1. 16 9月, 2016 9 次提交
  2. 14 9月, 2016 2 次提交
  3. 13 9月, 2016 5 次提交
    • X
      sctp: hold the transport before using it in sctp_hash_cmp · 715f5552
      Xin Long 提交于
      Since commit 4f008781 ("sctp: apply rhashtable api to send/recv
      path"), sctp uses transport rhashtable with .obj_cmpfn sctp_hash_cmp,
      in which it compares the members of the transport with the rhashtable
      args to check if it's the right transport.
      
      But sctp uses the transport without holding it in sctp_hash_cmp, it can
      cause a use-after-free panic. As after it gets transport from hashtable,
      another CPU may close the sk and free the asoc. In sctp_association_free,
      it frees all the transports, meanwhile, the assoc's refcnt may be reduced
      to 0, assoc can be destroyed by sctp_association_destroy.
      
      So after that, transport->assoc is actually an unavailable memory address
      in sctp_hash_cmp. Although sctp_hash_cmp is under rcu_read_lock, it still
      can not avoid this, as assoc is not freed by RCU.
      
      This patch is to hold the transport before checking it's members with
      sctp_transport_hold, in which it checks the refcnt first, holds it if
      it's not 0.
      
      Fixes: 4f008781 ("sctp: apply rhashtable api to send/recv path")
      Signed-off-by: NXin Long <lucien.xin@gmail.com>
      Acked-by: NMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      715f5552
    • B
      bnx2: Reset device during driver initialization · 3e1be7ad
      Baoquan He 提交于
      When system enters into kdump kernel because of kernel panic, it won't
      shutdown devices. On-flight DMA will continue transferring data until
      device driver initializes. All devices are supposed to reset during
      driver initialization. And this property is used to fix the kdump
      failure in system with intel iommu. Other systems with hardware iommu
      should be similar. Please check commit 091d42e4 ("iommu/vt-d: Copy
      translation tables from old kernel") and those commits around.
      
      But bnx2 driver doesn't reset device during driver initialization. The
      device resetting is deferred to net device up stage. This will cause
      hardware iommu handling failure on bnx2 device. And its resetting relies
      on firmware. So in this patch move the firmware requesting code to earlier
      bnx2_init_one(), then next call bnx2_reset_chip to reset device.
      Signed-off-by: NBaoquan He <bhe@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3e1be7ad
    • D
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 67b9f0b7
      David S. Miller 提交于
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for your net tree,
      they are:
      
      1) Endianess fix for the new nf_tables netlink trace infrastructure,
         NFTA_TRACE_POLICY endianess was not correct, patch from Liping Zhang.
      
      2) Fix broken re-route after userspace queueing in nf_tables route
         chain. This patch is large but it is simple since it is just getting
         this code in sync with iptable_mangle. Also from Liping.
      
      3) NAT mangling via ctnetlink lies to userspace when nf_nat_setup_info()
         fails to setup the NAT conntrack extension. This problem has been
         there since the beginning, but it can now show up after rhashtable
         conversion.
      
      4) Fix possible NULL pointer dereference due to failures in allocating
         the synproxy and seqadj conntrack extensions, from Gao feng.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      67b9f0b7
    • G
      netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions · 4440a2ab
      Gao Feng 提交于
      When memory is exhausted, nfct_seqadj_ext_add may fail to add the
      synproxy and seqadj extensions. The function nf_ct_seqadj_init doesn't
      check if get valid seqadj pointer by the nfct_seqadj.
      
      Now drop the packet directly when fail to add seqadj extension to
      avoid dereference NULL pointer in nf_ct_seqadj_init from
      init_conntrack().
      Signed-off-by: NGao Feng <fgao@ikuai8.com>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      4440a2ab
    • P
      netfilter: nf_nat: handle NF_DROP from nfnetlink_parse_nat_setup() · ecfcdfec
      Pablo Neira Ayuso 提交于
      nf_nat_setup_info() returns NF_* verdicts, so convert them to error
      codes that is what ctnelink expects. This has passed overlook without
      having any impact since this nf_nat_setup_info() has always returned
      NF_ACCEPT so far. Since 870190a9 ("netfilter: nat: convert nat bysrc
      hash to rhashtable"), this is problem.
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      ecfcdfec
  4. 12 9月, 2016 13 次提交
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · da499f8f
      Linus Torvalds 提交于
      Pull networking fixes from David Miller:
       "Mostly small sets of driver fixes scattered all over the place.
      
         1) Mediatek driver fixes from Sean Wang.  Forward port not written
            correctly during TX map, missed handling of EPROBE_DEFER, and
            mistaken use of put_page() instead of skb_free_frag().
      
         2) Fix socket double-free in KCM code, from WANG Cong.
      
         3) QED driver fixes from Sudarsana Reddy Kalluru, including a fix for
            using the dcbx buffers before initializing them.
      
         4) Mellanox Switch driver fixes from Jiri Pirko, including a fix for
            double fib removals and an error handling fix in
            mlxsw_sp_module_init().
      
         5) Fix kernel panic when enabling LLDP in i40e driver, from Dave
            Ertman.
      
         6) Fix padding of TSO packets in thunderx driver, from Sunil Goutham.
      
         7) TCP's rcv_wup not initialized properly when using fastopen, from
            Neal Cardwell.
      
         8) Don't use uninitialized flow keys in flow dissector, from Gao
            Feng.
      
         9) Use after free in l2tp module unload, from Sabrina Dubroca.
      
        10) Fix interrupt registry ordering issues in smsc911x driver, from
            Jeremy Linton.
      
        11) Fix crashes in bonding having to do with enslaving and rx_handler,
            from Mahesh Bandewar.
      
        12) AF_UNIX deadlock fixes from Linus.
      
        13) In mlx5 driver, don't read skb->xmit_mode after it might have been
            freed from the TX reclaim path.  From Tariq Toukan.
      
        14) Fix a bug from 2015 in TCP Yeah where the congestion window does
            not increase, from Artem Germanov.
      
        15) Don't pad frames on receive in NFP driver, from Jakub Kicinski.
      
        16) Fix chunk fragmenting in SCTP wrt. GSO, from Marcelo Ricardo
            Leitner.
      
        17) Fix deletion of VRF routes, from Mark Tomlinson.
      
        18) Fix device refcount leak when DAD fails in ipv6, from Wei Yongjun"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (101 commits)
        net/mlx4_en: Fix panic on xmit while port is down
        net/mlx4_en: Fixes for DCBX
        net/mlx4_en: Fix the return value of mlx4_en_dcbnl_set_state()
        net/mlx4_en: Fix the return value of mlx4_en_dcbnl_set_all()
        net: ethernet: renesas: sh_eth: add POST registers for rz
        drivers: net: phy: mdio-xgene: Add hardware dependency
        dwc_eth_qos: do not register semi-initialized device
        sctp: identify chunks that need to be fragmented at IP level
        mlxsw: spectrum: Set port type before setting its address
        mlxsw: spectrum_router: Fix error path in mlxsw_sp_router_init
        nfp: don't pad frames on receive
        nfp: drop support for old firmware ABIs
        nfp: remove linux/version.h includes
        tcp: cwnd does not increase in TCP YeAH
        net/mlx5e: Fix parsing of vlan packets when updating lro header
        net/mlx5e: Fix global PFC counters replication
        net/mlx5e: Prevent casting overflow
        net/mlx5e: Move an_disable_cap bit to a new position
        net/mlx5e: Fix xmit_more counter race issue
        tcp: fastopen: avoid negative sk_forward_alloc
        ...
      da499f8f
    • P
      mac80211: make mpath path fixing more robust · 5df20f21
      Pedersen, Thomas 提交于
      A fixed mpath was not quite being treated as such:
      
      1) if a PERR frame was received, a fixed mpath was
         deactivated.
      
      2) queued path discovery for fixed mpath was potentially
         being considered, changing mpath state.
      
      3) other mpath flags were potentially being inherited when
         fixing the mpath. Just assign PATH_FIXED and SN_VALID.
      
      This solves several issues when fixing a mesh path in one
      direction. The reverse direction mpath should probably
      also be fixed, or root announcements at least be enabled.
      Signed-off-by: NThomas Pedersen <twp@qca.qualcomm.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      5df20f21
    • F
      mac80211: fix sequence number assignment for PS response frames · df6ef5d8
      Felix Fietkau 提交于
      When using intermediate queues, sequence number allocation is deferred
      until dequeue. This doesn't work for PS response frames, which bypass
      those queues.
      Signed-off-by: NFelix Fietkau <nbd@nbd.name>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      df6ef5d8
    • F
      mac80211: fix tim recalculation after PS response · 83843c80
      Felix Fietkau 提交于
      Handle the case where the mac80211 intermediate queues are empty and the
      driver has buffered frames
      
      Fixes: ba8c3d6f ("mac80211: add an intermediate software queue implementation")
      Signed-off-by: NFelix Fietkau <nbd@nbd.name>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      83843c80
    • L
      Linux 4.8-rc6 · 9395452b
      Linus Torvalds 提交于
      9395452b
    • D
      Merge branch 'mlx4-fixes' · 373df313
      David S. Miller 提交于
      Tariq Toukan says:
      
      ====================
      mlx4 fixes
      
      This patchset contains several bug fixes from the team to the
      mlx4 Eth driver.
      
      Series generated against net commit:
      c2f57fb9 "drivers: net: phy: mdio-xgene: Add hardware dependency"
      
      v2:
      * excluded some cleanup patches.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      373df313
    • M
      net/mlx4_en: Fix panic on xmit while port is down · 7a61fc86
      Moshe Shemesh 提交于
      When port is down, tx drop counter update is not needed.
      Updating the counter in this case can cause a kernel
      panic as when the port is down, ring can be NULL.
      
      Fixes: 63a664b7 ("net/mlx4_en: fix tx_dropped bug")
      Signed-off-by: NMoshe Shemesh <moshe@mellanox.com>
      Signed-off-by: NTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7a61fc86
    • T
      net/mlx4_en: Fixes for DCBX · 564ed9b1
      Tariq Toukan 提交于
      This patch adds a capability check before enabling DCBX.
      In addition, it re-organizes the relevant data structures,
      and fixes a typo in a define.
      
      Fixes: af7d5185 ("net/mlx4_en: Add DCB PFC support through CEE netlink commands")
      Signed-off-by: NTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      564ed9b1
    • K
      net/mlx4_en: Fix the return value of mlx4_en_dcbnl_set_state() · c6770717
      Kamal Heib 提交于
      mlx4_en_dcbnl_set_state() returns u8, the return value from
      mlx4_en_setup_tc() could be negative in case of failure, so fix that.
      
      Fixes: af7d5185 ("net/mlx4_en: Add DCB PFC support through CEE netlink commands")
      Signed-off-by: NKamal Heib <kamalh@mellanox.com>
      Signed-off-by: NTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c6770717
    • K
      net/mlx4_en: Fix the return value of mlx4_en_dcbnl_set_all() · 74a9e905
      Kamal Heib 提交于
      mlx4_en_dcbnl_set_all() returns u8, so return value can't be negative in
      case of failure.
      
      Fixes: af7d5185 ("net/mlx4_en: Add DCB PFC support through CEE netlink commands")
      Signed-off-by: NKamal Heib <kamalh@mellanox.com>
      Signed-off-by: NRana Shahout <ranas@mellanox.com>
      Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      74a9e905
    • L
      nvme: make NVME_RDMA depend on BLOCK · bd0b841f
      Linus Torvalds 提交于
      Commit aa719874 ("nvme: fabrics drivers don't need the nvme-pci
      driver") removed the dependency on BLK_DEV_NVME, but the cdoe does
      depend on the block layer (which used to be an implicit dependency
      through BLK_DEV_NVME).
      
      Otherwise you get various errors from the kbuild test robot random
      config testing when that happens to hit a configuration with BLOCK
      device support disabled.
      
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Jay Freyensee <james_p_freyensee@linux.intel.com>
      Cc: Sagi Grimberg <sagi@grimberg.me>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      bd0b841f
    • L
      Merge tag 'staging-4.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 2afe669a
      Linus Torvalds 提交于
      Pull IIO fixes from Greg KH:
       "Here are a few small IIO fixes for 4.8-rc6.
      
        Nothing major, full details are in the shortlog, all of these have
        been in linux-next with no reported issues"
      
      * tag 'staging-4.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        iio:core: fix IIO_VAL_FRACTIONAL sign handling
        iio: ensure ret is initialized to zero before entering do loop
        iio: accel: kxsd9: Fix scaling bug
        iio: accel: bmc150: reset chip at init time
        iio: fix pressure data output unit in hid-sensor-attributes
        tools:iio:iio_generic_buffer: fix trigger-less mode
      2afe669a
    • L
      Merge tag 'usb-4.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 61c3dae6
      Linus Torvalds 提交于
      Pull USB fixes from Greg KH:
       "Here are some small USB gadget, phy, and xhci fixes for 4.8-rc6.
      
        All of these resolve minor issues that have been reported, and all
        have been in linux-next with no reported issues"
      
      * tag 'usb-4.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: chipidea: udc: fix NULL ptr dereference in isr_setup_status_phase
        xhci: fix null pointer dereference in stop command timeout function
        usb: dwc3: pci: fix build warning on !PM_SLEEP
        usb: gadget: prevent potenial null pointer dereference on skb->len
        usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition
        usb: phy: phy-generic: Check clk_prepare_enable() error
        usb: gadget: udc: renesas-usb3: clear VBOUT bit in DRD_CON
        Revert "usb: dwc3: gadget: always decrement by 1"
      61c3dae6
  5. 11 9月, 2016 4 次提交
    • C
      net: ethernet: renesas: sh_eth: add POST registers for rz · e1487888
      Chris Brandt 提交于
      Due to a mistake in the hardware manual, the FWSLC and POST1-4 registers
      were not documented and left out of the driver for RZ/A making the CAM
      feature non-operational.
      Additionally, when the offset values for POST1-4 are left blank, the driver
      attempts to set them using an offset of 0xFFFF which can cause a memory
      corruption or panic.
      
      This patch fixes the panic and properly enables CAM.
      Reported-by: NDaniel Palmer <daniel@0x0f.com>
      Signed-off-by: NChris Brandt <chris.brandt@renesas.com>
      Acked-by: NSergei Shtylyov <sergei.shtylyov@cogentembedded.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e1487888
    • L
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · 98ac9a60
      Linus Torvalds 提交于
      Pull libnvdimm fixes from Dan Williams:
       "nvdimm fixes for v4.8, two of them are tagged for -stable:
      
         - Fix devm_memremap_pages() to use track_pfn_insert().  Otherwise,
           DAX pmd mappings end up with an uncached pgprot, and unusable
           performance for the device-dax interface.  The device-dax interface
           appeared in 4.7 so this is tagged for -stable.
      
         - Fix a couple VM_BUG_ON() checks in the show_smaps() path to
           understand DAX pmd entries.  This fix is tagged for -stable.
      
         - Fix a mis-merge of the nfit machine-check handler to flip the
           polarity of an if() to match the final version of the patch that
           Vishal sent for 4.8-rc1.  Without this the nfit machine check
           handler never detects / inserts new 'badblocks' entries which
           applications use to identify lost portions of files.
      
         - For test purposes, fix the nvdimm_clear_poison() path to operate on
           legacy / simulated nvdimm memory ranges.  Without this fix a test
           can set badblocks, but never clear them on these ranges.
      
         - Fix the range checking done by dax_dev_pmd_fault().  This is not
           tagged for -stable since this problem is mitigated by specifying
           aligned resources at device-dax setup time.
      
        These patches have appeared in a next release over the past week.  The
        recent rebase you can see in the timestamps was to drop an invalid fix
        as identified by the updated device-dax unit tests [1].  The -mm
        touches have an ack from Andrew"
      
      [1]: "[ndctl PATCH 0/3] device-dax test for recent kernel bugs"
         https://lists.01.org/pipermail/linux-nvdimm/2016-September/006855.html
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        libnvdimm: allow legacy (e820) pmem region to clear bad blocks
        nfit, mce: Fix SPA matching logic in MCE handler
        mm: fix cache mode of dax pmd mappings
        mm: fix show_smap() for zone_device-pmd ranges
        dax: fix mapping size check
      98ac9a60
    • L
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · b8db3714
      Linus Torvalds 提交于
      Pull i2c fixes from Wolfram Sang:
       "Mostly driver bugfixes, but also a few cleanups which are nice to have
        out of the way"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: rk3x: Restore clock settings at resume time
        i2c: Spelling s/acknowedge/acknowledge/
        i2c: designware: save the preset value of DW_IC_SDA_HOLD
        Documentation: i2c: slave-interface: add note for driver development
        i2c: mux: demux-pinctrl: run properly with multiple instances
        i2c: bcm-kona: fix inconsistent indenting
        i2c: rcar: use proper device with dma_mapping_error
        i2c: sh_mobile: use proper device with dma_mapping_error
        i2c: mux: demux-pinctrl: invalidate properly when switching fails
      b8db3714
    • L
      Merge tag 'for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 6905732c
      Linus Torvalds 提交于
      Pull fscrypto fixes fromTed Ts'o:
       "Fix some brown-paper-bag bugs for fscrypto, including one one which
        allows a malicious user to set an encryption policy on an empty
        directory which they do not own"
      
      * tag 'for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        fscrypto: require write access to mount to set encryption policy
        fscrypto: only allow setting encryption policy on directories
        fscrypto: add authorization check for setting encryption policy
      6905732c
  6. 10 9月, 2016 7 次提交