Skip to content

Commit 59343cd

Browse files
torvaldstorvalds
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) Don't OOPS on socket AIO, from Christoph Hellwig. 2) Scheduled scans should be aborted upon RFKILL, from Emmanuel Grumbach. 3) Fix sleep in atomic context in kvaser_usb, from Ahmed S Darwish. 4) Fix RCU locking across copy_to_user() in bpf code, from Alexei Starovoitov. 5) Lots of crash, memory leak, short TX packet et al bug fixes in sh_eth from Ben Hutchings. 6) Fix memory corruption in SCTP wrt. INIT collitions, from Daniel Borkmann. 7) Fix return value logic for poll handlers in netxen, enic, and bnx2x. From Eric Dumazet and Govindarajulu Varadarajan. 8) Header length calculation fix in mac80211 from Fred Chou. 9) mv643xx_eth doesn't handle highmem correctly in non-TSO code paths. From Ezequiel Garcia. 10) udp_diag has bogus logic in it's hash chain skipping, copy same fix tcp diag used. From Herbert Xu. 11) amd-xgbe programs wrong rx flow control register, from Thomas Lendacky. 12) Fix race leading to use after free in ping receive path, from Subash Abhinov Kasiviswanathan. 13) Cache redirect routes otherwise we can get a heavy backlog of rcu jobs liberating DST_NOCACHE entries. From Hannes Frederic Sowa. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (48 commits) net: don't OOPS on socket aio stmmac: prevent probe drivers to crash kernel bnx2x: fix napi poll return value for repoll ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too sh_eth: Fix DMA-API usage for RX buffers sh_eth: Check for DMA mapping errors on transmit sh_eth: Ensure DMA engines are stopped before freeing buffers sh_eth: Remove RX overflow log messages ping: Fix race in free in receive path udp_diag: Fix socket skipping within chain can: kvaser_usb: Fix state handling upon BUS_ERROR events can: kvaser_usb: Retry the first bulk transfer on -ETIMEDOUT can: kvaser_usb: Send correct context to URB completion can: kvaser_usb: Do not sleep in atomic context ipv4: try to cache dst_entries which would cause a redirect samples: bpf: relax test_maps check bpf: rcu lock must not be held when calling copy_to_user() net: sctp: fix slab corruption from use after free on INIT collisions net: mv643xx_eth: Fix highmem support in non-TSO egress path sh_eth: Fix serialisation of interrupt disable with interrupt & NAPI handlers ...
2 parents 7da323b + 06539d3 commit 59343cd

File tree

42 files changed

+667
-334
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+667
-334
lines changed

‎arch/arm/boot/dts/imx6sx-sdb.dts

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -166,12 +166,12 @@
166166
#address-cells = <1>;
167167
#size-cells = <0>;
168168

169-
ethphy1: ethernet-phy@0 {
170-
reg = <0>;
169+
ethphy1: ethernet-phy@1 {
170+
reg = <1>;
171171
};
172172

173-
ethphy2: ethernet-phy@1 {
174-
reg = <1>;
173+
ethphy2: ethernet-phy@2 {
174+
reg = <2>;
175175
};
176176
};
177177
};

‎drivers/net/can/c_can/c_can.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -615,6 +615,9 @@ static void c_can_stop(struct net_device *dev)
615615

616616
c_can_irq_control(priv, false);
617617

618+
/* put ctrl to init on stop to end ongoing transmission */
619+
priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_INIT);
620+
618621
/* deactivate pins */
619622
pinctrl_pm_select_sleep_state(dev->dev.parent);
620623
priv->can.state = CAN_STATE_STOPPED;

‎drivers/net/can/usb/kvaser_usb.c

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -587,7 +587,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
587587
usb_sndbulkpipe(dev->udev,
588588
dev->bulk_out->bEndpointAddress),
589589
buf, msg->len,
590-
kvaser_usb_simple_msg_callback, priv);
590+
kvaser_usb_simple_msg_callback, netdev);
591591
usb_anchor_urb(urb, &priv->tx_submitted);
592592

593593
err = usb_submit_urb(urb, GFP_ATOMIC);
@@ -662,11 +662,6 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
662662
priv = dev->nets[channel];
663663
stats = &priv->netdev->stats;
664664

665-
if (status & M16C_STATE_BUS_RESET) {
666-
kvaser_usb_unlink_tx_urbs(priv);
667-
return;
668-
}
669-
670665
skb = alloc_can_err_skb(priv->netdev, &cf);
671666
if (!skb) {
672667
stats->rx_dropped++;
@@ -677,7 +672,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
677672

678673
netdev_dbg(priv->netdev, "Error status: 0x%02x\n", status);
679674

680-
if (status & M16C_STATE_BUS_OFF) {
675+
if (status & (M16C_STATE_BUS_OFF | M16C_STATE_BUS_RESET)) {
681676
cf->can_id |= CAN_ERR_BUSOFF;
682677

683678
priv->can.can_stats.bus_off++;
@@ -703,9 +698,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
703698
}
704699

705700
new_state = CAN_STATE_ERROR_PASSIVE;
706-
}
707-
708-
if (status == M16C_STATE_BUS_ERROR) {
701+
} else if (status & M16C_STATE_BUS_ERROR) {
709702
if ((priv->can.state < CAN_STATE_ERROR_WARNING) &&
710703
((txerr >= 96) || (rxerr >= 96))) {
711704
cf->can_id |= CAN_ERR_CRTL;
@@ -715,7 +708,8 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
715708

716709
priv->can.can_stats.error_warning++;
717710
new_state = CAN_STATE_ERROR_WARNING;
718-
} else if (priv->can.state > CAN_STATE_ERROR_ACTIVE) {
711+
} else if ((priv->can.state > CAN_STATE_ERROR_ACTIVE) &&
712+
((txerr < 96) && (rxerr < 96))) {
719713
cf->can_id |= CAN_ERR_PROT;
720714
cf->data[2] = CAN_ERR_PROT_ACTIVE;
721715

@@ -1590,7 +1584,7 @@ static int kvaser_usb_probe(struct usb_interface *intf,
15901584
{
15911585
struct kvaser_usb *dev;
15921586
int err = -ENOMEM;
1593-
int i;
1587+
int i, retry = 3;
15941588

15951589
dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL);
15961590
if (!dev)
@@ -1608,7 +1602,15 @@ static int kvaser_usb_probe(struct usb_interface *intf,
16081602

16091603
usb_set_intfdata(intf, dev);
16101604

1611-
err = kvaser_usb_get_software_info(dev);
1605+
/* On some x86 laptops, plugging a Kvaser device again after
1606+
* an unplug makes the firmware always ignore the very first
1607+
* command. For such a case, provide some room for retries
1608+
* instead of completely exiting the driver.
1609+
*/
1610+
do {
1611+
err = kvaser_usb_get_software_info(dev);
1612+
} while (--retry && err == -ETIMEDOUT);
1613+
16121614
if (err) {
16131615
dev_err(&intf->dev,
16141616
"Cannot get software infos, error %d\n", err);

‎drivers/net/ethernet/amd/xgbe/xgbe-common.h

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -767,16 +767,17 @@
767767
#define MTL_Q_RQOMR 0x40
768768
#define MTL_Q_RQMPOCR 0x44
769769
#define MTL_Q_RQDR 0x4c
770+
#define MTL_Q_RQFCR 0x50
770771
#define MTL_Q_IER 0x70
771772
#define MTL_Q_ISR 0x74
772773

773774
/* MTL queue register entry bit positions and sizes */
775+
#define MTL_Q_RQFCR_RFA_INDEX 1
776+
#define MTL_Q_RQFCR_RFA_WIDTH 6
777+
#define MTL_Q_RQFCR_RFD_INDEX 17
778+
#define MTL_Q_RQFCR_RFD_WIDTH 6
774779
#define MTL_Q_RQOMR_EHFC_INDEX 7
775780
#define MTL_Q_RQOMR_EHFC_WIDTH 1
776-
#define MTL_Q_RQOMR_RFA_INDEX 8
777-
#define MTL_Q_RQOMR_RFA_WIDTH 3
778-
#define MTL_Q_RQOMR_RFD_INDEX 13
779-
#define MTL_Q_RQOMR_RFD_WIDTH 3
780781
#define MTL_Q_RQOMR_RQS_INDEX 16
781782
#define MTL_Q_RQOMR_RQS_WIDTH 9
782783
#define MTL_Q_RQOMR_RSF_INDEX 5

‎drivers/net/ethernet/amd/xgbe/xgbe-dev.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2079,10 +2079,10 @@ static void xgbe_config_flow_control_threshold(struct xgbe_prv_data *pdata)
20792079

20802080
for (i = 0; i < pdata->rx_q_count; i++) {
20812081
/* Activate flow control when less than 4k left in fifo */
2082-
XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQOMR, RFA, 2);
2082+
XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQFCR, RFA, 2);
20832083

20842084
/* De-activate flow control when more than 6k left in fifo */
2085-
XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQOMR, RFD, 4);
2085+
XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQFCR, RFD, 4);
20862086
}
20872087
}
20882088

‎drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3175,7 +3175,7 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
31753175
}
31763176
#endif
31773177
if (!bnx2x_fp_lock_napi(fp))
3178-
return work_done;
3178+
return budget;
31793179

31803180
for_each_cos_in_tx_queue(fp, cos)
31813181
if (bnx2x_tx_queue_has_work(fp->txdata_ptr[cos]))

‎drivers/net/ethernet/cisco/enic/enic_main.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1335,7 +1335,7 @@ static int enic_poll_msix_rq(struct napi_struct *napi, int budget)
13351335
int err;
13361336

13371337
if (!enic_poll_lock_napi(&enic->rq[rq]))
1338-
return work_done;
1338+
return budget;
13391339
/* Service RQ
13401340
*/
13411341

‎drivers/net/ethernet/marvell/mv643xx_eth.c

Lines changed: 49 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,10 @@ static char mv643xx_eth_driver_version[] = "1.4";
192192
#define IS_TSO_HEADER(txq, addr) \
193193
((addr >= txq->tso_hdrs_dma) && \
194194
(addr < txq->tso_hdrs_dma + txq->tx_ring_size * TSO_HEADER_SIZE))
195+
196+
#define DESC_DMA_MAP_SINGLE 0
197+
#define DESC_DMA_MAP_PAGE 1
198+
195199
/*
196200
* RX/TX descriptors.
197201
*/
@@ -362,6 +366,7 @@ struct tx_queue {
362366
dma_addr_t tso_hdrs_dma;
363367

364368
struct tx_desc *tx_desc_area;
369+
char *tx_desc_mapping; /* array to track the type of the dma mapping */
365370
dma_addr_t tx_desc_dma;
366371
int tx_desc_area_size;
367372

@@ -750,6 +755,7 @@ txq_put_data_tso(struct net_device *dev, struct tx_queue *txq,
750755
if (txq->tx_curr_desc == txq->tx_ring_size)
751756
txq->tx_curr_desc = 0;
752757
desc = &txq->tx_desc_area[tx_index];
758+
txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;
753759

754760
desc->l4i_chk = 0;
755761
desc->byte_cnt = length;
@@ -879,14 +885,13 @@ static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
879885
skb_frag_t *this_frag;
880886
int tx_index;
881887
struct tx_desc *desc;
882-
void *addr;
883888

884889
this_frag = &skb_shinfo(skb)->frags[frag];
885-
addr = page_address(this_frag->page.p) + this_frag->page_offset;
886890
tx_index = txq->tx_curr_desc++;
887891
if (txq->tx_curr_desc == txq->tx_ring_size)
888892
txq->tx_curr_desc = 0;
889893
desc = &txq->tx_desc_area[tx_index];
894+
txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_PAGE;
890895

891896
/*
892897
* The last fragment will generate an interrupt
@@ -902,8 +907,9 @@ static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
902907

903908
desc->l4i_chk = 0;
904909
desc->byte_cnt = skb_frag_size(this_frag);
905-
desc->buf_ptr = dma_map_single(mp->dev->dev.parent, addr,
906-
desc->byte_cnt, DMA_TO_DEVICE);
910+
desc->buf_ptr = skb_frag_dma_map(mp->dev->dev.parent,
911+
this_frag, 0, desc->byte_cnt,
912+
DMA_TO_DEVICE);
907913
}
908914
}
909915

@@ -936,6 +942,7 @@ static int txq_submit_skb(struct tx_queue *txq, struct sk_buff *skb,
936942
if (txq->tx_curr_desc == txq->tx_ring_size)
937943
txq->tx_curr_desc = 0;
938944
desc = &txq->tx_desc_area[tx_index];
945+
txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;
939946

940947
if (nr_frags) {
941948
txq_submit_frag_skb(txq, skb);
@@ -1047,9 +1054,12 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
10471054
int tx_index;
10481055
struct tx_desc *desc;
10491056
u32 cmd_sts;
1057+
char desc_dma_map;
10501058

10511059
tx_index = txq->tx_used_desc;
10521060
desc = &txq->tx_desc_area[tx_index];
1061+
desc_dma_map = txq->tx_desc_mapping[tx_index];
1062+
10531063
cmd_sts = desc->cmd_sts;
10541064

10551065
if (cmd_sts & BUFFER_OWNED_BY_DMA) {
@@ -1065,9 +1075,19 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
10651075
reclaimed++;
10661076
txq->tx_desc_count--;
10671077

1068-
if (!IS_TSO_HEADER(txq, desc->buf_ptr))
1069-
dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
1070-
desc->byte_cnt, DMA_TO_DEVICE);
1078+
if (!IS_TSO_HEADER(txq, desc->buf_ptr)) {
1079+
1080+
if (desc_dma_map == DESC_DMA_MAP_PAGE)
1081+
dma_unmap_page(mp->dev->dev.parent,
1082+
desc->buf_ptr,
1083+
desc->byte_cnt,
1084+
DMA_TO_DEVICE);
1085+
else
1086+
dma_unmap_single(mp->dev->dev.parent,
1087+
desc->buf_ptr,
1088+
desc->byte_cnt,
1089+
DMA_TO_DEVICE);
1090+
}
10711091

10721092
if (cmd_sts & TX_ENABLE_INTERRUPT) {
10731093
struct sk_buff *skb = __skb_dequeue(&txq->tx_skb);
@@ -1996,6 +2016,7 @@ static int txq_init(struct mv643xx_eth_private *mp, int index)
19962016
struct tx_queue *txq = mp->txq + index;
19972017
struct tx_desc *tx_desc;
19982018
int size;
2019+
int ret;
19992020
int i;
20002021

20012022
txq->index = index;
@@ -2048,18 +2069,34 @@ static int txq_init(struct mv643xx_eth_private *mp, int index)
20482069
nexti * sizeof(struct tx_desc);
20492070
}
20502071

2072+
txq->tx_desc_mapping = kcalloc(txq->tx_ring_size, sizeof(char),
2073+
GFP_KERNEL);
2074+
if (!txq->tx_desc_mapping) {
2075+
ret = -ENOMEM;
2076+
goto err_free_desc_area;
2077+
}
2078+
20512079
/* Allocate DMA buffers for TSO MAC/IP/TCP headers */
20522080
txq->tso_hdrs = dma_alloc_coherent(mp->dev->dev.parent,
20532081
txq->tx_ring_size * TSO_HEADER_SIZE,
20542082
&txq->tso_hdrs_dma, GFP_KERNEL);
20552083
if (txq->tso_hdrs == NULL) {
2056-
dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
2057-
txq->tx_desc_area, txq->tx_desc_dma);
2058-
return -ENOMEM;
2084+
ret = -ENOMEM;
2085+
goto err_free_desc_mapping;
20592086
}
20602087
skb_queue_head_init(&txq->tx_skb);
20612088

20622089
return 0;
2090+
2091+
err_free_desc_mapping:
2092+
kfree(txq->tx_desc_mapping);
2093+
err_free_desc_area:
2094+
if (index == 0 && size <= mp->tx_desc_sram_size)
2095+
iounmap(txq->tx_desc_area);
2096+
else
2097+
dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
2098+
txq->tx_desc_area, txq->tx_desc_dma);
2099+
return ret;
20632100
}
20642101

20652102
static void txq_deinit(struct tx_queue *txq)
@@ -2077,6 +2114,8 @@ static void txq_deinit(struct tx_queue *txq)
20772114
else
20782115
dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
20792116
txq->tx_desc_area, txq->tx_desc_dma);
2117+
kfree(txq->tx_desc_mapping);
2118+
20802119
if (txq->tso_hdrs)
20812120
dma_free_coherent(mp->dev->dev.parent,
20822121
txq->tx_ring_size * TSO_HEADER_SIZE,

‎drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2388,7 +2388,10 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
23882388

23892389
work_done = netxen_process_rcv_ring(sds_ring, budget);
23902390

2391-
if ((work_done < budget) && tx_complete) {
2391+
if (!tx_complete)
2392+
work_done = budget;
2393+
2394+
if (work_done < budget) {
23922395
napi_complete(&sds_ring->napi);
23932396
if (test_bit(__NX_DEV_UP, &adapter->state))
23942397
netxen_nic_enable_int(sds_ring);

0 commit comments

Comments
 (0)