4.14.24-stable review

Fixes 597d0275736d ("timers: Framework for identifying pinned timers")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

Cc Mike Galbraith <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/time/hrtimer.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

kernel/time/hrtimer.c +6 -1

@@ -1106,7 +1106,12 @@ static void __hrtimer_init(struct hrtime
 
 	cpu_base = raw_cpu_ptr(&hrtimer_bases);
 
-	if (clock_id == CLOCK_REALTIME && mode != HRTIMER_MODE_ABS)
+	/*
+	 * POSIX magic: Relative CLOCK_REALTIME timers are not affected by
+	 * clock modifications, so they needs to become CLOCK_MONOTONIC to
+	 * ensure POSIX compliance.
+	 */
+	if (clock_id == CLOCK_REALTIME && mode & HRTIMER_MODE_REL)
 		clock_id = CLOCK_MONOTONIC;
 
 	base = hrtimer_clockid_to_base(clock_id);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #2 lore raw

PATCH 2/115 exec: avoid gcc-8 warning for get_task_comm

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

[ Upstream commit 3756f6401c302617c5e091081ca4d26ab604bec5 ]

gcc-8 warns about using strncpy() with the source size as the limit:

fs/exec.c:1223:32: error: argument to 'sizeof' in 'strncpy' call is the same expression as the source; did you mean to use the size of the destination? [-Werror=sizeof-pointer-memaccess]

This is indeed slightly suspicious, as it protects us from source arguments without NUL-termination, but does not guarantee that the destination is terminated.

This keeps the strncpy() to ensure we have properly padded target buffer, but ensures that we use the correct length, by passing the actual length of the destination buffer as well as adding a build-time check to ensure it is exactly TASK_COMM_LEN.

There are only 23 callsites which I all reviewed to ensure this is currently the case. We could get away with doing only the check or passing the right length, but it doesn't hurt to do both.

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Arnd Bergmann <[email protected]>

Suggested-by Kees Cook <[email protected]>

Acked-by Kees Cook <[email protected]>

Acked-by Ingo Molnar <[email protected]>

Cc Alexander Viro <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Serge Hallyn <[email protected]>

Cc James Morris <[email protected]>

Cc Aleksa Sarai <[email protected]>

Cc "Eric W. Biederman" <[email protected]>

Cc Frederic Weisbecker <[email protected]>

Cc Thomas Gleixner <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

Signed-off-by Linus Torvalds <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/exec.c             |    7 +++----
 include/linux/sched.h |    6 +++++-
 2 files changed, 8 insertions(+), 5 deletions(-)

fs/exec.c +3 -4

@@ -1216,15 +1216,14 @@ killed:
 	return -EAGAIN;
 }
 
-char *get_task_comm(char *buf, struct task_struct *tsk)
+char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
 {
-	/* buf must be at least sizeof(tsk->comm) in size */
 	task_lock(tsk);
-	strncpy(buf, tsk->comm, sizeof(tsk->comm));
+	strncpy(buf, tsk->comm, buf_size);
 	task_unlock(tsk);
 	return buf;
 }
-EXPORT_SYMBOL_GPL(get_task_comm);
+EXPORT_SYMBOL_GPL(__get_task_comm);
 
 /*
  * These functions flushes out all traces of the currently running executable

include/linux/sched.h +5 -1

@@ -1502,7 +1502,11 @@ static inline void set_task_comm(struct
 	__set_task_comm(tsk, from, false);
 }
 
-extern char *get_task_comm(char *to, struct task_struct *tsk);
+extern char *__get_task_comm(char *to, size_t len, struct task_struct *tsk);
+#define get_task_comm(buf, tsk) ({			\
+	BUILD_BUG_ON(sizeof(buf) != TASK_COMM_LEN);	\
+	__get_task_comm(buf, sizeof(buf), tsk);		\
+})
 
 #ifdef CONFIG_SMP
 void scheduler_ipi(void);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:59 UTC #3 lore raw

PATCH 3/115 mm/frame_vector.c: release a semaphore in get_vaddr_frames()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christophe JAILLET <[email protected]>

[ Upstream commit 1f704fd0d14043e76e80f6b8b2251b9b2cedcca6 ]

A semaphore is acquired before this check, so we must release it before leaving.

Link http://lkml.kernel.org/r/[email protected] open here

Fixes b7f0554a56f2 ("mm: fail get_vaddr_frames() for filesystem-dax mappings")

Signed-off-by Christophe JAILLET <[email protected]>

Acked-by Michal Hocko <[email protected]>

Cc Dan Williams <[email protected]>

Cc Christian Borntraeger <[email protected]>

Cc David Sterba <[email protected]>

Cc Greg Kroah-Hartman <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

Signed-off-by Linus Torvalds <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 mm/frame_vector.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

mm/frame_vector.c +4 -2

@@ -62,8 +62,10 @@ int get_vaddr_frames(unsigned long start
 	 * get_user_pages_longterm() and disallow it for filesystem-dax
 	 * mappings.
 	 */
-	if (vma_is_fsdax(vma))
-		return -EOPNOTSUPP;
+	if (vma_is_fsdax(vma)) {
+		ret = -EOPNOTSUPP;
+		goto out;
+	}
 
 	if (!(vma->vm_flags & (VM_IO | VM_PFNMAP))) {
 		vec->got_ref = true;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #4 lore raw

PATCH 4/115 scsi: aacraid: Fix I/O drop during reset

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Prasad B Munirathnam <[email protected]>

[ Upstream commit 5771cfffdffe709ae9b403b6f80438ca40bf850e ]

"FIB_CONTEXT_FLAG_TIMEDOUT" flag is set in aac_eh_abort to indicate command timeout. Using the same flag in reset handler causes the command to time out and the I/Os were dropped.

Define a new flag "FIB_CONTEXT_FLAG_EH_RESET" to make sure I/O is properly handled in eh_reset handler.

[mkp: tweaked commit message]

Signed-off-by Prasad B Munirathnam <[email protected]>

Reviewed-by Raghava Aditya Renukunta <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/scsi/aacraid/aacraid.h |    1 +
 drivers/scsi/aacraid/linit.c   |    2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

drivers/scsi/aacraid/aacraid.h +1 -0

@@ -1724,6 +1724,7 @@ struct aac_dev
 #define FIB_CONTEXT_FLAG_NATIVE_HBA		(0x00000010)
 #define FIB_CONTEXT_FLAG_NATIVE_HBA_TMF	(0x00000020)
 #define FIB_CONTEXT_FLAG_SCSI_CMD	(0x00000040)
+#define FIB_CONTEXT_FLAG_EH_RESET	(0x00000080)
 
 /*
  *	Define the command values

drivers/scsi/aacraid/linit.c +1 -1

@@ -1037,7 +1037,7 @@ static int aac_eh_bus_reset(struct scsi_
 			info = &aac->hba_map[bus][cid];
 			if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
 			    info->devtype != AAC_DEVTYPE_NATIVE_RAW) {
-				fib->flags |= FIB_CONTEXT_FLAG_TIMED_OUT;
+				fib->flags |= FIB_CONTEXT_FLAG_EH_RESET;
 				cmd->SCp.phase = AAC_OWNER_ERROR_HANDLER;
 			}
 		}

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #5 lore raw

PATCH 5/115 dmaengine: fsl-edma: disable clks on all error paths

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andreas Platschek <[email protected]>

[ Upstream commit 2610acf46b9ed528ec2cacd717bc9d354e452b73 ]

Previously enabled clks are only disabled if clk_prepare_enable() fails. However, there are other error paths were the previously enabled clocks are not disabled.

To fix the problem, fsl_disable_clocks() now takes the number of clocks that shall be disabled + unprepared. For existing calls were all clocks were already successfully prepared + enabled, DMAMUX_NR is passed to disable + unprepare all clocks.

In error paths were only some clocks were successfully prepared + enabled the loop counter is passed, in order to disable + unprepare all successfully prepared + enabled clocks.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by Andreas Platschek <[email protected]>

Signed-off-by Vinod Koul <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/dma/fsl-edma.c |   28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

drivers/dma/fsl-edma.c +14 ~~-14~~

@@ -863,11 +863,11 @@ static void fsl_edma_irq_exit(
 	}
 }
 
-static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma)
+static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma, int nr_clocks)
 {
 	int i;
 
-	for (i = 0; i < DMAMUX_NR; i++)
+	for (i = 0; i < nr_clocks; i++)
 		clk_disable_unprepare(fsl_edma->muxclk[i]);
 }

@@ -904,25 +904,25 @@ static int fsl_edma_probe(struct platfor
 
 		res = platform_get_resource(pdev, IORESOURCE_MEM, 1 + i);
 		fsl_edma->muxbase[i] = devm_ioremap_resource(&pdev->dev, res);
-		if (IS_ERR(fsl_edma->muxbase[i]))
+		if (IS_ERR(fsl_edma->muxbase[i])) {
+			/* on error: disable all previously enabled clks */
+			fsl_disable_clocks(fsl_edma, i);
 			return PTR_ERR(fsl_edma->muxbase[i]);
+		}
 
 		sprintf(clkname, "dmamux%d", i);
 		fsl_edma->muxclk[i] = devm_clk_get(&pdev->dev, clkname);
 		if (IS_ERR(fsl_edma->muxclk[i])) {
 			dev_err(&pdev->dev, "Missing DMAMUX block clock.\n");
+			/* on error: disable all previously enabled clks */
+			fsl_disable_clocks(fsl_edma, i);
 			return PTR_ERR(fsl_edma->muxclk[i]);
 		}
 
 		ret = clk_prepare_enable(fsl_edma->muxclk[i]);
-		if (ret) {
-			/* disable only clks which were enabled on error */
-			for (; i >= 0; i--)
-				clk_disable_unprepare(fsl_edma->muxclk[i]);
-
-			dev_err(&pdev->dev, "DMAMUX clk block failed.\n");
-			return ret;
-		}
+		if (ret)
+			/* on error: disable all previously enabled clks */
+			fsl_disable_clocks(fsl_edma, i);
 
 	}

@@ -976,7 +976,7 @@ static int fsl_edma_probe(struct platfor
 	if (ret) {
 		dev_err(&pdev->dev,
 			"Can't register Freescale eDMA engine. (%d)\n", ret);
-		fsl_disable_clocks(fsl_edma);
+		fsl_disable_clocks(fsl_edma, DMAMUX_NR);
 		return ret;
 	}

@@ -985,7 +985,7 @@ static int fsl_edma_probe(struct platfor
 		dev_err(&pdev->dev,
 			"Can't register Freescale eDMA of_dma. (%d)\n", ret);
 		dma_async_device_unregister(&fsl_edma->dma_dev);
-		fsl_disable_clocks(fsl_edma);
+		fsl_disable_clocks(fsl_edma, DMAMUX_NR);
 		return ret;
 	}

@@ -1015,7 +1015,7 @@ static int fsl_edma_remove(struct platfo
 	fsl_edma_cleanup_vchan(&fsl_edma->dma_dev);
 	of_dma_controller_free(np);
 	dma_async_device_unregister(&fsl_edma->dma_dev);
-	fsl_disable_clocks(fsl_edma);
+	fsl_disable_clocks(fsl_edma, DMAMUX_NR);
 
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #6 lore raw

PATCH 6/115 phy: cpcap-usb: Fix platform_get_irq_bynames error checking.

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arvind Yadav <[email protected]>

[ Upstream commit e796cc6a3a9186c92092e2f5929cf8f65b56cf01 ]

The platform_get_irq_byname() function returns negative if an error occurs. zero or positive number on success. platform_get_irq_byname() error checking for zero is not correct.

Fixes 6d6ce40f63af ("phy: cpcap-usb: Add CPCAP PMIC USB support")

Signed-off-by Arvind Yadav <[email protected]>

Reviewed-by Sebastian Reichel <[email protected]>

Acked-by Tony Lindgren <[email protected]>

Signed-off-by Kishon Vijay Abraham I <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/phy/motorola/phy-cpcap-usb.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/phy/motorola/phy-cpcap-usb.c +1 -1

@@ -310,7 +310,7 @@ static int cpcap_usb_init_irq(struct pla
 	int irq, error;
 
 	irq = platform_get_irq_byname(pdev, name);
-	if (!irq)
+	if (irq < 0)
 		return -ENODEV;
 
 	error = devm_request_threaded_irq(ddata->dev, irq, NULL,

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #7 lore raw

PATCH 7/115 nvme-fc: remove double put reference if admin connect fails

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: James Smart <[email protected]>

[ Upstream commit 4596e752db02d47038cd7c965419789ab15d1985 ]

There are two put references in the failure case of initial create_association. The first put actually frees the controller, thus the second put references freed memory.

Remove the unnecessary 2nd put.

Signed-off-by James Smart <[email protected]>

Signed-off-by Christoph Hellwig <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/nvme/host/fc.c |    1 -
 1 file changed, 1 deletion(-)

drivers/nvme/host/fc.c +0 -1

@@ -2876,7 +2876,6 @@ nvme_fc_init_ctrl(struct device *dev, st
 
 		/* initiate nvme ctrl ref counting teardown */
 		nvme_uninit_ctrl(&ctrl->ctrl);
-		nvme_put_ctrl(&ctrl->ctrl);
 
 		/* Remove core ctrl ref. */
 		nvme_put_ctrl(&ctrl->ctrl);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #8 lore raw

PATCH 8/115 nvme: check hw sectors before setting chunk sectors

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Keith Busch <[email protected]>

[ Upstream commit 249159c5f15812140fa216f9997d799ac0023a1f ]

Some devices with IDs matching the "stripe" quirk don't actually have this quirk, and don't have an MDTS value. When MDTS is not set, the driver sets the max sectors to UINT_MAX, which is not a power of 2, hitting a BUG_ON from blk_queue_chunk_sectors. This patch skips setting chunk sectors for such devices.

Signed-off-by Keith Busch <[email protected]>

Reviewed-by Martin K. Petersen <[email protected]>

Signed-off-by Christoph Hellwig <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/nvme/host/core.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/nvme/host/core.c +2 -1

@@ -1515,7 +1515,8 @@ static void nvme_set_queue_limits(struct
 		blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors);
 		blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX));
 	}
-	if (ctrl->quirks & NVME_QUIRK_STRIPE_SIZE)
+	if ((ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) &&
+	    is_power_of_2(ctrl->max_hw_sectors))
 		blk_queue_chunk_sectors(q, ctrl->max_hw_sectors);
 	blk_queue_virt_boundary(q, ctrl->page_size - 1);
 	if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #9 lore raw

PATCH 9/115 net: aquantia: Fix actual speed capabilities reporting

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Igor Russkikh <[email protected]>

[ Upstream commit e4d02ca04c6d48ab2226342a1c4ed54f1dbb72bd ]

Different hardware device Ids correspond to different maximum speed available. Extra checks were added for devices D108 and D109 to remove unsupported speeds from these device capabilities list.

Signed-off-by Igor Russkikh <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/aquantia/atlantic/aq_hw.h            |    4 +++-
 drivers/net/ethernet/aquantia/atlantic/aq_nic.c           |    7 ++++---
 drivers/net/ethernet/aquantia/atlantic/aq_nic.h           |    2 +-
 drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c      |    5 +++--
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c |   13 ++++++++++++-
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c |   13 ++++++++++++-
 6 files changed, 35 insertions(+), 9 deletions(-)

drivers/net/ethernet/aquantia/atlantic/aq_hw.h +3 -1

@@ -85,7 +85,9 @@ struct aq_hw_ops {
 	void (*destroy)(struct aq_hw_s *self);
 
 	int (*get_hw_caps)(struct aq_hw_s *self,
-			   struct aq_hw_caps_s *aq_hw_caps);
+			   struct aq_hw_caps_s *aq_hw_caps,
+			   unsigned short device,
+			   unsigned short subsystem_device);
 
 	int (*hw_ring_tx_xmit)(struct aq_hw_s *self, struct aq_ring_s *aq_ring,
 			       unsigned int frags);

drivers/net/ethernet/aquantia/atlantic/aq_nic.c +4 -3

@@ -222,7 +222,7 @@ static struct net_device *aq_nic_ndev_al
 
 struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
 				   const struct ethtool_ops *et_ops,
-				   struct device *dev,
+				   struct pci_dev *pdev,
 				   struct aq_pci_func_s *aq_pci_func,
 				   unsigned int port,
 				   const struct aq_hw_ops *aq_hw_ops)

@@ -242,7 +242,7 @@ struct aq_nic_s *aq_nic_alloc_cold(const
 	ndev->netdev_ops = ndev_ops;
 	ndev->ethtool_ops = et_ops;
 
-	SET_NETDEV_DEV(ndev, dev);
+	SET_NETDEV_DEV(ndev, &pdev->dev);
 
 	ndev->if_port = port;
 	self->ndev = ndev;

@@ -254,7 +254,8 @@ struct aq_nic_s *aq_nic_alloc_cold(const
 
 	self->aq_hw = self->aq_hw_ops.create(aq_pci_func, self->port,
 						&self->aq_hw_ops);
-	err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps);
+	err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps,
+					  pdev->device, pdev->subsystem_device);
 	if (err < 0)
 		goto err_exit;

drivers/net/ethernet/aquantia/atlantic/aq_nic.h +1 -1

@@ -71,7 +71,7 @@ struct aq_nic_cfg_s {
 
 struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
 				   const struct ethtool_ops *et_ops,
-				   struct device *dev,
+				   struct pci_dev *pdev,
 				   struct aq_pci_func_s *aq_pci_func,
 				   unsigned int port,
 				   const struct aq_hw_ops *aq_hw_ops);

drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +3 -2

@@ -51,7 +51,8 @@ struct aq_pci_func_s *aq_pci_func_alloc(
 	pci_set_drvdata(pdev, self);
 	self->pdev = pdev;
 
-	err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps);
+	err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps, pdev->device,
+				     pdev->subsystem_device);
 	if (err < 0)
 		goto err_exit;

@@ -59,7 +60,7 @@ struct aq_pci_func_s *aq_pci_func_alloc(
 
 	for (port = 0; port < self->ports; ++port) {
 		struct aq_nic_s *aq_nic = aq_nic_alloc_cold(ndev_ops, eth_ops,
-							    &pdev->dev, self,
+							    pdev, self,
 							    port, aq_hw_ops);
 
 		if (!aq_nic) {

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c +12 -1

@@ -18,9 +18,20 @@
 #include "hw_atl_a0_internal.h"
 
 static int hw_atl_a0_get_hw_caps(struct aq_hw_s *self,
-				 struct aq_hw_caps_s *aq_hw_caps)
+				 struct aq_hw_caps_s *aq_hw_caps,
+				 unsigned short device,
+				 unsigned short subsystem_device)
 {
 	memcpy(aq_hw_caps, &hw_atl_a0_hw_caps_, sizeof(*aq_hw_caps));
+
+	if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
+		aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
+
+	if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
+		aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
+		aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_5G;
+	}
+
 	return 0;
 }

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +12 -1

@@ -18,9 +18,20 @@
 #include "hw_atl_b0_internal.h"
 
 static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self,
-				 struct aq_hw_caps_s *aq_hw_caps)
+				 struct aq_hw_caps_s *aq_hw_caps,
+				 unsigned short device,
+				 unsigned short subsystem_device)
 {
 	memcpy(aq_hw_caps, &hw_atl_b0_hw_caps_, sizeof(*aq_hw_caps));
+
+	if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
+		aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
+
+	if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
+		aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
+		aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_5G;
+	}
+
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #10 lore raw

PATCH 10/115 net: aquantia: Fix hardware DMA stream overload on large MRRS

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Igor Russkikh <[email protected]>

[ Upstream commit 1e366161510f266516107a69db91f1f2edaea11c ]

Systems with large MRRS on device (2K, 4K) with high data rates and/or large MTU, atlantic observes DMA packet buffer overflow. On some systems that causes PCIe transaction errors, hardware NMIs or datapath freeze. This patch
1) Limits MRRS from device side to 2K (thats maximum our hardware supports)
2) Limit maximum size of outstanding TX DMA data read requests. This makes hardware buffers running fine.

Signed-off-by Pavel Belous <[email protected]>

Signed-off-by Igor Russkikh <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c           |   12 ++++++++++
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h |    6 +++++
 2 files changed, 18 insertions(+)

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +12 -0

@@ -16,6 +16,7 @@
 #include "hw_atl_utils.h"
 #include "hw_atl_llh.h"
 #include "hw_atl_b0_internal.h"
+#include "hw_atl_llh_internal.h"
 
 static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self,
 				 struct aq_hw_caps_s *aq_hw_caps,

@@ -368,6 +369,7 @@ static int hw_atl_b0_hw_init(struct aq_h
 	};
 
 	int err = 0;
+	u32 val;
 
 	self->aq_nic_cfg = aq_nic_cfg;

@@ -385,6 +387,16 @@ static int hw_atl_b0_hw_init(struct aq_h
 	hw_atl_b0_hw_rss_set(self, &aq_nic_cfg->aq_rss);
 	hw_atl_b0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss);
 
+	/* Force limit MRRS on RDM/TDM to 2K */
+	val = aq_hw_read_reg(self, pci_reg_control6_adr);
+	aq_hw_write_reg(self, pci_reg_control6_adr, (val & ~0x707) | 0x404);
+
+	/* TX DMA total request limit. B0 hardware is not capable to
+	 * handle more than (8K-MRRS) incoming DMA data.
+	 * Value 24 in 256byte units
+	 */
+	aq_hw_write_reg(self, tx_dma_total_req_limit_adr, 24);
+
 	err = aq_hw_err_from_flags(self);
 	if (err < 0)
 		goto err_exit;

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h +6 -0

@@ -2343,6 +2343,9 @@
 #define tx_dma_desc_base_addrmsw_adr(descriptor) \
 			(0x00007c04u + (descriptor) * 0x40)
 
+/* tx dma total request limit */
+#define tx_dma_total_req_limit_adr 0x00007b20u
+
 /* tx interrupt moderation control register definitions
  * Preprocessor definitions for TX Interrupt Moderation Control Register
  * Base Address: 0x00008980

@@ -2369,6 +2372,9 @@
 /* default value of bitfield reg_res_dsbl */
 #define pci_reg_res_dsbl_default 0x1
 
+/* PCI core control register */
+#define pci_reg_control6_adr 0x1014u
+
 /* global microprocessor scratch pad definitions */
 #define glb_cpu_scratch_scp_adr(scratch_scp) (0x00000300u + (scratch_scp) * 0x4)

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #11 lore raw

PATCH 11/115 net: usb: qmi_wwan: add Telit ME910 PID 0x1101 support

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniele Palmas <[email protected]>

[ Upstream commit c647c0d62c82eb3ddf78a0d8b3d58819d9f552aa ]

This patch adds support for Telit ME910 PID 0x1101.

Signed-off-by Daniele Palmas <[email protected]>

Acked-by Bjørn Mork <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/usb/qmi_wwan.c |    1 +
 1 file changed, 1 insertion(+)

drivers/net/usb/qmi_wwan.c +1 -0

@@ -1211,6 +1211,7 @@ static const struct usb_device_id produc
 	{QMI_FIXED_INTF(0x2357, 0x9000, 4)},	/* TP-LINK MA260 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)},	/* Telit LE922A */
 	{QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},	/* Telit ME910 */
+	{QMI_FIXED_INTF(0x1bc7, 0x1101, 3)},	/* Telit ME910 dual modem */
 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)},	/* Telit LE920, LE920A4 */
 	{QMI_FIXED_INTF(0x1c9e, 0x9801, 3)},	/* Telewell TW-3G HSPA+ */

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #12 lore raw

PATCH 12/115 mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sascha Hauer <[email protected]>

[ Upstream commit fdf2e821052958a114618a95ab18a300d0b080cb ]

When erased subpages are read then the BCH decoder returns STATUS_ERASED if they are all empty, or STATUS_UNCORRECTABLE if there are bitflips. When there are bitflips, we have to set these bits again to show the upper layers a completely erased page. When a bitflip happens in the exact byte where the bad block marker is, then this byte is swapped with another byte in block_mark_swapping(). The correction code then detects a bitflip in another subpage and no longer corrects the bitflip where it really happens.

Correct this behaviour by calling block_mark_swapping() after the bitflips have been corrected.

In our case UBIFS failed with this bug because it expects erased pages to be really empty:

UBIFS error (pid 187): ubifs_scan: corrupt empty space at LEB 36:118735 UBIFS error (pid 187): ubifs_scanned_corruption: corruption at LEB 36:118735 UBIFS error (pid 187): ubifs_scanned_corruption: first 8192 bytes from LEB 36:118735 UBIFS error (pid 187): ubifs_scan: LEB 36 scanning failed
UBIFS error (pid 187): do_commit: commit failed, error -117

Signed-off-by Sascha Hauer <[email protected]>

Reviewed-by Richard Weinberger <[email protected]>

Acked-by Boris Brezillon <[email protected]>

Signed-off-by Richard Weinberger <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mtd/nand/gpmi-nand/gpmi-nand.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

drivers/mtd/nand/gpmi-nand/gpmi-nand.c +3 -3

@@ -1067,9 +1067,6 @@ static int gpmi_ecc_read_page(struct mtd
 		return ret;
 	}
 
-	/* handle the block mark swapping */
-	block_mark_swapping(this, payload_virt, auxiliary_virt);
-
 	/* Loop over status bytes, accumulating ECC status. */
 	status = auxiliary_virt + nfc_geo->auxiliary_status_offset;

@@ -1158,6 +1155,9 @@ static int gpmi_ecc_read_page(struct mtd
 		max_bitflips = max_t(unsigned int, max_bitflips, *status);
 	}
 
+	/* handle the block mark swapping */
+	block_mark_swapping(this, buf, auxiliary_virt);
+
 	if (oob_required) {
 		/*
 		 * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob()

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #13 lore raw

PATCH 13/115 mtd: nand: brcmnand: Zero bitflip is not an error

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Albert Hsieh <[email protected]>

[ Upstream commit e44b9a9c135727f3410e029910275f40681dc8bc ]

A negative return value of brcmstb_nand_verify_erased_page() indicates a real bitflip error of an erased page, and other return values (>= 0) show the corrected bitflip number. Zero return value means no bitflip, but the current driver code treats it as an error, and eventually leads to falsely reported ECC error.

Fixes 02b88eea9f9c ("mtd: brcmnand: Add check for erased page bitflip")

Signed-off-by Albert Hsieh <[email protected]>

Acked-by Boris Brezillon <[email protected]>

Signed-off-by Richard Weinberger <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mtd/nand/brcmnand/brcmnand.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/mtd/nand/brcmnand/brcmnand.c +1 -1

@@ -1763,7 +1763,7 @@ try_dmaread:
 			err = brcmstb_nand_verify_erased_page(mtd, chip, buf,
 							      addr);
 			/* erased page bitflips corrected */
-			if (err > 0)
+			if (err >= 0)
 				return err;
 		}

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #14 lore raw

PATCH 14/115 ipv6: icmp6: Allow icmp messages to be looped back

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brendan McGrath <[email protected]>

[ Upstream commit 588753f1eb18978512b1c9b85fddb457d46f9033 ]

One example of when an ICMPv6 packet is required to be looped back is when a host acts as both a Multicast Listener and a Multicast Router.

A Multicast Router will listen on address ff02::16 for MLDv2 messages.

Currently, MLDv2 messages originating from a Multicast Listener running on the same host as the Multicast Router are not being delivered to the Multicast Router. This is due to dst.input being assigned the default value of dst_discard.

This results in the packet being looped back but discarded before being delivered to the Multicast Router.

This patch sets dst.input to ip6_input to ensure a looped back packet is delivered to the Multicast Router.

Signed-off-by Brendan McGrath <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/ipv6/route.c |    1 +
 1 file changed, 1 insertion(+)

net/ipv6/route.c +1 -0

@@ -1755,6 +1755,7 @@ struct dst_entry *icmp6_dst_alloc(struct
 	}
 
 	rt->dst.flags |= DST_HOST;
+	rt->dst.input = ip6_input;
 	rt->dst.output  = ip6_output;
 	rt->rt6i_gateway  = fl6->daddr;
 	rt->rt6i_dst.addr = fl6->daddr;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #15 lore raw

PATCH 15/115 parisc: Reduce thread stack to 16 kb

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: John David Anglin <[email protected]>

[ Upstream commit da57c5414f49ef9e4bcb9ae0bbafd1d650b31411 ]

In testing, I found that the thread stack can be 16 kB when using an irq stack. Without it, the thread stack needs to be 32 kB. Currently, the irq stack is 32 kB. While it probably could be 16 kB, I would prefer to leave it as is for safety.

Signed-off-by John David Anglin <[email protected]>

Signed-off-by Helge Deller <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/parisc/include/asm/thread_info.h |    5 +++++
 1 file changed, 5 insertions(+)

arch/parisc/include/asm/thread_info.h +5 -0

@@ -35,7 +35,12 @@ struct thread_info {
 
 /* thread information allocation */
 
+#ifdef CONFIG_IRQSTACKS
+#define THREAD_SIZE_ORDER	2 /* PA-RISC requires at least 16k stack */
+#else
 #define THREAD_SIZE_ORDER	3 /* PA-RISC requires at least 32k stack */
+#endif
+
 /* Be sure to hunt all references to this down when you change the size of
  * the kernel stack */
 #define THREAD_SIZE             (PAGE_SIZE << THREAD_SIZE_ORDER)

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #16 lore raw

PATCH 16/115 ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chunyan Zhang <[email protected]>

[ Upstream commit 36b0cb84ee858f02c256d26f0cb4229c78e3399e ]

An additional 'ip' will be pushed to the stack, for restoring the DACR later, if CONFIG_CPU_SW_DOMAIN_PAN defined.

However, the fixup still get the err_ptr by add #8*4 to sp, which results in the fact that the code area pointed by the LR will be overwritten, or the kernel will crash if CONFIG_DEBUG_RODATA is enabled.

This patch fixes the stack mismatch.

Fixes a5e090acbf54 ("ARM: software-based priviledged-no-access support")

Signed-off-by Lvqiang Huang <[email protected]>

Signed-off-by Chunyan Zhang <[email protected]>

Signed-off-by Russell King <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/lib/csumpartialcopyuser.S |    4 ++++
 1 file changed, 4 insertions(+)

arch/arm/lib/csumpartialcopyuser.S +4 -0

@@ -85,7 +85,11 @@
 		.pushsection .text.fixup,"ax"
 		.align	4
 9001:		mov	r4, #-EFAULT
+#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+		ldr	r5, [sp, #9*4]		@ *err_ptr
+#else
 		ldr	r5, [sp, #8*4]		@ *err_ptr
+#endif
 		str	r4, [r5]
 		ldmia	sp, {r1, r2}		@ retrieve dst, len
 		add	r2, r2, r1

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #17 lore raw

PATCH 17/115 x86/asm: Allow again using asm.h when building for the bpf clang target

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnaldo Carvalho de Melo <[email protected]>

[ Upstream commit ca26cffa4e4aaeb09bb9e308f95c7835cb149248 ]

Up to f5caf621ee35 ("x86/asm: Fix inline asm call constraints for Clang") we were able to use x86 headers to build to the 'bpf' clang target, as done by the BPF code in tools/perf/.

With that commit, we ended up with following failure for 'perf test LLVM', this is because "clang ... -target bpf ..." fails since 4.0 does not have bpf inline asm support and 6.0 does not recognize the register 'esp', fix it by guarding that part with an #ifndef __BPF__, that is defined by clang when building to the "bpf" target.

  # perf test -v LLVM
  37: LLVM search and compile                               :
  37.1: Basic BPF llvm compile                              :
  --- start ---
  test child forked, pid 25526
  Kernel build dir is set to /lib/modules/4.14.0+/build
  set env: KBUILD_DIR=/lib/modules/4.14.0+/build
  unset env: KBUILD_OPTS
  include option is set to  -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated  -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h
  set env: NR_CPUS=4
  set env: LINUX_VERSION_CODE=0x40e00
  set env: CLANG_EXEC=/usr/local/bin/clang
  set env: CLANG_OPTIONS=-xc
  set env: KERNEL_INC_OPTIONS= -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated  -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h
  set env: WORKING_DIR=/lib/modules/4.14.0+/build
  set env: CLANG_SOURCE=-
  llvm compiling command template: echo '/*
   * bpf-script-example.c
   * Test basic LLVM building
   */
  #ifndef LINUX_VERSION_CODE
  # error Need LINUX_VERSION_CODE
  # error Example: for 4.2 kernel, put 'clang-opt="-DLINUX_VERSION_CODE=0x40200" into llvm section of ~/.perfconfig'
  #endif
  #define BPF_ANY 0
  #define BPF_MAP_TYPE_ARRAY 2
  #define BPF_FUNC_map_lookup_elem 1
  #define BPF_FUNC_map_update_elem 2

static void *(*bpf_map_lookup_elem)(void *map, void *key) =

	  (void *) BPF_FUNC_map_lookup_elem;
  static void *(*bpf_map_update_elem)(void *map, void *key, void *value, int flags) =
	  (void *) BPF_FUNC_map_update_elem;

  struct bpf_map_def {
	  unsigned int type;
	  unsigned int key_size;
	  unsigned int value_size;
	  unsigned int max_entries;

};

#define SEC(NAME) __attribute__((section(NAME), used)) struct bpf_map_def SEC("maps") flip_table = {
.type = BPF_MAP_TYPE_ARRAY,
.key_size = sizeof(int),
.value_size = sizeof(int), .max_entries = 1,
};

SEC("func=SyS_epoll_wait")
int bpf_func__SyS_epoll_wait(void *ctx)

  {
	  int ind =0;
	  int *flag = bpf_map_lookup_elem(&flip_table, &ind);
	  int new_flag;
	  if (!flag)
		  return 0;
	  /* flip flag and store back */
	  new_flag = !*flag;
	  bpf_map_update_elem(&flip_table, &ind, &new_flag, BPF_ANY);
	  return new_flag;
  }
  char _license[] SEC("license") = "GPL";
  int _version SEC("version") = LINUX_VERSION_CODE;
  ' | $CLANG_EXEC -D__KERNEL__ -D__NR_CPUS__=$NR_CPUS -DLINUX_VERSION_CODE=$LINUX_VERSION_CODE $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c "$CLANG_SOURCE" -target bpf -O2 -o -
  test child finished with 0
  ---- end ----
  LLVM search and compile subtest 0: Ok
  37.2: kbuild searching                                    :
  --- start ---
  test child forked, pid 25950
  Kernel build dir is set to /lib/modules/4.14.0+/build
  set env: KBUILD_DIR=/lib/modules/4.14.0+/build
  unset env: KBUILD_OPTS
  include option is set to  -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated  -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h
  set env: NR_CPUS=4
  set env: LINUX_VERSION_CODE=0x40e00
  set env: CLANG_EXEC=/usr/local/bin/clang
  set env: CLANG_OPTIONS=-xc
  set env: KERNEL_INC_OPTIONS= -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated  -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h
  set env: WORKING_DIR=/lib/modules/4.14.0+/build
  set env: CLANG_SOURCE=-
  llvm compiling command template: echo '/*
   * bpf-script-test-kbuild.c
   * Test include from kernel header
   */
  #ifndef LINUX_VERSION_CODE
  # error Need LINUX_VERSION_CODE
  # error Example: for 4.2 kernel, put 'clang-opt="-DLINUX_VERSION_CODE=0x40200" into llvm section of ~/.perfconfig'
  #endif
  #define SEC(NAME) __attribute__((section(NAME), used))

  #include <uapi/linux/fs.h>
  #include <uapi/asm/ptrace.h>

SEC("func=vfs_llseek")
int bpf_func__vfs_llseek(void *ctx)

  {
	  return 0;

}

char _license[] SEC("license") = "GPL";
int _version SEC("version") = LINUX_VERSION_CODE;
' | $CLANG_EXEC -D__KERNEL__ -D__NR_CPUS__=$NR_CPUS -DLINUX_VERSION_CODE=$LINUX_VERSION_CODE $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c "$CLANG_SOURCE" -target bpf -O2 -o - In file included from <stdin>:12:
In file included from /home/acme/git/linux/arch/x86/include/uapi/asm/ptrace.h:5:
In file included from /home/acme/git/linux/include/linux/compiler.h:242:
In file included from /home/acme/git/linux/arch/x86/include/asm/barrier.h:5:
In file included from /home/acme/git/linux/arch/x86/include/asm/alternative.h:10:
/home/acme/git/linux/arch/x86/include/asm/asm.h:145:50: error: unknown register name 'esp' in asm

  register unsigned long current_stack_pointer asm(_ASM_SP);
                                                   ^
  /home/acme/git/linux/arch/x86/include/asm/asm.h:44:18: note: expanded from macro '_ASM_SP'
  #define _ASM_SP         __ASM_REG(sp)
                          ^
  /home/acme/git/linux/arch/x86/include/asm/asm.h:27:32: note: expanded from macro '__ASM_REG'
  #define __ASM_REG(reg)         __ASM_SEL_RAW(e##reg, r##reg)
                                 ^
  /home/acme/git/linux/arch/x86/include/asm/asm.h:18:29: note: expanded from macro '__ASM_SEL_RAW'
  # define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(a)
                              ^
  /home/acme/git/linux/arch/x86/include/asm/asm.h:11:32: note: expanded from macro '__ASM_FORM_RAW'
  # define __ASM_FORM_RAW(x)     #x
                                 ^
  <scratch space>:4:1: note: expanded from here
  "esp"
  ^
  1 error generated.
  ERROR:	unable to compile -
  Hint:	Check error message shown above.
  Hint:	You can also pre-compile it into .o using:
     		  clang -target bpf -O2 -c -
     	  with proper -I and -D options.
  Failed to compile test case: 'kbuild searching'
  test child finished with -1
  ---- end ----
  LLVM search and compile subtest 1: FAILED!

Cc Adrian Hunter <[email protected]>

Cc Alexander Potapenko <[email protected]>

Cc Alexei Starovoitov <[email protected]>

Cc Andrey Ryabinin <[email protected]>

Cc Andy Lutomirski <[email protected]>

Cc Arnd Bergmann <[email protected]>

Cc Daniel Borkmann <[email protected]>

Cc David Ahern <[email protected]>

Cc Dmitriy Vyukov <[email protected]>

Cc Jiri Olsa <[email protected]>

Cc Josh Poimboeuf <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Matthias Kaehlcke <[email protected]>

Cc Miguel Bernal Marin <[email protected]>

Cc Namhyung Kim <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Cc Wang Nan <[email protected]>

Cc Yonghong Song <[email protected]>

Link https://lkml.kernel.org/r/[email protected] open here

Signed-off-by Arnaldo Carvalho de Melo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/include/asm/asm.h |    2 ++
 1 file changed, 2 insertions(+)

arch/x86/include/asm/asm.h +2 -0

@@ -136,6 +136,7 @@
 #endif
 
 #ifndef __ASSEMBLY__
+#ifndef __BPF__
 /*
  * This output constraint should be used for any inline asm which has a "call"
  * instruction.  Otherwise the asm may be inserted before the frame pointer

@@ -145,5 +146,6 @@
 register unsigned long current_stack_pointer asm(_ASM_SP);
 #define ASM_CALL_CONSTRAINT "+r" (current_stack_pointer)
 #endif
+#endif
 
 #endif /* _ASM_X86_ASM_H */

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #18 lore raw

PATCH 18/115 sctp: fix the issue that a __u16 variable may overflow in sctp_ulpq_renege

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xin Long <[email protected]>

[ Upstream commit 5c468674d17056148da06218d4da5d04baf22eac ]

Now when reneging events in sctp_ulpq_renege(), the variable freed could be increased by a __u16 value twice while freed is of __u16 type. It means freed may overflow at the second addition.

This patch is to fix it by using __u32 type for 'freed', while at it, also to remove 'if (chunk)' check, as all renege commands are generated in sctp_eat_data and it can't be NULL.

Reported-by Marcelo Ricardo Leitner <[email protected]>

Signed-off-by Xin Long <[email protected]>

Acked-by Neil Horman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/sctp/ulpqueue.c |   24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

net/sctp/ulpqueue.c +8 ~~-16~~

@@ -1084,29 +1084,21 @@ void sctp_ulpq_partial_delivery(struct s
 void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
 		      gfp_t gfp)
 {
-	struct sctp_association *asoc;
-	__u16 needed, freed;
+	struct sctp_association *asoc = ulpq->asoc;
+	__u32 freed = 0;
+	__u16 needed;
 
-	asoc = ulpq->asoc;
-
-	if (chunk) {
-		needed = ntohs(chunk->chunk_hdr->length);
-		needed -= sizeof(struct sctp_data_chunk);
-	} else
-		needed = SCTP_DEFAULT_MAXWINDOW;
-
-	freed = 0;
+	needed = ntohs(chunk->chunk_hdr->length) -
+		 sizeof(struct sctp_data_chunk);
 
 	if (skb_queue_empty(&asoc->base.sk->sk_receive_queue)) {
 		freed = sctp_ulpq_renege_order(ulpq, needed);
-		if (freed < needed) {
+		if (freed < needed)
 			freed += sctp_ulpq_renege_frags(ulpq, needed - freed);
-		}
 	}
 	/* If able to free enough room, accept this chunk. */
-	if (chunk && (freed >= needed)) {
-		int retval;
-		retval = sctp_ulpq_tail_data(ulpq, chunk, gfp);
+	if (freed >= needed) {
+		int retval = sctp_ulpq_tail_data(ulpq, chunk, gfp);
 		/*
 		 * Enter partial delivery if chunk has not been
 		 * delivered; otherwise, drain the reassembly queue.

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #19 lore raw

PATCH 19/115 sget(): handle failures of register_shrinker()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Al Viro <[email protected]>

[ Upstream commit 9ee332d99e4d5a97548943b81c54668450ce641b ]

Signed-off-by Al Viro <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/super.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

fs/super.c +5 -1

@@ -522,7 +522,11 @@ retry:
 	hlist_add_head(&s->s_instances, &type->fs_supers);
 	spin_unlock(&sb_lock);
 	get_filesystem(type);
-	register_shrinker(&s->s_shrink);
+	err = register_shrinker(&s->s_shrink);
+	if (err) {
+		deactivate_locked_super(s);
+		s = ERR_PTR(err);
+	}
 	return s;
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #20 lore raw

PATCH 20/115 net: phy: xgene: disable clk on error paths

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexey Khoroshilov <[email protected]>

[ Upstream commit ab14436065c8066c265540312742390d6d07ddd2 ]

There are several error paths in xgene_mdio_probe(), where clk is left undisabled. The patch fixes them.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by Alexey Khoroshilov <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/phy/mdio-xgene.c |   21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

drivers/net/phy/mdio-xgene.c +15 -6

@@ -194,8 +194,11 @@ static int xgene_mdio_reset(struct xgene
 	}
 
 	ret = xgene_enet_ecc_init(pdata);
-	if (ret)
+	if (ret) {
+		if (pdata->dev->of_node)
+			clk_disable_unprepare(pdata->clk);
 		return ret;
+	}
 	xgene_gmac_reset(pdata);
 
 	return 0;

@@ -388,8 +391,10 @@ static int xgene_mdio_probe(struct platf
 		return ret;
 
 	mdio_bus = mdiobus_alloc();
-	if (!mdio_bus)
-		return -ENOMEM;
+	if (!mdio_bus) {
+		ret = -ENOMEM;
+		goto out_clk;
+	}
 
 	mdio_bus->name = "APM X-Gene MDIO bus";

@@ -418,7 +423,7 @@ static int xgene_mdio_probe(struct platf
 		mdio_bus->phy_mask = ~0;
 		ret = mdiobus_register(mdio_bus);
 		if (ret)
-			goto out;
+			goto out_mdiobus;
 
 		acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_HANDLE(dev), 1,
 				    acpi_register_phy, NULL, mdio_bus, NULL);

@@ -426,16 +431,20 @@ static int xgene_mdio_probe(struct platf
 	}
 
 	if (ret)
-		goto out;
+		goto out_mdiobus;
 
 	pdata->mdio_bus = mdio_bus;
 	xgene_mdio_status = true;
 
 	return 0;
 
-out:
+out_mdiobus:
 	mdiobus_free(mdio_bus);
 
+out_clk:
+	if (dev->of_node)
+		clk_disable_unprepare(pdata->clk);
+
 	return ret;
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #21 lore raw

PATCH 21/115 drm/nouveau/pci: do a msi rearm on init

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Karol Herbst <[email protected]>

[ Upstream commit a121027d2747168df0aac0c3da35509eea39f61c ]

On my GP107 when I load nouveau after unloading it, for some reason the GPU stopped sending or the CPU stopped receiving interrupts if MSI was enabled.

Doing a rearm once before getting any interrupts fixes this.

Signed-off-by Karol Herbst <[email protected]>

Reviewed-by Thierry Reding <[email protected]>

Signed-off-by Ben Skeggs <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c |    7 +++++++
 1 file changed, 7 insertions(+)

drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c +7 -0

@@ -136,6 +136,13 @@ nvkm_pci_init(struct nvkm_subdev *subdev
 		return ret;
 
 	pci->irq = pdev->irq;
+
+	/* Ensure MSI interrupts are armed, for the case where there are
+	 * already interrupts pending (for whatever reason) at load time.
+	 */
+	if (pci->msi)
+		pci->func->msi_rearm(pci);
+
 	return ret;
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #22 lore raw

PATCH 22/115 xfrm: Reinject transport-mode packets through tasklet

https://www.mail-archive.com/[email protected]/msg03894.html

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Herbert Xu <[email protected]>

[ Upstream commit acf568ee859f098279eadf551612f103afdacb4e ]

This is an old bugbear of mine:

By crafting special packets, it is possible to cause recursion in our kernel when processing transport-mode packets at levels that are only limited by packet size.

The easiest one is with DNAT, but an even worse one is where UDP encapsulation is used in which case you just have to insert an UDP encapsulation header in between each level of recursion.

This patch avoids this problem by reinjecting tranport-mode packets through a tasklet.

Fixes b05e106698d9 ("[IPV4/6]: Netfilter IPsec input hooks")

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Steffen Klassert <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/net/xfrm.h     |    3 ++
 net/ipv4/xfrm4_input.c |   12 +++++++++-
 net/ipv6/xfrm6_input.c |   10 +++++++-
 net/xfrm/xfrm_input.c  |   57 +++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 80 insertions(+), 2 deletions(-)

include/net/xfrm.h +3 -0

@@ -1570,6 +1570,9 @@ int xfrm_init_state(struct xfrm_state *x
 int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
 int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
 int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
+int xfrm_trans_queue(struct sk_buff *skb,
+		     int (*finish)(struct net *, struct sock *,
+				   struct sk_buff *));
 int xfrm_output_resume(struct sk_buff *skb, int err);
 int xfrm_output(struct sock *sk, struct sk_buff *skb);
 int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);

net/ipv4/xfrm4_input.c +11 -1

@@ -23,6 +23,12 @@ int xfrm4_extract_input(struct xfrm_stat
 	return xfrm4_extract_header(skb);
 }
 
+static int xfrm4_rcv_encap_finish2(struct net *net, struct sock *sk,
+				   struct sk_buff *skb)
+{
+	return dst_input(skb);
+}
+
 static inline int xfrm4_rcv_encap_finish(struct net *net, struct sock *sk,
 					 struct sk_buff *skb)
 {

@@ -33,7 +39,11 @@ static inline int xfrm4_rcv_encap_finish
 					 iph->tos, skb->dev))
 			goto drop;
 	}
-	return dst_input(skb);
+
+	if (xfrm_trans_queue(skb, xfrm4_rcv_encap_finish2))
+		goto drop;
+
+	return 0;
 drop:
 	kfree_skb(skb);
 	return NET_RX_DROP;

net/ipv6/xfrm6_input.c +9 -1

@@ -32,6 +32,14 @@ int xfrm6_rcv_spi(struct sk_buff *skb, i
 }
 EXPORT_SYMBOL(xfrm6_rcv_spi);
 
+static int xfrm6_transport_finish2(struct net *net, struct sock *sk,
+				   struct sk_buff *skb)
+{
+	if (xfrm_trans_queue(skb, ip6_rcv_finish))
+		__kfree_skb(skb);
+	return -1;
+}
+
 int xfrm6_transport_finish(struct sk_buff *skb, int async)
 {
 	struct xfrm_offload *xo = xfrm_offload(skb);

@@ -56,7 +64,7 @@ int xfrm6_transport_finish(struct sk_buf
 
 	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
 		dev_net(skb->dev), NULL, skb, skb->dev, NULL,
-		ip6_rcv_finish);
+		xfrm6_transport_finish2);
 	return -1;
 }

net/xfrm/xfrm_input.c +57 -0

91 lines not on this page · raw message

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #23 lore raw

PATCH 23/115 x86/stacktrace: Make zombie stack traces reliable

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josh Poimboeuf <[email protected]>

[ Upstream commit 6454b3bdd138dfc640deb5e7b9a0668fca2d55dd ]

Commit:

1959a60182f4 ("x86/dumpstack: Pin the target stack when dumping it")

changed the behavior of stack traces for zombies. Before that commit, /proc/<pid>/stack reported the last execution path of the zombie before it died:

  [<ffffffff8105b877>] do_exit+0x6f7/0xa80
  [<ffffffff8105bc79>] do_group_exit+0x39/0xa0
  [<ffffffff8105bcf0>] __wake_up_parent+0x0/0x30
  [<ffffffff8152dd09>] system_call_fastpath+0x16/0x1b
  [<00007fd128f9c4f9>] 0x7fd128f9c4f9
  [<ffffffffffffffff>] 0xffffffffffffffff

After the commit, it just reports an empty stack trace.

The new behavior is actually probably more correct. If the stack refcount has gone down to zero, then the task has already gone through do_exit() and isn't going to run anymore. The stack could be freed at any time and is basically gone, so reporting an empty stack makes sense.

However, save_stack_trace_tsk_reliable() treats such a missing stack condition as an error. That can cause livepatch transition stalls if there are any unreaped zombies. Instead, just treat it as a reliable, empty stack.

Reported-and-tested-by Miroslav Benes <[email protected]>

Signed-off-by Josh Poimboeuf <[email protected]>

Cc Andy Lutomirski <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Link http://lkml.kernel.org/r/e4b09e630e99d0c1080528f0821fc9d9dbaeea82.1513631620.git.jpoimboe@redhat.com open here

Fixes af085d9084b4 ("stacktrace/x86: add function for detecting reliable stack traces")

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/kernel/stacktrace.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

arch/x86/kernel/stacktrace.c +5 -1

@@ -160,8 +160,12 @@ int save_stack_trace_tsk_reliable(struct
 {
 	int ret;
 
+	/*
+	 * If the task doesn't have a stack (e.g., a zombie), the stack is
+	 * "reliably" empty.
+	 */
 	if (!try_get_task_stack(tsk))
-		return -EINVAL;
+		return 0;
 
 	ret = __save_stack_trace_reliable(trace, tsk);

Greg Kroah-Hartman

author maintainer

2018-03-02 09:02 UTC #24 lore raw

PATCH 24/115 mac80211_hwsim: Fix a possible sleep-in-atomic bug in hwsim_get_radio_nl

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jia-Ju Bai <[email protected]>

[ Upstream commit 162bd5e5fd921785077b5862d8f2ffabe2fe11e5 ]

The driver may sleep under a spinlock.
The function call path is:
hwsim_get_radio_nl (acquire the spinlock)
nlmsg_new(GFP_KERNEL) --> may sleep

To fix it, GFP_KERNEL is replaced with GFP_ATOMIC.

This bug is found by my static analysis tool(DSAC) and checked by my code review.

Signed-off-by Jia-Ju Bai <[email protected]>

Signed-off-by Johannes Berg <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/mac80211_hwsim.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/wireless/mac80211_hwsim.c +1 -1

@@ -3220,7 +3220,7 @@ static int hwsim_get_radio_nl(struct sk_
 		if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
 			continue;
 
-		skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+		skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
 		if (!skb) {
 			res = -ENOMEM;
 			goto out_err;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #25 lore raw

PATCH 25/115 spi: atmel: fixed spin_lock usage inside atmel_spi_remove

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Radu Pirea <[email protected]>

[ Upstream commit 66e900a3d225575c8b48b59ae1fe74bb6e5a65cc ]

The only part of atmel_spi_remove which needs to be atomic is hardware reset.

atmel_spi_stop_dma calls dma_terminate_all and this needs interrupts enabled.
atmel_spi_release_dma calls dma_release_channel and dma_release_channel locks a mutex inside of spin_lock.

So the call of these functions can't be inside a spin_lock.

Reported-by Jia-Ju Bai <[email protected]>

Signed-off-by Radu Pirea <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/spi/spi-atmel.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/spi/spi-atmel.c +1 -1

@@ -1661,12 +1661,12 @@ static int atmel_spi_remove(struct platf
 	pm_runtime_get_sync(&pdev->dev);
 
 	/* reset the hardware and block queue progress */
-	spin_lock_irq(&as->lock);
 	if (as->use_dma) {
 		atmel_spi_stop_dma(master);
 		atmel_spi_release_dma(master);
 	}
 
+	spin_lock_irq(&as->lock);
 	spi_writel(as, CR, SPI_BIT(SWRST));
 	spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
 	spi_readl(as, SR);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #26 lore raw

PATCH 26/115 ASoC: nau8825: fix issue that pop noise when start capture

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Abhijeet Kumar <[email protected]>

[ Upstream commit d070f7c703ef26e3db613f24206823f916272fc6 ]

In skylake platform, we hear a loud pop noise(0 dB) at start of audio capture power up sequence. This patch removes the pop noise from the recording by adding a delay before enabling ADC.

Signed-off-by Abhijeet Kumar <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/soc/codecs/nau8825.c |    1 +
 1 file changed, 1 insertion(+)

sound/soc/codecs/nau8825.c +1 -0

@@ -905,6 +905,7 @@ static int nau8825_adc_event(struct snd_
 
 	switch (event) {
 	case SND_SOC_DAPM_POST_PMU:
+		msleep(125);
 		regmap_update_bits(nau8825->regmap, NAU8825_REG_ENA_CTRL,
 			NAU8825_ENABLE_ADC, NAU8825_ENABLE_ADC);
 		break;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #27 lore raw

PATCH 27/115 cgroup: Fix deadlock in cpu hotplug path

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Prateek Sood <[email protected]>

[ Upstream commit 116d2f7496c51b2e02e8e4ecdd2bdf5fb9d5a641 ]

Deadlock during cgroup migration from cpu hotplug path when a task T is being moved from source to destination cgroup.

kworker/0:0
cpuset_hotplug_workfn()
cpuset_hotplug_update_tasks()
hotplug_update_tasks_legacy()
remove_tasks_in_empty_cpuset()
cgroup_transfer_tasks() // stuck in iterator loop
cgroup_migrate()
cgroup_migrate_add_task()

In cgroup_migrate_add_task() it checks for PF_EXITING flag of task T. Task T will not migrate to destination cgroup. css_task_iter_start() will keep pointing to task T in loop waiting for task T cg_list node to be removed.

Task T
do_exit()
exit_signals() // sets PF_EXITING
exit_task_namespaces()
switch_task_namespaces()
free_nsproxy()
put_mnt_ns()
drop_collected_mounts()
namespace_unlock()
synchronize_rcu()
_synchronize_rcu_expedited()
schedule_work() // on cpu0 low priority worker pool wait_event() // waiting for work item to execute

Task T inserted a work item in the worklist of cpu0 low priority worker pool. It is waiting for expedited grace period work item to execute. This work item will only be executed once kworker/0:0 complete execution of cpuset_hotplug_workfn().

kworker/0:0 ==> Task T ==>kworker/0:0

In case of PF_EXITING task being migrated from source to destination cgroup, migrate next available task in source cgroup.

Signed-off-by Prateek Sood <[email protected]>

Signed-off-by Tejun Heo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/cgroup/cgroup-v1.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

kernel/cgroup/cgroup-v1.c +5 -1

@@ -123,7 +123,11 @@ int cgroup_transfer_tasks(struct cgroup
 	 */
 	do {
 		css_task_iter_start(&from->self, 0, &it);
-		task = css_task_iter_next(&it);
+
+		do {
+			task = css_task_iter_next(&it);
+		} while (task && (task->flags & PF_EXITING));
+
 		if (task)
 			get_task_struct(task);
 		css_task_iter_end(&it);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #28 lore raw

PATCH 28/115 staging: ion: Fix ion_cma_heap allocations

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: John Stultz <[email protected]>

[ Upstream commit f292b9b28097d8fe870336108e91bd95a14294bf ]

In trying to add support for drm_hwcomposer to HiKey, I've needed to utilize the ION CMA heap, and I've noticed problems with allocations on newer kernels failing.

It seems back with 204f672255c2 ("ion: Use CMA APIs directly"), the ion_cma_heap code was modified to use the CMA API, but kept the arguments as buffer lengths rather then number of pages.

This results in errors as we don't have enough pages in CMA to satisfy the exaggerated requests.

This patch converts the ion_cma_heap CMA API usage to properly request pages.

It also fixes a minor issue in the allocation where in the error path, the cma_release is called with the buffer->size value which hasn't yet been set.

Cc Laura Abbott <[email protected]>

Cc Sumit Semwal <[email protected]>

Cc Benjamin Gaignard <[email protected]>

Cc Archit Taneja <[email protected]>

Cc Greg KH <[email protected]>

Cc Daniel Vetter <[email protected]>

Cc Dmitry Shmidt <[email protected]>

Cc Todd Kjos <[email protected]>

Cc Amit Pundir <[email protected]>

Fixes 204f672255c2 ("staging: android: ion: Use CMA APIs directly")

Acked-by Laura Abbott <[email protected]>

Signed-off-by John Stultz <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/android/ion/Kconfig        |    2 +-
 drivers/staging/android/ion/ion_cma_heap.c |   15 +++++++++++----
 2 files changed, 12 insertions(+), 5 deletions(-)

drivers/staging/android/ion/Kconfig +1 -1

@@ -37,7 +37,7 @@ config ION_CHUNK_HEAP
 
 config ION_CMA_HEAP
 	bool "Ion CMA heap support"
-	depends on ION && CMA
+	depends on ION && DMA_CMA
 	help
 	  Choose this option to enable CMA heaps with Ion. This heap is backed
 	  by the Contiguous Memory Allocator (CMA). If your system has these

drivers/staging/android/ion/ion_cma_heap.c +11 -4

@@ -39,9 +39,15 @@ static int ion_cma_allocate(struct ion_h
 	struct ion_cma_heap *cma_heap = to_cma_heap(heap);
 	struct sg_table *table;
 	struct page *pages;
+	unsigned long size = PAGE_ALIGN(len);
+	unsigned long nr_pages = size >> PAGE_SHIFT;
+	unsigned long align = get_order(size);
 	int ret;
 
-	pages = cma_alloc(cma_heap->cma, len, 0, GFP_KERNEL);
+	if (align > CONFIG_CMA_ALIGNMENT)
+		align = CONFIG_CMA_ALIGNMENT;
+
+	pages = cma_alloc(cma_heap->cma, nr_pages, align, GFP_KERNEL);
 	if (!pages)
 		return -ENOMEM;

@@ -53,7 +59,7 @@ static int ion_cma_allocate(struct ion_h
 	if (ret)
 		goto free_mem;
 
-	sg_set_page(table->sgl, pages, len, 0);
+	sg_set_page(table->sgl, pages, size, 0);
 
 	buffer->priv_virt = pages;
 	buffer->sg_table = table;

@@ -62,7 +68,7 @@ static int ion_cma_allocate(struct ion_h
 free_mem:
 	kfree(table);
 err:
-	cma_release(cma_heap->cma, pages, buffer->size);
+	cma_release(cma_heap->cma, pages, nr_pages);
 	return -ENOMEM;
 }

@@ -70,9 +76,10 @@ static void ion_cma_free(struct ion_buff
 {
 	struct ion_cma_heap *cma_heap = to_cma_heap(buffer->heap);
 	struct page *pages = buffer->priv_virt;
+	unsigned long nr_pages = PAGE_ALIGN(buffer->size) >> PAGE_SHIFT;
 
 	/* release memory */
-	cma_release(cma_heap->cma, pages, buffer->size);
+	cma_release(cma_heap->cma, pages, nr_pages);
 	/* release sg table */
 	sg_free_table(buffer->sg_table);
 	kfree(buffer->sg_table);

Greg Kroah-Hartman

author maintainer

2018-03-02 09:02 UTC #29 lore raw

PATCH 29/115 x86-64/Xen: eliminate W+X mappings

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jan Beulich <[email protected]>

[ Upstream commit 2cc42bac1c795f75fcc062b95c6ca7ac1b84d5d8 ]

A few thousand such pages are usually left around due to the re-use of L1 tables having been provided by the hypervisor (Dom0) or tool stack (DomU). Set NX in the direct map variant, which needs to be done in L2 due to the dual use of the re-used L1s.

For x86_configure_nx() to actually do what it is supposed to do, call get_cpu_cap() first. This was broken by commit 4763ed4d45 ("x86, mm:
Clean up and simplify NX enablement") when switching away from the direct EFER read.

Signed-off-by Jan Beulich <[email protected]>

Reviewed-by Juergen Gross <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/xen/enlighten_pv.c |    3 +++
 arch/x86/xen/mmu_pv.c       |   12 ++++++++++++
 2 files changed, 15 insertions(+)

arch/x86/xen/enlighten_pv.c +3 -0

@@ -88,6 +88,8 @@
 #include "multicalls.h"
 #include "pmu.h"
 
+#include "../kernel/cpu/cpu.h" /* get_cpu_cap() */
+
 void *xen_initial_gdt;
 
 static int xen_cpu_up_prepare_pv(unsigned int cpu);

@@ -1257,6 +1259,7 @@ asmlinkage __visible void __init xen_sta
 	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
 
 	/* Work out if we support NX */
+	get_cpu_cap(&boot_cpu_data);
 	x86_configure_nx();
 
 	/* Get mfn list */

arch/x86/xen/mmu_pv.c +12 -0

@@ -1902,6 +1902,18 @@ void __init xen_setup_kernel_pagetable(p
 	/* Graft it onto L4[511][510] */
 	copy_page(level2_kernel_pgt, l2);
 
+	/*
+	 * Zap execute permission from the ident map. Due to the sharing of
+	 * L1 entries we need to do this in the L2.
+	 */
+	if (__supported_pte_mask & _PAGE_NX) {
+		for (i = 0; i < PTRS_PER_PMD; ++i) {
+			if (pmd_none(level2_ident_pgt[i]))
+				continue;
+			level2_ident_pgt[i] = pmd_set_flags(level2_ident_pgt[i], _PAGE_NX);
+		}
+	}
+
 	/* Copy the initial P->M table mappings if necessary. */
 	i = pgd_index(xen_start_info->mfn_list);
 	if (i && i < pgd_index(__START_KERNEL_map))

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #30 lore raw

PATCH 30/115 net: mediatek: setup proper state for disabled GMAC on the default

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sean Wang <[email protected]>

[ Upstream commit 7352e252b5bf40d59342494a70354a2d436fd0cd ]

The current solution would setup fixed and force link of 1Gbps to the both GMAC on the default. However, The GMAC should always be put to link down state when the GMAC is disabled on certain target boards. Otherwise, the driver possibly receives unexpected data from the floating hardware connection through the unused GMAC. Although the driver had been added certain protection in RX path to get rid of such kind of unexpected data sent to the upper stack.

Signed-off-by Sean Wang <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/mediatek/mtk_eth_soc.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

drivers/net/ethernet/mediatek/mtk_eth_soc.c +6 -5

@@ -1959,11 +1959,12 @@ static int mtk_hw_init(struct mtk_eth *e
 	/* set GE2 TUNE */
 	regmap_write(eth->pctl, GPIO_BIAS_CTRL, 0x0);
 
-	/* GE1, Force 1000M/FD, FC ON */
-	mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(0));
-
-	/* GE2, Force 1000M/FD, FC ON */
-	mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(1));
+	/* Set linkdown as the default for each GMAC. Its own MCR would be set
+	 * up with the more appropriate value when mtk_phy_link_adjust call is
+	 * being invoked.
+	 */
+	for (i = 0; i < MTK_MAC_COUNT; i++)
+		mtk_w32(eth, 0, MTK_MAC_MCR(i));
 
 	/* Indicates CDM to parse the MTK special tag from CPU
 	 * which also is working out for untag packets.

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #31 lore raw

PATCH 31/115 net: arc_emac: fix arc_emac_rx() error paths

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Kochetkov <[email protected]>

[ Upstream commit e688822d035b494071ecbadcccbd6f3325fb0f59 ]

arc_emac_rx() has some issues found by code review.

In case netdev_alloc_skb_ip_align() or dma_map_single() failure rx fifo entry will not be returned to EMAC.

In case dma_map_single() failure previously allocated skb became lost to driver. At the same time address of newly allocated skb will not be provided to EMAC.

Signed-off-by Alexander Kochetkov <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/arc/emac_main.c |   53 ++++++++++++++++++++---------------
 1 file changed, 31 insertions(+), 22 deletions(-)

drivers/net/ethernet/arc/emac_main.c +31 ~~-22~~

@@ -210,39 +210,48 @@ static int arc_emac_rx(struct net_device
 			continue;
 		}
 
-		pktlen = info & LEN_MASK;
-		stats->rx_packets++;
-		stats->rx_bytes += pktlen;
-		skb = rx_buff->skb;
-		skb_put(skb, pktlen);
-		skb->dev = ndev;
-		skb->protocol = eth_type_trans(skb, ndev);
-
-		dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
-				 dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
-
-		/* Prepare the BD for next cycle */
-		rx_buff->skb = netdev_alloc_skb_ip_align(ndev,
-							 EMAC_BUFFER_SIZE);
-		if (unlikely(!rx_buff->skb)) {
+		/* Prepare the BD for next cycle. netif_receive_skb()
+		 * only if new skb was allocated and mapped to avoid holes
+		 * in the RX fifo.
+		 */
+		skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE);
+		if (unlikely(!skb)) {
+			if (net_ratelimit())
+				netdev_err(ndev, "cannot allocate skb\n");
+			/* Return ownership to EMAC */
+			rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
 			stats->rx_errors++;
-			/* Because receive_skb is below, increment rx_dropped */
 			stats->rx_dropped++;
 			continue;
 		}
 
-		/* receive_skb only if new skb was allocated to avoid holes */
-		netif_receive_skb(skb);
-
-		addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
+		addr = dma_map_single(&ndev->dev, (void *)skb->data,
 				      EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
 		if (dma_mapping_error(&ndev->dev, addr)) {
 			if (net_ratelimit())
-				netdev_err(ndev, "cannot dma map\n");
-			dev_kfree_skb(rx_buff->skb);
+				netdev_err(ndev, "cannot map dma buffer\n");
+			dev_kfree_skb(skb);
+			/* Return ownership to EMAC */
+			rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
 			stats->rx_errors++;
+			stats->rx_dropped++;
 			continue;
 		}
+
+		/* unmap previosly mapped skb */
+		dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
+				 dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
+
+		pktlen = info & LEN_MASK;
+		stats->rx_packets++;
+		stats->rx_bytes += pktlen;
+		skb_put(rx_buff->skb, pktlen);
+		rx_buff->skb->dev = ndev;
+		rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev);
+
+		netif_receive_skb(rx_buff->skb);
+
+		rx_buff->skb = skb;
 		dma_unmap_addr_set(rx_buff, addr, addr);
 		dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #32 lore raw

PATCH 32/115 vxlan: update skb dst pmtu on tx path

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xin Long <[email protected]>

[ Upstream commit a93bf0ff449064e6b7f44e58522e940f88c0d966 ]

Unlike ip tunnels, now vxlan doesn't do any pmtu update for upper dst pmtu, even if it doesn't match the lower dst pmtu any more.

The problem can be reproduced when reducing the vxlan lower dev's pmtu when running netperf. In jianlin's testing, the performance went to 1/7 of the previous.

This patch is to update the upper dst pmtu to match the lower dst pmtu on tx path so that packets can be sent out even when lower dev's pmtu has been changed.

It also works for metadata dst.

Note that this patch doesn't process any pmtu icmp packet. But even in the future, the support for pmtu icmp packets process of udp tunnels will also needs this.

The same thing will be done for geneve in another patch.

Signed-off-by Xin Long <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/vxlan.c |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

drivers/net/vxlan.c +14 -0

@@ -2155,6 +2155,13 @@ static void vxlan_xmit_one(struct sk_buf
 		}
 
 		ndst = &rt->dst;
+		if (skb_dst(skb)) {
+			int mtu = dst_mtu(ndst) - VXLAN_HEADROOM;
+
+			skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL,
+						       skb, mtu);
+		}
+
 		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
 		ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
 		err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),

@@ -2190,6 +2197,13 @@ static void vxlan_xmit_one(struct sk_buf
 				goto out_unlock;
 		}
 
+		if (skb_dst(skb)) {
+			int mtu = dst_mtu(ndst) - VXLAN6_HEADROOM;
+
+			skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL,
+						       skb, mtu);
+		}
+
 		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
 		ttl = ttl ? : ip6_dst_hoplimit(ndst);
 		skb_scrub_packet(skb, xnet);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #33 lore raw

PATCH 33/115 ip_gre: remove the incorrect mtu limit for ipgre tap

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xin Long <[email protected]>

[ Upstream commit cfddd4c33c254954927942599d299b3865743146 ]

ipgre tap driver calls ether_setup(), after commit 61e84623ace3 ("net: centralize net_device min/max MTU checking"), the range of mtu is [min_mtu, max_mtu], which is [68, 1500] by default.

It causes the dev mtu of the ipgre tap device to not be greater than 1500, this limit value is not correct for ipgre tap device.

Besides, it's .change_mtu already does the right check. So this patch is just to set max_mtu as 0, and leave the check to it's .change_mtu.

Fixes 61e84623ace3 ("net: centralize net_device min/max MTU checking")

Reported-by Jianlin Shi <[email protected]>

Signed-off-by Xin Long <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/ipv4/ip_gre.c |    1 +
 1 file changed, 1 insertion(+)

net/ipv4/ip_gre.c +1 -0

@@ -1274,6 +1274,7 @@ static const struct net_device_ops erspa
 static void ipgre_tap_setup(struct net_device *dev)
 {
 	ether_setup(dev);
+	dev->max_mtu = 0;
 	dev->netdev_ops	= &gre_tap_netdev_ops;
 	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
 	dev->priv_flags	|= IFF_LIVE_ADDR_CHANGE;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #34 lore raw

PATCH 34/115 ip6_gre: remove the incorrect mtu limit for ipgre tap

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xin Long <[email protected]>

[ Upstream commit 2c52129a7d74d017320804c6928de770815c5f4a ]

The same fix as the patch "ip_gre: remove the incorrect mtu limit for ipgre tap" is also needed for ip6_gre.

Fixes 61e84623ace3 ("net: centralize net_device min/max MTU checking")

Signed-off-by Xin Long <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/ipv6/ip6_gre.c |    1 +
 1 file changed, 1 insertion(+)

net/ipv6/ip6_gre.c +1 -0

@@ -1335,6 +1335,7 @@ static void ip6gre_tap_setup(struct net_
 
 	ether_setup(dev);
 
+	dev->max_mtu = 0;
 	dev->netdev_ops = &ip6gre_tap_netdev_ops;
 	dev->needs_free_netdev = true;
 	dev->priv_destructor = ip6gre_dev_free;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #35 lore raw

PATCH 35/115 ip6_tunnel: get the min mtu properly in ip6_tnl_xmit

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xin Long <[email protected]>

[ Upstream commit c9fefa08190fc879fb2e681035d7774e0a8c5170 ]

Now it's using IPV6_MIN_MTU as the min mtu in ip6_tnl_xmit, but IPV6_MIN_MTU actually only works when the inner packet is ipv6.

With IPV6_MIN_MTU for ipv4 packets, the new pmtu for inner dst couldn't be set less than 1280. It would cause tx_err and the packet to be dropped when the outer dst pmtu is close to 1280.

Jianlin found it by running ipv4 traffic with the topo:

(client) gre6 <---> eth1 (route) eth2 <---> gre6 (server)

After changing eth2 mtu to 1300, the performance became very low, or the connection was even broken. The issue also affects ip4ip6 and ip6ip6 tunnels.

So if the inner packet is ipv4, 576 should be considered as the min mtu.

Note that for ip4ip6 and ip6ip6 tunnels, the inner packet can only be ipv4 or ipv6, but for gre6 tunnel, it may also be ARP. This patch using 576 as the min mtu for non-ipv6 packet works for all those cases.

Reported-by Jianlin Shi <[email protected]>

Signed-off-by Xin Long <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/ipv6/ip6_tunnel.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

net/ipv6/ip6_tunnel.c +7 -2

@@ -1131,8 +1131,13 @@ route_lookup:
 		max_headroom += 8;
 		mtu -= 8;
 	}
-	if (mtu < IPV6_MIN_MTU)
-		mtu = IPV6_MIN_MTU;
+	if (skb->protocol == htons(ETH_P_IPV6)) {
+		if (mtu < IPV6_MIN_MTU)
+			mtu = IPV6_MIN_MTU;
+	} else if (mtu < 576) {
+		mtu = 576;
+	}
+
 	if (skb_dst(skb) && !t->parms.collect_md)
 		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
 	if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) {

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #36 lore raw

PATCH 36/115 net: stmmac: Fix TX timestamp calculation

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fredrik Hallenberg <[email protected]>

[ Upstream commit 200922c93f008e03ddc804c6dacdf26ca1ba86d7 ]

When using GMAC4 the value written in PTP_SSIR should be shifted however the shifted value is also used in subsequent calculations which results in a bad timestamp value.

Signed-off-by Fredrik Hallenberg <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +4 -2

@@ -34,6 +34,7 @@ static u32 stmmac_config_sub_second_incr
 {
 	u32 value = readl(ioaddr + PTP_TCR);
 	unsigned long data;
+	u32 reg_value;
 
 	/* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
 	 *	formula = (1/ptp_clock) * 1000000000

@@ -50,10 +51,11 @@ static u32 stmmac_config_sub_second_incr
 
 	data &= PTP_SSIR_SSINC_MASK;
 
+	reg_value = data;
 	if (gmac4)
-		data = data << GMAC4_PTP_SSIR_SSINC_SHIFT;
+		reg_value <<= GMAC4_PTP_SSIR_SSINC_SHIFT;
 
-	writel(data, ioaddr + PTP_SSIR);
+	writel(reg_value, ioaddr + PTP_SSIR);
 
 	return data;
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #37 lore raw

PATCH 37/115 net: stmmac: Fix bad RX timestamp extraction

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fredrik Hallenberg <[email protected]>

[ Upstream commit a1762456993893795030d911106a7650481db0ef ]

As noted in dwmac4_wrback_get_rx_timestamp_status the timestamp is found in the context descriptor following the current descriptor. However the current code looks for the context descriptor in the current descriptor, which will always fail.

Signed-off-by Fredrik Hallenberg <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/stmicro/stmmac/common.h       |    2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c |    5 +++--
 drivers/net/ethernet/stmicro/stmmac/enh_desc.c     |    3 ++-
 drivers/net/ethernet/stmicro/stmmac/norm_desc.c    |    2 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |    2 +-
 5 files changed, 8 insertions(+), 6 deletions(-)

drivers/net/ethernet/stmicro/stmmac/common.h +1 -1

@@ -409,7 +409,7 @@ struct stmmac_desc_ops {
 	/* get timestamp value */
 	 u64(*get_timestamp) (void *desc, u32 ats);
 	/* get rx timestamp status */
-	int (*get_rx_timestamp_status) (void *desc, u32 ats);
+	int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats);
 	/* Display ring */
 	void (*display_ring)(void *head, unsigned int size, bool rx);
 	/* set MSS via context descriptor */

drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +3 -2

@@ -258,7 +258,8 @@ static int dwmac4_rx_check_timestamp(voi
 	return ret;
 }
 
-static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
+static int dwmac4_wrback_get_rx_timestamp_status(void *desc, void *next_desc,
+						 u32 ats)
 {
 	struct dma_desc *p = (struct dma_desc *)desc;
 	int ret = -EINVAL;

@@ -270,7 +271,7 @@ static int dwmac4_wrback_get_rx_timestam
 
 			/* Check if timestamp is OK from context descriptor */
 			do {
-				ret = dwmac4_rx_check_timestamp(desc);
+				ret = dwmac4_rx_check_timestamp(next_desc);
 				if (ret < 0)
 					goto exit;
 				i++;

drivers/net/ethernet/stmicro/stmmac/enh_desc.c +2 -1

@@ -400,7 +400,8 @@ static u64 enh_desc_get_timestamp(void *
 	return ns;
 }
 
-static int enh_desc_get_rx_timestamp_status(void *desc, u32 ats)
+static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc,
+					    u32 ats)
 {
 	if (ats) {
 		struct dma_extended_desc *p = (struct dma_extended_desc *)desc;

drivers/net/ethernet/stmicro/stmmac/norm_desc.c +1 -1

@@ -265,7 +265,7 @@ static u64 ndesc_get_timestamp(void *des
 	return ns;
 }
 
-static int ndesc_get_rx_timestamp_status(void *desc, u32 ats)
+static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats)
 {
 	struct dma_desc *p = (struct dma_desc *)desc;

drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +1 -1

@@ -489,7 +489,7 @@ static void stmmac_get_rx_hwtstamp(struc
 		desc = np;
 
 	/* Check if timestamp is available */
-	if (priv->hw->desc->get_rx_timestamp_status(desc, priv->adv_ts)) {
+	if (priv->hw->desc->get_rx_timestamp_status(p, np, priv->adv_ts)) {
 		ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts);
 		netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);
 		shhwtstamp = skb_hwtstamps(skb);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #38 lore raw

PATCH 38/115 net/mlx5e: Fix ETS BW check

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Huy Nguyen <[email protected]>

[ Upstream commit ff0891915cd7b24ab27eee9b360c0452853bf9f6 ]

Fix bug that allows ets bw sum to be 0% when ets tc type exists.

Fixes 08fb1dacdd76 ('net/mlx5e: Support DCBNL IEEE ETS')

Signed-off-by Moshe Shemesh <[email protected]>

Reviewed-by Huy Nguyen <[email protected]>

Signed-off-by Saeed Mahameed <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +7 -3

@@ -259,6 +259,7 @@ int mlx5e_dcbnl_ieee_setets_core(struct
 static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
 				    struct ieee_ets *ets)
 {
+	bool have_ets_tc = false;
 	int bw_sum = 0;
 	int i;

@@ -273,11 +274,14 @@ static int mlx5e_dbcnl_validate_ets(stru
 	}
 
 	/* Validate Bandwidth Sum */
-	for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++)
-		if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS)
+	for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+		if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
+			have_ets_tc = true;
 			bw_sum += ets->tc_tx_bw[i];
+		}
+	}
 
-	if (bw_sum != 0 && bw_sum != 100) {
+	if (have_ets_tc && bw_sum != 100) {
 		netdev_err(netdev,
 			   "Failed to validate ETS: BW sum is illegal\n");
 		return -EINVAL;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #39 lore raw

PATCH 39/115 net/mlx5: Cleanup IRQs in case of unload failure

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Moshe Shemesh <[email protected]>

[ Upstream commit d6b2785cd55ee72e9608762650b3ef299f801b1b ]

When mlx5_stop_eqs fails to destroy any of the eqs it returns with an error. In such failure flow the function will return without
releasing all EQs irqs and then pci_free_irq_vectors will fail. Fix by only warn on destroy EQ failure and continue to release other EQs and their irqs.

It fixes the following kernel trace:
kernel: kernel BUG at drivers/pci/msi.c:352!
...
...
kernel: Call Trace:
kernel: pci_disable_msix+0xd3/0x100
kernel: pci_free_irq_vectors+0xe/0x20
kernel: mlx5_load_one.isra.17+0x9f5/0xec0 [mlx5_core]

Fixes e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")

Signed-off-by Moshe Shemesh <[email protected]>

Signed-off-by Saeed Mahameed <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/mellanox/mlx5/core/eq.c |   20 +++++++++++++-------
 include/linux/mlx5/driver.h                  |    2 +-
 2 files changed, 14 insertions(+), 8 deletions(-)

drivers/net/ethernet/mellanox/mlx5/core/eq.c +13 -7

@@ -776,7 +776,7 @@ err1:
 	return err;
 }
 
-int mlx5_stop_eqs(struct mlx5_core_dev *dev)
+void mlx5_stop_eqs(struct mlx5_core_dev *dev)
 {
 	struct mlx5_eq_table *table = &dev->priv.eq_table;
 	int err;

@@ -785,22 +785,28 @@ int mlx5_stop_eqs(struct mlx5_core_dev *
 	if (MLX5_CAP_GEN(dev, pg)) {
 		err = mlx5_destroy_unmap_eq(dev, &table->pfault_eq);
 		if (err)
-			return err;
+			mlx5_core_err(dev, "failed to destroy page fault eq, err(%d)\n",
+				      err);
 	}
 #endif
 
 	err = mlx5_destroy_unmap_eq(dev, &table->pages_eq);
 	if (err)
-		return err;
+		mlx5_core_err(dev, "failed to destroy pages eq, err(%d)\n",
+			      err);
 
-	mlx5_destroy_unmap_eq(dev, &table->async_eq);
+	err = mlx5_destroy_unmap_eq(dev, &table->async_eq);
+	if (err)
+		mlx5_core_err(dev, "failed to destroy async eq, err(%d)\n",
+			      err);
 	mlx5_cmd_use_polling(dev);
 
 	err = mlx5_destroy_unmap_eq(dev, &table->cmd_eq);
-	if (err)
+	if (err) {
+		mlx5_core_err(dev, "failed to destroy command eq, err(%d)\n",
+			      err);
 		mlx5_cmd_use_events(dev);
-
-	return err;
+	}
 }
 
 int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq,

include/linux/mlx5/driver.h +1 -1

@@ -1017,7 +1017,7 @@ int mlx5_create_map_eq(struct mlx5_core_
 		       enum mlx5_eq_type type);
 int mlx5_destroy_unmap_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq);
 int mlx5_start_eqs(struct mlx5_core_dev *dev);
-int mlx5_stop_eqs(struct mlx5_core_dev *dev);
+void mlx5_stop_eqs(struct mlx5_core_dev *dev);
 int mlx5_vector2eqn(struct mlx5_core_dev *dev, int vector, int *eqn,
 		    unsigned int *irqn);
 int mlx5_core_attach_mcg(struct mlx5_core_dev *dev, union ib_gid *mgid, u32 qpn);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #40 lore raw

PATCH 40/115 net/mlx5: Stay in polling mode when command EQ destroy fails

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Moshe Shemesh <[email protected]>

[ Upstream commit a2fba188fd5eadd6061bef4f2f2577a43231ebf3 ]

During unload, on mlx5_stop_eqs we move command interface from events mode to polling mode, but if command interface EQ destroy fail we move back to events mode.
That's wrong since even if we fail to destroy command interface EQ, we do release its irq, so no interrupts will be received.

Fixes e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")

Signed-off-by Moshe Shemesh <[email protected]>

Signed-off-by Saeed Mahameed <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/mellanox/mlx5/core/eq.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

drivers/net/ethernet/mellanox/mlx5/core/eq.c +1 -3

@@ -802,11 +802,9 @@ void mlx5_stop_eqs(struct mlx5_core_dev
 	mlx5_cmd_use_polling(dev);
 
 	err = mlx5_destroy_unmap_eq(dev, &table->cmd_eq);
-	if (err) {
+	if (err)
 		mlx5_core_err(dev, "failed to destroy command eq, err(%d)\n",
 			      err);
-		mlx5_cmd_use_events(dev);
-	}
 }
 
 int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq,

Greg Kroah-Hartman

author maintainer

2018-03-02 09:01 UTC #41 lore raw

PATCH 41/115 ASoC: rsnd: fixup ADG register mask

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kuninori Morimoto <[email protected]>

[ Upstream commit d5aa24825da5711f8cb829f873160ddf1a29b19c ]

BRGCKR should use 0x80770000, instead of 0x80FF0000.

R-Car Gen2 xxx_TIMSEL should use 0x0F1F,
R-Car Gen3 xxx_TIMSEL should use 0x1F1F.
Here, Gen3 doesn't support AVD, thus, both case can use 0x0F1F.

Signed-off-by Kuninori Morimoto <[email protected]>

Reviewed-by Hiroyuki Yokoyama <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/soc/sh/rcar/adg.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

sound/soc/sh/rcar/adg.c +3 -3

@@ -216,7 +216,7 @@ int rsnd_adg_set_cmd_timsel_gen2(struct
 				   NULL, &val, NULL);
 
 	val  = val	<< shift;
-	mask = 0xffff	<< shift;
+	mask = 0x0f1f	<< shift;
 
 	rsnd_mod_bset(adg_mod, CMDOUT_TIMSEL, mask, val);

@@ -244,7 +244,7 @@ int rsnd_adg_set_src_timesel_gen2(struct
 
 	in   = in	<< shift;
 	out  = out	<< shift;
-	mask = 0xffff	<< shift;
+	mask = 0x0f1f	<< shift;
 
 	switch (id / 2) {
 	case 0:

@@ -374,7 +374,7 @@ int rsnd_adg_ssi_clk_try_start(struct rs
 			ckr = 0x80000000;
 	}
 
-	rsnd_mod_bset(adg_mod, BRGCKR, 0x80FF0000, adg->ckr | ckr);
+	rsnd_mod_bset(adg_mod, BRGCKR, 0x80770000, adg->ckr | ckr);
 	rsnd_mod_write(adg_mod, BRRA,  adg->rbga);
 	rsnd_mod_write(adg_mod, BRRB,  adg->rbgb);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #42 lore raw

PATCH 42/115 xen/balloon: Mark unallocated host memory as UNUSABLE

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Boris Ostrovsky <[email protected]>

[ Upstream commit b3cf8528bb21febb650a7ecbf080d0647be40b9f ]

Commit f5775e0b6116 ("x86/xen: discard RAM regions above the maximum reservation") left host memory not assigned to dom0 as available for memory hotplug.

Unfortunately this also meant that those regions could be used by others. Specifically, commit fa564ad96366 ("x86/PCI: Enable a 64bit BAR on AMD Family 15h (Models 00-1f, 30-3f, 60-7f)") may try to map those addresses as MMIO.

To prevent this mark unallocated host memory as E820_TYPE_UNUSABLE (thus effectively reverting f5775e0b6116) and keep track of that region as a hostmem resource that can be used for the hotplug.

Reviewed-by Juergen Gross <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/xen/enlighten.c |   81 +++++++++++++++++++++++++++++++++++++++++++++++
 arch/x86/xen/setup.c     |    6 +--
 drivers/xen/balloon.c    |   65 ++++++++++++++++++++++++++++++++-----
 include/xen/balloon.h    |    5 ++
 4 files changed, 144 insertions(+), 13 deletions(-)

arch/x86/xen/enlighten.c +81 -0

@@ -1,8 +1,12 @@
+#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+#include <linux/bootmem.h>
+#endif
 #include <linux/cpu.h>
 #include <linux/kexec.h>
 
 #include <xen/features.h>
 #include <xen/page.h>
+#include <xen/interface/memory.h>
 
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>

@@ -331,3 +335,80 @@ void xen_arch_unregister_cpu(int num)
 }
 EXPORT_SYMBOL(xen_arch_unregister_cpu);
 #endif
+
+#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+void __init arch_xen_balloon_init(struct resource *hostmem_resource)
+{
+	struct xen_memory_map memmap;
+	int rc;
+	unsigned int i, last_guest_ram;
+	phys_addr_t max_addr = PFN_PHYS(max_pfn);
+	struct e820_table *xen_e820_table;
+	const struct e820_entry *entry;
+	struct resource *res;
+
+	if (!xen_initial_domain())
+		return;
+
+	xen_e820_table = kmalloc(sizeof(*xen_e820_table), GFP_KERNEL);
+	if (!xen_e820_table)
+		return;
+
+	memmap.nr_entries = ARRAY_SIZE(xen_e820_table->entries);
+	set_xen_guest_handle(memmap.buffer, xen_e820_table->entries);
+	rc = HYPERVISOR_memory_op(XENMEM_machine_memory_map, &memmap);
+	if (rc) {
+		pr_warn("%s: Can't read host e820 (%d)\n", __func__, rc);
+		goto out;
+	}
+
+	last_guest_ram = 0;
+	for (i = 0; i < memmap.nr_entries; i++) {
+		if (xen_e820_table->entries[i].addr >= max_addr)
+			break;
+		if (xen_e820_table->entries[i].type == E820_TYPE_RAM)
+			last_guest_ram = i;
+	}
+
+	entry = &xen_e820_table->entries[last_guest_ram];
+	if (max_addr >= entry->addr + entry->size)
+		goto out; /* No unallocated host RAM. */
+
+	hostmem_resource->start = max_addr;
+	hostmem_resource->end = entry->addr + entry->size;
+
+	/*
+	 * Mark non-RAM regions between the end of dom0 RAM and end of host RAM
+	 * as unavailable. The rest of that region can be used for hotplug-based
+	 * ballooning.
+	 */
+	for (; i < memmap.nr_entries; i++) {
+		entry = &xen_e820_table->entries[i];
+
+		if (entry->type == E820_TYPE_RAM)
+			continue;
+
+		if (entry->addr >= hostmem_resource->end)
+			break;
+
+		res = kzalloc(sizeof(*res), GFP_KERNEL);
+		if (!res)
+			goto out;
+
+		res->name = "Unavailable host RAM";
+		res->start = entry->addr;
+		res->end = (entry->addr + entry->size < hostmem_resource->end) ?
+			    entry->addr + entry->size : hostmem_resource->end;
+		rc = insert_resource(hostmem_resource, res);
+		if (rc) {
+			pr_warn("%s: Can't insert [%llx - %llx) (%d)\n",
+				__func__, res->start, res->end, rc);
+			kfree(res);
+			goto  out;
+		}
+	}
+
+ out:
+	kfree(xen_e820_table);
+}
+#endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */

arch/x86/xen/setup.c +2 -4

@@ -808,7 +808,6 @@ char * __init xen_memory_setup(void)
 	addr = xen_e820_table.entries[0].addr;
 	size = xen_e820_table.entries[0].size;
 	while (i < xen_e820_table.nr_entries) {
-		bool discard = false;
 
 		chunk_size = size;
 		type = xen_e820_table.entries[i].type;

@@ -824,11 +823,10 @@ char * __init xen_memory_setup(void)
 				xen_add_extra_mem(pfn_s, n_pfns);
 				xen_max_p2m_pfn = pfn_s + n_pfns;
 			} else
-				discard = true;
+				type = E820_TYPE_UNUSABLE;
 		}
 
-		if (!discard)
-			xen_align_and_add_e820_region(addr, chunk_size, type);
+		xen_align_and_add_e820_region(addr, chunk_size, type);
 
 		addr += chunk_size;
 		size -= chunk_size;

drivers/xen/balloon.c +56 -9

91 lines not on this page · raw message

include/xen/balloon.h +5 -0

@@ -44,3 +44,8 @@ static inline void xen_balloon_init(void
 {
 }
 #endif
+
+#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+struct resource;
+void arch_xen_balloon_init(struct resource *hostmem_resource);
+#endif

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #43 lore raw

PATCH 43/115 netfilter: nf_tables: fix chain filter in nf_tables_dump_rules()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pablo Neira Ayuso <[email protected]>

[ Upstream commit 24c0df82ef7919e4d10cf2e4e65d368eb2e8ea21 ]

ctx->chain may be null now that we have very large object names, so we cannot check for ctx->chain[0] here.

Fixes b7263e071aba7 ("netfilter: nf_tables: Allow table names of up to 255 chars")

Signed-off-by Pablo Neira Ayuso <[email protected]>

Acked-by Phil Sutter <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/netfilter/nf_tables_api.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

net/netfilter/nf_tables_api.c +1 -1

@@ -2072,7 +2072,7 @@ static int nf_tables_dump_rules(struct s
 				continue;
 
 			list_for_each_entry_rcu(chain, &table->chains, list) {
-				if (ctx && ctx->chain[0] &&
+				if (ctx && ctx->chain &&
 				    strcmp(ctx->chain, chain->name) != 0)
 					continue;

Greg Kroah-Hartman

author maintainer

2018-03-02 09:01 UTC #44 lore raw

PATCH 44/115 scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Cathy Avery <[email protected]>

[ Upstream commit d1b8b2391c24751e44f618fcf86fb55d9a9247fd ]

When an I/O is returned with an srb_status of SRB_STATUS_INVALID_LUN which has zero good_bytes it must be assigned an error. Otherwise the I/O will be continuously requeued and will cause a deadlock in the case where disks are being hot added and removed. sd_probe_async will wait forever for its I/O to complete while holding scsi_sd_probe_domain.

Also returning the default error of DID_TARGET_FAILURE causes multipath to not retry the I/O resulting in applications receiving I/O errors before a failover can occur.

Signed-off-by Cathy Avery <[email protected]>

Signed-off-by Long Li <[email protected]>

Reviewed-by Stephen Hemminger <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/scsi/storvsc_drv.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/scsi/storvsc_drv.c +2 -1

@@ -952,10 +952,11 @@ static void storvsc_handle_error(struct
 		case TEST_UNIT_READY:
 			break;
 		default:
-			set_host_byte(scmnd, DID_TARGET_FAILURE);
+			set_host_byte(scmnd, DID_ERROR);
 		}
 		break;
 	case SRB_STATUS_INVALID_LUN:
+		set_host_byte(scmnd, DID_NO_CONNECT);
 		do_work = true;
 		process_err_fn = storvsc_remove_lun;
 		break;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #45 lore raw

PATCH 45/115 netfilter: uapi: correct UNTRACKED conntrack state bit number

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Westphal <[email protected]>

[ Upstream commit 4c82fd0abb87e20d0d68ef5237e74732352806c8 ]

nft_ct exposes this bit to userspace. This used to be

  #define NF_CT_STATE_UNTRACKED_BIT              (1 << (IP_CT_NUMBER + 1))
  (IP_CT_NUMBER is 5, so this was 0x40)

.. but this got changed to 8 (0x100) when the untracked object got removed. Replace this with a literal 6 to prevent further incompatible changes in case IP_CT_NUMBER ever increases.

Fixes cc41c84b7e7f2 ("netfilter: kill the fake untracked conntrack objects")

Reported-by Li Shuang <[email protected]>

Signed-off-by Florian Westphal <[email protected]>

Signed-off-by Pablo Neira Ayuso <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/uapi/linux/netfilter/nf_conntrack_common.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

include/uapi/linux/netfilter/nf_conntrack_common.h +1 -1

@@ -36,7 +36,7 @@ enum ip_conntrack_info {
 
 #define NF_CT_STATE_INVALID_BIT			(1 << 0)
 #define NF_CT_STATE_BIT(ctinfo)			(1 << ((ctinfo) % IP_CT_IS_REPLY + 1))
-#define NF_CT_STATE_UNTRACKED_BIT		(1 << (IP_CT_UNTRACKED + 1))
+#define NF_CT_STATE_UNTRACKED_BIT		(1 << 6)
 
 /* Bitset representing status of connection. */
 enum ip_conntrack_status {

Greg Kroah-Hartman

author maintainer

2018-03-02 09:01 UTC #46 lore raw

PATCH 46/115 i915: Reject CCS modifiers for pipe C on Geminilake

https://lists.freedesktop.org/archives/intel-gfx/2017-December/150646.html

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gabriel Krisman Bertazi <[email protected]>

[ Upstream commit 8bc0d7ac934b6f2d0dc8f38a3104d281c9db1e98 ]

Current code advertises (on the modifiers blob property) support for CCS modifier for pipe C on GLK, only to reject it later when validating the request before the atomic commit.

This fixes the tests igt@kms_ccs@pipe-c-*, which should skip on GLK for pipe C (see bug 104096).

A relevant discussion is archived at:

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104096

Signed-off-by Gabriel Krisman Bertazi <[email protected]>

Cc Ben Widawsky <[email protected]>

Reviewed-by Ben Widawsky <[email protected]>

Signed-off-by Rodrigo Vivi <[email protected]>

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

(cherry picked from commit f0cbd8bd877f3d8c5b80a6b1add9ca9010d7f9d8)

Signed-off-by Jani Nikula <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/i915/intel_display.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/gpu/drm/i915/intel_display.c +1 -1

@@ -13240,7 +13240,7 @@ intel_primary_plane_create(struct drm_i9
 	primary->frontbuffer_bit = INTEL_FRONTBUFFER_PRIMARY(pipe);
 	primary->check_plane = intel_check_primary_plane;
 
-	if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv)) {
+	if (INTEL_GEN(dev_priv) >= 10) {
 		intel_primary_formats = skl_primary_formats;
 		num_formats = ARRAY_SIZE(skl_primary_formats);
 		modifiers = skl_format_modifiers_ccs;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #47 lore raw

PATCH 47/115 RDMA/vmw_pvrdma: Call ib_umem_release on destroy QP path

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bryan Tan <[email protected]>

[ Upstream commit 17748056ce123ee37fb7382bc698fc721e3c4a09 ]

The QP cleanup did not previously call ib_umem_release, resulting in a user-triggerable kernel resource leak.

Fixes 29c8d9eba550 ("IB: Add vmw_pvrdma driver")

Reviewed-by Adit Ranadive <[email protected]>

Reviewed-by Aditya Sarwade <[email protected]>

Reviewed-by Jorgen Hansen <[email protected]>

Signed-off-by Bryan Tan <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c |    7 +++++++
 1 file changed, 7 insertions(+)

drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c +7 -0

@@ -406,6 +406,13 @@ static void pvrdma_free_qp(struct pvrdma
 	atomic_dec(&qp->refcnt);
 	wait_event(qp->wait, !atomic_read(&qp->refcnt));
 
+	if (!qp->is_kernel) {
+		if (qp->rumem)
+			ib_umem_release(qp->rumem);
+		if (qp->sumem)
+			ib_umem_release(qp->sumem);
+	}
+
 	pvrdma_page_dir_cleanup(dev, &qp->pdir);
 
 	kfree(qp);

Greg Kroah-Hartman

author maintainer

2018-03-02 09:01 UTC #48 lore raw

PATCH 48/115 ARM: dts: ls1021a: fix incorrect clock references

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

[ Upstream commit 506e8a912661c97b41adc8a286b875d01323ec45 ]

dtc warns about two 'clocks' properties that have an extraneous '1' at the end:

arch/arm/boot/dts/ls1021a-qds.dtb: Warning (clocks_property): arch/arm/boot/dts/ls1021a-twr.dtb: Warning (clocks_property): Property 'clocks', cell 1 is not a phandle reference in /soc/i2c@2180000/mux@77/i2c@4/sgtl5000@2a arch/arm/boot/dts/ls1021a-qds.dtb: Warning (clocks_property): Missing property '#clock-cells' in node /soc/interrupt-controller@1400000 or bad phandle (referred from /soc/i2c@2180000/mux@77/i2c@4/sgtl5000@2a:clocks[1]) Property 'clocks', cell 1 is not a phandle reference in /soc/i2c@2190000/sgtl5000@a
arch/arm/boot/dts/ls1021a-twr.dtb: Warning (clocks_property): Missing property '#clock-cells' in node /soc/interrupt-controller@1400000 or bad phandle (referred from /soc/i2c@2190000/sgtl5000@a:clocks[1])

The clocks that get referenced here are fixed-rate, so they do not take any argument, and dtc interprets the next cell as a phandle, which is invalid.

Signed-off-by Arnd Bergmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/boot/dts/ls1021a-qds.dts |    2 +-
 arch/arm/boot/dts/ls1021a-twr.dts |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

arch/arm/boot/dts/ls1021a-qds.dts +1 -1

@@ -215,7 +215,7 @@
 				reg = <0x2a>;
 				VDDA-supply = <&reg_3p3v>;
 				VDDIO-supply = <&reg_3p3v>;
-				clocks = <&sys_mclk 1>;
+				clocks = <&sys_mclk>;
 			};
 		};
 	};

arch/arm/boot/dts/ls1021a-twr.dts +1 -1

@@ -187,7 +187,7 @@
 		reg = <0x0a>;
 		VDDA-supply = <&reg_3p3v>;
 		VDDIO-supply = <&reg_3p3v>;
-		clocks = <&sys_mclk 1>;
+		clocks = <&sys_mclk>;
 	};
 };

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #49 lore raw

PATCH 49/115 crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jonathan Cameron <[email protected]>

[ Upstream commit af955bf15d2c27496b0269b1f05c26f758c68314 ]

This variable was increased and decreased without any protection. Result was an occasional misscount and negative wrap around resulting in false resource allocation failures.

Fixes 7d2c3f54e6f6 ("crypto: af_alg - remove locking in async callback")

Signed-off-by Jonathan Cameron <[email protected]>

Reviewed-by Stephan Mueller <[email protected]>

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 crypto/af_alg.c         |    4 ++--
 crypto/algif_aead.c     |    2 +-
 crypto/algif_skcipher.c |    2 +-
 include/crypto/if_alg.h |    5 +++--
 4 files changed, 7 insertions(+), 6 deletions(-)

crypto/af_alg.c +2 -2

@@ -693,7 +693,7 @@ void af_alg_free_areq_sgls(struct af_alg
 	unsigned int i;
 
 	list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) {
-		ctx->rcvused -= rsgl->sg_num_bytes;
+		atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused);
 		af_alg_free_sg(&rsgl->sgl);
 		list_del(&rsgl->list);
 		if (rsgl != &areq->first_rsgl)

@@ -1192,7 +1192,7 @@ int af_alg_get_rsgl(struct sock *sk, str
 
 		areq->last_rsgl = rsgl;
 		len += err;
-		ctx->rcvused += err;
+		atomic_add(err, &ctx->rcvused);
 		rsgl->sg_num_bytes = err;
 		iov_iter_advance(&msg->msg_iter, err);
 	}

crypto/algif_aead.c +1 -1

@@ -571,7 +571,7 @@ static int aead_accept_parent_nokey(void
 	INIT_LIST_HEAD(&ctx->tsgl_list);
 	ctx->len = len;
 	ctx->used = 0;
-	ctx->rcvused = 0;
+	atomic_set(&ctx->rcvused, 0);
 	ctx->more = 0;
 	ctx->merge = 0;
 	ctx->enc = 0;

crypto/algif_skcipher.c +1 -1

@@ -391,7 +391,7 @@ static int skcipher_accept_parent_nokey(
 	INIT_LIST_HEAD(&ctx->tsgl_list);
 	ctx->len = len;
 	ctx->used = 0;
-	ctx->rcvused = 0;
+	atomic_set(&ctx->rcvused, 0);
 	ctx->more = 0;
 	ctx->merge = 0;
 	ctx->enc = 0;

include/crypto/if_alg.h +3 -2

@@ -18,6 +18,7 @@
 #include <linux/if_alg.h>
 #include <linux/scatterlist.h>
 #include <linux/types.h>
+#include <linux/atomic.h>
 #include <net/sock.h>
 
 #include <crypto/aead.h>

@@ -155,7 +156,7 @@ struct af_alg_ctx {
 	struct af_alg_completion completion;
 
 	size_t used;
-	size_t rcvused;
+	atomic_t rcvused;
 
 	bool more;
 	bool merge;

@@ -228,7 +229,7 @@ static inline int af_alg_rcvbuf(struct s
 	struct af_alg_ctx *ctx = ask->private;
 
 	return max_t(int, max_t(int, sk->sk_rcvbuf & PAGE_MASK, PAGE_SIZE) -
-			  ctx->rcvused, 0);
+		     atomic_read(&ctx->rcvused), 0);
 }
 
 /**

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #50 lore raw

PATCH 50/115 lib/mpi: Fix umul_ppmm() for MIPS64r6

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: James Hogan <[email protected]>

[ Upstream commit bbc25bee37d2b32cf3a1fab9195b6da3a185614a ]

Current MIPS64r6 toolchains aren't able to generate efficient DMULU/DMUHU based code for the C implementation of umul_ppmm(), which performs an unsigned 64 x 64 bit multiply and returns the upper and lower 64-bit halves of the 128-bit result. Instead it widens the 64-bit inputs to 128-bits and emits a __multi3 intrinsic call to perform a 128 x 128 multiply. This is both inefficient, and it results in a link error since we don't include __multi3 in MIPS linux.

For example commit 90a53e4432b1 ("cfg80211: implement regdb signature checking") merged in v4.15-rc1 recently broke the 64r6_defconfig and 64r6el_defconfig builds by indirectly selecting MPILIB. The same build errors can be reproduced on older kernels by enabling e.g. CRYPTO_RSA:

lib/mpi/generic_mpih-mul1.o: In function `mpihelp_mul_1':
lib/mpi/generic_mpih-mul1.c:50: undefined reference to __multi3' lib/mpi/generic_mpih-mul2.o: In function mpihelp_addmul_1':
lib/mpi/generic_mpih-mul2.c:49: undefined reference to __multi3' lib/mpi/generic_mpih-mul3.o: In function mpihelp_submul_1':
lib/mpi/generic_mpih-mul3.c:49: undefined reference to __multi3' lib/mpi/mpih-div.o In function mpihelp_divrem':
lib/mpi/mpih-div.c:205: undefined reference to __multi3' lib/mpi/mpih-div.c:142: undefined reference to __multi3'

Therefore add an efficient MIPS64r6 implementation of umul_ppmm() using inline assembly and the DMULU/DMUHU instructions, to prevent __multi3 calls being emitted.

Fixes 7fd08ca58ae6 ("MIPS: Add build support for the MIPS R6 ISA")

Signed-off-by James Hogan <[email protected]>

Cc Ralf Baechle <[email protected]>

Cc Herbert Xu <[email protected]>

Cc "David S. Miller" <[email protected]>

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 lib/mpi/longlong.h |   18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

lib/mpi/longlong.h +17 -1

@@ -671,7 +671,23 @@ do {						\
 	**************  MIPS/64  **************
 	***************************************/
 #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64
-#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
+#if defined(__mips_isa_rev) && __mips_isa_rev >= 6
+/*
+ * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C
+ * code below, so we special case MIPS64r6 until the compiler can do better.
+ */
+#define umul_ppmm(w1, w0, u, v)						\
+do {									\
+	__asm__ ("dmulu %0,%1,%2"					\
+		 : "=d" ((UDItype)(w0))					\
+		 : "d" ((UDItype)(u)),					\
+		   "d" ((UDItype)(v)));					\
+	__asm__ ("dmuhu %0,%1,%2"					\
+		 : "=d" ((UDItype)(w1))					\
+		 : "d" ((UDItype)(u)),					\
+		   "d" ((UDItype)(v)));					\
+} while (0)
+#elif (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
 #define umul_ppmm(w1, w0, u, v) \
 do {									\
 	typedef unsigned int __ll_UTItype __attribute__((mode(TI)));	\

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #51 lore raw

PATCH 51/115 arm64: dts: renesas: ulcb: Remove renesas, no-ether-link property

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bogdan Mirea <[email protected]>

[ Upstream commit 7d2901f809c110bd9a261e879d59efe62e3bc758 ]

The present change is a bug fix for AVB link iteratively up/down.

Steps to reproduce:
- start AVB TX stream (Using aplay via MSE),
- disconnect+reconnect the eth cable,
- after a reconnection the eth connection goes iteratively up/down without user interaction,
- this may heal after some seconds or even stay for minutes.

As the documentation specifies, the "renesas,no-ether-link" option should be used when a board does not provide a proper AVB_LINK signal. There is no need for this option enabled on RCAR H3/M3 Salvator-X/XS and ULCB starter kits since the AVB_LINK is correctly handled by HW.

Choosing to keep or remove the "renesas,no-ether-link" option will have impact on the code flow in the following ways:
- keeping this option enabled may lead to unexpected behavior since the RX & TX are enabled/disabled directly from adjust_link function without any HW interrogation,
- removing this option, the RX & TX will only be enabled/disabled after HW interrogation. The HW check is made through the LMON pin in PSR register which specifies AVB_LINK signal value (0 - at low level; 1 - at high level).

In conclusion, the present change is also a safety improvement because it removes the "renesas,no-ether-link" option leading to a proper way of detecting the link state based on HW interrogation and not on software heuristic.

Fixes dc36965a8905 ("arm64: dts: r8a7796: salvator-x: Enable EthernetAVB")

Fixes 6fa501c549aa ("arm64: dts: r8a7795: enable EthernetAVB on Salvator-X")

Signed-off-by Bogdan Mirea <[email protected]>

Signed-off-by Vladimir Zapolskiy <[email protected]>

Signed-off-by Simon Horman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm64/boot/dts/renesas/ulcb.dtsi |    1 -
 1 file changed, 1 deletion(-)

arch/arm64/boot/dts/renesas/ulcb.dtsi +0 -1

@@ -145,7 +145,6 @@
 &avb {
 	pinctrl-0 = <&avb_pins>;
 	pinctrl-names = "default";
-	renesas,no-ether-link;
 	phy-handle = <&phy0>;
 	status = "okay";

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #52 lore raw

PATCH 52/115 crypto: inside-secure - per request invalidation

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ofer Heifetz <[email protected]>

[ Upstream commit 1eb7b40386c97f6c4d1c62931bf306f4535a4bd6 ]

When an invalidation request is needed we currently override the context .send and .handle_result helpers. This is wrong as under high load other requests can already be queued and overriding the context helpers will make them execute the wrong .send and .handle_result functions.

This commit fixes this by adding a needs_inv flag in the request to choose the action to perform when sending requests or handling their results. This flag will be set when needed (i.e. when the context flag will be set).

Fixes 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver")

Signed-off-by Ofer Heifetz <[email protected]>

[Antoine: commit message, and removed non related changes from the original commit]

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/crypto/inside-secure/safexcel_cipher.c |   71 ++++++++++++++++++++-----
 drivers/crypto/inside-secure/safexcel_hash.c   |   67 ++++++++++++++++++-----
 2 files changed, 111 insertions(+), 27 deletions(-)

drivers/crypto/inside-secure/safexcel_cipher.c +58 ~~-13~~

@@ -14,6 +14,7 @@
 
 #include <crypto/aes.h>
 #include <crypto/skcipher.h>
+#include <crypto/internal/skcipher.h>
 
 #include "safexcel.h"

@@ -33,6 +34,10 @@ struct safexcel_cipher_ctx {
 	unsigned int key_len;
 };
 
+struct safexcel_cipher_req {
+	bool needs_inv;
+};
+
 static void safexcel_cipher_token(struct safexcel_cipher_ctx *ctx,
 				  struct crypto_async_request *async,
 				  struct safexcel_command_desc *cdesc,

@@ -126,9 +131,9 @@ static int safexcel_context_control(stru
 	return 0;
 }
 
-static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
-				  struct crypto_async_request *async,
-				  bool *should_complete, int *ret)
+static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, int ring,
+				      struct crypto_async_request *async,
+				      bool *should_complete, int *ret)
 {
 	struct skcipher_request *req = skcipher_request_cast(async);
 	struct safexcel_result_desc *rdesc;

@@ -265,7 +270,6 @@ static int safexcel_aes_send(struct cryp
 	spin_unlock_bh(&priv->ring[ring].egress_lock);
 
 	request->req = &req->base;
-	ctx->base.handle_result = safexcel_handle_result;
 
 	*commands = n_cdesc;
 	*results = n_rdesc;

@@ -341,8 +345,6 @@ static int safexcel_handle_inv_result(st
 
 	ring = safexcel_select_ring(priv);
 	ctx->base.ring = ring;
-	ctx->base.needs_inv = false;
-	ctx->base.send = safexcel_aes_send;
 
 	spin_lock_bh(&priv->ring[ring].queue_lock);
 	enq_ret = crypto_enqueue_request(&priv->ring[ring].queue, async);

@@ -359,6 +361,26 @@ static int safexcel_handle_inv_result(st
 	return ndesc;
 }
 
+static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
+				  struct crypto_async_request *async,
+				  bool *should_complete, int *ret)
+{
+	struct skcipher_request *req = skcipher_request_cast(async);
+	struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
+	int err;
+
+	if (sreq->needs_inv) {
+		sreq->needs_inv = false;
+		err = safexcel_handle_inv_result(priv, ring, async,
+						 should_complete, ret);
+	} else {
+		err = safexcel_handle_req_result(priv, ring, async,
+						 should_complete, ret);
+	}
+
+	return err;
+}
+
 static int safexcel_cipher_send_inv(struct crypto_async_request *async,
 				    int ring, struct safexcel_request *request,
 				    int *commands, int *results)

@@ -368,8 +390,6 @@ static int safexcel_cipher_send_inv(stru
 	struct safexcel_crypto_priv *priv = ctx->priv;
 	int ret;
 
-	ctx->base.handle_result = safexcel_handle_inv_result;
-
 	ret = safexcel_invalidate_cache(async, &ctx->base, priv,
 					ctx->base.ctxr_dma, ring, request);
 	if (unlikely(ret))

@@ -381,11 +401,29 @@ static int safexcel_cipher_send_inv(stru
 	return 0;
 }
 
+static int safexcel_send(struct crypto_async_request *async,
+			 int ring, struct safexcel_request *request,
+			 int *commands, int *results)
+{
+	struct skcipher_request *req = skcipher_request_cast(async);
+	struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
+	int ret;
+
+	if (sreq->needs_inv)
+		ret = safexcel_cipher_send_inv(async, ring, request,
+					       commands, results);
+	else
+		ret = safexcel_aes_send(async, ring, request,
+					commands, results);
+	return ret;
+}
+
 static int safexcel_cipher_exit_inv(struct crypto_tfm *tfm)
 {
 	struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(tfm);
 	struct safexcel_crypto_priv *priv = ctx->priv;
 	struct skcipher_request req;
+	struct safexcel_cipher_req *sreq = skcipher_request_ctx(&req);
 	struct safexcel_inv_result result = {};
 	int ring = ctx->base.ring;

@@ -399,7 +437,7 @@ static int safexcel_cipher_exit_inv(stru
 	skcipher_request_set_tfm(&req, __crypto_skcipher_cast(tfm));
 	ctx = crypto_tfm_ctx(req.base.tfm);
 	ctx->base.exit_inv = true;
-	ctx->base.send = safexcel_cipher_send_inv;
+	sreq->needs_inv = true;
 
 	spin_lock_bh(&priv->ring[ring].queue_lock);
 	crypto_enqueue_request(&priv->ring[ring].queue, &req.base);

@@ -424,19 +462,21 @@ static int safexcel_aes(struct skcipher_
 			enum safexcel_cipher_direction dir, u32 mode)
 {
 	struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
+	struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
 	struct safexcel_crypto_priv *priv = ctx->priv;
 	int ret, ring;
 
+	sreq->needs_inv = false;
 	ctx->direction = dir;
 	ctx->mode = mode;
 
 	if (ctx->base.ctxr) {
-		if (ctx->base.needs_inv)
-			ctx->base.send = safexcel_cipher_send_inv;
+		if (ctx->base.needs_inv) {
+			sreq->needs_inv = true;
+			ctx->base.needs_inv = false;
+		}
 	} else {
 		ctx->base.ring = safexcel_select_ring(priv);
-		ctx->base.send = safexcel_aes_send;
-
 		ctx->base.ctxr = dma_pool_zalloc(priv->context_pool,
 						 EIP197_GFP_FLAGS(req->base),
 						 &ctx->base.ctxr_dma);

@@ -476,6 +516,11 @@ static int safexcel_skcipher_cra_init(st
 			     alg.skcipher.base);
 
 	ctx->priv = tmpl->priv;
+	ctx->base.send = safexcel_send;
+	ctx->base.handle_result = safexcel_handle_result;
+
+	crypto_skcipher_set_reqsize(__crypto_skcipher_cast(tfm),
+				    sizeof(struct safexcel_cipher_req));
 
 	return 0;
 }

drivers/crypto/inside-secure/safexcel_hash.c +53 ~~-14~~

143 lines not on this page · raw message

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #53 lore raw

PATCH 53/115 crypto: inside-secure - free requests even if their handling failed

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Antoine T�nart" <[email protected]>

[ Upstream commit 0a02dcca126280595950f3ea809f77c9cb0a235c ]

This patch frees the request private data even if its handling failed, as it would never be freed otherwise.

Fixes 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver")

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/crypto/inside-secure/safexcel.c |    1 +
 1 file changed, 1 insertion(+)

drivers/crypto/inside-secure/safexcel.c +1 -0

@@ -607,6 +607,7 @@ static inline void safexcel_handle_resul
 		ndesc = ctx->handle_result(priv, ring, sreq->req,
 					   &should_complete, &ret);
 		if (ndesc < 0) {
+			kfree(sreq);
 			dev_err(priv->dev, "failed to handle result (%d)", ndesc);
 			return;
 		}

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #54 lore raw

PATCH 54/115 crypto: inside-secure - fix request allocations in invalidation path

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Antoine T�nart" <[email protected]>

[ Upstream commit 7cad2fabd5691dbb17762877d4e7f236fe4bc181 ]

This patch makes use of the SKCIPHER_REQUEST_ON_STACK and AHASH_REQUEST_ON_STACK helpers to allocate enough memory to contain both the crypto request structures and their embedded context (__ctx).

Fixes 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver")

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/crypto/inside-secure/safexcel_cipher.c |   16 ++++++++--------
 drivers/crypto/inside-secure/safexcel_hash.c   |   14 +++++++-------
 2 files changed, 15 insertions(+), 15 deletions(-)

drivers/crypto/inside-secure/safexcel_cipher.c +8 -8

@@ -422,25 +422,25 @@ static int safexcel_cipher_exit_inv(stru
 {
 	struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(tfm);
 	struct safexcel_crypto_priv *priv = ctx->priv;
-	struct skcipher_request req;
-	struct safexcel_cipher_req *sreq = skcipher_request_ctx(&req);
+	SKCIPHER_REQUEST_ON_STACK(req, __crypto_skcipher_cast(tfm));
+	struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
 	struct safexcel_inv_result result = {};
 	int ring = ctx->base.ring;
 
-	memset(&req, 0, sizeof(struct skcipher_request));
+	memset(req, 0, sizeof(struct skcipher_request));
 
 	/* create invalidation request */
 	init_completion(&result.completion);
-	skcipher_request_set_callback(&req, CRYPTO_TFM_REQ_MAY_BACKLOG,
-					safexcel_inv_complete, &result);
+	skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+				      safexcel_inv_complete, &result);
 
-	skcipher_request_set_tfm(&req, __crypto_skcipher_cast(tfm));
-	ctx = crypto_tfm_ctx(req.base.tfm);
+	skcipher_request_set_tfm(req, __crypto_skcipher_cast(tfm));
+	ctx = crypto_tfm_ctx(req->base.tfm);
 	ctx->base.exit_inv = true;
 	sreq->needs_inv = true;
 
 	spin_lock_bh(&priv->ring[ring].queue_lock);
-	crypto_enqueue_request(&priv->ring[ring].queue, &req.base);
+	crypto_enqueue_request(&priv->ring[ring].queue, &req->base);
 	spin_unlock_bh(&priv->ring[ring].queue_lock);
 
 	if (!priv->ring[ring].need_dequeue)

drivers/crypto/inside-secure/safexcel_hash.c +7 -7

@@ -470,25 +470,25 @@ static int safexcel_ahash_exit_inv(struc
 {
 	struct safexcel_ahash_ctx *ctx = crypto_tfm_ctx(tfm);
 	struct safexcel_crypto_priv *priv = ctx->priv;
-	struct ahash_request req;
-	struct safexcel_ahash_req *rctx = ahash_request_ctx(&req);
+	AHASH_REQUEST_ON_STACK(req, __crypto_ahash_cast(tfm));
+	struct safexcel_ahash_req *rctx = ahash_request_ctx(req);
 	struct safexcel_inv_result result = {};
 	int ring = ctx->base.ring;
 
-	memset(&req, 0, sizeof(struct ahash_request));
+	memset(req, 0, sizeof(struct ahash_request));
 
 	/* create invalidation request */
 	init_completion(&result.completion);
-	ahash_request_set_callback(&req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+	ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
 				   safexcel_inv_complete, &result);
 
-	ahash_request_set_tfm(&req, __crypto_ahash_cast(tfm));
-	ctx = crypto_tfm_ctx(req.base.tfm);
+	ahash_request_set_tfm(req, __crypto_ahash_cast(tfm));
+	ctx = crypto_tfm_ctx(req->base.tfm);
 	ctx->base.exit_inv = true;
 	rctx->needs_inv = true;
 
 	spin_lock_bh(&priv->ring[ring].queue_lock);
-	crypto_enqueue_request(&priv->ring[ring].queue, &req.base);
+	crypto_enqueue_request(&priv->ring[ring].queue, &req->base);
 	spin_unlock_bh(&priv->ring[ring].queue_lock);
 
 	if (!priv->ring[ring].need_dequeue)

Greg Kroah-Hartman

author maintainer

2018-03-02 09:01 UTC #55 lore raw

PATCH 55/115 netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hangbin Liu <[email protected]>

[ Upstream commit 8bea728dce8972e534e6b99fd550f7b5cc3864e8 ]

If there is no NFTA_OBJ_TABLE and NFTA_OBJ_TYPE, the c.data will be NULL in nf_tables_getobj(). So before free filter->table in nf_tables_dump_obj_done(), we need to check if filter is NULL first.

Fixes e46abbcc05aa ("netfilter: nf_tables: Allow table names of up to 255 chars")

Signed-off-by Hangbin Liu <[email protected]>

Acked-by Phil Sutter <[email protected]>

Signed-off-by Pablo Neira Ayuso <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/netfilter/nf_tables_api.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

net/netfilter/nf_tables_api.c +4 -2

@@ -4596,8 +4596,10 @@ static int nf_tables_dump_obj_done(struc
 {
 	struct nft_obj_filter *filter = cb->data;
 
-	kfree(filter->table);
-	kfree(filter);
+	if (filter) {
+		kfree(filter->table);
+		kfree(filter);
+	}
 
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:50 UTC #56 lore raw

PATCH 56/115 tipc: error path leak fixes in tipc_enable_bearer()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tommi Rantala <[email protected]>

[ Upstream commit 19142551b2be4a9e13838099fde1351386e5e007 ]

Fix memory leak in tipc_enable_bearer() if enable_media() fails, and cleanup with bearer_disable() if tipc_mon_create() fails.

Acked-by Ying Xue <[email protected]>

Acked-by Jon Maloy <[email protected]>

Signed-off-by Tommi Rantala <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/tipc/bearer.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

net/tipc/bearer.c +4 -1

@@ -324,6 +324,7 @@ restart:
 	if (res) {
 		pr_warn("Bearer <%s> rejected, enable failure (%d)\n",
 			name, -res);
+		kfree(b);
 		return -EINVAL;
 	}

@@ -347,8 +348,10 @@ restart:
 	if (skb)
 		tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr);
 
-	if (tipc_mon_create(net, bearer_id))
+	if (tipc_mon_create(net, bearer_id)) {
+		bearer_disable(net, b);
 		return -ENOMEM;
+	}
 
 	pr_info("Enabled bearer <%s>, discovery domain %s, priority %u\n",
 		name,

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #57 lore raw

PATCH 57/115 tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tommi Rantala <[email protected]>

[ Upstream commit 642a8439ddd8423b92f2e71960afe21ee1f66bb6 ]

Calling tipc_mon_delete() before the monitor has been created will oops. This can happen in tipc_enable_bearer() error path if tipc_disc_create() fails.

[   48.589074] BUG: unable to handle kernel paging request at 0000000000001008
[   48.590266] IP: tipc_mon_delete+0xea/0x270 [tipc]
[   48.591223] PGD 1e60c5067 P4D 1e60c5067 PUD 1eb0cf067 PMD 0
[   48.592230] Oops: 0000 [#1] SMP KASAN
[   48.595610] CPU: 5 PID: 1199 Comm: tipc Tainted: G    B            4.15.0-rc4-pc64-dirty #5
[   48.597176] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014
[   48.598489] RIP: 0010:tipc_mon_delete+0xea/0x270 [tipc]
[   48.599347] RSP: 0018:ffff8801d827f668 EFLAGS: 00010282
[   48.600705] RAX: ffff8801ee813f00 RBX: 0000000000000204 RCX: 0000000000000000
[   48.602183] RDX: 1ffffffff1de6a75 RSI: 0000000000000297 RDI: 0000000000000297
[   48.604373] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff1dd1533
[   48.605607] R10: ffffffff8eafbb05 R11: fffffbfff1dd1534 R12: 0000000000000050
[   48.607082] R13: dead000000000200 R14: ffffffff8e73f310 R15: 0000000000001020
[   48.608228] FS:  00007fc686484800(0000) GS:ffff8801f5540000(0000) knlGS:0000000000000000
[   48.610189] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   48.611459] CR2: 0000000000001008 CR3: 00000001dda70002 CR4: 00000000003606e0
[   48.612759] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   48.613831] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   48.615038] Call Trace:
[   48.615635]  tipc_enable_bearer+0x415/0x5e0 [tipc]
[   48.620623]  tipc_nl_bearer_enable+0x1ab/0x200 [tipc]
[   48.625118]  genl_family_rcv_msg+0x36b/0x570
[   48.631233]  genl_rcv_msg+0x5a/0xa0
[   48.631867]  netlink_rcv_skb+0x1cc/0x220
[   48.636373]  genl_rcv+0x24/0x40
[   48.637306]  netlink_unicast+0x29c/0x350
[   48.639664]  netlink_sendmsg+0x439/0x590
[   48.642014]  SYSC_sendto+0x199/0x250
[   48.649912]  do_syscall_64+0xfd/0x2c0
[   48.650651]  entry_SYSCALL64_slow_path+0x25/0x25
[   48.651843] RIP: 0033:0x7fc6859848e3
[   48.652539] RSP: 002b:00007ffd25dff938 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[   48.654003] RAX: ffffffffffffffda RBX: 00007ffd25dff990 RCX: 00007fc6859848e3
[   48.655303] RDX: 0000000000000054 RSI: 00007ffd25dff990 RDI: 0000000000000003
[   48.656512] RBP: 00007ffd25dff980 R08: 00007fc685c35fc0 R09: 000000000000000c
[   48.657697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000d13010
[   48.658840] R13: 00007ffd25e009c0 R14: 0000000000000000 R15: 0000000000000000
[   48.662972] RIP: tipc_mon_delete+0xea/0x270 [tipc] RSP: ffff8801d827f668
[   48.664073] CR2: 0000000000001008
[   48.664576] ---[ end trace e811818d54d5ce88 ]---

Acked-by Ying Xue <[email protected]>

Acked-by Jon Maloy <[email protected]>

Signed-off-by Tommi Rantala <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/tipc/monitor.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

net/tipc/monitor.c +5 -1

@@ -633,9 +633,13 @@ void tipc_mon_delete(struct net *net, in
 {
 	struct tipc_net *tn = tipc_net(net);
 	struct tipc_monitor *mon = tipc_monitor(net, bearer_id);
-	struct tipc_peer *self = get_self(net, bearer_id);
+	struct tipc_peer *self;
 	struct tipc_peer *peer, *tmp;
 
+	if (!mon)
+		return;
+
+	self = get_self(net, bearer_id);
 	write_lock_bh(&mon->lock);
 	tn->monitors[bearer_id] = NULL;
 	list_for_each_entry_safe(peer, tmp, &self->list, list) {

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #58 lore raw

PATCH 58/115 tg3: Add workaround to restrict 5762 MRRS to 2048

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Siva Reddy Kallam <[email protected]>

[ Upstream commit 4419bb1cedcda0272e1dc410345c5a1d1da0e367 ]

One of AMD based server with 5762 hangs with jumbo frame traffic. This AMD platform has southbridge limitation which is restricting MRRS to 4000. As a work around, driver to restricts the MRRS to 2048 for this particular 5762 NX1 card.

Signed-off-by Siva Reddy Kallam <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/broadcom/tg3.c |   10 ++++++++++
 drivers/net/ethernet/broadcom/tg3.h |    4 ++++
 2 files changed, 14 insertions(+)

drivers/net/ethernet/broadcom/tg3.c +10 -0

@@ -10052,6 +10052,16 @@ static int tg3_reset_hw(struct tg3 *tp,
 
 	tw32(GRC_MODE, tp->grc_mode | val);
 
+	/* On one of the AMD platform, MRRS is restricted to 4000 because of
+	 * south bridge limitation. As a workaround, Driver is setting MRRS
+	 * to 2048 instead of default 4096.
+	 */
+	if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
+	    tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) {
+		val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK;
+		tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048);
+	}
+
 	/* Setup the timer prescalar register.  Clock is always 66Mhz. */
 	val = tr32(GRC_MISC_CFG);
 	val &= ~0xff;

drivers/net/ethernet/broadcom/tg3.h +4 -0

@@ -96,6 +96,7 @@
 #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR		0x0106
 #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT		0x0109
 #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT	0x010a
+#define TG3PCI_SUBDEVICE_ID_DELL_5762		0x07f0
 #define TG3PCI_SUBVENDOR_ID_COMPAQ		PCI_VENDOR_ID_COMPAQ
 #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE	0x007c
 #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2	0x009a

@@ -281,6 +282,9 @@
 #define TG3PCI_STD_RING_PROD_IDX	0x00000098 /* 64-bit */
 #define TG3PCI_RCV_RET_RING_CON_IDX	0x000000a0 /* 64-bit */
 /* 0xa8 --> 0xb8 unused */
+#define TG3PCI_DEV_STATUS_CTRL		0x000000b4
+#define  MAX_READ_REQ_SIZE_2048		 0x00004000
+#define  MAX_READ_REQ_MASK		 0x00007000
 #define TG3PCI_DUAL_MAC_CTRL		0x000000b8
 #define  DUAL_MAC_CTRL_CH_MASK		 0x00000003
 #define  DUAL_MAC_CTRL_ID		 0x00000004

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #59 lore raw

PATCH 59/115 tg3: Enable PHY reset in MTU change path for 5720

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Siva Reddy Kallam <[email protected]>

[ Upstream commit e60ee41aaf898584205a6af5c996860d0fe6a836 ]

A customer noticed RX path hang when MTU is changed on the fly while running heavy traffic with NCSI enabled for 5717 and 5719. Since 5720 belongs to same ASIC family, we observed same issue and same fix could solve this problem for 5720.

Signed-off-by Siva Reddy Kallam <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/broadcom/tg3.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/net/ethernet/broadcom/tg3.c +2 -1

@@ -14239,7 +14239,8 @@ static int tg3_change_mtu(struct net_dev
 	 */
 	if (tg3_asic_rev(tp) == ASIC_REV_57766 ||
 	    tg3_asic_rev(tp) == ASIC_REV_5717 ||
-	    tg3_asic_rev(tp) == ASIC_REV_5719)
+	    tg3_asic_rev(tp) == ASIC_REV_5719 ||
+	    tg3_asic_rev(tp) == ASIC_REV_5720)
 		reset_phy = true;
 
 	err = tg3_restart_hw(tp, reset_phy);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #60 lore raw

PATCH 60/115 bnx2x: Improve reliability in case of nested PCI errors

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Guilherme G. Piccoli" <[email protected]>

[ Upstream commit f7084059a9cb9e56a186e1677b1dcffd76c2cd24 ]

While in recovery process of PCI error (called EEH on PowerPC arch), another PCI transaction could be corrupted causing a situation of nested PCI errors. Also, this scenario could be reproduced with error injection mechanisms (for debug purposes).

We observe that in case of nested PCI errors, bnx2x might attempt to initialize its shmem and cause a kernel crash due to bad addresses read from MCP. Multiple different stack traces were observed depending on the point the second PCI error happens.

This patch avoids the crashes by:

* failing PCI recovery in case of nested errors (since multiple PCI errors in a row are not expected to lead to a functional adapter anyway), and by,

* preventing access to adapter FW when MCP is failed (we mark it as failed when shmem cannot get initialized properly).

Reported-by Abdul Haleem <[email protected]>

Signed-off-by Guilherme G. Piccoli <[email protected]>

Acked-by Shahed Shaikh <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c  |    4 ++--
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c |   14 +++++++++++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +2 -2

@@ -3030,7 +3030,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i
 
 	del_timer_sync(&bp->timer);
 
-	if (IS_PF(bp)) {
+	if (IS_PF(bp) && !BP_NOMCP(bp)) {
 		/* Set ALWAYS_ALIVE bit in shmem */
 		bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE;
 		bnx2x_drv_pulse(bp);

@@ -3116,7 +3116,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i
 	bp->cnic_loaded = false;
 
 	/* Clear driver version indication in shmem */
-	if (IS_PF(bp))
+	if (IS_PF(bp) && !BP_NOMCP(bp))
 		bnx2x_update_mng_version(bp);
 
 	/* Check if there are pending parity attentions. If there are - set

drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +13 -1

@@ -9578,6 +9578,15 @@ static int bnx2x_init_shmem(struct bnx2x
 
 	do {
 		bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR);
+
+		/* If we read all 0xFFs, means we are in PCI error state and
+		 * should bail out to avoid crashes on adapter's FW reads.
+		 */
+		if (bp->common.shmem_base == 0xFFFFFFFF) {
+			bp->flags |= NO_MCP_FLAG;
+			return -ENODEV;
+		}
+
 		if (bp->common.shmem_base) {
 			val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]);
 			if (val & SHR_MEM_VALIDITY_MB)

@@ -14315,7 +14324,10 @@ static pci_ers_result_t bnx2x_io_slot_re
 		BNX2X_ERR("IO slot reset --> driver unload\n");
 
 		/* MCP should have been reset; Need to wait for validity */
-		bnx2x_init_shmem(bp);
+		if (bnx2x_init_shmem(bp)) {
+			rtnl_unlock();
+			return PCI_ERS_RESULT_DISCONNECT;
+		}
 
 		if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) {
 			u32 v;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #61 lore raw

PATCH 61/115 perf/x86/intel: Plug memory leak in intel_pmu_init()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <[email protected]>

[ Upstream commit 7ad1437d6ace0e450a6c1167720608ad660b191d ]

A recent commit introduced an extra merge_attr() call in the skylake branch, which causes a memory leak.

Store the pointer to the extra allocated memory and free it at the end of the function.

Fixes a5df70c354c2 ("perf/x86: Only show format attributes when supported")

Reported-by Tommi Rantala <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Cc Andi Kleen <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/events/intel/core.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

arch/x86/events/intel/core.c +4 -1

@@ -3847,6 +3847,8 @@ static struct attribute *intel_pmu_attrs
 
 __init int intel_pmu_init(void)
 {
+	struct attribute **extra_attr = NULL;
+	struct attribute **to_free = NULL;
 	union cpuid10_edx edx;
 	union cpuid10_eax eax;
 	union cpuid10_ebx ebx;

@@ -3854,7 +3856,6 @@ __init int intel_pmu_init(void)
 	unsigned int unused;
 	struct extra_reg *er;
 	int version, i;
-	struct attribute **extra_attr = NULL;
 	char *name;
 
 	if (!cpu_has(&boot_cpu_data, X86_FEATURE_ARCH_PERFMON)) {

@@ -4294,6 +4295,7 @@ __init int intel_pmu_init(void)
 		extra_attr = boot_cpu_has(X86_FEATURE_RTM) ?
 			hsw_format_attr : nhm_format_attr;
 		extra_attr = merge_attr(extra_attr, skl_format_attr);
+		to_free = extra_attr;
 		x86_pmu.cpu_events = get_hsw_events_attrs();
 		intel_pmu_pebs_data_source_skl(
 			boot_cpu_data.x86_model == INTEL_FAM6_SKYLAKE_X);

@@ -4401,6 +4403,7 @@ __init int intel_pmu_init(void)
 		pr_cont("full-width counters, ");
 	}
 
+	kfree(to_free);
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #62 lore raw

PATCH 62/115 led: core: Fix brightness setting when setting delay_off=0

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Matthieu CASTET <[email protected]>

[ Upstream commit 2b83ff96f51d0b039c4561b9f95c824d7bddb85c ]

With the current code, the following sequence won't work :
echo timer > trigger

echo 0 > delay_off
* at this point we call
** led_delay_off_store
** led_blink_set

---
 drivers/leds/led-core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/leds/led-core.c +1 -1

@@ -187,7 +187,7 @@ void led_blink_set(struct led_classdev *
 		   unsigned long *delay_on,
 		   unsigned long *delay_off)
 {
-	del_timer_sync(&led_cdev->blink_timer);
+	led_stop_software_blink(led_cdev);
 
 	clear_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags);
 	clear_bit(LED_BLINK_ONESHOT_STOP, &led_cdev->work_flags);

Greg Kroah-Hartman

author maintainer

2018-03-02 09:04 UTC #63 lore raw

PATCH 63/115 IB/mlx5: Fix mlx5_ib_alloc_mr error flow

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nitzan Carmi <[email protected]>

[ Upstream commit 45e6ae7ef21b907dacb18da62d5787d74a31d860 ]

ibmr.device is being set only after ib_alloc_mr() is (successfully) complete. Therefore, in case mlx5_core_create_mkey() return with error, the error flow calls mlx5_free_priv_descs() which uses ibmr.device (which doesn't exist yet), causing a NULL dereference oops.

To fix this, the IB device should be set in the mr struct earlier stage (e.g. prior to calling mlx5_core_create_mkey()).

Fixes 8a187ee52b04 ("IB/mlx5: Support the new memory registration API")

Signed-off-by Max Gurtovoy <[email protected]>

Signed-off-by Nitzan Carmi <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/mlx5/mr.c |    1 +
 1 file changed, 1 insertion(+)

drivers/infiniband/hw/mlx5/mr.c +1 -0

@@ -1637,6 +1637,7 @@ struct ib_mr *mlx5_ib_alloc_mr(struct ib
 	MLX5_SET(mkc, mkc, access_mode, mr->access_mode);
 	MLX5_SET(mkc, mkc, umr_en, 1);
 
+	mr->ibmr.device = pd->device;
 	err = mlx5_core_create_mkey(dev->mdev, &mr->mmkey, in, inlen);
 	if (err)
 		goto err_destroy_psv;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #64 lore raw

PATCH 64/115 genirq: Guard handle_bad_irq log messages

Link https://bugzilla.kernel.org/show_bug.cgi?id=197953

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <[email protected]>

[ Upstream commit 11bca0a83f83f6093d816295668e74ef24595944 ]

An interrupt storm on a bad interrupt will cause the kernel log to be clogged.

[   60.089234] ->handle_irq():  ffffffffbe2f803f,
[   60.090455] 0xffffffffbf2af380
[   60.090510] handle_bad_irq+0x0/0x2e5
[   60.090522] ->irq_data.chip(): ffffffffbf2af380,
[   60.090553]    IRQ_NOPROBE set
[   60.090584] ->handle_irq():  ffffffffbe2f803f,
[   60.090590] handle_bad_irq+0x0/0x2e5
[   60.090596] ->irq_data.chip(): ffffffffbf2af380,
[   60.090602] 0xffffffffbf2af380
[   60.090608] ->action():           (null)
[   60.090779] handle_bad_irq+0x0/0x2e5

This was seen when running an upstream kernel on Acer Chromebook R11. The system was unstable as result.

Guard the log message with __printk_ratelimit to reduce the impact. This won't prevent the interrupt storm from happening, but at least the system remains stable.

Signed-off-by Guenter Roeck <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Cc Dmitry Torokhov <[email protected]>

Cc Joe Perches <[email protected]>

Cc Andy Shevchenko <[email protected]>

Cc Mika Westerberg <[email protected]>

Link https://lkml.kernel.org/r/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/irq/debug.h |    5 +++++
 1 file changed, 5 insertions(+)

kernel/irq/debug.h +5 -0

@@ -12,6 +12,11 @@
 
 static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc)
 {
+	static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
+
+	if (!__ratelimit(&ratelimit))
+		return;
+
 	printk("irq %d, desc: %p, depth: %d, count: %d, unhandled: %d\n",
 		irq, desc, desc->depth, desc->irq_count, desc->irqs_unhandled);
 	printk("->handle_irq():  %p, ", desc->handle_irq);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #65 lore raw

PATCH 65/115 afs: Fix missing error handling in afs_write_end()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Howells <[email protected]>

[ Upstream commit afae457d874860a7e299d334f59eede5f3ad4b47 ]

afs_write_end() is missing page unlock and put if afs_fill_page() fails.

Reported-by Al Viro <[email protected]>

Signed-off-by David Howells <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/afs/write.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

fs/afs/write.c +5 -3

@@ -282,7 +282,7 @@ int afs_write_end(struct file *file, str
 			ret = afs_fill_page(vnode, key, pos + copied,
 					    len - copied, page);
 			if (ret < 0)
-				return ret;
+				goto out;
 		}
 		SetPageUptodate(page);
 	}

@@ -290,10 +290,12 @@ int afs_write_end(struct file *file, str
 	set_page_dirty(page);
 	if (PageDirty(page))
 		_debug("dirtied");
+	ret = copied;
+
+out:
 	unlock_page(page);
 	put_page(page);
-
-	return copied;
+	return ret;
 }
 
 /*

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #66 lore raw

PATCH 66/115 s390/dasd: fix wrongly assigned configuration data

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stefan Haberland <[email protected]>

[ Upstream commit 8a9bd4f8ebc6800bfc0596e28631ff6809a2f615 ]

We store per path and per device configuration data to identify the path or device correctly. The per path configuration data might get mixed up if the original request gets into error recovery and is started with a random path mask.

This would lead to a wrong identification of a path in case of a CUIR event for example.

Fix by copying the path mask from the original request to the error recovery request in case it is a path verification request.

Signed-off-by Stefan Haberland <[email protected]>

Reviewed-by Jan Hoeppner <[email protected]>

Signed-off-by Martin Schwidefsky <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/s390/block/dasd_3990_erp.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

drivers/s390/block/dasd_3990_erp.c +10 -0

@@ -2803,6 +2803,16 @@ dasd_3990_erp_action(struct dasd_ccw_req
 		erp = dasd_3990_erp_handle_match_erp(cqr, erp);
 	}
 
+
+	/*
+	 * For path verification work we need to stick with the path that was
+	 * originally chosen so that the per path configuration data is
+	 * assigned correctly.
+	 */
+	if (test_bit(DASD_CQR_VERIFY_PATH, &erp->flags) && cqr->lpm) {
+		erp->lpm = cqr->lpm;
+	}
+
 	if (device->features & DASD_FEATURE_ERPLOG) {
 		/* print current erp_chain */
 		dev_err(&device->cdev->dev,

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #67 lore raw

PATCH 67/115 btrfs: Fix flush bio leak

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nikolay Borisov <[email protected]>

[ Upstream commit beed9263f4000c48a5c48912f26576f6fa091181 ]

Commit e0ae99941423 ("btrfs: preallocate device flush bio") reworked the way the flush bio is allocated and used. Concretely it allocates the bio in __alloc_device and then re-uses it multiple times with a very simple endio routine that just calls complete() without consuming a reference. Allocated bios by default come with a ref count of 1, which is then consumed by the endio routine (or not, in which case they should be bio_put by the caller). The way the impleementation works now is that the flush bio has a refcount of 2 and we only ever bio_put it once, leaving it to hang indefinitely. Fix this by removing the extra bio_get in __alloc_device.

Fixes e0ae99941423 ("btrfs: preallocate device flush bio")

Signed-off-by Nikolay Borisov <[email protected]>

Reviewed-by Liu Bo <[email protected]>

Reviewed-by David Sterba <[email protected]>

Signed-off-by David Sterba <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/btrfs/volumes.c |    1 -
 1 file changed, 1 deletion(-)

fs/btrfs/volumes.c +0 -1

@@ -236,7 +236,6 @@ static struct btrfs_device *__alloc_devi
 		kfree(dev);
 		return ERR_PTR(-ENOMEM);
 	}
-	bio_get(dev->flush_bio);
 
 	INIT_LIST_HEAD(&dev->dev_list);
 	INIT_LIST_HEAD(&dev->dev_alloc_list);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #68 lore raw

PATCH 68/115 ip6_tunnel: allow ip6gre dev mtu to be set below 1280

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xin Long <[email protected]>

[ Upstream commit 2fa771be953a17f8e0a9c39103464c2574444c62 ]

Commit 582442d6d5bc ("ipv6: Allow the MTU of ipip6 tunnel to be set below 1280") fixed a mtu setting issue. It works for ipip6 tunnel.

But ip6gre dev updates the mtu also with ip6_tnl_change_mtu. Since the inner packet over ip6gre can be ipv4 and it's mtu should also be allowed to set below 1280, the same issue also exists on ip6gre.

This patch is to fix it by simply changing to check if parms.proto is IPPROTO_IPV6 in ip6_tnl_change_mtu instead, to make ip6gre to go to 'else' branch.

Signed-off-by Xin Long <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/ipv6/ip6_tunnel.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

net/ipv6/ip6_tunnel.c +3 -3

@@ -1684,11 +1684,11 @@ int ip6_tnl_change_mtu(struct net_device
 {
 	struct ip6_tnl *tnl = netdev_priv(dev);
 
-	if (tnl->parms.proto == IPPROTO_IPIP) {
-		if (new_mtu < ETH_MIN_MTU)
+	if (tnl->parms.proto == IPPROTO_IPV6) {
+		if (new_mtu < IPV6_MIN_MTU)
 			return -EINVAL;
 	} else {
-		if (new_mtu < IPV6_MIN_MTU)
+		if (new_mtu < ETH_MIN_MTU)
 			return -EINVAL;
 	}
 	if (new_mtu > 0xFFF8 - dev->hard_header_len)

Greg Kroah-Hartman

author maintainer

2018-03-02 09:02 UTC #69 lore raw

PATCH 69/115 Input: xen-kbdfront - do not advertise multi-touch pressure support

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oleksandr Andrushchenko <[email protected]>

[ Upstream commit 02a0d9216d4daf6a58d88642bd2da2c78c327552 ]

Some user-space applications expect multi-touch pressure on contact to be reported if it is advertised in device properties. Otherwise, such applications may treat reports not as actual touches, but hovering. Currently this is only advertised, but not reported.
Fix this by not advertising that ABS_MT_PRESSURE is supported.

Signed-off-by Oleksandr Andrushchenko <[email protected]>

Signed-off-by Andrii Chepurnyi <[email protected]>

Patchwork-Id: 10140017

Signed-off-by Dmitry Torokhov <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/input/misc/xen-kbdfront.c |    2 --
 1 file changed, 2 deletions(-)

drivers/input/misc/xen-kbdfront.c +0 -2

@@ -326,8 +326,6 @@ static int xenkbd_probe(struct xenbus_de
 				     0, width, 0, 0);
 		input_set_abs_params(mtouch, ABS_MT_POSITION_Y,
 				     0, height, 0, 0);
-		input_set_abs_params(mtouch, ABS_MT_PRESSURE,
-				     0, 255, 0, 0);
 
 		ret = input_mt_init_slots(mtouch, num_cont, INPUT_MT_DIRECT);
 		if (ret) {

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #70 lore raw

PATCH 70/115 IB/mlx4: Fix mlx4_ib_alloc_mr error flow

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Leon Romanovsky <[email protected]>

[ Upstream commit 5a371cf87e145b86efd32007e46146e78c1eff6d ]

ibmr.device is being set only after ib_alloc_mr() is successfully complete. Therefore, in case imlx4_mr_enable() returns with error, the error flow unwinder calls to mlx4_free_priv_pages(), which uses ibmr.device.

Such usage causes to NULL dereference oops and to fix it, the IB device should be set in the mr struct earlier stage (e.g. prior to calling mlx4_free_priv_pages()).

Fixes 1b2cd0fc673c ("IB/mlx4: Support the new memory registration API")

Signed-off-by Nitzan Carmi <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/hw/mlx4/mr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/infiniband/hw/mlx4/mr.c +1 -1

@@ -406,7 +406,6 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib
 		goto err_free_mr;
 
 	mr->max_pages = max_num_sg;
-
 	err = mlx4_mr_enable(dev->dev, &mr->mmr);
 	if (err)
 		goto err_free_pl;

@@ -417,6 +416,7 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib
 	return &mr->ibmr;
 
 err_free_pl:
+	mr->ibmr.device = pd->device;
 	mlx4_free_priv_pages(mr);
 err_free_mr:
 	(void) mlx4_mr_free(dev->dev, &mr->mmr);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #71 lore raw

PATCH 71/115 IB/ipoib: Fix race condition in neigh creation

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Erez Shitrit <[email protected]>

[ Upstream commit 16ba3defb8bd01a9464ba4820a487f5b196b455b ]

When using enhanced mode for IPoIB, two threads may execute xmit in parallel to two different TX queues while the target is the same. In this case, both of them will add the same neighbor to the path's neigh link list and we might see the following message:

list_add double add: new=ffff88024767a348, prev=ffff88024767a348...

  WARNING: lib/list_debug.c:31__list_add_valid+0x4e/0x70
  ipoib_start_xmit+0x477/0x680 [ib_ipoib]
  dev_hard_start_xmit+0xb9/0x3e0
  sch_direct_xmit+0xf9/0x250
  __qdisc_run+0x176/0x5d0
  __dev_queue_xmit+0x1f5/0xb10
  __dev_queue_xmit+0x55/0xb10

Analysis:
Two SKB are scheduled to be transmitted from two cores.
In ipoib_start_xmit, both gets NULL when calling ipoib_neigh_get. Two calls to neigh_add_path are made. One thread takes the spin-lock and calls ipoib_neigh_alloc which creates the neigh structure, then (after the __path_find) the neigh is added to the path's neigh link list. When the second thread enters the critical section it also calls ipoib_neigh_alloc but in this case it gets the already allocated ipoib_neigh structure, which is already linked to the path's neigh link list and adds it again to the list. Which beside of triggering the list, it creates a loop in the linked list. This loop leads to endless loop inside path_rec_completion.

Solution:
Check list_empty(&neigh->list) before adding to the list. Add a similar fix in "ipoib_multicast.c::ipoib_mcast_send"

Fixes b63b70d87741 ('IPoIB: Use a private hash table for path lookup in xmit path')

Signed-off-by Erez Shitrit <[email protected]>

Reviewed-by Alex Vesker <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/ulp/ipoib/ipoib_main.c      |   25 ++++++++++++++++++-------
 drivers/infiniband/ulp/ipoib/ipoib_multicast.c |    5 ++++-
 2 files changed, 22 insertions(+), 8 deletions(-)

drivers/infiniband/ulp/ipoib/ipoib_main.c +18 -7

@@ -903,8 +903,8 @@ static int path_rec_start(struct net_dev
 	return 0;
 }
 
-static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
-			   struct net_device *dev)
+static struct ipoib_neigh *neigh_add_path(struct sk_buff *skb, u8 *daddr,
+					  struct net_device *dev)
 {
 	struct ipoib_dev_priv *priv = ipoib_priv(dev);
 	struct rdma_netdev *rn = netdev_priv(dev);

@@ -918,7 +918,15 @@ static void neigh_add_path(struct sk_buf
 		spin_unlock_irqrestore(&priv->lock, flags);
 		++dev->stats.tx_dropped;
 		dev_kfree_skb_any(skb);
-		return;
+		return NULL;
+	}
+
+	/* To avoid race condition, make sure that the
+	 * neigh will be added only once.
+	 */
+	if (unlikely(!list_empty(&neigh->list))) {
+		spin_unlock_irqrestore(&priv->lock, flags);
+		return neigh;
 	}
 
 	path = __path_find(dev, daddr + 4);

@@ -957,7 +965,7 @@ static void neigh_add_path(struct sk_buf
 			path->ah->last_send = rn->send(dev, skb, path->ah->ah,
 						       IPOIB_QPN(daddr));
 			ipoib_neigh_put(neigh);
-			return;
+			return NULL;
 		}
 	} else {
 		neigh->ah  = NULL;

@@ -974,7 +982,7 @@ static void neigh_add_path(struct sk_buf
 
 	spin_unlock_irqrestore(&priv->lock, flags);
 	ipoib_neigh_put(neigh);
-	return;
+	return NULL;
 
 err_path:
 	ipoib_neigh_free(neigh);

@@ -984,6 +992,8 @@ err_drop:
 
 	spin_unlock_irqrestore(&priv->lock, flags);
 	ipoib_neigh_put(neigh);
+
+	return NULL;
 }
 
 static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,

@@ -1092,8 +1102,9 @@ static int ipoib_start_xmit(struct sk_bu
 	case htons(ETH_P_TIPC):
 		neigh = ipoib_neigh_get(dev, phdr->hwaddr);
 		if (unlikely(!neigh)) {
-			neigh_add_path(skb, phdr->hwaddr, dev);
-			return NETDEV_TX_OK;
+			neigh = neigh_add_path(skb, phdr->hwaddr, dev);
+			if (likely(!neigh))
+				return NETDEV_TX_OK;
 		}
 		break;
 	case htons(ETH_P_ARP):

drivers/infiniband/ulp/ipoib/ipoib_multicast.c +4 -1

@@ -816,7 +816,10 @@ void ipoib_mcast_send(struct net_device
 		spin_lock_irqsave(&priv->lock, flags);
 		if (!neigh) {
 			neigh = ipoib_neigh_alloc(daddr, dev);
-			if (neigh) {
+			/* Make sure that the neigh will be added only
+			 * once to mcast list.
+			 */
+			if (neigh && list_empty(&neigh->list)) {
 				kref_get(&mcast->ah->ref);
 				neigh->ah	= mcast->ah;
 				list_add_tail(&neigh->list, &mcast->neigh_list);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #72 lore raw

PATCH 72/115 xfs: quota: fix missed destroy of qi_tree_lock

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Aliaksei Karaliou <[email protected]>

[ Upstream commit 2196881566225f3c3428d1a5f847a992944daa5b ]

xfs_qm_destroy_quotainfo() does not destroy quotainfo->qi_tree_lock while destroys quotainfo->qi_quotaofflock.

Signed-off-by Aliaksei Karaliou <[email protected]>

Reviewed-by Darrick J. Wong <[email protected]>

Signed-off-by Darrick J. Wong <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/xfs/xfs_qm.c |    1 +
 1 file changed, 1 insertion(+)

fs/xfs/xfs_qm.c +1 -0

@@ -736,6 +736,7 @@ xfs_qm_destroy_quotainfo(
 		IRELE(qi->qi_pquotaip);
 		qi->qi_pquotaip = NULL;
 	}
+	mutex_destroy(&qi->qi_tree_lock);
 	mutex_destroy(&qi->qi_quotaofflock);
 	kmem_free(qi);
 	mp->m_quotainfo = NULL;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #73 lore raw

PATCH 73/115 xfs: quota: check result of register_shrinker()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Aliaksei Karaliou <[email protected]>

[ Upstream commit 3a3882ff26fbdbaf5f7e13f6a0bccfbf7121041d ]

xfs_qm_init_quotainfo() does not check result of register_shrinker() which was tagged as __must_check recently, reported by sparse.

Signed-off-by Aliaksei Karaliou <[email protected]>

[darrick: move xfs_qm_destroy_quotainos nearer xfs_qm_init_quotainos]

Reviewed-by Darrick J. Wong <[email protected]>

Signed-off-by Darrick J. Wong <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/xfs/xfs_qm.c |   45 +++++++++++++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 16 deletions(-)

fs/xfs/xfs_qm.c +29 ~~-16~~

@@ -48,7 +48,7 @@
 STATIC int	xfs_qm_init_quotainos(xfs_mount_t *);
 STATIC int	xfs_qm_init_quotainfo(xfs_mount_t *);
 
-
+STATIC void	xfs_qm_destroy_quotainos(xfs_quotainfo_t *qi);
 STATIC void	xfs_qm_dqfree_one(struct xfs_dquot *dqp);
 /*
  * We use the batch lookup interface to iterate over the dquots as it

@@ -695,9 +695,17 @@ xfs_qm_init_quotainfo(
 	qinf->qi_shrinker.scan_objects = xfs_qm_shrink_scan;
 	qinf->qi_shrinker.seeks = DEFAULT_SEEKS;
 	qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE;
-	register_shrinker(&qinf->qi_shrinker);
+
+	error = register_shrinker(&qinf->qi_shrinker);
+	if (error)
+		goto out_free_inos;
+
 	return 0;
 
+out_free_inos:
+	mutex_destroy(&qinf->qi_quotaofflock);
+	mutex_destroy(&qinf->qi_tree_lock);
+	xfs_qm_destroy_quotainos(qinf);
 out_free_lru:
 	list_lru_destroy(&qinf->qi_lru);
 out_free_qinf:

@@ -706,7 +714,6 @@ out_free_qinf:
 	return error;
 }
 
-
 /*
  * Gets called when unmounting a filesystem or when all quotas get
  * turned off.

@@ -723,19 +730,7 @@ xfs_qm_destroy_quotainfo(
 
 	unregister_shrinker(&qi->qi_shrinker);
 	list_lru_destroy(&qi->qi_lru);
-
-	if (qi->qi_uquotaip) {
-		IRELE(qi->qi_uquotaip);
-		qi->qi_uquotaip = NULL; /* paranoia */
-	}
-	if (qi->qi_gquotaip) {
-		IRELE(qi->qi_gquotaip);
-		qi->qi_gquotaip = NULL;
-	}
-	if (qi->qi_pquotaip) {
-		IRELE(qi->qi_pquotaip);
-		qi->qi_pquotaip = NULL;
-	}
+	xfs_qm_destroy_quotainos(qi);
 	mutex_destroy(&qi->qi_tree_lock);
 	mutex_destroy(&qi->qi_quotaofflock);
 	kmem_free(qi);

@@ -1601,6 +1596,24 @@ error_rele:
 }
 
 STATIC void
+xfs_qm_destroy_quotainos(
+	xfs_quotainfo_t	*qi)
+{
+	if (qi->qi_uquotaip) {
+		IRELE(qi->qi_uquotaip);
+		qi->qi_uquotaip = NULL; /* paranoia */
+	}
+	if (qi->qi_gquotaip) {
+		IRELE(qi->qi_gquotaip);
+		qi->qi_gquotaip = NULL;
+	}
+	if (qi->qi_pquotaip) {
+		IRELE(qi->qi_pquotaip);
+		qi->qi_pquotaip = NULL;
+	}
+}
+
+STATIC void
 xfs_qm_dqfree_one(
 	struct xfs_dquot	*dqp)
 {

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #74 lore raw

PATCH 74/115 macvlan: Fix one possible double free

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gao Feng <[email protected]>

[ Upstream commit d02fd6e7d2933ede6478a15f9e4ce8a93845824e ]

Because the macvlan_uninit would free the macvlan port, so there is one double free case in macvlan_common_newlink. When the macvlan port is just created, then register_netdevice or netdev_upper_dev_link failed and they would invoke macvlan_uninit. Then it would reach the macvlan_port_destroy which triggers the double free.

Signed-off-by Gao Feng <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/macvlan.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

drivers/net/macvlan.c +6 -1

@@ -1441,9 +1441,14 @@ int macvlan_common_newlink(struct net *s
 	return 0;
 
 unregister_netdev:
+	/* macvlan_uninit would free the macvlan port */
 	unregister_netdevice(dev);
+	return err;
 destroy_macvlan_port:
-	if (create)
+	/* the macvlan port may be freed by macvlan_uninit when fail to register.
+	 * so we destroy the macvlan port only when it's valid.
+	 */
+	if (create && macvlan_port_get_rtnl(dev))
 		macvlan_port_destroy(port->dev);
 	return err;
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #75 lore raw

PATCH 75/115 e1000: fix disabling already-disabled warning

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tushar Dave <[email protected]>

[ Upstream commit 0b76aae741abb9d16d2c0e67f8b1e766576f897d ]

This patch adds check so that driver does not disable already disabled device.

[   44.637743] advantechwdt: Unexpected close, not stopping watchdog!
[   44.997548] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input6
[   45.013419] e1000 0000:00:03.0: disabling already-disabled device
[   45.013447] ------------[ cut here ]------------
[   45.014868] WARNING: CPU: 1 PID: 71 at drivers/pci/pci.c:1641 pci_disable_device+0xa1/0x105:
						pci_disable_device at drivers/pci/pci.c:1640
[   45.016171] CPU: 1 PID: 71 Comm: rcu_perf_shutdo Not tainted 4.14.0-01330-g3c07399 #1
[   45.017197] task: ffff88011bee9e40 task.stack: ffffc90000860000
[   45.017987] RIP: 0010:pci_disable_device+0xa1/0x105:
						pci_disable_device at drivers/pci/pci.c:1640
[   45.018603] RSP: 0000:ffffc90000863e30 EFLAGS: 00010286
[   45.019282] RAX: 0000000000000035 RBX: ffff88013a230008 RCX: 0000000000000000
[   45.020182] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000203
[   45.021084] RBP: ffff88013a3f31e8 R08: 0000000000000001 R09: 0000000000000000
[   45.021986] R10: ffffffff827ec29c R11: 0000000000000002 R12: 0000000000000001
[   45.022946] R13: ffff88013a230008 R14: ffff880117802b20 R15: ffffc90000863e8f
[   45.023842] FS:  0000000000000000(0000) GS:ffff88013fd00000(0000) knlGS:0000000000000000
[   45.024863] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   45.025583] CR2: ffffc900006d4000 CR3: 000000000220f000 CR4: 00000000000006a0
[   45.026478] Call Trace:
[   45.026811]  __e1000_shutdown+0x1d4/0x1e2:
						__e1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5162
[   45.027344]  ? rcu_perf_cleanup+0x2a1/0x2a1:
						rcu_perf_shutdown at kernel/rcu/rcuperf.c:627
[   45.027883]  e1000_shutdown+0x14/0x3a:
						e1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5235
[   45.028351]  device_shutdown+0x110/0x1aa:
						device_shutdown at drivers/base/core.c:2807
[   45.028858]  kernel_power_off+0x31/0x64:
						kernel_power_off at kernel/reboot.c:260
[   45.029343]  rcu_perf_shutdown+0x9b/0xa7:
						rcu_perf_shutdown at kernel/rcu/rcuperf.c:637
[   45.029852]  ? __wake_up_common_lock+0xa2/0xa2:
						autoremove_wake_function at kernel/sched/wait.c:376
[   45.030414]  kthread+0x126/0x12e:
						kthread at kernel/kthread.c:233
[   45.030834]  ? __kthread_bind_mask+0x8e/0x8e:
						kthread at kernel/kthread.c:190
[   45.031399]  ? ret_from_fork+0x1f/0x30:
						ret_from_fork at arch/x86/entry/entry_64.S:443
[   45.031883]  ? kernel_init+0xa/0xf5:
						kernel_init at init/main.c:997
[   45.032325]  ret_from_fork+0x1f/0x30:
						ret_from_fork at arch/x86/entry/entry_64.S:443
[   45.032777] Code: 00 48 85 ed 75 07 48 8b ab a8 00 00 00 48 8d bb 98 00 00 00 e8 aa d1 11 00 48 89 ea 48 89 c6 48 c7 c7 d8 e4 0b 82 e8 55 7d da ff <0f> ff b9 01 00 00 00 31 d2 be 01 00 00 00 48 c7 c7 f0 b1 61 82
[   45.035222] ---[ end trace c257137b1b1976ef ]---
[   45.037838] ACPI: Preparing to enter system sleep state S5

Signed-off-by Tushar Dave <[email protected]>

Tested-by Fengguang Wu <[email protected]>

Signed-off-by Jeff Kirsher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/intel/e1000/e1000.h      |    3 +-
 drivers/net/ethernet/intel/e1000/e1000_main.c |   27 +++++++++++++++++++++-----
 2 files changed, 24 insertions(+), 6 deletions(-)

drivers/net/ethernet/intel/e1000/e1000.h +2 -1

@@ -331,7 +331,8 @@ struct e1000_adapter {
 enum e1000_state_t {
 	__E1000_TESTING,
 	__E1000_RESETTING,
-	__E1000_DOWN
+	__E1000_DOWN,
+	__E1000_DISABLED
 };
 
 #undef pr_fmt

drivers/net/ethernet/intel/e1000/e1000_main.c +22 -5

@@ -945,7 +945,7 @@ static int e1000_init_hw_struct(struct e
 static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
 	struct net_device *netdev;
-	struct e1000_adapter *adapter;
+	struct e1000_adapter *adapter = NULL;
 	struct e1000_hw *hw;
 
 	static int cards_found;

@@ -955,6 +955,7 @@ static int e1000_probe(struct pci_dev *p
 	u16 tmp = 0;
 	u16 eeprom_apme_mask = E1000_EEPROM_APME;
 	int bars, need_ioport;
+	bool disable_dev = false;
 
 	/* do not allocate ioport bars when not needed */
 	need_ioport = e1000_is_need_ioport(pdev);

@@ -1259,11 +1260,13 @@ err_mdio_ioremap:
 	iounmap(hw->ce4100_gbe_mdio_base_virt);
 	iounmap(hw->hw_addr);
 err_ioremap:
+	disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
 	free_netdev(netdev);
 err_alloc_etherdev:
 	pci_release_selected_regions(pdev, bars);
 err_pci_reg:
-	pci_disable_device(pdev);
+	if (!adapter || disable_dev)
+		pci_disable_device(pdev);
 	return err;
 }

@@ -1281,6 +1284,7 @@ static void e1000_remove(struct pci_dev
 	struct net_device *netdev = pci_get_drvdata(pdev);
 	struct e1000_adapter *adapter = netdev_priv(netdev);
 	struct e1000_hw *hw = &adapter->hw;
+	bool disable_dev;
 
 	e1000_down_and_stop(adapter);
 	e1000_release_manageability(adapter);

@@ -1299,9 +1303,11 @@ static void e1000_remove(struct pci_dev
 		iounmap(hw->flash_address);
 	pci_release_selected_regions(pdev, adapter->bars);
 
+	disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
 	free_netdev(netdev);
 
-	pci_disable_device(pdev);
+	if (disable_dev)
+		pci_disable_device(pdev);
 }
 
 /**

@@ -5156,7 +5162,8 @@ static int __e1000_shutdown(struct pci_d
 	if (netif_running(netdev))
 		e1000_free_irq(adapter);
 
-	pci_disable_device(pdev);
+	if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
+		pci_disable_device(pdev);
 
 	return 0;
 }

@@ -5200,6 +5207,10 @@ static int e1000_resume(struct pci_dev *
 		pr_err("Cannot enable PCI device from suspend\n");
 		return err;
 	}
+
+	/* flush memory to make sure state is correct */
+	smp_mb__before_atomic();
+	clear_bit(__E1000_DISABLED, &adapter->flags);
 	pci_set_master(pdev);
 
 	pci_enable_wake(pdev, PCI_D3hot, 0);

@@ -5274,7 +5285,9 @@ static pci_ers_result_t e1000_io_error_d
 
 	if (netif_running(netdev))
 		e1000_down(adapter);
-	pci_disable_device(pdev);
+
+	if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
+		pci_disable_device(pdev);
 
 	/* Request a slot slot reset. */
 	return PCI_ERS_RESULT_NEED_RESET;

@@ -5302,6 +5315,10 @@ static pci_ers_result_t e1000_io_slot_re
 		pr_err("Cannot re-enable PCI device after reset.\n");
 		return PCI_ERS_RESULT_DISCONNECT;
 	}
+
+	/* flush memory to make sure state is correct */
+	smp_mb__before_atomic();
+	clear_bit(__E1000_DISABLED, &adapter->flags);
 	pci_set_master(pdev);
 
 	pci_enable_wake(pdev, PCI_D3hot, 0);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #76 lore raw

PATCH 76/115 NET: usb: qmi_wwan: add support for YUGA CLM920-NC5 PID 0x9625

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: "SZ Lin (林上智)" <[email protected]>

[ Upstream commit bd30ffc414e55194ed6149fad69a145550cb7c18 ]

This patch adds support for PID 0x9625 of YUGA CLM920-NC5.

YUGA CLM920-NC5 needs to enable QMI_WWAN_QUIRK_DTR before QMI operation.

qmicli -d /dev/cdc-wdm0 -p --dms-get-revision [/dev/cdc-wdm0] Device revision retrieved:

        Revision: 'CLM920_NC5-V1  1  [Oct 23 2016 19:00:00]'

Signed-off-by SZ Lin (林上智) <[email protected]>

Acked-by Bjørn Mork <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/usb/qmi_wwan.c |    1 +
 1 file changed, 1 insertion(+)

drivers/net/usb/qmi_wwan.c +1 -0

@@ -1100,6 +1100,7 @@ static const struct usb_device_id produc
 	{QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
 	{QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
 	{QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
+	{QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)},	/* YUGA CLM920-NC5 */
 	{QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
 	{QMI_FIXED_INTF(0x12d1, 0x140c, 1)},	/* Huawei E173 */
 	{QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},	/* Huawei E1820 */

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #77 lore raw

PATCH 77/115 drm/ttm: check the return value of kzalloc

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xiongwei Song <[email protected]>

[ Upstream commit 19d859a7205bc59ffc38303eb25ae394f61d21dc ]

In the function ttm_page_alloc_init, kzalloc call is made for variable _manager, we need to check its return value, it may return NULL.

Signed-off-by Xiongwei Song <[email protected]>

Reviewed-by Christian König <[email protected]>

Signed-off-by Alex Deucher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/ttm/ttm_page_alloc.c |    2 ++
 1 file changed, 2 insertions(+)

drivers/gpu/drm/ttm/ttm_page_alloc.c +2 -0

@@ -821,6 +821,8 @@ int ttm_page_alloc_init(struct ttm_mem_g
 	pr_info("Initializing pool allocator\n");
 
 	_manager = kzalloc(sizeof(*_manager), GFP_KERNEL);
+	if (!_manager)
+		return -ENOMEM;
 
 	ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc");

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #78 lore raw

PATCH 78/115 RDMA/netlink: Fix locking around __ib_get_device_by_index

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Leon Romanovsky <[email protected]>

[ Upstream commit f8978bd95cf92f869f3d9b34c1b699f49253b8c6 ]

Holding locks is mandatory when calling __ib_device_get_by_index, otherwise there are races during the list iteration with device removal.

Since the locks are static to device.c, __ib_device_get_by_index can never be called correctly by any user out side the file.

Make the function static and provide a safe function that gets the correct locks and returns a kref'd pointer. Fix all callers.

Fixes e5c9469efcb1 ("RDMA/netlink: Add nldev device doit implementation")

Fixes c3f66f7b0052 ("RDMA/netlink: Implement nldev port doit callback")

Fixes 7d02f605f0dc ("RDMA/netlink: Add nldev port dumpit implementation")

Reviewed-by Mark Bloch <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/infiniband/core/core_priv.h |    2 -
 drivers/infiniband/core/device.c    |   18 +++++++++++-
 drivers/infiniband/core/nldev.c     |   54 ++++++++++++++++++++++++------------
 3 files changed, 54 insertions(+), 20 deletions(-)

drivers/infiniband/core/core_priv.h +1 -1

@@ -314,7 +314,7 @@ static inline int ib_mad_enforce_securit
 }
 #endif
 
-struct ib_device *__ib_device_get_by_index(u32 ifindex);
+struct ib_device *ib_device_get_by_index(u32 ifindex);
 /* RDMA device netlink */
 void nldev_init(void);
 void nldev_exit(void);

drivers/infiniband/core/device.c +17 -1

@@ -134,7 +134,7 @@ static int ib_device_check_mandatory(str
 	return 0;
 }
 
-struct ib_device *__ib_device_get_by_index(u32 index)
+static struct ib_device *__ib_device_get_by_index(u32 index)
 {
 	struct ib_device *device;

@@ -145,6 +145,22 @@ struct ib_device *__ib_device_get_by_ind
 	return NULL;
 }
 
+/*
+ * Caller is responsible to return refrerence count by calling put_device()
+ */
+struct ib_device *ib_device_get_by_index(u32 index)
+{
+	struct ib_device *device;
+
+	down_read(&lists_rwsem);
+	device = __ib_device_get_by_index(index);
+	if (device)
+		get_device(&device->dev);
+
+	up_read(&lists_rwsem);
+	return device;
+}
+
 static struct ib_device *__ib_device_get_by_name(const char *name)
 {
 	struct ib_device *device;

drivers/infiniband/core/nldev.c +36 ~~-18~~

108 lines not on this page · raw message

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #79 lore raw

PATCH 79/115 x86/efi: Fix kernel param add_efi_memmap regression

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dave Young <[email protected]>

[ Upstream commit 835bcec5fdf3f9e880111b482177e7e70e3596da ]

'add_efi_memmap' is an early param, but do_add_efi_memmap() has no chance to run because the code path is before parse_early_param(). I believe it worked when the param was introduced but probably later some other changes caused the wrong order and nobody noticed it.

Move efi_memblock_x86_reserve_range() after parse_early_param() to fix it.

Signed-off-by Dave Young <[email protected]>

Signed-off-by Matt Fleming <[email protected]>

Signed-off-by Ard Biesheuvel <[email protected]>

Cc Bryan O'Donoghue <[email protected]>

Cc Ge Song <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/kernel/setup.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

arch/x86/kernel/setup.c +2 -3

@@ -928,9 +928,6 @@ void __init setup_arch(char **cmdline_p)
 		set_bit(EFI_BOOT, &efi.flags);
 		set_bit(EFI_64BIT, &efi.flags);
 	}
-
-	if (efi_enabled(EFI_BOOT))
-		efi_memblock_x86_reserve_range();
 #endif
 
 	x86_init.oem.arch_setup();

@@ -984,6 +981,8 @@ void __init setup_arch(char **cmdline_p)
 
 	parse_early_param();
 
+	if (efi_enabled(EFI_BOOT))
+		efi_memblock_x86_reserve_range();
 #ifdef CONFIG_MEMORY_HOTPLUG
 	/*
 	 * Memory used by the kernel cannot be hot-removed because Linux

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #80 lore raw

PATCH 80/115 uapi libc compat: add fallback for unsupported libcs

http://git.musl-libc.org/cgit/musl/commit/?id=04983f2272382af92eb8f8838964ff944fbb8258

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Felix Janda <[email protected]>

[ Upstream commit c0bace798436bca0fdc221ff61143f1376a9c3de ]

libc-compat.h aims to prevent symbol collisions between uapi and libc headers for each supported libc. This requires continuous coordination between them.

The goal of this commit is to improve the situation for libcs (such as musl) which are not yet supported and/or do not wish to be explicitly supported, while not affecting supported libcs. More precisely, with this commit, unsupported libcs can request the suppression of any specific uapi definition by defining the correspondings _UAPI_DEF_* macro as 0. This can fix symbol collisions for them, as long as the libc headers are included before the uapi headers. Inclusion in the other order is outside the scope of this commit.

All infrastructure in order to enable this fallback for unsupported libcs is already in place, except that libc-compat.h unconditionally defines all _UAPI_DEF_* macros to 1 for all unsupported libcs so that any previous definitions are ignored. In order to fix this, this commit merely makes these definitions conditional.

This commit together with the musl libc commit

fixes for example the following compiler errors when <linux/in6.h> is included after musl's <netinet/in.h>:

./linux/in6.h:32:8: error: redefinition of 'struct in6_addr' ./linux/in6.h:49:8: error: redefinition of 'struct sockaddr_in6' ./linux/in6.h:59:8: error: redefinition of 'struct ipv6_mreq'

The comments referencing glibc are still correct, but this file is not only used for glibc any more.

Signed-off-by Felix Janda <[email protected]>

Reviewed-by Hauke Mehrtens <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/uapi/linux/libc-compat.h |   55 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 54 insertions(+), 1 deletion(-)

include/uapi/linux/libc-compat.h +54 -1

@@ -168,46 +168,99 @@
 
 /* If we did not see any headers from any supported C libraries,
  * or we are being included in the kernel, then define everything
- * that we need. */
+ * that we need. Check for previous __UAPI_* definitions to give
+ * unsupported C libraries a way to opt out of any kernel definition. */
 #else /* !defined(__GLIBC__) */
 
 /* Definitions for if.h */
+#ifndef __UAPI_DEF_IF_IFCONF
 #define __UAPI_DEF_IF_IFCONF 1
+#endif
+#ifndef __UAPI_DEF_IF_IFMAP
 #define __UAPI_DEF_IF_IFMAP 1
+#endif
+#ifndef __UAPI_DEF_IF_IFNAMSIZ
 #define __UAPI_DEF_IF_IFNAMSIZ 1
+#endif
+#ifndef __UAPI_DEF_IF_IFREQ
 #define __UAPI_DEF_IF_IFREQ 1
+#endif
 /* Everything up to IFF_DYNAMIC, matches net/if.h until glibc 2.23 */
+#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS
 #define __UAPI_DEF_IF_NET_DEVICE_FLAGS 1
+#endif
 /* For the future if glibc adds IFF_LOWER_UP, IFF_DORMANT and IFF_ECHO */
+#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO
 #define __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO 1
+#endif
 
 /* Definitions for in.h */
+#ifndef __UAPI_DEF_IN_ADDR
 #define __UAPI_DEF_IN_ADDR		1
+#endif
+#ifndef __UAPI_DEF_IN_IPPROTO
 #define __UAPI_DEF_IN_IPPROTO		1
+#endif
+#ifndef __UAPI_DEF_IN_PKTINFO
 #define __UAPI_DEF_IN_PKTINFO		1
+#endif
+#ifndef __UAPI_DEF_IP_MREQ
 #define __UAPI_DEF_IP_MREQ		1
+#endif
+#ifndef __UAPI_DEF_SOCKADDR_IN
 #define __UAPI_DEF_SOCKADDR_IN		1
+#endif
+#ifndef __UAPI_DEF_IN_CLASS
 #define __UAPI_DEF_IN_CLASS		1
+#endif
 
 /* Definitions for in6.h */
+#ifndef __UAPI_DEF_IN6_ADDR
 #define __UAPI_DEF_IN6_ADDR		1
+#endif
+#ifndef __UAPI_DEF_IN6_ADDR_ALT
 #define __UAPI_DEF_IN6_ADDR_ALT		1
+#endif
+#ifndef __UAPI_DEF_SOCKADDR_IN6
 #define __UAPI_DEF_SOCKADDR_IN6		1
+#endif
+#ifndef __UAPI_DEF_IPV6_MREQ
 #define __UAPI_DEF_IPV6_MREQ		1
+#endif
+#ifndef __UAPI_DEF_IPPROTO_V6
 #define __UAPI_DEF_IPPROTO_V6		1
+#endif
+#ifndef __UAPI_DEF_IPV6_OPTIONS
 #define __UAPI_DEF_IPV6_OPTIONS		1
+#endif
+#ifndef __UAPI_DEF_IN6_PKTINFO
 #define __UAPI_DEF_IN6_PKTINFO		1
+#endif
+#ifndef __UAPI_DEF_IP6_MTUINFO
 #define __UAPI_DEF_IP6_MTUINFO		1
+#endif
 
 /* Definitions for ipx.h */
+#ifndef __UAPI_DEF_SOCKADDR_IPX
 #define __UAPI_DEF_SOCKADDR_IPX			1
+#endif
+#ifndef __UAPI_DEF_IPX_ROUTE_DEFINITION
 #define __UAPI_DEF_IPX_ROUTE_DEFINITION		1
+#endif
+#ifndef __UAPI_DEF_IPX_INTERFACE_DEFINITION
 #define __UAPI_DEF_IPX_INTERFACE_DEFINITION	1
+#endif
+#ifndef __UAPI_DEF_IPX_CONFIG_DATA
 #define __UAPI_DEF_IPX_CONFIG_DATA		1
+#endif
+#ifndef __UAPI_DEF_IPX_ROUTE_DEF
 #define __UAPI_DEF_IPX_ROUTE_DEF		1
+#endif
 
 /* Definitions for xattr.h */
+#ifndef __UAPI_DEF_XATTR
 #define __UAPI_DEF_XATTR		1
+#endif
 
 #endif /* __GLIBC__ */

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #81 lore raw

PATCH 81/115 i40e/i40evf: Account for frags split over multiple descriptors in check linearize

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Duyck <[email protected]>

[ Upstream commit 248de22e638f10bd5bfc7624a357f940f66ba137 ]

The original code for __i40e_chk_linearize didn't take into account the fact that if a fragment is 16K in size or larger it has to be split over 2 descriptors and the smaller of those 2 descriptors will be on the trailing edge of the transmit. As a result we can get into situations where we didn't catch requests that could result in a Tx hang.

This patch takes care of that by subtracting the length of all but the trailing edge of the stale fragment before we test for sum. By doing this we can guarantee that we have all cases covered, including the case of a fragment that spans multiple descriptors. We don't need to worry about checking the inner portions of this since 12K is the maximum aligned DMA size and that is larger than any MSS will ever be since the MTU limit for jumbos is something on the order of 9K.

Signed-off-by Alexander Duyck <[email protected]>

Tested-by Andrew Bowers <[email protected]>

Signed-off-by Jeff Kirsher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/intel/i40e/i40e_txrx.c   |   26 +++++++++++++++++++++++---
 drivers/net/ethernet/intel/i40evf/i40e_txrx.c |   26 +++++++++++++++++++++++---
 2 files changed, 46 insertions(+), 6 deletions(-)

drivers/net/ethernet/intel/i40e/i40e_txrx.c +23 -3

@@ -3048,10 +3048,30 @@ bool __i40e_chk_linearize(struct sk_buff
 	/* Walk through fragments adding latest fragment, testing it, and
 	 * then removing stale fragments from the sum.
 	 */
-	stale = &skb_shinfo(skb)->frags[0];
-	for (;;) {
+	for (stale = &skb_shinfo(skb)->frags[0];; stale++) {
+		int stale_size = skb_frag_size(stale);
+
 		sum += skb_frag_size(frag++);
 
+		/* The stale fragment may present us with a smaller
+		 * descriptor than the actual fragment size. To account
+		 * for that we need to remove all the data on the front and
+		 * figure out what the remainder would be in the last
+		 * descriptor associated with the fragment.
+		 */
+		if (stale_size > I40E_MAX_DATA_PER_TXD) {
+			int align_pad = -(stale->page_offset) &
+					(I40E_MAX_READ_REQ_SIZE - 1);
+
+			sum -= align_pad;
+			stale_size -= align_pad;
+
+			do {
+				sum -= I40E_MAX_DATA_PER_TXD_ALIGNED;
+				stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED;
+			} while (stale_size > I40E_MAX_DATA_PER_TXD);
+		}
+
 		/* if sum is negative we failed to make sufficient progress */
 		if (sum < 0)
 			return true;

@@ -3059,7 +3079,7 @@ bool __i40e_chk_linearize(struct sk_buff
 		if (!nr_frags--)
 			break;
 
-		sum -= skb_frag_size(stale++);
+		sum -= stale_size;
 	}
 
 	return false;

drivers/net/ethernet/intel/i40evf/i40e_txrx.c +23 -3

@@ -2014,10 +2014,30 @@ bool __i40evf_chk_linearize(struct sk_bu
 	/* Walk through fragments adding latest fragment, testing it, and
 	 * then removing stale fragments from the sum.
 	 */
-	stale = &skb_shinfo(skb)->frags[0];
-	for (;;) {
+	for (stale = &skb_shinfo(skb)->frags[0];; stale++) {
+		int stale_size = skb_frag_size(stale);
+
 		sum += skb_frag_size(frag++);
 
+		/* The stale fragment may present us with a smaller
+		 * descriptor than the actual fragment size. To account
+		 * for that we need to remove all the data on the front and
+		 * figure out what the remainder would be in the last
+		 * descriptor associated with the fragment.
+		 */
+		if (stale_size > I40E_MAX_DATA_PER_TXD) {
+			int align_pad = -(stale->page_offset) &
+					(I40E_MAX_READ_REQ_SIZE - 1);
+
+			sum -= align_pad;
+			stale_size -= align_pad;
+
+			do {
+				sum -= I40E_MAX_DATA_PER_TXD_ALIGNED;
+				stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED;
+			} while (stale_size > I40E_MAX_DATA_PER_TXD);
+		}
+
 		/* if sum is negative we failed to make sufficient progress */
 		if (sum < 0)
 			return true;

@@ -2025,7 +2045,7 @@ bool __i40evf_chk_linearize(struct sk_bu
 		if (!nr_frags--)
 			break;
 
-		sum -= skb_frag_size(stale++);
+		sum -= stale_size;
 	}
 
 	return false;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #82 lore raw

PATCH 82/115 i40e: dont remove netdev->dev_addr when syncing uc list

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jacob Keller <[email protected]>

[ Upstream commit 458867b2ca0c987445c5d9adccd1642970e1ba07 ]

In some circumstances, such as with bridging, it is possible that the stack will add a devices own MAC address to its unicast address list.

If, later, the stack deletes this address, then the i40e driver will receive a request to remove this address.

The driver stores its current MAC address as part of the MAC/VLAN hash array, since it is convenient and matches exactly how the hardware expects to be told which traffic to receive.

This causes a problem, since for more devices, the MAC address is stored separately, and requests to delete a unicast address should not have the ability to remove the filter for the MAC address.

Fix this by forcing a check on every address sync to ensure we do not remove the device address.

There is a very narrow possibility of a race between .set_mac and .set_rx_mode, if we don't change netdev->dev_addr before updating our internal MAC list in .set_mac. This might be possible if .set_rx_mode is going to remove MAC "XYZ" from the list, at the same time as .set_mac changes our dev_addr to MAC "XYZ", we might possibly queue a delete, then an add in .set_mac, then queue a delete in .set_rx_mode's dev_uc_sync and then update netdev->dev_addr. We can avoid this by moving the copy into dev_addr prior to the changes to the MAC filter list.

A similar race on the other side does not cause problems, as if we're changing our MAC form A to B, and we race with .set_rx_mode, it could queue a delete from A, we'd update our address, and allow the delete. This seems like a race, but in reality we're about to queue a delete of A anyways, so it would not cause any issues.

A race in the initialization code is unlikely because the netdevice has not yet been fully initialized and the stack should not be adding or removing addresses yet.

Note that we don't (yet) need similar code for the VF driver because it does not make use of __dev_uc_sync and __dev_mc_sync, but instead roles its own method for handling updates to the MAC/VLAN list, which already has code to protect against removal of the hardware address.

Signed-off-by Jacob Keller <[email protected]>

Tested-by Andrew Bowers <[email protected]>

Signed-off-by Jeff Kirsher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/intel/i40e/i40e_main.c |   17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

drivers/net/ethernet/intel/i40e/i40e_main.c +16 -1

@@ -1553,11 +1553,18 @@ static int i40e_set_mac(struct net_devic
 	else
 		netdev_info(netdev, "set new mac address %pM\n", addr->sa_data);
 
+	/* Copy the address first, so that we avoid a possible race with
+	 * .set_rx_mode(). If we copy after changing the address in the filter
+	 * list, we might open ourselves to a narrow race window where
+	 * .set_rx_mode could delete our dev_addr filter and prevent traffic
+	 * from passing.
+	 */
+	ether_addr_copy(netdev->dev_addr, addr->sa_data);
+
 	spin_lock_bh(&vsi->mac_filter_hash_lock);
 	i40e_del_mac_filter(vsi, netdev->dev_addr);
 	i40e_add_mac_filter(vsi, addr->sa_data);
 	spin_unlock_bh(&vsi->mac_filter_hash_lock);
-	ether_addr_copy(netdev->dev_addr, addr->sa_data);
 	if (vsi->type == I40E_VSI_MAIN) {
 		i40e_status ret;

@@ -1739,6 +1746,14 @@ static int i40e_addr_unsync(struct net_d
 	struct i40e_netdev_priv *np = netdev_priv(netdev);
 	struct i40e_vsi *vsi = np->vsi;
 
+	/* Under some circumstances, we might receive a request to delete
+	 * our own device address from our uc list. Because we store the
+	 * device address in the VSI's MAC/VLAN filter list, we need to ignore
+	 * such requests and not delete our device address from this list.
+	 */
+	if (ether_addr_equal(addr, netdev->dev_addr))
+		return 0;
+
 	i40e_del_mac_filter(vsi, addr);
 
 	return 0;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #83 lore raw

PATCH 83/115 net: ena: unmask MSI-X only after device initialization is completed

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Netanel Belgazal <[email protected]>

[ Upstream commit 7853b49ce8e0ef6364d24512b287463841d71bd3 ]

Under certain conditions MSI-X interrupt might arrive right after it was unmasked in ena_up(). There is a chance it would be processed by the driver before device ENA_FLAG_DEV_UP flag is set. In such a case the interrupt is ignored.
ENA device operates in auto-masked mode, therefore ignoring interrupt leaves it masked for good.
Moving unmask of interrupt to be the last step in ena_up().

Signed-off-by Netanel Belgazal <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/amazon/ena/ena_netdev.c |   26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

drivers/net/ethernet/amazon/ena/ena_netdev.c +13 ~~-13~~

@@ -1565,7 +1565,7 @@ static int ena_rss_configure(struct ena_
 
 static int ena_up_complete(struct ena_adapter *adapter)
 {
-	int rc, i;
+	int rc;
 
 	rc = ena_rss_configure(adapter);
 	if (rc)

@@ -1584,17 +1584,6 @@ static int ena_up_complete(struct ena_ad
 
 	ena_napi_enable_all(adapter);
 
-	/* Enable completion queues interrupt */
-	for (i = 0; i < adapter->num_queues; i++)
-		ena_unmask_interrupt(&adapter->tx_ring[i],
-				     &adapter->rx_ring[i]);
-
-	/* schedule napi in case we had pending packets
-	 * from the last time we disable napi
-	 */
-	for (i = 0; i < adapter->num_queues; i++)
-		napi_schedule(&adapter->ena_napi[i].napi);
-
 	return 0;
 }

@@ -1731,7 +1720,7 @@ create_err:
 
 static int ena_up(struct ena_adapter *adapter)
 {
-	int rc;
+	int rc, i;
 
 	netdev_dbg(adapter->netdev, "%s\n", __func__);

@@ -1774,6 +1763,17 @@ static int ena_up(struct ena_adapter *ad
 
 	set_bit(ENA_FLAG_DEV_UP, &adapter->flags);
 
+	/* Enable completion queues interrupt */
+	for (i = 0; i < adapter->num_queues; i++)
+		ena_unmask_interrupt(&adapter->tx_ring[i],
+				     &adapter->rx_ring[i]);
+
+	/* schedule napi in case we had pending packets
+	 * from the last time we disable napi
+	 */
+	for (i = 0; i < adapter->num_queues; i++)
+		napi_schedule(&adapter->ena_napi[i].napi);
+
 	return rc;
 
 err_up:

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #84 lore raw

PATCH 84/115 nl80211: Check for the required netlink attribute presence

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hao Chen <[email protected]>

[ Upstream commit 3ea15452ee85754f70f3b9fa1f23165ef2e77ba7 ]

nl80211_nan_add_func() does not check if the required attribute NL80211_NAN_FUNC_FOLLOW_UP_DEST is present when processing NL80211_CMD_ADD_NAN_FUNCTION request. This request can be issued by users with CAP_NET_ADMIN privilege and may result in NULL dereference and a system crash. Add a check for the required attribute presence.

Signed-off-by Hao Chen <[email protected]>

Signed-off-by Johannes Berg <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/wireless/nl80211.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

net/wireless/nl80211.c +2 -1

@@ -11301,7 +11301,8 @@ static int nl80211_nan_add_func(struct s
 		break;
 	case NL80211_NAN_FUNC_FOLLOW_UP:
 		if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
-		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) {
+		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
+		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
 			err = -EINVAL;
 			goto out;
 		}

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #85 lore raw

PATCH 85/115 mac80211: mesh: drop frames appearing to be from us

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Berg <[email protected]>

[ Upstream commit 736a80bbfda709fb3631f5f62056f250a38e5804 ]

If there are multiple mesh stations with the same MAC address, they will both get confused and start throwing warnings.

Obviously in this case nothing can actually work anyway, so just drop frames that look like they're from ourselves early on.

Reported-by Gui Iribarren <[email protected]>

Signed-off-by Johannes Berg <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/mac80211/rx.c |    2 ++
 1 file changed, 2 insertions(+)

net/mac80211/rx.c +2 -0

@@ -3632,6 +3632,8 @@ static bool ieee80211_accept_frame(struc
 		}
 		return true;
 	case NL80211_IFTYPE_MESH_POINT:
+		if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
+			return false;
 		if (multicast)
 			return true;
 		return ether_addr_equal(sdata->vif.addr, hdr->addr1);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #86 lore raw

PATCH 86/115 can: flex_can: Correct the checking for frame length in flexcan_start_xmit()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Luu An Phu <[email protected]>

[ Upstream commit 13454c14550065fcc1705d6bd4ee6d40e057099f ]

The flexcan_start_xmit() function compares the frame length with data register length to write frame content into data[0] and data[1] register. Data register length is 4 bytes and frame maximum length is 8 bytes.

Fix the check that compares frame length with 3. Because the register length is 4.

Signed-off-by Luu An Phu <[email protected]>

Reviewed-by Oliver Hartkopp <[email protected]>

Signed-off-by Marc Kleine-Budde <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/can/flexcan.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/can/flexcan.c +1 -1

@@ -526,7 +526,7 @@ static int flexcan_start_xmit(struct sk_
 		data = be32_to_cpup((__be32 *)&cf->data[0]);
 		flexcan_write(data, &priv->tx_mb->data[0]);
 	}
-	if (cf->can_dlc > 3) {
+	if (cf->can_dlc > 4) {
 		data = be32_to_cpup((__be32 *)&cf->data[4]);
 		flexcan_write(data, &priv->tx_mb->data[1]);
 	}

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #87 lore raw

PATCH 87/115 wcn36xx: Fix dynamic power saving

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Loic Poulain <[email protected]>

[ Upstream commit 0856655a25476d4431005e39d606e349050066b0 ]

Since driver does not report hardware dynamic power saving cap, this is up to the mac80211 to manage power saving timeout and state machine, using the ieee80211 config callback to report PS changes. This patch enables/disables PS mode according to the new configuration.

Remove old behaviour enabling PS mode in a static way, this make the device unusable when power save is enabled since device is forced to PS regardless RX/TX traffic.

Acked-by Bjorn Andersson <[email protected]>

Signed-off-by Loic Poulain <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/wireless/ath/wcn36xx/main.c |   23 ++++++++++++-----------
 drivers/net/wireless/ath/wcn36xx/pmc.c  |    6 ++++--
 2 files changed, 16 insertions(+), 13 deletions(-)

drivers/net/wireless/ath/wcn36xx/main.c +12 ~~-11~~

@@ -384,6 +384,18 @@ static int wcn36xx_config(struct ieee802
 		}
 	}
 
+	if (changed & IEEE80211_CONF_CHANGE_PS) {
+		list_for_each_entry(tmp, &wcn->vif_list, list) {
+			vif = wcn36xx_priv_to_vif(tmp);
+			if (hw->conf.flags & IEEE80211_CONF_PS) {
+				if (vif->bss_conf.ps) /* ps allowed ? */
+					wcn36xx_pmc_enter_bmps_state(wcn, vif);
+			} else {
+				wcn36xx_pmc_exit_bmps_state(wcn, vif);
+			}
+		}
+	}
+
 	mutex_unlock(&wcn->conf_mutex);
 
 	return 0;

@@ -747,17 +759,6 @@ static void wcn36xx_bss_info_changed(str
 		vif_priv->dtim_period = bss_conf->dtim_period;
 	}
 
-	if (changed & BSS_CHANGED_PS) {
-		wcn36xx_dbg(WCN36XX_DBG_MAC,
-			    "mac bss PS set %d\n",
-			    bss_conf->ps);
-		if (bss_conf->ps) {
-			wcn36xx_pmc_enter_bmps_state(wcn, vif);
-		} else {
-			wcn36xx_pmc_exit_bmps_state(wcn, vif);
-		}
-	}
-
 	if (changed & BSS_CHANGED_BSSID) {
 		wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss changed_bssid %pM\n",
 			    bss_conf->bssid);

drivers/net/wireless/ath/wcn36xx/pmc.c +4 -2

@@ -45,8 +45,10 @@ int wcn36xx_pmc_exit_bmps_state(struct w
 	struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
 
 	if (WCN36XX_BMPS != vif_priv->pw_state) {
-		wcn36xx_err("Not in BMPS mode, no need to exit from BMPS mode!\n");
-		return -EINVAL;
+		/* Unbalanced call or last BMPS enter failed */
+		wcn36xx_dbg(WCN36XX_DBG_PMC,
+			    "Not in BMPS mode, no need to exit\n");
+		return -EALREADY;
 	}
 	wcn36xx_smd_exit_bmps(wcn, vif);
 	vif_priv->pw_state = WCN36XX_FULL_POWER;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #88 lore raw

PATCH 88/115 block: drain queue before waiting for q_usage_counter becoming zero

Link https://marc.info/?l=linux-block&m=151192424731797&w=2

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ming Lei <[email protected]>

[ Upstream commit 454be724f6f99cc7e7bbf15067128be9868186c6 ]

Now we track legacy requests with .q_usage_counter in commit 055f6e18e08f ("block: Make q_usage_counter also track legacy requests"), but that commit never runs and drains legacy queue before waiting for this counter becoming zero, then IO hang is caused in the test of pulling disk during IO.

This patch fixes the issue by draining requests before waiting for q_usage_counter becoming zero, both Mauricio and chenxiang reported this issue, and observed that it can be fixed by this patch.

Fixes 055f6e18e08f("block: Make q_usage_counter also track legacy requests")

Cc Wen Xiong <[email protected]>

Tested-by "chenxiang (M)" <[email protected]>

Tested-by Mauricio Faria de Oliveira <[email protected]>

Signed-off-by Ming Lei <[email protected]>

Signed-off-by Jens Axboe <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 block/blk-core.c |    9 +++++++--
 block/blk-mq.c   |    2 ++
 block/blk.h      |    2 ++
 3 files changed, 11 insertions(+), 2 deletions(-)

block/blk-core.c +7 -2

@@ -531,6 +531,13 @@ static void __blk_drain_queue(struct req
 	}
 }
 
+void blk_drain_queue(struct request_queue *q)
+{
+	spin_lock_irq(q->queue_lock);
+	__blk_drain_queue(q, true);
+	spin_unlock_irq(q->queue_lock);
+}
+
 /**
  * blk_queue_bypass_start - enter queue bypass mode
  * @q: queue of interest

@@ -655,8 +662,6 @@ void blk_cleanup_queue(struct request_qu
 	 */
 	blk_freeze_queue(q);
 	spin_lock_irq(lock);
-	if (!q->mq_ops)
-		__blk_drain_queue(q, true);
 	queue_flag_set(QUEUE_FLAG_DEAD, q);
 	spin_unlock_irq(lock);

block/blk-mq.c +2 -0

@@ -159,6 +159,8 @@ void blk_freeze_queue(struct request_que
 	 * exported to drivers as the only user for unfreeze is blk_mq.
 	 */
 	blk_freeze_queue_start(q);
+	if (!q->mq_ops)
+		blk_drain_queue(q);
 	blk_mq_freeze_queue_wait(q);
 }

block/blk.h +2 -0

@@ -362,4 +362,6 @@ static inline void blk_queue_bounce(stru
 }
 #endif /* CONFIG_BOUNCE */
 
+extern void blk_drain_queue(struct request_queue *q);
+
 #endif /* BLK_INTERNAL_H */

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #89 lore raw

PATCH 89/115 ia64, sched/cputime: Fix build error if CONFIG_VIRT_CPU_ACCOUNTING_NATIVE=y

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Valentin Ilie <[email protected]>

[ Upstream commit 7729bebc619307a0233c86f8585a4bf3eadc7ce4 ]

Remove the extra parenthesis.

This bug was introduced by:

e2339a4caa5e: ("ia64: Convert vtime to use nsec units directly")

Signed-off-by Valentin Ilie <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/ia64/kernel/time.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/ia64/kernel/time.c +1 -1

@@ -88,7 +88,7 @@ void vtime_flush(struct task_struct *tsk
 	}
 
 	if (ti->softirq_time) {
-		delta = cycle_to_nsec(ti->softirq_time));
+		delta = cycle_to_nsec(ti->softirq_time);
 		account_system_index_time(tsk, delta, CPUTIME_SOFTIRQ);
 	}

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #90 lore raw

PATCH 90/115 bpf: sockmap missing NULL psock check

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: John Fastabend <[email protected]>

[ Upstream commit 5731a879d03bdaa00265f8ebc32dfd0e65d25276 ]

Add psock NULL check to handle a racing sock event that can get the sk_callback_lock before this case but after xchg happens causing the refcnt to hit zero and sock user data (psock) to be null and queued for garbage collection.

Also add a comment in the code because this is a bit subtle and not obvious in my opinion.

Signed-off-by John Fastabend <[email protected]>

Signed-off-by Daniel Borkmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/bpf/sockmap.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

kernel/bpf/sockmap.c +9 -2

@@ -588,8 +588,15 @@ static void sock_map_free(struct bpf_map
 
 		write_lock_bh(&sock->sk_callback_lock);
 		psock = smap_psock_sk(sock);
-		smap_list_remove(psock, &stab->sock_map[i]);
-		smap_release_sock(psock, sock);
+		/* This check handles a racing sock event that can get the
+		 * sk_callback_lock before this case but after xchg happens
+		 * causing the refcnt to hit zero and sock user data (psock)
+		 * to be null and queued for garbage collection.
+		 */
+		if (likely(psock)) {
+			smap_list_remove(psock, &stab->sock_map[i]);
+			smap_release_sock(psock, sock);
+		}
 		write_unlock_bh(&sock->sk_callback_lock);
 	}
 	rcu_read_unlock();

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #91 lore raw

PATCH 91/115 leds: core: Fix regression caused by commit 2b83ff96f51d

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jacek Anaszewski <[email protected]>

[ Upstream commit 7b6af2c53192f1766892ef40c8f48a413509ed72 ]

Commit 2b83ff96f51d ("led: core: Fix brightness setting when setting delay_off=0") replaced del_timer_sync(&led_cdev->blink_timer) with led_stop_software_blink() in led_blink_set(), which additionally clears LED_BLINK_SW flag as well as zeroes blink_delay_on and blink_delay_off properties of the struct led_classdev.

Cleansing of the latter ones wasn't required to fix the original issue but wasn't considered harmful. It nonetheless turned out to be so in case when pointer to one or both props is passed to led_blink_set() like in the ledtrig-timer.c. In such cases zeroes are passed later in delay_on and/or delay_off arguments to led_blink_setup(), which results either in stopping the software blinking or setting blinking frequency always to 1Hz.

Avoid using led_stop_software_blink() and add a single call required to clear LED_BLINK_SW flag, which was the only needed modification to fix the original issue.

Fixes 2b83ff96f51d ("led: core: Fix brightness setting when setting delay_off=0")

Signed-off-by Jacek Anaszewski <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/leds/led-core.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/leds/led-core.c +2 -1

@@ -187,8 +187,9 @@ void led_blink_set(struct led_classdev *
 		   unsigned long *delay_on,
 		   unsigned long *delay_off)
 {
-	led_stop_software_blink(led_cdev);
+	del_timer_sync(&led_cdev->blink_timer);
 
+	clear_bit(LED_BLINK_SW, &led_cdev->work_flags);
 	clear_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags);
 	clear_bit(LED_BLINK_ONESHOT_STOP, &led_cdev->work_flags);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #92 lore raw

PATCH 92/115 powerpc/pseries: Make RAS IRQ explicitly dependent on DLPAR WQ

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael Ellerman <[email protected]>

[ Upstream commit e2d5915293ffdff977ddcfc12b817b08c53ffa7a ]

The hotplug code uses its own workqueue to handle IRQ requests (pseries_hp_wq), however that workqueue is initialized after init_ras_IRQ(). That can lead to a kernel panic if any hotplug interrupts fire after init_ras_IRQ() but before pseries_hp_wq is initialised. eg:

UDP-Lite hash table entries: 2048 (order: 0, 65536 bytes)
NET: Registered protocol family 1
Unpacking initramfs...
(qemu) object_add memory-backend-ram,id=mem1,size=10G (qemu) device_add pc-dimm,id=dimm1,memdev=mem1

  Unable to handle kernel paging request for data at address 0xf94d03007c421378
  Faulting instruction address: 0xc00000000012d744
  Oops: Kernel access of bad area, sig: 11 [#1]
  LE SMP NR_CPUS=2048 NUMA pSeries
  Modules linked in:
  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.15.0-rc2-ziviani+ #26
  task:         (ptrval) task.stack:         (ptrval)
  NIP:  c00000000012d744 LR: c00000000012d744 CTR: 0000000000000000
  REGS:         (ptrval) TRAP: 0380   Not tainted  (4.15.0-rc2-ziviani+)
  MSR:  8000000000009033 <SF,EE,ME,IR,DR,RI,LE>  CR: 28088042  XER: 20040000
  CFAR: c00000000012d3c4 SOFTE: 0
  ...
  NIP [c00000000012d744] __queue_work+0xd4/0x5c0
  LR [c00000000012d744] __queue_work+0xd4/0x5c0
  Call Trace:
  [c0000000fffefb90] [c00000000012d744] __queue_work+0xd4/0x5c0 (unreliable)
  [c0000000fffefc70] [c00000000012dce4] queue_work_on+0xb4/0xf0

This commit makes the RAS IRQ registration explicitly dependent on the creation of the pseries_hp_wq.

Reported-by Min Deng <[email protected]>

Reported-by Daniel Henrique Barboza <[email protected]>

Tested-by Jose Ricardo Ziviani <[email protected]>

Signed-off-by Michael Ellerman <[email protected]>

Reviewed-by David Gibson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/powerpc/platforms/pseries/dlpar.c   |   21 ++++++++++++++++++---
 arch/powerpc/platforms/pseries/pseries.h |    2 ++
 arch/powerpc/platforms/pseries/ras.c     |    3 ++-
 3 files changed, 22 insertions(+), 4 deletions(-)

arch/powerpc/platforms/pseries/dlpar.c +18 -3

@@ -586,11 +586,26 @@ static ssize_t dlpar_show(struct class *
 
 static CLASS_ATTR_RW(dlpar);
 
-static int __init pseries_dlpar_init(void)
+int __init dlpar_workqueue_init(void)
 {
+	if (pseries_hp_wq)
+		return 0;
+
 	pseries_hp_wq = alloc_workqueue("pseries hotplug workqueue",
-					WQ_UNBOUND, 1);
+			WQ_UNBOUND, 1);
+
+	return pseries_hp_wq ? 0 : -ENOMEM;
+}
+
+static int __init dlpar_sysfs_init(void)
+{
+	int rc;
+
+	rc = dlpar_workqueue_init();
+	if (rc)
+		return rc;
+
 	return sysfs_create_file(kernel_kobj, &class_attr_dlpar.attr);
 }
-machine_device_initcall(pseries, pseries_dlpar_init);
+machine_device_initcall(pseries, dlpar_sysfs_init);

arch/powerpc/platforms/pseries/pseries.h +2 -0

@@ -98,4 +98,6 @@ static inline unsigned long cmo_get_page
 	return CMO_PageSize;
 }
 
+int dlpar_workqueue_init(void);
+
 #endif /* _PSERIES_PSERIES_H */

arch/powerpc/platforms/pseries/ras.c +2 -1

@@ -69,7 +69,8 @@ static int __init init_ras_IRQ(void)
 	/* Hotplug Events */
 	np = of_find_node_by_path("/event-sources/hot-plug-events");
 	if (np != NULL) {
-		request_event_sources_irqs(np, ras_hotplug_interrupt,
+		if (dlpar_workqueue_init() == 0)
+			request_event_sources_irqs(np, ras_hotplug_interrupt,
 					   "RAS_HOTPLUG");
 		of_node_put(np);
 	}

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #93 lore raw

PATCH 93/115 nvme-fabrics: initialize default host->id in nvmf_host_default()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Ewan D. Milne" <[email protected]>

[ Upstream commit 6b018235b4daabae96d855219fae59c3fb8be417 ]

The field was uninitialized before use.

Signed-off-by Ewan D. Milne <[email protected]>

Signed-off-by Christoph Hellwig <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/nvme/host/fabrics.c |    1 +
 1 file changed, 1 insertion(+)

drivers/nvme/host/fabrics.c +1 -0

@@ -74,6 +74,7 @@ static struct nvmf_host *nvmf_host_defau
 		return NULL;
 
 	kref_init(&host->ref);
+	uuid_gen(&host->id);
 	snprintf(host->nqn, NVMF_NQN_SIZE,
 		"nqn.2014-08.org.nvmexpress:uuid:%pUb", &host->id);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #94 lore raw

PATCH 94/115 x86/platform/intel-mid: Revert "Make bt_sfi_data const"

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <[email protected]>

[ Upstream commit 9d0513d82f1a8fe17b41f113ac5922fa57dbaf5c ]

So one of the constification patches unearthed a type casting fragility of the underlying code:

276c87054751 ("x86/platform/intel-mid: Make 'bt_sfi_data' const")

converted the struct to be const while it is also used as a temporary container for important data that is used to fill 'parent' and 'name' fields in struct platform_device_info.

The compiler doesn't notice this due to an explicit type cast that loses the const - which fragility will be fixed separately.

This type cast turned a seemingly trivial const propagation patch into a hard to debug data corruptor and crasher bug.

Signed-off-by Andy Shevchenko <[email protected]>

Cc Bhumika Goyal <[email protected]>

Cc Darren Hart <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/platform/intel-mid/device_libs/platform_bt.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/x86/platform/intel-mid/device_libs/platform_bt.c +1 -1

@@ -60,7 +60,7 @@ static int __init tng_bt_sfi_setup(struc
 	return 0;
 }
 
-static const struct bt_sfi_data tng_bt_sfi_data __initdata = {
+static struct bt_sfi_data tng_bt_sfi_data __initdata = {
 	.setup	= tng_bt_sfi_setup,
 };

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #95 lore raw

PATCH 95/115 bnxt_en: Fix population of flow_type in bnxt_hwrm_cfa_flow_alloc()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sunil Challa <[email protected]>

[ Upstream commit 7deea450eb912f269d999de62c8ab922d1461748 ]

flow_type in HWRM_FLOW_ALLOC is not being populated correctly due to incorrect passing of pointer and size of l3_mask argument of is_wildcard(). Fixed this.

Fixes db1d36a27324 ("bnxt_en: add TC flower offload flow_alloc/free FW cmds")

Signed-off-by Sunil Challa <[email protected]>

Reviewed-by Sathya Perla <[email protected]>

Reviewed-by Venkat Duvvuru <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +1 -1

@@ -327,7 +327,7 @@ static int bnxt_hwrm_cfa_flow_alloc(stru
 	}
 
 	/* If all IP and L4 fields are wildcarded then this is an L2 flow */
-	if (is_wildcard(&l3_mask, sizeof(l3_mask)) &&
+	if (is_wildcard(l3_mask, sizeof(*l3_mask)) &&
 	    is_wildcard(&flow->l4_mask, sizeof(flow->l4_mask))) {
 		flow_flags |= CFA_FLOW_ALLOC_REQ_FLAGS_FLOWTYPE_L2;
 	} else {

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #96 lore raw

PATCH 96/115 bnxt_en: Fix the Invalid VF id check in bnxt_vf_ndo_prep routine.

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Venkat Duvvuru <[email protected]>

[ Upstream commit 78f300049335ae81a5cc6b4b232481dc5e1f9d41 ]

In bnxt_vf_ndo_prep (which is called by bnxt_get_vf_config ndo), there is a check for "Invalid VF id". Currently, the check is done against max_vfs. However, the user doesn't always create max_vfs. So, the check should be against the created number of VFs. The number of bnxt_vf_info structures that are allocated in bnxt_alloc_vf_resources routine is the "number of requested VFs". So, if an "invalid VF id" falls between the requested number of VFs and the max_vfs, the driver will be dereferencing an invalid pointer.

Fixes c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")

Signed-off-by Venkat Devvuru <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +1 -1

@@ -70,7 +70,7 @@ static int bnxt_vf_ndo_prep(struct bnxt
 		netdev_err(bp->dev, "vf ndo called though sriov is disabled\n");
 		return -EINVAL;
 	}
-	if (vf_id >= bp->pf.max_vfs) {
+	if (vf_id >= bp->pf.active_vfs) {
 		netdev_err(bp->dev, "Invalid VF id %d\n", vf_id);
 		return -EINVAL;
 	}

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #97 lore raw

PATCH 97/115 xen-netfront: enable device after manual module load

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eduardo Otubo <[email protected]>

[ Upstream commit b707fda2df4070785d0fa8a278aa13944c5f51f8 ]

When loading the module after unloading it, the network interface would not be enabled and thus wouldn't have a backend counterpart and unable to be used by the guest.

The guest would face errors like:

[root@guest ~]# ethtool -i eth0
Cannot get driver information: No such device

[root@guest ~]# ifconfig eth0
eth0: error fetching interface information: Device not found

This patch initializes the state of the netfront device whenever it is loaded manually, this state would communicate the netback to create its device and establish the connection between them.

Signed-off-by Eduardo Otubo <[email protected]>

Reviewed-by Boris Ostrovsky <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/xen-netfront.c |    1 +
 1 file changed, 1 insertion(+)

drivers/net/xen-netfront.c +1 -0

@@ -1326,6 +1326,7 @@ static struct net_device *xennet_create_
 
 	netif_carrier_off(netdev);
 
+	xenbus_switch_state(dev, XenbusStateInitialising);
 	return netdev;
 
  exit:

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #98 lore raw

PATCH 98/115 mdio-sun4i: Fix a memory leak

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christophe JAILLET <[email protected]>

[ Upstream commit 56c0290202ab94a2f2780c449395d4ae8495fab4 ]

If the probing of the regulator is deferred, the memory allocated by 'mdiobus_alloc_size()' will be leaking.
It should be freed before the next call to 'sun4i_mdio_probe()' which will reallocate it.

Fixes 4bdcb1dd9feb ("net: Add MDIO bus driver for the Allwinner EMAC")

Signed-off-by Christophe JAILLET <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/phy/mdio-sun4i.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/net/phy/mdio-sun4i.c +4 -2

@@ -118,8 +118,10 @@ static int sun4i_mdio_probe(struct platf
 
 	data->regulator = devm_regulator_get(&pdev->dev, "phy");
 	if (IS_ERR(data->regulator)) {
-		if (PTR_ERR(data->regulator) == -EPROBE_DEFER)
-			return -EPROBE_DEFER;
+		if (PTR_ERR(data->regulator) == -EPROBE_DEFER) {
+			ret = -EPROBE_DEFER;
+			goto err_out_free_mdiobus;
+		}
 
 		dev_info(&pdev->dev, "no regulator found\n");
 		data->regulator = NULL;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #99 lore raw

PATCH 99/115 SolutionEngine771x: fix Ether platform data

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sergei Shtylyov <[email protected]>

[ Upstream commit 195e2addbce09e5afbc766efc1e6567c9ce840d3 ]

The 'sh_eth' driver's probe() method would fail on the SolutionEngine7710 board and crash on SolutionEngine7712 board as the platform code is hopelessly behind the driver's platform data -- it passes the PHY address instead of 'struct sh_eth_plat_data *'; pass the latter to the driver in order to fix the bug...

Fixes 71557a37adb5 ("[netdrvr] sh_eth: Add SH7619 support")

Signed-off-by Sergei Shtylyov <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/sh/boards/mach-se/770x/setup.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

arch/sh/boards/mach-se/770x/setup.c +8 -2

@@ -9,6 +9,7 @@
  */
 #include <linux/init.h>
 #include <linux/platform_device.h>
+#include <linux/sh_eth.h>
 #include <mach-se/mach/se.h>
 #include <mach-se/mach/mrshpc.h>
 #include <asm/machvec.h>

@@ -115,6 +116,11 @@ static struct platform_device heartbeat_
 #if defined(CONFIG_CPU_SUBTYPE_SH7710) ||\
 	defined(CONFIG_CPU_SUBTYPE_SH7712)
 /* SH771X Ethernet driver */
+static struct sh_eth_plat_data sh_eth_plat = {
+	.phy = PHY_ID,
+	.phy_interface = PHY_INTERFACE_MODE_MII,
+};
+
 static struct resource sh_eth0_resources[] = {
 	[0] = {
 		.start = SH_ETH0_BASE,

@@ -132,7 +138,7 @@ static struct platform_device sh_eth0_de
 	.name = "sh771x-ether",
 	.id = 0,
 	.dev = {
-		.platform_data = PHY_ID,
+		.platform_data = &sh_eth_plat,
 	},
 	.num_resources = ARRAY_SIZE(sh_eth0_resources),
 	.resource = sh_eth0_resources,

@@ -155,7 +161,7 @@ static struct platform_device sh_eth1_de
 	.name = "sh771x-ether",
 	.id = 1,
 	.dev = {
-		.platform_data = PHY_ID,
+		.platform_data = &sh_eth_plat,
 	},
 	.num_resources = ARRAY_SIZE(sh_eth1_resources),
 	.resource = sh_eth1_resources,

Greg Kroah-Hartman

author maintainer

2018-03-02 09:05 UTC #100 lore raw

PATCH 100/115 xen/gntdev: Fix off-by-one error when unmapping with holes

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ross Lagerwall <[email protected]>

[ Upstream commit 951a010233625b77cde3430b4b8785a9a22968d1 ]

If the requested range has a hole, the calculation of the number of pages to unmap is off by one. Fix it.

Signed-off-by Ross Lagerwall <[email protected]>

Reviewed-by Boris Ostrovsky <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/xen/gntdev.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

drivers/xen/gntdev.c +1 -3

@@ -380,10 +380,8 @@ static int unmap_grant_pages(struct gran
 		}
 		range = 0;
 		while (range < pages) {
-			if (map->unmap_ops[offset+range].handle == -1) {
-				range--;
+			if (map->unmap_ops[offset+range].handle == -1)
 				break;
-			}
 			range++;
 		}
 		err = __unmap_grant_pages(map, offset, range);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #101 lore raw

PATCH 101/115 xen/gntdev: Fix partial gntdev_mmap() cleanup

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ross Lagerwall <[email protected]>

[ Upstream commit cf2acf66ad43abb39735568f55e1f85f9844e990 ]

When cleaning up after a partially successful gntdev_mmap(), unmap the successfully mapped grant pages otherwise Xen will kill the domain if in debug mode (Attempt to implicitly unmap a granted PTE) or Linux will kill the process and emit "BUG: Bad page map in process" if Xen is in release mode.

This is only needed when use_ptemod is true because gntdev_put_map() will unmap grant pages itself when use_ptemod is false.

Signed-off-by Ross Lagerwall <[email protected]>

Reviewed-by Boris Ostrovsky <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/xen/gntdev.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/xen/gntdev.c +3 -1

@@ -1071,8 +1071,10 @@ unlock_out:
 out_unlock_put:
 	mutex_unlock(&priv->lock);
 out_put_map:
-	if (use_ptemod)
+	if (use_ptemod) {
 		map->vma = NULL;
+		unmap_grant_pages(map, 0, map->count);
+	}
 	gntdev_put_map(priv, map);
 	return err;
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #102 lore raw

PATCH 102/115 sctp: add a ceiling to optlen in some sockopts

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marcelo Ricardo Leitner <[email protected]>

[ Upstream commit 5960cefab9df76600a1a7d4ff592c59e14616e88 ]

Hangbin Liu reported that some sockopt calls could cause the kernel to log a warning on memory allocation failure if the user supplied a large optlen value. That is because some of them called memdup_user() without a ceiling on optlen, allowing it to try to allocate really large buffers.

This patch adds a ceiling by limiting optlen to the maximum allowed that would still make sense for these sockopt.

Reported-by Hangbin Liu <[email protected]>

Signed-off-by Marcelo Ricardo Leitner <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/sctp/socket.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

net/sctp/socket.c +10 -0

@@ -3494,6 +3494,8 @@ static int sctp_setsockopt_hmac_ident(st
 
 	if (optlen < sizeof(struct sctp_hmacalgo))
 		return -EINVAL;
+	optlen = min_t(unsigned int, optlen, sizeof(struct sctp_hmacalgo) +
+					     SCTP_AUTH_NUM_HMACS * sizeof(u16));
 
 	hmacs = memdup_user(optval, optlen);
 	if (IS_ERR(hmacs))

@@ -3532,6 +3534,11 @@ static int sctp_setsockopt_auth_key(stru
 
 	if (optlen <= sizeof(struct sctp_authkey))
 		return -EINVAL;
+	/* authkey->sca_keylength is u16, so optlen can't be bigger than
+	 * this.
+	 */
+	optlen = min_t(unsigned int, optlen, USHRT_MAX +
+					     sizeof(struct sctp_authkey));
 
 	authkey = memdup_user(optval, optlen);
 	if (IS_ERR(authkey))

@@ -3889,6 +3896,9 @@ static int sctp_setsockopt_reset_streams
 
 	if (optlen < sizeof(*params))
 		return -EINVAL;
+	/* srs_number_streams is u16, so optlen can't be bigger than this. */
+	optlen = min_t(unsigned int, optlen, USHRT_MAX +
+					     sizeof(__u16) * sizeof(*params));
 
 	params = memdup_user(optval, optlen);
 	if (IS_ERR(params))

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #103 lore raw

PATCH 103/115 sctp: make use of pre-calculated len

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marcelo Ricardo Leitner <[email protected]>

[ Upstream commit c76f97c99ae6d26d14c7f0e50e074382bfbc9f98 ]

Some sockopt handling functions were calculating the length of the buffer to be written to userspace and then calculating it again when actually writing the buffer, which could lead to some write not using an up-to-date length.

This patch updates such places to just make use of the len variable.

Also, replace some sizeof(type) to sizeof(var).

Signed-off-by Marcelo Ricardo Leitner <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/sctp/socket.c |   16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

net/sctp/socket.c +10 -6

@@ -4957,7 +4957,7 @@ static int sctp_getsockopt_autoclose(str
 	len = sizeof(int);
 	if (put_user(len, optlen))
 		return -EFAULT;
-	if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))
+	if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len))
 		return -EFAULT;
 	return 0;
 }

@@ -5588,6 +5588,9 @@ copy_getaddrs:
 		err = -EFAULT;
 		goto out;
 	}
+	/* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too,
+	 * but we can't change it anymore.
+	 */
 	if (put_user(bytes_copied, optlen))
 		err = -EFAULT;
 out:

@@ -6024,7 +6027,7 @@ static int sctp_getsockopt_maxseg(struct
 		params.assoc_id = 0;
 	} else if (len >= sizeof(struct sctp_assoc_value)) {
 		len = sizeof(struct sctp_assoc_value);
-		if (copy_from_user(&params, optval, sizeof(params)))
+		if (copy_from_user(&params, optval, len))
 			return -EFAULT;
 	} else
 		return -EINVAL;

@@ -6194,7 +6197,9 @@ static int sctp_getsockopt_active_key(st
 
 	if (len < sizeof(struct sctp_authkeyid))
 		return -EINVAL;
-	if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
+
+	len = sizeof(struct sctp_authkeyid);
+	if (copy_from_user(&val, optval, len))
 		return -EFAULT;
 
 	asoc = sctp_id2assoc(sk, val.scact_assoc_id);

@@ -6206,7 +6211,6 @@ static int sctp_getsockopt_active_key(st
 	else
 		val.scact_keynumber = ep->active_key_id;
 
-	len = sizeof(struct sctp_authkeyid);
 	if (put_user(len, optlen))
 		return -EFAULT;
 	if (copy_to_user(optval, &val, len))

@@ -6232,7 +6236,7 @@ static int sctp_getsockopt_peer_auth_chu
 	if (len < sizeof(struct sctp_authchunks))
 		return -EINVAL;
 
-	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
+	if (copy_from_user(&val, optval, sizeof(val)))
 		return -EFAULT;
 
 	to = p->gauth_chunks;

@@ -6277,7 +6281,7 @@ static int sctp_getsockopt_local_auth_ch
 	if (len < sizeof(struct sctp_authchunks))
 		return -EINVAL;
 
-	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
+	if (copy_from_user(&val, optval, sizeof(val)))
 		return -EFAULT;
 
 	to = p->gauth_chunks;

Greg Kroah-Hartman

author maintainer

2018-03-02 09:05 UTC #104 lore raw

PATCH 104/115 net: gianfar_ptp: move set_fipers() to spinlock protecting area

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yangbo Lu <[email protected]>

[ Upstream commit 11d827a993a969c3c6ec56758ff63a44ba19b466 ]

set_fipers() calling should be protected by spinlock in case that any interrupt breaks related registers setting and the function we expect. This patch is to move set_fipers() to spinlock protecting area in ptp_gianfar_adjtime().

Signed-off-by Yangbo Lu <[email protected]>

Acked-by Richard Cochran <[email protected]>

Reviewed-by Fabio Estevam <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/freescale/gianfar_ptp.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

drivers/net/ethernet/freescale/gianfar_ptp.c +1 -2

@@ -319,11 +319,10 @@ static int ptp_gianfar_adjtime(struct pt
 	now = tmr_cnt_read(etsects);
 	now += delta;
 	tmr_cnt_write(etsects, now);
+	set_fipers(etsects);
 
 	spin_unlock_irqrestore(&etsects->lock, flags);
 
-	set_fipers(etsects);
-
 	return 0;
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 09:05 UTC #105 lore raw

PATCH 105/115 of_mdio: avoid MDIO bus removal when a PHY is missing

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Madalin Bucur <[email protected]>

[ Upstream commit 95f566de0269a0c59fd6a737a147731302136429 ]

If one of the child devices is missing the of_mdiobus_register_phy() call will return -ENODEV. When a missing device is encountered the registration of the remaining PHYs is stopped and the MDIO bus will fail to register. Propagate all errors except ENODEV to avoid it.

Signed-off-by Madalin Bucur <[email protected]>

Reviewed-by Andrew Lunn <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/of/of_mdio.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

drivers/of/of_mdio.c +7 -2

@@ -228,7 +228,12 @@ int of_mdiobus_register(struct mii_bus *
 			rc = of_mdiobus_register_phy(mdio, child, addr);
 		else
 			rc = of_mdiobus_register_device(mdio, child, addr);
-		if (rc)
+
+		if (rc == -ENODEV)
+			dev_err(&mdio->dev,
+				"MDIO device at address %d is missing.\n",
+				addr);
+		else if (rc)
 			goto unregister;
 	}

@@ -252,7 +257,7 @@ int of_mdiobus_register(struct mii_bus *
 
 			if (of_mdiobus_child_is_phy(child)) {
 				rc = of_mdiobus_register_phy(mdio, child, addr);
-				if (rc)
+				if (rc && rc != -ENODEV)
 					goto unregister;
 			}
 		}

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #106 lore raw

PATCH 106/115 nfp: always unmask aux interrupts at init

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jakub Kicinski <[email protected]>

[ Upstream commit fc2336505fb49a8b932a0a67a9745c408b79992c ]

The link state and exception interrupts may be masked when we probe. The firmware should in theory prevent sending (and automasking) those interrupts if the device is disabled, but if my reading of the FW code is correct there are firmwares out there with race conditions in this area. The interrupt may also be masked if previous driver which used the device was malfunctioning and we didn't load the FW (there is no other good way to comprehensively reset the PF).

Note that FW unmasks the data interrupts by itself when vNIC is enabled, such helpful operation is not performed for LSC/EXN interrupts.

Always unmask the auxiliary interrupts after request_irq(). On the remove path add missing PCI write flush before free_irq().

Fixes 4c3523623dc0 ("net: add driver for Netronome NFP4000/NFP6000 NIC VFs")

Signed-off-by Jakub Kicinski <[email protected]>

Reviewed-by Dirk van der Merwe <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/netronome/nfp/nfp_net_common.c |    2 ++
 1 file changed, 2 insertions(+)

drivers/net/ethernet/netronome/nfp/nfp_net_common.c +2 -0

@@ -568,6 +568,7 @@ nfp_net_aux_irq_request(struct nfp_net *
 		return err;
 	}
 	nn_writeb(nn, ctrl_offset, entry->entry);
+	nfp_net_irq_unmask(nn, entry->entry);
 
 	return 0;
 }

@@ -582,6 +583,7 @@ static void nfp_net_aux_irq_free(struct
 				 unsigned int vector_idx)
 {
 	nn_writeb(nn, ctrl_offset, 0xff);
+	nn_pci_flush(nn);
 	free_irq(nn->irq_entries[vector_idx].vector, nn);
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #107 lore raw

PATCH 107/115 mlxsw: pci: Wait after reset before accessing HW

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yuval Mintz <[email protected]>

[ Upstream commit 8e033a93b37f37aa9fca71a370a895155320af60 ]

After performing reset driver polls on HW indication until learning that the reset is done, but immediately after reset the device becomes unresponsive which might lead to completion timeout on the first read.

Wait for 100ms before starting the polling.

Fixes 233fa44bd67a ("mlxsw: pci: Implement reset done check")

Signed-off-by Yuval Mintz <[email protected]>

Reviewed-by Ido Schimmel <[email protected]>

Signed-off-by Jiri Pirko <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/ethernet/mellanox/mlxsw/pci.c    |    7 ++++++-
 drivers/net/ethernet/mellanox/mlxsw/pci_hw.h |    1 +
 2 files changed, 7 insertions(+), 1 deletion(-)

drivers/net/ethernet/mellanox/mlxsw/pci.c +6 -1

@@ -1643,7 +1643,12 @@ static int mlxsw_pci_sw_reset(struct mlx
 		return 0;
 	}
 
-	wmb(); /* reset needs to be written before we read control register */
+	/* Reset needs to be written before we read control register, and
+	 * we must wait for the HW to become responsive once again
+	 */
+	wmb();
+	msleep(MLXSW_PCI_SW_RESET_WAIT_MSECS);
+
 	end = jiffies + msecs_to_jiffies(MLXSW_PCI_SW_RESET_TIMEOUT_MSECS);
 	do {
 		u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY);

drivers/net/ethernet/mellanox/mlxsw/pci_hw.h +1 -0

@@ -59,6 +59,7 @@
 #define MLXSW_PCI_SW_RESET			0xF0010
 #define MLXSW_PCI_SW_RESET_RST_BIT		BIT(0)
 #define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS	5000
+#define MLXSW_PCI_SW_RESET_WAIT_MSECS		100
 #define MLXSW_PCI_FW_READY			0xA1844
 #define MLXSW_PCI_FW_READY_MASK			0xFFFF
 #define MLXSW_PCI_FW_READY_MAGIC		0x5E

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #108 lore raw

PATCH 108/115 MIPS: Implement __multi3 for GCC7 MIPS64r6 builds

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: James Hogan <[email protected]>

commit ebabcf17bcd7ce968b1631ebe08236275698f39b upstream.

GCC7 is a bit too eager to generate suboptimal __multi3 calls (128bit multiply with 128bit result) for MIPS64r6 builds, even in code which doesn't explicitly use 128bit types, such as the following:

unsigned long func(unsigned long a, unsigned long b)

{
	return a > (~0UL) / b;
}

Which GCC rearanges to:

return (unsigned __int128)a * (unsigned __int128)b > 0xffffffffffffffff;

Therefore implement __multi3, but only for MIPS64r6 with GCC7 as under normal circumstances we wouldn't expect any calls to __multi3 to be generated from kernel code.

Reported-by Thomas Petazzoni <[email protected]>

Signed-off-by James Hogan <[email protected]>

Tested-by Waldemar Brodkorb <[email protected]>

Cc Ralf Baechle <[email protected]>

Cc Maciej W. Rozycki <[email protected]>

Cc Matthew Fortune <[email protected]>

Cc Florian Fainelli <[email protected]>

Patchwork: https://patchwork.linux-mips.org/patch/17890/

Cc Guenter Roeck <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/mips/lib/Makefile |    3 +-
 arch/mips/lib/libgcc.h |   17 +++++++++++++++
 arch/mips/lib/multi3.c |   54 +++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 73 insertions(+), 1 deletion(-)

arch/mips/lib/Makefile +2 -1

@@ -16,4 +16,5 @@ obj-$(CONFIG_CPU_R3000)		+= r3k_dump_tlb
 obj-$(CONFIG_CPU_TX39XX)	+= r3k_dump_tlb.o
 
 # libgcc-style stuff needed in the kernel
-obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o ucmpdi2.o
+obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o multi3.o \
+	 ucmpdi2.o

arch/mips/lib/libgcc.h +17 -0

@@ -10,10 +10,18 @@ typedef int word_type __attribute__ ((mo
 struct DWstruct {
 	int high, low;
 };
+
+struct TWstruct {
+	long long high, low;
+};
 #elif defined(__LITTLE_ENDIAN)
 struct DWstruct {
 	int low, high;
 };
+
+struct TWstruct {
+	long long low, high;
+};
 #else
 #error I feel sick.
 #endif

@@ -23,4 +31,13 @@ typedef union {
 	long long ll;
 } DWunion;
 
+#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6)
+typedef int ti_type __attribute__((mode(TI)));
+
+typedef union {
+	struct TWstruct s;
+	ti_type ti;
+} TWunion;
+#endif
+
 #endif /* __ASM_LIBGCC_H */

arch/mips/lib/multi3.c new file +54 -0

54 lines not on this page · raw message

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #109 lore raw

PATCH 109/115 powerpc/pseries: Enable RAS hotplug events later

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sam Bobroff <[email protected]>

commit c9dccf1d074a67d36c510845f663980d69e3409b upstream.

Currently if the kernel receives a memory hot-unplug event early enough, it may get stuck in an infinite loop in dissolve_free_huge_pages(). This appears as a stall just after:

pseries-hotplug-mem: Attempting to hot-remove XX LMB(s) at YYYYYYYY

It appears to be caused by "minimum_order" being uninitialized, due to init_ras_IRQ() executing before hugetlb_init().

To correct this, extract the part of init_ras_IRQ() that enables hotplug event processing and place it in the machine_late_initcall phase, which is guaranteed to be after hugetlb_init() is called.

Signed-off-by Sam Bobroff <[email protected]>

Acked-by Balbir Singh <[email protected]>

[mpe: Reorder the functions to make the diff readable]

Signed-off-by Michael Ellerman <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/powerpc/platforms/pseries/ras.c |   31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

arch/powerpc/platforms/pseries/ras.c +22 -9

@@ -49,6 +49,28 @@ static irqreturn_t ras_error_interrupt(i
 
 
 /*
+ * Enable the hotplug interrupt late because processing them may touch other
+ * devices or systems (e.g. hugepages) that have not been initialized at the
+ * subsys stage.
+ */
+int __init init_ras_hotplug_IRQ(void)
+{
+	struct device_node *np;
+
+	/* Hotplug Events */
+	np = of_find_node_by_path("/event-sources/hot-plug-events");
+	if (np != NULL) {
+		if (dlpar_workqueue_init() == 0)
+			request_event_sources_irqs(np, ras_hotplug_interrupt,
+						   "RAS_HOTPLUG");
+		of_node_put(np);
+	}
+
+	return 0;
+}
+machine_late_initcall(pseries, init_ras_hotplug_IRQ);
+
+/*
  * Initialize handlers for the set of interrupts caused by hardware errors
  * and power system events.
  */

@@ -66,15 +88,6 @@ static int __init init_ras_IRQ(void)
 		of_node_put(np);
 	}
 
-	/* Hotplug Events */
-	np = of_find_node_by_path("/event-sources/hot-plug-events");
-	if (np != NULL) {
-		if (dlpar_workqueue_init() == 0)
-			request_event_sources_irqs(np, ras_hotplug_interrupt,
-					   "RAS_HOTPLUG");
-		of_node_put(np);
-	}
-
 	/* EPOW Events */
 	np = of_find_node_by_path("/event-sources/epow-events");
 	if (np != NULL) {

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #110 lore raw

PATCH 110/115 arm64: dts: marvell: add comphy nodes on cp110 master and slave

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Antoine Tenart <[email protected]>

commit 910d1bf2c68fa1d7dcde0316cb91f62758407e8d upstream.

This patch describes the comphy available in the cp110 master and slave. This comphy provides serdes lanes used by various controllers such as the network one.

Signed-off-by Gregory CLEMENT <[email protected]>

Cc Mikulas Patocka <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi |   38 +++++++++++++++++++
 arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi  |   38 +++++++++++++++++++
 2 files changed, 76 insertions(+)

arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi +38 -0

@@ -111,6 +111,44 @@
 				};
 			};
 
+			cpm_comphy: phy@120000 {
+				compatible = "marvell,comphy-cp110";
+				reg = <0x120000 0x6000>;
+				marvell,system-controller = <&cpm_syscon0>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				cpm_comphy0: phy@0 {
+					reg = <0>;
+					#phy-cells = <1>;
+				};
+
+				cpm_comphy1: phy@1 {
+					reg = <1>;
+					#phy-cells = <1>;
+				};
+
+				cpm_comphy2: phy@2 {
+					reg = <2>;
+					#phy-cells = <1>;
+				};
+
+				cpm_comphy3: phy@3 {
+					reg = <3>;
+					#phy-cells = <1>;
+				};
+
+				cpm_comphy4: phy@4 {
+					reg = <4>;
+					#phy-cells = <1>;
+				};
+
+				cpm_comphy5: phy@5 {
+					reg = <5>;
+					#phy-cells = <1>;
+				};
+			};
+
 			cpm_mdio: mdio@12a200 {
 				#address-cells = <1>;
 				#size-cells = <0>;

arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi +38 -0

@@ -111,6 +111,44 @@
 				};
 			};
 
+			cps_comphy: phy@120000 {
+				compatible = "marvell,comphy-cp110";
+				reg = <0x120000 0x6000>;
+				marvell,system-controller = <&cps_syscon0>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				cps_comphy0: phy@0 {
+					reg = <0>;
+					#phy-cells = <1>;
+				};
+
+				cps_comphy1: phy@1 {
+					reg = <1>;
+					#phy-cells = <1>;
+				};
+
+				cps_comphy2: phy@2 {
+					reg = <2>;
+					#phy-cells = <1>;
+				};
+
+				cps_comphy3: phy@3 {
+					reg = <3>;
+					#phy-cells = <1>;
+				};
+
+				cps_comphy4: phy@4 {
+					reg = <4>;
+					#phy-cells = <1>;
+				};
+
+				cps_comphy5: phy@5 {
+					reg = <5>;
+					#phy-cells = <1>;
+				};
+			};
+
 			cps_mdio: mdio@12a200 {
 				#address-cells = <1>;
 				#size-cells = <0>;

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #111 lore raw

PATCH 111/115 arm64: dts: marvell: mcbin: add comphy references to Ethernet ports

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Antoine Tenart <[email protected]>

commit 760b3843fcd88f2a46e66eec08e2e6023a425809 upstream.

This patch adds comphy phandles to the Ethernet ports in the mcbin device tree. The comphy is used to configure the serdes PHYs used by these ports.

Reviewed-by Andrew Lunn <[email protected]>

Signed-off-by Gregory CLEMENT <[email protected]>

Cc Mikulas Patocka <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm64/boot/dts/marvell/armada-8040-mcbin.dts |    9 +++++++++
 1 file changed, 9 insertions(+)

arch/arm64/boot/dts/marvell/armada-8040-mcbin.dts +9 -0

@@ -228,8 +228,11 @@
 
 &cpm_eth0 {
 	status = "okay";
+	/* Network PHY */
 	phy = <&phy0>;
 	phy-mode = "10gbase-kr";
+	/* Generic PHY, providing serdes lanes */
+	phys = <&cpm_comphy4 0>;
 };
 
 &cpm_sata0 {

@@ -263,15 +266,21 @@
 
 &cps_eth0 {
 	status = "okay";
+	/* Network PHY */
 	phy = <&phy8>;
 	phy-mode = "10gbase-kr";
+	/* Generic PHY, providing serdes lanes */
+	phys = <&cps_comphy4 0>;
 };
 
 &cps_eth1 {
 	/* CPS Lane 0 - J5 (Gigabit RJ45) */
 	status = "okay";
+	/* Network PHY */
 	phy = <&ge_phy>;
 	phy-mode = "sgmii";
+	/* Generic PHY, providing serdes lanes */
+	phys = <&cps_comphy0 1>;
 };
 
 &cps_pinctrl {

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #112 lore raw

PATCH 112/115 net: sched: fix crash when deleting secondary chains

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roman Kapl <[email protected]>

commit d7aa04a5e82b4f254d306926c81eae8df69e5200 upstream.

If you flush (delete) a filter chain other than chain 0 (such as when deleting the device), the kernel may run into a use-after-free. The chain refcount must not be decremented unless we are sure we are done with the chain.

To reproduce the bug, run:
ip link add dtest type dummy
tc qdisc add dev dtest ingress
tc filter add dev dtest chain 1 parent ffff: flower ip link del dtest

Introduced in: commit f93e1cdcf42c ("net/sched: fix filter flushing"), but unless you have KAsan or luck, you won't notice it until commit 0dadc117ac8b ("cls_flower: use tcf_exts_get_net() before call_rcu()")

Fixes f93e1cdcf42c ("net/sched: fix filter flushing")

Acked-by Jiri Pirko <[email protected]>

Signed-off-by Roman Kapl <[email protected]>

Cc Cong Wang <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/sched/cls_api.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

net/sched/cls_api.c +4 -3

@@ -197,14 +197,15 @@ static struct tcf_chain *tcf_chain_creat
 
 static void tcf_chain_flush(struct tcf_chain *chain)
 {
-	struct tcf_proto *tp;
+	struct tcf_proto *tp = rtnl_dereference(chain->filter_chain);
 
 	if (chain->p_filter_chain)
 		RCU_INIT_POINTER(*chain->p_filter_chain, NULL);
-	while ((tp = rtnl_dereference(chain->filter_chain)) != NULL) {
+	while (tp) {
 		RCU_INIT_POINTER(chain->filter_chain, tp->next);
-		tcf_chain_put(chain);
 		tcf_proto_destroy(tp);
+		tp = rtnl_dereference(chain->filter_chain);
+		tcf_chain_put(chain);
 	}
 }

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #113 lore raw

PATCH 113/115 net: sched: crash on blocks with goto chain action

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roman Kapl <[email protected]>

commit a60b3f515d30d0fe8537c64671926879a3548103 upstream.

tcf_block_put_ext has assumed that all filters (and thus their goto actions) are destroyed in RCU callback and thus can not race with our list iteration. However, that is not true during netns cleanup (see tcf_exts_get_net comment).

Prevent the user after free by holding all chains (except 0, that one is already held). foreach_safe is not enough in this case.

To reproduce, run the following in a netns and then delete the ns:
ip link add dtest type dummy
tc qdisc add dev dtest ingress
tc filter add dev dtest chain 1 parent ffff: handle 1 prio 1 flower action goto chain 2

Fixes 822e86d997 ("net_sched: remove tcf_block_put_deferred()")

Signed-off-by Roman Kapl <[email protected]>

Acked-by Jiri Pirko <[email protected]>

Cc Cong Wang <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/sched/cls_api.c |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

net/sched/cls_api.c +12 -5

@@ -282,7 +282,8 @@ static void tcf_block_put_final(struct w
 	struct tcf_chain *chain, *tmp;
 
 	rtnl_lock();
-	/* Only chain 0 should be still here. */
+
+	/* At this point, all the chains should have refcnt == 1. */
 	list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
 		tcf_chain_put(chain);
 	rtnl_unlock();

@@ -290,17 +291,23 @@ static void tcf_block_put_final(struct w
 }
 
 /* XXX: Standalone actions are not allowed to jump to any chain, and bound
- * actions should be all removed after flushing. However, filters are now
- * destroyed in tc filter workqueue with RTNL lock, they can not race here.
+ * actions should be all removed after flushing.
  */
 void tcf_block_put(struct tcf_block *block)
 {
-	struct tcf_chain *chain, *tmp;
+	struct tcf_chain *chain;
 
 	if (!block)
 		return;
 
-	list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
+	/* Hold a refcnt for all chains, except 0, so that they don't disappear
+	 * while we are iterating.
+	 */
+	list_for_each_entry(chain, &block->chain_list, list)
+		if (chain->index)
+			tcf_chain_hold(chain);
+
+	list_for_each_entry(chain, &block->chain_list, list)
 		tcf_chain_flush(chain);
 
 	INIT_WORK(&block->work, tcf_block_put_final);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #114 lore raw

PATCH 114/115 net_sched: get rid of rcu_barrier() in tcf_block_put_ext()

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Cong Wang <[email protected]>

commit efbf78973978b0d25af59bc26c8013a942af6e64 upstream.

Both Eric and Paolo noticed the rcu_barrier() we use in tcf_block_put_ext() could be a performance bottleneck when we have a lot of tc classes.

Paolo provided the following to demonstrate the issue:

tc qdisc add dev lo root htb
for I in seq 1 1000; do

        tc class add dev lo parent 1: classid 1:$I htb rate 100kbit
        tc qdisc add dev lo parent 1:$I handle $((I + 1)): htb
        for J in `seq 1 10`; do
                tc filter add dev lo parent $((I + 1)): u32 match ip src 1.1.1.$J
        done

done
time tc qdisc del dev root

real    0m54.764s
user    0m0.023s
sys     0m0.000s

The rcu_barrier() there is to ensure we free the block after all chains are gone, that is, to queue tcf_block_put_final() at the tail of workqueue. We can achieve this ordering requirement by refcnt'ing tcf block instead, that is, the tcf block is freed only when the last chain in this block is gone. This also simplifies the code.

Paolo reported after this patch we get:

real    0m0.017s
user    0m0.000s
sys     0m0.017s

Tested-by Paolo Abeni <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jiri Pirko <[email protected]>

Cc Jamal Hadi Salim <[email protected]>

Signed-off-by Cong Wang <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/net/sch_generic.h |    1 -
 net/sched/cls_api.c       |   29 +++++++++--------------------
 2 files changed, 9 insertions(+), 21 deletions(-)

include/net/sch_generic.h +0 -1

@@ -273,7 +273,6 @@ struct tcf_chain {
 
 struct tcf_block {
 	struct list_head chain_list;
-	struct work_struct work;
 };
 
 static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz)

net/sched/cls_api.c +9 ~~-20~~

@@ -211,8 +211,12 @@ static void tcf_chain_flush(struct tcf_c
 
 static void tcf_chain_destroy(struct tcf_chain *chain)
 {
+	struct tcf_block *block = chain->block;
+
 	list_del(&chain->list);
 	kfree(chain);
+	if (list_empty(&block->chain_list))
+		kfree(block);
 }
 
 static void tcf_chain_hold(struct tcf_chain *chain)

@@ -276,26 +280,12 @@ err_chain_create:
 }
 EXPORT_SYMBOL(tcf_block_get);
 
-static void tcf_block_put_final(struct work_struct *work)
-{
-	struct tcf_block *block = container_of(work, struct tcf_block, work);
-	struct tcf_chain *chain, *tmp;
-
-	rtnl_lock();
-
-	/* At this point, all the chains should have refcnt == 1. */
-	list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
-		tcf_chain_put(chain);
-	rtnl_unlock();
-	kfree(block);
-}
-
 /* XXX: Standalone actions are not allowed to jump to any chain, and bound
  * actions should be all removed after flushing.
  */
 void tcf_block_put(struct tcf_block *block)
 {
-	struct tcf_chain *chain;
+	struct tcf_chain *chain, *tmp;
 
 	if (!block)
 		return;

@@ -310,12 +300,11 @@ void tcf_block_put(struct tcf_block *blo
 	list_for_each_entry(chain, &block->chain_list, list)
 		tcf_chain_flush(chain);
 
-	INIT_WORK(&block->work, tcf_block_put_final);
-	/* Wait for RCU callbacks to release the reference count and make
-	 * sure their works have been queued before this.
+	/* At this point, all the chains should have refcnt >= 1. Block will be
+	 * freed after all chains are gone.
 	 */
-	rcu_barrier();
-	tcf_queue_work(&block->work);
+	list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
+		tcf_chain_put(chain);
 }
 EXPORT_SYMBOL(tcf_block_put);

Greg Kroah-Hartman

author maintainer

2018-03-02 08:51 UTC #115 lore raw

PATCH 115/115 net: sched: fix use-after-free in tcf_block_put_ext

4.14-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jiri Pirko <[email protected]>

commit df45bf84e4f5a48f23d4b1a07d21d566e8b587b2 upstream.

Since the block is freed with last chain being put, once we reach the end of iteration of list_for_each_entry_safe, the block may be already freed. I'm hitting this only by creating and deleting clsact:

[  202.171952] ==================================================================
[  202.180182] BUG: KASAN: use-after-free in tcf_block_put_ext+0x240/0x390
[  202.187590] Read of size 8 at addr ffff880225539a80 by task tc/796
[  202.194508]
[  202.196185] CPU: 0 PID: 796 Comm: tc Not tainted 4.15.0-rc2jiri+ #5
[  202.203200] Hardware name: Mellanox Technologies Ltd. "MSN2100-CB2F"/"SA001017", BIOS 5.6.5 06/07/2016
[  202.213613] Call Trace:
[  202.216369]  dump_stack+0xda/0x169
[  202.220192]  ? dma_virt_map_sg+0x147/0x147
[  202.224790]  ? show_regs_print_info+0x54/0x54
[  202.229691]  ? tcf_chain_destroy+0x1dc/0x250
[  202.234494]  print_address_description+0x83/0x3d0
[  202.239781]  ? tcf_block_put_ext+0x240/0x390
[  202.244575]  kasan_report+0x1ba/0x460
[  202.248707]  ? tcf_block_put_ext+0x240/0x390
[  202.253518]  tcf_block_put_ext+0x240/0x390
[  202.258117]  ? tcf_chain_flush+0x290/0x290
[  202.262708]  ? qdisc_hash_del+0x82/0x1a0
[  202.267111]  ? qdisc_hash_add+0x50/0x50
[  202.271411]  ? __lock_is_held+0x5f/0x1a0
[  202.275843]  clsact_destroy+0x3d/0x80 [sch_ingress]
[  202.281323]  qdisc_destroy+0xcb/0x240
[  202.285445]  qdisc_graft+0x216/0x7b0
[  202.289497]  tc_get_qdisc+0x260/0x560

Fix this by holding the block also by chain 0 and put chain 0 explicitly, out of the list_for_each_entry_safe loop at the very end of tcf_block_put_ext.

Fixes efbf78973978 ("net_sched: get rid of rcu_barrier() in tcf_block_put_ext()")

Signed-off-by Jiri Pirko <[email protected]>

Cc Cong Wang <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/sched/cls_api.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

net/sched/cls_api.c +7 -6

@@ -290,21 +290,22 @@ void tcf_block_put(struct tcf_block *blo
 	if (!block)
 		return;
 
-	/* Hold a refcnt for all chains, except 0, so that they don't disappear
+	/* Hold a refcnt for all chains, so that they don't disappear
 	 * while we are iterating.
 	 */
 	list_for_each_entry(chain, &block->chain_list, list)
-		if (chain->index)
-			tcf_chain_hold(chain);
+		tcf_chain_hold(chain);
 
 	list_for_each_entry(chain, &block->chain_list, list)
 		tcf_chain_flush(chain);
 
-	/* At this point, all the chains should have refcnt >= 1. Block will be
-	 * freed after all chains are gone.
-	 */
+	/* At this point, all the chains should have refcnt >= 1. */
 	list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
 		tcf_chain_put(chain);
+
+	/* Finally, put chain 0 and allow block to be freed. */
+	chain = list_first_entry(&block->chain_list, struct tcf_chain, list);
+	tcf_chain_put(chain);
 }
 EXPORT_SYMBOL(tcf_block_put);

Dan Murphy

2018-03-02 13:25 UTC #116 lore raw

Greg

Quoted 5 lines · Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.24 release. There are 115 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

It seems we missed the patch. It was supposed to be queued up for 4.14.24.

ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds

    [ commit 863204cfdae98626a92535ac928ad79f4d6b74ff upstream ]

Dan

Quoted 516 lines

Responses should be made by Sun Mar 4 08:44:32 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.24-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
    Linux 4.14.24-rc1
Jiri Pirko <[email protected]>
net: sched: fix use-after-free in tcf_block_put_ext
Cong Wang <[email protected]>
net_sched: get rid of rcu_barrier() in tcf_block_put_ext()
Roman Kapl <[email protected]>
net: sched: crash on blocks with goto chain action
Roman Kapl <[email protected]>
net: sched: fix crash when deleting secondary chains
Antoine Tenart <[email protected]>
arm64: dts: marvell: mcbin: add comphy references to Ethernet ports
Antoine Tenart <[email protected]>
arm64: dts: marvell: add comphy nodes on cp110 master and slave
Sam Bobroff <[email protected]>
powerpc/pseries: Enable RAS hotplug events later
James Hogan <[email protected]>
MIPS: Implement __multi3 for GCC7 MIPS64r6 builds
Yuval Mintz <[email protected]>
mlxsw: pci: Wait after reset before accessing HW
Jakub Kicinski <[email protected]>
nfp: always unmask aux interrupts at init
Madalin Bucur <[email protected]>
of_mdio: avoid MDIO bus removal when a PHY is missing
Yangbo Lu <[email protected]>
net: gianfar_ptp: move set_fipers() to spinlock protecting area
Marcelo Ricardo Leitner <[email protected]>
sctp: make use of pre-calculated len
Marcelo Ricardo Leitner <[email protected]>
sctp: add a ceiling to optlen in some sockopts
Ross Lagerwall <[email protected]>
xen/gntdev: Fix partial gntdev_mmap() cleanup
Ross Lagerwall <[email protected]>
xen/gntdev: Fix off-by-one error when unmapping with holes
Sergei Shtylyov <[email protected]>
SolutionEngine771x: fix Ether platform data
Christophe JAILLET <[email protected]>
mdio-sun4i: Fix a memory leak
Eduardo Otubo <[email protected]>
xen-netfront: enable device after manual module load
Venkat Duvvuru <[email protected]>
bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine.
Sunil Challa <[email protected]>
bnxt_en: Fix population of flow_type in bnxt_hwrm_cfa_flow_alloc()
Andy Shevchenko <[email protected]>
x86/platform/intel-mid: Revert "Make 'bt_sfi_data' const"
Ewan D. Milne <[email protected]>
    nvme-fabrics: initialize default host->id in nvmf_host_default()
Michael Ellerman <[email protected]>
powerpc/pseries: Make RAS IRQ explicitly dependent on DLPAR WQ
Jacek Anaszewski <[email protected]>
leds: core: Fix regression caused by commit 2b83ff96f51d
John Fastabend <[email protected]>
bpf: sockmap missing NULL psock check
Valentin Ilie <[email protected]>
ia64, sched/cputime: Fix build error if CONFIG_VIRT_CPU_ACCOUNTING_NATIVE=y
Ming Lei <[email protected]>
block: drain queue before waiting for q_usage_counter becoming zero
Loic Poulain <[email protected]>
wcn36xx: Fix dynamic power saving
Luu An Phu <[email protected]>
can: flex_can: Correct the checking for frame length in flexcan_start_xmit()
Johannes Berg <[email protected]>
mac80211: mesh: drop frames appearing to be from us
Hao Chen <[email protected]>
nl80211: Check for the required netlink attribute presence
Netanel Belgazal <[email protected]>
net: ena: unmask MSI-X only after device initialization is completed
Jacob Keller <[email protected]>
    i40e: don't remove netdev->dev_addr when syncing uc list
Alexander Duyck <[email protected]>
i40e/i40evf: Account for frags split over multiple descriptors in check linearize
Felix Janda <[email protected]>
uapi libc compat: add fallback for unsupported libcs
Dave Young <[email protected]>
x86/efi: Fix kernel param add_efi_memmap regression
Leon Romanovsky <[email protected]>
RDMA/netlink: Fix locking around __ib_get_device_by_index
Xiongwei Song <[email protected]>
drm/ttm: check the return value of kzalloc
SZ Lin (林上智) <[email protected]>
    NET: usb: qmi_wwan: add support for YUGA CLM920-NC5 PID 0x9625
Tushar Dave <[email protected]>
e1000: fix disabling already-disabled warning
Gao Feng <[email protected]>
macvlan: Fix one possible double free
Aliaksei Karaliou <[email protected]>
xfs: quota: check result of register_shrinker()
Aliaksei Karaliou <[email protected]>
xfs: quota: fix missed destroy of qi_tree_lock
Erez Shitrit <[email protected]>
IB/ipoib: Fix race condition in neigh creation
Leon Romanovsky <[email protected]>
IB/mlx4: Fix mlx4_ib_alloc_mr error flow
Oleksandr Andrushchenko <[email protected]>
Input: xen-kbdfront - do not advertise multi-touch pressure support
Xin Long <[email protected]>
ip6_tunnel: allow ip6gre dev mtu to be set below 1280
Nikolay Borisov <[email protected]>
btrfs: Fix flush bio leak
Stefan Haberland <[email protected]>
s390/dasd: fix wrongly assigned configuration data
David Howells <[email protected]>
afs: Fix missing error handling in afs_write_end()
Guenter Roeck <[email protected]>
genirq: Guard handle_bad_irq log messages
Nitzan Carmi <[email protected]>
IB/mlx5: Fix mlx5_ib_alloc_mr error flow
Matthieu CASTET <[email protected]>
led: core: Fix brightness setting when setting delay_off=0
Thomas Gleixner <[email protected]>
perf/x86/intel: Plug memory leak in intel_pmu_init()
Guilherme G. Piccoli <[email protected]>
bnx2x: Improve reliability in case of nested PCI errors
Siva Reddy Kallam <[email protected]>
tg3: Enable PHY reset in MTU change path for 5720
Siva Reddy Kallam <[email protected]>
tg3: Add workaround to restrict 5762 MRRS to 2048
Tommi Rantala <[email protected]>
tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path
Tommi Rantala <[email protected]>
tipc: error path leak fixes in tipc_enable_bearer()
Hangbin Liu <[email protected]>
netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done()
Antoine Tenart <[email protected]>
crypto: inside-secure - fix request allocations in invalidation path
Antoine Tenart <[email protected]>
crypto: inside-secure - free requests even if their handling failed
Ofer Heifetz <[email protected]>
crypto: inside-secure - per request invalidation
Bogdan Mirea <[email protected]>
arm64: dts: renesas: ulcb: Remove renesas, no-ether-link property
James Hogan <[email protected]>
lib/mpi: Fix umul_ppmm() for MIPS64r6
Jonathan Cameron <[email protected]>
    crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t
Arnd Bergmann <[email protected]>
ARM: dts: ls1021a: fix incorrect clock references
Bryan Tan <[email protected]>
RDMA/vmw_pvrdma: Call ib_umem_release on destroy QP path
Gabriel Krisman Bertazi <[email protected]>
i915: Reject CCS modifiers for pipe C on Geminilake
Florian Westphal <[email protected]>
netfilter: uapi: correct UNTRACKED conntrack state bit number
Cathy Avery <[email protected]>
scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: fix chain filter in nf_tables_dump_rules()
Boris Ostrovsky <[email protected]>
xen/balloon: Mark unallocated host memory as UNUSABLE
Kuninori Morimoto <[email protected]>
ASoC: rsnd: fixup ADG register mask
Moshe Shemesh <[email protected]>
net/mlx5: Stay in polling mode when command EQ destroy fails
Moshe Shemesh <[email protected]>
net/mlx5: Cleanup IRQs in case of unload failure
Huy Nguyen <[email protected]>
net/mlx5e: Fix ETS BW check
Fredrik Hallenberg <[email protected]>
net: stmmac: Fix bad RX timestamp extraction
Fredrik Hallenberg <[email protected]>
net: stmmac: Fix TX timestamp calculation
Xin Long <[email protected]>
ip6_tunnel: get the min mtu properly in ip6_tnl_xmit
Xin Long <[email protected]>
ip6_gre: remove the incorrect mtu limit for ipgre tap
Xin Long <[email protected]>
ip_gre: remove the incorrect mtu limit for ipgre tap
Xin Long <[email protected]>
vxlan: update skb dst pmtu on tx path
Alexander Kochetkov <[email protected]>
net: arc_emac: fix arc_emac_rx() error paths
Sean Wang <[email protected]>
net: mediatek: setup proper state for disabled GMAC on the default
Jan Beulich <[email protected]>
x86-64/Xen: eliminate W+X mappings
John Stultz <[email protected]>
staging: ion: Fix ion_cma_heap allocations
Prateek Sood <[email protected]>
cgroup: Fix deadlock in cpu hotplug path
Abhijeet Kumar <[email protected]>
ASoC: nau8825: fix issue that pop noise when start capture
Radu Pirea <[email protected]>
spi: atmel: fixed spin_lock usage inside atmel_spi_remove
Jia-Ju Bai <[email protected]>
mac80211_hwsim: Fix a possible sleep-in-atomic bug in hwsim_get_radio_nl
Josh Poimboeuf <[email protected]>
x86/stacktrace: Make zombie stack traces reliable
Herbert Xu <[email protected]>
xfrm: Reinject transport-mode packets through tasklet
Karol Herbst <[email protected]>
drm/nouveau/pci: do a msi rearm on init
Alexey Khoroshilov <[email protected]>
net: phy: xgene: disable clk on error paths
Al Viro <[email protected]>
sget(): handle failures of register_shrinker()
Xin Long <[email protected]>
sctp: fix the issue that a __u16 variable may overflow in sctp_ulpq_renege
Arnaldo Carvalho de Melo <[email protected]>
x86/asm: Allow again using asm.h when building for the 'bpf' clang target
Chunyan Zhang <[email protected]>
ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch
John David Anglin <[email protected]>
parisc: Reduce thread stack to 16 kb
Brendan McGrath <[email protected]>
ipv6: icmp6: Allow icmp messages to be looped back
Albert Hsieh <[email protected]>
mtd: nand: brcmnand: Zero bitflip is not an error
Sascha Hauer <[email protected]>
mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM
Daniele Palmas <[email protected]>
    net: usb: qmi_wwan: add Telit ME910 PID 0x1101 support
Igor Russkikh <[email protected]>
net: aquantia: Fix hardware DMA stream overload on large MRRS
Igor Russkikh <[email protected]>
net: aquantia: Fix actual speed capabilities reporting
Keith Busch <[email protected]>
nvme: check hw sectors before setting chunk sectors
James Smart <[email protected]>
nvme-fc: remove double put reference if admin connect fails
Arvind Yadav <[email protected]>
phy: cpcap-usb: Fix platform_get_irq_byname's error checking.
Andreas Platschek <[email protected]>
dmaengine: fsl-edma: disable clks on all error paths
Prasad B Munirathnam <[email protected]>
scsi: aacraid: Fix I/O drop during reset
Christophe JAILLET <[email protected]>
mm/frame_vector.c: release a semaphore in 'get_vaddr_frames()'
Arnd Bergmann <[email protected]>
exec: avoid gcc-8 warning for get_task_comm
Anna-Maria Gleixner <[email protected]>
hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers)
-------------
Diffstat:
 Makefile                                           |  4 +-
 arch/arm/boot/dts/ls1021a-qds.dts                  |  2 +-
 arch/arm/boot/dts/ls1021a-twr.dts                  |  2 +-
 arch/arm/lib/csumpartialcopyuser.S                 |  4 +
 arch/arm64/boot/dts/marvell/armada-8040-mcbin.dts  |  9 +++
 .../boot/dts/marvell/armada-cp110-master.dtsi      | 38 ++++++++++
 .../arm64/boot/dts/marvell/armada-cp110-slave.dtsi | 38 ++++++++++
 arch/arm64/boot/dts/renesas/ulcb.dtsi              |  1 -
 arch/ia64/kernel/time.c                            |  2 +-
 arch/mips/lib/Makefile                             |  3 +-
 arch/mips/lib/libgcc.h                             | 17 +++++
 arch/mips/lib/multi3.c                             | 54 ++++++++++++++
 arch/parisc/include/asm/thread_info.h              |  5 ++
 arch/powerpc/platforms/pseries/dlpar.c             | 21 +++++-
 arch/powerpc/platforms/pseries/pseries.h           |  2 +
 arch/powerpc/platforms/pseries/ras.c               | 30 ++++++--
 arch/sh/boards/mach-se/770x/setup.c                | 10 ++-
 arch/x86/events/intel/core.c                       |  5 +-
 arch/x86/include/asm/asm.h                         |  2 +
 arch/x86/kernel/setup.c                            |  5 +-
 arch/x86/kernel/stacktrace.c                       |  6 +-
 .../platform/intel-mid/device_libs/platform_bt.c   |  2 +-
 arch/x86/xen/enlighten.c                           | 81 +++++++++++++++++++++
 arch/x86/xen/enlighten_pv.c                        |  3 +
 arch/x86/xen/mmu_pv.c                              | 12 +++
 arch/x86/xen/setup.c                               |  6 +-
 block/blk-core.c                                   |  9 ++-
 block/blk-mq.c                                     |  2 +
 block/blk.h                                        |  2 +
 crypto/af_alg.c                                    |  4 +-
 crypto/algif_aead.c                                |  2 +-
 crypto/algif_skcipher.c                            |  2 +-
 drivers/crypto/inside-secure/safexcel.c            |  1 +
 drivers/crypto/inside-secure/safexcel_cipher.c     | 85 +++++++++++++++++-----
 drivers/crypto/inside-secure/safexcel_hash.c       | 79 +++++++++++++++-----
 drivers/dma/fsl-edma.c                             | 28 +++----
 drivers/gpu/drm/i915/intel_display.c               |  2 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c     |  7 ++
 drivers/gpu/drm/ttm/ttm_page_alloc.c               |  2 +
 drivers/infiniband/core/core_priv.h                |  2 +-
 drivers/infiniband/core/device.c                   | 18 ++++-
 drivers/infiniband/core/nldev.c                    | 54 +++++++++-----
 drivers/infiniband/hw/mlx4/mr.c                    |  2 +-
 drivers/infiniband/hw/mlx5/mr.c                    |  1 +
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c       |  7 ++
 drivers/infiniband/ulp/ipoib/ipoib_main.c          | 25 +++++--
 drivers/infiniband/ulp/ipoib/ipoib_multicast.c     |  5 +-
 drivers/input/misc/xen-kbdfront.c                  |  2 -
 drivers/leds/led-core.c                            |  1 +
 drivers/mtd/nand/brcmnand/brcmnand.c               |  2 +-
 drivers/mtd/nand/gpmi-nand/gpmi-nand.c             |  6 +-
 drivers/net/can/flexcan.c                          |  2 +-
 drivers/net/ethernet/amazon/ena/ena_netdev.c       | 26 +++----
 drivers/net/ethernet/aquantia/atlantic/aq_hw.h     |  4 +-
 drivers/net/ethernet/aquantia/atlantic/aq_nic.c    |  7 +-
 drivers/net/ethernet/aquantia/atlantic/aq_nic.h    |  2 +-
 .../net/ethernet/aquantia/atlantic/aq_pci_func.c   |  5 +-
 .../ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c  | 13 +++-
 .../ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c  | 25 ++++++-
 .../aquantia/atlantic/hw_atl/hw_atl_llh_internal.h |  6 ++
 drivers/net/ethernet/arc/emac_main.c               | 53 ++++++++------
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c    |  4 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c   | 14 +++-
 drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c    |  2 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c       |  2 +-
 drivers/net/ethernet/broadcom/tg3.c                | 13 +++-
 drivers/net/ethernet/broadcom/tg3.h                |  4 +
 drivers/net/ethernet/freescale/gianfar_ptp.c       |  3 +-
 drivers/net/ethernet/intel/e1000/e1000.h           |  3 +-
 drivers/net/ethernet/intel/e1000/e1000_main.c      | 27 +++++--
 drivers/net/ethernet/intel/i40e/i40e_main.c        | 17 ++++-
 drivers/net/ethernet/intel/i40e/i40e_txrx.c        | 26 ++++++-
 drivers/net/ethernet/intel/i40evf/i40e_txrx.c      | 26 ++++++-
 drivers/net/ethernet/mediatek/mtk_eth_soc.c        | 11 +--
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 ++-
 drivers/net/ethernet/mellanox/mlx5/core/eq.c       | 18 +++--
 drivers/net/ethernet/mellanox/mlxsw/pci.c          |  7 +-
 drivers/net/ethernet/mellanox/mlxsw/pci_hw.h       |  1 +
 .../net/ethernet/netronome/nfp/nfp_net_common.c    |  2 +
 drivers/net/ethernet/stmicro/stmmac/common.h       |  2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c |  5 +-
 drivers/net/ethernet/stmicro/stmmac/enh_desc.c     |  3 +-
 drivers/net/ethernet/stmicro/stmmac/norm_desc.c    |  2 +-
 .../net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c  |  6 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |  2 +-
 drivers/net/macvlan.c                              |  7 +-
 drivers/net/phy/mdio-sun4i.c                       |  6 +-
 drivers/net/phy/mdio-xgene.c                       | 21 ++++--
 drivers/net/usb/qmi_wwan.c                         |  2 +
 drivers/net/vxlan.c                                | 14 ++++
 drivers/net/wireless/ath/wcn36xx/main.c            | 23 +++---
 drivers/net/wireless/ath/wcn36xx/pmc.c             |  6 +-
 drivers/net/wireless/mac80211_hwsim.c              |  2 +-
 drivers/net/xen-netfront.c                         |  1 +
 drivers/nvme/host/core.c                           |  3 +-
 drivers/nvme/host/fabrics.c                        |  1 +
 drivers/nvme/host/fc.c                             |  1 -
 drivers/of/of_mdio.c                               |  9 ++-
 drivers/phy/motorola/phy-cpcap-usb.c               |  2 +-
 drivers/s390/block/dasd_3990_erp.c                 | 10 +++
 drivers/scsi/aacraid/aacraid.h                     |  1 +
 drivers/scsi/aacraid/linit.c                       |  2 +-
 drivers/scsi/storvsc_drv.c                         |  3 +-
 drivers/spi/spi-atmel.c                            |  2 +-
 drivers/staging/android/ion/Kconfig                |  2 +-
 drivers/staging/android/ion/ion_cma_heap.c         | 15 +++-
 drivers/xen/balloon.c                              | 65 ++++++++++++++---
 drivers/xen/gntdev.c                               |  8 +-
 fs/afs/write.c                                     |  8 +-
 fs/btrfs/volumes.c                                 |  1 -
 fs/exec.c                                          |  7 +-
 fs/super.c                                         |  6 +-
 fs/xfs/xfs_qm.c                                    | 46 ++++++++----
 include/crypto/if_alg.h                            |  5 +-
 include/linux/mlx5/driver.h                        |  2 +-
 include/linux/sched.h                              |  6 +-
 include/net/sch_generic.h                          |  1 -
 include/net/xfrm.h                                 |  3 +
 include/uapi/linux/libc-compat.h                   | 55 +++++++++++++-
 include/uapi/linux/netfilter/nf_conntrack_common.h |  2 +-
 include/xen/balloon.h                              |  5 ++
 kernel/bpf/sockmap.c                               | 11 ++-
 kernel/cgroup/cgroup-v1.c                          |  6 +-
 kernel/irq/debug.h                                 |  5 ++
 kernel/time/hrtimer.c                              |  7 +-
 lib/mpi/longlong.h                                 | 18 ++++-
 mm/frame_vector.c                                  |  6 +-
 net/ipv4/ip_gre.c                                  |  1 +
 net/ipv4/xfrm4_input.c                             | 12 ++-
 net/ipv6/ip6_gre.c                                 |  1 +
 net/ipv6/ip6_tunnel.c                              | 15 ++--
 net/ipv6/route.c                                   |  1 +
 net/ipv6/xfrm6_input.c                             | 10 ++-
 net/mac80211/rx.c                                  |  2 +
 net/netfilter/nf_tables_api.c                      |  8 +-
 net/sched/cls_api.c                                | 48 ++++++------
 net/sctp/socket.c                                  | 26 +++++--
 net/sctp/ulpqueue.c                                | 24 ++----
 net/tipc/bearer.c                                  |  5 +-
 net/tipc/monitor.c                                 |  6 +-
 net/wireless/nl80211.c                             |  3 +-
 net/xfrm/xfrm_input.c                              | 57 +++++++++++++++
 sound/soc/codecs/nau8825.c                         |  1 +
 sound/soc/sh/rcar/adg.c                            |  6 +-
 144 files changed, 1332 insertions(+), 367 deletions(-)

Signature · 2 lines

------------------
Dan Murphy

Greg Kroah-Hartman

author maintainer

2018-03-02 16:58 UTC #117 lore raw

Quoted 9 lines · Dan Murphy

Greg
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.24 release. There are 115 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Quoted 5 lines

It seems we missed the patch. It was supposed to be queued up for 4.14.24.
ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
    [ commit 863204cfdae98626a92535ac928ad79f4d6b74ff upstream ]

I don't see the request to backport this, when was it sent?

thanks,

greg k-h

Greg Kroah-Hartman

author maintainer

2018-03-02 16:58 UTC #118 lore raw

Quoted 10 lines · Greg Kroah-Hartman

Quoted 9 lines · Dan Murphy
Greg
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.24 release. There are 115 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Quoted 7 lines

Quoted 5 lines
It seems we missed the patch. It was supposed to be queued up for 4.14.24.
ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
    [ commit 863204cfdae98626a92535ac928ad79f4d6b74ff upstream ]
I don't see the request to backport this, when was it sent?

Ah, I see it now, sorry about that. Will get it next round.

thanks,

greg k-h

kernelci.org bot

2018-03-02 13:38 UTC #119 lore raw

stable-rc/linux-4.14.y boot: 62 boots: 1 failed, 59 passed with 2 offline (v4.14.23-116-g0ae11358b0bd)

Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.14.y/kernel/v4.14.23-116-g0ae11358b0bd/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.14.y/kernel/v4.14.23-116-g0ae11358b0bd/

Tree: stable-rc
Branch: linux-4.14.y
Git Describe: v4.14.23-116-g0ae11358b0bd
Git Commit: 0ae11358b0bdffc782ee655fd103b95cbcafb899
Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 38 unique boards, 19 SoC families, 13 builds out of 185

Boot Regressions Detected:

arm:

    sunxi_defconfig:
        sun8i-h3-orangepi-pc:
            lab-free-electrons: new failure (last pass: v4.14.18-23-g8d861f5b27b0)

Boot Failure Detected:

arm:

sunxi_defconfig
sun8i-h3-orangepi-pc: 1 failed lab

Offline Platforms:

arm64:

defconfig:
meson-gxbb-odroidc2: 1 offline lab meson-gxl-s905x-nexbox-a95x: 1 offline lab

---
For more info write to <[email protected]>

Guenter Roeck

2018-03-02 17:15 UTC #120 lore raw

Quoted 8 lines · Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.24 release. There are 115 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Mar 4 08:44:32 UTC 2018. Anything received after that time might be too late.

Build results:

	total: 145 pass: 145 fail: 0
Qemu test results:
	total: 134 pass: 134 fail: 0

Details are available at http://kerneltests.org/builders.

Guenter

Greg Kroah-Hartman

author maintainer

2018-03-02 18:53 UTC #121 lore raw

Quoted 9 lines · Guenter Roeck

Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.24 release. There are 115 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Mar 4 08:44:32 UTC 2018. Anything received after that time might be too late.

Quoted 6 lines

Build results:
	total: 145 pass: 145 fail: 0
Qemu test results:
	total: 134 pass: 134 fail: 0
Details are available at http://kerneltests.org/builders.

Yeah, they all worked this time! :)

thanks for testing and letting me know.

greg k-h

Naresh Kamboju

2018-03-02 18:18 UTC #122 lore raw

Quoted 9 lines · Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.24 release. There are 115 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Mar 4 08:44:32 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:

Quoted 8 lines

        https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.24-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h

Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.

NOTE:
dragonboard-410c and qemu-system-x86_64 are added to testing device pool. ignore boot failures 3 on dragonboard-410c are due to local LAVA setup.

Summary
------------------------------------------------------------------------

kernel: 4.14.24-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: 0ae11358b0bdffc782ee655fd103b95cbcafb899
git describe: v4.14.23-116-g0ae11358b0bd
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.23-116-g0ae11358b0bd

No regressions (compared to build v4.14.23)

Boards, architectures and test suites:
-------------------------------------

dragonboard-410c
* boot - pass: 24, fail: 3,
* kselftest - pass: 52, skip: 37
* libhugetlbfs - pass: 90, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17
* ltp-fcntl-locktests-tests - pass: 4,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 61, skip: 2
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 21, skip: 1
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 18,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 14,
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1012, fail: 2, skip: 136
* ltp-timers-tests - pass: 12, skip: 1

hi6220-hikey - arm64
* boot - pass: 20,
* kselftest - pass: 48, skip: 17
* libhugetlbfs - pass: 90, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 61, skip: 2
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 21, skip: 1
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 10, skip: 4
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 999, skip: 151
* ltp-timers-tests - pass: 12, skip: 1

juno-r2 - arm64
* boot - pass: 20,
* kselftest - pass: 48, skip: 17
* libhugetlbfs - pass: 90, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 61, skip: 2
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 22,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 10, skip: 4
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1001, skip: 149
* ltp-timers-tests - pass: 12, skip: 1

qemu_x86_64
* boot - pass: 20,
* kselftest - pass: 68, skip: 14
* libhugetlbfs - pass: 90, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 57, skip: 6
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 22,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 13, skip: 1
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1004, skip: 146
* ltp-timers-tests - pass: 12, skip: 1

x15 - arm
* boot - pass: 20,
* kselftest - pass: 43, fail: 2, skip: 19
* libhugetlbfs - pass: 87, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 62, fail: 2, skip: 17
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 61, skip: 2
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 20, skip: 2
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 13, skip: 1
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1053, skip: 97
* ltp-timers-tests - pass: 12, skip: 1

x86_64
* boot - pass: 20,
* kselftest - pass: 61, skip: 19
* libhugetlbfs - pass: 90, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 62, skip: 1
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 22,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 9, skip: 5
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1031, skip: 119
* ltp-timers-tests - pass: 12, skip: 1

--
Linaro QA (beta)
https://qa-reports.linaro.org

Greg Kroah-Hartman

author maintainer

2018-03-02 18:52 UTC #123 lore raw

Quoted 38 lines · Naresh Kamboju

Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.24 release. There are 115 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Mar 4 08:44:32 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
        https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.24-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
NOTE:
dragonboard-410c and qemu-system-x86_64 are added to testing device pool. ignore boot failures 3 on dragonboard-410c are due to local LAVA setup.
Summary
------------------------------------------------------------------------
kernel: 4.14.24-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: 0ae11358b0bdffc782ee655fd103b95cbcafb899
git describe: v4.14.23-116-g0ae11358b0bd
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.23-116-g0ae11358b0bd

Quoted 1 line

No regressions (compared to build v4.14.23)

Great, thanks for testing these three and letting me know.

greg k-h

Shuah Khan

2018-03-02 21:29 UTC #124 lore raw