aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2018-05-11sh: switch to NO_BOOTMEMRob Herring4-82/+7
Commit 0fa1c579349f ("of/fdt: use memblock_virt_alloc for early alloc") inadvertently switched the DT unflattening allocations from memblock to bootmem which doesn't work because the unflattening happens before bootmem is initialized. Swapping the order of bootmem init and unflattening could also fix this, but removing bootmem is desired. So enable NO_BOOTMEM on SH like other architectures have done. Fixes: 0fa1c579349f ("of/fdt: use memblock_virt_alloc for early alloc") Reported-by: Rich Felker <[email protected]> Cc: Yoshinori Sato <[email protected]> Signed-off-by: Rob Herring <[email protected]> Signed-off-by: Rich Felker <[email protected]>
2018-05-11mmap: introduce sane default mmap limitsLinus Torvalds1-0/+32
The internal VM "mmap()" interfaces are based on the mmap target doing everything using page indexes rather than byte offsets, because traditionally (ie 32-bit) we had the situation that the byte offset didn't fit in a register. So while the mmap virtual address was limited by the word size of the architecture, the backing store was not. So we're basically passing "pgoff" around as a page index, in order to be able to describe backing store locations that are much bigger than the word size (think files larger than 4GB etc). But while this all makes a ton of sense conceptually, we've been dogged by various drivers that don't really understand this, and internally work with byte offsets, and then try to work with the page index by turning it into a byte offset with "pgoff << PAGE_SHIFT". Which obviously can overflow. Adding the size of the mapping to it to get the byte offset of the end of the backing store just exacerbates the problem, and if you then use this overflow-prone value to check various limits of your device driver mmap capability, you're just setting yourself up for problems. The correct thing for drivers to do is to do their limit math in page indices, the way the interface is designed. Because the generic mmap code _does_ test that the index doesn't overflow, since that's what the mmap code really cares about. HOWEVER. Finding and fixing various random drivers is a sisyphean task, so let's just see if we can just make the core mmap() code do the limiting for us. Realistically, the only "big" backing stores we need to care about are regular files and block devices, both of which are known to do this properly, and which have nice well-defined limits for how much data they can access. So let's special-case just those two known cases, and then limit other random mmap users to a backing store that still fits in "unsigned long". Realistically, that's not much of a limit at all on 64-bit, and on 32-bit architectures the only worry might be the GPU drivers, which can have big physical address spaces. To make it possible for drivers like that to say that they are 64-bit clean, this patch does repurpose the "FMODE_UNSIGNED_OFFSET" bit in the file flags to allow drivers to mark their file descriptors as safe in the full 64-bit mmap address space. [ The timing for doing this is less than optimal, and this should really go in a merge window. But realistically, this needs wide testing more than it needs anything else, and being main-line is the only way to do that. So the earlier the better, even if it's outside the proper development cycle - Linus ] Cc: Kees Cook <[email protected]> Cc: Dan Carpenter <[email protected]> Cc: Al Viro <[email protected]> Cc: Willy Tarreau <[email protected]> Cc: Dave Airlie <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2018-05-11Merge tag 'pm-4.17-rc5' of ↵Linus Torvalds4-26/+31
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix two PCI power management regressions from the 4.13 cycle and one cpufreq schedutil governor bug introduced during the 4.12 cycle, drop a stale comment from the schedutil code and fix two mistakes in docs. Specifics: - Restore device_may_wakeup() check in pci_enable_wake() removed inadvertently during the 4.13 cycle to prevent systems from drawing excessive power when suspended or off, among other things (Rafael Wysocki). - Fix pci_dev_run_wake() to properly handle devices that only can signal PME# when in the D3cold power state (Kai Heng Feng). - Fix the schedutil cpufreq governor to avoid using UINT_MAX as the new CPU frequency in some cases due to a missing check (Rafael Wysocki). - Remove a stale comment regarding worker kthreads from the schedutil cpufreq governor (Juri Lelli). - Fix a copy-paste mistake in the intel_pstate driver documentation (Juri Lelli). - Fix a typo in the system sleep states documentation (Jonathan Neuschäfer)" * tag 'pm-4.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PCI / PM: Check device_may_wakeup() in pci_enable_wake() PCI / PM: Always check PME wakeup capability for runtime wakeup support cpufreq: schedutil: Avoid using invalid next_freq cpufreq: schedutil: remove stale comment PM: docs: intel_pstate: fix Active Mode w/o HWP paragraph PM: docs: sleep-states: Fix a typo ("includig")
2018-05-11Merge tag 'mtd/fixes-for-4.17-rc5' of git://git.infradead.org/linux-mtdLinus Torvalds3-70/+52
Pull mtd fixes from Boris Brezillon: - make nand_soft_waitrdy() wait tWB before polling the status REG - fix BCH write in the the Marvell NAND controller driver - fix wrong picosec to msec conversion in the Marvell NAND controller driver - fix DMA handling in the TI OneNAND controllre driver * tag 'mtd/fixes-for-4.17-rc5' of git://git.infradead.org/linux-mtd: mtd: rawnand: Make sure we wait tWB before polling the STATUS reg mtd: rawnand: marvell: fix command xtype in BCH write hook mtd: rawnand: marvell: pass ms delay to wait_op mtd: onenand: omap2: Disable DMA for HIGHMEM buffers
2018-05-11udp: avoid refcount_t saturation in __udp_gso_segment()Eric Dumazet1-3/+11
For some reason, Willem thought that the issue we fixed for TCP in commit 7ec318feeed1 ("tcp: gso: avoid refcount_t warning from tcp_gso_segment()") was not relevant for UDP GSO. But syzbot found its way. refcount_t: saturated; leaking memory. WARNING: CPU: 0 PID: 10261 at lib/refcount.c:78 refcount_add_not_zero+0x2d4/0x320 lib/refcount.c:78 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 10261 Comm: syz-executor5 Not tainted 4.17.0-rc3+ #38 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 panic+0x22f/0x4de kernel/panic.c:184 __warn.cold.8+0x163/0x1b3 kernel/panic.c:536 report_bug+0x252/0x2d0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x1de/0x490 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992 RIP: 0010:refcount_add_not_zero+0x2d4/0x320 lib/refcount.c:78 RSP: 0018:ffff880196db6b90 EFLAGS: 00010282 RAX: 0000000000000026 RBX: 00000000ffffff01 RCX: ffffc900040d9000 RDX: 0000000000004a29 RSI: ffffffff8160f6f1 RDI: ffff880196db66f0 RBP: ffff880196db6c78 R08: ffff8801b33d6740 R09: 0000000000000002 R10: ffff8801b33d6740 R11: 0000000000000000 R12: 0000000000000000 R13: 00000000ffffffff R14: ffff880196db6c50 R15: 0000000000020101 refcount_add+0x1b/0x70 lib/refcount.c:102 __udp_gso_segment+0xaa5/0xee0 net/ipv4/udp_offload.c:272 udp4_ufo_fragment+0x592/0x7a0 net/ipv4/udp_offload.c:301 inet_gso_segment+0x639/0x12b0 net/ipv4/af_inet.c:1342 skb_mac_gso_segment+0x3ad/0x720 net/core/dev.c:2792 __skb_gso_segment+0x3bb/0x870 net/core/dev.c:2865 skb_gso_segment include/linux/netdevice.h:4050 [inline] validate_xmit_skb+0x54d/0xd90 net/core/dev.c:3122 __dev_queue_xmit+0xbf8/0x34c0 net/core/dev.c:3579 dev_queue_xmit+0x17/0x20 net/core/dev.c:3620 neigh_direct_output+0x15/0x20 net/core/neighbour.c:1401 neigh_output include/net/neighbour.h:483 [inline] ip_finish_output2+0xa5f/0x1840 net/ipv4/ip_output.c:229 ip_finish_output+0x828/0xf80 net/ipv4/ip_output.c:317 NF_HOOK_COND include/linux/netfilter.h:277 [inline] ip_output+0x21b/0x850 net/ipv4/ip_output.c:405 dst_output include/net/dst.h:444 [inline] ip_local_out+0xc5/0x1b0 net/ipv4/ip_output.c:124 ip_send_skb+0x40/0xe0 net/ipv4/ip_output.c:1434 udp_send_skb.isra.37+0x5eb/0x1000 net/ipv4/udp.c:825 udp_push_pending_frames+0x5c/0xf0 net/ipv4/udp.c:853 udp_v6_push_pending_frames+0x380/0x3e0 net/ipv6/udp.c:1105 udp_lib_setsockopt+0x59a/0x600 net/ipv4/udp.c:2403 udpv6_setsockopt+0x95/0xa0 net/ipv6/udp.c:1447 sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3046 __sys_setsockopt+0x1bd/0x390 net/socket.c:1903 __do_sys_setsockopt net/socket.c:1914 [inline] __se_sys_setsockopt net/socket.c:1911 [inline] __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1911 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: ad405857b174 ("udp: better wmem accounting on gso") Signed-off-by: Eric Dumazet <[email protected]> Cc: Willem de Bruijn <[email protected]> Cc: Alexander Duyck <[email protected]> Reported-by: syzbot <[email protected]> Acked-by: Willem de Bruijn <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11Merge tag 'mlx5-fixes-2018-05-10' of ↵David S. Miller5-1/+52
git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2018-05-10 the following series includes some fixes for mlx5 core driver. Please pull and let me know if there's any problem. For -stable v4.5 ("net/mlx5: E-Switch, Include VF RDMA stats in vport statistics") For -stable v4.10 ("net/mlx5e: Err if asked to offload TC match on frag being first") ==================== Signed-off-by: David S. Miller <[email protected]>
2018-05-11tcp: switch pacing timer to softirq based hrtimerEric Dumazet3-46/+29
linux-4.16 got support for softirq based hrtimers. TCP can switch its pacing hrtimer to this variant, since this avoids going through a tasklet and some atomic operations. pacing timer logic looks like other (jiffies based) tcp timers. v2: use hrtimer_try_to_cancel() in tcp_clear_xmit_timers() to correctly release reference on socket if needed. Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11Merge tag 'drm-fixes-for-v4.17-rc5' of ↵Linus Torvalds37-158/+501
git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "nouveau, amdgpu, i915, vc4, omap, exynos and atomic fixes. As last week seemed a bit slow, we got a few more fixes this week. The main stuff is two weeks of fixes for amdgpu, some missing bits of vega12 atom firmware support were added, and some power management fixes. Nouveau got two regression fixes for an DP MST deadlock and a random oops fix. i915 got an LVDS panel timeout fix 2 WARN fixes. exynos fixed a pagefault issue in the mixer driver. vc4 has an oops fix. omap had a bunch of uninit var and error-checking fixes. Two atomic modesetting state fixes. One minor agp cleanup patch" * tag 'drm-fixes-for-v4.17-rc5' of git://people.freedesktop.org/~airlied/linux: (30 commits) drm/amd/pp: Fix performance drop on Fiji drm/nouveau: Fix deadlock in nv50_mstm_register_connector() drm/nouveau/ttm: don't dereference nvbo::cli, it can outlive client agp: uninorth: make two functions static drm/amd/pp: Refine the output of pp_power_profile_mode on VI drm/amdgpu: Switch to interruptable wait to recover from ring hang. drm/ttm: Use GFP_TRANSHUGE_LIGHT for allocating huge pages drm/amd/display: Use kvzalloc for potentially large allocations drm/amd/display: Don't return ddc result and read_bytes in same return value drm/amd/display: Add get_firmware_info_v3_2 for VG12 drm/amd: Add BIOS smu_info v3_3 required struct def. drm/amd/display: Add VG12 ASIC IDs drm/vc4: Fix scaling of uni-planar formats drm/exynos: hdmi: avoid duplicating drm_bridge_attach drm/i915: Fix drm:intel_enable_lvds ERROR message in kernel log drm/i915: Correctly populate user mode h/vdisplay with pipe src size during readout drm/i915: Adjust eDP's logical vco in a reliable place. drm/bridge/sii8620: add Kconfig dependency on extcon drm/omap: handle alloc failures in omap_connector drm/omap: add missing linefeeds to prints ...
2018-05-11Merge branch 'dsa-Plug-in-PHYLINK-support'David S. Miller9-207/+458
Florian Fainelli says: ==================== net: dsa: Plug in PHYLINK support This patch series adds PHYLINK support to DSA which is necessary to support more complex PHY and pluggable modules setups. Patch series can be found here: https://github.com/ffainelli/linux/commits/dsa-phylink-v2 This was tested on: - dsa-loop - bcm_sf2 - mv88e6xxx - b53 With a variety of test cases: - internal & external MDIO PHYs - MoCA with link notification through interrupt/MMIO register - built-in PHYs - ifconfig up/down for several cycles works - bind/unbind of the drivers Changes in v2: - fixed link configuration for mv88e6xxx (Andrew) after introducing polling This is technically v2 of what was posted back in March 2018, changes from last time: - fixed probe/remove of drivers - fixed missing gpiod_put() for link GPIOs - fixed polling of link GPIOs (Russell I would need your SoB on the patch you provided offline initially, added some modifications to it) - tested across a wider set of platforms And everything should still work as expected. Please be aware of the following: - switch drivers (like bcm_sf2) which may have user-facing network ports using fixed links would need to implement phylink_mac_ops to remain functional. PHYLINK does not create a phy_device for fixed links, therefore our call to adjust_link() from phylink_mac_link_{up,down} would not be calling into the driver. This *should not* affect CPU/DSA ports which are configured through adjust_link() but have no network devices - support for SFP/SFF is now possible, but switch drivers will still need some modifications to properly support those, including, but not limited to using the correct binding information. This will be submitted on top of this series Please do test on your respective platforms/switches and let me know if you find any issues, hopefully everything still works like before. ==================== Signed-off-by: David S. Miller <[email protected]>
2018-05-11net: dsa: bcm_sf2: Get rid of PHYLIB functionsFlorian Fainelli1-149/+0
Now that we have converted the bcm_sf2 driver to implement PHYLINK MAC operations, we can remove the PHYLIB callbacks: adjust_link() and fixed_link_update() which are no longer called by DSA. Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11net: dsa: Plug in PHYLINK supportFlorian Fainelli3-132/+172
Add support for PHYLINK within the DSA subsystem in order to support more complex devices such as pluggable (SFP) and non-pluggable (SFF) modules, 10G PHYs, and traditional PHYs. Using PHYLINK allows us to drop some amount of complexity we had while probing fixed and non-fixed PHYs using Device Tree. Because PHYLINK separates the Ethernet MAC/port configuration into different stages, we let switch drivers implement those, and for now, we maintain functionality by calling dsa_slave_adjust_link() during phylink_mac_link_{up,down} which provides semantically equivalent steps. Drivers willing to take advantage of PHYLINK should implement the phylink_mac_* operations that DSA wraps. We cannot quite remove the adjust_link() callback just yet, because a number of drivers rely on that for configuring their "CPU" and "DSA" ports, this is done dsa_port_setup_phy_of() and dsa_port_fixed_link_register_of() still. Drivers that utilize fixed links for user-facing ports (e.g: bcm_sf2) will need to implement phylink_mac_ops from now on to preserve functionality, since PHYLINK *does not* create a phy_device instance for fixed links. Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11net: dsa: mv88e6xxx: add PHYLINK supportRussell King3-0/+125
Add rudimentary phylink support to mv88e6xxx. This allows the driver using user ports with fixed links to keep operating normally. User ports with normal PHYs are not affected since the switch automatically manages their link parameters. User facing ports which use a SFP/SFF with a non-fixed link mode might require a call to phylink_mac_change() to operate properly. Signed-off-by: Russell King <[email protected]> [Andrew: fixed link setting after adding link polling] Signed-off-by: Andrew Lunn <[email protected]> [florian: expand commit message] Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11net: dsa: Eliminate dsa_slave_get_link()Florian Fainelli1-11/+1
Since we use PHYLIB to manage the per-port link indication, this will also be reflected correctly in the network device's carrier state, so we can use ethtool_op_get_link() instead. Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11net: dsa: bcm_sf2: Implement phylink_mac_opsFlorian Fainelli1-8/+206
Make the bcm_sf2 driver implement phylink_mac_ops since it needs to support a wide variety of network interfaces: internal & external MDIO PHYs, fixed PHYs, MoCA with MMIO link status. A large amount of what needs to be done already exists under bcm_sf2_sw_adjust_link() so we are essentially breaking this down into the necessary operation for PHYLINK to work: mac_config, mac_link_up, mac_link_down and validate. We can now entirely get rid of most of what fixed_link_update() provided because only the link information is actually necessary. We still have to force DUPLEX_FULL for legacy Device Tree bindings that did not specify that before. Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11net: dsa: Add PHYLINK switch operationsFlorian Fainelli3-1/+30
In preparation for adding support for PHYLINK within DSA, define a number of operations that we will need and that switch drivers can start implementing. Proper integration with PHYLINK will follow in subsequent patches. We start selecting PHYLINK (which implies PHYLIB) in net/dsa/Kconfig such that drivers can be guaranteed that this dependency is properly taken care of and can start referencing PHYLINK helper functions without requiring stubs or anything. Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11net: phy: phylink: Poll link GPIOsRussell King1-0/+16
When using a fixed link with a link GPIO, we need to poll that GPIO to determine link state changes. This is consistent with what fixed_phy.c does. Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11net: phy: phylink: Release link GPIOFlorian Fainelli1-0/+2
We are not releasing the link GPIO descriptor with gpiod_put() which results in subsequent probing to get -EBUSY when calling fwnode_get_named_gpiod(). Fix this by doing the release in phylink_destroy(). Fixes: 9525ae83959b ("phylink: add phylink infrastructure") Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11net: phy: phylink: Use gpiod_get_value_cansleep()Florian Fainelli1-1/+1
The GPIO provider for the link GPIO line might require the use of the _cansleep() API, utilize that. This is safe to do since we run in workqueue context. Fixes: 9525ae83959b ("phylink: add phylink infrastructure") Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsgAndrey Ignatov2-4/+10
Fix more memory leaks in ip_cmsg_send() callers. Part of them were fixed earlier in 919483096bfe. * udp_sendmsg one was there since the beginning when linux sources were first added to git; * ping_v4_sendmsg one was copy/pasted in c319b4d76b9e. Whenever return happens in udp_sendmsg() or ping_v4_sendmsg() IP options have to be freed if they were allocated previously. Add label so that future callers (if any) can use it instead of kfree() before return that is easy to forget. Fixes: c319b4d76b9e (net: ipv4: add IPPROTO_ICMP socket kind) Signed-off-by: Andrey Ignatov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11mlxsw: core: Fix an error handling path in 'mlxsw_core_bus_device_register()'Christophe JAILLET1-2/+2
Resources are not freed in the reverse order of the allocation. Labels are also mixed-up. Fix it and reorder code and labels in the error handling path of 'mlxsw_core_bus_device_register()' Fixes: ef3116e5403e ("mlxsw: spectrum: Register KVD resources with devlink") Signed-off-by: Christophe JAILLET <[email protected]> Reviewed-by: Ido Schimmel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11Merge branch 'bonding-bug-fixes-and-regressions'David S. Miller3-6/+12
Debabrata Banerjee says: ==================== bonding: bug fixes and regressions Fixes to bonding driver for balance-alb mode, suitable for stable. ==================== Signed-off-by: David S. Miller <[email protected]>
2018-05-11bonding: send learning packets for vlans on slaveDebabrata Banerjee3-5/+11
There was a regression at some point from the intended functionality of commit f60c3704e87d ("bonding: Fix alb mode to only use first level vlans.") Given the return value vlan_get_encap_level() we need to store the nest level of the bond device, and then compare the vlan's encap level to this. Without this, this check always fails and learning packets are never sent. In addition, this same commit caused a regression in the behavior of balance_alb, which requires learning packets be sent for all interfaces using the slave's mac in order to load balance properly. For vlan's that have not set a user mac, we can send after checking one bit. Otherwise we need send the set mac, albeit defeating rx load balancing for that vlan. Signed-off-by: Debabrata Banerjee <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11bonding: do not allow rlb updates to invalid macDebabrata Banerjee1-1/+1
Make sure multicast, broadcast, and zero mac's cannot be the output of rlb updates, which should all be directed arps. Receive load balancing will be collapsed if any of these happen, as the switch will broadcast. Signed-off-by: Debabrata Banerjee <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-11tracing: Fix regex_match_front() to not over compare the test stringSteven Rostedt (VMware)1-0/+3
The regex match function regex_match_front() in the tracing filter logic, was fixed to test just the pattern length from testing the entire test string. That is, it went from strncmp(str, r->pattern, len) to strcmp(str, r->pattern, r->len). The issue is that str is not guaranteed to be nul terminated, and if r->len is greater than the length of str, it can access more memory than is allocated. The solution is to add a simple test if (len < r->len) return 0. Cc: [email protected] Fixes: 285caad415f45 ("tracing/filters: Fix MATCH_FRONT_ONLY filter matching") Signed-off-by: Steven Rostedt (VMware) <[email protected]>
2018-05-11Merge branches 'pm-pci' and 'pm-docs'Rafael J. Wysocki3-12/+29
* pm-pci: PCI / PM: Check device_may_wakeup() in pci_enable_wake() PCI / PM: Always check PME wakeup capability for runtime wakeup support * pm-docs: PM: docs: intel_pstate: fix Active Mode w/o HWP paragraph PM: docs: sleep-states: Fix a typo ("includig")
2018-05-10compat: fix 4-byte infoleak via uninitialized struct fieldJann Horn1-0/+1
Commit 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts") removed the memset() in compat_get_timex(). Since then, the compat adjtimex syscall can invoke do_adjtimex() with an uninitialized ->tai. If do_adjtimex() doesn't write to ->tai (e.g. because the arguments are invalid), compat_put_timex() then copies the uninitialized ->tai field to userspace. Fix it by adding the memset() back. Fixes: 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts") Signed-off-by: Jann Horn <[email protected]> Acked-by: Kees Cook <[email protected]> Acked-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2018-05-11Merge branch 'drm-fixes-4.17' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie1-3/+1
into drm-fixes Single amdgpu regression fix * 'drm-fixes-4.17' of git://people.freedesktop.org/~agd5f/linux: drm/amd/pp: Fix performance drop on Fiji
2018-05-10net/mlx5e: Err if asked to offload TC match on frag being firstRoi Dayan1-0/+4
The HW doesn't support matching on frag first/later, return error if we are asked to offload that. Fixes: 3f7d0eb42d59 ("net/mlx5e: Offload TC matching on packets being IP fragments") Signed-off-by: Roi Dayan <[email protected]> Reviewed-by: Or Gerlitz <[email protected]> Signed-off-by: Saeed Mahameed <[email protected]>
2018-05-10net/mlx5: E-Switch, Include VF RDMA stats in vport statisticsAdi Nissim1-1/+10
The host side reporting of VF vport statistics didn't include the VF RDMA traffic. Fixes: 3b751a2a418a ("net/mlx5: E-Switch, Introduce get vf statistics") Signed-off-by: Adi Nissim <[email protected]> Reported-by: Ariel Almog <[email protected]> Reviewed-by: Or Gerlitz <[email protected]> Signed-off-by: Saeed Mahameed <[email protected]>
2018-05-10net/mlx5: Free IRQs in shutdown pathDaniel Jurgens3-0/+38
Some platforms require IRQs to be free'd in the shutdown path. Otherwise they will fail to be reallocated after a kexec. Fixes: 8812c24d28f4 ("net/mlx5: Add fast unload support in shutdown flow") Signed-off-by: Daniel Jurgens <[email protected]> Signed-off-by: Saeed Mahameed <[email protected]>
2018-05-10rxrpc: Trace UDP transmission failureDavid Howells5-8/+90
Add a tracepoint to log transmission failure from the UDP transport socket being used by AF_RXRPC. Signed-off-by: David Howells <[email protected]>
2018-05-10rxrpc: Add a tracepoint to log ICMP/ICMP6 and error messagesDavid Howells2-23/+53
Add a tracepoint to log received ICMP/ICMP6 events and other error messages. Signed-off-by: David Howells <[email protected]>
2018-05-10rxrpc: Fix the min security level for kernel callsDavid Howells1-1/+1
Fix the kernel call initiation to set the minimum security level for kernel initiated calls (such as from kAFS) from the sockopt value. Fixes: 19ffa01c9c45 ("rxrpc: Use structs to hold connection params and protocol info") Signed-off-by: David Howells <[email protected]>
2018-05-10rxrpc: Fix error reception on AF_INET6 socketsDavid Howells1-15/+42
AF_RXRPC tries to turn on IP_RECVERR and IP_MTU_DISCOVER on the UDP socket it just opened for communications with the outside world, regardless of the type of socket. Unfortunately, this doesn't work with an AF_INET6 socket. Fix this by turning on IPV6_RECVERR and IPV6_MTU_DISCOVER instead if the socket is of the AF_INET6 family. Without this, kAFS server and address rotation doesn't work correctly because the algorithm doesn't detect received network errors. Fixes: 75b54cb57ca3 ("rxrpc: Add IPv6 support") Signed-off-by: David Howells <[email protected]>
2018-05-10rxrpc: Fix missing start of call timeoutDavid Howells4-1/+23
The expect_rx_by call timeout is supposed to be set when a call is started to indicate that we need to receive a packet by that point. This is currently put back every time we receive a packet, but it isn't started when we first send a packet. Without this, the call may wait forever if the server doesn't deign to reply. Fix this by setting the timeout upon a successful UDP sendmsg call for the first DATA packet. The timeout is initiated only for initial transmission and not for subsequent retries as we don't want the retry mechanism to extend the timeout indefinitely. Fixes: a158bdd3247b ("rxrpc: Fix call timeouts") Reported-by: Marc Dionne <[email protected]> Signed-off-by: David Howells <[email protected]>
2018-05-10Merge tag 'linux-can-fixes-for-4.17-20180510' of ↵David S. Miller1-4/+7
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== this is a pull request for net/master consisting of 2 patches. Both patches are from Lukas Wunner and fix two problems found in the hi311x CAN driver under high load situations. ==================== Signed-off-by: David S. Miller <[email protected]>
2018-05-10qed: fix spelling mistake: "taskelt" -> "tasklet"Colin Ian King1-1/+1
Trivial fix to spelling mistake in DP_VERBOSE message text Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10rocker: Postpone filtering of !added_by_user FDBPetr Machata1-2/+4
Breaking out of the switch in rocker_switchdev_event() still ends up scheduling work, except an ill-defined one. This leads to an OOPS cited below. Fix by postponing the check until rocker_switchdev_event_work(). [ 23.148476] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 23.148810] PGD 0 P4D 0 [ 23.148982] Oops: 0000 [#1] PREEMPT SMP PTI [ 23.149190] Modules linked in: bridge stp llc iptable_nat nf_nat_ipv4 nf_nat e1000 rocker [ 23.149768] CPU: 0 PID: 239 Comm: kworker/u2:4 Not tainted 4.17.0-rc3-net_next_queue-custom #6 [ 23.150298] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014 [ 23.150868] Workqueue: rocker rocker_switchdev_event_work [rocker] [ 23.151258] RIP: 0010:ofdpa_port_fdb+0x7b/0x230 [rocker] [ 23.151597] RSP: 0018:ffffc900004b3e18 EFLAGS: 00010246 [ 23.151952] RAX: 00000000fffbc68c RBX: 0000000000000000 RCX: 0000000000000000 [ 23.152363] RDX: 0000000000000010 RSI: ffff88003b4471e0 RDI: 00000000ffffffff [ 23.152768] RBP: ffff88003b4471c0 R08: ffff88003b4471e0 R09: ffff88003b4471c0 [ 23.153141] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880036caf000 [ 23.153515] R13: 0000000000000000 R14: 0000000000000000 R15: ffff88003bc00000 [ 23.153919] FS: 0000000000000000(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000 [ 23.154444] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.154806] CR2: 0000000000000000 CR3: 0000000036eb6000 CR4: 00000000000006f0 [ 23.155194] Call Trace: [ 23.155472] rocker_switchdev_event_work+0x9b/0xd0 [rocker] [ 23.155850] ? __schedule+0x231/0x700 [ 23.156175] process_one_work+0x1cf/0x3e0 [ 23.156490] worker_thread+0x26/0x3d0 [ 23.156795] ? trace_event_raw_event_workqueue_execute_start+0x80/0x80 [ 23.157181] kthread+0x10e/0x130 [ 23.157485] ? kthread_create_worker_on_cpu+0x40/0x40 [ 23.157824] ret_from_fork+0x35/0x40 [ 23.158174] Code: 00 00 c1 e8 02 4c 8d 45 20 bf ff ff ff ff 83 e0 01 4c 89 65 20 88 45 14 48 8b 05 21 da 1f e2 4c 89 c6 4c 89 44 24 10 48 89 45 18 <41> 8b 45 00 89 45 28 41 0f b7 45 04 66 89 45 2c 0f b7 44 24 04 [ 23.159346] RIP: ofdpa_port_fdb+0x7b/0x230 [rocker] RSP: ffffc900004b3e18 [ 23.159742] CR2: 0000000000000000 [ 23.160088] ---[ end trace f9b16d4cb6df0629 ]--- Fixes: 816a3bed9549 ("switchdev: Add fdb.added_by_user to switchdev notifications") Suggested-by: Vivien Didelot <[email protected]> Signed-off-by: Petr Machata <[email protected]> Reviewed-by: Vivien Didelot <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10tls: Fix tls_device initializationBoris Pismenny1-0/+2
Add sg table initialization to fix a BUG_ON encountered when enabling CONFIG_DEBUG_SG. Signed-off-by: Boris Pismenny <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10cxgb4: fix the wrong conversion of Mbps to KbpsGanesh Goudar1-3/+3
fix the wrong conversion where 1 Mbps was converted to 1024 Kbps. Signed-off-by: Ganesh Goudar <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10Merge branch 'mlxsw-Support-VLAN-devices-in-mirroring-offloads'David S. Miller3-8/+91
Ido Schimmel says: ==================== mlxsw: Support VLAN devices in mirroring offloads Petr says: When offloading "tc action mirred mirror", there are several scenarios where VLAN devices can show up, that mlxsw can offload on Spectrum machines. I) A direct mirror to a VLAN device on top of a front-panel port device (commonly referred to as "RSPAN") II) VLAN device in egress path of a packet when resolving a mirror to gretap or ip6gretap netdevice. Specifically in the latter case, the following are the cases that can be offloaded: IIa) VLAN device directly above a physical device. IIb) A VLAN-unaware bridge where the egress device is as in IIa. IIc) VLAN device on top of a VLAN-aware bridge where the egress device is a physical device. This patch set implements all the above cases. First, in patch #1, br_vlan_get_info() is extended to allow bridge master argument. Case I is then implemented in patches #2 and #3, case II in patch #4. Note that handling of VLAN protocol is not included. In case I, mirrored packets may end up being double-tagged, and it might be reasonable for the outer tag to be an 802.1ad. However, the protocol type configuration would have to be put on the same VLAN netdevice that represents normal VLAN traffic, and mlxsw currently ignores this setting in that case. Thus this support was left out and the encapsulation always uses 802.1q protocol. ==================== Signed-off-by: David S. Miller <[email protected]>
2018-05-10mlxsw: spectrum_span: Support VLAN under mirror-to-gretapPetr Machata1-8/+19
When mirroring to a gretap or ip6gretap device, allow the underlay packet path to include VLAN devices. The following configurations are supported in underlay: - vlan over phys - vlan-unaware bridge where the egress device is vlan over phys - vlan over vlan-aware bridge where the egress device is phys Signed-off-by: Petr Machata <[email protected]> Signed-off-by: Ido Schimmel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10mlxsw: spectrum_span: Support mirror-to-VLANPetr Machata1-0/+64
Offload "tc action mirred mirror" to a device that is a vlan device on top of a front-panel port device. The hardware encapsulates the mirrored packets in a VLAN tag. That includes the case that the mirrored traffic is already VLAN-tagged--in that case the monitor traffic will be double-tagged, just like in the software path. Signed-off-by: Petr Machata <[email protected]> Signed-off-by: Ido Schimmel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10mlxsw: reg: Add MLXSW_REG_MPAT_SPAN_TYPE_REMOTE_ETHPetr Machata1-0/+6
Add MLXSW_REG_MPAT_SPAN_TYPE_REMOTE_ETH to support VLAN-encapsulated port mirroring. Signed-off-by: Petr Machata <[email protected]> Signed-off-by: Ido Schimmel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10net: bridge: Allow bridge master in br_vlan_get_info()Petr Machata1-0/+2
Mirroring offload in mlxsw needs to check that a given VLAN is allowed to ingress the bridge device. br_vlan_get_info() is the function that is used for this, however currently it only supports bridge port devices. Extend it to support bridge masters as well. Signed-off-by: Petr Machata <[email protected]> Signed-off-by: Ido Schimmel <[email protected]> Acked-by: Nikolay Aleksandrov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsgXin Long1-1/+0
In Commit 1f45f78f8e51 ("sctp: allow GSO frags to access the chunk too"), it held the chunk in sctp_ulpevent_make_rcvmsg to access it safely later in recvmsg. However, it also added sctp_chunk_put in fail_mark err path, which is only triggered before holding the chunk. syzbot reported a use-after-free crash happened on this err path, where it shouldn't call sctp_chunk_put. This patch simply removes this call. Fixes: 1f45f78f8e51 ("sctp: allow GSO frags to access the chunk too") Reported-by: [email protected] Signed-off-by: Xin Long <[email protected]> Acked-by: Neil Horman <[email protected]> Acked-by: Marcelo Ricardo Leitner <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10net/mlx4_en: Fix an error handling path in 'mlx4_en_init_netdev()'Christophe JAILLET1-7/+1
If an error occurs, 'mlx4_en_destroy_netdev()' is called. It then calls 'mlx4_en_free_resources()' which does the needed resources cleanup. So, doing some explicit kfree in the error handling path would lead to some double kfree. Simplify code to avoid such a case. Fixes: 67f8b1dcb9ee ("net/mlx4_en: Refactor the XDP forwarding rings scheme") Signed-off-by: Christophe JAILLET <[email protected]> Reviewed-by: Tariq Toukan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10tcp: Add mark for TIMEWAIT socketsJon Maxwell5-4/+22
This version has some suggestions by Eric Dumazet: - Use a local variable for the mark in IPv6 instead of ctl_sk to avoid SMP races. - Use the more elegant "IP4_REPLY_MARK(net, skb->mark) ?: sk->sk_mark" statement. - Factorize code as sk_fullsock() check is not necessary. Aidan McGurn from Openwave Mobility systems reported the following bug: "Marked routing is broken on customer deployment. Its effects are large increase in Uplink retransmissions caused by the client never receiving the final ACK to their FINACK - this ACK misses the mark and routes out of the incorrect route." Currently marks are added to sk_buffs for replies when the "fwmark_reflect" sysctl is enabled. But not for TW sockets that had sk->sk_mark set via setsockopt(SO_MARK..). Fix this in IPv4/v6 by adding tw->tw_mark for TIME_WAIT sockets. Copy the the original sk->sk_mark in __inet_twsk_hashdance() to the new tw->tw_mark location. Then progate this so that the skb gets sent with the correct mark. Do the same for resets. Give the "fwmark_reflect" sysctl precedence over sk->sk_mark so that netfilter rules are still honored. Signed-off-by: Jon Maxwell <[email protected]> Reviewed-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10net: ipv4: remove define INET_CSK_DEBUG and unnecessary EXPORT_SYMBOLJoe Perches2-23/+4
INET_CSK_DEBUG is always set and only is used for 2 pr_debug calls. EXPORT_SYMBOL(inet_csk_timer_bug_msg) is only used by these 2 pr_debug calls and is also unnecessary as the exported string can be used directly by these calls. Signed-off-by: Joe Perches <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-05-10hv_netvsc: set master deviceStephen Hemminger1-1/+2
The hyper-v transparent bonding should have used master_dev_link. The netvsc device should look like a master bond device not like the upper side of a tunnel. This makes the semantics the same so that userspace applications looking at network devices see the correct master relationshipship. Fixes: 0c195567a8f6 ("netvsc: transparent VF management") Signed-off-by: Stephen Hemminger <[email protected]> Signed-off-by: David S. Miller <[email protected]>