1. 18 Apr, 2020 7 commits
    • Alexander Aring's avatar
      ipv6: rpl: fix full address compression · 62e69776
      Alexander Aring authored
      This patch makes it impossible that cmpri or cmpre values are set to the
      value 16 which is not possible, because these are 4 bit values. We
      currently run in an overflow when assigning the value 16 to it.
      
      According to the standard a value of 16 can be interpreted as a full
      elided address which isn't possible to set as compression value. A reason
      why this cannot be set is that the current ipv6 header destination address
      should never show up inside the segments of the rpl header. In this case we
      run in a overflow and the address will have no compression at all. Means
      cmpri or compre is set to 0.
      
      As we handle cmpri and cmpre sometimes as unsigned char or 4 bit value
      inside the rpl header the current behaviour ends in an invalid header
      format. This patch simple use the best compression method if we ever run
      into the case that the destination address is showed up inside the rpl
      segments. We avoid the overflow handling and the rpl header is still valid,
      even when we have the destination address inside the rpl segments.
      Signed-off-by: default avatarAlexander Aring <alex.aring@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      62e69776
    • Julien Beraud's avatar
      net: stmmac: Fix sub-second increment · 91a2559c
      Julien Beraud authored
      In fine adjustement mode, which is the current default, the sub-second
          increment register is the number of nanoseconds that will be added to
          the clock when the accumulator overflows. At each clock cycle, the
          value of the addend register is added to the accumulator.
          Currently, we use 20ns = 1e09ns / 50MHz as this value whatever the
          frequency of the ptp clock actually is.
          The adjustment is then done on the addend register, only incrementing
          every X clock cycles X being the ratio between 50MHz and ptp_clock_rate
          (addend = 2^32 * 50MHz/ptp_clock_rate).
          This causes the following issues :
          - In case the frequency of the ptp clock is inferior or equal to 50MHz,
            the addend value calculation will overflow and the default
            addend value will be set to 0, causing the clock to not work at
            all. (For instance, for ptp_clock_rate = 50MHz, addend = 2^32).
          - The resolution of the timestamping clock is limited to 20ns while it
            is not needed, thus limiting the accuracy of the timestamping to
            20ns.
      
          Fix this by setting sub-second increment to 2e09ns / ptp_clock_rate.
          It will allow to reach the minimum possible frequency for
          ptp_clk_ref, which is 5MHz for GMII 1000Mps Full-Duplex by setting the
          sub-second-increment to a higher value. For instance, for 25MHz, it
          gives ssinc = 80ns and default_addend = 2^31.
          It will also allow to use a lower value for sub-second-increment, thus
          improving the timestamping accuracy with frequencies higher than
          100MHz, for instance, for 200MHz, ssinc = 10ns and default_addend =
          2^31.
      
      v1->v2:
       - Remove modifications to the calculation of default addend, which broke
       compatibility with clock frequencies for which 2000000000 / ptp_clk_freq
       is not an integer.
       - Modify description according to discussions.
      Signed-off-by: default avatarJulien Beraud <julien.beraud@orolia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      91a2559c
    • Julien Beraud's avatar
      net: stmmac: fix enabling socfpga's ptp_ref_clock · 15ce3060
      Julien Beraud authored
      There are 2 registers to write to enable a ptp ref clock coming from the
      fpga.
      One that enables the usage of the clock from the fpga for emac0 and emac1
      as a ptp ref clock, and the other to allow signals from the fpga to reach
      emac0 and emac1.
      Currently, if the dwmac-socfpga has phymode set to PHY_INTERFACE_MODE_MII,
      PHY_INTERFACE_MODE_GMII, or PHY_INTERFACE_MODE_SGMII, both registers will
      be written and the ptp ref clock will be set as coming from the fpga.
      Separate the 2 register writes to only enable signals from the fpga to
      reach emac0 or emac1 when ptp ref clock is not coming from the fpga.
      Signed-off-by: default avatarJulien Beraud <julien.beraud@orolia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      15ce3060
    • Xiyu Yang's avatar
      wimax/i2400m: Fix potential urb refcnt leak · 7717cbec
      Xiyu Yang authored
      i2400mu_bus_bm_wait_for_ack() invokes usb_get_urb(), which increases the
      refcount of the "notif_urb".
      
      When i2400mu_bus_bm_wait_for_ack() returns, local variable "notif_urb"
      becomes invalid, so the refcount should be decreased to keep refcount
      balanced.
      
      The issue happens in all paths of i2400mu_bus_bm_wait_for_ack(), which
      forget to decrease the refcnt increased by usb_get_urb(), causing a
      refcnt leak.
      
      Fix this issue by calling usb_put_urb() before the
      i2400mu_bus_bm_wait_for_ack() returns.
      Signed-off-by: default avatarXiyu Yang <xiyuyang19@fudan.edu.cn>
      Signed-off-by: default avatarXin Tan <tanxin.ctf@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7717cbec
    • Xiyu Yang's avatar
      tipc: Fix potential tipc_node refcnt leak in tipc_rcv · de058420
      Xiyu Yang authored
      tipc_rcv() invokes tipc_node_find() twice, which returns a reference of
      the specified tipc_node object to "n" with increased refcnt.
      
      When tipc_rcv() returns or a new object is assigned to "n", the original
      local reference of "n" becomes invalid, so the refcount should be
      decreased to keep refcount balanced.
      
      The issue happens in some paths of tipc_rcv(), which forget to decrease
      the refcnt increased by tipc_node_find() and will cause a refcnt leak.
      
      Fix this issue by calling tipc_node_put() before the original object
      pointed by "n" becomes invalid.
      Signed-off-by: default avatarXiyu Yang <xiyuyang19@fudan.edu.cn>
      Signed-off-by: default avatarXin Tan <tanxin.ctf@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      de058420
    • Xiyu Yang's avatar
      tipc: Fix potential tipc_aead refcnt leak in tipc_crypto_rcv · 441870ee
      Xiyu Yang authored
      tipc_crypto_rcv() invokes tipc_aead_get(), which returns a reference of
      the tipc_aead object to "aead" with increased refcnt.
      
      When tipc_crypto_rcv() returns, the original local reference of "aead"
      becomes invalid, so the refcount should be decreased to keep refcount
      balanced.
      
      The issue happens in one error path of tipc_crypto_rcv(). When TIPC
      message decryption status is EINPROGRESS or EBUSY, the function forgets
      to decrease the refcnt increased by tipc_aead_get() and causes a refcnt
      leak.
      
      Fix this issue by calling tipc_aead_put() on the error path when TIPC
      message decryption status is EINPROGRESS or EBUSY.
      Signed-off-by: default avatarXiyu Yang <xiyuyang19@fudan.edu.cn>
      Signed-off-by: default avatarXin Tan <tanxin.ctf@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      441870ee
    • Xiyu Yang's avatar
      net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node · d03f2284
      Xiyu Yang authored
      nr_add_node() invokes nr_neigh_get_dev(), which returns a local
      reference of the nr_neigh object to "nr_neigh" with increased refcnt.
      
      When nr_add_node() returns, "nr_neigh" becomes invalid, so the refcount
      should be decreased to keep refcount balanced.
      
      The issue happens in one normal path of nr_add_node(), which forgets to
      decrease the refcnt increased by nr_neigh_get_dev() and causes a refcnt
      leak. It should decrease the refcnt before the function returns like
      other normal paths do.
      
      Fix this issue by calling nr_neigh_put() before the nr_add_node()
      returns.
      Signed-off-by: default avatarXiyu Yang <xiyuyang19@fudan.edu.cn>
      Signed-off-by: default avatarXin Tan <tanxin.ctf@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d03f2284
  2. 16 Apr, 2020 11 commits
    • Linus Torvalds's avatar
      Merge tag 'tag-chrome-platform-fixes-for-v5.7-rc2' of... · 2fcd8014
      Linus Torvalds authored
      Merge tag 'tag-chrome-platform-fixes-for-v5.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux
      
      Pull chrome-platform fixes from Benson Leung:
       "Two small fixes for cros_ec_sensorhub_ring.c, addressing issues
        introduced in the cros_ec_sensorhub FIFO support commit"
      
      * tag 'tag-chrome-platform-fixes-for-v5.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
        platform/chrome: cros_ec_sensorhub: Add missing '\n' in log messages
        platform/chrome: cros_ec_sensorhub: Off by one in cros_sensorhub_send_sample()
      2fcd8014
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · c8372665
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Disable RISCV BPF JIT builds when !MMU, from Björn Töpel.
      
       2) nf_tables leaves dangling pointer after free, fix from Eric Dumazet.
      
       3) Out of boundary write in __xsk_rcv_memcpy(), fix from Li RongQing.
      
       4) Adjust icmp6 message source address selection when routes have a
          preferred source address set, from Tim Stallard.
      
       5) Be sure to validate HSR protocol version when creating new links,
          from Taehee Yoo.
      
       6) CAP_NET_ADMIN should be sufficient to manage l2tp tunnels even in
          non-initial namespaces, from Michael Weiß.
      
       7) Missing release firmware call in mlx5, from Eran Ben Elisha.
      
       8) Fix variable type in macsec_changelink(), caught by KASAN. Fix from
          Taehee Yoo.
      
       9) Fix pause frame negotiation in marvell phy driver, from Clemens
          Gruber.
      
      10) Record RX queue early enough in tun packet paths such that XDP
          programs will see the correct RX queue index, from Gilberto Bertin.
      
      11) Fix double unlock in mptcp, from Florian Westphal.
      
      12) Fix offset overflow in ARM bpf JIT, from Luke Nelson.
      
      13) marvell10g needs to soft reset PHY when coming out of low power
          mode, from Russell King.
      
      14) Fix MTU setting regression in stmmac for some chip types, from
          Florian Fainelli.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (101 commits)
        amd-xgbe: Use __napi_schedule() in BH context
        mISDN: make dmril and dmrim static
        net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes
        net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode
        tipc: fix incorrect increasing of link window
        Documentation: Fix tcp_challenge_ack_limit default value
        net: tulip: make early_486_chipsets static
        dt-bindings: net: ethernet-phy: add desciption for ethernet-phy-id1234.d400
        ipv6: remove redundant assignment to variable err
        net/rds: Use ERR_PTR for rds_message_alloc_sgs()
        net: mscc: ocelot: fix untagged packet drops when enslaving to vlan aware bridge
        selftests/bpf: Check for correct program attach/detach in xdp_attach test
        libbpf: Fix type of old_fd in bpf_xdp_set_link_opts
        libbpf: Always specify expected_attach_type on program load if supported
        xsk: Add missing check on user supplied headroom size
        mac80211: fix channel switch trigger from unknown mesh peer
        mac80211: fix race in ieee80211_register_hw()
        net: marvell10g: soft-reset the PHY when coming out of low power
        net: marvell10g: report firmware version
        net/cxgb4: Check the return from t4_query_params properly
        ...
      c8372665
    • Sebastian Andrzej Siewior's avatar
      amd-xgbe: Use __napi_schedule() in BH context · d518691c
      Sebastian Andrzej Siewior authored
      The driver uses __napi_schedule_irqoff() which is fine as long as it is
      invoked with disabled interrupts by everybody. Since the commit
      mentioned below the driver may invoke xgbe_isr_task() in tasklet/softirq
      context. This may lead to list corruption if another driver uses
      __napi_schedule_irqoff() in IRQ context.
      
      Use __napi_schedule() which safe to use from IRQ and softirq context.
      
      Fixes: 85b85c85 ("amd-xgbe: Re-issue interrupt if interrupt status not cleared")
      Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Acked-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
      Cc: Tom Lendacky <thomas.lendacky@amd.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d518691c
    • Jason Yan's avatar
      mISDN: make dmril and dmrim static · 05eab4f3
      Jason Yan authored
      Fix the following sparse warning:
      
      drivers/isdn/hardware/mISDN/mISDNisar.c:746:12: warning: symbol 'dmril'
      was not declared. Should it be static?
      drivers/isdn/hardware/mISDN/mISDNisar.c:749:12: warning: symbol 'dmrim'
      was not declared. Should it be static?
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarJason Yan <yanaijie@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      05eab4f3
    • Florian Fainelli's avatar
      net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes · 806fd188
      Florian Fainelli authored
      After commit bfcb8132 ("net: dsa:
      configure the MTU for switch ports") my Lamobo R1 platform which uses
      an allwinner,sun7i-a20-gmac compatible Ethernet MAC started to fail
      by rejecting a MTU of 1536. The reason for that is that the DMA
      capabilities are not readable on this version of the IP, and there
      is also no 'tx-fifo-depth' property being provided in Device Tree. The
      property is documented as optional, and is not provided.
      
      Chen-Yu indicated that the FIFO sizes are 4KB for TX and 16KB for RX, so
      provide these values through platform data as an immediate fix until
      various Device Tree sources get updated accordingly.
      
      Fixes: eaf4fac4 ("net: stmmac: Do not accept invalid MTU values")
      Suggested-by: default avatarChen-Yu Tsai <wens@csie.org>
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Acked-by: default avatarChen-Yu Tsai <wens@csie.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      806fd188
    • DENG Qingfang's avatar
      net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode · e045124e
      DENG Qingfang authored
      In VLAN-unaware mode, the Egress Tag (EG_TAG) field in Port VLAN
      Control register must be set to Consistent to let tagged frames pass
      through as is, otherwise their tags will be stripped.
      
      Fixes: 83163f7d ("net: dsa: mediatek: add VLAN support for MT7530")
      Signed-off-by: default avatarDENG Qingfang <dqfext@gmail.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Tested-by: default avatarRené van Dorst <opensource@vdorst.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e045124e
    • Linus Torvalds's avatar
      Merge tag 'selinux-pr-20200416' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux · 9786cab6
      Linus Torvalds authored
      Pull SELinux fix from Paul Moore:
       "One small SELinux fix to ensure we cleanup properly on an error
        condition"
      
      * tag 'selinux-pr-20200416' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
        selinux: free str on error in str_read()
      9786cab6
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-5.7-rc2' of git://github.com/ceph/ceph-client · 3fa84bf9
      Linus Torvalds authored
      Pull ceph fixes from Ilya Dryomov:
      
       - a set of patches for a deadlock on "rbd map" error path
      
       - a fix for invalid pointer dereference and uninitialized variable use
         on asynchronous create and unlink error paths.
      
      * tag 'ceph-for-5.7-rc2' of git://github.com/ceph/ceph-client:
        ceph: fix potential bad pointer deref in async dirops cb's
        rbd: don't mess with a page vector in rbd_notify_op_lock()
        rbd: don't test rbd_dev->opts in rbd_dev_image_release()
        rbd: call rbd_dev_unprobe() after unwatching and flushing notifies
        rbd: avoid a deadlock on header_rwsem when flushing notifies
      3fa84bf9
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 4ede1259
      Linus Torvalds authored
      Pull tracing fix from Steven Rostedt:
       "This fixes a small race between allocating a snapshot buffer and
        setting the snapshot trigger.
      
        On a slow machine, the trigger can occur before the snapshot is
        allocated causing a warning to be displayed in the ring buffer, and no
        snapshot triggering. Reversing the allocation and the enabling of the
        trigger fixes the problem"
      
      * tag 'trace-v5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation
      4ede1259
    • Vasily Averin's avatar
      keys: Fix proc_keys_next to increase position index · 86d32f9a
      Vasily Averin authored
      If seq_file .next function does not change position index,
      read after some lseek can generate unexpected output:
      
          $ dd if=/proc/keys bs=1  # full usual output
          0f6bfdf5 I--Q---     2 perm 3f010000  1000  1000 user      4af2f79ab8848d0a: 740
          1fb91b32 I--Q---     3 perm 1f3f0000  1000 65534 keyring   _uid.1000: 2
          27589480 I--Q---     1 perm 0b0b0000     0     0 user      invocation_id: 16
          2f33ab67 I--Q---   152 perm 3f030000     0     0 keyring   _ses: 2
          33f1d8fa I--Q---     4 perm 3f030000  1000  1000 keyring   _ses: 1
          3d427fda I--Q---     2 perm 3f010000  1000  1000 user      69ec44aec7678e5a: 740
          3ead4096 I--Q---     1 perm 1f3f0000  1000 65534 keyring   _uid_ses.1000: 1
          521+0 records in
          521+0 records out
          521 bytes copied, 0,00123769 s, 421 kB/s
      
      But a read after lseek in middle of last line results in the partial
      last line and then a repeat of the final line:
      
          $ dd if=/proc/keys bs=500 skip=1
          dd: /proc/keys: cannot skip to specified offset
          g   _uid_ses.1000: 1
          3ead4096 I--Q---     1 perm 1f3f0000  1000 65534 keyring   _uid_ses.1000: 1
          0+1 records in
          0+1 records out
          97 bytes copied, 0,000135035 s, 718 kB/s
      
      and a read after lseek beyond end of file results in the last line being
      shown:
      
          $ dd if=/proc/keys bs=1000 skip=1   # read after lseek beyond end of file
          dd: /proc/keys: cannot skip to specified offset
          3ead4096 I--Q---     1 perm 1f3f0000  1000 65534 keyring   _uid_ses.1000: 1
          0+1 records in
          0+1 records out
          76 bytes copied, 0,000119981 s, 633 kB/s
      
      See https://bugzilla.kernel.org/show_bug.cgi?id=206283
      
      Fixes: 1f4aace6 ("fs/seq_file.c: simplify seq_file iteration code ...")
      Signed-off-by: default avatarVasily Averin <vvs@virtuozzo.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      86d32f9a
    • Linus Torvalds's avatar
      Merge tag 'efi-urgent-2020-04-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 00086336
      Linus Torvalds authored
      Pull EFI fixes from Ingo Molnar:
       "Misc EFI fixes, including the boot failure regression caused by the
        BSS section not being cleared by the loaders"
      
      * tag 'efi-urgent-2020-04-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        efi/x86: Revert struct layout change to fix kexec boot regression
        efi/x86: Don't remap text<->rodata gap read-only for mixed mode
        efi/x86: Fix the deletion of variables in mixed mode
        efi/libstub/file: Merge file name buffers to reduce stack usage
        Documentation/x86, efi/x86: Clarify EFI handover protocol and its requirements
        efi/arm: Deal with ADR going out of range in efi_enter_kernel()
        efi/x86: Always relocate the kernel for EFI handover entry
        efi/x86: Move efi stub globals from .bss to .data
        efi/libstub/x86: Remove redundant assignment to pointer hdr
        efi/cper: Use scnprintf() for avoiding potential buffer overflow
      00086336
  3. 15 Apr, 2020 17 commits
  4. 14 Apr, 2020 5 commits