1. 20 Feb, 2018 3 commits
  2. 19 Feb, 2018 36 commits
    • David S. Miller's avatar
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 79c0ef3e
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Prevent index integer overflow in ptr_ring, from Jason Wang.
      
       2) Program mvpp2 multicast filter properly, from Mikulas Patocka.
      
       3) The bridge brport attribute file is write only and doesn't have a
          ->show() method, don't blindly invoke it. From Xin Long.
      
       4) Inverted mask used in genphy_setup_forced(), from Ingo van Lil.
      
       5) Fix multiple definition issue with if_ether.h UAPI header, from
          Hauke Mehrtens.
      
       6) Fix GFP_KERNEL usage in atomic in RDS protocol code, from Sowmini
          Varadhan.
      
       7) Revert XDP redirect support from thunderx driver, it is not
          implemented properly. From Jesper Dangaard Brouer.
      
       8) Fix missing RTNL protection across some tipc operations, from Ying
          Xue.
      
       9) Return the correct IV bytes in the TLS getsockopt code, from Boris
          Pismenny.
      
      10) Take tclassid into consideration properly when doing FIB rule
          matching. From Stefano Brivio.
      
      11) cxgb4 device needs more PCI VPD quirks, from Casey Leedom.
      
      12) TUN driver doesn't align frags properly, and we can end up doing
          unaligned atomics on misaligned metadata. From Eric Dumazet.
      
      13) Fix various crashes found using DEBUG_PREEMPT in rmnet driver, from
          Subash Abhinov Kasiviswanathan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (56 commits)
        tg3: APE heartbeat changes
        mlxsw: spectrum_router: Do not unconditionally clear route offload indication
        net: qualcomm: rmnet: Fix possible null dereference in command processing
        net: qualcomm: rmnet: Fix warning seen with 64 bit stats
        net: qualcomm: rmnet: Fix crash on real dev unregistration
        sctp: remove the left unnecessary check for chunk in sctp_renege_events
        rxrpc: Work around usercopy check
        tun: fix tun_napi_alloc_frags() frag allocator
        udplite: fix partial checksum initialization
        skbuff: Fix comment mis-spelling.
        dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
        PCI/cxgb4: Extend T3 PCI quirk to T4+ devices
        cxgb4: fix trailing zero in CIM LA dump
        cxgb4: free up resources of pf 0-3
        fib_semantics: Don't match route with mismatching tclassid
        NFC: llcp: Limit size of SDP URI
        tls: getsockopt return record sequence number
        tls: reset the crypto info if copy_from_user fails
        tls: retrun the correct IV in getsockopt
        docs: segmentation-offloads.txt: add SCTP info
        ...
      79c0ef3e
    • Paolo Abeni's avatar
      tipc: don't call sock_release() in atomic context · 26736a08
      Paolo Abeni authored
      syzbot reported a scheduling while atomic issue at netns
      destruction time:
      
      BUG: sleeping function called from invalid context at net/core/sock.c:2769
      in_atomic(): 1, irqs_disabled(): 0, pid: 85, name: kworker/u4:3
      5 locks held by kworker/u4:3/85:
        #0:  ((wq_completion)"%s""netns"){+.+.}, at: [<00000000c9792deb>]
      process_one_work+0xaaf/0x1af0 kernel/workqueue.c:2084
        #1:  (net_cleanup_work){+.+.}, at: [<00000000adc12e2a>]
      process_one_work+0xb01/0x1af0 kernel/workqueue.c:2088
        #2:  (net_sem){++++}, at: [<000000009ccb5669>] cleanup_net+0x23f/0xd20
      net/core/net_namespace.c:494
        #3:  (net_mutex){+.+.}, at: [<00000000a92767d9>] cleanup_net+0xa7d/0xd20
      net/core/net_namespace.c:496
        #4:  (&(&srv->idr_lock)->rlock){+...}, at: [<000000001343e568>]
      spin_lock_bh include/linux/spinlock.h:315 [inline]
        #4:  (&(&srv->idr_lock)->rlock){+...}, at: [<000000001343e568>]
      tipc_topsrv_stop+0x231/0x610 net/tipc/topsrv.c:685
      CPU: 0 PID: 85 Comm: kworker/u4:3 Not tainted 4.16.0-rc1+ #230
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
      Google 01/01/2011
      Workqueue: netns cleanup_net
      Call Trace:
        __dump_stack lib/dump_stack.c:17 [inline]
        dump_stack+0x194/0x257 lib/dump_stack.c:53
        ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6128
        __might_sleep+0x95/0x190 kernel/sched/core.c:6081
        lock_sock_nested+0x37/0x110 net/core/sock.c:2769
        lock_sock include/net/sock.h:1463 [inline]
        tipc_release+0x103/0xff0 net/tipc/socket.c:572
        sock_release+0x8d/0x1e0 net/socket.c:594
        tipc_topsrv_stop+0x3c0/0x610 net/tipc/topsrv.c:696
        tipc_exit_net+0x15/0x40 net/tipc/core.c:96
        ops_exit_list.isra.6+0xae/0x150 net/core/net_namespace.c:148
        cleanup_net+0x6ba/0xd20 net/core/net_namespace.c:529
        process_one_work+0xbbf/0x1af0 kernel/workqueue.c:2113
        worker_thread+0x223/0x1990 kernel/workqueue.c:2247
        kthread+0x33c/0x400 kernel/kthread.c:238
        ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:429
      
      This is caused by tipc_topsrv_stop() releasing the listener socket
      with the idr lock held. This changeset addresses the issue moving
      the release operation outside such lock.
      
      Reported-and-tested-by: syzbot+749d9d87c294c00ca856@syzkaller.appspotmail.com
      Fixes: 0ef897be ("tipc: separate topology server listener socket from subcsriber sockets")
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Acked-by:  ///jon
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      26736a08
    • Jon Maloy's avatar
      tipc: fix bug on error path in tipc_topsrv_kern_subscr() · 96c252bf
      Jon Maloy authored
      In commit cc1ea9ffadf7 ("tipc: eliminate struct tipc_subscriber") we
      re-introduced an old bug on the error path in the function
      tipc_topsrv_kern_subscr(). We now re-introduce the correction too.
      
      Reported-by: syzbot+f62e0f2a0ef578703946@syzkaller.appspotmail.com
      Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      96c252bf
    • David S. Miller's avatar
      Merge branch 'pernet_ops-conversions-part-2' · cc35b396
      David S. Miller authored
      Kirill Tkhai says:
      
      ====================
      Converting pernet_operations (part #2)
      
      This patchset continues to review and to convert pernet_operations
      to async. There are mostly ipv6, also some regular used netfilter
      pernet_operations are involved. One more converted is cfg80211_pernet_ops.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cc35b396
    • Kirill Tkhai's avatar
      net: Convert iptable_filter_net_ops · da349fad
      Kirill Tkhai authored
      These pernet_operations register and unregister
      net::ipv4.iptable_filter table. Since there are
      no packets in-flight at the time of exit method
      is working, iptables rules should not be touched.
      Also, pernet_operations should not send ipv4
      packets each other. So, it's safe to mark them
      async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      da349fad
    • Kirill Tkhai's avatar
      net: Convert ip_tables_net_ops, udplite6_net_ops and xt_net_ops · 4d6b8076
      Kirill Tkhai authored
      ip_tables_net_ops and udplite6_net_ops create and destroy /proc entries.
      xt_net_ops does nothing.
      
      So, we are able to mark them async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4d6b8076
    • Kirill Tkhai's avatar
      net: Convert ip6_frags_ops · 5fc094f5
      Kirill Tkhai authored
      Exit methods calls inet_frags_exit_net() with global ip6_frags
      as argument. So, after we make the pernet_operations async,
      a pair of exit methods may be called to iterate this hash table.
      Since there is inet_frag_worker(), which already may work
      in parallel with inet_frags_exit_net(), and it can make the same
      cleanup, that inet_frags_exit_net() does, it's safe. So we may
      mark these pernet_operations as async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5fc094f5
    • Kirill Tkhai's avatar
      net: Convert fib6_net_ops, ipv6_addr_label_ops and ip6_segments_ops · d16784d9
      Kirill Tkhai authored
      These pernet_operations register and unregister tables
      and lists for packets forwarding. All of the entities
      are per-net. Init methods makes simple initializations,
      and since net is not visible for foreigners at the time
      it is working, it can't race with anything. Exit method
      is executed when there are only local devices, and there
      mustn't be packets in-flight. Also, it looks like no one
      pernet_operations want to send ipv6 packets to foreign
      net. The same reasons are for ipv6_addr_label_ops and
      ip6_segments_ops. So, we are able to mark all them as
      async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d16784d9
    • Kirill Tkhai's avatar
      net: Convert xfrm6_net_ops · b4891413
      Kirill Tkhai authored
      These pernet_operations create sysctl tables and
      initialize net::xfrm.xfrm6_dst_ops used for routing.
      It doesn't look like another pernet_operations send
      ipv6 packets to foreign net namespaces, so it should
      be safe to mark the pernet_operations as async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b4891413
    • Kirill Tkhai's avatar
      net: Convert ip6_flowlabel_net_ops · a7852a76
      Kirill Tkhai authored
      These pernet_operations create and destroy /proc entries.
      ip6_fl_purge() makes almost the same actions as timer
      ip6_fl_gc_timer does, and as it can be executed in parallel
      with ip6_fl_purge(), two parallel ip6_fl_purge() may be
      executed. So, we can mark it async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a7852a76
    • Kirill Tkhai's avatar
      net: Convert ping_v6_net_ops · ac34cb6c
      Kirill Tkhai authored
      These pernet_operations only register and unregister /proc
      entries, so it's possible to mark them async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ac34cb6c
    • Kirill Tkhai's avatar
      net: Convert ipv6_sysctl_net_ops · 58708cae
      Kirill Tkhai authored
      These pernet_operations create and destroy sysctl tables.
      They are not touched by another net pernet_operations.
      So, it's possible to execute them in parallel with others.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      58708cae
    • Kirill Tkhai's avatar
      net: Convert tcpv6_net_ops · fef65a2c
      Kirill Tkhai authored
      These pernet_operations create and destroy net::ipv6.tcp_sk
      socket, which is used in tcp_v6_send_response() only. It looks
      like foreign pernet_operations don't want to set ipv6 connection
      inside destroyed net, so this socket may be created in destroyed
      in parallel with anything else. inet_twsk_purge() is also safe
      for that, as described in patch for tcp_sk_ops. So, it's possible
      to mark them as async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fef65a2c
    • Kirill Tkhai's avatar
      net: Convert fib6_rules_net_ops · 7b7dd180
      Kirill Tkhai authored
      These pernet_operations register and unregister
      net::ipv6.fib6_rules_ops, which are used for
      routing. It looks like there are no pernet_operations,
      which send ipv6 packages to another net, so we
      are able to mark them as async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7b7dd180
    • Kirill Tkhai's avatar
      net: Convert ipv6_inetpeer_ops · 85ca51b2
      Kirill Tkhai authored
      net->ipv6.peers is dereferenced in three places via inet_getpeer_v6(),
      and it's used to handle skb. All the users of inet_getpeer_v6() do not
      look like be able to be called from foreign net pernet_operations, so
      we may mark them as async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      85ca51b2
    • Kirill Tkhai's avatar
      net: Convert raw6_net_ops, udplite6_net_ops, ipv6_proc_ops, if6_proc_net_ops... · 50911411
      Kirill Tkhai authored
      net: Convert raw6_net_ops, udplite6_net_ops, ipv6_proc_ops, if6_proc_net_ops and ip6_route_net_late_ops
      
      These pernet_operations create and destroy /proc entries
      and safely may be converted and safely may be mark as async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      50911411
    • Kirill Tkhai's avatar
      net: Convert icmpv6_sk_ops, ndisc_net_ops and igmp6_net_ops · 1a2e9332
      Kirill Tkhai authored
      These pernet_operations create and destroy net::ipv6.icmp_sk
      socket, used to send ICMP or error reply.
      
      Nobody can dereference the socket to handle a packet before
      net is initialized, as there is no routing; nobody can do
      that in parallel with exit, as all of devices are moved
      to init_net or destroyed and there are no packets it-flight.
      So, it's possible to mark these pernet_operations as async.
      
      The same for ndisc_net_ops and for igmp6_net_ops. The last
      one also creates and destroys /proc entries.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1a2e9332
    • Kirill Tkhai's avatar
      net: Convert ip6mr_net_ops · b01a59a4
      Kirill Tkhai authored
      These pernet_operations create and destroy /proc entries,
      populate and depopulate net::rules_ops and multiroute table.
      All the structures are pernet, and they are not touched
      by foreign net pernet_operations. So, it's possible to mark
      them async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b01a59a4
    • Kirill Tkhai's avatar
      net: Convert cfg80211_pernet_ops · 9c537ca1
      Kirill Tkhai authored
      This patch finishes converting pernet_operations
      registered in net/wireless directory.
      
      These pernet_operations have only exit method,
      which moves devices to init_net. This action
      is not pernet_operations-specific, and function
      cfg80211_switch_netns() may be called all time
      during the system life. All necessary protection
      against concurrent cfg80211_pernet_exit() is made
      by rtnl_lock(). So, cfg80211_pernet_ops is able
      to be marked as async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9c537ca1
    • Kirill Tkhai's avatar
      net: Convert inet6_net_ops · 753d525a
      Kirill Tkhai authored
      init method initializes sysctl defaults, allocates
      percpu arrays and creates /proc entries.
      exit method reverts the above.
      
      There are no pernet_operations, which are interested
      in the above entities of foreign net namespace, so
      inet6_net_ops are able to be marked as async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      753d525a
    • Prashant Sreedharan's avatar
      tg3: APE heartbeat changes · 506b0a39
      Prashant Sreedharan authored
      In ungraceful host shutdown or driver crash case BMC connectivity is
      lost. APE firmware is missing the driver state in this
      case to keep the BMC connectivity alive.
      This patch has below change to address this issue.
      
      Heartbeat mechanism with APE firmware. This heartbeat mechanism
      is needed to notify the APE firmware about driver state.
      
      This patch also has the change in wait time for APE event from
      1ms to 20ms as there can be some delay in getting response.
      
      v2: Drop inline keyword as per David suggestion.
      Signed-off-by: default avatarPrashant Sreedharan <prashant.sreedharan@broadcom.com>
      Signed-off-by: default avatarSatish Baddipadige <satish.baddipadige@broadcom.com>
      Signed-off-by: default avatarSiva Reddy Kallam <siva.kallam@broadcom.com>
      Acked-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      506b0a39
    • Jake Moroni's avatar
      dpaa_eth: fix pause capability advertisement logic · 3021efb4
      Jake Moroni authored
      The ADVERTISED_Asym_Pause bit was being improperly set when both
      rx and tx pause were enabled. When rx and tx are both enabled, only
      the ADVERTISED_Pause bit is supposed to be set.
      Signed-off-by: default avatarJake Moroni <mail@jakemoroni.com>
      Acked-by: default avatarMadalin Bucur <madalin.bucur@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3021efb4
    • Sergei Shtylyov's avatar
      sh_eth: simplify sh_eth_check_reset() · 607ea032
      Sergei Shtylyov authored
      The *while* loop in this function  can be turned into a normal *for* loop.
      And getting rid  of the  single return point saves us a few more LoCs...
      Signed-off-by: default avatarSergei Shtylyov <sergei.shtylyov@cogentembedded.com>
      Reviewed-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      607ea032
    • David S. Miller's avatar
      Merge branch 'dwmac-meson8b-small-cleanup' · c088165d
      David S. Miller authored
      Martin Blumenstingl says:
      
      ====================
      dwmac-meson8b: small cleanup
      
      This is a follow-up to my previous series "dwmac-meson8b: clock fixes for
      Meson8b" from [0].
      during the review of that series it was found that the clock registration
      could be simplified. now that the previous series has landed we can start
      cleaning up the clock registration.
      
      the goal of this series is to simplify the code in the dwmac-meson8b
      driver. no functional changes are intended.
      
      I have tested this on my Khadas VIM2 (GXM SoC, with RGMII PHY) and my
      Endless Mini (EC-100, Meson8b SoC with RMII PHY, .dts support is not part
      of mainline yet). no problems were found.
      
      [0] http://lists.infradead.org/pipermail/linux-amlogic/2018-January/006143.html
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c088165d
    • Martin Blumenstingl's avatar
      net: stmmac: dwmac-meson8b: make the clock configurations private · 8076759d
      Martin Blumenstingl authored
      The common clock framework needs access to the "clock configuration"
      structs during runtime.
      However, only the common clock framework should access these. Ensure
      this by moving the configuration structs out of struct meson8b_dwmac,
      so only meson8b_init_rgmii_tx_clk() and the common clock framework know
      about these configurations.
      Suggested-by: default avatarJerome Brunet <jbrunet@baylibre.com>
      Signed-off-by: default avatarMartin Blumenstingl <martin.blumenstingl@googlemail.com>
      Acked-by: default avatarJerome Brunet <jbrunet@baylibre.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8076759d
    • Martin Blumenstingl's avatar
      net: stmmac: dwmac-meson8b: only keep struct device around · b756371e
      Martin Blumenstingl authored
      Nothing in the dwmac-meson8b driver (except .probe itself) requires the
      platform_device anymore after .probe has finished. Replace it with a
      pointer to struct device since this is what the functions inside the
      driver are actually accessing.
      No functional changes.
      Signed-off-by: default avatarMartin Blumenstingl <martin.blumenstingl@googlemail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b756371e
    • Martin Blumenstingl's avatar
      net: stmmac: dwmac-meson8b: simplify clock registration · 11184a5f
      Martin Blumenstingl authored
      To goal of this patch is to simplify the registration of the RGMII TX
      clock (and it's parent clocks). This is achieved by:
      - introducing the meson8b_dwmac_register_clk helper-function to remove
        code duplication when registering a single clock (this saves a few
        lines since we have 4 clocks internally)
      - using devm_add_action_or_reset to disable the RGMII TX clock
        automatically when needed. This also allows us to re-use the standard
        stmmac_pltfr_remove function.
      - devm_kasprintf() and devm_kstrdup() are not used anymore to generate
        the clock name (these are replaced by a variable on the stack) because
        the common clock framework already uses kstrdup() internally.
      
      No functional changes intended.
      Signed-off-by: default avatarMartin Blumenstingl <martin.blumenstingl@googlemail.com>
      Reviewed-by: default avatarJerome Brunet <jbrunet@baylibre.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      11184a5f
    • Ido Schimmel's avatar
      mlxsw: spectrum_router: Do not unconditionally clear route offload indication · d1c95af3
      Ido Schimmel authored
      When mlxsw replaces (or deletes) a route it removes the offload
      indication from the replaced route. This is problematic for IPv4 routes,
      as the offload indication is stored in the fib_info which is usually
      shared between multiple routes.
      
      Instead of unconditionally clearing the offload indication, only clear
      it if no other route is using the fib_info.
      
      Fixes: 3984d1a8 ("mlxsw: spectrum_router: Provide offload indication using nexthop flags")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reported-by: default avatarAlexander Petrovskiy <alexpe@mellanox.com>
      Tested-by: default avatarAlexander Petrovskiy <alexpe@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d1c95af3
    • David S. Miller's avatar
      Merge branch 'qualcomm-rmnet-Fix-issues-with-CONFIG_DEBUG_PREEMPT-enabled' · cae69256
      David S. Miller authored
      Subash Abhinov Kasiviswanathan says:
      
      ====================
      net: qualcomm: rmnet: Fix issues with CONFIG_DEBUG_PREEMPT enabled
      
      Patch 1 and 2 fixes issues identified when CONFIG_DEBUG_PREEMPT was
      enabled. These involve APIs which were called in invalid contexts.
      
      Patch 3 is a null derefence fix identified by code inspection.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cae69256
    • Subash Abhinov Kasiviswanathan's avatar
      net: qualcomm: rmnet: Fix possible null dereference in command processing · f57bbaae
      Subash Abhinov Kasiviswanathan authored
      If a command packet with invalid mux id is received, the packet would
      not have a valid endpoint. This invalid endpoint maybe dereferenced
      leading to a crash. Identified by manual code inspection.
      
      Fixes: 3352e6c4 ("net: qualcomm: rmnet: Convert the muxed endpoint to hlist")
      Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f57bbaae
    • Subash Abhinov Kasiviswanathan's avatar
      net: qualcomm: rmnet: Fix warning seen with 64 bit stats · 4dba8bbc
      Subash Abhinov Kasiviswanathan authored
      With CONFIG_DEBUG_PREEMPT enabled, a warning was seen on device
      creation. This occurs due to the incorrect cpu API usage in
      ndo_get_stats64 handler.
      
      BUG: using smp_processor_id() in preemptible [00000000] code: rmnetcli/5743
      caller is debug_smp_processor_id+0x1c/0x24
      Call trace:
      [<ffffff9d48c8967c>] dump_backtrace+0x0/0x2a8
      [<ffffff9d48c89bbc>] show_stack+0x20/0x28
      [<ffffff9d4901fff8>] dump_stack+0xa8/0xe0
      [<ffffff9d490421e0>] check_preemption_disabled+0x104/0x108
      [<ffffff9d49042200>] debug_smp_processor_id+0x1c/0x24
      [<ffffff9d494a36b0>] rmnet_get_stats64+0x64/0x13c
      [<ffffff9d49b014e0>] dev_get_stats+0x68/0xd8
      [<ffffff9d49d58df8>] rtnl_fill_stats+0x54/0x140
      [<ffffff9d49b1f0b8>] rtnl_fill_ifinfo+0x428/0x9cc
      [<ffffff9d49b23834>] rtmsg_ifinfo_build_skb+0x80/0xf4
      [<ffffff9d49b23930>] rtnetlink_event+0x88/0xb4
      [<ffffff9d48cd21b4>] raw_notifier_call_chain+0x58/0x78
      [<ffffff9d49b028a4>] call_netdevice_notifiers_info+0x48/0x78
      [<ffffff9d49b08bf8>] __netdev_upper_dev_link+0x290/0x5e8
      [<ffffff9d49b08fcc>] netdev_master_upper_dev_link+0x3c/0x48
      [<ffffff9d494a2e74>] rmnet_newlink+0xf0/0x1c8
      [<ffffff9d49b23360>] rtnl_newlink+0x57c/0x6c8
      [<ffffff9d49b2355c>] rtnetlink_rcv_msg+0xb0/0x244
      [<ffffff9d49b5230c>] netlink_rcv_skb+0xb4/0xdc
      [<ffffff9d49b204f4>] rtnetlink_rcv+0x34/0x44
      [<ffffff9d49b51af0>] netlink_unicast+0x1ec/0x294
      [<ffffff9d49b51fdc>] netlink_sendmsg+0x320/0x390
      [<ffffff9d49ae6858>] sock_sendmsg+0x54/0x60
      [<ffffff9d49ae91bc>] SyS_sendto+0x1a0/0x1e4
      [<ffffff9d48c83770>] el0_svc_naked+0x24/0x28
      
      Fixes: 192c4b5d ("net: qualcomm: rmnet: Add support for 64 bit stats")
      Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4dba8bbc
    • Subash Abhinov Kasiviswanathan's avatar
      net: qualcomm: rmnet: Fix crash on real dev unregistration · b37f78f2
      Subash Abhinov Kasiviswanathan authored
      With CONFIG_DEBUG_PREEMPT enabled, a crash with the following call
      stack was observed when removing a real dev which had rmnet devices
      attached to it.
      To fix this, remove the netdev_upper link APIs and instead use the
      existing information in rmnet_port and rmnet_priv to get the
      association between real and rmnet devs.
      
      BUG: sleeping function called from invalid context
      in_atomic(): 0, irqs_disabled(): 0, pid: 5762, name: ip
      Preemption disabled at:
      [<ffffff9d49043564>] debug_object_active_state+0xa4/0x16c
      Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
      Modules linked in:
      PC is at ___might_sleep+0x13c/0x180
      LR is at ___might_sleep+0x17c/0x180
      [<ffffff9d48ce0924>] ___might_sleep+0x13c/0x180
      [<ffffff9d48ce09c0>] __might_sleep+0x58/0x8c
      [<ffffff9d49d6253c>] mutex_lock+0x2c/0x48
      [<ffffff9d48ed4840>] kernfs_remove_by_name_ns+0x48/0xa8
      [<ffffff9d48ed6ec8>] sysfs_remove_link+0x30/0x58
      [<ffffff9d49b05840>] __netdev_adjacent_dev_remove+0x14c/0x1e0
      [<ffffff9d49b05914>] __netdev_adjacent_dev_unlink_lists+0x40/0x68
      [<ffffff9d49b08820>] netdev_upper_dev_unlink+0xb4/0x1fc
      [<ffffff9d494a29f0>] rmnet_dev_walk_unreg+0x6c/0xc8
      [<ffffff9d49b00b40>] netdev_walk_all_lower_dev_rcu+0x58/0xb4
      [<ffffff9d494a30fc>] rmnet_config_notify_cb+0xf4/0x134
      [<ffffff9d48cd21b4>] raw_notifier_call_chain+0x58/0x78
      [<ffffff9d49b028a4>] call_netdevice_notifiers_info+0x48/0x78
      [<ffffff9d49b0b568>] rollback_registered_many+0x230/0x3c8
      [<ffffff9d49b0b738>] unregister_netdevice_many+0x38/0x94
      [<ffffff9d49b1e110>] rtnl_delete_link+0x58/0x88
      [<ffffff9d49b201dc>] rtnl_dellink+0xbc/0x1cc
      [<ffffff9d49b2355c>] rtnetlink_rcv_msg+0xb0/0x244
      [<ffffff9d49b5230c>] netlink_rcv_skb+0xb4/0xdc
      [<ffffff9d49b204f4>] rtnetlink_rcv+0x34/0x44
      [<ffffff9d49b51af0>] netlink_unicast+0x1ec/0x294
      [<ffffff9d49b51fdc>] netlink_sendmsg+0x320/0x390
      [<ffffff9d49ae6858>] sock_sendmsg+0x54/0x60
      [<ffffff9d49ae6f94>] ___sys_sendmsg+0x298/0x2b0
      [<ffffff9d49ae98f8>] SyS_sendmsg+0xb4/0xf0
      [<ffffff9d48c83770>] el0_svc_naked+0x24/0x28
      
      Fixes: ceed73a2 ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
      Fixes: 60d58f97 ("net: qualcomm: rmnet: Implement bridge mode")
      Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b37f78f2
    • Gustavo A. R. Silva's avatar
      net: dsa: mv88e6xxx: hwtstamp: remove unnecessary range checking tests · e21fed58
      Gustavo A. R. Silva authored
      _port_ is already known to be a valid index in the callers [1]. So
      these checks are unnecessary.
      
      [1] https://lkml.org/lkml/2018/2/16/469
      
      Addresses-Coverity-ID: 1465287
      Addresses-Coverity-ID: 1465291
      Suggested-by: default avatarRichard Cochran <richardcochran@gmail.com>
      Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e21fed58
    • Andrea Parri's avatar
      ptr_ring: Remove now-redundant smp_read_barrier_depends() · e3f9f417
      Andrea Parri authored
      Because READ_ONCE() now implies smp_read_barrier_depends(), the
      smp_read_barrier_depends() in __ptr_ring_consume() is redundant;
      this commit removes it and updates the comments.
      Signed-off-by: default avatarAndrea Parri <parri.andrea@gmail.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Jason Wang <jasowang@redhat.com>
      Cc: John Fastabend <john.fastabend@gmail.com>
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: <linux-kernel@vger.kernel.org>
      Cc: <netdev@vger.kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e3f9f417
    • Linus Torvalds's avatar
      Linux 4.16-rc2 · 91ab883e
      Linus Torvalds authored
      91ab883e
  3. 18 Feb, 2018 1 commit