linux-stable.git/drivers/net, branch v3.18.29

iwlwifi: pcie: support loading FW with extended mem range

2016-03-13T17:53:42+00:00

[commit fe45773b5baa154468416aac1304f6325939f775 upstream]

Toggle the LMPM_CHICK register when writing chunks into the FW's extended
SRAM. This tells the FW to put the chunk into a different memory space.

Signed-off-by: Arik Nemtsov 
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Sasha Levin

can: ems_usb: Fix possible tx overflow

2016-03-08T06:13:49+00:00

[ Upstream commit 90cfde46586d2286488d8ed636929e936c0c9ab2 ]

This patch fixes the problem that more CAN messages could be sent to the
interface as could be send on the CAN bus. This was more likely for slow baud
rates. The sleeping _start_xmit was woken up in the _write_bulk_callback. Under
heavy TX load this produced another bulk transfer without checking the
free_slots variable and hence caused the overflow in the interface.

Signed-off-by: Gerhard Uttenthaler 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Sasha Levin

iwlwifi: mvm: don't allow sched scans without matches to be started

2016-03-08T02:14:56+00:00

[ Upstream commit 5e56276e7555b34550d51459a801ff75eca8b907 ]

The firmware can perform a scheduled scan with not matchsets passed,
but it can't send notification that results were found.  Since the
userspace then cannot know when we got new results and the firmware
wouldn't trigger a wake in case we are sleeping, it's better not to
allow scans without matchsets.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=110831

Cc:  [3.17+]
Signed-off-by: Luca Coelho 
Signed-off-by: Emmanuel Grumbach 
[SL: Backport to 4.1]
Signed-off-by: Sasha Levin

xen-netfront: update num_queues to real created

2016-02-15T20:42:45+00:00

[ Upstream commit ca88ea1247dfee094e2467a3578eaec9bdf0833a ]

Sometimes xennet_create_queues() may failed to created all requested
queues, we need to update num_queues to real created to avoid NULL
pointer dereference.

Signed-off-by: Joe Jin 
Cc: Boris Ostrovsky 
Cc: Konrad Rzeszutek Wilk 
Cc: Wei Liu 
Cc: Ian Campbell 
Cc: David S. Miller 
Reviewed-by: Boris Ostrovsky 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

xen-netfront: respect user provided max_queues

2016-02-15T20:42:45+00:00

[ Upstream commit 32a844056fd43dda647e1c3c6b9983bdfa04d17d ]

Originally that parameter was always reset to num_online_cpus during
module initialisation, which renders it useless.

The fix is to only set max_queues to num_online_cpus when user has not
provided a value.

Signed-off-by: Wei Liu 
Cc: David Vrabel 
Reviewed-by: David Vrabel 
Tested-by: David Vrabel 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

xen-netback: respect user provided max_queues

2016-02-15T20:42:45+00:00

[ Upstream commit 4c82ac3c37363e8c4ded6a5fe1ec5fa756b34df3 ]

Originally that parameter was always reset to num_online_cpus during
module initialisation, which renders it useless.

The fix is to only set max_queues to num_online_cpus when user has not
provided a value.

Reported-by: Johnny Strom 
Signed-off-by: Wei Liu 
Reviewed-by: David Vrabel 
Acked-by: Ian Campbell 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid

2016-02-15T20:42:45+00:00

[ Upstream commit 60a6531bfe49555581ccd65f66a350cc5693fcde ]

We can't be within an RCU read-side critical section when deleting
VLANs, as underlying drivers might sleep during the hardware operation.
Therefore, replace the RCU critical section with a mutex. This is
consistent with team_vlan_rx_add_vid.

Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
Acked-by: Jiri Pirko 
Signed-off-by: Ido Schimmel 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

ppp, slip: Validate VJ compression slot parameters completely

2016-02-15T20:42:45+00:00

[ Upstream commit 4ab42d78e37a294ac7bc56901d563c642e03c4ae ]

Currently slhc_init() treats out-of-range values of rslots and tslots
as equivalent to 0, except that if tslots is too large it will
dereference a null pointer (CVE-2015-7799).

Add a range-check at the top of the function and make it return an
ERR_PTR() on error instead of NULL.  Change the callers accordingly.

Compile-tested only.

Reported-by: 郭永刚 
References: http://article.gmane.org/gmane.comp.security.oss.general/17908
Signed-off-by: Ben Hutchings 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

bonding: Prevent IPv6 link local address on enslaved devices

2016-02-15T20:42:44+00:00

[ Upstream commit 03d84a5f83a67e692af00a3d3901e7820e3e84d5 ]

Commit 1f718f0f4f97 ("bonding: populate neighbour's private on enslave")
undoes the fix provided by commit c2edacf80e15 ("bonding / ipv6: no addrconf
for slaves separately from master") by effectively setting the slave flag
after the slave has been opened.  If the slave comes up quickly enough, it
will go through the IPv6 addrconf before the slave flag has been set and
will get a link local IPv6 address.

In order to ensure that addrconf knows to ignore the slave devices on state
change, set IFF_SLAVE before dev_open() during bonding enslavement.

Fixes: 1f718f0f4f97 ("bonding: populate neighbour's private on enslave")
Signed-off-by: Karl Heiss 
Signed-off-by: Jay Vosburgh 
Reviewed-by: Jarod Wilson 
Signed-off-by: Andy Gospodarek 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

vxlan: fix test which detect duplicate vxlan iface

2016-02-15T20:42:43+00:00

[ Upstream commit 07b9b37c227cb8d88d478b4a9c5634fee514ede1 ]

When a vxlan interface is created, the driver checks that there is not
another vxlan interface with the same properties. To do this, it checks
the existing vxlan udp socket. Since commit 1c51a9159dde, the creation of
the vxlan socket is done only when the interface is set up, thus it breaks
that test.

Example:
$ ip l a vxlan10 type vxlan id 10 group 239.0.0.10 dev eth0 dstport 0
$ ip l a vxlan11 type vxlan id 10 group 239.0.0.10 dev eth0 dstport 0
$ ip -br l | grep vxlan
vxlan10          DOWN           f2:55:1c:6a:fb:00 
vxlan11          DOWN           7a:cb:b9:38:59:0d 

Instead of checking sockets, let's loop over the vxlan iface list.

Fixes: 1c51a9159dde ("vxlan: fix race caused by dropping rtnl_unlock")
Reported-by: Thomas Faivre 
Signed-off-by: Nicolas Dichtel 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin