summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-03-27vhost: correctly remove wait queue during poll failureJason Wang
We tried to remove vq poll from wait queue, but do not check whether or not it was in a list before. This will lead double free. Fixing this by switching to use vhost_poll_stop() which zeros poll->wqh after removing poll from waitqueue to make sure it won't be freed twice. Cc: Darren Kenny <darren.kenny@oracle.com> Reported-by: syzbot+c0272972b01b872e604a@syzkaller.appspotmail.com Fixes: 2b8b328b61c79 ("vhost_net: handle polling errors when setting backend") Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27parisc: Fix out of array access in match_pci_device()Helge Deller
As found by the ubsan checker, the value of the 'index' variable can be out of range for the bc[] array: UBSAN: Undefined behaviour in arch/parisc/kernel/drivers.c:655:21 index 6 is out of range for type 'char [6]' Backtrace: [<104fa850>] __ubsan_handle_out_of_bounds+0x68/0x80 [<1019d83c>] check_parent+0xc0/0x170 [<1019d91c>] descend_children+0x30/0x6c [<1059e164>] device_for_each_child+0x60/0x98 [<1019cd54>] parse_tree_node+0x40/0x54 [<1019d86c>] check_parent+0xf0/0x170 [<1019d91c>] descend_children+0x30/0x6c [<1059e164>] device_for_each_child+0x60/0x98 [<1019d938>] descend_children+0x4c/0x6c [<1059e164>] device_for_each_child+0x60/0x98 [<1019cd54>] parse_tree_node+0x40/0x54 [<1019cffc>] hwpath_to_device+0xa4/0xc4 Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org
2018-03-27parisc: Add code generator for Qemu/SeaBIOS machine infoHelge Deller
Qemu now supports emulating PA-RISC machines. For that a forked version of SeaBIOS available at https://github.com/hdeller/seabios-hppa is used which requires some information about the emulated machine. This patch adds code to generate a header file with the necessary information for SeaBIOS. The information is extracted from the firmware the current kernel is running on. Tested on a B160L workstation. Signed-off-by: Helge Deller <deller@gmx.de>
2018-03-27parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail modeHelge Deller
Carlo Pisani noticed that his C3600 workstation behaved unstable during heavy I/O on the PCI bus with a VIA VT6421 IDE/SATA PCI card. To avoid such instability, this patch switches the LBA PCI bus from Hard Fail mode into Soft Fail mode. In this mode the bus will return -1UL for timed out MMIO transactions, which is exactly how the x86 (and most other architectures) PCI busses behave. This patch is based on a proposal by Grant Grundler and Kyle McMartin 10 years ago: https://www.spinics.net/lists/linux-parisc/msg01027.html Cc: Carlo Pisani <carlojpisani@gmail.com> Cc: Kyle McMartin <kyle@mcmartin.ca> Reviewed-by: Grant Grundler <grantgrundler@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2018-03-27parisc: Fix HPMC handler by increasing size to multiple of 16 bytesHelge Deller
Make sure that the HPMC (High Priority Machine Check) handler is 16-byte aligned and that it's length in the IVT is a multiple of 16 bytes. Otherwise PDC may decide not to call the HPMC crash handler. Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org
2018-03-27parisc: Directly call machine_power_off() in power button driverHelge Deller
Signed-off-by: Helge Deller <deller@gmx.de> Tested-by: Matt Turner <mattst88@gmail.com>
2018-03-27parisc: machine_power_off() should call pm_power_off()Helge Deller
Signed-off-by: Helge Deller <deller@gmx.de> Tested-by: Matt Turner <mattst88@gmail.com>
2018-03-27parisc/Kconfig: SMP kernels boot on all machinesHelge Deller
I'm not aware of any machines which won't be able to run our SMP kernel. Refine the Kconfig help text. Signed-off-by: Helge Deller <deller@gmx.de>
2018-03-27parisc: Silence uninitialized variable warning in dbl_to_sgl_fcnvff()Dan Carpenter
Smatch warns that is_tiny can be used uninitialized: arch/parisc/math-emu/fcnvff.c:297 dbl_to_sgl_fcnvff() error: uninitialized symbol 'is_tiny'. This code is very old so that suggests the bug doesn't have a huge affect in real life. But I've read the code and it seems like a reasonable warning. Either way it should be harmless to initialize it to false and silence the static checker warning. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Helge Deller <deller@gmx.de>
2018-03-27parisc: Move various functions and strings to init sectionHelge Deller
Signed-off-by: Helge Deller <deller@gmx.de>
2018-03-27parisc: Convert MAP_TYPE to cover 4 bits on pariscHelge Deller
On parisc we want to be as much as possible compatible to the major architectures like x86. Those architectures have MAP_TYPE defined as 0x0f which covers MAP_SHARED and MAP_PRIVATE and leaves two more bits unused. In contrast, on parisc we have MAP_TYPE defined to 0x03 which covers MAP_SHARED and MAP_PRIVATE only. But we don't have the 2 bits free as x86. Usually that's not a problem, but during the discussions for pmem+dax support the idea came up to use the two remaining bits of MAP_TYPE (on x86 and others) for the new MAP_DIRECT and MAP_SYNC flags. One requirement is, that an old kernel should correctly handle MAP_DIRECT and MAP_SYNC and fail on those if set. This only works if MAP_TYPE has 4 bits. Even though the pmem+dax people now choosed another solution via MAP_SHARED_VALIDATE, let's still proceed to be more compatible to x86 by adding two more bits for future usage. Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: John David Anglin <dave.anglin@bell.net>
2018-03-27parisc: Force to various endian types for sparseHelge Deller
Signed-off-by: Helge Deller <deller@gmx.de>
2018-03-27parisc/gscps2: Fix sparse warningsHelge Deller
Signed-off-by: Helge Deller <deller@gmx.de>
2018-03-27parisc/led: Fix sparse warningsHelge Deller
Annotate user buffer and use NULL to avoid sparse warnings. Signed-off-by: Helge Deller <deller@gmx.de>
2018-03-27parisc/parport_gsc: Use NULL to avoid sparse warningHelge Deller
Signed-off-by: Helge Deller <deller@gmx.de>
2018-03-27parisc/stifb: Use fb_memset() to avoid sparse warningHelge Deller
Signed-off-by: Helge Deller <deller@gmx.de>
2018-03-28kbuild: rpm-pkg: Support GNU tar >= 1.29Jason Gunthorpe
There is a change in how command line parsing is done in this version. Excludes and includes are now ordered with the file list. Since the spec file puts the file list before the exclude list it means newer tar ignores the excludes and packs all the build output into the kernel-devel RPM resulting in a huge package. Simple argument re-ordering fixes the problem. Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2018-03-28builddeb: Fix header package regarding dtc source linksJan Kiszka
Since d5d332d3f7e8, a couple of links in scripts/dtc/include-prefixes are additionally required in order to build device trees with the header package. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Reviewed-by: Riku Voipio <riku.voipio@linaro.org> Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2018-03-27perf vendor events s390: Add JSON files for IBM z14Thomas Richter
Add CPU measurement counter facility event description files (json files) for IBM z14. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Link: http://lkml.kernel.org/r/20180326082538.2258-5-tmricht@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2018-03-27perf vendor events s390: Add JSON files for IBM z13Thomas Richter
Add CPU measurement counter facility event description files (json files) for IBM z13. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Link: http://lkml.kernel.org/r/20180326082538.2258-4-tmricht@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2018-03-27perf vendor events s390: Add JSON files for IBM zEC12 zBC12Thomas Richter
Add CPU measurement counter facility event description files (json files) for IBM zEC12 and zBC12. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Link: http://lkml.kernel.org/r/20180326082538.2258-3-tmricht@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2018-03-27perf vendor events s390: Add JSON files for IBM z196Thomas Richter
Add CPU measurement counter facility event description files (json files) for IBM z196. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Link: http://lkml.kernel.org/r/20180326082538.2258-2-tmricht@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2018-03-27perf vendor events s390: Add JSON files for IBM z10EC z10BCThomas Richter
Add CPU measurement counter facility event description files (JSON files) for IBM z10EC and z10BC. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Link: http://lkml.kernel.org/r/20180326082538.2258-1-tmricht@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2018-03-27perf mmap: Be consistent when checking for an unmaped ring bufferArnaldo Carvalho de Melo
The previous patch is insufficient to cure the reported 'perf trace' segfault, as it only cures the perf_mmap__read_done() case, moving the segfault to perf_mmap__read_init() functio, fix it by doing the same refcount check. Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: David Ahern <dsahern@gmail.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Kan Liang <kan.liang@intel.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Wang Nan <wangnan0@huawei.com> Fixes: 8872481bd048 ("perf mmap: Introduce perf_mmap__read_init()") Link: https://lkml.kernel.org/r/20180326144127.GF18897@kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2018-03-27perf mmap: Fix accessing unmapped mmap in perf_mmap__read_done()Kan Liang
There is a segmentation fault when running 'perf trace'. For example: [root@jouet e]# perf trace -e *chdir -o /tmp/bla perf report --ignore-vmlinux -i ../perf.data The perf_mmap__consume() could unmap the mmap. It needs to check the refcnt in perf_mmap__read_done(). Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Kan Liang <kan.liang@linux.intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Wang Nan <wangnan0@huawei.com> Fixes: ee023de05f35 ("perf mmap: Introduce perf_mmap__read_done()") Link: http://lkml.kernel.org/r/1522071729-16776-1-git-send-email-kan.liang@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2018-03-27perf build: Fix check-headers.sh opts assignmentJiri Olsa
Currently the "opts" variable is not zero-ed and we keep on adding to it, ending up with: $ check-headers.sh 2>&1 + opts=' "-B"' + opts=' "-B" "-B"' + opts=' "-B" "-B" "-B"' + opts=' "-B" "-B" "-B" "-B"' + opts=' "-B" "-B" "-B" "-B" "-B"' + opts=' "-B" "-B" "-B" "-B" "-B" "-B"' Fix this by initializing it in the check() function, right before starting the loop. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: David Ahern <dsahern@gmail.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Link: http://lkml.kernel.org/r/20180321140515.2252-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2018-03-27ipmi/parisc: Add IPMI chassis poweroff for certain HP PA-RISC and IA-64 serversHelge Deller
This patch allows HP PA-RISC servers like rp3410/rp3440 and the HP C8000 workstation with an IPMI controller that predate IPMI 1.5 to use the standard poweroff or powercycle commands. These systems firmware don't set the chassis capability bit in the Get Device ID, but they do implement the standard poweroff and powercycle commands. Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2018-03-27Merge branch 'mlx4-misc-fixes-for-4.16'David S. Miller
Tariq Toukan says: ==================== mlx4 misc fixes for 4.16 This patchset contains misc bug fixes from the team to the mlx4 Core and Eth drivers. Patch 1 by Eran fixes a control mix of PFC and Global pauses, please queue it to -stable for >= v4.8. Patch 2 by Moshe fixes a resource leak in slave's delete flow, please queue it to -stable for >= v4.5. Series generated against net commit: 3c82b372a9f4 net: dsa: mt7530: fix module autoloading for OF platform drivers ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27net/mlx4_core: Fix memory leak while delete slave's resourcesMoshe Shemesh
mlx4_delete_all_resources_for_slave in resource tracker should free all memory allocated for a slave. While releasing memory of fs_rule, it misses releasing memory of fs_rule->mirr_mbox. Fixes: 78efed275117 ('net/mlx4_core: Support mirroring VF DMFS rules on both ports') Signed-off-by: Moshe Shemesh <moshe@mellanox.com> Signed-off-by: Tariq Toukan <tariqt@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27net/mlx4_en: Fix mixed PFC and Global pause user control requestsEran Ben Elisha
Global pause and PFC configuration should be mutually exclusive (i.e. only one of them at most can be set). However, once PFC was turned off, driver automatically turned Global pause on. This is a bug. Fix the driver behaviour to turn off PFC/Global once the user turned the other on. This also fixed a weird behaviour that at a current time, the profile had both PFC and global pause configuration turned on, which is Hardware-wise impossible and caused returning false positive indication to query tools. In addition, fix error code when setting global pause or PFC to change metadata only upon successful change. Also, removed useless debug print. Fixes: af7d51852631 ("net/mlx4_en: Add DCB PFC support through CEE netlink commands") Fixes: c27a02cd94d6 ("mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC") Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com> Signed-off-by: Tariq Toukan <tariqt@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27net/smc: use announced length in sock_recvmsg()Ursula Braun
Not every CLC proposal message needs the maximum buffer length. Due to the MSG_WAITALL flag, it is important to use the peeked real length when receiving the message. Fixes: d63d271ce2b5ce ("smc: switch to sock_recvmsg()") Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27llc: properly handle dev_queue_xmit() return valueCong Wang
llc_conn_send_pdu() pushes the skb into write queue and calls llc_conn_send_pdus() to flush them out. However, the status of dev_queue_xmit() is not returned to caller, in this case, llc_conn_state_process(). llc_conn_state_process() needs hold the skb no matter success or failure, because it still uses it after that, therefore we should hold skb before dev_queue_xmit() when that skb is the one being processed by llc_conn_state_process(). For other callers, they can just pass NULL and ignore the return value as they are. Reported-by: Noam Rathaus <noamr@beyondsecurity.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27ALSA: usb-audio: fix memory leak on cvalColin Ian King
With the current exit return path of the ctl_info allocation failure cval is not being freed resulting in a memory leak. Fix this by kfree'ing it on the return. Detected by CoverityScan, CID#1466878 ("Resource Leak") Fixes: 21e9b3e931f7 ("ALSA: usb-audio: fix uac control query argument") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-03-27Merge tag 'mlx5-fixes-2018-03-23' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2018-03-23 The following series includes fixes for mlx5 netdev and eswitch. v1->v2: - Fixed commit message quotation marks in patch #7 For -stable v4.12 ('net/mlx5e: Avoid using the ipv6 stub in the TC offload neigh update path') ('net/mlx5e: Fix traffic being dropped on VF representor') For -stable v4.13 ('net/mlx5e: Fix memory usage issues in offloading TC flows') ('net/mlx5e: Verify coalescing parameters in range') For -stable v4.14 ('net/mlx5e: Don't override vport admin link state in switchdev mode') For -stable v4.15 ('108b2b6d5c02 net/mlx5e: Sync netdev vxlan ports at open') Please pull and let me know if there's any problem. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27Merge tag 'mlx5-updates-2018-03-22' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2018-03-22 (Misc updates) This series includes misc updates for mlx5 core and netdev dirver, Highlights: From Inbar, three patches to add support for PFC stall prevention statistics and enable/disable through new ethtool tunable, as requested from previous submission. From Moshe, four patches, added more drop counters: - drop counter for netdev steering miss - drop counter for when VF logical link is down - drop counter for when netdev logical link is down. From Or, three patches to support vlan push/pop offload via tc HW action, for newer HW (Connectx-5 and onward) via HW steering flow actions rather than the emulated path for the older HW brands. And five more misc small trivial patches. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27liquidio: Removed duplicate Tx queue status checkIntiyaz Basha
Napi is checking Tx queue status and waking the Tx queue if required. Same operation is being done while freeing every Tx buffer. So removed the duplicate operation of checking Tx queue status from the Tx buffer free functions. Signed-off-by: Intiyaz Basha <intiyaz.basha@cavium.com> Signed-off-by: Felix Manlunas <felix.manlunas@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27strparser: Fix sign of err codesDave Watson
strp_parser_err is called with a negative code everywhere, which then calls abort_parser with a negative code. strp_msg_timeout calls abort_parser directly with a positive code. Negate ETIMEDOUT to match signed-ness of other calls. The default abort_parser callback, strp_abort_strp, sets sk->sk_err to err. Also negate the error here so sk_err always holds a positive value, as the rest of the net code expects. Currently a negative sk_err can result in endless loops, or user code that thinks it actually sent/received err bytes. Found while testing net/tls_sw recv path. Fixes: 43a0c6751a322847 ("strparser: Stream parser for messages") Signed-off-by: Dave Watson <davejwatson@fb.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27net sched actions: fix dumping which requires several messages to user spaceCraig Dillabaugh
Fixes a bug in the tcf_dump_walker function that can cause some actions to not be reported when dumping a large number of actions. This issue became more aggrevated when cookies feature was added. In particular this issue is manifest when large cookie values are assigned to the actions and when enough actions are created that the resulting table must be dumped in multiple batches. The number of actions returned in each batch is limited by the total number of actions and the memory buffer size. With small cookies the numeric limit is reached before the buffer size limit, which avoids the code path triggering this bug. When large cookies are used buffer fills before the numeric limit, and the erroneous code path is hit. For example after creating 32 csum actions with the cookie aaaabbbbccccdddd $ tc actions ls action csum total acts 26 action order 0: csum (tcp) action continue index 1 ref 1 bind 0 cookie aaaabbbbccccdddd ..... action order 25: csum (tcp) action continue index 26 ref 1 bind 0 cookie aaaabbbbccccdddd total acts 6 action order 0: csum (tcp) action continue index 28 ref 1 bind 0 cookie aaaabbbbccccdddd ...... action order 5: csum (tcp) action continue index 32 ref 1 bind 0 cookie aaaabbbbccccdddd Note that the action with index 27 is omitted from the report. Fixes: 4b3550ef530c ("[NET_SCHED]: Use nla_nest_start/nla_nest_end")" Signed-off-by: Craig Dillabaugh <cdillaba@mojatatu.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27r8169: fix setting driver_data after register_netdevHeiner Kallweit
pci_set_drvdata() is called only after registering the net_device, therefore we could run into a NPE if one of the functions using driver_data is called before it's set. Fix this by calling pci_set_drvdata() before registering the net_device. This fix is a candidate for stable. As far as I can see the bug has been there in kernel version 3.2 already, therefore I can't provide a reference which commit is fixed by it. The fix may need small adjustments per kernel version because due to other changes the label which is jumped to if register_netdev() fails has changed over time. Reported-by: David Miller <davem@davemloft.net> Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27ipv6: addrconf: Use normal debugging styleJoe Perches
Remove local ADBG macro and use netdev_dbg/pr_debug Miscellanea: o Remove unnecessary debug message after allocation failure as there already is a dump_stack() on the failure paths o Leave the allocation failure message on snmp6_alloc_dev as there is one code path that does not do a dump_stack() Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27net: fix possible out-of-bound read in skb_network_protocol()Eric Dumazet
skb mac header is not necessarily set at the time skb_network_protocol() is called. Use skb->data instead. BUG: KASAN: slab-out-of-bounds in skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739 Read of size 2 at addr ffff8801b3097a0b by task syz-executor5/14242 CPU: 1 PID: 14242 Comm: syz-executor5 Not tainted 4.16.0-rc6+ #280 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report+0x23c/0x360 mm/kasan/report.c:412 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:443 skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739 harmonize_features net/core/dev.c:2924 [inline] netif_skb_features+0x509/0x9b0 net/core/dev.c:3011 validate_xmit_skb+0x81/0xb00 net/core/dev.c:3084 validate_xmit_skb_list+0xbf/0x120 net/core/dev.c:3142 packet_direct_xmit+0x117/0x790 net/packet/af_packet.c:256 packet_snd net/packet/af_packet.c:2944 [inline] packet_sendmsg+0x3aed/0x60b0 net/packet/af_packet.c:2969 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xca/0x110 net/socket.c:639 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2047 __sys_sendmsg+0xe5/0x210 net/socket.c:2081 Fixes: 19acc327258a ("gso: Handle Trans-Ether-Bridging protocol in skb_network_protocol()") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Pravin B Shelar <pshelar@ovn.org> Reported-by: Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27tc-testing: Correct compound statements for namespace executionLucas Bates
If tdc is executing test cases inside a namespace, only the first command in a compound statement will be executed inside the namespace by tdc. As a result, the subsequent commands are not executed inside the namespace and the test will fail. Example: for i in {x..y}; do args="foo"; done && tc actions add $args The namespace execution feature will prepend 'ip netns exec' to the command: ip netns exec tcut for i in {x..y}; do args="foo"; done && \ tc actions add $args So the actual tc command is not parsed by the shell as being part of the namespace execution. Enclosing these compound statements inside a bash invocation with proper escape characters resolves the problem by creating a subshell inside the namespace. Signed-off-by: Lucas Bates <lucasb@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27net-usb: add qmi_wwan if on lte modem wistron neweb d18q1Giuseppe Lippolis
This modem is embedded on dlink dwr-921 router. The oem configuration states: T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1435 ProdID=0918 Rev= 2.32 S: Manufacturer=Android S: Product=Android S: SerialNumber=0123456789ABCDEF C:* #Ifs= 7 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=32ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=125us Tested on openwrt distribution Signed-off-by: Giuseppe Lippolis <giu.lippolis@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27tipc: tipc_node_create() can be staticWei Yongjun
Fixes the following sparse warning: net/tipc/node.c:336:18: warning: symbol 'tipc_node_create' was not declared. Should it be static? Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Acked-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27tipc: fix error handling in tipc_udp_enable()Wei Yongjun
Release alloced resource before return from the error handling case in tipc_udp_enable(), otherwise will cause memory leak. Fixes: 52dfae5c85a4 ("tipc: obtain node identity from interface by default") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Acked-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27net: aquantia: Make function hw_atl_utils_mpi_set_speed() staticWei Yongjun
Fixes the following sparse warning: drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c:508:5: warning: symbol 'hw_atl_utils_mpi_set_speed' was not declared. Should it be static? Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27Merge branch 'net-mvpp2-Remove-unnecessary-dynamic-allocs'David S. Miller
Maxime Chevallier says: ==================== net: mvpp2: Remove unnecessary dynamic allocs Some utility functions in mvpp2 make use of dynamic alloc to exchange temporary objects representing Parser Entries (which are generic filtering entries in the PPv2 controller). These objects are small (44 bytes each), we can use the stack to exchange them. Some previous discussion on this topic showed that the mvpp2_prs_hw_read, which initializes a struct mvpp2_prs_entry based on one of its fields, can easily lead to erroneous code if we don't zero-out the struct beforehand : https://lkml.org/lkml/2018/3/21/739 To fix this, I propose to rename mvpp2_prs_hw_read into mvpp2_prs_init_from_hw, make it zero-out the struct and take the index as a parameter. That's what's done in the first patch of the series. The second patch is the V3 of ("net: mvpp2: Don't use dynamic allocs for local variables"), making use of mvpp2_prs_init_from_hw and taking previous comments into account. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27net: mvpp2: Don't use dynamic allocs for local variablesMaxime Chevallier
Some helper functions that search for given entries in the TCAM filter on PPv2 controller make use of dynamically alloced temporary variables, allocated with GFP_KERNEL. These functions can be called in atomic context, and dynamic alloc is not really needed in these cases anyways. This commit gets rid of dynamic allocs and use stack allocation in the following functions, and where they're used : - mvpp2_prs_flow_find - mvpp2_prs_vlan_find - mvpp2_prs_double_vlan_find - mvpp2_prs_mac_da_range_find For all these functions, instead of returning an temporary object representing the TCAM entry, we simply return the TCAM id that matches the requested entry. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27net: mvpp2: Make mvpp2_prs_hw_read a parser entry init functionMaxime Chevallier
The mvpp2_prs_hw_read function uses the 'index' field of the struct mvpp2_prs_entry to initialize the rest of the fields. This makes it unclear from a caller's perspective, who needs to manipulate a struct that is not entirely initialized. This commit makes it an init function for prs_entry, by passing it the index as a parameter. The function now zeroes the entry, and sets the index field before doing all other init from HW. The function is renamed 'mvpp2_prs_init_from_hw' to make that clear. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27Merge tag 'batadv-net-for-davem-20180326' of git://git.open-mesh.org/linux-mergeDavid S. Miller
Simon Wunderlich says: ==================== Here are some batman-adv bugfixes: - fix multicast-via-unicast transmissions for AP isolation and gateway extension, by Linus Luessing (2 patches) ==================== Signed-off-by: David S. Miller <davem@davemloft.net>