1. 10 Nov, 2017 5 commits
  2. 09 Nov, 2017 33 commits
    • Linus Torvalds's avatar
      Merge tag 'pm-final-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 3fefc318
      Linus Torvalds authored
      Pull final power management fixes from Rafael Wysocki:
       "These fix a regression in the schedutil cpufreq governor introduced by
        a recent change and blacklist Dell XPS13 9360 from using the Low Power
        S0 Idle _DSM interface which triggers serious problems on one of these
        machines.
      
        Specifics:
      
         - Prevent the schedutil cpufreq governor from using the utilization
           of a wrong CPU in some cases which started to happen after one of
           the recent changes in it (Chris Redpath).
      
         - Blacklist Dell XPS13 9360 from using the Low Power S0 Idle _DSM
           interface as that causes serious issue (related to NVMe) to appear
           on one of these machines, even though the other Dells XPS13 9360 in
           somewhat different HW configurations behave correctly (Rafael
           Wysocki)"
      
      * tag 'pm-final-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI / PM: Blacklist Low Power S0 Idle _DSM for Dell XPS13 9360
        cpufreq: schedutil: Examine the correct CPU when we update util
      3fefc318
    • Linus Torvalds's avatar
      Merge tag 'sound-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · d93d4ce1
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "The amount of the changes isn't as quite small as wished, nevertheless
        they are straight fixes that deserve merging to 4.14 final.
      
        Most of fixes are about ALSA core bugs spotted by fuzzer: a follow-up
        fix for the previous nested rwsem patch, a fix to avoid the resource
        hogs due to too many concurrent ALSA timer invocations, and a fix for
        a crash with SYSEX MIDI transfer over OSS sequencer emulation that is
        used by none but fuzzer.
      
        The rest are usual HD-audio and USB-audio device-specific quirks,
        which are safe to apply"
      
      * tag 'sound-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - fix headset mic problem for Dell machines with alc274
        ALSA: seq: Fix OSS sysex delivery in OSS emulation
        ALSA: seq: Avoid invalid lockdep class warning
        ALSA: timer: Limit max instances per timer
        ALSA: usb-audio: support new Amanero Combo384 firmware version
      d93d4ce1
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · d1041cdc
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix use-after-free in IPSEC input parsing, desintation address
          pointer was loaded before pskb_may_pull() which can change the SKB
          data pointers. From Florian Westphal.
      
       2) Stack out-of-bounds read in xfrm_state_find(), from Steffen
          Klassert.
      
       3) IPVS state of SKB is not properly reset when moving between
          namespaces, from Ye Yin.
      
       4) Fix crash in asix driver suspend and resume, from Andrey Konovalov.
      
       5) Don't deliver ipv6 l2tp tunnel packets to ipv4 l2tp tunnels, and
          vice versa, from Guillaume Nault.
      
       6) Fix DSACK undo on non-dup ACKs, from Priyaranjan Jha.
      
       7) Fix regression in bond_xmit_hash()'s behavior after the TCP port
          selection changes back in 4.2, from Hangbin Liu.
      
       8) Two divide by zero bugs in USB networking drivers when parsing
          descriptors, from Bjorn Mork.
      
       9) Fix bonding slaves being stuck in BOND_LINK_FAIL state, from Jay
          Vosburgh.
      
      10) Missing skb_reset_mac_header() in qmi_wwan, from Kristian Evensen.
      
      11) Fix the destruction of tc action object races properly, from Cong
          Wang.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (31 commits)
        cls_u32: use tcf_exts_get_net() before call_rcu()
        cls_tcindex: use tcf_exts_get_net() before call_rcu()
        cls_rsvp: use tcf_exts_get_net() before call_rcu()
        cls_route: use tcf_exts_get_net() before call_rcu()
        cls_matchall: use tcf_exts_get_net() before call_rcu()
        cls_fw: use tcf_exts_get_net() before call_rcu()
        cls_flower: use tcf_exts_get_net() before call_rcu()
        cls_flow: use tcf_exts_get_net() before call_rcu()
        cls_cgroup: use tcf_exts_get_net() before call_rcu()
        cls_bpf: use tcf_exts_get_net() before call_rcu()
        cls_basic: use tcf_exts_get_net() before call_rcu()
        net_sched: introduce tcf_exts_get_net() and tcf_exts_put_net()
        Revert "net_sched: hold netns refcnt for each action"
        net: usb: asix: fill null-ptr-deref in asix_suspend
        Revert "net: usb: asix: fill null-ptr-deref in asix_suspend"
        qmi_wwan: Add missing skb_reset_mac_header-call
        bonding: fix slave stuck in BOND_LINK_FAIL state
        qrtr: Move to postcore_initcall
        net: qmi_wwan: fix divide by 0 on bad descriptors
        net: cdc_ether: fix divide by 0 on bad descriptors
        ...
      d1041cdc
    • Hui Wang's avatar
      ALSA: hda - fix headset mic problem for Dell machines with alc274 · 75ee94b2
      Hui Wang authored
      Confirmed with Kailang of Realtek, the pin 0x19 is for Headset Mic, and
      the pin 0x1a is for Headphone Mic, he suggested to apply
      ALC269_FIXUP_DELL1_MIC_NO_PRESENCE to fix this problem. And we
      verified applying this FIXUP can fix this problem.
      
      Cc: <stable@vger.kernel.org>
      Cc: Kailang Yang <kailang@realtek.com>
      Signed-off-by: default avatarHui Wang <hui.wang@canonical.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      75ee94b2
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec · 6a172802
      David S. Miller authored
      Steffen Klassert says:
      
      ====================
      pull request (net): ipsec 2017-11-09
      
      1) Fix a use after free due to a reallocated skb head.
         From Florian Westphal.
      
      2) Fix sporadic lookup failures on labeled IPSEC.
         From Florian Westphal.
      
      3) Fix a stack out of bounds when a socket policy is applied
         to an IPv6 socket that sends IPv4 packets.
      
      Please pull or let me know if there are problems.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6a172802
    • David S. Miller's avatar
      Merge branch 'net-sched-race-fix' · 623859ae
      David S. Miller authored
      Cong Wang says:
      
      ====================
      net_sched: close the race between call_rcu() and cleanup_net()
      
      This patchset tries to fix the race between call_rcu() and
      cleanup_net() again. Without holding the netns refcnt the
      tc_action_net_exit() in netns workqueue could be called before
      filter destroy works in tc filter workqueue. This patchset
      moves the netns refcnt from tc actions to tcf_exts, without
      breaking per-netns tc actions.
      
      Patch 1 reverts the previous fix, patch 2 introduces two new
      API's to help to address the bug and the rest patches switch
      to the new API's. Please see each patch for details.
      
      I was not able to reproduce this bug, but now after adding
      some delay in filter destroy work I manage to trigger the
      crash. After this patchset, the crash is not reproducible
      any more and the debugging printk's show the order is expected
      too.
      ====================
      
      Fixes: ddf97ccd ("net_sched: add network namespace support for tc actions")
      Reported-by: default avatarLucas Bates <lucasb@mojatatu.com>
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      623859ae
    • Cong Wang's avatar
      cls_u32: use tcf_exts_get_net() before call_rcu() · 35c55fc1
      Cong Wang authored
      Hold netns refcnt before call_rcu() and release it after
      the tcf_exts_destroy() is done.
      
      Note, on ->destroy() path we have to respect the return value
      of tcf_exts_get_net(), on other paths it should always return
      true, so we don't need to care.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      35c55fc1
    • Cong Wang's avatar
      cls_tcindex: use tcf_exts_get_net() before call_rcu() · f2b75105
      Cong Wang authored
      Hold netns refcnt before call_rcu() and release it after
      the tcf_exts_destroy() is done.
      
      Note, on ->destroy() path we have to respect the return value
      of tcf_exts_get_net(), on other paths it should always return
      true, so we don't need to care.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f2b75105
    • Cong Wang's avatar
      cls_rsvp: use tcf_exts_get_net() before call_rcu() · 96585063
      Cong Wang authored
      Hold netns refcnt before call_rcu() and release it after
      the tcf_exts_destroy() is done.
      
      Note, on ->destroy() path we have to respect the return value
      of tcf_exts_get_net(), on other paths it should always return
      true, so we don't need to care.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      96585063
    • Cong Wang's avatar
      cls_route: use tcf_exts_get_net() before call_rcu() · 3fd51de5
      Cong Wang authored
      Hold netns refcnt before call_rcu() and release it after
      the tcf_exts_destroy() is done.
      
      Note, on ->destroy() path we have to respect the return value
      of tcf_exts_get_net(), on other paths it should always return
      true, so we don't need to care.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3fd51de5
    • Cong Wang's avatar
      cls_matchall: use tcf_exts_get_net() before call_rcu() · 57767e78
      Cong Wang authored
      Hold netns refcnt before call_rcu() and release it after
      the tcf_exts_destroy() is done.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      57767e78
    • Cong Wang's avatar
      cls_fw: use tcf_exts_get_net() before call_rcu() · d5f984f5
      Cong Wang authored
      Hold netns refcnt before call_rcu() and release it after
      the tcf_exts_destroy() is done.
      
      Note, on ->destroy() path we have to respect the return value
      of tcf_exts_get_net(), on other paths it should always return
      true, so we don't need to care.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d5f984f5
    • Cong Wang's avatar
      cls_flower: use tcf_exts_get_net() before call_rcu() · 0dadc117
      Cong Wang authored
      Hold netns refcnt before call_rcu() and release it after
      the tcf_exts_destroy() is done.
      
      Note, on ->destroy() path we have to respect the return value
      of tcf_exts_get_net(), on other paths it should always return
      true, so we don't need to care.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0dadc117
    • Cong Wang's avatar
      cls_flow: use tcf_exts_get_net() before call_rcu() · 22f7cec9
      Cong Wang authored
      Hold netns refcnt before call_rcu() and release it after
      the tcf_exts_destroy() is done.
      
      Note, on ->destroy() path we have to respect the return value
      of tcf_exts_get_net(), on other paths it should always return
      true, so we don't need to care.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      22f7cec9
    • Cong Wang's avatar
      cls_cgroup: use tcf_exts_get_net() before call_rcu() · ed148168
      Cong Wang authored
      Hold netns refcnt before call_rcu() and release it after
      the tcf_exts_destroy() is done.
      
      Note, on ->destroy() path we have to respect the return value
      of tcf_exts_get_net(), on other paths it should always return
      true, so we don't need to care.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ed148168
    • Cong Wang's avatar
      cls_bpf: use tcf_exts_get_net() before call_rcu() · aae2c35e
      Cong Wang authored
      Hold netns refcnt before call_rcu() and release it after
      the tcf_exts_destroy() is done.
      
      Note, on ->destroy() path we have to respect the return value
      of tcf_exts_get_net(), on other paths it should always return
      true, so we don't need to care.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      aae2c35e
    • Cong Wang's avatar
      cls_basic: use tcf_exts_get_net() before call_rcu() · 0b2a5989
      Cong Wang authored
      Hold netns refcnt before call_rcu() and release it after
      the tcf_exts_destroy() is done.
      
      Note, on ->destroy() path we have to respect the return value
      of tcf_exts_get_net(), on other paths it should always return
      true, so we don't need to care.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0b2a5989
    • Cong Wang's avatar
      net_sched: introduce tcf_exts_get_net() and tcf_exts_put_net() · e4b95c41
      Cong Wang authored
      Instead of holding netns refcnt in tc actions, we can minimize
      the holding time by saving it in struct tcf_exts instead. This
      means we can just hold netns refcnt right before call_rcu() and
      release it after tcf_exts_destroy() is done.
      
      However, because on netns cleanup path we call tcf_proto_destroy()
      too, obviously we can not hold netns for a zero refcnt, in this
      case we have to do cleanup synchronously. It is fine for RCU too,
      the caller cleanup_net() already waits for a grace period.
      
      For other cases, refcnt is non-zero and we can safely grab it as
      normal and release it after we are done.
      
      This patch provides two new API for each filter to use:
      tcf_exts_get_net() and tcf_exts_put_net(). And all filters now can
      use the following pattern:
      
      void __destroy_filter() {
        tcf_exts_destroy();
        tcf_exts_put_net();  // <== release netns refcnt
        kfree();
      }
      void some_work() {
        rtnl_lock();
        __destroy_filter();
        rtnl_unlock();
      }
      void some_rcu_callback() {
        tcf_queue_work(some_work);
      }
      
      if (tcf_exts_get_net())  // <== hold netns refcnt
        call_rcu(some_rcu_callback);
      else
        __destroy_filter();
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e4b95c41
    • Cong Wang's avatar
      Revert "net_sched: hold netns refcnt for each action" · c7e460ce
      Cong Wang authored
      This reverts commit ceffcc5e.
      If we hold that refcnt, the netns can never be destroyed until
      all actions are destroyed by user, this breaks our netns design
      which we expect all actions are destroyed when we destroy the
      whole netns.
      
      Cc: Lucas Bates <lucasb@mojatatu.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c7e460ce
    • David S. Miller's avatar
      Merge branch 'dsa-setup-stage' · 19aeeb9f
      David S. Miller authored
      Vivien Didelot says:
      
      ====================
      net: dsa: setup stage
      
      When probing a DSA switch, there is basically two stages.
      
      The first stage is the parsing of the switch device, from either device
      tree or platform data. It fetches the DSA tree to which it belongs, and
      validates its ports. The switch device is then added to the tree, and
      the second stage is called if this was the last switch of the tree.
      
      The second stage is the setup of the tree, which validates that the tree
      is complete, sets up the routing tables, the default CPU port for user
      ports, sets up the switch drivers and finally the master interfaces,
      which makes the whole switch fabric functional.
      
      This patch series covers the second setup stage. The setup and teardown
      of a switch tree have been separated into logical steps, and the probing
      of a switch now simply parses and adds a switch to a tree.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      19aeeb9f
    • Vivien Didelot's avatar
      net: dsa: rename probe and remove switch functions · b4fbb347
      Vivien Didelot authored
      This commit brings no functional changes. It gets rid of the underscore
      prefixed _dsa_register_switch and _dsa_unregister_switch functions in
      favor of dsa_switch_probe() which parses and adds a switch to a tree and
      dsa_switch_remove() which removes a switch from a tree.
      Signed-off-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b4fbb347
    • Vivien Didelot's avatar
      net: dsa: setup a tree when adding a switch to it · 30817354
      Vivien Didelot authored
      Now that the tree setup is centralized, we can simplify the code a bit
      more by setting up or tearing down the tree directly when adding or
      removing a switch to/from it.
      Signed-off-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      30817354
    • Vivien Didelot's avatar
      net: dsa: setup routing table · 34c09a89
      Vivien Didelot authored
      The *_complete() functions take too much arguments to do only one thing:
      they try to fetch the dsa_port structures corresponding to device nodes
      under the "link" list property of DSA ports, and use them to setup the
      routing table of switches.
      
      This patch simplifies them by providing instead simpler
      dsa_{port,switch,tree}_setup_routing_table functions which return a
      boolean value, true if the tree is complete.
      
      dsa_tree_setup_routing_table is called inside dsa_tree_setup which
      simplifies the switch registering function as well.
      
      A switch's routing table is now initialized before its setup.
      
      This also makes dsa_port_is_valid obsolete, remove it.
      Signed-off-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      34c09a89
    • Vivien Didelot's avatar
      net: dsa: use of_for_each_phandle · c5286665
      Vivien Didelot authored
      The OF code provides a of_for_each_phandle() helper to iterate over
      phandles. Use it instead of arbitrary iterating ourselves over the list
      of phandles hanging to the "link" property of the port's device node.
      
      The of_phandle_iterator_next() helper calls of_node_put() itself on
      it.node. Thus We must only do it ourselves if we break the loop.
      Signed-off-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c5286665
    • Vivien Didelot's avatar
      net: dsa: add find port by node helper · f163da88
      Vivien Didelot authored
      Instead of having two dsa_ds_find_port_dn (which returns a bool) and
      dsa_dst_find_port_dn (which returns a switch) functions, provide a more
      explicit dsa_tree_find_port_by_node function which returns a matching
      port.
      Signed-off-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f163da88
    • Vivien Didelot's avatar
      net: dsa: setup and teardown ports · 1d27732f
      Vivien Didelot authored
      The dsa_dsa_port_apply and dsa_cpu_port_apply functions do exactly the
      same. The dsa_user_port_apply function does not try to register a fixed
      link but try to create a slave.
      
      This commit factorizes and scopes all that in two convenient
      dsa_port_setup and dsa_port_teardown functions.
      
      It won't hurt to register a devlink_port for unused port as well.
      Signed-off-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1d27732f
    • Vivien Didelot's avatar
      net: dsa: setup and teardown switches · 1f08f9e9
      Vivien Didelot authored
      This patches brings no functional changes. It removes the unused dst
      argument from the dsa_ds_apply and dsa_ds_unapply functions, rename them
      to dsa_switch_setup and dsa_switch_teardown for a more explicit scope.
      
      This clarifies the steps of the setup or teardown of a switch fabric.
      Signed-off-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1f08f9e9
    • Vivien Didelot's avatar
      net: dsa: setup and teardown tree · ec15dd42
      Vivien Didelot authored
      This commit provides better scope for the DSA tree setup and teardown
      functions. It renames the "applied" bool to "setup" and print a message
      when the tree is setup, as it is done during teardown.
      
      At the same time, check dst->setup in dsa_tree_setup, where it is set to
      true.
      Signed-off-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ec15dd42
    • Vivien Didelot's avatar
      net: dsa: setup and teardown master device · 17a22fcf
      Vivien Didelot authored
      Add DSA helpers to setup and teardown a master net device wired to its
      CPU port. This centralizes the dsa_ptr assignment.
      
      This also makes the master ethtool helpers static at the same time.
      Signed-off-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      17a22fcf
    • Vivien Didelot's avatar
      net: dsa: setup and teardown default CPU port · f070464c
      Vivien Didelot authored
      The dsa_dst_parse function called just before dsa_dst_apply does not
      parse the tree but does only one thing: it assigns the default CPU port
      to dst->cpu_dp and to each user ports.
      
      This patch simplifies this by calling a dsa_tree_setup_default_cpu
      function at the beginning of dsa_dst_apply directly.
      
      A dsa_port_is_user helper is added for convenience.
      Signed-off-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f070464c
    • Vivien Didelot's avatar
      net: dsa: constify cpu_dp member of dsa_port · 24a9332a
      Vivien Didelot authored
      A DSA port has a dedicated CPU port assigned to it, stored in the cpu_dp
      member. It is not meant to be modified by a port, thus make it const.
      Signed-off-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      24a9332a
    • Andrey Konovalov's avatar
      net: usb: asix: fill null-ptr-deref in asix_suspend · 8f562462
      Andrey Konovalov authored
      When asix_suspend() is called dev->driver_priv might not have been
      assigned a value, so we need to check that it's not NULL.
      
      Similar issue is present in asix_resume(), this patch fixes it as well.
      
      Found by syzkaller.
      
      kasan: CONFIG_KASAN_INLINE enabled
      kasan: GPF could be caused by NULL-ptr deref or user memory access
      general protection fault: 0000 [#1] PREEMPT SMP KASAN
      Modules linked in:
      CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc4-43422-geccacdd69a8c #400
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
      Workqueue: usb_hub_wq hub_event
      task: ffff88006bb36300 task.stack: ffff88006bba8000
      RIP: 0010:asix_suspend+0x76/0xc0 drivers/net/usb/asix_devices.c:629
      RSP: 0018:ffff88006bbae718 EFLAGS: 00010202
      RAX: dffffc0000000000 RBX: ffff880061ba3b80 RCX: 1ffff1000c34d644
      RDX: 0000000000000001 RSI: 0000000000000402 RDI: 0000000000000008
      RBP: ffff88006bbae738 R08: 1ffff1000d775cad R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800630a8b40
      R13: 0000000000000000 R14: 0000000000000402 R15: ffff880061ba3b80
      FS:  0000000000000000(0000) GS:ffff88006c600000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007ff33cf89000 CR3: 0000000061c0a000 CR4: 00000000000006f0
      Call Trace:
       usb_suspend_interface drivers/usb/core/driver.c:1209
       usb_suspend_both+0x27f/0x7e0 drivers/usb/core/driver.c:1314
       usb_runtime_suspend+0x41/0x120 drivers/usb/core/driver.c:1852
       __rpm_callback+0x339/0xb60 drivers/base/power/runtime.c:334
       rpm_callback+0x106/0x220 drivers/base/power/runtime.c:461
       rpm_suspend+0x465/0x1980 drivers/base/power/runtime.c:596
       __pm_runtime_suspend+0x11e/0x230 drivers/base/power/runtime.c:1009
       pm_runtime_put_sync_autosuspend ./include/linux/pm_runtime.h:251
       usb_new_device+0xa37/0x1020 drivers/usb/core/hub.c:2487
       hub_port_connect drivers/usb/core/hub.c:4903
       hub_port_connect_change drivers/usb/core/hub.c:5009
       port_event drivers/usb/core/hub.c:5115
       hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195
       process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119
       worker_thread+0x221/0x1850 kernel/workqueue.c:2253
       kthread+0x3a1/0x470 kernel/kthread.c:231
       ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
      Code: 8d 7c 24 20 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5b 48 b8 00 00
      00 00 00 fc ff df 4d 8b 6c 24 20 49 8d 7d 08 48 89 fa 48 c1 ea 03 <80>
      3c 02 00 75 34 4d 8b 6d 08 4d 85 ed 74 0b e8 26 2b 51 fd 4c
      RIP: asix_suspend+0x76/0xc0 RSP: ffff88006bbae718
      ---[ end trace dfc4f5649284342c ]---
      Signed-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8f562462
    • David S. Miller's avatar
      Revert "net: usb: asix: fill null-ptr-deref in asix_suspend" · 1a8e6b48
      David S. Miller authored
      This reverts commit baedf68a.
      
      There is an updated version of this fix which covers
      the problem more thoroughly.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1a8e6b48
  3. 08 Nov, 2017 2 commits
    • Rafael J. Wysocki's avatar
      Merge branch 'pm-cpufreq-sched' · e029b9bf
      Rafael J. Wysocki authored
      * pm-cpufreq-sched:
        cpufreq: schedutil: Examine the correct CPU when we update util
      e029b9bf
    • Jiri Kosina's avatar
      x86/mm: Unbreak modules that rely on external PAGE_KERNEL availability · 87df2617
      Jiri Kosina authored
      Commit 7744ccdb ("x86/mm: Add Secure Memory Encryption (SME)
      support") as a side-effect made PAGE_KERNEL all of a sudden unavailable
      to modules which can't make use of EXPORT_SYMBOL_GPL() symbols.
      
      This is because once SME is enabled, sme_me_mask (which is introduced as
      EXPORT_SYMBOL_GPL) makes its way to PAGE_KERNEL through _PAGE_ENC,
      causing imminent build failure for all the modules which make use of all
      the EXPORT-SYMBOL()-exported API (such as vmap(), __vmalloc(),
      remap_pfn_range(), ...).
      
      Exporting (as EXPORT_SYMBOL()) interfaces (and having done so for ages)
      that take pgprot_t argument, while making it impossible to -- all of a
      sudden -- pass PAGE_KERNEL to it, feels rather incosistent.
      
      Restore the original behavior and make it possible to pass PAGE_KERNEL
      to all its EXPORT_SYMBOL() consumers.
      
      [ This is all so not wonderful. We shouldn't need that "sme_me_mask"
        access at all in all those places that really don't care about that
        level of detail, and just want _PAGE_KERNEL or whatever.
      
        We have some similar issues with _PAGE_CACHE_WP and _PAGE_NOCACHE,
        both of which hide a "cachemode2protval()" call, and which also ends
        up using another EXPORT_SYMBOL(), but at least that only triggers for
        the much more rare cases.
      
        Maybe we could move these dynamic page table bits to be generated much
        deeper down in the VM layer, instead of hiding them in the macros that
        everybody uses.
      
        So this all would merit some cleanup. But not today.   - Linus ]
      
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Despised-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      87df2617