1. 28 Jul, 2020 23 commits
    • David S. Miller's avatar
      Merge tag 'mlx5-fixes-2020-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux · b5cd55b3
      David S. Miller authored
      Saeed Mahameed says:
      
      ====================
      mlx5 fixes-2020-07-28
      
      This series introduces some fixes to mlx5 driver.
      v1->v2:
       - Drop the "Hold reference on mirred devices" patch, until Or's
         comments are addressed.
       - Imporve "Modify uplink state" patch commit message per Or's request.
      
      Please pull and let me know if there is any problem.
      
      For -Stable:
      
      For -stable v4.9
       ('net/mlx5e: Fix error path of device attach')
      
      For -stable v4.15
       ('net/mlx5: Verify Hardware supports requested ptp function on a given
      pin')
      
      For -stable v5.3
       ('net/mlx5e: Modify uplink state on interface up/down')
      
      For -stable v5.4
       ('net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev')
       ('net/mlx5: E-switch, Destroy TSAR when fail to enable the mode')
      
      For -stable v5.5
       ('net/mlx5: E-switch, Destroy TSAR after reload interface')
      
      For -stable v5.7
       ('net/mlx5: Fix a bug of using ptp channel index as pin index')
      ====================
      Acked-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b5cd55b3
    • David S. Miller's avatar
      Merge branch 'net-lan78xx-fix-NULL-deref-and-memory-leak' · 2ff34c90
      David S. Miller authored
      Johan Hovold says:
      
      ====================
      net: lan78xx: fix NULL deref and memory leak
      
      The first two patches fix a NULL-pointer dereference at probe that can
      be triggered by a malicious device and a small transfer-buffer memory
      leak, respectively.
      
      For another subsystem I would have marked them:
      
      	Cc: stable@vger.kernel.org	# 4.3
      
      The third one replaces the driver's current broken endpoint lookup
      helper, which could end up accepting incomplete interfaces and whose
      results weren't even useeren
      Johan
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2ff34c90
    • Johan Hovold's avatar
      net: lan78xx: replace bogus endpoint lookup · ea060b35
      Johan Hovold authored
      Drop the bogus endpoint-lookup helper which could end up accepting
      interfaces based on endpoints belonging to unrelated altsettings.
      
      Note that the returned bulk pipes and interrupt endpoint descriptor
      were never actually used. Instead the bulk-endpoint numbers are
      hardcoded to 1 and 2 (matching the specification), while the interrupt-
      endpoint descriptor was assumed to be the third descriptor created by
      USB core.
      
      Try to bring some order to this by dropping the bogus lookup helper and
      adding the missing endpoint sanity checks while keeping the interrupt-
      descriptor assumption for now.
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ea060b35
    • Johan Hovold's avatar
      net: lan78xx: fix transfer-buffer memory leak · 63634aa6
      Johan Hovold authored
      The interrupt URB transfer-buffer was never freed on disconnect or after
      probe errors.
      
      Fixes: 55d7de9d ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
      Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      63634aa6
    • Johan Hovold's avatar
      net: lan78xx: add missing endpoint sanity check · 8d8e95fd
      Johan Hovold authored
      Add the missing endpoint sanity check to prevent a NULL-pointer
      dereference should a malicious device lack the expected endpoints.
      
      Note that the driver has a broken endpoint-lookup helper,
      lan78xx_get_endpoints(), which can end up accepting interfaces in an
      altsetting without endpoints as long as *some* altsetting has a bulk-in
      and a bulk-out endpoint.
      
      Fixes: 55d7de9d ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
      Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8d8e95fd
    • Rustam Kovhaev's avatar
      usb: hso: check for return value in hso_serial_common_create() · e911e99a
      Rustam Kovhaev authored
      in case of an error tty_register_device_attr() returns ERR_PTR(),
      add IS_ERR() check
      
      Reported-and-tested-by: syzbot+67b2bd0e34f952d0321e@syzkaller.appspotmail.com
      Link: https://syzkaller.appspot.com/bug?extid=67b2bd0e34f952d0321eSigned-off-by: default avatarRustam Kovhaev <rkovhaev@gmail.com>
      Reviewed-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e911e99a
    • Alaa Hleihel's avatar
      net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev · 350a6324
      Alaa Hleihel authored
      After the cited commit, function 'mlx5_eswitch_set_vport_vlan' started
      to acquire esw->state_lock.
      However, esw is not defined for VF devices, hence attempting to set vf
      VLANID on a VF dev will cause a kernel panic.
      
      Fix it by moving up the (redundant) esw validation from function
      '__mlx5_eswitch_set_vport_vlan' since the rest of the callers now have
      and use a valid esw.
      
      For example with vf device eth4:
       # ip link set dev eth4 vf 0 vlan 0
      
      Trace of the panic:
       [  411.409842] BUG: unable to handle page fault for address: 00000000000011b8
       [  411.449745] #PF: supervisor read access in kernel mode
       [  411.452348] #PF: error_code(0x0000) - not-present page
       [  411.454938] PGD 80000004189c9067 P4D 80000004189c9067 PUD 41899a067 PMD 0
       [  411.458382] Oops: 0000 [#1] SMP PTI
       [  411.460268] CPU: 4 PID: 5711 Comm: ip Not tainted 5.8.0-rc4_for_upstream_min_debug_2020_07_08_22_04 #1
       [  411.462447] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
       [  411.464158] RIP: 0010:__mutex_lock+0x4e/0x940
       [  411.464928] Code: fd 41 54 49 89 f4 41 52 53 89 d3 48 83 ec 70 44 8b 1d ee 03 b0 01 65 48 8b 04 25 28 00 00 00 48 89 45 c8 31 c0 45 85 db 75 0a <48> 3b 7f 60 0f 85 7e 05 00 00 49 8d 45 68 41 56 41 b8 01 00 00 00
       [  411.467678] RSP: 0018:ffff88841fcd74b0 EFLAGS: 00010246
       [  411.468562] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
       [  411.469715] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000001158
       [  411.470812] RBP: ffff88841fcd7550 R08: ffffffffa00fa1ce R09: 0000000000000000
       [  411.471835] R10: ffff88841fcd7570 R11: 0000000000000000 R12: 0000000000000002
       [  411.472862] R13: 0000000000001158 R14: ffffffffa00fa1ce R15: 0000000000000000
       [  411.474004] FS:  00007faee7ca6b80(0000) GS:ffff88846fc00000(0000) knlGS:0000000000000000
       [  411.475237] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       [  411.476129] CR2: 00000000000011b8 CR3: 000000041909c006 CR4: 0000000000360ea0
       [  411.477260] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
       [  411.478340] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
       [  411.479332] Call Trace:
       [  411.479760]  ? __nla_validate_parse.part.6+0x57/0x8f0
       [  411.482825]  ? mlx5_eswitch_set_vport_vlan+0x3e/0xa0 [mlx5_core]
       [  411.483804]  mlx5_eswitch_set_vport_vlan+0x3e/0xa0 [mlx5_core]
       [  411.484733]  mlx5e_set_vf_vlan+0x41/0x50 [mlx5_core]
       [  411.485545]  do_setlink+0x613/0x1000
       [  411.486165]  __rtnl_newlink+0x53d/0x8c0
       [  411.486791]  ? mark_held_locks+0x49/0x70
       [  411.487429]  ? __lock_acquire+0x8fe/0x1eb0
       [  411.488085]  ? rcu_read_lock_sched_held+0x52/0x60
       [  411.488998]  ? kmem_cache_alloc_trace+0x16d/0x2d0
       [  411.489759]  rtnl_newlink+0x47/0x70
       [  411.490357]  rtnetlink_rcv_msg+0x24e/0x450
       [  411.490978]  ? netlink_deliver_tap+0x92/0x3d0
       [  411.491631]  ? validate_linkmsg+0x330/0x330
       [  411.492262]  netlink_rcv_skb+0x47/0x110
       [  411.492852]  netlink_unicast+0x1ac/0x270
       [  411.493551]  netlink_sendmsg+0x336/0x450
       [  411.494209]  sock_sendmsg+0x30/0x40
       [  411.494779]  ____sys_sendmsg+0x1dd/0x1f0
       [  411.495378]  ? copy_msghdr_from_user+0x5c/0x90
       [  411.496082]  ___sys_sendmsg+0x87/0xd0
       [  411.496683]  ? lock_acquire+0xb9/0x3a0
       [  411.497322]  ? lru_cache_add+0x5/0x170
       [  411.497944]  ? find_held_lock+0x2d/0x90
       [  411.498568]  ? handle_mm_fault+0xe46/0x18c0
       [  411.499205]  ? __sys_sendmsg+0x51/0x90
       [  411.499784]  __sys_sendmsg+0x51/0x90
       [  411.500341]  do_syscall_64+0x59/0x2e0
       [  411.500938]  ? asm_exc_page_fault+0x8/0x30
       [  411.501609]  ? rcu_read_lock_sched_held+0x52/0x60
       [  411.502350]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
       [  411.503093] RIP: 0033:0x7faee73b85a7
       [  411.503654] Code: Bad RIP value.
      
      Fixes: 0e18134f ("net/mlx5e: Eswitch, use state_lock to synchronize vlan change")
      Signed-off-by: default avatarAlaa Hleihel <alaa@mellanox.com>
      Reviewed-by: default avatarRoi Dayan <roid@mellanox.com>
      Reviewed-by: default avatarVlad Buslov <vladbu@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      350a6324
    • Ron Diskin's avatar
      net/mlx5e: Modify uplink state on interface up/down · 7d0314b1
      Ron Diskin authored
      When setting the PF interface up/down, notify the firmware to update
      uplink state via MODIFY_VPORT_STATE, when E-Switch is enabled.
      
      This behavior will prevent sending traffic out on uplink port when PF is
      down, such as sending traffic from a VF interface which is still up.
      Currently when calling mlx5e_open/close(), the driver only sends PAOS
      command to notify the firmware to set the physical port state to
      up/down, however, it is not sufficient. When VF is in "auto" state, it
      follows the uplink state, which was not updated on mlx5e_open/close()
      before this patch.
      
      When switchdev mode is enabled and uplink representor is first enabled,
      set the uplink port state value back to its FW default "AUTO".
      
      Fixes: 63bfd399 ("net/mlx5e: Send PAOS command on interface up/down")
      Signed-off-by: default avatarRon Diskin <rondi@mellanox.com>
      Reviewed-by: default avatarRoi Dayan <roid@mellanox.com>
      Reviewed-by: default avatarMoshe Shemesh <moshe@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      7d0314b1
    • Eran Ben Elisha's avatar
      net/mlx5: Query PPS pin operational status before registering it · ed56d749
      Eran Ben Elisha authored
      In a special configuration, a ConnectX6-Dx pin pps-out might be activated
      when driver is loaded. Fix the driver to always read the operational pin
      mode when registering it, and advertise it accordingly.
      
      Fixes: ee7f1220 ("net/mlx5e: Implement 1PPS support")
      Signed-off-by: default avatarEran Ben Elisha <eranbe@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      ed56d749
    • Raed Salem's avatar
      net/mlx5e: Fix slab-out-of-bounds in mlx5e_rep_is_lag_netdev · 21083309
      Raed Salem authored
      mlx5e_rep_is_lag_netdev is used as first check as part of netdev events
      handler for bond device of non-uplink representors, this handler can get
      any netdevice under the same network namespace of mlx5e netdevice. Current
      code treats the netdev as mlx5e netdev and only later on verifies this,
      hence causes the following Kasan trace:
      [15402.744990] ==================================================================
      [15402.746942] BUG: KASAN: slab-out-of-bounds in mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
      [15402.749009] Read of size 8 at addr ffff880391f3f6b0 by task ovs-vswitchd/5347
      
      [15402.752065] CPU: 7 PID: 5347 Comm: ovs-vswitchd Kdump: loaded Tainted: G    B      O     --------- -t - 4.18.0-g3dcc204d291d-dirty #1
      [15402.755349] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
      [15402.757600] Call Trace:
      [15402.758968]  dump_stack+0x71/0xab
      [15402.760427]  print_address_description+0x6a/0x270
      [15402.761969]  kasan_report+0x179/0x2d0
      [15402.763445]  ? mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
      [15402.765121]  mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
      [15402.766782]  mlx5e_rep_esw_bond_netevent+0x129/0x620 [mlx5_core]
      
      Fix by deferring the violating access to be post the netdev verify check.
      
      Fixes: 7e51891a ("net/mlx5e: Use netdev events to set/del egress acl forward-to-vport rule")
      Signed-off-by: default avatarRaed Salem <raeds@mellanox.com>
      Reviewed-by: default avatarRoi Dayan <roid@mellanox.com>
      Reviewed-by: default avatarVu Pham <vuhuong@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      21083309
    • Eran Ben Elisha's avatar
      net/mlx5: Verify Hardware supports requested ptp function on a given pin · 071995c8
      Eran Ben Elisha authored
      Fix a bug where driver did not verify Hardware pin capabilities for
      PTP functions.
      
      Fixes: ee7f1220 ("net/mlx5e: Implement 1PPS support")
      Signed-off-by: default avatarEran Ben Elisha <eranbe@mellanox.com>
      Reviewed-by: default avatarAriel Levkovich <lariel@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      071995c8
    • Eran Ben Elisha's avatar
      net/mlx5: Fix a bug of using ptp channel index as pin index · 88c8cf92
      Eran Ben Elisha authored
      On PTP mlx5_ptp_enable(on=0) flow, driver mistakenly used channel index
      as pin index.
      
      After ptp patch marked in fixes tag was introduced, driver can freely
      call ptp_find_pin() as part of the .enable() callback.
      
      Fix driver mlx5_ptp_enable(on=0) flow to always use ptp_find_pin(). With
      that, Driver will use the correct pin index in mlx5_ptp_enable(on=0) flow.
      
      In addition, when initializing the pins, always set channel to zero. As
      all pins can be attached to all channels, let ptp_set_pinfunc() to move
      them between the channels.
      
      For stable branches, this fix to be applied only on kernels that includes
      both patches in fixes tag. Otherwise, mlx5_ptp_enable(on=0) will be stuck
      on pincfg_mux.
      
      Fixes: 62582a7e ("ptp: Avoid deadlocks in the programmable pin code.")
      Fixes: ee7f1220 ("net/mlx5e: Implement 1PPS support")
      Signed-off-by: default avatarEran Ben Elisha <eranbe@mellanox.com>
      Reviewed-by: default avatarAriel Levkovich <lariel@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      88c8cf92
    • Maor Dickman's avatar
      net/mlx5e: Fix missing cleanup of ethtool steering during rep rx cleanup · 0e2e7aa5
      Maor Dickman authored
      The cited commit add initialization of ethtool steering during
      representor rx initializations without cleaning it up in representor
      rx cleanup, this may cause for stale ethtool flows to remain after
      moving back from switchdev mode to legacy mode.
      
      Fixed by calling ethtool steering cleanup during rep rx cleanup.
      
      Fixes: 6783e8b2 ("net/mlx5e: Init ethtool steering for representors")
      Signed-off-by: default avatarMaor Dickman <maord@mellanox.com>
      Reviewed-by: default avatarRoi Dayan <roid@mellanox.com>
      Reviewed-by: default avatarVlad Buslov <vladbu@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      0e2e7aa5
    • Aya Levin's avatar
      net/mlx5e: Fix error path of device attach · 5cd39b6e
      Aya Levin authored
      On failure to attach the netdev, fix the rollback by re-setting the
      device's state back to MLX5E_STATE_DESTROYING.
      
      Failing to attach doesn't stop statistics polling via .ndo_get_stats64.
      In this case, although the device is not attached, it falsely continues
      to query the firmware for counters. Setting the device's state back to
      MLX5E_STATE_DESTROYING prevents the firmware counters query.
      
      Fixes: 26e59d80 ("net/mlx5e: Implement mlx5e interface attach/detach callbacks")
      Signed-off-by: default avatarAya Levin <ayal@mellanox.com>
      Reviewed-by: default avatarTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      5cd39b6e
    • Maor Gottlieb's avatar
      net/mlx5: Fix forward to next namespace · 59f8f7c8
      Maor Gottlieb authored
      The steering tree is as follow (nic RX as example):
      		   ---------
                         |root_ns|
      		   ---------
      			|
            	--------------------------------
          	|		|	       |
         ---------- 	   ----------      ---------
         |p(prio)0|	   |   p1   |      |   pn  |
         ----------	   ----------	   ---------
              |		|
       ----------------  ---------------
       |ns(e.g bypass)|  |ns(e.g. lag) |
       ----------------  ---------------
        |     |    |
      ----  ----  ----
      |p0|  |p1|  |pn|
      ----  ----  ----
       |
      ----
      |FT|
      ----
      
      find_next_chained_ft(prio) returns the first flow table in the next
      priority. If prio is a parent of a flow table then it returns the first
      flow table in the next priority in the same namespace, else if prio
      is parent of namespace, then it should return the first flow table
      in the next namespace. Currently if the user requests to forward to
      next namespace, the code calls to find_next_chained_ft with the prio
      of the next namespace and not the prio of the namesapce itself.
      
      Fixes: 9254f8ed ("net/mlx5: Add support in forward to namespace")
      Signed-off-by: default avatarMaor Gottlieb <maorg@mellanox.com>
      Reviewed-by: default avatarMark Bloch <markb@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      59f8f7c8
    • Parav Pandit's avatar
      net/mlx5: E-switch, Destroy TSAR after reload interface · 0c2600c6
      Parav Pandit authored
      When eswitch offloads is enabled, TSAR is created before reloading
      the interfaces.
      However when eswitch offloads mode is disabled, TSAR is disabled before
      reloading the interfaces.
      
      To keep the eswitch enable/disable sequence as mirror, destroy TSAR
      after reloading the interfaces.
      
      Fixes: 1bd27b11 ("net/mlx5: Introduce E-switch QoS management")
      Signed-off-by: default avatarParav Pandit <parav@mellanox.com>
      Reviewed-by: default avatarRoi Dayan <roid@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      0c2600c6
    • Parav Pandit's avatar
      net/mlx5: E-switch, Destroy TSAR when fail to enable the mode · 2b8e9c7c
      Parav Pandit authored
      When either esw_legacy_enable() or esw_offloads_enable() fails,
      code missed to destroy the created TSAR.
      
      Hence, add the missing call to destroy the TSAR.
      
      Fixes: 610090eb ("net/mlx5: E-switch, Initialize TSAR Qos hardware block before its user vports")
      Signed-off-by: default avatarParav Pandit <parav@mellanox.com>
      Reviewed-by: default avatarRoi Dayan <roid@mellanox.com>
      Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
      2b8e9c7c
    • David S. Miller's avatar
      Merge branch 'hns3-fixes' · 7a9212d1
      David S. Miller authored
      Huazhong Tan says:
      
      ====================
      net: hns3: fixes for -net
      
      There are some bugfixes for the HNS3 ethernet driver. patch#1 fixes
      a desc filling bug, patch#2 fixes a false TX timeout issue, and
      patch#3~#5 fixes some bugs related to VLAN and FD.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7a9212d1
    • Guojia Liao's avatar
      net: hns3: fix for VLAN config when reset failed · b7b5d25b
      Guojia Liao authored
      When device is resetting or reset failed, firmware is unable to
      handle mailbox. VLAN should not be configured in this case.
      
      Fixes: fe4144d4 ("net: hns3: sync VLAN filter entries when kill VLAN ID failed")
      Signed-off-by: default avatarGuojia Liao <liaoguojia@huawei.com>
      Signed-off-by: default avatarHuazhong Tan <tanhuazhong@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b7b5d25b
    • Guojia Liao's avatar
      net: hns3: fix aRFS FD rules leftover after add a user FD rule · efe3fa45
      Guojia Liao authored
      When user had created a FD rule, all the aRFS rules should be clear up.
      HNS3 process flow as below:
      1.get spin lock of fd_ruls_list
      2.clear up all aRFS rules
      3.release lock
      4.get spin lock of fd_ruls_list
      5.creat a rules
      6.release lock;
      
      There is a short period of time between step 3 and step 4, which would
      creatting some new aRFS FD rules if driver was receiving packet.
      So refactor the fd_rule_lock to fix it.
      
      Fixes: 44122887 ("net: hns3: refine the flow director handle")
      Signed-off-by: default avatarGuojia Liao <liaoguojia@huawei.com>
      Signed-off-by: default avatarHuazhong Tan <tanhuazhong@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      efe3fa45
    • Jian Shen's avatar
      net: hns3: add reset check for VF updating port based VLAN · a6f7bfdc
      Jian Shen authored
      Currently hclgevf_update_port_base_vlan_info() may be called when
      VF is resetting,  which may cause hns3_nic_net_open() being called
      twice unexpectedly.
      
      So fix it by adding a reset check for it, and extend critical
      region for rntl_lock in hclgevf_update_port_base_vlan_info().
      
      Fixes: 92f11ea1 ("net: hns3: fix set port based VLAN issue for VF")
      Signed-off-by: default avatarJian Shen <shenjian15@huawei.com>
      Signed-off-by: default avatarHuazhong Tan <tanhuazhong@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a6f7bfdc
    • Yonglong Liu's avatar
      net: hns3: fix a TX timeout issue · a7e90ee5
      Yonglong Liu authored
      When the queue depth and queue parameters are modified, there is
      a low probability that TX timeout occurs. The two operations cause
      the link to be down or up when the watchdog is still working. All
      queues are stopped when the link is down. After the carrier is on,
      all queues are woken up. If the watchdog detects the link between
      the carrier on and wakeup queues, a false TX timeout occurs.
      
      So fix this issue by modifying the sequence of carrier on and queue
      wakeup, which is symmetrical to the link down action.
      
      Fixes: 76ad4f0e ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
      Signed-off-by: default avatarYonglong Liu <liuyonglong@huawei.com>
      Signed-off-by: default avatarHuazhong Tan <tanhuazhong@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a7e90ee5
    • Yunsheng Lin's avatar
      net: hns3: fix desc filling bug when skb is expanded or lineared · cfdaeba5
      Yunsheng Lin authored
      The linear and frag data part may be changed when the skb is expanded
      or lineared in skb_cow_head() or skb_checksum_help(), which is called
      by hns3_fill_skb_desc(), so the linear len return by skb_headlen()
      before the calling of hns3_fill_skb_desc() is unreliable.
      
      Move hns3_fill_skb_desc() before the calling of skb_headlen() to fix
      this bug.
      
      Fixes: 76ad4f0e ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
      Signed-off-by: default avatarYunsheng Lin <linyunsheng@huawei.com>
      Signed-off-by: default avatarHuazhong Tan <tanhuazhong@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cfdaeba5
  2. 27 Jul, 2020 8 commits
  3. 25 Jul, 2020 9 commits
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-linus-5.8-rc7' of... · 04300d66
      Linus Torvalds authored
      Merge tag 'riscv-for-linus-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux into master
      
      Pull RISC-V fixes from Palmer Dabbelt:
       "A few more fixes this week:
      
         - A fix to avoid using SBI calls during kasan initialization, as the
           SBI calls themselves have not been probed yet.
      
         - Three fixes related to systems with multiple memory regions"
      
      * tag 'riscv-for-linus-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
        riscv: Parse all memory blocks to remove unusable memory
        RISC-V: Do not rely on initrd_start/end computed during early dt parsing
        RISC-V: Set maximum number of mapped pages correctly
        riscv: kasan: use local_tlb_flush_all() to avoid uninitialized __sbi_rfence
      04300d66
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2020-07-25' of... · fbe0d451
      Linus Torvalds authored
      Merge tag 'x86-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull x86 fixes from Ingo Molnar:
       "Misc fixes:
      
         - Fix a section end page alignment assumption that was causing
           crashes
      
         - Fix ORC unwinding on freshly forked tasks which haven't executed
           yet and which have empty user task stacks
      
         - Fix the debug.exception-trace=1 sysctl dumping of user stacks,
           which was broken by recent maccess changes"
      
      * tag 'x86-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/dumpstack: Dump user space code correctly again
        x86/stacktrace: Fix reliable check for empty user task stacks
        x86/unwind/orc: Fix ORC for newly forked tasks
        x86, vmlinux.lds: Page-align end of ..page_aligned sections
      fbe0d451
    • Linus Torvalds's avatar
      Merge tag 'perf-urgent-2020-07-25' of... · 78b1afe2
      Linus Torvalds authored
      Merge tag 'perf-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull uprobe fix from Ingo Molnar:
       "Fix an interaction/regression between uprobes based shared library
        tracing & GDB"
      
      * tag 'perf-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
      78b1afe2
    • Linus Torvalds's avatar
      Merge tag 'timers-urgent-2020-07-25' of... · a7b36c2b
      Linus Torvalds authored
      Merge tag 'timers-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull timer fix from Ingo Molnar:
       "Fix a suspend/resume regression (crash) on TI AM3/AM4 SoC's"
      
      * tag 'timers-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        clocksource/drivers/timer-ti-dm: Fix suspend and resume for am3 and am4
      a7b36c2b
    • Linus Torvalds's avatar
      Merge tag 'sched-urgent-2020-07-25' of... · 3077805e
      Linus Torvalds authored
      Merge tag 'sched-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull scheduler fixes from Ingo Molnar:
       "Fix a race introduced by the recent loadavg race fix, plus add a debug
        check for a hard to debug case of bogus wakeup function flags"
      
      * tag 'sched-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched: Warn if garbage is passed to default_wake_function()
        sched: Fix race against ptrace_freeze_trace()
      3077805e
    • Linus Torvalds's avatar
      Merge tag 'efi-urgent-2020-07-25' of... · 17baa442
      Linus Torvalds authored
      Merge tag 'efi-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull EFI fixes from Ingo Molnar:
       "Various EFI fixes:
      
         - Fix the layering violation in the use of the EFI runtime services
           availability mask in users of the 'efivars' abstraction
      
         - Revert build fix for GCC v4.8 which is no longer supported
      
         - Clean up some x86 EFI stub details, some of which are borderline
           bugs that copy around garbage into padding fields - let's fix these
           out of caution.
      
         - Fix build issues while working on RISC-V support
      
         - Avoid --whole-archive when linking the stub on arm64"
      
      * tag 'efi-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        efi: Revert "efi/x86: Fix build with gcc 4"
        efi/efivars: Expose RT service availability via efivars abstraction
        efi/libstub: Move the function prototypes to header file
        efi/libstub: Fix gcc error around __umoddi3 for 32 bit builds
        efi/libstub/arm64: link stub lib.a conditionally
        efi/x86: Only copy upto the end of setup_header
        efi/x86: Remove unused variables
      17baa442
    • Linus Torvalds's avatar
      Merge tag '5.8-rc6-cifs-fix' of git://git.samba.org/sfrench/cifs-2.6 into master · 7cb3a5c5
      Linus Torvalds authored
      Pull cifs fix from Steve French:
       "A fix for a recently discovered regression in rename to older servers
        caused by a recent patch"
      
      * tag '5.8-rc6-cifs-fix' of git://git.samba.org/sfrench/cifs-2.6:
        Revert "cifs: Fix the target file was deleted when rename failed."
      7cb3a5c5
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net into master · 1b64b2e2
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix RCU locaking in iwlwifi, from Johannes Berg.
      
       2) mt76 can access uninitialized NAPI struct, from Felix Fietkau.
      
       3) Fix race in updating pause settings in bnxt_en, from Vasundhara
          Volam.
      
       4) Propagate error return properly during unbind failures in ax88172a,
          from George Kennedy.
      
       5) Fix memleak in adf7242_probe, from Liu Jian.
      
       6) smc_drv_probe() can leak, from Wang Hai.
      
       7) Don't muck with the carrier state if register_netdevice() fails in
          the bonding driver, from Taehee Yoo.
      
       8) Fix memleak in dpaa_eth_probe, from Liu Jian.
      
       9) Need to check skb_put_padto() return value in hsr_fill_tag(), from
          Murali Karicheri.
      
      10) Don't lose ionic RSS hash settings across FW update, from Shannon
          Nelson.
      
      11) Fix clobbered SKB control block in act_ct, from Wen Xu.
      
      12) Missing newlink in "tx_timeout" sysfs output, from Xiongfeng Wang.
      
      13) IS_UDPLITE cleanup a long time ago, incorrectly handled
          transformations involving UDPLITE_RECV_CC. From Miaohe Lin.
      
      14) Unbalanced locking in netdevsim, from Taehee Yoo.
      
      15) Suppress false-positive error messages in qed driver, from Alexander
          Lobakin.
      
      16) Out of bounds read in ax25_connect and ax25_sendmsg, from Peilin Ye.
      
      17) Missing SKB release in cxgb4's uld_send(), from Navid Emamdoost.
      
      18) Uninitialized value in geneve_changelink(), from Cong Wang.
      
      19) Fix deadlock in xen-netfront, from Andera Righi.
      
      19) flush_backlog() frees skbs with IRQs disabled, so should use
          dev_kfree_skb_irq() instead of kfree_skb(). From Subash Abhinov
          Kasiviswanathan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (111 commits)
        drivers/net/wan: lapb: Corrected the usage of skb_cow
        dev: Defer free of skbs in flush_backlog
        qrtr: orphan socket in qrtr_release()
        xen-netfront: fix potential deadlock in xennet_remove()
        flow_offload: Move rhashtable inclusion to the source file
        geneve: fix an uninitialized value in geneve_changelink()
        bonding: check return value of register_netdevice() in bond_newlink()
        tcp: allow at most one TLP probe per flight
        AX.25: Prevent integer overflows in connect and sendmsg
        cxgb4: add missing release on skb in uld_send()
        net: atlantic: fix PTP on AQC10X
        AX.25: Prevent out-of-bounds read in ax25_sendmsg()
        sctp: shrink stream outq when fails to do addstream reconf
        sctp: shrink stream outq only when new outcnt < old outcnt
        AX.25: Fix out-of-bounds read in ax25_connect()
        enetc: Remove the mdio bus on PF probe bailout
        net: ethernet: ti: add NETIF_F_HW_TC hw feature flag for taprio offload
        net: ethernet: ave: Fix error returns in ave_init
        drivers/net/wan/x25_asy: Fix to make it work
        ipvs: fix the connection sync failed in some cases
        ...
      1b64b2e2
    • Atish Patra's avatar
      riscv: Parse all memory blocks to remove unusable memory · fa5a1983
      Atish Patra authored
      Currently, maximum physical memory allowed is equal to -PAGE_OFFSET.
      That's why we remove any memory blocks spanning beyond that size. However,
      it is done only for memblock containing linux kernel which will not work
      if there are multiple memblocks.
      
      Process all memory blocks to figure out how much memory needs to be removed
      and remove at the end instead of updating the memblock list in place.
      Signed-off-by: default avatarAtish Patra <atish.patra@wdc.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      fa5a1983