Commit Graph

663081 Commits

Author SHA1 Message Date
Eric Dumazet
17c3060b17 tcp: clear saved_syn in tcp_disconnect()
In the (very unlikely) case a passive socket becomes a listener,
we do not want to duplicate its saved SYN headers.

This would lead to double frees, use after free, and please hackers and
various fuzzers

Tested:
    0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
   +0 setsockopt(3, IPPROTO_TCP, TCP_SAVE_SYN, [1], 4) = 0
   +0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0

   +0 bind(3, ..., ...) = 0
   +0 listen(3, 5) = 0

   +0 < S 0:0(0) win 32972 <mss 1460,nop,wscale 7>
   +0 > S. 0:0(0) ack 1 <...>
  +.1 < . 1:1(0) ack 1 win 257
   +0 accept(3, ..., ...) = 4

   +0 connect(4, AF_UNSPEC, ...) = 0
   +0 close(3) = 0
   +0 bind(4, ..., ...) = 0
   +0 listen(4, 5) = 0

   +0 < S 0:0(0) win 32972 <mss 1460,nop,wscale 7>
   +0 > S. 0:0(0) ack 1 <...>
  +.1 < . 1:1(0) ack 1 win 257

Fixes: cd8ae85299 ("tcp: provide SYN headers for passive connections")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-09 18:27:28 -07:00
David S. Miller
df59577d8c linux-can-fixes-for-4.12-20170404
-----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEE4bay/IylYqM/npjQHv7KIOw4HPYFAljjwMUTHG1rbEBwZW5n
 dXRyb25peC5kZQAKCRAe/sog7Dgc9mHoCADZYQkgRBnaNp5x5XFJfIccC12O5Lqq
 AlJ1sJZAGI0xm863VW2qMgZLXY0j6gCPaZ71Dru/hnZdcrzc047ztAHGMItfJti2
 Jm5lXgzozgpqmdYH0WcdnT1GxRAFLyUMWhagm1PSgpOHGV8CcjBLMYiUuD5oUjqN
 Gz7CeHdPSLFeyO0ZJh/gEvstMgn5FrQx6iY8vXX0hAAI+XZM/QDlObBeZ6NxEHB6
 b2W38/yu9KyR3V1m4uYS2JwPc+dmG9ESxdjDuNuo49kV2oPeEyFknkg7wSecidxO
 TXau2awb8s6yn1KIYzRRFmJzGT7qB9A9xmfHUxJwQ+B4gIHg5yHJ2c+q
 =j41f
 -----END PGP SIGNATURE-----

Merge tag 'linux-can-fixes-for-4.12-20170404' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can

Marc Kleine-Budde says:

====================
pull-request: can 2017-04-04

this is a pull request of two patches for net/master.

The first patch by Markus Marb fixes a register read access in the ifi driver.
The second patch by Geert Uytterhoeven for the rcar driver remove the printing
of a kernel virtual address.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-08 08:48:50 -07:00
Gao Feng
7cc2b043bc net: tcp: Increase TCP_MIB_OUTRSTS even though fail to alloc skb
Because TCP_MIB_OUTRSTS is an important count, so always increase it
whatever send it successfully or not.

Now move the increment of TCP_MIB_OUTRSTS to the top of
tcp_send_active_reset to make sure it is increased always even though
fail to alloc skb.

Signed-off-by: Gao Feng <fgao@ikuai8.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-08 08:30:09 -07:00
David S. Miller
3aecfbb19c Merge branch 'l2tp-sockopt-errors'
Guillaume Nault says:

====================
l2tp: fix error handling of PPPoL2TP socket options

Fix pppol2tp_[gs]etsockopt() so that they don't ignore errors returned
by their helper functions.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-08 08:29:05 -07:00
Guillaume Nault
321a52a391 l2tp: don't mask errors in pppol2tp_getsockopt()
pppol2tp_getsockopt() doesn't take into account the error code returned
by pppol2tp_tunnel_getsockopt() or pppol2tp_session_getsockopt(). If
error occurs there, pppol2tp_getsockopt() continues unconditionally and
reports erroneous values.

Fixes: fd558d186d ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-08 08:29:04 -07:00
Guillaume Nault
364700cf8f l2tp: don't mask errors in pppol2tp_setsockopt()
pppol2tp_setsockopt() unconditionally overwrites the error value
returned by pppol2tp_tunnel_setsockopt() or
pppol2tp_session_setsockopt(), thus hiding errors from userspace.

Fixes: fd558d186d ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-08 08:29:04 -07:00
Yuchung Cheng
cc663f4d4c tcp: restrict F-RTO to work-around broken middle-boxes
The recent extension of F-RTO 89fe18e44 ("tcp: extend F-RTO
to catch more spurious timeouts") interacts badly with certain
broken middle-boxes.  These broken boxes modify and falsely raise
the receive window on the ACKs. During a timeout induced recovery,
F-RTO would send new data packets to probe if the timeout is false
or not. Since the receive window is falsely raised, the receiver
would silently drop these F-RTO packets. The recovery would take N
(exponentially backoff) timeouts to repair N packet losses.  A TCP
performance killer.

Due to this unfortunate situation, this patch removes this extension
to revert F-RTO back to the RFC specification.

Fixes: 89fe18e44f ("tcp: extend F-RTO to catch more spurious timeouts")
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-07 11:44:00 -07:00
Xin Long
16cf72bb08 team: call netdev_change_features out of team lock
Commit f6988cb63a ("team: don't call netdev_change_features under
team->lock") fixed the issue calling netdev_change_features under
team->lock for team_compute_features.

But there are still two places where it calls netdev_change_features
under team->lock, team_port_add and team_port_del. It may cause a
dead lock when the slave port with LRO enabled is added.

This patch is to fix this dead lock by moving netdev_change_features
out of team_port_add and team_port_del, and call it after unlocking
the team lock.

Reported-by: Patrick Talbert <ptalbert@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-06 13:56:49 -07:00
Xin Long
34b2789f1d sctp: listen on the sock only when it's state is listening or closed
Now sctp doesn't check sock's state before listening on it. It could
even cause changing a sock with any state to become a listening sock
when doing sctp_listen.

This patch is to fix it by checking sock's state in sctp_listen, so
that it will listen on the sock with right state.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-06 13:55:51 -07:00
Oliver Neukum
6c22fce07c usbnet: make sure no NULL pointer is passed through
Coverity reports:

** CID 751368:  Null pointer dereferences  (FORWARD_NULL)
/drivers/net/usb/usbnet.c: 1925 in __usbnet_read_cmd()

________________________________________________________________________________________________________
*** CID 751368:  Null pointer dereferences  (FORWARD_NULL)
/drivers/net/usb/usbnet.c: 1925 in __usbnet_read_cmd()
1919     EXPORT_SYMBOL(usbnet_link_change);
1920
1921     /*-------------------------------------------------------------------------*/
1922     static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
1923                                 u16 value, u16 index, void *data, u16 size)
1924     {
>>>     CID 751368:  Null pointer dereferences  (FORWARD_NULL)
>>>     Assigning: "buf" = "NULL".
1925            void *buf = NULL;
1926            int err = -ENOMEM;
1927
1928            netdev_dbg(dev->net, "usbnet_read_cmd cmd=0x%02x reqtype=%02x"
1929                       " value=0x%04x index=0x%04x size=%d\n",
1930                       cmd, reqtype, value, index, size);

** CID 751370:  Null pointer dereferences  (FORWARD_NULL)
/drivers/net/usb/usbnet.c: 1952 in __usbnet_write_cmd()

________________________________________________________________________________________________________
*** CID 751370:  Null pointer dereferences  (FORWARD_NULL)
/drivers/net/usb/usbnet.c: 1952 in __usbnet_write_cmd()
1946     }
1947
1948     static int __usbnet_write_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
1949                                  u16 value, u16 index, const void *data,
1950                                  u16 size)
1951     {
>>>     CID 751370:  Null pointer dereferences  (FORWARD_NULL)
>>>     Assigning: "buf" = "NULL".
1952            void *buf = NULL;
1953            int err = -ENOMEM;
1954
1955            netdev_dbg(dev->net, "usbnet_write_cmd cmd=0x%02x reqtype=%02x"
1956                       " value=0x%04x index=0x%04x size=%d\n",
1957                       cmd, reqtype, value, index, size);

** CID 1325026:  Null pointer dereferences  (FORWARD_NULL)
/drivers/net/usb/ch9200.c: 143 in control_write()

It is valid to offer commands without a buffer, but then you need a size
of zero. This should actually be checked.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-06 13:17:27 -07:00
WANG Cong
92f9170621 net_sched: check noop_qdisc before qdisc_hash_add()
Dmitry reported a crash when injecting faults in
attach_one_default_qdisc() and dev->qdisc is still
a noop_disc, the check before qdisc_hash_add() fails
to catch it because it tests NULL. We should test
against noop_qdisc since it is the default qdisc
at this point.

Fixes: 59cc1f61f0 ("net: sched: convert qdisc linked list to hashtable")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-06 12:28:39 -07:00
Florian Larysch
a8801799c6 net: ipv4: fix multipath RTM_GETROUTE behavior when iif is given
inet_rtm_getroute synthesizes a skeletal ICMP skb, which is passed to
ip_route_input when iif is given. If a multipath route is present for
the designated destination, ip_multipath_icmp_hash ends up being called,
which uses the source/destination addresses within the skb to calculate
a hash. However, those are not set in the synthetic skb, causing it to
return an arbitrary and incorrect result.

Instead, use UDP, which gets no such special treatment.

Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-06 12:18:56 -07:00
David S. Miller
0e4c0ee580 Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-04-06 11:57:04 -07:00
Linus Torvalds
ea6b1720ce Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:

 1) Reject invalid updates to netfilter expectation policies, from Pablo
    Neira Ayuso.

 2) Fix memory leak in nfnl_cthelper, from Jeffy Chen.

 3) Don't do stupid things if we get a neigh_probe() on a neigh entry
    whose ops lack a solicit method. From Eric Dumazet.

 4) Don't transmit packets in r8152 driver when the carrier is off, from
    Hayes Wang.

 5) Fix ipv6 packet type detection in aquantia driver, from Pavel
    Belous.

 6) Don't write uninitialized data into hw registers in bna driver, from
    Arnd Bergmann.

 7) Fix locking in ping_unhash(), from Eric Dumazet.

 8) Make BPF verifier range checks able to understand certain sequences
    emitted by LLVM, from Alexei Starovoitov.

 9) Fix use after free in ipconfig, from Mark Rutland.

10) Fix refcount leak on force commit in openvswitch, from Jarno
    Rajahalme.

11) Fix various overflow checks in AF_PACKET, from Andrey Konovalov.

12) Fix endianness bug in be2net driver, from Suresh Reddy.

13) Don't forget to wake TX queues when processing a timeout, from
    Grygorii Strashko.

14) ARP header on-stack storage is wrong in flow dissector, from Simon
    Horman.

15) Lost retransmit and reordering SNMP stats in TCP can be
    underreported. From Yuchung Cheng.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (82 commits)
  nfp: fix potential use after free on xdp prog
  tcp: fix reordering SNMP under-counting
  tcp: fix lost retransmit SNMP under-counting
  sctp: get sock from transport in sctp_transport_update_pmtu
  net: ethernet: ti: cpsw: fix race condition during open()
  l2tp: fix PPP pseudo-wire auto-loading
  bnx2x: fix spelling mistake in macros HW_INTERRUT_ASSERT_SET_*
  l2tp: take reference on sessions being dumped
  tcp: minimize false-positives on TCP/GRO check
  sctp: check for dst and pathmtu update in sctp_packet_config
  flow dissector: correct size of storage for ARP
  net: ethernet: ti: cpsw: wake tx queues on ndo_tx_timeout
  l2tp: take a reference on sessions used in genetlink handlers
  l2tp: hold session while sending creation notifications
  l2tp: fix duplicate session creation
  l2tp: ensure session can't get removed during pppol2tp_session_ioctl()
  l2tp: fix race in l2tp_recv_common()
  sctp: use right in and out stream cnt
  bpf: add various verifier test cases for self-tests
  bpf, verifier: fix rejection of unaligned access checks for map_value_adj
  ...
2017-04-05 20:17:38 -07:00
Jakub Kicinski
c383bdd14f nfp: fix potential use after free on xdp prog
We should unregister the net_device first, before we give back
our reference on xdp_prog.  Otherwise xdp_prog may be freed
before .ndo_stop() disabled the datapath.  Found by code inspection.

Fixes: ecd63a0217 ("nfp: add XDP support in the driver")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-05 18:46:40 -07:00
Yuchung Cheng
2d2517ee31 tcp: fix reordering SNMP under-counting
Currently the reordering SNMP counters only increase if a connection
sees a higher degree then it has previously seen. It ignores if the
reordering degree is not greater than the default system threshold.
This significantly under-counts the number of reordering events
and falsely convey that reordering is rare on the network.

This patch properly and faithfully records the number of reordering
events detected by the TCP stack, just like the comment says "this
exciting event is worth to be remembered". Note that even so TCP
still under-estimate the actual reordering events because TCP
requires TS options or certain packet sequences to detect reordering
(i.e. ACKing never-retransmitted sequence in recovery or disordered
 state).

Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-05 18:41:27 -07:00
Yuchung Cheng
ecde8f36f8 tcp: fix lost retransmit SNMP under-counting
The lost retransmit SNMP stat is under-counting retransmission
that uses segment offloading. This patch fixes that so all
retransmission related SNMP counters are consistent.

Fixes: 10d3be5692 ("tcp-tso: do not split TSO packets at retransmit time")
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-05 18:41:27 -07:00
Linus Torvalds
aeb4a57681 - Bug fixes
- Increase buffer size to allow for SPI messages; cros_ec
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABCAAGBQJY5OgnAAoJEFGvii+H/HdhhY0P/jojAc65zjRXhXWH+4EcCTsO
 fRoH3PsXsFylag89ytRLbeRnFumk/P51iVVig6groLh7qFcu/3zZmk3jtjojOCka
 yAbfqTTJiV9fkBEKs+hmQQJ+4nTXkPmDuwDePsE6xmrqMq1H6bSK3U5u7Bb8yj4X
 tAZtCIvGQvsJnwhnmjsjTf19UmxtYVjah2oBgDQKNsU8FXiaXmbS9yhSZZd3iv2M
 HowNeBhzNJKGkRYnCgzNlrs9dO4U/fGqRJ7Rh5vuXVNEBmEfMZbgV0svFuQYe1LM
 Ix//WvbPX7XYqYOWl7TwB7xoRb2rpai5NFtmkT6uhTYSV1RT6fNRxXi/sd24ewiq
 s2clJCsPxhds/XZ1u3C+fkMzPnoCdtWojQg6GOxaXk+qrp7XQ9Fg9eG/wqzf/9wl
 lHnsMUksgjUOWHw/WU1nDU4rVgO9j6iMk3L8UTMtAJPtO1r8S8lVDaIFRQMfcIqF
 wmdraxlOuSLm5yne3D1t1BbJMozFQi0CvpVVe1aLtPDuo/EW3SdKr5rtrOAINnEV
 AIQZLhHrpvCpKfAuLu4zr4++dziSoie+oP9H5CHFQ+upabol1u1KWTjH5NlazEvn
 gVjLCTsJXIeOaeVFstgSIWmkHVlwDtEWjAfK+efqUa/6Ivwe4Wxmb6FJR5KJ78tp
 6kzHQvZbss9EwZ+6iU8v
 =p+uD
 -----END PGP SIGNATURE-----

Merge tag 'mfd-fixes-4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd

Pull MFD bug fix from Lee Jones:
 "Increase buffer size om cros-ec to allow for SPI messages"

* tag 'mfd-fixes-4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd:
  mfd: cros-ec: Fix host command buffer size
2017-04-05 09:04:26 -07:00
Linus Torvalds
9f0bffa18c Kbuild fixes for v4.11
- Hand-off primary maintainership of Kbuild
 - Fix build warnings
 - Fix build error when GCOV is enabled with old compiler
 - Fix HAVE_ASM_GOTO check when GCC plugin is enabled
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJY5DVaAAoJED2LAQed4NsGOvYP/2aBSxp8k4s8XphPYXlF2ITE
 MlHWq9nJqlUBqv6Q6fTd8SiVU5LP9kSV54V8jCwBjjPV4ZxWTD0R2XDjdmW/Zzqu
 Fpjs61TScLUmpPDCwK9Q8k/FVHnjkM5H0U/9tsVWSoCUknJ3WqFNf0KcB7HIlWaH
 w5+Twt87e7dlaCbwCseWYsA3i8mkXXrdRFU+qlXHcgmfVnYEYdqjtWOKfESWGet0
 1Nwi0lQXEYb4W+vLczJ6K53BHW5dtL9+jiTZb5aGu3oTSFPFasOjGwdGDH1oVqif
 28ueGnPFzxl2FXzY0GT66/gRBQdtMnt2/vUVG2PUbCqa3MRZkRvFN8IntkmZz1iY
 2cTZ70PjKRyCr9DUw5UQnQweNB9reZlCsEC41xG21c5CLWL0/50iPX17rVAIP2D1
 GMVNWq4AEF4M98ovbyw8FEhz57ZQeVZ+dS0mmnPnL8R/a+SAiQ38ZBS18IqMPbDi
 5qsBvsqL8g5wb6d9cexzZJaFmkN4zBLek1O6EMKVH4FUOYKqR6Z470l7I4+/4UGD
 G9fkIAPGIBJoQ7gJZXQACdrtrhleFMX4JcnPycUsTiCkF86rBqWNjlp9nRPlxUw4
 HdrjwnsHL28G1rprT0Divmtjw074dxEem5PQzSD191IP+PINnXPzCVKhGKUN3uYh
 ykSDv++jHBQNGn+ivUBW
 =ZHIG
 -----END PGP SIGNATURE-----

Merge tag 'kbuild-fixes-v4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

Pull Kbuild fixes from Masahiro Yamada:

 - hand-off primary maintainership of Kbuild

 - fix build warnings

 - fix build error when GCOV is enabled with old compiler

 - fix HAVE_ASM_GOTO check when GCC plugin is enabled

* tag 'kbuild-fixes-v4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
  gconfig: remove misleading parentheses around a condition
  jump label: fix passing kbuild_cflags when checking for asm goto support
  Kbuild: use cc-disable-warning consistently for maybe-uninitialized
  kbuild: external module build warnings when KBUILD_OUTPUT set and W=1
  MAINTAINERS: add Masahiro Yamada as a Kbuild maintainer
2017-04-05 08:37:28 -07:00
Xin Long
3ebfdf0821 sctp: get sock from transport in sctp_transport_update_pmtu
This patch is almost to revert commit 02f3d4ce9e ("sctp: Adjust PMTU
updates to accomodate route invalidation."). As t->asoc can't be NULL
in sctp_transport_update_pmtu, it could get sk from asoc, and no need
to pass sk into that function.

It is also to remove some duplicated codes from that function.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-05 07:20:06 -07:00
Vic Yang
b2376407f9 mfd: cros-ec: Fix host command buffer size
For SPI, we can get up to 32 additional bytes for response preamble.
The current overhead (2 bytes) may cause problems when we try to receive
a big response. Update it to 32 bytes.

Without this fix we could see a kernel BUG when we receive a big response
from the Chrome EC when is connected via SPI.

Signed-off-by: Vic Yang <victoryang@google.com>
Tested-by: Enric Balletbo i Serra <enric.balletbo.collabora.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2017-04-05 13:30:07 +01:00
Linus Torvalds
308ac75639 Late GPIO fixes for v4.11:
We're dealing with ACPI issues here. The first is related to
 wake IRQs on Bay Trail/Cherry Trail CPUs which are common in
 laptops. The second is about proper probe deferral when reading
 _CRS properties.
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJY44fCAAoJEEEQszewGV1z+wkP/0ySyMBUDBlnIdUHjkqXV+Up
 p9KuNp8Z3VR/Zh+dN9I3RjNj0ParbkaD1sUuQLgowwMCuz+j/VdNlrStvHJjGJi2
 Zf2kV6d0CHnnLo0RnsDpQgIvqFgDawMG7a9nDrRQXVso68Yzh6Pdm+JMkvNZ8C6j
 RTPcPYh7WqYyiC1Y8OnuBTwVPyLOW/608PDYqrU4V76W+h1YYP9xLcEbDC+ORcj6
 BJLoqA1k0csC+ySNCY6ft77O7ItLapppmQqbbktO853Epmhe3PHZ9ZEjxbgpbUg4
 IBAsyIZnyayGxeowtmZZnJzSdGSpI2mzxTZPy9AQTBkWZ4Kp3hbOIjri9/UBtAu8
 amvcwTeYUFE+tm7tjm1RyKVLQgWdVfxX5UCxtderBUK5Ja106QrtwzaeJiCXM7Cj
 RbPYUftn0k9r3DU9HO1eGQ2sX5bFzWDcQjzSaftnP6G8BpIffAxj5MxSJmsgkO4Z
 yYy0+Qo42RUsUy9gTjMbKHT8/7get+iuBPtATUrtfPMfvUCM1jrvbpvQ8L+y3Wo2
 9ne1rqltZ4scBtm1ZEg8i5Ib9oF9nH3xdGr4tfjrcDmxKUza4uq2D3dPMsytlAH/
 l8vZM/bhv9ryc8qnqKsMPDDeOPmDpZ3cpioC7Xvo/0thplvI2jxOgVxpyoYmzC2c
 wcGMusEBFfeJZQDn6ArH
 =DTy3
 -----END PGP SIGNATURE-----

Merge tag 'gpio-v4.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio

Pull late GPIO fixes from Linus Walleij:
 "Some late coming ACPI fixes for GPIO.

  We're dealing with ACPI issues here. The first is related to wake IRQs
  on Bay Trail/Cherry Trail CPUs which are common in laptops. The second
  is about proper probe deferral when reading _CRS properties.

  For my untrained eye it seems there was some quarrel between the BIOS
  and the kernel about who is supposed to deal with wakeups from GPIO
  lines"

* tag 'gpio-v4.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  ACPI / gpio: do not fall back to parsing _CRS when we get a deferral
  gpio: acpi: Call enable_irq_wake for _IAE GpioInts with Wake set
2017-04-04 11:40:20 -07:00
David S. Miller
e90be21b1c wireless-drivers fixes for 4.11
iwlwifi
 
 * an RCU fix
 * a fix for a potential out-of-bounds access crash
 * a fix for IBSS which has been broken since DQA was enabled
 
 rtlwifi
 
 * fix scheduling while atomic regression
 
 brcmfmac
 
 * fix use-after-free bug found by KASAN
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJY4ivhAAoJEG4XJFUm622bnNQIAId7kE+dQjX/VRRCfZl5679K
 pkcooXgqCBODA03phCCa9pDGx8O2JPoPJzDgqthHJcpD03nmp8TbiCfuZY6VT2HK
 ohwydmwh2y614V7XrLmEJ6MRl06R2ihXZRMaasPf7LIydXHYo3JFU60XOTNRKrmE
 bDvukcNeKB6s/YuMBf4247qi6mpHuWMeTBVdzUo3Ht06JH6AK2F9M81IS2AiXojY
 lAQWWBBrQT6B7fiVMw4+wRux4Mirkzy/7WJIeFS5oGPFj4ha3gGQhddVHAj8Z9hA
 zQKQxojNLj89tFKqXV3JvDQe20/bNGN81ushkkcy4l8pPtHoJylD3ladPbiXMH8=
 =vv5x
 -----END PGP SIGNATURE-----

Merge tag 'wireless-drivers-for-davem-2017-04-03' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers

Kalle Valo says:

====================
wireless-drivers fixes for 4.11

iwlwifi

* an RCU fix
* a fix for a potential out-of-bounds access crash
* a fix for IBSS which has been broken since DQA was enabled

rtlwifi

* fix scheduling while atomic regression

brcmfmac

* fix use-after-free bug found by KASAN
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-04 11:36:54 -07:00
Linus Torvalds
b824a957bf nios2 fix for v4.11
- nios2: reserve boot memory for device tree
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJY4p2VAAoJEFWoEK+e3syCoJYQAJE+airaXB1vqhdjiLxPk8yI
 1RoiLyZ5GUxDEUsQDVE1M1E4UGrKuko8TmPnLpR2AswYSCVQIUpsrGqJLXHnoYCE
 mmC4ONOTBOvptIvrMgxmzjxmhSr5sctf+o5P7RqptTdWuS4Uas9lTlrpjr9PbdRn
 qAi3H7ziTyBFiH+/TtU5s5mXv2cBi1cTCEG98xWPI0y5g3PUNp5XwpDQwKzjq8qb
 cJVQvf7/Dnj+opS5KlWuIY+sKRaLz21f8YKLbf6xpB5mH0ohdmxgfoUS607IIOVK
 3Nc2J7ZPTPOK4c3TnR0M57LIxtk1SonAaW+FF8a4q0XnokuqgVjB3m6nV1UDFp7b
 DUZKK9Rme/2/AlydX9rYxIwLNwlLyyzdN302C1InFcH71TCsCsNraxFXySkFHu0o
 aGJA6zsbEeXOsFAf4dHY3mtSwHTB7KsnZAMO15snvqFBhs/lemmznWSHCtRSiFj6
 cnCk6vkAbVMhkYTaKSB0S2kmaJ9ONdFjazqBsY1FSiFvutXqN8Wsv/BS9Hf2n/AT
 Bqgrzkt/SH0aGKvOXnUu9Bu4YdXeYg3kcxQ8VqflBwF8Uts6Fnnth91aHKs+2ORP
 E/h72N7I9GuF44ymXjSpZuKamFd/OTTMkdfigOKwP8ZW8/qNxMVBcieGY4pzAu1V
 2jrC4QnmIvtguV5Nzqo6
 =E/bW
 -----END PGP SIGNATURE-----

Merge tag 'nios2-v4.11-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2

Pull nios2 fix from Ley Foon Tan:

 - nios2: reserve boot memory for device tree

* tag 'nios2-v4.11-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2:
  nios2: reserve boot memory for device tree
2017-04-04 11:16:52 -07:00
Sekhar Nori
30c57f0734 net: ethernet: ti: cpsw: fix race condition during open()
TI's cpsw driver handles both OF and non-OF case for phy
connect. Unfortunately of_phy_connect() returns NULL on
error while phy_connect() returns ERR_PTR().

To handle this, cpsw_slave_open() overrides the return value
from phy_connect() to make it NULL or error.

This leaves a small window, where cpsw_adjust_link() may be
invoked for a slave while slave->phy pointer is temporarily
set to -ENODEV (or some other error) before it is finally set
to NULL.

_cpsw_adjust_link() only handles the NULL case, and an oops
results when ERR_PTR() is seen by it.

Note that cpsw_adjust_link() checks PHY status for each
slave whenever it is invoked. It can so happen that even
though phy_connect() for a given slave returns error,
_cpsw_adjust_link() is still called for that slave because
the link status of another slave changed.

Fix this by using a temporary pointer to store return value
of {of_}phy_connect() and do a one-time write to slave->phy.

Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Reported-by: Yan Liu <yan-liu@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-04 10:33:33 -07:00
Linus Torvalds
1a589c0443 vmwgfx and msm fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJY4xUcAAoJEAx081l5xIa+WJAP/iYhjkhcP3tRN/u+oCRKuAjw
 EmhR6AAAmF2kqbZa30e2DCDvrB5UODxRSnIWGq7FUfwB8nWW366opU18hzwdepUJ
 sCWqwtj6ZhFP4P5LZUQcjQseXmwcDnmsnY59mWKWqYDOM+5rvprN1sSBRs2Z2TfZ
 ZwBQt0AdmxkxVOarEgF3ZFCZ3cweRPvFH3WjhYvLTkWtVqoMQtKwJfkL9F8qk/QR
 +137vIOzVDM9NVu10+D2nTISGQKnwqPGkvYWpnsVbLR/AFtfkSS2NXiiP5yROwXK
 qdaQzf1jPTLGbhMlQfahajrzncxMxVm3dNcyG9D/DWqdv24cUKaT4/OsJnS7T2YW
 B1rEl12A5wsAjyOgafU6J8nCXnSdJ4VXnlI5igJCNIIuZc9DoDStpc4/7va3gyHA
 QaC7zGh1QKBQbl9sTwwinl1xuTIbROCRv+1snD07pO2KCc6Y+F7Fks31lqrucwk4
 bBGlyoPN21IJLyfzHGz9hwuKvuAtMxWgGG+GAFCzxKwjocFSktPetsPmnLKlxcdt
 DhBIWELzQ9lyzLeNeyQIFpMwLX3CxkfGa2+2xpnI8NMNVuzsTtju/20U+YHOJZwK
 C5gJRFRHlG+F2fx09cRKW1Lp37S9yN/2IDHKmkdS0JhAErBlJhMv1dRXTZXk1wNK
 z3fSS7NdMMZRVXddx5mn
 =pqDR
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-for-v4.11-rc6' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:
 "This is just mostly stuff that missed rc5, from vmwgfx and msm
  drivers"

* tag 'drm-fixes-for-v4.11-rc6' of git://people.freedesktop.org/~airlied/linux:
  drm/msm: Make sure to detach the MMU during GPU cleanup
  drm/msm/hdmi: redefinitions of macros not required
  drm/msm/mdp5: Update SSPP_MAX value
  drm/msm/dsi: Fix bug in dsi_mgr_phy_enable
  drm/msm: Don't allow zero sized buffer objects
  drm/msm: Fix wrong pointer check in a5xx_destroy
  drm/msm: adreno: fix build error without debugfs
  drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
  drm/vmwgfx: Remove getparam error message
  drm/ttm: Avoid calling drm_ht_remove from atomic context
  drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
  drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()
  drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()
  drm/vmwgfx: Type-check lookups of fence objects
2017-04-04 10:12:15 -07:00
Guillaume Nault
249ee819e2 l2tp: fix PPP pseudo-wire auto-loading
PPP pseudo-wire type is 7 (11 is L2TP_PWTYPE_IP).

Fixes: f1f39f9110 ("l2tp: auto load type modules")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-04 10:08:42 -07:00
Colin Ian King
a8919661d7 bnx2x: fix spelling mistake in macros HW_INTERRUT_ASSERT_SET_*
Trival fix, rename HW_INTERRUT_ASSERT_SET_* to HW_INTERRUPT_ASSERT_SET_*

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Yuval Mintz <Yuval.Mintz@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-04 10:04:49 -07:00
Guillaume Nault
e08293a4cc l2tp: take reference on sessions being dumped
Take a reference on the sessions returned by l2tp_session_find_nth()
(and rename it l2tp_session_get_nth() to reflect this change), so that
caller is assured that the session isn't going to disappear while
processing it.

For procfs and debugfs handlers, the session is held in the .start()
callback and dropped in .show(). Given that pppol2tp_seq_session_show()
dereferences the associated PPPoL2TP socket and that
l2tp_dfs_seq_session_show() might call pppol2tp_show(), we also need to
call the session's .ref() callback to prevent the socket from going
away from under us.

Fixes: fd558d186d ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Fixes: 0ad6614048 ("l2tp: Add debugfs files for dumping l2tp debug info")
Fixes: 309795f4be ("l2tp: Add netlink control API for L2TP")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-04 10:00:56 -07:00
Geert Uytterhoeven
ca257b9e2d can: rcar_can: Do not print virtual addresses
During probe, the rcar_can driver prints:

    rcar_can e6e80000.can: device registered (regs @ e08bc000, IRQ76)

The "regs" value is a virtual address, exposing internal information,
hence stop printing it.  The (useful) physical address is already
printed as part of the device name.

Fixes: fd1159318e ("can: add Renesas R-Car CAN driver")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2017-04-04 17:49:59 +02:00
Markus Marb
57c1d4c33e can: ifi: use correct register to read rx status
The incorrect offset was used when trying to read the RXSTCMD register.

Signed-off-by: Markus Marb <markus@marb.org>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2017-04-04 17:48:22 +02:00
Marcelo Ricardo Leitner
0b9aefea86 tcp: minimize false-positives on TCP/GRO check
Markus Trippelsdorf reported that after commit dcb17d22e1 ("tcp: warn
on bogus MSS and try to amend it") the kernel started logging the
warning for a NIC driver that doesn't even support GRO.

It was diagnosed that it was possibly caused on connections that were
using TCP Timestamps but some packets lacked the Timestamps option. As
we reduce rcv_mss when timestamps are used, the lack of them would cause
the packets to be bigger than expected, although this is a valid case.

As this warning is more as a hint, getting a clean-cut on the
threshold is probably not worth the execution time spent on it. This
patch thus alleviates the false-positives with 2 quick checks: by
accounting for the entire TCP option space and also checking against the
interface MTU if it's available.

These changes, specially the MTU one, might mask some real positives,
though if they are really happening, it's possible that sooner or later
it will be triggered anyway.

Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-03 18:43:41 -07:00
Linus Torvalds
08e4e0d045 Xtensa fixes for 4.11-rc6
- make __pa work with uncached KSEG addresses, it fixes DMA memory
   mmapping and DMA debug;
 - fix torn stack dump output;
 - wire up statx syscall.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJY4tpmAAoJEFH5zJH4P6BECVsP/0VW0w0rwPS22zy0hRHQP3BQ
 QEUDK7H9X1e8DWV4rEC47mSg4IYAJD8CTGsbsMHrBLm7krgbj4WZnkcuAuW+keH9
 pjgY2jhn0a84MHIk/ubtya/L0HfjmDfEm41VAWg0uqVg+NspENxgdGJSq88eCEU7
 up3KiM2/pBrgNiCejo6Nm8+Ct/fNMY0sgPAd83SoPdlMZY22K97NqBobdkoF43kR
 KH7BqAncSIBjUnYEtxlLjqs83GVnAwDBffVObL8JEHrodV6Mmbuut3rS4buCr2xW
 MZUfyWYQOuPRWLGhPZ49tFFfHakkfoOg3jLteU7FyOvX/tIPGh9jLA86ZIm7Eu+H
 RuAdhr6gTvQfuHx+XSguANKaRG67mkPICNusGUd5/prdIU65StQYzxh+lzkCP4SE
 UDlzbwLz9/9wiC/m6k+8outytcv89WqUtWq4l3sTc0X6SUIiMna2EDYLwV9aGELQ
 Gj/3AGMSAdUsJksUBFmLJ+eT4o7ujzsonZO0aMh3IpnhnnlCbV3x/4QlVLlAyjRJ
 Dp7v+++/iMkeczqtMka8ijfuOxjS0T55e4XyTfaHODYv2ai76G0K7wfu6TTwQDf6
 4BKBxxg/SKYkOwbBAcCvQzhX7AJ18hkZaXioDuRT+7uK+ljyUMfFvF8e44yL0RVl
 AeVWbXAXBwpw6PZOEnRo
 =lq7n
 -----END PGP SIGNATURE-----

Merge tag 'xtensa-20170403' of git://github.com/jcmvbkbc/linux-xtensa

Pull Xtensa fixes from Max Filippov:

 - make __pa work with uncached KSEG addresses, it fixes DMA memory
   mmapping and DMA debug

 - fix torn stack dump output

 - wire up statx syscall

* tag 'xtensa-20170403' of git://github.com/jcmvbkbc/linux-xtensa:
  xtensa: wire up statx system call
  xtensa: fix stack dump output
  xtensa: make __pa work with uncached KSEG addresses
2017-04-03 17:56:32 -07:00
Dave Airlie
130e35e4bb Merge branch 'msm-fixes-4.11-rc6' of git://people.freedesktop.org/~robclark/linux into drm-fixes
misc msm fixes.

* 'msm-fixes-4.11-rc6' of git://people.freedesktop.org/~robclark/linux:
  drm/msm: Make sure to detach the MMU during GPU cleanup
  drm/msm/hdmi: redefinitions of macros not required
  drm/msm/mdp5: Update SSPP_MAX value
  drm/msm/dsi: Fix bug in dsi_mgr_phy_enable
  drm/msm: Don't allow zero sized buffer objects
  drm/msm: Fix wrong pointer check in a5xx_destroy
  drm/msm: adreno: fix build error without debugfs
2017-04-04 10:13:40 +10:00
Xin Long
df2729c323 sctp: check for dst and pathmtu update in sctp_packet_config
This patch is to move sctp_transport_dst_check into sctp_packet_config
from sctp_packet_transmit and add pathmtu check in sctp_packet_config.

With this fix, sctp can update dst or pathmtu before appending chunks,
which can void dropping packets in sctp_packet_transmit when dst is
obsolete or dst's mtu is changed.

This patch is also to improve some other codes in sctp_packet_config.
It updates packet max_size with gso_max_size, checks for dst and
pathmtu, and appends ecne chunk only when packet is empty and asoc
is not NULL.

It makes sctp flush work better, as we only need to set up them once
for one flush schedule. It's also safe, since asoc is NULL only when
the packet is created by sctp_ootb_pkt_new in which it just gets the
new dst, no need to do more things for it other than set packet with
transport's pathmtu.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-03 14:54:33 -07:00
Simon Horman
ac6a3722fe flow dissector: correct size of storage for ARP
The last argument to __skb_header_pointer() should be a buffer large
enough to store struct arphdr. This can be a pointer to a struct arphdr
structure. The code was previously using a pointer to a pointer to
struct arphdr.

By my counting the storage available both before and after is 8 bytes on
x86_64.

Fixes: 55733350e5 ("flow disector: ARP support")
Reported-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Signed-off-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-03 14:46:45 -07:00
Jordan Crouse
028402d4bc drm/msm: Make sure to detach the MMU during GPU cleanup
We should be detaching the MMU before destroying the address
space. To do this cleanly, the detach has to happen in
adreno_gpu_cleanup() because it needs access to structs
in adreno_gpu.c.  Plus it is better symmetry to have
the attach and detach at the same code level.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-04-03 16:09:37 -04:00
Vinay Simha BN
d322a693f5 drm/msm/hdmi: redefinitions of macros not required
4 macros already defined in hdmi.h,
which is not required to redefine in hdmi_audio.c

Signed-off-by: Vinay Simha BN <simhavcs@gmail.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-04-03 16:09:36 -04:00
Archit Taneja
30512040ed drm/msm/mdp5: Update SSPP_MAX value
'SSPP_MAX + 1' is the max number of hwpipes that can be present on a
MDP5 platform. Recently, 2 new cursor hwpipes were added, which
caused overflows in arrays that used SSPP_MAX to represent the number
of elements. Update the SSPP_MAX value to incorporate the extra
hwpipes.

Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-04-03 16:09:36 -04:00
Archit Taneja
a5fef535c5 drm/msm/dsi: Fix bug in dsi_mgr_phy_enable
A recent commit introduces a bug in dsi_mgr_phy_enable. In the non
dual DSI mode, we reset the mdsi (master DSI) PHY. This isn't right
since master and slave DSI exist only in dual DSI mode. For the normal
mode of operation, we should simply reset the PHY of the DSI device
(i.e. msm_dsi) corresponding to the current bridge.

Usage of the wrong DSI pointer also resulted in a static checker
warning. That too is resolved with this fix.

Fixes: b62aa70a98 (drm/msm/dsi: Move PHY operations out of host)

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-04-03 16:09:35 -04:00
Jordan Crouse
1a5dff5d74 drm/msm: Don't allow zero sized buffer objects
Zero sized buffer objects tend to make various bits of the GEM
infrastructure complain:

 WARNING: CPU: 1 PID: 2323 at drivers/gpu/drm/drm_mm.c:389 drm_mm_insert_node_generic+0x258/0x2f0
 Modules linked in:

 CPU: 1 PID: 2323 Comm: drm-api-test Tainted: G        W 4.9.0-rc4-00906-g693af44 #213
 Hardware name: Qualcomm Technologies, Inc. DB820c (DT)
 task: ffff8000d7353400 task.stack: ffff8000d7720000
 PC is at drm_mm_insert_node_generic+0x258/0x2f0
 LR is at drm_vma_offset_add+0x4c/0x70

Zero sized buffers serve no appreciable value to the user so disallow
them at create time.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-04-03 16:09:35 -04:00
Jordan Crouse
f456d348b6 drm/msm: Fix wrong pointer check in a5xx_destroy
Instead of checking for a5xx_gpu->gpmu_iova during destroy we
accidently check a5xx_gpu->gpmu_bo.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-04-03 16:09:34 -04:00
Arnd Bergmann
280489daa6 drm/msm: adreno: fix build error without debugfs
The newly added a5xx support fails to build when debugfs is diabled:

drivers/gpu/drm/msm/adreno/a5xx_gpu.c:849:4: error: 'struct msm_gpu_funcs' has no member named 'show'
drivers/gpu/drm/msm/adreno/a5xx_gpu.c:849:11: error: 'a5xx_show' undeclared here (not in a function); did you mean 'a5xx_irq'?

This adds a missing #ifdef.

Fixes: b5f103ab98 ("drm/msm: gpu: Add A5XX target support")
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-04-03 16:09:34 -04:00
Dave Airlie
84c4ba54f4 Merge branch 'vmwgfx-fixes-4.11' of git://people.freedesktop.org/~thomash/linux into drm-fixes
Set of vmwgfx fixes
* 'vmwgfx-fixes-4.11' of git://people.freedesktop.org/~thomash/linux:
  drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
  drm/vmwgfx: Remove getparam error message
  drm/ttm: Avoid calling drm_ht_remove from atomic context
  drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
  drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()
  drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()
  drm/vmwgfx: Type-check lookups of fence objects
2017-04-04 05:45:27 +10:00
Linus Torvalds
4ad72555b8 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Martin Schwidefsky:
 "Four bug fixes, two of them for stable:

   - avoid initrd corruptions in the kernel decompressor

   - prevent inconsistent dumps if the boot CPU does not have address
     zero

   - fix the new pkey interface added with the merge window for 4.11

   - a fix for a fix, another issue with user copy zero padding"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/uaccess: get_user() should zero on failure (again)
  s390/pkey: Fix wrong handling of secure key with old MKVP
  s390/smp: fix ipl from cpu with non-zero address
  s390/decompressor: fix initrd corruption caused by bss clear
2017-04-03 08:44:43 -07:00
Linus Torvalds
3ccfcdc9ef Merge branch 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull RAS fix from Thomas Gleixner:
 "Prevent dmesg from being spammed when MCE logging is active"

* 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/mce: Don't print MCEs when mcelog is active
2017-04-03 08:36:24 -07:00
Tobias Klauser
921d701e6f nios2: reserve boot memory for device tree
Make sure to reserve the boot memory for the flattened device tree.
Otherwise it might get overwritten, e.g. when initial_boot_params is
copied, leading to a corrupted FDT and a boot hang/crash:

  bootconsole [early0] enabled
  Early console on uart16650 initialized at 0xf8001600
  OF: fdt: Error -11 processing FDT
  Kernel panic - not syncing: setup_cpuinfo: No CPU found in devicetree!

  ---[ end Kernel panic - not syncing: setup_cpuinfo: No CPU found in devicetree!

Guenter Roeck says:

> I think I found the problem. In unflatten_and_copy_device_tree(), with added
> debug information:
>
> OF: fdt: initial_boot_params=c861e400, dt=c861f000 size=28874 (0x70ca)
>
> ... and then initial_boot_params is copied to dt, which results in corrupted
> fdt since the memory overlaps. Looks like the initial_boot_params memory
> is not reserved and (re-)allocated by early_init_dt_alloc_memory_arch().

Cc: stable@vger.kernel.org
Reported-by: Guenter Roeck <linux@roeck-us.net>
Reference: http://lkml.kernel.org/r/20170226210338.GA19476@roeck-us.net
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Acked-by: Ley Foon Tan <ley.foon.tan@intel.com>
2017-04-02 20:13:57 -07:00
Grygorii Strashko
75514b6654 net: ethernet: ti: cpsw: wake tx queues on ndo_tx_timeout
In case, if TX watchdog is fired some or all netdev TX queues will be
stopped and as part of recovery it is required not only to drain and
reinitailize CPSW TX channeles, but also wake up stoppted TX queues what
doesn't happen now and netdevice will stop transmiting data until
reopenned.

Hence, add netif_tx_wake_all_queues() call in .ndo_tx_timeout() to complete
recovery and restore TX path.

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-02 19:42:44 -07:00
Linus Torvalds
a71c9a1c77 Linux 4.11-rc5 2017-04-02 17:23:54 -07:00
Linus Torvalds
f49237bfcd dmaengine fixes for 4.11-rc5
Couple of minor fixes for 4.11
  - array bound fix for __get_unmap_pool()
  - cyclic period splitting for bcm2835
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJY4L1bAAoJEHwUBw8lI4NHoI4P/j+t5ZiMd9LgBaEWrkQRJd0j
 RiTD2ub93XRaMGCCTG9mpKy6QJ18T2Hma8e73sW6+kxG0KPP7JldvK395cO9pTgb
 R0CktSA72HPlUyy+OSg5OeB9T3pdcOfwv/RuD1g4TfEyknGVTWXKd4u/v5Lupn/y
 UTWIhsd/0VlIIIEKlaoelG0UsK92rqAc3dnjdVzx102XuZZYBStZxP7j7Jnuep4y
 O4BNLq64/og5X8VvSGjvzkzV83X+JFxPLk1sVrcmChzttOjKWRZkTssiR6DH5qni
 pz7WI3fxDFgJJwLSejAfhHo+wOwaezytymlVmfViAfDQLgDG8hrt/if1meBffrg6
 VpumHcgKiDfPanji1fauC2DK9QFZZ0NuT0DXsL07csVFbqRndFp3qIhDGHy00z4k
 r2MrFiGcuA5LEQotha3VKD0Z5HjeOOUKCj9hacZAuCXNUohX8KX6Yietc7oEIWco
 WCodC6vQ3yICPI4bS9dUIkJRkI1qJoB5f5cVcl9NaMybXza/mvyeI7yIOWgoRBvf
 O0bh1j8sxeyYyfsJ8DZ+NI3uBKm5+iMb6VsVWrso+O8+0sH3f+s8wZkemMDWCBMv
 V1kx5ZVKJ+7qw4OLOm6tlom8WGdvYQAQjYoLT0Zh9yXc5CQUfpwk4tZ0WOnsoVIi
 vIJGh6uu3S1rXOTeGXJR
 =bNTJ
 -----END PGP SIGNATURE-----

Merge tag 'dmaengine-fix-4.11-rc5' of git://git.infradead.org/users/vkoul/slave-dma

Pull dmaengine fixes from Vinod Koul:
 "A couple of minor fixes for 4.11:

   - array bound fix for __get_unmap_pool()

   - cyclic period splitting for bcm2835"

* tag 'dmaengine-fix-4.11-rc5' of git://git.infradead.org/users/vkoul/slave-dma:
  dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
  dmaengine: bcm2835: Fix cyclic DMA period splitting
2017-04-02 16:29:34 -07:00