1. 18 Jan, 2016 9 commits
  2. 17 Jan, 2016 3 commits
    • Doron Tsur's avatar
      net/mlx5_core: Fix trimming down IRQ number · 0b6e26ce
      Doron Tsur authored
      With several ConnectX-4 cards installed on a server, one may receive
      irqn > 255 from the kernel API, which we mistakenly trim to 8bit.
      
      This causes EQ creation failure with the following stack trace:
      [<ffffffff812a11f4>] dump_stack+0x48/0x64
      [<ffffffff810ace21>] __setup_irq+0x3a1/0x4f0
      [<ffffffff810ad7e0>] request_threaded_irq+0x120/0x180
      [<ffffffffa0923660>] ? mlx5_eq_int+0x450/0x450 [mlx5_core]
      [<ffffffffa0922f64>] mlx5_create_map_eq+0x1e4/0x2b0 [mlx5_core]
      [<ffffffffa091de01>] alloc_comp_eqs+0xb1/0x180 [mlx5_core]
      [<ffffffffa091ea99>] mlx5_dev_init+0x5e9/0x6e0 [mlx5_core]
      [<ffffffffa091ec29>] init_one+0x99/0x1c0 [mlx5_core]
      [<ffffffff812e2afc>] local_pci_probe+0x4c/0xa0
      
      Fixing it by changing of the irqn type from u8 to unsigned int to
      support values > 255
      
      Fixes: 61d0e73e ('net/mlx5_core: Use the the real irqn in eq->irqn')
      Reported-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDoron Tsur <doront@mellanox.com>
      Signed-off-by: default avatarMatan Barak <matanb@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0b6e26ce
    • Geert Uytterhoeven's avatar
      tcp_memcontrol: Forward declare cgroup_subsys and mem_cgroup stucts · cdb00777
      Geert Uytterhoeven authored
      In file included from net/ipv4/tcp_ipv4.c:77 (and many more):
      include/net/tcp_memcontrol.h:5: warning: ‘struct cgroup_subsys’ declared inside parameter list
      include/net/tcp_memcontrol.h:5: warning: its scope is only this definition or declaration, which is probably not what you want
      
      Add forward declarations for all used structures to fix this.
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cdb00777
    • David S. Miller's avatar
      Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge · 78c5b2c6
      David S. Miller authored
      Antonio Quartulli says:
      
      ====================
      pull request [net]: batman-adv 20160117
      
      here you have a bunch of patches intended for net.
      
      This patchset is provided by Sven Eckelmann and it is basically
      fixing 2 major issues that exist in several parts of the code -
      that is why we have 8 patches.
      
      The first bugfix (patch 1 and 2) is preventing call_rcu from
      being invoked recursively. This would deceive any user waiting
      on rcu_barrier() because the latter won't be able to wait for
      the nested invocation thus triggering any sort of undefined
      behaviours.
      
      The second bugfix (patches from 3 to 8) prevents the code from
      freeing rcu protected objects without waiting for the proper grace
      period. This issue can potentially lead to wrong memory access
      and thus kernel crashes.
      
      Unfortunately this bogus code pattern was copy/pasted
      all around the place when developing new features, therefore
      Sven diligently created several patches to address each component
      independently.
      
      Given that such bugs were introduced quite some time ago, all
      the patches except patch 5 should be considered for submission
      to stable.
      
      Included changes:
      - avoid recursive invocations of call_rcu() which would fool users waiting on
        rcu_barrier()
      - prevent immediate kfree of objects used in rcu protected contexts
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      78c5b2c6
  3. 16 Jan, 2016 9 commits
    • Sven Eckelmann's avatar
      batman-adv: Drop immediate orig_node free function · 42eff6a6
      Sven Eckelmann authored
      It is not allowed to free the memory of an object which is part of a list
      which is protected by rcu-read-side-critical sections without making sure
      that no other context is accessing the object anymore. This usually happens
      by removing the references to this object and then waiting until the rcu
      grace period is over and no one (allowedly) accesses it anymore.
      
      But the _now functions ignore this completely. They free the object
      directly even when a different context still tries to access it. This has
      to be avoided and thus these functions must be removed and all functions
      have to use batadv_orig_node_free_ref.
      
      Fixes: 72822225 ("batman-adv: Fix rcu_barrier() miss due to double call_rcu() in TT code")
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      42eff6a6
    • Sven Eckelmann's avatar
      batman-adv: Drop immediate batadv_hard_iface free function · b4d922cf
      Sven Eckelmann authored
      It is not allowed to free the memory of an object which is part of a list
      which is protected by rcu-read-side-critical sections without making sure
      that no other context is accessing the object anymore. This usually happens
      by removing the references to this object and then waiting until the rcu
      grace period is over and no one (allowedly) accesses it anymore.
      
      But the _now functions ignore this completely. They free the object
      directly even when a different context still tries to access it. This has
      to be avoided and thus these functions must be removed and all functions
      have to use batadv_hardif_free_ref.
      
      Fixes: 89652331 ("batman-adv: split tq information in neigh_node struct")
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      b4d922cf
    • Sven Eckelmann's avatar
      batman-adv: Drop immediate neigh_ifinfo free function · ae3e1e36
      Sven Eckelmann authored
      It is not allowed to free the memory of an object which is part of a list
      which is protected by rcu-read-side-critical sections without making sure
      that no other context is accessing the object anymore. This usually happens
      by removing the references to this object and then waiting until the rcu
      grace period is over and no one (allowedly) accesses it anymore.
      
      But the _now functions ignore this completely. They free the object
      directly even when a different context still tries to access it. This has
      to be avoided and thus these functions must be removed and all functions
      have to use batadv_neigh_ifinfo_free_ref.
      
      Fixes: 89652331 ("batman-adv: split tq information in neigh_node struct")
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      ae3e1e36
    • Sven Eckelmann's avatar
      batman-adv: Drop immediate batadv_hardif_neigh_node free function · f6389692
      Sven Eckelmann authored
      It is not allowed to free the memory of an object which is part of a list
      which is protected by rcu-read-side-critical sections without making sure
      that no other context is accessing the object anymore. This usually happens
      by removing the references to this object and then waiting until the rcu
      grace period is over and no one (allowedly) accesses it anymore.
      
      But the _now functions ignore this completely. They free the object
      directly even when a different context still tries to access it. This has
      to be avoided and thus these functions must be removed and all functions
      have to use batadv_hardif_neigh_free_ref.
      
      Fixes: cef63419 ("batman-adv: add list of unique single hop neighbors per hard-interface")
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      f6389692
    • Sven Eckelmann's avatar
      batman-adv: Drop immediate batadv_neigh_node free function · 2baa753c
      Sven Eckelmann authored
      It is not allowed to free the memory of an object which is part of a list
      which is protected by rcu-read-side-critical sections without making sure
      that no other context is accessing the object anymore. This usually happens
      by removing the references to this object and then waiting until the rcu
      grace period is over and no one (allowedly) accesses it anymore.
      
      But the _now functions ignore this completely. They free the object
      directly even when a different context still tries to access it. This has
      to be avoided and thus these functions must be removed and all functions
      have to use batadv_neigh_node_free_ref.
      
      Fixes: 89652331 ("batman-adv: split tq information in neigh_node struct")
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      2baa753c
    • Sven Eckelmann's avatar
      batman-adv: Drop immediate batadv_orig_ifinfo free function · deed9660
      Sven Eckelmann authored
      It is not allowed to free the memory of an object which is part of a list
      which is protected by rcu-read-side-critical sections without making sure
      that no other context is accessing the object anymore. This usually happens
      by removing the references to this object and then waiting until the rcu
      grace period is over and no one (allowedly) accesses it anymore.
      
      But the _now functions ignore this completely. They free the object
      directly even when a different context still tries to access it. This has
      to be avoided and thus these functions must be removed and all functions
      have to use batadv_orig_ifinfo_free_ref.
      
      Fixes: 7351a482 ("batman-adv: split out router from orig_node")
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      deed9660
    • Sven Eckelmann's avatar
      batman-adv: Avoid recursive call_rcu for batadv_nc_node · 44e8e7e9
      Sven Eckelmann authored
      The batadv_nc_node_free_ref function uses call_rcu to delay the free of the
      batadv_nc_node object until no (already started) rcu_read_lock is enabled
      anymore. This makes sure that no context is still trying to access the
      object which should be removed. But batadv_nc_node also contains a
      reference to orig_node which must be removed.
      
      The reference drop of orig_node was done in the call_rcu function
      batadv_nc_node_free_rcu but should actually be done in the
      batadv_nc_node_release function to avoid nested call_rcus. This is
      important because rcu_barrier (e.g. batadv_softif_free or batadv_exit) will
      not detect the inner call_rcu as relevant for its execution. Otherwise this
      barrier will most likely be inserted in the queue before the callback of
      the first call_rcu was executed. The caller of rcu_barrier will therefore
      continue to run before the inner call_rcu callback finished.
      
      Fixes: d56b1705 ("batman-adv: network coding - detect coding nodes and remove these after timeout")
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      44e8e7e9
    • Sven Eckelmann's avatar
      batman-adv: Avoid recursive call_rcu for batadv_bla_claim · 63b39927
      Sven Eckelmann authored
      The batadv_claim_free_ref function uses call_rcu to delay the free of the
      batadv_bla_claim object until no (already started) rcu_read_lock is enabled
      anymore. This makes sure that no context is still trying to access the
      object which should be removed. But batadv_bla_claim also contains a
      reference to backbone_gw which must be removed.
      
      The reference drop of backbone_gw was done in the call_rcu function
      batadv_claim_free_rcu but should actually be done in the
      batadv_claim_release function to avoid nested call_rcus. This is important
      because rcu_barrier (e.g. batadv_softif_free or batadv_exit) will not
      detect the inner call_rcu as relevant for its execution. Otherwise this
      barrier will most likely be inserted in the queue before the callback of
      the first call_rcu was executed. The caller of rcu_barrier will therefore
      continue to run before the inner call_rcu callback finished.
      
      Fixes: 23721387 ("batman-adv: add basic bridge loop avoidance code")
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Acked-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      63b39927
    • Ivan Vecera's avatar
      bna: fix Rx data corruption with VLAN stripping enabled and MTU > 4096 · 6c3f5aef
      Ivan Vecera authored
      The multi-buffer Rx mode implemented in the past introduced
      a regression that causes a data corruption for received VLAN
      traffic when VLAN tag stripping is enabled. This mode is supported
      only be newer chipsets (1860) and is enabled when MTU > 4096.
      
      When this mode is enabled Rx queue contains buffers with fixed size
      2048 bytes. Any incoming packet larger than 2048 is divided into
      multiple buffers that are attached as skb frags in polling routine.
      
      The driver assumes that all buffers associated with a packet except
      the last one is fully used (e.g. packet with size 5000 are divided
      into 3 buffers 2048 + 2048 + 904 bytes) and ignores true size reported
      in completions. This assumption is usually true but not when VLAN
      packet is received and VLAN tag stripping is enabled. In this case
      the first buffer is 2044 bytes long but as the driver always assumes
      2048 bytes then 4 extra random bytes are included between the first
      and the second frag. Additionally the driver sets checksum as correct
      so the packet is properly processed by the core.
      
      The driver needs to check the size of used space in each Rx buffer
      reported by FW and not blindly use the fixed value.
      
      Cc: Rasesh Mody <rasesh.mody@qlogic.com>
      Signed-off-by: default avatarIvan Vecera <ivecera@redhat.com>
      Reviewed-by: default avatarRasesh Mody <rasesh.mody@qlogic.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6c3f5aef
  4. 15 Jan, 2016 19 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 4e5448a3
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "A quick set of bug fixes after there initial networking merge:
      
        1) Netlink multicast group storage allocator only was tested with
           nr_groups equal to 1, make it work for other values too.  From
           Matti Vaittinen.
      
        2) Check build_skb() return value in macb and hip04_eth drivers, from
           Weidong Wang.
      
        3) Don't leak x25_asy on x25_asy_open() failure.
      
        4) More DMA map/unmap fixes in 3c59x from Neil Horman.
      
        5) Don't clobber IP skb control block during GSO segmentation, from
           Konstantin Khlebnikov.
      
        6) ECN helpers for ipv6 don't fixup the checksum, from Eric Dumazet.
      
        7) Fix SKB segment utilization estimation in xen-netback, from David
           Vrabel.
      
        8) Fix lockdep splat in bridge addrlist handling, from Nikolay
           Aleksandrov"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits)
        bgmac: Fix reversed test of build_skb() return value.
        bridge: fix lockdep addr_list_lock false positive splat
        net: smsc: Add support h8300
        xen-netback: free queues after freeing the net device
        xen-netback: delete NAPI instance when queue fails to initialize
        xen-netback: use skb to determine number of required guest Rx requests
        net: sctp: Move sequence start handling into sctp_transport_get_idx()
        ipv6: update skb->csum when CE mark is propagated
        net: phy: turn carrier off on phy attach
        net: macb: clear interrupts when disabling them
        sctp: support to lookup with ep+paddr in transport rhashtable
        net: hns: fixes no syscon error when init mdio
        dts: hisi: fixes no syscon fault when init mdio
        net: preserve IP control block during GSO segmentation
        fsl/fman: Delete one function call "put_device" in dtsec_config()
        hip04_eth: fix missing error handle for build_skb failed
        3c59x: fix another page map/single unmap imbalance
        3c59x: balance page maps and unmaps
        x25_asy: Free x25_asy on x25_asy_open() failure.
        mlxsw: fix SWITCHDEV_OBJ_ID_PORT_MDB
        ...
      4e5448a3
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 5a18d263
      Linus Torvalds authored
      Pull sparc fixes from David Miller:
       "Two sparc bug fixes"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc64: Fix numa node distance initialization
        sparc64: fix incorrect sign extension in sys_sparc64_personality
      5a18d263
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · f689b742
      Linus Torvalds authored
      Pull powerpc updates from Michael Ellerman:
       "Core:
         - Ground work for the new Power9 MMU from Aneesh Kumar K.V
         - Optimise FP/VMX/VSX context switching from Anton Blanchard
      
        Misc:
         - Various cleanups from Krzysztof Kozlowski, John Ogness, Rashmica
           Gupta, Russell Currey, Gavin Shan, Daniel Axtens, Michael Neuling,
           Andrew Donnellan
         - Allow wrapper to work on non-english system from Laurent Vivier
         - Add rN aliases to the pt_regs_offset table from Rashmica Gupta
         - Fix module autoload for rackmeter & axonram drivers from Luis de
           Bethencourt
         - Include KVM guest test in all interrupt vectors from Paul Mackerras
         - Fix DSCR inheritance over fork() from Anton Blanchard
         - Make value-returning atomics & {cmp}xchg* & their atomic_ versions
           fully ordered from Boqun Feng
         - Print MSR TM bits in oops messages from Michael Neuling
         - Add TM signal return & invalid stack selftests from Michael Neuling
         - Limit EPOW reset event warnings from Vipin K Parashar
         - Remove the Cell QPACE code from Rashmica Gupta
         - Append linux_banner to exception information in xmon from Rashmica
           Gupta
         - Add selftest to check if VSRs are corrupted from Rashmica Gupta
         - Remove broken GregorianDay() from Daniel Axtens
         - Import Anton's context_switch2 benchmark into selftests from
           Michael Ellerman
         - Add selftest script to test HMI functionality from Daniel Axtens
         - Remove obsolete OPAL v2 support from Stewart Smith
         - Make enter_rtas() private from Michael Ellerman
         - PPR exception cleanups from Michael Ellerman
         - Add page soft dirty tracking from Laurent Dufour
         - Add support for Nvlink NPUs from Alistair Popple
         - Add support for kexec on 476fpe from Alistair Popple
         - Enable kernel CPU dlpar from sysfs from Nathan Fontenot
         - Copy only required pieces of the mm_context_t to the paca from
           Michael Neuling
         - Add a kmsg_dumper that flushes OPAL console output on panic from
           Russell Currey
         - Implement save_stack_trace_regs() to enable kprobe stack tracing
           from Steven Rostedt
         - Add HWCAP bits for Power9 from Michael Ellerman
         - Fix _PAGE_PTE breaking swapoff from Aneesh Kumar K.V
         - Fix _PAGE_SWP_SOFT_DIRTY breaking swapoff from Hugh Dickins
         - scripts/recordmcount.pl: support data in text section on powerpc
           from Ulrich Weigand
         - Handle R_PPC64_ENTRY relocations in modules from Ulrich Weigand
      
        cxl:
         - cxl: Fix possible idr warning when contexts are released from
           Vaibhav Jain
         - cxl: use correct operator when writing pcie config space values
           from Andrew Donnellan
         - cxl: Fix DSI misses when the context owning task exits from Vaibhav
           Jain
         - cxl: fix build for GCC 4.6.x from Brian Norris
         - cxl: use -Werror only with CONFIG_PPC_WERROR from Brian Norris
         - cxl: Enable PCI device ID for future IBM CXL adapter from Uma
           Krishnan
      
        Freescale:
         - Freescale updates from Scott: Highlights include moving QE code out
           of arch/powerpc (to be shared with arm), device tree updates, and
           minor fixes"
      
      * tag 'powerpc-4.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (149 commits)
        powerpc/module: Handle R_PPC64_ENTRY relocations
        scripts/recordmcount.pl: support data in text section on powerpc
        powerpc/powernv: Fix OPAL_CONSOLE_FLUSH prototype and usages
        powerpc/mm: fix _PAGE_SWP_SOFT_DIRTY breaking swapoff
        powerpc/mm: Fix _PAGE_PTE breaking swapoff
        cxl: Enable PCI device ID for future IBM CXL adapter
        cxl: use -Werror only with CONFIG_PPC_WERROR
        cxl: fix build for GCC 4.6.x
        powerpc: Add HWCAP bits for Power9
        powerpc/powernv: Reserve PE#0 on NPU
        powerpc/powernv: Change NPU PE# assignment
        powerpc/powernv: Fix update of NVLink DMA mask
        powerpc/powernv: Remove misleading comment in pci.c
        powerpc: Implement save_stack_trace_regs() to enable kprobe stack tracing
        powerpc: Fix build break due to paca mm_context_t changes
        cxl: Fix DSI misses when the context owning task exits
        MAINTAINERS: Update Scott Wood's e-mail address
        powerpc/powernv: Fix minor off-by-one error in opal_mce_check_early_recovery()
        powerpc: Fix style of self-test config prompts
        powerpc/powernv: Only delay opal_rtc_read() retry when necessary
        ...
      f689b742
    • David S. Miller's avatar
      bgmac: Fix reversed test of build_skb() return value. · 750afbf8
      David S. Miller authored
      Fixes: f1640c3d ("bgmac: fix a missing check for build_skb")
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      750afbf8
    • Linus Torvalds's avatar
      Merge tag 'vfio-v4.5-rc1' of git://github.com/awilliam/linux-vfio · 37cea93b
      Linus Torvalds authored
      Pull VFIO updates from Alex Williamson:
      
       - Fixes in AMD xgbe reset, spapr structure padding, type 1 flags (Dan
         Carpenter, Alexey Kardashevskiy, Pierre Morel)
      
       - Re-introduce no-iommu mode, with a user this time (Alex Williamson)
      
      * tag 'vfio-v4.5-rc1' of git://github.com/awilliam/linux-vfio:
        vfio/iommu_type1: make use of info.flags
        vfio: Include No-IOMMU mode
        vfio: Add explicit alignments in vfio_iommu_spapr_tce_create
        VFIO: platform: reset: fix a warning message condition
      37cea93b
    • Linus Torvalds's avatar
      Merge tag 'nfsd-4.5' of git://linux-nfs.org/~bfields/linux · cc80fe0e
      Linus Torvalds authored
      Pull nfsd updates from Bruce Fields:
       "Smaller bugfixes and cleanup, including a fix for a failures of
        kerberized NFSv4.1 mounts, and Scott Mayhew's work addressing ACK
        storms that can affect some high-availability NFS setups"
      
      * tag 'nfsd-4.5' of git://linux-nfs.org/~bfields/linux:
        nfsd: add new io class tracepoint
        nfsd: give up on CB_LAYOUTRECALLs after two lease periods
        nfsd: Fix nfsd leaks sunrpc module references
        lockd: constify nlmsvc_binding structure
        lockd: use to_delayed_work
        nfsd: use to_delayed_work
        Revert "svcrdma: Do not send XDR roundup bytes for a write chunk"
        lockd: Register callbacks on the inetaddr_chain and inet6addr_chain
        nfsd: Register callbacks on the inetaddr_chain and inet6addr_chain
        sunrpc: Add a function to close temporary transports immediately
        nfsd: don't base cl_cb_status on stale information
        nfsd4: fix gss-proxy 4.1 mounts for some AD principals
        nfsd: fix unlikely NULL deref in mach_creds_match
        nfsd: minor consolidation of mach_cred handling code
        nfsd: helper for dup of possibly NULL string
        svcrpc: move some initialization to common code
        nfsd: fix a warning message
        nfsd: constify nfsd4_callback_ops structure
        nfsd: recover: constify nfsd4_client_tracking_ops structures
        svcrdma: Do not send XDR roundup bytes for a write chunk
      cc80fe0e
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · c7b6c5fe
      Linus Torvalds authored
      Pull vfs regression fix from Al Viro:
       "Fix for braino introduced in vfs.git#work.misc"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        amdkfd: Copy from the proper user command pointer
      c7b6c5fe
    • Nikolay Aleksandrov's avatar
      bridge: fix lockdep addr_list_lock false positive splat · c6894dec
      Nikolay Aleksandrov authored
      After promisc mode management was introduced a bridge device could do
      dev_set_promiscuity from its ndo_change_rx_flags() callback which in
      turn can be called after the bridge's addr_list_lock has been taken
      (e.g. by dev_uc_add). This causes a false positive lockdep splat because
      the port interfaces' addr_list_lock is taken when br_manage_promisc()
      runs after the bridge's addr list lock was already taken.
      To remove the false positive introduce a custom bridge addr_list_lock
      class and set it on bridge init.
      A simple way to reproduce this is with the following:
      $ brctl addbr br0
      $ ip l add l br0 br0.100 type vlan id 100
      $ ip l set br0 up
      $ ip l set br0.100 up
      $ echo 1 > /sys/class/net/br0/bridge/vlan_filtering
      $ brctl addif br0 eth0
      Splat:
      [   43.684325] =============================================
      [   43.684485] [ INFO: possible recursive locking detected ]
      [   43.684636] 4.4.0-rc8+ #54 Not tainted
      [   43.684755] ---------------------------------------------
      [   43.684906] brctl/1187 is trying to acquire lock:
      [   43.685047]  (_xmit_ETHER){+.....}, at: [<ffffffff8150169e>] dev_set_rx_mode+0x1e/0x40
      [   43.685460]  but task is already holding lock:
      [   43.685618]  (_xmit_ETHER){+.....}, at: [<ffffffff815072a7>] dev_uc_add+0x27/0x80
      [   43.686015]  other info that might help us debug this:
      [   43.686316]  Possible unsafe locking scenario:
      
      [   43.686743]        CPU0
      [   43.686967]        ----
      [   43.687197]   lock(_xmit_ETHER);
      [   43.687544]   lock(_xmit_ETHER);
      [   43.687886] *** DEADLOCK ***
      
      [   43.688438]  May be due to missing lock nesting notation
      
      [   43.688882] 2 locks held by brctl/1187:
      [   43.689134]  #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff81510317>] rtnl_lock+0x17/0x20
      [   43.689852]  #1:  (_xmit_ETHER){+.....}, at: [<ffffffff815072a7>] dev_uc_add+0x27/0x80
      [   43.690575] stack backtrace:
      [   43.690970] CPU: 0 PID: 1187 Comm: brctl Not tainted 4.4.0-rc8+ #54
      [   43.691270] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
      [   43.691770]  ffffffff826a25c0 ffff8800369fb8e0 ffffffff81360ceb ffffffff826a25c0
      [   43.692425]  ffff8800369fb9b8 ffffffff810d0466 ffff8800369fb968 ffffffff81537139
      [   43.693071]  ffff88003a08c880 0000000000000000 00000000ffffffff 0000000002080020
      [   43.693709] Call Trace:
      [   43.693931]  [<ffffffff81360ceb>] dump_stack+0x4b/0x70
      [   43.694199]  [<ffffffff810d0466>] __lock_acquire+0x1e46/0x1e90
      [   43.694483]  [<ffffffff81537139>] ? netlink_broadcast_filtered+0x139/0x3e0
      [   43.694789]  [<ffffffff8153b5da>] ? nlmsg_notify+0x5a/0xc0
      [   43.695064]  [<ffffffff810d10f5>] lock_acquire+0xe5/0x1f0
      [   43.695340]  [<ffffffff8150169e>] ? dev_set_rx_mode+0x1e/0x40
      [   43.695623]  [<ffffffff815edea5>] _raw_spin_lock_bh+0x45/0x80
      [   43.695901]  [<ffffffff8150169e>] ? dev_set_rx_mode+0x1e/0x40
      [   43.696180]  [<ffffffff8150169e>] dev_set_rx_mode+0x1e/0x40
      [   43.696460]  [<ffffffff8150189c>] dev_set_promiscuity+0x3c/0x50
      [   43.696750]  [<ffffffffa0586845>] br_port_set_promisc+0x25/0x50 [bridge]
      [   43.697052]  [<ffffffffa05869aa>] br_manage_promisc+0x8a/0xe0 [bridge]
      [   43.697348]  [<ffffffffa05826ee>] br_dev_change_rx_flags+0x1e/0x20 [bridge]
      [   43.697655]  [<ffffffff81501532>] __dev_set_promiscuity+0x132/0x1f0
      [   43.697943]  [<ffffffff81501672>] __dev_set_rx_mode+0x82/0x90
      [   43.698223]  [<ffffffff815072de>] dev_uc_add+0x5e/0x80
      [   43.698498]  [<ffffffffa05b3c62>] vlan_device_event+0x542/0x650 [8021q]
      [   43.698798]  [<ffffffff8109886d>] notifier_call_chain+0x5d/0x80
      [   43.699083]  [<ffffffff810988b6>] raw_notifier_call_chain+0x16/0x20
      [   43.699374]  [<ffffffff814f456e>] call_netdevice_notifiers_info+0x6e/0x80
      [   43.699678]  [<ffffffff814f4596>] call_netdevice_notifiers+0x16/0x20
      [   43.699973]  [<ffffffffa05872be>] br_add_if+0x47e/0x4c0 [bridge]
      [   43.700259]  [<ffffffffa058801e>] add_del_if+0x6e/0x80 [bridge]
      [   43.700548]  [<ffffffffa0588b5f>] br_dev_ioctl+0xaf/0xc0 [bridge]
      [   43.700836]  [<ffffffff8151a7ac>] dev_ifsioc+0x30c/0x3c0
      [   43.701106]  [<ffffffff8151aac9>] dev_ioctl+0xf9/0x6f0
      [   43.701379]  [<ffffffff81254345>] ? mntput_no_expire+0x5/0x450
      [   43.701665]  [<ffffffff812543ee>] ? mntput_no_expire+0xae/0x450
      [   43.701947]  [<ffffffff814d7b02>] sock_do_ioctl+0x42/0x50
      [   43.702219]  [<ffffffff814d8175>] sock_ioctl+0x1e5/0x290
      [   43.702500]  [<ffffffff81242d0b>] do_vfs_ioctl+0x2cb/0x5c0
      [   43.702771]  [<ffffffff81243079>] SyS_ioctl+0x79/0x90
      [   43.703033]  [<ffffffff815eebb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
      
      CC: Vlad Yasevich <vyasevic@redhat.com>
      CC: Stephen Hemminger <stephen@networkplumber.org>
      CC: Bridge list <bridge@lists.linux-foundation.org>
      CC: Andy Gospodarek <gospo@cumulusnetworks.com>
      CC: Roopa Prabhu <roopa@cumulusnetworks.com>
      Fixes: 2796d0c6 ("bridge: Automatically manage port promiscuous mode.")
      Reported-by: default avatarAndy Gospodarek <gospo@cumulusnetworks.com>
      Signed-off-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c6894dec
    • Linus Torvalds's avatar
      Merge tag 'md/4.5' of git://neil.brown.name/md · 3c28c9cc
      Linus Torvalds authored
      Pull md updates from Neil Brown:
       "Mostly clustered-raid1 and raid5 journal updates.  one Y2038 fix and
        other minor stuff.
      
        One patch removes me from the MAINTAINERS file and adds a record of my
        md maintainership to Credits"
      
      Many thanks to Neil, who has been around for a _looong_ time.
      
      * tag 'md/4.5' of git://neil.brown.name/md: (26 commits)
        md/raid: only permit hot-add of compatible integrity profiles
        Remove myself as MD Maintainer, and add to Credits.
        raid5-cache: handle journal hotadd in quiesce
        MD: add journal with array suspended
        md: set MD_HAS_JOURNAL in correct places
        md: Remove 'ready' field from mddev.
        md: remove unnecesary md_new_event_inintr
        raid5: allow r5l_io_unit allocations to fail
        raid5-cache: use a mempool for the metadata block
        raid5-cache: use a bio_set
        raid5-cache: add journal hot add/remove support
        drivers: md: use ktime_get_real_seconds()
        md: avoid warning for 32-bit sector_t
        raid5-cache: free meta_page earlier
        raid5-cache: simplify r5l_move_io_unit_list
        md: update comment for md_allow_write
        md-cluster: update comments for MD_CLUSTER_SEND_LOCKED_ALREADY
        md-cluster: Protect communication with mutexes
        md-cluster: Defer MD reloading to mddev->thread
        md-cluster: update the documentation
        ...
      3c28c9cc
    • Linus Torvalds's avatar
      Merge tag 'regulator-v4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator · 4b43ea2a
      Linus Torvalds authored
      Pull regulator updates from Mark Brown:
       "Aside from a fix for a spurious warning (which caused more problems
        than it fixed in the fixing really) this is all driver updates,
        including new drivers for Dialog PV88060/90 and TI LM363x and TPS65086
        devices.  The qcom_smd driver has had PM8916 and PMA8084 support
        added"
      
      * tag 'regulator-v4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (36 commits)
        regulator: core: remove some dead code
        regulator: core: use dev_to_rdev
        regulator: lp872x: Get rid of duplicate reference to DVS GPIO
        regulator: lp872x: Add missing of_match in regulators descriptions
        regulator: axp20x: Fix GPIO LDO enable value for AXP22x
        regulator: lp8788: constify regulator_ops structures
        regulator: wm8*: constify regulator_ops structures
        regulator: da9*: constify regulator_ops structures
        regulator: mt6311: Use REGCACHE_RBTREE
        regulator: tps65917/palmas: Add bypass ops for LDOs with bypass capability
        regulator: qcom-smd: Add support for PMA8084
        regulator: qcom-smd: Add PM8916 support
        soc: qcom: documentation: Update SMD/RPM Docs
        regulator: pv88090: logical vs bitwise AND typo
        regulator: pv88090: Fix irq leak
        regulator: pv88090: new regulator driver
        regulator: wm831x-ldo: Use platform_register/unregister_drivers()
        regulator: wm831x-dcdc: Use platform_register/unregister_drivers()
        regulator: lp8788-ldo: Use platform_register/unregister_drivers()
        regulator: core: Fix nested locking of supplies
        ...
      4b43ea2a
    • Yoshinori Sato's avatar
      net: smsc: Add support h8300 · f147d0b3
      Yoshinori Sato authored
      Add H8/300 platform support for smc91x
      Signed-off-by: default avatarYoshinori Sato <ysato@users.sourceforge.jp>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f147d0b3
    • Borislav Petkov's avatar
      amdkfd: Copy from the proper user command pointer · 39c01bf9
      Borislav Petkov authored
      8f1d57c1 ("amdkfd: don't open-code memdup_user()") mistakenly uses
      an uninitialized local pointer, gcc complains:
      
        drivers/gpu/drm/amd/amdkfd/kfd_chardev.c: In function ‘kfd_ioctl_dbg_address_watch’:
        drivers/gpu/drm/amd/amdkfd/kfd_chardev.c:562:12: warning: ‘args_buff’ may be used uninitialized in this function [-Wmaybe-uninitialized]
          args_buff = memdup_user(args_buff,
                      ^
      
      Fix it.
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      39c01bf9
    • Linus Torvalds's avatar
      Merge branch 'mailbox-for-next' of git://git.linaro.org/landing-teams/working/fujitsu/integration · 7aca74e7
      Linus Torvalds authored
      Pull mailbox fixlet from Jussi Brar.
      
      * 'mailbox-for-next' of git://git.linaro.org/landing-teams/working/fujitsu/integration:
        mailbox: constify mbox_chan_ops structure
      7aca74e7
    • David S. Miller's avatar
      Merge branch 'xen-netback-fixes' · 973365dc
      David S. Miller authored
      David Vrabel says:
      
      ====================
      xen-netback: use skb to determine number of required (etc.)
      
      "xen-netback: use skb to determine number of required" plus two other
      minor fixes I found down the back of the sofa.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      973365dc
    • David Vrabel's avatar
      xen-netback: free queues after freeing the net device · 9c6f3ffe
      David Vrabel authored
      If a queue still has a NAPI instance added to the net device, freeing
      the queues early results in a use-after-free.
      
      The shouldn't ever happen because we disconnect and tear down all queues
      before freeing the net device, but doing this makes it obviously safe.
      Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9c6f3ffe
    • David Vrabel's avatar
      xen-netback: delete NAPI instance when queue fails to initialize · 4a658527
      David Vrabel authored
      When xenvif_connect() fails it may leave a stale NAPI instance added to
      the device.  Make sure we delete it in the error path.
      Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4a658527
    • David Vrabel's avatar
      xen-netback: use skb to determine number of required guest Rx requests · 99a2dea5
      David Vrabel authored
      Using the MTU or GSO size to determine the number of required guest Rx
      requests for an skb was subtly broken since these value may change at
      runtime.
      
      After 1650d545 (xen-netback: always
      fully coalesce guest Rx packets) we always fully pack a packet into
      its guest Rx slots.  Calculating the number of required slots from the
      packet length is then easy.
      Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      99a2dea5
    • Geert Uytterhoeven's avatar
      net: sctp: Move sequence start handling into sctp_transport_get_idx() · fb331185
      Geert Uytterhoeven authored
      net/sctp/proc.c: In function ‘sctp_transport_get_idx’:
      net/sctp/proc.c:313: warning: ‘obj’ may be used uninitialized in this function
      
      This is currently a false positive, as all callers check for a zero
      offset first, and handle this case in the exact same way.
      
      Move the check and handling into sctp_transport_get_idx() to kill the
      compiler warning, and avoid future bugs.
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fb331185
    • Eric Dumazet's avatar
      ipv6: update skb->csum when CE mark is propagated · 34ae6a1a
      Eric Dumazet authored
      When a tunnel decapsulates the outer header, it has to comply
      with RFC 6080 and eventually propagate CE mark into inner header.
      
      It turns out IP6_ECN_set_ce() does not correctly update skb->csum
      for CHECKSUM_COMPLETE packets, triggering infamous "hw csum failure"
      messages and stack traces.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      34ae6a1a