1. 09 Apr, 2016 7 commits
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · fb41b4be
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "This is a set of eight fixes.
      
        Two are trivial gcc-6 updates (brace additions and unused variable
        removal).  There's a couple of cxlflash regressions, a correction for
        sd being overly chatty on revalidation (causing excess log increases).
        A VPD issue which could crash USB devices because they seem very
        intolerant to VPD inquiries, an ALUA deadlock fix and a mpt3sas buffer
        overrun fix"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: Do not attach VPD to devices that don't support it
        sd: Fix excessive capacity printing on devices with blocks bigger than 512 bytes
        scsi_dh_alua: Fix a recently introduced deadlock
        scsi: Declare local symbols static
        cxlflash: Move to exponential back-off when cmd_room is not available
        cxlflash: Fix regression issue with re-ordering patch
        mpt3sas: Don't overreach ioc->reply_post[] during initialization
        aacraid: add missing curly braces
      fb41b4be
    • Linus Torvalds's avatar
      Merge tag 'md/4.6-rc2-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md · 63b106a8
      Linus Torvalds authored
      Pull MD fixes from Shaohua Li:
       "This update mainly fixes bugs:
      
         - fix error handling (Guoqing)
         - fix a crash when a disk is hotremoved (me)
         - fix a dead loop (Wei Fang)"
      
      * tag 'md/4.6-rc2-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
        md/bitmap: clear bitmap if bitmap_create failed
        MD: add rdev reference for super write
        md: fix a trivial typo in comments
        md:raid1: fix a dead loop when read from a WriteMostly disk
      63b106a8
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 40bca9db
      Linus Torvalds authored
      Pull power management and ACPI fixes from Rafael Wysocki:
       "Fixes for some issues discovered after recent changes and for some
        that have just been found lately regardless of those changes
        (intel_pstate, intel_idle, PM core, mailbox/pcc, turbostat) plus
        support for some new CPU models (intel_idle, Intel RAPL driver,
        turbostat) and documentation updates (intel_pstate, PM core).
      
        Specifics:
      
         - intel_pstate fixes for two issues exposed by the recent switch over
           from using timers and for one issue introduced during the 4.4 cycle
           plus new comments describing data structures used by the driver
           (Rafael Wysocki, Srinivas Pandruvada).
      
         - intel_idle fixes related to CPU offline/online (Richard Cochran).
      
         - intel_idle support (new CPU IDs and state definitions mostly) for
           Skylake-X and Kabylake processors (Len Brown).
      
         - PCC mailbox driver fix for an out-of-bounds memory access that may
           cause the kernel to panic() (Shanker Donthineni).
      
         - New (missing) CPU ID for one apparently overlooked Haswell model in
           the Intel RAPL power capping driver (Srinivas Pandruvada).
      
         - Fix for the PM core's wakeup IRQs framework to make it work after
           wakeup settings reconfiguration from sysfs (Grygorii Strashko).
      
         - Runtime PM documentation update to make it describe what needs to
           be done during device removal more precisely (Krzysztof Kozlowski).
      
         - Stale comment removal cleanup in the cpufreq-dt driver (Viresh
           Kumar).
      
         - turbostat utility fixes and support for Broxton, Skylake-X and
           Kabylake processors (Len Brown)"
      
      * tag 'pm+acpi-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (28 commits)
        PM / wakeirq: fix wakeirq setting after wakup re-configuration from sysfs
        tools/power turbostat: work around RC6 counter wrap
        tools/power turbostat: initial KBL support
        tools/power turbostat: initial SKX support
        tools/power turbostat: decode BXT TSC frequency via CPUID
        tools/power turbostat: initial BXT support
        tools/power turbostat: print IRTL MSRs
        tools/power turbostat: SGX state should print only if --debug
        intel_idle: Add KBL support
        intel_idle: Add SKX support
        intel_idle: Clean up all registered devices on exit.
        intel_idle: Propagate hot plug errors.
        intel_idle: Don't overreact to a cpuidle registration failure.
        intel_idle: Setup the timer broadcast only on successful driver load.
        intel_idle: Avoid a double free of the per-CPU data.
        intel_idle: Fix dangling registration on error path.
        intel_idle: Fix deallocation order on the driver exit path.
        intel_idle: Remove redundant initialization calls.
        intel_idle: Fix a helper function's return value.
        intel_idle: remove useless return from void function.
        ...
      40bca9db
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 9ef11ceb
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Stale SKB data pointer access across pskb_may_pull() calls in L2TP,
          from Haishuang Yan.
      
       2) Fix multicast frame handling in mac80211 AP code, from Felix
          Fietkau.
      
       3) mac80211 station hashtable insert errors not handled properly, fix
          from Johannes Berg.
      
       4) Fix TX descriptor count limit handling in e1000, from Alexander
          Duyck.
      
       5) Revert a buggy netdev refcount fix in netpoll, from Bjorn Helgaas.
      
       6) Must assign rtnl_link_ops of the device before registering it, fix
          in ip6_tunnel from Thadeu Lima de Souza Cascardo.
      
       7) Memory leak fix in tc action net exit, from WANG Cong.
      
       8) Add missing AF_KCM entries to name tables, from Dexuan Cui.
      
       9) Fix regression in GRE handling of csums wrt.  FOU, from Alexander
          Duyck.
      
      10) Fix memory allocation alignment and congestion map corruption in
          RDS, from Shamir Rabinovitch.
      
      11) Fix default qdisc regression in tuntap driver, from Jason Wang.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits)
        bridge, netem: mark mailing lists as moderated
        tuntap: restore default qdisc
        mpls: find_outdev: check for err ptr in addition to NULL check
        ipv6: Count in extension headers in skb->network_header
        RDS: fix congestion map corruption for PAGE_SIZE > 4k
        RDS: memory allocated must be align to 8
        GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU
        net: add the AF_KCM entries to family name tables
        MAINTAINERS: intel-wired-lan list is moderated
        lib/test_bpf: Add additional BPF_ADD tests
        lib/test_bpf: Add test to check for result of 32-bit add that overflows
        lib/test_bpf: Add tests for unsigned BPF_JGT
        lib/test_bpf: Fix JMP_JSET tests
        VSOCK: Detach QP check should filter out non matching QPs.
        stmmac: fix adjust link call in case of a switch is attached
        af_packet: tone down the Tx-ring unsupported spew.
        net_sched: fix a memory leak in tc action
        samples/bpf: Enable powerpc support
        samples/bpf: Use llc in PATH, rather than a hardcoded value
        samples/bpf: Fix build breakage with map_perf_test_user.c
        ...
      9ef11ceb
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 839a3f76
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "These are bug fixes, including a really old fsync bug, and a few trace
        points to help us track down problems in the quota code"
      
      * 'for-linus-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: fix file/data loss caused by fsync after rename and new inode
        btrfs: Reset IO error counters before start of device replacing
        btrfs: Add qgroup tracing
        Btrfs: don't use src fd for printk
        btrfs: fallback to vmalloc in btrfs_compare_tree
        btrfs: handle non-fatal errors in btrfs_qgroup_inherit()
        btrfs: Output more info for enospc_debug mount option
        Btrfs: fix invalid reference in replace_path
        Btrfs: Improve FL_KEEP_SIZE handling in fallocate
      839a3f76
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.6-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux · 67592126
      Linus Torvalds authored
      Pull orangefs fixes from Mike Marshall:
       "Orangefs cleanups and a strncpy vulnerability fix.
      
        Cleanups:
         - remove an unused variable from orangefs_readdir.
         - clean up printk wrapper used for ofs "gossip" debugging.
         - clean up truncate ctime and mtime setting in inode.c
         - remove a useless null check found by coccinelle.
         - optimize some memcpy/memset boilerplate code.
         - remove some useless sanity checks from xattr.c
      
        Fix:
         - fix a potential strncpy vulnerability"
      
      * tag 'for-linus-4.6-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux:
        orangefs: remove unused variable
        orangefs: Add KERN_<LEVEL> to gossip_<level> macros
        orangefs: strncpy -> strscpy
        orangefs: clean up truncate ctime and mtime setting
        Orangefs: fix ifnullfree.cocci warnings
        Orangefs: optimize boilerplate code.
        Orangefs: xattr.c cleanup
      67592126
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v4.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 1a59c539
      Linus Torvalds authored
      Pull IOMMU fixes from Joerg Roedel:
      
       - compile-time fixes (warnings and failures)
      
       - a bug in iommu core code which could cause the group->domain pointer
         to be falsly cleared
      
       - fix in scatterlist handling of the ARM common DMA-API code
      
       - stall detection fix for the Rockchip IOMMU driver
      
      * tag 'iommu-fixes-v4.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        iommu/vt-d: Silence an uninitialized variable warning
        iommu/rockchip: Fix "is stall active" check
        iommu: Don't overwrite domain pointer when there is no default_domain
        iommu/dma: Restore scatterlist offsets correctly
        iommu: provide of_xlate pointer unconditionally
      1a59c539
  2. 08 Apr, 2016 16 commits
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2016-04-06' of... · 30d237a6
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2016-04-06' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      For the current RC series, we have the following fixes:
       * TDLS fixes from Arik and Ilan
       * rhashtable fixes from Ben and myself
       * documentation fixes from Luis
       * U-APSD fixes from Emmanuel
       * a TXQ fix from Felix
       * and a compiler warning suppression from Jeff
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      30d237a6
    • stephen hemminger's avatar
      bridge, netem: mark mailing lists as moderated · 3430284f
      stephen hemminger authored
      I moderate these (lightly loaded) lists to block spam.
      Signed-off-by: default avatarStephen Hemminger <stephen@networkplumber.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3430284f
    • Jason Wang's avatar
      tuntap: restore default qdisc · 016adb72
      Jason Wang authored
      After commit f84bb1ea ("net: fix IFF_NO_QUEUE for drivers using
      alloc_netdev"), default qdisc was changed to noqueue because
      tuntap does not set tx_queue_len during .setup(). This patch restores
      default qdisc by setting tx_queue_len in tun_setup().
      
      Fixes: f84bb1ea ("net: fix IFF_NO_QUEUE for drivers using alloc_netdev")
      Cc: Phil Sutter <phil@nwl.cc>
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Acked-by: default avatarPhil Sutter <phil@nwl.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      016adb72
    • Martin Brandenburg's avatar
      e56f4981
    • Rafael J. Wysocki's avatar
      Merge branches 'pm-core', 'powercap' and 'pm-tools' · 73659be7
      Rafael J. Wysocki authored
      * pm-core:
        PM / wakeirq: fix wakeirq setting after wakup re-configuration from sysfs
        PM / runtime: Document steps for device removal
      
      * powercap:
        powercap: intel_rapl: Add missing Haswell model
      
      * pm-tools:
        tools/power turbostat: work around RC6 counter wrap
        tools/power turbostat: initial KBL support
        tools/power turbostat: initial SKX support
        tools/power turbostat: decode BXT TSC frequency via CPUID
        tools/power turbostat: initial BXT support
        tools/power turbostat: print IRTL MSRs
        tools/power turbostat: SGX state should print only if --debug
      73659be7
    • Rafael J. Wysocki's avatar
      Merge branches 'pm-cpufreq', 'pm-cpuidle' and 'acpi-cppc' · fa81e66e
      Rafael J. Wysocki authored
      * pm-cpufreq:
        cpufreq: dt: Drop stale comment
        cpufreq: intel_pstate: Documenation for structures
        cpufreq: intel_pstate: fix inconsistency in setting policy limits
        intel_pstate: Avoid extra invocation of intel_pstate_sample()
        intel_pstate: Do not set utilization update hook too early
      
      * pm-cpuidle:
        intel_idle: Add KBL support
        intel_idle: Add SKX support
        intel_idle: Clean up all registered devices on exit.
        intel_idle: Propagate hot plug errors.
        intel_idle: Don't overreact to a cpuidle registration failure.
        intel_idle: Setup the timer broadcast only on successful driver load.
        intel_idle: Avoid a double free of the per-CPU data.
        intel_idle: Fix dangling registration on error path.
        intel_idle: Fix deallocation order on the driver exit path.
        intel_idle: Remove redundant initialization calls.
        intel_idle: Fix a helper function's return value.
        intel_idle: remove useless return from void function.
      
      * acpi-cppc:
        mailbox: pcc: Don't access an unmapped memory address space
      fa81e66e
    • Joe Perches's avatar
      orangefs: Add KERN_<LEVEL> to gossip_<level> macros · 1917a693
      Joe Perches authored
      Emit the logging messages at the appropriate levels.
      
      Miscellanea:
      
      o Change format to fmt
      o Use the more common ##__VA_ARGS__
      Signed-off-by: default avatarJoe Perches <joe@perches.com>
      Signed-off-by: default avatarMike Marshall <hubcap@omnibond.com>
      1917a693
    • Martin Brandenburg's avatar
      orangefs: strncpy -> strscpy · 2eacea74
      Martin Brandenburg authored
      It would have been possible for a rogue client-core to send in a symlink
      target which is not NUL terminated. This returns EIO if the client-core
      gives us corrupt data.
      
      Leave debugfs and superblock code as is for now.
      
      Other dcache.c and namei.c strncpy instances are safe because
      ORANGEFS_NAME_MAX = NAME_MAX + 1; there is always enough space for a
      name plus a NUL byte.
      Signed-off-by: default avatarMartin Brandenburg <martin@omnibond.com>
      Signed-off-by: default avatarMike Marshall <hubcap@omnibond.com>
      2eacea74
    • Martin Brandenburg's avatar
      orangefs: clean up truncate ctime and mtime setting · f83140c1
      Martin Brandenburg authored
      The ctime and mtime are always updated on a successful ftruncate and
      only updated on a successful truncate where the size changed.
      
      We handle the ``if the size changed'' bit.
      
      This matches FUSE's behavior.
      Signed-off-by: default avatarMartin Brandenburg <martin@omnibond.com>
      Signed-off-by: default avatarMike Marshall <hubcap@omnibond.com>
      f83140c1
    • kbuild test robot's avatar
      Orangefs: fix ifnullfree.cocci warnings · 2fa37fd7
      kbuild test robot authored
      fs/orangefs/orangefs-debugfs.c:130:2-26: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values.
      
       NULL check before some freeing functions is not needed.
      
       Based on checkpatch warning
       "kfree(NULL) is safe this check is probably not required"
       and kfreeaddr.cocci by Julia Lawall.
      
      Generated by: scripts/coccinelle/free/ifnullfree.cocci
      Signed-off-by: default avatarFengguang Wu <fengguang.wu@intel.com>
      Signed-off-by: default avatarMike Marshall <hubcap@omnibond.com>
      2fa37fd7
    • Mike Marshall's avatar
      Orangefs: optimize boilerplate code. · a9bb3ba8
      Mike Marshall authored
      Suggested by David Binderman <dcb314@hotmail.com>
      The former can potentially be a performance win over the latter.
      
      memcpy(d, s, len);
      memset(d+len, c, size-len);
      
      memset(d, c, size);
      memcpy(d, s, len);
      Signed-off-by: default avatarMike Marshall <hubcap@omnibond.com>
      a9bb3ba8
    • Mike Marshall's avatar
      Orangefs: xattr.c cleanup · 2d09a2ca
      Mike Marshall authored
      1. It is nonsense to test for negative size_t, suggested by
         David Binderman <dcb314@hotmail.com>
      
      2. By the time Orangefs gets called, the vfs has ensured that
         name != NULL, and that buffer and size are sane.
      Signed-off-by: default avatarMike Marshall <hubcap@omnibond.com>
      2d09a2ca
    • Roopa Prabhu's avatar
      mpls: find_outdev: check for err ptr in addition to NULL check · 94a57f1f
      Roopa Prabhu authored
      find_outdev calls inet{,6}_fib_lookup_dev() or dev_get_by_index() to
      find the output device. In case of an error, inet{,6}_fib_lookup_dev()
      returns error pointer and dev_get_by_index() returns NULL. But the function
      only checks for NULL and thus can end up calling dev_put on an ERR_PTR.
      This patch adds an additional check for err ptr after the NULL check.
      
      Before: Trying to add an mpls route with no oif from user, no available
      path to 10.1.1.8 and no default route:
      $ip -f mpls route add 100 as 200 via inet 10.1.1.8
      [  822.337195] BUG: unable to handle kernel NULL pointer dereference at
      00000000000003a3
      [  822.340033] IP: [<ffffffff8148781e>] mpls_nh_assign_dev+0x10b/0x182
      [  822.340033] PGD 1db38067 PUD 1de9e067 PMD 0
      [  822.340033] Oops: 0000 [#1] SMP
      [  822.340033] Modules linked in:
      [  822.340033] CPU: 0 PID: 11148 Comm: ip Not tainted 4.5.0-rc7+ #54
      [  822.340033] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
      BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org
      04/01/2014
      [  822.340033] task: ffff88001db82580 ti: ffff88001dad4000 task.ti:
      ffff88001dad4000
      [  822.340033] RIP: 0010:[<ffffffff8148781e>]  [<ffffffff8148781e>]
      mpls_nh_assign_dev+0x10b/0x182
      [  822.340033] RSP: 0018:ffff88001dad7a88  EFLAGS: 00010282
      [  822.340033] RAX: ffffffffffffff9b RBX: ffffffffffffff9b RCX:
      0000000000000002
      [  822.340033] RDX: 00000000ffffff9b RSI: 0000000000000008 RDI:
      0000000000000000
      [  822.340033] RBP: ffff88001ddc9ea0 R08: ffff88001e9f1768 R09:
      0000000000000000
      [  822.340033] R10: ffff88001d9c1100 R11: ffff88001e3c89f0 R12:
      ffffffff8187e0c0
      [  822.340033] R13: ffffffff8187e0c0 R14: ffff88001ddc9e80 R15:
      0000000000000004
      [  822.340033] FS:  00007ff9ed798700(0000) GS:ffff88001fc00000(0000)
      knlGS:0000000000000000
      [  822.340033] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  822.340033] CR2: 00000000000003a3 CR3: 000000001de89000 CR4:
      00000000000006f0
      [  822.340033] Stack:
      [  822.340033]  0000000000000000 0000000100000000 0000000000000000
      0000000000000000
      [  822.340033]  0000000000000000 0801010a00000000 0000000000000000
      0000000000000000
      [  822.340033]  0000000000000004 ffffffff8148749b ffffffff8187e0c0
      000000000000001c
      [  822.340033] Call Trace:
      [  822.340033]  [<ffffffff8148749b>] ? mpls_rt_alloc+0x2b/0x3e
      [  822.340033]  [<ffffffff81488e66>] ? mpls_rtm_newroute+0x358/0x3e2
      [  822.340033]  [<ffffffff810e7bbc>] ? get_page+0x5/0xa
      [  822.340033]  [<ffffffff813b7d94>] ? rtnetlink_rcv_msg+0x17e/0x191
      [  822.340033]  [<ffffffff8111794e>] ? __kmalloc_track_caller+0x8c/0x9e
      [  822.340033]  [<ffffffff813c9393>] ?
      rht_key_hashfn.isra.20.constprop.57+0x14/0x1f
      [  822.340033]  [<ffffffff813b7c16>] ? __rtnl_unlock+0xc/0xc
      [  822.340033]  [<ffffffff813cb794>] ? netlink_rcv_skb+0x36/0x82
      [  822.340033]  [<ffffffff813b4507>] ? rtnetlink_rcv+0x1f/0x28
      [  822.340033]  [<ffffffff813cb2b1>] ? netlink_unicast+0x106/0x189
      [  822.340033]  [<ffffffff813cb5b3>] ? netlink_sendmsg+0x27f/0x2c8
      [  822.340033]  [<ffffffff81392ede>] ? sock_sendmsg_nosec+0x10/0x1b
      [  822.340033]  [<ffffffff81393df1>] ? ___sys_sendmsg+0x182/0x1e3
      [  822.340033]  [<ffffffff810e4f35>] ?
      __alloc_pages_nodemask+0x11c/0x1e4
      [  822.340033]  [<ffffffff8110619c>] ? PageAnon+0x5/0xd
      [  822.340033]  [<ffffffff811062fe>] ? __page_set_anon_rmap+0x45/0x52
      [  822.340033]  [<ffffffff810e7bbc>] ? get_page+0x5/0xa
      [  822.340033]  [<ffffffff810e85ab>] ? __lru_cache_add+0x1a/0x3a
      [  822.340033]  [<ffffffff81087ea9>] ? current_kernel_time64+0x9/0x30
      [  822.340033]  [<ffffffff813940c4>] ? __sys_sendmsg+0x3c/0x5a
      [  822.340033]  [<ffffffff8148f597>] ?
      entry_SYSCALL_64_fastpath+0x12/0x6a
      [  822.340033] Code: 83 08 04 00 00 65 ff 00 48 8b 3c 24 e8 40 7c f2 ff
      eb 13 48 c7 c3 9f ff ff ff eb 0f 89 ce e8 f1 ae f1 ff 48 89 c3 48 85 db
      74 15 <48> 8b 83 08 04 00 00 65 ff 08 48 81 fb 00 f0 ff ff 76 0d eb 07
      [  822.340033] RIP  [<ffffffff8148781e>] mpls_nh_assign_dev+0x10b/0x182
      [  822.340033]  RSP <ffff88001dad7a88>
      [  822.340033] CR2: 00000000000003a3
      [  822.435363] ---[ end trace 98cc65e6f6b8bf11 ]---
      
      After patch:
      $ip -f mpls route add 100 as 200 via inet 10.1.1.8
      RTNETLINK answers: Network is unreachable
      Signed-off-by: default avatarRoopa Prabhu <roopa@cumulusnetworks.com>
      Reported-by: default avatarDavid Miller <davem@davemloft.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      94a57f1f
    • Jakub Sitnicki's avatar
      ipv6: Count in extension headers in skb->network_header · 3ba3458f
      Jakub Sitnicki authored
      When sending a UDPv6 message longer than MTU, account for the length
      of fragmentable IPv6 extension headers in skb->network_header offset.
      Same as we do in alloc_new_skb path in __ip6_append_data().
      
      This ensures that later on __ip6_make_skb() will make space in
      headroom for fragmentable extension headers:
      
      	/* move skb->data to ip header from ext header */
      	if (skb->data < skb_network_header(skb))
      		__skb_pull(skb, skb_network_offset(skb));
      
      Prevents a splat due to skb_under_panic:
      
      skbuff: skb_under_panic: text:ffffffff8143397b len:2126 put:14 \
      head:ffff880005bacf50 data:ffff880005bacf4a tail:0x48 end:0xc0 dev:lo
      ------------[ cut here ]------------
      kernel BUG at net/core/skbuff.c:104!
      invalid opcode: 0000 [#1] KASAN
      CPU: 0 PID: 160 Comm: reproducer Not tainted 4.6.0-rc2 #65
      [...]
      Call Trace:
       [<ffffffff813eb7b9>] skb_push+0x79/0x80
       [<ffffffff8143397b>] eth_header+0x2b/0x100
       [<ffffffff8141e0d0>] neigh_resolve_output+0x210/0x310
       [<ffffffff814eab77>] ip6_finish_output2+0x4a7/0x7c0
       [<ffffffff814efe3a>] ip6_output+0x16a/0x280
       [<ffffffff815440c1>] ip6_local_out+0xb1/0xf0
       [<ffffffff814f1115>] ip6_send_skb+0x45/0xd0
       [<ffffffff81518836>] udp_v6_send_skb+0x246/0x5d0
       [<ffffffff8151985e>] udpv6_sendmsg+0xa6e/0x1090
      [...]
      Reported-by: default avatarJi Jianwen <jiji@redhat.com>
      Signed-off-by: default avatarJakub Sitnicki <jkbs@redhat.com>
      Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3ba3458f
    • Bart Van Assche's avatar
      Revert "ib_srpt: Convert to percpu_ida tag allocation" · 3c968887
      Bart Van Assche authored
      This reverts commit 0fd10721.
      
      That patch causes the ib_srpt driver to crash as soon as the first SCSI
      command is received:
      
        kernel BUG at drivers/infiniband/ulp/srpt/ib_srpt.c:1439!
        invalid opcode: 0000 [#1] SMP
        Workqueue: target_completion target_complete_ok_work [target_core_mod]
        RIP: srpt_queue_response+0x437/0x4a0 [ib_srpt]
        Call Trace:
          srpt_queue_data_in+0x9/0x10 [ib_srpt]
          target_complete_ok_work+0x152/0x2b0 [target_core_mod]
          process_one_work+0x197/0x480
          worker_thread+0x49/0x490
          kthread+0xea/0x100
          ret_from_fork+0x22/0x40
      
      Aside from the crash, the shortcomings of that patch are as follows:
      
       - It makes the ib_srpt driver use I/O contexts allocated by
         transport_alloc_session_tags() but it does not initialize these I/O
         contexts properly.  All the initializations performed by
         srpt_alloc_ioctx() are skipped.
      
       - It swaps the order of the send ioctx allocation and the transition to
         RTR mode which is wrong.
      
       - The amount of memory that is needed for I/O contexts is doubled.
      
       - srpt_rdma_ch.free_list is no longer used but is not removed.
      Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
      Cc: Nicholas Bellinger <nab@linux-iscsi.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      3c968887
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 93061f39
      Linus Torvalds authored
      Pull ext4 bugfixes from Ted Ts'o:
       "These changes contains a fix for overlayfs interacting with some
        (badly behaved) dentry code in various file systems.  These have been
        reviewed by Al and the respective file system mtinainers and are going
        through the ext4 tree for convenience.
      
        This also has a few ext4 encryption bug fixes that were discovered in
        Android testing (yes, we will need to get these sync'ed up with the
        fs/crypto code; I'll take care of that).  It also has some bug fixes
        and a change to ignore the legacy quota options to allow for xfstests
        regression testing of ext4's internal quota feature and to be more
        consistent with how xfs handles this case"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: ignore quota mount options if the quota feature is enabled
        ext4 crypto: fix some error handling
        ext4: avoid calling dquot_get_next_id() if quota is not enabled
        ext4: retry block allocation for failed DIO and DAX writes
        ext4: add lockdep annotations for i_data_sem
        ext4: allow readdir()'s of large empty directories to be interrupted
        btrfs: fix crash/invalid memory access on fsync when using overlayfs
        ext4 crypto: use dget_parent() in ext4_d_revalidate()
        ext4: use file_dentry()
        ext4: use dget_parent() in ext4_file_open()
        nfs: use file_dentry()
        fs: add file_dentry()
        ext4 crypto: don't let data integrity writebacks fail with ENOMEM
        ext4: check if in-inode xattr is corrupted in ext4_expand_extra_isize_ea()
      93061f39
  3. 07 Apr, 2016 17 commits