1. 24 Oct, 2017 12 commits
    • Greg Kroah-Hartman's avatar
      Merge tag 'usb-for-v4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next · 2d5afd51
      Greg Kroah-Hartman authored
      Felipe writes:
      
      usb: changes for v4.15 merge window
      
      Not much going on this time around. With only 51 non-merge commits,
      this was one of the smallest pull requests from the Gadget tree.
      
      Most of the changes are in the mtu3 driver which added support for
      36-bit DMA, support for USB 3.1 and support for dual-role (along with
      some non-critical fixes).
      
      The dwc2 driver got a few improvements to how we handle gadget state
      tracking and also added support for STM32F7xx devices.
      
      Other than that, we just some minor non-critical fixes and
      improvements all over the place.
      2d5afd51
    • John Stultz's avatar
      usb: dwc2: Fix UDC state tracking · ce2b21a4
      John Stultz authored
      It has been noticed that the dwc2 udc state reporting doesn't
      seem to work (at least on HiKey boards). Where after the initial
      setup, the sysfs /sys/class/udc/f72c0000.usb/state file would
      report "configured" no matter the state of the OTG port.
      
      This patch adds a call so that we report to the UDC layer when
      the gadget device is disconnected.
      
      This patch does depend on the previous patch ("usb: dwc2:
      Improve gadget state disconnection handling") in this patch set
      in order to properly work.
      
      Cc: Wei Xu <xuwei5@hisilicon.com>
      Cc: Guodong Xu <guodong.xu@linaro.org>
      Cc: Amit Pundir <amit.pundir@linaro.org>
      Cc: YongQin Liu <yongqin.liu@linaro.org>
      Cc: John Youn <johnyoun@synopsys.com>
      Cc: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
      Cc: Douglas Anderson <dianders@chromium.org>
      Cc: Chen Yu <chenyu56@huawei.com>
      Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: linux-usb@vger.kernel.org
      Acked-by: default avatarMinas Harutyunyan <hminas@synopsys.com>
      Tested-by: default avatarMinas Harutyunyan <hminas@synopsys.com>
      Reported-by: default avatarAmit Pundir <amit.pundir@linaro.org>
      Signed-off-by: default avatarJohn Stultz <john.stultz@linaro.org>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      ce2b21a4
    • John Stultz's avatar
      usb: dwc2: Error out of dwc2_hsotg_ep_disable() if we're in host mode · 9b481092
      John Stultz authored
      We've found that while in host mode, using Android, if one runs
      the command:
        stop adbd
      
      The existing usb devices being utilized in host mode are disconnected.
      This is most visible with usb networking devices.
      
      This seems to be due to adbd closing the file:
        /dev/usb-ffs/adb/ep0
      Which calls ffs_ep0_release() and the following backtrace:
      
      [<ffffff800875a430>] dwc2_hsotg_ep_disable+0x148/0x150
      [<ffffff800875a498>] dwc2_hsotg_udc_stop+0x60/0x110
      [<ffffff8008787950>] usb_gadget_remove_driver+0x58/0x78
      [<ffffff80087879e4>] usb_gadget_unregister_driver+0x74/0xe8
      [<ffffff80087850c0>] unregister_gadget+0x28/0x58
      [<ffffff800878511c>] unregister_gadget_item+0x2c/0x40
      [<ffffff8008790ea8>] ffs_data_clear+0xe8/0xf8
      [<ffffff8008790ed8>] ffs_data_reset+0x20/0x58
      [<ffffff8008793218>] ffs_data_closed+0x98/0xe8
      [<ffffff80087932d8>] ffs_ep0_release+0x20/0x30
      
      Then when dwc2_hsotg_ep_disable() is called, we call
      kill_all_requests() which causes a bunch of the following
      messages:
      
      dwc2 f72c0000.usb: Mode Mismatch Interrupt: currently in Host mode
      dwc2 f72c0000.usb: Mode Mismatch Interrupt: currently in Host mode
      dwc2 f72c0000.usb: Mode Mismatch Interrupt: currently in Host mode
      dwc2 f72c0000.usb: Mode Mismatch Interrupt: currently in Host mode
      dwc2 f72c0000.usb: Mode Mismatch Interrupt: currently in Host mode
      dwc2 f72c0000.usb: Mode Mismatch Interrupt: currently in Host mode
      dwc2 f72c0000.usb: Mode Mismatch Interrupt: currently in Host mode
      dwc2 f72c0000.usb: Mode Mismatch Interrupt: currently in Host mode
      init: Service 'adbd' (pid 1915) killed by signal 9
      init: Sending signal 9 to service 'adbd' (pid 1915) process group...
      init: Successfully killed process cgroup uid 0 pid 1915 in 0ms
      init: processing action (init.svc.adbd=stopped) from (/init.usb.configfs.rc:15)
      dwc2 f72c0000.usb: dwc2_hc_chhltd_intr_dma: Channel 8 - ChHltd set, but reason is unknown
      dwc2 f72c0000.usb: hcint 0x00000002, intsts 0x04200029
      dwc2 f72c0000.usb: dwc2_hc_chhltd_intr_dma: Channel 12 - ChHltd set, but reason is unknown
      dwc2 f72c0000.usb: hcint 0x00000002, intsts 0x04200029
      dwc2 f72c0000.usb: dwc2_hc_chhltd_intr_dma: Channel 15 - ChHltd set, but reason is unknown
      dwc2 f72c0000.usb: hcint 0x00000002, intsts 0x04200029
      dwc2 f72c0000.usb: dwc2_hc_chhltd_intr_dma: Channel 3 - ChHltd set, but reason is unknown
      dwc2 f72c0000.usb: hcint 0x00000002, intsts 0x04200029
      dwc2 f72c0000.usb: dwc2_hc_chhltd_intr_dma: Channel 4 - ChHltd set, but reason is unknown
      dwc2 f72c0000.usb: hcint 0x00000002, intsts 0x04200029
      dwc2 f72c0000.usb: dwc2_update_urb_state_abn(): trimming xfer length
      
      And the usb devices connected are basically hung at this point.
      
      It seems like if we're in host mode, we probably shouldn't run
      the dwc2_hostg_ep_disable logic, so this patch returns an error
      in that case.
      
      With this patch (along with the previous patch in this set), we avoid
      the mismatched interrupts and connected usb devices continue to function.
      
      I'm not sure if some other solution would be better here, but this seems
      to work, so I wanted to send it out for input on what the right approach
      should be.
      
      Cc: Wei Xu <xuwei5@hisilicon.com>
      Cc: Guodong Xu <guodong.xu@linaro.org>
      Cc: Amit Pundir <amit.pundir@linaro.org>
      Cc: YongQin Liu <yongqin.liu@linaro.org>
      Cc: John Youn <johnyoun@synopsys.com>
      Cc: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
      Cc: Douglas Anderson <dianders@chromium.org>
      Cc: Chen Yu <chenyu56@huawei.com>
      Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: linux-usb@vger.kernel.org
      Acked-by: default avatarMinas Harutyunyan <hminas@synopsys.com>
      Tested-by: default avatarMinas Harutyunyan <hminas@synopsys.com>
      Reported-by: default avatarYongQin Liu <yongqin.liu@linaro.org>
      Signed-off-by: default avatarJohn Stultz <john.stultz@linaro.org>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      9b481092
    • John Stultz's avatar
      usb: dwc2: Improve gadget state disconnection handling · d2471d4a
      John Stultz authored
      In the earlier commit dad3f793 ("usb: dwc2: Make sure we
      disconnect the gadget state"), I was trying to fix up the
      fact that we somehow weren't disconnecting the gadget state,
      so that when the OTG port was plugged in the second time we
      would get warnings about the state tracking being wrong.
      
      (This seems to be due to a quirk of the HiKey board where
      we do not ever get any otg interrupts, particularly the session
      end detected signal. Instead we only see status change
      interrupt.)
      
      The fix there was somewhat simple, as it just made sure to
      call dwc2_hsotg_disconnect() before we connected things up
      in OTG mode, ensuring the state handling didn't throw errors.
      
      But in looking at a different issue I was seeing with UDC
      state handling, I realized that it would be much better
      to call dwc2_hsotg_disconnect when we get the state change
      signal moving to host mode.
      
      Thus, this patch removes the earlier disconnect call I added
      and moves it (and the needed locking) to the host mode
      transition.
      
      Cc: Wei Xu <xuwei5@hisilicon.com>
      Cc: Guodong Xu <guodong.xu@linaro.org>
      Cc: Amit Pundir <amit.pundir@linaro.org>
      Cc: YongQin Liu <yongqin.liu@linaro.org>
      Cc: John Youn <johnyoun@synopsys.com>
      Cc: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
      Cc: Douglas Anderson <dianders@chromium.org>
      Cc: Chen Yu <chenyu56@huawei.com>
      Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: linux-usb@vger.kernel.org
      Acked-by: default avatarMinas Harutyunyan <hminas@synopsys.com>
      Tested-by: default avatarMinas Harutyunyan <hminas@synopsys.com>
      Signed-off-by: default avatarJohn Stultz <john.stultz@linaro.org>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      d2471d4a
    • Manu Gautam's avatar
      usb: dwc3: core: Notify current USB mode to USB3 PHY as well · 644cbbc3
      Manu Gautam authored
      Driver currently notifies only USB2 PHY on USB mode change.
      Extend this to USB3 PHY so that PHY drivers based on the
      mode can release system resources - clocks, regulators etc.
      Additionally Qualcomm QMP and QUSB2 PHY drivers need to
      override VBUS signal in PHY wrapper in device mode as USB
      VBUS line is not connected to PHYs. Also, remove NULL checks
      for PHY when calling phy_set_mode as PHY ops already check this.
      Signed-off-by: default avatarManu Gautam <mgautam@codeaurora.org>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      644cbbc3
    • Manu Gautam's avatar
      usb: dwc3: pci: Runtime resume child device from wq · 8eed00b2
      Manu Gautam authored
      Driver currently resumes and increments pm usage_count
      of its child device (dwc3 main) from its runtime_resume
      handler. This requires dwc3 runtime_resume to perform
      pm_runtime_put to decrement the pm usage_count. However
      runtime_put from dwc3 happens for non pci drivers
      (e.g. dwc3-if-simple.c) as well which results in dwc3
      pm usage_count becoming negative after couple of
      runtime suspend resume iterations. Fix this by
      performing runtime_get/put from dwc3-pci driver only
      using workqueue.
      Signed-off-by: default avatarManu Gautam <mgautam@codeaurora.org>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      8eed00b2
    • Manu Gautam's avatar
      usb: dwc3: Don't reinitialize core during host bus-suspend/resume · 689bf72c
      Manu Gautam authored
      Driver powers-off PHYs and reinitializes DWC3 core and gadget on
      resume. While this works fine for gadget mode but in host
      mode there is not re-initialization of host stack. Also, resetting
      bus as part of bus_suspend/resume is not correct which could affect
      (or disconnect) connected devices.
      Fix this by not reinitializing core on suspend/resume in host mode
      for HOST only and OTG/drd configurations.
      Signed-off-by: default avatarManu Gautam <mgautam@codeaurora.org>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      689bf72c
    • Alexey Khoroshilov's avatar
      usb: phy: tahvo: fix error handling in tahvo_usb_probe() · ce035409
      Alexey Khoroshilov authored
      If devm_extcon_dev_allocate() fails, we should disable clk before return.
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
      Fixes: 860d2686 ("usb: phy: tahvo: Use devm_extcon_dev_[allocate|register]() and replace deprecated API")
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      ce035409
    • Gustavo A. R. Silva's avatar
      usb: gadget: serial: mark expected switch fall-through · fdb5e4fa
      Gustavo A. R. Silva authored
      In preparation to enabling -Wimplicit-fallthrough, mark switch cases
      where we are expecting to fall through.
      
      Addresses-Coverity-ID: 1350962
      Signed-off-by: default avatarGustavo A. R. Silva <garsilva@embeddedor.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      fdb5e4fa
    • Gustavo A. R. Silva's avatar
      usb: phy: phy-msm-usb: mark expected switch fall-through · 58a636ec
      Gustavo A. R. Silva authored
      In preparation to enabling -Wimplicit-fallthrough, mark switch cases
      where we are expecting to fall through.
      
      Addresses-Coverity-ID: 1222118
      Signed-off-by: default avatarGustavo A. R. Silva <garsilva@embeddedor.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      58a636ec
    • Gustavo A. R. Silva's avatar
      usb: gadget: f_tcm: mark expected switch fall-through · d4acce95
      Gustavo A. R. Silva authored
      In preparation to enabling -Wimplicit-fallthrough, mark switch cases
      where we are expecting to fall through.
      
      Addresses-Coverity-ID: 703128
      Signed-off-by: default avatarGustavo A. R. Silva <garsilva@embeddedor.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      d4acce95
    • Gustavo A. R. Silva's avatar
      usb: gadget: goku_udc: mark expected switch fall-throughs · 457b16d4
      Gustavo A. R. Silva authored
      In preparation to enabling -Wimplicit-fallthrough, mark switch cases
      where we are expecting to fall through.
      
      Addresses-Coverity-ID: 145713
      Signed-off-by: default avatarGustavo A. R. Silva <garsilva@embeddedor.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      457b16d4
  2. 23 Oct, 2017 16 commits
  3. 22 Oct, 2017 12 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 02982f85
      Linus Torvalds authored
      Pull input fix from Dmitry Torokhov:
       "A fix for a broken commit in the previous pull breaking automatic
        module loading of input handlers, such ad evdev"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: do not use property bits when generating module alias
      02982f85
    • Dmitry Torokhov's avatar
      Input: do not use property bits when generating module alias · 09c3e01b
      Dmitry Torokhov authored
      The commit 8724ecb0 ("Input: allow matching device IDs on property
      bits") started using property bits when generating module aliases for input
      handlers, but did not adjust the generation of MODALIAS attribute on input
      device uevents, breaking automatic module loading. Given that no handler
      currently uses property bits in their module tables, let's revert this part
      of the commit for now.
      Reported-by: default avatarDamien Wyart <damien.wyart@gmail.com>
      Tested-by: default avatarDamien Wyart <damien.wyart@gmail.com>
      Fixes: 8724ecb0 ("Input: allow matching device IDs on property bits")
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      09c3e01b
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 936fd005
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A couple of fixes addressing the following issues:
      
         - The last polishing for the TLB code, removing the last BUG_ON() and
           the debug file along with tidying up the lazy TLB code.
      
         - Prevent triple fault on 1st Gen. 486 caused by stupidly calling the
           early IDT setup after the first function which causes a fault which
           should be caught by the exception table.
      
         - Limit the mmap of /dev/mem to valid addresses
      
         - Prevent late microcode loading on Broadwell X
      
         - Remove a redundant assignment in the cache info code"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/mm: Limit mmap() of /dev/mem to valid physical addresses
        x86/mm: Remove debug/x86/tlb_defer_switch_to_init_mm
        x86/mm: Tidy up "x86/mm: Flush more aggressively in lazy TLB mode"
        x86/mm/64: Remove the last VM_BUG_ON() from the TLB code
        x86/microcode/intel: Disable late loading on model 79
        x86/idt: Initialize early IDT before cr4_init_shadow()
        x86/cpu/intel_cacheinfo: Remove redundant assignment to 'this_leaf'
      936fd005
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 9e415a8e
      Linus Torvalds authored
      Pull timer fix from Thomas Gleixner:
       "A single fix to make the cs5535 clock event driver robust agaist
        spurious interrupts"
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        clockevents/drivers/cs5535: Improve resilience to spurious interrupts
      9e415a8e
    • Linus Torvalds's avatar
      Merge branch 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 5670a847
      Linus Torvalds authored
      Pull smp/hotplug fix from Thomas Gleixner:
       "The recent rework of the callback invocation missed to cleanup the
        leftovers of the operation, so under certain circumstances a
        subsequent CPU hotplug operation accesses stale data and crashes.
        Clean it up."
      
      * 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        cpu/hotplug: Reset node state after operation
      5670a847
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 085cf9bf
      Linus Torvalds authored
      Pull perf fixes from Thomas Gleixner:
       "A series of fixes for perf tooling:
      
         - Make xyarray return the X/Y size correctly which fixes a crash in
           the exit code.
      
         - Fix the libc path in test so it works not only on Debian/Ubuntu
           correctly
      
         - Check for eBPF file existance and output a useful error message
           instead of failing to compile a non existant file
      
         - Make sure perf_hpp_fmt is not longer references before freeing it
      
         - Use list_del_init() in the histogram code to prevent a crash when
           the already deleted element is deleted again
      
         - Remove the leftovers of the removed '-l' option
      
         - Add reviewer entries to the MAINTAINERS file"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf test shell trace+probe_libc_inet_pton.sh: Be compatible with Debian/Ubuntu
        perf xyarray: Fix wrong processing when closing evsel fd
        perf buildid-list: Fix crash when processing PERF_RECORD_NAMESPACE
        perf record: Fix documentation for a inexistent option '-l'
        perf tools: Add long time reviewers to MAINTAINERS
        perf tools: Check wether the eBPF file exists in event parsing
        perf hists: Add extra integrity checks to fmt_free()
        perf hists: Fix crash in perf_hpp__reset_output_field()
      085cf9bf
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 4f184d7d
      Linus Torvalds authored
      Pull irq fixes from Thomas Gleixner:
       "A set of small fixes mostly in the irq drivers area:
      
         - Make the tango irq chip work correctly, which requires a new
           function in the generiq irq chip implementation
      
         - A set of updates to the GIC-V3 ITS driver removing a bogus BUG_ON()
           and parsing the VCPU table size correctly"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        genirq: generic chip: remove irq_gc_mask_disable_reg_and_ack()
        irqchip/tango: Use irq_gc_mask_disable_and_ack_set
        genirq: generic chip: Add irq_gc_mask_disable_and_ack_set()
        irqchip/gic-v3-its: Add missing changes to support 52bit physical address
        irqchip/gic-v3-its: Fix the incorrect parsing of VCPU table size
        irqchip/gic-v3-its: Fix the incorrect BUG_ON in its_init_vpe_domain()
        DT: arm,gic-v3: Update the ITS size in the examples
      4f184d7d
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · b8d389e8
      Linus Torvalds authored
      Pull objtool fix from Thomas Gleixner:
       "Plug a memory leak in the instruction decoder"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        objtool: Fix memory leak in decode_instructions()
      b8d389e8
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · b5ac3beb
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "A little more than usual this time around. Been travelling, so that is
        part of it.
      
        Anyways, here are the highlights:
      
         1) Deal with memcontrol races wrt. listener dismantle, from Eric
            Dumazet.
      
         2) Handle page allocation failures properly in nfp driver, from Jaku
            Kicinski.
      
         3) Fix memory leaks in macsec, from Sabrina Dubroca.
      
         4) Fix crashes in pppol2tp_session_ioctl(), from Guillaume Nault.
      
         5) Several fixes in bnxt_en driver, including preventing potential
            NVRAM parameter corruption from Michael Chan.
      
         6) Fix for KRACK attacks in wireless, from Johannes Berg.
      
         7) rtnetlink event generation fixes from Xin Long.
      
         8) Deadlock in mlxsw driver, from Ido Schimmel.
      
         9) Disallow arithmetic operations on context pointers in bpf, from
            Jakub Kicinski.
      
        10) Missing sock_owned_by_user() check in sctp_icmp_redirect(), from
            Xin Long.
      
        11) Only TCP is supported for sockmap, make that explicit with a
            check, from John Fastabend.
      
        12) Fix IP options state races in DCCP and TCP, from Eric Dumazet.
      
        13) Fix panic in packet_getsockopt(), also from Eric Dumazet.
      
        14) Add missing locked in hv_sock layer, from Dexuan Cui.
      
        15) Various aquantia bug fixes, including several statistics handling
            cures. From Igor Russkikh et al.
      
        16) Fix arithmetic overflow in devmap code, from John Fastabend.
      
        17) Fix busted socket memory accounting when we get a fault in the tcp
            zero copy paths. From Willem de Bruijn.
      
        18) Don't leave opt->tot_len uninitialized in ipv6, from Eric Dumazet"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (106 commits)
        stmmac: Don't access tx_q->dirty_tx before netif_tx_lock
        ipv6: flowlabel: do not leave opt->tot_len with garbage
        of_mdio: Fix broken PHY IRQ in case of probe deferral
        textsearch: fix typos in library helpers
        rxrpc: Don't release call mutex on error pointer
        net: stmmac: Prevent infinite loop in get_rx_timestamp_status()
        net: stmmac: Fix stmmac_get_rx_hwtstamp()
        net: stmmac: Add missing call to dev_kfree_skb()
        mlxsw: spectrum_router: Configure TIGCR on init
        mlxsw: reg: Add Tunneling IPinIP General Configuration Register
        net: ethtool: remove error check for legacy setting transceiver type
        soreuseport: fix initialization race
        net: bridge: fix returning of vlan range op errors
        sock: correct sk_wmem_queued accounting on efault in tcp zerocopy
        bpf: add test cases to bpf selftests to cover all access tests
        bpf: fix pattern matches for direct packet access
        bpf: fix off by one for range markings with L{T, E} patterns
        bpf: devmap fix arithmetic overflow in bitmap_size calculation
        net: aquantia: Bad udp rate on default interrupt coalescing
        net: aquantia: Enable coalescing management via ethtool interface
        ...
      b5ac3beb
    • Bernd Edlinger's avatar
      stmmac: Don't access tx_q->dirty_tx before netif_tx_lock · 8d5f4b07
      Bernd Edlinger authored
      This is the possible reason for different hard to reproduce
      problems on my ARMv7-SMP test system.
      
      The symptoms are in recent kernels imprecise external aborts,
      and in older kernels various kinds of network stalls and
      unexpected page allocation failures.
      
      My testing indicates that the trouble started between v4.5 and v4.6
      and prevails up to v4.14.
      
      Using the dirty_tx before acquiring the spin lock is clearly
      wrong and was first introduced with v4.6.
      
      Fixes: e3ad57c9 ("stmmac: review RX/TX ring management")
      Signed-off-by: default avatarBernd Edlinger <bernd.edlinger@hotmail.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8d5f4b07
    • Eric Dumazet's avatar
      ipv6: flowlabel: do not leave opt->tot_len with garbage · 864e2a1f
      Eric Dumazet authored
      When syzkaller team brought us a C repro for the crash [1] that
      had been reported many times in the past, I finally could find
      the root cause.
      
      If FlowLabel info is merged by fl6_merge_options(), we leave
      part of the opt_space storage provided by udp/raw/l2tp with random value
      in opt_space.tot_len, unless a control message was provided at sendmsg()
      time.
      
      Then ip6_setup_cork() would use this random value to perform a kzalloc()
      call. Undefined behavior and crashes.
      
      Fix is to properly set tot_len in fl6_merge_options()
      
      At the same time, we can also avoid consuming memory and cpu cycles
      to clear it, if every option is copied via a kmemdup(). This is the
      change in ip6_setup_cork().
      
      [1]
      kasan: CONFIG_KASAN_INLINE enabled
      kasan: GPF could be caused by NULL-ptr deref or user memory access
      general protection fault: 0000 [#1] SMP KASAN
      Dumping ftrace buffer:
         (ftrace buffer empty)
      Modules linked in:
      CPU: 0 PID: 6613 Comm: syz-executor0 Not tainted 4.14.0-rc4+ #127
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      task: ffff8801cb64a100 task.stack: ffff8801cc350000
      RIP: 0010:ip6_setup_cork+0x274/0x15c0 net/ipv6/ip6_output.c:1168
      RSP: 0018:ffff8801cc357550 EFLAGS: 00010203
      RAX: dffffc0000000000 RBX: ffff8801cc357748 RCX: 0000000000000010
      RDX: 0000000000000002 RSI: ffffffff842bd1d9 RDI: 0000000000000014
      RBP: ffff8801cc357620 R08: ffff8801cb17f380 R09: ffff8801cc357b10
      R10: ffff8801cb64a100 R11: 0000000000000000 R12: ffff8801cc357ab0
      R13: ffff8801cc357b10 R14: 0000000000000000 R15: ffff8801c3bbf0c0
      FS:  00007f9c5c459700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000020324000 CR3: 00000001d1cf2000 CR4: 00000000001406f0
      DR0: 0000000020001010 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
      Call Trace:
       ip6_make_skb+0x282/0x530 net/ipv6/ip6_output.c:1729
       udpv6_sendmsg+0x2769/0x3380 net/ipv6/udp.c:1340
       inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:762
       sock_sendmsg_nosec net/socket.c:633 [inline]
       sock_sendmsg+0xca/0x110 net/socket.c:643
       SYSC_sendto+0x358/0x5a0 net/socket.c:1750
       SyS_sendto+0x40/0x50 net/socket.c:1718
       entry_SYSCALL_64_fastpath+0x1f/0xbe
      RIP: 0033:0x4520a9
      RSP: 002b:00007f9c5c458c08 EFLAGS: 00000216 ORIG_RAX: 000000000000002c
      RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 00000000004520a9
      RDX: 0000000000000001 RSI: 0000000020fd1000 RDI: 0000000000000016
      RBP: 0000000000000086 R08: 0000000020e0afe4 R09: 000000000000001c
      R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004bb1ee
      R13: 00000000ffffffff R14: 0000000000000016 R15: 0000000000000029
      Code: e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 ea 0f 00 00 48 8d 79 04 48 b8 00 00 00 00 00 fc ff df 45 8b 74 24 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
      RIP: ip6_setup_cork+0x274/0x15c0 net/ipv6/ip6_output.c:1168 RSP: ffff8801cc357550
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      864e2a1f
    • Geert Uytterhoeven's avatar
      of_mdio: Fix broken PHY IRQ in case of probe deferral · 66bdede4
      Geert Uytterhoeven authored
      If an Ethernet PHY is initialized before the interrupt controller it is
      connected to, a message like the following is printed:
      
          irq: no irq domain found for /interrupt-controller@e61c0000 !
      
      However, the actual error is ignored, leading to a non-functional (POLL)
      PHY interrupt later:
      
          Micrel KSZ8041RNLI ee700000.ethernet-ffffffff:01: attached PHY driver [Micrel KSZ8041RNLI] (mii_bus:phy_addr=ee700000.ethernet-ffffffff:01, irq=POLL)
      
      Depending on whether the PHY driver will fall back to polling, Ethernet
      may or may not work.
      
      To fix this:
        1. Switch of_mdiobus_register_phy() from irq_of_parse_and_map() to
           of_irq_get().
           Unlike the former, the latter returns -EPROBE_DEFER if the
           interrupt controller is not yet available, so this condition can be
           detected.
           Other errors are handled the same as before, i.e. use the passed
           mdio->irq[addr] as interrupt.
        2. Propagate and handle errors from of_mdiobus_register_phy() and
           of_mdiobus_register_device().
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      66bdede4