summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-04-25dm crypt: remove obsolete references to per-CPU stateEric Biggers
dm-crypt used to use separate crypto transforms for each CPU, but this is no longer the case. To avoid confusion, fix up obsolete comments and rename setup_essiv_cpu(). Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2017-04-25iwlwifi: adjust NVM parsing APIs for new a000 methodSara Sharon
In a000 devices we will get all nvm data from the firmware, and can save most of the parsing. Export two APIs that op mode will still use. Adjust API of init_sbands to be independent of NVM file structure so it can be used by op mode as well. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: pcie: apply no-reclaim logic only to group 0Johannes Berg
When applying no-reclaim logic to commands other than the group zero for legacy commands, commands such as 0x1c (TX_CMD in group 0) can't be used in any other group. Fix that by applying this logic only for group 0 - it's not and should never be needed for any other groups. Reported-by: Sharon Dvir <sharon.dvir@intel.com> Reported-by: Shaul Triebitz <shaul.triebitz@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: mvm: memset binding before setting valuesSara Sharon
The changes in commit 9415af7f306b ("iwlwifi: mvm: support new binding API") assigned values that were later memset to 0. Move the memset earlier. Fixes: 9415af7f306b ("iwlwifi: mvm: support new binding API") Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: rename wait_for_tx_queues_emptySara Sharon
Rename current wait_tx_queue_empty to wait_tx_queues_empty since it waits for multiple queues (up to 32). Next patch will add a wait for single TX queue which is needed for gen2 to be scalable for 512. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: move to 512 queuesSara Sharon
Avoid using the old define since it will enlarge necessary structs for previous HW. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: mvm: support station type APISara Sharon
Support change to ADD_STA API to support station types. Each station is assigned its type. This simplifies FW handling of the broadcast and multicast stations: * broadcast station is identified by its type and not the mac address. * multicast queue is no longer treated differently. The opening and closing of it is done by referring to its station. There is no need to specify it in the MAC command. * When disabling TX to all station driver can disable the traffic on multicast station, so FW doesn't have to do it. Change is backward compatible. Change the order of adding and removing the stations according to FW requirements. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25MIPS: Octeon: cavium_octeon_defconfig: Enable Octeon MMCSteven J. Hill
Enable the Octeon MMC driver in the defconfig. Signed-off-by: Steven J. Hill <Steven.Hill@cavium.com> Acked-by: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2017-04-25iwlwifi: mvm: remove references to queue_info in new TX pathSara Sharon
Most of the fields aren't needed in new TX path. Enlarging the struct to 512 queues will consume a lot of memory. Remove all references to the struct in the new TX path. Move mac80211 queue mapping outside, since it will be needed per queue for TVQM mode. Add warning in paths that shouldn't be hit. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: gen2: support nmi triggering from hostLiad Kaufman
For gen2 there is a new register. Signed-off-by: Liad Kaufman <liad.kaufman@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: remove module loading failure messageJohannes Berg
When CONFIG_DEBUG_TEST_DRIVER_REMOVE is set, iwlwifi crashes when the opmode module cannot be loaded, due to completing the completion before using drv->dev, which can then already be freed. Fix this by removing the (fairly useless) message. Moving the completion later causes a deadlock instead, so that's not an option. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: don't leak memory on allocation failureJohannes Berg
If we fail to allocate the small chunk of memory for the pieces of the firmware file, we leak the whole firmware image instead... Since the allocation failure is really unlikely, just bail out at that point instead. Remove the error message at the label since we now (and actually have been) use it for various reasons. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: pcie: remove superfluous trans->dev assignmentJohannes Berg
This struct member is already assigned in the previous call to iwl_trans_alloc(), so assigning the same value again is superfluous - remove it. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: mvm: use defines instead of variables for shared dwell timesSara Sharon
Most of the dwells are constant across different scan types. Use defines instead of depending on scan type. This is needed as preparation to having different scan type per band. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: mvm: remove color definitionSara Sharon
We use the full station field as sta_id, and never use the color. FW are about to clean the color out, so those defines are incorrect now (and were redundant before). Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: mvm: move internally to use bigger INVALID_TXQSara Sharon
We can't use IEEE80211_INVAL_HW_QUEUE to mark a queue as invalid since 255 will be a valid value for a TVQM queue index. Use IWL_MVM_INVALID_QUEUE instead for accessing txq_id. reserved_queue can stay a u8 since reserved_queue is not used when TVQM is enabled. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25mac80211: rewrite monitor mode delivery logicJohannes Berg
The monitor mode delivery logic makes it hard to add any kind of filtering in an efficient way, because the monitor SKB is created first and then passed to all interfaces. Rewrite the logic to create the monitor SKB the first time it's actually needed, and then keep delivering it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-04-25cfg80211: Fix dfs state propagation for non-DFS center channelVasanthakumar Thiagarajan
When part of a bigger bandwidth (160 MHz) channel falls in DFS channel range it is possible that the center frequency may not necessarily be a radar channel. Remove the sanity check on channel flag for IEEE80211_CHAN_RADAR in regulatory_propagate_dfs_state(), this should fix the dfs state propagation for non-DFS center freq which has DFS channels in it's bandwidth, should also fix unnecessary WARN_ON() spam in regulatory_propagate_dfs_state(). Fixes: 8976672736d6 ("cfg80211: Share Channel DFS state across wiphys of same DFS domain") Reported-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-04-25IB/vmw_pvrdma: Spare annotate imm_dataJason Gunthorpe
imm_data is copied directly from the ib_send_wr and ib_wc which have it marked as __be32, copy that mark into the uapi structures as well. Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Tested-by: Adit Ranadive <aditr@vmware.com> Acked-by: Adit Ranadive <aditr@vmware.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB/mlx5: Add ODP support to MWArtemy Kovalyov
Internally MW implemented as KLM MKey and filled by userspace UMR postsends. Handle pagefault trigered by operations on this MKeys. Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB/mlx5: Extract page fault codeArtemy Kovalyov
To make page fault handling code more flexible split pagefault_single_data_segment() function. Keep MR resolution in pagefault_single_data_segment() and move actual updates into pagefault_single_mr(). Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB/umem: Add support to huge ODPArtemy Kovalyov
Add IB_ACCESS_HUGETLB ib_reg_mr flag. Hugetlb region registered with this flag will use single translation entry per huge page. Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB/mlx5: Add contiguous ODP supportArtemy Kovalyov
Currenlty ODP supports only regular MMU pages. Add ODP support for regions consisting of physically contiguous chunks of arbitrary order (huge pages for instance) to improve performance. Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB/umem: Add contiguous ODP supportArtemy Kovalyov
Currenlty ODP supports only regular MMU pages. Add ODP support for regions consisting of physically contiguous chunks of arbitrary order (huge pages for instance) to improve performance. Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB/mlx5: Decrease verbosity level of ODP errorsArtemy Kovalyov
Decrease verbosity level of ODP error flows messages to debug level. Remove one redundant print since debug level message already exists in this flow. Fixes: d9aaed838765 ('{net,IB}/mlx5: Refactor page fault handling') Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB/mlx5: Fix implicit MR GCArtemy Kovalyov
When implicit MR's leaf MKey becomes unused, i.e. when it's last page being released my MMU invalidation it is marked as "dying" and scheduled for release by garbage collector. Currentle consequent page fault may remove "dying" flag. Treat leaf MKey as non-existent once it was scheduled to removal by GC. Fixes: 81713d3788d2 ('IB/mlx5: Add implicit MR support') Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB/mlx5: Fix UMR size calculationArtemy Kovalyov
Translation table updates of large UMR may require multiple post send operations. The last operations can be in various lengths, but current code set them to be the same length. Fixes: 7d0cc6edcc70 ('IB/mlx5: Add MR cache for large UMR regions') Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB/mlx5: Fix function updating xlt emergency pathArtemy Kovalyov
In memory shortage path we fall back to use spare buffer. mlx5_ib_update_xlt() called from ib_uverbs_reg_mr when ibmr.ucontext not initialized yet. Scenario how to test it: 1. trigger memory exhaustion so __get_free_pages(GFP_KERNEL, 4) will fail 2. register MR 3. there should be no kernel oops Fixes: 7d0cc6edcc70 ('IB/mlx5: Add MR cache for large UMR regions') Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB: Replace ib_umem page_size by page_shiftArtemy Kovalyov
Size of pages are held by struct ib_umem in page_size field. It is better to store it as an exponent, because page size by nature is always power-of-two and used as a factor, divisor or ilog2's argument. The conversion of page_size to be page_shift allows to have portable code and avoid following error while compiling on ARM: ERROR: "__aeabi_uldivmod" [drivers/infiniband/core/ib_core.ko] undefined! CC: Selvin Xavier <selvin.xavier@broadcom.com> CC: Steve Wise <swise@chelsio.com> CC: Lijun Ou <oulijun@huawei.com> CC: Shiraz Saleem <shiraz.saleem@intel.com> CC: Adit Ranadive <aditr@vmware.com> CC: Dennis Dalessandro <dennis.dalessandro@intel.com> CC: Ram Amrani <Ram.Amrani@Cavium.com> Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Acked-by: Ram Amrani <Ram.Amrani@cavium.com> Acked-by: Shiraz Saleem <shiraz.saleem@intel.com> Acked-by: Selvin Xavier <selvin.xavier@broadcom.com> Acked-by: Selvin Xavier <selvin.xavier@broadcom.com> Acked-by: Adit Ranadive <aditr@vmware.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25iwlwifi: mvm: map cab_queue to different txq_idSara Sharon
cab_queue can now get bigger than u8, since in TVQM we will support 512 queues.. Support it by maintaining internal mapping between the actual number and mac80211 queue (IWL_MVM_DQA_GCAST_QUEUE). For pre-a000 the internal queue will be the same as the mac80211 queue. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: mvm: Ignore wifi mcc update in the driver while associatedHaim Dreyfuss
Wifi mcc (mobile country code) update is forbidden while associated. Currently, FW prevents these updates and the driver is unaware to this logic. From now on, the FW sends every wifi mcc update to the driver. The driver in his turn needs to decide whether to ignore it or not, depends on the association state. Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: mvm: don't reserve queue in TVQM modeSara Sharon
The reserved queue is never used, save the trouble. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: pcie: support debug applying on a000 hwLiad Kaufman
Allow configuring debug destination on a000 HW. Signed-off-by: Liad Kaufman <liad.kaufman@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: mvm: avoid variable shadowingJohannes Berg
Remove an extra variable 'queue' that already exists. Also, since there are no code paths that use 'queue' without intializing it, remove the unnecessary zero initialization. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25iwlwifi: mvm: freeze 7265D and 3168 on API version 29Dor Shaish
iwl7265D and iwl3168 are frozen on API version 29. Set the MAX API allowed level to 29 from now on. Signed-off-by: Dor Shaish <dor.shaish@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2017-04-25IB/core: change the return type to voidZhu Yanjun
The function ib_unregister_mad_agent always returns zero. And this returned value is not checked. As such, chane the return type to void. CC: Joe Jin <joe.jin@oracle.com> CC: Junxiao Bi <junxiao.bi@oracle.com> Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com> Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com> Reviewed-by: Hal Rosenstock <hal@mellanox.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25MAINTAINERS: Update ocrdma module statusSelvin Xavier
Since ocrdma driver is not going to be updated with any new development activity, except for critical bug fixes reported by partners or customers, changing the module status to "Odd Fixes". Also, updating the web page info and the maintainers email addresses. Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB/hfi: Fix up comments in engine mappingIra Weiny
Fix off by 1 error in comments documenting the sdma and send context mappings. Signed-off-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25MAINTAINERS: Add file patterns for infiniband device tree bindingsGeert Uytterhoeven
Submitters of device tree binding documentation may forget to CC the subsystem maintainer if this is missing. Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Doug Ledford <dledford@redhat.com> Cc: Sean Hefty <sean.hefty@intel.com> Cc: Hal Rosenstock <hal.rosenstock@gmail.com> Cc: linux-rdma@vger.kernel.org Acked-by: Doug Ledford <dledford@redhat.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25infiniband/uverbs: Fix integer overflowsVlad Tsyrklevich
The 'num_sge' variable is verfied to be smaller than the 'sge_count' variable; however, since both are user-controlled it's possible to cause an integer overflow for the kmalloc multiply on 32-bit platforms (num_sge and sge_count are both defined u32). By crafting an input that causes a smaller-than-expected allocation it's possible to write controlled data out-of-bounds. Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25infiniband: hns: avoid gcc-7.0.1 warning for uninitialized dataArnd Bergmann
hns_roce_v1_cq_set_ci() calls roce_set_bit() on an uninitialized field, which will then change only a few of its bits, causing a warning with the latest gcc: infiniband/hw/hns/hns_roce_hw_v1.c: In function 'hns_roce_v1_cq_set_ci': infiniband/hw/hns/hns_roce_hw_v1.c:1854:23: error: 'doorbell[1]' is used uninitialized in this function [-Werror=uninitialized] roce_set_bit(doorbell[1], ROCEE_DB_OTHERS_H_ROCEE_DB_OTH_HW_SYNS_S, 1); The code is actually correct since we always set all bits of the port_vlan field, but gcc correctly points out that the first access does contain uninitialized data. This initializes the field to zero first before setting the individual bits. Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25ceph: fix recursion between ceph_set_acl() and __ceph_setattr()Yan, Zheng
ceph_set_acl() calls __ceph_setattr() if the setacl operation needs to modify inode's i_mode. __ceph_setattr() updates inode's i_mode, then calls posix_acl_chmod(). The problem is that __ceph_setattr() calls posix_acl_chmod() before sending the setattr request. The get_acl() call in posix_acl_chmod() can trigger a getxattr request. The reply of the getxattr request can restore inode's i_mode to its old value. The set_acl() call in posix_acl_chmod() sees old value of inode's i_mode, so it calls __ceph_setattr() again. Cc: stable@vger.kernel.org # needs backporting for < 4.9 Link: http://tracker.ceph.com/issues/19688 Reported-by: Jerry Lee <leisurelysw24@gmail.com> Signed-off-by: "Yan, Zheng" <zyan@redhat.com> Reviewed-by: Jeff Layton <jlayton@redhat.com> Tested-by: Luis Henriques <lhenriques@suse.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2017-04-25IB/fmr_pool: Convert the cleanup thread into kthread worker APIPetr Mladek
Kthreads are currently implemented as an infinite loop. Each has its own variant of checks for terminating, freezing, awakening. In many cases it is unclear to say in which state it is and sometimes it is done a wrong way. The plan is to convert kthreads into kthread_worker or workqueues API. It allows to split the functionality into separate operations. It helps to make a better structure. Also it defines a clean state where no locks are taken, IRQs blocked, the kthread might sleep or even be safely migrated. The kthread worker API is useful when we want to have a dedicated single thread for the work. It helps to make sure that it is available when needed. Also it allows a better control, e.g. define a scheduling priority. This patch converts the frm_pool kthread into the kthread worker API because I am not sure how busy the thread is. It is well possible that it does not need a dedicated kthread and workqueues would be perfectly fine. Well, the conversion between kthread worker API and workqueues is pretty trivial. The patch moves one iteration from the kthread into the work function. It is queued only when there is a pending work. Therefore we do not need to compare flush_ser and req_ser at the beginning. On the contrary, the same work could be queued only once at a time. Therefore it has to re-queue itself if some requests are pending. Otherwise, wake_up_process() is replaced by queuing the work. Important: The change is only compile tested. I did not find an easy way how to check it in a real life. Signed-off-by: Petr Mladek <pmladek@suse.com> TO: Doug Ledford <dledford@redhat.com> CC: Sean Hefty <sean.hefty@intel.com> CC: Hal Rosenstock <hal.rosenstock@gmail.com> CC: linux-rdma@vger.kernel.org Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25{net,IB}/{rxe,usnic}: Utilize generic mac to eui32 functionYuval Shaia
This logic seems to be duplicated in (at least) three separate files. Move it to one place so code can be re-use. Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com> Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
2017-04-25IB/usnic: Remove unused functionsYuval Shaia
Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com> Reviewed-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25IB/iser: fix spelling mistake: "unexepected" -> "unexpected"Colin Ian King
trivial fix to spelling mistake in iser_err error message Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Max Gurtovoy <maxg@mellanox.com> Acked-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25net/packet: check length in getsockopt() called with PACKET_HDRLENAlexander Potapenko
In the case getsockopt() is called with PACKET_HDRLEN and optlen < 4 |val| remains uninitialized and the syscall may behave differently depending on its value, and even copy garbage to userspace on certain architectures. To fix this we now return -EINVAL if optlen is too small. This bug has been detected with KMSAN. Signed-off-by: Alexander Potapenko <glider@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-25net: ipv6: regenerate host route if moved to gc listDavid Ahern
Taking down the loopback device wreaks havoc on IPv6 routing. By extension, taking down a VRF device wreaks havoc on its table. Dmitry and Andrey both reported heap out-of-bounds reports in the IPv6 FIB code while running syzkaller fuzzer. The root cause is a dead dst that is on the garbage list gets reinserted into the IPv6 FIB. While on the gc (or perhaps when it gets added to the gc list) the dst->next is set to an IPv4 dst. A subsequent walk of the ipv6 tables causes the out-of-bounds access. Andrey's reproducer was the key to getting to the bottom of this. With IPv6, host routes for an address have the dst->dev set to the loopback device. When the 'lo' device is taken down, rt6_ifdown initiates a walk of the fib evicting routes with the 'lo' device which means all host routes are removed. That process moves the dst which is attached to an inet6_ifaddr to the gc list and marks it as dead. The recent change to keep global IPv6 addresses added a new function, fixup_permanent_addr, that is called on admin up. That function restarts dad for an inet6_ifaddr and when it completes the host route attached to it is inserted into the fib. Since the route was marked dead and moved to the gc list, re-inserting the route causes the reported out-of-bounds accesses. If the device with the address is taken down or the address is removed, the WARN_ON in fib6_del is triggered. All of those faults are fixed by regenerating the host route if the existing one has been moved to the gc list, something that can be determined by checking if the rt6i_ref counter is 0. Fixes: f1705ec197e7 ("net: ipv6: Make address flushing on ifdown optional") Reported-by: Dmitry Vyukov <dvyukov@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Acked-by: Martin KaFai Lau <kafai@fb.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-25iw_cxgb4: Use dsgl by defaultGanesh Goudar
Enable the use of dsgl by default and determine whether dsgl is supported from lld info. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Bharat Potnuri <bharat@chelsio.com> Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-25USB: Revert "cdc-wdm: fix "out-of-sync" due to missing notifications"Bjørn Mork
This reverts commit 833415a3e781 ("cdc-wdm: fix "out-of-sync" due to missing notifications") There have been several reports of wdm_read returning unexpected EIO errors with QMI devices using the qmi_wwan driver. The reporters confirm that reverting prevents these errors. I have been unable to reproduce the bug myself, and have no explanation to offer either. But reverting is the safe choice here, given that the commit was an attempt to work around a firmware problem. Living with a firmware problem is still better than adding driver bugs. Reported-by: Kasper Holtze <kasper@holtze.dk> Reported-by: Aleksander Morgado <aleksander@aleksander.es> Reported-by: Daniele Palmas <dnlplm@gmail.com> Cc: <stable@vger.kernel.org> # v4.9+ Fixes: 833415a3e781 ("cdc-wdm: fix "out-of-sync" due to missing notifications") Signed-off-by: Bjørn Mork <bjorn@mork.no> Acked-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>