1. 07 Aug, 2015 10 commits
  2. 04 Aug, 2015 2 commits
  3. 03 Aug, 2015 7 commits
  4. 01 Aug, 2015 3 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 7c764cec
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Must teardown SR-IOV before unregistering netdev in igb driver, from
          Alex Williamson.
      
       2) Fix ipv6 route unreachable crash in IPVS, from Alex Gartrell.
      
       3) Default route selection in ipv4 should take the prefix length, table
          ID, and TOS into account, from Julian Anastasov.
      
       4) sch_plug must have a reset method in order to purge all buffered
          packets when the qdisc is reset, likewise for sch_choke, from WANG
          Cong.
      
       5) Fix deadlock and races in slave_changelink/br_setport in bridging.
          From Nikolay Aleksandrov.
      
       6) mlx4 bug fixes (wrong index in port even propagation to VFs,
          overzealous BUG_ON assertion, etc.) from Ido Shamay, Jack
          Morgenstein, and Or Gerlitz.
      
       7) Turn off klog message about SCTP userspace interface compat that
          makes no sense at all, from Daniel Borkmann.
      
       8) Fix unbounded restarts of inet frag eviction process, causing NMI
          watchdog soft lockup messages, from Florian Westphal.
      
       9) Suspend/resume fixes for r8152 from Hayes Wang.
      
      10) Fix busy loop when MSG_WAITALL|MSG_PEEK is used in TCP recv, from
          Sabrina Dubroca.
      
      11) Fix performance regression when removing a lot of routes from the
          ipv4 routing tables, from Alexander Duyck.
      
      12) Fix device leak in AF_PACKET, from Lars Westerhoff.
      
      13) AF_PACKET also has a header length comparison bug due to signedness,
          from Alexander Drozdov.
      
      14) Fix bug in EBPF tail call generation on x86, from Daniel Borkmann.
      
      15) Memory leaks, TSO stats, watchdog timeout and other fixes to
          thunderx driver from Sunil Goutham and Thanneeru Srinivasulu.
      
      16) act_bpf can leak memory when replacing programs, from Daniel
          Borkmann.
      
      17) WOL packet fixes in gianfar driver, from Claudiu Manoil.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (79 commits)
        stmmac: fix missing MODULE_LICENSE in stmmac_platform
        gianfar: Enable device wakeup when appropriate
        gianfar: Fix suspend/resume for wol magic packet
        gianfar: Fix warning when CONFIG_PM off
        act_pedit: check binding before calling tcf_hash_release()
        net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket
        net: sched: fix refcount imbalance in actions
        r8152: reset device when tx timeout
        r8152: add pre_reset and post_reset
        qlcnic: Fix corruption while copying
        act_bpf: fix memory leaks when replacing bpf programs
        net: thunderx: Fix for crash while BGX teardown
        net: thunderx: Add PCI driver shutdown routine
        net: thunderx: Fix crash when changing rss with mutliple traffic flows
        net: thunderx: Set watchdog timeout value
        net: thunderx: Wakeup TXQ only if CQE_TX are processed
        net: thunderx: Suppress alloc_pages() failure warnings
        net: thunderx: Fix TSO packet statistic
        net: thunderx: Fix memory leak when changing queue count
        net: thunderx: Fix RQ_DROP miscalculation
        ...
      7c764cec
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · acea568f
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "Filipe fixed up a hard to trigger ENOSPC regression from our merge
        window pull, and we have a few other smaller fixes"
      
      * 'for-linus-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: fix quick exhaustion of the system array in the superblock
        btrfs: its btrfs_err() instead of btrfs_error()
        btrfs: Avoid NULL pointer dereference of free_extent_buffer when read_tree_block() fail
        btrfs: Fix lockdep warning of btrfs_run_delayed_iputs()
      acea568f
    • Linus Torvalds's avatar
      Merge tag 'sound-4.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · c6fd4fc7
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This became a relative big update as it includes the collected ASoC
        fixes.  There are a few fixes in ASoC core side, mostly for DAPM and
        the new topology API.  The rest are various ASoC driver-specific
        fixes, as well as the usual HD-audio and USB-audio quirks"
      
      * tag 'sound-4.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (29 commits)
        ALSA: hda - Fix MacBook Pro 5,2 quirk
        ALSA: hda - Fix race between PM ops and HDA init/probe
        ALSA: usb-audio: add dB range mapping for some devices
        ALSA: hda - Apply a fixup to Dell Vostro 5480
        ALSA: hda - Add pin quirk for the headset mic jack detection on Dell laptop
        ALSA: hda - Apply fixup for another Toshiba Satellite S50D
        ALSA: fireworks: add support for AudioFire2 quirk
        ALSA: hda - Fix the headset mic that will not work on Dell desktop machine
        ALSA: hda - fix cs4210_spdif_automute()
        ASoC: pcm1681: Fix setting de-emphasis sampling rate selection
        ASoC: ssm4567: Keep TDM_BCLKS in ssm4567_set_dai_fmt
        ASoC: sgtl5000: Fix up define for SGTL5000_SMALL_POP
        ASoC: dapm: Don't add prefix to widget stream name
        ASoC: rt5645: Check if codec is initialized in workqueue handler
        ASoC: Intel: Get correct usage_count value to load firmware
        ASoC: topology: Fix to add dapm mixer info
        ASoC: zx: spdif: Fix devm_ioremap_resource return value check
        ASoC: zx: i2s: Fix devm_ioremap_resource return value check
        ASoC: mediatek: Use platform_of_node for machine drivers
        ASoC: Free card DAPM context on snd_soc_instantiate_card() error path
        ...
      c6fd4fc7
  5. 31 Jul, 2015 15 commits
    • Joachim Eastwood's avatar
      stmmac: fix missing MODULE_LICENSE in stmmac_platform · ea111545
      Joachim Eastwood authored
      Commit 50649ab1 ("stmmac: drop driver from stmmac platform code")
      was a bit overzealous in removing code and dropped the MODULE_*
      macro's that are still needed since stmmac_platform can be a module.
      Fix this by putting the macro's remvoed in 50649ab1 back.
      
      This fixes the following errors when used as a module:
        stmmac_platform: module license 'unspecified' taints kernel.
        Disabling lock debugging due to kernel taint
        stmmac_platform: Unknown symbol devm_kmalloc (err 0)
        stmmac_platform: Unknown symbol stmmac_suspend (err 0)
        stmmac_platform: Unknown symbol platform_get_irq_byname (err 0)
        stmmac_platform: Unknown symbol stmmac_dvr_remove (err 0)
        stmmac_platform: Unknown symbol platform_get_resource (err 0)
        stmmac_platform: Unknown symbol of_get_phy_mode (err 0)
        stmmac_platform: Unknown symbol of_property_read_u32_array (err 0)
        stmmac_platform: Unknown symbol of_alias_get_id (err 0)
        stmmac_platform: Unknown symbol stmmac_resume (err 0)
        stmmac_platform: Unknown symbol stmmac_dvr_probe (err 0)
      
      Fixes: 50649ab1 ("stmmac: drop driver from stmmac platform code")
      Reported-by: default avatarIgor Gnatenko <i.gnatenko.brain@gmail.com>
      Signed-off-by: default avatarJoachim Eastwood <manabian@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ea111545
    • David S. Miller's avatar
      Merge branch 'gianfar-wol-fixes' · ef1f4364
      David S. Miller authored
      Claudiu Manoil says:
      
      ====================
      gianfar: wol magic packet fixes
      
      These changes were already validated as part of FSL SDK.
      Patch 2 fixes occasional wake-on magic packet failures during
      traffic, probably due to incorrect traffic stop/ device halt
      sequence and incorrect usage of txlock.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ef1f4364
    • Claudiu Manoil's avatar
      gianfar: Enable device wakeup when appropriate · b0734b6d
      Claudiu Manoil authored
      The wol_en flag is 0 by default anyway, and we have the
      following inconsistency: a MAGIC packet wol capable eth
      interface is registered as a wake-up source but unable
      to wake-up the system as wol_en is 0 (wake-on flag set to 'd').
      Calling set_wakeup_enable() at netdev open is just redundant
      because wol_en is 0 by default.
      Let only ethtool call set_wakeup_enable() for now.
      
      The bflock is obviously obsoleted, its utility has been corroded
      over time.  The bitfield flags used today in gianfar are accessed
      only on the init/ config path, with no real possibility of
      concurrency - nothing that would justify smth. like bflock.
      Signed-off-by: default avatarClaudiu Manoil <claudiu.manoil@freescale.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b0734b6d
    • Claudiu Manoil's avatar
      gianfar: Fix suspend/resume for wol magic packet · 614b4242
      Claudiu Manoil authored
      If we disable NAPI in the first place we can mask the device's
      interrupts (and halt it) without fearing that imask may be
      concurrently accessed from interrupt context, so there's
      no need to do local_irq_save() around gfar_halt_nodisable().
      lock_rx_qs()/unlock_tx_qs() are just obsoleted and potentially
      buggy routines.  The txlock is currently used in the driver only
      to manage TX congestion, it has nothing to do with halting the
      device.  With these changes, the TX processing is stopped before
      gfar_halt().
      
      Compact gfar_halt() is used instead of gfar_halt_nodisable(),
      as it disables Rx/TX DMA h/w blocks and the Rx/TX h/w queues.
      gfar_start() re-enables all these blocks on resume.  Enabling
      the magic-packet mode remains the same, note that the RX block
      is re-enabled just before entering sleep mode.
      
      Add IRQF_NO_SUSPEND flag for the error interrupt line, to signal
      that the interrupt line must remain active during sleep in order
      to wake the system by magic packet (MAG) reception interrupt.
      (On some systems the MAG interrupt did trigger w/o this flag
      as well, but on others it didn't.)
      
      Without these fixes, when suspended during fair Tx traffic the
      interface occasionally failed to be woken up by magic packet.
      Signed-off-by: default avatarClaudiu Manoil <claudiu.manoil@freescale.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      614b4242
    • Claudiu Manoil's avatar
      gianfar: Fix warning when CONFIG_PM off · 84868305
      Claudiu Manoil authored
      CC      drivers/net/ethernet/freescale/gianfar.o
      drivers/net/ethernet/freescale/gianfar.c:568:13: warning: 'lock_tx_qs'
      defined but not used [-Wunused-function]
       static void lock_tx_qs(struct gfar_private *priv)
                   ^
      drivers/net/ethernet/freescale/gianfar.c:576:13: warning: 'unlock_tx_qs'
      defined but not used [-Wunused-function]
       static void unlock_tx_qs(struct gfar_private *priv)
                   ^
      Reported-by: default avatarScott Wood <scottwood@freescale.com>
      Signed-off-by: default avatarClaudiu Manoil <claudiu.manoil@freescale.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      84868305
    • WANG Cong's avatar
      act_pedit: check binding before calling tcf_hash_release() · 5175f710
      WANG Cong authored
      When we share an action within a filter, the bind refcnt
      should increase, therefore we should not call tcf_hash_release().
      
      Fixes: 1a29321e ("net_sched: act: Dont increment refcnt on replace")
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Daniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarCong Wang <cwang@twopensource.com>
      Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5175f710
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 5e49e0be
      Linus Torvalds authored
      Pull IOMMU fixes from Joerg Roedel:
       "These fixes are all for the AMD IOMMU driver:
      
         - A regression with HSA caused by the conversion of the driver to
           default domains.  The fixes make sure that an HSA device can still
           be attached to an IOMMUv2 domain and that these domains also allow
           non-IOMMUv2 capable devices.
      
         - Fix iommu=pt mode which did not work because the dma_ops where set
           to nommu_ops, which breaks devices that can only do 32bit DMA.
      
         - Fix an issue with non-PCI devices not working, because there are no
           dma_ops for them.  This issue was discovered recently as new AMD
           x86 platforms have non-PCI devices too"
      
      * tag 'iommu-fixes-v4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        iommu/amd: Allow non-ATS devices in IOMMUv2 domains
        iommu/amd: Set global dma_ops if swiotlb is disabled
        iommu/amd: Use swiotlb in passthrough mode
        iommu/amd: Allow non-IOMMUv2 devices in IOMMUv2 domains
        iommu/amd: Use iommu core for passthrough mode
        iommu/amd: Use iommu_attach_group()
      5e49e0be
    • Linus Torvalds's avatar
      Merge tag 'drm-intel-fixes-2015-07-31' of git://anongit.freedesktop.org/drm-intel · 23ff9e19
      Linus Torvalds authored
      Pull drm intel fixes from Daniel Vetter:
       "I delayed my -fixes pull a bit hoping that I could include a fix for
        the dp mst stuff but looks a bit more nasty than that.  So just 3
        other regression fixes, one 4.2 other two cc: stable"
      
      * tag 'drm-intel-fixes-2015-07-31' of git://anongit.freedesktop.org/drm-intel:
        drm/i915: Declare the swizzling unknown for L-shaped configurations
        drm/i915: Mark PIN_USER binding as GLOBAL_BIND without the aliasing ppgtt
        drm/i915: Replace WARN inside I915_READ64_2x32 with retry loop
      23ff9e19
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · fd56d1d6
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This has a bunch of nouveau fixes, as Ben has been hibernating and has
        lots of small fixes for lots of bugs across nouveau.
      
        Radeon has one major fix for hdmi/dp audio regression that is larger
        than Alex would like, but seems to fix up a fair few bugs, along with
        some misc fixes.
      
        And a few msm fixes, one of which is also a bit large.
      
        But nothing in here seems insane or crazy for this stage, just more
        than I'd like"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (33 commits)
        drm/msm/mdp5: release SMB (shared memory blocks) in various cases
        drm/msm: change to uninterruptible wait in atomic commit
        drm/msm: mdp4: Fix drm_framebuffer dereference crash
        drm/msm: fix msm_gem_prime_get_sg_table()
        drm/amdgpu: add new parameter to seperate map and unmap
        drm/amdgpu: hdp_flush is not needed for inside IB
        drm/amdgpu: different emit_ib for gfx and compute
        drm/amdgpu: information leak in amdgpu_info_ioctl()
        drm/amdgpu: clean up init sequence for failures
        drm/radeon/combios: add some validation of lvds values
        drm/radeon: rework audio modeset to handle non-audio hdmi features
        drm/radeon: rework audio detect (v4)
        drm/amdgpu: Drop drm/ prefix for including drm.h in amdgpu_drm.h
        drm/radeon: Drop drm/ prefix for including drm.h in radeon_drm.h
        drm/nouveau/nouveau/ttm: fix tiled system memory with Maxwell
        drm/nouveau/kms/nv50-: guard against enabling cursor on disabled heads
        drm/nouveau/fbcon/g80: reduce PUSH_SPACE alloc, fire ring on accel init
        drm/nouveau/fbcon/gf100-: reduce RING_SPACE allocation
        drm/nouveau/fbcon/nv11-: correctly account for ring space usage
        drm/nouveau/bios: add proper support for opcode 0x59
        ...
      fd56d1d6
    • Joerg Roedel's avatar
      iommu/amd: Allow non-ATS devices in IOMMUv2 domains · 1c1cc454
      Joerg Roedel authored
      With the grouping of multi-function devices a non-ATS
      capable device might also end up in the same domain as an
      IOMMUv2 capable device.
      So handle this situation gracefully and don't consider it a
      bug anymore.
      Tested-by: default avatarOded Gabbay <oded.gabbay@gmail.com>
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      1c1cc454
    • Luis Felipe Dominguez Vega's avatar
      rtlwifi: Fix NULL dereference when PCI driver used as an AP · 7c629401
      Luis Felipe Dominguez Vega authored
      In commit 33511b15 ("rtlwifi: add support to
      send beacon frame"), the mechanism for sending beacons was established. That
      patch works correctly for rtl8192cu, but there is a possibility of getting
      the following warnings in the PCI drivers:
      
      WARNING: CPU: 1 PID: 2439 at net/mac80211/driver-ops.h:12
      ieee80211_bss_info_change_notify+0x179/0x1d0 [mac80211]()
      wlp5s0:  Failed check-sdata-in-driver check, flags: 0x0
      
      The warning is followed by a NULL pointer dereference as follows:
      
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000006
      IP: [<ffffffffc073998e>] rtl_get_tcb_desc+0x5e/0x760 [rtlwifi]
      
      This problem was reported at http://thread.gmane.org/gmane.linux.kernel.wireless.general/138645,
      but no solution was found at that time.
      
      The problem was also reported at https://bugzilla.kernel.org/show_bug.cgi?id=9744
      and this solution was developed and tested there.
      
      The USB driver works with a NULL final argument in the adapter_tx() callback;
      however, the PCI drivers need a struct rtl_tcb_desc in that position.
      
      Fixes: 33511b15 ("rtlwifi: add support to send beacon frame.")
      Signed-off-by: default avatarLuis Felipe Dominguez Vega <lfdominguez@nauta.cu>
      Signed-off-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
      Cc: Stable <stable@vger.kernel.org> [3.19+]
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      7c629401
    • Hauke Mehrtens's avatar
      b43: fix extpa_gain check for 2GHz · 098697db
      Hauke Mehrtens authored
      On the 2GHz and and on the 5GHZ band only the extpa_gain setting from
      the 5GHz band was checked. this patch makes it check the property from
      the correct band.
      Signed-off-by: default avatarHauke Mehrtens <hauke@hauke-m.de>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      098697db
    • Mike Looijmans's avatar
      rsi: Fix failure to load firmware after memory leak fix and fix the leak · 5d5cd85f
      Mike Looijmans authored
      Fixes commit eae79b4f ("rsi: fix memory leak in rsi_load_ta_instructions()")
      which stopped the driver from functioning.
      
      Firmware data has been allocated using vmalloc(), resulting in memory
      that cannot be used for DMA. Hence the firmware was first copied to a
      buffer allocated with kmalloc() in the original code. This patch reverts
      the commit and only calls "kfree()" to release the buffer after sending
      the data. This fixes the memory leak without breaking the driver.
      
      Add a comment to the kmemdup() calls to explain why this is done, and abort
      if memory allocation fails.
      
      Tested on a Topic Miami-Florida board which contains the rsi SDIO chip.
      
      Also added the same kfree() call to the USB glue driver. This was not
      tested on actual hardware though, as I only have the SDIO version.
      
      Fixes: eae79b4f ("rsi: fix memory leak in rsi_load_ta_instructions()")
      Signed-off-by: default avatarMike Looijmans <mike.looijmans@topic.nl>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      5d5cd85f
    • Kalle Valo's avatar
      Merge tag 'iwlwifi-for-kalle-2015-07-30' of... · f7c0af82
      Kalle Valo authored
      Merge tag 'iwlwifi-for-kalle-2015-07-30' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes
      
      * a fix for the stuck TFD queue mechanism - it was producing
        noisy false alarms.
      * a fix for the NIC prepare flow that prevented the driver
        from being able to access the device on certain systems.
      * a fix for the scan prority handling which allows the
        regular scan to run even if a scheduled scan is already
        running.
      f7c0af82
    • Linus Torvalds's avatar
      Merge tag 'xfs-for-linus-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs · 84009357
      Linus Torvalds authored
      Pull xfs fixes from Dave Chinner:
       "There are a couple of recently found, long standing remote attribute
        corruption fixes caused by log recovery getting confused after a
        crash, and the new DAX code in XFS (merged in 4.2-rc1) needs to
        actually use the DAX fault path on read faults.
      
        Summary:
      
         - remote attribute log recovery corruption fixes
      
         - DAX page faults need to use direct mappings, not a page cache
           mapping"
      
      * tag 'xfs-for-linus-4.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs:
        xfs: remote attributes need to be considered data
        xfs: remote attribute headers contain an invalid LSN
        xfs: call dax_fault on read page faults for DAX
      84009357
  6. 30 Jul, 2015 3 commits
    • Sowmini Varadhan's avatar
      net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket · 8a681736
      Sowmini Varadhan authored
      The newsk returned by sk_clone_lock should hold a get_net()
      reference if, and only if, the parent is not a kernel socket
      (making this similar to sk_alloc()).
      
      E.g,. for the SYN_RECV path, tcp_v4_syn_recv_sock->..inet_csk_clone_lock
      sets up the syn_recv newsk from sk_clone_lock. When the parent (listen)
      socket is a kernel socket (defined in sk_alloc() as having
      sk_net_refcnt == 0), then the newsk should also have a 0 sk_net_refcnt
      and should not hold a get_net() reference.
      
      Fixes: 26abe143 ("net: Modify sk_alloc to not reference count the
            netns of kernel sockets.")
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Eric W. Biederman <ebiederm@xmission.com>
      Signed-off-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8a681736
    • Daniel Borkmann's avatar
      net: sched: fix refcount imbalance in actions · 28e6b67f
      Daniel Borkmann authored
      Since commit 55334a5d ("net_sched: act: refuse to remove bound action
      outside"), we end up with a wrong reference count for a tc action.
      
      Test case 1:
      
        FOO="1,6 0 0 4294967295,"
        BAR="1,6 0 0 4294967294,"
        tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 \
           action bpf bytecode "$FOO"
        tc actions show action bpf
          action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
          index 1 ref 1 bind 1
        tc actions replace action bpf bytecode "$BAR" index 1
        tc actions show action bpf
          action order 0: bpf bytecode '1,6 0 0 4294967294' default-action pipe
          index 1 ref 2 bind 1
        tc actions replace action bpf bytecode "$FOO" index 1
        tc actions show action bpf
          action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe
          index 1 ref 3 bind 1
      
      Test case 2:
      
        FOO="1,6 0 0 4294967295,"
        tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok
        tc actions show action gact
          action order 0: gact action pass
          random type none pass val 0
           index 1 ref 1 bind 1
        tc actions add action drop index 1
          RTNETLINK answers: File exists [...]
        tc actions show action gact
          action order 0: gact action pass
           random type none pass val 0
           index 1 ref 2 bind 1
        tc actions add action drop index 1
          RTNETLINK answers: File exists [...]
        tc actions show action gact
          action order 0: gact action pass
           random type none pass val 0
           index 1 ref 3 bind 1
      
      What happens is that in tcf_hash_check(), we check tcf_common for a given
      index and increase tcfc_refcnt and conditionally tcfc_bindcnt when we've
      found an existing action. Now there are the following cases:
      
        1) We do a late binding of an action. In that case, we leave the
           tcfc_refcnt/tcfc_bindcnt increased and are done with the ->init()
           handler. This is correctly handeled.
      
        2) We replace the given action, or we try to add one without replacing
           and find out that the action at a specific index already exists
           (thus, we go out with error in that case).
      
      In case of 2), we have to undo the reference count increase from
      tcf_hash_check() in the tcf_hash_check() function. Currently, we fail to
      do so because of the 'tcfc_bindcnt > 0' check which bails out early with
      an -EPERM error.
      
      Now, while commit 55334a5d prevents 'tc actions del action ...' on an
      already classifier-bound action to drop the reference count (which could
      then become negative, wrap around etc), this restriction only accounts for
      invocations outside a specific action's ->init() handler.
      
      One possible solution would be to add a flag thus we possibly trigger
      the -EPERM ony in situations where it is indeed relevant.
      
      After the patch, above test cases have correct reference count again.
      
      Fixes: 55334a5d ("net_sched: act: refuse to remove bound action outside")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Reviewed-by: default avatarCong Wang <cwang@twopensource.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      28e6b67f
    • David S. Miller's avatar
      Merge branch 'r8152-fixes' · 990c9b34
      David S. Miller authored
      Hayes Wang says:
      
      ====================
      r8152: device reset
      
      v3:
      For patch #2, remove cancel_delayed_work().
      
      v2:
      For patch #1, remove usb_autopm_get_interface(), usb_autopm_put_interface(), and
      the checking of intf->condition.
      
      For patch #2, replace the original method with usb_queue_reset_device() to reset
      the device.
      
      v1:
      Although the driver works normally, we find the device may get all 0xff data when
      transmitting packets on certain platforms. It would break the device and no packet
      could be transmitted. The reset is necessary to recover the hw for this situation.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      990c9b34