aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2013-02-08 15:55:24 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2013-02-08 15:55:24 -0500
commite06b84052a0721a4432e5242cf7526d47869b063 (patch)
treeb979db6918362e151f4d682bdac943fe1c2f4b41
parent2a1a6e7af41cd029c90b8d9d79a76452a864805e (diff)
parenta1c83b054ebe1264ed9ae9d5c286f9eae68e60ea (diff)
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) Revert iwlwifi reclaimed packet tracking, it causes problems for a bunch of folks. From Emmanuel Grumbach. 2) Work limiting code in brcmsmac wifi driver can clear tx status without processing the event. From Arend van Spriel. 3) rtlwifi USB driver processes wrong SKB, fix from Larry Finger. 4) l2tp tunnel delete can race with close, fix from Tom Parkin. 5) pktgen_add_device() failures are not checked at all, fix from Cong Wang. 6) Fix unintentional removal of carrier off from tun_detach(), otherwise we confuse userspace, from Michael S. Tsirkin. 7) Don't leak socket reference counts and ubufs in vhost-net driver, from Jason Wang. 8) vmxnet3 driver gets it's initial carrier state wrong, fix from Neil Horman. 9) Protect against USB networking devices which spam the host with 0 length frames, from Bjørn Mork. 10) Prevent neighbour overflows in ipv6 for locally destined routes, from Marcelo Ricardo. This is the best short-term fix for this, a longer term fix has been implemented in net-next. 11) L2TP uses ipv4 datagram routines in it's ipv6 code, whoops. This mistake is largely because the ipv6 functions don't even have some kind of prefix in their names to suggest they are ipv6 specific. From Tom Parkin. 12) Check SYN packet drops properly in tcp_rcv_fastopen_synack(), from Yuchung Cheng. 13) Fix races and TX skb freeing bugs in via-rhine's NAPI support, from Francois Romieu and your's truly. 14) Fix infinite loops and divides by zero in TCP congestion window handling, from Eric Dumazet, Neal Cardwell, and Ilpo Järvinen. 15) AF_PACKET tx ring handling can leak kernel memory to userspace, fix from Phil Sutter. 16) Fix error handling in ipv6 GRE tunnel transmit, from Tommi Rantala. 17) Protect XEN netback driver against hostile frontend putting garbage into the rings, don't leak pages in TX GOP checking, and add proper resource releasing in error path of xen_netbk_get_requests(). From Ian Campbell. 18) SCTP authentication keys should be cleared out and released with kzfree(), from Daniel Borkmann. 19) L2TP is a bit too clever trying to maintain skb->truesize, and ends up corrupting socket memory accounting to the point where packet sending is halted indefinitely. Just remove the adjustments entirely, they aren't really needed. From Eric Dumazet. 20) ATM Iphase driver uses a data type with the same name as the S390 headers, rename to fix the build. From Heiko Carstens. 21) Fix a typo in copying the inner network header offset from one SKB to another, from Pravin B Shelar. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (56 commits) net: sctp: sctp_endpoint_free: zero out secret key data net: sctp: sctp_setsockopt_auth_key: use kzfree instead of kfree atm/iphase: rename fregt_t -> ffreg_t net: usb: fix regression from FLAG_NOARP code l2tp: dont play with skb->truesize net: sctp: sctp_auth_key_put: use kzfree instead of kfree netback: correct netbk_tx_err to handle wrap around. xen/netback: free already allocated memory on failure in xen_netbk_get_requests xen/netback: don't leak pages on failure in xen_netbk_tx_check_gop. xen/netback: shutdown the ring if it contains garbage. net: qmi_wwan: add more Huawei devices, including E320 net: cdc_ncm: add another Huawei vendor specific device ipv6/ip6_gre: fix error case handling in ip6gre_tunnel_xmit() tcp: fix for zero packets_in_flight was too broad brcmsmac: rework of mac80211 .flush() callback operation ssb: unregister gpios before unloading ssb bcma: unregister gpios before unloading bcma rtlwifi: Fix scheduling while atomic bug net: usbnet: fix tx_dropped statistics tcp: ipv6: Update MIB counters for drops ...
Diffstat
-rw-r--r--drivers/atm/iphase.h146
-rw-r--r--drivers/bcma/bcma_private.h5
-rw-r--r--drivers/bcma/driver_chipcommon_nflash.c2
-rw-r--r--drivers/bcma/driver_gpio.c5
-rw-r--r--drivers/bcma/main.c7
-rw-r--r--drivers/net/bonding/bond_sysfs.c1
-rw-r--r--drivers/net/can/c_can/c_can.c6
-rw-r--r--drivers/net/ethernet/emulex/benet/be.h8
-rw-r--r--drivers/net/ethernet/emulex/benet/be_main.c2
-rw-r--r--drivers/net/ethernet/intel/e1000e/defines.h9
-rw-r--r--drivers/net/ethernet/intel/e1000e/e1000.h2
-rw-r--r--drivers/net/ethernet/intel/e1000e/ethtool.c2
-rw-r--r--drivers/net/ethernet/intel/e1000e/hw.h1
-rw-r--r--drivers/net/ethernet/intel/e1000e/ich8lan.c11
-rw-r--r--drivers/net/ethernet/intel/e1000e/netdev.c46
-rw-r--r--drivers/net/ethernet/via/via-rhine.c8
-rw-r--r--drivers/net/tun.c38
-rw-r--r--drivers/net/usb/cdc_ncm.c3
-rw-r--r--drivers/net/usb/qmi_wwan.c13
-rw-r--r--drivers/net/usb/usbnet.c35
-rw-r--r--drivers/net/vmxnet3/vmxnet3_drv.c7
-rw-r--r--drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c35
-rw-r--r--drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h3
-rw-r--r--drivers/net/wireless/brcm80211/brcmsmac/main.c40
-rw-r--r--drivers/net/wireless/brcm80211/brcmsmac/pub.h3
-rw-r--r--drivers/net/wireless/iwlwifi/dvm/tx.c24
-rw-r--r--drivers/net/wireless/mwifiex/scan.c9
-rw-r--r--drivers/net/wireless/rtlwifi/base.c7
-rw-r--r--drivers/net/wireless/rtlwifi/usb.c4
-rw-r--r--drivers/net/xen-netback/common.h3
-rw-r--r--drivers/net/xen-netback/interface.c23
-rw-r--r--drivers/net/xen-netback/netback.c115
-rw-r--r--drivers/ssb/driver_gpio.c12
-rw-r--r--drivers/ssb/main.c9
-rw-r--r--drivers/ssb/ssb_private.h5
-rw-r--r--drivers/vhost/net.c41
-rw-r--r--drivers/vhost/vhost.c18
-rw-r--r--drivers/vhost/vhost.h2
-rw-r--r--include/linux/usb/usbnet.h4
-rw-r--r--include/net/transp_v6.h22
-rw-r--r--net/bluetooth/hci_conn.c6
-rw-r--r--net/bluetooth/smp.c13
-rw-r--r--net/core/pktgen.c9
-rw-r--r--net/core/skbuff.c2
-rw-r--r--net/ipv4/tcp_cong.c14
-rw-r--r--net/ipv4/tcp_input.c8
-rw-r--r--net/ipv4/tcp_ipv4.c6
-rw-r--r--net/ipv6/addrconf.c1
-rw-r--r--net/ipv6/datagram.c16
-rw-r--r--net/ipv6/ip6_flowlabel.c4
-rw-r--r--net/ipv6/ip6_gre.c2
-rw-r--r--net/ipv6/ipv6_sockglue.c6
-rw-r--r--net/ipv6/raw.c6
-rw-r--r--net/ipv6/route.c2
-rw-r--r--net/ipv6/tcp_ipv6.c6
-rw-r--r--net/ipv6/udp.c6
-rw-r--r--net/l2tp/l2tp_core.c82
-rw-r--r--net/l2tp/l2tp_core.h5
-rw-r--r--net/l2tp/l2tp_ip6.c10
-rw-r--r--net/l2tp/l2tp_ppp.c6
-rw-r--r--net/openvswitch/vport-netdev.c16
-rw-r--r--net/packet/af_packet.c10
-rw-r--r--net/sched/sch_netem.c12
-rw-r--r--net/sctp/auth.c2
-rw-r--r--net/sctp/endpointola.c5
-rw-r--r--net/sctp/socket.c2
-rw-r--r--net/sunrpc/svcsock.c2
-rw-r--r--net/wireless/scan.c2
68 files changed, 649 insertions, 348 deletions
diff --git a/drivers/atm/iphase.h b/drivers/atm/iphase.h
index 6a0955e6d4fc..53ecac5a2161 100644
--- a/drivers/atm/iphase.h
+++ b/drivers/atm/iphase.h
@@ -636,82 +636,82 @@ struct rx_buf_desc {
636#define SEG_BASE IPHASE5575_FRAG_CONTROL_REG_BASE 636#define SEG_BASE IPHASE5575_FRAG_CONTROL_REG_BASE
637#define REASS_BASE IPHASE5575_REASS_CONTROL_REG_BASE 637#define REASS_BASE IPHASE5575_REASS_CONTROL_REG_BASE
638 638
639typedef volatile u_int freg_t; 639typedef volatile u_int ffreg_t;
640typedef u_int rreg_t; 640typedef u_int rreg_t;
641 641
642typedef struct _ffredn_t { 642typedef struct _ffredn_t {
643 freg_t idlehead_high; /* Idle cell header (high) */ 643 ffreg_t idlehead_high; /* Idle cell header (high) */
644 freg_t idlehead_low; /* Idle cell header (low) */ 644 ffreg_t idlehead_low; /* Idle cell header (low) */
645 freg_t maxrate; /* Maximum rate */ 645 ffreg_t maxrate; /* Maximum rate */
646 freg_t stparms; /* Traffic Management Parameters */ 646 ffreg_t stparms; /* Traffic Management Parameters */
647 freg_t abrubr_abr; /* ABRUBR Priority Byte 1, TCR Byte 0 */ 647 ffreg_t abrubr_abr; /* ABRUBR Priority Byte 1, TCR Byte 0 */
648 freg_t rm_type; /* */ 648 ffreg_t rm_type; /* */
649 u_int filler5[0x17 - 0x06]; 649 u_int filler5[0x17 - 0x06];
650 freg_t cmd_reg; /* Command register */ 650 ffreg_t cmd_reg; /* Command register */
651 u_int filler18[0x20 - 0x18]; 651 u_int filler18[0x20 - 0x18];
652 freg_t cbr_base; /* CBR Pointer Base */ 652 ffreg_t cbr_base; /* CBR Pointer Base */
653 freg_t vbr_base; /* VBR Pointer Base */ 653 ffreg_t vbr_base; /* VBR Pointer Base */
654 freg_t abr_base; /* ABR Pointer Base */ 654 ffreg_t abr_base; /* ABR Pointer Base */
655 freg_t ubr_base; /* UBR Pointer Base */ 655 ffreg_t ubr_base; /* UBR Pointer Base */
656 u_int filler24; 656 u_int filler24;
657 freg_t vbrwq_base; /* VBR Wait Queue Base */ 657 ffreg_t vbrwq_base; /* VBR Wait Queue Base */
658 freg_t abrwq_base; /* ABR Wait Queue Base */ 658 ffreg_t abrwq_base; /* ABR Wait Queue Base */
659 freg_t ubrwq_base; /* UBR Wait Queue Base */ 659 ffreg_t ubrwq_base; /* UBR Wait Queue Base */
660 freg_t vct_base; /* Main VC Table Base */ 660 ffreg_t vct_base; /* Main VC Table Base */
661 freg_t vcte_base; /* Extended Main VC Table Base */ 661 ffreg_t vcte_base; /* Extended Main VC Table Base */
662 u_int filler2a[0x2C - 0x2A]; 662 u_int filler2a[0x2C - 0x2A];
663 freg_t cbr_tab_beg; /* CBR Table Begin */ 663 ffreg_t cbr_tab_beg; /* CBR Table Begin */
664 freg_t cbr_tab_end; /* CBR Table End */ 664 ffreg_t cbr_tab_end; /* CBR Table End */
665 freg_t cbr_pointer; /* CBR Pointer */ 665 ffreg_t cbr_pointer; /* CBR Pointer */
666 u_int filler2f[0x30 - 0x2F]; 666 u_int filler2f[0x30 - 0x2F];
667 freg_t prq_st_adr; /* Packet Ready Queue Start Address */ 667 ffreg_t prq_st_adr; /* Packet Ready Queue Start Address */
668 freg_t prq_ed_adr; /* Packet Ready Queue End Address */ 668 ffreg_t prq_ed_adr; /* Packet Ready Queue End Address */
669 freg_t prq_rd_ptr; /* Packet Ready Queue read pointer */ 669 ffreg_t prq_rd_ptr; /* Packet Ready Queue read pointer */
670 freg_t prq_wr_ptr; /* Packet Ready Queue write pointer */ 670 ffreg_t prq_wr_ptr; /* Packet Ready Queue write pointer */
671 freg_t tcq_st_adr; /* Transmit Complete Queue Start Address*/ 671 ffreg_t tcq_st_adr; /* Transmit Complete Queue Start Address*/
672 freg_t tcq_ed_adr; /* Transmit Complete Queue End Address */ 672 ffreg_t tcq_ed_adr; /* Transmit Complete Queue End Address */
673 freg_t tcq_rd_ptr; /* Transmit Complete Queue read pointer */ 673 ffreg_t tcq_rd_ptr; /* Transmit Complete Queue read pointer */
674 freg_t tcq_wr_ptr; /* Transmit Complete Queue write pointer*/ 674 ffreg_t tcq_wr_ptr; /* Transmit Complete Queue write pointer*/
675 u_int filler38[0x40 - 0x38]; 675 u_int filler38[0x40 - 0x38];
676 freg_t queue_base; /* Base address for PRQ and TCQ */ 676 ffreg_t queue_base; /* Base address for PRQ and TCQ */
677 freg_t desc_base; /* Base address of descriptor table */ 677 ffreg_t desc_base; /* Base address of descriptor table */
678 u_int filler42[0x45 - 0x42]; 678 u_int filler42[0x45 - 0x42];
679 freg_t mode_reg_0; /* Mode register 0 */ 679 ffreg_t mode_reg_0; /* Mode register 0 */
680 freg_t mode_reg_1; /* Mode register 1 */ 680 ffreg_t mode_reg_1; /* Mode register 1 */
681 freg_t intr_status_reg;/* Interrupt Status register */ 681 ffreg_t intr_status_reg;/* Interrupt Status register */
682 freg_t mask_reg; /* Mask Register */ 682 ffreg_t mask_reg; /* Mask Register */
683 freg_t cell_ctr_high1; /* Total cell transfer count (high) */ 683 ffreg_t cell_ctr_high1; /* Total cell transfer count (high) */
684 freg_t cell_ctr_lo1; /* Total cell transfer count (low) */ 684 ffreg_t cell_ctr_lo1; /* Total cell transfer count (low) */
685 freg_t state_reg; /* Status register */ 685 ffreg_t state_reg; /* Status register */
686 u_int filler4c[0x58 - 0x4c]; 686 u_int filler4c[0x58 - 0x4c];
687 freg_t curr_desc_num; /* Contains the current descriptor num */ 687 ffreg_t curr_desc_num; /* Contains the current descriptor num */
688 freg_t next_desc; /* Next descriptor */ 688 ffreg_t next_desc; /* Next descriptor */
689 freg_t next_vc; /* Next VC */ 689 ffreg_t next_vc; /* Next VC */
690 u_int filler5b[0x5d - 0x5b]; 690 u_int filler5b[0x5d - 0x5b];
691 freg_t present_slot_cnt;/* Present slot count */ 691 ffreg_t present_slot_cnt;/* Present slot count */
692 u_int filler5e[0x6a - 0x5e]; 692 u_int filler5e[0x6a - 0x5e];
693 freg_t new_desc_num; /* New descriptor number */ 693 ffreg_t new_desc_num; /* New descriptor number */
694 freg_t new_vc; /* New VC */ 694 ffreg_t new_vc; /* New VC */
695 freg_t sched_tbl_ptr; /* Schedule table pointer */ 695 ffreg_t sched_tbl_ptr; /* Schedule table pointer */
696 freg_t vbrwq_wptr; /* VBR wait queue write pointer */ 696 ffreg_t vbrwq_wptr; /* VBR wait queue write pointer */
697 freg_t vbrwq_rptr; /* VBR wait queue read pointer */ 697 ffreg_t vbrwq_rptr; /* VBR wait queue read pointer */
698 freg_t abrwq_wptr; /* ABR wait queue write pointer */ 698 ffreg_t abrwq_wptr; /* ABR wait queue write pointer */
699 freg_t abrwq_rptr; /* ABR wait queue read pointer */ 699 ffreg_t abrwq_rptr; /* ABR wait queue read pointer */
700 freg_t ubrwq_wptr; /* UBR wait queue write pointer */ 700 ffreg_t ubrwq_wptr; /* UBR wait queue write pointer */
701 freg_t ubrwq_rptr; /* UBR wait queue read pointer */ 701 ffreg_t ubrwq_rptr; /* UBR wait queue read pointer */
702 freg_t cbr_vc; /* CBR VC */ 702 ffreg_t cbr_vc; /* CBR VC */
703 freg_t vbr_sb_vc; /* VBR SB VC */ 703 ffreg_t vbr_sb_vc; /* VBR SB VC */
704 freg_t abr_sb_vc; /* ABR SB VC */ 704 ffreg_t abr_sb_vc; /* ABR SB VC */
705 freg_t ubr_sb_vc; /* UBR SB VC */ 705 ffreg_t ubr_sb_vc; /* UBR SB VC */
706 freg_t vbr_next_link; /* VBR next link */ 706 ffreg_t vbr_next_link; /* VBR next link */
707 freg_t abr_next_link; /* ABR next link */ 707 ffreg_t abr_next_link; /* ABR next link */
708 freg_t ubr_next_link; /* UBR next link */ 708 ffreg_t ubr_next_link; /* UBR next link */
709 u_int filler7a[0x7c-0x7a]; 709 u_int filler7a[0x7c-0x7a];
710 freg_t out_rate_head; /* Out of rate head */ 710 ffreg_t out_rate_head; /* Out of rate head */
711 u_int filler7d[0xca-0x7d]; /* pad out to full address space */ 711 u_int filler7d[0xca-0x7d]; /* pad out to full address space */
712 freg_t cell_ctr_high1_nc;/* Total cell transfer count (high) */ 712 ffreg_t cell_ctr_high1_nc;/* Total cell transfer count (high) */
713 freg_t cell_ctr_lo1_nc;/* Total cell transfer count (low) */ 713 ffreg_t cell_ctr_lo1_nc;/* Total cell transfer count (low) */
714 u_int fillercc[0x100-0xcc]; /* pad out to full address space */ 714 u_int fillercc[0x100-0xcc]; /* pad out to full address space */
715} ffredn_t; 715} ffredn_t;
716 716
717typedef struct _rfredn_t { 717typedef struct _rfredn_t {
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index 19e3fbfd5757..cb0c45488572 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -94,11 +94,16 @@ void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
94#ifdef CONFIG_BCMA_DRIVER_GPIO 94#ifdef CONFIG_BCMA_DRIVER_GPIO
95/* driver_gpio.c */ 95/* driver_gpio.c */
96int bcma_gpio_init(struct bcma_drv_cc *cc); 96int bcma_gpio_init(struct bcma_drv_cc *cc);
97int bcma_gpio_unregister(struct bcma_drv_cc *cc);
97#else 98#else
98static inline int bcma_gpio_init(struct bcma_drv_cc *cc) 99static inline int bcma_gpio_init(struct bcma_drv_cc *cc)
99{ 100{
100 return -ENOTSUPP; 101 return -ENOTSUPP;
101} 102}
103static inline int bcma_gpio_unregister(struct bcma_drv_cc *cc)
104{
105 return 0;
106}
102#endif /* CONFIG_BCMA_DRIVER_GPIO */ 107#endif /* CONFIG_BCMA_DRIVER_GPIO */
103 108
104#endif 109#endif
diff --git a/drivers/bcma/driver_chipcommon_nflash.c b/drivers/bcma/driver_chipcommon_nflash.c
index dbda91e4dff5..1f0b83e18f68 100644
--- a/drivers/bcma/driver_chipcommon_nflash.c
+++ b/drivers/bcma/driver_chipcommon_nflash.c
@@ -21,7 +21,7 @@ int bcma_nflash_init(struct bcma_drv_cc *cc)
21 struct bcma_bus *bus = cc->core->bus; 21 struct bcma_bus *bus = cc->core->bus;
22 22
23 if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4706 && 23 if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4706 &&
24 cc->core->id.rev != 0x38) { 24 cc->core->id.rev != 38) {
25 bcma_err(bus, "NAND flash on unsupported board!\n"); 25 bcma_err(bus, "NAND flash on unsupported board!\n");
26 return -ENOTSUPP; 26 return -ENOTSUPP;
27 } 27 }
diff --git a/drivers/bcma/driver_gpio.c b/drivers/bcma/driver_gpio.c
index 9a6f585da2d9..71f755c06fc6 100644
--- a/drivers/bcma/driver_gpio.c
+++ b/drivers/bcma/driver_gpio.c
@@ -96,3 +96,8 @@ int bcma_gpio_init(struct bcma_drv_cc *cc)
96 96
97 return gpiochip_add(chip); 97 return gpiochip_add(chip);
98} 98}
99
100int bcma_gpio_unregister(struct bcma_drv_cc *cc)
101{
102 return gpiochip_remove(&cc->gpio);
103}
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 4a92f647b58b..324f9debda88 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -268,6 +268,13 @@ int bcma_bus_register(struct bcma_bus *bus)
268void bcma_bus_unregister(struct bcma_bus *bus) 268void bcma_bus_unregister(struct bcma_bus *bus)
269{ 269{
270 struct bcma_device *cores[3]; 270 struct bcma_device *cores[3];
271 int err;
272
273 err = bcma_gpio_unregister(&bus->drv_cc);
274 if (err == -EBUSY)
275 bcma_err(bus, "Some GPIOs are still in use.\n");
276 else if (err)
277 bcma_err(bus, "Can not unregister GPIO driver: %i\n", err);
271 278
272 cores[0] = bcma_find_core(bus, BCMA_CORE_MIPS_74K); 279 cores[0] = bcma_find_core(bus, BCMA_CORE_MIPS_74K);
273 cores[1] = bcma_find_core(bus, BCMA_CORE_PCIE); 280 cores[1] = bcma_find_core(bus, BCMA_CORE_PCIE);
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 1877ed7ca086..1c9e09fbdff8 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1053,6 +1053,7 @@ static ssize_t bonding_store_primary(struct device *d,
1053 pr_info("%s: Setting primary slave to None.\n", 1053 pr_info("%s: Setting primary slave to None.\n",
1054 bond->dev->name); 1054 bond->dev->name);
1055 bond->primary_slave = NULL; 1055 bond->primary_slave = NULL;
1056 memset(bond->params.primary, 0, sizeof(bond->params.primary));
1056 bond_select_active_slave(bond); 1057 bond_select_active_slave(bond);
1057 goto out; 1058 goto out;
1058 } 1059 }
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 58607f196c9e..2282b1ae9765 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -488,8 +488,12 @@ static void c_can_setup_receive_object(struct net_device *dev, int iface,
488 488
489 priv->write_reg(priv, C_CAN_IFACE(MASK1_REG, iface), 489 priv->write_reg(priv, C_CAN_IFACE(MASK1_REG, iface),
490 IFX_WRITE_LOW_16BIT(mask)); 490 IFX_WRITE_LOW_16BIT(mask));
491
492 /* According to C_CAN documentation, the reserved bit
493 * in IFx_MASK2 register is fixed 1
494 */
491 priv->write_reg(priv, C_CAN_IFACE(MASK2_REG, iface), 495 priv->write_reg(priv, C_CAN_IFACE(MASK2_REG, iface),
492 IFX_WRITE_HIGH_16BIT(mask)); 496 IFX_WRITE_HIGH_16BIT(mask) | BIT(13));
493 497
494 priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface), 498 priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface),
495 IFX_WRITE_LOW_16BIT(id)); 499 IFX_WRITE_LOW_16BIT(id));
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 4eba17b83ba8..f1b3df167ff2 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -36,13 +36,13 @@
36 36
37#define DRV_VER "4.4.161.0u" 37#define DRV_VER "4.4.161.0u"
38#define DRV_NAME "be2net" 38#define DRV_NAME "be2net"
39#define BE_NAME "ServerEngines BladeEngine2 10Gbps NIC" 39#define BE_NAME "Emulex BladeEngine2"
40#define BE3_NAME "ServerEngines BladeEngine3 10Gbps NIC" 40#define BE3_NAME "Emulex BladeEngine3"
41#define OC_NAME "Emulex OneConnect 10Gbps NIC" 41#define OC_NAME "Emulex OneConnect"
42#define OC_NAME_BE OC_NAME "(be3)" 42#define OC_NAME_BE OC_NAME "(be3)"
43#define OC_NAME_LANCER OC_NAME "(Lancer)" 43#define OC_NAME_LANCER OC_NAME "(Lancer)"
44#define OC_NAME_SH OC_NAME "(Skyhawk)" 44#define OC_NAME_SH OC_NAME "(Skyhawk)"
45#define DRV_DESC "ServerEngines BladeEngine 10Gbps NIC Driver" 45#define DRV_DESC "Emulex OneConnect 10Gbps NIC Driver"
46 46
47#define BE_VENDOR_ID 0x19a2 47#define BE_VENDOR_ID 0x19a2
48#define EMULEX_VENDOR_ID 0x10df 48#define EMULEX_VENDOR_ID 0x10df
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 5c995700e534..4d6f3c54427a 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -25,7 +25,7 @@
25MODULE_VERSION(DRV_VER); 25MODULE_VERSION(DRV_VER);
26MODULE_DEVICE_TABLE(pci, be_dev_ids); 26MODULE_DEVICE_TABLE(pci, be_dev_ids);
27MODULE_DESCRIPTION(DRV_DESC " " DRV_VER); 27MODULE_DESCRIPTION(DRV_DESC " " DRV_VER);
28MODULE_AUTHOR("ServerEngines Corporation"); 28MODULE_AUTHOR("Emulex Corporation");
29MODULE_LICENSE("GPL"); 29MODULE_LICENSE("GPL");
30 30
31static unsigned int num_vfs; 31static unsigned int num_vfs;
diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
index 02a12b69555f..4dab6fc265a2 100644
--- a/drivers/net/ethernet/intel/e1000e/defines.h
+++ b/drivers/net/ethernet/intel/e1000e/defines.h
@@ -232,6 +232,7 @@
232#define E1000_CTRL_FRCDPX 0x00001000 /* Force Duplex */ 232#define E1000_CTRL_FRCDPX 0x00001000 /* Force Duplex */
233#define E1000_CTRL_LANPHYPC_OVERRIDE 0x00010000 /* SW control of LANPHYPC */ 233#define E1000_CTRL_LANPHYPC_OVERRIDE 0x00010000 /* SW control of LANPHYPC */
234#define E1000_CTRL_LANPHYPC_VALUE 0x00020000 /* SW value of LANPHYPC */ 234#define E1000_CTRL_LANPHYPC_VALUE 0x00020000 /* SW value of LANPHYPC */
235#define E1000_CTRL_MEHE 0x00080000 /* Memory Error Handling Enable */
235#define E1000_CTRL_SWDPIN0 0x00040000 /* SWDPIN 0 value */ 236#define E1000_CTRL_SWDPIN0 0x00040000 /* SWDPIN 0 value */
236#define E1000_CTRL_SWDPIN1 0x00080000 /* SWDPIN 1 value */ 237#define E1000_CTRL_SWDPIN1 0x00080000 /* SWDPIN 1 value */
237#define E1000_CTRL_SWDPIO0 0x00400000 /* SWDPIN 0 Input or output */ 238#define E1000_CTRL_SWDPIO0 0x00400000 /* SWDPIN 0 Input or output */
@@ -389,6 +390,12 @@
389 390
390#define E1000_PBS_16K E1000_PBA_16K 391#define E1000_PBS_16K E1000_PBA_16K
391 392
393/* Uncorrectable/correctable ECC Error counts and enable bits */
394#define E1000_PBECCSTS_CORR_ERR_CNT_MASK 0x000000FF
395#define E1000_PBECCSTS_UNCORR_ERR_CNT_MASK 0x0000FF00
396#define E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT 8
397#define E1000_PBECCSTS_ECC_ENABLE 0x00010000
398
392#define IFS_MAX 80 399#define IFS_MAX 80
393#define IFS_MIN 40 400#define IFS_MIN 40
394#define IFS_RATIO 4 401#define IFS_RATIO 4
@@ -408,6 +415,7 @@
408#define E1000_ICR_RXSEQ 0x00000008 /* Rx sequence error */ 415#define E1000_ICR_RXSEQ 0x00000008 /* Rx sequence error */
409#define E1000_ICR_RXDMT0 0x00000010 /* Rx desc min. threshold (0) */ 416#define E1000_ICR_RXDMT0 0x00000010 /* Rx desc min. threshold (0) */
410#define E1000_ICR_RXT0 0x00000080 /* Rx timer intr (ring 0) */ 417#define E1000_ICR_RXT0 0x00000080 /* Rx timer intr (ring 0) */
418#define E1000_ICR_ECCER 0x00400000 /* Uncorrectable ECC Error */
411#define E1000_ICR_INT_ASSERTED 0x80000000 /* If this bit asserted, the driver should claim the interrupt */ 419#define E1000_ICR_INT_ASSERTED 0x80000000 /* If this bit asserted, the driver should claim the interrupt */
412#define E1000_ICR_RXQ0 0x00100000 /* Rx Queue 0 Interrupt */ 420#define E1000_ICR_RXQ0 0x00100000 /* Rx Queue 0 Interrupt */
413#define E1000_ICR_RXQ1 0x00200000 /* Rx Queue 1 Interrupt */ 421#define E1000_ICR_RXQ1 0x00200000 /* Rx Queue 1 Interrupt */
@@ -443,6 +451,7 @@
443#define E1000_IMS_RXSEQ E1000_ICR_RXSEQ /* Rx sequence error */ 451#define E1000_IMS_RXSEQ E1000_ICR_RXSEQ /* Rx sequence error */
444#define E1000_IMS_RXDMT0 E1000_ICR_RXDMT0 /* Rx desc min. threshold */ 452#define E1000_IMS_RXDMT0 E1000_ICR_RXDMT0 /* Rx desc min. threshold */
445#define E1000_IMS_RXT0 E1000_ICR_RXT0 /* Rx timer intr */ 453#define E1000_IMS_RXT0 E1000_ICR_RXT0 /* Rx timer intr */
454#define E1000_IMS_ECCER E1000_ICR_ECCER /* Uncorrectable ECC Error */
446#define E1000_IMS_RXQ0 E1000_ICR_RXQ0 /* Rx Queue 0 Interrupt */ 455#define E1000_IMS_RXQ0 E1000_ICR_RXQ0 /* Rx Queue 0 Interrupt */
447#define E1000_IMS_RXQ1 E1000_ICR_RXQ1 /* Rx Queue 1 Interrupt */ 456#define E1000_IMS_RXQ1 E1000_ICR_RXQ1 /* Rx Queue 1 Interrupt */
448#define E1000_IMS_TXQ0 E1000_ICR_TXQ0 /* Tx Queue 0 Interrupt */ 457#define E1000_IMS_TXQ0 E1000_ICR_TXQ0 /* Tx Queue 0 Interrupt */
diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
index 6782a2eea1bc..7e95f221d60b 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -309,6 +309,8 @@ struct e1000_adapter {
309 309
310 struct napi_struct napi; 310 struct napi_struct napi;
311 311
312 unsigned int uncorr_errors; /* uncorrectable ECC errors */
313 unsigned int corr_errors; /* correctable ECC errors */
312 unsigned int restart_queue; 314 unsigned int restart_queue;
313 u32 txd_cmd; 315 u32 txd_cmd;
314 316
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index f95bc6ee1c22..fd4772a2691c 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -108,6 +108,8 @@ static const struct e1000_stats e1000_gstrings_stats[] = {
108 E1000_STAT("dropped_smbus", stats.mgpdc), 108 E1000_STAT("dropped_smbus", stats.mgpdc),
109 E1000_STAT("rx_dma_failed", rx_dma_failed), 109 E1000_STAT("rx_dma_failed", rx_dma_failed),
110 E1000_STAT("tx_dma_failed", tx_dma_failed), 110 E1000_STAT("tx_dma_failed", tx_dma_failed),
111 E1000_STAT("uncorr_ecc_errors", uncorr_errors),
112 E1000_STAT("corr_ecc_errors", corr_errors),
111}; 113};
112 114
113#define E1000_GLOBAL_STATS_LEN ARRAY_SIZE(e1000_gstrings_stats) 115#define E1000_GLOBAL_STATS_LEN ARRAY_SIZE(e1000_gstrings_stats)
diff --git a/drivers/net/ethernet/intel/e1000e/hw.h b/drivers/net/ethernet/intel/e1000e/hw.h
index cf217777586c..b88676ff3d86 100644
--- a/drivers/net/ethernet/intel/e1000e/hw.h
+++ b/drivers/net/ethernet/intel/e1000e/hw.h
@@ -77,6 +77,7 @@ enum e1e_registers {
77#define E1000_POEMB E1000_PHY_CTRL /* PHY OEM Bits */ 77#define E1000_POEMB E1000_PHY_CTRL /* PHY OEM Bits */
78 E1000_PBA = 0x01000, /* Packet Buffer Allocation - RW */ 78 E1000_PBA = 0x01000, /* Packet Buffer Allocation - RW */
79 E1000_PBS = 0x01008, /* Packet Buffer Size */ 79 E1000_PBS = 0x01008, /* Packet Buffer Size */
80 E1000_PBECCSTS = 0x0100C, /* Packet Buffer ECC Status - RW */
80 E1000_EEMNGCTL = 0x01010, /* MNG EEprom Control */ 81 E1000_EEMNGCTL = 0x01010, /* MNG EEprom Control */
81 E1000_EEWR = 0x0102C, /* EEPROM Write Register - RW */ 82 E1000_EEWR = 0x0102C, /* EEPROM Write Register - RW */
82 E1000_FLOP = 0x0103C, /* FLASH Opcode Register */ 83 E1000_FLOP = 0x0103C, /* FLASH Opcode Register */
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 976336547607..24d9f61956f0 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -3624,6 +3624,17 @@ static void e1000_initialize_hw_bits_ich8lan(struct e1000_hw *hw)
3624 if (hw->mac.type == e1000_ich8lan) 3624 if (hw->mac.type == e1000_ich8lan)
3625 reg |= (E1000_RFCTL_IPV6_EX_DIS | E1000_RFCTL_NEW_IPV6_EXT_DIS); 3625 reg |= (E1000_RFCTL_IPV6_EX_DIS | E1000_RFCTL_NEW_IPV6_EXT_DIS);
3626 ew32(RFCTL, reg); 3626 ew32(RFCTL, reg);
3627
3628 /* Enable ECC on Lynxpoint */
3629 if (hw->mac.type == e1000_pch_lpt) {
3630 reg = er32(PBECCSTS);
3631 reg |= E1000_PBECCSTS_ECC_ENABLE;
3632 ew32(PBECCSTS, reg);
3633
3634 reg = er32(CTRL);
3635 reg |= E1000_CTRL_MEHE;
3636 ew32(CTRL, reg);
3637 }
3627} 3638}
3628 3639
3629/** 3640/**
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index fbf75fdca994..643c883dd795 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -1678,6 +1678,23 @@ static irqreturn_t e1000_intr_msi(int irq, void *data)
1678 mod_timer(&adapter->watchdog_timer, jiffies + 1); 1678 mod_timer(&adapter->watchdog_timer, jiffies + 1);
1679 } 1679 }
1680 1680
1681 /* Reset on uncorrectable ECC error */
1682 if ((icr & E1000_ICR_ECCER) && (hw->mac.type == e1000_pch_lpt)) {
1683 u32 pbeccsts = er32(PBECCSTS);
1684
1685 adapter->corr_errors +=
1686 pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
1687 adapter->uncorr_errors +=
1688 (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
1689 E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
1690
1691 /* Do the reset outside of interrupt context */
1692 schedule_work(&adapter->reset_task);
1693
1694 /* return immediately since reset is imminent */
1695 return IRQ_HANDLED;
1696 }
1697
1681 if (napi_schedule_prep(&adapter->napi)) { 1698 if (napi_schedule_prep(&adapter->napi)) {
1682 adapter->total_tx_bytes = 0; 1699 adapter->total_tx_bytes = 0;
1683 adapter->total_tx_packets = 0; 1700 adapter->total_tx_packets = 0;
@@ -1741,6 +1758,23 @@ static irqreturn_t e1000_intr(int irq, void *data)
1741 mod_timer(&adapter->watchdog_timer, jiffies + 1); 1758 mod_timer(&adapter->watchdog_timer, jiffies + 1);
1742 } 1759 }
1743 1760
1761 /* Reset on uncorrectable ECC error */
1762 if ((icr & E1000_ICR_ECCER) && (hw->mac.type == e1000_pch_lpt)) {
1763 u32 pbeccsts = er32(PBECCSTS);
1764
1765 adapter->corr_errors +=
1766 pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
1767 adapter->uncorr_errors +=
1768 (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
1769 E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
1770
1771 /* Do the reset outside of interrupt context */
1772 schedule_work(&adapter->reset_task);
1773
1774 /* return immediately since reset is imminent */
1775 return IRQ_HANDLED;
1776 }
1777
1744 if (napi_schedule_prep(&adapter->napi)) { 1778 if (napi_schedule_prep(&adapter->napi)) {
1745 adapter->total_tx_bytes = 0; 1779 adapter->total_tx_bytes = 0;
1746 adapter->total_tx_packets = 0; 1780 adapter->total_tx_packets = 0;
@@ -2104,6 +2138,8 @@ static void e1000_irq_enable(struct e1000_adapter *adapter)
2104 if (adapter->msix_entries) { 2138 if (adapter->msix_entries) {
2105 ew32(EIAC_82574, adapter->eiac_mask & E1000_EIAC_MASK_82574); 2139 ew32(EIAC_82574, adapter->eiac_mask & E1000_EIAC_MASK_82574);
2106 ew32(IMS, adapter->eiac_mask | E1000_IMS_OTHER | E1000_IMS_LSC); 2140 ew32(IMS, adapter->eiac_mask | E1000_IMS_OTHER | E1000_IMS_LSC);
2141 } else if (hw->mac.type == e1000_pch_lpt) {
2142 ew32(IMS, IMS_ENABLE_MASK | E1000_IMS_ECCER);
2107 } else { 2143 } else {
2108 ew32(IMS, IMS_ENABLE_MASK); 2144 ew32(IMS, IMS_ENABLE_MASK);
2109 } 2145 }
@@ -4251,6 +4287,16 @@ static void e1000e_update_stats(struct e1000_adapter *adapter)
4251 adapter->stats.mgptc += er32(MGTPTC); 4287 adapter->stats.mgptc += er32(MGTPTC);
4252 adapter->stats.mgprc += er32(MGTPRC); 4288 adapter->stats.mgprc += er32(MGTPRC);
4253 adapter->stats.mgpdc += er32(MGTPDC); 4289 adapter->stats.mgpdc += er32(MGTPDC);
4290
4291 /* Correctable ECC Errors */
4292 if (hw->mac.type == e1000_pch_lpt) {
4293 u32 pbeccsts = er32(PBECCSTS);
4294 adapter->corr_errors +=
4295 pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
4296 adapter->uncorr_errors +=
4297 (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
4298 E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
4299 }
4254} 4300}
4255 4301
4256/** 4302/**
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index 7992b3e05d3d..78ace59efd29 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -1801,7 +1801,7 @@ static void rhine_tx(struct net_device *dev)
1801 rp->tx_skbuff[entry]->len, 1801 rp->tx_skbuff[entry]->len,
1802 PCI_DMA_TODEVICE); 1802 PCI_DMA_TODEVICE);
1803 } 1803 }
1804 dev_kfree_skb_irq(rp->tx_skbuff[entry]); 1804 dev_kfree_skb(rp->tx_skbuff[entry]);
1805 rp->tx_skbuff[entry] = NULL; 1805 rp->tx_skbuff[entry] = NULL;
1806 entry = (++rp->dirty_tx) % TX_RING_SIZE; 1806 entry = (++rp->dirty_tx) % TX_RING_SIZE;
1807 } 1807 }
@@ -2010,11 +2010,7 @@ static void rhine_slow_event_task(struct work_struct *work)
2010 if (intr_status & IntrPCIErr) 2010 if (intr_status & IntrPCIErr)
2011 netif_warn(rp, hw, dev, "PCI error\n"); 2011 netif_warn(rp, hw, dev, "PCI error\n");
2012 2012
2013 napi_disable(&rp->napi); 2013 iowrite16(RHINE_EVENT & 0xffff, rp->base + IntrEnable);
2014 rhine_irq_disable(rp);
2015 /* Slow and safe. Consider __napi_schedule as a replacement ? */
2016 napi_enable(&rp->napi);
2017 napi_schedule(&rp->napi);
2018 2014
2019out_unlock: 2015out_unlock:
2020 mutex_unlock(&rp->task_lock); 2016 mutex_unlock(&rp->task_lock);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index cc09b67c23bc..2917a86f4c43 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -298,11 +298,12 @@ static void tun_flow_cleanup(unsigned long data)
298} 298}
299 299
300static void tun_flow_update(struct tun_struct *tun, u32 rxhash, 300static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
301 u16 queue_index) 301 struct tun_file *tfile)
302{ 302{
303 struct hlist_head *head; 303 struct hlist_head *head;
304 struct tun_flow_entry *e; 304 struct tun_flow_entry *e;
305 unsigned long delay = tun->ageing_time; 305 unsigned long delay = tun->ageing_time;
306 u16 queue_index = tfile->queue_index;
306 307
307 if (!rxhash) 308 if (!rxhash)
308 return; 309 return;
@@ -311,7 +312,9 @@ static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
311 312
312 rcu_read_lock(); 313 rcu_read_lock();
313 314
314 if (tun->numqueues == 1) 315 /* We may get a very small possibility of OOO during switching, not
316 * worth to optimize.*/
317 if (tun->numqueues == 1 || tfile->detached)
315 goto unlock; 318 goto unlock;
316 319
317 e = tun_flow_find(head, rxhash); 320 e = tun_flow_find(head, rxhash);
@@ -411,21 +414,21 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
411 414
412 tun = rtnl_dereference(tfile->tun); 415 tun = rtnl_dereference(tfile->tun);
413 416
414 if (tun) { 417 if (tun && !tfile->detached) {
415 u16 index = tfile->queue_index; 418 u16 index = tfile->queue_index;
416 BUG_ON(index >= tun->numqueues); 419 BUG_ON(index >= tun->numqueues);
417 dev = tun->dev; 420 dev = tun->dev;
418 421
419 rcu_assign_pointer(tun->tfiles[index], 422 rcu_assign_pointer(tun->tfiles[index],
420 tun->tfiles[tun->numqueues - 1]); 423 tun->tfiles[tun->numqueues - 1]);
421 rcu_assign_pointer(tfile->tun, NULL);
422 ntfile = rtnl_dereference(tun->tfiles[index]); 424 ntfile = rtnl_dereference(tun->tfiles[index]);
423 ntfile->queue_index = index; 425 ntfile->queue_index = index;
424 426
425 --tun->numqueues; 427 --tun->numqueues;
426 if (clean) 428 if (clean) {
429 rcu_assign_pointer(tfile->tun, NULL);
427 sock_put(&tfile->sk); 430 sock_put(&tfile->sk);
428 else 431 } else
429 tun_disable_queue(tun, tfile); 432 tun_disable_queue(tun, tfile);
430 433
431 synchronize_net(); 434 synchronize_net();
@@ -439,10 +442,13 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
439 } 442 }
440 443
441 if (clean) { 444 if (clean) {
442 if (tun && tun->numqueues == 0 && tun->numdisabled == 0 && 445 if (tun && tun->numqueues == 0 && tun->numdisabled == 0) {
443 !(tun->flags & TUN_PERSIST)) 446 netif_carrier_off(tun->dev);
444 if (tun->dev->reg_state == NETREG_REGISTERED) 447
448 if (!(tun->flags & TUN_PERSIST) &&
449 tun->dev->reg_state == NETREG_REGISTERED)
445 unregister_netdevice(tun->dev); 450 unregister_netdevice(tun->dev);
451 }
446 452
447 BUG_ON(!test_bit(SOCK_EXTERNALLY_ALLOCATED, 453 BUG_ON(!test_bit(SOCK_EXTERNALLY_ALLOCATED,
448 &tfile->socket.flags)); 454 &tfile->socket.flags));
@@ -470,6 +476,10 @@ static void tun_detach_all(struct net_device *dev)
470 rcu_assign_pointer(tfile->tun, NULL); 476 rcu_assign_pointer(tfile->tun, NULL);
471 --tun->numqueues; 477 --tun->numqueues;
472 } 478 }
479 list_for_each_entry(tfile, &tun->disabled, next) {
480 wake_up_all(&tfile->wq.wait);
481 rcu_assign_pointer(tfile->tun, NULL);
482 }
473 BUG_ON(tun->numqueues != 0); 483 BUG_ON(tun->numqueues != 0);
474 484
475 synchronize_net(); 485 synchronize_net();
@@ -500,7 +510,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file)
500 goto out; 510 goto out;
501 511
502 err = -EINVAL; 512 err = -EINVAL;
503 if (rtnl_dereference(tfile->tun)) 513 if (rtnl_dereference(tfile->tun) && !tfile->detached)
504 goto out; 514 goto out;
505 515
506 err = -EBUSY; 516 err = -EBUSY;
@@ -1199,7 +1209,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
1199 tun->dev->stats.rx_packets++; 1209 tun->dev->stats.rx_packets++;
1200 tun->dev->stats.rx_bytes += len; 1210 tun->dev->stats.rx_bytes += len;
1201 1211
1202 tun_flow_update(tun, rxhash, tfile->queue_index); 1212 tun_flow_update(tun, rxhash, tfile);
1203 return total_len; 1213 return total_len;
1204} 1214}
1205 1215
@@ -1658,10 +1668,10 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
1658 device_create_file(&tun->dev->dev, &dev_attr_owner) || 1668 device_create_file(&tun->dev->dev, &dev_attr_owner) ||
1659 device_create_file(&tun->dev->dev, &dev_attr_group)) 1669 device_create_file(&tun->dev->dev, &dev_attr_group))
1660 pr_err("Failed to create tun sysfs files\n"); 1670 pr_err("Failed to create tun sysfs files\n");
1661
1662 netif_carrier_on(tun->dev);
1663 } 1671 }
1664 1672
1673 netif_carrier_on(tun->dev);
1674
1665 tun_debug(KERN_INFO, tun, "tun_set_iff\n"); 1675 tun_debug(KERN_INFO, tun, "tun_set_iff\n");
1666 1676
1667 if (ifr->ifr_flags & IFF_NO_PI) 1677 if (ifr->ifr_flags & IFF_NO_PI)
@@ -1813,7 +1823,7 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr)
1813 ret = tun_attach(tun, file); 1823 ret = tun_attach(tun, file);
1814 } else if (ifr->ifr_flags & IFF_DETACH_QUEUE) { 1824 } else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
1815 tun = rtnl_dereference(tfile->tun); 1825 tun = rtnl_dereference(tfile->tun);
1816 if (!tun || !(tun->flags & TUN_TAP_MQ)) 1826 if (!tun || !(tun->flags & TUN_TAP_MQ) || tfile->detached)
1817 ret = -EINVAL; 1827 ret = -EINVAL;
1818 else 1828 else
1819 __tun_detach(tfile, false); 1829 __tun_detach(tfile, false);
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 9197b2c72ca3..00d3b2d37828 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1215,6 +1215,9 @@ static const struct usb_device_id cdc_devs[] = {
1215 { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x46), 1215 { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x46),
1216 .driver_info = (unsigned long)&wwan_info, 1216 .driver_info = (unsigned long)&wwan_info,
1217 }, 1217 },
1218 { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x76),
1219 .driver_info = (unsigned long)&wwan_info,
1220 },
1218 1221
1219 /* Infineon(now Intel) HSPA Modem platform */ 1222 /* Infineon(now Intel) HSPA Modem platform */
1220 { USB_DEVICE_AND_INTERFACE_INFO(0x1519, 0x0443, 1223 { USB_DEVICE_AND_INTERFACE_INFO(0x1519, 0x0443,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 575a5839ee34..c8e05e27f38c 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -351,6 +351,10 @@ static const struct usb_device_id products[] = {
351 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 57), 351 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 57),
352 .driver_info = (unsigned long)&qmi_wwan_info, 352 .driver_info = (unsigned long)&qmi_wwan_info,
353 }, 353 },
354 { /* HUAWEI_INTERFACE_NDIS_CONTROL_QUALCOMM */
355 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x69),
356 .driver_info = (unsigned long)&qmi_wwan_info,
357 },
354 358
355 /* 2. Combined interface devices matching on class+protocol */ 359 /* 2. Combined interface devices matching on class+protocol */
356 { /* Huawei E367 and possibly others in "Windows mode" */ 360 { /* Huawei E367 and possibly others in "Windows mode" */
@@ -361,6 +365,14 @@ static const struct usb_device_id products[] = {
361 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 17), 365 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 17),
362 .driver_info = (unsigned long)&qmi_wwan_info, 366 .driver_info = (unsigned long)&qmi_wwan_info,
363 }, 367 },
368 { /* HUAWEI_NDIS_SINGLE_INTERFACE_VDF */
369 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x37),
370 .driver_info = (unsigned long)&qmi_wwan_info,
371 },
372 { /* HUAWEI_INTERFACE_NDIS_HW_QUALCOMM */
373 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x67),
374 .driver_info = (unsigned long)&qmi_wwan_info,
375 },
364 { /* Pantech UML290, P4200 and more */ 376 { /* Pantech UML290, P4200 and more */
365 USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff), 377 USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
366 .driver_info = (unsigned long)&qmi_wwan_info, 378 .driver_info = (unsigned long)&qmi_wwan_info,
@@ -461,6 +473,7 @@ static const struct usb_device_id products[] = {
461 {QMI_FIXED_INTF(0x1199, 0x901c, 8)}, /* Sierra Wireless EM7700 */ 473 {QMI_FIXED_INTF(0x1199, 0x901c, 8)}, /* Sierra Wireless EM7700 */
462 {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ 474 {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
463 {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ 475 {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
476 {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
464 477
465 /* 4. Gobi 1000 devices */ 478 /* 4. Gobi 1000 devices */
466 {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ 479 {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index f34b2ebee815..5e33606c1366 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -380,6 +380,12 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
380 unsigned long lockflags; 380 unsigned long lockflags;
381 size_t size = dev->rx_urb_size; 381 size_t size = dev->rx_urb_size;
382 382
383 /* prevent rx skb allocation when error ratio is high */
384 if (test_bit(EVENT_RX_KILL, &dev->flags)) {
385 usb_free_urb(urb);
386 return -ENOLINK;
387 }
388
383 skb = __netdev_alloc_skb_ip_align(dev->net, size, flags); 389 skb = __netdev_alloc_skb_ip_align(dev->net, size, flags);
384 if (!skb) { 390 if (!skb) {
385 netif_dbg(dev, rx_err, dev->net, "no rx skb\n"); 391 netif_dbg(dev, rx_err, dev->net, "no rx skb\n");
@@ -539,6 +545,17 @@ block:
539 break; 545 break;
540 } 546 }
541 547
548 /* stop rx if packet error rate is high */
549 if (++dev->pkt_cnt > 30) {
550 dev->pkt_cnt = 0;
551 dev->pkt_err = 0;
552 } else {
553 if (state == rx_cleanup)
554 dev->pkt_err++;
555 if (dev->pkt_err > 20)
556 set_bit(EVENT_RX_KILL, &dev->flags);
557 }
558
542 state = defer_bh(dev, skb, &dev->rxq, state); 559 state = defer_bh(dev, skb, &dev->rxq, state);
543 560
544 if (urb) { 561 if (urb) {
@@ -791,6 +808,11 @@ int usbnet_open (struct net_device *net)
791 (dev->driver_info->flags & FLAG_FRAMING_AX) ? "ASIX" : 808 (dev->driver_info->flags & FLAG_FRAMING_AX) ? "ASIX" :
792 "simple"); 809 "simple");
793 810
811 /* reset rx error state */
812 dev->pkt_cnt = 0;
813 dev->pkt_err = 0;
814 clear_bit(EVENT_RX_KILL, &dev->flags);
815
794 // delay posting reads until we're fully open 816 // delay posting reads until we're fully open
795 tasklet_schedule (&dev->bh); 817 tasklet_schedule (&dev->bh);
796 if (info->manage_power) { 818 if (info->manage_power) {
@@ -1103,13 +1125,11 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
1103 if (info->tx_fixup) { 1125 if (info->tx_fixup) {
1104 skb = info->tx_fixup (dev, skb, GFP_ATOMIC); 1126 skb = info->tx_fixup (dev, skb, GFP_ATOMIC);
1105 if (!skb) { 1127 if (!skb) {
1106 if (netif_msg_tx_err(dev)) { 1128 /* packet collected; minidriver waiting for more */
1107 netif_dbg(dev, tx_err, dev->net, "can't tx_fixup skb\n"); 1129 if (info->flags & FLAG_MULTI_PACKET)
1108 goto drop;
1109 } else {
1110 /* cdc_ncm collected packet; waits for more */
1111 goto not_drop; 1130 goto not_drop;
1112 } 1131 netif_dbg(dev, tx_err, dev->net, "can't tx_fixup skb\n");
1132 goto drop;
1113 } 1133 }
1114 } 1134 }
1115 length = skb->len; 1135 length = skb->len;
@@ -1254,6 +1274,9 @@ static void usbnet_bh (unsigned long param)
1254 } 1274 }
1255 } 1275 }
1256 1276
1277 /* restart RX again after disabling due to high error rate */
1278 clear_bit(EVENT_RX_KILL, &dev->flags);
1279
1257 // waiting for all pending urbs to complete? 1280 // waiting for all pending urbs to complete?
1258 if (dev->wait) { 1281 if (dev->wait) {
1259 if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) { 1282 if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index dc8913c6238c..12c6440d1649 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -154,8 +154,7 @@ vmxnet3_check_link(struct vmxnet3_adapter *adapter, bool affectTxQueue)
154 if (ret & 1) { /* Link is up. */ 154 if (ret & 1) { /* Link is up. */
155 printk(KERN_INFO "%s: NIC Link is Up %d Mbps\n", 155 printk(KERN_INFO "%s: NIC Link is Up %d Mbps\n",
156 adapter->netdev->name, adapter->link_speed); 156 adapter->netdev->name, adapter->link_speed);
157 if (!netif_carrier_ok(adapter->netdev)) 157 netif_carrier_on(adapter->netdev);
158 netif_carrier_on(adapter->netdev);
159 158
160 if (affectTxQueue) { 159 if (affectTxQueue) {
161 for (i = 0; i < adapter->num_tx_queues; i++) 160 for (i = 0; i < adapter->num_tx_queues; i++)
@@ -165,8 +164,7 @@ vmxnet3_check_link(struct vmxnet3_adapter *adapter, bool affectTxQueue)
165 } else { 164 } else {
166 printk(KERN_INFO "%s: NIC Link is Down\n", 165 printk(KERN_INFO "%s: NIC Link is Down\n",
167 adapter->netdev->name); 166 adapter->netdev->name);
168 if (netif_carrier_ok(adapter->netdev)) 167 netif_carrier_off(adapter->netdev);
169 netif_carrier_off(adapter->netdev);
170 168
171 if (affectTxQueue) { 169 if (affectTxQueue) {
172 for (i = 0; i < adapter->num_tx_queues; i++) 170 for (i = 0; i < adapter->num_tx_queues; i++)
@@ -3061,6 +3059,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
3061 netif_set_real_num_tx_queues(adapter->netdev, adapter->num_tx_queues); 3059 netif_set_real_num_tx_queues(adapter->netdev, adapter->num_tx_queues);
3062 netif_set_real_num_rx_queues(adapter->netdev, adapter->num_rx_queues); 3060 netif_set_real_num_rx_queues(adapter->netdev, adapter->num_rx_queues);
3063 3061
3062 netif_carrier_off(netdev);
3064 err = register_netdev(netdev); 3063 err = register_netdev(netdev);
3065 3064
3066 if (err) { 3065 if (err) {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 0f71d1d4339d..e5fd20994bec 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -36,6 +36,7 @@
36#include "debug.h" 36#include "debug.h"
37 37
38#define N_TX_QUEUES 4 /* #tx queues on mac80211<->driver interface */ 38#define N_TX_QUEUES 4 /* #tx queues on mac80211<->driver interface */
39#define BRCMS_FLUSH_TIMEOUT 500 /* msec */
39 40
40/* Flags we support */ 41/* Flags we support */
41#define MAC_FILTERS (FIF_PROMISC_IN_BSS | \ 42#define MAC_FILTERS (FIF_PROMISC_IN_BSS | \
@@ -708,16 +709,29 @@ static void brcms_ops_rfkill_poll(struct ieee80211_hw *hw)
708 wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, blocked); 709 wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, blocked);
709} 710}
710 711
712static bool brcms_tx_flush_completed(struct brcms_info *wl)
713{
714 bool result;
715
716 spin_lock_bh(&wl->lock);
717 result = brcms_c_tx_flush_completed(wl->wlc);
718 spin_unlock_bh(&wl->lock);
719 return result;
720}
721
711static void brcms_ops_flush(struct ieee80211_hw *hw, bool drop) 722static void brcms_ops_flush(struct ieee80211_hw *hw, bool drop)
712{ 723{
713 struct brcms_info *wl = hw->priv; 724 struct brcms_info *wl = hw->priv;
725 int ret;
714 726
715 no_printk("%s: drop = %s\n", __func__, drop ? "true" : "false"); 727 no_printk("%s: drop = %s\n", __func__, drop ? "true" : "false");
716 728
717 /* wait for packet queue and dma fifos to run empty */ 729 ret = wait_event_timeout(wl->tx_flush_wq,
718 spin_lock_bh(&wl->lock); 730 brcms_tx_flush_completed(wl),
719 brcms_c_wait_for_tx_completion(wl->wlc, drop); 731 msecs_to_jiffies(BRCMS_FLUSH_TIMEOUT));
720 spin_unlock_bh(&wl->lock); 732
733 brcms_dbg_mac80211(wl->wlc->hw->d11core,
734 "ret=%d\n", jiffies_to_msecs(ret));
721} 735}
722 736
723static const struct ieee80211_ops brcms_ops = { 737static const struct ieee80211_ops brcms_ops = {
@@ -772,6 +786,7 @@ void brcms_dpc(unsigned long data)
772 786
773 done: 787 done:
774 spin_unlock_bh(&wl->lock); 788 spin_unlock_bh(&wl->lock);
789 wake_up(&wl->tx_flush_wq);
775} 790}
776 791
777/* 792/*
@@ -1020,6 +1035,8 @@ static struct brcms_info *brcms_attach(struct bcma_device *pdev)
1020 1035
1021 atomic_set(&wl->callbacks, 0); 1036 atomic_set(&wl->callbacks, 0);
1022 1037
1038 init_waitqueue_head(&wl->tx_flush_wq);
1039
1023 /* setup the bottom half handler */ 1040 /* setup the bottom half handler */
1024 tasklet_init(&wl->tasklet, brcms_dpc, (unsigned long) wl); 1041 tasklet_init(&wl->tasklet, brcms_dpc, (unsigned long) wl);
1025 1042
@@ -1609,13 +1626,3 @@ bool brcms_rfkill_set_hw_state(struct brcms_info *wl)
1609 spin_lock_bh(&wl->lock); 1626 spin_lock_bh(&wl->lock);
1610 return blocked; 1627 return blocked;
1611} 1628}
1612
1613/*
1614 * precondition: perimeter lock has been acquired
1615 */
1616void brcms_msleep(struct brcms_info *wl, uint ms)
1617{
1618 spin_unlock_bh(&wl->lock);
1619 msleep(ms);
1620 spin_lock_bh(&wl->lock);
1621}
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
index 9358bd5ebd35..947ccacf43e6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
@@ -68,6 +68,8 @@ struct brcms_info {
68 spinlock_t lock; /* per-device perimeter lock */ 68 spinlock_t lock; /* per-device perimeter lock */
69 spinlock_t isr_lock; /* per-device ISR synchronization lock */ 69 spinlock_t isr_lock; /* per-device ISR synchronization lock */
70 70
71 /* tx flush */
72 wait_queue_head_t tx_flush_wq;
71 73
72 /* timer related fields */ 74 /* timer related fields */
73 atomic_t callbacks; /* # outstanding callback functions */ 75 atomic_t callbacks; /* # outstanding callback functions */
@@ -100,7 +102,6 @@ extern struct brcms_timer *brcms_init_timer(struct brcms_info *wl,
100extern void brcms_free_timer(struct brcms_timer *timer); 102extern void brcms_free_timer(struct brcms_timer *timer);
101extern void brcms_add_timer(struct brcms_timer *timer, uint ms, int periodic); 103extern void brcms_add_timer(struct brcms_timer *timer, uint ms, int periodic);
102extern bool brcms_del_timer(struct brcms_timer *timer); 104extern bool brcms_del_timer(struct brcms_timer *timer);
103extern void brcms_msleep(struct brcms_info *wl, uint ms);
104extern void brcms_dpc(unsigned long data); 105extern void brcms_dpc(unsigned long data);
105extern void brcms_timer(struct brcms_timer *t); 106extern void brcms_timer(struct brcms_timer *t);
106extern void brcms_fatal_error(struct brcms_info *wl); 107extern void brcms_fatal_error(struct brcms_info *wl);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 17594de4199e..8b5839008af3 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -1027,7 +1027,6 @@ brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
1027static bool 1027static bool
1028brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal) 1028brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
1029{ 1029{
1030 bool morepending = false;
1031 struct bcma_device *core; 1030 struct bcma_device *core;
1032 struct tx_status txstatus, *txs; 1031 struct tx_status txstatus, *txs;
1033 u32 s1, s2; 1032 u32 s1, s2;
@@ -1041,23 +1040,20 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
1041 txs = &txstatus; 1040 txs = &txstatus;
1042 core = wlc_hw->d11core; 1041 core = wlc_hw->d11core;
1043 *fatal = false; 1042 *fatal = false;
1044 s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
1045 while (!(*fatal)
1046 && (s1 & TXS_V)) {
1047 /* !give others some time to run! */
1048 if (n >= max_tx_num) {
1049 morepending = true;
1050 break;
1051 }
1052 1043
1044 while (n < max_tx_num) {
1045 s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
1053 if (s1 == 0xffffffff) { 1046 if (s1 == 0xffffffff) {
1054 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit, 1047 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
1055 __func__); 1048 __func__);
1056 *fatal = true; 1049 *fatal = true;
1057 return false; 1050 return false;
1058 } 1051 }
1059 s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2)); 1052 /* only process when valid */
1053 if (!(s1 & TXS_V))
1054 break;
1060 1055
1056 s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
1061 txs->status = s1 & TXS_STATUS_MASK; 1057 txs->status = s1 & TXS_STATUS_MASK;
1062 txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT; 1058 txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
1063 txs->sequence = s2 & TXS_SEQ_MASK; 1059 txs->sequence = s2 & TXS_SEQ_MASK;
@@ -1065,15 +1061,12 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
1065 txs->lasttxtime = 0; 1061 txs->lasttxtime = 0;
1066 1062
1067 *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs); 1063 *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
1068 1064 if (*fatal == true)
1069 s1 = bcma_read32(core, D11REGOFFS(frmtxstatus)); 1065 return false;
1070 n++; 1066 n++;
1071 } 1067 }
1072 1068
1073 if (*fatal) 1069 return n >= max_tx_num;
1074 return false;
1075
1076 return morepending;
1077} 1070}
1078 1071
1079static void brcms_c_tbtt(struct brcms_c_info *wlc) 1072static void brcms_c_tbtt(struct brcms_c_info *wlc)
@@ -7518,25 +7511,16 @@ int brcms_c_get_curband(struct brcms_c_info *wlc)
7518 return wlc->band->bandunit; 7511 return wlc->band->bandunit;
7519} 7512}
7520 7513
7521void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop) 7514bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
7522{ 7515{
7523 int timeout = 20;
7524 int i; 7516 int i;
7525 7517
7526 /* Kick DMA to send any pending AMPDU */ 7518 /* Kick DMA to send any pending AMPDU */
7527 for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++) 7519 for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
7528 if (wlc->hw->di[i]) 7520 if (wlc->hw->di[i])
7529 dma_txflush(wlc->hw->di[i]); 7521 dma_kick_tx(wlc->hw->di[i]);
7530
7531 /* wait for queue and DMA fifos to run dry */
7532 while (brcms_txpktpendtot(wlc) > 0) {
7533 brcms_msleep(wlc->wl, 1);
7534
7535 if (--timeout == 0)
7536 break;
7537 }
7538 7522
7539 WARN_ON_ONCE(timeout == 0); 7523 return !brcms_txpktpendtot(wlc);
7540} 7524}
7541 7525
7542void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval) 7526void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pub.h b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
index 4fb2834f4e64..b0f14b7b8616 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
@@ -314,8 +314,6 @@ extern void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state);
314extern void brcms_c_scan_start(struct brcms_c_info *wlc); 314extern void brcms_c_scan_start(struct brcms_c_info *wlc);
315extern void brcms_c_scan_stop(struct brcms_c_info *wlc); 315extern void brcms_c_scan_stop(struct brcms_c_info *wlc);
316extern int brcms_c_get_curband(struct brcms_c_info *wlc); 316extern int brcms_c_get_curband(struct brcms_c_info *wlc);
317extern void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc,
318 bool drop);
319extern int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel); 317extern int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel);
320extern int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl); 318extern int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl);
321extern void brcms_c_get_current_rateset(struct brcms_c_info *wlc, 319extern void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
@@ -332,5 +330,6 @@ extern int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr);
332extern int brcms_c_get_tx_power(struct brcms_c_info *wlc); 330extern int brcms_c_get_tx_power(struct brcms_c_info *wlc);
333extern bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc); 331extern bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc);
334extern void brcms_c_mute(struct brcms_c_info *wlc, bool on); 332extern void brcms_c_mute(struct brcms_c_info *wlc, bool on);
333extern bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
335 334
336#endif /* _BRCM_PUB_H_ */ 335#endif /* _BRCM_PUB_H_ */
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 31534f7c0548..279796419ea0 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1153,6 +1153,13 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
1153 next_reclaimed = ssn; 1153 next_reclaimed = ssn;
1154 } 1154 }
1155 1155
1156 if (tid != IWL_TID_NON_QOS) {
1157 priv->tid_data[sta_id][tid].next_reclaimed =
1158 next_reclaimed;
1159 IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
1160 next_reclaimed);
1161 }
1162
1156 iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs); 1163 iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
1157 1164
1158 iwlagn_check_ratid_empty(priv, sta_id, tid); 1165 iwlagn_check_ratid_empty(priv, sta_id, tid);
@@ -1203,28 +1210,11 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
1203 if (!is_agg) 1210 if (!is_agg)
1204 iwlagn_non_agg_tx_status(priv, ctx, hdr->addr1); 1211 iwlagn_non_agg_tx_status(priv, ctx, hdr->addr1);
1205 1212
1206 /*
1207 * W/A for FW bug - the seq_ctl isn't updated when the
1208 * queues are flushed. Fetch it from the packet itself
1209 */
1210 if (!is_agg && status == TX_STATUS_FAIL_FIFO_FLUSHED) {
1211 next_reclaimed = le16_to_cpu(hdr->seq_ctrl);
1212 next_reclaimed =
1213 SEQ_TO_SN(next_reclaimed + 0x10);
1214 }
1215
1216 is_offchannel_skb = 1213 is_offchannel_skb =
1217 (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN); 1214 (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN);
1218 freed++; 1215 freed++;
1219 } 1216 }
1220 1217
1221 if (tid != IWL_TID_NON_QOS) {
1222 priv->tid_data[sta_id][tid].next_reclaimed =
1223 next_reclaimed;
1224 IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
1225 next_reclaimed);
1226 }
1227
1228 WARN_ON(!is_agg && freed != 1); 1218 WARN_ON(!is_agg && freed != 1);
1229 1219
1230 /* 1220 /*
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 9189a32b7844..973a9d90e9ea 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1563,7 +1563,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
1563 dev_err(adapter->dev, "SCAN_RESP: too many AP returned (%d)\n", 1563 dev_err(adapter->dev, "SCAN_RESP: too many AP returned (%d)\n",
1564 scan_rsp->number_of_sets); 1564 scan_rsp->number_of_sets);
1565 ret = -1; 1565 ret = -1;
1566 goto done; 1566 goto check_next_scan;
1567 } 1567 }
1568 1568
1569 bytes_left = le16_to_cpu(scan_rsp->bss_descript_size); 1569 bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
@@ -1634,7 +1634,8 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
1634 if (!beacon_size || beacon_size > bytes_left) { 1634 if (!beacon_size || beacon_size > bytes_left) {
1635 bss_info += bytes_left; 1635 bss_info += bytes_left;
1636 bytes_left = 0; 1636 bytes_left = 0;
1637 return -1; 1637 ret = -1;
1638 goto check_next_scan;
1638 } 1639 }
1639 1640
1640 /* Initialize the current working beacon pointer for this BSS 1641 /* Initialize the current working beacon pointer for this BSS
@@ -1690,7 +1691,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
1690 dev_err(priv->adapter->dev, 1691 dev_err(priv->adapter->dev,
1691 "%s: bytes left < IE length\n", 1692 "%s: bytes left < IE length\n",
1692 __func__); 1693 __func__);
1693 goto done; 1694 goto check_next_scan;
1694 } 1695 }
1695 if (element_id == WLAN_EID_DS_PARAMS) { 1696 if (element_id == WLAN_EID_DS_PARAMS) {
1696 channel = *(current_ptr + sizeof(struct ieee_types_header)); 1697 channel = *(current_ptr + sizeof(struct ieee_types_header));
@@ -1753,6 +1754,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
1753 } 1754 }
1754 } 1755 }
1755 1756
1757check_next_scan:
1756 spin_lock_irqsave(&adapter->scan_pending_q_lock, flags); 1758 spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
1757 if (list_empty(&adapter->scan_pending_q)) { 1759 if (list_empty(&adapter->scan_pending_q)) {
1758 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags); 1760 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
@@ -1813,7 +1815,6 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
1813 } 1815 }
1814 } 1816 }
1815 1817
1816done:
1817 return ret; 1818 return ret;
1818} 1819}
1819 1820
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 4494d130b37c..0f8b05185eda 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1004,7 +1004,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
1004 is_tx ? "Tx" : "Rx"); 1004 is_tx ? "Tx" : "Rx");
1005 1005
1006 if (is_tx) { 1006 if (is_tx) {
1007 rtl_lps_leave(hw); 1007 schedule_work(&rtlpriv->
1008 works.lps_leave_work);
1008 ppsc->last_delaylps_stamp_jiffies = 1009 ppsc->last_delaylps_stamp_jiffies =
1009 jiffies; 1010 jiffies;
1010 } 1011 }
@@ -1014,7 +1015,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
1014 } 1015 }
1015 } else if (ETH_P_ARP == ether_type) { 1016 } else if (ETH_P_ARP == ether_type) {
1016 if (is_tx) { 1017 if (is_tx) {
1017 rtl_lps_leave(hw); 1018 schedule_work(&rtlpriv->works.lps_leave_work);
1018 ppsc->last_delaylps_stamp_jiffies = jiffies; 1019 ppsc->last_delaylps_stamp_jiffies = jiffies;
1019 } 1020 }
1020 1021
@@ -1024,7 +1025,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
1024 "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx"); 1025 "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
1025 1026
1026 if (is_tx) { 1027 if (is_tx) {
1027 rtl_lps_leave(hw); 1028 schedule_work(&rtlpriv->works.lps_leave_work);
1028 ppsc->last_delaylps_stamp_jiffies = jiffies; 1029 ppsc->last_delaylps_stamp_jiffies = jiffies;
1029 } 1030 }
1030 1031
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index f2ecdeb3a90d..1535efda3d52 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -542,8 +542,8 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb)
542 WARN_ON(skb_queue_empty(&rx_queue)); 542 WARN_ON(skb_queue_empty(&rx_queue));
543 while (!skb_queue_empty(&rx_queue)) { 543 while (!skb_queue_empty(&rx_queue)) {
544 _skb = skb_dequeue(&rx_queue); 544 _skb = skb_dequeue(&rx_queue);
545 _rtl_usb_rx_process_agg(hw, skb); 545 _rtl_usb_rx_process_agg(hw, _skb);
546 ieee80211_rx_irqsafe(hw, skb); 546 ieee80211_rx_irqsafe(hw, _skb);
547 } 547 }
548} 548}
549 549
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 94b79c3338c4..9d7f1723dd8f 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -151,6 +151,9 @@ void xen_netbk_queue_tx_skb(struct xenvif *vif, struct sk_buff *skb);
151/* Notify xenvif that ring now has space to send an skb to the frontend */ 151/* Notify xenvif that ring now has space to send an skb to the frontend */
152void xenvif_notify_tx_completion(struct xenvif *vif); 152void xenvif_notify_tx_completion(struct xenvif *vif);
153 153
154/* Prevent the device from generating any further traffic. */
155void xenvif_carrier_off(struct xenvif *vif);
156
154/* Returns number of ring slots required to send an skb to the frontend */ 157/* Returns number of ring slots required to send an skb to the frontend */
155unsigned int xen_netbk_count_skb_slots(struct xenvif *vif, struct sk_buff *skb); 158unsigned int xen_netbk_count_skb_slots(struct xenvif *vif, struct sk_buff *skb);
156 159
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index b7d41f8c338a..b8c5193bd420 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -343,17 +343,22 @@ err:
343 return err; 343 return err;
344} 344}
345 345
346void xenvif_disconnect(struct xenvif *vif) 346void xenvif_carrier_off(struct xenvif *vif)
347{ 347{
348 struct net_device *dev = vif->dev; 348 struct net_device *dev = vif->dev;
349 if (netif_carrier_ok(dev)) { 349
350 rtnl_lock(); 350 rtnl_lock();
351 netif_carrier_off(dev); /* discard queued packets */ 351 netif_carrier_off(dev); /* discard queued packets */
352 if (netif_running(dev)) 352 if (netif_running(dev))
353 xenvif_down(vif); 353 xenvif_down(vif);
354 rtnl_unlock(); 354 rtnl_unlock();
355 xenvif_put(vif); 355 xenvif_put(vif);
356 } 356}
357
358void xenvif_disconnect(struct xenvif *vif)
359{
360 if (netif_carrier_ok(vif->dev))
361 xenvif_carrier_off(vif);
357 362
358 atomic_dec(&vif->refcnt); 363 atomic_dec(&vif->refcnt);
359 wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0); 364 wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f2d6b78d901d..2b9520c46e97 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -147,7 +147,8 @@ void xen_netbk_remove_xenvif(struct xenvif *vif)
147 atomic_dec(&netbk->netfront_count); 147 atomic_dec(&netbk->netfront_count);
148} 148}
149 149
150static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx); 150static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
151 u8 status);
151static void make_tx_response(struct xenvif *vif, 152static void make_tx_response(struct xenvif *vif,
152 struct xen_netif_tx_request *txp, 153 struct xen_netif_tx_request *txp,
153 s8 st); 154 s8 st);
@@ -879,7 +880,7 @@ static void netbk_tx_err(struct xenvif *vif,
879 880
880 do { 881 do {
881 make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR); 882 make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
882 if (cons >= end) 883 if (cons == end)
883 break; 884 break;
884 txp = RING_GET_REQUEST(&vif->tx, cons++); 885 txp = RING_GET_REQUEST(&vif->tx, cons++);
885 } while (1); 886 } while (1);
@@ -888,6 +889,13 @@ static void netbk_tx_err(struct xenvif *vif,
888 xenvif_put(vif); 889 xenvif_put(vif);
889} 890}
890 891
892static void netbk_fatal_tx_err(struct xenvif *vif)
893{
894 netdev_err(vif->dev, "fatal error; disabling device\n");
895 xenvif_carrier_off(vif);
896 xenvif_put(vif);
897}
898
891static int netbk_count_requests(struct xenvif *vif, 899static int netbk_count_requests(struct xenvif *vif,
892 struct xen_netif_tx_request *first, 900 struct xen_netif_tx_request *first,
893 struct xen_netif_tx_request *txp, 901 struct xen_netif_tx_request *txp,
@@ -901,19 +909,22 @@ static int netbk_count_requests(struct xenvif *vif,
901 909
902 do { 910 do {
903 if (frags >= work_to_do) { 911 if (frags >= work_to_do) {
904 netdev_dbg(vif->dev, "Need more frags\n"); 912 netdev_err(vif->dev, "Need more frags\n");
913 netbk_fatal_tx_err(vif);
905 return -frags; 914 return -frags;
906 } 915 }
907 916
908 if (unlikely(frags >= MAX_SKB_FRAGS)) { 917 if (unlikely(frags >= MAX_SKB_FRAGS)) {
909 netdev_dbg(vif->dev, "Too many frags\n"); 918 netdev_err(vif->dev, "Too many frags\n");
919 netbk_fatal_tx_err(vif);
910 return -frags; 920 return -frags;
911 } 921 }
912 922
913 memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + frags), 923 memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + frags),
914 sizeof(*txp)); 924 sizeof(*txp));
915 if (txp->size > first->size) { 925 if (txp->size > first->size) {
916 netdev_dbg(vif->dev, "Frags galore\n"); 926 netdev_err(vif->dev, "Frag is bigger than frame.\n");
927 netbk_fatal_tx_err(vif);
917 return -frags; 928 return -frags;
918 } 929 }
919 930
@@ -921,8 +932,9 @@ static int netbk_count_requests(struct xenvif *vif,
921 frags++; 932 frags++;
922 933
923 if (unlikely((txp->offset + txp->size) > PAGE_SIZE)) { 934 if (unlikely((txp->offset + txp->size) > PAGE_SIZE)) {
924 netdev_dbg(vif->dev, "txp->offset: %x, size: %u\n", 935 netdev_err(vif->dev, "txp->offset: %x, size: %u\n",
925 txp->offset, txp->size); 936 txp->offset, txp->size);
937 netbk_fatal_tx_err(vif);
926 return -frags; 938 return -frags;
927 } 939 }
928 } while ((txp++)->flags & XEN_NETTXF_more_data); 940 } while ((txp++)->flags & XEN_NETTXF_more_data);
@@ -966,7 +978,7 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk,
966 pending_idx = netbk->pending_ring[index]; 978 pending_idx = netbk->pending_ring[index];
967 page = xen_netbk_alloc_page(netbk, skb, pending_idx); 979 page = xen_netbk_alloc_page(netbk, skb, pending_idx);
968 if (!page) 980 if (!page)
969 return NULL; 981 goto err;
970 982
971 gop->source.u.ref = txp->gref; 983 gop->source.u.ref = txp->gref;
972 gop->source.domid = vif->domid; 984 gop->source.domid = vif->domid;
@@ -988,6 +1000,17 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk,
988 } 1000 }
989 1001
990 return gop; 1002 return gop;
1003err:
1004 /* Unwind, freeing all pages and sending error responses. */
1005 while (i-- > start) {
1006 xen_netbk_idx_release(netbk, frag_get_pending_idx(&frags[i]),
1007 XEN_NETIF_RSP_ERROR);
1008 }
1009 /* The head too, if necessary. */
1010 if (start)
1011 xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
1012
1013 return NULL;
991} 1014}
992 1015
993static int xen_netbk_tx_check_gop(struct xen_netbk *netbk, 1016static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
@@ -996,30 +1019,20 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
996{ 1019{
997 struct gnttab_copy *gop = *gopp; 1020 struct gnttab_copy *gop = *gopp;
998 u16 pending_idx = *((u16 *)skb->data); 1021 u16 pending_idx = *((u16 *)skb->data);
999 struct pending_tx_info *pending_tx_info = netbk->pending_tx_info;
1000 struct xenvif *vif = pending_tx_info[pending_idx].vif;
1001 struct xen_netif_tx_request *txp;
1002 struct skb_shared_info *shinfo = skb_shinfo(skb); 1022 struct skb_shared_info *shinfo = skb_shinfo(skb);
1003 int nr_frags = shinfo->nr_frags; 1023 int nr_frags = shinfo->nr_frags;
1004 int i, err, start; 1024 int i, err, start;
1005 1025
1006 /* Check status of header. */ 1026 /* Check status of header. */
1007 err = gop->status; 1027 err = gop->status;
1008 if (unlikely(err)) { 1028 if (unlikely(err))
1009 pending_ring_idx_t index; 1029 xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
1010 index = pending_index(netbk->pending_prod++);
1011 txp = &pending_tx_info[pending_idx].req;
1012 make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
1013 netbk->pending_ring[index] = pending_idx;
1014 xenvif_put(vif);
1015 }
1016 1030
1017 /* Skip first skb fragment if it is on same page as header fragment. */ 1031 /* Skip first skb fragment if it is on same page as header fragment. */
1018 start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx); 1032 start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
1019 1033
1020 for (i = start; i < nr_frags; i++) { 1034 for (i = start; i < nr_frags; i++) {
1021 int j, newerr; 1035 int j, newerr;
1022 pending_ring_idx_t index;
1023 1036
1024 pending_idx = frag_get_pending_idx(&shinfo->frags[i]); 1037 pending_idx = frag_get_pending_idx(&shinfo->frags[i]);
1025 1038
@@ -1028,16 +1041,12 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
1028 if (likely(!newerr)) { 1041 if (likely(!newerr)) {
1029 /* Had a previous error? Invalidate this fragment. */ 1042 /* Had a previous error? Invalidate this fragment. */
1030 if (unlikely(err)) 1043 if (unlikely(err))
1031 xen_netbk_idx_release(netbk, pending_idx); 1044 xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
1032 continue; 1045 continue;
1033 } 1046 }
1034 1047
1035 /* Error on this fragment: respond to client with an error. */ 1048 /* Error on this fragment: respond to client with an error. */
1036 txp = &netbk->pending_tx_info[pending_idx].req; 1049 xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
1037 make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
1038 index = pending_index(netbk->pending_prod++);
1039 netbk->pending_ring[index] = pending_idx;
1040 xenvif_put(vif);
1041 1050
1042 /* Not the first error? Preceding frags already invalidated. */ 1051 /* Not the first error? Preceding frags already invalidated. */
1043 if (err) 1052 if (err)
@@ -1045,10 +1054,10 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
1045 1054
1046 /* First error: invalidate header and preceding fragments. */ 1055 /* First error: invalidate header and preceding fragments. */
1047 pending_idx = *((u16 *)skb->data); 1056 pending_idx = *((u16 *)skb->data);
1048 xen_netbk_idx_release(netbk, pending_idx); 1057 xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
1049 for (j = start; j < i; j++) { 1058 for (j = start; j < i; j++) {
1050 pending_idx = frag_get_pending_idx(&shinfo->frags[j]); 1059 pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
1051 xen_netbk_idx_release(netbk, pending_idx); 1060 xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
1052 } 1061 }
1053 1062
1054 /* Remember the error: invalidate all subsequent fragments. */ 1063 /* Remember the error: invalidate all subsequent fragments. */
@@ -1082,7 +1091,7 @@ static void xen_netbk_fill_frags(struct xen_netbk *netbk, struct sk_buff *skb)
1082 1091
1083 /* Take an extra reference to offset xen_netbk_idx_release */ 1092 /* Take an extra reference to offset xen_netbk_idx_release */
1084 get_page(netbk->mmap_pages[pending_idx]); 1093 get_page(netbk->mmap_pages[pending_idx]);
1085 xen_netbk_idx_release(netbk, pending_idx); 1094 xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
1086 } 1095 }
1087} 1096}
1088 1097
@@ -1095,7 +1104,8 @@ static int xen_netbk_get_extras(struct xenvif *vif,
1095 1104
1096 do { 1105 do {
1097 if (unlikely(work_to_do-- <= 0)) { 1106 if (unlikely(work_to_do-- <= 0)) {
1098 netdev_dbg(vif->dev, "Missing extra info\n"); 1107 netdev_err(vif->dev, "Missing extra info\n");
1108 netbk_fatal_tx_err(vif);
1099 return -EBADR; 1109 return -EBADR;
1100 } 1110 }
1101 1111
@@ -1104,8 +1114,9 @@ static int xen_netbk_get_extras(struct xenvif *vif,
1104 if (unlikely(!extra.type || 1114 if (unlikely(!extra.type ||
1105 extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) { 1115 extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
1106 vif->tx.req_cons = ++cons; 1116 vif->tx.req_cons = ++cons;
1107 netdev_dbg(vif->dev, 1117 netdev_err(vif->dev,
1108 "Invalid extra type: %d\n", extra.type); 1118 "Invalid extra type: %d\n", extra.type);
1119 netbk_fatal_tx_err(vif);
1109 return -EINVAL; 1120 return -EINVAL;
1110 } 1121 }
1111 1122
@@ -1121,13 +1132,15 @@ static int netbk_set_skb_gso(struct xenvif *vif,
1121 struct xen_netif_extra_info *gso) 1132 struct xen_netif_extra_info *gso)
1122{ 1133{
1123 if (!gso->u.gso.size) { 1134 if (!gso->u.gso.size) {
1124 netdev_dbg(vif->dev, "GSO size must not be zero.\n"); 1135 netdev_err(vif->dev, "GSO size must not be zero.\n");
1136 netbk_fatal_tx_err(vif);
1125 return -EINVAL; 1137 return -EINVAL;
1126 } 1138 }
1127 1139
1128 /* Currently only TCPv4 S.O. is supported. */ 1140 /* Currently only TCPv4 S.O. is supported. */
1129 if (gso->u.gso.type != XEN_NETIF_GSO_TYPE_TCPV4) { 1141 if (gso->u.gso.type != XEN_NETIF_GSO_TYPE_TCPV4) {
1130 netdev_dbg(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type); 1142 netdev_err(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
1143 netbk_fatal_tx_err(vif);
1131 return -EINVAL; 1144 return -EINVAL;
1132 } 1145 }
1133 1146
@@ -1264,9 +1277,25 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
1264 1277
1265 /* Get a netif from the list with work to do. */ 1278 /* Get a netif from the list with work to do. */
1266 vif = poll_net_schedule_list(netbk); 1279 vif = poll_net_schedule_list(netbk);
1280 /* This can sometimes happen because the test of
1281 * list_empty(net_schedule_list) at the top of the
1282 * loop is unlocked. Just go back and have another
1283 * look.
1284 */
1267 if (!vif) 1285 if (!vif)
1268 continue; 1286 continue;
1269 1287
1288 if (vif->tx.sring->req_prod - vif->tx.req_cons >
1289 XEN_NETIF_TX_RING_SIZE) {
1290 netdev_err(vif->dev,
1291 "Impossible number of requests. "
1292 "req_prod %d, req_cons %d, size %ld\n",
1293 vif->tx.sring->req_prod, vif->tx.req_cons,
1294 XEN_NETIF_TX_RING_SIZE);
1295 netbk_fatal_tx_err(vif);
1296 continue;
1297 }
1298
1270 RING_FINAL_CHECK_FOR_REQUESTS(&vif->tx, work_to_do); 1299 RING_FINAL_CHECK_FOR_REQUESTS(&vif->tx, work_to_do);
1271 if (!work_to_do) { 1300 if (!work_to_do) {
1272 xenvif_put(vif); 1301 xenvif_put(vif);
@@ -1294,17 +1323,14 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
1294 work_to_do = xen_netbk_get_extras(vif, extras, 1323 work_to_do = xen_netbk_get_extras(vif, extras,
1295 work_to_do); 1324 work_to_do);
1296 idx = vif->tx.req_cons; 1325 idx = vif->tx.req_cons;
1297 if (unlikely(work_to_do < 0)) { 1326 if (unlikely(work_to_do < 0))
1298 netbk_tx_err(vif, &txreq, idx);
1299 continue; 1327 continue;
1300 }
1301 } 1328 }
1302 1329
1303 ret = netbk_count_requests(vif, &txreq, txfrags, work_to_do); 1330 ret = netbk_count_requests(vif, &txreq, txfrags, work_to_do);
1304 if (unlikely(ret < 0)) { 1331 if (unlikely(ret < 0))
1305 netbk_tx_err(vif, &txreq, idx - ret);
1306 continue; 1332 continue;
1307 } 1333
1308 idx += ret; 1334 idx += ret;
1309 1335
1310 if (unlikely(txreq.size < ETH_HLEN)) { 1336 if (unlikely(txreq.size < ETH_HLEN)) {
@@ -1316,11 +1342,11 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
1316 1342
1317 /* No crossing a page as the payload mustn't fragment. */ 1343 /* No crossing a page as the payload mustn't fragment. */
1318 if (unlikely((txreq.offset + txreq.size) > PAGE_SIZE)) { 1344 if (unlikely((txreq.offset + txreq.size) > PAGE_SIZE)) {
1319 netdev_dbg(vif->dev, 1345 netdev_err(vif->dev,
1320 "txreq.offset: %x, size: %u, end: %lu\n", 1346 "txreq.offset: %x, size: %u, end: %lu\n",
1321 txreq.offset, txreq.size, 1347 txreq.offset, txreq.size,
1322 (txreq.offset&~PAGE_MASK) + txreq.size); 1348 (txreq.offset&~PAGE_MASK) + txreq.size);
1323 netbk_tx_err(vif, &txreq, idx); 1349 netbk_fatal_tx_err(vif);
1324 continue; 1350 continue;
1325 } 1351 }
1326 1352
@@ -1348,8 +1374,8 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
1348 gso = &extras[XEN_NETIF_EXTRA_TYPE_GSO - 1]; 1374 gso = &extras[XEN_NETIF_EXTRA_TYPE_GSO - 1];
1349 1375
1350 if (netbk_set_skb_gso(vif, skb, gso)) { 1376 if (netbk_set_skb_gso(vif, skb, gso)) {
1377 /* Failure in netbk_set_skb_gso is fatal. */
1351 kfree_skb(skb); 1378 kfree_skb(skb);
1352 netbk_tx_err(vif, &txreq, idx);
1353 continue; 1379 continue;
1354 } 1380 }
1355 } 1381 }
@@ -1448,7 +1474,7 @@ static void xen_netbk_tx_submit(struct xen_netbk *netbk)
1448 txp->size -= data_len; 1474 txp->size -= data_len;
1449 } else { 1475 } else {
1450 /* Schedule a response immediately. */ 1476 /* Schedule a response immediately. */
1451 xen_netbk_idx_release(netbk, pending_idx); 1477 xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
1452 } 1478 }
1453 1479
1454 if (txp->flags & XEN_NETTXF_csum_blank) 1480 if (txp->flags & XEN_NETTXF_csum_blank)
@@ -1500,7 +1526,8 @@ static void xen_netbk_tx_action(struct xen_netbk *netbk)
1500 xen_netbk_tx_submit(netbk); 1526 xen_netbk_tx_submit(netbk);
1501} 1527}
1502 1528
1503static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx) 1529static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
1530 u8 status)
1504{ 1531{
1505 struct xenvif *vif; 1532 struct xenvif *vif;
1506 struct pending_tx_info *pending_tx_info; 1533 struct pending_tx_info *pending_tx_info;
@@ -1514,7 +1541,7 @@ static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)
1514 1541
1515 vif = pending_tx_info->vif; 1542 vif = pending_tx_info->vif;
1516 1543
1517 make_tx_response(vif, &pending_tx_info->req, XEN_NETIF_RSP_OKAY); 1544 make_tx_response(vif, &pending_tx_info->req, status);
1518 1545
1519 index = pending_index(netbk->pending_prod++); 1546 index = pending_index(netbk->pending_prod++);
1520 netbk->pending_ring[index] = pending_idx; 1547 netbk->pending_ring[index] = pending_idx;
diff --git a/drivers/ssb/driver_gpio.c b/drivers/ssb/driver_gpio.c
index 97ac0a38e3d0..eb2753008ef0 100644
--- a/drivers/ssb/driver_gpio.c
+++ b/drivers/ssb/driver_gpio.c
@@ -174,3 +174,15 @@ int ssb_gpio_init(struct ssb_bus *bus)
174 174
175 return -1; 175 return -1;
176} 176}
177
178int ssb_gpio_unregister(struct ssb_bus *bus)
179{
180 if (ssb_chipco_available(&bus->chipco) ||
181 ssb_extif_available(&bus->extif)) {
182 return gpiochip_remove(&bus->gpio);
183 } else {
184 SSB_WARN_ON(1);
185 }
186
187 return -1;
188}
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 772ad9b5c304..24dc331b4701 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -443,6 +443,15 @@ static void ssb_devices_unregister(struct ssb_bus *bus)
443 443
444void ssb_bus_unregister(struct ssb_bus *bus) 444void ssb_bus_unregister(struct ssb_bus *bus)
445{ 445{
446 int err;
447
448 err = ssb_gpio_unregister(bus);
449 if (err == -EBUSY)
450 ssb_dprintk(KERN_ERR PFX "Some GPIOs are still in use.\n");
451 else if (err)
452 ssb_dprintk(KERN_ERR PFX
453 "Can not unregister GPIO driver: %i\n", err);
454
446 ssb_buses_lock(); 455 ssb_buses_lock();
447 ssb_devices_unregister(bus); 456 ssb_devices_unregister(bus);
448 list_del(&bus->list); 457 list_del(&bus->list);
diff --git a/drivers/ssb/ssb_private.h b/drivers/ssb/ssb_private.h
index 6c10b66c796c..da38305a2d22 100644
--- a/drivers/ssb/ssb_private.h
+++ b/drivers/ssb/ssb_private.h
@@ -252,11 +252,16 @@ static inline void ssb_extif_init(struct ssb_extif *extif)
252 252
253#ifdef CONFIG_SSB_DRIVER_GPIO 253#ifdef CONFIG_SSB_DRIVER_GPIO
254extern int ssb_gpio_init(struct ssb_bus *bus); 254extern int ssb_gpio_init(struct ssb_bus *bus);
255extern int ssb_gpio_unregister(struct ssb_bus *bus);
255#else /* CONFIG_SSB_DRIVER_GPIO */ 256#else /* CONFIG_SSB_DRIVER_GPIO */
256static inline int ssb_gpio_init(struct ssb_bus *bus) 257static inline int ssb_gpio_init(struct ssb_bus *bus)
257{ 258{
258 return -ENOTSUPP; 259 return -ENOTSUPP;
259} 260}
261static inline int ssb_gpio_unregister(struct ssb_bus *bus)
262{
263 return 0;
264}
260#endif /* CONFIG_SSB_DRIVER_GPIO */ 265#endif /* CONFIG_SSB_DRIVER_GPIO */
261 266
262#endif /* LINUX_SSB_PRIVATE_H_ */ 267#endif /* LINUX_SSB_PRIVATE_H_ */
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index ebd08b21b234..959b1cd89e6a 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -165,12 +165,16 @@ static void tx_poll_stop(struct vhost_net *net)
165} 165}
166 166
167/* Caller must have TX VQ lock */ 167/* Caller must have TX VQ lock */
168static void tx_poll_start(struct vhost_net *net, struct socket *sock) 168static int tx_poll_start(struct vhost_net *net, struct socket *sock)
169{ 169{
170 int ret;
171
170 if (unlikely(net->tx_poll_state != VHOST_NET_POLL_STOPPED)) 172 if (unlikely(net->tx_poll_state != VHOST_NET_POLL_STOPPED))
171 return; 173 return 0;
172 vhost_poll_start(net->poll + VHOST_NET_VQ_TX, sock->file); 174 ret = vhost_poll_start(net->poll + VHOST_NET_VQ_TX, sock->file);
173 net->tx_poll_state = VHOST_NET_POLL_STARTED; 175 if (!ret)
176 net->tx_poll_state = VHOST_NET_POLL_STARTED;
177 return ret;
174} 178}
175 179
176/* In case of DMA done not in order in lower device driver for some reason. 180/* In case of DMA done not in order in lower device driver for some reason.
@@ -642,20 +646,23 @@ static void vhost_net_disable_vq(struct vhost_net *n,
642 vhost_poll_stop(n->poll + VHOST_NET_VQ_RX); 646 vhost_poll_stop(n->poll + VHOST_NET_VQ_RX);
643} 647}
644 648
645static void vhost_net_enable_vq(struct vhost_net *n, 649static int vhost_net_enable_vq(struct vhost_net *n,
646 struct vhost_virtqueue *vq) 650 struct vhost_virtqueue *vq)
647{ 651{
648 struct socket *sock; 652 struct socket *sock;
653 int ret;
649 654
650 sock = rcu_dereference_protected(vq->private_data, 655 sock = rcu_dereference_protected(vq->private_data,
651 lockdep_is_held(&vq->mutex)); 656 lockdep_is_held(&vq->mutex));
652 if (!sock) 657 if (!sock)
653 return; 658 return 0;
654 if (vq == n->vqs + VHOST_NET_VQ_TX) { 659 if (vq == n->vqs + VHOST_NET_VQ_TX) {
655 n->tx_poll_state = VHOST_NET_POLL_STOPPED; 660 n->tx_poll_state = VHOST_NET_POLL_STOPPED;
656 tx_poll_start(n, sock); 661 ret = tx_poll_start(n, sock);
657 } else 662 } else
658 vhost_poll_start(n->poll + VHOST_NET_VQ_RX, sock->file); 663 ret = vhost_poll_start(n->poll + VHOST_NET_VQ_RX, sock->file);
664
665 return ret;
659} 666}
660 667
661static struct socket *vhost_net_stop_vq(struct vhost_net *n, 668static struct socket *vhost_net_stop_vq(struct vhost_net *n,
@@ -827,15 +834,18 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
827 r = PTR_ERR(ubufs); 834 r = PTR_ERR(ubufs);
828 goto err_ubufs; 835 goto err_ubufs;
829 } 836 }
830 oldubufs = vq->ubufs; 837
831 vq->ubufs = ubufs;
832 vhost_net_disable_vq(n, vq); 838 vhost_net_disable_vq(n, vq);
833 rcu_assign_pointer(vq->private_data, sock); 839 rcu_assign_pointer(vq->private_data, sock);
834 vhost_net_enable_vq(n, vq);
835
836 r = vhost_init_used(vq); 840 r = vhost_init_used(vq);
837 if (r) 841 if (r)
838 goto err_vq; 842 goto err_used;
843 r = vhost_net_enable_vq(n, vq);
844 if (r)
845 goto err_used;
846
847 oldubufs = vq->ubufs;
848 vq->ubufs = ubufs;
839 849
840 n->tx_packets = 0; 850 n->tx_packets = 0;
841 n->tx_zcopy_err = 0; 851 n->tx_zcopy_err = 0;
@@ -859,6 +869,11 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
859 mutex_unlock(&n->dev.mutex); 869 mutex_unlock(&n->dev.mutex);
860 return 0; 870 return 0;
861 871
872err_used:
873 rcu_assign_pointer(vq->private_data, oldsock);
874 vhost_net_enable_vq(n, vq);
875 if (ubufs)
876 vhost_ubuf_put_and_wait(ubufs);
862err_ubufs: 877err_ubufs:
863 fput(sock->file); 878 fput(sock->file);
864err_vq: 879err_vq:
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 34389f75fe65..9759249e6d90 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -77,26 +77,38 @@ void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn,
77 init_poll_funcptr(&poll->table, vhost_poll_func); 77 init_poll_funcptr(&poll->table, vhost_poll_func);
78 poll->mask = mask; 78 poll->mask = mask;
79 poll->dev = dev; 79 poll->dev = dev;
80 poll->wqh = NULL;
80 81
81 vhost_work_init(&poll->work, fn); 82 vhost_work_init(&poll->work, fn);
82} 83}
83 84
84/* Start polling a file. We add ourselves to file's wait queue. The caller must 85/* Start polling a file. We add ourselves to file's wait queue. The caller must
85 * keep a reference to a file until after vhost_poll_stop is called. */ 86 * keep a reference to a file until after vhost_poll_stop is called. */
86void vhost_poll_start(struct vhost_poll *poll, struct file *file) 87int vhost_poll_start(struct vhost_poll *poll, struct file *file)
87{ 88{
88 unsigned long mask; 89 unsigned long mask;
90 int ret = 0;
89 91
90 mask = file->f_op->poll(file, &poll->table); 92 mask = file->f_op->poll(file, &poll->table);
91 if (mask) 93 if (mask)
92 vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask); 94 vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask);
95 if (mask & POLLERR) {
96 if (poll->wqh)
97 remove_wait_queue(poll->wqh, &poll->wait);
98 ret = -EINVAL;
99 }
100
101 return ret;
93} 102}
94 103
95/* Stop polling a file. After this function returns, it becomes safe to drop the 104/* Stop polling a file. After this function returns, it becomes safe to drop the
96 * file reference. You must also flush afterwards. */ 105 * file reference. You must also flush afterwards. */
97void vhost_poll_stop(struct vhost_poll *poll) 106void vhost_poll_stop(struct vhost_poll *poll)
98{ 107{
99 remove_wait_queue(poll->wqh, &poll->wait); 108 if (poll->wqh) {
109 remove_wait_queue(poll->wqh, &poll->wait);
110 poll->wqh = NULL;
111 }
100} 112}
101 113
102static bool vhost_work_seq_done(struct vhost_dev *dev, struct vhost_work *work, 114static bool vhost_work_seq_done(struct vhost_dev *dev, struct vhost_work *work,
@@ -792,7 +804,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp)
792 fput(filep); 804 fput(filep);
793 805
794 if (pollstart && vq->handle_kick) 806 if (pollstart && vq->handle_kick)
795 vhost_poll_start(&vq->poll, vq->kick); 807 r = vhost_poll_start(&vq->poll, vq->kick);
796 808
797 mutex_unlock(&vq->mutex); 809 mutex_unlock(&vq->mutex);
798 810
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 2639c58b23ab..17261e277c02 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -42,7 +42,7 @@ void vhost_work_queue(struct vhost_dev *dev, struct vhost_work *work);
42 42
43void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn, 43void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn,
44 unsigned long mask, struct vhost_dev *dev); 44 unsigned long mask, struct vhost_dev *dev);
45void vhost_poll_start(struct vhost_poll *poll, struct file *file); 45int vhost_poll_start(struct vhost_poll *poll, struct file *file);
46void vhost_poll_stop(struct vhost_poll *poll); 46void vhost_poll_stop(struct vhost_poll *poll);
47void vhost_poll_flush(struct vhost_poll *poll); 47void vhost_poll_flush(struct vhost_poll *poll);
48void vhost_poll_queue(struct vhost_poll *poll); 48void vhost_poll_queue(struct vhost_poll *poll);
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 5de7a220e986..0e5ac93bab10 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -33,6 +33,7 @@ struct usbnet {
33 wait_queue_head_t *wait; 33 wait_queue_head_t *wait;
34 struct mutex phy_mutex; 34 struct mutex phy_mutex;
35 unsigned char suspend_count; 35 unsigned char suspend_count;
36 unsigned char pkt_cnt, pkt_err;
36 37
37 /* i/o info: pipes etc */ 38 /* i/o info: pipes etc */
38 unsigned in, out; 39 unsigned in, out;
@@ -70,6 +71,7 @@ struct usbnet {
70# define EVENT_DEV_OPEN 7 71# define EVENT_DEV_OPEN 7
71# define EVENT_DEVICE_REPORT_IDLE 8 72# define EVENT_DEVICE_REPORT_IDLE 8
72# define EVENT_NO_RUNTIME_PM 9 73# define EVENT_NO_RUNTIME_PM 9
74# define EVENT_RX_KILL 10
73}; 75};
74 76
75static inline struct usb_driver *driver_of(struct usb_interface *intf) 77static inline struct usb_driver *driver_of(struct usb_interface *intf)
@@ -100,7 +102,6 @@ struct driver_info {
100#define FLAG_LINK_INTR 0x0800 /* updates link (carrier) status */ 102#define FLAG_LINK_INTR 0x0800 /* updates link (carrier) status */
101 103
102#define FLAG_POINTTOPOINT 0x1000 /* possibly use "usb%d" names */ 104#define FLAG_POINTTOPOINT 0x1000 /* possibly use "usb%d" names */
103#define FLAG_NOARP 0x2000 /* device can't do ARP */
104 105
105/* 106/*
106 * Indicates to usbnet, that USB driver accumulates multiple IP packets. 107 * Indicates to usbnet, that USB driver accumulates multiple IP packets.
@@ -108,6 +109,7 @@ struct driver_info {
108 */ 109 */
109#define FLAG_MULTI_PACKET 0x2000 110#define FLAG_MULTI_PACKET 0x2000
110#define FLAG_RX_ASSEMBLE 0x4000 /* rx packets may span >1 frames */ 111#define FLAG_RX_ASSEMBLE 0x4000 /* rx packets may span >1 frames */
112#define FLAG_NOARP 0x8000 /* device can't do ARP */
111 113
112 /* init device ... can sleep, or cause probe() failure */ 114 /* init device ... can sleep, or cause probe() failure */
113 int (*bind)(struct usbnet *, struct usb_interface *); 115 int (*bind)(struct usbnet *, struct usb_interface *);
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index 498433dd067d..938b7fd11204 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -34,17 +34,17 @@ extern int udpv6_connect(struct sock *sk,
34 struct sockaddr *uaddr, 34 struct sockaddr *uaddr,
35 int addr_len); 35 int addr_len);
36 36
37extern int datagram_recv_ctl(struct sock *sk, 37extern int ip6_datagram_recv_ctl(struct sock *sk,
38 struct msghdr *msg, 38 struct msghdr *msg,
39 struct sk_buff *skb); 39 struct sk_buff *skb);
40 40
41extern int datagram_send_ctl(struct net *net, 41extern int ip6_datagram_send_ctl(struct net *net,
42 struct sock *sk, 42 struct sock *sk,
43 struct msghdr *msg, 43 struct msghdr *msg,
44 struct flowi6 *fl6, 44 struct flowi6 *fl6,
45 struct ipv6_txoptions *opt, 45 struct ipv6_txoptions *opt,
46 int *hlimit, int *tclass, 46 int *hlimit, int *tclass,
47 int *dontfrag); 47 int *dontfrag);
48 48
49#define LOOPBACK4_IPV6 cpu_to_be32(0x7f000006) 49#define LOOPBACK4_IPV6 cpu_to_be32(0x7f000006)
50 50
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 25bfce0666eb..4925a02ae7e4 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -249,12 +249,12 @@ static void hci_conn_disconnect(struct hci_conn *conn)
249 __u8 reason = hci_proto_disconn_ind(conn); 249 __u8 reason = hci_proto_disconn_ind(conn);
250 250
251 switch (conn->type) { 251 switch (conn->type) {
252 case ACL_LINK:
253 hci_acl_disconn(conn, reason);
254 break;
255 case AMP_LINK: 252 case AMP_LINK:
256 hci_amp_disconn(conn, reason); 253 hci_amp_disconn(conn, reason);
257 break; 254 break;
255 default:
256 hci_acl_disconn(conn, reason);
257 break;
258 } 258 }
259} 259}
260 260
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 68a9587c9694..5abefb12891d 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -859,6 +859,19 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
859 859
860 skb_pull(skb, sizeof(code)); 860 skb_pull(skb, sizeof(code));
861 861
862 /*
863 * The SMP context must be initialized for all other PDUs except
864 * pairing and security requests. If we get any other PDU when
865 * not initialized simply disconnect (done if this function
866 * returns an error).
867 */
868 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
869 !conn->smp_chan) {
870 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
871 kfree_skb(skb);
872 return -ENOTSUPP;
873 }
874
862 switch (code) { 875 switch (code) {
863 case SMP_CMD_PAIRING_REQ: 876 case SMP_CMD_PAIRING_REQ:
864 reason = smp_cmd_pairing_req(conn, skb); 877 reason = smp_cmd_pairing_req(conn, skb);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index b29dacf900f9..e6e1cbe863f5 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1781,10 +1781,13 @@ static ssize_t pktgen_thread_write(struct file *file,
1781 return -EFAULT; 1781 return -EFAULT;
1782 i += len; 1782 i += len;
1783 mutex_lock(&pktgen_thread_lock); 1783 mutex_lock(&pktgen_thread_lock);
1784 pktgen_add_device(t, f); 1784 ret = pktgen_add_device(t, f);
1785 mutex_unlock(&pktgen_thread_lock); 1785 mutex_unlock(&pktgen_thread_lock);
1786 ret = count; 1786 if (!ret) {
1787 sprintf(pg_result, "OK: add_device=%s", f); 1787 ret = count;
1788 sprintf(pg_result, "OK: add_device=%s", f);
1789 } else
1790 sprintf(pg_result, "ERROR: can not add device %s", f);
1788 goto out; 1791 goto out;
1789 } 1792 }
1790 1793
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a9a2ae3e2213..32443ebc3e89 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -683,7 +683,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
683 new->network_header = old->network_header; 683 new->network_header = old->network_header;
684 new->mac_header = old->mac_header; 684 new->mac_header = old->mac_header;
685 new->inner_transport_header = old->inner_transport_header; 685 new->inner_transport_header = old->inner_transport_header;
686 new->inner_network_header = old->inner_transport_header; 686 new->inner_network_header = old->inner_network_header;
687 skb_dst_copy(new, old); 687 skb_dst_copy(new, old);
688 new->rxhash = old->rxhash; 688 new->rxhash = old->rxhash;
689 new->ooo_okay = old->ooo_okay; 689 new->ooo_okay = old->ooo_okay;
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 291f2ed7cc31..cdf2e707bb10 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -310,6 +310,12 @@ void tcp_slow_start(struct tcp_sock *tp)
310{ 310{
311 int cnt; /* increase in packets */ 311 int cnt; /* increase in packets */
312 unsigned int delta = 0; 312 unsigned int delta = 0;
313 u32 snd_cwnd = tp->snd_cwnd;
314
315 if (unlikely(!snd_cwnd)) {
316 pr_err_once("snd_cwnd is nul, please report this bug.\n");
317 snd_cwnd = 1U;
318 }
313 319
314 /* RFC3465: ABC Slow start 320 /* RFC3465: ABC Slow start
315 * Increase only after a full MSS of bytes is acked 321 * Increase only after a full MSS of bytes is acked
@@ -324,7 +330,7 @@ void tcp_slow_start(struct tcp_sock *tp)
324 if (sysctl_tcp_max_ssthresh > 0 && tp->snd_cwnd > sysctl_tcp_max_ssthresh) 330 if (sysctl_tcp_max_ssthresh > 0 && tp->snd_cwnd > sysctl_tcp_max_ssthresh)
325 cnt = sysctl_tcp_max_ssthresh >> 1; /* limited slow start */ 331 cnt = sysctl_tcp_max_ssthresh >> 1; /* limited slow start */
326 else 332 else
327 cnt = tp->snd_cwnd; /* exponential increase */ 333 cnt = snd_cwnd; /* exponential increase */
328 334
329 /* RFC3465: ABC 335 /* RFC3465: ABC
330 * We MAY increase by 2 if discovered delayed ack 336 * We MAY increase by 2 if discovered delayed ack
@@ -334,11 +340,11 @@ void tcp_slow_start(struct tcp_sock *tp)
334 tp->bytes_acked = 0; 340 tp->bytes_acked = 0;
335 341
336 tp->snd_cwnd_cnt += cnt; 342 tp->snd_cwnd_cnt += cnt;
337 while (tp->snd_cwnd_cnt >= tp->snd_cwnd) { 343 while (tp->snd_cwnd_cnt >= snd_cwnd) {
338 tp->snd_cwnd_cnt -= tp->snd_cwnd; 344 tp->snd_cwnd_cnt -= snd_cwnd;
339 delta++; 345 delta++;
340 } 346 }
341 tp->snd_cwnd = min(tp->snd_cwnd + delta, tp->snd_cwnd_clamp); 347 tp->snd_cwnd = min(snd_cwnd + delta, tp->snd_cwnd_clamp);
342} 348}
343EXPORT_SYMBOL_GPL(tcp_slow_start); 349EXPORT_SYMBOL_GPL(tcp_slow_start);
344 350
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 18f97ca76b00..ad70a962c20e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3504,6 +3504,11 @@ static bool tcp_process_frto(struct sock *sk, int flag)
3504 } 3504 }
3505 } else { 3505 } else {
3506 if (!(flag & FLAG_DATA_ACKED) && (tp->frto_counter == 1)) { 3506 if (!(flag & FLAG_DATA_ACKED) && (tp->frto_counter == 1)) {
3507 if (!tcp_packets_in_flight(tp)) {
3508 tcp_enter_frto_loss(sk, 2, flag);
3509 return true;
3510 }
3511
3507 /* Prevent sending of new data. */ 3512 /* Prevent sending of new data. */
3508 tp->snd_cwnd = min(tp->snd_cwnd, 3513 tp->snd_cwnd = min(tp->snd_cwnd,
3509 tcp_packets_in_flight(tp)); 3514 tcp_packets_in_flight(tp));
@@ -5649,8 +5654,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
5649 * the remote receives only the retransmitted (regular) SYNs: either 5654 * the remote receives only the retransmitted (regular) SYNs: either
5650 * the original SYN-data or the corresponding SYN-ACK is lost. 5655 * the original SYN-data or the corresponding SYN-ACK is lost.
5651 */ 5656 */
5652 syn_drop = (cookie->len <= 0 && data && 5657 syn_drop = (cookie->len <= 0 && data && tp->total_retrans);
5653 inet_csk(sk)->icsk_retransmits);
5654 5658
5655 tcp_fastopen_cache_set(sk, mss, cookie, syn_drop); 5659 tcp_fastopen_cache_set(sk, mss, cookie, syn_drop);
5656 5660
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 70b09ef2463b..eadb693eef55 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -496,6 +496,7 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
496 * errors returned from accept(). 496 * errors returned from accept().
497 */ 497 */
498 inet_csk_reqsk_queue_drop(sk, req, prev); 498 inet_csk_reqsk_queue_drop(sk, req, prev);
499 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
499 goto out; 500 goto out;
500 501
501 case TCP_SYN_SENT: 502 case TCP_SYN_SENT:
@@ -1500,8 +1501,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
1500 * clogging syn queue with openreqs with exponentially increasing 1501 * clogging syn queue with openreqs with exponentially increasing
1501 * timeout. 1502 * timeout.
1502 */ 1503 */
1503 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) 1504 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
1505 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1504 goto drop; 1506 goto drop;
1507 }
1505 1508
1506 req = inet_reqsk_alloc(&tcp_request_sock_ops); 1509 req = inet_reqsk_alloc(&tcp_request_sock_ops);
1507 if (!req) 1510 if (!req)
@@ -1666,6 +1669,7 @@ drop_and_release:
1666drop_and_free: 1669drop_and_free:
1667 reqsk_free(req); 1670 reqsk_free(req);
1668drop: 1671drop:
1672 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1669 return 0; 1673 return 0;
1670} 1674}
1671EXPORT_SYMBOL(tcp_v4_conn_request); 1675EXPORT_SYMBOL(tcp_v4_conn_request);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 420e56326384..1b5d8cb9b123 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1660,6 +1660,7 @@ static int addrconf_ifid_eui64(u8 *eui, struct net_device *dev)
1660 if (dev->addr_len != IEEE802154_ADDR_LEN) 1660 if (dev->addr_len != IEEE802154_ADDR_LEN)
1661 return -1; 1661 return -1;
1662 memcpy(eui, dev->dev_addr, 8); 1662 memcpy(eui, dev->dev_addr, 8);
1663 eui[0] ^= 2;
1663 return 0; 1664 return 0;
1664} 1665}
1665 1666
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 8edf2601065a..7a778b9a7b85 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -380,7 +380,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
380 if (skb->protocol == htons(ETH_P_IPV6)) { 380 if (skb->protocol == htons(ETH_P_IPV6)) {
381 sin->sin6_addr = ipv6_hdr(skb)->saddr; 381 sin->sin6_addr = ipv6_hdr(skb)->saddr;
382 if (np->rxopt.all) 382 if (np->rxopt.all)
383 datagram_recv_ctl(sk, msg, skb); 383 ip6_datagram_recv_ctl(sk, msg, skb);
384 if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL) 384 if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
385 sin->sin6_scope_id = IP6CB(skb)->iif; 385 sin->sin6_scope_id = IP6CB(skb)->iif;
386 } else { 386 } else {
@@ -468,7 +468,8 @@ out:
468} 468}
469 469
470 470
471int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb) 471int ip6_datagram_recv_ctl(struct sock *sk, struct msghdr *msg,
472 struct sk_buff *skb)
472{ 473{
473 struct ipv6_pinfo *np = inet6_sk(sk); 474 struct ipv6_pinfo *np = inet6_sk(sk);
474 struct inet6_skb_parm *opt = IP6CB(skb); 475 struct inet6_skb_parm *opt = IP6CB(skb);
@@ -597,11 +598,12 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
597 } 598 }
598 return 0; 599 return 0;
599} 600}
601EXPORT_SYMBOL_GPL(ip6_datagram_recv_ctl);
600 602
601int datagram_send_ctl(struct net *net, struct sock *sk, 603int ip6_datagram_send_ctl(struct net *net, struct sock *sk,
602 struct msghdr *msg, struct flowi6 *fl6, 604 struct msghdr *msg, struct flowi6 *fl6,
603 struct ipv6_txoptions *opt, 605 struct ipv6_txoptions *opt,
604 int *hlimit, int *tclass, int *dontfrag) 606 int *hlimit, int *tclass, int *dontfrag)
605{ 607{
606 struct in6_pktinfo *src_info; 608 struct in6_pktinfo *src_info;
607 struct cmsghdr *cmsg; 609 struct cmsghdr *cmsg;
@@ -871,4 +873,4 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
871exit_f: 873exit_f:
872 return err; 874 return err;
873} 875}
874EXPORT_SYMBOL_GPL(datagram_send_ctl); 876EXPORT_SYMBOL_GPL(ip6_datagram_send_ctl);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 29124b7a04c8..d6de4b447250 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -365,8 +365,8 @@ fl_create(struct net *net, struct sock *sk, struct in6_flowlabel_req *freq,
365 msg.msg_control = (void*)(fl->opt+1); 365 msg.msg_control = (void*)(fl->opt+1);
366 memset(&flowi6, 0, sizeof(flowi6)); 366 memset(&flowi6, 0, sizeof(flowi6));
367 367
368 err = datagram_send_ctl(net, sk, &msg, &flowi6, fl->opt, &junk, 368 err = ip6_datagram_send_ctl(net, sk, &msg, &flowi6, fl->opt,
369 &junk, &junk); 369 &junk, &junk, &junk);
370 if (err) 370 if (err)
371 goto done; 371 goto done;
372 err = -EINVAL; 372 err = -EINVAL;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index c727e4712751..131dd097736d 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -960,7 +960,7 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
960 int ret; 960 int ret;
961 961
962 if (!ip6_tnl_xmit_ctl(t)) 962 if (!ip6_tnl_xmit_ctl(t))
963 return -1; 963 goto tx_err;
964 964
965 switch (skb->protocol) { 965 switch (skb->protocol) {
966 case htons(ETH_P_IP): 966 case htons(ETH_P_IP):
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index ee94d31c9d4d..d1e2e8ef29c5 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -476,8 +476,8 @@ sticky_done:
476 msg.msg_controllen = optlen; 476 msg.msg_controllen = optlen;
477 msg.msg_control = (void*)(opt+1); 477 msg.msg_control = (void*)(opt+1);
478 478
479 retv = datagram_send_ctl(net, sk, &msg, &fl6, opt, &junk, &junk, 479 retv = ip6_datagram_send_ctl(net, sk, &msg, &fl6, opt, &junk,
480 &junk); 480 &junk, &junk);
481 if (retv) 481 if (retv)
482 goto done; 482 goto done;
483update: 483update:
@@ -1002,7 +1002,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
1002 release_sock(sk); 1002 release_sock(sk);
1003 1003
1004 if (skb) { 1004 if (skb) {
1005 int err = datagram_recv_ctl(sk, &msg, skb); 1005 int err = ip6_datagram_recv_ctl(sk, &msg, skb);
1006 kfree_skb(skb); 1006 kfree_skb(skb);
1007 if (err) 1007 if (err)
1008 return err; 1008 return err;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 6cd29b1e8b92..70fa81449997 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -507,7 +507,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
507 sock_recv_ts_and_drops(msg, sk, skb); 507 sock_recv_ts_and_drops(msg, sk, skb);
508 508
509 if (np->rxopt.all) 509 if (np->rxopt.all)
510 datagram_recv_ctl(sk, msg, skb); 510 ip6_datagram_recv_ctl(sk, msg, skb);
511 511
512 err = copied; 512 err = copied;
513 if (flags & MSG_TRUNC) 513 if (flags & MSG_TRUNC)
@@ -822,8 +822,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
822 memset(opt, 0, sizeof(struct ipv6_txoptions)); 822 memset(opt, 0, sizeof(struct ipv6_txoptions));
823 opt->tot_len = sizeof(struct ipv6_txoptions); 823 opt->tot_len = sizeof(struct ipv6_txoptions);
824 824
825 err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt, 825 err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
826 &hlimit, &tclass, &dontfrag); 826 &hlimit, &tclass, &dontfrag);
827 if (err < 0) { 827 if (err < 0) {
828 fl6_sock_release(flowlabel); 828 fl6_sock_release(flowlabel);
829 return err; 829 return err;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e229a3bc345d..363d8b7772e8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -928,7 +928,7 @@ restart:
928 dst_hold(&rt->dst); 928 dst_hold(&rt->dst);
929 read_unlock_bh(&table->tb6_lock); 929 read_unlock_bh(&table->tb6_lock);
930 930
931 if (!rt->n && !(rt->rt6i_flags & RTF_NONEXTHOP)) 931 if (!rt->n && !(rt->rt6i_flags & (RTF_NONEXTHOP | RTF_LOCAL)))
932 nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr); 932 nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
933 else if (!(rt->dst.flags & DST_HOST)) 933 else if (!(rt->dst.flags & DST_HOST))
934 nrt = rt6_alloc_clone(rt, &fl6->daddr); 934 nrt = rt6_alloc_clone(rt, &fl6->daddr);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 93825dd3a7c0..4f43537197ef 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -423,6 +423,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
423 } 423 }
424 424
425 inet_csk_reqsk_queue_drop(sk, req, prev); 425 inet_csk_reqsk_queue_drop(sk, req, prev);
426 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
426 goto out; 427 goto out;
427 428
428 case TCP_SYN_SENT: 429 case TCP_SYN_SENT:
@@ -958,8 +959,10 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
958 goto drop; 959 goto drop;
959 } 960 }
960 961
961 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) 962 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
963 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
962 goto drop; 964 goto drop;
965 }
963 966
964 req = inet6_reqsk_alloc(&tcp6_request_sock_ops); 967 req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
965 if (req == NULL) 968 if (req == NULL)
@@ -1108,6 +1111,7 @@ drop_and_release:
1108drop_and_free: 1111drop_and_free:
1109 reqsk_free(req); 1112 reqsk_free(req);
1110drop: 1113drop:
1114 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1111 return 0; /* don't send reset */ 1115 return 0; /* don't send reset */
1112} 1116}
1113 1117
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index dfaa29b8b293..fb083295ff0b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -443,7 +443,7 @@ try_again:
443 ip_cmsg_recv(msg, skb); 443 ip_cmsg_recv(msg, skb);
444 } else { 444 } else {
445 if (np->rxopt.all) 445 if (np->rxopt.all)
446 datagram_recv_ctl(sk, msg, skb); 446 ip6_datagram_recv_ctl(sk, msg, skb);
447 } 447 }
448 448
449 err = copied; 449 err = copied;
@@ -1153,8 +1153,8 @@ do_udp_sendmsg:
1153 memset(opt, 0, sizeof(struct ipv6_txoptions)); 1153 memset(opt, 0, sizeof(struct ipv6_txoptions));
1154 opt->tot_len = sizeof(*opt); 1154 opt->tot_len = sizeof(*opt);
1155 1155
1156 err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt, 1156 err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
1157 &hlimit, &tclass, &dontfrag); 1157 &hlimit, &tclass, &dontfrag);
1158 if (err < 0) { 1158 if (err < 0) {
1159 fl6_sock_release(flowlabel); 1159 fl6_sock_release(flowlabel);
1160 return err; 1160 return err;
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 1a9f3723c13c..2ac884d0e89b 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -168,6 +168,51 @@ l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
168 168
169} 169}
170 170
171/* Lookup the tunnel socket, possibly involving the fs code if the socket is
172 * owned by userspace. A struct sock returned from this function must be
173 * released using l2tp_tunnel_sock_put once you're done with it.
174 */
175struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
176{
177 int err = 0;
178 struct socket *sock = NULL;
179 struct sock *sk = NULL;
180
181 if (!tunnel)
182 goto out;
183
184 if (tunnel->fd >= 0) {
185 /* Socket is owned by userspace, who might be in the process
186 * of closing it. Look the socket up using the fd to ensure
187 * consistency.
188 */
189 sock = sockfd_lookup(tunnel->fd, &err);
190 if (sock)
191 sk = sock->sk;
192 } else {
193 /* Socket is owned by kernelspace */
194 sk = tunnel->sock;
195 }
196
197out:
198 return sk;
199}
200EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_lookup);
201
202/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
203void l2tp_tunnel_sock_put(struct sock *sk)
204{
205 struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
206 if (tunnel) {
207 if (tunnel->fd >= 0) {
208 /* Socket is owned by userspace */
209 sockfd_put(sk->sk_socket);
210 }
211 sock_put(sk);
212 }
213}
214EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_put);
215
171/* Lookup a session by id in the global session list 216/* Lookup a session by id in the global session list
172 */ 217 */
173static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id) 218static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
@@ -1123,8 +1168,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
1123 struct udphdr *uh; 1168 struct udphdr *uh;
1124 struct inet_sock *inet; 1169 struct inet_sock *inet;
1125 __wsum csum; 1170 __wsum csum;
1126 int old_headroom;
1127 int new_headroom;
1128 int headroom; 1171 int headroom;
1129 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 1172 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1130 int udp_len; 1173 int udp_len;
@@ -1136,16 +1179,12 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
1136 */ 1179 */
1137 headroom = NET_SKB_PAD + sizeof(struct iphdr) + 1180 headroom = NET_SKB_PAD + sizeof(struct iphdr) +
1138 uhlen + hdr_len; 1181 uhlen + hdr_len;
1139 old_headroom = skb_headroom(skb);
1140 if (skb_cow_head(skb, headroom)) { 1182 if (skb_cow_head(skb, headroom)) {
1141 kfree_skb(skb); 1183 kfree_skb(skb);
1142 return NET_XMIT_DROP; 1184 return NET_XMIT_DROP;
1143 } 1185 }
1144 1186
1145 new_headroom = skb_headroom(skb);
1146 skb_orphan(skb); 1187 skb_orphan(skb);
1147 skb->truesize += new_headroom - old_headroom;
1148
1149 /* Setup L2TP header */ 1188 /* Setup L2TP header */
1150 session->build_header(session, __skb_push(skb, hdr_len)); 1189 session->build_header(session, __skb_push(skb, hdr_len));
1151 1190
@@ -1607,6 +1646,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
1607 tunnel->old_sk_destruct = sk->sk_destruct; 1646 tunnel->old_sk_destruct = sk->sk_destruct;
1608 sk->sk_destruct = &l2tp_tunnel_destruct; 1647 sk->sk_destruct = &l2tp_tunnel_destruct;
1609 tunnel->sock = sk; 1648 tunnel->sock = sk;
1649 tunnel->fd = fd;
1610 lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock"); 1650 lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
1611 1651
1612 sk->sk_allocation = GFP_ATOMIC; 1652 sk->sk_allocation = GFP_ATOMIC;
@@ -1642,24 +1682,32 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1642 */ 1682 */
1643int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) 1683int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
1644{ 1684{
1645 int err = 0; 1685 int err = -EBADF;
1646 struct socket *sock = tunnel->sock ? tunnel->sock->sk_socket : NULL; 1686 struct socket *sock = NULL;
1687 struct sock *sk = NULL;
1688
1689 sk = l2tp_tunnel_sock_lookup(tunnel);
1690 if (!sk)
1691 goto out;
1692
1693 sock = sk->sk_socket;
1694 BUG_ON(!sock);
1647 1695
1648 /* Force the tunnel socket to close. This will eventually 1696 /* Force the tunnel socket to close. This will eventually
1649 * cause the tunnel to be deleted via the normal socket close 1697 * cause the tunnel to be deleted via the normal socket close
1650 * mechanisms when userspace closes the tunnel socket. 1698 * mechanisms when userspace closes the tunnel socket.
1651 */ 1699 */
1652 if (sock != NULL) { 1700 err = inet_shutdown(sock, 2);
1653 err = inet_shutdown(sock, 2);
1654 1701
1655 /* If the tunnel's socket was created by the kernel, 1702 /* If the tunnel's socket was created by the kernel,
1656 * close the socket here since the socket was not 1703 * close the socket here since the socket was not
1657 * created by userspace. 1704 * created by userspace.
1658 */ 1705 */
1659 if (sock->file == NULL) 1706 if (sock->file == NULL)
1660 err = inet_release(sock); 1707 err = inet_release(sock);
1661 }
1662 1708
1709 l2tp_tunnel_sock_put(sk);
1710out:
1663 return err; 1711 return err;
1664} 1712}
1665EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); 1713EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 56d583e083a7..e62204cad4fe 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -188,7 +188,8 @@ struct l2tp_tunnel {
188 int (*recv_payload_hook)(struct sk_buff *skb); 188 int (*recv_payload_hook)(struct sk_buff *skb);
189 void (*old_sk_destruct)(struct sock *); 189 void (*old_sk_destruct)(struct sock *);
190 struct sock *sock; /* Parent socket */ 190 struct sock *sock; /* Parent socket */
191 int fd; 191 int fd; /* Parent fd, if tunnel socket
192 * was created by userspace */
192 193
193 uint8_t priv[0]; /* private data */ 194 uint8_t priv[0]; /* private data */
194}; 195};
@@ -228,6 +229,8 @@ out:
228 return tunnel; 229 return tunnel;
229} 230}
230 231
232extern struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel);
233extern void l2tp_tunnel_sock_put(struct sock *sk);
231extern struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id); 234extern struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id);
232extern struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth); 235extern struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth);
233extern struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname); 236extern struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname);
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 927547171bc7..8ee4a86ae996 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -554,8 +554,8 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
554 memset(opt, 0, sizeof(struct ipv6_txoptions)); 554 memset(opt, 0, sizeof(struct ipv6_txoptions));
555 opt->tot_len = sizeof(struct ipv6_txoptions); 555 opt->tot_len = sizeof(struct ipv6_txoptions);
556 556
557 err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt, 557 err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
558 &hlimit, &tclass, &dontfrag); 558 &hlimit, &tclass, &dontfrag);
559 if (err < 0) { 559 if (err < 0) {
560 fl6_sock_release(flowlabel); 560 fl6_sock_release(flowlabel);
561 return err; 561 return err;
@@ -646,7 +646,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
646 struct msghdr *msg, size_t len, int noblock, 646 struct msghdr *msg, size_t len, int noblock,
647 int flags, int *addr_len) 647 int flags, int *addr_len)
648{ 648{
649 struct inet_sock *inet = inet_sk(sk); 649 struct ipv6_pinfo *np = inet6_sk(sk);
650 struct sockaddr_l2tpip6 *lsa = (struct sockaddr_l2tpip6 *)msg->msg_name; 650 struct sockaddr_l2tpip6 *lsa = (struct sockaddr_l2tpip6 *)msg->msg_name;
651 size_t copied = 0; 651 size_t copied = 0;
652 int err = -EOPNOTSUPP; 652 int err = -EOPNOTSUPP;
@@ -688,8 +688,8 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
688 lsa->l2tp_scope_id = IP6CB(skb)->iif; 688 lsa->l2tp_scope_id = IP6CB(skb)->iif;
689 } 689 }
690 690
691 if (inet->cmsg_flags) 691 if (np->rxopt.all)
692 ip_cmsg_recv(msg, skb); 692 ip6_datagram_recv_ctl(sk, msg, skb);
693 693
694 if (flags & MSG_TRUNC) 694 if (flags & MSG_TRUNC)
695 copied = skb->len; 695 copied = skb->len;
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 286366ef8930..716605c241f4 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -388,8 +388,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
388 struct l2tp_session *session; 388 struct l2tp_session *session;
389 struct l2tp_tunnel *tunnel; 389 struct l2tp_tunnel *tunnel;
390 struct pppol2tp_session *ps; 390 struct pppol2tp_session *ps;
391 int old_headroom;
392 int new_headroom;
393 int uhlen, headroom; 391 int uhlen, headroom;
394 392
395 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 393 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
@@ -408,7 +406,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
408 if (tunnel == NULL) 406 if (tunnel == NULL)
409 goto abort_put_sess; 407 goto abort_put_sess;
410 408
411 old_headroom = skb_headroom(skb);
412 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 409 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
413 headroom = NET_SKB_PAD + 410 headroom = NET_SKB_PAD +
414 sizeof(struct iphdr) + /* IP header */ 411 sizeof(struct iphdr) + /* IP header */
@@ -418,9 +415,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
418 if (skb_cow_head(skb, headroom)) 415 if (skb_cow_head(skb, headroom))
419 goto abort_put_sess_tun; 416 goto abort_put_sess_tun;
420 417
421 new_headroom = skb_headroom(skb);
422 skb->truesize += new_headroom - old_headroom;
423
424 /* Setup PPP header */ 418 /* Setup PPP header */
425 __skb_push(skb, sizeof(ppph)); 419 __skb_push(skb, sizeof(ppph));
426 skb->data[0] = ppph[0]; 420 skb->data[0] = ppph[0];
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index a9327e2e48ce..670cbc3518de 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -35,10 +35,11 @@
35/* Must be called with rcu_read_lock. */ 35/* Must be called with rcu_read_lock. */
36static void netdev_port_receive(struct vport *vport, struct sk_buff *skb) 36static void netdev_port_receive(struct vport *vport, struct sk_buff *skb)
37{ 37{
38 if (unlikely(!vport)) { 38 if (unlikely(!vport))
39 kfree_skb(skb); 39 goto error;
40 return; 40
41 } 41 if (unlikely(skb_warn_if_lro(skb)))
42 goto error;
42 43
43 /* Make our own copy of the packet. Otherwise we will mangle the 44 /* Make our own copy of the packet. Otherwise we will mangle the
44 * packet for anyone who came before us (e.g. tcpdump via AF_PACKET). 45 * packet for anyone who came before us (e.g. tcpdump via AF_PACKET).
@@ -50,6 +51,10 @@ static void netdev_port_receive(struct vport *vport, struct sk_buff *skb)
50 51
51 skb_push(skb, ETH_HLEN); 52 skb_push(skb, ETH_HLEN);
52 ovs_vport_receive(vport, skb); 53 ovs_vport_receive(vport, skb);
54 return;
55
56error:
57 kfree_skb(skb);
53} 58}
54 59
55/* Called with rcu_read_lock and bottom-halves disabled. */ 60/* Called with rcu_read_lock and bottom-halves disabled. */
@@ -169,9 +174,6 @@ static int netdev_send(struct vport *vport, struct sk_buff *skb)
169 goto error; 174 goto error;
170 } 175 }
171 176
172 if (unlikely(skb_warn_if_lro(skb)))
173 goto error;
174
175 skb->dev = netdev_vport->dev; 177 skb->dev = netdev_vport->dev;
176 len = skb->len; 178 len = skb->len;
177 dev_queue_xmit(skb); 179 dev_queue_xmit(skb);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e639645e8fec..c111bd0e083a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2361,13 +2361,15 @@ static int packet_release(struct socket *sock)
2361 2361
2362 packet_flush_mclist(sk); 2362 packet_flush_mclist(sk);
2363 2363
2364 memset(&req_u, 0, sizeof(req_u)); 2364 if (po->rx_ring.pg_vec) {
2365 2365 memset(&req_u, 0, sizeof(req_u));
2366 if (po->rx_ring.pg_vec)
2367 packet_set_ring(sk, &req_u, 1, 0); 2366 packet_set_ring(sk, &req_u, 1, 0);
2367 }
2368 2368
2369 if (po->tx_ring.pg_vec) 2369 if (po->tx_ring.pg_vec) {
2370 memset(&req_u, 0, sizeof(req_u));
2370 packet_set_ring(sk, &req_u, 1, 1); 2371 packet_set_ring(sk, &req_u, 1, 1);
2372 }
2371 2373
2372 fanout_release(sk); 2374 fanout_release(sk);
2373 2375
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 298c0ddfb57e..3d2acc7a9c80 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -438,18 +438,18 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
438 if (q->rate) { 438 if (q->rate) {
439 struct sk_buff_head *list = &sch->q; 439 struct sk_buff_head *list = &sch->q;
440 440
441 delay += packet_len_2_sched_time(skb->len, q);
442
443 if (!skb_queue_empty(list)) { 441 if (!skb_queue_empty(list)) {
444 /* 442 /*
445 * Last packet in queue is reference point (now). 443 * Last packet in queue is reference point (now),
446 * First packet in queue is already in flight, 444 * calculate this time bonus and subtract
447 * calculate this time bonus and substract
448 * from delay. 445 * from delay.
449 */ 446 */
450 delay -= now - netem_skb_cb(skb_peek(list))->time_to_send; 447 delay -= netem_skb_cb(skb_peek_tail(list))->time_to_send - now;
448 delay = max_t(psched_tdiff_t, 0, delay);
451 now = netem_skb_cb(skb_peek_tail(list))->time_to_send; 449 now = netem_skb_cb(skb_peek_tail(list))->time_to_send;
452 } 450 }
451
452 delay += packet_len_2_sched_time(skb->len, q);
453 } 453 }
454 454
455 cb->time_to_send = now + delay; 455 cb->time_to_send = now + delay;
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 159b9bc5d633..d8420ae614dc 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -71,7 +71,7 @@ void sctp_auth_key_put(struct sctp_auth_bytes *key)
71 return; 71 return;
72 72
73 if (atomic_dec_and_test(&key->refcnt)) { 73 if (atomic_dec_and_test(&key->refcnt)) {
74 kfree(key); 74 kzfree(key);
75 SCTP_DBG_OBJCNT_DEC(keys); 75 SCTP_DBG_OBJCNT_DEC(keys);
76 } 76 }
77} 77}
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 17a001bac2cc..1a9c5fb77310 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -249,6 +249,8 @@ void sctp_endpoint_free(struct sctp_endpoint *ep)
249/* Final destructor for endpoint. */ 249/* Final destructor for endpoint. */
250static void sctp_endpoint_destroy(struct sctp_endpoint *ep) 250static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
251{ 251{
252 int i;
253
252 SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return); 254 SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return);
253 255
254 /* Free up the HMAC transform. */ 256 /* Free up the HMAC transform. */
@@ -271,6 +273,9 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
271 sctp_inq_free(&ep->base.inqueue); 273 sctp_inq_free(&ep->base.inqueue);
272 sctp_bind_addr_free(&ep->base.bind_addr); 274 sctp_bind_addr_free(&ep->base.bind_addr);
273 275
276 for (i = 0; i < SCTP_HOW_MANY_SECRETS; ++i)
277 memset(&ep->secret_key[i], 0, SCTP_SECRET_SIZE);
278
274 /* Remove and free the port */ 279 /* Remove and free the port */
275 if (sctp_sk(ep->base.sk)->bind_hash) 280 if (sctp_sk(ep->base.sk)->bind_hash)
276 sctp_put_port(ep->base.sk); 281 sctp_put_port(ep->base.sk);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9e65758cb038..cedd9bf67b8c 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3390,7 +3390,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
3390 3390
3391 ret = sctp_auth_set_key(sctp_sk(sk)->ep, asoc, authkey); 3391 ret = sctp_auth_set_key(sctp_sk(sk)->ep, asoc, authkey);
3392out: 3392out:
3393 kfree(authkey); 3393 kzfree(authkey);
3394 return ret; 3394 return ret;
3395} 3395}
3396 3396
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 0a148c9d2a5c..0f679df7d072 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -465,7 +465,7 @@ static int svc_udp_get_dest_address4(struct svc_rqst *rqstp,
465} 465}
466 466
467/* 467/*
468 * See net/ipv6/datagram.c : datagram_recv_ctl 468 * See net/ipv6/datagram.c : ip6_datagram_recv_ctl
469 */ 469 */
470static int svc_udp_get_dest_address6(struct svc_rqst *rqstp, 470static int svc_udp_get_dest_address6(struct svc_rqst *rqstp,
471 struct cmsghdr *cmh) 471 struct cmsghdr *cmh)
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 01592d7d4789..45f1618c8e23 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1358,7 +1358,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
1358 &iwe, IW_EV_UINT_LEN); 1358 &iwe, IW_EV_UINT_LEN);
1359 } 1359 }
1360 1360
1361 buf = kmalloc(30, GFP_ATOMIC); 1361 buf = kmalloc(31, GFP_ATOMIC);
1362 if (buf) { 1362 if (buf) {
1363 memset(&iwe, 0, sizeof(iwe)); 1363 memset(&iwe, 0, sizeof(iwe));
1364 iwe.cmd = IWEVCUSTOM; 1364 iwe.cmd = IWEVCUSTOM;
generated by cgit v1.2.2 (git 2.25.0) at 2025-02-27 10:59:42 -0500