linux-stable.git/drivers/net, branch v4.4.1

team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid

2016-01-31T19:29:01+00:00

[ Upstream commit 60a6531bfe49555581ccd65f66a350cc5693fcde ]

We can't be within an RCU read-side critical section when deleting
VLANs, as underlying drivers might sleep during the hardware operation.
Therefore, replace the RCU critical section with a mutex. This is
consistent with team_vlan_rx_add_vid.

Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
Acked-by: Jiri Pirko 
Signed-off-by: Ido Schimmel 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net/mlx5_core: Fix trimming down IRQ number

2016-01-31T19:29:01+00:00

[ Upstream commit 0b6e26ce89391327d955a756a7823272238eb867 ]

With several ConnectX-4 cards installed on a server, one may receive
irqn > 255 from the kernel API, which we mistakenly trim to 8bit.

This causes EQ creation failure with the following stack trace:
[] dump_stack+0x48/0x64
[] __setup_irq+0x3a1/0x4f0
[] request_threaded_irq+0x120/0x180
[] ? mlx5_eq_int+0x450/0x450 [mlx5_core]
[] mlx5_create_map_eq+0x1e4/0x2b0 [mlx5_core]
[] alloc_comp_eqs+0xb1/0x180 [mlx5_core]
[] mlx5_dev_init+0x5e9/0x6e0 [mlx5_core]
[] init_one+0x99/0x1c0 [mlx5_core]
[] local_pci_probe+0x4c/0xa0

Fixing it by changing of the irqn type from u8 to unsigned int to
support values > 255

Fixes: 61d0e73e0a5a ('net/mlx5_core: Use the the real irqn in eq->irqn')
Reported-by: Jiri Pirko 
Signed-off-by: Doron Tsur 
Signed-off-by: Matan Barak 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

dwc_eth_qos: Fix dma address for multi-fragment skbs

2016-01-31T19:29:00+00:00

[ Upstream commit d461873272169a3fc3a8d155d7b1c92e9d97b419 ]

The offset inside the fragment was not used for the dma address and
silent data corruption resulted because TSO makes the checksum match.

Fixes: 077742dac2c7 ("dwc_eth_qos: Add support for Synopsys DWC Ethernet QoS")
Signed-off-by: Lars Persson 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bonding: Prevent IPv6 link local address on enslaved devices

2016-01-31T19:29:00+00:00

[ Upstream commit 03d84a5f83a67e692af00a3d3901e7820e3e84d5 ]

Commit 1f718f0f4f97 ("bonding: populate neighbour's private on enslave")
undoes the fix provided by commit c2edacf80e15 ("bonding / ipv6: no addrconf
for slaves separately from master") by effectively setting the slave flag
after the slave has been opened.  If the slave comes up quickly enough, it
will go through the IPv6 addrconf before the slave flag has been set and
will get a link local IPv6 address.

In order to ensure that addrconf knows to ignore the slave devices on state
change, set IFF_SLAVE before dev_open() during bonding enslavement.

Fixes: 1f718f0f4f97 ("bonding: populate neighbour's private on enslave")
Signed-off-by: Karl Heiss 
Signed-off-by: Jay Vosburgh 
Reviewed-by: Jarod Wilson 
Signed-off-by: Andy Gospodarek 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

vxlan: fix test which detect duplicate vxlan iface

2016-01-31T19:28:59+00:00

[ Upstream commit 07b9b37c227cb8d88d478b4a9c5634fee514ede1 ]

When a vxlan interface is created, the driver checks that there is not
another vxlan interface with the same properties. To do this, it checks
the existing vxlan udp socket. Since commit 1c51a9159dde, the creation of
the vxlan socket is done only when the interface is set up, thus it breaks
that test.

Example:
$ ip l a vxlan10 type vxlan id 10 group 239.0.0.10 dev eth0 dstport 0
$ ip l a vxlan11 type vxlan id 10 group 239.0.0.10 dev eth0 dstport 0
$ ip -br l | grep vxlan
vxlan10          DOWN           f2:55:1c:6a:fb:00 
vxlan11          DOWN           7a:cb:b9:38:59:0d 

Instead of checking sockets, let's loop over the vxlan iface list.

Fixes: 1c51a9159dde ("vxlan: fix race caused by dropping rtnl_unlock")
Reported-by: Thomas Faivre 
Signed-off-by: Nicolas Dichtel 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

rtlwifi: fix memory leak for USB device

2016-01-31T19:28:58+00:00

commit 17bc55864f81dd730d05f09b1641312a7990d636 upstream.

Free skb for received frames with a wrong checksum. This can happen
pretty rapidly, exhausting all memory.

This fixes a memleak (detected with kmemleak). Originally found while
using monitor mode, but it also appears during managed mode (once the
link is up).

Signed-off-by: Peter Wu 
ACKed-by: Larry Finger 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

Driver: Vmxnet3: Fix regression caused by 5738a09

2016-01-06T21:20:13+00:00

Reported-by: Bingkuo Liu 
Signed-off-by: Shrikrishna Khare 
Signed-off-by: David S. Miller

net: qmi_wwan: Add WeTelecom-WPD600N

2016-01-06T20:50:00+00:00

The WeTelecom-WPD600N is an LTE module that, in addition to supporting most
"normal" bands, also supports LTE over 450MHz. Manual testing showed that
only interface number three replies to QMI messages.

Cc: Bjørn Mork 
Signed-off-by: Kristian Evensen 
Acked-by: Bjørn Mork 
Signed-off-by: David S. Miller

mkiss: fix scribble on freed memory

2016-01-06T20:06:27+00:00

commit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable
scribble on free memory but added a new one which allows the user to
scribble even more and user controlled data into freed space.

As with 6pack we need to halt the queue before we free the buffers, because
the transmit logic is not protected by the semaphore.

Signed-off-by: Alan Cox 
Signed-off-by: David S. Miller

6pack: fix free memory scribbles

2016-01-06T06:25:01+00:00

commit acf673a3187edf72068ee2f92f4dc47d66baed47 fixed a user triggerable free
memory scribble but in doing so replaced it with a different one that allows
the user to control the data and scribble even more.

sixpack_close is called by the tty layer in tty context. The tty context is
protected by sp_get() and sp_put(). However network layer activity via
sp_xmit() is not protected this way. We must therefore stop the queue
otherwise the user gets to dump a buffer mostly of their choice into freed
kernel pages.

Signed-off-by: Alan Cox 
Signed-off-by: David S. Miller