1. 16 Jan, 2017 15 commits
    • Basil Gunn's avatar
      ax25: Fix segfault after sock connection timeout · 8a367e74
      Basil Gunn authored
      The ax.25 socket connection timed out & the sock struct has been
      previously taken down ie. sock struct is now a NULL pointer. Checking
      the sock_flag causes the segfault.  Check if the socket struct pointer
      is NULL before checking sock_flag. This segfault is seen in
      timed out netrom connections.
      
      Please submit to -stable.
      Signed-off-by: default avatarBasil Gunn <basil@pacabunga.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8a367e74
    • Daniel Borkmann's avatar
      bpf: rework prog_digest into prog_tag · f1f7714e
      Daniel Borkmann authored
      Commit 7bd509e3 ("bpf: add prog_digest and expose it via
      fdinfo/netlink") was recently discussed, partially due to
      admittedly suboptimal name of "prog_digest" in combination
      with sha1 hash usage, thus inevitably and rightfully concerns
      about its security in terms of collision resistance were
      raised with regards to use-cases.
      
      The intended use cases are for debugging resp. introspection
      only for providing a stable "tag" over the instruction sequence
      that both kernel and user space can calculate independently.
      It's not usable at all for making a security relevant decision.
      So collisions where two different instruction sequences generate
      the same tag can happen, but ideally at a rather low rate. The
      "tag" will be dumped in hex and is short enough to introspect
      in tracepoints or kallsyms output along with other data such
      as stack trace, etc. Thus, this patch performs a rename into
      prog_tag and truncates the tag to a short output (64 bits) to
      make it obvious it's not collision-free.
      
      Should in future a hash or facility be needed with a security
      relevant focus, then we can think about requirements, constraints,
      etc that would fit to that situation. For now, rework the exposed
      parts for the current use cases as long as nothing has been
      released yet. Tested on x86_64 and s390x.
      
      Fixes: 7bd509e3 ("bpf: add prog_digest and expose it via fdinfo/netlink")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f1f7714e
    • Parthasarathy Bhuvaragan's avatar
      tipc: allocate user memory with GFP_KERNEL flag · 57d5f64d
      Parthasarathy Bhuvaragan authored
      Until now, we allocate memory always with GFP_ATOMIC flag.
      When the system is under memory pressure and a user tries to send,
      the send fails due to low memory. However, the user application
      can wait for free memory if we allocate it using GFP_KERNEL flag.
      
      In this commit, we use allocate memory with GFP_KERNEL for all user
      allocation.
      Reported-by: default avatarRune Torgersen <runet@innovsys.com>
      Acked-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarParthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      57d5f64d
    • Karicheri, Muralidharan's avatar
      net: phy: dp83867: allow RGMII_TXID/RGMII_RXID interface types · 34c55cf2
      Karicheri, Muralidharan authored
      Currently dp83867 driver returns error if phy interface type
      PHY_INTERFACE_MODE_RGMII_RXID is used to set the rx only internal
      delay. Similarly issue happens for PHY_INTERFACE_MODE_RGMII_TXID.
      Fix this by checking also the interface type if a particular delay
      value is missing in the phy dt bindings. Also update the DT document
      accordingly.
      Signed-off-by: default avatarMurali Karicheri <m-karicheri2@ti.com>
      Signed-off-by: default avatarSekhar Nori <nsekhar@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      34c55cf2
    • Jakub Sitnicki's avatar
      ip6_tunnel: Account for tunnel header in tunnel MTU · 02ca0423
      Jakub Sitnicki authored
      With ip6gre we have a tunnel header which also makes the tunnel MTU
      smaller. We need to reserve room for it. Previously we were using up
      space reserved for the Tunnel Encapsulation Limit option
      header (RFC 2473).
      
      Also, after commit b05229f4 ("gre6: Cleanup GREv6 transmit path,
      call common GRE functions") our contract with the caller has
      changed. Now we check if the packet length exceeds the tunnel MTU after
      the tunnel header has been pushed, unlike before.
      
      This is reflected in the check where we look at the packet length minus
      the size of the tunnel header, which is already accounted for in tunnel
      MTU.
      
      Fixes: b05229f4 ("gre6: Cleanup GREv6 transmit path, call common GRE functions")
      Signed-off-by: default avatarJakub Sitnicki <jkbs@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      02ca0423
    • Hangbin Liu's avatar
      mld: do not remove mld souce list info when set link down · 1666d49e
      Hangbin Liu authored
      This is an IPv6 version of commit 24803f38 ("igmp: do not remove igmp
      souce list..."). In mld_del_delrec(), we will restore back all source filter
      info instead of flush them.
      
      Move mld_clear_delrec() from ipv6_mc_down() to ipv6_mc_destroy_dev() since
      we should not remove source list info when set link down. Remove
      igmp6_group_dropped() in ipv6_mc_destroy_dev() since we have called it in
      ipv6_mc_down().
      
      Also clear all source info after igmp6_group_dropped() instead of in it
      because ipv6_mc_down() will call igmp6_group_dropped().
      Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1666d49e
    • Ivan Vecera's avatar
      be2net: fix MAC addr setting on privileged BE3 VFs · 34393529
      Ivan Vecera authored
      During interface opening MAC address stored in netdev->dev_addr is
      programmed in the HW with exception of BE3 VFs where the initial
      MAC is programmed by parent PF. This is OK when MAC address is not
      changed when an interfaces is down. In this case the requested MAC is
      stored to netdev->dev_addr and later is stored into HW during opening.
      But this is not done for all BE3 VFs so the NIC HW does not know
      anything about this change and all traffic is filtered.
      
      This is the case of bonding if fail_over_mac == 0 where the MACs of
      the slaves are changed while they are down.
      
      The be2net behavior is too restrictive because if a BE3 VF has
      the FILTMGMT privilege then it is able to modify its MAC without
      any restriction.
      
      To solve the described problem the driver should take care about these
      privileged BE3 VFs so the MAC is programmed during opening. And by
      contrast unpriviled BE3 VFs should not be allowed to change its MAC
      in any case.
      
      Cc: Sathya Perla <sathya.perla@broadcom.com>
      Cc: Ajit Khaparde <ajit.khaparde@broadcom.com>
      Cc: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
      Cc: Somnath Kotur <somnath.kotur@broadcom.com>
      Signed-off-by: default avatarIvan Vecera <cera@cera.cz>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      34393529
    • Ivan Vecera's avatar
      be2net: don't delete MAC on close on unprivileged BE3 VFs · 6d928ae5
      Ivan Vecera authored
      BE3 VFs without FILTMGMT privilege are not allowed to modify its MAC,
      VLAN table and UC/MC lists. So don't try to delete MAC on such VFs.
      
      Cc: Sathya Perla <sathya.perla@broadcom.com>
      Cc: Ajit Khaparde <ajit.khaparde@broadcom.com>
      Cc: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
      Cc: Somnath Kotur <somnath.kotur@broadcom.com>
      Signed-off-by: default avatarIvan Vecera <cera@cera.cz>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6d928ae5
    • Ivan Vecera's avatar
      be2net: fix status check in be_cmd_pmac_add() · fe68d8bf
      Ivan Vecera authored
      Return value from be_mcc_notify_wait() contains a base completion status
      together with an additional status. The base_status() macro need to be
      used to access base status.
      
      Fixes: e3a7ae2c be2net: Changing MAC Address of a VF was broken
      Cc: Sathya Perla <sathya.perla@broadcom.com>
      Cc: Ajit Khaparde <ajit.khaparde@broadcom.com>
      Cc: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
      Cc: Somnath Kotur <somnath.kotur@broadcom.com>
      Signed-off-by: default avatarIvan Vecera <cera@cera.cz>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fe68d8bf
    • Arnd Bergmann's avatar
      cpmac: remove hopeless #warning · d43e6fb4
      Arnd Bergmann authored
      The #warning was present 10 years ago when the driver first got merged.
      As the platform is rather obsolete by now, it seems very unlikely that
      the warning will cause anyone to fix the code properly.
      
      kernelci.org reports the warning for every build in the meantime, so
      I think it's better to just turn it into a code comment to reduce
      noise.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d43e6fb4
    • Masaru Nagai's avatar
      ravb: do not use zero-length alignment DMA descriptor · 8ec3e8a1
      Masaru Nagai authored
      Due to alignment requirements of the hardware transmissions are split into
      two DMA descriptors, a small padding descriptor of 0 - 3 bytes in length
      followed by a descriptor for rest of the packet.
      
      In the case of IP packets the first descriptor will never be zero due to
      the way that the stack aligns buffers for IP packets. However, for non-IP
      packets it may be zero.
      
      In that case it has been reported that timeouts occur, presumably because
      transmission stops at the first zero-length DMA descriptor and thus the
      packet is not transmitted. However, in my environment a BUG is triggered as
      follows:
      
      [   20.381417] ------------[ cut here ]------------
      [   20.386054] kernel BUG at lib/swiotlb.c:495!
      [   20.390324] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
      [   20.395805] Modules linked in:
      [   20.398862] CPU: 0 PID: 2089 Comm: mz Not tainted 4.10.0-rc3-00001-gf13ad2db193f #162
      [   20.406689] Hardware name: Renesas Salvator-X board based on r8a7796 (DT)
      [   20.413474] task: ffff80063b1f1900 task.stack: ffff80063a71c000
      [   20.419404] PC is at swiotlb_tbl_map_single+0x178/0x2ec
      [   20.424625] LR is at map_single+0x4c/0x98
      [   20.428629] pc : [<ffff00000839c4c0>] lr : [<ffff00000839c680>] pstate: 800001c5
      [   20.436019] sp : ffff80063a71f9b0
      [   20.439327] x29: ffff80063a71f9b0 x28: ffff80063a20d500
      [   20.444636] x27: ffff000008ed5000 x26: 0000000000000000
      [   20.449944] x25: 000000067abe2adc x24: 0000000000000000
      [   20.455252] x23: 0000000000200000 x22: 0000000000000001
      [   20.460559] x21: 0000000000175ffe x20: ffff80063b2a0010
      [   20.465866] x19: 0000000000000000 x18: 0000ffffcae6fb20
      [   20.471173] x17: 0000ffffa09ba018 x16: ffff0000087c8b70
      [   20.476480] x15: 0000ffffa084f588 x14: 0000ffffa09cfa14
      [   20.481787] x13: 0000ffffcae87ff0 x12: 000000000063abe2
      [   20.487098] x11: ffff000008096360 x10: ffff80063abe2adc
      [   20.492407] x9 : 0000000000000000 x8 : 0000000000000000
      [   20.497718] x7 : 0000000000000000 x6 : ffff000008ed50d0
      [   20.503028] x5 : 0000000000000000 x4 : 0000000000000001
      [   20.508338] x3 : 0000000000000000 x2 : 000000067abe2adc
      [   20.513648] x1 : 00000000bafff000 x0 : 0000000000000000
      [   20.518958]
      [   20.520446] Process mz (pid: 2089, stack limit = 0xffff80063a71c000)
      [   20.526798] Stack: (0xffff80063a71f9b0 to 0xffff80063a720000)
      [   20.532543] f9a0:                                   ffff80063a71fa30 ffff00000839c680
      [   20.540374] f9c0: ffff80063b2a0010 ffff80063b2a0010 0000000000000001 0000000000000000
      [   20.548204] f9e0: 000000000000006e ffff80063b23c000 ffff80063b23c000 0000000000000000
      [   20.556034] fa00: ffff80063b23c000 ffff80063a20d500 000000013b1f1900 0000000000000000
      [   20.563864] fa20: ffff80063ffd18e0 ffff80063b2a0010 ffff80063a71fa60 ffff00000839cd10
      [   20.571694] fa40: ffff80063b2a0010 0000000000000000 ffff80063ffd18e0 000000067abe2adc
      [   20.579524] fa60: ffff80063a71fa90 ffff000008096380 ffff80063b2a0010 0000000000000000
      [   20.587353] fa80: 0000000000000000 0000000000000001 ffff80063a71fac0 ffff00000864f770
      [   20.595184] faa0: ffff80063b23caf0 0000000000000000 0000000000000000 0000000000000140
      [   20.603014] fac0: ffff80063a71fb60 ffff0000087e6498 ffff80063a20d500 ffff80063b23c000
      [   20.610843] fae0: 0000000000000000 ffff000008daeaf0 0000000000000000 ffff000008daeb00
      [   20.618673] fb00: ffff80063a71fc0c ffff000008da7000 ffff80063b23c090 ffff80063a44f000
      [   20.626503] fb20: 0000000000000000 ffff000008daeb00 ffff80063a71fc0c ffff000008da7000
      [   20.634333] fb40: ffff80063b23c090 0000000000000000 ffff800600000037 ffff0000087e63d8
      [   20.642163] fb60: ffff80063a71fbc0 ffff000008807510 ffff80063a692400 ffff80063a20d500
      [   20.649993] fb80: ffff80063a44f000 ffff80063b23c000 ffff80063a69249c 0000000000000000
      [   20.657823] fba0: 0000000000000000 ffff80063a087800 ffff80063b23c000 ffff80063a20d500
      [   20.665653] fbc0: ffff80063a71fc10 ffff0000087e67dc ffff80063a20d500 ffff80063a692400
      [   20.673483] fbe0: ffff80063b23c000 0000000000000000 ffff80063a44f000 ffff80063a69249c
      [   20.681312] fc00: ffff80063a5f1a10 000000103a087800 ffff80063a71fc70 ffff0000087e6b24
      [   20.689142] fc20: ffff80063a5f1a80 ffff80063a71fde8 000000000000000f 00000000000005ea
      [   20.696972] fc40: ffff80063a5f1a10 0000000000000000 000000000000000f ffff00000887fbd0
      [   20.704802] fc60: fffffff43a5f1a80 0000000000000000 ffff80063a71fc80 ffff000008880240
      [   20.712632] fc80: ffff80063a71fd90 ffff0000087c7a34 ffff80063afc7180 0000000000000000
      [   20.720462] fca0: 0000ffffcae6fe18 0000000000000014 0000000060000000 0000000000000015
      [   20.728292] fcc0: 0000000000000123 00000000000000ce ffff0000088d2000 ffff80063b1f1900
      [   20.736122] fce0: 0000000000008933 ffff000008e7cb80 ffff80063a71fd80 ffff0000087c50a4
      [   20.743951] fd00: 0000000000008933 ffff000008e7cb80 ffff000008e7cb80 000000100000000e
      [   20.751781] fd20: ffff80063a71fe4c 0000ffff00000300 0000000000000123 0000000000000000
      [   20.759611] fd40: 0000000000000000 ffff80063b1f0000 000000000000000e 0000000000000300
      [   20.767441] fd60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
      [   20.775271] fd80: 0000000000000000 0000000000000000 ffff80063a71fda0 ffff0000087c8c20
      [   20.783100] fda0: 0000000000000000 ffff000008082f30 0000000000000000 0000800637260000
      [   20.790930] fdc0: ffffffffffffffff 0000ffffa0903078 0000000000000000 000000001ea87232
      [   20.798760] fde0: 000000000000000f ffff80063a71fe40 ffff800600000014 ffff000000000001
      [   20.806590] fe00: 0000000000000000 0000000000000000 ffff80063a71fde8 0000000000000000
      [   20.814420] fe20: 0000000000000000 0000000000000000 0000000000000000 0000000000000001
      [   20.822249] fe40: 0000000203000011 0000000000000000 0000000000000000 ffff80063a68aa00
      [   20.830079] fe60: ffff80063a68aa00 0000000000000003 0000000000008933 ffff0000081f1b9c
      [   20.837909] fe80: 0000000000000000 ffff000008082f30 0000000000000000 0000800637260000
      [   20.845739] fea0: ffffffffffffffff 0000ffffa07ca81c 0000000060000000 0000000000000015
      [   20.853569] fec0: 0000000000000003 000000001ea87232 000000000000000f 0000000000000000
      [   20.861399] fee0: 0000ffffcae6fe18 0000000000000014 0000000000000300 0000000000000000
      [   20.869228] ff00: 00000000000000ce 0000000000000000 00000000ffffffff 0000000000000000
      [   20.877059] ff20: 0000000000000002 0000ffffcae87ff0 0000ffffa09cfa14 0000ffffa084f588
      [   20.884888] ff40: 0000000000000000 0000ffffa09ba018 0000ffffcae6fb20 000000001ea87010
      [   20.892718] ff60: 0000ffffa09b9000 0000ffffcae6fe30 0000ffffcae6fe18 000000000000000f
      [   20.900548] ff80: 0000000000000003 000000001ea87232 0000000000000000 0000000000000000
      [   20.908378] ffa0: 0000000000000000 0000ffffcae6fdc0 0000ffffa09a7824 0000ffffcae6fdc0
      [   20.916208] ffc0: 0000ffffa0903078 0000000060000000 0000000000000003 00000000000000ce
      [   20.924038] ffe0: 0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff
      [   20.931867] Call trace:
      [   20.934312] Exception stack(0xffff80063a71f7e0 to 0xffff80063a71f910)
      [   20.940750] f7e0: 0000000000000000 0001000000000000 ffff80063a71f9b0 ffff00000839c4c0
      [   20.948580] f800: ffff80063a71f840 ffff00000888a6e4 ffff80063a24c418 ffff80063a24c448
      [   20.956410] f820: 0000000000000000 ffff00000811cd54 ffff80063a71f860 ffff80063a24c458
      [   20.964240] f840: ffff80063a71f870 ffff00000888b258 ffff80063a24c418 0000000000000001
      [   20.972070] f860: ffff80063a71f910 ffff80063a7b7028 ffff80063a71f890 ffff0000088825e4
      [   20.979899] f880: 0000000000000000 00000000bafff000 000000067abe2adc 0000000000000000
      [   20.987729] f8a0: 0000000000000001 0000000000000000 ffff000008ed50d0 0000000000000000
      [   20.995560] f8c0: 0000000000000000 0000000000000000 ffff80063abe2adc ffff000008096360
      [   21.003390] f8e0: 000000000063abe2 0000ffffcae87ff0 0000ffffa09cfa14 0000ffffa084f588
      [   21.011219] f900: ffff0000087c8b70 0000ffffa09ba018
      [   21.016097] [<ffff00000839c4c0>] swiotlb_tbl_map_single+0x178/0x2ec
      [   21.022362] [<ffff00000839c680>] map_single+0x4c/0x98
      [   21.027411] [<ffff00000839cd10>] swiotlb_map_page+0xa4/0x138
      [   21.033072] [<ffff000008096380>] __swiotlb_map_page+0x20/0x7c
      [   21.038821] [<ffff00000864f770>] ravb_start_xmit+0x174/0x668
      [   21.044484] [<ffff0000087e6498>] dev_hard_start_xmit+0x8c/0x120
      [   21.050407] [<ffff000008807510>] sch_direct_xmit+0x108/0x1a0
      [   21.056064] [<ffff0000087e67dc>] __dev_queue_xmit+0x194/0x4cc
      [   21.061807] [<ffff0000087e6b24>] dev_queue_xmit+0x10/0x18
      [   21.067214] [<ffff000008880240>] packet_sendmsg+0xf40/0x1220
      [   21.072873] [<ffff0000087c7a34>] sock_sendmsg+0x18/0x2c
      [   21.078097] [<ffff0000087c8c20>] SyS_sendto+0xb0/0xf0
      [   21.083150] [<ffff000008082f30>] el0_svc_naked+0x24/0x28
      [   21.088462] Code: d34bfef7 2a1803f3 1a9f86d6 35fff878 (d4210000)
      [   21.094611] ---[ end trace 5bc544ad491f3814 ]---
      [   21.099234] Kernel panic - not syncing: Fatal exception in interrupt
      [   21.105587] Kernel Offset: disabled
      [   21.109073] Memory Limit: none
      [   21.112126] ---[ end Kernel panic - not syncing: Fatal exception in interrupt
      
      Fixes: 2f45d190 ("ravb: minimize TX data copying")
      Signed-off-by: Masaru Nagai <masaru.nagai.vx@renesas.com
      Signed-off-by: default avatarSimon Horman <horms+renesas@verge.net.au>
      Acked-by: default avatarSergei Shtylyov <sergei.shtylyov@cogentembedded.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8ec3e8a1
    • Eric Dumazet's avatar
      mlx4: do not call napi_schedule() without care · 8cf699ec
      Eric Dumazet authored
      Disable BH around the call to napi_schedule() to avoid following warning
      
      [   52.095499] NOHZ: local_softirq_pending 08
      [   52.421291] NOHZ: local_softirq_pending 08
      [   52.608313] NOHZ: local_softirq_pending 08
      
      Fixes: 8d59de8f ("net/mlx4_en: Process all completions in RX rings after port goes up")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Erez Shitrit <erezsh@mellanox.com>
      Cc: Eugenia Emantayev <eugenia@mellanox.com>
      Cc: Tariq Toukan <tariqt@mellanox.com>
      Acked-by: default avatarTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8cf699ec
    • David S. Miller's avatar
      Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth · 50719195
      David S. Miller authored
      Johan Hedberg says:
      
      ====================
      pull request: bluetooth 2017-01-16
      
      Here are a couple of important 802.15.4 driver fixes for the 4.10
      kernel.
      
      Please let me know if there are any issues pulling. Thanks.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      50719195
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2017-01-13' of... · 1a717fcf
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2017-01-13' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      We have a number of fixes, in part because I was late
      in actually sending them out - will try to do better in
      the future:
       * handle VHT opmode properly when hostapd is controlling
         full station state
       * two fixes for minimum channel width in mac80211
       * don't leave SMPS set to junk in HT capabilities
       * fix headroom when forwarding mesh packets, recently
         broken by another fix that failed to take into account
         frame encryption
       * fix the TID in null-data packets indicating EOSP (end
         of service period) in U-APSD
       * prevent attempting to use (and then failing which
         results in crashes) TXQs on stations that aren't added
         to the driver yet
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1a717fcf
    • Lance Richardson's avatar
      openvswitch: maintain correct checksum state in conntrack actions · 75f01a4c
      Lance Richardson authored
      When executing conntrack actions on skbuffs with checksum mode
      CHECKSUM_COMPLETE, the checksum must be updated to account for
      header pushes and pulls. Otherwise we get "hw csum failure"
      logs similar to this (ICMP packet received on geneve tunnel
      via ixgbe NIC):
      
      [  405.740065] genev_sys_6081: hw csum failure
      [  405.740106] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G          I     4.10.0-rc3+ #1
      [  405.740108] Call Trace:
      [  405.740110]  <IRQ>
      [  405.740113]  dump_stack+0x63/0x87
      [  405.740116]  netdev_rx_csum_fault+0x3a/0x40
      [  405.740118]  __skb_checksum_complete+0xcf/0xe0
      [  405.740120]  nf_ip_checksum+0xc8/0xf0
      [  405.740124]  icmp_error+0x1de/0x351 [nf_conntrack_ipv4]
      [  405.740132]  nf_conntrack_in+0xe1/0x550 [nf_conntrack]
      [  405.740137]  ? find_bucket.isra.2+0x62/0x70 [openvswitch]
      [  405.740143]  __ovs_ct_lookup+0x95/0x980 [openvswitch]
      [  405.740145]  ? netif_rx_internal+0x44/0x110
      [  405.740149]  ovs_ct_execute+0x147/0x4b0 [openvswitch]
      [  405.740153]  do_execute_actions+0x22e/0xa70 [openvswitch]
      [  405.740157]  ovs_execute_actions+0x40/0x120 [openvswitch]
      [  405.740161]  ovs_dp_process_packet+0x84/0x120 [openvswitch]
      [  405.740166]  ovs_vport_receive+0x73/0xd0 [openvswitch]
      [  405.740168]  ? udp_rcv+0x1a/0x20
      [  405.740170]  ? ip_local_deliver_finish+0x93/0x1e0
      [  405.740172]  ? ip_local_deliver+0x6f/0xe0
      [  405.740174]  ? ip_rcv_finish+0x3a0/0x3a0
      [  405.740176]  ? ip_rcv_finish+0xdb/0x3a0
      [  405.740177]  ? ip_rcv+0x2a7/0x400
      [  405.740180]  ? __netif_receive_skb_core+0x970/0xa00
      [  405.740185]  netdev_frame_hook+0xd3/0x160 [openvswitch]
      [  405.740187]  __netif_receive_skb_core+0x1dc/0xa00
      [  405.740194]  ? ixgbe_clean_rx_irq+0x46d/0xa20 [ixgbe]
      [  405.740197]  __netif_receive_skb+0x18/0x60
      [  405.740199]  netif_receive_skb_internal+0x40/0xb0
      [  405.740201]  napi_gro_receive+0xcd/0x120
      [  405.740204]  gro_cell_poll+0x57/0x80 [geneve]
      [  405.740206]  net_rx_action+0x260/0x3c0
      [  405.740209]  __do_softirq+0xc9/0x28c
      [  405.740211]  irq_exit+0xd9/0xf0
      [  405.740213]  do_IRQ+0x51/0xd0
      [  405.740215]  common_interrupt+0x93/0x93
      
      Fixes: 7f8a436e ("openvswitch: Add conntrack action")
      Signed-off-by: default avatarLance Richardson <lrichard@redhat.com>
      Acked-by: default avatarPravin B Shelar <pshelar@ovn.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      75f01a4c
  2. 13 Jan, 2017 5 commits
    • Shannon Nelson's avatar
      tcp: fix tcp_fastopen unaligned access complaints on sparc · 003c9410
      Shannon Nelson authored
      Fix up a data alignment issue on sparc by swapping the order
      of the cookie byte array field with the length field in
      struct tcp_fastopen_cookie, and making it a proper union
      to clean up the typecasting.
      
      This addresses log complaints like these:
          log_unaligned: 113 callbacks suppressed
          Kernel unaligned access at TPC[976490] tcp_try_fastopen+0x2d0/0x360
          Kernel unaligned access at TPC[9764ac] tcp_try_fastopen+0x2ec/0x360
          Kernel unaligned access at TPC[9764c8] tcp_try_fastopen+0x308/0x360
          Kernel unaligned access at TPC[9764e4] tcp_try_fastopen+0x324/0x360
          Kernel unaligned access at TPC[976490] tcp_try_fastopen+0x2d0/0x360
      
      Cc: Eric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarShannon Nelson <shannon.nelson@oracle.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      003c9410
    • David Lebrun's avatar
      ipv6: sr: fix several BUGs when preemption is enabled · fa79581e
      David Lebrun authored
      When CONFIG_PREEMPT=y, CONFIG_IPV6=m and CONFIG_SEG6_HMAC=y,
      seg6_hmac_init() is called during the initialization of the ipv6 module.
      This causes a subsequent call to smp_processor_id() with preemption
      enabled, resulting in the following trace.
      
      [   20.451460] BUG: using smp_processor_id() in preemptible [00000000] code: systemd/1
      [   20.452556] caller is debug_smp_processor_id+0x17/0x19
      [   20.453304] CPU: 0 PID: 1 Comm: systemd Not tainted 4.9.0-rc5-00973-g46738b13 #1
      [   20.454406]  ffffc9000062fc18 ffffffff813607b2 0000000000000000 ffffffff81a7f782
      [   20.455528]  ffffc9000062fc48 ffffffff813778dc 0000000000000000 00000000001dcf98
      [   20.456539]  ffffffffa003bd08 ffffffff81af93e0 ffffc9000062fc58 ffffffff81377905
      [   20.456539] Call Trace:
      [   20.456539]  [<ffffffff813607b2>] dump_stack+0x63/0x7f
      [   20.456539]  [<ffffffff813778dc>] check_preemption_disabled+0xd1/0xe3
      [   20.456539]  [<ffffffff81377905>] debug_smp_processor_id+0x17/0x19
      [   20.460260]  [<ffffffffa0061f3b>] seg6_hmac_init+0xfa/0x192 [ipv6]
      [   20.460260]  [<ffffffffa0061ccc>] seg6_init+0x39/0x6f [ipv6]
      [   20.460260]  [<ffffffffa006121a>] inet6_init+0x21a/0x321 [ipv6]
      [   20.460260]  [<ffffffffa0061000>] ? 0xffffffffa0061000
      [   20.460260]  [<ffffffff81000457>] do_one_initcall+0x8b/0x115
      [   20.460260]  [<ffffffff811328a3>] do_init_module+0x53/0x1c4
      [   20.460260]  [<ffffffff8110650a>] load_module+0x1153/0x14ec
      [   20.460260]  [<ffffffff81106a7b>] SYSC_finit_module+0x8c/0xb9
      [   20.460260]  [<ffffffff81106a7b>] ? SYSC_finit_module+0x8c/0xb9
      [   20.460260]  [<ffffffff81106abc>] SyS_finit_module+0x9/0xb
      [   20.460260]  [<ffffffff810014d1>] do_syscall_64+0x62/0x75
      [   20.460260]  [<ffffffff816834f0>] entry_SYSCALL64_slow_path+0x25/0x25
      
      Moreover, dst_cache_* functions also call smp_processor_id(), generating
      a similar trace.
      
      This patch uses raw_cpu_ptr() in seg6_hmac_init() rather than this_cpu_ptr()
      and disable preemption when using dst_cache_* functions.
      Signed-off-by: default avatarDavid Lebrun <david.lebrun@uclouvain.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fa79581e
    • Florian Fainelli's avatar
      net: systemport: Decouple flow control from __bcm_sysport_tx_reclaim · 148d3d02
      Florian Fainelli authored
      The __bcm_sysport_tx_reclaim() function is used to reclaim transmit
      resources in different places within the driver. Most of them should
      not affect the state of the transit flow control.
      
      Introduce bcm_sysport_tx_clean() which cleans the ring, but does not
      re-enable flow control towards the networking stack, and make
      bcm_sysport_tx_reclaim() do the actual transmit queue flow control.
      
      Fixes: 80105bef ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      148d3d02
    • Michal Kazior's avatar
      mac80211: prevent skb/txq mismatch · dbef5362
      Michal Kazior authored
      Station structure is considered as not uploaded
      (to driver) until drv_sta_state() finishes. This
      call is however done after the structure is
      attached to mac80211 internal lists and hashes.
      This means mac80211 can lookup (and use) station
      structure before it is uploaded to a driver.
      
      If this happens (structure exists, but
      sta->uploaded is false) fast_tx path can still be
      taken. Deep in the fastpath call the sta->uploaded
      is checked against to derive "pubsta" argument for
      ieee80211_get_txq(). If sta->uploaded is false
      (and sta is actually non-NULL) ieee80211_get_txq()
      effectively downgraded to vif->txq.
      
      At first glance this may look innocent but coerces
      mac80211 into a state that is almost guaranteed
      (codel may drop offending skb) to crash because a
      station-oriented skb gets queued up on
      vif-oriented txq. The ieee80211_tx_dequeue() ends
      up looking at info->control.flags and tries to use
      txq->sta which in the fail case is NULL.
      
      It's probably pointless to pretend one can
      downgrade skb from sta-txq to vif-txq.
      
      Since downgrading unicast traffic to vif->txq must
      not be done there's no txq to put a frame on if
      sta->uploaded is false. Therefore the code is made
      to fall back to regular tx() op path if the
      described condition is hit.
      
      Only drivers using wake_tx_queue were affected.
      
      Example crash dump before fix:
      
       Unable to handle kernel paging request at virtual address ffffe26c
       PC is at ieee80211_tx_dequeue+0x204/0x690 [mac80211]
       [<bf4252a4>] (ieee80211_tx_dequeue [mac80211]) from
       [<bf4b1388>] (ath10k_mac_tx_push_txq+0x54/0x1c0 [ath10k_core])
       [<bf4b1388>] (ath10k_mac_tx_push_txq [ath10k_core]) from
       [<bf4bdfbc>] (ath10k_htt_txrx_compl_task+0xd78/0x11d0 [ath10k_core])
       [<bf4bdfbc>] (ath10k_htt_txrx_compl_task [ath10k_core])
       [<bf51c5a4>] (ath10k_pci_napi_poll+0x54/0xe8 [ath10k_pci])
       [<bf51c5a4>] (ath10k_pci_napi_poll [ath10k_pci]) from
       [<c0572e90>] (net_rx_action+0xac/0x160)
      Reported-by: default avatarMohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
      Signed-off-by: default avatarMichal Kazior <michal.kazior@tieto.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      dbef5362
    • Felix Fietkau's avatar
      mac80211: initialize SMPS field in HT capabilities · 43071d8f
      Felix Fietkau authored
      ibss and mesh modes copy the ht capabilites from the band without
      overriding the SMPS state. Unfortunately the default value 0 for the
      SMPS field means static SMPS instead of disabled.
      
      This results in HT ibss and mesh setups using only single-stream rates,
      even though SMPS is not supposed to be active.
      
      Initialize SMPS to disabled for all bands on ieee80211_hw_register to
      ensure that the value is sane where it is not overriden with the real
      SMPS state.
      Reported-by: default avatarElektra Wagenrad <onelektra@gmx.net>
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      [move VHT TODO comment to a better place]
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      43071d8f
  3. 12 Jan, 2017 14 commits
  4. 11 Jan, 2017 6 commits
    • stephen hemminger's avatar
      netvsc: add rcu_read locking to netvsc callback · 0719e72c
      stephen hemminger authored
      The receive callback (in tasklet context) is using RCU to get reference
      to associated VF network device but this is not safe. RCU read lock
      needs to be held. Found by running with full lockdep debugging
      enabled.
      
      Fixes: f207c10d ("hv_netvsc: use RCU to protect vf_netdev")
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0719e72c
    • Martynas Pumputis's avatar
      vxlan: Set ports in flow key when doing route lookups · 4ecb1d83
      Martynas Pumputis authored
      Otherwise, a xfrm policy with sport/dport being set cannot be matched.
      Signed-off-by: default avatarMartynas Pumputis <martynas@weave.works>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4ecb1d83
    • hayeswang's avatar
      r8152: fix the sw rx checksum is unavailable · 19c0f40d
      hayeswang authored
      Fix the hw rx checksum is always enabled, and the user couldn't switch
      it to sw rx checksum.
      
      Note that the RTL_VER_01 only support sw rx checksum only. Besides,
      the hw rx checksum for RTL_VER_02 is disabled after
      commit b9a321b4 ("r8152: Fix broken RX checksums."). Re-enable it.
      Signed-off-by: default avatarHayes Wang <hayeswang@realtek.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      19c0f40d
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · ba836a6f
      Linus Torvalds authored
      Merge fixes from Andrew Morton:
       "27 fixes.
      
        There are three patches that aren't actually fixes. They're simple
        function renamings which are nice-to-have in mainline as ongoing net
        development depends on them."
      
      * akpm: (27 commits)
        timerfd: export defines to userspace
        mm/hugetlb.c: fix reservation race when freeing surplus pages
        mm/slab.c: fix SLAB freelist randomization duplicate entries
        zram: support BDI_CAP_STABLE_WRITES
        zram: revalidate disk under init_lock
        mm: support anonymous stable page
        mm: add documentation for page fragment APIs
        mm: rename __page_frag functions to __page_frag_cache, drop order from drain
        mm: rename __alloc_page_frag to page_frag_alloc and __free_page_frag to page_frag_free
        mm, memcg: fix the active list aging for lowmem requests when memcg is enabled
        mm: don't dereference struct page fields of invalid pages
        mailmap: add codeaurora.org names for nameless email commits
        signal: protect SIGNAL_UNKILLABLE from unintentional clearing.
        mm: pmd dirty emulation in page fault handler
        ipc/sem.c: fix incorrect sem_lock pairing
        lib/Kconfig.debug: fix frv build failure
        mm: get rid of __GFP_OTHER_NODE
        mm: fix remote numa hits statistics
        mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done}
        ocfs2: fix crash caused by stale lvb with fsdlm plugin
        ...
      ba836a6f
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · cff3b2c4
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix rtlwifi crash, from Larry Finger.
      
       2) Memory disclosure in appletalk ipddp routing code, from Vlad
          Tsyrklevich.
      
       3) r8152 can erroneously split an RX packet into multiple URBs if the
          Rx FIFO is not empty when we suspend. Fix this by waiting for the
          FIFO to empty before suspending. From Hayes Wang.
      
       4) Two GRO fixes (enter slow path when not enough SKB tail room exists,
          disable frag0 optimizations when there are IPV6 extension headers)
          from Eric Dumazet and Herbert Xu.
      
       5) A series of mlx5e bug fixes (do source udp port offloading for
          tunnels properly, Ip fragment matching fixes, handling firmware
          errors properly when installing TC rules, etc.) from Saeed Mahameed,
          Or Gerlitz, Roi Dayan, Hadar Hen Zion, Gil Rockah, and Daniel
          Jurgens.
      
       6) Two VRF fixes from David Ahern (don't skip multipath selection for
          VRF paths, disallow VRF to be configured with table ID 0).
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (35 commits)
        net: vrf: do not allow table id 0
        net: phy: marvell: fix Marvell 88E1512 used in SGMII mode
        sctp: Fix spelling mistake: "Atempt" -> "Attempt"
        net: ipv4: Fix multipath selection with vrf
        cgroup: move CONFIG_SOCK_CGROUP_DATA to init/Kconfig
        gro: use min_t() in skb_gro_reset_offset()
        net/mlx5: Only cancel recovery work when cleaning up device
        net/mlx5e: Remove WARN_ONCE from adaptive moderation code
        net/mlx5e: Un-register uplink representor on nic_disable
        net/mlx5e: Properly handle FW errors while adding TC rules
        net/mlx5e: Fix kbuild warnings for uninitialized parameters
        net/mlx5e: Set inline mode requirements for matching on IP fragments
        net/mlx5e: Properly get address type of encapsulation IP headers
        net/mlx5e: TC ipv4 tunnel encap offload error flow fixes
        net/mlx5e: Warn when rejecting offload attempts of IP tunnels
        net/mlx5e: Properly handle offloading of source udp port for IP tunnels
        gro: Disable frag0 optimization on IPv6 ext headers
        gro: Enter slow-path if there is no tailroom
        mlx4: Return EOPNOTSUPP instead of ENOTSUPP
        net/af_iucv: don't use paged skbs for TX on HiperSockets
        ...
      cff3b2c4
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · a6b6e616
      Linus Torvalds authored
      Pull crypto fix from Herbert Xu:
       "This fixes a regression in aesni that renders it useless if it's
        built-in with a modular pcbc configuration"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: aesni - Fix failure when built-in with modular pcbc
      a6b6e616