07 May, 2014

37 commits

  • iov_iter_get_pages(iter, pages, maxsize, &start) grabs references pinning
    the pages of up to maxsize of (contiguous) data from iter. Returns the
    amount of memory grabbed or -error. In case of success, the requested
    area begins at offset start in pages[0] and runs through pages[1], etc.
    Less than requested amount might be returned - either because the contiguous
    area in the beginning of iterator is smaller than requested, or because
    the kernel failed to pin that many pages.

    direct-io.c switched to using iov_iter_get_pages()

    Signed-off-by: Al Viro

    Al Viro
     
  • Signed-off-by: Al Viro

    Al Viro
     
  • For now, just use the same thing we pass to ->direct_IO() - it's all
    iovec-based at the moment. Pass it explicitly to iov_iter_init() and
    account for kvec vs. iovec in there, by the same kludge NFS ->direct_IO()
    uses.

    Signed-off-by: Al Viro

    Al Viro
     
  • iov_iter-using variant of generic_file_aio_read(). Some callers
    converted. Note that it's still not quite there for use as ->read_iter() -
    we depend on having zero iter->iov_offset in O_DIRECT case. Fortunately,
    that's true for all converted callers (and for generic_file_aio_read() itself).

    Signed-off-by: Al Viro

    Al Viro
     
  • Signed-off-by: Al Viro

    Al Viro
     
  • Signed-off-by: Al Viro

    Al Viro
     
  • returns the value aligned as badly as the worst remaining segment
    in iov_iter is. Use instead of open-coded equivalents.

    Signed-off-by: Al Viro

    Al Viro
     
  • the thing is, we want to advance what's given to ->direct_IO() as we
    are forming the request; however, the callers care about the amount
    of data actually transferred, not the amount we tried to transfer.
    It's more convenient to allow ->direct_IO() instances do use
    iov_iter_advance() on the copy of iov_iter, leaving the actual
    advancing of the original to caller.

    Signed-off-by: Al Viro

    Al Viro
     
  • Signed-off-by: Al Viro

    Al Viro
     
  • all callers have iov_length(iter->iov, iter->nr_segs) == iov_iter_count(iter)

    Signed-off-by: Al Viro

    Al Viro
     
  • Signed-off-by: Al Viro

    Al Viro
     
  • Signed-off-by: Al Viro

    Al Viro
     
  • unmodified, for now

    Signed-off-by: Al Viro

    Al Viro
     
  • all callers of ->aio_read() and ->aio_write() have iov/nr_segs already
    checked - generic_segment_checks() done after that is just an odd way
    to spell iov_length().

    Signed-off-by: Al Viro

    Al Viro
     
  • Signed-off-by: Al Viro

    Al Viro
     
  • Signed-off-by: Al Viro

    Al Viro
     
  • all callers can use copy_page_from_iter() and it actually simplifies
    them.

    Signed-off-by: Al Viro

    Al Viro
     
  • Signed-off-by: Al Viro

    Al Viro
     
  • Merge misc fixes from Andrew Morton:
    "13 fixes"

    * emailed patches from Andrew Morton :
    agp: info leak in agpioc_info_wrap()
    fs/affs/super.c: bugfix / double free
    fanotify: fix -EOVERFLOW with large files on 64-bit
    slub: use sysfs'es release mechanism for kmem_cache
    revert "mm: vmscan: do not swap anon pages just because free+file is low"
    autofs: fix lockref lookup
    mm: filemap: update find_get_pages_tag() to deal with shadow entries
    mm/compaction: make isolate_freepages start at pageblock boundary
    MAINTAINERS: zswap/zbud: change maintainer email address
    mm/page-writeback.c: fix divide by zero in pos_ratio_polynom
    hugetlb: ensure hugepage access is denied if hugepages are not supported
    slub: fix memcg_propagate_slab_attrs
    drivers/rtc/rtc-pcf8523.c: fix month definition

    Linus Torvalds
     
  • On 64 bit systems the agp_info struct has a 4 byte hole between
    ->agp_mode and ->aper_base. We need to clear it to avoid disclosing
    stack information to userspace.

    Signed-off-by: Dan Carpenter
    Cc: David Airlie
    Cc: Daniel Vetter
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dan Carpenter
     
  • Commit 842a859db26b ("affs: use ->kill_sb() to simplify ->put_super()
    and failure exits of ->mount()") adds .kill_sb which frees sbi but
    doesn't remove sbi free in case of parse_options error causing double
    free+random crash.

    Signed-off-by: Fabian Frederick
    Cc: Alexander Viro
    Cc: [3.14.x]
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Fabian Frederick
     
  • On 64-bit systems, O_LARGEFILE is automatically added to flags inside
    the open() syscall (also openat(), blkdev_open(), etc). Userspace
    therefore defines O_LARGEFILE to be 0 - you can use it, but it's a
    no-op. Everything should be O_LARGEFILE by default.

    But: when fanotify does create_fd() it uses dentry_open(), which skips
    all that. And userspace can't set O_LARGEFILE in fanotify_init()
    because it's defined to 0. So if fanotify gets an event regarding a
    large file, the read() will just fail with -EOVERFLOW.

    This patch adds O_LARGEFILE to fanotify_init()'s event_f_flags on 64-bit
    systems, using the same test as open()/openat()/etc.

    Addresses https://bugzilla.redhat.com/show_bug.cgi?id=696821

    Signed-off-by: Will Woods
    Acked-by: Eric Paris
    Reviewed-by: Jan Kara
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Will Woods
     
  • debugobjects warning during netfilter exit:

    ------------[ cut here ]------------
    WARNING: CPU: 6 PID: 4178 at lib/debugobjects.c:260 debug_print_object+0x8d/0xb0()
    ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x20
    Modules linked in:
    CPU: 6 PID: 4178 Comm: kworker/u16:2 Tainted: G W 3.11.0-next-20130906-sasha #3984
    Workqueue: netns cleanup_net
    Call Trace:
    dump_stack+0x52/0x87
    warn_slowpath_common+0x8c/0xc0
    warn_slowpath_fmt+0x46/0x50
    debug_print_object+0x8d/0xb0
    __debug_check_no_obj_freed+0xa5/0x220
    debug_check_no_obj_freed+0x15/0x20
    kmem_cache_free+0x197/0x340
    kmem_cache_destroy+0x86/0xe0
    nf_conntrack_cleanup_net_list+0x131/0x170
    nf_conntrack_pernet_exit+0x5d/0x70
    ops_exit_list+0x5e/0x70
    cleanup_net+0xfb/0x1c0
    process_one_work+0x338/0x550
    worker_thread+0x215/0x350
    kthread+0xe7/0xf0
    ret_from_fork+0x7c/0xb0

    Also during dcookie cleanup:

    WARNING: CPU: 12 PID: 9725 at lib/debugobjects.c:260 debug_print_object+0x8c/0xb0()
    ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x20
    Modules linked in:
    CPU: 12 PID: 9725 Comm: trinity-c141 Not tainted 3.15.0-rc2-next-20140423-sasha-00018-gc4ff6c4 #408
    Call Trace:
    dump_stack (lib/dump_stack.c:52)
    warn_slowpath_common (kernel/panic.c:430)
    warn_slowpath_fmt (kernel/panic.c:445)
    debug_print_object (lib/debugobjects.c:262)
    __debug_check_no_obj_freed (lib/debugobjects.c:697)
    debug_check_no_obj_freed (lib/debugobjects.c:726)
    kmem_cache_free (mm/slub.c:2689 mm/slub.c:2717)
    kmem_cache_destroy (mm/slab_common.c:363)
    dcookie_unregister (fs/dcookies.c:302 fs/dcookies.c:343)
    event_buffer_release (arch/x86/oprofile/../../../drivers/oprofile/event_buffer.c:153)
    __fput (fs/file_table.c:217)
    ____fput (fs/file_table.c:253)
    task_work_run (kernel/task_work.c:125 (discriminator 1))
    do_notify_resume (include/linux/tracehook.h:196 arch/x86/kernel/signal.c:751)
    int_signal (arch/x86/kernel/entry_64.S:807)

    Sysfs has a release mechanism. Use that to release the kmem_cache
    structure if CONFIG_SYSFS is enabled.

    Only slub is changed - slab currently only supports /proc/slabinfo and
    not /sys/kernel/slab/*. We talked about adding that and someone was
    working on it.

    [akpm@linux-foundation.org: fix CONFIG_SYSFS=n build]
    [akpm@linux-foundation.org: fix CONFIG_SYSFS=n build even more]
    Signed-off-by: Christoph Lameter
    Reported-by: Sasha Levin
    Tested-by: Sasha Levin
    Acked-by: Greg KH
    Cc: Thomas Gleixner
    Cc: Pekka Enberg
    Cc: Russell King
    Cc: Bart Van Assche
    Cc: Al Viro
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Christoph Lameter
     
  • This reverts commit 0bf1457f0cfc ("mm: vmscan: do not swap anon pages
    just because free+file is low") because it introduced a regression in
    mostly-anonymous workloads, where reclaim would become ineffective and
    trap every allocating task in direct reclaim.

    The problem is that there is a runaway feedback loop in the scan balance
    between file and anon, where the balance tips heavily towards a tiny
    thrashing file LRU and anonymous pages are no longer being looked at.
    The commit in question removed the safe guard that would detect such
    situations and respond with forced anonymous reclaim.

    This commit was part of a series to fix premature swapping in loads with
    relatively little cache, and while it made a small difference, the cure
    is obviously worse than the disease. Revert it.

    Signed-off-by: Johannes Weiner
    Reported-by: Christian Borntraeger
    Acked-by: Christian Borntraeger
    Acked-by: Rafael Aquini
    Cc: Rik van Riel
    Cc: [3.12+]
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Johannes Weiner
     
  • autofs needs to be able to see private data dentry flags for its dentrys
    that are being created but not yet hashed and for its dentrys that have
    been rmdir()ed but not yet freed. It needs to do this so it can block
    processes in these states until a status has been returned to indicate
    the given operation is complete.

    It does this by keeping two lists, active and expring, of dentrys in
    this state and uses ->d_release() to keep them stable while it checks
    the reference count to determine if they should be used.

    But with the recent lockref changes dentrys being freed sometimes don't
    transition to a reference count of 0 before being freed so autofs can
    occassionally use a dentry that is invalid which can lead to a panic.

    Signed-off-by: Ian Kent
    Cc: Al Viro
    Cc: Linus Torvalds
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Ian Kent
     
  • Dave Jones reports the following crash when find_get_pages_tag() runs
    into an exceptional entry:

    kernel BUG at mm/filemap.c:1347!
    RIP: find_get_pages_tag+0x1cb/0x220
    Call Trace:
    find_get_pages_tag+0x36/0x220
    pagevec_lookup_tag+0x21/0x30
    filemap_fdatawait_range+0xbe/0x1e0
    filemap_fdatawait+0x27/0x30
    sync_inodes_sb+0x204/0x2a0
    sync_inodes_one_sb+0x19/0x20
    iterate_supers+0xb2/0x110
    sys_sync+0x44/0xb0
    ia32_do_call+0x13/0x13

    1343 /*
    1344 * This function is never used on a shmem/tmpfs
    1345 * mapping, so a swap entry won't be found here.
    1346 */
    1347 BUG();

    After commit 0cd6144aadd2 ("mm + fs: prepare for non-page entries in
    page cache radix trees") this comment and BUG() are out of date because
    exceptional entries can now appear in all mappings - as shadows of
    recently evicted pages.

    However, as Hugh Dickins notes,

    "it is truly surprising for a PAGECACHE_TAG_WRITEBACK (and probably
    any other PAGECACHE_TAG_*) to appear on an exceptional entry.

    I expect it comes down to an occasional race in RCU lookup of the
    radix_tree: lacking absolute synchronization, we might sometimes
    catch an exceptional entry, with the tag which really belongs with
    the unexceptional entry which was there an instant before."

    And indeed, not only is the tree walk lockless, the tags are also read
    in chunks, one radix tree node at a time. There is plenty of time for
    page reclaim to swoop in and replace a page that was already looked up
    as tagged with a shadow entry.

    Remove the BUG() and update the comment. While reviewing all other
    lookup sites for whether they properly deal with shadow entries of
    evicted pages, update all the comments and fix memcg file charge moving
    to not miss shmem/tmpfs swapcache pages.

    Fixes: 0cd6144aadd2 ("mm + fs: prepare for non-page entries in page cache radix trees")
    Signed-off-by: Johannes Weiner
    Reported-by: Dave Jones
    Acked-by: Hugh Dickins
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Johannes Weiner
     
  • The compaction freepage scanner implementation in isolate_freepages()
    starts by taking the current cc->free_pfn value as the first pfn. In a
    for loop, it scans from this first pfn to the end of the pageblock, and
    then subtracts pageblock_nr_pages from the first pfn to obtain the first
    pfn for the next for loop iteration.

    This means that when cc->free_pfn starts at offset X rather than being
    aligned on pageblock boundary, the scanner will start at offset X in all
    scanned pageblock, ignoring potentially many free pages. Currently this
    can happen when

    a) zone's end pfn is not pageblock aligned, or

    b) through zone->compact_cached_free_pfn with CONFIG_HOLES_IN_ZONE
    enabled and a hole spanning the beginning of a pageblock

    This patch fixes the problem by aligning the initial pfn in
    isolate_freepages() to pageblock boundary. This also permits replacing
    the end-of-pageblock alignment within the for loop with a simple
    pageblock_nr_pages increment.

    Signed-off-by: Vlastimil Babka
    Reported-by: Heesub Shin
    Acked-by: Minchan Kim
    Cc: Mel Gorman
    Acked-by: Joonsoo Kim
    Cc: Bartlomiej Zolnierkiewicz
    Cc: Michal Nazarewicz
    Cc: Naoya Horiguchi
    Cc: Christoph Lameter
    Acked-by: Rik van Riel
    Cc: Dongjun Shin
    Cc: Sunghwan Yun
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Vlastimil Babka
     
  • sjenning@linux.vnet.ibm.com is no longer a viable entity.

    Signed-off-by: Seth Jennings
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Seth Jennings
     
  • It is possible for "limit - setpoint + 1" to equal zero, after getting
    truncated to a 32 bit variable, and resulting in a divide by zero error.

    Using the fully 64 bit divide functions avoids this problem. It also
    will cause pos_ratio_polynom() to return the correct value when
    (setpoint - limit) exceeds 2^32.

    Also uninline pos_ratio_polynom, at Andrew's request.

    Signed-off-by: Rik van Riel
    Reviewed-by: Michal Hocko
    Cc: Aneesh Kumar K.V
    Cc: Mel Gorman
    Cc: Nishanth Aravamudan
    Cc: Luiz Capitulino
    Cc: Masayoshi Mizuma
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Rik van Riel
     
  • Currently, I am seeing the following when I `mount -t hugetlbfs /none
    /dev/hugetlbfs`, and then simply do a `ls /dev/hugetlbfs`. I think it's
    related to the fact that hugetlbfs is properly not correctly setting
    itself up in this state?:

    Unable to handle kernel paging request for data at address 0x00000031
    Faulting instruction address: 0xc000000000245710
    Oops: Kernel access of bad area, sig: 11 [#1]
    SMP NR_CPUS=2048 NUMA pSeries
    ....

    In KVM guests on Power, in a guest not backed by hugepages, we see the
    following:

    AnonHugePages: 0 kB
    HugePages_Total: 0
    HugePages_Free: 0
    HugePages_Rsvd: 0
    HugePages_Surp: 0
    Hugepagesize: 64 kB

    HPAGE_SHIFT == 0 in this configuration, which indicates that hugepages
    are not supported at boot-time, but this is only checked in
    hugetlb_init(). Extract the check to a helper function, and use it in a
    few relevant places.

    This does make hugetlbfs not supported (not registered at all) in this
    environment. I believe this is fine, as there are no valid hugepages
    and that won't change at runtime.

    [akpm@linux-foundation.org: use pr_info(), per Mel]
    [akpm@linux-foundation.org: fix build when HPAGE_SHIFT is undefined]
    Signed-off-by: Nishanth Aravamudan
    Reviewed-by: Aneesh Kumar K.V
    Acked-by: Mel Gorman
    Cc: Randy Dunlap
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Nishanth Aravamudan
     
  • After creating a cache for a memcg we should initialize its sysfs attrs
    with the values from its parent. That's what memcg_propagate_slab_attrs
    is for. Currently it's broken - we clearly muddled root-vs-memcg caches
    there. Let's fix it up.

    Signed-off-by: Vladimir Davydov
    Cc: Christoph Lameter
    Cc: Pekka Enberg
    Cc: Michal Hocko
    Cc: Johannes Weiner
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Vladimir Davydov
     
  • PCF8523 uses 1-12 to represent month according to datasheet.
    link: www.nxp.com/documents/data_sheet/PCF8523.pdf.

    Signed-off-by: Chris Cui
    Cc: Alessandro Zummo
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Chris Cui
     
  • Pull vfs fixes from Al Viro:
    "dcache fixes + kvfree() (uninlined, exported by mm/util.c) + posix_acl
    bugfix from hch"

    The dcache fixes are for a subtle LRU list corruption bug reported by
    Miklos Szeredi, where people inside IBM saw list corruptions with the
    LTP/host01 test.

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
    nick kvfree() from apparmor
    posix_acl: handle NULL ACL in posix_acl_equiv_mode
    dcache: don't need rcu in shrink_dentry_list()
    more graceful recovery in umount_collect()
    don't remove from shrink list in select_collect()
    dentry_kill(): don't try to remove from shrink list
    expand the call of dentry_lru_del() in dentry_kill()
    new helper: dentry_free()
    fold try_prune_one_dentry()
    fold d_kill() and d_free()
    fix races between __d_instantiate() and checks of dentry flags

    Linus Torvalds
     
  • too many places open-code it

    Signed-off-by: Al Viro

    Al Viro
     
  • Various filesystems don't bother checking for a NULL ACL in
    posix_acl_equiv_mode, and thus can dereference a NULL pointer when it
    gets passed one. This usually happens from the NFS server, as the ACL tools
    never pass a NULL ACL, but instead of one representing the mode bits.

    Instead of adding boilerplat to all filesystems put this check into one place,
    which will allow us to remove the check from other filesystems as well later
    on.

    Signed-off-by: Christoph Hellwig
    Reported-by: Ben Greear
    Reported-by: Marco Munderloh ,
    Cc: Chuck Lever
    Cc: stable@vger.kernel.org
    Signed-off-by: Al Viro

    Christoph Hellwig
     
  • Pull fuse fixes from Miklos Szeredi:
    "This adds ctime update in the new cached writeback mode and also
    fixes/simplifies the mtime update handling. Support for rename flags
    (aka renameat2) is also added to the userspace API"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
    fuse: add renameat2 support
    fuse: clear MS_I_VERSION
    fuse: clear FUSE_I_CTIME_DIRTY flag on setattr
    fuse: trust kernel i_ctime only
    fuse: remove .update_time
    fuse: allow ctime flushing to userspace
    fuse: fuse: add time_gran to INIT_OUT
    fuse: add .write_inode
    fuse: clean up fsync
    fuse: fuse: fallocate: use file_update_time()
    fuse: update mtime on open(O_TRUNC) in atomic_o_trunc mode
    fuse: update mtime on truncate(2)
    fuse: do not use uninitialized i_mode
    fuse: fix mtime update error in fsync
    fuse: check fallocate mode
    fuse: add __exit to fuse_ctl_cleanup

    Linus Torvalds
     
  • Pull sparc fixes from David Miller:
    "I've been auditing the THP support on sparc64 and found several bugs,
    hopefully most of which are fixed completely here.

    Also an RT kernel locking fix from Kirill Tkhai"

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
    sparc64: Give more detailed information in {pgd,pmd}_ERROR() and kill pte_ERROR().
    sparc64: Add basic validations to {pud,pmd}_bad().
    sparc64: Use 'ILOG2_4MB' instead of constant '22'.
    sparc64: Fix range check in kern_addr_valid().
    sparc64: Fix top-level fault handling bugs.
    sparc64: Handle 32-bit tasks properly in compute_effective_address().
    sparc64: Don't use _PAGE_PRESENT in pte_modify() mask.
    sparc64: Fix hex values in comment above pte_modify().
    sparc64: Fix bugs in get_user_pages_fast() wrt. THP.
    sparc64: Fix huge PMD invalidation.
    sparc64: Fix executable bit testing in set_pmd_at() paths.
    sparc64: Normalize NMI watchdog logging and behavior.
    sparc64: Make itc_sync_lock raw
    sparc64: Fix argument sign extension for compat_sys_futex().

    Linus Torvalds
     

06 May, 2014

3 commits

  • If freelist_idx_t is a byte, SLAB_OBJ_MAX_NUM should be 255 not 256, and
    likewise if freelist_idx_t is a short, then it should be 65535 not
    65536.

    This was leading to all kinds of random crashes on sparc64 where
    PAGE_SIZE is 8192. One problem shown was that if spinlock debugging was
    enabled, we'd get deadlocks in copy_pte_range() or do_wp_page() with the
    same cpu already holding a lock it shouldn't hold, or the lock belonging
    to a completely unrelated process.

    Fixes: a41adfaa23df ("slab: introduce byte sized index for the freelist of a slab")
    Signed-off-by: David S. Miller
    Signed-off-by: Linus Torvalds

    David Miller
     
  • Commit a41adfaa23df ("slab: introduce byte sized index for the freelist
    of a slab") changes the size of freelist index and also changes
    prototype of accessor function to freelist index. And there was a
    mistake.

    The mistake is that although it changes the size of freelist index
    correctly, it changes the size of the index of freelist index
    incorrectly. With patch, freelist index can be 1 byte or 2 bytes, that
    means that num of object on on a slab can be more than 255. So we need
    more than 1 byte for the index to find the index of free object on
    freelist. But, above patch makes this index type 1 byte, so slab which
    have more than 255 objects cannot work properly and in consequence of
    it, the system cannot boot.

    This issue was reported by Steven King on m68knommu which would use
    2 bytes freelist index:

    https://lkml.org/lkml/2014/4/16/433

    To fix is easy. To change the type of the index of freelist index on
    accessor functions is enough to fix this bug. Although 2 bytes is
    enough, I use 4 bytes since it have no bad effect and make things more
    easier. This fix was suggested and tested by Steven in his original
    report.

    Signed-off-by: Joonsoo Kim
    Reported-and-acked-by: Steven King
    Acked-by: Christoph Lameter
    Tested-by: James Hogan
    Tested-by: David Miller
    Cc: Pekka Enberg
    Signed-off-by: Linus Torvalds

    Joonsoo Kim
     
  • Pull networking fixes from David Miller:

    1) e1000e computes header length incorrectly wrt vlans, fix from Vlad
    Yasevich.

    2) ns_capable() check in sock_diag netlink code, from Andrew
    Lutomirski.

    3) Fix invalid queue pairs handling in virtio_net, from Amos Kong.

    4) Checksum offloading busted in sxgbe driver due to incorrect
    descriptor layout, fix from Byungho An.

    5) Fix build failure with SMC_DEBUG set to 2 or larger, from Zi Shen
    Lim.

    6) Fix uninitialized A and X registers in BPF interpreter, from Alexei
    Starovoitov.

    7) Fix arch dependencies of candence driver.

    8) Fix netlink capabilities checking tree-wide, from Eric W Biederman.

    9) Don't dump IFLA_VF_PORTS if netlink request didn't ask for it in
    IFLA_EXT_MASK, from David Gibson.

    10) IPV6 FIB dump restart doesn't handle table changes that happen
    meanwhile, causing the code to loop forever or emit dups, fix from
    Kumar Sandararajan.

    11) Memory leak on VF removal in bnx2x, from Yuval Mintz.

    12) Bug fixes for new Altera TSE driver from Vince Bridgers.

    13) Fix route lookup key in SCTP, from Xugeng Zhang.

    14) Use BH blocking spinlocks in SLIP, as per a similar fix to CAN/SLCAN
    driver. From Oliver Hartkopp.

    15) TCP doesn't bump retransmit counters in some code paths, fix from
    Eric Dumazet.

    16) Clamp delayed_ack in tcp_cubic to prevent theoretical divides by
    zero. Fix from Liu Yu.

    17) Fix locking imbalance in error paths of HHF packet scheduler, from
    John Fastabend.

    18) Properly reference the transport module when vsock_core_init() runs,
    from Andy King.

    19) Fix buffer overflow in cdc_ncm driver, from Bjørn Mork.

    20) IP_ECN_decapsulate() doesn't see a correct SKB network header in
    ip_tunnel_rcv(), fix from Ying Cai.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (132 commits)
    net: macb: Fix race between HW and driver
    net: macb: Remove 'unlikely' optimization
    net: macb: Re-enable RX interrupt only when RX is done
    net: macb: Clear interrupt flags
    net: macb: Pass same size to DMA_UNMAP as used for DMA_MAP
    ip_tunnel: Set network header properly for IP_ECN_decapsulate()
    e1000e: Restrict MDIO Slow Mode workaround to relevant parts
    e1000e: Fix issue with link flap on 82579
    e1000e: Expand workaround for 10Mb HD throughput bug
    e1000e: Workaround for dropped packets in Gig/100 speeds on 82579
    net/mlx4_core: Don't issue PCIe speed/width checks for VFs
    net/mlx4_core: Load the Eth driver first
    net/mlx4_core: Fix slave id computation for single port VF
    net/mlx4_core: Adjust port number in qp_attach wrapper when detaching
    net: cdc_ncm: fix buffer overflow
    Altera TSE: ALTERA_TSE should depend on HAS_DMA
    vsock: Make transport the proto owner
    net: sched: lock imbalance in hhf qdisc
    net: mvmdio: Check for a valid interrupt instead of an error
    net phy: Check for aneg completion before setting state to PHY_RUNNING
    ...

    Linus Torvalds