From: Greg Kroah-Hartman Date: Tue, 2 Apr 2013 21:12:24 +0000 (-0700) Subject: 3.8-stable patches X-Git-Tag: v3.8.6~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dbd589c721eaf82ee0427ff437f5d80be7d94f8a;p=thirdparty%2Fkernel%2Fstable-queue.git 3.8-stable patches added patches: 8021q-fix-a-potential-use-after-free.patch af_unix-dont-send-scm_credential-when-dest-socket-is-null.patch aoe-reserve-enough-headroom-on-skbs.patch atl1e-drop-pci-msi-support-because-of-packet-corruption.patch bonding-fix-disabling-of-arp_interval-and-miimon.patch bonding-remove-already-created-master-sysfs-link-on-failure.patch dm9000b-driver-initialization-upgrade.patch drivers-net-ethernet-cpsw-use-netif_wake_queue-while-restarting-tx-queue.patch drivers-net-ethernet-davinci_emac-use-netif_wake_queue-while-restarting-tx-queue.patch fec-fix-the-build-as-module.patch ipv6-don-t-accept-multicast-traffic-with-scope-0.patch ipv6-don-t-accept-node-local-multicast-traffic-from-the-wire.patch ipv6-fix-bad-free-of-addrconf_init_net.patch ks8851-fix-interpretation-of-rxlen-field.patch net-add-a-synchronize_net-in-netdev_rx_handler_unregister.patch net-ethernet-cpsw-fix-erroneous-condition-in-error-check.patch net-fix-_diag_max-constants.patch net-fix-the-use-of-this_cpu_ptr.patch net-fq_codel-fix-off-by-one-error.patch net-remove-a-warn_on-in-net_enable_timestamp.patch pch_gbe-fix-ip_summed-checksum-reporting-on-rx.patch sky2-receive-overflows-not-counted.patch sky2-threshold-for-pause-packet-is-set-wrong.patch smsc75xx-fix-jumbo-frame-support.patch tcp-preserve-ack-clocking-in-tso.patch tcp-undo-spurious-timeout-after-sack-reneging.patch thermal-shorten-too-long-mcast-group-name.patch unix-fix-a-race-condition-in-unix_release.patch --- diff --git a/queue-3.8/8021q-fix-a-potential-use-after-free.patch b/queue-3.8/8021q-fix-a-potential-use-after-free.patch new file mode 100644 index 00000000000..11e78fbb7bd --- /dev/null +++ b/queue-3.8/8021q-fix-a-potential-use-after-free.patch @@ -0,0 +1,56 @@ +From c82e2350e15cc63b5cfb3b40a60a337138d9d046 Mon Sep 17 00:00:00 2001 +From: Cong Wang +Date: Fri, 22 Mar 2013 19:14:07 +0000 +Subject: 8021q: fix a potential use-after-free + + +From: Cong Wang + +[ Upstream commit 4a7df340ed1bac190c124c1601bfc10cde9fb4fb ] + +vlan_vid_del() could possibly free ->vlan_info after a RCU grace +period, however, we may still refer to the freed memory area +by 'grp' pointer. Found by code inspection. + +This patch moves vlan_vid_del() as behind as possible. + +Cc: Patrick McHardy +Cc: "David S. Miller" +Signed-off-by: Cong Wang +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/8021q/vlan.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/net/8021q/vlan.c ++++ b/net/8021q/vlan.c +@@ -86,13 +86,6 @@ void unregister_vlan_dev(struct net_devi + + grp = &vlan_info->grp; + +- /* Take it out of our own structures, but be sure to interlock with +- * HW accelerating devices or SW vlan input packet processing if +- * VLAN is not 0 (leave it there for 802.1p). +- */ +- if (vlan_id) +- vlan_vid_del(real_dev, vlan_id); +- + grp->nr_vlan_devs--; + + if (vlan->flags & VLAN_FLAG_GVRP) +@@ -108,6 +101,13 @@ void unregister_vlan_dev(struct net_devi + if (grp->nr_vlan_devs == 0) + vlan_gvrp_uninit_applicant(real_dev); + ++ /* Take it out of our own structures, but be sure to interlock with ++ * HW accelerating devices or SW vlan input packet processing if ++ * VLAN is not 0 (leave it there for 802.1p). ++ */ ++ if (vlan_id) ++ vlan_vid_del(real_dev, vlan_id); ++ + /* Get rid of the vlan's reference to real_dev */ + dev_put(real_dev); + } diff --git a/queue-3.8/af_unix-dont-send-scm_credential-when-dest-socket-is-null.patch b/queue-3.8/af_unix-dont-send-scm_credential-when-dest-socket-is-null.patch new file mode 100644 index 00000000000..a236303c687 --- /dev/null +++ b/queue-3.8/af_unix-dont-send-scm_credential-when-dest-socket-is-null.patch @@ -0,0 +1,36 @@ +From a54e981e407135779bf1d9121c515f7715c4d520 Mon Sep 17 00:00:00 2001 +From: dingtianhong +Date: Mon, 25 Mar 2013 17:02:04 +0000 +Subject: af_unix: dont send SCM_CREDENTIAL when dest socket is NULL + + +From: dingtianhong + +[ Upstream commit 14134f6584212d585b310ce95428014b653dfaf6 ] + +SCM_SCREDENTIALS should apply to write() syscalls only either source or destination +socket asserted SOCK_PASSCRED. The original implememtation in maybe_add_creds is wrong, +and breaks several LSB testcases ( i.e. /tset/LSB.os/netowkr/recvfrom/T.recvfrom). + +Origionally-authored-by: Karel Srot +Signed-off-by: Ding Tianhong +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/unix/af_unix.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1414,8 +1414,8 @@ static void maybe_add_creds(struct sk_bu + if (UNIXCB(skb).cred) + return; + if (test_bit(SOCK_PASSCRED, &sock->flags) || +- !other->sk_socket || +- test_bit(SOCK_PASSCRED, &other->sk_socket->flags)) { ++ (other->sk_socket && ++ test_bit(SOCK_PASSCRED, &other->sk_socket->flags))) { + UNIXCB(skb).pid = get_pid(task_tgid(current)); + UNIXCB(skb).cred = get_current_cred(); + } diff --git a/queue-3.8/aoe-reserve-enough-headroom-on-skbs.patch b/queue-3.8/aoe-reserve-enough-headroom-on-skbs.patch new file mode 100644 index 00000000000..4fcea46c9c0 --- /dev/null +++ b/queue-3.8/aoe-reserve-enough-headroom-on-skbs.patch @@ -0,0 +1,42 @@ +From 8ab3517828b0482c7badadea6b42b7c7d075c713 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 27 Mar 2013 18:28:41 +0000 +Subject: aoe: reserve enough headroom on skbs + + +From: Eric Dumazet + +[ Upstream commit 91c5746425aed8f7188a351f1224a26aa232e4b3 ] + +Some network drivers use a non default hard_header_len + +Transmitted skb should take into account dev->hard_header_len, or risk +crashes or expensive reallocations. + +In the case of aoe, lets reserve MAX_HEADER bytes. + +David reported a crash in defxx driver, solved by this patch. + +Reported-by: David Oostdyk +Tested-by: David Oostdyk +Signed-off-by: Eric Dumazet +Cc: Ed Cashin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/aoe/aoecmd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/block/aoe/aoecmd.c ++++ b/drivers/block/aoe/aoecmd.c +@@ -51,8 +51,9 @@ new_skb(ulong len) + { + struct sk_buff *skb; + +- skb = alloc_skb(len, GFP_ATOMIC); ++ skb = alloc_skb(len + MAX_HEADER, GFP_ATOMIC); + if (skb) { ++ skb_reserve(skb, MAX_HEADER); + skb_reset_mac_header(skb); + skb_reset_network_header(skb); + skb->protocol = __constant_htons(ETH_P_AOE); diff --git a/queue-3.8/atl1e-drop-pci-msi-support-because-of-packet-corruption.patch b/queue-3.8/atl1e-drop-pci-msi-support-because-of-packet-corruption.patch new file mode 100644 index 00000000000..457be530b38 --- /dev/null +++ b/queue-3.8/atl1e-drop-pci-msi-support-because-of-packet-corruption.patch @@ -0,0 +1,72 @@ +From a631b646b7bc022917e572f8c5873ecd6e0e2cd4 Mon Sep 17 00:00:00 2001 +From: Hannes Frederic Sowa +Date: Thu, 28 Mar 2013 18:10:50 +0000 +Subject: atl1e: drop pci-msi support because of packet corruption + + +From: Hannes Frederic Sowa + +[ Upstream commit 188ab1b105c96656f6bcfb49d0d8bb1b1936b632 ] + +Usage of pci-msi results in corrupted dma packet transfers to the host. + +Reported-by: rebelyouth +Cc: Huang, Xiong +Tested-by: Christian Sünkenberg +Signed-off-by: Hannes Frederic Sowa +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/atheros/atl1e/atl1e.h | 1 - + drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 19 ++----------------- + 2 files changed, 2 insertions(+), 18 deletions(-) + +--- a/drivers/net/ethernet/atheros/atl1e/atl1e.h ++++ b/drivers/net/ethernet/atheros/atl1e/atl1e.h +@@ -438,7 +438,6 @@ struct atl1e_adapter { + struct atl1e_hw hw; + struct atl1e_hw_stats hw_stats; + +- bool have_msi; + u32 wol; + u16 link_speed; + u16 link_duplex; +--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c ++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c +@@ -1851,34 +1851,19 @@ static void atl1e_free_irq(struct atl1e_ + struct net_device *netdev = adapter->netdev; + + free_irq(adapter->pdev->irq, netdev); +- +- if (adapter->have_msi) +- pci_disable_msi(adapter->pdev); + } + + static int atl1e_request_irq(struct atl1e_adapter *adapter) + { + struct pci_dev *pdev = adapter->pdev; + struct net_device *netdev = adapter->netdev; +- int flags = 0; + int err = 0; + +- adapter->have_msi = true; +- err = pci_enable_msi(pdev); +- if (err) { +- netdev_dbg(netdev, +- "Unable to allocate MSI interrupt Error: %d\n", err); +- adapter->have_msi = false; +- } +- +- if (!adapter->have_msi) +- flags |= IRQF_SHARED; +- err = request_irq(pdev->irq, atl1e_intr, flags, netdev->name, netdev); ++ err = request_irq(pdev->irq, atl1e_intr, IRQF_SHARED, netdev->name, ++ netdev); + if (err) { + netdev_dbg(adapter->netdev, + "Unable to allocate interrupt Error: %d\n", err); +- if (adapter->have_msi) +- pci_disable_msi(pdev); + return err; + } + netdev_dbg(netdev, "atl1e_request_irq OK\n"); diff --git a/queue-3.8/bonding-fix-disabling-of-arp_interval-and-miimon.patch b/queue-3.8/bonding-fix-disabling-of-arp_interval-and-miimon.patch new file mode 100644 index 00000000000..8f2db11e742 --- /dev/null +++ b/queue-3.8/bonding-fix-disabling-of-arp_interval-and-miimon.patch @@ -0,0 +1,164 @@ +From c5c1096d4a925b7d6fec9bac1266a4d1c70d0cee Mon Sep 17 00:00:00 2001 +From: "nikolay@redhat.com" +Date: Wed, 27 Mar 2013 03:32:41 +0000 +Subject: bonding: fix disabling of arp_interval and miimon + + +From: "nikolay@redhat.com" + +[ Upstream commit 1bc7db16782c2a581fb4d53ca853631050f31611 ] + +Currently if either arp_interval or miimon is disabled, they both get +disabled, and upon disabling they get executed once more which is not +the proper behaviour. Also when doing a no-op and disabling an already +disabled one, the other again gets disabled. +Also fix the error messages with the proper valid ranges, and a small +typo fix in the up delay error message (outputting "down delay", instead +of "up delay"). + +Signed-off-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_sysfs.c | 92 ++++++++++++++++++++------------------- + 1 file changed, 48 insertions(+), 44 deletions(-) + +--- a/drivers/net/bonding/bond_sysfs.c ++++ b/drivers/net/bonding/bond_sysfs.c +@@ -527,7 +527,7 @@ static ssize_t bonding_store_arp_interva + goto out; + } + if (new_value < 0) { +- pr_err("%s: Invalid arp_interval value %d not in range 1-%d; rejected.\n", ++ pr_err("%s: Invalid arp_interval value %d not in range 0-%d; rejected.\n", + bond->dev->name, new_value, INT_MAX); + ret = -EINVAL; + goto out; +@@ -542,14 +542,15 @@ static ssize_t bonding_store_arp_interva + pr_info("%s: Setting ARP monitoring interval to %d.\n", + bond->dev->name, new_value); + bond->params.arp_interval = new_value; +- if (bond->params.miimon) { +- pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n", +- bond->dev->name, bond->dev->name); +- bond->params.miimon = 0; +- } +- if (!bond->params.arp_targets[0]) { +- pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n", +- bond->dev->name); ++ if (new_value) { ++ if (bond->params.miimon) { ++ pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n", ++ bond->dev->name, bond->dev->name); ++ bond->params.miimon = 0; ++ } ++ if (!bond->params.arp_targets[0]) ++ pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n", ++ bond->dev->name); + } + if (bond->dev->flags & IFF_UP) { + /* If the interface is up, we may need to fire off +@@ -557,10 +558,13 @@ static ssize_t bonding_store_arp_interva + * timer will get fired off when the open function + * is called. + */ +- cancel_delayed_work_sync(&bond->mii_work); +- queue_delayed_work(bond->wq, &bond->arp_work, 0); ++ if (!new_value) { ++ cancel_delayed_work_sync(&bond->arp_work); ++ } else { ++ cancel_delayed_work_sync(&bond->mii_work); ++ queue_delayed_work(bond->wq, &bond->arp_work, 0); ++ } + } +- + out: + rtnl_unlock(); + return ret; +@@ -702,7 +706,7 @@ static ssize_t bonding_store_downdelay(s + } + if (new_value < 0) { + pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n", +- bond->dev->name, new_value, 1, INT_MAX); ++ bond->dev->name, new_value, 0, INT_MAX); + ret = -EINVAL; + goto out; + } else { +@@ -757,8 +761,8 @@ static ssize_t bonding_store_updelay(str + goto out; + } + if (new_value < 0) { +- pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n", +- bond->dev->name, new_value, 1, INT_MAX); ++ pr_err("%s: Invalid up delay value %d not in range %d-%d; rejected.\n", ++ bond->dev->name, new_value, 0, INT_MAX); + ret = -EINVAL; + goto out; + } else { +@@ -968,37 +972,37 @@ static ssize_t bonding_store_miimon(stru + } + if (new_value < 0) { + pr_err("%s: Invalid miimon value %d not in range %d-%d; rejected.\n", +- bond->dev->name, new_value, 1, INT_MAX); ++ bond->dev->name, new_value, 0, INT_MAX); + ret = -EINVAL; + goto out; +- } else { +- pr_info("%s: Setting MII monitoring interval to %d.\n", +- bond->dev->name, new_value); +- bond->params.miimon = new_value; +- if (bond->params.updelay) +- pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n", +- bond->dev->name, +- bond->params.updelay * bond->params.miimon); +- if (bond->params.downdelay) +- pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n", +- bond->dev->name, +- bond->params.downdelay * bond->params.miimon); +- if (bond->params.arp_interval) { +- pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n", +- bond->dev->name); +- bond->params.arp_interval = 0; +- if (bond->params.arp_validate) { +- bond->params.arp_validate = +- BOND_ARP_VALIDATE_NONE; +- } +- } +- +- if (bond->dev->flags & IFF_UP) { +- /* If the interface is up, we may need to fire off +- * the MII timer. If the interface is down, the +- * timer will get fired off when the open function +- * is called. +- */ ++ } ++ pr_info("%s: Setting MII monitoring interval to %d.\n", ++ bond->dev->name, new_value); ++ bond->params.miimon = new_value; ++ if (bond->params.updelay) ++ pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n", ++ bond->dev->name, ++ bond->params.updelay * bond->params.miimon); ++ if (bond->params.downdelay) ++ pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n", ++ bond->dev->name, ++ bond->params.downdelay * bond->params.miimon); ++ if (new_value && bond->params.arp_interval) { ++ pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n", ++ bond->dev->name); ++ bond->params.arp_interval = 0; ++ if (bond->params.arp_validate) ++ bond->params.arp_validate = BOND_ARP_VALIDATE_NONE; ++ } ++ if (bond->dev->flags & IFF_UP) { ++ /* If the interface is up, we may need to fire off ++ * the MII timer. If the interface is down, the ++ * timer will get fired off when the open function ++ * is called. ++ */ ++ if (!new_value) { ++ cancel_delayed_work_sync(&bond->mii_work); ++ } else { + cancel_delayed_work_sync(&bond->arp_work); + queue_delayed_work(bond->wq, &bond->mii_work, 0); + } diff --git a/queue-3.8/bonding-remove-already-created-master-sysfs-link-on-failure.patch b/queue-3.8/bonding-remove-already-created-master-sysfs-link-on-failure.patch new file mode 100644 index 00000000000..df133620e46 --- /dev/null +++ b/queue-3.8/bonding-remove-already-created-master-sysfs-link-on-failure.patch @@ -0,0 +1,34 @@ +From b443ae6579c740e70a0d2f0fe1163fe118eafbbe Mon Sep 17 00:00:00 2001 +From: Veaceslav Falico +Date: Tue, 26 Mar 2013 17:43:28 +0100 +Subject: bonding: remove already created master sysfs link on failure + + +From: Veaceslav Falico + +[ Upstream commit 9fe16b78ee17579cb4f333534cf7043e94c67024 ] + +If slave sysfs symlink failes to be created - we end up without removing +the master sysfs symlink. Remove it in case of failure. + +Signed-off-by: Veaceslav Falico +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_sysfs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/bonding/bond_sysfs.c ++++ b/drivers/net/bonding/bond_sysfs.c +@@ -183,6 +183,11 @@ int bond_create_slave_symlinks(struct ne + sprintf(linkname, "slave_%s", slave->name); + ret = sysfs_create_link(&(master->dev.kobj), &(slave->dev.kobj), + linkname); ++ ++ /* free the master link created earlier in case of error */ ++ if (ret) ++ sysfs_remove_link(&(slave->dev.kobj), "master"); ++ + return ret; + + } diff --git a/queue-3.8/dm9000b-driver-initialization-upgrade.patch b/queue-3.8/dm9000b-driver-initialization-upgrade.patch new file mode 100644 index 00000000000..3bc842f6708 --- /dev/null +++ b/queue-3.8/dm9000b-driver-initialization-upgrade.patch @@ -0,0 +1,302 @@ +From f05d9c5e3f6f32d596078e89cb39898f7cd47539 Mon Sep 17 00:00:00 2001 +From: Joseph CHANG +Date: Thu, 28 Mar 2013 23:13:42 +0000 +Subject: DM9000B: driver initialization upgrade + + +From: Joseph CHANG + +[ Upstream commit 6741f40d198c6a5feb23653a1efd4ca47f93d83d ] + +Fix bug for DM9000 revision B which contain a DSP PHY + +DM9000B use DSP PHY instead previouse DM9000 revisions' analog PHY, +So need extra change in initialization, For +explicity PHY Reset and PHY init parameter, and +first DM9000_NCR reset need NCR_MAC_LBK bit by dm9000_probe(). + +Following DM9000_NCR reset cause by dm9000_open() clear the +NCR_MAC_LBK bit. + +Without this fix, Power-up FIFO pointers error happen around 2% +rate among Davicom's customers' boards. With this fix, All above +cases can be solved. + +Signed-off-by: Joseph CHANG +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/davicom/dm9000.c | 214 +++++++++++++++++----------------- + drivers/net/ethernet/davicom/dm9000.h | 11 + + 2 files changed, 120 insertions(+), 105 deletions(-) + +--- a/drivers/net/ethernet/davicom/dm9000.c ++++ b/drivers/net/ethernet/davicom/dm9000.c +@@ -257,6 +257,107 @@ static void dm9000_dumpblk_32bit(void __ + tmp = readl(reg); + } + ++/* ++ * Sleep, either by using msleep() or if we are suspending, then ++ * use mdelay() to sleep. ++ */ ++static void dm9000_msleep(board_info_t *db, unsigned int ms) ++{ ++ if (db->in_suspend) ++ mdelay(ms); ++ else ++ msleep(ms); ++} ++ ++/* Read a word from phyxcer */ ++static int ++dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg) ++{ ++ board_info_t *db = netdev_priv(dev); ++ unsigned long flags; ++ unsigned int reg_save; ++ int ret; ++ ++ mutex_lock(&db->addr_lock); ++ ++ spin_lock_irqsave(&db->lock, flags); ++ ++ /* Save previous register address */ ++ reg_save = readb(db->io_addr); ++ ++ /* Fill the phyxcer register into REG_0C */ ++ iow(db, DM9000_EPAR, DM9000_PHY | reg); ++ ++ /* Issue phyxcer read command */ ++ iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS); ++ ++ writeb(reg_save, db->io_addr); ++ spin_unlock_irqrestore(&db->lock, flags); ++ ++ dm9000_msleep(db, 1); /* Wait read complete */ ++ ++ spin_lock_irqsave(&db->lock, flags); ++ reg_save = readb(db->io_addr); ++ ++ iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer read command */ ++ ++ /* The read data keeps on REG_0D & REG_0E */ ++ ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL); ++ ++ /* restore the previous address */ ++ writeb(reg_save, db->io_addr); ++ spin_unlock_irqrestore(&db->lock, flags); ++ ++ mutex_unlock(&db->addr_lock); ++ ++ dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret); ++ return ret; ++} ++ ++/* Write a word to phyxcer */ ++static void ++dm9000_phy_write(struct net_device *dev, ++ int phyaddr_unused, int reg, int value) ++{ ++ board_info_t *db = netdev_priv(dev); ++ unsigned long flags; ++ unsigned long reg_save; ++ ++ dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value); ++ mutex_lock(&db->addr_lock); ++ ++ spin_lock_irqsave(&db->lock, flags); ++ ++ /* Save previous register address */ ++ reg_save = readb(db->io_addr); ++ ++ /* Fill the phyxcer register into REG_0C */ ++ iow(db, DM9000_EPAR, DM9000_PHY | reg); ++ ++ /* Fill the written data into REG_0D & REG_0E */ ++ iow(db, DM9000_EPDRL, value); ++ iow(db, DM9000_EPDRH, value >> 8); ++ ++ /* Issue phyxcer write command */ ++ iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW); ++ ++ writeb(reg_save, db->io_addr); ++ spin_unlock_irqrestore(&db->lock, flags); ++ ++ dm9000_msleep(db, 1); /* Wait write complete */ ++ ++ spin_lock_irqsave(&db->lock, flags); ++ reg_save = readb(db->io_addr); ++ ++ iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer write command */ ++ ++ /* restore the previous address */ ++ writeb(reg_save, db->io_addr); ++ ++ spin_unlock_irqrestore(&db->lock, flags); ++ mutex_unlock(&db->addr_lock); ++} ++ + /* dm9000_set_io + * + * select the specified set of io routines to use with the +@@ -794,6 +895,9 @@ dm9000_init_dm9000(struct net_device *de + + iow(db, DM9000_GPCR, GPCR_GEP_CNTL); /* Let GPIO0 output */ + ++ dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET); /* PHY RESET */ ++ dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM); /* Init */ ++ + ncr = (db->flags & DM9000_PLATF_EXT_PHY) ? NCR_EXT_PHY : 0; + + /* if wol is needed, then always set NCR_WAKEEN otherwise we end +@@ -1200,109 +1304,6 @@ dm9000_open(struct net_device *dev) + return 0; + } + +-/* +- * Sleep, either by using msleep() or if we are suspending, then +- * use mdelay() to sleep. +- */ +-static void dm9000_msleep(board_info_t *db, unsigned int ms) +-{ +- if (db->in_suspend) +- mdelay(ms); +- else +- msleep(ms); +-} +- +-/* +- * Read a word from phyxcer +- */ +-static int +-dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg) +-{ +- board_info_t *db = netdev_priv(dev); +- unsigned long flags; +- unsigned int reg_save; +- int ret; +- +- mutex_lock(&db->addr_lock); +- +- spin_lock_irqsave(&db->lock,flags); +- +- /* Save previous register address */ +- reg_save = readb(db->io_addr); +- +- /* Fill the phyxcer register into REG_0C */ +- iow(db, DM9000_EPAR, DM9000_PHY | reg); +- +- iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS); /* Issue phyxcer read command */ +- +- writeb(reg_save, db->io_addr); +- spin_unlock_irqrestore(&db->lock,flags); +- +- dm9000_msleep(db, 1); /* Wait read complete */ +- +- spin_lock_irqsave(&db->lock,flags); +- reg_save = readb(db->io_addr); +- +- iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer read command */ +- +- /* The read data keeps on REG_0D & REG_0E */ +- ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL); +- +- /* restore the previous address */ +- writeb(reg_save, db->io_addr); +- spin_unlock_irqrestore(&db->lock,flags); +- +- mutex_unlock(&db->addr_lock); +- +- dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret); +- return ret; +-} +- +-/* +- * Write a word to phyxcer +- */ +-static void +-dm9000_phy_write(struct net_device *dev, +- int phyaddr_unused, int reg, int value) +-{ +- board_info_t *db = netdev_priv(dev); +- unsigned long flags; +- unsigned long reg_save; +- +- dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value); +- mutex_lock(&db->addr_lock); +- +- spin_lock_irqsave(&db->lock,flags); +- +- /* Save previous register address */ +- reg_save = readb(db->io_addr); +- +- /* Fill the phyxcer register into REG_0C */ +- iow(db, DM9000_EPAR, DM9000_PHY | reg); +- +- /* Fill the written data into REG_0D & REG_0E */ +- iow(db, DM9000_EPDRL, value); +- iow(db, DM9000_EPDRH, value >> 8); +- +- iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW); /* Issue phyxcer write command */ +- +- writeb(reg_save, db->io_addr); +- spin_unlock_irqrestore(&db->lock, flags); +- +- dm9000_msleep(db, 1); /* Wait write complete */ +- +- spin_lock_irqsave(&db->lock,flags); +- reg_save = readb(db->io_addr); +- +- iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer write command */ +- +- /* restore the previous address */ +- writeb(reg_save, db->io_addr); +- +- spin_unlock_irqrestore(&db->lock, flags); +- mutex_unlock(&db->addr_lock); +-} +- + static void + dm9000_shutdown(struct net_device *dev) + { +@@ -1501,7 +1502,12 @@ dm9000_probe(struct platform_device *pde + db->flags |= DM9000_PLATF_SIMPLE_PHY; + #endif + +- dm9000_reset(db); ++ /* Fixing bug on dm9000_probe, takeover dm9000_reset(db), ++ * Need 'NCR_MAC_LBK' bit to indeed stable our DM9000 fifo ++ * while probe stage. ++ */ ++ ++ iow(db, DM9000_NCR, NCR_MAC_LBK | NCR_RST); + + /* try multiple times, DM9000 sometimes gets the read wrong */ + for (i = 0; i < 8; i++) { +--- a/drivers/net/ethernet/davicom/dm9000.h ++++ b/drivers/net/ethernet/davicom/dm9000.h +@@ -69,7 +69,9 @@ + #define NCR_WAKEEN (1<<6) + #define NCR_FCOL (1<<4) + #define NCR_FDX (1<<3) +-#define NCR_LBK (3<<1) ++ ++#define NCR_RESERVED (3<<1) ++#define NCR_MAC_LBK (1<<1) + #define NCR_RST (1<<0) + + #define NSR_SPEED (1<<7) +@@ -167,5 +169,12 @@ + #define ISR_LNKCHNG (1<<5) + #define ISR_UNDERRUN (1<<4) + ++/* Davicom MII registers. ++ */ ++ ++#define MII_DM_DSPCR 0x1b /* DSP Control Register */ ++ ++#define DSPCR_INIT_PARAM 0xE100 /* DSP init parameter */ ++ + #endif /* _DM9000X_H_ */ + diff --git a/queue-3.8/drivers-net-ethernet-cpsw-use-netif_wake_queue-while-restarting-tx-queue.patch b/queue-3.8/drivers-net-ethernet-cpsw-use-netif_wake_queue-while-restarting-tx-queue.patch new file mode 100644 index 00000000000..a38a6889cec --- /dev/null +++ b/queue-3.8/drivers-net-ethernet-cpsw-use-netif_wake_queue-while-restarting-tx-queue.patch @@ -0,0 +1,35 @@ +From 48f7ec674de0c7aa71ace3ffa735808df99705f0 Mon Sep 17 00:00:00 2001 +From: Mugunthan V N +Date: Wed, 27 Mar 2013 04:41:59 +0000 +Subject: drivers: net: ethernet: cpsw: use netif_wake_queue() while restarting tx queue + + +From: Mugunthan V N + +[ Upstream commit b56d6b3fca6d1214dbc9c5655f26e5d4ec04afc8 ] + +To restart tx queue use netif_wake_queue() intead of netif_start_queue() +so that net schedule will restart transmission immediately which will +increase network performance while doing huge data transfers. + +Reported-by: Dan Franke +Suggested-by: Sriramakrishnan A G +Signed-off-by: Mugunthan V N +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/cpsw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -375,7 +375,7 @@ void cpsw_tx_handler(void *token, int le + struct cpsw_priv *priv = netdev_priv(ndev); + + if (unlikely(netif_queue_stopped(ndev))) +- netif_start_queue(ndev); ++ netif_wake_queue(ndev); + cpts_tx_timestamp(&priv->cpts, skb); + priv->stats.tx_packets++; + priv->stats.tx_bytes += len; diff --git a/queue-3.8/drivers-net-ethernet-davinci_emac-use-netif_wake_queue-while-restarting-tx-queue.patch b/queue-3.8/drivers-net-ethernet-davinci_emac-use-netif_wake_queue-while-restarting-tx-queue.patch new file mode 100644 index 00000000000..8ecbcf80ac2 --- /dev/null +++ b/queue-3.8/drivers-net-ethernet-davinci_emac-use-netif_wake_queue-while-restarting-tx-queue.patch @@ -0,0 +1,31 @@ +From 942cfd4c45f0892631fdc556c4f1ce853f860edb Mon Sep 17 00:00:00 2001 +From: Mugunthan V N +Date: Wed, 27 Mar 2013 04:42:00 +0000 +Subject: drivers: net: ethernet: davinci_emac: use netif_wake_queue() while restarting tx queue + + +To restart tx queue use netif_wake_queue() intead of netif_start_queue() +so that net schedule will restart transmission immediately which will +increase network performance while doing huge data transfers. + +Reported-by: Dan Franke +Suggested-by: Sriramakrishnan A G +Signed-off-by: Mugunthan V N +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/davinci_emac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -1055,7 +1055,7 @@ static void emac_tx_handler(void *token, + atomic_dec(&priv->cur_tx); + + if (unlikely(netif_queue_stopped(ndev))) +- netif_start_queue(ndev); ++ netif_wake_queue(ndev); + ndev->stats.tx_packets++; + ndev->stats.tx_bytes += len; + dev_kfree_skb_any(skb); diff --git a/queue-3.8/fec-fix-the-build-as-module.patch b/queue-3.8/fec-fix-the-build-as-module.patch new file mode 100644 index 00000000000..0c45b3873d5 --- /dev/null +++ b/queue-3.8/fec-fix-the-build-as-module.patch @@ -0,0 +1,50 @@ +From 8b87ef5c47d27e493894909713584f9ea2d0f13c Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Wed, 20 Mar 2013 08:19:32 +0000 +Subject: fec: Fix the build as module + + +From: Fabio Estevam + +[ Upstream commit 9d73adf431e093b23fb4990f1ade11283cb67a98 ] + +Since commit ff43da86c69 (NET: FEC: dynamtic check DMA desc buff type) the +following build error happens when CONFIG_FEC=m + +ERROR: "fec_ptp_init" [drivers/net/ethernet/freescale/fec.ko] undefined! +ERROR: "fec_ptp_ioctl" [drivers/net/ethernet/freescale/fec.ko] undefined! +ERROR: "fec_ptp_start_cyclecounter" [drivers/net/ethernet/freescale/fec.ko] undefined! + +Fix it by exporting the required fec_ptp symbols. + +Reported-by: Uwe Kleine-Koenig +Signed-off-by: Fabio Estevam +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/fec_ptp.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/freescale/fec_ptp.c ++++ b/drivers/net/ethernet/freescale/fec_ptp.c +@@ -128,6 +128,7 @@ void fec_ptp_start_cyclecounter(struct n + + spin_unlock_irqrestore(&fep->tmreg_lock, flags); + } ++EXPORT_SYMBOL(fec_ptp_start_cyclecounter); + + /** + * fec_ptp_adjfreq - adjust ptp cycle frequency +@@ -318,6 +319,7 @@ int fec_ptp_ioctl(struct net_device *nde + return copy_to_user(ifr->ifr_data, &config, sizeof(config)) ? + -EFAULT : 0; + } ++EXPORT_SYMBOL(fec_ptp_ioctl); + + /** + * fec_time_keep - call timecounter_read every second to avoid timer overrun +@@ -381,3 +383,4 @@ void fec_ptp_init(struct net_device *nde + pr_info("registered PHC device on %s\n", ndev->name); + } + } ++EXPORT_SYMBOL(fec_ptp_init); diff --git a/queue-3.8/ipv6-don-t-accept-multicast-traffic-with-scope-0.patch b/queue-3.8/ipv6-don-t-accept-multicast-traffic-with-scope-0.patch new file mode 100644 index 00000000000..7ed09b0bf36 --- /dev/null +++ b/queue-3.8/ipv6-don-t-accept-multicast-traffic-with-scope-0.patch @@ -0,0 +1,43 @@ +From 750cfde171136f23a2bdc4cea5e18eb3a35060d2 Mon Sep 17 00:00:00 2001 +From: Hannes Frederic Sowa +Date: Sun, 10 Feb 2013 05:35:22 +0000 +Subject: ipv6: don't accept multicast traffic with scope 0 + + +From: Hannes Frederic Sowa + +[ Upstream commit 20314092c1b41894d8c181bf9aa6f022be2416aa ] + +v2: +a) moved before multicast source address check +b) changed comment to netdev style + +Cc: Erik Hugne +Cc: YOSHIFUJI Hideaki +Acked-by: YOSHIFUJI Hideaki +Signed-off-by: Hannes Frederic Sowa +Acked-by: YOSHIFUJI Hideaki +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_input.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -118,6 +118,15 @@ int ipv6_rcv(struct sk_buff *skb, struct + ipv6_addr_loopback(&hdr->daddr)) + goto err; + ++ /* RFC4291 2.7 ++ * Nodes must not originate a packet to a multicast address whose scope ++ * field contains the reserved value 0; if such a packet is received, it ++ * must be silently dropped. ++ */ ++ if (ipv6_addr_is_multicast(&hdr->daddr) && ++ IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 0) ++ goto err; ++ + /* + * RFC4291 2.7 + * Multicast addresses must not be used as source addresses in IPv6 diff --git a/queue-3.8/ipv6-don-t-accept-node-local-multicast-traffic-from-the-wire.patch b/queue-3.8/ipv6-don-t-accept-node-local-multicast-traffic-from-the-wire.patch new file mode 100644 index 00000000000..be9e376b6a5 --- /dev/null +++ b/queue-3.8/ipv6-don-t-accept-node-local-multicast-traffic-from-the-wire.patch @@ -0,0 +1,49 @@ +From 3abe6e4c2d6b6453fafa59bfff4c771eb093ceb1 Mon Sep 17 00:00:00 2001 +From: Hannes Frederic Sowa +Date: Tue, 26 Mar 2013 08:13:34 +0000 +Subject: ipv6: don't accept node local multicast traffic from the wire + + +From: Hannes Frederic Sowa + +[ Upstream commit 1c4a154e5253687c51123956dfcee9e9dfa8542d ] + +Erik Hugne's errata proposal (Errata ID: 3480) to RFC4291 has been +verified: http://www.rfc-editor.org/errata_search.php?eid=3480 + +We have to check for pkt_type and loopback flag because either the +packets are allowed to travel over the loopback interface (in which case +pkt_type is PACKET_HOST and IFF_LOOPBACK flag is set) or they travel +over a non-loopback interface back to us (in which case PACKET_TYPE is +PACKET_LOOPBACK and IFF_LOOPBACK flag is not set). + +Cc: Erik Hugne +Cc: YOSHIFUJI Hideaki +Signed-off-by: Hannes Frederic Sowa +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_input.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -118,6 +118,18 @@ int ipv6_rcv(struct sk_buff *skb, struct + ipv6_addr_loopback(&hdr->daddr)) + goto err; + ++ /* RFC4291 Errata ID: 3480 ++ * Interface-Local scope spans only a single interface on a ++ * node and is useful only for loopback transmission of ++ * multicast. Packets with interface-local scope received ++ * from another node must be discarded. ++ */ ++ if (!(skb->pkt_type == PACKET_LOOPBACK || ++ dev->flags & IFF_LOOPBACK) && ++ ipv6_addr_is_multicast(&hdr->daddr) && ++ IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1) ++ goto err; ++ + /* RFC4291 2.7 + * Nodes must not originate a packet to a multicast address whose scope + * field contains the reserved value 0; if such a packet is received, it diff --git a/queue-3.8/ipv6-fix-bad-free-of-addrconf_init_net.patch b/queue-3.8/ipv6-fix-bad-free-of-addrconf_init_net.patch new file mode 100644 index 00000000000..dbcabff71f2 --- /dev/null +++ b/queue-3.8/ipv6-fix-bad-free-of-addrconf_init_net.patch @@ -0,0 +1,56 @@ +From 8c2c2758276caff3260b3fd6de56ea7114aeb434 Mon Sep 17 00:00:00 2001 +From: Hong Zhiguo +Date: Tue, 26 Mar 2013 01:52:45 +0800 +Subject: ipv6: fix bad free of addrconf_init_net + + +From: Hong Zhiguo + +[ Upstream commit a79ca223e029aa4f09abb337accf1812c900a800 ] + +Signed-off-by: Hong Zhiguo +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrconf.c | 26 ++++++++++---------------- + 1 file changed, 10 insertions(+), 16 deletions(-) + +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -4787,26 +4787,20 @@ static void addrconf_sysctl_unregister(s + + static int __net_init addrconf_init_net(struct net *net) + { +- int err; ++ int err = -ENOMEM; + struct ipv6_devconf *all, *dflt; + +- err = -ENOMEM; +- all = &ipv6_devconf; +- dflt = &ipv6_devconf_dflt; ++ all = kmemdup(&ipv6_devconf, sizeof(ipv6_devconf), GFP_KERNEL); ++ if (all == NULL) ++ goto err_alloc_all; + +- if (!net_eq(net, &init_net)) { +- all = kmemdup(all, sizeof(ipv6_devconf), GFP_KERNEL); +- if (all == NULL) +- goto err_alloc_all; ++ dflt = kmemdup(&ipv6_devconf_dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL); ++ if (dflt == NULL) ++ goto err_alloc_dflt; + +- dflt = kmemdup(dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL); +- if (dflt == NULL) +- goto err_alloc_dflt; +- } else { +- /* these will be inherited by all namespaces */ +- dflt->autoconf = ipv6_defaults.autoconf; +- dflt->disable_ipv6 = ipv6_defaults.disable_ipv6; +- } ++ /* these will be inherited by all namespaces */ ++ dflt->autoconf = ipv6_defaults.autoconf; ++ dflt->disable_ipv6 = ipv6_defaults.disable_ipv6; + + net->ipv6.devconf_all = all; + net->ipv6.devconf_dflt = dflt; diff --git a/queue-3.8/ks8851-fix-interpretation-of-rxlen-field.patch b/queue-3.8/ks8851-fix-interpretation-of-rxlen-field.patch new file mode 100644 index 00000000000..652fed254bf --- /dev/null +++ b/queue-3.8/ks8851-fix-interpretation-of-rxlen-field.patch @@ -0,0 +1,38 @@ +From 327f957e6c86612fe289723f7fe31dacba0c3f8e Mon Sep 17 00:00:00 2001 +From: "Max.Nekludov@us.elster.com" +Date: Fri, 29 Mar 2013 05:27:36 +0000 +Subject: ks8851: Fix interpretation of rxlen field. + + +From: "Max.Nekludov@us.elster.com" + +[ Upstream commit 14bc435ea54cb888409efb54fc6b76c13ef530e9 ] + +According to the Datasheet (page 52): +15-12 Reserved +11-0 RXBC Receive Byte Count +This field indicates the present received frame byte size. + +The code has a bug: + rxh = ks8851_rdreg32(ks, KS_RXFHSR); + rxstat = rxh & 0xffff; + rxlen = rxh >> 16; // BUG!!! 0xFFF mask should be applied + +Signed-off-by: Max Nekludov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/micrel/ks8851.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/micrel/ks8851.c ++++ b/drivers/net/ethernet/micrel/ks8851.c +@@ -547,7 +547,7 @@ static void ks8851_rx_pkts(struct ks8851 + for (; rxfc != 0; rxfc--) { + rxh = ks8851_rdreg32(ks, KS_RXFHSR); + rxstat = rxh & 0xffff; +- rxlen = rxh >> 16; ++ rxlen = (rxh >> 16) & 0xfff; + + netif_dbg(ks, rx_status, ks->netdev, + "rx: stat 0x%04x, len 0x%04x\n", rxstat, rxlen); diff --git a/queue-3.8/net-add-a-synchronize_net-in-netdev_rx_handler_unregister.patch b/queue-3.8/net-add-a-synchronize_net-in-netdev_rx_handler_unregister.patch new file mode 100644 index 00000000000..b8781611ee2 --- /dev/null +++ b/queue-3.8/net-add-a-synchronize_net-in-netdev_rx_handler_unregister.patch @@ -0,0 +1,127 @@ +From 7fe700dbfc0abc4fd21afc40996d02b5958e8503 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Fri, 29 Mar 2013 03:01:22 +0000 +Subject: net: add a synchronize_net() in netdev_rx_handler_unregister() + + +From: Eric Dumazet + +[ Upstream commit 00cfec37484761a44a3b6f4675a54caa618210ae ] + +commit 35d48903e97819 (bonding: fix rx_handler locking) added a race +in bonding driver, reported by Steven Rostedt who did a very good +diagnosis : + + + +I'm currently debugging a crash in an old 3.0-rt kernel that one of our +customers is seeing. The bug happens with a stress test that loads and +unloads the bonding module in a loop (I don't know all the details as +I'm not the one that is directly interacting with the customer). But the +bug looks to be something that may still be present and possibly present +in mainline too. It will just be much harder to trigger it in mainline. + +In -rt, interrupts are threads, and can schedule in and out just like +any other thread. Note, mainline now supports interrupt threads so this +may be easily reproducible in mainline as well. I don't have the ability +to tell the customer to try mainline or other kernels, so my hands are +somewhat tied to what I can do. + +But according to a core dump, I tracked down that the eth irq thread +crashed in bond_handle_frame() here: + + slave = bond_slave_get_rcu(skb->dev); + bond = slave->bond; <--- BUG + +the slave returned was NULL and accessing slave->bond caused a NULL +pointer dereference. + +Looking at the code that unregisters the handler: + +void netdev_rx_handler_unregister(struct net_device *dev) +{ + + ASSERT_RTNL(); + RCU_INIT_POINTER(dev->rx_handler, NULL); + RCU_INIT_POINTER(dev->rx_handler_data, NULL); +} + +Which is basically: + dev->rx_handler = NULL; + dev->rx_handler_data = NULL; + +And looking at __netif_receive_skb() we have: + + rx_handler = rcu_dereference(skb->dev->rx_handler); + if (rx_handler) { + if (pt_prev) { + ret = deliver_skb(skb, pt_prev, orig_dev); + pt_prev = NULL; + } + switch (rx_handler(&skb)) { + +My question to all of you is, what stops this interrupt from happening +while the bonding module is unloading? What happens if the interrupt +triggers and we have this: + + CPU0 CPU1 + ---- ---- + rx_handler = skb->dev->rx_handler + + netdev_rx_handler_unregister() { + dev->rx_handler = NULL; + dev->rx_handler_data = NULL; + + rx_handler() + bond_handle_frame() { + slave = skb->dev->rx_handler; + bond = slave->bond; <-- NULL pointer dereference!!! + +What protection am I missing in the bond release handler that would +prevent the above from happening? + + + +We can fix bug this in two ways. First is adding a test in +bond_handle_frame() and others to check if rx_handler_data is NULL. + +A second way is adding a synchronize_net() in +netdev_rx_handler_unregister() to make sure that a rcu protected reader +has the guarantee to see a non NULL rx_handler_data. + +The second way is better as it avoids an extra test in fast path. + +Reported-by: Steven Rostedt +Signed-off-by: Eric Dumazet +Cc: Jiri Pirko +Cc: Paul E. McKenney +Acked-by: Steven Rostedt +Reviewed-by: Paul E. McKenney +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/dev.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3276,6 +3276,7 @@ int netdev_rx_handler_register(struct ne + if (dev->rx_handler) + return -EBUSY; + ++ /* Note: rx_handler_data must be set before rx_handler */ + rcu_assign_pointer(dev->rx_handler_data, rx_handler_data); + rcu_assign_pointer(dev->rx_handler, rx_handler); + +@@ -3296,6 +3297,11 @@ void netdev_rx_handler_unregister(struct + + ASSERT_RTNL(); + RCU_INIT_POINTER(dev->rx_handler, NULL); ++ /* a reader seeing a non NULL rx_handler in a rcu_read_lock() ++ * section has a guarantee to see a non NULL rx_handler_data ++ * as well. ++ */ ++ synchronize_net(); + RCU_INIT_POINTER(dev->rx_handler_data, NULL); + } + EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister); diff --git a/queue-3.8/net-ethernet-cpsw-fix-erroneous-condition-in-error-check.patch b/queue-3.8/net-ethernet-cpsw-fix-erroneous-condition-in-error-check.patch new file mode 100644 index 00000000000..d307ceb55a2 --- /dev/null +++ b/queue-3.8/net-ethernet-cpsw-fix-erroneous-condition-in-error-check.patch @@ -0,0 +1,33 @@ +From 4c1b9f826533e277b5682eceb2099286dfcfbeaa Mon Sep 17 00:00:00 2001 +From: Lothar Waßmann +Date: Thu, 21 Mar 2013 02:20:11 +0000 +Subject: net: ethernet: cpsw: fix erroneous condition in error check + + +From: =?UTF-8?q?Lothar=20Wa=C3=9Fmann?= + +[ Upstream commit ce16294fda230c787ce5c35f61b2f80d14d70a72 ] + +The error check in cpsw_probe_dt() has an '&&' where an '||' is +meant to be. This causes a NULL pointer dereference when incomplet DT +data is passed to the driver ('phy_id' property for cpsw_emac1 +missing). + +Signed-off-by: Lothar Waßmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/cpsw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -1111,7 +1111,7 @@ static int cpsw_probe_dt(struct cpsw_pla + struct platform_device *mdio; + + parp = of_get_property(slave_node, "phy_id", &lenp); +- if ((parp == NULL) && (lenp != (sizeof(void *) * 2))) { ++ if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) { + pr_err("Missing slave[%d] phy_id property\n", i); + ret = -EINVAL; + goto error_ret; diff --git a/queue-3.8/net-fix-_diag_max-constants.patch b/queue-3.8/net-fix-_diag_max-constants.patch new file mode 100644 index 00000000000..f13c63e07ac --- /dev/null +++ b/queue-3.8/net-fix-_diag_max-constants.patch @@ -0,0 +1,66 @@ +From ec4c09a4cb738a5c47819709aa1004aab475d43c Mon Sep 17 00:00:00 2001 +From: Andrey Vagin +Date: Thu, 21 Mar 2013 20:33:46 +0400 +Subject: net: fix *_DIAG_MAX constants + + +From: Andrey Vagin + +[ Upstream commit ae5fc98728c8bbbd6d7cab0b9781671fc4419c1b ] + +Follow the common pattern and define *_DIAG_MAX like: + + [...] + __XXX_DIAG_MAX, +}; + +Because everyone is used to do: + + struct nlattr *attrs[XXX_DIAG_MAX+1]; + + nla_parse([...], XXX_DIAG_MAX, [...] + +Reported-by: Thomas Graf +Cc: "David S. Miller" +Cc: Pavel Emelyanov +Cc: Eric Dumazet +Cc: "Paul E. McKenney" +Cc: David Howells +Signed-off-by: Andrey Vagin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/packet_diag.h | 4 +++- + include/uapi/linux/unix_diag.h | 4 +++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/include/uapi/linux/packet_diag.h ++++ b/include/uapi/linux/packet_diag.h +@@ -33,9 +33,11 @@ enum { + PACKET_DIAG_TX_RING, + PACKET_DIAG_FANOUT, + +- PACKET_DIAG_MAX, ++ __PACKET_DIAG_MAX, + }; + ++#define PACKET_DIAG_MAX (__PACKET_DIAG_MAX - 1) ++ + struct packet_diag_info { + __u32 pdi_index; + __u32 pdi_version; +--- a/include/uapi/linux/unix_diag.h ++++ b/include/uapi/linux/unix_diag.h +@@ -39,9 +39,11 @@ enum { + UNIX_DIAG_MEMINFO, + UNIX_DIAG_SHUTDOWN, + +- UNIX_DIAG_MAX, ++ __UNIX_DIAG_MAX, + }; + ++#define UNIX_DIAG_MAX (__UNIX_DIAG_MAX - 1) ++ + struct unix_diag_vfs { + __u32 udiag_vfs_ino; + __u32 udiag_vfs_dev; diff --git a/queue-3.8/net-fix-the-use-of-this_cpu_ptr.patch b/queue-3.8/net-fix-the-use-of-this_cpu_ptr.patch new file mode 100644 index 00000000000..6a31ea7a036 --- /dev/null +++ b/queue-3.8/net-fix-the-use-of-this_cpu_ptr.patch @@ -0,0 +1,35 @@ +From 24ec2f461c2436afc77aafdfbce35ff6ce80474a Mon Sep 17 00:00:00 2001 +From: Li RongQing +Date: Wed, 27 Mar 2013 23:42:41 +0000 +Subject: net: fix the use of this_cpu_ptr + + +From: Li RongQing + +[ Upstream commit 50eab0503a7579ada512e4968738b7c9737cf36e ] + +flush_tasklet is not percpu var, and percpu is percpu var, and + this_cpu_ptr(&info->cache->percpu->flush_tasklet) +is not equal to + &this_cpu_ptr(info->cache->percpu)->flush_tasklet + +1f743b076(use this_cpu_ptr per-cpu helper) introduced this bug. + +Signed-off-by: Li RongQing +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/flow.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/flow.c ++++ b/net/core/flow.c +@@ -329,7 +329,7 @@ static void flow_cache_flush_per_cpu(voi + struct flow_flush_info *info = data; + struct tasklet_struct *tasklet; + +- tasklet = this_cpu_ptr(&info->cache->percpu->flush_tasklet); ++ tasklet = &this_cpu_ptr(info->cache->percpu)->flush_tasklet; + tasklet->data = (unsigned long)info; + tasklet_schedule(tasklet); + } diff --git a/queue-3.8/net-fq_codel-fix-off-by-one-error.patch b/queue-3.8/net-fq_codel-fix-off-by-one-error.patch new file mode 100644 index 00000000000..76558de80d7 --- /dev/null +++ b/queue-3.8/net-fq_codel-fix-off-by-one-error.patch @@ -0,0 +1,32 @@ +From c527a555494d486e6133cfd61f9ed2a55d1afff0 Mon Sep 17 00:00:00 2001 +From: Vijay Subramanian +Date: Thu, 28 Mar 2013 13:52:00 +0000 +Subject: net: fq_codel: Fix off-by-one error + + +From: Vijay Subramanian + +[ Upstream commit cd68ddd4c29ab523440299f24ff2417fe7a0dca6 ] + +Currently, we hold a max of sch->limit -1 number of packets instead of +sch->limit packets. Fix this off-by-one error. + +Signed-off-by: Vijay Subramanian +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_fq_codel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/sch_fq_codel.c ++++ b/net/sched/sch_fq_codel.c +@@ -195,7 +195,7 @@ static int fq_codel_enqueue(struct sk_bu + flow->deficit = q->quantum; + flow->dropped = 0; + } +- if (++sch->q.qlen < sch->limit) ++ if (++sch->q.qlen <= sch->limit) + return NET_XMIT_SUCCESS; + + q->drop_overlimit++; diff --git a/queue-3.8/net-remove-a-warn_on-in-net_enable_timestamp.patch b/queue-3.8/net-remove-a-warn_on-in-net_enable_timestamp.patch new file mode 100644 index 00000000000..b80cf45b772 --- /dev/null +++ b/queue-3.8/net-remove-a-warn_on-in-net_enable_timestamp.patch @@ -0,0 +1,55 @@ +From b27297324c5f9c71bf504d6d70cce57722aa1e93 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Fri, 22 Mar 2013 14:38:28 +0000 +Subject: net: remove a WARN_ON() in net_enable_timestamp() + + +From: Eric Dumazet + +[ Upstream commit 9979a55a833883242e3a29f3596676edd7199c46 ] + +The WARN_ON(in_interrupt()) in net_enable_timestamp() can get false +positive, in socket clone path, run from softirq context : + +[ 3641.624425] WARNING: at net/core/dev.c:1532 net_enable_timestamp+0x7b/0x80() +[ 3641.668811] Call Trace: +[ 3641.671254] [] warn_slowpath_common+0x87/0xc0 +[ 3641.677871] [] warn_slowpath_null+0x1a/0x20 +[ 3641.683683] [] net_enable_timestamp+0x7b/0x80 +[ 3641.689668] [] sk_clone_lock+0x425/0x450 +[ 3641.695222] [] inet_csk_clone_lock+0x16/0x170 +[ 3641.701213] [] tcp_create_openreq_child+0x29/0x820 +[ 3641.707663] [] ? ipt_do_table+0x222/0x670 +[ 3641.713354] [] tcp_v4_syn_recv_sock+0xab/0x3d0 +[ 3641.719425] [] tcp_check_req+0x3da/0x530 +[ 3641.724979] [] ? inet_hashinfo_init+0x60/0x80 +[ 3641.730964] [] ? tcp_v4_rcv+0x79f/0xbe0 +[ 3641.736430] [] tcp_v4_do_rcv+0x38d/0x4f0 +[ 3641.741985] [] tcp_v4_rcv+0xa7a/0xbe0 + +Its safe at this point because the parent socket owns a reference +on the netstamp_needed, so we cant have a 0 -> 1 transition, which +requires to lock a mutex. + +Instead of refining the check, lets remove it, as all known callers +are safe. If it ever changes in the future, static_key_slow_inc() +will complain anyway. + +Reported-by: Laurent Chavey +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/dev.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1591,7 +1591,6 @@ void net_enable_timestamp(void) + return; + } + #endif +- WARN_ON(in_interrupt()); + static_key_slow_inc(&netstamp_needed); + } + EXPORT_SYMBOL(net_enable_timestamp); diff --git a/queue-3.8/pch_gbe-fix-ip_summed-checksum-reporting-on-rx.patch b/queue-3.8/pch_gbe-fix-ip_summed-checksum-reporting-on-rx.patch new file mode 100644 index 00000000000..fe3d1855ba3 --- /dev/null +++ b/queue-3.8/pch_gbe-fix-ip_summed-checksum-reporting-on-rx.patch @@ -0,0 +1,36 @@ +From be0da62e865d43c9b7647d782e5965a4a08fcfd8 Mon Sep 17 00:00:00 2001 +From: Veaceslav Falico +Date: Mon, 25 Mar 2013 22:26:21 +0000 +Subject: pch_gbe: fix ip_summed checksum reporting on rx + + +From: Veaceslav Falico + +[ Upstream commit 76a0e68129d7d24eb995a6871ab47081bbfa0acc ] + +skb->ip_summed should be CHECKSUM_UNNECESSARY when the driver reports that +checksums were correct and CHECKSUM_NONE in any other case. They're +currently placed vice versa, which breaks the forwarding scenario. Fix it +by placing them as described above. + +Signed-off-by: Veaceslav Falico +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c ++++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c +@@ -1726,9 +1726,9 @@ pch_gbe_clean_rx(struct pch_gbe_adapter + + skb->protocol = eth_type_trans(skb, netdev); + if (tcp_ip_status & PCH_GBE_RXD_ACC_STAT_TCPIPOK) +- skb->ip_summed = CHECKSUM_NONE; +- else + skb->ip_summed = CHECKSUM_UNNECESSARY; ++ else ++ skb->ip_summed = CHECKSUM_NONE; + + napi_gro_receive(&adapter->napi, skb); + (*work_done)++; diff --git a/queue-3.8/series b/queue-3.8/series index 3191afc8a5d..0d4bd0ab748 100644 --- a/queue-3.8/series +++ b/queue-3.8/series @@ -94,3 +94,31 @@ tracing-prevent-buffer-overwrite-disabled-for-latency-tracers.patch efivars-explicitly-calculate-length-of-variablename.patch efivars-handle-duplicate-names-from-get_next_variable.patch regulator-fix-memory-garbage-dev_err-printout.patch +net-remove-a-warn_on-in-net_enable_timestamp.patch +sky2-receive-overflows-not-counted.patch +sky2-threshold-for-pause-packet-is-set-wrong.patch +tcp-preserve-ack-clocking-in-tso.patch +tcp-undo-spurious-timeout-after-sack-reneging.patch +8021q-fix-a-potential-use-after-free.patch +thermal-shorten-too-long-mcast-group-name.patch +unix-fix-a-race-condition-in-unix_release.patch +af_unix-dont-send-scm_credential-when-dest-socket-is-null.patch +bonding-remove-already-created-master-sysfs-link-on-failure.patch +bonding-fix-disabling-of-arp_interval-and-miimon.patch +drivers-net-ethernet-davinci_emac-use-netif_wake_queue-while-restarting-tx-queue.patch +drivers-net-ethernet-cpsw-use-netif_wake_queue-while-restarting-tx-queue.patch +net-fix-_diag_max-constants.patch +aoe-reserve-enough-headroom-on-skbs.patch +atl1e-drop-pci-msi-support-because-of-packet-corruption.patch +dm9000b-driver-initialization-upgrade.patch +fec-fix-the-build-as-module.patch +ipv6-fix-bad-free-of-addrconf_init_net.patch +ipv6-don-t-accept-multicast-traffic-with-scope-0.patch +ipv6-don-t-accept-node-local-multicast-traffic-from-the-wire.patch +ks8851-fix-interpretation-of-rxlen-field.patch +net-add-a-synchronize_net-in-netdev_rx_handler_unregister.patch +net-ethernet-cpsw-fix-erroneous-condition-in-error-check.patch +net-fix-the-use-of-this_cpu_ptr.patch +net-fq_codel-fix-off-by-one-error.patch +pch_gbe-fix-ip_summed-checksum-reporting-on-rx.patch +smsc75xx-fix-jumbo-frame-support.patch diff --git a/queue-3.8/sky2-receive-overflows-not-counted.patch b/queue-3.8/sky2-receive-overflows-not-counted.patch new file mode 100644 index 00000000000..d96750c3377 --- /dev/null +++ b/queue-3.8/sky2-receive-overflows-not-counted.patch @@ -0,0 +1,37 @@ +From 3b5b5f8dc7597878752db9d820a771de3fbb5a40 Mon Sep 17 00:00:00 2001 +From: Mirko Lindner +Date: Tue, 26 Mar 2013 06:38:35 +0000 +Subject: sky2: Receive Overflows not counted + + +From: Mirko Lindner + +[ Upstream commit 9cfe8b156c21cf340b3a10ecb3022fbbc1c39185 ] + +The sky2 driver doesn't count the Receive Overflows because the MAC +interrupt for this event is not set in the MAC's interrupt mask. +The MAC's interrupt mask is set only for Transmit FIFO Underruns. + +Fix: The correct setting should be (GM_IS_TX_FF_UR | GM_IS_RX_FF_OR) +Otherwise the Receive Overflow event will not generate any interrupt. +The Receive Overflow interrupt is handled correctly + +Signed-off-by: Mirko Lindner +Acked-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/sky2.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/sky2.h ++++ b/drivers/net/ethernet/marvell/sky2.h +@@ -2074,7 +2074,7 @@ enum { + GM_IS_RX_FF_OR = 1<<1, /* Receive FIFO Overrun */ + GM_IS_RX_COMPL = 1<<0, /* Frame Reception Complete */ + +-#define GMAC_DEF_MSK GM_IS_TX_FF_UR ++#define GMAC_DEF_MSK (GM_IS_TX_FF_UR | GM_IS_RX_FF_OR) + }; + + /* GMAC_LINK_CTRL 16 bit GMAC Link Control Reg (YUKON only) */ diff --git a/queue-3.8/sky2-threshold-for-pause-packet-is-set-wrong.patch b/queue-3.8/sky2-threshold-for-pause-packet-is-set-wrong.patch new file mode 100644 index 00000000000..53f48d2a739 --- /dev/null +++ b/queue-3.8/sky2-threshold-for-pause-packet-is-set-wrong.patch @@ -0,0 +1,35 @@ +From 1694c623bf63248b3e8e77c17061da6618941699 Mon Sep 17 00:00:00 2001 +From: Mirko Lindner +Date: Tue, 26 Mar 2013 06:38:42 +0000 +Subject: sky2: Threshold for Pause Packet is set wrong + + +From: Mirko Lindner + +[ Upstream commit 74f9f42c1c1650e74fb464f76644c9041f996851 ] + +The sky2 driver sets the Rx Upper Threshold for Pause Packet generation to a +wrong value which leads to only 2kB of RAM remaining space. This can lead to +Rx overflow errors even with activated flow-control. + +Fix: We should increase the value to 8192/8 + +Signed-off-by: Mirko Lindner +Acked-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/sky2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/sky2.c ++++ b/drivers/net/ethernet/marvell/sky2.c +@@ -1067,7 +1067,7 @@ static void sky2_ramset(struct sky2_hw * + sky2_write32(hw, RB_ADDR(q, RB_RX_UTHP), tp); + sky2_write32(hw, RB_ADDR(q, RB_RX_LTHP), space/2); + +- tp = space - 2048/8; ++ tp = space - 8192/8; + sky2_write32(hw, RB_ADDR(q, RB_RX_UTPP), tp); + sky2_write32(hw, RB_ADDR(q, RB_RX_LTPP), space/4); + } else { diff --git a/queue-3.8/smsc75xx-fix-jumbo-frame-support.patch b/queue-3.8/smsc75xx-fix-jumbo-frame-support.patch new file mode 100644 index 00000000000..da0d881f91a --- /dev/null +++ b/queue-3.8/smsc75xx-fix-jumbo-frame-support.patch @@ -0,0 +1,63 @@ +From cf25a1e38ba1ae2e312be11dc05bde8404fdf2dd Mon Sep 17 00:00:00 2001 +From: Steve Glendinning +Date: Thu, 28 Mar 2013 02:34:41 +0000 +Subject: smsc75xx: fix jumbo frame support + + +From: Steve Glendinning + +[ Upstream commit 4c51e53689569398d656e631c17308d9b8e84650 ] + +This patch enables RX of jumbo frames for LAN7500. + +Previously the driver would transmit jumbo frames succesfully but +would drop received jumbo frames (incrementing the interface errors +count). + +With this patch applied the device can succesfully receive jumbo +frames up to MTU 9000 (9014 bytes on the wire including ethernet +header). + +Signed-off-by: Steve Glendinning +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/smsc75xx.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -914,8 +914,12 @@ static int smsc75xx_set_rx_max_frame_len + static int smsc75xx_change_mtu(struct net_device *netdev, int new_mtu) + { + struct usbnet *dev = netdev_priv(netdev); ++ int ret; ++ ++ if (new_mtu > MAX_SINGLE_PACKET_SIZE) ++ return -EINVAL; + +- int ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu); ++ ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu + ETH_HLEN); + if (ret < 0) { + netdev_warn(dev->net, "Failed to set mac rx frame length\n"); + return ret; +@@ -1324,7 +1328,7 @@ static int smsc75xx_reset(struct usbnet + + netif_dbg(dev, ifup, dev->net, "FCT_TX_CTL set to 0x%08x\n", buf); + +- ret = smsc75xx_set_rx_max_frame_length(dev, 1514); ++ ret = smsc75xx_set_rx_max_frame_length(dev, dev->net->mtu + ETH_HLEN); + if (ret < 0) { + netdev_warn(dev->net, "Failed to set max rx frame length\n"); + return ret; +@@ -2136,8 +2140,8 @@ static int smsc75xx_rx_fixup(struct usbn + else if (rx_cmd_a & (RX_CMD_A_LONG | RX_CMD_A_RUNT)) + dev->net->stats.rx_frame_errors++; + } else { +- /* ETH_FRAME_LEN + 4(CRC) + 2(COE) + 4(Vlan) */ +- if (unlikely(size > (ETH_FRAME_LEN + 12))) { ++ /* MAX_SINGLE_PACKET_SIZE + 4(CRC) + 2(COE) + 4(Vlan) */ ++ if (unlikely(size > (MAX_SINGLE_PACKET_SIZE + ETH_HLEN + 12))) { + netif_dbg(dev, rx_err, dev->net, + "size err rx_cmd_a=0x%08x\n", + rx_cmd_a); diff --git a/queue-3.8/tcp-preserve-ack-clocking-in-tso.patch b/queue-3.8/tcp-preserve-ack-clocking-in-tso.patch new file mode 100644 index 00000000000..1340e935b80 --- /dev/null +++ b/queue-3.8/tcp-preserve-ack-clocking-in-tso.patch @@ -0,0 +1,88 @@ +From 83fd2c09ed5206b13ed34d5400171551101185dd Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 21 Mar 2013 17:36:09 +0000 +Subject: tcp: preserve ACK clocking in TSO + + +From: Eric Dumazet + +[ Upstream commit f4541d60a449afd40448b06496dcd510f505928e ] + +A long standing problem with TSO is the fact that tcp_tso_should_defer() +rearms the deferred timer, while it should not. + +Current code leads to following bad bursty behavior : + +20:11:24.484333 IP A > B: . 297161:316921(19760) ack 1 win 119 +20:11:24.484337 IP B > A: . ack 263721 win 1117 +20:11:24.485086 IP B > A: . ack 265241 win 1117 +20:11:24.485925 IP B > A: . ack 266761 win 1117 +20:11:24.486759 IP B > A: . ack 268281 win 1117 +20:11:24.487594 IP B > A: . ack 269801 win 1117 +20:11:24.488430 IP B > A: . ack 271321 win 1117 +20:11:24.489267 IP B > A: . ack 272841 win 1117 +20:11:24.490104 IP B > A: . ack 274361 win 1117 +20:11:24.490939 IP B > A: . ack 275881 win 1117 +20:11:24.491775 IP B > A: . ack 277401 win 1117 +20:11:24.491784 IP A > B: . 316921:332881(15960) ack 1 win 119 +20:11:24.492620 IP B > A: . ack 278921 win 1117 +20:11:24.493448 IP B > A: . ack 280441 win 1117 +20:11:24.494286 IP B > A: . ack 281961 win 1117 +20:11:24.495122 IP B > A: . ack 283481 win 1117 +20:11:24.495958 IP B > A: . ack 285001 win 1117 +20:11:24.496791 IP B > A: . ack 286521 win 1117 +20:11:24.497628 IP B > A: . ack 288041 win 1117 +20:11:24.498459 IP B > A: . ack 289561 win 1117 +20:11:24.499296 IP B > A: . ack 291081 win 1117 +20:11:24.500133 IP B > A: . ack 292601 win 1117 +20:11:24.500970 IP B > A: . ack 294121 win 1117 +20:11:24.501388 IP B > A: . ack 295641 win 1117 +20:11:24.501398 IP A > B: . 332881:351881(19000) ack 1 win 119 + +While the expected behavior is more like : + +20:19:49.259620 IP A > B: . 197601:202161(4560) ack 1 win 119 +20:19:49.260446 IP B > A: . ack 154281 win 1212 +20:19:49.261282 IP B > A: . ack 155801 win 1212 +20:19:49.262125 IP B > A: . ack 157321 win 1212 +20:19:49.262136 IP A > B: . 202161:206721(4560) ack 1 win 119 +20:19:49.262958 IP B > A: . ack 158841 win 1212 +20:19:49.263795 IP B > A: . ack 160361 win 1212 +20:19:49.264628 IP B > A: . ack 161881 win 1212 +20:19:49.264637 IP A > B: . 206721:211281(4560) ack 1 win 119 +20:19:49.265465 IP B > A: . ack 163401 win 1212 +20:19:49.265886 IP B > A: . ack 164921 win 1212 +20:19:49.266722 IP B > A: . ack 166441 win 1212 +20:19:49.266732 IP A > B: . 211281:215841(4560) ack 1 win 119 +20:19:49.267559 IP B > A: . ack 167961 win 1212 +20:19:49.268394 IP B > A: . ack 169481 win 1212 +20:19:49.269232 IP B > A: . ack 171001 win 1212 +20:19:49.269241 IP A > B: . 215841:221161(5320) ack 1 win 119 + +Signed-off-by: Eric Dumazet +Cc: Yuchung Cheng +Cc: Van Jacobson +Cc: Neal Cardwell +Cc: Nandita Dukkipati +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1809,8 +1809,11 @@ static bool tcp_tso_should_defer(struct + goto send_now; + } + +- /* Ok, it looks like it is advisable to defer. */ +- tp->tso_deferred = 1 | (jiffies << 1); ++ /* Ok, it looks like it is advisable to defer. ++ * Do not rearm the timer if already set to not break TCP ACK clocking. ++ */ ++ if (!tp->tso_deferred) ++ tp->tso_deferred = 1 | (jiffies << 1); + + return true; + diff --git a/queue-3.8/tcp-undo-spurious-timeout-after-sack-reneging.patch b/queue-3.8/tcp-undo-spurious-timeout-after-sack-reneging.patch new file mode 100644 index 00000000000..fabd400507c --- /dev/null +++ b/queue-3.8/tcp-undo-spurious-timeout-after-sack-reneging.patch @@ -0,0 +1,40 @@ +From 706c55db6cce07e12fba69c008c1900af145a1e1 Mon Sep 17 00:00:00 2001 +From: Yuchung Cheng +Date: Sun, 24 Mar 2013 10:42:25 +0000 +Subject: tcp: undo spurious timeout after SACK reneging + + +From: Yuchung Cheng + +[ Upstream commit 7ebe183c6d444ef5587d803b64a1f4734b18c564 ] + +On SACK reneging the sender immediately retransmits and forces a +timeout but disables Eifel (undo). If the (buggy) receiver does not +drop any packet this can trigger a false slow-start retransmit storm +driven by the ACKs of the original packets. This can be detected with +undo and TCP timestamps. + +Signed-off-by: Yuchung Cheng +Acked-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_input.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2064,11 +2064,8 @@ void tcp_enter_loss(struct sock *sk, int + if (tcp_is_reno(tp)) + tcp_reset_reno_sack(tp); + +- if (!how) { +- /* Push undo marker, if it was plain RTO and nothing +- * was retransmitted. */ +- tp->undo_marker = tp->snd_una; +- } else { ++ tp->undo_marker = tp->snd_una; ++ if (how) { + tp->sacked_out = 0; + tp->fackets_out = 0; + } diff --git a/queue-3.8/thermal-shorten-too-long-mcast-group-name.patch b/queue-3.8/thermal-shorten-too-long-mcast-group-name.patch new file mode 100644 index 00000000000..7be83d2432b --- /dev/null +++ b/queue-3.8/thermal-shorten-too-long-mcast-group-name.patch @@ -0,0 +1,44 @@ +From 91ae28f8557a672b36e50dc20d49d9993b3c90f7 Mon Sep 17 00:00:00 2001 +From: Masatake YAMATO +Date: Mon, 1 Apr 2013 14:50:40 -0400 +Subject: thermal: shorten too long mcast group name + + +From: Masatake YAMATO + +[ Upstream commits 73214f5d9f33b79918b1f7babddd5c8af28dd23d + and f1e79e208076ffe7bad97158275f1c572c04f5c7, the latter + adds an assertion to genetlink to prevent this from happening + again in the future. ] + +The original name is too long. + +Signed-off-by: Masatake YAMATO +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/thermal.h | 2 +- + net/netlink/genetlink.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/include/linux/thermal.h ++++ b/include/linux/thermal.h +@@ -44,7 +44,7 @@ + /* Adding event notification support elements */ + #define THERMAL_GENL_FAMILY_NAME "thermal_event" + #define THERMAL_GENL_VERSION 0x01 +-#define THERMAL_GENL_MCAST_GROUP_NAME "thermal_mc_group" ++#define THERMAL_GENL_MCAST_GROUP_NAME "thermal_mc_grp" + + /* Default Thermal Governor */ + #if defined(CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE) +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -142,6 +142,7 @@ int genl_register_mc_group(struct genl_f + int err = 0; + + BUG_ON(grp->name[0] == '\0'); ++ BUG_ON(memchr(grp->name, '\0', GENL_NAMSIZ) == NULL); + + genl_lock(); + diff --git a/queue-3.8/unix-fix-a-race-condition-in-unix_release.patch b/queue-3.8/unix-fix-a-race-condition-in-unix_release.patch new file mode 100644 index 00000000000..b5cb1f083a4 --- /dev/null +++ b/queue-3.8/unix-fix-a-race-condition-in-unix_release.patch @@ -0,0 +1,66 @@ +From 4621adeeda0eafe3b4be8f0c8bf6605359ab5d9b Mon Sep 17 00:00:00 2001 +From: Paul Moore +Date: Mon, 25 Mar 2013 03:18:33 +0000 +Subject: unix: fix a race condition in unix_release() + + +From: Paul Moore + +[ Upstream commit ded34e0fe8fe8c2d595bfa30626654e4b87621e0 ] + +As reported by Jan, and others over the past few years, there is a +race condition caused by unix_release setting the sock->sk pointer +to NULL before properly marking the socket as dead/orphaned. This +can cause a problem with the LSM hook security_unix_may_send() if +there is another socket attempting to write to this partially +released socket in between when sock->sk is set to NULL and it is +marked as dead/orphaned. This patch fixes this by only setting +sock->sk to NULL after the socket has been marked as dead; I also +take the opportunity to make unix_release_sock() a void function +as it only ever returned 0/success. + +Dave, I think this one should go on the -stable pile. + +Special thanks to Jan for coming up with a reproducer for this +problem. + +Reported-by: Jan Stancek +Signed-off-by: Paul Moore +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/unix/af_unix.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -384,7 +384,7 @@ static void unix_sock_destructor(struct + #endif + } + +-static int unix_release_sock(struct sock *sk, int embrion) ++static void unix_release_sock(struct sock *sk, int embrion) + { + struct unix_sock *u = unix_sk(sk); + struct path path; +@@ -453,8 +453,6 @@ static int unix_release_sock(struct sock + + if (unix_tot_inflight) + unix_gc(); /* Garbage collect fds */ +- +- return 0; + } + + static void init_peercred(struct sock *sk) +@@ -701,9 +699,10 @@ static int unix_release(struct socket *s + if (!sk) + return 0; + ++ unix_release_sock(sk, 0); + sock->sk = NULL; + +- return unix_release_sock(sk, 0); ++ return 0; + } + + static int unix_autobind(struct socket *sock)