linux-stable.git/drivers/net, branch v4.9.25

ath9k: fix NULL pointer dereference

2017-04-21T07:31:23+00:00

commit 40bea976c72b9ee60f8d097852deb53ccbeaffbe upstream.

relay_open() may return NULL, check the return value to avoid the crash.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
IP: [] ath_cmn_process_fft+0xd5/0x700 [ath9k_common]
PGD 41cf28067 PUD 41be92067 PMD 0
Oops: 0000 [#1] SMP
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.8.6+ #35
Hardware name: Hewlett-Packard h8-1080t/2A86, BIOS 6.15    07/04/2011
task: ffffffff81e0c4c0 task.stack: ffffffff81e00000
RIP: 0010:[] [] ath_cmn_process_fft+0xd5/0x700 [ath9k_common]
RSP: 0018:ffff88041f203ca0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 000000000000059f RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffffffff81f0ca98
RBP: ffff88041f203dc8 R08: ffffffffffffffff R09: 00000000000000ff
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff81f0ca98 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88041f200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000040 CR3: 000000041b6ec000 CR4: 00000000000006f0
Stack:
0000000000000363 00000000000003f3 00000000000003f3 00000000000001f9
000000000000049a 0000000001252c04 ffff88041f203e44 ffff880417b4bfd0
0000000000000008 ffff88041785b9c0 0000000000000002 ffff88041613dc60

Call Trace:

[] ath9k_tasklet+0x1b1/0x220 [ath9k]
[] tasklet_action+0x4d/0xf0
[] __do_softirq+0x92/0x2a0

Reported-by: Devin Tuchsen 
Tested-by: Devin Tuchsen 
Signed-off-by: Miaoqing Pan 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

can: ifi: use correct register to read rx status

2017-04-21T07:31:22+00:00

commit 57c1d4c33e8f7ec90976d79127059c1919cc0651 upstream.

The incorrect offset was used when trying to read the RXSTCMD register.

Signed-off-by: Markus Marb 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman

net/mlx4_core: Fix when to save some qp context flags for dynamic VST to VGT transitions

2017-04-18T05:11:50+00:00

commit 7c3945bc2073554bb2ecf983e073dee686679c53 upstream.

Save the qp context flags byte containing the flag disabling vlan stripping
in the RESET to INIT qp transition, rather than in the INIT to RTR
transition. Per the firmware spec, the flags in this byte are active
in the RESET to INIT transition.

As a result of saving the flags in the incorrect qp transition, when
switching dynamically from VGT to VST and back to VGT, the vlan
remained stripped (as is required for VST) and did not return to
not-stripped (as is required for VGT).

Fixes: f0f829bf42cd ("net/mlx4_core: Add immediate activate for VGT->VST->VGT")
Signed-off-by: Jack Morgenstein 
Signed-off-by: Tariq Toukan 
Signed-off-by: David S. Miller 
Signed-off-by: Sumit Semwal 
Signed-off-by: Greg Kroah-Hartman

net/mlx4_core: Fix racy CQ (Completion Queue) free

2017-04-18T05:11:50+00:00

commit 291c566a28910614ce42d0ffe82196eddd6346f4 upstream.

In function mlx4_cq_completion() and mlx4_cq_event(), the
radix_tree_lookup requires a rcu_read_lock.
This is mandatory: if another core frees the CQ, it could
run the radix_tree_node_rcu_free() call_rcu() callback while
its being used by the radix tree lookup function.

Additionally, in function mlx4_cq_event(), since we are adding
the rcu lock around the radix-tree lookup, we no longer need to take
the spinlock. Also, the synchronize_irq() call for the async event
eliminates the need for incrementing the cq reference count in
mlx4_cq_event().

Other changes:
1. In function mlx4_cq_free(), replace spin_lock_irq with spin_lock:
   we no longer take this spinlock in the interrupt context.
   The spinlock here, therefore, simply protects against different
   threads simultaneously invoking mlx4_cq_free() for different cq's.

2. In function mlx4_cq_free(), we move the radix tree delete to before
   the synchronize_irq() calls. This guarantees that we will not
   access this cq during any subsequent interrupts, and therefore can
   safely free the CQ after the synchronize_irq calls. The rcu_read_lock
   in the interrupt handlers only needs to protect against corrupting the
   radix tree; the interrupt handlers may access the cq outside the
   rcu_read_lock due to the synchronize_irq calls which protect against
   premature freeing of the cq.

3. In function mlx4_cq_event(), we change the mlx_warn message to mlx4_dbg.

4. We leave the cq reference count mechanism in place, because it is
   still needed for the cq completion tasklet mechanism.

Fixes: 6d90aa5cf17b ("net/mlx4_core: Make sure there are no pending async events when freeing CQ")
Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters")
Signed-off-by: Jack Morgenstein 
Signed-off-by: Matan Barak 
Signed-off-by: Tariq Toukan 
Signed-off-by: David S. Miller 
Signed-off-by: Sumit Semwal 
Signed-off-by: Greg Kroah-Hartman

net/mlx4_en: Fix bad WQE issue

2017-04-18T05:11:50+00:00

commit 6496bbf0ec481966ef9ffe5b6660d8d1b55c60cc upstream.

Single send WQE in RX buffer should be stamped with software
ownership in order to prevent the flow of QP in error in FW
once UPDATE_QP is called.

Fixes: 9f519f68cfff ('mlx4_en: Not using Shared Receive Queues')
Signed-off-by: Eugenia Emantayev 
Signed-off-by: Tariq Toukan 
Signed-off-by: David S. Miller 
Signed-off-by: Sumit Semwal 
Signed-off-by: Greg Kroah-Hartman

rt2x00: Fix incorrect usage of CONFIG_RT2X00_LIB_USB

2017-04-18T05:11:47+00:00

commit a083c8fd277b4122c804f18ec8c84165f345c71c upstream.

In device removal routine, usage of "#ifdef CONFIG_RT2X00_LIB_USB"
will not cover the case when it is configured as module. This will
omit the entire if-block which does cleanup of URBs and cancellation
of pending work. Changing the #ifdef to #if IS_ENABLED() to fix it.

Signed-off-by: Vishal Thanki 
Acked-by: Stanislaw Gruszka 
Signed-off-by: Kalle Valo 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

rt2x00usb: do not anchor rx and tx urb's

2017-04-18T05:11:47+00:00

commit 93c7018ec16bb83399dd4db61c361a6d6aba0d5a upstream.

We might kill TX or RX urb during rt2x00usb_flush_entry(), what can
cause anchor list corruption like shown below:

[ 2074.035633] WARNING: CPU: 2 PID: 14480 at lib/list_debug.c:33 __list_add+0xac/0xc0
[ 2074.035634] list_add corruption. prev->next should be next (ffff88020f362c28), but was dead000000000100. (prev=ffff8801d161bb70).

[ 2074.035670] Call Trace:
[ 2074.035672]  [] dump_stack+0x63/0x8c
[ 2074.035674]  [] __warn+0xd1/0xf0
[ 2074.035676]  [] warn_slowpath_fmt+0x5f/0x80
[ 2074.035678]  [] ? rt2x00usb_register_write_lock+0x3d/0x60 [rt2800usb]
[ 2074.035679]  [] __list_add+0xac/0xc0
[ 2074.035681]  [] usb_anchor_urb+0x4c/0xa0
[ 2074.035683]  [] rt2x00usb_kick_rx_entry+0xaf/0x100 [rt2x00usb]
[ 2074.035684]  [] rt2x00usb_clear_entry+0x22/0x30 [rt2x00usb]

To fix do not anchor TX and RX urb's, it is not needed as during
shutdown we kill those urbs in rt2x00usb_free_entries().

Cc: Vishal Thanki 
Fixes: 8b4c0009313f ("rt2x00usb: Use usb anchor to manage URB")
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: Kalle Valo 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

rt2x00usb: fix anchor initialization

2017-04-18T05:11:47+00:00

commit 0488a6121dfe6cbd44de15ea3627913b7549a1e9 upstream.

If device fail to initialize we can OOPS in rt2x00lib_remove_dev(), due
to using uninitialized usb_anchor structure:

[  855.435820] ieee80211 phy3: rt2x00usb_vendor_request: Error - Vendor Request 0x07 failed for offset 0x1000 with error -19
[  855.435826] ieee80211 phy3: rt2800_probe_rt: Error - Invalid RT chipset 0x0000, rev 0000 detected
[  855.435829] ieee80211 phy3: rt2x00lib_probe_dev: Error - Failed to allocate device
[  855.435845] BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
[  855.435900] IP: _raw_spin_lock_irq+0xd/0x30
[  855.435926] PGD 0
[  855.435953] Oops: 0002 [#1] SMP

[  855.437011] Call Trace:
[  855.437029]  ? usb_kill_anchored_urbs+0x27/0xc0
[  855.437061]  rt2x00lib_remove_dev+0x190/0x1c0 [rt2x00lib]
[  855.437097]  rt2x00lib_probe_dev+0x246/0x7a0 [rt2x00lib]
[  855.437149]  ? ieee80211_roc_setup+0x9e/0xd0 [mac80211]
[  855.437183]  ? __kmalloc+0x1af/0x1f0
[  855.437207]  ? rt2x00usb_probe+0x13d/0xc50 [rt2x00usb]
[  855.437240]  rt2x00usb_probe+0x155/0xc50 [rt2x00usb]
[  855.437273]  rt2800usb_probe+0x15/0x20 [rt2800usb]
[  855.437304]  usb_probe_interface+0x159/0x2d0
[  855.437333]  driver_probe_device+0x2bb/0x460

Patch changes initialization sequence to fix the problem.

Cc: Vishal Thanki 
Fixes: 8b4c0009313f ("rt2x00usb: Use usb anchor to manage URB")
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: Kalle Valo 
Cc: Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

net/mlx4_core: Use device ID defines

2017-04-12T10:41:16+00:00

[ Upstream commit c19e4b9037fa8a0477525a64e93847f534e8cc17 ]

We added a bunch of new Mellanox device ID definitions because they'll be
used by INTx quirks.  Use them in the mlx4 ID table also so grep can find
both places.  No functional change intended.

Signed-off-by: Bjorn Helgaas 
Acked-by: Tariq Toukan 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

brcmfmac: use local iftype avoiding use-after-free of virtual interface

2017-04-12T10:41:12+00:00

commit d77facb88448cdeaaa3adba5b9704a48ac2ac8d6 upstream.

A use-after-free was found using KASAN. In brcmf_p2p_del_if() the virtual
interface is removed using call to brcmf_remove_interface(). After that
the virtual interface instance has been freed and should not be referenced.
Solve this by storing the nl80211 iftype in local variable, which is used
in a couple of places anyway.

Reported-by: Daniel J Blueman 
Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman