16 May, 2018

7 commits


14 May, 2018

6 commits

  • Otherwise we will leak a reference to the network namespace.

    Signed-off-by: Christoph Hellwig

    Christoph Hellwig
     
  • Linus Torvalds
     
  • Pull x86/pti updates from Thomas Gleixner:
    "A mixed bag of fixes and updates for the ghosts which are hunting us.

    The scheduler fixes have been pulled into that branch to avoid
    conflicts.

    - A set of fixes to address a khread_parkme() race which caused lost
    wakeups and loss of state.

    - A deadlock fix for stop_machine() solved by moving the wakeups
    outside of the stopper_lock held region.

    - A set of Spectre V1 array access restrictions. The possible
    problematic spots were discuvered by Dan Carpenters new checks in
    smatch.

    - Removal of an unused file which was forgotten when the rest of that
    functionality was removed"

    * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/vdso: Remove unused file
    perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr
    perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver
    perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map()
    perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_*
    perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[]
    sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[]
    sched/core: Fix possible Spectre-v1 indexing for sched_prio_to_weight[]
    sched/core: Introduce set_special_state()
    kthread, sched/wait: Fix kthread_parkme() completion issue
    kthread, sched/wait: Fix kthread_parkme() wait-loop
    sched/fair: Fix the update of blocked load when newly idle
    stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock

    Linus Torvalds
     
  • Pull scheduler fix from Thomas Gleixner:
    "Revert the new NUMA aware placement approach which turned out to
    create more problems than it solved"

    * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    Revert "sched/numa: Delay retrying placement for automatic NUMA balance after wake_affine()"

    Linus Torvalds
     
  • Pull perf tooling fixes from Thomas Gleixner:
    "Another small set of perf tooling fixes and updates:

    - Revert "perf pmu: Fix pmu events parsing rule", as it broke Intel
    PT event description parsing (Arnaldo Carvalho de Melo)

    - Sync x86's cpufeatures.h and kvm UAPI headers with the kernel
    sources, suppressing the ABI drift warnings (Arnaldo Carvalho de
    Melo)

    - Remove duplicated entry for westmereep-dp in Intel's mapfile.csv
    (William Cohen)

    - Fix typo in 'perf bench numa' options description (Yisheng Xie)"

    * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    Revert "perf pmu: Fix pmu events parsing rule"
    tools headers kvm: Sync ARM UAPI headers with the kernel sources
    tools headers kvm: Sync uapi/linux/kvm.h with the kernel sources
    tools headers: Sync x86 cpufeatures.h with the kernel sources
    perf vendor events intel: Remove duplicated entry for westmereep-dp in mapfile.csv
    perf bench numa: Fix typo in options

    Linus Torvalds
     
  • Pull dma-mapping fix from Christoph Hellwig:
    "Just one little fix from Jean to avoid a harmless but very annoying
    warning, especially for the drm code"

    * tag 'dma-mapping-4.17-5' of git://git.infradead.org/users/hch/dma-mapping:
    swiotlb: silent unwanted warning "buffer is full"

    Linus Torvalds
     

13 May, 2018

3 commits

  • Pull cifs fixes from Steve French:
    "Some small SMB3 fixes for 4.17-rc5, some for stable"

    * tag '4.17-rc4-SMB3-Fixes' of git://git.samba.org/sfrench/cifs-2.6:
    smb3: directory sync should not return an error
    cifs: smb2ops: Fix listxattr() when there are no EAs
    cifs: smbd: Enable signing with smbdirect
    cifs: Allocate validate negotiation request through kmalloc

    Linus Torvalds
     
  • Pull thermal fixes from Zhang Rui:

    - fix NULL pointer dereference on module load/probe for int3403_thermal
    driver

    - fix an emergency shutdown issue on exynos thermal driver

    * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
    thermal: exynos: Propagate error value from tmu_read()
    thermal: exynos: Reading temperature makes sense only when TMU is turned on
    thermal: int3403_thermal: Fix NULL pointer deref on module load / probe

    Linus Torvalds
     
  • Pull block fixes from Jens Axboe:
    "Just a few NVMe fixes this round - one fixing a use-after-free, one
    fixes the return value after controller reset, and the last one fixes
    an issue where some drives will spuriously EIO. We should get these
    into 4.17"

    * tag 'for-linus-20180511' of git://git.kernel.dk/linux-block:
    nvme: add quirk to force medium priority for SQ creation
    nvme: Fix sync controller reset return
    nvme: fix use-after-free in nvme_free_ns_head

    Linus Torvalds
     

12 May, 2018

24 commits

  • If DMA_ATTR_NO_WARN is passed to swiotlb_alloc_buffer(), it should be
    passed further down to swiotlb_tbl_map_single(). Otherwise we escape
    half of the warnings but still log the other half.

    This is one of the multiple causes of spurious warnings reported at:
    https://bugs.freedesktop.org/show_bug.cgi?id=104082

    Signed-off-by: Jean Delvare
    Fixes: 0176adb00406 ("swiotlb: refactor coherent buffer allocation")
    Cc: Christoph Hellwig
    Cc: Christian König
    Cc: Michel Dänzer
    Cc: Takashi Iwai
    Cc: stable@vger.kernel.org # v4.16

    Jean Delvare
     
  • This reverts commit 7347fc87dfe6b7315e74310ee1243dc222c68086.

    Srikar Dronamra pointed out that while the commit in question did show
    a performance improvement on ppc64, it did so at the cost of disabling
    active CPU migration by automatic NUMA balancing which was not the intent.
    The issue was that a serious flaw in the logic failed to ever active balance
    if SD_WAKE_AFFINE was disabled on scheduler domains. Even when it's enabled,
    the logic is still bizarre and against the original intent.

    Investigation showed that fixing the patch in either the way he suggested,
    using the correct comparison for jiffies values or introducing a new
    numa_migrate_deferred variable in task_struct all perform similarly to a
    revert with a mix of gains and losses depending on the workload, machine
    and socket count.

    The original intent of the commit was to handle a problem whereby
    wake_affine, idle balancing and automatic NUMA balancing disagree on the
    appropriate placement for a task. This was particularly true for cases where
    a single task was a massive waker of tasks but where wake_wide logic did
    not apply. This was particularly noticeable when a futex (a barrier) woke
    all worker threads and tried pulling the wakees to the waker nodes. In that
    specific case, it could be handled by tuning MPI or openMP appropriately,
    but the behavior is not illogical and was worth attempting to fix. However,
    the approach was wrong. Given that we're at rc4 and a fix is not obvious,
    it's better to play safe, revert this commit and retry later.

    Signed-off-by: Mel Gorman
    Signed-off-by: Peter Zijlstra (Intel)
    Reviewed-by: Srikar Dronamraju
    Cc: Linus Torvalds
    Cc: Thomas Gleixner
    Cc: efault@gmx.de
    Cc: ggherdovich@suse.cz
    Cc: hpa@zytor.com
    Cc: matt@codeblueprint.co.uk
    Cc: mpe@ellerman.id.au
    Link: http://lkml.kernel.org/r/20180509163115.6fnnyeg4vdm2ct4v@techsingularity.net
    Signed-off-by: Ingo Molnar

    Mel Gorman
     
  • Merge misc fixes from Andrew Morton:
    "13 fixes"

    * emailed patches from Andrew Morton :
    rbtree: include rcu.h
    scripts/faddr2line: fix error when addr2line output contains discriminator
    ocfs2: take inode cluster lock before moving reflinked inode from orphan dir
    mm, oom: fix concurrent munlock and oom reaper unmap, v3
    mm: migrate: fix double call of radix_tree_replace_slot()
    proc/kcore: don't bounds check against address 0
    mm: don't show nr_indirectly_reclaimable in /proc/vmstat
    mm: sections are not offlined during memory hotremove
    z3fold: fix reclaim lock-ups
    init: fix false positives in W+X checking
    lib/find_bit_benchmark.c: avoid soft lockup in test_find_first_bit()
    KASAN: prohibit KASAN+STRUCTLEAK combination
    MAINTAINERS: update Shuah's email address

    Linus Torvalds
     
  • Since commit c1adf20052d8 ("Introduce rb_replace_node_rcu()")
    rbtree_augmented.h uses RCU related data structures but does not include
    the header file. It works as long as it gets somehow included before
    that and fails otherwise.

    Link: http://lkml.kernel.org/r/20180504103159.19938-1-bigeasy@linutronix.de
    Signed-off-by: Sebastian Andrzej Siewior
    Reviewed-by: Andrew Morton
    Cc: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Sebastian Andrzej Siewior
     
  • When addr2line output contains discriminator, the current awk script
    cannot parse it. This patch fixes it by extracting key words using
    regex which is more reliable.

    $ scripts/faddr2line vmlinux tlb_flush_mmu_free+0x26
    tlb_flush_mmu_free+0x26/0x50:
    tlb_flush_mmu_free at mm/memory.c:258 (discriminator 3)
    scripts/faddr2line: eval: line 173: unexpected EOF while looking for matching `)'

    Link: http://lkml.kernel.org/r/1525323379-25193-1-git-send-email-changbin.du@intel.com
    Fixes: 6870c0165feaa5 ("scripts/faddr2line: show the code context")
    Signed-off-by: Changbin Du
    Cc: Thomas Gleixner
    Cc: Greg Kroah-Hartman
    Cc: Philippe Ombredanne
    Cc: NeilBrown
    Cc: Richard Weinberger
    Cc: Kate Stewart
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Changbin Du
     
  • While reflinking an inode, we create a new inode in orphan directory,
    then take EX lock on it, reflink the original inode to orphan inode and
    release EX lock. Once the lock is released another node could request
    it in EX mode from ocfs2_recover_orphans() which causes downconvert of
    the lock, on this node, to NL mode.

    Later we attempt to initialize security acl for the orphan inode and
    move it to the reflink destination. However, while doing this we dont
    take EX lock on the inode. This could potentially cause problems
    because we could be starting transaction, accessing journal and
    modifying metadata of the inode while holding NL lock and with another
    node holding EX lock on the inode.

    Fix this by taking orphan inode cluster lock in EX mode before
    initializing security and moving orphan inode to reflink destination.
    Use the __tracker variant while taking inode lock to avoid recursive
    locking in the ocfs2_init_security_and_acl() call chain.

    Link: http://lkml.kernel.org/r/1523475107-7639-1-git-send-email-ashish.samant@oracle.com
    Signed-off-by: Ashish Samant
    Reviewed-by: Joseph Qi
    Reviewed-by: Junxiao Bi
    Acked-by: Jun Piao
    Cc: Mark Fasheh
    Cc: Joel Becker
    Cc: Changwei Ge
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Ashish Samant
     
  • Since exit_mmap() is done without the protection of mm->mmap_sem, it is
    possible for the oom reaper to concurrently operate on an mm until
    MMF_OOM_SKIP is set.

    This allows munlock_vma_pages_all() to concurrently run while the oom
    reaper is operating on a vma. Since munlock_vma_pages_range() depends
    on clearing VM_LOCKED from vm_flags before actually doing the munlock to
    determine if any other vmas are locking the same memory, the check for
    VM_LOCKED in the oom reaper is racy.

    This is especially noticeable on architectures such as powerpc where
    clearing a huge pmd requires serialize_against_pte_lookup(). If the pmd
    is zapped by the oom reaper during follow_page_mask() after the check
    for pmd_none() is bypassed, this ends up deferencing a NULL ptl or a
    kernel oops.

    Fix this by manually freeing all possible memory from the mm before
    doing the munlock and then setting MMF_OOM_SKIP. The oom reaper can not
    run on the mm anymore so the munlock is safe to do in exit_mmap(). It
    also matches the logic that the oom reaper currently uses for
    determining when to set MMF_OOM_SKIP itself, so there's no new risk of
    excessive oom killing.

    This issue fixes CVE-2018-1000200.

    Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1804241526320.238665@chino.kir.corp.google.com
    Fixes: 212925802454 ("mm: oom: let oom_reap_task and exit_mmap run concurrently")
    Signed-off-by: David Rientjes
    Suggested-by: Tetsuo Handa
    Acked-by: Michal Hocko
    Cc: Andrea Arcangeli
    Cc: [4.14+]
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Rientjes
     
  • radix_tree_replace_slot() is called twice for head page, it's obviously
    a bug. Let's fix it.

    Link: http://lkml.kernel.org/r/20180423072101.GA12157@hori1.linux.bs1.fc.nec.co.jp
    Fixes: e71769ae5260 ("mm: enable thp migration for shmem thp")
    Signed-off-by: Naoya Horiguchi
    Reported-by: Matthew Wilcox
    Reviewed-by: Andrew Morton
    Cc: Michal Hocko
    Cc: "Kirill A. Shutemov"
    Cc: Zi Yan
    Cc: Vlastimil Babka
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Naoya Horiguchi
     
  • The existing kcore code checks for bad addresses against __va(0) with
    the assumption that this is the lowest address on the system. This may
    not hold true on some systems (e.g. arm64) and produce overflows and
    crashes. Switch to using other functions to validate the address range.

    It's currently only seen on arm64 and it's not clear if anyone wants to
    use that particular combination on a stable release. So this is not
    urgent for stable.

    Link: http://lkml.kernel.org/r/20180501201143.15121-1-labbott@redhat.com
    Signed-off-by: Laura Abbott
    Tested-by: Dave Anderson
    Cc: Kees Cook
    Cc: Ard Biesheuvel
    Cc: Ingo Molnar
    Cc: Andi Kleen
    Cc: Alexey Dobriyan a
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Laura Abbott
     
  • Don't show nr_indirectly_reclaimable in /proc/vmstat, because there is
    no need to export this vm counter to userspace, and some changes are
    expected in reclaimable object accounting, which can alter this counter.

    Link: http://lkml.kernel.org/r/20180425191422.9159-1-guro@fb.com
    Signed-off-by: Roman Gushchin
    Acked-by: Vlastimil Babka
    Reviewed-by: Andrew Morton
    Cc: Matthew Wilcox
    Cc: Alexander Viro
    Cc: Michal Hocko
    Cc: Johannes Weiner
    Cc: David Rientjes
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Roman Gushchin
     
  • Memory hotplug and hotremove operate with per-block granularity. If the
    machine has a large amount of memory (more than 64G), the size of a
    memory block can span multiple sections. By mistake, during hotremove
    we set only the first section to offline state.

    The bug was discovered because kernel selftest started to fail:
    https://lkml.kernel.org/r/20180423011247.GK5563@yexl-desktop

    After commit, "mm/memory_hotplug: optimize probe routine". But, the bug
    is older than this commit. In this optimization we also added a check
    for sections to be in a proper state during hotplug operation.

    Link: http://lkml.kernel.org/r/20180427145257.15222-1-pasha.tatashin@oracle.com
    Fixes: 2d070eab2e82 ("mm: consider zone which is not fully populated to have holes")
    Signed-off-by: Pavel Tatashin
    Acked-by: Michal Hocko
    Reviewed-by: Andrew Morton
    Cc: Vlastimil Babka
    Cc: Steven Sistare
    Cc: Daniel Jordan
    Cc: "Kirill A. Shutemov"
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Pavel Tatashin
     
  • Do not try to optimize in-page object layout while the page is under
    reclaim. This fixes lock-ups on reclaim and improves reclaim
    performance at the same time.

    [akpm@linux-foundation.org: coding-style fixes]
    Link: http://lkml.kernel.org/r/20180430125800.444cae9706489f412ad12621@gmail.com
    Signed-off-by: Vitaly Wool
    Reported-by: Guenter Roeck
    Tested-by: Guenter Roeck
    Cc:
    Cc: Matthew Wilcox
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Vitaly Wool
     
  • load_module() creates W+X mappings via __vmalloc_node_range() (from
    layout_and_allocate()->move_module()->module_alloc()) by using
    PAGE_KERNEL_EXEC. These mappings are later cleaned up via
    "call_rcu_sched(&freeinit->rcu, do_free_init)" from do_init_module().

    This is a problem because call_rcu_sched() queues work, which can be run
    after debug_checkwx() is run, resulting in a race condition. If hit,
    the race results in a nasty splat about insecure W+X mappings, which
    results in a poor user experience as these are not the mappings that
    debug_checkwx() is intended to catch.

    This issue is observed on multiple arm64 platforms, and has been
    artificially triggered on an x86 platform.

    Address the race by flushing the queued work before running the
    arch-defined mark_rodata_ro() which then calls debug_checkwx().

    Link: http://lkml.kernel.org/r/1525103946-29526-1-git-send-email-jhugo@codeaurora.org
    Fixes: e1a58320a38d ("x86/mm: Warn on W^X mappings")
    Signed-off-by: Jeffrey Hugo
    Reported-by: Timur Tabi
    Reported-by: Jan Glauber
    Acked-by: Kees Cook
    Acked-by: Ingo Molnar
    Acked-by: Will Deacon
    Acked-by: Laura Abbott
    Cc: Mark Rutland
    Cc: Ard Biesheuvel
    Cc: Catalin Marinas
    Cc: Stephen Smalley
    Cc: Thomas Gleixner
    Cc: Peter Zijlstra
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jeffrey Hugo
     
  • test_find_first_bit() is intentionally sub-optimal, and may cause soft
    lockup due to long time of run on some systems. So decrease length of
    bitmap to traverse to avoid lockup.

    With the change below, time of test execution doesn't exceed 0.2 seconds
    on my testing system.

    Link: http://lkml.kernel.org/r/20180420171949.15710-1-ynorov@caviumnetworks.com
    Fixes: 4441fca0a27f5 ("lib: test module for find_*_bit() functions")
    Signed-off-by: Yury Norov
    Reviewed-by: Andrew Morton
    Reported-by: Fengguang Wu
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Yury Norov
     
  • Currently STRUCTLEAK inserts initialization out of live scope of variables
    from KASAN point of view. This leads to KASAN false positive reports.
    Prohibit this combination for now.

    Link: http://lkml.kernel.org/r/20180419172451.104700-1-dvyukov@google.com
    Signed-off-by: Dmitry Vyukov
    Acked-by: Kees Cook
    Cc: Fengguang Wu
    Cc: Sergey Senozhatsky
    Cc: Andrey Ryabinin
    Cc: Dennis Zhou
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dmitry Vyukov
     
  • Update email address in MAINTAINERS file due to IT infrastructure changes
    at Samsung.

    Link: http://lkml.kernel.org/r/20180501212815.25911-1-shuah@kernel.org
    Signed-off-by: Shuah Khan (Samsung OSG)
    Cc: Mauro Carvalho Chehab
    Cc: David S. Miller
    Cc: Greg Kroah-Hartman
    Cc: Linus Walleij
    Cc: Randy Dunlap
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Shuah Khan (Samsung OSG)
     
  • Pull networking fixes from David Miller:

    1) Verify lengths of keys provided by the user is AF_KEY, from Kevin
    Easton.

    2) Add device ID for BCM89610 PHY. Thanks to Bhadram Varka.

    3) Add Spectre guards to some ATM code, courtesy of Gustavo A. R.
    Silva.

    4) Fix infinite loop in NSH protocol code. To Eric Dumazet we are most
    grateful for this fix.

    5) Line up /proc/net/netlink headers properly. This fix from YU Bo, we
    do appreciate.

    6) Use after free in TLS code. Once again we are blessed by the
    honorable Eric Dumazet with this fix.

    7) Fix regression in TLS code causing stalls on partial TLS records.
    This fix is bestowed upon us by Andrew Tomt.

    8) Deal with too small MTUs properly in LLC code, another great gift
    from Eric Dumazet.

    9) Handle cached route flushing properly wrt. MTU locking in ipv4, to
    Hangbin Liu we give thanks for this.

    10) Fix regression in SO_BINDTODEVIC handling wrt. UDP socket demux.
    Paolo Abeni, he gave us this.

    11) Range check coalescing parameters in mlx4 driver, thank you Moshe
    Shemesh.

    12) Some ipv6 ICMP error handling fixes in rxrpc, from our good brother
    David Howells.

    13) Fix kexec on mlx5 by freeing IRQs in shutdown path. Daniel Juergens,
    you're the best!

    14) Don't send bonding RLB updates to invalid MAC addresses. Debabrata
    Benerjee saved us!

    15) Uh oh, we were leaking in udp_sendmsg and ping_v4_sendmsg. The ship
    is now water tight, thanks to Andrey Ignatov.

    16) IPSEC memory leak in ixgbe from Colin Ian King, man we've got holes
    everywhere!

    17) Fix error path in tcf_proto_create, Jiri Pirko what would we do
    without you!

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (92 commits)
    net sched actions: fix refcnt leak in skbmod
    net: sched: fix error path in tcf_proto_create() when modules are not configured
    net sched actions: fix invalid pointer dereferencing if skbedit flags missing
    ixgbe: fix memory leak on ipsec allocation
    ixgbevf: fix ixgbevf_xmit_frame()'s return type
    ixgbe: return error on unsupported SFP module when resetting
    ice: Set rq_last_status when cleaning rq
    ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg
    mlxsw: core: Fix an error handling path in 'mlxsw_core_bus_device_register()'
    bonding: send learning packets for vlans on slave
    bonding: do not allow rlb updates to invalid mac
    net/mlx5e: Err if asked to offload TC match on frag being first
    net/mlx5: E-Switch, Include VF RDMA stats in vport statistics
    net/mlx5: Free IRQs in shutdown path
    rxrpc: Trace UDP transmission failure
    rxrpc: Add a tracepoint to log ICMP/ICMP6 and error messages
    rxrpc: Fix the min security level for kernel calls
    rxrpc: Fix error reception on AF_INET6 sockets
    rxrpc: Fix missing start of call timeout
    qed: fix spelling mistake: "taskelt" -> "tasklet"
    ...

    Linus Torvalds
     
  • Pull NFS client fixes from Anna Schumaker:
    "These patches fix both a possible corruption during NFSoRDMA MR
    recovery, and a sunrpc tracepoint crash.

    Additionally, Trond has a new email address to put in the MAINTAINERS
    file"

    * tag 'nfs-for-4.17-2' of git://git.linux-nfs.org/projects/anna/linux-nfs:
    Change Trond's email address in MAINTAINERS
    sunrpc: Fix latency trace point crashes
    xprtrdma: Fix list corruption / DMAR errors during MR recovery

    Linus Torvalds
     
  • When application fails to pass flags in netlink TLV when replacing
    existing skbmod action, the kernel will leak refcnt:

    $ tc actions get action skbmod index 1
    total acts 0

    action order 0: skbmod pipe set smac 00:11:22:33:44:55
    index 1 ref 1 bind 0

    For example, at this point a buggy application replaces the action with
    index 1 with new smac 00:aa:22:33:44:55, it fails because of zero flags,
    however refcnt gets bumped:

    $ tc actions get actions skbmod index 1
    total acts 0

    action order 0: skbmod pipe set smac 00:11:22:33:44:55
    index 1 ref 2 bind 0
    $

    Tha patch fixes this by calling tcf_idr_release() on existing actions.

    Fixes: 86da71b57383d ("net_sched: Introduce skbmod action")
    Signed-off-by: Roman Mashak
    Acked-by: Cong Wang
    Signed-off-by: David S. Miller

    Roman Mashak
     
  • Pull ceph fixes from Ilya Dryomov:
    "These patches fix two long-standing bugs in the DIO code path, one of
    which is a crash trivially triggerable with splice()"

    * tag 'ceph-for-4.17-rc5' of git://github.com/ceph/ceph-client:
    ceph: fix iov_iter issues in ceph_direct_read_write()
    libceph: add osd_req_op_extent_osd_data_bvecs()
    ceph: fix rsize/wsize capping in ceph_direct_read_write()

    Linus Torvalds
     
  • In case modules are not configured, error out when tp->ops is null
    and prevent later null pointer dereference.

    Fixes: 33a48927c193 ("sched: push TC filter protocol creation into a separate function")
    Signed-off-by: Jiri Pirko
    Acked-by: Cong Wang
    Signed-off-by: David S. Miller

    Jiri Pirko
     
  • Pull arch/sh fixes from Rich Felker:
    "Fixes for critical regressions and a build failure.

    The regressions were introduced in 4.15 and 4.17-rc1 and prevented
    booting on affected systems"

    * tag 'sh-for-4.17-fixes' of git://git.libc.org/linux-sh:
    sh: switch to NO_BOOTMEM
    sh: mm: Fix unprotected access to struct device
    sh: fix build failure for J2 cpu with SMP disabled

    Linus Torvalds
     
  • Pull arm64 fixes from Will Deacon:
    "There's a small memblock accounting problem when freeing the initrd
    and a Spectre-v2 mitigation for NVIDIA Denver CPUs which just requires
    a match on the CPU ID register.

    Summary:

    - Mitigate Spectre-v2 for NVIDIA Denver CPUs

    - Free memblocks corresponding to freed initrd area"

    * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
    arm64: capabilities: Add NVIDIA Denver CPU to bp_harden list
    arm64: Add MIDR encoding for NVIDIA CPUs
    arm64: To remove initrd reserved area entry from memblock

    Linus Torvalds
     
  • Pull powerpc fixes from Michael Ellerman:
    "One fix for an actual regression, the change to the SYSCALL_DEFINE
    wrapper broke FTRACE_SYSCALLS for us due to a name mismatch. There's
    also another commit to the same code to make sure we match all our
    syscalls with various prefixes.

    And then just one minor build fix, and the removal of an unused
    variable that was removed and then snuck back in due to some rebasing.

    Thanks to: Naveen N. Rao"

    * tag 'powerpc-4.17-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
    powerpc/pseries: Fix CONFIG_NUMA=n build
    powerpc/trace/syscalls: Update syscall name matching logic to account for ppc_ prefix
    powerpc/trace/syscalls: Update syscall name matching logic
    powerpc/64: Remove unused paca->soft_enabled

    Linus Torvalds