1. 23 Mar, 2018 1 commit
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.16-rc7' of git://people.freedesktop.org/~airlied/linux · 9ec7ccc8
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "A bunch of fixes all over the place (core, i915, amdgpu, imx, sun4i,
        ast, tegra, vmwgfx), nothing too serious or worrying at this stage.
      
         - one uapi fix to stop multi-planar images with getfb
      
         - Sun4i error path and clock fixes
      
         - udl driver mmap offset fix
      
         - i915 DP MST and GPU reset fixes
      
         - vmwgfx mutex and black screen fixes
      
         - imx array underflow fix and vblank fix
      
         - amdgpu: display fixes
      
         - exynos devicetree fix
      
         - ast mode fix"
      
      * tag 'drm-fixes-for-v4.16-rc7' of git://people.freedesktop.org/~airlied/linux: (29 commits)
        drm/ast: Fixed 1280x800 Display Issue
        drm: udl: Properly check framebuffer mmap offsets
        drm/i915: Specify which engines to reset following semaphore/event lockups
        drm/vmwgfx: Fix a destoy-while-held mutex problem.
        drm/vmwgfx: Fix black screen and device errors when running without fbdev
        drm: Reject getfb for multi-plane framebuffers
        drm/amd/display: Add one to EDID's audio channel count when passing to DC
        drm/amd/display: We shouldn't set format_default on plane as atomic driver
        drm/amd/display: Fix FMT truncation programming
        drm/amd/display: Allow truncation to 10 bits
        drm/sun4i: hdmi: Fix another error handling path in 'sun4i_hdmi_bind()'
        drm/sun4i: hdmi: Fix an error handling path in 'sun4i_hdmi_bind()'
        drm/i915/dp: Write to SET_POWER dpcd to enable MST hub.
        drm/amd/display: fix dereferencing possible ERR_PTR()
        drm/amd/display: Refine disable VGA
        drm/tegra: Shutdown on driver unbind
        drm/tegra: dsi: Don't disable regulator on ->exit()
        drm/tegra: dc: Detach IOMMU group from domain only once
        dt-bindings: exynos: Document #sound-dai-cells property of the HDMI node
        drm/imx: move arming of the vblank event to atomic_flush
        ...
      9ec7ccc8
  2. 22 Mar, 2018 39 commits
    • Y.C. Chen's avatar
      drm/ast: Fixed 1280x800 Display Issue · 5a9f698f
      Y.C. Chen authored
      The original ast driver cannot display properly if the resolution is 1280x800 and the pixel clock is 83.5MHz.
      Here is the update to fix it.
      Signed-off-by: default avatarY.C. Chen <yc_chen@aspeedtech.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      5a9f698f
    • Linus Torvalds's avatar
      Merge tag 'acpi-4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · e7d7743f
      Linus Torvalds authored
      Pull ACPI fixes from Rafael Wysocki:
       "These revert one recent commit that added incorrect battery quirks for
        some Asus systems and fix an off-by-one error in the watchdog driver
        based on the ACPI WDAT table.
      
        Specifics:
      
         - Revert the recent change adding battery quirks for Asus GL502VSK
           and UX305LA as these quirks turn out to be inadequate and possibly
           premature (Daniel Drake).
      
         - Fix an off-by-one error in the resource allocation part of the
           watchdog driver based on the ACPI WDAT table (Takashi Iwai)"
      
      * tag 'acpi-4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI / watchdog: Fix off-by-one error at resource assignment
        Revert "ACPI / battery: Add quirk for Asus GL502VSK and UX305LA"
      e7d7743f
    • Linus Torvalds's avatar
      Merge tag 'modules-for-v4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux · 394c73d3
      Linus Torvalds authored
      Pull modules fix from Jessica Yu:
       "Propagate error in modules_open() to avoid possible later NULL
        dereference if seq_open() had failed"
      
      * tag 'modules-for-v4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux:
        module: propagate error in modules_open()
      394c73d3
    • Rafael J. Wysocki's avatar
      Merge branch 'acpi-wdat' · 594fdbaa
      Rafael J. Wysocki authored
      * acpi-wdat:
        ACPI / watchdog: Fix off-by-one error at resource assignment
      594fdbaa
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c4f4d2f9
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Always validate XFRM esn replay attribute, from Florian Westphal.
      
       2) Fix RCU read lock imbalance in xfrm_get_tos(), from Xin Long.
      
       3) Don't try to get firmware dump if not loaded in iwlwifi, from Shaul
          Triebitz.
      
       4) Fix BPF helpers to deal with SCTP GSO SKBs properly, from Daniel
          Axtens.
      
       5) Fix some interrupt handling issues in e1000e driver, from Benjamin
          Poitier.
      
       6) Use strlcpy() in several ethtool get_strings methods, from Florian
          Fainelli.
      
       7) Fix rhlist dup insertion, from Paul Blakey.
      
       8) Fix SKB leak in netem packet scheduler, from Alexey Kodanev.
      
       9) Fix driver unload crash when link is up in smsc911x, from Jeremy
          Linton.
      
      10) Purge out invalid socket types in l2tp_tunnel_create(), from Eric
          Dumazet.
      
      11) Need to purge the write queue when TCP connections are aborted,
          otherwise userspace using MSG_ZEROCOPY can't close the fd. From
          Soheil Hassas Yeganeh.
      
      12) Fix double free in error path of team driver, from Arkadi
          Sharshevsky.
      
      13) Filter fixes for hv_netvsc driver, from Stephen Hemminger.
      
      14) Fix non-linear packet access in ipv6 ndisc code, from Lorenzo
          Bianconi.
      
      15) Properly filter out unsupported feature flags in macvlan driver,
          from Shannon Nelson.
      
      16) Don't request loading the diag module for a protocol if the protocol
          itself is not even registered. From Xin Long.
      
      17) If datagram connect fails in ipv6, make sure the socket state is
          consistent afterwards. From Paolo Abeni.
      
      18) Use after free in qed driver, from Dan Carpenter.
      
      19) If received ipv4 PMTU is less than the min pmtu, lock the mtu in the
          entry. From Sabrina Dubroca.
      
      20) Fix sleep in atomic in tg3 driver, from Jonathan Toppins.
      
      21) Fix vlan in vlan untagging in some situations, from Toshiaki Makita.
      
      22) Fix double SKB free in genlmsg_mcast(). From Nicolas Dichtel.
      
      23) Fix NULL derefs in error paths of tcf_*_init(), from Davide Caratti.
      
      24) Unbalanced PM runtime calls in FEC driver, from Florian Fainelli.
      
      25) Memory leak in gemini driver, from Igor Pylypiv.
      
      26) IDR leaks in error paths of tcf_*_init() functions, from Davide
          Caratti.
      
      27) Need to use GFP_ATOMIC in seg6_build_state(), from David Lebrun.
      
      28) Missing dev_put() in error path of macsec_newlink(), from Dan
          Carpenter.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (201 commits)
        macsec: missing dev_put() on error in macsec_newlink()
        net: dsa: Fix functional dsa-loop dependency on FIXED_PHY
        hv_netvsc: common detach logic
        hv_netvsc: change GPAD teardown order on older versions
        hv_netvsc: use RCU to fix concurrent rx and queue changes
        hv_netvsc: disable NAPI before channel close
        net/ipv6: Handle onlink flag with multipath routes
        ppp: avoid loop in xmit recursion detection code
        ipv6: sr: fix NULL pointer dereference when setting encap source address
        ipv6: sr: fix scheduling in RCU when creating seg6 lwtunnel state
        net: aquantia: driver version bump
        net: aquantia: Implement pci shutdown callback
        net: aquantia: Allow live mac address changes
        net: aquantia: Add tx clean budget and valid budget handling logic
        net: aquantia: Change inefficient wait loop on fw data reads
        net: aquantia: Fix a regression with reset on old firmware
        net: aquantia: Fix hardware reset when SPI may rarely hangup
        s390/qeth: on channel error, reject further cmd requests
        s390/qeth: lock read device while queueing next buffer
        s390/qeth: when thread completes, wake up all waiters
        ...
      c4f4d2f9
    • Linus Torvalds's avatar
      Merge tag 'mmc-v4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 9ce20788
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
       "A couple of MMC fixes intended for v4.16-rc7:
      
        MMC host:
      
         - dw_mmc: Fix the suspend/resume issue for Exynos5433
      
         - dw_mmc: Fix the DTO/CTO timeout overflow calculation for 32-bit
           systems
      
         - dw_mmc: Make PIO mode work when failing with idmac when
           dw_mci_reset occurs
      
         - sdhci-acpi: Re-allow IRQ 0 to fix broken probe
      
        MMC core:
      
         - Update EXT_CSD caches to correctly switch partition for ioctl calls
      
         - Fix tracepoint print of blk_addr and blksz
      
         - Disable HPI on broken Micron (Numonyx) eMMC cards"
      
      * tag 'mmc-v4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: sdhci-acpi: Fix IRQ 0
        mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
        mmc: core: Fix tracepoint print of blk_addr and blksz
        mmc: core: Disable HPI for certain Micron (Numonyx) eMMC cards
        mmc: dw_mmc: exynos: fix the suspend/resume issue for exynos5433
        mmc: block: fix updating ext_csd caches on ioctl call
        mmc: dw_mmc: Fix the DTO/CTO timeout overflow calculation for 32-bit systems
      9ce20788
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2018-03-22' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · b7b3f669
      Dave Airlie authored
      Main change is a patch to reject getfb call for multiplanar framebuffers,
      then we have a couple of error path fixes on the sun4i driver. Still on that
      driver there is a clk fix and finally a mmap offset fix on the udl driver.
      
      * tag 'drm-misc-fixes-2018-03-22' of git://anongit.freedesktop.org/drm/drm-misc:
        drm: udl: Properly check framebuffer mmap offsets
        drm: Reject getfb for multi-plane framebuffers
        drm/sun4i: hdmi: Fix another error handling path in 'sun4i_hdmi_bind()'
        drm/sun4i: hdmi: Fix an error handling path in 'sun4i_hdmi_bind()'
        drm/sun4i: Fix an error handling path in 'sun4i_drv_bind()'
        drm/sun4i: Fix exclusivity of the TCON clocks
      b7b3f669
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2018-03-21' of... · 8c2d689e
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2018-03-21' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      One fix for DP MST and one fix for GPU reset on hang check.
      
      * tag 'drm-intel-fixes-2018-03-21' of git://anongit.freedesktop.org/drm/drm-intel:
        drm/i915: Specify which engines to reset following semaphore/event lockups
        drm/i915/dp: Write to SET_POWER dpcd to enable MST hub.
      8c2d689e
    • Dave Airlie's avatar
      Merge branch 'vmwgfx-fixes-4.16' of git://people.freedesktop.org/~thomash/linux into drm-fixes · 096c49ec
      Dave Airlie authored
      Two vmwgfx fixes for 4.16. Both cc'd stable.
      
      * 'vmwgfx-fixes-4.16' of git://people.freedesktop.org/~thomash/linux:
        drm/vmwgfx: Fix a destoy-while-held mutex problem.
        drm/vmwgfx: Fix black screen and device errors when running without fbdev
      096c49ec
    • Dave Airlie's avatar
      Merge tag 'imx-drm-fixes-2018-03-22' of git://git.pengutronix.de/git/pza/linux into drm-fixes · cec1b948
      Dave Airlie authored
      drm/imx: fixes for early vblank event issue, array underflow error
      
      - fix an array underflow error by reordering the range check before the array
        subscript in ipu-prg.
      - make some local functions static in ipuv3-plane.
      - add a missng header for ipu_planes_assign_pre in ipuv3-plane.
      - move arming of the vblank event from atomic_begin to atomic_flush, to avoid
        signalling atomic commit completion to userspace before plane atomic_update
        has finished, due to a race condition that is likely to be hit on i.MX6QP on
        PRE enabled channels.
      
      * tag 'imx-drm-fixes-2018-03-22' of git://git.pengutronix.de/git/pza/linux:
        drm/imx: move arming of the vblank event to atomic_flush
        drm/imx: ipuv3-plane: Include "imx-drm.h" header file
        drm/imx: ipuv3-plane: Make functions static when possible
        gpu: ipu-v3: prg: avoid possible array underflow
      cec1b948
    • Dan Carpenter's avatar
      macsec: missing dev_put() on error in macsec_newlink() · 5dcd8400
      Dan Carpenter authored
      We moved the dev_hold(real_dev); call earlier in the function but forgot
      to update the error paths.
      
      Fixes: 0759e552 ("macsec: fix negative refcnt on parent link")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5dcd8400
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2018-03-21' of... · e0645d9b
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2018-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      Two more fixes (in three patches):
       * ath9k_htc doesn't like QoS NDP frames, use regular ones
       * hwsim: set up wmediumd for radios created later
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e0645d9b
    • Florian Fainelli's avatar
      net: dsa: Fix functional dsa-loop dependency on FIXED_PHY · 40013ff2
      Florian Fainelli authored
      We have a functional dependency on the FIXED_PHY MDIO bus because we register
      fixed PHY devices "the old way" which only works if the code that does this has
      had a chance to run before the fixed MDIO bus is probed. Make sure we account
      for that and have dsa_loop_bdinfo.o be either built-in or modular depending on
      whether CONFIG_FIXED_PHY reflects that too.
      
      Fixes: 98cd1552 ("net: dsa: Mock-up driver")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      40013ff2
    • David S. Miller's avatar
      Merge branch 'hv_netvsc-fix-races-during-shutdown-and-changes' · 53e82697
      David S. Miller authored
      Stephen Hemminger says:
      
      ====================
      hv_netvsc: fix races during shutdown and changes
      
      This set of patches fixes issues identified by Vitaly Kuznetsov and
      Mohammed Gamal related to state changes in Hyper-v network driver.
      
      A lot of the issues are because setting up the netvsc device requires
      a second step (in work queue) to get all the sub-channels running.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      53e82697
    • Stephen Hemminger's avatar
      hv_netvsc: common detach logic · 7b2ee50c
      Stephen Hemminger authored
      Make common function for detaching internals of device
      during changes to MTU and RSS. Make sure no more packets
      are transmitted and all packets have been received before
      doing device teardown.
      
      Change the wait logic to be common and use usleep_range().
      
      Changes transmit enabling logic so that transmit queues are disabled
      during the period when lower device is being changed. And enabled
      only after sub channels are setup. This avoids issue where it could
      be that a packet was being sent while subchannel was not initialized.
      
      Fixes: 8195b139 ("hv_netvsc: fix deadlock on hotplug")
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7b2ee50c
    • Stephen Hemminger's avatar
      hv_netvsc: change GPAD teardown order on older versions · 0ef58b0a
      Stephen Hemminger authored
      On older versions of Windows, the host ignores messages after
      vmbus channel is closed.
      
      Workaround this by doing what Windows does and send the teardown
      before close on older versions of NVSP protocol.
      Reported-by: default avatarMohammed Gamal <mgamal@redhat.com>
      Fixes: 0cf73780 ("hv_netvsc: netvsc_teardown_gpadl() split")
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0ef58b0a
    • Stephen Hemminger's avatar
      hv_netvsc: use RCU to fix concurrent rx and queue changes · 02400fce
      Stephen Hemminger authored
      The receive processing may continue to happen while the
      internal network device state is in RCU grace period.
      The internal RNDIS structure is associated with the
      internal netvsc_device structure; both have the same
      RCU lifetime.
      
      Defer freeing all associated parts until after grace
      period.
      
      Fixes: 0cf73780 ("hv_netvsc: netvsc_teardown_gpadl() split")
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      02400fce
    • Stephen Hemminger's avatar
      hv_netvsc: disable NAPI before channel close · 8348e046
      Stephen Hemminger authored
      This makes sure that no CPU is still process packets when
      the channel is closed.
      
      Fixes: 76bb5db5 ("netvsc: fix use after free on module removal")
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8348e046
    • David Ahern's avatar
      net/ipv6: Handle onlink flag with multipath routes · 68e2ffde
      David Ahern authored
      For multipath routes the ONLINK flag can be specified per nexthop in
      rtnh_flags or globally in rtm_flags. Update ip6_route_multipath_add
      to consider the ONLINK setting coming from rtnh_flags. Each loop over
      nexthops the config for the sibling route is initialized to the global
      config and then per nexthop settings overlayed. The flag is 'or'ed into
      fib6_config to handle the ONLINK flag coming from either rtm_flags or
      rtnh_flags.
      
      Fixes: fc1e64e1 ("net/ipv6: Add support for onlink flag")
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      68e2ffde
    • Guillaume Nault's avatar
      ppp: avoid loop in xmit recursion detection code · 6d066734
      Guillaume Nault authored
      We already detect situations where a PPP channel sends packets back to
      its upper PPP device. While this is enough to avoid deadlocking on xmit
      locks, this doesn't prevent packets from looping between the channel
      and the unit.
      
      The problem is that ppp_start_xmit() enqueues packets in ppp->file.xq
      before checking for xmit recursion. Therefore, __ppp_xmit_process()
      might dequeue a packet from ppp->file.xq and send it on the channel
      which, in turn, loops it back on the unit. Then ppp_start_xmit()
      queues the packet back to ppp->file.xq and __ppp_xmit_process() picks
      it up and sends it again through the channel. Therefore, the packet
      will loop between __ppp_xmit_process() and ppp_start_xmit() until some
      other part of the xmit path drops it.
      
      For L2TP, we rapidly fill the skb's headroom and pppol2tp_xmit() drops
      the packet after a few iterations. But PPTP reallocates the headroom
      if necessary, letting the loop run and exhaust the machine resources
      (as reported in https://bugzilla.kernel.org/show_bug.cgi?id=199109).
      
      Fix this by letting __ppp_xmit_process() enqueue the skb to
      ppp->file.xq, so that we can check for recursion before adding it to
      the queue. Now ppp_xmit_process() can drop the packet when recursion is
      detected.
      
      __ppp_channel_push() is a bit special. It calls __ppp_xmit_process()
      without having any actual packet to send. This is used by
      ppp_output_wakeup() to re-enable transmission on the parent unit (for
      implementations like ppp_async.c, where the .start_xmit() function
      might not consume the skb, leaving it in ppp->xmit_pending and
      disabling transmission).
      Therefore, __ppp_xmit_process() needs to handle the case where skb is
      NULL, dequeuing as many packets as possible from ppp->file.xq.
      Reported-by: default avatarxu heng <xuheng333@zoho.com>
      Fixes: 55454a56 ("ppp: avoid dealock on recursive xmit")
      Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6d066734
    • David Lebrun's avatar
      ipv6: sr: fix NULL pointer dereference when setting encap source address · 8936ef76
      David Lebrun authored
      When using seg6 in encap mode, we call ipv6_dev_get_saddr() to set the
      source address of the outer IPv6 header, in case none was specified.
      Using skb->dev can lead to BUG() when it is in an inconsistent state.
      This patch uses the net_device attached to the skb's dst instead.
      
      [940807.667429] BUG: unable to handle kernel NULL pointer dereference at 000000000000047c
      [940807.762427] IP: ipv6_dev_get_saddr+0x8b/0x1d0
      [940807.815725] PGD 0 P4D 0
      [940807.847173] Oops: 0000 [#1] SMP PTI
      [940807.890073] Modules linked in:
      [940807.927765] CPU: 6 PID: 0 Comm: swapper/6 Tainted: G        W        4.16.0-rc1-seg6bpf+ #2
      [940808.028988] Hardware name: HP ProLiant DL120 G6/ProLiant DL120 G6, BIOS O26    09/06/2010
      [940808.128128] RIP: 0010:ipv6_dev_get_saddr+0x8b/0x1d0
      [940808.187667] RSP: 0018:ffff88043fd836b0 EFLAGS: 00010206
      [940808.251366] RAX: 0000000000000005 RBX: ffff88042cb1c860 RCX: 00000000000000fe
      [940808.338025] RDX: 00000000000002c0 RSI: ffff88042cb1c860 RDI: 0000000000004500
      [940808.424683] RBP: ffff88043fd83740 R08: 0000000000000000 R09: ffffffffffffffff
      [940808.511342] R10: 0000000000000040 R11: 0000000000000000 R12: ffff88042cb1c850
      [940808.598012] R13: ffffffff8208e380 R14: ffff88042ac8da00 R15: 0000000000000002
      [940808.684675] FS:  0000000000000000(0000) GS:ffff88043fd80000(0000) knlGS:0000000000000000
      [940808.783036] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [940808.852975] CR2: 000000000000047c CR3: 00000004255fe000 CR4: 00000000000006e0
      [940808.939634] Call Trace:
      [940808.970041]  <IRQ>
      [940808.995250]  ? ip6t_do_table+0x265/0x640
      [940809.043341]  seg6_do_srh_encap+0x28f/0x300
      [940809.093516]  ? seg6_do_srh+0x1a0/0x210
      [940809.139528]  seg6_do_srh+0x1a0/0x210
      [940809.183462]  seg6_output+0x28/0x1e0
      [940809.226358]  lwtunnel_output+0x3f/0x70
      [940809.272370]  ip6_xmit+0x2b8/0x530
      [940809.313185]  ? ac6_proc_exit+0x20/0x20
      [940809.359197]  inet6_csk_xmit+0x7d/0xc0
      [940809.404173]  tcp_transmit_skb+0x548/0x9a0
      [940809.453304]  __tcp_retransmit_skb+0x1a8/0x7a0
      [940809.506603]  ? ip6_default_advmss+0x40/0x40
      [940809.557824]  ? tcp_current_mss+0x24/0x90
      [940809.605925]  tcp_retransmit_skb+0xd/0x80
      [940809.654016]  tcp_xmit_retransmit_queue.part.17+0xf9/0x210
      [940809.719797]  tcp_ack+0xa47/0x1110
      [940809.760612]  tcp_rcv_established+0x13c/0x570
      [940809.812865]  tcp_v6_do_rcv+0x151/0x3d0
      [940809.858879]  tcp_v6_rcv+0xa5c/0xb10
      [940809.901770]  ? seg6_output+0xdd/0x1e0
      [940809.946745]  ip6_input_finish+0xbb/0x460
      [940809.994837]  ip6_input+0x74/0x80
      [940810.034612]  ? ip6_rcv_finish+0xb0/0xb0
      [940810.081663]  ipv6_rcv+0x31c/0x4c0
      ...
      
      Fixes: 6c8702c6 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
      Reported-by: default avatarTom Herbert <tom@quantonium.net>
      Signed-off-by: default avatarDavid Lebrun <dlebrun@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8936ef76
    • David Lebrun's avatar
      ipv6: sr: fix scheduling in RCU when creating seg6 lwtunnel state · 191f86ca
      David Lebrun authored
      The seg6_build_state() function is called with RCU read lock held,
      so we cannot use GFP_KERNEL. This patch uses GFP_ATOMIC instead.
      
      [   92.770271] =============================
      [   92.770628] WARNING: suspicious RCU usage
      [   92.770921] 4.16.0-rc4+ #12 Not tainted
      [   92.771277] -----------------------------
      [   92.771585] ./include/linux/rcupdate.h:302 Illegal context switch in RCU read-side critical section!
      [   92.772279]
      [   92.772279] other info that might help us debug this:
      [   92.772279]
      [   92.773067]
      [   92.773067] rcu_scheduler_active = 2, debug_locks = 1
      [   92.773514] 2 locks held by ip/2413:
      [   92.773765]  #0:  (rtnl_mutex){+.+.}, at: [<00000000e5461720>] rtnetlink_rcv_msg+0x441/0x4d0
      [   92.774377]  #1:  (rcu_read_lock){....}, at: [<00000000df4f161e>] lwtunnel_build_state+0x59/0x210
      [   92.775065]
      [   92.775065] stack backtrace:
      [   92.775371] CPU: 0 PID: 2413 Comm: ip Not tainted 4.16.0-rc4+ #12
      [   92.775791] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc27 04/01/2014
      [   92.776608] Call Trace:
      [   92.776852]  dump_stack+0x7d/0xbc
      [   92.777130]  __schedule+0x133/0xf00
      [   92.777393]  ? unwind_get_return_address_ptr+0x50/0x50
      [   92.777783]  ? __sched_text_start+0x8/0x8
      [   92.778073]  ? rcu_is_watching+0x19/0x30
      [   92.778383]  ? kernel_text_address+0x49/0x60
      [   92.778800]  ? __kernel_text_address+0x9/0x30
      [   92.779241]  ? unwind_get_return_address+0x29/0x40
      [   92.779727]  ? pcpu_alloc+0x102/0x8f0
      [   92.780101]  _cond_resched+0x23/0x50
      [   92.780459]  __mutex_lock+0xbd/0xad0
      [   92.780818]  ? pcpu_alloc+0x102/0x8f0
      [   92.781194]  ? seg6_build_state+0x11d/0x240
      [   92.781611]  ? save_stack+0x9b/0xb0
      [   92.781965]  ? __ww_mutex_wakeup_for_backoff+0xf0/0xf0
      [   92.782480]  ? seg6_build_state+0x11d/0x240
      [   92.782925]  ? lwtunnel_build_state+0x1bd/0x210
      [   92.783393]  ? ip6_route_info_create+0x687/0x1640
      [   92.783846]  ? ip6_route_add+0x74/0x110
      [   92.784236]  ? inet6_rtm_newroute+0x8a/0xd0
      
      Fixes: 6c8702c6 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
      Signed-off-by: default avatarDavid Lebrun <dlebrun@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      191f86ca
    • David S. Miller's avatar
      Merge branch 'aquantia-fixes' · 9b894cdd
      David S. Miller authored
      Igor Russkikh says:
      
      ====================
      Aquantia atlantic hot fixes 03-2018
      
      This is a set of atlantic driver hot fixes for various areas:
      
      Some issues with hardware reset covered,
      Fixed napi_poll flood happening on some traffic conditions,
      Allow system to change MAC address on live device,
      Add pci shutdown handler.
      
      patch v2:
      - reverse christmas tree
      - remove driver private parameter, replacing it with define.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9b894cdd
    • Igor Russkikh's avatar
      c89bf1cd
    • Igor Russkikh's avatar
      net: aquantia: Implement pci shutdown callback · 90869ddf
      Igor Russkikh authored
      We should close link and all NIC operations during shutdown.
      On some systems graceful reboot never closes NIC interface on its own,
      but only indicates pci device shutdown. Without explicit handler, NIC
      rx rings continued to transfer DMA data into prepared buffers while CPU
      rebooted already. That caused memory corruptions on soft reboot.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      90869ddf
    • Igor Russkikh's avatar
      net: aquantia: Allow live mac address changes · 3e9a5451
      Igor Russkikh authored
      There is nothing prevents us from changing MAC on the running interface.
      Allow this with ndev priv flag.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3e9a5451
    • Igor Russkikh's avatar
      net: aquantia: Add tx clean budget and valid budget handling logic · b647d398
      Igor Russkikh authored
      We should report to napi full budget only when we have more job to do.
      Before this fix, on any tx queue cleanup we forced napi to do poll again.
      Thats a waste of cpu resources and caused storming with napi polls when
      there was at least one tx on each interrupt.
      
      With this fix we report full budget only when there is more job on TX
      to do. Or, as before, when rx budget was fully consumed.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b647d398
    • Igor Russkikh's avatar
      net: aquantia: Change inefficient wait loop on fw data reads · 47203b34
      Igor Russkikh authored
      B1 hardware changes behavior of mailbox interface, it has busy bit
      always raised. Data ready condition should be detected by increment
      of address register.
      
      Old code has empty `for` loop, and that caused cpu overloads on B1
      hardware. aq_nic_service_timer_cb consumed ~100ms because of that.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      47203b34
    • Igor Russkikh's avatar
      net: aquantia: Fix a regression with reset on old firmware · d0f0fb25
      Igor Russkikh authored
      FW 1.5.58 and below needs a fixed delay even after 0x18 register
      is filled. Otherwise, setting MPI_INIT state too fast causes
      traffic hang.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d0f0fb25
    • Igor Russkikh's avatar
      net: aquantia: Fix hardware reset when SPI may rarely hangup · 1bf9a752
      Igor Russkikh authored
      Under some circumstances (notably using thunderbolt interface) SPI
      on chip reset may be in active transaction.
      Here we forcibly cleanup SPI to prevent possible hangups.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1bf9a752
    • David S. Miller's avatar
      Merge branch 's390-qeth-fixes' · 1959031e
      David S. Miller authored
      Julian Wiedmann says:
      
      ====================
      s390/qeth: fixes 2018-03-20
      
      Please apply one final set of qeth patches for 4.16.
      All of these fix long-standing bugs, so please queue them up for -stable
      as well.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1959031e
    • Julian Wiedmann's avatar
      s390/qeth: on channel error, reject further cmd requests · a6c3d939
      Julian Wiedmann authored
      When the IRQ handler determines that one of the cmd IO channels has
      failed and schedules recovery, block any further cmd requests from
      being submitted. The request would inevitably stall, and prevent the
      recovery from making progress until the request times out.
      
      This sort of error was observed after Live Guest Relocation, where
      the pending IO on the READ channel intentionally gets terminated to
      kick-start recovery. Simultaneously the guest executed SIOCETHTOOL,
      triggering qeth to issue a QUERY CARD INFO command. The command
      then stalled in the inoperabel WRITE channel.
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a6c3d939
    • Julian Wiedmann's avatar
      s390/qeth: lock read device while queueing next buffer · 17bf8c9b
      Julian Wiedmann authored
      For calling ccw_device_start(), issue_next_read() needs to hold the
      device's ccwlock.
      This is satisfied for the IRQ handler path (where qeth_irq() gets called
      under the ccwlock), but we need explicit locking for the initial call by
      the MPC initialization.
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      17bf8c9b
    • Julian Wiedmann's avatar
      s390/qeth: when thread completes, wake up all waiters · 1063e432
      Julian Wiedmann authored
      qeth_wait_for_threads() is potentially called by multiple users, make
      sure to notify all of them after qeth_clear_thread_running_bit()
      adjusted the thread_running_mask. With no timeout, callers would
      otherwise stall.
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1063e432
    • Julian Wiedmann's avatar
      s390/qeth: free netdevice when removing a card · 6be68739
      Julian Wiedmann authored
      On removal, a qeth card's netdevice is currently not properly freed
      because the call chain looks as follows:
      
      qeth_core_remove_device(card)
      	lx_remove_device(card)
      		unregister_netdev(card->dev)
      		card->dev = NULL			!!!
      	qeth_core_free_card(card)
      		if (card->dev)				!!!
      			free_netdev(card->dev)
      
      Fix it by free'ing the netdev straight after unregistering. This also
      fixes the sysfs-driven layer switch case (qeth_dev_layer2_store()),
      where the need to free the current netdevice was not considered at all.
      
      Note that free_netdev() takes care of the netif_napi_del() for us too.
      
      Fixes: 4a71df50 ("qeth: new qeth device driver")
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.vnet.ibm.com>
      Reviewed-by: default avatarUrsula Braun <ubraun@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6be68739
    • David S. Miller's avatar
      Merge branch 'net-phy-Add-general-dummy-stubs-for-MMD-register-access' · 3d21ac6f
      David S. Miller authored
      Kevin Hao says:
      
      ====================
      net: phy: Add general dummy stubs for MMD register access
      
      v2:
      As suggested by Andrew:
        - Add general dummy stubs
        - Also use that for the micrel phy
      
      This patch series fix the Ethernet broken on the mpc8315erdb board introduced
      by commit b6b5e8a6 ("gianfar: Disable EEE autoneg by default").
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3d21ac6f
    • Kevin Hao's avatar
      net: phy: micrel: Use the general dummy stubs for MMD register access · c846a2b7
      Kevin Hao authored
      The new general dummy stubs for MMD register access were introduced.
      Use that for the codes reuse.
      Signed-off-by: default avatarKevin Hao <haokexin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c846a2b7
    • Kevin Hao's avatar
      net: phy: realtek: Use the dummy stubs for MMD register access for rtl8211b · 0231b1a0
      Kevin Hao authored
      The Ethernet on mpc8315erdb is broken since commit b6b5e8a6
      ("gianfar: Disable EEE autoneg by default"). The reason is that
      even though the rtl8211b doesn't support the MMD extended registers
      access, it does return some random values if we trying to access
      the MMD register via indirect method. This makes it seem that the
      EEE is supported by this phy device. And the subsequent writing to
      the MMD registers does cause the phy malfunction. So use the dummy
      stubs for the MMD register access to fix this issue.
      
      Fixes: b6b5e8a6 ("gianfar: Disable EEE autoneg by default")
      Signed-off-by: default avatarKevin Hao <haokexin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0231b1a0
    • Kevin Hao's avatar
      net: phy: Add general dummy stubs for MMD register access · 5df7af85
      Kevin Hao authored
      For some phy devices, even though they don't support the MMD extended
      register access, it does have some side effect if we are trying to
      read/write the MMD registers via indirect method. So introduce general
      dummy stubs for MMD register access which these devices can use to avoid
      such side effect.
      
      Fixes: b6b5e8a6 ("gianfar: Disable EEE autoneg by default")
      Signed-off-by: default avatarKevin Hao <haokexin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5df7af85