1. 22 Mar, 2018 32 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c4f4d2f9
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Always validate XFRM esn replay attribute, from Florian Westphal.
      
       2) Fix RCU read lock imbalance in xfrm_get_tos(), from Xin Long.
      
       3) Don't try to get firmware dump if not loaded in iwlwifi, from Shaul
          Triebitz.
      
       4) Fix BPF helpers to deal with SCTP GSO SKBs properly, from Daniel
          Axtens.
      
       5) Fix some interrupt handling issues in e1000e driver, from Benjamin
          Poitier.
      
       6) Use strlcpy() in several ethtool get_strings methods, from Florian
          Fainelli.
      
       7) Fix rhlist dup insertion, from Paul Blakey.
      
       8) Fix SKB leak in netem packet scheduler, from Alexey Kodanev.
      
       9) Fix driver unload crash when link is up in smsc911x, from Jeremy
          Linton.
      
      10) Purge out invalid socket types in l2tp_tunnel_create(), from Eric
          Dumazet.
      
      11) Need to purge the write queue when TCP connections are aborted,
          otherwise userspace using MSG_ZEROCOPY can't close the fd. From
          Soheil Hassas Yeganeh.
      
      12) Fix double free in error path of team driver, from Arkadi
          Sharshevsky.
      
      13) Filter fixes for hv_netvsc driver, from Stephen Hemminger.
      
      14) Fix non-linear packet access in ipv6 ndisc code, from Lorenzo
          Bianconi.
      
      15) Properly filter out unsupported feature flags in macvlan driver,
          from Shannon Nelson.
      
      16) Don't request loading the diag module for a protocol if the protocol
          itself is not even registered. From Xin Long.
      
      17) If datagram connect fails in ipv6, make sure the socket state is
          consistent afterwards. From Paolo Abeni.
      
      18) Use after free in qed driver, from Dan Carpenter.
      
      19) If received ipv4 PMTU is less than the min pmtu, lock the mtu in the
          entry. From Sabrina Dubroca.
      
      20) Fix sleep in atomic in tg3 driver, from Jonathan Toppins.
      
      21) Fix vlan in vlan untagging in some situations, from Toshiaki Makita.
      
      22) Fix double SKB free in genlmsg_mcast(). From Nicolas Dichtel.
      
      23) Fix NULL derefs in error paths of tcf_*_init(), from Davide Caratti.
      
      24) Unbalanced PM runtime calls in FEC driver, from Florian Fainelli.
      
      25) Memory leak in gemini driver, from Igor Pylypiv.
      
      26) IDR leaks in error paths of tcf_*_init() functions, from Davide
          Caratti.
      
      27) Need to use GFP_ATOMIC in seg6_build_state(), from David Lebrun.
      
      28) Missing dev_put() in error path of macsec_newlink(), from Dan
          Carpenter.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (201 commits)
        macsec: missing dev_put() on error in macsec_newlink()
        net: dsa: Fix functional dsa-loop dependency on FIXED_PHY
        hv_netvsc: common detach logic
        hv_netvsc: change GPAD teardown order on older versions
        hv_netvsc: use RCU to fix concurrent rx and queue changes
        hv_netvsc: disable NAPI before channel close
        net/ipv6: Handle onlink flag with multipath routes
        ppp: avoid loop in xmit recursion detection code
        ipv6: sr: fix NULL pointer dereference when setting encap source address
        ipv6: sr: fix scheduling in RCU when creating seg6 lwtunnel state
        net: aquantia: driver version bump
        net: aquantia: Implement pci shutdown callback
        net: aquantia: Allow live mac address changes
        net: aquantia: Add tx clean budget and valid budget handling logic
        net: aquantia: Change inefficient wait loop on fw data reads
        net: aquantia: Fix a regression with reset on old firmware
        net: aquantia: Fix hardware reset when SPI may rarely hangup
        s390/qeth: on channel error, reject further cmd requests
        s390/qeth: lock read device while queueing next buffer
        s390/qeth: when thread completes, wake up all waiters
        ...
      c4f4d2f9
    • Linus Torvalds's avatar
      Merge tag 'mmc-v4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 9ce20788
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
       "A couple of MMC fixes intended for v4.16-rc7:
      
        MMC host:
      
         - dw_mmc: Fix the suspend/resume issue for Exynos5433
      
         - dw_mmc: Fix the DTO/CTO timeout overflow calculation for 32-bit
           systems
      
         - dw_mmc: Make PIO mode work when failing with idmac when
           dw_mci_reset occurs
      
         - sdhci-acpi: Re-allow IRQ 0 to fix broken probe
      
        MMC core:
      
         - Update EXT_CSD caches to correctly switch partition for ioctl calls
      
         - Fix tracepoint print of blk_addr and blksz
      
         - Disable HPI on broken Micron (Numonyx) eMMC cards"
      
      * tag 'mmc-v4.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: sdhci-acpi: Fix IRQ 0
        mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
        mmc: core: Fix tracepoint print of blk_addr and blksz
        mmc: core: Disable HPI for certain Micron (Numonyx) eMMC cards
        mmc: dw_mmc: exynos: fix the suspend/resume issue for exynos5433
        mmc: block: fix updating ext_csd caches on ioctl call
        mmc: dw_mmc: Fix the DTO/CTO timeout overflow calculation for 32-bit systems
      9ce20788
    • Dan Carpenter's avatar
      macsec: missing dev_put() on error in macsec_newlink() · 5dcd8400
      Dan Carpenter authored
      We moved the dev_hold(real_dev); call earlier in the function but forgot
      to update the error paths.
      
      Fixes: 0759e552 ("macsec: fix negative refcnt on parent link")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5dcd8400
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2018-03-21' of... · e0645d9b
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2018-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      Two more fixes (in three patches):
       * ath9k_htc doesn't like QoS NDP frames, use regular ones
       * hwsim: set up wmediumd for radios created later
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e0645d9b
    • Florian Fainelli's avatar
      net: dsa: Fix functional dsa-loop dependency on FIXED_PHY · 40013ff2
      Florian Fainelli authored
      We have a functional dependency on the FIXED_PHY MDIO bus because we register
      fixed PHY devices "the old way" which only works if the code that does this has
      had a chance to run before the fixed MDIO bus is probed. Make sure we account
      for that and have dsa_loop_bdinfo.o be either built-in or modular depending on
      whether CONFIG_FIXED_PHY reflects that too.
      
      Fixes: 98cd1552 ("net: dsa: Mock-up driver")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      40013ff2
    • David S. Miller's avatar
      Merge branch 'hv_netvsc-fix-races-during-shutdown-and-changes' · 53e82697
      David S. Miller authored
      Stephen Hemminger says:
      
      ====================
      hv_netvsc: fix races during shutdown and changes
      
      This set of patches fixes issues identified by Vitaly Kuznetsov and
      Mohammed Gamal related to state changes in Hyper-v network driver.
      
      A lot of the issues are because setting up the netvsc device requires
      a second step (in work queue) to get all the sub-channels running.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      53e82697
    • Stephen Hemminger's avatar
      hv_netvsc: common detach logic · 7b2ee50c
      Stephen Hemminger authored
      Make common function for detaching internals of device
      during changes to MTU and RSS. Make sure no more packets
      are transmitted and all packets have been received before
      doing device teardown.
      
      Change the wait logic to be common and use usleep_range().
      
      Changes transmit enabling logic so that transmit queues are disabled
      during the period when lower device is being changed. And enabled
      only after sub channels are setup. This avoids issue where it could
      be that a packet was being sent while subchannel was not initialized.
      
      Fixes: 8195b139 ("hv_netvsc: fix deadlock on hotplug")
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7b2ee50c
    • Stephen Hemminger's avatar
      hv_netvsc: change GPAD teardown order on older versions · 0ef58b0a
      Stephen Hemminger authored
      On older versions of Windows, the host ignores messages after
      vmbus channel is closed.
      
      Workaround this by doing what Windows does and send the teardown
      before close on older versions of NVSP protocol.
      Reported-by: default avatarMohammed Gamal <mgamal@redhat.com>
      Fixes: 0cf73780 ("hv_netvsc: netvsc_teardown_gpadl() split")
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0ef58b0a
    • Stephen Hemminger's avatar
      hv_netvsc: use RCU to fix concurrent rx and queue changes · 02400fce
      Stephen Hemminger authored
      The receive processing may continue to happen while the
      internal network device state is in RCU grace period.
      The internal RNDIS structure is associated with the
      internal netvsc_device structure; both have the same
      RCU lifetime.
      
      Defer freeing all associated parts until after grace
      period.
      
      Fixes: 0cf73780 ("hv_netvsc: netvsc_teardown_gpadl() split")
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      02400fce
    • Stephen Hemminger's avatar
      hv_netvsc: disable NAPI before channel close · 8348e046
      Stephen Hemminger authored
      This makes sure that no CPU is still process packets when
      the channel is closed.
      
      Fixes: 76bb5db5 ("netvsc: fix use after free on module removal")
      Signed-off-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8348e046
    • David Ahern's avatar
      net/ipv6: Handle onlink flag with multipath routes · 68e2ffde
      David Ahern authored
      For multipath routes the ONLINK flag can be specified per nexthop in
      rtnh_flags or globally in rtm_flags. Update ip6_route_multipath_add
      to consider the ONLINK setting coming from rtnh_flags. Each loop over
      nexthops the config for the sibling route is initialized to the global
      config and then per nexthop settings overlayed. The flag is 'or'ed into
      fib6_config to handle the ONLINK flag coming from either rtm_flags or
      rtnh_flags.
      
      Fixes: fc1e64e1 ("net/ipv6: Add support for onlink flag")
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      68e2ffde
    • Guillaume Nault's avatar
      ppp: avoid loop in xmit recursion detection code · 6d066734
      Guillaume Nault authored
      We already detect situations where a PPP channel sends packets back to
      its upper PPP device. While this is enough to avoid deadlocking on xmit
      locks, this doesn't prevent packets from looping between the channel
      and the unit.
      
      The problem is that ppp_start_xmit() enqueues packets in ppp->file.xq
      before checking for xmit recursion. Therefore, __ppp_xmit_process()
      might dequeue a packet from ppp->file.xq and send it on the channel
      which, in turn, loops it back on the unit. Then ppp_start_xmit()
      queues the packet back to ppp->file.xq and __ppp_xmit_process() picks
      it up and sends it again through the channel. Therefore, the packet
      will loop between __ppp_xmit_process() and ppp_start_xmit() until some
      other part of the xmit path drops it.
      
      For L2TP, we rapidly fill the skb's headroom and pppol2tp_xmit() drops
      the packet after a few iterations. But PPTP reallocates the headroom
      if necessary, letting the loop run and exhaust the machine resources
      (as reported in https://bugzilla.kernel.org/show_bug.cgi?id=199109).
      
      Fix this by letting __ppp_xmit_process() enqueue the skb to
      ppp->file.xq, so that we can check for recursion before adding it to
      the queue. Now ppp_xmit_process() can drop the packet when recursion is
      detected.
      
      __ppp_channel_push() is a bit special. It calls __ppp_xmit_process()
      without having any actual packet to send. This is used by
      ppp_output_wakeup() to re-enable transmission on the parent unit (for
      implementations like ppp_async.c, where the .start_xmit() function
      might not consume the skb, leaving it in ppp->xmit_pending and
      disabling transmission).
      Therefore, __ppp_xmit_process() needs to handle the case where skb is
      NULL, dequeuing as many packets as possible from ppp->file.xq.
      Reported-by: default avatarxu heng <xuheng333@zoho.com>
      Fixes: 55454a56 ("ppp: avoid dealock on recursive xmit")
      Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6d066734
    • David Lebrun's avatar
      ipv6: sr: fix NULL pointer dereference when setting encap source address · 8936ef76
      David Lebrun authored
      When using seg6 in encap mode, we call ipv6_dev_get_saddr() to set the
      source address of the outer IPv6 header, in case none was specified.
      Using skb->dev can lead to BUG() when it is in an inconsistent state.
      This patch uses the net_device attached to the skb's dst instead.
      
      [940807.667429] BUG: unable to handle kernel NULL pointer dereference at 000000000000047c
      [940807.762427] IP: ipv6_dev_get_saddr+0x8b/0x1d0
      [940807.815725] PGD 0 P4D 0
      [940807.847173] Oops: 0000 [#1] SMP PTI
      [940807.890073] Modules linked in:
      [940807.927765] CPU: 6 PID: 0 Comm: swapper/6 Tainted: G        W        4.16.0-rc1-seg6bpf+ #2
      [940808.028988] Hardware name: HP ProLiant DL120 G6/ProLiant DL120 G6, BIOS O26    09/06/2010
      [940808.128128] RIP: 0010:ipv6_dev_get_saddr+0x8b/0x1d0
      [940808.187667] RSP: 0018:ffff88043fd836b0 EFLAGS: 00010206
      [940808.251366] RAX: 0000000000000005 RBX: ffff88042cb1c860 RCX: 00000000000000fe
      [940808.338025] RDX: 00000000000002c0 RSI: ffff88042cb1c860 RDI: 0000000000004500
      [940808.424683] RBP: ffff88043fd83740 R08: 0000000000000000 R09: ffffffffffffffff
      [940808.511342] R10: 0000000000000040 R11: 0000000000000000 R12: ffff88042cb1c850
      [940808.598012] R13: ffffffff8208e380 R14: ffff88042ac8da00 R15: 0000000000000002
      [940808.684675] FS:  0000000000000000(0000) GS:ffff88043fd80000(0000) knlGS:0000000000000000
      [940808.783036] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [940808.852975] CR2: 000000000000047c CR3: 00000004255fe000 CR4: 00000000000006e0
      [940808.939634] Call Trace:
      [940808.970041]  <IRQ>
      [940808.995250]  ? ip6t_do_table+0x265/0x640
      [940809.043341]  seg6_do_srh_encap+0x28f/0x300
      [940809.093516]  ? seg6_do_srh+0x1a0/0x210
      [940809.139528]  seg6_do_srh+0x1a0/0x210
      [940809.183462]  seg6_output+0x28/0x1e0
      [940809.226358]  lwtunnel_output+0x3f/0x70
      [940809.272370]  ip6_xmit+0x2b8/0x530
      [940809.313185]  ? ac6_proc_exit+0x20/0x20
      [940809.359197]  inet6_csk_xmit+0x7d/0xc0
      [940809.404173]  tcp_transmit_skb+0x548/0x9a0
      [940809.453304]  __tcp_retransmit_skb+0x1a8/0x7a0
      [940809.506603]  ? ip6_default_advmss+0x40/0x40
      [940809.557824]  ? tcp_current_mss+0x24/0x90
      [940809.605925]  tcp_retransmit_skb+0xd/0x80
      [940809.654016]  tcp_xmit_retransmit_queue.part.17+0xf9/0x210
      [940809.719797]  tcp_ack+0xa47/0x1110
      [940809.760612]  tcp_rcv_established+0x13c/0x570
      [940809.812865]  tcp_v6_do_rcv+0x151/0x3d0
      [940809.858879]  tcp_v6_rcv+0xa5c/0xb10
      [940809.901770]  ? seg6_output+0xdd/0x1e0
      [940809.946745]  ip6_input_finish+0xbb/0x460
      [940809.994837]  ip6_input+0x74/0x80
      [940810.034612]  ? ip6_rcv_finish+0xb0/0xb0
      [940810.081663]  ipv6_rcv+0x31c/0x4c0
      ...
      
      Fixes: 6c8702c6 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
      Reported-by: default avatarTom Herbert <tom@quantonium.net>
      Signed-off-by: default avatarDavid Lebrun <dlebrun@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8936ef76
    • David Lebrun's avatar
      ipv6: sr: fix scheduling in RCU when creating seg6 lwtunnel state · 191f86ca
      David Lebrun authored
      The seg6_build_state() function is called with RCU read lock held,
      so we cannot use GFP_KERNEL. This patch uses GFP_ATOMIC instead.
      
      [   92.770271] =============================
      [   92.770628] WARNING: suspicious RCU usage
      [   92.770921] 4.16.0-rc4+ #12 Not tainted
      [   92.771277] -----------------------------
      [   92.771585] ./include/linux/rcupdate.h:302 Illegal context switch in RCU read-side critical section!
      [   92.772279]
      [   92.772279] other info that might help us debug this:
      [   92.772279]
      [   92.773067]
      [   92.773067] rcu_scheduler_active = 2, debug_locks = 1
      [   92.773514] 2 locks held by ip/2413:
      [   92.773765]  #0:  (rtnl_mutex){+.+.}, at: [<00000000e5461720>] rtnetlink_rcv_msg+0x441/0x4d0
      [   92.774377]  #1:  (rcu_read_lock){....}, at: [<00000000df4f161e>] lwtunnel_build_state+0x59/0x210
      [   92.775065]
      [   92.775065] stack backtrace:
      [   92.775371] CPU: 0 PID: 2413 Comm: ip Not tainted 4.16.0-rc4+ #12
      [   92.775791] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc27 04/01/2014
      [   92.776608] Call Trace:
      [   92.776852]  dump_stack+0x7d/0xbc
      [   92.777130]  __schedule+0x133/0xf00
      [   92.777393]  ? unwind_get_return_address_ptr+0x50/0x50
      [   92.777783]  ? __sched_text_start+0x8/0x8
      [   92.778073]  ? rcu_is_watching+0x19/0x30
      [   92.778383]  ? kernel_text_address+0x49/0x60
      [   92.778800]  ? __kernel_text_address+0x9/0x30
      [   92.779241]  ? unwind_get_return_address+0x29/0x40
      [   92.779727]  ? pcpu_alloc+0x102/0x8f0
      [   92.780101]  _cond_resched+0x23/0x50
      [   92.780459]  __mutex_lock+0xbd/0xad0
      [   92.780818]  ? pcpu_alloc+0x102/0x8f0
      [   92.781194]  ? seg6_build_state+0x11d/0x240
      [   92.781611]  ? save_stack+0x9b/0xb0
      [   92.781965]  ? __ww_mutex_wakeup_for_backoff+0xf0/0xf0
      [   92.782480]  ? seg6_build_state+0x11d/0x240
      [   92.782925]  ? lwtunnel_build_state+0x1bd/0x210
      [   92.783393]  ? ip6_route_info_create+0x687/0x1640
      [   92.783846]  ? ip6_route_add+0x74/0x110
      [   92.784236]  ? inet6_rtm_newroute+0x8a/0xd0
      
      Fixes: 6c8702c6 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
      Signed-off-by: default avatarDavid Lebrun <dlebrun@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      191f86ca
    • David S. Miller's avatar
      Merge branch 'aquantia-fixes' · 9b894cdd
      David S. Miller authored
      Igor Russkikh says:
      
      ====================
      Aquantia atlantic hot fixes 03-2018
      
      This is a set of atlantic driver hot fixes for various areas:
      
      Some issues with hardware reset covered,
      Fixed napi_poll flood happening on some traffic conditions,
      Allow system to change MAC address on live device,
      Add pci shutdown handler.
      
      patch v2:
      - reverse christmas tree
      - remove driver private parameter, replacing it with define.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9b894cdd
    • Igor Russkikh's avatar
      c89bf1cd
    • Igor Russkikh's avatar
      net: aquantia: Implement pci shutdown callback · 90869ddf
      Igor Russkikh authored
      We should close link and all NIC operations during shutdown.
      On some systems graceful reboot never closes NIC interface on its own,
      but only indicates pci device shutdown. Without explicit handler, NIC
      rx rings continued to transfer DMA data into prepared buffers while CPU
      rebooted already. That caused memory corruptions on soft reboot.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      90869ddf
    • Igor Russkikh's avatar
      net: aquantia: Allow live mac address changes · 3e9a5451
      Igor Russkikh authored
      There is nothing prevents us from changing MAC on the running interface.
      Allow this with ndev priv flag.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3e9a5451
    • Igor Russkikh's avatar
      net: aquantia: Add tx clean budget and valid budget handling logic · b647d398
      Igor Russkikh authored
      We should report to napi full budget only when we have more job to do.
      Before this fix, on any tx queue cleanup we forced napi to do poll again.
      Thats a waste of cpu resources and caused storming with napi polls when
      there was at least one tx on each interrupt.
      
      With this fix we report full budget only when there is more job on TX
      to do. Or, as before, when rx budget was fully consumed.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b647d398
    • Igor Russkikh's avatar
      net: aquantia: Change inefficient wait loop on fw data reads · 47203b34
      Igor Russkikh authored
      B1 hardware changes behavior of mailbox interface, it has busy bit
      always raised. Data ready condition should be detected by increment
      of address register.
      
      Old code has empty `for` loop, and that caused cpu overloads on B1
      hardware. aq_nic_service_timer_cb consumed ~100ms because of that.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      47203b34
    • Igor Russkikh's avatar
      net: aquantia: Fix a regression with reset on old firmware · d0f0fb25
      Igor Russkikh authored
      FW 1.5.58 and below needs a fixed delay even after 0x18 register
      is filled. Otherwise, setting MPI_INIT state too fast causes
      traffic hang.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d0f0fb25
    • Igor Russkikh's avatar
      net: aquantia: Fix hardware reset when SPI may rarely hangup · 1bf9a752
      Igor Russkikh authored
      Under some circumstances (notably using thunderbolt interface) SPI
      on chip reset may be in active transaction.
      Here we forcibly cleanup SPI to prevent possible hangups.
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1bf9a752
    • David S. Miller's avatar
      Merge branch 's390-qeth-fixes' · 1959031e
      David S. Miller authored
      Julian Wiedmann says:
      
      ====================
      s390/qeth: fixes 2018-03-20
      
      Please apply one final set of qeth patches for 4.16.
      All of these fix long-standing bugs, so please queue them up for -stable
      as well.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1959031e
    • Julian Wiedmann's avatar
      s390/qeth: on channel error, reject further cmd requests · a6c3d939
      Julian Wiedmann authored
      When the IRQ handler determines that one of the cmd IO channels has
      failed and schedules recovery, block any further cmd requests from
      being submitted. The request would inevitably stall, and prevent the
      recovery from making progress until the request times out.
      
      This sort of error was observed after Live Guest Relocation, where
      the pending IO on the READ channel intentionally gets terminated to
      kick-start recovery. Simultaneously the guest executed SIOCETHTOOL,
      triggering qeth to issue a QUERY CARD INFO command. The command
      then stalled in the inoperabel WRITE channel.
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a6c3d939
    • Julian Wiedmann's avatar
      s390/qeth: lock read device while queueing next buffer · 17bf8c9b
      Julian Wiedmann authored
      For calling ccw_device_start(), issue_next_read() needs to hold the
      device's ccwlock.
      This is satisfied for the IRQ handler path (where qeth_irq() gets called
      under the ccwlock), but we need explicit locking for the initial call by
      the MPC initialization.
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      17bf8c9b
    • Julian Wiedmann's avatar
      s390/qeth: when thread completes, wake up all waiters · 1063e432
      Julian Wiedmann authored
      qeth_wait_for_threads() is potentially called by multiple users, make
      sure to notify all of them after qeth_clear_thread_running_bit()
      adjusted the thread_running_mask. With no timeout, callers would
      otherwise stall.
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1063e432
    • Julian Wiedmann's avatar
      s390/qeth: free netdevice when removing a card · 6be68739
      Julian Wiedmann authored
      On removal, a qeth card's netdevice is currently not properly freed
      because the call chain looks as follows:
      
      qeth_core_remove_device(card)
      	lx_remove_device(card)
      		unregister_netdev(card->dev)
      		card->dev = NULL			!!!
      	qeth_core_free_card(card)
      		if (card->dev)				!!!
      			free_netdev(card->dev)
      
      Fix it by free'ing the netdev straight after unregistering. This also
      fixes the sysfs-driven layer switch case (qeth_dev_layer2_store()),
      where the need to free the current netdevice was not considered at all.
      
      Note that free_netdev() takes care of the netif_napi_del() for us too.
      
      Fixes: 4a71df50 ("qeth: new qeth device driver")
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.vnet.ibm.com>
      Reviewed-by: default avatarUrsula Braun <ubraun@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6be68739
    • David S. Miller's avatar
      Merge branch 'net-phy-Add-general-dummy-stubs-for-MMD-register-access' · 3d21ac6f
      David S. Miller authored
      Kevin Hao says:
      
      ====================
      net: phy: Add general dummy stubs for MMD register access
      
      v2:
      As suggested by Andrew:
        - Add general dummy stubs
        - Also use that for the micrel phy
      
      This patch series fix the Ethernet broken on the mpc8315erdb board introduced
      by commit b6b5e8a6 ("gianfar: Disable EEE autoneg by default").
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3d21ac6f
    • Kevin Hao's avatar
      net: phy: micrel: Use the general dummy stubs for MMD register access · c846a2b7
      Kevin Hao authored
      The new general dummy stubs for MMD register access were introduced.
      Use that for the codes reuse.
      Signed-off-by: default avatarKevin Hao <haokexin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c846a2b7
    • Kevin Hao's avatar
      net: phy: realtek: Use the dummy stubs for MMD register access for rtl8211b · 0231b1a0
      Kevin Hao authored
      The Ethernet on mpc8315erdb is broken since commit b6b5e8a6
      ("gianfar: Disable EEE autoneg by default"). The reason is that
      even though the rtl8211b doesn't support the MMD extended registers
      access, it does return some random values if we trying to access
      the MMD register via indirect method. This makes it seem that the
      EEE is supported by this phy device. And the subsequent writing to
      the MMD registers does cause the phy malfunction. So use the dummy
      stubs for the MMD register access to fix this issue.
      
      Fixes: b6b5e8a6 ("gianfar: Disable EEE autoneg by default")
      Signed-off-by: default avatarKevin Hao <haokexin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0231b1a0
    • Kevin Hao's avatar
      net: phy: Add general dummy stubs for MMD register access · 5df7af85
      Kevin Hao authored
      For some phy devices, even though they don't support the MMD extended
      register access, it does have some side effect if we are trying to
      read/write the MMD registers via indirect method. So introduce general
      dummy stubs for MMD register access which these devices can use to avoid
      such side effect.
      
      Fixes: b6b5e8a6 ("gianfar: Disable EEE autoneg by default")
      Signed-off-by: default avatarKevin Hao <haokexin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5df7af85
    • David S. Miller's avatar
      Merge tag 'batadv-net-for-davem-20180319' of git://git.open-mesh.org/linux-merge · ee54a9f9
      David S. Miller authored
      Simon Wunderlich says:
      
      ====================
      Here are some batman-adv bugfixes:
      
       - fix possible IPv6 packet loss when multicast extension is used, by Linus Luessing
      
       - fix SKB handling issues for TTVN and DAT, by Matthias Schiffer (two patches)
      
       - fix include for eventpoll, by Sven Eckelmann
      
       - fix skb checksum for ttvn reroutes, by Sven Eckelmann
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ee54a9f9
  2. 21 Mar, 2018 8 commits
    • David S. Miller's avatar
      Merge branch 'net-sched-action-idr-leak' · ba9a1908
      David S. Miller authored
      Davide Caratti says:
      
      ====================
      fix idr leak in actions
      
      This series fixes situations where a temporary failure to install a TC
      action results in the permanent impossibility to reuse the configured
      value of 'index'.
      
      Thanks to Cong Wang for the initial review.
      
      v2: fix build error in act_ipt.c, reported by kbuild test robot
      ====================
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ba9a1908
    • Davide Caratti's avatar
      net/sched: fix idr leak in the error path of tcf_skbmod_init() · f29cdfbe
      Davide Caratti authored
      tcf_skbmod_init() can fail after the idr has been successfully reserved.
      When this happens, every subsequent attempt to configure skbmod rules
      using the same idr value will systematically fail with -ENOSPC, unless
      the first attempt was done using the 'replace' keyword:
      
       # tc action add action skbmod swap mac index 100
       RTNETLINK answers: Cannot allocate memory
       We have an error talking to the kernel
       # tc action add action skbmod swap mac index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       # tc action add action skbmod swap mac index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       ...
      
      Fix this in tcf_skbmod_init(), ensuring that tcf_idr_release() is called
      on the error path when the idr has been reserved, but not yet inserted.
      Also, don't test 'ovr' in the error path, to avoid a 'replace' failure
      implicitly become a 'delete' that leaks refcount in act_skbmod module:
      
       # rmmod act_skbmod; modprobe act_skbmod
       # tc action add action skbmod swap mac index 100
       # tc action add action skbmod swap mac continue index 100
       RTNETLINK answers: File exists
       We have an error talking to the kernel
       # tc action replace action skbmod swap mac continue index 100
       RTNETLINK answers: Cannot allocate memory
       We have an error talking to the kernel
       # tc action list action skbmod
       #
       # rmmod  act_skbmod
       rmmod: ERROR: Module act_skbmod is in use
      
      Fixes: 65a206c0 ("net/sched: Change act_api and act_xxx modules to use IDR")
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f29cdfbe
    • Davide Caratti's avatar
      net/sched: fix idr leak in the error path of tcf_vlan_init() · d7f20015
      Davide Caratti authored
      tcf_vlan_init() can fail after the idr has been successfully reserved.
      When this happens, every subsequent attempt to configure vlan rules using
      the same idr value will systematically fail with -ENOSPC, unless the first
      attempt was done using the 'replace' keyword.
      
       # tc action add action vlan pop index 100
       RTNETLINK answers: Cannot allocate memory
       We have an error talking to the kernel
       # tc action add action vlan pop index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       # tc action add action vlan pop index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       ...
      
      Fix this in tcf_vlan_init(), ensuring that tcf_idr_release() is called on
      the error path when the idr has been reserved, but not yet inserted. Also,
      don't test 'ovr' in the error path, to avoid a 'replace' failure implicitly
      become a 'delete' that leaks refcount in act_vlan module:
      
       # rmmod act_vlan; modprobe act_vlan
       # tc action add action vlan push id 5 index 100
       # tc action replace action vlan push id 7 index 100
       RTNETLINK answers: Cannot allocate memory
       We have an error talking to the kernel
       # tc action list action vlan
       #
       # rmmod act_vlan
       rmmod: ERROR: Module act_vlan is in use
      
      Fixes: 4c5b9d96 ("act_vlan: VLAN action rewrite to use RCU lock/unlock and update")
      Fixes: 65a206c0 ("net/sched: Change act_api and act_xxx modules to use IDR")
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d7f20015
    • Davide Caratti's avatar
      net/sched: fix idr leak in the error path of __tcf_ipt_init() · 1e46ef17
      Davide Caratti authored
      __tcf_ipt_init() can fail after the idr has been successfully reserved.
      When this happens, subsequent attempts to configure xt/ipt rules using
      the same idr value systematically fail with -ENOSPC:
      
       # tc action add action xt -j LOG --log-prefix test1 index 100
       tablename: mangle hook: NF_IP_POST_ROUTING
               target:  LOG level warning prefix "test1" index 100
       RTNETLINK answers: Cannot allocate memory
       We have an error talking to the kernel
       Command "(null)" is unknown, try "tc actions help".
       # tc action add action xt -j LOG --log-prefix test1 index 100
       tablename: mangle hook: NF_IP_POST_ROUTING
               target:  LOG level warning prefix "test1" index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       Command "(null)" is unknown, try "tc actions help".
       # tc action add action xt -j LOG --log-prefix test1 index 100
       tablename: mangle hook: NF_IP_POST_ROUTING
               target:  LOG level warning prefix "test1" index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       ...
      
      Fix this in the error path of __tcf_ipt_init(), calling tcf_idr_release()
      in place of tcf_idr_cleanup(). Since tcf_ipt_release() can now be called
      when tcfi_t is NULL, we also need to protect calls to ipt_destroy_target()
      to avoid NULL pointer dereference.
      
      Fixes: 65a206c0 ("net/sched: Change act_api and act_xxx modules to use IDR")
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1e46ef17
    • Davide Caratti's avatar
      net/sched: fix idr leak in the error path of tcp_pedit_init() · 94fa3f92
      Davide Caratti authored
      tcf_pedit_init() can fail to allocate 'keys' after the idr has been
      successfully reserved. When this happens, subsequent attempts to configure
      a pedit rule using the same idr value systematically fail with -ENOSPC:
      
       # tc action add action pedit munge ip ttl set 63 index 100
       RTNETLINK answers: Cannot allocate memory
       We have an error talking to the kernel
       # tc action add action pedit munge ip ttl set 63 index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       # tc action add action pedit munge ip ttl set 63 index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       ...
      
      Fix this in the error path of tcf_act_pedit_init(), calling
      tcf_idr_release() in place of tcf_idr_cleanup().
      
      Fixes: 65a206c0 ("net/sched: Change act_api and act_xxx modules to use IDR")
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      94fa3f92
    • Davide Caratti's avatar
      net/sched: fix idr leak in the error path of tcf_act_police_init() · 5bf7f818
      Davide Caratti authored
      tcf_act_police_init() can fail after the idr has been successfully
      reserved (e.g., qdisc_get_rtab() may return NULL). When this happens,
      subsequent attempts to configure a police rule using the same idr value
      systematiclly fail with -ENOSPC:
      
       # tc action add action police rate 1000 burst 1000 drop index 100
       RTNETLINK answers: Cannot allocate memory
       We have an error talking to the kernel
       # tc action add action police rate 1000 burst 1000 drop index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       # tc action add action police rate 1000 burst 1000 drop index 100
       RTNETLINK answers: No space left on device
       ...
      
      Fix this in the error path of tcf_act_police_init(), calling
      tcf_idr_release() in place of tcf_idr_cleanup().
      
      Fixes: 65a206c0 ("net/sched: Change act_api and act_xxx modules to use IDR")
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5bf7f818
    • Davide Caratti's avatar
      net/sched: fix idr leak in the error path of tcf_simp_init() · 60e10b3a
      Davide Caratti authored
      if the kernel fails to duplicate 'sdata', creation of a new action fails
      with -ENOMEM. However, subsequent attempts to install the same action
      using the same value of 'index' systematically fail with -ENOSPC, and
      that value of 'index' will no more be usable by act_simple, until rmmod /
      insmod of act_simple.ko is done:
      
       # tc actions add action simple sdata hello index 100
       # tc actions list action simple
      
              action order 0: Simple <hello>
               index 100 ref 1 bind 0
       # tc actions flush action simple
       # tc actions add action simple sdata hello index 100
       RTNETLINK answers: Cannot allocate memory
       We have an error talking to the kernel
       # tc actions flush action simple
       # tc actions add action simple sdata hello index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       # tc actions add action simple sdata hello index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       ...
      
      Fix this in the error path of tcf_simp_init(), calling tcf_idr_release()
      in place of tcf_idr_cleanup().
      
      Fixes: 65a206c0 ("net/sched: Change act_api and act_xxx modules to use IDR")
      Suggested-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      60e10b3a
    • Davide Caratti's avatar
      net/sched: fix idr leak on the error path of tcf_bpf_init() · bbc09e78
      Davide Caratti authored
      when the following command sequence is entered
      
       # tc action add action bpf bytecode '4,40 0 0 12,31 0 1 2048,6 0 0 262144,6 0 0 0' index 100
       RTNETLINK answers: Invalid argument
       We have an error talking to the kernel
       # tc action add action bpf bytecode '4,40 0 0 12,21 0 1 2048,6 0 0 262144,6 0 0 0' index 100
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
      
      act_bpf correctly refuses to install the first TC rule, because 31 is not
      a valid instruction. However, it refuses to install the second TC rule,
      even if the BPF code is correct. Furthermore, it's no more possible to
      install any other rule having the same value of 'index' until act_bpf
      module is unloaded/inserted again. After the idr has been reserved, call
      tcf_idr_release() instead of tcf_idr_cleanup(), to fix this issue.
      
      Fixes: 65a206c0 ("net/sched: Change act_api and act_xxx modules to use IDR")
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bbc09e78