linux.git/drivers, branch v3.10.62

bnx2fc: do not add shared skbs to the fcoe_rx_list

2014-12-06T23:05:49+00:00

commit 01a4cc4d0cd6a836c7b923760e8eb1cbb6a47258 upstream.

In some cases, the fcoe_rx_list may contains multiple instances
of the same skb (the so called "shared skbs").

the bnx2fc_l2_rcv thread is a loop that extracts a skb from the list,
modifies (and destroys) its content and then proceed to the next one.
The problem is that if the skb is shared, the remaining instances will
be corrupted.

The solution is to use skb_share_check() before adding the skb to the
fcoe_rx_list.

[ 6286.808725] ------------[ cut here ]------------
[ 6286.808729] WARNING: at include/scsi/fc_frame.h:173 bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc]()
[ 6286.808748] Modules linked in: bnx2x(-) mdio dm_service_time bnx2fc cnic uio fcoe libfcoe 8021q garp stp mrp libfc llc scsi_transport_fc scsi_tgt sg iTCO_wdt iTCO_vendor_support coretemp kvm_intel kvm crct10dif_pclmul crc32_pclmul crc32c_intel e1000e ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper ptp cryptd hpilo serio_raw hpwdt lpc_ich pps_core ipmi_si pcspkr mfd_core ipmi_msghandler shpchp pcc_cpufreq mperf nfsd auth_rpcgss nfs_acl lockd sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sd_mod crc_t10dif crct10dif_common mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit ata_piix drm_kms_helper ttm drm libata i2c_core hpsa dm_mirror dm_region_hash dm_log dm_mod [last unloaded: mdio]
[ 6286.808750] CPU: 3 PID: 1304 Comm: bnx2fc_l2_threa Not tainted 3.10.0-121.el7.x86_64 #1
[ 6286.808750] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013
[ 6286.808752]  0000000000000000 000000000b36e715 ffff8800deba1e00 ffffffff815ec0ba
[ 6286.808753]  ffff8800deba1e38 ffffffff8105dee1 ffffffffa05618c0 ffff8801e4c81888
[ 6286.808754]  ffffe8ffff663868 ffff8801f402b180 ffff8801f56bc000 ffff8800deba1e48
[ 6286.808754] Call Trace:
[ 6286.808759]  [] dump_stack+0x19/0x1b
[ 6286.808762]  [] warn_slowpath_common+0x61/0x80
[ 6286.808763]  [] warn_slowpath_null+0x1a/0x20
[ 6286.808765]  [] bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc]
[ 6286.808767]  [] ? bnx2fc_disable+0x90/0x90 [bnx2fc]
[ 6286.808769]  [] kthread+0xcf/0xe0
[ 6286.808770]  [] ? kthread_create_on_node+0x140/0x140
[ 6286.808772]  [] ret_from_fork+0x7c/0xb0
[ 6286.808773]  [] ? kthread_create_on_node+0x140/0x140
[ 6286.808774] ---[ end trace c6cdb939184ccb4e ]---

Signed-off-by: Maurizio Lombardi 
Acked-by: Chad Dupuis 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

rt2x00: do not align payload on modern H/W

2014-12-06T23:05:49+00:00

commit cfd9167af14eb4ec21517a32911d460083ee3d59 upstream.

RT2800 and newer hardware require padding between header and payload if
header length is not multiple of 4.

For historical reasons we also align payload to to 4 bytes boundary, but
such alignment is not needed on modern H/W.

Patch fixes skb_under_panic problems reported from time to time:

https://bugzilla.kernel.org/show_bug.cgi?id=84911
https://bugzilla.kernel.org/show_bug.cgi?id=72471
http://marc.info/?l=linux-wireless&m=139108549530402&w=2
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1087591

Panic happened because we eat 4 bytes of skb headroom on each
(re)transmission when sending frame without the payload and the header
length not being multiple of 4 (i.e. QoS header has 26 bytes). On such
case because paylad_aling=2 is bigger than header_align=0 we increase
header_align by 4 bytes. To prevent that we could change the check to:

	if (payload_length && payload_align > header_align)
		header_align += 4;

but not aligning payload at all is more effective and alignment is not
really needed by H/W (that has been tested on OpenWrt project for few
years now).

Reported-and-tested-by: Antti S. Lankila 
Debugged-by: Antti S. Lankila 
Reported-by: Henrik Asp 
Originally-From: Helmut Schaa 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

can: dev: avoid calling kfree_skb() from interrupt context

2014-12-06T23:05:49+00:00

commit 5247a589c24022ab34e780039cc8000c48f2035e upstream.

ikfree_skb() is Called in can_free_echo_skb(), which might be called from (TX
Error) interrupt, which triggers the folloing warning:

[ 1153.360705] ------------[ cut here ]------------
[ 1153.360715] WARNING: CPU: 0 PID: 31 at net/core/skbuff.c:563 skb_release_head_state+0xb9/0xd0()
[ 1153.360772] Call Trace:
[ 1153.360778]  [] dump_stack+0x41/0x52
[ 1153.360782]  [] warn_slowpath_common+0x7e/0xa0
[ 1153.360784]  [] ? skb_release_head_state+0xb9/0xd0
[ 1153.360786]  [] ? skb_release_head_state+0xb9/0xd0
[ 1153.360788]  [] warn_slowpath_null+0x22/0x30
[ 1153.360791]  [] skb_release_head_state+0xb9/0xd0
[ 1153.360793]  [] skb_release_all+0x10/0x30
[ 1153.360795]  [] kfree_skb+0x36/0x80
[ 1153.360799]  [] ? can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360802]  [] can_free_echo_skb+0x28/0x40 [can_dev]
[ 1153.360805]  [] esd_pci402_interrupt+0x34c/0x57a [esd402]
[ 1153.360809]  [] handle_irq_event_percpu+0x35/0x180
[ 1153.360811]  [] ? handle_irq_event_percpu+0xa3/0x180
[ 1153.360813]  [] handle_irq_event+0x31/0x50
[ 1153.360816]  [] handle_fasteoi_irq+0x6f/0x120
[ 1153.360818]  [] ? handle_edge_irq+0x110/0x110
[ 1153.360822]  [] handle_irq+0x71/0x90
[ 1153.360823]    [] do_IRQ+0x3c/0xd0
[ 1153.360829]  [] common_interrupt+0x2c/0x34
[ 1153.360834]  [] ? finish_task_switch+0x47/0xf0
[ 1153.360836]  [] __schedule+0x35b/0x7e0
[ 1153.360839]  [] ? console_unlock+0x2c4/0x4d0
[ 1153.360842]  [] ? n_tty_receive_buf_common+0x890/0x890
[ 1153.360845]  [] ? process_one_work+0x196/0x370
[ 1153.360847]  [] schedule+0x23/0x60
[ 1153.360849]  [] worker_thread+0x161/0x460
[ 1153.360852]  [] ? __wake_up_locked+0x1f/0x30
[ 1153.360854]  [] ? rescuer_thread+0x2f0/0x2f0
[ 1153.360856]  [] kthread+0xa1/0xc0
[ 1153.360859]  [] ret_from_kernel_thread+0x21/0x30
[ 1153.360861]  [] ? kthread_create_on_node+0x110/0x110
[ 1153.360863] ---[ end trace 5ff83639cbb74b35 ]---

This patch replaces the kfree_skb() by dev_kfree_skb_any().

Signed-off-by: Thomas Körper 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman

spi: dw: Fix dynamic speed change.

2014-12-06T23:05:49+00:00

commit 0a8727e69778683495058852f783eeda141a754e upstream.

An IOCTL call that calls spi_setup() and then dw_spi_setup() will
overwrite the persisted last transfer speed. On each transfer, the
SPI speed is compared to the last transfer speed to determine if the
clock divider registers need to be updated (did the speed change?).
This bug was observed with the spidev driver using spi-config to
update the max transfer speed.

This fix: Don't overwrite the persisted last transaction clock speed
when updating the SPI parameters in dw_spi_setup(). On the next
transaction, the new speed won't match the persisted last speed
and the hardware registers will be updated.
On initialization, the persisted last transaction clock
speed will be 0 but will be updated after the first SPI
transaction.

Move zeroed clock divider check into clock change test because
chip->clk_div is zero on startup and would cause a divide-by-zero
error. The calculation was wrong as well (can't support odd #).

Reported-by: Vlastimil Setka 
Signed-off-by: Vlastimil Setka 
Signed-off-by: Thor Thayer 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

iser-target: Handle DEVICE_REMOVAL event on network portal listener correctly

2014-12-06T23:05:49+00:00

commit 3b726ae2de02a406cc91903f80132daee37b6f1b upstream.

In this case the cm_id->context is the isert_np, and the cm_id->qp
is NULL, so use that to distinct the cases.

Since we don't expect any other events on this cm_id we can
just return -1 for explicit termination of the cm_id by the
cma layer.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Don't call TFO->write_pending if data_length == 0

2014-12-06T23:05:49+00:00

commit 885e7b0e181c14e4d0ddd26c688bad2b84c1ada9 upstream.

If an initiator sends a zero-length command (e.g. TEST UNIT READY) but
sets the transfer direction in the transport layer to indicate a
data-out phase, we still shouldn't try to transfer data.  At best it's
a NOP, and depending on the transport, we might crash on an
uninitialized sg list.

Reported-by: Craig Watson 
Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

srp-target: Retry when QP creation fails with ENOMEM

2014-12-06T23:05:49+00:00

commit ab477c1ff5e0a744c072404bf7db51bfe1f05b6e upstream.

It is not guaranteed to that srp_sq_size is supported
by the HCA. So if we failed to create the QP with ENOMEM,
try with a smaller srp_sq_size. Keep it up until we hit
MIN_SRPT_SQ_SIZE, then fail the connection.

Reported-by: Mark Lehrer 
Signed-off-by: Bart Van Assche 
Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

Input: xpad - use proper endpoint type

2014-12-06T23:05:49+00:00

commit a1f9a4072655843fc03186acbad65990cc05dd2d upstream.

The xpad wireless endpoint is not a bulk endpoint on my devices, but
rather an interrupt one, so the USB core complains when it is submitted.
I'm guessing that the author really did mean that this should be an
interrupt urb, but as there are a zillion different xpad devices out
there, let's cover out bases and handle both bulk and interrupt
endpoints just as easily.

Signed-off-by: "Pierre-Loup A. Griffais" 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

can: esd_usb2: fix memory leak on disconnect

2014-12-06T23:05:48+00:00

commit efbd50d2f62fc1f69a3dcd153e63ba28cc8eb27f upstream.

It seems struct esd_usb2 dev is not deallocated on disconnect. The patch adds
the missing deallocation.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Acked-by: Matthias Fuchs 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman

USB: xhci: don't start a halted endpoint before its new dequeue is set

2014-12-06T23:05:48+00:00

commit c3492dbfa1050debf23a5b5cd2bc7514c5b37896 upstream.

A halted endpoint ring must first be reset, then move the ring
dequeue pointer past the problematic TRB. If we start the ring too
early after reset, but before moving the dequeue pointer we
will end up executing the same problematic TRB again.

As we always issue a set transfer dequeue command after a reset
endpoint command we can skip starting endpoint rings at reset endpoint
command completion.

Without this fix we end up trying to handle the same faulty TD for
contol endpoints. causing timeout, and failing testusb ctrl_out write
tests.

Fixes: e9df17e (USB: xhci: Correct assumptions about number of rings per endpoint.)
Tested-by: Felipe Balbi 
Signed-off-by: Mathias Nyman 
Signed-off-by: Greg Kroah-Hartman