1. 28 Jan, 2019 7 commits
    • Nir Dotan's avatar
      ip6mr: Fix notifiers call on mroute_clean_tables() · 146820cc
      Nir Dotan authored
      When the MC route socket is closed, mroute_clean_tables() is called to
      cleanup existing routes. Mistakenly notifiers call was put on the cleanup
      of the unresolved MC route entries cache.
      In a case where the MC socket closes before an unresolved route expires,
      the notifier call leads to a crash, caused by the driver trying to
      increment a non initialized refcount_t object [1] and then when handling
      is done, to decrement it [2]. This was detected by a test recently added in
      commit 6d4efada ("selftests: forwarding: Add multicast routing test").
      
      Fix that by putting notifiers call on the resolved entries traversal,
      instead of on the unresolved entries traversal.
      
      [1]
      
      [  245.748967] refcount_t: increment on 0; use-after-free.
      [  245.754829] WARNING: CPU: 3 PID: 3223 at lib/refcount.c:153 refcount_inc_checked+0x2b/0x30
      ...
      [  245.802357] Hardware name: Mellanox Technologies Ltd. MSN2740/SA001237, BIOS 5.6.5 06/07/2016
      [  245.811873] RIP: 0010:refcount_inc_checked+0x2b/0x30
      ...
      [  245.907487] Call Trace:
      [  245.910231]  mlxsw_sp_router_fib_event.cold.181+0x42/0x47 [mlxsw_spectrum]
      [  245.917913]  notifier_call_chain+0x45/0x7
      [  245.922484]  atomic_notifier_call_chain+0x15/0x20
      [  245.927729]  call_fib_notifiers+0x15/0x30
      [  245.932205]  mroute_clean_tables+0x372/0x3f
      [  245.936971]  ip6mr_sk_done+0xb1/0xc0
      [  245.940960]  ip6_mroute_setsockopt+0x1da/0x5f0
      ...
      
      [2]
      
      [  246.128487] refcount_t: underflow; use-after-free.
      [  246.133859] WARNING: CPU: 0 PID: 7 at lib/refcount.c:187 refcount_sub_and_test_checked+0x4c/0x60
      [  246.183521] Hardware name: Mellanox Technologies Ltd. MSN2740/SA001237, BIOS 5.6.5 06/07/2016
      ...
      [  246.193062] Workqueue: mlxsw_core_ordered mlxsw_sp_router_fibmr_event_work [mlxsw_spectrum]
      [  246.202394] RIP: 0010:refcount_sub_and_test_checked+0x4c/0x60
      ...
      [  246.298889] Call Trace:
      [  246.301617]  refcount_dec_and_test_checked+0x11/0x20
      [  246.307170]  mlxsw_sp_router_fibmr_event_work.cold.196+0x47/0x78 [mlxsw_spectrum]
      [  246.315531]  process_one_work+0x1fa/0x3f0
      [  246.320005]  worker_thread+0x2f/0x3e0
      [  246.324083]  kthread+0x118/0x130
      [  246.327683]  ? wq_update_unbound_numa+0x1b0/0x1b0
      [  246.332926]  ? kthread_park+0x80/0x80
      [  246.337013]  ret_from_fork+0x1f/0x30
      
      Fixes: 088aa3ee ("ip6mr: Support fib notifications")
      Signed-off-by: default avatarNir Dotan <nird@mellanox.com>
      Reviewed-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      146820cc
    • Johannes Berg's avatar
      decnet: fix DN_IFREQ_SIZE · 50c29366
      Johannes Berg authored
      Digging through the ioctls with Al because of the previous
      patches, we found that on 64-bit decnet's dn_dev_ioctl()
      is wrong, because struct ifreq::ifr_ifru is actually 24
      bytes (not 16 as expected from struct sockaddr) due to the
      ifru_map and ifru_settings members.
      
      Clearly, decnet expects the ioctl to be called with a struct
      like
        struct ifreq_dn {
          char ifr_name[IFNAMSIZ];
          struct sockaddr_dn ifr_addr;
        };
      
      since it does
        struct ifreq *ifr = ...;
        struct sockaddr_dn *sdn = (struct sockaddr_dn *)&ifr->ifr_addr;
      
      This means that DN_IFREQ_SIZE is too big for what it wants on
      64-bit, as it is
        sizeof(struct ifreq) - sizeof(struct sockaddr) +
        sizeof(struct sockaddr_dn)
      
      This assumes that sizeof(struct sockaddr) is the size of ifr_ifru
      but that isn't true.
      
      Fix this to use offsetof(struct ifreq, ifr_ifru).
      
      This indeed doesn't really matter much - the result is that we
      copy in/out 8 bytes more than we should on 64-bit platforms. In
      case the "struct ifreq_dn" lands just on the end of a page though
      it might lead to faults.
      
      As far as I can tell, it has been like this forever, so it seems
      very likely that nobody cares.
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      50c29366
    • Alexey Khoroshilov's avatar
      net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup() · c69c29a1
      Alexey Khoroshilov authored
      If phy_power_on() fails in rk_gmac_powerup(), clocks are left enabled.
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c69c29a1
    • David S. Miller's avatar
      Merge branch 'hns-fixes' · 417c8045
      David S. Miller authored
      Peng Li says:
      
      ====================
      net: hns: code optimizations & bugfixes for HNS driver
      
      This patchset includes bugfixes and code optimizations for the HNS
      ethernet controller driver
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      417c8045
    • Yonglong Liu's avatar
      net: hns: Fix wrong read accesses via Clause 45 MDIO protocol · cec8abba
      Yonglong Liu authored
      When reading phy registers via Clause 45 MDIO protocol, after write
      address operation, the driver use another write address operation, so
      can not read the right value of any phy registers. This patch fixes it.
      Signed-off-by: default avatarYonglong Liu <liuyonglong@huawei.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cec8abba
    • Yonglong Liu's avatar
      net: hns: Restart autoneg need return failed when autoneg off · ed29ca8b
      Yonglong Liu authored
      The hns driver of earlier devices, when autoneg off, restart autoneg
      will return -EINVAL, so make the hns driver for the latest devices
      do the same.
      Signed-off-by: default avatarYonglong Liu <liuyonglong@huawei.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ed29ca8b
    • Yonglong Liu's avatar
      net: hns: Fix for missing of_node_put() after of_parse_phandle() · 263c6d75
      Yonglong Liu authored
      In hns enet driver, we use of_parse_handle() to get hold of the
      device node related to "ae-handle" but we have missed to put
      the node reference using of_node_put() after we are done using
      the node. This patch fixes it.
      
      Note:
      This problem is stated in Link: https://lkml.org/lkml/2018/12/22/217
      
      Fixes: 48189d6a ("net: hns: enet specifies a reference to dsaf")
      Reported-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
      Signed-off-by: default avatarYonglong Liu <liuyonglong@huawei.com>
      Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      263c6d75
  2. 27 Jan, 2019 10 commits
    • David S. Miller's avatar
      Merge tag 'mlx5-fixes-2019-01-25' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux · 3da15ad3
      David S. Miller authored
      Saeed Mahameed says:
      
      ====================
      Mellanox, mlx5 fixes 2019-01-25
      
      This series introduces some fixes to mlx5 driver.
      For more information please see tag log below.
      
      Please pull and let me know if there is any problem.
      
      For -stable v4.13
      ('net/mlx5e: Allow MAC invalidation while spoofchk is ON')
      
      For -stable v4.18
      ('Revert "net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager"')
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3da15ad3
    • Bernard Pidoux's avatar
      net/rose: fix NULL ax25_cb kernel panic · b0cf0292
      Bernard Pidoux authored
      When an internally generated frame is handled by rose_xmit(),
      rose_route_frame() is called:
      
              if (!rose_route_frame(skb, NULL)) {
                      dev_kfree_skb(skb);
                      stats->tx_errors++;
                      return NETDEV_TX_OK;
              }
      
      We have the same code sequence in Net/Rom where an internally generated
      frame is handled by nr_xmit() calling nr_route_frame(skb, NULL).
      However, in this function NULL argument is tested while it is not in
      rose_route_frame().
      Then kernel panic occurs later on when calling ax25cmp() with a NULL
      ax25_cb argument as reported many times and recently with syzbot.
      
      We need to test if ax25 is NULL before using it.
      
      Testing:
      Built kernel with CONFIG_ROSE=y.
      Signed-off-by: default avatarBernard Pidoux <f6bvp@free.fr>
      Acked-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Reported-by: syzbot+1a2c456a1ea08fa5b5f7@syzkaller.appspotmail.com
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Bernard Pidoux <f6bvp@free.fr>
      Cc: linux-hams@vger.kernel.org
      Cc: netdev@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b0cf0292
    • Tomonori Sakita's avatar
      net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case · 6571ebce
      Tomonori Sakita authored
      If fill_level was not zero and status was not BUSY,
      result of "tx_prod - tx_cons - inuse" might be zero.
      Subtracting 1 unconditionally results invalid negative return value
      on this case.
      Make sure not to return an negative value.
      Signed-off-by: default avatarTomonori Sakita <tomonori.sakita@sord.co.jp>
      Signed-off-by: default avatarAtsushi Nemoto <atsushi.nemoto@sord.co.jp>
      Reviewed-by: default avatarDalon L Westergreen <dalon.westergreen@linux.intel.com>
      Acked-by: default avatarThor Thayer <thor.thayer@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6571ebce
    • Cong Wang's avatar
      netrom: switch to sock timer API · 63346650
      Cong Wang authored
      sk_reset_timer() and sk_stop_timer() properly handle
      sock refcnt for timer function. Switching to them
      could fix a refcounting bug reported by syzbot.
      
      Reported-and-tested-by: syzbot+defa700d16f1bd1b9a05@syzkaller.appspotmail.com
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: linux-hams@vger.kernel.org
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      63346650
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec · c303a9b2
      David S. Miller authored
      Steffen Klassert says:
      
      ====================
      pull request (net): ipsec 2019-01-25
      
      1) Several patches to fix the fallout from the recent
         tree based policy lookup work. From Florian Westphal.
      
      2) Fix VTI for IPCOMP for 'not compressed' IPCOMP packets.
         We need an extra IPIP handler to process these packets
         correctly. From Su Yanjun.
      
      3) Fix validation of template and selector families for
         MODE_ROUTEOPTIMIZATION with ipv4-in-ipv6 packets.
         This can lead to a stack-out-of-bounds because
         flowi4 struct is treated as flowi6 struct.
         Fix from Florian Westphal.
      
      4) Restore the default behaviour of the xfrm set-mark
         in the output path. This was changed accidentally
         when mark setting was extended to the input path.
         From Benedict Wong.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c303a9b2
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 1fc7f56d
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "Quite a few fixes for x86: nested virtualization save/restore, AMD
        nested virtualization and virtual APIC, 32-bit fixes, an important fix
        to restore operation on older processors, and a bunch of hyper-v
        bugfixes. Several are marked stable.
      
        There are also fixes for GCC warnings and for a GCC/objtool interaction"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: x86: Mark expected switch fall-throughs
        KVM: x86: fix TRACE_INCLUDE_PATH and remove -I. header search paths
        KVM: selftests: check returned evmcs version range
        x86/kvm/hyper-v: nested_enable_evmcs() sets vmcs_version incorrectly
        KVM: VMX: Move vmx_vcpu_run()'s VM-Enter asm blob to a helper function
        kvm: selftests: Fix region overlap check in kvm_util
        kvm: vmx: fix some -Wmissing-prototypes warnings
        KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
        svm: Fix AVIC incomplete IPI emulation
        svm: Add warning message for AVIC IPI invalid target
        KVM: x86: WARN_ONCE if sending a PV IPI returns a fatal error
        KVM: x86: Fix PV IPIs for 32-bit KVM host
        x86/kvm/hyper-v: recommend using eVMCS only when it is enabled
        x86/kvm/hyper-v: don't recommend doing reset via synthetic MSR
        kvm: x86/vmx: Use kzalloc for cached_vmcs12
        KVM: VMX: Use the correct field var when clearing VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL
        KVM: x86: Fix single-step debugging
        x86/kvm/hyper-v: don't announce GUEST IDLE MSR support
      1fc7f56d
    • Linus Torvalds's avatar
      Merge tag 'dma-mapping-5.0-2' of git://git.infradead.org/users/hch/dma-mapping · c180f1b0
      Linus Torvalds authored
      Pull dma-mapping fix from Christoph Hellwig:
       "Fix a xen-swiotlb regression on arm64"
      
      * tag 'dma-mapping-5.0-2' of git://git.infradead.org/users/hch/dma-mapping:
        arm64/xen: fix xen-swiotlb cache flushing
      c180f1b0
    • Linus Torvalds's avatar
      Merge tag 'libnvdimm-fixes-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · 6a2651b5
      Linus Torvalds authored
      Pull libnvdimm fixes from Dan Williams:
       "A fix for namespace label support for non-Intel NVDIMMs that implement
        the ACPI standard label method.
      
        This has apparently never worked and could wait for v5.1. However it
        has enough visibility with hardware vendors [1] and distro bug
        trackers [2], and low enough risk that I decided it should go in for
        -rc4. The other fixups target the new, for v5.0, nvdimm security
        functionality. The larger init path fixup closes a memory leak and a
        potential userspace lockup due to missed notifications.
      
          [1] https://github.com/pmem/ndctl/issues/78
          [2] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1811785
      
        These have all soaked in -next for a week with no reported issues.
      
        Summary:
      
         - Fix support for NVDIMMs that implement the ACPI standard label
           methods.
      
         - Fix error handling for security overwrite (memory leak / userspace
           hang condition), and another one-line security cleanup"
      
      * tag 'libnvdimm-fixes-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        acpi/nfit: Fix command-supported detection
        acpi/nfit: Block function zero DSMs
        libnvdimm/security: Require nvdimm_security_setup_events() to succeed
        nfit_test: fix security state pull for nvdimm security nfit_test
      6a2651b5
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 78e372e6
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
       "A fixup for the input_event fix for y2038 Sparc64, and couple other
        minor fixes"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: input_event - fix the CONFIG_SPARC64 mixup
        Input: olpc_apsp - assign priv->dev earlier
        Input: uinput - fix undefined behavior in uinput_validate_absinfo()
        Input: raspberrypi-ts - fix link error
        Input: xpad - add support for SteelSeries Stratus Duo
        Input: input_event - provide override for sparc64
      78e372e6
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 037222ad
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Count ttl-dropped frames properly in mac80211, from Bob Copeland.
      
       2) Integer overflow in ktime handling of bcm can code, from Oliver
          Hartkopp.
      
       3) Fix RX desc handling wrt. hw checksumming in ravb, from Simon
          Horman.
      
       4) Various hash key fixes in hv_netvsc, from Haiyang Zhang.
      
       5) Use after free in ax25, from Eric Dumazet.
      
       6) Several fixes to the SSN support in SCTP, from Xin Long.
      
       7) Do not process frames after a NAPI reschedule in ibmveth, from
          Thomas Falcon.
      
       8) Fix NLA_POLICY_NESTED arguments, from Johannes Berg.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (42 commits)
        qed: Revert error handling changes.
        cfg80211: extend range deviation for DMG
        cfg80211: reg: remove warn_on for a normal case
        mac80211: Add attribute aligned(2) to struct 'action'
        mac80211: don't initiate TDLS connection if station is not associated to AP
        nl80211: fix NLA_POLICY_NESTED() arguments
        ibmveth: Do not process frames after calling napi_reschedule
        net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP
        net: usb: asix: ax88772_bind return error when hw_reset fail
        MAINTAINERS: Update cavium networking drivers
        net/mlx4_core: Fix error handling when initializing CQ bufs in the driver
        net/mlx4_core: Add masking for a few queries on HCA caps
        sctp: set flow sport from saddr only when it's 0
        sctp: set chunk transport correctly when it's a new asoc
        sctp: improve the events for sctp stream adding
        sctp: improve the events for sctp stream reset
        ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel
        ax25: fix possible use-after-free
        sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
        hv_netvsc: fix typos in code comments
        ...
      037222ad
  3. 26 Jan, 2019 4 commits
    • Linus Torvalds's avatar
      Merge tag '5.0-rc3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 7c2614bf
      Linus Torvalds authored
      Pull smb3 fixes from Steve French:
       "A set of small smb3 fixes, some fixing various crediting issues
        discovered during xfstest runs, five for stable"
      
      * tag '5.0-rc3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: print CIFSMaxBufSize as part of /proc/fs/cifs/DebugData
        smb3: add credits we receive from oplock/break PDUs
        CIFS: Fix mounts if the client is low on credits
        CIFS: Do not assume one credit for async responses
        CIFS: Fix credit calculations in compound mid callback
        CIFS: Fix credit calculation for encrypted reads with errors
        CIFS: Fix credits calculations for reads with errors
        CIFS: Do not reconnect TCP session in add_credits()
        smb3: Cleanup license mess
        CIFS: Fix possible hang during async MTU reads and writes
        cifs: fix memory leak of an allocated cifs_ntsd structure
      7c2614bf
    • Linus Torvalds's avatar
      Merge tag 'vfio-v5.0-rc4' of git://github.com/awilliam/linux-vfio · 2580acb2
      Linus Torvalds authored
      Pull VFIO fixes from Alex Williamson:
      
       - cleanup licenses in new files (Thomas Gleixner)
      
       - cleanup new compiler warnings (Alexey Kardashevskiy)
      
      * tag 'vfio-v5.0-rc4' of git://github.com/awilliam/linux-vfio:
        vfio-pci/nvlink2: Fix ancient gcc warnings
        vfio/pci: Cleanup license mess
      2580acb2
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 7930851e
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Six fixes, all of which appear to have user visible consequences.
      
        The DMA one is a regression fix from the merge window and of the
        others, four are driver specific and one specific to the target code"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: ufs: Use explicit access size in ufshcd_dump_regs
        scsi: tcmu: fix use after free
        scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
        scsi: lpfc: nvmet: avoid hang / use-after-free when destroying targetport
        scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport
        scsi: communicate max segment size to the DMA mapping code
      7930851e
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20190125' of git://git.kernel.dk/linux-block · 6b8f9159
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A collection of fixes for this release. This contains:
      
         - Silence sparse rightfully complaining about non-static wbt
           functions (Bart)
      
         - Fixes for the zoned comments/ioctl documentation (Damien)
      
         - direct-io fix that's been lingering for a while (Ernesto)
      
         - cgroup writeback fix (Tejun)
      
         - Set of NVMe patches for nvme-rdma/tcp (Sagi, Hannes, Raju)
      
         - Block recursion tracking fix (Ming)
      
         - Fix debugfs command flag naming for a few flags (Jianchao)"
      
      * tag 'for-linus-20190125' of git://git.kernel.dk/linux-block:
        block: Fix comment typo
        uapi: fix ioctl documentation
        blk-wbt: Declare local functions static
        blk-mq: fix the cmd_flag_name array
        nvme-multipath: drop optimization for static ANA group IDs
        nvmet-rdma: fix null dereference under heavy load
        nvme-rdma: rework queue maps handling
        nvme-tcp: fix timeout handler
        nvme-rdma: fix timeout handler
        writeback: synchronize sync(2) against cgroup writeback membership switches
        block: cover another queue enter recursion via BIO_QUEUE_ENTERED
        direct-io: allow direct writes to empty inodes
      6b8f9159
  4. 25 Jan, 2019 19 commits
    • David S. Miller's avatar
      qed: Revert error handling changes. · abfd04f7
      David S. Miller authored
      This is new code and not bug fixes.
      
      This reverts all changes added by merge commit
      8fb18be9Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      abfd04f7
    • Linus Torvalds's avatar
      Merge tag 'mmc-v5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · ba606975
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
      
       - sdhci-acpi: Fixup build dependency for PCI
      
       - sdhci-omap: Resolve Kconfig warnings on keystone
      
       - sdhci-iproc: Propagate errors from DT parsing
      
       - meson-gx: Fixup IRQ handling in release callback
      
       - meson-gx: Use signal re-sampling to fixup tuning
      
       - dw_mmc-bluefield: Fix the license information
      
      * tag 'mmc-v5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: dw_mmc-bluefield: : Fix the license information
        mmc: meson-gx: enable signal re-sampling together with tuning
        mmc: sdhci-iproc: handle mmc_of_parse() errors during probe
        mmc: meson-gx: Free irq in release() callback
        mmc: host: Fix Kconfig warnings on keystone_defconfig
        mmc: sdhci-acpi: Make PCI dependency explicit
      ba606975
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · d488bd21
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some small char and misc driver fixes to resolve some
        reported issues, as well as a number of binderfs fixups that were
        found after auditing the filesystem code by Al Viro. As binderfs
        hasn't been in a previous release yet, it's good to get these in now
        before the first users show up.
      
        All of these have been in linux-next for a bit with no reported
        issues"
      
      * tag 'char-misc-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (26 commits)
        i3c: master: Fix an error checking typo in 'cdns_i3c_master_probe()'
        binderfs: switch from d_add() to d_instantiate()
        binderfs: drop lock in binderfs_binder_ctl_create
        binderfs: kill_litter_super() before cleanup
        binderfs: rework binderfs_binder_device_create()
        binderfs: rework binderfs_fill_super()
        binderfs: prevent renaming the control dentry
        binderfs: remove outdated comment
        binderfs: use __u32 for device numbers
        binderfs: use correct include guards in header
        misc: pvpanic: fix warning implicit declaration
        char/mwave: fix potential Spectre v1 vulnerability
        misc: ibmvsm: Fix potential NULL pointer dereference
        binderfs: fix error return code in binderfs_fill_super()
        mei: me: add denverton innovation engine device IDs
        mei: me: mark LBG devices as having dma support
        mei: dma: silent the reject message
        binderfs: handle !CONFIG_IPC_NS builds
        binderfs: reserve devices for initial mount
        binderfs: rename header to binderfs.h
        ...
      d488bd21
    • Linus Torvalds's avatar
      Merge tag 'staging-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 96f18cb8
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Here are some small staging driver fixes for 5.0-rc4.
      
        They resolve some reported bugs and add a new device id for one
        driver. Nothing major at all, but all good to have.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'staging-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: android: ion: Support cpu access during dma_buf_detach
        staging: rtl8723bs: Fix build error with Clang when inlining is disabled
        staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1
        staging: vchiq: Fix local event signalling
        Staging: wilc1000: unlock on error in init_chip()
        staging: wilc1000: fix memory leak in wilc_add_rx_gtk
        staging: wilc1000: fix registration frame size
      96f18cb8
    • Linus Torvalds's avatar
      Merge tag 'tty-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 473721f9
      Linus Torvalds authored
      Pull tty/serial driver fixes from Greg KH:
       "Here are a number of small tty core and serial driver fixes for
        5.0-rc4 to resolve some reported issues.
      
        Nothing major, the small serial driver fixes, a tty core fixup for a
        crash that was reported, and some good vt fixes from Nicolas Pitre as
        he seems to be auditing that chunk of code a lot lately.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'tty-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
        tty: serial: qcom_geni_serial: Allow mctrl when flow control is disabled
        tty: Handle problem if line discipline does not have receive_buf
        vgacon: unconfuse vc_origin when using soft scrollback
        vt: invoke notifier on screen size change
        vt: always call notifier with the console lock held
        vt: make vt_console_print() compatible with the unicode screen buffer
        tty/n_hdlc: fix __might_sleep warning
        serial: 8250: Fix serial8250 initialization crash
        uart: Fix crash in uart_write and uart_put_char
      473721f9
    • Linus Torvalds's avatar
      Merge tag 'usb-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · b48cef32
      Linus Torvalds authored
      Pull USB/PHY fixes from Greg KH:
       "Here are a number of small USB and PHY driver fixes for 5.0-rc4.
      
        Nothing major at all, just the usual selection of USB gadget bugfixes,
        some new USB serial driver ids, some SPDX fixes, and some PHY driver
        fixes for reported issues.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'usb-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        USB: serial: keyspan_usa: add proper SPDX lines for .h files
        USB: EHCI: ehci-mv: add MODULE_DEVICE_TABLE
        USB: leds: fix regression in usbport led trigger
        usb: chipidea: fix static checker warning for NULL pointer
        MAINTAINERS: email address update in MAINTAINERS entries
        USB: usbip: delete README file
        USB: serial: pl2303: add new PID to support PL2303TB
        usb: dwc2: gadget: Fix Remote Wakeup interrupt bit clearing
        phy: ath79-usb: Fix the main reset name to match the DT binding
        phy: ath79-usb: Fix the power on error path
        phy: fix build breakage: add PHY_MODE_SATA
        phy: ti: ensure priv is not null before dereferencing it
        USB: serial: ftdi_sio: fix GPIO not working in autosuspend
        usb: gadget: Potential NULL dereference on allocation error
        usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
        usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup
        usb: dwc3: gadget: synchronize_irq dwc irq in suspend
        USB: serial: simple: add Motorola Tetra TPG2200 device id
      b48cef32
    • Or Gerlitz's avatar
      net/mlx5e: Unblock setting vid 0 for VFs through the uplink rep · 6ce966fd
      Or Gerlitz authored
      It turns out that libvirt uses 0-vid as a default if no vlan was
      set for the guest (which is the case for switchdev mode) and errs
      if we disallow that:
      
      error: Failed to start domain vm75
      error: Cannot set interface MAC/vlanid to 6a:66:2d:48:92:c2/0 \
      		for ifname enp59s0f0 vf 0: Operation not supported
      
      So allow this in order not to break existing systems.
      Signed-off-by: default avatarOr Gerlitz <ogerlitz@mellanox.com>
      Reported-by: default avatarMaor Dickman <maord@mellanox.com>
      Reviewed-by: default avatarGavi Teitz <gavi@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      6ce966fd
    • Or Gerlitz's avatar
      net/mlx5e: Move to use common phys port names for vport representors · c12ecc23
      Or Gerlitz authored
      With VF LAG commit 491c37e4 "net/mlx5e: In case of LAG, one switch
      parent id is used for all representors", both uplinks and all the VFs
      (on both of them) get the same switchdev id.
      
      This cause the provisioning system method to identify the rep of a given
      VF from the parent PF PCI device using switchev id and physical port
      name to break, since VFm of PF0 will have the (id, name) as VFm of PF1.
      
      To fix that, we align to use the framework agreed upstream and set by
      nfp commit 168c478e "nfp: wire get_phys_port_name on representors":
      
      $ cat /sys/class/net/eth4_*/phys_port_name
      p0
      pf0vf0
      pf0vf1
      
      Now, the names will be different, e.g. pf0vf0 vs. pf1vf0.
      
      Fixes: 491c37e4 ("net/mlx5e: In case of LAG, one switch parent id is used for all representors")
      Signed-off-by: default avatarOr Gerlitz <ogerlitz@mellanox.com>
      Reported-by: default avatarWaleed Musa <waleedm@mellanox.com>
      Reviewed-by: default avatarRoi Dayan <roid@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      c12ecc23
    • Aya Levin's avatar
      net/mlx5e: Allow MAC invalidation while spoofchk is ON · 9d2cbdc5
      Aya Levin authored
      Prior to this patch the driver prohibited spoof checking on invalid MAC.
      Now the user can set this configuration if it wishes to.
      
      This is required since libvirt might invalidate the VF Mac by setting it
      to zero, while spoofcheck is ON.
      
      Fixes: 1ab2068a ("net/mlx5: Implement vports admin state backup/restore")
      Signed-off-by: default avatarAya Levin <ayal@mellanox.com>
      Reviewed-by: default avatarEran Ben Elisha <eranbe@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      9d2cbdc5
    • Moni Shoua's avatar
      net/mlx5: Take lock with IRQs disabled to avoid deadlock · 33814e5d
      Moni Shoua authored
      The lock in qp_table might be taken from process context or from
      interrupt context. This may lead to a deadlock unless it is taken with
      IRQs disabled.
      
      Discovered by lockdep
      
      ================================
      WARNING: inconsistent lock state
      4.20.0-rc6
      --------------------------------
      inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W}
      
      python/12572 [HC1[1]:SC0[0]:HE0:SE1] takes:
      00000000052a4df4 (&(&table->lock)->rlock#2){?.+.}, /0x50 [mlx5_core]
      {HARDIRQ-ON-W} state was registered at:
        _raw_spin_lock+0x33/0x70
        mlx5_get_rsc+0x1a/0x50 [mlx5_core]
        mlx5_ib_eqe_pf_action+0x493/0x1be0 [mlx5_ib]
        process_one_work+0x90c/0x1820
        worker_thread+0x87/0xbb0
        kthread+0x320/0x3e0
        ret_from_fork+0x24/0x30
      irq event stamp: 103928
      hardirqs last  enabled at (103927): [] nk+0x1a/0x1c
      hardirqs last disabled at (103928): [] unk+0x1a/0x1c
      softirqs last  enabled at (103924): [] tcp_sendmsg+0x31/0x40
      softirqs last disabled at (103922): [] 80
      
      other info that might help us debug this:
       Possible unsafe locking scenario:
      
             CPU0
             ----
        lock(&(&table->lock)->rlock#2);
      
          lock(&(&table->lock)->rlock#2);
      
       *** DEADLOCK ***
      
      Fixes: 032080ab ("IB/mlx5: Lock QP during page fault handling")
      Signed-off-by: default avatarMoni Shoua <monis@mellanox.com>
      Reviewed-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      33814e5d
    • Shay Agroskin's avatar
      net/mlx5e: Fix wrong private flag usage causing checksum disable · 92b32772
      Shay Agroskin authored
      MLX5E_PFLAG_* definitions were changed from bitmask to enumerated
      values. However, in mlx5e_open_rq(), the proper API (MLX5E_GET_PFLAG macro)
      was not used to read the flag value of MLX5E_PFLAG_RX_NO_CSUM_COMPLETE.
      Fixed it.
      
      Fixes: 8ff57c18 ("net/mlx5e: Improve ethtool private-flags code structure")
      Signed-off-by: default avatarShay Agroskin <shayag@mellanox.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      92b32772
    • Bodong Wang's avatar
      Revert "net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager" · 4e046de0
      Bodong Wang authored
      This reverts commit 5f5991f3.
      
      With the original commit, eswitch instance will not be initialized for
      a function which is vport group manager but not eswitch manager such as
      host PF on SmartNIC (BlueField) card. This will result in a kernel crash
      when such a vport group manager is trying to access vports in its group.
      E.g, PF vport manager (not eswitch manager) tries to configure the MAC
      of its VF vport, a kernel trace will happen similar as bellow:
      
       BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
       ...
       RIP: 0010:mlx5_eswitch_get_vport_config+0xc/0x180 [mlx5_core]
       ...
      
      Fixes: 5f5991f3 ("net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager")
      Signed-off-by: default avatarBodong Wang <bodong@mellanox.com>
      Reported-by: default avatarYuval Avnery <yuvalav@mellanox.com>
      Reviewed-by: default avatarDaniel Jurgens <danielj@mellanox.com>
      Reviewed-by: default avatarOr Gerlitz <ogerlitz@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      4e046de0
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2019-01-25' of... · 51795275
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2019-01-25' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      Just a few small fixes:
       * avoid trying to operate TDLS when not connection,
         this is not valid and led to issues
       * count TTL-dropped frames in mesh better
       * deal with new WiGig channels in regulatory code
       * remove a WARN_ON() that can trigger due to benign
         races during device/driver registration
       * fix nested netlink policy maxattrs (syzkaller)
       * fix hwsim n_limits (syzkaller)
       * propagate __aligned(2) to a surrounding struct
       * return proper error in virt_wifi error path
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      51795275
    • Gustavo A. R. Silva's avatar
      KVM: x86: Mark expected switch fall-throughs · b2869f28
      Gustavo A. R. Silva authored
      In preparation to enabling -Wimplicit-fallthrough, mark switch
      cases where we are expecting to fall through.
      
      This patch fixes the following warnings:
      
      arch/x86/kvm/lapic.c:1037:27: warning: this statement may fall through [-Wimplicit-fallthrough=]
      arch/x86/kvm/lapic.c:1876:3: warning: this statement may fall through [-Wimplicit-fallthrough=]
      arch/x86/kvm/hyperv.c:1637:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
      arch/x86/kvm/svm.c:4396:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
      arch/x86/kvm/mmu.c:4372:36: warning: this statement may fall through [-Wimplicit-fallthrough=]
      arch/x86/kvm/x86.c:3835:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
      arch/x86/kvm/x86.c:7938:23: warning: this statement may fall through [-Wimplicit-fallthrough=]
      arch/x86/kvm/vmx/vmx.c:2015:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
      arch/x86/kvm/vmx/vmx.c:1773:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
      
      Warning level 3 was used: -Wimplicit-fallthrough=3
      
      This patch is part of the ongoing efforts to enabling -Wimplicit-fallthrough.
      Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      b2869f28
    • Masahiro Yamada's avatar
      KVM: x86: fix TRACE_INCLUDE_PATH and remove -I. header search paths · 5cd5548f
      Masahiro Yamada authored
      The header search path -I. in kernel Makefiles is very suspicious;
      it allows the compiler to search for headers in the top of $(srctree),
      where obviously no header file exists.
      
      The reason of having -I. here is to make the incorrectly set
      TRACE_INCLUDE_PATH working.
      
      As the comment block in include/trace/define_trace.h says,
      TRACE_INCLUDE_PATH should be a relative path to the define_trace.h
      
      Fix the TRACE_INCLUDE_PATH, and remove the iffy include paths.
      Signed-off-by: default avatarMasahiro Yamada <yamada.masahiro@socionext.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      5cd5548f
    • Vitaly Kuznetsov's avatar
      KVM: selftests: check returned evmcs version range · 35b531a1
      Vitaly Kuznetsov authored
      Check that KVM_CAP_HYPERV_ENLIGHTENED_VMCS returns correct version range.
      Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      35b531a1
    • Vitaly Kuznetsov's avatar
      x86/kvm/hyper-v: nested_enable_evmcs() sets vmcs_version incorrectly · 3a2f5773
      Vitaly Kuznetsov authored
      Commit e2e871ab ("x86/kvm/hyper-v: Introduce nested_get_evmcs_version()
      helper") broke EVMCS enablement: to set vmcs_version we now call
      nested_get_evmcs_version() but this function checks
      enlightened_vmcs_enabled flag which is not yet set so we end up returning
      zero.
      
      Fix the issue by re-arranging things in nested_enable_evmcs().
      
      Fixes: e2e871ab ("x86/kvm/hyper-v: Introduce nested_get_evmcs_version() helper")
      Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      3a2f5773
    • Sean Christopherson's avatar
      KVM: VMX: Move vmx_vcpu_run()'s VM-Enter asm blob to a helper function · 5ad6ece8
      Sean Christopherson authored
      ...along with the function's STACK_FRAME_NON_STANDARD tag.  Moving the
      asm blob results in a significantly smaller amount of code that is
      marked with STACK_FRAME_NON_STANDARD, which makes it far less likely
      that gcc will split the function and trigger a spurious objtool warning.
      As a bonus, removing STACK_FRAME_NON_STANDARD from vmx_vcpu_run() allows
      the bulk of code to be properly checked by objtool.
      
      Because %rbp is not loaded via VMCS fields, vmx_vcpu_run() must manually
      save/restore the host's RBP and load the guest's RBP prior to calling
      vmx_vmenter().  Modifying %rbp triggers objtool's stack validation code,
      and so vmx_vcpu_run() is tagged with STACK_FRAME_NON_STANDARD since it's
      impossible to avoid modifying %rbp.
      
      Unfortunately, vmx_vcpu_run() is also a gigantic function that gcc will
      split into separate functions, e.g. so that pieces of the function can
      be inlined.  Splitting the function means that the compiled Elf file
      will contain one or more vmx_vcpu_run.part.* functions in addition to
      a vmx_vcpu_run function.  Depending on where the function is split,
      objtool may warn about a "call without frame pointer save/setup" in
      vmx_vcpu_run.part.* since objtool's stack validation looks for exact
      names when whitelisting functions tagged with STACK_FRAME_NON_STANDARD.
      
      Up until recently, the undesirable function splitting was effectively
      blocked because vmx_vcpu_run() was tagged with __noclone.  At the time,
      __noclone had an unintended side effect that put vmx_vcpu_run() into a
      separate optimization unit, which in turn prevented gcc from inlining
      the function (or any of its own function calls) and thus eliminated gcc's
      motivation to split the function.  Removing the __noclone attribute
      allowed gcc to optimize vmx_vcpu_run(), exposing the objtool warning.
      
      Kudos to Qian Cai for root causing that the fnsplit optimization is what
      caused objtool to complain.
      
      Fixes: 453eafbe ("KVM: VMX: Move VM-Enter + VM-Exit handling to non-inline sub-routines")
      Tested-by: default avatarQian Cai <cai@lca.pw>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Reported-by: default avatarkbuild test robot <lkp@intel.com>
      Signed-off-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      5ad6ece8
    • Ben Gardon's avatar
      kvm: selftests: Fix region overlap check in kvm_util · 94a980c3
      Ben Gardon authored
      Fix a call to userspace_mem_region_find to conform to its spec of
      taking an inclusive, inclusive range. It was previously being called
      with an inclusive, exclusive range. Also remove a redundant region bounds
      check in vm_userspace_mem_region_add. Region overlap checking is already
      performed by the call to userspace_mem_region_find.
      
      Tested: Compiled tools/testing/selftests/kvm with -static
      	Ran all resulting test binaries on an Intel Haswell test machine
      	All tests passed
      Signed-off-by: default avatarBen Gardon <bgardon@google.com>
      Reviewed-by: default avatarJim Mattson <jmattson@google.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      94a980c3