1. 03 Dec, 2017 17 commits
  2. 01 Dec, 2017 21 commits
    • David S. Miller's avatar
      Merge branch 'sfp-phylink-fixes' · ccab371f
      David S. Miller authored
      Russell King says:
      
      ====================
      SFP/phylink fixes
      
      Here are four phylink fixes:
      - the "options" is a big-endian value, we must test the bits taking the
        endian-ness into account.
      - improve the handling of RX_LOS polarity, taking no RX_LOS polarity
        bits set to mean there is no RX_LOS functionality provided.
      - do not report modules that require the address mode switching as
        supporting SFF8472.
      - ensure that the mac_link_down() function is called when phylink_stop()
        is called.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ccab371f
    • Russell King's avatar
      phylink: ensure we take the link down when phylink_stop() is called · 2012b7d6
      Russell King authored
      Ensure that we tell the MAC to take the link down when phylink_stop()
      is called, and that this completes prior to phylink_stop() returns.
      Reported-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Tested-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2012b7d6
    • Russell King's avatar
      sfp: warn about modules requiring address change sequence · ec7681bd
      Russell King authored
      We do not support SFP modules which require the address change sequence
      as detailed by SFF 8472 revision 1.22 section 8.9.  Warn when these
      modules are inserted, and treat them as SFF8079 modules for ethtool.
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ec7681bd
    • Russell King's avatar
      sfp: improve RX_LOS handling · 710dfbb0
      Russell King authored
      There are two bits in the option word for the RX_LOS signal.  One
      reports that the RX_LOS signal is active high, the other reports that
      it is active low.  When both or neither are set, the result is not
      well defined in the specification.
      
      Rather than assuming that neither set means normal RX_LOS, take this
      as meaning no RX_LOS signal available, thereby ignoring the signal.
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      710dfbb0
    • Russell King's avatar
      sfp: fix RX_LOS signal handling · acf1c02f
      Russell King authored
      The options word is a be16 quantity, so we need to test the flags
      having converted the endian-ness.  Convert the flag bits to be16,
      which can be optimised by the compiler, rather than converting a
      variable at runtime.
      Reported-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      acf1c02f
    • Max Uvarov's avatar
      net: phy-micrel: check return code in flp center function · a0da456b
      Max Uvarov authored
      Fix obvious typo that first return value is set but not checked.
      Signed-off-by: default avatarMax Uvarov <muvarov@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a0da456b
    • Tommi Rantala's avatar
      tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv() · c7799c06
      Tommi Rantala authored
      Remove the second tipc_rcv() call in tipc_udp_recv(). We have just
      checked that the bearer is not up, and calling tipc_rcv() with a bearer
      that is not up leads to a TIPC div-by-zero crash in
      tipc_node_calculate_timer(). The crash is rare in practice, but can
      happen like this:
      
        We're enabling a bearer, but it's not yet up and fully initialized.
        At the same time we receive a discovery packet, and in tipc_udp_recv()
        we end up calling tipc_rcv() with the not-yet-initialized bearer,
        causing later the div-by-zero crash in tipc_node_calculate_timer().
      
      Jon Maloy explains the impact of removing the second tipc_rcv() call:
        "link setup in the worst case will be delayed until the next arriving
         discovery messages, 1 sec later, and this is an acceptable delay."
      
      As the tipc_rcv() call is removed, just leave the function via the
      rcu_out label, so that we will kfree_skb().
      
      [   12.590450] Own node address <1.1.1>, network identity 1
      [   12.668088] divide error: 0000 [#1] SMP
      [   12.676952] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.14.2-dirty #1
      [   12.679225] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014
      [   12.682095] task: ffff8c2a761edb80 task.stack: ffffa41cc0cac000
      [   12.684087] RIP: 0010:tipc_node_calculate_timer.isra.12+0x45/0x60 [tipc]
      [   12.686486] RSP: 0018:ffff8c2a7fc838a0 EFLAGS: 00010246
      [   12.688451] RAX: 0000000000000000 RBX: ffff8c2a5b382600 RCX: 0000000000000000
      [   12.691197] RDX: 0000000000000000 RSI: ffff8c2a5b382600 RDI: ffff8c2a5b382600
      [   12.693945] RBP: ffff8c2a7fc838b0 R08: 0000000000000001 R09: 0000000000000001
      [   12.696632] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8c2a5d8949d8
      [   12.699491] R13: ffffffff95ede400 R14: 0000000000000000 R15: ffff8c2a5d894800
      [   12.702338] FS:  0000000000000000(0000) GS:ffff8c2a7fc80000(0000) knlGS:0000000000000000
      [   12.705099] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   12.706776] CR2: 0000000001bb9440 CR3: 00000000bd009001 CR4: 00000000003606e0
      [   12.708847] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [   12.711016] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [   12.712627] Call Trace:
      [   12.713390]  <IRQ>
      [   12.714011]  tipc_node_check_dest+0x2e8/0x350 [tipc]
      [   12.715286]  tipc_disc_rcv+0x14d/0x1d0 [tipc]
      [   12.716370]  tipc_rcv+0x8b0/0xd40 [tipc]
      [   12.717396]  ? minmax_running_min+0x2f/0x60
      [   12.718248]  ? dst_alloc+0x4c/0xa0
      [   12.718964]  ? tcp_ack+0xaf1/0x10b0
      [   12.719658]  ? tipc_udp_is_known_peer+0xa0/0xa0 [tipc]
      [   12.720634]  tipc_udp_recv+0x71/0x1d0 [tipc]
      [   12.721459]  ? dst_alloc+0x4c/0xa0
      [   12.722130]  udp_queue_rcv_skb+0x264/0x490
      [   12.722924]  __udp4_lib_rcv+0x21e/0x990
      [   12.723670]  ? ip_route_input_rcu+0x2dd/0xbf0
      [   12.724442]  ? tcp_v4_rcv+0x958/0xa40
      [   12.725039]  udp_rcv+0x1a/0x20
      [   12.725587]  ip_local_deliver_finish+0x97/0x1d0
      [   12.726323]  ip_local_deliver+0xaf/0xc0
      [   12.726959]  ? ip_route_input_noref+0x19/0x20
      [   12.727689]  ip_rcv_finish+0xdd/0x3b0
      [   12.728307]  ip_rcv+0x2ac/0x360
      [   12.728839]  __netif_receive_skb_core+0x6fb/0xa90
      [   12.729580]  ? udp4_gro_receive+0x1a7/0x2c0
      [   12.730274]  __netif_receive_skb+0x1d/0x60
      [   12.730953]  ? __netif_receive_skb+0x1d/0x60
      [   12.731637]  netif_receive_skb_internal+0x37/0xd0
      [   12.732371]  napi_gro_receive+0xc7/0xf0
      [   12.732920]  receive_buf+0x3c3/0xd40
      [   12.733441]  virtnet_poll+0xb1/0x250
      [   12.733944]  net_rx_action+0x23e/0x370
      [   12.734476]  __do_softirq+0xc5/0x2f8
      [   12.734922]  irq_exit+0xfa/0x100
      [   12.735315]  do_IRQ+0x4f/0xd0
      [   12.735680]  common_interrupt+0xa2/0xa2
      [   12.736126]  </IRQ>
      [   12.736416] RIP: 0010:native_safe_halt+0x6/0x10
      [   12.736925] RSP: 0018:ffffa41cc0cafe90 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff4d
      [   12.737756] RAX: 0000000000000000 RBX: ffff8c2a761edb80 RCX: 0000000000000000
      [   12.738504] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
      [   12.739258] RBP: ffffa41cc0cafe90 R08: 0000014b5b9795e5 R09: ffffa41cc12c7e88
      [   12.740118] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
      [   12.740964] R13: ffff8c2a761edb80 R14: 0000000000000000 R15: 0000000000000000
      [   12.741831]  default_idle+0x2a/0x100
      [   12.742323]  arch_cpu_idle+0xf/0x20
      [   12.742796]  default_idle_call+0x28/0x40
      [   12.743312]  do_idle+0x179/0x1f0
      [   12.743761]  cpu_startup_entry+0x1d/0x20
      [   12.744291]  start_secondary+0x112/0x120
      [   12.744816]  secondary_startup_64+0xa5/0xa5
      [   12.745367] Code: b9 f4 01 00 00 48 89 c2 48 c1 ea 02 48 3d d3 07 00
      00 48 0f 47 d1 49 8b 0c 24 48 39 d1 76 07 49 89 14 24 48 89 d1 31 d2 48
      89 df <48> f7 f1 89 c6 e8 81 6e ff ff 5b 41 5c 5d c3 66 90 66 2e 0f 1f
      [   12.747527] RIP: tipc_node_calculate_timer.isra.12+0x45/0x60 [tipc] RSP: ffff8c2a7fc838a0
      [   12.748555] ---[ end trace 1399ab83390650fd ]---
      [   12.749296] Kernel panic - not syncing: Fatal exception in interrupt
      [   12.750123] Kernel Offset: 0x13200000 from 0xffffffff82000000
      (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
      [   12.751215] Rebooting in 60 seconds..
      
      Fixes: c9b64d49 ("tipc: add replicast peer discovery")
      Signed-off-by: default avatarTommi Rantala <tommi.t.rantala@nokia.com>
      Cc: Jon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c7799c06
    • Eric Dumazet's avatar
      tcp/dccp: block bh before arming time_wait timer · cfac7f83
      Eric Dumazet authored
      Maciej Żenczykowski reported some panics in tcp_twsk_destructor()
      that might be caused by the following bug.
      
      timewait timer is pinned to the cpu, because we want to transition
      timwewait refcount from 0 to 4 in one go, once everything has been
      initialized.
      
      At the time commit ed2e9239 ("tcp/dccp: fix timewait races in timer
      handling") was merged, TCP was always running from BH habdler.
      
      After commit 5413d1ba ("net: do not block BH while processing
      socket backlog") we definitely can run tcp_time_wait() from process
      context.
      
      We need to block BH in the critical section so that the pinned timer
      has still its purpose.
      
      This bug is more likely to happen under stress and when very small RTO
      are used in datacenter flows.
      
      Fixes: 5413d1ba ("net: do not block BH while processing socket backlog")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarMaciej Żenczykowski <maze@google.com>
      Acked-by: default avatarMaciej Żenczykowski <maze@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cfac7f83
    • David S. Miller's avatar
      Merge branch 'sctp-prsctp-chunk-fixes' · b484d8a5
      David S. Miller authored
      Xin Long says:
      
      ====================
      sctp: a couple of fixes for chunks abandoned in prsctp
      
      Now when abandoning chunks in prsctp, it doesn't consider for frags in
      one msg, which would cause peer can never receive the whole frags for
      one msg to get them reassembled, these pieces of this msg will stay in
      the reasm queue forever and block the following chunks' receiving.
      
      This patchset is to fix them in patch 2 and 3, and also fix another
      issue for prsctp in patch 1.
      ====================
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b484d8a5
    • Xin Long's avatar
      sctp: do not abandon the other frags in unsent outq if one msg has outstanding frags · 779edd73
      Xin Long authored
      Now for the abandoned chunks in unsent outq, it would just free the chunks.
      Because no tsn is assigned to them yet, there's no need to send fwd tsn to
      peer, unlike for the abandoned chunks in sent outq.
      
      The problem is when parts of the msg have been sent and the other frags
      are still in unsent outq, if they are abandoned/dropped, the peer would
      never get this msg reassembled.
      
      So these frags in unsent outq can't be dropped if this msg already has
      outstanding frags.
      
      This patch does the check in sctp_chunk_abandoned and
      sctp_prsctp_prune_unsent.
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      779edd73
    • Xin Long's avatar
      sctp: abandon the whole msg if one part of a fragmented message is abandoned · e5f61296
      Xin Long authored
      As rfc3758#section-3.1 demands:
      
         A3) When a TSN is "abandoned", if it is part of a fragmented message,
             all other TSN's within that fragmented message MUST be abandoned
             at the same time.
      
      Besides, if it couldn't handle this, the rest frags would never get
      assembled in peer side.
      
      This patch supports it by adding abandoned flag in sctp_datamsg, when
      one chunk is being abandoned, set chunk->msg->abandoned as well. Next
      time when checking for abandoned, go checking chunk->msg->abandoned
      first.
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e5f61296
    • Xin Long's avatar
      sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune · d30fc512
      Xin Long authored
      Now outstanding_bytes is only increased when appending chunks into one
      packet and sending it at 1st time, while decreased when it is about to
      move into retransmit queue. It means outstanding_bytes value is already
      decreased for all chunks in retransmit queue.
      
      However sctp_prsctp_prune_sent is a common function to check the chunks
      in both transmitted and retransmit queue, it decrease outstanding_bytes
      when moving a chunk into abandoned queue from either of them.
      
      It could cause outstanding_bytes underflow, as it also decreases it's
      value for the chunks in retransmit queue.
      
      This patch fixes it by only updating outstanding_bytes for transmitted
      queue when pruning queues for prsctp prio policy, the same fix is also
      needed in sctp_check_transmitted.
      
      Fixes: 8dbdf1f5 ("sctp: implement prsctp PRIO policy")
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d30fc512
    • Martin Kelly's avatar
      can: mcba_usb: fix device disconnect bug · 1cb35a33
      Martin Kelly authored
      Currently, when you disconnect the device, the driver infinitely
      resubmits all URBs, so you see:
      
      Rx URB aborted (-32)
      
      in an infinite loop.
      
      Fix this by catching -EPIPE (what we get in urb->status when the device
      disconnects) and not resubmitting.
      
      With this patch, I can plug and unplug many times and the driver
      recovers correctly.
      Signed-off-by: default avatarMartin Kelly <mkelly@xevo.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      1cb35a33
    • Martin Kelly's avatar
      can: mcba_usb: fix typo · 3fed8dbb
      Martin Kelly authored
      Fix typo "analizer" --> "Analyzer".
      Signed-off-by: default avatarMartin Kelly <mkelly@xevo.com>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      3fed8dbb
    • Marc Kleine-Budde's avatar
      can: flexcan: fix VF610 state transition issue · 29c64b17
      Marc Kleine-Budde authored
      Enable FLEXCAN_QUIRK_BROKEN_PERR_STATE for VF610 to report correct state
      transitions.
      Tested-by: default avatarMirza Krak <mirza.krak@gmail.com>
      Cc: linux-stable <stable@vger.kernel.org> # >= v4.11
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      29c64b17
    • Marc Kleine-Budde's avatar
      can: flexcan: Update IRQ Err Passive information · 658f534c
      Marc Kleine-Budde authored
      The flexcan IP cores used on MX25 and MX35 do not generate Error Passive
      IRQs. Update the IP core overview table in the driver accordingly.
      Suggested-by: default avatarZHU Yi (ST-FIR/ENG1-Zhu) <Yi.Zhu5@cn.bosch.com>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      658f534c
    • Stephane Grosjean's avatar
      can: peak/pci: fix potential bug when probe() fails · 5c2cb02e
      Stephane Grosjean authored
      PCI/PCIe drivers for PEAK-System CAN/CAN-FD interfaces do some access to the
      PCI config during probing. In case one of these accesses fails, a POSITIVE
      PCIBIOS_xxx error code is returned back. This POSITIVE error code MUST be
      converted into a NEGATIVE errno for the probe() function to indicate it
      failed. Using the pcibios_err_to_errno() function, we make sure that the
      return code will always be negative.
      Signed-off-by: default avatarStephane Grosjean <s.grosjean@peak-system.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      5c2cb02e
    • Oliver Stäbler's avatar
      can: ti_hecc: Fix napi poll return value for repoll · f6c23b17
      Oliver Stäbler authored
      After commit d75b1ade ("net: less interrupt masking in NAPI") napi
      repoll is done only when work_done == budget.
      So we need to return budget if there are still packets to receive.
      Signed-off-by: default avatarOliver Stäbler <oliver.staebler@bytesatwork.ch>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      f6c23b17
    • Jimmy Assarsson's avatar
      can: kvaser_usb: ratelimit errors if incomplete messages are received · 8bd13bd5
      Jimmy Assarsson authored
      Avoid flooding the kernel log with "Formate error", if incomplete message
      are received.
      Signed-off-by: default avatarJimmy Assarsson <jimmyassarsson@gmail.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      8bd13bd5
    • Jimmy Assarsson's avatar
      can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback() · e84f44eb
      Jimmy Assarsson authored
      The conditon in the while-loop becomes true when actual_length is less than
      2 (MSG_HEADER_LEN). In best case we end up with a former, already
      dispatched msg, that got msg->len greater than actual_length. This will
      result in a "Format error" error printout.
      
      Problem seen when unplugging a Kvaser USB device connected to a vbox guest.
      
      warning: comparison between signed and unsigned integer expressions
      [-Wsign-compare]
      Signed-off-by: default avatarJimmy Assarsson <jimmyassarsson@gmail.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      e84f44eb
    • Jimmy Assarsson's avatar
      can: kvaser_usb: free buf in error paths · 435019b4
      Jimmy Assarsson authored
      The allocated buffer was not freed if usb_submit_urb() failed.
      Signed-off-by: default avatarJimmy Assarsson <jimmyassarsson@gmail.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      435019b4
  3. 30 Nov, 2017 2 commits