linux-stable.git/drivers/net, branch v3.4.106

drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets

2015-02-02T09:05:26+00:00

commit 5188cd44c55db3e92cd9e77a40b5baa7ed4340f7 upstream.

UFO is now disabled on all drivers that work with virtio net headers,
but userland may try to send UFO/IPv6 packets anyway.  Instead of
sending with ID=0, we should select identifiers on their behalf (as we
used to).

Signed-off-by: Ben Hutchings 
Fixes: 916e4cf46d02 ("ipv6: reuse ip6_frag_id from ip6_ufo_append_data")
Signed-off-by: David S. Miller 
[bwh: For 3.2, net/ipv6/output_core.c is a completely new file]
Signed-off-by: Zefan Li

can: esd_usb2: fix memory leak on disconnect

2015-02-02T09:05:22+00:00

commit efbd50d2f62fc1f69a3dcd153e63ba28cc8eb27f upstream.

It seems struct esd_usb2 dev is not deallocated on disconnect. The patch adds
the missing deallocation.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Acked-by: Matthias Fuchs 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Zefan Li

can: dev: avoid calling kfree_skb() from interrupt context

2015-02-02T09:05:22+00:00

commit 5247a589c24022ab34e780039cc8000c48f2035e upstream.

ikfree_skb() is Called in can_free_echo_skb(), which might be called from (TX
Error) interrupt, which triggers the folloing warning:

[ 1153.360705] ------------[ cut here ]------------
[ 1153.360715] WARNING: CPU: 0 PID: 31 at net/core/skbuff.c:563 skb_release_head_state+0xb9/0xd0()
[ 1153.360772] Call Trace:
[ 1153.360778]  [] dump_stack+0x41/0x52
[ 1153.360782]  [] warn_slowpath_common+0x7e/0xa0
[ 1153.360784]  [] ? skb_release_head_state+0xb9/0xd0
[ 1153.360786]  [] ? skb_release_head_state+0xb9/0xd0
[ 1153.360788]  [] warn_slowpath_null+0x22/0x30
[ 1153.360791]  [] skb_release_head_state+0xb9/0xd0
[ 1153.360793]  [] skb_release_all+0x10/0x30
[ 1153.360795]  [] kfree_skb+0x36/0x80
[ 1153.360799]  [] ? can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360802]  [] can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360805]  [] esd_pci402_interrupt+0x34c/0x57a [esd402]
[ 1153.360809]  [] handle_irq_event_percpu+0x35/0x180
[ 1153.360811]  [] ? handle_irq_event_percpu+0xa3/0x180
[ 1153.360813]  [] handle_irq_event+0x31/0x50
[ 1153.360816]  [] handle_fasteoi_irq+0x6f/0x120
[ 1153.360818]  [] ? handle_edge_irq+0x110/0x110
[ 1153.360822]  [] handle_irq+0x71/0x90
[ 1153.360823]    [] do_IRQ+0x3c/0xd0
[ 1153.360829]  [] common_interrupt+0x2c/0x34
[ 1153.360834]  [] ? finish_task_switch+0x47/0xf0
[ 1153.360836]  [] __schedule+0x35b/0x7e0
[ 1153.360839]  [] ? console_unlock+0x2c4/0x4d0
[ 1153.360842]  [] ? n_tty_receive_buf_common+0x890/0x890
[ 1153.360845]  [] ? process_one_work+0x196/0x370
[ 1153.360847]  [] schedule+0x23/0x60
[ 1153.360849]  [] worker_thread+0x161/0x460
[ 1153.360852]  [] ? __wake_up_locked+0x1f/0x30
[ 1153.360854]  [] ? rescuer_thread+0x2f0/0x2f0
[ 1153.360856]  [] kthread+0xa1/0xc0
[ 1153.360859]  [] ret_from_kernel_thread+0x21/0x30
[ 1153.360861]  [] ? kthread_create_on_node+0x110/0x110
[ 1153.360863] ---[ end trace 5ff83639cbb74b35 ]---

This patch replaces the kfree_skb() by dev_kfree_skb_any().

Signed-off-by: Thomas Körper 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Zefan Li

rt2x00: do not align payload on modern H/W

2015-02-02T09:05:21+00:00

commit cfd9167af14eb4ec21517a32911d460083ee3d59 upstream.

RT2800 and newer hardware require padding between header and payload if
header length is not multiple of 4.

For historical reasons we also align payload to to 4 bytes boundary, but
such alignment is not needed on modern H/W.

Patch fixes skb_under_panic problems reported from time to time:

https://bugzilla.kernel.org/show_bug.cgi?id=84911
https://bugzilla.kernel.org/show_bug.cgi?id=72471
http://marc.info/?l=linux-wireless&m=139108549530402&w=2
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1087591

Panic happened because we eat 4 bytes of skb headroom on each
(re)transmission when sending frame without the payload and the header
length not being multiple of 4 (i.e. QoS header has 26 bytes). On such
case because paylad_aling=2 is bigger than header_align=0 we increase
header_align by 4 bytes. To prevent that we could change the check to:

	if (payload_length && payload_align > header_align)
		header_align += 4;

but not aligning payload at all is more effective and alignment is not
really needed by H/W (that has been tested on OpenWrt project for few
years now).

Reported-and-tested-by: Antti S. Lankila 
Debugged-by: Antti S. Lankila 
Reported-by: Henrik Asp 
Originally-From: Helmut Schaa 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Zefan Li

macvtap: Fix csum_start when VLAN tags are present

2015-02-02T09:05:18+00:00

commit 3ce9b20f1971690b8b3b620e735ec99431573b39 upstream.

When VLAN is in use in macvtap_put_user, we end up setting
csum_start to the wrong place.  The result is that the whoever
ends up doing the checksum setting will corrupt the packet instead
of writing the checksum to the expected location, usually this
means writing the checksum with an offset of -4.

This patch fixes this by adjusting csum_start when VLAN tags are
detected.

Fixes: f09e2249c4f5 ("macvtap: restore vlan header on user read")
Signed-off-by: Herbert Xu 

Cheers,
Signed-off-by: David S. Miller 
Signed-off-by: Zefan Li

wireless: rt2x00: add new rt2800usb device

2015-02-02T09:05:08+00:00

commit 664d6a792785cc677c2091038ce10322c8d04ae1 upstream.

0x1b75 0xa200 AirLive WN-200USB wireless 11b/g/n dongle

References: https://bugs.debian.org/766802
Reported-by: Martin Mokrejs 
Signed-off-by: Cyril Brulebois 
Acked-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Zefan Li

fix misuses of f_count() in ppp and netlink

2015-02-02T09:04:48+00:00

commit 24dff96a37a2ca319e75a74d3929b2de22447ca6 upstream.

we used to check for "nobody else could start doing anything with
that opened file" by checking that refcount was 2 or less - one
for descriptor table and one we'd acquired in fget() on the way to
wherever we are.  That was race-prone (somebody else might have
had a reference to descriptor table and do fget() just as we'd
been checking) and it had become flat-out incorrect back when
we switched to fget_light() on those codepaths - unlike fget(),
it doesn't grab an extra reference unless the descriptor table
is shared.  The same change allowed a race-free check, though -
we are safe exactly when refcount is less than 2.

It was a long time ago; pre-2.6.12 for ioctl() (the codepath leading
to ppp one) and 2.6.17 for sendmsg() (netlink one).  OTOH,
netlink hadn't grown that check until 3.9 and ppp used to live
in drivers/net, not drivers/net/ppp until 3.1.  The bug existed
well before that, though, and the same fix used to apply in old
location of file.

Signed-off-by: Al Viro 
[lizf: Backported to 3.4: drop the change to netlink_mmap_sendmsg()]
Signed-off-by: Zefan Li

rt2800: correct BBP1_TX_POWER_CTRL mask

2015-02-02T09:04:43+00:00

commit 01f7feeaf4528bec83798316b3c811701bac5d3e upstream.

Two bits control TX power on BBP_R1 register. Correct the mask,
otherwise we clear additional bit on BBP_R1 register, what can have
unknown, possible negative effect.

Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Zefan Li

ixgbevf: Prevent RX/TX statistics getting reset to zero

2014-12-01T10:02:45+00:00

commit 936597631dd310e220544dc5c6075d924efd39b2 upstream.

The commit 4197aa7bb81877ebb06e4f2cc1b5fea2da23a7bd implements 64 bit
per ring statistics. But the driver resets the 'total_bytes' and
'total_packets' from RX and TX rings in the RX and TX interrupt
handlers to zero. This results in statistics being lost and user space
reporting RX and TX statistics as zero. This patch addresses the
issue by preventing the resetting of RX and TX ring statistics to
zero.

Signed-off-by: Narendra K 
Tested-by: Sibai Li 
Signed-off-by: Jeff Kirsher 
Signed-off-by: David S. Miller 
Cc: Weng Meiling 
Signed-off-by: Zefan Li

rtl8192ce: Fix null dereference in watchdog

2014-12-01T10:02:44+00:00

Dmitry Semyonov reported that after upgrading from 3.2.54 to
3.2.57 the rtl8192ce driver will crash when its interface is brought
up.  The oops message shows:

[ 1833.611397] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
[ 1833.611455] IP: [] rtl92ce_update_hal_rate_tbl+0x29/0x4db [rtl8192ce]
...
[ 1833.613326] Call Trace:
[ 1833.613346]  [] ? rtl92c_dm_watchdog+0xd0b/0xec9 [rtl8192c_common]
[ 1833.613391]  [] ? process_one_work+0x161/0x269
[ 1833.613425]  [] ? worker_thread+0xc2/0x145
[ 1833.613458]  [] ? manage_workers.isra.25+0x15b/0x15b
[ 1833.613496]  [] ? kthread+0x76/0x7e
[ 1833.613527]  [] ? kernel_thread_helper+0x4/0x10
[ 1833.613563]  [] ? kthread_worker_fn+0x139/0x139
[ 1833.613598]  [] ? gs_change+0x13/0x13

Disassembly of rtl92ce_update_hal_rate_tbl() shows that the 'sta'
parameter was null.  None of the changes to the rtlwifi family between
3.2.54 and 3.2.57 seem to directly cause this, and reverting commit
f78bccd79ba3 ('rtlwifi: rtl8192ce: Fix too long disable of IRQs')
doesn't fix it.

rtl92c_dm_watchdog() calls rtl92ce_update_hal_rate_tbl() via
rtl92c_dm_refresh_rate_adaptive_mask(), which does not appear in the
call trace as it was inlined.  That function has been completely
removed upstream which may explain why this crash wasn't seen there.

I'm not sure that it is sensible to completely remove
rtl92c_dm_refresh_rate_adaptive_mask() without making other
compensating changes elsewhere, so try to work around this for 3.2 by
checking for a null pointer in rtl92c_dm_refresh_rate_adaptive_mask()
and then skipping the call to rtl92ce_update_hal_rate_tbl().

References: https://bugs.debian.org/745137
References: https://bugs.debian.org/745462
Reported-by: Dmitry Semyonov 
Signed-off-by: Ben Hutchings 
Cc: Larry Finger 
Cc: Chaoming Li 
Cc: Satoshi IWAMOTO 
Signed-off-by: Zefan Li