History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller: 1) Use after free in vlan, from Cong Wang. 2) Handle NAPI poll with a zero budget properly in mlx5 driver, from Saeed Mahameed. 3) If DMA mapping fails in mlx5 driver, NULL out page, from Inbar Karmy. 4) Handle overrun in RX FIFO of sun4i CAN driver, from Gerhard Bertelsmann. 5) Missing return in mdb and vlan prepare phase of DSA layer, from Vivien Didelot. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: vlan: fix a use-after-free in vlan_device_event() net: dsa: return after vlan prepare phase net: dsa: return after mdb prepare phase can: ifi: Fix transmitter delay calculation tcp: fix tcp_fastretrans_alert warning tcp: gso: avoid refcount_t warning from tcp_gso_segment() can: peak: Add support for new PCIe/M2 CAN FD interfaces can: sun4i: handle overrun in RX FIFO can: c_can: don't indicate triple sampling support for D_CAN net/mlx5e: Increase Striding RQ minimum size limit to 4 multi-packet WQEs net/mlx5e: Set page to null in case dma mapping fails net/mlx5e: Fix napi poll with zero budget net/mlx5: Cancel health poll before sending panic teardown command net/mlx5: Loop over temp list to release delay events rds: ib: Fix NULL pointer dereference in debug code

Linus Torvalds committed 9 years ago

Commit b3954562 parents ca91659 92d288215 files · +68 −34Browse files

Unified · Split

15 files
  1. drivers/net/can/c_can/c_can_pci.c +0 −1
  2. drivers/net/can/c_can/c_can_platform.c +0 −1
  3. drivers/net/can/ifi_canfd/ifi_canfd.c +3 −3
  4. drivers/net/can/peak_canfd/peak_pciefd_main.c +12 −2
  5. drivers/net/can/sun4i_can.c +10 −2
  6. drivers/net/ethernet/mellanox/mlx5/core/dev.c +1 −1
  7. drivers/net/ethernet/mellanox/mlx5/core/en.h +1 −1
  8. drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +5 −7
  9. drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c +6 −4
  10. drivers/net/ethernet/mellanox/mlx5/core/main.c +7 −0
  11. net/8021q/vlan.c +3 −3
  12. net/dsa/switch.c +4 −0
  13. net/ipv4/tcp_input.c +1 −2
  14. net/ipv4/tcp_offload.c +10 −2
  15. net/rds/ib_recv.c +5 −5
drivers/net/can/c_can/c_can_pci.c+0−1
@@ -178,7 +178,6 @@ static int c_can_pci_probe(struct pci_dev *pdev, · 177 unmodified lines
178178 break;
179179 case BOSCH_D_CAN:
180180 priv->regs = reg_map_d_can;
181− priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
182181 break;
183182 default:
184183 ret = -EINVAL;
drivers/net/can/c_can/c_can_platform.c+0−1
@@ -320,7 +320,6 @@ static int c_can_plat_probe(struct platform_device *pdev) · 319 unmodified lines
320320 break;
321321 case BOSCH_D_CAN:
322322 priv->regs = reg_map_d_can;
323− priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
324323 priv->read_reg = c_can_plat_read_reg_aligned_to_16bit;
325324 priv->write_reg = c_can_plat_write_reg_aligned_to_16bit;
326325 priv->read_reg32 = d_can_plat_read_reg32;
drivers/net/can/ifi_canfd/ifi_canfd.c+3−3
@@ -670,9 +670,9 @@ static void ifi_canfd_set_bittiming(struct net_device *ndev) · 669 unmodified lines
670670 priv->base + IFI_CANFD_FTIME);
671671
672672 /* Configure transmitter delay */
673− tdc = (dbt->brp * (dbt->phase_seg1 + 1)) & IFI_CANFD_TDELAY_MASK;
674− writel(IFI_CANFD_TDELAY_EN | IFI_CANFD_TDELAY_ABS | tdc,
675− priv->base + IFI_CANFD_TDELAY);
673+ tdc = dbt->brp * (dbt->prop_seg + dbt->phase_seg1);
674+ tdc &= IFI_CANFD_TDELAY_MASK;
675+ writel(IFI_CANFD_TDELAY_EN | tdc, priv->base + IFI_CANFD_TDELAY);
676676 }
677677
678678 static void ifi_canfd_set_filter(struct net_device *ndev, const u32 id,
drivers/net/can/peak_canfd/peak_pciefd_main.c+12−2
@@ -29,14 +29,19 @@ · 28 unmodified lines
2929 #include "peak_canfd_user.h"
3030
3131 MODULE_AUTHOR("Stephane Grosjean <s.grosjean@peak-system.com>");
32−MODULE_DESCRIPTION("Socket-CAN driver for PEAK PCAN PCIe FD family cards");
33−MODULE_SUPPORTED_DEVICE("PEAK PCAN PCIe FD CAN cards");
32+MODULE_DESCRIPTION("Socket-CAN driver for PEAK PCAN PCIe/M.2 FD family cards");
33+MODULE_SUPPORTED_DEVICE("PEAK PCAN PCIe/M.2 FD CAN cards");
3434 MODULE_LICENSE("GPL v2");
3535
3636 #define PCIEFD_DRV_NAME "peak_pciefd"
3737
3838 #define PEAK_PCI_VENDOR_ID 0x001c /* The PCI device and vendor IDs */
3939 #define PEAK_PCIEFD_ID 0x0013 /* for PCIe slot cards */
40+#define PCAN_CPCIEFD_ID 0x0014 /* for Compact-PCI Serial slot cards */
41+#define PCAN_PCIE104FD_ID 0x0017 /* for PCIe-104 Express slot cards */
42+#define PCAN_MINIPCIEFD_ID 0x0018 /* for mini-PCIe slot cards */
43+#define PCAN_PCIEFD_OEM_ID 0x0019 /* for PCIe slot OEM cards */
44+#define PCAN_M2_ID 0x001a /* for M2 slot cards */
4045
4146 /* PEAK PCIe board access description */
4247 #define PCIEFD_BAR0_SIZE (64 * 1024)
@@ -203,6 +208,11 @@ struct pciefd_board { · 160 unmodified lines
203208 /* supported device ids. */
204209 static const struct pci_device_id peak_pciefd_tbl[] = {
205210 {PEAK_PCI_VENDOR_ID, PEAK_PCIEFD_ID, PCI_ANY_ID, PCI_ANY_ID,},
211+ {PEAK_PCI_VENDOR_ID, PCAN_CPCIEFD_ID, PCI_ANY_ID, PCI_ANY_ID,},
212+ {PEAK_PCI_VENDOR_ID, PCAN_PCIE104FD_ID, PCI_ANY_ID, PCI_ANY_ID,},
213+ {PEAK_PCI_VENDOR_ID, PCAN_MINIPCIEFD_ID, PCI_ANY_ID, PCI_ANY_ID,},
214+ {PEAK_PCI_VENDOR_ID, PCAN_PCIEFD_OEM_ID, PCI_ANY_ID, PCI_ANY_ID,},
215+ {PEAK_PCI_VENDOR_ID, PCAN_M2_ID, PCI_ANY_ID, PCI_ANY_ID,},
206216 {0,}
207217 };
208218
drivers/net/can/sun4i_can.c+10−2
@@ -539,6 +539,13 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) · 538 unmodified lines
539539 }
540540 stats->rx_over_errors++;
541541 stats->rx_errors++;
542+
543+ /* reset the CAN IP by entering reset mode
544+ * ignoring timeout error
545+ */
546+ set_reset_mode(dev);
547+ set_normal_mode(dev);
548+
542549 /* clear bit */
543550 sun4i_can_write_cmdreg(priv, SUN4I_CMD_CLEAR_OR_FLAG);
544551 }
@@ -653,8 +660,9 @@ static irqreturn_t sun4i_can_interrupt(int irq, void *dev_id) · 108 unmodified lines
653660 netif_wake_queue(dev);
654661 can_led_event(dev, CAN_LED_EVENT_TX);
655662 }
656− if (isrc & SUN4I_INT_RBUF_VLD) {
657− /* receive interrupt */
663+ if ((isrc & SUN4I_INT_RBUF_VLD) &&
664+ !(isrc & SUN4I_INT_DATA_OR)) {
665+ /* receive interrupt - don't read if overrun occurred */
658666 while (status & SUN4I_STA_RBUF_RDY) {
659667 /* RX buffer is not empty */
660668 sun4i_can_rx(dev);
drivers/net/ethernet/mellanox/mlx5/core/dev.c+1−1
@@ -93,7 +93,7 @@ static void delayed_event_release(struct mlx5_device_context *dev_ctx, · 92 unmodified lines
9393 list_splice_init(&priv->waiting_events_list, &temp);
9494 if (!dev_ctx->context)
9595 goto out;
96− list_for_each_entry_safe(de, n, &priv->waiting_events_list, list)
96+ list_for_each_entry_safe(de, n, &temp, list)
9797 dev_ctx->intf->event(dev, dev_ctx->context, de->event, de->param);
9898
9999 out:
drivers/net/ethernet/mellanox/mlx5/core/en.h+1−1
@@ -67,7 +67,7 @@ · 66 unmodified lines
6767 #define MLX5E_PARAMS_DEFAULT_LOG_RQ_SIZE 0xa
6868 #define MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE 0xd
6969
70−#define MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE_MPW 0x1
70+#define MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE_MPW 0x2
7171 #define MLX5E_PARAMS_DEFAULT_LOG_RQ_SIZE_MPW 0x3
7272 #define MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW 0x6
7373
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c+5−7
@@ -215,22 +215,20 @@ static inline bool mlx5e_rx_cache_get(struct mlx5e_rq *rq, · 214 unmodified lines
215215 static inline int mlx5e_page_alloc_mapped(struct mlx5e_rq *rq,
216216 struct mlx5e_dma_info *dma_info)
217217 {
218− struct page *page;
219−
220218 if (mlx5e_rx_cache_get(rq, dma_info))
221219 return 0;
222220
223− page = dev_alloc_pages(rq->buff.page_order);
224− if (unlikely(!page))
221+ dma_info->page = dev_alloc_pages(rq->buff.page_order);
222+ if (unlikely(!dma_info->page))
225223 return -ENOMEM;
226224
227− dma_info->addr = dma_map_page(rq->pdev, page, 0,
225+ dma_info->addr = dma_map_page(rq->pdev, dma_info->page, 0,
228226 RQ_PAGE_SIZE(rq), rq->buff.map_dir);
229227 if (unlikely(dma_mapping_error(rq->pdev, dma_info->addr))) {
230− put_page(page);
228+ put_page(dma_info->page);
229+ dma_info->page = NULL;
231230 return -ENOMEM;
232231 }
233− dma_info->page = page;
234232
235233 return 0;
236234 }
drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c+6−4
@@ -49,7 +49,7 @@ int mlx5e_napi_poll(struct napi_struct *napi, int budget) · 48 unmodified lines
4949 struct mlx5e_channel *c = container_of(napi, struct mlx5e_channel,
5050 napi);
5151 bool busy = false;
52− int work_done;
52+ int work_done = 0;
5353 int i;
5454
5555 for (i = 0; i < c->num_tc; i++)
@@ -58,15 +58,17 @@ int mlx5e_napi_poll(struct napi_struct *napi, int budget) · 2 unmodified lines
5858 if (c->xdp)
5959 busy |= mlx5e_poll_xdpsq_cq(&c->rq.xdpsq.cq);
6060
61− work_done = mlx5e_poll_rx_cq(&c->rq.cq, budget);
62− busy |= work_done == budget;
61+ if (likely(budget)) { /* budget=0 means: don't poll rx rings */
62+ work_done = mlx5e_poll_rx_cq(&c->rq.cq, budget);
63+ busy |= work_done == budget;
64+ }
6365
6466 busy |= c->rq.post_wqes(&c->rq);
6567
6668 if (busy) {
6769 if (likely(mlx5e_channel_no_affinity_change(c)))
6870 return budget;
69− if (work_done == budget)
71+ if (budget && work_done == budget)
7072 work_done--;
7173 }
7274
drivers/net/ethernet/mellanox/mlx5/core/main.c+7−0
@@ -1482,9 +1482,16 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev) · 1481 unmodified lines
14821482 return -EAGAIN;
14831483 }
14841484
1485+ /* Panic tear down fw command will stop the PCI bus communication
1486+ * with the HCA, so the health polll is no longer needed.
1487+ */
1488+ mlx5_drain_health_wq(dev);
1489+ mlx5_stop_health_poll(dev);
1490+
14851491 ret = mlx5_cmd_force_teardown_hca(dev);
14861492 if (ret) {
14871493 mlx5_core_dbg(dev, "Firmware couldn't do fast unload error: %d\n", ret);
1494+ mlx5_start_health_poll(dev);
14881495 return ret;
14891496 }
14901497
net/8021q/vlan.c+3−3
@@ -376,6 +376,9 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event, · 375 unmodified lines
376376 dev->name);
377377 vlan_vid_add(dev, htons(ETH_P_8021Q), 0);
378378 }
379+ if (event == NETDEV_DOWN &&
380+ (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER))
381+ vlan_vid_del(dev, htons(ETH_P_8021Q), 0);
379382
380383 vlan_info = rtnl_dereference(dev->vlan_info);
381384 if (!vlan_info)
@@ -423,9 +426,6 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event, · 41 unmodified lines
423426 struct net_device *tmp;
424427 LIST_HEAD(close_list);
425428
426− if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
427− vlan_vid_del(dev, htons(ETH_P_8021Q), 0);
428−
429429 /* Put all VLANs for this dev in the down state too. */
430430 vlan_group_for_each_dev(grp, i, vlandev) {
431431 flgs = vlandev->flags;
net/dsa/switch.c+4−0
@@ -133,6 +133,8 @@ static int dsa_switch_mdb_add(struct dsa_switch *ds, · 132 unmodified lines
133133 if (err)
134134 return err;
135135 }
136+
137+ return 0;
136138 }
137139
138140 for_each_set_bit(port, group, ds->num_ports)
@@ -180,6 +182,8 @@ static int dsa_switch_vlan_add(struct dsa_switch *ds, · 41 unmodified lines
180182 if (err)
181183 return err;
182184 }
185+
186+ return 0;
183187 }
184188
185189 for_each_set_bit(port, members, ds->num_ports)
net/ipv4/tcp_input.c+1−2
@@ -2615,7 +2615,6 @@ void tcp_simple_retransmit(struct sock *sk) · 2614 unmodified lines
26152615 struct tcp_sock *tp = tcp_sk(sk);
26162616 struct sk_buff *skb;
26172617 unsigned int mss = tcp_current_mss(sk);
2618− u32 prior_lost = tp->lost_out;
26192618
26202619 tcp_for_write_queue(skb, sk) {
26212620 if (skb == tcp_send_head(sk))
@@ -2632,7 +2631,7 @@ void tcp_simple_retransmit(struct sock *sk) · 10 unmodified lines
26322631
26332632 tcp_clear_retrans_hints_partial(tp);
26342633
2635− if (prior_lost == tp->lost_out)
2634+ if (!tp->lost_out)
26362635 return;
26372636
26382637 if (tcp_is_reno(tp))
net/ipv4/tcp_offload.c+10−2
@@ -149,11 +149,19 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb, · 148 unmodified lines
149149 * is freed by GSO engine
150150 */
151151 if (copy_destructor) {
152+ int delta;
153+
152154 swap(gso_skb->sk, skb->sk);
153155 swap(gso_skb->destructor, skb->destructor);
154156 sum_truesize += skb->truesize;
155− refcount_add(sum_truesize - gso_skb->truesize,
156− &skb->sk->sk_wmem_alloc);
157+ delta = sum_truesize - gso_skb->truesize;
158+ /* In some pathological cases, delta can be negative.
159+ * We need to either use refcount_add() or refcount_sub_and_test()
160+ */
161+ if (likely(delta >= 0))
162+ refcount_add(delta, &skb->sk->sk_wmem_alloc);
163+ else
164+ WARN_ON_ONCE(refcount_sub_and_test(-delta, &skb->sk->sk_wmem_alloc));
157165 }
158166
159167 delta = htonl(oldlen + (skb_tail_pointer(skb) -
net/rds/ib_recv.c+5−5
@@ -410,14 +410,14 @@ void rds_ib_recv_refill(struct rds_connection *conn, int prefill, gfp_t gfp) · 409 unmodified lines
410410 break;
411411 }
412412
413− /* XXX when can this fail? */
414− ret = ib_post_recv(ic->i_cm_id->qp, &recv->r_wr, &failed_wr);
415− rdsdebug("recv %p ibinc %p page %p addr %lu ret %d\n", recv,
413+ rdsdebug("recv %p ibinc %p page %p addr %lu\n", recv,
416414 recv->r_ibinc, sg_page(&recv->r_frag->f_sg),
417415 (long) ib_sg_dma_address(
418416 ic->i_cm_id->device,
419− &recv->r_frag->f_sg),
420− ret);
417+ &recv->r_frag->f_sg));
418+
419+ /* XXX when can this fail? */
420+ ret = ib_post_recv(ic->i_cm_id->qp, &recv->r_wr, &failed_wr);
421421 if (ret) {
422422 rds_ib_conn_error(conn, "recv post on "
423423 "%pI4 returned %d, disconnecting and "