linux-stable.git/drivers/net, branch v4.15.4

rocker: fix possible null pointer dereference in rocker_router_fib_event_work

2018-02-12T06:07:20+00:00

[ Upstream commit a83165f00f16c0e0ef5b7cec3cbd0d4788699265 ]

Currently, rocker user may experience following null pointer
derefence bug:

[    3.062141] BUG: unable to handle kernel NULL pointer dereference at 00000000000000d0
[    3.065163] IP: rocker_router_fib_event_work+0x36/0x110 [rocker]

The problem is uninitialized rocker->wops pointer that is initialized
only with the first initialized port. So move the port initialization
before registering the fib events.

Fixes: 936bd486564a ("rocker: use FIB notifications instead of switchdev calls")
Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

r8169: fix RTL8168EP take too long to complete driver initialization.

2018-02-12T06:07:19+00:00

[ Upstream commit 086ca23d03c0d2f4088f472386778d293e15c5f6 ]

Driver check the wrong register bit in rtl_ocp_tx_cond() that keep driver
waiting until timeout.

Fix this by waiting for the right register bit.

Signed-off-by: Chunhao Lin 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

qmi_wwan: Add support for Quectel EP06

2018-02-12T06:07:19+00:00

[ Upstream commit c0b91a56a2e57a5a370655b25d677ae0ebf8a2d0 ]

The Quectel EP06 is a Cat. 6 LTE modem. It uses the same interface as
the EC20/EC25 for QMI, and requires the same "set DTR"-quirk to work.

Signed-off-by: Kristian Evensen 
Acked-by: Bjørn Mork 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

qlcnic: fix deadlock bug

2018-02-12T06:07:19+00:00

[ Upstream commit 233ac3891607f501f08879134d623b303838f478 ]

The following soft lockup was caught. This is a deadlock caused by
recusive locking.

Process kworker/u40:1:28016 was holding spin lock "mbx->queue_lock" in
qlcnic_83xx_mailbox_worker(), while a softirq came in and ask the same spin
lock in qlcnic_83xx_enqueue_mbx_cmd(). This lock should be hold by disable
bh..

[161846.962125] NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [kworker/u40:1:28016]
[161846.962367] Modules linked in: tun ocfs2 xen_netback xen_blkback xen_gntalloc xen_gntdev xen_evtchn xenfs xen_privcmd autofs4 ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs bnx2fc fcoe libfcoe libfc sunrpc 8021q mrp garp bridge stp llc bonding dm_round_robin dm_multipath iTCO_wdt iTCO_vendor_support pcspkr sb_edac edac_core i2c_i801 shpchp lpc_ich mfd_core ioatdma ipmi_devintf ipmi_si ipmi_msghandler sg ext4 jbd2 mbcache2 sr_mod cdrom sd_mod igb i2c_algo_bit i2c_core ahci libahci megaraid_sas ixgbe dca ptp pps_core vxlan udp_tunnel ip6_udp_tunnel qla2xxx scsi_transport_fc qlcnic crc32c_intel be2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi dm_mirror dm_region_hash dm_log dm_mod
[161846.962454]
[161846.962460] CPU: 1 PID: 28016 Comm: kworker/u40:1 Not tainted 4.1.12-94.5.9.el6uek.x86_64 #2
[161846.962463] Hardware name: Oracle Corporation SUN SERVER X4-2L      /ASSY,MB,X4-2L         , BIOS 26050100 09/19/2017
[161846.962489] Workqueue: qlcnic_mailbox qlcnic_83xx_mailbox_worker [qlcnic]
[161846.962493] task: ffff8801f2e34600 ti: ffff88004ca5c000 task.ti: ffff88004ca5c000
[161846.962496] RIP: e030:[]  [] xen_hypercall_sched_op+0xa/0x20
[161846.962506] RSP: e02b:ffff880202e43388  EFLAGS: 00000206
[161846.962509] RAX: 0000000000000000 RBX: ffff8801f6996b70 RCX: ffffffff810013aa
[161846.962511] RDX: ffff880202e433cc RSI: ffff880202e433b0 RDI: 0000000000000003
[161846.962513] RBP: ffff880202e433d0 R08: 0000000000000000 R09: ffff8801fe893200
[161846.962516] R10: ffff8801fe400538 R11: 0000000000000206 R12: ffff880202e4b000
[161846.962518] R13: 0000000000000050 R14: 0000000000000001 R15: 000000000000020d
[161846.962528] FS:  0000000000000000(0000) GS:ffff880202e40000(0000) knlGS:ffff880202e40000
[161846.962531] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[161846.962533] CR2: 0000000002612640 CR3: 00000001bb796000 CR4: 0000000000042660
[161846.962536] Stack:
[161846.962538]  ffff880202e43608 0000000000000000 ffffffff813f0442 ffff880202e433b0
[161846.962543]  0000000000000000 ffff880202e433cc ffffffff00000001 0000000000000000
[161846.962547]  00000009813f03d6 ffff880202e433e0 ffffffff813f0460 ffff880202e43440
[161846.962552] Call Trace:
[161846.962555]  
[161846.962565]  [] ? xen_poll_irq_timeout+0x42/0x50
[161846.962570]  [] xen_poll_irq+0x10/0x20
[161846.962578]  [] xen_lock_spinning+0xe2/0x110
[161846.962583]  [] __raw_callee_save_xen_lock_spinning+0x11/0x20
[161846.962592]  [] ? _raw_spin_lock+0x57/0x80
[161846.962609]  [] qlcnic_83xx_enqueue_mbx_cmd+0x7c/0xe0 [qlcnic]
[161846.962623]  [] qlcnic_83xx_issue_cmd+0x58/0x210 [qlcnic]
[161846.962636]  [] qlcnic_83xx_sre_macaddr_change+0x162/0x1d0 [qlcnic]
[161846.962649]  [] qlcnic_83xx_change_l2_filter+0x2b/0x30 [qlcnic]
[161846.962657]  [] ? __skb_flow_dissect+0x18b/0x650
[161846.962670]  [] qlcnic_send_filter+0x205/0x250 [qlcnic]
[161846.962682]  [] qlcnic_xmit_frame+0x547/0x7b0 [qlcnic]
[161846.962691]  [] xmit_one+0x82/0x1a0
[161846.962696]  [] dev_hard_start_xmit+0x50/0xa0
[161846.962701]  [] sch_direct_xmit+0x112/0x220
[161846.962706]  [] __dev_queue_xmit+0x1df/0x5e0
[161846.962710]  [] dev_queue_xmit_sk+0x13/0x20
[161846.962721]  [] bond_dev_queue_xmit+0x35/0x80 [bonding]
[161846.962729]  [] __bond_start_xmit+0x1cb/0x210 [bonding]
[161846.962736]  [] bond_start_xmit+0x31/0x60 [bonding]
[161846.962740]  [] xmit_one+0x82/0x1a0
[161846.962745]  [] dev_hard_start_xmit+0x50/0xa0
[161846.962749]  [] __dev_queue_xmit+0x4ee/0x5e0
[161846.962754]  [] dev_queue_xmit_sk+0x13/0x20
[161846.962760]  [] vlan_dev_hard_start_xmit+0xb2/0x150 [8021q]
[161846.962764]  [] xmit_one+0x82/0x1a0
[161846.962769]  [] dev_hard_start_xmit+0x50/0xa0
[161846.962773]  [] __dev_queue_xmit+0x4ee/0x5e0
[161846.962777]  [] dev_queue_xmit_sk+0x13/0x20
[161846.962789]  [] br_dev_queue_push_xmit+0x54/0xa0 [bridge]
[161846.962797]  [] br_forward_finish+0x2f/0x90 [bridge]
[161846.962807]  [] ? ttwu_do_wakeup+0x1d/0x100
[161846.962811]  [] ? __alloc_skb+0x8b/0x1f0
[161846.962818]  [] __br_forward+0x8d/0x120 [bridge]
[161846.962822]  [] ? __kmalloc_reserve+0x3b/0xa0
[161846.962829]  [] ? update_rq_runnable_avg+0xee/0x230
[161846.962836]  [] br_forward+0x96/0xb0 [bridge]
[161846.962845]  [] br_handle_frame_finish+0x1ae/0x420 [bridge]
[161846.962853]  [] br_handle_frame+0x17f/0x260 [bridge]
[161846.962862]  [] ? br_handle_frame_finish+0x420/0x420 [bridge]
[161846.962867]  [] __netif_receive_skb_core+0x1f7/0x870
[161846.962872]  [] __netif_receive_skb+0x22/0x70
[161846.962877]  [] netif_receive_skb_internal+0x23/0x90
[161846.962884]  [] ? xenvif_idx_release+0xea/0x100 [xen_netback]
[161846.962889]  [] ? _raw_spin_unlock_irqrestore+0x20/0x50
[161846.962893]  [] netif_receive_skb_sk+0x24/0x90
[161846.962899]  [] xenvif_tx_submit+0x2ca/0x3f0 [xen_netback]
[161846.962906]  [] xenvif_tx_action+0x9c/0xd0 [xen_netback]
[161846.962915]  [] xenvif_poll+0x35/0x70 [xen_netback]
[161846.962920]  [] napi_poll+0xcb/0x1e0
[161846.962925]  [] net_rx_action+0x90/0x1c0
[161846.962931]  [] __do_softirq+0x10a/0x350
[161846.962938]  [] irq_exit+0x125/0x130
[161846.962943]  [] xen_evtchn_do_upcall+0x39/0x50
[161846.962950]  [] xen_do_hypervisor_callback+0x1e/0x40
[161846.962952]  
[161846.962959]  [] ? _raw_spin_lock+0x4a/0x80
[161846.962964]  [] ? _raw_spin_lock_irqsave+0x1e/0xa0
[161846.962978]  [] ? qlcnic_83xx_mailbox_worker+0xb9/0x2a0 [qlcnic]
[161846.962991]  [] ? process_one_work+0x151/0x4b0
[161846.962995]  [] ? check_events+0x12/0x20
[161846.963001]  [] ? worker_thread+0x120/0x480
[161846.963005]  [] ? __schedule+0x30b/0x890
[161846.963010]  [] ? process_one_work+0x4b0/0x4b0
[161846.963015]  [] ? process_one_work+0x4b0/0x4b0
[161846.963021]  [] ? kthread+0xce/0xf0
[161846.963025]  [] ? kthread_freezable_should_stop+0x70/0x70
[161846.963031]  [] ? ret_from_fork+0x42/0x70
[161846.963035]  [] ? kthread_freezable_should_stop+0x70/0x70
[161846.963037] Code: cc 51 41 53 b8 1c 00 00 00 0f 05 41 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 51 41 53 b8 1d 00 00 00 0f 05 <41> 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc

Signed-off-by: Junxiao Bi 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

igb: Free IRQs when device is hotplugged

2018-02-03T16:58:35+00:00

commit 888f22931478a05bc81ceb7295c626e1292bf0ed upstream.

Recently I got a Caldigit TS3 Thunderbolt 3 dock, and noticed that upon
hotplugging my kernel would immediately crash due to igb:

[  680.825801] kernel BUG at drivers/pci/msi.c:352!
[  680.828388] invalid opcode: 0000 [#1] SMP
[  680.829194] Modules linked in: igb(O) thunderbolt i2c_algo_bit joydev vfat fat btusb btrtl btbcm btintel bluetooth ecdh_generic hp_wmi sparse_keymap rfkill wmi_bmof iTCO_wdt intel_rapl x86_pkg_temp_thermal coretemp crc32_pclmul snd_pcm rtsx_pci_ms mei_me snd_timer memstick snd pcspkr mei soundcore i2c_i801 tpm_tis psmouse shpchp wmi tpm_tis_core tpm video hp_wireless acpi_pad rtsx_pci_sdmmc mmc_core crc32c_intel serio_raw rtsx_pci mfd_core xhci_pci xhci_hcd i2c_hid i2c_core [last unloaded: igb]
[  680.831085] CPU: 1 PID: 78 Comm: kworker/u16:1 Tainted: G           O     4.15.0-rc3Lyude-Test+ #6
[  680.831596] Hardware name: HP HP ZBook Studio G4/826B, BIOS P71 Ver. 01.03 06/09/2017
[  680.832168] Workqueue: kacpi_hotplug acpi_hotplug_work_fn
[  680.832687] RIP: 0010:free_msi_irqs+0x180/0x1b0
[  680.833271] RSP: 0018:ffffc9000030fbf0 EFLAGS: 00010286
[  680.833761] RAX: ffff8803405f9c00 RBX: ffff88033e3d2e40 RCX: 000000000000002c
[  680.834278] RDX: 0000000000000000 RSI: 00000000000000ac RDI: ffff880340be2178
[  680.834832] RBP: 0000000000000000 R08: ffff880340be1ff0 R09: ffff8803405f9c00
[  680.835342] R10: 0000000000000000 R11: 0000000000000040 R12: ffff88033d63a298
[  680.835822] R13: ffff88033d63a000 R14: 0000000000000060 R15: ffff880341959000
[  680.836332] FS:  0000000000000000(0000) GS:ffff88034f440000(0000) knlGS:0000000000000000
[  680.836817] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  680.837360] CR2: 000055e64044afdf CR3: 0000000001c09002 CR4: 00000000003606e0
[  680.837954] Call Trace:
[  680.838853]  pci_disable_msix+0xce/0xf0
[  680.839616]  igb_reset_interrupt_capability+0x5d/0x60 [igb]
[  680.840278]  igb_remove+0x9d/0x110 [igb]
[  680.840764]  pci_device_remove+0x36/0xb0
[  680.841279]  device_release_driver_internal+0x157/0x220
[  680.841739]  pci_stop_bus_device+0x7d/0xa0
[  680.842255]  pci_stop_bus_device+0x2b/0xa0
[  680.842722]  pci_stop_bus_device+0x3d/0xa0
[  680.843189]  pci_stop_and_remove_bus_device+0xe/0x20
[  680.843627]  trim_stale_devices+0xf3/0x140
[  680.844086]  trim_stale_devices+0x94/0x140
[  680.844532]  trim_stale_devices+0xa6/0x140
[  680.845031]  ? get_slot_status+0x90/0xc0
[  680.845536]  acpiphp_check_bridge.part.5+0xfe/0x140
[  680.846021]  acpiphp_hotplug_notify+0x175/0x200
[  680.846581]  ? free_bridge+0x100/0x100
[  680.847113]  acpi_device_hotplug+0x8a/0x490
[  680.847535]  acpi_hotplug_work_fn+0x1a/0x30
[  680.848076]  process_one_work+0x182/0x3a0
[  680.848543]  worker_thread+0x2e/0x380
[  680.848963]  ? process_one_work+0x3a0/0x3a0
[  680.849373]  kthread+0x111/0x130
[  680.849776]  ? kthread_create_worker_on_cpu+0x50/0x50
[  680.850188]  ret_from_fork+0x1f/0x30
[  680.850601] Code: 43 14 85 c0 0f 84 d5 fe ff ff 31 ed eb 0f 83 c5 01 39 6b 14 0f 86 c5 fe ff ff 8b 7b 10 01 ef e8 b7 e4 d2 ff 48 83 78 70 00 74 e3 <0f> 0b 49 8d b5 a0 00 00 00 e8 62 6f d3 ff e9 c7 fe ff ff 48 8b
[  680.851497] RIP: free_msi_irqs+0x180/0x1b0 RSP: ffffc9000030fbf0

As it turns out, normally the freeing of IRQs that would fix this is called
inside of the scope of __igb_close(). However, since the device is
already gone by the point we try to unregister the netdevice from the
driver due to a hotplug we end up seeing that the netif isn't present
and thus, forget to free any of the device IRQs.

So: make sure that if we're in the process of dismantling the netdev, we
always allow __igb_close() to be called so that IRQs may be freed
normally. Additionally, only allow igb_close() to be called from
__igb_close() if it hasn't already been called for the given adapter.

Signed-off-by: Lyude Paul 
Fixes: 9474933caf21 ("igb: close/suspend race in netif_device_detach")
Cc: Todd Fujinaka 
Cc: Stephen Hemminger 
Tested-by: Aaron Brown 
Signed-off-by: Jeff Kirsher 
Signed-off-by: Greg Kroah-Hartman

net: vrf: Add support for sends to local broadcast address

2018-01-26T02:51:03+00:00

Sukumar reported that sends to the local broadcast address
(255.255.255.255) are broken. Check for the address in vrf driver
and do not redirect to the VRF device - similar to multicast
packets.

With this change sockets can use SO_BINDTODEVICE to specify an
egress interface and receive responses. Note: the egress interface
can not be a VRF device but needs to be the enslaved device.

https://bugzilla.kernel.org/show_bug.cgi?id=198521

Reported-by: Sukumar Gopalakrishnan 
Signed-off-by: David Ahern 
Signed-off-by: David S. Miller

r8169: fix memory corruption on retrieval of hardware statistics.

2018-01-26T02:34:04+00:00

Hardware statistics retrieval hurts in tight invocation loops.

Avoid extraneous write and enforce strict ordering of writes targeted to
the tally counters dump area address registers.

Signed-off-by: Francois Romieu 
Tested-by: Oliver Freyermuth 
Signed-off-by: David S. Miller

net: don't call update_pmtu unconditionally

2018-01-25T21:27:34+00:00

Some dst_ops (e.g. md_dst_ops)) doesn't set this handler. It may result to:
"BUG: unable to handle kernel NULL pointer dereference at           (null)"

Let's add a helper to check if update_pmtu is available before calling it.

Fixes: 52a589d51f10 ("geneve: update skb dst pmtu on tx path")
Fixes: a93bf0ff4490 ("vxlan: update skb dst pmtu on tx path")
CC: Roman Kapl 
CC: Xin Long 
Signed-off-by: Nicolas Dichtel 
Signed-off-by: David S. Miller

net/ibm/emac: wrong bit is used for STA control register write

2018-01-24T23:10:57+00:00

STA control register has areas of mode and opcodes for opeations. 18 bit is
using for mode selection, where 0 is old MIO/MDIO access method and 1 is
indirect access mode. 19-20 bits are using for setting up read/write
operation(STA opcodes). In current state 'read' is set into old MIO/MDIO mode
with 19 bit and write operation is set into 18 bit which is mode selection,
not a write operation. To correlate write with read we set it into 20 bit.
All those bit operations are MSB 0 based.

Signed-off-by: Ivan Mikhaylov 
Signed-off-by: David S. Miller

net/ibm/emac: add 8192 rx/tx fifo size

2018-01-24T23:10:57+00:00

emac4syn chips has availability to use 8192 rx/tx fifo buffer sizes,
in current state if we set it up in dts 8192 as example, we will get
only 2048 which may impact on network speed.

Signed-off-by: Ivan Mikhaylov 
Signed-off-by: David S. Miller