1. 15 Nov, 2016 1 commit
    • Jens Axboe's avatar
      Merge branch 'nvmf-4.9-rc' of git://git.infradead.org/nvme-fabrics into for-linus · 959401aa
      Jens Axboe authored
      Sagi writes:
      
      These are the relevant fixes for rc6
      - fix possible crash in nvmet-rdma cm_handler from Bart
      - fix possible memory leak in nvmet-rdma for connection failures
      - fix possible use-after-free conditions in nvmet-rdma
      - fix possible IO errors during reconnect stage from Christoph
      - fix possible memory leak in nvme-rdma during IO queues connect
        failures from Steve
      959401aa
  2. 14 Nov, 2016 25 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · e76d21c4
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix off by one wrt. indexing when dumping /proc/net/route entries,
          from Alexander Duyck.
      
       2) Fix lockdep splats in iwlwifi, from Johannes Berg.
      
       3) Cure panic when inserting certain netfilter rules when NFT_SET_HASH
          is disabled, from Liping Zhang.
      
       4) Memory leak when nft_expr_clone() fails, also from Liping Zhang.
      
       5) Disable UFO when path will apply IPSEC tranformations, from Jakub
          Sitnicki.
      
       6) Don't bogusly double cwnd in dctcp module, from Florian Westphal.
      
       7) skb_checksum_help() should never actually use the value "0" for the
          resulting checksum, that has a special meaning, use CSUM_MANGLED_0
          instead. From Eric Dumazet.
      
       8) Per-tx/rx queue statistic strings are wrong in qed driver, fix from
          Yuval MIntz.
      
       9) Fix SCTP reference counting of associations and transports in
          sctp_diag. From Xin Long.
      
      10) When we hit ip6tunnel_xmit() we could have come from an ipv4 path in
          a previous layer or similar, so explicitly clear the ipv6 control
          block in the skb. From Eli Cooper.
      
      11) Fix bogus sleeping inside of inet_wait_for_connect(), from WANG
          Cong.
      
      12) Correct deivce ID of T6 adapter in cxgb4 driver, from Hariprasad
          Shenai.
      
      13) Fix potential access past the end of the skb page frag array in
          tcp_sendmsg(). From Eric Dumazet.
      
      14) 'skb' can legitimately be NULL in inet{,6}_exact_dif_match(). Fix
          from David Ahern.
      
      15) Don't return an error in tcp_sendmsg() if we wronte any bytes
          successfully, from Eric Dumazet.
      
      16) Extraneous unlocks in netlink_diag_dump(), we removed the locking
          but forgot to purge these unlock calls. From Eric Dumazet.
      
      17) Fix memory leak in error path of __genl_register_family(). We leak
          the attrbuf, from WANG Cong.
      
      18) cgroupstats netlink policy table is mis-sized, from WANG Cong.
      
      19) Several XDP bug fixes in mlx5, from Saeed Mahameed.
      
      20) Fix several device refcount leaks in network drivers, from Johan
          Hovold.
      
      21) icmp6_send() should use skb dst device not skb->dev to determine L3
          routing domain. From David Ahern.
      
      22) ip_vs_genl_family sets maxattr incorrectly, from WANG Cong.
      
      23) We leak new macvlan port in some cases of maclan_common_netlink()
          errors. Fix from Gao Feng.
      
      24) Similar to the icmp6_send() fix, icmp_route_lookup() should
          determine L3 routing domain using skb_dst(skb)->dev not skb->dev.
          Also from David Ahern.
      
      25) Several fixes for route offloading and FIB notification handling in
          mlxsw driver, from Jiri Pirko.
      
      26) Properly cap __skb_flow_dissect()'s return value, from Eric Dumazet.
      
      27) Fix long standing regression in ipv4 redirect handling, wrt.
          validating the new neighbour's reachability. From Stephen Suryaputra
          Lin.
      
      28) If sk_filter() trims the packet excessively, handle it reasonably in
          tcp input instead of exploding. From Eric Dumazet.
      
      29) Fix handling of napi hash state when copying channels in sfc driver,
          from Bert Kenward.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (121 commits)
        mlxsw: spectrum_router: Flush FIB tables during fini
        net: stmmac: Fix lack of link transition for fixed PHYs
        sctp: change sk state only when it has assocs in sctp_shutdown
        bnx2: Wait for in-flight DMA to complete at probe stage
        Revert "bnx2: Reset device during driver initialization"
        ps3_gelic: fix spelling mistake in debug message
        net: ethernet: ixp4xx_eth: fix spelling mistake in debug message
        ibmvnic: Fix size of debugfs name buffer
        ibmvnic: Unmap ibmvnic_statistics structure
        sfc: clear napi_hash state when copying channels
        mlxsw: spectrum_router: Correctly dump neighbour activity
        mlxsw: spectrum: Fix refcount bug on span entries
        bnxt_en: Fix VF virtual link state.
        bnxt_en: Fix ring arithmetic in bnxt_setup_tc().
        Revert "include/uapi/linux/atm_zatm.h: include linux/time.h"
        tcp: take care of truncations done by sk_filter()
        ipv4: use new_gw for redirect neigh lookup
        r8152: Fix error path in open function
        net: bpqether.h: remove if_ether.h guard
        net: __skb_flow_dissect() must cap its return value
        ...
      e76d21c4
    • Linus Torvalds's avatar
      Merge branch 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile · d4b95323
      Linus Torvalds authored
      Pull arch/tile bugfix from Chris Metcalf:
       "This just fixes an incompatibility with tile __ro_after_init"
      
      * 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
        tile: handle __ro_after_init like parisc does
      d4b95323
    • Linus Torvalds's avatar
      Merge tag 'rtc-4.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux · ac38126b
      Linus Torvalds authored
      Pull RTC fixes from Alexandre Belloni:
       "Here are a few driver fixes for 4.9. It has been calm for a while so I
        don't expect more for this cycle.
      
        Drivers:
         - asm9260: fix module autoload
         - cmos: fix crashes
         - omap: fix clock handling"
      
      * tag 'rtc-4.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:
        rtc: omap: prevent disabling of clock/module during suspend
        rtc: omap: Fix selecting external osc
        rtc: cmos: Don't enable interrupts in the middle of the interrupt handler
        rtc: cmos: remove all __exit_p annotations
        rtc: asm9260: fix module autoload
      ac38126b
    • Chris Metcalf's avatar
      tile: handle __ro_after_init like parisc does · e123386b
      Chris Metcalf authored
      The tile architecture already marks RO_DATA as read-only in
      the kernel, so grouping RO_AFTER_INIT_DATA with RO_DATA, as is
      done by default, means the kernel faults in init when it tries
      to write to RO_AFTER_INIT_DATA.  For now, just arrange that
      __ro_after_init is handled like __write_once, i.e. __read_mostly.
      Reviewed-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarChris Metcalf <cmetcalf@mellanox.com>
      e123386b
    • Ido Schimmel's avatar
      mlxsw: spectrum_router: Flush FIB tables during fini · ac571de9
      Ido Schimmel authored
      Since commit b45f64d1 ("mlxsw: spectrum_router: Use FIB notifications
      instead of switchdev calls") we reflect to the device the entire FIB
      table and not only FIBs that point to netdevs created by the driver.
      
      During module removal, FIBs of the second type are removed following
      NETDEV_UNREGISTER events sent. The other FIBs are still present in both
      the driver's cache and the device's table.
      
      Fix this by iterating over all the FIB tables in the device and flush
      them. There's no need to take locks, as we're the only writer.
      
      Fixes: b45f64d1 ("mlxsw: spectrum_router: Use FIB notifications instead of switchdev calls")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ac571de9
    • Florian Fainelli's avatar
      net: stmmac: Fix lack of link transition for fixed PHYs · c51e424d
      Florian Fainelli authored
      Commit 52f95bbf ("stmmac: fix adjust link call in case of a switch
      is attached") added some logic to avoid polling the fixed PHY and
      therefore invoking the adjust_link callback more than once, since this
      is a fixed PHY and link events won't be generated.
      
      This works fine the first time, because we start with phydev->irq =
      PHY_POLL, so we call adjust_link, then we set phydev->irq =
      PHY_IGNORE_INTERRUPT and we stop polling the PHY.
      
      Now, if we called ndo_close(), which calls both phy_stop() and does an
      explicit netif_carrier_off(), we end up with a link down. Upon calling
      ndo_open() again, despite starting the PHY state machine, we have
      PHY_IGNORE_INTERRUPT set, and we generate no link event at all, so the
      link is permanently down.
      
      Fixes: 52f95bbf ("stmmac: fix adjust link call in case of a switch is attached")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Acked-by: default avatarGiuseppe Cavallaro <peppe.cavallaro@st.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c51e424d
    • Xin Long's avatar
      sctp: change sk state only when it has assocs in sctp_shutdown · 5bf35ddf
      Xin Long authored
      Now when users shutdown a sock with SEND_SHUTDOWN in sctp, even if
      this sock has no connection (assoc), sk state would be changed to
      SCTP_SS_CLOSING, which is not as we expect.
      
      Besides, after that if users try to listen on this sock, kernel
      could even panic when it dereference sctp_sk(sk)->bind_hash in
      sctp_inet_listen, as bind_hash is null when sock has no assoc.
      
      This patch is to move sk state change after checking sk assocs
      is not empty, and also merge these two if() conditions and reduce
      indent level.
      
      Fixes: d46e416c ("sctp: sctp should change socket state when shutdown is received")
      Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Tested-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5bf35ddf
    • David S. Miller's avatar
      Merge branch 'bnx2-kdump-fix' · 193f5122
      David S. Miller authored
      Baoquan He says:
      
      ====================
      bnx2: Wait for in-flight DMA to complete at probe stage
      
      This is v2 post.
      
      In commit 3e1be7ad ("bnx2: Reset device during driver initialization"),
      firmware requesting code was moved from open stage to probe stage.
      The reason is in kdump kernel hardware iommu need device be reset in
      driver probe stage, otherwise those in-flight DMA from 1st kernel
      will continue going and look up into the newly created io-page tables.
      However bnx2 chip resetting involves firmware requesting issue, that
      need be done in open stage.
      
      Michale Chan suggested we can just wait for the old in-flight DMA to
      complete at probe stage, then though without device resetting, we
      don't need to worry the old in-flight DMA could continue looking up
      the newly created io-page tables.
      
      v1->v2:
          Michael suggested to wait for the in-flight DMA to complete at probe
          stage. So give up the old method of trying to reset chip at probe
          stage, take the new way accordingly.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      193f5122
    • Baoquan He's avatar
      bnx2: Wait for in-flight DMA to complete at probe stage · 6df77862
      Baoquan He authored
      In-flight DMA from 1st kernel could continue going in kdump kernel.
      New io-page table has been created before bnx2 does reset at open stage.
      We have to wait for the in-flight DMA to complete to avoid it look up
      into the newly created io-page table at probe stage.
      Suggested-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarBaoquan He <bhe@redhat.com>
      Acked-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6df77862
    • Baoquan He's avatar
      Revert "bnx2: Reset device during driver initialization" · 5d0d4b91
      Baoquan He authored
      This reverts commit 3e1be7ad.
      
      When people build bnx2 driver into kernel, it will fail to detect
      and load firmware because firmware is contained in initramfs and
      initramfs has not been uncompressed yet during do_initcalls. So
      revert commit 3e1be7ad and work out a new way in the later patch.
      Signed-off-by: default avatarBaoquan He <bhe@redhat.com>
      Acked-by: default avatarPaul Menzel <pmenzel@molgen.mpg.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5d0d4b91
    • Colin Ian King's avatar
      ps3_gelic: fix spelling mistake in debug message · 7020637b
      Colin Ian King authored
      Trivial fix to spelling mistake "unmached" to "unmatched" in
      debug message.
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7020637b
    • Linus Torvalds's avatar
      ASoC: lpass-platform: fix uninitialized variable · ee2bd216
      Linus Torvalds authored
      In commit 022d00ee ("ASoC: lpass-platform: Fix broken pcm data
      usage") the stream specific information initialization was broken, with
      the dma channel information not being initialized if there was no
      alloc_dma_channel() helper function.
      
      Before that, the DMA channel number was implicitly initialized to zero
      because the backing store was allocated with devm_kzalloc().  When the
      init code was rewritten, that implicit initialization was lost, and gcc
      rightfully complains about an uninitialized variable being used.
      
      Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
      Cc: Mark Brown <broonie@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ee2bd216
    • Linus Torvalds's avatar
      Revert "printk: make reading the kernel log flush pending lines" · f5c9f9c7
      Linus Torvalds authored
      This reverts commit bfd8d3f2.
      
      It turns out that this flushes things much too aggressiverly, and causes
      lines to break up when the system logger races with new continuation
      lines being printed.
      
      There's a pending patch to make printk() flushing much more
      straightforward, but it's too invasive for 4.9, so in the meantime let's
      just not make the system message logging flush continuation lines.
      They'll be flushed by the final newline anyway.
      Suggested-by: default avatarPetr Mladek <pmladek@suse.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f5c9f9c7
    • Mauro Carvalho Chehab's avatar
      gp8psk-fe: add missing MODULE_foo() macros · b15efc38
      Mauro Carvalho Chehab authored
      This file was converted to a separate module at commit 7a0786c1
      ("gp8psk: Fix DVB frontend attach"), because the DVB attach routines
      require it to work.  However, I forgot to copy the MODULE_foo() macros
      from the original module, causing this warning:
      
          WARNING: modpost: missing MODULE_LICENSE() in drivers/media/dvb-frontends/gp8psk-fe.o
      Reported-by: default avatarStephen Rothwell <sfr@canb.auug.org.au>
      Fixes: 7a0786c1 ("gp8psk: Fix DVB frontend attach")
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b15efc38
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 8528d662
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Misc fixes:
      
         - fix an Intel/MID boot crash/hang bug
      
         - fix a cache topology mis-parsing bug on certain AMD CPUs
      
         - fix a virtualization firmware bug by adding a check+quirk
           workaround on the kernel side"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/cpu: Deal with broken firmware (VMWare/XEN)
        x86/cpu/AMD: Fix cpu_llc_id for AMD Fam17h systems
        x86/platform/intel-mid: Retrofit pci_platform_pm_ops ->get_state hook
      8528d662
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 5d69561b
      Linus Torvalds authored
      Pull irq fix from Ingo Molnar:
       "This fixes a genirq regression that resulted in the Intel/Broxton
        pinctrl/GPIO driver (and possibly others) spewing warnings"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        genirq: Use irq type from irqdata instead of irqdesc
      5d69561b
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 5ad62a9e
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "An uncore PMU driver hardware enablement change for Intel SkyLake
        uncore PMUs (Skylake Y, U, H and S platforms), plus a number of
        tooling fixes for the histogram handling/displaying code"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86/intel/uncore: Add more Intel uncore IMC PCI IDs for SkyLake
        perf hists: Fix column length on --hierarchy
        perf hists browser: Fix column indentation on --hierarchy
        perf hists browser: Show folded sign properly on --hierarchy
        perf hists browser: Fix indentation of folded sign on --hierarchy
        perf hist browser: Fix hierarchy column counts
      5ad62a9e
    • Linus Torvalds's avatar
      Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 53381e2e
      Linus Torvalds authored
      Pull EFI fixes from Ingo Molnar:
       "A boot crash fix and a build warning fix"
      
      * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/efi: Prevent mixed mode boot corruption with CONFIG_VMAP_STACK=y
        x86/efi: Fix EFI memmap pointer size warning
      53381e2e
    • Linus Torvalds's avatar
      Merge tag 'ntb-4.9' of git://github.com/jonmason/ntb · 28ddafa5
      Linus Torvalds authored
      Pull NTB fixes from Jon Mason:
       "NTB bug fixes for ntb_hw_intel, ntb_perf, and ntb_pingpong.
      
        Also, a fixup to use jiffies in schedule_timeout_* call instead of a
        constant"
      
      * tag 'ntb-4.9' of git://github.com/jonmason/ntb:
        ntb_perf: potential info leak in debugfs
        ntb: ntb_hw_intel: init peer_addr in struct intel_ntb_dev
        ntb: make DMA_OUT_RESOURCE_TO HZ independent
        ntb_transport: make DMA_OUT_RESOURCE_TO HZ independent
        NTB: ntb_hw_intel: Fix typo in module parameter descriptions
        ntb_pingpong: Fix db_init parameter description
      28ddafa5
    • Sagi Grimberg's avatar
      nvmet-rdma: drain the queue-pair just before freeing it · 14c862db
      Sagi Grimberg authored
      draining the qp right after disconnect might not suffice because
      the nvmet sq is not fully drained (in nvmet_sq_destroy) and we might
      see completions after the drain. Instead, drain right before the
      qp destroy which comes after the sq destruction and we can be sure
      that no posts come after the drain.
      Tested-by: default avatarSteve Wise <swise@opengridcomputing.com>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      14c862db
    • Steve Wise's avatar
      nvme-rdma: stop and free io queues on connect failure · c8dbc37c
      Steve Wise authored
      While testing nvme-rdma with the spdk nvmf target over iw_cxgb4, I
      configured the target (mistakenly) to generate an error creating the
      NVMF IO queues.  This resulted a "Invalid SQE Parameter" error sent back
      to the host on the first IO queue connect:
      
      [ 9610.928182] nvme nvme1: queue_size 128 > ctrl maxcmd 120, clamping down
      [ 9610.938745] nvme nvme1: creating 32 I/O queues.
      
      So nvmf_connect_io_queue() returns an error to
      nvmf_connect_io_queue() / nvmf_connect_io_queues(), and that
      is returned to nvme_rdma_create_io_queues().  In the error path,
      nvmf_rdma_create_io_queues() frees the queue tagset memory _before_
      stopping and freeing the IB queues, which causes yet another
      touch-after-free crash due to SQ CQEs being flushed after the ib_cqe
      structs pointed-to by the flushed WRs have been freed (since they are
      part of the nvme_rdma_request struct).
      
      The fix is to stop and free the queues in nvmf_connect_io_queues()
      if there is an error connecting any of the queues.
      Signed-off-by: default avatarSteve Wise <swise@opengridcomputing.com>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      c8dbc37c
    • Sagi Grimberg's avatar
      nvmet-rdma: don't forget to delete a queue from the list of connection failed · 766dbb17
      Sagi Grimberg authored
      In case we accepted a queue connection and it failed, we might not
      remove the queue from the list until we unload and clean it up.
      We should delete it from the queue list on the relevant handler.
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      766dbb17
    • Sagi Grimberg's avatar
      nvmet: Don't queue fatal error work if csts.cfs is set · 8242ddac
      Sagi Grimberg authored
      In the transport, in case of an interal queue error like
      error completion in rdma we trigger a fatal error. However,
      multiple queues in the same controller can serr error completions
      and we don't want to trigger fatal error work more than once.
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      8242ddac
    • Christoph Hellwig's avatar
      nvme-rdma: reject non-connect commands before the queue is live · 553cd9ef
      Christoph Hellwig authored
      If we reconncect we might have command queue up that get resent as soon
      as the queue is restarted.  But until the connect command succeeded we
      can't send other command.  Add a new flag that marks a queue as live when
      connect finishes, and delay any non-connect command until the queue is
      live based on it.
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reported-by: default avatarSteve Wise <swise@opengridcomputing.com>
      Tested-by: default avatarSteve Wise <swise@opengridcomputing.com>
      [sagig: fixes admin queue LIVE setting]
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      553cd9ef
    • Bart Van Assche's avatar
      nvmet-rdma: Fix possible NULL deref when handling rdma cm events · fa14a0ac
      Bart Van Assche authored
      When we initiate queue teardown sequence we call rdma_destroy_qp
      which clears cm_id->qp, afterwards we call rdma_destroy_id, but
      we might see a rdma_cm event in between with a cleared cm_id->qp
      so watch out for that and silently ignore the event because this
      means that the queue teardown sequence is in progress.
      Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      fa14a0ac
  3. 13 Nov, 2016 14 commits