aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* bnx2x: Spelling mistakesEilon Greenstein2008-08-13
| | | | | | | | Spelling mistakes Spelling has to L's in it... Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Minor code improvementsEilon Greenstein2008-08-13
| | | | | | | | | | | | | | | Minor code improvements Small changes to make the code a little bit more efficient and mostly more readable: - Using unified macros for EMAC_RD/WR which looks like normal REG_RD/WR - Removing the NIG_WR since it did nothing and was only confusing - On bnx2x_panic_dump, print only the used parts of the rings - define parameters only on the branch they are needed and not at the beginning of the function - using NETIF_MSG_INTR and not private BNX2X_MSG_SP for debug prints Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Driver infoEilon Greenstein2008-08-13
| | | | | | | | | | | Driver info The internal FW which is downloaded by the driver should not be displayed - it is only causing confusion and it is redundant since it can be concluded from the driver version. Display only FW which is burned on the board nvram Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: 1G LED does not turn offEilon Greenstein2008-08-13
| | | | | | | | 1G LED does not turn off The 1G LED was not switched to off when the link was lost Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: 8073 PHY changesYaniv Rosner2008-08-13
| | | | | | | | | | | | | 8073 PHY changes The initial support we had for this PHY needs some serious changing. The major change is that this PHY should be initialized only when the first function is loaded and not for each function. The official SPI-ROM of this PHY was released and it requires some changes in the initialization code as well Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Change GPIO for any portEilon Greenstein2008-08-13
| | | | | | | | | | Change GPIO for any port The set GPIO function should receive the port index to allow changing the GPIO of another port. This is needed for the common init phase (one the first driver is loaded for the chip) Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Pause settingsYaniv Rosner2008-08-13
| | | | | | | | | | | | | | | | Pause settings - 1G pause was not working due to missing write to the emac block (TX_MODE_FLOW_EN) - The flow control should use the negotiated result (after autoneg) so we should save both the requested autoneg and the result - The HW credits with flow control at 1G speed were not optimized and caused low throughput - It is recommended to turn off flow control if the MTU is bigger than 5000B due to internal buffers size Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Link order with external PHYYaniv Rosner2008-08-13
| | | | | | | | | | | | | | Link order with external PHY When external PHY exists (second chip with the PHY to translate to another physical medium) the link with the eternal PHY and the network should be established before setting the link between the 5771x and the PHY. This is the right order and it is important when using autoneg - the link to the network should use the autoneg and the link between the two chips should be forced to the network result. Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: No LRO without Rx checksumVladislav Zolotarov2008-08-13
| | | | | | | | | No LRO without Rx checksum Disabling LRO when Rx checksum is disabled Signed-off-by: Vladislav Zolotarov <vladz@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Wrong structure sizeYitchak Gertner2008-08-13
| | | | | | | | | | Wrong structure size The wrong structure was used in the sizeof to clear (luckily both structures have the same size in this version...) Signed-off-by: Yitchak Gertner <gertner@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: WoL capabilityEilon Greenstein2008-08-13
| | | | | | | | | WoL capability All designs reported WoL capability regardless of HW limitations - check if this device is actually capable of WoL Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Clearing MAC addresses filtersYitchak Gertner2008-08-13
| | | | | | | | | | | Clearing MAC addresses filters When the driver unloads, it should clear the MAC addresses filters in the HW - this prevents packets from entering the chip when the driver is re-loaded before initializing the right filters Signed-off-by: Yitchak Gertner <gertner@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Delay in while loopsYitchak Gertner2008-08-13
| | | | | | | | | | Delay in while loops The delay in the loop should be after the change. This has very little effect (can save one delay) but it is the right thing to do Signed-off-by: Yitchak Gertner <gertner@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: PBA Table Page Alignment WorkaroundEilon Greenstein2008-08-13
| | | | | | | | | | PBA Table Page Alignment Workaround The PBA table starts on the middle of the page and that's causing very low performance with virtualization. The solution is not to update via the BAR directly but via chip access to the same memory Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Self-test false positiveYitchak Gertner2008-08-13
| | | | | | | | | | | Self-test false positive - The memory test should use a mask according to the chip type - In the register test, check the port only once and not inside the for loop (not causing a failure - just ugly) Signed-off-by: Yitchak Gertner <gertner@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Memory allocationEilon Greenstein2008-08-13
| | | | | | | | | | | Memory allocation - The CQE ring was allocated to the max size even for a chip that does not support it. Fixed to allocate according to the chip type to save memory - The rx_page_ring was not freed on driver unload Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: HW attention lockEilon Greenstein2008-08-13
| | | | | | | | | HW attention lock Making sure that only one function will handle the HW attention. This makes the device parameter aeu_mask redundant so it is removed Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: HW lock mechanismYitchak Gertner2008-08-13
| | | | | | | | | | | | HW lock mechanism Enhancing the HW lock to work per function and not only per port - this is needed for the next patch that protects races over HW attention detection between the different functions. At this chance, changing the functions names to be more inline with the current naming convention Signed-off-by: Yitchak Gertner <gertner@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Load/Unload under trafficVladislav Zolotarov2008-08-13
| | | | | | | | | | | | | | | | | | | | | | | Load/Unload under traffic Few issues were found when loading and unloading under traffic: - When receiving Tx interrupt call netif_wake_queue if the queue is stopped but the state is open - Check that interrupts are enabled before doing anything else on the msix_fp_int function - In nic_load, enable the interrupts only when needed and ready for it - Function stop_leading returns status since it can fail - Add 1ms delay when unloading the driver to validate that there are no open transactions that already started by the FW - Splitting the "has work" function into Tx and Rx so the same function will be used on unload and interrupts - Do not request for WoL if only resetting the device (save the time that it takes the FW to set the link after reset) - Fixing the device reset after iSCSI boot and before driver load - all internal buffers must be cleared before the driver is loaded Signed-off-by: Vladislav Zolotarov <vladz@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: FW Internal Memory structureEilon Greenstein2008-08-13
| | | | | | | | | | | | FW Internal Memory structure The FW uses data structures on the chip internal memory to aggregate the connections when TPA is enabled. The driver was clearing the wrong offsets and therefore one function could cause another function to loose packets. Changing the initialization of the chip internal memory to clear only the relevant memory for each function which is being loaded Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: StatisticsYitchak Gertner2008-08-13
| | | | | | | | | | | | | | | | | Statistics - Making sure that each drop is accounted for in the driver statistics - Clearing the FW statistics when driver is loaded to prevent inconsistency with HW statistics - Once error is detected (bnx2x_panic_dump), stop the statistics before other actions (currently it is stopped last and can corrupt the data) - Adding HW checksum error counter to the statistics - Removing unused variable stats_ticks - Using macros instead of magic numbers to indicate which statistics are shared per port and which are per function Signed-off-by: Yitchak Gertner <gertner@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: Not dropping packets with L3/L4 checksum errorEilon Greenstein2008-08-13
| | | | | | | | | Not dropping packets with L3/L4 checksum error Those packets should be passed to the OS. The problem is clear in forwarding mode. Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bnx2x: FW (bootcode) interface fixesEilon Greenstein2008-08-13
| | | | | | | | | | | | | FW (bootcode) interface fixes - Making sure that the device will not cause kernel panic of the bootcode is corrupted or missing - Removing module debug parameter "nomcp" since no one should work without the bootcode (this is a left over from the chip bring up days) - Instead of waiting fix amount of time for bootcode response, sample it every 10ms (usually the answer is ready after less than 10ms) Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* pkt_sched: Protect gen estimators under est_lock.Jarek Poplawski2008-08-13
| | | | | | | | gen_kill_estimator() required rtnl_lock() protection, but since it is moved to an RCU callback __qdisc_destroy() let's use est_lock instead. Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* pkt_sched: Fix queue quiescence testing in dev_deactivate().David S. Miller2008-08-13
| | | | | | | | | | | | | | | | | | | Based upon discussions with Jarek P. and Herbert Xu. First, we're testing the wrong qdisc. We just reset the device queue qdiscs to &noop_qdisc and checking it's state is completely pointless here. We want to wait until the previous qdisc that was sitting at the ->qdisc pointer is not busy any more. And that would be ->qdisc_sleeping. Because of how we propagate the samples qdisc pointer down into qdisc_run and friends via per-cpu ->output_queue and netif_schedule, we have to wait also for the __QDISC_STATE_SCHED bit to clear as well. Signed-off-by: David S. Miller <davem@davemloft.net>
* pkt_sched: Fix oops in htb_delete.Jarek Poplawski2008-08-13
| | | | | | | | | Recent changes introduced a bug in htb_delete(): cl->parent->children counter update misses checking cl->parent for NULL, which is used for root classes, so deleting them causes an oops. Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* pktgen: prevent pktgen from using bad tx queueAndrew Gallatin2008-08-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the new multi-queue transmit code, it is possible to accidentally make pktgen pick a non-existing tx queue simply by using a stale script to drive pktgen. Access to this non-existing tx queue will then trigger a bad memory access and kill the machine. For example, setting "queue_map_max 2" will cause my machine to die when accessing a garbage spinlock in the non-existing tx queue: BUG: spinlock bad magic on CPU#0, kpktgend_0/564 lock: ffff88001ddf6718, .magic: ffffffff, .owner: /-1, .owner_cpu: 0 Pid: 564, comm: kpktgend_0 Not tainted 2.6.27-rc3 #35 Call Trace: [<ffffffff803a1228>] spin_bug+0xa4/0xac [<ffffffff803a1253>] _raw_spin_lock+0x23/0x123 [<ffffffff8055b06f>] _spin_lock_bh+0x17/0x1b [<ffffffff804cb57d>] pktgen_thread_worker+0xa97/0x1002 [<ffffffff8022874d>] ? finish_task_switch+0x38/0x97 [<ffffffff80242077>] ? autoremove_wake_function+0x0/0x36 [<ffffffff80242077>] ? autoremove_wake_function+0x0/0x36 [<ffffffff804caae6>] ? pktgen_thread_worker+0x0/0x1002 [<ffffffff80241a40>] kthread+0x44/0x6d [<ffffffff8020c399>] child_rip+0xa/0x11 [<ffffffff802419fc>] ? kthread+0x0/0x6d [<ffffffff8020c38f>] ? child_rip+0x0/0x11 The attached patch adds some sanity checking to prevent these sorts of configuration errors. Signed-off-by: Andrew Gallatin <gallatin@myri.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* dccp: change L/R must have at least one byte in the dccpsf_val fieldArnaldo Carvalho de Melo2008-08-13
| | | | | | | | | Thanks to Eugene Teo for reporting this problem. Signed-off-by: Eugene Teo <eugenete@kernel.sg> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
* xfrm: remove unnecessary variable in xfrm_output_resume() 2nd tryJean-Christophe DUBOIS2008-08-13
| | | | | | | Small fix removing an unnecessary intermediate variable. Signed-off-by: Jean-Christophe DUBOIS <jcd@tribudubois.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* net-sched: fix Action flushing return codeJamal Hadi Salim2008-08-13
| | | | | | | Flushing must consistently return ENOMEM on failure of any allocation Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca> Signed-off-by: David S. Miller <davem@davemloft.net>
* net-sched: Fix actions flushingJamal Hadi Salim2008-08-13
| | | | | | | | | Flushing of actions has been broken since we changed the semantics of netlink parsed tb[X] to mean X is an attribute type. This makes the flushing work. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca> Signed-off-by: David S. Miller <davem@davemloft.net>
* net/rxrpc: Use an IS_ERR test rather than a NULL testJulien Brunel2008-08-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In case of error, the function rxrpc_get_transport returns an ERR pointer, but never returns a NULL pointer. So after a call to this function, a NULL test should be replaced by an IS_ERR test. A simplified version of the semantic patch that makes this change is as follows: (http://www.emn.fr/x-info/coccinelle/) // <smpl> @correct_null_test@ expression x,E; statement S1, S2; @@ x = rxrpc_get_transport(...) <... when != x = E if ( ( - x@p2 != NULL + ! IS_ERR ( x ) | - x@p2 == NULL + IS_ERR( x ) ) ) S1 else S2 ...> ? x = E; // </smpl> Signed-off-by: Julien Brunel <brunel@diku.dk> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: David S. Miller <davem@davemloft.net>
* wext: Send name on eventsJamal Hadi Salim2008-08-13
| | | | | | | | In the minimal the wireless extensions oughta send at least the name in addition to the ifindex. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca> Signed-off-by: David S. Miller <davem@davemloft.net>
* ipv6: Kill unused ip6_prohibit_entry and ip6_blk_hole_entry declarations.Rami Rosen2008-08-13
| | | | | | | | This patch removes ip6_prohibit_entry and ip6_blk_hole_entry declarations from include/net/ip6_route.h as they are unused. Signed-off-by: Rami Rosen <ramirose@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ipv6: ip6_route.h cleanup.Rami Rosen2008-08-13
| | | | | | | | This patch removes rt6_lock declaration from include/net/ip6_route.h as it is unused. Signed-off-by: Rami Rosen <ramirose@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net/tipc/subscr.c: don't use ___constant_swab32Andrew Morton2008-08-13
| | | | | | | | | | | It's an internal implementation detail which we _should_ be free to change. So we did, and it promptly broke. The compiler shold be able to work out when to use the __constant version anyway. Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* pkt_sched: Add queue stopped test back to qdisc_run().David S. Miller2008-08-13
| | | | | | | | | | | | | | | | | Based upon a bug report by Andrew Gallatin on netdev with subject "CPU utilization increased in 2.6.27rc" In commit 37437bb2e1ae8af470dfcd5b4ff454110894ccaf ("pkt_sched: Schedule qdiscs instead of netdev_queue.") the test of the queue being stopped was erroneously removed from qdisc_run(). When the TX queue of the device fills up, this omission causes lots of extraneous useless work to be queued up to softirq context, where we'll just return immediately because the device is still stuffed up. Signed-off-by: David S. Miller <davem@davemloft.net>
* ipv6: Fix OOPS, ip -f inet6 route get fec0::1, linux-2.6.26, ↵Brian Haley2008-08-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ip6_route_output, rt6_fill_node+0x175 Alexey Dobriyan wrote: > On Thu, Aug 07, 2008 at 07:00:56PM +0200, John Gumb wrote: >> Scenario: no ipv6 default route set. > >> # ip -f inet6 route get fec0::1 >> >> BUG: unable to handle kernel NULL pointer dereference at 00000000 >> IP: [<c0369b85>] rt6_fill_node+0x175/0x3b0 >> EIP is at rt6_fill_node+0x175/0x3b0 > > 0xffffffff80424dd3 is in rt6_fill_node (net/ipv6/route.c:2191). > 2186 } else > 2187 #endif > 2188 NLA_PUT_U32(skb, RTA_IIF, iif); > 2189 } else if (dst) { > 2190 struct in6_addr saddr_buf; > 2191 ====> if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev, > ^^^^^^^^^^^^^^^^^^^^^^^^ > NULL > > 2192 dst, 0, &saddr_buf) == 0) > 2193 NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf); > 2194 } The commit that changed this can't be reverted easily, but the patch below works for me. Fix NULL de-reference in rt6_fill_node() when there's no IPv6 input device present in the dst entry. Signed-off-by: Brian Haley <brian.haley@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* skbuff: Code readability NiTGerrit Renker2008-08-11
| | | | | | | | Inserting a space between the `-' improved the C readability (some languages allow hyphens within functions and variable names, which is confusing). Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
* pkt_sched: Add BH protection for qdisc_stab_lock.Jarek Poplawski2008-08-11
| | | | | | | | | Since qdisc_stab_lock is used in qdisc_put_stab(), which is called in BH context from __qdisc_destroy() RCU callback, softirq safe locking is needed. Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'stealer/ipvs/for-davem' of git://git.stealer.net/linux-2.6David S. Miller2008-08-11
|\
| * ipvs: Explictly clear ip_vs_stats membersSimon Horman2008-08-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to align the coding styles of ip_vs_zero_stats() and its child-function ip_vs_zero_estimator(), clear ip_vs_stats members explicitlty rather than doing a limited memset(). This was chosen over modifying ip_vs_zero_estimator() to use memset() as it is more robust against changes in members in the relevant structures. memset() would be prefered if all members of the structure were to be cleared. Cc: Sven Wegener <sven.wegener@stealer.net> Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
| * ipvs: No need to zero out ip_vs_stats during initializationSven Wegener2008-08-11
| | | | | | | | | | | | | | | | It's a global variable and automatically initialized to zero. And now we can also initialize the lock at compile time. Signed-off-by: Sven Wegener <sven.wegener@stealer.net> Acked-by: Simon Horman <horms@verge.net.au>
| * ipvs: Embed estimator object into stats objectSven Wegener2008-08-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's no reason for dynamically allocating an estimator object for every stats object. Directly embed an estimator object into every stats object and switch to using the kernel-provided list implementation. This makes the code much simpler and faster, as we do not need to traverse the list of all estimators to find the one belonging to a stats object. There's no need to use an rwlock, as we only have one reader. Also reorder the members of the estimator structure slightly to avoid padding overhead. This can't be done with the stats object as the members are currently copied to our user space object via memcpy() and changing it would break ABI. Signed-off-by: Sven Wegener <sven.wegener@stealer.net> Acked-by: Simon Horman <horms@verge.net.au>
| * ipvs: Mark net_vs_ctl_path constSven Wegener2008-08-11
| | | | | | | | | | Signed-off-by: Sven Wegener <sven.wegener@stealer.net> Acked-by: Simon Horman <horms@verge.net.au>
| * ipvs: Annotate init functions with __initSven Wegener2008-08-11
| | | | | | | | | | | | | | | | | | Being able to discard these functions saves a couple of bytes at runtime. The cleanup functions can't be annotated with __exit as they are also called from init functions. Signed-off-by: Sven Wegener <sven.wegener@stealer.net> Acked-by: Simon Horman <horms@verge.net.au>
| * ipvs: Initialize schedulers' struct list_head at compile timeSven Wegener2008-08-11
| | | | | | | | | | | | | | | | No need to do it at runtime and this saves a couple of bytes in the text section. Signed-off-by: Sven Wegener <sven.wegener@stealer.net> Acked-by: Simon Horman <horms@verge.net.au>
| * ipvs: Use list_empty() instead of open-coding the same functionalitySven Wegener2008-08-11
| | | | | | | | | | Signed-off-by: Sven Wegener <sven.wegener@stealer.net> Acked-by: Simon Horman <horms@verge.net.au>
| * ipvs: Use ARRAY_SIZE()Sven Wegener2008-08-11
| | | | | | | | | | Signed-off-by: Sven Wegener <sven.wegener@stealer.net> Acked-by: Simon Horman <horms@verge.net.au>
| * ipvs: Fix possible deadlock in estimator codeSven Wegener2008-08-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a slight chance for a deadlock in the estimator code. We can't call del_timer_sync() while holding our lock, as the timer might be active and spinning for the lock on another cpu. Work around this issue by using try_to_del_timer_sync() and releasing the lock. We could actually delete the timer outside of our lock, as the add and kill functions are only every called from userspace via [gs]etsockopt() and are serialized by a mutex, but better make this explicit. Signed-off-by: Sven Wegener <sven.wegener@stealer.net> Cc: stable <stable@kernel.org> Acked-by: Simon Horman <horms@verge.net.au>