linux-stable.git/drivers/net, branch v3.18.30

can: gs_usb: fixed disconnect bug by removing erroneous use of kfree()

2016-03-21T02:14:25+00:00

[ Upstream commit e9a2d81b1761093386a0bb8a4f51642ac785ef63 ]

gs_destroy_candev() erroneously calls kfree() on a struct gs_can *, which is
allocated through alloc_candev() and should instead be freed using
free_candev() alone.

The inappropriate use of kfree() causes the kernel to hang when
gs_destroy_candev() is called.

Only the struct gs_usb * which is allocated through kzalloc() should be freed
using kfree() when the device is disconnected.

Signed-off-by: Maximilian Schneider 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Sasha Levin

iwlwifi: mvm: inc pending frames counter also when txing non-sta

2016-03-21T02:14:03+00:00

[ Upstream commit fb896c44f88a75843a072cd6961b1615732f7811 ]

Until this patch, when TXing non-sta the pending_frames counter
wasn't increased, but it WAS decreased in
iwl_mvm_rx_tx_cmd_single(), what makes it negative in certain
conditions. This in turn caused much trouble when we need to
remove the station since we won't be waiting forever until
pending_frames gets 0. In certain cases, we were exhausting
the station table even in BSS mode, because we had a lot of
stale stations.

Increase the counter also in iwl_mvm_tx_skb_non_sta() after a
successful TX to avoid this outcome.

CC:  [3.18+]
Signed-off-by: Liad Kaufman 
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Sasha Levin

iwlwifi: pcie: support loading FW with extended mem range

2016-03-13T17:53:42+00:00

[commit fe45773b5baa154468416aac1304f6325939f775 upstream]

Toggle the LMPM_CHICK register when writing chunks into the FW's extended
SRAM. This tells the FW to put the chunk into a different memory space.

Signed-off-by: Arik Nemtsov 
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Sasha Levin

can: ems_usb: Fix possible tx overflow

2016-03-08T06:13:49+00:00

[ Upstream commit 90cfde46586d2286488d8ed636929e936c0c9ab2 ]

This patch fixes the problem that more CAN messages could be sent to the
interface as could be send on the CAN bus. This was more likely for slow baud
rates. The sleeping _start_xmit was woken up in the _write_bulk_callback. Under
heavy TX load this produced another bulk transfer without checking the
free_slots variable and hence caused the overflow in the interface.

Signed-off-by: Gerhard Uttenthaler 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Sasha Levin

iwlwifi: mvm: don't allow sched scans without matches to be started

2016-03-08T02:14:56+00:00

[ Upstream commit 5e56276e7555b34550d51459a801ff75eca8b907 ]

The firmware can perform a scheduled scan with not matchsets passed,
but it can't send notification that results were found.  Since the
userspace then cannot know when we got new results and the firmware
wouldn't trigger a wake in case we are sleeping, it's better not to
allow scans without matchsets.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=110831

Cc:  [3.17+]
Signed-off-by: Luca Coelho 
Signed-off-by: Emmanuel Grumbach 
[SL: Backport to 4.1]
Signed-off-by: Sasha Levin

xen-netfront: update num_queues to real created

2016-02-15T20:42:45+00:00

[ Upstream commit ca88ea1247dfee094e2467a3578eaec9bdf0833a ]

Sometimes xennet_create_queues() may failed to created all requested
queues, we need to update num_queues to real created to avoid NULL
pointer dereference.

Signed-off-by: Joe Jin 
Cc: Boris Ostrovsky 
Cc: Konrad Rzeszutek Wilk 
Cc: Wei Liu 
Cc: Ian Campbell 
Cc: David S. Miller 
Reviewed-by: Boris Ostrovsky 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

xen-netfront: respect user provided max_queues

2016-02-15T20:42:45+00:00

[ Upstream commit 32a844056fd43dda647e1c3c6b9983bdfa04d17d ]

Originally that parameter was always reset to num_online_cpus during
module initialisation, which renders it useless.

The fix is to only set max_queues to num_online_cpus when user has not
provided a value.

Signed-off-by: Wei Liu 
Cc: David Vrabel 
Reviewed-by: David Vrabel 
Tested-by: David Vrabel 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

xen-netback: respect user provided max_queues

2016-02-15T20:42:45+00:00

[ Upstream commit 4c82ac3c37363e8c4ded6a5fe1ec5fa756b34df3 ]

Originally that parameter was always reset to num_online_cpus during
module initialisation, which renders it useless.

The fix is to only set max_queues to num_online_cpus when user has not
provided a value.

Reported-by: Johnny Strom 
Signed-off-by: Wei Liu 
Reviewed-by: David Vrabel 
Acked-by: Ian Campbell 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid

2016-02-15T20:42:45+00:00

[ Upstream commit 60a6531bfe49555581ccd65f66a350cc5693fcde ]

We can't be within an RCU read-side critical section when deleting
VLANs, as underlying drivers might sleep during the hardware operation.
Therefore, replace the RCU critical section with a mutex. This is
consistent with team_vlan_rx_add_vid.

Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
Acked-by: Jiri Pirko 
Signed-off-by: Ido Schimmel 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

ppp, slip: Validate VJ compression slot parameters completely

2016-02-15T20:42:45+00:00

[ Upstream commit 4ab42d78e37a294ac7bc56901d563c642e03c4ae ]

Currently slhc_init() treats out-of-range values of rslots and tslots
as equivalent to 0, except that if tslots is too large it will
dereference a null pointer (CVE-2015-7799).

Add a range-check at the top of the function and make it return an
ERR_PTR() on error instead of NULL.  Change the callers accordingly.

Compile-tested only.

Reported-by: 郭永刚 
References: http://article.gmane.org/gmane.comp.security.oss.general/17908
Signed-off-by: Ben Hutchings 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin