Commit Graph

303480 Commits

Author SHA1 Message Date
Rom Lemarchand
82fc90bbc2 android: configs: Enable KSM support by default
This will be a noop unless the KSM thread is enabled by userspace

Change-Id: Ia5fde14504cc0da50522e2f875d8d021f9e054ba
Signed-off-by: Rom Lemarchand <romlem@google.com>
2013-05-31 11:55:49 -07:00
Michael Wright
c97eb70f9b android: configs: Add Logitech unifying receivers to recommended
Change-Id: I7647cd7037731df69dfdd513a0808b396d9d5bdd
Signed-off-by: Michael Wright <michaelwr@android.com>
2013-05-31 18:53:42 +00:00
Rebecca Schultz Zavin
072beca551 gpu: ion: Also shrink memory cached in the deferred free list
When the system is low on memory, we want to shrink any cached
system memory ion is holding.  Previously we were shrinking memory
in the page pools, but not in the deferred free list.  This patch
makes it possible to shrink both.  It also moves the shrinker
code into the heaps so they can correctly manage any caches they
might contain.

Change-Id: I177f587f999a5220eddbf7af94745aae736cac75
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
2013-05-31 17:57:47 +00:00
Dmitry Shmidt
cd60d02d0b net: wireless: bcmdhd: Update to version 1.88.21
- Remove DHCP_SCAN_SUPPRESS option
- Tune P2P parameters
- Add bcm4339 support

Change-Id: Ifc2906b3df6c17a7a8ea8e27f5f001fe3d9acd01
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2013-05-30 16:04:05 -07:00
JP Abgrall
1b7ab6fed1 misc: uidstat: avoid create_stat() race and blockage.
* create_stat() race would lead to:
  [   58.132324] proc_dir_entry 'uid_stat/10061' already registered

* blocking kmalloc reported by sbranden
 tcp_read_sock()
  uid_stat_tcp_rcv()
    create_stat()
      kmalloc(GFP_KERNEL)

Signed-off-by: JP Abgrall <jpa@google.com>
2013-05-30 15:38:45 -07:00
Dmitry Shmidt
cbcea555d8 net: wireless: bcmdhd: Close p2p0 device in wl_down
Change-Id: I9e8404badf55c0e7a54144d7b5f1c5d80aa0cb4b
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2013-05-21 18:22:56 -07:00
Ken Sumrall
714855d8ef mmc: Add tracepoints of mmc block operations
Add tracepoints to record the start and end of each mmc block
operation.  This includes read, write, erase, secure erase,
trim, secure trim1 and secure trim 2, discard and
sanitize commands.

Change-Id: Ic5d1cbdb9adb940d8b1a2a13c73970023575df50
Signed-off-by: Ken Sumrall <ksumrall@android.com>
2013-05-17 16:05:36 -07:00
Tommi Rantala
8737f9ad19 perf: Treat attr.config as u64 in perf_swevent_init()
Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Link: http://lkml.kernel.org/r/1365882554-30259-1-git-send-email-tt.rantala@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2013-05-14 11:46:24 -07:00
Dmitry Shmidt
0548584082 net: wireless: bcmdhd: Update to version 1.88.16
- Change the logic to enable Power save mode for STA or P2P GC
- Fix protxstatus bug for corner case
- Reset uninitialized value for mac entry
- Remove dhd_wlfc_init/deinit in wl_android.c
- Fix IBSS mode

Change-Id: I4589e87eda456798eae48548261a1f7cb9542660
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2013-05-10 13:17:47 -07:00
Colin Cross
f8f24e6631 lowmemorykiller: make default lowmemorykiller debug message useful
lowmemorykiller debug messages are inscrutable and mostly useful
for debugging the lowmemorykiller, not explaining why a process
was killed.  Make the messages more useful by prefixing them
with "lowmemorykiller: " and explaining in more readable terms
what was killed, who it was killed for, and why it was killed.

The messages now look like:
[   76.997631] lowmemorykiller: Killing 'droid.gallery3d' (2172), adj 1000,
[   76.997635]    to free 27436kB on behalf of 'kswapd0' (29) because
[   76.997638]    cache 122624kB is below limit 122880kB for oom_score_adj 1000
[   76.997641]    Free memory is -53356kB above reserved

A negative number for free memory above reserved means some of the
reserved memory has been used and is being regenerated by kswapd,
which is likely what called the shrinkers.

Change-Id: I1fe983381e73e124b90aa5d91cb66e55eaca390f
Signed-off-by: Colin Cross <ccross@android.com>
2013-05-03 14:59:17 -07:00
JP Abgrall
0e473aec28 ARM: fault: assume no context when IRQs are disabled during data abort.
Bail out early if IRQs are disabled in do_page_fault or else
  [14415.157266] BUG: sleeping function called from invalid context at arch/arm/mm/fault.c:301

Russell King's idea from
  http://comments.gmane.org/gmane.linux.ports.arm.omap/59256

Signed-off-by: JP Abgrall <jpa@google.com>
2013-04-29 16:09:00 -07:00
Minsung Kim
2e745d359f cpufreq: interactive: fix uninitialized spinlock
Add missing spinlock init

Backtrace:
[<c0011ce4>] (dump_backtrace+0x0/0x10c) from [<c0662a68>] (dump_stack+0x18/0x1c)
 r6:00000032 r5:c0bd09ec r4:e6848000 r3:00000000
[<c0662a50>] (dump_stack+0x0/0x1c) from [<c06670b0>] (spin_dump+0x80/0x94)
[<c0667030>] (spin_dump+0x0/0x94) from [<c06670f0>] (spin_bug+0x2c/0x30)
 r5:c08f91fc r4:c0bd09ec
[<c06670c4>] (spin_bug+0x0/0x30) from [<c0245f74>] (do_raw_spin_unlock+0x88/0xcc)
 r5:e547bac0 r4:c0bd09ec
[<c0245eec>] (do_raw_spin_unlock+0x0/0xcc) from [<c066c9cc>] (_raw_spin_unlock_irqrestore+0x14/0x40)
 r5:e547bac0 r4:60000013
[<c066c9b8>] (_raw_spin_unlock_irqrestore+0x0/0x40) from [<c044b884>] (store_above_hispeed_delay+0x6c/0x80)
 r4:c0b4cf78 r3:00000007
[<c044b818>] (store_above_hispeed_delay+0x0/0x80) from [<c0235d24>] (kobj_attr_store+0x1c/0x28)
 r7:e68ff000 r6:00000032 r5:e58137c0 r4:e61cde80
[<c0235d08>] (kobj_attr_store+0x0/0x28) from [<c0156b78>] (sysfs_write_file+0x104/0x184)
[<c0156a74>] (sysfs_write_file+0x0/0x184) from [<c0100680>] (vfs_write+0xb0/0x140)
[<c01005d0>] (vfs_write+0x0/0x140) from [<c0100900>] (sys_write+0x44/0x70)
 r8:00000000 r7:00000004 r6:00000032 r5:bee43c90 r4:e5600300
[<c01008bc>] (sys_write+0x0/0x70) from [<c000e400>] (ret_fast_syscall+0x0/0x30)
 r9:e6842000 r8:c000e584 r6:00000032 r5:bee43c90 r4:00000009

Change-Id: I80a1e0b3fecb24adba501ff44f568479deeff7fa
Signed-off-by: Minsung Kim <ms925.kim@samsung.com>
2013-04-26 18:22:06 +00:00
Rom Lemarchand
f6b2e06e61 android: configs: Initial commit of Android config fragments
- Add 2 files that contain the minimal and recommended kernel config
options respectively.
- Add a README to explain their purpose and how to use them to
generate a device config compatible with Android.

Change-Id: I3a4883f3b04d2820e90ceb3c4d02390d6458d6ce
Signed-off-by: Rom Lemarchand <romlem@google.com>
2013-04-24 22:30:08 +00:00
Rebecca Schultz Zavin
3ccc212f99 gpu: ion: Fix bug in ion shrinker
The high variable was sometimes used uninitialized

Change-Id: I2f51413fd2d063fdff325047e824dc8c749d9e0a
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
2013-04-24 14:51:48 -07:00
Dmitry Shmidt
ccf5d23b1d net: wireless: bcmdhd: Update to version 1.88.11
- Fix potential memory leak in wl_android_iolist_resume for Miracast command
- Check return value for "buf_key_b4_m4"
- Add Platform custom LISTEN INTERVAL
- Parse all P2P IEs to check for attributes

Change-Id: I892cd2efee425e38e08fbbec666c9a666eebe0cb
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2013-04-24 11:06:35 -07:00
Dmitry Shmidt
9849aab9c8 net: wireless: bcmdhd: Enable full scan on PNO event
Change-Id: I21cfbd5fd88ab528a481b3a215a922ec656c681f
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2013-04-24 10:28:59 -07:00
Dmitry Shmidt
357566d0a2 net: wireless: bcmdhd: Prevent recursive call of cfg80211_sched_scan_stopped()
Change-Id: I821313a69b2d2bb978917fc184bf9e095dd48c47
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2013-04-23 14:54:02 -07:00
Jamie Gennis
6460ff855d trace/events: fix gpu event timestamp formatting
This change fixes the how the gpu_sched_switch timestamp field is formatted.

Signed-off-by: Jamie Gennis <jgennis@google.com>
Change-Id: I273234935254ed15772c9e561c9af20e480004ae
2013-04-19 20:06:45 -07:00
Colin Cross
6a3b63009b ARM: convert build of appended dtb zImage to list of dtbs
Allow CONFIG_BUILD_ARM_APPENDED_DTB_IMAGE_NAMES to specify
a space separated list of dtbs to append to the zImage,
and name the resulting file zImage-dtb

Change-Id: I36d9108a2349bdbb373e95076dcb1417d8c7dce6
Signed-off-by: Colin Cross <ccross@android.com>
2013-04-19 19:49:58 +00:00
Rebecca Schultz Zavin
adfb519e67 gpu: ion: ion_chunk_heap: Zero chunk heap memory at creation time
Allocations from the ion heap need to be zeroed to protect userspace
from seeing memory belonging to other processes.  First allocations
from this heap were not zero'd allowing users to see memory from other
processes on a warm reset.

Change-Id: I524a7b79cb76c390c870fcf8b30d213185fc85a0
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
2013-04-19 04:58:37 +00:00
Peter Korsgaard
c8a011880c f_fs: ffs_func_free: cleanup requests allocated by autoconfig
functionfs was leaking request objects created by autoconfig.

Bug: 8659094

Change-Id: I641326cb5cb26e0a2ffa082cd2be2c21c66c38e5
Signed-off-by: Peter Korsgaard <peter.korsgaard@barco.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Benoit Goby <benoit@android.com>
2013-04-18 19:51:04 -07:00
JP Abgrall
ba6e9571a8 gpu: ion: fix kfree/list_del order
With CONFIG_SLUB_DEBUG_ON it would panic during
ion_alloc()
 ion_buffer_create()
   io_heap_drain_freelist()

Signed-off-by: JP Abgrall <jpa@google.com>
2013-04-15 14:26:39 -07:00
Dmitry Shmidt
b6d0c39dd8 net: wireless: bcmdhd: Update to version 1.88.10
- Check vndr pointer in case WPA Supplicant does not use probe_resp data
- Enable buf_key_b4_m4 to install the key after sending 4-way M4
  (802.1x EAPOL 4-way handshake may fail on Multiple VSDB situation)
- Improve P2P tx frame stuff

Change-Id: I5a46ebb50b37fbe6f4380f6e4deb8925603a56be
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2013-04-09 12:24:49 -07:00
JP Abgrall
bd91f6b218 netfilter: qtaguid: rate limit some of the printks
Some of the printks are in the packet handling path.
We now ratelimit the very unlikely errors to avoid
kmsg spamming.


Signed-off-by: JP Abgrall <jpa@google.com>
2013-04-08 15:09:26 -07:00
Dmitry Shmidt
485023a1a9 net: wireless: bcmdhd: Fix WEP-104 authentication
Change-Id: I2c80e7ff393050978d35f997f24ee82d7e4c20d1
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2013-04-08 13:44:36 -07:00
Colin Cross
d80428a98b This is the 3.4.39 stable release
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.19 (GNU/Linux)
 
 iQIbBAABAgAGBQJRXwUwAAoJEDjbvchgkmk+XFcP902iMBRyI3GXUK63pEjW/dZl
 rn8Ayje2lOb18Vk6eJWo/0QGEoruPPGU3apI+csdc8NTAKXtFjax0KKDRHg10pUB
 AXbhe5DvBhyKM/KUxafVnMZcc+h1Uw3ir1DF2Y65uxI4PISaOjPSRj60ifu4ipxd
 VlN49Hhzyk4oUvpuGMakwVx2NdH7cfYAWkCN64N80AztWPn86P8oDdkFHbvOg8DY
 5UEwygkmudNKWZDyc/3aiVxYZYleUptyzSZ16hK1a9cfdkH3m0s6EEEx+inmfaqt
 n4Xywt9PNpUvbMK6fTc3rYJhoyHC3kjjDakKwp++uBcmC1Iuj3ru3yULOqatEJDt
 mb3svYkRsdOmK0VO0ixbZqfc+PfS5HlDNvNHjGojjmcwae0WNnqWfbYBm5qKXJ4d
 Ve15pznG5fQ6H2h2wBWYJtmfPRozIvjpFuHdgHJ9q95xgsTXDNplpH5klzkOll1l
 e0Xn/4gVlU6B9bCZ+i8GLO5U1xwFRLPs9eh5hHH+hnNdQTogmZJ/tN/8qigXqDSE
 WNWCJ0Ap3MgGpNBh6hij+SFOo0/ewQdzoALtuju8xLaILzRXH4rBWEbGhAEVU+dp
 CK8KZRD3cD2iSVVAwSxtsnum9OCkdL6ljGywIUTqxMHPpg7w0JhO7PyhNV/YOSrZ
 Z9XcqVLwVZuGo1mdXvQ=
 =KYRz
 -----END PGP SIGNATURE-----

Merge tag 'v3.4.39' into android-3.4

This is the 3.4.39 stable release
2013-04-05 20:54:49 -07:00
Greg Kroah-Hartman
cbfed955f4 Linux 3.4.39 2013-04-05 10:08:54 -07:00
Greg Kroah-Hartman
29fcbcb3e0 Revert "xen/blkback: Don't trust the handle from the frontend."
This reverts commit c93c85196e which is
commit 01c681d4c7 upstream.

It shouldn't have been applied to the 3.4-stable tree, sorry about that.

Reported-by: William Dauchy <wdauchy@gmail.com>
Cc: Jan Beulich <jbeulich@suse.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:52 -07:00
Veaceslav Falico
aa5ec2292c bonding: get netdev_rx_handler_unregister out of locks
[ Upstream commit fcd99434fb ]

Now that netdev_rx_handler_unregister contains synchronize_net(), we need
to call it outside of bond->lock, cause it might sleep. Also, remove the
already unneded synchronize_net().

Signed-off-by: Veaceslav Falico <vfalico@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:52 -07:00
Steve Glendinning
c8438198c0 smsc75xx: fix jumbo frame support
[ Upstream commit 4c51e53689 ]

This patch enables RX of jumbo frames for LAN7500.

Previously the driver would transmit jumbo frames succesfully but
would drop received jumbo frames (incrementing the interface errors
count).

With this patch applied the device can succesfully receive jumbo
frames up to MTU 9000 (9014 bytes on the wire including ethernet
header).

Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:51 -07:00
Veaceslav Falico
74bed69914 pch_gbe: fix ip_summed checksum reporting on rx
[ Upstream commit 76a0e68129 ]

skb->ip_summed should be CHECKSUM_UNNECESSARY when the driver reports that
checksums were correct and CHECKSUM_NONE in any other case. They're
currently placed vice versa, which breaks the forwarding scenario. Fix it
by placing them as described above.

Signed-off-by: Veaceslav Falico <vfalico@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:51 -07:00
Eric Dumazet
f0180de266 net: add a synchronize_net() in netdev_rx_handler_unregister()
[ Upstream commit 00cfec3748 ]

commit 35d48903e9 (bonding: fix rx_handler locking) added a race
in bonding driver, reported by Steven Rostedt who did a very good
diagnosis :

<quoting Steven>

I'm currently debugging a crash in an old 3.0-rt kernel that one of our
customers is seeing. The bug happens with a stress test that loads and
unloads the bonding module in a loop (I don't know all the details as
I'm not the one that is directly interacting with the customer). But the
bug looks to be something that may still be present and possibly present
in mainline too. It will just be much harder to trigger it in mainline.

In -rt, interrupts are threads, and can schedule in and out just like
any other thread. Note, mainline now supports interrupt threads so this
may be easily reproducible in mainline as well. I don't have the ability
to tell the customer to try mainline or other kernels, so my hands are
somewhat tied to what I can do.

But according to a core dump, I tracked down that the eth irq thread
crashed in bond_handle_frame() here:

        slave = bond_slave_get_rcu(skb->dev);
        bond = slave->bond; <--- BUG

the slave returned was NULL and accessing slave->bond caused a NULL
pointer dereference.

Looking at the code that unregisters the handler:

void netdev_rx_handler_unregister(struct net_device *dev)
{

        ASSERT_RTNL();
        RCU_INIT_POINTER(dev->rx_handler, NULL);
        RCU_INIT_POINTER(dev->rx_handler_data, NULL);
}

Which is basically:
        dev->rx_handler = NULL;
        dev->rx_handler_data = NULL;

And looking at __netif_receive_skb() we have:

        rx_handler = rcu_dereference(skb->dev->rx_handler);
        if (rx_handler) {
                if (pt_prev) {
                        ret = deliver_skb(skb, pt_prev, orig_dev);
                        pt_prev = NULL;
                }
                switch (rx_handler(&skb)) {

My question to all of you is, what stops this interrupt from happening
while the bonding module is unloading?  What happens if the interrupt
triggers and we have this:

        CPU0                    CPU1
        ----                    ----
  rx_handler = skb->dev->rx_handler

                        netdev_rx_handler_unregister() {
                           dev->rx_handler = NULL;
                           dev->rx_handler_data = NULL;

  rx_handler()
   bond_handle_frame() {
    slave = skb->dev->rx_handler;
    bond = slave->bond; <-- NULL pointer dereference!!!

What protection am I missing in the bond release handler that would
prevent the above from happening?

</quoting Steven>

We can fix bug this in two ways. First is adding a test in
bond_handle_frame() and others to check if rx_handler_data is NULL.

A second way is adding a synchronize_net() in
netdev_rx_handler_unregister() to make sure that a rcu protected reader
has the guarantee to see a non NULL rx_handler_data.

The second way is better as it avoids an extra test in fast path.

Reported-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jiri Pirko <jpirko@redhat.com>
Cc: Paul E. McKenney <paulmck@us.ibm.com>
Acked-by: Steven Rostedt <rostedt@goodmis.org>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:47 -07:00
Max.Nekludov@us.elster.com
5afd933cc4 ks8851: Fix interpretation of rxlen field.
[ Upstream commit 14bc435ea5 ]

According to the Datasheet (page 52):
15-12 Reserved
11-0 RXBC Receive Byte Count
This field indicates the present received frame byte size.

The code has a bug:
                 rxh = ks8851_rdreg32(ks, KS_RXFHSR);
                 rxstat = rxh & 0xffff;
                 rxlen = rxh >> 16; // BUG!!! 0xFFF mask should be applied

Signed-off-by: Max Nekludov <Max.Nekludov@us.elster.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:41 -07:00
Hannes Frederic Sowa
567a4ac4b7 ipv6: don't accept node local multicast traffic from the wire
[ Upstream commit 1c4a154e52 ]

Erik Hugne's errata proposal (Errata ID: 3480) to RFC4291 has been
verified: http://www.rfc-editor.org/errata_search.php?eid=3480

We have to check for pkt_type and loopback flag because either the
packets are allowed to travel over the loopback interface (in which case
pkt_type is PACKET_HOST and IFF_LOOPBACK flag is set) or they travel
over a non-loopback interface back to us (in which case PACKET_TYPE is
PACKET_LOOPBACK and IFF_LOOPBACK flag is not set).

Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Erik Hugne <erik.hugne@ericsson.com>
Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:41 -07:00
Hong Zhiguo
6a519979f9 ipv6: fix bad free of addrconf_init_net
[ Upstream commit a79ca223e0 ]

Signed-off-by: Hong Zhiguo <honkiko@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:41 -07:00
Hannes Frederic Sowa
df19106f45 ipv6: don't accept multicast traffic with scope 0
[ Upstream commit 20314092c1 ]

v2:
a) moved before multicast source address check
b) changed comment to netdev style

Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Cc: Erik Hugne <erik.hugne@ericsson.com>
Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:41 -07:00
Joseph CHANG
ccb926f51c DM9000B: driver initialization upgrade
[ Upstream commit 6741f40d19 ]

Fix bug for DM9000 revision B which contain a DSP PHY

DM9000B use DSP PHY instead previouse DM9000 revisions' analog PHY,
So need extra change in initialization, For
explicity PHY Reset and PHY init parameter, and
first DM9000_NCR reset need NCR_MAC_LBK bit by dm9000_probe().

Following DM9000_NCR reset cause by dm9000_open() clear the
NCR_MAC_LBK bit.

Without this fix, Power-up FIFO pointers error happen around 2%
rate among Davicom's customers' boards. With this fix, All above
cases can be solved.

Signed-off-by: Joseph CHANG <josright123@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:40 -07:00
Hannes Frederic Sowa
98b3a5734c atl1e: drop pci-msi support because of packet corruption
[ Upstream commit 188ab1b105 ]

Usage of pci-msi results in corrupted dma packet transfers to the host.

Reported-by: rebelyouth <rebelyouth.hacklab@gmail.com>
Cc: Huang, Xiong <xiong@qca.qualcomm.com>
Tested-by: Christian Sünkenberg <christian.suenkenberg@student.kit.edu>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:40 -07:00
Eric Dumazet
d97bcfae8b aoe: reserve enough headroom on skbs
[ Upstream commit 91c5746425 ]

Some network drivers use a non default hard_header_len

Transmitted skb should take into account dev->hard_header_len, or risk
crashes or expensive reallocations.

In the case of aoe, lets reserve MAX_HEADER bytes.

David reported a crash in defxx driver, solved by this patch.

Reported-by: David Oostdyk <daveo@ll.mit.edu>
Tested-by: David Oostdyk <daveo@ll.mit.edu>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Ed Cashin <ecashin@coraid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:40 -07:00
Andrey Vagin
a930484427 net: fix *_DIAG_MAX constants
[ Upstream commit ae5fc98728 ]

Follow the common pattern and define *_DIAG_MAX like:

        [...]
        __XXX_DIAG_MAX,
};

Because everyone is used to do:

        struct nlattr *attrs[XXX_DIAG_MAX+1];

        nla_parse([...], XXX_DIAG_MAX, [...]

Reported-by: Thomas Graf <tgraf@suug.ch>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:40 -07:00
Mugunthan V N
71ec40e8f0 drivers: net: ethernet: cpsw: use netif_wake_queue() while restarting tx queue
[ Upstream commit b56d6b3fca ]

To restart tx queue use netif_wake_queue() intead of netif_start_queue()
so that net schedule will restart transmission immediately which will
increase network performance while doing huge data transfers.

Reported-by: Dan Franke <dan.franke@schneider-electric.com>
Suggested-by: Sriramakrishnan A G <srk@ti.com>
Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:40 -07:00
Mugunthan V N
86f1b8c36b drivers: net: ethernet: davinci_emac: use netif_wake_queue() while restarting tx queue
To restart tx queue use netif_wake_queue() intead of netif_start_queue()
so that net schedule will restart transmission immediately which will
increase network performance while doing huge data transfers.

Reported-by: Dan Franke <dan.franke@schneider-electric.com>
Suggested-by: Sriramakrishnan A G <srk@ti.com>
Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:40 -07:00
nikolay@redhat.com
ae8c63b03d bonding: fix disabling of arp_interval and miimon
[ Upstream commit 1bc7db1678 ]

Currently if either arp_interval or miimon is disabled, they both get
disabled, and upon disabling they get executed once more which is not
the proper behaviour. Also when doing a no-op and disabling an already
disabled one, the other again gets disabled.
Also fix the error messages with the proper valid ranges, and a small
typo fix in the up delay error message (outputting "down delay", instead
of "up delay").

Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:39 -07:00
nikolay@redhat.com
d98ea18887 bonding: fix miimon and arp_interval delayed work race conditions
[ Upstream commit fbb0c41b81 ]

First I would give three observations which will be used later.
Observation 1: if (delayed_work_pending(wq)) cancel_delayed_work(wq)
 This usage is wrong because the pending bit is cleared just before the
 work's fn is executed and if the function re-arms itself we might end up
 with the work still running. It's safe to call cancel_delayed_work_sync()
 even if the work is not queued at all.
Observation 2: Use of INIT_DELAYED_WORK()
 Work needs to be initialized only once prior to (de/en)queueing.
Observation 3: IFF_UP is set only after ndo_open is called

Related race conditions:
1. Race between bonding_store_miimon() and bonding_store_arp_interval()
 Because of Obs.1 we can end up having both works enqueued.
2. Multiple races with INIT_DELAYED_WORK()
 Since the works are not protected by anything between INIT_DELAYED_WORK()
 and calls to (en/de)queue it is possible for races between the following
 functions:
 (races are also possible between the calls to INIT_DELAYED_WORK()
  and workqueue code)
 bonding_store_miimon() - bonding_store_arp_interval(), bond_close(),
			  bond_open(), enqueued functions
 bonding_store_arp_interval() - bonding_store_miimon(), bond_close(),
				bond_open(), enqueued functions
3. By Obs.1 we need to change bond_cancel_all()

Bugs 1 and 2 are fixed by moving all work initializations in bond_open
which by Obs. 2 and Obs. 3 and the fact that we make sure that all works
are cancelled in bond_close(), is guaranteed not to have any work
enqueued.
Also RTNL lock is now acquired in bonding_store_miimon/arp_interval so
they can't race with bond_close and bond_open. The opposing work is
cancelled only if the IFF_UP flag is set and it is cancelled
unconditionally. The opposing work is already cancelled if the interface
is down so no need to cancel it again. This way we don't need new
synchronizations for the bonding workqueue. These bugs (and fixes) are
tied together and belong in the same patch.
Note: I have left 1 line intentionally over 80 characters (84) because I
      didn't like how it looks broken down. If you'd prefer it otherwise,
      then simply break it.

 v2: Make description text < 75 columns

Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:39 -07:00
Veaceslav Falico
b11b7d9b96 bonding: remove already created master sysfs link on failure
[ Upstream commit 9fe16b78ee ]

If slave sysfs symlink failes to be created - we end up without removing
the master sysfs symlink. Remove it in case of failure.

Signed-off-by: Veaceslav Falico <vfalico@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:39 -07:00
Paul Moore
fbb7347e85 unix: fix a race condition in unix_release()
[ Upstream commit ded34e0fe8 ]

As reported by Jan, and others over the past few years, there is a
race condition caused by unix_release setting the sock->sk pointer
to NULL before properly marking the socket as dead/orphaned.  This
can cause a problem with the LSM hook security_unix_may_send() if
there is another socket attempting to write to this partially
released socket in between when sock->sk is set to NULL and it is
marked as dead/orphaned.  This patch fixes this by only setting
sock->sk to NULL after the socket has been marked as dead; I also
take the opportunity to make unix_release_sock() a void function
as it only ever returned 0/success.

Dave, I think this one should go on the -stable pile.

Special thanks to Jan for coming up with a reproducer for this
problem.

Reported-by: Jan Stancek <jan.stancek@gmail.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:39 -07:00
Masatake YAMATO
b9f3bf1d0f thermal: shorten too long mcast group name
[ Upstream commits 73214f5d9f
  and f1e79e2080, the latter
  adds an assertion to genetlink to prevent this from happening
  again in the future. ]

The original name is too long.

Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:38 -07:00
Cong Wang
a83417946d 8021q: fix a potential use-after-free
[ Upstream commit 4a7df340ed ]

vlan_vid_del() could possibly free ->vlan_info after a RCU grace
period, however, we may still refer to the freed memory area
by 'grp' pointer. Found by code inspection.

This patch moves vlan_vid_del() as behind as possible.

Signed-off-by: Cong Wang <amwang@redhat.com>
Cc: Patrick McHardy <kaber@trash.net>
Cc: "David S. Miller" <davem@davemloft.net>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:38 -07:00
Yuchung Cheng
d1f60c6d91 tcp: undo spurious timeout after SACK reneging
[ Upstream commit 7ebe183c6d ]

On SACK reneging the sender immediately retransmits and forces a
timeout but disables Eifel (undo). If the (buggy) receiver does not
drop any packet this can trigger a false slow-start retransmit storm
driven by the ACKs of the original packets. This can be detected with
undo and TCP timestamps.

Signed-off-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:38 -07:00
Eric Dumazet
21b56e0f08 tcp: preserve ACK clocking in TSO
[ Upstream commit f4541d60a4 ]

A long standing problem with TSO is the fact that tcp_tso_should_defer()
rearms the deferred timer, while it should not.

Current code leads to following bad bursty behavior :

20:11:24.484333 IP A > B: . 297161:316921(19760) ack 1 win 119
20:11:24.484337 IP B > A: . ack 263721 win 1117
20:11:24.485086 IP B > A: . ack 265241 win 1117
20:11:24.485925 IP B > A: . ack 266761 win 1117
20:11:24.486759 IP B > A: . ack 268281 win 1117
20:11:24.487594 IP B > A: . ack 269801 win 1117
20:11:24.488430 IP B > A: . ack 271321 win 1117
20:11:24.489267 IP B > A: . ack 272841 win 1117
20:11:24.490104 IP B > A: . ack 274361 win 1117
20:11:24.490939 IP B > A: . ack 275881 win 1117
20:11:24.491775 IP B > A: . ack 277401 win 1117
20:11:24.491784 IP A > B: . 316921:332881(15960) ack 1 win 119
20:11:24.492620 IP B > A: . ack 278921 win 1117
20:11:24.493448 IP B > A: . ack 280441 win 1117
20:11:24.494286 IP B > A: . ack 281961 win 1117
20:11:24.495122 IP B > A: . ack 283481 win 1117
20:11:24.495958 IP B > A: . ack 285001 win 1117
20:11:24.496791 IP B > A: . ack 286521 win 1117
20:11:24.497628 IP B > A: . ack 288041 win 1117
20:11:24.498459 IP B > A: . ack 289561 win 1117
20:11:24.499296 IP B > A: . ack 291081 win 1117
20:11:24.500133 IP B > A: . ack 292601 win 1117
20:11:24.500970 IP B > A: . ack 294121 win 1117
20:11:24.501388 IP B > A: . ack 295641 win 1117
20:11:24.501398 IP A > B: . 332881:351881(19000) ack 1 win 119

While the expected behavior is more like :

20:19:49.259620 IP A > B: . 197601:202161(4560) ack 1 win 119
20:19:49.260446 IP B > A: . ack 154281 win 1212
20:19:49.261282 IP B > A: . ack 155801 win 1212
20:19:49.262125 IP B > A: . ack 157321 win 1212
20:19:49.262136 IP A > B: . 202161:206721(4560) ack 1 win 119
20:19:49.262958 IP B > A: . ack 158841 win 1212
20:19:49.263795 IP B > A: . ack 160361 win 1212
20:19:49.264628 IP B > A: . ack 161881 win 1212
20:19:49.264637 IP A > B: . 206721:211281(4560) ack 1 win 119
20:19:49.265465 IP B > A: . ack 163401 win 1212
20:19:49.265886 IP B > A: . ack 164921 win 1212
20:19:49.266722 IP B > A: . ack 166441 win 1212
20:19:49.266732 IP A > B: . 211281:215841(4560) ack 1 win 119
20:19:49.267559 IP B > A: . ack 167961 win 1212
20:19:49.268394 IP B > A: . ack 169481 win 1212
20:19:49.269232 IP B > A: . ack 171001 win 1212
20:19:49.269241 IP A > B: . 215841:221161(5320) ack 1 win 119

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Van Jacobson <vanj@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Nandita Dukkipati <nanditad@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-05 10:04:38 -07:00