linux-stable.git/drivers/net, branch v4.1.45

net: phy: Correctly process PHY_HALTED in phy_stop_machine()

2017-10-06T16:53:16+00:00

[ Upstream commit 7ad813f208533cebfcc32d3d7474dc1677d1b09a ]

Marc reported that he was not getting the PHY library adjust_link()
callback function to run when calling phy_stop() + phy_disconnect()
which does not indeed happen because we set the state machine to
PHY_HALTED but we don't get to run it to process this state past that
point.

Fix this with a synchronous call to phy_state_machine() in order to have
the state machine actually act on PHY_HALTED, set the PHY device's link
down, turn the network device's carrier off and finally call the
adjust_link() function.

Reported-by: Marc Gonzalez 
Fixes: a390d1f379cf ("phylib: convert state_queue work to delayed_work")
Signed-off-by: Florian Fainelli 
Signed-off-by: Marc Gonzalez 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

gianfar: Fix Tx flow control deactivation

2017-10-04T01:36:49+00:00

[ Upstream commit 5d621672bc1a1e5090c1ac5432a18c79e0e13e03 ]

The wrong register is checked for the Tx flow control bit,
it should have been maccfg1 not maccfg2.
This went unnoticed for so long probably because the impact is
hardly visible, not to mention the tangled code from adjust_link().
First, link flow control (i.e. handling of Rx/Tx link level pause frames)
is disabled by default (needs to be enabled via 'ethtool -A').
Secondly, maccfg2 always returns 0 for tx_flow_oldval (except for a few
old boards), which results in Tx flow control remaining always on
once activated.

Fixes: 45b679c9a3ccd9e34f28e6ec677b812a860eb8eb ("gianfar: Implement PAUSE frame generation support")
Signed-off-by: Claudiu Manoil 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()"

2017-10-04T01:36:49+00:00

[ Upstream commit ebc8254aeae34226d0bc8fda309fd9790d4dccfe ]

This reverts commit 7ad813f208533cebfcc32d3d7474dc1677d1b09a ("net: phy:
Correctly process PHY_HALTED in phy_stop_machine()") because it is
creating the possibility for a NULL pointer dereference.

David Daney provide the following call trace and diagram of events:

When ndo_stop() is called we call:

 phy_disconnect()
    +---> phy_stop_interrupts() implies: phydev->irq = PHY_POLL;
    +---> phy_stop_machine()
    |      +---> phy_state_machine()
    |              +----> queue_delayed_work(): Work queued.
    +--->phy_detach() implies: phydev->attached_dev = NULL;

Now at a later time the queued work does:

 phy_state_machine()
    +---->netif_carrier_off(phydev->attached_dev): Oh no! It is NULL:

 CPU 12 Unable to handle kernel paging request at virtual address
0000000000000048, epc == ffffffff80de37ec, ra == ffffffff80c7c
Oops[#1]:
CPU: 12 PID: 1502 Comm: kworker/12:1 Not tainted 4.9.43-Cavium-Octeon+ #1
Workqueue: events_power_efficient phy_state_machine
task: 80000004021ed100 task.stack: 8000000409d70000
$ 0   : 0000000000000000 ffffffff84720060 0000000000000048 0000000000000004
$ 4   : 0000000000000000 0000000000000001 0000000000000004 0000000000000000
$ 8   : 0000000000000000 0000000000000000 00000000ffff98f3 0000000000000000
$12   : 8000000409d73fe0 0000000000009c00 ffffffff846547c8 000000000000af3b
$16   : 80000004096bab68 80000004096babd0 0000000000000000 80000004096ba800
$20   : 0000000000000000 0000000000000000 ffffffff81090000 0000000000000008
$24   : 0000000000000061 ffffffff808637b0
$28   : 8000000409d70000 8000000409d73cf0 80000000271bd300 ffffffff80c7804c
Hi    : 000000000000002a
Lo    : 000000000000003f
epc   : ffffffff80de37ec netif_carrier_off+0xc/0x58
ra    : ffffffff80c7804c phy_state_machine+0x48c/0x4f8
Status: 14009ce3        KX SX UX KERNEL EXL IE
Cause : 00800008 (ExcCode 02)
BadVA : 0000000000000048
PrId  : 000d9501 (Cavium Octeon III)
Modules linked in:
Process kworker/12:1 (pid: 1502, threadinfo=8000000409d70000,
task=80000004021ed100, tls=0000000000000000)
Stack : 8000000409a54000 80000004096bab68 80000000271bd300 80000000271c1e00
        0000000000000000 ffffffff808a1708 8000000409a54000 80000000271bd300
        80000000271bd320 8000000409a54030 ffffffff80ff0f00 0000000000000001
        ffffffff81090000 ffffffff808a1ac0 8000000402182080 ffffffff84650000
        8000000402182080 ffffffff84650000 ffffffff80ff0000 8000000409a54000
        ffffffff808a1970 0000000000000000 80000004099e8000 8000000402099240
        0000000000000000 ffffffff808a8598 0000000000000000 8000000408eeeb00
        8000000409a54000 00000000810a1d00 0000000000000000 8000000409d73de8
        8000000409d73de8 0000000000000088 000000000c009c00 8000000409d73e08
        8000000409d73e08 8000000402182080 ffffffff808a84d0 8000000402182080
        ...
Call Trace:
[] netif_carrier_off+0xc/0x58
[] phy_state_machine+0x48c/0x4f8
[] process_one_work+0x158/0x368
[] worker_thread+0x150/0x4c0
[] kthread+0xc8/0xe0
[] ret_from_kernel_thread+0x14/0x1c

The original motivation for this change originated from Marc Gonzales
indicating that his network driver did not have its adjust_link callback
executing with phydev->link = 0 while he was expecting it.

PHYLIB has never made any such guarantees ever because phy_stop() merely just
tells the workqueue to move into PHY_HALTED state which will happen
asynchronously.

Reported-by: Geert Uytterhoeven 
Reported-by: David Daney 
Fixes: 7ad813f20853 ("net: phy: Correctly process PHY_HALTED in phy_stop_machine()")
Signed-off-by: Florian Fainelli 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

qlge: avoid memcpy buffer overflow

2017-10-04T01:36:49+00:00

[ Upstream commit e58f95831e7468d25eb6e41f234842ecfe6f014f ]

gcc-8.0.0 (snapshot) points out that we copy a variable-length string
into a fixed length field using memcpy() with the destination length,
and that ends up copying whatever follows the string:

    inlined from 'ql_core_dump' at drivers/net/ethernet/qlogic/qlge/qlge_dbg.c:1106:2:
drivers/net/ethernet/qlogic/qlge/qlge_dbg.c:708:2: error: 'memcpy' reading 15 bytes from a region of size 14 [-Werror=stringop-overflow=]
  memcpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1);

Changing it to use strncpy() will instead zero-pad the destination,
which seems to be the right thing to do here.

The bug is probably harmless, but it seems like a good idea to address
it in stable kernels as well, if only for the purpose of building with
gcc-8 without warnings.

Fixes: a61f80261306 ("qlge: Add ethtool register dump function.")
Signed-off-by: Arnd Bergmann 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

ath10k: fix memory leak in rx ring buffer allocation

2017-10-04T01:36:45+00:00

[ Upstream commit f35a7f91f66af528b3ee1921de16bea31d347ab0 ]

The rx ring buffers are added to a hash table if
firmware support full rx reorder. If the full rx
reorder support flag is not set before allocating
the rx ring buffers, none of the buffers are added
to the hash table.

There is a race condition between rx ring refill and
rx buffer replenish from napi poll. The interrupts are
enabled in hif start, before the rx ring is refilled during init.
We replenish buffers from napi poll due to the interrupts which
get enabled after hif start. Hence before the entire rx ring is
refilled during the init, the napi poll replenishes a few buffers
in steps of 100 buffers per attempt. During this rx ring replenish
from napi poll, the rx reorder flag has not been set due to which
the replenished buffers are not added to the hash table

Set the rx full reorder support flag before we allocate
the rx ring buffer to avoid the memory leak.

Signed-off-by: Rakesh Pillai 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin

wl1251: add a missing spin_lock_init()

2017-10-04T01:36:42+00:00

[ Upstream commit 6e9aae179f290f1a44fce7ef8e9a8e2dd68ed1e4 ]

This fixes the following kernel warning:

  [ 5668.771453] BUG: spinlock bad magic on CPU#0, kworker/u2:3/9745
  [ 5668.771850]  lock: 0xce63ef20, .magic: 00000000, .owner: /-1,
  .owner_cpu: 0
  [ 5668.772277] CPU: 0 PID: 9745 Comm: kworker/u2:3 Tainted: G        W
  4.12.0-03002-gec979a4-dirty #40
  [ 5668.772796] Hardware name: Nokia RX-51 board
  [ 5668.773071] Workqueue: phy1 wl1251_irq_work
  [ 5668.773345] [] (unwind_backtrace) from []
  (show_stack+0x10/0x14)
  [ 5668.773803] [] (show_stack) from []
  (do_raw_spin_lock+0x6c/0xa0)
  [ 5668.774230] [] (do_raw_spin_lock) from []
  (_raw_spin_lock_irqsave+0x10/0x18)
  [ 5668.774658] [] (_raw_spin_lock_irqsave) from []
  (wl1251_op_tx+0x38/0x5c)
  [ 5668.775115] [] (wl1251_op_tx) from []
  (ieee80211_tx_frags+0x188/0x1c0)
  [ 5668.775543] [] (ieee80211_tx_frags) from []
  (__ieee80211_tx+0x6c/0x130)
  [ 5668.775970] [] (__ieee80211_tx) from []
  (ieee80211_tx+0xdc/0x104)
  [ 5668.776367] [] (ieee80211_tx) from []
  (__ieee80211_subif_start_xmit+0x454/0x8c8)
  [ 5668.776824] [] (__ieee80211_subif_start_xmit) from
  [] (ieee80211_subif_start_xmit+0x30/0x2fc)
  [ 5668.777343] [] (ieee80211_subif_start_xmit) from
  [] (dev_hard_start_xmit+0x80/0x118)
  ...

by adding the missing spin_lock_init().

Reported-by: Pavel Machek 
Cc: Kalle Valo 
Signed-off-by: Cong Wang 
Acked-by: Pavel Machek 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin

p54: memset(0) whole array

2017-10-04T01:36:38+00:00

[ Upstream commit 6f17581788206444cbbcdbc107498f85e9765e3d ]

gcc 7 complains:
drivers/net/wireless/intersil/p54/fwio.c: In function 'p54_scan':
drivers/net/wireless/intersil/p54/fwio.c:491:4: warning: 'memset' used with length equal to number of elements without multiplication by element size [-Wmemset-elt-size]

Fix that by passing the correct size to memset.

Signed-off-by: Jiri Slaby 
Cc: Christian Lamparter 
Cc: Kalle Valo 
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Acked-by: Christian Lamparter 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin

usb: qmi_wwan: add D-Link DWM-222 device ID

2017-10-04T01:36:30+00:00

[ Upstream commit bed9ff165960921303a100228585f2d1691b42eb ]

Signed-off-by: Hector Martin 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

tg3: Fix race condition in tg3_get_stats64().

2017-09-10T20:36:05+00:00

[ Upstream commit f5992b72ebe0dde488fa8f706b887194020c66fc ]

The driver's ndo_get_stats64() method is not always called under RTNL.
So it can race with driver close or ethtool reconfigurations.  Fix the
race condition by taking tp->lock spinlock in tg3_free_consistent()
when freeing the tp->hw_stats memory block.  tg3_get_stats64() is
already taking tp->lock.

Reported-by: Wang Yufen 
Signed-off-by: Michael Chan 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

sh_eth: R8A7740 supports packet shecksumming

2017-09-10T20:36:05+00:00

[ Upstream commit 0f1f9cbc04dbb3cc310f70a11cba0cf1f2109d9c ]

The R8A7740 GEther controller supports the packet checksum offloading
but the 'hw_crc' (bad name, I'll fix it) flag isn't set in the R8A7740
data,  thus CSMR isn't cleared...

Fixes: 73a0d907301e ("net: sh_eth: add support R8A7740")
Signed-off-by: Sergei Shtylyov 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin