1. 22 Dec, 2015 6 commits
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec · 024f35c5
      David S. Miller authored
      Steffen Klassert says:
      
      ====================
      pull request (net): ipsec 2015-12-22
      
      Just one patch to fix dst_entries_init with multiple namespaces.
      From Dan Streetman.
      
      Please pull or let me know if there are problems.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      024f35c5
    • Andrey Ryabinin's avatar
      ipv6/addrlabel: fix ip6addrlbl_get() · e459dfee
      Andrey Ryabinin authored
      ip6addrlbl_get() has never worked. If ip6addrlbl_hold() succeeded,
      ip6addrlbl_get() will exit with '-ESRCH'. If ip6addrlbl_hold() failed,
      ip6addrlbl_get() will use about to be free ip6addrlbl_entry pointer.
      
      Fix this by inverting ip6addrlbl_hold() check.
      
      Fixes: 2a8cc6c8 ("[IPV6] ADDRCONF: Support RFC3484 configurable address selection policy table.")
      Signed-off-by: default avatarAndrey Ryabinin <aryabinin@virtuozzo.com>
      Reviewed-by: default avatarCong Wang <cwang@twopensource.com>
      Acked-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e459dfee
    • Ido Schimmel's avatar
      switchdev: bridge: Pass ageing time as clock_t instead of jiffies · ef9cdd0f
      Ido Schimmel authored
      The bridge's ageing time is offloaded to hardware when:
      	1) A port joins a bridge
      	2) The ageing time of the bridge is changed
      
      In the first case the ageing time is offloaded as jiffies, but in the
      second case it's offloaded as clock_t, which is what existing switchdev
      drivers expect to receive.
      
      Fixes: 6ac311ae ("Adding switchdev ageing notification on port bridged")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ef9cdd0f
    • Sergei Shtylyov's avatar
      sh_eth: fix 16-bit descriptor field access endianness too · 5cbf20c7
      Sergei Shtylyov authored
      Commit 1299653a ("sh_eth: fix descriptor access endianness") only
      addressed the 32-bit buffer address field byte-swapping  but the driver
      still accesses 16-bit frame/buffer length descriptor fields without the
      necessary byte-swapping -- which should affect the big-endian kernels.
      In order to be able to use {cpu|edmac}_to_{edmac|cpu}(), we need to declare
      the RX/TX descriptor word 1 as a 32-bit field and use shifts/masking to
      access the 16-bit subfields (which gets rid of the ugly #ifdef'ery too)...
      Signed-off-by: default avatarSergei Shtylyov <sergei.shtylyov@cogentembedded.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5cbf20c7
    • Vijay Pandurangan's avatar
      veth: don’t modify ip_summed; doing so treats packets with bad checksums as good. · ce8c839b
      Vijay Pandurangan authored
      Packets that arrive from real hardware devices have ip_summed ==
      CHECKSUM_UNNECESSARY if the hardware verified the checksums, or
      CHECKSUM_NONE if the packet is bad or it was unable to verify it. The
      current version of veth will replace CHECKSUM_NONE with
      CHECKSUM_UNNECESSARY, which causes corrupt packets routed from hardware to
      a veth device to be delivered to the application. This caused applications
      at Twitter to receive corrupt data when network hardware was corrupting
      packets.
      
      We believe this was added as an optimization to skip computing and
      verifying checksums for communication between containers. However, locally
      generated packets have ip_summed == CHECKSUM_PARTIAL, so the code as
      written does nothing for them. As far as we can tell, after removing this
      code, these packets are transmitted from one stack to another unmodified
      (tcpdump shows invalid checksums on both sides, as expected), and they are
      delivered correctly to applications. We didn’t test every possible network
      configuration, but we tried a few common ones such as bridging containers,
      using NAT between the host and a container, and routing from hardware
      devices to containers. We have effectively deployed this in production at
      Twitter (by disabling RX checksum offloading on veth devices).
      
      This code dates back to the first version of the driver, commit
      <e314dbdc> ("[NET]: Virtual ethernet device driver"), so I
      suspect this bug occurred mostly because the driver API has evolved
      significantly since then. Commit <0b796750> ("net/veth: Fix
      packet checksumming") (in December 2010) fixed this for packets that get
      created locally and sent to hardware devices, by not changing
      CHECKSUM_PARTIAL. However, the same issue still occurs for packets coming
      in from hardware devices.
      Co-authored-by: default avatarEvan Jones <ej@evanjones.ca>
      Signed-off-by: default avatarEvan Jones <ej@evanjones.ca>
      Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
      Cc: Phil Sutter <phil@nwl.cc>
      Cc: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
      Cc: netdev@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarVijay Pandurangan <vijayp@vijayp.ca>
      Acked-by: default avatarCong Wang <cwang@twopensource.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ce8c839b
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · a7c09ae6
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains two netfilter fixes:
      
      1) Oneliner from Florian to dump missing NFT_CT_L3PROTOCOL netlink
         attribute, from Florian Westphal.
      
      2) Another oneliner for nf_tables to use skb->protocol from the new
         netdev family, we can't assume ethernet there.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a7c09ae6
  2. 21 Dec, 2015 3 commits
  3. 19 Dec, 2015 2 commits
  4. 18 Dec, 2015 15 commits
  5. 17 Dec, 2015 9 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 73796d8b
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix uninitialized variable warnings in nfnetlink_queue, a lot of
          people reported this...  From Arnd Bergmann.
      
       2) Don't init mutex twice in i40e driver, from Jesse Brandeburg.
      
       3) Fix spurious EBUSY in rhashtable, from Herbert Xu.
      
       4) Missing DMA unmaps in mvpp2 driver, from Marcin Wojtas.
      
       5) Fix race with work structure access in pppoe driver causing
          corruptions, from Guillaume Nault.
      
       6) Fix OOPS due to sh_eth_rx() not checking whether netdev_alloc_skb()
          actually succeeded or not, from Sergei Shtylyov.
      
       7) Don't lose flags when settifn IFA_F_OPTIMISTIC in ipv6 code, from
          Bjørn Mork.
      
       8) VXLAN_HD_RCO defined incorrectly, fix from Jiri Benc.
      
       9) Fix clock source used for cookies in SCTP, from Marcelo Ricardo
          Leitner.
      
      10) aurora driver needs HAS_DMA dependency, from Geert Uytterhoeven.
      
      11) ndo_fill_metadata_dst op of vxlan has to handle ipv6 tunneling
          properly as well, from Jiri Benc.
      
      12) Handle request sockets properly in xfrm layer, from Eric Dumazet.
      
      13) Double stats update in ipv6 geneve transmit path, fix from Pravin B
          Shelar.
      
      14) sk->sk_policy[] needs RCU protection, and as a result
          xfrm_policy_destroy() needs to free policies using an RCU grace
          period, from Eric Dumazet.
      
      15) SCTP needs to clone ipv6 tx options in order to avoid use after
          free, from Eric Dumazet.
      
      16) Missing kbuild export if ila.h, from Stephen Hemminger.
      
      17) Missing mdiobus_alloc() return value checking in mdio-mux.c, from
          Tobias Klauser.
      
      18) Validate protocol value range in ->create() methods, from Hannes
          Frederic Sowa.
      
      19) Fix early socket demux races that result in illegal dst reuse, from
          Eric Dumazet.
      
      20) Validate socket address length in pptp code, from WANG Cong.
      
      21) skb_reorder_vlan_header() uses incorrect offset and can corrupt
          packets, from Vlad Yasevich.
      
      22) Fix memory leaks in nl80211 registry code, from Ola Olsson.
      
      23) Timeout loop count handing fixes in mISDN, xgbe, qlge, sfc, and
          qlcnic.  From Dan Carpenter.
      
      24) msg.msg_iocb needs to be cleared in recvfrom() otherwise, for
          example, AF_ALG will interpret it as an async call.  From Tadeusz
          Struk.
      
      25) inetpeer_set_addr_v4 forgets to initialize the 'vif' field, from
          Eric Dumazet.
      
      26) rhashtable enforces the minimum table size not early enough,
          breaking how we calculate the per-cpu lock allocations.  From
          Herbert Xu.
      
      27) Fix FCC port lockup in 82xx driver, from Martin Roth.
      
      28) FOU sockets need to be freed using RCU, from Hannes Frederic Sowa.
      
      29) Fix out-of-bounds access in __skb_complete_tx_timestamp() and
          sock_setsockopt() wrt.  timestamp handling.  From WANG Cong.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (117 commits)
        net: check both type and procotol for tcp sockets
        drivers: net: xgene: fix Tx flow control
        tcp: restore fastopen with no data in SYN packet
        af_unix: Revert 'lock_interruptible' in stream receive code
        fou: clean up socket with kfree_rcu
        82xx: FCC: Fixing a bug causing to FCC port lock-up
        gianfar: Don't enable RX Filer if not supported
        net: fix warnings in 'make htmldocs' by moving macro definition out of field declaration
        rhashtable: Fix walker list corruption
        rhashtable: Enforce minimum size on initial hash table
        inet: tcp: fix inetpeer_set_addr_v4()
        ipv6: automatically enable stable privacy mode if stable_secret set
        net: fix uninitialized variable issue
        bluetooth: Validate socket address length in sco_sock_bind().
        net_sched: make qdisc_tree_decrease_qlen() work for non mq
        ser_gigaset: remove unnecessary kfree() calls from release method
        ser_gigaset: fix deallocation of platform device structure
        ser_gigaset: turn nonsense checks into WARN_ON
        ser_gigaset: fix up NULL checks
        qlcnic: fix a timeout loop
        ...
      73796d8b
    • WANG Cong's avatar
      net: check both type and procotol for tcp sockets · ac5cc977
      WANG Cong authored
      Dmitry reported the following out-of-bound access:
      
      Call Trace:
       [<ffffffff816cec2e>] __asan_report_load4_noabort+0x3e/0x40
      mm/kasan/report.c:294
       [<ffffffff84affb14>] sock_setsockopt+0x1284/0x13d0 net/core/sock.c:880
       [<     inline     >] SYSC_setsockopt net/socket.c:1746
       [<ffffffff84aed7ee>] SyS_setsockopt+0x1fe/0x240 net/socket.c:1729
       [<ffffffff85c18c76>] entry_SYSCALL_64_fastpath+0x16/0x7a
      arch/x86/entry/entry_64.S:185
      
      This is because we mistake a raw socket as a tcp socket.
      We should check both sk->sk_type and sk->sk_protocol to ensure
      it is a tcp socket.
      
      Willem points out __skb_complete_tx_timestamp() needs to fix as well.
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
      Cc: Eric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ac5cc977
    • Iyappan Subramanian's avatar
      drivers: net: xgene: fix Tx flow control · 67894eec
      Iyappan Subramanian authored
      Currently the Tx flow control is based on reading the hardware state,
      which is not accurate since it may not reflect the descriptors that
      are not yet reached the memory.
      
      To accurately control the Tx flow, changing it to be software based.
      Signed-off-by: default avatarIyappan Subramanian <isubramanian@apm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      67894eec
    • Eric Dumazet's avatar
      tcp: restore fastopen with no data in SYN packet · 07e100f9
      Eric Dumazet authored
      Yuchung tracked a regression caused by commit 57be5bda ("ip: convert
      tcp_sendmsg() to iov_iter primitives") for TCP Fast Open.
      
      Some Fast Open users do not actually add any data in the SYN packet.
      
      Fixes: 57be5bda ("ip: convert tcp_sendmsg() to iov_iter primitives")
      Reported-by: default avatarYuchung Cheng <ycheng@google.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Acked-by: default avatarYuchung Cheng <ycheng@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      07e100f9
    • Rainer Weikusat's avatar
      af_unix: Revert 'lock_interruptible' in stream receive code · 3822b5c2
      Rainer Weikusat authored
      With b3ca9b02, the AF_UNIX SOCK_STREAM
      receive code was changed from using mutex_lock(&u->readlock) to
      mutex_lock_interruptible(&u->readlock) to prevent signals from being
      delayed for an indefinite time if a thread sleeping on the mutex
      happened to be selected for handling the signal. But this was never a
      problem with the stream receive code (as opposed to its datagram
      counterpart) as that never went to sleep waiting for new messages with the
      mutex held and thus, wouldn't cause secondary readers to block on the
      mutex waiting for the sleeping primary reader. As the interruptible
      locking makes the code more complicated in exchange for no benefit,
      change it back to using mutex_lock.
      Signed-off-by: default avatarRainer Weikusat <rweikusat@mobileactivedefense.com>
      Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3822b5c2
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · ce42af94
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Some i915 fixes, one omap fix, one core regression fix.
      
        Not even enough fixes for a twelve days of xmas song, which seemms
        good"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm: Don't overwrite UNVERFIED mode status to OK
        drm/omap: fix fbdev pix format to support all platforms
        drm/i915: Do a better job at disabling primary plane in the noatomic case.
        drm/i915/skl: Double RC6 WRL always on
        drm/i915/skl: Disable coarse power gating up until F0
        drm/i915: Remove incorrect warning in context cleanup
      ce42af94
    • Will Deacon's avatar
      locking/osq: Fix ordering of node initialisation in osq_lock · b4b29f94
      Will Deacon authored
      The Cavium guys reported a soft lockup on their arm64 machine, caused by
      commit c55a6ffa ("locking/osq: Relax atomic semantics"):
      
          mutex_optimistic_spin+0x9c/0x1d0
          __mutex_lock_slowpath+0x44/0x158
          mutex_lock+0x54/0x58
          kernfs_iop_permission+0x38/0x70
          __inode_permission+0x88/0xd8
          inode_permission+0x30/0x6c
          link_path_walk+0x68/0x4d4
          path_openat+0xb4/0x2bc
          do_filp_open+0x74/0xd0
          do_sys_open+0x14c/0x228
          SyS_openat+0x3c/0x48
          el0_svc_naked+0x24/0x28
      
      This is because in osq_lock we initialise the node for the current CPU:
      
          node->locked = 0;
          node->next = NULL;
          node->cpu = curr;
      
      and then publish the current CPU in the lock tail:
      
          old = atomic_xchg_acquire(&lock->tail, curr);
      
      Once the update to lock->tail is visible to another CPU, the node is
      then live and can be both read and updated by concurrent lockers.
      
      Unfortunately, the ACQUIRE semantics of the xchg operation mean that
      there is no guarantee the contents of the node will be visible before
      lock tail is updated.  This can lead to lock corruption when, for
      example, a concurrent locker races to set the next field.
      
      Fixes: c55a6ffa ("locking/osq: Relax atomic semantics"):
      Reported-by: default avatarDavid Daney <ddaney@caviumnetworks.com>
      Reported-by: default avatarAndrew Pinski <andrew.pinski@caviumnetworks.com>
      Tested-by: default avatarAndrew Pinski <andrew.pinski@caviumnetworks.com>
      Acked-by: default avatarDavidlohr Bueso <dave@stgolabs.net>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Link: http://lkml.kernel.org/r/1449856001-21177-1-git-send-email-will.deacon@arm.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b4b29f94
    • Linus Torvalds's avatar
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · d7637d01
      Linus Torvalds authored
      Pull libnvdimm fixes from Dan Williams:
      
       - Two bug fixes for misuse of PAGE_MASK in scatterlist and dma-debug.
         These are tagged for -stable.  The scatterlist impact is potentially
        corrupted dma addresses on HIGHMEM enabled platforms.
      
       - A minor locking fix for the NFIT hot-add implementation that is new
         in 4.4-rc.  This would only trigger in the case a hot-add raced
         driver removal.
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        dma-debug: Fix dma_debug_entry offset calculation
        Revert "scatterlist: use sg_phys()"
        nfit: acpi_nfit_notify(): Do not leave device locked
      d7637d01
    • Hannes Frederic Sowa's avatar
      fou: clean up socket with kfree_rcu · 3036facb
      Hannes Frederic Sowa authored
      fou->udp_offloads is managed by RCU. As it is actually included inside
      the fou sockets, we cannot let the memory go out of scope before a grace
      period. We either can synchronize_rcu or switch over to kfree_rcu to
      manage the sockets. kfree_rcu seems appropriate as it is used by vxlan
      and geneve.
      
      Fixes: 23461551 ("fou: Support for foo-over-udp RX path")
      Cc: Tom Herbert <tom@herbertland.com>
      Signed-off-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3036facb
  6. 16 Dec, 2015 5 commits
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2015-12-15' of... · 4d4f3791
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2015-12-15' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      Another set of fixes:
       * memory leak fixes (from Ola)
       * operating mode notification spec compliance fix (from Eyal)
       * copy rfkill names in case pointer becomes invalid (myself)
       * two hardware restart fixes (myself)
       * get rid of "limiting TX power" log spam (myself)
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4d4f3791
    • Martin Roth's avatar
      82xx: FCC: Fixing a bug causing to FCC port lock-up · 79aa05a2
      Martin Roth authored
      The patch fixes FCC port lock-up, which occurs as a result of a bug
      during underrun/collision handling. Within the tx_startup() function
      in mac-fcc.c, the address of last BD is not calculated correctly.
      As a result of wrong calculation of the last BD address, the next
      transmitted BD may be set to an area out of the transmit BD ring.
      This actually causes to port lock-up and it is not recoverable.
      Signed-off-by: default avatarMartin Roth <martin.roth@motorolasolutions.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      79aa05a2
    • Hamish Martin's avatar
      gianfar: Don't enable RX Filer if not supported · 7bff47da
      Hamish Martin authored
      After commit 15bf176d ("gianfar: Don't enable the Filer w/o the
      Parser"), 'TSEC' model controllers (for example as seen on MPC8541E)
      always have 8 bytes stripped from the front of received frames.
      Only 'eTSEC' gianfar controllers have the RX Filer capability (amongst
      other enhancements). Previously this was treated as always enabled
      for both 'TSEC' and 'eTSEC' controllers.
      In commit 15bf176d ("gianfar: Don't enable the Filer w/o the Parser")
      a subtle change was made to the setting of 'uses_rxfcb' to effectively
      always set it (since 'rx_filer_enable' was always true). This had the
      side-effect of always stripping 8 bytes from the front of received frames
      on 'TSEC' type controllers.
      
      We now only enable the RX Filer capability on controller types that
      support it, thereby avoiding the issue for 'TSEC' type controllers.
      Reviewed-by: default avatarChris Packham <chris.packham@alliedtelesis.co.nz>
      Reviewed-by: default avatarMark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
      Signed-off-by: default avatarHamish Martin <hamish.martin@alliedtelesis.co.nz>
      Reviewed-by: default avatarClaudiu Manoil <claudiu.manoil@freescale.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7bff47da
    • Daniel Mentz's avatar
      dma-debug: Fix dma_debug_entry offset calculation · 0354aec1
      Daniel Mentz authored
      dma-debug uses struct dma_debug_entry to keep track of dma coherent
      memory allocation requests. The virtual address is converted into a pfn
      and an offset. Previously, the offset was calculated using an incorrect
      bit mask.  As a result, we saw incorrect error messages from dma-debug
      like the following:
      
      "DMA-API: exceeded 7 overlapping mappings of cacheline 0x03e00000"
      
      Cacheline 0x03e00000 does not exist on our platform.
      
      Cc: <stable@vger.kernel.org>
      Fixes: 0abdd7a8 ("dma-debug: introduce debug_dma_assert_idle()")
      Signed-off-by: default avatarDaniel Mentz <danielmentz@google.com>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      0354aec1
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm · a5e90b1b
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "Further ARM fixes:
         - Anson Huang noticed that we were corrupting a register we shouldn't
           be during suspend on some CPUs.
         - Shengjiu Wang spotted a bug in the 'swp' instruction emulation.
         - Will Deacon fixed a bug in the ASID allocator.
         - Laura Abbott fixed the kernel permission protection to apply to all
           threads running in the system.
         - I've fixed two bugs with the domain access control register
           handling, one to do with printing an appropriate value at oops
           time, and the other to further fix the uaccess_with_memcpy code"
      
      * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
        ARM: 8475/1: SWP emulation: Restore original *data when failed
        ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted
        ARM: fix uaccess_with_memcpy() with SW_DOMAIN_PAN
        ARM: report proper DACR value in oops dumps
        ARM: 8464/1: Update all mm structures with section adjustments
        ARM: 8465/1: mm: keep reserved ASIDs in sync with mm after multiple rollovers
      a5e90b1b