linux-stable.git/drivers/net, branch v3.0.67

xen-netback: cancel the credit timer when taking the vif down

2013-02-28T14:32:27+00:00

[ Upstream commit 3e55f8b306cf305832a4ac78aa82e1b40e818ece ]

If the credit timer is left armed after calling
xen_netbk_remove_xenvif(), then it may fire and attempt to schedule
the vif which will then oops as vif->netbk == NULL.

This may happen both in the fatal error path and during normal
disconnection from the front end.

The sequencing during shutdown is critical to ensure that: a)
vif->netbk doesn't become unexpectedly NULL; and b) the net device/vif
is not freed.

1. Mark as unschedulable (netif_carrier_off()).
2. Synchronously cancel the timer.
3. Remove the vif from the schedule list.
4. Remove it from it netback thread group.
5. Wait for vif->refcnt to become 0.

Signed-off-by: David Vrabel 
Acked-by: Ian Campbell 
Reported-by: Christopher S. Aker 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen-netback: correctly return errors from netbk_count_requests()

2013-02-28T14:32:27+00:00

[ Upstream commit 35876b5ffc154c357476b2c3bdab10feaf4bd8f0 ]

netbk_count_requests() could detect an error, call
netbk_fatal_tx_error() but return 0.  The vif may then be used
afterwards (e.g., in a call to netbk_tx_error().

Since netbk_fatal_tx_error() could set vif->refcnt to 1, the vif may
be freed immediately after the call to netbk_fatal_tx_error() (e.g.,
if the vif is also removed).

Netback thread              Xenwatch thread
-------------------------------------------
netbk_fatal_tx_err()        netback_remove()
                              xenvif_disconnect()
                                ...
                                free_netdev()
netbk_tx_err() Oops!

Signed-off-by: Wei Liu 
Signed-off-by: Jan Beulich 
Signed-off-by: David Vrabel 
Reported-by: Christopher S. Aker 
Acked-by: Ian Campbell 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

p54usb: corrected USB ID for T-Com Sinus 154 data II

2013-02-28T14:32:25+00:00

commit 008e33f733ca51acb2dd9d88ea878693b04d1d2a upstream.

Corrected USB ID for T-Com Sinus 154 data II. ISL3887-based. The
device was tested in managed mode with no security, WEP 128
bit and WPA-PSK (TKIP) with firmware 2.13.1.0.lm87.arm (md5sum:
7d676323ac60d6e1a3b6d61e8c528248). It works.

Signed-off-by: Tomasz Guszkowski 
Acked-By: Christian Lamparter 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

xen/netback: check correct frag when looking for head frag

2013-02-28T14:32:24+00:00

When I backported 7d5145d8eb2b "xen/netback: don't leak pages on failure in
xen_netbk_tx_check_gop" to 3.0 (where it became f0457844e605) I somehow picked
up an extraneous hunk breaking this.

Reported-by: Herton Ronaldo Krzesinski 
Signed-off-by: Ian Campbell 
Signed-off-by: Greg Kroah-Hartman

igb: Remove artificial restriction on RQDPC stat reading

2013-02-17T18:46:20+00:00

commit ae1c07a6b7ced6c0c94c99e3b53f4e7856fa8bff upstream.

For some reason the reading of the RQDPC register was being artificially
limited to 4K.  Instead of limiting the value we should read the value and
add the full amount.  Otherwise this can lead to a misleading number of
dropped packets when the actual value is in fact much higher.

Signed-off-by: Alexander Duyck 
Tested-by: Jeff Pieper   
Signed-off-by: Jeff Kirsher 
Cc: Vinson Lee 
Signed-off-by: Greg Kroah-Hartman

netback: correct netbk_tx_err to handle wrap around.

2013-02-14T18:47:45+00:00

[ Upstream commit b9149729ebdcfce63f853aa54a404c6a8f6ebbf3 ]

Signed-off-by: Ian Campbell 
Acked-by: Jan Beulich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen/netback: free already allocated memory on failure in xen_netbk_get_requests

2013-02-14T18:47:40+00:00

[ Upstream commit 4cc7c1cb7b11b6f3515bd9075527576a1eecc4aa ]

Signed-off-by: Ian Campbell 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen/netback: don't leak pages on failure in xen_netbk_tx_check_gop.

2013-02-14T18:47:37+00:00

[ Upstream commit 7d5145d8eb2b9791533ffe4dc003b129b9696c48 ]

Signed-off-by: Matthew Daley 
Reviewed-by: Konrad Rzeszutek Wilk 
Acked-by: Ian Campbell 
Acked-by: Jan Beulich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen/netback: shutdown the ring if it contains garbage.

2013-02-14T18:47:37+00:00

[ Upstream commit 48856286b64e4b66ec62b94e504d0b29c1ade664 ]

A buggy or malicious frontend should not be able to confuse netback.
If we spot anything which is not as it should be then shutdown the
device and don't try to continue with the ring in a potentially
hostile state. Well behaved and non-hostile frontends will not be
penalised.

As well as making the existing checks for such errors fatal also add a
new check that ensures that there isn't an insane number of requests
on the ring (i.e. more than would fit in the ring). If the ring
contains garbage then previously is was possible to loop over this
insane number, getting an error each time and therefore not generating
any more pending requests and therefore not exiting the loop in
xen_netbk_tx_build_gops for an externded period.

Also turn various netdev_dbg calls which no precipitate a fatal error
into netdev_err, they are rate limited because the device is shutdown
afterwards.

This fixes at least one known DoS/softlockup of the backend domain.

Signed-off-by: Ian Campbell 
Reviewed-by: Konrad Rzeszutek Wilk 
Acked-by: Jan Beulich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tg3: Fix crc errors on jumbo frame receive

2013-02-14T18:47:37+00:00

[ Upstream commit daf3ec688e057f6060fb9bb0819feac7a8bbf45c ]

TG3_PHY_AUXCTL_SMDSP_ENABLE/DISABLE macros do a blind write to the phy
auxiliary control register and overwrite the EXT_PKT_LEN (bit 14) resulting
in intermittent crc errors on jumbo frames with some link partners. Change
the code to do a read/modify/write.

Signed-off-by: Nithin Nayak Sujir 
Signed-off-by: Michael Chan 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman