1. 09 Feb, 2018 26 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c839682c
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Make allocations less aggressive in x_tables, from Minchal Hocko.
      
       2) Fix netfilter flowtable Kconfig deps, from Pablo Neira Ayuso.
      
       3) Fix connection loss problems in rtlwifi, from Larry Finger.
      
       4) Correct DRAM dump length for some chips in ath10k driver, from Yu
          Wang.
      
       5) Fix ABORT handling in rxrpc, from David Howells.
      
       6) Add SPDX tags to Sun networking drivers, from Shannon Nelson.
      
       7) Some ipv6 onlink handling fixes, from David Ahern.
      
       8) Netem packet scheduler interval calcualtion fix from Md. Islam.
      
       9) Don't put crypto buffers on-stack in rxrpc, from David Howells.
      
      10) Fix handling of error non-delivery status in netlink multicast
          delivery over multiple namespaces, from Nicolas Dichtel.
      
      11) Missing xdp flush in tuntap driver, from Jason Wang.
      
      12) Synchonize RDS protocol netns/module teardown with rds object
          management, from Sowini Varadhan.
      
      13) Add nospec annotations to mpls, from Dan Williams.
      
      14) Fix SKB truesize handling in TIPC, from Hoang Le.
      
      15) Interrupt masking fixes in stammc from Niklas Cassel.
      
      16) Don't allow ptr_ring objects to be sized outside of kmalloc's
          limits, from Jason Wang.
      
      17) Don't allow SCTP chunks to be built which will have a length
          exceeding the chunk header's 16-bit length field, from Alexey
          Kodanev.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (82 commits)
        ibmvnic: Remove skb->protocol checks in ibmvnic_xmit
        bpf: fix rlimit in reuseport net selftest
        sctp: verify size of a new chunk in _sctp_make_chunk()
        s390/qeth: fix SETIP command handling
        s390/qeth: fix underestimated count of buffer elements
        ptr_ring: try vmalloc() when kmalloc() fails
        ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE
        net: stmmac: remove redundant enable of PMT irq
        net: stmmac: rename GMAC_INT_DEFAULT_MASK for dwmac4
        net: stmmac: discard disabled flags in interrupt status register
        ibmvnic: Reset long term map ID counter
        tools/libbpf: handle issues with bpf ELF objects containing .eh_frames
        selftests/bpf: add selftest that use test_libbpf_open
        selftests/bpf: add test program for loading BPF ELF files
        tools/libbpf: improve the pr_debug statements to contain section numbers
        bpf: Sync kernel ABI header with tooling header for bpf_common.h
        net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT
        net: thunder: change q_len's type to handle max ring size
        tipc: fix skb truesize/datasize ratio control
        net/sched: cls_u32: fix cls_u32 on filter replace
        ...
      c839682c
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-4.16-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · 82f0a41e
      Linus Torvalds authored
      Pull more NFS client updates from Trond Myklebust:
       "A few bugfixes and some small sunrpc latency/performance improvements
        before the merge window closes:
      
        Stable fixes:
      
         - fix an incorrect calculation of the RDMA send scatter gather
           element limit
      
         - fix an Oops when attempting to free resources after RDMA device
           removal
      
        Bugfixes:
      
         - SUNRPC: Ensure we always release the TCP socket in a timely fashion
           when the connection is shut down.
      
         - SUNRPC: Don't call __UDPX_INC_STATS() from a preemptible context
      
        Latency/Performance:
      
         - SUNRPC: Queue latency sensitive socket tasks to the less contended
           xprtiod queue
      
         - SUNRPC: Make the xprtiod workqueue unbounded.
      
         - SUNRPC: Make the rpciod workqueue unbounded"
      
      * tag 'nfs-for-4.16-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        SUNRPC: Don't call __UDPX_INC_STATS() from a preemptible context
        fix parallelism for rpc tasks
        Make the xprtiod workqueue unbounded.
        SUNRPC: Queue latency-sensitive socket tasks to xprtiod
        SUNRPC: Ensure we always close the socket after a connection shuts down
        xprtrdma: Fix BUG after a device removal
        xprtrdma: Fix calculation of ri_max_send_sges
      82f0a41e
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · 858f45bf
      Linus Torvalds authored
      Pull SCSI target updates from Nicholas Bellinger:
       "The highlights include:
      
         - numerous target-core-user improvements related to queue full and
           timeout handling. (MNC)
      
         - prevent target-core-user corruption when invalid data page is
           requested. (MNC)
      
         - add target-core device action configfs attributes to allow
           user-space to trigger events separate from existing attributes
           exposed to end-users. (MNC)
      
         - fix iscsi-target NULL pointer dereference 4.6+ regression in CHAP
           error path. (David Disseldorp)
      
         - avoid target-core backend UNMAP callbacks if range is zero. (Andrei
           Vagin)
      
         - fix a iscsi-target 4.14+ regression related multiple PDU logins,
           that was exposed due to removal of TCP prequeue support. (Florian
           Westphal + MNC)
      
        Also, there is a iser-target bug still being worked on for post -rc1
        code to address a long standing issue resulting in persistent
        ib_post_send() failures, for RNICs with small max_send_sge"
      
      * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (36 commits)
        iscsi-target: make sure to wake up sleeping login worker
        tcmu: Fix trailing semicolon
        tcmu: fix cmd user after free
        target: fix destroy device in target_configure_device
        tcmu: allow userspace to reset ring
        target core: add device action configfs files
        tcmu: fix error return code in tcmu_configure_device()
        target_core_user: add cmd id to broken ring message
        target: add SAM_STAT_BUSY sense reason
        tcmu: prevent corruption when invalid data page requested
        target: don't call an unmap callback if a range length is zero
        target/iscsi: avoid NULL dereference in CHAP auth error path
        cxgbit: call neigh_event_send() to update MAC address
        target: tcm_loop: Use seq_puts() in tcm_loop_show_info()
        target: tcm_loop: Delete an unnecessary return statement in tcm_loop_submission_work()
        target: tcm_loop: Delete two unnecessary variable initialisations in tcm_loop_issue_tmr()
        target: tcm_loop: Combine substrings for 26 messages
        target: tcm_loop: Improve a size determination in two functions
        target: tcm_loop: Delete an error message for a failed memory allocation in four functions
        sbp-target: Delete an error message for a failed memory allocation in three functions
        ...
      858f45bf
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 8158c2ff
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
       "Al Viro discovered some breakage with the parsing of the
        set_ftrace_filter as well as the removing of function probes.
      
        This fixes the code with Al's suggestions. I also added a few
        selftests to test the broken cases such that they wont happen
        again"
      
      * tag 'trace-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        selftests/ftrace: Add more tests for removing of function probes
        selftests/ftrace: Add some missing glob checks
        selftests/ftrace: Have reset_ftrace_filter handle multiple instances
        selftests/ftrace: Have reset_ftrace_filter handle modules
        tracing: Fix parsing of globs with a wildcard at the beginning
        ftrace: Remove incorrect setting of glob search field
      8158c2ff
    • Linus Torvalds's avatar
      Merge tag '4.16-minor-rc-SMB3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · a2834832
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "There are a couple additional security fixes that are still being
        tested that are not in this set."
      
      * tag '4.16-minor-rc-SMB3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        Add missing structs and defines from recent SMB3.1.1 documentation
        address lock imbalance warnings in smbdirect.c
        cifs: silence compiler warnings showing up with gcc-8.0.0
        Add some missing debug fields in server and tcon structs
      a2834832
    • Linus Torvalds's avatar
      Merge tag 'fbdev-v4.16-fix' of git://github.com/bzolnier/linux · 58fcba61
      Linus Torvalds authored
      Pull fbdev fix from Bartlomiej Zolnierkiewicz:
       "Fix building of the omapfb driver (Tomi Valkeinen)"
      
      * tag 'fbdev-v4.16-fix' of git://github.com/bzolnier/linux:
        video: omapfb: fix missing #includes
      58fcba61
    • John Allen's avatar
      ibmvnic: Remove skb->protocol checks in ibmvnic_xmit · 2fa56a49
      John Allen authored
      Having these checks in ibmvnic_xmit causes problems with VLAN
      tagging and balance-alb/tlb bonding modes. The restriction they
      imposed can be removed.
      Signed-off-by: default avatarJohn Allen <jallen@linux.vnet.ibm.com>
      Signed-off-by: default avatarNathan Fontenot <nfont@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2fa56a49
    • Daniel Borkmann's avatar
      bpf: fix rlimit in reuseport net selftest · 941ff6f1
      Daniel Borkmann authored
      Fix two issues in the reuseport_bpf selftests that were
      reported by Linaro CI:
      
        [...]
        + ./reuseport_bpf
        ---- IPv4 UDP ----
        Testing EBPF mod 10...
        Reprograming, testing mod 5...
        ./reuseport_bpf: ebpf error. log:
        0: (bf) r6 = r1
        1: (20) r0 = *(u32 *)skb[0]
        2: (97) r0 %= 10
        3: (95) exit
        processed 4 insns
        : Operation not permitted
        + echo FAIL
        [...]
        ---- IPv4 TCP ----
        Testing EBPF mod 10...
        ./reuseport_bpf: failed to bind send socket: Address already in use
        + echo FAIL
        [...]
      
      For the former adjust rlimit since this was the cause of
      failure for loading the BPF prog, and for the latter add
      SO_REUSEADDR.
      Reported-by: default avatarNaresh Kamboju <naresh.kamboju@linaro.org>
      Link: https://bugs.linaro.org/show_bug.cgi?id=3502Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      941ff6f1
    • Alexey Kodanev's avatar
      sctp: verify size of a new chunk in _sctp_make_chunk() · 07f2c7ab
      Alexey Kodanev authored
      When SCTP makes INIT or INIT_ACK packet the total chunk length
      can exceed SCTP_MAX_CHUNK_LEN which leads to kernel panic when
      transmitting these packets, e.g. the crash on sending INIT_ACK:
      
      [  597.804948] skbuff: skb_over_panic: text:00000000ffae06e4 len:120168
                     put:120156 head:000000007aa47635 data:00000000d991c2de
                     tail:0x1d640 end:0xfec0 dev:<NULL>
      ...
      [  597.976970] ------------[ cut here ]------------
      [  598.033408] kernel BUG at net/core/skbuff.c:104!
      [  600.314841] Call Trace:
      [  600.345829]  <IRQ>
      [  600.371639]  ? sctp_packet_transmit+0x2095/0x26d0 [sctp]
      [  600.436934]  skb_put+0x16c/0x200
      [  600.477295]  sctp_packet_transmit+0x2095/0x26d0 [sctp]
      [  600.540630]  ? sctp_packet_config+0x890/0x890 [sctp]
      [  600.601781]  ? __sctp_packet_append_chunk+0x3b4/0xd00 [sctp]
      [  600.671356]  ? sctp_cmp_addr_exact+0x3f/0x90 [sctp]
      [  600.731482]  sctp_outq_flush+0x663/0x30d0 [sctp]
      [  600.788565]  ? sctp_make_init+0xbf0/0xbf0 [sctp]
      [  600.845555]  ? sctp_check_transmitted+0x18f0/0x18f0 [sctp]
      [  600.912945]  ? sctp_outq_tail+0x631/0x9d0 [sctp]
      [  600.969936]  sctp_cmd_interpreter.isra.22+0x3be1/0x5cb0 [sctp]
      [  601.041593]  ? sctp_sf_do_5_1B_init+0x85f/0xc30 [sctp]
      [  601.104837]  ? sctp_generate_t1_cookie_event+0x20/0x20 [sctp]
      [  601.175436]  ? sctp_eat_data+0x1710/0x1710 [sctp]
      [  601.233575]  sctp_do_sm+0x182/0x560 [sctp]
      [  601.284328]  ? sctp_has_association+0x70/0x70 [sctp]
      [  601.345586]  ? sctp_rcv+0xef4/0x32f0 [sctp]
      [  601.397478]  ? sctp6_rcv+0xa/0x20 [sctp]
      ...
      
      Here the chunk size for INIT_ACK packet becomes too big, mostly
      because of the state cookie (INIT packet has large size with
      many address parameters), plus additional server parameters.
      
      Later this chunk causes the panic in skb_put_data():
      
        skb_packet_transmit()
            sctp_packet_pack()
                skb_put_data(nskb, chunk->skb->data, chunk->skb->len);
      
      'nskb' (head skb) was previously allocated with packet->size
      from u16 'chunk->chunk_hdr->length'.
      
      As suggested by Marcelo we should check the chunk's length in
      _sctp_make_chunk() before trying to allocate skb for it and
      discard a chunk if its size bigger than SCTP_MAX_CHUNK_LEN.
      Signed-off-by: default avatarAlexey Kodanev <alexey.kodanev@oracle.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leinter@gmail.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      07f2c7ab
    • David S. Miller's avatar
      Merge branch 's390-qeth-fixes' · 7b30d51a
      David S. Miller authored
      Julian Wiedmann says:
      
      ====================
      s390/qeth: fixes 2018-02-09
      
      please apply the following two qeth patches for 4.16 and stable.
      
      One restricts a command quirk to the intended commandd type,
      while the other fixes an off-by-one during data transmission
      that can cause qeth to build malformed buffer descriptors.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7b30d51a
    • Julian Wiedmann's avatar
      s390/qeth: fix SETIP command handling · 1c5b2216
      Julian Wiedmann authored
      send_control_data() applies some special handling to SETIP v4 IPA
      commands. But current code parses *all* command types for the SETIP
      command code. Limit the command code check to IPA commands.
      
      Fixes: 5b54e16f ("qeth: do not spin for SETIP ip assist command")
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1c5b2216
    • Ursula Braun's avatar
      s390/qeth: fix underestimated count of buffer elements · 89271c65
      Ursula Braun authored
      For a memory range/skb where the last byte falls onto a page boundary
      (ie. 'end' is of the form xxx...xxx001), the PFN_UP() part of the
      calculation currently doesn't round up to the next PFN due to an
      off-by-one error.
      Thus qeth believes that the skb occupies one page less than it
      actually does, and may select a IO buffer that doesn't have enough spare
      buffer elements to fit all of the skb's data.
      HW detects this as a malformed buffer descriptor, and raises an
      exception which then triggers device recovery.
      
      Fixes: 2863c613 ("qeth: refactor calculation of SBALE count")
      Signed-off-by: default avatarUrsula Braun <ubraun@linux.vnet.ibm.com>
      Signed-off-by: default avatarJulian Wiedmann <jwi@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      89271c65
    • Jason Wang's avatar
      ptr_ring: try vmalloc() when kmalloc() fails · 0bf7800f
      Jason Wang authored
      This patch switch to use kvmalloc_array() for using a vmalloc()
      fallback to help in case kmalloc() fails.
      
      Reported-by: syzbot+e4d4f9ddd4295539735d@syzkaller.appspotmail.com
      Fixes: 2e0ab8ca ("ptr_ring: array based FIFO for pointers")
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0bf7800f
    • Jason Wang's avatar
      ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE · 6e6e41c3
      Jason Wang authored
      To avoid slab to warn about exceeded size, fail early if queue
      occupies more than KMALLOC_MAX_SIZE.
      
      Reported-by: syzbot+e4d4f9ddd4295539735d@syzkaller.appspotmail.com
      Fixes: 2e0ab8ca ("ptr_ring: array based FIFO for pointers")
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6e6e41c3
    • David S. Miller's avatar
      Merge branch 'stmmac-irq-fixes-cleanups' · 909ebd58
      David S. Miller authored
      Niklas Cassel says:
      
      ====================
      stmmac irq fixes/cleanups
      
      A couple of small stmmac irq fixes/cleanups.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      909ebd58
    • Niklas Cassel's avatar
      net: stmmac: remove redundant enable of PMT irq · 10291171
      Niklas Cassel authored
      For dwmac4, GMAC_INT_DEFAULT_ENABLE already includes
      GMAC_INT_PMT_EN, so it is redundant to check if hw->pmt
      is set, and if so, setting the bit again.
      
      For dwmac1000, GMAC_INT_DEFAULT_MASK does not include
      GMAC_INT_DISABLE_PMT, so it is redundant to check if
      hw->pmt is set, and if so, clearing an already cleared bit.
      
      Improve code readability by removing this redundant code.
      Signed-off-by: default avatarNiklas Cassel <niklas.cassel@axis.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      10291171
    • Niklas Cassel's avatar
      net: stmmac: rename GMAC_INT_DEFAULT_MASK for dwmac4 · e879b7ab
      Niklas Cassel authored
      GMAC_INT_DEFAULT_MASK is written to the interrupt enable register.
      In previous versions of the IP (e.g. dwmac1000), this register was
      instead an interrupt mask register.
      To improve clarity and reflect reality, rename GMAC_INT_DEFAULT_MASK
      to GMAC_INT_DEFAULT_ENABLE.
      Signed-off-by: default avatarNiklas Cassel <niklas.cassel@axis.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e879b7ab
    • Niklas Cassel's avatar
      net: stmmac: discard disabled flags in interrupt status register · 1b84ca18
      Niklas Cassel authored
      The interrupt status register in both dwmac1000 and dwmac4 ignores
      interrupt enable (for dwmac4) / interrupt mask (for dwmac1000).
      Therefore, if we want to check only the bits that can actually trigger
      an irq, we have to filter the interrupt status register manually.
      
      Commit 0a764db1 ("stmmac: Discard masked flags in interrupt status
      register") fixed this for dwmac1000. Fix the same issue for dwmac4.
      
      Just like commit 0a764db1 ("stmmac: Discard masked flags in
      interrupt status register"), this makes sure that we do not get
      spurious link up/link down prints.
      Signed-off-by: default avatarNiklas Cassel <niklas.cassel@axis.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1b84ca18
    • Thomas Falcon's avatar
      ibmvnic: Reset long term map ID counter · faefaa97
      Thomas Falcon authored
      When allocating RX or TX buffer pools, the driver needs to provide a
      unique mapping ID to firmware for each pool. This value is assigned
      using a counter which is incremented after a new pool is created. The
      ID can be an integer ranging from 1-255. When migrating to a device
      that requests a different number of queues, this value was not being
      reset properly. As a result, after enough migrations, the counter
      exceeded the upper bound and pool creation failed. This is fixed by
      resetting the counter to one in this case.
      Signed-off-by: default avatarThomas Falcon <tlfalcon@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      faefaa97
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 437a4db6
      David S. Miller authored
      Daniel Borkmann says:
      
      ====================
      pull-request: bpf 2018-02-09
      
      The following pull-request contains BPF updates for your *net* tree.
      
      The main changes are:
      
      1) Two fixes for BPF sockmap in order to break up circular map references
         from programs attached to sockmap, and detaching related sockets in
         case of socket close() event. For the latter we get rid of the
         smap_state_change() and plug into ULP infrastructure, which will later
         also be used for additional features anyway such as TX hooks. For the
         second issue, dependency chain is broken up via map release callback
         to free parse/verdict programs, all from John.
      
      2) Fix a libbpf relocation issue that was found while implementing XDP
         support for Suricata project. Issue was that when clang was invoked
         with default target instead of bpf target, then various other e.g.
         debugging relevant sections are added to the ELF file that contained
         relocation entries pointing to non-BPF related sections which libbpf
         trips over instead of skipping them. Test cases for libbpf are added
         as well, from Jesper.
      
      3) Various misc fixes for bpftool and one for libbpf: a small addition
         to libbpf to make sure it recognizes all standard section prefixes.
         Then, the Makefile in bpftool/Documentation is improved to explicitly
         check for rst2man being installed on the system as we otherwise risk
         installing empty man pages; the man page for bpftool-map is corrected
         and a set of missing bash completions added in order to avoid shipping
         bpftool where the completions are only partially working, from Quentin.
      
      4) Fix applying the relocation to immediate load instructions in the
         nfp JIT which were missing a shift, from Jakub.
      
      5) Two fixes for the BPF kernel selftests: handle CONFIG_BPF_JIT_ALWAYS_ON=y
         gracefully in test_bpf.ko module and mark them as FLAG_EXPECTED_FAIL
         in this case; and explicitly delete the veth devices in the two tests
         test_xdp_{meta,redirect}.sh before dismantling the netnses as when
         selftests are run in batch mode, then workqueue to handle destruction
         might not have finished yet and thus veth creation in next test under
         same dev name would fail, from Yonghong.
      
      6) Fix test_kmod.sh to check the test_bpf.ko module path before performing
         an insmod, and fallback to modprobe. Especially the latter is useful
         when having a device under test that has the modules installed instead,
         from Naresh.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      437a4db6
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.16-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · f9f1e414
      Linus Torvalds authored
      Pull xen fixes from Juergen Gross:
       "Only five small fixes for issues when running under Xen"
      
      * tag 'for-linus-4.16-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen: Fix {set,clear}_foreign_p2m_mapping on autotranslating guests
        pvcalls-back: do not return error on inet_accept EAGAIN
        xen-netfront: Fix race between device setup and open
        xen/grant-table: Use put_page instead of free_page
        x86/xen: init %gs very early to avoid page faults with stack protector
      f9f1e414
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · dff839f2
      Linus Torvalds authored
      Pull s390 updates from Heiko Carstens:
       "The main thing in this merge is the defense for the Spectre
        vulnerabilities. But there are other updates as well, the changes in
        more detail:
      
         - An s390 specific implementation of the array_index_mask_nospec
           function to the defense against spectre v1
      
         - Two patches to utilize the new PPA-12/PPA-13 instructions to run
           the kernel and/or user space with reduced branch predicton.
      
         - The s390 variant of the 'retpoline' spectre v2 defense called
           'expoline'. There is no return instruction for s390, instead an
           indirect branch is used for function return
      
           The s390 defense mechanism for indirect branches works by using an
           execute-type instruction with the indirect branch as the target of
           the execute. In effect that turns off the prediction for the
           indirect branch.
      
         - Scrub registers in entry.S that contain user controlled values to
           prevent the speculative use of these values.
      
         - Re-add the second parameter for the s390 specific runtime
           instrumentation system call and move the header file to uapi. The
           second parameter will continue to do nothing but older kernel
           versions only accepted valid real-time signal numbers. The details
           will be documented in the man-page for the system call.
      
         - Corrections and improvements for the s390 specific documentation
      
         - Add a line to /proc/sysinfo to display the CPU model dependent
           license-internal-code identifier
      
         - A header file include fix for eadm.
      
         - An error message fix in the kprobes code.
      
         - The removal of an outdated ARCH_xxx select statement"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/kconfig: Remove ARCH_WANTS_PROT_NUMA_PROT_NONE select
        s390: introduce execute-trampolines for branches
        s390: run user space and KVM guests with modified branch prediction
        s390: add options to change branch prediction behaviour for the kernel
        s390/alternative: use a copy of the facility bit mask
        s390: add optimized array_index_mask_nospec
        s390: scrub registers on kernel entry and KVM exit
        s390/cio: fix kernel-doc usage
        s390/runtime_instrumentation: re-add signum system call parameter
        s390/cpum_cf: correct counter number of LAST_HOST_TRANSLATIONS
        s390/kprobes: Fix %p uses in error messages
        s390/runtime instrumentation: provide uapi header file
        s390/sysinfo: add and display licensed internal code identifier
        s390/docs: reword airq section
        s390/docs: mention subchannel types
        s390/cmf: fix kerneldoc
        s390/eadm: fix CONFIG_BLOCK include dependency
      dff839f2
    • Linus Torvalds's avatar
      Merge tag 'acpi-part2-4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 54ce685c
      Linus Torvalds authored
      Pull more ACPI updates from Rafael Wysocki:
       "These are mostly fixes and cleanups, a few new quirks, a couple of
        updates related to the handling of ACPI tables and ACPICA copyrights
        refreshment.
      
        Specifics:
      
         - Update the ACPICA kernel code to upstream revision 20180105
           including:
             * Assorted fixes (Jung-uk Kim)
             * Support for X32 ABI compilation (Anuj Mittal)
             * Update of ACPICA copyrights to 2018 (Bob Moore)
      
         - Prepare for future modifications to avoid executing the _STA
           control method too early (Hans de Goede)
      
         - Make the processor performance control library code ignore _PPC
           notifications if they cannot be handled and fix up the C1 idle
           state definition when it is used as a fallback state (Chen Yu,
           Yazen Ghannam)
      
         - Make it possible to use the SPCR table on x86 and to replace the
           original IORT table with a new one from initrd (Prarit Bhargava,
           Shunyong Yang)
      
         - Add battery-related quirks for Asus UX360UA and UX410UAK and add
           quirks for table parsing on Dell XPS 9570 and Precision M5530 (Kai
           Heng Feng)
      
         - Address static checker warnings in the CPPC code (Gustavo Silva)
      
         - Avoid printing a raw pointer to the kernel log in the smart battery
           driver (Greg Kroah-Hartman)"
      
      * tag 'acpi-part2-4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: sbshc: remove raw pointer from printk() message
        ACPI: SPCR: Make SPCR available to x86
        ACPI / CPPC: Use 64-bit arithmetic instead of 32-bit
        ACPI / tables: Add IORT to injectable table list
        ACPI / bus: Parse tables as term_list for Dell XPS 9570 and Precision M5530
        ACPICA: Update version to 20180105
        ACPICA: All acpica: Update copyrights to 2018
        ACPI / processor: Set default C1 idle state description
        ACPI / battery: Add quirk for Asus UX360UA and UX410UAK
        ACPI: processor_perflib: Do not send _PPC change notification if not ready
        ACPI / scan: Use acpi_bus_get_status() to initialize ACPI_TYPE_DEVICE devs
        ACPI / bus: Do not call _STA on battery devices with unmet dependencies
        PCI: acpiphp_ibm: prepare for acpi_get_object_info() no longer returning status
        ACPI: export acpi_bus_get_status_handle()
        ACPICA: Add a missing pair of parentheses
        ACPICA: Prefer ACPI_TO_POINTER() over ACPI_ADD_PTR()
        ACPICA: Avoid NULL pointer arithmetic
        ACPICA: Linux: add support for X32 ABI compilation
        ACPI / video: Use true for boolean value
      54ce685c
    • Linus Torvalds's avatar
      Merge tag 'pm-part2-4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · a051c14b
      Linus Torvalds authored
      Pull more power management updates from Rafael Wysocki:
       "These are mostly fixes and cleanups and removal of the no longer
        needed at32ap-cpufreq driver.
      
        Specifics:
      
         - Drop the at32ap-cpufreq driver which is useless after the removal
           of the corresponding arch (Corentin LABBE).
      
         - Fix a regression from the 4.14 cycle in the APM idle driver by
           making it initialize the polling state properly (Rafael Wysocki).
      
         - Fix a crash on failing system suspend due to a missing check in the
           cpufreq core (Bo Yan).
      
         - Make the intel_pstate driver initialize the hardware-managed
           P-state control (HWP) feature on CPU0 upon resume from system
           suspend if HWP had been enabled before the system was suspended
           (Chen Yu).
      
         - Fix up the SCPI cpufreq driver after recent changes (Sudeep Holla,
           Wei Yongjun).
      
         - Avoid pointer subtractions during frequency table walks in cpufreq
           (Dominik Brodowski).
      
         - Avoid the check for ProcFeedback in ST/CZ in the cpufreq driver for
           AMD processors and add a MODULE_ALIAS for cpufreq on ARM IMX (Akshu
           Agrawal, Nicolas Chauvet).
      
         - Fix the prototype of swsusp_arch_resume() on x86 (Arnd Bergmann).
      
         - Fix up the parsing of power domains DT data (Ulf Hansson)"
      
      * tag 'pm-part2-4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        arm: imx: Add MODULE_ALIAS for cpufreq
        cpufreq: Add and use cpufreq_for_each_{valid_,}entry_idx()
        cpufreq: intel_pstate: Enable HWP during system resume on CPU0
        cpufreq: scpi: fix error return code in scpi_cpufreq_init()
        x86: hibernate: fix swsusp_arch_resume() prototype
        PM / domains: Fix up domain-idle-states OF parsing
        cpufreq: scpi: fix static checker warning cdev isn't an ERR_PTR
        cpufreq: remove at32ap-cpufreq
        cpufreq: AMD: Ignore the check for ProcFeedback in ST/CZ
        x86: PM: Make APM idle driver initialize polling state
        cpufreq: Skip cpufreq resume if it's not suspended
      a051c14b
    • Trond Myklebust's avatar
      SUNRPC: Don't call __UDPX_INC_STATS() from a preemptible context · 0afa6b44
      Trond Myklebust authored
      Calling __UDPX_INC_STATS() from a preemptible context leads to a
      warning of the form:
      
       BUG: using __this_cpu_add() in preemptible [00000000] code: kworker/u5:0/31
       caller is xs_udp_data_receive_workfn+0x194/0x270
       CPU: 1 PID: 31 Comm: kworker/u5:0 Not tainted 4.15.0-rc8-00076-g90ea9f1b #2
       Workqueue: xprtiod xs_udp_data_receive_workfn
       Call Trace:
        dump_stack+0x85/0xc1
        check_preemption_disabled+0xce/0xe0
        xs_udp_data_receive_workfn+0x194/0x270
        process_one_work+0x318/0x620
        worker_thread+0x20a/0x390
        ? process_one_work+0x620/0x620
        kthread+0x120/0x130
        ? __kthread_bind_mask+0x60/0x60
        ret_from_fork+0x24/0x30
      
      Since we're taking a spinlock in those functions anyway, let's fix the
      issue by moving the call so that it occurs under the spinlock.
      Reported-by: default avatarkernel test robot <fengguang.wu@intel.com>
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
      0afa6b44
    • Tomi Valkeinen's avatar
      video: omapfb: fix missing #includes · b9058afc
      Tomi Valkeinen authored
      The omapfb driver fails to build after commit 23c35f48
      ("pinctrl: remove include file from <linux/device.h>") because it
      relies on the <linux/pinctrl/consumer.h> and <linux/seq_file.h>
      being pulled in by the <linux/device.h> header implicitly.
      
      Include these headers explicitly to avoid the build failures.
      
      Fixes: 23c35f48 ("pinctrl: remove include file from <linux/device.h>")
      Signed-off-by: default avatarTomi Valkeinen <tomi.valkeinen@ti.com>
      Tested-by: default avatarTony Lindgren <tony@atomide.com>
      [b.zolnierkie: fix include order and patch description]
      Signed-off-by: default avatarBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
      b9058afc
  2. 08 Feb, 2018 14 commits
    • Daniel Borkmann's avatar
      Merge branch 'bpf-libbpf-relo-fix-and-tests' · d977ae59
      Daniel Borkmann authored
      Jesper Dangaard Brouer says:
      
      ====================
      While playing with using libbpf for the Suricata project, we had
      issues LLVM >= 4.0.1 generating ELF files that could not be loaded
      with libbpf (tools/lib/bpf/).
      
      During the troubleshooting phase, I wrote a test program and improved
      the debugging output in libbpf.  I turned this into a selftests
      program, and it also serves as a code example for libbpf in itself.
      
      I discovered that there are at least three ELF load issues with
      libbpf.  I left them as TODO comments in (tools/testing/selftests/bpf)
      test_libbpf.sh. I've only fixed the load issue with eh_frames, and
      other types of relo-section that does not have exec flags.  We can
      work on the other issues later.
      ====================
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      d977ae59
    • Jesper Dangaard Brouer's avatar
      tools/libbpf: handle issues with bpf ELF objects containing .eh_frames · e3d91b0c
      Jesper Dangaard Brouer authored
      V3: More generic skipping of relo-section (suggested by Daniel)
      
      If clang >= 4.0.1 is missing the option '-target bpf', it will cause
      llc/llvm to create two ELF sections for "Exception Frames", with
      section names '.eh_frame' and '.rel.eh_frame'.
      
      The BPF ELF loader library libbpf fails when loading files with these
      sections.  The other in-kernel BPF ELF loader in samples/bpf/bpf_load.c,
      handle this gracefully. And iproute2 loader also seems to work with these
      "eh" sections.
      
      The issue in libbpf is caused by bpf_object__elf_collect() skipping
      some sections, and later when performing relocation it will be
      pointing to a skipped section, as these sections cannot be found by
      bpf_object__find_prog_by_idx() in bpf_object__collect_reloc().
      
      This is a general issue that also occurs for other sections, like
      debug sections which are also skipped and can have relo section.
      
      As suggested by Daniel.  To avoid keeping state about all skipped
      sections, instead perform a direct qlookup in the ELF object.  Lookup
      the section that the relo-section points to and check if it contains
      executable machine instructions (denoted by the sh_flags
      SHF_EXECINSTR).  Use this check to also skip irrelevant relo-sections.
      
      Note, for samples/bpf/ the '-target bpf' parameter to clang cannot be used
      due to incompatibility with asm embedded headers, that some of the samples
      include. This is explained in more details by Yonghong Song in bpf_devel_QA.
      Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      e3d91b0c
    • Jesper Dangaard Brouer's avatar
      selftests/bpf: add selftest that use test_libbpf_open · f09b2e38
      Jesper Dangaard Brouer authored
      This script test_libbpf.sh will be part of the 'make run_tests'
      invocation, but can also be invoked manually in this directory,
      and a verbose mode can be enabled via setting the environment
      variable $VERBOSE like:
      
       $ VERBOSE=yes ./test_libbpf.sh
      
      The script contains some tests that are commented out, as they
      currently fail.  They are reminders about what we need to improve
      for the libbpf loader library.
      Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      f09b2e38
    • Jesper Dangaard Brouer's avatar
      selftests/bpf: add test program for loading BPF ELF files · 864db336
      Jesper Dangaard Brouer authored
      V2: Moved program into selftests/bpf from tools/libbpf
      
      This program can be used on its own for testing/debugging if a
      BPF ELF-object file can be loaded with libbpf (from tools/lib/bpf).
      
      If something is wrong with the ELF object, the program have
      a --debug mode that will display the ELF sections and especially
      the skipped sections.  This allows for quickly identifying the
      problematic ELF section number, which can be corrolated with the
      readelf tool.
      
      The program signal error via return codes, and also have
      a --quiet mode, which is practical for use in scripts like
      selftests/bpf.
      Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      864db336
    • Jesper Dangaard Brouer's avatar
      tools/libbpf: improve the pr_debug statements to contain section numbers · 077c066a
      Jesper Dangaard Brouer authored
      While debugging a bpf ELF loading issue, I needed to correlate the
      ELF section number with the failed relocation section reference.
      Thus, add section numbers/index to the pr_debug.
      
      In debug mode, also print section that were skipped.  This helped
      me identify that a section (.eh_frame) was skipped, and this was
      the reason the relocation section (.rel.eh_frame) could not find
      that section number.
      
      The section numbers corresponds to the readelf tools Section Headers [Nr].
      Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      077c066a
    • Jesper Dangaard Brouer's avatar
      bpf: Sync kernel ABI header with tooling header for bpf_common.h · 8c88181e
      Jesper Dangaard Brouer authored
      I recently fixed up a lot of commits that forgot to keep the tooling
      headers in sync.  And then I forgot to do the same thing in commit
      cb5f7334 ("bpf: add comments to BPF ld/ldx sizes"). Let correct
      that before people notice ;-).
      
      Lawrence did partly fix/sync this for bpf.h in commit d6d4f60c
      ("bpf: add selftest for tcpbpf").
      
      Fixes: cb5f7334 ("bpf: add comments to BPF ld/ldx sizes")
      Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      8c88181e
    • Linus Torvalds's avatar
      Merge tag 'nfsd-4.16' of git://linux-nfs.org/~bfields/linux · f1517df8
      Linus Torvalds authored
      Pull nfsd update from Bruce Fields:
       "A fairly small update this time around. Some cleanup, RDMA fixes,
        overlayfs fixes, and a fix for an NFSv4 state bug.
      
        The bigger deal for nfsd this time around was Jeff Layton's
        already-merged i_version patches"
      
      * tag 'nfsd-4.16' of git://linux-nfs.org/~bfields/linux:
        svcrdma: Fix Read chunk round-up
        NFSD: hide unused svcxdr_dupstr()
        nfsd: store stat times in fill_pre_wcc() instead of inode times
        nfsd: encode stat->mtime for getattr instead of inode->i_mtime
        nfsd: return RESOURCE not GARBAGE_ARGS on too many ops
        nfsd4: don't set lock stateid's sc_type to CLOSED
        nfsd: Detect unhashed stids in nfsd4_verify_open_stid()
        sunrpc: remove dead code in svc_sock_setbufsize
        svcrdma: Post Receives in the Receive completion handler
        nfsd4: permit layoutget of executable-only files
        lockd: convert nlm_rqst.a_count from atomic_t to refcount_t
        lockd: convert nlm_lockowner.count from atomic_t to refcount_t
        lockd: convert nsm_handle.sm_count from atomic_t to refcount_t
      f1517df8
    • Linus Torvalds's avatar
      Merge branch 'idr-2018-02-06' of git://git.infradead.org/users/willy/linux-dax · 9d21874d
      Linus Torvalds authored
      Pull idr updates from Matthew Wilcox:
      
       - test-suite improvements
      
       - replace the extended API by improving the normal API
      
       - performance improvement for IDRs which are 1-based rather than
         0-based
      
       - add documentation
      
      * 'idr-2018-02-06' of git://git.infradead.org/users/willy/linux-dax:
        idr: Add documentation
        idr: Make 1-based IDRs more efficient
        idr: Warn if old iterators see large IDs
        idr: Rename idr_for_each_entry_ext
        idr: Remove idr_alloc_ext
        cls_u32: Convert to idr_alloc_u32
        cls_u32: Reinstate cyclic allocation
        cls_flower: Convert to idr_alloc_u32
        cls_bpf: Convert to use idr_alloc_u32
        cls_basic: Convert to use idr_alloc_u32
        cls_api: Convert to idr_alloc_u32
        net sched actions: Convert to use idr_alloc_u32
        idr: Add idr_alloc_u32 helper
        idr: Delete idr_find_ext function
        idr: Delete idr_replace_ext function
        idr: Delete idr_remove_ext function
        IDR test suite: Check handling negative end correctly
        idr test suite: Fix ida_test_random()
        radix tree test suite: Remove ARRAY_SIZE
      9d21874d
    • Linus Torvalds's avatar
      Merge tag 'gcc-plugins-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · 4ed8244e
      Linus Torvalds authored
      Pull gcc plugins updates from Kees Cook:
      
       - update includes for gcc 8 (Valdis Kletnieks)
      
       - update initializers for gcc 8
      
      * tag 'gcc-plugins-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        gcc-plugins: Use dynamic initializers
        gcc-plugins: Add include required by GCC release 8
      4ed8244e
    • Olga Kornievskaia's avatar
      fix parallelism for rpc tasks · f515f86b
      Olga Kornievskaia authored
      Hi folks,
      
      On a multi-core machine, is it expected that we can have parallel RPCs
      handled by each of the per-core workqueue?
      
      In testing a read workload, observing via "top" command that a single
      "kworker" thread is running servicing the requests (no parallelism).
      It's more prominent while doing these operations over krb5p mount.
      
      What has been suggested by Bruce is to try this and in my testing I
      see then the read workload spread among all the kworker threads.
      Signed-off-by: default avatarOlga Kornievskaia <kolga@netapp.com>
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
      f515f86b
    • Heiner Kallweit's avatar
      net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT · 08f51385
      Heiner Kallweit authored
      This condition wasn't adjusted when PHY_IGNORE_INTERRUPT (-2) was added
      long ago. In case of PHY_IGNORE_INTERRUPT the MAC interrupt indicates
      also PHY state changes and we should do what the symbol says.
      
      Fixes: 84a527a4 ("net: phylib: fix interrupts re-enablement in phy_start")
      Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      08f51385
    • Dean Nelson's avatar
      net: thunder: change q_len's type to handle max ring size · 88c991a9
      Dean Nelson authored
      The Cavium thunder nicvf driver supports rx/tx rings of up to 65536 entries per.
      The number of entires are stored in the q_len member of struct q_desc_mem. The
      problem is that q_len being a u16, results in 65536 becoming 0.
      
      In getting pointers to descriptors in the rings, the driver uses q_len minus 1
      as a mask after incrementing the pointer, in order to go back to the beginning
      and not go past the end of the ring.
      
      With the q_len set to 0 the mask is no longer correct and the driver does go
      beyond the end of the ring, causing various ills. Usually the first thing that
      shows up is a "NETDEV WATCHDOG: enP2p1s0f1 (nicvf): transmit queue 7 timed out"
      warning.
      
      This patch remedies the problem by changing q_len to a u32.
      Signed-off-by: default avatarDean Nelson <dnelson@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      88c991a9
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-next-for-davem-2018-02-08' of... · e0c42c8e
      David S. Miller authored
      Merge tag 'wireless-drivers-next-for-davem-2018-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next
      
      Kalle Valo says:
      
      ====================
      wireless-drivers-next patches for 4.16
      
      The most important here is the ssb fix, it has been reported by the
      users frequently and the fix just missed the final v4.15. Also
      numerous other fixes, mt76 had multiple problems with aggregation and
      a long standing unaligned access bug in rtlwifi is finally fixed.
      
      Major changes:
      
      ath10k
      
      * correct firmware RAM dump length for QCA6174/QCA9377
      
      * add new QCA988X device id
      
      * fix a kernel panic during pci probe
      
      * revert a recent commit which broke ath10k firmware metadata parsing
      
      ath9k
      
      * fix a noise floor regression introduced during the merge window
      
      * add new device id
      
      rtlwifi
      
      * fix unaligned access seen on ARM architecture
      
      mt76
      
      * various aggregation fixes which fix connection stalls
      
      ssb
      
      * fix b43 and b44 on non-MIPS which broke in v4.15-rc9
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e0c42c8e
    • Hoang Le's avatar
      tipc: fix skb truesize/datasize ratio control · 55b3280d
      Hoang Le authored
      In commit d618d09a ("tipc: enforce valid ratio between skb truesize
      and contents") we introduced a test for ensuring that the condition
      truesize/datasize <= 4 is true for a received buffer. Unfortunately this
      test has two problems.
      
      - Because of the integer arithmetics the test
        if (skb->truesize / buf_roundup_len(skb) > 4) will miss all
        ratios [4 < ratio < 5], which was not the intention.
      - The buffer returned by skb_copy() inherits skb->truesize of the
        original buffer, which doesn't help the situation at all.
      
      In this commit, we change the ratio condition and replace skb_copy()
      with a call to skb_copy_expand() to finally get this right.
      Acked-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      55b3280d