1. 11 Dec, 2017 6 commits
    • Kevin Cernekee's avatar
      netlink: Add netns check on taps · 93c64764
      Kevin Cernekee authored
      Currently, a nlmon link inside a child namespace can observe systemwide
      netlink activity.  Filter the traffic so that nlmon can only sniff
      netlink messages from its own netns.
      
      Test case:
      
          vpnns -- bash -c "ip link add nlmon0 type nlmon; \
                            ip link set nlmon0 up; \
                            tcpdump -i nlmon0 -q -w /tmp/nlmon.pcap -U" &
          sudo ip xfrm state add src 10.1.1.1 dst 10.1.1.2 proto esp \
              spi 0x1 mode transport \
              auth sha1 0x6162633132330000000000000000000000000000 \
              enc aes 0x00000000000000000000000000000000
          grep --binary abc123 /tmp/nlmon.pcap
      Signed-off-by: default avatarKevin Cernekee <cernekee@chromium.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      93c64764
    • Thomas Petazzoni's avatar
      net: sh_eth: do not advertise Gigabit capabilities when not available · 2aab6b40
      Thomas Petazzoni authored
      Not all variants of the sh_eth hardware have Gigabit
      support. Unfortunately, the current driver doesn't tell the PHY about
      the limited MAC capabilities. Due to this, if you have a Gigabit
      capable PHY, the PHY will advertise its Gigabit capability and
      establish a link at 1Gbit/s, even though the MAC doesn't support it.
      
      In order to avoid this, we use the recently introduced
      phy_set_max_speed() to tell the PHY to not advertise speed higher than
      100 MBit/s.
      
      Tested on a SH7786 platform, with a Gigabit PHY.
      Signed-off-by: default avatarThomas Petazzoni <thomas.petazzoni@free-electrons.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2aab6b40
    • Jerome Brunet's avatar
      net: phy: meson-gxl: detect LPA corruption · f1e2400a
      Jerome Brunet authored
      The purpose of this change is to fix the incorrect detection of the link
      partner (LP) advertised capabilities which sometimes happens with this PHY
      (roughly 1 time in a dozen)
      
      This issue may cause the link to be negotiated at 10Mbps/Full or
      10Mbps/Half when 100MBps/Full is actually possible. In some case, the link
      is even completely broken and no communication is possible.
      
      To detect the corruption, we must look for a magic undocumented bit in the
      WOL bank (hint given by the SoC vendor kernel) but this is not enough to
      cover all cases. We also have to look at the LPA ack. If the LP supports
      Aneg but did not ack our base code when aneg is completed, we assume
      something went wrong.
      
      The detection of a corrupted LPA triggers a restart of the aneg process.
      This solves the problem but may take up to 6 retries to complete.
      
      Fixes: 7334b3e4 ("net: phy: Add Meson GXL Internal PHY driver")
      Signed-off-by: default avatarJerome Brunet <jbrunet@baylibre.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f1e2400a
    • Michael S. Tsirkin's avatar
      ptr_ring: add barriers · a8ceb5db
      Michael S. Tsirkin authored
      Users of ptr_ring expect that it's safe to give the
      data structure a pointer and have it be available
      to consumers, but that actually requires an smb_wmb
      or a stronger barrier.
      
      In absence of such barriers and on architectures that reorder writes,
      consumer might read an un=initialized value from an skb pointer stored
      in the skb array.  This was observed causing crashes.
      
      To fix, add memory barriers.  The barrier we use is a wmb, the
      assumption being that producers do not need to read the value so we do
      not need to order these reads.
      Reported-by: default avatarGeorge Cherian <george.cherian@cavium.com>
      Suggested-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a8ceb5db
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2017-12-11' of... · f0f1d016
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2017-12-11' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      Three fixes:
       * for certificate C file generation, don't use hexdump as it's
         not always installed by default, use pure posix instead (od/sed)
       * for certificate C file generation, don't write the file if
         anything fails, so the build abort will not cause a bad build
         upon a second attempt
       * fix locking in ieee80211_sta_tear_down_BA_sessions() which had
         been causing lots of locking warnings
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f0f1d016
    • Johannes Berg's avatar
      mac80211: fix locking in ieee80211_sta_tear_down_BA_sessions · 0afe9d4a
      Johannes Berg authored
      Due to overlap between
      commit 12811037 ("mac80211: Simplify locking in ieee80211_sta_tear_down_BA_sessions()")
      and the way that Luca modified
      commit 72e2c343 ("mac80211: tear down RX aggregations first")
      when sending it upstream from Intel's internal tree, we get
      the following warning:
      
      WARNING: CPU: 0 PID: 5472 at net/mac80211/agg-tx.c:315 ___ieee80211_stop_tx_ba_session+0x158/0x1f0
      
      since there's no appropriate locking around the call to
      ___ieee80211_stop_tx_ba_session; Sara's original just had
      a call to the locked __ieee80211_stop_tx_ba_session (one
      less underscore) but it looks like Luca modified both of
      the calls when fixing it up for upstream, leading to the
      problem at hand.
      
      Move the locking appropriately to fix this problem.
      Reported-by: default avatarKalle Valo <kvalo@codeaurora.org>
      Reported-by: default avatarPavel Machek <pavel@ucw.cz>
      Tested-by: default avatarPavel Machek <pavel@ucw.cz>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      0afe9d4a
  2. 08 Dec, 2017 34 commits
    • Michal Hocko's avatar
      kmemcheck: rip it out for real · f335195a
      Michal Hocko authored
      Commit 4675ff05 ("kmemcheck: rip it out") has removed the code but
      for some reason SPDX header stayed in place.  This looks like a rebase
      mistake in the mmotm tree or the merge mistake.  Let's drop those
      leftovers as well.
      Signed-off-by: default avatarMichal Hocko <mhocko@suse.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f335195a
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · e9ef1fe3
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) CAN fixes from Martin Kelly (cancel URBs properly in all the CAN usb
          drivers).
      
       2) Revert returning -EEXIST from __dev_alloc_name() as this propagates
          to userspace and broke some apps. From Johannes Berg.
      
       3) Fix conn memory leaks and crashes in TIPC, from Jon Malloc and Cong
          Wang.
      
       4) Gianfar MAC can't do EEE so don't advertise it by default, from
          Claudiu Manoil.
      
       5) Relax strict netlink attribute validation, but emit a warning. From
          David Ahern.
      
       6) Fix regression in checksum offload of thunderx driver, from Florian
          Westphal.
      
       7) Fix UAPI bpf issues on s390, from Hendrik Brueckner.
      
       8) New card support in iwlwifi, from Ihab Zhaika.
      
       9) BBR congestion control bug fixes from Neal Cardwell.
      
      10) Fix port stats in nfp driver, from Pieter Jansen van Vuuren.
      
      11) Fix leaks in qualcomm rmnet, from Subash Abhinov Kasiviswanathan.
      
      12) Fix DMA API handling in sh_eth driver, from Thomas Petazzoni.
      
      13) Fix spurious netpoll warnings in bnxt_en, from Calvin Owens.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (67 commits)
        net: mvpp2: fix the RSS table entry offset
        tcp: evaluate packet losses upon RTT change
        tcp: fix off-by-one bug in RACK
        tcp: always evaluate losses in RACK upon undo
        tcp: correctly test congestion state in RACK
        bnxt_en: Fix sources of spurious netpoll warnings
        tcp_bbr: reset long-term bandwidth sampling on loss recovery undo
        tcp_bbr: reset full pipe detection on loss recovery undo
        tcp_bbr: record "full bw reached" decision in new full_bw_reached bit
        sfc: pass valid pointers from efx_enqueue_unwind
        gianfar: Disable EEE autoneg by default
        tcp: invalidate rate samples during SACK reneging
        can: peak/pcie_fd: fix potential bug in restarting tx queue
        can: usb_8dev: cancel urb on -EPIPE and -EPROTO
        can: kvaser_usb: cancel urb on -EPIPE and -EPROTO
        can: esd_usb2: cancel urb on -EPIPE and -EPROTO
        can: ems_usb: cancel urb on -EPIPE and -EPROTO
        can: mcba_usb: cancel urb on -EPROTO
        usbnet: fix alignment for frames with no ethernet header
        tcp: use current time in tcp_rcv_space_adjust()
        ...
      e9ef1fe3
    • Linus Torvalds's avatar
      Merge tag 'media/v4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 77071bc6
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
      
       "A series of fixes for the media subsytem:
      
         - The largest amount of fixes in this series is with regards to
           comments that aren't kernel-doc, but start with "/**".
      
           A new check added for 4.15 makes it to produce a *huge* amount of
           new warnings (I'm compiling here with W=1). Most of the patches in
           this series fix those.
      
           No code changes - just comment changes at the source files
      
         - rc: some fixed in order to better handle RC repetition codes
      
         - v4l-async: use the v4l2_dev from the root notifier when matching
           sub-devices
      
         - v4l2-fwnode: Check subdev count after checking port
      
         - ov 13858 and et8ek8: compilation fix with randconfigs
      
         - usbtv: a trivial new USB ID addition
      
         - dibusb-common: don't do DMA on stack on firmware load
      
         - imx274: Fix error handling, add MAINTAINERS entry
      
         - sir_ir: detect presence of port"
      
      * tag 'media/v4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (50 commits)
        media: imx274: Fix error handling, add MAINTAINERS entry
        media: v4l: async: use the v4l2_dev from the root notifier when matching sub-devices
        media: v4l2-fwnode: Check subdev count after checking port
        media: et8ek8: select V4L2_FWNODE
        media: ov13858: Select V4L2_FWNODE
        media: rc: partial revert of "media: rc: per-protocol repeat period"
        media: dvb: i2c transfers over usb cannot be done from stack
        media: dvb-frontends: complete kernel-doc markups
        media: docs: add documentation for frontend attach info
        media: dvb_frontends: fix kernel-doc macros
        media: drivers: remove "/**" from non-kernel-doc comments
        media: lm3560: add a missing kernel-doc parameter
        media: rcar_jpu: fix two kernel-doc markups
        media: vsp1: add a missing kernel-doc parameter
        media: soc_camera: fix a kernel-doc markup
        media: mt2063: fix some kernel-doc warnings
        media: radio-wl1273: fix a parameter name at kernel-doc macro
        media: s3c-camif: add missing description at s3c_camif_find_format()
        media: mtk-vpu: add description for wdt fields at struct mtk_vpu
        media: vdec: fix some kernel-doc warnings
        ...
      77071bc6
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.15-rc3' of git://people.freedesktop.org/~airlied/linux · 4066aa72
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This pull is a bit larger than I'd like but a large bunch of it is
        license fixes, AMD wanted to fix the licenses for a bunch of files
        that were missing them,
      
       Otherwise a bunch of TTM regression fix since the hugepage support,
       some i915 and gvt fixes, a core connector free in a safe context fix,
       and one bridge fix"
      
      * tag 'drm-fixes-for-v4.15-rc3' of git://people.freedesktop.org/~airlied/linux: (26 commits)
        drm/bridge: analogix dp: Fix runtime PM state in get_modes() callback
        Revert "drm/i915: Display WA #1133 WaFbcSkipSegments:cnl, glk"
        drm/vc4: Fix false positive WARN() backtrace on refcount_inc() usage
        drm/i915: Call i915_gem_init_userptr() before taking struct_mutex
        drm/exynos: remove unnecessary function declaration
        drm/exynos: remove unnecessary descrptions
        drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU
        drm/exynos: Fix dma-buf import
        drm/ttm: swap consecutive allocated pooled pages v4
        drm: safely free connectors from connector_iter
        drm/i915/gvt: set max priority for gvt context
        drm/i915/gvt: Don't mark vgpu context as inactive when preempted
        drm/i915/gvt: Limit read hw reg to active vgpu
        drm/i915/gvt: Export intel_gvt_render_mmio_to_ring_id()
        drm/i915/gvt: Emulate PCI expansion ROM base address register
        drm/ttm: swap consecutive allocated cached pages v3
        drm/ttm: roundup the shrink request to prevent skip huge pool
        drm/ttm: add page order support in ttm_pages_put
        drm/ttm: add set_pages_wb for handling page order more than zero
        drm/ttm: add page order in page pool
        ...
      4066aa72
    • Linus Torvalds's avatar
      Merge tag 'md/4.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md · 7267212c
      Linus Torvalds authored
      Pull md fixes from Shaohua Li:
       "Some MD fixes.
      
        The notable one is a raid5-cache deadlock bug with dm-raid, others are
        not significant"
      
      * tag 'md/4.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
        md/raid1/10: add missed blk plug
        md: limit mdstat resync progress to max_sectors
        md/r5cache: move mddev_lock() out of r5c_journal_mode_set()
        md/raid5: correct degraded calculation in raid5_error
      7267212c
    • Linus Torvalds's avatar
      Merge tag 'devicetree-fixes-for-4.15-part2' of... · 78d9b048
      Linus Torvalds authored
      Merge tag 'devicetree-fixes-for-4.15-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
      
      Pull DeviceTree fixes from Rob Herring:
       "Another set of DT fixes:
      
         - Fixes from overlay code rework. A trifecta of fixes to the locking,
           an out of bounds access, and a memory leak in of_overlay_apply()
      
         - Clean-up at25 eeprom binding document
      
         - Remove leading '0x' in unit-addresses from binding docs"
      
      * tag 'devicetree-fixes-for-4.15-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
        of: overlay: Make node skipping in init_overlay_changeset() clearer
        of: overlay: Fix out-of-bounds write in init_overlay_changeset()
        of: overlay: Fix (un)locking in of_overlay_apply()
        of: overlay: Fix memory leak in of_overlay_apply() error path
        dt-bindings: eeprom: at25: Document device-specific compatible values
        dt-bindings: eeprom: at25: Grammar s/are can/can/
        dt-bindings: Remove leading 0x from bindings notation
        of: overlay: Remove else after goto
        of: Spelling s/changset/changeset/
        of: unittest: Remove bogus overlay mutex release from overlay_data_add()
      78d9b048
    • Linus Torvalds's avatar
      Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost · 900add27
      Linus Torvalds authored
      Pull virtio bugfixes from Michael Tsirkin:
       "A couple of minor bugfixes"
      
      * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
        virtio_net: fix return value check in receive_mergeable()
        virtio_mmio: add cleanup for virtio_mmio_remove
        virtio_mmio: add cleanup for virtio_mmio_probe
      900add27
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.15-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 32abeb09
      Linus Torvalds authored
      Pull xen fixes from Juergen Gross:
       "Just two small fixes for the new pvcalls frontend driver"
      
      * tag 'for-linus-4.15-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen/pvcalls: Fix a check in pvcalls_front_remove()
        xen/pvcalls: check for xenbus_read() errors
      32abeb09
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · d90696ed
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
      
       "One notable fix for kexec on Power9, where we were not clearing MMU
        PID properly which sometimes leads to hangs. Finally debugged to a
        root cause by Nick.
      
        A revert of a patch which tried to rework our panic handling to get
        more output on the console, but inadvertently broke reporting the
        panic to the hypervisor, which apparently people care about.
      
        Then a fix for an oops in the PMU code, and finally some s/%p/%px/ in
        xmon.
      
        Thanks to: David Gibson, Nicholas Piggin, Ravi Bangoria"
      
      * tag 'powerpc-4.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/xmon: Don't print hashed pointers in xmon
        powerpc/64s: Initialize ISAv3 MMU registers before setting partition table
        Revert "powerpc: Do not call ppc_md.panic in fadump panic notifier"
        powerpc/perf: Fix oops when grouping different pmu events
      d90696ed
    • David S. Miller's avatar
      Merge tag 'linux-can-fixes-for-4.15-20171208' of... · fd29117a
      David S. Miller authored
      Merge tag 'linux-can-fixes-for-4.15-20171208' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
      
      Marc Kleine-Budde says:
      
      ====================
      pull-request: can 2017-12-08
      
      this is a pull request of 6 patches for net/master.
      
      Martin Kelly provides 5 patches for various USB based CAN drivers, that
      properly cancel the URBs on adapter unplug, so that the driver doesn't
      end up in an endless loop. Stephane Grosjean provides a patch to restart
      the tx queue if zero length packages are transmitted.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fd29117a
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-for-davem-2017-12-08' of... · 03afb6e4
      David S. Miller authored
      Merge tag 'wireless-drivers-for-davem-2017-12-08' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      wireless-drivers fixes for 4.15
      
      Second set of fixes for 4.15. This time a lot of iwlwifi patches and
      two brcmfmac patches. Most important here are the MIC and IVC fixes
      for iwlwifi to unbreak 9000 series.
      
      iwlwifi
      
      * fix rate-scaling to not start lowest possible rate
      
      * fix the TX queue hang detection for AP/GO modes
      
      * fix the TX queue hang timeout in monitor interfaces
      
      * fix packet injection
      
      * remove a wrong error message when dumping PCI registers
      
      * fix race condition with RF-kill
      
      * tell mac80211 when the MIC has been stripped (9000 series)
      
      * tell mac80211 when the IVC has been stripped (9000 series)
      
      * add 2 new PCI IDs, one for 9000 and one for 22000
      
      * fix a queue hang due during a P2P Remain-on-Channel operation
      
      brcmfmac
      
      * fix a race which sometimes caused a crash during sdio unbind
      
      * fix a kernel-doc related build error
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      03afb6e4
    • Antoine Tenart's avatar
      net: mvpp2: fix the RSS table entry offset · 8a7b741e
      Antoine Tenart authored
      The macro used to access or set an RSS table entry was using an offset
      of 8, while it should use an offset of 0. This lead to wrongly configure
      the RSS table, not accessing the right entries.
      
      Fixes: 1d7d15d7 ("net: mvpp2: initialize the RSS tables")
      Signed-off-by: default avatarAntoine Tenart <antoine.tenart@free-electrons.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8a7b741e
    • David S. Miller's avatar
      Merge branch 'tcp-RACK-loss-recovery-bug-fixes' · b7e445a1
      David S. Miller authored
      Yuchung Cheng says:
      
      ====================
      tcp: RACK loss recovery bug fixes
      
      This patch set has four minor bug fixes in TCP RACK loss recovery.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b7e445a1
    • Yuchung Cheng's avatar
      tcp: evaluate packet losses upon RTT change · 6065fd0d
      Yuchung Cheng authored
      RACK skips an ACK unless it advances the most recently delivered
      TX timestamp (rack.mstamp). Since RACK also uses the most recent
      RTT to decide if a packet is lost, RACK should still run the
      loss detection whenever the most recent RTT changes. For example,
      an ACK that does not advance the timestamp but triggers the cwnd
      undo due to reordering, would then use the most recent (higher)
      RTT measurement to detect further losses.
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Reviewed-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarPriyaranjan Jha <priyarjha@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6065fd0d
    • Yuchung Cheng's avatar
      tcp: fix off-by-one bug in RACK · 428aec5e
      Yuchung Cheng authored
      RACK should mark a packet lost when remaining wait time is zero.
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Reviewed-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarPriyaranjan Jha <priyarjha@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      428aec5e
    • Yuchung Cheng's avatar
      tcp: always evaluate losses in RACK upon undo · cd1fc85b
      Yuchung Cheng authored
      When sender detects spurious retransmission, all packets
      marked lost are remarked to be in-flight. However some may
      be considered lost based on its timestamps in RACK. This patch
      forces RACK to re-evaluate, which may be skipped previously if
      the ACK does not advance RACK timestamp.
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Reviewed-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarPriyaranjan Jha <priyarjha@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cd1fc85b
    • Yuchung Cheng's avatar
      tcp: correctly test congestion state in RACK · 0ce294d8
      Yuchung Cheng authored
      RACK does not test the loss recovery state correctly to compute
      the reordering window. It assumes if lost_out is zero then TCP is
      not in loss recovery. But it can be zero during recovery before
      calling tcp_rack_detect_loss(): when an ACK acknowledges all
      packets marked lost before receiving this ACK, but has not yet
      to discover new ones by tcp_rack_detect_loss(). The fix is to
      simply test the congestion state directly.
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Reviewed-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarPriyaranjan Jha <priyarjha@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0ce294d8
    • Calvin Owens's avatar
      bnxt_en: Fix sources of spurious netpoll warnings · 2edbdb31
      Calvin Owens authored
      After applying 2270bc5d ("bnxt_en: Fix netpoll handling") and
      903649e7 ("bnxt_en: Improve -ENOMEM logic in NAPI poll loop."),
      we still see the following WARN fire:
      
        ------------[ cut here ]------------
        WARNING: CPU: 0 PID: 1875170 at net/core/netpoll.c:165 netpoll_poll_dev+0x15a/0x160
        bnxt_poll+0x0/0xd0 exceeded budget in poll
        <snip>
        Call Trace:
         [<ffffffff814be5cd>] dump_stack+0x4d/0x70
         [<ffffffff8107e013>] __warn+0xd3/0xf0
         [<ffffffff8107e07f>] warn_slowpath_fmt+0x4f/0x60
         [<ffffffff8179519a>] netpoll_poll_dev+0x15a/0x160
         [<ffffffff81795f38>] netpoll_send_skb_on_dev+0x168/0x250
         [<ffffffff817962fc>] netpoll_send_udp+0x2dc/0x440
         [<ffffffff815fa9be>] write_ext_msg+0x20e/0x250
         [<ffffffff810c8125>] call_console_drivers.constprop.23+0xa5/0x110
         [<ffffffff810c9549>] console_unlock+0x339/0x5b0
         [<ffffffff810c9a88>] vprintk_emit+0x2c8/0x450
         [<ffffffff810c9d5f>] vprintk_default+0x1f/0x30
         [<ffffffff81173df5>] printk+0x48/0x50
         [<ffffffffa0197713>] edac_raw_mc_handle_error+0x563/0x5c0 [edac_core]
         [<ffffffffa0197b9b>] edac_mc_handle_error+0x42b/0x6e0 [edac_core]
         [<ffffffffa01c3a60>] sbridge_mce_output_error+0x410/0x10d0 [sb_edac]
         [<ffffffffa01c47cc>] sbridge_check_error+0xac/0x130 [sb_edac]
         [<ffffffffa0197f3c>] edac_mc_workq_function+0x3c/0x90 [edac_core]
         [<ffffffff81095f8b>] process_one_work+0x19b/0x480
         [<ffffffff810967ca>] worker_thread+0x6a/0x520
         [<ffffffff8109c7c4>] kthread+0xe4/0x100
         [<ffffffff81884c52>] ret_from_fork+0x22/0x40
      
      This happens because we increment rx_pkts on -ENOMEM and -EIO, resulting
      in rx_pkts > 0. Fix this by only bumping rx_pkts if we were actually
      given a non-zero budget.
      Signed-off-by: default avatarCalvin Owens <calvinowens@fb.com>
      Acked-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2edbdb31
    • David S. Miller's avatar
      Merge branch 'tcp-bbr-sampling-fixes' · b25b3e2f
      David S. Miller authored
      Neal Cardwell says:
      
      ====================
      TCP BBR sampling fixes for loss recovery undo
      
      This patch series has a few minor bug fixes for cases where spurious
      loss recoveries can trick BBR estimators into estimating that the
      available bandwidth is much lower than the true available bandwidth.
      In both cases the fix here is to just reset the estimator upon loss
      recovery undo.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b25b3e2f
    • Neal Cardwell's avatar
      tcp_bbr: reset long-term bandwidth sampling on loss recovery undo · 600647d4
      Neal Cardwell authored
      Fix BBR so that upon notification of a loss recovery undo BBR resets
      long-term bandwidth sampling.
      
      Under high reordering, reordering events can be interpreted as loss.
      If the reordering and spurious loss estimates are high enough, this
      can cause BBR to spuriously estimate that we are seeing loss rates
      high enough to trigger long-term bandwidth estimation. To avoid that
      problem, this commit resets long-term bandwidth sampling on loss
      recovery undo events.
      Signed-off-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarYuchung Cheng <ycheng@google.com>
      Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      600647d4
    • Neal Cardwell's avatar
      tcp_bbr: reset full pipe detection on loss recovery undo · 2f6c498e
      Neal Cardwell authored
      Fix BBR so that upon notification of a loss recovery undo BBR resets
      the full pipe detection (STARTUP exit) state machine.
      
      Under high reordering, reordering events can be interpreted as loss.
      If the reordering and spurious loss estimates are high enough, this
      could previously cause BBR to spuriously estimate that the pipe is
      full.
      
      Since spurious loss recovery means that our overall sending will have
      slowed down spuriously, this commit gives a flow more time to probe
      robustly for bandwidth and decide the pipe is really full.
      Signed-off-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarYuchung Cheng <ycheng@google.com>
      Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2f6c498e
    • Neal Cardwell's avatar
      tcp_bbr: record "full bw reached" decision in new full_bw_reached bit · c589e69b
      Neal Cardwell authored
      This commit records the "full bw reached" decision in a new
      full_bw_reached bit. This is a pure refactor that does not change the
      current behavior, but enables subsequent fixes and improvements.
      
      In particular, this enables simple and clean fixes because the full_bw
      and full_bw_cnt can be unconditionally zeroed without worrying about
      forgetting that we estimated we filled the pipe in Startup. And it
      enables future improvements because multiple code paths can be used
      for estimating that we filled the pipe in Startup; any new code paths
      only need to set this bit when they think the pipe is full.
      
      Note that this fix intentionally reduces the width of the full_bw_cnt
      counter, since we have never used the most significant bit.
      Signed-off-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarYuchung Cheng <ycheng@google.com>
      Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c589e69b
    • Bert Kenward's avatar
      sfc: pass valid pointers from efx_enqueue_unwind · d4a7a889
      Bert Kenward authored
      The bytes_compl and pkts_compl pointers passed to efx_dequeue_buffers
      cannot be NULL. Add a paranoid warning to check this condition and fix
      the one case where they were NULL.
      
      efx_enqueue_unwind() is called very rarely, during error handling.
      Without this fix it would fail with a NULL pointer dereference in
      efx_dequeue_buffer, with efx_enqueue_skb in the call stack.
      
      Fixes: e9117e50 ("sfc: Firmware-Assisted TSO version 2")
      Reported-by: default avatarJarod Wilson <jarod@redhat.com>
      Signed-off-by: default avatarBert Kenward <bkenward@solarflare.com>
      Tested-by: default avatarJarod Wilson <jarod@redhat.com>
      Acked-by: default avatarJarod Wilson <jarod@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d4a7a889
    • Claudiu Manoil's avatar
      gianfar: Disable EEE autoneg by default · b6b5e8a6
      Claudiu Manoil authored
      This controller does not support EEE, but it may connect to a PHY
      which supports EEE and advertises EEE by default, while its link
      partner also advertises EEE. If this happens, the PHY enters low
      power mode when the traffic rate is low and causes packet loss.
      This patch disables EEE advertisement by default for any PHY that
      gianfar connects to, to prevent the above unwanted outcome.
      Signed-off-by: default avatarShaohui Xie <Shaohui.Xie@nxp.com>
      Tested-by: default avatarYangbo Lu <Yangbo.lu@nxp.com>
      Signed-off-by: default avatarClaudiu Manoil <claudiu.manoil@nxp.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b6b5e8a6
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · c6b3e969
      Linus Torvalds authored
      Pull s390 fixes from Martin Schwidefsky:
      
       - three more patches in regard to the SPDX license tags. The missing
         tags for the files in arch/s390/kvm will be merged via the KVM tree.
         With that all s390 related files should have their SPDX tags.
      
       - a patch to get rid of 'struct timespec' in the DASD driver.
      
       - bug fixes
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390: fix compat system call table
        s390/mm: fix off-by-one bug in 5-level page table handling
        s390: Remove redudant license text
        s390: add a few more SPDX identifiers
        s390/dasd: prevent prefix I/O error
        s390: always save and restore all registers on context switch
        s390/dasd: remove 'struct timespec' usage
        s390/qdio: restrict target-full handling to IQDIO
        s390/qdio: consider ERROR buffers for inbound-full condition
        s390/virtio: add BSD license to virtio-ccw
      c6b3e969
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 6e7e7f4d
      Linus Torvalds authored
      Pull arm64 fixes from Will Deacon:
       "Fix some more FP register fallout from the SVE patches and also some
        problems with the PGD tracking in our software PAN emulation code,
        after we received a crash report from a 3.18 kernel running a
        backport.
      
        Summary:
      
         - fix SW PAN pgd shadowing for kernel threads, EFI and exiting user
           tasks
      
         - fix FP register leak when a task_struct is re-allocated
      
         - fix potential use-after-free in FP state tracking used by KVM"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64/sve: Avoid dereference of dead task_struct in KVM guest entry
        arm64: SW PAN: Update saved ttbr0 value on enter_lazy_tlb
        arm64: SW PAN: Point saved ttbr0 at the zero page when switching to init_mm
        arm64: fpsimd: Abstract out binding of task's fpsimd context to the cpu.
        arm64: fpsimd: Prevent registers leaking from dead tasks
      6e7e7f4d
    • Linus Torvalds's avatar
      Merge tag 'acpi-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 3625de4b
      Linus Torvalds authored
      Pull ACPI fix from Rafael Wysocki:
       "This fixes an out of bounds warning from KASAN in the ACPI CPPC
        driver"
      
      * tag 'acpi-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI / CPPC: Fix KASAN global out of bounds warning
      3625de4b
    • Linus Torvalds's avatar
      Merge tag 'pm-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 7ed9fd2e
      Linus Torvalds authored
      Pull power management fix from Rafael Wysocki:
       "This fixes an issue in the device runtime PM framework that prevents
        customer devices from resuming if runtime PM is disabled for one or
        more of their supplier devices (as reflected by device links between
        those devices)"
      
      * tag 'pm-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        PM / runtime: Fix handling of suppliers with disabled runtime PM
      7ed9fd2e
    • Geert Uytterhoeven's avatar
      of: overlay: Make node skipping in init_overlay_changeset() clearer · 589b754d
      Geert Uytterhoeven authored
      Make it more clear that nodes without "__overlay__" subnodes are
      skipped, by reverting the logic and using continue.
      This also reduces indentation level.
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Signed-off-by: default avatarRob Herring <robh@kernel.org>
      589b754d
    • Geert Uytterhoeven's avatar
      of: overlay: Fix out-of-bounds write in init_overlay_changeset() · 35e691ed
      Geert Uytterhoeven authored
      If an overlay has no "__symbols__" node, but it has nodes without
      "__overlay__" subnodes at the end (e.g. a "__fixups__" node), after
      filling in all fragments for nodes with "__overlay__" subnodes,
      "fragment = &fragments[cnt]" will point beyond the end of the allocated
      array.
      
      Hence writing to "fragment->overlay" will overwrite unallocated memory,
      which may lead to a crash later.
      
      Fix this by deferring both the assignment to "fragment" and the
      offending write afterwards until we know for sure the node has an
      "__overlay__" subnode, and thus a valid entry in "fragments[]".
      
      Fixes: 61b4de4e ("of: overlay: minor restructuring")
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Signed-off-by: default avatarRob Herring <robh@kernel.org>
      35e691ed
    • Yousuk Seung's avatar
      tcp: invalidate rate samples during SACK reneging · d4761754
      Yousuk Seung authored
      Mark tcp_sock during a SACK reneging event and invalidate rate samples
      while marked. Such rate samples may overestimate bw by including packets
      that were SACKed before reneging.
      
      < ack 6001 win 10000 sack 7001:38001
      < ack 7001 win 0 sack 8001:38001 // Reneg detected
      > seq 7001:8001 // RTO, SACK cleared.
      < ack 38001 win 10000
      
      In above example the rate sample taken after the last ack will count
      7001-38001 as delivered while the actual delivery rate likely could
      be much lower i.e. 7001-8001.
      
      This patch adds a new field tcp_sock.sack_reneg and marks it when we
      declare SACK reneging and entering TCP_CA_Loss, and unmarks it after
      the last rate sample was taken before moving back to TCP_CA_Open. This
      patch also invalidates rate samples taken while tcp_sock.is_sack_reneg
      is set.
      
      Fixes: b9f64820 ("tcp: track data delivery rate for a TCP connection")
      Signed-off-by: default avatarYousuk Seung <ysseung@google.com>
      Signed-off-by: default avatarNeal Cardwell <ncardwell@google.com>
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarPriyaranjan Jha <priyarjha@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d4761754
    • Stephane Grosjean's avatar
      can: peak/pcie_fd: fix potential bug in restarting tx queue · 91785de6
      Stephane Grosjean authored
      Don't rely on can_get_echo_skb() return value to wake the network tx
      queue up: can_get_echo_skb() returns 0 if the echo array slot was not
      occupied, but also when the DLC of the released echo frame was 0.
      Signed-off-by: default avatarStephane Grosjean <s.grosjean@peak-system.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      91785de6
    • Martin Kelly's avatar
      can: usb_8dev: cancel urb on -EPIPE and -EPROTO · 12147edc
      Martin Kelly authored
      In mcba_usb, we have observed that when you unplug the device, the driver will
      endlessly resubmit failing URBs, which can cause CPU stalls. This issue
      is fixed in mcba_usb by catching the codes seen on device disconnect
      (-EPIPE and -EPROTO).
      
      This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it
      in the same way.
      Signed-off-by: default avatarMartin Kelly <mkelly@xevo.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      12147edc
    • Martin Kelly's avatar
      can: kvaser_usb: cancel urb on -EPIPE and -EPROTO · 6aa8d594
      Martin Kelly authored
      In mcba_usb, we have observed that when you unplug the device, the driver will
      endlessly resubmit failing URBs, which can cause CPU stalls. This issue
      is fixed in mcba_usb by catching the codes seen on device disconnect
      (-EPIPE and -EPROTO).
      
      This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it
      in the same way.
      Signed-off-by: default avatarMartin Kelly <mkelly@xevo.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      6aa8d594