<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/drivers/net, branch v3.18.95</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>r8169: fix RTL8168EP take too long to complete driver initialization.</title>
<updated>2018-02-16T19:14:41+00:00</updated>
<author>
<name>Chunhao Lin</name>
<email>hau@realtek.com</email>
</author>
<published>2018-01-30T17:32:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=0d8e72014eca79abcf9424be37023dae97141093'/>
<id>0d8e72014eca79abcf9424be37023dae97141093</id>
<content type='text'>
[ Upstream commit 086ca23d03c0d2f4088f472386778d293e15c5f6 ]

Driver check the wrong register bit in rtl_ocp_tx_cond() that keep driver
waiting until timeout.

Fix this by waiting for the right register bit.

Signed-off-by: Chunhao Lin &lt;hau@realtek.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 086ca23d03c0d2f4088f472386778d293e15c5f6 ]

Driver check the wrong register bit in rtl_ocp_tx_cond() that keep driver
waiting until timeout.

Fix this by waiting for the right register bit.

Signed-off-by: Chunhao Lin &lt;hau@realtek.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>qlcnic: fix deadlock bug</title>
<updated>2018-02-16T19:14:41+00:00</updated>
<author>
<name>Junxiao Bi</name>
<email>junxiao.bi@oracle.com</email>
</author>
<published>2018-01-29T09:53:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=cafbcd523a70712ed3215f5a549d8938d00c3b7e'/>
<id>cafbcd523a70712ed3215f5a549d8938d00c3b7e</id>
<content type='text'>
[ Upstream commit 233ac3891607f501f08879134d623b303838f478 ]

The following soft lockup was caught. This is a deadlock caused by
recusive locking.

Process kworker/u40:1:28016 was holding spin lock "mbx-&gt;queue_lock" in
qlcnic_83xx_mailbox_worker(), while a softirq came in and ask the same spin
lock in qlcnic_83xx_enqueue_mbx_cmd(). This lock should be hold by disable
bh..

[161846.962125] NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [kworker/u40:1:28016]
[161846.962367] Modules linked in: tun ocfs2 xen_netback xen_blkback xen_gntalloc xen_gntdev xen_evtchn xenfs xen_privcmd autofs4 ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs bnx2fc fcoe libfcoe libfc sunrpc 8021q mrp garp bridge stp llc bonding dm_round_robin dm_multipath iTCO_wdt iTCO_vendor_support pcspkr sb_edac edac_core i2c_i801 shpchp lpc_ich mfd_core ioatdma ipmi_devintf ipmi_si ipmi_msghandler sg ext4 jbd2 mbcache2 sr_mod cdrom sd_mod igb i2c_algo_bit i2c_core ahci libahci megaraid_sas ixgbe dca ptp pps_core vxlan udp_tunnel ip6_udp_tunnel qla2xxx scsi_transport_fc qlcnic crc32c_intel be2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi dm_mirror dm_region_hash dm_log dm_mod
[161846.962454]
[161846.962460] CPU: 1 PID: 28016 Comm: kworker/u40:1 Not tainted 4.1.12-94.5.9.el6uek.x86_64 #2
[161846.962463] Hardware name: Oracle Corporation SUN SERVER X4-2L      /ASSY,MB,X4-2L         , BIOS 26050100 09/19/2017
[161846.962489] Workqueue: qlcnic_mailbox qlcnic_83xx_mailbox_worker [qlcnic]
[161846.962493] task: ffff8801f2e34600 ti: ffff88004ca5c000 task.ti: ffff88004ca5c000
[161846.962496] RIP: e030:[&lt;ffffffff810013aa&gt;]  [&lt;ffffffff810013aa&gt;] xen_hypercall_sched_op+0xa/0x20
[161846.962506] RSP: e02b:ffff880202e43388  EFLAGS: 00000206
[161846.962509] RAX: 0000000000000000 RBX: ffff8801f6996b70 RCX: ffffffff810013aa
[161846.962511] RDX: ffff880202e433cc RSI: ffff880202e433b0 RDI: 0000000000000003
[161846.962513] RBP: ffff880202e433d0 R08: 0000000000000000 R09: ffff8801fe893200
[161846.962516] R10: ffff8801fe400538 R11: 0000000000000206 R12: ffff880202e4b000
[161846.962518] R13: 0000000000000050 R14: 0000000000000001 R15: 000000000000020d
[161846.962528] FS:  0000000000000000(0000) GS:ffff880202e40000(0000) knlGS:ffff880202e40000
[161846.962531] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[161846.962533] CR2: 0000000002612640 CR3: 00000001bb796000 CR4: 0000000000042660
[161846.962536] Stack:
[161846.962538]  ffff880202e43608 0000000000000000 ffffffff813f0442 ffff880202e433b0
[161846.962543]  0000000000000000 ffff880202e433cc ffffffff00000001 0000000000000000
[161846.962547]  00000009813f03d6 ffff880202e433e0 ffffffff813f0460 ffff880202e43440
[161846.962552] Call Trace:
[161846.962555]  &lt;IRQ&gt;
[161846.962565]  [&lt;ffffffff813f0442&gt;] ? xen_poll_irq_timeout+0x42/0x50
[161846.962570]  [&lt;ffffffff813f0460&gt;] xen_poll_irq+0x10/0x20
[161846.962578]  [&lt;ffffffff81014222&gt;] xen_lock_spinning+0xe2/0x110
[161846.962583]  [&lt;ffffffff81013f01&gt;] __raw_callee_save_xen_lock_spinning+0x11/0x20
[161846.962592]  [&lt;ffffffff816e5c57&gt;] ? _raw_spin_lock+0x57/0x80
[161846.962609]  [&lt;ffffffffa028acfc&gt;] qlcnic_83xx_enqueue_mbx_cmd+0x7c/0xe0 [qlcnic]
[161846.962623]  [&lt;ffffffffa028e008&gt;] qlcnic_83xx_issue_cmd+0x58/0x210 [qlcnic]
[161846.962636]  [&lt;ffffffffa028caf2&gt;] qlcnic_83xx_sre_macaddr_change+0x162/0x1d0 [qlcnic]
[161846.962649]  [&lt;ffffffffa028cb8b&gt;] qlcnic_83xx_change_l2_filter+0x2b/0x30 [qlcnic]
[161846.962657]  [&lt;ffffffff8160248b&gt;] ? __skb_flow_dissect+0x18b/0x650
[161846.962670]  [&lt;ffffffffa02856e5&gt;] qlcnic_send_filter+0x205/0x250 [qlcnic]
[161846.962682]  [&lt;ffffffffa0285c77&gt;] qlcnic_xmit_frame+0x547/0x7b0 [qlcnic]
[161846.962691]  [&lt;ffffffff8160ac22&gt;] xmit_one+0x82/0x1a0
[161846.962696]  [&lt;ffffffff8160ad90&gt;] dev_hard_start_xmit+0x50/0xa0
[161846.962701]  [&lt;ffffffff81630112&gt;] sch_direct_xmit+0x112/0x220
[161846.962706]  [&lt;ffffffff8160b80f&gt;] __dev_queue_xmit+0x1df/0x5e0
[161846.962710]  [&lt;ffffffff8160bc33&gt;] dev_queue_xmit_sk+0x13/0x20
[161846.962721]  [&lt;ffffffffa0575bd5&gt;] bond_dev_queue_xmit+0x35/0x80 [bonding]
[161846.962729]  [&lt;ffffffffa05769fb&gt;] __bond_start_xmit+0x1cb/0x210 [bonding]
[161846.962736]  [&lt;ffffffffa0576a71&gt;] bond_start_xmit+0x31/0x60 [bonding]
[161846.962740]  [&lt;ffffffff8160ac22&gt;] xmit_one+0x82/0x1a0
[161846.962745]  [&lt;ffffffff8160ad90&gt;] dev_hard_start_xmit+0x50/0xa0
[161846.962749]  [&lt;ffffffff8160bb1e&gt;] __dev_queue_xmit+0x4ee/0x5e0
[161846.962754]  [&lt;ffffffff8160bc33&gt;] dev_queue_xmit_sk+0x13/0x20
[161846.962760]  [&lt;ffffffffa05cfa72&gt;] vlan_dev_hard_start_xmit+0xb2/0x150 [8021q]
[161846.962764]  [&lt;ffffffff8160ac22&gt;] xmit_one+0x82/0x1a0
[161846.962769]  [&lt;ffffffff8160ad90&gt;] dev_hard_start_xmit+0x50/0xa0
[161846.962773]  [&lt;ffffffff8160bb1e&gt;] __dev_queue_xmit+0x4ee/0x5e0
[161846.962777]  [&lt;ffffffff8160bc33&gt;] dev_queue_xmit_sk+0x13/0x20
[161846.962789]  [&lt;ffffffffa05adf74&gt;] br_dev_queue_push_xmit+0x54/0xa0 [bridge]
[161846.962797]  [&lt;ffffffffa05ae4ff&gt;] br_forward_finish+0x2f/0x90 [bridge]
[161846.962807]  [&lt;ffffffff810b0dad&gt;] ? ttwu_do_wakeup+0x1d/0x100
[161846.962811]  [&lt;ffffffff815f929b&gt;] ? __alloc_skb+0x8b/0x1f0
[161846.962818]  [&lt;ffffffffa05ae04d&gt;] __br_forward+0x8d/0x120 [bridge]
[161846.962822]  [&lt;ffffffff815f613b&gt;] ? __kmalloc_reserve+0x3b/0xa0
[161846.962829]  [&lt;ffffffff810be55e&gt;] ? update_rq_runnable_avg+0xee/0x230
[161846.962836]  [&lt;ffffffffa05ae176&gt;] br_forward+0x96/0xb0 [bridge]
[161846.962845]  [&lt;ffffffffa05af85e&gt;] br_handle_frame_finish+0x1ae/0x420 [bridge]
[161846.962853]  [&lt;ffffffffa05afc4f&gt;] br_handle_frame+0x17f/0x260 [bridge]
[161846.962862]  [&lt;ffffffffa05afad0&gt;] ? br_handle_frame_finish+0x420/0x420 [bridge]
[161846.962867]  [&lt;ffffffff8160d057&gt;] __netif_receive_skb_core+0x1f7/0x870
[161846.962872]  [&lt;ffffffff8160d6f2&gt;] __netif_receive_skb+0x22/0x70
[161846.962877]  [&lt;ffffffff8160d913&gt;] netif_receive_skb_internal+0x23/0x90
[161846.962884]  [&lt;ffffffffa07512ea&gt;] ? xenvif_idx_release+0xea/0x100 [xen_netback]
[161846.962889]  [&lt;ffffffff816e5a10&gt;] ? _raw_spin_unlock_irqrestore+0x20/0x50
[161846.962893]  [&lt;ffffffff8160e624&gt;] netif_receive_skb_sk+0x24/0x90
[161846.962899]  [&lt;ffffffffa075269a&gt;] xenvif_tx_submit+0x2ca/0x3f0 [xen_netback]
[161846.962906]  [&lt;ffffffffa0753f0c&gt;] xenvif_tx_action+0x9c/0xd0 [xen_netback]
[161846.962915]  [&lt;ffffffffa07567f5&gt;] xenvif_poll+0x35/0x70 [xen_netback]
[161846.962920]  [&lt;ffffffff8160e01b&gt;] napi_poll+0xcb/0x1e0
[161846.962925]  [&lt;ffffffff8160e1c0&gt;] net_rx_action+0x90/0x1c0
[161846.962931]  [&lt;ffffffff8108aaba&gt;] __do_softirq+0x10a/0x350
[161846.962938]  [&lt;ffffffff8108ae75&gt;] irq_exit+0x125/0x130
[161846.962943]  [&lt;ffffffff813f03a9&gt;] xen_evtchn_do_upcall+0x39/0x50
[161846.962950]  [&lt;ffffffff816e7ffe&gt;] xen_do_hypervisor_callback+0x1e/0x40
[161846.962952]  &lt;EOI&gt;
[161846.962959]  [&lt;ffffffff816e5c4a&gt;] ? _raw_spin_lock+0x4a/0x80
[161846.962964]  [&lt;ffffffff816e5b1e&gt;] ? _raw_spin_lock_irqsave+0x1e/0xa0
[161846.962978]  [&lt;ffffffffa028e279&gt;] ? qlcnic_83xx_mailbox_worker+0xb9/0x2a0 [qlcnic]
[161846.962991]  [&lt;ffffffff810a14e1&gt;] ? process_one_work+0x151/0x4b0
[161846.962995]  [&lt;ffffffff8100c3f2&gt;] ? check_events+0x12/0x20
[161846.963001]  [&lt;ffffffff810a1960&gt;] ? worker_thread+0x120/0x480
[161846.963005]  [&lt;ffffffff816e187b&gt;] ? __schedule+0x30b/0x890
[161846.963010]  [&lt;ffffffff810a1840&gt;] ? process_one_work+0x4b0/0x4b0
[161846.963015]  [&lt;ffffffff810a1840&gt;] ? process_one_work+0x4b0/0x4b0
[161846.963021]  [&lt;ffffffff810a6b3e&gt;] ? kthread+0xce/0xf0
[161846.963025]  [&lt;ffffffff810a6a70&gt;] ? kthread_freezable_should_stop+0x70/0x70
[161846.963031]  [&lt;ffffffff816e6522&gt;] ? ret_from_fork+0x42/0x70
[161846.963035]  [&lt;ffffffff810a6a70&gt;] ? kthread_freezable_should_stop+0x70/0x70
[161846.963037] Code: cc 51 41 53 b8 1c 00 00 00 0f 05 41 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 51 41 53 b8 1d 00 00 00 0f 05 &lt;41&gt; 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc

Signed-off-by: Junxiao Bi &lt;junxiao.bi@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 233ac3891607f501f08879134d623b303838f478 ]

The following soft lockup was caught. This is a deadlock caused by
recusive locking.

Process kworker/u40:1:28016 was holding spin lock "mbx-&gt;queue_lock" in
qlcnic_83xx_mailbox_worker(), while a softirq came in and ask the same spin
lock in qlcnic_83xx_enqueue_mbx_cmd(). This lock should be hold by disable
bh..

[161846.962125] NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [kworker/u40:1:28016]
[161846.962367] Modules linked in: tun ocfs2 xen_netback xen_blkback xen_gntalloc xen_gntdev xen_evtchn xenfs xen_privcmd autofs4 ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs bnx2fc fcoe libfcoe libfc sunrpc 8021q mrp garp bridge stp llc bonding dm_round_robin dm_multipath iTCO_wdt iTCO_vendor_support pcspkr sb_edac edac_core i2c_i801 shpchp lpc_ich mfd_core ioatdma ipmi_devintf ipmi_si ipmi_msghandler sg ext4 jbd2 mbcache2 sr_mod cdrom sd_mod igb i2c_algo_bit i2c_core ahci libahci megaraid_sas ixgbe dca ptp pps_core vxlan udp_tunnel ip6_udp_tunnel qla2xxx scsi_transport_fc qlcnic crc32c_intel be2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi dm_mirror dm_region_hash dm_log dm_mod
[161846.962454]
[161846.962460] CPU: 1 PID: 28016 Comm: kworker/u40:1 Not tainted 4.1.12-94.5.9.el6uek.x86_64 #2
[161846.962463] Hardware name: Oracle Corporation SUN SERVER X4-2L      /ASSY,MB,X4-2L         , BIOS 26050100 09/19/2017
[161846.962489] Workqueue: qlcnic_mailbox qlcnic_83xx_mailbox_worker [qlcnic]
[161846.962493] task: ffff8801f2e34600 ti: ffff88004ca5c000 task.ti: ffff88004ca5c000
[161846.962496] RIP: e030:[&lt;ffffffff810013aa&gt;]  [&lt;ffffffff810013aa&gt;] xen_hypercall_sched_op+0xa/0x20
[161846.962506] RSP: e02b:ffff880202e43388  EFLAGS: 00000206
[161846.962509] RAX: 0000000000000000 RBX: ffff8801f6996b70 RCX: ffffffff810013aa
[161846.962511] RDX: ffff880202e433cc RSI: ffff880202e433b0 RDI: 0000000000000003
[161846.962513] RBP: ffff880202e433d0 R08: 0000000000000000 R09: ffff8801fe893200
[161846.962516] R10: ffff8801fe400538 R11: 0000000000000206 R12: ffff880202e4b000
[161846.962518] R13: 0000000000000050 R14: 0000000000000001 R15: 000000000000020d
[161846.962528] FS:  0000000000000000(0000) GS:ffff880202e40000(0000) knlGS:ffff880202e40000
[161846.962531] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[161846.962533] CR2: 0000000002612640 CR3: 00000001bb796000 CR4: 0000000000042660
[161846.962536] Stack:
[161846.962538]  ffff880202e43608 0000000000000000 ffffffff813f0442 ffff880202e433b0
[161846.962543]  0000000000000000 ffff880202e433cc ffffffff00000001 0000000000000000
[161846.962547]  00000009813f03d6 ffff880202e433e0 ffffffff813f0460 ffff880202e43440
[161846.962552] Call Trace:
[161846.962555]  &lt;IRQ&gt;
[161846.962565]  [&lt;ffffffff813f0442&gt;] ? xen_poll_irq_timeout+0x42/0x50
[161846.962570]  [&lt;ffffffff813f0460&gt;] xen_poll_irq+0x10/0x20
[161846.962578]  [&lt;ffffffff81014222&gt;] xen_lock_spinning+0xe2/0x110
[161846.962583]  [&lt;ffffffff81013f01&gt;] __raw_callee_save_xen_lock_spinning+0x11/0x20
[161846.962592]  [&lt;ffffffff816e5c57&gt;] ? _raw_spin_lock+0x57/0x80
[161846.962609]  [&lt;ffffffffa028acfc&gt;] qlcnic_83xx_enqueue_mbx_cmd+0x7c/0xe0 [qlcnic]
[161846.962623]  [&lt;ffffffffa028e008&gt;] qlcnic_83xx_issue_cmd+0x58/0x210 [qlcnic]
[161846.962636]  [&lt;ffffffffa028caf2&gt;] qlcnic_83xx_sre_macaddr_change+0x162/0x1d0 [qlcnic]
[161846.962649]  [&lt;ffffffffa028cb8b&gt;] qlcnic_83xx_change_l2_filter+0x2b/0x30 [qlcnic]
[161846.962657]  [&lt;ffffffff8160248b&gt;] ? __skb_flow_dissect+0x18b/0x650
[161846.962670]  [&lt;ffffffffa02856e5&gt;] qlcnic_send_filter+0x205/0x250 [qlcnic]
[161846.962682]  [&lt;ffffffffa0285c77&gt;] qlcnic_xmit_frame+0x547/0x7b0 [qlcnic]
[161846.962691]  [&lt;ffffffff8160ac22&gt;] xmit_one+0x82/0x1a0
[161846.962696]  [&lt;ffffffff8160ad90&gt;] dev_hard_start_xmit+0x50/0xa0
[161846.962701]  [&lt;ffffffff81630112&gt;] sch_direct_xmit+0x112/0x220
[161846.962706]  [&lt;ffffffff8160b80f&gt;] __dev_queue_xmit+0x1df/0x5e0
[161846.962710]  [&lt;ffffffff8160bc33&gt;] dev_queue_xmit_sk+0x13/0x20
[161846.962721]  [&lt;ffffffffa0575bd5&gt;] bond_dev_queue_xmit+0x35/0x80 [bonding]
[161846.962729]  [&lt;ffffffffa05769fb&gt;] __bond_start_xmit+0x1cb/0x210 [bonding]
[161846.962736]  [&lt;ffffffffa0576a71&gt;] bond_start_xmit+0x31/0x60 [bonding]
[161846.962740]  [&lt;ffffffff8160ac22&gt;] xmit_one+0x82/0x1a0
[161846.962745]  [&lt;ffffffff8160ad90&gt;] dev_hard_start_xmit+0x50/0xa0
[161846.962749]  [&lt;ffffffff8160bb1e&gt;] __dev_queue_xmit+0x4ee/0x5e0
[161846.962754]  [&lt;ffffffff8160bc33&gt;] dev_queue_xmit_sk+0x13/0x20
[161846.962760]  [&lt;ffffffffa05cfa72&gt;] vlan_dev_hard_start_xmit+0xb2/0x150 [8021q]
[161846.962764]  [&lt;ffffffff8160ac22&gt;] xmit_one+0x82/0x1a0
[161846.962769]  [&lt;ffffffff8160ad90&gt;] dev_hard_start_xmit+0x50/0xa0
[161846.962773]  [&lt;ffffffff8160bb1e&gt;] __dev_queue_xmit+0x4ee/0x5e0
[161846.962777]  [&lt;ffffffff8160bc33&gt;] dev_queue_xmit_sk+0x13/0x20
[161846.962789]  [&lt;ffffffffa05adf74&gt;] br_dev_queue_push_xmit+0x54/0xa0 [bridge]
[161846.962797]  [&lt;ffffffffa05ae4ff&gt;] br_forward_finish+0x2f/0x90 [bridge]
[161846.962807]  [&lt;ffffffff810b0dad&gt;] ? ttwu_do_wakeup+0x1d/0x100
[161846.962811]  [&lt;ffffffff815f929b&gt;] ? __alloc_skb+0x8b/0x1f0
[161846.962818]  [&lt;ffffffffa05ae04d&gt;] __br_forward+0x8d/0x120 [bridge]
[161846.962822]  [&lt;ffffffff815f613b&gt;] ? __kmalloc_reserve+0x3b/0xa0
[161846.962829]  [&lt;ffffffff810be55e&gt;] ? update_rq_runnable_avg+0xee/0x230
[161846.962836]  [&lt;ffffffffa05ae176&gt;] br_forward+0x96/0xb0 [bridge]
[161846.962845]  [&lt;ffffffffa05af85e&gt;] br_handle_frame_finish+0x1ae/0x420 [bridge]
[161846.962853]  [&lt;ffffffffa05afc4f&gt;] br_handle_frame+0x17f/0x260 [bridge]
[161846.962862]  [&lt;ffffffffa05afad0&gt;] ? br_handle_frame_finish+0x420/0x420 [bridge]
[161846.962867]  [&lt;ffffffff8160d057&gt;] __netif_receive_skb_core+0x1f7/0x870
[161846.962872]  [&lt;ffffffff8160d6f2&gt;] __netif_receive_skb+0x22/0x70
[161846.962877]  [&lt;ffffffff8160d913&gt;] netif_receive_skb_internal+0x23/0x90
[161846.962884]  [&lt;ffffffffa07512ea&gt;] ? xenvif_idx_release+0xea/0x100 [xen_netback]
[161846.962889]  [&lt;ffffffff816e5a10&gt;] ? _raw_spin_unlock_irqrestore+0x20/0x50
[161846.962893]  [&lt;ffffffff8160e624&gt;] netif_receive_skb_sk+0x24/0x90
[161846.962899]  [&lt;ffffffffa075269a&gt;] xenvif_tx_submit+0x2ca/0x3f0 [xen_netback]
[161846.962906]  [&lt;ffffffffa0753f0c&gt;] xenvif_tx_action+0x9c/0xd0 [xen_netback]
[161846.962915]  [&lt;ffffffffa07567f5&gt;] xenvif_poll+0x35/0x70 [xen_netback]
[161846.962920]  [&lt;ffffffff8160e01b&gt;] napi_poll+0xcb/0x1e0
[161846.962925]  [&lt;ffffffff8160e1c0&gt;] net_rx_action+0x90/0x1c0
[161846.962931]  [&lt;ffffffff8108aaba&gt;] __do_softirq+0x10a/0x350
[161846.962938]  [&lt;ffffffff8108ae75&gt;] irq_exit+0x125/0x130
[161846.962943]  [&lt;ffffffff813f03a9&gt;] xen_evtchn_do_upcall+0x39/0x50
[161846.962950]  [&lt;ffffffff816e7ffe&gt;] xen_do_hypervisor_callback+0x1e/0x40
[161846.962952]  &lt;EOI&gt;
[161846.962959]  [&lt;ffffffff816e5c4a&gt;] ? _raw_spin_lock+0x4a/0x80
[161846.962964]  [&lt;ffffffff816e5b1e&gt;] ? _raw_spin_lock_irqsave+0x1e/0xa0
[161846.962978]  [&lt;ffffffffa028e279&gt;] ? qlcnic_83xx_mailbox_worker+0xb9/0x2a0 [qlcnic]
[161846.962991]  [&lt;ffffffff810a14e1&gt;] ? process_one_work+0x151/0x4b0
[161846.962995]  [&lt;ffffffff8100c3f2&gt;] ? check_events+0x12/0x20
[161846.963001]  [&lt;ffffffff810a1960&gt;] ? worker_thread+0x120/0x480
[161846.963005]  [&lt;ffffffff816e187b&gt;] ? __schedule+0x30b/0x890
[161846.963010]  [&lt;ffffffff810a1840&gt;] ? process_one_work+0x4b0/0x4b0
[161846.963015]  [&lt;ffffffff810a1840&gt;] ? process_one_work+0x4b0/0x4b0
[161846.963021]  [&lt;ffffffff810a6b3e&gt;] ? kthread+0xce/0xf0
[161846.963025]  [&lt;ffffffff810a6a70&gt;] ? kthread_freezable_should_stop+0x70/0x70
[161846.963031]  [&lt;ffffffff816e6522&gt;] ? ret_from_fork+0x42/0x70
[161846.963035]  [&lt;ffffffff810a6a70&gt;] ? kthread_freezable_should_stop+0x70/0x70
[161846.963037] Code: cc 51 41 53 b8 1c 00 00 00 0f 05 41 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 51 41 53 b8 1d 00 00 00 0f 05 &lt;41&gt; 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc

Signed-off-by: Junxiao Bi &lt;junxiao.bi@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: ethernet: xilinx: Mark XILINX_LL_TEMAC broken on 64-bit</title>
<updated>2018-02-07T19:07:55+00:00</updated>
<author>
<name>Geert Uytterhoeven</name>
<email>geert+renesas@glider.be</email>
</author>
<published>2017-11-29T10:01:09+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=d5b5f8b30aee9939e837817bb9d0de317160482e'/>
<id>d5b5f8b30aee9939e837817bb9d0de317160482e</id>
<content type='text'>
[ Upstream commit 15bfe05c8d6386f1a90e9340d15336e85e32aad6 ]

On 64-bit (e.g. powerpc64/allmodconfig):

    drivers/net/ethernet/xilinx/ll_temac_main.c: In function 'temac_start_xmit_done':
    drivers/net/ethernet/xilinx/ll_temac_main.c:633:22: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
	dev_kfree_skb_irq((struct sk_buff *)cur_p-&gt;app4);
			  ^

cdmac_bd.app4 is u32, so it is too small to hold a kernel pointer.

Note that several other fields in struct cdmac_bd are also too small to
hold physical addresses on 64-bit platforms.

Signed-off-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@microsoft.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 15bfe05c8d6386f1a90e9340d15336e85e32aad6 ]

On 64-bit (e.g. powerpc64/allmodconfig):

    drivers/net/ethernet/xilinx/ll_temac_main.c: In function 'temac_start_xmit_done':
    drivers/net/ethernet/xilinx/ll_temac_main.c:633:22: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
	dev_kfree_skb_irq((struct sk_buff *)cur_p-&gt;app4);
			  ^

cdmac_bd.app4 is u32, so it is too small to hold a kernel pointer.

Note that several other fields in struct cdmac_bd are also too small to
hold physical addresses on 64-bit platforms.

Signed-off-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@microsoft.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>xen-netfront: remove warning when unloading module</title>
<updated>2018-02-07T19:07:55+00:00</updated>
<author>
<name>Eduardo Otubo</name>
<email>otubo@redhat.com</email>
</author>
<published>2017-11-23T14:18:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f2dc0da2c28194bc7f8722ad54565f90bcbd8b3a'/>
<id>f2dc0da2c28194bc7f8722ad54565f90bcbd8b3a</id>
<content type='text'>
[ Upstream commit 5b5971df3bc2775107ddad164018a8a8db633b81 ]

v2:
 * Replace busy wait with wait_event()/wake_up_all()
 * Cannot garantee that at the time xennet_remove is called, the
   xen_netback state will not be XenbusStateClosed, so added a
   condition for that
 * There's a small chance for the xen_netback state is
   XenbusStateUnknown by the time the xen_netfront switches to Closed,
   so added a condition for that.

When unloading module xen_netfront from guest, dmesg would output
warning messages like below:

  [  105.236836] xen:grant_table: WARNING: g.e. 0x903 still in use!
  [  105.236839] deferring g.e. 0x903 (pfn 0x35805)

This problem relies on netfront and netback being out of sync. By the time
netfront revokes the g.e.'s netback didn't have enough time to free all of
them, hence displaying the warnings on dmesg.

The trick here is to make netfront to wait until netback frees all the g.e.'s
and only then continue to cleanup for the module removal, and this is done by
manipulating both device states.

Signed-off-by: Eduardo Otubo &lt;otubo@redhat.com&gt;
Acked-by: Juergen Gross &lt;jgross@suse.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@microsoft.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 5b5971df3bc2775107ddad164018a8a8db633b81 ]

v2:
 * Replace busy wait with wait_event()/wake_up_all()
 * Cannot garantee that at the time xennet_remove is called, the
   xen_netback state will not be XenbusStateClosed, so added a
   condition for that
 * There's a small chance for the xen_netback state is
   XenbusStateUnknown by the time the xen_netfront switches to Closed,
   so added a condition for that.

When unloading module xen_netfront from guest, dmesg would output
warning messages like below:

  [  105.236836] xen:grant_table: WARNING: g.e. 0x903 still in use!
  [  105.236839] deferring g.e. 0x903 (pfn 0x35805)

This problem relies on netfront and netback being out of sync. By the time
netfront revokes the g.e.'s netback didn't have enough time to free all of
them, hence displaying the warnings on dmesg.

The trick here is to make netfront to wait until netback frees all the g.e.'s
and only then continue to cleanup for the module removal, and this is done by
manipulating both device states.

Signed-off-by: Eduardo Otubo &lt;otubo@redhat.com&gt;
Acked-by: Juergen Gross &lt;jgross@suse.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@microsoft.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>igb: Free IRQs when device is hotplugged</title>
<updated>2018-02-07T19:07:54+00:00</updated>
<author>
<name>Lyude Paul</name>
<email>lyude@redhat.com</email>
</author>
<published>2017-12-12T19:31:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f7c2ce3d42bc18fce799f9144cc28328a896c7b1'/>
<id>f7c2ce3d42bc18fce799f9144cc28328a896c7b1</id>
<content type='text'>
commit 888f22931478a05bc81ceb7295c626e1292bf0ed upstream.

Recently I got a Caldigit TS3 Thunderbolt 3 dock, and noticed that upon
hotplugging my kernel would immediately crash due to igb:

[  680.825801] kernel BUG at drivers/pci/msi.c:352!
[  680.828388] invalid opcode: 0000 [#1] SMP
[  680.829194] Modules linked in: igb(O) thunderbolt i2c_algo_bit joydev vfat fat btusb btrtl btbcm btintel bluetooth ecdh_generic hp_wmi sparse_keymap rfkill wmi_bmof iTCO_wdt intel_rapl x86_pkg_temp_thermal coretemp crc32_pclmul snd_pcm rtsx_pci_ms mei_me snd_timer memstick snd pcspkr mei soundcore i2c_i801 tpm_tis psmouse shpchp wmi tpm_tis_core tpm video hp_wireless acpi_pad rtsx_pci_sdmmc mmc_core crc32c_intel serio_raw rtsx_pci mfd_core xhci_pci xhci_hcd i2c_hid i2c_core [last unloaded: igb]
[  680.831085] CPU: 1 PID: 78 Comm: kworker/u16:1 Tainted: G           O     4.15.0-rc3Lyude-Test+ #6
[  680.831596] Hardware name: HP HP ZBook Studio G4/826B, BIOS P71 Ver. 01.03 06/09/2017
[  680.832168] Workqueue: kacpi_hotplug acpi_hotplug_work_fn
[  680.832687] RIP: 0010:free_msi_irqs+0x180/0x1b0
[  680.833271] RSP: 0018:ffffc9000030fbf0 EFLAGS: 00010286
[  680.833761] RAX: ffff8803405f9c00 RBX: ffff88033e3d2e40 RCX: 000000000000002c
[  680.834278] RDX: 0000000000000000 RSI: 00000000000000ac RDI: ffff880340be2178
[  680.834832] RBP: 0000000000000000 R08: ffff880340be1ff0 R09: ffff8803405f9c00
[  680.835342] R10: 0000000000000000 R11: 0000000000000040 R12: ffff88033d63a298
[  680.835822] R13: ffff88033d63a000 R14: 0000000000000060 R15: ffff880341959000
[  680.836332] FS:  0000000000000000(0000) GS:ffff88034f440000(0000) knlGS:0000000000000000
[  680.836817] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  680.837360] CR2: 000055e64044afdf CR3: 0000000001c09002 CR4: 00000000003606e0
[  680.837954] Call Trace:
[  680.838853]  pci_disable_msix+0xce/0xf0
[  680.839616]  igb_reset_interrupt_capability+0x5d/0x60 [igb]
[  680.840278]  igb_remove+0x9d/0x110 [igb]
[  680.840764]  pci_device_remove+0x36/0xb0
[  680.841279]  device_release_driver_internal+0x157/0x220
[  680.841739]  pci_stop_bus_device+0x7d/0xa0
[  680.842255]  pci_stop_bus_device+0x2b/0xa0
[  680.842722]  pci_stop_bus_device+0x3d/0xa0
[  680.843189]  pci_stop_and_remove_bus_device+0xe/0x20
[  680.843627]  trim_stale_devices+0xf3/0x140
[  680.844086]  trim_stale_devices+0x94/0x140
[  680.844532]  trim_stale_devices+0xa6/0x140
[  680.845031]  ? get_slot_status+0x90/0xc0
[  680.845536]  acpiphp_check_bridge.part.5+0xfe/0x140
[  680.846021]  acpiphp_hotplug_notify+0x175/0x200
[  680.846581]  ? free_bridge+0x100/0x100
[  680.847113]  acpi_device_hotplug+0x8a/0x490
[  680.847535]  acpi_hotplug_work_fn+0x1a/0x30
[  680.848076]  process_one_work+0x182/0x3a0
[  680.848543]  worker_thread+0x2e/0x380
[  680.848963]  ? process_one_work+0x3a0/0x3a0
[  680.849373]  kthread+0x111/0x130
[  680.849776]  ? kthread_create_worker_on_cpu+0x50/0x50
[  680.850188]  ret_from_fork+0x1f/0x30
[  680.850601] Code: 43 14 85 c0 0f 84 d5 fe ff ff 31 ed eb 0f 83 c5 01 39 6b 14 0f 86 c5 fe ff ff 8b 7b 10 01 ef e8 b7 e4 d2 ff 48 83 78 70 00 74 e3 &lt;0f&gt; 0b 49 8d b5 a0 00 00 00 e8 62 6f d3 ff e9 c7 fe ff ff 48 8b
[  680.851497] RIP: free_msi_irqs+0x180/0x1b0 RSP: ffffc9000030fbf0

As it turns out, normally the freeing of IRQs that would fix this is called
inside of the scope of __igb_close(). However, since the device is
already gone by the point we try to unregister the netdevice from the
driver due to a hotplug we end up seeing that the netif isn't present
and thus, forget to free any of the device IRQs.

So: make sure that if we're in the process of dismantling the netdev, we
always allow __igb_close() to be called so that IRQs may be freed
normally. Additionally, only allow igb_close() to be called from
__igb_close() if it hasn't already been called for the given adapter.

Signed-off-by: Lyude Paul &lt;lyude@redhat.com&gt;
Fixes: 9474933caf21 ("igb: close/suspend race in netif_device_detach")
Cc: Todd Fujinaka &lt;todd.fujinaka@intel.com&gt;
Cc: Stephen Hemminger &lt;stephen@networkplumber.org&gt;
Tested-by: Aaron Brown &lt;aaron.f.brown@intel.com&gt;
Signed-off-by: Jeff Kirsher &lt;jeffrey.t.kirsher@intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 888f22931478a05bc81ceb7295c626e1292bf0ed upstream.

Recently I got a Caldigit TS3 Thunderbolt 3 dock, and noticed that upon
hotplugging my kernel would immediately crash due to igb:

[  680.825801] kernel BUG at drivers/pci/msi.c:352!
[  680.828388] invalid opcode: 0000 [#1] SMP
[  680.829194] Modules linked in: igb(O) thunderbolt i2c_algo_bit joydev vfat fat btusb btrtl btbcm btintel bluetooth ecdh_generic hp_wmi sparse_keymap rfkill wmi_bmof iTCO_wdt intel_rapl x86_pkg_temp_thermal coretemp crc32_pclmul snd_pcm rtsx_pci_ms mei_me snd_timer memstick snd pcspkr mei soundcore i2c_i801 tpm_tis psmouse shpchp wmi tpm_tis_core tpm video hp_wireless acpi_pad rtsx_pci_sdmmc mmc_core crc32c_intel serio_raw rtsx_pci mfd_core xhci_pci xhci_hcd i2c_hid i2c_core [last unloaded: igb]
[  680.831085] CPU: 1 PID: 78 Comm: kworker/u16:1 Tainted: G           O     4.15.0-rc3Lyude-Test+ #6
[  680.831596] Hardware name: HP HP ZBook Studio G4/826B, BIOS P71 Ver. 01.03 06/09/2017
[  680.832168] Workqueue: kacpi_hotplug acpi_hotplug_work_fn
[  680.832687] RIP: 0010:free_msi_irqs+0x180/0x1b0
[  680.833271] RSP: 0018:ffffc9000030fbf0 EFLAGS: 00010286
[  680.833761] RAX: ffff8803405f9c00 RBX: ffff88033e3d2e40 RCX: 000000000000002c
[  680.834278] RDX: 0000000000000000 RSI: 00000000000000ac RDI: ffff880340be2178
[  680.834832] RBP: 0000000000000000 R08: ffff880340be1ff0 R09: ffff8803405f9c00
[  680.835342] R10: 0000000000000000 R11: 0000000000000040 R12: ffff88033d63a298
[  680.835822] R13: ffff88033d63a000 R14: 0000000000000060 R15: ffff880341959000
[  680.836332] FS:  0000000000000000(0000) GS:ffff88034f440000(0000) knlGS:0000000000000000
[  680.836817] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  680.837360] CR2: 000055e64044afdf CR3: 0000000001c09002 CR4: 00000000003606e0
[  680.837954] Call Trace:
[  680.838853]  pci_disable_msix+0xce/0xf0
[  680.839616]  igb_reset_interrupt_capability+0x5d/0x60 [igb]
[  680.840278]  igb_remove+0x9d/0x110 [igb]
[  680.840764]  pci_device_remove+0x36/0xb0
[  680.841279]  device_release_driver_internal+0x157/0x220
[  680.841739]  pci_stop_bus_device+0x7d/0xa0
[  680.842255]  pci_stop_bus_device+0x2b/0xa0
[  680.842722]  pci_stop_bus_device+0x3d/0xa0
[  680.843189]  pci_stop_and_remove_bus_device+0xe/0x20
[  680.843627]  trim_stale_devices+0xf3/0x140
[  680.844086]  trim_stale_devices+0x94/0x140
[  680.844532]  trim_stale_devices+0xa6/0x140
[  680.845031]  ? get_slot_status+0x90/0xc0
[  680.845536]  acpiphp_check_bridge.part.5+0xfe/0x140
[  680.846021]  acpiphp_hotplug_notify+0x175/0x200
[  680.846581]  ? free_bridge+0x100/0x100
[  680.847113]  acpi_device_hotplug+0x8a/0x490
[  680.847535]  acpi_hotplug_work_fn+0x1a/0x30
[  680.848076]  process_one_work+0x182/0x3a0
[  680.848543]  worker_thread+0x2e/0x380
[  680.848963]  ? process_one_work+0x3a0/0x3a0
[  680.849373]  kthread+0x111/0x130
[  680.849776]  ? kthread_create_worker_on_cpu+0x50/0x50
[  680.850188]  ret_from_fork+0x1f/0x30
[  680.850601] Code: 43 14 85 c0 0f 84 d5 fe ff ff 31 ed eb 0f 83 c5 01 39 6b 14 0f 86 c5 fe ff ff 8b 7b 10 01 ef e8 b7 e4 d2 ff 48 83 78 70 00 74 e3 &lt;0f&gt; 0b 49 8d b5 a0 00 00 00 e8 62 6f d3 ff e9 c7 fe ff ff 48 8b
[  680.851497] RIP: free_msi_irqs+0x180/0x1b0 RSP: ffffc9000030fbf0

As it turns out, normally the freeing of IRQs that would fix this is called
inside of the scope of __igb_close(). However, since the device is
already gone by the point we try to unregister the netdevice from the
driver due to a hotplug we end up seeing that the netif isn't present
and thus, forget to free any of the device IRQs.

So: make sure that if we're in the process of dismantling the netdev, we
always allow __igb_close() to be called so that IRQs may be freed
normally. Additionally, only allow igb_close() to be called from
__igb_close() if it hasn't already been called for the given adapter.

Signed-off-by: Lyude Paul &lt;lyude@redhat.com&gt;
Fixes: 9474933caf21 ("igb: close/suspend race in netif_device_detach")
Cc: Todd Fujinaka &lt;todd.fujinaka@intel.com&gt;
Cc: Stephen Hemminger &lt;stephen@networkplumber.org&gt;
Tested-by: Aaron Brown &lt;aaron.f.brown@intel.com&gt;
Signed-off-by: Jeff Kirsher &lt;jeffrey.t.kirsher@intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>vmxnet3: repair memory leak</title>
<updated>2018-01-31T13:46:15+00:00</updated>
<author>
<name>Neil Horman</name>
<email>nhorman@tuxdriver.com</email>
</author>
<published>2018-01-22T21:06:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=1414a1ede0ea554364d3cfbfe8dbf650f9d57a29'/>
<id>1414a1ede0ea554364d3cfbfe8dbf650f9d57a29</id>
<content type='text'>
[ Upstream commit 848b159835ddef99cc4193083f7e786c3992f580 ]

with the introduction of commit
b0eb57cb97e7837ebb746404c2c58c6f536f23fa, it appears that rq-&gt;buf_info
is improperly handled.  While it is heap allocated when an rx queue is
setup, and freed when torn down, an old line of code in
vmxnet3_rq_destroy was not properly removed, leading to rq-&gt;buf_info[0]
being set to NULL prior to its being freed, causing a memory leak, which
eventually exhausts the system on repeated create/destroy operations
(for example, when  the mtu of a vmxnet3 interface is changed
frequently.

Fix is pretty straight forward, just move the NULL set to after the
free.

Tested by myself with successful results

Applies to net, and should likely be queued for stable, please

Signed-off-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Reported-By: boyang@redhat.com
CC: boyang@redhat.com
CC: Shrikrishna Khare &lt;skhare@vmware.com&gt;
CC: "VMware, Inc." &lt;pv-drivers@vmware.com&gt;
CC: David S. Miller &lt;davem@davemloft.net&gt;
Acked-by: Shrikrishna Khare &lt;skhare@vmware.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 848b159835ddef99cc4193083f7e786c3992f580 ]

with the introduction of commit
b0eb57cb97e7837ebb746404c2c58c6f536f23fa, it appears that rq-&gt;buf_info
is improperly handled.  While it is heap allocated when an rx queue is
setup, and freed when torn down, an old line of code in
vmxnet3_rq_destroy was not properly removed, leading to rq-&gt;buf_info[0]
being set to NULL prior to its being freed, causing a memory leak, which
eventually exhausts the system on repeated create/destroy operations
(for example, when  the mtu of a vmxnet3 interface is changed
frequently.

Fix is pretty straight forward, just move the NULL set to after the
free.

Tested by myself with successful results

Applies to net, and should likely be queued for stable, please

Signed-off-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Reported-By: boyang@redhat.com
CC: boyang@redhat.com
CC: Shrikrishna Khare &lt;skhare@vmware.com&gt;
CC: "VMware, Inc." &lt;pv-drivers@vmware.com&gt;
CC: David S. Miller &lt;davem@davemloft.net&gt;
Acked-by: Shrikrishna Khare &lt;skhare@vmware.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>pppoe: take -&gt;needed_headroom of lower device into account on xmit</title>
<updated>2018-01-31T13:46:15+00:00</updated>
<author>
<name>Guillaume Nault</name>
<email>g.nault@alphalink.fr</email>
</author>
<published>2018-01-22T17:06:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=0e4c26c860609df87e52ab334cef36993184727c'/>
<id>0e4c26c860609df87e52ab334cef36993184727c</id>
<content type='text'>
[ Upstream commit 02612bb05e51df8489db5e94d0cf8d1c81f87b0c ]

In pppoe_sendmsg(), reserving dev-&gt;hard_header_len bytes of headroom
was probably fine before the introduction of -&gt;needed_headroom in
commit f5184d267c1a ("net: Allow netdevices to specify needed head/tailroom").

But now, virtual devices typically advertise the size of their overhead
in dev-&gt;needed_headroom, so we must also take it into account in
skb_reserve().
Allocation size of skb is also updated to take dev-&gt;needed_tailroom
into account and replace the arbitrary 32 bytes with the real size of
a PPPoE header.

This issue was discovered by syzbot, who connected a pppoe socket to a
gre device which had dev-&gt;header_ops-&gt;create == ipgre_header and
dev-&gt;hard_header_len == 0. Therefore, PPPoE didn't reserve any
headroom, and dev_hard_header() crashed when ipgre_header() tried to
prepend its header to skb-&gt;data.

skbuff: skb_under_panic: text:000000001d390b3a len:31 put:24
head:00000000d8ed776f data:000000008150e823 tail:0x7 end:0xc0 dev:gre0
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:104!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
    (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3670 Comm: syzkaller801466 Not tainted
4.15.0-rc7-next-20180115+ #97
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:skb_panic+0x162/0x1f0 net/core/skbuff.c:100
RSP: 0018:ffff8801d9bd7840 EFLAGS: 00010282
RAX: 0000000000000083 RBX: ffff8801d4f083c0 RCX: 0000000000000000
RDX: 0000000000000083 RSI: 1ffff1003b37ae92 RDI: ffffed003b37aefc
RBP: ffff8801d9bd78a8 R08: 1ffff1003b37ae8a R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff86200de0
R13: ffffffff84a981ad R14: 0000000000000018 R15: ffff8801d2d34180
FS:  00000000019c4880(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000208bc000 CR3: 00000001d9111001 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  skb_under_panic net/core/skbuff.c:114 [inline]
  skb_push+0xce/0xf0 net/core/skbuff.c:1714
  ipgre_header+0x6d/0x4e0 net/ipv4/ip_gre.c:879
  dev_hard_header include/linux/netdevice.h:2723 [inline]
  pppoe_sendmsg+0x58e/0x8b0 drivers/net/ppp/pppoe.c:890
  sock_sendmsg_nosec net/socket.c:630 [inline]
  sock_sendmsg+0xca/0x110 net/socket.c:640
  sock_write_iter+0x31a/0x5d0 net/socket.c:909
  call_write_iter include/linux/fs.h:1775 [inline]
  do_iter_readv_writev+0x525/0x7f0 fs/read_write.c:653
  do_iter_write+0x154/0x540 fs/read_write.c:932
  vfs_writev+0x18a/0x340 fs/read_write.c:977
  do_writev+0xfc/0x2a0 fs/read_write.c:1012
  SYSC_writev fs/read_write.c:1085 [inline]
  SyS_writev+0x27/0x30 fs/read_write.c:1082
  entry_SYSCALL_64_fastpath+0x29/0xa0

Admittedly PPPoE shouldn't be allowed to run on non Ethernet-like
interfaces, but reserving space for -&gt;needed_headroom is a more
fundamental issue that needs to be addressed first.

Same problem exists for __pppoe_xmit(), which also needs to take
dev-&gt;needed_headroom into account in skb_cow_head().

Fixes: f5184d267c1a ("net: Allow netdevices to specify needed head/tailroom")
Reported-by: syzbot+ed0838d0fa4c4f2b528e20286e6dc63effc7c14d@syzkaller.appspotmail.com
Signed-off-by: Guillaume Nault &lt;g.nault@alphalink.fr&gt;
Reviewed-by: Xin Long &lt;lucien.xin@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 02612bb05e51df8489db5e94d0cf8d1c81f87b0c ]

In pppoe_sendmsg(), reserving dev-&gt;hard_header_len bytes of headroom
was probably fine before the introduction of -&gt;needed_headroom in
commit f5184d267c1a ("net: Allow netdevices to specify needed head/tailroom").

But now, virtual devices typically advertise the size of their overhead
in dev-&gt;needed_headroom, so we must also take it into account in
skb_reserve().
Allocation size of skb is also updated to take dev-&gt;needed_tailroom
into account and replace the arbitrary 32 bytes with the real size of
a PPPoE header.

This issue was discovered by syzbot, who connected a pppoe socket to a
gre device which had dev-&gt;header_ops-&gt;create == ipgre_header and
dev-&gt;hard_header_len == 0. Therefore, PPPoE didn't reserve any
headroom, and dev_hard_header() crashed when ipgre_header() tried to
prepend its header to skb-&gt;data.

skbuff: skb_under_panic: text:000000001d390b3a len:31 put:24
head:00000000d8ed776f data:000000008150e823 tail:0x7 end:0xc0 dev:gre0
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:104!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
    (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3670 Comm: syzkaller801466 Not tainted
4.15.0-rc7-next-20180115+ #97
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:skb_panic+0x162/0x1f0 net/core/skbuff.c:100
RSP: 0018:ffff8801d9bd7840 EFLAGS: 00010282
RAX: 0000000000000083 RBX: ffff8801d4f083c0 RCX: 0000000000000000
RDX: 0000000000000083 RSI: 1ffff1003b37ae92 RDI: ffffed003b37aefc
RBP: ffff8801d9bd78a8 R08: 1ffff1003b37ae8a R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff86200de0
R13: ffffffff84a981ad R14: 0000000000000018 R15: ffff8801d2d34180
FS:  00000000019c4880(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000208bc000 CR3: 00000001d9111001 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  skb_under_panic net/core/skbuff.c:114 [inline]
  skb_push+0xce/0xf0 net/core/skbuff.c:1714
  ipgre_header+0x6d/0x4e0 net/ipv4/ip_gre.c:879
  dev_hard_header include/linux/netdevice.h:2723 [inline]
  pppoe_sendmsg+0x58e/0x8b0 drivers/net/ppp/pppoe.c:890
  sock_sendmsg_nosec net/socket.c:630 [inline]
  sock_sendmsg+0xca/0x110 net/socket.c:640
  sock_write_iter+0x31a/0x5d0 net/socket.c:909
  call_write_iter include/linux/fs.h:1775 [inline]
  do_iter_readv_writev+0x525/0x7f0 fs/read_write.c:653
  do_iter_write+0x154/0x540 fs/read_write.c:932
  vfs_writev+0x18a/0x340 fs/read_write.c:977
  do_writev+0xfc/0x2a0 fs/read_write.c:1012
  SYSC_writev fs/read_write.c:1085 [inline]
  SyS_writev+0x27/0x30 fs/read_write.c:1082
  entry_SYSCALL_64_fastpath+0x29/0xa0

Admittedly PPPoE shouldn't be allowed to run on non Ethernet-like
interfaces, but reserving space for -&gt;needed_headroom is a more
fundamental issue that needs to be addressed first.

Same problem exists for __pppoe_xmit(), which also needs to take
dev-&gt;needed_headroom into account in skb_cow_head().

Fixes: f5184d267c1a ("net: Allow netdevices to specify needed head/tailroom")
Reported-by: syzbot+ed0838d0fa4c4f2b528e20286e6dc63effc7c14d@syzkaller.appspotmail.com
Signed-off-by: Guillaume Nault &lt;g.nault@alphalink.fr&gt;
Reviewed-by: Xin Long &lt;lucien.xin@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>e1000e: Fix e1000_check_for_copper_link_ich8lan return value.</title>
<updated>2018-01-17T08:29:31+00:00</updated>
<author>
<name>Benjamin Poirier</name>
<email>bpoirier@suse.com</email>
</author>
<published>2017-12-11T07:26:40+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=55492dc6122f42a057fef1641e48c7ac489fd4e0'/>
<id>55492dc6122f42a057fef1641e48c7ac489fd4e0</id>
<content type='text'>
commit 4110e02eb45ea447ec6f5459c9934de0a273fb91 upstream.

e1000e_check_for_copper_link() and e1000_check_for_copper_link_ich8lan()
are the two functions that may be assigned to mac.ops.check_for_link when
phy.media_type == e1000_media_type_copper. Commit 19110cfbb34d ("e1000e:
Separate signaling for link check/link up") changed the meaning of the
return value of check_for_link for copper media but only adjusted the first
function. This patch adjusts the second function likewise.

Reported-by: Christian Hesse &lt;list@eworm.de&gt;
Reported-by: Gabriel C &lt;nix.or.die@gmail.com&gt;
Link: https://bugzilla.kernel.org/show_bug.cgi?id=198047
Fixes: 19110cfbb34d ("e1000e: Separate signaling for link check/link up")
Signed-off-by: Benjamin Poirier &lt;bpoirier@suse.com&gt;
Tested-by: Aaron Brown &lt;aaron.f.brown@intel.com&gt;
Tested-by: Christian Hesse &lt;list@eworm.de&gt;
Signed-off-by: Jeff Kirsher &lt;jeffrey.t.kirsher@intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 4110e02eb45ea447ec6f5459c9934de0a273fb91 upstream.

e1000e_check_for_copper_link() and e1000_check_for_copper_link_ich8lan()
are the two functions that may be assigned to mac.ops.check_for_link when
phy.media_type == e1000_media_type_copper. Commit 19110cfbb34d ("e1000e:
Separate signaling for link check/link up") changed the meaning of the
return value of check_for_link for copper media but only adjusted the first
function. This patch adjusts the second function likewise.

Reported-by: Christian Hesse &lt;list@eworm.de&gt;
Reported-by: Gabriel C &lt;nix.or.die@gmail.com&gt;
Link: https://bugzilla.kernel.org/show_bug.cgi?id=198047
Fixes: 19110cfbb34d ("e1000e: Separate signaling for link check/link up")
Signed-off-by: Benjamin Poirier &lt;bpoirier@suse.com&gt;
Tested-by: Aaron Brown &lt;aaron.f.brown@intel.com&gt;
Tested-by: Christian Hesse &lt;list@eworm.de&gt;
Signed-off-by: Jeff Kirsher &lt;jeffrey.t.kirsher@intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>Revert "can: kvaser_usb: free buf in error paths"</title>
<updated>2018-01-17T08:29:31+00:00</updated>
<author>
<name>Greg Kroah-Hartman</name>
<email>gregkh@linuxfoundation.org</email>
</author>
<published>2018-01-13T17:45:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=e27472ac7ec96208d485101d3476361a866957fe'/>
<id>e27472ac7ec96208d485101d3476361a866957fe</id>
<content type='text'>
This reverts commit 70d9dccf50152b0d7bfb2697d8c51e9fab9f782c which was
commit 435019b48033138581a6171093b181fc6b4d3d30 upstream.

Jimmy Assarsson asks that it be reverted as it's not correct there.

Reported-by: Jimmy Assarsson &lt;jimmyassarsson@gmail.com&gt;
Cc: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This reverts commit 70d9dccf50152b0d7bfb2697d8c51e9fab9f782c which was
commit 435019b48033138581a6171093b181fc6b4d3d30 upstream.

Jimmy Assarsson asks that it be reverted as it's not correct there.

Reported-by: Jimmy Assarsson &lt;jimmyassarsson@gmail.com&gt;
Cc: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: stmmac: enable EEE in MII, GMII or RGMII only</title>
<updated>2018-01-17T08:29:30+00:00</updated>
<author>
<name>Jerome Brunet</name>
<email>jbrunet@baylibre.com</email>
</author>
<published>2018-01-03T15:46:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=540eac0e594e216d7f85011286ee4bd234930ccc'/>
<id>540eac0e594e216d7f85011286ee4bd234930ccc</id>
<content type='text'>
[ Upstream commit 879626e3a52630316d817cbda7cec9a5446d1d82 ]

Note in the databook - Section 4.4 - EEE :
" The EEE feature is not supported when the MAC is configured to use the
TBI, RTBI, SMII, RMII or SGMII single PHY interface. Even if the MAC
supports multiple PHY interfaces, you should activate the EEE mode only
when the MAC is operating with GMII, MII, or RGMII interface."

Applying this restriction solves a stability issue observed on Amlogic
gxl platforms operating with RMII interface and the internal PHY.

Fixes: 83bf79b6bb64 ("stmmac: disable at run-time the EEE if not supported")
Signed-off-by: Jerome Brunet &lt;jbrunet@baylibre.com&gt;
Tested-by: Arnaud Patard &lt;arnaud.patard@rtp-net.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 879626e3a52630316d817cbda7cec9a5446d1d82 ]

Note in the databook - Section 4.4 - EEE :
" The EEE feature is not supported when the MAC is configured to use the
TBI, RTBI, SMII, RMII or SGMII single PHY interface. Even if the MAC
supports multiple PHY interfaces, you should activate the EEE mode only
when the MAC is operating with GMII, MII, or RGMII interface."

Applying this restriction solves a stability issue observed on Amlogic
gxl platforms operating with RMII interface and the internal PHY.

Fixes: 83bf79b6bb64 ("stmmac: disable at run-time the EEE if not supported")
Signed-off-by: Jerome Brunet &lt;jbrunet@baylibre.com&gt;
Tested-by: Arnaud Patard &lt;arnaud.patard@rtp-net.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
