From 5933a7bbb5de66482ea8aa874a7ebaf8e67603c4 Mon Sep 17 00:00:00 2001 From: Mike Rapoport Date: Tue, 1 Apr 2014 09:23:01 +0300 Subject: net: vxlan: fix crash when interface is created with no group If the vxlan interface is created without explicit group definition, there are corner cases which may cause kernel panic. For instance, in the following scenario: node A: $ ip link add dev vxlan42 address 2c:c2:60:00:10:20 type vxlan id 42 $ ip addr add dev vxlan42 10.0.0.1/24 $ ip link set up dev vxlan42 $ arp -i vxlan42 -s 10.0.0.2 2c:c2:60:00:01:02 $ bridge fdb add dev vxlan42 to 2c:c2:60:00:01:02 dst $ ping 10.0.0.2 node B: $ ip link add dev vxlan42 address 2c:c2:60:00:01:02 type vxlan id 42 $ ip addr add dev vxlan42 10.0.0.2/24 $ ip link set up dev vxlan42 $ arp -i vxlan42 -s 10.0.0.1 2c:c2:60:00:10:20 node B crashes: vxlan42: 2c:c2:60:00:10:20 migrated from 4011:eca4:c0a8:6466:c0a8:6415:8e09:2118 to (invalid address) vxlan42: 2c:c2:60:00:10:20 migrated from 4011:eca4:c0a8:6466:c0a8:6415:8e09:2118 to (invalid address) BUG: unable to handle kernel NULL pointer dereference at 0000000000000046 IP: [] ip6_route_output+0x58/0x82 PGD 7bd89067 PUD 7bd4e067 PMD 0 Oops: 0000 [#1] SMP Modules linked in: CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.14.0-rc8-hvx-xen-00019-g97a5221-dirty #154 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: ffff88007c774f50 ti: ffff88007c79c000 task.ti: ffff88007c79c000 RIP: 0010:[] [] ip6_route_output+0x58/0x82 RSP: 0018:ffff88007fd03668 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff8186a000 RCX: 0000000000000040 RDX: 0000000000000000 RSI: ffff88007b0e4a80 RDI: ffff88007fd03754 RBP: ffff88007fd03688 R08: ffff88007b0e4a80 R09: 0000000000000000 R10: 0200000a0100000a R11: 0001002200000000 R12: ffff88007fd03740 R13: ffff88007b0e4a80 R14: ffff88007b0e4a80 R15: ffff88007bba0c50 FS: 0000000000000000(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000046 CR3: 000000007bb60000 CR4: 00000000000006e0 Stack: 0000000000000000 ffff88007fd037a0 ffffffff8186a000 ffff88007fd03740 ffff88007fd036c8 ffffffff814320bb 0000000000006e49 ffff88007b8b7360 ffff88007bdbf200 ffff88007bcbc000 ffff88007b8b7000 ffff88007b8b7360 Call Trace: [] ip6_dst_lookup_tail+0x2d/0xa4 [] ip6_dst_lookup+0x10/0x12 [] vxlan_xmit_one+0x32a/0x68c [] ? _raw_spin_unlock_irqrestore+0x12/0x14 [] ? lock_timer_base.isra.23+0x26/0x4b [] vxlan_xmit+0x66a/0x6a8 [] ? ipt_do_table+0x35f/0x37e [] ? selinux_ip_postroute+0x41/0x26e [] dev_hard_start_xmit+0x2ce/0x3ce [] __dev_queue_xmit+0x2d0/0x392 [] ? eth_header+0x28/0xb5 [] dev_queue_xmit+0xb/0xd [] neigh_resolve_output+0x134/0x152 [] ip_finish_output2+0x236/0x299 [] ip_finish_output+0x98/0x9d [] ip_output+0x62/0x67 [] dst_output+0xf/0x11 [] ip_local_out+0x1b/0x1f [] ip_send_skb+0x11/0x37 [] ip_push_pending_frames+0x2f/0x33 [] icmp_push_reply+0x106/0x115 [] icmp_reply+0x142/0x164 [] icmp_echo.part.16+0x46/0x48 [] ? nf_iterate+0x43/0x80 [] ? xfrm4_policy_check.constprop.11+0x52/0x52 [] icmp_echo+0x25/0x27 [] icmp_rcv+0x1d2/0x20a [] ? xfrm4_policy_check.constprop.11+0x52/0x52 [] ip_local_deliver_finish+0xd6/0x14f [] ? xfrm4_policy_check.constprop.11+0x52/0x52 [] NF_HOOK.constprop.10+0x4c/0x53 [] ip_local_deliver+0x4a/0x4f [] ip_rcv_finish+0x253/0x26a [] ? inet_add_protocol+0x3e/0x3e [] NF_HOOK.constprop.10+0x4c/0x53 [] ip_rcv+0x2a6/0x2ec [] __netif_receive_skb_core+0x43e/0x478 [] ? virtqueue_poll+0x16/0x27 [] __netif_receive_skb+0x55/0x5a [] process_backlog+0x76/0x12f [] net_rx_action+0xa2/0x1ab [] __do_softirq+0xca/0x1d1 [] irq_exit+0x3e/0x85 [] do_IRQ+0xa9/0xc4 [] common_interrupt+0x6d/0x6d [] ? native_safe_halt+0x6/0x8 [] default_idle+0x9/0xd [] arch_cpu_idle+0x13/0x1c [] cpu_startup_entry+0xbc/0x137 [] start_secondary+0x1a0/0x1a5 Code: 24 14 e8 f1 e5 01 00 31 d2 a8 32 0f 95 c2 49 8b 44 24 2c 49 0b 44 24 24 74 05 83 ca 04 eb 1c 4d 85 ed 74 17 49 8b 85 a8 02 00 00 <66> 8b 40 46 66 c1 e8 07 83 e0 07 c1 e0 03 09 c2 4c 89 e6 48 89 RIP [] ip6_route_output+0x58/0x82 RSP CR2: 0000000000000046 ---[ end trace 4612329caab37efd ]--- When vxlan interface is created without explicit group definition, the default_dst protocol family is initialiazed to AF_UNSPEC and the driver assumes IPv4 configuration. On the other side, the default_dst protocol family is used to differentiate between IPv4 and IPv6 cases and, since, AF_UNSPEC != AF_INET, the processing takes the IPv6 path. Making the IPv4 assumption explicit by settting default_dst protocol family to AF_INET4 and preventing mixing of IPv4 and IPv6 addresses in snooped fdb entries fixes the corner case crashes. Signed-off-by: Mike Rapoport Signed-off-by: David S. Miller --- drivers/net/vxlan.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c index 0d862a5077ab..c55e316373a1 100644 --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c @@ -871,6 +871,9 @@ static int vxlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[], if (err) return err; + if (vxlan->default_dst.remote_ip.sa.sa_family != ip.sa.sa_family) + return -EAFNOSUPPORT; + spin_lock_bh(&vxlan->hash_lock); err = vxlan_fdb_create(vxlan, addr, &ip, ndm->ndm_state, flags, port, vni, ifindex, ndm->ndm_flags); @@ -2601,9 +2604,10 @@ static int vxlan_newlink(struct net *net, struct net_device *dev, vni = nla_get_u32(data[IFLA_VXLAN_ID]); dst->remote_vni = vni; + /* Unless IPv6 is explicitly requested, assume IPv4 */ + dst->remote_ip.sa.sa_family = AF_INET; if (data[IFLA_VXLAN_GROUP]) { dst->remote_ip.sin.sin_addr.s_addr = nla_get_be32(data[IFLA_VXLAN_GROUP]); - dst->remote_ip.sa.sa_family = AF_INET; } else if (data[IFLA_VXLAN_GROUP6]) { if (!IS_ENABLED(CONFIG_IPV6)) return -EPFNOSUPPORT; -- cgit v1.2.3 From 79eb9d28c9b22fa419e2c3f1b2cc6e285720ae41 Mon Sep 17 00:00:00 2001 From: Alexei Starovoitov Date: Tue, 1 Apr 2014 18:26:48 -0700 Subject: net: ti: fix CPTS driver build on arm fix build errors: drivers/net/ethernet/ti/cpts.c:266:12: error: 'ETH_HLEN' undeclared (first use in this function) drivers/net/ethernet/ti/cpts.c:276:23: error: 'VLAN_HLEN' undeclared (first use in this function) Fixes: 408eccce3204 ("net: ptp: move PTP classifier in its own file") Reported-by: Fengguang Wu Signed-off-by: Alexei Starovoitov Suggested-by: Daniel Borkmann Cc: Richard Cochran Acked-by: Daniel Borkmann Signed-off-by: David S. Miller --- drivers/net/ethernet/ti/cpts.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers') diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c index a3bbf59eaafd..243513980b51 100644 --- a/drivers/net/ethernet/ti/cpts.c +++ b/drivers/net/ethernet/ti/cpts.c @@ -26,6 +26,8 @@ #include #include #include +#include +#include #include "cpts.h" -- cgit v1.2.3 From 77bc6bed7121936bb2e019a8c336075f4c8eef62 Mon Sep 17 00:00:00 2001 From: YOSHIFUJI Hideaki / 吉藤英明 Date: Wed, 2 Apr 2014 12:48:42 +0900 Subject: isdnloop: Validate NUL-terminated strings from user. Return -EINVAL unless all of user-given strings are correctly NUL-terminated. Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller --- drivers/isdn/isdnloop/isdnloop.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'drivers') diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c index 02125e6a9109..e1f8748ff25d 100644 --- a/drivers/isdn/isdnloop/isdnloop.c +++ b/drivers/isdn/isdnloop/isdnloop.c @@ -1070,6 +1070,12 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp) return -EBUSY; if (copy_from_user((char *) &sdef, (char *) sdefp, sizeof(sdef))) return -EFAULT; + + for (i = 0; i < 3; i++) { + if (!memchr(sdef.num[i], 0, sizeof(sdef.num[i]))) + return -EINVAL; + } + spin_lock_irqsave(&card->isdnloop_lock, flags); switch (sdef.ptype) { case ISDN_PTYPE_EURO: -- cgit v1.2.3 From df1efc2d3037334f4a868aca9ae329d67058bbfd Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Wed, 2 Apr 2014 11:21:58 -0400 Subject: net: bnx2x: include irq.h for irqreturn_t definitions The bnx2x driver fails to build on ARM with: In file included from drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c:28:0: drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h:243:1: error: unknown type name 'irqreturn_t' irqreturn_t bnx2x_msix_sp_int(int irq, void *dev_instance); ^ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h:251:1: error: unknown type name 'irqreturn_t' irqreturn_t bnx2x_interrupt(int irq, void *dev_instance); ^ Nothing in bnx2x_link.c or bnx2x_cmn.h is explicitly including the irq definitions, so we add an include of linux/irq.h to pick them up. Signed-off-by: Josh Boyer Signed-off-by: David S. Miller --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers') diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h index 05f4f5f52635..3448cc033ca5 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h @@ -21,6 +21,7 @@ #include #include #include +#include #include "bnx2x.h" #include "bnx2x_sriov.h" -- cgit v1.2.3 From fef1f07cbf3d9b6f79beac8575554476c02c7f54 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Wed, 2 Apr 2014 11:24:00 -0400 Subject: net: enic: include irq.h for irqreturn_t definitions The enic driver fails to build on ARM with: In file included from drivers/net/ethernet/cisco/enic/enic_res.c:40:0: drivers/net/ethernet/cisco/enic/enic.h:48:2: error: expected specifier-qualifier-list before 'irqreturn_t' irqreturn_t (*isr)(int, void *); ^ Nothing in the driver is explicitly including the irq definitions, so we add an include of linux/irq.h to pick them up. Signed-off-by: Josh Boyer Signed-off-by: David S. Miller --- drivers/net/ethernet/cisco/enic/enic.h | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers') diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h index e9f7c656ddda..e35c8e0202ad 100644 --- a/drivers/net/ethernet/cisco/enic/enic.h +++ b/drivers/net/ethernet/cisco/enic/enic.h @@ -29,6 +29,7 @@ #include "vnic_stats.h" #include "vnic_nic.h" #include "vnic_rss.h" +#include #define DRV_NAME "enic" #define DRV_DESCRIPTION "Cisco VIC Ethernet NIC Driver" -- cgit v1.2.3 From acdd32be6d3ec5f872d9fd930cac54d18d6c74ac Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Wed, 2 Apr 2014 11:25:47 -0400 Subject: net: qlcnic: include irq.h for irq definitions The qlcnic driver fails to build on ARM with errors like: In file included from drivers/net/ethernet/qlogic/qlcnic/qlcnic.h:36:0, from drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c:8: drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h:585:1: error: unknown type name 'irqreturn_t' irqreturn_t qlcnic_83xx_clear_legacy_intr(struct qlcnic_adapter *); ^ Nothing in the driver is explicitly including the irq definitions, so we add an include of linux/irq.h to pick them up. Signed-off-by: Josh Boyer Signed-off-by: David S. Miller --- drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers') diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h index f31bb5e9d8a9..7b52a88923ef 100644 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h @@ -23,6 +23,7 @@ #include #include #include +#include #include -- cgit v1.2.3 From 9074ce249321861e535cdf8de9af0930a174dda9 Mon Sep 17 00:00:00 2001 From: Zoltan Kiss Date: Wed, 2 Apr 2014 18:04:57 +0100 Subject: xen-netback: Rename map ops Rename identifiers to state explicitly that they refer to map ops. Signed-off-by: Zoltan Kiss Reviewed-by: Paul Durrant Acked-by: Ian Campbell Signed-off-by: David S. Miller --- drivers/net/xen-netback/netback.c | 46 ++++++++++++++++++++------------------- 1 file changed, 24 insertions(+), 22 deletions(-) (limited to 'drivers') diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c index 3f021e054ba1..4bb78862afc8 100644 --- a/drivers/net/xen-netback/netback.c +++ b/drivers/net/xen-netback/netback.c @@ -820,13 +820,13 @@ struct xenvif_tx_cb { #define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb) -static inline void xenvif_tx_create_gop(struct xenvif *vif, - u16 pending_idx, - struct xen_netif_tx_request *txp, - struct gnttab_map_grant_ref *gop) +static inline void xenvif_tx_create_map_op(struct xenvif *vif, + u16 pending_idx, + struct xen_netif_tx_request *txp, + struct gnttab_map_grant_ref *mop) { - vif->pages_to_map[gop-vif->tx_map_ops] = vif->mmap_pages[pending_idx]; - gnttab_set_map_op(gop, idx_to_kaddr(vif, pending_idx), + vif->pages_to_map[mop-vif->tx_map_ops] = vif->mmap_pages[pending_idx]; + gnttab_set_map_op(mop, idx_to_kaddr(vif, pending_idx), GNTMAP_host_map | GNTMAP_readonly, txp->gref, vif->domid); @@ -880,7 +880,7 @@ static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif *vif, shinfo->nr_frags++, txp++, gop++) { index = pending_index(vif->pending_cons++); pending_idx = vif->pending_ring[index]; - xenvif_tx_create_gop(vif, pending_idx, txp, gop); + xenvif_tx_create_map_op(vif, pending_idx, txp, gop); frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx); } @@ -900,7 +900,7 @@ static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif *vif, shinfo->nr_frags++, txp++, gop++) { index = pending_index(vif->pending_cons++); pending_idx = vif->pending_ring[index]; - xenvif_tx_create_gop(vif, pending_idx, txp, gop); + xenvif_tx_create_map_op(vif, pending_idx, txp, gop); frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx); } @@ -940,9 +940,9 @@ static inline void xenvif_grant_handle_reset(struct xenvif *vif, static int xenvif_tx_check_gop(struct xenvif *vif, struct sk_buff *skb, - struct gnttab_map_grant_ref **gopp) + struct gnttab_map_grant_ref **gopp_map) { - struct gnttab_map_grant_ref *gop = *gopp; + struct gnttab_map_grant_ref *gop_map = *gopp_map; u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx; struct skb_shared_info *shinfo = skb_shinfo(skb); struct pending_tx_info *tx_info; @@ -951,11 +951,11 @@ static int xenvif_tx_check_gop(struct xenvif *vif, struct sk_buff *first_skb = NULL; /* Check status of header. */ - err = gop->status; + err = gop_map->status; if (unlikely(err)) xenvif_idx_release(vif, pending_idx, XEN_NETIF_RSP_ERROR); else - xenvif_grant_handle_set(vif, pending_idx , gop->handle); + xenvif_grant_handle_set(vif, pending_idx , gop_map->handle); /* Skip first skb fragment if it is on same page as header fragment. */ start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx); @@ -968,10 +968,12 @@ check_frags: tx_info = &vif->pending_tx_info[pending_idx]; /* Check error status: if okay then remember grant handle. */ - newerr = (++gop)->status; + newerr = (++gop_map)->status; if (likely(!newerr)) { - xenvif_grant_handle_set(vif, pending_idx , gop->handle); + xenvif_grant_handle_set(vif, + pending_idx, + gop_map->handle); /* Had a previous error? Invalidate this fragment. */ if (unlikely(err)) xenvif_idx_unmap(vif, pending_idx); @@ -1023,7 +1025,7 @@ check_frags: } } - *gopp = gop + 1; + *gopp_map = gop_map + 1; return err; } @@ -1292,7 +1294,7 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget) } } - xenvif_tx_create_gop(vif, pending_idx, &txreq, gop); + xenvif_tx_create_map_op(vif, pending_idx, &txreq, gop); gop++; @@ -1399,7 +1401,7 @@ static int xenvif_handle_frag_list(struct xenvif *vif, struct sk_buff *skb) static int xenvif_tx_submit(struct xenvif *vif) { - struct gnttab_map_grant_ref *gop = vif->tx_map_ops; + struct gnttab_map_grant_ref *gop_map = vif->tx_map_ops; struct sk_buff *skb; int work_done = 0; @@ -1412,7 +1414,7 @@ static int xenvif_tx_submit(struct xenvif *vif) txp = &vif->pending_tx_info[pending_idx].req; /* Check the remap error code. */ - if (unlikely(xenvif_tx_check_gop(vif, skb, &gop))) { + if (unlikely(xenvif_tx_check_gop(vif, skb, &gop_map))) { netdev_dbg(vif->dev, "netback grant failed.\n"); skb_shinfo(skb)->nr_frags = 0; kfree_skb(skb); @@ -1611,21 +1613,21 @@ static inline void xenvif_tx_dealloc_action(struct xenvif *vif) /* Called after netfront has transmitted */ int xenvif_tx_action(struct xenvif *vif, int budget) { - unsigned nr_gops; + unsigned nr_mops; int work_done, ret; if (unlikely(!tx_work_todo(vif))) return 0; - nr_gops = xenvif_tx_build_gops(vif, budget); + nr_mops = xenvif_tx_build_gops(vif, budget); - if (nr_gops == 0) + if (nr_mops == 0) return 0; ret = gnttab_map_refs(vif->tx_map_ops, NULL, vif->pages_to_map, - nr_gops); + nr_mops); BUG_ON(ret); work_done = xenvif_tx_submit(vif); -- cgit v1.2.3 From bdab82759b8e3620096d6db46dc1cac38a52d779 Mon Sep 17 00:00:00 2001 From: Zoltan Kiss Date: Wed, 2 Apr 2014 18:04:58 +0100 Subject: xen-netback: Grant copy the header instead of map and memcpy An old inefficiency of the TX path that we are grant mapping the first slot, and then copy the header part to the linear area. Instead, doing a grant copy for that header straight on is more reasonable. Especially because there are ongoing efforts to make Xen avoiding TLB flush after unmap when the page were not touched in Dom0. In the original way the memcpy ruined that. The key changes: - the vif has a tx_copy_ops array again - xenvif_tx_build_gops sets up the grant copy operations - we don't have to figure out whether the header and first frag are on the same grant mapped page or not Note, we only grant copy PKT_PROT_LEN bytes from the first slot, the rest (if any) will be on the first frag, which is grant mapped. If the first slot is smaller than PKT_PROT_LEN, then we grant copy that, and later __pskb_pull_tail will pull more from the frags (if any) Signed-off-by: Zoltan Kiss Reviewed-by: Paul Durrant Acked-by: Ian Campbell Signed-off-by: David S. Miller --- drivers/net/xen-netback/common.h | 1 + drivers/net/xen-netback/netback.c | 122 +++++++++++++++++++++----------------- 2 files changed, 70 insertions(+), 53 deletions(-) (limited to 'drivers') diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h index 89d1d0556b6e..630a3fcf65bc 100644 --- a/drivers/net/xen-netback/common.h +++ b/drivers/net/xen-netback/common.h @@ -124,6 +124,7 @@ struct xenvif { struct pending_tx_info pending_tx_info[MAX_PENDING_REQS]; grant_handle_t grant_tx_handle[MAX_PENDING_REQS]; + struct gnttab_copy tx_copy_ops[MAX_PENDING_REQS]; struct gnttab_map_grant_ref tx_map_ops[MAX_PENDING_REQS]; struct gnttab_unmap_grant_ref tx_unmap_ops[MAX_PENDING_REQS]; /* passed to gnttab_[un]map_refs with pages under (un)mapping */ diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c index 4bb78862afc8..99c8f09b4654 100644 --- a/drivers/net/xen-netback/netback.c +++ b/drivers/net/xen-netback/netback.c @@ -940,35 +940,37 @@ static inline void xenvif_grant_handle_reset(struct xenvif *vif, static int xenvif_tx_check_gop(struct xenvif *vif, struct sk_buff *skb, - struct gnttab_map_grant_ref **gopp_map) + struct gnttab_map_grant_ref **gopp_map, + struct gnttab_copy **gopp_copy) { struct gnttab_map_grant_ref *gop_map = *gopp_map; u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx; struct skb_shared_info *shinfo = skb_shinfo(skb); - struct pending_tx_info *tx_info; int nr_frags = shinfo->nr_frags; - int i, err, start; + int i, err; struct sk_buff *first_skb = NULL; /* Check status of header. */ - err = gop_map->status; - if (unlikely(err)) + err = (*gopp_copy)->status; + (*gopp_copy)++; + if (unlikely(err)) { + if (net_ratelimit()) + netdev_dbg(vif->dev, + "Grant copy of header failed! status: %d pending_idx% %u ref: %u\n", + (*gopp_copy)->status, + pending_idx, + (*gopp_copy)->source.u.ref); xenvif_idx_release(vif, pending_idx, XEN_NETIF_RSP_ERROR); - else - xenvif_grant_handle_set(vif, pending_idx , gop_map->handle); - - /* Skip first skb fragment if it is on same page as header fragment. */ - start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx); + } check_frags: - for (i = start; i < nr_frags; i++) { + for (i = 0; i < nr_frags; i++, gop_map++) { int j, newerr; pending_idx = frag_get_pending_idx(&shinfo->frags[i]); - tx_info = &vif->pending_tx_info[pending_idx]; /* Check error status: if okay then remember grant handle. */ - newerr = (++gop_map)->status; + newerr = gop_map->status; if (likely(!newerr)) { xenvif_grant_handle_set(vif, @@ -981,18 +983,20 @@ check_frags: } /* Error on this fragment: respond to client with an error. */ + if (net_ratelimit()) + netdev_dbg(vif->dev, + "Grant map of %d. frag failed! status: %d pending_idx% %u ref: %u\n", + i, + gop_map->status, + pending_idx, + gop_map->ref); xenvif_idx_release(vif, pending_idx, XEN_NETIF_RSP_ERROR); /* Not the first error? Preceding frags already invalidated. */ if (err) continue; - /* First error: invalidate header and preceding fragments. */ - if (!first_skb) - pending_idx = XENVIF_TX_CB(skb)->pending_idx; - else - pending_idx = XENVIF_TX_CB(skb)->pending_idx; - xenvif_idx_unmap(vif, pending_idx); - for (j = start; j < i; j++) { + /* First error: invalidate preceding fragments. */ + for (j = 0; j < i; j++) { pending_idx = frag_get_pending_idx(&shinfo->frags[j]); xenvif_idx_unmap(vif, pending_idx); } @@ -1006,7 +1010,6 @@ check_frags: skb = shinfo->frag_list; shinfo = skb_shinfo(skb); nr_frags = shinfo->nr_frags; - start = 0; goto check_frags; } @@ -1017,15 +1020,13 @@ check_frags: if (first_skb && err) { int j; shinfo = skb_shinfo(first_skb); - pending_idx = XENVIF_TX_CB(skb)->pending_idx; - start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx); - for (j = start; j < shinfo->nr_frags; j++) { + for (j = 0; j < shinfo->nr_frags; j++) { pending_idx = frag_get_pending_idx(&shinfo->frags[j]); xenvif_idx_unmap(vif, pending_idx); } } - *gopp_map = gop_map + 1; + *gopp_map = gop_map; return err; } @@ -1036,9 +1037,6 @@ static void xenvif_fill_frags(struct xenvif *vif, struct sk_buff *skb) int i; u16 prev_pending_idx = INVALID_PENDING_IDX; - if (skb_shinfo(skb)->destructor_arg) - prev_pending_idx = XENVIF_TX_CB(skb)->pending_idx; - for (i = 0; i < nr_frags; i++) { skb_frag_t *frag = shinfo->frags + i; struct xen_netif_tx_request *txp; @@ -1048,10 +1046,10 @@ static void xenvif_fill_frags(struct xenvif *vif, struct sk_buff *skb) pending_idx = frag_get_pending_idx(frag); /* If this is not the first frag, chain it to the previous*/ - if (unlikely(prev_pending_idx == INVALID_PENDING_IDX)) + if (prev_pending_idx == INVALID_PENDING_IDX) skb_shinfo(skb)->destructor_arg = &callback_param(vif, pending_idx); - else if (likely(pending_idx != prev_pending_idx)) + else callback_param(vif, prev_pending_idx).ctx = &callback_param(vif, pending_idx); @@ -1191,7 +1189,10 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size) return false; } -static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget) +static void xenvif_tx_build_gops(struct xenvif *vif, + int budget, + unsigned *copy_ops, + unsigned *map_ops) { struct gnttab_map_grant_ref *gop = vif->tx_map_ops, *request_gop; struct sk_buff *skb; @@ -1294,22 +1295,36 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget) } } - xenvif_tx_create_map_op(vif, pending_idx, &txreq, gop); - - gop++; - XENVIF_TX_CB(skb)->pending_idx = pending_idx; __skb_put(skb, data_len); + vif->tx_copy_ops[*copy_ops].source.u.ref = txreq.gref; + vif->tx_copy_ops[*copy_ops].source.domid = vif->domid; + vif->tx_copy_ops[*copy_ops].source.offset = txreq.offset; + + vif->tx_copy_ops[*copy_ops].dest.u.gmfn = + virt_to_mfn(skb->data); + vif->tx_copy_ops[*copy_ops].dest.domid = DOMID_SELF; + vif->tx_copy_ops[*copy_ops].dest.offset = + offset_in_page(skb->data); + + vif->tx_copy_ops[*copy_ops].len = data_len; + vif->tx_copy_ops[*copy_ops].flags = GNTCOPY_source_gref; + + (*copy_ops)++; skb_shinfo(skb)->nr_frags = ret; if (data_len < txreq.size) { skb_shinfo(skb)->nr_frags++; frag_set_pending_idx(&skb_shinfo(skb)->frags[0], pending_idx); + xenvif_tx_create_map_op(vif, pending_idx, &txreq, gop); + gop++; } else { frag_set_pending_idx(&skb_shinfo(skb)->frags[0], INVALID_PENDING_IDX); + memcpy(&vif->pending_tx_info[pending_idx].req, &txreq, + sizeof(txreq)); } vif->pending_cons++; @@ -1326,11 +1341,13 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget) vif->tx.req_cons = idx; - if ((gop-vif->tx_map_ops) >= ARRAY_SIZE(vif->tx_map_ops)) + if (((gop-vif->tx_map_ops) >= ARRAY_SIZE(vif->tx_map_ops)) || + (*copy_ops >= ARRAY_SIZE(vif->tx_copy_ops))) break; } - return gop - vif->tx_map_ops; + (*map_ops) = gop - vif->tx_map_ops; + return; } /* Consolidate skb with a frag_list into a brand new one with local pages on @@ -1402,6 +1419,7 @@ static int xenvif_handle_frag_list(struct xenvif *vif, struct sk_buff *skb) static int xenvif_tx_submit(struct xenvif *vif) { struct gnttab_map_grant_ref *gop_map = vif->tx_map_ops; + struct gnttab_copy *gop_copy = vif->tx_copy_ops; struct sk_buff *skb; int work_done = 0; @@ -1414,27 +1432,22 @@ static int xenvif_tx_submit(struct xenvif *vif) txp = &vif->pending_tx_info[pending_idx].req; /* Check the remap error code. */ - if (unlikely(xenvif_tx_check_gop(vif, skb, &gop_map))) { - netdev_dbg(vif->dev, "netback grant failed.\n"); + if (unlikely(xenvif_tx_check_gop(vif, skb, &gop_map, &gop_copy))) { skb_shinfo(skb)->nr_frags = 0; kfree_skb(skb); continue; } data_len = skb->len; - memcpy(skb->data, - (void *)(idx_to_kaddr(vif, pending_idx)|txp->offset), - data_len); callback_param(vif, pending_idx).ctx = NULL; if (data_len < txp->size) { /* Append the packet payload as a fragment. */ txp->offset += data_len; txp->size -= data_len; - skb_shinfo(skb)->destructor_arg = - &callback_param(vif, pending_idx); } else { /* Schedule a response immediately. */ - xenvif_idx_unmap(vif, pending_idx); + xenvif_idx_release(vif, pending_idx, + XEN_NETIF_RSP_OKAY); } if (txp->flags & XEN_NETTXF_csum_blank) @@ -1613,22 +1626,25 @@ static inline void xenvif_tx_dealloc_action(struct xenvif *vif) /* Called after netfront has transmitted */ int xenvif_tx_action(struct xenvif *vif, int budget) { - unsigned nr_mops; + unsigned nr_mops, nr_cops = 0; int work_done, ret; if (unlikely(!tx_work_todo(vif))) return 0; - nr_mops = xenvif_tx_build_gops(vif, budget); + xenvif_tx_build_gops(vif, budget, &nr_cops, &nr_mops); - if (nr_mops == 0) + if (nr_cops == 0) return 0; - ret = gnttab_map_refs(vif->tx_map_ops, - NULL, - vif->pages_to_map, - nr_mops); - BUG_ON(ret); + gnttab_batch_copy(vif->tx_copy_ops, nr_cops); + if (nr_mops != 0) { + ret = gnttab_map_refs(vif->tx_map_ops, + NULL, + vif->pages_to_map, + nr_mops); + BUG_ON(ret); + } work_done = xenvif_tx_submit(vif); -- cgit v1.2.3 From 56c8b193ea7052d191c344ef9196bb8d759e1abf Mon Sep 17 00:00:00 2001 From: françois romieu Date: Thu, 3 Apr 2014 01:13:03 +0200 Subject: sxgbe: use common NET_VENDOR_FOO style. Signed-off-by: Francois Romieu Acked-by: Valdis Kletnieks Signed-off-by: David S. Miller --- drivers/net/ethernet/samsung/Kconfig | 24 ++++++++++++++++++++---- drivers/net/ethernet/samsung/sxgbe/Kconfig | 9 --------- 2 files changed, 20 insertions(+), 13 deletions(-) delete mode 100644 drivers/net/ethernet/samsung/sxgbe/Kconfig (limited to 'drivers') diff --git a/drivers/net/ethernet/samsung/Kconfig b/drivers/net/ethernet/samsung/Kconfig index 7902341f2623..2360d8150777 100644 --- a/drivers/net/ethernet/samsung/Kconfig +++ b/drivers/net/ethernet/samsung/Kconfig @@ -3,14 +3,30 @@ # config NET_VENDOR_SAMSUNG - bool "Samsung Ethernet device" + bool "Samsung Ethernet devices" default y ---help--- - This is the driver for the SXGBE 10G Ethernet IP block found on Samsung - platforms. + If you have a network (Ethernet) chipset belonging to this class, + say Y. + + Note that the answer to this question does not directly affect + the kernel: saying N will just case the configurator to skip all + the questions about Samsung chipsets. If you say Y, you will be asked + for your specific chipset/driver in the following questions. if NET_VENDOR_SAMSUNG -source "drivers/net/ethernet/samsung/sxgbe/Kconfig" +config SXGBE_ETH + tristate "Samsung 10G/2.5G/1G SXGBE Ethernet driver" + depends on HAS_IOMEM && HAS_DMA + select PHYLIB + select CRC32 + select PTP_1588_CLOCK + ---help--- + This is the driver for the SXGBE 10G Ethernet IP block found on + Samsung platforms. + + To compile this driver as a module, choose M here: the module + will be called samsung-sxgbe. endif # NET_VENDOR_SAMSUNG diff --git a/drivers/net/ethernet/samsung/sxgbe/Kconfig b/drivers/net/ethernet/samsung/sxgbe/Kconfig deleted file mode 100644 index d79288c51d0a..000000000000 --- a/drivers/net/ethernet/samsung/sxgbe/Kconfig +++ /dev/null @@ -1,9 +0,0 @@ -config SXGBE_ETH - tristate "Samsung 10G/2.5G/1G SXGBE Ethernet driver" - depends on HAS_IOMEM && HAS_DMA - select PHYLIB - select CRC32 - select PTP_1588_CLOCK - ---help--- - This is the driver for the SXGBE 10G Ethernet IP block found on Samsung - platforms. -- cgit v1.2.3 From d9bd6461681c78fbe18087c20b4bb47845cd5564 Mon Sep 17 00:00:00 2001 From: françois romieu Date: Thu, 3 Apr 2014 01:13:43 +0200 Subject: sxgbe: fix driver probe error path and driver removal leaks sxgbe_drv_probe: mdio and priv->hw leaks sxgbe_drv_remove: clk and priv->hw leaks Signed-off-by: Francois Romieu Acked-by: Byungho An Signed-off-by: David S. Miller --- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 27 ++++++++++++++++--------- 1 file changed, 17 insertions(+), 10 deletions(-) (limited to 'drivers') diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c index a72688e8dc6c..27e8c824b204 100644 --- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c +++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c @@ -2113,11 +2113,11 @@ struct sxgbe_priv_data *sxgbe_drv_probe(struct device *device, /* allocate memory resources for Descriptor rings */ ret = txring_mem_alloc(priv); if (ret) - goto error_free_netdev; + goto error_free_hw; ret = rxring_mem_alloc(priv); if (ret) - goto error_free_netdev; + goto error_free_hw; ndev->netdev_ops = &sxgbe_netdev_ops; @@ -2163,7 +2163,7 @@ struct sxgbe_priv_data *sxgbe_drv_probe(struct device *device, if (IS_ERR(priv->sxgbe_clk)) { netdev_warn(ndev, "%s: warning: cannot get CSR clock\n", __func__); - goto error_clk_get; + goto error_napi_del; } /* If a specific clk_csr value is passed from the platform @@ -2182,24 +2182,27 @@ struct sxgbe_priv_data *sxgbe_drv_probe(struct device *device, if (ret < 0) { netdev_dbg(ndev, "%s: MDIO bus (id: %d) registration failed\n", __func__, priv->plat->bus_id); - goto error_mdio_register; + goto error_clk_put; } ret = register_netdev(ndev); if (ret) { pr_err("%s: ERROR %i registering the device\n", __func__, ret); - goto error_netdev_register; + goto error_mdio_unregister; } sxgbe_check_ether_addr(priv); return priv; -error_mdio_register: +error_mdio_unregister: + sxgbe_mdio_unregister(ndev); +error_clk_put: clk_put(priv->sxgbe_clk); -error_clk_get: -error_netdev_register: +error_napi_del: netif_napi_del(&priv->napi); +error_free_hw: + kfree(priv->hw); error_free_netdev: free_netdev(ndev); @@ -2224,11 +2227,15 @@ int sxgbe_drv_remove(struct net_device *ndev) priv->hw->mac->enable_tx(priv->ioaddr, false); priv->hw->mac->enable_rx(priv->ioaddr, false); - netif_napi_del(&priv->napi); + unregister_netdev(ndev); sxgbe_mdio_unregister(ndev); - unregister_netdev(ndev); + clk_put(priv->sxgbe_clk); + + netif_napi_del(&priv->napi); + + kfree(priv->hw); free_netdev(ndev); -- cgit v1.2.3 From 240a12d58e3935945c8c0f767134f3da1ac05371 Mon Sep 17 00:00:00 2001 From: Philipp Zabel Date: Thu, 3 Apr 2014 11:28:10 +0200 Subject: net: Micrel KSZ8864RMN 4-port managed switch support This patch adds support for the Micrel KSZ8864RMN switch to the spi_ks8995 driver. The KSZ8864RMN switch has a wider 256-byte register space. Signed-off-by: Philipp Zabel Signed-off-by: David S. Miller --- drivers/net/phy/spi_ks8995.c | 52 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 40 insertions(+), 12 deletions(-) (limited to 'drivers') diff --git a/drivers/net/phy/spi_ks8995.c b/drivers/net/phy/spi_ks8995.c index 4cf5fb922e59..22b047f1fcdc 100644 --- a/drivers/net/phy/spi_ks8995.c +++ b/drivers/net/phy/spi_ks8995.c @@ -1,5 +1,5 @@ /* - * SPI driver for Micrel/Kendin KS8995M ethernet switch + * SPI driver for Micrel/Kendin KS8995M and KSZ8864RMN ethernet switches * * Copyright (C) 2008 Gabor Juhos * @@ -70,7 +70,10 @@ #define KS8995_REG_IAD1 0x76 /* Indirect Access Data 1 */ #define KS8995_REG_IAD0 0x77 /* Indirect Access Data 0 */ +#define KSZ8864_REG_ID1 0xfe /* Chip ID in bit 7 */ + #define KS8995_REGS_SIZE 0x80 +#define KSZ8864_REGS_SIZE 0x100 #define ID1_CHIPID_M 0xf #define ID1_CHIPID_S 4 @@ -94,6 +97,7 @@ struct ks8995_switch { struct spi_device *spi; struct mutex lock; struct ks8995_pdata *pdata; + struct bin_attribute regs_attr; }; static inline u8 get_chip_id(u8 val) @@ -216,11 +220,11 @@ static ssize_t ks8995_registers_read(struct file *filp, struct kobject *kobj, dev = container_of(kobj, struct device, kobj); ks8995 = dev_get_drvdata(dev); - if (unlikely(off > KS8995_REGS_SIZE)) + if (unlikely(off > ks8995->regs_attr.size)) return 0; - if ((off + count) > KS8995_REGS_SIZE) - count = KS8995_REGS_SIZE - off; + if ((off + count) > ks8995->regs_attr.size) + count = ks8995->regs_attr.size - off; if (unlikely(!count)) return count; @@ -238,11 +242,11 @@ static ssize_t ks8995_registers_write(struct file *filp, struct kobject *kobj, dev = container_of(kobj, struct device, kobj); ks8995 = dev_get_drvdata(dev); - if (unlikely(off >= KS8995_REGS_SIZE)) + if (unlikely(off >= ks8995->regs_attr.size)) return -EFBIG; - if ((off + count) > KS8995_REGS_SIZE) - count = KS8995_REGS_SIZE - off; + if ((off + count) > ks8995->regs_attr.size) + count = ks8995->regs_attr.size - off; if (unlikely(!count)) return count; @@ -251,7 +255,7 @@ static ssize_t ks8995_registers_write(struct file *filp, struct kobject *kobj, } -static struct bin_attribute ks8995_registers_attr = { +static const struct bin_attribute ks8995_registers_attr = { .attr = { .name = "registers", .mode = S_IRUSR | S_IWUSR, @@ -306,20 +310,44 @@ static int ks8995_probe(struct spi_device *spi) goto err_drvdata; } + memcpy(&ks->regs_attr, &ks8995_registers_attr, sizeof(ks->regs_attr)); + if (get_chip_id(ids[1]) != CHIPID_M) { + u8 val; + + /* Check if this is a KSZ8864RMN */ + err = ks8995_read(ks, &val, KSZ8864_REG_ID1, sizeof(val)); + if (err < 0) { + dev_err(&spi->dev, + "unable to read chip id register, err=%d\n", + err); + goto err_drvdata; + } + if ((val & 0x80) == 0) { + dev_err(&spi->dev, "unknown chip:%02x,0\n", ids[1]); + goto err_drvdata; + } + ks->regs_attr.size = KSZ8864_REGS_SIZE; + } + err = ks8995_reset(ks); if (err) goto err_drvdata; - err = sysfs_create_bin_file(&spi->dev.kobj, &ks8995_registers_attr); + err = sysfs_create_bin_file(&spi->dev.kobj, &ks->regs_attr); if (err) { dev_err(&spi->dev, "unable to create sysfs file, err=%d\n", err); goto err_drvdata; } - dev_info(&spi->dev, "KS89%02X device found, Chip ID:%01x, " - "Revision:%01x\n", ids[0], - get_chip_id(ids[1]), get_chip_rev(ids[1])); + if (get_chip_id(ids[1]) == CHIPID_M) { + dev_info(&spi->dev, + "KS8995 device found, Chip ID:%x, Revision:%x\n", + get_chip_id(ids[1]), get_chip_rev(ids[1])); + } else { + dev_info(&spi->dev, "KSZ8864 device found, Revision:%x\n", + get_chip_rev(ids[1])); + } return 0; -- cgit v1.2.3 From 7db8df02797e29cfa7d62a7e0b19f41e64b8433e Mon Sep 17 00:00:00 2001 From: "zheng.li" Date: Wed, 2 Apr 2014 11:01:48 +0800 Subject: bonding: Inactive slaves should keep inactive flag's value bond_open is not setting the inactive flag correctly for some modes (alb and tlb), resulting in error behavior if the bond has been administratively set down and then back up. This effect should not occur when slaves are added while the bond is up; it's something that only happens after a down/up bounce of the bond. For example, in bond tlb or alb mode, domu send some ARP request which go out from dom0 bond's active slave, then the ARP broadcast request packets go back to inactive slave from switch, because the inactive slave's inactive flag is zero, kernel will receive the packets and pass them to bridge that cause dom0's bridge map domu's MAC address to port of bond, bridge should map domu's MAC to port of vif. Signed-off-by: Zheng Li Signed-off-by: Jay Vosburgh Signed-off-by: David S. Miller --- drivers/net/bonding/bond_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 95a6ca7d9e51..d9f85464b362 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -3077,7 +3077,7 @@ static int bond_open(struct net_device *bond_dev) if (bond_has_slaves(bond)) { read_lock(&bond->curr_slave_lock); bond_for_each_slave(bond, slave, iter) { - if ((bond->params.mode == BOND_MODE_ACTIVEBACKUP) + if (USES_PRIMARY(bond->params.mode) && (slave != bond->curr_active_slave)) { bond_set_slave_inactive_flags(slave, BOND_SLAVE_NOTIFY_NOW); -- cgit v1.2.3 From a50988a11d1bbf58213f81d46623596bfb51a969 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Fri, 4 Apr 2014 02:16:23 +0200 Subject: net: smc911x: Remove unused local variable The ioaddr local variable is assigned to but never used in the smc911x_rx_dma_irq() function, remove it. Signed-off-by: Laurent Pinchart Signed-off-by: David S. Miller --- drivers/net/ethernet/smsc/smc911x.c | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c index 66b05e62f70a..1c44e67c3067 100644 --- a/drivers/net/ethernet/smsc/smc911x.c +++ b/drivers/net/ethernet/smsc/smc911x.c @@ -1211,7 +1211,6 @@ static void smc911x_rx_dma_irq(int dma, void *data) { struct net_device *dev = (struct net_device *)data; - unsigned long ioaddr = dev->base_addr; struct smc911x_local *lp = netdev_priv(dev); struct sk_buff *skb = lp->current_rx_skb; unsigned long flags; -- cgit v1.2.3 From 65e71ff342f8c2c8a9962ebc1fbceef4c7a529e0 Mon Sep 17 00:00:00 2001 From: Sachin Kamat Date: Fri, 4 Apr 2014 11:43:35 +0530 Subject: net: bcmgenet: Remove unnecessary version.h inclusion version.h inclusion is not necessary as detected by versioncheck. Signed-off-by: Sachin Kamat Signed-off-by: David S. Miller --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c index adf8acbddf56..0966bd04375f 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -34,7 +34,6 @@ #include #include #include -#include #include #include #include -- cgit v1.2.3 From 00aefceb2fffcf4ea2fbc97ef5d4f79ef2668ecc Mon Sep 17 00:00:00 2001 From: Zoltan Kiss Date: Fri, 4 Apr 2014 15:45:24 +0100 Subject: xen-netback: Trivial format string fix There is a "%" after pending_idx instead of ":". Signed-off-by: Zoltan Kiss Signed-off-by: David S. Miller --- drivers/net/xen-netback/netback.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c index 99c8f09b4654..76665405c5aa 100644 --- a/drivers/net/xen-netback/netback.c +++ b/drivers/net/xen-netback/netback.c @@ -956,7 +956,7 @@ static int xenvif_tx_check_gop(struct xenvif *vif, if (unlikely(err)) { if (net_ratelimit()) netdev_dbg(vif->dev, - "Grant copy of header failed! status: %d pending_idx% %u ref: %u\n", + "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n", (*gopp_copy)->status, pending_idx, (*gopp_copy)->source.u.ref); @@ -985,7 +985,7 @@ check_frags: /* Error on this fragment: respond to client with an error. */ if (net_ratelimit()) netdev_dbg(vif->dev, - "Grant map of %d. frag failed! status: %d pending_idx% %u ref: %u\n", + "Grant map of %d. frag failed! status: %d pending_idx: %u ref: %u\n", i, gop_map->status, pending_idx, -- cgit v1.2.3 From c28c7a6accb680d88b8586a4b32be4e54d60715e Mon Sep 17 00:00:00 2001 From: Jean Sacren Date: Sat, 5 Apr 2014 00:29:00 -0600 Subject: sxgbe: fix duplicate #include headers The commit 1edb9ca69e8a ("net: sxgbe: add basic framework for Samsung 10Gb ethernet driver") added support for Samsung 10Gb ethernet driver(sxgbe) with a minor issue of including linux/io.h header twice in sxgbe_dma.c file. Fix the duplicate #include by deleting the top one so that all the rest good #include headers would be preserved in the alphabetical order. Signed-off-by: Jean Sacren Cc: Byungho An Cc: Girish K S Cc: Siva Reddy Kallam Cc: Vipul Pandya Acked-by: Byungho An Signed-off-by: David S. Miller --- drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c index 28f89c41d0cd..4d989ff6c978 100644 --- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c +++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c @@ -9,7 +9,6 @@ * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. */ -#include #include #include #include -- cgit v1.2.3 From 39d7f3200801a993bff15ea89d83e99d0c479594 Mon Sep 17 00:00:00 2001 From: Alexander Aring Date: Sat, 5 Apr 2014 13:49:26 +0200 Subject: at86rf230: fix MAX_CSMA_RETRIES parameter This patch fix a copy&paste failure for setting the MAX_CSMA_RETRIES value of the at86rf212 chip which was introduced by commit f2fdd67c6bc89de0100410efb37de69b1c98ac03 ("ieee802154: enable smart transmitter features of RF212") Signed-off-by: Alexander Aring Cc: Phoebe Buckheister Signed-off-by: David S. Miller --- drivers/net/ieee802154/at86rf230.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c index 89417ac41083..430bb0db9bc4 100644 --- a/drivers/net/ieee802154/at86rf230.c +++ b/drivers/net/ieee802154/at86rf230.c @@ -852,7 +852,7 @@ at86rf212_set_csma_params(struct ieee802154_dev *dev, u8 min_be, u8 max_be, if (rc) return rc; - return at86rf230_write_subreg(lp, SR_MAX_CSMA_RETRIES, max_be); + return at86rf230_write_subreg(lp, SR_MAX_CSMA_RETRIES, retries); } static int -- cgit v1.2.3 From c293fb785bdda64d88f197e6758a3c16ae83e569 Mon Sep 17 00:00:00 2001 From: Gilles Chanteperdrix Date: Sun, 6 Apr 2014 20:37:44 +0200 Subject: net/at91_ether: avoid NULL pointer dereference The at91_ether driver calls macb_mii_init passing a 'struct macb' structure whose tx_clk member is initialized to 0. However, macb_handle_link_change() expects tx_clk to be the result of a call to clk_get, and so IS_ERR(tx_clk) to be true if the clock is invalid. This causes an oops when booting Linux 3.14 on the csb637 board. The following changes avoids this. Signed-off-by: Gilles Chanteperdrix Acked-by: Nicolas Ferre Signed-off-by: David S. Miller --- drivers/net/ethernet/cadence/at91_ether.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers') diff --git a/drivers/net/ethernet/cadence/at91_ether.c b/drivers/net/ethernet/cadence/at91_ether.c index ce75de9bae9e..4a79edaf3885 100644 --- a/drivers/net/ethernet/cadence/at91_ether.c +++ b/drivers/net/ethernet/cadence/at91_ether.c @@ -342,6 +342,9 @@ static int __init at91ether_probe(struct platform_device *pdev) } clk_enable(lp->pclk); + lp->hclk = ERR_PTR(-ENOENT); + lp->tx_clk = ERR_PTR(-ENOENT); + /* Install the interrupt handler */ dev->irq = platform_get_irq(pdev, 0); res = devm_request_irq(&pdev->dev, dev->irq, at91ether_interrupt, 0, dev->name, dev); -- cgit v1.2.3 From 7563487cbf865284dcd35e9ef5a95380da046737 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 8 Apr 2014 12:23:09 +0300 Subject: isdnloop: several buffer overflows There are three buffer overflows addressed in this patch. 1) In isdnloop_fake_err() we add an 'E' to a 60 character string and then copy it into a 60 character buffer. I have made the destination buffer 64 characters and I'm changed the sprintf() to a snprintf(). 2) In isdnloop_parse_cmd(), p points to a 6 characters into a 60 character buffer so we have 54 characters. The ->eazlist[] is 11 characters long. I have modified the code to return if the source buffer is too long. 3) In isdnloop_command() the cbuf[] array was 60 characters long but the max length of the string then can be up to 79 characters. I made the cbuf array 80 characters long and changed the sprintf() to snprintf(). I also removed the temporary "dial" buffer and changed it to use "p" directly. Unfortunately, we pass the "cbuf" string from isdnloop_command() to isdnloop_writecmd() which truncates anything over 60 characters to make it fit in card->omsg[]. (It can accept values up to 255 characters so long as there is a '\n' character every 60 characters). For now I have just fixed the memory corruption bug and left the other problems in this driver alone. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller --- drivers/isdn/isdnloop/isdnloop.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) (limited to 'drivers') diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c index e1f8748ff25d..5a4da94aefb0 100644 --- a/drivers/isdn/isdnloop/isdnloop.c +++ b/drivers/isdn/isdnloop/isdnloop.c @@ -518,9 +518,9 @@ static isdnloop_stat isdnloop_cmd_table[] = static void isdnloop_fake_err(isdnloop_card *card) { - char buf[60]; + char buf[64]; - sprintf(buf, "E%s", card->omsg); + snprintf(buf, sizeof(buf), "E%s", card->omsg); isdnloop_fake(card, buf, -1); isdnloop_fake(card, "NAK", -1); } @@ -903,6 +903,8 @@ isdnloop_parse_cmd(isdnloop_card *card) case 7: /* 0x;EAZ */ p += 3; + if (strlen(p) >= sizeof(card->eazlist[0])) + break; strcpy(card->eazlist[ch - 1], p); break; case 8: @@ -1133,7 +1135,7 @@ isdnloop_command(isdn_ctrl *c, isdnloop_card *card) { ulong a; int i; - char cbuf[60]; + char cbuf[80]; isdn_ctrl cmd; isdnloop_cdef cdef; @@ -1198,7 +1200,6 @@ isdnloop_command(isdn_ctrl *c, isdnloop_card *card) break; if ((c->arg & 255) < ISDNLOOP_BCH) { char *p; - char dial[50]; char dcode[4]; a = c->arg; @@ -1210,10 +1211,10 @@ isdnloop_command(isdn_ctrl *c, isdnloop_card *card) } else /* Normal Dial */ strcpy(dcode, "CAL"); - strcpy(dial, p); - sprintf(cbuf, "%02d;D%s_R%s,%02d,%02d,%s\n", (int) (a + 1), - dcode, dial, c->parm.setup.si1, - c->parm.setup.si2, c->parm.setup.eazmsn); + snprintf(cbuf, sizeof(cbuf), + "%02d;D%s_R%s,%02d,%02d,%s\n", (int) (a + 1), + dcode, p, c->parm.setup.si1, + c->parm.setup.si2, c->parm.setup.eazmsn); i = isdnloop_writecmd(cbuf, strlen(cbuf), 0, card); } break; -- cgit v1.2.3