summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | net/apne: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERODuan Jiong2014-04-121-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes coccinelle error regarding usage of IS_ERR and PTR_ERR instead of PTR_ERR_OR_ZERO. Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | net: ipv6: Fix oif in TCP SYN+ACK route lookup.Lorenzo Colitti2014-04-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | net-next commit 9c76a11, ipv6: tcp_ipv6 policy route issue, had a boolean logic error that caused incorrect behaviour for TCP SYN+ACK when oif-based rules are in use. Specifically: 1. If a SYN comes in from a global address, and sk_bound_dev_if is not set, the routing lookup has oif set to the interface the SYN came in on. Instead, it should have oif unset, because for global addresses, the incoming interface doesn't necessarily have any bearing on the interface the SYN+ACK is sent out on. 2. If a SYN comes in from a link-local address, and sk_bound_dev_if is set, the routing lookup has oif set to the interface the SYN came in on. Instead, it should have oif set to sk_bound_dev_if, because that's what the application requested. Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | Merge branch 'for-davem' of ↵David S. Miller2014-04-1112-62/+66
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless John W. Linville says: ==================== Please pull this batch of fixes intended for the 3.15 stream! Chun-Yeow Yeoh gives us an ath9k_htc fix so that mac80211 can report last_tx_rate correctly for those devices.. Fariya Fatima has a number of small fixes for things identified by the static analysis folks in the new rsi driver. Felix Fietkau brings an ath9k fix to better support some older chips, and a fix for a scheduling while atomic bug introduced by an earlier patch. Janusz Dziedzic produced an ath9k fix to only enable DFS when a related build option is selected. Paul Bolle removes some dead code in rtlwifi. Rafał Miłecki fixes some b43 code that was accessing some registers with operations for the wrong register width. Please let me know if there are problems! ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| | * \ \ Merge branch 'master' of ↵John W. Linville2014-04-1012-62/+66
| | |\ \ \ | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
| | | * | | ath9k: fix a scheduling while atomic bug in CSA handlingFelix Fietkau2014-04-091-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit "ath9k: prepare for multi-interface CSA support" added a call to ieee80211_iterate_active_interfaces in atomic context (beacon tasklet), which is crashing. Use ieee80211_iterate_active_interfaces_atomic instead. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | ath9k_hw: reduce ANI firstep range for older chipsFelix Fietkau2014-04-091-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use 0-8 instead of 0-16, which is closer to the old implementation. Also drop the overwrite of the firstep_low parameter to improve stability. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | ath9k: Enable DFS only when ATH9K_DFS_CERTIFIEDJanusz Dziedzic2014-04-091-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add DFS interface combination only when CONFIG_ATH9K_DFS_CERTIFIED is set. In other case user can run CAC/beaconing without proper handling of pulse events (without radar detection activated). Reported-by: Cedric Voncken <cedric.voncken@acksys.fr> Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | b43: Fix machine check error due to improper access of B43_MMIO_PSM_PHY_HDRRafał Miłecki2014-04-091-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Register B43_MMIO_PSM_PHY_HDR is 16 bit one, so accessing it with 32b functions isn't safe. On my machine it causes delayed (!) CPU exception: Disabling lock debugging due to kernel taint mce: [Hardware Error]: CPU 0: Machine Check Exception: 4 Bank 4: b200000000070f0f mce: [Hardware Error]: TSC 164083803dc mce: [Hardware Error]: PROCESSOR 2:20fc2 TIME 1396650505 SOCKET 0 APIC 0 microcode 0 mce: [Hardware Error]: Run the above through 'mcelog --ascii' mce: [Hardware Error]: Machine check: Processor context corrupt Kernel panic - not syncing: Fatal machine check on current CPU Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff) Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Stable <stable@vger.kernel.org> [2.6.35+] Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | rtlwifi: btcoexist: remove undefined Kconfig macrosPaul Bolle2014-04-091-10/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are references to four undefined Kconfig macros in the code. Commit 8542373dccd2 ("Staging: rtl8812ae: remove undefined Kconfig macros") removed identical references from that staging driver, but they resurfaced in rtlwifi. Remove these again as the checks for them still will always evaluate to false. Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | ath9k_htc: set IEEE80211_TX_STAT_AMPDU for acked aggregated framesChun-Yeow Yeoh2014-04-091-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Frame aggregation requires the IEEE80211_TX_STAT_AMPDU to be set so that mac80211 can report the last_tx_rate correctly. Signed-off-by: Chun-Yeow Yeoh <yeohchunyeow@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | rsi: Fixed issue relating to doing dma on stack error.Fariya Fatima2014-04-091-7/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Fariya Fatima <fariyaf@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | rsi: Fixed issue relating to index of q_num.Fariya Fatima2014-04-091-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Fariya Fatima <fariyaf@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | rsi: Fixed issue relating to return value.Fariya Fatima2014-04-091-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Fariya Fatima <fariyaf@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | rsi: Fixed issue relating to variable de-referenced before check 'adapter'Fariya Fatima2014-04-091-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Fariya Fatima <fariyaf@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | rsi: Fixed signedness bug reported by static code analyzer.Fariya Fatima2014-04-091-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Fariya Fatima <fariyaf@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | | * | | rsi: Potential null pointer derefernce issue fixed.Fariya Fatima2014-04-091-19/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Fariya Fatima <fariyaf@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * | | | | Merge branch 'cpsw'David S. Miller2014-04-111-7/+7
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mugunthan V N says: ==================== This patch series fixes the cpsw issue with interface up/dpwn with high ethernet traffic. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | | | drivers: net: cpsw: enable interrupts after napi enable and clearing ↵Mugunthan V N2014-04-111-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | previous interrupts When the Ethernet interface is put down and up with heavy Ethernet traffic, then there is prossibility of an interrupt waiting in irq controller to be processed, so when the interface is brought up again just after enable interrupt, it goes to ISR due to the previous unhandled interrutp and in ISR napi is not scheduled as the napi is not enabled in ndo_open which results in disabled interrupt for CPSW and no packets are received in cpsw. So this patch moves enabling of interupts after napi_enable and clearing CPDMA interrupts. Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | | | drivers: net: cpsw: discard all packets received when interface is downMugunthan V N2014-04-111-1/+1
| |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the Ethernet interface is brought down during high Ethernet traffic, then cpsw creates the following warn dump. When cpdma has already processed the packet then the status will be greater than 0, so the cpsw_rx_handler considers that the interface is up and try to resubmit one more rx buffer to cpdma which fails as the DMA is in teardown process. This can be avoided by checking the interface state and then process the received packet, if the interface is down just discard and free the skb and return. [ 2823.104591] WARNING: CPU: 0 PID: 1823 at drivers/net/ethernet/ti/cpsw.c:711 cpsw_rx_handler+0x148/0x164() [ 2823.114654] Modules linked in: [ 2823.117872] CPU: 0 PID: 1823 Comm: ifconfig Tainted: G W 3.14.0-11992-gf34c4a3 #11 [ 2823.126860] [<c0014b5c>] (unwind_backtrace) from [<c00117e4>] (show_stack+0x10/0x14) [ 2823.135030] [<c00117e4>] (show_stack) from [<c0533a9c>] (dump_stack+0x80/0x9c) [ 2823.142619] [<c0533a9c>] (dump_stack) from [<c003f0e0>] (warn_slowpath_common+0x6c/0x90) [ 2823.151141] [<c003f0e0>] (warn_slowpath_common) from [<c003f120>] (warn_slowpath_null+0x1c/0x24) [ 2823.160336] [<c003f120>] (warn_slowpath_null) from [<c03caeb0>] (cpsw_rx_handler+0x148/0x164) [ 2823.169314] [<c03caeb0>] (cpsw_rx_handler) from [<c03c730c>] (__cpdma_chan_free+0x90/0xa8) [ 2823.178028] [<c03c730c>] (__cpdma_chan_free) from [<c03c7418>] (__cpdma_chan_process+0xf4/0x134) [ 2823.187279] [<c03c7418>] (__cpdma_chan_process) from [<c03c7560>] (cpdma_chan_stop+0xb4/0x17c) [ 2823.196349] [<c03c7560>] (cpdma_chan_stop) from [<c03c766c>] (cpdma_ctlr_stop+0x44/0x9c) [ 2823.204872] [<c03c766c>] (cpdma_ctlr_stop) from [<c03cb708>] (cpsw_ndo_stop+0x154/0x188) [ 2823.213321] [<c03cb708>] (cpsw_ndo_stop) from [<c046f0ec>] (__dev_close_many+0x84/0xc8) [ 2823.221761] [<c046f0ec>] (__dev_close_many) from [<c046f158>] (__dev_close+0x28/0x3c) [ 2823.230012] [<c046f158>] (__dev_close) from [<c0474ca8>] (__dev_change_flags+0x88/0x160) [ 2823.238483] [<c0474ca8>] (__dev_change_flags) from [<c0474da0>] (dev_change_flags+0x18/0x48) [ 2823.247316] [<c0474da0>] (dev_change_flags) from [<c04d12c4>] (devinet_ioctl+0x61c/0x6e0) [ 2823.255884] [<c04d12c4>] (devinet_ioctl) from [<c045c660>] (sock_ioctl+0x68/0x2a4) [ 2823.263789] [<c045c660>] (sock_ioctl) from [<c0125fe4>] (do_vfs_ioctl+0x78/0x61c) [ 2823.271629] [<c0125fe4>] (do_vfs_ioctl) from [<c01265ec>] (SyS_ioctl+0x64/0x74) [ 2823.279284] [<c01265ec>] (SyS_ioctl) from [<c000e580>] (ret_fast_syscall+0x0/0x48) Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | net: Fix use after free by removing length arg from sk_data_ready callbacks.David S. Miller2014-04-1158-121/+112
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Several spots in the kernel perform a sequence like: skb_queue_tail(&sk->s_receive_queue, skb); sk->sk_data_ready(sk, skb->len); But at the moment we place the SKB onto the socket receive queue it can be consumed and freed up. So this skb->len access is potentially to freed up memory. Furthermore, the skb->len can be modified by the consumer so it is possible that the value isn't accurate. And finally, no actual implementation of this callback actually uses the length argument. And since nobody actually cared about it's value, lots of call sites pass arbitrary values in such as '0' and even '1'. So just remove the length argument from the callback, that way there is no confusion whatsoever and all of these use-after-free cases get fixed as a side effect. Based upon a patch by Eric Dumazet and his suggestion to audit this issue tree-wide. Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | Merge branch 'hyperv'David S. Miller2014-04-114-4/+41
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | K. Y. Srinivasan says: ==================== Fix issues with Heper-V network offload code WS2008 R2 does not support udp checksum offload. Furthermore, ws2012 and ws2012 r2 have issues offloading udp checksum from Linux guests. This patch-set addresses these issues as well as other bug fixes. Please apply. In this version, I have addressed the comment from David Miller with reagards to COWing the skb prior to modifying the header (patch 3/3). ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | | | Drivers: net: hyperv: Address UDP checksum issuesKY Srinivasan2014-04-113-2/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ws2008r2 does not support UDP checksum offload. Thus, we cannnot turn on UDP offload in the host. Also, on ws2012 and ws2012 r2, there appear to be an issue with UDP checksum offload. Fix this issue by computing the UDP checksum in the Hyper-V driver. Based on Dave Miller's comments, in this version, I have COWed the skb before modifying the UDP header (the checksum field). Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | | | Drivers: net: hyperv: Negotiate suitable ndis version for offload supportKY Srinivasan2014-04-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ws2008R2 supports ndis_version 6.1 and 6.1 is the minimal version required for various offloads. Negotiate ndis_version 6.1 when on ws2008r2. Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * | | | | Drivers: net: hyperv: Allocate memory for all possible per-pecket informationKY Srinivasan2014-04-111-1/+3
| |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | An outgoing packet can potentially need per-packet information for all the offloads and VLAN tagging. Fix this issue. Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | bridge: Fix double free and memory leak around br_allowed_ingressToshiaki Makita2014-04-112-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | br_allowed_ingress() has two problems. 1. If br_allowed_ingress() is called by br_handle_frame_finish() and vlan_untag() in br_allowed_ingress() fails, skb will be freed by both vlan_untag() and br_handle_frame_finish(). 2. If br_allowed_ingress() is called by br_dev_xmit() and br_allowed_ingress() fails, the skb will not be freed. Fix these two problems by freeing the skb in br_allowed_ingress() if it fails. Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | bonding: Remove debug_fs files when module init failsThomas Richter2014-04-111-0/+1
| | |_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the bonding debug_fs entries when the module initialization fails. The debug_fs entries should be removed together with all other already allocated resources. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Signed-off-by: Jay Vosburgh <j.vosburgh@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | net: core: don't account for udp header size when computing seglenFlorian Westphal2014-04-101-5/+7
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In case of tcp, gso_size contains the tcpmss. For UFO (udp fragmentation offloading) skbs, gso_size is the fragment payload size, i.e. we must not account for udp header size. Otherwise, when using virtio drivers, a to-be-forwarded UFO GSO packet will be needlessly fragmented in the forward path, because we think its individual segments are too large for the outgoing link. Fixes: fe6cc55f3a9a053 ("net: ip, ipv6: handle gso skbs in forwarding path") Cc: Eric Dumazet <eric.dumazet@gmail.com> Reported-by: Tobias Brunner <tobias@strongswan.org> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | l2tp: take PMTU from tunnel UDP socketDmitry Petukhov2014-04-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When l2tp driver tries to get PMTU for the tunnel destination, it uses the pointer to struct sock that represents PPPoX socket, while it should use the pointer that represents UDP socket of the tunnel. Signed-off-by: Dmitry Petukhov <dmgenp@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | drivers: net: cpsw: Add default vlan for dual emac case alsoMugunthan V N2014-04-091-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Dual EMAC works with VLAN segregation of the ports, so default vlan needs to be added in dual EMAC case else default vlan will be tagged for all egress packets and vlan unaware switches/servers will drop packets from the EVM. Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com> Tested-by: Yegor Yefremov <yegorslists@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | net phylib: Remove unnecessary condition check in phyBalakumaran Kannan2014-04-091-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This condition check makes no difference in the code flow since 3.10 Signed-off-by: Balakumaran Kannan <kumaran.4353@gmail.com> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | net: sctp: test if association is dead in sctp_wake_up_waitersDaniel Borkmann2014-04-091-0/+6
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In function sctp_wake_up_waiters(), we need to involve a test if the association is declared dead. If so, we don't have any reference to a possible sibling association anymore and need to invoke sctp_write_space() instead, and normally walk the socket's associations and notify them of new wmem space. The reason for special casing is that otherwise, we could run into the following issue when a sctp_primitive_SEND() call from sctp_sendmsg() fails, and tries to flush an association's outq, i.e. in the following way: sctp_association_free() `-> list_del(&asoc->asocs) <-- poisons list pointer asoc->base.dead = true sctp_outq_free(&asoc->outqueue) `-> __sctp_outq_teardown() `-> sctp_chunk_free() `-> consume_skb() `-> sctp_wfree() `-> sctp_wake_up_waiters() <-- dereferences poisoned pointers if asoc->ep->sndbuf_policy=0 Therefore, only walk the list in an 'optimized' way if we find that the current association is still active. We could also use list_del_init() in addition when we call sctp_association_free(), but as Vlad suggests, we want to trap such bugs and thus leave it poisoned as is. Why is it safe to resolve the issue by testing for asoc->base.dead? Parallel calls to sctp_sendmsg() are protected under socket lock, that is lock_sock()/release_sock(). Only within that path under lock held, we're setting skb/chunk owner via sctp_set_owner_w(). Eventually, chunks are freed directly by an association still under that lock. So when traversing association list on destruction time from sctp_wake_up_waiters() via sctp_wfree(), a different CPU can't be running sctp_wfree() while another one calls sctp_association_free() as both happens under the same lock. Therefore, this can also not race with setting/testing against asoc->base.dead as we are guaranteed for this to happen in order, under lock. Further, Vlad says: the times we check asoc->base.dead is when we've cached an association pointer for later processing. In between cache and processing, the association may have been freed and is simply still around due to reference counts. We check asoc->base.dead under a lock, so it should always be safe to check and not race against sctp_association_free(). Stress-testing seems fine now, too. Fixes: cd253f9f357d ("net: sctp: wake up all assocs if sndbuf policy is per socket") Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Cc: Vlad Yasevich <vyasevic@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Vlad Yasevich <vyasevic@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | Merge tag 'blackfin-for-linus' of ↵Linus Torvalds2014-04-1237-1473/+1115
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/realmz6/blackfin-linux Pull blackfin updates from Steven Miao: "Code cleanup, some previously ignored patches, and bug fixes" * tag 'blackfin-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/realmz6/blackfin-linux: blackfin: cleanup board files bf609: clock: drop unused clock bit set/clear functions Blackfin: bf537: rename "CONFIG_ADT75" Blackfin: bf537: rename "CONFIG_AD7314" Blackfin: bf537: rename ad2s120x ->ad2s1200 blackfin: bf537: fix typo "CONFIG_SND_SOC_ADV80X_MODULE" blackfin: dma: current count mmr is read only bfin_crc: Move architecture independant crc header file out of the blackfin folder. bf54x: drop unuesd HOST status,control,timeout registers bit define macros blackfin: portmux: cleanup head file Blackfin: remove "config IP_CHECKSUM_L1" blackfin: Remove GENERIC_GPIO config option again blackfin:Use generic /proc/interrupts implementation blackfin: bf60x: fix typo "CONFIG_PM_BFIN_WAKE_PA15_POL"
| * | | blackfin: cleanup board filesSteven Miao2014-04-1228-1209/+1089
| | | | | | | | | | | | | | | | | | | | | | | | using IS_ENABLED() macro instead of defined(CONFIG_XXX) || defined(CONFIG_XXX_MODULE) Signed-off-by: Steven Miao <realmz6@gmail.com>
| * | | bf609: clock: drop unused clock bit set/clear functionsSteven Miao2014-04-121-18/+0
| | | | | | | | | | | | | | | | Signed-off-by: Steven Miao <realmz6@gmail.com>
| * | | Blackfin: bf537: rename "CONFIG_ADT75"Paul Bolle2014-04-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In v3.2 the Analog Devices ADT75 temperature sensor driver was removed as an IIO driver and support for it was added to the LM75 HWMON driver. But it was apparently overlooked to rename one reference to CONFIG_ADT75 to CONFIG_SENSORS_LM75. Do so now. Use the IS_ENABLED() macro, while we're at it. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
| * | | Blackfin: bf537: rename "CONFIG_AD7314"Paul Bolle2014-04-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In v3.2 the Analog Devices AD7314 temperature sensor driver was removed as an IIO driver and added as a HWMON driver. But it was apparently overlooked to rename two references to CONFIG_AD7314 to CONFIG_SENSORS_AD7314. Do so now. Use the IS_ENABLED() macro, while we're at it. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
| * | | Blackfin: bf537: rename ad2s120x ->ad2s1200Paul Bolle2014-04-121-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In v3.2 the Analog Devices ad2s1200/ad2s1205 driver was renamed from ad2s120x to ad2s1200. But it apparently forgot to rename the references to this driver in the BF537-STAMP code. Rename these now, and use the IS_ENABLED() macro, while we're at it. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
| * | | blackfin: bf537: fix typo "CONFIG_SND_SOC_ADV80X_MODULE"Paul Bolle2014-04-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's a (rather subtle) typo in "CONFIG_SND_SOC_ADV80X_MODULE". Fix it once and for all by using IS_ENABLED(), which is designed to avoid issues like this. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
| * | | blackfin: dma: current count mmr is read onlySonic Zhang2014-04-121-2/+0
| | | | | | | | | | | | | | | | Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
| * | | bfin_crc: Move architecture independant crc header file out of the blackfin ↵Sonic Zhang2014-04-121-125/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | folder. Signed-off-by: Sonic Zhang <sonic.zhang@analog.com> Signed-off-by: Steven Miao <realmz6@gmail.com>
| * | | bf54x: drop unuesd HOST status,control,timeout registers bit define macrosSteven Miao2014-04-122-60/+0
| | | | | | | | | | | | | | | | Signed-off-by: Steven Miao <realmz6@gmail.com>
| * | | blackfin: portmux: cleanup head fileSteven Miao2014-04-121-6/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | drop unused head file change pinmux request/free macro for backward compatiblity add function declaration Signed-off-by: Steven Miao <realmz6@gmail.com>
| * | | Blackfin: remove "config IP_CHECKSUM_L1"Paul Bolle2014-04-111-8/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The only user of Kconfig symbol IP_CHECKSUM_L1 got removed in v2.6.33, with commit ddf9ddacef0989fdeb22e182212a232488f0f3ad ("Blackfin: convert to generic checksum code"). We can remove the Kconfig entry for this unused symbol now. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
| * | | blackfin: Remove GENERIC_GPIO config option againPaul Bolle2014-04-111-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Kconfig symbol GENERIC_GPIO was removed in v3.10. Nothing cares about it anymore. It popped up somehow in v3.13, so it can be removed again. Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
| * | | blackfin:Use generic /proc/interrupts implementationThomas Gleixner2014-04-112-30/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is nothing special in that blackfin code. Use the core implementation. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Steven Miao <realmz6@gmail.com> Cc: bfin <adi-buildroot-devel@lists.sourceforge.net>
| * | | blackfin: bf60x: fix typo "CONFIG_PM_BFIN_WAKE_PA15_POL"Paul Bolle2014-04-111-1/+1
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: Steven Miao <realmz6@gmail.com>
* | | | Merge tag 'remoteproc-3.15-cleanups' of ↵Linus Torvalds2014-04-122-17/+3
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc Pull remoteproc cleanups from Ohad Ben-Cohen: "Several remoteproc cleanup patches coming from Jingoo Han, Julia Lawall and Uwe Kleine-König" * tag 'remoteproc-3.15-cleanups' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc: remoteproc/ste_modem: staticize local symbols remoteproc/davinci: simplify use of devm_ioremap_resource remoteproc/davinci: drop needless devm_clk_put
| * | | | remoteproc/ste_modem: staticize local symbolsJingoo Han2014-02-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These local symbols are used only in this file. Fix the following sparse warnings: drivers/remoteproc/ste_modem_rproc.c:167:27: warning: symbol 'sproc_fw_ops' was not declared. Should it be static? drivers/remoteproc/ste_modem_rproc.c:196:25: warning: symbol 'sproc_dev_cb' was not declared. Should it be static? Signed-off-by: Jingoo Han <jg1.han@samsung.com> [standartize patch title] Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
| * | | | remoteproc/davinci: simplify use of devm_ioremap_resourceJulia Lawall2014-02-241-13/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove unneeded error handling on the result of a call to platform_get_resource when the value is passed to devm_ioremap_resource. Move the call to platform_get_resource adjacent to the call to devm_ioremap_resource to make the connection between them more clear. A simplified version of the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression pdev,res,n,e,e1; expression ret != 0; identifier l; @@ - res = platform_get_resource(pdev, IORESOURCE_MEM, n); ... when != res - if (res == NULL) { ... \(goto l;\|return ret;\) } ... when != res + res = platform_get_resource(pdev, IORESOURCE_MEM, n); e = devm_ioremap_resource(e1, res); // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> [simplify patch title] Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
| * | | | remoteproc/davinci: drop needless devm_clk_putUwe Kleine-König2014-02-241-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The comment above disable_irq says that it is needed to ensure that the "devm subsystem might end up releasing things before freeing the irq, thus allowing an interrupt to sneak in while the device is being removed." disable_irq is enough for this purpose and there is no need to manually free the reference to the clock. Cc: Robert Tivy <rtivy@ti.com> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> [moved the Cc line into the commit message] Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
OpenPOWER on IntegriCloud