aboutsummaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)AuthorFilesLines
2018-10-05mt76: move mt76x02_mac_process_rx in mt76x02-lib moduleLorenzo Bianconi6-101/+110
Move mt76x02_mac_process_rx utility routine in mt76x02-lib in order to by reused by mt76x0 driver for rxwi parsing. Add stream number check in mt76x02_mac_process_rx since mt76x0 chipsets are 1x1:1 Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76x0: merge mt76x0_dev in mt76x02_devLorenzo Bianconi16-210/+157
Merge mt76x0_dev data structure in mt76x02_dev one and remove duplicated code. Remove unused definition in mt76x0.h. Moreover merge mt76x0_caldata and mt76x02_rx_freq_cal data structures. This is a preliminary patch for rxwi unification. Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76x2: move mt76x2_dev in mt76x02_util.hLorenzo Bianconi33-509/+537
Move mt76x2_dev in mt76x02_util.h and rename it in mt76x02_dev in order to be shared between mt76x2 and mt76x0 driver Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76x0: remove hw_atomic_mutex mutex in mt76x0_devLorenzo Bianconi3-23/+2
Remove hw_atomic_mutex mutex in mt76x0_dev data structure since mt76x0_phy_set_channel is already protected by mt76_dev mutex while mt76x0_chip_onoff is used just at device probe or cleanup Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76x0: remove unused variable in mt76x0_devLorenzo Bianconi2-6/+0
Remove no longer used mac_lock spinlock and data array in mt76x0_dev data structure Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76x0: mac: use sta ewma estimation for rssi trackingLorenzo Bianconi6-62/+17
Use shared mt76x02 utility routines for rssi tracking. Moreover remove no longer used con_mon_lock spinlock and following variable: - ap_bssid - bcn_freq_off - bcn_phy_mode - avg_rssi Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76: move mt76x02_rx_get_sta and mt76x02_rx_get_sta_wcid in mt76x02_util.hLorenzo Bianconi2-30/+31
Move mt76x02_rx_get_sta and mt76x02_rx_get_sta_wcid utility routines in mt76x02-lib module since it will be used by mt76x0 driver in order to unify rxwi parsing Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76: move mt76x02_phy_get_min_avg_rssi in mt76x02_phy.cLorenzo Bianconi6-50/+53
Move mt76x02_phy_get_min_avg_rssi in mt76x02-lib module since it will be used by mt76x0 driver in order to unify rxwi parsing Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76x0: init: remove unnecessary configurationsLorenzo Bianconi1-6/+0
Remove leftover configuration for legacy devices in mt76x0_init_mac_registers routine. Moreover remove unnecessary msleep delay Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76: usb: use mt76x02u_tx_prepare_skb to fill txwiLorenzo Bianconi11-130/+48
Use mt76x02u_tx_prepare_skb routine to fill txwi in mt76x2u and mt76x0u driver and remove duplicated code. Moreover add static qualifier to mt76x02_mac_tx_rate_val and mt76x02_mac_fill_txwi routines Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76: move mt76x02_mac_write_txwi in mt76x02-lib moduleLorenzo Bianconi7-67/+69
Move mt76x02_mac_write_txwi in mt76x02_mac.c since it is shared between mt76x0 and mt76x2 drivers. This is a preliminary patch to unify txwi configuration between mt76x0 and mt76x2 drivers Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76: add get_tx_txpwr_adj function pointer to mt76_driver_opsLorenzo Bianconi5-4/+9
Add get_tx_txpwr_adj function pointer to mt76_driver_ops data structure as a preliminary patch to unify txwi configuration between mt76x0 and mt76x2 drivers since tpc is currently supported just by mt76x2 driver Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76: move mt76x02_tx_get_max_txpwr_adj in mt76x02_util.cLorenzo Bianconi7-51/+45
Move mt76x02_tx_get_max_txpwr_adj routine in mt76x02-lib module since now both mt76x0 and mt76x2 drivers read rate tx power gain from rate_power data structure. Moreover remove get_max_txpwr_adj function pointer from mt76_driver_ops data structure Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76x0: usb: stop cal/mac workqueues at hw stopLorenzo Bianconi1-3/+3
Stop mac and calibration work stopping the hw even if the device has been removed Fixes: b11e19694dc9 ("mt76x0: add ieee80211_ops ops pointer to mt76x0_alloc_device signature") Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76: usb: fix hw initialization sequenceLorenzo Bianconi2-10/+10
mt76u_alloc_queues need to be called before mt76u_mcu_init_rx since it initializes rx_page_lock spinlock used in mt76u_buf_alloc routine. Fixes: b11e19694dc9 ("mt76x0: add ieee80211_ops ops pointer to mt76x0_alloc_device signature") Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76: fix frag length allocation for usbStanislaw Gruszka1-1/+1
This is correct fix for c12128ce44b0 ("mt76: use a per rx queue page fragment cache"). We use wrong length when we allocate segments for MCU transmissions, which require bigger segment size than e->buf_size. Commit 481bb0432414 ("mt76: usb: make rx page_frag_cache access atomic") partially solved the problem or actually mask it by changing mt76u_mcu_init_rx() and mt76u_alloc_queues() sequence, so e->buf_size become non zero any longer, but still not big enough to handle MCU data. Patch fixes memory corruption which can manifest itself as random, not easy to reproduce crashes, during mt76 driver load or unload. Fixes: c12128ce44b0 ("mt76: use a per rx queue page fragment cache") Signed-off-by: Stanislaw Gruszka <[email protected]> Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76: fix header guard macro define namesColin Ian King2-2/+2
The header guards that are #defined are different from those being checked. Fix this by #defining them to the correct name. Fixes clang warnings: drivers/net/wireless/mediatek/mt76/mt76x02_mcu.h:17:9: warning: '__MT76x02_MCU_H' is used as a header guard here, followed by #define of a different macro [-Wheader-guard] drivers/net/wireless/mediatek/mt76/mt76x02_usb.h:17:9: warning: '__MT76x02_USB_H' is used as a header guard here, followed by #define of a different macro [-Wheader-guard] Fixes: 905db7470199 ("mt76: usb: move mt76x02 mcu code in mt76x02-usb module") Fixes: edaa580bc830 ("mt76: move shared mcu_calibrate routine in mt76x02-lib module") Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76x2: move mt76x2 source files to mt76x2 folderLorenzo Bianconi38-119/+120
Move mt76x2 and mt76x2u drivers to mt76x2 subfolder and leave just shared code in mt76 root folder Acked-by: Stanislaw Gruszka <[email protected]> Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05mt76x0: pci: add mt76x0e_cleanup routineLorenzo Bianconi1-6/+20
Add mt76x0e_cleanup routine to tidy up the device during device removal Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Felix Fietkau <[email protected]>
2018-10-05cxgb4: use FW_PORT_ACTION_L1_CFG32 for 32 bit capabilityGanesh Goudar1-2/+8
when 32 bit port capability is in use, use FW_PORT_ACTION_L1_CFG32 rather than FW_PORT_ACTION_L1_CFG. Signed-off-by: Casey Leedom <[email protected]> Signed-off-by: Ganesh Goudar <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-10-05qtnfmac: implement dump_station support for STA modeSergey Matyukevich1-9/+21
Current implementation of dump_station cfg80211 callback supports AP mode only. Add support for STA mode as well: by default in STA mode this callback is supposed to return AP on managed interface. Signed-off-by: Sergey Matyukevich <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: drop redundant data copy in control pathSergey Matyukevich3-12/+10
Command responses and events from the firmware are copied twice in control path: at first in shm core (qtnf_shm_handle_new_data) and then in pcie bus drivers (qtnf_pcie_control_rx_callback). There is no need to copy this data twice, it can be done only once in rx callbacks. Signed-off-by: Sergey Matyukevich <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: add support for scan dwell time configurationSergey Matyukevich3-0/+15
Firmware supports scan dwell time tuning for various types of scans. Enable support for this feature: - advertise capability to configure channel dwell time to host - pass scan dwell parameters to wireless card in scan request Signed-off-by: Sergey Matyukevich <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: add support for scan flushSergey Matyukevich3-0/+15
Notify firmware to flush cache before scanning when needed. Signed-off-by: Sergey Matyukevich <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: drop error reports for out-of-bounds key indexesSergey Matyukevich1-3/+10
On disconnect wireless core attempts to remove all the supported keys. Following cfg80211_ops conventions, firmware returns -ENOENT code for the out-of-bound key indexes. This is a normal behavior, so no need to report errors for this case. Signed-off-by: Sergey Matyukevich <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: inform wireless core about supported extended capabilitiesSergey Matyukevich4-4/+25
Driver retrieves information about supported extended capabilities from wireless card. However this information is not propagated further to Linux wireless core. Fix this by setting extended capabilities fields of wiphy structure. Signed-off-by: Sergey Matyukevich <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: pass sgi rate info flag to wireless coreSergey Matyukevich1-0/+3
SGI should be passed to wireless core as a part of rate structure. Otherwise wireless core performs incorrect rate calculation when SGI is enabled in hardware but not reported to host. Signed-off-by: Sergey Matyukevich <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: do not cancel scan in disconnect callbackIgor Mitsyanko1-2/+0
Do not cancel scan in disconnect callback. If there is an active scan, it will be cancelled by firmware, then host driver will be properly notified by event. Cancelling scan in disconnect callback occasionally may lead to the following race issue. Host is able to queue one scan after scan abort in disconnect callback, and another scan after scan abort in event handler. As a result, firmware receives second scan before the first scan completes. Signed-off-by: Igor Mitsyanko <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: cleanup and unify command error handlingSergey Matyukevich2-433/+149
Unify command error handling using qtnf_cmd_resp_result_decode function. Do not duplicate error messages in command handlers and cfg80211 callbacks: report 'cmd exec fail' only on control path internal failure. Remove redundant 'unlikely' macros. Signed-off-by: Sergey Matyukevich <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: do not initialize per-MAC data multiple timesIgor Mitsyanko1-10/+13
Several members of pwr-MAC structure are re-initialized several times together with per-VIF initialization. Fix that and simplify the code. Signed-off-by: Igor Mitsyanko <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: request userspace to do OBSS scanning if FW can notIgor Mitsyanko2-0/+5
In case firmware reports that it can not do OBSS scanning for 40MHz 2.4GHz channels itself, tell userpsace to do that instead by setting NL80211_FEATURE_NEED_OBSS_SCAN flag. Signed-off-by: Igor mitsyanko <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: generate local disconnect event in disconnect callbackIgor Mitsyanko1-6/+7
When cfg80211 disconnect callback is triggered and command is processed by firmware, disconnect event with local parameter set must be sent immediately. Indicating that it's a "local" event (not from AP) will help upper layers to process this event correctly. Signed-off-by: Igor Mitsyanko <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05qtnfmac: do not track STA states in driverSergey Matyukevich3-76/+8
Remove STA connection states tracking from driver. Leave it wireless core on host and to firmware. Signed-off-by: Sergey Matyukevich <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05b43: remove set but not used variable 'wl'YueHaibing1-2/+0
Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/broadcom/b43/main.c: In function 'b43_one_core_detach': drivers/net/wireless/broadcom/b43/main.c:5496:17: warning: variable 'wl' set but not used [-Wunused-but-set-variable] After commit 644aa4d62096 ("b43: remove list of IEEE 802.11 devices") 'wl' is not used any more. Signed-off-by: YueHaibing <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05zd1211rw: Replace spin_is_locked() with lockdepLance Roy1-1/+1
lockdep_assert_held() is better suited to checking locking requirements, since it won't get confused when someone else holds the lock. This is also a step towards possibly removing spin_is_locked(). Signed-off-by: Lance Roy <[email protected]> Cc: Daniel Drake <[email protected]> Cc: Ulrich Kunitz <[email protected]> Cc: Kalle Valo <[email protected]> Cc: "David S. Miller" <[email protected]> Cc: <[email protected]> Cc: <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05wlcore: Add support for optional wakeirqTony Lindgren3-9/+40
Now with wlcore using PM runtime, we can also add support for Linux generic wakeirq handling for it if configured in the dts file. The wakeirq can be configured as the second interrupt in the dts file with interrupts-extended property where it is the padconf irq of the OOB GPIO pin used for wlcore interrupt. Note that eventually we should also allow configuring wlcore to use the SDIO dat1 IRQ for wake-up, and in that case the the wakeirq should be configured to be the padconf interrupt of the dat1 pin and not the padconf interrupt of the OOB GPIO pin. Cc: Eyal Reizer <[email protected]> Signed-off-by: Tony Lindgren <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05wlcore: Fix BUG with clear completion on timeoutTony Lindgren1-4/+14
We do not currently clear wl->elp_compl on ELP timeout and we have bogus lingering pointer that wlcore_irq then will try to access after recovery is done: BUG: spinlock bad magic on CPU#1, irq/255-wl12xx/580 ... (spin_dump) from [<c01b9344>] (do_raw_spin_lock+0xc8/0x124) (do_raw_spin_lock) from [<c09b3970>] (_raw_spin_lock_irqsave+0x68/0x74) (_raw_spin_lock_irqsave) from [<c01a02f0>] (complete+0x24/0x58) (complete) from [<bf572610>] (wlcore_irq+0x48/0x17c [wlcore]) (wlcore_irq [wlcore]) from [<c01c5efc>] (irq_thread_fn+0x2c/0x64) (irq_thread_fn) from [<c01c623c>] (irq_thread+0x148/0x290) (irq_thread) from [<c016b4b0>] (kthread+0x160/0x17c) (kthread) from [<c01010b4>] (ret_from_fork+0x14/0x20) ... After that the system will hang. Let's fix this by adding a flag for recovery and moving the recovery work call to to the error handling section. And we want to set WL1271_FLAG_INTENDED_FW_RECOVERY and actually clear it too in wl1271_recovery_work() and just downgrade the error to a warning to prevent overly verbose output. Cc: Eyal Reizer <[email protected]> Signed-off-by: Tony Lindgren <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05rtlwifi: Removed unused define and code efuse_re_pg* from wifi.hPing-Ke Shih1-4/+0
The following: bool efuse_re_pg_sec1flag; u8 efuse_re_pg_data[8]; are not referenced anywhere in the rtlwifi code. This patch is originally created by Rick Veens <[email protected]>, and Joe Perches <[email protected]> reminded to apply it to rtlwifi. Signed-off-by: Ping-Ke Shih <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05brcmfmac: fix full timeout waiting for action frame on-channel txChung-Hsien Hsu2-2/+17
The driver sends an action frame down and waits for a completion signal triggered by the received BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE event to continue the process. However, the action frame could be transmitted either on the current channel or on an off channel. For the on-channel case, only BRCMF_E_ACTION_FRAME_COMPLETE event will be received when the frame is transmitted, which make the driver always wait a full timeout duration. This patch has the completion signal be triggered by receiving the BRCMF_E_ACTION_FRAME_COMPLETE event for the on-channel case. This change fixes WFA p2p certification 5.1.19 failure. Signed-off-by: Chung-Hsien Hsu <[email protected]> Signed-off-by: Chi-Hsien Lin <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05brcmfmac: reduce timeout for action frame scanChung-Hsien Hsu1-5/+4
Finding a common channel to send an action frame out is required for some action types. Since a loop with several scan retry is used to find the channel, a short wait time could be considered for each attempt. This patch reduces the wait time from 1500 to 450 msec for each action frame scan. This patch fixes the WFA p2p certification 5.1.20 failure caused by the long action frame send time. Signed-off-by: Chung-Hsien Hsu <[email protected]> Signed-off-by: Chi-Hsien Lin <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2018-10-05net: phy: phylink: fix SFP interface autodetectionBaruch Siach1-20/+28
When connecting SFP PHY to phylink use the detected interface. Otherwise, the link fails to come up when the configured 'phy-mode' differs from the SFP detected mode. Move most of phylink_connect_phy() into __phylink_connect_phy(), and leave phylink_connect_phy() as a wrapper. phylink_sfp_connect_phy() can now pass the SFP detected PHY interface to __phylink_connect_phy(). This fixes 1GB SFP module link up on eth3 of the Macchiatobin board that is configured in the DT to "2500base-x" phy-mode. Fixes: 9525ae83959b6 ("phylink: add phylink infrastructure") Suggested-by: Russell King <[email protected]> Signed-off-by: Baruch Siach <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-10-05be2net: don't flip hw_features when VXLANs are added/deletedDavide Caratti1-4/+1
the be2net implementation of .ndo_tunnel_{add,del}() changes the value of NETIF_F_GSO_UDP_TUNNEL bit in 'features' and 'hw_features', but it forgets to call netdev_features_change(). Moreover, ethtool setting for that bit can potentially be reverted after a tunnel is added or removed. GSO already does software segmentation when 'hw_enc_features' is 0, even if VXLAN offload is turned on. In addition, commit 096de2f83ebc ("benet: stricter vxlan offloading check in be_features_check") avoids hardware segmentation of non-VXLAN tunneled packets, or VXLAN packets having wrong destination port. So, it's safe to avoid flipping the above feature on addition/deletion of VXLAN tunnels. Fixes: 630f4b70567f ("be2net: Export tunnel offloads only when a VxLAN tunnel is created") Signed-off-by: Davide Caratti <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-10-04net: dsa: b53: Keep CPU port as tagged in all VLANsFlorian Fainelli1-2/+2
Commit c499696e7901 ("net: dsa: b53: Stop using dev->cpu_port incorrectly") was a bit too trigger happy in removing the CPU port from the VLAN membership because we rely on DSA to program the CPU port VLAN, which it does, except it does not bother itself with tagged/untagged and just usese untagged. Having the CPU port "follow" the user ports tagged/untagged is not great and does not allow for properly differentiating, so keep the CPU port tagged in all VLANs. Reported-by: Gerhard Wiesinger <[email protected]> Fixes: c499696e7901 ("net: dsa: b53: Stop using dev->cpu_port incorrectly") Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-10-04bnxt_en: get the reduced max_irqs by the ones used by RDMAVasundhara Volam1-1/+1
When getting the max rings supported, get the reduced max_irqs by the ones used by RDMA. If the number MSIX is the limiting factor, this bug may cause the max ring count to be higher than it should be when RDMA driver is loaded and may result in ring allocation failures. Fixes: 30f529473ec9 ("bnxt_en: Do not modify max IRQ count after RDMA driver requests/frees IRQs.") Signed-off-by: Vasundhara Volam <[email protected]> Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-10-04bnxt_en: free hwrm resources, if driver probe fails.Venkat Duvvuru1-4/+6
When the driver probe fails, all the resources that were allocated prior to the failure must be freed. However, hwrm dma response memory is not getting freed. This patch fixes the problem described above. Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") Signed-off-by: Venkat Duvvuru <[email protected]> Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-10-04bnxt_en: Fix enables field in HWRM_QUEUE_COS2BW_CFG requestVasundhara Volam1-3/+3
In HWRM_QUEUE_COS2BW_CFG request, enables field should have the bits set only for the queue ids which are having the valid parameters. This causes firmware to return error when the TC to hardware CoS queue mapping is not 1:1 during DCBNL ETS setup. Fixes: 2e8ef77ee0ff ("bnxt_en: Add TC to hardware QoS queue mapping logic.") Signed-off-by: Vasundhara Volam <[email protected]> Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-10-04bnxt_en: Fix VNIC reservations on the PF.Michael Chan1-1/+1
The enables bit for VNIC was set wrong when calling the HWRM_FUNC_CFG firmware call to reserve VNICs. This has the effect that the firmware will keep a large number of VNICs for the PF, and having very few for VFs. DPDK driver running on the VFs, which requires more VNICs, may not work properly as a result. Fixes: 674f50a5b026 ("bnxt_en: Implement new method to reserve rings.") Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-10-04team: Forbid enslaving team device to itselfIdo Schimmel1-0/+6
team's ndo_add_slave() acquires 'team->lock' and later tries to open the newly enslaved device via dev_open(). This emits a 'NETDEV_UP' event that causes the VLAN driver to add VLAN 0 on the team device. team's ndo_vlan_rx_add_vid() will also try to acquire 'team->lock' and deadlock. Fix this by checking early at the enslavement function that a team device is not being enslaved to itself. A similar check was added to the bond driver in commit 09a89c219baf ("bonding: disallow enslaving a bond to itself"). WARNING: possible recursive locking detected 4.18.0-rc7+ #176 Not tainted -------------------------------------------- syz-executor4/6391 is trying to acquire lock: (____ptrval____) (&team->lock){+.+.}, at: team_vlan_rx_add_vid+0x3b/0x1e0 drivers/net/team/team.c:1868 but task is already holding lock: (____ptrval____) (&team->lock){+.+.}, at: team_add_slave+0xdb/0x1c30 drivers/net/team/team.c:1947 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&team->lock); lock(&team->lock); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by syz-executor4/6391: #0: (____ptrval____) (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:77 [inline] #0: (____ptrval____) (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x412/0xc30 net/core/rtnetlink.c:4662 #1: (____ptrval____) (&team->lock){+.+.}, at: team_add_slave+0xdb/0x1c30 drivers/net/team/team.c:1947 stack backtrace: CPU: 1 PID: 6391 Comm: syz-executor4 Not tainted 4.18.0-rc7+ #176 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 print_deadlock_bug kernel/locking/lockdep.c:1765 [inline] check_deadlock kernel/locking/lockdep.c:1809 [inline] validate_chain kernel/locking/lockdep.c:2405 [inline] __lock_acquire.cold.64+0x1fb/0x486 kernel/locking/lockdep.c:3435 lock_acquire+0x1e4/0x540 kernel/locking/lockdep.c:3924 __mutex_lock_common kernel/locking/mutex.c:757 [inline] __mutex_lock+0x176/0x1820 kernel/locking/mutex.c:894 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:909 team_vlan_rx_add_vid+0x3b/0x1e0 drivers/net/team/team.c:1868 vlan_add_rx_filter_info+0x14a/0x1d0 net/8021q/vlan_core.c:210 __vlan_vid_add net/8021q/vlan_core.c:278 [inline] vlan_vid_add+0x63e/0x9d0 net/8021q/vlan_core.c:308 vlan_device_event.cold.12+0x2a/0x2f net/8021q/vlan.c:381 notifier_call_chain+0x180/0x390 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1735 call_netdevice_notifiers net/core/dev.c:1753 [inline] dev_open+0x173/0x1b0 net/core/dev.c:1433 team_port_add drivers/net/team/team.c:1219 [inline] team_add_slave+0xa8b/0x1c30 drivers/net/team/team.c:1948 do_set_master+0x1c9/0x220 net/core/rtnetlink.c:2248 do_setlink+0xba4/0x3e10 net/core/rtnetlink.c:2382 rtnl_setlink+0x2a9/0x400 net/core/rtnetlink.c:2636 rtnetlink_rcv_msg+0x46e/0xc30 net/core/rtnetlink.c:4665 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2455 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4683 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x5a0/0x760 net/netlink/af_netlink.c:1343 netlink_sendmsg+0xa18/0xfd0 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:642 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:652 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2126 __sys_sendmsg+0x11d/0x290 net/socket.c:2164 __do_sys_sendmsg net/socket.c:2173 [inline] __se_sys_sendmsg net/socket.c:2171 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2171 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x456b29 Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f9706bf8c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f9706bf96d4 RCX: 0000000000456b29 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000004 RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000004d3548 R14: 00000000004c8227 R15: 0000000000000000 Fixes: 87002b03baab ("net: introduce vlan_vid_[add/del] and use them instead of direct [add/kill]_vid ndo calls") Signed-off-by: Ido Schimmel <[email protected]> Reported-and-tested-by: [email protected] Signed-off-by: David S. Miller <[email protected]>
2018-10-04geneve: allow to clear ttl inheritHangbin Liu1-4/+8
As Michal remaind, we should allow to clear ttl inherit. Then we will have three states: 1. set the flag, and do ttl inherit. 2. do not set the flag, use configured ttl value, or default ttl (0) if not set. 3. disable ttl inherit, use previous configured ttl value, or default ttl (0). Fixes: 52d0d404d39dd ("geneve: add ttl inherit support") CC: Michal Kubecek <[email protected]> Signed-off-by: Hangbin Liu <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-10-04net/usb: cancel pending work when unbinding smsc75xxYu Zhao1-0/+1
Cancel pending work before freeing smsc75xx private data structure during binding. This fixes the following crash in the driver: BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 IP: mutex_lock+0x2b/0x3f <snipped> Workqueue: events smsc75xx_deferred_multicast_write [smsc75xx] task: ffff8caa83e85700 task.stack: ffff948b80518000 RIP: 0010:mutex_lock+0x2b/0x3f <snipped> Call Trace: smsc75xx_deferred_multicast_write+0x40/0x1af [smsc75xx] process_one_work+0x18d/0x2fc worker_thread+0x1a2/0x269 ? pr_cont_work+0x58/0x58 kthread+0xfa/0x10a ? pr_cont_work+0x58/0x58 ? rcu_read_unlock_sched_notrace+0x48/0x48 ret_from_fork+0x22/0x40 Signed-off-by: Yu Zhao <[email protected]> Signed-off-by: David S. Miller <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.