aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-11-29net: ethernet: fs_enet: fix fixed-link phydev leaksJohan Hovold1-1/+6
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: bb74d9a4a87b ("fs_enet: use the new fixed PHY helpers") Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29net: ethernet: fec: fix fixed-link phydev leaksJohan Hovold1-0/+5
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: 407066f8f371 ("net: fec: Support phys probed from devicetree and fixed-link") Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29net: ethernet: bcmgenet: fix fixed-link phydev leaksJohan Hovold1-0/+6
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Note that we're still leaking any fixed-link PHY registered in the non-OF probe path. Fixes: 9abf0c2b717a ("net: bcmgenet: use the new fixed PHY helpers") Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29net: ethernet: bcmsysport: fix fixed-link phydev leaksJohan Hovold1-5/+12
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: 186534a3f832 ("net: systemport: use the new fixed PHY helpers") Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29net: ethernet: aurora: nb8800: fix fixed-link phydev leaksJohan Hovold1-2/+7
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: c7dfe3abf40e ("net: ethernet: nb8800: support fixed-link DT node") Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29net: ethernet: altera: fix fixed-link phydev leaksJohan Hovold1-1/+8
Make sure to deregister and free any fixed-link PHY registered using of_phy_register_fixed_link() on probe errors and on driver unbind. Fixes: 7cdbc6f74f8e ("altera tse: add support for fixed-links.") Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29of_mdio: add helper to deregister fixed-link PHYsJohan Hovold4-24/+23
Add helper to deregister fixed-link PHYs registered using of_phy_register_fixed_link(). Convert the two drivers that care to deregister their fixed-link PHYs to use the new helper, but note that most drivers currently fail to do so. Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29net: dsa: slave: fix of-node leak and phy priorityJohan Hovold1-2/+5
Make sure to drop the reference taken by of_parse_phandle() before returning from dsa_slave_phy_setup(). Note that this also modifies the PHY priority so that any fixed-link node is only parsed when no phy-handle is given, which is in accordance with the common scheme for this. Fixes: 0d8bcdd383b8 ("net: dsa: allow for more complex PHY setups") Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-30Merge branch 'drm-fixes-4.9' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie3-5/+22
into drm-fixes Regression fixes for PX and a powerplay fix. * 'drm-fixes-4.9' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: fix check for port PM availability drm/amdgpu: fix check for port PM availability drm/amd/powerplay: initialize the soft_regs offset in struct smu7_hwmgr
2016-11-29Merge tag 'arc-4.9-final' of ↵Linus Torvalds3-6/+7
git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - fix PAE40 crash [Yuriy] - disable IO-Coherency by default - use a different inline asm constraint for Zero Overhead loops * tag 'arc-4.9-final' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: mm: PAE40: Fix crash at munmap ARC: mm: IOC: Don't enable IOC by default ARC: Don't use "+l" inline asm constraint
2016-11-29GSO: Reload iph after pskb_may_pullArnaldo Carvalho de Melo1-1/+1
As it may get stale and lead to use after free. Acked-by: Eric Dumazet <[email protected]> Cc: Alexander Duyck <[email protected]> Cc: Andrey Konovalov <[email protected]> Fixes: cbc53e08a793 ("GSO: Add GSO type for fixed IPv4 ID") Signed-off-by: Arnaldo Carvalho de Melo <[email protected]> Acked-by: Alexander Duyck <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29sched: cls_flower: remove from hashtable only in case skip sw flag is not setJiri Pirko1-4/+6
Be symmetric to hashtable insert and remove filter from hashtable only in case skip sw flag is not set. Fixes: e69985c67c33 ("net/sched: cls_flower: Introduce support in SKIP SW flag") Signed-off-by: Jiri Pirko <[email protected]> Reviewed-by: Amir Vadai <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29net/dccp: fix use-after-free in dccp_invalid_packetEric Dumazet1-5/+7
pskb_may_pull() can reallocate skb->head, we need to reload dh pointer in dccp_invalid_packet() or risk use after free. Bug found by Andrey Konovalov using syzkaller. Signed-off-by: Eric Dumazet <[email protected]> Reported-by: Andrey Konovalov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29net: macb: ensure ordering write to re-enable RX smoothlyZumeng Chen1-0/+2
When a hardware issue happened as described by inline comments, the register write pattern looks like the following: <write ~MACB_BIT(RE)> + wmb(); <write MACB_BIT(RE)> There might be a memory barrier between these two write operations, so add wmb to ensure an flip from 0 to 1 for NCR. Signed-off-by: Zumeng Chen <[email protected]> Acked-by: Nicolas Ferre <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29net: macb: fix the RX queue reset in macb_rx()Cyrille Pitchen1-2/+1
On macb only (not gem), when a RX queue corruption was detected from macb_rx(), the RX queue was reset: during this process the RX ring buffer descriptor was initialized by macb_init_rx_ring() but we forgot to also set bp->rx_tail to 0. Indeed, when processing the received frames, bp->rx_tail provides the macb driver with the index in the RX ring buffer of the next buffer to process. So when the whole ring buffer is reset we must also reset bp->rx_tail so the driver is synchronized again with the hardware. Since macb_init_rx_ring() is called from many locations, currently from macb_rx() and macb_init_rings(), we'd rather add the "bp->rx_tail = 0;" line inside macb_init_rx_ring() than add the very same line after each call of this function. Without this fix, the rx queue is not reset properly to recover from queue corruption and connection drop may occur. Signed-off-by: Cyrille Pitchen <[email protected]> Fixes: 9ba723b081a2 ("net: macb: remove BUG_ON() and reset the queue to handle RX errors") Acked-by: Nicolas Ferre <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29netlink: Call cb->done from a worker threadHerbert Xu2-4/+25
The cb->done interface expects to be called in process context. This was broken by the netlink RCU conversion. This patch fixes it by adding a worker struct to make the cb->done call where necessary. Fixes: 21e4902aea80 ("netlink: Lockless lookup with RCU grace...") Reported-by: Subash Abhinov Kasiviswanathan <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Acked-by: Cong Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29net/sched: pedit: make sure that offset is validAmir Vadai1-4/+20
Add a validation function to make sure offset is valid: 1. Not below skb head (could happen when offset is negative). 2. Validate both 'offset' and 'at'. Signed-off-by: Amir Vadai <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-29Re-enable CONFIG_MODVERSIONS in a slightly weaker formLinus Torvalds2-3/+3
This enables CONFIG_MODVERSIONS again, but allows for missing symbol CRC information in order to work around the issue that newer binutils versions seem to occasionally drop the CRC on the floor. binutils 2.26 seems to work fine, while binutils 2.27 seems to break MODVERSIONS of symbols that have been defined in assembler files. [ We've had random missing CRC's before - it may be an old problem that just is now reliably triggered with the weak asm symbols and a new version of binutils ] Some day I really do want to remove MODVERSIONS entirely. Sadly, today does not appear to be that day: Debian people apparently do want the option to enable MODVERSIONS to make it easier to have external modules across kernel versions, and this seems to be a fairly minimal fix for the annoying problem. Cc: Ben Hutchings <[email protected]> Acked-by: Michal Marek <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-11-29Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds3-12/+28
Pull CIFS fixes from Steve French: "A few misc important cifs fixes, including a fix for a 4.9 regression in posix_acl xattr handling" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: CIFS: iterate over posix acl xattr entry correctly in ACL_to_cifs_posix() Call echo service immediately after socket reconnect CIFS: Fix BUG() in calc_seckey()
2016-11-29netfilter: ipv6: nf_defrag: drop mangled skb on ream errorFlorian Westphal2-3/+3
Dmitry Vyukov reported GPF in network stack that Andrey traced down to negative nh offset in nf_ct_frag6_queue(). Problem is that all network headers before fragment header are pulled. Normal ipv6 reassembly will drop the skb when errors occur further down the line. netfilter doesn't do this, and instead passed the original fragment along. That was also fine back when netfilter ipv6 defrag worked with cloned fragments, as the original, pristine fragment was passed on. So we either have to undo the pull op, or discard such fragments. Since they're malformed after all (e.g. overlapping fragment) it seems preferrable to just drop them. Same for temporary errors -- it doesn't make sense to accept (and perhaps forward!) only some fragments of same datagram. Fixes: 029f7f3b8701cc7ac ("netfilter: ipv6: nf_defrag: avoid/free clone operations") Reported-by: Dmitry Vyukov <[email protected]> Debugged-by: Andrey Konovalov <[email protected]> Diagnosed-by: Eric Dumazet <Eric Dumazet <[email protected]> Signed-off-by: Florian Westphal <[email protected]> Acked-by: Eric Dumazet <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2016-11-29Merge tag 'scsi-fixes' of ↵Linus Torvalds5-12/+23
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four small fixes. The be2iscsi is a potential device overrun in consistent memory, which could have nasty consequences if the consistent allocations are packed. The hpsa one fixes a regression where older controllers can now get a numbering clash between the first internal disk and the controller. The libfc one is a regression in timespec conversions which causes a user visible issue in a command line tool and the mpt3sas one fixes a regression where the controller could remain permanently blocked after an ATA pass through command followed by a reset" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: be2iscsi: allocate enough memory in beiscsi_boot_get_sinfo() scsi: mpt3sas: Unblock device after controller reset scsi: hpsa: use bus '3' for legacy HBA devices scsi: libfc: fix seconds_since_last_reset miscalculation
2016-11-29Revert "i2c: octeon: thunderx: Limit register access retries"Jan Glauber2-19/+12
This reverts commit 70121f7f3725 ("i2c: octeon: thunderx: Limit register access retries"). Using readq_poll_timeout instead of __raw_readq triggers the following debug warning: [ 78.871568] ipmi_ssif: Trying hotmod-specified SSIF interface at i2c address 0x12, adapter Cavium ThunderX i2c adapter at 0000:01:09.4, slave address 0x0 [ 78.886107] do not call blocking ops when !TASK_RUNNING; state=2 set at [<fffffc00080e0088>] prepare_to_wait_event+0x58/0x10c [ 78.897436] ------------[ cut here ]------------ [ 78.902050] WARNING: CPU: 6 PID: 2235 at kernel/sched/core.c:7718 __might_sleep+0x80/0x88 [...] [ 79.133553] [<fffffc00080c3aac>] __might_sleep+0x80/0x88 [ 79.138862] [<fffffc0000e30138>] octeon_i2c_test_iflg+0x4c/0xbc [i2c_thunderx] [ 79.146077] [<fffffc0000e30958>] octeon_i2c_test_ready+0x18/0x70 [i2c_thunderx] [ 79.153379] [<fffffc0000e30b04>] octeon_i2c_wait+0x154/0x1a4 [i2c_thunderx] [ 79.160334] [<fffffc0000e310bc>] octeon_i2c_xfer+0xf4/0xf60 [i2c_thunderx] Signed-off-by: Jan Glauber <[email protected]> Acked-by: Steven J. Hill <[email protected]> Signed-off-by: Wolfram Sang <[email protected]>
2016-11-29ARC: mm: PAE40: Fix crash at munmapYuriy Kolerov1-1/+1
commit 1c3c90930392 broke PAE40. Macro pfn_pte(pfn, prot) creates paddr from pfn, but the page shift was getting truncated to 32 bits since we lost the proper cast to 64 bits (for PAE400 Instead of reverting that commit, use a better helper which is 32/64 bits safe just like ARM implementation. Fixes: 1c3c90930392 ("ARC: mm: fix build breakage with STRICT_MM_TYPECHECKS") Cc: <[email protected]> #4.4+ Signed-off-by: Yuriy Kolerov <[email protected]> [vgupta: massaged changelog] Signed-off-by: Vineet Gupta <[email protected]>
2016-11-29mremap: move_ptes: check pte dirty after its removalAaron Lu2-6/+10
Linus found there still is a race in mremap after commit 5d1904204c99 ("mremap: fix race between mremap() and page cleanning"). As described by Linus: "the issue is that another thread might make the pte be dirty (in the hardware walker, so no locking of ours will make any difference) *after* we checked whether it was dirty, but *before* we removed it from the page tables" Fix it by moving the check after we removed it from the page table. Suggested-by: Linus Torvalds <[email protected]> Signed-off-by: Aaron Lu <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-11-29pwm: Fix device reference leakJohan Hovold1-0/+2
Make sure to drop the reference to the parent device taken by class_find_device() after "unexporting" any children when deregistering a PWM chip. Fixes: 0733424c9ba9 ("pwm: Unexport children before chip removal") Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Thierry Reding <[email protected]>
2016-11-29drm/radeon: fix check for port PM availabilityAlex Deucher1-2/+9
The ATPX method does not always exist on the dGPU, it may be located at the iGPU. The parent device of the iGPU is the root port for which bridge_d3 is false. This accidentally enables the legacy PM method which conflicts with port PM and prevented the dGPU from powering on. Ported from amdgpu commit: drm/amdgpu: fix check for port PM availability from Peter Wu. Fixes: d3ac31f3b4bf9fad (drm/radeon: fix power state when port pm is unavailable (v2)) Signed-off-by: Alex Deucher <[email protected]> Cc: Peter Wu <[email protected]> Cc: <[email protected]> # 4.8+
2016-11-29drm/amdgpu: fix check for port PM availabilityPeter Wu1-2/+9
The ATPX method does not always exist on the dGPU, it may be located at the iGPU. The parent device of the iGPU is the root port for which bridge_d3 is false. This accidentally enables the legacy PM method which conflicts with port PM and prevented the dGPU from powering on. Fixes: 1db4496f167b ("drm/amdgpu: fix power state when port pm is unavailable") Reported-and-tested-by: Mike Lothian <[email protected]> Signed-off-by: Peter Wu <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Cc: <[email protected]> # 4.8+
2016-11-29powerpc/mm: Fix lazy icache flush on pre-POWER5Benjamin Herrenschmidt2-3/+3
On 64-bit CPUs with no-execute support and non-snooping icache, such as 970 or POWER4, we have a software mechanism to ensure coherency of the cache (using exec faults when needed). This was broken due to a logic error when the code was rewritten from assembly to C, previously the assembly code did: BEGIN_FTR_SECTION mr r4,r30 mr r5,r7 bl hash_page_do_lazy_icache END_FTR_SECTION(CPU_FTR_NOEXECUTE|CPU_FTR_COHERENT_ICACHE, CPU_FTR_NOEXECUTE) Which tests that: (cpu_features & (NOEXECUTE | COHERENT_ICACHE)) == NOEXECUTE Which says that the current cpu does have NOEXECUTE, but does not have COHERENT_ICACHE. Fixes: 91f1da99792a ("powerpc/mm: Convert 4k hash insert to C") Fixes: 89ff725051d1 ("powerpc/mm: Convert __hash_page_64K to C") Fixes: a43c0eb8364c ("powerpc/mm: Convert 4k insert from asm to C") Cc: [email protected] # v4.5+ Signed-off-by: Benjamin Herrenschmidt <[email protected]> Reviewed-by: Aneesh Kumar K.V <[email protected]> [mpe: Change log verbosification] Signed-off-by: Michael Ellerman <[email protected]>
2016-11-29ovl: fix d_real() for stacked fsMiklos Szeredi1-3/+3
Handling of recursion in d_real() is completely broken. Recursion is only done in the 'inode != NULL' case. But when opening the file we have 'inode == NULL' hence d_real() will return an overlay dentry. This won't work since overlayfs doesn't define its own file operations, so all file ops will fail. Fix by doing the recursion first and the check against the inode second. Bash script to reproduce the issue written by Quentin: - 8< - - - - - 8< - - - - - 8< - - - - - 8< - - - - tmpdir=$(mktemp -d) pushd ${tmpdir} mkdir -p {upper,lower,work} echo -n 'rocks' > lower/ksplice mount -t overlay level_zero upper -o lowerdir=lower,upperdir=upper,workdir=work cat upper/ksplice tmpdir2=$(mktemp -d) pushd ${tmpdir2} mkdir -p {upper,work} mount -t overlay level_one upper -o lowerdir=${tmpdir}/upper,upperdir=upper,workdir=work ls -l upper/ksplice cat upper/ksplice - 8< - - - - - 8< - - - - - 8< - - - - - 8< - - - - Reported-by: Quentin Casasnovas <[email protected]> Signed-off-by: Miklos Szeredi <[email protected]> Fixes: 2d902671ce1c ("vfs: merge .d_select_inode() into .d_real()") Cc: <[email protected]> # v4.8+
2016-11-28CIFS: iterate over posix acl xattr entry correctly in ACL_to_cifs_posix()Eryu Guan1-2/+2
Commit 2211d5ba5c6c ("posix_acl: xattr representation cleanups") removes the typedefs and the zero-length a_entries array in struct posix_acl_xattr_header, and uses bare struct posix_acl_xattr_header and struct posix_acl_xattr_entry directly. But it failed to iterate over posix acl slots when converting posix acls to CIFS format, which results in several test failures in xfstests (generic/053 generic/105) when testing against a samba v1 server, starting from v4.9-rc1 kernel. e.g. [root@localhost xfstests]# diff -u tests/generic/105.out /root/xfstests/results//generic/105.out.bad --- tests/generic/105.out 2016-09-19 16:33:28.577962575 +0800 +++ /root/xfstests/results//generic/105.out.bad 2016-10-22 15:41:15.201931110 +0800 @@ -1,3 +1,4 @@ QA output created by 105 -rw-r--r-- root +setfacl: subdir: Invalid argument -rw-r--r-- root Fix it by introducing a new "ace" var, like what cifs_copy_posix_acl() does, and iterating posix acl xattr entries over it in the for loop. Signed-off-by: Eryu Guan <[email protected]> Signed-off-by: Steve French <[email protected]>
2016-11-28Call echo service immediately after socket reconnectSachin Prabhu1-7/+18
Commit 4fcd1813e640 ("Fix reconnect to not defer smb3 session reconnect long after socket reconnect") changes the behaviour of the SMB2 echo service and causes it to renegotiate after a socket reconnect. However under default settings, the echo service could take up to 120 seconds to be scheduled. The patch forces the echo service to be called immediately resulting a negotiate call being made immediately on reconnect. Signed-off-by: Sachin Prabhu <[email protected]> Reviewed-by: Pavel Shilovsky <[email protected]> Signed-off-by: Steve French <[email protected]>
2016-11-28CIFS: Fix BUG() in calc_seckey()Sachin Prabhu1-3/+8
Andy Lutromirski's new virtually mapped kernel stack allocations moves kernel stacks the vmalloc area. This triggers the bug kernel BUG at ./include/linux/scatterlist.h:140! at calc_seckey()->sg_init() Signed-off-by: Sachin Prabhu <[email protected]> Signed-off-by: Steve French <[email protected]> Reviewed-by: Jeff Layton <[email protected]>
2016-11-28drm/amd/powerplay: initialize the soft_regs offset in struct smu7_hwmgrRex Zhu1-1/+4
This could lead to mclk dpm problems on some boards. Signed-off-by: Rex Zhu <[email protected]> Ack-by: Tom St Denis <[email protected]> Reviewed-by: Huang Rui <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
2016-11-28Merge branch 'for-4.9-fixes' of ↵Linus Torvalds3-9/+4
git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata Pull libata fixes from Tejun Heo: "The recent changes in ahci MSI handling need one more fix. Hopefully, this restores parity with before. The other two are minor fixes with both low impact and risk" * 'for-4.9-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: ahci: always fall back to single-MSI mode libata-scsi: Fixup ata_gen_passthru_sense() mvsas: fix error return code in mvs_task_prep()
2016-11-28Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparcLinus Torvalds2-12/+18
Pull sparc fixes from David Miller: "Two ugly build warning fixes" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: dbri: Fix compiler warning qlogicpti: Fix compiler warnings
2016-11-28bpf/samples: Fix PT_REGS_IP on s390x and use itMichael Holzheu3-3/+3
The files "sampleip_kern.c" and "trace_event_kern.c" directly access "ctx->regs.ip" which is not available on s390x. Fix this and use the PT_REGS_IP() macro instead. Also fix the macro for s390x and use "psw.addr" from "pt_regs". Reported-by: Zvonko Kosic <[email protected]> Signed-off-by: Michael Holzheu <[email protected]> Acked-by: Alexei Starovoitov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-28net: dsa: fix unbalanced dsa_switch_tree reference countingNikita Yushchenko1-1/+3
_dsa_register_switch() gets a dsa_switch_tree object either via dsa_get_dst() or via dsa_add_dst(). Former path does not increase kref in returned object (resulting into caller not owning a reference), while later path does create a new object (resulting into caller owning a reference). The rest of _dsa_register_switch() assumes that it owns a reference, and calls dsa_put_dst(). This causes a memory breakage if first switch in the tree initialized successfully, but second failed to initialize. In particular, freed dsa_swith_tree object is left referenced by switch that was initialized, and later access to sysfs attributes of that switch cause OOPS. To fix, need to add kref_get() call to dsa_get_dst(). Fixes: 83c0afaec7b7 ("net: dsa: Add new binding implementation") Signed-off-by: Nikita Yushchenko <[email protected]> Reviewed-by: Andrew Lunn <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-28net: handle no dst on skb in icmp6_sendDavid Ahern1-2/+4
Andrey reported the following while fuzzing the kernel with syzkaller: kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN Modules linked in: CPU: 0 PID: 3859 Comm: a.out Not tainted 4.9.0-rc6+ #429 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff8800666d4200 task.stack: ffff880067348000 RIP: 0010:[<ffffffff833617ec>] [<ffffffff833617ec>] icmp6_send+0x5fc/0x1e30 net/ipv6/icmp.c:451 RSP: 0018:ffff88006734f2c0 EFLAGS: 00010206 RAX: ffff8800666d4200 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000000018 RBP: ffff88006734f630 R08: ffff880064138418 R09: 0000000000000003 R10: dffffc0000000000 R11: 0000000000000005 R12: 0000000000000000 R13: ffffffff84e7e200 R14: ffff880064138484 R15: ffff8800641383c0 FS: 00007fb3887a07c0(0000) GS:ffff88006cc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 000000006b040000 CR4: 00000000000006f0 Stack: ffff8800666d4200 ffff8800666d49f8 ffff8800666d4200 ffffffff84c02460 ffff8800666d4a1a 1ffff1000ccdaa2f ffff88006734f498 0000000000000046 ffff88006734f440 ffffffff832f4269 ffff880064ba7456 0000000000000000 Call Trace: [<ffffffff83364ddc>] icmpv6_param_prob+0x2c/0x40 net/ipv6/icmp.c:557 [< inline >] ip6_tlvopt_unknown net/ipv6/exthdrs.c:88 [<ffffffff83394405>] ip6_parse_tlv+0x555/0x670 net/ipv6/exthdrs.c:157 [<ffffffff8339a759>] ipv6_parse_hopopts+0x199/0x460 net/ipv6/exthdrs.c:663 [<ffffffff832ee773>] ipv6_rcv+0xfa3/0x1dc0 net/ipv6/ip6_input.c:191 ... icmp6_send / icmpv6_send is invoked for both rx and tx paths. In both cases the dst->dev should be preferred for determining the L3 domain if the dst has been set on the skb. Fallback to the skb->dev if it has not. This covers the case reported here where icmp6_send is invoked on Rx before the route lookup. Fixes: 5d41ce29e ("net: icmp6_send should use dst dev to determine L3 domain") Reported-by: Andrey Konovalov <[email protected]> Signed-off-by: David Ahern <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-28dbri: Fix compiler warningTushar Dave1-10/+16
dbri uses 'u32' for dma handle while invoking kernel DMA APIs, instead of using dma_addr_t. This hasn't caused any 'incompatible pointer type' warning on SPARC because until now dma_addr_t is of type u32. However, recent changes in SPARC ATU (iommu) enabled 64bit DMA and therefore dma_addr_t became of type u64. This makes 'incompatible pointer type' warnings inevitable. e.g. sound/sparc/dbri.c: In function ‘snd_dbri_create’: sound/sparc/dbri.c:2538: warning: passing argument 3 of ‘dma_zalloc_coherent’ from incompatible pointer type ./include/linux/dma-mapping.h:608: note: expected ‘dma_addr_t *’ but argument is of type ‘u32 *’ For the record, dbri(sbus) driver never executes on sun4v. Therefore even though 64bit DMA is enabled on SPARC, dbri continues to use legacy iommu that guarantees DMA address is always in 32bit range. This patch resolves above compiler warning. Signed-off-by: Tushar Dave <[email protected]> Reviewed-by: thomas tai <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-28qlogicpti: Fix compiler warningsTushar Dave1-2/+2
qlogicpti uses '__u32' for dma handle while invoking kernel DMA APIs, instead of using dma_addr_t. This hasn't caused any 'incompatible pointer type' warning on SPARC because until now dma_addr_t is of type u32. However, recent changes in SPARC ATU (iommu) enabled 64bit DMA and therefore dma_addr_t became of type u64. This makes 'incompatible pointer type' warnings inevitable. e.g. drivers/scsi/qlogicpti.c: In function ‘qpti_map_queues’: drivers/scsi/qlogicpti.c:813: warning: passing argument 3 of ‘dma_alloc_coherent’ from incompatible pointer type ./include/linux/dma-mapping.h:445: note: expected ‘dma_addr_t *’ but argument is of type ‘__u32 *’ drivers/scsi/qlogicpti.c:822: warning: passing argument 3 of ‘dma_alloc_coherent’ from incompatible pointer type ./include/linux/dma-mapping.h:445: note: expected ‘dma_addr_t *’ but argument is of type ‘__u32 *’ For the record, qlogicpti never executes on sun4v. Therefore even though 64bit DMA is enabled on SPARC, qlogicpti continues to use legacy iommu that guarantees DMA address is always in 32bit range. This patch resolves aforementioned compiler warnings. Signed-off-by: Tushar Dave <[email protected]> Reviewed-by: thomas tai <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-28Merge branch 'mlx4-fixes'David S. Miller4-21/+9
Tariq Toukan says: ==================== mlx4 bug fixes for 4.9 This patchset includes 2 bug fixes: * In patch 1 we revert the commit that avoids invoking unregister_netdev in shutdown flow, as it introduces netdev presence issues where it can be accessed unsafely by ndo operations during the flow. * Patch 2 is a simple fix for a variable uninitialization issue. Series generated against net commit: 6998cc6ec237 tipc: resolve connection flow control compatibility problem ==================== Signed-off-by: David S. Miller <[email protected]>
2016-11-28net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to ↵Jack Morgenstein1-1/+6
device managed flow steering In procedure mlx4_flow_steer_promisc_add(), several fields were left uninitialized in the rule structure. Correctly initialize these fields. Fixes: 592e49dda812 ("net/mlx4: Implement promiscuous mode with device managed flow-steering") Signed-off-by: Jack Morgenstein <[email protected]> Signed-off-by: Tariq Toukan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-28Revert "net/mlx4_en: Avoid unregister_netdev at shutdown flow"Tariq Toukan3-20/+3
This reverts commit 9d76931180557270796f9631e2c79b9c7bb3c9fb. Using unregister_netdev at shutdown flow prevents calling the netdev's ndos or trying to access its freed resources. This fixes crashes like the following: Call Trace: [<ffffffff81587a6e>] dev_get_phys_port_id+0x1e/0x30 [<ffffffff815a36ce>] rtnl_fill_ifinfo+0x4be/0xff0 [<ffffffff815a53f3>] rtmsg_ifinfo_build_skb+0x73/0xe0 [<ffffffff815a5476>] rtmsg_ifinfo.part.27+0x16/0x50 [<ffffffff815a54c8>] rtmsg_ifinfo+0x18/0x20 [<ffffffff8158a6c6>] netdev_state_change+0x46/0x50 [<ffffffff815a5e78>] linkwatch_do_dev+0x38/0x50 [<ffffffff815a6165>] __linkwatch_run_queue+0xf5/0x170 [<ffffffff815a6205>] linkwatch_event+0x25/0x30 [<ffffffff81099a82>] process_one_work+0x152/0x400 [<ffffffff8109a325>] worker_thread+0x125/0x4b0 [<ffffffff8109a200>] ? rescuer_thread+0x350/0x350 [<ffffffff8109fc6a>] kthread+0xca/0xe0 [<ffffffff8109fba0>] ? kthread_park+0x60/0x60 [<ffffffff816a1285>] ret_from_fork+0x25/0x30 Fixes: 9d7693118055 ("net/mlx4_en: Avoid unregister_netdev at shutdown flow") Signed-off-by: Tariq Toukan <[email protected]> Reported-by: Sebastian Ott <[email protected]> Reported-by: Steve Wise <[email protected]> Cc: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-28net/sched: Export tc_tunnel_key so its UAPI accessibleRoi Dayan1-0/+1
Export tc_tunnel_key so it can be used from user space. Signed-off-by: Roi Dayan <[email protected]> Reviewed-by: Amir Vadai <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-28amd-xgbe: Fix unused suspend handlers build warningBorislav Petkov1-2/+2
Fix: drivers/net/ethernet/amd/xgbe/xgbe-main.c:835:12: warning: ‘xgbe_suspend’ defined but not used [-Wunused-function] drivers/net/ethernet/amd/xgbe/xgbe-main.c:855:12: warning: ‘xgbe_resume’ defined but not used [-Wunused-function] I see it during randconfig builds here. Signed-off-by: Borislav Petkov <[email protected]> Cc: Tom Lendacky <[email protected]> Cc: [email protected] Signed-off-by: David S. Miller <[email protected]>
2016-11-28ARC: mm: IOC: Don't enable IOC by defaultVineet Gupta1-1/+1
Signed-off-by: Vineet Gupta <[email protected]>
2016-11-28ARC: Don't use "+l" inline asm constraintVineet Gupta1-4/+5
Apparenty this is coming in the way of gcc fix which inhibits the usage of LP_COUNT as a gpr. Cc: [email protected] Signed-off-by: Vineet Gupta <[email protected]>
2016-11-28tcp: Set DEFAULT_TCP_CONG to bbr if DEFAULT_BBR is setJulian Wollrath1-0/+1
Signed-off-by: Julian Wollrath <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-11-28Merge branch 'fix-RTL8211F-TX-delay-handling'David S. Miller2-12/+32
Martin Blumenstingl says: ==================== net: phy: realtek: fix RTL8211F TX-delay handling The RTL8211F PHY driver currently enables the TX-delay only when the phy-mode is PHY_INTERFACE_MODE_RGMII. This is incorrect, because there are three RGMII variations of the phy-mode which explicitly request the PHY to enable the RX and/or TX delay, while PHY_INTERFACE_MODE_RGMII specifies that the PHY should disable the RX and/or TX delays. Additionally to the RTL8211F PHY driver change this contains a small update to the phy-mode documentation to clarify the purpose of the RGMII phy-modes. While this may not be perfect yet it's at least a start. Please feel free to drop this patch from this series and send an improved version yourself. These patches are the results of recent discussions, see [0] [0] http://lists.infradead.org/pipermail/linux-amlogic/2016-November/001688.html ==================== Signed-off-by: David S. Miller <[email protected]>
2016-11-28net: phy: realtek: fix enabling of the TX-delay for RTL8211FMartin Blumenstingl1-8/+12
The old logic always enabled the TX-delay when the phy-mode was set to PHY_INTERFACE_MODE_RGMII. There are dedicated phy-modes which tell the PHY driver to enable the RX and/or TX delays: - PHY_INTERFACE_MODE_RGMII should disable the RX and TX delay in the PHY (if required, the MAC should add the delays in this case) - PHY_INTERFACE_MODE_RGMII_ID should enable RX and TX delay in the PHY - PHY_INTERFACE_MODE_RGMII_TXID should enable the TX delay in the PHY - PHY_INTERFACE_MODE_RGMII_RXID should enable the RX delay in the PHY (currently not supported by RTL8211F) With this patch we enable the TX delay for PHY_INTERFACE_MODE_RGMII_ID and PHY_INTERFACE_MODE_RGMII_TXID. Additionally we now explicity disable the TX-delay, which seems to be enabled automatically after a hard-reset of the PHY (by triggering it's reset pin) to get a consistent state (as defined by the phy-mode). This fixes a compatibility problem with some SoCs where the TX-delay was also added by the MAC. With the TX-delay being applied twice the TX clock was off and TX traffic was broken or very slow (<10Mbit/s) on 1000Mbit/s links. Signed-off-by: Martin Blumenstingl <[email protected]> Reviewed-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.