summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-08-26netfilter: ip6t_REJECT: added missing icmpv6 codesAndreas Herz2-1/+9
RFC 4443 added two new codes values for ICMPv6 type 1: 5 - Source address failed ingress/egress policy 6 - Reject route to destination And RFC 7084 states in L-14 that IPv6 Router MUST send ICMPv6 Destination Unreachable with code 5 for packets forwarded to it that use an address from a prefix that has been invalidated. Codes 5 and 6 are more informative subsets of code 1. Signed-off-by: Andreas Herz <andi@geekosphere.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2015-08-26Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds2-9/+21
Pull block fixes from Jens Axboe: "Two fixes in this pull request: - The writeback regression fix from Tejun, which has been weeks in the making. This fixes a case where we would sometimes not issue writeback when we should have. - An older fix for a memory corruption issue in mtip32xx. It was deferred since we wanted a better fix for this (driver should not have to handle that case), but given the timing, it's better to put the simple fix in for 4.2 release" * 'for-linus' of git://git.kernel.dk/linux-block: mtip32x: fix regression introduced by blk-mq per-hctx flush writeback: sync_inodes_sb() must write out I_DIRTY_TIME inodes and always call wait_sb_inodes()
2015-08-26Merge branch 'act_bpf_lockless'David S. Miller6-30/+61
Alexei Starovoitov says: ==================== act_bpf: remove spinlock in fast path v1 version had a race condition in cleanup path of bpf_prog. I tried to fix it by adding new callback 'cleanup_rcu' to 'struct tcf_common' and call it out of act_api cleanup path, but Daniel noticed (thanks for the idea!) that most of the classifiers already do action cleanup out of rcu callback. So instead this set of patches converts tcindex and rsvp classifiers to call tcf_exts_destroy() after rcu grace period and since action cleanup logic in __tcf_hash_release() is only called when bind and refcnt goes to zero, it's guaranteed that cleanup() callback is called from rcu callback. More specifically: patches 1 and 2 - simple fixes patches 2 and 3 - convert tcf_exts_destroy in tcindex and rsvp to call_rcu patch 5 - removes spin_lock from act_bpf The cleanup of actions is now universally done after rcu grace period and in the future we can drop (now unnecessary) call_rcu from tcf_hash_destroy() patch 5 is using synchronize_rcu() in act_bpf replacement path, since it's very rare and alternative of dynamically allocating 'struct tcf_bpf_cfg' just to pass it to call_rcu looks even less appealing. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26net_sched: act_bpf: remove spinlock in fast pathAlexei Starovoitov2-18/+20
Similar to act_gact/act_mirred, act_bpf can be lockless in packet processing with extra care taken to free bpf programs after rcu grace period. Replacement of existing act_bpf (very rare) is done with synchronize_rcu() and final destruction is done from tc_action_ops->cleanup() callback that is called from tcf_exts_destroy()->tcf_action_destroy()->__tcf_hash_release() when bind and refcnt reach zero which is only possible when classifier is destroyed. Previous two patches fixed the last two classifiers (tcindex and rsvp) to call tcf_exts_destroy() from rcu callback. Similar to gact/mirred there is a race between prog->filter and prog->tcf_action. Meaning that the program being replaced may use previous default action if it happened to return TC_ACT_UNSPEC. act_mirred race betwen tcf_action and tcfm_dev is similar. In all cases the race is harmless. Long term we may want to improve the situation by replacing the whole tc_action->priv as single pointer instead of updating inner fields one by one. Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26net_sched: convert rsvp to call tcf_exts_destroy from rcu callbackAlexei Starovoitov1-4/+14
Adjust destroy path of cls_rsvp to call tcf_exts_destroy() after rcu grace period. Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26net_sched: convert tcindex to call tcf_exts_destroy from rcu callbackAlexei Starovoitov1-4/+25
Adjust destroy path of cls_tcindex to call tcf_exts_destroy() after rcu grace period. Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26net_sched: act_bpf: remove unnecessary copyAlexei Starovoitov1-1/+1
Fix harmless typo and avoid unnecessary copy of empty 'prog' into unused 'strcut tcf_bpf_cfg old'. Fixes: f4eaed28c783 ("act_bpf: fix memory leaks when replacing bpf programs") Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26net_sched: make tcf_hash_destroy() staticAlexei Starovoitov2-3/+1
tcf_hash_destroy() used once. Make it static. Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26lib/Makefile: remove CONFIG_AVERAGE build ruleValentin Rothberg1-2/+0
The Kconfig option AVERAGE and its implementation has been removed by commit f4e774f55fe0 ("average: remove out-of-line implementation"). Remove the dead build rule in lib/Makefile. Signed-off-by: Valentin Rothberg <valentinrothberg@gmail.com> Reviewed-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26powerpc/PCI: Disable MSI/MSI-X interrupts at PCI probe time in OF caseGuilherme G. Piccoli1-0/+3
Since commit 1851617cd2da ("PCI/MSI: Disable MSI at enumeration even if kernel doesn't support MSI"), the setup of dev->msi_cap/msix_cap and the disable of MSI/MSI-X interrupts isn't being done at PCI probe time, as the logic responsible for this was moved in the aforementioned commit from pci_device_add() to pci_setup_device(). The latter function is not reachable on PowerPC pseries platform during Open Firmware PCI probing time. This exhibits as drivers not being able to enable MSI, eg: bnx2x 0000:01:00.0: no msix capability found This patch calls pci_msi_setup_pci_dev() explicitly to disable MSI/MSI-X during PCI probe time on pSeries platform. Fixes: 1851617cd2da ("PCI/MSI: Disable MSI at enumeration even if kernel doesn't support MSI") [mpe: Flesh out change log and clarify comment] Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-08-26PCI: Make pci_msi_setup_pci_dev() non-static for use by arch codeGuilherme G. Piccoli2-1/+2
Commit 1851617cd2da ("PCI/MSI: Disable MSI at enumeration even if kernel doesn't support MSI") changed the location of the code that initialises dev->msi_cap/msix_cap and then disables MSI/MSI-X interrupts at PCI probe time in devices that have this flag set. It moved the code from pci_msi_init_pci_dev() to a new function named pci_msi_setup_pci_dev(), called by pci_setup_device(). The pseries PCI probing code does not call pci_setup_device(), so since the aforementioned commit the function pci_msi_setup_pci_dev() is not called and MSI/MSI-X interrupts are left enabled. Additionally because dev->msi_cap/msix_cap are not initialised no driver can ever enable MSI/MSI-X. To fix this, the pseries PCI probe should manually call pci_msi_setup_pci_dev(), so this patch makes it non-static. Fixes: 1851617cd2da ("PCI/MSI: Disable MSI at enumeration even if kernel doesn't support MSI") [mpe: Update change log to mention dev->msi_cap/msix_cap] Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2015-08-26Merge ath-next from ath.gitKalle Valo16-95/+348
Major changes in ath10k: * add spectral scan support for qca99x0 * add qca6164 support
2015-08-26ath10k: fix compilation warnings in wmi phyerr pull functionRaja Mani1-2/+2
Below compilation warnings are observed in gcc version 4.8.2. Even though it's not seen in bit older gcc versions (for ex, 4.7.3), It's good to fix it by changing format specifier from %d to %zd in wmi pull phyerr functions. wmi.c: In function 'ath10k_wmi_op_pull_phyerr_ev': wmi.c:3567:8: warning: format '%d' expects argument of type 'int', but argument 4 has type 'long unsigned int' [-Wformat=] left_len, sizeof(*phyerr)); ^ wmi.c: In function 'ath10k_wmi_10_4_op_pull_phyerr_ev': wmi.c:3612:8: warning: format '%d' expects argument of type 'int', but argument 4 has type 'long unsigned int' [-Wformat=] left_len, sizeof(*phyerr)); ^ Fixes: 991adf71a6cd ("ath10k: refactor phyerr event handlers") Fixes: 2b0a2e0d7c2f ("ath10k: handle 10.4 firmware phyerr event") Signed-off-by: Raja Mani <rmani@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-08-26ath10k: add qca6164 supportMichal Kazior3-0/+25
This adds additional 0x0041 PCI Device ID definition to ath10k for QCA6164 which is a 1 spatial stream sibling of the QCA6174 (which is 2 spatial stream chip). The QCA6164 needs a dedicated board.bin file which is different than the one used for QCA6174. If the board.bin is wrong the device will crash early while trying to boot firmware. The register dump will look like this: ath10k_pci 0000:02:00.0: firmware register dump: ath10k_pci 0000:02:00.0: [00]: 0x05010000 0x000015B3 0x000A012D 0x00955B31 ... Note the value 0x000A012D. Special credit goes to Alan Liu <alanliu@qca.qualcomm.com> for providing support help which enabled me to come up with this patch. Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-08-26ath10k: add spectral scan support for 10.4 fwRaja Mani2-0/+11
To enable/configure spectral scan parameters in 10.4 firmware, existing wmi spectral related functions can be reused. Link those functions in 10.4 wmi ops table. In addition, adjust bin size (only when size is 68 bytes) before reporting bin samples to user space. The background for this adjustment is that qca99x0 reports bin size as 68 bytes (64 bytes + 4 bytes) in report mode 2. First 64 bytes carries in-band tones (-32 to +31) and last 4 byte carries band edge detection data (+32) mainly used in radar detection purpose. Additional last 4 bytes are stripped to make bin size valid one. This bin size adjustment will happen only for qca99x0, all other chipsets will report proper bin sizes (64/128) without extra 4 bytes being added at the end. The changes are validated in qca99x0 using 10.4 firmware. Signed-off-by: Raja Mani <rmani@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-08-26ath10k: fix dma_mapping_error() handlingMichal Kazior4-5/+16
The function returns 1 when DMA mapping fails. The driver would return bogus values and could possibly confuse itself if DMA failed. Fixes: 767d34fc67af ("ath10k: remove DMA mapping wrappers") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-08-26ath10k: add missing mutex unlock on failpathMichal Kazior1-1/+2
Kernel would complain about leaving a held lock after going back to userspace and would subsequently deadlock. Fixes: e04cafbc38c7 ("ath10k: fix peer limit enforcement") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-08-26usbnet: Get EVENT_NO_RUNTIME_PM bit before it is clearedEugene Shatokhin1-3/+4
It is needed to check EVENT_NO_RUNTIME_PM bit of dev->flags in usbnet_stop(), but its value should be read before it is cleared when dev->flags is set to 0. The problem was spotted and the fix was provided by Oliver Neukum <oneukum@suse.de>. Signed-off-by: Eugene Shatokhin <eugene.shatokhin@rosalab.ru> Acked-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26Merge branch 'for-linus' of ↵Linus Torvalds1-5/+6
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull LSM regression fix from James Morris. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: LSM: restore certain default error codes
2015-08-26Merge branch 'libnvdimm-fixes' of ↵Linus Torvalds1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull nvdimm fix from Dan Williams: "A single fix for status register read size in the nd_blk driver. The effect of getting the width of this register read wrong is that all I/O fails when the read returns non-zero. Given the availability of ACPI 6 NFIT enabled platforms, this could reasonably wait to come in during the 4.3 merge window with a tag for 4.2-stable. Otherwise, this makes the 4.2 kernel fully functional with devices that conform to the mmio-block-apertures defined in the ACPI 6 NFIT (NVDIMM Firmware Interface Table)" * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nfit, nd_blk: BLK status register is only 32 bits
2015-08-26drivers: net: xgene: fix: Oops in linkwatch_fire_eventIyappan Subramanian2-2/+6
[ 1065.801569] Internal error: Oops: 96000006 [#1] SMP ... [ 1065.866655] Hardware name: AppliedMicro Mustang/Mustang, BIOS 1.1.0 Apr 22 2015 [ 1065.873937] Workqueue: events_power_efficient phy_state_machine [ 1065.879837] task: fffffe01de105e80 ti: fffffe00bcf18000 task.ti: fffffe00bcf18000 [ 1065.887288] PC is at linkwatch_fire_event+0xac/0xc0 [ 1065.892141] LR is at linkwatch_fire_event+0xa0/0xc0 [ 1065.896995] pc : [<fffffe000060284c>] lr : [<fffffe0000602840>] pstate: 200001c5 [ 1065.904356] sp : fffffe00bcf1bd00 ... [ 1066.196813] Call Trace: [ 1066.199248] [<fffffe000060284c>] linkwatch_fire_event+0xac/0xc0 [ 1066.205140] [<fffffe000061167c>] netif_carrier_off+0x54/0x64 [ 1066.210773] [<fffffe00004f1654>] phy_state_machine+0x120/0x3bc [ 1066.216578] [<fffffe00000d8d10>] process_one_work+0x15c/0x3a8 [ 1066.222296] [<fffffe00000d9090>] worker_thread+0x134/0x470 [ 1066.227757] [<fffffe00000df014>] kthread+0xe0/0xf8 [ 1066.232525] Code: 97f65ee9 f9420660 d538d082 8b000042 (885f7c40) The fix is to call phy_disconnect() from xgene_enet_mdio_remove, which in turn call cancel_delayed_work_sync(). Signed-off-by: Iyappan Subramanian <isubramanian@apm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26cls_u32: complete the check for non-forced case in u32_destroy()WANG Cong1-0/+13
In commit 1e052be69d04 ("net_sched: destroy proto tp when all filters are gone") I added a check in u32_destroy() to see if all real filters are gone for each tp, however, that is only done for root_ht, same is needed for others. This can be reproduced by the following tc commands: tc filter add dev eth0 parent 1:0 prio 5 handle 15: protocol ip u32 divisor 256 tc filter add dev eth0 protocol ip parent 1: prio 5 handle 15:2:2 u32 ht 15:2: match ip src 10.0.0.2 flowid 1:10 tc filter add dev eth0 protocol ip parent 1: prio 5 handle 15:2:3 u32 ht 15:2: match ip src 10.0.0.3 flowid 1:10 Fixes: 1e052be69d04 ("net_sched: destroy proto tp when all filters are gone") Reported-by: Akshat Kakkar <akshat.1984@gmail.com> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Cong Wang <cwang@twopensource.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26Merge branch 'dsa-docs'David S. Miller2-0/+729
Florian Fainelli says: ==================== Documentation: dsa This patch series adds some documentation about DSA as a subsystem as well as the SF2 driver since it slightly diverges from your average DSA driver ;) ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26Documentation: networking: dsa: Add Broadcom SF2 documentFlorian Fainelli1-0/+114
Add a document describing the Broadcom Starfigther 2 switch hardware, its specifics, and how the driver is implemented and its specifics. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Reviewed-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26Documentation: networking: add a DSA documentFlorian Fainelli1-0/+615
Describe how the DSA subsystem works, its design principles, limitations, and describe in details how to implement a DSA switch driver. Acked-by: Andrew Lunn <andrew@lunn.ch> Acked-by: Scott Feldman <sfeldma@gmail.com> Reviewed-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26LSM: restore certain default error codesJan Beulich1-5/+6
While in most cases commit b1d9e6b064 ("LSM: Switch to lists of hooks") retained previous error returns, in three cases it altered them without any explanation in the commit message. Restore all of them - in the security_old_inode_init_security() case this led to reiserfs using uninitialized data, sooner or later crashing the system (the only other user of this function - ocfs2 - was unaffected afaict, since it passes pre-initialized structures). Signed-off-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
2015-08-26nfit, nd_blk: BLK status register is only 32 bitsRoss Zwisler1-2/+2
Only read 32 bits for the BLK status register in read_blk_stat(). The format and size of this register is defined in the "NVDIMM Driver Writer's guide": http://pmem.io/documents/NVDIMM_Driver_Writers_Guide.pdf Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com> Reported-by: Nicholas Moulin <nicholas.w.moulin@linux.intel.com> Tested-by: Nicholas Moulin <nicholas.w.moulin@linux.intel.com> Reviewed-by: Jeff Moyer <jmoyer@redhat.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2015-08-26net: fec: use reinit_completion() in mdio accessor functionsRussell King1-2/+2
Rather than re-initialising the entire completion on every mdio access, use reinit_completion() which only resets the completion count. This avoids possible reinitialisation of the contained spinlock and waitqueue while they may be in use (eg, mid-completion.) Such an event could occur if there's a long delay in interrupt handling causing the mdio accessor to time out, then a second access comes in while the interrupt handler on a different CPU has called complete(). Another scenario where this has been observed is while locking has been missing at the phy layer, allowing concurrent attempts to access the MDIO bus. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26net: phy: add locking to phy_read_mmd_indirect()/phy_write_mmd_indirect()Russell King1-4/+12
The phy layer is missing locking for the above two functions - it has been observed that two threads (userspace and the phy worker thread) can race, entering the bus ->write or ->read functions simultaneously. This causes the FEC driver to initialise a completion while another thread is waiting on it or while the interrupt is calling complete() on it, which causes spinlock unlock-without-lock, spinlock lockups, and completion timeouts. Fixes: a59a4d192 ("phy: add the EEE support and the way to access to the MMD registers.") Fixes: 0c1d77dfb ("net: libphy: Add phy specific function to access mmd phy registers") Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26Merge branch 'rds-more-fixes'David S. Miller5-17/+50
Santosh Shilimkar says: ==================== RDS: Few more fixes As indicated in the earlier series [1], this is a follow-up series which addresses few issues around the RDS FMR code. With [1] and the subject series, now I can run many parallel threads with multiple sockets with N x N traffic. The stress tests has survived overnight runs. [1] https://lkml.org/lkml/2015/8/22/127 ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26RDS: remove superfluous from rds_ib_alloc_fmr()santosh.shilimkar@oracle.com1-2/+0
Memory allocated for 'ibmr' uses kzalloc_node() which already initialises the memory to zero. There is no need to do memset() 0 on that memory. Signed-off-by: Santosh Shilimkar <ssantosh@kernel.org> Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26RDS: flush the FMR pool less oftensantosh.shilimkar@oracle.com1-1/+1
FMR flush is an expensive and time consuming operation. Reduce the frequency of FMR pool flush by 50% so that more FMR work gets accumulated for more efficient flushing. Signed-off-by: Santosh Shilimkar <ssantosh@kernel.org> Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26RDS: push FMR pool flush work to its own workersantosh.shilimkar@oracle.com3-4/+34
RDS FMR flush operation and also it races with connect/reconect which happes a lot with RDS. FMR flush being on common rds_wq aggrevates the problem. Lets push RDS FMR pool flush work to its own worker. Signed-off-by: Santosh Shilimkar <ssantosh@kernel.org> Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26RDS: fix fmr pool dirty_countWengang Wang1-6/+9
In rds_ib_flush_mr_pool(), dirty_count accounts the clean ones which is wrong. This can lead to a negative dirty count value. Lets fix it. Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com> Signed-off-by: Santosh Shilimkar <ssantosh@kernel.org> Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26RDS: Fix rds MR reference count in rds_rdma_unuse()santosh.shilimkar@oracle.com1-2/+3
rds_rdma_unuse() drops the mr reference count which it hasn't taken. Correct way of removing mr is to remove mr from the tree and then rdma_destroy_mr() it first, then rds_mr_put() to decrement its reference count. Whichever thread holds last reference will free the mr via rds_mr_put() This bug was triggering weird null pointer crashes. One if the trace for it is captured below. BUG: unable to handle kernel NULL pointer dereference at 0000000000000104 IP: [<ffffffffa0899471>] rds_ib_free_mr+0x31/0x130 [rds_rdma] PGD 4366fa067 PUD 4366f9067 PMD 0 Oops: 0000 [#1] SMP [...] task: ffff88046da6a000 ti: ffff88046da6c000 task.ti: ffff88046da6c000 RIP: 0010:[<ffffffffa0899471>] [<ffffffffa0899471>] rds_ib_free_mr+0x31/0x130 [rds_rdma] RSP: 0018:ffff88046fa43bd8 EFLAGS: 00010286 RAX: 0000000071d38b80 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff880079e7ff40 RBP: ffff88046fa43bf8 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88046fa43ca8 R11: ffff88046a802ed8 R12: ffff880079e7fa40 R13: 0000000000000000 R14: ffff880079e7ff40 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88046fa40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000104 CR3: 00000004366fb000 CR4: 00000000000006e0 Stack: ffff880079e7fa40 ffff880671d38f08 ffff880079e7ff40 0000000000000296 ffff88046fa43c28 ffffffffa087a38b ffff880079e7fa40 ffff880671d38f10 0000000000000000 0000000000000292 ffff88046fa43c48 ffffffffa087a3b6 Call Trace: <IRQ> [<ffffffffa087a38b>] rds_destroy_mr+0x8b/0xa0 [rds] [<ffffffffa087a3b6>] __rds_put_mr_final+0x16/0x30 [rds] [<ffffffffa087a492>] rds_rdma_unuse+0xc2/0x120 [rds] [<ffffffffa08766d3>] rds_recv_incoming_exthdrs+0x83/0xa0 [rds] [<ffffffffa0876782>] rds_recv_incoming+0x92/0x200 [rds] [<ffffffffa0895269>] rds_ib_process_recv+0x259/0x320 [rds_rdma] [<ffffffffa08962a8>] rds_ib_recv_tasklet_fn+0x1a8/0x490 [rds_rdma] [<ffffffff810dcd78>] ? __remove_hrtimer+0x58/0x90 [<ffffffff810799e1>] tasklet_action+0xb1/0xc0 [<ffffffff81079b52>] __do_softirq+0xe2/0x290 [<ffffffff81079df6>] irq_exit+0xa6/0xb0 [<ffffffff81613915>] do_IRQ+0x65/0xf0 [<ffffffff816118ab>] common_interrupt+0x6b/0x6b Signed-off-by: Santosh Shilimkar <ssantosh@kernel.org> Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26RDS: fix the dangling reference to rds_ib_incoming_slabsantosh.shilimkar@oracle.com1-2/+3
On rds_ib_frag_slab allocation failure, ensure rds_ib_incoming_slab is not pointing to the detsroyed memory. Signed-off-by: Santosh Shilimkar <ssantosh@kernel.org> Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26vxlan: re-ignore EADDRINUSE from igmp_joinMarcelo Ricardo Leitner1-0/+2
Before 56ef9c909b40[1] it used to ignore all errors from igmp_join(). That commit enhanced that and made it error out whatever error happened with igmp_join(), but that's not good because when using multicast groups vxlan will try to join it multiple times if the socket is reused and then the 2nd and further attempts will fail with EADDRINUSE. As we don't track to which groups the socket is already subscribed, it's okay to just ignore that error. Fixes: 56ef9c909b40 ("vxlan: Move socket initialization to within rtnl scope") Reported-by: John Nielsen <lists@jnielsen.net> Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26Merge tag 'batman-adv-for-davem' of git://git.open-mesh.org/linux-mergeDavid S. Miller37-679/+733
Antonio Quartulli says: ==================== Included changes: - code restyling and beautification - use int kernel types instead of C99 - update kereldoc - prevent potential hlist double deletion of VLAN objects - fix gw bandwidth calculation - convert list to hlist when needed - add lockdep_asserts calls in function with lock requirements described in kerneldoc ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26Merge tag 'linux-can-fixes-for-4.2-20150825' of ↵David S. Miller5-70/+82
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== this is the updated pull request of one patch by me for the peak_usb driver. It fixes the driver, so that non FD adapters don't provide CAN FD bittimings. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26enic: reduce ioread in devcmd2Govindarajulu Varadarajan2-3/+6
posted_index is RO in firmware. We need not do ioread everytime to get posted index. Store posted index locally. Signed-off-by: Govindarajulu Varadarajan <_govind@gmx.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26net: compile renesas directory if NET_VENDOR_RENESAS is configuredKazuya Mizuguchi1-1/+1
Currently the renesas ethernet driver directory is compiled if SH_ETH is configured rather than NET_VENDOR_RENESAS. Although incorrect that was quite harmless as until recently as SH_ETH configured the only driver in the renesas directory. However, as of c156633f1353 ("Renesas Ethernet AVB driver proper") the renesas directory includes another driver, configured by RAVB, and it makes little sense for it to have a hidden dependency on SH_ETH. Signed-off-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com> [horms: rewrote changelog] Signed-off-by: Simon Horman <horms+renesas@verge.net.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26r8169: Add values missing in @get_stats64 from HW countersCorinna Vinschen1-14/+149
The r8169 driver collects statistical information returned by @get_stats64 by counting them in the driver itself, even though many (but not all) of the values are already collected by tally counters (TCs) in the NIC. Some of these TC values are not returned by @get_stats64. Especially the received multicast packages are missing from /proc/net/dev. Rectify this by fetching the TCs and returning them from rtl8169_get_stats64. The counters collected in the driver obviously disappear as soon as the driver is unloaded so after a driver is loaded the counters always start at 0. The TCs on the other hand are only reset by a power cycle. Without further considerations the values collected by the driver would not match up against the TC values. This patch introduces a new function rtl8169_reset_counters which resets the TCs. Also, since rtl8169_reset_counters shares most of its code with rtl8169_update_counters, refactor the shared code into two new functions rtl8169_map_counters and rtl8169_unmap_counters. Unfortunately chip versions prior to RTL_GIGA_MAC_VER_19 don't allow to reset the TCs programatically. Therefore introduce an addition to the rtl8169_private struct and a function rtl8169_init_counter_offsets to store the TCs at first rtl_open. Use these values as offsets in rtl8169_get_stats64. Propagate a failure to reset *and* update the counters up to rtl_open and emit a warning message, if so. Signed-off-by: Corinna Vinschen <vinschen@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26rds: Fix improper gfp_t usage.David S. Miller1-1/+1
>> net/rds/ib_recv.c:382:28: sparse: incorrect type in initializer (different base types) net/rds/ib_recv.c:382:28: expected int [signed] can_wait net/rds/ib_recv.c:382:28: got restricted gfp_t net/rds/ib_recv.c:828:23: sparse: cast to restricted __le64 Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26MAINTAINERS: update vmxnet3 driver maintainerShrikrishna Khare1-1/+1
Shreyas Bhatewara would no longer maintain the vmxnet3 driver. Taking over the role of vmxnet3 maintainer. Signed-off-by: Shrikrishna Khare <skhare@vmware.com> Signed off-by: Shreyas Bhatewara <sbhatewara@vmware.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26ip6_gre: release cached dst on tunnel removalhuaibin Wang1-0/+1
When a tunnel is deleted, the cached dst entry should be released. This problem may prevent the removal of a netns (seen with a x-netns IPv6 gre tunnel): unregister_netdevice: waiting for lo to become free. Usage count = 3 CC: Dmitry Kozlov <xeb@mail.ru> Fixes: c12b395a4664 ("gre: Support GRE over IPv6") Signed-off-by: huaibin Wang <huaibin.wang@6wind.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26vxlan: fix multiple inclusion of vxlan.hJiri Benc1-1/+2
The vxlan_get_sk_family inline function was added after the last #endif, making multiple inclusion of net/vxlan.h fail. Move it to the proper place. Reported-by: Mark Rustad <mark.d.rustad@intel.com> Fixes: 705cc62f6728c ("vxlan: provide access function for vxlan socket address family") Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26MAINTAINERS: Add VRF entryDavid Ahern1-0/+8
Add entry for new VRF device driver. Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26route: fix a use-after-freeWANG Cong1-1/+2
This patch fixes the following crash: general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.2.0-rc7+ #166 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: ffff88010656d280 ti: ffff880106570000 task.ti: ffff880106570000 RIP: 0010:[<ffffffff8182f91b>] [<ffffffff8182f91b>] dst_destroy+0xa6/0xef RSP: 0018:ffff880107603e38 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff8800d225a000 RCX: ffffffff82250fd0 RDX: 0000000000000001 RSI: ffffffff82250fd0 RDI: 6b6b6b6b6b6b6b6b RBP: ffff880107603e58 R08: 0000000000000001 R09: 0000000000000001 R10: 000000000000b530 R11: ffff880107609000 R12: 0000000000000000 R13: ffffffff82343c40 R14: 0000000000000000 R15: ffffffff8182fb4f FS: 0000000000000000(0000) GS:ffff880107600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00007fcabd9d3000 CR3: 00000000d7279000 CR4: 00000000000006e0 Stack: ffffffff82250fd0 ffff8801077d6f00 ffffffff82253c40 ffff8800d225a000 ffff880107603e68 ffffffff8182fb5d ffff880107603f08 ffffffff810d795e ffffffff810d7648 ffff880106574000 ffff88010656d280 ffff88010656d280 Call Trace: <IRQ> [<ffffffff8182fb5d>] dst_destroy_rcu+0xe/0x1d [<ffffffff810d795e>] rcu_process_callbacks+0x618/0x7eb [<ffffffff810d7648>] ? rcu_process_callbacks+0x302/0x7eb [<ffffffff8182fb4f>] ? dst_gc_task+0x1eb/0x1eb [<ffffffff8107e11b>] __do_softirq+0x178/0x39f [<ffffffff8107e52e>] irq_exit+0x41/0x95 [<ffffffff81a4f215>] smp_apic_timer_interrupt+0x34/0x40 [<ffffffff81a4d5cd>] apic_timer_interrupt+0x6d/0x80 <EOI> [<ffffffff8100b968>] ? default_idle+0x21/0x32 [<ffffffff8100b966>] ? default_idle+0x1f/0x32 [<ffffffff8100bf19>] arch_cpu_idle+0xf/0x11 [<ffffffff810b0bc7>] default_idle_call+0x1f/0x21 [<ffffffff810b0dce>] cpu_startup_entry+0x1ad/0x273 [<ffffffff8102fe67>] start_secondary+0x135/0x156 dst is freed right before lwtstate_put(), this is not correct... Fixes: 61adedf3e3f1 ("route: move lwtunnel state to dst_entry") Acked-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Cong Wang <cwang@twopensource.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26net-next: Fix warning while make xmldocs caused by skbuff.cMasanari Iida1-2/+2
This patch fix following warnings. .//net/core/skbuff.c:407: warning: No description found for parameter 'len' .//net/core/skbuff.c:407: warning: Excess function parameter 'length' description in '__netdev_alloc_skb' .//net/core/skbuff.c:476: warning: No description found for parameter 'len' .//net/core/skbuff.c:476: warning: Excess function parameter 'length' description in '__napi_alloc_skb' Signed-off-by: Masanari Iida <standby24x7@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-26ppp: implement x-netns supportGuillaume Nault1-2/+15
Let packets move from one netns to the other at PPP encapsulation and decapsulation time. PPP units and channels remain in the netns in which they were originally created. Only the net_device may move to a different namespace. Cross netns handling is thus transparent to lower PPP layers (PPPoE, L2TP, etc.). PPP devices are automatically unregistered when their netns gets removed. So read() and poll() on the unit file descriptor will respectively receive EOF and POLLHUP. Channels aren't affected. Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net>