1. 21 Jul, 2019 7 commits
    • Vlad Buslov's avatar
      net: sched: verify that q!=NULL before setting q->flags · 503d81d4
      Vlad Buslov authored
      In function int tc_new_tfilter() q pointer can be NULL when adding filter
      on a shared block. With recent change that resets TCQ_F_CAN_BYPASS after
      filter creation, following NULL pointer dereference happens in case parent
      block is shared:
      
      [  212.925060] BUG: kernel NULL pointer dereference, address: 0000000000000010
      [  212.925445] #PF: supervisor write access in kernel mode
      [  212.925709] #PF: error_code(0x0002) - not-present page
      [  212.925965] PGD 8000000827923067 P4D 8000000827923067 PUD 827924067 PMD 0
      [  212.926302] Oops: 0002 [#1] SMP KASAN PTI
      [  212.926539] CPU: 18 PID: 2617 Comm: tc Tainted: G    B             5.2.0+ #512
      [  212.926938] Hardware name: Supermicro SYS-2028TP-DECR/X10DRT-P, BIOS 2.0b 03/30/2017
      [  212.927364] RIP: 0010:tc_new_tfilter+0x698/0xd40
      [  212.927633] Code: 74 0d 48 85 c0 74 08 48 89 ef e8 03 aa 62 00 48 8b 84 24 a0 00 00 00 48 8d 78 10 48 89 44 24 18 e8 4d 0c 6b ff 48 8b 44 24 18 <83> 60 10 f
      b 48 85 ed 0f 85 3d fe ff ff e9 4f fe ff ff e8 81 26 f8
      [  212.928607] RSP: 0018:ffff88884fd5f5d8 EFLAGS: 00010296
      [  212.928905] RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000
      [  212.929201] RDX: 0000000000000007 RSI: 0000000000000004 RDI: 0000000000000297
      [  212.929402] RBP: ffff88886bedd600 R08: ffffffffb91d4b51 R09: fffffbfff7616e4d
      [  212.929609] R10: fffffbfff7616e4c R11: ffffffffbb0b7263 R12: ffff88886bc61040
      [  212.929803] R13: ffff88884fd5f950 R14: ffffc900039c5000 R15: ffff88835e927680
      [  212.929999] FS:  00007fe7c50b6480(0000) GS:ffff88886f980000(0000) knlGS:0000000000000000
      [  212.930235] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  212.930394] CR2: 0000000000000010 CR3: 000000085bd04002 CR4: 00000000001606e0
      [  212.930588] Call Trace:
      [  212.930682]  ? tc_del_tfilter+0xa40/0xa40
      [  212.930811]  ? __lock_acquire+0x5b5/0x2460
      [  212.930948]  ? find_held_lock+0x85/0xa0
      [  212.931081]  ? tc_del_tfilter+0xa40/0xa40
      [  212.931201]  rtnetlink_rcv_msg+0x4ab/0x5f0
      [  212.931332]  ? rtnl_dellink+0x490/0x490
      [  212.931454]  ? lockdep_hardirqs_on+0x260/0x260
      [  212.931589]  ? netlink_deliver_tap+0xab/0x5a0
      [  212.931717]  ? match_held_lock+0x1b/0x240
      [  212.931844]  netlink_rcv_skb+0xd0/0x200
      [  212.931958]  ? rtnl_dellink+0x490/0x490
      [  212.932079]  ? netlink_ack+0x440/0x440
      [  212.932205]  ? netlink_deliver_tap+0x161/0x5a0
      [  212.932335]  ? lock_downgrade+0x360/0x360
      [  212.932457]  ? lock_acquire+0xe5/0x210
      [  212.932579]  netlink_unicast+0x296/0x350
      [  212.932705]  ? netlink_attachskb+0x390/0x390
      [  212.932834]  ? _copy_from_iter_full+0xe0/0x3a0
      [  212.932976]  netlink_sendmsg+0x394/0x600
      [  212.937998]  ? netlink_unicast+0x350/0x350
      [  212.943033]  ? move_addr_to_kernel.part.0+0x90/0x90
      [  212.948115]  ? netlink_unicast+0x350/0x350
      [  212.953185]  sock_sendmsg+0x96/0xa0
      [  212.958099]  ___sys_sendmsg+0x482/0x520
      [  212.962881]  ? match_held_lock+0x1b/0x240
      [  212.967618]  ? copy_msghdr_from_user+0x250/0x250
      [  212.972337]  ? lock_downgrade+0x360/0x360
      [  212.976973]  ? rwlock_bug.part.0+0x60/0x60
      [  212.981548]  ? __mod_node_page_state+0x1f/0xa0
      [  212.986060]  ? match_held_lock+0x1b/0x240
      [  212.990567]  ? find_held_lock+0x85/0xa0
      [  212.994989]  ? do_user_addr_fault+0x349/0x5b0
      [  212.999387]  ? lock_downgrade+0x360/0x360
      [  213.003713]  ? find_held_lock+0x85/0xa0
      [  213.007972]  ? __fget_light+0xa1/0xf0
      [  213.012143]  ? sockfd_lookup_light+0x91/0xb0
      [  213.016165]  __sys_sendmsg+0xba/0x130
      [  213.020040]  ? __sys_sendmsg_sock+0xb0/0xb0
      [  213.023870]  ? handle_mm_fault+0x337/0x470
      [  213.027592]  ? page_fault+0x8/0x30
      [  213.031316]  ? lockdep_hardirqs_off+0xbe/0x100
      [  213.034999]  ? mark_held_locks+0x24/0x90
      [  213.038671]  ? do_syscall_64+0x1e/0xe0
      [  213.042297]  do_syscall_64+0x74/0xe0
      [  213.045828]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  213.049354] RIP: 0033:0x7fe7c527c7b8
      [  213.052792] Code: 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 65 8f 0c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f
      0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 89 54
      [  213.060269] RSP: 002b:00007ffc3f7908a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
      [  213.064144] RAX: ffffffffffffffda RBX: 000000005d34716f RCX: 00007fe7c527c7b8
      [  213.068094] RDX: 0000000000000000 RSI: 00007ffc3f790910 RDI: 0000000000000003
      [  213.072109] RBP: 0000000000000000 R08: 0000000000000001 R09: 00007fe7c5340cc0
      [  213.076113] R10: 0000000000404ec2 R11: 0000000000000246 R12: 0000000000000080
      [  213.080146] R13: 0000000000480640 R14: 0000000000000080 R15: 0000000000000000
      [  213.084147] Modules linked in: act_gact cls_flower sch_ingress nfsv3 nfs_acl nfs lockd grace fscache bridge stp llc sunrpc intel_rapl_msr intel_rapl_common
      [<1;69;32Msb_edac rdma_ucm rdma_cm x86_pkg_temp_thermal iw_cm intel_powerclamp ib_cm coretemp kvm_intel kvm irqbypass mlx5_ib ib_uverbs ib_core crct10dif_pclmul crc32_pc
      lmul crc32c_intel ghash_clmulni_intel mlx5_core intel_cstate intel_uncore iTCO_wdt igb iTCO_vendor_support mlxfw mei_me ptp ses intel_rapl_perf mei pcspkr ipmi
      _ssif i2c_i801 joydev enclosure pps_core lpc_ich ioatdma wmi dca ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter acpi_pad ast i2c_algo_bit drm_vram_helpe
      r ttm drm_kms_helper drm mpt3sas raid_class scsi_transport_sas
      [  213.112326] CR2: 0000000000000010
      [  213.117429] ---[ end trace adb58eb0a4ee6283 ]---
      
      Verify that q pointer is not NULL before setting the 'flags' field.
      
      Fixes: 3f05e688 ("net_sched: unset TCQ_F_CAN_BYPASS when adding filters")
      Signed-off-by: default avatarVlad Buslov <vladbu@mellanox.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      503d81d4
    • Christophe JAILLET's avatar
      chelsio: Fix a typo in a function name · 85d9bf97
      Christophe JAILLET authored
      It is likely that 'my3216_poll()' should be 'my3126_poll()'. (1 and 2
      switched in 3126.
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      85d9bf97
    • Navid Emamdoost's avatar
      allocate_flower_entry: should check for null deref · bb132083
      Navid Emamdoost authored
      allocate_flower_entry does not check for allocation success, but tries
      to deref the result. I only moved the spin_lock under null check, because
       the caller is checking allocation's status at line 652.
      Signed-off-by: default avatarNavid Emamdoost <navid.emamdoost@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bb132083
    • Christophe JAILLET's avatar
      net: hns3: typo in the name of a constant · 4803d010
      Christophe JAILLET authored
      All constant in 'enum HCLGE_MBX_OPCODE' start with HCLGE, except
      'HLCGE_MBX_PUSH_VLAN_INFO' (C and L switched)
      
      s/HLC/HCL/
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4803d010
    • Jeremy Sowden's avatar
      kbuild: add net/netfilter/nf_tables_offload.h to header-test blacklist. · 408d2bbb
      Jeremy Sowden authored
      net/netfilter/nf_tables_offload.h includes net/netfilter/nf_tables.h
      which is itself on the blacklist.
      Reported-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      Signed-off-by: default avatarJeremy Sowden <jeremy@azazel.net>
      Acked-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      408d2bbb
    • Christophe JAILLET's avatar
      tipc: Fix a typo · bad7f869
      Christophe JAILLET authored
      s/tipc_toprsv_listener_data_ready/tipc_topsrv_listener_data_ready/
      (r and s switched in topsrv)
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bad7f869
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2019-07-20' of... · 953ba0a6
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2019-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      We have a handful of fixes:
       * ignore bad CW parameters if we aren't using them,
         instead of warning
       * fix operation (and then build) with the new netlink vendor
         command policy requirement
       * fix a memory leak in an error path when setting beacons
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      953ba0a6
  2. 20 Jul, 2019 12 commits
  3. 19 Jul, 2019 21 commits
    • Linus Torvalds's avatar
      Merge tag 'drm-next-2019-07-19' of git://anongit.freedesktop.org/drm/drm · 31cc088a
      Linus Torvalds authored
      Pull drm fixes from Daniel Vetter:
       "Dave is back in shape, but now family got it so I'm doing the pull.
        Two things worthy of note:
      
         - nouveau feature pull was way too late, Dave&me decided to not take
           that, so Ben spun up a pull with just the fixes.
      
         - after some chatting with the arm display maintainers we decided to
           change a bit how that's maintained, for more oversight/review and
           cross vendor collab.
      
        More details below:
      
        nouveau:
         - bugfixes
         - TU116 enabling (minor iteration) :w
      
        amdgpu:
         - large pile of fixes for new hw support this release (navi, vega20)
         - audio hotplug fix
         - bunch of corner cases and small fixes all over for amdgpu/kfd
      
        komeda:
         - back out some new properties (from this merge window) that needs
           more pondering.
      
        bochs:
         - fb pitch setup
      
        core:
         - a new panel quirk
         - misc fixes"
      
      * tag 'drm-next-2019-07-19' of git://anongit.freedesktop.org/drm/drm: (73 commits)
        drm/nouveau/secboot/gp102-: remove WAR for SEC2 RTOS start bug
        drm/nouveau/flcn/gp102-: improve implementation of bind_context() on SEC2/GSP
        drm/nouveau: fix memory leak in nouveau_conn_reset()
        drm/nouveau/dmem: missing mutex_lock in error path
        drm/nouveau/hwmon: return EINVAL if the GPU is powered down for sensors reads
        drm/nouveau: fix bogus GPL-2 license header
        drm/nouveau: fix bogus GPL-2 license header
        drm/nouveau/i2c: Enable i2c pads & busses during preinit
        drm/nouveau/disp/tu102-: wire up scdc parameter setter
        drm/nouveau/core: recognise TU116 chipset
        drm/nouveau/kms: disallow dual-link harder if hdmi connection detected
        drm/nouveau/disp/nv50-: fix center/aspect-corrected scaling
        drm/nouveau/disp/nv50-: force scaler for any non-default LVDS/eDP modes
        drm/nouveau/mcp89/mmu: Use mcp77_mmu_new instead of g84_mmu_new on MCP89.
        drm/amd/display: init res_pool dccg_ref, dchub_ref with xtalin_freq
        drm/amdgpu/pm: remove check for pp funcs in freq sysfs handlers
        drm/amd/display: Force uclk to max for every state
        drm/amdkfd: Remove GWS from process during uninit
        drm/amd/amdgpu: Fix offset for vmid selection in debugfs interface
        drm/amd/powerplay: update vega20 driver if to fit latest SMU firmware
        ...
      31cc088a
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · dd4542d2
      Linus Torvalds authored
      Pull crypto fixes from Herbert Xu:
      
       - Fix missed wake-up race in padata
      
       - Use crypto_memneq in ccp
      
       - Fix version check in ccp
      
       - Fix fuzz test failure in ccp
      
       - Fix potential double free in crypto4xx
      
       - Fix compile warning in stm32
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
        crypto: ccp - Fix SEV_VERSION_GREATER_OR_EQUAL
        crypto: ccp/gcm - use const time tag comparison.
        crypto: ccp - memset structure fields to zero before reuse
        crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe
        crypto: stm32/hash - Fix incorrect printk modifier for size_t
      dd4542d2
    • Dave Jones's avatar
      Remove references to dead website. · 40ef768a
      Dave Jones authored
      This fell into disrepair a while ago, and the majority of hits to the
      snapshots were from bots, so it's more trouble to keep running than it's worth.
      Signed-off-by: default avatarDave Jones <davej@codemonkey.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      40ef768a
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 41ba485e
      Linus Torvalds authored
      Pull tracing fix from Steven Rostedt:
       "Eiichi Tsukata found a small bug from the fixup of the stack code
      
        Removing ULONG_MAX as the marker for the user stack trace end, made
        the tracing code not know where the end is. The end is now marked with
        a zero (NULL) pointer. Eiichi fixed this in the tracing code"
      
      * tag 'trace-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Fix user stack trace "??" output
      41ba485e
    • Linus Torvalds's avatar
      Merge tag 'csky-for-linus-5.3-rc1' of git://github.com/c-sky/csky-linux · a84d2d29
      Linus Torvalds authored
      Pull arch/csky pupdates from Guo Ren:
       "This round of csky subsystem gives two features (ASID algorithm
        update, Perf pmu record support) and some fixups.
      
        ASID updates:
         - Revert mmu ASID mechanism
         - Add new asid lib code from arm
         - Use generic asid algorithm to implement switch_mm
         - Improve tlb operation with help of asid
      
        Perf pmu record support:
         - Init pmu as a device
         - Add count-width property for csky pmu
         - Add pmu interrupt support
         - Fix perf record in kernel/user space
         - dt-bindings: Add csky PMU bindings
      
        Fixes:
         - Fixup no panic in kernel for some traps
         - Fixup some error count in 810 & 860.
         - Fixup abiv1 memset error"
      
      * tag 'csky-for-linus-5.3-rc1' of git://github.com/c-sky/csky-linux:
        csky: Fixup abiv1 memset error
        csky: Improve tlb operation with help of asid
        csky: Use generic asid algorithm to implement switch_mm
        csky: Add new asid lib code from arm
        csky: Revert mmu ASID mechanism
        dt-bindings: csky: Add csky PMU bindings
        dt-bindings: interrupt-controller: Update csky mpintc
        csky: Fixup some error count in 810 & 860.
        csky: Fix perf record in kernel/user space
        csky: Add pmu interrupt support
        csky: Add count-width property for csky pmu
        csky: Init pmu as a device
        csky: Fixup no panic in kernel for some traps
        csky: Select intc & timer drivers
      a84d2d29
    • Linus Torvalds's avatar
      Merge tag 'for-linus-5.3a-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · b5d72dda
      Linus Torvalds authored
      Pull xen updates from Juergen Gross:
       "Fixes and features:
      
         - A series to introduce a common command line parameter for disabling
           paravirtual extensions when running as a guest in virtualized
           environment
      
         - A fix for int3 handling in Xen pv guests
      
         - Removal of the Xen-specific tmem driver as support of tmem in Xen
           has been dropped (and it was experimental only)
      
         - A security fix for running as Xen dom0 (XSA-300)
      
         - A fix for IRQ handling when offlining cpus in Xen guests
      
         - Some small cleanups"
      
      * tag 'for-linus-5.3a-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen: let alloc_xenballooned_pages() fail if not enough memory free
        xen/pv: Fix a boot up hang revealed by int3 self test
        x86/xen: Add "nopv" support for HVM guest
        x86/paravirt: Remove const mark from x86_hyper_xen_hvm variable
        xen: Map "xen_nopv" parameter to "nopv" and mark it obsolete
        x86: Add "nopv" parameter to disable PV extensions
        x86/xen: Mark xen_hvm_need_lapic() and xen_x2apic_para_available() as __init
        xen: remove tmem driver
        Revert "x86/paravirt: Set up the virt_spin_lock_key after static keys get initialized"
        xen/events: fix binding user event channels to cpus
      b5d72dda
    • Linus Torvalds's avatar
      Merge tag 'iomap-5.3-merge-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 26473f83
      Linus Torvalds authored
      Pull iomap split/cleanup from Darrick Wong:
       "As promised, here's the second part of the iomap merge for 5.3, in
        which we break up iomap.c into smaller files grouped by functional
        area so that it'll be easier in the long run to maintain cohesiveness
        of code units and to review incoming patches. There are no functional
        changes and fs/iomap.c split cleanly.
      
        Summary:
      
         - Regroup the fs/iomap.c code by major functional area so that we can
           start development for 5.4 from a more stable base"
      
      * tag 'iomap-5.3-merge-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        iomap: move internal declarations into fs/iomap/
        iomap: move the main iteration code into a separate file
        iomap: move the buffered IO code into a separate file
        iomap: move the direct IO code into a separate file
        iomap: move the SEEK_HOLE code into a separate file
        iomap: move the file mapping reporting code into a separate file
        iomap: move the swapfile code into a separate file
        iomap: start moving code to fs/iomap/
      26473f83
    • Linus Torvalds's avatar
      Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 4f5ed131
      Linus Torvalds authored
      Pull misc vfs updates from Al Viro:
       "Assorted stuff"
      
      * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        perf_event_get(): don't bother with fget_raw()
        vfs: update d_make_root() description
      4f5ed131
    • Linus Torvalds's avatar
      Merge branch 'work.adfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · d2fbf4b6
      Linus Torvalds authored
      Pull adfs updates from Al Viro:
       "More ADFS patches from Russell King"
      
      * 'work.adfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        fs/adfs: add time stamp and file type helpers
        fs/adfs: super: limit idlen according to directory type
        fs/adfs: super: fix use-after-free bug
        fs/adfs: super: safely update options on remount
        fs/adfs: super: correct superblock flags
        fs/adfs: clean up indirect disc addresses and fragment IDs
        fs/adfs: clean up error message printing
        fs/adfs: use %pV for error messages
        fs/adfs: use format_version from disc_record
        fs/adfs: add helper to get filesystem size
        fs/adfs: add helper to get discrecord from map
        fs/adfs: correct disc record structure
      d2fbf4b6
    • Linus Torvalds's avatar
      Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 933a90bf
      Linus Torvalds authored
      Pull vfs mount updates from Al Viro:
       "The first part of mount updates.
      
        Convert filesystems to use the new mount API"
      
      * 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (63 commits)
        mnt_init(): call shmem_init() unconditionally
        constify ksys_mount() string arguments
        don't bother with registering rootfs
        init_rootfs(): don't bother with init_ramfs_fs()
        vfs: Convert smackfs to use the new mount API
        vfs: Convert selinuxfs to use the new mount API
        vfs: Convert securityfs to use the new mount API
        vfs: Convert apparmorfs to use the new mount API
        vfs: Convert openpromfs to use the new mount API
        vfs: Convert xenfs to use the new mount API
        vfs: Convert gadgetfs to use the new mount API
        vfs: Convert oprofilefs to use the new mount API
        vfs: Convert ibmasmfs to use the new mount API
        vfs: Convert qib_fs/ipathfs to use the new mount API
        vfs: Convert efivarfs to use the new mount API
        vfs: Convert configfs to use the new mount API
        vfs: Convert binfmt_misc to use the new mount API
        convenience helper: get_tree_single()
        convenience helper get_tree_nodev()
        vfs: Kill sget_userns()
        ...
      933a90bf
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 5f4fc6d4
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix AF_XDP cq entry leak, from Ilya Maximets.
      
       2) Fix handling of PHY power-down on RTL8411B, from Heiner Kallweit.
      
       3) Add some new PCI IDs to iwlwifi, from Ihab Zhaika.
      
       4) Fix handling of neigh timers wrt. entries added by userspace, from
          Lorenzo Bianconi.
      
       5) Various cases of missing of_node_put(), from Nishka Dasgupta.
      
       6) The new NET_ACT_CT needs to depend upon NF_NAT, from Yue Haibing.
      
       7) Various RDS layer fixes, from Gerd Rausch.
      
       8) Fix some more fallout from TCQ_F_CAN_BYPASS generalization, from
          Cong Wang.
      
       9) Fix FIB source validation checks over loopback, also from Cong Wang.
      
      10) Use promisc for unsupported number of filters, from Justin Chen.
      
      11) Missing sibling route unlink on failure in ipv6, from Ido Schimmel.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (90 commits)
        tcp: fix tcp_set_congestion_control() use from bpf hook
        ag71xx: fix return value check in ag71xx_probe()
        ag71xx: fix error return code in ag71xx_probe()
        usb: qmi_wwan: add D-Link DWM-222 A2 device ID
        bnxt_en: Fix VNIC accounting when enabling aRFS on 57500 chips.
        net: dsa: sja1105: Fix missing unlock on error in sk_buff()
        gve: replace kfree with kvfree
        selftests/bpf: fix test_xdp_noinline on s390
        selftests/bpf: fix "valid read map access into a read-only array 1" on s390
        net/mlx5: Replace kfree with kvfree
        MAINTAINERS: update netsec driver
        ipv6: Unlink sibling route in case of failure
        liquidio: Replace vmalloc + memset with vzalloc
        udp: Fix typo in net/ipv4/udp.c
        net: bcmgenet: use promisc for unsupported filters
        ipv6: rt6_check should return NULL if 'from' is NULL
        tipc: initialize 'validated' field of received packets
        selftests: add a test case for rp_filter
        fib: relax source validation check for loopback packets
        mlxsw: spectrum: Do not process learned records with a dummy FID
        ...
      5f4fc6d4
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · 249be851
      Linus Torvalds authored
      Merge yet more updates from Andrew Morton:
       "The rest of MM and a kernel-wide procfs cleanup.
      
        Summary of the more significant patches:
      
         - Patch series "mm/memory_hotplug: Factor out memory block
           devicehandling", v3. David Hildenbrand.
      
           Some spring-cleaning of the memory hotplug code, notably in
           drivers/base/memory.c
      
         - "mm: thp: fix false negative of shmem vma's THP eligibility". Yang
           Shi.
      
           Fix /proc/pid/smaps output for THP pages used in shmem.
      
         - "resource: fix locking in find_next_iomem_res()" + 1. Nadav Amit.
      
           Bugfix and speedup for kernel/resource.c
      
         - Patch series "mm: Further memory block device cleanups", David
           Hildenbrand.
      
           More spring-cleaning of the memory hotplug code.
      
         - Patch series "mm: Sub-section memory hotplug support". Dan
           Williams.
      
           Generalise the memory hotplug code so that pmem can use it more
           completely. Then remove the hacks from the libnvdimm code which
           were there to work around the memory-hotplug code's constraints.
      
         - "proc/sysctl: add shared variables for range check", Matteo Croce.
      
           We have about 250 instances of
      
                int zero;
                ...
                        .extra1 = &zero,
      
           in the tree. This is a tree-wide sweep to make all those private
           "zero"s and "one"s use global variables.
      
           Alas, it isn't practical to make those two global integers const"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (38 commits)
        proc/sysctl: add shared variables for range check
        mm: migrate: remove unused mode argument
        mm/sparsemem: cleanup 'section number' data types
        libnvdimm/pfn: stop padding pmem namespaces to section alignment
        libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields
        mm/devm_memremap_pages: enable sub-section remap
        mm: document ZONE_DEVICE memory-model implications
        mm/sparsemem: support sub-section hotplug
        mm/sparsemem: prepare for sub-section ranges
        mm: kill is_dev_zone() helper
        mm/hotplug: kill is_dev_zone() usage in __remove_pages()
        mm/sparsemem: convert kmalloc_section_memmap() to populate_section_memmap()
        mm/hotplug: prepare shrink_{zone, pgdat}_span for sub-section removal
        mm/sparsemem: add helpers track active portions of a section at boot
        mm/sparsemem: introduce a SECTION_IS_EARLY flag
        mm/sparsemem: introduce struct mem_section_usage
        drivers/base/memory.c: get rid of find_memory_block_hinted()
        mm/memory_hotplug: move and simplify walk_memory_blocks()
        mm/memory_hotplug: rename walk_memory_range() and pass start+size instead of pfns
        mm: make register_mem_sect_under_node() static
        ...
      249be851
    • Eiichi Tsukata's avatar
      tracing: Fix user stack trace "??" output · 6d54ceb5
      Eiichi Tsukata authored
      Commit c5c27a0a ("x86/stacktrace: Remove the pointless ULONG_MAX
      marker") removes ULONG_MAX marker from user stack trace entries but
      trace_user_stack_print() still uses the marker and it outputs unnecessary
      "??".
      
      For example:
      
                  less-1911  [001] d..2    34.758944: <user stack trace>
         =>  <00007f16f2295910>
         => ??
         => ??
         => ??
         => ??
         => ??
         => ??
         => ??
      
      The user stack trace code zeroes the storage before saving the stack, so if
      the trace is shorter than the maximum number of entries it can terminate
      the print loop if a zero entry is detected.
      
      Link: http://lkml.kernel.org/r/20190630085438.25545-1-devel@etsukata.com
      
      Cc: stable@vger.kernel.org
      Fixes: 4285f2fc ("tracing: Remove the ULONG_MAX stack trace hackery")
      Signed-off-by: default avatarEiichi Tsukata <devel@etsukata.com>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      6d54ceb5
    • Arnd Bergmann's avatar
      netfilter: bridge: make NF_TABLES_BRIDGE tristate · dfee0e99
      Arnd Bergmann authored
      The new nft_meta_bridge code fails to link as built-in when NF_TABLES
      is a loadable module.
      
      net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval':
      nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval'
      net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init':
      nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init'
      nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register'
      nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store'
      net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit':
      nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr'
      net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init':
      nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr'
      net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump'
      net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval'
      
      This can happen because the NF_TABLES_BRIDGE dependency itself is just a
      'bool'.  Make the symbol a 'tristate' instead so Kconfig can propagate the
      dependencies correctly.
      
      Fixes: 30e103fe ("netfilter: nft_meta: move bridge meta keys into nft_meta_bridge")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      dfee0e99
    • Dave Airlie's avatar
    • Dave Airlie's avatar
      Merge tag 'drm-next-5.3-2019-07-18' of git://people.freedesktop.org/~agd5f/linux into drm-next · 9fb7dc73
      Dave Airlie authored
      drm-next-5.3-2019-07-18:
      
      amdgpu:
      - Navi DC fix for secondary adapters
      - Fix Navi flickering with high res panels
      - Navi SMU fixes
      - Vega20 SMU fixes
      - Fixes for audio hotplug on HG systems
      - Fix for potential integer overflows on large buffer
        migrations
      - debugfs fixes for umr
      - Various other small fixes
      
      amdkfd:
      - Apply noretry setting consistently
      - Fix hang in eviction
      - Properly clean up GWS on uninit
      
      UAPI:
      - clarify a comment on ctx priority
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexdeucher@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190718211525.3374-1-alexander.deucher@amd.com
      9fb7dc73
    • Ben Skeggs's avatar
      drm/nouveau/secboot/gp102-: remove WAR for SEC2 RTOS start bug · 4d352dbd
      Ben Skeggs authored
      Appears to be fixed by "flcn/gp102-: improve implementation of
      bind_context() on SEC2/GSP".
      
      Tested on GP10[24678] and GV100.
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      4d352dbd
    • Ben Skeggs's avatar
      drm/nouveau/flcn/gp102-: improve implementation of bind_context() on SEC2/GSP · 5210e967
      Ben Skeggs authored
      Fixes various issues encountered while attempting to initialise ACR.
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      5210e967
    • Yongxin Liu's avatar
      drm/nouveau: fix memory leak in nouveau_conn_reset() · 09b90e2f
      Yongxin Liu authored
      In nouveau_conn_reset(), if connector->state is true,
      __drm_atomic_helper_connector_destroy_state() will be called,
      but the memory pointed by asyc isn't freed. Memory leak happens
      in the following function __drm_atomic_helper_connector_reset(),
      where newly allocated asyc->state will be assigned to connector->state.
      
      So using nouveau_conn_atomic_destroy_state() instead of
      __drm_atomic_helper_connector_destroy_state to free the "old" asyc.
      
      Here the is the log showing memory leak.
      
      unreferenced object 0xffff8c5480483c80 (size 192):
        comm "kworker/0:2", pid 188, jiffies 4294695279 (age 53.179s)
        hex dump (first 32 bytes):
          00 f0 ba 7b 54 8c ff ff 00 00 00 00 00 00 00 00  ...{T...........
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        backtrace:
          [<000000005005c0d0>] kmem_cache_alloc_trace+0x195/0x2c0
          [<00000000a122baed>] nouveau_conn_reset+0x25/0xc0 [nouveau]
          [<000000004fd189a2>] nouveau_connector_create+0x3a7/0x610 [nouveau]
          [<00000000c73343a8>] nv50_display_create+0x343/0x980 [nouveau]
          [<000000002e2b03c3>] nouveau_display_create+0x51f/0x660 [nouveau]
          [<00000000c924699b>] nouveau_drm_device_init+0x182/0x7f0 [nouveau]
          [<00000000cc029436>] nouveau_drm_probe+0x20c/0x2c0 [nouveau]
          [<000000007e961c3e>] local_pci_probe+0x47/0xa0
          [<00000000da14d569>] work_for_cpu_fn+0x1a/0x30
          [<0000000028da4805>] process_one_work+0x27c/0x660
          [<000000001d415b04>] worker_thread+0x22b/0x3f0
          [<0000000003b69f1f>] kthread+0x12f/0x150
          [<00000000c94c29b7>] ret_from_fork+0x3a/0x50
      Signed-off-by: default avatarYongxin Liu <yongxin.liu@windriver.com>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      09b90e2f
    • Ralph Campbell's avatar
      drm/nouveau/dmem: missing mutex_lock in error path · d304654b
      Ralph Campbell authored
      In nouveau_dmem_pages_alloc(), the drm->dmem->mutex is unlocked before
      calling nouveau_dmem_chunk_alloc() as shown when CONFIG_PROVE_LOCKING
      is enabled:
      
      [ 1294.871933] =====================================
      [ 1294.876656] WARNING: bad unlock balance detected!
      [ 1294.881375] 5.2.0-rc3+ #5 Not tainted
      [ 1294.885048] -------------------------------------
      [ 1294.889773] test-malloc-vra/6299 is trying to release lock (&drm->dmem->mutex) at:
      [ 1294.897482] [<ffffffffa01a220f>] nouveau_dmem_migrate_alloc_and_copy+0x79f/0xbf0 [nouveau]
      [ 1294.905782] but there are no more locks to release!
      [ 1294.910690]
      [ 1294.910690] other info that might help us debug this:
      [ 1294.917249] 1 lock held by test-malloc-vra/6299:
      [ 1294.921881]  #0: 0000000016e10454 (&mm->mmap_sem#2){++++}, at: nouveau_svmm_bind+0x142/0x210 [nouveau]
      [ 1294.931313]
      [ 1294.931313] stack backtrace:
      [ 1294.935702] CPU: 4 PID: 6299 Comm: test-malloc-vra Not tainted 5.2.0-rc3+ #5
      [ 1294.942786] Hardware name: ASUS X299-A/PRIME X299-A, BIOS 1401 05/21/2018
      [ 1294.949590] Call Trace:
      [ 1294.952059]  dump_stack+0x7c/0xc0
      [ 1294.955469]  ? nouveau_dmem_migrate_alloc_and_copy+0x79f/0xbf0 [nouveau]
      [ 1294.962213]  print_unlock_imbalance_bug.cold.52+0xca/0xcf
      [ 1294.967641]  lock_release+0x306/0x380
      [ 1294.971383]  ? nouveau_dmem_migrate_alloc_and_copy+0x79f/0xbf0 [nouveau]
      [ 1294.978089]  ? lock_downgrade+0x2d0/0x2d0
      [ 1294.982121]  ? find_held_lock+0xac/0xd0
      [ 1294.985979]  __mutex_unlock_slowpath+0x8f/0x3f0
      [ 1294.990540]  ? wait_for_completion+0x230/0x230
      [ 1294.995002]  ? rwlock_bug.part.2+0x60/0x60
      [ 1294.999197]  nouveau_dmem_migrate_alloc_and_copy+0x79f/0xbf0 [nouveau]
      [ 1295.005751]  ? page_mapping+0x98/0x110
      [ 1295.009511]  migrate_vma+0xa74/0x1090
      [ 1295.013186]  ? move_to_new_page+0x480/0x480
      [ 1295.017400]  ? __kmalloc+0x153/0x300
      [ 1295.021052]  ? nouveau_dmem_migrate_vma+0xd8/0x1e0 [nouveau]
      [ 1295.026796]  nouveau_dmem_migrate_vma+0x157/0x1e0 [nouveau]
      [ 1295.032466]  ? nouveau_dmem_init+0x490/0x490 [nouveau]
      [ 1295.037612]  ? vmacache_find+0xc2/0x110
      [ 1295.041537]  nouveau_svmm_bind+0x1b4/0x210 [nouveau]
      [ 1295.046583]  ? nouveau_svm_fault+0x13e0/0x13e0 [nouveau]
      [ 1295.051912]  drm_ioctl_kernel+0x14d/0x1a0
      [ 1295.055930]  ? drm_setversion+0x330/0x330
      [ 1295.059971]  drm_ioctl+0x308/0x530
      [ 1295.063384]  ? drm_version+0x150/0x150
      [ 1295.067153]  ? find_held_lock+0xac/0xd0
      [ 1295.070996]  ? __pm_runtime_resume+0x3f/0xa0
      [ 1295.075285]  ? mark_held_locks+0x29/0xa0
      [ 1295.079230]  ? _raw_spin_unlock_irqrestore+0x3c/0x50
      [ 1295.084232]  ? lockdep_hardirqs_on+0x17d/0x250
      [ 1295.088768]  nouveau_drm_ioctl+0x9a/0x100 [nouveau]
      [ 1295.093661]  do_vfs_ioctl+0x137/0x9a0
      [ 1295.097341]  ? ioctl_preallocate+0x140/0x140
      [ 1295.101623]  ? match_held_lock+0x1b/0x230
      [ 1295.105646]  ? match_held_lock+0x1b/0x230
      [ 1295.109660]  ? find_held_lock+0xac/0xd0
      [ 1295.113512]  ? __do_page_fault+0x324/0x630
      [ 1295.117617]  ? lock_downgrade+0x2d0/0x2d0
      [ 1295.121648]  ? mark_held_locks+0x79/0xa0
      [ 1295.125583]  ? handle_mm_fault+0x352/0x430
      [ 1295.129687]  ksys_ioctl+0x60/0x90
      [ 1295.133020]  ? mark_held_locks+0x29/0xa0
      [ 1295.136964]  __x64_sys_ioctl+0x3d/0x50
      [ 1295.140726]  do_syscall_64+0x68/0x250
      [ 1295.144400]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [ 1295.149465] RIP: 0033:0x7f1a3495809b
      [ 1295.153053] Code: 0f 1e fa 48 8b 05 ed bd 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d bd bd 0c 00 f7 d8 64 89 01 48
      [ 1295.171850] RSP: 002b:00007ffef7ed1358 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      [ 1295.179451] RAX: ffffffffffffffda RBX: 00007ffef7ed1628 RCX: 00007f1a3495809b
      [ 1295.186601] RDX: 00007ffef7ed13b0 RSI: 0000000040406449 RDI: 0000000000000004
      [ 1295.193759] RBP: 00007ffef7ed13b0 R08: 0000000000000000 R09: 000000000157e770
      [ 1295.200917] R10: 000000000151c010 R11: 0000000000000246 R12: 0000000040406449
      [ 1295.208083] R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
      
      Reacquire the lock before continuing to the next page.
      Signed-off-by: default avatarRalph Campbell <rcampbell@nvidia.com>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      d304654b
    • Karol Herbst's avatar
      drm/nouveau/hwmon: return EINVAL if the GPU is powered down for sensors reads · 68bf8b57
      Karol Herbst authored
      fixes bogus values userspace gets from hwmon while the GPU is powered down
      Signed-off-by: default avatarKarol Herbst <kherbst@redhat.com>
      Reviewed-by: default avatarRhys Kidd <rhyskidd@gmail.com>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      68bf8b57