Commit Graph

739365 Commits

Author SHA1 Message Date
Raghuram Chary J
2d2d99ec13 lan78xx: Crash in lan78xx_writ_reg (Workqueue: events lan78xx_deferred_multicast_write)
Description:
Crash was reported with syzkaller pointing to lan78xx_write_reg routine.

Root-cause:
Proper cleanup of workqueues and init/setup routines was not happening
in failure conditions.

Fix:
Handled the error conditions by cleaning up the queues and init/setup
routines.

Fixes: 55d7de9de6 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Raghuram Chary J <raghuramchary.jallipalli@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-29 11:35:51 -04:00
David S. Miller
020295d95e Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
Steffen Klassert says:

====================
pull request (net): ipsec 2018-03-29

1) Fix a rcu_read_lock/rcu_read_unlock imbalance
   in the error path of xfrm_local_error().
   From Taehee Yoo.

2) Some VTI MTU fixes. From Stefano Brivio.

3) Fix a too early overwritten skb control buffer
   on xfrm transport mode.

Please note that this pull request has a merge conflict
in net/ipv4/ip_tunnel.c.

The conflict is between

commit f6cc9c054e ("ip_tunnel: Emit events for post-register MTU changes")

from the net tree and

commit 24fc79798b ("ip_tunnel: Clamp MTU to bounds on new link")

from the ipsec tree.

It can be solved as it is currently done in linux-next.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-29 10:12:47 -04:00
Linus Torvalds
0b412605ef tegra + amdkfd final fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJavDfaAAoJEAx081l5xIa+PJkQAJJTlmLeXSFhzMyxmBwOEiKl
 jAawsi7tTiJTjKeMwDmBZDbaU6TdlmEiwpwR0GgBvn+Bp7yM7MulSEByQF8lVv19
 fFnakWFyYiCvQyeuPIxXud1z7CihCFYDFhxLdkcB/fSbo9fiCwn07G895HKCY//P
 V6+O+5ghYckVVOYJzXhhPmPQnRAPPAL2vb924lvqQnnfdyufQTpZLsTFdZWIIDSO
 USiD8aLZ/fkyLvgTsOL/Fw2lsX/ToQkgnzciO3h/xMpGy2VY+C1gDe0Fp2KOJZrv
 dXdTGvoUi76z98l5hz+R+aCVBTKFEEtRIYKvpeWmHpZPU1bIoyCCZChQfEw3w13M
 +Vs4trHEixnOkPnHUorfUW+dPZRBvKqKXUDEBFdI3zUqaU7oWo2uWpKFqwvlu8GJ
 /MdMBDPFTy3RVCbecpEprTTtIXMJiNkNSod3rsGjEHxIZPSGUUYNGwqUh+9ZeGSf
 3GR3uIACKyizrLNRQfR8168XMGDwOYg8CNIu1gn1wzJeu6BSJR9OAH/UPpqybXUh
 zICNJp6JrHe2A49JorfO+UjI3vVk+4DhjrFXmRjrykMiftz0xF2TrGmYe3/6QsQ+
 WjUqFgSZmNP6JIeblfNpGA1J/FztJHDtfZfY52qPGweOx0nJMb4NLJCMIr3ulrQC
 5d7Cgz7KyOPD7JqnJCTL
 =oXU3
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-for-v4.16-rc8' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:
 "Nothing serious, two amdkfd and two tegra fixes"

* tag 'drm-fixes-for-v4.16-rc8' of git://people.freedesktop.org/~airlied/linux:
  drm/tegra: dc: Using NULL instead of plain integer
  drm/amdkfd: Deallocate SDMA queues correctly
  drm/amdkfd: Fix scratch memory with HWS enabled
  drm/tegra: dc: Use correct format array for Tegra124
2018-03-28 15:07:23 -10:00
Masahiro Yamada
28913ee819 netfilter: nf_nat_snmp_basic: add correct dependency to Makefile
nf_nat_snmp_basic_main.c includes a generated header, but the
necessary dependency is missing in Makefile. This could cause
build error in parallel building.

Remove a weird line, and add a correct one.

Fixes: cc2d58634e ("netfilter: nf_nat_snmp_basic: use asn1 decoder library")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2018-03-29 09:42:32 +09:00
Linus Torvalds
68b8dffce6 Merge branch 'akpm' (patches from Andrew)
Merge misc fixes from Andrew Morton:
 "8 fixes"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  MAINTAINERS: demote ARM port to "odd fixes"
  MAINTAINERS: correct rmk's email address
  mm/kmemleak.c: wait for scan completion before disabling free
  mm/memcontrol.c: fix parameter description mismatch
  mm/vmstat.c: fix vmstat_update() preemption BUG
  mm/page_owner: fix recursion bug after changing skip entries
  ipc/shm.c: add split function to shm_vm_ops
  mm, slab: memcg_link the SLAB's kmem_cache
2018-03-28 14:34:55 -10:00
Dave Airlie
ef55d1538d drm/tegra: Fixes for v4.16
This contains two small fixes, one which fixes a typo that causes a
 crash with the new framebuffer modifier query support and another that
 fixes a build warning.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCAAxFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAlq7sZkTHHRyZWRpbmdA
 bnZpZGlhLmNvbQAKCRDdI6zXfz6zofC6D/9hGJTvHS4ILI8pf1uoVFxFKkviIsXg
 803H9VYavBm5PVBDIbEa1jw/TPjMBnaqzIH3MAjwxF57gaiFQzlnkaXEd9XZZAXf
 AywOU3ONbVXkDunYr1zU2SyhluCnWYroOAJMzo0VVhOhymoC0q6QH+CI88+EtI53
 MnELeFieRspFdzB1dX4Hxn0HoMZ8jXdnn4Jr2/LD+Da8hLfXGvEZPwBYj5WPgGRi
 vKT8KMRngtbka44ymQfD6oxEpgvaEJSZ1wnfXl4guW9SnRTUq33KTgW4xlMPw/2+
 //H7clEvmE61FsiNbnBqXfyRSsnUq90yI+QBrmvNFY1H8iqvfRleYE/kY0R8o5eg
 lb9822mPCu9B6DDukP4hz5pPS7iX9m4V+9CF9pPkG3PX+ogZAOfZ05odIGuoxICU
 EvVY5uQuksleEu6YbgfyZStGutLPxqoJ4ocMkAQRWRLeNIUf2jHssdfQqwUvD1gr
 9RcoZtBO5xtN1ro+rvAx3bvetuN+rFae7TYe6oG9X/aOVCVmsrRwORa9143HiKfK
 5/62rugC5gGJz4dUZKMcMjfswTLjzaHg6Te27yFhm945hobuSkaiB3MUjgdXmXNZ
 G8enRnZrL2GhAsqRvCkwISHHMNX8j7QQ94bkzc4Tm/vlnxBm3o8REW9xRk+Mjm0o
 hOHROiAaJ2nDhw==
 =vROp
 -----END PGP SIGNATURE-----

Merge tag 'drm/tegra/for-4.16-fixes' of git://anongit.freedesktop.org/tegra/linux into drm-fixes

drm/tegra: Fixes for v4.16

This contains two small fixes, one which fixes a typo that causes a
crash with the new framebuffer modifier query support and another that
fixes a build warning.

* tag 'drm/tegra/for-4.16-fixes' of git://anongit.freedesktop.org/tegra/linux:
  drm/tegra: dc: Using NULL instead of plain integer
  drm/tegra: dc: Use correct format array for Tegra124
2018-03-29 09:57:09 +10:00
Linus Torvalds
a2601d78b7 powerpc fixes for 4.16 #6
These are actually all fixes for pre-4.16 code, or new hardware workarounds.
 
 Fix missing AT_BASE_PLATFORM (in auxv) when we're using a new firmware interface
 for describing CPU features.
 
 Fix lost pending interrupts due to a race in our interrupt soft-masking code.
 
 A workaround for a nest MMU bug with TLB invalidations on Power9.
 
 A workaround for broadcast TLB invalidations on Power9.
 
 Fix a bug in our instruction SLB miss handler, when handling bad addresses
 (eg. >= TASK_SIZE), which could corrupt non-volatile user GPRs.
 
 Thanks to:
   Aneesh Kumar K.V, Balbir Singh, Benjamin Herrenschmidt, Nicholas Piggin.
 -----BEGIN PGP SIGNATURE-----
 
 iQIwBAABCAAaBQJau3wfExxtcGVAZWxsZXJtYW4uaWQuYXUACgkQUevqPMjhpYCz
 dA/+JnB5iKCXCCebnqoaX4AFTqMfxT3nr/+JkfchovZLV0PBVzKME5JtL61udmDe
 j1JZU8UASLqN/8/j652s87XuuRi6xPjSPjMNXmU1LFQ7DjS9yA6FOAsbE4c1Xg4D
 jSded2BSnMRtA/yw8AupvdYr4w72zKMQYzo8/Or3eUQAAge+oX3d1SQiRkD3DOUg
 EdpHnOScSwz6GL9amfaQBhXwvik+4crTQ/wZ/SsTpQrfJkVzHXLn/DnHEP1qO+ky
 v/Y0ix5TxpH132XsVM7UaUvy1ZcZSyEmT2qGOisGm0fj4jesVn9dQMzP+97W4QeW
 ghfHj2fvzx6IsPM3PhNKITknQi/GTrukjSuzYNuj7MyvKY15HUP1MPXNeJUl5thw
 kI5uYWuTvyI3daQKFXRQa7V6H0auuYeEV6/RvIlJ2YtUfqmvyECviNM/+mDC0+Jk
 bgqz47qqeEz2cwIUu/vQm2phVpq+15cLPwmdA37IdyT6GvYgGmsW4HWVIsyxLR2z
 fo9ghX+1oMhmMNhgVYtL2P9BfCzQenK2R+uAmUOHdNyc0LBlGKN+RPAQqQkBhKGp
 BB1L2F13kpeNBNTOsPU4yH3DpPaJFtfnaeL7jd5SanwsxNnoKApFglf0nE73bvbw
 AwRF/vWokbd3WzuPmOtldtluWUHQhaLECU24odVGB/r3XCI=
 =qP8V
 -----END PGP SIGNATURE-----

Merge tag 'powerpc-4.16-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Pull powerpc fixes from Michael Ellerman:
 "Some more powerpc fixes for 4.16. Apologies if this is a bit big at
  rc7, but they're all reasonably important fixes. None are actually for
  new code, so they aren't indicative of 4.16 being in bad shape from
  our point of view.

   - Fix missing AT_BASE_PLATFORM (in auxv) when we're using a new
     firmware interface for describing CPU features.

   - Fix lost pending interrupts due to a race in our interrupt
     soft-masking code.

   - A workaround for a nest MMU bug with TLB invalidations on Power9.

   - A workaround for broadcast TLB invalidations on Power9.

   - Fix a bug in our instruction SLB miss handler, when handling bad
     addresses (eg. >= TASK_SIZE), which could corrupt non-volatile user
     GPRs.

  Thanks to: Aneesh Kumar K.V, Balbir Singh, Benjamin Herrenschmidt,
  Nicholas Piggin"

* tag 'powerpc-4.16-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/64s: Fix i-side SLB miss bad address handler saving nonvolatile GPRs
  powerpc/mm: Fixup tlbie vs store ordering issue on POWER9
  powerpc/mm/radix: Move the functions that does the actual tlbie closer
  powerpc/mm/radix: Remove unused code
  powerpc/mm: Workaround Nest MMU bug with TLB invalidations
  powerpc/mm: Add tracking of the number of coprocessors using a context
  powerpc/64s: Fix lost pending interrupt due to race causing lost update to irq_happened
  powerpc/64s: Fix NULL AT_BASE_PLATFORM when using DT CPU features
2018-03-28 13:54:03 -10:00
Linus Torvalds
616d8cf0fa ARM: SoC fixes for 4.16
Here are are a couple of last-minute fixes for 4.16, mostly for
 regressions. As usual, the majory are device tree changes:
 
 - USB 3 support on rk3399 didn't work and is being reverted for now
 
 - One fix for an old suspend/resume bug on rk3399
 
 - A few regulator related fixes on Banana Pi M2, and on imx7d-sdb
 
 - A boot regression fix for all Aspeed SoCs failing to find
   their memory
 
 - One more dtc warning fix
 
 The other changes are:
 
 - A few updates to the MAINTAINERS file
 
 - A revert for an incorrect orion5x cleanup
 
 - Two power management fixes for OMAP
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJau+0YAAoJEGCrR//JCVInPu4P/2cGvKWc7SIARWTFpfadIkbM
 X4O+emNsPhYW3Nr2XRIq8JHxHVRzxVtNWeXEpbpX2uOpv/w9AUt3amyrIpdZ3oHh
 IWdDhX9b4gEU85mWAVCstWmsH4gioBC+LW3cn+GSSFrvQBXJUWHMkDqnLa2GSq32
 NSwvhYQLEpQeJPYQUtZKCt2L73UV1JWhHspMnuAEANZ+D2MbQ0iFKVM+mctkpxKE
 m8pFcGP7yBFm/5SADVo9MKnfqEa2IL5wCUbVz54xC6P+3v/DzgxgQG2dUXVVucBV
 arl+VECHh7IVDX9lxNzMkBUvfRd45dXWuHnf+lx9FE5nVs6OpypuSIrE5xunNeD7
 o0APtfjYbqZA62ZFRKP//3A1/CuyxQxK7PSzMXFO0G8QNleobJBcxsCEhOBLSGc5
 DrGzxtEGKUolY3l+d5VYA9EXlbmc1BWK5zGGWIJ7Id1v/KU54Kj+kIGxs7QDnIKC
 bPy4dw1bV8RzGIEJJcOPuGtdxtWBsHXTcvgXXrMMqPbYi6H3Bh2H+ezpYs9aLUF0
 8ejbPF1ekjN5prsxpWIGxUAd5BluIk5mpvFcYqm2oOkYfolo2yM5oLv91xrjuY68
 xQKr86oJU9Mcyc7IVNbN4L3iUu3MjDxB1p4zGao7ofD52lcsqvxx/P2Nnk0rifg9
 ClZFDtGkPp/76v5bXHb3
 =qZnT
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC fixes from Arnd Bergmann:
 "Here are are a couple of last-minute fixes for 4.16, mostly for
  regressions. As usual, the majory are device tree changes:

   - USB 3 support on rk3399 didn't work and is being reverted for now

   - One fix for an old suspend/resume bug on rk3399

   - A few regulator related fixes on Banana Pi M2, and on imx7d-sdb

   - A boot regression fix for all Aspeed SoCs failing to find their
     memory

   - One more dtc warning fix

  The other changes are:

   - A few updates to the MAINTAINERS file

   - A revert for an incorrect orion5x cleanup

   - Two power management fixes for OMAP"

* tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: OMAP: Fix SRAM W+X mapping
  ARM: dts: aspeed: Add default memory node
  mailmap: Update email address for Gregory CLEMENT
  ARM: davinci: fix the GPIO lookup for omapl138-hawk
  MAINTAINERS: Update Tegra IOMMU maintainer
  ARM: dts: imx7d-sdb: Fix regulator-usb-otg2-vbus node name
  ARM: ux500: Fix PMU IRQ regression
  ARM: dts: rockchip: Add missing #sound-dai-cells on rk3288
  Revert "arm64: dts: rockchip: add usb3-phy otg-port support for rk3399"
  arm64: dts: rockchip: Fix rk3399-gru-* s2r (pinctrl hogs, wifi reset)
  ARM: OMAP: Fix dmtimer init for omap1
  MAINTAINERS: update email address for Maxime Ripard
  ARM: dts: sun6i: a31s: bpi-m2: add missing regulators
  ARM: dts: sun6i: a31s: bpi-m2: improve pmic properties
2018-03-28 13:52:13 -10:00
Russell King
18bd49043c MAINTAINERS: demote ARM port to "odd fixes"
As of the start of 2018, I am no longer paid to support the core 32-bit
ARM architecture code.  This means that this code is no longer
commercially supported, and is now only supported through voluntary
effort.

I will continue to merge patches as and when able, but this will be at a
lower priority than before (which means a longer latency.) I have also
be scaled back the amount of time spent reading email, so email that is
intended for my attention needs to make itself plainly obvious, or I
will miss it.

In an attempt to reduce the amount of email Cc'd to me, exclude
arch/arm/boot/dts from the maintainers patterns, but add entries for the
SolidRun platforms I look after.

Link: http://lkml.kernel.org/r/E1ezkgn-0002fO-52@rmk-PC.armlinux.org.uk
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-03-28 13:42:06 -10:00
Russell King
5b634e8e38 MAINTAINERS: correct rmk's email address
Correct my email address in the MAINTAINTERS file.

Link: http://lkml.kernel.org/r/E1ezkgi-0002fH-01@rmk-PC.armlinux.org.uk
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-03-28 13:42:05 -10:00
Vinayak Menon
914b6dfff7 mm/kmemleak.c: wait for scan completion before disabling free
A crash is observed when kmemleak_scan accesses the object->pointer,
likely due to the following race.

  TASK A             TASK B                     TASK C
  kmemleak_write
   (with "scan" and
   NOT "scan=on")
  kmemleak_scan()
                     create_object
                     kmem_cache_alloc fails
                     kmemleak_disable
                     kmemleak_do_cleanup
                     kmemleak_free_enabled = 0
                                                kfree
                                                kmemleak_free bails out
                                                 (kmemleak_free_enabled is 0)
                                                slub frees object->pointer
  update_checksum
  crash - object->pointer
   freed (DEBUG_PAGEALLOC)

kmemleak_do_cleanup waits for the scan thread to complete, but not for
direct call to kmemleak_scan via kmemleak_write.  So add a wait for
kmemleak_scan completion before disabling kmemleak_free, and while at it
fix the comment on stop_scan_thread.

[vinmenon@codeaurora.org: fix stop_scan_thread comment]
  Link: http://lkml.kernel.org/r/1522219972-22809-1-git-send-email-vinmenon@codeaurora.org
Link: http://lkml.kernel.org/r/1522063429-18992-1-git-send-email-vinmenon@codeaurora.org
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-03-28 13:42:05 -10:00
Honglei Wang
b213b54fbf mm/memcontrol.c: fix parameter description mismatch
There are a couple of places where parameter description and function
name do not match the actual code.  Fix it.

Link: http://lkml.kernel.org/r/1520843448-17347-1-git-send-email-honglei.wang@oracle.com
Signed-off-by: Honglei Wang <honglei.wang@oracle.com>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-03-28 13:42:05 -10:00
Steven J. Hill
c7f26ccfb2 mm/vmstat.c: fix vmstat_update() preemption BUG
Attempting to hotplug CPUs with CONFIG_VM_EVENT_COUNTERS enabled can
cause vmstat_update() to report a BUG due to preemption not being
disabled around smp_processor_id().

Discovered on Ubiquiti EdgeRouter Pro with Cavium Octeon II processor.

  BUG: using smp_processor_id() in preemptible [00000000] code:
  kworker/1:1/269
  caller is vmstat_update+0x50/0xa0
  CPU: 0 PID: 269 Comm: kworker/1:1 Not tainted
  4.16.0-rc4-Cavium-Octeon-00009-gf83bbd5-dirty #1
  Workqueue: mm_percpu_wq vmstat_update
  Call Trace:
    show_stack+0x94/0x128
    dump_stack+0xa4/0xe0
    check_preemption_disabled+0x118/0x120
    vmstat_update+0x50/0xa0
    process_one_work+0x144/0x348
    worker_thread+0x150/0x4b8
    kthread+0x110/0x140
    ret_from_kernel_thread+0x14/0x1c

Link: http://lkml.kernel.org/r/1520881552-25659-1-git-send-email-steven.hill@cavium.com
Signed-off-by: Steven J. Hill <steven.hill@cavium.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Tejun Heo <htejun@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-03-28 13:42:05 -10:00
Maninder Singh
299815a4fb mm/page_owner: fix recursion bug after changing skip entries
This patch fixes commit 5f48f0bd4e ("mm, page_owner: skip unnecessary
stack_trace entries").

Because if we skip first two entries then logic of checking count value
as 2 for recursion is broken and code will go in one depth recursion.

so we need to check only one call of _RET_IP(__set_page_owner) while
checking for recursion.

Current Backtrace while checking for recursion:-

  (save_stack)             from (__set_page_owner)  // (But recursion returns true here)
  (__set_page_owner)       from (get_page_from_freelist)
  (get_page_from_freelist) from (__alloc_pages_nodemask)
  (__alloc_pages_nodemask) from (depot_save_stack)
  (depot_save_stack)       from (save_stack)       // recursion should return true here
  (save_stack)             from (__set_page_owner)
  (__set_page_owner)       from (get_page_from_freelist)
  (get_page_from_freelist) from (__alloc_pages_nodemask+)
  (__alloc_pages_nodemask) from (depot_save_stack)
  (depot_save_stack)       from (save_stack)
  (save_stack)             from (__set_page_owner)
  (__set_page_owner)       from (get_page_from_freelist)

Correct Backtrace with fix:

  (save_stack)             from (__set_page_owner) // recursion returned true here
  (__set_page_owner)       from (get_page_from_freelist)
  (get_page_from_freelist) from (__alloc_pages_nodemask+)
  (__alloc_pages_nodemask) from (depot_save_stack)
  (depot_save_stack)       from (save_stack)
  (save_stack)             from (__set_page_owner)
  (__set_page_owner)       from (get_page_from_freelist)

Link: http://lkml.kernel.org/r/1521607043-34670-1-git-send-email-maninder1.s@samsung.com
Fixes: 5f48f0bd4e ("mm, page_owner: skip unnecessary stack_trace entries")
Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
Signed-off-by: Vaneet Narang <v.narang@samsung.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Oscar Salvador <osalvador@techadventures.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Ayush Mittal <ayush.m@samsung.com>
Cc: Prakash Gupta <guptap@codeaurora.org>
Cc: Vinayak Menon <vinmenon@codeaurora.org>
Cc: Vasyl Gomonovych <gomonovych@gmail.com>
Cc: Amit Sahrawat <a.sahrawat@samsung.com>
Cc: <pankaj.m@samsung.com>
Cc: Vaneet Narang <v.narang@samsung.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-03-28 13:42:05 -10:00
Mike Kravetz
3d942ee079 ipc/shm.c: add split function to shm_vm_ops
If System V shmget/shmat operations are used to create a hugetlbfs
backed mapping, it is possible to munmap part of the mapping and split
the underlying vma such that it is not huge page aligned.  This will
untimately result in the following BUG:

  kernel BUG at /build/linux-jWa1Fv/linux-4.15.0/mm/hugetlb.c:3310!
  Oops: Exception in kernel mode, sig: 5 [#1]
  LE SMP NR_CPUS=2048 NUMA PowerNV
  Modules linked in: kcm nfc af_alg caif_socket caif phonet fcrypt
  CPU: 18 PID: 43243 Comm: trinity-subchil Tainted: G         C  E 4.15.0-10-generic #11-Ubuntu
  NIP:  c00000000036e764 LR: c00000000036ee48 CTR: 0000000000000009
  REGS: c000003fbcdcf810 TRAP: 0700   Tainted: G         C  E (4.15.0-10-generic)
  MSR:  9000000000029033 <SF,HV,EE,ME,IR,DR,RI,LE>  CR: 24002222  XER: 20040000
  CFAR: c00000000036ee44 SOFTE: 1
  NIP __unmap_hugepage_range+0xa4/0x760
  LR __unmap_hugepage_range_final+0x28/0x50
  Call Trace:
    0x7115e4e00000 (unreliable)
    __unmap_hugepage_range_final+0x28/0x50
    unmap_single_vma+0x11c/0x190
    unmap_vmas+0x94/0x140
    exit_mmap+0x9c/0x1d0
    mmput+0xa8/0x1d0
    do_exit+0x360/0xc80
    do_group_exit+0x60/0x100
    SyS_exit_group+0x24/0x30
    system_call+0x58/0x6c
  ---[ end trace ee88f958a1c62605 ]---

This bug was introduced by commit 31383c6865 ("mm, hugetlbfs:
introduce ->split() to vm_operations_struct").  A split function was
added to vm_operations_struct to determine if a mapping can be split.
This was mostly for device-dax and hugetlbfs mappings which have
specific alignment constraints.

Mappings initiated via shmget/shmat have their original vm_ops
overwritten with shm_vm_ops.  shm_vm_ops functions will call back to the
original vm_ops if needed.  Add such a split function to shm_vm_ops.

Link: http://lkml.kernel.org/r/20180321161314.7711-1-mike.kravetz@oracle.com
Fixes: 31383c6865 ("mm, hugetlbfs: introduce ->split() to vm_operations_struct")
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Reported-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Reviewed-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Tested-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-03-28 13:42:05 -10:00
Shakeel Butt
880cd276df mm, slab: memcg_link the SLAB's kmem_cache
All the root caches are linked into slab_root_caches which was
introduced by the commit 510ded33e0 ("slab: implement slab_root_caches
list") but it missed to add the SLAB's kmem_cache.

While experimenting with opt-in/opt-out kmem accounting, I noticed
system crashes due to NULL dereference inside cache_from_memcg_idx()
while deferencing kmem_cache.memcg_params.memcg_caches.  The upstream
clean kernel will not see these crashes but SLAB should be consistent
with SLUB which does linked its boot caches (kmem_cache_node and
kmem_cache) into slab_root_caches.

Link: http://lkml.kernel.org/r/20180319210020.60289-1-shakeelb@google.com
Fixes: 510ded33e0 ("slab: implement slab_root_caches list")
Signed-off-by: Shakeel Butt <shakeelb@google.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Greg Thelen <gthelen@google.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-03-28 13:42:05 -10:00
Roland Dreier
84652aefb3 RDMA/ucma: Introduce safer rdma_addr_size() variants
There are several places in the ucma ABI where userspace can pass in a
sockaddr but set the address family to AF_IB.  When that happens,
rdma_addr_size() will return a size bigger than sizeof struct sockaddr_in6,
and the ucma kernel code might end up copying past the end of a buffer
not sized for a struct sockaddr_ib.

Fix this by introducing new variants

    int rdma_addr_size_in6(struct sockaddr_in6 *addr);
    int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr);

that are type-safe for the types used in the ucma ABI and return 0 if the
size computed is bigger than the size of the type passed in.  We can use
these new variants to check what size userspace has passed in before
copying any addresses.

Reported-by: <syzbot+6800425d54ed3ed8135d@syzkaller.appspotmail.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2018-03-28 16:13:36 -06:00
mike.travis@hpe.com
bd47a85acd x86/platform/UV: Fix critical UV MMR address error
A critical error was found testing the fixed UV4 HUB in that an MMR address
was found to be incorrect.  This causes the virtual address space for
accessing the MMIOH1 region to be allocated with the incorrect size.

Fixes: 673aa20c55 ("x86/platform/UV: Update uv_mmrs.h to prepare for UV4A fixes")
Signed-off-by: Mike Travis <travis@sgi.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Dimitri Sivanich <dimitri.sivanich@hpe.com>
Cc: Russ Anderson <russ.anderson@hpe.com>
Cc: Andrew Banman <andrew.banman@hpe.com>
Link: https://lkml.kernel.org/r/20180328174011.041801248@stormcage.americas.sgi.com
2018-03-28 20:19:45 +02:00
Linus Torvalds
f67b15037a perf/hwbp: Simplify the perf-hwbp code, fix documentation
Annoyingly, modify_user_hw_breakpoint() unnecessarily complicates the
modification of a breakpoint - simplify it and remove the pointless
local variables.

Also update the stale Docbook while at it.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2018-03-28 17:41:50 +02:00
Wei Yongjun
ef1b204a70 drm/tegra: dc: Using NULL instead of plain integer
Fixes the following sparse warnings:

drivers/gpu/drm/tegra/dc.c:2181:69: warning:
  Using plain integer as NULL pointer

Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2018-03-28 17:01:13 +02:00
Wanpeng Li
17a1079d9c KVM: x86: Fix pv tlb flush dependencies
PV TLB FLUSH can only be turned on when steal time is enabled.
The condition got reversed during conflict resolution.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
Fixes: 4f2f61fc50 ("KVM: X86: Avoid traversing all the cpus for pv tlb flush when steal time is disabled")
[Rebased on top of kvm/master and reworded the commit message. - Radim]
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
2018-03-28 15:53:34 +02:00
Andrew Banman
151ad17fbe x86/platform/uv/BAU: Add APIC idt entry
BAU uses the old alloc_initr_gate90 method to setup its interrupt. This
fails silently as the BAU vector is in the range of APIC vectors that are
registered to the spurious interrupt handler. As a consequence BAU
broadcasts are not handled, and the broadcast source CPU hangs.

Update BAU to use new idt structure.

Fixes: dc20b2d526 ("x86/idt: Move interrupt gate initialization to IDT code")
Signed-off-by: Andrew Banman <abanman@hpe.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Mike Travis <mike.travis@hpe.com>
Cc: Dimitri Sivanich <sivanich@hpe.com>
Cc: Russ Anderson <rja@hpe.com>
Cc: stable@vger.kernel.org
Cc: "H. Peter Anvin" <hpa@zytor.com>
Link: https://lkml.kernel.org/r/1522188546-196177-1-git-send-email-abanman@hpe.com
2018-03-28 10:40:55 +02:00
Linus Torvalds
d2b35e0042 Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm
Pull ARM fixes from Russell King:
 "A small number of small fixes for ARM, mostly for some build issues.

  One fix for a regression caused by the cpu hotplug conversion from a
  few kernel versions ago"

* 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm:
  ARM: 8750/1: deflate_xip_data.sh: minor fixes
  ARM: 8748/1: mm: Define vdso_start, vdso_end as array
  ARM: 8747/1: make CONFIG_DEBUG_WX depend on MMU
  ARM: 8746/1: vfp: Go back to clearing vfp_current_hw_state[]
2018-03-27 14:28:40 -10:00
Linus Torvalds
fd9adc402b SCSI fixes on 20180327
Two driver fixes (ibmvfc, iscsi_tcp) and a USB fix for devices that
 give the wrong return to Read Capacity and cause a huge log spew.  The
 remaining 5 patches all try to fix commit 84676c1f21
 "genirq/affinity: assign vectors to all possible CPUs") which broke
 the non-mq I/O path.
 
 Signed-off-by: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCWrpSmyYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishY+MAP9Zvin/
 AUc3xkvOPdIzRPp2aXQHJKC+NGmNFr6MiXIHiAD/TvjbkxEjbUTjnr+gZNaloDma
 d/I4i9xaBNSvqNJpzT0=
 =mLIX
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Two driver fixes (ibmvfc, iscsi_tcp) and a USB fix for devices that
  give the wrong return to Read Capacity and cause a huge log spew.

  The remaining five patches all try to fix commit 84676c1f21
  ("genirq/affinity: assign vectors to all possible CPUs") which broke
  the non-mq I/O path"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: iscsi_tcp: set BDI_CAP_STABLE_WRITES when data digest enabled
  scsi: sd: Remember that READ CAPACITY(16) succeeded
  scsi: ibmvfc: Avoid unnecessary port relogin
  scsi: virtio_scsi: unify scsi_host_template
  scsi: virtio_scsi: fix IO hang caused by automatic irq vector affinity
  scsi: core: introduce force_blk_mq
  scsi: megaraid_sas: fix selection of reply queue
  scsi: hpsa: fix selection of reply queue
2018-03-27 14:11:46 -10:00
Colin Ian King
38759d6175 RDMA/hns: ensure for-loop actually iterates and free's buffers
The current for-loop zeros variable i and only loops once, hence
not all the buffers are free'd.  Fix this by setting i correctly.

Detected by CoverityScan, CID#1463415 ("Operands don't affect result")

Fixes: a5073d6054 ("RDMA/hns: Add eq support of hip08")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Yixian Liu <liuyixian@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2018-03-27 15:06:34 -06:00
Leon Romanovsky
c8d3bcbfc5 RDMA/ucma: Check that device exists prior to accessing it
Ensure that device exists prior to accessing its properties.

Reported-by: <syzbot+71655d44855ac3e76366@syzkaller.appspotmail.com>
Fixes: 7521663857 ("RDMA/cma: Export rdma cm interface to userspace")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2018-03-27 14:10:45 -06:00
Leon Romanovsky
4b658d1bbc RDMA/ucma: Check that device is connected prior to access it
Add missing check that device is connected prior to access it.

[   55.358652] BUG: KASAN: null-ptr-deref in rdma_init_qp_attr+0x4a/0x2c0
[   55.359389] Read of size 8 at addr 00000000000000b0 by task qp/618
[   55.360255]
[   55.360432] CPU: 1 PID: 618 Comm: qp Not tainted 4.16.0-rc1-00071-gcaf61b1b8b88 #91
[   55.361693] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014
[   55.363264] Call Trace:
[   55.363833]  dump_stack+0x5c/0x77
[   55.364215]  kasan_report+0x163/0x380
[   55.364610]  ? rdma_init_qp_attr+0x4a/0x2c0
[   55.365238]  rdma_init_qp_attr+0x4a/0x2c0
[   55.366410]  ucma_init_qp_attr+0x111/0x200
[   55.366846]  ? ucma_notify+0xf0/0xf0
[   55.367405]  ? _get_random_bytes+0xea/0x1b0
[   55.367846]  ? urandom_read+0x2f0/0x2f0
[   55.368436]  ? kmem_cache_alloc_trace+0xd2/0x1e0
[   55.369104]  ? refcount_inc_not_zero+0x9/0x60
[   55.369583]  ? refcount_inc+0x5/0x30
[   55.370155]  ? rdma_create_id+0x215/0x240
[   55.370937]  ? _copy_to_user+0x4f/0x60
[   55.371620]  ? mem_cgroup_commit_charge+0x1f5/0x290
[   55.372127]  ? _copy_from_user+0x5e/0x90
[   55.372720]  ucma_write+0x174/0x1f0
[   55.373090]  ? ucma_close_id+0x40/0x40
[   55.373805]  ? __lru_cache_add+0xa8/0xd0
[   55.374403]  __vfs_write+0xc4/0x350
[   55.374774]  ? kernel_read+0xa0/0xa0
[   55.375173]  ? fsnotify+0x899/0x8f0
[   55.375544]  ? fsnotify_unmount_inodes+0x170/0x170
[   55.376689]  ? __fsnotify_update_child_dentry_flags+0x30/0x30
[   55.377522]  ? handle_mm_fault+0x174/0x320
[   55.378169]  vfs_write+0xf7/0x280
[   55.378864]  SyS_write+0xa1/0x120
[   55.379270]  ? SyS_read+0x120/0x120
[   55.379643]  ? mm_fault_error+0x180/0x180
[   55.380071]  ? task_work_run+0x7d/0xd0
[   55.380910]  ? __task_pid_nr_ns+0x120/0x140
[   55.381366]  ? SyS_read+0x120/0x120
[   55.381739]  do_syscall_64+0xeb/0x250
[   55.382143]  entry_SYSCALL_64_after_hwframe+0x21/0x86
[   55.382841] RIP: 0033:0x7fc2ef803e99
[   55.383227] RSP: 002b:00007fffcc5f3be8 EFLAGS: 00000217 ORIG_RAX: 0000000000000001
[   55.384173] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc2ef803e99
[   55.386145] RDX: 0000000000000057 RSI: 0000000020000080 RDI: 0000000000000003
[   55.388418] RBP: 00007fffcc5f3c00 R08: 0000000000000000 R09: 0000000000000000
[   55.390542] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000400480
[   55.392916] R13: 00007fffcc5f3cf0 R14: 0000000000000000 R15: 0000000000000000
[   55.521088] Code: e5 4d 1e ff 48 89 df 44 0f b6 b3 b8 01 00 00 e8 65 50 1e ff 4c 8b 2b 49
8d bd b0 00 00 00 e8 56 50 1e ff 41 0f b6 c6 48 c1 e0 04 <49> 03 85 b0 00 00 00 48 8d 78 08
48 89 04 24 e8 3a 4f 1e ff 48
[   55.525980] RIP: rdma_init_qp_attr+0x52/0x2c0 RSP: ffff8801e2c2f9d8
[   55.532648] CR2: 00000000000000b0
[   55.534396] ---[ end trace 70cee64090251c0b ]---

Fixes: 7521663857 ("RDMA/cma: Export rdma cm interface to userspace")
Fixes: d541e45500 ("IB/core: Convert ah_attr from OPA to IB when copying to user")
Reported-by: <syzbot+7b62c837c2516f8f38c8@syzkaller.appspotmail.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2018-03-27 14:10:45 -06:00
Jason Gunthorpe
9137108cc3 RDMA/rdma_cm: Fix use after free race with process_one_req
process_one_req() can race with rdma_addr_cancel():

           CPU0                                 CPU1
           ====                                 ====
 process_one_work()
  debug_work_deactivate(work);
  process_one_req()
                                        rdma_addr_cancel()
	                                  mutex_lock(&lock);
 			    	           set_timeout(&req->work,..);
                                              __queue_work()
				   	       debug_work_activate(work);
	                                  mutex_unlock(&lock);

   mutex_lock(&lock);
[..]
	list_del(&req->list);
   mutex_unlock(&lock);
[..]

   // ODEBUG explodes since the work is still queued.
   kfree(req);

Causing ODEBUG to detect the use after free:

ODEBUG: free active (active state 0) object type: work_struct hint: process_one_req+0x0/0x6c0 include/net/dst.h:165
WARNING: CPU: 0 PID: 79 at lib/debugobjects.c:291 debug_print_object+0x166/0x220 lib/debugobjects.c:288
kvm: emulating exchange as write
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 79 Comm: kworker/u4:3 Not tainted 4.16.0-rc6+ #361
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: ib_addr process_one_req
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x24d lib/dump_stack.c:53
 panic+0x1e4/0x41c kernel/panic.c:183
 __warn+0x1dc/0x200 kernel/panic.c:547
 report_bug+0x1f4/0x2b0 lib/bug.c:186
 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
 fixup_bug arch/x86/kernel/traps.c:247 [inline]
 do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:986
RIP: 0010:debug_print_object+0x166/0x220 lib/debugobjects.c:288
RSP: 0000:ffff8801d966f210 EFLAGS: 00010086
RAX: dffffc0000000008 RBX: 0000000000000003 RCX: ffffffff815acd6e
RDX: 0000000000000000 RSI: 1ffff1003b2cddf2 RDI: 0000000000000000
RBP: ffff8801d966f250 R08: 0000000000000000 R09: 1ffff1003b2cddc8
R10: ffffed003b2cde71 R11: ffffffff86f39a98 R12: 0000000000000001
R13: ffffffff86f15540 R14: ffffffff86408700 R15: ffffffff8147c0a0
 __debug_check_no_obj_freed lib/debugobjects.c:745 [inline]
 debug_check_no_obj_freed+0x662/0xf1f lib/debugobjects.c:774
 kfree+0xc7/0x260 mm/slab.c:3799
 process_one_req+0x2e7/0x6c0 drivers/infiniband/core/addr.c:592
 process_one_work+0xc47/0x1bb0 kernel/workqueue.c:2113
 worker_thread+0x223/0x1990 kernel/workqueue.c:2247
 kthread+0x33c/0x400 kernel/kthread.c:238
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:406

Fixes: 5fff41e1f8 ("IB/core: Fix race condition in resolving IP to MAC")
Reported-by: <syzbot+3b4acab09b6463472d0a@syzkaller.appspotmail.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2018-03-27 13:19:01 -06:00
Manish Chopra
b9fc828deb qede: Fix barrier usage after tx doorbell write.
Since commit c5ad119fb6
("net: sched: pfifo_fast use skb_array") driver is exposed
to an issue where it is hitting NULL skbs while handling TX
completions. Driver uses mmiowb() to flush the writes to the
doorbell bar which is a write-combined bar, however on x86
mmiowb() does not flush the write combined buffer.

This patch fixes this problem by replacing mmiowb() with wmb()
after the write combined doorbell write so that writes are
flushed and synchronized from more than one processor.

V1->V2:
-------
This patch was marked as "superseded" in patchwork.
(Not really sure for what reason).Resending it as v2.

Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
Signed-off-by: Manish Chopra <manish.chopra@cavium.com>

Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 13:11:46 -04:00
Jason Wang
dc6455a71c vhost: correctly remove wait queue during poll failure
We tried to remove vq poll from wait queue, but do not check whether
or not it was in a list before. This will lead double free. Fixing
this by switching to use vhost_poll_stop() which zeros poll->wqh after
removing poll from waitqueue to make sure it won't be freed twice.

Cc: Darren Kenny <darren.kenny@oracle.com>
Reported-by: syzbot+c0272972b01b872e604a@syzkaller.appspotmail.com
Fixes: 2b8b328b61 ("vhost_net: handle polling errors when setting backend")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 13:03:18 -04:00
Jason Gunthorpe
8a6105c481 kbuild: rpm-pkg: Support GNU tar >= 1.29
There is a change in how command line parsing is done in this version.
Excludes and includes are now ordered with the file list. Since
the spec file puts the file list before the exclude list it means newer
tar ignores the excludes and packs all the build output into the
kernel-devel RPM resulting in a huge package.

Simple argument re-ordering fixes the problem.

Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2018-03-28 01:42:17 +09:00
Jan Kiszka
f843752070 builddeb: Fix header package regarding dtc source links
Since d5d332d3f7, a couple of links in scripts/dtc/include-prefixes
are additionally required in order to build device trees with the header
package.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Riku Voipio <riku.voipio@linaro.org>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2018-03-28 01:42:17 +09:00
David S. Miller
d222a08432 Merge branch 'mlx4-misc-fixes-for-4.16'
Tariq Toukan says:

====================
mlx4 misc fixes for 4.16

This patchset contains misc bug fixes from the team
to the mlx4 Core and Eth drivers.

Patch 1 by Eran fixes a control mix of PFC and Global pauses, please queue it
to -stable for >= v4.8.
Patch 2 by Moshe fixes a resource leak in slave's delete flow, please queue it
to -stable for >= v4.5.

Series generated against net commit:
3c82b372a9 net: dsa: mt7530: fix module autoloading for OF platform drivers
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 12:02:30 -04:00
Moshe Shemesh
461d5f1b59 net/mlx4_core: Fix memory leak while delete slave's resources
mlx4_delete_all_resources_for_slave in resource tracker should free all
memory allocated for a slave.
While releasing memory of fs_rule, it misses releasing memory of
fs_rule->mirr_mbox.

Fixes: 78efed2751 ('net/mlx4_core: Support mirroring VF DMFS rules on both ports')
Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 12:02:30 -04:00
Eran Ben Elisha
6e8814ceb7 net/mlx4_en: Fix mixed PFC and Global pause user control requests
Global pause and PFC configuration should be mutually exclusive (i.e. only
one of them at most can be set). However, once PFC was turned off,
driver automatically turned Global pause on. This is a bug.

Fix the driver behaviour to turn off PFC/Global once the user turned the
other on.

This also fixed a weird behaviour that at a current time, the profile
had both PFC and global pause configuration turned on, which is
Hardware-wise impossible and caused returning false positive indication
to query tools.

In addition, fix error code when setting global pause or PFC to change
metadata only upon successful change.

Also, removed useless debug print.

Fixes: af7d518526 ("net/mlx4_en: Add DCB PFC support through CEE netlink commands")
Fixes: c27a02cd94 ("mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC")
Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 12:02:30 -04:00
Ursula Braun
ab6f6dd18a net/smc: use announced length in sock_recvmsg()
Not every CLC proposal message needs the maximum buffer length.
Due to the MSG_WAITALL flag, it is important to use the peeked
real length when receiving the message.

Fixes: d63d271ce2 ("smc: switch to sock_recvmsg()")
Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 11:59:49 -04:00
Cong Wang
b85ab56c3f llc: properly handle dev_queue_xmit() return value
llc_conn_send_pdu() pushes the skb into write queue and
calls llc_conn_send_pdus() to flush them out. However, the
status of dev_queue_xmit() is not returned to caller,
in this case, llc_conn_state_process().

llc_conn_state_process() needs hold the skb no matter
success or failure, because it still uses it after that,
therefore we should hold skb before dev_queue_xmit() when
that skb is the one being processed by llc_conn_state_process().

For other callers, they can just pass NULL and ignore
the return value as they are.

Reported-by: Noam Rathaus <noamr@beyondsecurity.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 11:56:00 -04:00
David S. Miller
2a7fdec98f mlx5-fixes-2018-03-23
-----BEGIN PGP SIGNATURE-----
 
 iQEcBAABAgAGBQJauV9vAAoJEEg/ir3gV/o+Dw4H/0oT5mXUQuEdXDw3y3JtodMA
 VEYjPt7EH+X0RUZcO9xkiZGwtfh5+Bk7oDB4uy5IzGdAAEgCX5VvR+m3jnbRfORm
 WztMGAy1fiswavYf5tYDBjSM0HSLLKxCUJr0FcPG5DG5Fe90n0DvP2Xj0l+6R0Og
 7SSwiK2UXrnfcAvDTFUgj0k2IEAUH1/dCwfruVvt4H4R1Pp6PQGBEfuEc3Jra4wi
 9wYik10xQ/MTVxEtw3Om+D7CJzvSiz6DOk2Pp0Ls+1RKvKrlqWyiAOR7nswHRgIk
 hnqNV3t47FP1W4bp1YpMjeQ0yi2xcJQPBzRdaf22MDaUiEBLFQBqiINPsOaniL0=
 =Tqzl
 -----END PGP SIGNATURE-----

Merge tag 'mlx5-fixes-2018-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux

Saeed Mahameed says:

====================
Mellanox, mlx5 fixes 2018-03-23

The following series includes fixes for mlx5 netdev and eswitch.

v1->v2:
    - Fixed commit message quotation marks in patch #7

For -stable v4.12
    ('net/mlx5e: Avoid using the ipv6 stub in the TC offload neigh update path')
    ('net/mlx5e: Fix traffic being dropped on VF representor')

For -stable v4.13
    ('net/mlx5e: Fix memory usage issues in offloading TC flows')
    ('net/mlx5e: Verify coalescing parameters in range')

For -stable v4.14
    ('net/mlx5e: Don't override vport admin link state in switchdev mode')

For -stable v4.15
    ('108b2b6d5c02 net/mlx5e: Sync netdev vxlan ports at open')

Please pull and let me know if there's any problem.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 11:41:56 -04:00
Dave Watson
cd00edc179 strparser: Fix sign of err codes
strp_parser_err is called with a negative code everywhere, which then
calls abort_parser with a negative code.  strp_msg_timeout calls
abort_parser directly with a positive code.  Negate ETIMEDOUT
to match signed-ness of other calls.

The default abort_parser callback, strp_abort_strp, sets
sk->sk_err to err.  Also negate the error here so sk_err always
holds a positive value, as the rest of the net code expects.  Currently
a negative sk_err can result in endless loops, or user code that
thinks it actually sent/received err bytes.

Found while testing net/tls_sw recv path.

Fixes: 43a0c6751a ("strparser: Stream parser for messages")
Signed-off-by: Dave Watson <davejwatson@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 11:00:18 -04:00
Craig Dillabaugh
734549eb55 net sched actions: fix dumping which requires several messages to user space
Fixes a bug in the tcf_dump_walker function that can cause some actions
to not be reported when dumping a large number of actions. This issue
became more aggrevated when cookies feature was added. In particular
this issue is manifest when large cookie values are assigned to the
actions and when enough actions are created that the resulting table
must be dumped in multiple batches.

The number of actions returned in each batch is limited by the total
number of actions and the memory buffer size.  With small cookies
the numeric limit is reached before the buffer size limit, which avoids
the code path triggering this bug. When large cookies are used buffer
fills before the numeric limit, and the erroneous code path is hit.

For example after creating 32 csum actions with the cookie
aaaabbbbccccdddd

$ tc actions ls action csum
total acts 26

    action order 0: csum (tcp) action continue
    index 1 ref 1 bind 0
    cookie aaaabbbbccccdddd

    .....

    action order 25: csum (tcp) action continue
    index 26 ref 1 bind 0
    cookie aaaabbbbccccdddd
total acts 6

    action order 0: csum (tcp) action continue
    index 28 ref 1 bind 0
    cookie aaaabbbbccccdddd

    ......

    action order 5: csum (tcp) action continue
    index 32 ref 1 bind 0
    cookie aaaabbbbccccdddd

Note that the action with index 27 is omitted from the report.

Fixes: 4b3550ef53 ("[NET_SCHED]: Use nla_nest_start/nla_nest_end")"
Signed-off-by: Craig Dillabaugh <cdillaba@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 10:59:12 -04:00
Heiner Kallweit
19c9ea363a r8169: fix setting driver_data after register_netdev
pci_set_drvdata() is called only after registering the net_device,
therefore we could run into a NPE if one of the functions using
driver_data is called before it's set.

Fix this by calling pci_set_drvdata() before registering the
net_device.

This fix is a candidate for stable. As far as I can see the
bug has been there in kernel version 3.2 already, therefore
I can't provide a reference which commit is fixed by it.

The fix may need small adjustments per kernel version because
due to other changes the label which is jumped to if
register_netdev() fails has changed over time.

Reported-by: David Miller <davem@davemloft.net>
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 10:56:04 -04:00
Eric Dumazet
1dfe82ebd7 net: fix possible out-of-bound read in skb_network_protocol()
skb mac header is not necessarily set at the time skb_network_protocol()
is called. Use skb->data instead.

BUG: KASAN: slab-out-of-bounds in skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739
Read of size 2 at addr ffff8801b3097a0b by task syz-executor5/14242

CPU: 1 PID: 14242 Comm: syz-executor5 Not tainted 4.16.0-rc6+ #280
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x24d lib/dump_stack.c:53
 print_address_description+0x73/0x250 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report+0x23c/0x360 mm/kasan/report.c:412
 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:443
 skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739
 harmonize_features net/core/dev.c:2924 [inline]
 netif_skb_features+0x509/0x9b0 net/core/dev.c:3011
 validate_xmit_skb+0x81/0xb00 net/core/dev.c:3084
 validate_xmit_skb_list+0xbf/0x120 net/core/dev.c:3142
 packet_direct_xmit+0x117/0x790 net/packet/af_packet.c:256
 packet_snd net/packet/af_packet.c:2944 [inline]
 packet_sendmsg+0x3aed/0x60b0 net/packet/af_packet.c:2969
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:639
 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2047
 __sys_sendmsg+0xe5/0x210 net/socket.c:2081

Fixes: 19acc32725 ("gso: Handle Trans-Ether-Bridging protocol in skb_network_protocol()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pravin B Shelar <pshelar@ovn.org>
Reported-by: Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 10:53:27 -04:00
Giuseppe Lippolis
d4c4bc1135 net-usb: add qmi_wwan if on lte modem wistron neweb d18q1
This modem is embedded on dlink dwr-921 router.
    The oem configuration states:

    T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480 MxCh= 0
    D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
    P:  Vendor=1435 ProdID=0918 Rev= 2.32
    S:  Manufacturer=Android
    S:  Product=Android
    S:  SerialNumber=0123456789ABCDEF
    C:* #Ifs= 7 Cfg#= 1 Atr=80 MxPwr=500mA
    I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
    E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
    E:  Ad=84(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
    E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
    E:  Ad=86(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
    E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
    E:  Ad=88(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
    E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
    E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
    E:  Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
    E:  Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=125us

Tested on openwrt distribution

Signed-off-by: Giuseppe Lippolis <giu.lippolis@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 10:51:10 -04:00
David S. Miller
d7785b59e7 Here are some batman-adv bugfixes:
- fix multicast-via-unicast transmissions for AP isolation and gateway
    extension, by Linus Luessing (2 patches)
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEE1ilQI7G+y+fdhnrfoSvjmEKSnqEFAlq466kWHHN3QHNpbW9u
 d3VuZGVybGljaC5kZQAKCRChK+OYQpKeobv5EACwz70r21xIUxwq6FWXysTfxxXt
 H3qcXt2BzCaGYKmYt8xqz9z368v7wpgCsPfZsvW2eBYhcpCkGQm6PR2XNy7WMoBz
 6aFO4SDDi5L/S+5O0iXg79niRiTe9lCbOl/r6uv/2FtY22rIfhocFwkBL8cjIC3E
 hOWuFUbk3mAu8i+WMyhfDEUL33oy9CMvlJqaxqJuTHf3HxjOeGVjusOvSbQu+OGG
 K+TCAbIjazQ02R9p6lXQoIAjfg+kfsYIdT84MTgjk91qCtp1ztRxr3MNAwTgPvA4
 Vi4uZGLbLCMvaAF1wqVBSuOnFFwbUCc8IBIoUvvZSMQTYm3agcg96pFLMYqNzrhY
 aHco1neJ+a+pGUmByijmYbsrJI2dYqK0V0OZlLG9WKwkrE3Y023LGGdXUbdl4RhS
 LXqMLGVJ9eqV+m7MCuv/q/PTVOL89loAun0DuIU4IhJuDM2+5yEG5jBiI6ImIym+
 KX3F9F9nyefr5aCYsd14izX6WHxTXkJQaVpjVNBP56P6eZMLMx81eozBD9eotFyv
 A1EgQolLFEKWmtKU2KUK+qrGFNXaLlc9z8ZGkbizi/CTEjN0tr1UjW6B6toOOoZ+
 fhF3HwlpgqVOdDodT+eDtxY8YboZBCpAnAOiE1LP3leVY4yab23Q02kskOPTPg1G
 CfpZwDjXIyZburUvfA==
 =j2w0
 -----END PGP SIGNATURE-----

Merge tag 'batadv-net-for-davem-20180326' of git://git.open-mesh.org/linux-merge

Simon Wunderlich says:

====================
Here are some batman-adv bugfixes:

 - fix multicast-via-unicast transmissions for AP isolation and gateway
   extension, by Linus Luessing (2 patches)
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-27 10:40:19 -04:00
Dan Carpenter
5607dddbfc ALSA: pcm: potential uninitialized return values
Smatch complains that "tmp" can be uninitialized if we do a zero size
write.

Fixes: 02a5d6925c ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-03-27 15:20:19 +02:00
Arnd Bergmann
bbad2093df Allwinner Fixes for 4.16
The first and second patches fix the regulator support for the Bananapi M2
 board.
 
 The last one updates my email address in MAINTAINERS.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE0VqZU19dR2zEVaqr0rTAlCFNr3QFAlqzwLkACgkQ0rTAlCFN
 r3QkSw//Vz97WVSg5DILB0euujWNMvtO0i37DnSt8g6u68SDo61TNE9LdPydaK+e
 dSdRP6cUJ6DLuflYHZ30Y9+EQQpYs8YzVl4bAfKBm7IxThQx29e5MqmhtfDSrjm1
 3l2D5G7hf6OsNBsfm0xkYkY8HgNriypBWbgRj/+5/gfCiHVg1Zhru5/B7X2VGrv2
 gfpWRLHwDt93utcJdDKl0O71frGEcRqNJs979yTr3ERmhjo9C4EnEGFD+KouVA6O
 gtGI8JveKTOBc+Mzb7LYGLvboHvBKmsf5iqew1efRWZlajIuwtikS4LT9JNOCULD
 GEZSC56JI5Opq1h4Y2EpkKOAvAL+90RkdmQJ+JiTRxpmkGntbz7/kUs+CHYiSYIT
 Z8g1S42Gv9vYXCD7ACS7eaFe1Fw+bN9c7gRW2SPJj6PPiKw2FD1xYqgYOZVw/afL
 orGkp/lAMn3wQlmQpzEQkPRFwC9mCRFb/1UYkejVOYYM8mSOgII7QuXwK6T39gwU
 JA/+1puWvmsirgt+sNEp07iFBBoo5CVqcsLpITjfXE+U4oAnqYXypD+gPMVhIEas
 6kzjvb3RRHDmXLJjxQMYq8I3lLU590vlf+J0jdJW12MB8hmjb34SFV3BFP8Hpipp
 laI9BOIRyP+yTF/CQBqLkL8TwS6hEMSN314GEriiRi+aw4IYYEo=
 =GQc4
 -----END PGP SIGNATURE-----

Merge tag 'sunxi-fixes-for-4.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into fixes

Pull "Allwinner Fixes for 4.16" from Maxime Ripard:

The first and second patches fix the regulator support for the Bananapi M2
board.

The last one updates my email address in MAINTAINERS.

* tag 'sunxi-fixes-for-4.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  MAINTAINERS: update email address for Maxime Ripard
  ARM: dts: sun6i: a31s: bpi-m2: add missing regulators
  ARM: dts: sun6i: a31s: bpi-m2: improve pmic properties
2018-03-27 13:12:10 +02:00
Arnd Bergmann
66f3731f39 Two fixes for omap variants for v4.16-rc cycle
Fix insecure W+X mapping warning for SRAM for omaps that
 don't yet use drivers/misc/*sram*.c code. An earlier attempt
 at fixing this turned out to cause problems with PM on omap3,
 this version works with PM on omap3.
 
 Also fix dmtimer probe for omap16xx devices that was noticed
 with the pending dmtimer move to drivers. It seems this has
 been broken for a while and is a non-critical for booting.
 It is needed for PM on omap16xx though.
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEEkgNvrZJU/QSQYIcQG9Q+yVyrpXMFAlqz2WgRHHRvbnlAYXRv
 bWlkZS5jb20ACgkQG9Q+yVyrpXPisRAAla6az5TwwdJB5JC3BkU7pZLfmqR7jsyh
 65Zj0KOp+b3kI/9jwaOql+WDf5hktEMEK6JjqDkz4Gs8WUE8tBxRYh95DlIb1sza
 0UloFeVy8wgZ0XJk9/6ysXWQ6cFETjR3DW5dKSyHivtFX1MYZETD8wMUhfZ6YTuJ
 1lSGpz9RhhI/PSMz9nOA7PQXSF1K+k2h9BzMaEarhDk3ni+gvoY1OahKk6kmXdFG
 Op41Vfkc3/BqWxhZV79CtPPyoD1G1/pRtEFfxAUuaU6kGbA8XrHpmccyuBv2UXpo
 pL4NJkI0HPR83W4iSvJgiARcTX7qzpUwCK3NmphhNKQ7tUwwF3mWwMMT+2TsZ4tD
 kSViqkWqeDxcgC/JMdsff1oksjDQK+uPC8FsReZkK9MyUT3eK4gw+cRTA7fy/3jr
 UZgf4PjkxouBjzrrR+aQj+R79xTX6pRSEkMjpR9hgY+eQUP9Ls+zk7JnHnJRiGqw
 GaL4Lg0jh9p7DSLn9xRaPmb6qrs//XPrPoAN70PLdSi5bBqWeknMNSzorz8Xc3eR
 7UBaIo445QoSRsG1eBAqxmz8F8R7p/fgQ+lKfxszyxDZ1qyCrORvdZZapdTy9nUA
 adnqukn2T6QLrt3g/kckAugY8/Piek1JtbPGgFsDMRa4jcOGiZP/kEnKm6c8Hmya
 LZueeqxuPac=
 =/ZXy
 -----END PGP SIGNATURE-----

Merge tag 'omap-for-v4.16/sram-fix-signed' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

Pull "Two fixes for omap variants for v4.16-rc cycle" from Tony Lindgren:

Fix insecure W+X mapping warning for SRAM for omaps that
don't yet use drivers/misc/*sram*.c code. An earlier attempt
at fixing this turned out to cause problems with PM on omap3,
this version works with PM on omap3.

Also fix dmtimer probe for omap16xx devices that was noticed
with the pending dmtimer move to drivers. It seems this has
been broken for a while and is a non-critical for booting.
It is needed for PM on omap16xx though.

* tag 'omap-for-v4.16/sram-fix-signed' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: OMAP: Fix SRAM W+X mapping
  ARM: OMAP: Fix dmtimer init for omap1
2018-03-27 13:11:21 +02:00
Arnd Bergmann
c27a2cbe3d ARM: tegra: Miscellaneous changes for v4.17-rc1
This contains a single patch to update the MAINTAINERS entry for the
 Tegra SMMU driver.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCAAxFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAlqrzyMTHHRyZWRpbmdA
 bnZpZGlhLmNvbQAKCRDdI6zXfz6zoSRnEAC2jdGgop1sXVyGTrTZhV9AVtHOmWtf
 pcBN20OATg5msa0KFSWGxjuwP3jb+f0xPjpgSf47vQNgMiCtXYVrpHN8rClWt3mT
 dgMw903Xj8bLqJ2Y2BGkh2m8u/jFwQv+vBn0kDtYxngtwTzP0C8Dokvtvrwrqmtt
 u1tjbqqnuRuEFCaC7PJbwEk6/FoGYpqTovXz++ruhG2rm5E9b5d14oDwglhLLroE
 LiRusvQO0e3xqPElY9zK5TbxM8PInCjIzzinfJ5slpuvq3QbbuP86xhSGmWpwzoU
 aC1jYzcEztxx5oHEZd0yiVw0OPglB5Na/KlEZpUT5NNtKdK5JcUEWtD4za+ScxLt
 NEIrs5d4Lgs2Szyk5Pw8DhvLGySo6tceIt+g6DgQn9YpBTcTHHREiKnMrik1nU45
 BVNpeNaw7Xbt2RJiTKjcXrYxgQ5Wy6hc5piXJgJEgCjHTNPVxMNv6sveiTyIGRk4
 RaYotjvihbVW4qbbU90vCObkKJWYNcgeXAZPcFuW44Bvm693yW87e87lcn8xXahM
 6pJ1gaerrcto0OqVdiZxIgYtdCa6eSpne8U5bh/C9VfxCrz2TylMF0OJVReO61kM
 EPduoYido88DPG8O4fSaYbRKezToXx9fV+/IgWXhjw4phWkIRo3v3f7+6ihfcs/X
 F1GXczqwKDzCNQ==
 =wAvI
 -----END PGP SIGNATURE-----

Merge tag 'tegra-for-4.17-misc' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tegra/linux into fixes

Pull "ARM: tegra: Miscellaneous changes for v4.17-rc1" from Thierry Reding:

This contains a single patch to update the MAINTAINERS entry for the
Tegra SMMU driver.

* tag 'tegra-for-4.17-misc' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
  MAINTAINERS: Update Tegra IOMMU maintainer
2018-03-27 13:09:09 +02:00
Alexey Dobriyan
bd6271039e x86/alternatives: Fixup alternative_call_2
The following pattern fails to compile while the same pattern
with alternative_call() does:

	if (...)
		alternative_call_2(...);
	else
		alternative_call_2(...);

as it expands into

	if (...)
	{
	};	<===
	else
	{
	};

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20180114120504.GA11368@avx2
2018-03-27 09:47:53 +02:00
Dave Airlie
9713096883 Merge tag 'drm-amdkfd-fixes-2018-03-25' of git://people.freedesktop.org/~gabbayo/linux into drm-fixes
- Programming VMID correctly for scratch memory with HWS
- deallocating SDMA queues correctly in various situations

* tag 'drm-amdkfd-fixes-2018-03-25' of git://people.freedesktop.org/~gabbayo/linux:
  drm/amdkfd: Deallocate SDMA queues correctly
  drm/amdkfd: Fix scratch memory with HWS enabled
2018-03-27 17:39:50 +10:00