summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2011-09-27wl3501_cs: min_t() cast truncates high bitsDan Carpenter
wrqu->encoding.length comes from the network administrator. It's size u16. We want to limit "tocopy" to the smallest value of either "len_keys", "wrqu->encoding.length" or 100. But because .length gets cast from u16 to u8 we might use a random, smaller value than the was desired. It's probably not very serious, but we may as well fix it. Btw, this is from code auditing and not from testing. I don't know if this affects anyone in real life. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: fix scan complete processingJohannes Berg
When we cancel a scan, the completion runs only from the workqueue. This can cause the remain-on-channel scan to fail when another one was just canceled, because we're still aborting it. To fix this, run the completion inline with the lock still held before returning from iwl_scan_cancel_timeout(). Also, to avoid the scan complete work from completing a new scan prematurely, add a new STATUS_SCAN_COMPLETE bit. Reported-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Tested-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: move iwl_process_scan_complete upJohannes Berg
To make the next patch easier to read, move the function up, it'll be needed earlier in this file in the next patch. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: refactor scan completeJohannes Berg
We'll need to be able to run scan complete inline, not from the workqueue, so refactor it. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: make iwl_scan_cancel_timeout voidJohannes Berg
The return value of iwl_scan_cancel_timeout() isn't used anywhere, so let's just remove it. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: remove Kelvin supportJohannes Berg
Only 5150 series devices report their temperature in Kelvin, and for those we already convert it to Celsius when storing into priv->temperature, so there's no way priv->temperature will ever be in Kelvin. Remove support for this. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: fix slot programmingJohannes Berg
When an AP mode interface is added with a DTIM period of two, the slot programming is wrong. Fix it by taking into account the DTIM period. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: fix dangling scan requestJohannes Berg
If iwl_scan_initiate() fails for any reason, priv->scan_request and priv->scan_vif are left dangling. This can lead to a crash later when iwl_bg_scan_completed() tries to run a pending scan request. In practice, this seems to be very rare due to the STATUS_SCANNING check earlier. That check, however, is wrong -- it should allow a scan to be queued when a reset/roc scan is going on. When a normal scan is already going on, a new one can't be issued by mac80211, so that code can be removed completely. I introduced this bug when adding off-channel support in commit 266af4c745952e9bebf687dd68af58df553cb59d. Cc: stable@kernel.org [3.0] Reported-by: Peng Yan <peng.yan@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: use kcalloc when possible for array allocationEmmanuel Grumbach
As everybody knows kcalloc checks the multiplication is safe and that we don't run into overflow. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: update rate scaling with BA notificationsEmmanuel Grumbach
In the current code, the rate scaling isn't fed with statistics from the BA notifications. This is since my patch: iwlagn: reclaim the packets in transport layer Fix that. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: add debugging to show probe related info in scan notificationWey-Yi Guy
Add debugging to show the status of probe in scan notification to help debug probe related issues Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: set the sequence control from the transport layerEmmanuel Grumbach
Since all the queue logic has been moved to the transport layer, the sequence number is set in the transport layer. While doing that I forgot that the mac header is copied to the TB of the TX cmd in the upper layer before the call to the transport layer. So basically we used the sequence number from mac80211... This was fine for the first assocation but after the second, mac80211 resets its counters while we don't hence a shift that led to terrible impact on performance. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: sparse warning priv->temperature is signedEmmanuel Grumbach
Since priv->temperature is signed, we cannot use debugfs_create_u32 to refer to it. Use a regular debugfs file instead. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27iwlagn: remove warning in iwl_rx_handleEmmanuel Grumbach
Txid was used without being initialized. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27ath9k: fix a regression in ath9k_ps_restoreFelix Fietkau
After 'ath9k: optimize ath9k_ps_restore', it would only send the device to network sleep and not to full sleep anymore, potentially causing more battery drain. Reported-by: Vivek Natarajan <nataraja@qca.qualcomm.com> Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27mwifiex: reset skb length before inserting to free queueAmitkumar Karwar
After handling command response, cmd skb is inserted into command free queue(which keeps track of availabile skbs) for reuse purpose. Skb length is not getting reset to zero here. This patch takes care of it. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27mwifiex: pass correct band parameter to ieee80211_channel_to_frequency()Amitkumar Karwar
ieee80211_channel_to_frequency() routine expects band parameter in the form of "enum ieee80211_band band". Currently driver specific band (BAND_A, BAND_AN etc.) is passed to the routine. This patch makes sure that correct parameter is passed. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27mwifiex: update bss band informationAmitkumar Karwar
In recent commit "mwifiex: use cfg80211 dynamic scan..." (7c6fa2a843..) scan table handling in driver is removed to make use of cfg80211 dynamic scan table. Now driver sends beacon buffers found in scanning directly to stack and parse the buffer for requested BSS only during association. Beacon buffer doesn't contain bss band information. Driver gets it from firmware in separate tlv (chan_band_tlv). Currently since we don't inform stack about bss bandinfo, there is an issue with 5GHz association. Use "priv" field of struct cfg80211_bss to store bandinfo. This fixes 5GHz association issue. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27mwifiex: fix 5GHz association issueAmitkumar Karwar
Sometimes association in 5GHz doesn't work. Dmesg log shows "Can not find requested SSID xyz" error message. Currently while preparing scan channel list for firmware Null entries are created for disabled channels. The routine which retrieves this list ignores channels after Null entry. Hence sometimes driver doesn't scan the channel of requested AP and association fails. The issue is fixed by avoiding those NULL entries. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27b43: LCN-PHY: minor clean upsRafał Miłecki
Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27b43: update dummy transmissionRafał Miłecki
Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27b43: add missing MMIO definesRafał Miłecki
Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27libertas: scan behaviour consistency improvementsDaniel Drake
When scanning for the broadcast SSID, there is no need to add the SSID TLV (restoring the behaviour of the driver behaviour in the wext days, confirmed in Marvell specifications). If bssid is unspecified, the current scan code will usually fire off an active scan probing for the specific requested SSID. However, if a scan is ongoing (or has just finished), those scan results will be used instead (even if that scan is totally different, e.g. a passive scan on channel 4 for a different SSID). Fix this inconsistency by always firing off a scan when associating without a bssid. Signed-off-by: Daniel Drake <dsd@laptop.org> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27mac80211: add ieee80211_vif param to tsf functionsEliad Peller
TSF can be kept per vif. Add ieee80211_vif param to set/get/reset_tsf, and move the debugfs entries to the per-vif directory. Update all the drivers that implement these callbacks. Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27ath9k: add Block ACK bitmap in sample debugMohammed Shafi Shajakhan
this represents the bitmap of block ACK received after the successful transmission of an aggregate frame. also made few changes to beautify the display Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-27ath6kl: allow firmware to override firmware patch addressKalle Valo
In some firmware versions their patch address has changed. If the firmware provides one, use it to override the default address. Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2011-09-27ath6kl: fix TCP corruptionJouni Malinen
Commit 94e532d1a ("ath6kl: Fix system freeze under heavy data load") aligns the skb data without checking if the skb is cloned. Because of this ath6kl can corrupt the local TCP stack information that can result in TCP retransmission failing and TCP connections stalling. To avoid the corruption we need to copy the skb. Now the alignment in ath6kl_htc_tx_buf_align() doesn't corrupt TCP packets anymore (and is not even used for the cloned skb's that got copied since the alignment of the data is handled at the copy time). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2011-09-27skge: handle irq better on single port cardStephen Hemminger
Most boards with SysKonnect/Marvell Ethernet have only a single port. For the single port case, use the standard Ethernet driver convention of allocating IRQ when device is brought up rather than at probe time. This patch also adds some additional read after writes to avoid any PCI posting problems when setting the IRQ mask. The error handling of dual port cards is also changed. If second port can not be brought up, then just fail. No point in continuing, since the failure is most certainly because of out of memory. It is worth noting that the dual port skge device has a single irq but two seperate status rings and therefore has two NAPI objects, one for each port. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-27be2net: Show newly flashed FW ver in ethtoolSathya Perla
This fix provides a newly flashed FW version (appended, in braces) along with the currently running FW version via ethtool. The newly flashed version runs only after a system reset. Signed-off-by: Suresh Reddy <Suresh.Reddy@emulex.com> Signed-off-by: Sathya Perla <sathya.perla@emulex.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-27be2net: fix multicast filter programmingSathya Perla
Re-posting with subject fixed! Multicast programming has been broken since commit 5b8821b7. Setting the MULTICAST flag while sending the cmd to the FW was missing. Fixed this. Also fixed-up some indentation in the adjacent lines. Signed-off-by: Sathya Perla <sathya.perla@emulex.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-27treewide: Correct spelling of successfully in commentsJoe Perches
Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-09-27doc: fix broken referencesPaul Bolle
There are numerous broken references to Documentation files (in other Documentation files, in comments, etc.). These broken references are caused by typo's in the references, and by renames or removals of the Documentation files. Some broken references are simply odd. Fix these broken references, sometimes by dropping the irrelevant text they were part of. Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-09-27ath6kl: Remove unnecessary retrieval of first list entry in ↵Vasanthakumar Thiagarajan
ath6kl_htc_tx_setup_scat_list() It is unnecessary to take the first list entry from queue again for transmission. Sometimes it may look racy when the head of the list changes between subsequent retrival, but should not happen in practical. Reported-by: Jouni Malinen <jouni@qca.qualcomm.com> Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2011-09-27ath6kl: Fix compilation error while compiling w/o debugRajkumar Manoharan
drivers/net/wireless/ath/ath6kl/htc_hif.o: In function `ath6kl_debug_fwlog_event': drivers/net/wireless/ath/ath6kl/debug.h:109: multiple definition of `ath6kl_debug_fwlog_event' drivers/net/wireless/ath/ath6kl/debug.o: drivers/net/wireless/ath/ath6kl/debug.h:109: first defined here drivers/net/wireless/ath/ath6kl/htc_hif.o: In function `ath6kl_debug_cleanup': drivers/net/wireless/ath/ath6kl/debug.h:118: multiple definition of `ath6kl_debug_cleanup' drivers/net/wireless/ath/ath6kl/debug.o: drivers/net/wireless/ath/ath6kl/debug.h:118: first defined here Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2011-09-27enic: Add support for port profile association on a enic SRIOV VFRoopa Prabhu
This patch touchs most of the enic port profile handling code. Tried to break it into sub patches without success. The patch mainly does the following: - Port profile operations for a SRIOV VF are modified to work only via its PF - Changes the port profile static struct in struct enic to a pointer. This is because a SRIOV PF has to now hold the port profile information for all its VF's - Moved address registration for VF's during port profile ASSOCIATE time - Most changes in port profile handling code are changes related to indexing into the port profile struct array of a PF for the VF port profile information Signed-off-by: Roopa Prabhu <roprabhu@cisco.com> Signed-off-by: Sujith Sankar <ssujith@cisco.com> Signed-off-by: Christian Benvenuti <benve@cisco.com> Signed-off-by: David Wang <dwang2@cisco.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-27enic: Helper code for SRIOV proxy commandsRoopa Prabhu
This patch adds helper functions to use PF as proxy for SRIOV VF firmware commands. Signed-off-by: Roopa Prabhu <roprabhu@cisco.com> Signed-off-by: Sujith Sankar <ssujith@cisco.com> Signed-off-by: Christian Benvenuti <benve@cisco.com> Signed-off-by: David Wang <dwang2@cisco.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-27enic: Add SRIOV supportRoopa Prabhu
This patch adds support to enable SRIOV on enic devices. Enic SRIOV VF's are dynamic vnics and will use the same driver code as dynamic vnics. Signed-off-by: Roopa Prabhu <roprabhu@cisco.com> Signed-off-by: Sujith Sankar <ssujith@cisco.com> Signed-off-by: Christian Benvenuti <benve@cisco.com> Signed-off-by: David Wang <dwang2@cisco.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-27sky2: manage irq better on single port cardstephen hemminger
Most sky2 hardware only has a single port, although some variations of the chip support two interfaces. For the single port case, use the standard Ethernet driver convention of allocating IRQ when device is brought up rather than at probe time. Also, change the error handling of dual port cards so that if second port can not be brought up, then just fail. No point in continuing, since the failure is most certainly because of out of memory. The dual port sky2 device has a single irq and a single status ring, therefore it has a single NAPI object shared by both ports. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-27pch_gbe: remove unused variableJon Mason
netdev is unused in pch_gbe_setup_rctl. Remove this declaration to avoid a compiler warning. Signed-off-by: Jon Mason <jdmason@kudzu.us> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-27ehea: Remove sleep at .ndo_get_statsbrenohl@br.ibm.com
Currently ehea ndo_get_stats can sleep in two places, in a hcall and in a GFP_KERNEL alloc, which is not correct. This patch creates a delayed workqueue that grabs the information each 1 sec from the hardware, and place it into the device structure, so that, .ndo_get_stats quickly returns the device structure statistics block. Signed-off-by: Breno Leitao <brenohl@br.ibm.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-26dp83640: add time stamp insertion for sync messagesRichard Cochran
This commit adds one step support to the phyter. When enabled, the hardware does not provide time stamps for transmitted sync messages but instead inserts the stamp into the outgoing packet. Signed-off-by: Richard Cochran <richard.cochran@omicron.at> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-26dp83640: enable six external events and one periodic outputRichard Cochran
This patch enables six external event channels and one periodic output. One GPIO is reserved for synchronizing multiple PHYs. The assignment of GPIO functions can be changed via a module parameter. The code supports multiple simultaneous events by inducing a PTP clock event for every channel marked in the PHY's extended status word. Signed-off-by: Richard Cochran <richard.cochran@omicron.at> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-26ath9k: Fix a dma warning/memory leakMohammed Shafi Shajakhan
proper dma_unmapping and freeing of skb's has to be done in the rx cleanup for EDMA chipsets when the device is unloaded and this also seems to address the following warning which shows up occasionally when the device is unloaded Call Trace: [<c0148cd2>] warn_slowpath_common+0x72/0xa0 [<c03b669c>] ? dma_debug_device_change+0x19c/0x200 [<c03b669c>] ? dma_debug_device_change+0x19c/0x200 [<c0148da3>] warn_slowpath_fmt+0x33/0x40 [<c03b669c>] dma_debug_device_change+0x19c/0x200 [<c0657f12>] notifier_call_chain+0x82/0xb0 [<c0171370>] __blocking_notifier_call_chain+0x60/0x90 [<c01713bf>] blocking_notifier_call_chain+0x1f/0x30 [<c044f594>] __device_release_driver+0xa4/0xc0 [<c044f647>] driver_detach+0x97/0xa0 [<c044e65c>] bus_remove_driver+0x6c/0xe0 [<c029af0b>] ? sysfs_addrm_finish+0x4b/0x60 [<c0450109>] driver_unregister+0x49/0x80 [<c0299f54>] ? sysfs_remove_file+0x14/0x20 [<c03c3ab2>] pci_unregister_driver+0x32/0x80 [<f92c2162>] ath_pci_exit+0x12/0x20 [ath9k] [<f92c8467>] ath9k_exit+0x17/0x36 [ath9k] [<c06523cd>] ? mutex_unlock+0xd/0x10 [<c018e27f>] sys_delete_module+0x13f/0x200 [<c02139bb>] ? sys_munmap+0x4b/0x60 [<c06547c5>] ? restore_all+0xf/0xf [<c0657a20>] ? spurious_fault+0xe0/0xe0 [<c01832f4>] ? trace_hardirqs_on_caller+0xf4/0x180 [<c065b863>] sysenter_do_call+0x12/0x38 ---[ end trace 16e1c1521c06bcf9 ]--- Mapped at: [<c03b7938>] debug_dma_map_page+0x48/0x120 [<f92ba3e8>] ath_rx_init+0x3f8/0x4b0 [ath9k] [<f92b5ae4>] ath9k_init_device+0x4c4/0x7b0 [ath9k] [<f92c2813>] ath_pci_probe+0x263/0x330 [ath9k] Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-26rtlwifi: rtl8192cu: Fix unitialized structLarry Finger
Driver rtl8192cu assigns a new struct rtl_tcb_desc object, but fails to clear it. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Stable <stable@kernel.org> [2.6.39+] Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-26iwlagn: fix dangling scan requestJohannes Berg
If iwl_scan_initiate() fails for any reason, priv->scan_request and priv->scan_vif are left dangling. This can lead to a crash later when iwl_bg_scan_completed() tries to run a pending scan request. In practice, this seems to be very rare due to the STATUS_SCANNING check earlier. That check, however, is wrong -- it should allow a scan to be queued when a reset/roc scan is going on. When a normal scan is already going on, a new one can't be issued by mac80211, so that code can be removed completely. I introduced this bug when adding off-channel support in commit 266af4c745952e9bebf687dd68af58df553cb59d. Cc: stable@kernel.org [3.0] Reported-by: Peng Yan <peng.yan@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-26[SCSI] cxgb3i: convert cdev->l2opt to use rcu to prevent NULL dereferenceNeil Horman
This oops was reported recently: d:mon> e cpu 0xd: Vector: 300 (Data Access) at [c0000000fd4c7120] pc: d00000000076f194: .t3_l2t_get+0x44/0x524 [cxgb3] lr: d000000000b02108: .init_act_open+0x150/0x3d4 [cxgb3i] sp: c0000000fd4c73a0 msr: 8000000000009032 dar: 0 dsisr: 40000000 current = 0xc0000000fd640d40 paca = 0xc00000000054ff80 pid = 5085, comm = iscsid d:mon> t [c0000000fd4c7450] d000000000b02108 .init_act_open+0x150/0x3d4 [cxgb3i] [c0000000fd4c7500] d000000000e45378 .cxgbi_ep_connect+0x784/0x8e8 [libcxgbi] [c0000000fd4c7650] d000000000db33f0 .iscsi_if_rx+0x71c/0xb18 [scsi_transport_iscsi2] [c0000000fd4c7740] c000000000370c9c .netlink_data_ready+0x40/0xa4 [c0000000fd4c77c0] c00000000036f010 .netlink_sendskb+0x4c/0x9c [c0000000fd4c7850] c000000000370c18 .netlink_sendmsg+0x358/0x39c [c0000000fd4c7950] c00000000033be24 .sock_sendmsg+0x114/0x1b8 [c0000000fd4c7b50] c00000000033d208 .sys_sendmsg+0x218/0x2ac [c0000000fd4c7d70] c00000000033f55c .sys_socketcall+0x228/0x27c [c0000000fd4c7e30] c0000000000086a4 syscall_exit+0x0/0x40 --- Exception: c01 (System Call) at 00000080da560cfc The root cause was an EEH error, which sent us down the offload_close path in the cxgb3 driver, which in turn sets cdev->l2opt to NULL, without regard for upper layer driver (like the cxgbi drivers) which might have execution contexts in the middle of its use. The result is the oops above, when t3_l2t_get attempts to dereference L2DATA(cdev)->nentries in arp_hash right after the EEH error handler sets it to NULL. The fix is to prevent the setting of the NULL pointer until after there are no further users of it. The t3cdev->l2opt pointer is now converted to be an rcu pointer and the L2DATA macro is now called under the protection of the rcu_read_lock(). When the EEH error path: t3_adapter_error->offload_close->cxgb3_offload_deactivate Is exectured, setting of that l2opt pointer to NULL, is now gated on an rcu quiescence point, preventing, allowing L2DATA callers to safely check for a NULL pointer without concern that the underlying data will be freeded before the pointer is dereferenced. This has been tested by the reporter and shown to fix the reproted oops [nhorman: fix up unitinialised variable reported by Dan Carpenter] Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Reviewed-by: Karen Xie <kxie@chelsio.com> Cc: stable@kernel.org Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2011-09-23qlcnic: Change CDRP functionAnirban Chakraborty
Argument list to CDRP function has become unmanageably long. Fix it by properly declaring a struct that encompasses all the input and output parameters. Signed-off-by: Anirban Chakraborty <anirban.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-23qlcnic: Added error logging for firmware abortAmeen Rahman
Signed-off-by: Ameen Rahman <ameen.rahman@qlogic.com> Signed-off-by: Anirban Chakraborty <anirban.chakraborty@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-23Merge git://github.com/Jkirsher/net-nextDavid S. Miller
2011-09-23net/fec: add imx6q enet supportShawn Guo
The imx6q enet is a derivative of imx28 enet controller. It fixed the frame endian issue found on imx28, and added 1 Gbps support. It also fixes a typo on vendor name in Kconfig. Signed-off-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>