summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-02-08net: stmmac: Rewrite two test against NULL valueLABBE Corentin
This patch rewrite two test against NULL value with correct style. Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: stmmac: Correct the error message about invalid speedLABBE Corentin
The message about invalid speed does not state 1000 as a valid speed. It is much simpler to said that the speed is invalid. Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: stmmac: replace ENOSYS by EINVALLABBE Corentin
As said by checkpatch ENOSYS means 'invalid syscall nr' and nothing else. This patch replace ENOSYS by the more appropriate value EINVAL. Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: stmmac: Use readl_poll_timeoutLABBE Corentin
The dwmac_dma_reset function use an open coded of readl_poll_timeout(). Replace the open coded handling with the proper function. Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: stmmac: replace stmmac_mdio_busy_wait by readl_poll_timeoutLABBE Corentin
The stmmac_mdio_busy_wait() function do the same job than readl_poll_timeout(). So is is better to replace it. Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: stmmac: fix some code style problemLABBE Corentin
Checkpatch complains about some code style problem on stmmac_mdio.c. This patch fix them. Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: stmmac: remplace asm/io.h by linux/io.hLABBE Corentin
This patch fix the checkpatch warning about asm/io.h. Sorting all includes in the process. Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: stmmac: remove freesoftware addressLABBE Corentin
This patch fix the checkpatch warning about free software address. Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: stmmac: fix some typos in commentsLABBE Corentin
This patch fix some typos in comments. Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: stmmac: Remove the bus_setup function pointerLABBE Corentin
The bus_setup function pointer is not used at all, this patch remove it. Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: stmmac: fix the typo on MAC_RNABLE_RXLABBE Corentin
the define MAC_RNABLE_RX have a typo, rename it to MAC_ENABLE_RX Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com> Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: dsa: Do not destroy invalid network devicesFlorian Fainelli
dsa_slave_create() can fail, and dsa_user_port_unapply() will properly check for the network device not being NULL before attempting to destroy it. We were not setting the slave network device as NULL if dsa_slave_create() failed, so we would later on be calling dsa_slave_destroy() on a now free'd and unitialized network device, causing crashes in dsa_slave_destroy(). Fixes: 83c0afaec7b7 ("net: dsa: Add new binding implementation") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08dax: assert that i_rwsem is held exclusive for writesChristoph Hellwig
Make sure all callers follow the same locking protocol, given that DAX transparantly replaced the normal buffered I/O path. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Reviewed-by: Jan Kara <jack@suse.cz>
2017-02-08bpf, lpm: fix overflows in trie_alloc checksDaniel Borkmann
Cap the maximum (total) value size and bail out if larger than KMALLOC_MAX_SIZE as otherwise it doesn't make any sense to proceed further, since we're guaranteed to fail to allocate elements anyway in lpm_trie_node_alloc(); likleyhood of failure is still high for large values, though, similarly as with htab case in non-prealloc. Next, make sure that cost vars are really u64 instead of size_t, so that we don't overflow on 32 bit and charge only tiny map.pages against memlock while allowing huge max_entries; cap also the max cost like we do with other map types. Fixes: b95a5c4db09b ("bpf: add a longest prefix match trie map implementation") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08ext4: fix DAX write lockingChristoph Hellwig
Unlike O_DIRECT DAX is not an optional opt-in feature selected by the application, so we'll have to provide the traditional synchronіzation of overlapping writes as we do for buffered writes. This was broken historically for DAX, but got fixed for ext2 and XFS as part of the iomap conversion. Fix up ext4 as well. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Reviewed-by: Jan Kara <jack@suse.cz>
2017-02-08bridge: vlan tunnel id info range fill size calc cleanupsRoopa Prabhu
This fixes a bug and cleans up tunnelid range size calculation code by using consistent variable names and checks in size calculation and fill functions. tested for a few cases of vlan-vni range mappings: (output from patched iproute2): $bridge vlan showtunnel port vid tunid vxlan0 100-105 1000-1005 200 2000 210 2100 211-213 2100-2102 214 2104 216-217 2108-2109 219 2119 Fixes: efa5356b0d97 ("bridge: per vlan dst_metadata netlink support") Reported-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08tools lib bpf: Add missing header to the libraryMickaël Salaün
Include stddef.h to define size_t. Signed-off-by: Mickaël Salaün <mic@digikod.net> Acked-by: Wang Nan <wangnan0@huawei.com> Cc: Alexei Starovoitov <ast@fb.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: David S. Miller <davem@davemloft.net> Cc: Joe Stringer <joe@ovn.org> Link: http://lkml.kernel.org/r/20170207205609.8035-2-mic@digikod.net Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2017-02-08perf vendor events intel: Add uncore events for Broadwell DEAndi Kleen
This is not a full uncore event list, but a short list of useful and understandable metrics. Signed-off-by: Andi Kleen <ak@linux.intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Link: http://lkml.kernel.org/n/tip-c0cix4eprbldfrx5zf60suvh@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2017-02-08gro_cells: move to net/core/gro_cells.cEric Dumazet
We have many gro cells users, so lets move the code to avoid duplication. This creates a CONFIG_GRO_CELLS option. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08perf vendor events intel: Add uncore events for Xeon Phi (Knights Landing)Andi Kleen
Add metrics for memory and MCDRAM. Minimal metrics only for now. Signed-off-by: Andi Kleen <ak@linux.intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Link: http://lkml.kernel.org/n/tip-c0cix4eprbldfrx5zf60suvh@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2017-02-08perf vendor events intel: Add uncore events for Sandy Bridge ServerAndi Kleen
This is not a full uncore event list, but a short list of useful and understandable metrics. Signed-off-by: Andi Kleen <ak@linux.intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Link: http://lkml.kernel.org/n/tip-c0cix4eprbldfrx5zf60suvh@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2017-02-08perf vendor events intel: Add uncore events for IvyBridge ServerAndi Kleen
This is not a full uncore event list, but a short list of useful and understandable metrics. Signed-off-by: Andi Kleen <ak@linux.intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Link: http://lkml.kernel.org/n/tip-c0cix4eprbldfrx5zf60suvh@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2017-02-08perf vendor events intel: Add uncore events for Broadwell ServerAndi Kleen
This is not a full uncore event list, but a short list of useful and understandable metrics. Signed-off-by: Andi Kleen <ak@linux.intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Link: http://lkml.kernel.org/n/tip-c0cix4eprbldfrx5zf60suvh@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2017-02-08perf vendor events intel: Add uncore events for Haswell Server processorAndi Kleen
This is not a full uncore event list, but a short list of useful and understandable metrics. Signed-off-by: Andi Kleen <ak@linux.intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Link: http://lkml.kernel.org/n/tip-c0cix4eprbldfrx5zf60suvh@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2017-02-08mtd: add DT bindings for the Cortina Systems Gemini FlashLinus Walleij
This adds device tree bindings for the Cortina systems Gemini flash controller, a simple physmap which however need a few syscon bits to be poked to operate properly. Cc: Janos Laube <janos.dev@gmail.com> Cc: Paulius Zaleckas <paulius.zaleckas@gmail.com> Cc: Hans Ulli Kroll <ulli.kroll@googlemail.com> Cc: Florian Fainelli <f.fainelli@gmail.com> Cc: devicetree@vger.kernel.org Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Marek Vasut <marek.vasut@gmail.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Brian Norris <computersforpeace@gmail.com>
2017-02-08net: mellanox: switchx2: use new api ethtool_{get|set}_link_ksettingsPhilippe Reynes
The ethtool api {get|set}_settings is deprecated. We move this driver to new api {get|set}_link_ksettings. As I don't have the hardware, I'd be very pleased if someone may test this patch. Signed-off-by: Philippe Reynes <tremyfr@gmail.com> Reviewed-by: Ido Schimmel <idosch@mellanox.com> Tested-by: Ido Schimmel <idosch@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08arm64: uaccess: consistently check object sizesMark Rutland
Currently in arm64's copy_{to,from}_user, we only check the source/destination object size if access_ok() tells us the user access is permissible. However, in copy_from_user() we'll subsequently zero any remainder on the destination object. If we failed the access_ok() check, that applies to the whole object size, which we didn't check. To ensure that we catch that case, this patch hoists check_object_size() to the start of copy_from_user(), matching __copy_from_user() and __copy_to_user(). To make all of our uaccess copy primitives consistent, the same is done to copy_to_user(). Cc: Catalin Marinas <catalin.marinas@arm.com> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com>
2017-02-08perf: add qcom l2 cache perf events driverNeil Leeder
Adds perf events support for L2 cache PMU. The L2 cache PMU driver is named 'l2cache_0' and can be used with perf events to profile L2 events such as cache hits and misses on Qualcomm Technologies processors. Reviewed-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Neil Leeder <nleeder@codeaurora.org> [will: minimise nesting in l2_cache_associate_cpu_with_cluster] [will: use kstrtoul for unsigned long, remove redunant .owner setting] Signed-off-by: Will Deacon <will.deacon@arm.com>
2017-02-08Merge tag 'iwlwifi-next-for-kalle-2017-02-08' of ↵Kalle Valo
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Some patches focusing on bugfixes for v4.11: * Fix 802.11w, which was failing to due an IGTK bug; * A few more bugzilla bug fixes; * A channel-switch race condition fix; * Some fixes related to suspend/resume with new HW; * The RF-kill saga continues; * And some other fixes here and there...
2017-02-08mtd: bcm47xxsflash: use platform_(set|get)_drvdataRafał Miłecki
We have generic place & helpers for storing platform driver data so there is no reason for using custom priv pointer. This allows cleaning up struct bcma_sflash from unneeded fields. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> Acked-by: Kalle Valo <kvalo@codeaurora.org> Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Brian Norris <computersforpeace@gmail.com>
2017-02-08perf tools: Fix include of linux/mman.hArnaldo Carvalho de Melo
It was using uapi/linux/mmap.h which caused for at least one reporter, that hasn't specified in what environment the problem manifests itself: ---- The original error is: In file included from util/event.c:2:0: ...tools/include/uapi/linux/mman.h:4:27: fatal error: uapi/asm/mman.h: No such file or directory #include <uapi/asm/mman.h> ^ compilation terminated. ---- Test built it on these containers: # dm 1 alpine:3.4: Ok 2 android-ndk:r12b-arm: Ok 3 archlinux:latest: Ok 4 centos:5: Ok 5 centos:6: Ok 6 centos:7: Ok 7 debian:7: Ok 8 debian:8: Ok 9 debian:experimental: Ok 10 debian:experimental-x-arm64: Ok 11 debian:experimental-x-mips: Ok 12 debian:experimental-x-mips64: Ok 13 debian:experimental-x-mipsel: Ok 14 fedora:20: Ok 15 fedora:21: Ok 16 fedora:22: Ok 17 fedora:23: Ok 18 fedora:24: Ok 19 fedora:24-x-ARC-uClibc: Ok 20 fedora:25: Ok 21 fedora:rawhide: Ok 22 mageia:5: Ok 23 opensuse:13.2: Ok 24 opensuse:42.1: Ok 25 opensuse:tumbleweed: Ok 26 ubuntu:12.04.5: Ok 27 ubuntu:14.04.4-x-linaro-arm64: Ok 28 ubuntu:15.10: Ok 29 ubuntu:16.04: Ok 30 ubuntu:16.04-x-arm: Ok 31 ubuntu:16.04-x-arm64: Ok 32 ubuntu:16.04-x-powerpc: Ok 33 ubuntu:16.04-x-powerpc64: Ok 34 ubuntu:16.04-x-powerpc64el: Ok 35 ubuntu:16.04-x-s390: Ok 36 ubuntu:16.10: Ok Reported-by: David Carrillo-Cisneros <davidcc@google.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: He Kuang <hekuang@huawei.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Michal Marek <mmarek@suse.com> Cc: Paul Turner <pjt@google.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Cc: Wang Nan <wangnan0@huawei.com> Fixes: fbef103fad50 ("perf tools: Do hugetlb handling in more systems") Link: http://lkml.kernel.org/n/tip-4wm5xmjz5wgbq7ucyz4dyd72@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2017-02-08ping: fix a null pointer dereferenceWANG Cong
Andrey reported a kernel crash: general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ #124 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880060048040 task.stack: ffff880069be8000 RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline] RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837 RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000 RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2 RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0 R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000 FS: 00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0 Call Trace: inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744 sock_sendmsg_nosec net/socket.c:635 [inline] sock_sendmsg+0xca/0x110 net/socket.c:645 SYSC_sendto+0x660/0x810 net/socket.c:1687 SyS_sendto+0x40/0x50 net/socket.c:1655 entry_SYSCALL_64_fastpath+0x1f/0xc2 This is because we miss a check for NULL pointer for skb_peek() when the queue is empty. Other places already have the same check. Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08Merge branch 'net-header-length-truncation'David S. Miller
Willem de Bruijn says: ==================== net: Fixes for header length truncation Packets should not enter the stack with truncated link layer headers and link layer headers should always be stored in the skb linear segment. Patch 1 ensures the first for PF_PACKET sockets Patch 2 ensures the second for PF_PACKET GSO sockets without tx_ring ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08packet: round up linear to header lenWillem de Bruijn
Link layer protocols may unconditionally pull headers, as Ethernet does in eth_type_trans. Ensure that the entire link layer header always lies in the skb linear segment. tpacket_snd has such a check. Extend this to packet_snd. Variable length link layer headers complicate the computation somewhat. Here skb->len may be smaller than dev->hard_header_len. Round up the linear length to be at least as long as the smallest of the two. Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: introduce device min_header_lenWillem de Bruijn
The stack must not pass packets to device drivers that are shorter than the minimum link layer header length. Previously, packet sockets would drop packets smaller than or equal to dev->hard_header_len, but this has false positives. Zero length payload is used over Ethernet. Other link layer protocols support variable length headers. Support for validation of these protocols removed the min length check for all protocols. Introduce an explicit dev->min_header_len parameter and drop all packets below this value. Initially, set it to non-zero only for Ethernet and loopback. Other protocols can follow in a patch to net-next. Fixes: 9ed988cd5915 ("packet: validate variable length ll headers") Reported-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Acked-by: Eric Dumazet <edumazet@google.com> Acked-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08ibmvscsis: Add SGL limitBryant G. Ly
This patch adds internal LIO sgl limit since the driver already sets a max transfer limit on transport layer of 1MB to the client. Cc: stable@vger.kernel.org Tested-by: Steven Royer <seroyer@linux.vnet.ibm.com> Signed-off-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2017-02-08net: qcom/emac: fix semicolon.cocci warningsWu Fengguang
drivers/net/ethernet/qualcomm/emac/emac-ethtool.c:155:49-50: Unneeded semicolon Remove unneeded semicolon. Generated by: scripts/coccinelle/misc/semicolon.cocci CC: Timur Tabi <timur@codeaurora.org> Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08regulator: core: simplify _regulator_get()Dmitry Torokhov
The code in _regulator_get() got a bit confusing over time, with control flow jumping to a label from couple of places. Let's untangle it a bit by doing the following: 1. Make handling of missing supplies and substituting them with dummy regulators more explicit: - check if we not have full constraints and refuse considering dummy regulators with appropriate message; - use "switch (get_type)" to handle different types of request explicitly as well. "Normal" requests will get dummies, exclusive will not and will notify user about that; optional will fail silently. 2. Stop jumping to a label in the middle of the function but instead have proper conditional flow. I believe jumps should be reserved for error handling, breaking from inner loop, or restarting a loop, but not for implementing normal conditional flow. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2017-02-08net: phy: Add LED mode driver for Microsemi PHYs.Raju Lakkaraju
LED Mode: Microsemi PHY support 2 LEDs (LED[0] and LED[1]) to display different status information that can be selected by setting LED mode. LED Mode parameter (vsc8531, led-0-mode) and (vsc8531, led-1-mode) get from Device Tree. Signed-off-by: Raju Lakkaraju <Raju.Lakkaraju@microsemi.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08net: dsa: bcm_sf2: cleanup bcm_sf2_cfp_rule_get() a littleDan Carpenter
This patch doesn't affect how the code works. My static checker complains that the mask and shift doesn't make sense because 0xffffff << 16 goes beyond the end of 32 bits. It should be 0xffff instead but the existing code won't cause runtime bugs. Also the casting here is not needed and not consistent with the rest of the code. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08sit: fix a double free on error pathWANG Cong
Dmitry reported a double free in sit_init_net(): kernel BUG at mm/percpu.c:689! invalid opcode: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 15692 Comm: syz-executor1 Not tainted 4.10.0-rc6-next-20170206 #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801c9cc27c0 task.stack: ffff88017d1d8000 RIP: 0010:pcpu_free_area+0x68b/0x810 mm/percpu.c:689 RSP: 0018:ffff88017d1df488 EFLAGS: 00010046 RAX: 0000000000010000 RBX: 00000000000007c0 RCX: ffffc90002829000 RDX: 0000000000010000 RSI: ffffffff81940efb RDI: ffff8801db841d94 RBP: ffff88017d1df590 R08: dffffc0000000000 R09: 1ffffffff0bb3bdd R10: dffffc0000000000 R11: 00000000000135dd R12: ffff8801db841d80 R13: 0000000000038e40 R14: 00000000000007c0 R15: 00000000000007c0 FS: 00007f6ea608f700(0000) GS:ffff8801dbe00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000aff8 CR3: 00000001c8d44000 CR4: 00000000001426f0 DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: free_percpu+0x212/0x520 mm/percpu.c:1264 ipip6_dev_free+0x43/0x60 net/ipv6/sit.c:1335 sit_init_net+0x3cb/0xa10 net/ipv6/sit.c:1831 ops_init+0x10a/0x530 net/core/net_namespace.c:115 setup_net+0x2ed/0x690 net/core/net_namespace.c:291 copy_net_ns+0x26c/0x530 net/core/net_namespace.c:396 create_new_namespaces+0x409/0x860 kernel/nsproxy.c:106 unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:205 SYSC_unshare kernel/fork.c:2281 [inline] SyS_unshare+0x64e/0xfc0 kernel/fork.c:2231 entry_SYSCALL_64_fastpath+0x1f/0xc2 This is because when tunnel->dst_cache init fails, we free dev->tstats once in ipip6_tunnel_init() and twice in sit_init_net(). This looks redundant but its ndo_uinit() does not seem enough to clean up everything here. So avoid this by setting dev->tstats to NULL after the first free, at least for -net. Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08Merge tag 'fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Arnd Bergmann: - A relatively large patch restores booting on i.MX platforms that failed to boot after a cleanup was merged for v4.10. - A quirk for USB needs to be enabled on the STi platform - On the Meson platform, we saw memory corruption with part of the memory used by the secure monitor, so we have to stay out of that area. - The same platform also has a problem with ethernet under load, which is fixed by disabling EEE negotiation. - imx6dl has an incorrect pin configuration, which prevents SPI from working. - Two maintainers have lost their access to their email addresses, so we should update the MAINTAINERS file before the release - Renaming one of the orion5x linkstation models to help simplify the debian install. - A couple of fixes for build warnings that were introduced during v4.10-rc. * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: defconfigs: make NF_CT_PROTO_SCTP and NF_CT_PROTO_UDPLITE built-in MAINTAINERS: socfpga: update email for Dinh Nguyen ARM: orion5x: fix Makefile for linkstation-lschl.dtb ARM: dts: orion5x-lschl: More consistent naming on linkstation series ARM: dts: orion5x-lschl: Fix model name MAINTAINERS: change email address from atmel to microchip MAINTAINERS: at91: change email address ARM64: dts: meson-gx: Add firmware reserved memory zones ARM64: dts: meson-gxbb-odroidc2: fix GbE tx link breakage ARM: dts: STiH407-family: set snps,dis_u3_susphy_quirk ARM: dts: imx: Pass 'chosen' and 'memory' nodes ARM: dts: imx6dl: fix GPIO4 range ARM: imx: hide unused variable in #ifdef
2017-02-08Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull selinux fix from James Morris: "Fix off-by-one in setprocattr" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: selinux: fix off-by-one in setprocattr
2017-02-08Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds
Pull block fix from Jens Axboe: "A single fix that should go into 4.10, fixing a regression on some devices with the WRITE_SAME command" * 'for-linus' of git://git.kernel.dk/linux-block: block: don't try Write Same from __blkdev_issue_zeroout
2017-02-08lwtunnel: valid encap attr check should return 0 when lwtunnel is disabledDavid Ahern
An error was reported upgrading to 4.9.8: root@Typhoon:~# ip route add default table 210 nexthop dev eth0 via 10.68.64.1 weight 1 nexthop dev eth0 via 10.68.64.2 weight 1 RTNETLINK answers: Operation not supported The problem occurs when CONFIG_LWTUNNEL is not enabled and a multipath route is submitted. The point of lwtunnel_valid_encap_type_attr is catch modules that need to be loaded before any references are taken with rntl held. With CONFIG_LWTUNNEL disabled, there will be no modules to load so the lwtunnel_valid_encap_type_attr stub should just return 0. Fixes: 9ed59592e3e3 ("lwtunnel: fix autoload of lwt modules") Reported-by: pupilla@libero.it Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-08RDMA: Don't reference kernel private header from UAPI headerLeon Romanovsky
Remove references to private kernel header and defines from exported ib_user_verb.h file. The code snippet below is used to reproduce the issue: #include <stdio.h> #include <rdma/ib_user_verb.h> int main(void) { printf("IB_USER_VERBS_ABI_VERSION = %d\n", IB_USER_VERBS_ABI_VERSION); return 0; } It fails during compilation phase with an error: ➜ /tmp gcc main.c main.c:2:31: fatal error: rdma/ib_user_verb.h: No such file or directory #include <rdma/ib_user_verb.h> ^ compilation terminated. Fixes: 189aba99e700 ("IB/uverbs: Extend modify_qp and support packet pacing") CC: Bodong Wang <bodong@mellanox.com> CC: Matan Barak <matanb@mellanox.com> CC: Christoph Hellwig <hch@infradead.org> Tested-by: Slava Shwartsman <slavash@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-02-08IB/rxe: Fix mem_check_range integer overflowEyal Itkin
Update the range check to avoid integer-overflow in edge case. Resolves CVE 2016-8636. Signed-off-by: Eyal Itkin <eyal.itkin@gmail.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-02-08IB/rxe: Fix resid updateEyal Itkin
Update the response's resid field when larger than MTU, instead of only updating the local resid variable. Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Eyal Itkin <eyal.itkin@gmail.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-02-08irqchip/gic-v3-its: Zero command on allocationMarc Zyngier
When reusing commands from the ring buffer, it would be better to zero them out, even if the ITS should ignore the unused fields. Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
2017-02-08ipv6: addrconf: fix generation of new temporary addressesMarcus Huewe
Under some circumstances it is possible that no new temporary addresses will be generated. For instance, addrconf_prefix_rcv_add_addr() indirectly calls ipv6_create_tempaddr(), which creates a tentative temporary address and starts dad. Next, addrconf_prefix_rcv_add_addr() indirectly calls addrconf_verify_rtnl(). Now, assume that the previously created temporary address has the least preferred lifetime among all existing addresses and is still tentative (that is, dad is still running). Hence, the next run of addrconf_verify_rtnl() is performed when the preferred lifetime of the temporary address ends. If dad succeeds before the next run, the temporary address becomes deprecated during the next run, but no new temporary address is generated. In order to fix this, schedule the next addrconf_verify_rtnl() run slightly before the temporary address becomes deprecated, if dad succeeded. Signed-off-by: Marcus Huewe <suse-tux@gmx.de> Signed-off-by: David S. Miller <davem@davemloft.net>