1. 03 Jan, 2020 4 commits
  2. 02 Jan, 2020 2 commits
    • Pengcheng Yang's avatar
      tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK · c9655008
      Pengcheng Yang authored
      When we receive a D-SACK, where the sequence number satisfies:
      	undo_marker <= start_seq < end_seq <= prior_snd_una
      we consider this is a valid D-SACK and tcp_is_sackblock_valid()
      returns true, then this D-SACK is discarded as "old stuff",
      but the variable first_sack_index is not marked as negative
      in tcp_sacktag_write_queue().
      
      If this D-SACK also carries a SACK that needs to be processed
      (for example, the previous SACK segment was lost), this SACK
      will be treated as a D-SACK in the following processing of
      tcp_sacktag_write_queue(), which will eventually lead to
      incorrect updates of undo_retrans and reordering.
      
      Fixes: fd6dad61 ("[TCP]: Earlier SACK block verification & simplify access to them")
      Signed-off-by: default avatarPengcheng Yang <yangpc@wangsu.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c9655008
    • Baruch Siach's avatar
      net: dsa: mv88e6xxx: force cmode write on 6141/6341 · f7a48b68
      Baruch Siach authored
      mv88e6xxx_port_set_cmode() relies on cmode stored in struct
      mv88e6xxx_port to skip cmode update when the requested value matches the
      cached value. It turns out that mv88e6xxx_port_hidden_write() might
      change the port cmode setting as a side effect, so we can't rely on the
      cached value to determine that cmode update in not necessary.
      
      Force cmode update in mv88e6341_port_set_cmode(), to make
      serdes configuration work again. Other mv88e6xxx_port_set_cmode()
      callers keep the current behaviour.
      
      This fixes serdes configuration of the 6141 switch on SolidRun Clearfog
      GT-8K.
      
      Fixes: 7a3007d2 ("net: dsa: mv88e6xxx: fully support SERDES on Topaz family")
      Reported-by: default avatarDenis Odintsov <d.odintsov@traviangames.com>
      Signed-off-by: default avatarBaruch Siach <baruch@tkos.co.il>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f7a48b68
  3. 31 Dec, 2019 11 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 738d2902
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix big endian overflow in nf_flow_table, from Arnd Bergmann.
      
       2) Fix port selection on big endian in nft_tproxy, from Phil Sutter.
      
       3) Fix precision tracking for unbound scalars in bpf verifier, from
          Daniel Borkmann.
      
       4) Fix integer overflow in socket rcvbuf check in UDP, from Antonio
          Messina.
      
       5) Do not perform a neigh confirmation during a pmtu update over a
          tunnel, from Hangbin Liu.
      
       6) Fix DMA mapping leak in dpaa_eth driver, from Madalin Bucur.
      
       7) Various PTP fixes for sja1105 dsa driver, from Vladimir Oltean.
      
       8) Add missing to dummy definition of of_mdiobus_child_is_phy(), from
          Geert Uytterhoeven
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (54 commits)
        hsr: fix slab-out-of-bounds Read in hsr_debugfs_rename()
        net/sched: add delete_empty() to filters and use it in cls_flower
        tcp: Fix highest_sack and highest_sack_seq
        ptp: fix the race between the release of ptp_clock and cdev
        net: dsa: sja1105: Reconcile the meaning of TPID and TPID2 for E/T and P/Q/R/S
        Documentation: net: dsa: sja1105: Remove text about taprio base-time limitation
        net: dsa: sja1105: Remove restriction of zero base-time for taprio offload
        net: dsa: sja1105: Really make the PTP command read-write
        net: dsa: sja1105: Take PTP egress timestamp by port, not mgmt slot
        cxgb4/cxgb4vf: fix flow control display for auto negotiation
        mlxsw: spectrum: Use dedicated policer for VRRP packets
        mlxsw: spectrum_router: Skip loopback RIFs during MAC validation
        net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs
        net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device
        net_sched: sch_fq: properly set sk->sk_pacing_status
        bnx2x: Fix accounting of vlan resources among the PFs
        bnx2x: Use appropriate define for vlan credit
        of: mdio: Add missing inline to of_mdiobus_child_is_phy() dummy
        net: phy: aquantia: add suspend / resume ops for AQR105
        dpaa_eth: fix DMA mapping leak
        ...
      738d2902
    • Linus Torvalds's avatar
      Merge tag 'tomoyo-fixes-for-5.5' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1 · c5c928c6
      Linus Torvalds authored
      Pull tomoyo fixes from Tetsuo Handa:
       "Two bug fixes:
      
         - Suppress RCU warning at list_for_each_entry_rcu()
      
         - Don't use fancy names on sockets"
      
      * tag 'tomoyo-fixes-for-5.5' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1:
        tomoyo: Suppress RCU warning at list_for_each_entry_rcu().
        tomoyo: Don't use nifty names on sockets.
      c5c928c6
    • Taehee Yoo's avatar
      hsr: fix slab-out-of-bounds Read in hsr_debugfs_rename() · 04b69426
      Taehee Yoo authored
      hsr slave interfaces don't have debugfs directory.
      So, hsr_debugfs_rename() shouldn't be called when hsr slave interface name
      is changed.
      
      Test commands:
          ip link add dummy0 type dummy
          ip link add dummy1 type dummy
          ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1
          ip link set dummy0 name ap
      
      Splat looks like:
      [21071.899367][T22666] ap: renamed from dummy0
      [21071.914005][T22666] ==================================================================
      [21071.919008][T22666] BUG: KASAN: slab-out-of-bounds in hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.923640][T22666] Read of size 8 at addr ffff88805febcd98 by task ip/22666
      [21071.926941][T22666]
      [21071.927750][T22666] CPU: 0 PID: 22666 Comm: ip Not tainted 5.5.0-rc2+ #240
      [21071.929919][T22666] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
      [21071.935094][T22666] Call Trace:
      [21071.935867][T22666]  dump_stack+0x96/0xdb
      [21071.936687][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.937774][T22666]  print_address_description.constprop.5+0x1be/0x360
      [21071.939019][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.940081][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.940949][T22666]  __kasan_report+0x12a/0x16f
      [21071.941758][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.942674][T22666]  kasan_report+0xe/0x20
      [21071.943325][T22666]  hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.944187][T22666]  hsr_netdev_notify+0x1fe/0x9b0 [hsr]
      [21071.945052][T22666]  ? __module_text_address+0x13/0x140
      [21071.945897][T22666]  notifier_call_chain+0x90/0x160
      [21071.946743][T22666]  dev_change_name+0x419/0x840
      [21071.947496][T22666]  ? __read_once_size_nocheck.constprop.6+0x10/0x10
      [21071.948600][T22666]  ? netdev_adjacent_rename_links+0x280/0x280
      [21071.949577][T22666]  ? __read_once_size_nocheck.constprop.6+0x10/0x10
      [21071.950672][T22666]  ? lock_downgrade+0x6e0/0x6e0
      [21071.951345][T22666]  ? do_setlink+0x811/0x2ef0
      [21071.951991][T22666]  do_setlink+0x811/0x2ef0
      [21071.952613][T22666]  ? is_bpf_text_address+0x81/0xe0
      [ ... ]
      
      Reported-by: syzbot+9328206518f08318a5fd@syzkaller.appspotmail.com
      Fixes: 4c2d5e33 ("hsr: rename debugfs file when interface name is changed")
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      04b69426
    • Davide Caratti's avatar
      net/sched: add delete_empty() to filters and use it in cls_flower · a5b72a08
      Davide Caratti authored
      Revert "net/sched: cls_u32: fix refcount leak in the error path of
      u32_change()", and fix the u32 refcount leak in a more generic way that
      preserves the semantic of rule dumping.
      On tc filters that don't support lockless insertion/removal, there is no
      need to guard against concurrent insertion when a removal is in progress.
      Therefore, for most of them we can avoid a full walk() when deleting, and
      just decrease the refcount, like it was done on older Linux kernels.
      This fixes situations where walk() was wrongly detecting a non-empty
      filter, like it happened with cls_u32 in the error path of change(), thus
      leading to failures in the following tdc selftests:
      
       6aa7: (filter, u32) Add/Replace u32 with source match and invalid indev
       6658: (filter, u32) Add/Replace u32 with custom hash table and invalid handle
       74c2: (filter, u32) Add/Replace u32 filter with invalid hash table id
      
      On cls_flower, and on (future) lockless filters, this check is necessary:
      move all the check_empty() logic in a callback so that each filter
      can have its own implementation. For cls_flower, it's sufficient to check
      if no IDRs have been allocated.
      
      This reverts commit 275c44aa.
      
      Changes since v1:
       - document the need for delete_empty() when TCF_PROTO_OPS_DOIT_UNLOCKED
         is used, thanks to Vlad Buslov
       - implement delete_empty() without doing fl_walk(), thanks to Vlad Buslov
       - squash revert and new fix in a single patch, to be nice with bisect
         tests that run tdc on u32 filter, thanks to Dave Miller
      
      Fixes: 275c44aa ("net/sched: cls_u32: fix refcount leak in the error path of u32_change()")
      Fixes: 6676d5e4 ("net: sched: set dedicated tcf_walker flag when tp is empty")
      Suggested-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Suggested-by: default avatarVlad Buslov <vladbu@mellanox.com>
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Reviewed-by: default avatarVlad Buslov <vladbu@mellanox.com>
      Tested-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a5b72a08
    • Cambda Zhu's avatar
      tcp: Fix highest_sack and highest_sack_seq · 85369750
      Cambda Zhu authored
      >From commit 50895b9d ("tcp: highest_sack fix"), the logic about
      setting tp->highest_sack to the head of the send queue was removed.
      Of course the logic is error prone, but it is logical. Before we
      remove the pointer to the highest sack skb and use the seq instead,
      we need to set tp->highest_sack to NULL when there is no skb after
      the last sack, and then replace NULL with the real skb when new skb
      inserted into the rtx queue, because the NULL means the highest sack
      seq is tp->snd_nxt. If tp->highest_sack is NULL and new data sent,
      the next ACK with sack option will increase tp->reordering unexpectedly.
      
      This patch sets tp->highest_sack to the tail of the rtx queue if
      it's NULL and new data is sent. The patch keeps the rule that the
      highest_sack can only be maintained by sack processing, except for
      this only case.
      
      Fixes: 50895b9d ("tcp: highest_sack fix")
      Signed-off-by: default avatarCambda Zhu <cambda@linux.alibaba.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      85369750
    • Vladis Dronov's avatar
      ptp: fix the race between the release of ptp_clock and cdev · a33121e5
      Vladis Dronov authored
      In a case when a ptp chardev (like /dev/ptp0) is open but an underlying
      device is removed, closing this file leads to a race. This reproduces
      easily in a kvm virtual machine:
      
      ts# cat openptp0.c
      int main() { ... fp = fopen("/dev/ptp0", "r"); ... sleep(10); }
      ts# uname -r
      5.5.0-rc3-46cf053e
      ts# cat /proc/cmdline
      ... slub_debug=FZP
      ts# modprobe ptp_kvm
      ts# ./openptp0 &
      [1] 670
      opened /dev/ptp0, sleeping 10s...
      ts# rmmod ptp_kvm
      ts# ls /dev/ptp*
      ls: cannot access '/dev/ptp*': No such file or directory
      ts# ...woken up
      [   48.010809] general protection fault: 0000 [#1] SMP
      [   48.012502] CPU: 6 PID: 658 Comm: openptp0 Not tainted 5.5.0-rc3-46cf053e #25
      [   48.014624] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ...
      [   48.016270] RIP: 0010:module_put.part.0+0x7/0x80
      [   48.017939] RSP: 0018:ffffb3850073be00 EFLAGS: 00010202
      [   48.018339] RAX: 000000006b6b6b6b RBX: 6b6b6b6b6b6b6b6b RCX: ffff89a476c00ad0
      [   48.018936] RDX: fffff65a08d3ea08 RSI: 0000000000000247 RDI: 6b6b6b6b6b6b6b6b
      [   48.019470] ...                                              ^^^ a slub poison
      [   48.023854] Call Trace:
      [   48.024050]  __fput+0x21f/0x240
      [   48.024288]  task_work_run+0x79/0x90
      [   48.024555]  do_exit+0x2af/0xab0
      [   48.024799]  ? vfs_write+0x16a/0x190
      [   48.025082]  do_group_exit+0x35/0x90
      [   48.025387]  __x64_sys_exit_group+0xf/0x10
      [   48.025737]  do_syscall_64+0x3d/0x130
      [   48.026056]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [   48.026479] RIP: 0033:0x7f53b12082f6
      [   48.026792] ...
      [   48.030945] Modules linked in: ptp i6300esb watchdog [last unloaded: ptp_kvm]
      [   48.045001] Fixing recursive fault but reboot is needed!
      
      This happens in:
      
      static void __fput(struct file *file)
      {   ...
          if (file->f_op->release)
              file->f_op->release(inode, file); <<< cdev is kfree'd here
          if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL &&
                   !(mode & FMODE_PATH))) {
              cdev_put(inode->i_cdev); <<< cdev fields are accessed here
      
      Namely:
      
      __fput()
        posix_clock_release()
          kref_put(&clk->kref, delete_clock) <<< the last reference
            delete_clock()
              delete_ptp_clock()
                kfree(ptp) <<< cdev is embedded in ptp
        cdev_put
          module_put(p->owner) <<< *p is kfree'd, bang!
      
      Here cdev is embedded in posix_clock which is embedded in ptp_clock.
      The race happens because ptp_clock's lifetime is controlled by two
      refcounts: kref and cdev.kobj in posix_clock. This is wrong.
      
      Make ptp_clock's sysfs device a parent of cdev with cdev_device_add()
      created especially for such cases. This way the parent device with its
      ptp_clock is not released until all references to the cdev are released.
      This adds a requirement that an initialized but not exposed struct
      device should be provided to posix_clock_register() by a caller instead
      of a simple dev_t.
      
      This approach was adopted from the commit 72139dfa ("watchdog: Fix
      the race between the release of watchdog_core_data and cdev"). See
      details of the implementation in the commit 233ed09d ("chardev: add
      helper function to register char devs with a struct device").
      
      Link: https://lore.kernel.org/linux-fsdevel/20191125125342.6189-1-vdronov@redhat.com/T/#uAnalyzed-by: default avatarStephen Johnston <sjohnsto@redhat.com>
      Analyzed-by: default avatarVern Lovejoy <vlovejoy@redhat.com>
      Signed-off-by: default avatarVladis Dronov <vdronov@redhat.com>
      Acked-by: default avatarRichard Cochran <richardcochran@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a33121e5
    • Vladimir Oltean's avatar
      net: dsa: sja1105: Reconcile the meaning of TPID and TPID2 for E/T and P/Q/R/S · 54fa49ee
      Vladimir Oltean authored
      For first-generation switches (SJA1105E and SJA1105T):
      - TPID means C-Tag (typically 0x8100)
      - TPID2 means S-Tag (typically 0x88A8)
      
      While for the second generation switches (SJA1105P, SJA1105Q, SJA1105R,
      SJA1105S) it is the other way around:
      - TPID means S-Tag (typically 0x88A8)
      - TPID2 means C-Tag (typically 0x8100)
      
      In other words, E/T tags untagged traffic with TPID, and P/Q/R/S with
      TPID2.
      
      So the patch mentioned below fixed VLAN filtering for P/Q/R/S, but broke
      it for E/T.
      
      We strive for a common code path for all switches in the family, so just
      lie in the static config packing functions that TPID and TPID2 are at
      swapped bit offsets than they actually are, for P/Q/R/S. This will make
      both switches understand TPID to be ETH_P_8021Q and TPID2 to be
      ETH_P_8021AD. The meaning from the original E/T was chosen over P/Q/R/S
      because E/T is actually the one with public documentation available
      (UM10944.pdf).
      
      Fixes: f9a1a764 ("net: dsa: sja1105: Reverse TPID and TPID2")
      Signed-off-by: default avatarVladimir Oltean <olteanv@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      54fa49ee
    • Vladimir Oltean's avatar
      Documentation: net: dsa: sja1105: Remove text about taprio base-time limitation · 3a323ed7
      Vladimir Oltean authored
      Since commit 86db36a3 ("net: dsa: sja1105: Implement state machine
      for TAS with PTP clock source"), this paragraph is no longer true. So
      remove it.
      Signed-off-by: default avatarVladimir Oltean <olteanv@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3a323ed7
    • Vladimir Oltean's avatar
      net: dsa: sja1105: Remove restriction of zero base-time for taprio offload · d00bdc0a
      Vladimir Oltean authored
      The check originates from the initial implementation which was not based
      on PTP time but on a standalone clock source. In the meantime we can now
      program the PTPSCHTM register at runtime with the dynamic base time
      (actually with a value that is 200 ns smaller, to avoid writing DELTA=0
      in the Schedule Entry Points Parameters Table). And we also have logic
      for moving the actual base time in the future of the PHC's current time
      base, so the check for zero serves no purpose, since even if the user
      will specify zero, that's not what will end up in the static config
      table where the limitation is.
      
      Fixes: 86db36a3 ("net: dsa: sja1105: Implement state machine for TAS with PTP clock source")
      Signed-off-by: default avatarVladimir Oltean <olteanv@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d00bdc0a
    • Vladimir Oltean's avatar
      net: dsa: sja1105: Really make the PTP command read-write · 5a47f588
      Vladimir Oltean authored
      When activating tc-taprio offload on the switch ports, the TAS state
      machine will try to check whether it is running or not, but will find
      both the STARTED and STOPPED bits as false in the
      sja1105_tas_check_running function. So the function will return -EINVAL
      (an abnormal situation) and the kernel will keep printing this from the
      TAS FSM workqueue:
      
      [   37.691971] sja1105 spi0.1: An operation returned -22
      
      The reason is that the underlying function that gets called,
      sja1105_ptp_commit, does not actually do a SPI_READ, but a SPI_WRITE. So
      the command buffer remains initialized with zeroes instead of retrieving
      the hardware state. Fix that.
      
      Fixes: 41603d78 ("net: dsa: sja1105: Make the PTP command read-write")
      Signed-off-by: default avatarVladimir Oltean <olteanv@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5a47f588
    • Vladimir Oltean's avatar
      net: dsa: sja1105: Take PTP egress timestamp by port, not mgmt slot · 9fcf024d
      Vladimir Oltean authored
      The PTP egress timestamp N must be captured from register PTPEGR_TS[n],
      where n = 2 * PORT + TSREG. There are 10 PTPEGR_TS registers, 2 per
      port. We are only using TSREG=0.
      
      As opposed to the management slots, which are 4 in number
      (SJA1105_NUM_PORTS, minus the CPU port). Any management frame (which
      includes PTP frames) can be sent to any non-CPU port through any
      management slot. When the CPU port is not the last port (#4), there will
      be a mismatch between the slot and the port number.
      
      Luckily, the only mainline occurrence with this switch
      (arch/arm/boot/dts/ls1021a-tsn.dts) does have the CPU port as #4, so the
      issue did not manifest itself thus far.
      
      Fixes: 47ed985e ("net: dsa: sja1105: Add logic for TX timestamping")
      Signed-off-by: default avatarVladimir Oltean <olteanv@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9fcf024d
  4. 30 Dec, 2019 1 commit
  5. 29 Dec, 2019 8 commits
  6. 28 Dec, 2019 6 commits
    • Olof Johansson's avatar
      riscv: export flush_icache_all to modules · 1833e327
      Olof Johansson authored
      This is needed by LKDTM (crash dump test module), it calls
      flush_icache_range(), which on RISC-V turns into flush_icache_all(). On
      other architectures, the actual implementation is exported, so follow
      that precedence and export it here too.
      
      Fixes build of CONFIG_LKDTM that fails with:
      ERROR: "flush_icache_all" [drivers/misc/lkdtm/lkdtm.ko] undefined!
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      Signed-off-by: default avatarPaul Walmsley <paul.walmsley@sifive.com>
      1833e327
    • David Abdurachmanov's avatar
      riscv: reject invalid syscalls below -1 · 556f47ac
      David Abdurachmanov authored
      Running "stress-ng --enosys 4 -t 20 -v" showed a large number of kernel oops
      with "Unable to handle kernel paging request at virtual address" message. This
      happens when enosys stressor starts testing random non-valid syscalls.
      
      I forgot to redirect any syscall below -1 to sys_ni_syscall.
      
      With the patch kernel oops messages are gone while running stress-ng enosys
      stressor.
      Signed-off-by: default avatarDavid Abdurachmanov <david.abdurachmanov@sifive.com>
      Fixes: 5340627e ("riscv: add support for SECCOMP and SECCOMP_FILTER")
      Signed-off-by: default avatarPaul Walmsley <paul.walmsley@sifive.com>
      556f47ac
    • Luc Van Oostenryck's avatar
      riscv: fix compile failure with EXPORT_SYMBOL() & !MMU · 4d47ce15
      Luc Van Oostenryck authored
      When support for !MMU was added, the declaration of
      __asm_copy_to_user() & __asm_copy_from_user() were #ifdefed
      out hence their EXPORT_SYMBOL() give an error message like:
        .../riscv_ksyms.c:13:15: error: '__asm_copy_to_user' undeclared here
        .../riscv_ksyms.c:14:15: error: '__asm_copy_from_user' undeclared here
      
      Since these symbols are not defined with !MMU it's wrong to export them.
      Same for __clear_user() (even though this one is also declared in
      include/asm-generic/uaccess.h and thus doesn't give an error message).
      
      Fix this by doing the EXPORT_SYMBOL() directly where these symbols
      are defined: inside lib/uaccess.S itself.
      
      Fixes: 6bd33e1e ("riscv: fix compile failure with EXPORT_SYMBOL() & !MMU")
      Reported-by: default avatarkbuild test robot <lkp@intel.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Palmer Dabbelt <palmer@dabbelt.com>
      Cc: Paul Walmsley <paul.walmsley@sifive.com>
      Signed-off-by: default avatarLuc Van Oostenryck <luc.vanoostenryck@gmail.com>
      Signed-off-by: default avatarPaul Walmsley <paul.walmsley@sifive.com>
      4d47ce15
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · bf8d1cd4
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Four fixes and one spelling update, all in drivers: two in lpfc and
        the rest in mp3sas, cxgbi and target"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: target/iblock: Fix protection error with blocks greater than 512B
        scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy()
        scsi: lpfc: fix spelling mistakes of asynchronous
        scsi: lpfc: fix build failure with DEBUGFS disabled
        scsi: mpt3sas: Fix double free in attach error handling
      bf8d1cd4
    • Martin Blumenstingl's avatar
      net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs · bd6f4854
      Martin Blumenstingl authored
      GXBB and newer SoCs use the fixed FCLK_DIV2 (1GHz) clock as input for
      the m250_sel clock. Meson8b and Meson8m2 use MPLL2 instead, whose rate
      can be adjusted at runtime.
      
      So far we have been running MPLL2 with ~250MHz (and the internal
      m250_div with value 1), which worked enough that we could transfer data
      with an TX delay of 4ns. Unfortunately there is high packet loss with
      an RGMII PHY when transferring data (receiving data works fine though).
      Odroid-C1's u-boot is running with a TX delay of only 2ns as well as
      the internal m250_div set to 2 - no lost (TX) packets can be observed
      with that setting in u-boot.
      
      Manual testing has shown that the TX packet loss goes away when using
      the following settings in Linux (the vendor kernel uses the same
      settings):
      - MPLL2 clock set to ~500MHz
      - m250_div set to 2
      - TX delay set to 2ns on the MAC side
      
      Update the m250_div divider settings to only accept dividers greater or
      equal 2 to fix the TX delay generated by the MAC.
      
      iperf3 results before the change:
      [ ID] Interval           Transfer     Bitrate         Retr
      [  5]   0.00-10.00  sec   182 MBytes   153 Mbits/sec  514      sender
      [  5]   0.00-10.00  sec   182 MBytes   152 Mbits/sec           receiver
      
      iperf3 results after the change (including an updated TX delay of 2ns):
      [ ID] Interval           Transfer     Bitrate         Retr  Cwnd
      [  5]   0.00-10.00  sec   927 MBytes   778 Mbits/sec    0      sender
      [  5]   0.00-10.01  sec   927 MBytes   777 Mbits/sec           receiver
      
      Fixes: 4f6a71b8 ("net: stmmac: dwmac-meson8b: fix internal RGMII clock configuration")
      Signed-off-by: default avatarMartin Blumenstingl <martin.blumenstingl@googlemail.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bd6f4854
    • Shmulik Ladkani's avatar
      net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device · 70cf3dc7
      Shmulik Ladkani authored
      There's no skb_pull performed when a mirred action is set at egress of a
      mac device, with a target device/action that expects skb->data to point
      at the network header.
      
      As a result, either the target device is errornously given an skb with
      data pointing to the mac (egress case), or the net stack receives the
      skb with data pointing to the mac (ingress case).
      
      E.g:
       # tc qdisc add dev eth9 root handle 1: prio
       # tc filter add dev eth9 parent 1: prio 9 protocol ip handle 9 basic \
         action mirred egress redirect dev tun0
      
       (tun0 is a tun device. result: tun0 errornously gets the eth header
        instead of the iph)
      
      Revise the push/pull logic of tcf_mirred_act() to not rely on the
      skb_at_tc_ingress() vs tcf_mirred_act_wants_ingress() comparison, as it
      does not cover all "pull" cases.
      
      Instead, calculate whether the required action on the target device
      requires the data to point at the network header, and compare this to
      whether skb->data points to network header - and make the push/pull
      adjustments as necessary.
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Signed-off-by: default avatarShmulik Ladkani <sladkani@proofpoint.com>
      Tested-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      70cf3dc7
  7. 27 Dec, 2019 8 commits
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2019-12-28' of git://anongit.freedesktop.org/drm/drm · 48a8dd17
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Post-xmas food coma recovery fixes. Only three fixes for i915 since I
        expect most people are holidaying.
      
        i915:
         - power management rc6 fix
         - framebuffer tracking fix
         - display power management ratelimit fix"
      
      * tag 'drm-fixes-2019-12-28' of git://anongit.freedesktop.org/drm/drm:
        drm/i915: Hold reference to intel_frontbuffer as we track activity
        drm/i915/gt: Ratelimit display power w/a
        drm/i915/pmu: Ensure monotonic rc6
      48a8dd17
    • Linus Torvalds's avatar
      Merge tag 'linux-kselftest-5.5-rc4' of... · f4b39746
      Linus Torvalds authored
      Merge tag 'linux-kselftest-5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
      
      Pull Kselftest fixes from Shuah Khan:
      
       - rseq build failures fixes related to glibc 2.30 compatibility from
         Mathieu Desnoyers
      
       - Kunit fixes and cleanups from SeongJae Park
      
       - Fixes to filesystems/epoll, firmware, and livepatch build failures
         and skip handling.
      
      * tag 'linux-kselftest-5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
        rseq/selftests: Clarify rseq_prepare_unload() helper requirements
        rseq/selftests: Fix: Namespace gettid() for compatibility with glibc 2.30
        rseq/selftests: Turn off timeout setting
        kunit/kunit_tool_test: Test '--build_dir' option run
        kunit: Rename 'kunitconfig' to '.kunitconfig'
        kunit: Place 'test.log' under the 'build_dir'
        kunit: Create default config in '--build_dir'
        kunit: Remove duplicated defconfig creation
        docs/kunit/start: Use in-tree 'kunit_defconfig'
        selftests: livepatch: Fix it to do root uid check and skip
        selftests: firmware: Fix it to do root uid check and skip
        selftests: filesystems/epoll: fix build error
      f4b39746
    • Linus Torvalds's avatar
      Merge tag 'pm-5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 1413c361
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "Fix compile test of the Tegra devfreq driver (Arnd Bergmann) and
        remove redundant Kconfig dependencies from multiple devfreq drivers
        (Leonard Crestez)"
      
      * tag 'pm-5.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        PM / devfreq: tegra: Add COMMON_CLK dependency
        PM / devfreq: Drop explicit selection of PM_OPP
      1413c361
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.5-20191226' of git://git.kernel.dk/linux-block · 534121d2
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
      
       - Removal of now unused busy wqe list (Hillf)
      
       - Add cond_resched() to io-wq work processing (Hillf)
      
       - And then the series that I hinted at from last week, which removes
         the sqe from the io_kiocb and keeps all sqe handling on the prep
         side. This guarantees that an opcode can't do the wrong thing and
         read the sqe more than once. This is unchanged from last week, no
         issues have been observed with this in testing. Hence I really think
         we should fold this into 5.5.
      
      * tag 'io_uring-5.5-20191226' of git://git.kernel.dk/linux-block:
        io-wq: add cond_resched() to worker thread
        io-wq: remove unused busy list from io_sqe
        io_uring: pass in 'sqe' to the prep handlers
        io_uring: standardize the prep methods
        io_uring: read 'count' for IORING_OP_TIMEOUT in prep handler
        io_uring: move all prep state for IORING_OP_{SEND,RECV}_MGS to prep handler
        io_uring: move all prep state for IORING_OP_CONNECT to prep handler
        io_uring: add and use struct io_rw for read/writes
        io_uring: use u64_to_user_ptr() consistently
      534121d2
    • Linus Torvalds's avatar
      Merge tag 'libata-5.5-20191226' of git://git.kernel.dk/linux-block · 0f710a55
      Linus Torvalds authored
      Pull libata fixes from Jens Axboe:
       "Two things in here:
      
         - First half of a series that fixes ahci_brcm, also marked for
           stable. The other part of the series is going into 5.6 (Florian)
      
         - sata_nv regression fix that is also marked for stable (Sascha)"
      
      * tag 'libata-5.5-20191226' of git://git.kernel.dk/linux-block:
        ata: ahci_brcm: Add missing clock management during recovery
        ata: ahci_brcm: BCM7425 AHCI requires AHCI_HFLAG_DELAY_ENGINE
        ata: ahci_brcm: Fix AHCI resources management
        ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys()
        libata: Fix retrieving of active qcs
      0f710a55
    • Linus Torvalds's avatar
      Merge tag 'block-5.5-20191226' of git://git.kernel.dk/linux-block · 8ae40a69
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Only thing here are the changes from Arnd from last week, which now
        have the appropriate header include to ensure they actually compile if
        COMPAT is enabled"
      
      * tag 'block-5.5-20191226' of git://git.kernel.dk/linux-block:
        compat_ioctl: block: handle Persistent Reservations
        compat_ioctl: block: handle add zone open, close and finish ioctl
        compat_ioctl: block: handle BLKGETZONESZ/BLKGETNRZONES
        compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE
        pktcdvd: fix regression on 64-bit architectures
      8ae40a69
    • Linus Torvalds's avatar
      Merge tag 'gpio-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · a305bd7c
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "A set of fixes for the v5.5 series:
      
         - Fix the build for the Xtensa driver.
      
         - Make sure to set up the parent device for mpc8xxx.
      
         - Clarify the look-up error message.
      
         - Fix the usage of the line direction in the mockup device.
      
         - Fix a type warning on the Aspeed driver.
      
         - Remove the pointless __exit annotation on the xgs-iproc which is
           causing a compilation problem.
      
         - Fix up emultation of open drain outputs .get_direction()
      
         - Fix the IRQ callbacks on the PCA953xx to use bitops and work
           properly.
      
         - Fix the Kconfig on the Tegra driver"
      
      * tag 'gpio-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: tegra186: Allow building on Tegra194-only configurations
        gpio: pca953x: Switch to bitops in IRQ callbacks
        gpiolib: fix up emulated open drain outputs
        MAINTAINERS: Append missed file to the database
        gpio: xgs-iproc: remove __exit annotation for iproc_gpio_remove
        gpio: aspeed: avoid return type warning
        gpio: mockup: Fix usage of new GPIO_LINE_DIRECTION
        gpio: Fix error message on out-of-range GPIO in lookup table
        gpio: mpc8xxx: Add platform device to gpiochip->parent
        gpio: xtensa: fix driver build
      a305bd7c
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2019-12-23' of... · e31d941c
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2019-12-23' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      i915 power and frontbuffer tracking fixes
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Jani Nikula <jani.nikula@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/87r20vdlrs.fsf@intel.com
      e31d941c