1. 26 Nov, 2014 7 commits
  2. 25 Nov, 2014 7 commits
  3. 24 Nov, 2014 5 commits
    • Jane Zhou's avatar
      net/ping: handle protocol mismatching scenario · 91a0b603
      Jane Zhou authored
      ping_lookup() may return a wrong sock if sk_buff's and sock's protocols
      dont' match. For example, sk_buff's protocol is ETH_P_IPV6, but sock's
      sk_family is AF_INET, in that case, if sk->sk_bound_dev_if is zero, a wrong
      sock will be returned.
      the fix is to "continue" the searching, if no matching, return NULL.
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
      Cc: James Morris <jmorris@namei.org>
      Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
      Cc: Patrick McHardy <kaber@trash.net>
      Cc: netdev@vger.kernel.org
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJane Zhou <a17711@motorola.com>
      Signed-off-by: default avatarYiwei Zhao <gbjc64@motorola.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      91a0b603
    • Michael S. Tsirkin's avatar
      af_packet: fix sparse warning · 6e58040b
      Michael S. Tsirkin authored
      af_packet produces lots of these:
      	net/packet/af_packet.c:384:39: warning: incorrect type in return expression (different modifiers)
      	net/packet/af_packet.c:384:39:    expected struct page [pure] *
      	net/packet/af_packet.c:384:39:    got struct page *
      
      this seems to be because sparse does not realize that _pure
      refers to function, not the returned pointer.
      
      Tweak code slightly to avoid the warning.
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6e58040b
    • Alexey Khoroshilov's avatar
      xen-netback: do not report success if backend_create_xenvif() fails · 2dd34339
      Alexey Khoroshilov authored
      If xenvif_alloc() or xenbus_scanf() fail in backend_create_xenvif(),
      xenbus is left in offline mode but netback_probe() reports success.
      
      The patch implements propagation of error code for backend_create_xenvif().
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
      Acked-by: default avatarWei Liu <wei.liu2@citrix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2dd34339
    • Yuri Chislov's avatar
      ipv6: gre: fix wrong skb->protocol in WCCP · be6572fd
      Yuri Chislov authored
      When using GRE redirection in WCCP, it sets the wrong skb->protocol,
      that is, ETH_P_IP instead of ETH_P_IPV6 for the encapuslated traffic.
      
      Fixes: c12b395a ("gre: Support GRE over IPv6")
      Cc: Dmitry Kozlov <xeb@mail.ru>
      Signed-off-by: default avatarYuri Chislov <yuri.chislov@gmail.com>
      Tested-by: default avatarYuri Chislov <yuri.chislov@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      be6572fd
    • lucien's avatar
      ip_tunnel: the lack of vti_link_ops' dellink() cause kernel panic · 20ea60ca
      lucien authored
      Now the vti_link_ops do not point the .dellink, for fb tunnel device
      (ip_vti0), the net_device will be removed as the default .dellink is
      unregister_netdevice_queue,but the tunnel still in the tunnel list,
      then if we add a new vti tunnel, in ip_tunnel_find():
      
              hlist_for_each_entry_rcu(t, head, hash_node) {
                      if (local == t->parms.iph.saddr &&
                          remote == t->parms.iph.daddr &&
                          link == t->parms.link &&
      ==>                 type == t->dev->type &&
                          ip_tunnel_key_match(&t->parms, flags, key))
                              break;
              }
      
      the panic will happen, cause dev of ip_tunnel *t is null:
      [ 3835.072977] IP: [<ffffffffa04103fd>] ip_tunnel_find+0x9d/0xc0 [ip_tunnel]
      [ 3835.073008] PGD b2c21067 PUD b7277067 PMD 0
      [ 3835.073008] Oops: 0000 [#1] SMP
      .....
      [ 3835.073008] Stack:
      [ 3835.073008]  ffff8800b72d77f0 ffffffffa0411924 ffff8800bb956000 ffff8800b72d78e0
      [ 3835.073008]  ffff8800b72d78a0 0000000000000000 ffffffffa040d100 ffff8800b72d7858
      [ 3835.073008]  ffffffffa040b2e3 0000000000000000 0000000000000000 0000000000000000
      [ 3835.073008] Call Trace:
      [ 3835.073008]  [<ffffffffa0411924>] ip_tunnel_newlink+0x64/0x160 [ip_tunnel]
      [ 3835.073008]  [<ffffffffa040b2e3>] vti_newlink+0x43/0x70 [ip_vti]
      [ 3835.073008]  [<ffffffff8150d4da>] rtnl_newlink+0x4fa/0x5f0
      [ 3835.073008]  [<ffffffff812f68bb>] ? nla_strlcpy+0x5b/0x70
      [ 3835.073008]  [<ffffffff81508fb0>] ? rtnl_link_ops_get+0x40/0x60
      [ 3835.073008]  [<ffffffff8150d11f>] ? rtnl_newlink+0x13f/0x5f0
      [ 3835.073008]  [<ffffffff81509cf4>] rtnetlink_rcv_msg+0xa4/0x270
      [ 3835.073008]  [<ffffffff8126adf5>] ? sock_has_perm+0x75/0x90
      [ 3835.073008]  [<ffffffff81509c50>] ? rtnetlink_rcv+0x30/0x30
      [ 3835.073008]  [<ffffffff81529e39>] netlink_rcv_skb+0xa9/0xc0
      [ 3835.073008]  [<ffffffff81509c48>] rtnetlink_rcv+0x28/0x30
      ....
      
      modprobe ip_vti
      ip link del ip_vti0 type vti
      ip link add ip_vti0 type vti
      rmmod ip_vti
      
      do that one or more times, kernel will panic.
      
      fix it by assigning ip_tunnel_dellink to vti_link_ops' dellink, in
      which we skip the unregister of fb tunnel device. do the same on ip6_vti.
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Signed-off-by: default avatarCong Wang <cwang@twopensource.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      20ea60ca
  4. 23 Nov, 2014 5 commits
    • Julia Lawall's avatar
      solos-pci: fix error return code · 73112f9b
      Julia Lawall authored
      Return a negative error code on failure.
      
      A simplified version of the semantic match that finds this problem is as
      follows: (http://coccinelle.lip6.fr/)
      
      // <smpl>
      @@
      identifier ret; expression e1,e2;
      @@
      (
      if (\(ret < 0\|ret != 0\))
       { ... return ret; }
      |
      ret = 0
      )
      ... when != ret = e1
          when != &ret
      *if(...)
      {
        ... when != ret = e2
            when forall
       return ret;
      }
      // </smpl>
      Signed-off-by: default avatarJulia Lawall <Julia.Lawall@lip6.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      73112f9b
    • Carolyn Wyborny's avatar
      igb: Fixes needed for surprise removal support · 17a402a0
      Carolyn Wyborny authored
      This patch adds some checks in order to prevent panic's on surprise
      removal of devices during S0, S3, S4.  Without this patch, Thunderbolt
      type device removal will panic the system.
      Signed-off-by: default avatarYanir Lubetkin <yanirx.lubetkin@intel.com>
      Signed-off-by: default avatarCarolyn Wyborny <carolyn.wyborny@intel.com>
      Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      17a402a0
    • Daniel Borkmann's avatar
      ixgbe: fix use after free adapter->state test in ixgbe_remove/ixgbe_probe · b5b2ffc0
      Daniel Borkmann authored
      While working on a different issue, I noticed an annoying use
      after free bug on my machine when unloading the ixgbe driver:
      
      [ 8642.318797] ixgbe 0000:02:00.1: removed PHC on p2p2
      [ 8642.742716] ixgbe 0000:02:00.1: complete
      [ 8642.743784] BUG: unable to handle kernel paging request at ffff8807d3740a90
      [ 8642.744828] IP: [<ffffffffa01c77dc>] ixgbe_remove+0xfc/0x1b0 [ixgbe]
      [ 8642.745886] PGD 20c6067 PUD 81c1f6067 PMD 81c15a067 PTE 80000007d3740060
      [ 8642.746956] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
      [ 8642.748039] Modules linked in: [...]
      [ 8642.752929] CPU: 1 PID: 1225 Comm: rmmod Not tainted 3.18.0-rc2+ #49
      [ 8642.754203] Hardware name: Supermicro X10SLM-F/X10SLM-F, BIOS 1.1b 11/01/2013
      [ 8642.755505] task: ffff8807e34d3fe0 ti: ffff8807b7204000 task.ti: ffff8807b7204000
      [ 8642.756831] RIP: 0010:[<ffffffffa01c77dc>]  [<ffffffffa01c77dc>] ixgbe_remove+0xfc/0x1b0 [ixgbe]
      [...]
      [ 8642.774335] Stack:
      [ 8642.775805]  ffff8807ee824098 ffff8807ee824098 ffffffffa01f3000 ffff8807ee824000
      [ 8642.777326]  ffff8807b7207e18 ffffffff8137720f ffff8807ee824098 ffff8807ee824098
      [ 8642.778848]  ffffffffa01f3068 ffff8807ee8240f8 ffff8807b7207e38 ffffffff8144180f
      [ 8642.780365] Call Trace:
      [ 8642.781869]  [<ffffffff8137720f>] pci_device_remove+0x3f/0xc0
      [ 8642.783395]  [<ffffffff8144180f>] __device_release_driver+0x7f/0xf0
      [ 8642.784876]  [<ffffffff814421f8>] driver_detach+0xb8/0xc0
      [ 8642.786352]  [<ffffffff814414a9>] bus_remove_driver+0x59/0xe0
      [ 8642.787783]  [<ffffffff814429d0>] driver_unregister+0x30/0x70
      [ 8642.789202]  [<ffffffff81375c65>] pci_unregister_driver+0x25/0xa0
      [ 8642.790657]  [<ffffffffa01eb38e>] ixgbe_exit_module+0x1c/0xc8e [ixgbe]
      [ 8642.792064]  [<ffffffff810f93a2>] SyS_delete_module+0x132/0x1c0
      [ 8642.793450]  [<ffffffff81012c61>] ? do_notify_resume+0x61/0xa0
      [ 8642.794837]  [<ffffffff816d2029>] system_call_fastpath+0x12/0x17
      
      The issue is that test_and_set_bit() done on adapter->state is being
      performed *after* the netdevice has been freed via free_netdev().
      
      When netdev is being allocated on initialization time, it allocates
      a private area, here struct ixgbe_adapter, that resides after the
      net_device structure. In ixgbe_probe(), the device init routine,
      we set up the adapter after alloc_etherdev_mq() on the private area
      and add a reference for the pci_dev as well via pci_set_drvdata().
      
      Both in the error path of ixgbe_probe(), but also on module unload
      when ixgbe_remove() is being called, commit 41c62843 ("ixgbe:
      Fix rcu warnings induced by LER") accesses adapter after free_netdev().
      The patch stores the result in a bool and thus fixes above oops on my
      side.
      
      Fixes: 41c62843 ("ixgbe: Fix rcu warnings induced by LER")
      Cc: stable <stable@vger.kernel.org>
      Cc: Mark Rustad <mark.d.rustad@intel.com>
      Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b5b2ffc0
    • Vlad Yasevich's avatar
      ixgbe: Correctly disable VLAN filter in promiscuous mode · 4556dc59
      Vlad Yasevich authored
      IXGBE adapter seems to require that VLAN filtering be enabled if
      VMDQ or SRIOV are enabled.  When those functions are disabled,
      VLAN filtering may be disabled in promiscuous mode.
      
      Prior to commit a9b8943e ("ixgbe: remove vlan_filter_disable
      and enable functions")
      
      The logic was correct.  However, after the commit the logic
      got reversed and VLAN filtered in now turned on when VMDQ/SRIOV
      is disabled.
      
      This patch changes the condition to enable hw vlan filtered
      when VMDQ or SRIOV is enabled.
      
      Fixes: a9b8943e ("ixgbe: remove vlan_filter_disable and enable functions")
      Cc: stable <stable@vger.kernel.org>
      CC: Jacob Keller <jacob.e.keller@intel.com>
      Signed-off-by: default avatarVladislav Yasevich <vyasevic@redhat.com>
      Acked-by: default avatarEmil Tantilov <emil.s.tantilov@intel.com>
      Tested-by: default avatarPhil Schmitt <phillip.j.schmitt@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4556dc59
    • Alexander Duyck's avatar
      ipv6: Do not treat a GSO_TCPV4 request from UDP tunnel over IPv6 as invalid · b6fef4c6
      Alexander Duyck authored
      This patch adds SKB_GSO_TCPV4 to the list of supported GSO types handled by
      the IPv6 GSO offloads.  Without this change VXLAN tunnels running over IPv6
      do not currently handle IPv4 TCP TSO requests correctly and end up handing
      the non-segmented frame off to the device.
      
      Below is the before and after for a simple netperf TCP_STREAM test between
      two endpoints tunneling IPv4 over a VXLAN tunnel running on IPv6 on top of
      a 1Gb/s network adapter.
      
      Recv   Send    Send
      Socket Socket  Message  Elapsed
      Size   Size    Size     Time     Throughput
      bytes  bytes   bytes    secs.    10^6bits/sec
      
       87380  16384  16384    10.29       0.88      Before
       87380  16384  16384    10.03     895.69      After
      Signed-off-by: default avatarAlexander Duyck <alexander.h.duyck@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b6fef4c6
  5. 22 Nov, 2014 10 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 8a84e01e
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix BUG when decrypting empty packets in mac80211, from Ronald Wahl.
      
       2) nf_nat_range is not fully initialized and this is copied back to
          userspace, from Daniel Borkmann.
      
       3) Fix read past end of b uffer in netfilter ipset, also from Dan
          Carpenter.
      
       4) Signed integer overflow in ipv4 address mask creation helper
          inet_make_mask(), from Vincent BENAYOUN.
      
       5) VXLAN, be2net, mlx4_en, and qlcnic need ->ndo_gso_check() methods to
          properly describe the device's capabilities, from Joe Stringer.
      
       6) Fix memory leaks and checksum miscalculations in openvswitch, from
          Pravin B SHelar and Jesse Gross.
      
       7) FIB rules passes back ambiguous error code for unreachable routes,
          making behavior confusing for userspace.  Fix from Panu Matilainen.
      
       8) ieee802154fake_probe() doesn't release resources properly on error,
          from Alexey Khoroshilov.
      
       9) Fix skb_over_panic in add_grhead(), from Daniel Borkmann.
      
      10) Fix access of stale slave pointers in bonding code, from Nikolay
          Aleksandrov.
      
      11) Fix stack info leak in PPP pptp code, from Mathias Krause.
      
      12) Cure locking bug in IPX stack, from Jiri Bohac.
      
      13) Revert SKB fclone memory freeing optimization that is racey and can
          allow accesses to freed up memory, from Eric Dumazet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (71 commits)
        tcp: Restore RFC5961-compliant behavior for SYN packets
        net: Revert "net: avoid one atomic operation in skb_clone()"
        virtio-net: validate features during probe
        cxgb4 : Fix DCB priority groups being returned in wrong order
        ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg
        openvswitch: Don't validate IPv6 label masks.
        pptp: fix stack info leak in pptp_getname()
        brcmfmac: don't include linux/unaligned/access_ok.h
        cxgb4i : Don't block unload/cxgb4 unload when remote closes TCP connection
        ipv6: delete protocol and unregister rtnetlink when cleanup
        net/mlx4_en: Add VXLAN ndo calls to the PF net device ops too
        bonding: fix curr_active_slave/carrier with loadbalance arp monitoring
        mac80211: minstrel_ht: fix a crash in rate sorting
        vxlan: Inline vxlan_gso_check().
        can: m_can: update to support CAN FD features
        can: m_can: fix incorrect error messages
        can: m_can: add missing delay after setting CCCR_INIT bit
        can: m_can: fix not set can_dlc for remote frame
        can: m_can: fix possible sleep in napi poll
        can: m_can: add missing message RAM initialization
        ...
      8a84e01e
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 928352e9
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Just two radeon and two intel fixes: endian and regression fixes"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/radeon: fix endian swapping in vbios fetch for tdp table
        drm/radeon: disable native backlight control on pre-r6xx asics (v2)
        drm/i915: Kick fbdev before vgacon
        drm/i915: drop WaSetupGtModeTdRowDispatch:snb
      928352e9
    • Linus Torvalds's avatar
      Merge tag 'sound-3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 9a7e4f56
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This batch ended up as a relatively high volume due to pending ASoC
        fixes.  But most of fixes there are trivial and/or device- specific
        fixes and quirks, so safe to apply.  The only (ASoC) core fixes are
        the DPCM race fix and the machine-driver matching fix for
        componentization"
      
      * tag 'sound-3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - fix the mic mute led problem for Latitude E5550
        ALSA: hda - move DELL_WMI_MIC_MUTE_LED to the tail in the quirk chain
        ASoC: wm_adsp: Avoid attempt to free buffers that might still be in use
        ALSA: usb-audio: Set the Control Selector to SU_SELECTOR_CONTROL for UAC2
        ALSA: usb-audio: Add ctrl message delay quirk for Marantz/Denon devices
        ASoC: sgtl5000: Fix SMALL_POP bit definition
        ASoC: cs42l51: re-hook of_match_table pointer
        ASoC: rt5670: change dapm routes of PLL connection
        ASoC: rt5670: correct the incorrect default values
        ASoC: samsung: Add MODULE_DEVICE_TABLE for Snow
        ASoC: max98090: Correct pclk divisor settings
        ASoC: dpcm: Fix race between FE/BE updates and trigger
        ASoC: Fix snd_soc_find_dai() matching component by name
        ASoC: rsnd: remove unsupported PAUSE flag
        ASoC: fsi: remove unsupported PAUSE flag
        ASoC: rt5645: Mark RT5645_TDM_CTRL_3 as readable
        ASoC: rockchip-i2s: fix infinite loop in rockchip_snd_rxctrl
        ASoC: es8328-i2c: Fix i2c_device_id name field in es8328_id
        ASoC: fsl_asrc: Add reg_defaults for regmap to fix kernel dump
      9a7e4f56
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · f100a746
      Linus Torvalds authored
      Pull ACPI power management fix from Rafael Wysocki:
       "This is just a one-liner fixing a regression introduced in 3.13 that
        broke system suspend on some Chromebooks.
      
        On those machines there are ACPI device objects for some I2C devices
        that can wake up the system from sleep states, but that is done via a
        platform-specific mechanism and the ACPI objects don't contain any
        wakeup-related information.  When we started to use ACPI power
        management with those devices (which happened during the 3.13 cycle),
        their configuration confused the ACPI PM layer that returned error
        codes from suspend callbacks for them causing system suspend to fail.
      
        However, the ACPI PM layer can safely ignore the wakeup setting from a
        device driver if the ACPI object corresponding to the device in
        question doesn't contain wakeup information in which case the driver
        itself is responsible for setting up the device for system wakeup"
      
      * tag 'pm+acpi-3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI / PM: Ignore wakeup setting if the ACPI companion can't wake up
      f100a746
    • Linus Torvalds's avatar
      Merge tag 'devicetree-fixes-for-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux · 2e29a6d0
      Linus Torvalds authored
      Pull devicetree fixes from Rob Herring:
       "DeviceTree fixes for 3.18:
      
         - two fixes for OF selftest code
         - fix for PowerPC address parsing to disable work-around except on
           old PowerMACs
         - fix a crash when earlycon is enabled, but no device is found
         - DT documentation fixes and missing vendor prefixes
      
        All but the doc updates are also for stable"
      
      * tag 'devicetree-fixes-for-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
        of/selftest: Fix testing when /aliases is missing
        of/selftest: Fix off-by-one error in removal path
        documentation: pinctrl bindings: Fix trivial typo 'abitrary'
        devicetree: bindings: Add vendor prefix for Micron Technology, Inc.
        of: Add vendor prefix for Chips&Media, Inc.
        of/base: Fix PowerPC address parsing hack
        devicetree: vendor-prefixes.txt: fix whitespace
        of: Fix crash if an earlycon driver is not found
        of/irq: Drop obsolete 'interrupts' vs 'interrupts-extended' text
        of: Spelling s/stucture/structure/
        devicetree: bindings: add sandisk to the vendor prefixes
      2e29a6d0
    • Linus Torvalds's avatar
      Merge tag 'pci-v3.18-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · 08685897
      Linus Torvalds authored
      Pull PCI fixes from Bjorn Helgaas:
       "These are fixes for an issue with 64-bit PCI bus addresses on 32-bit
        PAE kernels, an APM X-Gene problem (it depended on a generic change we
        removed before merging), a fix for my hotplug device configuration
        changes, and a devicetree documentation update.
      
        Resource management:
          - Support 64-bit bridge windows if we have 64-bit dma_addr_t (Yinghai Lu)
      
        PCI device hotplug:
          - Apply _HPX Link Control settings to all devices with a link (Yinghai Lu)
      
        Generic host bridge driver:
          - Add DT binding for "linux,pci-domain" property (Lucas Stach)
      
        APM X-Gene:
          - Assign resources to bus before adding new devices (Duc Dang)"
      
      * tag 'pci-v3.18-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        PCI: Support 64-bit bridge windows if we have 64-bit dma_addr_t
        PCI: Apply _HPX Link Control settings to all devices with a link
        PCI: Add missing DT binding for "linux,pci-domain" property
        PCI: xgene: Assign resources to bus before adding new devices
      08685897
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · a46171d0
      Linus Torvalds authored
      Pull SCSI target fixes from Nicholas Bellinger:
       "Here are the target-pending fixes queued for v3.18-rc6.
      
        The highlights include:
      
         - target-core OOPs fix with tcm_qla2xxx + vxworks FC initiators +
           zero length SCSI commands having a transfer direction set.  (Roland
           + Craig Watson)
      
         - vhost-scsi OOPs fix to explicitly prevent WWPN endpoint configfs
           group removal while qemu still has an active reference.  (Paolo +
           nab)
      
         - ib_srpt fix for RDMA hardware with lower srp_sq_size limits.
           (Bart)
      
         - two ib_isert work-arounds for running on ocrdma hardware (Or + Sagi
           + Chris)
      
         - iscsi-target discovery portal typo + SPC-3 PR Preempt SA key
           matching fix (Steve)"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
        IB/isert: Adjust CQ size to HW limits
        target: return CONFLICT only when SA key unmatched
        iser-target: Handle DEVICE_REMOVAL event on network portal listener correctly
        ib_isert: Add max_send_sge=2 minimum for control PDU responses
        srp-target: Retry when QP creation fails with ENOMEM
        iscsi-target: return the correct port in SendTargets
        vhost-scsi: Take configfs group dependency during VHOST_SCSI_SET_ENDPOINT
        target: Don't call TFO->write_pending if data_length == 0
      a46171d0
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma · 4ec69c7e
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "We have couple of fixes for dmaengine queued up:
         - dma mempcy fix for dma configuration of sun6i by Maxime
         - pl330 fixes: First the fixing allocation for data buffers by Liviu
           and then Jon's fixe for fifo width and usage"
      
      * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: Fix allocation size for PL330 data buffer depth.
        dmaengine: pl330: Limit MFIFO usage for memcpy to avoid exhausting entries
        dmaengine: pl330: Align DMA memcpy operations to MFIFO width
        dmaengine: sun6i: Fix memcpy operation
      4ec69c7e
    • Linus Torvalds's avatar
      Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus · e6a588d0
      Linus Torvalds authored
      Pull MIPS fixes from Ralf Baechle:
       "More 3.18 fixes for MIPS:
      
         - backtraces were not quite working on on 64-bit kernels
         - loongson needs a different cache coherency setting
         - Loongson 3 is a MIPS64 R2 version but due to erratum we treat is an
           older architecture revision.
         - fix build errors due to undefined references to __node_distances
           for certain configurations.
         - fix instruction decodig in the jump label code.
         - for certain configurations copy_{from,to}_user destroy the content
           of $3 so that register needs to be marked as clobbed by the calling
           code.
         - Hardware Table Walker fixes.
         - fill the delay slot of the last instruction of memcpy otherwise
           whatever ends up there randomly might have undesirable effects.
         - ensure get_user/__get_user always zero the variable to be read even
           in case of an error"
      
      * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
        MIPS: jump_label.c: Handle the microMIPS J instruction encoding
        MIPS: jump_label.c: Correct the span of the J instruction
        MIPS: Zero variable read by get_user / __get_user in case of an error.
        MIPS: lib: memcpy: Restore NOP on delay slot before returning to caller
        MIPS: tlb-r4k: Add missing HTW stop/start sequences
        MIPS: asm: uaccess: Add v1 register to clobber list on EVA
        MIPS: oprofile: Fix backtrace on 64-bit kernel
        MIPS: Loongson: Set Loongson-3's ISA level to MIPS64R1
        MIPS: Loongson: Fix the write-combine CCA value setting
        MIPS: IP27: Fix __node_distances undefined error
        MIPS: Loongson3: Fix __node_distances undefined error
      e6a588d0
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux · 4fc82c0a
      Linus Torvalds authored
      Pull powerpc fix from Michael Ellerman:
       "One fix from Scott, he says:
      
        This patch fixes a crash (introduced in v3.18-rc1) in the FSL MSI driver
        when threaded IRQs are enabled"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux:
        powerpc/fsl_msi: mark the msi cascade handler IRQF_NO_THREAD
      4fc82c0a
  6. 21 Nov, 2014 6 commits
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · c6c9161d
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "Misc fixes:
         - gold linker build fix
         - noxsave command line parsing fix
         - bugfix for NX setup
         - microcode resume path bug fix
         - _TIF_NOHZ versus TIF_NOHZ bugfix as discussed in the mysterious
           lockup thread"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86, syscall: Fix _TIF_NOHZ handling in syscall_trace_enter_phase1
        x86, kaslr: Handle Gold linker for finding bss/brk
        x86, mm: Set NX across entire PMD at boot
        x86, microcode: Update BSPs microcode on resume
        x86: Require exact match for 'noxsave' command line option
      c6c9161d
    • Linus Torvalds's avatar
      Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 8b2ed21e
      Linus Torvalds authored
      Pull scheduler fixes from Ingo Molnar:
       "Misc fixes: two NUMA fixes, two cputime fixes and an RCU/lockdep fix"
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/cputime: Fix clock_nanosleep()/clock_gettime() inconsistency
        sched/cputime: Fix cpu_timer_sample_group() double accounting
        sched/numa: Avoid selecting oneself as swap target
        sched/numa: Fix out of bounds read in sched_init_numa()
        sched: Remove lockdep check in sched_move_task()
      8b2ed21e
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 13f5004c
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "Misc fixes: two Intel uncore driver fixes, a CPU-hotplug fix and a
        build dependencies fix"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86/intel/uncore: Fix boot crash on SBOX PMU on Haswell-EP
        perf/x86/intel/uncore: Fix IRP uncore register offsets on Haswell EP
        perf: Fix corruption of sibling list with hotplug
        perf/x86: Fix embarrasing typo
      13f5004c
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · a64bb02f
      Linus Torvalds authored
      Pull core fix from Ingo Molnar:
       "Fix GENMASK macro shift overflow"
      
      Nobody seems to currently use GENMASK() to fill every single last bit
      (which is what overflows) in-tree, and gcc would warn about it, so we
      have that going for us.  But apparently there are pending changes that
      want this.
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        bitops: Fix shift overflow in GENMASK macros
      a64bb02f
    • Calvin Owens's avatar
      tcp: Restore RFC5961-compliant behavior for SYN packets · 0c228e83
      Calvin Owens authored
      Commit c3ae62af ("tcp: should drop incoming frames without ACK
      flag set") was created to mitigate a security vulnerability in which a
      local attacker is able to inject data into locally-opened sockets by
      using TCP protocol statistics in procfs to quickly find the correct
      sequence number.
      
      This broke the RFC5961 requirement to send a challenge ACK in response
      to spurious RST packets, which was subsequently fixed by commit
      7b514a88 ("tcp: accept RST without ACK flag").
      
      Unfortunately, the RFC5961 requirement that spurious SYN packets be
      handled in a similar manner remains broken.
      
      RFC5961 section 4 states that:
      
         ... the handling of the SYN in the synchronized state SHOULD be
         performed as follows:
      
         1) If the SYN bit is set, irrespective of the sequence number, TCP
            MUST send an ACK (also referred to as challenge ACK) to the remote
            peer:
      
            <SEQ=SND.NXT><ACK=RCV.NXT><CTL=ACK>
      
            After sending the acknowledgment, TCP MUST drop the unacceptable
            segment and stop processing further.
      
         By sending an ACK, the remote peer is challenged to confirm the loss
         of the previous connection and the request to start a new connection.
         A legitimate peer, after restart, would not have a TCB in the
         synchronized state.  Thus, when the ACK arrives, the peer should send
         a RST segment back with the sequence number derived from the ACK
         field that caused the RST.
      
         This RST will confirm that the remote peer has indeed closed the
         previous connection.  Upon receipt of a valid RST, the local TCP
         endpoint MUST terminate its connection.  The local TCP endpoint
         should then rely on SYN retransmission from the remote end to
         re-establish the connection.
      
      This patch lets SYN packets through the discard added in c3ae62af,
      so that spurious SYN packets are properly dealt with as per the RFC.
      
      The challenge ACK is sent unconditionally and is rate-limited, so the
      original vulnerability is not reintroduced by this patch.
      Signed-off-by: default avatarCalvin Owens <calvinowens@fb.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0c228e83
    • Eric Dumazet's avatar
      net: Revert "net: avoid one atomic operation in skb_clone()" · e7820e39
      Eric Dumazet authored
      Not sure what I was thinking, but doing anything after
      releasing a refcount is suicidal or/and embarrassing.
      
      By the time we set skb->fclone to SKB_FCLONE_FREE, another cpu
      could have released last reference and freed whole skb.
      
      We potentially corrupt memory or trap if CONFIG_DEBUG_PAGEALLOC is set.
      Reported-by: default avatarChris Mason <clm@fb.com>
      Fixes: ce1a4ea3 ("net: avoid one atomic operation in skb_clone()")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Sabrina Dubroca <sd@queasysnail.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e7820e39