1. 28 Jan, 2017 1 commit
    • Douglas Miller's avatar
      percpu-refcount: fix reference leak during percpu-atomic transition · 966d2b04
      Douglas Miller authored
      percpu_ref_tryget() and percpu_ref_tryget_live() should return
      "true" IFF they acquire a reference. But the return value from
      atomic_long_inc_not_zero() is a long and may have high bits set,
      e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines
      is bool so the reference may actually be acquired but the routines
      return "false" which results in a reference leak since the caller
      assumes it does not need to do a corresponding percpu_ref_put().
      
      This was seen when performing CPU hotplug during I/O, as hangs in
      blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start)
      raced with percpu_ref_tryget (blk_mq_timeout_work).
      Sample stack trace:
      
      __switch_to+0x2c0/0x450
      __schedule+0x2f8/0x970
      schedule+0x48/0xc0
      blk_mq_freeze_queue_wait+0x94/0x120
      blk_mq_queue_reinit_work+0xb8/0x180
      blk_mq_queue_reinit_prepare+0x84/0xa0
      cpuhp_invoke_callback+0x17c/0x600
      cpuhp_up_callbacks+0x58/0x150
      _cpu_up+0xf0/0x1c0
      do_cpu_up+0x120/0x150
      cpu_subsys_online+0x64/0xe0
      device_online+0xb4/0x120
      online_store+0xb4/0xc0
      dev_attr_store+0x68/0xa0
      sysfs_kf_write+0x80/0xb0
      kernfs_fop_write+0x17c/0x250
      __vfs_write+0x6c/0x1e0
      vfs_write+0xd0/0x270
      SyS_write+0x6c/0x110
      system_call+0x38/0xe0
      
      Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS,
      and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests.
      However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0
      and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set.
      
      The fix is to make the tryget routines use an actual boolean internally instead
      of the atomic long result truncated to a int.
      
      Fixes: e625305b percpu-refcount: make percpu_ref based on longs instead of ints
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751Signed-off-by: default avatarDouglas Miller <dougmill@linux.vnet.ibm.com>
      Reviewed-by: default avatarJens Axboe <axboe@fb.com>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Fixes: e625305b ("percpu-refcount: make percpu_ref based on longs instead of ints")
      Cc: stable@vger.kernel.org # v3.18+
      966d2b04
  2. 27 Jan, 2017 31 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 1b1bc42c
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) GTP fixes from Andreas Schultz (missing genl module alias, clear IP
          DF on transmit).
      
       2) Netfilter needs to reflect the fwmark when sending resets, from Pau
          Espin Pedrol.
      
       3) nftable dump OOPS fix from Liping Zhang.
      
       4) Fix erroneous setting of VIRTIO_NET_HDR_F_DATA_VALID on transmit,
          from Rolf Neugebauer.
      
       5) Fix build error of ipt_CLUSTERIP when procfs is disabled, from Arnd
          Bergmann.
      
       6) Fix regression in handling of NETIF_F_SG in harmonize_features(),
          from Eric Dumazet.
      
       7) Fix RTNL deadlock wrt. lwtunnel module loading, from David Ahern.
      
       8) tcp_fastopen_create_child() needs to setup tp->max_window, from
          Alexey Kodanev.
      
       9) Missing kmemdup() failure check in ipv6 segment routing code, from
          Eric Dumazet.
      
      10) Don't execute unix_bind() under the bindlock, otherwise we deadlock
          with splice. From WANG Cong.
      
      11) ip6_tnl_parse_tlv_enc_lim() potentially reallocates the skb buffer,
          therefore callers must reload cached header pointers into that skb.
          Fix from Eric Dumazet.
      
      12) Fix various bugs in legacy IRQ fallback handling in alx driver, from
          Tobias Regnery.
      
      13) Do not allow lwtunnel drivers to be unloaded while they are
          referenced by active instances, from Robert Shearman.
      
      14) Fix truncated PHY LED trigger names, from Geert Uytterhoeven.
      
      15) Fix a few regressions from virtio_net XDP support, from John
          Fastabend and Jakub Kicinski.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (102 commits)
        ISDN: eicon: silence misleading array-bounds warning
        net: phy: micrel: add support for KSZ8795
        gtp: fix cross netns recv on gtp socket
        gtp: clear DF bit on GTP packet tx
        gtp: add genl family modules alias
        tcp: don't annotate mark on control socket from tcp_v6_send_response()
        ravb: unmap descriptors when freeing rings
        virtio_net: reject XDP programs using header adjustment
        virtio_net: use dev_kfree_skb for small buffer XDP receive
        r8152: check rx after napi is enabled
        r8152: re-schedule napi for tx
        r8152: avoid start_xmit to schedule napi when napi is disabled
        r8152: avoid start_xmit to call napi_schedule during autosuspend
        net: dsa: Bring back device detaching in dsa_slave_suspend()
        net: phy: leds: Fix truncated LED trigger names
        net: phy: leds: Break dependency of phy.h on phy_led_triggers.h
        net: phy: leds: Clear phy_num_led_triggers on failure to avoid crash
        net-next: ethernet: mediatek: change the compatible string
        Documentation: devicetree: change the mediatek ethernet compatible string
        bnxt_en: Fix RTNL lock usage on bnxt_get_port_module_status().
        ...
      1b1bc42c
    • Linus Torvalds's avatar
      Merge tag 'xfs-for-linus-4.10-rc6-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 3365135d
      Linus Torvalds authored
      Pull xfs uodates from Darrick Wong:
       "I have some more fixes this week: better input validation, corruption
        avoidance, build fixes, memory leak fixes, and a couple from Christoph
        to avoid an ENOSPC failure.
      
        Summary:
         - Fix race conditions in the CoW code
         - Fix some incorrect input validation checks
         - Avoid crashing fs by running out of space when freeing inodes
         - Fix toctou race wrt whether or not an inode has an attr
         - Fix build error on arm
         - Fix page refcount corruption when readahead fails
         - Don't corrupt userspace in the bmap ioctl"
      
      * tag 'xfs-for-linus-4.10-rc6-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: prevent quotacheck from overloading inode lru
        xfs: fix bmv_count confusion w/ shared extents
        xfs: clear _XBF_PAGES from buffers when readahead page
        xfs: extsize hints are not unlikely in xfs_bmap_btalloc
        xfs: remove racy hasattr check from attr ops
        xfs: use per-AG reservations for the finobt
        xfs: only update mount/resv fields on success in __xfs_ag_resv_init
        xfs: verify dirblocklog correctly
        xfs: fix COW writeback race
      3365135d
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 59063744
      Linus Torvalds authored
      Pull btrfs updates from Chris Mason:
       "Some fixes that we've collected from the list.
      
        We still have one more pending to nail down a regression in lzo
        compression, but I wanted to get this batch out the door"
      
      * 'for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: remove ->{get, set}_acl() from btrfs_dir_ro_inode_operations
        Btrfs: disable xattr operations on subvolume directories
        Btrfs: remove old tree_root case in btrfs_read_locked_inode()
        Btrfs: fix truncate down when no_holes feature is enabled
        Btrfs: Fix deadlock between direct IO and fast fsync
        btrfs: fix false enospc error when truncating heavily reflinked file
      59063744
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 2fb78e89
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A set of fixes for this series. This contains:
      
         - Set of fixes for the nvme target code
      
         - A revert of patch from this merge window, causing a regression with
           WRITE_SAME on iSCSI targets at least.
      
         - A fix for a use-after-free in the new O_DIRECT bdev code.
      
         - Two fixes for the xen-blkfront driver"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        Revert "sd: remove __data_len hack for WRITE SAME"
        nvme-fc: use blk_rq_nr_phys_segments
        nvmet-rdma: Fix missing dma sync to nvme data structures
        nvmet: Call fatal_error from keep-alive timout expiration
        nvmet: cancel fatal error and flush async work before free controller
        nvmet: delete controllers deletion upon subsystem release
        nvmet_fc: correct logic in disconnect queue LS handling
        block: fix use after free in __blkdev_direct_IO
        xen-blkfront: correct maximum segment accounting
        xen-blkfront: feature flags handling adjustments
      2fb78e89
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · dd3b9f25
      Linus Torvalds authored
      Pull rdma fixes from Doug Ledford:
       "Second round of -rc fixes for 4.10.
      
        This -rc cycle has been slow for the rdma subsystem. I had already
        sent you the first batch before the Holiday break. After that, we kept
        only getting a few here or there. Up until this week, when I got a
        drop of 13 to one driver (qedr). So, here's the -rc patches I have. I
        currently have none held in reserve, so unless something new comes in,
        this is it until the next merge window opens.
      
        Summary:
      
         - series of iw_cxgb4 fixes to make it work with the drain cq API
      
         - one or two patches each to: srp, iser, cxgb3, vmw_pvrdma, umem,
           rxe, and ipoib
      
         - one big series (13 patches) for the new qedr driver"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: (27 commits)
        RDMA/cma: Fix unknown symbol when CONFIG_IPV6 is not enabled
        IB/rxe: Prevent from completer to operate on non valid QP
        IB/rxe: Fix rxe dev insertion to rxe_dev_list
        IB/umem: Release pid in error and ODP flow
        RDMA/qedr: Dispatch port active event from qedr_add
        RDMA/qedr: Fix and simplify memory leak in PD alloc
        RDMA/qedr: Fix RDMA CM loopback
        RDMA/qedr: Fix formatting
        RDMA/qedr: Mark three functions as static
        RDMA/qedr: Don't reset QP when queues aren't flushed
        RDMA/qedr: Don't spam dmesg if QP is in error state
        RDMA/qedr: Remove CQ spinlock from CM completion handlers
        RDMA/qedr: Return max inline data in QP query result
        RDMA/qedr: Return success when not changing QP state
        RDMA/qedr: Add uapi header qedr-abi.h
        RDMA/qedr: Fix MTU returned from QP query
        RDMA/core: Add the function ib_mtu_int_to_enum
        IB/vmw_pvrdma: Fix incorrect cleanup on pvrdma_pci_probe error path
        IB/vmw_pvrdma: Don't leak info from alloc_ucontext
        IB/cxgb3: fix misspelling in header guard
        ...
      dd3b9f25
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · 69978aa0
      Linus Torvalds authored
      Pull s390 fixes from Martin Schwidefsky:
       "Another two bug fixes:
      
         - ptrace partial write information leak
      
         - a guest page hinting regression introduced with v4.6"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/mm: Fix cmma unused transfer from pgste into pte
        s390/ptrace: Preserve previous registers for short regset write
      69978aa0
    • Linus Torvalds's avatar
      Merge branch 'stable/for-linus-4.10' of... · 2b432150
      Linus Torvalds authored
      Merge branch 'stable/for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb
      
      Pull swiotlb fix from Konrad Rzeszutek Wilk:
       "An ARM fix in the Xen SWIOTLB - mainly the translation of physical to
        bus addresses was done just a tad too late"
      
      * 'stable/for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb:
        swiotlb-xen: update dev_addr after swapping pages
      2b432150
    • Linus Torvalds's avatar
      Merge tag 'vfio-v4.10-rc6' of git://github.com/awilliam/linux-vfio · 3aebae06
      Linus Torvalds authored
      Pull VFIO fix from Alex Williamson:
       "mdev IOMMU groups are not yet compatible with the powerpc SPAPR IOMMU
        backend, detect and fail group attach (Greg Kurz)"
      
      * tag 'vfio-v4.10-rc6' of git://github.com/awilliam/linux-vfio:
        vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null
      3aebae06
    • Jack Morgenstein's avatar
      RDMA/cma: Fix unknown symbol when CONFIG_IPV6 is not enabled · b4cfe397
      Jack Morgenstein authored
      If IPV6 has not been enabled in the underlying kernel, we must avoid
      calling IPV6 procedures in rdma_cm.ko.
      
      This requires using "IS_ENABLED(CONFIG_IPV6)" in "if" statements
      surrounding any code which calls external IPV6 procedures.
      
      In the instance fixed here, procedure cma_bind_addr() called
      ipv6_addr_type() -- which resulted in calling external procedure
      __ipv6_addr_type().
      
      Fixes: 6c26a771 ("RDMA/cma: fix IPv6 address resolution")
      Cc: <stable@vger.kernel.org> # v4.2+
      Cc: Spencer Baugh <sbaugh@catern.com>
      Signed-off-by: default avatarJack Morgenstein <jackm@dev.mellanox.co.il>
      Reviewed-by: default avatarMoni Shoua <monis@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      b4cfe397
    • Jens Axboe's avatar
      Merge branch 'stable/for-jens-4.10' of... · c14024db
      Jens Axboe authored
      Merge branch 'stable/for-jens-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen into for-linus
      
      Konrad writes:
      
      Please pull in your 'for-linus' branch two little fixes for Xen
      block front:
      
      One fix is for handling the XEN_PAGE_SIZE != PAGE_SIZE (4KB vs 64KB
      on ARM for example) mishandling while the other is fixing
      the accounting for the configuration changes.
      c14024db
    • Linus Torvalds's avatar
      Merge tag 'media/v4.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 9d1d166f
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
      
       - fix a regression on tvp5150 causing failures at input selection and
         image glitches
      
       - CEC was moved out of staging for v4.10. Fix some bugs on it while not
         too late
      
       - fix a regression on pctv452e caused by VM stack changes
      
       - fix suspend issued with smiapp
      
       - fix a regression on cobalt driver
      
       - fix some warnings and Kconfig issues with some random configs.
      
      * tag 'media/v4.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        [media] s5k4ecgx: select CRC32 helper
        [media] dvb: avoid warning in dvb_net
        [media] v4l: tvp5150: Don't override output pinmuxing at stream on/off time
        [media] v4l: tvp5150: Fix comment regarding output pin muxing
        [media] v4l: tvp5150: Reset device at probe time, not in get/set format handlers
        [media] pctv452e: move buffer to heap, no mutex
        [media] media/cobalt: use pci_irq_allocate_vectors
        [media] cec: fix race between configuring and unconfiguring
        [media] cec: move cec_report_phys_addr into cec_config_thread_func
        [media] cec: replace cec_report_features by cec_fill_msg_report_features
        [media] cec: update log_addr[] before finishing configuration
        [media] cec: CEC_MSG_GIVE_FEATURES should abort for CEC version < 2
        [media] cec: when canceling a message, don't overwrite old status info
        [media] cec: fix report_current_latency
        [media] smiapp: Make suspend and resume functions __maybe_unused
        [media] smiapp: Implement power-on and power-off sequences without runtime PM
      9d1d166f
    • Linus Torvalds's avatar
      Merge tag 'mmc-v4.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · b84f0279
      Linus Torvalds authored
      Pull MMC fix from Ulf Hansson:
       "MMC host: fix runtime PM resume path in dw_mmc"
      
      * tag 'mmc-v4.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: dw_mmc: force setup bus if active slots exist
      b84f0279
    • Linus Torvalds's avatar
      Merge branch 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux · ed4d50c4
      Linus Torvalds authored
      Pull thermal management fix from Zhang Rui:
       "A single revert from a recently introduced problem.
      
        Specifics:
      
        Commit 7611fb68 ("thermal: thermal_hwmon: Convert to
        hwmon_device_register_with_info()"), which was introduced in 4.10-rc5,
        uses new hwmon API. But this breaks some soc thermal driver because
        the new hwmon API has a strict rule for the hwmon device name. Revert
        the offending commit as a quick solution for 4.10"
      
      * 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
        Revert "thermal: thermal_hwmon: Convert to hwmon_device_register_with_info()"
      ed4d50c4
    • Brian Foster's avatar
      xfs: prevent quotacheck from overloading inode lru · e0d76fa4
      Brian Foster authored
      Quotacheck runs at mount time in situations where quota accounting must
      be recalculated. In doing so, it uses bulkstat to visit every inode in
      the filesystem. Historically, every inode processed during quotacheck
      was released and immediately tagged for reclaim because quotacheck runs
      before the superblock is marked active by the VFS. In other words,
      the final iput() lead to an immediate ->destroy_inode() call, which
      allowed the XFS background reclaim worker to start reclaiming inodes.
      
      Commit 17c12bcd ("xfs: when replaying bmap operations, don't let
      unlinked inodes get reaped") marks the XFS superblock active sooner as
      part of the mount process to support caching inodes processed during log
      recovery. This occurs before quotacheck and thus means all inodes
      processed by quotacheck are inserted to the LRU on release.  The
      s_umount lock is held until the mount has completed and thus prevents
      the shrinkers from operating on the sb. This means that quotacheck can
      excessively populate the inode LRU and lead to OOM conditions on systems
      without sufficient RAM.
      
      Update the quotacheck bulkstat handler to set XFS_IGET_DONTCACHE on
      inodes processed by quotacheck. This causes ->drop_inode() to return 1
      and in turn causes iput_final() to evict the inode. This preserves the
      original quotacheck behavior and prevents it from overloading the LRU
      and running out of memory.
      
      CC: stable@vger.kernel.org # v4.9
      Reported-by: default avatarMartin Svec <martin.svec@zoner.cz>
      Signed-off-by: default avatarBrian Foster <bfoster@redhat.com>
      Reviewed-by: default avatarEric Sandeen <sandeen@redhat.com>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      e0d76fa4
    • Arnd Bergmann's avatar
      ISDN: eicon: silence misleading array-bounds warning · 950eabbd
      Arnd Bergmann authored
      With some gcc versions, we get a warning about the eicon driver,
      and that currently shows up as the only remaining warning in one
      of the build bots:
      
      In file included from ../drivers/isdn/hardware/eicon/message.c:30:0:
      eicon/message.c: In function 'mixer_notify_update':
      eicon/platform.h:333:18: warning: array subscript is above array bounds [-Warray-bounds]
      
      The code is easily changed to open-code the unusual PUT_WORD() line
      causing this to avoid the warning.
      
      Cc: stable@vger.kernel.org
      Link: http://arm-soc.lixom.net/buildlogs/stable-rc/v4.4.45/Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      950eabbd
    • Sean Nyekjaer's avatar
      net: phy: micrel: add support for KSZ8795 · 9d162ed6
      Sean Nyekjaer authored
      This is adds support for the PHYs in the KSZ8795 5port managed switch.
      
      It will allow to detect the link between the switch and the soc
      and uses the same read_status functions as the KSZ8873MLL switch.
      Signed-off-by: default avatarSean Nyekjaer <sean.nyekjaer@prevas.dk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9d162ed6
    • David S. Miller's avatar
      Merge branch 'gtp-fixes' · 95120ebf
      David S. Miller authored
      Andreas Schultz says:
      
      ====================
      various gtp fixes
      
      I'm sorry for the compile error mess up in the last version.
      It's no excuse for not test compiling, but the hunks got lost in
      a rebase.
      
      This is the part of the previous "simple gtp improvements" series
      that Pablo indicated should go into net.
      
      The addition of the module alias fixes genl family autoloading,
      clearing the DF bit fixes a protocol violation in regard to the
      specification and the netns comparison fixes a corner case of
      cross netns recv.
      
      v2->v3: fix compiler error introduced in rebase
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      95120ebf
    • Andreas Schultz's avatar
      gtp: fix cross netns recv on gtp socket · 3ab1b469
      Andreas Schultz authored
      The use of the passed through netlink src_net to check for a
      cross netns operation was wrong. Using the GTP socket and the
      GTP netdevice is always correct (even if the netdev has been
      moved to new netns after link creation).
      
      Remove the now obsolete net field from gtp_dev.
      Signed-off-by: default avatarAndreas Schultz <aschultz@tpip.net>
      Acked-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3ab1b469
    • Andreas Schultz's avatar
      gtp: clear DF bit on GTP packet tx · c6ce1d08
      Andreas Schultz authored
      3GPP TS 29.281 and 3GPP TS 29.060 imply that GTP-U packets should be
      sent with the DF bit cleared. For example 3GPP TS 29.060, Release 8,
      Section 13.2.2:
      
      > Backbone router: Any router in the backbone may fragment the GTP
      > packet if needed, according to IPv4.
      Signed-off-by: default avatarAndreas Schultz <aschultz@tpip.net>
      Acked-by: default avatarHarald Welte <laforge@netfilter.org>
      Acked-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c6ce1d08
    • Andreas Schultz's avatar
      gtp: add genl family modules alias · ab729823
      Andreas Schultz authored
      Auto-load the module when userspace asks for the gtp netlink
      family.
      Signed-off-by: default avatarAndreas Schultz <aschultz@tpip.net>
      Acked-by: default avatarHarald Welte <laforge@netfilter.org>
      Acked-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ab729823
    • Pablo Neira's avatar
      tcp: don't annotate mark on control socket from tcp_v6_send_response() · 92e55f41
      Pablo Neira authored
      Unlike ipv4, this control socket is shared by all cpus so we cannot use
      it as scratchpad area to annotate the mark that we pass to ip6_xmit().
      
      Add a new parameter to ip6_xmit() to indicate the mark. The SCTP socket
      family caches the flowi6 structure in the sctp_transport structure, so
      we cannot use to carry the mark unless we later on reset it back, which
      I discarded since it looks ugly to me.
      
      Fixes: bf99b4de ("tcp: fix mark propagation with fwmark_reflect enabled")
      Suggested-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      92e55f41
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.10-rc6-part-two' of git://people.freedesktop.org/~airlied/linux · fd694aaa
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This is the main request for rc6, since really the one earlier was the
        rc5 one :-)
      
        The main thing are the nouveau specific race fixes for the connector
        locking bug we fixed in -next and reverted here as it has quite large
        prereqs. These two fixes should solve the problem at that level and we
        can fix it properly in 4.11
      
        Otherwise i915 has a bunch of changes, one ABI change for GVT related
        stuff, some VC4 leak fixes, one core fence fix and some AMD changes,
        oh and one ast hang avoidance fix.
      
        Hoping it calms down around now"
      
      * tag 'drm-fixes-for-v4.10-rc6-part-two' of git://people.freedesktop.org/~airlied/linux: (25 commits)
        drm/nouveau: Handle fbcon suspend/resume in seperate worker
        drm/nouveau: Don't enabling polling twice on runtime resume
        drm/ast: Fixed system hanged if disable P2A
        Revert "drm/radeon: always apply pci shutdown callbacks"
        drm/i915: reinstate call to trace_i915_vma_bind
        drm/i915: Move atomic state free from out of fence release
        drm/i915: Check for NULL atomic state in intel_crtc_disable_noatomic()
        drm/i915: Fix calculation of rotated x and y offsets for planar formats
        drm/i915: Don't init hpd polling for vlv and chv from runtime_suspend()
        drm/i915: Don't leak edid in intel_crt_detect_ddc()
        drm/i915: Release temporary load-detect state upon switching
        drm/i915: prevent crash with .disable_display parameter
        drm/i915: Avoid drm_atomic_state_put(NULL) in intel_display_resume
        MAINTAINERS: update new mail list for intel gvt driver
        drm/i915/gvt: Fix kmem_cache_create() name
        drm/i915/gvt/kvmgt: mdev ABI is available_instances, not available_instance
        drm/amdgpu: fix unload driver issue for virtual display
        drm/amdgpu: check ring being ready before using
        drm/vc4: Return -EINVAL on the overflow checks failing.
        drm/vc4: Fix an integer overflow in temporary allocation layout.
        ...
      fd694aaa
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2017-01-26' of... · 736a1494
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2017-01-26' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes
      
      More fixes than I'd like at this stage, but I think the holidays and
      conferences have delayed finding and fixing the stuff a bit. Almost all
      of them have Fixes: tags, so it's not just random fixes, we can point
      fingers at the commits that broke stuff.
      
      There's an ABI fix to GVT from Alex, before we go on an release a kernel
      with the wrong attribute name.
      
      * tag 'drm-intel-fixes-2017-01-26' of git://anongit.freedesktop.org/git/drm-intel:
        drm/i915: reinstate call to trace_i915_vma_bind
        drm/i915: Move atomic state free from out of fence release
        drm/i915: Check for NULL atomic state in intel_crtc_disable_noatomic()
        drm/i915: Fix calculation of rotated x and y offsets for planar formats
        drm/i915: Don't init hpd polling for vlv and chv from runtime_suspend()
        drm/i915: Don't leak edid in intel_crt_detect_ddc()
        drm/i915: Release temporary load-detect state upon switching
        drm/i915: prevent crash with .disable_display parameter
        drm/i915: Avoid drm_atomic_state_put(NULL) in intel_display_resume
        MAINTAINERS: update new mail list for intel gvt driver
        drm/i915/gvt: Fix kmem_cache_create() name
        drm/i915/gvt/kvmgt: mdev ABI is available_instances, not available_instance
        drm/i915/gvt: Fix relocation of shadow bb
        drm/i915/gvt: Enable the shadow batch buffer
      736a1494
    • Linus Torvalds's avatar
      Merge tag 'acpi-4.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 2287a240
      Linus Torvalds authored
      Pull ACPI fixes from Rafael Wysocki:
       "These fix two regressions introduced recently, one by reverting the
        problematic commit and one by fixing up locking in the ACPICA core.
      
        Specifics:
      
         - Revert a recent change that added an ACPI video blacklist entry for
           HP Pavilion dv6 as it turned to introduce backlight handling
           regressions on some systems (Hans de Goede).
      
         - Fix locking in the ACPICA core to avoid deadlocks related to table
           loading that were exposed by a recent change in that area (Lv
           Zheng)"
      
      * tag 'acpi-4.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        Revert "ACPI / video: Add force_native quirk for HP Pavilion dv6"
        ACPICA: Tables: Fix hidden logic related to acpi_tb_install_standard_table()
      2287a240
    • Linus Torvalds's avatar
      Merge tag 'pm-4.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 7d3a0fa5
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "These fix two regressions introduced recently, one by reverting the
        problematic commit and one by fixing up the behavior in an overlooked
        case.
      
        Specifics:
      
         - Revert the recent change that caused suspend-to-idle to be used as
           the default suspend method on systems where it is indicated to be
           efficient by the ACPI tables, as that turned out to be premature
           and introduced suspend regressions on some systems with missing
           power management support in device drivers (Rafael Wysocki).
      
         - Fix up the intel_pstate driver to take changes of the global limits
           via sysfs correctly when the performance policy is used which has
           been broken by a recent change in it (Srinivas Pandruvada)"
      
      * tag 'pm-4.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        cpufreq: intel_pstate: Fix sysfs limits enforcement for performance policy
        Revert "PM / sleep / ACPI: Use the ACPI_FADT_LOW_POWER_S0 flag"
      7d3a0fa5
    • Lyude Paul's avatar
      drm/nouveau: Handle fbcon suspend/resume in seperate worker · 15266ae3
      Lyude Paul authored
      Resuming from RPM can happen while already holding
      dev->mode_config.mutex. This means we can't actually handle fbcon in
      any RPM resume workers, since restoring fbcon requires grabbing
      dev->mode_config.mutex again. So move the fbcon suspend/resume code into
      it's own worker, and rely on that instead to avoid deadlocking.
      
      This fixes more deadlocks for runtime suspending the GPU on the ThinkPad
      W541. Reproduction recipe:
      
       - Get a machine with both optimus and a nvidia card with connectors
         attached to it
       - Wait for the nvidia GPU to suspend
       - Attempt to manually reprobe any of the connectors on the nvidia GPU
         using sysfs
       - *deadlock*
      
      [airlied: use READ_ONCE to address Hans's comment]
      Signed-off-by: default avatarLyude <lyude@redhat.com>
      Cc: Hans de Goede <hdegoede@redhat.com>
      Cc: Kilian Singer <kilian.singer@quantumtechnology.info>
      Cc: Lukas Wunner <lukas@wunner.de>
      Cc: David Airlie <airlied@redhat.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      15266ae3
    • Lyude Paul's avatar
      drm/nouveau: Don't enabling polling twice on runtime resume · cae9ff03
      Lyude Paul authored
      As it turns out, on cards that actually have CRTCs on them we're already
      calling drm_kms_helper_poll_enable(drm_dev) from
      nouveau_display_resume() before we call it in
      nouveau_pmops_runtime_resume(). This leads us to accidentally trying to
      enable polling twice, which results in a potential deadlock between the
      RPM locks and drm_dev->mode_config.mutex if we end up trying to enable
      polling the second time while output_poll_execute is running and holding
      the mode_config lock. As such, make sure we only enable polling in
      nouveau_pmops_runtime_resume() if we need to.
      
      This fixes hangs observed on the ThinkPad W541
      Signed-off-by: default avatarLyude <lyude@redhat.com>
      Cc: Hans de Goede <hdegoede@redhat.com>
      Cc: Kilian Singer <kilian.singer@quantumtechnology.info>
      Cc: Lukas Wunner <lukas@wunner.de>
      Cc: David Airlie <airlied@redhat.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      cae9ff03
    • Y.C. Chen's avatar
      drm/ast: Fixed system hanged if disable P2A · 6c971c09
      Y.C. Chen authored
      The original ast driver will access some BMC configuration through P2A bridge
      that can be disabled since AST2300 and after.
      It will cause system hanged if P2A bridge is disabled.
      Here is the update to fix it.
      Signed-off-by: default avatarY.C. Chen <yc_chen@aspeedtech.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      6c971c09
    • Dave Airlie's avatar
      Merge tag 'drm-vc4-fixes-2017-01-23' of https://github.com/anholt/linux into drm-fixes · e996598b
      Dave Airlie authored
      This pull request brings in a few little error checking fixes and one
      slow memory leak fix.
      
      * tag 'drm-vc4-fixes-2017-01-23' of https://github.com/anholt/linux:
        drm/vc4: Return -EINVAL on the overflow checks failing.
        drm/vc4: Fix an integer overflow in temporary allocation layout.
        drm/vc4: fix a bounds check
        drm/vc4: Fix memory leak of the CRTC state.
      e996598b
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.10' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 1fb2d354
      Dave Airlie authored
      Just a few small fixes.
      
      * 'drm-fixes-4.10' of git://people.freedesktop.org/~agd5f/linux:
        Revert "drm/radeon: always apply pci shutdown callbacks"
        drm/amdgpu: fix unload driver issue for virtual display
        drm/amdgpu: check ring being ready before using
      1fb2d354
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2017-01-23' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes · 99f300cf
      Dave Airlie authored
      Single fence fix.
      * tag 'drm-misc-fixes-2017-01-23' of git://anongit.freedesktop.org/git/drm-misc:
        drm/fence: fix memory overwrite when setting out_fence fd
      99f300cf
  3. 26 Jan, 2017 8 commits
    • Omar Sandoval's avatar
      Btrfs: remove ->{get, set}_acl() from btrfs_dir_ro_inode_operations · 57b59ed2
      Omar Sandoval authored
      Subvolume directory inodes can't have ACLs.
      
      Cc: <stable@vger.kernel.org> # 4.9.x
      Signed-off-by: default avatarOmar Sandoval <osandov@fb.com>
      Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarChris Mason <clm@fb.com>
      57b59ed2
    • Omar Sandoval's avatar
      Btrfs: disable xattr operations on subvolume directories · 1fdf4194
      Omar Sandoval authored
      When you snapshot a subvolume containing a subvolume, you get a
      placeholder directory where the subvolume would be. These directory
      inodes have ->i_ops set to btrfs_dir_ro_inode_operations. Previously,
      these i_ops didn't include the xattr operation callbacks. The conversion
      to xattr_handlers missed this case, leading to bogus attempts to set
      xattrs on these inodes. This manifested itself as failures when running
      delayed inodes.
      
      To fix this, clear IOP_XATTR in ->i_opflags on these inodes.
      
      Fixes: 6c6ef9f2 ("xattr: Stop calling {get,set,remove}xattr inode operations")
      Cc: Andreas Gruenbacher <agruenba@redhat.com>
      Reported-by: default avatarChris Murphy <lists@colorremedies.com>
      Tested-by: default avatarChris Murphy <lists@colorremedies.com>
      Cc: <stable@vger.kernel.org> # 4.9.x
      Signed-off-by: default avatarOmar Sandoval <osandov@fb.com>
      Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarChris Mason <clm@fb.com>
      1fdf4194
    • Omar Sandoval's avatar
      Btrfs: remove old tree_root case in btrfs_read_locked_inode() · 67ade058
      Omar Sandoval authored
      As Jeff explained in c2951f32 ("btrfs: remove old tree_root dirent
      processing in btrfs_real_readdir()"), supporting this old format is no
      longer necessary since the Btrfs magic number has been updated since we
      changed to the current format. There are other places where we still
      handle this old format, but since this is part of a fix that is going to
      stable, I'm only removing this one for now.
      
      Cc: <stable@vger.kernel.org> # 4.9.x
      Signed-off-by: default avatarOmar Sandoval <osandov@fb.com>
      Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarChris Mason <clm@fb.com>
      67ade058
    • Kazuya Mizuguchi's avatar
      ravb: unmap descriptors when freeing rings · a47b70ea
      Kazuya Mizuguchi authored
      "swiotlb buffer is full" errors occur after repeated initialisation of a
      device - f.e. suspend/resume or ip link set up/down. This is because memory
      mapped using dma_map_single() in ravb_ring_format() and ravb_start_xmit()
      is not released.  Resolve this problem by unmapping descriptors when
      freeing rings.
      
      Fixes: c156633f ("Renesas Ethernet AVB driver proper")
      Signed-off-by: default avatarKazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>
      [simon: reworked]
      Signed-off-by: default avatarSimon Horman <horms+renesas@verge.net.au>
      Acked-by: default avatarSergei Shtylyov <sergei.shtylyov@cogentembedded.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a47b70ea
    • Rafael J. Wysocki's avatar
      Merge branches 'acpica' and 'acpi-video' · 0389227d
      Rafael J. Wysocki authored
      * acpica:
        ACPICA: Tables: Fix hidden logic related to acpi_tb_install_standard_table()
      
      * acpi-video:
        Revert "ACPI / video: Add force_native quirk for HP Pavilion dv6"
      0389227d
    • Rafael J. Wysocki's avatar
      Merge branches 'pm-sleep' and 'pm-cpufreq' · ff7e593c
      Rafael J. Wysocki authored
      * pm-sleep:
        Revert "PM / sleep / ACPI: Use the ACPI_FADT_LOW_POWER_S0 flag"
      
      * pm-cpufreq:
        cpufreq: intel_pstate: Fix sysfs limits enforcement for performance policy
      ff7e593c
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 086cb6a4
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains a large batch with Netfilter fixes for
      your net tree, they are:
      
      1) Two patches to solve conntrack garbage collector cpu hogging, one to
         remove GC_MAX_EVICTS and another to look at the ratio (scanned entries
         vs. evicted entries) to make a decision on whether to reduce or not
         the scanning interval. From Florian Westphal.
      
      2) Two patches to fix incorrect set element counting if NLM_F_EXCL is
         is not set. Moreover, don't decrenent set->nelems from abort patch
         if -ENFILE which leaks a spare slot in the set. This includes a
         patch to deconstify the set walk callback to update set->ndeact.
      
      3) Two fixes for the fwmark_reflect sysctl feature: Propagate mark to
         reply packets both from nf_reject and local stack, from Pau Espin Pedrol.
      
      4) Fix incorrect handling of loopback traffic in rpfilter and nf_tables
         fib expression, from Liping Zhang.
      
      5) Fix oops on stateful objects netlink dump, when no filter is specified.
         Also from Liping Zhang.
      
      6) Fix a build error if proc is not available in ipt_CLUSTERIP, related
         to fix that was applied in the previous batch for net. From Arnd Bergmann.
      
      7) Fix lack of string validation in table, chain, set and stateful
         object names in nf_tables, from Liping Zhang. Moreover, restrict
         maximum log prefix length to 127 bytes, otherwise explicitly bail
         out.
      
      8) Two patches to fix spelling and typos in nf_tables uapi header file
         and Kconfig, patches from Alexander Alemayhu and William Breathitt Gray.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      086cb6a4
    • Darrick J. Wong's avatar
      xfs: fix bmv_count confusion w/ shared extents · c364b6d0
      Darrick J. Wong authored
      In a bmapx call, bmv_count is the total size of the array, including the
      zeroth element that userspace uses to supply the search key.  The output
      array starts at offset 1 so that we can set up the user for the next
      invocation.  Since we now can split an extent into multiple bmap records
      due to shared/unshared status, we have to be careful that we don't
      overflow the output array.
      
      In the original patch f86f4037 ("xfs: teach get_bmapx about shared
      extents and the CoW fork") I used cur_ext (the output index) to check
      for overflows, albeit with an off-by-one error.  Since nexleft no longer
      describes the number of unfilled slots in the output, we can rip all
      that out and use cur_ext for the overflow check directly.
      
      Failure to do this causes heap corruption in bmapx callers such as
      xfs_io and xfs_scrub.  xfs/328 can reproduce this problem.
      Reviewed-by: default avatarEric Sandeen <sandeen@redhat.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      c364b6d0