1. 31 7月, 2014 8 次提交
    • D
      Merge branch 'mlx5-next' · 7aa06bf5
      David S. Miller 提交于
      Eli Cohen says:
      
      ====================
      mlx5 driver changes related to PCI handling ***
      
      The first of these patches is changing the pci device driver from mlx5_ib to
      mlx5_core in a similar manner it is done in mlx4. This set the grounds for us
      to introduce Ethernet driver for HW which uses mlx5.
      
      The other two patches contain minor fixes.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7aa06bf5
    • J
      mlx5: Adjust events to use unsigned long param instead of void * · 4d2f9bbb
      Jack Morgenstein 提交于
      In the event flow, we currently pass only a port number in the
      void *data argument.  Rather than pass a pointer to the event handlers,
      we should use an "unsigned long" parameter, and pass the port number
      value directly.
      
      In the future, if necessary for some events, we can use the unsigned long
      parameter to pass a pointer.
      
      Based on a patch by Eli Cohen <eli@mellanox.com>
      Signed-off-by: NJack Morgenstein <jackm@dev.mellanox.co.il>
      Signed-off-by: NEli Cohen <eli@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4d2f9bbb
    • J
      mlx5: minor fixes (mainly avoidance of hidden casts) · f241e749
      Jack Morgenstein 提交于
      There were many places where parameters which should be u8/u16 were
      integer type.
      
      Additionally, in 2 places, a check for a non-null pointer was added
      before dereferencing the pointer (this is actually a bug fix).
      Signed-off-by: NJack Morgenstein <jackm@dev.mellanox.co.il>
      Signed-off-by: NEli Cohen <eli@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f241e749
    • J
      mlx5: Move pci device handling from mlx5_ib to mlx5_core · 9603b61d
      Jack Morgenstein 提交于
      In preparation for a new mlx5 device which is VPI (i.e., ports can be
      either IB or ETH), move the pci device functionality from mlx5_ib
      to mlx5_core.
      
      This involves the following changes:
      1. Move mlx5_core_dev struct out of mlx5_ib_dev. mlx5_core_dev
         is now an independent structure maintained by mlx5_core.
         mlx5_ib_dev now has a pointer to that struct.
         This requires changing a lot of places where the core_dev
         struct was accessed via mlx5_ib_dev (now, this needs to
         be a pointer dereference).
      2. All PCI initializations are now done in mlx5_core. Thus,
         it is now mlx5_core which does pci_register_device (and not
         mlx5_ib, as was previously).
      3. mlx5_ib now registers itself with mlx5_core as an "interface"
         driver. This is very similar to the mechanism employed for
         the mlx4 (ConnectX) driver. Once the HCA is initialized
         (by mlx5_core), it invokes the interface drivers to do
         their initializations.
      4. There is a new event handler which the core registers:
         mlx5_core_event(). This event handler invokes the
         event handlers registered by the interfaces.
      
      Based on a patch by Eli Cohen <eli@mellanox.com>
      Signed-off-by: NJack Morgenstein <jackm@dev.mellanox.co.il>
      Signed-off-by: NEli Cohen <eli@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9603b61d
    • H
      random32: mix in entropy from core to late initcall · 4ada97ab
      Hannes Frederic Sowa 提交于
      Currently, we have a 3-stage seeding process in prandom():
      
      Phase 1 is from the early actual initialization of prandom()
      subsystem which happens during core_initcall() and remains
      most likely until the beginning of late_initcall() phase.
      Here, the system might not have enough entropy available
      for seeding with strong randomness from the random driver.
      That means, we currently have a 32bit weak LCG() seeding
      the PRNG status register 1 and mixing that successively
      into the other 3 registers just to get it up and running.
      
      Phase 2 starts with late_initcall() phase resp. when the
      random driver has initialized its non-blocking pool with
      enough entropy. At that time, we throw away *all* inner
      state from its 4 registers and do a full reseed with strong
      randomness.
      
      Phase 3 starts right after that and does a periodic reseed
      with random slack of status register 1 by a strong random
      source again.
      
      A problem in phase 1 is that during bootup data structures
      can be initialized, e.g. on module load time, and thus access
      a weakly seeded prandom and are never changed for the rest
      of their live-time, thus carrying along the results from a
      week seed. Lets make sure that current but also future users
      access a possibly better early seeded prandom.
      
      This patch therefore improves phase 1 by trying to make it
      more 'unpredictable' through mixing in seed from a possible
      hardware source. Now, the mix-in xors inner state with the
      outcome of either of the two functions arch_get_random_{,seed}_int(),
      preferably arch_get_random_seed_int() as it likely represents
      a non-deterministic random bit generator in hw rather than
      a cryptographically secure PRNG in hw. However, not all might
      have the first one, so we use the PRNG as a fallback if
      available. As we xor the seed into the current state, the
      worst case would be that a hardware source could be unverifiable
      compromised or backdoored. In that case nevertheless it
      would be as good as our original early seeding function
      prandom_seed_very_weak() since we mix through xor which is
      entropy preserving.
      
      Joint work with Daniel Borkmann.
      Signed-off-by: NDaniel Borkmann <dborkman@redhat.com>
      Signed-off-by: NHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4ada97ab
    • D
    • L
      Merge tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux · 26bcd8b7
      Linus Torvalds 提交于
      Pull Exynos platform DT fix from Grant Likely:
       "Device tree Exynos bug fix for v3.16-rc7
      
        This bug fix has been brewing for a while.  I hate sending it to you
        so late, but I only got confirmation that it solves the problem this
        past weekend.  The diff looks big for a bug fix, but the majority of
        it is only executed in the Exynos quirk case.  Unfortunately it
        required splitting early_init_dt_scan() in two and adding quirk
        handling in the middle of it on ARM.
      
        Exynos has buggy firmware that puts bad data into the memory node.
        Commit 1c2f87c2 ("ARM: Get rid of meminfo") exposed the bug by
        dropping the artificial upper bound on the number of memory banks that
        can be added.  Exynos fails to boot after that commit.  This branch
        fixes it by splitting the early DT parse function and inserting a
        fixup hook.  Exynos uses the hook to correct the DT before parsing
        memory regions"
      
      * tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux:
        arm: Add devicetree fixup machine function
        of: Add memory limiting function for flattened devicetrees
        of: Split early_init_dt_scan into two parts
      26bcd8b7
    • L
      Merge tag 'stable/for-linus-3.16-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · acba648d
      Linus Torvalds 提交于
      Pull Xen fix from David Vrabel:
       "Fix BUG when trying to expand the grant table.  This seems to occur
        often during boot with Ubuntu 14.04 PV guests"
      
      * tag 'stable/for-linus-3.16-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        x86/xen: safely map and unmap grant frames when in atomic context
      acba648d
  2. 30 7月, 2014 32 次提交
    • L
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · d8772157
      Linus Torvalds 提交于
      Pull KVM fix from Paolo Bonzini:
       "Fix a bug which allows KVM guests to bring down the entire system on
        some 64K enabled ARM64 hosts"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        kvm: arm64: vgic: fix hyp panic with 64k pages on juno platform
      d8772157
    • L
      Revert "cdc_subset: deal with a device that needs reset for timeout" · 1d8fcba1
      Linus Torvalds 提交于
      This reverts commit 20fbe3ae.
      
      As reported by Stephen Rothwell, it causes compile failures in certain
      configurations:
      
        drivers/net/usb/cdc_subset.c:360:15: error: 'dummy_prereset' undeclared here (not in a function)
          .pre_reset = dummy_prereset,
                       ^
        drivers/net/usb/cdc_subset.c:361:16: error: 'dummy_postreset' undeclared here (not in a function)
          .post_reset = dummy_postreset,
                        ^
      Reported-by: NStephen Rothwell <sfr@canb.auug.org.au>
      Acked-by: NDavid Miller <davem@davemloft.net>
      Cc: Oliver Neukum <oneukum@suse.de>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      1d8fcba1
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · b527caee
      Linus Torvalds 提交于
      Pull networking fixes from David Miller:
      
       1) Make fragmentation IDs less predictable, from Eric Dumazet.
      
       2) TSO tunneling can crash in bnx2x driver, fix from Dmitry Kravkov.
      
       3) Don't allow NULL msg->msg_name just because msg->msg_namelen is
          non-zero, from Andrey Ryabinin.
      
       4) ndm->ndm_type set using wrong macros, from Jun Zhao.
      
       5) cdc-ether devices can come up with entries in their address filter,
          so explicitly clear the filter after the device initializes.  From
          Oliver Neukum.
      
       6) Forgotten refcount bump in xfrm_lookup(), from Steffen Klassert.
      
       7) Short packets not padded properly, exposing random data, in bcmgenet
          driver.  Fix from Florian Fainelli.
      
       8) xgbe_probe() doesn't return an error code, but rather zero, when
          netif_set_real_num_tx_queues() fails.  Fix from Wei Yongjun.
      
       9) USB speed not probed properly in r8152 driver, from Hayes Wang.
      
      10) Transmit logic choosing the outgoing port in the sunvnet driver
          needs to consider a) is the port actually up and b) whether it is a
          switch port.  Fix from David L Stevens.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (27 commits)
        net: phy: re-apply PHY fixups during phy_register_device
        cdc-ether: clean packet filter upon probe
        cdc_subset: deal with a device that needs reset for timeout
        net: sendmsg: fix NULL pointer dereference
        isdn/bas_gigaset: fix a leak on failure path in gigaset_probe()
        ip: make IP identifiers less predictable
        neighbour : fix ndm_type type error issue
        sunvnet: only use connected ports when sending
        can: c_can_platform: Fix raminit, use devm_ioremap() instead of devm_ioremap_resource()
        bnx2x: fix crash during TSO tunneling
        r8152: fix the checking of the usb speed
        net: phy: Ensure the MDIO bus module is held
        net: phy: Set the driver when registering an MDIO bus device
        bnx2x: fix set_setting for some PHYs
        hyperv: Fix error return code in netvsc_init_buf()
        amd-xgbe: Fix error return code in xgbe_probe()
        ath9k: fix aggregation session lockup
        net: bcmgenet: correctly pad short packets
        net: sctp: inherit auth_capable on INIT collisions
        mac80211: fix crash on getting sta info with uninitialized rate control
        ...
      b527caee
    • D
      x86/xen: safely map and unmap grant frames when in atomic context · b7dd0e35
      David Vrabel 提交于
      arch_gnttab_map_frames() and arch_gnttab_unmap_frames() are called in
      atomic context but were calling alloc_vm_area() which might sleep.
      
      Also, if a driver attempts to allocate a grant ref from an interrupt
      and the table needs expanding, then the CPU may already by in lazy MMU
      mode and apply_to_page_range() will BUG when it tries to re-enable
      lazy MMU mode.
      
      These two functions are only used in PV guests.
      
      Introduce arch_gnttab_init() to allocates the virtual address space in
      advance.
      
      Avoid the use of apply_to_page_range() by using saving and using the
      array of PTE addresses from the alloc_vm_area() call (which ensures
      that the required page tables are pre-allocated).
      Signed-off-by: NDavid Vrabel <david.vrabel@citrix.com>
      Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      b7dd0e35
    • W
      kvm: arm64: vgic: fix hyp panic with 64k pages on juno platform · 63afbe7a
      Will Deacon 提交于
      If the physical address of GICV isn't page-aligned, then we end up
      creating a stage-2 mapping of the page containing it, which causes us to
      map neighbouring memory locations directly into the guest.
      
      As an example, consider a platform with GICV at physical 0x2c02f000
      running a 64k-page host kernel. If qemu maps this into the guest at
      0x80010000, then guest physical addresses 0x80010000 - 0x8001efff will
      map host physical region 0x2c020000 - 0x2c02efff. Accesses to these
      physical regions may cause UNPREDICTABLE behaviour, for example, on the
      Juno platform this will cause an SError exception to EL3, which brings
      down the entire physical CPU resulting in RCU stalls / HYP panics / host
      crashing / wasted weeks of debugging.
      
      SBSA recommends that systems alias the 4k GICV across the bounding 64k
      region, in which case GICV physical could be described as 0x2c020000 in
      the above scenario.
      
      This patch fixes the problem by failing the vgic probe if the physical
      base address or the size of GICV aren't page-aligned. Note that this
      generated a warning in dmesg about freeing enabled IRQs, so I had to
      move the IRQ enabling later in the probe.
      
      Cc: Christoffer Dall <christoffer.dall@linaro.org>
      Cc: Marc Zyngier <marc.zyngier@arm.com>
      Cc: Gleb Natapov <gleb@kernel.org>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Joel Schopp <joel.schopp@amd.com>
      Cc: Don Dutile <ddutile@redhat.com>
      Acked-by: NPeter Maydell <peter.maydell@linaro.org>
      Acked-by: NJoel Schopp <joel.schopp@amd.com>
      Acked-by: NMarc Zyngier <marc.zyngier@arm.com>
      Signed-off-by: NWill Deacon <will.deacon@arm.com>
      Signed-off-by: NChristoffer Dall <christoffer.dall@linaro.org>
      63afbe7a
    • L
      arm: Add devicetree fixup machine function · 5a12a597
      Laura Abbott 提交于
      Commit 1c2f87c2
      (ARM: 8025/1: Get rid of meminfo) dropped the upper bound on
      the number of memory banks that can be added as there was no
      technical need in the kernel. It turns out though, some bootloaders
      (specifically the arndale-octa exynos boards) may pass invalid memory
      information and rely on the kernel to not parse this data. This is a
      bug in the bootloader but we still need to work around this.
      Work around this by introducing a dt_fixup function. This function
      gets called before the flattened devicetree is scanned for memory
      and the like. In this fixup function for exynos, limit the maximum
      number of memory regions in the devicetree.
      Signed-off-by: NLaura Abbott <lauraa@codeaurora.org>
      Tested-by: NAndreas Färber <afaerber@suse.de>
      [glikely: Added a comment and fixed up function name]
      Signed-off-by: NGrant Likely <grant.likely@linaro.org>
      5a12a597
    • L
      of: Add memory limiting function for flattened devicetrees · 704033ce
      Laura Abbott 提交于
      Buggy bootloaders may pass bogus memory entries in the devicetree.
      Add of_fdt_limit_memory to add an upper bound on the number of
      entries that can be present in the devicetree.
      Signed-off-by: NLaura Abbott <lauraa@codeaurora.org>
      Tested-by: NAndreas Färber <afaerber@suse.de>
      Signed-off-by: NGrant Likely <grant.likely@linaro.org>
      704033ce
    • L
      of: Split early_init_dt_scan into two parts · 4972a74b
      Laura Abbott 提交于
      Currently, early_init_dt_scan validates the header, sets the
      boot params, and scans for chosen/memory all in one function.
      Split this up into two separate functions (validation/setting
      boot params in one, scanning in another) to allow for
      additional setup between boot params and scanning the memory.
      Signed-off-by: NLaura Abbott <lauraa@codeaurora.org>
      Tested-by: NAndreas Färber <afaerber@suse.de>
      [glikely: s/early_init_dt_scan_all/early_init_dt_scan_nodes/]
      Signed-off-by: NGrant Likely <grant.likely@linaro.org>
      4972a74b
    • T
      net: mvpp2: implement ioctl() operation for PHY ioctls · bd695a5f
      Thomas Petazzoni 提交于
      This commit implements the ->ndo_do_ioctl() operation so that the
      PHY-related ioctl() calls can work from userspace, which allows
      applications like mii-tool or mii-diag to do their job.
      Signed-off-by: NThomas Petazzoni <thomas.petazzoni@free-electrons.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      bd695a5f
    • T
      net: mvpp2: fix 10 Mbit/s usage · 2add511e
      Thomas Petazzoni 提交于
      This commit is similar to commit 4d12bc63 ("net: mvneta: fix
      operation in 10 Mbit/s mode"), but this time for the mvpp2 driver. The
      driver was properly taking into account the 1 Gbit/s and 100 Mbit/s
      speeds, but not the 10 Mbit/s, which was handled as 100
      Mbit/s. However, the MVPP2_GMAC_CONFIG_MII_SPEED bit in the
      MVPP2_GMAC_AUTONEG_CONFIG register must remain cleared to allow 10
      Mbit/s operation. This commit therefore fixes 10 Mbit/s operation.
      Signed-off-by: NThomas Petazzoni <thomas.petazzoni@free-electrons.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      2add511e
    • K
      ipv4: clean up cast warning in do_ip_getsockopt · c54a5e02
      Karoly Kemeny 提交于
      Sparse warns because of implicit pointer cast.
      
      v2: subject line correction, space between "void" and "*"
      Signed-off-by: NKaroly Kemeny <karoly.kemeny@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c54a5e02
    • W
      tipc: remove duplicated include from socket.c · ad025a56
      Wei Yongjun 提交于
      Remove duplicated include.
      Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ad025a56
    • H
      net/udp_offload: Use IS_ERR_OR_NULL · 27446442
      Himangi Saraogi 提交于
      This patch introduces the use of the macro IS_ERR_OR_NULL in place of
      tests for NULL and IS_ERR.
      
      The following Coccinelle semantic patch was used for making the change:
      
      @@
      expression e;
      @@
      
      - e == NULL || IS_ERR(e)
      + IS_ERR_OR_NULL(e)
       || ...
      Signed-off-by: NHimangi Saraogi <himangi774@gmail.com>
      Acked-by: NJulia Lawall <julia.lawall@lip6.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      27446442
    • H
      openvswitch: Use IS_ERR_OR_NULL · d0e992aa
      Himangi Saraogi 提交于
      This patch introduces the use of the macro IS_ERR_OR_NULL in place of
      tests for NULL and IS_ERR.
      
      The following Coccinelle semantic patch was used for making the change:
      
      @@
      expression e;
      @@
      
      - e == NULL || IS_ERR(e)
      + IS_ERR_OR_NULL(e)
       || ...
      Signed-off-by: NHimangi Saraogi <himangi774@gmail.com>
      Acked-by: NJulia Lawall <julia.lawall@lip6.fr>
      Acked-by: NPravin B Shelar <pshelar@nicira.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d0e992aa
    • H
      net/ipv4: Use IS_ERR_OR_NULL · 5a8dbf03
      Himangi Saraogi 提交于
      This patch introduces the use of the macro IS_ERR_OR_NULL in place of
      tests for NULL and IS_ERR.
      
      The following Coccinelle semantic patch was used for making the change:
      
      @@
      expression e;
      @@
      
      - e == NULL || IS_ERR(e)
      + IS_ERR_OR_NULL(e)
       || ...
      Signed-off-by: NHimangi Saraogi <himangi774@gmail.com>
      Acked-by: NJulia Lawall <julia.lawall@lip6.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      5a8dbf03
    • B
      sfc: Use __iowrite64_copy instead of a slightly different local function · 4984c237
      Ben Hutchings 提交于
      __iowrite64_copy() isn't quite the same as efx_memcpy_64(), but
      it looks close enough:
      
      - The length is in units of qwords not bytes
      - It never byte-swaps, but that doesn't make a difference now as PIO
        is only enabled for x86_64
      - It doesn't include any memory barriers, but that's OK as there is a
        barrier just before pushing the doorbell
      - mlx4_en uses it for the same purpose
      
      Compile-tested only.
      Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
      Acked-by: NEdward Cree <ecree@solarflare.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4984c237
    • F
      net: phy: re-apply PHY fixups during phy_register_device · d92f5dec
      Florian Fainelli 提交于
      Commit 87aa9f9c ("net: phy: consolidate PHY reset in phy_init_hw()")
      moved the call to phy_scan_fixups() in phy_init_hw() after a software
      reset is performed.
      
      By the time phy_init_hw() is called in phy_device_register(), no driver
      has been bound to this PHY yet, so all the checks in phy_init_hw()
      against the PHY driver and the PHY driver's config_init function will
      return 0. We will therefore never call phy_scan_fixups() as we should.
      
      Fix this by calling phy_scan_fixups() and check for its return value to
      restore the intended functionality.
      
      This broke PHY drivers which do register an early PHY fixup callback to
      intercept the PHY probing and do things like changing the 32-bits unique
      PHY identifier when a pseudo-PHY address has been used, as well as
      board-specific PHY fixups that need to be applied during driver probe
      time.
      Reported-by: NHauke Merthens <hauke-m@hauke-m.de>
      Reported-by: NJonas Gorski <jogo@openwrt.org>
      Signed-off-by: NFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d92f5dec
    • O
      cdc-ether: clean packet filter upon probe · c472ab68
      Oliver Neukum 提交于
      There are devices that don't do reset all the way. So the packet filter should
      be set to a sane initial value. Failure to do so leads to intermittent failures
      of DHCP on some systems under some conditions.
      Signed-off-by: NOliver Neukum <oneukum@suse.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c472ab68
    • O
      cdc_subset: deal with a device that needs reset for timeout · 20fbe3ae
      Oliver Neukum 提交于
      This device needs to be reset to recover from a timeout.
      Unfortunately this can be handled only at the level of
      the subdrivers.
      Signed-off-by: NOliver Neukum <oneukum@suse.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      20fbe3ae
    • A
      net: sendmsg: fix NULL pointer dereference · 40eea803
      Andrey Ryabinin 提交于
      Sasha's report:
      	> While fuzzing with trinity inside a KVM tools guest running the latest -next
      	> kernel with the KASAN patchset, I've stumbled on the following spew:
      	>
      	> [ 4448.949424] ==================================================================
      	> [ 4448.951737] AddressSanitizer: user-memory-access on address 0
      	> [ 4448.952988] Read of size 2 by thread T19638:
      	> [ 4448.954510] CPU: 28 PID: 19638 Comm: trinity-c76 Not tainted 3.16.0-rc4-next-20140711-sasha-00046-g07d3099-dirty #813
      	> [ 4448.956823]  ffff88046d86ca40 0000000000000000 ffff880082f37e78 ffff880082f37a40
      	> [ 4448.958233]  ffffffffb6e47068 ffff880082f37a68 ffff880082f37a58 ffffffffb242708d
      	> [ 4448.959552]  0000000000000000 ffff880082f37a88 ffffffffb24255b1 0000000000000000
      	> [ 4448.961266] Call Trace:
      	> [ 4448.963158] dump_stack (lib/dump_stack.c:52)
      	> [ 4448.964244] kasan_report_user_access (mm/kasan/report.c:184)
      	> [ 4448.965507] __asan_load2 (mm/kasan/kasan.c:352)
      	> [ 4448.966482] ? netlink_sendmsg (net/netlink/af_netlink.c:2339)
      	> [ 4448.967541] netlink_sendmsg (net/netlink/af_netlink.c:2339)
      	> [ 4448.968537] ? get_parent_ip (kernel/sched/core.c:2555)
      	> [ 4448.970103] sock_sendmsg (net/socket.c:654)
      	> [ 4448.971584] ? might_fault (mm/memory.c:3741)
      	> [ 4448.972526] ? might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3740)
      	> [ 4448.973596] ? verify_iovec (net/core/iovec.c:64)
      	> [ 4448.974522] ___sys_sendmsg (net/socket.c:2096)
      	> [ 4448.975797] ? put_lock_stats.isra.13 (./arch/x86/include/asm/preempt.h:98 kernel/locking/lockdep.c:254)
      	> [ 4448.977030] ? lock_release_holdtime (kernel/locking/lockdep.c:273)
      	> [ 4448.978197] ? lock_release_non_nested (kernel/locking/lockdep.c:3434 (discriminator 1))
      	> [ 4448.979346] ? check_chain_key (kernel/locking/lockdep.c:2188)
      	> [ 4448.980535] __sys_sendmmsg (net/socket.c:2181)
      	> [ 4448.981592] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600)
      	> [ 4448.982773] ? trace_hardirqs_on (kernel/locking/lockdep.c:2607)
      	> [ 4448.984458] ? syscall_trace_enter (arch/x86/kernel/ptrace.c:1500 (discriminator 2))
      	> [ 4448.985621] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600)
      	> [ 4448.986754] SyS_sendmmsg (net/socket.c:2201)
      	> [ 4448.987708] tracesys (arch/x86/kernel/entry_64.S:542)
      	> [ 4448.988929] ==================================================================
      
      This reports means that we've come to netlink_sendmsg() with msg->msg_name == NULL and msg->msg_namelen > 0.
      
      After this report there was no usual "Unable to handle kernel NULL pointer dereference"
      and this gave me a clue that address 0 is mapped and contains valid socket address structure in it.
      
      This bug was introduced in f3d33426
      (net: rework recvmsg handler msg_name and msg_namelen logic).
      Commit message states that:
      	"Set msg->msg_name = NULL if user specified a NULL in msg_name but had a
      	 non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't
      	 affect sendto as it would bail out earlier while trying to copy-in the
      	 address."
      But in fact this affects sendto when address 0 is mapped and contains
      socket address structure in it. In such case copy-in address will succeed,
      verify_iovec() function will successfully exit with msg->msg_namelen > 0
      and msg->msg_name == NULL.
      
      This patch fixes it by setting msg_namelen to 0 if msg_name == NULL.
      
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: <stable@vger.kernel.org>
      Reported-by: NSasha Levin <sasha.levin@oracle.com>
      Signed-off-by: NAndrey Ryabinin <a.ryabinin@samsung.com>
      Acked-by: NHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      40eea803
    • A
      isdn/bas_gigaset: fix a leak on failure path in gigaset_probe() · 86b7987d
      Alexey Khoroshilov 提交于
      There is a lack of usb_put_dev(udev) on failure path in gigaset_probe().
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
      Acked-by: NTilman Schmidt <tilman@imap.cc>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      86b7987d
    • D
      Merge branch 'netdev-name' · 772e7023
      David S. Miller 提交于
      Cong Wang says:
      
      ====================
      net: forbid net devices named "all" "default" or "config"
      
      /proc/sys/net/ipv[46]/conf/<dev> could conflict with
      /proc/sys/net/ipv[46]/conf/(all|default). And /proc/net/vlan/<dev>
      could conflict with /proc/net/vlan/config. Besides kernel warnings,
      undefined behavior such as duplicated proc files also appears, therefore
      we should forbid these names.
      
      v2: introduce a helper function, suggested by Florian
          fix error handling for ipv6_add_dev() in addrconf_init()
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      772e7023
    • W
      vlan: fail early when creating netdev named config · 9c5ff24f
      WANG Cong 提交于
      Similarly, vlan will create  /proc/net/vlan/<dev>, so when we
      create dev with name "config", it will confict with
      /proc/net/vlan/config.
      Reported-by: NStephane Chazelas <stephane.chazelas@gmail.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Signed-off-by: NCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9c5ff24f
    • W
      ipv6: fail early when creating netdev named all or default · a317a2f1
      WANG Cong 提交于
      We create a proc dir for each network device, this will cause
      conflicts when the devices have name "all" or "default".
      
      Rather than emitting an ugly kernel warning, we could just
      fail earlier by checking the device name.
      Reported-by: NStephane Chazelas <stephane.chazelas@gmail.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Signed-off-by: NCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a317a2f1
    • W
      ipv4: fail early when creating netdev named all or default · 20e61da7
      WANG Cong 提交于
      We create a proc dir for each network device, this will cause
      conflicts when the devices have name "all" or "default".
      
      Rather than emitting an ugly kernel warning, we could just
      fail earlier by checking the device name.
      Reported-by: NStephane Chazelas <stephane.chazelas@gmail.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Signed-off-by: NCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      20e61da7
    • D
      Merge branch 'syststamp-removal' · 9d7e3ea7
      David S. Miller 提交于
      Willem de Bruijn says:
      
      ====================
      net: remove deprecated syststamp
      
      The network stack can generate two kinds of hardware timestamps:
      - hwtstamp stores a hw timestamp in device-specific raw format
      - syststamp convers the raw format to system time
      
      The second is deprecated and only implemented by a single device
      driver. The suggested alternative is to communicate hwtstamp +
      directly expose the NIC PTP clock device through ptp_clock_info.
      The remaining driver (octeon) does not expose such a standard
      interface as of now. It does have its own PTP library that depends
      on its own shared memory PTP clock interface.
      
      This patchset
      1. reverts the syststamp code in the one driver (octeon)
      2. reverts an unnecessary zero initialization in another (vxge)
      3. modifies PF_PACKET to use syststamp is != 0 (because always == 0)
      4. modifies SCM_TIMESTAMPING in the same way
      
      For backwards compatibility, the interfaces are not removed.
      Applications can still request SOF_TIMESTAMPING_SYS_HARDWARE. The
      response field in scm_timestamping also remains. As was the case
      for hardware/drivers that did not implement the feature, the
      setsockopt succeeds, but the response field is always zero.
      ====================
      Acked-by: NRichard Cochran <richardcochran@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9d7e3ea7
    • W
      net: remove deprecated syststamp timestamp · 4d276eb6
      Willem de Bruijn 提交于
      The SO_TIMESTAMPING API defines three types of timestamps: software,
      hardware in raw format (hwtstamp) and hardware converted to system
      format (syststamp). The last has been deprecated in favor of combining
      hwtstamp with a PTP clock driver. There are no active users in the
      kernel.
      
      The option was device driver dependent. If set, but without hardware
      support, the correct behavior is to return zero in the relevant field
      in the SCM_TIMESTAMPING ancillary message. Without device drivers
      implementing the option, this field is effectively always zero.
      
      Remove the internal plumbing to dissuage new drivers from implementing
      the feature. Keep the SOF_TIMESTAMPING_SYS_HARDWARE flag, however, to
      avoid breaking existing applications that request the timestamp.
      Signed-off-by: NWillem de Bruijn <willemb@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4d276eb6
    • W
      packet: remove deprecated syststamp timestamp · 68a360e8
      Willem de Bruijn 提交于
      No device driver will ever return an skb_shared_info structure with
      syststamp non-zero, so remove the branch that tests for this and
      optionally marks the packet timestamp as TP_STATUS_TS_SYS_HARDWARE.
      
      Do not remove the definition TP_STATUS_TS_SYS_HARDWARE, as processes
      may refer to it.
      Signed-off-by: NWillem de Bruijn <willemb@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      68a360e8
    • W
      vxge: remove deprecated syststamp timestamp · ce750588
      Willem de Bruijn 提交于
      This driver explicitly clears a field that is unused and about to be
      removed. Remove the initialization.
      
      All fields in skb_shared_info before dataref are cleared in
      __alloc_skb, so the removal is safe even while syststamp exists.
      Signed-off-by: NWillem de Bruijn <willemb@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ce750588
    • W
      octeon: remove deprecated syststamp timestamp · c6d5fefa
      Willem de Bruijn 提交于
      Hardware timestamps can be exposed to userspace in raw hardware format
      (hwtstamp) as well as converted to system time (syststamp). The second
      variant is deprecated and only implemented by this driver.
      
      The preferred method of hardware timestamp generation is to combine
      hwtstamp with a device PTP clock. Octeon has its own PTP library
      that relies on a shared memory interface to the PTP clock device.
      Signed-off-by: NWillem de Bruijn <willemb@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c6d5fefa
    • L
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · c98158ed
      Linus Torvalds 提交于
      Pull ARM SoC fixes from Arnd Bergmann:
       "A nice small set of bug fixes for arm-soc:
      
         - two incorrect register addresses in DT files on shmobile and hisilicon
         - one revert for a regression on omap
         - one bug fix for a newly introduced pin controller binding
         - one regression fix for the memory controller on omap
         - one patch to avoid a harmless WARN_ON"
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: dts: Revert enabling of twl configuration for n900
        ARM: dts: fix L2 address in Hi3620
        ARM: OMAP2+: gpmc: fix gpmc_hwecc_bch_capable()
        pinctrl: dra: dt-bindings: Fix pull enable/disable
        ARM: shmobile: r8a7791: Fix SD2CKCR register address
        ARM: OMAP2+: l2c: squelch warning dump on power control setting
      c98158ed
    • D
      AFS: Correctly assemble the client UUID · 0ef13515
      David Howells 提交于
      Correctly assemble the client UUID by OR'ing in the flags rather than
      assigning them over the other components.
      Reported-by: NHimangi Saraogi <himangi774@gmail.com>
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      0ef13515