Commit Graph

617692 Commits

Author SHA1 Message Date
David S. Miller
2f83a53a81 Merge branch 'vxlan-fixes'
Jiri Benc says:

====================
vxlan: fix error reporting

This patchset improves checking for invalid configuration in VXLAN and
fixes problems with duplicated and inappropriate error messages.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-04 11:42:57 -07:00
Jiri Benc
3555621de7 vxlan: fix duplicated and wrong error messages
vxlan_dev_configure outputs error messages before returning, no need to
print again the same mesages in vxlan_newlink. Also, vxlan_dev_configure may
return a particular error code for a different reason than vxlan_newlink
thinks.

Move the remaining error messages into vxlan_dev_configure and let
vxlan_newlink just pass on the error code.

Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-04 11:42:56 -07:00
Jiri Benc
9b4cdd516d vxlan: reject multicast destination without an interface
Currently, kernel accepts configurations such as:

  ip l a type vxlan dstport 4789 id 1 group 239.192.0.1
  ip l a type vxlan dstport 4789 id 1 group ff0e::110

However, neither of those really works. In the IPv4 case, the interface
cannot be brought up ("RTNETLINK answers: No such device"). This is because
multicast join will be rejected without the interface being specified.

In the IPv6 case, multicast wil be joined on the first interface found. This
is not what the user wants as it depends on random factors (order of
interfaces).

Note that it's possible to add a local address but it doesn't solve
anything. For IPv4, it's not considered in the multicast join (thus the same
error as above is returned on ifup). This could be added but it wouldn't
help for IPv6 anyway. For IPv6, we do need the interface.

Just reject a configuration that sets multicast address and does not provide
an interface. Nobody can depend on the previous behavior as it never worked.

Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-04 11:42:56 -07:00
Mahesh Bandewar
24b27fc4cd bonding: Fix bonding crash
Following few steps will crash kernel -

  (a) Create bonding master
      > modprobe bonding miimon=50
  (b) Create macvlan bridge on eth2
      > ip link add link eth2 dev mvl0 address aa:0:0:0:0:01 \
	   type macvlan
  (c) Now try adding eth2 into the bond
      > echo +eth2 > /sys/class/net/bond0/bonding/slaves
      <crash>

Bonding does lots of things before checking if the device enslaved is
busy or not.

In this case when the notifier call-chain sends notifications, the
bond_netdev_event() assumes that the rx_handler /rx_handler_data is
registered while the bond_enslave() hasn't progressed far enough to
register rx_handler for the new slave.

This patch adds a rx_handler check that can be performed right at the
beginning of the enslave code to avoid getting into this situation.

Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-04 11:41:12 -07:00
Linus Torvalds
9ca581b50d Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fix from Thomas Gleixner:
 "A single fix for an AMD erratum so machines without a BIOS fix work"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/AMD: Apply erratum 665 on machines without a BIOS fix
2016-09-04 08:45:41 -07:00
Linus Torvalds
1c3333600b Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Thomas Gleixner:
 "Two fixlet from the timers departement:

   - A fix for scheduler stalls in the tick idle code affecting
     NOHZ_FULL kernels

   - A trivial compile fix"

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  tick/nohz: Fix softlockup on scheduler stalls in kvm guest
  clocksource/drivers/atmel-pit: Fix compilation error
2016-09-04 08:43:45 -07:00
Linus Torvalds
28e68154c5 - a stable fix in both DM crypt and DM log-writes for too large bios (as
generated by bcache)
 
 - 2 other stable fixes for DM log-writes
 
 - a stable fix for a DM crypt bug that could result in freeing pointers
   from uninitialized memory in the tfm allocation error path
 
 - a DM bufio cleanup to discontinue using create_singlethread_workqueue()
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJXybwpAAoJEMUj8QotnQNaVjIIALIS2erGyUquUcFALyGzK0So
 f3GUA3+o/1ttkzkHvDwdgPO0CscVsAp71hMN+3+GrPtXJZRoqlE/w2QfGLYHvV++
 xZR4+kBYuKrlo7+ldvjEi4KI2YtZ541QyaRez7Vy8XKDBo54cFe9oUnGznOYIC+2
 +oH0d2w933rrFgsUa3RFa+8Qyv2ch6SAhDhn6oy0vk7HhH8MIGQKMDQEHVRbgfJ9
 kG45wakb4rDDzmxqT+ZyA8rNk4sV+WanNVfj/7mww/NZe4HW+O7xMJTVgUqczADu
 Sny4VhQOk6w4rpooDeJ2djWHUi8THtX1W616Owu701fmQ9ttALEw0xiZXEOYzBA=
 =v6+u
 -----END PGP SIGNATURE-----

Merge tag 'dm-4.8-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

Pull device mapper fixes from Mike Snitzer:

 - a stable fix in both DM crypt and DM log-writes for too large bios
   (as generated by bcache)

 - two other stable fixes for DM log-writes

 - a stable fix for a DM crypt bug that could result in freeing pointers
   from uninitialized memory in the tfm allocation error path

 - a DM bufio cleanup to discontinue using create_singlethread_workqueue()

* tag 'dm-4.8-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm bufio: remove use of deprecated create_singlethread_workqueue()
  dm crypt: fix free of bad values after tfm allocation failure
  dm crypt: fix error with too large bios
  dm log writes: fix check of kthread_run() return value
  dm log writes: fix bug with too large bios
  dm log writes: move IO accounting earlier to fix error path
2016-09-03 17:29:58 -07:00
Linus Torvalds
4b30b6d126 Merge branch 'for-linus-4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs
Pull btrfs fixes from Chris Mason:
 "I'm still prepping a set of fixes for btrfs fsync, just nailing down a
  hard to trigger memory corruption.  For now, these are tested and ready."

* 'for-linus-4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  btrfs: fix one bug that process may endlessly wait for ticket in wait_reserve_ticket()
  Btrfs: fix endless loop in balancing block groups
  Btrfs: kill invalid ASSERT() in process_all_refs()
2016-09-03 12:40:45 -07:00
Linus Torvalds
2bece1a010 - arm64 fix: debug exception unmasking on the CPU resume path
- ARM PMU fixes: memory leak on error path and NULL pointer dereference
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJXyqG5AAoJEGvWsS0AyF7x1NsP/irMTRdy27zrV2PV5rhuA2Hx
 1xvpLD2vG5mUA89XDKFWwqXCw44VDdWv2TaqvzyVE+oGO1A/1wiH6ZVdqoYCsQ7x
 AcxlJv21i0jZTO/xlSVA/vayhTq3UHXveUcn+Ji5y6u9pLE7Eb7h922oFMV8DlvR
 7UM37TEXclDzSpmmUSynmhu/OwFKjzQGSo0J19cAj7bV/9V/si09Obh3IskcbrQe
 o5tQ+Eel4huWi99h2Uo8HPcsPkQ08Q1ISloSz4yWTEfIX4R0F3R2yP+hpJWuaOy6
 HoIeKE3dCj2PIUyMonvnTFLzBoddxL/N7H/J9XpyHvjG/bmngV2cQrjjIMBIKVC7
 zjw5UuYi39prP2KA+vJMmzkzad67GrEqsWk3NXMwqF43HAW2abAlhTNC2F/or1+V
 YxtTVYAlk7F+AnItVBIZfX43H2LqVl0RrnCfYN2z7+pn2sBcJdRH2IuRj+Pl+WZk
 ErKBZoDHd2NYEh3rNL6HhghDn9obNUVbeDtkMk7ZLRvI919sOuDqcMRRJ5VlBW1s
 EQQNjEQaRZxUOKTEWvSIcdKmr2jOrf8m35NlPAEbGBa5ZDtM86AbEBIHrOiZdCQT
 XN01tUFP/LwqgtjlgFnak806dwwZXeGzF/VqivS0oV8DfPVqtRn8xJrqR35dvcNx
 R4mC9bBozPzGWWwP65qV
 =aasV
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Catalin Marinas:
 "arm64 and arm/perf fixes:

   - arm64 fix: debug exception unmasking on the CPU resume path

   - ARM PMU fixes: memory leak on error path and NULL pointer
     dereference"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: kernel: Fix unmasked debug exceptions when restoring mdscr_el1
  drivers/perf: arm_pmu: Fix NULL pointer dereference during probe
  drivers/perf: arm_pmu: Fix leak in error path
2016-09-03 12:31:37 -07:00
Linus Torvalds
593ee4edc5 Char/Misc driver fixes for 4.8-rc5
Here are a number of small driver fixes for 4.8-rc5.
 
 The largest thing here is deleting an obsolete driver,
 drivers/misc/bh1780gli.c, as the functionality of it was replaced by an
 iio driver a while ago.  The other fixes are things that have been
 reported, or reverts of broken stuff (the binder change).  All of these
 changes have been in linux-next for a while with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iFYEABECABYFAlfK3/MPHGdyZWdAa3JvYWguY29tAAoJEDFH1A3bLfspm5MAoLb+
 VGesoc7cGbFN0EIskollZRzBAJ9Wnhvu3rVeDQYCA0t9+uRg0CcpWw==
 =Wt/v
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH:
 "Here are a number of small driver fixes for 4.8-rc5.

  The largest thing here is deleting an obsolete driver,
  drivers/misc/bh1780gli.c, as the functionality of it was replaced by
  an iio driver a while ago.

  The other fixes are things that have been reported, or reverts of
  broken stuff (the binder change).  All of these changes have been in
  linux-next for a while with no reported issues"

* tag 'char-misc-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  thunderbolt: Don't declare Falcon Ridge unsupported
  thunderbolt: Add support for INTEL_FALCON_RIDGE_2C controller.
  thunderbolt: Fix resume quirk for Falcon Ridge 4C.
  lkdtm: Mark lkdtm_rodata_do_nothing() notrace
  mei: me: disable driver on SPT SPS firmware
  Revert "android: binder: fix dangling pointer comparison"
  drivers/iio/light/Kconfig: SENSORS_BH1780 cleanup
  android: binder: fix dangling pointer comparison
  misc: delete bh1780 driver
2016-09-03 11:38:43 -07:00
Linus Torvalds
41488202f1 Driver core fixes for 4.8-rc5
Here are 3 small fixes for 4.8-rc5.
 
 One for sysfs, one for kernfs, and one documentation fix, all for
 reported issues.  All of these have been in linux-next for a while.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iFYEABECABYFAlfK30APHGdyZWdAa3JvYWguY29tAAoJEDFH1A3bLfspfk8AnjB+
 nWc9F3GbEhS211M7gCiby8eFAJ0QGl9iPSuIUMZ5RdkfTjAj/Un3JA==
 =Yfb4
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

Pull driver core fixes from Greg KH:
 "Here are three small fixes for 4.8-rc5.

  One for sysfs, one for kernfs, and one documentation fix, all for
  reported issues.  All of these have been in linux-next for a while"

* tag 'driver-core-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  sysfs: correctly handle read offset on PREALLOC attrs
  documentation: drivers/core/of: fix name of of_node symlink
  kernfs: don't depend on d_find_any_alias() when generating notifications
2016-09-03 11:36:55 -07:00
Linus Torvalds
018c81b827 Staging/IIO driver fixes for 4.8-rc5
Here are a number of small fixes for staging and IIO drivers that
 resolve reported problems.
 
 Full details are in the shortlog.  All of these have been in linux-next
 with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iFYEABECABYFAlfK4HoPHGdyZWdAa3JvYWguY29tAAoJEDFH1A3bLfspt0MAn0wC
 dYhZOUHxOptLiEkVGXFCU9kzAJ4gETEbuGn9lgp2TFATOOAN7oqPUw==
 =6MKk
 -----END PGP SIGNATURE-----

Merge tag 'staging-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging/IIO driver fixes from Greg KH:
 "Here are a number of small fixes for staging and IIO drivers that
  resolve reported problems.

  Full details are in the shortlog.  All of these have been in
  linux-next with no reported issues"

* tag 'staging-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (35 commits)
  arm: dts: rockchip: add reset node for the exist saradc SoCs
  arm64: dts: rockchip: add reset saradc node for rk3368 SoCs
  iio: adc: rockchip_saradc: reset saradc controller before programming it
  iio: accel: kxsd9: Fix raw read return
  iio: adc: ti_am335x_adc: Increase timeout value waiting for ADC sample
  iio: adc: ti_am335x_adc: Protect FIFO1 from concurrent access
  include/linux: fix excess fence.h kernel-doc notation
  staging: wilc1000: correctly check if associatedsta has not been found
  staging: wilc1000: NULL dereference on error
  staging: wilc1000: txq_event: Fix coding error
  MAINTAINERS: Add file patterns for ion device tree bindings
  MAINTAINERS: Update maintainer entry for wilc1000
  iio: chemical: atlas-ph-sensor: fix typo in val assignment
  iio: fix sched WARNING "do not call blocking ops when !TASK_RUNNING"
  staging: comedi: ni_mio_common: fix AO inttrig backwards compatibility
  staging: comedi: dt2811: fix a precedence bug
  staging: comedi: adv_pci1760: Do not return EINVAL for CMDF_ROUND_DOWN.
  staging: comedi: ni_mio_common: fix wrong insn_write handler
  staging: comedi: comedi_test: fix timer race conditions
  staging: comedi: daqboard2000: bug fix board type matching code
  ...
2016-09-03 11:33:33 -07:00
Linus Torvalds
39da979c98 Serial driver fixes for 4.8-rc5
Here are some small serial driver fixes for 4.8-rc5.  One fixes an
 oft-reported build issue with the fintek driver, another reverts a patch
 that was causing problems, one fixes a crash, and some new device ids
 were added.
 
 All of these have been in linux-next for a while.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iFYEABECABYFAlfK4ScPHGdyZWdAa3JvYWguY29tAAoJEDFH1A3bLfspmEcAn0FE
 lUzWBQb4to15YXhl8wtNF9ZbAJ9Gi2r5MEfXlnLStI3XM/gq8BdXGw==
 =pkwv
 -----END PGP SIGNATURE-----

Merge tag 'tty-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull serial driver fixes from Greg KH:
 "Here are some small serial driver fixes for 4.8-rc5.  One fixes an
  oft-reported build issue with the fintek driver, another reverts a
  patch that was causing problems, one fixes a crash, and some new
  device ids were added.

  All of these have been in linux-next for a while"

* tag 'tty-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: 8250: added acces i/o products quad and octal serial cards
  serial: 8250_mid: fix divide error bug if baud rate is 0
  Revert "tty/serial/8250: use mctrl_gpio helpers"
  8250/fintek: rename IRQ_MODE macro
2016-09-03 11:29:31 -07:00
Linus Torvalds
70dad4998e USB/PHY fixes for 4.8-rc5
Here are some USB and PHY driver fixes for 4.8-rc5
 
 Nothing major, lots of little fixes for reported bugs, and a build fix
 for a missing .h file that the phy drivers needed.  All of these have
 been in linux-next for a while with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iFYEABECABYFAlfK4h8PHGdyZWdAa3JvYWguY29tAAoJEDFH1A3bLfspLTMAoMNL
 Q3TlSgupOTzsV1MMRdRMuU6fAJ4/jMOV5h8XTx9ETmhx8N9RB63QTw==
 =RTNl
 -----END PGP SIGNATURE-----

Merge tag 'usb-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB/PHY fixes from Greg KH:
 "Here are some USB and PHY driver fixes for 4.8-rc5

  Nothing major, lots of little fixes for reported bugs, and a build fix
  for a missing .h file that the phy drivers needed.  All of these have
  been in linux-next for a while with no reported issues"

* tag 'usb-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (24 commits)
  usb: musb: Fix locking errors for host only mode
  usb: dwc3: gadget: always decrement by 1
  usb: dwc3: debug: fix ep name on trace output
  usb: gadget: udc: core: don't starve DMA resources
  USB: serial: option: add WeTelecom 0x6802 and 0x6803 products
  USB: avoid left shift by -1
  USB: fix typo in wMaxPacketSize validation
  usb: gadget: Add the gserial port checking in gs_start_tx()
  usb: dwc3: gadget: don't rely on jiffies while holding spinlock
  usb: gadget: fsl_qe_udc: signedness bug in qe_get_frame()
  usb: gadget: function: f_rndis: socket buffer may be NULL
  usb: gadget: function: f_eem: socket buffer may be NULL
  usb: renesas_usbhs: gadget: fix return value check in usbhs_mod_gadget_probe()
  usb: dwc2: Add reset control to dwc2
  usb: dwc3: core: allow device to runtime_suspend several times
  usb: dwc3: pci: runtime_resume child device
  USB: serial: option: add WeTelecom WM-D200
  usb: chipidea: udc: don't touch DP when controller is in host mode
  USB: serial: mos7840: fix non-atomic allocation in write path
  USB: serial: mos7720: fix non-atomic allocation in write path
  ...
2016-09-03 11:24:23 -07:00
Linus Torvalds
3e423945ea devpts: return NULL pts 'priv' entry for non-devpts nodes
In commit 8ead9dd547 ("devpts: more pty driver interface cleanups") I
made devpts_get_priv() just return the dentry->fs_data directly.  And
because I thought it wouldn't happen, I added a warning if you ever saw
a pts node that wasn't on devpts.

And no, that warning never triggered under any actual real use, but you
can trigger it by creating nonsensical pts nodes by hand.

So just revert the warning, and make devpts_get_priv() return NULL for
that case like it used to.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: stable@vger.kernel.org # 4.6+
Cc: Eric W Biederman" <ebiederm@xmission.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-09-03 11:02:50 -07:00
Dan Williams
4c3cb6e9a9 dax: fix mapping size check
pgoff_to_phys() validates that both the starting address and the length
of the mapping against the resource list.  We need to check for a
mapping size of PMD_SIZE not PAGE_SIZE in the pmd fault path.

Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2016-09-03 10:40:57 -07:00
Linus Walleij
307fe9dd11 iio: accel: kxsd9: Fix scaling bug
All the scaling of the KXSD9 involves multiplication with a
fraction number < 1.

However the scaling value returned from IIO_INFO_SCALE was
unpredictable as only the micros of the value was assigned, and
not the integer part, resulting in scaling like this:

$cat in_accel_scale
-1057462640.011978

Fix this by assigning zero to the integer part.

Cc: stable@vger.kernel.org
Tested-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2016-09-03 18:30:45 +01:00
Olof Johansson
1c50084093 iio: accel: bmc150: reset chip at init time
In at least one known setup, the chip comes up in a state where reading
the chip ID returns garbage unless it's been reset, due to noise on the
wires during system boot.

All supported chips have the same reset method, and based on the
datasheets they all need 1.3 or 1.8ms to recover after reset. So, do
the conservative thing here and always reset the chip.

Signed-off-by: Olof Johansson <olof@lixom.net>
Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2016-09-03 17:26:14 +01:00
Kweh, Hock Leong
36afb176d3 iio: fix pressure data output unit in hid-sensor-attributes
According to IIO ABI definition, IIO_PRESSURE data output unit is
kilopascal:
http://lxr.free-electrons.com/source/Documentation/ABI/testing/sysfs-bus-iio

This patch fix output unit of HID pressure sensor IIO driver from pascal to
kilopascal to follow IIO ABI definition.

Signed-off-by: Kweh, Hock Leong <hock.leong.kweh@intel.com>
Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2016-09-03 17:09:58 +01:00
Mark Brown
787ad90332 Merge remote-tracking branch 'regmap/fix/rbtree' into regmap-linus 2016-09-03 12:10:09 +01:00
Mark Brown
f735aa2790 Merge remote-tracking branch 'regmap/fix/cache' into regmap-linus 2016-09-03 12:10:08 +01:00
Sien Wu
d0716dde37 spi: Prevent unexpected SPI time out due to arithmetic overflow
When reading SPI flash as MTD device, the transfer length is
directly passed to the spi driver. If the requested data size
exceeds 512KB, it will cause the time out calculation to
overflow since transfer length is 32-bit unsigned integer.
This issue is resolved by using 64-bit unsigned integer
to perform the arithmetic.

Signed-off-by: Sien Wu <sien.wu@ni.com>
Acked-by: Brad Keryan <brad.keryan@ni.com>
Acked-by: Gratian Crisan <gratian.crisan@ni.com>
Acked-by: Brad Mouring <brad.mouring@ni.com>

Natinst-ReviewBoard-ID 150232
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-09-03 11:58:13 +01:00
Linus Torvalds
0141af184a Merge branch 'for-linus' of git://git.kernel.dk/linux-block
Pull block fixes from Jens Axboe:
 "A collection of fixes for the nvme over fabrics code"

* 'for-linus' of git://git.kernel.dk/linux-block:
  nvme-rdma: Get rid of redundant defines
  nvme-rdma: Get rid of duplicate variable
  nvme: fabrics drivers don't need the nvme-pci driver
  nvme-fabrics: get a reference when reusing a nvme_host structure
  nvme-fabrics: change NQN UUID to big-endian format
  nvme-loop: set sqsize to 0-based value, per spec
  nvme-rdma: fix sqsize/hsqsize per spec
  fabrics: define admin sqsize min default, per spec
  nvmet-rdma: +1 to *queue_size from hsqsize/hrqsize
  nvmet-rdma: Fix use after free
  nvme-rdma: initialize ret to zero to avoid returning garbage
2016-09-02 21:05:38 -07:00
David S. Miller
312565a0c3 Merge branch 'smsc911x-fixes'
Jeremy Linton says:

====================
net: smsc911x: Move phy and interrupt config

v2-v3: Move error handing into separate patch, replace a couple cases
 of fixed errors with the errors being returned from the failing functions.
 Hoist irq handler.

The smsc911x driver is doing a number of things in its probe routine that
should be delayed until the interface is started. Because of this, the module
cannot be unloaded, the phy states are incorrect/stale if the interface isn't
running, open's unnecessarily fail causing network configuration problems, and
the /proc/irq nodes are incorrectly named.

Clean up a number of these problems by moving the mdio and interrupt
configuration into the smsc911x_open routine.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-02 17:28:34 -07:00
Jeremy Linton
f252974eaa net: smsc911x: Move interrupt allocation to open/stop
The /proc/irq/xx information is incorrect for smsc911x because
the request_irq is happening before the register_netdev has the
proper device name. Moving it to the open also fixes the case
of when the device is renamed.

Reported-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Tested-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-02 17:28:33 -07:00
Jeremy Linton
a85f00c36e net: smsc911x: Move interrupt handler before open
In preparation for the allocating/enabling interrupts
in the ndo_open routine move the irq handler before it.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-02 17:28:33 -07:00
Jeremy Linton
aea95dd52d net: smsc911x: Fix register_netdev, phy startup, driver unload ordering
Move phy startup/shutdown into the smsc911x_open/stop routines. This
allows the module to be unloaded because phy_connect_direct is no longer
always holding the module use count. This one change also resolves a
number of other problems.

The link status of a downed interface no longer reflects a stale state.
Errors caused by the net device being opened before the mdio/phy was
configured. There is also a potential power savings as the phy's don't
remain powered when the interface isn't running.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-02 17:28:33 -07:00
Jeremy Linton
1358bd5a74 net: smsc911x: Remove multiple exit points from smsc911x_open
Rework the error handling in smsc911x open in preparation
for the mdio startup being moved here.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-02 17:28:33 -07:00
Linus Torvalds
0ddc9e5a11 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull TPM bugfix from James Morris.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  tpm: invalid self test error message
2016-09-02 15:33:54 -07:00
Jarkko Sakkinen
4a29b3484f tpm: invalid self test error message
The driver emits invalid self test error message even though the init
succeeds.

Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Fixes: cae8b441fc ("tpm: Factor out common startup code")
Reviewed-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
2016-09-03 08:27:37 +10:00
Linus Torvalds
601b586994 ACPI fixes for v4.8-rc5
Two stable-candidate fixes for the ACPI early device probing code
 added during the 4.4 cycle, one fixing a typo in a stub macro used
 when CONFIG_ACPI is unset and one that prevents sleeping functions
 from being called under a spinlock (Lorenzo Pieralisi).
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABCAAGBQJXyex0AAoJEILEb/54YlRxdlsP/jMcKQ/6dPNxaZjr+073m9/X
 J7SGlzN8JeO5JdKHoTrfjI50tb1JUf+giZD72/v5f6/LjKJTCQAPqTRBKdhvBc0B
 glqUvHVA0Pvag4tCKLlb8amF1hcYg4Gb14wzyk6IOq0bfeNdOm4vOIMZUOFcOZzO
 eTXzne5e7OUpcmRaO07wv/QCKxi0dpW4CAQobhO18CJ9dw66D/wUNfCO7Bq10Hm8
 ZcgEjxW4tcltJuffw9w8Qxi9bbGTscG7BxRcOM0E9MC32xFuk+Os5y+dq47qtCTq
 NQiar/bZC/NY9OcmSF7H0UwMVRar44LlQtxjCefcJzYS9xMbPgwgcecfe8gOBI/q
 Fmj+tPC1y2QJQFQWbJT1uW8aRJzt4mKHe+GutXUhTiJWQ0DUj7IFVR11OfR5K0Fd
 uB2Cf0waOSAnS3lOmAS4hLJAVL5fhl4bmTtDbDNU8wSTt7opMM38ltL1qfX8sgiR
 Ig9tYW4IVEZuZPqIsdcQ1FOtnitZ9RXIcWuR1aYNadqimZqVO+78KjdnfxQ0e5Fs
 KBOde+Pb7DogZbF11dbErjXTPsBfP6WYC3nIsxZmg9VefipNqt4PSy4ZQUZctVv9
 8ENuv0GMHkK1qdgcet+v7mwgDYyGHeL45j6zjuLNgN35FsbyZRhzQ0EeDQAfMCeT
 fjHCLBtYGJ6J/Du4dly3
 =tsb6
 -----END PGP SIGNATURE-----

Merge tag 'acpi-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI fixes ffrom Rafael Wysocki:
 "Two stable-candidate fixes for the ACPI early device probing code
  added during the 4.4 cycle, one fixing a typo in a stub macro used
  when CONFIG_ACPI is unset and one that prevents sleeping functions
  from being called under a spinlock (Lorenzo Pieralisi)"

* tag 'acpi-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI / drivers: replace acpi_probe_lock spinlock with mutex
  ACPI / drivers: fix typo in ACPI_DECLARE_PROBE_ENTRY macro
2016-09-02 15:16:04 -07:00
Linus Torvalds
9a0bcc8fe7 Power management fixes for v4.8-rc5
- Fix the definition of the cpufreq-dt driver's machines table
    introduced during the 4.7 cycle that should be NULL-terminated,
    but the termination entry is missing from it (Wei Yongjun).
 
  - Annotate tracepoints in the runtime PM framework's core so as to
    allow the functions containing them to be called from the idle
    code path without causing RCU to complain about illegal usage
    (Paul McKenney).
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABCAAGBQJXyevXAAoJEILEb/54YlRxOy0QAKwNA4OH2gwUh+60j/wRK5pL
 gGb60iJo8rgG2X0VswD4lae1QB/SUn9ehRbca2bq0Ql1HQ8d+RxCaVFRHpp09WZs
 GqpGbByp4GOzKgYbeTj5bZDX0A4c5zjjp0fZaY15+8tyPEXqcc/koZOWX9DM5JiN
 Q/SkCnlxYo0kKX/WnfveYnCk8Yzy7sj0H4H083dgUaWzG/4/hliXPv8Fum3UrIKU
 Fotft/oY+9NR1C1+NgDBHfgTlZZ3PKEqHT1Okvmv6NTMe114EfPnV+UwNiOn6L9g
 iqVtK9hFOg3kweuHfsf9pSnVjsU2nh6/up4BI76zlAKqEQa/Vrsy9FBbsD7dXPiL
 He6LIBbsxnH0/6w3rcPlsr63EpFPFBbdL2ZXtrVnU8TbdofgpTlX6q38jyoNFg3B
 cfNy/d1kHYpjI5psKtxFtUr8T+ARpAKO9A+vV4qZndtwjP9XVu58NJFgomHlSWyz
 ZXVc3FIuLIQ6Gd2QzT+xq5Hsdr5xd+v65kSn2ZL2tXkUQDmHwKvzrPj63AXupThW
 gAmfIJO83Tre+fSPOoG5SNGUrMD80RXEFUJlgXphzN5HhejCznEqubIJIV5oitcw
 33CNtYxPesLmMFuOQOYd4aVVTwmrElrnI23+x/Er3f0N6cxpphhDdjPwauhV5Rpe
 lqdYZtxebiFSgzqKViYv
 =Jsm8
 -----END PGP SIGNATURE-----

Merge tag 'pm-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fixes from Rafael Wysocki:
 "This includes a stable-candidate cpufreq-dt driver problem fix and
  annotations of tracepoints in the runtime PM framework.

  Specifics:

   - Fix the definition of the cpufreq-dt driver's machines table
     introduced during the 4.7 cycle that should be NULL-terminated, but
     the termination entry is missing from it (Wei Yongjun).

   - Annotate tracepoints in the runtime PM framework's core so as to
     allow the functions containing them to be called from the idle code
     path without causing RCU to complain about illegal usage (Paul
     McKenney)"

* tag 'pm-4.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  PM / runtime: Add _rcuidle suffix to allow rpm_idle() use from idle
  PM / runtime: Add _rcuidle suffix to allow rpm_resume() to be called from idle
  cpufreq: dt: Add terminate entry for of_device_id tables
2016-09-02 15:07:41 -07:00
Rafael J. Wysocki
b654c62e77 Merge branches 'pm-cpufreq-fixes' and 'pm-core-fixes'
* pm-cpufreq-fixes:
  cpufreq: dt: Add terminate entry for of_device_id tables

* pm-core-fixes:
  PM / runtime: Add _rcuidle suffix to allow rpm_idle() use from idle
  PM / runtime: Add _rcuidle suffix to allow rpm_resume() to be called from idle
2016-09-02 22:38:30 +02:00
Lorenzo Pieralisi
5331d9cab3 ACPI / drivers: replace acpi_probe_lock spinlock with mutex
Commit e647b53227 ("ACPI: Add early device probing infrastructure")
introduced code that allows inserting driver specific
struct acpi_probe_entry probe entries into ACPI linker sections
(one per-subsystem, eg irqchip, clocksource) that are then walked
to retrieve the data and function hooks required to probe the
respective kernel components.

Probing for all entries in a section is triggered through
the __acpi_probe_device_table() function, that in turn, according
to the table ID a given probe entry reports parses the table
with the function retrieved from the respective section structures
(ie struct acpi_probe_entry). Owing to the current ACPI table
parsing implementation, the __acpi_probe_device_table() function
has to share global variables with the acpi_match_madt() function, so
in order to guarantee mutual exclusion locking is required
between the two functions.

Current kernel code implements the locking through the acpi_probe_lock
spinlock; this has the side effect of requiring all code called
within the lock (ie struct acpi_probe_entry.probe_{table/subtbl} hooks)
not to sleep.

However, kernel subsystems that make use of the early probing
infrastructure are relying on kernel APIs that may sleep (eg
irq_domain_alloc_fwnode(), among others) in the function calls
pointed at by struct acpi_probe_entry.{probe_table/subtbl} entries
(eg gic_v2_acpi_init()), which is a bug.

Since __acpi_probe_device_table() is called from context
that is allowed to sleep the acpi_probe_lock spinlock can be replaced
with a mutex; this fixes the issue whilst still guaranteeing
mutual exclusion.

Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Fixes: e647b53227 (ACPI: Add early device probing infrastructure)
Cc: 4.4+ <stable@vger.kernel.org> # 4.4+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-09-02 22:22:21 +02:00
Lorenzo Pieralisi
3feab13c91 ACPI / drivers: fix typo in ACPI_DECLARE_PROBE_ENTRY macro
When the ACPI_DECLARE_PROBE_ENTRY macro was added in
commit e647b53227 ("ACPI: Add early device probing infrastructure"),
a stub macro adding an unused entry was added for the !CONFIG_ACPI
Kconfig option case to make sure kernel code making use of the
macro did not require to be guarded within CONFIG_ACPI in order to
be compiled.

The stub macro was never used since all kernel code that defines
ACPI_DECLARE_PROBE_ENTRY entries is currently guarded within
CONFIG_ACPI; it contains a typo that should be nonetheless fixed.

Fix the typo in the stub (ie !CONFIG_ACPI) ACPI_DECLARE_PROBE_ENTRY()
macro so that it can actually be used if needed.

Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Fixes: e647b53227 (ACPI: Add early device probing infrastructure)
Cc: 4.4+ <stable@vger.kernel.org> # 4.4+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-09-02 22:21:34 +02:00
Sabrina Dubroca
2f86953e74 l2tp: fix use-after-free during module unload
Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq
 -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU ->
l2tp_tunnel_destruct).

By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish
destroying the socket, the private data reserved via the net_generic
mechanism has already been freed, but l2tp_tunnel_destruct() actually
uses this data.

Make sure tunnel deletion for the netns has completed before returning
from l2tp_exit_net() by first flushing the tunnel removal workqueue, and
then waiting for RCU callbacks to complete.

Fixes: 167eb17e0b ("l2tp: create tunnel sockets in the right namespace")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-02 11:44:44 -07:00
Emanuel Czirai
d199299675 x86/AMD: Apply erratum 665 on machines without a BIOS fix
AMD F12h machines have an erratum which can cause DIV/IDIV to behave
unpredictably. The workaround is to set MSRC001_1029[31] but sometimes
there is no BIOS update containing that workaround so let's do it
ourselves unconditionally. It is simple enough.

[ Borislav: Wrote commit message. ]

Signed-off-by: Emanuel Czirai <icanrealizeum@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Yaowu Xu <yaowu@google.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/20160902053550.18097-1-bp@alien8.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2016-09-02 20:42:28 +02:00
Mike Marciniszyn
16170d9c10 IB/hfi1: Rework debugfs to use SRCU
The debugfs RCU trips many debug kernel warnings because of potential
sleeps with an RCU read lock held. This includes both user copy calls
and slab allocations throughout the file.

This patch switches the RCU to use SRCU for file remove/access
race protection.

In one case, the SRCU is implicit in the use of the raw debugfs file
object and just works.

In the seq_file case, a wrapper around seq_read() and seq_lseek() is
used to enforce the SRCU using the debugfs supplied functions
debugfs_use_file_start() and debugfs_use_file_stop().

The sychronize_rcu() is deleted since the SRCU prevents the remove
access race.

The RCU locking is kept for qp_stats since the QP hash list is
protected using the non-sleepable RCU.

Reviewed-by: Sebastian Sanchez <sebastian.sanchez@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:26:55 -04:00
Harish Chegondi
429b6a7217 IB/hfi1: Make n_krcvqs be an unsigned long integer
The global variable n_krcvqs stores the sum of the number of kernel
receive queues of VLs 0-7 which the user can pass to the driver through
the module parameter array krcvqs which is of type unsigned integer. If
the user passes large value(s) into krcvqs parameter array, it can cause
an arithmetic overflow while calculating n_krcvqs which is also of type
unsigned int. The overflow results in an incorrect value of n_krcvqs
which can lead to kernel crash while loading the driver.

Fix by changing the data type of n_krcvqs to unsigned long. This patch
also changes the data type of other variables that get their values from
n_krcvqs.

Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Harish Chegondi <harish.chegondi@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:26:55 -04:00
Dean Luick
673b975f1f IB/hfi1: Add QSFP sanity pre-check
Sometimes a QSFP device does not respond in the expected time
after a power-on.  Add a read pre-check/retry when starting
the link on driver load.

Reviewed-by: Easwar Hariharan <easwar.hariharan@intel.com>
Signed-off-by: Dean Luick <dean.luick@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:26:55 -04:00
Jubin John
af53493916 IB/hfi1: Fix AHG KDETH Intr shift
In the set_txreq_header_ahg(), The KDETH Intr bit is obtained from the
header in the user sdma request using a KDETH_GET shift and mask macro.
This value is then futher right shifted by 16 causing us to lose the
value i.e it is shifted to zero, leading to the following
smatch warning:
drivers/infiniband/hw/hfi1/user_sdma.c:1482 set_txreq_header_ahg()
warn: mask and shift to zero

The Intr bit should be left shifted into its correct position in the
KDETH header before the AHG update.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com>
Reviewed-by: Harish Chegondi <harish.chegondi@intel.com>
Signed-off-by: Jubin John <jubin.john@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:26:55 -04:00
Sebastian Sanchez
3e6c3b0fd5 IB/hfi1: Fix SGE length for misaligned PIO copy
When trying to align the source pointer and there's a byte carry
in an SGE copy, bytes are borrowed from the next quad-word X to
complete the required quad-word copy. Then, the SGE length is
reduced by the number of borrowed bytes. After this, if the
remaining number of bytes from quad-word X (extra bytes) is
greater than the new SGE length, the number of extra bytes needs
to be updated to the new SGE length. Otherwise, when the
SGE length gets updated again after the extra bytes are read to
create the new byte carry, it goes negative, which then becomes
a very large number as the SGE length is an unsigned integer.
This causes SGE buffer to be over-read.

Reviewed-by: Dean Luick <dean.luick@intel.com>
Signed-off-by: Sebastian Sanchez <sebastian.sanchez@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:26:55 -04:00
Leon Romanovsky
dbdf7d4e7f IB/mlx5: Don't return errors from poll_cq
Remove returning errors from mlx5 poll_cq function. Polling CQ
operation in kernel never fails by Mellanox HCA architecture and
respective driver design.

Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:11:40 -04:00
Yishai Hadas
d9f88e5ab9 IB/mlx5: Use TIR number based on selector
Use TIR number based on selector, it should be done to differentiate
between RSS QP to RAW one.

Reported-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Tested-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:11:40 -04:00
Leon Romanovsky
b2a232d21f IB/mlx5: Simplify code by removing return variable
Return variable was set in a line before the
actual return was called in begin_wqe function.

This patch removes such variable and simplifies the code.

Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:11:39 -04:00
Chuck Lever
24be409bee IB/mlx5: Return EINVAL when caller specifies too many SGEs
The returned value should be EINVAL, because it is caused by wrong
caller and not by internal overflow event.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:11:39 -04:00
Leon Romanovsky
20697434b6 IB/mlx4: Don't return errors from poll_cq
Remove returning errors from mlx4 poll_cq function. Polling CQ
operation in kernel never fails by Mellanox HCA architecture and
respective driver design.

Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:11:38 -04:00
Leon Romanovsky
25b64fc5f2 Revert "IB/mlx4: Return EAGAIN for any error in mlx4_ib_poll_one"
By Mellanox HW design and SW implementation, poll_cq never
fails and returns errors, so all these printks are to catch ULP bugs.

In case of such bug, the reverted patch will cause reentry of the
function, resulting in a printk storm.

This reverts commit 5412352fcd ("IB/mlx4: Return EAGAIN for any error in mlx4_ib_poll_one")

Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:09:14 -04:00
Erez Shitrit
546481c281 IB/ipoib: Fix memory corruption in ipoib cm mode connect flow
When a new CM connection is being requested, ipoib driver copies data
from the path pointer in the CM/tx object, the path object might be
invalid at the point and memory corruption will happened later when now
the CM driver will try using that data.

The next scenario demonstrates it:
	neigh_add_path --> ipoib_cm_create_tx -->
	queue_work (pointer to path is in the cm/tx struct)
	#while the work is still in the queue,
	#the port goes down and causes the ipoib_flush_paths:
	ipoib_flush_paths --> path_free --> kfree(path)
	#at this point the work scheduled starts.
	ipoib_cm_tx_start --> copy from the (invalid)path pointer:
	(memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);)
	 -> memory corruption.

To fix that the driver now starts the CM/tx connection only if that
specific path exists in the general paths database.
This check is protected with the relevant locks, and uses the gid from
the neigh member in the CM/tx object which is valid according to the ref
count that was taken by the CM/tx.

Fixes: 839fcaba35 ('IPoIB: Connected mode experimental support')
Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:07:38 -04:00
Erez Shitrit
68c6bcdd8b IB/core: Fix use after free in send_leave function
The function send_leave sets the member: group->query_id
(group->query_id = ret) after calling the sa_query, but leave_handler
can be executed before the setting and it might delete the group object,
and will get a memory corruption.

Additionally, this patch gets rid of group->query_id variable which is
not used.

Fixes: faec2f7b96 ('IB/sa: Track multicast join/leave requests')
Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:06:27 -04:00