- 27 Jan, 2020 40 commits
-
-
Antonio Borneo authored
[ Upstream commit 5da202c8 ] The field "name" in struct ptp_clock_info has a fixed size of 16 chars and is used as zero terminated string by clock_name_show() in drivers/ptp/ptp_sysfs.c The current initialization value requires 17 chars to fit also the null termination, and this causes overflow to the next bytes in the struct when the string is read as null terminated: hexdump -C /sys/class/ptp/ptp0/clock_name 00000000 73 74 6d 6d 61 63 5f 70 74 70 5f 63 6c 6f 63 6b |stmmac_ptp_clock| 00000010 a0 ac b9 03 0a |.....| where the extra 4 bytes (excluding the newline) after the string represent the integer 0x03b9aca0 = 62500000 assigned to the field "max_adj" that follows "name" in the same struct. There is no strict requirement for the "name" content and in the comment in ptp_clock_kernel.h it's reported it should just be 'A short "friendly name" to identify the clock'. Replace it with "stmmac ptp". Signed-off-by:
Antonio Borneo <antonio.borneo@st.com> Fixes: 92ba6888 ("stmmac: add the support for PTP hw clock driver") Signed-off-by:
Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by:
Sasha Levin <sashal@kernel.org>
-
Haishuang Yan authored
[ Upstream commit 4123f637 ] ip6erspan driver calls ether_setup(), after commit 61e84623 ("net: centralize net_device min/max MTU checking"), the range of mtu is [min_mtu, max_mtu], which is [68, 1500] by default. It causes the dev mtu of the erspan device to not be greater than 1500, this limit value is not correct for ip6erspan tap device. Fixes: 61e84623 ("net: centralize net_device min/max MTU checking") Signed-off-by:
Haishuang Yan <yanhaishuang@cmss.chinamobile.com> Acked-by:
William Tu <u9012063@gmail.com> Signed-off-by:
-
Eric Biggers authored
[ Upstream commit 36453c85 ] If llc_conn_state_process() sees that llc_conn_service() put the skb on a list, it will drop one fewer references to it. This is wrong because the current behavior is that llc_conn_service() never consumes a reference to the skb. The code also makes the number of skb references being dropped conditional on which of ind_prim and cfm_prim are nonzero, yet neither of these affects how many references are *acquired*. So there is extra code that tries to fix this up by sometimes taking another reference. Remove the unnecessary/broken refcounting logic and instead just add an skb_get() before the only two places where an extra reference is actually consumed. Fixes: 1da177e4 ("Linux-2.6.12-rc2") Signed-off-by:
Eric Biggers <ebiggers@google.com> Signed-off-by:
-
Eric Biggers authored
[ Upstream commit fc8d5db1 ] All callers of llc_conn_state_process() except llc_build_and_send_pkt() (via llc_ui_sendmsg() -> llc_ui_send_data()) assume that it always consumes a reference to the skb. Fix this caller to do the same. Fixes: 1da177e4 ("Linux-2.6.12-rc2") Signed-off-by:
-
Johannes Berg authored
[ Upstream commit 95697f99 ] We can process deauth frames and all, but we drop them very early in the RX path today - this could never have worked. Fixes: 2cc59e78 ("mac80211: reply to AUTH with DEAUTH if sta allocation fails in IBSS") Signed-off-by:
Johannes Berg <johannes.berg@intel.com> Signed-off-by:
Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/20191004123706.15768-2-luca@coelho.fiSigned-off-by:
-
David Howells authored
[ Upstream commit 4c1295dc ] rxrpc_put_*conn() calls trace_rxrpc_conn() after they have done the decrement of the refcount - which looks at the debug_id in the connection record. But unless the refcount was reduced to zero, we no longer have the right to look in the record and, indeed, it may be deleted by some other thread. Fix this by getting the debug_id out before decrementing the refcount and then passing that into the tracepoint. Fixes: 363deeab ("rxrpc: Add connection tracepoint and client conn state tracepoint") Signed-off-by:
David Howells <dhowells@redhat.com> Signed-off-by:
-
Jose Abreu authored
[ Upstream commit 25683bab ] Some setups may not have all Unicast addresses filters available. Check the number of available filters before trying to setup it. Fixes: 477286b5 ("stmmac: add GMAC4 core support") Signed-off-by:
Jose Abreu <Jose.Abreu@synopsys.com> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
-
Ard Biesheuvel authored
[ Upstream commit 3a8ecc93 ] Commit 7fd8930f "nvme: add a common helper to read Identify Controller data" has re-introduced an issue that we have attempted to work around in the past, in commit a310acd7 ("NVMe: use split lo_hi_{read,write}q"). The problem is that some PCIe NVMe controllers do not implement 64-bit outbound accesses correctly, which is why the commit above switched to using lo_hi_[read|write]q for all 64-bit BAR accesses occuring in the code. In the mean time, the NVMe subsystem has been refactored, and now calls into the PCIe support layer for NVMe via a .reg_read64() method, which fails to use lo_hi_readq(), and thus reintroduces the problem that the workaround above aimed to address. Given that, at the moment, .reg_read64() is only used to read the capability register [which is known to tolerate split reads], let's switch .reg_read64() to lo_hi_readq() as well. This fixes a boot issue on some ARM boxes with NVMe behind a Synopsys DesignWare PCIe host controller. Fixes: 7fd8930f ("nvme: add a common helper to read Identify Controller data") Signed-off-by:
Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by:
Sagi Grimberg <sagi@grimberg.me> Signed-off-by:
-
Vladimir Oltean authored
[ Upstream commit 83c8c3cf ] As explained in the "net: sched: taprio: Avoid division by zero on invalid link speed" commit, it is legal for the ethtool API to return zero as a link speed. So guard against it to ensure we don't perform a division by zero in kernel. Fixes: e0a7683d ("net/sched: cbs: fix port_rate miscalculation") Signed-off-by:
Vladimir Oltean <olteanv@gmail.com> Acked-by:
Vinicius Costa Gomes <vinicius.gomes@intel.com> Signed-off-by:
-
Dan Carpenter authored
[ Upstream commit 23104218 ] The "gmac->phy_mode" variable is an enum and in this context GCC will treat it as an unsigned int so the error handling will never be triggered. Fixes: b1c17215 ("stmmac: add ipq806x glue layer") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
Dan Carpenter authored
[ Upstream commit 1a4b62a0 ] The "priv->phy_mode" is an enum and in this context GCC will treat it as an unsigned int so it can never be less than zero. Fixes: 492caffa ("net: ethernet: nixge: Add support for National Instruments XGE netdev") Signed-off-by:
-
Dan Carpenter authored
[ Upstream commit d7eb6512 ] The "iface" variable is an enum and in this context GCC treats it as an unsigned int so the error handling is never triggered. Fixes: b7862412 ("of_mdio: Abstract a general interface for phy connect") Signed-off-by:
-
Dan Carpenter authored
[ Upstream commit 73e211e1 ] The "lp->phy_mode" is an enum but in this context GCC treats it as an unsigned int so the error handling is never triggered. Fixes: ee06b172 ("net: axienet: add support for standard phy-mode binding") Signed-off-by:
Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com> Signed-off-by:
-
Dan Carpenter authored
[ Upstream commit f1021051 ] The "dwmac->phy_mode" is an enum and in this context GCC treats it as an unsigned int so the error handling is never triggered. Fixes: 566e8251 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC") Signed-off-by:
Martin Blumenstingl <martin.blumenstingl@googlemail.com> Signed-off-by:
-
Dan Carpenter authored
[ Upstream commit 7f9e88e6 ] The "phy_mode" variable is an enum and in this context GCC treats it as an unsigned int so the error handling is never triggered. Fixes: 4c270b55 ("net: ethernet: socionext: add AVE ethernet driver") Signed-off-by:
Kunihiko Hayashi <hayashi.kunihiko@socionext.com> Signed-off-by:
-
Dan Carpenter authored
[ Upstream commit bd55f8dd ] The "priv->phy_interface" variable is an enum and in this context GCC will treat it as an unsigned int so the error handling is never triggered. Fixes: 533dd11a ("net: socionext: Add Synquacer NetSec driver") Signed-off-by:
-
Dan Carpenter authored
[ Upstream commit 25a58495 ] The "priv->phy_interface" variable is an enum and in this context GCC will treat it as unsigned so the error handling will never be triggered. Fixes: 80105bef ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver") Signed-off-by:
Florian Fainelli <f.fainelli@gmail.com> Signed-off-by:
-
Dan Carpenter authored
[ Upstream commit 002dfe80 ] The "priv->phy_mode" variable is an enum and in this context GCC will treat it as unsigned to the error handling will never trigger. Fixes: 57c5bc9a ("net: hisilicon: add hix5hd2 mac driver") Signed-off-by:
-
Dan Carpenter authored
[ Upstream commit 28618314 ] The "chip" variable is an enum, and it's treated as unsigned int by GCC in this context so the error handling isn't triggered. Fixes: e8d45292 ("cxgb4: clean up init_one") Signed-off-by:
-
Dan Carpenter authored
[ Upstream commit 31aefe14 ] The irqreturn_t type is an enum or an unsigned int in GCC. That creates to problems because it can't detect if the self->aq_hw_ops->hw_irq_read() call fails and at the end the function always returns IRQ_HANDLED. drivers/net/ethernet/aquantia/atlantic/aq_vec.c:316 aq_vec_isr_legacy() warn: unsigned 'err' is never less than zero. drivers/net/ethernet/aquantia/atlantic/aq_vec.c:329 aq_vec_isr_legacy() warn: always true condition '(err >= 0) => (0-u32max >= 0)' Fixes: 970a2e98 ("net: ethernet: aquantia: Vector operations") Signed-off-by:
Igor Russkikh <igor.russkikh@aquantia.com> Signed-off-by:
-
Filippo Sironi authored
[ Upstream commit 0b15e02f ] To make sure the domain tlb flush completes before the function returns, explicitly wait for its completion. Signed-off-by:
Filippo Sironi <sironi@amazon.de> Fixes: 42a49f96 ("amd-iommu: flush domain tlb when attaching a new device") [joro: Added commit message and fixes tag] Signed-off-by:
Joerg Roedel <jroedel@suse.de> Signed-off-by:
-
Yunfeng Ye authored
[ Upstream commit e00371af ] When dma_pool_zalloc() fail in sec_alloc_and_fill_hw_sgl(), dma_pool_free() is invoked, but the parameters that sgl_current and sgl_current->next_sgl is not match. Using sec_free_hw_sgl() instead of the original free routine. Fixes: 915e4e84 ("crypto: hisilicon - SEC security accelerator driver") Signed-off-by:
Yunfeng Ye <yeyunfeng@huawei.com> Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Alexei Starovoitov authored
[ Upstream commit a0791f0d ] vmlinux BTF has more than 64k types. Its string section is also at the offset larger than 64k. Adjust both limits to make in-kernel BTF verifier successfully parse in-kernel BTF. Fixes: 69b693f0 ("bpf: btf: Introduce BPF Type Format (BTF)") Signed-off-by:
Alexei Starovoitov <ast@kernel.org> Acked-by:
Martin KaFai Lau <kafai@fb.com> Signed-off-by:
Daniel Borkmann <daniel@iogearbox.net> Signed-off-by:
-
Aneesh Kumar K.V authored
[ Upstream commit d9101bfa ] __find_linux_mm_pte() returns a page table entry pointer after walking the page table without holding locks. To make it safe against a THP split and/or collapse, we disable interrupts around the lockless page table walk. However we need to keep interrupts disabled as long as we use the page table entry pointer that is returned. Fix addr_to_pfn() to do that. Fixes: ba41e1e1 ("powerpc/mce: Hookup derror (load/store) UE errors") Signed-off-by:
Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> [mpe: Rearrange code slightly and tweak change log wording] Signed-off-by:
Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20190918145328.28602-1-aneesh.kumar@linux.ibm.comSigned-off-by:
-
Manivannan Sadhasivam authored
[ Upstream commit ed309bfb ] Since the helper "owl_factor_helper_round_rate" is shared between factor and composite clocks, using the factor clk specific helper function like "hw_to_owl_factor" to access its members will create issues when called from composite clk specific code. Hence, pass the "factor_hw" struct pointer directly instead of fetching it using factor clk specific helpers. This issue has been observed when a composite clock like "sd0_clk" tried to call "owl_factor_helper_round_rate" resulting in pointer dereferencing error. While we are at it, let's rename the "clk_val_best" function to "owl_clk_val_best" since this is an owl SoCs specific helper. Fixes: 4bb78fc9 ("clk: actions: Add factor clock support") Signed-off-by:
Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by:
Stephen Boyd <sboyd@kernel.org> Link: https://lkml.kernel.org/r/20190916154546.24982-2-manivannan.sadhasivam@linaro.orgSigned-off-by:
-
Jorge Ramirez-Ortiz authored
[ Upstream commit 556a0964 ] The mailbox length is 0x1000 hence the max_register value is 0xFFC. Fixes: c6a8b171 ("mailbox: qcom: Convert APCS IPC driver to use regmap") Signed-off-by:
Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org> Signed-off-by:
Jassi Brar <jaswinder.singh@linaro.org> Signed-off-by:
-
Chao Yu authored
[ Upstream commit 98194030 ] If inode is newly created, inode page may not synchronize with inode cache, so fields like .i_inline or .i_extra_isize could be wrong, in below call path, we may access such wrong fields, result in failing to migrate valid target block. Thread A Thread B - f2fs_create - f2fs_add_link - f2fs_add_dentry - f2fs_init_inode_metadata - f2fs_add_inline_entry - f2fs_new_inode_page - f2fs_put_page : inode page wasn't updated with inode cache - gc_data_segment - is_alive - f2fs_get_node_page - datablock_addr - offset_in_addr : access uninitialized fields Fixes: 7a2af766 ("f2fs: enhance on-disk inode structure scalability") Signed-off-by:
Chao Yu <yuchao0@huawei.com> Signed-off-by:
Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by:
-
Vasundhara Volam authored
[ Upstream commit 57a8730b ] Firmware coredump messages take much longer than standard messages, so increase the timeout accordingly. Fixes: 6c5657d0 ("bnxt_en: Add support for ethtool get dump.") Signed-off-by:
Vasundhara Volam <vasundhara-v.volam@broadcom.com> Signed-off-by:
Michael Chan <michael.chan@broadcom.com> Signed-off-by:
-
Anton Ivanov authored
[ Upstream commit 09ccf036 ] Fix an off-by-one in IRQ enumeration Fixes: 49da7e64 ("High Performance UML Vector Network Driver") Reported by: Dana Johnson <djohns042@gmail.com> Signed-off-by:
Anton Ivanov <anton.ivanov@cambridgegreys.com> Signed-off-by:
Richard Weinberger <richard@nod.at> Signed-off-by:
-
Gerd Rausch authored
[ Upstream commit 05a82481 ] All entries in 'rds_ib_stat_names' are stringified versions of the corresponding "struct rds_ib_statistics" element without the "s_"-prefix. Fix entry 'ib_evt_handler_call' to do the same. Fixes: f4f943c9 ("RDS: IB: ack more receive completions to improve performance") Signed-off-by:
Gerd Rausch <gerd.rausch@oracle.com> Acked-by:
Santosh Shilimkar <santosh.shilimkar@oracle.com> Signed-off-by:
-
Håkon Bugge authored
[ Upstream commit a6e4d254 ] In addr_handler(), assuming status == 0 and the device already has been acquired (id_priv->cma_dev != NULL), we get the following incorrect "error" message: RDMA CM: ADDR_ERROR: failed to resolve IP. status 0 Fixes: 498683c6 ("IB/cma: Add debug messages to error flows") Link: https://lore.kernel.org/r/20190902092731.1055757-1-haakon.bugge@oracle.comSigned-off-by:
Håkon Bugge <haakon.bugge@oracle.com> Reviewed-by:
Jason Gunthorpe <jgg@mellanox.com> Signed-off-by:
-
Nicolas Boichat authored
[ Upstream commit b7139960 ] When the FW bundles multiple packets, pkt->act_len may be incorrect as it refers to the first packet only (however, the FW will only bundle packets that fit into the same pkt->alloc_len). Before this patch, the skb length would be set (incorrectly) to pkt->act_len in ath10k_sdio_mbox_rx_packet, and then later manually adjusted in ath10k_sdio_mbox_rx_process_packet. The first problem is that ath10k_sdio_mbox_rx_process_packet does not use proper skb_put commands to adjust the length (it directly changes skb->len), so we end up with a mismatch between skb->head + skb->tail and skb->data + skb->len. This is quite serious, and causes corruptions in the TCP stack, as the stack tries to coalesce packets, and relies on skb->tail being correct (that is, skb_tail_pointer must point to the first byte_after_ the data). Instead of re-adjusting the size in ath10k_sdio_mbox_rx_process_packet, this moves the code to ath10k_sdio_mbox_rx_packet, and also add a bounds check, as skb_put would crash the kernel if not enough space is available. Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Fixes: 8530b4e7 ("ath10k: sdio: set skb len for all rx packets") Signed-off-by:
Nicolas Boichat <drinkcat@chromium.org> Signed-off-by:
Wen Gong <wgong@codeaurora.org> Signed-off-by:
Kalle Valo <kvalo@codeaurora.org> Signed-off-by:
-
Rashmica Gupta authored
[ Upstream commit 3c4710ae ] The current calculation for the number of GPIO banks is only correct if the number of GPIOs is a multiple of 32 (if there were 31 GPIOs we would currently say there are 0 banks, which is incorrect). Fixes: 361b7911 ('gpio: Add Aspeed driver') Signed-off-by:
Rashmica Gupta <rashmica.g@gmail.com> Reviewed-by:
Andrew Jeffery <andrew@aj.id.au> Link: https://lore.kernel.org/r/20190906062623.13354-1-rashmica.g@gmail.comReviewed-by:
Joel Stanley <joel@jms.d.au> Signed-off-by:
Linus Walleij <linus.walleij@linaro.org> Signed-off-by:
-
Li Jin authored
[ Upstream commit 398a1f50 ] Fix drive strength for AON/CRMU controller; fix pull-up/down setting for CCM/CDRU controller. Fixes: 616043d5 ("pinctrl: Rename gpio driver from cygnus to iproc") Signed-off-by:
Li Jin <li.jin@broadcom.com> Link: https://lore.kernel.org/r/1567054348-19685-2-git-send-email-srinath.mannam@broadcom.comSigned-off-by:
-
Mao Wenan authored
[ Upstream commit 49f6c90b ] sonic_send_packet will be processed in irq or non-irq context, so it would better use dev_kfree_skb_any instead of dev_kfree_skb. Fixes: d9fb9f38 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers") Signed-off-by:
Mao Wenan <maowenan@huawei.com> Signed-off-by:
-
Dan Robertson authored
[ Upstream commit fdc7d8e8 ] Fix an error in the bitmaskfor the shtc1 and shtw1 bitmask used to retrieve the chip ID from the ID register. See section 5.7 of the shtw1 or shtc1 datasheet for details. Fixes: 1a539d37 ("hwmon: add support for Sensirion SHTC1 sensor") Signed-off-by:
Dan Robertson <dan@dlrobertson.com> Link: https://lore.kernel.org/r/20190905014554.21658-3-dan@dlrobertson.com [groeck: Reordered to be first in series and adjusted accordingly] Signed-off-by:
Guenter Roeck <linux@roeck-us.net> Signed-off-by:
-
Firo Yang authored
[ Upstream commit e7ba676c ] In Xen environment, if Xen-swiotlb is enabled, ixgbe driver could possibly allocate a page, DMA memory buffer, for the first fragment which is not suitable for Xen-swiotlb to do DMA operations. Xen-swiotlb have to internally allocate another page for doing DMA operations. This mechanism requires syncing the data from the internal page to the page which ixgbe sends to upper network stack. However, since commit f3213d93 ("ixgbe: Update driver to make use of DMA attributes in Rx path"), the unmap operation is performed with DMA_ATTR_SKIP_CPU_SYNC. As a result, the sync is not performed. Since the sync isn't performed, the upper network stack could receive a incomplete network packet. By incomplete, it means the linear data on the first fragment(between skb->head and skb->end) is invalid. So we have to copy the data from the internal xen-swiotlb page to the page which ixgbe sends to upper network stack through the sync operation. More details from Alexander Duyck: Specifically since we are mapping the frame with DMA_ATTR_SKIP_CPU_SYNC we have to unmap with that as well. As a result a sync is not performed on an unmap and must be done manually as we skipped it for the first frag. As such we need to always sync before possibly performing a page unmap operation. Fixes: f3213d93 ("ixgbe: Update driver to make use of DMA attributes in Rx path") Signed-off-by:
Firo Yang <firo.yang@suse.com> Reviewed-by:
Alexander Duyck <alexander.h.duyck@linux.intel.com> Tested-by:
Andrew Bowers <andrewx.bowers@intel.com> Signed-off-by:
Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by:
-
Omar Sandoval authored
[ Upstream commit c09767a8 ] generic_write_checks() may modify iov_iter_count(), so we must get the count after the call, not before. Using the wrong one has a couple of consequences: 1. We check a longer range in check_can_nocow() for nowait than we're actually writing. 2. We create extra hole extent maps in btrfs_cont_expand(). As far as I can tell, this is harmless, but I might be missing something. These issues are pretty minor, but let's fix it before something more important trips on it. Fixes: edf064e7 ("btrfs: nowait aio support") Reviewed-by:
Josef Bacik <josef@toxicpanda.com> Signed-off-by:
Omar Sandoval <osandov@fb.com> Reviewed-by:
David Sterba <dsterba@suse.com> Signed-off-by:
-
Filipe Manana authored
[ Upstream commit 9d123a35 ] If the caching thread fails to allocate a path, it returns without waking up any cache waiters, leaving them hang forever. Fix this by following the same approach as when we fail to start the caching thread: print an error message, disable inode caching and make the wakers fallback to non-caching mode behaviour (calling btrfs_find_free_objectid()). Fixes: 581bb050 ("Btrfs: Cache free inode numbers in memory") Reviewed-by:
Nikolay Borisov <nborisov@suse.com> Signed-off-by:
Filipe Manana <fdmanana@suse.com> Signed-off-by:
-
Filipe Manana authored
[ Upstream commit a68ebe07 ] If we fail to start the inode caching thread, we print an error message and disable the inode cache, however we never wake up any waiters, so they hang forever waiting for the caching to finish. Fix this by waking them up and have them fallback to a call to btrfs_find_free_objectid(). Fixes: e60efa84 ("Btrfs: avoid triggering bug_on() when we fail to start inode caching task") Reviewed-by:
-
