1. 24 Mar, 2017 18 commits
    • Linus Torvalds's avatar
      Merge tag 'vfio-v4.11-rc4' of git://github.com/awilliam/linux-vfio · d07c6f46
      Linus Torvalds authored
      Pull VFIO fix from Alex Williamson:
       "Rework sanity check for mdev driver group notifier de-registration
        (Alex Williamson)"
      
      * tag 'vfio-v4.11-rc4' of git://github.com/awilliam/linux-vfio:
        vfio: Rework group release notifier warning
      d07c6f46
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 04e904aa
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A few fixes for the current series that should go into -rc4. This
        contains:
      
         - a fix for a potential corruption of un-started requests from Ming.
      
         - a blk-stat fix from Omar, ensuring we flush the stat batch before
           checking nr_samples.
      
         - a set of fixes from Sagi for the nvmeof family"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        blk-mq: don't complete un-started request in timeout handler
        nvme-loop: handle cpu unplug when re-establishing the controller
        nvme-rdma: handle cpu unplug when re-establishing the controller
        nvmet-rdma: Fix a possible uninitialized variable dereference
        nvmet: confirm sq percpu has scheduled and switched to atomic
        nvme-loop: fix a possible use-after-free when destroying the admin queue
        blk-stat: fix blk_stat_sum() if all samples are batched
      04e904aa
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-4.11-rc4' of git://github.com/ceph/ceph-client · 59d9cb91
      Linus Torvalds authored
      Pull ceph fix from Ilya Dryomov:
       "A fix for a writeback deadlock caused by a GFP_KERNEL allocation on
        the reclaim path, tagged for stable"
      
      * tag 'ceph-for-4.11-rc4' of git://github.com/ceph/ceph-client:
        libceph: force GFP_NOIO for socket allocations
      59d9cb91
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 2056b7c7
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
      
       - a couple of OMAP 4.11 regression fixes, including a boot regression
         for SmartReflex, hypervisor mode in thumb2 mode, and reference
         counting of device nodes
      
       - a fix for cpu_idle on at91
      
       - minor DT fixes on across several platforms: sunxi, bcm53xx, at91,
         nsp, ns2, ux500, omap
      
       - a fix to correct an API change in the reset controllers
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (22 commits)
        arm64: dts: NS2: Add dma-coherent to relevant DT entries
        reset: fix optional reset_control_get stubs to return NULL
        ARM: sun8i: a23/a33: drop bl_en_pin GPIO pinmux in reference design DTSI
        ARM: dts: sun7i: lamobo-r1: Fix CPU port RGMII settings
        ARM: dts: NSP: GPIO reboot open-source
        ARM: at91: pm: cpu_idle: switch DDR to power-down mode
        ARM: dts: add the AB8500 clocks to the device tree
        ARM: dts: imx6sx-udoo-neo: Fix reboot hang
        ARM: sun8i: Fix the mali clock rate
        ARM: dts: BCM5301X: Correct GIC_PPI interrupt flags
        ARM: dts: BCM5301X: Fix memory start address
        ARM: dts: BCM5301X: Fix UARTs on bcm953012k
        Revert "ARM: at91/dt: sama5d2: Use new compatible for ohci node"
        ARM: OMAP2+: Release device node after it is no longer needed.
        ARM: OMAP2+: Fix device node reference counts
        ARM: OMAP2+: Remove legacy gpmc-nand.c
        ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure
        ARM: dts: am335x-pcm953: Fix legacy wakeup source binding
        ARM: omap2plus_defconfig: Enable INPUT_MOUSEDEV as loadable modules
        ARM: dts: am57xx-idk: tpic2810 is on I2C bus, not SPI
        ...
      2056b7c7
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.11b-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 42ea16f8
      Linus Torvalds authored
      Pull xen fixes from Juergen Gross:
       "Fixes for PM under Xen"
      
      * tag 'for-linus-4.11b-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen/acpi: upload PM state from init-domain to Xen
        xen/acpi: Replace hard coded "ACPI0007"
      42ea16f8
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 69917da7
      Linus Torvalds authored
      Pull arm64 fixes from Will Deacon:
       "There's a kaslr fix and then two patches to update our native and
        compat syscall tables. Arnd asked that we take the addition of statx
        to the asm-generic unistd.h via arm64, as he didn't have anything
        queued in the asm-generic tree.
      
        Summary:
      
         - Fix mapping of kernel image under certain kaslr offsets
      
         - Hook up new statx syscall in asm-generic syscall table
      
         - Update compat syscall table to match arch/arm/ (pkeys and statx)"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: kaslr: Fix up the kernel image alignment
        arm64: compat: Update compat syscalls
        generic syscalls: Wire up statx syscall
      69917da7
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · e8fe23ff
      Linus Torvalds authored
      Pull crypto fixes from Herbert Xu:
       "This fixes regressions in the crypto ccp driver and the hwrng drivers
        for amd and geode"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        hwrng: geode - Revert managed API changes
        hwrng: amd - Revert managed API changes
        crypto: ccp - Assign DMA commands to the channel's CCP
      e8fe23ff
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v4.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 213e4eb2
      Linus Torvalds authored
      Pull IOMMU fixes from Joerg Roedel:
       "A few fixes piled up:
      
         - fix a NULL-ptr dereference that happens in VT-d on some platforms
      
         - a fix for ARM MSI region reporting, so that a sane interface makes
           it to a released kernel
      
         - fixes for leaf-checking in ARM io-page-table code
      
         - two fixes for IO/TLB flushing code on ARM Exynos platforms"
      
      * tag 'iommu-fixes-v4.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        iommu: Disambiguate MSI region types
        iommu/exynos: Workaround FLPD cache flush issues for SYSMMU v5
        iommu/exynos: Block SYSMMU while invalidating FLPD cache
        iommu/vt-d: Fix NULL pointer dereference in device_to_iommu
        iommu/io-pgtable-arm-v7s: Check for leaf entry before dereferencing it
        iommu/io-pgtable-arm: Check for leaf entry before dereferencing it
      213e4eb2
    • Linus Torvalds's avatar
      Merge tag 'mmc-v4.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 9a31328f
      Linus Torvalds authored
      Pull mmc fixes from Ulf Hansson:
       "Here are a couple of mmc fixes intended for v4.11 rc4.
      
        MMC core:
         - Fix initialization of HS400-ES eMMC cards
         - A couple of fixes for the mmc block device driver
         - Resolved a compiler warning
      
        MMC host:
         - sdhci: Do not disable IRQs while waiting for clock
         - sdhci-pci: Do not disable IRQs in sdhci_intel_set_power
         - sdhci-of-arasan: Fix incorrect timeout clock
         - mediatek: Fix bug for setting wrong clock frequency
         - sdhci-of-at91: Use regulator to fix cmd timeout errors
         - ushc: Fix NULL-deref at probe
         - rockchip-dw-mshc: Rename RK1108 to RV1108 in DT"
      
      * tag 'mmc-v4.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: sdhci-pci: Do not disable interrupts in sdhci_intel_set_power
        mmc: sdhci: Do not disable interrupts while waiting for clock
        mmc: ushc: fix NULL-deref at probe
        mmc: sdhci-of-at91: Support external regulators
        mmc: core: mmc_blk_rw_cmd_err - remove unused variable
        mmc: mediatek: Fixed bug where clock frequency could be set wrong
        mmc: block: Fix cmd error reset failure path
        mmc: block: Fix is_waiting_last_req set incorrectly
        mmc: core: Fix access to HS400-ES devices
        mmc: sdhci-of-arasan: fix incorrect timeout clock
        dt-bindings: rockchip-dw-mshc: rename RK1108 to RV1108
      9a31328f
    • Linus Torvalds's avatar
      Merge tag 'media/v4.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · e8871186
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
      
       - dvb-usb-firmware: don't do DMA on stack
      
       - coda/imx-vdoa: platform_driver should not be const
      
       - bdisp: Clean up file handle in open() error path
      
       - exynos-gsc: Do not swap cb/cr for semi planar formats
      
      * tag 'media/v4.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        [media] exynos-gsc: Do not swap cb/cr for semi planar formats
        [media] bdisp: Clean up file handle in open() error path
        [media] coda/imx-vdoa: platform_driver should not be const
        [media] dvb-usb-firmware: don't do DMA on stack
      e8871186
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.11-rc4' of git://people.freedesktop.org/~airlied/linux · 86b7eab2
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
      
       - one core drm/fbdev regression fix
      
       - a set of i915 fixes including a few GVT related fixes, along with
         some reset fixes
      
       - one new PCI id for amdgpu, and some minor workaround regression
         fixes
      
       - .. and a set of exynos fixes, dropping support for an old unsupported
         SoC, some vblank timing fixes, and an info leak fix
      
      * tag 'drm-fixes-for-v4.11-rc4' of git://people.freedesktop.org/~airlied/linux: (34 commits)
        drm/fb-helper: Allow var->x/yres(_virtual) < fb->width/height again
        drm/i915: make context status notifier head be per engine
        drm/i915: Avoid rcu_barrier() from reclaim paths (shrinker)
        drm/exynos/dsi: make te-gpios optional
        drm/exynos: Print kernel pointers in a restricted form
        drm/exynos/decon5433: fix software trigger mask
        drm/exynos/fimd: signal frame done interrupt at front porch
        drm/exynos/decon5433: signal frame done interrupt at front porch
        drm/exynos/decon5433: fix vblank event handling
        drm/exynos: move crtc event handling to drivers callbacks
        drm/exynos: Remove support for Exynos4415 (SoC not supported anymore)
        drm/exynos/decon5433: & vs | typo
        drm/amd/amdgpu: add POLARIS12 PCI ID
        drm/i915/gvt: Fix gvt scheduler interval time
        drm/i915/gvt: GVT pin/unpin shadow context
        drm/i915/gvt: scan shadow indirect context image when valid
        drm/i915/kvmgt: fix suspicious rcu dereference usage
        drm/i915/gvt: add enable_execlists check before enable gvt
        drm/i915/gvt: Remove bogus retry around i915_wait_request
        drm/i915/gvt: correct the ggtt valid bit check in pipe control command
        ...
      86b7eab2
    • Arnd Bergmann's avatar
      Merge tag 'arm-soc/for-4.11/devicetree-arm64-fixes' of... · 0fa974b8
      Arnd Bergmann authored
      Merge tag 'arm-soc/for-4.11/devicetree-arm64-fixes' of http://github.com/Broadcom/stblinux into fixes
      
      Pull "Broadcom arm64 Device Tree fixes for 4.11" from Florian Fainelli:
      
      This pull request contains Broadcom ARM64-based SoCs Device Tree fixes for 4.11,
      please pull the following:
      
      - Jon adds missing "dma-coherent" property to the Northstar 2 DTS include file
        in order to fix both performance and cache problems for: PCIe, Ethernet,
        PDC/mailbox, SATA3 and SDHCI
      
      * tag 'arm-soc/for-4.11/devicetree-arm64-fixes' of http://github.com/Broadcom/stblinux:
        arm64: dts: NS2: Add dma-coherent to relevant DT entries
      0fa974b8
    • Arnd Bergmann's avatar
      Merge tag 'arm-soc/for-4.11/devicetree-fixes-2' of http://github.com/Broadcom/stblinux into fixes · bf3f5308
      Arnd Bergmann authored
      Pull "Broadcom arm Device Tree fixes for 4.11 (part 2)" from Florian Fainelli:
      
      This pull request contains Broadcom ARM-based SoCs Device Tree fixes for 4.11,
      please pull the following:
      
      - Jon fixes a reboot issue on most Northstar Plus platforms by adding the
        "open-source" property to the "gpio-restart" Device Tree nodes
      
      * tag 'arm-soc/for-4.11/devicetree-fixes-2' of http://github.com/Broadcom/stblinux:
        ARM: dts: NSP: GPIO reboot open-source
      bf3f5308
    • Linus Torvalds's avatar
      Merge tag 'pm-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · ebe64824
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "One of these is an intel_pstate regression fix and it is not a small
        change, but it mostly removes code that shouldn't be there. That code
        was acquired by mistake and has been a source of constant pain since
        then, so the time has come to get rid of it finally. We have not seen
        problems with this change in the lab, so fingers crossed.
      
        The rest is more usual: one more intel_pstate commit removing useless
        code, a cpufreq core fix to make it restore policy limits on CPU
        online (which prevents the limits from being reset over system
        suspend/resume), a schedutil cpufreq governor initialization fix to
        make it actually work as advertised on all systems and an extra sanity
        check in the cpuidle core to prevent crashes from happening if the
        arch code messes things up.
      
        Specifics:
      
         - Make intel_pstate use one set of global P-state limits in the
           active mode regardless of the scaling_governor settings for
           individual CPUs instead of switching back and forth between two of
           them in a way that is hard to control (Rafael Wysocki).
      
         - Drop a useless function from intel_pstate to prevent it from
           modifying the maximum supported frequency value unexpectedly which
           may confuse the cpufreq core (Rafael Wysocki).
      
         - Fix the cpufreq core to restore policy limits on CPU online so that
           the limits are not reset over system suspend/resume, among other
           things (Viresh Kumar).
      
         - Fix the initialization of the schedutil cpufreq governor to make
           the IO-wait boosting mechanism in it actually work on systems with
           one CPU per cpufreq policy (Rafael Wysocki).
      
         - Add a sanity check to the cpuidle core to prevent crashes from
           happening if the architecture code initialization fails to set up
           things as expected (Vaidyanathan Srinivasan)"
      
      * tag 'pm-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        cpufreq: Restore policy min/max limits on CPU online
        cpuidle: Validate cpu_dev in cpuidle_add_sysfs()
        cpufreq: intel_pstate: Fix policy data management in passive mode
        cpufreq: schedutil: Fix per-CPU structure initialization in sugov_start()
        cpufreq: intel_pstate: One set of global limits in active mode
      ebe64824
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 02a2cad8
      Linus Torvalds authored
      Pull input fixes from Dmitry Torokhov:
       "Fixes to various USB drivers to validate existence of endpoints before
        trying to use them, fixes to APLS v8 protocol, and a couple of i8042
        quirks"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: ALPS - fix trackstick button handling on V8 devices
        Input: ALPS - fix V8+ protocol handling (73 03 28)
        Input: sur40 - validate number of endpoints before using them
        Input: kbtab - validate number of endpoints before using them
        Input: hanwang - validate number of endpoints before using them
        Input: yealink - validate number of endpoints before using them
        Input: ims-pcu - validate number of endpoints before using them
        Input: cm109 - validate number of endpoints before using them
        Input: iforce - validate number of endpoints before using them
        Input: elan_i2c - add ASUS EeeBook X205TA special touchpad fw
        Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list
        Input: synaptics-rmi4 - prevent null pointer dereference in f30
        Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000
      02a2cad8
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.11' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · d64a0472
      Dave Airlie authored
      A few small fixes for 4.11
      
      * 'drm-fixes-4.11' of git://people.freedesktop.org/~agd5f/linux:
        drm/amd/amdgpu: add POLARIS12 PCI ID
        drm/amdgpu: fix the clearing wb size
        drm/amdgpu: reinstate oland workaround for sclk
        drm/radeon: reinstate oland workaround for sclk
      d64a0472
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2017-03-23' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes · f505a5c0
      Dave Airlie authored
      One fbdev regression fix from Michel
      
      * tag 'drm-misc-fixes-2017-03-23' of git://anongit.freedesktop.org/git/drm-misc:
        drm/fb-helper: Allow var->x/yres(_virtual) < fb->width/height again
      f505a5c0
    • Dave Airlie's avatar
      Merge branch 'exynos-drm-fixes' of... · 8201f1e8
      Dave Airlie authored
      Merge branch 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes
      
         Just several fixups,
         - fix page fault and vblank timeout issues due to delayed vblank handling.
         - fix panel driver probing to fail without te-gpios property.
         - fix potential security hole by using "%pK" format.
         - fix wrong if statement condition.
      
         And one cleanup which removes Exynos4415 SoC support which is not supported
         anymore.
      
      * 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
        drm/exynos/dsi: make te-gpios optional
        drm/exynos: Print kernel pointers in a restricted form
        drm/exynos/decon5433: fix software trigger mask
        drm/exynos/fimd: signal frame done interrupt at front porch
        drm/exynos/decon5433: signal frame done interrupt at front porch
        drm/exynos/decon5433: fix vblank event handling
        drm/exynos: move crtc event handling to drivers callbacks
        drm/exynos: Remove support for Exynos4415 (SoC not supported anymore)
        drm/exynos/decon5433: & vs | typo
      8201f1e8
  2. 23 Mar, 2017 17 commits
    • Rafael J. Wysocki's avatar
      Merge branch 'pm-cpuidle-fixes' · 90ff2b72
      Rafael J. Wysocki authored
      * pm-cpuidle-fixes:
        cpuidle: Validate cpu_dev in cpuidle_add_sysfs()
      90ff2b72
    • Rafael J. Wysocki's avatar
      Merge branches 'pm-cpufreq-fixes', 'pm-cpufreq-sched-fixes' and 'intel_pstate-fixes' · 6488294e
      Rafael J. Wysocki authored
      * pm-cpufreq-fixes:
        cpufreq: Restore policy min/max limits on CPU online
      
      * pm-cpufreq-sched-fixes:
        cpufreq: schedutil: Fix per-CPU structure initialization in sugov_start()
      
      * intel_pstate-fixes:
        cpufreq: intel_pstate: Fix policy data management in passive mode
        cpufreq: intel_pstate: One set of global limits in active mode
      6488294e
    • Linus Torvalds's avatar
      Merge tag 'sound-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · d038e3dc
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This contains the collection of small fixes for 4.11 that were pending
        during my vacation:
      
         - a few HD-audio quirks (more Dell headset support, docking station
           support on HP laptops)
      
         - a regression fix for the previous ctxfi DMA mask fix
      
         - a correction of the new CONFIG_SND_X86 menu entry
      
         - a fix for the races in ALSA sequencer core spotted by syzkaller"
      
      * tag 'sound-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - Adding a group of pin definition to fix headset problem
        ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()
        ALSA: x86: Make CONFIG_SND_X86 bool
        ALSA: hda - add support for docking station for HP 840 G3
        ALSA: hda - add support for docking station for HP 820 G2
        ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call
      d038e3dc
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 131fbf4f
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "Zygo tracked down a very old bug with inline compressed extents.
      
        I didn't tag this one for stable because I want to do individual
        tested backports. It's a little tricky and I'd rather do some extra
        testing on it along the way"
      
      * 'for-linus-4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        btrfs: add missing memset while reading compressed inline extents
        Btrfs: fix regression in lock_delalloc_pages
        btrfs: remove btrfs_err_str function from uapi/linux/btrfs.h
      131fbf4f
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · f341d9f0
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Several netfilter fixes from Pablo and the crew:
            - Handle fragmented packets properly in netfilter conntrack, from
              Florian Westphal.
            - Fix SCTP ICMP packet handling, from Ying Xue.
            - Fix big-endian bug in nftables, from Liping Zhang.
            - Fix alignment of fake conntrack entry, from Steven Rostedt.
      
       2) Fix feature flags setting in fjes driver, from Taku Izumi.
      
       3) Openvswitch ipv6 tunnel source address not set properly, from Or
          Gerlitz.
      
       4) Fix jumbo MTU handling in amd-xgbe driver, from Thomas Lendacky.
      
       5) sk->sk_frag.page not released properly in some cases, from Eric
          Dumazet.
      
       6) Fix RTNL deadlocks in nl80211, from Johannes Berg.
      
       7) Fix erroneous RTNL lockdep splat in crypto, from Herbert Xu.
      
       8) Cure improper inflight handling during AF_UNIX GC, from Andrey
          Ulanov.
      
       9) sch_dsmark doesn't write to packet headers properly, from Eric
          Dumazet.
      
      10) Fix SCM_TIMESTAMPING_OPT_STATS handling in TCP, from Soheil Hassas
          Yeganeh.
      
      11) Add some IDs for Motorola qmi_wwan chips, from Tony Lindgren.
      
      12) Fix nametbl deadlock in tipc, from Ying Xue.
      
      13) GRO and LRO packets not counted correctly in mlx5 driver, from Gal
          Pressman.
      
      14) Fix reset of internal PHYs in bcmgenet, from Doug Berger.
      
      15) Fix hashmap allocation handling, from Alexei Starovoitov.
      
      16) nl_fib_input() needs stronger netlink message length checking, from
          Eric Dumazet.
      
      17) Fix double-free of sk->sk_filter during sock clone, from Daniel
          Borkmann.
      
      18) Fix RX checksum offloading in aquantia driver, from Pavel Belous.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (85 commits)
        net:ethernet:aquantia: Fix for RX checksum offload.
        amd-xgbe: Fix the ECC-related bit position definitions
        sfc: cleanup a condition in efx_udp_tunnel_del()
        Bluetooth: btqcomsmd: fix compile-test dependency
        inet: frag: release spinlock before calling icmp_send()
        tcp: initialize icsk_ack.lrcvtime at session start time
        genetlink: fix counting regression on ctrl_dumpfamily()
        socket, bpf: fix sk_filter use after free in sk_clone_lock
        ipv4: provide stronger user input validation in nl_fib_input()
        bpf: fix hashmap extra_elems logic
        enic: update enic maintainers
        net: bcmgenet: remove bcmgenet_internal_phy_setup()
        ipv6: make sure to initialize sockc.tsflags before first use
        fjes: Do not load fjes driver if extended socket device is not power on.
        fjes: Do not load fjes driver if system does not have extended socket device.
        net/mlx5e: Count LRO packets correctly
        net/mlx5e: Count GSO packets correctly
        net/mlx5: Increase number of max QPs in default profile
        net/mlx5e: Avoid supporting udp tunnel port ndo for VF reps
        net/mlx5e: Use the proper UAPI values when offloading TC vlan actions
        ...
      f341d9f0
    • Ankur Arora's avatar
      xen/acpi: upload PM state from init-domain to Xen · 1914f0cd
      Ankur Arora authored
      This was broken in commit cd979883 ("xen/acpi-processor:
      fix enabling interrupts on syscore_resume"). do_suspend (from
      xen/manage.c) and thus xen_resume_notifier never get called on
      the initial-domain at resume (it is if running as guest.)
      
      The rationale for the breaking change was that upload_pm_data()
      potentially does blocking work in syscore_resume(). This patch
      addresses the original issue by scheduling upload_pm_data() to
      execute in workqueue context.
      
      Cc: Stanislaw Gruszka <sgruszka@redhat.com>
      Cc: stable@vger.kernel.org
      Based-on-patch-by: default avatarKonrad Wilk <konrad.wilk@oracle.com>
      Reviewed-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Reviewed-by: default avatarStanislaw Gruszka <sgruszka@redhat.com>
      Signed-off-by: default avatarAnkur Arora <ankur.a.arora@oracle.com>
      Signed-off-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
      1914f0cd
    • Michel Dänzer's avatar
      drm/fb-helper: Allow var->x/yres(_virtual) < fb->width/height again · 12ffed96
      Michel Dänzer authored
      Otherwise this can also prevent modesets e.g. for switching VTs, when
      multiple monitors with different native resolutions are connected.
      
      The depths must match though, so keep the != test for that.
      
      Also update the DRM_DEBUG output to be slightly more accurate, this
      doesn't only affect requests from userspace.
      
      Bugzilla: https://bugs.freedesktop.org/99841
      Fixes: 865afb11 ("drm/fb-helper: reject any changes to the fbdev")
      Signed-off-by: default avatarMichel Dänzer <michel.daenzer@amd.com>
      Reviewed-by: default avatarDaniel Stone <daniels@collabora.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: http://patchwork.freedesktop.org/patch/msgid/20170323085326.20185-1-michel@daenzer.net
      12ffed96
    • Ankur Arora's avatar
      xen/acpi: Replace hard coded "ACPI0007" · 1c2593cc
      Ankur Arora authored
      Replace hard coded "ACPI0007" with ACPI_PROCESSOR_DEVICE_HID
      Reviewed-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Signed-off-by: default avatarAnkur Arora <ankur.a.arora@oracle.com>
      Signed-off-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
      1c2593cc
    • Ilya Dryomov's avatar
      libceph: force GFP_NOIO for socket allocations · 633ee407
      Ilya Dryomov authored
      sock_alloc_inode() allocates socket+inode and socket_wq with
      GFP_KERNEL, which is not allowed on the writeback path:
      
          Workqueue: ceph-msgr con_work [libceph]
          ffff8810871cb018 0000000000000046 0000000000000000 ffff881085d40000
          0000000000012b00 ffff881025cad428 ffff8810871cbfd8 0000000000012b00
          ffff880102fc1000 ffff881085d40000 ffff8810871cb038 ffff8810871cb148
          Call Trace:
          [<ffffffff816dd629>] schedule+0x29/0x70
          [<ffffffff816e066d>] schedule_timeout+0x1bd/0x200
          [<ffffffff81093ffc>] ? ttwu_do_wakeup+0x2c/0x120
          [<ffffffff81094266>] ? ttwu_do_activate.constprop.135+0x66/0x70
          [<ffffffff816deb5f>] wait_for_completion+0xbf/0x180
          [<ffffffff81097cd0>] ? try_to_wake_up+0x390/0x390
          [<ffffffff81086335>] flush_work+0x165/0x250
          [<ffffffff81082940>] ? worker_detach_from_pool+0xd0/0xd0
          [<ffffffffa03b65b1>] xlog_cil_force_lsn+0x81/0x200 [xfs]
          [<ffffffff816d6b42>] ? __slab_free+0xee/0x234
          [<ffffffffa03b4b1d>] _xfs_log_force_lsn+0x4d/0x2c0 [xfs]
          [<ffffffff811adc1e>] ? lookup_page_cgroup_used+0xe/0x30
          [<ffffffffa039a723>] ? xfs_reclaim_inode+0xa3/0x330 [xfs]
          [<ffffffffa03b4dcf>] xfs_log_force_lsn+0x3f/0xf0 [xfs]
          [<ffffffffa039a723>] ? xfs_reclaim_inode+0xa3/0x330 [xfs]
          [<ffffffffa03a62c6>] xfs_iunpin_wait+0xc6/0x1a0 [xfs]
          [<ffffffff810aa250>] ? wake_atomic_t_function+0x40/0x40
          [<ffffffffa039a723>] xfs_reclaim_inode+0xa3/0x330 [xfs]
          [<ffffffffa039ac07>] xfs_reclaim_inodes_ag+0x257/0x3d0 [xfs]
          [<ffffffffa039bb13>] xfs_reclaim_inodes_nr+0x33/0x40 [xfs]
          [<ffffffffa03ab745>] xfs_fs_free_cached_objects+0x15/0x20 [xfs]
          [<ffffffff811c0c18>] super_cache_scan+0x178/0x180
          [<ffffffff8115912e>] shrink_slab_node+0x14e/0x340
          [<ffffffff811afc3b>] ? mem_cgroup_iter+0x16b/0x450
          [<ffffffff8115af70>] shrink_slab+0x100/0x140
          [<ffffffff8115e425>] do_try_to_free_pages+0x335/0x490
          [<ffffffff8115e7f9>] try_to_free_pages+0xb9/0x1f0
          [<ffffffff816d56e4>] ? __alloc_pages_direct_compact+0x69/0x1be
          [<ffffffff81150cba>] __alloc_pages_nodemask+0x69a/0xb40
          [<ffffffff8119743e>] alloc_pages_current+0x9e/0x110
          [<ffffffff811a0ac5>] new_slab+0x2c5/0x390
          [<ffffffff816d71c4>] __slab_alloc+0x33b/0x459
          [<ffffffff815b906d>] ? sock_alloc_inode+0x2d/0xd0
          [<ffffffff8164bda1>] ? inet_sendmsg+0x71/0xc0
          [<ffffffff815b906d>] ? sock_alloc_inode+0x2d/0xd0
          [<ffffffff811a21f2>] kmem_cache_alloc+0x1a2/0x1b0
          [<ffffffff815b906d>] sock_alloc_inode+0x2d/0xd0
          [<ffffffff811d8566>] alloc_inode+0x26/0xa0
          [<ffffffff811da04a>] new_inode_pseudo+0x1a/0x70
          [<ffffffff815b933e>] sock_alloc+0x1e/0x80
          [<ffffffff815ba855>] __sock_create+0x95/0x220
          [<ffffffff815baa04>] sock_create_kern+0x24/0x30
          [<ffffffffa04794d9>] con_work+0xef9/0x2050 [libceph]
          [<ffffffffa04aa9ec>] ? rbd_img_request_submit+0x4c/0x60 [rbd]
          [<ffffffff81084c19>] process_one_work+0x159/0x4f0
          [<ffffffff8108561b>] worker_thread+0x11b/0x530
          [<ffffffff81085500>] ? create_worker+0x1d0/0x1d0
          [<ffffffff8108b6f9>] kthread+0xc9/0xe0
          [<ffffffff8108b630>] ? flush_kthread_worker+0x90/0x90
          [<ffffffff816e1b98>] ret_from_fork+0x58/0x90
          [<ffffffff8108b630>] ? flush_kthread_worker+0x90/0x90
      
      Use memalloc_noio_{save,restore}() to temporarily force GFP_NOIO here.
      
      Cc: stable@vger.kernel.org # 3.10+, needs backporting
      Link: http://tracker.ceph.com/issues/19309Reported-by: default avatarSergey Jerusalimov <wintchester@gmail.com>
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Reviewed-by: default avatarJeff Layton <jlayton@redhat.com>
      633ee407
    • Hui Wang's avatar
      ALSA: hda - Adding a group of pin definition to fix headset problem · 3f307834
      Hui Wang authored
      A new Dell laptop needs to apply ALC269_FIXUP_DELL1_MIC_NO_PRESENCE to
      fix the headset problem, and the pin definiton of this machine is not
      in the pin quirk table yet, now adding it to the table.
      Signed-off-by: default avatarHui Wang <hui.wang@canonical.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      3f307834
    • Adrian Hunter's avatar
      mmc: sdhci-pci: Do not disable interrupts in sdhci_intel_set_power · 027fb89e
      Adrian Hunter authored
      Disabling interrupts for even a millisecond can cause problems for some
      devices. That can happen when Intel host controllers wait for the present
      state to propagate.
      
      The spin lock is not necessary here. Anything that is racing with changes
      to the I/O state is already broken. The mmc core already provides
      synchronization via "claiming" the host.
      
      Although the spin lock probably should be removed from the code paths that
      lead to this point, such a patch would touch too much code to be suitable
      for stable trees. Consequently, for this patch, just drop the spin lock
      while waiting.
      Signed-off-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
      Cc: stable@vger.kernel.org # v4.9+
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      Tested-by: default avatarLudovic Desroches <ludovic.desroches@microchip.com>
      027fb89e
    • Adrian Hunter's avatar
      mmc: sdhci: Do not disable interrupts while waiting for clock · e2ebfb21
      Adrian Hunter authored
      Disabling interrupts for even a millisecond can cause problems for some
      devices. That can happen when sdhci changes clock frequency because it
      waits for the clock to become stable under a spin lock.
      
      The spin lock is not necessary here. Anything that is racing with changes
      to the I/O state is already broken. The mmc core already provides
      synchronization via "claiming" the host.
      
      Although the spin lock probably should be removed from the code paths that
      lead to this point, such a patch would touch too much code to be suitable
      for stable trees. Consequently, for this patch, just drop the spin lock
      while waiting.
      Signed-off-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      Tested-by: default avatarLudovic Desroches <ludovic.desroches@microchip.com>
      e2ebfb21
    • Pavel Belous's avatar
      net:ethernet:aquantia: Fix for RX checksum offload. · 68c38659
      Pavel Belous authored
      Since AQC-100/107/108 chips supports hardware checksums for RX we should indicate this
      via NETIF_F_RXCSUM flag.
      
      v1->v2: 'Signed-off-by' tag added.
      Signed-off-by: default avatarPavel Belous <pavel.belous@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      68c38659
    • Lendacky, Thomas's avatar
      amd-xgbe: Fix the ECC-related bit position definitions · f43feef4
      Lendacky, Thomas authored
      The ECC bit positions that describe whether the ECC interrupt is for
      Tx, Rx or descriptor memory and whether the it is a single correctable
      or double detected error were defined in incorrectly (reversed order).
      Fix the bit position definitions for these settings so that the proper
      ECC handling is performed.
      Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f43feef4
    • Dan Carpenter's avatar
      sfc: cleanup a condition in efx_udp_tunnel_del() · c04ca616
      Dan Carpenter authored
      Presumably if there is an "add" function, there is also a "del"
      function.  But it causes a static checker warning because it looks like
      a common cut and paste bug.
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Acked-by: default avatarJarod Wilson <jarod@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c04ca616
    • Arnd Bergmann's avatar
      Bluetooth: btqcomsmd: fix compile-test dependency · 6e9e6cc8
      Arnd Bergmann authored
      compile-testing fails when QCOM_SMD is a loadable module:
      
      drivers/bluetooth/built-in.o: In function `btqcomsmd_send':
      btqca.c:(.text+0xa8): undefined reference to `qcom_smd_send'
      drivers/bluetooth/built-in.o: In function `btqcomsmd_probe':
      btqca.c:(.text+0x3ec): undefined reference to `qcom_wcnss_open_channel'
      btqca.c:(.text+0x46c): undefined reference to `qcom_smd_set_drvdata'
      
      This clarifies the dependency to allow compile-testing only when
      SMD is completely disabled, otherwise the dependency on QCOM_SMD
      will make sure we can link against it.
      
      Fixes: e27ee2b1 ("Bluetooth: btqcomsmd: Allow driver to build if COMPILE_TEST is enabled")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      [bjorn: Restructure and clarify dependency to QCOM_WCNSS_CTRL]
      Signed-off-by: default avatarBjorn Andersson <bjorn.andersson@linaro.org>
      Acked-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6e9e6cc8
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2017-03-22' of... · d08997cb
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2017-03-22' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes
      
      drm/i915 fixes for v4.11-rc4
      
      * tag 'drm-intel-fixes-2017-03-22' of git://anongit.freedesktop.org/git/drm-intel:
        drm/i915: make context status notifier head be per engine
        drm/i915: Avoid rcu_barrier() from reclaim paths (shrinker)
        drm/i915/gvt: Fix gvt scheduler interval time
        drm/i915/gvt: GVT pin/unpin shadow context
        drm/i915/gvt: scan shadow indirect context image when valid
        drm/i915/kvmgt: fix suspicious rcu dereference usage
        drm/i915/gvt: add enable_execlists check before enable gvt
        drm/i915/gvt: Remove bogus retry around i915_wait_request
        drm/i915/gvt: correct the ggtt valid bit check in pipe control command
        drm/i915/gvt: replace the gvt_err with gvt_vgpu_err
        drm/i915/gvt: handle force-nonpriv registers, cmd parser part
        drm/i915: Do .init_clock_gating() earlier to avoid it clobbering watermarks
        drm/i915/glk: Remove MODULE_FIRMWARE() tag from Geminilake's DMC
        drm/i915: Reject HDMI 12bpc if the sink doesn't indicate support
        drm/i915: Always call i915_gem_reset_finish() following i915_gem_reset_prepare()
        drm/i915: Stop using RP_DOWN_EI on Baytrail
        drm/i915: Drop support for I915_EXEC_CONSTANTS_* execbuf parameters.
        drm/i915: Only enable hotplug interrupts if the display interrupts are enabled
        drm/i915: Disable engine->irq_tasklet around resets
        drm/i915: Split GEM resetting into 3 phases
      d08997cb
  3. 22 Mar, 2017 5 commits
    • Joerg Roedel's avatar
      Merge branch 'for-joerg/arm-smmu/fixes' of... · 11cd3386
      Joerg Roedel authored
      Merge branch 'for-joerg/arm-smmu/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/will/linux into iommu/fixes
      11cd3386
    • Eric Dumazet's avatar
      inet: frag: release spinlock before calling icmp_send() · ec4fbd64
      Eric Dumazet authored
      Dmitry reported a lockdep splat [1] (false positive) that we can fix
      by releasing the spinlock before calling icmp_send() from ip_expire()
      
      This is a false positive because sending an ICMP message can not
      possibly re-enter the IP frag engine.
      
      [1]
      [ INFO: possible circular locking dependency detected ]
      4.10.0+ #29 Not tainted
      -------------------------------------------------------
      modprobe/12392 is trying to acquire lock:
       (_xmit_ETHER#2){+.-...}, at: [<ffffffff837a8182>] spin_lock
      include/linux/spinlock.h:299 [inline]
       (_xmit_ETHER#2){+.-...}, at: [<ffffffff837a8182>] __netif_tx_lock
      include/linux/netdevice.h:3486 [inline]
       (_xmit_ETHER#2){+.-...}, at: [<ffffffff837a8182>]
      sch_direct_xmit+0x282/0x6d0 net/sched/sch_generic.c:180
      
      but task is already holding lock:
       (&(&q->lock)->rlock){+.-...}, at: [<ffffffff8389a4d1>] spin_lock
      include/linux/spinlock.h:299 [inline]
       (&(&q->lock)->rlock){+.-...}, at: [<ffffffff8389a4d1>]
      ip_expire+0x51/0x6c0 net/ipv4/ip_fragment.c:201
      
      which lock already depends on the new lock.
      
      the existing dependency chain (in reverse order) is:
      
      -> #1 (&(&q->lock)->rlock){+.-...}:
             validate_chain kernel/locking/lockdep.c:2267 [inline]
             __lock_acquire+0x2149/0x3430 kernel/locking/lockdep.c:3340
             lock_acquire+0x2a1/0x630 kernel/locking/lockdep.c:3755
             __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
             _raw_spin_lock+0x33/0x50 kernel/locking/spinlock.c:151
             spin_lock include/linux/spinlock.h:299 [inline]
             ip_defrag+0x3a2/0x4130 net/ipv4/ip_fragment.c:669
             ip_check_defrag+0x4e3/0x8b0 net/ipv4/ip_fragment.c:713
             packet_rcv_fanout+0x282/0x800 net/packet/af_packet.c:1459
             deliver_skb net/core/dev.c:1834 [inline]
             dev_queue_xmit_nit+0x294/0xa90 net/core/dev.c:1890
             xmit_one net/core/dev.c:2903 [inline]
             dev_hard_start_xmit+0x16b/0xab0 net/core/dev.c:2923
             sch_direct_xmit+0x31f/0x6d0 net/sched/sch_generic.c:182
             __dev_xmit_skb net/core/dev.c:3092 [inline]
             __dev_queue_xmit+0x13e5/0x1e60 net/core/dev.c:3358
             dev_queue_xmit+0x17/0x20 net/core/dev.c:3423
             neigh_resolve_output+0x6b9/0xb10 net/core/neighbour.c:1308
             neigh_output include/net/neighbour.h:478 [inline]
             ip_finish_output2+0x8b8/0x15a0 net/ipv4/ip_output.c:228
             ip_do_fragment+0x1d93/0x2720 net/ipv4/ip_output.c:672
             ip_fragment.constprop.54+0x145/0x200 net/ipv4/ip_output.c:545
             ip_finish_output+0x82d/0xe10 net/ipv4/ip_output.c:314
             NF_HOOK_COND include/linux/netfilter.h:246 [inline]
             ip_output+0x1f0/0x7a0 net/ipv4/ip_output.c:404
             dst_output include/net/dst.h:486 [inline]
             ip_local_out+0x95/0x170 net/ipv4/ip_output.c:124
             ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1492
             ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1512
             raw_sendmsg+0x26de/0x3a00 net/ipv4/raw.c:655
             inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:761
             sock_sendmsg_nosec net/socket.c:633 [inline]
             sock_sendmsg+0xca/0x110 net/socket.c:643
             ___sys_sendmsg+0x4a3/0x9f0 net/socket.c:1985
             __sys_sendmmsg+0x25c/0x750 net/socket.c:2075
             SYSC_sendmmsg net/socket.c:2106 [inline]
             SyS_sendmmsg+0x35/0x60 net/socket.c:2101
             do_syscall_64+0x2e8/0x930 arch/x86/entry/common.c:281
             return_from_SYSCALL_64+0x0/0x7a
      
      -> #0 (_xmit_ETHER#2){+.-...}:
             check_prev_add kernel/locking/lockdep.c:1830 [inline]
             check_prevs_add+0xa8f/0x19f0 kernel/locking/lockdep.c:1940
             validate_chain kernel/locking/lockdep.c:2267 [inline]
             __lock_acquire+0x2149/0x3430 kernel/locking/lockdep.c:3340
             lock_acquire+0x2a1/0x630 kernel/locking/lockdep.c:3755
             __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
             _raw_spin_lock+0x33/0x50 kernel/locking/spinlock.c:151
             spin_lock include/linux/spinlock.h:299 [inline]
             __netif_tx_lock include/linux/netdevice.h:3486 [inline]
             sch_direct_xmit+0x282/0x6d0 net/sched/sch_generic.c:180
             __dev_xmit_skb net/core/dev.c:3092 [inline]
             __dev_queue_xmit+0x13e5/0x1e60 net/core/dev.c:3358
             dev_queue_xmit+0x17/0x20 net/core/dev.c:3423
             neigh_hh_output include/net/neighbour.h:468 [inline]
             neigh_output include/net/neighbour.h:476 [inline]
             ip_finish_output2+0xf6c/0x15a0 net/ipv4/ip_output.c:228
             ip_finish_output+0xa29/0xe10 net/ipv4/ip_output.c:316
             NF_HOOK_COND include/linux/netfilter.h:246 [inline]
             ip_output+0x1f0/0x7a0 net/ipv4/ip_output.c:404
             dst_output include/net/dst.h:486 [inline]
             ip_local_out+0x95/0x170 net/ipv4/ip_output.c:124
             ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1492
             ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1512
             icmp_push_reply+0x372/0x4d0 net/ipv4/icmp.c:394
             icmp_send+0x156c/0x1c80 net/ipv4/icmp.c:754
             ip_expire+0x40e/0x6c0 net/ipv4/ip_fragment.c:239
             call_timer_fn+0x241/0x820 kernel/time/timer.c:1268
             expire_timers kernel/time/timer.c:1307 [inline]
             __run_timers+0x960/0xcf0 kernel/time/timer.c:1601
             run_timer_softirq+0x21/0x80 kernel/time/timer.c:1614
             __do_softirq+0x31f/0xbe7 kernel/softirq.c:284
             invoke_softirq kernel/softirq.c:364 [inline]
             irq_exit+0x1cc/0x200 kernel/softirq.c:405
             exiting_irq arch/x86/include/asm/apic.h:657 [inline]
             smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:962
             apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:707
             __read_once_size include/linux/compiler.h:254 [inline]
             atomic_read arch/x86/include/asm/atomic.h:26 [inline]
             rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:350 [inline]
             __rcu_is_watching kernel/rcu/tree.c:1133 [inline]
             rcu_is_watching+0x83/0x110 kernel/rcu/tree.c:1147
             rcu_read_lock_held+0x87/0xc0 kernel/rcu/update.c:293
             radix_tree_deref_slot include/linux/radix-tree.h:238 [inline]
             filemap_map_pages+0x6d4/0x1570 mm/filemap.c:2335
             do_fault_around mm/memory.c:3231 [inline]
             do_read_fault mm/memory.c:3265 [inline]
             do_fault+0xbd5/0x2080 mm/memory.c:3370
             handle_pte_fault mm/memory.c:3600 [inline]
             __handle_mm_fault+0x1062/0x2cb0 mm/memory.c:3714
             handle_mm_fault+0x1e2/0x480 mm/memory.c:3751
             __do_page_fault+0x4f6/0xb60 arch/x86/mm/fault.c:1397
             do_page_fault+0x54/0x70 arch/x86/mm/fault.c:1460
             page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1011
      
      other info that might help us debug this:
      
       Possible unsafe locking scenario:
      
             CPU0                    CPU1
             ----                    ----
        lock(&(&q->lock)->rlock);
                                     lock(_xmit_ETHER#2);
                                     lock(&(&q->lock)->rlock);
        lock(_xmit_ETHER#2);
      
       *** DEADLOCK ***
      
      10 locks held by modprobe/12392:
       #0:  (&mm->mmap_sem){++++++}, at: [<ffffffff81329758>]
      __do_page_fault+0x2b8/0xb60 arch/x86/mm/fault.c:1336
       #1:  (rcu_read_lock){......}, at: [<ffffffff8188cab6>]
      filemap_map_pages+0x1e6/0x1570 mm/filemap.c:2324
       #2:  (&(ptlock_ptr(page))->rlock#2){+.+...}, at: [<ffffffff81984a78>]
      spin_lock include/linux/spinlock.h:299 [inline]
       #2:  (&(ptlock_ptr(page))->rlock#2){+.+...}, at: [<ffffffff81984a78>]
      pte_alloc_one_map mm/memory.c:2944 [inline]
       #2:  (&(ptlock_ptr(page))->rlock#2){+.+...}, at: [<ffffffff81984a78>]
      alloc_set_pte+0x13b8/0x1b90 mm/memory.c:3072
       #3:  (((&q->timer))){+.-...}, at: [<ffffffff81627e72>]
      lockdep_copy_map include/linux/lockdep.h:175 [inline]
       #3:  (((&q->timer))){+.-...}, at: [<ffffffff81627e72>]
      call_timer_fn+0x1c2/0x820 kernel/time/timer.c:1258
       #4:  (&(&q->lock)->rlock){+.-...}, at: [<ffffffff8389a4d1>] spin_lock
      include/linux/spinlock.h:299 [inline]
       #4:  (&(&q->lock)->rlock){+.-...}, at: [<ffffffff8389a4d1>]
      ip_expire+0x51/0x6c0 net/ipv4/ip_fragment.c:201
       #5:  (rcu_read_lock){......}, at: [<ffffffff8389a633>]
      ip_expire+0x1b3/0x6c0 net/ipv4/ip_fragment.c:216
       #6:  (slock-AF_INET){+.-...}, at: [<ffffffff839b3313>] spin_trylock
      include/linux/spinlock.h:309 [inline]
       #6:  (slock-AF_INET){+.-...}, at: [<ffffffff839b3313>] icmp_xmit_lock
      net/ipv4/icmp.c:219 [inline]
       #6:  (slock-AF_INET){+.-...}, at: [<ffffffff839b3313>]
      icmp_send+0x803/0x1c80 net/ipv4/icmp.c:681
       #7:  (rcu_read_lock_bh){......}, at: [<ffffffff838ab9a1>]
      ip_finish_output2+0x2c1/0x15a0 net/ipv4/ip_output.c:198
       #8:  (rcu_read_lock_bh){......}, at: [<ffffffff836d1dee>]
      __dev_queue_xmit+0x23e/0x1e60 net/core/dev.c:3324
       #9:  (dev->qdisc_running_key ?: &qdisc_running_key){+.....}, at:
      [<ffffffff836d3a27>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3423
      
      stack backtrace:
      CPU: 0 PID: 12392 Comm: modprobe Not tainted 4.10.0+ #29
      Hardware name: Google Google Compute Engine/Google Compute Engine,
      BIOS Google 01/01/2011
      Call Trace:
       <IRQ>
       __dump_stack lib/dump_stack.c:16 [inline]
       dump_stack+0x2ee/0x3ef lib/dump_stack.c:52
       print_circular_bug+0x307/0x3b0 kernel/locking/lockdep.c:1204
       check_prev_add kernel/locking/lockdep.c:1830 [inline]
       check_prevs_add+0xa8f/0x19f0 kernel/locking/lockdep.c:1940
       validate_chain kernel/locking/lockdep.c:2267 [inline]
       __lock_acquire+0x2149/0x3430 kernel/locking/lockdep.c:3340
       lock_acquire+0x2a1/0x630 kernel/locking/lockdep.c:3755
       __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
       _raw_spin_lock+0x33/0x50 kernel/locking/spinlock.c:151
       spin_lock include/linux/spinlock.h:299 [inline]
       __netif_tx_lock include/linux/netdevice.h:3486 [inline]
       sch_direct_xmit+0x282/0x6d0 net/sched/sch_generic.c:180
       __dev_xmit_skb net/core/dev.c:3092 [inline]
       __dev_queue_xmit+0x13e5/0x1e60 net/core/dev.c:3358
       dev_queue_xmit+0x17/0x20 net/core/dev.c:3423
       neigh_hh_output include/net/neighbour.h:468 [inline]
       neigh_output include/net/neighbour.h:476 [inline]
       ip_finish_output2+0xf6c/0x15a0 net/ipv4/ip_output.c:228
       ip_finish_output+0xa29/0xe10 net/ipv4/ip_output.c:316
       NF_HOOK_COND include/linux/netfilter.h:246 [inline]
       ip_output+0x1f0/0x7a0 net/ipv4/ip_output.c:404
       dst_output include/net/dst.h:486 [inline]
       ip_local_out+0x95/0x170 net/ipv4/ip_output.c:124
       ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1492
       ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1512
       icmp_push_reply+0x372/0x4d0 net/ipv4/icmp.c:394
       icmp_send+0x156c/0x1c80 net/ipv4/icmp.c:754
       ip_expire+0x40e/0x6c0 net/ipv4/ip_fragment.c:239
       call_timer_fn+0x241/0x820 kernel/time/timer.c:1268
       expire_timers kernel/time/timer.c:1307 [inline]
       __run_timers+0x960/0xcf0 kernel/time/timer.c:1601
       run_timer_softirq+0x21/0x80 kernel/time/timer.c:1614
       __do_softirq+0x31f/0xbe7 kernel/softirq.c:284
       invoke_softirq kernel/softirq.c:364 [inline]
       irq_exit+0x1cc/0x200 kernel/softirq.c:405
       exiting_irq arch/x86/include/asm/apic.h:657 [inline]
       smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:962
       apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:707
      RIP: 0010:__read_once_size include/linux/compiler.h:254 [inline]
      RIP: 0010:atomic_read arch/x86/include/asm/atomic.h:26 [inline]
      RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:350 [inline]
      RIP: 0010:__rcu_is_watching kernel/rcu/tree.c:1133 [inline]
      RIP: 0010:rcu_is_watching+0x83/0x110 kernel/rcu/tree.c:1147
      RSP: 0000:ffff8801c391f120 EFLAGS: 00000a03 ORIG_RAX: ffffffffffffff10
      RAX: dffffc0000000000 RBX: ffff8801c391f148 RCX: 0000000000000000
      RDX: 0000000000000000 RSI: 000055edd4374000 RDI: ffff8801dbe1ae0c
      RBP: ffff8801c391f1a0 R08: 0000000000000002 R09: 0000000000000000
      R10: dffffc0000000000 R11: 0000000000000002 R12: 1ffff10038723e25
      R13: ffff8801dbe1ae00 R14: ffff8801c391f680 R15: dffffc0000000000
       </IRQ>
       rcu_read_lock_held+0x87/0xc0 kernel/rcu/update.c:293
       radix_tree_deref_slot include/linux/radix-tree.h:238 [inline]
       filemap_map_pages+0x6d4/0x1570 mm/filemap.c:2335
       do_fault_around mm/memory.c:3231 [inline]
       do_read_fault mm/memory.c:3265 [inline]
       do_fault+0xbd5/0x2080 mm/memory.c:3370
       handle_pte_fault mm/memory.c:3600 [inline]
       __handle_mm_fault+0x1062/0x2cb0 mm/memory.c:3714
       handle_mm_fault+0x1e2/0x480 mm/memory.c:3751
       __do_page_fault+0x4f6/0xb60 arch/x86/mm/fault.c:1397
       do_page_fault+0x54/0x70 arch/x86/mm/fault.c:1460
       page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1011
      RIP: 0033:0x7f83172f2786
      RSP: 002b:00007fffe859ae80 EFLAGS: 00010293
      RAX: 000055edd4373040 RBX: 00007f83175111c8 RCX: 000055edd4373238
      RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f8317510970
      RBP: 00007fffe859afd0 R08: 0000000000000009 R09: 0000000000000000
      R10: 0000000000000064 R11: 0000000000000000 R12: 000055edd4373040
      R13: 0000000000000000 R14: 00007fffe859afe8 R15: 0000000000000000
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ec4fbd64
    • Eric Dumazet's avatar
      tcp: initialize icsk_ack.lrcvtime at session start time · 15bb7745
      Eric Dumazet authored
      icsk_ack.lrcvtime has a 0 value at socket creation time.
      
      tcpi_last_data_recv can have bogus value if no payload is ever received.
      
      This patch initializes icsk_ack.lrcvtime for active sessions
      in tcp_finish_connect(), and for passive sessions in
      tcp_create_openreq_child()
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      15bb7745
    • Stanislaw Gruszka's avatar
      genetlink: fix counting regression on ctrl_dumpfamily() · 1d2a6a5e
      Stanislaw Gruszka authored
      Commit 2ae0f17d ("genetlink: use idr to track families") replaced
      
      	if (++n < fams_to_skip)
      		continue;
      into:
      
      	if (n++ < fams_to_skip)
      		continue;
      
      This subtle change cause that on retry ctrl_dumpfamily() call we omit
      one family that failed to do ctrl_fill_info() on previous call, because
      cb->args[0] = n number counts also family that failed to do
      ctrl_fill_info().
      
      Patch fixes the problem and avoid confusion in the future just decrease
      n counter when ctrl_fill_info() fail.
      
      User visible problem caused by this bug is failure to get access to
      some genetlink family i.e. nl80211. However problem is reproducible
      only if number of registered genetlink families is big enough to
      cause second call of ctrl_dumpfamily().
      
      Cc: Xose Vazquez Perez <xose.vazquez@gmail.com>
      Cc: Larry Finger <Larry.Finger@lwfinger.net>
      Cc: Johannes Berg <johannes@sipsolutions.net>
      Fixes: 2ae0f17d ("genetlink: use idr to track families")
      Signed-off-by: default avatarStanislaw Gruszka <sgruszka@redhat.com>
      Acked-by: default avatarJohannes Berg <johannes@sipsolutions.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1d2a6a5e
    • Daniel Borkmann's avatar
      socket, bpf: fix sk_filter use after free in sk_clone_lock · a97e50cc
      Daniel Borkmann authored
      In sk_clone_lock(), we create a new socket and inherit most of the
      parent's members via sock_copy() which memcpy()'s various sections.
      Now, in case the parent socket had a BPF socket filter attached,
      then newsk->sk_filter points to the same instance as the original
      sk->sk_filter.
      
      sk_filter_charge() is then called on the newsk->sk_filter to take a
      reference and should that fail due to hitting max optmem, we bail
      out and release the newsk instance.
      
      The issue is that commit 278571ba ("net: filter: simplify socket
      charging") wrongly combined the dismantle path with the failure path
      of xfrm_sk_clone_policy(). This means, even when charging failed, we
      call sk_free_unlock_clone() on the newsk, which then still points to
      the same sk_filter as the original sk.
      
      Thus, sk_free_unlock_clone() calls into __sk_destruct() eventually
      where it tests for present sk_filter and calls sk_filter_uncharge()
      on it, which potentially lets sk_omem_alloc wrap around and releases
      the eBPF prog and sk_filter structure from the (still intact) parent.
      
      Fix it by making sure that when sk_filter_charge() failed, we reset
      newsk->sk_filter back to NULL before passing to sk_free_unlock_clone(),
      so that we don't mess with the parents sk_filter.
      
      Only if xfrm_sk_clone_policy() fails, we did reach the point where
      either the parent's filter was NULL and as a result newsk's as well
      or where we previously had a successful sk_filter_charge(), thus for
      that case, we do need sk_filter_uncharge() to release the prior taken
      reference on sk_filter.
      
      Fixes: 278571ba ("net: filter: simplify socket charging")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a97e50cc