aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2018-04-12Merge tag 'drm-fixes-for-v4.17-rc1' of ↵Linus Torvalds40-1640/+432
git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "One omap, and one alsa pm fix (we merged the breaking patch via drm tree). Otherwise it's two bunches of amdgpu fixes, removing an unneeded file, some DC fixes, HDMI audio regression fix, and some vega12 fixes" * tag 'drm-fixes-for-v4.17-rc1' of git://people.freedesktop.org/~airlied/linux: (27 commits) Revert "drm/amd/display: disable CRTCs with NULL FB on their primary plane (V2)" Revert "drm/amd/display: fix dereferencing possible ERR_PTR()" drm/amd/display: Fix regamma not affecting full-intensity color values drm/amd/display: Fix FBC text console corruption drm/amd/display: Only register backlight device if embedded panel connected drm/amd/display: fix brightness level after resume from suspend drm/amd/display: HDMI has no sound after Panel power off/on drm/amdgpu: add MP1 and THM hw ip base reg offset drm/amdgpu: fix null pointer panic with direct fw loading on gpu reset drm/radeon: add PX quirk for Asus K73TK drm/omap: fix crash if there's no video PLL drm/amdgpu: Fix memory leaks at amdgpu_init() error path drm/amdgpu: Fix PCIe lane width calculation drm/radeon: Fix PCIe lane width calculation drm/amdgpu/si: implement get/set pcie_lanes asic callback drm/amdgpu: Add support for SRBM selection v3 Revert "drm/amdgpu: Don't change preferred domian when fallback GTT v5" drm/amd/powerply: fix power reading on Fiji drm/amd/powerplay: Enable ACG SS feature drm/amdgpu/sdma: fix mask in emit_pipeline_sync ...
2018-04-12Merge tag 'trace-v4.17-2' of ↵Linus Torvalds2-34/+15
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "A few clean ups and bug fixes: - replace open coded "ARRAY_SIZE()" with macro - updates to uprobes - bug fix for perf event filter on error path" * tag 'trace-v4.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Enforce passing in filter=NULL to create_filter() trace_uprobe: Simplify probes_seq_show() trace_uprobe: Use %lx to display offset tracing/uprobe: Add support for overlayfs tracing: Use ARRAY_SIZE() macro instead of open coding it
2018-04-12proc: fixup copyright signAlexey Dobriyan9-7/+37
Add copyright in two files before they get autorubberstamped. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2018-04-12Merge tag 'pci-v4.17-changes-2' of ↵Linus Torvalds3-3/+4
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - mark Extended Tags as broken on Broadcom HT1100 and HT2000 Root Ports to fix drm/Xorg hangs and unresponsive keyboards (Sinan Kaya) - remove useless messages during resource reassignment (Desnes A. Nunes do Rosario) * tag 'pci-v4.17-changes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: Remove messages about reassigning resources PCI: Mark Broadcom HT1100 and HT2000 Root Port Extended Tags as broken
2018-04-12net: dsa: mv88e6xxx: Fix receive time stamp race condition.Richard Cochran1-2/+10
The DSA stack passes received PTP frames to this driver via mv88e6xxx_port_rxtstamp() for deferred delivery. The driver then queues the frame and kicks the worker thread. The work callback reads out the latched receive time stamp and then works through the queue, delivering any non-matching frames without a time stamp. If a new frame arrives after the worker thread has read out the time stamp register but enters the queue before the worker finishes processing the queue, that frame will be delivered without a time stamp. This patch fixes the race by moving the queue onto a list on the stack before reading out the latched time stamp value. Fixes: c6fe0ad2c3499 ("net: dsa: mv88e6xxx: add rx/tx timestamping support") Signed-off-by: Richard Cochran <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12net: fix deadlock while clearing neighbor proxy tableWolfgang Bumiller1-10/+18
When coming from ndisc_netdev_event() in net/ipv6/ndisc.c, neigh_ifdown() is called with &nd_tbl, locking this while clearing the proxy neighbor entries when eg. deleting an interface. Calling the table's pndisc_destructor() with the lock still held, however, can cause a deadlock: When a multicast listener is available an IGMP packet of type ICMPV6_MGM_REDUCTION may be sent out. When reaching ip6_finish_output2(), if no neighbor entry for the target address is found, __neigh_create() is called with &nd_tbl, which it'll want to lock. Move the elements into their own list, then unlock the table and perform the destruction. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199289 Fixes: 6fd6ce2056de ("ipv6: Do not depend on rt->n in ip6_finish_output2().") Signed-off-by: Wolfgang Bumiller <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12sctp: do not check port in sctp_inet6_cmp_addrXin Long1-30/+30
pf->cmp_addr() is called before binding a v6 address to the sock. It should not check ports, like in sctp_inet_cmp_addr. But sctp_inet6_cmp_addr checks the addr by invoking af(6)->cmp_addr, sctp_v6_cmp_addr where it also compares the ports. This would cause that setsockopt(SCTP_SOCKOPT_BINDX_ADD) could bind multiple duplicated IPv6 addresses after Commit 40b4f0fd74e4 ("sctp: lack the check for ports in sctp_v6_cmp_addr"). This patch is to remove af->cmp_addr called in sctp_inet6_cmp_addr, but do the proper check for both v6 addrs and v4mapped addrs. v1->v2: - define __sctp_v6_cmp_addr to do the common address comparison used for both pf and af v6 cmp_addr. Fixes: 40b4f0fd74e4 ("sctp: lack the check for ports in sctp_v6_cmp_addr") Reported-by: Jianwen Ji <[email protected]> Signed-off-by: Xin Long <[email protected]> Acked-by: Neil Horman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12Merge branch ↵David S. Miller6-14/+54
'nfp-improve-signal-handing-on-FW-waits-and-flower-control-message-Jakub Kicinski says: ==================== nfp: improve signal handing on FW waits and flower control message processing The first part of this set aims to improve handling of interrupted waits. Patch 1 makes waiting for management FW responses uninterruptible while patch 2 adds a message when signal arrives while waiting for an NFP mutex. We can't interrupt execution of FW commands so uninterruptible sleep seems reasonable there. Exiting a wait for a mutex should be clean and have no side affects so we are allowing to abort it. Note that both waits have rather large timeouts (tens of seconds). Patches 3 and 4 improve flower offload operation under heavy load. Currently there is no cap on the number of queued FW notifications. Some of the notifications have to be processed from a workqueue which may lead to very large number of messages getting queued if workqueue never gets a chance to run. Pieter puts a limit on number of queued messages, tries to drop some messages we ignore without queuing and process more important messages first. ==================== Signed-off-by: David S. Miller <[email protected]> processing'
2018-04-12nfp: flower: split and limit cmsg skb listsPieter Jansen van Vuuren4-8/+46
Introduce a second skb list for handling control messages and limit the number of allowed messages. Some control messages are considered more crucial than others, resulting in the need for a second skb list. By splitting the list into a separate high and low priority list we can ensure that messages on the high list get added to the head of the list that gets processed, this however has no functional impact. Previously there was no limit on the number of messages allowed on the queue, this could result in the queue growing boundlessly and eventually the host running out of memory. Fixes: b985f870a5f0 ("nfp: process control messages in workqueue in flower app") Signed-off-by: Pieter Jansen van Vuuren <[email protected]> Reviewed-by: Jakub Kicinski <[email protected]> Reviewed-by: Simon Horman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12nfp: flower: move route ack control messages out of the workqueuePieter Jansen van Vuuren1-3/+3
Previously we processed the route ack control messages in the workqueue, this unnecessarily loads the workqueue. We can deal with these messages sooner as we know we are going to drop them. Fixes: 8e6a9046b66a ("nfp: flower vxlan neighbour offload") Signed-off-by: Pieter Jansen van Vuuren <[email protected]> Reviewed-by: Jakub Kicinski <[email protected]> Reviewed-by: Simon Horman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12nfp: print a message when mutex wait is interruptedJakub Kicinski1-1/+4
When waiting for an NFP mutex is interrupted print a message to make root causing later error messages easier. Signed-off-by: Jakub Kicinski <[email protected]> Reviewed-by: Dirk van der Merwe <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12nfp: ignore signals when communicating with management FWJakub Kicinski1-2/+1
We currently allow signals to interrupt the wait for management FW commands. Exiting the wait should not cause trouble, the FW will just finish executing the command in the background and new commands will wait for the old one to finish. However, this may not be what users expect (Ctrl-C not actually stopping the command). Moreover some systems routinely request link information with signals pending (Ubuntu 14.04 runs a landscape-sysinfo python tool from MOTD) worrying users with errors like these: nfp 0000:04:00.0: nfp_nsp: Error -512 waiting for code 0x0007 to start nfp 0000:04:00.0: nfp: reading port table failed -512 Make the wait for management FW responses non-interruptible. Fixes: 1a64821c6af7 ("nfp: add support for service processor access") Signed-off-by: Jakub Kicinski <[email protected]> Reviewed-by: Dirk van der Merwe <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12tipc: fix missing initializer in tipc_sendmsg()Jon Maloy1-1/+3
The stack variable 'dnode' in __tipc_sendmsg() may theoretically end up tipc_node_get_mtu() as an unitilalized variable. We fix this by intializing the variable at declaration. We also add a default else clause to the two conditional ones already there, so that we never end up in the named function if the given address type is illegal. Reported-by: [email protected] Signed-off-by: Jon Maloy <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12strparser: Fix incorrect strp->need_bytes value.Doron Roberts-Kedes1-4/+3
strp_data_ready resets strp->need_bytes to 0 if strp_peek_len indicates that the remainder of the message has been received. However, do_strp_work does not reset strp->need_bytes to 0. If do_strp_work completes a partial message, the value of strp->need_bytes will continue to reflect the needed bytes of the previous message, causing future invocations of strp_data_ready to return early if strp->need_bytes is less than strp_peek_len. Resetting strp->need_bytes to 0 in __strp_recv on handing a full message to the upper layer solves this problem. __strp_recv also calculates strp->need_bytes using stm->accum_len before stm->accum_len has been incremented by cand_len. This can cause strp->need_bytes to be equal to the full length of the message instead of the full length minus the accumulated length. This, in turn, causes strp_data_ready to return early, even when there is sufficient data to complete the partial message. Incrementing stm->accum_len before using it to calculate strp->need_bytes solves this problem. Found while testing net/tls_sw recv path. Fixes: 43a0c6751a322847 ("strparser: Stream parser for messages") Signed-off-by: Doron Roberts-Kedes <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12selftests: net: add in_netns.sh to TEST_PROGSAnders Roxell1-1/+1
Script in_netns.sh isn't installed. -------------------- running psock_fanout test -------------------- ./run_afpackettests: line 12: ./in_netns.sh: No such file or directory [FAIL] -------------------- running psock_tpacket test -------------------- ./run_afpackettests: line 22: ./in_netns.sh: No such file or directory [FAIL] In current code added in_netns.sh to be installed. Fixes: cc30c93fa020 ("selftests/net: ignore background traffic in psock_fanout") Signed-off-by: Anders Roxell <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12Merge branch 'ibmvnic-Fix-parameter-change-request-handling'David S. Miller2-22/+37
Nathan Fontenot says: ==================== ibmvnic: Fix parameter change request handling When updating parameters for the ibmvnic driver there is a possibility of entering an infinite loop if a return value other that a partial success is received from sending the login CRQ. Also, a deadlock can occur on the rtnl lock if netdev_notify_peers() is called during driver reset for a parameter change reset. This patch set corrects both of these issues by updating the return code handling in ibmvnic_login() nand gaurding against calling netdev_notify_peers() for parameter change requests. Updates for V2: Correct spelling mistakes in commit messages. ==================== Signed-off-by: David S. Miller <[email protected]>
2018-04-12ibmvnic: Do not notify peers on parameter change resetsNathan Fontenot1-1/+2
When attempting to change the driver parameters, such as the MTU value or number of queues, do not call netdev_notify_peers(). Doing so will deadlock on the rtnl_lock. Signed-off-by: Nathan Fontenot <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12ibmvnic: Handle all login error conditionsNathan Fontenot2-21/+35
There is a bug in handling the possible return codes from sending the login CRQ. The current code treats any non-success return value, minus failure to send the crq and a timeout waiting for a login response, as a need to re-send the login CRQ. This can put the drive in an infinite loop of trying to login when getting return values other that a partial success such as a return code of aborted. For these scenarios the login will not ever succeed at this point and the driver would need to be reset again. To resolve this loop trying to login is updated to only retry the login if the driver gets a return code of a partial success. Other return codes are treated as an error and the driver returns an error from ibmvnic_login(). To avoid infinite looping in the partial success return cases, the number of retries is capped at the maximum number of supported queues. This value was chosen because the driver does a renegotiation of capabilities which sets the number of queues possible and allows the driver to attempt a login for possible value for the number of queues supported. Signed-off-by: Nathan Fontenot <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12net: validate attribute sizes in neigh_dump_table()Eric Dumazet1-4/+8
Since neigh_dump_table() calls nlmsg_parse() without giving policy constraints, attributes can have arbirary size that we must validate Reported by syzbot/KMSAN : BUG: KMSAN: uninit-value in neigh_master_filtered net/core/neighbour.c:2292 [inline] BUG: KMSAN: uninit-value in neigh_dump_table net/core/neighbour.c:2348 [inline] BUG: KMSAN: uninit-value in neigh_dump_info+0x1af0/0x2250 net/core/neighbour.c:2438 CPU: 1 PID: 3575 Comm: syzkaller268891 Not tainted 4.16.0+ #83 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:53 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676 neigh_master_filtered net/core/neighbour.c:2292 [inline] neigh_dump_table net/core/neighbour.c:2348 [inline] neigh_dump_info+0x1af0/0x2250 net/core/neighbour.c:2438 netlink_dump+0x9ad/0x1540 net/netlink/af_netlink.c:2225 __netlink_dump_start+0x1167/0x12a0 net/netlink/af_netlink.c:2322 netlink_dump_start include/linux/netlink.h:214 [inline] rtnetlink_rcv_msg+0x1435/0x1560 net/core/rtnetlink.c:4598 netlink_rcv_skb+0x355/0x5f0 net/netlink/af_netlink.c:2447 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:4653 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x1672/0x1750 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x1048/0x1310 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg net/socket.c:640 [inline] ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046 __sys_sendmsg net/socket.c:2080 [inline] SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091 SyS_sendmsg+0x54/0x80 net/socket.c:2087 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 RIP: 0033:0x43fed9 RSP: 002b:00007ffddbee2798 EFLAGS: 00000213 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fed9 RDX: 0000000000000000 RSI: 0000000020005000 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401800 R13: 0000000000401890 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314 kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slub.c:2737 [inline] __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369 __kmalloc_reserve net/core/skbuff.c:138 [inline] __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206 alloc_skb include/linux/skbuff.h:984 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1183 [inline] netlink_sendmsg+0x9a6/0x1310 net/netlink/af_netlink.c:1875 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg net/socket.c:640 [inline] ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046 __sys_sendmsg net/socket.c:2080 [inline] SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091 SyS_sendmsg+0x54/0x80 net/socket.c:2087 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Fixes: 21fdd092acc7 ("net: Add support for filtering neigh dump by master device") Signed-off-by: Eric Dumazet <[email protected]> Cc: David Ahern <[email protected]> Reported-by: syzbot <[email protected]> Acked-by: David Ahern <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established socketsEric Dumazet1-2/+4
syzbot/KMSAN reported an uninit-value in tcp_parse_options() [1] I believe this was caused by a TCP_MD5SIG being set on live flow. This is highly unexpected, since TCP option space is limited. For instance, presence of TCP MD5 option automatically disables TCP TimeStamp option at SYN/SYNACK time, which we can not do once flow has been established. Really, adding/deleting an MD5 key only makes sense on sockets in CLOSE or LISTEN state. [1] BUG: KMSAN: uninit-value in tcp_parse_options+0xd74/0x1a30 net/ipv4/tcp_input.c:3720 CPU: 1 PID: 6177 Comm: syzkaller192004 Not tainted 4.16.0+ #83 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:53 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676 tcp_parse_options+0xd74/0x1a30 net/ipv4/tcp_input.c:3720 tcp_fast_parse_options net/ipv4/tcp_input.c:3858 [inline] tcp_validate_incoming+0x4f1/0x2790 net/ipv4/tcp_input.c:5184 tcp_rcv_established+0xf60/0x2bb0 net/ipv4/tcp_input.c:5453 tcp_v4_do_rcv+0x6cd/0xd90 net/ipv4/tcp_ipv4.c:1469 sk_backlog_rcv include/net/sock.h:908 [inline] __release_sock+0x2d6/0x680 net/core/sock.c:2271 release_sock+0x97/0x2a0 net/core/sock.c:2786 tcp_sendmsg+0xd6/0x100 net/ipv4/tcp.c:1464 inet_sendmsg+0x48d/0x740 net/ipv4/af_inet.c:764 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg net/socket.c:640 [inline] SYSC_sendto+0x6c3/0x7e0 net/socket.c:1747 SyS_sendto+0x8a/0xb0 net/socket.c:1715 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 RIP: 0033:0x448fe9 RSP: 002b:00007fd472c64d38 EFLAGS: 00000216 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00000000006e5a30 RCX: 0000000000448fe9 RDX: 000000000000029f RSI: 0000000020a88f88 RDI: 0000000000000004 RBP: 00000000006e5a34 R08: 0000000020e68000 R09: 0000000000000010 R10: 00000000200007fd R11: 0000000000000216 R12: 0000000000000000 R13: 00007fff074899ef R14: 00007fd472c659c0 R15: 0000000000000009 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314 kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slub.c:2737 [inline] __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369 __kmalloc_reserve net/core/skbuff.c:138 [inline] __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206 alloc_skb include/linux/skbuff.h:984 [inline] tcp_send_ack+0x18c/0x910 net/ipv4/tcp_output.c:3624 __tcp_ack_snd_check net/ipv4/tcp_input.c:5040 [inline] tcp_ack_snd_check net/ipv4/tcp_input.c:5053 [inline] tcp_rcv_established+0x2103/0x2bb0 net/ipv4/tcp_input.c:5469 tcp_v4_do_rcv+0x6cd/0xd90 net/ipv4/tcp_ipv4.c:1469 sk_backlog_rcv include/net/sock.h:908 [inline] __release_sock+0x2d6/0x680 net/core/sock.c:2271 release_sock+0x97/0x2a0 net/core/sock.c:2786 tcp_sendmsg+0xd6/0x100 net/ipv4/tcp.c:1464 inet_sendmsg+0x48d/0x740 net/ipv4/af_inet.c:764 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg net/socket.c:640 [inline] SYSC_sendto+0x6c3/0x7e0 net/socket.c:1747 SyS_sendto+0x8a/0xb0 net/socket.c:1715 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Fixes: cfb6eeb4c860 ("[TCP]: MD5 Signature Option (RFC2385) support.") Signed-off-by: Eric Dumazet <[email protected]> Reported-by: syzbot <[email protected]> Acked-by: Yuchung Cheng <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12tipc: fix unbalanced reference counterJon Maloy3-3/+9
When a topology subscription is created, we may encounter (or KASAN may provoke) a failure to create a corresponding service instance in the binding table. Instead of letting the tipc_nametbl_subscribe() report the failure back to the caller, the function just makes a warning printout and returns, without incrementing the subscription reference counter as expected by the caller. This makes the caller believe that the subscription was successful, so it will at a later moment try to unsubscribe the item. This involves a sub_put() call. Since the reference counter never was incremented in the first place, we get a premature delete of the subscription item, followed by a "use-after-free" warning. We fix this by adding a return value to tipc_nametbl_subscribe() and make the caller aware of the failure to subscribe. This bug seems to always have been around, but this fix only applies back to the commit shown below. Given the low risk of this happening we believe this to be sufficient. Fixes: commit 218527fe27ad ("tipc: replace name table service range array with rb tree") Reported-by: [email protected] Signed-off-by: Jon Maloy <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12lan78xx: PHY DSP registers initialization to address EEE link drop issues ↵Raghuram Chary J2-1/+185
with long cables The patch is to configure DSP registers of PHY device to handle Gbe-EEE failures with >40m cable length. Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Signed-off-by: Raghuram Chary J <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12mISDN: Remove VLAsLaura Abbott2-6/+16
There's an ongoing effort to remove VLAs[1] from the kernel to eventually turn on -Wvla. Remove the VLAs from the mISDN code by switching to using kstrdup in one place and using an upper bound in another. Signed-off-by: Laura Abbott <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12net/tls: Remove VLA usageKees Cook1-1/+9
In the quest to remove VLAs from the kernel[1], this replaces the VLA size with the only possible size used in the code, and adds a mechanism to double-check future IV sizes. [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com Signed-off-by: Kees Cook <[email protected]> Acked-by: Dave Watson <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12ibmvnic: Define vnic_login_client_data name field as unsized arrayKees Cook1-6/+6
The "name" field of struct vnic_login_client_data is a char array of undefined length. This should be written as "char name[]" so the compiler can make better decisions about the field (for example, not assuming it's a single character). This was noticed while trying to tighten the CONFIG_FORTIFY_SOURCE checking. Signed-off-by: Kees Cook <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-12cifs: change validate_buf to validate_iovRonnie Sahlberg1-18/+21
Signed-off-by: Ronnie Sahlberg <[email protected]> Signed-off-by: Steve French <[email protected]> Reviewed-by: Pavel Shilovsky <[email protected]>
2018-04-12cifs: remove rfc1002 hardcoded constants from cifs_discard_remaining_data()Ronnie Sahlberg1-2/+3
Signed-off-by: Ronnie Sahlberg <[email protected]> Signed-off-by: Steve French <[email protected]> Reviewed-by: Pavel Shilovsky <[email protected]>
2018-04-12cifs: Change SMB2_open to return an iov for the error parameterRonnie Sahlberg3-9/+13
Signed-off-by: Ronnie Sahlberg <[email protected]> Signed-off-by: Steve French <[email protected]> Reviewed-by: Pavel Shilovsky <[email protected]>
2018-04-12cifs: add resp_buf_size to the mid_q_entry structureRonnie Sahlberg4-2/+4
and get rid of some more calls to get_rfc1002_length() Signed-off-by: Ronnie Sahlberg <[email protected]> Signed-off-by: Steve French <[email protected]> Reviewed-by: Pavel Shilovsky <[email protected]>
2018-04-12smb3.11: replace a 4 with server->vals->header_preamble_sizeSteve French2-5/+9
More cleanup of use of hardcoded 4 byte RFC1001 field size Signed-off-by: Steve French <[email protected]> Reviewed-by: Pavel Shilovsky <[email protected]> Reviewed-by: Ronnie Sahlberg <[email protected]>
2018-04-12Merge branch 'parisc-4.17-2' of ↵Linus Torvalds11-157/+60
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: - fix panic when halting system via "shutdown -h now" - drop own coding in favour of generic CONFIG_COMPAT_BINFMT_ELF implementation - add FPE_CONDTRAP constant: last outstanding parisc-specific cleanup for Eric Biedermans siginfo patches - move some functions to .init and some to .text.hot linker sections * 'parisc-4.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Prevent panic at system halt parisc: Switch to generic COMPAT_BINFMT_ELF parisc: Move cache flush functions into .text.hot section parisc/signal: Add FPE_CONDTRAP for conditional trap handling
2018-04-12arch/sh: pcie-sh7786: handle non-zero DMA offsetThomas Petazzoni1-0/+8
On SuperH, the base of the physical memory might be different from zero. In this case, PCI address zero will map to a non-zero physical address. In order to make sure that the DMA mapping API takes care of this DMA offset, we must fill in the dev->dma_pfn_offset field for PCI devices. This gets done in the pcibios_bus_add_device() hook, called for each new PCI device detected. The dma_pfn_offset global variable is re-calculated for every PCI controller available on the platform, but that's not an issue because its value will each time be exactly the same, as it only depends on the memory start address and memory size. Signed-off-by: Thomas Petazzoni <[email protected]> Signed-off-by: Rich Felker <[email protected]>
2018-04-12arch/sh: pcie-sh7786: adjust the memory mappingThomas Petazzoni1-5/+14
The code setting up the PCI -> SuperHighway mapping doesn't take into account the fact that the address stored in PCIELARx must be aligned with the size stored in PCIELAMRx. For example, when your physical memory starts at 0x0800_0000 (128 MB), a size of 64 MB or 128 MB is fine. However, if you have 256 MB of memory, it doesn't work because the base address is not aligned on the size. In such situation, we have to round down the base address to make sure it is aligned on the size of the area. For for a 0x0800_0000 base address with 256 MB of memory, we will round down to 0x0, and extend the size of the mapping to 512 MB. This allows the mapping to work on platforms that have 256 MB of RAM. The current setup would only work with 128 MB of RAM or less. Signed-off-by: Thomas Petazzoni <[email protected]> Signed-off-by: Rich Felker <[email protected]>
2018-04-12arch/sh: pcie-sh7786: adjust PCI MEM and IO regionsThomas Petazzoni1-18/+18
The current definition of the PCIe IO and MEM resources for SH7786 doesn't match what the datasheet says. For example, for PCIe0 0xfe100000 is advertised by the datasheet as a PCI IO region, while 0xfd000000 is advertised as a PCI MEM region. The code currently inverts the two. The SH4A_PCIEPARL and SH4A_PCIEPTCTLR registers allow to define the base address and role of the different regions (including whether it's a MEM or IO region). However, practical experience on a SH7786 shows that if 0xfe100000 is used for LEL and 0xfd000000 for IO, a PCIe device using two MEM BARs cannot be accessed at all. Simply using 0xfe100000 for IO and 0xfd000000 for MEM makes the PCIe device accessible. It is very likely that this was never seen because there are two other PCI MEM region listed in the resources. However, for different reasons, none of the two other MEM regions are usable on the specific SH7786 platform the problem was encountered. Therefore, the last MEM region at 0xfe100000 was used to place the BARs, making the device non-functional. This commit therefore adjusts those PCI MEM and IO resources definitions so that they match what the datasheet says. They have only been tested with PCIe 0. Signed-off-by: Thomas Petazzoni <[email protected]> Signed-off-by: Rich Felker <[email protected]>
2018-04-12arch/sh: pcie-sh7786: exclude unusable PCI MEM areasThomas Petazzoni1-0/+12
Depending on the physical memory layout, some PCI MEM areas are not usable. According to the SH7786 datasheet, the PCI MEM area from 1000_0000 to 13FF_FFFF is only usable if the physical memory layout (in MMSELR) is 1, 2, 5 or 6. In all other configurations, this PCI MEM area is not usable (because it overlaps with DRAM). Therefore, this commit adjusts the PCI SH7786 initialization to mark the relevant PCI resource as IORESOURCE_DISABLED if we can't use it. Signed-off-by: Thomas Petazzoni <[email protected]> Signed-off-by: Rich Felker <[email protected]>
2018-04-12arch/sh: pcie-sh7786: mark unavailable PCI resource as disabledThomas Petazzoni1-0/+3
Some PCI MEM resources are marked as IORESOURCE_MEM_32BIT, which means they are only usable when the SH core runs in 32-bit mode. In 29-bit mode, such memory regions are not usable. The existing code for SH7786 properly skips such regions when configuring the PCIe controller registers. However, because such regions are still described in the resource array, the pcibios_scanbus() function in the SuperH pci.c will register them to the PCI core. Due to this, the PCI core will allocate MEM areas from this resource, and assign BARs pointing to this area, even though it's unusable. In order to prevent this from happening, we mark such regions as IORESOURCE_DISABLED, which tells the SuperH pci.c pcibios_scanbus() function to skip them. Note that we separate marking the region as disabled from skipping it, because other regions will be marked as disabled in follow-up patches. Signed-off-by: Thomas Petazzoni <[email protected]> Signed-off-by: Rich Felker <[email protected]>
2018-04-12arch/sh: pci: don't use disabled resourcesThomas Petazzoni1-0/+5
In pcibios_scanbus(), we provide to the PCI core the usable MEM and IO regions using pci_add_resource_offset(). We travel through all resources available in the "struct pci_channel". Also, in register_pci_controller(), we travel through all resources to request them, making sure they don't conflict with already requested resources. However, some resources may be disabled, in which case they should not be requested nor provided to the PCI core. In the current situation, none of the resources are disabled. However, follow-up patches in this series will make some resources disabled, making this preliminary change necessary. Signed-off-by: Thomas Petazzoni <[email protected]> Signed-off-by: Rich Felker <[email protected]>
2018-04-12arch/sh: make the DMA mapping operations observe dev->dma_pfn_offsetThomas Petazzoni2-4/+7
Some devices may have a non-zero DMA offset, i.e an offset between the DMA address and the physical address. Such an offset can be encoded into the dma_pfn_offset field of "struct device", but the SuperH implementation of the DMA mapping API does not observe this information. This commit fixes that by ensuring the DMA address is properly calculated depending on this DMA offset. Signed-off-by: Thomas Petazzoni <[email protected]> Signed-off-by: Rich Felker <[email protected]>
2018-04-12arch/sh: add sh7786_mm_sel() functionThomas Petazzoni1-0/+7
The SH7786 has different physical memory layout configurations, configurable through the MMSELR register. The configuration is typically defined by the bootloader, so Linux generally doesn't care. Except that depending on the configuration, some PCI MEM areas may or may not be available. This commit adds a helper function that allows to retrieve the current physical memory layout configuration. It will be used in a following patch to exclude unusable PCI MEM areas during the PCI initialization. Signed-off-by: Thomas Petazzoni <[email protected]> Signed-off-by: Rich Felker <[email protected]>
2018-04-12sh: fix debug trap failure to process signals before return to userRich Felker1-1/+1
When responding to a debug trap (breakpoint) in userspace, the kernel's trap handler raised SIGTRAP but returned from the trap via a code path that ignored pending signals, resulting in an infinite loop re-executing the trapping instruction. Signed-off-by: Rich Felker <[email protected]>
2018-04-12sh: fix memory corruption of unflattened device treeRich Felker2-6/+8
unflatten_device_tree() makes use of memblock allocation, and therefore must be called before paging_init() migrates the memblock allocation data to the bootmem framework. Otherwise the record of the allocation for the expanded device tree will be lost, and will eventually be clobbered when allocated for another use. Signed-off-by: Rich Felker <[email protected]>
2018-04-12sh: fix futex FUTEX_OP_SET op on userspace addressesAurelien Jarno1-4/+1
Commit 00b73d8d1b71 ("sh: add working futex atomic ops on userspace addresses for smp") changed the futex_atomic_op_inuser function to use a loop. In case of the FUTEX_OP_SET op with a userspace address containing a value different of 0, this loop is an endless loop. Fix that by loading the value of oldval from the userspace before doing the cmpxchg op, also for the FUTEX_OP_SET case. Signed-off-by: Aurelien Jarno <[email protected]> Signed-off-by: Rich Felker <[email protected]>
2018-04-13Merge branch 'drm-next-4.17' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie10-74/+124
into drm-next - Add a PX quirk for radeon - Fix flickering and stability issues with DC on some platforms - Fix HDMI audio regression - Few other misc DC and base driver fixes * 'drm-next-4.17' of git://people.freedesktop.org/~agd5f/linux: Revert "drm/amd/display: disable CRTCs with NULL FB on their primary plane (V2)" Revert "drm/amd/display: fix dereferencing possible ERR_PTR()" drm/amd/display: Fix regamma not affecting full-intensity color values drm/amd/display: Fix FBC text console corruption drm/amd/display: Only register backlight device if embedded panel connected drm/amd/display: fix brightness level after resume from suspend drm/amd/display: HDMI has no sound after Panel power off/on drm/amdgpu: add MP1 and THM hw ip base reg offset drm/amdgpu: fix null pointer panic with direct fw loading on gpu reset drm/radeon: add PX quirk for Asus K73TK
2018-04-13Merge tag 'drm-misc-next-fixes-2018-04-11' of ↵Dave Airlie1-7/+8
git://anongit.freedesktop.org/drm/drm-misc into drm-next omap: Fix crash on AM4 EVM, and all OMAP2/3 boards (Tomi) Cc: Tomi Valkeinen <[email protected]> * tag 'drm-misc-next-fixes-2018-04-11' of git://anongit.freedesktop.org/drm/drm-misc: drm/omap: fix crash if there's no video PLL
2018-04-12cifs: replace a 4 with server->vals->header_preamble_sizeRonnie Sahlberg1-1/+1
Signed-off-by: Ronnie Sahlberg <[email protected]> Signed-off-by: Steve French <[email protected]> Reviewed-by: Pavel Shilovsky <[email protected]>
2018-04-12cifs: add pdu_size to the TCP_Server_Info structureRonnie Sahlberg4-6/+9
and get rid of some get_rfc1002_length() in smb2 Signed-off-by: Ronnie Sahlberg <[email protected]> Signed-off-by: Steve French <[email protected]> Reviewed-by: Pavel Shilovsky <[email protected]>
2018-04-12MIPS: io: Prevent compiler reordering writeX()Sinan Kaya1-1/+1
writeX() has strong ordering semantics with respect to memory updates. In the absence of a write barrier or a compiler barrier, the compiler can reorder register and memory update instructions. This breaks the writeX() API. Signed-off-by: Sinan Kaya <[email protected]> Cc: Arnd Bergmann <[email protected]> Cc: Ralf Baechle <[email protected]> Cc: Paul Burton <[email protected]> Cc: [email protected] Patchwork: https://patchwork.linux-mips.org/patch/18997/ [[email protected]: Tidy commit message] Signed-off-by: James Hogan <[email protected]>
2018-04-12SMB311: Improve checking of negotiate security contextsSteve French3-0/+106
SMB3.11 crypto and hash contexts were not being checked strictly enough. Add parsing and validity checking for the security contexts in the SMB3.11 negotiate response. Signed-off-by: Steve French <[email protected]> CC: Stable <[email protected]> Reviewed-by: Pavel Shilovsky <[email protected]>
2018-04-12SMB3: Fix length checking of SMB3.11 negotiate requestSteve French2-0/+46
The length checking for SMB3.11 negotiate request includes "negotiate contexts" which caused a buffer validation problem and a confusing warning message on SMB3.11 mount e.g.: SMB2 server sent bad RFC1001 len 236 not 170 Fix the length checking for SMB3.11 negotiate to account for the new negotiate context so that we don't log a warning on SMB3.11 mount by default but do log warnings if lengths returned by the server are incorrect. CC: Stable <[email protected]> Signed-off-by: Steve French <[email protected]> Reviewed-by: Aurelien Aptel <[email protected]> Reviewed-by: Pavel Shilovsky <[email protected]>
2018-04-12Merge tag 'xfs-4.17-merge-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linuxLinus Torvalds37-205/+172
Pull more xfs updates from Darrick Wong: "Most of these are code cleanups, but there are a couple of notable use-after-free bug fixes. This series has been run through a full xfstests run over the week and through a quick xfstests run against this morning's master, with no major failures reported. - clean up unnecessary function call parameters - fix a use-after-free bug when aborting logging intents - refactor filestreams state data to avoid use-after-free bug - fix incorrect removal of cow extents when truncating extended attributes. - refactor open-coded __set_page_dirty in favor of using vfs function. - fix a deadlock when fstrim and fs shutdown race" * tag 'xfs-4.17-merge-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: Force log to disk before reading the AGF during a fstrim Export __set_page_dirty xfs: only cancel cow blocks when truncating the data fork xfs: non-scrub - remove unused function parameters xfs: remove filestream item xfs_inode reference xfs: fix intent use-after-free on abort xfs: Remove "committed" argument of xfs_dir_ialloc
Powered by cgit, Gruvboxed by Blaster4385.