summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-05-11arm64: dts: mt7622: add High-Speed DMA device nodesSean Wang
add High-Speed DMA (HSDMA) nodes Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
2018-05-11Merge tag 'mlx5-fixes-2018-05-10' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2018-05-10 the following series includes some fixes for mlx5 core driver. Please pull and let me know if there's any problem. For -stable v4.5 ("net/mlx5: E-Switch, Include VF RDMA stats in vport statistics") For -stable v4.10 ("net/mlx5e: Err if asked to offload TC match on frag being first") ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-11Merge tag 'drm-fixes-for-v4.17-rc5' of ↵Linus Torvalds
git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "nouveau, amdgpu, i915, vc4, omap, exynos and atomic fixes. As last week seemed a bit slow, we got a few more fixes this week. The main stuff is two weeks of fixes for amdgpu, some missing bits of vega12 atom firmware support were added, and some power management fixes. Nouveau got two regression fixes for an DP MST deadlock and a random oops fix. i915 got an LVDS panel timeout fix 2 WARN fixes. exynos fixed a pagefault issue in the mixer driver. vc4 has an oops fix. omap had a bunch of uninit var and error-checking fixes. Two atomic modesetting state fixes. One minor agp cleanup patch" * tag 'drm-fixes-for-v4.17-rc5' of git://people.freedesktop.org/~airlied/linux: (30 commits) drm/amd/pp: Fix performance drop on Fiji drm/nouveau: Fix deadlock in nv50_mstm_register_connector() drm/nouveau/ttm: don't dereference nvbo::cli, it can outlive client agp: uninorth: make two functions static drm/amd/pp: Refine the output of pp_power_profile_mode on VI drm/amdgpu: Switch to interruptable wait to recover from ring hang. drm/ttm: Use GFP_TRANSHUGE_LIGHT for allocating huge pages drm/amd/display: Use kvzalloc for potentially large allocations drm/amd/display: Don't return ddc result and read_bytes in same return value drm/amd/display: Add get_firmware_info_v3_2 for VG12 drm/amd: Add BIOS smu_info v3_3 required struct def. drm/amd/display: Add VG12 ASIC IDs drm/vc4: Fix scaling of uni-planar formats drm/exynos: hdmi: avoid duplicating drm_bridge_attach drm/i915: Fix drm:intel_enable_lvds ERROR message in kernel log drm/i915: Correctly populate user mode h/vdisplay with pipe src size during readout drm/i915: Adjust eDP's logical vco in a reliable place. drm/bridge/sii8620: add Kconfig dependency on extcon drm/omap: handle alloc failures in omap_connector drm/omap: add missing linefeeds to prints ...
2018-05-11ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsgAndrey Ignatov
Fix more memory leaks in ip_cmsg_send() callers. Part of them were fixed earlier in 919483096bfe. * udp_sendmsg one was there since the beginning when linux sources were first added to git; * ping_v4_sendmsg one was copy/pasted in c319b4d76b9e. Whenever return happens in udp_sendmsg() or ping_v4_sendmsg() IP options have to be freed if they were allocated previously. Add label so that future callers (if any) can use it instead of kfree() before return that is easy to forget. Fixes: c319b4d76b9e (net: ipv4: add IPPROTO_ICMP socket kind) Signed-off-by: Andrey Ignatov <rdna@fb.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-11mlxsw: core: Fix an error handling path in 'mlxsw_core_bus_device_register()'Christophe JAILLET
Resources are not freed in the reverse order of the allocation. Labels are also mixed-up. Fix it and reorder code and labels in the error handling path of 'mlxsw_core_bus_device_register()' Fixes: ef3116e5403e ("mlxsw: spectrum: Register KVD resources with devlink") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by: Ido Schimmel <idosch@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-11arm: dts: mt7623: add MT7623N reference board with eMMCSean Wang
Add MT7623N reference board with eMMC. On the board, there is additional external PHY ICPlus IP1001 transceiver available by port 5 on the MDIO bus connectted with GMAC2. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Suggested-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
2018-05-11arm: dts: mt7623: add MT7623A reference boardsSean Wang
Add MT7623A reference board with eMMC and NAND, respectively. The both boards compared against MT7623N BPI-R2, we could see there are UART[0-1] and USB2 being removed, I2C2 and SPI1 being added, I2C1, UART2 owning distinct pin usage and an extra WM8960 codec chip plugged into the I2C1 offering the functionality of audio player and recorder through SoC audio front-end engine (AFE). Signed-off-by: Sean Wang <sean.wang@mediatek.com> Suggested-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
2018-05-11arm: dts: mt7623: add MT7623A SoC level DTSSean Wang
Add a common file for MT7623A SoC level DTS, indicating MT7623A only has a specific definition for power domain. That causes we need to change related consumers devices such as audio, ethernet, crypto, NAND, and USB controller to grasp its own power domain it should belong to. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
2018-05-11Merge branch 'bonding-bug-fixes-and-regressions'David S. Miller
Debabrata Banerjee says: ==================== bonding: bug fixes and regressions Fixes to bonding driver for balance-alb mode, suitable for stable. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-11bonding: send learning packets for vlans on slaveDebabrata Banerjee
There was a regression at some point from the intended functionality of commit f60c3704e87d ("bonding: Fix alb mode to only use first level vlans.") Given the return value vlan_get_encap_level() we need to store the nest level of the bond device, and then compare the vlan's encap level to this. Without this, this check always fails and learning packets are never sent. In addition, this same commit caused a regression in the behavior of balance_alb, which requires learning packets be sent for all interfaces using the slave's mac in order to load balance properly. For vlan's that have not set a user mac, we can send after checking one bit. Otherwise we need send the set mac, albeit defeating rx load balancing for that vlan. Signed-off-by: Debabrata Banerjee <dbanerje@akamai.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-11bonding: do not allow rlb updates to invalid macDebabrata Banerjee
Make sure multicast, broadcast, and zero mac's cannot be the output of rlb updates, which should all be directed arps. Receive load balancing will be collapsed if any of these happen, as the switch will broadcast. Signed-off-by: Debabrata Banerjee <dbanerje@akamai.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-11arm: dts: mt7623: extend common file reused by all boards with MT7623 SoCsSean Wang
Move all possible setups for pio into SoC level DTSI file mt7623.dtsi in order to introduce more boards such as official MT7623A reference boards without copy-n-pasting almost the same content of nodes in pio into every new file. So, it should be better to reuse those nodes by consolidating them into the common file mt7623.dtsi from the current existent DTS and allow new DTS files to refer to them. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
2018-05-11arm: dts: mt6323: move node mt6323 leds to mt6323.dtsiSean Wang
Since those LEDs are parts of PMIC MT6323, it is reasonable to merge those LEDs node definition back into mt6323.dtsi. This way can improve the reusability of those nodes among different boards with the same PMIC. And LED is very much board specific and thus the mt6323.dtsi only includes the parent node here and leave these child nodes in the board specific dts file. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Cc: Lee Jones <lee.jones@linaro.org> Cc: Rob Herring <robh+dt@kernel.org> Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
2018-05-11arm: dts: mt7623: add BTIF, HSDMA and SPI-NOR device nodesSean Wang
add BTIF, HSDMA and SPI-NOR device nodes and enable it on relevant boards Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
2018-05-11arm: dts: mt7623: fix all Warnings (unit_address_vs_reg)Sean Wang
Fix below a lot of Warnings (unit_address_vs_reg) that dtc complains so much for Node /oscillator@1 has a unit name, but no reg property Node /oscillator@0 has a unit name, but no reg property Node /pinctrl@10005000/cir@0 has a unit name, but no reg property Node /pinctrl@10005000/i2c@0 has a unit name, but no reg property Node /pinctrl@10005000/i2c@1 has a unit name, but no reg property Node /pinctrl@10005000/i2s@0 has a unit name, but no reg property Node /pinctrl@10005000/i2s@1 has a unit name, but no reg property Node /pinctrl@10005000/keys@0 has a unit name, but no reg property Node /pinctrl@10005000/leds@0 has a unit name, but no reg property Node /pinctrl@10005000/pwm@0 has a unit name, but no reg property Node /pinctrl@10005000/spi@0 has a unit name, but no reg property Node /pinctrl@10005000/uart@0 has a unit name, but no reg property Node /pinctrl@10005000/uart@1 has a unit name, but no reg property Node /pinctrl@10005000/uart@2 has a unit name, but no reg property Node /ethernet@1b100000/mdio-bus/switch@0/ports has a reg or ranges property, but no unit name Signed-off-by: Sean Wang <sean.wang@mediatek.com> Cc: Rob Herring <robh+dt@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: devicetree@vger.kernel.org Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
2018-05-11arm: dts: mt7623: fix available memory size on bananapi-r2Sean Wang
There is 2GB DDR3 available on bananapi-r2 board as [1] specified. [1] http://www.banana-pi.org/r2.html Signed-off-by: Sean Wang <sean.wang@mediatek.com> Cc: Rob Herring <robh+dt@kernel.org> Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
2018-05-11arm: dts: mt7623: fix invalid memory node being generatedSean Wang
Below two wrong nodes in existing DTS files would cause a fail boot since in fact the address 0 is not the correct place the memory device locates at. memory { device_type = "memory"; reg = <0x0 0x0 0x0 0x0>; }; memory@80000000 { reg = <0x0 0x80000000 0x0 0x40000000>; }; In order to avoid having a memory node starting at address 0, we can't include file skeleton64.dtsi and instead need to explicitly manually define a few of properties the DTS relies on such as #address-cells and #size-cells in root node and device_type in the node memory@80000000. Cc: stable@vger.kernel.org Fixes: 31ac0d69a1d4 ("ARM: dts: mediatek: add MT7623 basic support") Signed-off-by: Sean Wang <sean.wang@mediatek.com> Cc: Rob Herring <robh+dt@kernel.org> Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
2018-05-11tracing: Fix regex_match_front() to not over compare the test stringSteven Rostedt (VMware)
The regex match function regex_match_front() in the tracing filter logic, was fixed to test just the pattern length from testing the entire test string. That is, it went from strncmp(str, r->pattern, len) to strcmp(str, r->pattern, r->len). The issue is that str is not guaranteed to be nul terminated, and if r->len is greater than the length of str, it can access more memory than is allocated. The solution is to add a simple test if (len < r->len) return 0. Cc: stable@vger.kernel.org Fixes: 285caad415f45 ("tracing/filters: Fix MATCH_FRONT_ONLY filter matching") Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2018-05-11Merge branches 'pm-pci' and 'pm-docs'Rafael J. Wysocki
* pm-pci: PCI / PM: Check device_may_wakeup() in pci_enable_wake() PCI / PM: Always check PME wakeup capability for runtime wakeup support * pm-docs: PM: docs: intel_pstate: fix Active Mode w/o HWP paragraph PM: docs: sleep-states: Fix a typo ("includig")
2018-05-11ARM: dts: vexpress: replace '_' with '-' in node namesSudeep Holla
The latest DTC throws warnings for character '_' in the node names. Warning (node_name_chars_strict): /pmu_a15: Character '_' not recommended in node name Warning (node_name_chars_strict): /pmu_a7: Character '_' not recommended in node name The general recommendation is to use character '-' for all the node names. This patch fixes the warnings following the recommendation. Acked-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2018-05-11ARM: dts: vexpress: use standard gpio bindings for sys_{led,mci,flash}Sudeep Holla
Commit 2cff6dba57b7 ("ARM: dts: vexpress: fix node name unit-address presence warnings") removed the unit address as there was no associated reg property in these sysreg nodes. Also the latest DTC throws warnings for character '_' in the node names. Warning (node_name_chars_strict): /sysreg@10000/sys_led: Character '_' not recommended in node name Warning (node_name_chars_strict): /sysreg@10000/sys_mci: Character '_' not recommended in node name Warning (node_name_chars_strict): /sysreg@10000/sys_flash: Character '_' not recommended in node name The correct way to fix this as well as the original unit-address presence warnings is to use the standard gpio controller binding and specify the reg properties as per the hardware as it was before. However note that Vexpress sysreg MFD driver will still continue to use the hardcoded values for compatibility reasons. Acked-by: Liviu Dudau <liviu.dudau@arm.com> Suggested-by: Rob Herring <robh@kernel.org> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2018-05-11ARM: dts: sun8i: h3: Add SY8106A regulator to Orange Pi PCOndrej Jirman
Add SY8106A regulator to r_i2c bus and enable the r_i2c bus on Orange Pi PC, then set the power supply of the ARM cores to this regulator, in order to enable DVFS. Signed-off-by: Ondrej Jirman <megous@megous.com> [Icenowy: Enable DVFS in this patch, slight changes and change commit message] Signed-off-by: Icenowy Zheng <icenowy@aosc.io> Reviewed-by: Chen-Yu Tsai <wens@csie.org> Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
2018-05-11Merge branch 'thermal-soc' into nextZhang Rui
2018-05-10compat: fix 4-byte infoleak via uninitialized struct fieldJann Horn
Commit 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts") removed the memset() in compat_get_timex(). Since then, the compat adjtimex syscall can invoke do_adjtimex() with an uninitialized ->tai. If do_adjtimex() doesn't write to ->tai (e.g. because the arguments are invalid), compat_put_timex() then copies the uninitialized ->tai field to userspace. Fix it by adding the memset() back. Fixes: 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts") Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-05-11Merge branch 'drm-fixes-4.17' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie
into drm-fixes Single amdgpu regression fix * 'drm-fixes-4.17' of git://people.freedesktop.org/~agd5f/linux: drm/amd/pp: Fix performance drop on Fiji
2018-05-10smb3: directory sync should not return an errorSteve French
As with NFS, which ignores sync on directory handles, fsync on a directory handle is a noop for CIFS/SMB3. Do not return an error on it. It breaks some database apps otherwise. Signed-off-by: Steve French <smfrench@gmail.com> CC: Stable <stable@vger.kernel.org> Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com> Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
2018-05-10ARM: dts: meson8m2: add support for the Tronsmart MXIII PlusOleg Ivanov
The Tronsmart MXIII Plus is an Android TV box which uses the Amlogic S812 (Meson8m2) SoC. It uses a Realtek RTL8211F RGMII Ethernet PHY as well as a Ricoh RN5T618 system power controller. It also comes with an Ampak AP6330 SDIO wifi/Bluetooth combo chip (support for wifi and Bluetooth is currently not added because the Linux drivers currently only support one MMC controller and that is used for the SD card). Signed-off-by: Oleg Ivanov <balbes-150@yandex.ru> Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2018-05-10ARM: dts: meson8: add the uart_A pinsMartin Blumenstingl
This adds the pins for uart_A, which is used to connect to the Bluetooth module on some devices. Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2018-05-10ARM: dts: meson: add support for the Meson8m2 SoCMartin Blumenstingl
This adds a meson8m2.dtsi which simply inherits meson8.dtsi as both SoCs share most peripherals. The known differences are: - Meson8m2's hardware video decoder additionally supports H.265 decoding - Meson8m2 has the same Gigabit MAC as Meson8b (instead of the 10/100M MAC that Meson8 uses) - Meson8m2 uses the same watchdog register layout/bits as Meson8b (using the Meson8 watchdog compatible leads to an infinite hang when rebooting the machine) - Meson8m2 uses the same SAR ADC register layout/bits as Meson8b. However, it uses the temperature sensor calibration formula (and registers) Meson8b which differ from Meson8. This however is currently not supported by the meson-saradc driver yet. - the pin controller is mostly compatible with Meson8, Meson8m2 has an additional function on eight pins and removes the "VGA" function. So there's a total of 10 pins which are slightly changed, which is why there's a separate compatible for the pin controller - a separate compatible for the clock controller is used because at least the Mali clock tree (not supported yet) is the same as on GXBB while Meson8 and Meson8b have a reduced/older version of the Mali clock tree. Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2018-05-10ARM: meson: add support for the Meson8m2 SoCsMartin Blumenstingl
Add the newly introduced compatible string for the Meson8m2 SoC. The existing Meson8 Kconfig entry is updated to also provide support for the Meson8m2 SoCs. The Meson8m2 SoC is mostly identical to the Meson8 SoC with just a few peripherals being updated. Both SoCs currently share the same pinctrl, clock and GPIO IRQ bindings. Thus the existing Kconfig entry is re-used to avoid duplication (the only cost is building a few extra DTBs). Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2018-05-10net/mlx5e: Err if asked to offload TC match on frag being firstRoi Dayan
The HW doesn't support matching on frag first/later, return error if we are asked to offload that. Fixes: 3f7d0eb42d59 ("net/mlx5e: Offload TC matching on packets being IP fragments") Signed-off-by: Roi Dayan <roid@mellanox.com> Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2018-05-10net/mlx5: E-Switch, Include VF RDMA stats in vport statisticsAdi Nissim
The host side reporting of VF vport statistics didn't include the VF RDMA traffic. Fixes: 3b751a2a418a ("net/mlx5: E-Switch, Introduce get vf statistics") Signed-off-by: Adi Nissim <adin@mellanox.com> Reported-by: Ariel Almog <ariela@mellanox.com> Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2018-05-10net/mlx5: Free IRQs in shutdown pathDaniel Jurgens
Some platforms require IRQs to be free'd in the shutdown path. Otherwise they will fail to be reallocated after a kexec. Fixes: 8812c24d28f4 ("net/mlx5: Add fast unload support in shutdown flow") Signed-off-by: Daniel Jurgens <danielj@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
2018-05-10rxrpc: Trace UDP transmission failureDavid Howells
Add a tracepoint to log transmission failure from the UDP transport socket being used by AF_RXRPC. Signed-off-by: David Howells <dhowells@redhat.com>
2018-05-10rxrpc: Add a tracepoint to log ICMP/ICMP6 and error messagesDavid Howells
Add a tracepoint to log received ICMP/ICMP6 events and other error messages. Signed-off-by: David Howells <dhowells@redhat.com>
2018-05-10rxrpc: Fix the min security level for kernel callsDavid Howells
Fix the kernel call initiation to set the minimum security level for kernel initiated calls (such as from kAFS) from the sockopt value. Fixes: 19ffa01c9c45 ("rxrpc: Use structs to hold connection params and protocol info") Signed-off-by: David Howells <dhowells@redhat.com>
2018-05-10rxrpc: Fix error reception on AF_INET6 socketsDavid Howells
AF_RXRPC tries to turn on IP_RECVERR and IP_MTU_DISCOVER on the UDP socket it just opened for communications with the outside world, regardless of the type of socket. Unfortunately, this doesn't work with an AF_INET6 socket. Fix this by turning on IPV6_RECVERR and IPV6_MTU_DISCOVER instead if the socket is of the AF_INET6 family. Without this, kAFS server and address rotation doesn't work correctly because the algorithm doesn't detect received network errors. Fixes: 75b54cb57ca3 ("rxrpc: Add IPv6 support") Signed-off-by: David Howells <dhowells@redhat.com>
2018-05-10rxrpc: Fix missing start of call timeoutDavid Howells
The expect_rx_by call timeout is supposed to be set when a call is started to indicate that we need to receive a packet by that point. This is currently put back every time we receive a packet, but it isn't started when we first send a packet. Without this, the call may wait forever if the server doesn't deign to reply. Fix this by setting the timeout upon a successful UDP sendmsg call for the first DATA packet. The timeout is initiated only for initial transmission and not for subsequent retries as we don't want the retry mechanism to extend the timeout indefinitely. Fixes: a158bdd3247b ("rxrpc: Fix call timeouts") Reported-by: Marc Dionne <marc.dionne@auristor.com> Signed-off-by: David Howells <dhowells@redhat.com>
2018-05-10Merge tag 'linux-can-fixes-for-4.17-20180510' of ↵David S. Miller
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== this is a pull request for net/master consisting of 2 patches. Both patches are from Lukas Wunner and fix two problems found in the hi311x CAN driver under high load situations. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-10qed: fix spelling mistake: "taskelt" -> "tasklet"Colin Ian King
Trivial fix to spelling mistake in DP_VERBOSE message text Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-10sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsgXin Long
In Commit 1f45f78f8e51 ("sctp: allow GSO frags to access the chunk too"), it held the chunk in sctp_ulpevent_make_rcvmsg to access it safely later in recvmsg. However, it also added sctp_chunk_put in fail_mark err path, which is only triggered before holding the chunk. syzbot reported a use-after-free crash happened on this err path, where it shouldn't call sctp_chunk_put. This patch simply removes this call. Fixes: 1f45f78f8e51 ("sctp: allow GSO frags to access the chunk too") Reported-by: syzbot+141d898c5f24489db4aa@syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-10net/mlx4_en: Fix an error handling path in 'mlx4_en_init_netdev()'Christophe JAILLET
If an error occurs, 'mlx4_en_destroy_netdev()' is called. It then calls 'mlx4_en_free_resources()' which does the needed resources cleanup. So, doing some explicit kfree in the error handling path would lead to some double kfree. Simplify code to avoid such a case. Fixes: 67f8b1dcb9ee ("net/mlx4_en: Refactor the XDP forwarding rings scheme") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by: Tariq Toukan <tariqt@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-10hv_netvsc: set master deviceStephen Hemminger
The hyper-v transparent bonding should have used master_dev_link. The netvsc device should look like a master bond device not like the upper side of a tunnel. This makes the semantics the same so that userspace applications looking at network devices see the correct master relationshipship. Fixes: 0c195567a8f6 ("netvsc: transparent VF management") Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-10Merge tag 'mac80211-for-davem-2018-05-09' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== We only have a few fixes this time: * WMM element validation * SAE timeout * add-BA timeout * docbook parsing * a few memory leaks in error paths ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-10tipc: fix one byte leak in tipc_sk_set_orig_addr()Eric Dumazet
sysbot/KMSAN reported an uninit-value in recvmsg() that I tracked down to tipc_sk_set_orig_addr(), missing srcaddr->member.scope initialization. This patches moves srcaddr->sock.scope init to follow fields order and ease future verifications. BUG: KMSAN: uninit-value in copy_to_user include/linux/uaccess.h:184 [inline] BUG: KMSAN: uninit-value in move_addr_to_user+0x32e/0x530 net/socket.c:226 CPU: 0 PID: 4549 Comm: syz-executor287 Not tainted 4.17.0-rc3+ #88 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:113 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 kmsan_internal_check_memory+0x135/0x1e0 mm/kmsan/kmsan.c:1157 kmsan_copy_to_user+0x69/0x160 mm/kmsan/kmsan.c:1199 copy_to_user include/linux/uaccess.h:184 [inline] move_addr_to_user+0x32e/0x530 net/socket.c:226 ___sys_recvmsg+0x4e2/0x810 net/socket.c:2285 __sys_recvmsg net/socket.c:2328 [inline] __do_sys_recvmsg net/socket.c:2338 [inline] __se_sys_recvmsg net/socket.c:2335 [inline] __x64_sys_recvmsg+0x325/0x460 net/socket.c:2335 do_syscall_64+0x154/0x220 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x4455e9 RSP: 002b:00007fe3bd36ddb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 00000000006dac24 RCX: 00000000004455e9 RDX: 0000000000002002 RSI: 0000000020000400 RDI: 0000000000000003 RBP: 00000000006dac20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff98ce4b6f R14: 00007fe3bd36e9c0 R15: 0000000000000003 Local variable description: ----addr@___sys_recvmsg Variable was created at: ___sys_recvmsg+0xd5/0x810 net/socket.c:2246 __sys_recvmsg net/socket.c:2328 [inline] __do_sys_recvmsg net/socket.c:2338 [inline] __se_sys_recvmsg net/socket.c:2335 [inline] __x64_sys_recvmsg+0x325/0x460 net/socket.c:2335 Byte 19 of 32 is uninitialized Fixes: 31c82a2d9d51 ("tipc: add second source address to recvmsg()/recvfrom()") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Jon Maloy <jon.maloy@ericsson.com> Cc: Ying Xue <ying.xue@windriver.com> Acked-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-10tc-testing: fix tdc tests for 'bpf' actionDavide Caratti
- correct a typo in the value of 'matchPattern' of test 282d, potentially causing false negative - allow errors when 'teardown' executes '$TC action flush action bpf' in test 282d, to fix false positive when it is run with act_bpf unloaded - correct the value of 'matchPattern' in test e939, causing false positive in case the BPF JIT is enabled Fixes: 440ea4ae1828 ("tc-testing: add selftests for 'bpf' action") Signed-off-by: Davide Caratti <dcaratti@redhat.com> Acked-by: Lucas Bates <lucasb@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-10net/mlx4_en: Verify coalescing parameters are in rangeMoshe Shemesh
Add check of coalescing parameters received through ethtool are within range of values supported by the HW. Driver gets the coalescing rx/tx-usecs and rx/tx-frames as set by the users through ethtool. The ethtool support up to 32 bit value for each. However, mlx4 modify cq limits the coalescing time parameter and coalescing frames parameters to 16 bits. Return out of range error if user tries to set these parameters to higher values. Change type of sample-interval and adaptive_rx_coal parameters in mlx4 driver to u32 as the ethtool holds them as u32 and these parameters are not limited due to mlx4 HW. Fixes: c27a02cd94d6 ('mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC') Signed-off-by: Moshe Shemesh <moshe@mellanox.com> Signed-off-by: Tariq Toukan <tariqt@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-10cxgb4: copy mbox log size to PF0-3 adap instancesGanesh Goudar
copy mbox size to adapter instances of PF0-3 to avoid mbox log overflow. This fixes the possible protection fault. Fixes: baf5086840ab ("cxgb4: restructure VF mgmt code") Signed-off-by: Casey Leedom <leedom@chelsio.com> Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-10cxgb4: zero the HMA memoryGanesh Goudar
firmware expects HMA memory to be zeroed, use __GFP_ZERO for HMA memory allocation. Fixes: 8b4e6b3ca2ed ("cxgb4: Add HMA support") Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-10udp: fix SO_BINDTODEVICEPaolo Abeni
Damir reported a breakage of SO_BINDTODEVICE for UDP sockets. In absence of VRF devices, after commit fb74c27735f0 ("net: ipv4: add second dif to udp socket lookups") the dif mismatch isn't fatal anymore for UDP socket lookup with non null sk_bound_dev_if, breaking SO_BINDTODEVICE semantics. This changeset addresses the issue making the dif match mandatory again in the above scenario. Reported-by: Damir Mansurov <dnman@oktetlabs.ru> Fixes: fb74c27735f0 ("net: ipv4: add second dif to udp socket lookups") Fixes: 1801b570dd2a ("net: ipv6: add second dif to udp socket lookups") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Acked-by: David Ahern <dsahern@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>