linux-stable.git/drivers/net/ethernet/intel, branch v3.18

net: Check for presence of IFLA_AF_SPEC

2014-11-26T20:29:01+00:00

ndo_bridge_setlink() is currently only called on the slave if
IFLA_AF_SPEC is set but this is a very fragile assumption and may
change in the future.

Cc: Ajit Khaparde 
Cc: John Fastabend 
Signed-off-by: Thomas Graf 
Acked-by: Jeff Kirsher 
Signed-off-by: David S. Miller

net: Validate IFLA_BRIDGE_MODE attribute length

2014-11-26T20:29:00+00:00

Payload is currently accessed blindly and may exceed valid message
boundaries.

Fixes: a77dcb8c8 ("be2net: set and query VEB/VEPA mode of the PF interface")
Fixes: 815cccbf1 ("ixgbe: add setlink, getlink support to ixgbe and ixgbevf")
Cc: Ajit Khaparde 
Cc: John Fastabend 
Signed-off-by: Thomas Graf 
Acked-by: Jeff Kirsher 
Acked-by: John Fastabend 
Signed-off-by: David S. Miller

igb: Fixes needed for surprise removal support

2014-11-23T19:26:12+00:00

This patch adds some checks in order to prevent panic's on surprise
removal of devices during S0, S3, S4.  Without this patch, Thunderbolt
type device removal will panic the system.

Signed-off-by: Yanir Lubetkin 
Signed-off-by: Carolyn Wyborny 
Tested-by: Aaron Brown 
Signed-off-by: Jeff Kirsher 
Signed-off-by: David S. Miller

ixgbe: fix use after free adapter->state test in ixgbe_remove/ixgbe_probe

2014-11-23T19:26:12+00:00

While working on a different issue, I noticed an annoying use
after free bug on my machine when unloading the ixgbe driver:

[ 8642.318797] ixgbe 0000:02:00.1: removed PHC on p2p2
[ 8642.742716] ixgbe 0000:02:00.1: complete
[ 8642.743784] BUG: unable to handle kernel paging request at ffff8807d3740a90
[ 8642.744828] IP: [] ixgbe_remove+0xfc/0x1b0 [ixgbe]
[ 8642.745886] PGD 20c6067 PUD 81c1f6067 PMD 81c15a067 PTE 80000007d3740060
[ 8642.746956] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
[ 8642.748039] Modules linked in: [...]
[ 8642.752929] CPU: 1 PID: 1225 Comm: rmmod Not tainted 3.18.0-rc2+ #49
[ 8642.754203] Hardware name: Supermicro X10SLM-F/X10SLM-F, BIOS 1.1b 11/01/2013
[ 8642.755505] task: ffff8807e34d3fe0 ti: ffff8807b7204000 task.ti: ffff8807b7204000
[ 8642.756831] RIP: 0010:[]  [] ixgbe_remove+0xfc/0x1b0 [ixgbe]
[...]
[ 8642.774335] Stack:
[ 8642.775805]  ffff8807ee824098 ffff8807ee824098 ffffffffa01f3000 ffff8807ee824000
[ 8642.777326]  ffff8807b7207e18 ffffffff8137720f ffff8807ee824098 ffff8807ee824098
[ 8642.778848]  ffffffffa01f3068 ffff8807ee8240f8 ffff8807b7207e38 ffffffff8144180f
[ 8642.780365] Call Trace:
[ 8642.781869]  [] pci_device_remove+0x3f/0xc0
[ 8642.783395]  [] __device_release_driver+0x7f/0xf0
[ 8642.784876]  [] driver_detach+0xb8/0xc0
[ 8642.786352]  [] bus_remove_driver+0x59/0xe0
[ 8642.787783]  [] driver_unregister+0x30/0x70
[ 8642.789202]  [] pci_unregister_driver+0x25/0xa0
[ 8642.790657]  [] ixgbe_exit_module+0x1c/0xc8e [ixgbe]
[ 8642.792064]  [] SyS_delete_module+0x132/0x1c0
[ 8642.793450]  [] ? do_notify_resume+0x61/0xa0
[ 8642.794837]  [] system_call_fastpath+0x12/0x17

The issue is that test_and_set_bit() done on adapter->state is being
performed *after* the netdevice has been freed via free_netdev().

When netdev is being allocated on initialization time, it allocates
a private area, here struct ixgbe_adapter, that resides after the
net_device structure. In ixgbe_probe(), the device init routine,
we set up the adapter after alloc_etherdev_mq() on the private area
and add a reference for the pci_dev as well via pci_set_drvdata().

Both in the error path of ixgbe_probe(), but also on module unload
when ixgbe_remove() is being called, commit 41c62843eb6a ("ixgbe:
Fix rcu warnings induced by LER") accesses adapter after free_netdev().
The patch stores the result in a bool and thus fixes above oops on my
side.

Fixes: 41c62843eb6a ("ixgbe: Fix rcu warnings induced by LER")
Cc: stable 
Cc: Mark Rustad 
Signed-off-by: Daniel Borkmann 
Signed-off-by: Jeff Kirsher 
Signed-off-by: David S. Miller

ixgbe: Correctly disable VLAN filter in promiscuous mode

2014-11-23T19:26:12+00:00

IXGBE adapter seems to require that VLAN filtering be enabled if
VMDQ or SRIOV are enabled.  When those functions are disabled,
VLAN filtering may be disabled in promiscuous mode.

Prior to commit a9b8943ee129 ("ixgbe: remove vlan_filter_disable
and enable functions")

The logic was correct.  However, after the commit the logic
got reversed and VLAN filtered in now turned on when VMDQ/SRIOV
is disabled.

This patch changes the condition to enable hw vlan filtered
when VMDQ or SRIOV is enabled.

Fixes: a9b8943ee129 ("ixgbe: remove vlan_filter_disable and enable functions")
Cc: stable 
CC: Jacob Keller 
Signed-off-by: Vladislav Yasevich 
Acked-by: Emil Tantilov 
Tested-by: Phil Schmitt 
Signed-off-by: Jeff Kirsher 
Signed-off-by: David S. Miller

ixgbe: phy: fix uninitialized status in ixgbe_setup_phy_link_tnx

2014-11-11T21:31:54+00:00

Status variable is never initialized, can carry an arbitrary value
on the stack and thus may let the function fail.

Fixes: e90dd2645664 ("ixgbe: Make return values more direct")
Signed-off-by: Daniel Borkmann 
Acked-by: Emil Tantilov 
Signed-off-by: Jeff Kirsher 
Signed-off-by: David S. Miller

ixgbe: fix race when setting advertised speed

2014-10-30T12:12:07+00:00

Following commands:

modprobe ixgbe
ifconfig ethX up
ethtool -s ethX advertise 0x020

can lead to "setup link failed with code -14" error due to the setup_link
call racing with the SFP detection routine in the watchdog.

This patch resolves this issue by protecting the setup_link call with check
for __IXGBE_IN_SFP_INIT.

Reported-by: Scott Harrison 
Signed-off-by: Emil Tantilov 
Tested-by: Phil Schmitt 
Signed-off-by: Jeff Kirsher

ixgbe: need not repeat init skb with NULL

2014-10-30T12:04:39+00:00

Signed-off-by: Martin Zhang 
Tested-by: Phil Schmitt 
Signed-off-by: Jeff Kirsher

igb: don't reuse pages with pfmemalloc flag

2014-10-30T11:56:52+00:00

Incoming packet is dropped silently by sk_filter(), if the skb was
allocated from pfmemalloc reserves and the corresponding socket is
not marked with the SOCK_MEMALLOC flag.

Igb driver allocates pages for DMA with __skb_alloc_page(), which
calls alloc_pages_node() with the __GFP_MEMALLOC flag. So, in case
of OOM condition, igb can get pages with pfmemalloc flag set.

If an incoming packet hits the pfmemalloc page and is large enough
(small packets are copying into the memory, allocated with
netdev_alloc_skb_ip_align(), so they are not affected), it will be
dropped.

This behavior is ok under high memory pressure, but the problem is
that the igb driver reuses these mapped pages. So, packets are still
dropping even if all memory issues are gone and there is a plenty
of free memory.

In my case, some TCP sessions hang on a small percentage (< 0.1%)
of machines days after OOMs.

Fix this by avoiding reuse of such pages.

Signed-off-by: Roman Gushchin 
Tested-by: Aaron Brown "aaron.f.brown@intel.com"
Signed-off-by: Jeff Kirsher

e1000: unset IFF_UNICAST_FLT on WMware 82545EM

2014-10-30T11:47:39+00:00

VMWare's e1000 implementation does not seem to support unicast filtering.
This can be observed by configuring a macvlan interface on eth0 in a VM in
VMWare Fusion 5.0.5, and trying to use that interface instead of eth0.
Tested on 3.16.

Signed-off-by: Francesco Ruggeri 
Tested-by: Aaron Brown 
Signed-off-by: Jeff Kirsher