1. 12 Feb, 2019 1 commit
  2. 11 Feb, 2019 7 commits
    • Francesco Ruggeri's avatar
      netfilter: compat: initialize all fields in xt_init · 8d29d16d
      Francesco Ruggeri authored
      If a non zero value happens to be in xt[NFPROTO_BRIDGE].cur at init
      time, the following panic can be caused by running
      
      % ebtables -t broute -F BROUTING
      
      from a 32-bit user level on a 64-bit kernel. This patch replaces
      kmalloc_array with kcalloc when allocating xt.
      
      [  474.680846] BUG: unable to handle kernel paging request at 0000000009600920
      [  474.687869] PGD 2037006067 P4D 2037006067 PUD 2038938067 PMD 0
      [  474.693838] Oops: 0000 [#1] SMP
      [  474.697055] CPU: 9 PID: 4662 Comm: ebtables Kdump: loaded Not tainted 4.19.17-11302235.AroraKernelnext.fc18.x86_64 #1
      [  474.707721] Hardware name: Supermicro X9DRT/X9DRT, BIOS 3.0 06/28/2013
      [  474.714313] RIP: 0010:xt_compat_calc_jump+0x2f/0x63 [x_tables]
      [  474.720201] Code: 40 0f b6 ff 55 31 c0 48 6b ff 70 48 03 3d dc 45 00 00 48 89 e5 8b 4f 6c 4c 8b 47 60 ff c9 39 c8 7f 2f 8d 14 08 d1 fa 48 63 fa <41> 39 34 f8 4c 8d 0c fd 00 00 00 00 73 05 8d 42 01 eb e1 76 05 8d
      [  474.739023] RSP: 0018:ffffc9000943fc58 EFLAGS: 00010207
      [  474.744296] RAX: 0000000000000000 RBX: ffffc90006465000 RCX: 0000000002580249
      [  474.751485] RDX: 00000000012c0124 RSI: fffffffff7be17e9 RDI: 00000000012c0124
      [  474.758670] RBP: ffffc9000943fc58 R08: 0000000000000000 R09: ffffffff8117cf8f
      [  474.765855] R10: ffffc90006477000 R11: 0000000000000000 R12: 0000000000000001
      [  474.773048] R13: 0000000000000000 R14: ffffc9000943fcb8 R15: ffffc9000943fcb8
      [  474.780234] FS:  0000000000000000(0000) GS:ffff88a03f840000(0063) knlGS:00000000f7ac7700
      [  474.788612] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
      [  474.794632] CR2: 0000000009600920 CR3: 0000002037422006 CR4: 00000000000606e0
      [  474.802052] Call Trace:
      [  474.804789]  compat_do_replace+0x1fb/0x2a3 [ebtables]
      [  474.810105]  compat_do_ebt_set_ctl+0x69/0xe6 [ebtables]
      [  474.815605]  ? try_module_get+0x37/0x42
      [  474.819716]  compat_nf_setsockopt+0x4f/0x6d
      [  474.824172]  compat_ip_setsockopt+0x7e/0x8c
      [  474.828641]  compat_raw_setsockopt+0x16/0x3a
      [  474.833220]  compat_sock_common_setsockopt+0x1d/0x24
      [  474.838458]  __compat_sys_setsockopt+0x17e/0x1b1
      [  474.843343]  ? __check_object_size+0x76/0x19a
      [  474.847960]  __ia32_compat_sys_socketcall+0x1cb/0x25b
      [  474.853276]  do_fast_syscall_32+0xaf/0xf6
      [  474.857548]  entry_SYSENTER_compat+0x6b/0x7a
      Signed-off-by: default avatarFrancesco Ruggeri <fruggeri@arista.com>
      Acked-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      8d29d16d
    • Eric Dumazet's avatar
      net/x25: do not hold the cpu too long in x25_new_lci() · cf657d22
      Eric Dumazet authored
      Due to quadratic behavior of x25_new_lci(), syzbot was able
      to trigger an rcu stall.
      
      Fix this by not blocking BH for the whole duration of
      the function, and inserting a reschedule point when possible.
      
      If we care enough, using a bitmap could get rid of the quadratic
      behavior.
      
      syzbot report :
      
      rcu: INFO: rcu_preempt self-detected stall on CPU
      rcu:    0-...!: (10500 ticks this GP) idle=4fa/1/0x4000000000000002 softirq=283376/283376 fqs=0
      rcu:     (t=10501 jiffies g=383105 q=136)
      rcu: rcu_preempt kthread starved for 10502 jiffies! g383105 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
      rcu: RCU grace-period kthread stack dump:
      rcu_preempt     I28928    10      2 0x80000000
      Call Trace:
       context_switch kernel/sched/core.c:2844 [inline]
       __schedule+0x817/0x1cc0 kernel/sched/core.c:3485
       schedule+0x92/0x180 kernel/sched/core.c:3529
       schedule_timeout+0x4db/0xfd0 kernel/time/timer.c:1803
       rcu_gp_fqs_loop kernel/rcu/tree.c:1948 [inline]
       rcu_gp_kthread+0x956/0x17a0 kernel/rcu/tree.c:2105
       kthread+0x357/0x430 kernel/kthread.c:246
       ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
      NMI backtrace for cpu 0
      CPU: 0 PID: 8759 Comm: syz-executor2 Not tainted 5.0.0-rc4+ #51
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       <IRQ>
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x172/0x1f0 lib/dump_stack.c:113
       nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
       nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
       arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
       trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
       rcu_dump_cpu_stacks+0x183/0x1cf kernel/rcu/tree.c:1211
       print_cpu_stall kernel/rcu/tree.c:1348 [inline]
       check_cpu_stall kernel/rcu/tree.c:1422 [inline]
       rcu_pending kernel/rcu/tree.c:3018 [inline]
       rcu_check_callbacks.cold+0x500/0xa4a kernel/rcu/tree.c:2521
       update_process_times+0x32/0x80 kernel/time/timer.c:1635
       tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:161
       tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1271
       __run_hrtimer kernel/time/hrtimer.c:1389 [inline]
       __hrtimer_run_queues+0x33e/0xde0 kernel/time/hrtimer.c:1451
       hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1509
       local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
       smp_apic_timer_interrupt+0x120/0x570 arch/x86/kernel/apic/apic.c:1060
       apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
       </IRQ>
      RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline]
      RIP: 0010:queued_write_lock_slowpath+0x13e/0x290 kernel/locking/qrwlock.c:86
      Code: 00 00 fc ff df 4c 8d 2c 01 41 83 c7 03 41 0f b6 45 00 41 38 c7 7c 08 84 c0 0f 85 0c 01 00 00 8b 03 3d 00 01 00 00 74 1a f3 90 <41> 0f b6 55 00 41 38 d7 7c eb 84 d2 74 e7 48 89 df e8 6c 0f 4f 00
      RSP: 0018:ffff88805f117bd8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
      RAX: 0000000000000300 RBX: ffffffff89413ba0 RCX: 1ffffffff1282774
      RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff89413ba0
      RBP: ffff88805f117c70 R08: 1ffffffff1282774 R09: fffffbfff1282775
      R10: fffffbfff1282774 R11: ffffffff89413ba3 R12: 00000000000000ff
      R13: fffffbfff1282774 R14: 1ffff1100be22f7d R15: 0000000000000003
       queued_write_lock include/asm-generic/qrwlock.h:104 [inline]
       do_raw_write_lock+0x1d6/0x290 kernel/locking/spinlock_debug.c:203
       __raw_write_lock_bh include/linux/rwlock_api_smp.h:204 [inline]
       _raw_write_lock_bh+0x3b/0x50 kernel/locking/spinlock.c:312
       x25_insert_socket+0x21/0xe0 net/x25/af_x25.c:267
       x25_bind+0x273/0x340 net/x25/af_x25.c:705
       __sys_bind+0x23f/0x290 net/socket.c:1505
       __do_sys_bind net/socket.c:1516 [inline]
       __se_sys_bind net/socket.c:1514 [inline]
       __x64_sys_bind+0x73/0xb0 net/socket.c:1514
       do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      RIP: 0033:0x457e39
      Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007fafccd0dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031
      RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e39
      RDX: 0000000000000012 RSI: 0000000020000240 RDI: 0000000000000004
      RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 00007fafccd0e6d4
      R13: 00000000004bdf8b R14: 00000000004ce4b8 R15: 00000000ffffffff
      Sending NMI from CPU 0 to CPUs 1:
      NMI backtrace for cpu 1
      CPU: 1 PID: 8752 Comm: syz-executor4 Not tainted 5.0.0-rc4+ #51
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      RIP: 0010:__x25_find_socket+0x78/0x120 net/x25/af_x25.c:328
      Code: 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 a6 00 00 00 4d 8b 64 24 68 4d 85 e4 74 7f e8 03 97 3d fb 49 83 ec 68 74 74 e8 f8 96 3d fb <49> 8d bc 24 88 04 00 00 48 89 f8 48 c1 e8 03 0f b6 04 18 84 c0 74
      RSP: 0018:ffff8880639efc58 EFLAGS: 00000246
      RAX: 0000000000040000 RBX: dffffc0000000000 RCX: ffffc9000e677000
      RDX: 0000000000040000 RSI: ffffffff863244b8 RDI: ffff88806a764628
      RBP: ffff8880639efc80 R08: ffff8880a80d05c0 R09: fffffbfff1282775
      R10: fffffbfff1282774 R11: ffffffff89413ba3 R12: ffff88806a7645c0
      R13: 0000000000000001 R14: ffff88809f29ac00 R15: 0000000000000000
      FS:  00007fe8d0c58700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000001b32823000 CR3: 00000000672eb000 CR4: 00000000001406e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       x25_new_lci net/x25/af_x25.c:357 [inline]
       x25_connect+0x374/0xdf0 net/x25/af_x25.c:786
       __sys_connect+0x266/0x330 net/socket.c:1686
       __do_sys_connect net/socket.c:1697 [inline]
       __se_sys_connect net/socket.c:1694 [inline]
       __x64_sys_connect+0x73/0xb0 net/socket.c:1694
       do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      RIP: 0033:0x457e39
      Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007fe8d0c57c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
      RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e39
      RDX: 0000000000000012 RSI: 0000000020000200 RDI: 0000000000000004
      RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe8d0c586d4
      R13: 00000000004be378 R14: 00000000004ceb00 R15: 00000000ffffffff
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Cc: Andrew Hendry <andrew.hendry@gmail.com>
      Cc: linux-x25@vger.kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cf657d22
    • Eric Dumazet's avatar
      vxlan: test dev->flags & IFF_UP before calling netif_rx() · 4179cb5a
      Eric Dumazet authored
      netif_rx() must be called under a strict contract.
      
      At device dismantle phase, core networking clears IFF_UP
      and flush_all_backlogs() is called after rcu grace period
      to make sure no incoming packet might be in a cpu backlog
      and still referencing the device.
      
      Most drivers call netif_rx() from their interrupt handler,
      and since the interrupts are disabled at device dismantle,
      netif_rx() does not have to check dev->flags & IFF_UP
      
      Virtual drivers do not have this guarantee, and must
      therefore make the check themselves.
      
      Otherwise we risk use-after-free and/or crashes.
      
      Note this patch also fixes a small issue that came
      with commit ce6502a8 ("vxlan: fix a use after free
      in vxlan_encap_bypass"), since the dev->stats.rx_dropped
      change was done on the wrong device.
      
      Fixes: d342894c ("vxlan: virtual extensible lan")
      Fixes: ce6502a8 ("vxlan: fix a use after free in vxlan_encap_bypass")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Petr Machata <petrm@mellanox.com>
      Cc: Ido Schimmel <idosch@mellanox.com>
      Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
      Cc: Stefano Brivio <sbrivio@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4179cb5a
    • Jouke Witteveen's avatar
      Documentation: bring operstate documentation up-to-date · 989723b0
      Jouke Witteveen authored
      Netlink has moved from bitmasks to group numbers long ago.
      Signed-off-by: default avatarJouke Witteveen <j.witteveen@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      989723b0
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 4d73eaee
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for net:
      
      1) Out-of-bound access to packet data from the snmp nat helper,
         from Jann Horn.
      
      2) ICMP(v6) error packets are set as related traffic by conntrack,
         update protocol number before calling nf_nat_ipv4_manip_pkt()
         to use ICMP(v6) rather than the original protocol number,
         from Florian Westphal.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4d73eaee
    • Florian Westphal's avatar
      netfilter: nat: fix spurious connection timeouts · 8303b7e8
      Florian Westphal authored
      Sander Eikelenboom bisected a NAT related regression down
      to the l4proto->manip_pkt indirection removal.
      
      I forgot that ICMP(v6) errors (e.g. PKTTOOBIG) can be set as related
      to the existing conntrack entry.
      
      Therefore, when passing the skb to nf_nat_ipv4/6_manip_pkt(), that
      ended up calling the wrong l4 manip function, as tuple->dst.protonum
      is the original flows l4 protocol (TCP, UDP, etc).
      
      Set the dst protocol field to ICMP(v6), we already have a private copy
      of the tuple due to the inversion of src/dst.
      Reported-by: default avatarSander Eikelenboom <linux@eikelenboom.it>
      Tested-by: default avatarSander Eikelenboom <linux@eikelenboom.it>
      Fixes: faec18db ("netfilter: nat: remove l4proto->manip_pkt")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      8303b7e8
    • Jann Horn's avatar
      netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs · c4c07b4d
      Jann Horn authored
      The generic ASN.1 decoder infrastructure doesn't guarantee that callbacks
      will get as much data as they expect; callbacks have to check the `datalen`
      parameter before looking at `data`. Make sure that snmp_version() and
      snmp_helper() don't read/write beyond the end of the packet data.
      
      (Also move the assignment to `pdata` down below the check to make it clear
      that it isn't necessarily a pointer we can use before the `datalen` check.)
      
      Fixes: cc2d5863 ("netfilter: nf_nat_snmp_basic: use asn1 decoder library")
      Signed-off-by: default avatarJann Horn <jannh@google.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      c4c07b4d
  3. 10 Feb, 2019 3 commits
  4. 09 Feb, 2019 3 commits
  5. 08 Feb, 2019 12 commits
    • Russell King's avatar
      net: sfp: do not probe SFP module before we're attached · b5bfc21a
      Russell King authored
      When we probe a SFP module, we expect to be able to call the upstream
      device's module_insert() function so that the upstream link can be
      configured.  However, when the upstream device is delayed, we currently
      may end up probing the module before the upstream device is available,
      and lose the module_insert() call.
      
      Avoid this by holding off probing the module until the SFP bus is
      properly connected to both the SFP socket driver and the upstream
      driver.
      Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b5bfc21a
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 27b4ad62
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "This pull request is dedicated to the upcoming snowpocalypse parts 2
        and 3 in the Pacific Northwest:
      
         1) Drop profiles are broken because some drivers use dev_kfree_skb*
            instead of dev_consume_skb*, from Yang Wei.
      
         2) Fix IWLWIFI kconfig deps, from Luca Coelho.
      
         3) Fix percpu maps updating in bpftool, from Paolo Abeni.
      
         4) Missing station release in batman-adv, from Felix Fietkau.
      
         5) Fix some networking compat ioctl bugs, from Johannes Berg.
      
         6) ucc_geth must reset the BQL queue state when stopping the device,
            from Mathias Thore.
      
         7) Several XDP bug fixes in virtio_net from Toshiaki Makita.
      
         8) TSO packets must be sent always on queue 0 in stmmac, from Jose
            Abreu.
      
         9) Fix socket refcounting bug in RDS, from Eric Dumazet.
      
        10) Handle sparse cpu allocations in bpf selftests, from Martynas
            Pumputis.
      
        11) Make sure mgmt frames have enough tailroom in mac80211, from Felix
            Feitkau.
      
        12) Use safe list walking in sctp_sendmsg() asoc list traversal, from
            Greg Kroah-Hartman.
      
        13) Make DCCP's ccid_hc_[rt]x_parse_options always check for NULL
            ccid, from Eric Dumazet.
      
        14) Need to reload WoL password into bcmsysport device after deep
            sleeps, from Florian Fainelli.
      
        15) Remove filter from mask before freeing in cls_flower, from Petr
            Machata.
      
        16) Missing release and use after free in error paths of s390 qeth
            code, from Julian Wiedmann.
      
        17) Fix lockdep false positive in dsa code, from Marc Zyngier.
      
        18) Fix counting of ATU violations in mv88e6xxx, from Andrew Lunn.
      
        19) Fix EQ firmware assert in qed driver, from Manish Chopra.
      
        20) Don't default Caivum PTP to Y in kconfig, from Bjorn Helgaas"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (116 commits)
        net: dsa: b53: Fix for failure when irq is not defined in dt
        sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
        geneve: should not call rt6_lookup() when ipv6 was disabled
        net: Don't default Cavium PTP driver to 'y'
        net: broadcom: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles
        net: via-velocity: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles
        net: tehuti: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles
        net: sun: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles
        net: fsl_ucc_hdlc: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles
        net: fec_mpc52xx: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles
        net: smsc: epic100: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles
        net: dscc4: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles
        net: tulip: de2104x: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles
        net: defxx: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles
        net/mlx5e: Don't overwrite pedit action when multiple pedit used
        net/mlx5e: Update hw flows when encap source mac changed
        qed*: Advance drivers version to 8.37.0.20
        qed: Change verbosity for coalescing message.
        qede: Fix system crash on configuring channels.
        qed: Consider TX tcs while deriving the max num_queues for PF.
        ...
      27b4ad62
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 68090543
      Linus Torvalds authored
      Pull char/misc fixes from Greg KH:
       "Here are some small char and misc driver fixes for 5.0-rc6.
      
        Nothing huge here, some more binderfs fixups found as people use it,
        and there is a "large" selftest added to validate the binderfs code,
        which makes up the majority of this pull request.
      
        There's also some small mei and mic fixes to resolve some reported
        issues.
      
        All of these have been in linux-next for over a week with no reported
        issues"
      
      * tag 'char-misc-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        mic: vop: Fix crash on remove
        mic: vop: Fix use-after-free on remove
        binderfs: remove separate device_initcall()
        fpga: stratix10-soc: fix wrong of_node_put() in init function
        mic: vop: Fix broken virtqueues
        mei: free read cb on ctrl_wr list flush
        samples: mei: use /dev/mei0 instead of /dev/mei
        mei: me: add ice lake point device id.
        binderfs: respect limit on binder control creation
        binder: fix CONFIG_ANDROID_BINDER_DEVICES
        selftests: add binderfs selftests
      68090543
    • Linus Torvalds's avatar
      Merge tag 'driver-core-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core · 8c8e62cc
      Linus Torvalds authored
      Pull driver core fixes from Greg KH:
       "Here are some driver core fixes for 5.0-rc6.
      
        Well, not so much "driver core" as "debugfs". There's a lot of
        outstanding debugfs cleanup patches coming in through different
        subsystem trees, and in that process the debugfs core was found that
        it really should return errors when something bad happens, to prevent
        random files from showing up in the root of debugfs afterward. So
        debugfs was fixed up to handle this properly, and then two fixes for
        the relay and blk-mq code was needed as it was making invalid
        assumptions about debugfs return values.
      
        There's also a cacheinfo fix in here that resolves a tiny issue.
      
        All of these have been in linux-next for over a week with no reported
        problems"
      
      * tag 'driver-core-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        blk-mq: protect debugfs_create_files() from failures
        relay: check return of create_buf_file() properly
        debugfs: debugfs_lookup() should return NULL if not found
        debugfs: return error values, not NULL
        debugfs: fix debugfs_rename parameter checking
        cacheinfo: Keep the old value if of_property_read_u32 fails
      8c8e62cc
    • Linus Torvalds's avatar
      Merge tag 'staging-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · e464f50c
      Linus Torvalds authored
      Pull staging/IIO driver fixes from Greg KH:
       "Here are some small iio and staging driver fixes for 5.0-rc6.
      
        Nothing big, just resolve some reported IIO driver issues, and one
        staging driver bug. One staging driver patch was added and then
        reverted as well.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'staging-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        Revert "staging: erofs: keep corrupted fs from crashing kernel in erofs_namei()"
        staging: erofs: keep corrupted fs from crashing kernel in erofs_namei()
        staging: octeon: fix broken phylib usage
        iio: ti-ads8688: Update buffer allocation for timestamps
        tools: iio: iio_generic_buffer: make num_loops signed
        iio: adc: axp288: Fix TS-pin handling
        iio: chemical: atlas-ph-sensor: correct IIO_TEMP values to millicelsius
      e464f50c
    • Linus Torvalds's avatar
      Merge tag 'tty-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · e22a15d1
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are some small tty and serial fixes for 5.0-rc6.
      
        Nothing huge, just a few small fixes for reported issues. The speakup
        fix is in here as it is a tty operation issue.
      
        All of these have been in linux-next for a while with no reported
        problems"
      
      * tag 'tty-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: fix race between flush_to_ldisc and tty_open
        staging: speakup: fix tty-operation NULL derefs
        serial: sh-sci: Do not free irqs that have already been freed
        serial: 8250_pci: Make PCI class test non fatal
        tty: serial: 8250_mtk: Fix potential NULL pointer dereference
      e22a15d1
    • Linus Torvalds's avatar
      Merge tag 'usb-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 00a159a0
      Linus Torvalds authored
      Pull USB fixes from Grek KH:
       "Here are some small USB fixes for 5.0-rc6.
      
        Nothing huge, the normal amount of USB gadget fixes as well as some
        USB phy fixes. There's also a typec fix as well. Full details are in
        the shortlog.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'usb-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: typec: tcpm: Correct the PPS out_volt calculation
        usb: gadget: musb: fix short isoc packets with inventra dma
        usb: phy: am335x: fix race condition in _probe
        usb: dwc3: exynos: Fix error handling of clk_prepare_enable
        usb: phy: fix link errors
        usb: gadget: udc: net2272: Fix bitwise and boolean operations
        usb: dwc3: gadget: Handle 0 xfer length for OUT EP
      00a159a0
    • Linus Torvalds's avatar
      Merge tag 'xfs-5.0-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · bd5ff862
      Linus Torvalds authored
      Pull xfs fixes from Darrick Wong:
       "Here are a handful of XFS fixes to fix a data corruption problem, a
        crasher bug, and a deadlock.
      
        Summary:
      
         - Fix cache coherency problem with writeback mappings
      
         - Fix buffer deadlock when shutting fs down
      
         - Fix a null pointer dereference when running online repair"
      
      * tag 'xfs-5.0-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: set buffer ops when repair probes for btree type
        xfs: end sync buffer I/O properly on shutdown error
        xfs: eof trim writeback mapping as soon as it is cached
      bd5ff862
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2019-02-08' of git://anongit.freedesktop.org/drm/drm · adcbc921
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Missed fixes last week as had nothing until amdgpu showed up on
        Saturday. Other stuff has since rolled in along with some more amdgpu
        fixes, so we have two weeks of those, and some i915, vmwgfx, sun4i,
        rockchip and omap fixes.
      
        amdgpu/radeon:
         - fix crash on passthrough for SI
         - fencing fix for shared buffers
         - APU hwmon fix
         - API powerplay fix
         - eDP freesync fix
         - PASID mgr locking fix
         - KFD warning fix
         - DC/powerplay fix
         - raven revision ids fix
         - vega20 doorbell fix
      
        i915:
         - SNB display fix
         - SKL srckey mask fix
         - ICL DDI clock selection fix
      
        vmwgfx:
         - DMA API fix
         - IOMMU detection fix
         - display fixes
      
        sun4i:
         - tcon clock fix
      
        rockchip:
         - SPDX identifier fix
      
        omap:
         - DSI fixes"
      
      * tag 'drm-fixes-2019-02-08' of git://anongit.freedesktop.org/drm/drm: (28 commits)
        drm/omap: dsi: Hack-fix DSI bus flags
        drm/omap: dsi: Fix OF platform depopulate
        drm/omap: dsi: Fix crash in DSI debug dumps
        drm/i915: Try to sanitize bogus DPLL state left over by broken SNB BIOSen
        drm/amd/display: Attach VRR properties for eDP connectors
        drm/amdkfd: Fix if preprocessor statement above kfd_fill_iolink_info_for_cpu
        drm/amdgpu: use spin_lock_irqsave to protect vm_manager.pasid_idr
        drm/i915: always return something on DDI clock selection
        drm/i915: Fix skl srckey mask bits
        drm/vmwgfx: Improve on IOMMU detection
        drm/vmwgfx: Fix setting of dma masks
        drm/vmwgfx: Also check for crtc status while checking for DU active
        drm/vmwgfx: Fix an uninitialized fence handle value
        drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user
        drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init
        drm/amdgpu: fix the incorrect external id for raven series
        drm/amdgpu: Implement doorbell self-ring for NBIO 7.4
        drm/amd/display: Fix fclk idle state
        drm/amdgpu: Transfer fences to dmabuf importer
        drm/amd/powerplay: Fix missing break in switch
        ...
      adcbc921
    • Arun Parameswaran's avatar
      net: dsa: b53: Fix for failure when irq is not defined in dt · 39841cc1
      Arun Parameswaran authored
      Fixes the issues with non BCM58XX chips in the b53 driver
      failing, when the irq is not specified in the device tree.
      
      Removed the check for BCM58XX in b53_srab_prepare_irq(),
      so the 'port->irq' will be set to '-EXIO' if the irq is not
      specified in the device tree.
      
      Fixes: 16994374 ("net: dsa: b53: Make SRAB driver manage port interrupts")
      Fixes: b2ddc48a ("net: dsa: b53: Do not fail when IRQ are not initialized")
      Signed-off-by: default avatarArun Parameswaran <arun.parameswaran@broadcom.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      39841cc1
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2019-02-07' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · dada163c
      Dave Airlie authored
      drm-misc-fixes for v5.0-rc6:
      - Fixes to omap/dsi encoder.
      - Clock fix for sun4i.
      - Licensing header fix for rockchip.
      - Fix division by zero in the mode when trying to set a mode on
        i915 with GVT-g enabled.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/84462cef-609f-e2af-084a-f9fe2b05c53e@linux.intel.com
      dada163c
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2019-02-07-1' of... · 151e3d6a
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2019-02-07-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      drm/i915 fixes for v5.0-rc6:
      - SNB DPLL sanitize
      - ICL DDI clock selection
      - SLK srckey mask
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Jani Nikula <jani.nikula@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/87lg2s6nur.fsf@intel.com
      151e3d6a
  6. 07 Feb, 2019 14 commits