1. 06 Oct, 2020 23 commits
  2. 05 Oct, 2020 8 commits
    • Linus Torvalds's avatar
      Merge tag 'platform-drivers-x86-v5.9-2' of git://git.infradead.org/linux-platform-drivers-x86 · 7575fdda
      Linus Torvalds authored
      Pull x86 platform driver fixes from Andy Shevchenko:
       "We have some fixes for Tablet Mode reporting in particular, that users
        are complaining a lot about.
      
        Summary:
      
         - Attempt #3 of enabling Tablet Mode reporting w/o regressions
      
         - Improve battery recognition code in ASUS WMI driver
      
         - Fix Kconfig dependency warning for Fujitsu and LG laptop drivers
      
         - Add fixes in Thinkpad ACPI driver for _BCL method and NVRAM polling
      
         - Fix power supply extended topology in Mellanox driver
      
         - Fix memory leak in OLPC EC driver
      
         - Avoid static struct device in Intel PMC core driver
      
         - Add support for the touchscreen found in MPMAN Converter9 2-in-1
      
         - Update MAINTAINERS to reflect the real state of affairs"
      
      * tag 'platform-drivers-x86-v5.9-2' of git://git.infradead.org/linux-platform-drivers-x86:
        platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when reuse
        MAINTAINERS: Add Mark Gross and Hans de Goede as x86 platform drivers maintainers
        platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE reporting
        platform/x86: intel-vbtn: Revert "Fix SW_TABLET_MODE always reporting 1 on the HP Pavilion 11 x360"
        platform/x86: intel_pmc_core: do not create a static struct device
        platform/x86: mlx-platform: Fix extended topology configuration for power supply units
        platform/x86: pcengines-apuv2: Fix typo on define of AMD_FCH_GPIO_REG_GPIO55_DEVSLP0
        platform/x86: fix kconfig dependency warning for FUJITSU_LAPTOP
        platform/x86: fix kconfig dependency warning for LG_LAPTOP
        platform/x86: thinkpad_acpi: initialize tp_nvram_state variable
        platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on the HP Pavilion 11 x360
        platform/x86: asus-wmi: Add BATC battery name to the list of supported
        platform/x86: asus-nb-wmi: Revert "Do not load on Asus T100TA and T200TA"
        platform/x86: touchscreen_dmi: Add info for the MPMAN Converter9 2-in-1
        Documentation: laptops: thinkpad-acpi: fix underline length build warning
        Platform: OLPC: Fix memleak in olpc_ec_probe
      7575fdda
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 165563c0
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Make sure SKB control block is in the proper state during IPSEC
          ESP-in-TCP encapsulation. From Sabrina Dubroca.
      
       2) Various kinds of attributes were not being cloned properly when we
          build new xfrm_state objects from existing ones. Fix from Antony
          Antony.
      
       3) Make sure to keep BTF sections, from Tony Ambardar.
      
       4) TX DMA channels need proper locking in lantiq driver, from Hauke
          Mehrtens.
      
       5) Honour route MTU during forwarding, always. From Maciej
          Żenczykowski.
      
       6) Fix races in kTLS which can result in crashes, from Rohit
          Maheshwari.
      
       7) Skip TCP DSACKs with rediculous sequence ranges, from Priyaranjan
          Jha.
      
       8) Use correct address family in xfrm state lookups, from Herbert Xu.
      
       9) A bridge FDB flush should not clear out user managed fdb entries
          with the ext_learn flag set, from Nikolay Aleksandrov.
      
      10) Fix nested locking of netdev address lists, from Taehee Yoo.
      
      11) Fix handling of 32-bit DATA_FIN values in mptcp, from Mat Martineau.
      
      12) Fix r8169 data corruptions on RTL8402 chips, from Heiner Kallweit.
      
      13) Don't free command entries in mlx5 while comp handler could still be
          running, from Eran Ben Elisha.
      
      14) Error flow of request_irq() in mlx5 is busted, due to an off by one
          we try to free and IRQ never allocated. From Maor Gottlieb.
      
      15) Fix leak when dumping netlink policies, from Johannes Berg.
      
      16) Sendpage cannot be performed when a page is a slab page, or the page
          count is < 1. Some subsystems such as nvme were doing so. Create a
          "sendpage_ok()" helper and use it as needed, from Coly Li.
      
      17) Don't leak request socket when using syncookes with mptcp, from
          Paolo Abeni.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (111 commits)
        net/core: check length before updating Ethertype in skb_mpls_{push,pop}
        net: mvneta: fix double free of txq->buf
        net_sched: check error pointer in tcf_dump_walker()
        net: team: fix memory leak in __team_options_register
        net: typhoon: Fix a typo Typoon --> Typhoon
        net: hinic: fix DEVLINK build errors
        net: stmmac: Modify configuration method of EEE timers
        tcp: fix syn cookied MPTCP request socket leak
        libceph: use sendpage_ok() in ceph_tcp_sendpage()
        scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map()
        drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage()
        tcp: use sendpage_ok() to detect misused .sendpage
        nvme-tcp: check page by sendpage_ok() before calling kernel_sendpage()
        net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send
        net: introduce helper sendpage_ok() in include/linux/net.h
        net: usb: pegasus: Proper error handing when setting pegasus' MAC address
        net: core: document two new elements of struct net_device
        netlink: fix policy dump leak
        net/mlx5e: Fix race condition on nhe->n pointer in neigh update
        net/mlx5e: Fix VLAN create flow
        ...
      165563c0
    • Jisheng Zhang's avatar
      net: phy: marvell: Use phy_read_paged() instead of open coding it · f4f9dcc3
      Jisheng Zhang authored
      Convert m88e1318_get_wol() to use the well implemented phy_read_paged()
      instead of open coding it.
      Signed-off-by: default avatarJisheng Zhang <Jisheng.Zhang@synaptics.com>
      Reviewed-by: default avatarMarek Behún <kabel@kernel.org>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f4f9dcc3
    • Vladimir Oltean's avatar
      net: dsa: propagate switchdev vlan_filtering prepare phase to drivers · 2e554a7a
      Vladimir Oltean authored
      A driver may refuse to enable VLAN filtering for any reason beyond what
      the DSA framework cares about, such as:
      - having tc-flower rules that rely on the switch being VLAN-aware
      - the particular switch does not support VLAN, even if the driver does
        (the DSA framework just checks for the presence of the .port_vlan_add
        and .port_vlan_del pointers)
      - simply not supporting this configuration to be toggled at runtime
      
      Currently, when a driver rejects a configuration it cannot support, it
      does this from the commit phase, which triggers various warnings in
      switchdev.
      
      So propagate the prepare phase to drivers, to give them the ability to
      refuse invalid configurations cleanly and avoid the warnings.
      
      Since we need to modify all function prototypes and check for the
      prepare phase from within the drivers, take that opportunity and move
      the existing driver restrictions within the prepare phase where that is
      possible and easy.
      
      Cc: Florian Fainelli <f.fainelli@gmail.com>
      Cc: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
      Cc: Hauke Mehrtens <hauke@hauke-m.de>
      Cc: Woojung Huh <woojung.huh@microchip.com>
      Cc: Microchip Linux Driver Support <UNGLinuxDriver@microchip.com>
      Cc: Sean Wang <sean.wang@mediatek.com>
      Cc: Landen Chao <Landen.Chao@mediatek.com>
      Cc: Andrew Lunn <andrew@lunn.ch>
      Cc: Vivien Didelot <vivien.didelot@gmail.com>
      Cc: Jonathan McDowell <noodles@earth.li>
      Cc: Linus Walleij <linus.walleij@linaro.org>
      Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
      Cc: Claudiu Manoil <claudiu.manoil@nxp.com>
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2e554a7a
    • Aaron Ma's avatar
      platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when reuse · 720ef73d
      Aaron Ma authored
      Evaluating ACPI _BCL could fail, then ACPI buffer size will be set to 0.
      When reuse this ACPI buffer, AE_BUFFER_OVERFLOW will be triggered.
      
      Re-initialize buffer size will make ACPI evaluate successfully.
      
      Fixes: 46445b6b ("thinkpad-acpi: fix handle locate for video and query of _BCL")
      Signed-off-by: default avatarAaron Ma <aaron.ma@canonical.com>
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      720ef73d
    • David S. Miller's avatar
      Merge branch 'net-Constify-struct-genl_small_ops' · c2568c8c
      David S. Miller authored
      Rikard Falkeborn says:
      
      ====================
      net: Constify struct genl_small_ops
      
      Make a couple of static struct genl_small_ops const to allow the compiler
      to put them in read-only memory. Patches are independent.
      
      v2: Rebase on net-next, genl_ops -> genl_small_ops
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c2568c8c
    • Rikard Falkeborn's avatar
      net: openvswitch: Constify static struct genl_small_ops · b980b313
      Rikard Falkeborn authored
      The only usage of these is to assign their address to the small_ops field
      in the genl_family struct, which is a const pointer, and applying
      ARRAY_SIZE() on them. Make them const to allow the compiler to put them
      in read-only memory.
      Signed-off-by: default avatarRikard Falkeborn <rikard.falkeborn@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b980b313
    • Rikard Falkeborn's avatar
      mptcp: Constify mptcp_pm_ops · 674d3ab9
      Rikard Falkeborn authored
      The only usages of mptcp_pm_ops is to assign its address to the small_ops
      field of the genl_family struct, which is a const pointer, and applying
      ARRAY_SIZE() on it. Make it const to allow the compiler to put it in
      read-only memory.
      Signed-off-by: default avatarRikard Falkeborn <rikard.falkeborn@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      674d3ab9
  3. 04 Oct, 2020 9 commits
    • Linus Torvalds's avatar
      Linux 5.9-rc8 · 549738f1
      Linus Torvalds authored
      549738f1
    • Xie He's avatar
      drivers/net/wan/hdlc_fr: Improvements to the code of pvc_xmit · f5083d0c
      Xie He authored
      1. Keep the code for the normal (non-error) flow at the lowest
      indentation level. And use "goto drop" for all error handling.
      
      2. Replace code that pads short Ethernet frames with a "__skb_pad" call.
      
      3. Change "dev_kfree_skb" to "kfree_skb" in error handling code.
      "kfree_skb" is the correct function to call when dropping an skb due to
      an error. "dev_kfree_skb", which is an alias of "consume_skb", is for
      dropping skbs normally (not due to an error).
      
      Cc: Krzysztof Halasa <khc@pm.waw.pl>
      Cc: Stephen Hemminger <stephen@networkplumber.org>
      Signed-off-by: default avatarXie He <xie.he.0141@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f5083d0c
    • Guillaume Nault's avatar
      net/core: check length before updating Ethertype in skb_mpls_{push,pop} · 4296adc3
      Guillaume Nault authored
      Openvswitch allows to drop a packet's Ethernet header, therefore
      skb_mpls_push() and skb_mpls_pop() might be called with ethernet=true
      and mac_len=0. In that case the pointer passed to skb_mod_eth_type()
      doesn't point to an Ethernet header and the new Ethertype is written at
      unexpected locations.
      
      Fix this by verifying that mac_len is big enough to contain an Ethernet
      header.
      
      Fixes: fa4e0f88 ("net/sched: fix corrupted L2 header with MPLS 'push' and 'pop' actions")
      Signed-off-by: default avatarGuillaume Nault <gnault@redhat.com>
      Acked-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4296adc3
    • Tom Rix's avatar
      net: mvneta: fix double free of txq->buf · f4544e53
      Tom Rix authored
      clang static analysis reports this problem:
      
      drivers/net/ethernet/marvell/mvneta.c:3465:2: warning:
        Attempt to free released memory
              kfree(txq->buf);
              ^~~~~~~~~~~~~~~
      
      When mvneta_txq_sw_init() fails to alloc txq->tso_hdrs,
      it frees without poisoning txq->buf.  The error is caught
      in the mvneta_setup_txqs() caller which handles the error
      by cleaning up all of the txqs with a call to
      mvneta_txq_sw_deinit which also frees txq->buf.
      
      Since mvneta_txq_sw_deinit is a general cleaner, all of the
      partial cleaning in mvneta_txq_sw_deinit()'s error handling
      is not needed.
      
      Fixes: 2adb719d ("net: mvneta: Implement software TSO")
      Signed-off-by: default avatarTom Rix <trix@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f4544e53
    • Cong Wang's avatar
      net_sched: check error pointer in tcf_dump_walker() · 580e4273
      Cong Wang authored
      Although we take RTNL on dump path, it is possible to
      skip RTNL on insertion path. So the following race condition
      is possible:
      
      rtnl_lock()		// no rtnl lock
      			mutex_lock(&idrinfo->lock);
      			// insert ERR_PTR(-EBUSY)
      			mutex_unlock(&idrinfo->lock);
      tc_dump_action()
      rtnl_unlock()
      
      So we have to skip those temporary -EBUSY entries on dump path
      too.
      
      Reported-and-tested-by: syzbot+b47bc4f247856fb4d9e1@syzkaller.appspotmail.com
      Fixes: 0fedc63f ("net_sched: commit action insertions together")
      Cc: Vlad Buslov <vladbu@mellanox.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      580e4273
    • Anant Thazhemadam's avatar
      net: team: fix memory leak in __team_options_register · 9a9e7749
      Anant Thazhemadam authored
      The variable "i" isn't initialized back correctly after the first loop
      under the label inst_rollback gets executed.
      
      The value of "i" is assigned to be option_count - 1, and the ensuing
      loop (under alloc_rollback) begins by initializing i--.
      Thus, the value of i when the loop begins execution will now become
      i = option_count - 2.
      
      Thus, when kfree(dst_opts[i]) is called in the second loop in this
      order, (i.e., inst_rollback followed by alloc_rollback),
      dst_optsp[option_count - 2] is the first element freed, and
      dst_opts[option_count - 1] does not get freed, and thus, a memory
      leak is caused.
      
      This memory leak can be fixed, by assigning i = option_count (instead of
      option_count - 1).
      
      Fixes: 80f7c668 ("team: add support for per-port options")
      Reported-by: syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com
      Tested-by: syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com
      Signed-off-by: default avatarAnant Thazhemadam <anant.thazhemadam@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9a9e7749
    • David S. Miller's avatar
      Merge branch 'bnxt_en-net-next-updates' · 3e233cac
      David S. Miller authored
      Michael Chan says:
      
      ====================
      bnxt_en: net-next updates.
      
      This series starts off with the usual update of the firmware interface
      spec.  A new firmware status bit in the interface will be used in patch
      add the infrastructure to read the firmware status very early during
      driver probe and this will allow patch #4 to do the recovery if needed.
      
      The rest of the patches add improvements to the current RX reset
      logic by localizing the reset to the affected RX ring only and to
      reset only if firmware has determined that the RX ring is in permanent
      error state.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3e233cac
    • Michael Chan's avatar
      bnxt_en: Eliminate unnecessary RX resets. · 8d4bd96b
      Michael Chan authored
      Currently, the driver will schedule RX ring reset when we get a buffer
      error in the RX completion record.  These RX buffer errors can be due
      to normal out-of-buffer conditions or a permanent error in the RX
      ring.  Because the driver cannot distinguish between these 2
      conditions, we assume all these buffer errors require reset.
      
      This is very disruptive when it is just a normal out-of-buffer
      condition.  Newer firmware will now monitor the rings for the permanent
      failure and will send a notification to the driver when it happens.
      This allows the driver to reset only when such a notification is
      received.  In environments where we have predominently out-of-buffer
      conditions, we now can avoid these unnecessary resets.
      Reviewed-by: default avatarEdwin Peer <edwin.peer@broadcom.com>
      Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8d4bd96b
    • Michael Chan's avatar
      bnxt_en: Reduce unnecessary message log during RX errors. · 1b5c8b63
      Michael Chan authored
      There is logic in the RX path to detect unexpected handles in the
      RX completion.  We'll print a warning and schedule a reset.  The
      next expected handle is then set to 0xffff which is guaranteed to
      not match any valid handle.  This will force all remaining packets in
      the ring to be discarded before the reset.  There can be hundreds of
      these packets remaining in the ring and there is no need to print the
      warnings for these forced errors.
      Reviewed-by: default avatarPavan Chebbi <pavan.chebbi@broadcom.com>
      Reviewed-by: default avatarEdwin Peer <edwin.peer@broadcom.com>
      Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1b5c8b63