History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller: 1) Use after free in vlan, from Cong Wang. 2) Handle NAPI poll with a zero budget properly in mlx5 driver, from Saeed Mahameed. 3) If DMA mapping fails in mlx5 driver, NULL out page, from Inbar Karmy. 4) Handle overrun in RX FIFO of sun4i CAN driver, from Gerhard Bertelsmann. 5) Missing return in mdb and vlan prepare phase of DSA layer, from Vivien Didelot. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: vlan: fix a use-after-free in vlan_device_event() net: dsa: return after vlan prepare phase net: dsa: return after mdb prepare phase can: ifi: Fix transmitter delay calculation tcp: fix tcp_fastretrans_alert warning tcp: gso: avoid refcount_t warning from tcp_gso_segment() can: peak: Add support for new PCIe/M2 CAN FD interfaces can: sun4i: handle overrun in RX FIFO can: c_can: don't indicate triple sampling support for D_CAN net/mlx5e: Increase Striding RQ minimum size limit to 4 multi-packet WQEs net/mlx5e: Set page to null in case dma mapping fails net/mlx5e: Fix napi poll with zero budget net/mlx5: Cancel health poll before sending panic teardown command net/mlx5: Loop over temp list to release delay events rds: ib: Fix NULL pointer dereference in debug code

Linus Torvalds committed 9 years ago

Commit b3954562 parents ca91659 92d288215 files · +68 −34Browse files

Unified · Split

15 files
  1. drivers/net/can/c_can/c_can_pci.c +0 −1
  2. drivers/net/can/c_can/c_can_platform.c +0 −1
  3. drivers/net/can/ifi_canfd/ifi_canfd.c +3 −3
  4. drivers/net/can/peak_canfd/peak_pciefd_main.c +12 −2
  5. drivers/net/can/sun4i_can.c +10 −2
  6. drivers/net/ethernet/mellanox/mlx5/core/dev.c +1 −1
  7. drivers/net/ethernet/mellanox/mlx5/core/en.h +1 −1
  8. drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +5 −7
  9. drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c +6 −4
  10. drivers/net/ethernet/mellanox/mlx5/core/main.c +7 −0
  11. net/8021q/vlan.c +3 −3
  12. net/dsa/switch.c +4 −0
  13. net/ipv4/tcp_input.c +1 −2
  14. net/ipv4/tcp_offload.c +10 −2
  15. net/rds/ib_recv.c +5 −5
drivers/net/can/c_can/c_can_pci.c+0−1
@@ -178,7 +178,6 @@ static int c_can_pci_probe(struct pci_dev *pdev, · 177 unmodified lines
178 break;178 break;
179 case BOSCH_D_CAN:179 case BOSCH_D_CAN:
180 priv->regs = reg_map_d_can;180 priv->regs = reg_map_d_can;
181 priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
182 break;181 break;
183 default:182 default:
184 ret = -EINVAL;183 ret = -EINVAL;
drivers/net/can/c_can/c_can_platform.c+0−1
@@ -320,7 +320,6 @@ static int c_can_plat_probe(struct platform_device *pdev) · 319 unmodified lines
320 break;320 break;
321 case BOSCH_D_CAN:321 case BOSCH_D_CAN:
322 priv->regs = reg_map_d_can;322 priv->regs = reg_map_d_can;
323 priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
324 priv->read_reg = c_can_plat_read_reg_aligned_to_16bit;323 priv->read_reg = c_can_plat_read_reg_aligned_to_16bit;
325 priv->write_reg = c_can_plat_write_reg_aligned_to_16bit;324 priv->write_reg = c_can_plat_write_reg_aligned_to_16bit;
326 priv->read_reg32 = d_can_plat_read_reg32;325 priv->read_reg32 = d_can_plat_read_reg32;
drivers/net/can/ifi_canfd/ifi_canfd.c+3−3
@@ -670,9 +670,9 @@ static void ifi_canfd_set_bittiming(struct net_device *ndev) · 669 unmodified lines
670 priv->base + IFI_CANFD_FTIME);670 priv->base + IFI_CANFD_FTIME);
671 671
672 /* Configure transmitter delay */672 /* Configure transmitter delay */
673 tdc = (dbt->brp * (dbt->phase_seg1 + 1)) & IFI_CANFD_TDELAY_MASK;673 tdc = dbt->brp * (dbt->prop_seg + dbt->phase_seg1);
674 writel(IFI_CANFD_TDELAY_EN | IFI_CANFD_TDELAY_ABS | tdc,674 tdc &= IFI_CANFD_TDELAY_MASK;
675 priv->base + IFI_CANFD_TDELAY);675 writel(IFI_CANFD_TDELAY_EN | tdc, priv->base + IFI_CANFD_TDELAY);
676}676}
677 677
678static void ifi_canfd_set_filter(struct net_device *ndev, const u32 id,678static void ifi_canfd_set_filter(struct net_device *ndev, const u32 id,
drivers/net/can/peak_canfd/peak_pciefd_main.c+12−2
@@ -29,14 +29,19 @@ · 28 unmodified lines
29#include "peak_canfd_user.h"29#include "peak_canfd_user.h"
30 30
31MODULE_AUTHOR("Stephane Grosjean <s.grosjean@peak-system.com>");31MODULE_AUTHOR("Stephane Grosjean <s.grosjean@peak-system.com>");
32MODULE_DESCRIPTION("Socket-CAN driver for PEAK PCAN PCIe FD family cards");32MODULE_DESCRIPTION("Socket-CAN driver for PEAK PCAN PCIe/M.2 FD family cards");
33MODULE_SUPPORTED_DEVICE("PEAK PCAN PCIe FD CAN cards");33MODULE_SUPPORTED_DEVICE("PEAK PCAN PCIe/M.2 FD CAN cards");
34MODULE_LICENSE("GPL v2");34MODULE_LICENSE("GPL v2");
35 35
36#define PCIEFD_DRV_NAME "peak_pciefd"36#define PCIEFD_DRV_NAME "peak_pciefd"
37 37
38#define PEAK_PCI_VENDOR_ID 0x001c /* The PCI device and vendor IDs */38#define PEAK_PCI_VENDOR_ID 0x001c /* The PCI device and vendor IDs */
39#define PEAK_PCIEFD_ID 0x0013 /* for PCIe slot cards */39#define PEAK_PCIEFD_ID 0x0013 /* for PCIe slot cards */
40#define PCAN_CPCIEFD_ID 0x0014 /* for Compact-PCI Serial slot cards */
41#define PCAN_PCIE104FD_ID 0x0017 /* for PCIe-104 Express slot cards */
42#define PCAN_MINIPCIEFD_ID 0x0018 /* for mini-PCIe slot cards */
43#define PCAN_PCIEFD_OEM_ID 0x0019 /* for PCIe slot OEM cards */
44#define PCAN_M2_ID 0x001a /* for M2 slot cards */
40 45
41/* PEAK PCIe board access description */46/* PEAK PCIe board access description */
42#define PCIEFD_BAR0_SIZE (64 * 1024)47#define PCIEFD_BAR0_SIZE (64 * 1024)
@@ -203,6 +208,11 @@ struct pciefd_board { · 160 unmodified lines
203/* supported device ids. */208/* supported device ids. */
204static const struct pci_device_id peak_pciefd_tbl[] = {209static const struct pci_device_id peak_pciefd_tbl[] = {
205 {PEAK_PCI_VENDOR_ID, PEAK_PCIEFD_ID, PCI_ANY_ID, PCI_ANY_ID,},210 {PEAK_PCI_VENDOR_ID, PEAK_PCIEFD_ID, PCI_ANY_ID, PCI_ANY_ID,},
211 {PEAK_PCI_VENDOR_ID, PCAN_CPCIEFD_ID, PCI_ANY_ID, PCI_ANY_ID,},
212 {PEAK_PCI_VENDOR_ID, PCAN_PCIE104FD_ID, PCI_ANY_ID, PCI_ANY_ID,},
213 {PEAK_PCI_VENDOR_ID, PCAN_MINIPCIEFD_ID, PCI_ANY_ID, PCI_ANY_ID,},
214 {PEAK_PCI_VENDOR_ID, PCAN_PCIEFD_OEM_ID, PCI_ANY_ID, PCI_ANY_ID,},
215 {PEAK_PCI_VENDOR_ID, PCAN_M2_ID, PCI_ANY_ID, PCI_ANY_ID,},
206 {0,}216 {0,}
207};217};
208 218
drivers/net/can/sun4i_can.c+10−2
@@ -539,6 +539,13 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) · 538 unmodified lines
539 }539 }
540 stats->rx_over_errors++;540 stats->rx_over_errors++;
541 stats->rx_errors++;541 stats->rx_errors++;
542
543 /* reset the CAN IP by entering reset mode
544 * ignoring timeout error
545 */
546 set_reset_mode(dev);
547 set_normal_mode(dev);
548
542 /* clear bit */549 /* clear bit */
543 sun4i_can_write_cmdreg(priv, SUN4I_CMD_CLEAR_OR_FLAG);550 sun4i_can_write_cmdreg(priv, SUN4I_CMD_CLEAR_OR_FLAG);
544 }551 }
@@ -653,8 +660,9 @@ static irqreturn_t sun4i_can_interrupt(int irq, void *dev_id) · 108 unmodified lines
653 netif_wake_queue(dev);660 netif_wake_queue(dev);
654 can_led_event(dev, CAN_LED_EVENT_TX);661 can_led_event(dev, CAN_LED_EVENT_TX);
655 }662 }
656 if (isrc & SUN4I_INT_RBUF_VLD) {663 if ((isrc & SUN4I_INT_RBUF_VLD) &&
657 /* receive interrupt */664 !(isrc & SUN4I_INT_DATA_OR)) {
665 /* receive interrupt - don't read if overrun occurred */
658 while (status & SUN4I_STA_RBUF_RDY) {666 while (status & SUN4I_STA_RBUF_RDY) {
659 /* RX buffer is not empty */667 /* RX buffer is not empty */
660 sun4i_can_rx(dev);668 sun4i_can_rx(dev);
drivers/net/ethernet/mellanox/mlx5/core/dev.c+1−1
@@ -93,7 +93,7 @@ static void delayed_event_release(struct mlx5_device_context *dev_ctx, · 92 unmodified lines
93 list_splice_init(&priv->waiting_events_list, &temp);93 list_splice_init(&priv->waiting_events_list, &temp);
94 if (!dev_ctx->context)94 if (!dev_ctx->context)
95 goto out;95 goto out;
96 list_for_each_entry_safe(de, n, &priv->waiting_events_list, list)96 list_for_each_entry_safe(de, n, &temp, list)
97 dev_ctx->intf->event(dev, dev_ctx->context, de->event, de->param);97 dev_ctx->intf->event(dev, dev_ctx->context, de->event, de->param);
98 98
99out:99out:
drivers/net/ethernet/mellanox/mlx5/core/en.h+1−1
@@ -67,7 +67,7 @@ · 66 unmodified lines
67#define MLX5E_PARAMS_DEFAULT_LOG_RQ_SIZE 0xa67#define MLX5E_PARAMS_DEFAULT_LOG_RQ_SIZE 0xa
68#define MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE 0xd68#define MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE 0xd
69 69
70#define MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE_MPW 0x170#define MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE_MPW 0x2
71#define MLX5E_PARAMS_DEFAULT_LOG_RQ_SIZE_MPW 0x371#define MLX5E_PARAMS_DEFAULT_LOG_RQ_SIZE_MPW 0x3
72#define MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW 0x672#define MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW 0x6
73 73
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c+5−7
@@ -215,22 +215,20 @@ static inline bool mlx5e_rx_cache_get(struct mlx5e_rq *rq, · 214 unmodified lines
215static inline int mlx5e_page_alloc_mapped(struct mlx5e_rq *rq,215static inline int mlx5e_page_alloc_mapped(struct mlx5e_rq *rq,
216 struct mlx5e_dma_info *dma_info)216 struct mlx5e_dma_info *dma_info)
217{217{
218 struct page *page;
219
220 if (mlx5e_rx_cache_get(rq, dma_info))218 if (mlx5e_rx_cache_get(rq, dma_info))
221 return 0;219 return 0;
222 220
223 page = dev_alloc_pages(rq->buff.page_order);221 dma_info->page = dev_alloc_pages(rq->buff.page_order);
224 if (unlikely(!page))222 if (unlikely(!dma_info->page))
225 return -ENOMEM;223 return -ENOMEM;
226 224
227 dma_info->addr = dma_map_page(rq->pdev, page, 0,225 dma_info->addr = dma_map_page(rq->pdev, dma_info->page, 0,
228 RQ_PAGE_SIZE(rq), rq->buff.map_dir);226 RQ_PAGE_SIZE(rq), rq->buff.map_dir);
229 if (unlikely(dma_mapping_error(rq->pdev, dma_info->addr))) {227 if (unlikely(dma_mapping_error(rq->pdev, dma_info->addr))) {
230 put_page(page);228 put_page(dma_info->page);
229 dma_info->page = NULL;
231 return -ENOMEM;230 return -ENOMEM;
232 }231 }
233 dma_info->page = page;
234 232
235 return 0;233 return 0;
236}234}
drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c+6−4
@@ -49,7 +49,7 @@ int mlx5e_napi_poll(struct napi_struct *napi, int budget) · 48 unmodified lines
49 struct mlx5e_channel *c = container_of(napi, struct mlx5e_channel,49 struct mlx5e_channel *c = container_of(napi, struct mlx5e_channel,
50 napi);50 napi);
51 bool busy = false;51 bool busy = false;
52 int work_done;52 int work_done = 0;
53 int i;53 int i;
54 54
55 for (i = 0; i < c->num_tc; i++)55 for (i = 0; i < c->num_tc; i++)
@@ -58,15 +58,17 @@ int mlx5e_napi_poll(struct napi_struct *napi, int budget) · 2 unmodified lines
58 if (c->xdp)58 if (c->xdp)
59 busy |= mlx5e_poll_xdpsq_cq(&c->rq.xdpsq.cq);59 busy |= mlx5e_poll_xdpsq_cq(&c->rq.xdpsq.cq);
60 60
61 work_done = mlx5e_poll_rx_cq(&c->rq.cq, budget);61 if (likely(budget)) { /* budget=0 means: don't poll rx rings */
62 busy |= work_done == budget;62 work_done = mlx5e_poll_rx_cq(&c->rq.cq, budget);
63 busy |= work_done == budget;
64 }
63 65
64 busy |= c->rq.post_wqes(&c->rq);66 busy |= c->rq.post_wqes(&c->rq);
65 67
66 if (busy) {68 if (busy) {
67 if (likely(mlx5e_channel_no_affinity_change(c)))69 if (likely(mlx5e_channel_no_affinity_change(c)))
68 return budget;70 return budget;
69 if (work_done == budget)71 if (budget && work_done == budget)
70 work_done--;72 work_done--;
71 }73 }
72 74
drivers/net/ethernet/mellanox/mlx5/core/main.c+7−0
@@ -1482,9 +1482,16 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev) · 1481 unmodified lines
1482 return -EAGAIN;1482 return -EAGAIN;
1483 }1483 }
1484 1484
1485 /* Panic tear down fw command will stop the PCI bus communication
1486 * with the HCA, so the health polll is no longer needed.
1487 */
1488 mlx5_drain_health_wq(dev);
1489 mlx5_stop_health_poll(dev);
1490
1485 ret = mlx5_cmd_force_teardown_hca(dev);1491 ret = mlx5_cmd_force_teardown_hca(dev);
1486 if (ret) {1492 if (ret) {
1487 mlx5_core_dbg(dev, "Firmware couldn't do fast unload error: %d\n", ret);1493 mlx5_core_dbg(dev, "Firmware couldn't do fast unload error: %d\n", ret);
1494 mlx5_start_health_poll(dev);
1488 return ret;1495 return ret;
1489 }1496 }
1490 1497
net/8021q/vlan.c+3−3
@@ -376,6 +376,9 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event, · 375 unmodified lines
376 dev->name);376 dev->name);
377 vlan_vid_add(dev, htons(ETH_P_8021Q), 0);377 vlan_vid_add(dev, htons(ETH_P_8021Q), 0);
378 }378 }
379 if (event == NETDEV_DOWN &&
380 (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER))
381 vlan_vid_del(dev, htons(ETH_P_8021Q), 0);
379 382
380 vlan_info = rtnl_dereference(dev->vlan_info);383 vlan_info = rtnl_dereference(dev->vlan_info);
381 if (!vlan_info)384 if (!vlan_info)
@@ -423,9 +426,6 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event, · 41 unmodified lines
423 struct net_device *tmp;426 struct net_device *tmp;
424 LIST_HEAD(close_list);427 LIST_HEAD(close_list);
425 428
426 if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
427 vlan_vid_del(dev, htons(ETH_P_8021Q), 0);
428
429 /* Put all VLANs for this dev in the down state too. */429 /* Put all VLANs for this dev in the down state too. */
430 vlan_group_for_each_dev(grp, i, vlandev) {430 vlan_group_for_each_dev(grp, i, vlandev) {
431 flgs = vlandev->flags;431 flgs = vlandev->flags;
net/dsa/switch.c+4−0
@@ -133,6 +133,8 @@ static int dsa_switch_mdb_add(struct dsa_switch *ds, · 132 unmodified lines
133 if (err)133 if (err)
134 return err;134 return err;
135 }135 }
136
137 return 0;
136 }138 }
137 139
138 for_each_set_bit(port, group, ds->num_ports)140 for_each_set_bit(port, group, ds->num_ports)
@@ -180,6 +182,8 @@ static int dsa_switch_vlan_add(struct dsa_switch *ds, · 41 unmodified lines
180 if (err)182 if (err)
181 return err;183 return err;
182 }184 }
185
186 return 0;
183 }187 }
184 188
185 for_each_set_bit(port, members, ds->num_ports)189 for_each_set_bit(port, members, ds->num_ports)
net/ipv4/tcp_input.c+1−2
@@ -2615,7 +2615,6 @@ void tcp_simple_retransmit(struct sock *sk) · 2614 unmodified lines
2615 struct tcp_sock *tp = tcp_sk(sk);2615 struct tcp_sock *tp = tcp_sk(sk);
2616 struct sk_buff *skb;2616 struct sk_buff *skb;
2617 unsigned int mss = tcp_current_mss(sk);2617 unsigned int mss = tcp_current_mss(sk);
2618 u32 prior_lost = tp->lost_out;
2619 2618
2620 tcp_for_write_queue(skb, sk) {2619 tcp_for_write_queue(skb, sk) {
2621 if (skb == tcp_send_head(sk))2620 if (skb == tcp_send_head(sk))
@@ -2632,7 +2631,7 @@ void tcp_simple_retransmit(struct sock *sk) · 10 unmodified lines
2632 2631
2633 tcp_clear_retrans_hints_partial(tp);2632 tcp_clear_retrans_hints_partial(tp);
2634 2633
2635 if (prior_lost == tp->lost_out)2634 if (!tp->lost_out)
2636 return;2635 return;
2637 2636
2638 if (tcp_is_reno(tp))2637 if (tcp_is_reno(tp))
net/ipv4/tcp_offload.c+10−2
@@ -149,11 +149,19 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb, · 148 unmodified lines
149 * is freed by GSO engine149 * is freed by GSO engine
150 */150 */
151 if (copy_destructor) {151 if (copy_destructor) {
152 int delta;
153
152 swap(gso_skb->sk, skb->sk);154 swap(gso_skb->sk, skb->sk);
153 swap(gso_skb->destructor, skb->destructor);155 swap(gso_skb->destructor, skb->destructor);
154 sum_truesize += skb->truesize;156 sum_truesize += skb->truesize;
155 refcount_add(sum_truesize - gso_skb->truesize,157 delta = sum_truesize - gso_skb->truesize;
156 &skb->sk->sk_wmem_alloc);158 /* In some pathological cases, delta can be negative.
159 * We need to either use refcount_add() or refcount_sub_and_test()
160 */
161 if (likely(delta >= 0))
162 refcount_add(delta, &skb->sk->sk_wmem_alloc);
163 else
164 WARN_ON_ONCE(refcount_sub_and_test(-delta, &skb->sk->sk_wmem_alloc));
157 }165 }
158 166
159 delta = htonl(oldlen + (skb_tail_pointer(skb) -167 delta = htonl(oldlen + (skb_tail_pointer(skb) -
net/rds/ib_recv.c+5−5
@@ -410,14 +410,14 @@ void rds_ib_recv_refill(struct rds_connection *conn, int prefill, gfp_t gfp) · 409 unmodified lines
410 break;410 break;
411 }411 }
412 412
413 /* XXX when can this fail? */413 rdsdebug("recv %p ibinc %p page %p addr %lu\n", recv,
414 ret = ib_post_recv(ic->i_cm_id->qp, &recv->r_wr, &failed_wr);
415 rdsdebug("recv %p ibinc %p page %p addr %lu ret %d\n", recv,
416 recv->r_ibinc, sg_page(&recv->r_frag->f_sg),414 recv->r_ibinc, sg_page(&recv->r_frag->f_sg),
417 (long) ib_sg_dma_address(415 (long) ib_sg_dma_address(
418 ic->i_cm_id->device,416 ic->i_cm_id->device,
419 &recv->r_frag->f_sg),417 &recv->r_frag->f_sg));
420 ret);418
419 /* XXX when can this fail? */
420 ret = ib_post_recv(ic->i_cm_id->qp, &recv->r_wr, &failed_wr);
421 if (ret) {421 if (ret) {
422 rds_ib_conn_error(conn, "recv post on "422 rds_ib_conn_error(conn, "recv post on "
423 "%pI4 returned %d, disconnecting and "423 "%pI4 returned %d, disconnecting and "