1. 13 Dec, 2017 9 commits
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · d6da8381
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The follow patchset contains Netfilter fixes for your net tree,
      they are:
      
      1) Fix compilation warning in x_tables with clang due to useless
         redundant reassignment, from Colin Ian King.
      
      2) Add bugtrap to net_exit to catch uninitialized lists, patch
         from Vasily Averin.
      
      3) Fix out of bounds memory reads in H323 conntrack helper, this
         comes with an initial patch to remove replace the obscure
         CHECK_BOUND macro as a dependency. From Eric Sesterhenn.
      
      4) Reduce retransmission timeout when window is 0 in TCP conntrack,
         from Florian Westphal.
      
      6) ctnetlink clamp timeout to INT_MAX if timeout is too large,
         otherwise timeout wraps around and it results in killing the
         entry that is being added immediately.
      
      7) Missing CAP_NET_ADMIN checks in cthelper and xt_osf, due to
         no netns support. From Kevin Cernekee.
      
      8) Missing maximum number of instructions checks in xt_bpf, patch
         from Jann Horn.
      
      9) With no CONFIG_PROC_FS ipt_CLUSTERIP compilation breaks,
         patch from Arnd Bergmann.
      
      10) Missing netlink attribute policy in nftables exthdr, from
          Florian Westphal.
      
      11) Enable conntrack with IPv6 MASQUERADE rules, as a357b3f8
          should have done in first place, from Konstantin Khlebnikov.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d6da8381
    • Branislav Radocaj's avatar
      net: ethernet: arc: fix error handling in emac_rockchip_probe · 2a9ee696
      Branislav Radocaj authored
      If clk_set_rate() fails, we should disable clk before return.
      Found by Linux Driver Verification project (linuxtesting.org).
      
      Changes since v2 [1]:
      * Merged with latest code changes
      
      Changes since v1:
      Update made thanks to David's review, much appreciated David.
      * Improved inconsistent failure handling of clock rate setting
      * For completeness of usecase, added arc_emac_probe error handling
      Signed-off-by: default avatarBranislav Radocaj <branislav@radocaj.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2a9ee696
    • Sebastian Sjoholm's avatar
      net: qmi_wwan: add Sierra EM7565 1199:9091 · aceef61e
      Sebastian Sjoholm authored
      Sierra Wireless EM7565 is an Qualcomm MDM9x50 based M.2 modem.
      The USB id is added to qmi_wwan.c to allow QMI communication
      with the EM7565.
      Signed-off-by: default avatarSebastian Sjoholm <ssjoholm@mac.com>
      Acked-by: default avatarBjørn Mork <bjorn@mork.no>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      aceef61e
    • Kevin Cernekee's avatar
      net: igmp: Use correct source address on IGMPv3 reports · a46182b0
      Kevin Cernekee authored
      Closing a multicast socket after the final IPv4 address is deleted
      from an interface can generate a membership report that uses the
      source IP from a different interface.  The following test script, run
      from an isolated netns, reproduces the issue:
      
          #!/bin/bash
      
          ip link add dummy0 type dummy
          ip link add dummy1 type dummy
          ip link set dummy0 up
          ip link set dummy1 up
          ip addr add 10.1.1.1/24 dev dummy0
          ip addr add 192.168.99.99/24 dev dummy1
      
          tcpdump -U -i dummy0 &
          socat EXEC:"sleep 2" \
              UDP4-DATAGRAM:239.101.1.68:8889,ip-add-membership=239.0.1.68:10.1.1.1 &
      
          sleep 1
          ip addr del 10.1.1.1/24 dev dummy0
          sleep 5
          kill %tcpdump
      
      RFC 3376 specifies that the report must be sent with a valid IP source
      address from the destination subnet, or from address 0.0.0.0.  Add an
      extra check to make sure this is the case.
      Signed-off-by: default avatarKevin Cernekee <cernekee@chromium.org>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a46182b0
    • Jon Maloy's avatar
      tipc: eliminate potential memory leak · c545a945
      Jon Maloy authored
      In the function tipc_sk_mcast_rcv() we call refcount_dec(&skb->users)
      on received sk_buffers. Since the reference counter might hit zero at
      this point, we have a potential memory leak.
      
      We fix this by replacing refcount_dec() with kfree_skb().
      Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c545a945
    • Pravin Shedge's avatar
      net: remove duplicate includes · 83593010
      Pravin Shedge authored
      These duplicate includes have been found with scripts/checkincludes.pl but
      they have been removed manually to avoid removing false positives.
      Signed-off-by: default avatarPravin Shedge <pravin.shedge4linux@gmail.com>
      Acked-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      83593010
    • Eric Dumazet's avatar
      ipv4: igmp: guard against silly MTU values · b5476022
      Eric Dumazet authored
      IPv4 stack reacts to changes to small MTU, by disabling itself under
      RTNL.
      
      But there is a window where threads not using RTNL can see a wrong
      device mtu. This can lead to surprises, in igmp code where it is
      assumed the mtu is suitable.
      
      Fix this by reading device mtu once and checking IPv4 minimal MTU.
      
      This patch adds missing IPV4_MIN_MTU define, to not abuse
      ETH_MIN_MTU anymore.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b5476022
    • Eric Dumazet's avatar
      ipv6: mcast: better catch silly mtu values · b9b312a7
      Eric Dumazet authored
      syzkaller reported crashes in IPv6 stack [1]
      
      Xin Long found that lo MTU was set to silly values.
      
      IPv6 stack reacts to changes to small MTU, by disabling itself under
      RTNL.
      
      But there is a window where threads not using RTNL can see a wrong
      device mtu. This can lead to surprises, in mld code where it is assumed
      the mtu is suitable.
      
      Fix this by reading device mtu once and checking IPv6 minimal MTU.
      
      [1]
       skbuff: skb_over_panic: text:0000000010b86b8d len:196 put:20
       head:000000003b477e60 data:000000000e85441e tail:0xd4 end:0xc0 dev:lo
       ------------[ cut here ]------------
       kernel BUG at net/core/skbuff.c:104!
       invalid opcode: 0000 [#1] SMP KASAN
       Dumping ftrace buffer:
          (ftrace buffer empty)
       Modules linked in:
       CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.15.0-rc2-mm1+ #39
       Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
       Google 01/01/2011
       RIP: 0010:skb_panic+0x15c/0x1f0 net/core/skbuff.c:100
       RSP: 0018:ffff8801db307508 EFLAGS: 00010286
       RAX: 0000000000000082 RBX: ffff8801c517e840 RCX: 0000000000000000
       RDX: 0000000000000082 RSI: 1ffff1003b660e61 RDI: ffffed003b660e95
       RBP: ffff8801db307570 R08: 1ffff1003b660e23 R09: 0000000000000000
       R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff85bd4020
       R13: ffffffff84754ed2 R14: 0000000000000014 R15: ffff8801c4e26540
       FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 0000000000463610 CR3: 00000001c6698000 CR4: 00000000001406e0
       DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
       DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
       Call Trace:
        <IRQ>
        skb_over_panic net/core/skbuff.c:109 [inline]
        skb_put+0x181/0x1c0 net/core/skbuff.c:1694
        add_grhead.isra.24+0x42/0x3b0 net/ipv6/mcast.c:1695
        add_grec+0xa55/0x1060 net/ipv6/mcast.c:1817
        mld_send_cr net/ipv6/mcast.c:1903 [inline]
        mld_ifc_timer_expire+0x4d2/0x770 net/ipv6/mcast.c:2448
        call_timer_fn+0x23b/0x840 kernel/time/timer.c:1320
        expire_timers kernel/time/timer.c:1357 [inline]
        __run_timers+0x7e1/0xb60 kernel/time/timer.c:1660
        run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1686
        __do_softirq+0x29d/0xbb2 kernel/softirq.c:285
        invoke_softirq kernel/softirq.c:365 [inline]
        irq_exit+0x1d3/0x210 kernel/softirq.c:405
        exiting_irq arch/x86/include/asm/apic.h:540 [inline]
        smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
        apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:920
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Tested-by: default avatarXin Long <lucien.xin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b9b312a7
    • Geert Uytterhoeven's avatar
      Revert "ravb: add workaround for clock when resuming with WoL enabled" · 6b782f43
      Geert Uytterhoeven authored
      This reverts commit fbf3d034.
      
      As of commit 56086910 ("clk: renesas: cpg-mssr: Restore module
      clocks during resume"), the workaround is no longer needed.
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Reviewed-by: default avatarNiklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
      Acked-by: default avatarSergei Shtylyov <sergei.shtylyov@cogentembedded.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6b782f43
  2. 12 Dec, 2017 1 commit
    • Christoph Paasch's avatar
      tcp md5sig: Use skb's saddr when replying to an incoming segment · 30791ac4
      Christoph Paasch authored
      The MD5-key that belongs to a connection is identified by the peer's
      IP-address. When we are in tcp_v4(6)_reqsk_send_ack(), we are replying
      to an incoming segment from tcp_check_req() that failed the seq-number
      checks.
      
      Thus, to find the correct key, we need to use the skb's saddr and not
      the daddr.
      
      This bug seems to have been there since quite a while, but probably got
      unnoticed because the consequences are not catastrophic. We will call
      tcp_v4_reqsk_send_ack only to send a challenge-ACK back to the peer,
      thus the connection doesn't really fail.
      
      Fixes: 9501f972 ("tcp md5sig: Let the caller pass appropriate key for tcp_v{4,6}_do_calc_md5_hash().")
      Signed-off-by: default avatarChristoph Paasch <cpaasch@apple.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      30791ac4
  3. 11 Dec, 2017 11 commits
  4. 08 Dec, 2017 19 commits
    • Michal Hocko's avatar
      kmemcheck: rip it out for real · f335195a
      Michal Hocko authored
      Commit 4675ff05 ("kmemcheck: rip it out") has removed the code but
      for some reason SPDX header stayed in place.  This looks like a rebase
      mistake in the mmotm tree or the merge mistake.  Let's drop those
      leftovers as well.
      Signed-off-by: default avatarMichal Hocko <mhocko@suse.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f335195a
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · e9ef1fe3
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) CAN fixes from Martin Kelly (cancel URBs properly in all the CAN usb
          drivers).
      
       2) Revert returning -EEXIST from __dev_alloc_name() as this propagates
          to userspace and broke some apps. From Johannes Berg.
      
       3) Fix conn memory leaks and crashes in TIPC, from Jon Malloc and Cong
          Wang.
      
       4) Gianfar MAC can't do EEE so don't advertise it by default, from
          Claudiu Manoil.
      
       5) Relax strict netlink attribute validation, but emit a warning. From
          David Ahern.
      
       6) Fix regression in checksum offload of thunderx driver, from Florian
          Westphal.
      
       7) Fix UAPI bpf issues on s390, from Hendrik Brueckner.
      
       8) New card support in iwlwifi, from Ihab Zhaika.
      
       9) BBR congestion control bug fixes from Neal Cardwell.
      
      10) Fix port stats in nfp driver, from Pieter Jansen van Vuuren.
      
      11) Fix leaks in qualcomm rmnet, from Subash Abhinov Kasiviswanathan.
      
      12) Fix DMA API handling in sh_eth driver, from Thomas Petazzoni.
      
      13) Fix spurious netpoll warnings in bnxt_en, from Calvin Owens.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (67 commits)
        net: mvpp2: fix the RSS table entry offset
        tcp: evaluate packet losses upon RTT change
        tcp: fix off-by-one bug in RACK
        tcp: always evaluate losses in RACK upon undo
        tcp: correctly test congestion state in RACK
        bnxt_en: Fix sources of spurious netpoll warnings
        tcp_bbr: reset long-term bandwidth sampling on loss recovery undo
        tcp_bbr: reset full pipe detection on loss recovery undo
        tcp_bbr: record "full bw reached" decision in new full_bw_reached bit
        sfc: pass valid pointers from efx_enqueue_unwind
        gianfar: Disable EEE autoneg by default
        tcp: invalidate rate samples during SACK reneging
        can: peak/pcie_fd: fix potential bug in restarting tx queue
        can: usb_8dev: cancel urb on -EPIPE and -EPROTO
        can: kvaser_usb: cancel urb on -EPIPE and -EPROTO
        can: esd_usb2: cancel urb on -EPIPE and -EPROTO
        can: ems_usb: cancel urb on -EPIPE and -EPROTO
        can: mcba_usb: cancel urb on -EPROTO
        usbnet: fix alignment for frames with no ethernet header
        tcp: use current time in tcp_rcv_space_adjust()
        ...
      e9ef1fe3
    • Linus Torvalds's avatar
      Merge tag 'media/v4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 77071bc6
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
      
       "A series of fixes for the media subsytem:
      
         - The largest amount of fixes in this series is with regards to
           comments that aren't kernel-doc, but start with "/**".
      
           A new check added for 4.15 makes it to produce a *huge* amount of
           new warnings (I'm compiling here with W=1). Most of the patches in
           this series fix those.
      
           No code changes - just comment changes at the source files
      
         - rc: some fixed in order to better handle RC repetition codes
      
         - v4l-async: use the v4l2_dev from the root notifier when matching
           sub-devices
      
         - v4l2-fwnode: Check subdev count after checking port
      
         - ov 13858 and et8ek8: compilation fix with randconfigs
      
         - usbtv: a trivial new USB ID addition
      
         - dibusb-common: don't do DMA on stack on firmware load
      
         - imx274: Fix error handling, add MAINTAINERS entry
      
         - sir_ir: detect presence of port"
      
      * tag 'media/v4.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (50 commits)
        media: imx274: Fix error handling, add MAINTAINERS entry
        media: v4l: async: use the v4l2_dev from the root notifier when matching sub-devices
        media: v4l2-fwnode: Check subdev count after checking port
        media: et8ek8: select V4L2_FWNODE
        media: ov13858: Select V4L2_FWNODE
        media: rc: partial revert of "media: rc: per-protocol repeat period"
        media: dvb: i2c transfers over usb cannot be done from stack
        media: dvb-frontends: complete kernel-doc markups
        media: docs: add documentation for frontend attach info
        media: dvb_frontends: fix kernel-doc macros
        media: drivers: remove "/**" from non-kernel-doc comments
        media: lm3560: add a missing kernel-doc parameter
        media: rcar_jpu: fix two kernel-doc markups
        media: vsp1: add a missing kernel-doc parameter
        media: soc_camera: fix a kernel-doc markup
        media: mt2063: fix some kernel-doc warnings
        media: radio-wl1273: fix a parameter name at kernel-doc macro
        media: s3c-camif: add missing description at s3c_camif_find_format()
        media: mtk-vpu: add description for wdt fields at struct mtk_vpu
        media: vdec: fix some kernel-doc warnings
        ...
      77071bc6
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.15-rc3' of git://people.freedesktop.org/~airlied/linux · 4066aa72
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This pull is a bit larger than I'd like but a large bunch of it is
        license fixes, AMD wanted to fix the licenses for a bunch of files
        that were missing them,
      
       Otherwise a bunch of TTM regression fix since the hugepage support,
       some i915 and gvt fixes, a core connector free in a safe context fix,
       and one bridge fix"
      
      * tag 'drm-fixes-for-v4.15-rc3' of git://people.freedesktop.org/~airlied/linux: (26 commits)
        drm/bridge: analogix dp: Fix runtime PM state in get_modes() callback
        Revert "drm/i915: Display WA #1133 WaFbcSkipSegments:cnl, glk"
        drm/vc4: Fix false positive WARN() backtrace on refcount_inc() usage
        drm/i915: Call i915_gem_init_userptr() before taking struct_mutex
        drm/exynos: remove unnecessary function declaration
        drm/exynos: remove unnecessary descrptions
        drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU
        drm/exynos: Fix dma-buf import
        drm/ttm: swap consecutive allocated pooled pages v4
        drm: safely free connectors from connector_iter
        drm/i915/gvt: set max priority for gvt context
        drm/i915/gvt: Don't mark vgpu context as inactive when preempted
        drm/i915/gvt: Limit read hw reg to active vgpu
        drm/i915/gvt: Export intel_gvt_render_mmio_to_ring_id()
        drm/i915/gvt: Emulate PCI expansion ROM base address register
        drm/ttm: swap consecutive allocated cached pages v3
        drm/ttm: roundup the shrink request to prevent skip huge pool
        drm/ttm: add page order support in ttm_pages_put
        drm/ttm: add set_pages_wb for handling page order more than zero
        drm/ttm: add page order in page pool
        ...
      4066aa72
    • Linus Torvalds's avatar
      Merge tag 'md/4.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md · 7267212c
      Linus Torvalds authored
      Pull md fixes from Shaohua Li:
       "Some MD fixes.
      
        The notable one is a raid5-cache deadlock bug with dm-raid, others are
        not significant"
      
      * tag 'md/4.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
        md/raid1/10: add missed blk plug
        md: limit mdstat resync progress to max_sectors
        md/r5cache: move mddev_lock() out of r5c_journal_mode_set()
        md/raid5: correct degraded calculation in raid5_error
      7267212c
    • Linus Torvalds's avatar
      Merge tag 'devicetree-fixes-for-4.15-part2' of... · 78d9b048
      Linus Torvalds authored
      Merge tag 'devicetree-fixes-for-4.15-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
      
      Pull DeviceTree fixes from Rob Herring:
       "Another set of DT fixes:
      
         - Fixes from overlay code rework. A trifecta of fixes to the locking,
           an out of bounds access, and a memory leak in of_overlay_apply()
      
         - Clean-up at25 eeprom binding document
      
         - Remove leading '0x' in unit-addresses from binding docs"
      
      * tag 'devicetree-fixes-for-4.15-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
        of: overlay: Make node skipping in init_overlay_changeset() clearer
        of: overlay: Fix out-of-bounds write in init_overlay_changeset()
        of: overlay: Fix (un)locking in of_overlay_apply()
        of: overlay: Fix memory leak in of_overlay_apply() error path
        dt-bindings: eeprom: at25: Document device-specific compatible values
        dt-bindings: eeprom: at25: Grammar s/are can/can/
        dt-bindings: Remove leading 0x from bindings notation
        of: overlay: Remove else after goto
        of: Spelling s/changset/changeset/
        of: unittest: Remove bogus overlay mutex release from overlay_data_add()
      78d9b048
    • Linus Torvalds's avatar
      Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost · 900add27
      Linus Torvalds authored
      Pull virtio bugfixes from Michael Tsirkin:
       "A couple of minor bugfixes"
      
      * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
        virtio_net: fix return value check in receive_mergeable()
        virtio_mmio: add cleanup for virtio_mmio_remove
        virtio_mmio: add cleanup for virtio_mmio_probe
      900add27
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.15-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 32abeb09
      Linus Torvalds authored
      Pull xen fixes from Juergen Gross:
       "Just two small fixes for the new pvcalls frontend driver"
      
      * tag 'for-linus-4.15-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen/pvcalls: Fix a check in pvcalls_front_remove()
        xen/pvcalls: check for xenbus_read() errors
      32abeb09
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · d90696ed
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
      
       "One notable fix for kexec on Power9, where we were not clearing MMU
        PID properly which sometimes leads to hangs. Finally debugged to a
        root cause by Nick.
      
        A revert of a patch which tried to rework our panic handling to get
        more output on the console, but inadvertently broke reporting the
        panic to the hypervisor, which apparently people care about.
      
        Then a fix for an oops in the PMU code, and finally some s/%p/%px/ in
        xmon.
      
        Thanks to: David Gibson, Nicholas Piggin, Ravi Bangoria"
      
      * tag 'powerpc-4.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/xmon: Don't print hashed pointers in xmon
        powerpc/64s: Initialize ISAv3 MMU registers before setting partition table
        Revert "powerpc: Do not call ppc_md.panic in fadump panic notifier"
        powerpc/perf: Fix oops when grouping different pmu events
      d90696ed
    • David S. Miller's avatar
      Merge tag 'linux-can-fixes-for-4.15-20171208' of... · fd29117a
      David S. Miller authored
      Merge tag 'linux-can-fixes-for-4.15-20171208' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
      
      Marc Kleine-Budde says:
      
      ====================
      pull-request: can 2017-12-08
      
      this is a pull request of 6 patches for net/master.
      
      Martin Kelly provides 5 patches for various USB based CAN drivers, that
      properly cancel the URBs on adapter unplug, so that the driver doesn't
      end up in an endless loop. Stephane Grosjean provides a patch to restart
      the tx queue if zero length packages are transmitted.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fd29117a
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-for-davem-2017-12-08' of... · 03afb6e4
      David S. Miller authored
      Merge tag 'wireless-drivers-for-davem-2017-12-08' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      wireless-drivers fixes for 4.15
      
      Second set of fixes for 4.15. This time a lot of iwlwifi patches and
      two brcmfmac patches. Most important here are the MIC and IVC fixes
      for iwlwifi to unbreak 9000 series.
      
      iwlwifi
      
      * fix rate-scaling to not start lowest possible rate
      
      * fix the TX queue hang detection for AP/GO modes
      
      * fix the TX queue hang timeout in monitor interfaces
      
      * fix packet injection
      
      * remove a wrong error message when dumping PCI registers
      
      * fix race condition with RF-kill
      
      * tell mac80211 when the MIC has been stripped (9000 series)
      
      * tell mac80211 when the IVC has been stripped (9000 series)
      
      * add 2 new PCI IDs, one for 9000 and one for 22000
      
      * fix a queue hang due during a P2P Remain-on-Channel operation
      
      brcmfmac
      
      * fix a race which sometimes caused a crash during sdio unbind
      
      * fix a kernel-doc related build error
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      03afb6e4
    • Antoine Tenart's avatar
      net: mvpp2: fix the RSS table entry offset · 8a7b741e
      Antoine Tenart authored
      The macro used to access or set an RSS table entry was using an offset
      of 8, while it should use an offset of 0. This lead to wrongly configure
      the RSS table, not accessing the right entries.
      
      Fixes: 1d7d15d7 ("net: mvpp2: initialize the RSS tables")
      Signed-off-by: default avatarAntoine Tenart <antoine.tenart@free-electrons.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8a7b741e
    • David S. Miller's avatar
      Merge branch 'tcp-RACK-loss-recovery-bug-fixes' · b7e445a1
      David S. Miller authored
      Yuchung Cheng says:
      
      ====================
      tcp: RACK loss recovery bug fixes
      
      This patch set has four minor bug fixes in TCP RACK loss recovery.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b7e445a1
    • Yuchung Cheng's avatar
      tcp: evaluate packet losses upon RTT change · 6065fd0d
      Yuchung Cheng authored
      RACK skips an ACK unless it advances the most recently delivered
      TX timestamp (rack.mstamp). Since RACK also uses the most recent
      RTT to decide if a packet is lost, RACK should still run the
      loss detection whenever the most recent RTT changes. For example,
      an ACK that does not advance the timestamp but triggers the cwnd
      undo due to reordering, would then use the most recent (higher)
      RTT measurement to detect further losses.
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Reviewed-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarPriyaranjan Jha <priyarjha@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6065fd0d
    • Yuchung Cheng's avatar
      tcp: fix off-by-one bug in RACK · 428aec5e
      Yuchung Cheng authored
      RACK should mark a packet lost when remaining wait time is zero.
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Reviewed-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarPriyaranjan Jha <priyarjha@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      428aec5e
    • Yuchung Cheng's avatar
      tcp: always evaluate losses in RACK upon undo · cd1fc85b
      Yuchung Cheng authored
      When sender detects spurious retransmission, all packets
      marked lost are remarked to be in-flight. However some may
      be considered lost based on its timestamps in RACK. This patch
      forces RACK to re-evaluate, which may be skipped previously if
      the ACK does not advance RACK timestamp.
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Reviewed-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarPriyaranjan Jha <priyarjha@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cd1fc85b
    • Yuchung Cheng's avatar
      tcp: correctly test congestion state in RACK · 0ce294d8
      Yuchung Cheng authored
      RACK does not test the loss recovery state correctly to compute
      the reordering window. It assumes if lost_out is zero then TCP is
      not in loss recovery. But it can be zero during recovery before
      calling tcp_rack_detect_loss(): when an ACK acknowledges all
      packets marked lost before receiving this ACK, but has not yet
      to discover new ones by tcp_rack_detect_loss(). The fix is to
      simply test the congestion state directly.
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Reviewed-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarPriyaranjan Jha <priyarjha@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0ce294d8
    • Calvin Owens's avatar
      bnxt_en: Fix sources of spurious netpoll warnings · 2edbdb31
      Calvin Owens authored
      After applying 2270bc5d ("bnxt_en: Fix netpoll handling") and
      903649e7 ("bnxt_en: Improve -ENOMEM logic in NAPI poll loop."),
      we still see the following WARN fire:
      
        ------------[ cut here ]------------
        WARNING: CPU: 0 PID: 1875170 at net/core/netpoll.c:165 netpoll_poll_dev+0x15a/0x160
        bnxt_poll+0x0/0xd0 exceeded budget in poll
        <snip>
        Call Trace:
         [<ffffffff814be5cd>] dump_stack+0x4d/0x70
         [<ffffffff8107e013>] __warn+0xd3/0xf0
         [<ffffffff8107e07f>] warn_slowpath_fmt+0x4f/0x60
         [<ffffffff8179519a>] netpoll_poll_dev+0x15a/0x160
         [<ffffffff81795f38>] netpoll_send_skb_on_dev+0x168/0x250
         [<ffffffff817962fc>] netpoll_send_udp+0x2dc/0x440
         [<ffffffff815fa9be>] write_ext_msg+0x20e/0x250
         [<ffffffff810c8125>] call_console_drivers.constprop.23+0xa5/0x110
         [<ffffffff810c9549>] console_unlock+0x339/0x5b0
         [<ffffffff810c9a88>] vprintk_emit+0x2c8/0x450
         [<ffffffff810c9d5f>] vprintk_default+0x1f/0x30
         [<ffffffff81173df5>] printk+0x48/0x50
         [<ffffffffa0197713>] edac_raw_mc_handle_error+0x563/0x5c0 [edac_core]
         [<ffffffffa0197b9b>] edac_mc_handle_error+0x42b/0x6e0 [edac_core]
         [<ffffffffa01c3a60>] sbridge_mce_output_error+0x410/0x10d0 [sb_edac]
         [<ffffffffa01c47cc>] sbridge_check_error+0xac/0x130 [sb_edac]
         [<ffffffffa0197f3c>] edac_mc_workq_function+0x3c/0x90 [edac_core]
         [<ffffffff81095f8b>] process_one_work+0x19b/0x480
         [<ffffffff810967ca>] worker_thread+0x6a/0x520
         [<ffffffff8109c7c4>] kthread+0xe4/0x100
         [<ffffffff81884c52>] ret_from_fork+0x22/0x40
      
      This happens because we increment rx_pkts on -ENOMEM and -EIO, resulting
      in rx_pkts > 0. Fix this by only bumping rx_pkts if we were actually
      given a non-zero budget.
      Signed-off-by: default avatarCalvin Owens <calvinowens@fb.com>
      Acked-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2edbdb31
    • David S. Miller's avatar
      Merge branch 'tcp-bbr-sampling-fixes' · b25b3e2f
      David S. Miller authored
      Neal Cardwell says:
      
      ====================
      TCP BBR sampling fixes for loss recovery undo
      
      This patch series has a few minor bug fixes for cases where spurious
      loss recoveries can trick BBR estimators into estimating that the
      available bandwidth is much lower than the true available bandwidth.
      In both cases the fix here is to just reset the estimator upon loss
      recovery undo.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b25b3e2f