718298 Commits

Author SHA1 Message Date
Linux Build Service Account
76653a0d2c Merge "serial: msm_serial_hs: Remove unwanted header file inclusion" into msm-4.14 2018-04-12 14:29:30 -07:00
Linux Build Service Account
595fe08a42 Merge "ARM: dts: msm: add wil6210 device for sm8150 platforms" into msm-4.14 2018-04-12 14:29:27 -07:00
Linux Build Service Account
4452d7cb12 Merge "ARM: dts: msm: Update IMEM base address for sdm640" into msm-4.14 2018-04-12 14:29:25 -07:00
Linux Build Service Account
091617847d Merge "sched: Fix for 32 bit compilation issue" into msm-4.14 2018-04-12 14:29:22 -07:00
Linux Build Service Account
5b4fa2440f Merge "msm: ipa3: use atomic allocations for setup/teardown pipes" into msm-4.14 2018-04-12 14:29:20 -07:00
Linux Build Service Account
2b465df208 Merge "ARM: dts: msm: coresight: Add spss node for sm8150" into msm-4.14 2018-04-12 14:29:16 -07:00
Linux Build Service Account
03e4fd22e3 Merge "msm: ipa3: Added retry logic if memory allocate fails" into msm-4.14 2018-04-12 14:29:13 -07:00
Linux Build Service Account
f22faadc28 Merge "PM / devfreq: Introduce a sysfs lock" into msm-4.14 2018-04-12 14:29:10 -07:00
Linux Build Service Account
772a81c42c Merge "drivers: qcom: fix compilation errors" into msm-4.14 2018-04-12 14:29:07 -07:00
Chris Lew
647f1771fd rpmsg: glink: Put an extra reference during cleanup
In a remote processor crash scenario, there is no guarantee the remote
processor sent close requests before it went into a bad state. Remove
the reference that is normally handled by the close command in the
so channel resources can be released.

Change-Id: I02980914bfb587990c3277a945193fb89e76c504
Signed-off-by: Chris Lew <clew@codeaurora.org>
2018-04-12 14:11:02 -07:00
Bjorn Andersson
a85b03ba84 rpmsg: Only invoke announce_create for rpdev with endpoints
For special rpmsg devices without a primary endpoint there is nothing to
announce so don't call the backend announce create function if we didn't
create an endpoint.

Change-Id: I42adaa317e408b73061f1c3d392699bec36b193e
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Patch-mainline: linux-arm-msm @ 27/03/2018, 23:07
Signed-off-by: Chris Lew <clew@codeaurora.org>
2018-04-12 14:11:02 -07:00
Sujeev Dias
4fc64a8ee5 trace: ipc_logging: check for existing ipclog ctxt before creating new one
Many ipc logging clients does a complete driver reinitialization during
shutdown or ssr process. However, these clients prefer to continue use
same logging buffer instead of creating a new buffer. So, check if a
ipc logging context already exist, if so return the same context
instead of creating a new one.

CRs-Fixed: 2214790
Change-Id: Ic0508a0dbf2afbdb1c5d7655c7a79a9bfa01f5a2
Signed-off-by: Sujeev Dias <sdias@codeaurora.org>
2018-04-12 14:11:01 -07:00
Chris Lew
234e3fc6d5 defconfig: SM8105: Enable QSEE IPC IRQ bridge
The QSEE IPC IRQ bridge forwards interrupts from QSEE to userspace by
writing to a char device node.

Change-Id: Ib538a19ac8d8d83cf0383bec8bfe3fa899d9a885
Signed-off-by: Chris Lew <clew@codeaurora.org>
2018-04-12 14:11:01 -07:00
Chris Lew
020f4b68be ARM: dts: msm: Add qsee_ipc_irq_bridge nodes for SM8150
The qsee_ipc_irq_bridge bridges interrupt notifications to userspace by
creating a char dev for userspace to poll until an interrupt from QSEE
arrives.

Change-Id: I2b4150428d59ce4edd038de11a59b36f5f78e958
Signed-off-by: Chris Lew <clew@codeaurora.org>
2018-04-12 14:11:00 -07:00
Chris Lew
f2dc86b171 soc: qcom: Add snapshot of qsee_ipc_irq_bridge driver
This snapshot is taken as of msm-4.9 'commit <34e1614ab73d>
("Merge "thermal: qpnp-adc-tm: Add read_status function for non-HC
peripheral"")'.

In addition, update copyright and remove wake properties from the
interrupt since this will be handled by the qsee_ipc_irq driver. Also
change of_get_property to of_property_read_string for names.

Change-Id: I36bbc36b3e87548020fe5a52422a5343d83f81cb
Signed-off-by: Chris Lew <clew@codeaurora.org>
2018-04-12 14:11:00 -07:00
Chris Lew
09ddc60f1f soc: qcom: glink_pkt: Remove incorrect mutex_unlock
When a channel is reset and a client is still reading, glink pkt
executes an error case. Remove the incorrect mutex_unlock in this case.

Change-Id: I2c28dadf327b09eaa55f9853e8bf1f55017c4e51
Signed-off-by: Chris Lew <clew@codeaurora.org>
2018-04-12 13:54:12 -07:00
Chris Lew
aac89833af soc: qcom: qsee_ipc_irq: Fix irq mapping logic
The hw irq number should be determined by using the bank index and
bit offset of the irq status register. Add a macro to quickly get
the hw irq number from this information.

Change-Id: Ic5e3a193a2b0d145c8d4a593fbff5208a10b099a
Signed-off-by: Chris Lew <clew@codeaurora.org>
2018-04-12 13:54:11 -07:00
Maheshwar Ajja
282e2eb407 msm: vidc: fix cvp session close issue
Video driver tries to unregister the buffers which
are not unregistered by the userspace client in
deinitialization. Unregistering the buffers is not
required as the session will be closed anyway. So
simply try session close in msm_cvp_inst_deinit()
to avoid errors due to unregistering buffers.

Change-Id: Id9ae0683498dbbc1451055bf04a7fb7513248391
Signed-off-by: Maheshwar Ajja <majja@codeaurora.org>
2018-04-12 13:26:38 -07:00
Jeevan Shriram
08a67b4bbe ARM: dts: msm: Add CPUSS core hang dt node for sdmshrike
Add device tree nodes to enable and detect if any CPU is hung.

Change-Id: Idd7c2fdcf4886e119800e30f2283cf2f62916b8e
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
2018-04-12 12:41:58 -07:00
Jeevan Shriram
4e1f224dc7 ARM: dts: msm: Add L1 cache definitions to sdmshrike target
Ad L1 I/D cache nodes and cpu dump nodes for sdmshrike target.

Change-Id: I0381321dc83983812b1cb8f4084c23eb482a653e
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
2018-04-12 12:39:48 -07:00
Isaac J. Manjarres
92816ebe29 Merge remote-tracking branch 'remotes/origin/tmp-7e76ead' into msm-4.14
* remotes/origin/tmp-7e76ead:
  Linux 4.14.34
  net/mlx4_core: Fix memory leak while delete slave's resources
  vhost_net: add missing lock nesting notation
  team: move dev_mc_sync after master_upper_dev_link in team_port_add
  route: check sysctl_fib_multipath_use_neigh earlier than hash
  vhost: validate log when IOTLB is enabled
  net/mlx5e: Fix traffic being dropped on VF representor
  net/mlx4_en: Fix mixed PFC and Global pause user control requests
  strparser: Fix sign of err codes
  net/sched: fix NULL dereference on the error path of tcf_skbmod_init()
  net/sched: fix NULL dereference in the error path of tunnel_key_init()
  net/mlx5e: Sync netdev vxlan ports at open
  net/mlx5e: Don't override vport admin link state in switchdev mode
  ipv6: sr: fix seg6 encap performances with TSO enabled
  nfp: use full 40 bits of the NSP buffer address
  net/mlx5e: Fix memory usage issues in offloading TC flows
  net/mlx5e: Avoid using the ipv6 stub in the TC offload neigh update path
  vti6: better validate user provided tunnel names
  ip6_tunnel: better validate user provided tunnel names
  ip6_gre: better validate user provided tunnel names
  ipv6: sit: better validate user provided tunnel names
  ip_tunnel: better validate user provided tunnel names
  net: fool proof dev_valid_name()
  bonding: process the err returned by dev_set_allmulti properly in bond_enslave
  bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
  bonding: fix the err path for dev hwaddr sync in bond_enslave
  vrf: Fix use after free and double free in vrf_finish_output
  vlan: also check phy_driver ts_info for vlan's real device
  vhost: correctly remove wait queue during poll failure
  sky2: Increase D3 delay to sky2 stops working after suspend
  sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
  sctp: do not leak kernel memory to user space
  r8169: fix setting driver_data after register_netdev
  pptp: remove a buggy dst release in pptp_connect()
  net/sched: fix NULL dereference in the error path of tcf_bpf_init()
  net sched actions: fix dumping which requires several messages to user space
  netlink: make sure nladdr has correct size in netlink_connect()
  net/ipv6: Increment OUTxxx counters after netfilter hook
  net/ipv6: Fix route leaking between VRFs
  net: fix possible out-of-bound read in skb_network_protocol()
  lan78xx: Crash in lan78xx_writ_reg (Workqueue: events lan78xx_deferred_multicast_write)
  ipv6: the entire IPv6 header chain must fit the first fragment
  arp: fix arp_filter on l3slave devices
  x86/microcode: Fix CPU synchronization routine
  x86/microcode: Attempt late loading only when new microcode is present
  x86/microcode: Synchronize late microcode loading
  x86/microcode: Request microcode on the BSP
  x86/microcode/intel: Look into the patch cache first
  x86/microcode: Do not upload microcode if CPUs are offline
  x86/microcode/intel: Writeback and invalidate caches before updating microcode
  x86/microcode/intel: Check microcode revision before updating sibling threads
  x86/microcode: Get rid of struct apply_microcode_ctx
  x86/CPU: Check CPU feature bits after microcode upgrade
  x86/CPU: Add a microcode loader callback
  x86/microcode: Propagate return value from updating functions
  crypto: arm64/aes-ce-cipher - move assembler code to .S file
  objtool: Add Clang support
  thermal: int3400_thermal: fix error handling in int3400_thermal_probe()
  tcmu: release blocks for partially setup cmds
  perf tools: Fix copyfile_offset update of output offset
  crypto: aes-generic - build with -Os on gcc-7+
  mtd: mtd_oobtest: Handle bitflips during reads
  Input: goodix - disable IRQs while suspended
  ibmvnic: Don't handle RX interrupts when not up.
  sdhci: Advertise 2.0v supply on SDIO host controller
  x86/gart: Exclude GART aperture from vmcore
  gpio: thunderx: fix error return code in thunderx_gpio_probe()
  RDMA/cma: Fix rdma_cm path querying for RoCE
  scsi: megaraid_sas: unload flag should be set after scsi_remove_host is called
  scsi: megaraid_sas: Error handling for invalid ldcount provided by firmware in RAID map
  cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
  i40evf: don't rely on netif_running() outside rtnl_lock()
  uio_hv_generic: check that host supports monitor page
  EDAC, mv64x60: Fix an error handling path
  block, bfq: put async queues for root bfq groups too
  tty: n_gsm: Allow ADM response in addition to UA for control dlci
  blk-mq: fix kernel oops in blk_mq_tag_idle()
  scsi: libsas: initialize sas_phy status according to response of DISCOVER
  scsi: libsas: fix error when getting phy events
  scsi: libsas: fix memory leak in sas_smp_get_phy_events()
  bcache: segregate flash only volume write streams
  bcache: stop writeback thread after detaching
  bcache: ret IOERR when read meets metadata error
  net: hns3: fix for changing MTU
  net: hns3: Fix an error macro definition of HNS3_TQP_STAT
  net: hns3: Fix a loop index error of tqp statistics query
  net: hns3: Fix an error of total drop packet statistics
  net/mlx5: Fix race for multiple RoCE enable
  wl1251: check return from call to wl1251_acx_arp_ip_filter
  rt2x00: do not pause queue unconditionally on error path
  power: supply: axp288_charger: Properly stop work on probe-error / remove
  ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
  staging: lustre: disable preempt while sampling processor id.
  perf report: Fix a no annotate browser displayed issue
  tpm: return a TPM_RC_COMMAND_CODE response if command is not implemented
  nvme_fcloop: fix abort race condition
  nvme_fcloop: disassocate local port structs
  pinctrl: baytrail: Enable glitch filter for GPIOs used as interrupts
  backlight: tdo24m: Fix the SPI CS between transfers
  blk-mq: fix race between updating nr_hw_queues and switching io sched
  blk-mq: avoid to map CPU into stale hw queue
  IB/rdmavt: Allocate CQ memory on the correct node
  powernv-cpufreq: Add helper to extract pstate from PMSR
  gpio: label descriptors using the device name
  vfb: fix video mode and line_length being set when loaded
  mac80211: Fix setting TX power on monitor interfaces
  ACPI: EC: Fix debugfs_create_*() usage
  irqchip/gic-v3: Fix the driver probe() fail due to disabled GICC entry
  scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
  scsi: libiscsi: Allow sd_shutdown on bad transport
  spi: sh-msiof: Fix timeout failures for TX-only DMA transfers
  ASoC: Intel: cht_bsw_rt5645: Analog Mic support
  ASoC: Intel: Skylake: Disable clock gating during firmware and library download
  media: videobuf2-core: don't go out of the buffer range
  clk: sunxi-ng: a83t: Add M divider to TCON1 clock
  hwmon: (ina2xx) Make calibration register value fixed
  RDMA/cma: Mark end of CMA ID messages
  selftests/net: fix bugs in address and port initialization
  PM / devfreq: Fix potential NULL pointer dereference in governor_store
  clk: divider: fix incorrect usage of container_of
  watchdog: dw_wdt: add stop watchdog operation
  VFS: close race between getcwd() and d_move()
  net/mlx4_en: Change default QoS settings
  ACPI / video: Default lcd_only to true on Win8-ready and newer machines
  rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
  l2tp: fix missing print session offset info
  net: hns3: fix for getting auto-negotiation state in hclge_get_autoneg
  net: hns3: free the ring_data structrue when change tqps
  perf evsel: Enable ignore_missing_thread for pid option
  perf probe: Add warning message if there is unexpected event name
  perf probe: Find versioned symbols from map
  thermal: power_allocator: fix one race condition issue for thermal_instances list
  ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT
  Bluetooth: Add a new 04ca:3015 QCA_ROME device
  ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
  clk: meson: mpll: use 64-bit maths in params_from_rate
  i40iw: Validate correct IRD/ORD connection parameters
  i40iw: Correct Q1/XF object count equation
  i40iw: Fix sequence number for the first partial FPDU
  Revert "ANDROID: sched/tune: Initialize raw_spin_lock in boosted_groups"

Conflicts:
	arch/arm64/crypto/Makefile
	drivers/clk/qcom/clk-regmap-divider.c

Change-Id: I7d83113e6d6d943804051a983d73067184b9fb39
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
2018-04-12 12:24:33 -07:00
Lokesh Batra
64e87bfbdf msm: kgsl: Set primFifo thresholds value for A640
Set the primFifo thresholds field in GPU_PC_DBG_ECO_CNTL register
for A640.

Change-Id: I4c87146fb148da522989376ef9f1488a546f889c
Signed-off-by: Lokesh Batra <lbatra@codeaurora.org>
2018-04-12 11:10:29 -07:00
Jeevan Shriram
8c3a7f09db defconfig: Enable POWEROFF driver on sdmshrike target
Enable poweroff driver on sdmshrike target to support reboot and
entering into download modes.

Change-Id: I3aa636ca871ee5cd42c5f301e7176fb8c640ac75
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
2018-04-12 10:50:35 -07:00
Jeevan Shriram
5d09cb476d ARM: dts: msm: Update interrupt parent and smp2p bits for LPASS
Update interrupt parent and smp2p interrupt bits for LPSS PIL node on
sdmshrike target.

Change-Id: I4c6be6cb8406070645b57a934005bed697b5d425
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
2018-04-12 10:39:16 -07:00
Jeevan Shriram
789a2c1f73 ARM: dts: msm: Add imem,restart and sleep counter for sdmshrike
Add imem, restart and mpm sleep counter device tree nodes for
sdmshrike target.

Change-Id: I33430219cb2183581670f1cd5a75e82c68b41dfa
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
2018-04-12 10:33:59 -07:00
Karthikeyan Mani
ad747fdc14 ARM: dts: msm: Add FSA and REGMAP debugfs configs on sdmshrike
Enable FSA chip driver and debugfs option for REGMAP on
sdmshrike target.

Change-Id: I2db930876ed05cbd3c98c586d0e4000cd7ee0266
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
2018-04-12 10:30:26 -07:00
Isaac J. Manjarres
b0166e2f2f Merge remote-tracking branch 'remotes/origin/tmp-27e69ad' into msm-4.14
* remotes/origin/tmp-27e69ad:
  Linux 4.14.33
  Revert "ip6_vti: adjust vti mtu according to mtu of lower device"
  Revert "cpufreq: Fix governor module removal race"
  Revert "ARM: dts: omap3-n900: Fix the audio CODEC's reset pin"
  Revert "ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin"
  Fix slab name "biovec-(1<<(21-12))"
  net: hns: Fix ethtool private flags
  ARM: dts: DRA76-EVM: Set powerhold property for tps65917
  vt: change SGR 21 to follow the standards
  Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad
  Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list
  Input: ALPS - fix TrackStick detection on Thinkpad L570 and Latitude 7370
  Revert "base: arch_topology: fix section mismatch build warnings"
  staging: comedi: ni_mio_common: ack ai fifo error interrupts.
  Btrfs: fix unexpected cow in run_delalloc_nocow
  crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one
  crypto: arm,arm64 - Fix random regeneration of S_shipped
  crypto: ccp - return an actual key size from RSA max_size callback
  crypto: caam - Fix null dereference at error path
  crypto: ahash - Fix early termination in hash walk
  crypto: testmgr - Fix incorrect values in PKCS#1 test vector
  crypto: inside-secure - fix clock management
  crypto: lrw - Free rctx->ext with kzfree
  parport_pc: Add support for WCH CH382L PCI-E single parallel port card.
  media: usbtv: prevent double free in error case
  /dev/mem: Avoid overwriting "err" in read_mem()
  mei: remove dev_err message on an unsupported ioctl
  serial: 8250: Add Nuvoton NPCM UART
  USB: serial: cp210x: add ELDAT Easywave RX09 id
  USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator
  USB: serial: ftdi_sio: add RT Systems VX-8 cable
  bitmap: fix memset optimization on big-endian systems
  usb: dwc2: Improve gadget state disconnection handling
  Bluetooth: Fix missing encryption refresh on Security Request
  phy: qcom-ufs: add MODULE_LICENSE tag
  netfilter: x_tables: add and use xt_check_proc_name
  netfilter: drop template ct when conntrack is skipped.
  l2tp: fix races with ipv4-mapped ipv6 addresses
  netfilter: bridge: ebt_among: add more missing match size checks
  netfilter: x_tables: make allocation less aggressive
  percpu: add __GFP_NORETRY semantics to the percpu balancing path
  xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems
  net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()
  RDMA/ucma: Introduce safer rdma_addr_size() variants
  RDMA/ucma: Check that device exists prior to accessing it
  RDMA/ucma: Check that device is connected prior to access it
  RDMA/rdma_cm: Fix use after free race with process_one_req
  RDMA/ucma: Ensure that CM_ID exists prior to access it
  RDMA/ucma: Fix use-after-free access in ucma_close
  RDMA/ucma: Check AF family prior resolving address
  xfrm_user: uncoditionally validate esn replay attribute struct
  partitions/msdos: Unable to mount UFS 44bsd partitions
  powerpc/64s: Fix i-side SLB miss bad address handler saving nonvolatile GPRs
  powerpc/64s: Fix lost pending interrupt due to race causing lost update to irq_happened
  i2c: i2c-stm32f7: fix no check on returned setup
  ipc/shm.c: add split function to shm_vm_ops
  ceph: only dirty ITER_IOVEC pages for direct read
  perf/hwbp: Simplify the perf-hwbp code, fix documentation
  x86/platform/uv/BAU: Add APIC idt entry
  ALSA: pcm: potential uninitialized return values
  ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent()
  ALSA: usb-audio: Add native DSD support for TEAC UD-301
  mtd: nand: atmel: Fix get_sectorsize() function
  mtd: jedec_probe: Fix crash in jedec_read_mfr()
  ARM: dts: sun6i: a31s: bpi-m2: add missing regulators
  ARM: dts: sun6i: a31s: bpi-m2: improve pmic properties
  ARM: 8746/1: vfp: Go back to clearing vfp_current_hw_state[]
  ARM: OMAP: Fix SRAM W+X mapping
  ANDROID: fuse: Add null terminator to path in canonical path to avoid issue
  ANDROID: sdcardfs: Fix sdcardfs to stop creating cases-sensitive duplicate entries.

Conflicts:
	drivers/phy/qualcomm/phy-qcom-ufs.c

Change-Id: Iab5cb23d596cebf19e0eb63a71828507dfb47054
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
2018-04-12 09:39:59 -07:00
Greg Kroah-Hartman
7e76ead2d2 This is the 4.14.34 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlrPNhoACgkQONu9yGCS
 aT6BgRAAlQVoTa9PEk/vyJACP/IDnzW/UUhUatTTBcsj8hAOzeF5tpFPvvqG+Aoj
 TfjujeFN8YgqepBKEWdAvUknJtO9Ka+1Q7elBg1A9ygwPXn4XCVV1Cu+Q7w9gmci
 OJd/3ubevqGV0enA9wzxsczhG8ua/8EZiBM5pz8NDXy4nZ7rtxCUs+8npCj23/dJ
 klN70Gv58ClSaI4CUTXejBxm9/EGIrY0+SoS3+M1rj8vV8kgr8uzqDuk/Kv12YL8
 /XVbB6QHPauvJAw9QFaP9xi2M7hZ03YJlo0hHMoPUXyLK2CJ5w/NJmJcKOu+eKx0
 GGn/qQ0C8uAXGFfJjwHNj3MHDgPVayIvE7SMVKRIY8EcSYv9AsL+YDo6KK9WRmuE
 3VLxOFO8Z2vVaVATU3U/m/+lK+kyDqStwwp7IFTbYSb3GpSD8JeruBWcbM2ywPCX
 J+n3DWrvwcvIsS1+URJogiaamo7J6u4upyz9ilym7XovMub5RfjmhIAKBsd3DqEL
 PZ+MLM+TMUq6smSlSFdrSuU+aquhbaKaD/LdXmVlsIjMQOOkQCU8d6mHYfW7jBEP
 6oE/VjXSewMdsrux3C4rKW/TnnXRWNHPY47SqObkqEx1uf2uFPSi5jIKRCBZtNfT
 2nMEfDnW/FBuQVoWvBx01eiSeupNRl0ULbdtdrMS7YMFY8gaVOY=
 =+4X0
 -----END PGP SIGNATURE-----

Merge 4.14.34 into android-4.14

Changes in 4.14.34
	i40iw: Fix sequence number for the first partial FPDU
	i40iw: Correct Q1/XF object count equation
	i40iw: Validate correct IRD/ORD connection parameters
	clk: meson: mpll: use 64-bit maths in params_from_rate
	ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
	Bluetooth: Add a new 04ca:3015 QCA_ROME device
	ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT
	thermal: power_allocator: fix one race condition issue for thermal_instances list
	perf probe: Find versioned symbols from map
	perf probe: Add warning message if there is unexpected event name
	perf evsel: Enable ignore_missing_thread for pid option
	net: hns3: free the ring_data structrue when change tqps
	net: hns3: fix for getting auto-negotiation state in hclge_get_autoneg
	l2tp: fix missing print session offset info
	rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
	ACPI / video: Default lcd_only to true on Win8-ready and newer machines
	net/mlx4_en: Change default QoS settings
	VFS: close race between getcwd() and d_move()
	watchdog: dw_wdt: add stop watchdog operation
	clk: divider: fix incorrect usage of container_of
	PM / devfreq: Fix potential NULL pointer dereference in governor_store
	selftests/net: fix bugs in address and port initialization
	RDMA/cma: Mark end of CMA ID messages
	hwmon: (ina2xx) Make calibration register value fixed
	clk: sunxi-ng: a83t: Add M divider to TCON1 clock
	media: videobuf2-core: don't go out of the buffer range
	ASoC: Intel: Skylake: Disable clock gating during firmware and library download
	ASoC: Intel: cht_bsw_rt5645: Analog Mic support
	spi: sh-msiof: Fix timeout failures for TX-only DMA transfers
	scsi: libiscsi: Allow sd_shutdown on bad transport
	scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
	irqchip/gic-v3: Fix the driver probe() fail due to disabled GICC entry
	ACPI: EC: Fix debugfs_create_*() usage
	mac80211: Fix setting TX power on monitor interfaces
	vfb: fix video mode and line_length being set when loaded
	gpio: label descriptors using the device name
	powernv-cpufreq: Add helper to extract pstate from PMSR
	IB/rdmavt: Allocate CQ memory on the correct node
	blk-mq: avoid to map CPU into stale hw queue
	blk-mq: fix race between updating nr_hw_queues and switching io sched
	backlight: tdo24m: Fix the SPI CS between transfers
	pinctrl: baytrail: Enable glitch filter for GPIOs used as interrupts
	nvme_fcloop: disassocate local port structs
	nvme_fcloop: fix abort race condition
	tpm: return a TPM_RC_COMMAND_CODE response if command is not implemented
	perf report: Fix a no annotate browser displayed issue
	staging: lustre: disable preempt while sampling processor id.
	ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
	power: supply: axp288_charger: Properly stop work on probe-error / remove
	rt2x00: do not pause queue unconditionally on error path
	wl1251: check return from call to wl1251_acx_arp_ip_filter
	net/mlx5: Fix race for multiple RoCE enable
	net: hns3: Fix an error of total drop packet statistics
	net: hns3: Fix a loop index error of tqp statistics query
	net: hns3: Fix an error macro definition of HNS3_TQP_STAT
	net: hns3: fix for changing MTU
	bcache: ret IOERR when read meets metadata error
	bcache: stop writeback thread after detaching
	bcache: segregate flash only volume write streams
	scsi: libsas: fix memory leak in sas_smp_get_phy_events()
	scsi: libsas: fix error when getting phy events
	scsi: libsas: initialize sas_phy status according to response of DISCOVER
	blk-mq: fix kernel oops in blk_mq_tag_idle()
	tty: n_gsm: Allow ADM response in addition to UA for control dlci
	block, bfq: put async queues for root bfq groups too
	EDAC, mv64x60: Fix an error handling path
	uio_hv_generic: check that host supports monitor page
	i40evf: don't rely on netif_running() outside rtnl_lock()
	cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
	scsi: megaraid_sas: Error handling for invalid ldcount provided by firmware in RAID map
	scsi: megaraid_sas: unload flag should be set after scsi_remove_host is called
	RDMA/cma: Fix rdma_cm path querying for RoCE
	gpio: thunderx: fix error return code in thunderx_gpio_probe()
	x86/gart: Exclude GART aperture from vmcore
	sdhci: Advertise 2.0v supply on SDIO host controller
	ibmvnic: Don't handle RX interrupts when not up.
	Input: goodix - disable IRQs while suspended
	mtd: mtd_oobtest: Handle bitflips during reads
	crypto: aes-generic - build with -Os on gcc-7+
	perf tools: Fix copyfile_offset update of output offset
	tcmu: release blocks for partially setup cmds
	thermal: int3400_thermal: fix error handling in int3400_thermal_probe()
	objtool: Add Clang support
	crypto: arm64/aes-ce-cipher - move assembler code to .S file
	x86/microcode: Propagate return value from updating functions
	x86/CPU: Add a microcode loader callback
	x86/CPU: Check CPU feature bits after microcode upgrade
	x86/microcode: Get rid of struct apply_microcode_ctx
	x86/microcode/intel: Check microcode revision before updating sibling threads
	x86/microcode/intel: Writeback and invalidate caches before updating microcode
	x86/microcode: Do not upload microcode if CPUs are offline
	x86/microcode/intel: Look into the patch cache first
	x86/microcode: Request microcode on the BSP
	x86/microcode: Synchronize late microcode loading
	x86/microcode: Attempt late loading only when new microcode is present
	x86/microcode: Fix CPU synchronization routine
	arp: fix arp_filter on l3slave devices
	ipv6: the entire IPv6 header chain must fit the first fragment
	lan78xx: Crash in lan78xx_writ_reg (Workqueue: events lan78xx_deferred_multicast_write)
	net: fix possible out-of-bound read in skb_network_protocol()
	net/ipv6: Fix route leaking between VRFs
	net/ipv6: Increment OUTxxx counters after netfilter hook
	netlink: make sure nladdr has correct size in netlink_connect()
	net sched actions: fix dumping which requires several messages to user space
	net/sched: fix NULL dereference in the error path of tcf_bpf_init()
	pptp: remove a buggy dst release in pptp_connect()
	r8169: fix setting driver_data after register_netdev
	sctp: do not leak kernel memory to user space
	sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
	sky2: Increase D3 delay to sky2 stops working after suspend
	vhost: correctly remove wait queue during poll failure
	vlan: also check phy_driver ts_info for vlan's real device
	vrf: Fix use after free and double free in vrf_finish_output
	bonding: fix the err path for dev hwaddr sync in bond_enslave
	bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
	bonding: process the err returned by dev_set_allmulti properly in bond_enslave
	net: fool proof dev_valid_name()
	ip_tunnel: better validate user provided tunnel names
	ipv6: sit: better validate user provided tunnel names
	ip6_gre: better validate user provided tunnel names
	ip6_tunnel: better validate user provided tunnel names
	vti6: better validate user provided tunnel names
	net/mlx5e: Avoid using the ipv6 stub in the TC offload neigh update path
	net/mlx5e: Fix memory usage issues in offloading TC flows
	nfp: use full 40 bits of the NSP buffer address
	ipv6: sr: fix seg6 encap performances with TSO enabled
	net/mlx5e: Don't override vport admin link state in switchdev mode
	net/mlx5e: Sync netdev vxlan ports at open
	net/sched: fix NULL dereference in the error path of tunnel_key_init()
	net/sched: fix NULL dereference on the error path of tcf_skbmod_init()
	strparser: Fix sign of err codes
	net/mlx4_en: Fix mixed PFC and Global pause user control requests
	net/mlx5e: Fix traffic being dropped on VF representor
	vhost: validate log when IOTLB is enabled
	route: check sysctl_fib_multipath_use_neigh earlier than hash
	team: move dev_mc_sync after master_upper_dev_link in team_port_add
	vhost_net: add missing lock nesting notation
	net/mlx4_core: Fix memory leak while delete slave's resources
	Linux 4.14.34

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-04-12 14:51:09 +02:00
Greg Kroah-Hartman
ffebeb0d7c Linux 4.14.34 2018-04-12 12:32:27 +02:00
Moshe Shemesh
fdae5b6205 net/mlx4_core: Fix memory leak while delete slave's resources
[ Upstream commit 461d5f1b59490ce0096dfda45e10038c122a7892 ]

mlx4_delete_all_resources_for_slave in resource tracker should free all
memory allocated for a slave.
While releasing memory of fs_rule, it misses releasing memory of
fs_rule->mirr_mbox.

Fixes: 78efed275117 ('net/mlx4_core: Support mirroring VF DMFS rules on both ports')
Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:27 +02:00
Jason Wang
9fdeb33e19 vhost_net: add missing lock nesting notation
[ Upstream commit aaa3149bbee9ba9b4e6f0bd6e3e7d191edeae942 ]

We try to hold TX virtqueue mutex in vhost_net_rx_peek_head_len()
after RX virtqueue mutex is held in handle_rx(). This requires an
appropriate lock nesting notation to calm down deadlock detector.

Fixes: 0308813724606 ("vhost_net: basic polling support")
Reported-by: syzbot+7f073540b1384a614e09@syzkaller.appspotmail.com
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:27 +02:00
Xin Long
8c316b6257 team: move dev_mc_sync after master_upper_dev_link in team_port_add
[ Upstream commit 982cf3b3999d39a2eaca0a65542df33c19b5d814 ]

The same fix as in 'bonding: move dev_mc_sync after master_upper_dev_link
in bond_enslave' is needed for team driver.

The panic can be reproduced easily:

  ip link add team1 type team
  ip link set team1 up
  ip link add link team1 vlan1 type vlan id 80
  ip link set vlan1 master team1

Fixes: cb41c997d444 ("team: team should sync the port's uc/mc addrs when add a port")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:27 +02:00
Xin Long
233ba28e18 route: check sysctl_fib_multipath_use_neigh earlier than hash
[ Upstream commit 6174a30df1b902e1fedbd728f5343937e83e64e6 ]

Prior to this patch, when one packet is hashed into path [1]
(hash <= nh_upper_bound) and it's neigh is dead, it will try
path [2]. However, if path [2]'s neigh is alive but it's
hash > nh_upper_bound, it will not return this alive path.
This packet will never be sent even if path [2] is alive.

 3.3.3.1/24:
  nexthop via 1.1.1.254 dev eth1 weight 1 <--[1] (dead neigh)
  nexthop via 2.2.2.254 dev eth2 weight 1 <--[2]

With sysctl_fib_multipath_use_neigh set is supposed to find an
available path respecting to the l3/l4 hash. But if there is
no available route with this hash, it should at least return
an alive route even with other hash.

This patch is to fix it by processing fib_multipath_use_neigh
earlier than the hash check, so that it will at least return
an alive route if there is when fib_multipath_use_neigh is
enabled. It's also compatible with before when there are alive
routes with the l3/l4 hash.

Fixes: a6db4494d218 ("net: ipv4: Consider failed nexthops in multipath routes")
Reported-by: Jianlin Shi <jishi@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:27 +02:00
Jason Wang
2f8aa659d4 vhost: validate log when IOTLB is enabled
[ Upstream commit d65026c6c62e7d9616c8ceb5a53b68bcdc050525 ]

Vq log_base is the userspace address of bitmap which has nothing to do
with IOTLB. So it needs to be validated unconditionally otherwise we
may try use 0 as log_base which may lead to pin pages that will lead
unexpected result (e.g trigger BUG_ON() in set_bit_to_user()).

Fixes: 6b1e6cc7855b0 ("vhost: new device IOTLB API")
Reported-by: syzbot+6304bf97ef436580fede@syzkaller.appspotmail.com
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:27 +02:00
Roi Dayan
72b880f439 net/mlx5e: Fix traffic being dropped on VF representor
[ Upstream commit 4246f698dd58e3c6246fa919ef0b0a1d29a57e4a ]

Increase representor netdev RQ size to avoid dropped packets.
The current size (two) is just too small to keep up with
conventional slow path traffic patterns.
Also match the SQ size to the RQ size.

Fixes: cb67b832921c ("net/mlx5e: Introduce SRIOV VF representors")
Signed-off-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Paul Blakey <paulb@mellanox.com>
Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:27 +02:00
Eran Ben Elisha
9408bceb06 net/mlx4_en: Fix mixed PFC and Global pause user control requests
[ Upstream commit 6e8814ceb7e8f468659ef9253bd212c07ae19584 ]

Global pause and PFC configuration should be mutually exclusive (i.e. only
one of them at most can be set). However, once PFC was turned off,
driver automatically turned Global pause on. This is a bug.

Fix the driver behaviour to turn off PFC/Global once the user turned the
other on.

This also fixed a weird behaviour that at a current time, the profile
had both PFC and global pause configuration turned on, which is
Hardware-wise impossible and caused returning false positive indication
to query tools.

In addition, fix error code when setting global pause or PFC to change
metadata only upon successful change.

Also, removed useless debug print.

Fixes: af7d51852631 ("net/mlx4_en: Add DCB PFC support through CEE netlink commands")
Fixes: c27a02cd94d6 ("mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC")
Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:27 +02:00
Dave Watson
477c73abf2 strparser: Fix sign of err codes
[ Upstream commit cd00edc179863848abab5cc5683de5b7b5f70954 ]

strp_parser_err is called with a negative code everywhere, which then
calls abort_parser with a negative code.  strp_msg_timeout calls
abort_parser directly with a positive code.  Negate ETIMEDOUT
to match signed-ness of other calls.

The default abort_parser callback, strp_abort_strp, sets
sk->sk_err to err.  Also negate the error here so sk_err always
holds a positive value, as the rest of the net code expects.  Currently
a negative sk_err can result in endless loops, or user code that
thinks it actually sent/received err bytes.

Found while testing net/tls_sw recv path.

Fixes: 43a0c6751a322847 ("strparser: Stream parser for messages")
Signed-off-by: Dave Watson <davejwatson@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:26 +02:00
Davide Caratti
1c71bfe84d net/sched: fix NULL dereference on the error path of tcf_skbmod_init()
[ Upstream commit 2d433610176d6569e8b3a28f67bc72235bf69efc ]

when the following command

 # tc action replace action skbmod swap mac index 100

is run for the first time, and tcf_skbmod_init() fails to allocate struct
tcf_skbmod_params, tcf_skbmod_cleanup() calls kfree_rcu(NULL), thus
causing the following error:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
 IP: __call_rcu+0x23/0x2b0
 PGD 8000000034057067 P4D 8000000034057067 PUD 74937067 PMD 0
 Oops: 0002 [#1] SMP PTI
 Modules linked in: act_skbmod(E) psample ip6table_filter ip6_tables iptable_filter binfmt_misc ext4 snd_hda_codec_generic snd_hda_intel snd_hda_codec crct10dif_pclmul mbcache jbd2 crc32_pclmul snd_hda_core ghash_clmulni_intel snd_hwdep pcbc snd_seq snd_seq_device snd_pcm aesni_intel snd_timer crypto_simd glue_helper snd cryptd virtio_balloon joydev soundcore pcspkr i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c ata_generic pata_acpi qxl drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm virtio_console virtio_net virtio_blk ata_piix libata crc32c_intel virtio_pci serio_raw virtio_ring virtio i2c_core floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: act_skbmod]
 CPU: 3 PID: 3144 Comm: tc Tainted: G            E    4.16.0-rc4.act_vlan.orig+ #403
 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
 RIP: 0010:__call_rcu+0x23/0x2b0
 RSP: 0018:ffffbd2e403e7798 EFLAGS: 00010246
 RAX: ffffffffc0872080 RBX: ffff981d34bff780 RCX: 00000000ffffffff
 RDX: ffffffff922a5f00 RSI: 0000000000000000 RDI: 0000000000000000
 RBP: 0000000000000000 R08: 0000000000000001 R09: 000000000000021f
 R10: 000000003d003000 R11: 0000000000aaaaaa R12: 0000000000000000
 R13: ffffffff922a5f00 R14: 0000000000000001 R15: ffff981d3b698c2c
 FS:  00007f3678292740(0000) GS:ffff981d3fd80000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000008 CR3: 000000007c57a006 CR4: 00000000001606e0
 Call Trace:
  __tcf_idr_release+0x79/0xf0
  tcf_skbmod_init+0x1d1/0x210 [act_skbmod]
  tcf_action_init_1+0x2cc/0x430
  tcf_action_init+0xd3/0x1b0
  tc_ctl_action+0x18b/0x240
  rtnetlink_rcv_msg+0x29c/0x310
  ? _cond_resched+0x15/0x30
  ? __kmalloc_node_track_caller+0x1b9/0x270
  ? rtnl_calcit.isra.28+0x100/0x100
  netlink_rcv_skb+0xd2/0x110
  netlink_unicast+0x17c/0x230
  netlink_sendmsg+0x2cd/0x3c0
  sock_sendmsg+0x30/0x40
  ___sys_sendmsg+0x27a/0x290
  ? filemap_map_pages+0x34a/0x3a0
  ? __handle_mm_fault+0xbfd/0xe20
  __sys_sendmsg+0x51/0x90
  do_syscall_64+0x6e/0x1a0
  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
 RIP: 0033:0x7f36776a3ba0
 RSP: 002b:00007fff4703b618 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
 RAX: ffffffffffffffda RBX: 00007fff4703b740 RCX: 00007f36776a3ba0
 RDX: 0000000000000000 RSI: 00007fff4703b690 RDI: 0000000000000003
 RBP: 000000005aaaba36 R08: 0000000000000002 R09: 0000000000000000
 R10: 00007fff4703b0a0 R11: 0000000000000246 R12: 0000000000000000
 R13: 00007fff4703b754 R14: 0000000000000001 R15: 0000000000669f60
 Code: 5d e9 42 da ff ff 66 90 0f 1f 44 00 00 41 57 41 56 41 55 49 89 d5 41 54 55 48 89 fd 53 48 83 ec 08 40 f6 c7 07 0f 85 19 02 00 00 <48> 89 75 08 48 c7 45 00 00 00 00 00 9c 58 0f 1f 44 00 00 49 89
 RIP: __call_rcu+0x23/0x2b0 RSP: ffffbd2e403e7798
 CR2: 0000000000000008

Fix it in tcf_skbmod_cleanup(), ensuring that kfree_rcu(p, ...) is called
only when p is not NULL.

Fixes: 86da71b57383 ("net_sched: Introduce skbmod action")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:26 +02:00
Davide Caratti
a19024a3f3 net/sched: fix NULL dereference in the error path of tunnel_key_init()
[ Upstream commit abdadd3cfd3e7ea3da61ac774f84777d1f702058 ]

when the following command

 # tc action add action tunnel_key unset index 100

is run for the first time, and tunnel_key_init() fails to allocate struct
tcf_tunnel_key_params, tunnel_key_release() dereferences NULL pointers.
This causes the following error:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
 IP: tunnel_key_release+0xd/0x40 [act_tunnel_key]
 PGD 8000000033787067 P4D 8000000033787067 PUD 74646067 PMD 0
 Oops: 0000 [#1] SMP PTI
 Modules linked in: act_tunnel_key(E) act_csum ip6table_filter ip6_tables iptable_filter binfmt_misc ext4 mbcache jbd2 crct10dif_pclmul crc32_pclmul snd_hda_codec_generic ghash_clmulni_intel snd_hda_intel pcbc snd_hda_codec snd_hda_core snd_hwdep snd_seq aesni_intel snd_seq_device crypto_simd glue_helper snd_pcm cryptd joydev snd_timer pcspkr virtio_balloon snd i2c_piix4 soundcore nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c ata_generic pata_acpi qxl drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm virtio_net virtio_blk drm virtio_console crc32c_intel ata_piix serio_raw i2c_core virtio_pci libata virtio_ring virtio floppy dm_mirror dm_region_hash dm_log dm_mod
 CPU: 2 PID: 3101 Comm: tc Tainted: G            E    4.16.0-rc4.act_vlan.orig+ #403
 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
 RIP: 0010:tunnel_key_release+0xd/0x40 [act_tunnel_key]
 RSP: 0018:ffffba46803b7768 EFLAGS: 00010286
 RAX: ffffffffc09010a0 RBX: 0000000000000000 RCX: 0000000000000024
 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff99ee336d7480
 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000044
 R10: 0000000000000220 R11: ffff99ee79d73131 R12: 0000000000000000
 R13: ffff99ee32d67610 R14: ffff99ee7671dc38 R15: 00000000fffffff4
 FS:  00007febcb2cd740(0000) GS:ffff99ee7fd00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000010 CR3: 000000007c8e4005 CR4: 00000000001606e0
 Call Trace:
  __tcf_idr_release+0x79/0xf0
  tunnel_key_init+0xd9/0x460 [act_tunnel_key]
  tcf_action_init_1+0x2cc/0x430
  tcf_action_init+0xd3/0x1b0
  tc_ctl_action+0x18b/0x240
  rtnetlink_rcv_msg+0x29c/0x310
  ? _cond_resched+0x15/0x30
  ? __kmalloc_node_track_caller+0x1b9/0x270
  ? rtnl_calcit.isra.28+0x100/0x100
  netlink_rcv_skb+0xd2/0x110
  netlink_unicast+0x17c/0x230
  netlink_sendmsg+0x2cd/0x3c0
  sock_sendmsg+0x30/0x40
  ___sys_sendmsg+0x27a/0x290
  __sys_sendmsg+0x51/0x90
  do_syscall_64+0x6e/0x1a0
  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
 RIP: 0033:0x7febca6deba0
 RSP: 002b:00007ffe7b0dd128 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
 RAX: ffffffffffffffda RBX: 00007ffe7b0dd250 RCX: 00007febca6deba0
 RDX: 0000000000000000 RSI: 00007ffe7b0dd1a0 RDI: 0000000000000003
 RBP: 000000005aaa90cb R08: 0000000000000002 R09: 0000000000000000
 R10: 00007ffe7b0dcba0 R11: 0000000000000246 R12: 0000000000000000
 R13: 00007ffe7b0dd264 R14: 0000000000000001 R15: 0000000000669f60
 Code: 44 00 00 8b 0d b5 23 00 00 48 8b 87 48 10 00 00 48 8b 3c c8 e9 a5 e5 d8 c3 0f 1f 44 00 00 0f 1f 44 00 00 53 48 8b 9f b0 00 00 00 <83> 7b 10 01 74 0b 48 89 df 31 f6 5b e9 f2 fa 7f c3 48 8b 7b 18
 RIP: tunnel_key_release+0xd/0x40 [act_tunnel_key] RSP: ffffba46803b7768
 CR2: 0000000000000010

Fix this in tunnel_key_release(), ensuring 'param' is not NULL before
dereferencing it.

Fixes: d0f6dd8a914f ("net/sched: Introduce act_tunnel_key")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:26 +02:00
Shahar Klein
e096c8bf4f net/mlx5e: Sync netdev vxlan ports at open
[ Upstream commit a117f73dc2430443f23e18367fa545981129c1a6 ]

When mlx5_core is loaded it is expected to sync ports
with all vxlan devices so it can support vxlan encap/decap.
This is done via udp_tunnel_get_rx_info(). Currently this
call is set in mlx5e_nic_enable() and if the netdev is not in
NETREG_REGISTERED state it will not be called.

Normally on load the netdev state is not NETREG_REGISTERED
so udp_tunnel_get_rx_info() will not be called.

Moving udp_tunnel_get_rx_info() to mlx5e_open() so
it will be called on netdev UP event and allow encap/decap.

Fixes: 610e89e05c3f ("net/mlx5e: Don't sync netdev state when not registered")
Signed-off-by: Shahar Klein <shahark@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:26 +02:00
Jianbo Liu
baab1f0c48 net/mlx5e: Don't override vport admin link state in switchdev mode
The vport admin original link state will be re-applied after returning
back to legacy mode, it is not right to change the admin link state value
when in switchdev mode.

Use direct vport commands to alter logical vport state in netdev
representor open/close flows rather than the administrative eswitch API.

Fixes: 20a1ea674783 ('net/mlx5e: Support VF vport link state control for SRIOV switchdev mode')
Signed-off-by: Jianbo Liu <jianbol@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:26 +02:00
David Lebrun
1ec7966ab7 ipv6: sr: fix seg6 encap performances with TSO enabled
[ Upstream commit 5807b22c9164a21cd1077a9bc587f0bba361f72d ]

Enabling TSO can lead to abysmal performances when using seg6 in
encap mode, such as with the ixgbe driver. This patch adds a call to
iptunnel_handle_offloads() to remove the encapsulation bit if needed.

Before:
root@comp4-seg6bpf:~# iperf3 -c fc00::55
Connecting to host fc00::55, port 5201
[  4] local fc45::4 port 36592 connected to fc00::55 port 5201
[ ID] Interval           Transfer     Bandwidth       Retr  Cwnd
[  4]   0.00-1.00   sec   196 KBytes  1.60 Mbits/sec   47   6.66 KBytes
[  4]   1.00-2.00   sec   304 KBytes  2.49 Mbits/sec  100   5.33 KBytes
[  4]   2.00-3.00   sec   284 KBytes  2.32 Mbits/sec   92   5.33 KBytes

After:
root@comp4-seg6bpf:~# iperf3 -c fc00::55
Connecting to host fc00::55, port 5201
[  4] local fc45::4 port 43062 connected to fc00::55 port 5201
[ ID] Interval           Transfer     Bandwidth       Retr  Cwnd
[  4]   0.00-1.00   sec  1.03 GBytes  8.89 Gbits/sec    0    743 KBytes
[  4]   1.00-2.00   sec  1.03 GBytes  8.87 Gbits/sec    0    743 KBytes
[  4]   2.00-3.00   sec  1.03 GBytes  8.87 Gbits/sec    0    743 KBytes

Reported-by: Tom Herbert <tom@quantonium.net>
Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
Signed-off-by: David Lebrun <dlebrun@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:26 +02:00
Dirk van der Merwe
e52a45bb39 nfp: use full 40 bits of the NSP buffer address
[ Upstream commit 1489bbd10e16079ce30a53d3c22a431fd47af791 ]

The NSP default buffer is a piece of NFP memory where additional
command data can be placed.  Its format has been copied from
host buffer, but the PCIe selection bits do not make sense in
this case.  If those get masked out from a NFP address - writes
to random place in the chip memory may be issued and crash the
device.

Even in the general NSP buffer case, it doesn't make sense to have the
PCIe selection bits there anymore. These are unused at the moment, and
when it becomes necessary, the PCIe selection bits should rather be
moved to another register to utilise more bits for the buffer address.

This has never been an issue because the buffer used to be
allocated in memory with less-than-38-bit-long address but that
is about to change.

Fixes: 1a64821c6af7 ("nfp: add support for service processor access")
Signed-off-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:26 +02:00
Jianbo Liu
ddf79878f1 net/mlx5e: Fix memory usage issues in offloading TC flows
[ Upstream commit af1607c37d9d85a66fbcf43b7f11bf3d94b9bb69 ]

For NIC flows, the parsed attributes are not freed when we exit
successfully from mlx5e_configure_flower().

There is possible double free for eswitch flows. If error is returned
from rhashtable_insert_fast(), the parse attrs will be freed in
mlx5e_tc_del_flow(), but they will be freed again before exiting
mlx5e_configure_flower().

To fix both issues we do the following:
(1) change the condition that determines if to issue the free call to
    check if this flow is NIC flow, or it does not have encap action.
(2) reorder the code such that that the check and free calls are done
    before we attempt to add into the hash table.

Fixes: 232c001398ae ('net/mlx5e: Add support to neighbour update flow')
Signed-off-by: Jianbo Liu <jianbol@mellanox.com>
Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:26 +02:00
Or Gerlitz
9282181c1c net/mlx5e: Avoid using the ipv6 stub in the TC offload neigh update path
[ Upstream commit 423c9db29943cfc43e3a408192e9efa4178af6a1 ]

Currently we use the global ipv6_stub var to access the ipv6 global
nd table. This practice gets us to troubles when the stub is only partially
set e.g when ipv6 is loaded under the disabled policy. In this case, as of commit
343d60aada5a ("ipv6: change ipv6_stub_impl.ipv6_dst_lookup to take net argument")
the stub is not null, but stub->nd_tbl is and we crash.

As we can access the ipv6 nd_tbl directly, the fix is just to avoid the
reference through the stub. There is one place in the code where we
issue ipv6 route lookup and keep doing it through the stub, but that
mentioned commit makes sure we get -EAFNOSUPPORT from the stack.

Fixes: 232c001398ae ("net/mlx5e: Add support to neighbour update flow")
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Reviewed-by: Aviv Heller <avivh@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:25 +02:00
Eric Dumazet
b9c6ddda38 vti6: better validate user provided tunnel names
[ Upstream commit 537b361fbcbcc3cd6fe2bb47069fd292b9256d16 ]

Use valid_name() to make sure user does not provide illegal
device name.

Fixes: ed1efb2aefbb ("ipv6: Add support for IPsec virtual tunnel interfaces")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:25 +02:00
Eric Dumazet
109dce20c6 ip6_tunnel: better validate user provided tunnel names
[ Upstream commit db7a65e3ab78e5b1c4b17c0870ebee35a4ee3257 ]

Use valid_name() to make sure user does not provide illegal
device name.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:25 +02:00
Eric Dumazet
72363c63b0 ip6_gre: better validate user provided tunnel names
[ Upstream commit 5f42df013b8bc1b6511af7a04bf93b014884ae2a ]

Use dev_valid_name() to make sure user does not provide illegal
device name.

syzbot caught the following bug :

BUG: KASAN: stack-out-of-bounds in strlcpy include/linux/string.h:300 [inline]
BUG: KASAN: stack-out-of-bounds in ip6gre_tunnel_locate+0x334/0x860 net/ipv6/ip6_gre.c:339
Write of size 20 at addr ffff8801afb9f7b8 by task syzkaller851048/4466

CPU: 1 PID: 4466 Comm: syzkaller851048 Not tainted 4.16.0+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b9/0x29f lib/dump_stack.c:53
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0xac/0x2f5 mm/kasan/report.c:412
 check_memory_region_inline mm/kasan/kasan.c:260 [inline]
 check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
 memcpy+0x37/0x50 mm/kasan/kasan.c:303
 strlcpy include/linux/string.h:300 [inline]
 ip6gre_tunnel_locate+0x334/0x860 net/ipv6/ip6_gre.c:339
 ip6gre_tunnel_ioctl+0x69d/0x12e0 net/ipv6/ip6_gre.c:1195
 dev_ifsioc+0x43e/0xb90 net/core/dev_ioctl.c:334
 dev_ioctl+0x69a/0xcc0 net/core/dev_ioctl.c:525
 sock_ioctl+0x47e/0x680 net/socket.c:1015
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x1cf/0x1650 fs/ioctl.c:684
 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
 SYSC_ioctl fs/ioctl.c:708 [inline]
 SyS_ioctl+0x24/0x30 fs/ioctl.c:706
 do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:25 +02:00
Eric Dumazet
a7309cad9c ipv6: sit: better validate user provided tunnel names
[ Upstream commit b95211e066fc3494b7c115060b2297b4ba21f025 ]

Use dev_valid_name() to make sure user does not provide illegal
device name.

syzbot caught the following bug :

BUG: KASAN: stack-out-of-bounds in strlcpy include/linux/string.h:300 [inline]
BUG: KASAN: stack-out-of-bounds in ipip6_tunnel_locate+0x63b/0xaa0 net/ipv6/sit.c:254
Write of size 33 at addr ffff8801b64076d8 by task syzkaller932654/4453

CPU: 0 PID: 4453 Comm: syzkaller932654 Not tainted 4.16.0+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b9/0x29f lib/dump_stack.c:53
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0xac/0x2f5 mm/kasan/report.c:412
 check_memory_region_inline mm/kasan/kasan.c:260 [inline]
 check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
 memcpy+0x37/0x50 mm/kasan/kasan.c:303
 strlcpy include/linux/string.h:300 [inline]
 ipip6_tunnel_locate+0x63b/0xaa0 net/ipv6/sit.c:254
 ipip6_tunnel_ioctl+0xe71/0x241b net/ipv6/sit.c:1221
 dev_ifsioc+0x43e/0xb90 net/core/dev_ioctl.c:334
 dev_ioctl+0x69a/0xcc0 net/core/dev_ioctl.c:525
 sock_ioctl+0x47e/0x680 net/socket.c:1015
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x1cf/0x1650 fs/ioctl.c:684
 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
 SYSC_ioctl fs/ioctl.c:708 [inline]
 SyS_ioctl+0x24/0x30 fs/ioctl.c:706
 do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:25 +02:00
Eric Dumazet
6816295fe9 ip_tunnel: better validate user provided tunnel names
[ Upstream commit 9cb726a212a82c88c98aa9f0037fd04777cd8fe5 ]

Use dev_valid_name() to make sure user does not provide illegal
device name.

syzbot caught the following bug :

BUG: KASAN: stack-out-of-bounds in strlcpy include/linux/string.h:300 [inline]
BUG: KASAN: stack-out-of-bounds in __ip_tunnel_create+0xca/0x6b0 net/ipv4/ip_tunnel.c:257
Write of size 20 at addr ffff8801ac79f810 by task syzkaller268107/4482

CPU: 0 PID: 4482 Comm: syzkaller268107 Not tainted 4.16.0+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b9/0x29f lib/dump_stack.c:53
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0xac/0x2f5 mm/kasan/report.c:412
 check_memory_region_inline mm/kasan/kasan.c:260 [inline]
 check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
 memcpy+0x37/0x50 mm/kasan/kasan.c:303
 strlcpy include/linux/string.h:300 [inline]
 __ip_tunnel_create+0xca/0x6b0 net/ipv4/ip_tunnel.c:257
 ip_tunnel_create net/ipv4/ip_tunnel.c:352 [inline]
 ip_tunnel_ioctl+0x818/0xd40 net/ipv4/ip_tunnel.c:861
 ipip_tunnel_ioctl+0x1c5/0x420 net/ipv4/ipip.c:350
 dev_ifsioc+0x43e/0xb90 net/core/dev_ioctl.c:334
 dev_ioctl+0x69a/0xcc0 net/core/dev_ioctl.c:525
 sock_ioctl+0x47e/0x680 net/socket.c:1015
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x1cf/0x1650 fs/ioctl.c:684
 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
 SYSC_ioctl fs/ioctl.c:708 [inline]
 SyS_ioctl+0x24/0x30 fs/ioctl.c:706
 do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-12 12:32:25 +02:00