13 Mar, 2019

4 commits

  • The mutex for the regulator_dev must be controlled by the caller of
    the regulator_notifier_call_chain(), as described in the comment
    for that function.

    Failure to mutex lock and unlock surrounding the notifier call results
    in a kernel WARN_ON_ONCE() which will dump a backtrace for the
    regulator_notifier_call_chain() when that function call is first made.
    The mutex can be controlled using the regulator_lock/unlock() API.

    Fixes: 4068e5182ada ("regulator: da9062: DA9062 regulator driver")
    Suggested-by: Adam Thomson
    Signed-off-by: Steve Twiss
    Signed-off-by: Mark Brown

    Steve Twiss
     
  • The mutex for the regulator_dev must be controlled by the caller of
    the regulator_notifier_call_chain(), as described in the comment
    for that function.

    Failure to mutex lock and unlock surrounding the notifier call results
    in a kernel WARN_ON_ONCE() which will dump a backtrace for the
    regulator_notifier_call_chain() when that function call is first made.
    The mutex can be controlled using the regulator_lock/unlock() API.

    Fixes: f6130be652d0 ("regulator: DA9055 regulator driver")
    Suggested-by: Adam Thomson
    Signed-off-by: Steve Twiss
    Signed-off-by: Mark Brown

    Steve Twiss
     
  • gpio_regulator_voltage_ops and gpio_regulator_current_ops should never
    change, make them const.

    Signed-off-by: Axel Lin
    Signed-off-by: Mark Brown

    Axel Lin
     
  • Use devm_regulator_register to simplify the code.

    Signed-off-by: Axel Lin
    Signed-off-by: Mark Brown

    Axel Lin
     

12 Mar, 2019

4 commits


04 Mar, 2019

17 commits


03 Mar, 2019

5 commits

  • Pull ARM SoC fixes from Arnd Bergmann:
    "One more set of simple ARM platform fixes:

    - A boot regression on qualcomm msm8998

    - Gemini display controllers got turned off by accident

    - incorrect reference counting in optee"

    * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
    tee: optee: add missing of_node_put after of_device_is_available
    arm64: dts: qcom: msm8998: Extend TZ reserved memory area
    ARM: dts: gemini: Re-enable display controller

    Linus Torvalds
     
  • Pull x86 fixes from Thomas Gleixner:
    "Two last minute fixes:

    - Prevent value evaluation via functions happening in the user access
    enabled region of __put_user() (put another way: make sure to
    evaluate the value to be stored in user space _before_ enabling
    user space accesses)

    - Correct the definition of a Hyper-V hypercall constant"

    * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/hyper-v: Fix definition of HV_MAX_FLUSH_REP_COUNT
    x86/uaccess: Don't leak the AC flag into __put_user() value evaluation

    Linus Torvalds
     
  • Pull SCSI fixes from James Bottomley:
    "Nine small fixes.

    The resume fix is a cosmetic removal of a warning with an incorrect
    condition causing it to alarm people wrongly.

    The other eight patches correct a thinko in Christoph Hellwig's DMA
    conversion series. Without it all these drivers end up with 32 bit DMA
    masks meaning they bounce any page over 4GB before sending it to the
    controller.

    Nowadays, even laptops mostly have memory above 4GB, so this can lead
    to significant performance degradation with all the bouncing"

    * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
    scsi: core: Avoid that system resume triggers a kernel warning
    scsi: hptiop: fix calls to dma_set_mask()
    scsi: hisi_sas: fix calls to dma_set_mask_and_coherent()
    scsi: csiostor: fix calls to dma_set_mask_and_coherent()
    scsi: bfa: fix calls to dma_set_mask_and_coherent()
    scsi: aic94xx: fix calls to dma_set_mask_and_coherent()
    scsi: 3w-sas: fix calls to dma_set_mask_and_coherent()
    scsi: 3w-9xxx: fix calls to dma_set_mask_and_coherent()
    scsi: lpfc: fix calls to dma_set_mask_and_coherent()

    Linus Torvalds
     
  • Pull networking fixes from David Miller:

    1) Fix refcount leak in act_ipt during replace, from Davide Caratti.

    2) Set task state properly in tun during blocking reads, from Timur
    Celik.

    3) Leaked reference in DSA, from Wen Yang.

    4) NULL deref in act_tunnel_key, from Vlad Buslov.

    5) cipso_v4_erro can reference the skb IPCB in inappropriate contexts
    thus referencing garbage, from Nazarov Sergey.

    6) Don't accept RTA_VIA and RTA_GATEWAY in contexts where those
    attributes make no sense.

    7) Fix hung sendto in tipc, from Tung Nguyen.

    8) Out-of-bounds access in netlabel, from Paul Moore.

    9) Grant reference leak in xen-netback, from Igor Druzhinin.

    10) Fix tx stalls with lan743x, from Bryan Whitehead.

    11) Fix interrupt storm with mv88e6xxx, from Hein Kallweit.

    12) Memory leak in sit on device registry failure, from Mao Wenan.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits)
    net: sit: fix memory leak in sit_init_net()
    net: dsa: mv88e6xxx: Fix statistics on mv88e6161
    geneve: correctly handle ipv6.disable module parameter
    net: dsa: mv88e6xxx: prevent interrupt storm caused by mv88e6390x_port_set_cmode
    bpf: fix sanitation rewrite in case of non-pointers
    ipv4: Add ICMPv6 support when parse route ipproto
    MIPS: eBPF: Fix icache flush end address
    lan743x: Fix TX Stall Issue
    net: phy: phylink: fix uninitialized variable in phylink_get_mac_state
    net: aquantia: regression on cpus with high cores: set mode with 8 queues
    selftests: fixes for UDP GRO
    bpf: drop refcount if bpf_map_new_fd() fails in map_create()
    net: dsa: mv88e6xxx: power serdes on/off for 10G interfaces on 6390X
    net: dsa: mv88e6xxx: Fix u64 statistics
    xen-netback: don't populate the hash cache on XenBus disconnect
    xen-netback: fix occasional leak of grant ref mappings under memory pressure
    sctp: chunk.c: correct format string for size_t in printk
    net: netem: fix skb length BUG_ON in __skb_to_sgvec
    netlabel: fix out-of-bounds memory accesses
    ipv4: Pass original device to ip_rcv_finish_core
    ...

    Linus Torvalds
     
  • Pull more crypto fixes from Herbert Xu:
    "This fixes a couple of issues in arm64/chacha that was introduced in
    5.0"

    * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
    crypto: arm64/chacha - fix hchacha_block_neon() for big endian
    crypto: arm64/chacha - fix chacha_4block_xor_neon() for big endian

    Linus Torvalds
     

02 Mar, 2019

10 commits

  • If register_netdev() is failed to register sitn->fb_tunnel_dev,
    it will go to err_reg_dev and forget to free netdev(sitn->fb_tunnel_dev).

    BUG: memory leak
    unreferenced object 0xffff888378daad00 (size 512):
    comm "syz-executor.1", pid 4006, jiffies 4295121142 (age 16.115s)
    hex dump (first 32 bytes):
    00 e6 ed c0 83 88 ff ff 00 00 00 00 00 00 00 00 ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    backtrace:
    [] kvmalloc include/linux/mm.h:577 [inline]
    [] kvzalloc include/linux/mm.h:585 [inline]
    [] netif_alloc_netdev_queues net/core/dev.c:8380 [inline]
    [] alloc_netdev_mqs+0x600/0xcc0 net/core/dev.c:8970
    [] sit_init_net+0x295/0xa40 net/ipv6/sit.c:1848
    [] ops_init+0xad/0x3e0 net/core/net_namespace.c:129
    [] setup_net+0x2ba/0x690 net/core/net_namespace.c:314
    [] copy_net_ns+0x1dc/0x330 net/core/net_namespace.c:437
    [] create_new_namespaces+0x382/0x730 kernel/nsproxy.c:107
    [] copy_namespaces+0x2ed/0x3d0 kernel/nsproxy.c:165
    [] copy_process.part.27+0x231e/0x6db0 kernel/fork.c:1919
    [] copy_process kernel/fork.c:1713 [inline]
    [] _do_fork+0x1bc/0xe90 kernel/fork.c:2224
    [] do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290
    [] entry_SYSCALL_64_after_hwframe+0x49/0xbe
    [] 0xffffffffffffffff

    Signed-off-by: Mao Wenan
    Signed-off-by: David S. Miller

    Mao Wenan
     
  • Despite what the datesheet says, the silicon implements the older way
    of snapshoting the statistics. Change the op.

    Reported-by: Chris.Healy@zii.aero
    Tested-by: Chris.Healy@zii.aero
    Fixes: 0ac64c394900 ("net: dsa: mv88e6xxx: mv88e6161 uses mv88e6320 stats snapshot")
    Signed-off-by: Andrew Lunn
    Signed-off-by: David S. Miller

    Andrew Lunn
     
  • When IPv6 is compiled but disabled at runtime, geneve_sock_add returns
    -EAFNOSUPPORT. For metadata based tunnels, this causes failure of the whole
    operation of bringing up the tunnel.

    Ignore failure of IPv6 socket creation for metadata based tunnels caused by
    IPv6 not being available.

    This is the same fix as what commit d074bf960044 ("vxlan: correctly handle
    ipv6.disable module parameter") is doing for vxlan.

    Note there's also commit c0a47e44c098 ("geneve: should not call rt6_lookup()
    when ipv6 was disabled") which fixes a similar issue but for regular
    tunnels, while this patch is needed for metadata based tunnels.

    Signed-off-by: Jiri Benc
    Signed-off-by: David S. Miller

    Jiri Benc
     
  • Alexei Starovoitov says:

    ====================
    pull-request: bpf 2019-03-01

    The following pull-request contains BPF updates for your *net* tree.

    The main changes are:

    1) fix sanitation rewrite, from Daniel.

    2) fix error path on map_new_fd, from Peng.

    3) fix icache flush address, from Paul.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • When debugging another issue I faced an interrupt storm in this
    driver (88E6390, port 9 in SGMII mode), consisting of alternating
    link-up / link-down interrupts. Analysis showed that the driver
    wanted to set a cmode that was set already. But so far
    mv88e6390x_port_set_cmode() doesn't check this and powers down
    SERDES, what causes the link to break, and eventually results in
    the described interrupt storm.

    Fix this by checking whether the cmode actually changes. We want
    that the very first call to mv88e6390x_port_set_cmode() always
    configures the registers, therefore initialize port.cmode with
    a value that is different from any supported cmode value.
    We have to take care that we only init the ports cmode once
    chip->info->num_ports is set.

    v2:
    - add small helper and init the number of actual ports only

    Fixes: 364e9d7776a3 ("net: dsa: mv88e6xxx: Power on/off SERDES on cmode change")
    Signed-off-by: Heiner Kallweit
    Signed-off-by: David S. Miller

    Heiner Kallweit
     
  • Marek reported that he saw an issue with the below snippet in that
    timing measurements where off when loaded as unpriv while results
    were reasonable when loaded as privileged:

    [...]
    uint64_t a = bpf_ktime_get_ns();
    uint64_t b = bpf_ktime_get_ns();
    uint64_t delta = b - a;
    if ((int64_t)delta > 0) {
    [...]

    Turns out there is a bug where a corner case is missing in the fix
    d3bd7413e0ca ("bpf: fix sanitation of alu op with pointer / scalar
    type from different paths"), namely fixup_bpf_calls() only checks
    whether aux has a non-zero alu_state, but it also needs to test for
    the case of BPF_ALU_NON_POINTER since in both occasions we need to
    skip the masking rewrite (as there is nothing to mask).

    Fixes: d3bd7413e0ca ("bpf: fix sanitation of alu op with pointer / scalar type from different paths")
    Reported-by: Marek Majkowski
    Reported-by: Arthur Fabre
    Signed-off-by: Daniel Borkmann
    Link: https://lore.kernel.org/netdev/CAJPywTJqP34cK20iLM5YmUMz9KXQOdu1-+BZrGMAGgLuBWz7fg@mail.gmail.com/T/
    Acked-by: Song Liu
    Signed-off-by: Alexei Starovoitov

    Daniel Borkmann
     
  • For ip rules, we need to use 'ipproto ipv6-icmp' to match ICMPv6 headers.
    But for ip -6 route, currently we only support tcp, udp and icmp.

    Add ICMPv6 support so we can match ipv6-icmp rules for route lookup.

    v2: As David Ahern and Sabrina Dubroca suggested, Add an argument to
    rtm_getroute_parse_ip_proto() to handle ICMP/ICMPv6 with different family.

    Reported-by: Jianlin Shi
    Fixes: eacb9384a3fe ("ipv6: support sport, dport and ip_proto in RTM_GETROUTE")
    Signed-off-by: Hangbin Liu
    Signed-off-by: David S. Miller

    Hangbin Liu
     
  • The MIPS eBPF JIT calls flush_icache_range() in order to ensure the
    icache observes the code that we just wrote. Unfortunately it gets the
    end address calculation wrong due to some bad pointer arithmetic.

    The struct jit_ctx target field is of type pointer to u32, and as such
    adding one to it will increment the address being pointed to by 4 bytes.
    Therefore in order to find the address of the end of the code we simply
    need to add the number of 4 byte instructions emitted, but we mistakenly
    add the number of instructions multiplied by 4. This results in the call
    to flush_icache_range() operating on a memory region 4x larger than
    intended, which is always wasteful and can cause crashes if we overrun
    into an unmapped page.

    Fix this by correcting the pointer arithmetic to remove the bogus
    multiplication, and use braces to remove the need for a set of brackets
    whilst also making it obvious that the target field is a pointer.

    Signed-off-by: Paul Burton
    Fixes: b6bd53f9c4e8 ("MIPS: Add missing file for eBPF JIT.")
    Cc: Alexei Starovoitov
    Cc: Daniel Borkmann
    Cc: Martin KaFai Lau
    Cc: Song Liu
    Cc: Yonghong Song
    Cc: netdev@vger.kernel.org
    Cc: bpf@vger.kernel.org
    Cc: linux-mips@vger.kernel.org
    Cc: stable@vger.kernel.org # v4.13+
    Signed-off-by: Daniel Borkmann

    Paul Burton
     
  • It has been observed that tx queue stalls while downloading
    from certain web sites (example www.speedtest.net)

    The cause has been tracked down to a corner case where
    dma descriptors where not setup properly. And there for a tx
    completion interrupt was not signaled.

    This fix corrects the problem by properly marking the end of
    a multi descriptor transmission.

    Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver")
    Signed-off-by: Bryan Whitehead
    Signed-off-by: David S. Miller

    Bryan Whitehead
     
  • When debugging an issue I found implausible values in state->pause.
    Reason in that state->pause isn't initialized and later only single
    bits are changed. Also the struct itself isn't initialized in
    phylink_resolve(). So better initialize state->pause and other
    not yet initialized fields.

    v2:
    - use right function name in subject
    v3:
    - initialize additional fields

    Fixes: 9525ae83959b ("phylink: add phylink infrastructure")
    Signed-off-by: Heiner Kallweit
    Signed-off-by: David S. Miller

    Heiner Kallweit