1. 16 Jul, 2017 11 commits
    • Arvind Yadav's avatar
      atm: lanai: constify pci_device_id. · 626e87ca
      Arvind Yadav authored
      pci_device_id are not supposed to change at runtime. All functions
      working with pci_device_id provided by <linux/pci.h> work with
      const pci_device_id. So mark the non-const structs as const.
      
      File size before:
         text	   data	    bss	    dec	    hex	filename
        18074	    352	      0	  18426	   47fa	drivers/atm/lanai.o
      
      File size After adding 'const':
         text	   data	    bss	    dec	    hex	filename
        18170	    256	      0	  18426	   47fa	drivers/atm/lanai.o
      Signed-off-by: default avatarArvind Yadav <arvind.yadav.cs@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      626e87ca
    • Arvind Yadav's avatar
      atm: solos-pci: constify pci_device_id. · 6d6148b3
      Arvind Yadav authored
      pci_device_id are not supposed to change at runtime. All functions
      working with pci_device_id provided by <linux/pci.h> work with
      const pci_device_id. So mark the non-const structs as const.
      
      File size before:
         text	   data	    bss	    dec	    hex	filename
        16138	   4592	     24	  20754	   5112	drivers/atm/solos-pci.o
      
      File size After adding 'const':
         text	   data	    bss	    dec	    hex	filename
        16218	   4528	     24	  20754	   5122	drivers/atm/solos-pci.o
      Signed-off-by: default avatarArvind Yadav <arvind.yadav.cs@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6d6148b3
    • Arvind Yadav's avatar
      atm: horizon: constify pci_device_id. · 77c0805d
      Arvind Yadav authored
      pci_device_id are not supposed to change at runtime. All functions
      working with pci_device_id provided by <linux/pci.h> work with
      const pci_device_id. So mark the non-const structs as const.
      
      File size before:
         text	   data	    bss	    dec	    hex	filename
         9859	    328	      6	  10193	   27d1	drivers/atm/horizon.o
      
      File size After adding 'const':
         text	   data	    bss	    dec	    hex	filename
         9923	    264	      6	  10193	   27d1	drivers/atm/horizon.o
      Signed-off-by: default avatarArvind Yadav <arvind.yadav.cs@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      77c0805d
    • Arvind Yadav's avatar
      atm: he: constify pci_device_id. · 5c007845
      Arvind Yadav authored
      pci_device_id are not supposed to change at runtime. All functions
      working with pci_device_id provided by <linux/pci.h> work with
      const pci_device_id. So mark the non-const structs as const.
      
      File size before:
         text	   data	    bss	    dec	    hex	filename
        26514	    440	     48	  27002	   697a	drivers/atm/he.o
      
      File size After adding 'const':
         text	   data	    bss	    dec	    hex	filename
        26578	    376	     48	  27002	   697a	drivers/atm/he.o
      Signed-off-by: default avatarArvind Yadav <arvind.yadav.cs@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5c007845
    • Arvind Yadav's avatar
      atm: nicstar: constify pci_device_id. · 2f3e2604
      Arvind Yadav authored
      pci_device_id are not supposed to change at runtime. All functions
      working with pci_device_id provided by <linux/pci.h> work with
      const pci_device_id. So mark the non-const structs as const.
      
      File size before:
         text	   data	    bss	    dec	    hex	filename
        22781	    464	    128	  23373	   5b4d	drivers/atm/nicstar.o
      
      File size After adding 'const':
         text	   data	    bss	    dec	    hex	filename
        22845	    400	    128	  23373	   5b4d	drivers/atm/nicstar.o
      Signed-off-by: default avatarArvind Yadav <arvind.yadav.cs@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2f3e2604
    • Arvind Yadav's avatar
      atm: fore200e: constify pci_device_id. · d5c5665d
      Arvind Yadav authored
      pci_device_id are not supposed to change at runtime. All functions
      working with pci_device_id provided by <linux/pci.h> work with
      const pci_device_id. So mark the non-const structs as const.
      
      File size before:
         text	   data	    bss	    dec	    hex	filename
        20025	    320	     16	  20361	   4f89	drivers/atm/fore200e.o
      
      File size After adding 'const':
         text	   data	    bss	    dec	    hex	filename
        20089	    256	     16	  20361	   4f89	drivers/atm/fore200e.o
      Signed-off-by: default avatarArvind Yadav <arvind.yadav.cs@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d5c5665d
    • Arvind Yadav's avatar
      atm: ambassador: constify pci_device_id. · c21c5a7f
      Arvind Yadav authored
      pci_device_id are not supposed to change at runtime. All functions
      working with pci_device_id provided by <linux/pci.h> work with
      const pci_device_id. So mark the non-const structs as const.
      
      File size before:
         text	   data	    bss	    dec	    hex	filename
        13372	    408	      4	  13784	   35d8	drivers/atm/ambassador.o
      
      File size After adding 'const':
         text	   data	    bss	    dec	    hex	filename
        13484	    296	      4	  13784	   35d8	drivers/atm/ambassador.o
      Signed-off-by: default avatarArvind Yadav <arvind.yadav.cs@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c21c5a7f
    • Arvind Yadav's avatar
      atm: iphase: constify pci_device_id. · 10244bc2
      Arvind Yadav authored
      pci_device_id are not supposed to change at runtime. All functions
      working with pci_device_id provided by <linux/pci.h> work with
      const pci_device_id. So mark the non-const structs as const.
      
      File size before:
         text	   data	    bss	    dec	    hex	filename
        23536	    432	    160	  24128	   5e40	drivers/atm/iphase.o
      
      File size After adding 'const':
         text	   data	    bss	    dec	    hex	filename
        23632	    336	    160	  24128	   5e40	drivers/atm/iphase.o
      Signed-off-by: default avatarArvind Yadav <arvind.yadav.cs@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      10244bc2
    • Vincent Bernat's avatar
      ip6: fix PMTU discovery when using /127 subnets · ccdb2d17
      Vincent Bernat authored
      The definition of an "anycast destination address" has been tweaked as a
      side-effect of commit 2647a9b0 ("ipv6: Remove external dependency on
      rt6i_gateway and RTF_ANYCAST"). The first address of a point-to-point
      /127 subnet is now considered as an anycast address. This prevents
      ICMPv6 errors to be returned to a sender of such a subnet and breaks
      PMTU discovery.
      
      This can be reproduced with:
      
          ip link add name out6 type veth peer name in6
          ip link add name out7 type veth peer name in7
          ip link set mtu 1400 dev out7
          ip link set mtu 1400 dev in7
          ip netns add next-hop
          ip netns add next-next-hop
          ip link set netns next-hop dev in6
          ip link set netns next-hop dev out7
          ip link set netns next-next-hop dev in7
          ip link set up dev out6
          ip addr add 2001:db8:1::12/127 dev out6
          ip netns exec next-hop ip link set up dev in6
          ip netns exec next-hop ip link set up dev out7
          ip netns exec next-hop ip addr add 2001:db8:1::13/127 dev in6
          ip netns exec next-hop ip addr add 2001:db8:1::14/127 dev out7
          ip netns exec next-hop ip route add default via 2001:db8:1::15
          ip netns exec next-hop sysctl -qw net.ipv6.conf.all.forwarding=1
          ip netns exec next-next-hop ip link set up dev in7
          ip netns exec next-next-hop ip addr add 2001:db8:1::15/127 dev in7
          ip netns exec next-next-hop ip addr add 2001:db8:1::50/128 dev in7
          ip netns exec next-next-hop ip route add default via 2001:db8:1::14
          ip netns exec next-next-hop sysctl -qw net.ipv6.conf.all.forwarding=1
          ip route add 2001:db8:1::48/123 via 2001:db8:1::13
          sleep 4
          ping -M do -s 1452 -c 3 2001:db8:1::50 || true
          ip route get 2001:db8:1::50
      
      Before the patch, we get:
      
          2001:db8:1::50 from :: via 2001:db8:1::13 dev out6 src 2001:db8:1::12 metric 1024  pref medium
      
      After the patch, we get:
      
          2001:db8:1::50 via 2001:db8:1::13 dev out6 src 2001:db8:1::12 metric 0
              cache  expires 578sec mtu 1400 pref medium
      
      Fixes: 2647a9b0 ("ipv6: Remove external dependency on rt6i_gateway and RTF_ANYCAST")
      Signed-off-by: default avatarVincent Bernat <vincent@bernat.im>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ccdb2d17
    • sixiao@microsoft.com's avatar
      tools: hv: ignore a NIC if it has been configured · 1c3a044c
      sixiao@microsoft.com authored
      Let bondvf.sh ignore this NIC if it has been configured, to prevent
      user configuration from being overwritten unexpectly.
      Signed-off-by: default avatarSimon Xiao <sixiao@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1c3a044c
    • Shannon Nelson's avatar
      sunvnet: add support for IPv6 checksum offloads · 98524e04
      Shannon Nelson authored
      The original code didn't handle non-IPv4 packets very well, so the
      offload advertising had to be scaled back down to just IP.  Here we
      add the bits needed to support TCP and UDP packets over IPv6 and
      turn the offload advertising back on.
      
      Orabug: 26289579
      Signed-off-by: default avatarShannon Nelson <shannon.nelson@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      98524e04
  2. 13 Jul, 2017 3 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · edaf3825
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
      1) Fix 64-bit division in mlx5 IPSEC offload support, from Ilan Tayari
         and Arnd Bergmann.
      
      2) Fix race in statistics gathering in bnxt_en driver, from Michael
         Chan.
      
      3) Can't use a mutex in RCU reader protected section on tap driver, from
         Cong WANG.
      
      4) Fix mdb leak in bridging code, from Eduardo Valentin.
      
      5) Fix free of wrong pointer variable in nfp driver, from Dan Carpenter.
      
      6) Buffer overflow in brcmfmac driver, from Arend van SPriel.
      
      7) ioremap_nocache() return value needs to be checked in smsc911x
         driver, from Alexey Khoroshilov.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (34 commits)
        net: stmmac: revert "support future possible different internal phy mode"
        sfc: don't read beyond unicast address list
        datagram: fix kernel-doc comments
        socket: add documentation for missing elements
        smsc911x: Add check for ioremap_nocache() return code
        brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
        net: hns: Bugfix for Tx timeout handling in hns driver
        net: ipmr: ipmr_get_table() returns NULL
        nfp: freeing the wrong variable
        mlxsw: spectrum_switchdev: Check status of memory allocation
        mlxsw: spectrum_switchdev: Remove unused variable
        mlxsw: spectrum_router: Fix use-after-free in route replace
        mlxsw: spectrum_router: Add missing rollback
        samples/bpf: fix a build issue
        bridge: mdb: fix leak on complete_info ptr on fail path
        tap: convert a mutex to a spinlock
        cxgb4: fix BUG() on interrupt deallocating path of ULD
        qed: Fix printk option passed when printing ipv6 addresses
        net: Fix minor code bug in timestamping.txt
        net: stmmac: Make 'alloc_dma_[rt]x_desc_resources()' look even closer
        ...
      edaf3825
    • Linus Torvalds's avatar
      disable new gcc-7.1.1 warnings for now · bd664f6b
      Linus Torvalds authored
      I made the mistake of upgrading my desktop to the new Fedora 26 that
      comes with gcc-7.1.1.
      
      There's nothing wrong per se that I've noticed, but I now have 1500
      lines of warnings, mostly from the new format-truncation warning
      triggering all over the tree.
      
      We use 'snprintf()' and friends in a lot of places, and often know that
      the numbers are fairly small (ie a controller index or similar), but gcc
      doesn't know that, and sees an 'int', and thinks that it could be some
      huge number.  And then complains when our buffers are not able to fit
      the name for the ten millionth controller.
      
      These warnings aren't necessarily bad per se, and we probably want to
      look through them subsystem by subsystem, but at least during the merge
      window they just mean that I can't even see if somebody is introducing
      any *real* problems when I pull.
      
      So warnings disabled for now.
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      bd664f6b
    • Linus Torvalds's avatar
      Merge tag 'modules-for-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux · 3a75ad14
      Linus Torvalds authored
      Pull modules updates from Jessica Yu:
       "Summary of modules changes for the 4.13 merge window:
      
         - Minor code cleanups
      
         - Avoid accessing mod struct prior to checking module struct version,
           from Kees
      
         - Fix racy atomic inc/dec logic of kmod_concurrent_max in kmod, from
           Luis"
      
      * tag 'modules-for-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux:
        module: make the modinfo name const
        kmod: reduce atomic operations on kmod_concurrent and simplify
        module: use list_for_each_entry_rcu() on find_module_all()
        kernel/module.c: suppress warning about unused nowarn variable
        module: Add module name to modinfo
        module: Pass struct load_info into symbol checks
      3a75ad14
  3. 12 Jul, 2017 22 commits
    • LABBE Corentin's avatar
      net: stmmac: revert "support future possible different internal phy mode" · d93b07f8
      LABBE Corentin authored
      Since internal phy-mode is reserved for non-xMII protocol we cannot use
      it with dwmac-sun8i.
      Furthermore, all DT patchs which comes with this patch were cleaned, so
      the current state is broken.
      This reverts commit 1c2fa5f8 ("net: stmmac: support future possible different internal phy mode")
      
      Fixes: 1c2fa5f8 ("net: stmmac: support future possible different internal phy mode")
      Signed-off-by: default avatarCorentin Labbe <clabbe.montjoie@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d93b07f8
    • Bert Kenward's avatar
      sfc: don't read beyond unicast address list · c70d6815
      Bert Kenward authored
      If we have more than 32 unicast MAC addresses assigned to an interface
      we will read beyond the end of the address table in the driver when
      adding filters. The next 256 entries store multicast addresses, so we
      will end up attempting to insert duplicate filters, which is mostly
      harmless. If we add more than 288 unicast addresses we will then read
      past the multicast address table, which is likely to be more exciting.
      
      Fixes: 12fb0da4 ("sfc: clean fallbacks between promisc/normal in efx_ef10_filter_sync_rx_mode")
      Signed-off-by: default avatarBert Kenward <bkenward@solarflare.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c70d6815
    • David S. Miller's avatar
      Merge branch 'net-doc-fixes' · 07b8a7cf
      David S. Miller authored
      Stephen Hemminger says:
      
      ====================
      minor net kernel-doc fixes
      
      Fix a couple of small errors in kernel-doc for networking
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      07b8a7cf
    • stephen hemminger's avatar
      datagram: fix kernel-doc comments · d3f6cd9e
      stephen hemminger authored
      An underscore in the kernel-doc comment section has special meaning
      and mis-use generates an errors.
      
      ./net/core/datagram.c:207: ERROR: Unknown target name: "msg".
      ./net/core/datagram.c:379: ERROR: Unknown target name: "msg".
      ./net/core/datagram.c:816: ERROR: Unknown target name: "t".
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d3f6cd9e
    • stephen hemminger's avatar
      socket: add documentation for missing elements · 771edcaf
      stephen hemminger authored
      Fill in missing kernel-doc for missing elements in struct sock.
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      771edcaf
    • Alexey Khoroshilov's avatar
      smsc911x: Add check for ioremap_nocache() return code · 57fe1479
      Alexey Khoroshilov authored
      There is no check for return code of smsc911x_drv_probe()
      in smsc911x_drv_probe(). The patch adds one.
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      57fe1479
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 235b84fc
      Linus Torvalds authored
      Pull i2c updates from Wolfram Sang:
       "This pull request contains:
      
         - i2c core reorganization. One source file became too monolithic. It
           is now split up, yet we still have the same named object as the
           final output. This should ease maintenance.
      
         - new drivers: ZTE ZX2967 family, ASPEED 24XX/25XX
      
         - designware driver gained slave mode support
      
         - xgene-slimpro driver gained ACPI support
      
         - bigger overhaul for pca-platform driver
      
         - the algo-bit module now supports messages with enforced STOP
      
         - slightly bigger than usual set of driver updates and improvements
      
        and with much appreciated quality assurance from Andy Shevchenko"
      
      * 'i2c/for-4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (51 commits)
        i2c: Provide a stub for i2c_detect_slave_mode()
        i2c: designware: Let slave adapter support be optional
        i2c: designware: Make HW init functions static
        i2c: designware: fix spelling mistakes
        i2c: pca-platform: propagate error from i2c_pca_add_numbered_bus
        i2c: pca-platform: correctly set algo_data.reset_chip
        i2c: acpi: Do not create i2c-clients for LNXVIDEO ACPI devices
        i2c: designware: enable SLAVE in platform module
        i2c: designware: add SLAVE mode functions
        i2c: zx2967: drop COMPILE_TEST dependency
        i2c: zx2967: always use the same device when printing errors
        i2c: pca-platform: use dev_warn/dev_info instead of printk
        i2c: pca-platform: use device managed allocations
        i2c: pca-platform: add devicetree awareness
        i2c: pca-platform: switch to struct gpio_desc
        dt-bindings: add bindings for i2c-pca-platform
        i2c: cadance: fix ctrl/addr reg write order
        i2c: zx2967: add i2c controller driver for ZTE's zx2967 family
        dt: bindings: add documentation for zx2967 family i2c controller
        i2c: algo-bit: add support for I2C_M_STOP
        ...
      235b84fc
    • Linus Torvalds's avatar
      Merge tag 'iommu-updates-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · fb4e3bee
      Linus Torvalds authored
      Pull IOMMU updates from Joerg Roedel:
       "This update comes with:
      
         - Support for lockless operation in the ARM io-pgtable code.
      
           This is an important step to solve the scalability problems in the
           common dma-iommu code for ARM
      
         - Some Errata workarounds for ARM SMMU implemenations
      
         - Rewrite of the deferred IO/TLB flush code in the AMD IOMMU driver.
      
           The code suffered from very high flush rates, with the new
           implementation the flush rate is down to ~1% of what it was before
      
         - Support for amd_iommu=off when booting with kexec.
      
           The problem here was that the IOMMU driver bailed out early without
           disabling the iommu hardware, if it was enabled in the old kernel
      
         - The Rockchip IOMMU driver is now available on ARM64
      
         - Align the return value of the iommu_ops->device_group call-backs to
           not miss error values
      
         - Preempt-disable optimizations in the Intel VT-d and common IOVA
           code to help Linux-RT
      
         - Various other small cleanups and fixes"
      
      * tag 'iommu-updates-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (60 commits)
        iommu/vt-d: Constify intel_dma_ops
        iommu: Warn once when device_group callback returns NULL
        iommu/omap: Return ERR_PTR in device_group call-back
        iommu: Return ERR_PTR() values from device_group call-backs
        iommu/s390: Use iommu_group_get_for_dev() in s390_iommu_add_device()
        iommu/vt-d: Don't disable preemption while accessing deferred_flush()
        iommu/iova: Don't disable preempt around this_cpu_ptr()
        iommu/arm-smmu-v3: Add workaround for Cavium ThunderX2 erratum #126
        iommu/arm-smmu-v3: Enable ACPI based HiSilicon CMD_PREFETCH quirk(erratum 161010701)
        iommu/arm-smmu-v3: Add workaround for Cavium ThunderX2 erratum #74
        ACPI/IORT: Fixup SMMUv3 resource size for Cavium ThunderX2 SMMUv3 model
        iommu/arm-smmu-v3, acpi: Add temporary Cavium SMMU-V3 IORT model number definitions
        iommu/io-pgtable-arm: Use dma_wmb() instead of wmb() when publishing table
        iommu/io-pgtable: depend on !GENERIC_ATOMIC64 when using COMPILE_TEST with LPAE
        iommu/arm-smmu-v3: Remove io-pgtable spinlock
        iommu/arm-smmu: Remove io-pgtable spinlock
        iommu/io-pgtable-arm-v7s: Support lockless operation
        iommu/io-pgtable-arm: Support lockless operation
        iommu/io-pgtable: Introduce explicit coherency
        iommu/io-pgtable-arm-v7s: Refactor split_blk_unmap
        ...
      fb4e3bee
    • Linus Torvalds's avatar
      Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs · 6b1c776d
      Linus Torvalds authored
      Pull overlayfs updates from Miklos Szeredi:
       "This work from Amir introduces the inodes index feature, which
        provides:
      
         - hardlinks are not broken on copy up
      
         - infrastructure for overlayfs NFS export
      
        This also fixes constant st_ino for samefs case for lower hardlinks"
      
      * 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: (33 commits)
        ovl: mark parent impure and restore timestamp on ovl_link_up()
        ovl: document copying layers restrictions with inodes index
        ovl: cleanup orphan index entries
        ovl: persistent overlay inode nlink for indexed inodes
        ovl: implement index dir copy up
        ovl: move copy up lock out
        ovl: rearrange copy up
        ovl: add flag for upper in ovl_entry
        ovl: use struct copy_up_ctx as function argument
        ovl: base tmpfile in workdir too
        ovl: factor out ovl_copy_up_inode() helper
        ovl: extract helper to get temp file in copy up
        ovl: defer upper dir lock to tempfile link
        ovl: hash overlay non-dir inodes by copy up origin
        ovl: cleanup bad and stale index entries on mount
        ovl: lookup index entry for copy up origin
        ovl: verify index dir matches upper dir
        ovl: verify upper root dir matches lower root dir
        ovl: introduce the inodes index dir feature
        ovl: generalize ovl_create_workdir()
        ...
      6b1c776d
    • Al Viro's avatar
      fix a braino in compat_sys_getrlimit() · 58c7ffc0
      Al Viro authored
      Reported-and-tested-by: default avatarMeelis Roos <mroos@linux.ee>
      Fixes: commit d9e968cb "getrlimit()/setrlimit(): move compat to native"
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      58c7ffc0
    • Arend van Spriel's avatar
      brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() · 8f44c9a4
      Arend van Spriel authored
      The lower level nl80211 code in cfg80211 ensures that "len" is between
      25 and NL80211_ATTR_FRAME (2304).  We subtract DOT11_MGMT_HDR_LEN (24) from
      "len" so thats's max of 2280.  However, the action_frame->data[] buffer is
      only BRCMF_FIL_ACTION_FRAME_SIZE (1800) bytes long so this memcpy() can
      overflow.
      
      	memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
      	       le16_to_cpu(action_frame->len));
      
      Cc: stable@vger.kernel.org # 3.9.x
      Fixes: 18e2f61d ("brcmfmac: P2P action frame tx.")
      Reported-by: default avatar"freenerguo(郭大兴)" <freenerguo@tencent.com>
      Signed-off-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8f44c9a4
    • Lin Yun Sheng's avatar
      net: hns: Bugfix for Tx timeout handling in hns driver · 76b825ab
      Lin Yun Sheng authored
      When hns port type is not debug mode, netif_tx_disable is called
      when there is a tx timeout, which requires system reboot to return
      to normal state. This patch fix this problem by resetting the net
      dev.
      
      Fixes: b5996f11 ("net: add Hisilicon Network Subsystem basic ethernet support")
      Signed-off-by: default avatarLin Yun Sheng <linyunsheng@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      76b825ab
    • Dan Carpenter's avatar
      net: ipmr: ipmr_get_table() returns NULL · 2e3d232e
      Dan Carpenter authored
      The ipmr_get_table() function doesn't return error pointers it returns
      NULL on error.
      
      Fixes: 4f75ba69 ("net: ipmr: Add ipmr_rtm_getroute")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Acked-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2e3d232e
    • Dan Carpenter's avatar
      nfp: freeing the wrong variable · 88f0f09b
      Dan Carpenter authored
      We accidentally free a NULL pointer and leak the pointer we want to
      free.  Also you can tell from the label name what was intended.  :)
      
      Fixes: abfcdc1d ("nfp: add a stats handler for flower offloads")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Acked-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      88f0f09b
    • David S. Miller's avatar
      Merge branch 'mlxsw-spectrum-Various-fixes' · da296769
      David S. Miller authored
      Jiri Pirko says:
      
      ====================
      mlxsw: spectrum: Various fixes
      
      First patch adds a missing rollback in error path. Second patch prevents
      a use-after-free during IPv4 route replace. Last two patches fix warnings
      from static checkers.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      da296769
    • Ido Schimmel's avatar
      mlxsw: spectrum_switchdev: Check status of memory allocation · 6f497930
      Ido Schimmel authored
      We can't rely on kzalloc() always succeeding, so check its return value.
      
      Suppresses the following smatch error:
      
      mlxsw_sp_switchdev_event() error: potential null dereference
      'switchdev_work->fdb_info.addr'.  (kzalloc returns
       null)
      
      Fixes: af061378 ("mlxsw: spectrum_switchdev: Add support for learning FDB through notification")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6f497930
    • Ido Schimmel's avatar
      mlxsw: spectrum_switchdev: Remove unused variable · a9265b80
      Ido Schimmel authored
      Commit 10e23eb2 ("mlxsw: spectrum: Remove support for bypass bridge
      port attributes/vlan set") removed statements that used 'bridge_vlan',
      but didn't remove the variable itself resulting in the following warning
      with W=1:
      
      warning: variable ‘bridge_vlan’ set but not used
      [-Wunused-but-set-variable]
      
      Remove the variable and suppress the warning.
      
      Fixes: 10e23eb2 ("mlxsw: spectrum: Remove support for bypass bridge port attributes/vlan set")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a9265b80
    • Ido Schimmel's avatar
      mlxsw: spectrum_router: Fix use-after-free in route replace · 7387dbbc
      Ido Schimmel authored
      While working on IPv6 route replace I realized we can have a
      use-after-free in IPv4 in case the replaced route is offloaded and the
      only one using its FIB info.
      
      The problem is that fib_table_insert() drops the reference on the FIB
      info of the replaced routes which is eventually freed via call_rcu().
      Since the driver doesn't hold a reference on this FIB info it can cause
      a use-after-free when it tries to clear the RTNH_F_OFFLOAD flag stored
      in fi->fib_flags.
      
      After running the following commands in a loop for enough time with a
      KASAN enabled kernel I finally got the below trace.
      
      $ ip route add 192.168.50.0/24 via 192.168.200.1 dev enp3s0np3
      $ ip route replace 192.168.50.0/24 dev enp3s0np5
      $ ip route del 192.168.50.0/24 dev enp3s0np5
      
      BUG: KASAN: use-after-free in mlxsw_sp_fib_entry_offload_unset+0xa7/0x120 [mlxsw_spectrum]
      Read of size 4 at addr ffff8803717d9820 by task kworker/u4:2/55
      [...]
      ? mlxsw_sp_fib_entry_offload_unset+0xa7/0x120 [mlxsw_spectrum]
      ? mlxsw_sp_fib_entry_offload_unset+0xa7/0x120 [mlxsw_spectrum]
      ? mlxsw_sp_router_neighs_update_work+0x1cd0/0x1ce0 [mlxsw_spectrum]
      ? mlxsw_sp_fib_entry_offload_unset+0xa7/0x120 [mlxsw_spectrum]
      __asan_load4+0x61/0x80
      mlxsw_sp_fib_entry_offload_unset+0xa7/0x120 [mlxsw_spectrum]
      mlxsw_sp_fib_entry_offload_refresh+0xb6/0x370 [mlxsw_spectrum]
      mlxsw_sp_router_fib_event_work+0xd1c/0x2780 [mlxsw_spectrum]
      [...]
      Freed by task 5131:
       save_stack_trace+0x16/0x20
       save_stack+0x46/0xd0
       kasan_slab_free+0x70/0xc0
       kfree+0x144/0x570
       free_fib_info_rcu+0x2e7/0x410
       rcu_process_callbacks+0x4f8/0xe30
       __do_softirq+0x1d3/0x9e2
      
      Fix this by taking a reference on the FIB info when creating the nexthop
      group it represents and drop it when the group is destroyed.
      
      Fixes: 599cf8f9 ("mlxsw: spectrum_router: Add support for route replace")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7387dbbc
    • Ido Schimmel's avatar
      mlxsw: spectrum_router: Add missing rollback · a4e75b76
      Ido Schimmel authored
      With this patch the error path of mlxsw_sp_nexthop_init() is symmetric
      with mlxsw_sp_nexthop_fini(). Noticed during code review.
      
      Fixes: a8c97014 ("mlxsw: spectrum_router: Refactor nexthop init routine")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a4e75b76
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 3b06b1a7
      Linus Torvalds authored
      Pull sparc fixes from David Miller:
      
       - Fix symbol version generation for assembler on sparc, from
         Nagarathnam Muthusamy.
      
       - Fix compound page handling in gup_huge_pmd(), from Nitin Gupta.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc64: Fix gup_huge_pmd
        Adding the type of exported symbols
        sed regex in Makefile.build requires line break between exported symbols
        Adding asm-prototypes.h for genksyms to generate crc
      3b06b1a7
    • Yonghong Song's avatar
      samples/bpf: fix a build issue · 53335022
      Yonghong Song authored
      With latest net-next:
      
      ====
      clang  -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/6.3.1/include -I./arch/x86/include -I./arch/x86/include/generated/uapi -I./arch/x86/include/generated  -I./include -I./arch/x86/include/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/kconfig.h  -Isamples/bpf \
          -D__KERNEL__ -D__ASM_SYSREG_H -Wno-unused-value -Wno-pointer-sign \
          -Wno-compare-distinct-pointer-types \
          -Wno-gnu-variable-sized-type-not-at-end \
          -Wno-address-of-packed-member -Wno-tautological-compare \
          -Wno-unknown-warning-option \
          -O2 -emit-llvm -c samples/bpf/tcp_synrto_kern.c -o -| llc -march=bpf -filetype=obj -o samples/bpf/tcp_synrto_kern.o
      samples/bpf/tcp_synrto_kern.c:20:10: fatal error: 'bpf_endian.h' file not found
                ^~~~~~~~~~~~~~
      1 error generated.
      ====
      
      net has the same issue.
      
      Add support for ntohl and htonl in tools/testing/selftests/bpf/bpf_endian.h.
      Also move bpf_helpers.h from samples/bpf to selftests/bpf and change
      compiler include logic so that programs in samples/bpf can access the headers
      in selftests/bpf, but not the other way around.
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarLawrence Brakmo <brakmo@fb.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      53335022
    • Eduardo Valentin's avatar
      bridge: mdb: fix leak on complete_info ptr on fail path · 1bfb1596
      Eduardo Valentin authored
      We currently get the following kmemleak report:
      unreferenced object 0xffff8800039d9820 (size 32):
        comm "softirq", pid 0, jiffies 4295212383 (age 792.416s)
        hex dump (first 32 bytes):
          00 0c e0 03 00 88 ff ff ff 02 00 00 00 00 00 00  ................
          00 00 00 01 ff 11 00 02 86 dd 00 00 ff ff ff ff  ................
        backtrace:
          [<ffffffff8152b4aa>] kmemleak_alloc+0x4a/0xa0
          [<ffffffff811d8ec8>] kmem_cache_alloc_trace+0xb8/0x1c0
          [<ffffffffa0389683>] __br_mdb_notify+0x2a3/0x300 [bridge]
          [<ffffffffa038a0ce>] br_mdb_notify+0x6e/0x70 [bridge]
          [<ffffffffa0386479>] br_multicast_add_group+0x109/0x150 [bridge]
          [<ffffffffa0386518>] br_ip6_multicast_add_group+0x58/0x60 [bridge]
          [<ffffffffa0387fb5>] br_multicast_rcv+0x1d5/0xdb0 [bridge]
          [<ffffffffa037d7cf>] br_handle_frame_finish+0xcf/0x510 [bridge]
          [<ffffffffa03a236b>] br_nf_hook_thresh.part.27+0xb/0x10 [br_netfilter]
          [<ffffffffa03a3738>] br_nf_hook_thresh+0x48/0xb0 [br_netfilter]
          [<ffffffffa03a3fb9>] br_nf_pre_routing_finish_ipv6+0x109/0x1d0 [br_netfilter]
          [<ffffffffa03a4400>] br_nf_pre_routing_ipv6+0xd0/0x14c [br_netfilter]
          [<ffffffffa03a3c27>] br_nf_pre_routing+0x197/0x3d0 [br_netfilter]
          [<ffffffff814a2952>] nf_iterate+0x52/0x60
          [<ffffffff814a29bc>] nf_hook_slow+0x5c/0xb0
          [<ffffffffa037ddf4>] br_handle_frame+0x1a4/0x2c0 [bridge]
      
      This happens when switchdev_port_obj_add() fails. This patch
      frees complete_info object in the fail path.
      Reviewed-by: default avatarVallish Vaidyeshwara <vallish@amazon.com>
      Signed-off-by: default avatarEduardo Valentin <eduval@amazon.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1bfb1596
  4. 11 Jul, 2017 4 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 130568d5
      Linus Torvalds authored
      Pull more block updates from Jens Axboe:
       "This is a followup for block changes, that didn't make the initial
        pull request. It's a bit of a mixed bag, this contains:
      
         - A followup pull request from Sagi for NVMe. Outside of fixups for
           NVMe, it also includes a series for ensuring that we properly
           quiesce hardware queues when browsing live tags.
      
         - Set of integrity fixes from Dmitry (mostly), fixing various issues
           for folks using DIF/DIX.
      
         - Fix for a bug introduced in cciss, with the req init changes. From
           Christoph.
      
         - Fix for a bug in BFQ, from Paolo.
      
         - Two followup fixes for lightnvm/pblk from Javier.
      
         - Depth fix from Ming for blk-mq-sched.
      
         - Also from Ming, performance fix for mtip32xx that was introduced
           with the dynamic initialization of commands"
      
      * 'for-linus' of git://git.kernel.dk/linux-block: (44 commits)
        block: call bio_uninit in bio_endio
        nvmet: avoid unneeded assignment of submit_bio return value
        nvme-pci: add module parameter for io queue depth
        nvme-pci: compile warnings in nvme_alloc_host_mem()
        nvmet_fc: Accept variable pad lengths on Create Association LS
        nvme_fc/nvmet_fc: revise Create Association descriptor length
        lightnvm: pblk: remove unnecessary checks
        lightnvm: pblk: control I/O flow also on tear down
        cciss: initialize struct scsi_req
        null_blk: fix error flow for shared tags during module_init
        block: Fix __blkdev_issue_zeroout loop
        nvme-rdma: unconditionally recycle the request mr
        nvme: split nvme_uninit_ctrl into stop and uninit
        virtio_blk: quiesce/unquiesce live IO when entering PM states
        mtip32xx: quiesce request queues to make sure no submissions are inflight
        nbd: quiesce request queues to make sure no submissions are inflight
        nvme: kick requeue list when requeueing a request instead of when starting the queues
        nvme-pci: quiesce/unquiesce admin_q instead of start/stop its hw queues
        nvme-loop: quiesce/unquiesce admin_q instead of start/stop its hw queues
        nvme-fc: quiesce/unquiesce admin_q instead of start/stop its hw queues
        ...
      130568d5
    • Linus Torvalds's avatar
      Merge tag 'smb3-security-fixes-for-4.13' of git://git.samba.org/sfrench/cifs-2.6 · 908b852d
      Linus Torvalds authored
      Pull cifs fixes and sane default from Steve French:
       "Upgrade default dialect to more secure SMB3 from older cifs dialect"
      
      * tag 'smb3-security-fixes-for-4.13' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: Clean up unused variables in smb2pdu.c
        [SMB3] Improve security, move default dialect to SMB3 from old CIFS
        [SMB3] Remove ifdef since SMB3 (and later) now STRONGLY preferred
        CIFS: Reconnect expired SMB sessions
        CIFS: Display SMB2 error codes in the hex format
        cifs: Use smb 2 - 3 and cifsacl mount options setacl function
        cifs: prototype declaration and definition to set acl for smb 2 - 3 and cifsacl mount options
      908b852d
    • WANG Cong's avatar
      tap: convert a mutex to a spinlock · ffa423fb
      WANG Cong authored
      We are not allowed to block on the RCU reader side, so can't
      just hold the mutex as before. As a quick fix, convert it to
      a spinlock.
      
      Fixes: d9f1f61c ("tap: Extending tap device create/destroy APIs")
      Reported-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
      Tested-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
      Cc: Sainath Grandhi <sainath.grandhi@intel.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ffa423fb
    • Guilherme G. Piccoli's avatar
      cxgb4: fix BUG() on interrupt deallocating path of ULD · 6a146f3a
      Guilherme G. Piccoli authored
      Since the introduction of ULD (Upper-Layer Drivers), the MSI-X
      deallocating path changed in cxgb4: the driver frees the interrupts
      of ULD when unregistering it or on shutdown PCI handler.
      
      Problem is that if a MSI-X is not freed before deallocated in the PCI
      layer, it will trigger a BUG() due to still "alive" interrupt being
      tentatively quiesced.
      
      The below trace was observed when doing a simple unbind of Chelsio's
      adapter PCI function, like:
        "echo 001e:80:00.4 > /sys/bus/pci/drivers/cxgb4/unbind"
      
      Trace:
      
        kernel BUG at drivers/pci/msi.c:352!
        Oops: Exception in kernel mode, sig: 5 [#1]
        ...
        NIP [c0000000005a5e60] free_msi_irqs+0xa0/0x250
        LR [c0000000005a5e50] free_msi_irqs+0x90/0x250
        Call Trace:
        [c0000000005a5e50] free_msi_irqs+0x90/0x250 (unreliable)
        [c0000000005a72c4] pci_disable_msix+0x124/0x180
        [d000000011e06708] disable_msi+0x88/0xb0 [cxgb4]
        [d000000011e06948] free_some_resources+0xa8/0x160 [cxgb4]
        [d000000011e06d60] remove_one+0x170/0x3c0 [cxgb4]
        [c00000000058a910] pci_device_remove+0x70/0x110
        [c00000000064ef04] device_release_driver_internal+0x1f4/0x2c0
        ...
      
      This patch fixes the issue by refactoring the shutdown path of ULD on
      cxgb4 driver, by properly freeing and disabling interrupts on PCI
      remove handler too.
      
      Fixes: 0fbc81b3 ("Allocate resources dynamically for all cxgb4 ULD's")
      Reported-by: default avatarHarsha Thyagaraja <hathyaga@in.ibm.com>
      Signed-off-by: default avatarGuilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6a146f3a