1. 14 May, 2018 4 commits
    • Rahul Lakkireddy's avatar
      cxgb4: collect hardware dump in second kernel · 1dde532d
      Rahul Lakkireddy authored
      Register callback to collect hardware/firmware dumps in second kernel
      before hardware/firmware is initialized. The dumps for each device
      will be available as elf notes in /proc/vmcore in second kernel.
      Signed-off-by: default avatarRahul Lakkireddy <rahul.lakkireddy@chelsio.com>
      Signed-off-by: default avatarGanesh Goudar <ganeshgr@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1dde532d
    • Rahul Lakkireddy's avatar
      vmcore: append device dumps to vmcore as elf notes · 7efe48df
      Rahul Lakkireddy authored
      Update read and mmap logic to append device dumps as additional notes
      before the other elf notes. We add device dumps before other elf notes
      because the other elf notes may not fill the elf notes buffer
      completely and we will end up with zero-filled data between the elf
      notes and the device dumps. Tools will then try to decode this
      zero-filled data as valid notes and we don't want that. Hence, adding
      device dumps before the other elf notes ensure that zero-filled data
      can be avoided. This also ensures that the device dumps and the
      other elf notes can be properly mmaped at page aligned address.
      
      Incorporate device dump size into the total vmcore size. Also update
      offsets for other program headers after the device dumps are added.
      
      Suggested-by: Eric Biederman <ebiederm@xmission.com>.
      Signed-off-by: default avatarRahul Lakkireddy <rahul.lakkireddy@chelsio.com>
      Signed-off-by: default avatarGanesh Goudar <ganeshgr@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7efe48df
    • Rahul Lakkireddy's avatar
      vmcore: add API to collect hardware dump in second kernel · 2724273e
      Rahul Lakkireddy authored
      The sequence of actions done by device drivers to append their device
      specific hardware/firmware logs to /proc/vmcore are as follows:
      
      1. During probe (before hardware is initialized), device drivers
      register to the vmcore module (via vmcore_add_device_dump()), with
      callback function, along with buffer size and log name needed for
      firmware/hardware log collection.
      
      2. vmcore module allocates the buffer with requested size. It adds
      an Elf note and invokes the device driver's registered callback
      function.
      
      3. Device driver collects all hardware/firmware logs into the buffer
      and returns control back to vmcore module.
      
      Ensure that the device dump buffer size is always aligned to page size
      so that it can be mmaped.
      
      Also, rename alloc_elfnotes_buf() to vmcore_alloc_buf() to make it more
      generic and reserve NT_VMCOREDD note type to indicate vmcore device
      dump.
      
      Suggested-by: Eric Biederman <ebiederm@xmission.com>.
      Signed-off-by: default avatarRahul Lakkireddy <rahul.lakkireddy@chelsio.com>
      Signed-off-by: default avatarGanesh Goudar <ganeshgr@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2724273e
    • Anders Roxell's avatar
      net: ipv4: ipconfig: fix unused variable · 289e1f4e
      Anders Roxell authored
      When CONFIG_PROC_FS isn't set, variable ipconfig_dir isn't used.
      net/ipv4/ipconfig.c:167:31: warning: ‘ipconfig_dir’ defined but not used [-Wunused-variable]
       static struct proc_dir_entry *ipconfig_dir;
                                     ^~~~~~~~~~~~
      Move the declaration of ipconfig_dir inside the CONFIG_PROC_FS ifdef to
      fix the warning.
      
      Fixes: c04d2cb2 ("ipconfig: Write NTP server IPs to /proc/net/ipconfig/ntp_servers")
      Signed-off-by: default avatarAnders Roxell <anders.roxell@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      289e1f4e
  2. 12 May, 2018 1 commit
  3. 11 May, 2018 35 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 4bc87198
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Verify lengths of keys provided by the user is AF_KEY, from Kevin
          Easton.
      
       2) Add device ID for BCM89610 PHY. Thanks to Bhadram Varka.
      
       3) Add Spectre guards to some ATM code, courtesy of Gustavo A. R.
          Silva.
      
       4) Fix infinite loop in NSH protocol code. To Eric Dumazet we are most
          grateful for this fix.
      
       5) Line up /proc/net/netlink headers properly. This fix from YU Bo, we
          do appreciate.
      
       6) Use after free in TLS code. Once again we are blessed by the
          honorable Eric Dumazet with this fix.
      
       7) Fix regression in TLS code causing stalls on partial TLS records.
          This fix is bestowed upon us by Andrew Tomt.
      
       8) Deal with too small MTUs properly in LLC code, another great gift
          from Eric Dumazet.
      
       9) Handle cached route flushing properly wrt. MTU locking in ipv4, to
          Hangbin Liu we give thanks for this.
      
      10) Fix regression in SO_BINDTODEVIC handling wrt. UDP socket demux.
          Paolo Abeni, he gave us this.
      
      11) Range check coalescing parameters in mlx4 driver, thank you Moshe
          Shemesh.
      
      12) Some ipv6 ICMP error handling fixes in rxrpc, from our good brother
          David Howells.
      
      13) Fix kexec on mlx5 by freeing IRQs in shutdown path. Daniel Juergens,
          you're the best!
      
      14) Don't send bonding RLB updates to invalid MAC addresses. Debabrata
          Benerjee saved us!
      
      15) Uh oh, we were leaking in udp_sendmsg and ping_v4_sendmsg. The ship
          is now water tight, thanks to Andrey Ignatov.
      
      16) IPSEC memory leak in ixgbe from Colin Ian King, man we've got holes
          everywhere!
      
      17) Fix error path in tcf_proto_create, Jiri Pirko what would we do
          without you!
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (92 commits)
        net sched actions: fix refcnt leak in skbmod
        net: sched: fix error path in tcf_proto_create() when modules are not configured
        net sched actions: fix invalid pointer dereferencing if skbedit flags missing
        ixgbe: fix memory leak on ipsec allocation
        ixgbevf: fix ixgbevf_xmit_frame()'s return type
        ixgbe: return error on unsupported SFP module when resetting
        ice: Set rq_last_status when cleaning rq
        ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg
        mlxsw: core: Fix an error handling path in 'mlxsw_core_bus_device_register()'
        bonding: send learning packets for vlans on slave
        bonding: do not allow rlb updates to invalid mac
        net/mlx5e: Err if asked to offload TC match on frag being first
        net/mlx5: E-Switch, Include VF RDMA stats in vport statistics
        net/mlx5: Free IRQs in shutdown path
        rxrpc: Trace UDP transmission failure
        rxrpc: Add a tracepoint to log ICMP/ICMP6 and error messages
        rxrpc: Fix the min security level for kernel calls
        rxrpc: Fix error reception on AF_INET6 sockets
        rxrpc: Fix missing start of call timeout
        qed: fix spelling mistake: "taskelt" -> "tasklet"
        ...
      4bc87198
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-4.17-2' of git://git.linux-nfs.org/projects/anna/linux-nfs · a1f45efb
      Linus Torvalds authored
      Pull NFS client fixes from Anna Schumaker:
       "These patches fix both a possible corruption during NFSoRDMA MR
        recovery, and a sunrpc tracepoint crash.
      
        Additionally, Trond has a new email address to put in the MAINTAINERS
        file"
      
      * tag 'nfs-for-4.17-2' of git://git.linux-nfs.org/projects/anna/linux-nfs:
        Change Trond's email address in MAINTAINERS
        sunrpc: Fix latency trace point crashes
        xprtrdma: Fix list corruption / DMAR errors during MR recovery
      a1f45efb
    • Roman Mashak's avatar
      net sched actions: fix refcnt leak in skbmod · a52956df
      Roman Mashak authored
      When application fails to pass flags in netlink TLV when replacing
      existing skbmod action, the kernel will leak refcnt:
      
      $ tc actions get action skbmod index 1
      total acts 0
      
              action order 0: skbmod pipe set smac 00:11:22:33:44:55
               index 1 ref 1 bind 0
      
      For example, at this point a buggy application replaces the action with
      index 1 with new smac 00:aa:22:33:44:55, it fails because of zero flags,
      however refcnt gets bumped:
      
      $ tc actions get actions skbmod index 1
      total acts 0
      
              action order 0: skbmod pipe set smac 00:11:22:33:44:55
               index 1 ref 2 bind 0
      $
      
      Tha patch fixes this by calling tcf_idr_release() on existing actions.
      
      Fixes: 86da71b5 ("net_sched: Introduce skbmod action")
      Signed-off-by: default avatarRoman Mashak <mrv@mojatatu.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a52956df
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-4.17-rc5' of git://github.com/ceph/ceph-client · ac428036
      Linus Torvalds authored
      Pull ceph fixes from Ilya Dryomov:
       "These patches fix two long-standing bugs in the DIO code path, one of
        which is a crash trivially triggerable with splice()"
      
      * tag 'ceph-for-4.17-rc5' of git://github.com/ceph/ceph-client:
        ceph: fix iov_iter issues in ceph_direct_read_write()
        libceph: add osd_req_op_extent_osd_data_bvecs()
        ceph: fix rsize/wsize capping in ceph_direct_read_write()
      ac428036
    • Dan Murphy's avatar
      net: phy: DP83TC811: Introduce support for the DP83TC811 phy · b753a9fa
      Dan Murphy authored
      Add support for the DP83811 phy.
      
      The DP83811 supports both rgmii and sgmii interfaces.
      There are 2 part numbers for this the DP83TC811R does not
      reliably support the SGMII interface but the DP83TC811S will.
      
      There is not a way to differentiate these parts from the
      hardware or register set.  So this is controlled via the DT
      to indicate which phy mode is required.  Or the part can be
      strapped to a certain interface.
      
      Data sheet can be found here:
      http://www.ti.com/product/DP83TC811S-Q1/description
      http://www.ti.com/product/DP83TC811R-Q1/descriptionSigned-off-by: default avatarDan Murphy <dmurphy@ti.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b753a9fa
    • Jiri Pirko's avatar
      net: sched: fix error path in tcf_proto_create() when modules are not configured · d68d75fd
      Jiri Pirko authored
      In case modules are not configured, error out when tp->ops is null
      and prevent later null pointer dereference.
      
      Fixes: 33a48927 ("sched: push TC filter protocol creation into a separate function")
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d68d75fd
    • Linus Torvalds's avatar
      Merge tag 'sh-for-4.17-fixes' of git://git.libc.org/linux-sh · 3f5f8596
      Linus Torvalds authored
      Pull arch/sh fixes from Rich Felker:
       "Fixes for critical regressions and a build failure.
      
        The regressions were introduced in 4.15 and 4.17-rc1 and prevented
        booting on affected systems"
      
      * tag 'sh-for-4.17-fixes' of git://git.libc.org/linux-sh:
        sh: switch to NO_BOOTMEM
        sh: mm: Fix unprotected access to struct device
        sh: fix build failure for J2 cpu with SMP disabled
      3f5f8596
    • Ganesh Goudar's avatar
      cxgb4: avoid schedule while atomic · 443e2dab
      Ganesh Goudar authored
      do not sleep while adding or deleting udp tunnel.
      
      Fixes: 846eac3f ("cxgb4: implement udp tunnel callbacks")
      Signed-off-by: default avatarGanesh Goudar <ganeshgr@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      443e2dab
    • Ganesh Goudar's avatar
      cxgb4: enable inner header checksum calculation · c50ae55e
      Ganesh Goudar authored
      set cntrl bits to indicate whether inner header checksum
      needs to be calculated whenever the packet is an encapsulated
      packet and enable supported encap features.
      
      Fixes: d0a1299c ("cxgb4: add support for vxlan segmentation offload")
      Signed-off-by: default avatarGanesh Goudar <ganeshgr@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c50ae55e
    • Arjun Vynipadath's avatar
      cxgb4: Fix {vxlan/geneve}_port initialization · 0e249898
      Arjun Vynipadath authored
      adapter->rawf_cnt was not initialized, thereby
      ndo_udp_tunnel_{add/del} was returning immediately
      without initializing {vxlan/geneve}_port.
      Also initializes mps_encap_entry refcnt.
      
      Fixes: 846eac3f ("cxgb4: implement udp tunnel callbacks")
      Signed-off-by: default avatarArjun Vynipadath <arjun@chelsio.com>
      Signed-off-by: default avatarGanesh Goudar <ganeshgr@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0e249898
    • Ganesh Goudar's avatar
      cxgb4: Add new T5 device id · f4a313b9
      Ganesh Goudar authored
      Add 0x50ad device id for new T5 card.
      Signed-off-by: default avatarGanesh Goudar <ganeshgr@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f4a313b9
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 7404bc27
      Linus Torvalds authored
      Pull arm64 fixes from Will Deacon:
       "There's a small memblock accounting problem when freeing the initrd
        and a Spectre-v2 mitigation for NVIDIA Denver CPUs which just requires
        a match on the CPU ID register.
      
        Summary:
      
         - Mitigate Spectre-v2 for NVIDIA Denver CPUs
      
         - Free memblocks corresponding to freed initrd area"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: capabilities: Add NVIDIA Denver CPU to bp_harden list
        arm64: Add MIDR encoding for NVIDIA CPUs
        arm64: To remove initrd reserved area entry from memblock
      7404bc27
    • Tonghao Zhang's avatar
    • Tonghao Zhang's avatar
      bonding: use the skb_get/set_queue_mapping · ae35c6f7
      Tonghao Zhang authored
      Use the skb_get_queue_mapping, skb_set_queue_mapping
      and skb_rx_queue_recorded for skb queue_mapping in bonding
      driver, but not use it directly.
      Signed-off-by: default avatarTonghao Zhang <xiangxia.m.yue@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ae35c6f7
    • Tonghao Zhang's avatar
      bonding: replace the return value type · dbdc8a21
      Tonghao Zhang authored
      The method ndo_start_xmit is defined as returning a
      netdev_tx_t, which is a typedef for an enum type,
      but the implementation in this driver returns an int.
      Signed-off-by: default avatarTonghao Zhang <xiangxia.m.yue@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dbdc8a21
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.17-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 5c6b5460
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "One fix for an actual regression, the change to the SYSCALL_DEFINE
        wrapper broke FTRACE_SYSCALLS for us due to a name mismatch. There's
        also another commit to the same code to make sure we match all our
        syscalls with various prefixes.
      
        And then just one minor build fix, and the removal of an unused
        variable that was removed and then snuck back in due to some rebasing.
      
        Thanks to: Naveen N. Rao"
      
      * tag 'powerpc-4.17-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/pseries: Fix CONFIG_NUMA=n build
        powerpc/trace/syscalls: Update syscall name matching logic to account for ppc_ prefix
        powerpc/trace/syscalls: Update syscall name matching logic
        powerpc/64: Remove unused paca->soft_enabled
      5c6b5460
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · c110a8b7
      Linus Torvalds authored
      Pull tracing fix from Steven Rostedt:
       "Working on some new updates to trace filtering, I noticed that the
        regex_match_front() test was updated to be limited to the size of the
        pattern instead of the full test string.
      
        But as the test string is not guaranteed to be nul terminated, it
        still needs to consider the size of the test string"
      
      * tag 'trace-v4.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Fix regex_match_front() to not over compare the test string
      c110a8b7
    • William Tu's avatar
      erspan: auto detect truncated ipv6 packets. · d5db21a3
      William Tu authored
      Currently the truncated bit is set only when 1) the mirrored packet
      is larger than mtu and 2) the ipv4 packet tot_len is larger than
      the actual skb->len.  This patch adds another case for detecting
      whether ipv6 packet is truncated or not, by checking the ipv6 header
      payload_len and the skb->len.
      Reported-by: default avatarXiaoyan Jin <xiaoyanj@vmware.com>
      Signed-off-by: default avatarWilliam Tu <u9012063@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d5db21a3
    • David S. Miller's avatar
      Merge branch 'mlxsw-spectrum_span-Two-minor-adjustments' · 755bbc1c
      David S. Miller authored
      Ido Schimmel says:
      
      ====================
      mlxsw: spectrum_span: Two minor adjustments
      
      Petr says:
      
      This patch set fixes a couple of nits in mlxsw's SPAN implementation:
      two counts of inaccurate variable name and one count of unsuitable error
      code, fixed, respectively, in patches #1 and #2.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      755bbc1c
    • Petr Machata's avatar
      mlxsw: spectrum_span: Use a more fitting error code · c41c0dd7
      Petr Machata authored
      ENOENT is suitable when an item is looked for in a collection and can't
      be found. The failure here is actually a depletion of a resource, where
      ENOBUFS is the more fitting error code.
      Signed-off-by: default avatarPetr Machata <petrm@mellanox.com>
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c41c0dd7
    • Petr Machata's avatar
      mlxsw: spectrum_span: Rename misnamed variable l3edev · fc74ecbc
      Petr Machata authored
      Calling the variable l3edev was relevant when neighbor lookup was the
      last stage in the simulated pipeline. Now that mlxsw handles bridges and
      vlan devices as well, calling it "L3" is a misnomer.
      
      Thus in mlxsw_sp_span_dmac(), rename to "dev", because that function is
      just a service routine where the distinction between tunnel and egress
      device isn't necessary.
      
      In mlxsw_sp_span_entry_tunnel_parms_common(), rename to "edev" to
      emphasize that the routine traces packet egress.
      Signed-off-by: default avatarPetr Machata <petrm@mellanox.com>
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fc74ecbc
    • David S. Miller's avatar
      Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue · f4d641a2
      David S. Miller authored
      Jeff Kirsher says:
      
      ====================
      Intel Wired LAN Driver Updates 2018-05-11
      
      This series contains fixes to the ice, ixgbe and ixgbevf drivers.
      
      Jeff Shaw provides a fix to ensure rq_last_status gets set, whether or
      not the hardware responds with an error in the ice driver.
      
      Emil adds a check for unsupported module during the reset routine for
      ixgbe.
      
      Luc Van Oostenryck fixes ixgbevf_xmit_frame() where it was not using the
      correct return value (int).
      
      Colin Ian King fixes a potential resource leak in ixgbe, where we were
      not freeing ipsec in our cleanup path.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f4d641a2
    • David S. Miller's avatar
      Merge tag 'rxrpc-fixes-20180510' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs · f0100891
      David S. Miller authored
      David Howells says:
      
      ====================
      rxrpc: Fixes
      
      Here are three fixes for AF_RXRPC and two tracepoints that were useful for
      finding them:
      
       (1) Fix missing start of expect-Rx-by timeout on initial packet
           transmission so that calls will time out if the peer doesn't respond.
      
       (2) Fix error reception on AF_INET6 sockets by using the correct family of
           sockopts on the UDP transport socket.
      
       (3) Fix setting the minimum security level on kernel calls so that they
           can be encrypted.
      
       (4) Add a tracepoint to log ICMP/ICMP6 and other error reports from the
           transport socket.
      
       (5) Add a tracepoint to log UDP sendmsg failure so that we can find out if
           transmission failure occurred on the UDP socket.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f0100891
    • Roman Mashak's avatar
      net sched actions: fix invalid pointer dereferencing if skbedit flags missing · af5d0184
      Roman Mashak authored
      When application fails to pass flags in netlink TLV for a new skbedit action,
      the kernel results in the following oops:
      
      [    8.307732] BUG: unable to handle kernel paging request at 0000000000021130
      [    8.309167] PGD 80000000193d1067 P4D 80000000193d1067 PUD 180e0067 PMD 0
      [    8.310595] Oops: 0000 [#1] SMP PTI
      [    8.311334] Modules linked in: kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd cryptd glue_helper serio_raw
      [    8.314190] CPU: 1 PID: 397 Comm: tc Not tainted 4.17.0-rc3+ #357
      [    8.315252] RIP: 0010:__tcf_idr_release+0x33/0x140
      [    8.316203] RSP: 0018:ffffa0718038f840 EFLAGS: 00010246
      [    8.317123] RAX: 0000000000000001 RBX: 0000000000021100 RCX: 0000000000000000
      [    8.319831] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000021100
      [    8.321181] RBP: 0000000000000000 R08: 000000000004adf8 R09: 0000000000000122
      [    8.322645] R10: 0000000000000000 R11: ffffffff9e5b01ed R12: 0000000000000000
      [    8.324157] R13: ffffffff9e0d3cc0 R14: 0000000000000000 R15: 0000000000000000
      [    8.325590] FS:  00007f591292e700(0000) GS:ffff8fcf5bc40000(0000) knlGS:0000000000000000
      [    8.327001] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [    8.327987] CR2: 0000000000021130 CR3: 00000000180e6004 CR4: 00000000001606a0
      [    8.329289] Call Trace:
      [    8.329735]  tcf_skbedit_init+0xa7/0xb0
      [    8.330423]  tcf_action_init_1+0x362/0x410
      [    8.331139]  ? try_to_wake_up+0x44/0x430
      [    8.331817]  tcf_action_init+0x103/0x190
      [    8.332511]  tc_ctl_action+0x11a/0x220
      [    8.333174]  rtnetlink_rcv_msg+0x23d/0x2e0
      [    8.333902]  ? _cond_resched+0x16/0x40
      [    8.334569]  ? __kmalloc_node_track_caller+0x5b/0x2c0
      [    8.335440]  ? rtnl_calcit.isra.31+0xf0/0xf0
      [    8.336178]  netlink_rcv_skb+0xdb/0x110
      [    8.336855]  netlink_unicast+0x167/0x220
      [    8.337550]  netlink_sendmsg+0x2a7/0x390
      [    8.338258]  sock_sendmsg+0x30/0x40
      [    8.338865]  ___sys_sendmsg+0x2c5/0x2e0
      [    8.339531]  ? pagecache_get_page+0x27/0x210
      [    8.340271]  ? filemap_fault+0xa2/0x630
      [    8.340943]  ? page_add_file_rmap+0x108/0x200
      [    8.341732]  ? alloc_set_pte+0x2aa/0x530
      [    8.342573]  ? finish_fault+0x4e/0x70
      [    8.343332]  ? __handle_mm_fault+0xbc1/0x10d0
      [    8.344337]  ? __sys_sendmsg+0x53/0x80
      [    8.345040]  __sys_sendmsg+0x53/0x80
      [    8.345678]  do_syscall_64+0x4f/0x100
      [    8.346339]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [    8.347206] RIP: 0033:0x7f591191da67
      [    8.347831] RSP: 002b:00007fff745abd48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
      [    8.349179] RAX: ffffffffffffffda RBX: 00007fff745abe70 RCX: 00007f591191da67
      [    8.350431] RDX: 0000000000000000 RSI: 00007fff745abdc0 RDI: 0000000000000003
      [    8.351659] RBP: 000000005af35251 R08: 0000000000000001 R09: 0000000000000000
      [    8.352922] R10: 00000000000005f1 R11: 0000000000000246 R12: 0000000000000000
      [    8.354183] R13: 00007fff745afed0 R14: 0000000000000001 R15: 00000000006767c0
      [    8.355400] Code: 41 89 d4 53 89 f5 48 89 fb e8 aa 20 fd ff 85 c0 0f 84 ed 00
      00 00 48 85 db 0f 84 cf 00 00 00 40 84 ed 0f 85 cd 00 00 00 45 84 e4 <8b> 53 30
      74 0d 85 d2 b8 ff ff ff ff 0f 8f b3 00 00 00 8b 43 2c
      [    8.358699] RIP: __tcf_idr_release+0x33/0x140 RSP: ffffa0718038f840
      [    8.359770] CR2: 0000000000021130
      [    8.360438] ---[ end trace 60c66be45dfc14f0 ]---
      
      The caller calls action's ->init() and passes pointer to "struct tc_action *a",
      which later may be initialized to point at the existing action, otherwise
      "struct tc_action *a" is still invalid, and therefore dereferencing it is an
      error as happens in tcf_idr_release, where refcnt is decremented.
      
      So in case of missing flags tcf_idr_release must be called only for
      existing actions.
      
      v2:
          - prepare patch for net tree
      
      Fixes: 5e1567ae ("net sched: skbedit action fix late binding")
      Signed-off-by: default avatarRoman Mashak <mrv@mojatatu.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      af5d0184
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.17-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 84c3a097
      Linus Torvalds authored
      Pull xen fix from Juergen Gross:
       "One fix for the kernel running as a fully virtualized guest using PV
        drivers on old Xen hypervisor versions"
      
      * tag 'for-linus-4.17-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        x86/xen: Reset VCPU0 info pointer after shared_info remap
      84c3a097
    • Colin Ian King's avatar
      ixgbe: fix memory leak on ipsec allocation · c89ebb96
      Colin Ian King authored
      The error clean up path kfree's adapter->ipsec and should be
      instead kfree'ing ipsec. Fix this.  Also, the err1 error exit path
      does not need to kfree ipsec because this failure path was for
      the failed allocation of ipsec.
      
      Detected by CoverityScan, CID#146424 ("Resource Leak")
      
      Fixes: 63a67fe2 ("ixgbe: add ipsec offload add and remove SA")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Acked-by: default avatarShannon Nelson <shannon.nelson@oracle.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      c89ebb96
    • Luc Van Oostenryck's avatar
      ixgbevf: fix ixgbevf_xmit_frame()'s return type · cf12aab6
      Luc Van Oostenryck authored
      The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
      which is a typedef for an enum type, but the implementation in this
      driver returns an 'int'.
      
      Fix this by returning 'netdev_tx_t' in this driver too.
      Signed-off-by: default avatarLuc Van Oostenryck <luc.vanoostenryck@gmail.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      cf12aab6
    • Emil Tantilov's avatar
      ixgbe: return error on unsupported SFP module when resetting · bbb27076
      Emil Tantilov authored
      Add check for unsupported module and return the error code.
      This fixes a Coverity hit due to unused return status from setup_sfp.
      Signed-off-by: default avatarEmil Tantilov <emil.s.tantilov@intel.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      bbb27076
    • Jeff Shaw's avatar
      ice: Set rq_last_status when cleaning rq · ea3beca4
      Jeff Shaw authored
      Prior to this commit, the rq_last_status was only set when hardware
      responded with an error. This leads to rq_last_status being invalid
      in the future when hardware eventually responds without error. This
      commit resolves the issue by unconditionally setting rq_last_status
      with the value returned in the descriptor.
      
      Fixes: 940b61af ("ice: Initialize PF and setup miscellaneous
      interrupt")
      Signed-off-by: default avatarJeff Shaw <jeffrey.b.shaw@intel.com>
      Signed-off-by: default avatarAnirudh Venkataramanan <anirudh.venkataramanan@intel.com>
      Tested-by: default avatarTony Brelinski <tonyx.brelinski@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      ea3beca4
    • Trond Myklebust's avatar
    • Rob Herring's avatar
      sh: switch to NO_BOOTMEM · ac21fc2d
      Rob Herring authored
      Commit 0fa1c579 ("of/fdt: use memblock_virt_alloc for early alloc")
      inadvertently switched the DT unflattening allocations from memblock to
      bootmem which doesn't work because the unflattening happens before
      bootmem is initialized. Swapping the order of bootmem init and
      unflattening could also fix this, but removing bootmem is desired. So
      enable NO_BOOTMEM on SH like other architectures have done.
      
      Fixes: 0fa1c579 ("of/fdt: use memblock_virt_alloc for early alloc")
      Reported-by: default avatarRich Felker <dalias@libc.org>
      Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
      Signed-off-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarRich Felker <dalias@libc.org>
      ac21fc2d
    • Linus Torvalds's avatar
      mmap: introduce sane default mmap limits · be83bbf8
      Linus Torvalds authored
      The internal VM "mmap()" interfaces are based on the mmap target doing
      everything using page indexes rather than byte offsets, because
      traditionally (ie 32-bit) we had the situation that the byte offset
      didn't fit in a register.  So while the mmap virtual address was limited
      by the word size of the architecture, the backing store was not.
      
      So we're basically passing "pgoff" around as a page index, in order to
      be able to describe backing store locations that are much bigger than
      the word size (think files larger than 4GB etc).
      
      But while this all makes a ton of sense conceptually, we've been dogged
      by various drivers that don't really understand this, and internally
      work with byte offsets, and then try to work with the page index by
      turning it into a byte offset with "pgoff << PAGE_SHIFT".
      
      Which obviously can overflow.
      
      Adding the size of the mapping to it to get the byte offset of the end
      of the backing store just exacerbates the problem, and if you then use
      this overflow-prone value to check various limits of your device driver
      mmap capability, you're just setting yourself up for problems.
      
      The correct thing for drivers to do is to do their limit math in page
      indices, the way the interface is designed.  Because the generic mmap
      code _does_ test that the index doesn't overflow, since that's what the
      mmap code really cares about.
      
      HOWEVER.
      
      Finding and fixing various random drivers is a sisyphean task, so let's
      just see if we can just make the core mmap() code do the limiting for
      us.  Realistically, the only "big" backing stores we need to care about
      are regular files and block devices, both of which are known to do this
      properly, and which have nice well-defined limits for how much data they
      can access.
      
      So let's special-case just those two known cases, and then limit other
      random mmap users to a backing store that still fits in "unsigned long".
      Realistically, that's not much of a limit at all on 64-bit, and on
      32-bit architectures the only worry might be the GPU drivers, which can
      have big physical address spaces.
      
      To make it possible for drivers like that to say that they are 64-bit
      clean, this patch does repurpose the "FMODE_UNSIGNED_OFFSET" bit in the
      file flags to allow drivers to mark their file descriptors as safe in
      the full 64-bit mmap address space.
      
      [ The timing for doing this is less than optimal, and this should really
        go in a merge window. But realistically, this needs wide testing more
        than it needs anything else, and being main-line is the only way to do
        that.
      
        So the earlier the better, even if it's outside the proper development
        cycle        - Linus ]
      
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Dan Carpenter <dan.carpenter@oracle.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Willy Tarreau <w@1wt.eu>
      Cc: Dave Airlie <airlied@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      be83bbf8
    • Linus Torvalds's avatar
      Merge tag 'pm-4.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 41e3e108
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "These fix two PCI power management regressions from the 4.13 cycle and
        one cpufreq schedutil governor bug introduced during the 4.12 cycle,
        drop a stale comment from the schedutil code and fix two mistakes in
        docs.
      
        Specifics:
      
         - Restore device_may_wakeup() check in pci_enable_wake() removed
           inadvertently during the 4.13 cycle to prevent systems from drawing
           excessive power when suspended or off, among other things (Rafael
           Wysocki).
      
         - Fix pci_dev_run_wake() to properly handle devices that only can
           signal PME# when in the D3cold power state (Kai Heng Feng).
      
         - Fix the schedutil cpufreq governor to avoid using UINT_MAX as the
           new CPU frequency in some cases due to a missing check (Rafael
           Wysocki).
      
         - Remove a stale comment regarding worker kthreads from the schedutil
           cpufreq governor (Juri Lelli).
      
         - Fix a copy-paste mistake in the intel_pstate driver documentation
           (Juri Lelli).
      
         - Fix a typo in the system sleep states documentation (Jonathan
           Neuschäfer)"
      
      * tag 'pm-4.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        PCI / PM: Check device_may_wakeup() in pci_enable_wake()
        PCI / PM: Always check PME wakeup capability for runtime wakeup support
        cpufreq: schedutil: Avoid using invalid next_freq
        cpufreq: schedutil: remove stale comment
        PM: docs: intel_pstate: fix Active Mode w/o HWP paragraph
        PM: docs: sleep-states: Fix a typo ("includig")
      41e3e108
    • Linus Torvalds's avatar
      Merge tag 'mtd/fixes-for-4.17-rc5' of git://git.infradead.org/linux-mtd · e03dc5d3
      Linus Torvalds authored
      Pull mtd fixes from Boris Brezillon:
      
       - make nand_soft_waitrdy() wait tWB before polling the status REG
      
       - fix BCH write in the the Marvell NAND controller driver
      
       - fix wrong picosec to msec conversion in the Marvell NAND controller
         driver
      
       - fix DMA handling in the TI OneNAND controllre driver
      
      * tag 'mtd/fixes-for-4.17-rc5' of git://git.infradead.org/linux-mtd:
        mtd: rawnand: Make sure we wait tWB before polling the STATUS reg
        mtd: rawnand: marvell: fix command xtype in BCH write hook
        mtd: rawnand: marvell: pass ms delay to wait_op
        mtd: onenand: omap2: Disable DMA for HIGHMEM buffers
      e03dc5d3
    • Eric Dumazet's avatar
      udp: avoid refcount_t saturation in __udp_gso_segment() · 575b65bc
      Eric Dumazet authored
      For some reason, Willem thought that the issue we fixed for TCP
      in commit 7ec318fe ("tcp: gso: avoid refcount_t warning from
      tcp_gso_segment()") was not relevant for UDP GSO.
      
      But syzbot found its way.
      
      refcount_t: saturated; leaking memory.
      WARNING: CPU: 0 PID: 10261 at lib/refcount.c:78 refcount_add_not_zero+0x2d4/0x320 lib/refcount.c:78
      Kernel panic - not syncing: panic_on_warn set ...
      
      CPU: 0 PID: 10261 Comm: syz-executor5 Not tainted 4.17.0-rc3+ #38
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x1b9/0x294 lib/dump_stack.c:113
       panic+0x22f/0x4de kernel/panic.c:184
       __warn.cold.8+0x163/0x1b3 kernel/panic.c:536
       report_bug+0x252/0x2d0 lib/bug.c:186
       fixup_bug arch/x86/kernel/traps.c:178 [inline]
       do_error_trap+0x1de/0x490 arch/x86/kernel/traps.c:296
       do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
       invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
      RIP: 0010:refcount_add_not_zero+0x2d4/0x320 lib/refcount.c:78
      RSP: 0018:ffff880196db6b90 EFLAGS: 00010282
      RAX: 0000000000000026 RBX: 00000000ffffff01 RCX: ffffc900040d9000
      RDX: 0000000000004a29 RSI: ffffffff8160f6f1 RDI: ffff880196db66f0
      RBP: ffff880196db6c78 R08: ffff8801b33d6740 R09: 0000000000000002
      R10: ffff8801b33d6740 R11: 0000000000000000 R12: 0000000000000000
      R13: 00000000ffffffff R14: ffff880196db6c50 R15: 0000000000020101
       refcount_add+0x1b/0x70 lib/refcount.c:102
       __udp_gso_segment+0xaa5/0xee0 net/ipv4/udp_offload.c:272
       udp4_ufo_fragment+0x592/0x7a0 net/ipv4/udp_offload.c:301
       inet_gso_segment+0x639/0x12b0 net/ipv4/af_inet.c:1342
       skb_mac_gso_segment+0x3ad/0x720 net/core/dev.c:2792
       __skb_gso_segment+0x3bb/0x870 net/core/dev.c:2865
       skb_gso_segment include/linux/netdevice.h:4050 [inline]
       validate_xmit_skb+0x54d/0xd90 net/core/dev.c:3122
       __dev_queue_xmit+0xbf8/0x34c0 net/core/dev.c:3579
       dev_queue_xmit+0x17/0x20 net/core/dev.c:3620
       neigh_direct_output+0x15/0x20 net/core/neighbour.c:1401
       neigh_output include/net/neighbour.h:483 [inline]
       ip_finish_output2+0xa5f/0x1840 net/ipv4/ip_output.c:229
       ip_finish_output+0x828/0xf80 net/ipv4/ip_output.c:317
       NF_HOOK_COND include/linux/netfilter.h:277 [inline]
       ip_output+0x21b/0x850 net/ipv4/ip_output.c:405
       dst_output include/net/dst.h:444 [inline]
       ip_local_out+0xc5/0x1b0 net/ipv4/ip_output.c:124
       ip_send_skb+0x40/0xe0 net/ipv4/ip_output.c:1434
       udp_send_skb.isra.37+0x5eb/0x1000 net/ipv4/udp.c:825
       udp_push_pending_frames+0x5c/0xf0 net/ipv4/udp.c:853
       udp_v6_push_pending_frames+0x380/0x3e0 net/ipv6/udp.c:1105
       udp_lib_setsockopt+0x59a/0x600 net/ipv4/udp.c:2403
       udpv6_setsockopt+0x95/0xa0 net/ipv6/udp.c:1447
       sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3046
       __sys_setsockopt+0x1bd/0x390 net/socket.c:1903
       __do_sys_setsockopt net/socket.c:1914 [inline]
       __se_sys_setsockopt net/socket.c:1911 [inline]
       __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1911
       do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Fixes: ad405857 ("udp: better wmem accounting on gso")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Willem de Bruijn <willemb@google.com>
      Cc: Alexander Duyck <alexander.h.duyck@intel.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Acked-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      575b65bc