Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1657896 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-06-05 19:00 +0200 |
| Last post | 2017-06-06 09:30 +0200 |
| Articles | 20 on this page of 24 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH 4.11 000/115] 4.11.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 033/115] virtio-net: enable TSO/checksum offloads for Q-in-Q vlans Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 011/115] tcp: avoid fragmenting peculiar skbs in SACK Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 003/115] ipv6/dccp: do not inherit ipv6_mc_list from parent Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 009/115] netem: fix skb_orphan_partial() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 023/115] ipv6: Check ip6_find_1stfragopt() return value properly. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 001/115] dccp/tcp: do not inherit mc_list from parent Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 018/115] tcp: eliminate negative reordering in tcp_clean_rtx_queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 024/115] bridge: netlink: check vlan_default_pvid range Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 027/115] ipv6: fix out of bound writes in __ip6_append_data() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 017/115] net/mlx5e: Fix ethtool pause support and advertise reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 029/115] net/mlx5: Avoid using pending command interface slots Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 021/115] net: Improve handling of failures on link and route dumps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 008/115] bpf, arm64: fix faulty emission of map access in tail calls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 012/115] tipc: make macro tipc_wait_for_cond() smp safe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 043/115] sparc: Fix -Wstringop-overflow warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 005/115] s390/qeth: unbreak OSM and OSN support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 007/115] s390/qeth: add missing hash table initializations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 004/115] s390/qeth: handle sysfs error during initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
[PATCH 4.11 020/115] net/smc: Add warning about remote memory exposure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:00 +0200
Re: [PATCH 4.11 000/115] 4.11.4-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-06-05 22:40 +0200
Re: [PATCH 4.11 000/115] 4.11.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-06 09:30 +0200
Re: [PATCH 4.11 000/115] 4.11.4-stable review Guenter Roeck <linux@roeck-us.net> - 2017-06-06 00:30 +0200
Re: [PATCH 4.11 000/115] 4.11.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-06 09:30 +0200
Page 1 of 2 [1] 2 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 000/115] 4.11.4-stable review |
| Message-ID | <tP33b-5dS-7@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.11.4 release.
There are 115 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Jun 7 15:30:31 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.11.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.11.4-rc1
Jan Kara <jack@suse.cz>
xfs: Fix off-by-in in loop termination in xfs_find_get_desired_pgoff()
Eric Sandeen <sandeen@sandeen.net>
xfs: fix unaligned access in xfs_btree_visit_blocks
Darrick J. Wong <darrick.wong@oracle.com>
xfs: avoid mount-time deadlock in CoW extent recovery
Christoph Hellwig <hch@lst.de>
xfs: xfs_trans_alloc_empty
Zorro Lang <zlang@redhat.com>
xfs: bad assertion for delalloc an extent that start at i_size
Darrick J. Wong <darrick.wong@oracle.com>
xfs: BMAPX shouldn't barf on inline-format directories
Brian Foster <bfoster@redhat.com>
xfs: fix indlen accounting error on partial delalloc conversion
Eryu Guan <eguan@redhat.com>
xfs: fix use-after-free in xfs_finish_page_writeback
Darrick J. Wong <darrick.wong@oracle.com>
xfs: reserve enough blocks to handle btree splits when remapping
Brian Foster <bfoster@redhat.com>
xfs: wait on new inodes during quotaoff dquot release
Brian Foster <bfoster@redhat.com>
xfs: update ag iterator to support wait on new inodes
Brian Foster <bfoster@redhat.com>
xfs: support ability to wait on new inodes
Brian Foster <bfoster@redhat.com>
xfs: fix up quotacheck buffer list error handling
Brian Foster <bfoster@redhat.com>
xfs: prevent multi-fsb dir readahead from reading random blocks
Eric Sandeen <sandeen@redhat.com>
xfs: handle array index overrun in xfs_dir2_leaf_readbuf()
Christoph Hellwig <hch@lst.de>
xfs: fix integer truncation in xfs_bmap_remap_alloc
Brian Foster <bfoster@redhat.com>
xfs: drop iolock from reclaim context to appease lockdep
Darrick J. Wong <darrick.wong@oracle.com>
xfs: actually report xattr extents via iomap
Darrick J. Wong <darrick.wong@oracle.com>
xfs: fix over-copying of getbmap parameters from userspace
Brian Foster <bfoster@redhat.com>
xfs: use dedicated log worker wq to avoid deadlock with cil wq
Eryu Guan <eguan@redhat.com>
xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff()
Brian Foster <bfoster@redhat.com>
xfs: use ->b_state to fix buffer I/O accounting release race
Jan Kara <jack@suse.cz>
xfs: Fix missed holes in SEEK_HOLE implementation
Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
drm/gma500/psb: Actually use VBT mode when it is found
Thomas Gleixner <tglx@linutronix.de>
slub/memcg: cure the brainless abuse of sysfs attributes
Andrea Arcangeli <aarcange@redhat.com>
ksm: prevent crash after write_protect_page fails
Rob Landley <rob@landley.net>
x86/boot: Use CROSS_COMPILE prefix for readelf
Imre Deak <imre.deak@intel.com>
PCI/PM: Add needs_resume flag to avoid suspend complete optimization
Mike Marciniszyn <mike.marciniszyn@intel.com>
RDMA/qib,hfi1: Fix MR reference count leak on write with immediate
Israel Rukshin <israelr@mellanox.com>
RDMA/srp: Fix NULL deref at srp_destroy_qp()
Michal Hocko <mhocko@suse.com>
mm: consider memblock reservations for deferred memory initialization sizing
James Morse <james.morse@arm.com>
mm/hugetlb: report -EHWPOISON not -EFAULT when FOLL_HWPOISON is specified
Yisheng Xie <xieyisheng1@huawei.com>
mlock: fix mlock count can not decrease in race condition
Punit Agrawal <punit.agrawal@arm.com>
mm/migrate: fix refcount handling when !hugepage_migration_supported()
Ross Zwisler <ross.zwisler@linux.intel.com>
dax: fix race between colliding PMD & PTE entries
Ross Zwisler <ross.zwisler@linux.intel.com>
mm: avoid spurious 'bad pmd' warning messages
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
mm/page_alloc.c: make sure OOM victim can try allocations with no watermarks once
Takashi Iwai <tiwai@suse.de>
ALSA: usb: Fix a typo in Tascam US-16x08 mixer element
Takashi Iwai <tiwai@suse.de>
Revert "ALSA: usb-audio: purge needless variable length array"
Alexander Tsoy <alexander@tsoy.me>
ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430
Takashi Iwai <tiwai@suse.de>
ALSA: hda - No loopback on ALC299 codec
Nicolas Iooss <nicolas.iooss_linux@m4x.org>
pcmcia: remove left-over %Z format
Lyude <lyude@redhat.com>
drm/radeon: Unbreak HPD handling for r600+
Alex Deucher <alexander.deucher@amd.com>
drm/radeon/ci: disable mclk switching for high refresh rates (v2)
Alex Deucher <alexander.deucher@amd.com>
drm/amd/powerplay/smu7: disable mclk switching for high refresh rates
Alex Deucher <alexander.deucher@amd.com>
drm/amd/powerplay/smu7: add vblank check for mclk switching (v2)
Ming Lei <ming.lei@redhat.com>
nvme: avoid to use blk_mq_abort_requeue_list()
Ming Lei <ming.lei@redhat.com>
nvme: use blk_mq_start_hw_queues() in nvme_kill_queues()
Marta Rybczynska <mrybczyn@kalray.eu>
nvme-rdma: support devices with queue size < 32
Jason Gerecke <killertofu@gmail.com>
HID: wacom: Have wacom_tpc_irq guard against possible NULL dereference
Bryant G. Ly <bryantly@linux.vnet.ibm.com>
ibmvscsis: Fix the incorrect req_lim_delta
Bryant G. Ly <bryantly@linux.vnet.ibm.com>
ibmvscsis: Clear left-over abort_cmd pointers
Artem Savkov <asavkov@redhat.com>
scsi: scsi_dh_rdac: Use ctlr directly in rdac_failover_get()
Nicholas Bellinger <nab@linux-iscsi.org>
iscsi-target: Fix initial login PDU asynchronous socket close OOPs
Jiang Yi <jiangyilism@gmail.com>
iscsi-target: Always wait for kthread_should_stop() before kthread exit
Long Li <longli@microsoft.com>
scsi: zero per-cmd private driver data for each MQ I/O
Srinath Mannam <srinath.mannam@broadcom.com>
mmc: sdhci-iproc: suppress spurious interrupt with Multiblock read
Benjamin Tissoires <benjamin.tissoires@redhat.com>
Revert "ACPI / button: Change default behavior to lid_init_state=open"
Lv Zheng <lv.zheng@intel.com>
ACPICA: Tables: Fix regression introduced by a too early mechanism enabling
Dan Williams <dan.j.williams@intel.com>
ACPI / sysfs: fix acpi_get_table() leak / acpi-sysfs denial of service
Vishal Verma <vishal.l.verma@intel.com>
acpi, nfit: Fix the memory error check in nfit_handle_mce()
Borislav Petkov <bp@suse.de>
x86/MCE: Export memory_error()
Lv Zheng <lv.zheng@intel.com>
Revert "ACPI / button: Remove lid_init_state=method mode"
Herbert Xu <herbert@gondor.apana.org.au>
crypto: skcipher - Add missing API setkey checks
Sebastian Reichel <sebastian.reichel@collabora.co.uk>
i2c: i2c-tiny-usb: fix buffer not being DMA capable
Ard Biesheuvel <ard.biesheuvel@linaro.org>
drivers/tty: 8250: only call fintek_8250_probe when doing port I/O
Johan Hovold <johan@kernel.org>
serdev: fix tty-port client deregistration
Johan Hovold <johan@kernel.org>
Revert "tty_port: register tty ports with serdev bus"
Jeremy Kerr <jk@ozlabs.org>
powerpc/spufs: Fix hash faults for kernel regions
Michael Neuling <mikey@neuling.org>
powerpc: Fix booting P9 hash with CONFIG_PPC_RADIX_MMU=N
Richard Narron <comet.berkeley@gmail.com>
fs/ufs: Set UFS default maximum bytes per file
Liam R. Howlett <Liam.Howlett@Oracle.com>
sparc/ftrace: Fix ftrace graph time measurement
Orlando Arias <oarias@knights.ucf.edu>
sparc: Fix -Wstringop-overflow warning
Nitin Gupta <nitin.m.gupta@oracle.com>
sparc64: Fix mapping of 64k pages with MAP_FIXED
Daniel Borkmann <daniel@iogearbox.net>
bpf: adjust verifier heuristics
Daniel Borkmann <daniel@iogearbox.net>
bpf: fix wrong exposure of map_flags into fdinfo for lpm
Daniel Borkmann <daniel@iogearbox.net>
bpf: add bpf_clone_redirect to bpf_helper_changes_pkt_data
Eric Dumazet <edumazet@google.com>
ipv4: add reference counting to metrics
Peter Dawson <petedaws@gmail.com>
ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets
Davide Caratti <dcaratti@redhat.com>
sctp: fix ICMP processing if skb is non-linear
Wei Wang <weiwan@google.com>
tcp: avoid fastopen API to be used on AF_UNSPEC
Eric Garver <e@erig.me>
geneve: fix fill_info when using collect_metadata
Vlad Yasevich <vyasevich@gmail.com>
virtio-net: enable TSO/checksum offloads for Q-in-Q vlans
Vlad Yasevich <vyasevich@gmail.com>
be2net: Fix offload features for Q-in-Q packets
Vlad Yasevich <vyasevich@gmail.com>
vlan: Fix tcp checksum offloads in Q-in-Q vlans
Andrew Lunn <andrew@lunn.ch>
net: phy: marvell: Limit errata to 88m1101
Mohamad Haj Yahia <mohamad@mellanox.com>
net/mlx5: Avoid using pending command interface slots
Jarod Wilson <jarod@redhat.com>
bonding: fix accounting of active ports in 3ad
Eric Dumazet <edumazet@google.com>
ipv6: fix out of bound writes in __ip6_append_data()
Xin Long <lucien.xin@gmail.com>
bridge: start hello_timer when enabling KERNEL_STP in br_stp_start
Bjørn Mork <bjorn@mork.no>
qmi_wwan: add another Lenovo EM74xx device ID
Tobias Jungel <tobias.jungel@bisdn.de>
bridge: netlink: check vlan_default_pvid range
David S. Miller <davem@davemloft.net>
ipv6: Check ip6_find_1stfragopt() return value properly.
Craig Gallek <kraig@google.com>
ipv6: Prevent overrun when parsing v6 header options
David Ahern <dsahern@gmail.com>
net: Improve handling of failures on link and route dumps
Christoph Hellwig <hch@lst.de>
net/smc: Add warning about remote memory exposure
Ursula Braun <ubraun@linux.vnet.ibm.com>
smc: switch to usage of IB_PD_UNSAFE_GLOBAL_RKEY
Soheil Hassas Yeganeh <soheil@google.com>
tcp: eliminate negative reordering in tcp_clean_rtx_queue
Gal Pressman <galp@mellanox.com>
net/mlx5e: Fix ethtool pause support and advertise reporting
Gal Pressman <galp@mellanox.com>
net/mlx5e: Use the correct pause values for ethtool advertising
Douglas Caetano dos Santos <douglascs@taghos.com.br>
net/packet: fix missing net_device reference release
Eric Dumazet <edumazet@google.com>
sctp: do not inherit ipv6_{mc|ac|fl}_list from parent
Xin Long <lucien.xin@gmail.com>
sctp: fix src address selection if using secondary addresses for ipv6
Jon Paul Maloy <jon.maloy@ericsson.com>
tipc: make macro tipc_wait_for_cond() smp safe
Yuchung Cheng <ycheng@google.com>
tcp: avoid fragmenting peculiar skbs in SACK
Eric Dumazet <edumazet@google.com>
net: fix compile error in skb_orphan_partial()
Eric Dumazet <edumazet@google.com>
netem: fix skb_orphan_partial()
Daniel Borkmann <daniel@iogearbox.net>
bpf, arm64: fix faulty emission of map access in tail calls
Ursula Braun <ubraun@linux.vnet.ibm.com>
s390/qeth: add missing hash table initializations
Julian Wiedmann <jwi@linux.vnet.ibm.com>
s390/qeth: avoid null pointer dereference on OSN
Julian Wiedmann <jwi@linux.vnet.ibm.com>
s390/qeth: unbreak OSM and OSN support
Ursula Braun <ubraun@linux.vnet.ibm.com>
s390/qeth: handle sysfs error during initialization
WANG Cong <xiyou.wangcong@gmail.com>
ipv6/dccp: do not inherit ipv6_mc_list from parent
Gao Feng <gfree.wind@vip.163.com>
driver: vrf: Fix one possible use-after-free issue
Eric Dumazet <edumazet@google.com>
dccp/tcp: do not inherit mc_list from parent
-------------
Diffstat:
Documentation/acpi/acpi-lid.txt | 16 +-
Makefile | 4 +-
arch/arm64/net/bpf_jit_comp.c | 5 +-
arch/powerpc/kernel/prom.c | 2 +
arch/powerpc/platforms/cell/spu_base.c | 4 +-
arch/sparc/include/asm/hugetlb.h | 6 +-
arch/sparc/include/asm/pgtable_32.h | 4 +-
arch/sparc/include/asm/setup.h | 2 +-
arch/sparc/kernel/ftrace.c | 13 +-
arch/sparc/mm/init_32.c | 2 +-
arch/x86/boot/compressed/Makefile | 2 +-
arch/x86/include/asm/mce.h | 1 +
arch/x86/kernel/cpu/mcheck/mce.c | 11 +-
crypto/skcipher.c | 40 ++++-
drivers/acpi/acpica/tbutils.c | 4 -
drivers/acpi/button.c | 11 +-
drivers/acpi/nfit/mce.c | 2 +-
drivers/acpi/sysfs.c | 7 +-
drivers/char/pcmcia/cm4040_cs.c | 6 +-
drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 32 +++-
drivers/gpu/drm/gma500/psb_intel_lvds.c | 18 +-
drivers/gpu/drm/radeon/ci_dpm.c | 6 +
drivers/gpu/drm/radeon/cik.c | 4 +-
drivers/gpu/drm/radeon/evergreen.c | 4 +-
drivers/gpu/drm/radeon/r600.c | 2 +-
drivers/gpu/drm/radeon/si.c | 4 +-
drivers/hid/wacom_wac.c | 45 ++---
drivers/i2c/busses/i2c-tiny-usb.c | 25 ++-
drivers/infiniband/hw/hfi1/rc.c | 5 +-
drivers/infiniband/hw/qib/qib_rc.c | 4 +-
drivers/infiniband/ulp/srp/ib_srp.c | 2 +-
drivers/mmc/host/sdhci-iproc.c | 3 +-
drivers/net/bonding/bond_3ad.c | 2 +-
drivers/net/ethernet/emulex/benet/be_main.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 41 ++++-
.../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 9 +-
drivers/net/ethernet/mellanox/mlx5/core/eq.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/health.c | 2 +-
drivers/net/geneve.c | 8 +-
drivers/net/phy/marvell.c | 66 ++++---
drivers/net/usb/qmi_wwan.c | 2 +
drivers/net/virtio_net.c | 1 +
drivers/net/vrf.c | 3 +-
drivers/nvme/host/core.c | 13 +-
drivers/nvme/host/rdma.c | 18 +-
drivers/pci/pci.c | 3 +-
drivers/s390/net/qeth_core.h | 4 +
drivers/s390/net/qeth_core_main.c | 21 ++-
drivers/s390/net/qeth_core_sys.c | 24 ++-
drivers/s390/net/qeth_l2.h | 2 +
drivers/s390/net/qeth_l2_main.c | 26 ++-
drivers/s390/net/qeth_l2_sys.c | 8 +
drivers/s390/net/qeth_l3_main.c | 8 +-
drivers/scsi/device_handler/scsi_dh_rdac.c | 10 +-
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 27 ++-
drivers/scsi/scsi_lib.c | 2 +-
drivers/target/iscsi/iscsi_target.c | 30 +++-
drivers/target/iscsi/iscsi_target_erl0.c | 6 +-
drivers/target/iscsi/iscsi_target_erl0.h | 2 +-
drivers/target/iscsi/iscsi_target_login.c | 4 +
drivers/target/iscsi/iscsi_target_nego.c | 194 ++++++++++++++-------
drivers/tty/serdev/serdev-ttyport.c | 15 +-
drivers/tty/serial/8250/8250_port.c | 2 +-
drivers/tty/tty_port.c | 12 --
fs/dax.c | 23 +++
fs/ufs/super.c | 5 +-
fs/xfs/libxfs/xfs_bmap.c | 9 +-
fs/xfs/libxfs/xfs_btree.c | 2 +-
fs/xfs/libxfs/xfs_refcount.c | 43 +++--
fs/xfs/libxfs/xfs_trans_space.h | 23 ++-
fs/xfs/xfs_aops.c | 4 +-
fs/xfs/xfs_bmap_item.c | 5 +-
fs/xfs/xfs_bmap_util.c | 18 +-
fs/xfs/xfs_buf.c | 62 +++++--
fs/xfs/xfs_buf.h | 6 +-
fs/xfs/xfs_dir2_readdir.c | 15 +-
fs/xfs/xfs_file.c | 33 ++--
fs/xfs/xfs_icache.c | 58 +++++-
fs/xfs/xfs_icache.h | 8 +
fs/xfs/xfs_inode.c | 9 +-
fs/xfs/xfs_inode.h | 4 +-
fs/xfs/xfs_ioctl.c | 5 +-
fs/xfs/xfs_iomap.c | 4 +-
fs/xfs/xfs_log.c | 2 +-
fs/xfs/xfs_mount.h | 1 +
fs/xfs/xfs_qm.c | 7 +-
fs/xfs/xfs_qm_syscalls.c | 3 +-
fs/xfs/xfs_reflink.c | 18 +-
fs/xfs/xfs_super.c | 8 +
fs/xfs/xfs_trans.c | 22 +++
fs/xfs/xfs_trans.h | 2 +
include/linux/if_vlan.h | 18 +-
include/linux/memblock.h | 8 +
include/linux/mlx5/driver.h | 7 +-
include/linux/mm.h | 11 ++
include/linux/mmzone.h | 1 +
include/linux/pci.h | 5 +
include/net/dst.h | 8 +-
include/net/ip_fib.h | 10 +-
include/target/iscsi/iscsi_target_core.h | 1 +
kernel/bpf/arraymap.c | 1 +
kernel/bpf/lpm_trie.c | 1 +
kernel/bpf/stackmap.c | 1 +
kernel/bpf/verifier.c | 12 +-
mm/gup.c | 20 +--
mm/hugetlb.c | 5 +
mm/ksm.c | 3 +-
mm/memblock.c | 23 +++
mm/memory-failure.c | 8 +-
mm/memory.c | 40 +++--
mm/mlock.c | 5 +-
mm/page_alloc.c | 37 ++--
mm/slub.c | 6 +-
net/bridge/br_netlink.c | 7 +
net/bridge/br_stp_if.c | 1 +
net/bridge/br_stp_timer.c | 2 +-
net/core/dst.c | 23 ++-
net/core/filter.c | 1 +
net/core/rtnetlink.c | 36 ++--
net/core/sock.c | 23 +--
net/dccp/ipv6.c | 6 +
net/ipv4/fib_frontend.c | 15 +-
net/ipv4/fib_semantics.c | 17 +-
net/ipv4/fib_trie.c | 26 +--
net/ipv4/inet_connection_sock.c | 2 +
net/ipv4/route.c | 10 +-
net/ipv4/tcp.c | 7 +-
net/ipv4/tcp_input.c | 11 +-
net/ipv6/ip6_gre.c | 13 +-
net/ipv6/ip6_offload.c | 7 +-
net/ipv6/ip6_output.c | 20 ++-
net/ipv6/ip6_tunnel.c | 21 ++-
net/ipv6/output_core.c | 14 +-
net/ipv6/tcp_ipv6.c | 2 +
net/ipv6/udp_offload.c | 6 +-
net/packet/af_packet.c | 14 +-
net/sctp/input.c | 16 +-
net/sctp/ipv6.c | 49 ++++--
net/smc/Kconfig | 4 +
net/smc/smc_clc.c | 4 +-
net/smc/smc_core.c | 16 +-
net/smc/smc_core.h | 2 +-
net/smc/smc_ib.c | 21 +--
net/smc/smc_ib.h | 2 -
net/tipc/socket.c | 38 ++--
sound/pci/hda/patch_realtek.c | 3 +
sound/pci/hda/patch_sigmatel.c | 2 +
sound/usb/mixer_us16x08.c | 10 +-
148 files changed, 1323 insertions(+), 625 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 033/115] virtio-net: enable TSO/checksum offloads for Q-in-Q vlans |
| Message-ID | <tP3we-5oV-11@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know. ------------------ From: Vlad Yasevich <vyasevich@gmail.com> [ Upstream commit 2836b4f224d4fd7d1a2b23c3eecaf0f0ae199a74 ] Since virtio does not provide it's own ndo_features_check handler, TSO, and now checksum offload, are disabled for stacked vlans. Re-enable the support and let the host take care of it. This restores/improves Guest-to-Guest performance over Q-in-Q vlans. Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/net/virtio_net.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -1894,6 +1894,7 @@ static const struct net_device_ops virtn .ndo_poll_controller = virtnet_netpoll, #endif .ndo_xdp = virtnet_xdp, + .ndo_features_check = passthru_features_check, }; static void virtnet_config_changed_work(struct work_struct *work)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 011/115] tcp: avoid fragmenting peculiar skbs in SACK |
| Message-ID | <tP3we-5oV-9@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchung Cheng <ycheng@google.com>
[ Upstream commit b451e5d24ba6687c6f0e7319c727a709a1846c06 ]
This patch fixes a bug in splitting an SKB during SACK
processing. Specifically if an skb contains multiple
packets and is only partially sacked in the higher sequences,
tcp_match_sack_to_skb() splits the skb and marks the second fragment
as SACKed.
The current code further attempts rounding up the first fragment
to MSS boundaries. But it misses a boundary condition when the
rounded-up fragment size (pkt_len) is exactly skb size. Spliting
such an skb is pointless and causses a kernel warning and aborts
the SACK processing. This patch universally checks such over-split
before calling tcp_fragment to prevent these unnecessary warnings.
Fixes: adb92db857ee ("tcp: Make SACK code to split only at mss boundaries")
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_input.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1174,13 +1174,14 @@ static int tcp_match_skb_to_sack(struct
*/
if (pkt_len > mss) {
unsigned int new_len = (pkt_len / mss) * mss;
- if (!in_sack && new_len < pkt_len) {
+ if (!in_sack && new_len < pkt_len)
new_len += mss;
- if (new_len >= skb->len)
- return 0;
- }
pkt_len = new_len;
}
+
+ if (pkt_len >= skb->len && !in_sack)
+ return 0;
+
err = tcp_fragment(sk, skb, pkt_len, mss, GFP_ATOMIC);
if (err < 0)
return err;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 003/115] ipv6/dccp: do not inherit ipv6_mc_list from parent |
| Message-ID | <tP3we-5oV-17@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
[ Upstream commit 83eaddab4378db256d00d295bda6ca997cd13a52 ]
Like commit 657831ffc38e ("dccp/tcp: do not inherit mc_list from parent")
we should clear ipv6_mc_list etc. for IPv6 sockets too.
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dccp/ipv6.c | 6 ++++++
net/ipv6/tcp_ipv6.c | 2 ++
2 files changed, 8 insertions(+)
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -426,6 +426,9 @@ static struct sock *dccp_v6_request_recv
newsk->sk_backlog_rcv = dccp_v4_do_rcv;
newnp->pktoptions = NULL;
newnp->opt = NULL;
+ newnp->ipv6_mc_list = NULL;
+ newnp->ipv6_ac_list = NULL;
+ newnp->ipv6_fl_list = NULL;
newnp->mcast_oif = inet6_iif(skb);
newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
@@ -490,6 +493,9 @@ static struct sock *dccp_v6_request_recv
/* Clone RX bits */
newnp->rxopt.all = np->rxopt.all;
+ newnp->ipv6_mc_list = NULL;
+ newnp->ipv6_ac_list = NULL;
+ newnp->ipv6_fl_list = NULL;
newnp->pktoptions = NULL;
newnp->opt = NULL;
newnp->mcast_oif = inet6_iif(skb);
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1070,6 +1070,7 @@ static struct sock *tcp_v6_syn_recv_sock
newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
#endif
+ newnp->ipv6_mc_list = NULL;
newnp->ipv6_ac_list = NULL;
newnp->ipv6_fl_list = NULL;
newnp->pktoptions = NULL;
@@ -1139,6 +1140,7 @@ static struct sock *tcp_v6_syn_recv_sock
First: no IPv4 options.
*/
newinet->inet_opt = NULL;
+ newnp->ipv6_mc_list = NULL;
newnp->ipv6_ac_list = NULL;
newnp->ipv6_fl_list = NULL;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 009/115] netem: fix skb_orphan_partial() |
| Message-ID | <tP3we-5oV-27@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit f6ba8d33cfbb46df569972e64dbb5bb7e929bfd9 ]
I should have known that lowering skb->truesize was dangerous :/
In case packets are not leaving the host via a standard Ethernet device,
but looped back to local sockets, bad things can happen, as reported
by Michael Madsen ( https://bugzilla.kernel.org/show_bug.cgi?id=195713 )
So instead of tweaking skb->truesize, lets change skb->destructor
and keep a reference on the owner socket via its sk_refcnt.
Fixes: f2f872f9272a ("netem: Introduce skb_orphan_partial() helper")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Michael Madsen <mkm@nabto.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/sock.c | 20 ++++++++------------
1 file changed, 8 insertions(+), 12 deletions(-)
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1699,28 +1699,24 @@ EXPORT_SYMBOL(skb_set_owner_w);
* delay queue. We want to allow the owner socket to send more
* packets, as if they were already TX completed by a typical driver.
* But we also want to keep skb->sk set because some packet schedulers
- * rely on it (sch_fq for example). So we set skb->truesize to a small
- * amount (1) and decrease sk_wmem_alloc accordingly.
+ * rely on it (sch_fq for example).
*/
void skb_orphan_partial(struct sk_buff *skb)
{
- /* If this skb is a TCP pure ACK or already went here,
- * we have nothing to do. 2 is already a very small truesize.
- */
- if (skb->truesize <= 2)
+ if (skb_is_tcp_pure_ack(skb))
return;
- /* TCP stack sets skb->ooo_okay based on sk_wmem_alloc,
- * so we do not completely orphan skb, but transfert all
- * accounted bytes but one, to avoid unexpected reorders.
- */
if (skb->destructor == sock_wfree
#ifdef CONFIG_INET
|| skb->destructor == tcp_wfree
#endif
) {
- atomic_sub(skb->truesize - 1, &skb->sk->sk_wmem_alloc);
- skb->truesize = 1;
+ struct sock *sk = skb->sk;
+
+ if (atomic_inc_not_zero(&sk->sk_refcnt)) {
+ atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
+ skb->destructor = sock_efree;
+ }
} else {
skb_orphan(skb);
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 023/115] ipv6: Check ip6_find_1stfragopt() return value properly. |
| Message-ID | <tP3we-5oV-29@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <davem@davemloft.net>
[ Upstream commit 7dd7eb9513bd02184d45f000ab69d78cb1fa1531 ]
Do not use unsigned variables to see if it returns a negative
error or not.
Fixes: 2423496af35d ("ipv6: Prevent overrun when parsing v6 header options")
Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_offload.c | 9 ++++-----
net/ipv6/ip6_output.c | 7 +++----
net/ipv6/udp_offload.c | 8 +++++---
3 files changed, 12 insertions(+), 12 deletions(-)
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -63,7 +63,6 @@ static struct sk_buff *ipv6_gso_segment(
const struct net_offload *ops;
int proto;
struct frag_hdr *fptr;
- unsigned int unfrag_ip6hlen;
unsigned int payload_len;
u8 *prevhdr;
int offset = 0;
@@ -116,10 +115,10 @@ static struct sk_buff *ipv6_gso_segment(
skb->network_header = (u8 *)ipv6h - skb->head;
if (udpfrag) {
- unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
- if (unfrag_ip6hlen < 0)
- return ERR_PTR(unfrag_ip6hlen);
- fptr = (struct frag_hdr *)((u8 *)ipv6h + unfrag_ip6hlen);
+ int err = ip6_find_1stfragopt(skb, &prevhdr);
+ if (err < 0)
+ return ERR_PTR(err);
+ fptr = (struct frag_hdr *)((u8 *)ipv6h + err);
fptr->frag_off = htons(offset);
if (skb->next)
fptr->frag_off |= htons(IP6_MF);
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -597,11 +597,10 @@ int ip6_fragment(struct net *net, struct
int ptr, offset = 0, err = 0;
u8 *prevhdr, nexthdr = 0;
- hlen = ip6_find_1stfragopt(skb, &prevhdr);
- if (hlen < 0) {
- err = hlen;
+ err = ip6_find_1stfragopt(skb, &prevhdr);
+ if (err < 0)
goto fail;
- }
+ hlen = err;
nexthdr = *prevhdr;
mtu = ip6_skb_dst_mtu(skb);
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -29,6 +29,7 @@ static struct sk_buff *udp6_ufo_fragment
u8 frag_hdr_sz = sizeof(struct frag_hdr);
__wsum csum;
int tnl_hlen;
+ int err;
mss = skb_shinfo(skb)->gso_size;
if (unlikely(skb->len <= mss))
@@ -90,9 +91,10 @@ static struct sk_buff *udp6_ufo_fragment
/* Find the unfragmentable header and shift it left by frag_hdr_sz
* bytes to insert fragment header.
*/
- unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
- if (unfrag_ip6hlen < 0)
- return ERR_PTR(unfrag_ip6hlen);
+ err = ip6_find_1stfragopt(skb, &prevhdr);
+ if (err < 0)
+ return ERR_PTR(err);
+ unfrag_ip6hlen = err;
nexthdr = *prevhdr;
*prevhdr = NEXTHDR_FRAGMENT;
unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) +
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 001/115] dccp/tcp: do not inherit mc_list from parent |
| Message-ID | <tP3we-5oV-31@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 657831ffc38e30092a2d5f03d385d710eb88b09a ]
syzkaller found a way to trigger double frees from ip_mc_drop_socket()
It turns out that leave a copy of parent mc_list at accept() time,
which is very bad.
Very similar to commit 8b485ce69876 ("tcp: do not inherit
fastopen_req from parent")
Initial report from Pray3r, completed by Andrey one.
Thanks a lot to them !
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Pray3r <pray3r.z@gmail.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/inet_connection_sock.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -794,6 +794,8 @@ struct sock *inet_csk_clone_lock(const s
/* listeners have SOCK_RCU_FREE, not the children */
sock_reset_flag(newsk, SOCK_RCU_FREE);
+ inet_sk(newsk)->mc_list = NULL;
+
newsk->sk_mark = inet_rsk(req)->ir_mark;
atomic64_set(&newsk->sk_cookie,
atomic64_read(&inet_rsk(req)->ir_cookie));
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 018/115] tcp: eliminate negative reordering in tcp_clean_rtx_queue |
| Message-ID | <tP3we-5oV-33@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Soheil Hassas Yeganeh <soheil@google.com>
[ Upstream commit bafbb9c73241760023d8981191ddd30bb1c6dbac ]
tcp_ack() can call tcp_fragment() which may dededuct the
value tp->fackets_out when MSS changes. When prior_fackets
is larger than tp->fackets_out, tcp_clean_rtx_queue() can
invoke tcp_update_reordering() with negative values. This
results in absurd tp->reodering values higher than
sysctl_tcp_max_reordering.
Note that tcp_update_reordering indeeds sets tp->reordering
to min(sysctl_tcp_max_reordering, metric), but because
the comparison is signed, a negative metric always wins.
Fixes: c7caf8d3ed7a ("[TCP]: Fix reord detection due to snd_una covered holes")
Reported-by: Rebecca Isaacs <risaacs@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_input.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3189,7 +3189,7 @@ static int tcp_clean_rtx_queue(struct so
int delta;
/* Non-retransmitted hole got filled? That's reordering */
- if (reord < prior_fackets)
+ if (reord < prior_fackets && reord <= tp->fackets_out)
tcp_update_reordering(sk, tp->fackets_out - reord, 0);
delta = tcp_is_fack(tp) ? pkts_acked :
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 024/115] bridge: netlink: check vlan_default_pvid range |
| Message-ID | <tP3wf-5oV-47@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Jungel <tobias.jungel@bisdn.de>
[ Upstream commit a285860211bf257b0e6d522dac6006794be348af ]
Currently it is allowed to set the default pvid of a bridge to a value
above VLAN_VID_MASK (0xfff). This patch adds a check to br_validate and
returns -EINVAL in case the pvid is out of bounds.
Reproduce by calling:
[root@test ~]# ip l a type bridge
[root@test ~]# ip l a type dummy
[root@test ~]# ip l s bridge0 type bridge vlan_filtering 1
[root@test ~]# ip l s bridge0 type bridge vlan_default_pvid 9999
[root@test ~]# ip l s dummy0 master bridge0
[root@test ~]# bridge vlan
port vlan ids
bridge0 9999 PVID Egress Untagged
dummy0 9999 PVID Egress Untagged
Fixes: 0f963b7592ef ("bridge: netlink: add support for default_pvid")
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: Tobias Jungel <tobias.jungel@bisdn.de>
Acked-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/br_netlink.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -828,6 +828,13 @@ static int br_validate(struct nlattr *tb
return -EPROTONOSUPPORT;
}
}
+
+ if (data[IFLA_BR_VLAN_DEFAULT_PVID]) {
+ __u16 defpvid = nla_get_u16(data[IFLA_BR_VLAN_DEFAULT_PVID]);
+
+ if (defpvid >= VLAN_VID_MASK)
+ return -EINVAL;
+ }
#endif
return 0;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 027/115] ipv6: fix out of bound writes in __ip6_append_data() |
| Message-ID | <tP3wf-5oV-51@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 232cd35d0804cc241eb887bb8d4d9b3b9881c64a ]
Andrey Konovalov and idaifish@gmail.com reported crashes caused by
one skb shared_info being overwritten from __ip6_append_data()
Andrey program lead to following state :
copy -4200 datalen 2000 fraglen 2040
maxfraglen 2040 alloclen 2048 transhdrlen 0 offset 0 fraggap 6200
The skb_copy_and_csum_bits(skb_prev, maxfraglen, data + transhdrlen,
fraggap, 0); is overwriting skb->head and skb_shared_info
Since we apparently detect this rare condition too late, move the
code earlier to even avoid allocating skb and risking crashes.
Once again, many thanks to Andrey and syzkaller team.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Reported-by: <idaifish@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_output.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1466,6 +1466,11 @@ alloc_new_skb:
*/
alloclen += sizeof(struct frag_hdr);
+ copy = datalen - transhdrlen - fraggap;
+ if (copy < 0) {
+ err = -EINVAL;
+ goto error;
+ }
if (transhdrlen) {
skb = sock_alloc_send_skb(sk,
alloclen + hh_len,
@@ -1515,13 +1520,9 @@ alloc_new_skb:
data += fraggap;
pskb_trim_unique(skb_prev, maxfraglen);
}
- copy = datalen - transhdrlen - fraggap;
-
- if (copy < 0) {
- err = -EINVAL;
- kfree_skb(skb);
- goto error;
- } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
+ if (copy > 0 &&
+ getfrag(from, data + transhdrlen, offset,
+ copy, fraggap, skb) < 0) {
err = -EFAULT;
kfree_skb(skb);
goto error;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 017/115] net/mlx5e: Fix ethtool pause support and advertise reporting |
| Message-ID | <tP3wf-5oV-45@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <galp@mellanox.com>
[ Upstream commit e3c19503712d6360239b19c14cded56dd63c40d7 ]
Pause bit should set when RX pause is on, not TX pause.
Also, setting Asym_Pause is incorrect, and should be turned off.
Fixes: 665bc53969d7 ("net/mlx5e: Use new ethtool get/set link ksettings API")
Signed-off-by: Gal Pressman <galp@mellanox.com>
Cc: kernel-team@fb.com
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -773,7 +773,6 @@ static void get_supported(u32 eth_proto_
ptys2ethtool_supported_port(link_ksettings, eth_proto_cap);
ptys2ethtool_supported_link(supported, eth_proto_cap);
ethtool_link_ksettings_add_link_mode(link_ksettings, supported, Pause);
- ethtool_link_ksettings_add_link_mode(link_ksettings, supported, Asym_Pause);
}
static void get_advertising(u32 eth_proto_cap, u8 tx_pause,
@@ -783,7 +782,7 @@ static void get_advertising(u32 eth_prot
unsigned long *advertising = link_ksettings->link_modes.advertising;
ptys2ethtool_adver_link(advertising, eth_proto_cap);
- if (tx_pause)
+ if (rx_pause)
ethtool_link_ksettings_add_link_mode(link_ksettings, advertising, Pause);
if (tx_pause ^ rx_pause)
ethtool_link_ksettings_add_link_mode(link_ksettings, advertising, Asym_Pause);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 029/115] net/mlx5: Avoid using pending command interface slots |
| Message-ID | <tP3wf-5oV-49@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamad Haj Yahia <mohamad@mellanox.com>
[ Upstream commit 73dd3a4839c1d27c36d4dcc92e1ff44225ecbeb7 ]
Currently when firmware command gets stuck or it takes long time to
complete, the driver command will get timeout and the command slot is
freed and can be used for new commands, and if the firmware receive new
command on the old busy slot its behavior is unexpected and this could
be harmful.
To fix this when the driver command gets timeout we return failure,
but we don't free the command slot and we wait for the firmware to
explicitly respond to that command.
Once all the entries are busy we will stop processing new firmware
commands.
Fixes: 9cba4ebcf374 ('net/mlx5: Fix potential deadlock in command mode change')
Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
Cc: kernel-team@fb.com
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 41 ++++++++++++++++++++---
drivers/net/ethernet/mellanox/mlx5/core/eq.c | 2 -
drivers/net/ethernet/mellanox/mlx5/core/health.c | 2 -
include/linux/mlx5/driver.h | 7 +++
4 files changed, 44 insertions(+), 8 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -770,7 +770,7 @@ static void cb_timeout_handler(struct wo
mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n",
mlx5_command_str(msg_to_opcode(ent->in)),
msg_to_opcode(ent->in));
- mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+ mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
}
static void cmd_work_handler(struct work_struct *work)
@@ -800,6 +800,7 @@ static void cmd_work_handler(struct work
}
cmd->ent_arr[ent->idx] = ent;
+ set_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, &ent->state);
lay = get_inst(cmd, ent->idx);
ent->lay = lay;
memset(lay, 0, sizeof(*lay));
@@ -821,6 +822,20 @@ static void cmd_work_handler(struct work
if (ent->callback)
schedule_delayed_work(&ent->cb_timeout_work, cb_timeout);
+ /* Skip sending command to fw if internal error */
+ if (pci_channel_offline(dev->pdev) ||
+ dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
+ u8 status = 0;
+ u32 drv_synd;
+
+ ent->ret = mlx5_internal_err_ret_value(dev, msg_to_opcode(ent->in), &drv_synd, &status);
+ MLX5_SET(mbox_out, ent->out, status, status);
+ MLX5_SET(mbox_out, ent->out, syndrome, drv_synd);
+
+ mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
+ return;
+ }
+
/* ring doorbell after the descriptor is valid */
mlx5_core_dbg(dev, "writing 0x%x to command doorbell\n", 1 << ent->idx);
wmb();
@@ -831,7 +846,7 @@ static void cmd_work_handler(struct work
poll_timeout(ent);
/* make sure we read the descriptor after ownership is SW */
rmb();
- mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+ mlx5_cmd_comp_handler(dev, 1UL << ent->idx, (ent->ret == -ETIMEDOUT));
}
}
@@ -875,7 +890,7 @@ static int wait_func(struct mlx5_core_de
wait_for_completion(&ent->done);
} else if (!wait_for_completion_timeout(&ent->done, timeout)) {
ent->ret = -ETIMEDOUT;
- mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+ mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
}
err = ent->ret;
@@ -1371,7 +1386,7 @@ static void free_msg(struct mlx5_core_de
}
}
-void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
+void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
{
struct mlx5_cmd *cmd = &dev->cmd;
struct mlx5_cmd_work_ent *ent;
@@ -1391,6 +1406,19 @@ void mlx5_cmd_comp_handler(struct mlx5_c
struct semaphore *sem;
ent = cmd->ent_arr[i];
+
+ /* if we already completed the command, ignore it */
+ if (!test_and_clear_bit(MLX5_CMD_ENT_STATE_PENDING_COMP,
+ &ent->state)) {
+ /* only real completion can free the cmd slot */
+ if (!forced) {
+ mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n",
+ ent->idx);
+ free_ent(cmd, ent->idx);
+ }
+ continue;
+ }
+
if (ent->callback)
cancel_delayed_work(&ent->cb_timeout_work);
if (ent->page_queue)
@@ -1413,7 +1441,10 @@ void mlx5_cmd_comp_handler(struct mlx5_c
mlx5_core_dbg(dev, "command completed. ret 0x%x, delivery status %s(0x%x)\n",
ent->ret, deliv_status_to_str(ent->status), ent->status);
}
- free_ent(cmd, ent->idx);
+
+ /* only real completion will free the entry slot */
+ if (!forced)
+ free_ent(cmd, ent->idx);
if (ent->callback) {
ds = ent->ts2 - ent->ts1;
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -422,7 +422,7 @@ static irqreturn_t mlx5_eq_int(int irq,
break;
case MLX5_EVENT_TYPE_CMD:
- mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector));
+ mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector), false);
break;
case MLX5_EVENT_TYPE_PORT_CHANGE:
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -90,7 +90,7 @@ static void trigger_cmd_completions(stru
spin_unlock_irqrestore(&dev->cmd.alloc_lock, flags);
mlx5_core_dbg(dev, "vector 0x%llx\n", vector);
- mlx5_cmd_comp_handler(dev, vector);
+ mlx5_cmd_comp_handler(dev, vector, true);
return;
no_trig:
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -785,7 +785,12 @@ enum {
typedef void (*mlx5_cmd_cbk_t)(int status, void *context);
+enum {
+ MLX5_CMD_ENT_STATE_PENDING_COMP,
+};
+
struct mlx5_cmd_work_ent {
+ unsigned long state;
struct mlx5_cmd_msg *in;
struct mlx5_cmd_msg *out;
void *uout;
@@ -979,7 +984,7 @@ void mlx5_cq_completion(struct mlx5_core
void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type);
void mlx5_srq_event(struct mlx5_core_dev *dev, u32 srqn, int event_type);
struct mlx5_core_srq *mlx5_core_get_srq(struct mlx5_core_dev *dev, u32 srqn);
-void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec);
+void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced);
void mlx5_cq_event(struct mlx5_core_dev *dev, u32 cqn, int event_type);
int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
int nent, u64 mask, const char *name,
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 021/115] net: Improve handling of failures on link and route dumps |
| Message-ID | <tP3wf-5oV-57@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <dsahern@gmail.com>
[ Upstream commit f6c5775ff0bfa62b072face6bf1d40f659f194b2 ]
In general, rtnetlink dumps do not anticipate failure to dump a single
object (e.g., link or route) on a single pass. As both route and link
objects have grown via more attributes, that is no longer a given.
netlink dumps can handle a failure if the dump function returns an
error; specifically, netlink_dump adds the return code to the response
if it is <= 0 so userspace is notified of the failure. The missing
piece is the rtnetlink dump functions returning the error.
Fix route and link dump functions to return the errors if no object is
added to an skb (detected by skb->len != 0). IPv6 route dumps
(rt6_dump_route) already return the error; this patch updates IPv4 and
link dumps. Other dump functions may need to be ajusted as well.
Reported-by: Jan Moskyto Matejka <mq@ucw.cz>
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/rtnetlink.c | 36 ++++++++++++++++++++++++------------
net/ipv4/fib_frontend.c | 15 +++++++++++----
net/ipv4/fib_trie.c | 26 ++++++++++++++------------
3 files changed, 49 insertions(+), 28 deletions(-)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1620,13 +1620,13 @@ static int rtnl_dump_ifinfo(struct sk_bu
cb->nlh->nlmsg_seq, 0,
flags,
ext_filter_mask);
- /* If we ran out of room on the first message,
- * we're in trouble
- */
- WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
- if (err < 0)
- goto out;
+ if (err < 0) {
+ if (likely(skb->len))
+ goto out;
+
+ goto out_err;
+ }
nl_dump_check_consistent(cb, nlmsg_hdr(skb));
cont:
@@ -1634,10 +1634,12 @@ cont:
}
}
out:
+ err = skb->len;
+out_err:
cb->args[1] = idx;
cb->args[0] = h;
- return skb->len;
+ return err;
}
int rtnl_nla_parse_ifla(struct nlattr **tb, const struct nlattr *head, int len)
@@ -3427,8 +3429,12 @@ static int rtnl_bridge_getlink(struct sk
err = br_dev->netdev_ops->ndo_bridge_getlink(
skb, portid, seq, dev,
filter_mask, NLM_F_MULTI);
- if (err < 0 && err != -EOPNOTSUPP)
- break;
+ if (err < 0 && err != -EOPNOTSUPP) {
+ if (likely(skb->len))
+ break;
+
+ goto out_err;
+ }
}
idx++;
}
@@ -3439,16 +3445,22 @@ static int rtnl_bridge_getlink(struct sk
seq, dev,
filter_mask,
NLM_F_MULTI);
- if (err < 0 && err != -EOPNOTSUPP)
- break;
+ if (err < 0 && err != -EOPNOTSUPP) {
+ if (likely(skb->len))
+ break;
+
+ goto out_err;
+ }
}
idx++;
}
}
+ err = skb->len;
+out_err:
rcu_read_unlock();
cb->args[0] = idx;
- return skb->len;
+ return err;
}
static inline size_t bridge_nlmsg_size(void)
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -760,7 +760,7 @@ static int inet_dump_fib(struct sk_buff
unsigned int e = 0, s_e;
struct fib_table *tb;
struct hlist_head *head;
- int dumped = 0;
+ int dumped = 0, err;
if (nlmsg_len(cb->nlh) >= sizeof(struct rtmsg) &&
((struct rtmsg *) nlmsg_data(cb->nlh))->rtm_flags & RTM_F_CLONED)
@@ -780,20 +780,27 @@ static int inet_dump_fib(struct sk_buff
if (dumped)
memset(&cb->args[2], 0, sizeof(cb->args) -
2 * sizeof(cb->args[0]));
- if (fib_table_dump(tb, skb, cb) < 0)
- goto out;
+ err = fib_table_dump(tb, skb, cb);
+ if (err < 0) {
+ if (likely(skb->len))
+ goto out;
+
+ goto out_err;
+ }
dumped = 1;
next:
e++;
}
}
out:
+ err = skb->len;
+out_err:
rcu_read_unlock();
cb->args[1] = e;
cb->args[0] = h;
- return skb->len;
+ return err;
}
/* Prepare and feed intra-kernel routing request.
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2079,6 +2079,8 @@ static int fn_trie_dump_leaf(struct key_
/* rcu_read_lock is hold by caller */
hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) {
+ int err;
+
if (i < s_i) {
i++;
continue;
@@ -2089,17 +2091,14 @@ static int fn_trie_dump_leaf(struct key_
continue;
}
- if (fib_dump_info(skb, NETLINK_CB(cb->skb).portid,
- cb->nlh->nlmsg_seq,
- RTM_NEWROUTE,
- tb->tb_id,
- fa->fa_type,
- xkey,
- KEYLENGTH - fa->fa_slen,
- fa->fa_tos,
- fa->fa_info, NLM_F_MULTI) < 0) {
+ err = fib_dump_info(skb, NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, RTM_NEWROUTE,
+ tb->tb_id, fa->fa_type,
+ xkey, KEYLENGTH - fa->fa_slen,
+ fa->fa_tos, fa->fa_info, NLM_F_MULTI);
+ if (err < 0) {
cb->args[4] = i;
- return -1;
+ return err;
}
i++;
}
@@ -2121,10 +2120,13 @@ int fib_table_dump(struct fib_table *tb,
t_key key = cb->args[3];
while ((l = leaf_walk_rcu(&tp, key)) != NULL) {
- if (fn_trie_dump_leaf(l, tb, skb, cb) < 0) {
+ int err;
+
+ err = fn_trie_dump_leaf(l, tb, skb, cb);
+ if (err < 0) {
cb->args[3] = key;
cb->args[2] = count;
- return -1;
+ return err;
}
++count;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 008/115] bpf, arm64: fix faulty emission of map access in tail calls |
| Message-ID | <tP3wf-5oV-59@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit d8b54110ee944de522ccd3531191f39986ec20f9 ]
Shubham was recently asking on netdev why in arm64 JIT we don't multiply
the index for accessing the tail call map by 8. That led me into testing
out arm64 JIT wrt tail calls and it turned out I got a NULL pointer
dereference on the tail call.
The buggy access is at:
prog = array->ptrs[index];
if (prog == NULL)
goto out;
[...]
00000060: d2800e0a mov x10, #0x70 // #112
00000064: f86a682a ldr x10, [x1,x10]
00000068: f862694b ldr x11, [x10,x2]
0000006c: b40000ab cbz x11, 0x00000080
[...]
The code triggering the crash is f862694b. x1 at the time contains the
address of the bpf array, x10 offsetof(struct bpf_array, ptrs). Meaning,
above we load the pointer to the program at map slot 0 into x10. x10
can then be NULL if the slot is not occupied, which we later on try to
access with a user given offset in x2 that is the map index.
Fix this by emitting the following instead:
[...]
00000060: d2800e0a mov x10, #0x70 // #112
00000064: 8b0a002a add x10, x1, x10
00000068: d37df04b lsl x11, x2, #3
0000006c: f86b694b ldr x11, [x10,x11]
00000070: b40000ab cbz x11, 0x00000084
[...]
This basically adds the offset to ptrs to the base address of the bpf
array we got and we later on access the map with an index * 8 offset
relative to that. The tail call map itself is basically one large area
with meta data at the head followed by the array of prog pointers.
This makes tail calls working again, tested on Cavium ThunderX ARMv8.
Fixes: ddb55992b04d ("arm64: bpf: implement bpf_tail_call() helper")
Reported-by: Shubham Bansal <illusionist.neo@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/net/bpf_jit_comp.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -252,8 +252,9 @@ static int emit_bpf_tail_call(struct jit
*/
off = offsetof(struct bpf_array, ptrs);
emit_a64_mov_i64(tmp, off, ctx);
- emit(A64_LDR64(tmp, r2, tmp), ctx);
- emit(A64_LDR64(prg, tmp, r3), ctx);
+ emit(A64_ADD(1, tmp, r2, tmp), ctx);
+ emit(A64_LSL(1, prg, r3, 3), ctx);
+ emit(A64_LDR64(prg, tmp, prg), ctx);
emit(A64_CBZ(1, prg, jmp_offset), ctx);
/* goto *(prog->bpf_func + prologue_size); */
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 012/115] tipc: make macro tipc_wait_for_cond() smp safe |
| Message-ID | <tP3wf-5oV-61@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Paul Maloy <jon.maloy@ericsson.com>
[ Upstream commit 844cf763fba654436d3a4279b6a672c196cf1901 ]
The macro tipc_wait_for_cond() is embedding the macro sk_wait_event()
to fulfil its task. The latter, in turn, is evaluating the stated
condition outside the socket lock context. This is problematic if
the condition is accessing non-trivial data structures which may be
altered by incoming interrupts, as is the case with the cong_links()
linked list, used by socket to keep track of the current set of
congested links. We sometimes see crashes when this list is accessed
by a condition function at the same time as a SOCK_WAKEUP interrupt
is removing an element from the list.
We fix this by expanding selected parts of sk_wait_event() into the
outer macro, while ensuring that all evaluations of a given condition
are performed under socket lock protection.
Fixes: commit 365ad353c256 ("tipc: reduce risk of user starvation during link congestion")
Reviewed-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/tipc/socket.c | 38 +++++++++++++++++++-------------------
1 file changed, 19 insertions(+), 19 deletions(-)
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -361,25 +361,25 @@ static int tipc_sk_sock_err(struct socke
return 0;
}
-#define tipc_wait_for_cond(sock_, timeout_, condition_) \
-({ \
- int rc_ = 0; \
- int done_ = 0; \
- \
- while (!(condition_) && !done_) { \
- struct sock *sk_ = sock->sk; \
- DEFINE_WAIT_FUNC(wait_, woken_wake_function); \
- \
- rc_ = tipc_sk_sock_err(sock_, timeout_); \
- if (rc_) \
- break; \
- prepare_to_wait(sk_sleep(sk_), &wait_, \
- TASK_INTERRUPTIBLE); \
- done_ = sk_wait_event(sk_, timeout_, \
- (condition_), &wait_); \
- remove_wait_queue(sk_sleep(sk_), &wait_); \
- } \
- rc_; \
+#define tipc_wait_for_cond(sock_, timeo_, condition_) \
+({ \
+ struct sock *sk_; \
+ int rc_; \
+ \
+ while ((rc_ = !(condition_))) { \
+ DEFINE_WAIT_FUNC(wait_, woken_wake_function); \
+ sk_ = (sock_)->sk; \
+ rc_ = tipc_sk_sock_err((sock_), timeo_); \
+ if (rc_) \
+ break; \
+ prepare_to_wait(sk_sleep(sk_), &wait_, TASK_INTERRUPTIBLE); \
+ release_sock(sk_); \
+ *(timeo_) = wait_woken(&wait_, TASK_INTERRUPTIBLE, *(timeo_)); \
+ sched_annotate_sleep(); \
+ lock_sock(sk_); \
+ remove_wait_queue(sk_sleep(sk_), &wait_); \
+ } \
+ rc_; \
})
/**
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 043/115] sparc: Fix -Wstringop-overflow warning |
| Message-ID | <tP3wg-5oV-63@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know. ------------------ From: Orlando Arias <oarias@knights.ucf.edu> [ Upstream commit deba804c90642c8ed0f15ac1083663976d578f54 ] Greetings, GCC 7 introduced the -Wstringop-overflow flag to detect buffer overflows in calls to string handling functions [1][2]. Due to the way ``empty_zero_page'' is declared in arch/sparc/include/setup.h, this causes a warning to trigger at compile time in the function mem_init(), which is subsequently converted to an error. The ensuing patch fixes this issue and aligns the declaration of empty_zero_page to that of other architectures. Thank you. Cheers, Orlando. [1] https://gcc.gnu.org/ml/gcc-patches/2016-10/msg02308.html [2] https://gcc.gnu.org/gcc-7/changes.html Signed-off-by: Orlando Arias <oarias@knights.ucf.edu> -------------------------------------------------------------------------------- Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- arch/sparc/include/asm/pgtable_32.h | 4 ++-- arch/sparc/include/asm/setup.h | 2 +- arch/sparc/mm/init_32.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) --- a/arch/sparc/include/asm/pgtable_32.h +++ b/arch/sparc/include/asm/pgtable_32.h @@ -91,9 +91,9 @@ extern unsigned long pfn_base; * ZERO_PAGE is a global shared page that is always zero: used * for zero-mapped memory areas etc.. */ -extern unsigned long empty_zero_page; +extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; -#define ZERO_PAGE(vaddr) (virt_to_page(&empty_zero_page)) +#define ZERO_PAGE(vaddr) (virt_to_page(empty_zero_page)) /* * In general all page table modifications should use the V8 atomic --- a/arch/sparc/include/asm/setup.h +++ b/arch/sparc/include/asm/setup.h @@ -16,7 +16,7 @@ extern char reboot_command[]; */ extern unsigned char boot_cpu_id; -extern unsigned long empty_zero_page; +extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; extern int serial_console; static inline int con_is_present(void) --- a/arch/sparc/mm/init_32.c +++ b/arch/sparc/mm/init_32.c @@ -290,7 +290,7 @@ void __init mem_init(void) /* Saves us work later. */ - memset((void *)&empty_zero_page, 0, PAGE_SIZE); + memset((void *)empty_zero_page, 0, PAGE_SIZE); i = last_valid_pfn >> ((20 - PAGE_SHIFT) + 5); i += 1;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 005/115] s390/qeth: unbreak OSM and OSN support |
| Message-ID | <tP3wg-5oV-65@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <jwi@linux.vnet.ibm.com>
[ Upstream commit 2d2ebb3ed0c6acfb014f98e427298673a5d07b82 ]
commit b4d72c08b358 ("qeth: bridgeport support - basic control")
broke the support for OSM and OSN devices as follows:
As OSM and OSN are L2 only, qeth_core_probe_device() does an early
setup by loading the l2 discipline and calling qeth_l2_probe_device().
In this context, adding the l2-specific bridgeport sysfs attributes
via qeth_l2_create_device_attributes() hits a BUG_ON in fs/sysfs/group.c,
since the basic sysfs infrastructure for the device hasn't been
established yet.
Note that OSN actually has its own unique sysfs attributes
(qeth_osn_devtype), so the additional attributes shouldn't be created
at all.
For OSM, add a new qeth_l2_devtype that contains all the common
and l2-specific sysfs attributes.
When qeth_core_probe_device() does early setup for OSM or OSN, assign
the corresponding devtype so that the ccwgroup probe code creates the
full set of sysfs attributes.
This allows us to skip qeth_l2_create_device_attributes() in case
of an early setup.
Any device that can't do early setup will initially have only the
generic sysfs attributes, and when it's probed later
qeth_l2_probe_device() adds the l2-specific attributes.
If an early-setup device is removed (by calling ccwgroup_ungroup()),
device_unregister() will - using the devtype - delete the
l2-specific attributes before qeth_l2_remove_device() is called.
So make sure to not remove them twice.
What complicates the issue is that qeth_l2_probe_device() and
qeth_l2_remove_device() is also called on a device when its
layer2 attribute changes (ie. its layer mode is switched).
For early-setup devices this wouldn't work properly - we wouldn't
remove the l2-specific attributes when switching to L3.
But switching the layer mode doesn't actually make any sense;
we already decided that the device can only operate in L2!
So just refuse to switch the layer mode on such devices. Note that
OSN doesn't have a layer2 attribute, so we only need to special-case
OSM.
Based on an initial patch by Ursula Braun.
Fixes: b4d72c08b358 ("qeth: bridgeport support - basic control")
Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/net/qeth_core.h | 4 ++++
drivers/s390/net/qeth_core_main.c | 17 +++++++++--------
drivers/s390/net/qeth_core_sys.c | 22 ++++++++++++++--------
drivers/s390/net/qeth_l2.h | 2 ++
drivers/s390/net/qeth_l2_main.c | 17 +++++++++++++----
drivers/s390/net/qeth_l2_sys.c | 8 ++++++++
drivers/s390/net/qeth_l3_main.c | 1 +
7 files changed, 51 insertions(+), 20 deletions(-)
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -714,6 +714,7 @@ enum qeth_discipline_id {
};
struct qeth_discipline {
+ const struct device_type *devtype;
void (*start_poll)(struct ccw_device *, int, unsigned long);
qdio_handler_t *input_handler;
qdio_handler_t *output_handler;
@@ -889,6 +890,9 @@ extern struct qeth_discipline qeth_l2_di
extern struct qeth_discipline qeth_l3_discipline;
extern const struct attribute_group *qeth_generic_attr_groups[];
extern const struct attribute_group *qeth_osn_attr_groups[];
+extern const struct attribute_group qeth_device_attr_group;
+extern const struct attribute_group qeth_device_blkt_group;
+extern const struct device_type qeth_generic_devtype;
extern struct workqueue_struct *qeth_wq;
int qeth_card_hw_is_reachable(struct qeth_card *);
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -5460,10 +5460,12 @@ void qeth_core_free_discipline(struct qe
card->discipline = NULL;
}
-static const struct device_type qeth_generic_devtype = {
+const struct device_type qeth_generic_devtype = {
.name = "qeth_generic",
.groups = qeth_generic_attr_groups,
};
+EXPORT_SYMBOL_GPL(qeth_generic_devtype);
+
static const struct device_type qeth_osn_devtype = {
.name = "qeth_osn",
.groups = qeth_osn_attr_groups,
@@ -5589,23 +5591,22 @@ static int qeth_core_probe_device(struct
goto err_card;
}
- if (card->info.type == QETH_CARD_TYPE_OSN)
- gdev->dev.type = &qeth_osn_devtype;
- else
- gdev->dev.type = &qeth_generic_devtype;
-
switch (card->info.type) {
case QETH_CARD_TYPE_OSN:
case QETH_CARD_TYPE_OSM:
rc = qeth_core_load_discipline(card, QETH_DISCIPLINE_LAYER2);
if (rc)
goto err_card;
+
+ gdev->dev.type = (card->info.type != QETH_CARD_TYPE_OSN)
+ ? card->discipline->devtype
+ : &qeth_osn_devtype;
rc = card->discipline->setup(card->gdev);
if (rc)
goto err_disc;
- case QETH_CARD_TYPE_OSD:
- case QETH_CARD_TYPE_OSX:
+ break;
default:
+ gdev->dev.type = &qeth_generic_devtype;
break;
}
--- a/drivers/s390/net/qeth_core_sys.c
+++ b/drivers/s390/net/qeth_core_sys.c
@@ -413,12 +413,16 @@ static ssize_t qeth_dev_layer2_store(str
if (card->options.layer2 == newdis)
goto out;
- else {
- card->info.mac_bits = 0;
- if (card->discipline) {
- card->discipline->remove(card->gdev);
- qeth_core_free_discipline(card);
- }
+ if (card->info.type == QETH_CARD_TYPE_OSM) {
+ /* fixed layer, can't switch */
+ rc = -EOPNOTSUPP;
+ goto out;
+ }
+
+ card->info.mac_bits = 0;
+ if (card->discipline) {
+ card->discipline->remove(card->gdev);
+ qeth_core_free_discipline(card);
}
rc = qeth_core_load_discipline(card, newdis);
@@ -705,10 +709,11 @@ static struct attribute *qeth_blkt_devic
&dev_attr_inter_jumbo.attr,
NULL,
};
-static struct attribute_group qeth_device_blkt_group = {
+const struct attribute_group qeth_device_blkt_group = {
.name = "blkt",
.attrs = qeth_blkt_device_attrs,
};
+EXPORT_SYMBOL_GPL(qeth_device_blkt_group);
static struct attribute *qeth_device_attrs[] = {
&dev_attr_state.attr,
@@ -728,9 +733,10 @@ static struct attribute *qeth_device_att
&dev_attr_switch_attrs.attr,
NULL,
};
-static struct attribute_group qeth_device_attr_group = {
+const struct attribute_group qeth_device_attr_group = {
.attrs = qeth_device_attrs,
};
+EXPORT_SYMBOL_GPL(qeth_device_attr_group);
const struct attribute_group *qeth_generic_attr_groups[] = {
&qeth_device_attr_group,
--- a/drivers/s390/net/qeth_l2.h
+++ b/drivers/s390/net/qeth_l2.h
@@ -8,6 +8,8 @@
#include "qeth_core.h"
+extern const struct attribute_group *qeth_l2_attr_groups[];
+
int qeth_l2_create_device_attributes(struct device *);
void qeth_l2_remove_device_attributes(struct device *);
void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card);
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1006,14 +1006,21 @@ static int qeth_l2_stop(struct net_devic
return 0;
}
+static const struct device_type qeth_l2_devtype = {
+ .name = "qeth_layer2",
+ .groups = qeth_l2_attr_groups,
+};
+
static int qeth_l2_probe_device(struct ccwgroup_device *gdev)
{
struct qeth_card *card = dev_get_drvdata(&gdev->dev);
int rc;
- rc = qeth_l2_create_device_attributes(&gdev->dev);
- if (rc)
- return rc;
+ if (gdev->dev.type == &qeth_generic_devtype) {
+ rc = qeth_l2_create_device_attributes(&gdev->dev);
+ if (rc)
+ return rc;
+ }
INIT_LIST_HEAD(&card->vid_list);
hash_init(card->mac_htable);
card->options.layer2 = 1;
@@ -1025,7 +1032,8 @@ static void qeth_l2_remove_device(struct
{
struct qeth_card *card = dev_get_drvdata(&cgdev->dev);
- qeth_l2_remove_device_attributes(&cgdev->dev);
+ if (cgdev->dev.type == &qeth_generic_devtype)
+ qeth_l2_remove_device_attributes(&cgdev->dev);
qeth_set_allowed_threads(card, 0, 1);
wait_event(card->wait_q, qeth_threads_running(card, 0xffffffff) == 0);
@@ -1409,6 +1417,7 @@ static int qeth_l2_control_event(struct
}
struct qeth_discipline qeth_l2_discipline = {
+ .devtype = &qeth_l2_devtype,
.start_poll = qeth_qdio_start_poll,
.input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
.output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
--- a/drivers/s390/net/qeth_l2_sys.c
+++ b/drivers/s390/net/qeth_l2_sys.c
@@ -272,3 +272,11 @@ void qeth_l2_setup_bridgeport_attrs(stru
} else
qeth_bridgeport_an_set(card, 0);
}
+
+const struct attribute_group *qeth_l2_attr_groups[] = {
+ &qeth_device_attr_group,
+ &qeth_device_blkt_group,
+ /* l2 specific, see l2_{create,remove}_device_attributes(): */
+ &qeth_l2_bridgeport_attr_group,
+ NULL,
+};
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3434,6 +3434,7 @@ static int qeth_l3_control_event(struct
}
struct qeth_discipline qeth_l3_discipline = {
+ .devtype = &qeth_generic_devtype,
.start_poll = qeth_qdio_start_poll,
.input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
.output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 007/115] s390/qeth: add missing hash table initializations |
| Message-ID | <tP3wg-5oV-73@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ursula Braun <ubraun@linux.vnet.ibm.com>
[ Upstream commit ebccc7397e4a49ff64c8f44a54895de9d32fe742 ]
commit 5f78e29ceebf ("qeth: optimize IP handling in rx_mode callback")
added new hash tables, but missed to initialize them.
Fixes: 5f78e29ceebf ("qeth: optimize IP handling in rx_mode callback")
Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
Reviewed-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/net/qeth_l3_main.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3158,6 +3158,8 @@ static int qeth_l3_probe_device(struct c
rc = qeth_l3_create_device_attributes(&gdev->dev);
if (rc)
return rc;
+ hash_init(card->ip_htable);
+ hash_init(card->ip_mc_htable);
card->options.layer2 = 0;
card->info.hwtrap = 0;
return 0;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 004/115] s390/qeth: handle sysfs error during initialization |
| Message-ID | <tP3wg-5oV-75@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ursula Braun <ubraun@linux.vnet.ibm.com>
[ Upstream commit 9111e7880ccf419548c7b0887df020b08eadb075 ]
When setting up the device from within the layer discipline's
probe routine, creating the layer-specific sysfs attributes can fail.
Report this error back to the caller, and handle it by
releasing the layer discipline.
Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
[jwi: updated commit msg, moved an OSN change to a subsequent patch]
Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/net/qeth_core_main.c | 4 +++-
drivers/s390/net/qeth_core_sys.c | 2 ++
drivers/s390/net/qeth_l2_main.c | 5 ++++-
drivers/s390/net/qeth_l3_main.c | 5 ++++-
4 files changed, 13 insertions(+), 3 deletions(-)
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -5661,8 +5661,10 @@ static int qeth_core_set_online(struct c
if (rc)
goto err;
rc = card->discipline->setup(card->gdev);
- if (rc)
+ if (rc) {
+ qeth_core_free_discipline(card);
goto err;
+ }
}
rc = card->discipline->set_online(gdev);
err:
--- a/drivers/s390/net/qeth_core_sys.c
+++ b/drivers/s390/net/qeth_core_sys.c
@@ -426,6 +426,8 @@ static ssize_t qeth_dev_layer2_store(str
goto out;
rc = card->discipline->setup(card->gdev);
+ if (rc)
+ qeth_core_free_discipline(card);
out:
mutex_unlock(&card->discipline_mutex);
return rc ? rc : count;
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1009,8 +1009,11 @@ static int qeth_l2_stop(struct net_devic
static int qeth_l2_probe_device(struct ccwgroup_device *gdev)
{
struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+ int rc;
- qeth_l2_create_device_attributes(&gdev->dev);
+ rc = qeth_l2_create_device_attributes(&gdev->dev);
+ if (rc)
+ return rc;
INIT_LIST_HEAD(&card->vid_list);
hash_init(card->mac_htable);
card->options.layer2 = 1;
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3153,8 +3153,11 @@ static int qeth_l3_setup_netdev(struct q
static int qeth_l3_probe_device(struct ccwgroup_device *gdev)
{
struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+ int rc;
- qeth_l3_create_device_attributes(&gdev->dev);
+ rc = qeth_l3_create_device_attributes(&gdev->dev);
+ if (rc)
+ return rc;
card->options.layer2 = 0;
card->info.hwtrap = 0;
return 0;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-06-05 19:00 +0200 |
| Subject | [PATCH 4.11 020/115] net/smc: Add warning about remote memory exposure |
| Message-ID | <tP3wg-5oV-77@gated-at.bofh.it> |
| In reply to | #1657896 |
4.11-stable review patch. If anyone has any objections, please let me know. ------------------ From: Christoph Hellwig <hch@lst.de> [ Upstream commit 19a0f7e37c0761a0a1cbf550705a6063c9675223 ] The driver explicitly bypasses APIs to register all memory once a connection is made, and thus allows remote access to memory. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Leon Romanovsky <leon@kernel.org> Acked-by: Ursula Braun <ubraun@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/smc/Kconfig | 4 ++++ 1 file changed, 4 insertions(+) --- a/net/smc/Kconfig +++ b/net/smc/Kconfig @@ -8,6 +8,10 @@ config SMC The Linux implementation of the SMC-R solution is designed as a separate socket family SMC. + Warning: SMC will expose all memory for remote reads and writes + once a connection is established. Don't enable this option except + for tightly controlled lab environment. + Select this option if you want to run SMC socket applications config SMC_DIAG
[toc] | [prev] | [next] | [standalone]
Page 1 of 2 [1] 2 Next page →
Back to top | Article view | linux.kernel
csiph-web