linux-stable.git/drivers/net, branch v3.18.35

rtlwifi: pci: use dev_kfree_skb_irq instead of kfree_skb in rtl_pci_reset_trx_ring

2016-06-06T23:11:03+00:00

[ Upstream commit cf968937d27751296920e6b82ffa89735e3a0023 ]

We can't use kfree_skb in irq disable context, because spin_lock_irqsave
make sure we are always in irq disable context, use dev_kfree_skb_irq
instead of kfree_skb is better than dev_kfree_skb_any.

This patch fix below kernel warning:
[ 7612.095528] ------------[ cut here ]------------
[ 7612.095546] WARNING: CPU: 3 PID: 4460 at kernel/softirq.c:150 __local_bh_enable_ip+0x58/0x80()
[ 7612.095550] Modules linked in: rtl8723be x86_pkg_temp_thermal btcoexist rtl_pci rtlwifi rtl8723_common
[ 7612.095567] CPU: 3 PID: 4460 Comm: ifconfig Tainted: G        W       4.4.0+ #4
[ 7612.095570] Hardware name: LENOVO 20DFA04FCD/20DFA04FCD, BIOS J5ET48WW (1.19 ) 08/27/2015
[ 7612.095574]  00000000 00000000 da37fc70 c12ce7c5 00000000 da37fca0 c104cc59 c19d4454
[ 7612.095584]  00000003 0000116c c19d4784 00000096 c10508a8 c10508a8 00000200 c1b42400
[ 7612.095594]  f29be780 da37fcb0 c104ccad 00000009 00000000 da37fcbc c10508a8 f21f08b8
[ 7612.095604] Call Trace:
[ 7612.095614]  [] dump_stack+0x41/0x5c
[ 7612.095620]  [] warn_slowpath_common+0x89/0xc0
[ 7612.095628]  [] ? __local_bh_enable_ip+0x58/0x80
[ 7612.095634]  [] ? __local_bh_enable_ip+0x58/0x80
[ 7612.095640]  [] warn_slowpath_null+0x1d/0x20
[ 7612.095646]  [] __local_bh_enable_ip+0x58/0x80
[ 7612.095653]  [] destroy_conntrack+0x64/0xa0
[ 7612.095660]  [] nf_conntrack_destroy+0xf/0x20
[ 7612.095665]  [] skb_release_head_state+0x55/0xa0
[ 7612.095670]  [] skb_release_all+0xb/0x20
[ 7612.095674]  [] __kfree_skb+0xb/0x60
[ 7612.095679]  [] kfree_skb+0x30/0x70
[ 7612.095686]  [] ? rtl_pci_reset_trx_ring+0x22d/0x370 [rtl_pci]
[ 7612.095692]  [] rtl_pci_reset_trx_ring+0x22d/0x370 [rtl_pci]
[ 7612.095698]  [] rtl_pci_start+0x19/0x190 [rtl_pci]
[ 7612.095705]  [] rtl_op_start+0x56/0x90 [rtlwifi]
[ 7612.095712]  [] drv_start+0x36/0xc0
[ 7612.095717]  [] ieee80211_do_open+0x2d3/0x890
[ 7612.095725]  [] ? call_netdevice_notifiers_info+0x2e/0x60
[ 7612.095730]  [] ieee80211_open+0x4d/0x50
[ 7612.095736]  [] __dev_open+0xa3/0x130
[ 7612.095742]  [] ? _raw_spin_unlock_bh+0x13/0x20
[ 7612.095748]  [] __dev_change_flags+0x89/0x140
[ 7612.095753]  [] ? selinux_capable+0xd/0x10
[ 7612.095759]  [] dev_change_flags+0x29/0x60
[ 7612.095765]  [] devinet_ioctl+0x553/0x670
[ 7612.095772]  [] ? _copy_to_user+0x28/0x40
[ 7612.095777]  [] inet_ioctl+0x85/0xb0
[ 7612.095783]  [] sock_ioctl+0x67/0x260
[ 7612.095788]  [] ? sock_fasync+0x80/0x80
[ 7612.095795]  [] do_vfs_ioctl+0x6b/0x550
[ 7612.095800]  [] ? selinux_file_ioctl+0x102/0x1e0
[ 7612.095807]  [] ? timekeeping_suspend+0x294/0x320
[ 7612.095813]  [] ? __hrtimer_run_queues+0x14a/0x210
[ 7612.095820]  [] ? security_file_ioctl+0x34/0x50
[ 7612.095827]  [] SyS_ioctl+0x70/0x80
[ 7612.095832]  [] do_fast_syscall_32+0x84/0x120
[ 7612.095839]  [] sysenter_past_esp+0x36/0x55
[ 7612.095844] ---[ end trace 97e9c637a20e8348 ]---

Signed-off-by: Wang YanQing 
Cc: Stable 
Acked-by: Larry Finger 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin

rtlwifi: Fix logic error in enter/exit power-save mode

2016-06-06T23:11:03+00:00

[ Upstream commit 873ffe154ae074c46ed2d72dbd9a2a99f06f55b4 ]

In commit a269913c52ad ("rtlwifi: Rework rtl_lps_leave() and
rtl_lps_enter() to use work queue"), the tests for enter/exit
power-save mode were inverted. With this change applied, the
wifi connection becomes much more stable.

Fixes: a269913c52ad ("rtlwifi: Rework rtl_lps_leave() and rtl_lps_enter() to use work queue")
Signed-off-by: Wang YanQing 
CC: Stable  [3.10+]
Acked-by: Larry Finger 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin

can: fix handling of unmodifiable configuration options

2016-06-03T15:30:37+00:00

[ Upstream commit bb208f144cf3f59d8f89a09a80efd04389718907 ]

As described in 'can: m_can: tag current CAN FD controllers as non-ISO'
(6cfda7fbebe) it is possible to define fixed configuration options by
setting the according bit in 'ctrlmode' and clear it in 'ctrlmode_supported'.
This leads to the incovenience that the fixed configuration bits can not be
passed by netlink even when they have the correct values (e.g. non-ISO, FD).

This patch fixes that issue and not only allows fixed set bit values to be set
again but now requires(!) to provide these fixed values at configuration time.
A valid CAN FD configuration consists of a nominal/arbitration bittiming, a
data bittiming and a control mode with CAN_CTRLMODE_FD set - which is now
enforced by a new can_validate() function. This fix additionally removed the
inconsistency that was prohibiting the support of 'CANFD-only' controller
drivers, like the RCar CAN FD.

For this reason a new helper can_set_static_ctrlmode() has been introduced to
provide a proper interface to handle static enabled CAN controller options.

Reported-by: Ramesh Shanmugasundaram 
Signed-off-by: Oliver Hartkopp 
Reviewed-by: Ramesh Shanmugasundaram  
Cc:  # >= 3.18
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Sasha Levin

ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards.

2016-06-03T15:30:29+00:00

[ Upstream commit 0f9edcdd88a993914fa1d1dc369b35dc503979db ]

The Wistron DNMA-92 and Compex WLM200NX have inverted LED polarity
(active high instead of active low).

The same PCI Subsystem ID is used by both cards, which are based on
the same Atheros MB92 design.

Cc: 
Cc: 
Cc: 
Cc: 
Signed-off-by: Vittorio Gambaletta 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin

rtlwifi: rtl8723be: Fix module parameter initialization

2016-06-01T20:25:52+00:00

[ Upstream commit 7079604ddb83f428359feace3aeaf8a9f435be4a ]

This driver has a number of errors in the module initialization. These
include the following:

Parameter msi_support is stored in two places - one is removed.
Paramters sw_crypto and disable_watchdog were never stored in the final
locations, nor were they initialized properly.

Signed-off-by: Larry Finger 
Cc: Stable 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin

ath5k: Change led pin configuration for compaq c700 laptop

2016-06-01T20:23:30+00:00

[ Upstream commit 7b9bc799a445aea95f64f15e0083cb19b5789abe ]

BugLink: http://bugs.launchpad.net/bugs/972604

Commit 09c9bae26b0d3c9472cb6ae45010460a2cee8b8d ("ath5k: add led pin
configuration for compaq c700 laptop") added a pin configuration for the Compaq
c700 laptop.  However, the polarity of the led pin is reversed.  It should be
red for wifi off and blue for wifi on, but it is the opposite.  This bug was
reported in the following bug report:
http://pad.lv/972604

Fixes: 09c9bae26b0d3c9472cb6ae45010460a2cee8b8d ("ath5k: add led pin configuration for compaq c700 laptop")
Signed-off-by: Joseph Salisbury 
Cc: stable@vger.kernel.org
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin

rapidio/rionet: fix deadlock on SMP

2016-04-18T12:49:39+00:00

[ Upstream commit 36915976eca58f2eefa040ba8f9939672564df61 ]

Fix deadlocking during concurrent receive and transmit operations on SMP
platforms caused by the use of incorrect lock: on transmit 'tx_lock'
spinlock should be used instead of 'lock' which is used for receive
operation.

This fix is applicable to kernel versions starting from v2.15.

Signed-off-by: Aurelien Jacquiot 
Signed-off-by: Alexandre Bounine 
Cc: Matt Porter 
Cc: Andre van Herk 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

net: mvneta: enable change MAC address when interface is up

2016-04-18T12:49:32+00:00

[ Upstream commit 928b6519afeb2a5e2dc61154380b545ed66c476a ]

Function eth_prepare_mac_addr_change() is called as part of MAC
address change. This function check if interface is running.
To enable change MAC address when interface is running:
IFF_LIVE_ADDR_CHANGE flag must be set to dev->priv_flags field

Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP
network unit")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitri Epshtein 
Signed-off-by: Gregory CLEMENT 
Signed-off-by: David S. Miller 

Signed-off-by: Sasha Levin

net: irda: Fix use-after-free in irtty_open()

2016-04-12T13:10:30+00:00

[ Upstream commit 401879c57f01cbf2da204ad2e8db910525c6dbea ]

The N_IRDA line discipline may access the previous line discipline's closed
and already-fre private data on open [1].

The tty->disc_data field _never_ refers to valid data on entry to the
line discipline's open() method. Rather, the ldisc is expected to
initialize that field for its own use for the lifetime of the instance
(ie. from open() to close() only).

[1]
    ==================================================================
    BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068
    Read of size 4 by task a.out/13960
    =============================================================================
    BUG kmalloc-512 (Tainted: G    B          ): kasan: bad access detected
    -----------------------------------------------------------------------------
    ...
    Call Trace:
     [] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279
     [] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436
     [] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447
     [] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567
     [<     inline     >] tiocsetd drivers/tty/tty_io.c:2650
     [] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883
     [<     inline     >] vfs_ioctl fs/ioctl.c:43
     [] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607
     [<     inline     >] SYSC_ioctl fs/ioctl.c:622
     [] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
     [] entry_SYSCALL_64_fastpath+0x16/0x7a

Reported-and-tested-by: Dmitry Vyukov 
Cc: 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

can: gs_usb: fixed disconnect bug by removing erroneous use of kfree()

2016-03-21T02:14:25+00:00

[ Upstream commit e9a2d81b1761093386a0bb8a4f51642ac785ef63 ]

gs_destroy_candev() erroneously calls kfree() on a struct gs_can *, which is
allocated through alloc_candev() and should instead be freed using
free_candev() alone.

The inappropriate use of kfree() causes the kernel to hang when
gs_destroy_candev() is called.

Only the struct gs_usb * which is allocated through kzalloc() should be freed
using kfree() when the device is disconnected.

Signed-off-by: Maximilian Schneider 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Sasha Levin