdef, #endif macros
  libata: init ata_print_id to 0
  ahci: Detect Marvell 88SE9172 SATA controller
  libata: skip old error history when counting probe trials
2012-05-03 17:16:52 -07:00
Linus Torvalds
4e78f00261 Merge branch 'i2c-embedded/for-current' of git://git.pengutronix.de/git/wsa/linux
Pull i2c embedded fixes from Wolfram Sang:
 "Here are some typical i2c driver bugfixes for 3.4.  Missed clock
  handling, improper timeout fixes, hardware wrokarounds...  All
  patches have been in linux-next for a few days, too."

* 'i2c-embedded/for-current' of git://git.pengutronix.de/git/wsa/linux:
  i2c: mxs: disable QUEUE when sending is done
  i2c: mxs: handle spurious interrupt
  i2c-eg20t: Modify MODULE_AUTHOR's email address
  i2c-eg20t: change timeout value 50msec to 1000msec
  i2c: tegra: Add delay before resetting the controller after NACK
  i2c: pnx: Disable clk in suspend
2012-05-03 17:15:47 -07:00
Linus Torvalds
f5645b5959 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
 "Just some regression fixes from Ben along with a variable that gcc
  failed to spot is uninitialised."

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  nouveau: initialise has_optimus variable.
  drm/nv10/gpio: fix thinko in mask for gpio lines 2-9
  nvc0/fb: shut up PMFB interrupt after the first occurrence
  drm/nouveau/hdmi: use correct hdmi regs for nvaa/nvac
  drm/nouveau/bios: fix regression on some nv4x board
2012-05-03 17:14:55 -07:00
Linus Torvalds
c42f1d4b52 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:

 1) Transfer padding was wrong for full-speed USB in ASIX driver, fix
    from Ingo van Lil.

 2) Propagate the negative packet offset fix into the PowerPC BPF JIT.
    From Jan Seiffert.

 3) dl2k driver's private ioctls were letting unprivileged tasks make
    MII writes and other ugly bits like that.  Fix from Jeff Mahoney.

 4) Fix TX VLAN and RX packet drops in ucc_geth, from Joakim Tjernlund.

 5) OOPS and network namespace fixes in IPVS from Hans Schillstrom and
    Julian Anastasov.

 6) Fix races and sleeping in locked context bugs in drop_monitor, from
    Neil Horman.

 7) Fix link status indication in smsc95xx driver, from Paolo Pisati.

 8) Fix bridge netfilter OOPS, from Peter Huang.

 9) L2TP sendmsg can return on error conditions with the socket lock
    held, oops.  Fix from Sasha Levin.

10) udp_diag should return meaningful values for socket memory usage,
    from Shan Wei.

11) Eric Dumazet is so awesome he gets his own section:

       Socket memory cgroup code (I never should have applied those
       patches, grumble...) made erroneous changes to
       sk_sockets_allocated_read_positive().  It was changed to
       use percpu_counter_sum_positive (which requires BH disabling)
       instead of percpu_counter_read_positive (which does not).
       Revert back to avoid crashes and lockdep warnings.

       Adjust the default tcp_adv_win_scale and tcp_rmem[2] values
       to fix throughput regressions.  This is necessary as a result
       of our more precise skb->truesize tracking.

       Fix SKB leak in netem packet scheduler.

12) New device IDs for various bluetooth devices, from Manoj Iyer,
    AceLan Kao, and Steven Harms.

13) Fix command completion race in ipw2200, from Stanislav Yakovlev.

14) Fix rtlwifi oops on unload, from Larry Finger.

15) Fix hard_mtu when adjusting hard_header_len in smsc95xx driver.
    From Stephane Fillod.

16) ehea driver registers it's IRQ before all the necessary state is
    setup, resulting in crashes.  Fix from Thadeu Lima de Souza
    Cascardo.

17) Fix PHY connection failures in davinci_emac driver, from Anatolij
    Gustschin.

18) Missing break; in switch statement in bluetooth's
    hci_cmd_complete_evt().  Fix from Szymon Janc.

19) Fix queue programming in iwlwifi, from Johannes Berg.

20) Interrupt throttling defaults not being actually programmed into the
    hardware, fix from Jeff Kirsher and Ying Cai.

21) TLAN driver SKB encoding in descriptor busted on 64-bit, fix from
    Benjamin Poirier.

22) Fix blind status block RX producer pointer deref in TG3 driver, from
    Matt Carlson.

23) Promisc and multicast are busted on ehea, fixes from Thadeu Lima de
    Souza Cascardo.

24) Fix crashes in 6lowpan, from Alexander Smirnov.

25) tcp_complete_cwr() needs to be careful to not rewind the CWND to
    ssthresh if ssthresh has the "infinite" value.  Fix from Yuchung
    Cheng.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (81 commits)
  sungem: Fix WakeOnLan
  tcp: change tcp_adv_win_scale and tcp_rmem[2]
  net: l2tp: unlock socket lock before returning from l2tp_ip_sendmsg
  drop_monitor: prevent init path from scheduling on the wrong cpu
  usbnet: fix failure handling in usbnet_probe
  usbnet: fix leak of transfer buffer of dev->interrupt
  ucc_geth: Add 16 bytes to max TX frame for VLANs
  net: ucc_geth, increase no. of HW RX descriptors
  netem: fix possible skb leak
  sky2: fix receive length error in mixed non-VLAN/VLAN traffic
  sky2: propogate rx hash when packet is copied
  net: fix two typos in skbuff.h
  cxgb3: Don't call cxgb_vlan_mode until q locks are initialized
  ixgbe: fix calling skb_put on nonlinear skb assertion bug
  ixgbe: Fix a memory leak in IEEE DCB
  igbvf: fix the bug when initializing the igbvf
  smsc75xx: enable mac to detect speed/duplex from phy
  smsc75xx: declare smsc75xx's MII as GMII capable
  smsc75xx: fix phy interrupt acknowledge
  smsc75xx: fix phy init reset loop
  ...
2012-05-03 17:10:39 -07:00
Linus Torvalds
913a904169 hwmon fixes for 3.4-rc6
Fix OOPS seen in coretemp driver if the CPU core ID is too large
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.10 (GNU/Linux)
 
 iQIcBAABAgAGBQJPorqvAAoJEMsfJm/On5mBPaMP/i/JH099QD0REncHrT79q6FY
 /AvLIc8+apnU4qVfdT1IXqFU8xwJ8zAbttjELae68uf7XV2F92YhmFrd5ExZe85L
 tokRONm6ThKDNzjLC5CFEgYVnch32DInNP5IgrxWNEJABLtHl3zGtTCmyOy7b3Gi
 xzYwPI62OEVCpDpusMlfWJvk05telzL+OlNAofd7WIMH7qSQo73GiF6x6NC8aVSB
 x58bQLSAU0dVDk0y66csCAd0JtYSszDxU2uvaDzTTNcsQDs9YyFIkIeBWFLESfpD
 NnhSOysRnlKcuH+VDlQLGWOMUxlzCzezqULWI9bjALB8XZ+kzGtx+NLMN+IB/7bL
 pkSxy88dMQjys2ymL3Pv16Pe+s6wuOuSsUsrWiZ2h3JjhCgqucMt4rdhIzAXlvm1
 hKkbpPfMcALbLD2cHLsZWDAdFVmlystlt4Rc+zBGlK7nucs7mMsPnaDU4fsw2hGM
 lc7Y+neZtk/2YPAhqqcikqjgY0FAf80ndo2IBpZnVmPPdvwNOE75/+yZWwOPw1/C
 hb4G//g0/Pg509a3gbBl10AiNX/VrnbJJrkpgbAlGqMU+ZQi0dveRK2FZX2KXRw3
 pEt+cQfDB809vR421lcw7IQpgQnzUQsox7BW3IKt2LeUX4Ie9ZnmnE1b8eIpazQl
 t9lOL/iKy02BmMPtccO7
 =iNOt
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:
 "Fix OOPS seen in coretemp driver if the CPU core ID is too large"

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (coretemp) Increase CPU core limit
  hwmon: (coretemp) fix oops on cpu unplug
2012-05-03 17:08:58 -07:00
Viresh Kumar
5f098a3ea7 ata: ahci_platform: Add synopsys ahci controller in DT's compatible list
SPEAr13xx series of SoCs contain Synopsys AHCI SATA Controller which shares
ahci_platform driver with other controller versions.

This patch updates DT compatible list for ahci_platform. It also updates and
renames binding documentation to more generic name.

Signed-off-by: Viresh Kumar <viresh.kumar@st.com>
Cc: Rob Herring <rob.herring@calxeda.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2012-05-03 14:08:53 -04:00
Viresh Kumar
fb9751d471 ata/pata_arasan_cf: Move arasan_cf_pm_ops out of #ifdef, #endif macros
#ifdef, #endif is not required in definition/usage of arasan_cf_pm_ops. So, move
this definition and its usage outside of them.

Signed-off-by: Viresh Kumar <viresh.kumar@st.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2012-05-03 14:08:03 -04:00
Tero Roponen
a78f57af61 libata: init ata_print_id to 0
When comparing the dmesg between 3.4-rc3 and 3.4-rc4 I found the
following differences:

 -ata1: SATA max UDMA/133 abar m2048@0xf9fff000 port 0xf9fff100 irq 47
 -ata2: SATA max UDMA/133 abar m2048@0xf9fff000 port 0xf9fff180 irq 47
 -ata3: DUMMY
 +ata2: SATA max UDMA/133 abar m2048@0xf9fff000 port 0xf9fff100 irq 47
 +ata3: SATA max UDMA/133 abar m2048@0xf9fff000 port 0xf9fff180 irq 47
  ata4: DUMMY
  ata5: DUMMY
 -ata6: SATA max UDMA/133 abar m2048@0xf9fff000 port 0xf9fff380 irq 47
 +ata6: DUMMY
 +ata7: SATA max UDMA/133 abar m2048@0xf9fff000 port 0xf9fff380 irq 47

The change of numbering comes from commit 85d6725b7c ("libata:
make ata_print_id atomic") that changed lines like

	ap->print_id = ata_print_id++;
		to
	ap->print_id = atomic_inc_return(&ata_print_id);

As the latter behaves like ++ata_print_id, we must initialize
it to zero to start the numbering from one.

Signed-off-by: Tero Roponen <tero.roponen@gmail.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2012-05-03 14:07:59 -04:00
Matt Johnson
642d892522 ahci: Detect Marvell 88SE9172 SATA controller
The Marvell 88SE9172 SATA controller (PCI ID 1b4b 917a) already worked
once it was detected, but was missing an ahci_pci_tbl entry.

Boot tested on a Gigabyte Z68X-UD3H-B3 motherboard.

Signed-off-by: Matt Johnson <johnso87@illinois.edu>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2012-05-03 14:07:40 -04:00
Lin Ming
6868225e3e libata: skip old error history when counting probe trials
Commit d902747("[libata] Add ATA transport class") introduced
ATA_EFLAG_OLD_ER to mark entries in the error ring as cleared.

But ata_count_probe_trials_cb() didn't check this flag and it still
counts the old error history. So wrong probe trials count is returned
and it causes problem, for example, SATA link speed is slowed down from
3.0Gbps to 1.5Gbps.

Fix it by checking ATA_EFLAG_OLD_ER in ata_count_probe_trials_cb().

Cc: stable <stable@vger.kernel.org> # 2.6.37+
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2012-05-03 14:05:58 -04:00
John W. Linville
3c3052eac2 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem 2012-05-03 11:23:15 -04:00
Eric Dumazet
ed90542b0c iwlwifi: fix skb truesize underestimation
By default, iwlwifi uses order-1 pages (8 KB) to store incoming frames,
but doesnt say so in skb->truesize.

This makes very possible to exhaust kernel memory since these skb evade
normal socket memory accounting.

As struct ieee80211_hdr is going to be pulled before calling IP stack,
there is no need to use dev_alloc_skb() to reserve NET_SKB_PAD bytes.
alloc_skb() is ok in this driver, allowing more tailroom.

Pull beginning of frame in skb header, in the hope we can reuse order-1
pages in the driver immediately for small frames and reduce their
truesize to the minimum (linear skbs)

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Cc: Neal Cardwell <ncardwell@google.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-05-03 10:52:30 -04:00
John Fastabend
f525c6d295 ixgbe: dcb: BIT_APP_UPCHG not set by ixgbe_copy_dcb_cfg()
After this commit:

commit aacc1bea19
Author: Multanen, Eric W <eric.w.multanen@intel.com>
Date:   Wed Mar 28 07:49:09 2012 +0000

    ixgbe: driver fix for link flap

The BIT_APP_UPCHG bit is no longer set when ixgbe_dcbnl_set_all() is
called. This results in the FCoE app user priority never getting set
and the driver will not configure the tx_rings correctly for FCoE
packets which use the SAN MTU and FCoE offloads.

We resolve this regression by fixing ixgbe_copy_dcb_cfg() to also
check for FCoE application changes. Additionally, we can drop the
IEEE variants of get_dcb_app() because this path is never called
with the IEEE mode enabled.

Signed-off-by: John Fastabend <john.r.fastabend@intel.com>
Tested-by: Ross Brattain <ross.b.brattain@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2012-05-03 03:04:13 -07:00
Don Skidmore
ab6039a70b ixgbe: fix race condition with shutdown
It was possible for shutdown to pull the rug out from other driver entry
points.  Now we just grab the rtnl lock before taking everything apart.
Thanks to Hariharan for noticing this tight race condition.

Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com>
Cc: Hariharan Nagarajan <hanagara@cisco.com>
Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2012-05-03 03:02:43 -07:00
Dave Airlie
addde4ec31 nouveau: initialise has_optimus variable.
We should initialise this to 0 really to avoid getting false positives.

Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
2012-05-03 09:30:58 +01:00
Gerard Lledo
5a8887d39e sungem: Fix WakeOnLan
WakeOnLan was broken in this driver because gp->asleep_wol is a 1-bit
bitfield and it was being assigned WAKE_MAGIC, which is (1 << 5).
gp->asleep_wol remains 0 and the machine never wakes up.  Fixed by casting
gp->wake_on_lan to bool.  Tested on an iBook G4.

Signed-off-by: Gerard Lledo <gerard.lledo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-03 01:42:55 -04:00
Eric Dumazet
b49960a05e tcp: change tcp_adv_win_scale and tcp_rmem[2]
tcp_adv_win_scale default value is 2, meaning we expect a good citizen
skb to have skb->len / skb->truesize ratio of 75% (3/4)

In 2.6 kernels we (mis)accounted for typical MSS=1460 frame :
1536 + 64 + 256 = 1856 'estimated truesize', and 1856 * 3/4 = 1392.
So these skbs were considered as not bloated.

With recent truesize fixes, a typical MSS=1460 frame truesize is now the
more precise :
2048 + 256 = 2304. But 2304 * 3/4 = 1728.
So these skb are not good citizen anymore, because 1460 < 1728

(GRO can escape this problem because it build skbs with a too low
truesize.)

This also means tcp advertises a too optimistic window for a given
allocated rcvspace : When receiving frames, sk_rmem_alloc can hit
sk_rcvbuf limit and we call tcp_prune_queue()/tcp_collapse() too often,
especially when application is slow to drain its receive queue or in
case of losses (netperf is fast, scp is slow). This is a major latency
source.

We should adjust the len/truesize ratio to 50% instead of 75%

This patch :

1) changes tcp_adv_win_scale default to 1 instead of 2

2) increase tcp_rmem[2] limit from 4MB to 6MB to take into account
better truesize tracking and to allow autotuning tcp receive window to
reach same value than before. Note that same amount of kernel memory is
consumed compared to 2.6 kernels.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-02 21:08:58 -04:00
Sasha Levin
84768edbb2 net: l2tp: unlock socket lock before returning from l2tp_ip_sendmsg
l2tp_ip_sendmsg could return without releasing socket lock, making it all the
way to userspace, and generating the following warning:

[  130.891594] ================================================
[  130.894569] [ BUG: lock held when returning to user space! ]
[  130.897257] 3.4.0-rc5-next-20120501-sasha #104 Tainted: G        W
[  130.900336] ------------------------------------------------
[  130.902996] trinity/8384 is leaving the kernel with locks still held!
[  130.906106] 1 lock held by trinity/8384:
[  130.907924]  #0:  (sk_lock-AF_INET){+.+.+.}, at: [<ffffffff82b9503f>] l2tp_ip_sendmsg+0x2f/0x550

Introduced by commit 2f16270 ("l2tp: Fix locking in l2tp_ip.c").

Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-02 21:04:33 -04:00
Neil Horman
4fdcfa1284 drop_monitor: prevent init path from scheduling on the wrong cpu
I just noticed after some recent updates, that the init path for the drop
monitor protocol has a minor error.  drop monitor maintains a per cpu structure,
that gets initalized from a single cpu.  Normally this is fine, as the protocol
isn't in use yet, but I recently made a change that causes a failed skb
allocation to reschedule itself .  Given the current code, the implication is
that this workqueue reschedule will take place on the wrong cpu.  If drop
monitor is used early during the boot process, its possible that two cpus will
access a single per-cpu structure in parallel, possibly leading to data
corruption.

This patch fixes the situation, by storing the cpu number that a given instance
of this per-cpu data should be accessed from.  In the case of a need for a
reschedule, the cpu stored in the struct is assigned the rescheule, rather than
the currently executing cpu

Tested successfully by myself.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: David Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-02 21:02:48 -04:00
tom.leiming@gmail.com
a4723848d0 usbnet: fix failure handling in usbnet_probe
If register_netdev returns failure, the dev->interrupt and
its transfer buffer should be released, so just fix it.

Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-02 20:13:04 -04:00
tom.leiming@gmail.com
720f3d7cb1 usbnet: fix leak of transfer buffer of dev->interrupt
The transfer buffer of dev->interrupt is allocated in .probe path,
but not freed in .disconnet path, so mark the interrupt URB as
URB_FREE_BUFFER to free the buffer when the URB is destroyed.

Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-02 20:13:03 -04:00
Joakim Tjernlund
70f8002d78 ucc_geth: Add 16 bytes to max TX frame for VLANs
Creating a VLAN interface on top of ucc_geth adds 4 bytes
to the frame and the HW controller is not prepared to
TX a frame bigger than 1518 bytes which is 4 bytes too
small for a full VLAN frame. Add 16 bytes which will handle
the a simple VLAN and leaves 12 bytes for future expansion.

Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-02 20:09:04 -04:00
Joakim Tjernlund
5bbdc057c2 net: ucc_geth, increase no. of HW RX descriptors
In a busy network we see ucc_geth is dropping RX pkgs every now
and then. Increase the RX queues HW descriptors from
16 to 32 to deal with this.

Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-02 20:09:04 -04:00
Linus Torvalds
ac001e7654 USB patches for 3.4-rc5
Here are two EHCI Tegra driver patches for your tree.
 
 The first is a bit big, but the majority is just moving code around. It
 is needed due to the other EHCI core changes that went in way back in
 3.4-rc1, so this driver will now properly handle suspend/resume, as it
 was broken.  The other one is a minor bugfix that resolves an warning
 that people have been seeing.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.18 (GNU/Linux)
 
 iEYEABECAAYFAk+hli8ACgkQMUfUDdst+ymGdgCeKYDYx5w2N+tmSy50kjDEhSQI
 534AoK3+ZQUNsEyLU8ufLtNOyPrtIH3i
 =5LmY
 -----END PGP SIGNATURE-----

Merge tag 'usb-3.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB patches from Greg Kroah-Hartman:
 "Here are two EHCI Tegra driver patches for your tree.

  The first is a bit big, but the majority is just moving code around.
  It is needed due to the other EHCI core changes that went in way back
  in 3.4-rc1, so this driver will now properly handle suspend/resume, as
  it was broken.  The other one is a minor bugfix that resolves an
  warning that people have been seeing."

* tag 'usb-3.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: ehci-tegra: remove redundant gpio_set_value
  EHCI: update PM methods in ehci-tegra.c
2012-05-02 13:48:33 -07:00
Linus Torvalds
c89ff23960 TTY fix for 3.4-rc5
This is a deadlock bugfix that was easy to hit, and that the vt layer lock
 rework got wrong, so it reverts the logic back to the way it was in 3.3 and
 earlier kernels to prevent problems.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.18 (GNU/Linux)
 
 iEYEABECAAYFAk+hlr4ACgkQMUfUDdst+ynGqwCfeaot2snAEoWi1qp1pU+4cAJn
 8gwAoLaO//pVnVmUIplPMRtFr3tuUN/h
 =z8wN
 -----END PGP SIGNATURE-----

Merge tag 'tty-3.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull a TTY fix from Greg Kroah-Hartman:
 "This is a deadlock bugfix that was easy to hit, and that the vt layer
  lock rework got wrong, so it reverts the logic back to the way it was
  in 3.3 and earlier kernels to prevent problems."

* tag 'tty-3.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  vt: Fix deadlock on scroll-lock
2012-05-02 13:47:49 -07:00
Rajkumar Manoharan
9d1ceac5c6 Revert "ath9k_hw: Fix incorrect spur_freq_sd for AR9003"
This reverts commit a844adfd7b.
The commit a844adfd is degrading rx sensitivity of lower rate in
HT40 mode and it is confirmed that reverting the change is
improving rx sensitivity.

spur_freq_sd (for self-corr in AGC) is defined with respect to the
center of each 20MHz channel while spur_phase_delta (for self-corr
in Rx and spur data filter) is defined with respect to the center
of current RF channel.

So in short, we need to subtract spur_freq_sd (for self-corr in AGC)
by the offset between the center of primary20 and the center of RF
channel in SW. This offset could be +/10 MHz for dynamic 40.

Cc: Madhan Jaganathan <madhanj@qca.qualcomm.com>
Signed-off-by: Kai Shi <kaishi@qca.qualcomm.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-05-02 14:02:03 -04:00