1. 11 Jul, 2017 10 commits
  2. 10 Jul, 2017 1 commit
  3. 09 Jul, 2017 1 commit
  4. 08 Jul, 2017 28 commits
    • Linus Torvalds's avatar
      Merge tag 'pci-v4.13-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · f263fbb8
      Linus Torvalds authored
      Pull PCI updates from Bjorn Helgaas:
      
        - add sysfs max_link_speed/width, current_link_speed/width (Wong Vee
          Khee)
      
        - make host bridge IRQ mapping much more generic (Matthew Minter,
          Lorenzo Pieralisi)
      
        - convert most drivers to pci_scan_root_bus_bridge() (Lorenzo
          Pieralisi)
      
        - mutex sriov_configure() (Jakub Kicinski)
      
        - mutex pci_error_handlers callbacks (Christoph Hellwig)
      
        - split ->reset_notify() into ->reset_prepare()/reset_done()
          (Christoph Hellwig)
      
        - support multiple PCIe portdrv interrupts for MSI as well as MSI-X
          (Gabriele Paoloni)
      
        - allocate MSI/MSI-X vector for Downstream Port Containment (Gabriele
          Paoloni)
      
        - fix MSI IRQ affinity pre/post/min_vecs issue (Michael Hernandez)
      
        - test INTx masking during enumeration, not at run-time (Piotr Gregor)
      
        - avoid using device_may_wakeup() for runtime PM (Rafael J. Wysocki)
      
        - restore the status of PCI devices across hibernation (Chen Yu)
      
        - keep parent resources that start at 0x0 (Ard Biesheuvel)
      
        - enable ECRC only if device supports it (Bjorn Helgaas)
      
        - restore PRI and PASID state after Function-Level Reset (CQ Tang)
      
        - skip DPC event if device is not present (Keith Busch)
      
        - check domain when matching SMBIOS info (Sujith Pandel)
      
        - mark Intel XXV710 NIC INTx masking as broken (Alex Williamson)
      
        - avoid AMD SB7xx EHCI USB wakeup defect (Kai-Heng Feng)
      
        - work around long-standing Macbook Pro poweroff issue (Bjorn Helgaas)
      
        - add Switchtec "running" status flag (Logan Gunthorpe)
      
        - fix dra7xx incorrect RW1C IRQ register usage (Arvind Yadav)
      
        - modify xilinx-nwl IRQ chip for legacy interrupts (Bharat Kumar
          Gogada)
      
        - move VMD SRCU cleanup after bus, child device removal (Jon Derrick)
      
        - add Faraday clock handling (Linus Walleij)
      
        - configure Rockchip MPS and reorganize (Shawn Lin)
      
        - limit Qualcomm TLP size to 2K (hardware issue) (Srinivas Kandagatla)
      
        - support Tegra MSI 64-bit addressing (Thierry Reding)
      
        - use Rockchip normal (not privileged) register bank (Shawn Lin)
      
        - add HiSilicon Kirin SoC PCIe controller driver (Xiaowei Song)
      
        - add Sigma Designs Tango SMP8759 PCIe controller driver (Marc
          Gonzalez)
      
        - add MediaTek PCIe host controller support (Ryder Lee)
      
        - add Qualcomm IPQ4019 support (John Crispin)
      
        - add HyperV vPCI protocol v1.2 support (Jork Loeser)
      
        - add i.MX6 regulator support (Quentin Schulz)
      
      * tag 'pci-v4.13-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (113 commits)
        PCI: tango: Add Sigma Designs Tango SMP8759 PCIe host bridge support
        PCI: Add DT binding for Sigma Designs Tango PCIe controller
        PCI: rockchip: Use normal register bank for config accessors
        dt-bindings: PCI: Add documentation for MediaTek PCIe
        PCI: Remove __pci_dev_reset() and pci_dev_reset()
        PCI: Split ->reset_notify() method into ->reset_prepare() and ->reset_done()
        PCI: xilinx: Make of_device_ids const
        PCI: xilinx-nwl: Modify IRQ chip for legacy interrupts
        PCI: vmd: Move SRCU cleanup after bus, child device removal
        PCI: vmd: Correct comment: VMD domains start at 0x10000, not 0x1000
        PCI: versatile: Add local struct device pointers
        PCI: tegra: Do not allocate MSI target memory
        PCI: tegra: Support MSI 64-bit addressing
        PCI: rockchip: Use local struct device pointer consistently
        PCI: rockchip: Check for clk_prepare_enable() errors during resume
        MAINTAINERS: Remove Wenrui Li as Rockchip PCIe driver maintainer
        PCI: rockchip: Configure RC's MPS setting
        PCI: rockchip: Reconfigure configuration space header type
        PCI: rockchip: Split out rockchip_pcie_cfg_configuration_accesses()
        PCI: rockchip: Move configuration accesses into rockchip_pcie_cfg_atu()
        ...
      f263fbb8
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md · 026d15f6
      Linus Torvalds authored
      Pull MD update from Shaohua Li:
      
       - fixed deadlock in MD suspend and a potential bug in bio allocation
         (Neil Brown)
      
       - fixed signal issue (Mikulas Patocka)
      
       - fixed typo in FailFast test (Guoqing Jiang)
      
       - other trival fixes
      
      * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
        MD: fix sleep in atomic
        MD: fix a null dereference
        md: use a separate bio_set for synchronous IO.
        md: change the initialization value for a spare device spot to MD_DISK_ROLE_SPARE
        md/raid1: remove unused bio in sync_request_write
        md/raid10: fix FailFast test for wrong device
        md: don't use flush_signals in userspace processes
        md: fix deadlock between mddev_suspend() and md_write_start()
      026d15f6
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 43d01209
      Linus Torvalds authored
      Pull input updates from Dmitry Torokhov:
      
       - a new driver for STM FingerTip touchscreen
      
       - a new driver for D-Link DIR-685 touch keys
      
       - updated list of supported devices in xpad driver
      
       - other assorted updates and fixes
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (23 commits)
        MAINTAINERS: update input subsystem patterns
        Input: introduce KEY_ASSISTANT
        Input: xpad - sync supported devices with XBCD
        Input: xpad - sync supported devices with 360Controller
        Input: xen-kbdfront - use string constants from PV protocol
        Input: stmfts - mark all PM functions as __maybe_unused
        Input: add support for the STMicroelectronics FingerTip touchscreen
        Input: add D-Link DIR-685 touchkeys driver
        Input: s3c2410_ts - handle return value of clk_prepare_enable
        Input: axp20x-pek - add wakeup support
        Input: synaptics-rmi4 - use %phN to form F34 configuration ID
        Input: synaptics-rmi4 - change a char type to u8
        Input: sparse-keymap - remove sparse_keymap_free()
        Input: tsc2007 - move header file out of I2C realm
        Input: mms114 - move header file out of I2C realm
        Input: mcs - move header file out of I2C realm
        Input: lm8323 - move header file out of I2C realm
        Input: elantech - force relative mode on a certain module
        Input: elan_i2c - add support for fetching chip type on newer hardware
        Input: elan_i2c - check if device is there before really probing
        ...
      43d01209
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-4.13-rc1' of git://git.infradead.org/users/vkoul/slave-dma · 2ceedf97
      Linus Torvalds authored
      Pull dmaengine updates from Vinod Koul:
      
       - removal of AVR32 support in dw driver as AVR32 is gone
      
       - new driver for Broadcom stream buffer accelerator (SBA) RAID driver
      
       - add support for Faraday Technology FTDMAC020 in amba-pl08x driver
      
       - IOMMU support in pl330 driver
      
       - updates to bunch of drivers
      
      * tag 'dmaengine-4.13-rc1' of git://git.infradead.org/users/vkoul/slave-dma: (36 commits)
        dmaengine: qcom_hidma: correct API violation for submit
        dmaengine: zynqmp_dma: Remove max len check in zynqmp_dma_prep_memcpy
        dmaengine: tegra-apb: Really fix runtime-pm usage
        dmaengine: fsl_raid: make of_device_ids const.
        dmaengine: qcom_hidma: allow ACPI/DT parameters to be overridden
        dmaengine: fsldma: set BWC, DAHTS and SAHTS values correctly
        dmaengine: Kconfig: Simplify the help text for MXS_DMA
        dmaengine: pl330: Delete unused functions
        dmaengine: Replace WARN_TAINT_ONCE() with pr_warn_once()
        dmaengine: Kconfig: Extend the dependency for MXS_DMA
        dmaengine: mxs: Use %zu for printing a size_t variable
        dmaengine: ste_dma40: Cleanup scatterlist layering violations
        dmaengine: imx-dma: cleanup scatterlist layering violations
        dmaengine: use proper name for the R-Car SoC
        dmaengine: imx-sdma: Fix compilation warning.
        dmaengine: imx-sdma: Handle return value of clk_prepare_enable
        dmaengine: pl330: Add IOMMU support to slave tranfers
        dmaengine: DW DMAC: Handle return value of clk_prepare_enable
        dmaengine: pl08x: use GENMASK() to create bitmasks
        dmaengine: pl08x: Add support for Faraday Technology FTDMAC020
        ...
      2ceedf97
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm · 09b56d5a
      Linus Torvalds authored
      Pull ARM updates from Russell King:
      
       - add support for ftrace-with-registers, which is needed for kgraft and
         other ftrace tools
      
       - support for mremap() for the sigpage/vDSO so that checkpoint/restore
         can work
      
       - add timestamps to each line of the register dump output
      
       - remove the unused KTHREAD_SIZE from nommu
      
       - align the ARM bitops APIs with the generic API (using unsigned long
         pointers rather than void pointers)
      
       - make the configuration of userspace Thumb support an expert option so
         that we can default it on, and avoid some hard to debug userspace
         crashes
      
      * 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: 8684/1: NOMMU: Remove unused KTHREAD_SIZE definition
        ARM: 8683/1: ARM32: Support mremap() for sigpage/vDSO
        ARM: 8679/1: bitops: Align prototypes to generic API
        ARM: 8678/1: ftrace: Adds support for CONFIG_DYNAMIC_FTRACE_WITH_REGS
        ARM: make configuration of userspace Thumb support an expert option
        ARM: 8673/1: Fix __show_regs output timestamps
      09b56d5a
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next · fe1b5180
      Linus Torvalds authored
      Pull sparc updates from David Miller:
      
       1) Queued spinlocks and rwlocks for sparc64, from Babu Moger.
      
       2) Some const'ification from Arvind Yadav.
      
       3) LDC/VIO driver infrastructure changes to facilitate future upcoming
          drivers, from Jag Raman.
      
       4) Initialize sched_clock() et al. early so that the initial printk
          timestamps are all done while the implementation is available and
          functioning. From Pavel Tatashin.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next: (38 commits)
        sparc: kernel: pmc: make of_device_ids const.
        sparc64: fix typo in property
        sparc64: add port_id to VIO device metadata
        sparc64: Enhance search for VIO device in MDESC
        sparc64: enhance VIO device probing
        sparc64: check if a client is allowed to register for MDESC notifications
        sparc64: remove restriction on VIO device name size
        sparc64: refactor code to obtain cfg_handle property from MDESC
        sparc64: add MDESC node name property to VIO device metadata
        sparc64: mdesc: use __GFP_REPEAT action modifier for VM allocation
        sparc64: expand MDESC interface
        sparc64: skip handshake for LDC channels in RAW mode
        sparc64: specify the device class in VIO version info. packet
        sparc64: ensure VIO operations are defined while being used
        sparc: kernel: apc: make of_device_ids const
        sparc/time: make of_device_ids const
        sparc64: broken %tick frequency on spitfire cpus
        sparc64: use prom interface to get %stick frequency
        sparc64: optimize functions that access tick
        sparc64: add hot-patched and inlined get_tick()
        ...
      fe1b5180
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 8b6b3172
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "Mostly fixing some light fallout from the changes that went into the
        merge window.
      
         1) Fix memory leaks on network namespace teardown in netfilter, from
            Liping Zhang.
      
         2) When comparing ipv6 nexthops, we have to take the lightweight
            tunnel state into account as well. From David Ahern.
      
         3) Fix socket option object length check in the new TLS code, from
            Matthias Rosenfelder.
      
         4) Fix memory leak in nfp driver flower support, from Jakub Kicinski.
      
         5) Several netlink attribute validation fixes in cfg80211, from
            Srinivas Dasari.
      
         6) Fix context array leak in virtio_net, from Jason Wang.
      
         7) SKB use after free in hns driver, from Yusheng Lin.
      
         8) Fix socket leak on accept() in RDS, from Sowmini Varadhan. Also
            add a WARN_ON() to sock_graft() so other protocol stacks don't
            trip over this as well"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits)
        net: ethernet: mediatek: remove useless code in mtk_probe()
        mpls: fix uninitialized in_label var warning in mpls_getroute
        doc: SKB_GSO_[IPIP|SIT] have been replaced
        bonding: avoid NETDEV_CHANGEMTU event when unregistering slave
        net/sock: add WARN_ON(parent->sk) in sock_graft()
        rds: tcp: use sock_create_lite() to create the accept socket
        net: hns: Fix a skb used after free bug
        net: hns: Fix a wrong op phy C45 code
        net: macb: Adding Support for Jumbo Frames up to 10240 Bytes in SAMA5D3
        net: Update networking MAINTAINERS entry.
        virtio-net: fix leaking of ctx array
        cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
        cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE
        cfg80211: Check if NAN service ID is of expected size
        cfg80211: Check if PMKID attribute is of expected size
        arcnet: com20020-pci: Fix an error handling path in 'com20020pci_probe()'
        nfp: flower: add missing clean up call to avoid memory leaks
        vrf: fix bug_on triggered by rx when destroying a vrf
        ptp: dte: Use LL suffix for 64-bit constants
        sctp: set the value of flowi6_oif to sk_bound_dev_if to make sctp_v6_get_dst to find the correct route entry.
        ...
      8b6b3172
    • Linus Torvalds's avatar
      Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · b8d4c1f9
      Linus Torvalds authored
      Pull misc filesystem updates from Al Viro:
       "Assorted normal VFS / filesystems stuff..."
      
      * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        dentry name snapshots
        Make statfs properly return read-only state after emergency remount
        fs/dcache: init in_lookup_hashtable
        minix: Deinline get_block, save 2691 bytes
        fs: Reorder inode_owner_or_capable() to avoid needless
        fs: warn in case userspace lied about modprobe return
      b8d4c1f9
    • Linus Torvalds's avatar
      Merge branch 'for-spi' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 090a81d8
      Linus Torvalds authored
      Pull spi uaccess delousing from Al Viro:
       "Getting rid of pointless __get_user() and friends in drivers/spi.
      
        [ the only reason it's on a separate branch is that I hoped it would
          be picked by spi folks; looks like mail asking them to grab it got
          lost and I hadn't followed up on that ]"
      
      * 'for-spi' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        spidev: quit messing with access_ok()
      090a81d8
    • Linus Torvalds's avatar
      Merge branch 'work.__copy_in_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 46ace66b
      Linus Torvalds authored
      Pull __copy_in_user removal from Al Viro:
       "There used to be 6 places in the entire tree calling __copy_in_user(),
        all of them bogus.
      
        Four got killed off in work.drm branch, this takes care of the
        remaining ones and kills the definition of that sucker"
      
      * 'work.__copy_in_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        kill __copy_in_user()
        sanitize do_i2c_smbus_ioctl()
      46ace66b
    • Gustavo A. R. Silva's avatar
      net: ethernet: mediatek: remove useless code in mtk_probe() · e8df7603
      Gustavo A. R. Silva authored
      Remove useless local variables _match_, _soc_ and the code related.
      
      Notice that
      
      const struct of_device_id of_mtk_match[] = {
              { .compatible = "mediatek,mt2701-eth" },
              {},
      };
      
      So match->data is NULL.
      Suggested-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarGustavo A. R. Silva <garsilva@embeddedor.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e8df7603
    • Roopa Prabhu's avatar
      mpls: fix uninitialized in_label var warning in mpls_getroute · a906c1aa
      Roopa Prabhu authored
      Fix the below warning generated by static checker:
          net/mpls/af_mpls.c:2111 mpls_getroute()
          error: uninitialized symbol 'in_label'."
      
      Fixes: 397fc9e5 ("mpls: route get support")
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarRoopa Prabhu <roopa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a906c1aa
    • Nicolas Dichtel's avatar
      doc: SKB_GSO_[IPIP|SIT] have been replaced · 11bafd54
      Nicolas Dichtel authored
      Those enum values don't exist anymore.
      
      Fixes: 7e13318d ("net: define gso types for IPx over IPv4 and IPv6")
      CC: Tom Herbert <tom@herbertland.com>
      Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      11bafd54
    • WANG Cong's avatar
      bonding: avoid NETDEV_CHANGEMTU event when unregistering slave · f51048c3
      WANG Cong authored
      As Hongjun/Nicolas summarized in their original patch:
      
      "
      When a device changes from one netns to another, it's first unregistered,
      then the netns reference is updated and the dev is registered in the new
      netns. Thus, when a slave moves to another netns, it is first
      unregistered. This triggers a NETDEV_UNREGISTER event which is caught by
      the bonding driver. The driver calls bond_release(), which calls
      dev_set_mtu() and thus triggers NETDEV_CHANGEMTU (the device is still in
      the old netns).
      "
      
      This is a very special case, because the device is being unregistered
      no one should still care about the NETDEV_CHANGEMTU event triggered
      at this point, we can avoid broadcasting this event on this path,
      and avoid touching inetdev_event()/addrconf_notify() path.
      
      It requires to export __dev_set_mtu() to bonding driver.
      Reported-by: default avatarHongjun Li <hongjun.li@6wind.com>
      Reported-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
      Cc: Jay Vosburgh <j.vosburgh@gmail.com>
      Cc: Veaceslav Falico <vfalico@gmail.com>
      Cc: Andy Gospodarek <andy@greyhouse.net>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f51048c3
    • David S. Miller's avatar
      Merge branch 'rds-tcp-sock_graft-leak' · 5dc314f8
      David S. Miller authored
      Sowmini Varadhan says:
      
      ====================
      rds-tcp: sock_graft() leak
      
      Following up on the discussion at
        https://www.spinics.net/lists/netdev/msg442859.html
      - make rds_tcp_accept_one() call sock_create_lite()
      - add a WARN_ON() to sock_graft()
      
      Tested by running an infinite while() loop that does
      (module-load; rds-stress; module-unload) and monitors
      TCP slabinfo while the test is running.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5dc314f8
    • Sowmini Varadhan's avatar
      net/sock: add WARN_ON(parent->sk) in sock_graft() · 0ffdaf5b
      Sowmini Varadhan authored
      sock_graft() unilaterally sets up parent->sk based on the
      assumption that the existing parent->sk is null. If this
      condition is not true, then the existing parent->sk would
      be leaked, so add a WARN_ON() to alert callers who may fall
      in this category.
      Signed-off-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0ffdaf5b
    • Sowmini Varadhan's avatar
      rds: tcp: use sock_create_lite() to create the accept socket · 0933a578
      Sowmini Varadhan authored
      There are two problems with calling sock_create_kern() from
      rds_tcp_accept_one()
      1. it sets up a new_sock->sk that is wasteful, because this ->sk
         is going to get replaced by inet_accept() in the subsequent ->accept()
      2. The new_sock->sk is a leaked reference in sock_graft() which
         expects to find a null parent->sk
      
      Avoid these problems by calling sock_create_lite().
      Signed-off-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
      Acked-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0933a578
    • David S. Miller's avatar
      Merge branch 'hns-fixes' · 9dc351da
      David S. Miller authored
      Lin Yun Sheng says:
      
      ====================
      Bugfixs for hns ethernet driver
      
      This patchset fix skb used after free and C45 op code issues
      in hns driver.
      
      Patch V2:
      	1. Remove ndev->feature checking in TX description patch.
      	2. Add Fixes: Tag in patch description.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9dc351da
    • Yunsheng Lin's avatar
      net: hns: Fix a skb used after free bug · 27463ad9
      Yunsheng Lin authored
      skb maybe freed in hns_nic_net_xmit_hw() and return NETDEV_TX_OK,
      which cause hns_nic_net_xmit to use a freed skb.
      
      BUG: KASAN: use-after-free in hns_nic_net_xmit_hw+0x62c/0x940...
      	[17659.112635]      alloc_debug_processing+0x18c/0x1a0
      	[17659.117208]      __slab_alloc+0x52c/0x560
      	[17659.120909]      kmem_cache_alloc_node+0xac/0x2c0
      	[17659.125309]      __alloc_skb+0x6c/0x260
      	[17659.128837]      tcp_send_ack+0x8c/0x280
      	[17659.132449]      __tcp_ack_snd_check+0x9c/0xf0
      	[17659.136587]      tcp_rcv_established+0x5a4/0xa70
      	[17659.140899]      tcp_v4_do_rcv+0x27c/0x620
      	[17659.144687]      tcp_prequeue_process+0x108/0x170
      	[17659.149085]      tcp_recvmsg+0x940/0x1020
      	[17659.152787]      inet_recvmsg+0x124/0x180
      	[17659.156488]      sock_recvmsg+0x64/0x80
      	[17659.160012]      SyS_recvfrom+0xd8/0x180
      	[17659.163626]      __sys_trace_return+0x0/0x4
      	[17659.167506] INFO: Freed in kfree_skbmem+0xa0/0xb0 age=23 cpu=1 pid=13
      	[17659.174000]      free_debug_processing+0x1d4/0x2c0
      	[17659.178486]      __slab_free+0x240/0x390
      	[17659.182100]      kmem_cache_free+0x24c/0x270
      	[17659.186062]      kfree_skbmem+0xa0/0xb0
      	[17659.189587]      __kfree_skb+0x28/0x40
      	[17659.193025]      napi_gro_receive+0x168/0x1c0
      	[17659.197074]      hns_nic_rx_up_pro+0x58/0x90
      	[17659.201038]      hns_nic_rx_poll_one+0x518/0xbc0
      	[17659.205352]      hns_nic_common_poll+0x94/0x140
      	[17659.209576]      net_rx_action+0x458/0x5e0
      	[17659.213363]      __do_softirq+0x1b8/0x480
      	[17659.217062]      run_ksoftirqd+0x64/0x80
      	[17659.220679]      smpboot_thread_fn+0x224/0x310
      	[17659.224821]      kthread+0x150/0x170
      	[17659.228084]      ret_from_fork+0x10/0x40
      
      	BUG: KASAN: use-after-free in hns_nic_net_xmit+0x8c/0xc0...
      	[17751.080490]      __slab_alloc+0x52c/0x560
      	[17751.084188]      kmem_cache_alloc+0x244/0x280
      	[17751.088238]      __build_skb+0x40/0x150
      	[17751.091764]      build_skb+0x28/0x100
      	[17751.095115]      __alloc_rx_skb+0x94/0x150
      	[17751.098900]      __napi_alloc_skb+0x34/0x90
      	[17751.102776]      hns_nic_rx_poll_one+0x180/0xbc0
      	[17751.107097]      hns_nic_common_poll+0x94/0x140
      	[17751.111333]      net_rx_action+0x458/0x5e0
      	[17751.115123]      __do_softirq+0x1b8/0x480
      	[17751.118823]      run_ksoftirqd+0x64/0x80
      	[17751.122437]      smpboot_thread_fn+0x224/0x310
      	[17751.126575]      kthread+0x150/0x170
      	[17751.129838]      ret_from_fork+0x10/0x40
      	[17751.133454] INFO: Freed in kfree_skbmem+0xa0/0xb0 age=19 cpu=7 pid=43
      	[17751.139951]      free_debug_processing+0x1d4/0x2c0
      	[17751.144436]      __slab_free+0x240/0x390
      	[17751.148051]      kmem_cache_free+0x24c/0x270
      	[17751.152014]      kfree_skbmem+0xa0/0xb0
      	[17751.155543]      __kfree_skb+0x28/0x40
      	[17751.159022]      napi_gro_receive+0x168/0x1c0
      	[17751.163074]      hns_nic_rx_up_pro+0x58/0x90
      	[17751.167041]      hns_nic_rx_poll_one+0x518/0xbc0
      	[17751.171358]      hns_nic_common_poll+0x94/0x140
      	[17751.175585]      net_rx_action+0x458/0x5e0
      	[17751.179373]      __do_softirq+0x1b8/0x480
      	[17751.183076]      run_ksoftirqd+0x64/0x80
      	[17751.186691]      smpboot_thread_fn+0x224/0x310
      	[17751.190826]      kthread+0x150/0x170
      	[17751.194093]      ret_from_fork+0x10/0x40
      
      Fixes: 13ac695e ("net:hns: Add support of Hip06 SoC to the Hislicon Network Subsystem")
      Signed-off-by: default avatarYunsheng Lin <linyunsheng@huawei.com>
      Signed-off-by: default avatarlipeng <lipeng321@huawei.com>
      Reported-by: default avatarJun He <hjat2005@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      27463ad9
    • Yunsheng Lin's avatar
      net: hns: Fix a wrong op phy C45 code · ebe8d359
      Yunsheng Lin authored
      As the user manual described, the second step to write to C45 phy
      by mdio should be data, but not address. Here we should fix this
      issue.
      
      Fixes: 5b904d39 ("net: add Hisilicon Network Subsystem MDIO support")
      Signed-off-by: default avatarYunsheng Lin <linyunsheng@huawei.com>
      Reviewed-by: default avatarlipeng <lipeng321@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ebe8d359
    • vishnuvardhan's avatar
      net: macb: Adding Support for Jumbo Frames up to 10240 Bytes in SAMA5D3 · 233a1587
      vishnuvardhan authored
      As per the SAMA5D3 device specification it supports Jumbo frames.
      But the suggested flag and length of bytes it supports was not updated
      in this driver config_structure.
      The maximum jumbo frames the device supports :
      10240 bytes as per the device spec.
      
      While changing the MTU value greater than 1500, it threw error:
      sudo ifconfig eth1 mtu 9000
      SIOCSIFMTU: Invalid argument
      
      Add this support to driver so that it works as expected and designed.
      Signed-off-by: default avatarvishnuvardhan <vardhanraj4143@gmail.com>
      [nicolas.ferre@microchip.com: modify slightly commit msg]
      Signed-off-by: default avatarNicolas Ferre <nicolas.ferre@microchip.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      233a1587
    • Linus Torvalds's avatar
      Merge branch 'work.read_write' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · cee37d83
      Linus Torvalds authored
      Pull read/write fix from Al Viro:
       "file_start_write()/file_end_write() got mixed into vfs_iter_write() by
        accident; that's a deadlock for all existing callers - they already do
        that, some - quite a bit outside.
      
        Easily fixed, fortunately"
      
      * 'work.read_write' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        move file_{start,end}_write() out of do_iter_write()
      cee37d83
    • Linus Torvalds's avatar
      Merge branch 'uaccess-work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 6a37e940
      Linus Torvalds authored
      Pull iov_iter hardening from Al Viro:
       "This is the iov_iter/uaccess/hardening pile.
      
        For one thing, it trims the inline part of copy_to_user/copy_from_user
        to the minimum that *does* need to be inlined - object size checks,
        basically. For another, it sanitizes the checks for iov_iter
        primitives. There are 4 groups of checks: access_ok(), might_fault(),
        object size and KASAN.
      
         - access_ok() had been verified by whoever had set the iov_iter up.
           However, that has happened in a function far away, so proving that
           there's no path to actual copying bypassing those checks is hard
           and proving that iov_iter has not been buggered in the meanwhile is
           also not pleasant. So we want those redone in actual
           copyin/copyout.
      
         - might_fault() is better off consolidated - we know whether it needs
           to be checked as soon as we enter iov_iter primitive and observe
           the iov_iter flavour. No need to wait until the copyin/copyout. The
           call chains are short enough to make sure we won't miss anything -
           in fact, it's more robust that way, since there are cases where we
           do e.g. forced fault-in before getting to copyin/copyout. It's not
           quite what we need to check (in particular, combination of
           iovec-backed and set_fs(KERNEL_DS) is almost certainly a bug, not a
           cause to skip checks), but that's for later series. For now let's
           keep might_fault().
      
         - KASAN checks belong in copyin/copyout - at the same level where
           other iov_iter flavours would've hit them in memcpy().
      
         - object size checks should apply to *all* iov_iter flavours, not
           just iovec-backed ones.
      
        There are two groups of primitives - one gets the kernel object
        described as pointer + size (copy_to_iter(), etc.) while another gets
        it as page + offset + size (copy_page_to_iter(), etc.)
      
        For the first group the checks are best done where we actually have a
        chance to find the object size. In other words, those belong in inline
        wrappers in uio.h, before calling into iov_iter.c. Same kind as we
        have for inlined part of copy_to_user().
      
        For the second group there is no object to look at - offset in page is
        just a number, it bears no type information. So we do them in the
        common helper called by iov_iter.c primitives of that kind. All it
        currently does is checking that we are not trying to access outside of
        the compound page; eventually we might want to add some sanity checks
        on the page involved.
      
        So the things we need in copyin/copyout part of iov_iter.c do not
        quite match anything in uaccess.h (we want no zeroing, we *do* want
        access_ok() and KASAN and we want no might_fault() or object size
        checks done on that level). OTOH, these needs are simple enough to
        provide a couple of helpers (static in iov_iter.c) doing just what we
        need..."
      
      * 'uaccess-work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        iov_iter: saner checks on copyin/copyout
        iov_iter: sanity checks for copy to/from page primitives
        iov_iter/hardening: move object size checks to inlined part
        copy_{to,from}_user(): consolidate object size checks
        copy_{from,to}_user(): move kasan checks and might_fault() out-of-line
      6a37e940
    • Kees Cook's avatar
      exec: Limit arg stack to at most 75% of _STK_LIM · da029c11
      Kees Cook authored
      To avoid pathological stack usage or the need to special-case setuid
      execs, just limit all arg stack usage to at most 75% of _STK_LIM (6MB).
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      da029c11
    • Linus Torvalds's avatar
      Merge tag 'for-linus-v4.13-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux · 088737f4
      Linus Torvalds authored
      Pull Writeback error handling updates from Jeff Layton:
       "This pile represents the bulk of the writeback error handling fixes
        that I have for this cycle. Some of the earlier patches in this pile
        may look trivial but they are prerequisites for later patches in the
        series.
      
        The aim of this set is to improve how we track and report writeback
        errors to userland. Most applications that care about data integrity
        will periodically call fsync/fdatasync/msync to ensure that their
        writes have made it to the backing store.
      
        For a very long time, we have tracked writeback errors using two flags
        in the address_space: AS_EIO and AS_ENOSPC. Those flags are set when a
        writeback error occurs (via mapping_set_error) and are cleared as a
        side-effect of filemap_check_errors (as you noted yesterday). This
        model really sucks for userland.
      
        Only the first task to call fsync (or msync or fdatasync) will see the
        error. Any subsequent task calling fsync on a file will get back 0
        (unless another writeback error occurs in the interim). If I have
        several tasks writing to a file and calling fsync to ensure that their
        writes got stored, then I need to have them coordinate with one
        another. That's difficult enough, but in a world of containerized
        setups that coordination may even not be possible.
      
        But wait...it gets worse!
      
        The calls to filemap_check_errors can be buried pretty far down in the
        call stack, and there are internal callers of filemap_write_and_wait
        and the like that also end up clearing those errors. Many of those
        callers ignore the error return from that function or return it to
        userland at nonsensical times (e.g. truncate() or stat()). If I get
        back -EIO on a truncate, there is no reason to think that it was
        because some previous writeback failed, and a subsequent fsync() will
        (incorrectly) return 0.
      
        This pile aims to do three things:
      
         1) ensure that when a writeback error occurs that that error will be
            reported to userland on a subsequent fsync/fdatasync/msync call,
            regardless of what internal callers are doing
      
         2) report writeback errors on all file descriptions that were open at
            the time that the error occurred. This is a user-visible change,
            but I think most applications are written to assume this behavior
            anyway. Those that aren't are unlikely to be hurt by it.
      
         3) document what filesystems should do when there is a writeback
            error. Today, there is very little consistency between them, and a
            lot of cargo-cult copying. We need to make it very clear what
            filesystems should do in this situation.
      
        To achieve this, the set adds a new data type (errseq_t) and then
        builds new writeback error tracking infrastructure around that. Once
        all of that is in place, we change the filesystems to use the new
        infrastructure for reporting wb errors to userland.
      
        Note that this is just the initial foray into cleaning up this mess.
        There is a lot of work remaining here:
      
         1) convert the rest of the filesystems in a similar fashion. Once the
            initial set is in, then I think most other fs' will be fairly
            simple to convert. Hopefully most of those can in via individual
            filesystem trees.
      
         2) convert internal waiters on writeback to use errseq_t for
            detecting errors instead of relying on the AS_* flags. I have some
            draft patches for this for ext4, but they are not quite ready for
            prime time yet.
      
        This was a discussion topic this year at LSF/MM too. If you're
        interested in the gory details, LWN has some good articles about this:
      
            https://lwn.net/Articles/718734/
            https://lwn.net/Articles/724307/"
      
      * tag 'for-linus-v4.13-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux:
        btrfs: minimal conversion to errseq_t writeback error reporting on fsync
        xfs: minimal conversion to errseq_t writeback error reporting
        ext4: use errseq_t based error handling for reporting data writeback errors
        fs: convert __generic_file_fsync to use errseq_t based reporting
        block: convert to errseq_t based writeback error tracking
        dax: set errors in mapping when writeback fails
        Documentation: flesh out the section in vfs.txt on storing and reporting writeback errors
        mm: set both AS_EIO/AS_ENOSPC and errseq_t in mapping_set_error
        fs: new infrastructure for writeback error handling and reporting
        lib: add errseq_t type and infrastructure for handling it
        mm: don't TestClearPageError in __filemap_fdatawait_range
        mm: clear AS_EIO/AS_ENOSPC when writeback initiation fails
        jbd2: don't clear and reset errors after waiting on writeback
        buffer: set errors in mapping at the time that the error occurs
        fs: check for writeback errors after syncing out buffers in generic_file_fsync
        buffer: use mapping_set_error instead of setting the flag
        mm: fix mapping_set_error call in me_pagecache_dirty
      088737f4
    • Linus Torvalds's avatar
      Merge tag 'for-linus-v4.13-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux · 33198c16
      Linus Torvalds authored
      Pull Writeback error handling fixes from Jeff Layton:
       "The main rationale for all of these changes is to tighten up writeback
        error reporting to userland. There are many ways now that writeback
        errors can be lost, such that fsync/fdatasync/msync return 0 when
        writeback actually failed.
      
        This pile contains a small set of cleanups and writeback error
        handling fixes that I was able to break off from the main pile (#2).
      
        Two of the patches in this pile are trivial. The exceptions are the
        patch to fix up error handling in write_one_page, and the patch to
        make JFS pay attention to write_one_page errors"
      
      * tag 'for-linus-v4.13-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux:
        fs: remove call_fsync helper function
        mm: clean up error handling in write_one_page
        JFS: do not ignore return code from write_one_page()
        mm: drop "wait" parameter from write_one_page()
      33198c16
    • Linus Torvalds's avatar
      Merge tag 'cifs-bug-fixes-for-4.13' of git://git.samba.org/sfrench/cifs-2.6 · 3ea4fcc5
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "First set of CIFS/SMB3 fixes for the merge window. Also improves POSIX
        character mapping for SMB3"
      
      * tag 'cifs-bug-fixes-for-4.13' of git://git.samba.org/sfrench/cifs-2.6:
        CIFS: fix circular locking dependency
        cifs: set oparms.create_options rather than or'ing in CREATE_OPEN_BACKUP_INTENT
        cifs: Do not modify mid entry after submitting I/O in cifs_call_async
        CIFS: add SFM mapping for 0x01-0x1F
        cifs: hide unused functions
        cifs: Use smb 2 - 3 and cifsacl mount options getacl functions
        cifs: prototype declaration and definition for smb 2 - 3 and cifsacl mount options
        CIFS: add CONFIG_CIFS_DEBUG_KEYS to dump encryption keys
        cifs: set mapping error when page writeback fails in writepage or launder_pages
        SMB3: Enable encryption for SMB3.1.1
      3ea4fcc5
    • Linus Torvalds's avatar
      Merge tag 'gfs2-4.13.fixes.addendum' of... · 1a86fc75
      Linus Torvalds authored
      Merge tag 'gfs2-4.13.fixes.addendum' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2
      
      Pull GFS2 fix from Bob Peterson:
       "Sorry for the additional merge request, but Andreas discovered this
        problem soon after you processed our last gfs2 merge.
      
        This fixes a regression introduced by a patch we did in mid-2015
        (commit 88ffbf3e: "GFS2: Use resizable hash table for glocks"), so
        best to get it fixed. Some code was reverted that should not have
        been.
      
        The patch from Andreas Gruenbacher just re-adds code that had been
        there originally"
      
      * tag 'gfs2-4.13.fixes.addendum' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2:
        gfs2: Fix glock rhashtable rcu bug
      1a86fc75