1. 11 Jun, 2018 1 commit
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · f0dc7f9c
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix several bpfilter/UMH bugs, in particular make the UMH build not
          depend upon X86 specific Kconfig symbols. From Alexei Starovoitov.
      
       2) Fix handling of modified context pointer in bpf verifier, from
          Daniel Borkmann.
      
       3) Kill regression in ifdown/ifup sequences for hv_netvsc driver, from
          Dexuan Cui.
      
       4) When the bonding primary member name changes, we have to re-evaluate
          the bond->force_primary setting, from Xiangning Yu.
      
       5) Eliminate possible padding beyone end of SKB in cdc_ncm driver, from
          Bjørn Mork.
      
       6) RX queue length reported for UDP sockets in procfs and socket diag
          are inaccurate, from Paolo Abeni.
      
       7) Fix br_fdb_find_port() locking, from Petr Machata.
      
       8) Limit sk_rcvlowat values properly in TCP, from Soheil Hassas
          Yeganeh.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (23 commits)
        tcp: limit sk_rcvlowat by the maximum receive buffer
        net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620
        socket: close race condition between sock_close() and sockfs_setattr()
        net: bridge: Fix locking in br_fdb_find_port()
        udp: fix rx queue len reported by diag and proc interface
        cdc_ncm: avoid padding beyond end of skb
        net/sched: act_simple: fix parsing of TCA_DEF_DATA
        net: fddi: fix a possible null-ptr-deref
        net: aquantia: fix unsigned numvecs comparison with less than zero
        net: stmmac: fix build failure due to missing COMMON_CLK dependency
        bpfilter: fix race in pipe access
        bpf, xdp: fix crash in xdp_umem_unaccount_pages
        xsk: Fix umem fill/completion queue mmap on 32-bit
        tools/bpf: fix selftest get_cgroup_id_user
        bpfilter: fix OUTPUT_FORMAT
        umh: fix race condition
        net: mscc: ocelot: Fix uninitialized error in ocelot_netdevice_event()
        bonding: re-evaluate force_primary when the primary slave name changes
        ip_tunnel: Fix name string concatenate in __ip_tunnel_create()
        hv_netvsc: Fix a network regression after ifdown/ifup
        ...
      f0dc7f9c
  2. 10 Jun, 2018 16 commits
    • Linus Torvalds's avatar
      Merge tag 'rtc-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux · 1aaccb5f
      Linus Torvalds authored
      Pull RTC updates from Alexandre Belloni:
       "Setting the supported range from drivers for RTCs failing soon has
        started. A few fixes are developed along the way. Some drivers have
        been switched to SPDX by their maintainers.
      
        Subsystem:
      
         - rework of the rtc-test driver which allows to test the core more
           thoroughly
      
         - rtc_set_alarm() now fails early when alarms are not supported
      
        Drivers:
      
         - mktime() is now replaced by mktime64()
      
         - RTC range added for 88pm80x, ab-b5ze-s3, at91rm9200,
           brcmstb-waketimer, ds1685, ftrtc010, ls1x, mxc_v2, rx8581, sprd,
           st-lpc, tps6586x, tps65910 and vr41xx
      
         - fixed a possible race condition in probe functions
      
         - pxa: fix the probe function that is broken since v4.3
      
         - stm32: now supports stm32mp1"
      
      * tag 'rtc-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (78 commits)
        rtc: pxa: fix probe function
        rtc: cros-ec: Switch to SPDX identifier.
        rtc: cros-ec: Make license text and module license match.
        rtc: ensure rtc_set_alarm fails when alarms are not supported
        rtc: test: remove alarm support from the first device
        rtc: test: convert to devm_rtc_allocate_device
        rtc: ftrtc010: let the core handle range
        rtc: ftrtc010: handle dates after 2106
        rtc: ftrtc010: switch to devm_rtc_allocate_device
        rtc: mrst: switch to devm functions
        rtc: sunxi: fix possible race condition
        rtc: test: remove irq sysfs file
        rtc: test: emulate alarms using timers
        rtc: test: store time as an offset to system time
        rtc: test: allow registering many devices
        rtc: test: remove useless proc info
        rtc: ds1685: Add range
        rtc: ds1685: fix possible race condition
        rtc: sprd: Add new RTC power down check method
        rtc: sun6i: Fix bit_idx value for clk_register_gate
        ...
      1aaccb5f
    • Linus Torvalds's avatar
      Merge tag 'upstream-4.18-rc1' of git://git.infradead.org/linux-ubifs · ab0b2e59
      Linus Torvalds authored
      Pull UBI and UBIFS updates from Richard Weinberger:
      
       - the UBI on-disk format header file is now dual licensed
      
       - new way to detect Fastmap problems during runtime
      
       - bugfix for Fastmap
      
       - minor updates for UBIFS (spelling, comments, vm_fault_t, ...)
      
      * tag 'upstream-4.18-rc1' of git://git.infradead.org/linux-ubifs:
        mtd: ubi: Update ubi-media.h to dual license
        ubi: fastmap: Detect EBA mismatches on-the-fly
        ubi: fastmap: Check each mapping only once
        ubi: fastmap: Correctly handle interrupted erasures in EBA
        ubi: fastmap: Cancel work upon detach
        ubifs: lpt: Fix wrong pnode number range in comment
        ubifs: gc: Fix typo
        ubifs: log: Some spelling fixes
        ubifs: Spelling fix someting -> something
        ubifs: journal: Remove wrong comment
        ubifs: remove set but never used variable
        ubifs, xattr: remove misguided quota flags
        fs: ubifs: Adding new return type vm_fault_t
      ab0b2e59
    • Soheil Hassas Yeganeh's avatar
      tcp: limit sk_rcvlowat by the maximum receive buffer · 867f816b
      Soheil Hassas Yeganeh authored
      The user-provided value to setsockopt(SO_RCVLOWAT) can be
      larger than the maximum possible receive buffer. Such values
      mute POLLIN signals on the socket which can stall progress
      on the socket.
      
      Limit the user-provided value to half of the maximum receive
      buffer, i.e., half of sk_rcvbuf when the receive buffer size
      is set by the user, or otherwise half of sysctl_tcp_rmem[2].
      
      Fixes: d1361840 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning")
      Signed-off-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reviewed-by: default avatarNeal Cardwell <ncardwell@google.com>
      Acked-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      867f816b
    • Linus Torvalds's avatar
      Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 5f85942c
      Linus Torvalds authored
      Pull SCSI updates from James Bottomley:
       "This is mostly updates to the usual drivers: ufs, qedf, mpt3sas, lpfc,
        xfcp, hisi_sas, cxlflash, qla2xxx.
      
        In the absence of Nic, we're also taking target updates which are
        mostly minor except for the tcmu refactor.
      
        The only real core change to worry about is the removal of high page
        bouncing (in sas, storvsc and iscsi). This has been well tested and no
        problems have shown up so far"
      
      * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (268 commits)
        scsi: lpfc: update driver version to 12.0.0.4
        scsi: lpfc: Fix port initialization failure.
        scsi: lpfc: Fix 16gb hbas failing cq create.
        scsi: lpfc: Fix crash in blk_mq layer when executing modprobe -r lpfc
        scsi: lpfc: correct oversubscription of nvme io requests for an adapter
        scsi: lpfc: Fix MDS diagnostics failure (Rx < Tx)
        scsi: hisi_sas: Mark PHY as in reset for nexus reset
        scsi: hisi_sas: Fix return value when get_free_slot() failed
        scsi: hisi_sas: Terminate STP reject quickly for v2 hw
        scsi: hisi_sas: Add v2 hw force PHY function for internal ATA command
        scsi: hisi_sas: Include TMF elements in struct hisi_sas_slot
        scsi: hisi_sas: Try wait commands before before controller reset
        scsi: hisi_sas: Init disks after controller reset
        scsi: hisi_sas: Create a scsi_host_template per HW module
        scsi: hisi_sas: Reset disks when discovered
        scsi: hisi_sas: Add LED feature for v3 hw
        scsi: hisi_sas: Change common allocation mode of device id
        scsi: hisi_sas: change slot index allocation mode
        scsi: hisi_sas: Introduce hisi_sas_phy_set_linkrate()
        scsi: hisi_sas: fix a typo in hisi_sas_task_prep()
        ...
      5f85942c
    • Alvaro Gamez Machado's avatar
      net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620 · b718e8c8
      Alvaro Gamez Machado authored
      DP83620 register set is compatible with the DP83848, but it also supports
      100base-FX. When the hardware is configured such as that fiber mode is
      enabled, autonegotiation is not possible.
      
      The chip, however, doesn't expose this information via BMSR_ANEGCAPABLE.
      Instead, this bit is always set high, even if the particular hardware
      configuration makes it so that auto negotiation is not possible [1]. Under
      these circumstances, the phy subsystem keeps trying for autonegotiation to
      happen, without success.
      
      Hereby, we inspect BMCR_ANENABLE bit after genphy_config_init, which on
      reset is set to 0 when auto negotiation is disabled, and so we use this
      value instead of BMSR_ANEGCAPABLE.
      
      [1] https://e2e.ti.com/support/interface/ethernet/f/903/p/697165/2571170Signed-off-by: default avatarAlvaro Gamez Machado <alvaro.gamez@hazent.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b718e8c8
    • Cong Wang's avatar
      socket: close race condition between sock_close() and sockfs_setattr() · 6d8c50dc
      Cong Wang authored
      fchownat() doesn't even hold refcnt of fd until it figures out
      fd is really needed (otherwise is ignored) and releases it after
      it resolves the path. This means sock_close() could race with
      sockfs_setattr(), which leads to a NULL pointer dereference
      since typically we set sock->sk to NULL in ->release().
      
      As pointed out by Al, this is unique to sockfs. So we can fix this
      in socket layer by acquiring inode_lock in sock_close() and
      checking against NULL in sockfs_setattr().
      
      sock_release() is called in many places, only the sock_close()
      path matters here. And fortunately, this should not affect normal
      sock_close() as it is only called when the last fd refcnt is gone.
      It only affects sock_close() with a parallel sockfs_setattr() in
      progress, which is not common.
      
      Fixes: 86741ec2 ("net: core: Add a UID field to struct sock.")
      Reported-by: default avatarshankarapailoor <shankarapailoor@gmail.com>
      Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
      Cc: Lorenzo Colitti <lorenzo@google.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6d8c50dc
    • Linus Torvalds's avatar
      Merge tag '4.18-fixes-smb3' of git://git.samba.org/sfrench/cifs-2.6 · 0c14e43a
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
      
       - one smb3 (ACL related) fix for stable
      
       - one SMB3 security enhancement (when mounting -t smb3 forbid less
         secure dialects)
      
       - some RDMA and compounding fixes
      
      * tag '4.18-fixes-smb3' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: fix a buffer leak in smb2_query_symlink
        smb3: do not allow insecure cifs mounts when using smb3
        CIFS: Fix NULL ptr deref
        CIFS: fix encryption in SMB3.1.1
        CIFS: Pass page offset for encrypting
        CIFS: Pass page offset for calculating signature
        CIFS: SMBD: Support page offset in memory registration
        CIFS: SMBD: Support page offset in RDMA recv
        CIFS: SMBD: Support page offset in RDMA send
        CIFS: When sending data on socket, pass the correct page offset
        CIFS: Introduce helper function to get page offset and length in smb_rqst
        CIFS: Calculate the correct request length based on page offset and tail size
        cifs: For SMB2 security informaion query, check for minimum sized security descriptor instead of sizeof FileAllInformation class
        CIFS: Fix signing for SMB2/3
      0c14e43a
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20180610' of git://git.kernel.dk/linux-block · bbaa1013
      Linus Torvalds authored
      Pull block flush handling fix from Jens Axboe:
       "Single fix that we should merge now, fixing a regression in queuing
        flush request, accessing request flags after calling the end_request
        handler"
      
      * tag 'for-linus-20180610' of git://git.kernel.dk/linux-block:
        block: fix use-after-free in block flush handling
      bbaa1013
    • Linus Torvalds's avatar
      Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · d82991a8
      Linus Torvalds authored
      Pull restartable sequence support from Thomas Gleixner:
       "The restartable sequences syscall (finally):
      
        After a lot of back and forth discussion and massive delays caused by
        the speculative distraction of maintainers, the core set of
        restartable sequences has finally reached a consensus.
      
        It comes with the basic non disputed core implementation along with
        support for arm, powerpc and x86 and a full set of selftests
      
        It was exposed to linux-next earlier this week, so it does not fully
        comply with the merge window requirements, but there is really no
        point to drag it out for yet another cycle"
      
      * 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        rseq/selftests: Provide Makefile, scripts, gitignore
        rseq/selftests: Provide parametrized tests
        rseq/selftests: Provide basic percpu ops test
        rseq/selftests: Provide basic test
        rseq/selftests: Provide rseq library
        selftests/lib.mk: Introduce OVERRIDE_TARGETS
        powerpc: Wire up restartable sequences system call
        powerpc: Add syscall detection for restartable sequences
        powerpc: Add support for restartable sequences
        x86: Wire up restartable sequence system call
        x86: Add support for restartable sequences
        arm: Wire up restartable sequences system call
        arm: Add syscall detection for restartable sequences
        arm: Add restartable sequences support
        rseq: Introduce restartable sequences system call
        uapi/headers: Provide types_32_64.h
      d82991a8
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f4e5b30d
      Linus Torvalds authored
      Pull x86 updates and fixes from Thomas Gleixner:
      
       - Fix the (late) fallout from the vector management rework causing
         hlist corruption and irq descriptor reference leaks caused by a
         missing sanity check.
      
         The straight forward fix triggered another long standing issue to
         surface. The pre rework code hid the issue due to being way slower,
         but now the chance that user space sees an EBUSY error return when
         updating irq affinities is way higher, though quite a bunch of
         userspace tools do not handle it properly despite the fact that EBUSY
         could be returned for at least 10 years.
      
         It turned out that the EBUSY return can be avoided completely by
         utilizing the existing delayed affinity update mechanism for irq
         remapped scenarios as well. That's a bit more error handling in the
         kernel, but avoids fruitless fingerpointing discussions with tool
         developers.
      
       - Decouple PHYSICAL_MASK from AMD SME as its going to be required for
         the upcoming Intel memory encryption support as well.
      
       - Handle legacy device ACPI detection properly for newer platforms
      
       - Fix the wrong argument ordering in the vector allocation tracepoint
      
       - Simplify the IDT setup code for the APIC=n case
      
       - Use the proper string helpers in the MTRR code
      
       - Remove a stale unused VDSO source file
      
       - Convert the microcode update lock to a raw spinlock as its used in
         atomic context.
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/intel_rdt: Enable CMT and MBM on new Skylake stepping
        x86/apic/vector: Print APIC control bits in debugfs
        genirq/affinity: Defer affinity setting if irq chip is busy
        x86/platform/uv: Use apic_ack_irq()
        x86/ioapic: Use apic_ack_irq()
        irq_remapping: Use apic_ack_irq()
        x86/apic: Provide apic_ack_irq()
        genirq/migration: Avoid out of line call if pending is not set
        genirq/generic_pending: Do not lose pending affinity update
        x86/apic/vector: Prevent hlist corruption and leaks
        x86/vector: Fix the args of vector_alloc tracepoint
        x86/idt: Simplify the idt_setup_apic_and_irq_gates()
        x86/platform/uv: Remove extra parentheses
        x86/mm: Decouple dynamic __PHYSICAL_MASK from AMD SME
        x86: Mark native_set_p4d() as __always_inline
        x86/microcode: Make the late update update_lock a raw lock for RT
        x86/mtrr: Convert to use strncpy_from_user() helper
        x86/mtrr: Convert to use match_string() helper
        x86/vdso: Remove unused file
        x86/i8237: Register device based on FADT legacy boot flag
      f4e5b30d
    • Linus Torvalds's avatar
      Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · a2211de0
      Linus Torvalds authored
      Pull x86 pti updates from Thomas Gleixner:
       "Three small commits updating the SSB mitigation to take the updated
        AMD mitigation variants into account"
      
      * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/bugs: Switch the selection of mitigation from CPU vendor to CPU features
        x86/bugs: Add AMD's SPEC_CTRL MSR usage
        x86/bugs: Add AMD's variant of SSB_NO
      a2211de0
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 2322d6c5
      Linus Torvalds authored
      Pull more perf tooling updates from Thomas Gleixner:
       "Perf tool updates and fixes:
      
        perf stat:
      
         - Display user and system time for workload targets (Jiri Olsa)
      
        perf record:
      
         - Enable arbitrary event names thru name= modifier (Alexey Budankov)
      
        PowerPC:
      
         - Add a python script for hypervisor call statistics (Ravi Bangoria)
      
        Intel PT: (Adrian Hunter)
      
         - Fix sync_switch INTEL_PT_SS_NOT_TRACING
      
         - Fix decoding to accept CBR between FUP and corresponding TIP
      
         - Fix MTC timing after overflow
      
         - Fix "Unexpected indirect branch" error
      
        perf test:
      
         - record+probe_libc_inet_pton:
            - To get the symbol table for dynamic shared objects on ubuntu we
              need to pass the -D/--dynamic command line option, unlike with
              the fedora distros (Arnaldo Carvalho de Melo)
      
         - code-reading:
            - Fix perf_env setup for PTI entry trampolines (Adrian Hunter)
      
         - kmod-path:
            - Add tests for vdso32 and vdsox32 (Adrian Hunter)
      
         - Use header file util/debug.h (Thomas Richter)
      
        perf annotate:
      
         - Make the various UI backends (stdio, TUI, gtk) use more
           consistently structs with annotation options as specified by the
           user (Arnaldo Carvalho de Melo)
      
         - Move annotation specific knobs from the symbol_conf global kitchen
           sink to the annotation option structs (Arnaldo Carvalho de Melo)
      
        perf script:
      
         - Add more PMU fields to python scripts event handler dict (Jin Yao)
      
        Core:
      
         - Fix misleading error for some unparsable events mentioning PMUs
           when those are not involved in the problem (Jiri Olsa)
      
         - Consider BSS symbols when processing /proc/kallsyms ('B' and 'b')
           (Arnaldo Carvalho de Melo)
      
         - Be more robust when trying to use per-symbol histograms, checking
           for unlikely but possible cases where the space for the histograms
           wasn't allocated, print a debug message for such cases (Arnaldo
           Carvalho de Melo)
      
         - Fix symbol and object code resolution for vdso32 and vdsox32
           (Adrian Hunter)
      
         - No need to check for null when passing pointers to foo__get() style
           refcount grabbing helpers, just like in the kernel and with free(),
           its safe to pass a NULL pointer to avoid having to check it before
           each and every foo__get() call (Arnaldo Carvalho de Melo)
      
         - Remove some dead code (quote.[ch]) (Arnaldo Carvalho de Melo)
      
         - Remove some needless globals, making them local (Arnaldo Carvalho
           de Melo)
      
         - Reduce usage of symbol_conf.use_callchain, using other means of
           finding out if callchains are in use or available for specific
           events, as we evolved this codebase to allow requesting callchains
           for just a subset of the monitored events. In time it will help
           polish recording and showing mixed sets accross the various tools:
      
              perf record -e cycles/call-graph=fp/,cache-misses/call-graph=dwarf/,instructions'
      
           (Arnaldo Carvalho de Melo)
      
         - Consider PTI entry trampolines in map__rip_2objdump() (Adrian
           Hunter)"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (50 commits)
        perf script python: Add dict fields introduction to Documentation
        perf script python: Add more PMU fields to event handler dict
        perf script python: Move dsoname code to a new function
        perf symbols: Add BSS symbols when reading from /proc/kallsyms
        perf annnotate: Make __symbol__inc_addr_samples handle src->histograms == NULL
        perf intel-pt: Fix "Unexpected indirect branch" error
        perf intel-pt: Fix MTC timing after overflow
        perf intel-pt: Fix decoding to accept CBR between FUP and corresponding TIP
        perf intel-pt: Fix sync_switch INTEL_PT_SS_NOT_TRACING
        perf script powerpc: Python script for hypervisor call statistics
        perf test record+probe_libc_inet_pton: Ask 'nm' for dynamic symbols
        perf map: Consider PTI entry trampolines in rip_2objdump()
        perf test code-reading: Fix perf_env setup for PTI entry trampolines
        perf tools: Fix pmu events parsing rule
        perf stat: Display user and system time
        perf record: Enable arbitrary event names thru name= modifier
        perf tools: Fix symbol and object code resolution for vdso32 and vdsox32
        perf tests kmod-path: Add tests for vdso32 and vdsox32
        perf hists: Check if a hist_entry has callchains before using them
        perf hists: Introduce hist_entry__has_callchain() method
        ...
      2322d6c5
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 9f3fbe85
      Linus Torvalds authored
      Pull irq fixes from Thomas Gleixner:
       "Two small fixlets:
      
         - Add the missing iomu mapping call in the Freescale/NXP/Qualcomm/
           whoever owns it now/ SCFG MSI irqchip driver. Otherwise IRQs wont
           work at all.
      
         - Fix a SMP=n build warning in the STM32 irq chip driver"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irqchip/ls-scfg-msi: Map MSIs in the iommu
        irqchip/stm32: Fix non-SMP build warning
      9f3fbe85
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · a8a4021b
      Linus Torvalds authored
      Pull core fixes from Thomas Gleixner:
       "A small set of core updates:
      
         - Make objtool cope with GCC8 oddities some more
      
         - Remove a stale local_irq_save/restore sequence in the signal code
           along with the stale comment in the RCU code. The underlying issue
           which led to this has been solved long time ago, but nobody cared
           to cleanup the hackarounds"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        signal: Remove no longer required irqsave/restore
        rcu: Update documentation of rcu_read_unlock()
        objtool: Fix GCC 8 cold subfunction detection for aliased functions
      a8a4021b
    • Anna-Maria Gleixner's avatar
      signal: Remove no longer required irqsave/restore · 59dc6f3c
      Anna-Maria Gleixner authored
      Commit a841796f ("signal: align __lock_task_sighand() irq disabling and
      RCU") introduced a rcu read side critical section with interrupts
      disabled. The changelog suggested that a better long-term fix would be "to
      make rt_mutex_unlock() disable irqs when acquiring the rt_mutex structure's
      ->wait_lock".
      
      This long-term fix has been made in commit b4abf910 ("rtmutex: Make
      wait_lock irq safe") for a different reason.
      
      Therefore revert commit a841796f ("signal: align >
      __lock_task_sighand() irq disabling and RCU") as the interrupt disable
      dance is not longer required.
      
      The change was tested on the base of b4abf910 ("rtmutex: Make wait_lock
      irq safe") with a four hour run of rcutorture scenario TREE03 with lockdep
      enabled as suggested by Paul McKenney.
      Signed-off-by: default avatarAnna-Maria Gleixner <anna-maria@linutronix.de>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Acked-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Acked-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Cc: bigeasy@linutronix.de
      Link: https://lkml.kernel.org/r/20180525090507.22248-3-anna-maria@linutronix.de
      59dc6f3c
    • Anna-Maria Gleixner's avatar
      rcu: Update documentation of rcu_read_unlock() · ec84b27f
      Anna-Maria Gleixner authored
      Since commit b4abf910 ("rtmutex: Make wait_lock irq safe") the
      explanation in rcu_read_unlock() documentation about irq unsafe rtmutex
      wait_lock is no longer valid.
      
      Remove it to prevent kernel developers reading the documentation to rely on
      it.
      Suggested-by: default avatarEric W. Biederman <ebiederm@xmission.com>
      Signed-off-by: default avatarAnna-Maria Gleixner <anna-maria@linutronix.de>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Acked-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Cc: bigeasy@linutronix.de
      Link: https://lkml.kernel.org/r/20180525090507.22248-2-anna-maria@linutronix.de
      ec84b27f
  3. 09 Jun, 2018 12 commits
    • Linus Torvalds's avatar
      Merge branch 'proc-cmdline' · 3ca24ce9
      Linus Torvalds authored
      Merge proc_cmdline simplifications.
      
      This re-writes the get_mm_cmdline() logic to be rather simpler than it
      used to be, and makes the semantics for "cmdline goes past the end of
      the original area" more natural.
      
      You _can_ use prctl(PR_SET_MM) to just point your command line somewhere
      else entirely, but the traditional model is to just edit things in place
      and that still needs to continue to work.  At least this way the code
      makes some sense.
      
      * proc-cmdline:
        fs/proc: simplify and clarify get_mm_cmdline() function
        fs/proc: re-factor proc_pid_cmdline_read() a bit
      3ca24ce9
    • Mikulas Patocka's avatar
      hpfs: Use EUCLEAN for filesystem errors · f72328d2
      Mikulas Patocka authored
      Use the error code EUCLEAN for filesystem errors because other
      filesystems use this code too.
      
      [ And remove unused EMEMERROR  - Linus ]
      Signed-off-by: default avatarMikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f72328d2
    • Linus Torvalds's avatar
      Merge tag 'for-v4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply · a16afaf7
      Linus Torvalds authored
      Pull power supply and reset updates from Sebastian Reichel:
       - bq27xxx: Add BQ27426 support
       - ab8500: Drop AB8540/9540 support
       - Introduced new usb_type property
       - Properly document the power-supply ABI
       - misc. cleanups and fixes
      
      * tag 'for-v4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply:
        MAINTAINERS: add entry for LEGO MINDSTORMS EV3
        power: supply: ab8500_charger: fix spelling mistake: "faile" -> "failed"
        power: supply: axp288_fuel_gauge: Remove polling from the driver
        power: supply: axp288_fuelguage: Do not bind when the fg function is not used
        power: supply: axp288_charger: Do not bind when the charge function is not used
        power: supply: axp288_charger: Support 3500 and 4000 mA input current limit
        power: supply: s3c-adc-battery: fix driver data initialization
        power: supply: charger-manager: Verify polling interval only when polling requested
        power: supply: sysfs: Use enum to specify property
        power: supply: ab8500: Drop AB8540/9540 support
        power: supply: ab8500_fg: fix spelling mistake: "Disharge" -> "Discharge"
        power: supply: simplify getting .drvdata
        power: supply: bq27xxx: Add support for BQ27426
        gpio-poweroff: Use gpiod_set_value_cansleep
      a16afaf7
    • Linus Torvalds's avatar
      Merge tag 'hsi-for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi · 2a70ea5c
      Linus Torvalds authored
      Pull HSI update from Sebastian Reichel:
       "Just one patch for the HSI subsystem this time: use the new vm_fault_t
        return type"
      
      * tag 'hsi-for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi:
        hsi: clients: Change return type to vm_fault_t
      2a70ea5c
    • Linus Torvalds's avatar
      Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · 6419945e
      Linus Torvalds authored
      Pull clk updates from Stephen Boyd:
       "This time we have a good set of changes to the core framework that do
        some general cleanups, but nothing too major. The majority of the diff
        goes to two SoCs, Actions Semi and Qualcomm. A brand new driver is
        introduced for Actions Semi so it takes up some lines to add all the
        different types, and the Qualcomm diff is there because we add support
        for two SoCs and it's quite a bit of data.
      
        Otherwise the big driver updates are on TI Davinci and Amlogic
        platforms. And then the long tail of driver updates for various fixes
        and stuff follows after that.
      
        Core:
         - debugfs cleanups removing error checking and an unused provider API
         - Removal of a clk init typedef that isn't used
         - Usage of match_string() to simplify parent string name matching
         - OF clk helpers moved to their own file (linux/of_clk.h)
         - Make clk warnings more readable across kernel versions
      
        New Drivers:
         - Qualcomm SDM845 GCC and Video clk controllers
         - Qualcomm MSM8998 GCC
         - Actions Semi S900 SoC support
         - Nuvoton npcm750 microcontroller clks
         - Amlogic axg AO clock controller
      
        Removed Drivers:
         - Deprecated Rockchip clk-gate driver
      
        Updates:
         - debugfs functions stopped checking return values
         - Support for the MSIOF module clocks on Rensas R-Car M3-N
         - Support for the new Rensas RZ/G1C and R-Car E3 SoCs
         - Qualcomm GDSC, RCG, and PLL updates for clk changes in new SoCs
         - Berlin and Amlogic SPDX tagging
         - Usage of of_clk_get_parent_count() in more places
         - Proper implementation of the CDEV1/2 clocks on Tegra20
         - Allwinner H6 PRCM clock support and R40 EMAC support
         - Add critical flag to meson8b's fdiv2 as temporary fixup for ethernet
         - Round closest support for meson's mpll driver
         - Support for meson8b nand clocks and gxbb video decoder clocks
         - Mediatek mali clks
         - STM32MP1 fixes
         - Uniphier LD11/LD20 stream demux system clock"
      
      * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (134 commits)
        clk: qcom: Export clk_fabia_pll_configure()
        clk: bcm: Update and add Stingray clock entries
        dt-bindings: clk: Update Stingray binding doc
        clk-si544: Properly round requested frequency to nearest match
        clk: ingenic: jz4770: Add 150us delay after enabling VPU clock
        clk: ingenic: jz4770: Enable power of AHB1 bus after ungating VPU clock
        clk: ingenic: jz4770: Modify C1CLK clock to disable CPU clock stop on idle
        clk: ingenic: jz4770: Change OTG from custom to standard gated clock
        clk: ingenic: Support specifying "wait for clock stable" delay
        clk: ingenic: Add support for clocks whose gate bit is inverted
        clk: use match_string() helper
        clk: bcm2835: use match_string() helper
        clk: Return void from debug_init op
        clk: remove clk_debugfs_add_file()
        clk: tegra: no need to check return value of debugfs_create functions
        clk: davinci: no need to check return value of debugfs_create functions
        clk: bcm2835: no need to check return value of debugfs_create functions
        clk: no need to check return value of debugfs_create functions
        clk: imx6: add EPIT clock support
        clk: mvebu: use correct bit for 98DX3236 NAND
        ...
      6419945e
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md · d60dafdc
      Linus Torvalds authored
      Pull MD updates from Shaohua Li:
       "A few fixes of MD for this merge window. Mostly bug fixes:
      
         - raid5 stripe batch fix from Amy
      
         - Read error handling for raid1 FailFast device from Gioh
      
         - raid10 recovery NULL pointer dereference fix from Guoqing
      
         - Support write hint for raid5 stripe cache from Mariusz
      
         - Fixes for device hot add/remove from Neil and Yufen
      
         - Improve flush bio scalability from Xiao"
      
      * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
        MD: fix lock contention for flush bios
        md/raid5: Assigning NULL to sh->batch_head before testing bit R5_Overlap of a stripe
        md/raid1: add error handling of read error from FailFast device
        md: fix NULL dereference of mddev->pers in remove_and_add_spares()
        raid5: copy write hint from origin bio to stripe
        md: fix two problems with setting the "re-add" device state.
        raid10: check bio in r10buf_pool_free to void NULL pointer dereference
        md: fix an error code format and remove unsed bio_sector
      d60dafdc
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 1329c204
      Linus Torvalds authored
      Pull sparc updates from David Miller:
      
       - a FPE signal fix that was also merged upstream
      
       - privileged ADI driver from Tom Hromatka
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc: fix compat siginfo ABI regression
        selftests: sparc64: char: Selftest for privileged ADI driver
        char: sparc64: Add privileged ADI driver
      1329c204
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide · d6c75284
      Linus Torvalds authored
      Pull IDE updates from David Miller:
       "Primarily IRQ disabling avoidance changes from Sebastian Andrzej
        Siewior"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide:
        ide: don't enable/disable interrupts in force threaded-IRQ mode
        ide: don't disable interrupts during kmap_atomic()
        ide: Handle irq disabling consistently
        alim15x3: move irq-restore before pci_dev_put()
      d6c75284
    • Linus Torvalds's avatar
      Merge tag 'staging-4.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · eafdca4d
      Linus Torvalds authored
      Pull staging/IIO updates from Greg KH:
       "Here is the big staging and IIO driver update for 4.18-rc1.
      
        It was delayed as I wanted to make sure the final driver deletions did
        not cause any major merge issues, and all now looks good.
      
        There are a lot of patches here, just over 1000. The diffstat summary
        shows the major changes here:
      
      	1007 files changed, 16828 insertions(+), 227770 deletions(-)
      
        Because of this, we might be close to shrinking the overall kernel
        source code size for two releases in a row.
      
        There was loads of work in this release cycle, primarily:
      
         - tons of ks7010 driver cleanups
      
         - lots of mt7621 driver fixes and cleanups
      
         - most driver cleanups
      
         - wilc1000 fixes and cleanups
      
         - lots and lots of IIO driver cleanups and new additions
      
         - debugfs cleanups for all staging drivers
      
         - lots of other staging driver cleanups and fixes, the shortlog has
           the full details.
      
        but the big user-visable things here are the removal of 3 chunks of
        code:
      
         - ncpfs and ipx were removed on schedule, no one has cared about this
           code since it moved to staging last year, and if it needs to come
           back, it can be reverted.
      
         - lustre file system is removed.
      
           I've ranted at the lustre developers about once a year for the past
           5 years, with no real forward progress at all to clean things up
           and get the code into the "real" part of the kernel.
      
           Given that the lustre developers continue to work on an external
           tree and try to port those changes to the in-kernel tree every once
           in a while, this whole thing really really is not working out at
           all. So I'm deleting it so that the developers can spend the time
           working in their out-of-tree location and get things cleaned up
           properly to get merged into the tree correctly at a later date.
      
        Because of these file removals, you will have merge issues on some of
        these files (2 in the ipx code, 1 in the ncpfs code, and 1 in the
        atomisp driver). Just delete those files, it's a simple merge :)
      
        All of this has been in linux-next for a while with no reported
        problems"
      
      * tag 'staging-4.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (1011 commits)
        staging: ipx: delete it from the tree
        ncpfs: remove uapi .h files
        ncpfs: remove Documentation
        ncpfs: remove compat functionality
        staging: ncpfs: delete it
        staging: lustre: delete the filesystem from the tree.
        staging: vc04_services: no need to save the log debufs dentries
        staging: vc04_services: vchiq_debugfs_log_entry can be a void *
        staging: vc04_services: remove struct vchiq_debugfs_info
        staging: vc04_services: move client dbg directory into static variable
        staging: vc04_services: remove odd vchiq_debugfs_top() wrapper
        staging: vc04_services: no need to check debugfs return values
        staging: mt7621-gpio: reorder includes alphabetically
        staging: mt7621-gpio: change gc_map to don't use pointers
        staging: mt7621-gpio: use GPIOF_DIR_OUT and GPIOF_DIR_IN macros instead of custom values
        staging: mt7621-gpio: change 'to_mediatek_gpio' to make just a one line return
        staging: mt7621-gpio: dt-bindings: update documentation for #interrupt-cells property
        staging: mt7621-gpio: update #interrupt-cells for the gpio node
        staging: mt7621-gpio: dt-bindings: complete documentation for the gpio
        staging: mt7621-dts: add missing properties to gpio node
        ...
      eafdca4d
    • Tony Luck's avatar
      x86/intel_rdt: Enable CMT and MBM on new Skylake stepping · 1d9f3e20
      Tony Luck authored
      New stepping of Skylake has fixes for cache occupancy and memory
      bandwidth monitoring.
      
      Update the code to enable these by default on newer steppings.
      Signed-off-by: default avatarTony Luck <tony.luck@intel.com>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: Fenghua Yu <fenghua.yu@intel.com>
      Cc: stable@vger.kernel.org # v4.14
      Cc: Vikas Shivappa <vikas.shivappa@linux.intel.com>
      Link: https://lkml.kernel.org/r/20180608160732.9842-1-tony.luck@intel.com
      1d9f3e20
    • Jens Axboe's avatar
      block: fix use-after-free in block flush handling · 190b02ed
      Jens Axboe authored
      A recent commit reused the original request flags for the flush
      queue handling. However, for some of the kick flush cases, the
      original request was already completed. This caused a use after
      free, if blk-mq wasn't used.
      
      Fixes: 84fca1b0 ("block: pass failfast and driver-specific flags to flush requests")
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      190b02ed
    • Linus Torvalds's avatar
      Merge tag 'libnvdimm-for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · 7d3bf613
      Linus Torvalds authored
      Pull libnvdimm updates from Dan Williams:
       "This adds a user for the new 'bytes-remaining' updates to
        memcpy_mcsafe() that you already received through Ingo via the
        x86-dax- for-linus pull.
      
        Not included here, but still targeting this cycle, is support for
        handling memory media errors (poison) consumed via userspace dax
        mappings.
      
        Summary:
      
         - DAX broke a fundamental assumption of truncate of file mapped
           pages. The truncate path assumed that it is safe to disconnect a
           pinned page from a file and let the filesystem reclaim the physical
           block. With DAX the page is equivalent to the filesystem block.
           Introduce dax_layout_busy_page() to enable filesystems to wait for
           pinned DAX pages to be released. Without this wait a filesystem
           could allocate blocks under active device-DMA to a new file.
      
         - DAX arranges for the block layer to be bypassed and uses
           dax_direct_access() + copy_to_iter() to satisfy read(2) calls.
           However, the memcpy_mcsafe() facility is available through the pmem
           block driver. In order to safely handle media errors, via the DAX
           block-layer bypass, introduce copy_to_iter_mcsafe().
      
         - Fix cache management policy relative to the ACPI NFIT Platform
           Capabilities Structure to properly elide cache flushes when they
           are not necessary. The table indicates whether CPU caches are
           power-fail protected. Clarify that a deep flush is always performed
           on REQ_{FUA,PREFLUSH} requests"
      
      * tag 'libnvdimm-for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: (21 commits)
        dax: Use dax_write_cache* helpers
        libnvdimm, pmem: Do not flush power-fail protected CPU caches
        libnvdimm, pmem: Unconditionally deep flush on *sync
        libnvdimm, pmem: Complete REQ_FLUSH => REQ_PREFLUSH
        acpi, nfit: Remove ecc_unit_size
        dax: dax_insert_mapping_entry always succeeds
        libnvdimm, e820: Register all pmem resources
        libnvdimm: Debug probe times
        linvdimm, pmem: Preserve read-only setting for pmem devices
        x86, nfit_test: Add unit test for memcpy_mcsafe()
        pmem: Switch to copy_to_iter_mcsafe()
        dax: Report bytes remaining in dax_iomap_actor()
        dax: Introduce a ->copy_to_iter dax operation
        uio, lib: Fix CONFIG_ARCH_HAS_UACCESS_MCSAFE compilation
        xfs, dax: introduce xfs_break_dax_layouts()
        xfs: prepare xfs_break_layouts() for another layout type
        xfs: prepare xfs_break_layouts() to be called with XFS_MMAPLOCK_EXCL
        mm, fs, dax: handle layout changes to pinned dax mappings
        mm: fix __gup_device_huge vs unmap
        mm: introduce MEMORY_DEVICE_FS_DAX and CONFIG_DEV_PAGEMAP_OPS
        ...
      7d3bf613
  4. 08 Jun, 2018 11 commits
    • Petr Machata's avatar
      net: bridge: Fix locking in br_fdb_find_port() · 873aca2e
      Petr Machata authored
      Callers of br_fdb_find() need to hold the hash lock, which
      br_fdb_find_port() doesn't do. However, since br_fdb_find_port() is not
      doing any actual FDB manipulation, the hash lock is not really needed at
      all. So convert to br_fdb_find_rcu(), surrounded by rcu_read_lock() /
      _unlock() pair.
      
      The device pointer copied from inside the FDB entry is then kept alive
      by the RTNL lock, which br_fdb_find_port() asserts.
      
      Fixes: 4d4fd361 ("net: bridge: Publish bridge accessor functions")
      Signed-off-by: default avatarPetr Machata <petrm@mellanox.com>
      Acked-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      873aca2e
    • Paolo Abeni's avatar
      udp: fix rx queue len reported by diag and proc interface · 6c206b20
      Paolo Abeni authored
      After commit 6b229cf7 ("udp: add batching to udp_rmem_release()")
      the sk_rmem_alloc field does not measure exactly anymore the
      receive queue length, because we batch the rmem release. The issue
      is really apparent only after commit 0d4a6608 ("udp: do rmem bulk
      free even if the rx sk queue is empty"): the user space can easily
      check for an empty socket with not-0 queue length reported by the 'ss'
      tool or the procfs interface.
      
      We need to use a custom UDP helper to report the correct queue length,
      taking into account the forward allocation deficit.
      
      Reported-by: trevor.francis@46labs.com
      Fixes: 6b229cf7 ("UDP: add batching to udp_rmem_release()")
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6c206b20
    • Bjørn Mork's avatar
      cdc_ncm: avoid padding beyond end of skb · 49c2c3f2
      Bjørn Mork authored
      Commit 4a0e3e98 ("cdc_ncm: Add support for moving NDP to end
      of NCM frame") added logic to reserve space for the NDP at the
      end of the NTB/skb.  This reservation did not take the final
      alignment of the NDP into account, causing us to reserve too
      little space. Additionally the padding prior to NDP addition did
      not ensure there was enough space for the NDP.
      
      The NTB/skb with the NDP appended would then exceed the configured
      max size. This caused the final padding of the NTB to use a
      negative count, padding to almost INT_MAX, and resulting in:
      
      [60103.825970] BUG: unable to handle kernel paging request at ffff9641f2004000
      [60103.825998] IP: __memset+0x24/0x30
      [60103.826001] PGD a6a06067 P4D a6a06067 PUD 4f65a063 PMD 72003063 PTE 0
      [60103.826013] Oops: 0002 [#1] SMP NOPTI
      [60103.826018] Modules linked in: (removed(
      [60103.826158] CPU: 0 PID: 5990 Comm: Chrome_DevTools Tainted: G           O 4.14.0-3-amd64 #1 Debian 4.14.17-1
      [60103.826162] Hardware name: LENOVO 20081 BIOS 41CN28WW(V2.04) 05/03/2012
      [60103.826166] task: ffff964193484fc0 task.stack: ffffb2890137c000
      [60103.826171] RIP: 0010:__memset+0x24/0x30
      [60103.826174] RSP: 0000:ffff964316c03b68 EFLAGS: 00010216
      [60103.826178] RAX: 0000000000000000 RBX: 00000000fffffffd RCX: 000000001ffa5000
      [60103.826181] RDX: 0000000000000005 RSI: 0000000000000000 RDI: ffff9641f2003ffc
      [60103.826184] RBP: ffff964192f6c800 R08: 00000000304d434e R09: ffff9641f1d2c004
      [60103.826187] R10: 0000000000000002 R11: 00000000000005ae R12: ffff9642e6957a80
      [60103.826190] R13: ffff964282ff2ee8 R14: 000000000000000d R15: ffff9642e4843900
      [60103.826194] FS:  00007f395aaf6700(0000) GS:ffff964316c00000(0000) knlGS:0000000000000000
      [60103.826197] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [60103.826200] CR2: ffff9641f2004000 CR3: 0000000013b0c000 CR4: 00000000000006f0
      [60103.826204] Call Trace:
      [60103.826212]  <IRQ>
      [60103.826225]  cdc_ncm_fill_tx_frame+0x5e3/0x740 [cdc_ncm]
      [60103.826236]  cdc_ncm_tx_fixup+0x57/0x70 [cdc_ncm]
      [60103.826246]  usbnet_start_xmit+0x5d/0x710 [usbnet]
      [60103.826254]  ? netif_skb_features+0x119/0x250
      [60103.826259]  dev_hard_start_xmit+0xa1/0x200
      [60103.826267]  sch_direct_xmit+0xf2/0x1b0
      [60103.826273]  __dev_queue_xmit+0x5e3/0x7c0
      [60103.826280]  ? ip_finish_output2+0x263/0x3c0
      [60103.826284]  ip_finish_output2+0x263/0x3c0
      [60103.826289]  ? ip_output+0x6c/0xe0
      [60103.826293]  ip_output+0x6c/0xe0
      [60103.826298]  ? ip_forward_options+0x1a0/0x1a0
      [60103.826303]  tcp_transmit_skb+0x516/0x9b0
      [60103.826309]  tcp_write_xmit+0x1aa/0xee0
      [60103.826313]  ? sch_direct_xmit+0x71/0x1b0
      [60103.826318]  tcp_tasklet_func+0x177/0x180
      [60103.826325]  tasklet_action+0x5f/0x110
      [60103.826332]  __do_softirq+0xde/0x2b3
      [60103.826337]  irq_exit+0xae/0xb0
      [60103.826342]  do_IRQ+0x81/0xd0
      [60103.826347]  common_interrupt+0x98/0x98
      [60103.826351]  </IRQ>
      [60103.826355] RIP: 0033:0x7f397bdf2282
      [60103.826358] RSP: 002b:00007f395aaf57d8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff6e
      [60103.826362] RAX: 0000000000000000 RBX: 00002f07bc6d0900 RCX: 00007f39752d7fe7
      [60103.826365] RDX: 0000000000000022 RSI: 0000000000000147 RDI: 00002f07baea02c0
      [60103.826368] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
      [60103.826371] R10: 00000000ffffffff R11: 0000000000000000 R12: 00002f07baea02c0
      [60103.826373] R13: 00002f07bba227a0 R14: 00002f07bc6d090c R15: 0000000000000000
      [60103.826377] Code: 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83
      e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 <f3> 48
      ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1
      [60103.826442] RIP: __memset+0x24/0x30 RSP: ffff964316c03b68
      [60103.826444] CR2: ffff9641f2004000
      
      Commit e1069bbf ("net: cdc_ncm: Reduce memory use when kernel
      memory low") made this bug much more likely to trigger by reducing
      the NTB size under memory pressure.
      
      Link: https://bugs.debian.org/893393Reported-by: default avatarГорбешко Богдан <bodqhrohro@gmail.com>
      Reported-and-tested-by: default avatarDennis Wassenberg <dennis.wassenberg@secunet.com>
      Cc: Enrico Mioso <mrkiko.rs@gmail.com>
      Fixes: 4a0e3e98 ("cdc_ncm: Add support for moving NDP to end of NCM frame")
      Signed-off-by: default avatarBjørn Mork <bjorn@mork.no>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      49c2c3f2
    • Davide Caratti's avatar
      net/sched: act_simple: fix parsing of TCA_DEF_DATA · 8d499533
      Davide Caratti authored
      use nla_strlcpy() to avoid copying data beyond the length of TCA_DEF_DATA
      netlink attribute, in case it is less than SIMP_MAX_DATA and it does not
      end with '\0' character.
      
      v2: fix errors in the commit message, thanks Hangbin Liu
      
      Fixes: fa1b1cff ("net_cls_act: Make act_simple use of netlink policy.")
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Reviewed-by: default avatarSimon Horman <simon.horman@netronome.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8d499533
    • YueHaibing's avatar
      net: fddi: fix a possible null-ptr-deref · 6310a882
      YueHaibing authored
      bp->SharedMemAddr is set to NULL while bp->SharedMemSize lesser-or-equal 0,
      then memset will trigger null-ptr-deref.
      
      fix it by replacing pci_alloc_consistent with dma_zalloc_coherent.
      Signed-off-by: default avatarYueHaibing <yuehaibing@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6310a882
    • Colin Ian King's avatar
      net: aquantia: fix unsigned numvecs comparison with less than zero · 58d813af
      Colin Ian King authored
      From: Colin Ian King <colin.king@canonical.com>
      
      This was originally mistakenly submitted to net-next. Resubmitting to net.
      
      The comparison of numvecs < 0 is always false because numvecs is a u32
      and hence the error return from a failed call to pci_alloc_irq_vectores
      is never detected.  Fix this by using the signed int ret to handle the
      error return and assign numvecs to err.
      
      Detected by CoverityScan, CID#1468650 ("Unsigned compared against 0")
      
      Fixes: a09bd81b ("net: aquantia: Limit number of vectors to actually allocated irqs")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      58d813af
    • Dan Williams's avatar
      930218af
    • Dan Williams's avatar
      b5684579
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20180608' of git://git.kernel.dk/linux-block · a3818841
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A few fixes for this merge window, where some of them should go in
        sooner rather than later, hence a new pull this week. This pull
        request contains:
      
         - Set of NVMe fixes, mostly follow up cleanups/fixes to the queue
           changes, but also teardown/removal and misc changes (Christop/Dan/
           Johannes/Sagi/Steve).
      
         - Two lightnvm fixes for issues that showed up in this window
           (Colin/Wei).
      
         - Failfast/driver flags inheritance for flush requests (Hannes).
      
         - The md device put sanitization and fix (Kent).
      
         - dm bio_set inheritance fix (me).
      
         - nbd discard granularity fix (Josef).
      
         - nbd consistency in command printing (Kevin).
      
         - Loop recursion validation fix (Ted).
      
         - Partition overlap check (Wang)"
      
      [ .. and now my build is warning-free again thanks to the md fix  - Linus ]
      
      * tag 'for-linus-20180608' of git://git.kernel.dk/linux-block: (22 commits)
        nvme: cleanup double shift issue
        nvme-pci: make CMB SQ mod-param read-only
        nvme-pci: unquiesce dead controller queues
        nvme-pci: remove HMB teardown on reset
        nvme-pci: queue creation fixes
        nvme-pci: remove unnecessary completion doorbell check
        nvme-pci: remove unnecessary nested locking
        nvmet: filter newlines from user input
        nvme-rdma: correctly check for target keyed sgl support
        nvme: don't hold nvmf_transports_rwsem for more than transport lookups
        nvmet: return all zeroed buffer when we can't find an active namespace
        md: Unify mddev destruction paths
        dm: use bioset_init_from_src() to copy bio_set
        block: add bioset_init_from_src() helper
        block: always set partition number to '0' in blk_partition_remap()
        block: pass failfast and driver-specific flags to flush requests
        nbd: set discard_alignment to the granularity
        nbd: Consistently use request pointer in debug messages.
        block: add verifier for cmdline partition
        lightnvm: pblk: fix resource leak of invalid_bitmap
        ...
      a3818841
    • Linus Torvalds's avatar
      Merge tag 'regulator-v4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator · 68cc38ff
      Linus Torvalds authored
      Pull regulator updates from Mark Brown:
       "Quite a lot of core work this time around, though not 100% successful.
      
        We gained support for runtime mode changes thanks to David Collins and
        improved support for write only regulators (ones where we can't read
        back the configuration) from Douglas Anderson.
      
        There's been quite a bit of work from Linus Walleij on converting from
        specfying GPIOs by numbers to descriptors. Sadly the testing turned
        out to be less good than we had hoped and so a lot of this had to be
        reverted.
      
        We also have the start of updates to use coupled regulators from
        Maciej Purski, unfortunately there are further problems there so the
        last couple of patches have been reverted.
      
        We also have new drivers for BD71837 and SY8106A devices, SAW
        regulators on Qualcomm SPMI and dropped support for some preproduction
        chips that never made it to market from the AB8500 driver"
      
      * tag 'regulator-v4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (57 commits)
        regulator: gpio: Revert
        ARM: pxa, regulator: fix building ezx e680
        regulator: Revert coupled regulator support again
        regulator: wm8994: Fix shared GPIOs
        regulator: max77686: Fix shared GPIOs
        regulator: bd71837: BD71837 PMIC regulator driver
        regulator: bd71837: Devicetree bindings for BD71837 regulators
        regulator: gpio: Get enable GPIO using GPIO descriptor
        regulator: fixed: Convert to use GPIO descriptor only
        regulator: s2mps11: Fix boot on Odroid XU3
        dt-bindings: qcom_spmi: Document SAW support
        regulator: qcom_spmi: Add support for SAW
        regulator: tps65090: Pass descriptor instead of GPIO number
        regulator: s5m8767: Pass descriptor instead of GPIO number
        regulator: pfuze100: Delete reference to ena_gpio
        regulator: max8952: Pass descriptor instead of GPIO number
        regulator: lp8788-ldo: Pass descriptor instead of GPIO number
        regulator: lm363x: Pass descriptor instead of GPIO number
        regulator: max8973: Pass descriptor instead of GPIO number
        regulator: mc13xxx-core: Switch to SPDX identifier
        ...
      68cc38ff
    • Dan Carpenter's avatar
      nvme: cleanup double shift issue · 77016199
      Dan Carpenter authored
      The problem here is that set_bit() and test_bit() take a bit number so
      we should be passing 0 but instead we're passing (1 << 0) which leads to
      a double shift.  It doesn't cause a runtime bug in the current code
      because it's done consistently and we only set that one bit.
      
      I decided to just re-use NVME_AER_NOTICE_NS_CHANGED instead of
      introducing a new define for this.
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      77016199