OSDN Git Service
Don Skidmore [Sat, 17 Mar 2012 05:51:52 +0000 (05:51 +0000)]
ixgbe: fix race condition with shutdown
It was possible for shutdown to pull the rug out from other driver entry
points. Now we just grab the rtnl lock before taking everything apart.
Thanks to Hariharan for noticing this tight race condition.
Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com>
Cc: Hariharan Nagarajan <hanagara@cisco.com>
Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Gerard Lledo [Sat, 28 Apr 2012 08:52:37 +0000 (08:52 +0000)]
sungem: Fix WakeOnLan
WakeOnLan was broken in this driver because gp->asleep_wol is a 1-bit
bitfield and it was being assigned WAKE_MAGIC, which is (1 << 5).
gp->asleep_wol remains 0 and the machine never wakes up. Fixed by casting
gp->wake_on_lan to bool. Tested on an iBook G4.
Signed-off-by: Gerard Lledo <gerard.lledo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Wed, 2 May 2012 02:28:41 +0000 (02:28 +0000)]
tcp: change tcp_adv_win_scale and tcp_rmem[2]
tcp_adv_win_scale default value is 2, meaning we expect a good citizen
skb to have skb->len / skb->truesize ratio of 75% (3/4)
In 2.6 kernels we (mis)accounted for typical MSS=1460 frame :
1536 + 64 + 256 = 1856 'estimated truesize', and 1856 * 3/4 = 1392.
So these skbs were considered as not bloated.
With recent truesize fixes, a typical MSS=1460 frame truesize is now the
more precise :
2048 + 256 = 2304. But 2304 * 3/4 = 1728.
So these skb are not good citizen anymore, because 1460 < 1728
(GRO can escape this problem because it build skbs with a too low
truesize.)
This also means tcp advertises a too optimistic window for a given
allocated rcvspace : When receiving frames, sk_rmem_alloc can hit
sk_rcvbuf limit and we call tcp_prune_queue()/tcp_collapse() too often,
especially when application is slow to drain its receive queue or in
case of losses (netperf is fast, scp is slow). This is a major latency
source.
We should adjust the len/truesize ratio to 50% instead of 75%
This patch :
1) changes tcp_adv_win_scale default to 1 instead of 2
2) increase tcp_rmem[2] limit from 4MB to 6MB to take into account
better truesize tracking and to allow autotuning tcp receive window to
reach same value than before. Note that same amount of kernel memory is
consumed compared to 2.6 kernels.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Sasha Levin [Wed, 2 May 2012 03:58:43 +0000 (03:58 +0000)]
net: l2tp: unlock socket lock before returning from l2tp_ip_sendmsg
l2tp_ip_sendmsg could return without releasing socket lock, making it all the
way to userspace, and generating the following warning:
[ 130.891594] ================================================
[ 130.894569] [ BUG: lock held when returning to user space! ]
[ 130.897257] 3.4.0-rc5-next-
20120501-sasha #104 Tainted: G W
[ 130.900336] ------------------------------------------------
[ 130.902996] trinity/8384 is leaving the kernel with locks still held!
[ 130.906106] 1 lock held by trinity/8384:
[ 130.907924] #0: (sk_lock-AF_INET){+.+.+.}, at: [<
ffffffff82b9503f>] l2tp_ip_sendmsg+0x2f/0x550
Introduced by commit
2f16270 ("l2tp: Fix locking in l2tp_ip.c").
Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Neil Horman [Tue, 1 May 2012 08:18:02 +0000 (08:18 +0000)]
drop_monitor: prevent init path from scheduling on the wrong cpu
I just noticed after some recent updates, that the init path for the drop
monitor protocol has a minor error. drop monitor maintains a per cpu structure,
that gets initalized from a single cpu. Normally this is fine, as the protocol
isn't in use yet, but I recently made a change that causes a failed skb
allocation to reschedule itself . Given the current code, the implication is
that this workqueue reschedule will take place on the wrong cpu. If drop
monitor is used early during the boot process, its possible that two cpus will
access a single per-cpu structure in parallel, possibly leading to data
corruption.
This patch fixes the situation, by storing the cpu number that a given instance
of this per-cpu data should be accessed from. In the case of a need for a
reschedule, the cpu stored in the struct is assigned the rescheule, rather than
the currently executing cpu
Tested successfully by myself.
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: David Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
tom.leiming@gmail.com [Sun, 29 Apr 2012 22:51:03 +0000 (22:51 +0000)]
usbnet: fix failure handling in usbnet_probe
If register_netdev returns failure, the dev->interrupt and
its transfer buffer should be released, so just fix it.
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
tom.leiming@gmail.com [Sun, 29 Apr 2012 22:51:02 +0000 (22:51 +0000)]
usbnet: fix leak of transfer buffer of dev->interrupt
The transfer buffer of dev->interrupt is allocated in .probe path,
but not freed in .disconnet path, so mark the interrupt URB as
URB_FREE_BUFFER to free the buffer when the URB is destroyed.
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Joakim Tjernlund [Sun, 29 Apr 2012 22:36:55 +0000 (22:36 +0000)]
ucc_geth: Add 16 bytes to max TX frame for VLANs
Creating a VLAN interface on top of ucc_geth adds 4 bytes
to the frame and the HW controller is not prepared to
TX a frame bigger than 1518 bytes which is 4 bytes too
small for a full VLAN frame. Add 16 bytes which will handle
the a simple VLAN and leaves 12 bytes for future expansion.
Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: David S. Miller <davem@davemloft.net>
Joakim Tjernlund [Sun, 29 Apr 2012 22:36:54 +0000 (22:36 +0000)]
net: ucc_geth, increase no. of HW RX descriptors
In a busy network we see ucc_geth is dropping RX pkgs every now
and then. Increase the RX queues HW descriptors from
16 to 32 to deal with this.
Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: David S. Miller <davem@davemloft.net>
John W. Linville [Tue, 1 May 2012 18:14:05 +0000 (14:14 -0400)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless into for-davem
Eric Dumazet [Sun, 29 Apr 2012 09:08:22 +0000 (09:08 +0000)]
netem: fix possible skb leak
skb_checksum_help(skb) can return an error, we must free skb in this
case. qdisc_drop(skb, sch) can also be feeded with a NULL skb (if
skb_unshare() failed), so lets use this generic helper.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
stephen hemminger [Mon, 30 Apr 2012 06:47:37 +0000 (06:47 +0000)]
sky2: fix receive length error in mixed non-VLAN/VLAN traffic
Bug: The VLAN bit of the MAC RX Status Word is unreliable in several older
supported chips. Sometimes the VLAN bit is not set for valid VLAN packets
and also sometimes the VLAN bit is set for non-VLAN packets that came after
a VLAN packet. This results in a receive length error when VLAN hardware
tagging is enabled.
Fix: Variation on original fix proposed by Mirko.
The VLAN information is decoded in the status loop, and can be
applied to the received SKB there. This eliminates the need for the
separate tag field in the interface data structure. The tag has to
be copied and cleared if packet is copied. This version checked out
with vlan and normal traffic.
Note: vlan_tx_tag_present should be renamed vlan_tag_present, but that
is outside scope of this.
Reported-by: Mirko Lindner <mlindner@marvell.com>
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
stephen hemminger [Mon, 30 Apr 2012 05:49:45 +0000 (05:49 +0000)]
sky2: propogate rx hash when packet is copied
When a small packet is received, the driver copies it to a new skb to allow
reusing the full size Rx buffer. The copy was propogating the checksum offload
but not the receive hash information. The bug is impact was mostly harmless
and therefore not observed until reviewing this area of code.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Mon, 30 Apr 2012 21:29:16 +0000 (21:29 +0000)]
net: fix two typos in skbuff.h
fix kernel doc typos in function names
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Roland Dreier [Mon, 30 Apr 2012 07:15:47 +0000 (07:15 +0000)]
cxgb3: Don't call cxgb_vlan_mode until q locks are initialized
The driver calls cxgb_vlan_mode() from init_one(). This calls into
synchronize_rx(), which locks all the q locks, but the q locks are not
initialized until cxgb_up() -> setup_sge_qsets(). So move the call to
cxgb_vlan_mode() into cxgb_up(), after the call to setup_sge_qsets().
We also move the body of these functions up higher to avoid having to
a forward declaration.
This was found because of the lockdep warning:
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
Pid: 323, comm: work_for_cpu Not tainted 3.4.0-rc5 #28
Call Trace:
[<
ffffffff8106e767>] register_lock_class+0x108/0x2d0
[<
ffffffff8106ff42>] __lock_acquire+0xd3/0xd06
[<
ffffffff81070fd0>] lock_acquire+0xbf/0xfe
[<
ffffffff813862a6>] _raw_spin_lock_irq+0x36/0x45
[<
ffffffffa01e71aa>] cxgb_vlan_mode+0x96/0xcb [cxgb3]
[<
ffffffffa01f90eb>] init_one+0x8c4/0x980 [cxgb3]
[<
ffffffff811fcbf0>] local_pci_probe+0x3f/0x70
[<
ffffffff81042206>] do_work_for_cpu+0x10/0x22
[<
ffffffff810482de>] kthread+0xa1/0xa9
[<
ffffffff8138e234>] kernel_thread_helper+0x4/0x10
Contrary to what lockdep says, the code is not fine: we are locking an
uninitialized spinlock.
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 1 May 2012 02:04:20 +0000 (22:04 -0400)]
Merge branch 'master' of git://git./linux/kernel/git/jkirsher/net
Yi Zou [Fri, 20 Apr 2012 05:48:08 +0000 (05:48 +0000)]
ixgbe: fix calling skb_put on nonlinear skb assertion bug
With the support to bounce buffer added, the skb is coming as nonlinear in the
case of non-DDPed data frames for FCoE, which is mostly ok as the FCoE stack
would take care of that. However, for target mode, we have to set the FC CRC
and FC EOF field to allow the protocol stack to not drop the frame for the last
data frame of that sequence. So fix this by linearizing the skb first before
doing skb_put().
Signed-off-by: Yi Zou <yi.zou@intel.com>
Tested-by: Marcus Dennis <marcusx.e.dennis@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Alexander Duyck [Sat, 17 Mar 2012 02:39:16 +0000 (02:39 +0000)]
ixgbe: Fix a memory leak in IEEE DCB
The driver was freeing memory in shutdown instead of remove. As a result
we were leaking memory if IEEE DCB was enabled and we loaded/unloaded the
driver. This change moves the freeing of the memory into the remove
routine where it belongs.
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Acked-by: John Fastabend <john.r.fastabend@intel.com>
Tested-by: Ross Brattain <ross.b.brattain@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Samuel Liao [Fri, 27 Apr 2012 17:09:27 +0000 (17:09 +0000)]
igbvf: fix the bug when initializing the igbvf
Maybe it's a typo, but it cause that igbvf can't be initialized successfully.
Set perm_addr value using valid dev_addr, although which is equal to hw.mac.addr.
Signed-off-by: Samuel Liao <samuelliao@tencent.com>
Signed-off-by: Shan Wei <davidshan@tencent.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Steve Glendinning [Mon, 30 Apr 2012 07:56:56 +0000 (07:56 +0000)]
smsc75xx: enable mac to detect speed/duplex from phy
This patch sets the automatic speed and duplex detection bits
in MAC_CR to enable the mac to determine its speed automatically
from the phy.
Note this must be done BEFORE the receiver or transmitter is
enabled.
Signed-off-by: Stephane Fillod <fillods@users.sf.net>
Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Steve Glendinning [Mon, 30 Apr 2012 07:56:55 +0000 (07:56 +0000)]
smsc75xx: declare smsc75xx's MII as GMII capable
also explicitly set the phy to advertise 1000 speeds
Signed-off-by: Stephane Fillod <fillods@users.sf.net>
Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Steve Glendinning [Mon, 30 Apr 2012 07:56:54 +0000 (07:56 +0000)]
smsc75xx: fix phy interrupt acknowledge
smsc75xx phy interrupt acknowledge needs an mdio_write to clear
PHY_INT_SRC instead of just a read like in smsc95xx.
Signed-off-by: Stephane Fillod <fillods@users.sf.net>
Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Steve Glendinning [Mon, 30 Apr 2012 07:56:53 +0000 (07:56 +0000)]
smsc75xx: fix phy init reset loop
fix bug in phy_init loop that was ignoring BMCR reset bit, akin to smsc95xx's
d946092000698fd204d82a9d239103c656fb63bf
Signed-off-by: Stephane Fillod <fillods@users.sf.net>
Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Steve Glendinning [Mon, 30 Apr 2012 07:56:52 +0000 (07:56 +0000)]
smsc75xx: add more information to register io failure warnings
Signed-off-by: Stephane Fillod <fillods@users.sf.net>
Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Steve Glendinning [Mon, 30 Apr 2012 07:56:51 +0000 (07:56 +0000)]
smsc75xx: fix mdio reads and writes
smsc75xx needs MII_ACCESS_BUSY to be set to correctly trigger mdio I/O. Note smsc75xx is different from smsc95xx in this regard.
Signed-off-by: Stephane Fillod <fillods@users.sf.net>
Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Steve Glendinning [Mon, 30 Apr 2012 07:56:50 +0000 (07:56 +0000)]
smsc75xx: mark link down on startup and let PHY interrupt deal with carrier changes
This patch fixes the same issue as reported on smsc95xx, where the
usb device is connected with no ethernet cable plugged-in.
Without this patch sysfs reports the cable as present
flag@flag-desktop:~$ cat /sys/class/net/eth0/carrier
1
while it's not:
flag@flag-desktop:~$ sudo mii-tool eth0
eth0: no link
Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Felix Fietkau [Sun, 29 Apr 2012 13:44:16 +0000 (15:44 +0200)]
mac80211: fix AP mode EAP tx for VLAN stations
EAP frames for stations in an AP VLAN are sent on the main AP interface
to avoid race conditions wrt. moving stations.
For that to work properly, sta_info_get_bss must be used instead of
sta_info_get when sending EAP packets.
Previously this was only done for cooked monitor injected packets, so
this patch adds a check for tx->skb->protocol to the same place.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Yuchung Cheng [Mon, 30 Apr 2012 06:00:18 +0000 (06:00 +0000)]
tcp: fix infinite cwnd in tcp_complete_cwr()
When the cwnd reduction is done, ssthresh may be infinite
if TCP enters CWR via ECN or F-RTO. If cwnd is not undone, i.e.,
undo_marker is set, tcp_complete_cwr() falsely set cwnd to the
infinite ssthresh value. The correct operation is to keep cwnd
intact because it has been updated in ECN or F-RTO.
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jan Seiffert [Sun, 29 Apr 2012 19:02:19 +0000 (19:02 +0000)]
bpf jit: Let the powerpc jit handle negative offsets
Now the helper function from filter.c for negative offsets is exported,
it can be used it in the jit to handle negative offsets.
First modify the asm load helper functions to handle:
- know positive offsets
- know negative offsets
- any offset
then the compiler can be modified to explicitly use these helper
when appropriate.
This fixes the case of a negative X register and allows to lift
the restriction that bpf programs with negative offsets can't
be jited.
Tested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Jan Seiffert <kaffeemonster@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Sat, 28 Apr 2012 23:21:56 +0000 (23:21 +0000)]
net: fix sk_sockets_allocated_read_positive
Denys Fedoryshchenko reported frequent crashes on a proxy server and kindly
provided a lockdep report that explains it all :
[ 762.903868]
[ 762.903880] =================================
[ 762.903890] [ INFO: inconsistent lock state ]
[ 762.903903] 3.3.4-build-0061 #8 Not tainted
[ 762.904133] ---------------------------------
[ 762.904344] inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
[ 762.904542] squid/1603 [HC0[0]:SC0[0]:HE1:SE1] takes:
[ 762.904542] (key#3){+.?...}, at: [<
c0232cc4>]
__percpu_counter_sum+0xd/0x58
[ 762.904542] {IN-SOFTIRQ-W} state was registered at:
[ 762.904542] [<
c0158b84>] __lock_acquire+0x284/0xc26
[ 762.904542] [<
c01598e8>] lock_acquire+0x71/0x85
[ 762.904542] [<
c0349765>] _raw_spin_lock+0x33/0x40
[ 762.904542] [<
c0232c93>] __percpu_counter_add+0x58/0x7c
[ 762.904542] [<
c02cfde1>] sk_clone_lock+0x1e5/0x200
[ 762.904542] [<
c0303ee4>] inet_csk_clone_lock+0xe/0x78
[ 762.904542] [<
c0315778>] tcp_create_openreq_child+0x1b/0x404
[ 762.904542] [<
c031339c>] tcp_v4_syn_recv_sock+0x32/0x1c1
[ 762.904542] [<
c031615a>] tcp_check_req+0x1fd/0x2d7
[ 762.904542] [<
c0313f77>] tcp_v4_do_rcv+0xab/0x194
[ 762.904542] [<
c03153bb>] tcp_v4_rcv+0x3b3/0x5cc
[ 762.904542] [<
c02fc0c4>] ip_local_deliver_finish+0x13a/0x1e9
[ 762.904542] [<
c02fc539>] NF_HOOK.clone.11+0x46/0x4d
[ 762.904542] [<
c02fc652>] ip_local_deliver+0x41/0x45
[ 762.904542] [<
c02fc4d1>] ip_rcv_finish+0x31a/0x33c
[ 762.904542] [<
c02fc539>] NF_HOOK.clone.11+0x46/0x4d
[ 762.904542] [<
c02fc857>] ip_rcv+0x201/0x23e
[ 762.904542] [<
c02daa3a>] __netif_receive_skb+0x319/0x368
[ 762.904542] [<
c02dac07>] netif_receive_skb+0x4e/0x7d
[ 762.904542] [<
c02dacf6>] napi_skb_finish+0x1e/0x34
[ 762.904542] [<
c02db122>] napi_gro_receive+0x20/0x24
[ 762.904542] [<
f85d1743>] e1000_receive_skb+0x3f/0x45 [e1000e]
[ 762.904542] [<
f85d3464>] e1000_clean_rx_irq+0x1f9/0x284 [e1000e]
[ 762.904542] [<
f85d3926>] e1000_clean+0x62/0x1f4 [e1000e]
[ 762.904542] [<
c02db228>] net_rx_action+0x90/0x160
[ 762.904542] [<
c012a445>] __do_softirq+0x7b/0x118
[ 762.904542] irq event stamp:
156915469
[ 762.904542] hardirqs last enabled at (
156915469): [<
c019b4f4>]
__slab_alloc.clone.58.clone.63+0xc4/0x2de
[ 762.904542] hardirqs last disabled at (
156915468): [<
c019b452>]
__slab_alloc.clone.58.clone.63+0x22/0x2de
[ 762.904542] softirqs last enabled at (
156915466): [<
c02ce677>]
lock_sock_nested+0x64/0x6c
[ 762.904542] softirqs last disabled at (
156915464): [<
c0349914>]
_raw_spin_lock_bh+0xe/0x45
[ 762.904542]
[ 762.904542] other info that might help us debug this:
[ 762.904542] Possible unsafe locking scenario:
[ 762.904542]
[ 762.904542] CPU0
[ 762.904542] ----
[ 762.904542] lock(key#3);
[ 762.904542] <Interrupt>
[ 762.904542] lock(key#3);
[ 762.904542]
[ 762.904542] *** DEADLOCK ***
[ 762.904542]
[ 762.904542] 1 lock held by squid/1603:
[ 762.904542] #0: (sk_lock-AF_INET){+.+.+.}, at: [<
c03055c0>]
lock_sock+0xa/0xc
[ 762.904542]
[ 762.904542] stack backtrace:
[ 762.904542] Pid: 1603, comm: squid Not tainted 3.3.4-build-0061 #8
[ 762.904542] Call Trace:
[ 762.904542] [<
c0347b73>] ? printk+0x18/0x1d
[ 762.904542] [<
c015873a>] valid_state+0x1f6/0x201
[ 762.904542] [<
c0158816>] mark_lock+0xd1/0x1bb
[ 762.904542] [<
c015876b>] ? mark_lock+0x26/0x1bb
[ 762.904542] [<
c015805d>] ? check_usage_forwards+0x77/0x77
[ 762.904542] [<
c0158bf8>] __lock_acquire+0x2f8/0xc26
[ 762.904542] [<
c0159b8e>] ? mark_held_locks+0x5d/0x7b
[ 762.904542] [<
c0159cf6>] ? trace_hardirqs_on+0xb/0xd
[ 762.904542] [<
c0158dd4>] ? __lock_acquire+0x4d4/0xc26
[ 762.904542] [<
c01598e8>] lock_acquire+0x71/0x85
[ 762.904542] [<
c0232cc4>] ? __percpu_counter_sum+0xd/0x58
[ 762.904542] [<
c0349765>] _raw_spin_lock+0x33/0x40
[ 762.904542] [<
c0232cc4>] ? __percpu_counter_sum+0xd/0x58
[ 762.904542] [<
c0232cc4>] __percpu_counter_sum+0xd/0x58
[ 762.904542] [<
c02cebc4>] __sk_mem_schedule+0xdd/0x1c7
[ 762.904542] [<
c02d178d>] ? __alloc_skb+0x76/0x100
[ 762.904542] [<
c0305e8e>] sk_wmem_schedule+0x21/0x2d
[ 762.904542] [<
c0306370>] sk_stream_alloc_skb+0x42/0xaa
[ 762.904542] [<
c0306567>] tcp_sendmsg+0x18f/0x68b
[ 762.904542] [<
c031f3dc>] ? ip_fast_csum+0x30/0x30
[ 762.904542] [<
c0320193>] inet_sendmsg+0x53/0x5a
[ 762.904542] [<
c02cb633>] sock_aio_write+0xd2/0xda
[ 762.904542] [<
c015876b>] ? mark_lock+0x26/0x1bb
[ 762.904542] [<
c01a1017>] do_sync_write+0x9f/0xd9
[ 762.904542] [<
c01a2111>] ? file_free_rcu+0x2f/0x2f
[ 762.904542] [<
c01a17a1>] vfs_write+0x8f/0xab
[ 762.904542] [<
c01a284d>] ? fget_light+0x75/0x7c
[ 762.904542] [<
c01a1900>] sys_write+0x3d/0x5e
[ 762.904542] [<
c0349ec9>] syscall_call+0x7/0xb
[ 762.904542] [<
c0340000>] ? rp_sidt+0x41/0x83
Bug is that sk_sockets_allocated_read_positive() calls
percpu_counter_sum_positive() without BH being disabled.
This bug was added in commit
180d8cd942ce33
(foundations of per-cgroup memory pressure controlling.), since previous
code was using percpu_counter_read_positive() which is IRQ safe.
In __sk_mem_schedule() we dont need the precise count of allocated
sockets and can revert to previous behavior.
Reported-by: Denys Fedoryshchenko <denys@visp.net.lb>
Sined-off-by: Eric Dumazet <edumazet@google.com>
Cc: Glauber Costa <glommer@parallels.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Mon, 30 Apr 2012 17:23:22 +0000 (13:23 -0400)]
Merge branch 'master' of git://1984.lsi.us.es/net
Pablo Neira Ayuso [Fri, 27 Apr 2012 00:00:50 +0000 (02:00 +0200)]
netfilter: xt_CT: fix wrong checking in the timeout assignment path
The current checking always succeeded. We have to check the first
character of the string to check that it's empty, thus, skipping
the timeout path.
This fixes the use of the CT target without the timeout option.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Hans Schillstrom [Thu, 26 Apr 2012 05:47:44 +0000 (07:47 +0200)]
ipvs: kernel oops - do_ip_vs_get_ctl
Change order of init so netns init is ready
when register ioctl and netlink.
Ver2
Whitespace fixes and __init added.
Reported-by: "Ryan O'Hara" <rohara@redhat.com>
Signed-off-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Hans Schillstrom [Thu, 26 Apr 2012 07:45:35 +0000 (09:45 +0200)]
ipvs: take care of return value from protocol init_netns
ip_vs_create_timeout_table() can return NULL
All functions protocol init_netns is affected of this patch.
Signed-off-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Hans Schillstrom [Thu, 26 Apr 2012 07:45:34 +0000 (09:45 +0200)]
ipvs: null check of net->ipvs in lblc(r) shedulers
Avoid crash when registering shedulers after
the IPVS core initialization for netns fails. Do this by
checking for present core (net->ipvs).
Signed-off-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Neil Horman [Fri, 27 Apr 2012 10:11:49 +0000 (10:11 +0000)]
drop_monitor: Make updating data->skb smp safe
Eric Dumazet pointed out to me that the drop_monitor protocol has some holes in
its smp protections. Specifically, its possible to replace data->skb while its
being written. This patch corrects that by making data->skb an rcu protected
variable. That will prevent it from being overwritten while a tracepoint is
modifying it.
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: David Miller <davem@davemloft.net>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Neil Horman [Fri, 27 Apr 2012 10:11:48 +0000 (10:11 +0000)]
drop_monitor: fix sleeping in invalid context warning
Eric Dumazet pointed out this warning in the drop_monitor protocol to me:
[ 38.352571] BUG: sleeping function called from invalid context at kernel/mutex.c:85
[ 38.352576] in_atomic(): 1, irqs_disabled(): 0, pid: 4415, name: dropwatch
[ 38.352580] Pid: 4415, comm: dropwatch Not tainted 3.4.0-rc2+ #71
[ 38.352582] Call Trace:
[ 38.352592] [<
ffffffff8153aaf0>] ? trace_napi_poll_hit+0xd0/0xd0
[ 38.352599] [<
ffffffff81063f2a>] __might_sleep+0xca/0xf0
[ 38.352606] [<
ffffffff81655b16>] mutex_lock+0x26/0x50
[ 38.352610] [<
ffffffff8153aaf0>] ? trace_napi_poll_hit+0xd0/0xd0
[ 38.352616] [<
ffffffff810b72d9>] tracepoint_probe_register+0x29/0x90
[ 38.352621] [<
ffffffff8153a585>] set_all_monitor_traces+0x105/0x170
[ 38.352625] [<
ffffffff8153a8ca>] net_dm_cmd_trace+0x2a/0x40
[ 38.352630] [<
ffffffff8154a81a>] genl_rcv_msg+0x21a/0x2b0
[ 38.352636] [<
ffffffff810f8029>] ? zone_statistics+0x99/0xc0
[ 38.352640] [<
ffffffff8154a600>] ? genl_rcv+0x30/0x30
[ 38.352645] [<
ffffffff8154a059>] netlink_rcv_skb+0xa9/0xd0
[ 38.352649] [<
ffffffff8154a5f0>] genl_rcv+0x20/0x30
[ 38.352653] [<
ffffffff81549a7e>] netlink_unicast+0x1ae/0x1f0
[ 38.352658] [<
ffffffff81549d76>] netlink_sendmsg+0x2b6/0x310
[ 38.352663] [<
ffffffff8150824f>] sock_sendmsg+0x10f/0x130
[ 38.352668] [<
ffffffff8150abe0>] ? move_addr_to_kernel+0x60/0xb0
[ 38.352673] [<
ffffffff81515f04>] ? verify_iovec+0x64/0xe0
[ 38.352677] [<
ffffffff81509c46>] __sys_sendmsg+0x386/0x390
[ 38.352682] [<
ffffffff810ffaf9>] ? handle_mm_fault+0x139/0x210
[ 38.352687] [<
ffffffff8165b5bc>] ? do_page_fault+0x1ec/0x4f0
[ 38.352693] [<
ffffffff8106ba4d>] ? set_next_entity+0x9d/0xb0
[ 38.352699] [<
ffffffff81310b49>] ? tty_ldisc_deref+0x9/0x10
[ 38.352703] [<
ffffffff8106d363>] ? pick_next_task_fair+0x63/0x140
[ 38.352708] [<
ffffffff8150b8d4>] sys_sendmsg+0x44/0x80
[ 38.352713] [<
ffffffff8165f8e2>] system_call_fastpath+0x16/0x1b
It stems from holding a spinlock (trace_state_lock) while attempting to register
or unregister tracepoint hooks, making in_atomic() true in this context, leading
to the warning when the tracepoint calls might_sleep() while its taking a mutex.
Since we only use the trace_state_lock to prevent trace protocol state races, as
well as hardware stat list updates on an rcu write side, we can just convert the
spinlock to a mutex to avoid this problem.
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: David Miller <davem@davemloft.net>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Grazvydas Ignotas [Thu, 26 Apr 2012 20:07:44 +0000 (23:07 +0300)]
wl1251: fix crash on remove due to leftover work item
This driver currently leaves elp_work behind when stopping, which
occasionally results in data corruption because work function ends
up accessing freed memory, typical symptoms of this are various
worker_thread crashes. Fix it by cancelling elp_work.
Cc: stable@vger.kernel.org # v2.6.37+
Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Grazvydas Ignotas [Thu, 26 Apr 2012 20:07:43 +0000 (23:07 +0300)]
wl1251: fix crash on remove due to premature kfree
Currently SDIO glue frees it's own structure before calling
wl1251_free_hw(), which in turn calls ieee80211_unregister_hw().
The later call may result in a need to communicate with the chip
to stop it (as it happens now if the interface is still up before
rmmod), which means calls are made back to the glue, resulting in
freed memory access.
Fix this by freeing glue data last.
Cc: stable@vger.kernel.org # v2.6.37+
Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Seth Forshee [Wed, 25 Apr 2012 22:28:00 +0000 (17:28 -0500)]
b43: only reload config after successful initialization
Commit
2a19032 (b43: reload phy and bss settings after core restarts)
introduced an unconditional call to b43_op_config() at the end of
b43_op_start(). When firmware fails to load this can wedge the system.
There's no need to reload the configuration after a failed
initialization anyway, so only make the call if initialization was
successful.
BugLink: http://bugs.launchpad.net/bugs/950295
Cc: Felix Fietkau <nbd@openwrt.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Wey-Yi Guy [Wed, 25 Apr 2012 15:10:08 +0000 (08:10 -0700)]
iwlwifi: use 6000G2B for 6030 device series
"iwlwifi: use correct released ucode version" change
the ucode api ok from 6000G2 to 6000G2B, but it shall belong
to 6030 device series, not the 6005 device series. Fix it
Cc: stable@vger.kernel.org #3.3+
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Jonathan Bither [Tue, 24 Apr 2012 09:20:15 +0000 (05:20 -0400)]
ath5k: add missing iounmap to AHB probe removal
When our driver device is removed on the AHB bus, our IO memory is never unmapped.
Signed-off-by: Jonathan Bither <jonbither@gmail.com>
Reviewed-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Franky Lin [Mon, 23 Apr 2012 21:24:53 +0000 (14:24 -0700)]
brcm80211: fmac: fix missing completion events issue
dpc takes care of all data packets transmissions for sdio function
2. It is possible that it misses some completion events when the
traffic is heavy or it's running on a slow cpu. A linked list is
introduced to make sure dpc is invoked whenever needed.
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Franky Lin [Mon, 23 Apr 2012 21:24:52 +0000 (14:24 -0700)]
brcm80211: fmac: fix SDIO function 0 register r/w issue
SDIO stack doesn't have a structure for function 0. The structure
pointer stored in card->sdio_func[0] is actually for function 1.
With current implementation the register read/write is applied to
function 1. This pathch fixes the issue.
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Florian Fainelli <florian@openwrt.org>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
John W. Linville [Fri, 27 Apr 2012 19:16:43 +0000 (15:16 -0400)]
Merge branch 'for-upstream' of git://git./linux/kernel/git/bluetooth/bluetooth
Neal Cardwell [Fri, 27 Apr 2012 15:29:37 +0000 (11:29 -0400)]
tcp: clean up use of jiffies in tcp_rcv_rtt_measure()
Clean up a reference to jiffies in tcp_rcv_rtt_measure() that should
instead reference tcp_time_stamp. Since the result of the subtraction
is passed into a function taking u32, this should not change any
behavior (and indeed the generated assembly does not change on
x86_64). However, it seems worth cleaning this up for consistency and
clarity (and perhaps to avoid bugs if this is copied and pasted
somewhere else).
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Vlad Yasevich [Thu, 26 Apr 2012 10:27:18 +0000 (10:27 +0000)]
MAINTAINERS: update sctp maintainer address
Update my email address.
Signed-off-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Paolo Pisati [Mon, 23 Apr 2012 04:05:20 +0000 (04:05 +0000)]
smsc95xx: mark link down on startup and let PHY interrupt deal with carrier changes
Without this patch sysfs reports the cable as present
flag@flag-desktop:~$ cat /sys/class/net/eth0/carrier
1
while it's not:
flag@flag-desktop:~$ sudo mii-tool eth0
eth0: no link
Tested on my Beagle XM.
v2: added mantainer to the list of recipient
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
Acked-by: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jeff Mahoney [Wed, 25 Apr 2012 14:32:09 +0000 (14:32 +0000)]
dl2k: Clean up rio_ioctl
The dl2k driver's rio_ioctl call has a few issues:
- No permissions checking
- Implements SIOCGMIIREG and SIOCGMIIREG using the SIOCDEVPRIVATE numbers
- Has a few ioctls that may have been used for debugging at one point
but have no place in the kernel proper.
This patch removes all but the MII ioctls, renumbers them to use the
standard ones, and adds the proper permission check for SIOCSMIIREG.
We can also get rid of the dl2k-specific struct mii_data in favor of
the generic struct mii_ioctl_data.
Since we have the phyid on hand, we can add the SIOCGMIIPHY ioctl too.
Most of the MII code for the driver could probably be converted to use
the generic MII library but I don't have a device to test the results.
Reported-by: Stephan Mueller <stephan.mueller@atsec.com>
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
alex.bluesman.smirnov@gmail.com [Wed, 25 Apr 2012 23:24:58 +0000 (23:24 +0000)]
6lowpan: add missing spin_lock_init()
Add missing spin_lock_init() for frames list lock.
Signed-off-by: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
alex.bluesman.smirnov@gmail.com [Wed, 25 Apr 2012 23:24:57 +0000 (23:24 +0000)]
6lowpan: clean up fragments list if module unloaded
Clean all the pending fragments and relative timers if 6lowpan link
is going to be deleted.
Signed-off-by: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
alex.bluesman.smirnov@gmail.com [Wed, 25 Apr 2012 23:24:56 +0000 (23:24 +0000)]
6lowpan: fix segmentation fault caused by mlme request
Add nescesary mlme callbacks to satisfy "iz list" request from user space.
Due to 6lowpan device doesn't have its own phy, mlme implemented as a pipe
to a real phy to which 6lowpan is attached.
Signed-off-by: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Thu, 26 Apr 2012 09:08:45 +0000 (05:08 -0400)]
Merge branch 'master' of git://git./linux/kernel/git/jkirsher/net
Thadeu Lima de Souza Cascardo [Wed, 25 Apr 2012 07:32:12 +0000 (07:32 +0000)]
ehea: fix promiscuous mode
commit
a4910b744486254cfa61995954c118fb2283c4fd has broken promiscuous
mode, which is never set. port->promisc just reflects the last setting
of PROMISCUOUS mode to avoid doing an extra hypercall when it's already
set.
However, since it may fail because of hypervisor permissions, we should
still respect the multicast settings and not simply exit after setting
promiscuous mode.
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Cc: Breno Leitao <leitao@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Thadeu Lima de Souza Cascardo [Wed, 25 Apr 2012 07:32:11 +0000 (07:32 +0000)]
ehea: fix allmulticast support
There was a bug in the mask of regtype parameter for registering a
multicast filter. It was ignoring the scope bit, which was wrongly being
used for all filters. The SCOPE_ALL value adds a filter that allows all
multicast packets and ignores the MAC parameter, just what allmulticast
needs. The normals filters, however, should not use SCOPE_ALL.
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Julian Anastasov [Tue, 24 Apr 2012 21:29:58 +0000 (00:29 +0300)]
ipvs: reset ipvs pointer in netns
Make sure net->ipvs is reset on netns cleanup or failed
initialization. It is needed for IPVS applications to know that
IPVS core is not loaded in netns.
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Julian Anastasov [Tue, 24 Apr 2012 21:29:59 +0000 (00:29 +0300)]
ipvs: add check in ftp for initialized core
Avoid crash when registering ip_vs_ftp after
the IPVS core initialization for netns fails. Do this by
checking for present core (net->ipvs).
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Shan Wei [Tue, 24 Apr 2012 18:15:41 +0000 (18:15 +0000)]
udp_diag: implement idiag_get_info for udp/udplite to get queue information
When we use netlink to monitor queue information for udp socket,
idiag_rqueue and idiag_wqueue of inet_diag_msg are returned with 0.
Keep consistent with netstat, just return back allocated rmem/wmem size.
Signed-off-by: Shan Wei <davidshan@tencent.com>
Acked-by: Pavel Emelyanov <xemul@parallels.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Wed, 25 Apr 2012 19:13:37 +0000 (15:13 -0400)]
Merge branch 'for-davem' of git://git./linux/kernel/git/linville/wireless
Matt Carlson [Tue, 24 Apr 2012 13:37:01 +0000 (13:37 +0000)]
tg3: Avoid panic from reserved statblk field access
When RSS is enabled, interrupt vector 0 does not receive any rx traffic.
The rx producer index fields for vector 0's status block should be
considered reserved in this case. This patch changes the code to
respect these reserved fields, which avoids a kernel panic when these
fields take on non-zero values.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Benjamin Poirier [Wed, 25 Apr 2012 04:49:20 +0000 (04:49 +0000)]
tlan: add cast needed for proper 64 bit operation
Changes this beauty into a statement that actually has an effect on amd64.
Tested-by: Per Jessen <per@opensuse.org>
Signed-off-by: Benjamin Poirier <bpoirier@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
John W. Linville [Wed, 25 Apr 2012 17:41:25 +0000 (13:41 -0400)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless into for-davem
Julian Anastasov [Fri, 13 Apr 2012 15:08:43 +0000 (18:08 +0300)]
ipvs: fix crash in ip_vs_control_net_cleanup on unload
commit
14e405461e664b777e2a5636e10b2ebf36a686ec (2.6.39)
("Add __ip_vs_control_{init,cleanup}_sysctl()")
introduced regression due to wrong __net_init for
__ip_vs_control_cleanup_sysctl. This leads to crash when
the ip_vs module is unloaded.
Fix it by changing __net_init to __net_exit for
the function that is already renamed to ip_vs_control_net_cleanup_sysctl.
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Hans Schillstrom <hans@schillstrom.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Sasha Levin [Sat, 14 Apr 2012 16:37:46 +0000 (12:37 -0400)]
ipvs: Verify that IP_VS protocol has been registered
The registration of a protocol might fail, there were no checks
and all registrations were assumed to be correct. This lead to
NULL ptr dereferences when apps tried registering.
For example:
[ 1293.226051] BUG: unable to handle kernel NULL pointer dereference at
0000000000000018
[ 1293.227038] IP: [<
ffffffff822aacb0>] tcp_register_app+0x60/0xb0
[ 1293.227038] PGD
391de067 PUD
6c20b067 PMD 0
[ 1293.227038] Oops: 0000 [#1] PREEMPT SMP
[ 1293.227038] CPU 1
[ 1293.227038] Pid: 19609, comm: trinity Tainted: G W 3.4.0-rc1-next-
20120405-sasha-dirty #57
[ 1293.227038] RIP: 0010:[<
ffffffff822aacb0>] [<
ffffffff822aacb0>] tcp_register_app+0x60/0xb0
[ 1293.227038] RSP: 0018:
ffff880038c1dd18 EFLAGS:
00010286
[ 1293.227038] RAX:
ffffffffffffffc0 RBX:
0000000000001500 RCX:
0000000000010000
[ 1293.227038] RDX:
0000000000000000 RSI:
ffff88003a2d5888 RDI:
0000000000000282
[ 1293.227038] RBP:
ffff880038c1dd48 R08:
0000000000000000 R09:
0000000000000000
[ 1293.227038] R10:
0000000000000000 R11:
0000000000000000 R12:
ffff88003a2d5668
[ 1293.227038] R13:
ffff88003a2d5988 R14:
ffff8800696a8ff8 R15:
0000000000000000
[ 1293.227038] FS:
00007f01930d9700(0000) GS:
ffff88007ce00000(0000) knlGS:
0000000000000000
[ 1293.227038] CS: 0010 DS: 0000 ES: 0000 CR0:
000000008005003b
[ 1293.227038] CR2:
0000000000000018 CR3:
0000000065dfc000 CR4:
00000000000406e0
[ 1293.227038] DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
[ 1293.227038] DR3:
0000000000000000 DR6:
00000000ffff0ff0 DR7:
0000000000000400
[ 1293.227038] Process trinity (pid: 19609, threadinfo
ffff880038c1c000, task
ffff88002dc73000)
[ 1293.227038] Stack:
[ 1293.227038]
ffff880038c1dd48 00000000fffffff4 ffff8800696aada0 ffff8800694f5580
[ 1293.227038]
ffffffff8369f1e0 0000000000001500 ffff880038c1dd98 ffffffff822a716b
[ 1293.227038]
0000000000000000 ffff8800696a8ff8 0000000000000015 ffff8800694f5580
[ 1293.227038] Call Trace:
[ 1293.227038] [<
ffffffff822a716b>] ip_vs_app_inc_new+0xdb/0x180
[ 1293.227038] [<
ffffffff822a7258>] register_ip_vs_app_inc+0x48/0x70
[ 1293.227038] [<
ffffffff822b2fea>] __ip_vs_ftp_init+0xba/0x140
[ 1293.227038] [<
ffffffff821c9060>] ops_init+0x80/0x90
[ 1293.227038] [<
ffffffff821c90cb>] setup_net+0x5b/0xe0
[ 1293.227038] [<
ffffffff821c9416>] copy_net_ns+0x76/0x100
[ 1293.227038] [<
ffffffff810dc92b>] create_new_namespaces+0xfb/0x190
[ 1293.227038] [<
ffffffff810dca21>] unshare_nsproxy_namespaces+0x61/0x80
[ 1293.227038] [<
ffffffff810afd1f>] sys_unshare+0xff/0x290
[ 1293.227038] [<
ffffffff8187622e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[ 1293.227038] [<
ffffffff82665539>] system_call_fastpath+0x16/0x1b
[ 1293.227038] Code: 89 c7 e8 34 91 3b 00 89 de 66 c1 ee 04 31 de 83 e6 0f 48 83 c6 22 48 c1 e6 04 4a 8b 14 26 49 8d 34 34 48 8d 42 c0 48 39 d6 74 13 <66> 39 58 58 74 22 48 8b 48 40 48 8d 41 c0 48 39 ce 75 ed 49 8d
[ 1293.227038] RIP [<
ffffffff822aacb0>] tcp_register_app+0x60/0xb0
[ 1293.227038] RSP <
ffff880038c1dd18>
[ 1293.227038] CR2:
0000000000000018
[ 1293.379284] ---[ end trace
364ab40c7011a009 ]---
[ 1293.381182] Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Jeff Kirsher [Fri, 20 Apr 2012 08:51:45 +0000 (08:51 +0000)]
e1000e: Fix default interrupt throttle rate not set in NIC HW
Based on the original patch from Ying Cai <ycai@google.com>
This change ensures that the itr/itr_setting adjustment logic is used,
even for the default/compiled-in value.
Context:
When we changed the default InterruptThrottleRate value from default
(3 = dynamic mode) to 8000 for example, only adapter->itr_setting
(which controls interrupt coalescing mode) was set to 8000, but
adapter->itr (which controls the value set in NIC register) was not
updated accordingly. So from ethtool, it seemed the interrupt
throttling is enabled at 8000 intr/s, but the NIC actually was
running in dynamic mode which has lower CPU efficiency especially
when throughput is not high.
CC: Ying Cai <ycai@google.com>
CC: David Decotigny <david.decotigny@google.com>
Signed-off-by: Jeff Kirsher <jeffrey.kirsher@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Prasanna S Panchamukhi [Thu, 19 Apr 2012 17:01:00 +0000 (17:01 +0000)]
e1000e: MSI interrupt test failed, using legacy interrupt
Following logs where seen on Systems with multiple NICs,
while using MSI interrupts as shown below:
Feb 16 15:09:32 (none) user.notice kernel: 0000:00:0d.0: lan0_0: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
Feb 16 15:09:32 (none) user.notice kernel: 0000:40:0d.0: wan0_1: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
Feb 16 15:09:32 (none) user.notice kernel: 0000:40:0d.0: lan0_1: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
Feb 16 15:09:32 (none) user.warn kernel: 0000:40:0e.0: wan4_0: MSI interrupt
test failed, using legacy interrupt.
Feb 16 15:09:32 (none) user.notice kernel: 0000:00:0e.0: wan1_0: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
Feb 16 15:09:33 (none) user.notice kernel: 0000:00:0e.0: lan1_0: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
Feb 16 15:09:33 (none) user.notice kernel: 0000:00:0f.0: wan2_0: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
Feb 16 15:09:33 (none) user.notice kernel: 0000:00:0f.0: lan2_0: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
Feb 16 15:09:33 (none) user.notice kernel: 0000:40:0a.0: wan3_0: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
Feb 16 15:09:33 (none) user.notice kernel: 0000:40:0a.0: lan3_0: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
Feb 16 15:09:34 (none) user.notice kernel: 0000:40:0e.0: lan4_0: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
Feb 16 15:09:34 (none) user.notice kernel: 0000:40:0f.0: wan5_0: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
Feb 16 15:09:34 (none) user.notice kernel: 0000:40:0f.0: lan5_0: NIC Link is Up
1000 Mbps Full Duplex, Flow Control: RX/TX
This patch fixes this problem by increasing the msleep from 50 to 100.
Signed-off-by: Prasanna S Panchamukhi <ppanchamukhi@riverbed.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Eliad Peller [Mon, 23 Apr 2012 11:45:15 +0000 (14:45 +0300)]
mac80211: call ieee80211_mgd_stop() on interface stop
ieee80211_mgd_teardown() is called on netdev removal, which
occurs after the vif was already removed from the low-level
driver, resulting in the following warning:
[ 4809.014734] ------------[ cut here ]------------
[ 4809.019861] WARNING: at net/mac80211/driver-ops.h:12 ieee80211_bss_info_change_notify+0x200/0x2c8 [mac80211]()
[ 4809.030388] wlan0: Failed check-sdata-in-driver check, flags: 0x4
[ 4809.036862] Modules linked in: wlcore_sdio(-) wl12xx wlcore mac80211 cfg80211 [last unloaded: cfg80211]
[ 4809.046849] [<
c001bd4c>] (unwind_backtrace+0x0/0x12c)
[ 4809.055937] [<
c047cf1c>] (dump_stack+0x20/0x24)
[ 4809.065385] [<
c003e334>] (warn_slowpath_common+0x5c/0x74)
[ 4809.075589] [<
c003e408>] (warn_slowpath_fmt+0x40/0x48)
[ 4809.088291] [<
bf033630>] (ieee80211_bss_info_change_notify+0x200/0x2c8 [mac80211])
[ 4809.102844] [<
bf067f84>] (ieee80211_destroy_auth_data+0x80/0xa4 [mac80211])
[ 4809.116276] [<
bf068004>] (ieee80211_mgd_teardown+0x5c/0x74 [mac80211])
[ 4809.129331] [<
bf043f18>] (ieee80211_teardown_sdata+0xb0/0xd8 [mac80211])
[ 4809.141595] [<
c03b5e58>] (rollback_registered_many+0x228/0x2f0)
[ 4809.153056] [<
c03b5f48>] (unregister_netdevice_many+0x28/0x50)
[ 4809.165696] [<
bf041ea8>] (ieee80211_remove_interfaces+0xb4/0xdc [mac80211])
[ 4809.179151] [<
bf032174>] (ieee80211_unregister_hw+0x50/0xf0 [mac80211])
[ 4809.191043] [<
bf0bebb4>] (wlcore_remove+0x5c/0x7c [wlcore])
[ 4809.201491] [<
c02c6918>] (platform_drv_remove+0x24/0x28)
[ 4809.212029] [<
c02c4d50>] (__device_release_driver+0x8c/0xcc)
[ 4809.222738] [<
c02c4e84>] (device_release_driver+0x30/0x3c)
[ 4809.233099] [<
c02c4258>] (bus_remove_device+0x10c/0x128)
[ 4809.242620] [<
c02c26f8>] (device_del+0x11c/0x17c)
[ 4809.252150] [<
c02c6de0>] (platform_device_del+0x28/0x68)
[ 4809.263051] [<
bf0df49c>] (wl1271_remove+0x3c/0x50 [wlcore_sdio])
[ 4809.273590] [<
c03806b0>] (sdio_bus_remove+0x48/0xf8)
[ 4809.283754] [<
c02c4d50>] (__device_release_driver+0x8c/0xcc)
[ 4809.293729] [<
c02c4e2c>] (driver_detach+0x9c/0xc4)
[ 4809.303163] [<
c02c3d7c>] (bus_remove_driver+0xc4/0xf4)
[ 4809.312973] [<
c02c5a98>] (driver_unregister+0x70/0x7c)
[ 4809.323220] [<
c03809c4>] (sdio_unregister_driver+0x24/0x2c)
[ 4809.334213] [<
bf0df458>] (wl1271_exit+0x14/0x1c [wlcore_sdio])
[ 4809.344930] [<
c009b1a4>] (sys_delete_module+0x228/0x2a8)
[ 4809.354734] ---[ end trace
515290ccf5feb522 ]---
Rename ieee80211_mgd_teardown() to ieee80211_mgd_stop(),
and call it on ieee80211_do_stop().
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Meenakshi Venkataraman [Sun, 22 Apr 2012 14:55:27 +0000 (07:55 -0700)]
iwlwifi: use correct released ucode version
Report correctly the latest released version
of the iwlwifi firmware for all
iwlwifi-supported devices.
Cc: stable@vger.kernel.org #3.3+
Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Johannes Berg [Mon, 23 Apr 2012 21:17:50 +0000 (14:17 -0700)]
iwlwifi: fix hardware queue programming
Newer devices have 20 (5000 series) or 30 (6000 series)
hardware queues, rather than the 16 that 4965 had. This
was added to the driver a long time ago, but improperly:
the queue registers for the higher queues aren't just
continuations of the registers for the first 16 queues,
they are in other places. Therefore, the hardware would
lock up when trying to activate queue 16 or above and
the device would have to be restarted.
Thanks goes to Emmanuel who identified this and told me
how the queue programming should be done.
Note that we don't use queues 20 and higher today and
doing so needs more work than this.
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Steven Harms [Fri, 13 Apr 2012 18:45:55 +0000 (14:45 -0400)]
Add Foxconn / Hon Hai IDs for btusb module
This change adds 0x0489:0xe033 to the btusb module.
This bluetooth usb device is integrated in the Acer TimelineX AS4830TG-6808 notebook.
Output from /sys/kernel/debug/usb/devices:
T: Bus=01 Lev=02 Prnt=02 Port=05 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0489 ProdID=e033 Rev= 2.29
S: Manufacturer=Broadcom Corp
S: Product=Acer Module
S: SerialNumber=
60D819F74101
C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 32 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 32 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
Signed-off-by: Steven Harms <sjharms@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Szymon Janc [Fri, 13 Apr 2012 10:32:42 +0000 (12:32 +0200)]
Bluetooth: Fix missing break in hci_cmd_complete_evt
Command complete event for HCI_OP_USER_PASSKEY_NEG_REPLY would result
in calling handler function also for HCI_OP_LE_SET_SCAN_PARAM. This
could result in undefined behaviour.
Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Ingo van Lil [Mon, 23 Apr 2012 22:05:38 +0000 (22:05 +0000)]
asix: Fix tx transfer padding for full-speed USB
The asix.c USB Ethernet driver avoids ending a tx transfer with a zero-
length packet by appending a four-byte padding to transfers whose length
is a multiple of maxpacket. However, the hard-coded 512 byte maxpacket
length is valid for high-speed USB only; full-speed USB uses 64 byte
packets.
Signed-off-by: Ingo van Lil <inguin@gmx.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Anatolij Gustschin [Mon, 23 Apr 2012 12:06:43 +0000 (12:06 +0000)]
net/davinci_emac: fix failing PHY connect attempts
PHY connect attempts fail if no PHY id is specified in the emac platform
data and another mdio bus has been registered before 'davinci_mdio' bus. In
this case when configuring the interface, there will be an attempt to
connect to already attached PHY on the previously registered mdio bus:
net eth1: PHY already attached
net eth1: could not connect to phy smsc911x-0:01
IP-Config: Failed to open eth1
IP-Config: Device `eth1' not found
Fix this by modifying match_first_device() to match first PHY device
on 'davinci_mdio' bus.
Signed-off-by: Anatolij Gustschin <agust@denx.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Thadeu Lima de Souza Cascardo [Mon, 23 Apr 2012 03:46:29 +0000 (03:46 +0000)]
ehea: only register irq after setting up ports
If we receive an interrupt too early before we set up ports in the probe
function, there won't be any port ready to handle it.
Only registering the irq after the ports are setup fixes the problem,
and works fine without losing any interrupts.
This causes crashes in some situations:
[
c000000f7ff7fd60]
d000000008e223f0 .ehea_neq_tasklet+0x78/0x148 [ehea]
[
c000000f7ff7fe00]
c0000000000b6cac .tasklet_hi_action+0xdc/0x210
[
c000000f7ff7fea0]
c0000000000b7cc8 .__do_softirq+0x178/0x300
[
c000000f7ff7ff90]
c000000000022694 .call_do_softirq+0x14/0x24
[
c000000f68ee7900]
c000000000010e04 .do_softirq+0xec/0x110
[
c000000f68ee79a0]
c0000000000b789c .irq_exit+0xac/0xe0
[
c000000f68ee7a20]
c0000000000110bc .do_IRQ+0x114/0x2a8
[
c000000f68ee7ae0]
c00000000000553c hardware_interrupt_entry+0x18/0x1c
Signed-off-by: David S. Miller <davem@davemloft.net>
Stefan Raspl [Sun, 22 Apr 2012 21:21:42 +0000 (21:21 +0000)]
qeth: Use blkt defaults for OSA Express 4
The previous blkt defaults for OSA Express 4 cards produced inadequate
performance for streaming workloads. The present patch will apply a
set of more appropriate defaults.
Signed-off-by: Stefan Raspl <raspl@linux.vnet.ibm.com>
Reviewed-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ursula Braun [Sun, 22 Apr 2012 21:21:41 +0000 (21:21 +0000)]
qeth: allow change of blkt default values
There exist qeth sysfs blkt attributes to change the default blkt
values. But blkt changes are reset during online setting due to a 2nd
invocation of qeth_determine_capabilites(). This patch makes sure
blkt default values are configured during 1st run of
qeth_determine_capabilities() only. Thus blkt changes are kept
during online setting.
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Reported-by: Horst Hartmann <horst.hartmann@de.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stephane Fillod [Fri, 20 Apr 2012 09:39:23 +0000 (09:39 +0000)]
net: usb: smsc95xx: fix mtu
Make smsc95xx recalculate the hard_mtu after adjusting the
hard_header_len.
Without this, usbnet adjusts the MTU down to 1488 bytes, and the host is
unable to receive standard 1500-byte frames from the device.
Inspired by same fix on cdc_eem
78fb72f7936c01d5b426c03a691eca082b03f2b9.
Tested on ARM/Beagle.
Signed-off-by: Stephane Fillod <fillods@users.sf.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Peter Huang (Peng) [Thu, 19 Apr 2012 20:12:51 +0000 (20:12 +0000)]
set fake_rtable's dst to NULL to avoid kernel Oops
bridge: set fake_rtable's dst to NULL to avoid kernel Oops
when bridge is deleted before tap/vif device's delete, kernel may
encounter an oops because of NULL reference to fake_rtable's dst.
Set fake_rtable's dst to NULL before sending packets out can solve
this problem.
v4 reformat, change br_drop_fake_rtable(skb) to {}
v3 enrich commit header
v2 introducing new flag DST_FAKE_RTABLE to dst_entry struct.
[ Use "do { } while (0)" for nop br_drop_fake_rtable()
implementation -DaveM ]
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Peter Huang <peter.huangpeng@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Tue, 24 Apr 2012 02:45:19 +0000 (19:45 -0700)]
Merge branch 'rc-fixes' of git://git./linux/kernel/git/mmarek/kbuild
Pull build system failure fix from Michal Marek:
"This fixes build failure with newer gcc that adds some internal
symbols that end in "__mod_*_device_table", but are not actually the
tables themselves."
* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
Fix modpost failures in fedora 17
Linus Torvalds [Tue, 24 Apr 2012 01:25:01 +0000 (18:25 -0700)]
Merge tag 'md-3.4-fixes' of git://neil.brown.name/md
Pull a few more md bug fixes from NeilBrown:
"2 are tagged for -stable, one being for a fairly serious bug that can
corrupt metadata and make it hard to recovery an array. The other is
for a more recent regression since 3.3"
* tag 'md-3.4-fixes' of git://neil.brown.name/md:
md: fix possible corruption of array metadata on shutdown.
md: don't call ->add_disk unless there is good reason.
DM RAID: Use safe version of rdev_for_each
Linus Torvalds [Tue, 24 Apr 2012 01:22:42 +0000 (18:22 -0700)]
Merge tag 'dlm-fixes-3.4' of git://git./linux/kernel/git/teigland/linux-dlm
Pull dlm fixes from David Teigland:
"This includes one short patch fixing the behavior of the QUECVT flag,
which the gfs2 folks are waiting on."
* tag 'dlm-fixes-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm:
dlm: fix QUECVT when convert queue is empty
Hugh Dickins [Mon, 23 Apr 2012 18:14:50 +0000 (11:14 -0700)]
mm: fix s390 BUG by __set_page_dirty_no_writeback on swap
Mel reports a BUG_ON(slot == NULL) in radix_tree_tag_set() on s390
3.0.13: called from __set_page_dirty_nobuffers() when page_remove_rmap()
tries to transfer dirty flag from s390 storage key to struct page and
radix_tree.
That would be because of reclaim's shrink_page_list() calling
add_to_swap() on this page at the same time: first PageSwapCache is set
(causing page_mapping(page) to appear as &swapper_space), then
page->private set, then tree_lock taken, then page inserted into
radix_tree - so there's an interval before taking the lock when the
radix_tree slot is empty.
We could fix this by moving __add_to_swap_cache()'s spin_lock_irq up
before the SetPageSwapCache. But a better fix is simply to do what's
five years overdue: Ken Chen introduced __set_page_dirty_no_writeback()
(if !PageDirty TestSetPageDirty) for tmpfs to skip all the radix_tree
overhead, and swap is just the same - it ignores the radix_tree tag, and
does not participate in dirty page accounting, so should be using
__set_page_dirty_no_writeback() too.
s390 testing now confirms that this does indeed fix the problem.
Reported-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Hugh Dickins <hughd@google.com>
Acked-by: Mel Gorman <mgorman@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Ken Chen <kenchen@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
NeilBrown [Tue, 24 Apr 2012 00:23:16 +0000 (10:23 +1000)]
md: fix possible corruption of array metadata on shutdown.
commit
c744a65c1e2d59acc54333ce8
md: don't set md arrays to readonly on shutdown.
removed the possibility of a 'BUG' when data is written to an array
that has just been switched to read-only, but also introduced the
possibility that the array metadata could be corrupted.
If, when md_notify_reboot gets the mddev lock, the array is
in a state where it is assembled but hasn't been started (as can
happen if the personality module is not available, or in other unusual
situations), then incorrect metadata will be written out making it
impossible to re-assemble the array.
So only call __md_stop_writes() if the array has actually been
activated.
This patch is needed for any stable kernel which has had the above
commit applied.
Cc: stable@vger.kernel.org
Reported-by: Christoph Nelles <evilazrael@evilazrael.de>
Signed-off-by: NeilBrown <neilb@suse.de>
NeilBrown [Tue, 24 Apr 2012 00:23:14 +0000 (10:23 +1000)]
md: don't call ->add_disk unless there is good reason.
Commit
7bfec5f35c68121e7b18
md/raid5: If there is a spare and a want_replacement device, start replacement.
cause md_check_recovery to call ->add_disk much more often.
Instead of only when the array is degraded, it is now called whenever
md_check_recovery finds anything useful to do, which includes
updating the metadata for clean<->dirty transition.
This causes unnecessary work, and causes info messages from ->add_disk
to be reported much too often.
So refine md_check_recovery to only do any actual recovery checking
(including ->add_disk) if MD_RECOVERY_NEEDED is set.
This fix is suitable for 3.3.y:
Cc: stable@vger.kernel.org
Reported-by: Jan Ceuleers <jan.ceuleers@computer.org>
Signed-off-by: NeilBrown <neilb@suse.de>
Jonathan Brassow [Tue, 24 Apr 2012 00:23:13 +0000 (10:23 +1000)]
DM RAID: Use safe version of rdev_for_each
Fix segfault caused by using rdev_for_each instead of rdev_for_each_safe
Commit
dafb20fa34320a472deb7442f25a0c086e0feb33 mistakenly replaced a safe
iterator with an unsafe one when making some macro changes.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Eldad Zack [Sat, 21 Apr 2012 22:48:04 +0000 (00:48 +0200)]
brcmsmac: "INTERMEDIATE but not AMPDU" only when tracing
I keep getting the following messages on the log buffer:
[ 2167.097507] ieee80211 phy0: brcms_c_dotxstatus: INTERMEDIATE but not AMPDU
[ 2281.331305] ieee80211 phy0: brcms_c_dotxstatus: INTERMEDIATE but not AMPDU
[ 2281.332539] ieee80211 phy0: brcms_c_dotxstatus: INTERMEDIATE but not AMPDU
[ 2329.876605] ieee80211 phy0: brcms_c_dotxstatus: INTERMEDIATE but not AMPDU
[ 2329.877354] ieee80211 phy0: brcms_c_dotxstatus: INTERMEDIATE but not AMPDU
[ 2462.280756] ieee80211 phy0: brcms_c_dotxstatus: INTERMEDIATE but not AMPDU
[ 2615.651689] ieee80211 phy0: brcms_c_dotxstatus: INTERMEDIATE but not AMPDU
From the code comment I understand that this something that can -
and does, quite frequently - happen.
Signed-off-by: Eldad Zack <eldad@fogrefinery.com>
Acked-by: Franky Lin<frankyl@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Larry Finger [Fri, 20 Apr 2012 02:39:06 +0000 (21:39 -0500)]
rtlwifi: Fix oops on unload
Under some circumstances, a PCI-based driver reports the following OOPs:
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Oops: 0000 [#1] SMP
--snip--
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Pid: 19627, comm: rmmod
Not tainted 3.2.9-2.fc16.x86_64 #1 LENOVO 05962RU/05962RU
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] RIP:
0010:[<
ffffffffa0418d39>] [<
ffffffffa0418d39>]
rtl92ce_get_desc+0x19/0xd0 [rtl8192ce]
--snip--
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Process rmmod (pid:
19627, threadinfo
ffff880050262000, task
ffff8801156d5cc0)
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Stack:
Mar 19 08:14:35 kvothe kernel: [ 6584.626011]
0000000000000002
ffff8801176c2540 ffff880050263ca8 ffffffffa03348e7
Mar 19 08:14:35 kvothe kernel: [ 6584.626011]
0000000000000282
0000000180150014 ffff880050263fd8 ffff8801176c2810
Mar 19 08:14:35 kvothe kernel: [ 6584.626011]
ffff880050263bc8
ffffffff810550e2 00000000000002c0 ffff8801176c0d40
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Call Trace:
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] [<
ffffffffa03348e7>]
_rtl_pci_rx_interrupt+0x187/0x650 [rtlwifi]
--snip--
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] Code: ff 09 d0 89 07 48
83 c4 08 5b 5d c3 66 0f 1f 44 00 00 55 48 89 e5 53 48 83 ec 08 66 66
66 66 90 40 84 f6 89 d3 74 13 84 d2 75 57 <8b> 07 48 83 c4 08 5b 5d c1
e8 1f c3 0f 1f 00 84 d2 74 ed 80 fa
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] RIP
[<
ffffffffa0418d39>] rtl92ce_get_desc+0x19/0xd0 [rtl8192ce]
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] RSP <
ffff880050263b58>
Mar 19 08:14:35 kvothe kernel: [ 6584.626011] CR2:
00000000000006e0
Mar 19 08:14:35 kvothe kernel: [ 6584.646491] ---[ end trace
8636c766dcfbe0e6 ]---
This oops is due to interrupts not being disabled in this particular path.
Reported-by: Dave Airlie <airlied@gmail.com>
Tested-by: Dave Airlie <airlied@gmail.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Stanislav Yakovlev [Thu, 19 Apr 2012 19:55:09 +0000 (15:55 -0400)]
ipw2200: Fix race condition in the command completion acknowledge
Driver incorrectly validates command completion: instead of waiting
for a command to be acknowledged it continues execution. Most of the
time driver gets acknowledge of the command completion in a tasklet
before it executes the next one. But sometimes it sends the next
command before it gets acknowledge for the previous one. In such a
case one of the following error messages appear in the log:
Failed to send SYSTEM_CONFIG: Already sending a command.
Failed to send ASSOCIATE: Already sending a command.
Failed to send TX_POWER: Already sending a command.
After that you need to reload the driver to get it working again.
This bug occurs during roaming (reported by Sam Varshavchik)
https://bugzilla.redhat.com/show_bug.cgi?id=738508
and machine booting (reported by Tom Gundersen and Mads Kiilerich)
https://bugs.archlinux.org/task/28097
https://bugzilla.redhat.com/show_bug.cgi?id=802106
This patch doesn't fix the delay issue during firmware load.
But at least device now works as usual after boot.
Cc: stable@kernel.org
Signed-off-by: Stanislav Yakovlev <stas.yakovlev@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Stanislaw Gruszka [Wed, 18 Apr 2012 15:01:15 +0000 (08:01 -0700)]
iwlwifi: do not nulify ctx->vif on reset
ctx->vif is dereferenced in different part of iwlwifi code, so do not
nullify it.
This should address at least one of the possible reasons of WARNING at
iwlagn_mac_remove_interface, and perhaps some random crashes when
firmware reset is performed.
Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Gabor Juhos [Sun, 15 Apr 2012 18:38:06 +0000 (20:38 +0200)]
ath9k: fix tx power settings for AR9287
The 'ath9k_hw_update_regulatory_maxpower'
helper function has been introduced by
commit
a55f858852e4345d0a31af593c46738ca8614bff
(ath9k_hw: Cleanup TX power calculation for AR9287).
Updating of the max_power_level value has been moved
into the helper function in that change, however the
removed code from 'ath9k_hw_ar9287_set_txpower' has
not been replaced with a call of the new helper
function.
Due to that missing call, retrieving tx power for 2x2
and 3x3 chainmask is not handled properly. During the
calculation of the tx power for 2x2 and 3x3 chainmasks
the values are reduced. Those reductions must be
compensated during retrieving.
Fix this by adding the missing call of the helper
function.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Gabor Juhos [Sun, 15 Apr 2012 18:38:05 +0000 (20:38 +0200)]
ath9k: add an extra boolean parameter to ath9k_hw_apply_txpower
In order to unifying regulatory limit handling
commit
ca2c68cc7bc80fc4504fb420df04cce99c9ee6ec
(ath9k_hw: clean up tx power handling) introduced
a new helper function 'ath9k_hw_apply_txpower',
and the direct calls of 'ah->eep_ops->set_txpower'
has been replaced by a call of the helper function.
This caused a change in the behaviour of the
'ath9k_hw_set_txpowerlimit' function. The purpose
of that function is to calculate and store the
rate txpower table and the regulatory limit without
touching the hardware registers. Before the commit,
the 'test' parameter of the function was passed to
the 'ah->eep_ops->set_txpower'. Now the calling of
the 'set_txpower' function happens indirectly through
'ath9k_hw_apply_txpower', so the 'test' argument of
the 'set_txpower' is always 'false'.
This patch restores the original behaviour of
'ath9k_hw_set_txpowerlimit' by adding a new
argument to 'ath9k_hw_apply_txpower.'
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
David Teigland [Wed, 4 Apr 2012 14:49:15 +0000 (09:49 -0500)]
dlm: fix QUECVT when convert queue is empty
The QUECVT flag should not prevent conversions from
being granted immediately when the convert queue is
empty.
Signed-off-by: David Teigland <teigland@redhat.com>
Linus Torvalds [Mon, 23 Apr 2012 04:19:15 +0000 (21:19 -0700)]
Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm
Pull ARM fixes from Russell King:
"Here's my usual Sunday push, just for one revert which PeterZ hollered
about after last weeks push. Other than that, all seems strangely
quiet as far as fixes go in non-platform ARM land at the moment."
* 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
Revert "ARM: 7359/2: smp_twd: Only wait for reprogramming on active cpus"
Linus Torvalds [Mon, 23 Apr 2012 04:07:51 +0000 (21:07 -0700)]
Merge branch 'merge' of git://git./linux/kernel/git/benh/powerpc
Pull powerpc fixes from Benjamin Herrenschmidt:
"Here are a few fixes for powerpc. Note the addition to the generic
irq.h. This is part of a 3-patches regression fix for mpic due to
changes in how IRQ_TYPE_NONE is being handled. Thomas agreed to the
addition of the new IRQ_TYPE_DEFAULT contant, however he hasn't
replied with an Ack to the actual patch yet. I don't to wait much
longer with these patches tho."
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc/mpic: Properly set default triggers
irq: Add IRQ_TYPE_DEFAULT for use by PIC drivers
powerpc/mpic: Fix confusion between hw_irq and virq
powerpc/pmac: Don't add_timer() twice
powerpc/eeh: Fix crash caused by null eeh_dev
powerpc/mpc85xx: add MPIC message dts node
powerpc/mpic_msgr: fix offset error when setting mer register
powerpc/mpic_msgr: add lock for MPIC message global variable
powerpc/mpic_msgr: fix compile error when SMP disabled
powerpc: fix build when CONFIG_BOOKE_WDT is enabled
powerpc/85xx: don't call of_platform_bus_probe() twice
Linus Torvalds [Mon, 23 Apr 2012 04:02:57 +0000 (21:02 -0700)]
Merge git://git./linux/kernel/git/davem/net
Pull networking fixes from David Miller:
1) Fix namespace init and cleanup in phonet to fix some oopses, from
Eric W. Biederman.
2) Missing kfree_skb() in AF_KEY, from Julia Lawall.
3) Refcount leak and source address handling fix in l2tp from James
Chapman.
4) Memory leak fix in CAIF from Tomasz Gregorek.
5) When routes are cloned from ipv6 addrconf routes, we don't process
expirations properly. Fix from Gao Feng.
6) Fix panic on DMA errors in atl1 driver, from Tony Zelenoff.
7) Only enable interrupts in 8139cp driver after we've registered the
IRQ handler. From Jason Wang.
8) Fix too many reads of KS_CIDER register in ks8851 during probe,
fixing crashes on spurious interrupts. From Matt Renzelmann.
9) Missing include in ath5k driver and missing iounmap on probe
failure, from Jonathan Bither.
10) Fix RX packet handling in smsc911x driver, from Will Deacon.
11) Fix ixgbe WoL on fiber by leaving the laser on during shutdown.
12) ks8851 needs MAX_RECV_FRAMES increased otherwise the internal MAC
buffers are easily overflown. Fix from Davide Cimingahi.
13) Fix memory leaks in peak_usb CAN driver, from Jesper Juhl.
14) gred packet scheduler can dump in WRED more when doing a netlink
dump. Fix from David Ward.
15) Fix MTU in USB smsc75xx driver, from Stephane Fillod.
16) Dummy device needs ->ndo_uninit handler to properly handle
->ndo_init failures. From Hiroaki SHIMODA.
17) Fix TX fragmentation in ath9k driver, from Sujith Manoharan.
18) Missing RTNL lock in ixgbe PM resume, from Benjamin Poirier.
19) Missing iounmap in farsync WAN driver, from Julia Lawall.
20) With LRO/GRO, tcp_grow_window() is easily tricked into not growing
the receive window properly, and this hurts performance. Fix from
Eric Dumazet.
21) Network namespace init failure can leak net_generic data, fix from
Julian Anastasov.
22) Fix skb_over_panic due to mis-accounting in TCP for partially ACK'd
SKBs. From Eric Dumazet.
23) New IDs for qmi_wwan driver, from Bjørn Mork.
24) Fix races in ax25_exit(), from Eric W. Biederman.
25) IPV6 TCP doesn't handle TCP_MAXSEG socket option properly, copy over
logic from the IPV4 side. From Neal Cardwell.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (59 commits)
tcp: fix TCP_MAXSEG for established IPv6 passive sockets
drivers/net: Do not free an IRQ if its request failed
drop_monitor: allow more events per second
ks8851: Fix request_irq/free_irq mismatch
net/hyperv: Adding cancellation to ensure rndis filter is closed
ks8851: Fix mutex deadlock in ks8851_net_stop()
net ax25: Reorder ax25_exit to remove races.
icplus: fix interrupt for IC+ 101A/G and 1001LF
net: qmi_wwan: support Sierra Wireless MC77xx devices in QMI mode
bnx2x: off by one in bnx2x_ets_e3b0_sp_pri_to_cos_set()
ksz884x: don't copy too much in netdev_set_mac_address()
tcp: fix retransmit of partially acked frames
netns: do not leak net_generic data on failed init
net/sock.h: fix sk_peek_off kernel-doc warning
tcp: fix tcp_grow_window() for large incoming frames
drivers/net/wan/farsync.c: add missing iounmap
davinci_mdio: Fix MDIO timeout check
ipv6: clean up rt6_clean_expires
ipv6: fix rt6_update_expires
arcnet: rimi: Fix device name in debug output
...
Benjamin Herrenschmidt [Thu, 19 Apr 2012 17:30:57 +0000 (17:30 +0000)]
powerpc/mpic: Properly set default triggers
This gets rid of the unused default senses array, and replaces the
incorrect use of IRQ_TYPE_NONE with the new IRQ_TYPE_DEFAULT for
the initial set_trigger() call when mapping an interrupt.
This in turn makes us read the HW state and update the irq desc
accordingly.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Benjamin Herrenschmidt [Thu, 19 Apr 2012 17:29:42 +0000 (17:29 +0000)]
irq: Add IRQ_TYPE_DEFAULT for use by PIC drivers
This is meant typically to allow a PIC driver's irq domain map() callback
to establish sane defaults for the interrupt (and make sure that the HW
and the irq_desc are in sync as far as the trigger is concerned).
The irq core may not call the set_trigger callback if it thinks the
trigger is already set to the right setting, so we need to ensure new
descriptors are properly synchronized with the hardware.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Benjamin Herrenschmidt [Thu, 19 Apr 2012 17:29:34 +0000 (17:29 +0000)]
powerpc/mpic: Fix confusion between hw_irq and virq
mpic_is_ipi() takes a virq and immediately converts it to a hw_irq.
However, one of the two call sites calls it with a ... hw_irq. The
other call site also happens to have the hw_irq at hand, so let's
change it to just take that as an argument. Also change mpic_is_tm()
for consistency.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Benjamin Herrenschmidt [Wed, 18 Apr 2012 22:16:48 +0000 (22:16 +0000)]
powerpc/pmac: Don't add_timer() twice
If the interrupt and the timeout happen roughly at the same
time, we can get into a situation where the timer function
is run while the interrupt has already been processed. In
this case, the timer function might end up doing an add_timer
on an already pending timer, causing a BUG_ON() to trigger.
Instead, just skip the whole timeout operation if we see that
the timer is pending. The spinlock ensures that the only way
that happens is if we already started a new operation and thus
the timeout can be ignored.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Gavin Shan [Mon, 16 Apr 2012 19:55:39 +0000 (19:55 +0000)]
powerpc/eeh: Fix crash caused by null eeh_dev
The problem was reported by Anton Blanchard. While EEH error
happened to the PCI device without the corresponding device
driver, kernel crash was seen. Eventually, I successfully
reproduced the problem on Firebird-L machine with utility
"errinjct". Initially, the device driver for Emulex ethernet
MAC has been disabled from .config and force data parity on
the Emulex ethernet MAC with help of "errinjct". Eventually,
I saw the kernel crash after issueing couple of "lspci -v"
command.
The root cause behind is that the PCI device, including the
reference to the corresponding eeh device, will be removed
from the system while EEH does recovery. Afterwards, the
PCI device will be probed again and added into the system
accordingly. So it's not safe to retrieve the eeh device from
the corresponding PCI device after the PCI device has been removed
and not added again.
The patch fixes the issue and retrieve the eeh device from OF node
instead of PCI device after the PCI device has been removed.
Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>
Tested-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>